create-nevela 0.4.1 → 0.4.3

package/README.md

@@ -45,8 +45,10 @@ npm install -g create-nevela
 ```
 
 ```sh
-nevela new my-app      # anywhere: create an app
+nevela                 # anywhere: everything it can do
+nevela new my-app      # anywhere: create an app (leave the name off and it asks)
 nevela update          # anywhere: update the nevela command itself
+nevela version         # anywhere: the command's version, and the app's when in one
 nevela dev             # inside an app: run the API and the dashboard
 nevela upgrade         # inside an app: bring it to the latest Nevela
 ```

package/banner.mjs

@@ -0,0 +1,50 @@
+// The name, large, at the top of the commands you run from anywhere: new, update, help.
+//
+// The same block letters as the Laravel installer and Grit, in Nevela's colours, one
+// colour to a row so the name runs from blue through indigo to pink.
+
+const LETTERS = {
+  N: ['███╗   ██╗', '████╗  ██║', '██╔██╗ ██║', '██║╚██╗██║', '██║ ╚████║', '╚═╝  ╚═══╝'],
+  E: ['███████╗', '██╔════╝', '█████╗  ', '██╔══╝  ', '███████╗', '╚══════╝'],
+  V: ['██╗   ██╗', '██║   ██║', '██║   ██║', '╚██╗ ██╔╝', ' ╚████╔╝ ', '  ╚═══╝  '],
+  L: ['██╗     ', '██║     ', '██║     ', '██║     ', '███████╗', '╚══════╝'],
+  A: [' █████╗ ', '██╔══██╗', '███████║', '██╔══██║', '██║  ██║', '╚═╝  ╚═╝'],
+};
+
+/** "NEVELA", six rows of the same width. */
+export const ROWS = [0, 1, 2, 3, 4, 5].map((row) => [...'NEVELA'].map((letter) => LETTERS[letter][row]).join(''));
+export const WIDTH = ROWS[0].length;
+
+export const TAGLINE = 'Describe a resource. Get the API and the dashboard.';
+
+/** A colour for each row, top to bottom, for what the terminal can show. */
+const GRADIENT = {
+  // 16.7 million colours
+  24: ['38;2;79;123;255', '38;2;99;102;241', '38;2;124;92;246', '38;2;168;85;247', '38;2;217;70;239', '38;2;244;114;182'],
+  // 256 colours
+  8: ['38;5;69', '38;5;63', '38;5;99', '38;5;135', '38;5;171', '38;5;205'],
+  // 16 colours: blue above, magenta below
+  4: ['94', '94', '94', '95', '95', '95'],
+};
+
+/**
+ * The banner, as text to print.
+ *
+ * @param {object} options
+ * @param {string} options.version
+ * @param {number} options.depth    Bits of colour the terminal has: 24, 8, 4, 1 for none,
+ *                                  and 0 when the output isn't a terminal at all.
+ * @param {number} [options.columns]  How wide the terminal is
+ * @param {boolean} [options.compact]  The name on one line, whatever the terminal can show
+ */
+export function banner({ version, depth, columns = 80, compact = false }) {
+  const paint = (code, text) => (depth > 1 ? `\x1b[${code}m${text}\x1b[0m` : text);
+  // Into a file or a pipe, or a terminal too narrow for the letters: the name on one line.
+  if (compact || depth === 0 || columns < WIDTH + 4) {
+    // Indigo where there are 256 colours to pick it from; magenta where there are 16.
+    return `\n  ${paint(depth >= 8 ? '1;38;5;99' : '1;95', 'Nevela')} ${paint(2, `v${version}`)}\n`;
+  }
+  const colours = GRADIENT[depth >= 24 ? 24 : depth >= 8 ? 8 : 4];
+  const rows = ROWS.map((row, index) => `  ${paint(colours[index], row)}`);
+  return `\n${rows.join('\n')}\n\n  ${paint(2, `${TAGLINE} v${version}`)}\n`;
+}

package/index.mjs

@@ -6,18 +6,19 @@
 //
 // No dependencies on purpose: this runs before anything is installed.
 
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import readline from 'node:readline/promises';
 import { fileURLToPath } from 'node:url';
+import { banner } from './banner.mjs';
 import { isNewer, latestRelease, onPackagist } from './packagist.mjs';
 import { COMMANDS, findProject, forward, upgrade } from './project.mjs';
 import { shellLine, spawnCommand, windows } from './shell.mjs';
 import { latestVersion, newerVersion, runVersion } from './selfupdate.mjs';
-import { globalInstall, INSTALL_COMMAND } from './tool.mjs';
+import { copiesOnPath, globalInstall, INSTALL_COMMAND, removeCommand } from './tool.mjs';
 import { copyLaravelPackage, copyWebTemplate, fromRepository, templateRecord } from './template.mjs';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
@@ -31,24 +32,39 @@ const DOCS = 'https://nevela-docs.vercel.app';
  */
 const ADMIN = { name: 'Admin', email: 'admin@example.com', password: 'password' };
 
-const colour = (code) => (text) => (process.stdout.isTTY ? `\x1b[${code}m${text}\x1b[0m` : text);
+/** Bits of colour the terminal has: 24, 8, 4, 1 for none, and 0 when this isn't going to a terminal. */
+const depth = process.stdout.isTTY ? process.stdout.getColorDepth() : 0;
+const colour = (code) => (text) => (depth > 1 ? `\x1b[${code}m${text}\x1b[0m` : text);
 const bold = colour(1);
 const dim = colour(2);
 const green = colour(32);
 const red = colour(31);
-const indigo = colour('38;5;99');
+// Indigo where there are 256 colours to pick it from; magenta where there are 16.
+const indigo = colour(depth >= 8 ? '38;5;99' : '95');
 
-const HELP = `
-  ${bold('create-nevela')} ${dim(`v${VERSION}`)}
+/**
+ * Whether `nevela` was typed, as opposed to create-nevela (`pnpm create nevela`). Kept in
+ * the environment so a newer installer this one hands over to knows it too.
+ */
+const startedAsNevela = /^nevela(\.mjs)?$/.test(path.basename(process.argv[1] ?? ''));
+const typedNevela = startedAsNevela || process.env.NEVELA_TYPED === 'nevela';
+if (typedNevela) process.env.NEVELA_TYPED = 'nevela';
+
+/** The name, large. Once per run: an installer that handed over to a newer one has shown it. */
+function showTitle() {
+  console.log(banner({ version: VERSION, depth, columns: process.stdout.columns ?? 80, compact: Boolean(process.env.NEVELA_HANDED_OVER) }));
+}
 
-  Create a new Nevela app: a Laravel API and a Next.js dashboard.
+const HELP = `  Create a new Nevela app: a Laravel API and a Next.js dashboard.
 
   ${bold('Get the nevela command')}  (once; everything below is then this short)
     npm install -g create-nevela
 
   ${bold('Anywhere')}
-    nevela new <name> [options]   Create an app. Without the command: pnpm create nevela <name>
+    nevela new [name] [options]   Create an app. It asks for the name if you leave it off.
+                                  Without the command: pnpm create nevela <name>
     nevela update                 Update the nevela command itself to the latest version
+    nevela version                Which version the nevela command is, and this app when in one
 
   ${bold('Inside an app')}
     nevela upgrade             Bring this app to the latest Nevela: the package and the dashboard
@@ -176,6 +192,7 @@ function parseArgs(argv) {
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === '-h' || arg === '--help') {
+      showTitle();
       console.log(HELP);
       process.exit(0);
     } else if (arg === '-v' || arg === '--version') {
@@ -210,6 +227,8 @@ function phpIsTypeable() {
 
 /** `nevela <command>` as someone should type it here: through PHP, or through the package manager. */
 function nevelaCommand(pm) {
+  // Typed as `nevela`, so the command is installed, and it is the shortest of the three.
+  if (typedNevela) return 'nevela';
   if (phpIsTypeable()) return 'php nevela';
   return { pnpm: 'pnpm nevela', yarn: 'yarn nevela', bun: 'bun run nevela' }[pm] ?? 'npm run nevela';
 }
@@ -330,9 +349,8 @@ Docs: ${DOCS}
 async function inProject(name, args) {
   const project = findProject(process.cwd());
   if (!project) {
-    fail(`"${name}" runs inside a Nevela app, and this folder isn't in one.`, `To create an app:  pnpm create nevela my-app`);
+    fail(`"${name}" runs inside a Nevela app, and this folder isn't in one.`, `To create an app:  ${typedNevela ? 'nevela new my-app' : 'pnpm create nevela my-app'}`);
   }
-  if (name === 'version') console.log(`create-nevela ${VERSION}`);
   if (name !== 'upgrade') process.exit(forward(project, name, args));
 
   // Upgrading is the one command that must not run on stale code itself: it is the newest
@@ -351,6 +369,130 @@ async function inProject(name, args) {
   process.exit(status);
 }
 
+/**
+ * How the copy that is running was installed, or null when it isn't the installed command.
+ * The folder it was started through is passed as well as the one its files are in: under
+ * pnpm 11 only the first says it is pnpm's.
+ */
+function installed() {
+  if (fromRepository) return null;
+  const startedFrom = process.argv[1] ? path.dirname(path.resolve(process.argv[1])) : here;
+  return globalInstall(here, fs.existsSync, startedFrom);
+}
+
+/** What typing `nevela` runs now, as "x.y.z", or null when that can't be found out. */
+function versionOnPath() {
+  const answer = spawnCommand('nevela', ['--version'], { stdio: 'pipe', encoding: 'utf8' });
+  return /^\d+\.\d+\.\d+$/m.exec(`${answer.stdout ?? ''}`)?.[0] ?? null;
+}
+
+/** The launcher of the nevela command in `dir`: the file the shell runs. */
+const launcherIn = (dir) => path.join(dir, windows ? 'nevela.cmd' : 'nevela');
+
+/** The version of the nevela command in `dir`, as "x.y.z", or null when it won't say. */
+function copyVersion(dir) {
+  const file = launcherIn(dir);
+  const answer = windows
+    ? spawnSync(`"${file}" --version`, { shell: true, stdio: 'pipe', encoding: 'utf8' })
+    : spawnSync(file, ['--version'], { stdio: 'pipe', encoding: 'utf8' });
+  return /^\d+\.\d+\.\d+$/m.exec(`${answer.stdout ?? ''}`)?.[0] ?? null;
+}
+
+/**
+ * Say so when the nevela command is installed more than once. Only the first on the PATH
+ * ever runs, so an update to one of the others looks like an update that did nothing.
+ * The one to keep is the newest, which is not always the one that runs.
+ */
+function otherCopies() {
+  const copies = copiesOnPath().map((dir) => ({ dir, version: copyVersion(dir) }));
+  if (copies.length < 2) return;
+  let keep = copies[0];
+  for (const copy of copies) {
+    if (copy.version && (!keep.version || isNewer(copy.version, keep.version))) keep = copy;
+  }
+  const width = Math.max(...copies.map((copy) => copy.dir.length));
+  console.log(`\n  ${red('!')} The nevela command is installed ${copies.length} times. Typing ${bold('nevela')} runs the first of these:`);
+  for (const copy of copies) console.log(`      ${copy.dir.padEnd(width)}  ${copy.version ? `v${copy.version}` : ''}`);
+  console.log(keep === copies[0]
+    ? `    Keep that one and remove the rest, so there is one to keep up to date:`
+    : `    The one that runs is not the newest. Remove the others, and ${bold(`v${keep.version}`)} is what ${bold('nevela')} runs:`);
+  const launcher = (dir) => {
+    try {
+      return fs.readFileSync(launcherIn(dir), 'utf8').slice(0, 4000);
+    } catch {
+      return '';
+    }
+  };
+  const removals = new Set(copies.filter((copy) => copy !== keep).map((copy) => removeCommand(copy.dir, launcher(copy.dir))));
+  for (const removal of removals) console.log(`      ${bold(removal)}`);
+}
+
+/** The version of Nevela an app has installed, read from the package, or null. */
+function appVersion(project) {
+  try {
+    const source = fs.readFileSync(path.join(project.api, 'vendor', 'nevela', 'laravel', 'src', 'Nevela.php'), 'utf8');
+    return /const VERSION = '([^']+)'/.exec(source)?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+
+/** `nevela version`, from anywhere: the command's version, and the app's when in one. */
+function showVersion() {
+  const project = findProject(process.cwd());
+  const install = installed();
+  console.log(`\n  ${indigo(bold('Nevela command'))}   ${bold(`v${VERSION}`)}${install ? `  ${dim(`installed with ${install.manager}`)}` : ''}`);
+  if (project) {
+    const app = appVersion(project);
+    if (app === null) {
+      console.log(`  ${indigo(bold('This app'))}         ${dim("Nevela isn't installed in it yet. Run: cd apps/api && composer install")}`);
+    } else {
+      const behind = isNewer(VERSION, app);
+      console.log(`  ${indigo(bold('This app'))}         ${bold(`v${app}`)}${behind ? `  ${dim('To bring it to the latest:')} ${bold('nevela upgrade')}` : ''}`);
+    }
+  }
+  otherCopies();
+  console.log('');
+}
+
+/**
+ * Why `name` can't be the new app's name, or null when it can.
+ */
+function nameProblem(name) {
+  if (name === '') return 'Type a name, for example my-app.';
+  if (!/^[a-z0-9][a-z0-9-_]*$/.test(name)) {
+    return `"${name}" can't be used as a name. Use lowercase letters, numbers and dashes, for example my-app.`;
+  }
+  const root = path.resolve(process.cwd(), name);
+  if (fs.existsSync(root) && fs.readdirSync(root).length > 0) return `${root} already exists and isn't empty.`;
+  return null;
+}
+
+/**
+ * Ask what the app is called, until the answer is a name that can be used. The only
+ * question this ever asks, and only when the name was left off.
+ */
+async function askName() {
+  const prompt = readline.createInterface({ input: process.stdin, output: process.stdout });
+  // Ctrl+C or the end of input, at the question: leave, having created nothing.
+  const closed = new Promise((resolve) => prompt.once('close', () => resolve(null)));
+  prompt.on('SIGINT', () => prompt.close());
+  try {
+    for (;;) {
+      const answer = await Promise.race([prompt.question(`  ${green('What is the name of your app?')} `).catch(() => null), closed]);
+      if (answer === null) {
+        console.log('\n');
+        process.exit(130);
+      }
+      const problem = nameProblem(answer.trim());
+      if (problem === null) return answer.trim();
+      console.log(`  ${red('✖')} ${problem}\n`);
+    }
+  } finally {
+    prompt.close();
+  }
+}
+
 /**
  * `nevela update`, from anywhere: update the nevela command itself.
  *
@@ -362,7 +504,7 @@ async function inProject(name, args) {
  */
 async function updateTool(args) {
   const project = findProject(process.cwd());
-  const install = fromRepository ? null : globalInstall(here);
+  const install = installed();
 
   if (!install) {
     // Run through npx or `pnpm dlx`, which fetch the latest every time, started by an
@@ -373,32 +515,46 @@ async function updateTool(args) {
       console.log(`\n  ${dim(`"update" now updates the nevela command, and an app is brought up to date with "upgrade". Upgrading this app.`)}`);
       await inProject('upgrade', args);
     }
-    console.log(`\n  ${indigo(bold('Nevela'))} ${dim(`v${VERSION}`)}\n`);
+    showTitle();
     console.log(`  The nevela command isn't installed on this computer, so there is nothing to update.`);
     console.log(`  To install it:  ${bold(INSTALL_COMMAND)}`);
     console.log(`  Then, anywhere: ${bold('nevela new my-app')}   and inside an app: ${bold('nevela upgrade')}, ${bold('nevela dev')}\n`);
     return;
   }
 
-  console.log(`\n  ${indigo(bold('Nevela'))} ${dim('update')}\n`);
+  showTitle();
+  console.log(`  ${indigo(`Nevela self-update — current: v${VERSION}`)}\n`);
+  console.log(`  ${dim('→ Checking npm for the latest release…')}\n`);
   const latest = await latestVersion();
   const newer = latest !== null && isNewer(latest, VERSION) ? latest : null;
   if (latest === null) {
     // Not the same as being up to date, so it isn't reported as that.
     console.log(`  ${red('!')} Couldn't reach npm to see whether there is a newer nevela than ${bold(VERSION)}. Nothing was changed.`);
-    console.log(`    Try again when you are online, or run:  ${install.command.join(' ')}`);
+    console.log(`    Try again when you are online, or run:  ${install.command().join(' ')}`);
     process.exitCode = 1;
   } else if (!newer) {
-    console.log(`  ${green('✔')} nevela ${bold(VERSION)} is the latest.`);
+    console.log(`  ${green(`✔ Already on the latest version (v${VERSION}). Nothing to do.`)}`);
   } else {
-    console.log(`  Updating the nevela command ${bold(VERSION)} → ${bold(newer)} ${dim(`(${install.command.join(' ')})`)}\n`);
-    const [command, ...rest] = install.command;
+    // The version by number, not "latest": pnpm holds "latest" back for a day.
+    const [command, ...rest] = install.command(newer);
+    console.log(`  Updating v${VERSION} → ${bold(`v${newer}`)} ${dim(`(${[command, ...rest].join(' ')})`)}\n`);
     const result = spawnCommand(command, rest, { stdio: 'inherit' });
     if (result.error || result.status !== 0) {
-      fail(`Couldn't update the nevela command.`, `Run it yourself to see why:  ${install.command.join(' ')}`);
+      fail(`Couldn't update the nevela command.`, `Run it yourself to see why:  ${[command, ...rest].join(' ')}`);
+    }
+    // The package manager saying so isn't the same as the command being newer: ask it.
+    const now = versionOnPath();
+    if (now === newer || now === null) {
+      console.log(`\n  ${green(`✔ Updated to v${newer}.`)} ${dim('Every nevela command, and every app you create from now on, uses it.')}`);
+    } else {
+      console.log(`\n  ${red('!')} ${install.manager} installed ${bold(`v${newer}`)}, but typing ${bold('nevela')} still runs ${bold(`v${now}`)}.`);
+      if (copiesOnPath().length < 2) {
+        console.log(`    Open a new terminal and run ${bold('nevela version')}. If it still says v${now}, the copy that runs was installed another way.`);
+      }
+      process.exitCode = 1;
     }
-    console.log(`\n  ${green('✔')} nevela is now ${bold(newer)}.`);
   }
+  otherCopies();
   if (project) {
     console.log(`  ${dim('This app is not changed by that. To bring it to the latest Nevela:')} ${bold('nevela upgrade')}`);
   }
@@ -409,10 +565,18 @@ async function main() {
   const argv = process.argv.slice(2);
   if (argv[0] === 'new') argv.shift();
   else if (argv[0] === 'update') return updateTool(argv.slice(1));
+  else if (argv[0] === 'version') return showVersion();
   else if (COMMANDS.includes(argv[0])) await inProject(argv[0], argv.slice(1));
+  else if (argv[0] === 'help' || (startedAsNevela && argv.length === 0)) {
+    // `nevela` on its own says what it can do. `pnpm create nevela` on its own starts an
+    // app, and so does a newer installer that an older `nevela new` handed over to.
+    showTitle();
+    console.log(HELP);
+    return;
+  }
   const options = parseArgs(argv);
 
-  console.log(`\n  ${indigo(bold('Nevela'))} ${dim(`v${VERSION}`)}\n`);
+  showTitle();
 
   // A package manager may hand over an older installer than the newest: pnpm skips versions
   // published in the last few hours, and both pnpm and npm cache. Fetch the newest and let
@@ -430,19 +594,17 @@ async function main() {
   }
 
   let name = options.name;
-  if (!name) {
-    // The only question this ever asks, and only when the name was left off.
-    if (options.yes || !process.stdin.isTTY) fail('Give the app a name: pnpm create nevela my-app');
-    const prompt = readline.createInterface({ input: process.stdin, output: process.stdout });
-    name = (await prompt.question('  What is the app called? ')).trim();
-    prompt.close();
-  }
-  if (!/^[a-z0-9][a-z0-9-_]*$/.test(name)) {
-    fail(`"${name}" can't be used as a name. Use lowercase letters, numbers and dashes, for example my-app.`);
+  if (name === undefined) {
+    // Nobody to ask: say what to type instead.
+    if (options.yes || !process.stdin.isTTY) fail(`Give the app a name: ${typedNevela ? 'nevela new my-app' : 'pnpm create nevela my-app'}`);
+    name = await askName();
+    console.log('');
+  } else {
+    const problem = nameProblem(name);
+    if (problem) fail(problem);
   }
 
   const root = path.resolve(process.cwd(), name);
-  if (fs.existsSync(root) && fs.readdirSync(root).length > 0) fail(`${root} already exists and isn't empty.`);
 
   checkRequirements();
   const pm = detectPackageManager(options.pm);
@@ -583,7 +745,7 @@ async function main() {
   }
   console.log(`\n  Add your first resource: ${dim(`${nevela} resource Product --fields="name:string, price:money"`)}`);
   console.log(`  Check the app: ${dim(`${nevela} status`)}   Upgrade it later: ${dim(`${nevela} upgrade`)}   Everything: ${dim(nevela)}`);
-  if (nevela !== 'php nevela') {
+  if (nevela !== 'php nevela' && nevela !== 'nevela') {
     console.log(`\n  ${dim(`In this shell "php" isn't a command (your PHP is php.bat), so use ${nevela}. In PowerShell, php nevela works too.`)}`);
   }
   console.log(`  Docs: ${DOCS}/start/quickstart/\n`);

package/net.mjs

@@ -0,0 +1,55 @@
+// Reading a URL, without fetch().
+//
+// On Windows, a process that exits just after a fetch() has finished trips an assertion
+// inside Node ("UV_HANDLE_CLOSING") and prints a crash where the error message should be.
+// The installer asks npm for the latest version first thing, so every mistake it reports
+// straight afterwards ended that way: no app name, a name it can't use, a folder that
+// already exists. A plain https request on a connection that closes with the answer doesn't.
+
+import https from 'node:https';
+
+/**
+ * GET `url`. Resolves to { ok, status, body } with the body as a Buffer, or to null when
+ * the server couldn't be reached within `milliseconds`. Never rejects.
+ *
+ * The time allowed is for the whole exchange, redirects included, and not only for a
+ * silence on the line.
+ */
+export function get(url, milliseconds, redirects = 3, deadline = Date.now() + milliseconds) {
+  return new Promise((resolve) => {
+    let timer = null;
+    const settle = (value) => {
+      clearTimeout(timer);
+      resolve(value);
+    };
+    try {
+      const request = https.get(url, { agent: false, headers: { connection: 'close', 'user-agent': 'create-nevela' } }, (response) => {
+        const status = response.statusCode ?? 0;
+        if (status >= 300 && status < 400 && response.headers.location && redirects > 0) {
+          response.resume();
+          settle(get(new URL(response.headers.location, url).href, milliseconds, redirects - 1, deadline));
+          return;
+        }
+        const chunks = [];
+        response.on('data', (chunk) => chunks.push(chunk));
+        response.on('end', () => settle({ ok: status >= 200 && status < 300, status, body: Buffer.concat(chunks) }));
+        response.on('error', () => settle(null));
+      });
+      request.on('error', () => settle(null));
+      timer = setTimeout(() => request.destroy(new Error('timed out')), Math.max(0, deadline - Date.now()));
+    } catch {
+      settle(null);
+    }
+  });
+}
+
+/** GET `url` and read it as JSON. Null when it couldn't be reached, or isn't JSON, or isn't a 2xx. */
+export async function getJson(url, milliseconds) {
+  const response = await get(url, milliseconds);
+  if (!response?.ok) return null;
+  try {
+    return JSON.parse(response.body.toString('utf8'));
+  } catch {
+    return null;
+  }
+}

package/nevela.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// The `nevela` command.
+//
+// The same program as create-nevela. It has a file of its own so the program can tell
+// which of the two was typed: `nevela` with nothing after it says what it can do, where
+// `pnpm create nevela` with nothing after it starts a new app.
+
+await import('./index.mjs');

package/package.json

@@ -1,14 +1,17 @@
 {
   "name": "create-nevela",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Create a new Nevela app: a Laravel API and a Next.js dashboard from one resource description.",
   "type": "module",
   "bin": {
     "create-nevela": "index.mjs",
-    "nevela": "index.mjs"
+    "nevela": "nevela.mjs"
   },
   "files": [
     "index.mjs",
+    "nevela.mjs",
+    "banner.mjs",
+    "net.mjs",
     "template.mjs",
     "packagist.mjs",
     "selfupdate.mjs",

package/packagist.mjs

@@ -1,8 +1,12 @@
 // Deciding where a new app gets nevela/laravel from.
 
+import { getJson } from './net.mjs';
+
+const RELEASES = 'https://repo.packagist.org/p2/nevela/laravel.json';
+
 /** Whether `candidate` is a stable release Composer's `^major.minor` would accept. */
 export function satisfiesCaret(candidate, [major, minor]) {
-  const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(candidate);
+  const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(String(candidate));
   if (!match) return false;
   const [theirMajor, theirMinor] = match.slice(1).map(Number);
   // Below 1.0 a caret holds the minor version too: ^0.1 means 0.1.x only.
@@ -23,29 +27,18 @@ export function isNewer(a, b) {
  * listed isn't enough: with no tagged release yet, `composer require` would fail.
  */
 export async function onPackagist(wanted) {
-  try {
-    const response = await fetch('https://repo.packagist.org/p2/nevela/laravel.json', { signal: AbortSignal.timeout(8000) });
-    if (!response.ok) return false;
-    const releases = (await response.json()).packages?.['nevela/laravel'] ?? [];
-    return releases.some((release) => satisfiesCaret(release.version, wanted));
-  } catch {
-    return false;
-  }
+  const releases = (await getJson(RELEASES, 8000))?.packages?.['nevela/laravel'];
+  return Array.isArray(releases) && releases.some((release) => satisfiesCaret(release?.version, wanted));
 }
 
 /** The newest stable nevela/laravel on Packagist, as "x.y.z", or null when it can't be reached. */
 export async function latestRelease() {
-  try {
-    const response = await fetch('https://repo.packagist.org/p2/nevela/laravel.json', { signal: AbortSignal.timeout(8000) });
-    if (!response.ok) return null;
-    const releases = (await response.json()).packages?.['nevela/laravel'] ?? [];
-    let latest = null;
-    for (const release of releases) {
-      const version = /^v?(\d+\.\d+\.\d+)$/.exec(release.version)?.[1];
-      if (version && (latest === null || isNewer(version, latest))) latest = version;
-    }
-    return latest;
-  } catch {
-    return null;
+  const releases = (await getJson(RELEASES, 8000))?.packages?.['nevela/laravel'];
+  if (!Array.isArray(releases)) return null;
+  let latest = null;
+  for (const release of releases) {
+    const version = /^v?(\d+\.\d+\.\d+)$/.exec(String(release?.version))?.[1];
+    if (version && (latest === null || isNewer(version, latest))) latest = version;
   }
+  return latest;
 }

package/selfupdate.mjs

@@ -10,19 +10,15 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import zlib from 'node:zlib';
+import { get, getJson } from './net.mjs';
 import { isNewer } from './packagist.mjs';
 
 const REGISTRY = 'https://registry.npmjs.org/create-nevela';
 
 /** The newest create-nevela on npm, or null when npm couldn't be asked. Never throws. */
 export async function latestVersion() {
-  try {
-    const response = await fetch(`${REGISTRY}/latest`, { signal: AbortSignal.timeout(4000) });
-    const latest = (await response.json()).version;
-    return typeof latest === 'string' && /^\d+\.\d+\.\d+$/.test(latest) ? latest : null;
-  } catch {
-    return null;
-  }
+  const latest = (await getJson(`${REGISTRY}/latest`, 4000))?.version;
+  return typeof latest === 'string' && /^\d+\.\d+\.\d+$/.test(latest) ? latest : null;
 }
 
 /**
@@ -84,16 +80,17 @@ export function untar(buffer, dir) {
 export async function runVersion(version, args) {
   const dir = path.join(os.tmpdir(), `create-nevela-${version}-${process.pid}`);
   try {
-    const response = await fetch(`${REGISTRY}/-/create-nevela-${version}.tgz`, { signal: AbortSignal.timeout(30000) });
-    if (!response.ok) return null;
-    untar(zlib.gunzipSync(Buffer.from(await response.arrayBuffer())), dir);
+    const response = await get(`${REGISTRY}/-/create-nevela-${version}.tgz`, 30000);
+    if (!response?.ok) return null;
+    untar(zlib.gunzipSync(response.body), dir);
     const entry = path.join(dir, 'package', 'index.mjs');
     if (!fs.existsSync(entry)) return null;
 
     const result = spawnSync(process.execPath, [entry, ...args], {
       stdio: 'inherit',
-      // The newer one must not go looking for a newer one in turn.
-      env: { ...process.env, NEVELA_NO_SELF_UPDATE: '1' },
+      // The newer one must not go looking for a newer one in turn, and the name has
+      // already been printed large once.
+      env: { ...process.env, NEVELA_NO_SELF_UPDATE: '1', NEVELA_HANDED_OVER: '1' },
     });
     return result.status ?? 1;
   } catch {

package/template/laravel/src/Nevela.php

@@ -18,7 +18,7 @@ use Nevela\Laravel\Support\Naming;
 final class Nevela
 {
     /** Written by `pnpm release`; the same number as the repository's git tag. */
-    public const VERSION = '0.4.1';
+    public const VERSION = '0.4.3';
 
     /** @var array<string, Descriptor> */
     private static array $descriptors = [];

package/template/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nevela-web",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "private": true,
   "type": "module",
   "scripts": {

package/tool.mjs

@@ -6,43 +6,64 @@
 //   nevela upgrade    the app you are in: its Nevela package and its dashboard
 //
 // Updating the command means asking the package manager that installed it to install the
-// latest. Which one that was is read from where this file is running from.
+// newest version. Which one that was is read from where this file is running from.
 
 import fs from 'node:fs';
 
-/** The command that installs the latest create-nevela globally, for each package manager. */
+/**
+ * The command that installs create-nevela globally, for each package manager.
+ *
+ * `nevela update` names the exact version it found on npm, not "latest": pnpm holds a
+ * version back for a day after it is published, so `pnpm add -g create-nevela@latest`
+ * installs yesterday's. Asked for a version by number, it installs that one.
+ */
 const INSTALL = {
-  npm: ['npm', 'install', '-g', 'create-nevela@latest'],
-  pnpm: ['pnpm', 'add', '-g', 'create-nevela@latest'],
-  yarn: ['yarn', 'global', 'add', 'create-nevela@latest'],
-  bun: ['bun', 'add', '-g', 'create-nevela@latest'],
+  npm: (version) => ['npm', 'install', '-g', `create-nevela@${version}`],
+  pnpm: (version) => ['pnpm', 'add', '-g', `create-nevela@${version}`],
+  yarn: (version) => ['yarn', 'global', 'add', `create-nevela@${version}`],
+  bun: (version) => ['bun', 'add', '-g', `create-nevela@${version}`],
 };
 
 /**
- * How the running copy was installed, from the folder it is in.
+ * How the running copy was installed, from the folder it is in and the folder it was
+ * started through.
+ *
+ * Those two differ under pnpm 11, which keeps the files of every package in its store and
+ * leaves a link to them in its global folder. Node reports the store; the command was
+ * started through the global folder. Going by the store alone, a pnpm install looked like
+ * an npm one, and `nevela update` updated a copy that was not the one running.
  *
- * Returns the package manager and the command that updates it, or null when this copy
+ * Returns the package manager and `command(version)`, which updates it, or null when this copy
  * isn't the installed command: it was fetched for a single run (npx, pnpm dlx, a
  * self-update), it is the repository itself, or it is a dependency in some project's own
  * node_modules. Updating the global command would not change the copy that is running in
  * any of those cases.
  *
- * @param {string} dir     The folder this package is running from
+ * @param {string} dir     The folder this package's files are in
  * @param {(file: string) => boolean} exists  Whether a file exists; replaceable in tests
+ * @param {string} startedFrom  The folder it was started through, when that is another
  */
-export function globalInstall(dir, exists = fs.existsSync) {
-  const plain = dir.replace(/\\/g, '/').replace(/\/+$/, '');
+export function globalInstall(dir, exists = fs.existsSync, startedFrom = dir) {
+  const tidy = (folder) => folder.replace(/\\/g, '/').replace(/\/+$/, '');
+  const plain = tidy(dir);
   const where = plain.toLowerCase();
+  const started = tidy(startedFrom).toLowerCase();
+  const found = (manager) => ({ manager, command: (version = 'latest') => INSTALL[manager](version) });
 
   // Fetched for one run and thrown away afterwards.
-  if (/\/_npx\/|\/dlx[-/]|\/\.?bunx-|\/xfs-[0-9a-f]+\/|\/create-nevela-\d[^/]*\/package$/.test(where)) return null;
+  if ([where, started].some((folder) => /\/_npx\/|\/dlx[-/]|\/\.?bunx-|\/xfs-[0-9a-f]+\/|\/create-nevela-\d[^/]*\/package$/.test(folder))) return null;
   // Installed, as opposed to checked out: it sits in somebody's node_modules.
   if (!/\/node_modules\/create-nevela$/.test(where)) return null;
 
   // pnpm, yarn and bun each keep global packages in a folder of their own.
-  if (/\/pnpm\/global\//.test(where)) return { manager: 'pnpm', command: INSTALL.pnpm };
-  if (/\/\.bun\/install\/global\//.test(where)) return { manager: 'bun', command: INSTALL.bun };
-  if (/\/yarn\/(data\/)?global\/|\/\.config\/yarn\/global\//.test(where)) return { manager: 'yarn', command: INSTALL.yarn };
+  for (const folder of [started, where]) {
+    if (!/\/node_modules\/create-nevela$/.test(folder)) continue;
+    if (/\/pnpm\/global\/|\/global\/v?\d+\/([^/]+\/)?node_modules\/create-nevela$/.test(folder)) return found('pnpm');
+    if (/\/\.bun\/install\/global\//.test(folder)) return found('bun');
+    if (/\/yarn\/(data\/)?global\/|\/\.config\/yarn\/global\//.test(folder)) return found('yarn');
+  }
+  // In pnpm's store, and not reached through its global folder: a project's dependency.
+  if (/\/store\/v?\d+\/links\//.test(where)) return null;
 
   // npm's global folder is a plain node_modules, like a project's. Two things tell them
   // apart: a project has a package.json beside its node_modules, and a dependency of a
@@ -51,8 +72,57 @@ export function globalInstall(dir, exists = fs.existsSync) {
   const owner = plain.slice(0, where.lastIndexOf('/node_modules/'));
   if (exists(`${owner}/package.json`)) return null;
 
-  return { manager: 'npm', command: INSTALL.npm };
+  return found('npm');
+}
+
+/**
+ * Every folder on the PATH that holds a nevela command, in the order the shell looks.
+ *
+ * More than one means it was installed more than once, say with npm and with pnpm. The
+ * shell runs the first and never mentions the rest, so updating one of the others changes
+ * nothing you can see: `npm install -g create-nevela@latest` succeeds and `nevela` is
+ * still the old one.
+ *
+ * @param {Record<string, string | undefined>} env
+ * @param {object} [system]  Replaceable in tests
+ */
+export function copiesOnPath(env = process.env, { exists = fs.existsSync, real = fs.realpathSync, windows = process.platform === 'win32' } = {}) {
+  const names = windows ? ['nevela.cmd', 'nevela.exe', 'nevela.ps1', 'nevela'] : ['nevela'];
+  const separator = windows ? '\\' : '/';
+  const found = [];
+  const seen = new Set();
+  for (const entry of String(env.PATH ?? env.Path ?? '').split(windows ? ';' : ':')) {
+    const dir = entry.trim().replace(/^"|"$/g, '').replace(/[\\/]+$/, '');
+    if (!dir) continue;
+    const file = names.map((name) => `${dir}${separator}${name}`).find((candidate) => exists(candidate));
+    if (!file) continue;
+    // The same folder listed twice, or two names for one folder (/bin and /usr/bin), is one copy.
+    let target = file;
+    try {
+      target = real(file);
+    } catch {
+      // Left as it is.
+    }
+    const key = windows ? target.toLowerCase() : target;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    found.push(dir);
+  }
+  return found;
+}
+
+/**
+ * What removes the copy whose command is in `dir`, judged by the folder and by the
+ * launcher in it: a small script that names the folder the package itself is in.
+ */
+export function removeCommand(dir, launcher = '') {
+  const where = dir.replace(/\\/g, '/').toLowerCase();
+  const points = launcher.replace(/\\/g, '/').toLowerCase();
+  if (/\/pnpm(\/|$)/.test(where) || /\/global\/v?\d+\/([^/]+\/)?node_modules\/create-nevela\//.test(points)) return 'pnpm remove -g create-nevela';
+  if (/\/\.bun\//.test(where)) return 'bun remove -g create-nevela';
+  if (/\/yarn\/|\/\.yarn\//.test(where)) return 'yarn global remove create-nevela';
+  return 'npm uninstall -g create-nevela';
 }
 
 /** What to type to get the `nevela` command, for someone who doesn't have it yet. */
-export const INSTALL_COMMAND = INSTALL.npm.join(' ').replace('@latest', '');
+export const INSTALL_COMMAND = 'npm install -g create-nevela';