create-trokky 0.1.3 → 0.1.5

package/dist/cli.js

@@ -86,6 +86,8 @@ async function main() {
             console.log(`  # ${secret.name}=   (${secret.optional ? 'optional — ' : ''}${secret.why})`);
         }
     }
+    if (config.target === 'workers')
+        console.log('  echo TROKKY_ENV=development >> .dev.vars');
     console.log('  npm install');
     console.log(config.target === 'workers' ? '  npm run build && npm run preview' : '  npm run dev');
 }

package/dist/config.js

@@ -22,7 +22,8 @@ export function withDefaults(input) {
         images: pick('images'),
         parts: pick('parts'),
         content: pick('content'),
-        trokkyVersion: input.trokkyVersion ?? '^3.4.1',
+        // 3.6: TrokkyCore takes `env`, which the Workers entry passes
+        trokkyVersion: input.trokkyVersion ?? '^3.6.0',
     };
 }
 export const hasStudio = (config) => config.parts !== 'api';

package/dist/emit.js

@@ -56,7 +56,8 @@ export function packageJson(config) {
         else {
             scripts.dev = 'tsx watch src/server.ts';
             scripts.build = 'tsc -p tsconfig.json';
-            scripts.start = 'node dist/server.js';
+            // rootDir is the project, so tsc mirrors src/ under dist/
+            scripts.start = 'node dist/src/server.js';
         }
     }
     return JSON.stringify({
@@ -196,6 +197,8 @@ export interface TrokkyEnv {
   MEDIA: R2Bucket
 ${config.images === 'cloudflare-images' ? '  IMAGES: ImagesBinding\n' : ''}${hasStudio(config) || config.content !== 'blank' ? '  ASSETS: { fetch(request: Request): Promise<Response> }\n' : ''}  TROKKY_JWT_SECRET?: string
   TROKKY_CLAIM_SECRET?: string
+  /** 'development' in .dev.vars for \`wrangler dev\`; unset when deployed */
+  TROKKY_ENV?: string
 }
 
 export const API_PATH = '/api'
@@ -226,6 +229,9 @@ ${mediaConfig}    },
     {
       jwtSecret: env.TROKKY_JWT_SECRET,
       claimSecret: env.TROKKY_CLAIM_SECRET,
+      // A Worker has no NODE_ENV: say production unless .dev.vars says otherwise, so a deploy
+      // without a real signing key refuses to start instead of signing with a random one
+      env: env.TROKKY_ENV === 'development' ? 'development' : 'production',
     },
   )
   // Creates the image processor; nothing serves images without it.
@@ -451,6 +457,12 @@ export function envExample(config) {
     for (const secret of secrets) {
         lines.push(...comment(secret.why), `${secret.name}=`, '');
     }
+    if (edge) {
+        // TROKKY_ENV=development is not listed here: the deploy button offers every line of this
+        // file as a value to set on the deployed Worker, which must run with the production checks.
+        // The README adds it to the local .dev.vars instead.
+        lines.push(...comment('For local development, also add TROKKY_ENV=development to your .dev.vars (the'), ...comment('README shows how). Never set it on the deployed Worker.'), '');
+    }
     if (config.data === 'postgres-data')
         lines.push('# Postgres connection string.', 'DATABASE_URL=', '');
     // Only where something is actually written to disk. A Worker has none, and with s3-media the

package/dist/generate.js

@@ -99,6 +99,7 @@ Generated with \`npm create trokky@latest\`.
 
 \`\`\`
 ${edge ? `cp .dev.vars.example .dev.vars   # fill both secrets
+echo TROKKY_ENV=development >> .dev.vars
 npm install
 npm run build && npm run preview` : `cp .env.example .env             # fill both secrets
 npm install
@@ -109,16 +110,28 @@ ${edge ? `## Deploy
 
 \`\`\`
 npm run build && npm run deploy
+npx wrangler secret put TROKKY_CLAIM_SECRET
+npx wrangler secret put TROKKY_JWT_SECRET
 \`\`\`
 
+\`.dev.vars\` is not uploaded, so the deployed Worker needs its own secrets; without
+\`TROKKY_JWT_SECRET\` it answers with an error. Set the claim secret first: once the JWT secret
+is in, the site answers, and an unset claim secret leaves the claim open.
+
 Wrangler provisions the D1 database and R2 bucket named in \`wrangler.jsonc\` on first deploy.
 \`database_id\` is intentionally empty: it is bound by name.
 
 ` : ''}## The first minute
 
-Open ${hasStudio(config) ? '`/studio`' : 'the API'}. Nobody owns this instance yet, so the first
-screen asks you to **claim** it: pick a username and password, and paste \`TROKKY_CLAIM_SECRET\`.
-${config.content === 'blank' ? '' : 'Sample content appears a moment later — edit it or delete it.'}
+${hasStudio(config) ? `Open \`/studio\`. Nobody owns this instance yet, so the first screen asks you to **claim** it:
+pick a username, an email and a password, and paste \`TROKKY_CLAIM_SECRET\`.` : `Nobody owns this instance yet. **Claim** it over HTTP (on a deployed site, use its URL instead of
+localhost); the response signs you in:
+
+\`\`\`
+curl -X POST http://localhost:${edge ? '8787' : '3000'}/api/auth/claim -H 'Content-Type: application/json' \\
+  -d '{"username":"admin","email":"you@example.com","password":"<a strong password>","secret":"<TROKKY_CLAIM_SECRET>"}'
+\`\`\``}
+${config.content === 'blank' ? '' : edge ? 'Sample content appears a moment after the claim — edit it or delete it.' : 'Sample content is written at the first start — edit it or delete it.'}
 
 Without a claim secret the claim is open to whoever reaches the URL first. That is fine for the
 minute between deploying and opening the link; it is not fine for an instance left sitting.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-trokky",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Compose a Trokky project: pick the target, adapters and parts you want.",
   "type": "module",
   "license": "MIT",