create-zoijs 0.1.4 → 0.3.0

package/CHANGELOG.md

@@ -1,88 +1,142 @@
-# Changelog
-
-All notable changes to `create-zoijs` are documented here.
-
-## 0.1.4 — 2026-06-27
-
-Scaffolded apps now come with editor config for a great out-of-the-box experience —
-no toolchain required. The CLI API and the app code are unchanged.
-
-- **`.vscode/extensions.json`** (templates `app`, `basic`, `typescript`, `library`) —
-  recommends a highlighter for `` html`` `` templates (`bierner.lit-html`), the ESLint
-  extension, and Prettier. VS Code suggests them when you open the project.
-- **`jsconfig.json`** (templates `app`, `basic`) — IntelliSense (autocomplete, hover,
-  go-to-definition) from the types every Zoijs package ships, with no build step. Flip
-  `checkJs` on to also type-check your JavaScript. (The `typescript` and `library`
-  templates already carry a `tsconfig.json`.)
-- See the [Editor Setup guide](https://zoijs.dev/editor-setup).
-
-## 0.1.3 — 2026-06-26
-
-Three new templates (now five total). No change to existing templates or the CLI
-API; `app` stays the default.
-
-- **`typescript`** — the counter as **type-checked JavaScript**: `// @ts-check` +
-  a strict `tsconfig.json` + `npm run typecheck` (`tsc --noEmit`) give full
-  TypeScript safety using `@zoijs/core`'s shipped types, with **no build step** (the
-  browser runs the `.js` as-is). Keeps the dev server on 7310.
-- **`minimal`** — the smallest scaffold: two flat files (`index.html` + `app.js`)
-  loading `@zoijs/core` from a CDN. No `package.json`, no install, no dev server —
-  run with `npx serve . -l 7310`.
-- **`library`** — a starter for authoring a Zoijs-based package: `src/index.js` +
-  hand-written `index.d.ts`, an `exports`/`types` `package.json` with a peer
-  dependency on `@zoijs/core`, and a `node:test` suite — the shape the official
-  optional packages use.
-- The scaffolder now treats `.ts`/`.d.ts` as text (token substitution), and the
-  CLI's own `npm test` targets its own test file so it no longer runs the
-  templates' bundled test files.
-
-## 0.1.2 — 2026-06-26
-
-Dev-server output polish. No CLI API changes; same zero-dependency server on the
-same ports.
-
-- **Cleaner banner:** `npm run dev` now prints a tidy banner with the local URL
-  on its own line, and only mentions fallback ports when one was actually busy:
-
-  ```text
-    Zoijs dev server
-
-    - Local:  http://localhost:7310
-  ```
-
-  (Previously a single `ZoiJS dev server: http://localhost:7310` line plus a
-  static `If busy: …` note.) Plain ASCII so it renders cleanly in every terminal,
-  including the Windows console. Brand casing normalized to **Zoijs**. Still port
-  **7310** with **7311 / 7312 / 7313** fallbacks; still Node built-ins only.
-
-## 0.1.1 — 2026-06-25
-
-Starter polish. No CLI API changes.
-
-- **Dev server:** generated apps now run `npm run dev` on a tiny zero-dependency
-  static server (`dev-server.mjs`, Node built-ins only) that uses port **7310**
-  and falls back to **7311 / 7312 / 7313** if busy — replacing the old default
-  of port 3000. It prints `ZoiJS dev server: http://localhost:<port>`.
-- **Default `app` template redesigned** into a polished "project dashboard":
-  a hero header, a reusable `StatCard` (used ×4), filter chips (All / Active /
-  Done), an empty state, and a developer-hint footer — demonstrating component
-  composition, conditional rendering, and filtering alongside `createState` /
-  `computed` / `each` and parent⇄child communication. Still depends only on
-  `@zoijs/core`; still no build step.
-- **`basic` template** keeps the minimal counter and adopts the same dev server.
-
-## 0.1.0 — 2026-06-25
-
-Initial release of the Zoijs starter CLI.
-
-- `npm create zoijs@latest my-app` — scaffold a new Zoijs app in one command.
-- Uses the provided folder name as the project name; derives `package.json`
-  `name` (lowercased) and a readable `index.html` `<title>` from it.
-- Two templates: `app` (default — a small task dashboard demonstrating
-  `html` / `mount` / `createState` / `computed` / `each` and parent⇄child
-  communication) and `basic` (a minimal counter). Select with `--template`.
-- Validates the project name (npm-safe) and refuses to overwrite a non-empty
-  directory.
-- Generated apps are plain HTML/CSS/JS with **no build step** and depend only on
-  `@zoijs/core` (served via an import map from `node_modules`).
-- Zero runtime dependencies; the CLI is a single small file.
+# Changelog
+
+All notable changes to `create-zoijs` are documented here.
+
+## 0.3.0 — 2026-10-12
+
+### Changed
+- **New apps use `@zoijs/core` 1.10.0.** Package templates depend on `^1.10.0` and the `minimal`
+  template loads core 1.10.0 from jsDelivr with an integrity hash for every module file
+  (`core-cdn.json`, regenerated from the published tarball). 1.10.0 fixes SVG/MathML lists,
+  style bindings under a strict `style-src` CSP, `each()` item spread/`JSON.stringify`, multi-root
+  list items, and class bindings that wiped classes added by other code — see the core CHANGELOG.
+- **Scaffolded apps are editor-neutral.** The `app`, `basic`, `typescript` and `library`
+  templates no longer write `.vscode/extensions.json`, which recommended three third-party
+  extensions. Zoijs doesn't recommend editors or editor extensions; autocomplete and
+  optional type-checking still come from the types every package ships, through the
+  `jsconfig.json` (`app`, `basic`) or `tsconfig.json` (`typescript`, `library`) that the
+  templates keep. Existing apps are unaffected — delete `.vscode/` if you don't want it.
+
+## 0.2.0 — 2026-10-05
+
+### Security
+- **Generated apps pin `@zoijs/core` exactly and securely (SEC-7).** Templates allowed `^1.1.0` /
+  `^1.2.0` (older than the 1.7.0 URL-guard fixes), and the `minimal` template loaded a floating
+  `esm.sh/@zoijs/core@1` URL with no integrity check. Every template now takes its core version from
+  one file, `core-cdn.json` (an exact, published version plus a jsDelivr import map with a sha384
+  integrity hash for every module file, generated from the npm tarball and verified at release):
+  package templates get `^<that version>`, and `minimal` gets the exact, integrity-pinned import map.
+- **Hardened the scaffolded dev server (SEC-6)** (templates `app`, `basic`, `typescript`).
+  It listened on every network interface, served dotfiles (`/.env`, `/.git/config`, `.npmrc`)
+  and followed symlinks out of the project to anyone on the LAN, and a malformed URL such as
+  `/%E0` crashed it. It now listens on `127.0.0.1` only (opt into the LAN explicitly with
+  `ZOIJS_HOST=0.0.0.0`, which prints a warning), never serves a path with a dot-segment,
+  confines every file — including symlink targets — to the project folder (package-manager
+  links under `node_modules/` excepted), answers malformed or null-byte paths with `400`
+  and keeps running, and sends `X-Content-Type-Options: nosniff` and `Cache-Control: no-store`.
+  `npm run dev` and the URL it prints are unchanged.
+- **The `minimal` template no longer recommends `npx serve`.** `npx serve . -l 7310`
+  downloaded a mutable package at run time and used that package's own (non-loopback)
+  defaults. `minimal` now ships the same hardened `dev-server.mjs` as the other templates,
+  plus a dependency-free `package.json` whose `dev` script runs it — still nothing to
+  install (`@zoijs/core` stays on the integrity-pinned CDN). All four template copies of
+  the server are byte-identical, and a test enforces that.
+
+### Changed
+- **Deploy guidance for the production entry (SEC-4).** Every app template's README and
+  `index.html` explain switching the import map to `@zoijs/core`'s production entry
+  (`src/prod.js`: no dev warnings, no devtools hook) before deploying. `minimal`'s map
+  already carries the integrity hash for `prod.js`.
+- **"Next steps" match the template.** `minimal` prints `npm run dev` with no install step;
+  `library` prints `npm install` / `npm test` instead of a `dev` script it doesn't have.
+
+### Changed
+- **Generated apps target `@zoijs/core` 1.9.0.** Package templates depend on `^1.9.0`; the
+  `minimal` template's import map points at the exact 1.9.0 files on jsDelivr with an sha384
+  integrity hash for every module, including the production entry `src/prod.js` (first
+  shipped in 1.9.0), so the deploy step in each README works as written.
+
+## 0.1.4 — 2026-06-27
+
+Scaffolded apps now come with editor config for a great out-of-the-box experience —
+no toolchain required. The CLI API and the app code are unchanged.
+
+- **`.vscode/extensions.json`** (templates `app`, `basic`, `typescript`, `library`) —
+  recommends a highlighter for `` html`` `` templates (`bierner.lit-html`), the ESLint
+  extension, and Prettier. VS Code suggests them when you open the project.
+- **`jsconfig.json`** (templates `app`, `basic`) — IntelliSense (autocomplete, hover,
+  go-to-definition) from the types every Zoijs package ships, with no build step. Flip
+  `checkJs` on to also type-check your JavaScript. (The `typescript` and `library`
+  templates already carry a `tsconfig.json`.)
+- See the [Editor Setup guide](https://zoijs.dev/editor-setup).
+
+## 0.1.3 — 2026-06-26
+
+Three new templates (now five total). No change to existing templates or the CLI
+API; `app` stays the default.
+
+- **`typescript`** — the counter as **type-checked JavaScript**: `// @ts-check` +
+  a strict `tsconfig.json` + `npm run typecheck` (`tsc --noEmit`) give full
+  TypeScript safety using `@zoijs/core`'s shipped types, with **no build step** (the
+  browser runs the `.js` as-is). Keeps the dev server on 7310.
+- **`minimal`** — the smallest scaffold: two flat files (`index.html` + `app.js`)
+  loading `@zoijs/core` from a CDN. No `package.json`, no install, no dev server —
+  run with `npx serve . -l 7310`.
+- **`library`** — a starter for authoring a Zoijs-based package: `src/index.js` +
+  hand-written `index.d.ts`, an `exports`/`types` `package.json` with a peer
+  dependency on `@zoijs/core`, and a `node:test` suite — the shape the official
+  optional packages use.
+- The scaffolder now treats `.ts`/`.d.ts` as text (token substitution), and the
+  CLI's own `npm test` targets its own test file so it no longer runs the
+  templates' bundled test files.
+
+## 0.1.2 — 2026-06-26
+
+Dev-server output polish. No CLI API changes; same zero-dependency server on the
+same ports.
+
+- **Cleaner banner:** `npm run dev` now prints a tidy banner with the local URL
+  on its own line, and only mentions fallback ports when one was actually busy:
+
+  ```text
+    Zoijs dev server
+
+    - Local:  http://localhost:7310
+  ```
+
+  (Previously a single `ZoiJS dev server: http://localhost:7310` line plus a
+  static `If busy: …` note.) Plain ASCII so it renders cleanly in every terminal,
+  including the Windows console. Brand casing normalized to **Zoijs**. Still port
+  **7310** with **7311 / 7312 / 7313** fallbacks; still Node built-ins only.
+
+## 0.1.1 — 2026-06-25
+
+Starter polish. No CLI API changes.
+
+- **Dev server:** generated apps now run `npm run dev` on a tiny zero-dependency
+  static server (`dev-server.mjs`, Node built-ins only) that uses port **7310**
+  and falls back to **7311 / 7312 / 7313** if busy — replacing the old default
+  of port 3000. It prints `ZoiJS dev server: http://localhost:<port>`.
+- **Default `app` template redesigned** into a polished "project dashboard":
+  a hero header, a reusable `StatCard` (used ×4), filter chips (All / Active /
+  Done), an empty state, and a developer-hint footer — demonstrating component
+  composition, conditional rendering, and filtering alongside `createState` /
+  `computed` / `each` and parent⇄child communication. Still depends only on
+  `@zoijs/core`; still no build step.
+- **`basic` template** keeps the minimal counter and adopts the same dev server.
+
+## 0.1.0 — 2026-06-25
+
+Initial release of the Zoijs starter CLI.
+
+- `npm create zoijs@latest my-app` — scaffold a new Zoijs app in one command.
+- Uses the provided folder name as the project name; derives `package.json`
+  `name` (lowercased) and a readable `index.html` `<title>` from it.
+- Two templates: `app` (default — a small task dashboard demonstrating
+  `html` / `mount` / `createState` / `computed` / `each` and parent⇄child
+  communication) and `basic` (a minimal counter). Select with `--template`.
+- Validates the project name (npm-safe) and refuses to overwrite a non-empty
+  directory.
+- Generated apps are plain HTML/CSS/JS with **no build step** and depend only on
+  `@zoijs/core` (served via an import map from `node_modules`).
+- Zero runtime dependencies; the CLI is a single small file.

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Zoijs contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Zoijs contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,97 +1,98 @@
-<div align="center">
-
-# create-zoijs
-
-**Create a new [Zoijs](https://zoijs.dev) app with one command.** Plain HTML, CSS, and JavaScript — no build step.
-
-[![npm](https://img.shields.io/npm/v/create-zoijs.svg)](https://www.npmjs.com/package/create-zoijs)
-[![license](https://img.shields.io/npm/l/create-zoijs.svg)](LICENSE)
-
-</div>
-
----
-
-## Usage
-
-```bash
-npm create zoijs@latest my-app
-cd my-app
-npm install
-npm run dev
-```
-
-`npm run dev` starts a tiny zero-dependency static server (no `serve`, no
-bundler, no build step):
-
-```text
-  Zoijs dev server
-
-  - Local:  http://localhost:7310
-```
-
-(It falls back to 7311–7313 if the port is busy.)
-
-Or with `npx`:
-
-```bash
-npx create-zoijs my-app
-```
-
-> **A note on the name.** npm maps `npm create zoijs` to the package
-> `create-zoijs` (that's npm's convention for `npm create <name>`), which is why
-> this package is `create-zoijs` rather than `@zoijs/create`.
-
-## Naming your app
-
-The folder name you pass becomes the project name:
-
-```bash
-npm create zoijs@latest task-manager
-```
-
-produces a `package.json` with `"name": "task-manager"` and an `index.html`
-with `<title>Task Manager</title>`. If you don't pass a name, the CLI asks for
-one.
-
-## Templates
-
-```bash
-npm create zoijs@latest my-app                       # default: the "app" template
-npm create zoijs@latest my-app --template app        # a polished project dashboard
-npm create zoijs@latest my-app --template basic      # a basic counter
-npm create zoijs@latest my-app --template typescript # type-checked JS, no build step
-npm create zoijs@latest my-app --template minimal    # two flat files, CDN, no install
-npm create zoijs@latest my-app --template library    # author a Zoijs-based package
-```
-
-- **`app`** (default) — a polished project dashboard (hero, stat cards, filters,
-  empty state) showing `html`, `mount`, `createState`, `computed`, `each`,
-  conditional rendering, and parent⇄child component communication.
-- **`basic`** — a basic counter, a small local app with a dev server.
-- **`typescript`** — the counter as type-checked JavaScript (`// @ts-check` +
-  strict `tsconfig.json` + `npm run typecheck`). Full TS safety, **no build step**.
-- **`minimal`** — the smallest scaffold: two flat files loading `@zoijs/core` from a
-  CDN. No install, no dev server — run with `npx serve . -l 7310`.
-- **`library`** — a starter for authoring a Zoijs-based package: `src` + `.d.ts`,
-  `exports`/`types`, a peer dep on `@zoijs/core`, and a `node:test` suite.
-
-## What it does
-
-- Copies a template, fills in the app name, and prints the next three commands.
-- Validates the name (npm-safe) and won't overwrite a non-empty folder.
-
-## What it does **not** do
-
-By design, to keep Zoijs simple: no build system, no bundler, no compiler, no
-JSX transform, no code generation, no plugin system, no template DSL, and no
-complex prompts. The generated app is plain files you can read.
-
-## You don't need this tool
-
-Zoijs works without the CLI — it's only a convenience. You can create an app by
-hand with an import map and a `<script type="module">`, or with
-`npm install @zoijs/core`. See the [Start guide](https://zoijs.dev/start).
-
-## License
-
-[MIT](LICENSE) © Zoijs contributors
+<div align="center">
+
+# create-zoijs
+
+**Create a new [Zoijs](https://zoijs.dev) app with one command.** Plain HTML, CSS, and JavaScript — no build step.
+
+[![npm](https://img.shields.io/npm/v/create-zoijs.svg)](https://www.npmjs.com/package/create-zoijs)
+[![license](https://img.shields.io/npm/l/create-zoijs.svg)](LICENSE)
+
+</div>
+
+---
+
+## Usage
+
+```bash
+npm create zoijs@latest my-app
+cd my-app
+npm install
+npm run dev
+```
+
+`npm run dev` starts a tiny zero-dependency static server (no `serve`, no
+bundler, no build step):
+
+```text
+  Zoijs dev server
+
+  - Local:  http://localhost:7310
+```
+
+(It falls back to 7311–7313 if the port is busy.)
+
+Or with `npx`:
+
+```bash
+npx create-zoijs my-app
+```
+
+> **A note on the name.** npm maps `npm create zoijs` to the package
+> `create-zoijs` (that's npm's convention for `npm create <name>`), which is why
+> this package is `create-zoijs` rather than `@zoijs/create`.
+
+## Naming your app
+
+The folder name you pass becomes the project name:
+
+```bash
+npm create zoijs@latest task-manager
+```
+
+produces a `package.json` with `"name": "task-manager"` and an `index.html`
+with `<title>Task Manager</title>`. If you don't pass a name, the CLI asks for
+one.
+
+## Templates
+
+```bash
+npm create zoijs@latest my-app                       # default: the "app" template
+npm create zoijs@latest my-app --template app        # a polished project dashboard
+npm create zoijs@latest my-app --template basic      # a basic counter
+npm create zoijs@latest my-app --template typescript # type-checked JS, no build step
+npm create zoijs@latest my-app --template minimal    # two flat files, CDN, no install
+npm create zoijs@latest my-app --template library    # author a Zoijs-based package
+```
+
+- **`app`** (default) — a polished project dashboard (hero, stat cards, filters,
+  empty state) showing `html`, `mount`, `createState`, `computed`, `each`,
+  conditional rendering, and parent⇄child component communication.
+- **`basic`** — a basic counter, a small local app with a dev server.
+- **`typescript`** — the counter as type-checked JavaScript (`// @ts-check` +
+  strict `tsconfig.json` + `npm run typecheck`). Full TS safety, **no build step**.
+- **`minimal`** — the smallest scaffold: two flat files loading `@zoijs/core` from a
+  CDN (exact version, integrity-pinned). No install — `npm run dev` runs the same
+  hardened dev server as the other templates.
+- **`library`** — a starter for authoring a Zoijs-based package: `src` + `.d.ts`,
+  `exports`/`types`, a peer dep on `@zoijs/core`, and a `node:test` suite.
+
+## What it does
+
+- Copies a template, fills in the app name, and prints the next commands to run.
+- Validates the name (npm-safe) and won't overwrite a non-empty folder.
+
+## What it does **not** do
+
+By design, to keep Zoijs simple: no build system, no bundler, no compiler, no
+JSX transform, no code generation, no plugin system, no template DSL, and no
+complex prompts. The generated app is plain files you can read.
+
+## You don't need this tool
+
+Zoijs works without the CLI — it's only a convenience. You can create an app by
+hand with an import map and a `<script type="module">`, or with
+`npm install @zoijs/core`. See the [Start guide](https://zoijs.dev/start).
+
+## License
+
+[MIT](LICENSE) © Zoijs contributors