create-bestax 3.8.0 → 4.0.1

package/README.md

@@ -3,11 +3,21 @@
 [![npm version](https://img.shields.io/npm/v/create-bestax.svg)](https://www.npmjs.com/package/create-bestax)
 [![npm downloads](https://img.shields.io/npm/dm/create-bestax.svg)](https://www.npmjs.com/package/create-bestax)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![Socket Badge](https://socket.dev/api/badge/npm/package/create-bestax)](https://socket.dev/npm/package/create-bestax/overview)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/allxsmith/bestax/badge)](https://scorecard.dev/viewer/?uri=github.com/allxsmith/bestax)
+[![npm provenance](https://img.shields.io/badge/npm-provenance-3fb950.svg)](https://www.npmjs.com/package/create-bestax#provenance)
+[![Security policy](https://img.shields.io/badge/security-policy-blue.svg)](https://github.com/allxsmith/bestax/blob/main/SECURITY.md)
 
 The scaffolder for [`@allxsmith/bestax-bulma`](https://www.npmjs.com/package/@allxsmith/bestax-bulma) — spin up a Vite app pre-wired for the **Bulma v1** React component library in one command. Picks your framework (JS or TypeScript), CSS flavor, and icon library, and can drop in the bestax **AI skills** so an agent like Claude Code knows the library from the first prompt.
 
 Part of the [bestax monorepo](https://github.com/allxsmith/bestax) — see also [`@allxsmith/bestax-bulma`](https://www.npmjs.com/package/@allxsmith/bestax-bulma) for the components themselves.
 
+## Requirements
+
+- **Node.js 22 or newer.** Node 18 and 20 are both past end-of-life. On an older runtime the
+  CLI exits immediately with an explicit upgrade message.
+- npm 10 or newer (ships with Node 22), or yarn/pnpm.
+
 ## Usage
 
 ### Quick Start
@@ -127,6 +137,20 @@ npm run typecheck # Type check CLI source code
 
 **Note on Templates:** Template files in `templates/` are excluded from linting. They should be manually validated by scaffolding a test project and running lint/build there before releasing.
 
+## Hardened by default
+
+A scaffolder runs with write access to your filesystem and picks your starting dependencies, so how it is built and published matters:
+
+- **Signed provenance** — every release carries a sigstore attestation linking the tarball to the exact commit and CI run that built it. Check the **Provenance** section on the [npm page](https://www.npmjs.com/package/create-bestax#provenance), or run `npm audit signatures`.
+- **npm OIDC trusted publishing** — short-lived, per-run credentials; no long-lived `NPM_TOKEN` exists to be stolen. Release commits and tags are GPG-signed.
+- **Socket.dev scans every PR** for malware, install scripts, obfuscated code, and privilege escalation before it can reach `main`.
+- **Dependencies are a deliberate act** — install scripts are blocked unless individually allow-listed, freshly published versions are refused for 3 days, and CI installs only what the reviewed lockfile resolves.
+- **Every GitHub Action is pinned to a full commit SHA**, so a compromised action release can't roll silently into a build of this CLI.
+- **CodeQL, Dependency Review, and Dependabot** run continuously, alongside a high-severity `pnpm audit` gate.
+- **Layered AI review before merge** — [CodeRabbit](https://coderabbit.ai) plus an independent adversarial Claude review (a different model from the one writing AI-authored changes), on top of required green CI, an approving review, and a human merge.
+
+Full detail: [`SECURITY.md`](https://github.com/allxsmith/bestax/blob/main/SECURITY.md) · [Security guide](https://bestax.io/docs/guides/security)
+
 ## Publishing
 
 This package uses semantic-release with scope-based rules. Only commits with `feat(create-bestax)` or `fix(create-bestax)` will trigger releases.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAuBA,OAAO,EAAE,CAAC"}

package/dist/index.js

@@ -1,15 +1,20 @@
 #!/usr/bin/env node
-import { createCLI } from './cli.js';
-import chalk from 'chalk';
-// Check Node.js version requirement (Breaking change for v2.0.0)
+// The version guard deliberately runs before anything else is imported, and
+// deliberately does not use chalk. `import` declarations are hoisted and
+// evaluated before any statement in this module, and chalk >= 6 itself
+// requires Node >= 22 — so a static import would fail to load on exactly the
+// runtimes this guard exists to catch, replacing the message below with an
+// opaque loader error. ./cli.js is pulled in dynamically for the same reason.
 const currentNodeVersion = process.versions.node;
 const majorVersion = parseInt(currentNodeVersion.split('.')[0], 10);
-const MINIMUM_NODE_VERSION = 18;
+const MINIMUM_NODE_VERSION = 22;
 if (majorVersion < MINIMUM_NODE_VERSION) {
-    console.error(chalk.red(`Error: create-bestax requires Node.js v${MINIMUM_NODE_VERSION}.0.0 or higher.\n` +
+    console.error(`Error: create-bestax requires Node.js v${MINIMUM_NODE_VERSION}.0.0 or higher.\n` +
         `You are currently running Node.js v${currentNodeVersion}.\n` +
-        `Please upgrade your Node.js version.`));
+        `Please upgrade your Node.js version.`);
     process.exit(1);
 }
+const { createCLI } = await import('./cli.js');
 const program = createCLI();
 program.parse();
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-bestax",
-  "version": "3.8.0",
+  "version": "4.0.1",
   "description": "Create a new bestax-bulma project",
   "type": "module",
   "bin": {
@@ -40,7 +40,7 @@
   "author": "Alex Smith",
   "license": "MIT",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22"
   },
   "repository": {
     "type": "git",
@@ -53,22 +53,22 @@
     "url": "https://github.com/allxsmith/bestax/issues"
   },
   "dependencies": {
-    "chalk": "^5.6.2",
+    "chalk": "^6.0.0",
     "commander": "^15.0.0",
     "figures": "^6.1.0",
-    "fs-extra": "^11.2.0",
+    "fs-extra": "^11.4.0",
     "prompts": "^2.4.2"
   },
   "devDependencies": {
     "@jest/globals": "^30.0.0",
-    "@playwright/test": "^1.57.0",
+    "@playwright/test": "^1.62.0",
     "@types/fs-extra": "^11.0.4",
     "@types/jest": "^30.0.0",
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.1.2",
     "@types/prompts": "^2.4.9",
     "@types/wait-on": "^5.3.4",
     "jest": "^30.2.0",
-    "ts-jest": "^29.4.6",
+    "ts-jest": "^29.4.12",
     "typescript": "^6.0.3",
     "wait-on": "^9.1.0"
   },

package/templates/skills/bestax-form/SKILL.md

@@ -144,17 +144,16 @@ function SignupForm() {
   const [email, setEmail] = useState('');
   const [touched, setTouched] = useState(false);
 
+  const valid = /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email);
   const error =
-    touched && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)
-      ? 'Please enter a valid email address.'
-      : undefined;
+    touched && !valid ? 'Please enter a valid email address.' : undefined;
 
   return (
     <form
       onSubmit={e => {
         e.preventDefault();
         setTouched(true);
-        if (!error && email) {
+        if (valid) {
           // submit…
         }
       }}
@@ -169,6 +168,8 @@ function SignupForm() {
         message={error}
         messageColor={error ? 'danger' : undefined}
         iconLeftName="envelope"
+        id="signup-email"
+        labelProps={{ htmlFor: 'signup-email' }}
       />
       <Button color="primary" type="submit" mt="3">
         Sign up