fix(templates): boot the Fastify starter on an empty PORT and a prod install

.changeset/fastify-port-and-pino-pretty.md

@@ -0,0 +1,13 @@
+---
+'seamless-templates': patch
+---
+
+Fix two boot-time footguns in the Fastify API starter.
+
+`PORT` is read with `||` rather than `??`, so an empty `PORT=` in `.env` falls back to 3000. It
+previously reached `Number("")`, which is `0`, and Fastify binds port 0 to a random free port, so the
+API came up somewhere nobody was looking.
+
+`pino-pretty` moves from `devDependencies` to `dependencies`. The logger loads it for any `NODE_ENV`
+other than `production`, so an install that omitted dev dependencies, which is the usual shape of a
+staging deploy, failed to boot on a missing transport target.

templates/api/fastify/package.json

@@ -25,6 +25,7 @@
         "pg": "^8.16.3",
         "pg-hstore": "^2.3.4",
         "pino": "^10.3.1",
+        "pino-pretty": "^13.1.3",
         "sequelize": "^6.37.8"
     },
     "devDependencies": {
@@ -35,7 +36,6 @@
         "eslint": "^9.39.1",
         "globals": "^16.5.0",
         "jiti": "^2.6.1",
-        "pino-pretty": "^13.1.3",
         "sequelize-cli": "^6.6.3",
         "ts-node": "^10.9.2",
         "tsx": "^4.20.6",

templates/api/fastify/src/index.ts

@@ -21,7 +21,9 @@ dotenv.config();
 
 assertEnvironment();
 
-const PORT = Number(process.env.PORT ?? 3000);
+// `||` rather than `??`: an empty PORT= in .env is a missing value, not a
+// request for port 0, which is what Number("") would bind.
+const PORT = Number(process.env.PORT || 3000);
 const logger = getLogger("index");
 
 const rawOrigins = process.env.UI_ORIGINS;

templates/api/fastify/src/lib/logger.ts

@@ -10,8 +10,10 @@ const isProduction = process.env.NODE_ENV === "production";
  * keeps its diagnostics in the same stream as the rest of the API instead of a
  * second one nobody is watching.
  *
- * pino-pretty is a devDependency and is only wired up outside production, where
- * logs stay as JSON for a log pipeline to parse.
+ * pino-pretty is only wired up outside production, where logs stay as JSON for a
+ * log pipeline to parse. It is a runtime dependency rather than a dev one
+ * because any NODE_ENV other than production loads it, so an install that
+ * omitted dev dependencies would fail to boot on a staging deploy.
  */
 export const rootLogger: Logger = pino({
   level: isProduction ? "info" : "debug",