@webjsdev/cli 0.10.33 → 0.10.34

package/lib/create.js

@@ -542,9 +542,12 @@ export async function scaffoldApp(name, cwd, opts = {}) {
     // Environment variables
     '.env.example',
     // Project-level gitignore (node_modules, .webjs, .env, OS junk).
-    // The SQLite dev.db rule is appended programmatically below so it
-    // only appears for the sqlite dialect.
-    '.gitignore',
+    // Shipped as `gitignore` (no dot) and renamed to `.gitignore` on copy:
+    // npm STRIPS a `.gitignore` from a published tarball, so a dotfile name
+    // would arrive missing and the app would ship without a `.env` ignore
+    // (dogfood #845). The SQLite dev.db rule is appended programmatically
+    // below so it only appears for the sqlite dialect.
+    'gitignore',
     // Git hooks (blocks commits on main)
     '.hooks/pre-commit',
     // Claude Code config + hooks
@@ -617,14 +620,17 @@ export async function scaffoldApp(name, cwd, opts = {}) {
   for (const f of templateFiles) {
     const src = join(TEMPLATES, f);
     if (existsSync(src)) {
-      await mkdir(dirname(join(appDir, f)), { recursive: true });
+      // `gitignore` ships without a dot (npm strips a published `.gitignore`)
+      // and is written to `.gitignore` in the generated app.
+      const dest = f === 'gitignore' ? '.gitignore' : f;
+      await mkdir(dirname(join(appDir, dest)), { recursive: true });
       let content = await readFile(src, 'utf8');
       content = content.replace(/\{\{APP_NAME\}\}/g, name);
       if (isBun) {
         if (PROSE_REWRITE.has(f)) content = bunifyProse(content);
         else if (FILE_REWRITE[f]) content = FILE_REWRITE[f](content);
       }
-      await writeFile(join(appDir, f), content);
+      await writeFile(join(appDir, dest), content);
     }
   }
 
@@ -837,7 +843,9 @@ export default defineConfig({
       const cur = await readFile(gitignore, 'utf8');
       if (!cur.includes('db/dev.db')) await writeFile(gitignore, cur + gitignoreExtra);
     } else {
-      await writeFile(gitignore, 'node_modules\n.webjs\n' + gitignoreExtra);
+      // Defense in depth: if the template gitignore is ever absent, still
+      // never leave a real `.env` trackable (dogfood #845).
+      await writeFile(gitignore, 'node_modules\n.webjs\n.env\n.env.*\n!.env.example\n' + gitignoreExtra);
     }
   }
 
@@ -1093,6 +1101,15 @@ export default function RootLayout({ children }: { children: unknown }) {
   const nonce = cspNonce();
   return html\`
     <script nonce="\${nonce}">
+      // ===== OPTIONAL: light/dark theme apparatus (remove as one unit) =====
+      // This IIFE reads the saved or OS theme and toggles the data-theme
+      // attribute plus the dark class the ui kit reads, so the token VALUES in
+      // the root, dark, and data-theme style blocks below switch. It is what
+      // makes the app theme-aware. Building a SINGLE-theme app of your own?
+      // Delete this IIFE, delete the dark and light style blocks below, and set
+      // your palette once on the root selector. That removes the wiring so it
+      // cannot fight your own colours (it will not override a plain root
+      // palette). The header-measure IIFE that follows is unrelated, keep it.
       (function(){
         try {
           var mq = window.matchMedia('(prefers-color-scheme: light)');
@@ -1112,6 +1129,7 @@ export default function RootLayout({ children }: { children: unknown }) {
           mq.addEventListener('change', apply);
         } catch (_) {}
       })();
+      // ===== end optional theme apparatus =====
       // The header is position:fixed (not sticky): a sticky header flickers on
       // iOS WebKit during a client-router nav. fixed leaves normal flow, so
       // --header-h reserves its height for the content below. Measured here so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/cli",
-  "version": "0.10.33",
+  "version": "0.10.34",
   "type": "module",
   "description": "webjs CLI - dev, start, create, db",
   "bin": {

package/templates/CONVENTIONS.md

@@ -928,7 +928,11 @@ global light-DOM namespace.
 
 Every page wraps its output in `<div class="page-<route>">`. Every
 layout wraps in `<div class="layout-<name>">`. Components scope via
-their tag. Styles colocate as `const STYLES = css\`…\`` + `<style>${'$'}{STYLES.text}</style>`.
+their tag. In a PAGE or LAYOUT (which render server-only and never
+hydrate) styles colocate as `const STYLES = css\`…\`` + `<style>${'$'}{STYLES.text}</style>`.
+In a COMPONENT, do NOT interpolate into `<style>` (the client drops the
+raw-text hole on hydrate, so the styles vanish); use `static styles =
+css\`…\`` or Tailwind classes instead.
 
 ```ts
 // app/dashboard/page.ts

package/templates/gitignore

@@ -0,0 +1,68 @@
+# deps
+node_modules/
+
+# webjs / framework caches.
+# `.webjs/routes.d.ts` (the generated route-types overlay, regenerated per
+# machine by `webjs types` / `webjs dev`) is correctly ignored by `**/.webjs/*`.
+# `.webjs/vendor/` is the EXCEPTION: it holds the committed importmap
+# manifest (.webjs/vendor/importmap.json) and optionally the vendored
+# bundle files (after `webjs vendor pin --download`). Both ship to
+# production via source control so the server doesn't need
+# api.jspm.io reachable at boot. Pattern is `**/.webjs/*` ignored,
+# `.webjs/vendor/` un-ignored, mirroring Rails' config/importmap.rb
+# + vendor/javascript/ being committed.
+#
+# DO NOT "simplify" the three lines below to `.webjs/`. Git's
+# gitignore semantics excludes the parent first; once the parent is
+# excluded, no `!**/.webjs/vendor/` negation can ever re-include children
+# (the failure is silent: `webjs vendor pin` runs, writes files, and
+# git ignores them with no warning). The `gitignore-vendor-not-ignored`
+# lint rule (run via `webjs check`) verifies this with
+# `git check-ignore` and will fail CI if the pattern regresses.
+#
+# The `**/` prefix matches `.webjs/` at ANY depth, not just this app's
+# root. A slash-bearing `.webjs/*` anchors to this file's directory, so
+# an app nested below its repo root (a monorepo package) would leak its
+# generated `.webjs/routes.d.ts` into `git status`. `**/.webjs/*` covers
+# the nested case while the negations still re-include vendor at each
+# depth (a re-included parent dir permits a child negation).
+**/.webjs/*
+!**/.webjs/vendor/
+!**/.webjs/vendor/**
+
+# generated Tailwind CSS, built from public/input.css via npm run dev / start
+public/tailwind.css
+
+# env (.env.example stays tracked; the real .env never is)
+.env
+.env.*
+!.env.example
+
+# logs
+*.log
+npm-debug.log*
+
+# OS
+.DS_Store
+Thumbs.db
+
+# editors
+# `.vscode/*` ignored, but `.vscode/settings.json` (the webjs-config JSON
+# Schema association, #259) is committed so the editor validates package.json's
+# webjs block out of the box. Same gitignore shape as `.webjs/*` above: a bare
+# `.vscode/` would exclude the directory and no negation could re-include a
+# child, so the settings file would silently never ship.
+.vscode/*
+!.vscode/settings.json
+.idea/
+
+# test artifacts
+coverage/
+
+# AI assistants: local session state, scheduled-task locks, etc.
+# Repo-shared config (settings.json + hooks scripts) stays tracked so
+# every contributor and agent gets the same PreToolUse rules.
+.claude/*
+!.claude/settings.json
+!.claude/hooks/
+!.claude/hooks/**