@rshono/create 1.0.0-rc.7 → 1.0.0-rc.8

package/bin/create-rshono.mjs

@@ -3,7 +3,8 @@
 // parse and run on whatever Node the user happens to have. The CLI itself is a bundle — its imports
 // are evaluated before any statement in it, so a version check *inside* it would be too late to
 // produce anything friendlier than a stack trace.
-var MINIMUM = [22, 1, 0];
+// Kept in step with `engines.node` in @rshono/core's manifest, which is what a scaffolded app pins.
+var MINIMUM = [22, 18, 0];
 
 var current = process.versions.node.split('.').map(Number);
 var older = false;
@@ -20,8 +21,9 @@ if (older) {
       ' or newer — you are on ' +
       process.versions.node +
       '.\n' +
-      'rshono itself requires it too (worker threads, process.loadEnvFile, Promise.withResolvers),\n' +
-      'so scaffolding on this version would produce an app that cannot start.\n',
+      'rshono itself requires it (native TypeScript stripping loads rshono.config.ts, and the dev\n' +
+      'server needs process.loadEnvFile and Promise.withResolvers), so scaffolding on this version\n' +
+      'would produce an app that cannot start.\n',
   );
   process.exit(1);
 }

package/dist/api.mjs

@@ -79,7 +79,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 ;// CONCATENATED MODULE: ./src/generated/framework.ts
 // GENERATED by scripts/codegen.mjs from packages/core — do not edit. Run `pnpm --filter @rshono/create codegen`.
-/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.7';
+/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.8';
 /**
  * The Node range rshono itself declares, restated in every scaffolded app's `engines` — so a CI image
  * or a contributor on an older Node hears it from their package manager rather than from a stack trace.
@@ -148,12 +148,11 @@ __webpack_require__.d(__webpack_exports__, {
 };
 /**
  * The TypeScript an ESLint app pins, in place of the framework's own — the one deliberate exception to
- * {@link FRAMEWORK_DEPS}, and the reason it is spelled out here.
+ * {@link FRAMEWORK_DEPS}.
  *
- * typescript-eslint reads TypeScript's compiler API directly rather than through a stable interface, so
- * it accepts `typescript >=4.8.4 <6.1.0` and nothing above. `~6.0.3` is the newest that satisfies it:
- * patch releases of 6.0, no minor. The framework itself stays on the TypeScript it is tested against —
- * rshono's declarations compile the same under either, which is what makes this pin an app's business
+ * typescript-eslint reads TypeScript's compiler API directly rather than through a stable interface,
+ * so it accepts `typescript >=4.8.4 <6.1.0` and nothing above; `~6.0.3` is the newest that satisfies
+ * it. rshono's declarations compile the same under either, which is what makes this an app's business
  * and not the framework's.
  *
  * When upstream widens the range, this constant and the ESLint feature's use of it are what to delete.
@@ -162,17 +161,13 @@ __webpack_require__.d(__webpack_exports__, {
 ;// CONCATENATED MODULE: ./src/features/deploy.ts
 
 /**
- * What a deploy target adds beyond the `deploy` line in `rshono.config.ts` — which is the build's job
- * to read, and the template's to carry.
+ * What a deploy target adds beyond the `deploy` line in `rshono.config.ts`, which the template carries.
  *
- * Deliberately thin. The framework already knows how to arrange its own output for every platform, and
- * `rshono build` writes the one platform config that has to exist (`wrangler.jsonc`, with the
- * `compatibility_date` of the day it ran) if the project has none. Generating a second copy here would
- * be a copy that goes stale.
- *
- * So a target contributes only what is true of it: the command that runs or ships the build, the CLI
- * that command needs installed locally, the directories its platform leaves behind for `.gitignore`, and
- * a note for the step no command covers. Several contribute just one of those.
+ * Deliberately thin: the framework arranges its own output for every platform, and `rshono build`
+ * writes the one platform config that has to exist (`wrangler.jsonc`, dated the day it ran) if the
+ * project has none — a second copy generated here would only go stale. So a target contributes the
+ * command that ships the build, the CLI that command needs, the directories to gitignore, and a note
+ * for the step no command covers. Several contribute just one of those.
  */ const DEPLOY_FEATURES = {
     // Where a Node build goes from here is a Dockerfile or a process manager, neither of which this can
     // guess — so the target contributes only the command that runs what was built.
@@ -187,9 +182,11 @@ __webpack_require__.d(__webpack_exports__, {
         devDependencies: {
             wrangler: TOOL_VERSIONS.wrangler
         },
-        // wrangler brings workerd, whose install script only picks the platform binary out of the optional
-        // dependency that already carries it — `workerd --version` answers without it having run.
+        // The only two install scripts a scaffolded app can end up with, and wrangler brings both. Each
+        // one merely picks the platform binary out of the optional dependency that already carries it, so
+        // neither needs to run — `workerd --version` and `esbuild --version` both answer without it.
         allowBuilds: {
+            esbuild: false,
             workerd: false
         },
         scripts: {
@@ -276,12 +273,11 @@ const OXLINT = {
     }
 };
 /**
- * The one feature that changes a dependency the framework otherwise decides: typescript-eslint cannot be
- * installed alongside the TypeScript rshono is tested against, so an ESLint app pins the newest one its
- * peer range accepts (see {@link ESLINT_TYPESCRIPT}). Every other preset leaves TypeScript alone.
- *
- * The rules are type-aware, which is the reason to reach for ESLint over a syntax-only linter at all —
- * so the config it ships hands the whole program to the parser rather than linting file by file.
+ * The one feature that changes a dependency the framework otherwise decides: typescript-eslint cannot
+ * be installed alongside the TypeScript rshono is tested against, so an ESLint app pins the newest one
+ * its peer range accepts (see {@link ESLINT_TYPESCRIPT}). Its rules are type-aware — the reason to
+ * reach for ESLint over a syntax-only linter — so the config it ships hands the parser the whole
+ * program rather than linting file by file.
  */ const ESLINT = {
     id: 'eslint',
     overlays: [
@@ -337,14 +333,13 @@ function linterFeature(linter) {
 ;// CONCATENATED MODULE: ./src/features/styling.ts
 
 /**
- * Tailwind is a PostCSS plugin and nothing more, which is the whole of this feature: four packages, and
- * an overlay carrying the `postcss.config.mjs` naming the plugin, an `rshono.config.ts` whose `rspack`
- * hook puts postcss-loader in front of the CSS parser, a Tailwind entry stylesheet, and the two views
- * written in utilities instead of classes of their own.
+ * Tailwind is a PostCSS plugin and nothing more, which is the whole of this feature: four packages,
+ * plus an overlay carrying `postcss.config.mjs`, an `rshono.config.ts` whose `rspack` hook puts
+ * postcss-loader in front of the CSS parser, a Tailwind entry stylesheet, and the two views rewritten
+ * in utilities.
  *
  * `postcss` and `postcss-loader` are the app's dependencies rather than the framework's — rshono
- * compiles CSS natively and has no PostCSS in it, so an app that does not want a plugin chain does not
- * install one.
+ * compiles CSS natively, so an app that does not want a plugin chain does not install one.
  */ const TAILWIND = {
     id: 'tailwind',
     overlays: [
@@ -503,35 +498,26 @@ function sorted(record) {
     return Object.fromEntries(Object.entries(record).sort(([a], [b])=>a < b ? -1 : 1));
 }
 /**
- * The install script every app inherits, from the framework rather than from anything it chose. tsx
- * reads `rshono.config.ts` through esbuild, and esbuild's script only picks the platform binary out of
- * the optional dependency that already carries it — rshono's own repo denies it for the same reason.
- */ const BASE_ALLOW_BUILDS = {
-    esbuild: false
-};
-/**
- * pnpm's settings for the new app — written for pnpm and for nobody else.
+ * pnpm's settings for the new app, written only when a feature has something to put in them. `null`
+ * means there is nothing to say, so no file is written.
  *
- * It exists for one field. A dependency with an install script is a question pnpm will not answer on its
- * own: it fails the install, and fails every `pnpm dev` after it, until the project has said whether the
- * script should run. None of the ones an rshono app inherits need to (each is a native package whose
- * binary arrives as an optional dependency), so a fresh app carries the answer rather than meeting
- * `pnpm approve-builds` before it has rendered a page once.
+ * It exists for one field, `allowBuilds`. pnpm fails an install — and every `pnpm dev` after it —
+ * until the project has said whether a dependency's install script should run. Nothing rshono itself
+ * installs has one, so most apps get no file; the packages that do (wrangler's esbuild and workerd)
+ * declare their answer on the feature that brings them.
  *
- * In this file rather than under a `pnpm` key in `package.json`, which pnpm 11 no longer reads, single-
- * package projects included. What lands here is a decision about *this* app: a scaffolded file the app
- * owns from then on, not something the framework reaches back into.
+ * A file rather than a `pnpm` key in `package.json`, which pnpm 11 no longer reads.
  */ function buildPnpmSettings(features) {
-    const allowBuilds = {
-        ...BASE_ALLOW_BUILDS
-    };
+    const allowBuilds = {};
     for (const feature of features)Object.assign(allowBuilds, feature.allowBuilds);
+    const entries = Object.entries(sorted(allowBuilds));
+    if (entries.length === 0) return null;
     return [
         '# Which dependencies may run an install script. pnpm runs none it has not been told about, and',
         '# fails the install rather than skip one quietly — so anything added later belongs here too.',
         '# `false` means the script was looked at: these ship their real binary as an optional dependency.',
         'allowBuilds:',
-        ...Object.entries(sorted(allowBuilds)).map(([name, allowed])=>`  ${name}: ${allowed}`),
+        ...entries.map(([name, allowed])=>`  ${name}: ${allowed}`),
         ''
     ].join('\n');
 }
@@ -587,10 +573,9 @@ function sorted(record) {
 ;// CONCATENATED MODULE: ./src/render.ts
 
 /**
- * `{{NAME}}`, and not the `__NAME__` this used to be. A template is a real file that real tools run
- * over, and in markdown `__NAME__` *is* strong emphasis — Prettier rewrites it to `**NAME**`, which
- * turns a token into literal text that no substitution will ever match again. `{{…}}` means nothing to
- * any of the formats these templates are written in.
+ * `{{NAME}}`, deliberately not `__NAME__`: templates are real files that real tools run over, and in
+ * markdown `__NAME__` *is* strong emphasis — Prettier rewrites it to `**NAME**` and the token stops
+ * matching. `{{…}}` means nothing to any format these templates are written in.
  */ const TOKEN_PATTERN = /\{\{[A-Z][A-Z\d_]*\}\}/g;
 function tokensFor(answers, pm) {
     return {
@@ -635,10 +620,9 @@ function readTemplateDir(dir) {
 /**
  * `_gitignore` → `.gitignore`, and so on for every dotfile.
  *
- * npm strips a literal `.gitignore` out of a published tarball, so a template cannot simply contain
- * one — the file would exist in the repo, pass every local test, and be missing from the package
- * everybody actually installs. Naming them with an underscore and renaming here is the long-standing
- * fix. It applies to the basename only, so `src/lib/_x.ts` is a dotfile but `templates/_x/y.ts` is not.
+ * npm strips a literal `.gitignore` out of a published tarball, so a template cannot contain one — it
+ * would exist in the repo, pass every local test, and be missing from the package everybody installs.
+ * Applies to the basename only, so `src/lib/_x.ts` is a dotfile but `templates/_x/y.ts` is not.
  */ function undotted(path) {
     const segments = path.split(posix.sep);
     const name = segments.pop();
@@ -678,7 +662,9 @@ function readTemplateDir(dir) {
     const gitignore = files.get('.gitignore');
     if (gitignore) files.set('.gitignore', appendGitignore(gitignore, features));
     files.set('package.json', buildPackageJson(answers, features, pm));
-    if (pm.name === 'pnpm') files.set('pnpm-workspace.yaml', buildPnpmSettings(features));
+    // Only for pnpm, and only when a feature brought an install script to answer for — see `buildPnpmSettings`.
+    const pnpmSettings = pm.name === 'pnpm' ? buildPnpmSettings(features) : null;
+    if (pnpmSettings) files.set('pnpm-workspace.yaml', pnpmSettings);
     return {
         // Sorted, so both the write order and a test's snapshot are stable.
         files: new Map([
@@ -724,10 +710,9 @@ function packageManager(name, version) {
     };
 }
 /**
- * Which package manager invoked us. Every one of them sets `npm_config_user_agent` for the process it
- * spawns, from its runner as much as from `create` — `pnpm/11.9.0 npm/? node/v22.14.0 darwin arm64` — so
- * `pnx @rshono/create` scaffolds a pnpm project without asking, and the exact version comes along for the
- * `packageManager` field.
+ * Which package manager invoked us. Every one of them sets `npm_config_user_agent` on the process it
+ * spawns — `pnpm/11.9.0 npm/? node/v22.14.0 darwin arm64` — so `pnx @rshono/create` scaffolds a pnpm
+ * project without asking, and the exact version comes along for the `packageManager` field.
  *
  * Falls back to npm, which is also what a bare `node bin/create-rshono.mjs` gets.
  */ function detectPackageManager(userAgent = process.env.npm_config_user_agent) {
@@ -766,12 +751,12 @@ function run(pm, args, cwd) {
     'Thumbs.db'
 ]);
 /**
- * What is already at the target path, which is what decides whether scaffolding into it is safe: the
- * entries already there, ignoring the ones a fresh clone or an editor leaves behind.
+ * What is already at the target path, ignoring the entries a fresh clone or an editor leaves behind —
+ * which is what decides whether scaffolding into it is safe.
  *
- * A path that does not exist yet is no conflict. A path that exists and is *not* a directory is not
- * something `--force` should be able to write into, so it throws rather than reporting an empty list —
- * otherwise `create-rshono README.md` gets as far as `mkdir` before failing on a raw ENOTDIR.
+ * A path that does not exist yet is no conflict. A path that exists and is *not* a directory throws
+ * rather than reporting an empty list, since `--force` should not write into one either — otherwise
+ * `create-rshono README.md` gets as far as `mkdir` before failing on a raw ENOTDIR.
  */ function conflictingEntries(dir) {
     const stats = statSync(dir, {
         throwIfNoEntry: false

package/dist/cli.mjs

@@ -2943,7 +2943,7 @@ function hasGit(cwd) {
 
 ;// CONCATENATED MODULE: ./src/generated/framework.ts
 // GENERATED by scripts/codegen.mjs from packages/core — do not edit. Run `pnpm --filter @rshono/create codegen`.
-/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.7';
+/** The framework release a scaffolded app is pinned to: this package and rshono ship together. */ const RSHONO_VERSION = '1.0.0-rc.8';
 /**
  * The Node range rshono itself declares, restated in every scaffolded app's `engines` — so a CI image
  * or a contributor on an older Node hears it from their package manager rather than from a stack trace.
@@ -3124,12 +3124,11 @@ const QUALITY_PRESETS = [
 };
 /**
  * The TypeScript an ESLint app pins, in place of the framework's own — the one deliberate exception to
- * {@link FRAMEWORK_DEPS}, and the reason it is spelled out here.
+ * {@link FRAMEWORK_DEPS}.
  *
- * typescript-eslint reads TypeScript's compiler API directly rather than through a stable interface, so
- * it accepts `typescript >=4.8.4 <6.1.0` and nothing above. `~6.0.3` is the newest that satisfies it:
- * patch releases of 6.0, no minor. The framework itself stays on the TypeScript it is tested against —
- * rshono's declarations compile the same under either, which is what makes this pin an app's business
+ * typescript-eslint reads TypeScript's compiler API directly rather than through a stable interface,
+ * so it accepts `typescript >=4.8.4 <6.1.0` and nothing above; `~6.0.3` is the newest that satisfies
+ * it. rshono's declarations compile the same under either, which is what makes this an app's business
  * and not the framework's.
  *
  * When upstream widens the range, this constant and the ESLint feature's use of it are what to delete.
@@ -3138,17 +3137,13 @@ const QUALITY_PRESETS = [
 ;// CONCATENATED MODULE: ./src/features/deploy.ts
 
 /**
- * What a deploy target adds beyond the `deploy` line in `rshono.config.ts` — which is the build's job
- * to read, and the template's to carry.
+ * What a deploy target adds beyond the `deploy` line in `rshono.config.ts`, which the template carries.
  *
- * Deliberately thin. The framework already knows how to arrange its own output for every platform, and
- * `rshono build` writes the one platform config that has to exist (`wrangler.jsonc`, with the
- * `compatibility_date` of the day it ran) if the project has none. Generating a second copy here would
- * be a copy that goes stale.
- *
- * So a target contributes only what is true of it: the command that runs or ships the build, the CLI
- * that command needs installed locally, the directories its platform leaves behind for `.gitignore`, and
- * a note for the step no command covers. Several contribute just one of those.
+ * Deliberately thin: the framework arranges its own output for every platform, and `rshono build`
+ * writes the one platform config that has to exist (`wrangler.jsonc`, dated the day it ran) if the
+ * project has none — a second copy generated here would only go stale. So a target contributes the
+ * command that ships the build, the CLI that command needs, the directories to gitignore, and a note
+ * for the step no command covers. Several contribute just one of those.
  */ const DEPLOY_FEATURES = {
     // Where a Node build goes from here is a Dockerfile or a process manager, neither of which this can
     // guess — so the target contributes only the command that runs what was built.
@@ -3163,9 +3158,11 @@ const QUALITY_PRESETS = [
         devDependencies: {
             wrangler: TOOL_VERSIONS.wrangler
         },
-        // wrangler brings workerd, whose install script only picks the platform binary out of the optional
-        // dependency that already carries it — `workerd --version` answers without it having run.
+        // The only two install scripts a scaffolded app can end up with, and wrangler brings both. Each
+        // one merely picks the platform binary out of the optional dependency that already carries it, so
+        // neither needs to run — `workerd --version` and `esbuild --version` both answer without it.
         allowBuilds: {
+            esbuild: false,
             workerd: false
         },
         scripts: {
@@ -3252,12 +3249,11 @@ const OXLINT = {
     }
 };
 /**
- * The one feature that changes a dependency the framework otherwise decides: typescript-eslint cannot be
- * installed alongside the TypeScript rshono is tested against, so an ESLint app pins the newest one its
- * peer range accepts (see {@link ESLINT_TYPESCRIPT}). Every other preset leaves TypeScript alone.
- *
- * The rules are type-aware, which is the reason to reach for ESLint over a syntax-only linter at all —
- * so the config it ships hands the whole program to the parser rather than linting file by file.
+ * The one feature that changes a dependency the framework otherwise decides: typescript-eslint cannot
+ * be installed alongside the TypeScript rshono is tested against, so an ESLint app pins the newest one
+ * its peer range accepts (see {@link ESLINT_TYPESCRIPT}). Its rules are type-aware — the reason to
+ * reach for ESLint over a syntax-only linter — so the config it ships hands the parser the whole
+ * program rather than linting file by file.
  */ const ESLINT = {
     id: 'eslint',
     overlays: [
@@ -3313,14 +3309,13 @@ function linterFeature(linter) {
 ;// CONCATENATED MODULE: ./src/features/styling.ts
 
 /**
- * Tailwind is a PostCSS plugin and nothing more, which is the whole of this feature: four packages, and
- * an overlay carrying the `postcss.config.mjs` naming the plugin, an `rshono.config.ts` whose `rspack`
- * hook puts postcss-loader in front of the CSS parser, a Tailwind entry stylesheet, and the two views
- * written in utilities instead of classes of their own.
+ * Tailwind is a PostCSS plugin and nothing more, which is the whole of this feature: four packages,
+ * plus an overlay carrying `postcss.config.mjs`, an `rshono.config.ts` whose `rspack` hook puts
+ * postcss-loader in front of the CSS parser, a Tailwind entry stylesheet, and the two views rewritten
+ * in utilities.
  *
  * `postcss` and `postcss-loader` are the app's dependencies rather than the framework's — rshono
- * compiles CSS natively and has no PostCSS in it, so an app that does not want a plugin chain does not
- * install one.
+ * compiles CSS natively, so an app that does not want a plugin chain does not install one.
  */ const TAILWIND = {
     id: 'tailwind',
     overlays: [
@@ -3390,35 +3385,26 @@ function sorted(record) {
     return Object.fromEntries(Object.entries(record).sort(([a], [b])=>a < b ? -1 : 1));
 }
 /**
- * The install script every app inherits, from the framework rather than from anything it chose. tsx
- * reads `rshono.config.ts` through esbuild, and esbuild's script only picks the platform binary out of
- * the optional dependency that already carries it — rshono's own repo denies it for the same reason.
- */ const BASE_ALLOW_BUILDS = {
-    esbuild: false
-};
-/**
- * pnpm's settings for the new app — written for pnpm and for nobody else.
+ * pnpm's settings for the new app, written only when a feature has something to put in them. `null`
+ * means there is nothing to say, so no file is written.
  *
- * It exists for one field. A dependency with an install script is a question pnpm will not answer on its
- * own: it fails the install, and fails every `pnpm dev` after it, until the project has said whether the
- * script should run. None of the ones an rshono app inherits need to (each is a native package whose
- * binary arrives as an optional dependency), so a fresh app carries the answer rather than meeting
- * `pnpm approve-builds` before it has rendered a page once.
+ * It exists for one field, `allowBuilds`. pnpm fails an install — and every `pnpm dev` after it —
+ * until the project has said whether a dependency's install script should run. Nothing rshono itself
+ * installs has one, so most apps get no file; the packages that do (wrangler's esbuild and workerd)
+ * declare their answer on the feature that brings them.
  *
- * In this file rather than under a `pnpm` key in `package.json`, which pnpm 11 no longer reads, single-
- * package projects included. What lands here is a decision about *this* app: a scaffolded file the app
- * owns from then on, not something the framework reaches back into.
+ * A file rather than a `pnpm` key in `package.json`, which pnpm 11 no longer reads.
  */ function buildPnpmSettings(features) {
-    const allowBuilds = {
-        ...BASE_ALLOW_BUILDS
-    };
+    const allowBuilds = {};
     for (const feature of features)Object.assign(allowBuilds, feature.allowBuilds);
+    const entries = Object.entries(sorted(allowBuilds));
+    if (entries.length === 0) return null;
     return [
         '# Which dependencies may run an install script. pnpm runs none it has not been told about, and',
         '# fails the install rather than skip one quietly — so anything added later belongs here too.',
         '# `false` means the script was looked at: these ship their real binary as an optional dependency.',
         'allowBuilds:',
-        ...Object.entries(sorted(allowBuilds)).map(([name, allowed])=>`  ${name}: ${allowed}`),
+        ...entries.map(([name, allowed])=>`  ${name}: ${allowed}`),
         ''
     ].join('\n');
 }
@@ -3474,10 +3460,9 @@ function sorted(record) {
 ;// CONCATENATED MODULE: ./src/render.ts
 
 /**
- * `{{NAME}}`, and not the `__NAME__` this used to be. A template is a real file that real tools run
- * over, and in markdown `__NAME__` *is* strong emphasis — Prettier rewrites it to `**NAME**`, which
- * turns a token into literal text that no substitution will ever match again. `{{…}}` means nothing to
- * any of the formats these templates are written in.
+ * `{{NAME}}`, deliberately not `__NAME__`: templates are real files that real tools run over, and in
+ * markdown `__NAME__` *is* strong emphasis — Prettier rewrites it to `**NAME**` and the token stops
+ * matching. `{{…}}` means nothing to any format these templates are written in.
  */ const TOKEN_PATTERN = /\{\{[A-Z][A-Z\d_]*\}\}/g;
 function tokensFor(answers, pm) {
     return {
@@ -3522,10 +3507,9 @@ function readTemplateDir(dir) {
 /**
  * `_gitignore` → `.gitignore`, and so on for every dotfile.
  *
- * npm strips a literal `.gitignore` out of a published tarball, so a template cannot simply contain
- * one — the file would exist in the repo, pass every local test, and be missing from the package
- * everybody actually installs. Naming them with an underscore and renaming here is the long-standing
- * fix. It applies to the basename only, so `src/lib/_x.ts` is a dotfile but `templates/_x/y.ts` is not.
+ * npm strips a literal `.gitignore` out of a published tarball, so a template cannot contain one — it
+ * would exist in the repo, pass every local test, and be missing from the package everybody installs.
+ * Applies to the basename only, so `src/lib/_x.ts` is a dotfile but `templates/_x/y.ts` is not.
  */ function undotted(path) {
     const segments = path.split(posix.sep);
     const name = segments.pop();
@@ -3565,7 +3549,9 @@ function readTemplateDir(dir) {
     const gitignore = files.get('.gitignore');
     if (gitignore) files.set('.gitignore', appendGitignore(gitignore, features));
     files.set('package.json', buildPackageJson(answers, features, pm));
-    if (pm.name === 'pnpm') files.set('pnpm-workspace.yaml', buildPnpmSettings(features));
+    // Only for pnpm, and only when a feature brought an install script to answer for — see `buildPnpmSettings`.
+    const pnpmSettings = pm.name === 'pnpm' ? buildPnpmSettings(features) : null;
+    if (pnpmSettings) files.set('pnpm-workspace.yaml', pnpmSettings);
     return {
         // Sorted, so both the write order and a test's snapshot are stable.
         files: new Map([
@@ -3609,10 +3595,9 @@ function packageManager(name, version) {
     };
 }
 /**
- * Which package manager invoked us. Every one of them sets `npm_config_user_agent` for the process it
- * spawns, from its runner as much as from `create` — `pnpm/11.9.0 npm/? node/v22.14.0 darwin arm64` — so
- * `pnx @rshono/create` scaffolds a pnpm project without asking, and the exact version comes along for the
- * `packageManager` field.
+ * Which package manager invoked us. Every one of them sets `npm_config_user_agent` on the process it
+ * spawns — `pnpm/11.9.0 npm/? node/v22.14.0 darwin arm64` — so `pnx @rshono/create` scaffolds a pnpm
+ * project without asking, and the exact version comes along for the `packageManager` field.
  *
  * Falls back to npm, which is also what a bare `node bin/create-rshono.mjs` gets.
  */ function detectPackageManager(userAgent = process.env.npm_config_user_agent) {
@@ -3688,12 +3673,12 @@ function run(pm, args, cwd) {
     'Thumbs.db'
 ]);
 /**
- * What is already at the target path, which is what decides whether scaffolding into it is safe: the
- * entries already there, ignoring the ones a fresh clone or an editor leaves behind.
+ * What is already at the target path, ignoring the entries a fresh clone or an editor leaves behind —
+ * which is what decides whether scaffolding into it is safe.
  *
- * A path that does not exist yet is no conflict. A path that exists and is *not* a directory is not
- * something `--force` should be able to write into, so it throws rather than reporting an empty list —
- * otherwise `create-rshono README.md` gets as far as `mkdir` before failing on a raw ENOTDIR.
+ * A path that does not exist yet is no conflict. A path that exists and is *not* a directory throws
+ * rather than reporting an empty list, since `--force` should not write into one either — otherwise
+ * `create-rshono README.md` gets as far as `mkdir` before failing on a raw ENOTDIR.
  */ function conflictingEntries(dir) {
     const stats = statSync(dir, {
         throwIfNoEntry: false
@@ -3770,11 +3755,7 @@ function fail(message) {
     if (off) return false;
     return undefined;
 }
-/**
- * `parseArgs` rejects an unknown flag with a message that names it but nothing else — so a mistyped
- * `--tailwnid` reads as a wall of text about positional arguments. Pointing at `--help` is the whole
- * addition.
- */ function parse() {
+/** `parseArgs` names an unknown flag but says nothing about what to do next; this points at `--help`. */ function parse() {
     try {
         return parseArgs({
             options: {
@@ -3840,12 +3821,11 @@ function fail(message) {
 async function main() {
     const { values, positionals } = parse();
     if (values.help) return console.log(HELP);
-    if (values.version) return console.log("1.0.0-rc.7");
-    /*
-   * A pipe, a CI job or an agent gets the defaults rather than a prompt nothing can answer. Both streams
-   * have to be a terminal: the prompts draw on stdout but *read from stdin*, so `echo | npx @rshono/create`
-   * with stdout still attached would otherwise ask a question with nothing behind the keyboard.
-   */ const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY) && !values.yes;
+    if (values.version) return console.log("1.0.0-rc.8");
+    // A pipe, a CI job or an agent gets the defaults rather than a prompt nothing can answer. Both
+    // streams have to be a terminal: the prompts draw on stdout but *read from stdin*, so
+    // `echo | npx @rshono/create` would otherwise ask a question with nothing behind the keyboard.
+    const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY) && !values.yes;
     const pmFlag = oneOf(values.pm, PACKAGE_MANAGERS, 'pm');
     const pm = pmFlag ? packageManager(pmFlag) : detectPackageManager();
     const deployFlag = oneOf(values.deploy, DEPLOY_TARGET_NAMES, 'deploy');
@@ -3916,10 +3896,9 @@ async function main() {
             ]
         }));
     }
-    /*
-   * The preset asks one question instead of two. The two axes stay independent underneath — a
-   * `--formatter` or `--linter` flag addresses either on its own, and skips the question entirely.
-   */ let preset = QUALITY_PRESETS.find((candidate)=>candidate.id === qualityFlag);
+    // One question instead of two. The axes stay independent underneath: a `--formatter` or `--linter`
+    // flag addresses either on its own, and skips the question entirely.
+    let preset = QUALITY_PRESETS.find((candidate)=>candidate.id === qualityFlag);
     if (!preset && !formatterFlag && !linterFlag) {
         const fallback = QUALITY_PRESETS["0"];
         if (interactive) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rshono/create",
-  "version": "1.0.0-rc.7",
+  "version": "1.0.0-rc.8",
   "description": "Scaffold a new rshono app — Hono + Rspack + React Server Components",
   "author": "Lasse <lasse@lassetange.com> (https://www.lassetange.com)",
   "license": "ISC",
@@ -36,17 +36,17 @@
     "templates"
   ],
   "engines": {
-    "node": ">=22.1.0"
+    "node": ">=22.18.0"
   },
   "publishConfig": {
     "access": "public"
   },
   "devDependencies": {
     "@clack/prompts": "^1.7.0",
-    "@rspack/core": "2.1.5",
+    "@rspack/core": "2.1.7",
     "@types/node": "^26.1.1",
     "typescript": "^7.0.2",
-    "@rshono/core": "1.0.0-rc.7"
+    "@rshono/core": "1.0.0-rc.8"
   },
   "scripts": {
     "build": "node scripts/codegen.mjs && node scripts/build.mjs",

package/templates/base/src/server.ts

@@ -1,5 +1,7 @@
-import { onServerError } from '@rshono/core/server';
+import { onServerError, publicUrl } from '@rshono/core/server';
 import { Hono } from 'hono';
+import { bodyLimit } from 'hono/body-limit';
+import { csrf } from 'hono/csrf';
 import { trimTrailingSlash } from 'hono/trailing-slash';
 
 /**
@@ -14,6 +16,15 @@ onServerError((error, { source, request }) => {
   console.error(`[error] ${source} ${new URL(request.url).pathname}: ${message}`);
 });
 
+/** Caps every request body before anything downstream buffers it. Raise it where you accept uploads. */
+server.use(bodyLimit({ maxSize: 1024 * 1024 }));
+
+/** Cross-origin hosts allowed to post server actions, alongside this app's own. */
+const ALLOWED_ORIGINS: string[] = [];
+
+/** Rejects a cross-origin POST before it reaches a server action. `publicUrl(c)`, not `c.req.url`: behind a proxy those differ. */
+server.use(csrf({ origin: (origin, c) => origin === publicUrl(c).origin || ALLOWED_ORIGINS.includes(origin) }));
+
 /** `/about/` and `/about` should not be two pages. */
 server.use(trimTrailingSlash({ alwaysRedirect: true }));
 
@@ -24,6 +35,9 @@ for (const [from, to] of Object.entries(REDIRECTS)) {
   server.get(from, (c) => c.redirect(to, 301));
 }
 
+/** A JSON API route, with no page involved. The layout links to it. */
+server.get('/api/health', (c) => c.json({ status: 'ok' }));
+
 export default server;
 
 /** `hc<AppType>('/')` from `hono/client` gives paths, params and responses typed against the handlers above. */