@webjsdev/cli 0.10.24 → 0.10.26

package/README.md

@@ -33,7 +33,7 @@ npx @webjsdev/cli create my-app
 cd my-app && npm run dev
 ```
 
-Both `webjs create` and `create-webjs-app` auto-install dependencies in the new directory using your detected package manager (npm / pnpm / yarn / bun). Pass `--no-install` to opt out.
+`webjs create` installs dependencies in the new directory by default on **Node** (it needs `node_modules` to run). On **Bun** it **skips** the install (zero-install: `bun run dev` resolves deps on the fly). Pass `--install` to force the install, or `--no-install` to skip it, on either runtime.
 
 ## Commands
 

package/bin/webjs.js

@@ -50,12 +50,12 @@ const USAGE = `webjs commands:
   webjs doctor                                    Verify project health (Node, tsconfig, env, vendor pins, importmap coherence, @webjsdev versions, git hook, page/layout elision)
   webjs types                                     Generate .webjs/routes.d.ts (typed Route union + per-route params)
   webjs typecheck [tsc args...]                   Type-check the app with the project's tsc --noEmit (non-zero on errors)
-  webjs create <name> [--template full-stack|api|saas] [--db sqlite|postgres] [--runtime node|bun] [--no-install]  Scaffold a new webjs app
+  webjs create <name> [--template full-stack|api|saas] [--db sqlite|postgres] [--runtime node|bun] [--install|--no-install]  Scaffold a new webjs app
                                                   (only 3 templates exist. default: full-stack, Drizzle, --db sqlite, --runtime node)
                                                   --runtime bun emits a Bun-flavored app (bun.lock, bun Dockerfile/CI, bun docs);
                                                   also auto-detected when run via "bun create webjs".
-                                                  Auto-runs the detected package manager's install in the new dir
-                                                  unless --no-install is passed.
+                                                  Install default is per runtime: Node installs; Bun skips (zero-install,
+                                                  "bun run dev" resolves deps on the fly). --install / --no-install override.
   webjs db generate                               Generate a SQL migration from the schema (drizzle-kit generate)
   webjs db migrate                                Apply pending migrations (drizzle-kit migrate)
   webjs db push                                   Push the schema straight to the dev DB (drizzle-kit push)
@@ -521,7 +521,11 @@ files.
 Full docs: https://docs.webjs.com`);
         process.exit(1);
       }
+      // Install policy (#682). Default per runtime: Node installs (needs
+      // node_modules to run); Bun skips (zero-install, `bun run dev` resolves
+      // on the fly). `--install` / `--no-install` override either way.
       const noInstall = rest.includes('--no-install');
+      const explicitInstall = rest.includes('--install');
       // --db picks the database dialect: sqlite (default) or postgres.
       const db = flag(rest, '--db', 'sqlite');
       // --runtime picks the target runtime: node (default) or bun. Orthogonal
@@ -532,8 +536,9 @@ Full docs: https://docs.webjs.com`);
         console.error(`Error: unknown --runtime '${runtime}'. Only node / bun are supported.`);
         process.exit(1);
       }
-      const { scaffoldApp } = await import('../lib/create.js');
-      await scaffoldApp(name, process.cwd(), { template, db, runtime, install: !noInstall });
+      const { scaffoldApp, resolveCreateInstall } = await import('../lib/create.js');
+      const install = resolveCreateInstall({ runtime, explicitInstall, noInstall });
+      await scaffoldApp(name, process.cwd(), { template, db, runtime, install });
       break;
     }
     case 'vendor': {

package/lib/create.js

@@ -14,7 +14,7 @@
 import { mkdir, writeFile, readFile, cp } from 'node:fs/promises';
 import { join, resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { spawnSync } from 'node:child_process';
 import { bunifyProse, bunifyDockerfile, bunifyCompose, bunifyCi } from './runtime-rewrite.js';
@@ -35,6 +35,86 @@ function detectPackageManager() {
   return 'npm';
 }
 
+/**
+ * Decide whether `webjs create` runs the post-scaffold install, per target
+ * runtime (#682). Node installs by default (it needs `node_modules` to run);
+ * Bun SKIPS by default (zero-install: `bun run dev` resolves deps on the fly,
+ * #675). Under Bun zero-install webjs pins a declared dep to its package.json
+ * version via the #685/#698 onLoad rewrite (a caret range now resolves the
+ * highest match, not absolute latest), so `bun install` is the path to a frozen
+ * lockfile, not a correctness fix. Explicit flags win: `--install` forces it
+ * on, `--no-install` forces it off. The CLI entry points call this and pass an
+ * explicit boolean to `scaffoldApp`, so the library default (no install unless
+ * `install: true`) is unchanged for programmatic callers.
+ *
+ * @param {{ runtime?: string, explicitInstall?: boolean, noInstall?: boolean }} [o]
+ * @returns {boolean}
+ */
+export function resolveCreateInstall({ runtime, explicitInstall, noInstall } = {}) {
+  if (explicitInstall) return true;
+  if (noInstall) return false;
+  const isBun = runtime === 'bun' || (!runtime && detectPackageManager() === 'bun');
+  return !isBun;
+}
+
+/**
+ * Read the EXACT version of `@webjsdev/<pkg>` the scaffolding CLI ships with.
+ * `webjsdevRange` carets over this for the generated `package.json` (#700), so a
+ * fresh app tracks the line the CLI shipped. Walks the `require.resolve` node_modules search paths
+ * and fs-reads `<pkg>/package.json` directly: `@webjsdev/server` (and `ui`) hide
+ * `./package.json` behind `exports`, so a bare `require('<pkg>/package.json')`
+ * fails (same constraint #687 hit). Falls back to `'latest'` when the package is
+ * not resolvable (defensive; the CLI's own dependency closure is normally
+ * present), which keeps the scaffold working rather than emitting a bad pin.
+ * @param {string} pkg  e.g. 'cli', 'core', 'server'
+ * @returns {string}  an exact version, or 'latest'
+ */
+function webjsdevVersion(pkg) {
+  const req = createRequire(import.meta.url);
+  for (const base of (req.resolve.paths(`@webjsdev/${pkg}`) || [])) {
+    const pj = join(base, '@webjsdev', pkg, 'package.json');
+    if (existsSync(pj)) {
+      try {
+        const v = JSON.parse(readFileSync(pj, 'utf8')).version;
+        if (v) return v;
+      } catch { /* unreadable; keep looking, then fall back */ }
+    }
+  }
+  return 'latest';
+}
+
+/**
+ * The `@webjsdev/<pkg>` specifier for the generated `package.json` (#700): a
+ * caret range over the version the scaffolding CLI ships with, so a fresh app
+ * picks up patch updates the way an npm user expects (a `^0.x` caret stays
+ * within the minor). Bun zero-install resolves a normal caret range correctly
+ * since #698, so this no longer diverges from npm. Falls back to `'latest'` when
+ * the version is not resolvable (keeps `^latest` from ever being emitted).
+ * @param {string} pkg  e.g. 'cli', 'core', 'server'
+ * @returns {string}
+ */
+function webjsdevRange(pkg) {
+  const v = webjsdevVersion(pkg);
+  return v === 'latest' ? 'latest' : '^' + v;
+}
+
+/**
+ * Third-party dep specifiers the scaffold ships (#700). These are template deps
+ * the CLI does NOT itself depend on, so they cannot be read from the CLI's
+ * closure (unlike `@webjsdev/*`). Since #698, Bun zero-install resolves a normal
+ * caret range correctly (highest match, not absolute latest), so `pg` is an
+ * idiomatic `^` range. Drizzle is PINNED to an exact RC: its 1.0 line is a
+ * PRERELEASE (`1.0.0-rc.3`), and Bun zero-install ENOENTs on a caret-prerelease
+ * inline specifier (`drizzle-orm@^1.0.0-rc.3`, verified on Bun 1.3.14) while the
+ * exact prerelease resolves, so drizzle must stay exact until the 1.0 stable
+ * ships. Refresh on a deliberate bump.
+ */
+const SCAFFOLD_DEP_VERSIONS = {
+  'drizzle-orm': '1.0.0-rc.3',
+  'drizzle-kit': '1.0.0-rc.3',
+  pg: '^8.22.0',
+};
+
 /**
  * Run `<pm> install` inside the scaffolded app. Returns true on success.
  * Inherits stdio so the user sees the install progress live. Caller decides
@@ -356,14 +436,20 @@ export async function scaffoldApp(name, cwd, opts = {}) {
       // for relations v2. SQLite needs NO driver dependency: the connection
       // uses the built-in node:sqlite (Node) / bun:sqlite (Bun) via Drizzle's
       // node-sqlite / bun-sqlite adapters. Postgres still needs the pg driver.
-      'drizzle-orm': '^1.0.0-rc.3',
-      ...(dialect === 'postgres' ? { pg: '^8.13.0' } : {}),
-      '@webjsdev/cli': 'latest',
-      '@webjsdev/core': 'latest',
-      '@webjsdev/server': 'latest',
+      // Since #698 a normal caret range resolves correctly under bun
+      // zero-install, so @webjsdev/* and pg are idiomatic `^` ranges (#700).
+      // Drizzle stays EXACT: its 1.0 line is a prerelease RC, and bun ENOENTs
+      // on a caret-prerelease inline specifier, so a range would break it.
+      'drizzle-orm': SCAFFOLD_DEP_VERSIONS['drizzle-orm'],
+      ...(dialect === 'postgres' ? { pg: SCAFFOLD_DEP_VERSIONS.pg } : {}),
+      '@webjsdev/cli': webjsdevRange('cli'),
+      '@webjsdev/core': webjsdevRange('core'),
+      '@webjsdev/server': webjsdevRange('server'),
     },
     devDependencies: {
-      'drizzle-kit': '^1.0.0-rc.3',
+      // Exact pin: drizzle-kit shares drizzle-orm's prerelease 1.0 RC, which bun
+      // cannot resolve as a caret-prerelease range, so it stays exact (#700).
+      'drizzle-kit': SCAFFOLD_DEP_VERSIONS['drizzle-kit'],
       ...(dialect === 'postgres' ? { '@types/pg': '^8.11.0' } : {}),
       // The TypeScript compiler, for `npm run typecheck` (webjs typecheck runs
       // tsc --noEmit). Not needed at runtime (Node strips types in place), only
@@ -1404,6 +1490,13 @@ For AI agents, read this before editing scaffolded files:
     if (!installed) {
       console.log(`\n[warn] ${pm} install failed. Run '${pm} install' manually in ${name}/ to finish setup.\n`);
     }
+  } else if (isBun) {
+    // Bun zero-install (#675): no install needed; `bun run dev` resolves deps on
+    // the fly. Since #698 they resolve to their package.json versions (a caret
+    // range to its highest match), so point at `bun install` for a frozen
+    // lockfile and editor type intelligence, not a correctness fix.
+    console.log(`Skipped install. Bun resolves dependencies on the fly, so 'bun run dev' and 'bun run start' work as-is (no node_modules).`);
+    console.log(`These resolve to the versions in package.json. Run 'bun install' in ${name}/ to freeze a lockfile and get editor type intelligence.\n`);
   }
 
   // Next-steps banner prints LAST so the actionable command is the
@@ -1415,7 +1508,10 @@ For AI agents, read this before editing scaffolded files:
   // generate + migrate before the first run (the example User model wants
   // its table to exist). Drizzle splits Prisma's `migrate dev` into
   // `db:generate` (schema to SQL) then `db:migrate` (apply).
-  const installSegment = installed ? '' : `${pm} install && `;
+  // Omit the install step from the next-steps line for a deliberate Bun
+  // zero-install (#682): `bun run dev` resolves deps on the fly, so it works
+  // without an install. Otherwise (Node, or an install that did not run) keep it.
+  const installSegment = (installed || (isBun && !shouldInstall)) ? '' : `${pm} install && `;
   const dbSegment = isSaas ? `${pm} run db:generate && ${pm} run db:migrate && ` : '';
   const runCommand = `cd ${name} && ${installSegment}${dbSegment}${pm} run dev`;
   // Use `npx webjsdev ui ...` here, not `npx webjs ui ...`. The bare

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/cli",
-  "version": "0.10.24",
+  "version": "0.10.26",
   "type": "module",
   "description": "webjs CLI - dev, start, create, db",
   "bin": {

package/templates/AGENTS.md

@@ -414,9 +414,18 @@ demand and **no `bun install` is needed**:
 bun run dev            # or: bun run start  (no install step required)
 ```
 
-`bun install` is optional here, run it for editor type intelligence or a pinned
-offline install. (To run a Node-flavored app on Bun instead, force `bun --bun run
-dev`, which still expects an install.)
+`bun create` does not run an install on Bun, so a fresh app serves immediately.
+Under zero-install, Bun's runtime auto-install resolves a BARE import to LATEST
+(it ignores `package.json` and `bun.lock`), so webjs rewrites each declared dep's
+specifier to an inline-versioned one via an `onLoad` transform. The version is the
+`bun.lock` exact when present, else the `package.json` value when it is an
+inline-safe semver (an exact pin, or a caret / tilde / comparator range, which
+Bun resolves to the highest match). A protocol range (`workspace:`, `file:`), a
+wildcard (`*`), and a dist-tag (`latest`) stay at latest. Run `bun install` when
+you want versions frozen identically across machines (it materializes
+`node_modules` from the lockfile) or editor type intelligence. (To run a
+Node-flavored app on Bun instead, force `bun --bun run dev`, which still expects
+an install.)
 
 On Node the `.ts` type-stripping is the built-in `module.stripTypeScriptTypes`;
 on Bun (which has no built-in) it comes from `amaro` automatically, so the same