create-keboola-app 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # create-keboola-app
 
+## 0.2.2
+
+### Patch Changes
+
+- Under `--workspace`, the scaffolded app's `knip:check` runs the monorepo's shared knip runner.
+
+  - It checks the app with `knip.json`, then in production mode, where an export only tests import fails the check.
+
+## 0.2.1
+
+### Patch Changes
+
+- Internal code satisfies the `anti-slop` lint rules; public APIs and behaviour are unchanged.
+
+  - `Reflect.get`, parameters typed `object` and accumulator-copying reducers give way to narrowing, precise types, `filter` and `flatMap`.
+  - `@keboola/api-client` keeps its `as unknown as` bridges from OpenAPI to domain types.
+
+- Scaffolded apps get route trees from `@tanstack/router-generator` 1.167.46, the generator of the TanStack Router 1.170.46 line.
+
 ## 0.2.0
 
 ### Minor Changes

package/dist/{blocks-D_-NWhwg.js → blocks-BdJaEmz1.js}

@@ -1,4 +1,4 @@
-//#region src/blocks.ts
+// src/blocks.ts
 const BLOCK_IDS = [
 	"kpi",
 	"chart",
@@ -144,13 +144,11 @@ const SHELL_FILES = [
 	"vitest.config.ts"
 ];
 /**
-* Tracked boilerplate files the template deliberately does not carry.
+* Tracked boilerplate files the template does not carry.
 *
-* - `AGENTS.md`, `README.md`, `.gitignore` — replaced by this package's `templates/`, because
-*   the boilerplate's versions point at monorepo paths.
-* - `turbo.json` — there is no turbo outside the monorepo.
-* - `src/routeTree.gen.ts` — regenerated per selection by the CLI; the committed one lists
-*   routes a shell-only app does not have.
+* - `AGENTS.md`, `README.md`, `.gitignore`: replaced by `templates/` (the originals cite monorepo paths).
+* - `turbo.json`: no turbo outside the monorepo.
+* - `src/routeTree.gen.ts`: regenerated per selection by the CLI.
 */
 const NOT_IN_TEMPLATE = [
 	".gitignore",
@@ -162,5 +160,4 @@ const NOT_IN_TEMPLATE = [
 const OWNER = new Map([...SHELL_FILES.map((file) => [file, "shell"]), ...BLOCK_IDS.flatMap((id) => BLOCKS[id].files.map((file) => [file, id]))]);
 /** The block that owns `path`, `'shell'`, or `null` when nothing claims it. */
 const ownerOf = (path) => NOT_IN_TEMPLATE.includes(path) ? "shell" : OWNER.get(path) ?? null;
-//#endregion
 export { isBlockId as a, SHELL_FILES as i, BLOCK_IDS as n, ownerOf as o, NOT_IN_TEMPLATE as r, BLOCKS as t };

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { a as isBlockId, n as BLOCK_IDS, o as ownerOf, t as BLOCKS } from "./blocks-D_-NWhwg.js";
-import { a as substitute, i as renderRegions, n as assertNoMarkers, r as blockIdOf } from "./regions-B3r5LhXl.js";
+import { a as isBlockId, n as BLOCK_IDS, o as ownerOf, t as BLOCKS } from "./blocks-BdJaEmz1.js";
+import { a as substitute, i as renderRegions, n as assertNoMarkers, o as isRecord, r as blockIdOf } from "./regions-BNl4QsPP.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { argv, cwd, exit, stderr, stdin, stdout } from "node:process";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
-//#region src/args.ts
+// src/args.ts
 /**
 * Accepted app names: kebab-case, starting with a letter, not ending in `-`.
 *
@@ -113,8 +113,7 @@ const parseArgs = (argv) => {
 		options
 	};
 };
-//#endregion
-//#region src/scaffold.ts
+// src/scaffold.ts
 /** Template files that describe the template rather than belong to the app. */
 const TEMPLATE_METADATA = /* @__PURE__ */ new Set(["workspace-deps.json", "package.json"]);
 /** Files this package's `templates/` contributes, which the boilerplate manifest does not claim. */
@@ -130,13 +129,8 @@ const evalCommand = (route, brief) => `npx --yes @keboola/ui-gen-bench eval --se
 /**
 * The emitted `gate:ui` script: one `ui-gen-bench eval` per scored route.
 *
-* - The overview's brief names the blocks that are actually on the page, because the score's
-*   brief-conformance axis marks down a page for missing what the brief promises.
-* - A block with a `route` adds an invocation for it, briefed entirely by the block. The
-*   conformance axis is graded against this text, so a shared suffix here would grade every
-*   routed block against one page's qualities.
-* - Not wired into `test`: it needs a model key, and a first run that fails on a missing
-*   credential is a worse welcome than an opt-in gate.
+* - Each brief names only its route's blocks: the brief-conformance axis grades against it.
+* - Not wired into `test`: it needs a model key.
 */
 const gateUiScript = (appTitle, blocks) => {
 	const clauses = blocks.filter((id) => BLOCKS[id].route === null).map((id) => BLOCKS[id].brief);
@@ -158,11 +152,7 @@ const walk = (root, dir, out) => {
 /**
 * `_gitignore` → `.gitignore`: npm strips a real `.gitignore` out of every tarball.
 *
-* - Applied only to `TEMPLATE_DOCS`, the files this package's `templates/` contributes. The
-*   rule exists for them and nothing else.
-* - Not a bare "basename starts with `_`" rule: TanStack's root route is `src/routes/__root.tsx`,
-*   which such a rule renames to `.root.tsx` — the route tree then has no root and the emitted
-*   app fails to generate one.
+* - `TEMPLATE_DOCS` only: a bare leading-`_` rule would rename `src/routes/__root.tsx`.
 */
 const outputPath = (file) => {
 	const name = basename(file);
@@ -192,7 +182,7 @@ const writeManifest = (opts) => {
 		...pkg.scripts,
 		"gate:ui": gateUiScript(titleCase(appName), blocks),
 		...workspace ? {
-			"knip:check": `pnpm --dir ../.. exec knip --workspace apps/${appName}`,
+			"knip:check": "node ../../scripts/knip-check.mjs",
 			"knip:fix": `pnpm --dir ../.. exec knip --workspace apps/${appName} --fix-type types,exports,files`
 		} : {}
 	};
@@ -201,10 +191,8 @@ const writeManifest = (opts) => {
 /**
 * `pnpm-workspace.yaml` for a standalone app.
 *
-* - It is the only file pnpm 11 reads `overrides` from; the `pnpm` field in `package.json` is
-*   ignored with a warning.
-* - Written only outside a monorepo. Under `--workspace` the app inherits the root's file, and a
-*   nested one would declare a second workspace root inside the first.
+* - pnpm 11 reads `overrides` only from it.
+* - Skipped under `--workspace`: a nested one would declare a second workspace root.
 */
 const writeWorkspaceConfig = (targetDir) => {
 	writeFileSync(join(targetDir, "pnpm-workspace.yaml"), `# pnpm reads \`overrides\` from this file only — the \`pnpm\` field in package.json is ignored.
@@ -268,16 +256,13 @@ const scaffold = (opts) => {
 		files: written.sort()
 	};
 };
-//#endregion
-//#region src/cli.ts
+// src/cli.ts
 const TEMPLATE_DIR = fileURLToPath(new URL("./template/", import.meta.url));
 /**
 * What to do when there is nobody to ask.
 *
-* - A missing `--name` is an error: there is no sane default for it, and a prompt an agent
-*   cannot answer is worse than a non-zero exit.
-* - A missing `--blocks` defaults to every block, which is the shape `apps/boilerplate` has and
-*   the most useful thing to hand someone who did not choose.
+* - A missing `--name` is an error: no sane default, and an unanswerable prompt is worse.
+* - A missing `--blocks` defaults to every block, the shape of `apps/boilerplate`.
 */
 const resolveNonInteractive = (options) => {
 	if (options.name === null) return {
@@ -304,11 +289,9 @@ const nextSteps = (result, workspace) => workspace ? [
 /**
 * Writes `src/routeTree.gen.ts` for the routes that were actually copied.
 *
-* - Same code path the Vite plugin takes, so the tree matches what `pnpm dev` would write.
-* - Run now rather than left to the first build, so the emitted app type-checks before it is
-*   ever built.
-* - A failure is fatal: an app whose `pnpm type-check` fails on a missing route tree is not a
-*   deliverable, and the message says how to recover.
+* - Same code path as the Vite plugin, so it matches what `pnpm dev` writes.
+* - Runs now so the emitted app type-checks before its first build.
+* - A failure is fatal.
 */
 const generateRouteTree = async (appDir) => {
 	try {
@@ -328,32 +311,29 @@ const generateRouteTree = async (appDir) => {
 /**
 * Adds the new app to the monorepo's knip config.
 *
-* - knip keys its per-workspace entry and project globs by path, so an unregistered app
-*   inherits knip's defaults and reports its postcss config as unused.
-* - The boilerplate's block is copied as-is: every scaffolded app has the same `src/` layout.
+* - Unregistered, knip's defaults report the app's postcss config as unused.
+* - Copies the boilerplate's entry as-is: every scaffolded app shares its `src/` layout.
 */
 const registerKnipWorkspace = (repoRoot, appName) => {
 	const knipPath = join(repoRoot, "knip.json");
 	if (!existsSync(knipPath)) return;
 	const config = JSON.parse(readFileSync(knipPath, "utf8"));
-	const workspaces = Reflect.get(config, "workspaces");
-	if (typeof workspaces !== "object" || workspaces === null) return;
-	const source = Reflect.get(workspaces, "apps/boilerplate");
-	if (source === void 0) return;
-	Reflect.set(workspaces, `apps/${appName}`, JSON.parse(JSON.stringify(source)));
+	if (!isRecord(config) || !isRecord(config.workspaces)) return;
+	const { workspaces } = config;
+	if (!("apps/boilerplate" in workspaces)) return;
+	workspaces[`apps/${appName}`] = structuredClone(workspaces["apps/boilerplate"]);
 	writeFileSync(knipPath, `${JSON.stringify(config, null, 2)}\n`);
 };
 /**
 * The monorepo root's own `engines`, for the emitted app to inherit under `--workspace`.
 *
-* - syncpack (`pnpm deps:check`) compares `engines.node` across every workspace, so an app
-*   carrying the template's standalone floor makes the whole repo's check red.
+* - syncpack compares `engines.node` across workspaces; the template's floor would fail it.
 * - `undefined` when the root declares none — `scaffold` then keeps the template's value.
 */
 const monorepoEngines = (root) => {
 	const manifest = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
-	const engines = Reflect.get(manifest, "engines");
-	if (typeof engines !== "object" || engines === null) return void 0;
+	if (!isRecord(manifest) || !isRecord(manifest.engines)) return void 0;
+	const { engines } = manifest;
 	return Object.fromEntries(Object.entries(engines).filter((entry) => typeof entry[1] === "string"));
 };
 const promptFor = async (options) => {
@@ -453,13 +433,8 @@ const main = async () => {
 /**
 * Whether this module is the process entry point.
 *
-* - `realpathSync` on both sides, because the installed `bin` is a symlink: npm and pnpm invoke
-*   `node_modules/.bin/create-keboola-app`, so `argv[1]` is the link, not `dist/cli.js`. An
-*   `endsWith('cli.js')` check — which is enough for `extract.ts` and `sanitize.ts`, both
-*   invoked by path — would answer `false` for every real install.
-* - Guarded at all so importing the module does not run it: `cli.test.ts` imports
-*   `resolveNonInteractive` and `nextSteps`, and an unguarded `main()` would scaffold, then
-*   `exit(1)` out of the test worker.
+* - `realpathSync` on both sides: the installed `bin` is a symlink, so `argv[1]` is the link.
+* - Guarded so `cli.test.ts` can import the module without running `main()`.
 */
 const isEntryPoint = () => {
 	const entry = argv[1];
@@ -477,5 +452,4 @@ if (isEntryPoint()) try {
 	stderr.write(`✗ ${error instanceof Error ? error.message : String(error)}\n`);
 	exit(1);
 }
-//#endregion
 export { nextSteps, resolveNonInteractive };

package/dist/extract.js

@@ -1,10 +1,10 @@
-import { a as isBlockId, i as SHELL_FILES, n as BLOCK_IDS, r as NOT_IN_TEMPLATE, t as BLOCKS } from "./blocks-D_-NWhwg.js";
-import { i as renderRegions, r as blockIdOf } from "./regions-B3r5LhXl.js";
-import { r as scan, t as formatFindings } from "./sanitize-CKs8pAzZ.js";
+import { a as isBlockId, i as SHELL_FILES, n as BLOCK_IDS, r as NOT_IN_TEMPLATE, t as BLOCKS } from "./blocks-BdJaEmz1.js";
+import { i as renderRegions, r as blockIdOf } from "./regions-BNl4QsPP.js";
+import { r as scan, t as formatFindings } from "./sanitize-DVFBkv8b.js";
 import { cpSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-//#region src/extract.ts
+// src/extract.ts
 /** The scripts the emitted app keeps, keyed the way its `package.json` will hold them. */
 const APP_SCRIPTS = {
 	build: "vite build",
@@ -36,10 +36,9 @@ const workspaceVersions = (packagesDir) => new Map(readdirSync(packagesDir).flat
 /**
 * The decision applied to every region while extracting.
 *
-* - `internal` is dropped: it is the marker for text that is true in the monorepo only.
+* - `internal` (monorepo-only text) is dropped.
 * - `block:<id>` is kept **with** its markers — the CLI decides per scaffold.
-* - Anything else throws, so a typo in a marker fails the build instead of shipping a region
-*   nobody will ever keep.
+* - Anything else throws, so a marker typo fails the build.
 */
 const decideRegion = (regionId) => {
 	if (regionId === "internal") return "drop";
@@ -50,12 +49,8 @@ const decideRegion = (regionId) => {
 /**
 * Per-file rewrites that turn this app's identity into placeholders.
 *
-* - Every rewrite has a matching assertion in `extract.test.ts`, and the sanitize scan fails
-*   the build on any surviving mention of this app's name — a rewrite that stops matching is
-*   a red build, not a scaffold that quietly names itself after the template.
-* - Match structurally, not by the literal name. The name must not appear here: the packed
-*   tarball is scanned too, and a rewrite that spells its own needle makes the scanner match
-*   its own implementation.
+* - Each has an assertion in `extract.test.ts`; the sanitize scan fails on any surviving name.
+* - Match structurally, never by the literal name: the tarball is scanned too.
 */
 const parameterise = (file, text) => {
 	if (file === "index.html") return text.replace(/<title>[^<]*<\/title>/, "<title>__APP_TITLE__</title>");
@@ -140,5 +135,4 @@ const main = () => {
 	console.log(`✓ extracted ${files.length} files into dist/template (${workspaceDeps.length} @keboola deps pinned to published ranges)`);
 };
 if (process.argv[1]?.endsWith("extract.js") === true) main();
-//#endregion
 export { extractTemplate };

package/dist/{regions-B3r5LhXl.js → regions-BNl4QsPP.js}

@@ -1,14 +1,14 @@
-//#region src/regions.ts
+// src/isRecord.ts
+/** A non-null object, readable by key — for parsed JSON. */
+const isRecord = (value) => typeof value === "object" && value !== null;
+// src/regions.ts
 const MARKER = String.raw`#(region|endregion)\s+(\S+)`;
 new RegExp(String.raw`^\s*(?://\s*|\{/\*\s*|<!--\s*)#region\s+(\S+)`);
 const MARKER_LINE_RE = new RegExp(String.raw`^\s*(?://\s*|\{/\*\s*|<!--\s*)${MARKER}`);
 /**
 * The block name in a region id, or `null` for any other shape.
 *
-* - Only an exact `block:<name>` matches. `block:kpi:extra` is a typo, not the `kpi` block —
-*   resolving it to the block whose name it happens to start with would let a malformed
-*   marker decide a real region, which is how a marker leaks into an emitted app.
-* - `internal` and every other id are the caller's business; this answers one question.
+* - Only an exact `block:<name>` matches; `block:kpi:extra` is a typo, not the `kpi` block.
 */
 const blockIdOf = (regionId) => /^block:([^:\s]+)$/.exec(regionId)?.[1] ?? null;
 const markerOf = (line) => {
@@ -22,11 +22,9 @@ const markerOf = (line) => {
 	};
 };
 /**
-* Removes the blank-line debris a dropped region leaves.
+* Collapses blank-line runs and drops a leading blank line.
 *
-* - Runs of two or more blank lines collapse to one: dropping an import region between two
-*   groups otherwise leaves a double gap, and the emitted app's `oxfmt --check` fails on it.
-* - A leading blank line is dropped for the same reason.
+* - Dropped regions leave that debris, and the emitted app's `oxfmt --check` fails on it.
 */
 const tidy = (lines) => {
 	const out = [];
@@ -68,21 +66,14 @@ const renderRegions = (source, decide) => {
 /**
 * Any marker, in any dialect, anywhere on a line.
 *
-* - Deliberately looser than `markerOf`: this is the containment check, so an *unrecognised*
-*   marker — misspelt dialect, indented into a continuation line, left inside a string — has to
-*   match too. `markerOf` would skip exactly those and let them through.
+* - Looser than `markerOf` on purpose: containment must catch unrecognised markers too.
 */
 const MARKER_RE = /#(?:region|endregion)\b/;
 /**
-* Fails when rendered text still carries a marker.
+* Fails when rendered text still carries a marker: no `#region` may reach an emitted app.
 *
-* - The invariant: no `#region block:` may reach an emitted app. Markers are a build-time
-*   mechanism, and one surviving into generated source is how that mechanism fails silently —
-*   the app compiles, the region is dead text, and nobody finds out until a reader asks.
-* - Called on every file the scaffolder writes, so a stray, mis-nested or unknown-block marker
-*   aborts the scaffold instead of shipping.
-* - Not called on the extract's output: that keeps its markers on purpose, for the CLI to
-*   decide per scaffold.
+* - Called on every file the scaffolder writes.
+* - Not on the extract's output, which keeps markers for the CLI to decide per scaffold.
 */
 const assertNoMarkers = (file, text) => {
 	const line = text.split("\n").findIndex((candidate) => MARKER_RE.test(candidate));
@@ -91,5 +82,4 @@ const assertNoMarkers = (file, text) => {
 };
 /** Replaces `__KEY__` with `vars[KEY]`. An unlisted placeholder is left in place. */
 const substitute = (source, vars) => Object.entries(vars).reduce((acc, [key, value]) => acc.replaceAll(`__${key}__`, value), source);
-//#endregion
-export { substitute as a, renderRegions as i, assertNoMarkers as n, blockIdOf as r, MARKER_RE as t };
+export { substitute as a, renderRegions as i, assertNoMarkers as n, isRecord as o, blockIdOf as r, MARKER_RE as t };

package/dist/{sanitize-CKs8pAzZ.js → sanitize-DVFBkv8b.js}

@@ -1,8 +1,8 @@
-import { t as MARKER_RE } from "./regions-B3r5LhXl.js";
+import { o as isRecord, t as MARKER_RE } from "./regions-BNl4QsPP.js";
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-//#region src/sanitize.ts
+// src/sanitize.ts
 const PATTERNS_PATH = fileURLToPath(new URL("../sanitize-patterns.json", import.meta.url));
 const SKIP_DIRS = /* @__PURE__ */ new Set([
 	"node_modules",
@@ -12,9 +12,8 @@ const SKIP_DIRS = /* @__PURE__ */ new Set([
 /**
 * The pattern table, compiled.
 *
-* - Read from JSON on purpose: the table is not in `files[]`, so no published copy of this
-*   scanner carries the patterns it looks for.
-* - Absent means the caller is running from an installed package, which the gates never do.
+* - JSON on purpose: it is not in `files[]`, so no published scanner carries its patterns.
+* - Absent only when run from an installed package, which the gates never do.
 */
 const loadPatterns = () => {
 	let raw;
@@ -69,11 +68,9 @@ const scanTree = (root, patterns = loadPatterns()) => {
 	});
 };
 /**
-* Structural check on every `package.json` under `root`: no dependency may keep pnpm's
-* `workspace:` protocol.
+* Findings for any `package.json` dependency still on pnpm's `workspace:` protocol.
 *
-* - Parsed rather than grepped, so the rule is about specifiers and not about the string
-*   appearing anywhere in a file. The CLI legitimately holds that literal for `--workspace`.
+* - Parsed, not grepped: the CLI legitimately holds that literal for `--workspace`.
 */
 const scanManifests = (root) => {
 	const files = [];
@@ -86,8 +83,9 @@ const scanManifests = (root) => {
 	];
 	return files.filter((file) => file === "package.json" || file.endsWith("/package.json")).flatMap((file) => {
 		const manifest = JSON.parse(readFileSync(join(root, file), "utf8"));
+		if (!isRecord(manifest)) return [];
 		return groups.flatMap((group) => {
-			const deps = Reflect.get(manifest, group);
+			const deps = manifest[group];
 			if (typeof deps !== "object" || deps === null) return [];
 			return Object.entries(deps).filter(([, range]) => typeof range === "string" && range.startsWith("workspace:")).map(([name, range]) => ({
 				file,
@@ -101,15 +99,10 @@ const scanManifests = (root) => {
 };
 const scan = (root) => [...scanTree(root), ...scanManifests(root)];
 /**
-* Region markers surviving into emitted source.
+* Region markers surviving into an emitted app.
 *
-* - Separate from `scan`, and never part of it: the tarball's own `dist/template/` carries
-*   markers on purpose, so a pattern-table rule for them would fail every run.
-* - Run against an **emitted app** instead — the one place the invariant applies. A marker
-*   there is dead text that compiles, which is how the mechanism fails without telling anyone.
-* - `assertNoMarkers` already aborts a scaffold in-process; this is the same rule applied to
-*   output on disk, so the gates can prove it about a real `pnpm pack` → scaffold run rather
-*   than trusting the code path.
+* - Never part of `scan`: the tarball's `dist/template/` carries markers on purpose.
+* - The on-disk twin of `assertNoMarkers`, so gates prove it on a real `pnpm pack` → scaffold.
 */
 const scanMarkers = (root) => {
 	const files = [];
@@ -130,12 +123,10 @@ const scanMarkers = (root) => {
 };
 const formatFindings = (findings) => findings.map((f) => `  ${f.file}:${f.line}  [${f.pattern}] ${f.match}\n      ${f.why}`).join("\n");
 /**
-* Two modes, because the two things being proved are opposites.
+* Two modes:
 *
-* 1. Default — internal references and credential shapes under a directory. Run on `pnpm pack`
-*    output, which still holds the marked-up template.
-* 2. `--markers` — region markers under a directory. Run on an **emitted app**, where a marker
-*    must never appear.
+* - Default — internal references and credential shapes; run on `pnpm pack` output.
+* - `--markers` — region markers; run on an emitted app.
 */
 const main = () => {
 	const args = process.argv.slice(2);
@@ -154,5 +145,4 @@ const main = () => {
 	console.log(markersOnly ? `✓ no region markers under ${root}` : `✓ no internal references or credential shapes under ${root}`);
 };
 if (process.argv[1]?.endsWith("sanitize.js") === true) main();
-//#endregion
 export { scanMarkers as a, scanManifests as i, loadPatterns as n, scanText as o, scan as r, scanTree as s, formatFindings as t };

package/dist/sanitize.js

@@ -1,2 +1 @@
-import { a as scanMarkers, i as scanManifests, n as loadPatterns, o as scanText, r as scan, s as scanTree, t as formatFindings } from "./sanitize-CKs8pAzZ.js";
-export { formatFindings, loadPatterns, scan, scanManifests, scanMarkers, scanText, scanTree };
+export { t as formatFindings, n as loadPatterns, r as scan, i as scanManifests, a as scanMarkers, o as scanText, s as scanTree } from "./sanitize-DVFBkv8b.js";

package/dist/template/oxlint.config.ts

@@ -1,41 +1,37 @@
 import { defineConfig } from 'oxlint';
 
 import keboolaShared from '@keboola/oxlint-config';
+import keboolaShadcn, { shadcnSettings } from '@keboola/oxlint-config/shadcn';
 import keboolaTailwind from '@keboola/oxlint-config/tailwind';
 
 export default defineConfig({
-  // `keboolaTailwind` opts into the v4-native Tailwind lint layer
-  // (eslint-plugin-better-tailwindcss). It carries the plugin + rules; the
-  // `entryPoint` below is required — oxlint only reads `settings` from the
-  // root config, so it can't live inside the shared fragment.
-  extends: [keboolaShared, keboolaTailwind],
+  extends: [keboolaShared, keboolaTailwind, keboolaShadcn],
   env: {
     node: true,
   },
   settings: {
     'better-tailwindcss': {
-      // This app's Tailwind v4 CSS entry (the file that `@import`s "tailwindcss").
+      // The file that `@import`s "tailwindcss".
       entryPoint: 'src/index.css',
     },
+    shadcn: shadcnSettings,
   },
   jsPlugins: [
-    // Local design-system + brand-safety lint rules. Aliased to `design` so rule
-    // IDs read `design/<rule>` in lint output.
+    // Aliased to `design`, so rule IDs read `design/<rule>`.
     { name: 'design', specifier: '@keboola/eslint-plugin-design' },
   ],
   rules: {
-    // Shipped at 'warn' for the first pass, matching the plugin convention —
-    // promote to 'error' once generated apps are consistently clean. See
-    // packages/eslint-plugin-design/README.md.
+    'design/max-comment-lines': 'error',
+    // 'warn' until generated apps are consistently clean.
     'design/no-layout-primitives': 'warn',
-    'design/no-inline-color': 'warn',
+    // `design/no-inline-color` off: `shadcn/no-inline-styles` and `no-arbitrary-values` cover it.
     'design/no-primitive-tw-color': 'warn',
     'design/no-native-form-controls': 'warn',
     'design/no-raw-heading-on-page': 'warn',
     'design/prefer-design-modal': 'warn',
+    'design/htmlfor-points-at-nothing': 'error',
 
-    // 'error' from the start: this app is the scaffold template, so a
-    // locale-implicit format here is copied into every generated app.
+    // 'error': the scaffold copies any locale-implicit format into every generated app.
     'design/no-implicit-locale': 'error',
   },
 });

package/dist/template/package.json

@@ -15,39 +15,40 @@
     "type-check": "tsc"
   },
   "dependencies": {
-    "@keboola/brand-registry": "^1.9.4",
-    "@keboola/design": "^11.5.0",
+    "@keboola/brand-registry": "^3.1.0",
+    "@keboola/design": "^17.2.1",
     "@tanstack/react-form": "^1.29.1",
-    "@tanstack/react-query": "^5.96.2",
-    "@tanstack/react-router": "^1.120.4",
+    "@tanstack/react-query": "^5.104.5",
+    "@tanstack/react-router": "^1.170.46",
     "@tanstack/react-table": "^8.21.3",
-    "@tanstack/router-plugin": "^1.120.4",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "@tanstack/router-plugin": "^1.168.48",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "zod": "^4.3.6",
     "zustand": "^5.0.8"
   },
   "devDependencies": {
-    "@keboola/eslint-plugin-design": "^0.4.3",
-    "@keboola/oxlint-config": "^10.0.2",
+    "@keboola/eslint-plugin-design": "^0.8.0",
+    "@keboola/oxlint-config": "^10.3.0",
     "@keboola/tsconfig": "^0.2.1",
+    "@shadcn/lint": "^0.1.5",
     "@tailwindcss/vite": "^4.3.3",
-    "@tanstack/react-query-devtools": "^5.96.2",
-    "@testing-library/jest-dom": "^6.8.0",
-    "@testing-library/react": "^16.3.2",
-    "@testing-library/user-event": "^14.6.1",
+    "@tanstack/react-query-devtools": "^5.104.5",
+    "@testing-library/jest-dom": "^7.0.1",
+    "@testing-library/react": "^16.3.3",
+    "@testing-library/user-event": "^14.6.8",
     "@types/node": "24.12.0",
-    "@types/react": "^19.2.15",
-    "@types/react-dom": "^19.2.3",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
     "@typescript/native": "npm:typescript@^7.0.2",
-    "@vitejs/plugin-react": "^6.0.0",
+    "@vitejs/plugin-react": "^6.1.2",
     "eslint-plugin-better-tailwindcss": "^4.7.0",
     "jsdom": "^26.1.0",
     "oxfmt": "^0.66.0",
-    "oxlint": "^1.81.0",
+    "oxlint": "^1.89.0",
     "tailwindcss": "^4.3.3",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "vite": "^8.1.5",
-    "vitest": "^4.1.10"
+    "vite": "^8.3.5",
+    "vitest": "^5.0.5"
   }
 }

package/dist/template/src/auth/AuthScreen.tsx

@@ -4,37 +4,17 @@ import { BrandLogo, Card } from '@keboola/design';
 
 import { ColorModeToggle } from '../components/ColorModeToggle';
 
-// The product name beside the brand mark.
-//
-// - `create-keboola-app` rewrites this literal to the generated app's title while extracting
-//   the template (`parameterise` in the package's `extract.ts`), so it has to stay a top-level
-//   single-quoted `const`.
+// Must stay a top-level single-quoted `const`: `create-keboola-app` (`parameterise` in
+// `extract.ts`) rewrites it to the generated app's title.
 const PRODUCT = '__APP_TITLE__';
 
 /**
  * The chrome every pre-project screen shares: brand lockup, one centred card, no navigation.
  *
- * - Renders *instead of* `AppChrome`, not inside it — `routes/__root.tsx` picks one from
- *   `useIsAuthRoute`. A visitor with no session gets no rail, no breadcrumb and no history.
- * - `tailwindcss-preflight` and `text-foreground` are set here rather than inherited. A real app
- *   moves this screen ahead of the router, because the session decides whether the router mounts
- *   at all, and then nothing above it sets either: without the preflight scope the card's
- *   controls pick up UA chrome, and without the ink `BrandLogo`'s inline SVG inherits
- *   `currentColor` and goes near-black on the dark page.
- * - `header` and `main` are landmarks, not decoration. Outside one, axe reports these controls as
- *   unreachable by landmark navigation — which is why the colour-scheme control sits inside
- *   `header` even though it is positioned away from the lockup.
- * - `Card.Title as="h1"` — the card carries the page's only heading, and the default `h3` opens
- *   the outline three levels down.
- * - `variant="mark"` beside the product name as text. The wordmark already spells the brand, so
- *   pairing it with a product name states the brand twice; the mark reads as one lockup. It also
- *   degrades in the right order — `BrandLogo` falls back to the wordmark for a brand that ships
- *   no mark and returns `null` for one that ships neither, which is why the name is text and not
- *   part of the image.
- * - `h-8`, not the navbar's `h-6`: with no chrome around it the lockup is the only thing naming
- *   the product, and at bar size it reads as chrome that lost its bar.
- * - Every pre-project state reuses this chrome — see `AUTH_STATES` in `states.tsx` — so the
- *   common path does not jump when one state replaces another.
+ * - Renders instead of `AppChrome`; `routes/__root.tsx` picks via `useIsAuthRoute`.
+ * - Sets `tailwindcss-preflight` and `text-foreground` itself: a real app mounts it above the router.
+ * - The toggle sits in `header` so axe finds it inside a landmark.
+ * - `variant="mark"` + text name: the wordmark would repeat the brand; the name survives a `null` logo.
  */
 export function AuthScreen({ title, children }: { title: string; children: ReactNode }) {
   return (