create-nevela 0.3.0 → 0.4.2

package/README.md

@@ -45,8 +45,10 @@ npm install -g create-nevela
 ```
 
 ```sh
-nevela new my-app      # anywhere: create an app
+nevela                 # anywhere: everything it can do
+nevela new my-app      # anywhere: create an app (leave the name off and it asks)
 nevela update          # anywhere: update the nevela command itself
+nevela version         # anywhere: the command's version, and the app's when in one
 nevela dev             # inside an app: run the API and the dashboard
 nevela upgrade         # inside an app: bring it to the latest Nevela
 ```

package/banner.mjs

@@ -0,0 +1,50 @@
+// The name, large, at the top of the commands you run from anywhere: new, update, help.
+//
+// The same block letters as the Laravel installer and Grit, in Nevela's colours, one
+// colour to a row so the name runs from blue through indigo to pink.
+
+const LETTERS = {
+  N: ['███╗   ██╗', '████╗  ██║', '██╔██╗ ██║', '██║╚██╗██║', '██║ ╚████║', '╚═╝  ╚═══╝'],
+  E: ['███████╗', '██╔════╝', '█████╗  ', '██╔══╝  ', '███████╗', '╚══════╝'],
+  V: ['██╗   ██╗', '██║   ██║', '██║   ██║', '╚██╗ ██╔╝', ' ╚████╔╝ ', '  ╚═══╝  '],
+  L: ['██╗     ', '██║     ', '██║     ', '██║     ', '███████╗', '╚══════╝'],
+  A: [' █████╗ ', '██╔══██╗', '███████║', '██╔══██║', '██║  ██║', '╚═╝  ╚═╝'],
+};
+
+/** "NEVELA", six rows of the same width. */
+export const ROWS = [0, 1, 2, 3, 4, 5].map((row) => [...'NEVELA'].map((letter) => LETTERS[letter][row]).join(''));
+export const WIDTH = ROWS[0].length;
+
+export const TAGLINE = 'Describe a resource. Get the API and the dashboard.';
+
+/** A colour for each row, top to bottom, for what the terminal can show. */
+const GRADIENT = {
+  // 16.7 million colours
+  24: ['38;2;79;123;255', '38;2;99;102;241', '38;2;124;92;246', '38;2;168;85;247', '38;2;217;70;239', '38;2;244;114;182'],
+  // 256 colours
+  8: ['38;5;69', '38;5;63', '38;5;99', '38;5;135', '38;5;171', '38;5;205'],
+  // 16 colours: blue above, magenta below
+  4: ['94', '94', '94', '95', '95', '95'],
+};
+
+/**
+ * The banner, as text to print.
+ *
+ * @param {object} options
+ * @param {string} options.version
+ * @param {number} options.depth    Bits of colour the terminal has: 24, 8, 4, 1 for none,
+ *                                  and 0 when the output isn't a terminal at all.
+ * @param {number} [options.columns]  How wide the terminal is
+ * @param {boolean} [options.compact]  The name on one line, whatever the terminal can show
+ */
+export function banner({ version, depth, columns = 80, compact = false }) {
+  const paint = (code, text) => (depth > 1 ? `\x1b[${code}m${text}\x1b[0m` : text);
+  // Into a file or a pipe, or a terminal too narrow for the letters: the name on one line.
+  if (compact || depth === 0 || columns < WIDTH + 4) {
+    // Indigo where there are 256 colours to pick it from; magenta where there are 16.
+    return `\n  ${paint(depth >= 8 ? '1;38;5;99' : '1;95', 'Nevela')} ${paint(2, `v${version}`)}\n`;
+  }
+  const colours = GRADIENT[depth >= 24 ? 24 : depth >= 8 ? 8 : 4];
+  const rows = ROWS.map((row, index) => `  ${paint(colours[index], row)}`);
+  return `\n${rows.join('\n')}\n\n  ${paint(2, `${TAGLINE} v${version}`)}\n`;
+}

package/index.mjs

@@ -7,16 +7,18 @@
 // No dependencies on purpose: this runs before anything is installed.
 
 import { spawn } from 'node:child_process';
+import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import readline from 'node:readline/promises';
 import { fileURLToPath } from 'node:url';
+import { banner } from './banner.mjs';
 import { isNewer, latestRelease, onPackagist } from './packagist.mjs';
 import { COMMANDS, findProject, forward, upgrade } from './project.mjs';
 import { shellLine, spawnCommand, windows } from './shell.mjs';
 import { latestVersion, newerVersion, runVersion } from './selfupdate.mjs';
-import { globalInstall, INSTALL_COMMAND } from './tool.mjs';
+import { copiesOnPath, globalInstall, INSTALL_COMMAND, removeCommand } from './tool.mjs';
 import { copyLaravelPackage, copyWebTemplate, fromRepository, templateRecord } from './template.mjs';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
@@ -30,24 +32,39 @@ const DOCS = 'https://nevela-docs.vercel.app';
  */
 const ADMIN = { name: 'Admin', email: 'admin@example.com', password: 'password' };
 
-const colour = (code) => (text) => (process.stdout.isTTY ? `\x1b[${code}m${text}\x1b[0m` : text);
+/** Bits of colour the terminal has: 24, 8, 4, 1 for none, and 0 when this isn't going to a terminal. */
+const depth = process.stdout.isTTY ? process.stdout.getColorDepth() : 0;
+const colour = (code) => (text) => (depth > 1 ? `\x1b[${code}m${text}\x1b[0m` : text);
 const bold = colour(1);
 const dim = colour(2);
 const green = colour(32);
 const red = colour(31);
-const indigo = colour('38;5;99');
+// Indigo where there are 256 colours to pick it from; magenta where there are 16.
+const indigo = colour(depth >= 8 ? '38;5;99' : '95');
 
-const HELP = `
-  ${bold('create-nevela')} ${dim(`v${VERSION}`)}
+/**
+ * Whether `nevela` was typed, as opposed to create-nevela (`pnpm create nevela`). Kept in
+ * the environment so a newer installer this one hands over to knows it too.
+ */
+const startedAsNevela = /^nevela(\.mjs)?$/.test(path.basename(process.argv[1] ?? ''));
+const typedNevela = startedAsNevela || process.env.NEVELA_TYPED === 'nevela';
+if (typedNevela) process.env.NEVELA_TYPED = 'nevela';
 
-  Create a new Nevela app: a Laravel API and a Next.js dashboard.
+/** The name, large. Once per run: an installer that handed over to a newer one has shown it. */
+function showTitle() {
+  console.log(banner({ version: VERSION, depth, columns: process.stdout.columns ?? 80, compact: Boolean(process.env.NEVELA_HANDED_OVER) }));
+}
+
+const HELP = `  Create a new Nevela app: a Laravel API and a Next.js dashboard.
 
   ${bold('Get the nevela command')}  (once; everything below is then this short)
     npm install -g create-nevela
 
   ${bold('Anywhere')}
-    nevela new <name> [options]   Create an app. Without the command: pnpm create nevela <name>
+    nevela new [name] [options]   Create an app. It asks for the name if you leave it off.
+                                  Without the command: pnpm create nevela <name>
     nevela update                 Update the nevela command itself to the latest version
+    nevela version                Which version the nevela command is, and this app when in one
 
   ${bold('Inside an app')}
     nevela upgrade             Bring this app to the latest Nevela: the package and the dashboard
@@ -175,6 +192,7 @@ function parseArgs(argv) {
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === '-h' || arg === '--help') {
+      showTitle();
       console.log(HELP);
       process.exit(0);
     } else if (arg === '-v' || arg === '--version') {
@@ -209,6 +227,8 @@ function phpIsTypeable() {
 
 /** `nevela <command>` as someone should type it here: through PHP, or through the package manager. */
 function nevelaCommand(pm) {
+  // Typed as `nevela`, so the command is installed, and it is the shortest of the three.
+  if (typedNevela) return 'nevela';
   if (phpIsTypeable()) return 'php nevela';
   return { pnpm: 'pnpm nevela', yarn: 'yarn nevela', bun: 'bun run nevela' }[pm] ?? 'npm run nevela';
 }
@@ -329,9 +349,8 @@ Docs: ${DOCS}
 async function inProject(name, args) {
   const project = findProject(process.cwd());
   if (!project) {
-    fail(`"${name}" runs inside a Nevela app, and this folder isn't in one.`, `To create an app:  pnpm create nevela my-app`);
+    fail(`"${name}" runs inside a Nevela app, and this folder isn't in one.`, `To create an app:  ${typedNevela ? 'nevela new my-app' : 'pnpm create nevela my-app'}`);
   }
-  if (name === 'version') console.log(`create-nevela ${VERSION}`);
   if (name !== 'upgrade') process.exit(forward(project, name, args));
 
   // Upgrading is the one command that must not run on stale code itself: it is the newest
@@ -350,6 +369,85 @@ async function inProject(name, args) {
   process.exit(status);
 }
 
+/**
+ * Say so when the nevela command is installed more than once. Only the first on the PATH
+ * ever runs, so an update to one of the others looks like an update that did nothing.
+ */
+function otherCopies() {
+  const copies = copiesOnPath();
+  if (copies.length < 2) return;
+  console.log(`\n  ${red('!')} The nevela command is installed ${copies.length} times. Typing ${bold('nevela')} runs the first of these:`);
+  for (const dir of copies) console.log(`      ${dir}`);
+  console.log(`    Keep that one and remove the rest, so there is one to keep up to date:`);
+  for (const dir of copies.slice(1)) console.log(`      ${bold(removeCommand(dir))}`);
+}
+
+/** The version of Nevela an app has installed, read from the package, or null. */
+function appVersion(project) {
+  try {
+    const source = fs.readFileSync(path.join(project.api, 'vendor', 'nevela', 'laravel', 'src', 'Nevela.php'), 'utf8');
+    return /const VERSION = '([^']+)'/.exec(source)?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+
+/** `nevela version`, from anywhere: the command's version, and the app's when in one. */
+function showVersion() {
+  const project = findProject(process.cwd());
+  const install = fromRepository ? null : globalInstall(here);
+  console.log(`\n  ${indigo(bold('Nevela command'))}   ${bold(`v${VERSION}`)}${install ? `  ${dim(`installed with ${install.manager}`)}` : ''}`);
+  if (project) {
+    const app = appVersion(project);
+    if (app === null) {
+      console.log(`  ${indigo(bold('This app'))}         ${dim("Nevela isn't installed in it yet. Run: cd apps/api && composer install")}`);
+    } else {
+      const behind = isNewer(VERSION, app);
+      console.log(`  ${indigo(bold('This app'))}         ${bold(`v${app}`)}${behind ? `  ${dim('To bring it to the latest:')} ${bold('nevela upgrade')}` : ''}`);
+    }
+  }
+  otherCopies();
+  console.log('');
+}
+
+/**
+ * Why `name` can't be the new app's name, or null when it can.
+ */
+function nameProblem(name) {
+  if (name === '') return 'Type a name, for example my-app.';
+  if (!/^[a-z0-9][a-z0-9-_]*$/.test(name)) {
+    return `"${name}" can't be used as a name. Use lowercase letters, numbers and dashes, for example my-app.`;
+  }
+  const root = path.resolve(process.cwd(), name);
+  if (fs.existsSync(root) && fs.readdirSync(root).length > 0) return `${root} already exists and isn't empty.`;
+  return null;
+}
+
+/**
+ * Ask what the app is called, until the answer is a name that can be used. The only
+ * question this ever asks, and only when the name was left off.
+ */
+async function askName() {
+  const prompt = readline.createInterface({ input: process.stdin, output: process.stdout });
+  // Ctrl+C or the end of input, at the question: leave, having created nothing.
+  const closed = new Promise((resolve) => prompt.once('close', () => resolve(null)));
+  prompt.on('SIGINT', () => prompt.close());
+  try {
+    for (;;) {
+      const answer = await Promise.race([prompt.question(`  ${green('What is the name of your app?')} `).catch(() => null), closed]);
+      if (answer === null) {
+        console.log('\n');
+        process.exit(130);
+      }
+      const problem = nameProblem(answer.trim());
+      if (problem === null) return answer.trim();
+      console.log(`  ${red('✖')} ${problem}\n`);
+    }
+  } finally {
+    prompt.close();
+  }
+}
+
 /**
  * `nevela update`, from anywhere: update the nevela command itself.
  *
@@ -372,14 +470,16 @@ async function updateTool(args) {
       console.log(`\n  ${dim(`"update" now updates the nevela command, and an app is brought up to date with "upgrade". Upgrading this app.`)}`);
       await inProject('upgrade', args);
     }
-    console.log(`\n  ${indigo(bold('Nevela'))} ${dim(`v${VERSION}`)}\n`);
+    showTitle();
     console.log(`  The nevela command isn't installed on this computer, so there is nothing to update.`);
     console.log(`  To install it:  ${bold(INSTALL_COMMAND)}`);
     console.log(`  Then, anywhere: ${bold('nevela new my-app')}   and inside an app: ${bold('nevela upgrade')}, ${bold('nevela dev')}\n`);
     return;
   }
 
-  console.log(`\n  ${indigo(bold('Nevela'))} ${dim('update')}\n`);
+  showTitle();
+  console.log(`  ${indigo(`Nevela self-update — current: v${VERSION}`)}\n`);
+  console.log(`  ${dim('→ Checking npm for the latest release…')}\n`);
   const latest = await latestVersion();
   const newer = latest !== null && isNewer(latest, VERSION) ? latest : null;
   if (latest === null) {
@@ -388,16 +488,17 @@ async function updateTool(args) {
     console.log(`    Try again when you are online, or run:  ${install.command.join(' ')}`);
     process.exitCode = 1;
   } else if (!newer) {
-    console.log(`  ${green('✔')} nevela ${bold(VERSION)} is the latest.`);
+    console.log(`  ${green(`✔ Already on the latest version (v${VERSION}). Nothing to do.`)}`);
   } else {
-    console.log(`  Updating the nevela command ${bold(VERSION)} → ${bold(newer)} ${dim(`(${install.command.join(' ')})`)}\n`);
+    console.log(`  Updating v${VERSION} → ${bold(`v${newer}`)} ${dim(`(${install.command.join(' ')})`)}\n`);
     const [command, ...rest] = install.command;
     const result = spawnCommand(command, rest, { stdio: 'inherit' });
     if (result.error || result.status !== 0) {
       fail(`Couldn't update the nevela command.`, `Run it yourself to see why:  ${install.command.join(' ')}`);
     }
-    console.log(`\n  ${green('✔')} nevela is now ${bold(newer)}.`);
+    console.log(`\n  ${green(`✔ Updated to v${newer}.`)} ${dim('Every nevela command, and every app you create from now on, uses it.')}`);
   }
+  otherCopies();
   if (project) {
     console.log(`  ${dim('This app is not changed by that. To bring it to the latest Nevela:')} ${bold('nevela upgrade')}`);
   }
@@ -408,10 +509,18 @@ async function main() {
   const argv = process.argv.slice(2);
   if (argv[0] === 'new') argv.shift();
   else if (argv[0] === 'update') return updateTool(argv.slice(1));
+  else if (argv[0] === 'version') return showVersion();
   else if (COMMANDS.includes(argv[0])) await inProject(argv[0], argv.slice(1));
+  else if (argv[0] === 'help' || (startedAsNevela && argv.length === 0)) {
+    // `nevela` on its own says what it can do. `pnpm create nevela` on its own starts an
+    // app, and so does a newer installer that an older `nevela new` handed over to.
+    showTitle();
+    console.log(HELP);
+    return;
+  }
   const options = parseArgs(argv);
 
-  console.log(`\n  ${indigo(bold('Nevela'))} ${dim(`v${VERSION}`)}\n`);
+  showTitle();
 
   // A package manager may hand over an older installer than the newest: pnpm skips versions
   // published in the last few hours, and both pnpm and npm cache. Fetch the newest and let
@@ -429,19 +538,17 @@ async function main() {
   }
 
   let name = options.name;
-  if (!name) {
-    // The only question this ever asks, and only when the name was left off.
-    if (options.yes || !process.stdin.isTTY) fail('Give the app a name: pnpm create nevela my-app');
-    const prompt = readline.createInterface({ input: process.stdin, output: process.stdout });
-    name = (await prompt.question('  What is the app called? ')).trim();
-    prompt.close();
-  }
-  if (!/^[a-z0-9][a-z0-9-_]*$/.test(name)) {
-    fail(`"${name}" can't be used as a name. Use lowercase letters, numbers and dashes, for example my-app.`);
+  if (name === undefined) {
+    // Nobody to ask: say what to type instead.
+    if (options.yes || !process.stdin.isTTY) fail(`Give the app a name: ${typedNevela ? 'nevela new my-app' : 'pnpm create nevela my-app'}`);
+    name = await askName();
+    console.log('');
+  } else {
+    const problem = nameProblem(name);
+    if (problem) fail(problem);
   }
 
   const root = path.resolve(process.cwd(), name);
-  if (fs.existsSync(root) && fs.readdirSync(root).length > 0) fail(`${root} already exists and isn't empty.`);
 
   checkRequirements();
   const pm = detectPackageManager(options.pm);
@@ -454,7 +561,14 @@ async function main() {
   // The dashboard first, so its packages can download while Composer works on Laravel.
   // The two don't touch each other, and Composer is the long part.
   copyWebTemplate(web, { name, title });
-  write(path.join(web, '.env.local'), '# Where the Laravel API is, including its prefix.\nNEVELA_API_URL=http://127.0.0.1:8000/api\n');
+  // Shared by the dashboard and the API, so the API can believe what the dashboard tells it
+  // about a person's browser (for the list of devices signed in to an account). Made here,
+  // per app, and never the same twice.
+  const proxySecret = crypto.randomBytes(24).toString('hex');
+  write(
+    path.join(web, '.env.local'),
+    `# Where the Laravel API is, including its prefix.\nNEVELA_API_URL=http://127.0.0.1:8000/api\n\n# The same value as in apps/api/.env. It lets the API trust this app's word on a visitor's browser.\nNEVELA_PROXY_SECRET=${proxySecret}\n`,
+  );
   if (pm === 'pnpm') {
     // Its own workspace file: lets sharp build, and keeps pnpm from adopting a workspace further up.
     write(path.join(web, 'pnpm-workspace.yaml'), 'allowBuilds:\n  sharp: true\n');
@@ -510,6 +624,9 @@ async function main() {
     // artisan command is slow for the same reason the index was: files read for the first time.
     const env = path.join(api, '.env');
     if (!fs.existsSync(env) && fs.existsSync(`${env}.example`)) fs.copyFileSync(`${env}.example`, env);
+    if (fs.existsSync(env) && !/^NEVELA_PROXY_SECRET=/m.test(fs.readFileSync(env, 'utf8'))) {
+      fs.appendFileSync(env, `\n# The same value as in apps/web/.env.local.\nNEVELA_PROXY_SECRET=${proxySecret}\n`);
+    }
     const sqlite = path.join(api, 'database', 'database.sqlite');
     if (/^DB_CONNECTION=sqlite\s*$/m.test(fs.readFileSync(env, 'utf8')) && !fs.existsSync(sqlite)) fs.writeFileSync(sqlite, '');
     return addApiTokens(path.join(api, 'app', 'Models', 'User.php'));
@@ -572,7 +689,7 @@ async function main() {
   }
   console.log(`\n  Add your first resource: ${dim(`${nevela} resource Product --fields="name:string, price:money"`)}`);
   console.log(`  Check the app: ${dim(`${nevela} status`)}   Upgrade it later: ${dim(`${nevela} upgrade`)}   Everything: ${dim(nevela)}`);
-  if (nevela !== 'php nevela') {
+  if (nevela !== 'php nevela' && nevela !== 'nevela') {
     console.log(`\n  ${dim(`In this shell "php" isn't a command (your PHP is php.bat), so use ${nevela}. In PowerShell, php nevela works too.`)}`);
   }
   console.log(`  Docs: ${DOCS}/start/quickstart/\n`);

package/net.mjs

@@ -0,0 +1,55 @@
+// Reading a URL, without fetch().
+//
+// On Windows, a process that exits just after a fetch() has finished trips an assertion
+// inside Node ("UV_HANDLE_CLOSING") and prints a crash where the error message should be.
+// The installer asks npm for the latest version first thing, so every mistake it reports
+// straight afterwards ended that way: no app name, a name it can't use, a folder that
+// already exists. A plain https request on a connection that closes with the answer doesn't.
+
+import https from 'node:https';
+
+/**
+ * GET `url`. Resolves to { ok, status, body } with the body as a Buffer, or to null when
+ * the server couldn't be reached within `milliseconds`. Never rejects.
+ *
+ * The time allowed is for the whole exchange, redirects included, and not only for a
+ * silence on the line.
+ */
+export function get(url, milliseconds, redirects = 3, deadline = Date.now() + milliseconds) {
+  return new Promise((resolve) => {
+    let timer = null;
+    const settle = (value) => {
+      clearTimeout(timer);
+      resolve(value);
+    };
+    try {
+      const request = https.get(url, { agent: false, headers: { connection: 'close', 'user-agent': 'create-nevela' } }, (response) => {
+        const status = response.statusCode ?? 0;
+        if (status >= 300 && status < 400 && response.headers.location && redirects > 0) {
+          response.resume();
+          settle(get(new URL(response.headers.location, url).href, milliseconds, redirects - 1, deadline));
+          return;
+        }
+        const chunks = [];
+        response.on('data', (chunk) => chunks.push(chunk));
+        response.on('end', () => settle({ ok: status >= 200 && status < 300, status, body: Buffer.concat(chunks) }));
+        response.on('error', () => settle(null));
+      });
+      request.on('error', () => settle(null));
+      timer = setTimeout(() => request.destroy(new Error('timed out')), Math.max(0, deadline - Date.now()));
+    } catch {
+      settle(null);
+    }
+  });
+}
+
+/** GET `url` and read it as JSON. Null when it couldn't be reached, or isn't JSON, or isn't a 2xx. */
+export async function getJson(url, milliseconds) {
+  const response = await get(url, milliseconds);
+  if (!response?.ok) return null;
+  try {
+    return JSON.parse(response.body.toString('utf8'));
+  } catch {
+    return null;
+  }
+}

package/nevela.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// The `nevela` command.
+//
+// The same program as create-nevela. It has a file of its own so the program can tell
+// which of the two was typed: `nevela` with nothing after it says what it can do, where
+// `pnpm create nevela` with nothing after it starts a new app.
+
+await import('./index.mjs');

package/package.json

@@ -1,14 +1,17 @@
 {
   "name": "create-nevela",
-  "version": "0.3.0",
+  "version": "0.4.2",
   "description": "Create a new Nevela app: a Laravel API and a Next.js dashboard from one resource description.",
   "type": "module",
   "bin": {
     "create-nevela": "index.mjs",
-    "nevela": "index.mjs"
+    "nevela": "nevela.mjs"
   },
   "files": [
     "index.mjs",
+    "nevela.mjs",
+    "banner.mjs",
+    "net.mjs",
     "template.mjs",
     "packagist.mjs",
     "selfupdate.mjs",

package/packagist.mjs

@@ -1,8 +1,12 @@
 // Deciding where a new app gets nevela/laravel from.
 
+import { getJson } from './net.mjs';
+
+const RELEASES = 'https://repo.packagist.org/p2/nevela/laravel.json';
+
 /** Whether `candidate` is a stable release Composer's `^major.minor` would accept. */
 export function satisfiesCaret(candidate, [major, minor]) {
-  const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(candidate);
+  const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(String(candidate));
   if (!match) return false;
   const [theirMajor, theirMinor] = match.slice(1).map(Number);
   // Below 1.0 a caret holds the minor version too: ^0.1 means 0.1.x only.
@@ -23,29 +27,18 @@ export function isNewer(a, b) {
  * listed isn't enough: with no tagged release yet, `composer require` would fail.
  */
 export async function onPackagist(wanted) {
-  try {
-    const response = await fetch('https://repo.packagist.org/p2/nevela/laravel.json', { signal: AbortSignal.timeout(8000) });
-    if (!response.ok) return false;
-    const releases = (await response.json()).packages?.['nevela/laravel'] ?? [];
-    return releases.some((release) => satisfiesCaret(release.version, wanted));
-  } catch {
-    return false;
-  }
+  const releases = (await getJson(RELEASES, 8000))?.packages?.['nevela/laravel'];
+  return Array.isArray(releases) && releases.some((release) => satisfiesCaret(release?.version, wanted));
 }
 
 /** The newest stable nevela/laravel on Packagist, as "x.y.z", or null when it can't be reached. */
 export async function latestRelease() {
-  try {
-    const response = await fetch('https://repo.packagist.org/p2/nevela/laravel.json', { signal: AbortSignal.timeout(8000) });
-    if (!response.ok) return null;
-    const releases = (await response.json()).packages?.['nevela/laravel'] ?? [];
-    let latest = null;
-    for (const release of releases) {
-      const version = /^v?(\d+\.\d+\.\d+)$/.exec(release.version)?.[1];
-      if (version && (latest === null || isNewer(version, latest))) latest = version;
-    }
-    return latest;
-  } catch {
-    return null;
+  const releases = (await getJson(RELEASES, 8000))?.packages?.['nevela/laravel'];
+  if (!Array.isArray(releases)) return null;
+  let latest = null;
+  for (const release of releases) {
+    const version = /^v?(\d+\.\d+\.\d+)$/.exec(String(release?.version))?.[1];
+    if (version && (latest === null || isNewer(version, latest))) latest = version;
   }
+  return latest;
 }

package/selfupdate.mjs

@@ -10,19 +10,15 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import zlib from 'node:zlib';
+import { get, getJson } from './net.mjs';
 import { isNewer } from './packagist.mjs';
 
 const REGISTRY = 'https://registry.npmjs.org/create-nevela';
 
 /** The newest create-nevela on npm, or null when npm couldn't be asked. Never throws. */
 export async function latestVersion() {
-  try {
-    const response = await fetch(`${REGISTRY}/latest`, { signal: AbortSignal.timeout(4000) });
-    const latest = (await response.json()).version;
-    return typeof latest === 'string' && /^\d+\.\d+\.\d+$/.test(latest) ? latest : null;
-  } catch {
-    return null;
-  }
+  const latest = (await getJson(`${REGISTRY}/latest`, 4000))?.version;
+  return typeof latest === 'string' && /^\d+\.\d+\.\d+$/.test(latest) ? latest : null;
 }
 
 /**
@@ -84,16 +80,17 @@ export function untar(buffer, dir) {
 export async function runVersion(version, args) {
   const dir = path.join(os.tmpdir(), `create-nevela-${version}-${process.pid}`);
   try {
-    const response = await fetch(`${REGISTRY}/-/create-nevela-${version}.tgz`, { signal: AbortSignal.timeout(30000) });
-    if (!response.ok) return null;
-    untar(zlib.gunzipSync(Buffer.from(await response.arrayBuffer())), dir);
+    const response = await get(`${REGISTRY}/-/create-nevela-${version}.tgz`, 30000);
+    if (!response?.ok) return null;
+    untar(zlib.gunzipSync(response.body), dir);
     const entry = path.join(dir, 'package', 'index.mjs');
     if (!fs.existsSync(entry)) return null;
 
     const result = spawnSync(process.execPath, [entry, ...args], {
       stdio: 'inherit',
-      // The newer one must not go looking for a newer one in turn.
-      env: { ...process.env, NEVELA_NO_SELF_UPDATE: '1' },
+      // The newer one must not go looking for a newer one in turn, and the name has
+      // already been printed large once.
+      env: { ...process.env, NEVELA_NO_SELF_UPDATE: '1', NEVELA_HANDED_OVER: '1' },
     });
     return result.status ?? 1;
   } catch {

package/template/laravel/composer.json

@@ -30,7 +30,8 @@
         "illuminate/support": "^11.0|^12.0|^13.0",
         "illuminate/database": "^11.17|^12.0|^13.0",
         "illuminate/http": "^11.0|^12.0|^13.0",
-        "illuminate/console": "^11.0|^12.0|^13.0"
+        "illuminate/console": "^11.0|^12.0|^13.0",
+        "lbuchs/webauthn": "^2.2"
     },
     "require-dev": {
         "phpunit/phpunit": "^11.0"

package/template/laravel/config/nevela.php

@@ -24,10 +24,75 @@ return [
     'prefix' => 'api',
     'middleware' => ['api', 'auth:sanctum'],
 
-    /* Token auth endpoints for the Next.js app: POST/DELETE {prefix}/auth/token, GET {prefix}/auth/me. */
+    /*
+    | Signing in. Every endpoint is under {prefix}/auth. Email and password is always
+    | available; the rest can be switched off here. A method that is off is refused by the
+    | API, not just hidden, and `php artisan nevela:generate` writes these choices to the
+    | dashboard (apps/web/lib/auth-config.ts) so its screens agree.
+    */
     'auth' => [
         'enabled' => true,
         'token_name' => 'nevela-web',
+
+        /*
+        | Let anyone create their own account at /sign-up. Off by default, and accounts come
+        | from `php nevela user`: a generated policy lets every signed-in user do everything
+        | until you tighten it, so open sign-up on an untouched app would hand the dashboard
+        | to whoever finds it. Tighten app/Policies first, then set NEVELA_REGISTRATION=true.
+        */
+        'registration' => (bool) env('NEVELA_REGISTRATION', false),
+
+        /* A sign-in link by email. */
+        'magic_link' => true,
+
+        /* A 6-digit sign-in code by email. */
+        'email_code' => true,
+
+        /* Face ID, Touch ID, Windows Hello or a security key. */
+        'passkeys' => true,
+
+        'two_factor' => [
+            /* Codes from an authenticator app (TOTP), with backup codes. */
+            'authenticator' => true,
+            /* Codes by email as the second step. */
+            'email' => true,
+        ],
+
+        /* Refuse password sign-in until the email address is verified. */
+        'require_email_verification' => false,
+
+        /*
+        | Check new passwords against Have I Been Pwned's breach list. Only the first five
+        | characters of the password's hash are sent, and an outage lets the password through.
+        */
+        'check_breached_passwords' => true,
+
+        /*
+        | Sign-in attempts are limited to ten a minute per account. This is the limit per
+        | address on top of that. It is high because the dashboard's server makes the calls:
+        | to Laravel, everyone using the dashboard comes from that one address.
+        */
+        'attempts_per_address' => 300,
+
+        /* The role a self-registered account starts with. Null leaves the column alone. */
+        'default_role' => null,
+
+        /*
+        | Where the dashboard is, for the links in emails and for passkeys, which are tied
+        | to its address. In development any localhost port is accepted as well, because
+        | the dashboard moves to another port when 3000 is taken.
+        */
+        'web_url' => env('NEVELA_WEB_URL', 'http://localhost:3000'),
+
+        /*
+        | A secret the dashboard's server and Laravel share, so Laravel can believe what the
+        | dashboard says about a person's browser and address (for the list of devices).
+        | Put the same value in the dashboard's .env.local. New apps get one when created.
+        */
+        'proxy_secret' => env('NEVELA_PROXY_SECRET'),
+
+        /* The name an authenticator app and a passkey prompt show. Null: the app's name. */
+        'issuer' => null,
     ],
 
     /* List defaults, matching Flare's client. */