@rshono/create 1.0.0-rc.1 → 1.0.0-rc.11

package/dist/api.mjs

@@ -2,7 +2,7 @@
 import {fileURLToPath as __rspack_fileURLToPath} from "node:url";
 import {dirname as __rspack_dirname} from "node:path";
 var __rspack_import_meta_dirname__ = __rspack_dirname(__rspack_fileURLToPath(import.meta.url));
-import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, posix, sep } from "node:path";
 import "node:child_process";
 // The require scope
@@ -32,16 +32,16 @@ var __webpack_exports__ = {};
 __webpack_require__.d(__webpack_exports__, {
   bp: () => (/* reexport */ DEPLOY_TARGET_NAMES),
   ml: () => (/* reexport */ (/* inlined export .ESLINT_TYPESCRIPT */"~6.0.3")),
+  wC: () => (/* reexport */ FORMATTER_NAMES),
   e7: () => (/* reexport */ FRAMEWORK_DEPS),
+  At: () => (/* reexport */ LINTER_NAMES),
   Ab: () => (/* reexport */ PACKAGE_MANAGERS),
   pm: () => (/* reexport */ QUALITY_PRESETS),
   s_: () => (/* reexport */ RSHONO_RANGE),
   RM: () => (/* reexport */ TOOL_VERSIONS),
-  Jh: () => (/* reexport */ buildPackageJson),
+  dh: () => (/* reexport */ conflictingEntries),
   P8: () => (/* reexport */ deployHint),
   Lv: () => (/* reexport */ detectPackageManager),
-  WL: () => (/* reexport */ inspectTarget),
-  p1: () => (/* reexport */ isDeployTarget),
   eW: () => (/* reexport */ isValidPackageName),
   VZ: () => (/* reexport */ packageManager),
   et: () => (/* reexport */ plan_plan),
@@ -77,9 +77,88 @@ __webpack_require__.d(__webpack_exports__, {
     ] : [];
 }
 
+;// CONCATENATED MODULE: ./src/scripts.ts
+// `features/types.js` rather than `features/index.js`: the deploy feature imports `invoke` from here, and
+// going through the barrel would make that a cycle — types.ts imports nothing.
+/**
+ * The scripts every app gets, whatever it targets.
+ *
+ * `start`, `preview` and `deploy` are deliberately not here: each one means something different per
+ * platform, so the deploy target contributes its own. The three names are a contract the targets keep,
+ * and the reason the README can describe an app it was not written for:
+ *
+ * - **`start`** runs a build that already exists and never makes one — what a host's own start command
+ *   calls. Only the target whose build is a server has one.
+ * - **`preview`** builds, then runs the result here — for the targets where that is not the same two
+ *   commands, because otherwise the production build is unanswerable without deploying it.
+ * - **`deploy`** builds, then ships it — where the platform has one command that does the shipping.
+ */ const BASE_SCRIPTS = {
+    dev: 'rshono dev',
+    build: 'rshono build',
+    typecheck: 'tsc --noEmit'
+};
+/**
+ * Every script the app gets, in the order they are written: the base ones, then each feature's, in the order
+ * the features were selected. The manifest and the README's command table are both this, so neither can
+ * document a script the other does not have.
+ */ function buildScripts(features) {
+    const scripts = {
+        ...BASE_SCRIPTS
+    };
+    for (const feature of features)Object.assign(scripts, feature.scripts);
+    return scripts;
+}
+/** The gloss for each base script, in the README's command table. `build` names the target it is for. */ function baseScriptHelp(deploy) {
+    return {
+        dev: 'dev server with HMR, http://localhost:3000',
+        build: `production build for ${deploy}`,
+        typecheck: 'tsc --noEmit'
+    };
+}
+/**
+ * Script names a package manager has a command of its own for. `pnpm deploy` runs pnpm's workspace-deploy
+ * command and never looks at the manifest, so printing it would hand somebody a line that quietly does
+ * something else. The explicit `run` form is what all four managers accept, so those names get it.
+ */ const SHADOWED = new Set([
+    'deploy'
+]);
+/** How to type one of the app's scripts with this package manager — `pnpm dev`, but `npm run dev`. */ function invoke(pm, script) {
+    return `${SHADOWED.has(script) ? `${pm.name} run` : pm.run} ${script}`;
+}
+/**
+ * The README's command table: one line per script, with the command to type and a one-line gloss.
+ *
+ * A script whose feature supplies no `scriptHelp` is left out and covered by the "package.json has the
+ * rest" line — that is how a formatter's `format:check` stays out of a table about running the app.
+ */ function scriptTable(answers, features, pm) {
+    const help = baseScriptHelp(answers.deploy);
+    for (const feature of features)Object.assign(help, feature.scriptHelp);
+    const documented = Object.keys(buildScripts(features)).filter((name)=>help[name]);
+    const width = Math.max(...documented.map((name)=>invoke(pm, name).length));
+    return documented.map((name)=>`${invoke(pm, name).padEnd(width)}  # ${help[name]}`).join('\n');
+}
+/**
+ * The command that gets this app into production, as a sentence — the README's deploy step, and the same
+ * choice the closing summary makes, so the two cannot name different commands.
+ *
+ * Read off the scripts rather than the target, so a target that gains a `deploy` gains the sentence with it.
+ * `start` is the answer where there is no `deploy`: it ships nothing itself, but it is what the host runs.
+ */ function deployStep(features, pm) {
+    const scripts = buildScripts(features);
+    if (scripts.deploy) return `\`${invoke(pm, 'deploy')}\` does the build and the upload in one step.`;
+    if (scripts.start) return `\`${invoke(pm, 'start')}\` runs that build wherever you host it, and never makes one.`;
+    // Every branch names a script the app has, so a target that contributes none of the three still reads true.
+    if (scripts.preview) return `\`${invoke(pm, 'preview')}\` runs the build here, so you can check it first.`;
+    return `\`${invoke(pm, 'build')}\` produces it; getting it there is yours to script.`;
+}
+
 ;// CONCATENATED MODULE: ./src/generated/framework.ts
 // GENERATED by scripts/codegen.mjs from packages/core — do not edit. Run `pnpm --filter @rshono/create codegen`.
-/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.1';
+/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.11';
+/**
+ * The Node range rshono itself declares, restated in every scaffolded app's `engines` — so a CI image
+ * or a contributor on an older Node hears it from their package manager rather than from a stack trace.
+ */ const NODE_ENGINE = '>=22.18.0';
 /**
  * The dependency versions rshono is tested against, copied from its own manifest. Exact where it is
  * exact — React's RSC internals are coupled across builds, and a generated app has no workspace
@@ -101,22 +180,10 @@ __webpack_require__.d(__webpack_exports__, {
         name: 'cloudflare',
         hint: 'deploy with `wrangler deploy`'
     },
-    {
-        name: 'bun',
-        hint: 'run `bun dist/server/main.mjs`'
-    },
-    {
-        name: 'deno',
-        hint: 'run `deno serve -A dist/server/main.mjs`'
-    },
     {
         name: 'vercel',
         hint: 'deploy with `vercel deploy --prebuilt`'
     },
-    {
-        name: 'netlify',
-        hint: 'deploy with `netlify deploy --build=false --dir=.netlify/publish`'
-    },
     {
         name: 'aws-lambda',
         hint: 'zip dist/ with the handler at dist/server/main.mjs'
@@ -125,7 +192,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 ;// CONCATENATED MODULE: ./src/versions.ts
 
-
+/** Passed straight through, so everything generated from the framework reaches the rest of the package here. */ 
 /** The framework range a scaffolded app gets. The two packages are released together, so this is ours. */ const RSHONO_RANGE = `^${RSHONO_VERSION}`;
 /**
  * Versions for the optional tooling the features can add — the one place in this package where a
@@ -156,12 +223,11 @@ __webpack_require__.d(__webpack_exports__, {
 };
 /**
  * The TypeScript an ESLint app pins, in place of the framework's own — the one deliberate exception to
- * {@link FRAMEWORK_DEPS}, and the reason it is spelled out here.
+ * {@link FRAMEWORK_DEPS}.
  *
- * typescript-eslint reads TypeScript's compiler API directly rather than through a stable interface, so
- * it accepts `typescript >=4.8.4 <6.1.0` and nothing above. `~6.0.3` is the newest that satisfies it:
- * patch releases of 6.0, no minor. The framework itself stays on the TypeScript it is tested against —
- * rshono's declarations compile the same under either, which is what makes this pin an app's business
+ * typescript-eslint reads TypeScript's compiler API directly rather than through a stable interface,
+ * so it accepts `typescript >=4.8.4 <6.1.0` and nothing above; `~6.0.3` is the newest that satisfies
+ * it. rshono's declarations compile the same under either, which is what makes this an app's business
  * and not the framework's.
  *
  * When upstream widens the range, this constant and the ESLint feature's use of it are what to delete.
@@ -169,88 +235,128 @@ __webpack_require__.d(__webpack_exports__, {
 
 ;// CONCATENATED MODULE: ./src/features/deploy.ts
 
+
 /**
- * What a deploy target adds beyond the `deploy` line in `rshono.config.ts` — which is the build's job
- * to read, and the template's to carry.
+ * What a deploy target adds beyond the `deploy` line in `rshono.config.ts`, which the template carries.
  *
- * Deliberately thin. The framework already knows how to arrange its own output for every platform, and
- * `rshono build` writes the one platform config that has to exist (`wrangler.jsonc`, with the
- * `compatibility_date` of the day it ran) if the project has none. Generating a second copy here would
- * be a copy that goes stale. So a target contributes a `deploy` script, the CLI it needs locally, and
- * the build artefacts its platform leaves in the project.
- */ const DEPLOY_FEATURES = {
-    // Where a Node build goes from here is a Dockerfile or a process manager, neither of which this can
-    // guess — so the target contributes only the command that runs what was built.
-    node: {
-        id: 'deploy-node',
-        scripts: {
-            start: 'rshono start'
-        }
-    },
-    // `rshono start` is the Node target's launcher and refuses a build made for another platform, so
-    // these two get the command their own runtime uses under the same script name.
-    bun: {
-        id: 'deploy-bun',
-        scripts: {
-            start: 'bun dist/server/main.mjs'
-        }
-    },
-    deno: {
-        id: 'deploy-deno',
-        scripts: {
-            start: 'deno serve -A dist/server/main.mjs'
-        }
-    },
-    cloudflare: {
-        id: 'deploy-cloudflare',
-        devDependencies: {
-            wrangler: TOOL_VERSIONS.wrangler
-        },
-        // wrangler brings workerd, whose install script only picks the platform binary out of the optional
-        // dependency that already carries it — `workerd --version` answers without it having run.
-        allowBuilds: {
-            workerd: false
-        },
-        scripts: {
-            deploy: 'rshono build && wrangler deploy'
+ * Deliberately thin: the framework arranges its own output for every platform, and `rshono build`
+ * writes the one platform config that has to exist (`wrangler.jsonc`) if the project has none — a second
+ * copy generated here would only go stale. So a target contributes the commands that run and ship the
+ * build, the CLI they need, the directories to gitignore, and a note for the step no command covers.
+ *
+ * What the three script names promise is documented once, above `BASE_SCRIPTS` in `scripts.ts`. Only `node`
+ * has a `start`, because `rshono start` refuses a bundle built for anywhere else, and it needs no `preview`:
+ * `build` then `start` already is one.
+ *
+ * `pm` is here because two things have to be spelled for the app's package manager — the runner that fetches
+ * the uninstalled Vercel CLI ({@link PackageManager.dlx}), and every command in {@link Feature.platformSetup}.
+ */ function deployFeatures(pm) {
+    const build = invoke(pm, 'build');
+    return {
+        // Where a Node build goes from here is a Dockerfile or a process manager, neither of which this can
+        // guess — so the target contributes only the command that runs what was built.
+        node: {
+            id: 'deploy-node',
+            scripts: {
+                start: 'rshono start'
+            },
+            scriptHelp: {
+                start: 'run the build that exists — what your host calls'
+            },
+            platformSetup: [
+                'The two commands a host asks for:',
+                '',
+                `- **Build** — \`${pm.name} install && ${build}\``,
+                `- **Start** — \`${invoke(pm, 'start')}\``,
+                '',
+                `In a Dockerfile, the same pair: \`RUN ${build}\`, then \`CMD ["${pm.name}", "start"]\`.`
+            ].join('\n')
         },
-        gitignore: [
-            '.wrangler/'
-        ],
-        notes: [
-            'The first build writes wrangler.jsonc — yours to edit after that.'
-        ]
-    },
-    vercel: {
-        id: 'deploy-vercel',
-        scripts: {
-            deploy: 'rshono build && vercel deploy --prebuilt'
+        cloudflare: {
+            id: 'deploy-cloudflare',
+            devDependencies: {
+                wrangler: TOOL_VERSIONS.wrangler
+            },
+            // The only two install scripts a scaffolded app can end up with, and wrangler brings both. Each
+            // one merely picks the platform binary out of the optional dependency that already carries it, so
+            // neither needs to run — `workerd --version` and `esbuild --version` both answer without it.
+            allowBuilds: {
+                esbuild: false,
+                workerd: false
+            },
+            // `wrangler dev` is the one preview that runs the code in the runtime it will actually run in:
+            // workerd, not Node, serving the assets the build assembled. Both scripts read the wrangler.jsonc the
+            // build wrote, so nothing here has to know where the bundle or the assets went.
+            scripts: {
+                preview: 'rshono build && wrangler dev',
+                deploy: 'rshono build && wrangler deploy'
+            },
+            scriptHelp: {
+                preview: 'build, then run it in workerd — port 8787',
+                deploy: 'build, then ship it to Cloudflare'
+            },
+            gitignore: [
+                '.wrangler/'
+            ],
+            notes: [
+                'The first build writes wrangler.jsonc — yours to edit after that.'
+            ],
+            platformSetup: [
+                `Building from a git repo instead: set Workers Builds' **Build command** to \`${build}\`.`,
+                'Its deploy command already defaults to `npx wrangler deploy`, and it installs dependencies itself.'
+            ].join('\n')
         },
-        gitignore: [
-            '.vercel/'
-        ],
-        notes: [
-            '--prebuilt uploads what rshono build assembled; the platform must not rebuild it.'
-        ]
-    },
-    netlify: {
-        id: 'deploy-netlify',
-        scripts: {
-            deploy: 'rshono build && netlify deploy --build=false --dir=.netlify/publish'
+        vercel: {
+            id: 'deploy-vercel',
+            // `--prod` because the script is called `deploy`: without it the CLI uploads to a throwaway preview
+            // URL, which is a useful thing to have but not what the word means. The local `preview` is a Node
+            // build run here — the platform has no way to run its own prebuilt output on your machine.
+            scripts: {
+                preview: 'rshono build --deploy node && rshono start',
+                deploy: `rshono build && ${pm.dlx} vercel deploy --prebuilt --prod`
+            },
+            scriptHelp: {
+                preview: 'build for Node and run that here',
+                deploy: 'build, then upload it to production'
+            },
+            gitignore: [
+                '.vercel/'
+            ],
+            notes: [
+                '--prebuilt uploads what rshono build assembled; the platform must not rebuild it.',
+                'Drop --prod from the deploy script for a preview URL instead.'
+            ],
+            platformSetup: [
+                `Deploying from CI instead: the same \`${invoke(pm, 'deploy')}\`, with \`VERCEL_ORG_ID\`, \`VERCEL_PROJECT_ID\``,
+                'and a CLI token in the environment.',
+                '',
+                `If you let Vercel build the repo itself, set **Framework Preset** to Other — \`hono\` is otherwise`,
+                `detected as the Hono preset — and **Build Command** to \`${build}\`.`
+            ].join('\n')
         },
-        gitignore: [
-            '.netlify/'
-        ]
-    },
-    'aws-lambda': {
-        id: 'deploy-aws-lambda',
-        notes: [
-            'Use a Function URL in RESPONSE_STREAM mode — a buffered invoke mode drops the streaming.'
-        ]
-    }
-};
-function deployFeature(target) {
-    return DEPLOY_FEATURES[target];
+        'aws-lambda': {
+            id: 'deploy-aws-lambda',
+            // No CLI to wrap, and no upload this could guess at. `preview` still applies — the bundle is a Node
+            // handler, so it runs here.
+            scripts: {
+                preview: 'rshono build --deploy node && rshono start'
+            },
+            scriptHelp: {
+                preview: 'build for Node and run that here'
+            },
+            notes: [
+                'Use a Function URL in RESPONSE_STREAM mode — a buffered invoke mode drops the streaming.'
+            ],
+            platformSetup: [
+                `There is no settings page here; the upload is yours to script. A job needs \`${pm.name} install && ${build}\`,`,
+                'then the function package: `dist/`, plus `node_modules` for any dependency of your own, which the server',
+                'bundle leaves external.'
+            ].join('\n')
+        }
+    };
+}
+function deployFeature(target, pm) {
+    return deployFeatures(pm)[target];
 }
 
 ;// CONCATENATED MODULE: ./src/features/quality.ts
@@ -260,8 +366,10 @@ function deployFeature(target) {
  * deduplicates by `id`, so `formatter: 'biome', linter: 'biome'` contributes one set of files, one
  * dependency and one pair of scripts.
  *
- * Each tool brings its own `check` script alongside `format`/`lint`, because the writing half and the
- * CI half want different exit-code behaviour: `format` rewrites files, `check` fails instead.
+ * A formatter brings `format:check` beside `format`, because the writing half and the CI half want
+ * different exit-code behaviour: `format` rewrites files, `format:check` fails instead. A linter brings
+ * `lint:fix` beside `lint`, for the same reason in the other direction — `lint` is already the failing
+ * one. Biome adds a `check` of its own, which is the pair of them in a single pass.
  */ const PRETTIER = {
     id: 'prettier',
     overlays: [
@@ -302,12 +410,11 @@ const OXLINT = {
     }
 };
 /**
- * The one feature that changes a dependency the framework otherwise decides: typescript-eslint cannot be
- * installed alongside the TypeScript rshono is tested against, so an ESLint app pins the newest one its
- * peer range accepts (see {@link ESLINT_TYPESCRIPT}). Every other preset leaves TypeScript alone.
- *
- * The rules are type-aware, which is the reason to reach for ESLint over a syntax-only linter at all —
- * so the config it ships hands the whole program to the parser rather than linting file by file.
+ * The one feature that changes a dependency the framework otherwise decides: typescript-eslint cannot
+ * be installed alongside the TypeScript rshono is tested against, so an ESLint app pins the newest one
+ * its peer range accepts (see {@link ESLINT_TYPESCRIPT}). Its rules are type-aware — the reason to
+ * reach for ESLint over a syntax-only linter — so the config it ships hands the parser the whole
+ * program rather than linting file by file.
  */ const ESLINT = {
     id: 'eslint',
     overlays: [
@@ -363,14 +470,13 @@ function linterFeature(linter) {
 ;// CONCATENATED MODULE: ./src/features/styling.ts
 
 /**
- * Tailwind is a PostCSS plugin and nothing more, which is the whole of this feature: four packages, and
- * an overlay carrying the `postcss.config.mjs` naming the plugin, an `rshono.config.ts` whose `rspack`
- * hook puts postcss-loader in front of the CSS parser, a Tailwind entry stylesheet, and the two views
- * written in utilities instead of classes of their own.
+ * Tailwind is a PostCSS plugin and nothing more, which is the whole of this feature: four packages,
+ * plus an overlay carrying `postcss.config.mjs`, an `rshono.config.ts` whose `rspack` hook puts
+ * postcss-loader in front of the CSS parser, a Tailwind entry stylesheet, and the two views rewritten
+ * in utilities.
  *
  * `postcss` and `postcss-loader` are the app's dependencies rather than the framework's — rshono
- * compiles CSS natively and has no PostCSS in it, so an app that does not want a plugin chain does not
- * install one.
+ * compiles CSS natively, so an app that does not want a plugin chain does not install one.
  */ const TAILWIND = {
     id: 'tailwind',
     overlays: [
@@ -396,9 +502,12 @@ function stylingFeature(styling) {
  * The features a set of answers selects, in application order — so an overlay listed later wins a file
  * both of them ship. Deduplicated by `id`, which is what lets one feature answer two questions (Biome
  * is both the formatter and the linter) without contributing twice.
- */ function selectFeatures(answers) {
+ *
+ * `pm` reaches the deploy target because one script has to name the runner that fetches an uninstalled
+ * CLI; nothing else here depends on which package manager the app is for.
+ */ function selectFeatures(answers, pm) {
     const selected = [
-        deployFeature(answers.deploy),
+        deployFeature(answers.deploy, pm),
         stylingFeature(answers.styling),
         formatterFeature(answers.formatter),
         linterFeature(answers.linter),
@@ -416,6 +525,22 @@ function stylingFeature(styling) {
 
 ;// CONCATENATED MODULE: ./src/options.ts
 
+/*
+ * The names each option accepts, spelled once. The types below are derived from them, the CLI validates
+ * its flags against them and prints them in `--help`, and `pm.ts` recognises a package manager by them
+ * — so a name added here reaches all three without a second list to remember.
+ */ const FORMATTER_NAMES = [
+    'prettier',
+    'biome',
+    'oxfmt',
+    'none'
+];
+const LINTER_NAMES = [
+    'oxlint',
+    'eslint',
+    'biome',
+    'none'
+];
 const PACKAGE_MANAGERS = [
     'npm',
     'pnpm',
@@ -426,9 +551,6 @@ const DEPLOY_TARGET_NAMES = DEPLOY_TARGETS.map((target)=>target.name);
 function deployHint(name) {
     return DEPLOY_TARGETS.find((target)=>target.name === name)?.hint ?? '';
 }
-function isDeployTarget(value) {
-    return DEPLOY_TARGET_NAMES.includes(value);
-}
 const QUALITY_PRESETS = [
     {
         id: 'prettier-oxlint',
@@ -486,16 +608,13 @@ const QUALITY_PRESETS = [
     return /^(?:@[a-z\d\-*~][a-z\d\-*._~]*\/)?[a-z\d\-~][a-z\d\-._~]*$/.test(name) && name.length <= 214;
 }
 
+;// CONCATENATED MODULE: external "node:fs"
+
+;// CONCATENATED MODULE: external "node:path"
+
 ;// CONCATENATED MODULE: ./src/pkg.ts
 
-/**
- * The scripts every app gets. `start` is not among them: it is the *Node* launcher, and the deploy
- * features each contribute the command their own platform runs what was built with.
- */ const BASE_SCRIPTS = {
-    dev: 'rshono dev',
-    build: 'rshono build',
-    typecheck: 'tsc --noEmit'
-};
+
 /** Field order in the emitted file — the conventional reading order, and stable so snapshots are too. */ const FIELD_ORDER = [
     'name',
     'version',
@@ -511,48 +630,35 @@ function sorted(record) {
     return Object.fromEntries(Object.entries(record).sort(([a], [b])=>a < b ? -1 : 1));
 }
 /**
- * The install script every app inherits, from the framework rather than from anything it chose. tsx
- * reads `rshono.config.ts` through esbuild, and esbuild's script only picks the platform binary out of
- * the optional dependency that already carries it — rshono's own repo denies it for the same reason.
- */ const BASE_ALLOW_BUILDS = {
-    esbuild: false
-};
-/**
- * pnpm's settings for the new app — written for pnpm and for nobody else.
+ * pnpm's settings for the new app, written only when a feature has something to put in them. `null`
+ * means there is nothing to say, so no file is written.
  *
- * It exists for one field. A dependency with an install script is a question pnpm will not answer on its
- * own: it fails the install, and fails every `pnpm dev` after it, until the project has said whether the
- * script should run. None of the ones an rshono app inherits need to (each is a native package whose
- * binary arrives as an optional dependency), so a fresh app carries the answer rather than meeting
- * `pnpm approve-builds` before it has rendered a page once.
+ * It exists for one field, `allowBuilds`. pnpm fails an install — and every `pnpm dev` after it —
+ * until the project has said whether a dependency's install script should run. Nothing rshono itself
+ * installs has one, so most apps get no file; the packages that do (wrangler's esbuild and workerd)
+ * declare their answer on the feature that brings them.
  *
- * In this file rather than under a `pnpm` key in `package.json`, which pnpm 11 no longer reads, single-
- * package projects included. What lands here is a decision about *this* app: a scaffolded file the app
- * owns from then on, not something the framework reaches back into.
+ * A file rather than a `pnpm` key in `package.json`, which pnpm 11 no longer reads.
  */ function buildPnpmSettings(features) {
-    const allowBuilds = {
-        ...BASE_ALLOW_BUILDS
-    };
+    const allowBuilds = {};
     for (const feature of features)Object.assign(allowBuilds, feature.allowBuilds);
+    const entries = Object.entries(sorted(allowBuilds));
+    if (entries.length === 0) return null;
     return [
         '# Which dependencies may run an install script. pnpm runs none it has not been told about, and',
         '# fails the install rather than skip one quietly — so anything added later belongs here too.',
         '# `false` means the script was looked at: these ship their real binary as an optional dependency.',
         'allowBuilds:',
-        ...Object.entries(sorted(allowBuilds)).map(([name, allowed])=>`  ${name}: ${allowed}`),
+        ...entries.map(([name, allowed])=>`  ${name}: ${allowed}`),
         ''
     ].join('\n');
 }
 /**
  * Assembles `package.json` from the answers and whatever the selected features contribute.
  *
- * Dependencies are sorted by name and scripts are left in contribution order (the base ones, then each
- * feature's, in the order features were selected) — so two runs with the same answers produce byte-
- * identical output, which is what makes the generated manifest snapshot-testable.
+ * Dependencies are sorted by name and scripts keep the order {@link buildScripts} gives them — so two runs
+ * with the same answers produce byte-identical output, which is what makes the manifest snapshot-testable.
  */ function buildPackageJson(answers, features, pm) {
-    const scripts = {
-        ...BASE_SCRIPTS
-    };
     const dependencies = {
         '@rshono/core': RSHONO_RANGE,
         hono: FRAMEWORK_DEPS.hono,
@@ -565,7 +671,6 @@ function sorted(record) {
         typescript: FRAMEWORK_DEPS.typescript
     };
     for (const feature of features){
-        Object.assign(scripts, feature.scripts);
         Object.assign(dependencies, feature.dependencies);
         Object.assign(devDependencies, feature.devDependencies);
     }
@@ -574,12 +679,11 @@ function sorted(record) {
         version: '0.1.0',
         private: true,
         type: 'module',
-        // The floor the framework declares. Stated here too so a CI image or a contributor on an older
-        // Node finds out from their package manager rather than from a stack trace.
+        // Generated from the framework's own manifest, so the app's floor cannot drift below rshono's.
         engines: {
-            node: '>=22.1.0'
+            node: NODE_ENGINE
         },
-        scripts,
+        scripts: buildScripts(features),
         dependencies: sorted(dependencies),
         devDependencies: sorted(devDependencies)
     };
@@ -593,25 +697,27 @@ function sorted(record) {
     return `${JSON.stringify(ordered, null, 2)}\n`;
 }
 
-;// CONCATENATED MODULE: external "node:fs"
-
-;// CONCATENATED MODULE: external "node:path"
-
 ;// CONCATENATED MODULE: ./src/render.ts
 
-const TOKEN_PATTERN = /__[A-Z][A-Z\d_]*__/g;
-function tokensFor(answers, pm) {
+/**
+ * `{{NAME}}`, deliberately not `__NAME__`: templates are real files that real tools run over, and in
+ * markdown `__NAME__` *is* strong emphasis — Prettier rewrites it to `**NAME**` and the token stops
+ * matching. `{{…}}` means nothing to any format these templates are written in.
+ */ const TOKEN_PATTERN = /\{\{[A-Z][A-Z\d_]*\}\}/g;
+function tokensFor(answers, features, pm) {
     return {
-        __PROJECT_NAME__: answers.packageName,
-        __DEPLOY_TARGET__: answers.deploy,
-        __DEPLOY_HINT__: deployHint(answers.deploy),
-        __PM__: pm.name,
-        __PM_RUN__: pm.run
+        '{{PROJECT_NAME}}': answers.packageName,
+        '{{DEPLOY_TARGET}}': answers.deploy,
+        // Derived from the features rather than the answers, because all three are about the scripts the app
+        // actually got: its command table, the one command that ships it, and what its platform asks for.
+        '{{SCRIPT_TABLE}}': scriptTable(answers, features, pm),
+        '{{DEPLOY_STEP}}': deployStep(features, pm),
+        '{{PLATFORM_SETUP}}': features.map((feature)=>feature.platformSetup ?? '').join('')
     };
 }
 /**
  * Substitutes tokens, and throws on one it doesn't know — a typo in a template would otherwise ship a
- * literal `__PORJECT_NAME__` into somebody's new app, which no test of the generator's logic would
+ * literal `{{PORJECT_NAME}}` into somebody's new app, which no test of the generator's logic would
  * catch.
  */ function render(contents, tokens, source) {
     return contents.replace(TOKEN_PATTERN, (token)=>{
@@ -644,10 +750,9 @@ function readTemplateDir(dir) {
 /**
  * `_gitignore` → `.gitignore`, and so on for every dotfile.
  *
- * npm strips a literal `.gitignore` out of a published tarball, so a template cannot simply contain
- * one — the file would exist in the repo, pass every local test, and be missing from the package
- * everybody actually installs. Naming them with an underscore and renaming here is the long-standing
- * fix. It applies to the basename only, so `src/lib/_x.ts` is a dotfile but `templates/_x/y.ts` is not.
+ * npm strips a literal `.gitignore` out of a published tarball, so a template cannot contain one — it
+ * would exist in the repo, pass every local test, and be missing from the package everybody installs.
+ * Applies to the basename only, so `src/lib/_x.ts` is a dotfile but `templates/_x/y.ts` is not.
  */ function undotted(path) {
     const segments = path.split(posix.sep);
     const name = segments.pop();
@@ -670,8 +775,8 @@ function readTemplateDir(dir) {
  * decisions and the I/O are separated so the whole matrix of answers can be asserted on in a test, and
  * so `--dry-run` is the same code path minus the last step.
  */ function plan_plan(answers, pm) {
-    const features = selectFeatures(answers);
-    const tokens = tokensFor(answers, pm);
+    const features = selectFeatures(answers, pm);
+    const tokens = tokensFor(answers, features, pm);
     const raw = readTemplateDir(join(TEMPLATES_DIR, 'base'));
     for (const feature of features){
         for (const overlay of feature.overlays ?? []){
@@ -687,7 +792,9 @@ function readTemplateDir(dir) {
     const gitignore = files.get('.gitignore');
     if (gitignore) files.set('.gitignore', appendGitignore(gitignore, features));
     files.set('package.json', buildPackageJson(answers, features, pm));
-    if (pm.name === 'pnpm') files.set('pnpm-workspace.yaml', buildPnpmSettings(features));
+    // Only for pnpm, and only when a feature brought an install script to answer for — see `buildPnpmSettings`.
+    const pnpmSettings = pm.name === 'pnpm' ? buildPnpmSettings(features) : null;
+    if (pnpmSettings) files.set('pnpm-workspace.yaml', pnpmSettings);
     return {
         // Sorted, so both the write order and a test's snapshot are stable.
         files: new Map([
@@ -702,6 +809,7 @@ function readTemplateDir(dir) {
 
 ;// CONCATENATED MODULE: ./src/pm.ts
 
+
 const INSTALL = {
     npm: [
         'install'
@@ -720,20 +828,27 @@ const RUN = {
     yarn: 'yarn',
     bun: 'bun'
 };
+const DLX = {
+    npm: 'npx',
+    pnpm: 'pnpm dlx',
+    yarn: 'yarn dlx',
+    bun: 'bunx'
+};
 function isKnown(name) {
-    return name === 'npm' || name === 'pnpm' || name === 'yarn' || name === 'bun';
+    return PACKAGE_MANAGERS.includes(name);
 }
 function packageManager(name, version) {
     return {
         name,
         version,
         install: INSTALL[name],
-        run: RUN[name]
+        run: RUN[name],
+        dlx: DLX[name]
     };
 }
 /**
- * Which package manager invoked us. Every one of them sets `npm_config_user_agent` for the process it
- * spawns — `pnpm/11.9.0 npm/? node/v22.14.0 darwin arm64` — so `pnpm create @rshono` scaffolds a pnpm
+ * Which package manager invoked us. Every one of them sets `npm_config_user_agent` on the process it
+ * spawns — `pnpm/11.9.0 npm/? node/v22.14.0 darwin arm64` — so `pnx @rshono/create` scaffolds a pnpm
  * project without asking, and the exact version comes along for the `packageManager` field.
  *
  * Falls back to npm, which is also what a bare `node bin/create-rshono.mjs` gets.
@@ -750,12 +865,6 @@ function packageManager(name, version) {
  */ function runInstall(pm, cwd) {
     return run(pm, pm.install, cwd);
 }
-/** `<pm> run <script>` — the one form every package manager accepts, Yarn v1 included. */ function runScript(pm, script, cwd) {
-    return run(pm, [
-        'run',
-        script
-    ], cwd);
-}
 function run(pm, args, cwd) {
     const result = spawnSync(pm.name, args, {
         cwd,
@@ -778,15 +887,20 @@ function run(pm, args, cwd) {
     '.vscode',
     'Thumbs.db'
 ]);
-function inspectTarget(dir) {
-    if (!existsSync(dir)) return {
-        exists: false,
-        conflicts: []
-    };
-    return {
-        exists: true,
-        conflicts: readdirSync(dir).filter((entry)=>!IGNORED_ENTRIES.has(entry))
-    };
+/**
+ * What is already at the target path, ignoring the entries a fresh clone or an editor leaves behind —
+ * which is what decides whether scaffolding into it is safe.
+ *
+ * A path that does not exist yet is no conflict. A path that exists and is *not* a directory throws
+ * rather than reporting an empty list, since `--force` should not write into one either — otherwise
+ * `create-rshono README.md` gets as far as `mkdir` before failing on a raw ENOTDIR.
+ */ function conflictingEntries(dir) {
+    const stats = statSync(dir, {
+        throwIfNoEntry: false
+    });
+    if (!stats) return [];
+    if (!stats.isDirectory()) throw new Error(`${dir} already exists and is not a directory.`);
+    return readdirSync(dir).filter((entry)=>!IGNORED_ENTRIES.has(entry));
 }
 /**
  * Writes the plan. Directories are created as needed, and files are written with the plan's own
@@ -808,7 +922,16 @@ function inspectTarget(dir) {
 /**
  * The generator without the CLI around it: answers in, the exact set of files out. This is what the
  * test suite asserts on — the whole matrix of options, in memory, with no directory to clean up — and
- * what another tool would call to scaffold an app itself.
+ * what another tool would call to scaffold an app itself:
+ *
+ * ```ts
+ * import { packageManager, plan, writePlan } from '@rshono/create';
+ *
+ * const answers = { packageName: 'my-app', deploy: 'node', styling: 'css', formatter: 'prettier', linter: 'oxlint' };
+ * writePlan(plan(answers, packageManager('npm')), './my-app');
+ * ```
+ *
+ * `package.json` is assembled inside `plan`, so nothing here needs to be composed by hand.
  *
  * @packageDocumentation
  */ 
@@ -818,23 +941,22 @@ function inspectTarget(dir) {
 
 
 
-
 var __webpack_exports__DEPLOY_TARGET_NAMES = __webpack_exports__.bp;
 var __webpack_exports__ESLINT_TYPESCRIPT = __webpack_exports__.ml;
+var __webpack_exports__FORMATTER_NAMES = __webpack_exports__.wC;
 var __webpack_exports__FRAMEWORK_DEPS = __webpack_exports__.e7;
+var __webpack_exports__LINTER_NAMES = __webpack_exports__.At;
 var __webpack_exports__PACKAGE_MANAGERS = __webpack_exports__.Ab;
 var __webpack_exports__QUALITY_PRESETS = __webpack_exports__.pm;
 var __webpack_exports__RSHONO_RANGE = __webpack_exports__.s_;
 var __webpack_exports__TOOL_VERSIONS = __webpack_exports__.RM;
-var __webpack_exports__buildPackageJson = __webpack_exports__.Jh;
+var __webpack_exports__conflictingEntries = __webpack_exports__.dh;
 var __webpack_exports__deployHint = __webpack_exports__.P8;
 var __webpack_exports__detectPackageManager = __webpack_exports__.Lv;
-var __webpack_exports__inspectTarget = __webpack_exports__.WL;
-var __webpack_exports__isDeployTarget = __webpack_exports__.p1;
 var __webpack_exports__isValidPackageName = __webpack_exports__.eW;
 var __webpack_exports__packageManager = __webpack_exports__.VZ;
 var __webpack_exports__plan = __webpack_exports__.et;
 var __webpack_exports__selectFeatures = __webpack_exports__.N7;
 var __webpack_exports__toPackageName = __webpack_exports__.PQ;
 var __webpack_exports__writePlan = __webpack_exports__.pD;
-export { __webpack_exports__DEPLOY_TARGET_NAMES as DEPLOY_TARGET_NAMES, __webpack_exports__ESLINT_TYPESCRIPT as ESLINT_TYPESCRIPT, __webpack_exports__FRAMEWORK_DEPS as FRAMEWORK_DEPS, __webpack_exports__PACKAGE_MANAGERS as PACKAGE_MANAGERS, __webpack_exports__QUALITY_PRESETS as QUALITY_PRESETS, __webpack_exports__RSHONO_RANGE as RSHONO_RANGE, __webpack_exports__TOOL_VERSIONS as TOOL_VERSIONS, __webpack_exports__buildPackageJson as buildPackageJson, __webpack_exports__deployHint as deployHint, __webpack_exports__detectPackageManager as detectPackageManager, __webpack_exports__inspectTarget as inspectTarget, __webpack_exports__isDeployTarget as isDeployTarget, __webpack_exports__isValidPackageName as isValidPackageName, __webpack_exports__packageManager as packageManager, __webpack_exports__plan as plan, __webpack_exports__selectFeatures as selectFeatures, __webpack_exports__toPackageName as toPackageName, __webpack_exports__writePlan as writePlan };
+export { __webpack_exports__DEPLOY_TARGET_NAMES as DEPLOY_TARGET_NAMES, __webpack_exports__ESLINT_TYPESCRIPT as ESLINT_TYPESCRIPT, __webpack_exports__FORMATTER_NAMES as FORMATTER_NAMES, __webpack_exports__FRAMEWORK_DEPS as FRAMEWORK_DEPS, __webpack_exports__LINTER_NAMES as LINTER_NAMES, __webpack_exports__PACKAGE_MANAGERS as PACKAGE_MANAGERS, __webpack_exports__QUALITY_PRESETS as QUALITY_PRESETS, __webpack_exports__RSHONO_RANGE as RSHONO_RANGE, __webpack_exports__TOOL_VERSIONS as TOOL_VERSIONS, __webpack_exports__conflictingEntries as conflictingEntries, __webpack_exports__deployHint as deployHint, __webpack_exports__detectPackageManager as detectPackageManager, __webpack_exports__isValidPackageName as isValidPackageName, __webpack_exports__packageManager as packageManager, __webpack_exports__plan as plan, __webpack_exports__selectFeatures as selectFeatures, __webpack_exports__toPackageName as toPackageName, __webpack_exports__writePlan as writePlan };