@rshono/create 1.0.0-rc.2 → 1.0.0-rc.20

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@rshono/create",
-  "version": "1.0.0-rc.2",
+  "version": "1.0.0-rc.20",
   "description": "Scaffold a new rshono app — Hono + Rspack + React Server Components",
   "author": "Lasse <lasse@lassetange.com> (https://www.lassetange.com)",
-  "license": "ISC",
+  "license": "MIT",
   "keywords": [
     "create",
     "scaffold",
@@ -36,24 +36,23 @@
     "templates"
   ],
   "engines": {
-    "node": ">=22.1.0"
+    "node": ">=22.18.0"
   },
   "publishConfig": {
     "access": "public"
   },
+  "devDependencies": {
+    "@clack/prompts": "^1.7.0",
+    "@rspack/core": "2.2.2",
+    "@types/node": "^26.4.0",
+    "typescript": "^7.0.2",
+    "@rshono/core": "1.0.0-rc.20"
+  },
   "scripts": {
     "build": "node scripts/codegen.mjs && node scripts/build.mjs",
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
     "codegen": "node scripts/codegen.mjs",
     "typecheck": "node scripts/codegen.mjs && tsc --noEmit",
-    "test": "npm run build && node --test --test-concurrency=1 \"test/*.test.mjs\"",
-    "prepack": "npm run build"
-  },
-  "devDependencies": {
-    "@clack/prompts": "^1.7.0",
-    "@rspack/core": "2.1.5",
-    "@types/node": "^26.1.1",
-    "@rshono/core": "workspace:*",
-    "typescript": "^7.0.2"
+    "test": "npm run build && node --test --test-concurrency=1 \"test/*.test.mjs\""
   }
-}
+}

package/templates/base/AGENTS.md

@@ -0,0 +1,5 @@
+# {{PROJECT_NAME}}
+
+An [rshono](https://www.rshono.com) app — Hono, Rspack and React Server Components.
+
+Read the framework's documentation before guessing at a convention: <https://www.rshono.com/llms.txt>.

package/templates/base/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/templates/base/README.md

@@ -1,11 +1,7 @@
 # {{PROJECT_NAME}}
 
-A [rshono](https://github.com/rshono/rshono) app — [Hono](https://hono.dev) + [Rspack](https://rspack.rs) + [React Server Components](https://react.dev/reference/rsc/server-components).
-
 ```bash
-{{PM_RUN}} dev        # dev server with HMR, http://localhost:3000
-{{PM_RUN}} build      # production build for {{DEPLOY_TARGET}}
-{{PM_RUN}} typecheck  # tsc --noEmit
+{{SCRIPT_TABLE}}
 ```
 
 `package.json` has the rest, including whatever your formatter and linter added.
@@ -18,9 +14,7 @@ public/            served verbatim at the web root (favicon.svg → /favicon.svg
 src/
   routes.ts        the route table — the one file rshono requires
   server.ts        a Hono app: middleware, API routes, redirects, error reporting
-  actions.ts       'use server' functions the browser can call
   components/      pages and components
-  lib/             everything else
   styles.css       imported by the layout, so it loads with the page
 ```
 
@@ -31,12 +25,20 @@ Interactive parts are `'use client'` components a page imports — only those sh
 
 `.env` holds committed defaults; `.env.local` overrides it and is gitignored. Only `PUBLIC_`-prefixed
 variables reach the browser — everything else is server-only, and a stray read of it in client code
-compiles to `undefined` rather than shipping. `src/lib/env.ts` is where both sides are read.
+compiles to `undefined` rather than shipping. `src/components/layout.tsx` reads `PUBLIC_APP_NAME` that way.
+
+Both are read **once, at startup**, and the `PUBLIC_` view of them is compiled into the bundle — so editing
+either while `pnpm dev` is running changes nothing until you restart it. The dev server says so when it
+happens; the same is true of `rshono.config.ts`.
 
 ## Deploying
 
-This app is built for `{{DEPLOY_TARGET}}`: after `{{PM_RUN}} build`, {{DEPLOY_HINT}}.
+This app is built for `{{DEPLOY_TARGET}}`. {{DEPLOY_STEP}}
+
+{{PLATFORM_SETUP}}
 
 Change `deploy` in `rshono.config.ts` to target somewhere else, or build for one place without editing the
 file: `rshono build --deploy vercel`, or `RSHONO_DEPLOY=vercel` in CI. `dev` always runs the Node dev
 server, whatever the target — it is a property of the build, not of developing.
+
+Every deployment target, and what each one needs: <https://www.rshono.com/docs/deployment>

package/templates/base/_env

@@ -1,7 +1,4 @@
-# Committed defaults — safe to share, and the values a fresh clone starts with.
-#
-# Secrets go in `.env.local`, which is gitignored and loaded first, so a value there wins over this
-# file. The real environment wins over both.
+# Every variable here is on `process.env` — the layout reads `process.env.PUBLIC_APP_NAME`.
 #
 # Only `PUBLIC_`-prefixed variables are compiled into the browser bundle. Anything else is server-only:
 # a stray read of it in client code compiles to `undefined` rather than shipping.

package/templates/base/_gitignore

@@ -1,5 +1,6 @@
 node_modules/
 dist/
+.rshono/
 *.tsbuildinfo
 .DS_Store
 

package/templates/base/public/favicon.svg

@@ -1 +1,2 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><title>Lightning bolt</title><text y=".9em" font-size="90">⚡</text></svg>
+<!-- The rshono mark, as a placeholder — replace it with your own and the tab is yours. -->
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none"><title>rshono</title><path fill="#087EA4" d="M12.4365 0.2520325c0.062375 -0.0080215 0.11745 0.0077075 0.16515 0.0471875 1.755075 2.142025 3.40665 4.359855 4.954725 6.65348 1.14615 1.725625 2.121325 3.550175 2.92565 5.4738 1.2845 3.426025 0.616 6.40675 -2.005475 8.9421 -2.293725 1.938575 -4.936225 2.693575 -7.927575 2.265025 -3.57555 -0.729025 -6.00575 -2.7974 -7.290525 -6.205225 -0.33465 -1.109425 -0.44475 -2.241925 -0.3303 -3.397525 0.19055 -1.9891 0.662425 -3.9081 1.415625 -5.7569 0.31385 -0.75435 0.722825 -1.4464 1.2269 -2.076275 0.411225 0.4898 0.80445 0.993175 1.179675 1.510025 0.17375 0.181625 0.354625 0.35465 0.542675 0.51905C8.728325 5.378325 10.44285 2.7201 12.4365 0.2520325Z"/><path fill="#61DAFB" d="M12.10625 4.07425c1.73145 2.008325 3.296525 4.1475 4.695175 6.41755 0.438525 0.75115 0.800275 1.537625 1.085325 2.3594 0.593825 2.336175 -0.043225 4.26305 -1.9111 5.7805 -1.80655 1.2712 -3.788425 1.6487 -5.945675 1.132525 -2.326325 -0.721875 -3.671175 -2.286975 -4.034575 -4.6952 -0.088175 -0.7593 -0.009525 -1.4986 0.23595 -2.217825 0.35005 -0.888875 0.774725 -1.73825 1.274075 -2.54815 0.471875 -0.6921 0.94375 -1.38415 1.415625 -2.07625 1.071925 -1.378375 2.13365 -2.762525 3.1852 -4.15255Z"/></svg>

package/templates/base/rshono.config.ts

@@ -1,35 +1,5 @@
 import { defineConfig } from '@rshono/core';
 
-/**
- * Every field is optional — delete this file to accept all the defaults. The commented lines are the
- * defaults, kept as documentation of what is there to change.
- *
- * The framework settings are compiled into the server bundle at build time, so changing one means a
- * rebuild; there is no env-var interface for them. `--port`/`PORT` and `HOST` are the two exceptions,
- * and they win over what is written here.
- */
 export default defineConfig({
-  /** Where `build` targets. Overridable per build with `--deploy` or `RSHONO_DEPLOY`. */
   deploy: '{{DEPLOY_TARGET}}',
-
-  // The public origin, baked into prerendered pages' absolute URLs. Set it if you use `render: 'static'`
-  // and build canonical tags, `og:url` or absolute links — there is no request to read a Host from.
-  // siteUrl: 'https://example.com',
-
-  // port: 3000,          // default for dev/start
-  // host: '0.0.0.0',     // bind address for start
-
-  // trustProxy: false,   // honour X-Forwarded-Host/-Proto — only behind a proxy you control
-  // checkOrigin: true,   // CSRF origin check on server-action POSTs
-  // allowedOrigins: [],  // extra origins allowed to post actions
-  // csp: false,          // strict per-request-nonce Content-Security-Policy
-  // cspDirectives: {},   // widen it, e.g. { 'img-src': "'self' https://cdn.example.com" }
-  // bodySizeLimit: '1mb',// request body cap before a 413; false disables it
-  // renderTimeout: 10_000, // ms deadline for a request (action + flight + SSR)
-  // compress: true,      // gzip; turn off behind a proxy that already does it
-
-  // Escape hatch: mutate the generated Rspack config just before it compiles. Called once per compiler.
-  // rspack(config, { isServer, isDev }) {
-  //   return config;
-  // },
 });

package/templates/base/src/components/404.tsx

@@ -1,7 +1,6 @@
 import type { PageProps } from '@rshono/core';
 import { Layout } from './layout';
 
-/** Declared as `notFound` in routes.ts. Answers unmatched paths, and any `notFound()` call, with a 404. */
 export default function NotFound({ url }: PageProps) {
   return (
     <Layout title="Not found">

package/templates/base/src/components/500.tsx

@@ -1,12 +1,6 @@
 import type { ErrorPageProps } from '@rshono/core';
 import { Layout } from './layout';
 
-/**
- * Declared as `error` in routes.ts. Answers a request that threw, with a 500.
- *
- * `error.message` is the real message in development and a generic `'Internal Server Error'` in
- * production, where `error.stack` is absent — so this component can show it without leaking anything.
- */
 export default function ServerError({ error }: ErrorPageProps) {
   return (
     <Layout title="Something went wrong">

package/templates/base/src/components/home.tsx

@@ -1,29 +1,14 @@
 import type { PageProps } from '@rshono/core';
-import { publicEnv } from '../lib/env';
-import type { AppEnv } from '../server';
-import { GreetForm } from './greet-form';
-import { Layout } from './layout';
+import { appName, Layout } from './layout';
 
-/**
- * A page is a React **server component**: it runs on the server only, may be `async`, and can await data
- * directly — no loaders, no client bundle for any of this.
- *
- * The `AppEnv` type argument is what types `ctx.var` key by key; without it `ctx.var` is an open record.
- */
-export default function Home({ url, ctx }: PageProps<'/', AppEnv>) {
+export default function Home({ url }: PageProps<'/'>) {
   return (
     <Layout description="A new rshono app.">
-      <h1>{publicEnv.appName}</h1>
+      <h1>{appName}</h1>
       <p>
-        Edit <code>src/components/home.tsx</code> and save. The page re-renders in place — the form below keeps whatever you have typed in it.
+        Edit <code>src/components/home.tsx</code> and save — the page re-renders in place.
       </p>
 
-      <h2>Server actions</h2>
-      <p>
-        This form calls a <code>'use server'</code> function in <code>src/actions.ts</code>. It works before hydration and with JavaScript disabled.
-      </p>
-      <GreetForm />
-
       <h2>Where things are</h2>
       <ul>
         <li>
@@ -33,7 +18,7 @@ export default function Home({ url, ctx }: PageProps<'/', AppEnv>) {
           <code>src/server.ts</code> — a Hono app for middleware and API routes, mounted ahead of the pages
         </li>
         <li>
-          <code>src/components/</code> — pages and components; <code>src/lib/</code> — everything else
+          <code>src/components/</code> — pages and components
         </li>
         <li>
           <code>rshono.config.ts</code> — deploy target, security and build settings
@@ -41,9 +26,7 @@ export default function Home({ url, ctx }: PageProps<'/', AppEnv>) {
       </ul>
 
       <p>
-        {/* `ctx` is the request context — cookies, headers, env, middleware variables — handed to the page as a
-            prop, so reading it needs no import. It is server-only and never crosses into a client component. */}
-        Rendered on the server for <code>{url.pathname}</code>, request <code>{ctx.var.requestId}</code>.
+        Rendered on the server for <code>{url.pathname}</code>.
       </p>
     </Layout>
   );

package/templates/base/src/components/layout.tsx

@@ -1,14 +1,10 @@
-import { NavigationProgress } from '@rshono/core/client';
 import type { ReactNode } from 'react';
-import { publicEnv } from '../lib/env';
 import '../styles.css';
 
-/**
- * A page renders the whole document, so the shell lives in one component every page wraps its content
- * in. Importing the stylesheet here is what attaches it to each of those pages.
- */
+export const appName = process.env.PUBLIC_APP_NAME ?? '{{PROJECT_NAME}}';
+
 export function Layout({ title, description, children }: { title?: string; description?: string; children: ReactNode }) {
-  const heading = title ? `${title} · ${publicEnv.appName}` : publicEnv.appName;
+  const heading = title ? `${title} · ${appName}` : appName;
 
   return (
     <html lang="en">
@@ -20,14 +16,11 @@ export function Layout({ title, description, children }: { title?: string; descr
         <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
       </head>
       <body>
-        {/* Paints during a soft navigation, so a slow page still feels answered. */}
-        <NavigationProgress />
         <header>
           <nav>
             <a href="/">
-              <strong>{publicEnv.appName}</strong>
+              <strong>{appName}</strong>
             </a>
-            {/* `data-prefetch` warms a page on hover; `data-native` opts a link out of soft navigation. */}
             <a href="/api/health" data-native>
               /api/health
             </a>

package/templates/base/src/routes.ts

@@ -1,32 +1,7 @@
 import { defineRoutes } from '@rshono/core';
 
-/**
- * The one file rshono requires. It only ever runs on the server, so importing server-only modules from
- * it — inside `staticPaths`, say — is safe.
- *
- * Write each page as the inline `component: () => import('…')` thunk you see below: the build detects
- * that exact form and attaches the page's own JS and CSS to it, which is what makes assets code-split
- * per route.
- */
 export const routes = defineRoutes({
-  routes: [
-    { path: '/', component: () => import('./components/home') },
-
-    // A page with params. `PageProps<'/posts/:slug'>` types `params.slug` for the component.
-    // { path: '/posts/:slug', component: () => import('./components/post') },
-
-    // Prerendered at build time, one file per param set, served from disk.
-    // {
-    //   path: '/docs/:slug',
-    //   render: 'static',
-    //   component: () => import('./components/doc'),
-    //   staticPaths: async () => [{ slug: 'getting-started' }],
-    // },
-
-    // A raw Hono handler instead of a page — for anything that isn't HTML. The other place for these
-    // is src/server.ts, which is the better home for a group of them.
-    // { type: 'endpoint', path: '/api/posts', server: () => import('./api/posts') },
-  ],
+  routes: [{ path: '/', component: () => import('./components/home') }],
   notFound: { component: () => import('./components/404') },
   error: { component: () => import('./components/500') },
 });

package/templates/base/src/server.ts

@@ -1,59 +1,44 @@
-import { onServerError } from '@rshono/core/server';
+import { onServerError, publicUrl } from '@rshono/core/server';
 import { Hono } from 'hono';
+import { bodyLimit } from 'hono/body-limit';
+import { csrf } from 'hono/csrf';
 import { trimTrailingSlash } from 'hono/trailing-slash';
 
 /**
- * What this app's middleware puts on the Hono context. Pass it to `PageProps<path, AppEnv>` (or
- * `getContext<AppEnv>()`) and `ctx.var` is typed key by key instead of an open record — see
- * `components/home.tsx`.
+ * Mounted at `/` ahead of the page routes, so middleware registered here wraps page requests too — auth,
+ * logging, headers. The flip side: a terminal handler at a page's path shadows the page.
  */
-export type AppEnv = { Variables: { requestId: string } };
+const server = new Hono();
 
-const server = new Hono<AppEnv>();
-const startedAt = Date.now();
-
-/**
- * Where an error tracker goes. Registered at module load — this file is imported as the server starts —
- * so every error the framework catches reaches one place: a thrown action, a failed render, SSR falling
- * over. Swap the log for `Sentry.captureException(error)` or whatever you use.
- */
+/** Every error the framework catches lands here: a thrown action, a failed render, SSR falling over. */
 onServerError((error, { source, request }) => {
   const message = error instanceof Error ? error.message : String(error);
   console.error(`[error] ${source} ${new URL(request.url).pathname}: ${message}`);
 });
 
+/** Caps every request body before anything downstream buffers it. Raise it where you accept uploads. */
+server.use(bodyLimit({ maxSize: 1024 * 1024 }));
+
+/** Cross-origin hosts allowed to post server actions, alongside this app's own. */
+const ALLOWED_ORIGINS: string[] = [];
+
+/** Rejects a cross-origin POST before it reaches a server action. `publicUrl(c)`, not `c.req.url`: behind a proxy those differ. */
+server.use(csrf({ origin: (origin, c) => origin === publicUrl(c).origin || ALLOWED_ORIGINS.includes(origin) }));
+
 /** `/about/` and `/about` should not be two pages. */
 server.use(trimTrailingSlash({ alwaysRedirect: true }));
 
-/**
- * This sub-app is mounted at `/` *ahead of* the page routes, so middleware registered here wraps page
- * requests too — auth, logging, headers. The flip side: a terminal handler at the same path as a page
- * route shadows the page.
- */
-server.use('*', async (c, next) => {
-  c.set('requestId', crypto.randomUUID());
-  const start = performance.now();
-  await next();
-  c.res.headers.set('X-Response-Time', `${(performance.now() - start).toFixed(1)} ms`);
-});
-
 /** Old paths that should keep working. One place to add to, rather than a handler each. */
-const REDIRECTS: Record<string, string> = {
-  '/home': '/',
-};
+const REDIRECTS: Record<string, string> = { '/home': '/' };
 
 for (const [from, to] of Object.entries(REDIRECTS)) {
   server.get(from, (c) => c.redirect(to, 301));
 }
 
-server.get('/api/health', (c) => {
-  return c.json({ status: 'ok', uptime: (Date.now() - startedAt) / 1000, requestId: c.var.requestId });
-});
+/** A JSON API route, with no page involved. The layout links to it. */
+server.get('/api/health', (c) => c.json({ status: 'ok' }));
 
 export default server;
 
-/**
- * End-to-end types for a client that calls this app: `hc<AppType>('/')` from `hono/client` gives typed
- * paths, params and responses, checked against the handlers above.
- */
+/** `hc<AppType>('/')` from `hono/client` gives paths, params and responses typed against the handlers above. */
 export type AppType = typeof server;

package/templates/base/src/styles.css

@@ -1,12 +1,3 @@
-/*
- * Deliberately element-level: nothing here names a class, so the markup in src/components stays plain
- * HTML you can restyle or replace wholesale without hunting for selectors.
- *
- * Rspack compiles this natively — there is no PostCSS anywhere in the framework. If you want a plugin
- * chain, add the loader in `rshono.config.ts`'s `rspack` hook; that, plus the packages, is all the
- * Tailwind setup is.
- */
-
 *,
 *::before,
 *::after {
@@ -38,12 +29,7 @@
 }
 
 body {
-  font-family:
-    ui-sans-serif,
-    system-ui,
-    -apple-system,
-    'Segoe UI',
-    sans-serif;
+  font-family: ui-sans-serif, system-ui, 'Segoe UI', sans-serif;
   line-height: 1.6;
   color: var(--text);
   background: var(--bg);
@@ -127,52 +113,3 @@ pre {
   background: var(--surface);
   font-size: 0.8125rem;
 }
-
-form {
-  display: flex;
-  flex-wrap: wrap;
-  align-items: center;
-  gap: 0.5rem;
-  padding: 1rem;
-  border: 1px solid var(--border);
-  border-radius: var(--radius);
-  background: var(--surface);
-}
-
-label {
-  flex-basis: 100%;
-  font-size: 0.875rem;
-  color: var(--muted);
-}
-
-input {
-  flex: 1 1 12rem;
-  padding: 0.5rem 0.75rem;
-  border: 1px solid var(--border);
-  border-radius: 6px;
-  background: var(--bg);
-  color: inherit;
-  font: inherit;
-}
-
-button {
-  padding: 0.5rem 1rem;
-  border: 0;
-  border-radius: 6px;
-  background: var(--accent);
-  color: #fff;
-  font: inherit;
-  font-weight: 500;
-  cursor: pointer;
-}
-
-button:disabled {
-  opacity: 0.6;
-  cursor: progress;
-}
-
-output {
-  flex-basis: 100%;
-  font-size: 0.9375rem;
-  color: var(--muted);
-}

package/templates/biome/biome.json

@@ -1,7 +1,8 @@
 {
   "$schema": "https://biomejs.dev/schemas/2.5.6/schema.json",
-  "files": { "includes": ["**", "!dist", "!.wrangler", "!.vercel", "!.netlify", "!wrangler.jsonc"] },
+  "files": { "includes": ["**", "!dist", "!.rshono", "!.wrangler", "!.vercel", "!.netlify", "!wrangler.jsonc"] },
   "formatter": { "indentStyle": "space", "indentWidth": 2, "lineWidth": 140 },
   "javascript": { "formatter": { "quoteStyle": "single", "jsxQuoteStyle": "double" } },
+  "css": { "formatter": { "quoteStyle": "single" } },
   "linter": { "enabled": true, "rules": { "preset": "recommended" } }
 }

package/templates/biome-tailwind/biome.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://biomejs.dev/schemas/2.5.6/schema.json",
-  "files": { "includes": ["**", "!dist", "!.wrangler", "!.vercel", "!.netlify", "!wrangler.jsonc", "!**/*.css"] },
+  "files": { "includes": ["**", "!dist", "!.rshono", "!.wrangler", "!.vercel", "!.netlify", "!wrangler.jsonc", "!**/*.css"] },
   "formatter": { "indentStyle": "space", "indentWidth": 2, "lineWidth": 140 },
   "javascript": { "formatter": { "quoteStyle": "single", "jsxQuoteStyle": "double" } },
   "linter": { "enabled": true, "rules": { "preset": "recommended" } }

package/templates/eslint/eslint.config.mjs

@@ -1,31 +1,31 @@
+/**
+ * ESLint with type-aware rules, which is the reason to reach for it over a linter that only reads syntax.
+ *
+ * **This app's `typescript` is pinned below the one rshono is built with.** typescript-eslint reads the
+ * compiler API directly and accepts nothing from TypeScript 6.1 up, so `package.json` holds the newest
+ * version it takes. Your editor and `tsc` are unaffected — rshono's declarations compile the same under
+ * either — but the rules below reason about your program through the *older* compiler.
+ *
+ * The practical consequence: `lint:fix` can rewrite code that `tsc` then rejects. Run `typecheck` after it,
+ * not instead of it. When typescript-eslint widens its peer range, drop the `typescript` pin from
+ * `package.json` and this note with it.
+ */
 import js from '@eslint/js';
 import reactHooks from 'eslint-plugin-react-hooks';
 import tseslint from 'typescript-eslint';
 
-/**
- * Flat config, with type-aware rules — the reason to run ESLint over a syntax-only linter. `projectService`
- * builds the same program `tsc` does from tsconfig.json, so a rule can ask what a value actually *is*:
- * an unawaited promise, a `catch` that swallows an error, a `String()` around something that is not one.
- *
- * The cost is that ESLint needs TypeScript to answer, which is why this app pins TypeScript 6 —
- * typescript-eslint reads the compiler API directly and accepts nothing newer. `npm run typecheck` is
- * still the thing that decides whether the app compiles; these rules only see what it sees.
- */
 export default tseslint.config(
-  // ESLint's own default ignores cover node_modules and nothing else, so the build output — and whatever
-  // the deploy target leaves beside it — would otherwise be linted as if you had written it.
-  { ignores: ['dist/**', '.wrangler/**', '.vercel/**', '.netlify/**'] },
+  // Build output, all of it generated: `dist/` from `rshono build`, `.rshono/` from `rshono dev`, and
+  // whatever the deploy target assembles beside them. Without this, linting after a dev run reports on
+  // bundles rather than on anything you wrote.
+  { ignores: ['dist/**', '.rshono/**', '.wrangler/**', '.vercel/**', '.netlify/**'] },
   js.configs.recommended,
   tseslint.configs.recommendedTypeChecked,
-  // The rules of hooks: the one class of React mistake no type checker catches, and the reason a React
-  // app wants a linter at all.
   reactHooks.configs.flat['recommended-latest'],
   {
     languageOptions: {
       parserOptions: { projectService: true, tsconfigRootDir: import.meta.dirname },
     },
   },
-  // This file and any other plain JavaScript sits outside the TypeScript program, so the type-aware rules
-  // have nothing to run against and would report every file as unconfigured.
   { files: ['**/*.{js,mjs,cjs}'], extends: [tseslint.configs.disableTypeChecked] },
 );

package/templates/oxfmt/_oxfmtrc.json

@@ -3,5 +3,5 @@
   "printWidth": 140,
   "singleQuote": true,
   "trailingComma": "all",
-  "ignorePatterns": ["dist", ".wrangler", ".vercel", ".netlify", "wrangler.jsonc"]
+  "ignorePatterns": ["dist", ".wrangler", ".vercel", ".netlify", "wrangler.jsonc", "package.json"]
 }

package/templates/tailwind/postcss.config.mjs

@@ -1,7 +1,3 @@
-/**
- * The plugin list. postcss-loader finds this file on its own; what puts postcss-loader in front of
- * Rspack's CSS parser in the first place is the rule in `rshono.config.ts`.
- */
 export default {
   plugins: {
     '@tailwindcss/postcss': {},

package/templates/tailwind/rshono.config.ts

@@ -1,44 +1,8 @@
 import { defineConfig } from '@rshono/core';
 
-/**
- * Every field is optional — delete this file to accept all the defaults. The commented lines are the
- * defaults, kept as documentation of what is there to change.
- *
- * The framework settings are compiled into the server bundle at build time, so changing one means a
- * rebuild; there is no env-var interface for them. `--port`/`PORT` and `HOST` are the two exceptions,
- * and they win over what is written here.
- */
 export default defineConfig({
-  /** Where `build` targets. Overridable per build with `--deploy` or `RSHONO_DEPLOY`. */
   deploy: '{{DEPLOY_TARGET}}',
-
-  // The public origin, baked into prerendered pages' absolute URLs. Set it if you use `render: 'static'`
-  // and build canonical tags, `og:url` or absolute links — there is no request to read a Host from.
-  // siteUrl: 'https://example.com',
-
-  // port: 3000,          // default for dev/start
-  // host: '0.0.0.0',     // bind address for start
-
-  // trustProxy: false,   // honour X-Forwarded-Host/-Proto — only behind a proxy you control
-  // checkOrigin: true,   // CSRF origin check on server-action POSTs
-  // allowedOrigins: [],  // extra origins allowed to post actions
-  // csp: false,          // strict per-request-nonce Content-Security-Policy
-  // cspDirectives: {},   // widen it, e.g. { 'img-src': "'self' https://cdn.example.com" }
-  // bodySizeLimit: '1mb',// request body cap before a 413; false disables it
-  // renderTimeout: 10_000, // ms deadline for a request (action + flight + SSR)
-  // compress: true,      // gzip; turn off behind a proxy that already does it
-
-  /**
-   * Tailwind, and the only thing the build needs to know about it.
-   *
-   * Rspack compiles CSS natively, which is fast and is all a plain stylesheet needs — but that parser
-   * reads *finished* CSS, and `@import 'tailwindcss'`, `@theme` and `@apply` are not that. Tailwind is a
-   * PostCSS plugin, so it has to run in front of the parser, which is what this rule does. The plugin
-   * list itself is in `postcss.config.mjs`, where postcss-loader looks for it.
-   *
-   * The hook is called once per compiler, so the rule reaches the client and the server graph both.
-   * Delete all of this, and the four Tailwind packages, to go back to plain CSS.
-   */
+  /** Tailwind is a PostCSS plugin, so postcss-loader has to run ahead of Rspack's native CSS parser. */
   rspack(config) {
     config.module!.rules!.push({ test: /\.css$/i, use: ['postcss-loader'], type: 'css/auto' });
   },