Add interactive starter options and deployment setup

[bcomnes]

Summary

• Add interactive TypeScript/JavaScript, Preact/React, Tailwind, and deployment choices with non-interactive flags.
• Use upstream DOMStack language-aware eject directly and remove the duplicate layout template.
• Generate GitHub Pages workflows with base-path handling and Neocities workflows using deploy-to-neocities.
• Derive starter dependency ranges from generator devDependencies and enable Dependabot range updates.
• Add generated setup documentation and reusable packed integration tests.

Validation

• npm test: 42 tests, lint, and TypeScript checks passed.
• npm run smoke:local -- ../domstack: passed against the local upstream changes, covering six generated projects, JS/TS, framework choices, Tailwind, and deployment options.
• Verified generated TypeScript checks, Tailwind output, GitHub Pages asset prefixes, and packed API declarations.
• No live deployments performed.

Release blocker

This draft depends on the upstream DOMStack feat/typescript-default-eject changes providing --eject --language ts|js --yes.
Publish those changes and update the @domstack/static devDependency range before releasing this generator.
The current range remains ^12.0.0-beta.5; local integration validation used a tarball of the upstream working tree rather than a published release.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​react-dom@​19.3.0
	npm/​@​domstack/​static@​12.0.0-beta.5
	npm/​@​types/​react@​19.3.0
	npm/​esbuild-plugin-tailwindcss@​2.2.0
	npm/​react@​19.3.0
	npm/​react-dom@​19.3.0
	npm/​preact@​10.29.8

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @pnpm/network.ca-file is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/@domstack/static@12.0.0-beta.5 → npm/@pnpm/network.ca-file@1.0.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@pnpm/network.ca-file@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm js-beautify is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/@domstack/static@12.0.0-beta.5 → npm/js-beautify@1.15.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-beautify@1.15.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[bcomnes]

Upstream draft PR is now open: bcomnes/domstack#320. It provides the canonical TypeScript default layout and --eject --language js|ts --yes support used here. Publish the upstream change and update this generator’s @domstack/static range before releasing.

[Copilot]

🟡 Changes recommended

Three critical issues remain unresolved, including an incompatible published dependency range and workflow security concerns.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds interactive starter options, framework/Tailwind setup, deployment workflows, DOMStack ejection, dependency management, documentation, and integration tests.

Changes:

• Adds JS/TS, Preact/React, Tailwind, and deployment choices.
• Adds GitHub Pages and Neocities workflow generation.
• Adds manifest-derived dependency ranges, Dependabot configuration, and smoke tests.

Unresolved critical findings:

• deployment.ts:103 — Pin the third-party action to an audited commit SHA and retain a version comment. (3 votes)
• deployment.ts:5 — Set persist-credentials: false on checkout to prevent token exposure. (1 vote)
• package.json:13 — Update the DOMStack dependency to a published release supporting --language and --yes. (3 votes)

File summaries

File	Description
template.ts	Generates language, framework, and Tailwind starter files.
template.test.ts	Tests feature combinations.
smoke.ts	Provides packed integration testing.
README.md	Documents options, deployment, and setup.
prompts.ts	Implements interactive feature selection.
prompts.test.ts	Tests prompt behavior and defaults.
package.json	Adds starter dependencies and build scripts.
index.ts	Orchestrates generation, installation, and ejection.
index.test.ts	Tests the generator API.
eject.test.ts	Tests package-manager ejection behavior.
deployment.ts	Generates deployment workflows.
deployment.test.ts	Tests deployment output and configuration.
dependencies.ts	Reads dependency ranges from package metadata.
dependencies.test.ts	Tests dependency-range resolution.
defaults.ts	Restores Tailwind defaults after ejection.
bin.ts	Connects CLI parsing, prompts, and project creation.
.github/dependabot.yml	Enables dependency range updates.

Review details

• Files reviewed: 17/17 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.