create-rsc-kit 0.27.0 → 0.28.0

package/dist/index.js

@@ -217,7 +217,7 @@ function write(o) {
     // secret the backend is given once. The scaffold's .gitignore already
     // keeps .env out of git.
     if (o.backend) {
-        files.push(['.env', t.backendEnv(o.backend, randomBytes(32).toString('base64url'))]);
+        files.push(['.env', t.backendEnv(o.backend, randomBytes(32).toString('base64url'), randomBytes(32).toString('base64url'))]);
         if (!o.env)
             files.push(['.env.example', t.backendEnvExample(o.backend)]);
     }

package/dist/init.js

@@ -603,17 +603,20 @@ function backend(o, found, dir) {
         if (!/^\s*RSC_HOST_CALL_SECRET=/m.test(current)) {
             missing.push(`RSC_HOST_CALL_SECRET=${randomBytes(32).toString('base64url')}`);
         }
+        if (!/^\s*RSC_SIGNING_SECRET=/m.test(current)) {
+            missing.push(`RSC_SIGNING_SECRET=${randomBytes(32).toString('base64url')}`);
+        }
         if (missing.length === 0) {
-            steps.push({ kind: 'skipped', what: '.env', detail: 'already has RSC_BACKEND and RSC_HOST_CALL_SECRET' });
+            steps.push({ kind: 'skipped', what: '.env', detail: 'already has RSC_BACKEND, RSC_HOST_CALL_SECRET and RSC_SIGNING_SECRET' });
         }
         else {
             writeFileSync(env, current.replace(/\s*$/, '\n\n') + missing.join('\n') + '\n');
-            steps.push({ kind: 'merged', what: '.env', detail: `added ${missing.map((line) => line.split('=')[0]).join(' and ')}` });
+            steps.push({ kind: 'merged', what: '.env', detail: `added ${missing.map((line) => line.split('=')[0]).join(', ')}` });
         }
     }
     else {
-        writeFileSync(env, t.backendEnv(o.backend, randomBytes(32).toString('base64url')));
-        steps.push({ kind: 'wrote', what: '.env', detail: 'RSC_BACKEND and a generated RSC_HOST_CALL_SECRET' });
+        writeFileSync(env, t.backendEnv(o.backend, randomBytes(32).toString('base64url'), randomBytes(32).toString('base64url')));
+        steps.push({ kind: 'wrote', what: '.env', detail: 'RSC_BACKEND, and a generated RSC_HOST_CALL_SECRET and RSC_SIGNING_SECRET' });
     }
     const example = join(dir, '.env.example');
     if (!existsSync(example)) {

package/dist/templates.d.ts

@@ -160,7 +160,7 @@ export declare function instrumentation(_o: Options): string;
  * configuring in development or in production. A Laravel app has both in
  * its .env already, under APP_URL.
  */
-export declare function backendEnv(backend: string, secret: string): string;
+export declare function backendEnv(backend: string, secret: string, signing: string): string;
 export declare function backendEnvExample(backend: string): string;
 /**
  * What the backend has to do, said once at the end. Go gets its own, because

package/dist/templates.js

@@ -990,12 +990,16 @@ export async function register() {}
  * configuring in development or in production. A Laravel app has both in
  * its .env already, under APP_URL.
  */
-export function backendEnv(backend, secret) {
+export function backendEnv(backend, secret, signing) {
     return `# Where rpc() goes: a backend answering POST /__rsc/host-call. The renderer
 # reads both of these, in development (vite) and in production (the built
 # server). The backend checks the secret on every call; keep it out of git.
 RSC_BACKEND=${backend}
 RSC_HOST_CALL_SECRET=${secret}
+
+# Signs the names a page refreshes on (refreshOn), for the renderer alone.
+# Its own key, not the one above; the same on every instance in production.
+RSC_SIGNING_SECRET=${signing}
 `;
 }
 export function backendEnvExample(backend) {
@@ -1003,6 +1007,10 @@ export function backendEnvExample(backend) {
 # generate one: openssl rand -base64 32
 RSC_BACKEND=${backend}
 RSC_HOST_CALL_SECRET=
+
+# Signs refreshOn names; its own key, the same on every instance in
+# production - generate one the same way.
+RSC_SIGNING_SECRET=
 `;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-rsc-kit",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "type": "module",
   "description": "Scaffold an RSC app on Bun, Hono, Elysia or Node.",
   "bin": {