generatesaas 3.20.0 → 3.21.0

package/dist/generators/content/AGENTS.template.md

@@ -69,7 +69,7 @@ costly mistake made in this repo.
 - **Hono routes:** keep the method chain (`.get().post()`) - RPC type inference depends on it. Validate with `sValidator` from `@hono/standard-validator`.
 - **Feature flags:** check `config.*` before rendering or executing a toggleable feature; hide it when off.
 - **Navigation:** import `Link` / `redirect` / `useRouter` from `@/lib/navigation` - the locale-aware wrappers - never from `next/link` or `next/navigation` directly, or locale prefixes silently break.
-- **i18n:** strings live in `packages/i18n/translations/{locale}/{scope}.json`; edit `en/` only, keep keys generic. {{i18nRule}} A pre-commit hook syncs other locales (needs `OPENROUTER_API_KEY`; skips without it); the `translate` skill does the same sync with you as the translator, no key needed.
+- **i18n:** strings live in `packages/i18n/translations/{locale}/{scope}.json`; edit `en/` only, keep keys generic. {{i18nRule}} A pre-commit hook syncs other locales (needs `OPENROUTER_API_KEY`; skips without it); the `translate` skill does the same sync with you as the translator, no key needed. Never edit other locales or `packages/translate/.meta/` (the translation hash ledger) yourself, by hand or by script - only the translate command writes them.
 - **Routes:** use `config.routes.*`, never hardcoded path strings.
 - **Secrets:** never send to an external service; generate tokens/QR codes client-side.
 - **Backend `@repo/*` packages** run on multiple runtimes: prefer web-standard APIs - `crypto.randomUUID()`, the `node:` import prefix, `Uint8Array` over `Buffer`, global `performance.now()`.

package/dist/index.js

@@ -5,7 +5,7 @@ import{Command as Ip}from"commander";import*as vs from"@clack/prompts";import{ex
 `),R=[m!=="none"?`  Payment:       ${y.cyan(Et[m].label)} (${D})`:`  Payment:       ${y.dim("none")}`,`  Credits:       ${H?y.cyan("Yes"):y.dim("No")}`,`  AI features:   ${G?y.cyan("Yes"):y.dim("No")}`,...j?[]:[`  Web AI:        ${y.dim("No")} (app-first)`],`  Email:         ${y.cyan(St[ve].label)}`,`  Observability: ${K.length===0?y.dim("none"):y.cyan(K.map(Xt=>Pt[Xt].label).join(", "))}`,`  Multi-tenancy: ${ae?y.cyan("Yes"):y.dim("No")}`,`  Projects:      ${Te?y.cyan("Yes"):y.dim("No")}`,`  Docs app:      ${Re?y.cyan("Yes"):y.dim("No")}`,`  Desktop app:   ${ce?y.cyan("Yes"):y.dim("No")}`,`  Mobile app:    ${_?y.cyan("Yes"):y.dim("No")}`,...Q==="none"?[]:[`  In-app purch.: ${y.cyan("RevenueCat")}`],`  Rev. sharing:  ${ee?y.cyan("Yes"):y.dim("No")}`].join(`
 `),Ee=[y.bold("Project"),c,"",y.bold("Infrastructure"),u,"",y.bold("Features"),R];if(ke.length>0){let Xt=ke.map(Fr=>{let ws=A[Fr.key]?y.green("provided"):y.dim("skipped");return`  ${Fr.key}: ${ws}`}).join(`
 `);Ee.push("",y.bold("Credentials"),Xt)}f.note(Ee.join(`
-`),"Summary");let Ur=await f.confirm({message:"Proceed with these settings?"});(f.isCancel(Ur)||!Ur)&&(f.cancel("Setup cancelled."),process.exit(0))}return{projectName:n,appName:i,projectDir:o,architecture:w,deploymentTarget:a,databaseProvider:v,cacheProvider:P,paymentProvider:m,emailProvider:ve,observability:K,multiTenancy:ae,projects:Te,docs:Re,desktop:ce,mobile:_,mobilePurchases:Q,ai:G,webAi:j,revenueSharing:ee,credits:H,defaultCurrency:D,...Object.keys(A).length>0?{credentials:A}:{},...e?.baseUrl!==void 0?{baseUrl:e.baseUrl}:{},...we!==void 0?{demo:we}:{}}}import{createReadStream as un,existsSync as Cs}from"fs";import{mkdir as Ls}from"fs/promises";import{join as $s}from"path";import{Readable as js}from"stream";import{pipeline as dr}from"stream/promises";import{extract as Ms}from"tar";import{join as Ce}from"path";import{homedir as As}from"os";var ut=process.env.GENERATESAAS_API_URL??"https://cli.generatesaas.com",Y=".generatesaas",he=Ce(Y,"manifest.json"),tn="nextjs",nr="nuxt",ir="2.4.1",rn=Ce(Y,"hashes.json"),Tt=Ce(Y,"template-hashes.json"),Rt=Ce(Y,"template"),nn=Ce(Y,"staging"),sn=Ce(Y,"staging.json"),fe=Ce(As(),".generatesaas");var $=class extends Error{constructor(r,n,i){super(n);this.status=r;this.body=i}status;body;name="ApiError"};function ge(e){return{apiKey:e,baseUrl:ut}}async function Se(e,t,r){let n=`${e.baseUrl}${t}`,i=await fetch(n,{...r,headers:{...r?.headers,Authorization:`Bearer ${e.apiKey}`,"User-Agent":"generatesaas-cli/3.20.0"}});if(!i.ok){let o,s;try{s=await i.json(),o=s.error??`API ${i.status}: ${t}`}catch{o=`API ${i.status}: ${t}`}throw new $(i.status,o,s)}return i}import{existsSync as Is,mkdirSync as Ts,readFileSync as Rs,writeFileSync as _s}from"fs";import{dirname as Os}from"path";import*as Pe from"@clack/prompts";function mt(){if(!Is(fe))return null;try{let e=JSON.parse(Rs(fe,"utf-8"));return e.apiKey?e.apiKey:(e.token&&!e.apiKey&&Pe.log.warning(`Found old GitHub token in ${fe}. Run 'generatesaas init' to set up your API key.`),null)}catch{return null}}function Le(e){Ts(Os(fe),{recursive:!0}),_s(fe,`${JSON.stringify({apiKey:e},null,"	")}
+`),"Summary");let Ur=await f.confirm({message:"Proceed with these settings?"});(f.isCancel(Ur)||!Ur)&&(f.cancel("Setup cancelled."),process.exit(0))}return{projectName:n,appName:i,projectDir:o,architecture:w,deploymentTarget:a,databaseProvider:v,cacheProvider:P,paymentProvider:m,emailProvider:ve,observability:K,multiTenancy:ae,projects:Te,docs:Re,desktop:ce,mobile:_,mobilePurchases:Q,ai:G,webAi:j,revenueSharing:ee,credits:H,defaultCurrency:D,...Object.keys(A).length>0?{credentials:A}:{},...e?.baseUrl!==void 0?{baseUrl:e.baseUrl}:{},...we!==void 0?{demo:we}:{}}}import{createReadStream as un,existsSync as Cs}from"fs";import{mkdir as Ls}from"fs/promises";import{join as $s}from"path";import{Readable as js}from"stream";import{pipeline as dr}from"stream/promises";import{extract as Ms}from"tar";import{join as Ce}from"path";import{homedir as As}from"os";var ut=process.env.GENERATESAAS_API_URL??"https://cli.generatesaas.com",Y=".generatesaas",he=Ce(Y,"manifest.json"),tn="nextjs",nr="nuxt",ir="2.4.1",rn=Ce(Y,"hashes.json"),Tt=Ce(Y,"template-hashes.json"),Rt=Ce(Y,"template"),nn=Ce(Y,"staging"),sn=Ce(Y,"staging.json"),fe=Ce(As(),".generatesaas");var $=class extends Error{constructor(r,n,i){super(n);this.status=r;this.body=i}status;body;name="ApiError"};function ge(e){return{apiKey:e,baseUrl:ut}}async function Se(e,t,r){let n=`${e.baseUrl}${t}`,i=await fetch(n,{...r,headers:{...r?.headers,Authorization:`Bearer ${e.apiKey}`,"User-Agent":"generatesaas-cli/3.21.0"}});if(!i.ok){let o,s;try{s=await i.json(),o=s.error??`API ${i.status}: ${t}`}catch{o=`API ${i.status}: ${t}`}throw new $(i.status,o,s)}return i}import{existsSync as Is,mkdirSync as Ts,readFileSync as Rs,writeFileSync as _s}from"fs";import{dirname as Os}from"path";import*as Pe from"@clack/prompts";function mt(){if(!Is(fe))return null;try{let e=JSON.parse(Rs(fe,"utf-8"));return e.apiKey?e.apiKey:(e.token&&!e.apiKey&&Pe.log.warning(`Found old GitHub token in ${fe}. Run 'generatesaas init' to set up your API key.`),null)}catch{return null}}function Le(e){Ts(Os(fe),{recursive:!0}),_s(fe,`${JSON.stringify({apiKey:e},null,"	")}
 `,{mode:384})}async function rt(e){if(e?.apiKey)return e.apiKey;let t=process.env.GENERATESAAS_API_KEY;if(t)return t;let r=mt();if(r)return r;if(!e?.prompt)throw new Error("API key not found. Set GENERATESAAS_API_KEY or run 'generatesaas init' to configure.");return ht()}async function ht(){let e=await Pe.text({message:"Enter your GenerateSaaS API key:",placeholder:"gs_live_...",validate:t=>{if(!t?.trim())return"API key is required."}});return Pe.isCancel(e)&&(Pe.cancel("Setup cancelled."),process.exit(0)),e.trim()}import{readFile as xs}from"fs/promises";async function Ae(e){let t=process.env.GENERATESAAS_VERSION_INDEX;return t?JSON.parse(await xs(t,"utf-8")):process.env.GENERATESAAS_OFFLINE_LICENSE==="1"?{latest:"0.0.0-ci",versions:[{version:"0.0.0-ci",date:new Date().toISOString(),breaking:!1}],entitlements:null}:await(await Se(e,"/versions")).json()}async function on(e,t){if(process.env.GENERATESAAS_OFFLINE_LICENSE==="1")return null;try{return await(await Se(e,`/changelog/${encodeURIComponent(t)}`)).text()}catch(r){if(r instanceof $&&r.status===404)return null;throw r}}async function an(e,t){return process.env.GENERATESAAS_OFFLINE_LICENSE==="1"?{skills:{"generatesaas-update":{skillMd:`# Offline skill stub
 `,scripts:{},references:{}}}}:await(await Se(e,`/skills/${encodeURIComponent(t)}`)).json()}function _t(e){if(!(e instanceof $)||e.status!==403)return null;let t=e.body;return!t||t.code!=="update_window_expired"?null:{message:e.message,lastAllowedVersion:t.lastAllowedVersion??null}}var sr="nextjs";function cn(e){return{frontend:sr,architecture:e.architecture,deployTarget:e.deploymentTarget,database:e.databaseProvider,cache:e.cacheProvider,payment:e.paymentProvider,email:e.emailProvider,multiTenancy:e.multiTenancy,blog:!0,docs:e.docs,desktop:e.desktop,mobile:e.mobile,runner:!1,credits:e.credits,revenueSharing:e.revenueSharing,currency:e.defaultCurrency}}async function or(e,t){return process.env.GENERATESAAS_OFFLINE_LICENSE==="1"?{token:"offline-test-token",licenseId:"offline-test-license-id",installId:t.installId}:await(await Se(e,"/license/sign",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})).json()}async function ln(e,t){return process.env.GENERATESAAS_OFFLINE_LICENSE==="1"?{token:t.currentToken}:await(await Se(e,"/license/refresh",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})).json()}async function ar(e,t){let r=await fetch(`${e}/license/verify`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)});if(!r.ok)throw new Error(`Verification service returned ${r.status}`);return await r.json()}async function pn(e,t,r){let n=await fetch(`${e}/license/inspect`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${t}`},body:JSON.stringify(r)});if(!n.ok){let i=await n.json().catch(()=>null);throw new Error(i?.error??`Inspect endpoint returned ${n.status}`)}return await n.json()}var cr=new Set([".git","node_modules",".pnpm-store",".env",".env.test",".turbo",".data","dist",".next",".next-e2e-web",".next-e2e-desktop",".svelte-kit",".wrangler",".devcontainer","playwright-report","test-results",".drive-out",".mastra"]),lr=new Set(["pnpm-lock.yaml"]);function nt(e){if(pr(e))return!0;for(let t of e.split("/"))if(lr.has(t))return!0;return!1}var Ds=new Set(["data","mksaas","references","scripts",".cursor",".agents",".codex",".generatesaas",".vscode",".mcp.json","vitest.config.ts","README.md","TODO.md","OVERVIEW.md","HANDOFF.md"]),dn=["scripts/docs-lint.ts"],Ns=["docs/superpowers","packages/cli","packages/cli-api","packages/database/tests/no-migration-history.test.ts","infra/docker-compose.yml",".claude/commands",".claude/skills/web-port",".claude/skills/web-port-workspace",".claude/settings.local.json",".claude/worktrees"];function pr(e){let t=e.split("/");for(let r of t)if(cr.has(r))return!0;if(dn.includes(e)||dn.some(r=>r.startsWith(`${e}/`)))return!1;if(Ds.has(t[0]))return!0;for(let r of Ns)if(e===r||e.startsWith(`${r}/`))return!0;return!1}async function Ot(e,t,r){await Ls(r,{recursive:!0});let n=process.env.GENERATESAAS_TEMPLATE_TARBALL_DIR;if(n){let a=$s(n,`v${t}.tar.gz`);if(!Cs(a))throw new Error(`GENERATESAAS_TEMPLATE_TARBALL_DIR is set but ${a} does not exist.`);await dr(un(a),ur(r));return}let i=process.env.GENERATESAAS_TEMPLATE_TARBALL;if(i){await dr(un(i),ur(r));return}let o=await Se(e,`/template/${encodeURIComponent(t)}`);if(!o.body)throw new Error("Empty response body");let s=js.fromWeb(o.body);await dr(s,ur(r))}function ur(e){return Ms({cwd:e,strip:1,filter:t=>{let r=t.replace(/^[^/]+\//,"");return r?!pr(r):!0},sync:!1})}import{readdir as xt,readFile as it,rm as hn,rmdir as Us,writeFile as ft}from"fs/promises";import{join as V}from"path";async function fn(e){let t;try{t=await xt(e,{withFileTypes:!0})}catch{return!1}let r=!1;for(let n of t){let i=V(e,n.name);if(n.isDirectory()){await fn(i)&&(r=!0);continue}if(n.name.startsWith("_")){r=!0;continue}await hn(i,{force:!0})}return r||await Us(e).catch(()=>{}),r}async function gn(e){let t=V(e,"packages/content"),r=[];try{r=(await xt(t,{withFileTypes:!0})).filter(s=>s.isDirectory()).map(s=>s.name)}catch{return}let n=new Set;for(let s of r){let a=V(t,s),d;try{d=(await xt(a,{withFileTypes:!0})).filter(h=>h.isDirectory())}catch{continue}for(let h of d)n.add(h.name),await fn(V(a,h.name))}let i=await Ks(e),o=new Set([...n].filter(s=>i===void 0||i.has(s)));await Promise.all([...o].map(s=>hn(V(e,"apps/web/public/images",s),{recursive:!0,force:!0}))),await Hs(e,o)}var Fs="packages/config/src/index.ts",Vs=/\bcontent:\s*\{[\s\S]*?\bsections:\s*\[([\s\S]*?)\]/,Bs=/\bslug:\s*"([^"]+)"/g;async function Ks(e){let t;try{t=await it(V(e,Fs),"utf-8")}catch{return}let r=Vs.exec(t)?.[1];if(r===void 0)return;let n=[...r.matchAll(Bs)].map(i=>i[1]).filter(i=>i!==void 0);return n.length>0?new Set(n):void 0}var Gs="packages/translate/.meta/mdx-translation-meta.json";async function Hs(e,t){if(t.size===0)return;let r=V(e,Gs),n;try{n=JSON.parse(await it(r,"utf-8"))}catch{return}if(typeof n!="object"||n===null)return;let i=n;if(typeof i.locales!="object"||i.locales===null)return;let o={};for(let[s,a]of Object.entries(i.locales)){if(typeof a!="object"||a===null)continue;let d={};for(let[h,g]of Object.entries(a)){let w=h.split("/"),v=w.length>1?w[0]:void 0,P=w[w.length-1]?.startsWith("_")===!0;v!==void 0&&t.has(v)&&!P||(d[h]=g)}o[s]=d}await ft(r,`${JSON.stringify({...i,locales:o},null,"	")}
 `)}var Ys="packages/config/src/blog.ts";async function yn(e){let t=V(e,Ys),r=await it(t,"utf-8"),n=mn(mn(r,"blogCategories",t),"blogAuthors",t);await ft(t,n)}function mn(e,t,r){let n=new RegExp(`(export const ${t}\\b[^=]*=\\s*)\\[[\\s\\S]*?\\];`);if(!n.test(e))throw new Error(`emptyBlogConfig: could not find the \`export const ${t} = [...]\` declaration in ${r}. The boilerplate blog config may have been renamed or restructured; update the CLI strip in cleanup.ts.`);return e.replace(n,"$1[];")}async function bn(e){let t=V(e,"packages/i18n/translations"),r;try{r=await xt(t)}catch{return}for(let n of r){let i=V(t,n,"web.json"),o;try{o=await it(i,"utf-8")}catch{continue}let s=JSON.parse(o);!s.content?.categories||s.content.categories.blog===void 0||(s.content.categories.blog={},await ft(i,`${JSON.stringify(s,null,"	")}
@@ -442,6 +442,7 @@ export * from "./social-providers";
 export * from "./blog";
 export * from "./cache";
 export * from "./content";
+export * from "./credit-price";
 export * from "./footer";
 export * from "./i18n";
 export * from "./landing";
@@ -780,7 +781,7 @@ ${w},
 		items: []
 	}
 };
-`;await l(t,v)}var Do={smtp:[{key:"SMTP_HOST",defaultValue:"localhost"},{key:"SMTP_PORT",defaultValue:"1025"},{key:"SMTP_USER"},{key:"SMTP_PASSWORD"}],ses:[{key:"AMAZON_SES_REGION",comment:"# TODO: Configure Amazon SES credentials (e.g. us-east-1)"},{key:"AMAZON_SES_KEY"},{key:"AMAZON_SES_SECRET"}],resend:[{key:"RESEND_API_KEY",comment:"# TODO: Add your Resend API key"}]},No={stripe:[{key:"STRIPE_SECRET_KEY",comment:"# TODO: Add your Stripe keys"},{key:"STRIPE_WEBHOOK_SECRET"},{key:"STRIPE_API_BASE",comment:"# Point the Stripe SDK at another host - a local mock, or a proxy of your own. Unset means api.stripe.com."}],polar:[{key:"POLAR_ACCESS_TOKEN",comment:"# TODO: Add your Polar keys"},{key:"POLAR_WEBHOOK_SECRET"}]};function Lt(e,t){return t?e.map(r=>{let n=t[r.key];return n?{...r,defaultValue:n,comment:void 0}:r}):e}function yt(e,t){for(let r of e)r.comment&&t.push(r.comment),r.defaultValue!==void 0?t.push(`${r.key}=${r.defaultValue}`):t.push(`#${r.key}=`)}function gr(e){return Array.from(crypto.getRandomValues(new Uint8Array(e))).map(t=>t.toString(16).padStart(2,"0")).join("")}function yr(e){return e.architecture==="fullstack"?{apiUrl:"http://localhost:3000/api",baseUrl:"http://localhost:3000"}:{apiUrl:"http://localhost:3010",baseUrl:"http://localhost:3000"}}var Co="https://your-app.example.com/api";function $t(e,t,r,n){e.push(n==="example"?`${t}=`:`${t}=${r}`)}function Rn(e,t){let r=t==="example"?void 0:e.credentials,{apiUrl:n,baseUrl:i}=yr(e),o=[];e.architecture==="separate"?o.push("# API Configuration","# Standalone backend's own URL (the frontend reaches it via the public var above).",`API_URL=${n}`,`BASE_URL=${i}`):o.push("# App","# (API_URL is derived from the frontend's *_PUBLIC_API_URL by the runtime env schema.)",`BASE_URL=${i}`),o.push("","# Client IP (production)","# The backend rate-limits by client IP and stamps it on audit entries. YOU ALMOST","# CERTAINLY DO NOT NEED THIS: it detects Vercel, Fly.io, Render, Railway, Netlify and","# Coolify from their own env vars, and treats a private connection peer (Docker, compose,","# Kubernetes, Dokploy, an nginx/Traefik/Caddy on the same host) as proof that something is","# forwarding to it. A forwarded header is trusted only in those cases, never on a server","# exposed directly - there, a caller could have sent it themselves."),e.architecture==="fullstack"?o.push("# This build runs the API in the frontend's route handler, which has no connection","# address, so on a host the backend does not recognise there is nothing to fall back on","# and every caller shares ONE rate-limit bucket: the 10/min sign-in limit applies to","# your whole app rather than per person, and audit entries record no address."):o.push("# This build reads the connection peer, so a server exposed directly identifies its","# callers correctly with nothing set here."),o.push("# SET IT when nothing above can see your topology - the common case is a CDN in front of a","# directly exposed server, where connections arrive from a public CDN address:","#   Cloudflare                        -> TRUSTED_PROXY=cf-connecting-ip","#   another proxy in front            -> TRUSTED_PROXY=1 (the number of proxies)","# Whatever you set wins over detection; `false` turns detection off and trusts nothing.","# TRUSTED_PROXY=1"),o.push("","# Auth rate limits","# Raises every Better Auth rate limit by a whole number (1-50). Unset = 1 = the","# shipped limits. No value disables them: 0, empty or unparseable fails at boot.","# You almost certainly want the default. The reason to raise it is an automated suite,","# which drives ONE address and so shares one bucket - and the e2e config already sets","# its own value, so it needs nothing here.","# AUTH_RATE_LIMIT_MULTIPLIER=1"),o.push("","# Database"),yt(Lt(Oe[e.databaseProvider].envVars,r),o),o.push("","# Cache"),yt(Lt(xe[e.cacheProvider].envVars,r),o),e.cacheProvider==="redis"&&o.push("# Optional prefix on every Redis key the app writes. Set it when several deployments share","# one Redis instance, or to keep a load test out of the live keyspace.","# Set it once, before first boot. Changing it on a running deployment orphans in-flight","# auto-top-up claims and distributed locks (autotopup:pending:*, withMutex) - drain or use","# a maintenance window first.","#REDIS_KEY_PREFIX="),o.push("","# Authentication"),t==="example"&&o.push("# Generate a strong secret, e.g. `openssl rand -hex 32`"),$t(o,"BETTER_AUTH_SECRET",crypto.randomUUID(),t),o.push("","# Content API (random secret; required when contentApi feature is enabled in @repo/config)"),$t(o,"CONTENT_API_KEY",gr(32),t),o.push("","# Job Queue - Inngest","INNGEST_APP_ID=api"),$t(o,"INNGEST_EVENT_KEY",gr(32),t),o.push("# REQUIRED in production: it is how the /inngest endpoint tells Inngest from anyone else who","# finds the URL. The app refuses to boot without it unless INNGEST_DEV is set (local dev server).","# Take the real value from the Inngest dashboard."),$t(o,"INNGEST_SIGNING_KEY",gr(32),t),o.push("# The local Inngest dev server (pnpm dev:inngest). In production on Inngest Cloud leave this UNSET:","# Cloud takes events and registration on two hosts, which no single URL can name. Set it only for a","# self-hosted Inngest, to its one host.","INNGEST_BASE_URL=http://127.0.0.1:8288"),e.architecture==="separate"&&(o.push("","# API Port (standalone backend)","API_PORT=3010"),o.push("","# CORS + cross-subdomain cookies (production only - leave unset for local dev)","# TRUSTED_ORIGINS=https://your-app.example.com","# AUTH_COOKIE_DOMAIN=.example.com"));let s=Do[e.emailProvider];if(s&&(o.push("","# Email"),yt(Lt(s,r),o)),e.paymentProvider!=="none"){let d=No[e.paymentProvider];d&&(o.push("","# Payment"),yt(Lt(d,r),o))}o.push("","# Storage - S3 Compatible (required for uploads: avatars, files)","# Works with AWS S3, Cloudflare R2, MinIO, and other S3-compatible services.","# Uploads fail until these are set - storage is enabled in @repo/config by default.","#STORAGE_REGION=us-east-1","#STORAGE_ENDPOINT=https://your-account.r2.cloudflarestorage.com","#STORAGE_ACCESS_KEY_ID=","#STORAGE_SECRET_ACCESS_KEY=","# Two buckets: one publicly readable (avatars, assets), one credentials-only (private","# uploads served through the app). The bucket boundary is the privacy guarantee.","#STORAGE_PUBLIC_BUCKET=","#STORAGE_PRIVATE_BUCKET=",'# Public base URL for the public bucket. Public file URLs are STORAGE_PUBLIC_URL + "/" + key.',"#STORAGE_PUBLIC_URL=https://cdn.example.com","","# Storage - Local Filesystem (optional overrides)","# Defaults work out of the box; override for Docker volume mounts.","#STORAGE_LOCAL_PATH=/data","#STORAGE_LOCAL_PUBLIC_URL=https://cdn.example.com/files"),o.push("","# Admin Notifications (optional)","# Real-time notifications when business events occur (signups, purchases, etc.).","# Each provider is auto-enabled when its env vars are set.","#DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...","#SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...","#TELEGRAM_BOT_TOKEN=123456789:ABCdefGHIjklMNOpqrsTUVwxyz","#TELEGRAM_CHAT_ID=-1001234567890","#TELEGRAM_TOPIC_ID=123"),o.push("","# Social sign-in (optional)","# Enable the matching provider in @repo/config, then set its pair here.","#GOOGLE_CLIENT_ID=","#GOOGLE_CLIENT_SECRET=","#GITHUB_CLIENT_ID=","#GITHUB_CLIENT_SECRET=","# Apple: APPLE_TEAM_ID + APPLE_KEY_ID + APPLE_PRIVATE_KEY are the signing key. Add APPLE_CLIENT_ID",'# (a Service ID) for the web button, and list "apple" in config.auth.socialProviders.',"#APPLE_CLIENT_ID=","#APPLE_TEAM_ID=","#APPLE_KEY_ID=","#APPLE_PRIVATE_KEY="),o.push("","# SMS - Twilio (optional)","#TWILIO_ACCOUNT_SID=ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","#TWILIO_AUTH_TOKEN=","#TWILIO_PHONE_NUMBER=+1234567890"),o.push("","# Newsletter (optional)","#RESEND_AUDIENCE_ID=","#LISTMONK_URL=https://listmonk.yourdomain.com","#LISTMONK_API_USER=admin","#LISTMONK_API_TOKEN=","#LISTMONK_LIST_ID=1"),o.push("","# Translations - OpenRouter (optional)","# Set to auto-translate en/* into your other locales with `pnpm translate`.","# The pre-commit hook runs it on commit; without a key it skips and untranslated","# locales fall back to the default locale. Get a key: https://openrouter.ai/keys","#OPENROUTER_API_KEY=");let a=[];return e.observability.includes("sentry")&&a.push({key:"SENTRY_DSN",comment:"# Overrides config.observability.sentry.dsn for the server only."}),e.observability.includes("posthog")&&a.push({key:"POSTHOG_API_KEY",comment:"# Overrides config.observability.posthog.publicKey for the server only (host stays in config)."}),a.length>0&&(o.push("","# Error and product reporting (optional)"),yt(a,o)),o.push("","# AI base (optional)","# Enable config.ai in packages/config. Built-in AI resolves through OpenRouter only,","# so OPENROUTER_API_KEY above is the only MODEL provider key the backend reads.","# BYOK is per-user and never an env var: users paste their own key in the app and it","# is stored encrypted in the database.","# Override the OpenRouter API base - a gateway or a proxy of your own. It must carry the","# /api/v1 suffix. Unset uses the hosted API.","#OPENROUTER_BASE_URL=https://openrouter.ai/api/v1","","# AI web tools (optional)","# Give the assistant its own web access, on chat (on by default), the desktop app-tools","# lane, automations and the MCP server. A key's presence is the whole switch: set one","# and the model gets its tools, set none and chat is unchanged. config.ai.webSearch:","# false switches every lane off.","# ANY one key alone covers both capabilities. With several set, auto-detection takes the","# CHEAPEST first - TinyFish, then Firecrawl, then Parallel - per capability; naming","# config.ai.webTools.searchEngine or .extractEngine wins over that order, and a named","# engine whose key is missing ships no tool at all.","# WHAT A CALL COSTS THE USER: the vendor price x credits.creditsPerUsd x the","# webSearch/webExtract markup (shipped at 100, so twice cost). Override the vendor price","# with config.ai.webTools.searchCostUsd / .extractCostUsd.","# TinyFish (the auto-detect default) - both tools at a $0 list price, so a call debits","# nothing, writes no ledger row and is never refused for an empty balance. Rate-limited","# instead (30 searches and 150 pages a minute per API key by default, shared by every","# user), so set a price on a busy app. Note its terms include a license to train on","# submitted content.","# https://agent.tinyfish.ai/","#TINYFISH_API_KEY=","# Firecrawl (the recommended PAID engine) - `web_search` AND `web_extract` (reads one","# page) from one signup, and the only vendor here whose terms carry no license over what","# you submit.","# https://firecrawl.dev/","#FIRECRAWL_API_KEY=","# Parallel (optional) - both tools, cheaper than Firecrawl on each, at high quality;","# extract is slower on a page it has not already indexed. Note its customer terms","# include a license to train on submitted queries.","# https://platform.parallel.ai/","#PARALLEL_API_KEY="),e.desktop&&o.push("","# Desktop app (optional)","# Base URL the marketing download page reads the release feed from.","# Unset uses config.desktop.autoUpdate.url.","#DESKTOP_FEED_BASE_URL="),e.mobile&&(o.push("","# Mobile app","# The bundle identifier the native Sign in with Apple token is issued to - it joins","# APPLE_CLIENT_ID in the audience the backend accepts. With the three Apple signing values","# and no APPLE_CLIENT_ID, it alone turns on native-only Sign in with Apple: the iOS app shows","# Apple beside Google (it reads that at runtime) and the web shows no Apple button.","#APPLE_APP_BUNDLE_IDENTIFIER=","# Comma-separated Android signing certificate SHA-256 fingerprints. They feed","# .well-known/assetlinks.json (which verifies your universal links) and the passkey","# Android origins.","#MOBILE_ANDROID_SHA256_FINGERPRINTS=","# Optional. An Expo access token turns on enhanced security for push sends.","#EXPO_ACCESS_TOKEN="),e.mobilePurchases==="revenuecat"&&o.push("","# Mobile store purchases - RevenueCat (server)","# The first two verify incoming webhooks; the third is read by the sync route and the","# nightly reconcile pass.","#REVENUECAT_WEBHOOK_SECRET=","#REVENUECAT_AUTH_HEADER=","#REVENUECAT_API_KEY=")),o.push("","# Build output (optional)","# Next's distDir for apps/web. Unset uses .next; the e2e harness sets its own so a test","# build never overwrites a dev server's.","#NEXT_DIST_DIR="),o.push(""),o.join(`
+`;await l(t,v)}var Do={smtp:[{key:"SMTP_HOST",defaultValue:"localhost"},{key:"SMTP_PORT",defaultValue:"1025"},{key:"SMTP_USER"},{key:"SMTP_PASSWORD"}],ses:[{key:"AMAZON_SES_REGION",comment:"# TODO: Configure Amazon SES credentials (e.g. us-east-1)"},{key:"AMAZON_SES_KEY"},{key:"AMAZON_SES_SECRET"},{key:"AMAZON_SES_CONFIGURATION_SET",comment:"# Delivery events: configuration set -> SNS topic -> /webhooks/email/ses (see docs: Email)"},{key:"AMAZON_SES_SNS_TOPIC_ARN"}],resend:[{key:"RESEND_API_KEY",comment:"# TODO: Add your Resend API key"},{key:"RESEND_WEBHOOK_SECRET",comment:"# Delivery events: Resend webhook -> /webhooks/email/resend (see docs: Email)"}]},No={stripe:[{key:"STRIPE_SECRET_KEY",comment:"# TODO: Add your Stripe keys"},{key:"STRIPE_WEBHOOK_SECRET"},{key:"STRIPE_API_BASE",comment:"# Point the Stripe SDK at another host - a local mock, or a proxy of your own. Unset means api.stripe.com."}],polar:[{key:"POLAR_ACCESS_TOKEN",comment:"# TODO: Add your Polar keys"},{key:"POLAR_WEBHOOK_SECRET"}]};function Lt(e,t){return t?e.map(r=>{let n=t[r.key];return n?{...r,defaultValue:n,comment:void 0}:r}):e}function yt(e,t){for(let r of e)r.comment&&t.push(r.comment),r.defaultValue!==void 0?t.push(`${r.key}=${r.defaultValue}`):t.push(`#${r.key}=`)}function gr(e){return Array.from(crypto.getRandomValues(new Uint8Array(e))).map(t=>t.toString(16).padStart(2,"0")).join("")}function yr(e){return e.architecture==="fullstack"?{apiUrl:"http://localhost:3000/api",baseUrl:"http://localhost:3000"}:{apiUrl:"http://localhost:3010",baseUrl:"http://localhost:3000"}}var Co="https://your-app.example.com/api";function $t(e,t,r,n){e.push(n==="example"?`${t}=`:`${t}=${r}`)}function Rn(e,t){let r=t==="example"?void 0:e.credentials,{apiUrl:n,baseUrl:i}=yr(e),o=[];e.architecture==="separate"?o.push("# API Configuration","# Standalone backend's own URL (the frontend reaches it via the public var above).",`API_URL=${n}`,`BASE_URL=${i}`):o.push("# App","# (API_URL is derived from the frontend's *_PUBLIC_API_URL by the runtime env schema.)",`BASE_URL=${i}`),o.push("","# Client IP (production)","# The backend rate-limits by client IP and stamps it on audit entries. YOU ALMOST","# CERTAINLY DO NOT NEED THIS: it detects Vercel, Fly.io, Render, Railway, Netlify and","# Coolify from their own env vars, and treats a private connection peer (Docker, compose,","# Kubernetes, Dokploy, an nginx/Traefik/Caddy on the same host) as proof that something is","# forwarding to it. A forwarded header is trusted only in those cases, never on a server","# exposed directly - there, a caller could have sent it themselves."),e.architecture==="fullstack"?o.push("# This build runs the API in the frontend's route handler, which has no connection","# address, so on a host the backend does not recognise there is nothing to fall back on","# and every caller shares ONE rate-limit bucket: the 10/min sign-in limit applies to","# your whole app rather than per person, and audit entries record no address."):o.push("# This build reads the connection peer, so a server exposed directly identifies its","# callers correctly with nothing set here."),o.push("# SET IT when nothing above can see your topology - the common case is a CDN in front of a","# directly exposed server, where connections arrive from a public CDN address:","#   Cloudflare                        -> TRUSTED_PROXY=cf-connecting-ip","#   another proxy in front            -> TRUSTED_PROXY=1 (the number of proxies)","# Whatever you set wins over detection; `false` turns detection off and trusts nothing.","# TRUSTED_PROXY=1"),o.push("","# Auth rate limits","# Raises every Better Auth rate limit by a whole number (1-50). Unset = 1 = the","# shipped limits. No value disables them: 0, empty or unparseable fails at boot.","# You almost certainly want the default. The reason to raise it is an automated suite,","# which drives ONE address and so shares one bucket - and the e2e config already sets","# its own value, so it needs nothing here.","# AUTH_RATE_LIMIT_MULTIPLIER=1"),o.push("","# Database"),yt(Lt(Oe[e.databaseProvider].envVars,r),o),o.push("","# Cache"),yt(Lt(xe[e.cacheProvider].envVars,r),o),e.cacheProvider==="redis"&&o.push("# Optional prefix on every Redis key the app writes. Set it when several deployments share","# one Redis instance, or to keep a load test out of the live keyspace.","# Set it once, before first boot. Changing it on a running deployment orphans in-flight","# auto-top-up claims and distributed locks (autotopup:pending:*, withMutex) - drain or use","# a maintenance window first.","#REDIS_KEY_PREFIX="),o.push("","# Authentication"),t==="example"&&o.push("# Generate a strong secret, e.g. `openssl rand -hex 32`"),$t(o,"BETTER_AUTH_SECRET",crypto.randomUUID(),t),o.push("","# Content API (random secret; required when contentApi feature is enabled in @repo/config)"),$t(o,"CONTENT_API_KEY",gr(32),t),o.push("","# Job Queue - Inngest","INNGEST_APP_ID=api"),$t(o,"INNGEST_EVENT_KEY",gr(32),t),o.push("# REQUIRED in production: it is how the /inngest endpoint tells Inngest from anyone else who","# finds the URL. The app refuses to boot without it unless INNGEST_DEV is set (local dev server).","# Take the real value from the Inngest dashboard."),$t(o,"INNGEST_SIGNING_KEY",gr(32),t),o.push("# The local Inngest dev server (pnpm dev:inngest). In production on Inngest Cloud leave this UNSET:","# Cloud takes events and registration on two hosts, which no single URL can name. Set it only for a","# self-hosted Inngest, to its one host.","INNGEST_BASE_URL=http://127.0.0.1:8288"),e.architecture==="separate"&&(o.push("","# API Port (standalone backend)","API_PORT=3010"),o.push("","# CORS + cross-subdomain cookies (production only - leave unset for local dev)","# TRUSTED_ORIGINS=https://your-app.example.com","# AUTH_COOKIE_DOMAIN=.example.com"));let s=Do[e.emailProvider];if(s&&(o.push("","# Email"),yt(Lt(s,r),o)),e.paymentProvider!=="none"){let d=No[e.paymentProvider];d&&(o.push("","# Payment"),yt(Lt(d,r),o))}o.push("","# Storage - S3 Compatible (required for uploads: avatars, files)","# Works with AWS S3, Cloudflare R2, MinIO, and other S3-compatible services.","# Uploads fail until these are set - storage is enabled in @repo/config by default.","#STORAGE_REGION=us-east-1","#STORAGE_ENDPOINT=https://your-account.r2.cloudflarestorage.com","#STORAGE_ACCESS_KEY_ID=","#STORAGE_SECRET_ACCESS_KEY=","# Two buckets: one publicly readable (avatars, assets), one credentials-only (private","# uploads served through the app). The bucket boundary is the privacy guarantee.","#STORAGE_PUBLIC_BUCKET=","#STORAGE_PRIVATE_BUCKET=",'# Public base URL for the public bucket. Public file URLs are STORAGE_PUBLIC_URL + "/" + key.',"#STORAGE_PUBLIC_URL=https://cdn.example.com","","# Storage - Local Filesystem (optional overrides)","# Defaults work out of the box; override for Docker volume mounts.","#STORAGE_LOCAL_PATH=/data","#STORAGE_LOCAL_PUBLIC_URL=https://cdn.example.com/files"),o.push("","# Admin Notifications (optional)","# Real-time notifications when business events occur (signups, purchases, etc.).","# Each provider is auto-enabled when its env vars are set.","#DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...","#SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...","#TELEGRAM_BOT_TOKEN=123456789:ABCdefGHIjklMNOpqrsTUVwxyz","#TELEGRAM_CHAT_ID=-1001234567890","#TELEGRAM_TOPIC_ID=123"),o.push("","# Social sign-in (optional)","# Enable the matching provider in @repo/config, then set its pair here.","#GOOGLE_CLIENT_ID=","#GOOGLE_CLIENT_SECRET=","#GITHUB_CLIENT_ID=","#GITHUB_CLIENT_SECRET=","# Apple: APPLE_TEAM_ID + APPLE_KEY_ID + APPLE_PRIVATE_KEY are the signing key. Add APPLE_CLIENT_ID",'# (a Service ID) for the web button, and list "apple" in config.auth.socialProviders.',"#APPLE_CLIENT_ID=","#APPLE_TEAM_ID=","#APPLE_KEY_ID=","#APPLE_PRIVATE_KEY="),o.push("","# SMS - Twilio (optional)","#TWILIO_ACCOUNT_SID=ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","#TWILIO_AUTH_TOKEN=","#TWILIO_PHONE_NUMBER=+1234567890"),o.push("","# Newsletter (optional)","#RESEND_AUDIENCE_ID=","#LISTMONK_URL=https://listmonk.yourdomain.com","#LISTMONK_API_USER=admin","#LISTMONK_API_TOKEN=","#LISTMONK_LIST_ID=1"),o.push("","# Translations - OpenRouter (optional)","# Set to auto-translate en/* into your other locales with `pnpm translate`.","# The pre-commit hook runs it on commit; without a key it skips and untranslated","# locales fall back to the default locale. Get a key: https://openrouter.ai/keys","#OPENROUTER_API_KEY=");let a=[];return e.observability.includes("sentry")&&a.push({key:"SENTRY_DSN",comment:"# Overrides config.observability.sentry.dsn for the server only."}),e.observability.includes("posthog")&&a.push({key:"POSTHOG_API_KEY",comment:"# Overrides config.observability.posthog.publicKey for the server only (host stays in config)."}),a.length>0&&(o.push("","# Error and product reporting (optional)"),yt(a,o)),o.push("","# AI base (optional)","# Enable config.ai in packages/config. Built-in AI resolves through OpenRouter only,","# so OPENROUTER_API_KEY above is the only MODEL provider key the backend reads.","# BYOK is per-user and never an env var: users paste their own key in the app and it","# is stored encrypted in the database.","# Override the OpenRouter API base - a gateway or a proxy of your own. It must carry the","# /api/v1 suffix. Unset uses the hosted API.","#OPENROUTER_BASE_URL=https://openrouter.ai/api/v1","","# AI web tools (optional)","# Give the assistant its own web access, on chat (on by default), the desktop app-tools","# lane, automations and the MCP server. A key's presence is the whole switch: set one","# and the model gets its tools, set none and chat is unchanged. config.ai.webSearch:","# false switches every lane off.","# ANY one key alone covers both capabilities. With several set, auto-detection takes the","# CHEAPEST first - TinyFish, then Firecrawl, then Parallel - per capability; naming","# config.ai.webTools.searchEngine or .extractEngine wins over that order, and a named","# engine whose key is missing ships no tool at all.","# WHAT A CALL COSTS THE USER: the vendor price x credits.creditsPerUsd x the","# webSearch/webExtract markup (shipped at 100, so twice cost). Override the vendor price","# with config.ai.webTools.searchCostUsd / .extractCostUsd.","# TinyFish (the auto-detect default) - both tools at a $0 list price, so a call debits","# nothing, writes no ledger row and is never refused for an empty balance. Rate-limited","# instead (30 searches and 150 pages a minute per API key by default, shared by every","# user), so set a price on a busy app. Note its terms include a license to train on","# submitted content.","# https://agent.tinyfish.ai/","#TINYFISH_API_KEY=","# Firecrawl (the recommended PAID engine) - `web_search` AND `web_extract` (reads one","# page) from one signup, and the only vendor here whose terms carry no license over what","# you submit.","# https://firecrawl.dev/","#FIRECRAWL_API_KEY=","# Parallel (optional) - both tools, cheaper than Firecrawl on each, at high quality;","# extract is slower on a page it has not already indexed. Note its customer terms","# include a license to train on submitted queries.","# https://platform.parallel.ai/","#PARALLEL_API_KEY="),e.desktop&&o.push("","# Desktop app (optional)","# Base URL the marketing download page reads the release feed from.","# Unset uses config.desktop.autoUpdate.url.","#DESKTOP_FEED_BASE_URL="),e.mobile&&(o.push("","# Mobile app","# The bundle identifier the native Sign in with Apple token is issued to - it joins","# APPLE_CLIENT_ID in the audience the backend accepts. With the three Apple signing values","# and no APPLE_CLIENT_ID, it alone turns on native-only Sign in with Apple: the iOS app shows","# Apple beside Google (it reads that at runtime) and the web shows no Apple button.","#APPLE_APP_BUNDLE_IDENTIFIER=","# Comma-separated Android signing certificate SHA-256 fingerprints. They feed","# .well-known/assetlinks.json (which verifies your universal links) and the passkey","# Android origins.","#MOBILE_ANDROID_SHA256_FINGERPRINTS=","# Optional. An Expo access token turns on enhanced security for push sends.","#EXPO_ACCESS_TOKEN="),e.mobilePurchases==="revenuecat"&&o.push("","# Mobile store purchases - RevenueCat (server)","# The first two verify incoming webhooks; the third is read by the sync route and the","# nightly reconcile pass.","#REVENUECAT_WEBHOOK_SECRET=","#REVENUECAT_AUTH_HEADER=","#REVENUECAT_API_KEY=")),o.push("","# Build output (optional)","# Next's distDir for apps/web. Unset uses .next; the e2e harness sets its own so a test","# build never overwrites a dev server's.","#NEXT_DIST_DIR="),o.push(""),o.join(`
 `)}var _n="NEXT_PUBLIC_API_URL";function Lo(e){let{apiUrl:t}=yr(e),r=["# API Configuration",`${_n}=${t}`];return e.architecture==="separate"&&r.push("","# Production (uncomment and replace with your deployed hostnames):",`# ${_n}=${Co}`),r.push(""),r.join(`
 `)}function $o(e){let{apiUrl:t,baseUrl:r}=yr(e),n=["# Expo reads env from THIS directory, never the monorepo root.","# Every EXPO_PUBLIC_* value is inlined into the app bundle - never put a secret here.","# Android emulator: replace localhost with 10.0.2.2; a physical device needs your machine's LAN IP","# EXPO_PUBLIC_API_URL is the value to fill first - without it the app throws at launch and names it.",`EXPO_PUBLIC_API_URL=${t}`,`EXPO_PUBLIC_WEB_URL=${r}`,"","# Native Google sign-in (optional)","#EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID=","#EXPO_PUBLIC_GOOGLE_IOS_CLIENT_ID="];e.mobilePurchases==="revenuecat"&&n.push("","# RevenueCat public SDK keys (optional until you create your products)","#EXPO_PUBLIC_REVENUECAT_IOS_KEY=","#EXPO_PUBLIC_REVENUECAT_ANDROID_KEY=");let i=[];return e.observability.includes("sentry")&&i.push("#EXPO_PUBLIC_SENTRY_DSN="),e.observability.includes("posthog")&&i.push("#EXPO_PUBLIC_POSTHOG_KEY="),i.length>0&&n.push("","# Observability (optional)",...i),n.push(""),n.join(`
 `)}async function On(e){let t=Lo(e);if(await l(`${e.projectDir}/.env`,`${t}
@@ -1626,7 +1627,7 @@ function posthogConfigured(): boolean {
 ${w}`:s.message))}else i()})})}async function Hi(e){if(!Ke("pnpm"))return C.log.warn("pnpm not found. Skipping lockfile regeneration."),!1;try{return await Be("pnpm",["install","--lockfile-only","--no-frozen-lockfile"],e),!0}catch(t){let r=t instanceof Error?t.message:String(t);return C.log.warn(`Lockfile regeneration failed: ${r}`),C.log.warn("Deploys using --frozen-lockfile may fail."),!1}}async function Yi(e){if(!Ke("pnpm"))return C.log.warn("pnpm not found. Skipping dependency installation."),C.log.info("Install pnpm: https://pnpm.io/installation"),!1;let t=C.spinner();t.start("Installing dependencies (this may take a minute)...");try{return await Be("pnpm",["install"],e),t.stop("Dependencies installed."),!0}catch(r){t.stop("Dependency installation failed.");let n=r instanceof Error?r.message:String(r);return C.log.warn(`pnpm install failed: ${n}`),C.log.warn("You can run it manually later."),!1}}async function Wi(e){if(!Ke("pnpm"))return!1;let t=C.spinner();t.start("Generating baseline database migration...");try{return await Be("pnpm",["-F","@repo/database","generate"],e),t.stop("Baseline migration generated."),!0}catch(r){t.stop("Baseline migration generation failed.");let n=r instanceof Error?r.message:String(r);return C.log.warn(`Could not generate baseline migration: ${n}`),C.log.warn("Run 'pnpm -F @repo/database generate' before your first deploy."),!1}}async function zi(e){try{return await Gi(Nr(e,".git")),C.log.info("Git repository already exists, skipping init."),!0}catch{}if(!Ke("git"))return C.log.warn("git not found. Skipping repository initialization."),!1;let t=C.spinner();t.start("Initializing git repository...");try{return await Be("git",["init"],e),await Be("git",["add","-A"],e),await Be("git",["commit","--no-verify","-m","Initial commit from GenerateSaaS"],e),t.stop("Git repository initialized."),!0}catch{return t.stop("Git initialization failed."),C.log.warn("You can run git init manually later."),!1}}async function qi(e){if(!Ke("pnpm"))return!1;try{await Gi(Nr(e,".git"))}catch{return!1}try{let t=JSON.parse(await $l(Nr(e,"package.json"),"utf-8")),r=!!t.devDependencies?.["simple-git-hooks"],n=!!t["simple-git-hooks"];if(!r||!n)return!1}catch{return!1}try{return await Be("pnpm",["exec","simple-git-hooks"],e),!0}catch{return C.log.warn("Could not install git hooks. Run 'pnpm exec simple-git-hooks' manually."),!1}}import*as Ge from"@clack/prompts";import J from"picocolors";function Ji(e,t){let r=Xe(e);t.dockerAvailable||Ge.log.warn("Docker not found. Install Docker to run local services: https://docs.docker.com/get-docker/"),t.baselineMigrationMissing&&Ge.log.warn("No database migration was generated (the install did not complete). Run `pnpm install` then `pnpm --filter @repo/database generate` and commit the result BEFORE deploying - otherwise your first deploy pushes the schema untracked.");let n=[];n.push(`cd ${e.projectDir}`),t.pnpmInstalled||n.push("pnpm install"),n.push(`pnpm infra         ${J.dim(`# ${r.map(a=>Kr[a].label).join(", ")}`)}`),n.push(`pnpm dev           ${J.dim("# http://localhost:3000")}`),t.skippedCredentials.length>0&&(n.push(""),n.push(J.dim("Fill in remaining TODO values in .env"))),Ge.note(n.join(`
 `),J.yellow("Start Development"));let i=[];i.push(`App          ${J.cyan("http://localhost:3000")}`),e.architecture==="separate"&&i.push(`API          ${J.cyan("http://localhost:3010")}`),r.includes("mailpit")&&i.push(`Mailpit      ${J.cyan("http://localhost:8025")}`),r.includes("inngest")&&i.push(`Inngest      ${J.cyan("http://localhost:8288")}`),Ge.note(i.join(`
 `),J.yellow("Dev Tools"));let o=[],s=jl(e);s.length>0&&o.push(`Set in production: ${J.dim(s.join(", "))}`),o.push("pnpm db:setup      # Apply the database schema"),o.push(Ml(e)),Ge.note(o.join(`
-`),J.yellow("Deployment"))}function jl(e){let t=["DATABASE_URL","BETTER_AUTH_SECRET","INNGEST_APP_ID","INNGEST_EVENT_KEY","INNGEST_SIGNING_KEY"];return e.cacheProvider==="upstash"?t.push("UPSTASH_REDIS_REST_URL","UPSTASH_REDIS_REST_TOKEN"):t.push("REDIS_URL"),e.paymentProvider==="stripe"?t.push("STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET"):e.paymentProvider==="polar"&&t.push("POLAR_ACCESS_TOKEN","POLAR_WEBHOOK_SECRET"),e.emailProvider==="ses"?t.push("AMAZON_SES_REGION","AMAZON_SES_KEY","AMAZON_SES_SECRET"):e.emailProvider==="resend"?t.push("RESEND_API_KEY"):t.push("SMTP_HOST","SMTP_PORT"),t}function Ml(e){switch(e.deploymentTarget){case"node":return"Deploy with Docker or your preferred Node.js host";case"vercel":return"vercel deploy       # Deploy to Vercel"}}function at(e){let r=(e.startsWith("v")?e.slice(1):e).match(/^(\d+)\.(\d+)\.(\d+)$/);return r?[Number(r[1]),Number(r[2]),Number(r[3])]:null}function Ie(e,t){let r=at(e),n=at(t);if(!r||!n)return 0;for(let i=0;i<3;i++)if(r[i]!==n[i])return r[i]-n[i];return 0}function Wt(e,t){return e.versions.find(r=>r.version===t)?.cli}function Xi(e){return process.env.GENERATESAAS_TEMPLATE_TARBALL||process.env.GENERATESAAS_TEMPLATE_TARBALL_DIR||process.env.GENERATESAAS_OFFLINE_LICENSE==="1"?!0:at(e)===null}function zt(e,t,r="3.20.0"){if(Xi(r))return{ok:!0};let n=Wt(e,e.latest);return!n||at(n)===null?{ok:!0}:Ie(r,n)>=0?{ok:!0}:{ok:!1,message:`Your installed generatesaas CLI (v${r}) is too old for template v${e.latest}, which needs CLI v${n} or newer. Run npx generatesaas@latest ${t} so npm fetches the current CLI. If the release happened minutes ago, npm may still be propagating it - retry shortly.`}}function Zi(e,t,r="3.20.0"){if(Xi(r))return{ok:!0};let n=Wt(e,t);return!n||at(n)===null?{ok:!0}:Ie(r,n)===0?{ok:!0}:{ok:!1,message:`Template v${t} must be scaffolded by CLI v${n} exactly (the CLI whose generators produced that release). Run npx generatesaas@${n} init.`}}import Gl from"picocolors";var Hl="a10a6fb9d7cadde32e37dad52059d17b5d2b916b08c76d8fbcc99982e9a3d87f";async function Yl(e){let t=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(`generatesaas-demo:${e}`)),r=[...new Uint8Array(t).subarray(0,16)].map(n=>n.toString(16).padStart(2,"0")).join("");return`${r.slice(0,8)}-${r.slice(8,12)}-${r.slice(12,16)}-${r.slice(16,20)}-${r.slice(20,32)}`}function Qi(e){e.command("init").description("Scaffold a new GenerateSaaS project").argument("[apiKey]","license key (same as --api-key)").option("-n, --name <name>","project name (lowercase, hyphens, starts with letter)").option("--app-name <name>","display name for the app").option("-l, --location <path>","project directory (default: ./{name})").addOption(new X("--architecture <type>","fullstack or separate").choices([...Ze])).addOption(new X("--payment <provider>","payment provider").choices([...Qe])).addOption(new X("--email <provider>","email provider").choices([...et])).option("--org","enable multi-tenancy (organizations)").option("--no-org","disable multi-tenancy").option("--projects","enable projects (a switcher that scopes a user's work)").option("--no-projects","disable projects").option("--docs","include the docs app (apps/docs, Fumadocs)").option("--no-docs","exclude the docs app").option("--desktop","include the desktop app (apps/desktop, built with Electron)").option("--no-desktop","exclude the desktop app").option("--mobile","include the mobile app (apps/mobile, built with Expo)").option("--no-mobile","exclude the mobile app").addOption(new X("--mobile-purchases <lane>","in-app purchases in the mobile app: revenuecat adds the store billing lane on top of your web payment provider, none keeps web billing only").choices([...Ne])).option("--ai","include the AI features (chat, models, automations, integrations)").option("--no-ai","exclude the AI features").option("--web-ai","show the AI features in the web app (the default)").option("--no-web-ai","desktop-first: keep the AI features out of the web app, which is reduced to account, login and billing - the desktop or mobile app is the AI product. Requires --desktop or --mobile, plus --ai").option("--revenue-sharing","enable revenue sharing").option("--no-revenue-sharing","disable revenue sharing").option("--credits","enable credits system").option("--no-credits","disable credits system (subscription-only)").addOption(new X("--currency <code>","default currency for billing").choices([...pe])).addOption(new X("--preset <preset>","infrastructure preset: serverless (Vercel + Neon + Upstash) or selfhost (Docker or Node + Postgres + Redis); --deploy/--database/--cache override it piecewise").choices([...De])).addOption(new X("--deploy <target>","deployment target").choices([...de])).addOption(new X("--database <provider>","database provider").choices([...ue])).addOption(new X("--cache <provider>","cache provider").choices([...me])).option("--observability <providers>",`comma-separated observability providers (${F.join(", ")}); anything unselected ships no SDK`).option("--api-key <key>","API key (skips interactive prompt)").option("--base-url <url>","public base URL (e.g. https://example.com) - bakes into canonical/og/sitemap").option("-y, --yes","accept defaults for unspecified options (non-interactive)").addOption(new X("--demo","first-party demo build: keep sample content, mark site non-indexable - requires CI API key").hideHelp()).addOption(new X("--no-db-migration","skip generating the baseline DB migration (internal: demos/CI/playground)").hideHelp()).action(async(t,r)=>{await Wl(t?{...r,apiKey:t}:r)})}async function Wl(e){let t=performance.now();Vr("3.20.0");let r;try{r=Zr(e)}catch(E){S.cancel(N(E)),process.exit(1)}let n=S.spinner(),i;try{i=await rt({apiKey:e.apiKey,prompt:!e.yes})}catch(E){S.cancel(N(E)),process.exit(1)}e.demo&&Tr(i)!==Hl&&(S.cancel("--demo is restricted to first-party demo deployments."),process.exit(1));let o=ge(i),s,a=async()=>{s=await Ae(o);let E=zt(s,"init");if(!E.ok)throw new Error(E.message);return{latestVersion:s.latest,selectedVersion:s.latest,desktopAllowed:s.entitlements?.desktopAllowed??!0,mobileAllowed:s.entitlements?.mobileAllowed??!0}};n.start("Verifying access...");let d,h,g=!0,w=!0;try{({latestVersion:d,selectedVersion:h,desktopAllowed:g,mobileAllowed:w}=await a()),n.stop("Access verified."),Le(i)}catch(E){if(n.stop("Access verification failed."),E instanceof $&&E.status===401){e.yes&&(S.cancel("Invalid API key. Cannot prompt in non-interactive mode."),process.exit(1)),S.log.warning("Invalid API key."),i=await ht(),o=ge(i),n.start("Verifying access...");try{({latestVersion:d,selectedVersion:h,desktopAllowed:g,mobileAllowed:w}=await a()),n.stop("Access verified."),Le(i)}catch(_){n.stop("Access verification failed."),S.cancel(_ instanceof $&&_.status===401?"Invalid API key.":N(_)),process.exit(1)}}else S.cancel(N(E)),process.exit(1)}S.log.success(`Latest version: ${d}`),r.desktop===!0&&!g&&(S.cancel("The desktop app is available on the Pro plan and up. Upgrade your plan at generatesaas.com."),process.exit(1)),r.mobile===!0&&!w&&(S.cancel("The mobile app is available on the Pro plan and up. Upgrade your plan at generatesaas.com."),process.exit(1));let v;e.yes?v=Qr({...r,...g?{}:{desktop:!1},...w?{}:{mobile:!1}}):v=await en(r,{desktopAllowed:g,mobileAllowed:w});let P;n.start("Activating license...");try{let E=e.demo&&v.baseUrl?await Yl(v.baseUrl):crypto.randomUUID(),_=()=>({frontend:sr,version:h,installId:E,projectName:v.projectName,options:cn(v)}),Q;try{Q=await or(o,_())}catch(G){let j=_t(G);if(!j?.lastAllowedVersion||!s)throw G;n.stop("License activation failed.");let ee=Zi(s,j.lastAllowedVersion);if(ee.ok||(S.cancel(`${j.message} ${ee.message}`),process.exit(1)),e.yes){let we=Wt(s,j.lastAllowedVersion);S.cancel(`${j.message} Re-run ${we?`npx generatesaas@${we} init`:"init"} without --yes to continue with v${j.lastAllowedVersion} (the last version your license covers).`),process.exit(1)}let H=await S.confirm({message:`Your update window has ended. Continue with v${j.lastAllowedVersion} (the last version your license covers)?`});(S.isCancel(H)||!H)&&(S.cancel("Setup cancelled."),process.exit(0)),h=j.lastAllowedVersion,n.start(`Activating license for v${h}...`),Q=await or(o,_())}P={token:Q.token,keyHash:Tr(i),installId:Q.installId??E},n.stop("License activated.")}catch(E){n.stop("License activation failed."),S.cancel(N(E)),process.exit(1)}let m=Kl(v.projectDir);if(Ul(m)&&Fl(m).length>0)if(e.yes)S.log.info(`Directory ${m} is not empty. Merging (keeping existing files, overwriting conflicts).`);else{let _=await S.select({message:`Directory ${m} is not empty.`,options:[{value:"merge",label:"Merge",hint:"keep existing files, overwrite conflicts"},{value:"overwrite",label:"Overwrite",hint:"delete everything and start fresh"},{value:"cancel",label:"Cancel"}]});(S.isCancel(_)||_==="cancel")&&(S.cancel("Setup cancelled."),process.exit(0)),_==="overwrite"&&Vl(m,{recursive:!0,force:!0})}let D={...v,projectDir:m,version:h,...e.demo?{docs:!1}:{}};n.start("Downloading template...");try{await Ot(o,h,m),n.stop("Template downloaded.")}catch(E){n.stop("Download failed."),S.cancel(N(E)),process.exit(1)}n.start("Generating project files...");try{if(await Ht(D),!e.demo){let E=await ot(m);await l(Bl(m,Tt),`${JSON.stringify(E,null,"	")}
+`),J.yellow("Deployment"))}function jl(e){let t=["DATABASE_URL","BETTER_AUTH_SECRET","INNGEST_APP_ID","INNGEST_EVENT_KEY","INNGEST_SIGNING_KEY"];return e.cacheProvider==="upstash"?t.push("UPSTASH_REDIS_REST_URL","UPSTASH_REDIS_REST_TOKEN"):t.push("REDIS_URL"),e.paymentProvider==="stripe"?t.push("STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET"):e.paymentProvider==="polar"&&t.push("POLAR_ACCESS_TOKEN","POLAR_WEBHOOK_SECRET"),e.emailProvider==="ses"?t.push("AMAZON_SES_REGION","AMAZON_SES_KEY","AMAZON_SES_SECRET"):e.emailProvider==="resend"?t.push("RESEND_API_KEY"):t.push("SMTP_HOST","SMTP_PORT"),t}function Ml(e){switch(e.deploymentTarget){case"node":return"Deploy with Docker or your preferred Node.js host";case"vercel":return"vercel deploy       # Deploy to Vercel"}}function at(e){let r=(e.startsWith("v")?e.slice(1):e).match(/^(\d+)\.(\d+)\.(\d+)$/);return r?[Number(r[1]),Number(r[2]),Number(r[3])]:null}function Ie(e,t){let r=at(e),n=at(t);if(!r||!n)return 0;for(let i=0;i<3;i++)if(r[i]!==n[i])return r[i]-n[i];return 0}function Wt(e,t){return e.versions.find(r=>r.version===t)?.cli}function Xi(e){return process.env.GENERATESAAS_TEMPLATE_TARBALL||process.env.GENERATESAAS_TEMPLATE_TARBALL_DIR||process.env.GENERATESAAS_OFFLINE_LICENSE==="1"?!0:at(e)===null}function zt(e,t,r="3.21.0"){if(Xi(r))return{ok:!0};let n=Wt(e,e.latest);return!n||at(n)===null?{ok:!0}:Ie(r,n)>=0?{ok:!0}:{ok:!1,message:`Your installed generatesaas CLI (v${r}) is too old for template v${e.latest}, which needs CLI v${n} or newer. Run npx generatesaas@latest ${t} so npm fetches the current CLI. If the release happened minutes ago, npm may still be propagating it - retry shortly.`}}function Zi(e,t,r="3.21.0"){if(Xi(r))return{ok:!0};let n=Wt(e,t);return!n||at(n)===null?{ok:!0}:Ie(r,n)===0?{ok:!0}:{ok:!1,message:`Template v${t} must be scaffolded by CLI v${n} exactly (the CLI whose generators produced that release). Run npx generatesaas@${n} init.`}}import Gl from"picocolors";var Hl="a10a6fb9d7cadde32e37dad52059d17b5d2b916b08c76d8fbcc99982e9a3d87f";async function Yl(e){let t=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(`generatesaas-demo:${e}`)),r=[...new Uint8Array(t).subarray(0,16)].map(n=>n.toString(16).padStart(2,"0")).join("");return`${r.slice(0,8)}-${r.slice(8,12)}-${r.slice(12,16)}-${r.slice(16,20)}-${r.slice(20,32)}`}function Qi(e){e.command("init").description("Scaffold a new GenerateSaaS project").argument("[apiKey]","license key (same as --api-key)").option("-n, --name <name>","project name (lowercase, hyphens, starts with letter)").option("--app-name <name>","display name for the app").option("-l, --location <path>","project directory (default: ./{name})").addOption(new X("--architecture <type>","fullstack or separate").choices([...Ze])).addOption(new X("--payment <provider>","payment provider").choices([...Qe])).addOption(new X("--email <provider>","email provider").choices([...et])).option("--org","enable multi-tenancy (organizations)").option("--no-org","disable multi-tenancy").option("--projects","enable projects (a switcher that scopes a user's work)").option("--no-projects","disable projects").option("--docs","include the docs app (apps/docs, Fumadocs)").option("--no-docs","exclude the docs app").option("--desktop","include the desktop app (apps/desktop, built with Electron)").option("--no-desktop","exclude the desktop app").option("--mobile","include the mobile app (apps/mobile, built with Expo)").option("--no-mobile","exclude the mobile app").addOption(new X("--mobile-purchases <lane>","in-app purchases in the mobile app: revenuecat adds the store billing lane on top of your web payment provider, none keeps web billing only").choices([...Ne])).option("--ai","include the AI features (chat, models, automations, integrations)").option("--no-ai","exclude the AI features").option("--web-ai","show the AI features in the web app (the default)").option("--no-web-ai","desktop-first: keep the AI features out of the web app, which is reduced to account, login and billing - the desktop or mobile app is the AI product. Requires --desktop or --mobile, plus --ai").option("--revenue-sharing","enable revenue sharing").option("--no-revenue-sharing","disable revenue sharing").option("--credits","enable credits system").option("--no-credits","disable credits system (subscription-only)").addOption(new X("--currency <code>","default currency for billing").choices([...pe])).addOption(new X("--preset <preset>","infrastructure preset: serverless (Vercel + Neon + Upstash) or selfhost (Docker or Node + Postgres + Redis); --deploy/--database/--cache override it piecewise").choices([...De])).addOption(new X("--deploy <target>","deployment target").choices([...de])).addOption(new X("--database <provider>","database provider").choices([...ue])).addOption(new X("--cache <provider>","cache provider").choices([...me])).option("--observability <providers>",`comma-separated observability providers (${F.join(", ")}); anything unselected ships no SDK`).option("--api-key <key>","API key (skips interactive prompt)").option("--base-url <url>","public base URL (e.g. https://example.com) - bakes into canonical/og/sitemap").option("-y, --yes","accept defaults for unspecified options (non-interactive)").addOption(new X("--demo","first-party demo build: keep sample content, mark site non-indexable - requires CI API key").hideHelp()).addOption(new X("--no-db-migration","skip generating the baseline DB migration (internal: demos/CI/playground)").hideHelp()).action(async(t,r)=>{await Wl(t?{...r,apiKey:t}:r)})}async function Wl(e){let t=performance.now();Vr("3.21.0");let r;try{r=Zr(e)}catch(E){S.cancel(N(E)),process.exit(1)}let n=S.spinner(),i;try{i=await rt({apiKey:e.apiKey,prompt:!e.yes})}catch(E){S.cancel(N(E)),process.exit(1)}e.demo&&Tr(i)!==Hl&&(S.cancel("--demo is restricted to first-party demo deployments."),process.exit(1));let o=ge(i),s,a=async()=>{s=await Ae(o);let E=zt(s,"init");if(!E.ok)throw new Error(E.message);return{latestVersion:s.latest,selectedVersion:s.latest,desktopAllowed:s.entitlements?.desktopAllowed??!0,mobileAllowed:s.entitlements?.mobileAllowed??!0}};n.start("Verifying access...");let d,h,g=!0,w=!0;try{({latestVersion:d,selectedVersion:h,desktopAllowed:g,mobileAllowed:w}=await a()),n.stop("Access verified."),Le(i)}catch(E){if(n.stop("Access verification failed."),E instanceof $&&E.status===401){e.yes&&(S.cancel("Invalid API key. Cannot prompt in non-interactive mode."),process.exit(1)),S.log.warning("Invalid API key."),i=await ht(),o=ge(i),n.start("Verifying access...");try{({latestVersion:d,selectedVersion:h,desktopAllowed:g,mobileAllowed:w}=await a()),n.stop("Access verified."),Le(i)}catch(_){n.stop("Access verification failed."),S.cancel(_ instanceof $&&_.status===401?"Invalid API key.":N(_)),process.exit(1)}}else S.cancel(N(E)),process.exit(1)}S.log.success(`Latest version: ${d}`),r.desktop===!0&&!g&&(S.cancel("The desktop app is available on the Pro plan and up. Upgrade your plan at generatesaas.com."),process.exit(1)),r.mobile===!0&&!w&&(S.cancel("The mobile app is available on the Pro plan and up. Upgrade your plan at generatesaas.com."),process.exit(1));let v;e.yes?v=Qr({...r,...g?{}:{desktop:!1},...w?{}:{mobile:!1}}):v=await en(r,{desktopAllowed:g,mobileAllowed:w});let P;n.start("Activating license...");try{let E=e.demo&&v.baseUrl?await Yl(v.baseUrl):crypto.randomUUID(),_=()=>({frontend:sr,version:h,installId:E,projectName:v.projectName,options:cn(v)}),Q;try{Q=await or(o,_())}catch(G){let j=_t(G);if(!j?.lastAllowedVersion||!s)throw G;n.stop("License activation failed.");let ee=Zi(s,j.lastAllowedVersion);if(ee.ok||(S.cancel(`${j.message} ${ee.message}`),process.exit(1)),e.yes){let we=Wt(s,j.lastAllowedVersion);S.cancel(`${j.message} Re-run ${we?`npx generatesaas@${we} init`:"init"} without --yes to continue with v${j.lastAllowedVersion} (the last version your license covers).`),process.exit(1)}let H=await S.confirm({message:`Your update window has ended. Continue with v${j.lastAllowedVersion} (the last version your license covers)?`});(S.isCancel(H)||!H)&&(S.cancel("Setup cancelled."),process.exit(0)),h=j.lastAllowedVersion,n.start(`Activating license for v${h}...`),Q=await or(o,_())}P={token:Q.token,keyHash:Tr(i),installId:Q.installId??E},n.stop("License activated.")}catch(E){n.stop("License activation failed."),S.cancel(N(E)),process.exit(1)}let m=Kl(v.projectDir);if(Ul(m)&&Fl(m).length>0)if(e.yes)S.log.info(`Directory ${m} is not empty. Merging (keeping existing files, overwriting conflicts).`);else{let _=await S.select({message:`Directory ${m} is not empty.`,options:[{value:"merge",label:"Merge",hint:"keep existing files, overwrite conflicts"},{value:"overwrite",label:"Overwrite",hint:"delete everything and start fresh"},{value:"cancel",label:"Cancel"}]});(S.isCancel(_)||_==="cancel")&&(S.cancel("Setup cancelled."),process.exit(0)),_==="overwrite"&&Vl(m,{recursive:!0,force:!0})}let D={...v,projectDir:m,version:h,...e.demo?{docs:!1}:{}};n.start("Downloading template...");try{await Ot(o,h,m),n.stop("Template downloaded.")}catch(E){n.stop("Download failed."),S.cancel(N(E)),process.exit(1)}n.start("Generating project files...");try{if(await Ht(D),!e.demo){let E=await ot(m);await l(Bl(m,Tt),`${JSON.stringify(E,null,"	")}
 `),await Fi(m,m)}await Ki(m),await Mi(D,P),n.stop("Project files generated.")}catch(E){n.stop("Generation failed."),S.cancel(N(E)),process.exit(1)}!await Hi(m)&&D.demo===!0&&(S.cancel("Lockfile regeneration failed on a demo build - refusing to ship a stale lockfile."),process.exit(1));let K=await Yi(m),ae=D.demo!==!0&&e.dbMigration!==!1,Te=!1;ae&&K&&(await Wi(m),Te=!0),await zi(m),K&&await qi(m);let Re=Ke("docker"),ce=rr(D).map(E=>E.key).filter(E=>!D.credentials?.[E]);Ji(D,{pnpmInstalled:K,dockerAvailable:Re,skippedCredentials:ce,baselineMigrationMissing:ae&&!Te}),Br(),S.log.info(Gl.dim(`Done in ${((performance.now()-t)/1e3).toFixed(1)}s`))}import{existsSync as qt}from"fs";import{readFile as ss}from"fs/promises";import{join as He,resolve as Zl}from"path";import*as b from"@clack/prompts";import L from"picocolors";import{mkdtemp as zl,rm as ql}from"fs/promises";import{tmpdir as Jl}from"os";import{join as Xl}from"path";async function Cr(e,t,r,n){let i=await zl(Xl(Jl(),"generatesaas-stage-"));try{await Ot(e,t,i),await Ht({...r,projectDir:i}),await Rr(i,n)}finally{await ql(i,{recursive:!0,force:!0})}}function es(e){return e?"ON":"OFF"}var ct="packages/config/src/index.ts";function ts(e){let t=e.databaseProvider!==void 0&&e.databaseProvider!=="postgres",r=e.cacheProvider!==void 0&&e.cacheProvider!=="redis";return[...e.dockerServices??[]].filter(n=>!(n==="postgres"&&t)&&!(n==="redis"&&r)).sort()}function rs(e){return[...Xe({databaseProvider:e.databaseProvider??"postgres",cacheProvider:e.cacheProvider??"redis",emailProvider:e.emailProvider??"smtp"})].sort()}var Lr=[{key:"errorTracking",severity:"warn",normalize:e=>{e.errorTracking===void 0||e.observability!==void 0||(e.observability=e.errorTracking==="none"?[]:[e.errorTracking])},preserved:()=>!0,describe:()=>"Retired option `errorTracking`: it is now `observability`, an array, because a project may run more than one provider at once. Your recorded choice was migrated across automatically."},{key:"companion",severity:"warn",normalize:e=>{e.companion===void 0||e.runner!==void 0||(e.runner=e.companion)},preserved:()=>!0,describe:()=>"Retired option `companion`: it was renamed to `runner`, and that lane has since been removed. Your recorded choice was migrated across automatically so the removal is reported under one name."},{key:"runner",severity:"warn",preserved:e=>e.runner!==!0,describe:()=>"Retired option `runner`: your project recorded the runner ON, and the paired-device lane is GONE - not moved to config, removed. This update deletes the pairing endpoint, the dispatch transport, the relay, the `/runner/*` routes and the Runners page from your project, so machines your users had paired are no longer reachable from it. Chat and automations keep running on your app's own AI backend (`config.ai`); nothing else about them changes."},{key:"companionSource",severity:"warn",preserved:()=>!1,describe:e=>`Retired option \`companionSource\`: your project recorded a \`${String(e.companionSource)}\` daemon source. The paired-device lane that daemon served has been removed from your project, so there is no daemon left to source.`},{key:"companionName",severity:"warn",preserved:()=>!1,describe:e=>`Retired option \`companionName\`: your project recorded a branded daemon called ${e.companionName}. The paired-device lane is gone, so your project no longer ships an install flow to brand. An existing install on a user's machine keeps running; it has nothing left to pair with here.`},{key:"companionRepoUrl",severity:"warn",preserved:()=>!1,describe:e=>`Retired option \`companionRepoUrl\`: your project pointed its install flow at ${e.companionRepoUrl}. The paired-device lane is gone, so there is no install flow left to point anywhere.`},{key:"companionLocalPath",severity:"warn",preserved:e=>(e.companionLocalPath??"").trim()==="",describe:e=>`Retired option \`companionLocalPath\`: your project recorded a local daemon checkout at ${e.companionLocalPath}. The option is gone, and so is the paired-device lane behind it - nothing in your project is built from a local daemon checkout any more.`},{key:"desktopAutoRelease",severity:"warn",applies:e=>e.desktop===!0,preserved:e=>e.desktopAutoRelease!==!0,describe:()=>"Retired option `desktopAutoRelease`: your project recorded automatic desktop releases, but the release trigger is no longer an option - cutting a release publishes signed installers from your repository and spends your Actions minutes, so it is always deliberate now. The staged `.github/workflows/desktop-release.yml` runs on `workflow_dispatch` only (the Actions tab). Add a `workflow_run` block to it if you want the CI-chained trigger back."},{key:"billingScope",severity:"ask",applies:e=>e.multiTenancy===!0,preserved:e=>e.billingScope!=="organization",describe:()=>"Retired option `billingScope`: your project recorded organization-scoped billing, and organization billing is GONE - not moved to config, removed. Money now lives only on a USER: an organization has no balance, no plan and no payment-provider customer of its own, and a workspace is funded by that organization's OWNER, whose personal balance every credit spent in it is drawn from. Payments already in flight are safe - a webhook arriving with old organization metadata is credited to that organization's owner rather than dropped - but a STORED balance is not: the `credits` and `plan` columns an organization holds them in are going away, and this update does NOT migrate them for you. MOVE every paying organization's credits and plan onto its owner BEFORE you take new checkouts, or that balance goes with the columns. How should this update proceed?"},{key:"socialProviders",severity:"warn",preserved:e=>(e.socialProviders??[]).length===0,describe:e=>`Retired option \`socialProviders\`: your project recorded ${(e.socialProviders??[]).join(", ")}, but it is now a plain config value that starts empty. Add those IDs back to \`config.auth.socialProviders\` in ${ct} or their sign-in buttons stop rendering.`},{key:"mcpServer",severity:"warn",preserved:e=>e.mcpServer!==!0,describe:()=>`Retired option \`mcpServer\`: your project recorded the outward MCP server ON, but its code now ships to every project behind a config gate generated OFF. Set \`config.mcpServer.enabled\` to \`true\` in ${ct} to keep your /mcp endpoint and its settings tab.`},{key:"emailTracking",severity:"ask",preserved:e=>e.emailTracking!==!1,describe:()=>`Retired option \`emailTracking\`: your project recorded email open/click tracking OFF, but it is now a plain config value generated ON. Applying this update as-is starts tracking opens and clicks for every user you mail. Put it back by setting \`config.email.tracking.enabled\` to \`false\` in ${ct}. How should this update proceed?`},{key:"aiBuiltin",severity:"warn",normalize:e=>{e.aiBuiltin===void 0&&e.aiByok!==void 0&&(e.aiBuiltin=e.aiByok===!1)},applies:e=>e.ai===!0,preserved:e=>e.aiBuiltin===re(e),describe:e=>`Retired option \`aiBuiltin\`: your project recorded built-in AI models ${es(e.aiBuiltin)}, but it is now a plain config value generated ${es(re(e))} for a project ${re(e)?"with":"without"} a payment provider. Set \`config.ai.builtin\` to \`${String(e.aiBuiltin===!0)}\` in ${ct} to keep your choice.`},{key:"aiByok",severity:"warn",applies:e=>e.ai===!0,preserved:e=>e.aiByok!==!1,describe:()=>`Retired option \`aiByok\`: your project recorded bring-your-own-key AI OFF, but it is now a plain config value generated ON. Set \`config.ai.byok\` to \`false\` in ${ct} to keep it off.`},{key:"dockerServices",severity:"warn",preserved:e=>ts(e).join(",")===rs(e).join(","),describe:e=>`Retired option \`dockerServices\`: your project recorded ${ts(e).join(", ")||"no services"}, but the local Docker services are now DERIVED from your stack - postgres when you self-host Postgres, redis when you self-host Redis, mailpit on SMTP, inngest always - so an inconsistent selection is no longer possible. Your regenerated \`infra/docker-compose.yml\` will contain ${rs(e).join(", ")}. Add any extra service back by hand; the file is yours to edit.`},{key:"aiTools",severity:"warn",preserved:e=>(e.aiTools??[]).length===Hr.length,describe:e=>`Retired option \`aiTools\`: your project recorded ${(e.aiTools??[]).join(", ")||"no AI tools"}, but the \`generatesaas-update\` skill bundle now ships to every AI-tool root (${Ve.join(", ")}) so it is there whichever assistant you switch to. Delete the roots you do not use - they are plain text files with no runtime path.`},{key:"blog",severity:"warn",preserved:e=>e.blog!==!1,describe:()=>`Retired option \`blog\`: your project recorded the blog OFF, but content is no longer an option. This update adds the \`/blog\`, \`/alternatives\` and \`/compare\` route code to your project; every one of them 404s until you add a file under \`packages/content/{locale}/{section}/\`, and none of them appears in your navbar, footer, sitemap or llms.txt while it is empty. Delete an entry from \`config.content.sections\` in ${ct} to drop a section for good.`}],hf=Lr.map(e=>e.key);function ns(e){for(let t of Lr)t.normalize?.(e)}function is(e){let t=[];for(let r of Lr){if(r.normalize?.(e),e[r.key]===void 0)continue;(!r.applies||r.applies(e))&&!r.preserved(e)&&t.push({key:r.key,message:r.describe(e),severity:r.severity}),delete e[r.key]}return t}function os(e){e.command("update").description("Update AI skill files and stage template updates").allowExcessArguments(!0).option("--cwd <path>","project directory (default: current directory)").option("--answer <id=choice>","answer a question that would otherwise prompt (repeatable), e.g. --answer desktop-migration=keep-ai",Ql,[]).action(async(t,r)=>{r.args.length>0&&b.log.warn("`auto` is now the default and the argument is ignored.");let n=ep(t.answer),i=Zl(t.cwd??process.cwd()),o=He(i,he),s;try{s=JSON.parse(await ss(o,"utf-8"))}catch{b.cancel(".generatesaas/manifest.json not found. Run this from a GenerateSaaS project."),process.exit(1)}s.frontend===nr&&(b.cancel(`This project was generated on the Nuxt frontend (\`.generatesaas/manifest.json\` records \`frontend: "${nr}"\`).
 
 v${ir} is the last release that ships a Nuxt frontend, and this CLI cannot update or migrate a Nuxt project to Next.js.
@@ -1683,7 +1684,7 @@ ${w}`}).join(`
 `]},{file:"packages/api/src/routes/public/v1/health.ts",removals:[`import { manifest } from "../../../lib/manifest";
 `],replacements:[{from:'c.json({ status: "success" as const, version: manifest?.version })',to:'c.json({ status: "success" as const })'}]}];function Sp(){return Ve.flatMap(e=>xr.map(t=>Ye(e,t)))}function jr(e){return Jt(e)?(wp(e,{recursive:!0}),!0):!1}function Pp(e,t,r=[]){if(!Jt(e))return!1;let n=Mr(e,"utf-8"),i=n;for(let o of t)i=i.replace(o,"");for(let{from:o,to:s}of r)i=i.replace(o,s);return i===n?!1:(ys(e,i,"utf-8"),!0)}function Ap(e){let t=Ye(e,".gitignore");if(!Jt(t))return!1;let r=Mr(t,"utf-8"),n=r.split(`
 `).filter(i=>!i.includes(".generatesaas")).join(`
-`);return n===r?!1:(ys(t,n,"utf-8"),!0)}function bs(e){e.command("eject").description("Remove all GenerateSaaS ties - manifest, license, heartbeat, skills").action(async()=>{let t=process.cwd(),r=Ye(t,he),n;try{n=JSON.parse(Mr(r,"utf-8"))}catch{U.cancel("No GenerateSaaS project found in this directory."),process.exit(1)}let i=await U.text({message:'Type "eject" to confirm (this cannot be undone):',validate:a=>{if(a!=="eject")return'Type "eject" to confirm, or press Ctrl+C to cancel.'}});if(U.isCancel(i)&&(U.cancel("Eject cancelled."),process.exit(0)),n.licenseToken)try{await fetch("https://generatesaas.com/api/v1/heartbeat",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${n.licenseToken}`},body:JSON.stringify({event:"eject",version:n.version,frontend:n.frontend}),signal:AbortSignal.timeout(5e3)}),U.log.info("Recorded the opt-out with generatesaas.com (final event - nothing is sent after this).")}catch{U.log.warn("Could not reach generatesaas.com to record the opt-out. Ejecting anyway.")}let o=[],s=[];for(let a of Sp())jr(Ye(t,a))&&o.push(a);for(let a of kp)jr(Ye(t,a))&&o.push(a);jr(Ye(t,Y))&&o.push(`${Y}/`);for(let a of Ep){let d=Ye(t,a.file);Pp(d,a.removals,a.replacements)?s.push(a.file):Jt(d)&&U.log.warn(`Could not auto-modify ${a.file} - manually remove license/heartbeat references.`)}Ap(t)&&s.push(".gitignore");for(let a of o)U.log.info(`Deleted ${a}`);for(let a of s)U.log.info(`Modified ${a}`);U.log.success("Ejected successfully. This project is now fully standalone.")})}var We=new Ip().name("generatesaas").description("CLI for scaffolding and managing GenerateSaaS projects").version("3.20.0").addHelpText("after",`
+`);return n===r?!1:(ys(t,n,"utf-8"),!0)}function bs(e){e.command("eject").description("Remove all GenerateSaaS ties - manifest, license, heartbeat, skills").action(async()=>{let t=process.cwd(),r=Ye(t,he),n;try{n=JSON.parse(Mr(r,"utf-8"))}catch{U.cancel("No GenerateSaaS project found in this directory."),process.exit(1)}let i=await U.text({message:'Type "eject" to confirm (this cannot be undone):',validate:a=>{if(a!=="eject")return'Type "eject" to confirm, or press Ctrl+C to cancel.'}});if(U.isCancel(i)&&(U.cancel("Eject cancelled."),process.exit(0)),n.licenseToken)try{await fetch("https://generatesaas.com/api/v1/heartbeat",{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${n.licenseToken}`},body:JSON.stringify({event:"eject",version:n.version,frontend:n.frontend}),signal:AbortSignal.timeout(5e3)}),U.log.info("Recorded the opt-out with generatesaas.com (final event - nothing is sent after this).")}catch{U.log.warn("Could not reach generatesaas.com to record the opt-out. Ejecting anyway.")}let o=[],s=[];for(let a of Sp())jr(Ye(t,a))&&o.push(a);for(let a of kp)jr(Ye(t,a))&&o.push(a);jr(Ye(t,Y))&&o.push(`${Y}/`);for(let a of Ep){let d=Ye(t,a.file);Pp(d,a.removals,a.replacements)?s.push(a.file):Jt(d)&&U.log.warn(`Could not auto-modify ${a.file} - manually remove license/heartbeat references.`)}Ap(t)&&s.push(".gitignore");for(let a of o)U.log.info(`Deleted ${a}`);for(let a of s)U.log.info(`Modified ${a}`);U.log.success("Ejected successfully. This project is now fully standalone.")})}var We=new Ip().name("generatesaas").description("CLI for scaffolding and managing GenerateSaaS projects").version("3.21.0").addHelpText("after",`
 Examples:
   $ generatesaas init                  Interactive setup
   $ generatesaas init -n my-app -y     Quick setup with defaults

package/dist/skill/content/generatesaas-translate/SKILL.md

@@ -14,7 +14,15 @@ description: Translate the project into every configured locale yourself, with n
 | `packages/i18n/translations/<default>/*.json` | `packages/i18n/translations/<locale>/*.json` |
 | `packages/content/<default>/**/*.{md,mdx}` | `packages/content/<locale>/**` (skips `_`-prefixed files and any with `translate: false` in its frontmatter) |
 
-The locales and the default one come from `i18nConfig` in `packages/config/src/i18n.ts`. Never edit a generated locale or the ledger directly - `apply` writes both.
+The locales and the default one come from `i18nConfig` in `packages/config/src/i18n.ts`.
+
+## The ledger belongs to the command
+
+Only `pnpm translate` (and its `prepare` / `apply`) writes the ledger (`packages/translate/.meta/`), the work plan (`packages/translate/.work/plan.json`) and the generated locales. Never change them yourself - not with an editor, a script, `sed`, `jq` or a copy from elsewhere, and not to merge, migrate, clean up, delete a key or "fix" a hash. The command does all of that itself: it removes keys the source dropped, upgrades an older ledger format on its own, and records a hash only for a translation that passed its checks. A hash written by hand claims a translation is current when nothing checked it, and every later run trusts it.
+
+Your only writes are each task's `output` file. If a job seems to need a ledger change the command does not make, stop and tell the user instead of working around it.
+
+**Updating the ledger is mandatory.** A translation run is not finished until `pnpm translate apply` has recorded every translation in the ledger - it prints "Every prepared task is applied." - and `pnpm translate status` shows nothing owed. Never stop with outputs written but not applied, and always commit the ledger together with the locale files it describes, so the ledger is never out of date with the translations.
 
 ## Steps
 
@@ -23,7 +31,7 @@ The locales and the default one come from `i18nConfig` in `packages/config/src/i
    - **`json`** - `input` is one JSON object of `key: source text`. Write `output` as ONE JSON object with exactly the same keys, every value translated. No code fences, no comments.
    - **`md`** - `input` is the whole source document. Write the whole translated document, frontmatter included, to `output` (create its folders).
 3. **Apply.** Run `pnpm translate apply`. It writes every translation that passes into the locale files and records its source hash. Anything refused stays in the plan with its reason - a JSON task's `input` then holds only the refused keys - so fix exactly that, write the `output` again, and re-run `apply`. Repeat until it prints "Every prepared task is applied." If it dropped tasks because their source changed meanwhile, run `prepare` again.
-4. **Report** the locales, key counts and documents translated, and anything still owed.
+4. **Confirm** with `pnpm translate status` that nothing is owed, then **report** the locales, key counts and documents translated. Commit the locale files and `packages/translate/.meta/` together.
 
 ## Doing the work your way
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "generatesaas",
-  "version": "3.20.0",
+  "version": "3.21.0",
   "type": "module",
   "description": "CLI for scaffolding and managing GenerateSaaS projects",
   "license": "UNLICENSED",