create-nowaki 0.15.0 → 0.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nowaki",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Scaffold a new Nowaki app",
   "license": "MIT",
   "author": "Tettu0530",

package/templates/_shared/AGENTS.md

@@ -15,6 +15,12 @@ npm run prerender  # nowaki prerender — static export
 npx nowaki upgrade # update nowaki (CLI) + @nowaki-dev/runtime to latest
 ```
 
+While `npm run dev` runs, the dev server also serves a read-only MCP endpoint
+(loopback only) at `http://127.0.0.1:3000/__nowaki/mcp`, with the tools `routes`,
+`module_graph`, `recent_errors`, and `dev_config`. Add it to Claude Code with
+`claude mcp add --transport http nowaki http://127.0.0.1:3000/__nowaki/mcp`.
+After an edit or a failing request, check `recent_errors` first.
+
 ## Project layout
 
 ```
@@ -105,6 +111,14 @@ nowaki.config.mjs   plugins (optional)
 8. **Jetstream islands** (server-reactive, zero client JS) — give an island
    `export const live = { state, on }`; buttons use `data-live="handler"` instead
    of `onClick`. State lives on the server; the server pushes HTML patches.
+   Forms use `data-live-submit="handler"` (gets the fields as an object), inputs
+   `data-live-input` (debounced; `data-live-debounce="ms"`) or `data-live-change`;
+   give list rows `data-key`. Read the request with `getContext()` and guard
+   events with `live.authorize`; `live.subscribe` + `live.load` + `publish(topic)`
+   push server-side changes. `live.room(props)` + `live.shared()` share one state
+   between everyone in a room (`data-nowaki-presence="<room>"` shows who's there).
+   Rooms, `publish`, and presence live in one server process (`nowaki start`);
+   on the deploy adapters live islands work per event over POST, without push.
 9. **Loading / error UI** (client navigation) — `routes/loading.tsx` renders
    while a navigation is in flight; `routes/error.tsx` (props `{ error, reset }`,
    type `ErrorPageProps`) renders if it fails. Both nest by directory. In
@@ -129,6 +143,17 @@ nowaki.config.mjs   plugins (optional)
   `.env.example` to `.env` and keep database URLs, API keys, and tokens unprefixed.
 - **Server functions and API routes are public endpoints.** Validate and bound every
   argument; authorize with `getContext()` (cookies/headers) before mutating data.
+  Use `serverFn(schema, impl)` for `"use server"` exports that take arguments (see
+  `actions/echo.ts` in the **basics** template).
+- **Cross-site writes.** Page `action`s reject cross-site non-GET requests by default.
+  **`routes/_middleware.ts` runs before that check** — do not perform sensitive
+  mutations in middleware unless you validate the caller yourself. API routes log a
+  warning and still accept cross-site POSTs unless you `export const csrf = true` on
+  the route (recommended for cookie-authenticated APIs).
+- **Production checklist** (when you deploy): set `NOWAKI_LIVE_SECRET` if the app
+  uses Jetstream live islands; try `NOWAKI_CSP=report-only` before `enforce`; behind
+  a reverse proxy on `nowaki start`, set `NOWAKI_TRUST_PROXY=1` and forward the public
+  host as `x-forwarded-host`. See the upstream [SECURITY.md](https://github.com/Tettu0530/nowaki/blob/main/SECURITY.md).
 - **Do not embed secrets** in client islands, loaders returned to the page, or static
   prerender output. ISR pages must not include per-user secrets.
 

package/templates/_shared/README.md

@@ -44,7 +44,15 @@ actions/     "use server" RPC modules (optional)
   `preact/compat`, so many React libraries work.)
 - Use **explicit file extensions** in relative imports: `../islands/Counter.tsx`.
 - A route's `loader` runs only on the server; `action` handles non-GET requests.
-- `routes/api/health.ts` is a minimal JSON API example; `routes/_404.tsx` handles unknown paths.
-- `AGENTS.md` documents the conventions for AI coding agents.
+- The **basics** template adds `routes/_404.tsx`, `routes/api/health.ts`, and
+  `actions/echo.ts`; **minimal** is a single page with no islands.
+- `AGENTS.md` documents conventions (including security) for AI coding agents.
+
+## Production
+
+Use `npm run build` then `npm run start` (or a deploy adapter). Do not run
+`nowaki dev` on the public internet. Cookie-authenticated API routes should export
+`csrf = true`; live islands need a stable `NOWAKI_LIVE_SECRET`. See `AGENTS.md`
+§ Security and [nowaki.dev/docs](https://nowaki.dev/docs).
 
 Docs: <https://nowaki.dev/docs>

package/templates/_shared/package.json

@@ -9,11 +9,11 @@
     "prerender": "nowaki prerender"
   },
   "dependencies": {
-    "@nowaki-dev/runtime": "^0.13.0",
+    "@nowaki-dev/runtime": "^0.15.0",
     "preact": "^10.25.4",
     "preact-render-to-string": "^6.8.2"
   },
   "devDependencies": {
-    "nowaki": "^0.14.0"
+    "nowaki": "^0.16.0"
   }
 }