@rshono/create 1.0.0-rc.1 → 1.0.0-rc.11

package/dist/cli.mjs

@@ -6,7 +6,7 @@ import { parseArgs, styleText as external_node_util_styleText } from "node:util"
 import node_process, { stdin as external_node_process_stdin, stdout as external_node_process_stdout } from "node:process";
 import node_readline from "node:readline";
 import "node:tty";
-import { existsSync as external_node_fs_existsSync, mkdirSync, readFileSync, readdirSync as external_node_fs_readdirSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, readdirSync as external_node_fs_readdirSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname as external_node_path_dirname, join as external_node_path_join, posix, relative as external_node_path_relative, resolve, sep } from "node:path";
 import { spawnSync } from "node:child_process";
 var __webpack_modules__ = ({
@@ -2943,7 +2943,11 @@ function hasGit(cwd) {
 
 ;// CONCATENATED MODULE: ./src/generated/framework.ts
 // GENERATED by scripts/codegen.mjs from packages/core — do not edit. Run `pnpm --filter @rshono/create codegen`.
-/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.1';
+/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.11';
+/**
+ * The Node range rshono itself declares, restated in every scaffolded app's `engines` — so a CI image
+ * or a contributor on an older Node hears it from their package manager rather than from a stack trace.
+ */ const NODE_ENGINE = '>=22.18.0';
 /**
  * The dependency versions rshono is tested against, copied from its own manifest. Exact where it is
  * exact — React's RSC internals are coupled across builds, and a generated app has no workspace
@@ -2965,22 +2969,10 @@ function hasGit(cwd) {
         name: 'cloudflare',
         hint: 'deploy with `wrangler deploy`'
     },
-    {
-        name: 'bun',
-        hint: 'run `bun dist/server/main.mjs`'
-    },
-    {
-        name: 'deno',
-        hint: 'run `deno serve -A dist/server/main.mjs`'
-    },
     {
         name: 'vercel',
         hint: 'deploy with `vercel deploy --prebuilt`'
     },
-    {
-        name: 'netlify',
-        hint: 'deploy with `netlify deploy --build=false --dir=.netlify/publish`'
-    },
     {
         name: 'aws-lambda',
         hint: 'zip dist/ with the handler at dist/server/main.mjs'
@@ -2989,19 +2981,32 @@ function hasGit(cwd) {
 
 ;// CONCATENATED MODULE: ./src/options.ts
 
-const PACKAGE_MANAGERS = (/* unused pure expression or super */ null && ([
+/*
+ * The names each option accepts, spelled once. The types below are derived from them, the CLI validates
+ * its flags against them and prints them in `--help`, and `pm.ts` recognises a package manager by them
+ * — so a name added here reaches all three without a second list to remember.
+ */ const FORMATTER_NAMES = [
+    'prettier',
+    'biome',
+    'oxfmt',
+    'none'
+];
+const LINTER_NAMES = [
+    'oxlint',
+    'eslint',
+    'biome',
+    'none'
+];
+const PACKAGE_MANAGERS = [
     'npm',
     'pnpm',
     'yarn',
     'bun'
-]));
+];
 const DEPLOY_TARGET_NAMES = DEPLOY_TARGETS.map((target)=>target.name);
 function deployHint(name) {
     return DEPLOY_TARGETS.find((target)=>target.name === name)?.hint ?? '';
 }
-function isDeployTarget(value) {
-    return DEPLOY_TARGET_NAMES.includes(value);
-}
 const QUALITY_PRESETS = [
     {
         id: 'prettier-oxlint',
@@ -3086,9 +3091,84 @@ const QUALITY_PRESETS = [
     ] : [];
 }
 
-;// CONCATENATED MODULE: ./src/versions.ts
+;// CONCATENATED MODULE: ./src/scripts.ts
+// `features/types.js` rather than `features/index.js`: the deploy feature imports `invoke` from here, and
+// going through the barrel would make that a cycle — types.ts imports nothing.
+/**
+ * The scripts every app gets, whatever it targets.
+ *
+ * `start`, `preview` and `deploy` are deliberately not here: each one means something different per
+ * platform, so the deploy target contributes its own. The three names are a contract the targets keep,
+ * and the reason the README can describe an app it was not written for:
+ *
+ * - **`start`** runs a build that already exists and never makes one — what a host's own start command
+ *   calls. Only the target whose build is a server has one.
+ * - **`preview`** builds, then runs the result here — for the targets where that is not the same two
+ *   commands, because otherwise the production build is unanswerable without deploying it.
+ * - **`deploy`** builds, then ships it — where the platform has one command that does the shipping.
+ */ const BASE_SCRIPTS = {
+    dev: 'rshono dev',
+    build: 'rshono build',
+    typecheck: 'tsc --noEmit'
+};
+/**
+ * Every script the app gets, in the order they are written: the base ones, then each feature's, in the order
+ * the features were selected. The manifest and the README's command table are both this, so neither can
+ * document a script the other does not have.
+ */ function buildScripts(features) {
+    const scripts = {
+        ...BASE_SCRIPTS
+    };
+    for (const feature of features)Object.assign(scripts, feature.scripts);
+    return scripts;
+}
+/** The gloss for each base script, in the README's command table. `build` names the target it is for. */ function baseScriptHelp(deploy) {
+    return {
+        dev: 'dev server with HMR, http://localhost:3000',
+        build: `production build for ${deploy}`,
+        typecheck: 'tsc --noEmit'
+    };
+}
+/**
+ * Script names a package manager has a command of its own for. `pnpm deploy` runs pnpm's workspace-deploy
+ * command and never looks at the manifest, so printing it would hand somebody a line that quietly does
+ * something else. The explicit `run` form is what all four managers accept, so those names get it.
+ */ const SHADOWED = new Set([
+    'deploy'
+]);
+/** How to type one of the app's scripts with this package manager — `pnpm dev`, but `npm run dev`. */ function invoke(pm, script) {
+    return `${SHADOWED.has(script) ? `${pm.name} run` : pm.run} ${script}`;
+}
+/**
+ * The README's command table: one line per script, with the command to type and a one-line gloss.
+ *
+ * A script whose feature supplies no `scriptHelp` is left out and covered by the "package.json has the
+ * rest" line — that is how a formatter's `format:check` stays out of a table about running the app.
+ */ function scriptTable(answers, features, pm) {
+    const help = baseScriptHelp(answers.deploy);
+    for (const feature of features)Object.assign(help, feature.scriptHelp);
+    const documented = Object.keys(buildScripts(features)).filter((name)=>help[name]);
+    const width = Math.max(...documented.map((name)=>invoke(pm, name).length));
+    return documented.map((name)=>`${invoke(pm, name).padEnd(width)}  # ${help[name]}`).join('\n');
+}
+/**
+ * The command that gets this app into production, as a sentence — the README's deploy step, and the same
+ * choice the closing summary makes, so the two cannot name different commands.
+ *
+ * Read off the scripts rather than the target, so a target that gains a `deploy` gains the sentence with it.
+ * `start` is the answer where there is no `deploy`: it ships nothing itself, but it is what the host runs.
+ */ function deployStep(features, pm) {
+    const scripts = buildScripts(features);
+    if (scripts.deploy) return `\`${invoke(pm, 'deploy')}\` does the build and the upload in one step.`;
+    if (scripts.start) return `\`${invoke(pm, 'start')}\` runs that build wherever you host it, and never makes one.`;
+    // Every branch names a script the app has, so a target that contributes none of the three still reads true.
+    if (scripts.preview) return `\`${invoke(pm, 'preview')}\` runs the build here, so you can check it first.`;
+    return `\`${invoke(pm, 'build')}\` produces it; getting it there is yours to script.`;
+}
 
+;// CONCATENATED MODULE: ./src/versions.ts
 
+/** Passed straight through, so everything generated from the framework reaches the rest of the package here. */ 
 /** The framework range a scaffolded app gets. The two packages are released together, so this is ours. */ const RSHONO_RANGE = `^${RSHONO_VERSION}`;
 /**
  * Versions for the optional tooling the features can add — the one place in this package where a
@@ -3119,12 +3199,11 @@ const QUALITY_PRESETS = [
 };
 /**
  * The TypeScript an ESLint app pins, in place of the framework's own — the one deliberate exception to
- * {@link FRAMEWORK_DEPS}, and the reason it is spelled out here.
+ * {@link FRAMEWORK_DEPS}.
  *
- * typescript-eslint reads TypeScript's compiler API directly rather than through a stable interface, so
- * it accepts `typescript >=4.8.4 <6.1.0` and nothing above. `~6.0.3` is the newest that satisfies it:
- * patch releases of 6.0, no minor. The framework itself stays on the TypeScript it is tested against —
- * rshono's declarations compile the same under either, which is what makes this pin an app's business
+ * typescript-eslint reads TypeScript's compiler API directly rather than through a stable interface,
+ * so it accepts `typescript >=4.8.4 <6.1.0` and nothing above; `~6.0.3` is the newest that satisfies
+ * it. rshono's declarations compile the same under either, which is what makes this an app's business
  * and not the framework's.
  *
  * When upstream widens the range, this constant and the ESLint feature's use of it are what to delete.
@@ -3132,88 +3211,128 @@ const QUALITY_PRESETS = [
 
 ;// CONCATENATED MODULE: ./src/features/deploy.ts
 
+
 /**
- * What a deploy target adds beyond the `deploy` line in `rshono.config.ts` — which is the build's job
- * to read, and the template's to carry.
+ * What a deploy target adds beyond the `deploy` line in `rshono.config.ts`, which the template carries.
  *
- * Deliberately thin. The framework already knows how to arrange its own output for every platform, and
- * `rshono build` writes the one platform config that has to exist (`wrangler.jsonc`, with the
- * `compatibility_date` of the day it ran) if the project has none. Generating a second copy here would
- * be a copy that goes stale. So a target contributes a `deploy` script, the CLI it needs locally, and
- * the build artefacts its platform leaves in the project.
- */ const DEPLOY_FEATURES = {
-    // Where a Node build goes from here is a Dockerfile or a process manager, neither of which this can
-    // guess — so the target contributes only the command that runs what was built.
-    node: {
-        id: 'deploy-node',
-        scripts: {
-            start: 'rshono start'
-        }
-    },
-    // `rshono start` is the Node target's launcher and refuses a build made for another platform, so
-    // these two get the command their own runtime uses under the same script name.
-    bun: {
-        id: 'deploy-bun',
-        scripts: {
-            start: 'bun dist/server/main.mjs'
-        }
-    },
-    deno: {
-        id: 'deploy-deno',
-        scripts: {
-            start: 'deno serve -A dist/server/main.mjs'
-        }
-    },
-    cloudflare: {
-        id: 'deploy-cloudflare',
-        devDependencies: {
-            wrangler: TOOL_VERSIONS.wrangler
-        },
-        // wrangler brings workerd, whose install script only picks the platform binary out of the optional
-        // dependency that already carries it — `workerd --version` answers without it having run.
-        allowBuilds: {
-            workerd: false
-        },
-        scripts: {
-            deploy: 'rshono build && wrangler deploy'
+ * Deliberately thin: the framework arranges its own output for every platform, and `rshono build`
+ * writes the one platform config that has to exist (`wrangler.jsonc`) if the project has none — a second
+ * copy generated here would only go stale. So a target contributes the commands that run and ship the
+ * build, the CLI they need, the directories to gitignore, and a note for the step no command covers.
+ *
+ * What the three script names promise is documented once, above `BASE_SCRIPTS` in `scripts.ts`. Only `node`
+ * has a `start`, because `rshono start` refuses a bundle built for anywhere else, and it needs no `preview`:
+ * `build` then `start` already is one.
+ *
+ * `pm` is here because two things have to be spelled for the app's package manager — the runner that fetches
+ * the uninstalled Vercel CLI ({@link PackageManager.dlx}), and every command in {@link Feature.platformSetup}.
+ */ function deployFeatures(pm) {
+    const build = invoke(pm, 'build');
+    return {
+        // Where a Node build goes from here is a Dockerfile or a process manager, neither of which this can
+        // guess — so the target contributes only the command that runs what was built.
+        node: {
+            id: 'deploy-node',
+            scripts: {
+                start: 'rshono start'
+            },
+            scriptHelp: {
+                start: 'run the build that exists — what your host calls'
+            },
+            platformSetup: [
+                'The two commands a host asks for:',
+                '',
+                `- **Build** — \`${pm.name} install && ${build}\``,
+                `- **Start** — \`${invoke(pm, 'start')}\``,
+                '',
+                `In a Dockerfile, the same pair: \`RUN ${build}\`, then \`CMD ["${pm.name}", "start"]\`.`
+            ].join('\n')
         },
-        gitignore: [
-            '.wrangler/'
-        ],
-        notes: [
-            'The first build writes wrangler.jsonc — yours to edit after that.'
-        ]
-    },
-    vercel: {
-        id: 'deploy-vercel',
-        scripts: {
-            deploy: 'rshono build && vercel deploy --prebuilt'
+        cloudflare: {
+            id: 'deploy-cloudflare',
+            devDependencies: {
+                wrangler: TOOL_VERSIONS.wrangler
+            },
+            // The only two install scripts a scaffolded app can end up with, and wrangler brings both. Each
+            // one merely picks the platform binary out of the optional dependency that already carries it, so
+            // neither needs to run — `workerd --version` and `esbuild --version` both answer without it.
+            allowBuilds: {
+                esbuild: false,
+                workerd: false
+            },
+            // `wrangler dev` is the one preview that runs the code in the runtime it will actually run in:
+            // workerd, not Node, serving the assets the build assembled. Both scripts read the wrangler.jsonc the
+            // build wrote, so nothing here has to know where the bundle or the assets went.
+            scripts: {
+                preview: 'rshono build && wrangler dev',
+                deploy: 'rshono build && wrangler deploy'
+            },
+            scriptHelp: {
+                preview: 'build, then run it in workerd — port 8787',
+                deploy: 'build, then ship it to Cloudflare'
+            },
+            gitignore: [
+                '.wrangler/'
+            ],
+            notes: [
+                'The first build writes wrangler.jsonc — yours to edit after that.'
+            ],
+            platformSetup: [
+                `Building from a git repo instead: set Workers Builds' **Build command** to \`${build}\`.`,
+                'Its deploy command already defaults to `npx wrangler deploy`, and it installs dependencies itself.'
+            ].join('\n')
         },
-        gitignore: [
-            '.vercel/'
-        ],
-        notes: [
-            '--prebuilt uploads what rshono build assembled; the platform must not rebuild it.'
-        ]
-    },
-    netlify: {
-        id: 'deploy-netlify',
-        scripts: {
-            deploy: 'rshono build && netlify deploy --build=false --dir=.netlify/publish'
+        vercel: {
+            id: 'deploy-vercel',
+            // `--prod` because the script is called `deploy`: without it the CLI uploads to a throwaway preview
+            // URL, which is a useful thing to have but not what the word means. The local `preview` is a Node
+            // build run here — the platform has no way to run its own prebuilt output on your machine.
+            scripts: {
+                preview: 'rshono build --deploy node && rshono start',
+                deploy: `rshono build && ${pm.dlx} vercel deploy --prebuilt --prod`
+            },
+            scriptHelp: {
+                preview: 'build for Node and run that here',
+                deploy: 'build, then upload it to production'
+            },
+            gitignore: [
+                '.vercel/'
+            ],
+            notes: [
+                '--prebuilt uploads what rshono build assembled; the platform must not rebuild it.',
+                'Drop --prod from the deploy script for a preview URL instead.'
+            ],
+            platformSetup: [
+                `Deploying from CI instead: the same \`${invoke(pm, 'deploy')}\`, with \`VERCEL_ORG_ID\`, \`VERCEL_PROJECT_ID\``,
+                'and a CLI token in the environment.',
+                '',
+                `If you let Vercel build the repo itself, set **Framework Preset** to Other — \`hono\` is otherwise`,
+                `detected as the Hono preset — and **Build Command** to \`${build}\`.`
+            ].join('\n')
         },
-        gitignore: [
-            '.netlify/'
-        ]
-    },
-    'aws-lambda': {
-        id: 'deploy-aws-lambda',
-        notes: [
-            'Use a Function URL in RESPONSE_STREAM mode — a buffered invoke mode drops the streaming.'
-        ]
-    }
-};
-function deployFeature(target) {
-    return DEPLOY_FEATURES[target];
+        'aws-lambda': {
+            id: 'deploy-aws-lambda',
+            // No CLI to wrap, and no upload this could guess at. `preview` still applies — the bundle is a Node
+            // handler, so it runs here.
+            scripts: {
+                preview: 'rshono build --deploy node && rshono start'
+            },
+            scriptHelp: {
+                preview: 'build for Node and run that here'
+            },
+            notes: [
+                'Use a Function URL in RESPONSE_STREAM mode — a buffered invoke mode drops the streaming.'
+            ],
+            platformSetup: [
+                `There is no settings page here; the upload is yours to script. A job needs \`${pm.name} install && ${build}\`,`,
+                'then the function package: `dist/`, plus `node_modules` for any dependency of your own, which the server',
+                'bundle leaves external.'
+            ].join('\n')
+        }
+    };
+}
+function deployFeature(target, pm) {
+    return deployFeatures(pm)[target];
 }
 
 ;// CONCATENATED MODULE: ./src/features/quality.ts
@@ -3223,8 +3342,10 @@ function deployFeature(target) {
  * deduplicates by `id`, so `formatter: 'biome', linter: 'biome'` contributes one set of files, one
  * dependency and one pair of scripts.
  *
- * Each tool brings its own `check` script alongside `format`/`lint`, because the writing half and the
- * CI half want different exit-code behaviour: `format` rewrites files, `check` fails instead.
+ * A formatter brings `format:check` beside `format`, because the writing half and the CI half want
+ * different exit-code behaviour: `format` rewrites files, `format:check` fails instead. A linter brings
+ * `lint:fix` beside `lint`, for the same reason in the other direction — `lint` is already the failing
+ * one. Biome adds a `check` of its own, which is the pair of them in a single pass.
  */ const PRETTIER = {
     id: 'prettier',
     overlays: [
@@ -3265,12 +3386,11 @@ const OXLINT = {
     }
 };
 /**
- * The one feature that changes a dependency the framework otherwise decides: typescript-eslint cannot be
- * installed alongside the TypeScript rshono is tested against, so an ESLint app pins the newest one its
- * peer range accepts (see {@link ESLINT_TYPESCRIPT}). Every other preset leaves TypeScript alone.
- *
- * The rules are type-aware, which is the reason to reach for ESLint over a syntax-only linter at all —
- * so the config it ships hands the whole program to the parser rather than linting file by file.
+ * The one feature that changes a dependency the framework otherwise decides: typescript-eslint cannot
+ * be installed alongside the TypeScript rshono is tested against, so an ESLint app pins the newest one
+ * its peer range accepts (see {@link ESLINT_TYPESCRIPT}). Its rules are type-aware — the reason to
+ * reach for ESLint over a syntax-only linter — so the config it ships hands the parser the whole
+ * program rather than linting file by file.
  */ const ESLINT = {
     id: 'eslint',
     overlays: [
@@ -3326,14 +3446,13 @@ function linterFeature(linter) {
 ;// CONCATENATED MODULE: ./src/features/styling.ts
 
 /**
- * Tailwind is a PostCSS plugin and nothing more, which is the whole of this feature: four packages, and
- * an overlay carrying the `postcss.config.mjs` naming the plugin, an `rshono.config.ts` whose `rspack`
- * hook puts postcss-loader in front of the CSS parser, a Tailwind entry stylesheet, and the two views
- * written in utilities instead of classes of their own.
+ * Tailwind is a PostCSS plugin and nothing more, which is the whole of this feature: four packages,
+ * plus an overlay carrying `postcss.config.mjs`, an `rshono.config.ts` whose `rspack` hook puts
+ * postcss-loader in front of the CSS parser, a Tailwind entry stylesheet, and the two views rewritten
+ * in utilities.
  *
  * `postcss` and `postcss-loader` are the app's dependencies rather than the framework's — rshono
- * compiles CSS natively and has no PostCSS in it, so an app that does not want a plugin chain does not
- * install one.
+ * compiles CSS natively, so an app that does not want a plugin chain does not install one.
  */ const TAILWIND = {
     id: 'tailwind',
     overlays: [
@@ -3359,9 +3478,12 @@ function stylingFeature(styling) {
  * The features a set of answers selects, in application order — so an overlay listed later wins a file
  * both of them ship. Deduplicated by `id`, which is what lets one feature answer two questions (Biome
  * is both the formatter and the linter) without contributing twice.
- */ function selectFeatures(answers) {
+ *
+ * `pm` reaches the deploy target because one script has to name the runner that fetches an uninstalled
+ * CLI; nothing else here depends on which package manager the app is for.
+ */ function selectFeatures(answers, pm) {
     const selected = [
-        deployFeature(answers.deploy),
+        deployFeature(answers.deploy, pm),
         stylingFeature(answers.styling),
         formatterFeature(answers.formatter),
         linterFeature(answers.linter),
@@ -3379,14 +3501,7 @@ function stylingFeature(styling) {
 
 ;// CONCATENATED MODULE: ./src/pkg.ts
 
-/**
- * The scripts every app gets. `start` is not among them: it is the *Node* launcher, and the deploy
- * features each contribute the command their own platform runs what was built with.
- */ const BASE_SCRIPTS = {
-    dev: 'rshono dev',
-    build: 'rshono build',
-    typecheck: 'tsc --noEmit'
-};
+
 /** Field order in the emitted file — the conventional reading order, and stable so snapshots are too. */ const FIELD_ORDER = [
     'name',
     'version',
@@ -3402,48 +3517,35 @@ function sorted(record) {
     return Object.fromEntries(Object.entries(record).sort(([a], [b])=>a < b ? -1 : 1));
 }
 /**
- * The install script every app inherits, from the framework rather than from anything it chose. tsx
- * reads `rshono.config.ts` through esbuild, and esbuild's script only picks the platform binary out of
- * the optional dependency that already carries it — rshono's own repo denies it for the same reason.
- */ const BASE_ALLOW_BUILDS = {
-    esbuild: false
-};
-/**
- * pnpm's settings for the new app — written for pnpm and for nobody else.
+ * pnpm's settings for the new app, written only when a feature has something to put in them. `null`
+ * means there is nothing to say, so no file is written.
  *
- * It exists for one field. A dependency with an install script is a question pnpm will not answer on its
- * own: it fails the install, and fails every `pnpm dev` after it, until the project has said whether the
- * script should run. None of the ones an rshono app inherits need to (each is a native package whose
- * binary arrives as an optional dependency), so a fresh app carries the answer rather than meeting
- * `pnpm approve-builds` before it has rendered a page once.
+ * It exists for one field, `allowBuilds`. pnpm fails an install — and every `pnpm dev` after it —
+ * until the project has said whether a dependency's install script should run. Nothing rshono itself
+ * installs has one, so most apps get no file; the packages that do (wrangler's esbuild and workerd)
+ * declare their answer on the feature that brings them.
  *
- * In this file rather than under a `pnpm` key in `package.json`, which pnpm 11 no longer reads, single-
- * package projects included. What lands here is a decision about *this* app: a scaffolded file the app
- * owns from then on, not something the framework reaches back into.
+ * A file rather than a `pnpm` key in `package.json`, which pnpm 11 no longer reads.
  */ function buildPnpmSettings(features) {
-    const allowBuilds = {
-        ...BASE_ALLOW_BUILDS
-    };
+    const allowBuilds = {};
     for (const feature of features)Object.assign(allowBuilds, feature.allowBuilds);
+    const entries = Object.entries(sorted(allowBuilds));
+    if (entries.length === 0) return null;
     return [
         '# Which dependencies may run an install script. pnpm runs none it has not been told about, and',
         '# fails the install rather than skip one quietly — so anything added later belongs here too.',
         '# `false` means the script was looked at: these ship their real binary as an optional dependency.',
         'allowBuilds:',
-        ...Object.entries(sorted(allowBuilds)).map(([name, allowed])=>`  ${name}: ${allowed}`),
+        ...entries.map(([name, allowed])=>`  ${name}: ${allowed}`),
         ''
     ].join('\n');
 }
 /**
  * Assembles `package.json` from the answers and whatever the selected features contribute.
  *
- * Dependencies are sorted by name and scripts are left in contribution order (the base ones, then each
- * feature's, in the order features were selected) — so two runs with the same answers produce byte-
- * identical output, which is what makes the generated manifest snapshot-testable.
+ * Dependencies are sorted by name and scripts keep the order {@link buildScripts} gives them — so two runs
+ * with the same answers produce byte-identical output, which is what makes the manifest snapshot-testable.
  */ function buildPackageJson(answers, features, pm) {
-    const scripts = {
-        ...BASE_SCRIPTS
-    };
     const dependencies = {
         '@rshono/core': RSHONO_RANGE,
         hono: FRAMEWORK_DEPS.hono,
@@ -3456,7 +3558,6 @@ function sorted(record) {
         typescript: FRAMEWORK_DEPS.typescript
     };
     for (const feature of features){
-        Object.assign(scripts, feature.scripts);
         Object.assign(dependencies, feature.dependencies);
         Object.assign(devDependencies, feature.devDependencies);
     }
@@ -3465,12 +3566,11 @@ function sorted(record) {
         version: '0.1.0',
         private: true,
         type: 'module',
-        // The floor the framework declares. Stated here too so a CI image or a contributor on an older
-        // Node finds out from their package manager rather than from a stack trace.
+        // Generated from the framework's own manifest, so the app's floor cannot drift below rshono's.
         engines: {
-            node: '>=22.1.0'
+            node: NODE_ENGINE
         },
-        scripts,
+        scripts: buildScripts(features),
         dependencies: sorted(dependencies),
         devDependencies: sorted(devDependencies)
     };
@@ -3486,19 +3586,25 @@ function sorted(record) {
 
 ;// CONCATENATED MODULE: ./src/render.ts
 
-const TOKEN_PATTERN = /__[A-Z][A-Z\d_]*__/g;
-function tokensFor(answers, pm) {
+/**
+ * `{{NAME}}`, deliberately not `__NAME__`: templates are real files that real tools run over, and in
+ * markdown `__NAME__` *is* strong emphasis — Prettier rewrites it to `**NAME**` and the token stops
+ * matching. `{{…}}` means nothing to any format these templates are written in.
+ */ const TOKEN_PATTERN = /\{\{[A-Z][A-Z\d_]*\}\}/g;
+function tokensFor(answers, features, pm) {
     return {
-        __PROJECT_NAME__: answers.packageName,
-        __DEPLOY_TARGET__: answers.deploy,
-        __DEPLOY_HINT__: deployHint(answers.deploy),
-        __PM__: pm.name,
-        __PM_RUN__: pm.run
+        '{{PROJECT_NAME}}': answers.packageName,
+        '{{DEPLOY_TARGET}}': answers.deploy,
+        // Derived from the features rather than the answers, because all three are about the scripts the app
+        // actually got: its command table, the one command that ships it, and what its platform asks for.
+        '{{SCRIPT_TABLE}}': scriptTable(answers, features, pm),
+        '{{DEPLOY_STEP}}': deployStep(features, pm),
+        '{{PLATFORM_SETUP}}': features.map((feature)=>feature.platformSetup ?? '').join('')
     };
 }
 /**
  * Substitutes tokens, and throws on one it doesn't know — a typo in a template would otherwise ship a
- * literal `__PORJECT_NAME__` into somebody's new app, which no test of the generator's logic would
+ * literal `{{PORJECT_NAME}}` into somebody's new app, which no test of the generator's logic would
  * catch.
  */ function render(contents, tokens, source) {
     return contents.replace(TOKEN_PATTERN, (token)=>{
@@ -3531,10 +3637,9 @@ function readTemplateDir(dir) {
 /**
  * `_gitignore` → `.gitignore`, and so on for every dotfile.
  *
- * npm strips a literal `.gitignore` out of a published tarball, so a template cannot simply contain
- * one — the file would exist in the repo, pass every local test, and be missing from the package
- * everybody actually installs. Naming them with an underscore and renaming here is the long-standing
- * fix. It applies to the basename only, so `src/lib/_x.ts` is a dotfile but `templates/_x/y.ts` is not.
+ * npm strips a literal `.gitignore` out of a published tarball, so a template cannot contain one — it
+ * would exist in the repo, pass every local test, and be missing from the package everybody installs.
+ * Applies to the basename only, so `src/lib/_x.ts` is a dotfile but `templates/_x/y.ts` is not.
  */ function undotted(path) {
     const segments = path.split(posix.sep);
     const name = segments.pop();
@@ -3557,8 +3662,8 @@ function readTemplateDir(dir) {
  * decisions and the I/O are separated so the whole matrix of answers can be asserted on in a test, and
  * so `--dry-run` is the same code path minus the last step.
  */ function plan_plan(answers, pm) {
-    const features = selectFeatures(answers);
-    const tokens = tokensFor(answers, pm);
+    const features = selectFeatures(answers, pm);
+    const tokens = tokensFor(answers, features, pm);
     const raw = readTemplateDir(external_node_path_join(TEMPLATES_DIR, 'base'));
     for (const feature of features){
         for (const overlay of feature.overlays ?? []){
@@ -3574,7 +3679,9 @@ function readTemplateDir(dir) {
     const gitignore = files.get('.gitignore');
     if (gitignore) files.set('.gitignore', appendGitignore(gitignore, features));
     files.set('package.json', buildPackageJson(answers, features, pm));
-    if (pm.name === 'pnpm') files.set('pnpm-workspace.yaml', buildPnpmSettings(features));
+    // Only for pnpm, and only when a feature brought an install script to answer for — see `buildPnpmSettings`.
+    const pnpmSettings = pm.name === 'pnpm' ? buildPnpmSettings(features) : null;
+    if (pnpmSettings) files.set('pnpm-workspace.yaml', pnpmSettings);
     return {
         // Sorted, so both the write order and a test's snapshot are stable.
         files: new Map([
@@ -3587,6 +3694,7 @@ function readTemplateDir(dir) {
 
 ;// CONCATENATED MODULE: ./src/pm.ts
 
+
 const INSTALL = {
     npm: [
         'install'
@@ -3605,20 +3713,27 @@ const RUN = {
     yarn: 'yarn',
     bun: 'bun'
 };
+const DLX = {
+    npm: 'npx',
+    pnpm: 'pnpm dlx',
+    yarn: 'yarn dlx',
+    bun: 'bunx'
+};
 function isKnown(name) {
-    return name === 'npm' || name === 'pnpm' || name === 'yarn' || name === 'bun';
+    return PACKAGE_MANAGERS.includes(name);
 }
 function packageManager(name, version) {
     return {
         name,
         version,
         install: INSTALL[name],
-        run: RUN[name]
+        run: RUN[name],
+        dlx: DLX[name]
     };
 }
 /**
- * Which package manager invoked us. Every one of them sets `npm_config_user_agent` for the process it
- * spawns — `pnpm/11.9.0 npm/? node/v22.14.0 darwin arm64` — so `pnpm create @rshono` scaffolds a pnpm
+ * Which package manager invoked us. Every one of them sets `npm_config_user_agent` on the process it
+ * spawns — `pnpm/11.9.0 npm/? node/v22.14.0 darwin arm64` — so `pnx @rshono/create` scaffolds a pnpm
  * project without asking, and the exact version comes along for the `packageManager` field.
  *
  * Falls back to npm, which is also what a bare `node bin/create-rshono.mjs` gets.
@@ -3635,12 +3750,6 @@ function packageManager(name, version) {
  */ function runInstall(pm, cwd) {
     return run(pm, pm.install, cwd);
 }
-/** `<pm> run <script>` — the one form every package manager accepts, Yarn v1 included. */ function runScript(pm, script, cwd) {
-    return run(pm, [
-        'run',
-        script
-    ], cwd);
-}
 function run(pm, args, cwd) {
     const result = spawnSync(pm.name, args, {
         cwd,
@@ -3653,6 +3762,17 @@ function run(pm, args, cwd) {
 ;// CONCATENATED MODULE: ./src/ui.ts
 
 
+
+/**
+ * The two halves of the closing line, in the words of the app's own scripts: what produces something
+ * shippable, and where it goes from there. The target with no command to give keeps the framework's hint,
+ * which is a sentence about the platform rather than something to type.
+ */ function productionSteps(answers, plan, pm) {
+    const scripts = buildScripts(plan.features);
+    const check = scripts.preview ? `${invoke(pm, 'preview')} to run the production build` : `${pm.run} build`;
+    const ship = scripts.deploy ? `${invoke(pm, 'deploy')} to ship it` : scripts.start ? `${invoke(pm, 'start')} on the host that runs it` : deployHint(answers.deploy);
+    return `${check}, and ${ship}`;
+}
 /**
  * What to do next, in the order to do it — the last thing the user reads, and for most people the only
  * documentation they will read today. `installed` decides whether the install step is still theirs.
@@ -3664,7 +3784,7 @@ function run(pm, args, cwd) {
     const lines = [
         steps.join('\n')
     ];
-    lines.push(`\nThen ${pm.run} build, and ${deployHint(answers.deploy)}.`);
+    lines.push(`\nThen ${productionSteps(answers, plan, pm)}.`);
     if (plan.notes.length > 0) lines.push(`\n${plan.notes.join('\n')}`);
     return lines.join('\n');
 }
@@ -3700,15 +3820,20 @@ function run(pm, args, cwd) {
     '.vscode',
     'Thumbs.db'
 ]);
-function inspectTarget(dir) {
-    if (!external_node_fs_existsSync(dir)) return {
-        exists: false,
-        conflicts: []
-    };
-    return {
-        exists: true,
-        conflicts: external_node_fs_readdirSync(dir).filter((entry)=>!IGNORED_ENTRIES.has(entry))
-    };
+/**
+ * What is already at the target path, ignoring the entries a fresh clone or an editor leaves behind —
+ * which is what decides whether scaffolding into it is safe.
+ *
+ * A path that does not exist yet is no conflict. A path that exists and is *not* a directory throws
+ * rather than reporting an empty list, since `--force` should not write into one either — otherwise
+ * `create-rshono README.md` gets as far as `mkdir` before failing on a raw ENOTDIR.
+ */ function conflictingEntries(dir) {
+    const stats = statSync(dir, {
+        throwIfNoEntry: false
+    });
+    if (!stats) return [];
+    if (!stats.isDirectory()) throw new Error(`${dir} already exists and is not a directory.`);
+    return external_node_fs_readdirSync(dir).filter((entry)=>!IGNORED_ENTRIES.has(entry));
 }
 /**
  * Writes the plan. Directories are created as needed, and files are written with the plan's own
@@ -3736,20 +3861,21 @@ function inspectTarget(dir) {
 
 
 
+
 const DEFAULT_DIRECTORY = 'my-rshono-app';
-const HELP = `create-rshono — scaffold a new rshono app
+/** Every accepted name comes from `options.ts`, so the help cannot promise one the validation refuses. */ const HELP = `create-rshono — scaffold a new rshono app
 
 Usage:
-  npm create @rshono@latest [directory] [options]
+  npx @rshono/create@latest [directory] [options]
 
 Options:
   -y, --yes                accept the default for every question not given as a flag
   -d, --deploy <target>    ${DEPLOY_TARGET_NAMES.join(' | ')}
       --tailwind           Tailwind CSS (--no-tailwind for plain CSS)
       --quality <preset>   ${QUALITY_PRESETS.map((preset)=>preset.id).join(' | ')}
-      --formatter <name>   prettier | biome | oxfmt | none      (overrides --quality)
-      --linter <name>      oxlint | eslint | biome | none       (overrides --quality; eslint pins TypeScript 6)
-      --pm <name>          npm | pnpm | yarn | bun              (default: whatever ran this)
+      --formatter <name>   ${FORMATTER_NAMES.join(' | ')}      (overrides --quality)
+      --linter <name>      ${LINTER_NAMES.join(' | ')}       (overrides --quality; eslint pins TypeScript 6)
+      --pm <name>          ${PACKAGE_MANAGERS.join(' | ')}              (default: whatever ran this)
       --no-install         write the files and stop
       --no-git             do not initialize a repository
       --force              scaffold into a directory that is not empty
@@ -3760,7 +3886,7 @@ Options:
 Every question can be answered by a flag, and a non-interactive terminal implies --yes — so one command
 scaffolds without prompting:
 
-  npm create @rshono@latest my-app -y --deploy cloudflare --tailwind --quality biome
+  npx @rshono/create@latest my-app -y --deploy cloudflare --tailwind --quality biome
 `;
 function fail(message) {
     log.error(message);
@@ -3777,93 +3903,89 @@ function fail(message) {
     if (off) return false;
     return undefined;
 }
-async function main() {
-    const { values, positionals } = parseArgs({
-        options: {
-            yes: {
-                type: 'boolean',
-                short: 'y'
-            },
-            deploy: {
-                type: 'string',
-                short: 'd'
-            },
-            tailwind: {
-                type: 'boolean'
-            },
-            'no-tailwind': {
-                type: 'boolean'
-            },
-            quality: {
-                type: 'string'
-            },
-            formatter: {
-                type: 'string'
-            },
-            linter: {
-                type: 'string'
-            },
-            pm: {
-                type: 'string'
-            },
-            install: {
-                type: 'boolean'
-            },
-            'no-install': {
-                type: 'boolean'
-            },
-            git: {
-                type: 'boolean'
-            },
-            'no-git': {
-                type: 'boolean'
-            },
-            force: {
-                type: 'boolean'
-            },
-            'dry-run': {
-                type: 'boolean'
-            },
-            help: {
-                type: 'boolean',
-                short: 'h'
+/** `parseArgs` names an unknown flag but says nothing about what to do next; this points at `--help`. */ function parse() {
+    try {
+        return parseArgs({
+            options: {
+                yes: {
+                    type: 'boolean',
+                    short: 'y'
+                },
+                deploy: {
+                    type: 'string',
+                    short: 'd'
+                },
+                tailwind: {
+                    type: 'boolean'
+                },
+                'no-tailwind': {
+                    type: 'boolean'
+                },
+                quality: {
+                    type: 'string'
+                },
+                formatter: {
+                    type: 'string'
+                },
+                linter: {
+                    type: 'string'
+                },
+                pm: {
+                    type: 'string'
+                },
+                install: {
+                    type: 'boolean'
+                },
+                'no-install': {
+                    type: 'boolean'
+                },
+                git: {
+                    type: 'boolean'
+                },
+                'no-git': {
+                    type: 'boolean'
+                },
+                force: {
+                    type: 'boolean'
+                },
+                'dry-run': {
+                    type: 'boolean'
+                },
+                help: {
+                    type: 'boolean',
+                    short: 'h'
+                },
+                version: {
+                    type: 'boolean',
+                    short: 'v'
+                }
             },
-            version: {
-                type: 'boolean',
-                short: 'v'
-            }
-        },
-        allowPositionals: true
-    });
+            allowPositionals: true
+        });
+    } catch (error) {
+        fail(`${error instanceof Error ? error.message : String(error)}\n\nRun with --help to see the options.`);
+    }
+}
+async function main() {
+    const { values, positionals } = parse();
     if (values.help) return console.log(HELP);
-    if (values.version) return console.log("1.0.0-rc.1");
-    // A pipe, a CI job or an agent gets the defaults rather than a prompt nothing can answer.
-    const interactive = Boolean(process.stdout.isTTY) && !values.yes;
-    const pmFlag = oneOf(values.pm, [
-        'npm',
-        'pnpm',
-        'yarn',
-        'bun'
-    ], 'pm');
+    if (values.version) return console.log("1.0.0-rc.11");
+    // A pipe, a CI job or an agent gets the defaults rather than a prompt nothing can answer. Both
+    // streams have to be a terminal: the prompts draw on stdout but *read from stdin*, so
+    // `echo | npx @rshono/create` would otherwise ask a question with nothing behind the keyboard.
+    const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY) && !values.yes;
+    const pmFlag = oneOf(values.pm, PACKAGE_MANAGERS, 'pm');
     const pm = pmFlag ? packageManager(pmFlag) : detectPackageManager();
     const deployFlag = oneOf(values.deploy, DEPLOY_TARGET_NAMES, 'deploy');
-    const formatterFlag = oneOf(values.formatter, [
-        'prettier',
-        'biome',
-        'oxfmt',
-        'none'
-    ], 'formatter');
-    const linterFlag = oneOf(values.linter, [
-        'oxlint',
-        'eslint',
-        'biome',
-        'none'
-    ], 'linter');
+    const formatterFlag = oneOf(values.formatter, FORMATTER_NAMES, 'formatter');
+    const linterFlag = oneOf(values.linter, LINTER_NAMES, 'linter');
     const qualityFlag = oneOf(values.quality, QUALITY_PRESETS.map((preset)=>preset.id), 'quality');
     const tailwindFlag = tristate(values.tailwind, values['no-tailwind'], 'tailwind');
     const installFlag = tristate(values.install, values['no-install'], 'install');
     const gitFlag = tristate(values.git, values['no-git'], 'git');
-    intro(`create-rshono  ·  rshono ${"1.0.0-rc.1"}`);
+    // The framework version, not this package's: it is the one the app will be pinned to, and the one
+    // worth reading here. `--version` reports create-rshono's own.
+    intro(`create-rshono  ·  rshono ${RSHONO_VERSION}`);
     // ── Where ───────────────────────────────────────────────────────────────────────────────────────
     let directory = positionals[0];
     if (!directory) {
@@ -3877,7 +3999,7 @@ async function main() {
     const targetDir = resolve(process.cwd(), directory);
     const packageName = toPackageName(directory === '.' ? basename(targetDir) : directory);
     if (!packageName || !isValidPackageName(packageName)) fail(`"${directory}" does not give a usable npm package name.`);
-    const conflicts = inspectTarget(targetDir).conflicts;
+    const conflicts = conflictingEntries(targetDir);
     if (conflicts.length > 0 && !values.force) {
         const where = directory === '.' ? 'this directory' : `"${directory}"`;
         const listed = `${conflicts.slice(0, 3).join(', ')}${conflicts.length > 3 ? ', …' : ''}`;
@@ -3903,7 +4025,7 @@ async function main() {
                 }))
         }));
     }
-    let styling = tailwindFlag === undefined ? 'css' : tailwindFlag ? 'tailwind' : 'css';
+    let styling = tailwindFlag ? 'tailwind' : 'css';
     if (tailwindFlag === undefined && interactive) {
         styling = unwrap(await dist_select({
             message: 'Styling?',
@@ -3922,10 +4044,9 @@ async function main() {
             ]
         }));
     }
-    /*
-   * The preset asks one question instead of two. The two axes stay independent underneath — a
-   * `--formatter` or `--linter` flag addresses either on its own, and skips the question entirely.
-   */ let preset = QUALITY_PRESETS.find((candidate)=>candidate.id === qualityFlag);
+    // One question instead of two. The axes stay independent underneath: a `--formatter` or `--linter`
+    // flag addresses either on its own, and skips the question entirely.
+    let preset = QUALITY_PRESETS.find((candidate)=>candidate.id === qualityFlag);
     if (!preset && !formatterFlag && !linterFlag) {
         const fallback = QUALITY_PRESETS["0"];
         if (interactive) {
@@ -3953,9 +4074,10 @@ async function main() {
             initialValue: true
         }));
     }
-    let git = gitFlag ?? !isInsideRepo(process.cwd());
+    // Asked once, not once per use: this shells out to `git rev-parse`.
+    const nested = isInsideRepo(process.cwd());
+    let git = gitFlag ?? !nested;
     if (gitFlag === undefined && interactive) {
-        const nested = isInsideRepo(process.cwd());
         git = unwrap(await dist_confirm({
             message: nested ? 'Initialize a git repository? (this is already inside one)' : 'Initialize a git repository?',
             initialValue: !nested
@@ -3963,14 +4085,10 @@ async function main() {
     }
     const answers = {
         packageName,
-        targetDir,
         deploy,
         styling,
         formatter,
-        linter,
-        packageManager: pm.name,
-        install,
-        git
+        linter
     };
     // ── Plan, then write ────────────────────────────────────────────────────────────────────────────
     const plan = plan_plan(answers, pm);
@@ -3987,14 +4105,7 @@ async function main() {
     if (install) {
         log.step(`Installing dependencies with ${pm.name}…`);
         installed = runInstall(pm, targetDir);
-        if (!installed) log.warn(`${pm.name} install failed — run it yourself and the rest will work.`);
-    }
-    /*
-   * Format the scaffold with the tool it was scaffolded with, so a fresh project passes its own
-   * `format:check` instead of reporting a diff nobody made. Needs the install, since the formatter is a
-   * devDependency — hence the skip, rather than a failure, when there is none.
-   */ if (installed && formatter !== 'none') {
-        if (!runScript(pm, 'format', targetDir)) log.warn(`\`${pm.run} format\` failed — the files are fine, the formatter is not.`);
+        if (!installed) log.warn(`${pm.name} install failed — the files are all written, so run it yourself in the project.`);
     }
     if (git) {
         if (!hasGit(targetDir)) {