create-daloy 0.1.20 → 0.1.21

package/bin/create-daloy.mjs

@@ -521,9 +521,15 @@ function rewriteScriptsForPackageManager(scripts, pm) {
 
 async function normalizePackageManagerFiles(dir, packageManager) {
   if (packageManager === "pnpm") return;
-  const npmrcPath = path.join(dir, ".npmrc");
-  if (!existsSync(npmrcPath)) return;
-  await rm(npmrcPath, { force: true });
+  // The hardened `.npmrc` and `pnpm-workspace.yaml` only make sense for pnpm.
+  // Removing them keeps npm/yarn/bun scaffolds from inheriting pnpm-specific
+  // settings the chosen package manager would either ignore or misinterpret.
+  for (const file of [".npmrc", "pnpm-workspace.yaml"]) {
+    const target = path.join(dir, file);
+    if (existsSync(target)) {
+      await rm(target, { force: true });
+    }
+  }
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",

package/templates/bun-basic/pnpm-workspace.yaml

@@ -0,0 +1,25 @@
+# pnpm workspace-level supply-chain settings.
+#
+# This file is here even though the default package manager for this
+# template is Bun, because users can switch to pnpm with
+# `pnpm create daloy --package-manager pnpm`. When that happens, the
+# scaffolder keeps this file so pnpm 11+ picks up the workspace-level
+# supply-chain controls below. If you keep using Bun, you can delete it.
+#
+# pnpm 11+ reads `pnpm-workspace.yaml` as a settings file even when no
+# `packages:` list is declared. It is the only file format that accepts
+# the v11 keys below (`.npmrc` cannot express them).
+#
+# See the DaloyJS supply-chain notes and the 2026-05-11 TanStack
+# postmortem (https://tanstack.com/blog/npm-supply-chain-compromise-postmortem)
+# for why every setting below is on by default.
+
+# Wait 24h (1440 minutes) before resolving a freshly published version.
+# Most npm worm campaigns are detected and unpublished within hours.
+# Set to 0 only for a real hotfix.
+minimumReleaseAge: 1440
+
+# Only direct dependencies may use exotic sources (git, tarball URLs).
+# Transitive deps must resolve from the configured registry, which makes
+# typosquatted-tarball and compromised-fork attacks much harder to land.
+blockExoticSubdeps: true

package/templates/cloudflare-worker/pnpm-workspace.yaml

@@ -0,0 +1,24 @@
+# pnpm workspace-level supply-chain settings.
+#
+# This file looks unusual in a single-package project, but pnpm 11+ reads
+# `pnpm-workspace.yaml` as a settings file even when no `packages:` list
+# is declared. It is the only file format that accepts the v11 keys
+# below (`.npmrc` cannot express them).
+#
+# See the DaloyJS supply-chain notes and the 2026-05-11 TanStack
+# postmortem (https://tanstack.com/blog/npm-supply-chain-compromise-postmortem)
+# for why every setting below is on by default.
+#
+# Want a real monorepo? Add a `packages:` key listing your sub-package
+# globs (e.g. `packages: ["apps/*", "packages/*"]`) and the keys below
+# will continue to apply.
+
+# Wait 24h (1440 minutes) before resolving a freshly published version.
+# Most npm worm campaigns are detected and unpublished within hours.
+# Set to 0 only for a real hotfix.
+minimumReleaseAge: 1440
+
+# Only direct dependencies may use exotic sources (git, tarball URLs).
+# Transitive deps must resolve from the configured registry, which makes
+# typosquatted-tarball and compromised-fork attacks much harder to land.
+blockExoticSubdeps: true

package/templates/node-basic/pnpm-workspace.yaml

@@ -0,0 +1,24 @@
+# pnpm workspace-level supply-chain settings.
+#
+# This file looks unusual in a single-package project, but pnpm 11+ reads
+# `pnpm-workspace.yaml` as a settings file even when no `packages:` list
+# is declared. It is the only file format that accepts the v11 keys
+# below (`.npmrc` cannot express them).
+#
+# See the DaloyJS supply-chain notes and the 2026-05-11 TanStack
+# postmortem (https://tanstack.com/blog/npm-supply-chain-compromise-postmortem)
+# for why every setting below is on by default.
+#
+# Want a real monorepo? Add a `packages:` key listing your sub-package
+# globs (e.g. `packages: ["apps/*", "packages/*"]`) and the keys below
+# will continue to apply.
+
+# Wait 24h (1440 minutes) before resolving a freshly published version.
+# Most npm worm campaigns are detected and unpublished within hours.
+# Set to 0 only for a real hotfix.
+minimumReleaseAge: 1440
+
+# Only direct dependencies may use exotic sources (git, tarball URLs).
+# Transitive deps must resolve from the configured registry, which makes
+# typosquatted-tarball and compromised-fork attacks much harder to land.
+blockExoticSubdeps: true

package/templates/vercel-edge/pnpm-workspace.yaml

@@ -0,0 +1,24 @@
+# pnpm workspace-level supply-chain settings.
+#
+# This file looks unusual in a single-package project, but pnpm 11+ reads
+# `pnpm-workspace.yaml` as a settings file even when no `packages:` list
+# is declared. It is the only file format that accepts the v11 keys
+# below (`.npmrc` cannot express them).
+#
+# See the DaloyJS supply-chain notes and the 2026-05-11 TanStack
+# postmortem (https://tanstack.com/blog/npm-supply-chain-compromise-postmortem)
+# for why every setting below is on by default.
+#
+# Want a real monorepo? Add a `packages:` key listing your sub-package
+# globs (e.g. `packages: ["apps/*", "packages/*"]`) and the keys below
+# will continue to apply.
+
+# Wait 24h (1440 minutes) before resolving a freshly published version.
+# Most npm worm campaigns are detected and unpublished within hours.
+# Set to 0 only for a real hotfix.
+minimumReleaseAge: 1440
+
+# Only direct dependencies may use exotic sources (git, tarball URLs).
+# Transitive deps must resolve from the configured registry, which makes
+# typosquatted-tarball and compromised-fork attacks much harder to land.
+blockExoticSubdeps: true