@rshono/create 1.0.0-rc.17 → 1.0.0-rc.19

package/dist/api.mjs

@@ -147,7 +147,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 ;// CONCATENATED MODULE: ./src/generated/framework.ts
 // GENERATED by scripts/codegen.mjs from packages/core — do not edit. Run `pnpm --filter @rshono/create codegen`.
-/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.17';
+/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.19';
 /**
  * The Node range rshono declares, restated in every scaffolded app's `engines` — so a CI image or a contributor
  * on an older Node hears it from their package manager rather than from a stack trace.
@@ -160,7 +160,7 @@ __webpack_require__.d(__webpack_exports__, {
     react: '19.2.8',
     'react-dom': '19.2.8',
     typescript: '^7.0.2',
-    '@types/node': '^26.2.0',
+    '@types/node': '^26.4.0',
     '@types/react': '^19.2.18'
 };
 /** Every `deploy` target the installed framework knows, with the command that ships what it built. */ const DEPLOY_TARGETS = [
@@ -569,6 +569,11 @@ const QUALITY_PRESETS = [
 /**
  * Turns whatever the user typed into a name npm will accept, or `null` when nothing usable is left.
  * Lowercasing and replacing runs of invalid characters covers the ordinary cases (`My App`, `my_app`).
+ *
+ * The promise is checked rather than assumed: the result goes through {@link isValidPackageName} on the way
+ * out. It used to be spelled as a rule per character class here and the check made again by the caller, which
+ * left the exported function able to return a name npm refuses — `_leading` was one, because a leading
+ * underscore is stripped by npm's rule and not by this one.
  */ function toPackageName(input) {
     const trimmed = input.trim().replace(/^\.\/+/, '').replace(/\/+$/, '');
     if (!trimmed || trimmed === '.') return null;
@@ -577,9 +582,11 @@ const QUALITY_PRESETS = [
     const scoped = /^@[^\\/]+[\\/][^\\/]+$/.test(trimmed);
     const base = scoped ? trimmed : trimmed.split(/[\\/]/).filter(Boolean).pop() ?? '';
     if (!base) return null;
-    const name = base.toLowerCase().replace(/[\\/]/g, '/').replace(/[^a-z\d\-._~/@]+/g, '-').replace(/^-+/, '').replace(/-+$/, '');
-    if (!name || name === '@' || !scoped && name.startsWith('.')) return null;
-    return name.slice(0, 214);
+    const name = base.toLowerCase().replace(/[\\/]/g, '/').replace(/[^a-z\d\-._~/@]+/g, '-')// `_` alongside `-`: npm refuses a leading underscore too, and it is what `My_App` and `_internal` leave
+    // behind once the invalid runs are replaced.
+    .replace(/^[-_]+/, '').replace(/-+$/, '');
+    const trimmedName = name.slice(0, 214);
+    return isValidPackageName(trimmedName) ? trimmedName : null;
 }
 /** npm's own rule, narrowed to what we ever generate: no uppercase, no leading dot or underscore. */ function isValidPackageName(name) {
     return /^(?:@[a-z\d\-*~][a-z\d\-*._~]*\/)?[a-z\d\-~][a-z\d\-._~]*$/.test(name) && name.length <= 214;

package/dist/cli.mjs

@@ -846,7 +846,7 @@ function dist_m(l, e) {
   if (e)
     return l ? e : e[0];
 }
-let T$1 = class T extends (/* unused pure expression or super */ null && (dist_V)) {
+let T$1 = class T extends dist_V {
   filteredOptions;
   multiple;
   isNavigating = false;
@@ -862,11 +862,11 @@ let T$1 = class T extends (/* unused pure expression or super */ null && (dist_V
   }
   get userInputWithCursor() {
     if (!this.userInput)
-      return styleText(["inverse", "hidden"], "_");
+      return external_node_util_styleText(["inverse", "hidden"], "_");
     if (this._cursor >= this.userInput.length)
       return `${this.userInput}\u2588`;
     const e = this.userInput.slice(0, this.cursor), t = this.userInput.slice(this.cursor, this.cursor + 1), i = this.userInput.slice(this.cursor + 1);
-    return `${e}${styleText("inverse", t)}${i}`;
+    return `${e}${external_node_util_styleText("inverse", t)}${i}`;
   }
   get options() {
     return typeof this.#i == "function" ? this.#i() : this.#i;
@@ -1160,7 +1160,7 @@ class U extends dist_V {
   }
 }
 
-let u$2 = class u extends (/* unused pure expression or super */ null && (dist_V)) {
+let u$2 = class u extends dist_V {
   options;
   cursor = 0;
   #t;
@@ -1364,7 +1364,7 @@ class dist_a extends dist_V {
   }
 }
 
-let u$1 = class u extends (/* unused pure expression or super */ null && (dist_V)) {
+let u$1 = class u extends dist_V {
   _mask = "\u2022";
   get cursor() {
     return this._cursor;
@@ -1377,9 +1377,9 @@ let u$1 = class u extends (/* unused pure expression or super */ null && (dist_V
       return this.masked;
     const t = this.userInput;
     if (this.cursor >= t.length)
-      return `${this.masked}${styleText(["inverse", "hidden"], "_")}`;
+      return `${this.masked}${external_node_util_styleText(["inverse", "hidden"], "_")}`;
     const s = this.masked, r = s.slice(0, this.cursor), i = s.slice(this.cursor, this.cursor + 1), o = s.slice(this.cursor + 1);
-    return `${r}${styleText("inverse", i)}${o}`;
+    return `${r}${external_node_util_styleText("inverse", i)}${o}`;
   }
   clear() {
     this._clearUserInput();
@@ -2941,7 +2941,7 @@ function hasGit(cwd) {
 
 ;// CONCATENATED MODULE: ./src/generated/framework.ts
 // GENERATED by scripts/codegen.mjs from packages/core — do not edit. Run `pnpm --filter @rshono/create codegen`.
-/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.17';
+/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.19';
 /**
  * The Node range rshono declares, restated in every scaffolded app's `engines` — so a CI image or a contributor
  * on an older Node hears it from their package manager rather than from a stack trace.
@@ -2954,7 +2954,7 @@ function hasGit(cwd) {
     react: '19.2.8',
     'react-dom': '19.2.8',
     typescript: '^7.0.2',
-    '@types/node': '^26.2.0',
+    '@types/node': '^26.4.0',
     '@types/react': '^19.2.18'
 };
 /** Every `deploy` target the installed framework knows, with the command that ships what it built. */ const DEPLOY_TARGETS = [
@@ -3043,6 +3043,11 @@ const QUALITY_PRESETS = [
 /**
  * Turns whatever the user typed into a name npm will accept, or `null` when nothing usable is left.
  * Lowercasing and replacing runs of invalid characters covers the ordinary cases (`My App`, `my_app`).
+ *
+ * The promise is checked rather than assumed: the result goes through {@link isValidPackageName} on the way
+ * out. It used to be spelled as a rule per character class here and the check made again by the caller, which
+ * left the exported function able to return a name npm refuses — `_leading` was one, because a leading
+ * underscore is stripped by npm's rule and not by this one.
  */ function toPackageName(input) {
     const trimmed = input.trim().replace(/^\.\/+/, '').replace(/\/+$/, '');
     if (!trimmed || trimmed === '.') return null;
@@ -3051,9 +3056,11 @@ const QUALITY_PRESETS = [
     const scoped = /^@[^\\/]+[\\/][^\\/]+$/.test(trimmed);
     const base = scoped ? trimmed : trimmed.split(/[\\/]/).filter(Boolean).pop() ?? '';
     if (!base) return null;
-    const name = base.toLowerCase().replace(/[\\/]/g, '/').replace(/[^a-z\d\-._~/@]+/g, '-').replace(/^-+/, '').replace(/-+$/, '');
-    if (!name || name === '@' || !scoped && name.startsWith('.')) return null;
-    return name.slice(0, 214);
+    const name = base.toLowerCase().replace(/[\\/]/g, '/').replace(/[^a-z\d\-._~/@]+/g, '-')// `_` alongside `-`: npm refuses a leading underscore too, and it is what `My_App` and `_internal` leave
+    // behind once the invalid runs are replaced.
+    .replace(/^[-_]+/, '').replace(/-+$/, '');
+    const trimmedName = name.slice(0, 214);
+    return isValidPackageName(trimmedName) ? trimmedName : null;
 }
 /** npm's own rule, narrowed to what we ever generate: no uppercase, no leading dot or underscore. */ function isValidPackageName(name) {
     return /^(?:@[a-z\d\-*~][a-z\d\-*._~]*\/)?[a-z\d\-~][a-z\d\-._~]*$/.test(name) && name.length <= 214;
@@ -3920,7 +3927,7 @@ function fail(message) {
 async function main() {
     const { values, positionals } = parse();
     if (values.help) return console.log(HELP);
-    if (values.version) return console.log("1.0.0-rc.17");
+    if (values.version) return console.log("1.0.0-rc.19");
     // A pipe, a CI job or an agent gets the defaults rather than a prompt nothing can answer. Both streams have to
     // be a terminal: the prompts draw on stdout but read from stdin.
     const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY) && !values.yes;
@@ -3946,11 +3953,17 @@ async function main() {
         })) : DEFAULT_DIRECTORY;
     }
     const targetDir = resolve(process.cwd(), directory);
-    const packageName = toPackageName(directory === '.' ? basename(targetDir) : directory);
-    if (!packageName || !isValidPackageName(packageName)) fail(`"${directory}" does not give a usable npm package name.`);
-    const conflicts = conflictingEntries(targetDir);
+    // Resolved rather than compared as text: `.`, `./`, `foo/..` and the cwd's own absolute path all name this
+    // directory, and its own basename is the only thing left to call the package. Matching the literal `'.'`
+    // covered one spelling and left `./` failing on "does not give a usable npm package name".
+    const intoCwd = targetDir === process.cwd();
+    const packageName = toPackageName(intoCwd ? basename(targetDir) : directory);
+    if (!packageName) fail(`"${directory}" does not give a usable npm package name.`);
+    // Not under --dry-run: nothing is written, so there is nothing to conflict with, and the advice it would
+    // give (`--force`) describes an action the user did not ask for.
+    const conflicts = values['dry-run'] ? [] : conflictingEntries(targetDir);
     if (conflicts.length > 0 && !values.force) {
-        const where = directory === '.' ? 'this directory' : `"${directory}"`;
+        const where = intoCwd ? 'this directory' : `"${directory}"`;
         const listed = `${conflicts.slice(0, 3).join(', ')}${conflicts.length > 3 ? ', …' : ''}`;
         if (!interactive) fail(`${where} is not empty (${listed}) — pass --force to scaffold into it anyway.`);
         const proceed = unwrap(await dist_confirm({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rshono/create",
-  "version": "1.0.0-rc.17",
+  "version": "1.0.0-rc.19",
   "description": "Scaffold a new rshono app — Hono + Rspack + React Server Components",
   "author": "Lasse <lasse@lassetange.com> (https://www.lassetange.com)",
   "license": "MIT",
@@ -43,10 +43,10 @@
   },
   "devDependencies": {
     "@clack/prompts": "^1.7.0",
-    "@rspack/core": "2.2.0",
-    "@types/node": "^26.2.0",
+    "@rspack/core": "2.2.2",
+    "@types/node": "^26.4.0",
     "typescript": "^7.0.2",
-    "@rshono/core": "1.0.0-rc.17"
+    "@rshono/core": "1.0.0-rc.19"
   },
   "scripts": {
     "build": "node scripts/codegen.mjs && node scripts/build.mjs",

package/templates/base/README.md

@@ -27,6 +27,10 @@ Interactive parts are `'use client'` components a page imports — only those sh
 variables reach the browser — everything else is server-only, and a stray read of it in client code
 compiles to `undefined` rather than shipping. `src/components/layout.tsx` reads `PUBLIC_APP_NAME` that way.
 
+Both are read **once, at startup**, and the `PUBLIC_` view of them is compiled into the bundle — so editing
+either while `pnpm dev` is running changes nothing until you restart it. The dev server says so when it
+happens; the same is true of `rshono.config.ts`.
+
 ## Deploying
 
 This app is built for `{{DEPLOY_TARGET}}`. {{DEPLOY_STEP}}

package/templates/biome/biome.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://biomejs.dev/schemas/2.5.6/schema.json",
-  "files": { "includes": ["**", "!dist", "!.wrangler", "!.vercel", "!.netlify", "!wrangler.jsonc"] },
+  "files": { "includes": ["**", "!dist", "!.rshono", "!.wrangler", "!.vercel", "!.netlify", "!wrangler.jsonc"] },
   "formatter": { "indentStyle": "space", "indentWidth": 2, "lineWidth": 140 },
   "javascript": { "formatter": { "quoteStyle": "single", "jsxQuoteStyle": "double" } },
   "css": { "formatter": { "quoteStyle": "single" } },

package/templates/biome-tailwind/biome.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://biomejs.dev/schemas/2.5.6/schema.json",
-  "files": { "includes": ["**", "!dist", "!.wrangler", "!.vercel", "!.netlify", "!wrangler.jsonc", "!**/*.css"] },
+  "files": { "includes": ["**", "!dist", "!.rshono", "!.wrangler", "!.vercel", "!.netlify", "!wrangler.jsonc", "!**/*.css"] },
   "formatter": { "indentStyle": "space", "indentWidth": 2, "lineWidth": 140 },
   "javascript": { "formatter": { "quoteStyle": "single", "jsxQuoteStyle": "double" } },
   "linter": { "enabled": true, "rules": { "preset": "recommended" } }