create-eigen-game 0.14.1 → 0.14.2

package/README.md

@@ -67,6 +67,10 @@ public values from `app/app-config.json` through Flutter's native
 it contains its own `package.json`, `wrangler.jsonc`, TypeScript entry point,
 generated Wrangler types, and game module. The combined CLI renders that same
 template under `server/`; it does not maintain a second Worker skeleton.
+The template approves only the `esbuild` and `workerd` install scripts that its
+toolchain requires, using npm's `allowScripts` in `package.json` and pnpm's
+`allowBuilds` in `pnpm-workspace.yaml`; npm explicitly declines the unnecessary
+optional `fsevents` fallback build.
 
 `templates/app-overlay` is applied after
 `flutter create --empty --platforms android,web`. It supplies the Firebase

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-eigen-game",
-  "version": "0.14.1",
+  "version": "0.14.2",
   "license": "MIT",
   "description": "Scaffold an EigenInteractive game Worker and Flutter app without cloning the engine repositories.",
   "type": "module",
@@ -29,9 +29,9 @@
     "vitest": "^4.1.11",
     "wrangler": "^4.129.0",
     "zod": "^4.4.3",
-    "@eigeninteractive/rules": "0.6.0",
-    "@eigeninteractive/server": "0.6.0",
-    "@eigeninteractive/testkit": "0.6.0"
+    "@eigeninteractive/rules": "0.6.1",
+    "@eigeninteractive/server": "0.6.1",
+    "@eigeninteractive/testkit": "0.6.1"
   },
   "engines": {
     "node": ">=22"

package/templates/worker/README.md

@@ -62,8 +62,12 @@ formatter is free to move anything written there.
 refuses to run them unless the project asks, and fails the install outright
 when one is skipped (`ERR_PNPM_IGNORED_BUILDS`). Two need theirs: `esbuild`
 fetches its platform binary, and `workerd` is the runtime `vitest` and
-`wrangler dev` execute against. npm runs install scripts by default and ignores
-the file entirely, so the scaffold is correct under both.
+`wrangler dev` execute against. npm ignores this file, so `package.json`
+declares the same two names in npm's `allowScripts` policy. Keeping both
+policies beside the Worker dependencies makes installs work without granting
+every dependency permission to run code. npm's policy also explicitly declines
+the optional `fsevents` fallback build: its package already carries a universal
+macOS binary, so compiling another one is unnecessary.
 
 `minimumReleaseAgeExclude` appears on its own. pnpm 11 will not install a
 version published less than a day ago, a quarantine against a compromised

package/templates/worker/package.json

@@ -4,6 +4,11 @@
   "private": true,
   "description": "The authoritative Example Game server on Cloudflare Workers.",
   "type": "module",
+  "allowScripts": {
+    "esbuild": true,
+    "fsevents": false,
+    "workerd": true
+  },
   "eigen": {
     "game": "Example Game"
   },