fix(create-void): validate Cloudflare-compatible project names (#541)

The lowercase check added in #513 still accepts names such as `my_app`,
`my.app`, `my app`, paths, and names longer than a workers.dev DNS
label. The scaffolder writes the supplied name directly into
package.json, so these inputs should receive actionable validation
before files are created or dependencies installed.

Extend the validator already shared by the interactive prompt and
positional CLI argument to require lowercase ASCII letters, digits, and
dashes, with an alphanumeric first/last character and a maximum of 63
characters. Preserve lowercase diagnostics and the interactive default.
Add regression coverage for invalid characters, paths, Unicode/control
characters, dash boundaries, single-character names, and the
63/64-character boundary; document the accepted project-name format.

Cloudflare references:
- [Worker name
configuration](https://developers.cloudflare.com/workers/wrangler/configuration/#inheritable-keys):
alphanumeric characters and dashes; underscores are explicitly
disallowed.
- [workers.dev
limitations](https://developers.cloudflare.com/workers/configuration/routing/workers-dev/#limitations):
at most 63 characters, with no leading/trailing dash. Workers without
workers.dev can have names up to 255 characters; the scaffolder
intentionally uses the workers.dev-compatible limit. Cloudflare itself
permits uppercase; this change preserves Void's existing lowercase
policy.

This narrows scaffold inputs: paths (including `.`) and scoped names are
rejected because the input is also used as the package name. Existing
project deployment naming and the separately validated Void platform
slug remain unchanged.

Validation: five dependency-free Node test groups against the production
validator/parser passed, covering valid/invalid input tables,
boundaries, defaults, and existing argument forwarding. The repository
Vite+ tests, affected-test checks, typecheck, and full suite could not
run because `vp` is unavailable and the shell proxy is unreachable,
preventing dependency installation.

---------

Signed-off-by: Christoph Nakazawa <christoph.pojer@gmail.com>
Co-authored-by: Christoph Nakazawa <christoph.pojer@gmail.com>

Author: camc314

packages/create-void/src/args.ts

@@ -14,6 +14,21 @@ export function validateProjectName(value: string | undefined): string | undefin
   if (value !== undefined && value !== value.toLowerCase()) {
     return 'Project name must be lowercase';
   }
+  // The prompt uses an empty value to select its default project name.
+  if (!value) {
+    return undefined;
+  }
+  // Keep scaffold names usable as workers.dev DNS labels.
+  // https://developers.cloudflare.com/workers/configuration/routing/workers-dev/#limitations
+  if (value.length > 63) {
+    return 'Project name must be at most 63 characters';
+  }
+  if (/[^a-z0-9-]/.test(value)) {
+    return 'Project name must contain only lowercase letters, numbers, and dashes';
+  }
+  if (value.startsWith('-') || value.endsWith('-')) {
+    return 'Project name cannot start or end with a dash';
+  }
   return undefined;
 }
 

packages/create-void/test/unit/args.test.ts

@@ -21,6 +21,24 @@ describe('parseCreateArgs', () => {
     expect(() => parseCreateArgs([name])).toThrow('create-void: Project name must be lowercase');
   });
 
+  it.each([
+    'my_app',
+    'my.app',
+    'my app',
+    'nested/my-app',
+    'my-app-',
+    'a'.repeat(64),
+  ])('rejects invalid project names from the command line: %s', (name) => {
+    expect(() => parseCreateArgs([name])).toThrow('create-void: Project name');
+  });
+
+  it.each(['a', '0', 'my-app', 'my--app', 'app123', 'a'.repeat(63)])(
+    'accepts deployable project names from the command line: %s',
+    (name) => {
+      expect(parseCreateArgs([name])).toEqual({ appName: name, initArgs: [] });
+    },
+  );
+
   it('rejects arguments that are not plain flags or values', () => {
     expect(() => parseCreateArgs(['my-app', '--framework', 'react&calc'])).toThrow(
       "create-void: Unsupported argument 'react&calc'.",
@@ -33,8 +51,47 @@ describe('validateProjectName', () => {
     expect(validateProjectName(name)).toBe('Project name must be lowercase');
   });
 
-  it.each(['my-app', 'app123', 'nested/my-app', '.'])('accepts lowercase names: %s', (name) => {
-    expect(validateProjectName(name)).toBeUndefined();
+  it.each(['a', '0', 'my-app', 'my--app', 'app123', 'a'.repeat(63)])(
+    'accepts lowercase names: %s',
+    (name) => {
+      expect(validateProjectName(name)).toBeUndefined();
+    },
+  );
+
+  it.each([
+    'my_app',
+    'my.app',
+    'my app',
+    ' my-app',
+    'my-app ',
+    'my-app\n',
+    'my-app\t',
+    'my-app\u0000',
+    'café',
+    '项目',
+    'my😀app',
+    'nested/my-app',
+    'nested\\my-app',
+    '@scope/my-app',
+    '.',
+    '..',
+    '../my-app',
+    '/tmp/my-app',
+    'my&app',
+    'my;app',
+    'my$app',
+  ])('rejects characters outside the Cloudflare name alphabet: %j', (name) => {
+    expect(validateProjectName(name)).toBe(
+      'Project name must contain only lowercase letters, numbers, and dashes',
+    );
+  });
+
+  it.each(['-app', 'app-', '-', '--'])('rejects leading or trailing dashes: %s', (name) => {
+    expect(validateProjectName(name)).toBe('Project name cannot start or end with a dash');
+  });
+
+  it('rejects names longer than a workers.dev DNS label', () => {
+    expect(validateProjectName('a'.repeat(64))).toBe('Project name must be at most 63 characters');
   });
 
   it('allows the prompt default and rejects whitespace-only names', () => {