create-nifra 3.5.0 → 4.0.2

package/dist/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAGnD,OAAO,EAAE,UAAU,EAAgC,MAAM,SAAS,CAAA;AAElE,MAAM,eAAe,GAAwC;IAC3D,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACjB,CAAA;AAED,iFAAiF;AACjF,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsEjB,CAAA;AAED,wFAAwF;AACxF,SAAS,QAAQ,CAAC,SAAoB;IACpC,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IACxC,OAAO,4CAA4C,KAAK;;;;;;;;;8DASI,SAAS;;;;;;;;;;;;;;CActE,CAAA;AACD,CAAC;AAED,oGAAoG;AACpG,SAAS,WAAW,CAAC,GAAoB;IACvC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,OAAO;;;;;;;;;;;;;;;;;+FAiBoF,CAAA;IAC7F,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,OAAO;;;;;;;;;;;;;;;;;;oEAkByD,CAAA;IAClE,CAAC;IACD,OAAO;;;;;;;;;;;;;;;;;iFAiBwE,CAAA;AACjF,CAAC;AAED,mGAAmG;AACnG,SAAS,OAAO,CAAC,EAAY;IAC3B,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IACxB,OAAO,gBAAgB,CAAC,CAAC,KAAK;;EAE9B,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI;;;;+GAIiF,CAAA;AAC/G,CAAC;AAED,yGAAyG;AACzG,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;sHAyB6G,CAAA;AACtH,CAAC;AAED,MAAM,cAAc,GAAG;;;;;;;;;;;;;CAatB,CAAA;AAED,MAAM,QAAQ,GAA2C;IACvD,GAAG,EAAE;;;kFAG2E;IAChF,IAAI,EAAE;;;;;;;;4GAQoG;IAC1G,GAAG,EAAE;;;;;;;0GAOmG;IACxG,SAAS,EAAE;;;;;;;8GAOiG;CAC7G,CAAA;AAED,uFAAuF;AACvF,MAAM,IAAI,GAAG;;;;;;;iGAOoF,CAAA;AAYjG,+DAA+D;AAC/D,MAAM,UAAU,QAAQ,CAAC,IAAqB;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAA;IACjE,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC,2FAA2F,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ;QACpI,CAAC,CAAC,4DAA4D,CAAA;IAEhE,sGAAsG;IACtG,8FAA8F;IAC9F,MAAM,MAAM,GAAG;QACb,iBAAiB,IAAI,CAAC,IAAI,mEAAmE,IAAI,kHAAkH;QACnN,kBAAkB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAC3C,mGAAmG;QACnG,6FAA6F;QAC7F,gBAAgB,EAAE;QAClB,SAAS,CAAC,IAAI,EAAE;QAChB,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QAC7C,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QACnD,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QAC5C,cAAc,CAAC,IAAI,EAAE;QACrB,IAAI;QACJ,8QAA8Q;KAC/Q,CAAA;IACD,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAA;AACnD,CAAC"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAG3E,OAAO,EAAE,UAAU,EAAgC,MAAM,SAAS,CAAA;AAElE,MAAM,eAAe,GAAwC;IAC3D,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACjB,CAAA;AAED,iFAAiF;AACjF,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyEjB,CAAA;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,SAAoB;IACpC,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IACxC,OAAO,4CAA4C,KAAK;;;;;;;;;8DASI,SAAS;;;;;;;EAOrE,sBAAsB,EAAE;CACzB,CAAA;AACD,CAAC;AAED,oGAAoG;AACpG,SAAS,WAAW,CAAC,GAAoB;IACvC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,OAAO;;;;;;;;;;;;;;;;;+FAiBoF,CAAA;IAC7F,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,OAAO;;;;;;;;;;;;;;;;;;uFAkB4E,CAAA;IACrF,CAAC;IACD,OAAO;;;;;;;;;;;;;;;;;8GAiBqG,CAAA;AAC9G,CAAC;AAED,mGAAmG;AACnG,SAAS,OAAO,CAAC,EAAY;IAC3B,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IACxB,OAAO,gBAAgB,CAAC,CAAC,KAAK;;EAE9B,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI;;;;mFAIqD,CAAA;AACnF,CAAC;AAED,yGAAyG;AACzG,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA2BY,CAAA;AACrB,CAAC;AAED,MAAM,cAAc,GAAG;;;;;;;;;;;;;CAatB,CAAA;AAED,MAAM,QAAQ,GAA2C;IACvD,GAAG,EAAE;;;kFAG2E;IAChF,IAAI,EAAE;;;;;;kFAM0E;IAChF,GAAG,EAAE;;;;;;kFAM2E;IAChF,SAAS,EAAE;;;;;;;8GAOiG;CAC7G,CAAA;AAED,uFAAuF;AACvF,MAAM,IAAI,GAAG;;;;;;;iGAOoF,CAAA;AAYjG,+DAA+D;AAC/D,MAAM,UAAU,QAAQ,CAAC,IAAqB;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAA;IACjE,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC,2FAA2F,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ;QACpI,CAAC,CAAC,4DAA4D,CAAA;IAEhE,sGAAsG;IACtG,8FAA8F;IAC9F,MAAM,MAAM,GAAG;QACb,iBAAiB,IAAI,CAAC,IAAI,mEAAmE,IAAI,kHAAkH;QACnN,kBAAkB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAC3C,mGAAmG;QACnG,6FAA6F;QAC7F,gBAAgB,EAAE;QAClB,SAAS,CAAC,IAAI,EAAE;QAChB,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QAC7C,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QACnD,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QAC5C,cAAc,CAAC,IAAI,EAAE;QACrB,IAAI;QACJ,8QAA8Q;KAC/Q,CAAA;IACD,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAA;AACnD,CAAC"}

package/dist/auth.d.ts

@@ -2,9 +2,10 @@
  * `--auth better-auth` - wire authentication into a scaffolded app, the same "bundle the right tool,
  * correctly" move as `--db`. nifra owns the *mount* (`@nifrajs/better-auth` plugs better-auth's handler
  * into a `server()` and gives typed `getSession`/`requireSession` guards); better-auth owns the auth
- * logic. Auth needs a database, so this composes with `--db`: the generated `auth.ts` reuses the client
- * from `./db` via better-auth's adapter for the chosen ORM (`drizzleAdapter` / `prismaAdapter`). The
- * agent then runs `bunx @better-auth/cli generate` to add the auth tables and migrates.
+ * logic. Auth needs a database, so this composes with `--db`: the generated `backend/auth.ts` reuses
+ * the client from `./db` via better-auth's adapter for the chosen ORM (`drizzleAdapter` /
+ * `prismaAdapter`). The agent then runs `bunx @better-auth/cli generate` to add the auth tables and
+ * migrates.
  *
  * `--auth` therefore requires `--db` (the CLI enforces it). better-auth's clean adapters cover Drizzle
  * and Prisma; Kysely is rejected (it has no drop-in adapter - wire better-auth's own dialect manually).
@@ -25,6 +26,6 @@ export interface AuthPreset {
     readonly deps: Readonly<Record<string, string>>;
 }
 export declare const AUTH_PRESETS: Readonly<Record<AuthChoice, AuthPreset>>;
-/** Write `auth.ts` and append the auth env vars to the (db-preset-created) `.env.example`. */
+/** Write `backend/auth.ts` and append the auth env vars to the (db-preset-created) `.env.example`. */
 export declare function writeAuthFiles(target: string, _auth: AuthChoice, db: DbChoice): Promise<void>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAc,KAAK,QAAQ,EAAY,MAAM,SAAS,CAAA;AAE7D,eAAO,MAAM,YAAY,0BAA2B,CAAA;AACpD,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAA;AAKtD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAQnD;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAChD;AAED,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAOjE,CAAA;AAiDD,8FAA8F;AAC9F,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,QAAQ,GACX,OAAO,CAAC,IAAI,CAAC,CAKf"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAc,KAAK,QAAQ,EAAY,MAAM,SAAS,CAAA;AAE7D,eAAO,MAAM,YAAY,0BAA2B,CAAA;AACpD,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAA;AAKtD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAQnD;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAChD;AAED,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAOjE,CAAA;AA6DD,sGAAsG;AACtG,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,QAAQ,GACX,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/auth.js

@@ -2,9 +2,10 @@
  * `--auth better-auth` - wire authentication into a scaffolded app, the same "bundle the right tool,
  * correctly" move as `--db`. nifra owns the *mount* (`@nifrajs/better-auth` plugs better-auth's handler
  * into a `server()` and gives typed `getSession`/`requireSession` guards); better-auth owns the auth
- * logic. Auth needs a database, so this composes with `--db`: the generated `auth.ts` reuses the client
- * from `./db` via better-auth's adapter for the chosen ORM (`drizzleAdapter` / `prismaAdapter`). The
- * agent then runs `bunx @better-auth/cli generate` to add the auth tables and migrates.
+ * logic. Auth needs a database, so this composes with `--db`: the generated `backend/auth.ts` reuses
+ * the client from `./db` via better-auth's adapter for the chosen ORM (`drizzleAdapter` /
+ * `prismaAdapter`). The agent then runs `bunx @better-auth/cli generate` to add the auth tables and
+ * migrates.
  *
  * `--auth` therefore requires `--db` (the CLI enforces it). better-auth's clean adapters cover Drizzle
  * and Prisma; Kysely is rejected (it has no drop-in adapter - wire better-auth's own dialect manually).
@@ -25,15 +26,15 @@ export function assertAuthableDb(db) {
     const { orm } = DB_PRESETS[db];
     if (!AUTHABLE_ORMS.has(orm)) {
         throw new Error(`--auth better-auth doesn't scaffold for --db ${db} (${orm} has no drop-in better-auth adapter). ` +
-            "Use a drizzle-* or prisma-* preset, or wire better-auth's database dialect manually in auth.ts.");
+            "Use a drizzle-* or prisma-* preset, or wire better-auth's database dialect manually in backend/auth.ts.");
     }
 }
 export const AUTH_PRESETS = {
     "better-auth": {
         label: "better-auth",
-        note: "email/password + sessions, mounted at /api/auth/* - add OAuth providers in auth.ts.",
+        note: "email/password + sessions, mounted at /api/auth/* - add OAuth providers in backend/auth.ts.",
         // @nifrajs/better-auth mounts it; better-auth is the implementation (peer-installed alongside).
-        deps: { "@nifrajs/better-auth": "^3.5.0", "better-auth": "^1.2.0" },
+        deps: { "@nifrajs/better-auth": "^4.0.2", "better-auth": "^1.2.0" },
     },
 };
 /** The better-auth `database` adapter expression + its import line, for the scaffolded DB's ORM. */
@@ -54,36 +55,48 @@ function adapterFor(db) {
         database: `drizzleAdapter(db, { provider: "${provider}" })`,
     };
 }
-/** The generated `auth.ts` - a better-auth instance backed by the scaffolded DB client. */
+/** The generated `backend/auth.ts` - a better-auth instance backed by the scaffolded DB client. */
 function authModule(db) {
     const { importLine, database } = adapterFor(db);
     return `import { betterAuth as createBetterAuth } from "better-auth"
 ${importLine}
 import { db } from "./db"
 
-// better-auth stores users + sessions in your database (the same one in db/). After editing the config
+// better-auth stores users + sessions in your database (backend/db/). After editing the config
 // (e.g. adding OAuth providers), generate its tables: \`bunx @better-auth/cli generate\` writes the auth
 // schema for your ORM, then \`bun run db:migrate\` applies it.
+
+// Set in .env: openssl rand -base64 32. better-auth refuses a missing secret in production but only
+// warns about a short one, so a short one is refused here.
+const secret = process.env.BETTER_AUTH_SECRET
+if (process.env.NODE_ENV === "production" && secret && secret.length < 32) {
+  throw new Error(
+    "BETTER_AUTH_SECRET is shorter than 32 characters. Generate one with: openssl rand -base64 32",
+  )
+}
+
 export const auth = createBetterAuth({
   database: ${database},
   emailAndPassword: { enabled: true },
-  // Set in .env - generate a strong value: openssl rand -base64 32
-  secret: process.env.BETTER_AUTH_SECRET,
+  secret,
   baseURL: process.env.BETTER_AUTH_URL,
 })
 
 export type Auth = typeof auth
 `;
 }
+// No placeholder secret: left empty, better-auth uses its development secret locally and refuses to
+// start in production, where a placeholder would only draw a warning.
 const ENV = `
-# better-auth - REQUIRED. Generate a 32+ char secret: openssl rand -base64 32
-BETTER_AUTH_SECRET="change-me-before-production"
+# better-auth - REQUIRED in production. Generate a 32+ char secret: openssl rand -base64 32
+# Left empty, development uses better-auth's built-in secret and production refuses to start.
+BETTER_AUTH_SECRET=""
 BETTER_AUTH_URL="http://localhost:3000"
 `;
-/** Write `auth.ts` and append the auth env vars to the (db-preset-created) `.env.example`. */
+/** Write `backend/auth.ts` and append the auth env vars to the (db-preset-created) `.env.example`. */
 export async function writeAuthFiles(target, _auth, db) {
     assertAuthableDb(db); // defensive: the CLI already checks, but never emit a broken adapter import
-    await writeFile(join(target, "auth.ts"), authModule(db));
+    await writeFile(join(target, "backend/auth.ts"), authModule(db));
     // .env.example already exists (the DB preset wrote it; `--auth` requires `--db`); append, don't clobber.
     await appendFile(join(target, ".env.example"), ENV);
 }

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,UAAU,EAA2B,MAAM,SAAS,CAAA;AAE7D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,aAAa,CAAU,CAAA;AAGpD,uGAAuG;AACvG,MAAM,aAAa,GAAqB,IAAI,GAAG,CAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAA;AAE3E;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAY;IAC3C,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IAC9B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,gDAAgD,EAAE,KAAK,GAAG,wCAAwC;YAChG,iGAAiG,CACpG,CAAA;IACH,CAAC;AACH,CAAC;AAQD,MAAM,CAAC,MAAM,YAAY,GAA6C;IACpE,aAAa,EAAE;QACb,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,qFAAqF;QAC3F,gGAAgG;QAChG,IAAI,EAAE,EAAE,sBAAsB,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE;KACpE;CACF,CAAA;AAED,oGAAoG;AACpG,SAAS,UAAU,CAAC,EAAY;IAC9B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IACvC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,yFAAyF;QACzF,MAAM,QAAQ,GAAG,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAA;QACjE,OAAO;YACL,UAAU,EAAE,6DAA6D;YACzE,QAAQ,EAAE,kCAAkC,QAAQ,MAAM;SAC3D,CAAA;IACH,CAAC;IACD,0FAA0F;IAC1F,MAAM,QAAQ,GAAG,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAA;IACzD,OAAO;QACL,UAAU,EAAE,+DAA+D;QAC3E,QAAQ,EAAE,mCAAmC,QAAQ,MAAM;KAC5D,CAAA;AACH,CAAC;AAED,2FAA2F;AAC3F,SAAS,UAAU,CAAC,EAAY;IAC9B,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IAC/C,OAAO;EACP,UAAU;;;;;;;cAOE,QAAQ;;;;;;;;CAQrB,CAAA;AACD,CAAC;AAED,MAAM,GAAG,GAAG;;;;CAIX,CAAA;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,KAAiB,EACjB,EAAY;IAEZ,gBAAgB,CAAC,EAAE,CAAC,CAAA,CAAC,4EAA4E;IACjG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACxD,yGAAyG;IACzG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,GAAG,CAAC,CAAA;AACrD,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,UAAU,EAA2B,MAAM,SAAS,CAAA;AAE7D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,aAAa,CAAU,CAAA;AAGpD,uGAAuG;AACvG,MAAM,aAAa,GAAqB,IAAI,GAAG,CAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAA;AAE3E;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAY;IAC3C,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IAC9B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,gDAAgD,EAAE,KAAK,GAAG,wCAAwC;YAChG,yGAAyG,CAC5G,CAAA;IACH,CAAC;AACH,CAAC;AAQD,MAAM,CAAC,MAAM,YAAY,GAA6C;IACpE,aAAa,EAAE;QACb,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,6FAA6F;QACnG,gGAAgG;QAChG,IAAI,EAAE,EAAE,sBAAsB,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE;KACpE;CACF,CAAA;AAED,oGAAoG;AACpG,SAAS,UAAU,CAAC,EAAY;IAC9B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IACvC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,yFAAyF;QACzF,MAAM,QAAQ,GAAG,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAA;QACjE,OAAO;YACL,UAAU,EAAE,6DAA6D;YACzE,QAAQ,EAAE,kCAAkC,QAAQ,MAAM;SAC3D,CAAA;IACH,CAAC;IACD,0FAA0F;IAC1F,MAAM,QAAQ,GAAG,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAA;IACzD,OAAO;QACL,UAAU,EAAE,+DAA+D;QAC3E,QAAQ,EAAE,mCAAmC,QAAQ,MAAM;KAC5D,CAAA;AACH,CAAC;AAED,mGAAmG;AACnG,SAAS,UAAU,CAAC,EAAY;IAC9B,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IAC/C,OAAO;EACP,UAAU;;;;;;;;;;;;;;;;;cAiBE,QAAQ;;;;;;;CAOrB,CAAA;AACD,CAAC;AAED,oGAAoG;AACpG,sEAAsE;AACtE,MAAM,GAAG,GAAG;;;;;CAKX,CAAA;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,KAAiB,EACjB,EAAY;IAEZ,gBAAgB,CAAC,EAAE,CAAC,CAAA,CAAC,4EAA4E;IACjG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAChE,yGAAyG;IACzG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,GAAG,CAAC,CAAA;AACrD,CAAC"}

package/dist/cli.d.ts

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { type AuthChoice } from "./auth.js";
 import { type DbChoice } from "./db.js";
+import { type DeployTarget } from "./scaffold/targets.js";
 declare const TEMPLATES: {
     readonly api: "../template";
     readonly site: "../template-site";
@@ -13,23 +14,10 @@ export type TemplateName = keyof typeof TEMPLATES;
  * + routes. */
 declare const FRAMEWORKS: readonly ["react", "preact", "vue", "solid", "svelte"];
 export type Framework = (typeof FRAMEWORKS)[number];
-/**
- * Deploy targets for the multi-target `site` template. Every target's build + server entry already ships
- * in the template; choosing one repoints the canonical `build`/`deploy` scripts at it (the per-target
- * `build:*` scripts stay, so you can still switch). nifra never runs the deploy or enters credentials -
- * `deploy` shells out to the vendor CLI you've authed yourself.
- */
-interface DeployPreset {
-    readonly label: string;
-    readonly build: string;
-    /** `deploy` script; `NAME` is replaced with the app directory name. */
-    readonly deploy: string;
-    readonly steps: readonly string[];
-}
 /**
  * Build a GitHub Actions workflow that builds on every push/PR and deploys `target` on a push to `main`.
- * Reuses the canonical `bun run build` (the deploy preset repoints it), then runs the target's official
- * deploy mechanism. Exported for unit tests. Throws on an unknown target.
+ * Runs `bun run build` (`nifra build` for the app's target), then the target's official deploy
+ * mechanism. Exported for unit tests. Throws on an unknown target.
  */
 export declare function githubDeployWorkflow(target: string, appName: string): string;
 export interface ScaffoldOptions {
@@ -39,9 +27,12 @@ export interface ScaffoldOptions {
     readonly template?: TemplateName;
     /** Frontend framework (site template only). Default `"react"`. */
     readonly framework?: string;
-    /** Deploy target (site template only) - repoints the default `build`/`deploy` scripts. */
-    readonly deploy?: string;
-    /** Emit a CI deploy workflow for the chosen `--deploy` target. Only `"github"` today. */
+    /** Where the site deploys (site template only): `bun` (default), `node`, `deno`, `cloudflare` or
+     * `vercel`. */
+    readonly deployTarget?: string;
+    /** Add a Dockerfile that builds and runs the server (`bun` and `node` targets). */
+    readonly docker?: boolean;
+    /** Emit a CI deploy workflow for the site's target. Only `"github"` today. */
     readonly ci?: string;
     /** Wire a data layer: `drizzle-{libsql,postgres,sqlite}` | `prisma-{postgres,sqlite}` | `kysely-postgres`. */
     readonly db?: string;
@@ -57,7 +48,12 @@ export interface ScaffoldResult {
     readonly name: string;
     readonly template: TemplateName;
     readonly framework?: Framework;
-    readonly deploy?: DeployPreset;
+    /** Where a site deploys, and whether it ships a Dockerfile. */
+    readonly deploy?: {
+        readonly target: DeployTarget;
+        readonly label: string;
+        readonly docker: boolean;
+    };
     /** The CI provider a workflow was generated for, when `--ci` was passed. */
     readonly ci?: "github";
     /** Repo secrets the generated workflow needs (for the next-steps message). */
@@ -70,25 +66,27 @@ export interface ScaffoldResult {
     readonly link?: string;
 }
 /**
- * Copy a template into `target` and finalize it (gitignore rename, package name, optional deploy preset).
- * Throws on: unknown template, `--deploy` with a non-site template, unknown deploy target, or an existing
- * destination. Pure enough to unit-test (no argv, no process.exit).
+ * Copy a template into `target` and finalize it (gitignore rename, package name, the site's deploy target).
+ * Throws on: unknown template, `--target`/`--docker` with a non-site template, unknown deploy target, or
+ * an existing destination. Pure enough to unit-test (no argv, no process.exit).
  */
 export declare function scaffold(opts: ScaffoldOptions): Promise<ScaffoldResult>;
 interface ParsedArgs {
     readonly target?: string;
     readonly template?: TemplateName;
     readonly framework?: string;
-    readonly deploy?: string;
+    readonly deployTarget?: string;
+    readonly docker?: boolean;
     readonly ci?: string;
     readonly db?: string;
     readonly auth?: string;
     readonly force?: boolean;
     readonly link?: string;
 }
-/** Parse `[dir] [--template|-t <t>] [--framework|-f <fw>] [--deploy|-d <target>] [--ci|-c github]
+/** Parse `[dir] [--template|-t <t>] [--framework|-f <fw>] [--target <t>] [--docker] [--ci|-c github]
  *  [--db <preset>] [--auth <preset>] [--force] [--link <path>]`.
- * `--framework`/`--deploy`/`--ci` all default the template to `site`. */
+ * `--framework`/`--target`/`--docker`/`--ci` all default the template to `site`. Throws on the retired
+ * `--deploy`. */
 export declare function parseArgs(argv: readonly string[]): ParsedArgs;
 /**
  * Run the CLI for `argv` and return the exit code + the message to print - no `process.exit`, `console`,

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAyBA,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,WAAW,CAAA;AAClB,OAAO,EAA0B,KAAK,QAAQ,EAAgB,MAAM,SAAS,CAAA;AAI7E,QAAA,MAAM,SAAS;;;;;CAKL,CAAA;AACV,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,SAAS,CAAA;AAEjD;;eAEe;AACf,QAAA,MAAM,UAAU,wDAAyD,CAAA;AACzE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;AAEnD;;;;;GAKG;AACH,UAAU,YAAY;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAwGD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAgC5E;AAED,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,yCAAyC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;IAChC,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,8GAA8G;IAC9G,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,oFAAoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB;0FACsF;IACtF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAA;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAA;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAA;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAA;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAA;IAC1B,iGAAiG;IACjG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CA8N7E;AAED,UAAU,UAAU;IAClB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;yEAEyE;AACzE,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAwC7D;AAID;;;GAGG;AACH,wBAAsB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAqE5F"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAoBA,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,WAAW,CAAA;AAClB,OAAO,EAA0B,KAAK,QAAQ,EAAgB,MAAM,SAAS,CAAA;AAI7E,OAAO,EAEL,KAAK,YAAY,EAIlB,MAAM,uBAAuB,CAAA;AAE9B,QAAA,MAAM,SAAS;;;;;CAKL,CAAA;AACV,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,SAAS,CAAA;AAEjD;;eAEe;AACf,QAAA,MAAM,UAAU,wDAAyD,CAAA;AACzE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;AAiFnD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAkC5E;AAED,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,yCAAyC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;IAChC,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;mBACe;IACf,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,8GAA8G;IAC9G,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,oFAAoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB;0FACsF;IACtF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAA;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;QAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;KACzB,CAAA;IACD,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAA;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAA;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAA;IAC1B,iGAAiG;IACjG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CA0O7E;AAED,UAAU,UAAU;IAClB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;iBAGiB;AACjB,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CA6C7D;AAID;;;GAGG;AACH,wBAAsB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAiF5F"}