@rshono/create 1.0.0-rc.0 → 1.0.0-rc.2

package/README.md

@@ -22,14 +22,14 @@ Six, each with a default, and each answerable by a flag instead:
 | Where should it go?   | `my-rshono-app`    | first positional argument, or `.`                                   |
 | Where is it deployed? | `node`             | `--deploy node\|bun\|deno\|cloudflare\|vercel\|netlify\|aws-lambda` |
 | Styling               | plain CSS          | `--tailwind` / `--no-tailwind`                                      |
-| Formatting & linting  | Prettier + oxlint  | `--quality prettier-oxlint\|biome\|oxc\|none`                       |
+| Formatting & linting  | Prettier + oxlint  | `--quality prettier-oxlint\|prettier-eslint\|biome\|oxc\|none`      |
 | Install dependencies? | yes                | `--no-install`                                                      |
 | Initialize git?       | yes, unless nested | `--no-git`                                                          |
 
-Plus `--formatter` and `--linter` to set either half of the quality preset on its own, `--force` to
-scaffold into a directory that is not empty, `--dry-run` to see the file list and write nothing, and `-y`
-to take the defaults for everything not given. **A non-interactive terminal implies `-y`**, so this is one
-command in CI or from an agent:
+Plus `--formatter` and `--linter` to set either half of the quality preset on its own, `--pm` to override
+the package manager that was detected, `--force` to scaffold into a directory that is not empty,
+`--dry-run` to see the file list and write nothing, and `-y` to take the defaults for everything not
+given. **A non-interactive terminal implies `-y`**, so this is one command in CI or from an agent:
 
 ```bash
 npm create @rshono@latest my-app -y --deploy cloudflare --tailwind --quality biome
@@ -51,6 +51,7 @@ src/actions.ts          a 'use server' action, called from a form that works wit
 src/components/         layout, home, greet-form ('use client'), 404, 500
 src/lib/env.ts          both sides of the PUBLIC_ boundary in one place
 src/styles.css          element-level CSS, or the Tailwind entry
+pnpm-workspace.yaml     pnpm only: which dependency install scripts this app runs (none of them)
 ```
 
 Then, if the dependencies were installed, the scaffold is run through its own formatter — so a fresh
@@ -83,10 +84,16 @@ import { plan, writePlan } from '@rshono/create';
 
 ## Two things worth knowing
 
-**There is no ESLint option.** Linting TypeScript with ESLint means `typescript-eslint`, whose peer range is
-`typescript >=4.8.4 <6.1.0`; rshono is built and tested against TypeScript 7. `npm install` fails outright
-on the conflict, and forcing past it would hand you a linter running against a compiler API it was never
-built for. When upstream widens the range, ESLint becomes one more entry in `features/quality.ts`.
+**The ESLint preset pins TypeScript 6.** Linting TypeScript with ESLint means `typescript-eslint`, which
+reads the compiler API directly rather than through a stable interface, so its peer range is
+`typescript >=4.8.4 <6.1.0` — below the TypeScript rshono is built and tested against. An app that chooses
+ESLint therefore gets `typescript ~6.0.3`, the newest that range allows: `npm install` would otherwise fail
+outright on the conflict, and forcing past it hands you a linter running against a compiler API it was never
+built for. The framework's declarations compile identically under either version, which is what makes this
+the app's pin and not the framework's — every other preset leaves TypeScript alone. What you trade for
+type-aware rules is a compiler one major behind, and the JavaScript implementation rather than the native
+one, so `typecheck` on a large app is several times slower. When upstream widens the range, the pin in
+`features/quality.ts` is the only thing to delete.
 
 **Tailwind is four packages, a `postcss.config.mjs` and one rule in `rshono.config.ts`.** rshono compiles
 CSS natively and has no PostCSS in it — that is deliberate, and it means an app that wants a plugin chain
@@ -97,9 +104,14 @@ delete to go back to plain CSS.
 
 ```bash
 pnpm --filter @rshono/create build       # codegen, then one bundled dist/cli.mjs with no runtime deps
-pnpm --filter @rshono/create test        # the plan matrix — fast, no I/O
+pnpm --filter @rshono/create test        # builds, then the plan matrix and the CLI — seconds, no installs
 CREATE_RSHONO_E2E=1 pnpm --filter @rshono/create test   # also: pack, install and build real apps
 ```
 
+`plan.test.mjs` is the fast one — the whole matrix of answers in memory, no directory touched.
+`cli.test.mjs` spawns the real bin against temp directories, which is where argument parsing and the
+refusal to overwrite somebody's files are checked. `e2e.test.mjs` is the opt-in one, and the only one that
+installs anything.
+
 `@clack/prompts` (MIT) is bundled rather than depended on, so `npm create` downloads one tarball before it
 can ask its first question.

package/dist/api.mjs

@@ -2,7 +2,7 @@
 import {fileURLToPath as __rspack_fileURLToPath} from "node:url";
 import {dirname as __rspack_dirname} from "node:path";
 var __rspack_import_meta_dirname__ = __rspack_dirname(__rspack_fileURLToPath(import.meta.url));
-import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, posix, sep } from "node:path";
 import "node:child_process";
 // The require scope
@@ -31,18 +31,19 @@ var __webpack_exports__ = {};
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
   bp: () => (/* reexport */ DEPLOY_TARGET_NAMES),
+  ml: () => (/* reexport */ (/* inlined export .ESLINT_TYPESCRIPT */"~6.0.3")),
+  wC: () => (/* reexport */ FORMATTER_NAMES),
   e7: () => (/* reexport */ FRAMEWORK_DEPS),
+  At: () => (/* reexport */ LINTER_NAMES),
   Ab: () => (/* reexport */ PACKAGE_MANAGERS),
   pm: () => (/* reexport */ QUALITY_PRESETS),
   s_: () => (/* reexport */ RSHONO_RANGE),
   RM: () => (/* reexport */ TOOL_VERSIONS),
-  Jh: () => (/* reexport */ buildPackageJson),
+  dh: () => (/* reexport */ conflictingEntries),
   P8: () => (/* reexport */ deployHint),
   Lv: () => (/* reexport */ detectPackageManager),
-  WL: () => (/* reexport */ inspectTarget),
-  p1: () => (/* reexport */ isDeployTarget),
   eW: () => (/* reexport */ isValidPackageName),
-  ml: () => (/* reexport */ packageManager),
+  VZ: () => (/* reexport */ packageManager),
   et: () => (/* reexport */ plan_plan),
   N7: () => (/* reexport */ selectFeatures),
   PQ: () => (/* reexport */ toPackageName),
@@ -78,7 +79,11 @@ __webpack_require__.d(__webpack_exports__, {
 
 ;// CONCATENATED MODULE: ./src/generated/framework.ts
 // GENERATED by scripts/codegen.mjs from packages/core — do not edit. Run `pnpm --filter @rshono/create codegen`.
-/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.0';
+/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.2';
+/**
+ * The Node range rshono itself declares, restated in every scaffolded app's `engines` — so a CI image
+ * or a contributor on an older Node hears it from their package manager rather than from a stack trace.
+ */ const NODE_ENGINE = '>=22.1.0';
 /**
  * The dependency versions rshono is tested against, copied from its own manifest. Exact where it is
  * exact — React's RSC internals are coupled across builds, and a generated app has no workspace
@@ -124,7 +129,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 ;// CONCATENATED MODULE: ./src/versions.ts
 
-
+/** Passed straight through, so everything generated from the framework reaches the rest of the package here. */ 
 /** The framework range a scaffolded app gets. The two packages are released together, so this is ours. */ const RSHONO_RANGE = `^${RSHONO_VERSION}`;
 /**
  * Versions for the optional tooling the features can add — the one place in this package where a
@@ -145,8 +150,26 @@ __webpack_require__.d(__webpack_exports__, {
     '@biomejs/biome': '^2.5.6',
     oxlint: '^1.76.0',
     oxfmt: '^0.61.0',
+    eslint: '^10.8.0',
+    // ESLint's own recommended JavaScript rules, which typescript-eslint layers on top of rather than
+    // replaces, and the rules of hooks — the one class of React mistake no type checker sees.
+    '@eslint/js': '^10.0.1',
+    'typescript-eslint': '^8.65.0',
+    'eslint-plugin-react-hooks': '^7.1.1',
     wrangler: '^4.115.0'
 };
+/**
+ * The TypeScript an ESLint app pins, in place of the framework's own — the one deliberate exception to
+ * {@link FRAMEWORK_DEPS}, and the reason it is spelled out here.
+ *
+ * typescript-eslint reads TypeScript's compiler API directly rather than through a stable interface, so
+ * it accepts `typescript >=4.8.4 <6.1.0` and nothing above. `~6.0.3` is the newest that satisfies it:
+ * patch releases of 6.0, no minor. The framework itself stays on the TypeScript it is tested against —
+ * rshono's declarations compile the same under either, which is what makes this pin an app's business
+ * and not the framework's.
+ *
+ * When upstream widens the range, this constant and the ESLint feature's use of it are what to delete.
+ */ const ESLINT_TYPESCRIPT = '~6.0.3';
 
 ;// CONCATENATED MODULE: ./src/features/deploy.ts
 
@@ -157,8 +180,11 @@ __webpack_require__.d(__webpack_exports__, {
  * Deliberately thin. The framework already knows how to arrange its own output for every platform, and
  * `rshono build` writes the one platform config that has to exist (`wrangler.jsonc`, with the
  * `compatibility_date` of the day it ran) if the project has none. Generating a second copy here would
- * be a copy that goes stale. So a target contributes a `deploy` script, the CLI it needs locally, and
- * the build artefacts its platform leaves in the project.
+ * be a copy that goes stale.
+ *
+ * So a target contributes only what is true of it: the command that runs or ships the build, the CLI
+ * that command needs installed locally, the directories its platform leaves behind for `.gitignore`, and
+ * a note for the step no command covers. Several contribute just one of those.
  */ const DEPLOY_FEATURES = {
     // Where a Node build goes from here is a Dockerfile or a process manager, neither of which this can
     // guess — so the target contributes only the command that runs what was built.
@@ -187,6 +213,11 @@ __webpack_require__.d(__webpack_exports__, {
         devDependencies: {
             wrangler: TOOL_VERSIONS.wrangler
         },
+        // wrangler brings workerd, whose install script only picks the platform binary out of the optional
+        // dependency that already carries it — `workerd --version` answers without it having run.
+        allowBuilds: {
+            workerd: false
+        },
         scripts: {
             deploy: 'rshono build && wrangler deploy'
         },
@@ -236,8 +267,10 @@ function deployFeature(target) {
  * deduplicates by `id`, so `formatter: 'biome', linter: 'biome'` contributes one set of files, one
  * dependency and one pair of scripts.
  *
- * Each tool brings its own `check` script alongside `format`/`lint`, because the writing half and the
- * CI half want different exit-code behaviour: `format` rewrites files, `check` fails instead.
+ * A formatter brings `format:check` beside `format`, because the writing half and the CI half want
+ * different exit-code behaviour: `format` rewrites files, `format:check` fails instead. A linter brings
+ * `lint:fix` beside `lint`, for the same reason in the other direction — `lint` is already the failing
+ * one. Biome adds a `check` of its own, which is the pair of them in a single pass.
  */ const PRETTIER = {
     id: 'prettier',
     overlays: [
@@ -277,6 +310,30 @@ const OXLINT = {
         'lint:fix': 'oxlint --fix'
     }
 };
+/**
+ * The one feature that changes a dependency the framework otherwise decides: typescript-eslint cannot be
+ * installed alongside the TypeScript rshono is tested against, so an ESLint app pins the newest one its
+ * peer range accepts (see {@link ESLINT_TYPESCRIPT}). Every other preset leaves TypeScript alone.
+ *
+ * The rules are type-aware, which is the reason to reach for ESLint over a syntax-only linter at all —
+ * so the config it ships hands the whole program to the parser rather than linting file by file.
+ */ const ESLINT = {
+    id: 'eslint',
+    overlays: [
+        'eslint'
+    ],
+    devDependencies: {
+        eslint: TOOL_VERSIONS.eslint,
+        '@eslint/js': TOOL_VERSIONS["@eslint/js"],
+        'typescript-eslint': TOOL_VERSIONS["typescript-eslint"],
+        'eslint-plugin-react-hooks': TOOL_VERSIONS["eslint-plugin-react-hooks"],
+        typescript: (/* inlined export .ESLINT_TYPESCRIPT */"~6.0.3")
+    },
+    scripts: {
+        lint: 'eslint .',
+        'lint:fix': 'eslint . --fix'
+    }
+};
 const BIOME = {
     id: 'biome',
     overlays: [
@@ -301,6 +358,7 @@ const FORMATTERS = {
 };
 const LINTERS = {
     oxlint: OXLINT,
+    eslint: ESLINT,
     biome: BIOME,
     none: null
 };
@@ -367,6 +425,22 @@ function stylingFeature(styling) {
 
 ;// CONCATENATED MODULE: ./src/options.ts
 
+/*
+ * The names each option accepts, spelled once. The types below are derived from them, the CLI validates
+ * its flags against them and prints them in `--help`, and `pm.ts` recognises a package manager by them
+ * — so a name added here reaches all three without a second list to remember.
+ */ const FORMATTER_NAMES = [
+    'prettier',
+    'biome',
+    'oxfmt',
+    'none'
+];
+const LINTER_NAMES = [
+    'oxlint',
+    'eslint',
+    'biome',
+    'none'
+];
 const PACKAGE_MANAGERS = [
     'npm',
     'pnpm',
@@ -377,9 +451,6 @@ const DEPLOY_TARGET_NAMES = DEPLOY_TARGETS.map((target)=>target.name);
 function deployHint(name) {
     return DEPLOY_TARGETS.find((target)=>target.name === name)?.hint ?? '';
 }
-function isDeployTarget(value) {
-    return DEPLOY_TARGET_NAMES.includes(value);
-}
 const QUALITY_PRESETS = [
     {
         id: 'prettier-oxlint',
@@ -388,6 +459,13 @@ const QUALITY_PRESETS = [
         formatter: 'prettier',
         linter: 'oxlint'
     },
+    {
+        id: 'prettier-eslint',
+        label: 'Prettier + ESLint',
+        hint: 'type-aware rules — pins TypeScript 6, which is all typescript-eslint accepts',
+        formatter: 'prettier',
+        linter: 'eslint'
+    },
     {
         id: 'biome',
         label: 'Biome',
@@ -430,11 +508,16 @@ const QUALITY_PRESETS = [
     return /^(?:@[a-z\d\-*~][a-z\d\-*._~]*\/)?[a-z\d\-~][a-z\d\-._~]*$/.test(name) && name.length <= 214;
 }
 
+;// CONCATENATED MODULE: external "node:fs"
+
+;// CONCATENATED MODULE: external "node:path"
+
 ;// CONCATENATED MODULE: ./src/pkg.ts
 
 /**
- * The scripts every app gets. `start` is not among them: it is the *Node* launcher, and the deploy
- * features each contribute the command their own platform runs what was built with.
+ * The scripts every app gets. `start` is not among them, because it means something different per
+ * platform: the three targets that run the build themselves — node, bun, deno — each contribute their
+ * own, and a platform target contributes a `deploy` instead, where its platform has one command to give.
  */ const BASE_SCRIPTS = {
     dev: 'rshono dev',
     build: 'rshono build',
@@ -454,6 +537,39 @@ const QUALITY_PRESETS = [
 function sorted(record) {
     return Object.fromEntries(Object.entries(record).sort(([a], [b])=>a < b ? -1 : 1));
 }
+/**
+ * The install script every app inherits, from the framework rather than from anything it chose. tsx
+ * reads `rshono.config.ts` through esbuild, and esbuild's script only picks the platform binary out of
+ * the optional dependency that already carries it — rshono's own repo denies it for the same reason.
+ */ const BASE_ALLOW_BUILDS = {
+    esbuild: false
+};
+/**
+ * pnpm's settings for the new app — written for pnpm and for nobody else.
+ *
+ * It exists for one field. A dependency with an install script is a question pnpm will not answer on its
+ * own: it fails the install, and fails every `pnpm dev` after it, until the project has said whether the
+ * script should run. None of the ones an rshono app inherits need to (each is a native package whose
+ * binary arrives as an optional dependency), so a fresh app carries the answer rather than meeting
+ * `pnpm approve-builds` before it has rendered a page once.
+ *
+ * In this file rather than under a `pnpm` key in `package.json`, which pnpm 11 no longer reads, single-
+ * package projects included. What lands here is a decision about *this* app: a scaffolded file the app
+ * owns from then on, not something the framework reaches back into.
+ */ function buildPnpmSettings(features) {
+    const allowBuilds = {
+        ...BASE_ALLOW_BUILDS
+    };
+    for (const feature of features)Object.assign(allowBuilds, feature.allowBuilds);
+    return [
+        '# Which dependencies may run an install script. pnpm runs none it has not been told about, and',
+        '# fails the install rather than skip one quietly — so anything added later belongs here too.',
+        '# `false` means the script was looked at: these ship their real binary as an optional dependency.',
+        'allowBuilds:',
+        ...Object.entries(sorted(allowBuilds)).map(([name, allowed])=>`  ${name}: ${allowed}`),
+        ''
+    ].join('\n');
+}
 /**
  * Assembles `package.json` from the answers and whatever the selected features contribute.
  *
@@ -485,10 +601,9 @@ function sorted(record) {
         version: '0.1.0',
         private: true,
         type: 'module',
-        // The floor the framework declares. Stated here too so a CI image or a contributor on an older
-        // Node finds out from their package manager rather than from a stack trace.
+        // Generated from the framework's own manifest, so the app's floor cannot drift below rshono's.
         engines: {
-            node: '>=22.1.0'
+            node: NODE_ENGINE
         },
         scripts,
         dependencies: sorted(dependencies),
@@ -504,25 +619,25 @@ function sorted(record) {
     return `${JSON.stringify(ordered, null, 2)}\n`;
 }
 
-;// CONCATENATED MODULE: external "node:fs"
-
-;// CONCATENATED MODULE: external "node:path"
-
 ;// CONCATENATED MODULE: ./src/render.ts
 
-const TOKEN_PATTERN = /__[A-Z][A-Z\d_]*__/g;
+/**
+ * `{{NAME}}`, and not the `__NAME__` this used to be. A template is a real file that real tools run
+ * over, and in markdown `__NAME__` *is* strong emphasis — Prettier rewrites it to `**NAME**`, which
+ * turns a token into literal text that no substitution will ever match again. `{{…}}` means nothing to
+ * any of the formats these templates are written in.
+ */ const TOKEN_PATTERN = /\{\{[A-Z][A-Z\d_]*\}\}/g;
 function tokensFor(answers, pm) {
     return {
-        __PROJECT_NAME__: answers.packageName,
-        __DEPLOY_TARGET__: answers.deploy,
-        __DEPLOY_HINT__: deployHint(answers.deploy),
-        __PM__: pm.name,
-        __PM_RUN__: pm.run
+        '{{PROJECT_NAME}}': answers.packageName,
+        '{{DEPLOY_TARGET}}': answers.deploy,
+        '{{DEPLOY_HINT}}': deployHint(answers.deploy),
+        '{{PM_RUN}}': pm.run
     };
 }
 /**
  * Substitutes tokens, and throws on one it doesn't know — a typo in a template would otherwise ship a
- * literal `__PORJECT_NAME__` into somebody's new app, which no test of the generator's logic would
+ * literal `{{PORJECT_NAME}}` into somebody's new app, which no test of the generator's logic would
  * catch.
  */ function render(contents, tokens, source) {
     return contents.replace(TOKEN_PATTERN, (token)=>{
@@ -598,6 +713,7 @@ function readTemplateDir(dir) {
     const gitignore = files.get('.gitignore');
     if (gitignore) files.set('.gitignore', appendGitignore(gitignore, features));
     files.set('package.json', buildPackageJson(answers, features, pm));
+    if (pm.name === 'pnpm') files.set('pnpm-workspace.yaml', buildPnpmSettings(features));
     return {
         // Sorted, so both the write order and a test's snapshot are stable.
         files: new Map([
@@ -612,6 +728,7 @@ function readTemplateDir(dir) {
 
 ;// CONCATENATED MODULE: ./src/pm.ts
 
+
 const INSTALL = {
     npm: [
         'install'
@@ -631,7 +748,7 @@ const RUN = {
     bun: 'bun'
 };
 function isKnown(name) {
-    return name === 'npm' || name === 'pnpm' || name === 'yarn' || name === 'bun';
+    return PACKAGE_MANAGERS.includes(name);
 }
 function packageManager(name, version) {
     return {
@@ -688,15 +805,20 @@ function run(pm, args, cwd) {
     '.vscode',
     'Thumbs.db'
 ]);
-function inspectTarget(dir) {
-    if (!existsSync(dir)) return {
-        exists: false,
-        conflicts: []
-    };
-    return {
-        exists: true,
-        conflicts: readdirSync(dir).filter((entry)=>!IGNORED_ENTRIES.has(entry))
-    };
+/**
+ * What is already at the target path, which is what decides whether scaffolding into it is safe: the
+ * entries already there, ignoring the ones a fresh clone or an editor leaves behind.
+ *
+ * A path that does not exist yet is no conflict. A path that exists and is *not* a directory is not
+ * something `--force` should be able to write into, so it throws rather than reporting an empty list —
+ * otherwise `create-rshono README.md` gets as far as `mkdir` before failing on a raw ENOTDIR.
+ */ function conflictingEntries(dir) {
+    const stats = statSync(dir, {
+        throwIfNoEntry: false
+    });
+    if (!stats) return [];
+    if (!stats.isDirectory()) throw new Error(`${dir} already exists and is not a directory.`);
+    return readdirSync(dir).filter((entry)=>!IGNORED_ENTRIES.has(entry));
 }
 /**
  * Writes the plan. Directories are created as needed, and files are written with the plan's own
@@ -718,7 +840,16 @@ function inspectTarget(dir) {
 /**
  * The generator without the CLI around it: answers in, the exact set of files out. This is what the
  * test suite asserts on — the whole matrix of options, in memory, with no directory to clean up — and
- * what another tool would call to scaffold an app itself.
+ * what another tool would call to scaffold an app itself:
+ *
+ * ```ts
+ * import { packageManager, plan, writePlan } from '@rshono/create';
+ *
+ * const answers = { packageName: 'my-app', deploy: 'node', styling: 'css', formatter: 'prettier', linter: 'oxlint' };
+ * writePlan(plan(answers, packageManager('npm')), './my-app');
+ * ```
+ *
+ * `package.json` is assembled inside `plan`, so nothing here needs to be composed by hand.
  *
  * @packageDocumentation
  */ 
@@ -728,22 +859,22 @@ function inspectTarget(dir) {
 
 
 
-
 var __webpack_exports__DEPLOY_TARGET_NAMES = __webpack_exports__.bp;
+var __webpack_exports__ESLINT_TYPESCRIPT = __webpack_exports__.ml;
+var __webpack_exports__FORMATTER_NAMES = __webpack_exports__.wC;
 var __webpack_exports__FRAMEWORK_DEPS = __webpack_exports__.e7;
+var __webpack_exports__LINTER_NAMES = __webpack_exports__.At;
 var __webpack_exports__PACKAGE_MANAGERS = __webpack_exports__.Ab;
 var __webpack_exports__QUALITY_PRESETS = __webpack_exports__.pm;
 var __webpack_exports__RSHONO_RANGE = __webpack_exports__.s_;
 var __webpack_exports__TOOL_VERSIONS = __webpack_exports__.RM;
-var __webpack_exports__buildPackageJson = __webpack_exports__.Jh;
+var __webpack_exports__conflictingEntries = __webpack_exports__.dh;
 var __webpack_exports__deployHint = __webpack_exports__.P8;
 var __webpack_exports__detectPackageManager = __webpack_exports__.Lv;
-var __webpack_exports__inspectTarget = __webpack_exports__.WL;
-var __webpack_exports__isDeployTarget = __webpack_exports__.p1;
 var __webpack_exports__isValidPackageName = __webpack_exports__.eW;
-var __webpack_exports__packageManager = __webpack_exports__.ml;
+var __webpack_exports__packageManager = __webpack_exports__.VZ;
 var __webpack_exports__plan = __webpack_exports__.et;
 var __webpack_exports__selectFeatures = __webpack_exports__.N7;
 var __webpack_exports__toPackageName = __webpack_exports__.PQ;
 var __webpack_exports__writePlan = __webpack_exports__.pD;
-export { __webpack_exports__DEPLOY_TARGET_NAMES as DEPLOY_TARGET_NAMES, __webpack_exports__FRAMEWORK_DEPS as FRAMEWORK_DEPS, __webpack_exports__PACKAGE_MANAGERS as PACKAGE_MANAGERS, __webpack_exports__QUALITY_PRESETS as QUALITY_PRESETS, __webpack_exports__RSHONO_RANGE as RSHONO_RANGE, __webpack_exports__TOOL_VERSIONS as TOOL_VERSIONS, __webpack_exports__buildPackageJson as buildPackageJson, __webpack_exports__deployHint as deployHint, __webpack_exports__detectPackageManager as detectPackageManager, __webpack_exports__inspectTarget as inspectTarget, __webpack_exports__isDeployTarget as isDeployTarget, __webpack_exports__isValidPackageName as isValidPackageName, __webpack_exports__packageManager as packageManager, __webpack_exports__plan as plan, __webpack_exports__selectFeatures as selectFeatures, __webpack_exports__toPackageName as toPackageName, __webpack_exports__writePlan as writePlan };
+export { __webpack_exports__DEPLOY_TARGET_NAMES as DEPLOY_TARGET_NAMES, __webpack_exports__ESLINT_TYPESCRIPT as ESLINT_TYPESCRIPT, __webpack_exports__FORMATTER_NAMES as FORMATTER_NAMES, __webpack_exports__FRAMEWORK_DEPS as FRAMEWORK_DEPS, __webpack_exports__LINTER_NAMES as LINTER_NAMES, __webpack_exports__PACKAGE_MANAGERS as PACKAGE_MANAGERS, __webpack_exports__QUALITY_PRESETS as QUALITY_PRESETS, __webpack_exports__RSHONO_RANGE as RSHONO_RANGE, __webpack_exports__TOOL_VERSIONS as TOOL_VERSIONS, __webpack_exports__conflictingEntries as conflictingEntries, __webpack_exports__deployHint as deployHint, __webpack_exports__detectPackageManager as detectPackageManager, __webpack_exports__isValidPackageName as isValidPackageName, __webpack_exports__packageManager as packageManager, __webpack_exports__plan as plan, __webpack_exports__selectFeatures as selectFeatures, __webpack_exports__toPackageName as toPackageName, __webpack_exports__writePlan as writePlan };

package/dist/cli.mjs

@@ -6,7 +6,7 @@ import { parseArgs, styleText as external_node_util_styleText } from "node:util"
 import node_process, { stdin as external_node_process_stdin, stdout as external_node_process_stdout } from "node:process";
 import node_readline from "node:readline";
 import "node:tty";
-import { existsSync as external_node_fs_existsSync, mkdirSync, readFileSync, readdirSync as external_node_fs_readdirSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, readdirSync as external_node_fs_readdirSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname as external_node_path_dirname, join as external_node_path_join, posix, relative as external_node_path_relative, resolve, sep } from "node:path";
 import { spawnSync } from "node:child_process";
 var __webpack_modules__ = ({
@@ -2943,7 +2943,11 @@ function hasGit(cwd) {
 
 ;// CONCATENATED MODULE: ./src/generated/framework.ts
 // GENERATED by scripts/codegen.mjs from packages/core — do not edit. Run `pnpm --filter @rshono/create codegen`.
-/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.0';
+/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.2';
+/**
+ * The Node range rshono itself declares, restated in every scaffolded app's `engines` — so a CI image
+ * or a contributor on an older Node hears it from their package manager rather than from a stack trace.
+ */ const NODE_ENGINE = '>=22.1.0';
 /**
  * The dependency versions rshono is tested against, copied from its own manifest. Exact where it is
  * exact — React's RSC internals are coupled across builds, and a generated app has no workspace
@@ -2989,19 +2993,32 @@ function hasGit(cwd) {
 
 ;// CONCATENATED MODULE: ./src/options.ts
 
-const PACKAGE_MANAGERS = (/* unused pure expression or super */ null && ([
+/*
+ * The names each option accepts, spelled once. The types below are derived from them, the CLI validates
+ * its flags against them and prints them in `--help`, and `pm.ts` recognises a package manager by them
+ * — so a name added here reaches all three without a second list to remember.
+ */ const FORMATTER_NAMES = [
+    'prettier',
+    'biome',
+    'oxfmt',
+    'none'
+];
+const LINTER_NAMES = [
+    'oxlint',
+    'eslint',
+    'biome',
+    'none'
+];
+const PACKAGE_MANAGERS = [
     'npm',
     'pnpm',
     'yarn',
     'bun'
-]));
+];
 const DEPLOY_TARGET_NAMES = DEPLOY_TARGETS.map((target)=>target.name);
 function deployHint(name) {
     return DEPLOY_TARGETS.find((target)=>target.name === name)?.hint ?? '';
 }
-function isDeployTarget(value) {
-    return DEPLOY_TARGET_NAMES.includes(value);
-}
 const QUALITY_PRESETS = [
     {
         id: 'prettier-oxlint',
@@ -3010,6 +3027,13 @@ const QUALITY_PRESETS = [
         formatter: 'prettier',
         linter: 'oxlint'
     },
+    {
+        id: 'prettier-eslint',
+        label: 'Prettier + ESLint',
+        hint: 'type-aware rules — pins TypeScript 6, which is all typescript-eslint accepts',
+        formatter: 'prettier',
+        linter: 'eslint'
+    },
     {
         id: 'biome',
         label: 'Biome',
@@ -3081,7 +3105,7 @@ const QUALITY_PRESETS = [
 
 ;// CONCATENATED MODULE: ./src/versions.ts
 
-
+/** Passed straight through, so everything generated from the framework reaches the rest of the package here. */ 
 /** The framework range a scaffolded app gets. The two packages are released together, so this is ours. */ const RSHONO_RANGE = `^${RSHONO_VERSION}`;
 /**
  * Versions for the optional tooling the features can add — the one place in this package where a
@@ -3102,8 +3126,26 @@ const QUALITY_PRESETS = [
     '@biomejs/biome': '^2.5.6',
     oxlint: '^1.76.0',
     oxfmt: '^0.61.0',
+    eslint: '^10.8.0',
+    // ESLint's own recommended JavaScript rules, which typescript-eslint layers on top of rather than
+    // replaces, and the rules of hooks — the one class of React mistake no type checker sees.
+    '@eslint/js': '^10.0.1',
+    'typescript-eslint': '^8.65.0',
+    'eslint-plugin-react-hooks': '^7.1.1',
     wrangler: '^4.115.0'
 };
+/**
+ * The TypeScript an ESLint app pins, in place of the framework's own — the one deliberate exception to
+ * {@link FRAMEWORK_DEPS}, and the reason it is spelled out here.
+ *
+ * typescript-eslint reads TypeScript's compiler API directly rather than through a stable interface, so
+ * it accepts `typescript >=4.8.4 <6.1.0` and nothing above. `~6.0.3` is the newest that satisfies it:
+ * patch releases of 6.0, no minor. The framework itself stays on the TypeScript it is tested against —
+ * rshono's declarations compile the same under either, which is what makes this pin an app's business
+ * and not the framework's.
+ *
+ * When upstream widens the range, this constant and the ESLint feature's use of it are what to delete.
+ */ const ESLINT_TYPESCRIPT = '~6.0.3';
 
 ;// CONCATENATED MODULE: ./src/features/deploy.ts
 
@@ -3114,8 +3156,11 @@ const QUALITY_PRESETS = [
  * Deliberately thin. The framework already knows how to arrange its own output for every platform, and
  * `rshono build` writes the one platform config that has to exist (`wrangler.jsonc`, with the
  * `compatibility_date` of the day it ran) if the project has none. Generating a second copy here would
- * be a copy that goes stale. So a target contributes a `deploy` script, the CLI it needs locally, and
- * the build artefacts its platform leaves in the project.
+ * be a copy that goes stale.
+ *
+ * So a target contributes only what is true of it: the command that runs or ships the build, the CLI
+ * that command needs installed locally, the directories its platform leaves behind for `.gitignore`, and
+ * a note for the step no command covers. Several contribute just one of those.
  */ const DEPLOY_FEATURES = {
     // Where a Node build goes from here is a Dockerfile or a process manager, neither of which this can
     // guess — so the target contributes only the command that runs what was built.
@@ -3144,6 +3189,11 @@ const QUALITY_PRESETS = [
         devDependencies: {
             wrangler: TOOL_VERSIONS.wrangler
         },
+        // wrangler brings workerd, whose install script only picks the platform binary out of the optional
+        // dependency that already carries it — `workerd --version` answers without it having run.
+        allowBuilds: {
+            workerd: false
+        },
         scripts: {
             deploy: 'rshono build && wrangler deploy'
         },
@@ -3193,8 +3243,10 @@ function deployFeature(target) {
  * deduplicates by `id`, so `formatter: 'biome', linter: 'biome'` contributes one set of files, one
  * dependency and one pair of scripts.
  *
- * Each tool brings its own `check` script alongside `format`/`lint`, because the writing half and the
- * CI half want different exit-code behaviour: `format` rewrites files, `check` fails instead.
+ * A formatter brings `format:check` beside `format`, because the writing half and the CI half want
+ * different exit-code behaviour: `format` rewrites files, `format:check` fails instead. A linter brings
+ * `lint:fix` beside `lint`, for the same reason in the other direction — `lint` is already the failing
+ * one. Biome adds a `check` of its own, which is the pair of them in a single pass.
  */ const PRETTIER = {
     id: 'prettier',
     overlays: [
@@ -3234,6 +3286,30 @@ const OXLINT = {
         'lint:fix': 'oxlint --fix'
     }
 };
+/**
+ * The one feature that changes a dependency the framework otherwise decides: typescript-eslint cannot be
+ * installed alongside the TypeScript rshono is tested against, so an ESLint app pins the newest one its
+ * peer range accepts (see {@link ESLINT_TYPESCRIPT}). Every other preset leaves TypeScript alone.
+ *
+ * The rules are type-aware, which is the reason to reach for ESLint over a syntax-only linter at all —
+ * so the config it ships hands the whole program to the parser rather than linting file by file.
+ */ const ESLINT = {
+    id: 'eslint',
+    overlays: [
+        'eslint'
+    ],
+    devDependencies: {
+        eslint: TOOL_VERSIONS.eslint,
+        '@eslint/js': TOOL_VERSIONS["@eslint/js"],
+        'typescript-eslint': TOOL_VERSIONS["typescript-eslint"],
+        'eslint-plugin-react-hooks': TOOL_VERSIONS["eslint-plugin-react-hooks"],
+        typescript: (/* inlined export .ESLINT_TYPESCRIPT */"~6.0.3")
+    },
+    scripts: {
+        lint: 'eslint .',
+        'lint:fix': 'eslint . --fix'
+    }
+};
 const BIOME = {
     id: 'biome',
     overlays: [
@@ -3258,6 +3334,7 @@ const FORMATTERS = {
 };
 const LINTERS = {
     oxlint: OXLINT,
+    eslint: ESLINT,
     biome: BIOME,
     none: null
 };
@@ -3325,8 +3402,9 @@ function stylingFeature(styling) {
 ;// CONCATENATED MODULE: ./src/pkg.ts
 
 /**
- * The scripts every app gets. `start` is not among them: it is the *Node* launcher, and the deploy
- * features each contribute the command their own platform runs what was built with.
+ * The scripts every app gets. `start` is not among them, because it means something different per
+ * platform: the three targets that run the build themselves — node, bun, deno — each contribute their
+ * own, and a platform target contributes a `deploy` instead, where its platform has one command to give.
  */ const BASE_SCRIPTS = {
     dev: 'rshono dev',
     build: 'rshono build',
@@ -3346,6 +3424,39 @@ function stylingFeature(styling) {
 function sorted(record) {
     return Object.fromEntries(Object.entries(record).sort(([a], [b])=>a < b ? -1 : 1));
 }
+/**
+ * The install script every app inherits, from the framework rather than from anything it chose. tsx
+ * reads `rshono.config.ts` through esbuild, and esbuild's script only picks the platform binary out of
+ * the optional dependency that already carries it — rshono's own repo denies it for the same reason.
+ */ const BASE_ALLOW_BUILDS = {
+    esbuild: false
+};
+/**
+ * pnpm's settings for the new app — written for pnpm and for nobody else.
+ *
+ * It exists for one field. A dependency with an install script is a question pnpm will not answer on its
+ * own: it fails the install, and fails every `pnpm dev` after it, until the project has said whether the
+ * script should run. None of the ones an rshono app inherits need to (each is a native package whose
+ * binary arrives as an optional dependency), so a fresh app carries the answer rather than meeting
+ * `pnpm approve-builds` before it has rendered a page once.
+ *
+ * In this file rather than under a `pnpm` key in `package.json`, which pnpm 11 no longer reads, single-
+ * package projects included. What lands here is a decision about *this* app: a scaffolded file the app
+ * owns from then on, not something the framework reaches back into.
+ */ function buildPnpmSettings(features) {
+    const allowBuilds = {
+        ...BASE_ALLOW_BUILDS
+    };
+    for (const feature of features)Object.assign(allowBuilds, feature.allowBuilds);
+    return [
+        '# Which dependencies may run an install script. pnpm runs none it has not been told about, and',
+        '# fails the install rather than skip one quietly — so anything added later belongs here too.',
+        '# `false` means the script was looked at: these ship their real binary as an optional dependency.',
+        'allowBuilds:',
+        ...Object.entries(sorted(allowBuilds)).map(([name, allowed])=>`  ${name}: ${allowed}`),
+        ''
+    ].join('\n');
+}
 /**
  * Assembles `package.json` from the answers and whatever the selected features contribute.
  *
@@ -3377,10 +3488,9 @@ function sorted(record) {
         version: '0.1.0',
         private: true,
         type: 'module',
-        // The floor the framework declares. Stated here too so a CI image or a contributor on an older
-        // Node finds out from their package manager rather than from a stack trace.
+        // Generated from the framework's own manifest, so the app's floor cannot drift below rshono's.
         engines: {
-            node: '>=22.1.0'
+            node: NODE_ENGINE
         },
         scripts,
         dependencies: sorted(dependencies),
@@ -3398,19 +3508,23 @@ function sorted(record) {
 
 ;// CONCATENATED MODULE: ./src/render.ts
 
-const TOKEN_PATTERN = /__[A-Z][A-Z\d_]*__/g;
+/**
+ * `{{NAME}}`, and not the `__NAME__` this used to be. A template is a real file that real tools run
+ * over, and in markdown `__NAME__` *is* strong emphasis — Prettier rewrites it to `**NAME**`, which
+ * turns a token into literal text that no substitution will ever match again. `{{…}}` means nothing to
+ * any of the formats these templates are written in.
+ */ const TOKEN_PATTERN = /\{\{[A-Z][A-Z\d_]*\}\}/g;
 function tokensFor(answers, pm) {
     return {
-        __PROJECT_NAME__: answers.packageName,
-        __DEPLOY_TARGET__: answers.deploy,
-        __DEPLOY_HINT__: deployHint(answers.deploy),
-        __PM__: pm.name,
-        __PM_RUN__: pm.run
+        '{{PROJECT_NAME}}': answers.packageName,
+        '{{DEPLOY_TARGET}}': answers.deploy,
+        '{{DEPLOY_HINT}}': deployHint(answers.deploy),
+        '{{PM_RUN}}': pm.run
     };
 }
 /**
  * Substitutes tokens, and throws on one it doesn't know — a typo in a template would otherwise ship a
- * literal `__PORJECT_NAME__` into somebody's new app, which no test of the generator's logic would
+ * literal `{{PORJECT_NAME}}` into somebody's new app, which no test of the generator's logic would
  * catch.
  */ function render(contents, tokens, source) {
     return contents.replace(TOKEN_PATTERN, (token)=>{
@@ -3486,6 +3600,7 @@ function readTemplateDir(dir) {
     const gitignore = files.get('.gitignore');
     if (gitignore) files.set('.gitignore', appendGitignore(gitignore, features));
     files.set('package.json', buildPackageJson(answers, features, pm));
+    if (pm.name === 'pnpm') files.set('pnpm-workspace.yaml', buildPnpmSettings(features));
     return {
         // Sorted, so both the write order and a test's snapshot are stable.
         files: new Map([
@@ -3498,6 +3613,7 @@ function readTemplateDir(dir) {
 
 ;// CONCATENATED MODULE: ./src/pm.ts
 
+
 const INSTALL = {
     npm: [
         'install'
@@ -3517,7 +3633,7 @@ const RUN = {
     bun: 'bun'
 };
 function isKnown(name) {
-    return name === 'npm' || name === 'pnpm' || name === 'yarn' || name === 'bun';
+    return PACKAGE_MANAGERS.includes(name);
 }
 function packageManager(name, version) {
     return {
@@ -3611,15 +3727,20 @@ function run(pm, args, cwd) {
     '.vscode',
     'Thumbs.db'
 ]);
-function inspectTarget(dir) {
-    if (!external_node_fs_existsSync(dir)) return {
-        exists: false,
-        conflicts: []
-    };
-    return {
-        exists: true,
-        conflicts: external_node_fs_readdirSync(dir).filter((entry)=>!IGNORED_ENTRIES.has(entry))
-    };
+/**
+ * What is already at the target path, which is what decides whether scaffolding into it is safe: the
+ * entries already there, ignoring the ones a fresh clone or an editor leaves behind.
+ *
+ * A path that does not exist yet is no conflict. A path that exists and is *not* a directory is not
+ * something `--force` should be able to write into, so it throws rather than reporting an empty list —
+ * otherwise `create-rshono README.md` gets as far as `mkdir` before failing on a raw ENOTDIR.
+ */ function conflictingEntries(dir) {
+    const stats = statSync(dir, {
+        throwIfNoEntry: false
+    });
+    if (!stats) return [];
+    if (!stats.isDirectory()) throw new Error(`${dir} already exists and is not a directory.`);
+    return external_node_fs_readdirSync(dir).filter((entry)=>!IGNORED_ENTRIES.has(entry));
 }
 /**
  * Writes the plan. Directories are created as needed, and files are written with the plan's own
@@ -3647,8 +3768,9 @@ function inspectTarget(dir) {
 
 
 
+
 const DEFAULT_DIRECTORY = 'my-rshono-app';
-const HELP = `create-rshono — scaffold a new rshono app
+/** Every accepted name comes from `options.ts`, so the help cannot promise one the validation refuses. */ const HELP = `create-rshono — scaffold a new rshono app
 
 Usage:
   npm create @rshono@latest [directory] [options]
@@ -3658,9 +3780,9 @@ Options:
   -d, --deploy <target>    ${DEPLOY_TARGET_NAMES.join(' | ')}
       --tailwind           Tailwind CSS (--no-tailwind for plain CSS)
       --quality <preset>   ${QUALITY_PRESETS.map((preset)=>preset.id).join(' | ')}
-      --formatter <name>   prettier | biome | oxfmt | none  (overrides --quality)
-      --linter <name>      oxlint | biome | none            (overrides --quality)
-      --pm <name>          npm | pnpm | yarn | bun          (default: whatever ran this)
+      --formatter <name>   ${FORMATTER_NAMES.join(' | ')}      (overrides --quality)
+      --linter <name>      ${LINTER_NAMES.join(' | ')}       (overrides --quality; eslint pins TypeScript 6)
+      --pm <name>          ${PACKAGE_MANAGERS.join(' | ')}              (default: whatever ran this)
       --no-install         write the files and stop
       --no-git             do not initialize a repository
       --force              scaffold into a directory that is not empty
@@ -3688,92 +3810,94 @@ function fail(message) {
     if (off) return false;
     return undefined;
 }
-async function main() {
-    const { values, positionals } = parseArgs({
-        options: {
-            yes: {
-                type: 'boolean',
-                short: 'y'
-            },
-            deploy: {
-                type: 'string',
-                short: 'd'
-            },
-            tailwind: {
-                type: 'boolean'
-            },
-            'no-tailwind': {
-                type: 'boolean'
-            },
-            quality: {
-                type: 'string'
-            },
-            formatter: {
-                type: 'string'
-            },
-            linter: {
-                type: 'string'
-            },
-            pm: {
-                type: 'string'
-            },
-            install: {
-                type: 'boolean'
-            },
-            'no-install': {
-                type: 'boolean'
-            },
-            git: {
-                type: 'boolean'
-            },
-            'no-git': {
-                type: 'boolean'
-            },
-            force: {
-                type: 'boolean'
-            },
-            'dry-run': {
-                type: 'boolean'
-            },
-            help: {
-                type: 'boolean',
-                short: 'h'
+/**
+ * `parseArgs` rejects an unknown flag with a message that names it but nothing else — so a mistyped
+ * `--tailwnid` reads as a wall of text about positional arguments. Pointing at `--help` is the whole
+ * addition.
+ */ function parse() {
+    try {
+        return parseArgs({
+            options: {
+                yes: {
+                    type: 'boolean',
+                    short: 'y'
+                },
+                deploy: {
+                    type: 'string',
+                    short: 'd'
+                },
+                tailwind: {
+                    type: 'boolean'
+                },
+                'no-tailwind': {
+                    type: 'boolean'
+                },
+                quality: {
+                    type: 'string'
+                },
+                formatter: {
+                    type: 'string'
+                },
+                linter: {
+                    type: 'string'
+                },
+                pm: {
+                    type: 'string'
+                },
+                install: {
+                    type: 'boolean'
+                },
+                'no-install': {
+                    type: 'boolean'
+                },
+                git: {
+                    type: 'boolean'
+                },
+                'no-git': {
+                    type: 'boolean'
+                },
+                force: {
+                    type: 'boolean'
+                },
+                'dry-run': {
+                    type: 'boolean'
+                },
+                help: {
+                    type: 'boolean',
+                    short: 'h'
+                },
+                version: {
+                    type: 'boolean',
+                    short: 'v'
+                }
             },
-            version: {
-                type: 'boolean',
-                short: 'v'
-            }
-        },
-        allowPositionals: true
-    });
+            allowPositionals: true
+        });
+    } catch (error) {
+        fail(`${error instanceof Error ? error.message : String(error)}\n\nRun with --help to see the options.`);
+    }
+}
+async function main() {
+    const { values, positionals } = parse();
     if (values.help) return console.log(HELP);
-    if (values.version) return console.log("1.0.0-rc.0");
-    // A pipe, a CI job or an agent gets the defaults rather than a prompt nothing can answer.
-    const interactive = Boolean(process.stdout.isTTY) && !values.yes;
-    const pmFlag = oneOf(values.pm, [
-        'npm',
-        'pnpm',
-        'yarn',
-        'bun'
-    ], 'pm');
+    if (values.version) return console.log("1.0.0-rc.2");
+    /*
+   * A pipe, a CI job or an agent gets the defaults rather than a prompt nothing can answer. Both streams
+   * have to be a terminal: the prompts draw on stdout but *read from stdin*, so `echo | npm create` with
+   * stdout still attached would otherwise ask a question with nothing behind the keyboard.
+   */ const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY) && !values.yes;
+    const pmFlag = oneOf(values.pm, PACKAGE_MANAGERS, 'pm');
     const pm = pmFlag ? packageManager(pmFlag) : detectPackageManager();
     const deployFlag = oneOf(values.deploy, DEPLOY_TARGET_NAMES, 'deploy');
-    const formatterFlag = oneOf(values.formatter, [
-        'prettier',
-        'biome',
-        'oxfmt',
-        'none'
-    ], 'formatter');
-    const linterFlag = oneOf(values.linter, [
-        'oxlint',
-        'biome',
-        'none'
-    ], 'linter');
+    const formatterFlag = oneOf(values.formatter, FORMATTER_NAMES, 'formatter');
+    const linterFlag = oneOf(values.linter, LINTER_NAMES, 'linter');
     const qualityFlag = oneOf(values.quality, QUALITY_PRESETS.map((preset)=>preset.id), 'quality');
     const tailwindFlag = tristate(values.tailwind, values['no-tailwind'], 'tailwind');
     const installFlag = tristate(values.install, values['no-install'], 'install');
     const gitFlag = tristate(values.git, values['no-git'], 'git');
-    intro(`create-rshono  ·  rshono ${"1.0.0-rc.0"}`);
+    // The framework version, not this package's: it is the one the app will be pinned to, and the one
+    // worth reading here. `--version` reports create-rshono's own.
+    intro(`create-rshono  ·  rshono ${RSHONO_VERSION}`);
     // ── Where ───────────────────────────────────────────────────────────────────────────────────────
     let directory = positionals[0];
     if (!directory) {
@@ -3787,7 +3911,7 @@ async function main() {
     const targetDir = resolve(process.cwd(), directory);
     const packageName = toPackageName(directory === '.' ? basename(targetDir) : directory);
     if (!packageName || !isValidPackageName(packageName)) fail(`"${directory}" does not give a usable npm package name.`);
-    const conflicts = inspectTarget(targetDir).conflicts;
+    const conflicts = conflictingEntries(targetDir);
     if (conflicts.length > 0 && !values.force) {
         const where = directory === '.' ? 'this directory' : `"${directory}"`;
         const listed = `${conflicts.slice(0, 3).join(', ')}${conflicts.length > 3 ? ', …' : ''}`;
@@ -3813,7 +3937,7 @@ async function main() {
                 }))
         }));
     }
-    let styling = tailwindFlag === undefined ? 'css' : tailwindFlag ? 'tailwind' : 'css';
+    let styling = tailwindFlag ? 'tailwind' : 'css';
     if (tailwindFlag === undefined && interactive) {
         styling = unwrap(await dist_select({
             message: 'Styling?',
@@ -3863,9 +3987,10 @@ async function main() {
             initialValue: true
         }));
     }
-    let git = gitFlag ?? !isInsideRepo(process.cwd());
+    // Asked once, not once per use: this shells out to `git rev-parse`.
+    const nested = isInsideRepo(process.cwd());
+    let git = gitFlag ?? !nested;
     if (gitFlag === undefined && interactive) {
-        const nested = isInsideRepo(process.cwd());
         git = unwrap(await dist_confirm({
             message: nested ? 'Initialize a git repository? (this is already inside one)' : 'Initialize a git repository?',
             initialValue: !nested
@@ -3873,14 +3998,10 @@ async function main() {
     }
     const answers = {
         packageName,
-        targetDir,
         deploy,
         styling,
         formatter,
-        linter,
-        packageManager: pm.name,
-        install,
-        git
+        linter
     };
     // ── Plan, then write ────────────────────────────────────────────────────────────────────────────
     const plan = plan_plan(answers, pm);
@@ -3897,14 +4018,17 @@ async function main() {
     if (install) {
         log.step(`Installing dependencies with ${pm.name}…`);
         installed = runInstall(pm, targetDir);
-        if (!installed) log.warn(`${pm.name} install failed — run it yourself and the rest will work.`);
+        if (!installed) log.warn(`${pm.name} install failed — the files are all written, so run it yourself in the project.`);
     }
     /*
    * Format the scaffold with the tool it was scaffolded with, so a fresh project passes its own
    * `format:check` instead of reporting a diff nobody made. Needs the install, since the formatter is a
    * devDependency — hence the skip, rather than a failure, when there is none.
-   */ if (installed && formatter !== 'none') {
-        if (!runScript(pm, 'format', targetDir)) log.warn(`\`${pm.run} format\` failed — the files are fine, the formatter is not.`);
+   *
+   * Whether there is a `format` script is the plan's answer, not the formatter answer's: `--formatter
+   * none --linter biome` has no formatter and a `format` script all the same, because Biome brings one.
+   */ if (installed && plan.features.some((feature)=>feature.scripts?.format)) {
+        if (!runScript(pm, 'format', targetDir)) log.warn(`\`${pm.run} format\` failed — the scaffold is written, just not formatted.`);
     }
     if (git) {
         if (!hasGit(targetDir)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rshono/create",
-  "version": "1.0.0-rc.0",
+  "version": "1.0.0-rc.2",
   "description": "Scaffold a new rshono app — Hono + Rspack + React Server Components",
   "author": "Lasse <lasse@lassetange.com> (https://www.lassetange.com)",
   "license": "ISC",

package/templates/base/README.md

@@ -1,11 +1,11 @@
-# **PROJECT_NAME**
+# {{PROJECT_NAME}}
 
 A [rshono](https://github.com/rshono/rshono) app — [Hono](https://hono.dev) + [Rspack](https://rspack.rs) + [React Server Components](https://react.dev/reference/rsc/server-components).
 
 ```bash
-__PM_RUN__ dev        # dev server with HMR, http://localhost:3000
-__PM_RUN__ build      # production build for __DEPLOY_TARGET__
-__PM_RUN__ typecheck  # tsc --noEmit
+{{PM_RUN}} dev        # dev server with HMR, http://localhost:3000
+{{PM_RUN}} build      # production build for {{DEPLOY_TARGET}}
+{{PM_RUN}} typecheck  # tsc --noEmit
 ```
 
 `package.json` has the rest, including whatever your formatter and linter added.
@@ -35,7 +35,7 @@ compiles to `undefined` rather than shipping. `src/lib/env.ts` is where both sid
 
 ## Deploying
 
-This app is built for `__DEPLOY_TARGET__`: after `__PM_RUN__ build`, **DEPLOY_HINT**.
+This app is built for `{{DEPLOY_TARGET}}`: after `{{PM_RUN}} build`, {{DEPLOY_HINT}}.
 
 Change `deploy` in `rshono.config.ts` to target somewhere else, or build for one place without editing the
 file: `rshono build --deploy vercel`, or `RSHONO_DEPLOY=vercel` in CI. `dev` always runs the Node dev

package/templates/base/_env

@@ -6,4 +6,4 @@
 # Only `PUBLIC_`-prefixed variables are compiled into the browser bundle. Anything else is server-only:
 # a stray read of it in client code compiles to `undefined` rather than shipping.
 
-PUBLIC_APP_NAME="__PROJECT_NAME__"
+PUBLIC_APP_NAME="{{PROJECT_NAME}}"

package/templates/base/rshono.config.ts

@@ -10,7 +10,7 @@ import { defineConfig } from '@rshono/core';
  */
 export default defineConfig({
   /** Where `build` targets. Overridable per build with `--deploy` or `RSHONO_DEPLOY`. */
-  deploy: '__DEPLOY_TARGET__',
+  deploy: '{{DEPLOY_TARGET}}',
 
   // The public origin, baked into prerendered pages' absolute URLs. Set it if you use `render: 'static'`
   // and build canonical tags, `og:url` or absolute links — there is no request to read a Host from.

package/templates/base/src/actions.ts

@@ -9,7 +9,10 @@
  * The signature is the one `useActionState` expects: previous state first, then the form data.
  */
 export async function greet(_previous: string | null, formData: FormData): Promise<string> {
-  const name = String(formData.get('name') ?? '').trim();
+  // A form field is a string or a File, never only a string — a file input posted under this name would
+  // stringify to "[object File]" rather than fail. Narrowing is the validation the endpoint owes itself.
+  const field = formData.get('name');
+  const name = typeof field === 'string' ? field.trim() : '';
   if (!name) return 'Type a name first.';
 
   // Where real work goes — a database write, an email, a queue push.

package/templates/base/src/lib/env.ts

@@ -9,7 +9,7 @@
 
 /** Safe anywhere: `PUBLIC_` variables are the ones compiled into the browser bundle. */
 export const publicEnv = {
-  appName: process.env.PUBLIC_APP_NAME ?? '__PROJECT_NAME__',
+  appName: process.env.PUBLIC_APP_NAME ?? '{{PROJECT_NAME}}',
 };
 
 /**

package/templates/biome/biome.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://biomejs.dev/schemas/2.5.6/schema.json",
-  "files": { "includes": ["**", "!dist", "!wrangler.jsonc"] },
+  "files": { "includes": ["**", "!dist", "!.wrangler", "!.vercel", "!.netlify", "!wrangler.jsonc"] },
   "formatter": { "indentStyle": "space", "indentWidth": 2, "lineWidth": 140 },
   "javascript": { "formatter": { "quoteStyle": "single", "jsxQuoteStyle": "double" } },
   "linter": { "enabled": true, "rules": { "preset": "recommended" } }

package/templates/biome-tailwind/biome.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://biomejs.dev/schemas/2.5.6/schema.json",
-  "files": { "includes": ["**", "!dist", "!wrangler.jsonc", "!**/*.css"] },
+  "files": { "includes": ["**", "!dist", "!.wrangler", "!.vercel", "!.netlify", "!wrangler.jsonc", "!**/*.css"] },
   "formatter": { "indentStyle": "space", "indentWidth": 2, "lineWidth": 140 },
   "javascript": { "formatter": { "quoteStyle": "single", "jsxQuoteStyle": "double" } },
   "linter": { "enabled": true, "rules": { "preset": "recommended" } }

package/templates/eslint/eslint.config.mjs

@@ -0,0 +1,31 @@
+import js from '@eslint/js';
+import reactHooks from 'eslint-plugin-react-hooks';
+import tseslint from 'typescript-eslint';
+
+/**
+ * Flat config, with type-aware rules — the reason to run ESLint over a syntax-only linter. `projectService`
+ * builds the same program `tsc` does from tsconfig.json, so a rule can ask what a value actually *is*:
+ * an unawaited promise, a `catch` that swallows an error, a `String()` around something that is not one.
+ *
+ * The cost is that ESLint needs TypeScript to answer, which is why this app pins TypeScript 6 —
+ * typescript-eslint reads the compiler API directly and accepts nothing newer. `npm run typecheck` is
+ * still the thing that decides whether the app compiles; these rules only see what it sees.
+ */
+export default tseslint.config(
+  // ESLint's own default ignores cover node_modules and nothing else, so the build output — and whatever
+  // the deploy target leaves beside it — would otherwise be linted as if you had written it.
+  { ignores: ['dist/**', '.wrangler/**', '.vercel/**', '.netlify/**'] },
+  js.configs.recommended,
+  tseslint.configs.recommendedTypeChecked,
+  // The rules of hooks: the one class of React mistake no type checker catches, and the reason a React
+  // app wants a linter at all.
+  reactHooks.configs.flat['recommended-latest'],
+  {
+    languageOptions: {
+      parserOptions: { projectService: true, tsconfigRootDir: import.meta.dirname },
+    },
+  },
+  // This file and any other plain JavaScript sits outside the TypeScript program, so the type-aware rules
+  // have nothing to run against and would report every file as unconfigured.
+  { files: ['**/*.{js,mjs,cjs}'], extends: [tseslint.configs.disableTypeChecked] },
+);

package/templates/oxfmt/_oxfmtrc.json

@@ -3,5 +3,5 @@
   "printWidth": 140,
   "singleQuote": true,
   "trailingComma": "all",
-  "ignorePatterns": ["wrangler.jsonc"]
+  "ignorePatterns": ["dist", ".wrangler", ".vercel", ".netlify", "wrangler.jsonc"]
 }

package/templates/oxlint/_oxlintrc.json

@@ -3,5 +3,5 @@
   "categories": {
     "correctness": "error"
   },
-  "ignorePatterns": ["dist"]
+  "ignorePatterns": ["dist", ".wrangler", ".vercel", ".netlify"]
 }

package/templates/prettier/_prettierignore

@@ -1,10 +1,15 @@
 node_modules/
-dist/
 pnpm-lock.yaml
 package-lock.json
 yarn.lock
 bun.lock
 
+# Build output: `rshono build`'s own, and whatever the deploy target assembles beside it.
+dist/
+.wrangler/
+.vercel/
+.netlify/
+
 # Written by `rshono build` for the Cloudflare target, in the shape the build decided. Yours to edit —
 # just not the formatter's to reflow on every build.
 wrangler.jsonc

package/templates/tailwind/rshono.config.ts

@@ -10,7 +10,7 @@ import { defineConfig } from '@rshono/core';
  */
 export default defineConfig({
   /** Where `build` targets. Overridable per build with `--deploy` or `RSHONO_DEPLOY`. */
-  deploy: '__DEPLOY_TARGET__',
+  deploy: '{{DEPLOY_TARGET}}',
 
   // The public origin, baked into prerendered pages' absolute URLs. Set it if you use `render: 'static'`
   // and build canonical tags, `og:url` or absolute links — there is no request to read a Host from.