create-nowaki 0.13.0 → 0.15.0

package/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-// `npm create nowaki` のスキャフォールダ。依存ゼロ（Node 組み込みのみ）。
-// 対話ウィザード（TTY 時）: プロジェクト名・パッケージマネージャ・git・依存インストール。
-// 非対話（CI / `-y` / パイプ）では既定値で黙って生成する。
+// Scaffolder for `npm create nowaki`. Zero dependencies (Node built-ins only).
+// Interactive wizard (on a TTY): project name, package manager, git, dependency install.
+// Non-interactive (CI / `-y` / pipe): no prompts, generates with defaults.
 //
-// フラグ: -t/--template <basics|minimal>, -y/--yes（質問を飛ばす）,
-//         --install（非対話でも入れる）, --no-install, --no-git, --pm <npm|pnpm|yarn|bun>
+// Flags: -t/--template <basics|minimal>, -y/--yes (skip prompts),
+//        --install (install even when non-interactive), --no-install, --no-git, --pm <npm|pnpm|yarn|bun>
 
 import { cp, mkdir, readdir, readFile, writeFile, rename } from "node:fs/promises";
 import path from "node:path";
@@ -15,7 +15,7 @@ import process from "node:process";
 
 const { stdin, stdout, env, argv, platform } = process;
 
-// --- 色（NO_COLOR と非 TTY を尊重）---
+// Respects NO_COLOR and non-TTY output.
 const useColor = !!stdout.isTTY && !env.NO_COLOR;
 const wrap = (code) => (s) => (useColor ? `\x1b[${code}m${s}\x1b[0m` : `${s}`);
 const cyan = wrap("36");
@@ -25,9 +25,8 @@ const green = wrap("32");
 const red = wrap("31");
 const yellow = wrap("33");
 
-// --- 引数 ---
 const args = argv.slice(2);
-// 値をとるフラグ。これらの直後の引数は positional ではない。
+// Flags that take a value. The argument right after one is not positional.
 const VALUE_FLAGS = new Set(["--pm", "--template", "-t"]);
 const flagAt = (...names) => {
   const i = args.findIndex((a) => names.includes(a));
@@ -37,7 +36,7 @@ const flags = new Set(args.filter((a) => a.startsWith("-")));
 const positionals = [];
 for (let i = 0; i < args.length; i++) {
   if (args[i].startsWith("-")) {
-    if (VALUE_FLAGS.has(args[i])) i++; // フラグの値を飛ばす
+    if (VALUE_FLAGS.has(args[i])) i++;
     continue;
   }
   positionals.push(args[i]);
@@ -51,13 +50,11 @@ const noGit = flags.has("--no-git");
 const interactive = !!stdin.isTTY && !!stdout.isTTY && !yes;
 
 const templatesDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "templates");
-// 利用可能なテンプレート（templates/<name>、_shared は共通設定）。
 const TEMPLATES = [
   { value: "basics", hint: "starter with an interactive island" },
   { value: "minimal", hint: "a single page, zero islands" },
 ];
 
-// --- パッケージマネージャ検出（`npm create` の user-agent から）---
 function detectPM() {
   const ua = env.npm_config_user_agent || "";
   if (ua.startsWith("pnpm")) return "pnpm";
@@ -66,7 +63,6 @@ function detectPM() {
   return "npm";
 }
 
-// --- バナー ---
 console.log();
 console.log(`  ${cyan(bold("Nowaki"))} ${dim("野分")}  ${dim("· create a new app")}`);
 console.log();
@@ -83,7 +79,6 @@ async function confirm(question, def = true) {
   if (!a) return def;
   return a === "y" || a === "yes";
 }
-// 番号 or 名前で選ぶ簡易メニュー（依存なし）。
 async function select(question, options, def) {
   if (!rl) return def;
   console.log(`  ${question}`);
@@ -98,14 +93,12 @@ async function select(question, options, def) {
   return options.some((o) => o.value === a) ? a : def;
 }
 
-// --- 質問 ---
 let name = positionals[0] || (await ask("Project name?", interactive ? "my-app" : "nowaki-app"));
 name = name.trim() || "nowaki-app";
-// package.json の name は valid な npm 名に正規化（ディレクトリ名は入力のまま）
+// Keep the directory name as typed; normalize only package.json's name to a valid npm name.
 const pkgName = name.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[._-]+/, "") || "nowaki-app";
 const dest = path.resolve(process.cwd(), name);
 
-// 既存の空でないディレクトリは中止
 try {
   const existing = await readdir(dest);
   if (existing.length > 0) {
@@ -113,11 +106,8 @@ try {
     rl?.close();
     process.exit(1);
   }
-} catch {
-  // 無ければOK
-}
+} catch {}
 
-// テンプレート選択（-t/--template or 対話メニュー、既定 basics）。
 let template = templateFlag || (interactive ? await select("Template?", TEMPLATES, "basics") : "basics");
 template = String(template).toLowerCase();
 if (!TEMPLATES.some((t) => t.value === template)) {
@@ -132,8 +122,7 @@ let pm = pmFlag || detectPM();
 if (interactive && !pmFlag) pm = (await ask("Package manager?", pm)).trim() || pm;
 if (!["npm", "pnpm", "yarn", "bun"].includes(pm)) pm = "npm";
 const doGit = noGit ? false : await confirm("Initialize a git repository?", false);
-// 依存インストール: 対話なら確認（既定 Yes）。非対話（-y / CI / パイプ）は自動実行しない
-//（驚き防止）。非対話で入れたいときは --install。--no-install は常にスキップ。
+// Non-interactive (-y / CI / pipe): to avoid surprises, don't install unless --install is given.
 const doInstall = noInstall
   ? false
   : forceInstall
@@ -143,34 +132,30 @@ const doInstall = noInstall
       : false;
 rl?.close();
 
-// --- 生成 ---
-// 共通設定（_shared）→ 選択テンプレートの順に重ねる。
+// Layer the shared config (_shared), then the chosen template.
 await mkdir(dest, { recursive: true });
 await cp(path.join(templatesDir, "_shared"), dest, { recursive: true });
 await cp(path.join(templatesDir, template), dest, { recursive: true });
 
-// npm は公開時に .gitignore を除外するので、テンプレートでは _gitignore で持ち、ここで戻す。
+// npm strips .gitignore on publish, so templates ship _gitignore and it's renamed back here.
 try {
   await rename(path.join(dest, "_gitignore"), path.join(dest, ".gitignore"));
-} catch {
-  // _gitignore が無ければ素通し
-}
+} catch {}
+try {
+  await rename(path.join(dest, "env.example"), path.join(dest, ".env.example"));
+} catch {}
 
-// package.json の name を設定
 try {
   const pkgPath = path.join(dest, "package.json");
   const pkg = JSON.parse(await readFile(pkgPath, "utf8"));
   pkg.name = pkgName;
   await writeFile(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
-} catch {
-  // package.json が無ければ素通し
-}
+} catch {}
 
 console.log(
   `\n  ${green("✓")} created ${bold(name)} ${dim(`(${template} template · ${path.relative(process.cwd(), dest) || "."})`)}`,
 );
 
-// git init（任意）
 if (doGit) {
   try {
     execFileSync("git", ["init", "-q"], { cwd: dest, stdio: "ignore" });
@@ -180,7 +165,6 @@ if (doGit) {
   }
 }
 
-// 依存インストール（任意）
 let installed = false;
 if (doInstall) {
   console.log(`\n  ${dim(`installing dependencies with ${pm}…`)}\n`);
@@ -193,7 +177,6 @@ if (doInstall) {
   }
 }
 
-// --- 次のステップ ---
 const runDev = pm === "npm" || pm === "bun" ? `${pm} run dev` : `${pm} dev`;
 console.log(`\n  ${bold("Next steps:")}`);
 console.log(`    cd ${name}`);

package/package.json

@@ -1,16 +1,16 @@
 {
   "name": "create-nowaki",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Scaffold a new Nowaki app",
   "license": "MIT",
-  "author": "VorEdge <dev@voredge.com>",
+  "author": "Tettu0530",
   "homepage": "https://nowaki.dev",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/nowaki-dev/nowaki.git",
+    "url": "git+https://github.com/Tettu0530/nowaki.git",
     "directory": "packages/create-nowaki"
   },
-  "bugs": "https://github.com/nowaki-dev/nowaki/issues",
+  "bugs": "https://github.com/Tettu0530/nowaki/issues",
   "keywords": [
     "nowaki",
     "create",

package/templates/_shared/AGENTS.md

@@ -84,13 +84,22 @@ nowaki.config.mjs   plugins (optional)
    islands to cut work on first load. The directives are typed (no prop leaks).
 7. **Server functions** — a module with a top-of-file `"use server"` directive
    becomes RPC; the client gets a tiny fetch proxy, the implementation stays on
-   the server. Validate arguments; read auth via `getContext()`:
+   the server. Validate the input with `serverFn(schema, impl)` (any Standard
+   Schema library: zod, valibot, arktype); `nowaki build` warns about exports that
+   take arguments without it. Read auth via `getContext()`, and throw
+   `ServerFnError` for messages the client may see (other errors are a generic
+   500 in production):
    ```ts
    // actions/todos.ts
    "use server";
-   import { getContext } from "@nowaki-dev/runtime";
-   export async function addTodo(text: string) { /* runs on the server */ }
+   import { z } from "zod";
+   import { getContext, serverFn, ServerFnError } from "@nowaki-dev/runtime";
+   export const addTodo = serverFn(z.string().min(1).max(200), async (text) => {
+     if (!getContext()?.cookies?.user) throw new ServerFnError("Sign in first", { status: 401 });
+     /* runs on the server with a validated string */
+   });
    ```
+   The **basics** template includes `actions/echo.ts` as a minimal validated example.
    Call it from an island like a normal async function:
    `import { addTodo } from "../actions/todos.ts";`
 8. **Jetstream islands** (server-reactive, zero client JS) — give an island
@@ -112,6 +121,17 @@ nowaki.config.mjs   plugins (optional)
     ```
     Unknown paths, missing params, and wrong param keys are compile errors.
 
+## Security
+
+- **`nowaki dev` is for local development.** Do not expose it to untrusted networks.
+  Use `nowaki start` or a deploy adapter output in production.
+- **Secrets stay server-side.** Only `PUBLIC_*` (and `MODE`) reach the browser. Copy
+  `.env.example` to `.env` and keep database URLs, API keys, and tokens unprefixed.
+- **Server functions and API routes are public endpoints.** Validate and bound every
+  argument; authorize with `getContext()` (cookies/headers) before mutating data.
+- **Do not embed secrets** in client islands, loaders returned to the page, or static
+  prerender output. ISR pages must not include per-user secrets.
+
 ## Don't
 
 - Don't add a build tool (Vite/webpack/Babel) or a `tsconfig` paths setup — the

package/templates/_shared/README.md

@@ -8,6 +8,7 @@ components under `islands/` ship JavaScript and hydrate.
 
 ```bash
 npm install
+cp .env.example .env   # optional — only PUBLIC_* vars belong in client bundles
 npm run dev      # http://localhost:3000
 ```
 
@@ -43,6 +44,7 @@ actions/     "use server" RPC modules (optional)
   `preact/compat`, so many React libraries work.)
 - Use **explicit file extensions** in relative imports: `../islands/Counter.tsx`.
 - A route's `loader` runs only on the server; `action` handles non-GET requests.
+- `routes/api/health.ts` is a minimal JSON API example; `routes/_404.tsx` handles unknown paths.
 - `AGENTS.md` documents the conventions for AI coding agents.
 
 Docs: <https://nowaki.dev/docs>

package/templates/_shared/env.example

@@ -0,0 +1,7 @@
+# Copy to `.env` for local development. Never commit `.env` (see `.gitignore`).
+#
+# Only variables prefixed with PUBLIC_ are inlined into client bundles.
+# Everything else stays on the server (loaders, actions, server functions).
+#
+# PUBLIC_SITE_NAME=My App
+# DATABASE_URL=postgres://...   # server-only — do not prefix with PUBLIC_

package/templates/_shared/nowaki-env.d.ts

@@ -1,5 +1,5 @@
-// Nowaki アンビエント型。CSS / アセット / 仮想モジュールの import をエディタが理解できるように。
-// 編集不要（フレームワークの import 規約を型に伝えるだけ）。
+// Nowaki ambient types, so editors understand CSS / asset / virtual-module imports.
+// No need to edit (it only teaches the type checker the framework's import conventions).
 
 declare module "*.module.css" {
   const classes: Record<string, string>;
@@ -10,7 +10,7 @@ declare module "*.css" {
   export default css;
 }
 
-// アセット import は配信 URL（文字列）になる。
+// An asset import becomes its served URL (a string).
 declare module "*.svg" { const url: string; export default url; }
 declare module "*.png" { const url: string; export default url; }
 declare module "*.jpg" { const url: string; export default url; }
@@ -29,32 +29,31 @@ declare module "*.mp3" { const url: string; export default url; }
 declare module "*.wav" { const url: string; export default url; }
 declare module "*.pdf" { const url: string; export default url; }
 
-// プラグインの仮想モジュール（nowaki.config の resolveId/load）。任意の export を許す。
+// Plugin virtual modules (resolveId/load in nowaki.config). Any export is allowed.
 declare module "virtual:*";
 
-// 遅延ハイドレーション指令（Astro 互換の client:*）を任意のコンポーネントに付けられるよう、
-// preact の JSX.IntrinsicAttributes を拡張する。<Counter client:visible /> 等が型チェックを通る。
-// （この import で本ファイルはモジュールになる＝下のグローバル型は declare global で公開する。）
+// Extends preact's JSX.IntrinsicAttributes so client:* directives can go on any component.
+// This import makes the file a module, so the global types below are exposed via declare global.
 import "preact";
 declare module "preact" {
   namespace JSX {
     interface IntrinsicAttributes {
-      /** ページ読み込み時にハイドレート（既定）。 */
+      /** Hydrate on page load (default). */
       "client:load"?: boolean;
-      /** requestIdleCallback でアイドル時にハイドレート。 */
+      /** Hydrate when idle, via requestIdleCallback. */
       "client:idle"?: boolean;
-      /** IntersectionObserver で可視になったらハイドレート。 */
+      /** Hydrate once visible, via IntersectionObserver. */
       "client:visible"?: boolean;
-      /** 指定メディアクエリが一致したらハイドレート。例: client:media="(min-width: 768px)" */
+      /** Hydrate when the media query matches. e.g. client:media="(min-width: 768px)" */
       "client:media"?: string;
-      /** SSR せず、クライアントだけで描画（ブラウザ専用 API を使う島向け）。 */
+      /** Skip SSR and render on the client only (for islands using browser-only APIs). */
       "client:only"?: boolean;
     }
   }
 }
 
 declare global {
-  // import.meta.env（PUBLIC_* と MODE がビルド時に inline される）。
+  // import.meta.env (PUBLIC_* and MODE are inlined at build time).
   interface ImportMetaEnv {
     readonly MODE: string;
     readonly [key: `PUBLIC_${string}`]: string | undefined;

package/templates/_shared/package.json

@@ -9,11 +9,11 @@
     "prerender": "nowaki prerender"
   },
   "dependencies": {
-    "@nowaki-dev/runtime": "^0.11.0",
+    "@nowaki-dev/runtime": "^0.13.0",
     "preact": "^10.25.4",
-    "preact-render-to-string": "^6.5.13"
+    "preact-render-to-string": "^6.8.2"
   },
   "devDependencies": {
-    "nowaki": "^0.12.0"
+    "nowaki": "^0.14.0"
   }
 }

package/templates/basics/actions/echo.ts

@@ -0,0 +1,22 @@
+"use server";
+
+import { getContext, serverFn } from "@nowaki-dev/runtime";
+
+// Hand-written Standard Schema (no zod/valibot) — same pattern as examples/hello/actions/todos.ts.
+const message = {
+  "~standard": {
+    version: 1 as const,
+    vendor: "example",
+    validate: (v: unknown) =>
+      typeof v === "string" && v.length <= 120
+        ? { value: v.trim() }
+        : { issues: [{ message: "message must be a string of at most 120 characters" }] },
+  },
+};
+
+/** Example server function — validated input and getContext() for auth in real apps. */
+export const echo = serverFn(message, async (text) => ({
+  ok: true,
+  echo: text,
+  hasRequest: getContext() != null,
+}));

package/templates/basics/islands/Counter.tsx

@@ -1,6 +1,6 @@
 import { useState } from "preact/hooks";
 
-// クライアントでハイドレートする唯一のコンポーネント（島）。スタイルは routes/index.tsx の <style> に。
+// The only component (island) hydrated on the client. Styles live in the <style> in routes/index.tsx.
 export default function Counter({ start = 0 }: { start?: number }) {
   const [count, setCount] = useState(start);
   return (

package/templates/basics/routes/_404.tsx

@@ -0,0 +1,13 @@
+export const title = "404 — Not found";
+
+export default function NotFound({ url }: { url: URL }) {
+  return (
+    <main>
+      <h1>404</h1>
+      <p>
+        Page not found: <code>{url.pathname}</code>
+      </p>
+      <a href="/">Back to home</a>
+    </main>
+  );
+}

package/templates/basics/routes/api/health.ts

@@ -0,0 +1,6 @@
+// Example API route (server-only). No secrets in responses; validate inputs on real endpoints.
+type Ctx = { json: (data: unknown) => unknown };
+
+export function GET(ctx: Ctx) {
+  return ctx.json({ ok: true });
+}