create-zfb 0.1.0-next.25 → 0.1.0-next.27

package/bin/create-zfb.mjs

@@ -9,7 +9,9 @@ const require = createRequire(import.meta.url);
 // Handles prerelease suffixes: 0.1.0-next.6 < 0.1.0-next.8 < 0.1.0
 function compareSemver(a, b) {
   const splitRelease = (v) => {
-    const [main, pre] = v.split(/-(.+)/, 2);
+    // Drop SemVer build metadata (`+...`) before splitting — it is ignored
+    // for precedence and would otherwise yield NaN numeric parts.
+    const [main, pre] = v.split("+")[0].split(/-(.+)/, 2);
     return { parts: main.split(".").map(Number), pre: pre ?? null };
   };
   const ra = splitRelease(a);
@@ -23,8 +25,27 @@ function compareSemver(a, b) {
   if (ra.pre !== null && rb.pre === null) return -1;
   if (ra.pre === null && rb.pre !== null) return 1;
   if (ra.pre !== null && rb.pre !== null) {
-    if (ra.pre < rb.pre) return -1;
-    if (ra.pre > rb.pre) return 1;
+    // Compare dot-separated prerelease identifiers per semver: numeric
+    // identifiers compare numerically (so next.9 < next.10), numeric ranks
+    // below alphanumeric, and a shorter prefix ranks lower. Plain string
+    // `<`/`>` would order next.10 before next.9 lexicographically.
+    const sa = ra.pre.split(".");
+    const sb = rb.pre.split(".");
+    for (let i = 0; i < Math.max(sa.length, sb.length); i++) {
+      if (sa[i] === undefined) return -1;
+      if (sb[i] === undefined) return 1;
+      const na = /^\d+$/.test(sa[i]);
+      const nb = /^\d+$/.test(sb[i]);
+      if (na && nb) {
+        const da = Number(sa[i]);
+        const db = Number(sb[i]);
+        if (da !== db) return da < db ? -1 : 1;
+      } else if (na !== nb) {
+        return na ? -1 : 1;
+      } else if (sa[i] !== sb[i]) {
+        return sa[i] < sb[i] ? -1 : 1;
+      }
+    }
   }
   return 0;
 }
@@ -34,27 +55,35 @@ try {
   const version = ownPkg.version;
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), 1500);
-  const res = await fetch("https://registry.npmjs.org/create-zfb/latest", {
-    signal: controller.signal,
-    headers: {
-      "User-Agent": `create-zfb/${version}`,
-      Accept: "application/json",
-    },
-  });
-  clearTimeout(timer);
-  if (res.ok) {
-    const data = await res.json();
-    const latest = data?.version;
-    if (typeof latest === "string" && typeof version === "string") {
-      if (compareSemver(version, latest) < 0) {
-        process.stderr.write(
-          `[create-zfb] You are running create-zfb@${version} but @latest is ${latest}.\n` +
-            `[create-zfb] pnpm 11's minimumReleaseAge may have downgraded the install.\n` +
-            `[create-zfb] Re-run with: pnpm create zfb@latest --config.minimumReleaseAge=0\n` +
-            `[create-zfb] Or use: npm create zfb@latest\n`,
-        );
+  let res;
+  try {
+    res = await fetch("https://registry.npmjs.org/create-zfb/latest", {
+      signal: controller.signal,
+      headers: {
+        "User-Agent": `create-zfb/${version}`,
+        Accept: "application/json",
+      },
+    });
+    if (res.ok) {
+      const data = await res.json();
+      const latest = data?.version;
+      if (typeof latest === "string" && typeof version === "string") {
+        if (compareSemver(version, latest) < 0) {
+          process.stderr.write(
+            `[create-zfb] You are running create-zfb@${version} but @latest is ${latest}.\n` +
+              `[create-zfb] pnpm 11's minimumReleaseAge may have downgraded the install.\n` +
+              `[create-zfb] Re-run with: pnpm create zfb@latest --config.minimumReleaseAge=0\n` +
+              `[create-zfb] Or use: npm create zfb@latest\n`,
+          );
+        }
       }
     }
+  } finally {
+    // Keep the abort signal armed across both the header and body reads.
+    // Only cancel the timer once the body has been fully consumed (or on
+    // any error path), so a proxy that stalls after headers cannot hang
+    // the scaffolder indefinitely.
+    clearTimeout(timer);
   }
 } catch {
   // silently skip on any error: network failure, timeout (AbortError), parse error, etc.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-zfb",
-  "version": "0.1.0-next.25",
+  "version": "0.1.0-next.27",
   "private": false,
   "type": "module",
   "description": "Scaffold a new zfb static-site project: `npm create zfb@latest my-site`",
@@ -35,6 +35,6 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@takazudo/zfb": "0.1.0-next.25"
+    "@takazudo/zfb": "0.1.0-next.27"
   }
 }