create-wordjs 2.0.0 → 2.1.0

package/README.md

@@ -31,7 +31,7 @@ That single command takes you from nothing to the browser install wizard:
    clickable URL:
 
    ```
-   → https://localhost:3000/install?token=…
+   → https://localhost:3000/install#token=…
    ```
 
 Open the URL, pick your database, create your admin account, and you're in. The wizard offers
@@ -47,7 +47,7 @@ in CI — plus a pure-JS *SQLite (legacy / WASM)* fallback for hosts where the n
 | Option | Description |
 | --- | --- |
 | `--zip <path-or-url>` | Use a local release ZIP (or a direct ZIP URL) instead of querying the GitHub API. Handy offline or when rate-limited. |
-| `--version <tag>` | Install a specific release (e.g. `--version v1.0.0`) instead of the latest. |
+| `--version <tag>` | Install a specific release (e.g. `--version v2.1.0`) instead of the latest. |
 | `--http` | Serve plain HTTP instead of self-signed HTTPS (sets `WORDJS_HTTP=1`). |
 | `--no-start` | Scaffold and install dependencies only — start the server yourself later. |
 | `--yes`, `-y` | Skip the confirmation prompt (required when `upgrade` runs non-interactively). |
@@ -119,7 +119,7 @@ need `openssl` on the PATH. Full details, port matrix and the manual (source-che
 - **GitHub rate limit / offline**: the release lookup uses the unauthenticated GitHub API. If it
   is rate-limited or you're offline, download `wordjs-v*.zip` from the
   [releases page](https://github.com/jaimemartinez/wordjs/releases) and run
-  `npx create-wordjs@latest my-site --zip ./wordjs-v1.0.0.zip`.
+  `npx create-wordjs@latest my-site --zip ./wordjs-v2.1.0.zip`.
 - **Existing directories**: the target directory must not exist (or must be empty) — the tool
   refuses to overwrite anything.
 

package/index.js

@@ -10,7 +10,7 @@
  *   1. Downloads the latest pre-compiled WordJS release ZIP from GitHub (no build step needed).
  *   2. Extracts it into <dir> and installs the runtime dependencies (npm run release:install).
  *   3. Generates a one-time install token and starts the server (npm run start:mono) with it,
- *      printing a clickable https://localhost:3000/install?token=… URL — the browser install
+ *      printing a clickable https://localhost:3000/install#token=… URL — the browser install
  *      wizard takes it from there (pick SQLite/PostgreSQL, create your admin, done).
  *
  * Plain Node, no TypeScript. Only runtime dependency: adm-zip (ZIP extraction).
@@ -49,7 +49,7 @@ Usage:
 
 Options:
   --zip <path-or-url>   Use a local release ZIP (or a direct ZIP URL) instead of asking GitHub.
-  --version <tag>       Install/upgrade to a specific release tag (e.g. v1.0.0) instead of the latest.
+  --version <tag>       Install/upgrade to a specific release tag (e.g. v2.1.0) instead of the latest.
   --http                Serve plain HTTP instead of self-signed HTTPS (sets WORDJS_HTTP=1). (create)
   --no-start            Scaffold + install dependencies only; don't start the server.
   --yes, -y             Skip the confirmation prompt (required when upgrading non-interactively).
@@ -65,7 +65,7 @@ Options:
 
 Examples:
   npx create-wordjs@latest my-site
-  npx create-wordjs@latest my-site --version v1.0.0
+  npx create-wordjs@latest my-site --version v2.1.0
   npx create-wordjs@latest upgrade                     # from inside your site directory
   npx create-wordjs@latest upgrade ./my-site --yes
 
@@ -103,7 +103,7 @@ function parseArgs(argv) {
         const a = argv[i];
         if (a === '-h' || a === '--help') { console.log(HELP); process.exit(0); }
         else if (a === '--zip') { opts.zip = argv[++i] || fail('--zip needs a value (path or URL to a wordjs-*.zip).'); }
-        else if (a === '--version') { opts.version = argv[++i] || fail('--version needs a value (a release tag, e.g. v1.0.0).'); }
+        else if (a === '--version') { opts.version = argv[++i] || fail('--version needs a value (a release tag, e.g. v2.1.0).'); }
         else if (a === '--http') opts.http = true;
         else if (a === '--no-start') opts.start = false;
         else if (a === '--yes' || a === '-y') opts.yes = true;
@@ -130,7 +130,7 @@ function parseArgs(argv) {
         else if (opts.mode === 'join') opts.dir = opts.role ? `wordjs-${opts.role}` : 'wordjs-node';
         else fail('Please specify a directory for your new site.', 'Example: npx create-wordjs@latest my-site');
     }
-    if (opts.version && /^\d/.test(opts.version)) opts.version = 'v' + opts.version;   // accept "1.0.0" for "v1.0.0"
+    if (opts.version && /^\d/.test(opts.version)) opts.version = 'v' + opts.version;   // accept "2.1.0" for "v2.1.0"
     return opts;
 }
 
@@ -729,7 +729,7 @@ async function main() {
         console.log(`      cd ${opts.dir}`);
         console.log(`      npm run start:mono${opts.http ? '        (with WORDJS_HTTP=1 in the environment for plain HTTP)' : ''}`);
         console.log('');
-        console.log(`   The console will print your one-time install URL (${proto}://localhost:3000/install?token=…).`);
+        console.log(`   The console will print your one-time install URL (${proto}://localhost:3000/install#token=…).`);
         console.log(line + '\n');
         return;
     }
@@ -743,7 +743,12 @@ async function main() {
     console.log(`\n${line}`);
     console.log('✅ WordJS is ready — finish setup in your browser:');
     console.log('');
-    console.log(`   → ${proto}://localhost:3000/install?token=${token}`);
+    // The token rides in the URL FRAGMENT, not a `?token=` query string: a fragment is never sent to
+    // any server, so this bootstrap secret stays out of access/proxy logs and out of the `Referer` of
+    // every sub-resource the install page loads. The wizard reads `#token=` (and still accepts a
+    // legacy `?token=`) and scrubs it from the address bar. Keep in sync with the backend's own
+    // banner in backend/src/core/install-token.ts.
+    console.log(`   → ${proto}://localhost:3000/install#token=${token}`);
     console.log('');
     console.log('   • The server is starting below — give it ~15–30 seconds, then open the URL.');
     if (!opts.http) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "create-wordjs",
-    "version": "2.0.0",
+    "version": "2.1.0",
     "description": "Create a WordJS site with one command — the self-hosted CMS where third-party plugins run in an OS-isolated process with per-capability permission grants. SSR/SEO out of the box, SQLite by default, no PHP.",
     "license": "MIT",
     "author": "Jaime Martinez (https://github.com/jaimemartinez)",