create-projx 1.6.0 → 1.6.1

package/README.md

@@ -175,27 +175,35 @@ Your custom files (controllers, pages, middleware) are never deleted. Files you
 
 ### Skip Files
 
-To skip component source files, add `skip` to `.projx-component`:
+Common user-owned files are **default-skipped** automatically — template updates won't touch them:
+
+| Scope | Default skips |
+|-------|---------------|
+| Root (`.projx`) | `docker-compose.yml`, `docker-compose.dev.yml`, `README.md`, `.githooks/pre-commit`, `.github/workflows/ci.yml`, `setup.sh` |
+| fastapi | `pyproject.toml` |
+| fastify / frontend / e2e | `package.json` |
+| mobile | `pubspec.yaml` |
+
+Defaults are applied once on first `update` and saved to the `skip` array. To skip additional files, add them to `skip` in `.projx` (root-level) or `.projx-component` (per-component):
 
 ```json
+// .projx — root skip
 {
-  "components": ["fastapi"],
-  "origin": "init",
-  "skip": ["src/**", "tests/**"]
+  "version": "x.y.z",
+  "skip": ["docker-compose.yml", "README.md", "my-custom-config.yml"]
 }
 ```
 
-To skip root-level files (docker-compose, README), add `skip` to `.projx`:
-
 ```json
+// fastapi/.projx-component — component skip
 {
-  "version": "1.5.2",
-  "components": ["fastapi", "frontend"],
-  "skip": ["docker-compose.yml", "README.md"]
+  "component": "fastapi",
+  "origin": "init",
+  "skip": ["pyproject.toml", "src/custom_middleware.py"]
 }
 ```
 
-Skipped files are excluded from template updates.
+To opt back in to updates for a skipped file, use `npx create-projx unpin <file>`.
 
 ## Options
 
@@ -274,12 +282,12 @@ When both `fastapi` and `fastify` exist, the entity generates in the **primary b
 
 Override with `--ai` (fastapi) or `--backend` (fastify).
 
-| Component                 | Generated                                                                                     |
-| ------------------------- | --------------------------------------------------------------------------------------------- |
-| Primary backend (fastapi) | `src/entities/<name>/_model.py` + `tests/test_<name>_entity.py` — model + 11 CRUD/auth tests  |
-| Primary backend (fastify) | `src/modules/<name>/schemas.ts` + `index.ts` + Prisma model + `tests/modules/<name>.test.ts`  |
-| `frontend`                | `src/types/<name>.ts` — TypeScript interface + Create/Update variants                         |
-| `mobile`                  | `lib/entities/<name>/model.dart` — Dart class with fromJson/toJson/copyWith                   |
+| Component                 | Generated                                                                                    |
+| ------------------------- | -------------------------------------------------------------------------------------------- |
+| Primary backend (fastapi) | `src/entities/<name>/_model.py` + `tests/test_<name>_entity.py` — model + 11 CRUD/auth tests |
+| Primary backend (fastify) | `src/modules/<name>/schemas.ts` + `index.ts` + Prisma model + `tests/modules/<name>.test.ts` |
+| `frontend`                | `src/types/<name>.ts` — TypeScript interface + Create/Update variants                        |
+| `mobile`                  | `lib/entities/<name>/model.dart` — Dart class with fromJson/toJson/copyWith                  |
 
 **Tests included**: every `gen entity` writes a working integration test file alongside the model — 11 tests for FastAPI (extending `BaseEntityApiTest`), 11 tests for Fastify (via `describeCrudEntity`). Both run against a real database (Postgres for Fastify, SQLite-in-memory for FastAPI today). New entities ship green from day one — no scrambling to bolt on tests at go-live.
 
@@ -343,6 +351,8 @@ The core idea: define a data model, get everything else for free.
 
 **Backend** — Drop a model file. The registry auto-discovers it and generates CRUD routes, schemas, pagination, filtering, sorting, search, FK expansion, and OpenAPI docs.
 
+**Field privacy** — Sensitive columns (`password_hash`, `secret`, `api_key`, `mfa_secret`, etc.) are automatically stripped from API responses and `/_meta` via a built-in baseline. Add project-specific hidden fields per entity (`__hidden_fields__` in FastAPI, `hiddenFields` in Fastify). Mark entire entities as `__private__` / `private: true` to hide them from the API entirely — no routes registered, not listed in `/_meta`. The `/_meta` endpoint requires authentication on both backends.
+
 **Frontend** — Fetches metadata from `GET /api/v1/_meta`, renders table + form UI automatically. Customize with overrides.
 
 **Mobile** — Same metadata endpoint, generates list/detail/form screens. Offline-first with local DB and sync queue.

package/dist/{baseline-72Z7TC2E.js → baseline-5XAJJ457.js}

@@ -10,7 +10,7 @@ import {
   matchesSkip,
   saveBaselineRef,
   writeTemplateToDir
-} from "./chunk-G74HYIE4.js";
+} from "./chunk-TNI4XBVS.js";
 import "./chunk-FTHX7ILT.js";
 export {
   BASELINE_REF,

package/dist/{chunk-G74HYIE4.js → chunk-TNI4XBVS.js}

@@ -16,9 +16,9 @@ import {
 
 // src/baseline.ts
 import { existsSync, writeFileSync, unlinkSync } from "fs";
-import { chmod, mkdir, writeFile, rm, readFile as readFile2 } from "fs/promises";
+import { chmod, mkdir, writeFile, rm, readFile as readFile2, copyFile } from "fs/promises";
 import { execSync } from "child_process";
-import { join as join2 } from "path";
+import { join as join2, dirname } from "path";
 import { tmpdir } from "os";
 
 // src/generators/index.ts
@@ -259,7 +259,12 @@ async function tryThreeWayMerge(cwd, templateDir, baselineRef, componentPaths) {
     if (file === ".projx") continue;
     if (file.endsWith("/.projx-component") || file === ".projx-component") continue;
     const oursPath = join2(cwd, file);
-    if (!existsSync(oursPath)) continue;
+    if (!existsSync(oursPath)) {
+      await mkdir(dirname(oursPath), { recursive: true });
+      await copyFile(join2(templateDir, file), oursPath);
+      merged.push(file);
+      continue;
+    }
     const baseContent = lookupBaseContent(cwd, baselineRef, file, pathFallbacks);
     if (baseContent === null) continue;
     let theirsContent;

package/dist/index.js

@@ -9,7 +9,7 @@ import {
   matchesSkip,
   saveBaselineRef,
   writeTemplateToDir
-} from "./chunk-G74HYIE4.js";
+} from "./chunk-TNI4XBVS.js";
 import {
   COMPONENTS,
   COMPONENT_MARKER,
@@ -371,7 +371,7 @@ function hasUncommittedChanges(cwd) {
 async function findPinnedFilesWithUpdates(cwd, repoDir, components, componentPaths, vars, version, componentSkips, rootSkip) {
   const { mkdir: mkdir5, rm: rm2, readFile: readFile7 } = await import("fs/promises");
   const { tmpdir: tmpdir2 } = await import("os");
-  const { writeTemplateToDir: writeTemplateToDir2 } = await import("./baseline-72Z7TC2E.js");
+  const { writeTemplateToDir: writeTemplateToDir2 } = await import("./baseline-5XAJJ457.js");
   const config = await readProjxConfig(cwd);
   const rootPinned = Array.isArray(config.skip) ? config.skip : [];
   const componentPinned = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-projx",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "Scaffold production-grade fullstack projects in seconds. FastAPI, Fastify, React, Flutter, Terraform — with auth, database, CI/CD, E2E tests, and Docker. One command, ready to deploy.",
   "type": "module",
   "bin": {