create-raredays-app 0.1.1 → 0.1.4

package/bin/compose-allow-builds.mjs

@@ -0,0 +1,47 @@
+// Merge per-module build-script approvals into a template's pnpm-workspace.yaml.
+//
+// pnpm 11 blocks dependency build scripts by default and only honors approvals
+// declared as `allowBuilds` in pnpm-workspace.yaml (the package.json `pnpm`
+// field and .npmrc are ignored). Each scaffold fragment (module or vendor) may
+// declare its own `allowBuilds` map in module.json; the scaffolder unions those
+// onto the template's base so a generated app pre-approves exactly the build
+// scripts its selected modules need — no matter which modules are chosen.
+//
+// Pure string transform over the template's pnpm-workspace.yaml: parse the
+// existing `  <pkg>: true|false` entries, union the fragment-contributed ones
+// (later wins, so a fragment can also opt a build OUT with `false`), and
+// re-emit a sorted block while preserving the file's header comment. We avoid a
+// YAML parser dependency on purpose — the block is a flat name->boolean map.
+
+const ENTRY = /^ {2}["']?([^"':\s]+)["']?:\s*(true|false)\s*$/gm;
+
+/**
+ * @param {string} yamlSource - the template's pnpm-workspace.yaml contents
+ * @param {Record<string, boolean>} extra - build approvals contributed by selected fragments
+ * @returns {string} the rewritten pnpm-workspace.yaml contents
+ */
+export function mergeAllowBuilds(yamlSource, extra) {
+  const merged = {};
+  ENTRY.lastIndex = 0;
+  let match;
+  while ((match = ENTRY.exec(yamlSource)) !== null) {
+    merged[match[1]] = match[2] === "true";
+  }
+  for (const [name, value] of Object.entries(extra)) {
+    merged[name] = value === true || value === "true";
+  }
+
+  // Preserve everything before `allowBuilds:` (the header comment block).
+  const marker = yamlSource.indexOf("allowBuilds:");
+  const header = marker > 0 ? yamlSource.slice(0, marker) : "";
+
+  const lines = Object.keys(merged)
+    .sort()
+    .map((name) => {
+      // Quote names that aren't bare identifiers (e.g. scoped "@sentry/cli").
+      const key = /^[a-zA-Z0-9_-]+$/.test(name) ? name : `"${name}"`;
+      return `  ${key}: ${merged[name] ? "true" : "false"}`;
+    });
+
+  return `${header}allowBuilds:\n${lines.join("\n")}\n`;
+}

package/bin/index.js

@@ -7,6 +7,8 @@ import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import * as p from "@clack/prompts";
 
+import { mergeAllowBuilds } from "./compose-allow-builds.mjs";
+
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const packageRoot = resolve(__dirname, "..");
 const templatesDir = resolve(packageRoot, "templates");
@@ -520,6 +522,7 @@ async function scaffold(opts) {
   // Load + apply selected fragments. Static templates don't have a
   // composition root, so skip module composition entirely there.
   const collectedDeps = {};
+  const collectedBuilds = {};
   const envVars = [];
   const vendorMocks = [];
   if (opts.template !== "static" && opts.selectedModules.length > 0) {
@@ -528,6 +531,7 @@ async function scaffold(opts) {
 
     for (const f of valid) {
       Object.assign(collectedDeps, f.deps ?? {});
+      Object.assign(collectedBuilds, f.allowBuilds ?? {});
       if (f.filesDir) await cp(f.filesDir, targetDir, { recursive: true });
     }
 
@@ -537,6 +541,7 @@ async function scaffold(opts) {
       const vendor = f?.vendors?.find((v) => v.key === vendorKey);
       if (!vendor) continue;
       Object.assign(collectedDeps, vendor.deps ?? {});
+      Object.assign(collectedBuilds, vendor.allowBuilds ?? {});
       for (const v of vendor.env ?? []) envVars.push(v);
       if (vendor.mocks) {
         vendorMocks.push(vendor.mocks);
@@ -550,6 +555,16 @@ async function scaffold(opts) {
     await writeFile(runtimePath, composeRuntime(source, valid));
   }
 
+  // Union module/vendor build-script approvals onto the template's
+  // pnpm-workspace.yaml so the generated app pre-approves exactly what its
+  // selected modules need under pnpm 11. No-op when no fragment declares any.
+  if (Object.keys(collectedBuilds).length > 0) {
+    const wsPath = resolve(targetDir, "pnpm-workspace.yaml");
+    if (existsSync(wsPath)) {
+      await writeFile(wsPath, mergeAllowBuilds(await readFile(wsPath, "utf8"), collectedBuilds));
+    }
+  }
+
   // Compose mocks/handlers.ts for any template that ships it (full-stack + client).
   if (opts.template !== "static") {
     const handlersPath = resolve(targetDir, "mocks/handlers.ts");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-raredays-app",
-  "version": "0.1.1",
+  "version": "0.1.4",
   "description": "Scaffold a new RareDays Next.js app.",
   "license": "UNLICENSED",
   "author": "Jeremy Harper <jeremy@raredays.com>",

package/scaffold-fragments/billing/module.json

@@ -3,14 +3,14 @@
   "label": "Billing (subscriptions + webhooks)",
   "description": "Plan registry, subscription state, webhook handler with idempotency + event-bus fan-out.",
   "deps": {
-    "@raredays/billing": "0.0.1"
+    "@raredays/billing": "^0.1.0"
   },
   "vendors": [
     {
       "key": "stripe",
       "label": "Stripe",
       "deps": {
-        "@raredays/billing-stripe": "0.0.1"
+        "@raredays/billing-stripe": "^0.1.0"
       },
       "env": [
         "STRIPE_SECRET_KEY",

package/scaffold-fragments/cms/module.json

@@ -3,14 +3,14 @@
   "label": "CMS (headless content + rich text)",
   "description": "Vendor-neutral CMS port. In-memory dev driver for development; swap to Hygraph (or another adapter) for production.",
   "deps": {
-    "@raredays/cms": "0.0.1"
+    "@raredays/cms": "^0.1.0"
   },
   "vendors": [
     {
       "key": "hygraph",
       "label": "Hygraph",
       "deps": {
-        "@raredays/cms-hygraph": "0.0.1"
+        "@raredays/cms-hygraph": "^0.1.0"
       },
       "env": [
         "HYGRAPH_ENDPOINT",

package/scaffold-fragments/email/module.json

@@ -3,14 +3,14 @@
   "label": "Transactional email",
   "description": "Vendor-neutral email port. Console adapter for dev; swap to Resend for production.",
   "deps": {
-    "@raredays/email": "0.0.1"
+    "@raredays/email": "^0.1.0"
   },
   "vendors": [
     {
       "key": "resend",
       "label": "Resend",
       "deps": {
-        "@raredays/email-resend": "0.0.1"
+        "@raredays/email-resend": "^0.1.0"
       },
       "env": [
         "RESEND_API_KEY"

package/scaffold-fragments/i18n/module.json

@@ -3,7 +3,7 @@
   "label": "Internationalisation (i18n)",
   "description": "Locale resolution, ICU message formatting, date/number/currency formatters, and React hooks.",
   "deps": {
-    "@raredays/i18n": "0.0.1"
+    "@raredays/i18n": "^0.1.0"
   },
   "templates": ["full-stack", "client", "static"]
 }

package/scaffold-fragments/identity/module.json

@@ -3,14 +3,14 @@
   "label": "Identity (auth, sessions, organizations, roles)",
   "description": "Identity port is always wired with an in-memory dev provider. Select a vendor to add the production adapter, env vars, mock handlers, and Next.js auth route stub.",
   "deps": {
-    "@raredays/identity": "0.0.1"
+    "@raredays/identity": "^0.1.0"
   },
   "vendors": [
     {
       "key": "better-auth",
       "label": "Better Auth (self-hosted)",
       "deps": {
-        "@raredays/identity-better-auth": "0.0.1",
+        "@raredays/identity-better-auth": "^0.1.0",
         "better-auth": "^1.2.0"
       },
       "env": [

package/scaffold-fragments/jobs/module.json

@@ -3,7 +3,7 @@
   "label": "Background jobs (in-process runner)",
   "description": "Type-safe job definitions, retries, idempotency. In-process runner by default; swap to Inngest/Trigger.dev for durable execution.",
   "deps": {
-    "@raredays/jobs": "0.0.1"
+    "@raredays/jobs": "^0.1.0"
   },
   "vendors": [],
   "templates": [

package/scaffold-fragments/notifications/module.json

@@ -3,7 +3,7 @@
   "label": "Notifications (multi-channel send)",
   "description": "Notification definitions, channels (email + in-app), user preferences, dedupe, delivery logging.",
   "deps": {
-    "@raredays/notifications": "0.0.1"
+    "@raredays/notifications": "^0.1.0"
   },
   "vendors": [],
   "templates": [

package/scaffold-fragments/organizations/module.json

@@ -3,7 +3,7 @@
   "label": "Organizations (multi-tenancy)",
   "description": "Domain types + role-based permissions for organizations, memberships, and invitations. Pairs with a postgres provider for storage.",
   "deps": {
-    "@raredays/organizations": "0.0.1"
+    "@raredays/organizations": "^0.1.0"
   },
   "vendors": [],
   "templates": [

package/scaffold-fragments/telemetry/module.json

@@ -3,14 +3,14 @@
   "label": "Telemetry (logging, errors, metrics, events)",
   "description": "Vendor-neutral observability port. Console adapters for dev; swap to Sentry + Axiom for production.",
   "deps": {
-    "@raredays/telemetry": "0.0.1"
+    "@raredays/telemetry": "^0.1.0"
   },
   "vendors": [
     {
       "key": "sentry",
       "label": "Sentry (error reporting)",
       "deps": {
-        "@raredays/telemetry-sentry": "0.0.1"
+        "@raredays/telemetry-sentry": "^0.1.0"
       },
       "env": [
         "SENTRY_DSN"
@@ -24,7 +24,7 @@
       "key": "axiom",
       "label": "Axiom (logging)",
       "deps": {
-        "@raredays/telemetry-axiom": "0.0.1"
+        "@raredays/telemetry-axiom": "^0.1.0"
       },
       "env": [
         "AXIOM_TOKEN",

package/templates/client/pnpm-workspace.yaml

@@ -0,0 +1,9 @@
+# pnpm 11 blocks dependency build scripts by default, and its pre-run deps
+# check then aborts every pnpm command (install/build/exec) with
+# ERR_PNPM_IGNORED_BUILDS. Pre-approve the builds this app actually needs so a
+# fresh scaffold works out of the box. (In pnpm 11 `allowBuilds` replaced
+# `onlyBuiltDependencies`; values are booleans, not a list.)
+allowBuilds:
+  esbuild: true
+  msw: true
+  sharp: true

package/templates/full-stack/pnpm-workspace.yaml

@@ -0,0 +1,9 @@
+# pnpm 11 blocks dependency build scripts by default, and its pre-run deps
+# check then aborts every pnpm command (install/build/exec) with
+# ERR_PNPM_IGNORED_BUILDS. Pre-approve the builds this app actually needs so a
+# fresh scaffold works out of the box. (In pnpm 11 `allowBuilds` replaced
+# `onlyBuiltDependencies`; values are booleans, not a list.)
+allowBuilds:
+  esbuild: true
+  msw: true
+  sharp: true

package/templates/static/pnpm-workspace.yaml

@@ -0,0 +1,8 @@
+# pnpm 11 blocks dependency build scripts by default, and its pre-run deps
+# check then aborts every pnpm command (install/build/exec) with
+# ERR_PNPM_IGNORED_BUILDS. Pre-approve the builds this app actually needs so a
+# fresh scaffold works out of the box. (In pnpm 11 `allowBuilds` replaced
+# `onlyBuiltDependencies`; values are booleans, not a list.)
+allowBuilds:
+  esbuild: true
+  sharp: true