@clubedge/create-clubedge-app 0.47.0 → 0.48.0

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 All notable changes to `create-clubedge-app` are documented here.
 
+## 0.48.0
+
+- **Starter v0.31.1** by default (#202). Its template schema is still 6. The [Starter's release notes](https://github.com/Clubedge/clubedge-starter/releases/tag/v0.31.1) cover:
+  - Expo SDK 58's latest patch versions, without which the native app's CI job fails in projects generated from v0.31.0;
+  - version 6 of the `redis` client for the Redis cache, still speaking RESP2;
+  - `pnpm typecheck` checking the browser tests too.
+- **`add`, `remove`, and `upgrade` refuse to change a project that still has conflict markers from an earlier change** (#198; issue #195). Merging into those files could leave old and new markers interleaved, or carry them forward with exit code 0. The CLI now lists each file with its number of conflict blocks and asks to resolve them first. `--force` changes the project anyway.
+- **Conflict blocks hold only the lines that differ** (#199; issue #196), as Git writes them. Lines your version and the Starter's share inside a conflict stay outside the markers, unless what separates two blocks is three lines or fewer, or lines without a letter or digit, such as closing braces and blank lines: those blocks stay one. In two apps built alongside the Starter, 44% and 39% of the lines inside markers were shared.
+- **A dependency both sides raised merges to the higher version** (#193; issue #191). When the project and the Starter both raised a dependency's `^` or `~` range and both ranges keep the same major (the same minor for `~` and for `^0.x`), the merge keeps the higher range, where it left a conflict in `package.json` that pnpm can't read. Other changes to the same dependency, such as exact versions or a new major, still conflict. This stopped 4 of 30 test upgrades.
+- **`add`, `remove`, `upgrade`, and `status` report what happened, and what to run next** (#194; issue #192):
+  - `status` has a Conflicts row with the files left with conflict markers, and its next step is to resolve them.
+  - A change ends by saying to resolve any conflicts first, then to review the diff and run `pnpm typecheck` and the tests: files that merged cleanly can still break the code.
+  - `--dry-run` says how many conflicts the change would leave, in how many files, and exits 2 with `--detailed-exit-code`, as the change itself would.
+  - When GitHub can't list the Starter releases an upgrade crosses, such as past its rate limit, the upgrade says so and links the releases page, instead of leaving the list out.
+  - A module new since the project's Starter release names that release, where it named the target.
+  - A README generated without its "Generated from" section, as React + Vite projects from older releases are, is no longer called replaced.
+  - A file whose merge changes nothing is left out of the change.
+- **"Updated N files" counts every file the change writes** (#200; issue #197), the lockfile and env files included.
+- **A failed scaffold keeps the files that were already in the directory** (#165 and issue #153, both by @ahmed-husssain). Rolling back a failed run in an existing directory emptied it; it now removes only the files the run wrote, and the folders that leaves empty.
+- **A lockfile with CRLF line endings is customized like one with LF** (#189; issue #186, reported by @ahmed-husssain). With CRLF, the apps and packages a project leaves out stayed in its lockfile, and no optional peer was pruned. The Starter checks the lockfile out with LF, so this concerned copies made outside Git, such as one given to `--template-dir`.
+- **`deploy` keeps the platform's direct database URL when the database doesn't change** (#188; issue #187, reported by @ahmed-husssain). A deploy with no env file, after one that supplied a pooled Neon URL, set `DATABASE_URL_DIRECT` to nothing, and migrations and the jobs worker fell back to the pooled URL.
+- **An empty variable with an inline comment is empty** (#190, by @ahmed-husssain). `DATABASE_URL= # leave blank to use platform Postgres` read as the comment, so `deploy` took it for a hosted database, created none on the platform, and the app failed at startup. A `#` inside a value, as in `PASSWORD=secret#123`, stays part of it.
+- `pnpm release` drafts name who wrote each pull request and list first-time contributors (#185).
+
+Thanks to everyone who contributed to this release: @ahmed-husssain and @yassine-ahmed.
+
 ## 0.47.0
 
 - **Starter v0.31.0** by default (#183). Its template schema is still 6. The [Starter's release notes](https://github.com/Clubedge/clubedge-starter/releases/tag/v0.31.0) cover:
@@ -10,16 +36,23 @@ All notable changes to `create-clubedge-app` are documented here.
   - Supabase sessions that the Hono API verifies itself;
   - fixes to the APIs' CORS and to SMTP sends that never answer;
   - browser tests in Chromium, Firefox, and WebKit.
-- **On Windows, an argument can no longer run a second command or expand a variable** (#176). The CLI ran commands through cmd.exe as one line, where `%VAR%` is expanded inside quotes, a line break ends the command, and a quote inside an argument can leave `&` and `|` outside the quotes. No argument from outside reached these commands, so this closes the gap before one does:
+- **On Windows, an argument can no longer run a second command or expand a variable** (#176; issue #156, reported by @ahmed-husssain). The CLI ran commands through cmd.exe as one line, where `%VAR%` is expanded inside quotes, a line break ends the command, and a quote inside an argument can leave `&` and `|` outside the quotes. No argument from outside reached these commands, so this closes the gap before one does:
   - A program (`.exe`, `.com`) now starts directly, with no shell, so `git`, `node`, `docker`, and `uv` no longer go through cmd.exe.
   - A batch file (`.cmd`, `.bat`), such as the npm shims for `pnpm` and `npx`, still needs cmd.exe. Each argument is quoted the way Windows programs split their command line, then escaped for both of cmd.exe's readings. An argument with a line break is refused.
-- **Windows device names are refused as project directories** (#169, #171): `CON`, `PRN`, `AUX`, `NUL`, `COM1` to `COM9`, and `LPT1` to `LPT9`, with or without an extension, which on Windows could create a folder that can't be deleted. The CLI checks the project's own name and each parent folder it would create, in the prompt and in the MCP server's `create_project` too. Folders that already exist are left alone.
-- **The browser opens web addresses only** (#175). Commands that open a page, such as `deploy`, `neon`, and `try`, hand the system's opener only an `http://` or `https://` address with a host, and open nothing otherwise.
+- **Windows device names are refused as project directories** (#169, by @biggdawg320, and #171; issue #155, reported by @ahmed-husssain): `CON`, `PRN`, `AUX`, `NUL`, `COM1` to `COM9`, and `LPT1` to `LPT9`, with or without an extension, which on Windows could create a folder that can't be deleted. The CLI checks the project's own name and each parent folder it would create, in the prompt and in the MCP server's `create_project` too. Folders that already exist are left alone.
+- **The browser opens web addresses only** (#175, by @jdotc1; issue #157, reported by @ahmed-husssain). Commands that open a page, such as `deploy`, `neon`, and `try`, hand the system's opener only an `http://` or `https://` address with a host, and open nothing otherwise.
 - **`create_project` reports progress over MCP** (#178) while it installs dependencies. A client that sends a progress token gets a notification when each install starts, every 5 seconds while it runs, and when it ends or fails, so a client that resets its timeout on progress keeps waiting. A client that sends none gets the same result as before.
 - **Sponsors** (#181, #182): the README has a Sponsors section. [Neon](https://neon.com) supports Clubedge Starter through its Open Source Program.
 - CI runs generated projects' browser checks in Chromium, by name (#180), since the Starter now has three browser projects.
 - `@modelcontextprotocol/server` 2.4.0 or newer (#173), vitest 5.1.0 (#174), and astral-sh/setup-uv 10.3.3 in CI (#172).
 
+### New contributors
+
+- @biggdawg320 made their first contribution in #169.
+- @jdotc1 made their first contribution in #175.
+
+Thanks to everyone who contributed to this release: @ahmed-husssain, @biggdawg320, @jdotc1, and @yassine-ahmed.
+
 ## 0.46.1
 
 - **Starter v0.30.1** by default (#167). Its template schema is still 6. The [Starter's release notes](https://github.com/Clubedge/clubedge-starter/releases/tag/v0.30.1) cover:

package/README.md

@@ -224,7 +224,8 @@ Options:
                           (upgrade: the Starter to upgrade to)
   --template-dir <path>   Scaffold from a local Starter checkout (for Starter development)
   --dry-run               Show what would be created or changed without writing anything
-  --force                 add/remove: change a project with uncommitted changes or without Git
+  --force                 add/remove/upgrade: change a project with uncommitted changes,
+                          unresolved conflicts, or without Git
   -y, --yes               Accept defaults and never prompt (default directory: my-app)
   --no-install            Skip dependency installation
   --no-git                Skip Git repository initialization
@@ -245,7 +246,7 @@ pnpm dlx @clubedge/create-clubedge-app my-app --yes --no-git --framework tanstac
 pnpm dlx @clubedge/create-clubedge-app my-app --ref main
 
 # Reproduce a specific Starter release or commit
-pnpm dlx @clubedge/create-clubedge-app my-app --ref v0.31.0
+pnpm dlx @clubedge/create-clubedge-app my-app --ref v0.31.1
 pnpm dlx @clubedge/create-clubedge-app my-app --ref <commit-sha>
 
 # Test local Starter changes before releasing them
@@ -266,7 +267,7 @@ pnpm clubedge add mobile expo                               # the native app; ad
 pnpm clubedge remove mobile
 pnpm dlx @clubedge/create-clubedge-app add infra local --dry-run
 pnpm dlx @clubedge/create-clubedge-app@latest upgrade        # to the newest CLI's Starter release
-pnpm dlx @clubedge/create-clubedge-app upgrade --ref v0.31.0 # or a specific tag, branch, or commit
+pnpm dlx @clubedge/create-clubedge-app upgrade --ref v0.31.1 # or a specific tag, branch, or commit
 ```
 
 The CLI renders the project twice, from the Starter commit and modules recorded in your `package.json` and from the new state, and merges the difference into your project. The new state has other modules for `add` and `remove`, and the newer Starter with the same modules for `upgrade`. Modules a newer Starter introduces start as `none` where possible, so an upgrade never adds a service on its own.
@@ -289,11 +290,11 @@ Since CLI 0.46.0, `add` and `remove` also take the apps that run on phones rathe
 - An app implements the modules it uses, such as the native app's sign-in. When the project's option is one it lacks, switch it in the same command: `add mobile expo auth better-auth`.
 - Removing an app deletes the Starter's files and leaves what was never the Starter's, such as its env file, its `node_modules`, and the shell's `android/` and `ios/` projects. The CLI lists them, to delete once you no longer need them.
 
-The project must be a Git repository without uncommitted changes, so you can review the result with `git diff` and undo it. Pass `--force` to skip this check. Add `--no-install` to skip `pnpm install`. Afterward, run `pnpm db:migrate` and `pnpm check:services` if the change added tables or services.
+The project must be a Git repository without uncommitted changes, so you can review the result with `git diff` and undo it, and without conflict markers left by an earlier change, which the new change would merge into: the CLI names the files to resolve first. Pass `--force` to skip these checks. Add `--no-install` to skip `pnpm install`. Afterward, run `pnpm typecheck` and your tests, since files that merge without conflicts can still break the code, and `pnpm db:migrate` and `pnpm check:services` if the change added tables or services.
 
 pnpm cannot read a `package.json` with conflict markers, so a change that leaves conflicts in one skips `pnpm install` and says so: resolve them, then run `pnpm install`. Until then, `pnpm clubedge` does not start either, and the CLI's own commands (`pnpm dlx @clubedge/create-clubedge-app status`, for example) stop with a message that names the file and the command that compares it with the Starter's version in `.clubedge/incoming/`. When the install fails for another reason, the CLI still lists what is left to resolve, then exits with an error.
 
-A change that leaves conflicts exits with 0, like a clean one. For scripts that need to tell them apart, add `--detailed-exit-code`: the CLI then exits with 2 when the change was written with conflicts to resolve, 0 when it was clean or there was nothing to change, and 1 when it failed.
+A change that leaves conflicts exits with 0, like a clean one. For scripts that need to tell them apart, add `--detailed-exit-code`: the CLI then exits with 2 when the change was written with conflicts to resolve, 0 when it was clean or there was nothing to change, and 1 when it failed. With `--dry-run`, it counts the conflicts the change would leave, and exits with 2 when there are any, so a script can check before changing anything.
 
 ## A hosted database with Neon
 
@@ -323,11 +324,11 @@ Claiming keeps the data but resets the password: copy the pooled and direct conn
 Two read-only commands help you keep a project healthy:
 
 ```sh
-pnpm clubedge status    # Starter release, modules, Git state, and whether a newer Starter exists
+pnpm clubedge status    # Starter release, modules, Git state, conflicts left, and whether a newer Starter exists
 pnpm clubedge doctor    # Node.js, pnpm, dependencies, lockfile, env file, and pnpm check:services
 ```
 
-`status` ends with the command to run next, such as `pnpm clubedge upgrade` when a newer Starter release is available; it asks npm for the newest CLI and still works offline. `doctor` checks that Node.js and pnpm meet the project's versions, that dependencies are installed, that `pnpm-lock.yaml` matches every `package.json`, and that each app's local env file has every variable in its example (`apps/web/.env.local` and `.env.example`, and `apps/api/.env.local` and `apps/api/.env.example` with a separate API), then runs `pnpm check:services` (skip it with `--no-services`). It exits with an error when a check fails, so it also works in CI.
+`status` ends with the command to run next, such as `pnpm clubedge upgrade` when a newer Starter release is available; it asks npm for the newest CLI and still works offline. It lists the files an earlier change left with conflict markers, and a `.clubedge/incoming/` left behind, and then says to resolve the conflicts first. `doctor` checks that Node.js and pnpm meet the project's versions, that dependencies are installed, that `pnpm-lock.yaml` matches every `package.json`, and that each app's local env file has every variable in its example (`apps/web/.env.local` and `.env.example`, and `apps/api/.env.local` and `apps/api/.env.example` with a separate API), then runs `pnpm check:services` (skip it with `--no-services`). It exits with an error when a check fails, so it also works in CI.
 
 ## Try it on a Railway VM (experimental)
 
@@ -415,27 +416,27 @@ Projects created with `--infra neon` also have `.github/workflows/preview.yml`,
 Each CLI release is tested against one specific Starter release:
 
 ```text
-create-clubedge-app v0.47.0
+create-clubedge-app v0.48.0
         |
         v
-Clubedge Starter v0.31.0
-commit e6c47d7b8ec153443ee35abab7fc61d37f55e36a
+Clubedge Starter v0.31.1
+commit 2fa0adfd67ef3511f577d11fdca4109cc8554759
 ```
 
 The current relationship is:
 
 | CLI release | Default Starter release | Meaning |
 | --- | --- | --- |
-| `create-clubedge-app@0.47.0` | `clubedge-starter@v0.31.0` | The CLI's required, tested default |
+| `create-clubedge-app@0.48.0` | `clubedge-starter@v0.31.1` | The CLI's required, tested default |
 
 This means the same CLI version always scaffolds the same Starter revision by default. The CLI does not silently follow Starter `main`.
 
-The `v0.31.0` tag is expected to resolve to commit
-`e6c47d7b8ec153443ee35abab7fc61d37f55e36a`. The CLI verifies this before
+The `v0.31.1` tag is expected to resolve to commit
+`2fa0adfd67ef3511f577d11fdca4109cc8554759`. The CLI verifies this before
 scaffolding with the default reference and fails rather than silently using a
 moved tag.
 
-When the Starter changes, its maintainers first publish a new versioned release, such as `v0.31.0`. The CLI is then updated to use that release, all generated-project checks must pass, and a new CLI version is published. This keeps Starter and CLI releases independently versioned while preserving a tested compatibility relationship.
+When the Starter changes, its maintainers first publish a new versioned release, such as `v0.31.1`. The CLI is then updated to use that release, all generated-project checks must pass, and a new CLI version is published. This keeps Starter and CLI releases independently versioned while preserving a tested compatibility relationship.
 
 Every generated project records its CLI version, Starter repository, Starter ref, Starter commit, framework, and modules in `package.json` and `README.md`.
 
@@ -490,12 +491,12 @@ CI packs the CLI with `npm pack`, scaffolds clean projects from the packed tarba
 1. Make and validate changes in `clubedge-starter`.
 2. Run lint, typecheck, unit tests, browser tests, and production build.
 3. Update the Starter package versions.
-4. Commit `main`, create a release tag such as `v0.31.0`, and publish the Starter release.
+4. Commit `main`, create a release tag such as `v0.31.1`, and publish the Starter release.
 
 ### CLI maintainers
 
 1. When the Starter publishes a release, the [Starter pin](.github/workflows/starter-pin.yml) workflow opens a pull request that moves `clubedge.starterRef` and `clubedge.starterCommit` in [`package.json`](package.json), and the docs that name them, to the new tag (daily, or run it by hand; locally: `pnpm release pin vX.Y.Z`). Its CI generates clean projects from that exact tag and runs install, lint, typecheck, unit tests, browser tests, production build, and runtime smoke checks. Merge it once they pass.
-2. `pnpm release patch|minor|major` (from an up-to-date `main`; add `--dry-run` to preview) opens the release pull request: it bumps `version`, updates the version relationship here and in CONTRIBUTING, adds the release table rows for a minor or major release, and drafts the changelog entry from the pull requests merged since the last tag. Edit the draft in that pull request: it becomes the GitHub Release page.
+2. `pnpm release patch|minor|major` (from an up-to-date `main`; add `--dry-run` to preview) opens the release pull request: it bumps `version`, updates the version relationship here and in CONTRIBUTING, adds the release table rows for a minor or major release, and drafts the changelog entry from the pull requests merged since the last tag. The draft names who wrote each pull request that a maintainer or a bot didn't, lists the first-time contributors, and thanks everyone by name. Edit the draft in that pull request, keeping those credits and adding who reported the issues it closes: it becomes the GitHub Release page.
 3. After it is merged, `pnpm release tag` tags `main`. The Release workflow checks and publishes it to npm, creates the GitHub Release page from the changelog entry, and smoke-tests the published package.
 
 The pin workflow needs **Settings → Actions → General → Allow GitHub Actions to create and approve pull requests**, or a `STARTER_PIN_TOKEN` secret (a fine-grained token with contents and pull requests write), which also lets its pull request start CI by itself.
@@ -548,6 +549,7 @@ Each phase ends with a Starter release and a CLI release pinned to it. The full
 | 0.45.0 | v0.29.0 | Starter v0.29.0: an update policy for installed apps, a new design for the native app, and clean splash screens; `package.json` merged by key |
 | 0.46.0 | v0.30.0 | Add and remove the mobile apps in an existing project; Starter v0.30.0: store releases, push notifications, and over-the-air updates; module options' `dependencies` |
 | 0.47.0 | v0.31.0 | Starter v0.31.0: deploying to Cloudflare (`--deploy cloudflare`), downloads by byte range, and browser tests in three engines; on Windows, arguments that can't start a second command and device names refused as project directories; install progress over MCP |
+| 0.48.0 | v0.31.1 | Starter v0.31.1: Expo SDK 58's latest patch versions; `add`, `remove`, and `upgrade` refuse to merge into unresolved conflicts, conflict blocks hold only the lines that differ, a dependency both sides raised merges to the higher version, and reports say what to run next |
 
 ## Sponsors
 

package/dist/cli/ui.js

@@ -131,9 +131,11 @@ ${selectionHelp(manifest)}
                           (upgrade: the Starter to upgrade to)
   --template-dir <path>   Scaffold from a local Starter checkout (for Starter development)
   --dry-run               Show what would be created or changed without writing anything
-  --force                 add/remove: change a project with uncommitted changes or without Git
+  --force                 add/remove/upgrade: change a project with uncommitted changes,
+                          unresolved conflicts, or without Git
   --detailed-exit-code    add/remove/upgrade: exit with 2 when the change leaves conflicts to
-                          resolve (0: changed cleanly or nothing to change, 1: failed)
+                          resolve, or would with --dry-run (0: changed cleanly or nothing to
+                          change, 1: failed)
   --no-services           doctor: skip pnpm check:services
   --no-open               try, deploy (Vercel, Netlify, Render): do not open the URL in the browser
   --claim                 try: open the page that claims the VM, to share the preview

package/dist/core/customize.js

@@ -1,6 +1,6 @@
 // Pure text transforms applied to template files. Keeping them free of I/O makes each one easy
 // to test and lets --dry-run describe them without touching the disk.
-import { pruneOptionalPeers } from "./lockfile-peers.js";
+import { keepLineEndings, pruneOptionalPeers } from "./lockfile-peers.js";
 import { FRAMEWORK_SLOT } from "./manifest-fields.js";
 const json = (value) => `${JSON.stringify(value, null, 2)}\n`;
 /**
@@ -124,9 +124,12 @@ export function customizeAppManifest(source, appPackage, version) {
  * works. Importers are keyed by workspace path at two-space indentation; package entries that
  * are no longer used are harmless, and pnpm prunes them on the next lockfile update. Optional
  * peer links to packages that only left-out importers installed are removed, so those packages
- * are not installed either.
+ * are not installed either. The lockfile keeps its line endings.
  */
-export function customizeLockfile(source, { remove, rename = [], removeDependencies = [] }) {
+export function customizeLockfile(source, changes) {
+    return keepLineEndings(source, (text) => customizeImporters(text, changes));
+}
+function customizeImporters(source, { remove, rename = [], removeDependencies = [] }) {
     const output = [];
     let inImporters = false;
     let skippingImporter = false;

package/dist/core/deploy.js

@@ -98,7 +98,7 @@ export function parseEnvFile(text) {
         const raw = match[2].trim();
         // A quoted value keeps everything inside the quotes, and may still have a comment after them.
         const quoted = /^(["'])(.*?)\1\s*(?:#.*)?$/.exec(raw);
-        values[match[1]] = quoted ? quoted[2] : raw.replace(/\s+#.*$/, "");
+        values[match[1]] = quoted ? quoted[2] : raw.replace(/(?:^|\s+)#.*$/, "");
     }
     return values;
 }
@@ -133,10 +133,16 @@ export function planVariables(input) {
     const direct = directDatabaseUrl(external.DATABASE_URL, envFile.DATABASE_URL_DIRECT);
     if (direct)
         set.DATABASE_URL_DIRECT = direct;
-    // A direct URL left from an earlier database would send migrations there: point it at the
-    // database the app now uses, or blank it (blank counts as unset).
-    else if (existing.DATABASE_URL_DIRECT)
-        set.DATABASE_URL_DIRECT = set.DATABASE_URL ?? "";
+    // A direct URL left from an earlier database would send migrations there. When this deploy
+    // decides the database (it sets DATABASE_URL, or the platform attaches its own), or no
+    // DATABASE_URL is left for the direct URL to belong to, point it at the database the app now
+    // uses, or blank it (blank counts as unset). A deploy that keeps the database the platform
+    // already has, such as one with no env file, leaves its direct URL as it is.
+    else if (existing.DATABASE_URL_DIRECT) {
+        const decided = set.DATABASE_URL !== undefined || attached.includes("DATABASE_URL");
+        if (decided || !existing.DATABASE_URL)
+            set.DATABASE_URL_DIRECT = set.DATABASE_URL ?? "";
+    }
     // Optional: without a direct URL, migrations and the jobs worker use DATABASE_URL, and the
     // client-address settings have safe defaults.
     const optional = ["DATABASE_URL_DIRECT", ...clientAddressKeys];

package/dist/core/execute.js

@@ -1,7 +1,6 @@
-import { constants } from "node:fs";
-import { copyFile, mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";
-import { basename, dirname, join, parse } from "node:path";
-import { copyTemplateFiles, emptyDirectory, pathExists } from "../utils/fs.js";
+import { mkdir, readdir, readFile, rm, rmdir, writeFile } from "node:fs/promises";
+import { basename, dirname, join, parse, relative, resolve } from "node:path";
+import { copyTemplateFiles, pathExists } from "../utils/fs.js";
 import { isReservedDeviceName } from "../utils/names.js";
 export class TargetError extends Error {
     name = "TargetError";
@@ -37,9 +36,26 @@ export async function assertTargetIsUsable(directory) {
         throw error;
     }
 }
+/** Removes files created during scaffolding, then removes any empty directories left behind. */
+export async function cleanupWrittenFiles(target, files, folders = []) {
+    const dirs = new Set();
+    const targetPath = resolve(target);
+    for (const file of files)
+        await rm(file, { force: true }).catch(() => { });
+    const paths = [...files.map((file) => dirname(file)), ...folders.map((folder) => folder.replace(/^\\\\\?\\/, ""))];
+    for (const p of paths) {
+        for (let cur = resolve(p); cur !== targetPath && cur !== dirname(cur) && !relative(targetPath, cur).startsWith(".."); cur = dirname(cur)) {
+            dirs.add(cur);
+        }
+    }
+    for (const dir of [...dirs].sort((a, b) => b.length - a.length)) {
+        await rmdir(dir).catch(() => { });
+    }
+}
 /**
  * Writes the project described by the plan. If any step fails, everything written so far is
- * removed: a directory the CLI created is deleted, and a pre-existing empty one is emptied.
+ * removed: a directory the CLI created is deleted, and for a pre-existing directory only files
+ * created during the run are removed, preserving any pre-existing contents.
  */
 export async function executePlan(plan, source) {
     const target = plan.targetDirectory;
@@ -56,21 +72,21 @@ export async function executePlan(plan, source) {
         if (!(error && typeof error === "object" && "code" in error && error.code === "EEXIST"))
             throw error;
     }
+    const written = [];
+    const folders = [];
     try {
-        await copyTemplateFiles(source.root, target, plan.files);
+        await copyTemplateFiles(source.root, target, plan.files, written, folders);
         for (const edit of plan.edits) {
             const path = join(target, edit.path);
             await writeFile(path, edit.apply(await readFile(path, "utf8")));
         }
-        for (const envFile of plan.envFiles) {
-            await copyFile(join(target, envFile.from), join(target, envFile.to), constants.COPYFILE_EXCL);
-        }
+        await copyTemplateFiles(target, target, plan.envFiles, written, folders);
     }
     catch (error) {
         if (created)
             await rm(target, { recursive: true, force: true });
         else
-            await emptyDirectory(target);
+            await cleanupWrittenFiles(target, written, folders);
         throw error;
     }
 }

package/dist/core/health.js

@@ -52,8 +52,14 @@ export function updateState(projectRef, latest) {
 export function latestCliCommand(cli) {
     return cli === "pnpm clubedge" ? cli : "pnpm dlx @clubedge/create-clubedge-app@latest";
 }
-/** What to do next, given the working tree and whether a newer Starter exists. */
-export function nextStep(git, update, cli) {
+/**
+ * What to do next, given the working tree, whether a newer Starter exists, and the files an
+ * earlier change left with conflict markers, which come first.
+ */
+export function nextStep(git, update, cli, conflicts = []) {
+    if (conflicts.length) {
+        return "Resolve the conflicts first: keep your lines, the Starter's, or a mix in each block, then delete the markers and .clubedge/incoming.";
+    }
     if (update.kind === "available") {
         const upgrade = `${latestCliCommand(cli)} upgrade`;
         return git.kind === "dirty"
@@ -210,6 +216,24 @@ export function checkDatabaseUrls(input) {
     }
     return { name, status: "ok", detail: "Neon, pooled for the app and direct for migrations and the jobs worker" };
 }
+/**
+ * The conflicts line of `status`: the files an earlier change left with conflict markers, and
+ * the Starter's versions it left to compare with in .clubedge/incoming.
+ */
+export function describeConflicts(conflicts, incomingLeft) {
+    if (!conflicts.length) {
+        return incomingLeft
+            ? "none, but .clubedge/incoming still holds the Starter's versions from the last change: delete it when you are done comparing"
+            : "none";
+    }
+    const total = conflicts.reduce((sum, c) => sum + c.blocks, 0);
+    const files = conflicts
+        .slice(0, 3)
+        .map((c) => `${c.path} (${c.blocks} ${c.blocks === 1 ? "block" : "blocks"})`)
+        .join(", ");
+    return (`${total} ${total === 1 ? "conflict" : "conflicts"} in ${conflicts.length} ${conflicts.length === 1 ? "file" : "files"}: ` +
+        `${files}${conflicts.length > 3 ? ", ..." : ""}${incomingLeft ? "; the Starter's versions are in .clubedge/incoming" : ""}`);
+}
 export function checkConflicts(conflicts) {
     const name = "Conflicts";
     if (!conflicts.length)

package/dist/core/lockfile-peers.js

@@ -2,6 +2,16 @@
 // workspace, and records the link in lockfile keys: drizzle-orm@0.45.4(@electric-sql/pglite@0.5.8).
 // When a left-out workspace package was the only reason the peer was installed, the link would
 // keep installing it, so these helpers remove such links from the lockfile.
+/**
+ * Changes a lockfile's text with LF line endings and gives it back in the original's. The Starter's
+ * .gitattributes checks pnpm-lock.yaml out with LF everywhere, but a copy made outside Git, such as
+ * one given to --template-dir, can have CRLF, and every line would then end in a stray \r.
+ */
+export function keepLineEndings(source, change) {
+    if (!source.includes("\r\n"))
+        return change(source);
+    return change(source.replace(/\r\n/g, "\n")).replace(/\n/g, "\r\n");
+}
 function unquote(text) {
     return text.replace(/^(['"])(.*)\1$/, "$2");
 }
@@ -18,7 +28,7 @@ function parse(source) {
     let key = "";
     let group = "";
     let entry = "";
-    for (const line of source.split("\n")) {
+    for (const line of source.split(/\r?\n/)) {
         if (/^\S/.test(line)) {
             section = line.replace(/:.*$/, "");
             continue;
@@ -117,9 +127,12 @@ function removeSuffixSegments(text, peer) {
 /**
  * Drops optional-peer links to packages nothing else installs (see findUnneededOptionalPeers),
  * so `pnpm install --frozen-lockfile` no longer installs them. Snapshot entries that become
- * identical are merged.
+ * identical are merged. The lockfile keeps its line endings.
  */
 export function pruneOptionalPeers(source) {
+    return keepLineEndings(source, pruneLines);
+}
+function pruneLines(source) {
     const peers = findUnneededOptionalPeers(source);
     if (!peers.length)
         return source;

package/dist/core/merge.js

@@ -50,13 +50,51 @@ function withMarkers(regions) {
     }
     return { text: lines.join("\n"), conflict };
 }
+const hasLetterOrDigit = (lines) => lines.some((line) => /[\p{L}\p{N}]/u.test(line));
+/**
+ * The regions with each conflict split where your lines and the Starter's are the same, so a
+ * block holds only what differs, as Git writes conflicts. Apps built alongside the Starter share
+ * many lines in their conflicts: 44% of those in Chess's and 39% in Chat App's.
+ */
+function refine(regions) {
+    return regions.flatMap((region) => "ok" in region || !region.yours.length || !region.theirs.length
+        ? [region]
+        : diffComm(region.yours, region.theirs).map((part) => part.common ? { ok: part.common } : { yours: part.buffer1, theirs: part.buffer2 }));
+}
+/**
+ * Joins conflicts with few shared lines between them back into one block, as Git does: three
+ * lines or fewer, or lines without a letter or digit, such as closing braces and blank lines,
+ * read better inside one block than as the edges of two.
+ */
+function joinClose(regions) {
+    const joined = [];
+    for (const region of regions) {
+        const last = joined.at(-1);
+        // Consecutive regions of one kind are one region.
+        if (last && "ok" in last && "ok" in region) {
+            joined[joined.length - 1] = { ok: [...last.ok, ...region.ok] };
+            continue;
+        }
+        if (last && !("ok" in last) && !("ok" in region)) {
+            joined[joined.length - 1] = { yours: [...last.yours, ...region.yours], theirs: [...last.theirs, ...region.theirs] };
+            continue;
+        }
+        const before = joined.at(-2);
+        if (!("ok" in region) && last && "ok" in last && before && !("ok" in before) && (last.ok.length <= 3 || !hasLetterOrDigit(last.ok))) {
+            joined.splice(-2, 2, { yours: [...before.yours, ...last.ok, ...region.yours], theirs: [...before.theirs, ...last.ok, ...region.theirs] });
+            continue;
+        }
+        joined.push(region);
+    }
+    return joined;
+}
 /** Merges base -> target into current. Resolves null for binary files, which cannot be merged. */
 export function mergeText(current, base, target) {
     if (isBinary(current) || isBinary(base) || isBinary(target))
         return null;
     const split = (content) => normalize(content).split("\n");
     const regions = diff3Merge(split(current), split(base), split(target), { excludeFalseConflicts: true });
-    return withMarkers(regions.flatMap((region) => region.ok ? [{ ok: region.ok }] : region.conflict ? [{ yours: region.conflict.a, theirs: region.conflict.b }] : []));
+    return withMarkers(joinClose(refine(regions.flatMap((region) => region.ok ? [{ ok: region.ok }] : region.conflict ? [{ yours: region.conflict.a, theirs: region.conflict.b }] : []))));
 }
 /**
  * Merges a package.json by key (see package-json-merge.ts), so edits to different keys never
@@ -69,6 +107,7 @@ export function mergePackageJsonText(current, base, target) {
         return null;
     return withMarkers(diffComm(merged.yours.split("\n"), merged.theirs.split("\n")).map((region) => region.common !== undefined ? { ok: region.common } : { yours: region.buffer1, theirs: region.buffer2 }));
 }
+/** The merge of a file both sides changed; null when the project already has the Starter's change. */
 function merged(path, current, base, target, binaryReason) {
     const result = (/(^|\/)package\.json$/.test(path) ? mergePackageJsonText(current, base, target) : null) ?? mergeText(current, base, target);
     if (!result)
@@ -76,7 +115,7 @@ function merged(path, current, base, target, binaryReason) {
     const content = withLineEndings(result.text, current);
     if (result.conflict)
         return { path, kind: "conflict", content, incoming: withLineEndings(normalize(target), current) };
-    return { path, kind: "merge", content };
+    return sameContent(content, current) ? null : { path, kind: "merge", content };
 }
 /**
  * Decides what happens to every file the base or the target contains. Files only the project
@@ -95,7 +134,9 @@ export function planMerge(base, target, current) {
             if (!mine)
                 actions.push({ path, kind: "create", content: after });
             else if (!sameContent(mine, after)) {
-                actions.push(merged(path, mine, Buffer.alloc(0), after, "Your file differs from the one the new selection adds."));
+                const action = merged(path, mine, Buffer.alloc(0), after, "Your file differs from the one the new selection adds.");
+                if (action)
+                    actions.push(action);
             }
             continue;
         }
@@ -122,7 +163,9 @@ export function planMerge(base, target, current) {
                 actions.push({ path, kind: "update", content });
             }
             else if (!sameContent(mine, after)) {
-                actions.push(merged(path, mine, before, after, "You changed this file, and the new selection changes it too."));
+                const action = merged(path, mine, before, after, "You changed this file, and the new selection changes it too.");
+                if (action)
+                    actions.push(action);
             }
         }
     }

package/dist/core/package-json-merge.js

@@ -1,8 +1,9 @@
 // package.json files merge by key instead of by line (#142), so edits to different keys never
 // conflict: a script the project adds after the Starter's, or an override next to one the
-// Starter adds. A key both sides changed to different values is a conflict. The merged file is
-// written twice, with your value for each such key and with the Starter's, and merge.ts puts
-// conflict markers around the lines where the two differ, which are that key's.
+// Starter adds. A key both sides changed to different values is a conflict, except a dependency
+// both raised within its range (see higherRange). The merged file is written twice, with your
+// value for each conflict and with the Starter's, and merge.ts puts conflict markers around the
+// lines where the two differ, which are that key's.
 /** A key both sides changed to different values; undefined is a side that removed it. */
 class Conflict {
     yours;
@@ -30,24 +31,61 @@ function same(a, b) {
     }
     return false;
 }
+/** The objects whose values are version ranges: a package's dependencies, and pnpm's overrides. */
+const RANGE_OBJECTS = [["dependencies"], ["devDependencies"], ["peerDependencies"], ["optionalDependencies"], ["pnpm", "overrides"]];
+const holdsRanges = (path) => RANGE_OBJECTS.some((object) => object.length === path.length && object.every((key, i) => key === path[i]));
+/** A ^ or ~ range on a full version, without a prerelease: ^1.7.21, ~58.0.24. */
+const SIMPLE_RANGE = /^([\^~])(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
 /**
- * One key's value: whoever changed it, or a conflict when both did, differently. Objects both
- * changed merge key by key; arrays and scalars are single values. Undefined is a removed key.
+ * Of two ^ ranges, or two ~ ranges, the one with the higher minimum, when every version it
+ * allows the other allows too: the same major for ^ (the same minor for ^0.x, the same version
+ * for ^0.0.x), the same minor for ~. Then the higher one satisfies both sides, as `pnpm up` raising
+ * a project's version within its range does. Undefined for anything else, which stays a conflict:
+ * exact versions (Expo pins some), different operators or majors, prereleases, workspace:, npm:
+ * aliases and URLs.
  */
-function merge(base, yours, theirs) {
+function higherRange(a, b) {
+    const first = SIMPLE_RANGE.exec(a);
+    const second = SIMPLE_RANGE.exec(b);
+    if (!first || !second || first[1] !== second[1])
+        return undefined;
+    const x = first.slice(2).map(Number);
+    const y = second.slice(2).map(Number);
+    // How many numbers a range keeps fixed: ~ the major and minor, ^ up to its first one that is not 0.
+    const fixed = (version) => (first[1] === "~" ? 2 : version.findIndex((n) => n !== 0) + 1 || 3);
+    const kept = fixed(x);
+    if (kept !== fixed(y) || x.slice(0, kept).some((n, i) => n !== y[i]))
+        return undefined;
+    for (const [i, n] of x.entries())
+        if (n !== y[i])
+            return n > (y[i] ?? 0) ? a : b;
+    return a;
+}
+/**
+ * One key's value, at `path` from the file's root: whoever changed it, or a conflict when both
+ * did, differently. Objects both changed merge key by key; arrays and scalars are single values.
+ * Undefined is a removed key. A dependency both raised within its range takes the higher range.
+ */
+function merge(base, yours, theirs, path) {
     if (same(yours, theirs) || same(base, theirs))
         return yours;
     if (same(base, yours))
         return theirs;
     if (isObject(yours) && isObject(theirs))
-        return mergeObjects(isObject(base) ? base : {}, yours, theirs);
+        return mergeObjects(isObject(base) ? base : {}, yours, theirs, path);
+    if (typeof yours === "string" && typeof theirs === "string" && holdsRanges(path.slice(0, -1))) {
+        const higher = higherRange(yours, theirs);
+        if (higher !== undefined)
+            return higher;
+    }
     return new Conflict(yours, theirs);
 }
 /**
  * Your keys in your order; a key only the Starter has goes after the key it follows in the
  * Starter's file, or first. At the root, `clubedge` (the provenance) is always the Starter's.
+ * `path` is the object's, from the file's root.
  */
-function mergeObjects(base, yours, theirs, root = false) {
+function mergeObjects(base, yours, theirs, path = []) {
     const order = Object.keys(yours);
     let previous;
     for (const key of Object.keys(theirs)) {
@@ -57,7 +95,7 @@ function mergeObjects(base, yours, theirs, root = false) {
     }
     const result = {};
     for (const key of order) {
-        const value = root && key === "clubedge" ? own(theirs, key) : merge(own(base, key), own(yours, key), own(theirs, key));
+        const value = path.length === 0 && key === "clubedge" ? own(theirs, key) : merge(own(base, key), own(yours, key), own(theirs, key), [...path, key]);
         if (value !== undefined)
             set(result, key, value);
     }
@@ -100,7 +138,7 @@ export function mergePackageJson(current, base, target) {
     const [yours, before, theirs] = parsed;
     if (!isObject(yours) || !isObject(before) || !isObject(theirs))
         return null;
-    const merged = mergeObjects(before, yours, theirs, true);
+    const merged = mergeObjects(before, yours, theirs);
     const write = (side) => JSON.stringify(resolve(merged, side), null, indentation(current)) + (current.endsWith("\n") ? "\n" : "");
     return { yours: write("yours"), theirs: write("theirs") };
 }