open-index/open-npm huggingface dataset:
npm package: @kusari-lab/saas
Description: `@kusari-lab/saas` is a single public npm package used to create projects from the private `kusari-lab/saas-starter` GitHub template.
Latest version: 1.2.0

# Kusari SaaS Bootstrapper

`@kusari-lab/saas` is a single public npm package used to create projects from the private `kusari-lab/saas-starter` GitHub template.

## Quick Start

Prerequisites:

- Node.js 18+
- GitHub CLI installed and logged in (`gh auth login`)
- 1Password CLI installed and signed in (`eval "$(op signin)"`)

Run preflight checks:

```sh
npx @kusari-lab/saas init
```

With Yarn:

```sh
yarn dlx @kusari-lab/saas init
```

Create a project:

```sh
npx @kusari-lab/saas create my-app --verbose
```

With Yarn:

```sh
yarn dlx @kusari-lab/saas create my-app --verbose
```

## Required 1Password paths

- `op://cli/github/GITHUB_TOKEN`
- `op://cli/vercel/VERCEL_TOKEN`
- `op://cli/neon/NEON_API_KEY`
- `op://cli/anthropic/ANTHROPIC_API_KEY`

Project-specific values are prompted during `create`:

- `VITE_CLERK_PUBLISHABLE_KEY`
- `CLERK_SECRET_KEY`
- `CLERK_WEBHOOK_SIGNING_SECRET` (optional)
- `DATABASE_URL` (only if Neon auto-provision fails)

## `saas create` behavior

- Creates a repo from `kusari-lab/saas-starter`
- Applies squash-only merge policy and delete-branch-on-merge
- Provisions Neon by default and resolves `DATABASE_URL`
- Creates a Vercel project by default
- Writes Vercel env vars for production/preview/development
- Writes GitHub Actions secrets used by template workflows
- Seeds `v0.0.0` and pushes a conventional bootstrap commit to trigger first release

Flags:

- `--skip-neon`
- `--skip-vercel`
- `--owner <org-or-user>` (default `kusari-lab`)
- `--verbose`

## Local Development

```sh
yarn install
yarn build
node dist/cli.js init
node dist/cli.js create my-app --verbose
```

## Publishing (maintainers)

Automatic semantic-release runs on pushes to `main` via `.github/workflows/release.yml`.

Required repository secrets:

- `GH_TOKEN` (GitHub token for release notes/tags)
- `NPM_TOKEN` (npm automation token for publishing)

Manual recovery publish is available in `.github/workflows/publish-packages.yml`.

## Security Notes

- No tokens are hardcoded in source.
- Secrets are read at runtime from environment variables or 1Password references.
- Treat created repository secrets as sensitive and restrict repository admin access.

## License

Not-licensed