create-daloy 0.41.0 → 0.43.0

package/bin/create-daloy.mjs

@@ -3,8 +3,8 @@
 // Zero runtime dependencies; uses only Node built-ins.
 
 import { spawn } from "node:child_process";
-import { existsSync, openSync } from "node:fs";
-import { mkdir, readdir, readFile, writeFile, copyFile, rm, stat, chmod } from "node:fs/promises";
+import { existsSync, openSync, constants as FS_CONSTANTS } from "node:fs";
+import { mkdir, readdir, readFile, writeFile, copyFile, rm, stat, chmod, access } from "node:fs/promises";
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { ReadStream as TtyReadStream } from "node:tty";
@@ -466,6 +466,100 @@ function detectPackageManager() {
   return "pnpm";
 }
 
+// ----------------------------------------------------------------------------
+// Tooling presence checks.
+//
+// A scaffolded project is only useful if the runtime and package manager its
+// "Next steps" reference are actually installed. When the user picks a path
+// whose CLI is missing from PATH (e.g. `bun-basic` on a machine without Bun, or
+// pnpm on a fresh box), we surface the official install link instead of letting
+// `pnpm run dev` or the dependency install fail with a cryptic spawn error.
+// ----------------------------------------------------------------------------
+
+// Official install guides for every runtime and package manager the scaffolder
+// can target. Keyed by the bare executable name we probe for on PATH.
+const TOOL_INSTALL_GUIDES = {
+  node: { label: "Node.js", url: "https://nodejs.org" },
+  npm: { label: "npm", url: "https://nodejs.org" },
+  pnpm: { label: "pnpm", url: "https://pnpm.io/installation" },
+  yarn: { label: "Yarn", url: "https://yarnpkg.com/getting-started/install" },
+  bun: { label: "Bun", url: "https://bun.sh" },
+  deno: { label: "Deno", url: "https://docs.deno.com/runtime/getting_started/installation/" },
+};
+
+/**
+ * Compute the CLIs a freshly-scaffolded project needs to run, given the chosen
+ * template (which fixes the runtime) and package manager. Runtime-only
+ * templates such as `deno-basic` drive the runtime directly, so they need the
+ * runtime but no npm-style package manager.
+ *
+ * @param {object} selection
+ * @param {string} selection.template - resolved template value, e.g. `node-basic`.
+ * @param {string} [selection.packageManager] - chosen package manager (pnpm/npm/yarn/bun).
+ * @param {boolean} [selection.skipPackageManager] - true for runtime-only templates (deno).
+ * @returns {string[]} bare executable names the scaffold depends on, deduped.
+ */
+function requiredTools({ template, packageManager, skipPackageManager }) {
+  const tools = new Set();
+  if (template === "bun-basic") tools.add("bun");
+  else if (template === "deno-basic") tools.add("deno");
+  else tools.add("node");
+  if (!skipPackageManager && packageManager) tools.add(packageManager);
+  return [...tools];
+}
+
+/**
+ * Resolve whether an executable is reachable on PATH **without executing it**.
+ * We scan each PATH entry for a matching file and check it is executable
+ * (POSIX) or simply present (Windows, where `PATHEXT` governs runnability).
+ * Avoiding a spawn keeps the check fast, side-effect-free, and immune to a
+ * misbehaving binary hanging the scaffolder.
+ *
+ * @param {string} binary - bare command name, e.g. `pnpm` or `node`.
+ * @param {NodeJS.ProcessEnv} [env=process.env] - environment to read PATH from.
+ * @returns {Promise<boolean>} true when a runnable match is found on PATH.
+ */
+async function isToolInstalled(binary, env = process.env) {
+  const pathValue = env.PATH ?? env.Path ?? "";
+  if (!pathValue) return false;
+  const dirs = pathValue.split(path.delimiter).filter(Boolean);
+  const isWindows = process.platform === "win32";
+  const extensions = isWindows
+    ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").map((ext) => ext.trim()).filter(Boolean)
+    : [""];
+  const mode = isWindows ? FS_CONSTANTS.F_OK : FS_CONSTANTS.X_OK;
+  for (const dir of dirs) {
+    for (const ext of extensions) {
+      try {
+        await access(path.join(dir, `${binary}${ext}`), mode);
+        return true;
+      } catch {
+        // Not in this PATH entry (or not executable); keep scanning.
+      }
+    }
+  }
+  return false;
+}
+
+/**
+ * Filter `tools` down to those that are not installed, pairing each with its
+ * official install guide. The `isInstalled` predicate is injected so the
+ * resolution stays unit-testable without touching the real PATH.
+ *
+ * @param {string[]} tools - bare executable names to probe (see {@link requiredTools}).
+ * @param {(binary: string) => boolean | Promise<boolean>} isInstalled - presence predicate.
+ * @returns {Promise<Array<{ tool: string, label: string, url: string }>>} missing tools + guides.
+ */
+async function missingToolGuides(tools, isInstalled) {
+  const missing = [];
+  for (const tool of tools) {
+    const guide = TOOL_INSTALL_GUIDES[tool];
+    if (!guide) continue;
+    if (!(await isInstalled(tool))) missing.push({ tool, ...guide });
+  }
+  return missing;
+}
+
 const VALID_NAME = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
 // Match the GitHub CODEOWNERS owner grammar: a personal handle (@user), an
 // organization team (@org/team), or an email address. Anything else is
@@ -1567,7 +1661,7 @@ function createSpinner(initialMessage) {
   };
 }
 
-function printSummary({ projectName, template, packageManager, installDeps, skipPackageManager, withCi, withDeploy }) {
+function printSummary({ projectName, template, packageManager, installDeps, skipPackageManager, withCi, withDeploy, missingTools = [] }) {
   const templateMeta = TEMPLATE_OPTIONS.find((option) => option.value === template);
   const templateLabel = templateMeta ? `${templateMeta.title} ${color(COLORS.dim, `(${template})`)}` : template;
   const summaryLines = [
@@ -1601,6 +1695,19 @@ function printSummary({ projectName, template, packageManager, installDeps, skip
     console.log(`  ${arrow} ${color(COLORS.cyan, `${packageManager} run dev`)}`);
   }
 
+  // Surface install links for any runtime/package manager the commands above
+  // rely on that isn't on PATH — saves a confusing "command not found" on the
+  // user's very first step.
+  if (missingTools.length > 0) {
+    const labelWidth = Math.max(...missingTools.map((tool) => tool.label.length));
+    console.log("");
+    console.log(`${color(COLORS.yellow, SYMBOLS.warn)}  ${color(COLORS.bold, "Install these to run the commands above")}`);
+    for (const { label, url } of missingTools) {
+      const name = color(COLORS.bold, label.padEnd(labelWidth));
+      console.log(`  ${color(COLORS.yellow, SYMBOLS.pointer)} ${name}  ${color(COLORS.cyan + COLORS.underline, url)}`);
+    }
+  }
+
   if (!installDeps && !skipPackageManager && packageManager === "pnpm") {
     console.log("");
     console.log(`${color(COLORS.bold, "Heads-up before \`pnpm install\`")}`);
@@ -1840,6 +1947,17 @@ async function main() {
       }
     }
 
+    // Probe PATH for the runtime + package manager this scaffold needs so we
+    // can print official install links (and avoid spawning a doomed install).
+    const missingTools = await missingToolGuides(
+      requiredTools({ template, packageManager, skipPackageManager }),
+      isToolInstalled,
+    );
+    if (installDeps && missingTools.some((tool) => tool.tool === packageManager)) {
+      logWarn(`${packageManager} is not installed; skipping dependency install. Install it from ${TOOL_INSTALL_GUIDES[packageManager].url}`);
+      installDeps = false;
+    }
+
     if (installDeps) {
       const spinner = createSpinner(`Installing dependencies with ${color(COLORS.cyan, packageManager)}\u2026`);
       spinner.start();
@@ -1857,7 +1975,7 @@ async function main() {
       }
     }
 
-    printSummary({ projectName, template, packageManager, installDeps, skipPackageManager, withCi, withDeploy });
+    printSummary({ projectName, template, packageManager, installDeps, skipPackageManager, withCi, withDeploy, missingTools });
   } catch (err) {
     rl?.close();
     if (err && err.message === "Cancelled") {
@@ -1874,4 +1992,4 @@ if (process.env.DALOY_TEST_IMPORT !== "1") {
   await main();
 }
 
-export { choiceInputMode };
+export { choiceInputMode, requiredTools, missingToolGuides, isToolInstalled, TOOL_INSTALL_GUIDES };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "0.41.0",
+  "version": "0.43.0",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",

package/sbom.cdx.json

@@ -1,25 +1,25 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e0065a2d-183f-5e2f-a081-7423be37ca75",
+  "serialNumber": "urn:uuid:c421c888-ec1b-5fd0-9d15-8ff8de111b6c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-18T16:40:29.534Z",
+    "timestamp": "2026-06-20T12:10:10.496Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.41.0"
+        "version": "0.43.0"
       }
     ],
     "authors": [],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/create-daloy@0.41.0",
+      "bom-ref": "pkg:npm/create-daloy@0.43.0",
       "name": "create-daloy",
-      "version": "0.41.0",
+      "version": "0.43.0",
       "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
-      "purl": "pkg:npm/create-daloy@0.41.0",
+      "purl": "pkg:npm/create-daloy@0.43.0",
       "licenses": [
         {
           "license": {
@@ -42,9 +42,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag-create-daloy-0.41.0",
+        "tagId": "swidtag-create-daloy-0.43.0",
         "name": "create-daloy",
-        "version": "0.41.0",
+        "version": "0.43.0",
         "tagVersion": 0,
         "patch": false
       }
@@ -53,7 +53,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/create-daloy@0.41.0",
+      "ref": "pkg:npm/create-daloy@0.43.0",
       "dependsOn": []
     }
   ]

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "create-daloy-0.41.0",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-0.41.0-e0065a2d-183f-5e2f-a081-7423be37ca75",
+  "name": "create-daloy-0.43.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-0.43.0-c421c888-ec1b-5fd0-9d15-8ff8de111b6c",
   "creationInfo": {
-    "created": "2026-06-18T16:40:29.534Z",
+    "created": "2026-06-20T12:10:10.496Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package-create-daloy",
       "name": "create-daloy",
-      "versionInfo": "0.41.0",
+      "versionInfo": "0.43.0",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/create-daloy@0.41.0"
+          "referenceLocator": "pkg:npm/create-daloy@0.43.0"
         }
       ]
     }

package/templates/bun-basic/package.json

@@ -19,7 +19,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.41.0",
+    "@daloyjs/core": "^0.43.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/cloudflare-worker/package.json

@@ -13,7 +13,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.41.0",
+    "@daloyjs/core": "^0.43.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/deno-basic/_Dockerfile

@@ -5,15 +5,19 @@
 #   - Non-root runtime user (`deno`, uid 1993 — created by the official
 #     `denoland/deno` image).
 #   - **Deno's capability-based permission model is the primary
-#     defense.** The runtime CMD passes only `--allow-net`,
-#     `--allow-env`, and scoped `--allow-read` — no `--allow-write`, no
-#     `--allow-run`, no `--allow-ffi`, no `--allow-sys`, no `--allow-all`.
-#     Network and env permissions are constrained to the server port and
-#     expected env vars so a compromised dependency cannot silently open
-#     arbitrary outbound sockets or read every secret in the environment.
+#     defense.** The runtime CMD passes a scoped `--allow-net`, a
+#     `--allow-env` allowlist of only the variables this app reads, and a
+#     scoped `--allow-read` — no `--allow-write`, no `--allow-run`, no
+#     `--allow-ffi`, no `--allow-sys`, no `--allow-all`. Network access is
+#     constrained to the server port and the env allowlist names each
+#     variable explicitly, so a compromised dependency cannot silently
+#     open arbitrary outbound sockets; even if it reads a listed var it
+#     has no `--allow-net` route to exfiltrate it.
 #   - `--cached-only` refuses any module that was not baked into the
-#     image at build time. A malicious republish of a transitive dep
-#     cannot ride in via a runtime `import("https://…")`.
+#     image at build time, and `--no-lock` keeps the lockfile out of the
+#     runtime surface (integrity is already verified against that cache).
+#     A malicious republish of a transitive dep cannot ride in via a
+#     runtime `import("https://…")`.
 #   - Read-only-root-filesystem friendly: no runtime writes. Run with
 #     `--read-only --tmpfs /tmp` or set `readOnlyRootFilesystem: true`
 #     in your orchestrator.
@@ -63,4 +67,12 @@ ENTRYPOINT ["/sbin/tini", "--"]
 # app genuinely needs them — every flag widens the blast radius of a
 # compromised dependency. If you change `PORT`, update `--allow-net` to
 # match the exposed listen address.
-CMD ["deno", "run", "--cached-only", "--allow-net=0.0.0.0:3000,127.0.0.1:3000,localhost:3000", "--allow-env=PORT,DENO_ENV", "--allow-read=/app/deno.json,/app/src", "src/main.ts"]
+#
+# `--allow-env` lists exactly the variables this app reads at startup
+# (see src/main.ts + src/build-app.ts): PORT (listen port), DENO_ENV
+# (production flag), TRUST_PROXY_HOPS (behindProxy), and PUBLIC_URL
+# (OpenAPI server URL). Add a variable here when you read a new one.
+# `--no-lock` skips runtime lockfile access — integrity is already
+# guaranteed by `--cached-only` against the cache baked at build time,
+# and the lockfile is not copied into the runtime stage.
+CMD ["deno", "run", "--cached-only", "--no-lock", "--allow-net=0.0.0.0:3000,127.0.0.1:3000,localhost:3000", "--allow-env=PORT,DENO_ENV,TRUST_PROXY_HOPS,PUBLIC_URL", "--allow-read=/app/deno.json,/app/src", "src/main.ts"]

package/templates/deno-basic/deno.json

@@ -10,11 +10,11 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "imports": {
-    "@daloyjs/core": "jsr:@daloyjs/daloy@^0.41.0",
-    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^0.41.0/banner",
-    "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^0.41.0/contract",
-    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^0.41.0/deno",
-    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^0.41.0/openapi",
+    "@daloyjs/core": "jsr:@daloyjs/daloy@^0.43.0",
+    "@daloyjs/core/banner": "jsr:@daloyjs/daloy@^0.43.0/banner",
+    "@daloyjs/core/contract": "jsr:@daloyjs/daloy@^0.43.0/contract",
+    "@daloyjs/core/deno": "jsr:@daloyjs/daloy@^0.43.0/deno",
+    "@daloyjs/core/openapi": "jsr:@daloyjs/daloy@^0.43.0/openapi",
     "zod": "npm:zod@^4.4.3"
   },
   "compilerOptions": {

package/templates/node-basic/package.json

@@ -20,7 +20,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.41.0",
+    "@daloyjs/core": "^0.43.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/vercel/package.json

@@ -13,7 +13,7 @@
     "hooks:install": "git config core.hooksPath .githooks"
   },
   "dependencies": {
-    "@daloyjs/core": "^0.41.0",
+    "@daloyjs/core": "^0.43.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {