create-shibumi 0.3.4 → 0.4.1

package/README.md

@@ -1,6 +1,8 @@
 # create-shibumi
 
-Scaffold a Shibumi Stack project: simple apps, whole stack, without React, build pipelines, or 600 MB of `node_modules`. Every generated project keeps its source, tests, and deployment config in your repository. No Shibumi runtime dependency.
+Scaffold a Bun full-stack app, blog, or static site as source you own. The full-stack template includes tests and container files; blog and static generate container files during deployment setup. No Shibumi runtime dependency.
+
+Requires **Bun 1.4.4 or newer** and Git. Run `bun --version` to check, or `bun upgrade` to update. The CLI refuses an older runtime before creating project files.
 
 ```sh
 bun create shibumi@latest my-app
@@ -8,6 +10,8 @@ cd my-app
 bun dev
 ```
 
+Choose **Later** for deployment, then open http://localhost:9001. In the full-stack starter, click Count and reload; SQLite keeps the value. Docker and a VPS are only needed when you deploy. [Follow the quick start](https://shibumistack.dev/docs) for the complete local and deployment path.
+
 Already have a project? Run it inside that project instead, and it gets deploy tooling rather than a scaffold:
 
 ```sh
@@ -17,7 +21,7 @@ bun create shibumi@latest .
 ## Three starting points
 
 1. **Bun full-stack app**: Hono, HTML, CSS, Alpine, Zod, tests, a health endpoint, and SQLite through Drizzle with migrations, persistent data, backup, and restore.
-2. **Blog**: Astro with posts, RSS, sitemap, SEO meta, and llms.txt.
+2. **Blog**: the shibumistack.dev engine — a Bun + Hono markdown renderer with posts, RSS, sitemap, SEO meta, and llms.txt.
 3. **Static site**: publish a verified build directory such as `./dist`, `public`, `build`, or `out` from any framework.
 
 All three deploy to a Linux VPS or homelab through [shibumi-server](https://server.shibumistack.dev). Other providers can wait until their generated projects pass the same artifact and deployment tests.
@@ -50,11 +54,23 @@ Generated projects include a root `agents.md`. It records route locations, data
 
 ```sh
 bun install
-bun test        # CLI tests (parsing, atomicity, signals, E2E)
-bun check       # TypeScript
+bun test        # Local CLI and regression tests; never deploys to a VPS
+bun check       # Native type checking; no standalone TypeScript dependency
 bun sync:ship   # re-vendor the Ship client from its locked immutable snapshot
 ```
 
 The vendored Ship client in `src/templates/ship.ts` is locked byte-for-byte to a published immutable snapshot via `scripts/ship.lock.json`; tests fail on any drift.
 
+## Live deployment tests
+
+The opt-in E2E suite uses Bun to pack and install the CLI outside this checkout. It runs the generated Ship client against a disposable VPS registration, checks real HTTPS pages in a browser, redeploys changed content, verifies recovery from an unhealthy image, and rolls back to the expected commit.
+
+```sh
+SHIBUMI_E2E=1 bun run test:e2e:matrix /absolute/path/to/target.json
+```
+
+The matrix covers every template in `src/args.ts` twice. Full-stack checks include auth and uploads, session cookies, and persistent SQLite data and file bytes. Blog checks include posts, drafts, canonical/OG metadata, feeds and Markdown alternates. Static checks include nested pages, assets, MIME types and custom 404s. Results and screenshots stay outside the checkout.
+
+This changes a dedicated test app and private test repository. Read [the setup and safety instructions](scripts/e2e.md) before running it. The matrix restores and deploys the original full-stack fixture afterward. Normal `bun test` does not run these live checks.
+
 Docs: <https://shibumistack.dev/docs>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-shibumi",
-  "version": "0.3.4",
+  "version": "0.4.1",
   "description": "Scaffold a Shibumi Stack project: Bun, Hono, Zod, Drizzle, SQLite, Alpine",
   "type": "module",
   "bin": {
@@ -24,7 +24,9 @@
   "scripts": {
     "start": "bun src/cli.ts",
     "test": "bun test test",
-    "check": "tsc --noEmit",
+    "test:e2e": "bun scripts/e2e.ts",
+    "test:e2e:matrix": "bun scripts/e2e-matrix.ts",
+    "check": "bun check --no-script",
     "sync:ship": "bun scripts/sync-ship.ts",
     "sync:extensions": "bun scripts/sync-extensions.ts",
     "verify:packed": "bun scripts/verify-packed.ts",
@@ -53,10 +55,9 @@
     "@clack/prompts": "1.7.0"
   },
   "devDependencies": {
-    "@types/bun": "1.4.0",
-    "typescript": "5.9.2"
+    "@types/bun": "1.4.0"
   },
   "engines": {
-    "bun": ">=1.4.0"
+    "bun": ">=1.4.4"
   }
 }

package/scripts/shibumi.lock.json

@@ -6,7 +6,7 @@
     },
     {
       "name": "auth",
-      "version": "1.0.1"
+      "version": "1.0.2"
     },
     {
       "name": "email",
@@ -17,5 +17,5 @@
       "version": "1.0.1"
     }
   ],
-  "sha256": "f859ca8e76ee58d8bbafb162ec8e06a794c9db6586759916a8e4b4d45568c5d4"
+  "sha256": "209142239ace4218419e72ec0e05b88ab1b26a7b67e73cc236c9dccfb2e6d826"
 }

package/scripts/ship.lock.json

@@ -1,4 +1,4 @@
 {
-  "url": "https://shibumistack.dev/ship/v49.ts",
-  "sha256": "9c9de7cbb7c2d82ce18e429edf216c4c61df24d16a9781035db56bf70d3fad78"
-}
+  "url": "https://shibumistack.dev/ship/v51.ts",
+  "sha256": "73f45cbea9a8b7b1c71b80921728d4e700859e8f85cb4fcf1885f0e370fafe51"
+}

package/src/args.ts

@@ -18,9 +18,9 @@ export type ParseResult =
   | { ok: true; args: ParsedArgs }
   | { ok: false; error: string };
 
-// Declared minimum Bun; template lockfiles use lockfileVersion 2, which
-// older Bun cannot parse, so scaffolding must refuse early and clearly.
-export const MINIMUM_BUN = "1.4.0";
+// Verified baseline for native bun check and the shipped version-2 lockfiles.
+// Keep package/template engines and onboarding requirements aligned.
+export const MINIMUM_BUN = "1.4.4";
 
 export function bunVersionProblem(version: string, minimum = MINIMUM_BUN): string | null {
   const parse = (value: string) => value.split("-")[0]!.split(".").map((part) => Number(part) || 0);

package/src/cli.ts

@@ -255,14 +255,14 @@ async function adoptExisting(args: ParsedArgs): Promise<void> {
 }
 
 async function main(): Promise<void> {
-  if (process.argv.slice(2).includes("--print-installer")) {
-    await printInstaller();
-  }
   const bunProblem = bunVersionProblem(Bun.version);
   if (bunProblem) {
     process.stderr.write(`${bunProblem}\n`);
     process.exit(2);
   }
+  if (process.argv.slice(2).includes("--print-installer")) {
+    await printInstaller();
+  }
   const parsed = parseArgs(process.argv.slice(2));
   if (!parsed.ok) {
     process.stderr.write(`${parsed.error}\nRun create-shibumi --help for usage.\n`);

package/src/create.ts

@@ -9,6 +9,7 @@ import {
   writeFileSync,
 } from "fs";
 import { dirname, join } from "path";
+import packageJson from "../package.json";
 import { validateName, type TemplateId } from "./args";
 
 export interface CreateOptions {
@@ -139,6 +140,14 @@ export async function createProject(
     // tmp was created exclusively by mkdtemp above and is empty.
     cpSync(templateSrc, tmp, { recursive: true });
 
+    // The blog template's generator meta records which create-shibumi
+    // release scaffolded the project. Templates are static files, so the
+    // version is substituted here rather than evaluated at render time.
+    const generatorLayout = join(tmp, "src", "layout.html");
+    if (existsSync(generatorLayout)) {
+      writeFileSync(generatorLayout, readFileSync(generatorLayout, "utf8").replaceAll("{{generator-version}}", packageJson.version));
+    }
+
     // npm pack always strips .gitignore files, so templates store the file
     // as "gitignore" and it is renamed into place here.
     const packSafeIgnore = join(tmp, "gitignore");

package/src/templates/blog/README.md

@@ -1,10 +1,11 @@
 # Shibumi blog
 
-An Astro blog with the boring parts done: RSS, sitemap, OG and SEO meta from a schema your posts can't skip, an `llms.txt`, and a markdown alternate of every post for readers who curl.
+A blog on the same engine as shibumistack.dev: a small Bun + Hono renderer with the boring parts done — RSS, sitemap, OG and SEO meta from a schema your posts can't skip, an `llms.txt`, and a markdown alternate of every post for readers who curl. No framework dependency; posts are markdown in `src/content/blog/` rendered by Bun's markdown engine.
 
 ```sh
 bun install
-bun dev
+bun dev    # live server on http://localhost:9001
+bun build  # pre-render dist/
 ```
 
-Write posts in `src/content/blog/`. Set `site` in `astro.config.mjs`, then `bun ship:setup` and `bun ship` to deploy. `agents.md` has the house rules.
+Write posts in `src/content/blog/`. Set `url` in `src/site.ts`, then `bun ship:setup` and `bun ship` to deploy. `agents.md` has the house rules.

package/src/templates/blog/agents.md

@@ -1,26 +1,37 @@
 # Agent Notes
 
-Astro blog generated by create-shibumi. Static output, shibumi design tokens, served as HTML for people and markdown for agents.
+Blog generated by create-shibumi on the shibumistack.dev engine: a Bun + Hono renderer that pre-renders to static files. Built as HTML for people and markdown for agents.
 
 ## Commands
 
 ```sh
-bun dev          # astro dev server
-bun run build    # astro build to dist/
-bun run check    # astro check (types + templates)
+bun dev          # live render on http://localhost:9001 (PORT/SHIBUMI_PORT to change)
+bun run build    # pre-render dist/ (same app, one pass)
+bun run preview  # serve dist/ locally
+bun check        # native type check (Bun 1.4.4+, no standalone TypeScript dependency)
 bun ship:setup   # configure the deploy target (preconfigured: static, dist/, build script)
 bun ship         # verify dist/, build the static image, upload, deploy
 bun ship:webhook # opt in to push-to-deploy; --off reverses it
 ```
 
+## Engine
+
+- `src/app.ts` is a Hono app. `serve.ts` serves it live; `scripts/build.ts` pre-renders the same routes to `dist/` at build time. Nothing runs a server in production — ship packages the static output.
+- `src/layout.html` is the frame: `{{tokens}}` are escaped values, `<!-- insert:name -->` markers are filled by the app, and an unresolved token or insert fails the build loudly.
+- Markdown is rendered by Bun's built-in engine (`Bun.markdown.render`) with a safe renderer: raw HTML is dropped, links must be http(s)/mailto/tel/relative/fragment, images must be https or local, and code blocks get classed spans. Frontmatter is parsed with `Bun.YAML`.
+
+## Posts
+
+- Posts are markdown files in `src/content/blog/` with YAML frontmatter: `title` (1 to 60 characters), `description` (50 to 160 characters; drives meta, RSS, and llms.txt), `date`, optional `ogImage` and `ogImageAlt` (alt text for the image, also used for `og:image:alt`/`twitter:image:alt`), and an optional `draft` flag (default false).
+- `draft: true` keeps a post out of everything: no page, no listing, no RSS, no llms.txt, no sitemap, no markdown alternate. Publish by removing the flag and running `bun ship`.
+- An invalid post (missing or out-of-range frontmatter, unsafe file name) fails `bun build` and `bun dev` with a clear message; a bad post never ships silently.
+- Files in `public/` are served verbatim by URL. Reference them from markdown as absolute paths (`![alt](/photo.jpg)`).
+
 ## Routes and templates
 
-- Posts are markdown files in `src/content/blog/`; the schema in `src/content.config.ts` requires title (max 60), description (50 to 160 characters, drives meta/RSS/llms.txt), date, optional ogImage, and an optional `draft` flag (default false).
-- `draft: true` keeps a post out of everything: no page, no listing, no RSS, no llms.txt, no markdown alternate. Publish by removing the flag and running `bun ship`.
-- Images: put files in `src/assets/` and reference them relatively from the markdown (`![alt](../../assets/photo.jpg)`); Astro optimizes them at build. Files in `public/` are served verbatim by URL.
-- `src/pages/index.astro` lists posts; `src/pages/posts/[id].astro` renders one; `src/layouts/Base.astro` and `src/components/BaseHead.astro` own the frame and every meta tag.
-- Generated endpoints: `/rss.xml`, `/llms.txt`, `/robots.txt`, and a markdown alternate for every post at `/posts/<id>.md`. All derive from the content collection; never hand-edit their output.
-- Site identity lives in `src/site.ts`. Design lives in `public/style.css` (one file, shibumi tokens, semantic selectors).
+- `/` lists posts; `/posts/<id>` renders one. Markup lives in `src/pages/index.html` and `src/pages/post.html`, styled by `public/style.css` (one file, shibumi tokens, semantic selectors).
+- Generated endpoints: `/rss.xml`, `/llms.txt`, `/robots.txt`, `/sitemap.xml`, and a markdown alternate for every post at `/posts/<id>.md`. All derive from the content collection; never hand-edit their output.
+- Site identity lives in `src/site.ts`, including `url`; set it to the real domain before the first ship — canonicals, og:url, RSS, and the sitemap derive from it.
 
 ## Trust boundaries and validation
 
@@ -36,4 +47,4 @@ None.
 
 ## Checks required before commit
 
-Set `site` in `astro.config.mjs` to the real domain before the first `bun ship`; sitemap, RSS, canonicals, and og:url derive from it. `bun run check` and `bun run build` must pass. Keep `build.format: "directory"` so the static server routes clean URLs.
+Set `url` in `src/site.ts` to the real domain before the first `bun ship`. `bun run check` and `bun run build` must pass; the build fails on any unresolved template token, unvalidated frontmatter, or unsafe file name.