feat(cli): add Atlas theme setup

Add an explicit rocket init --yes path for converting CommonJS package metadata to ESM, scaffold a public theme stylesheet, and let Atlas layout data load project-owned stylesheets after package CSS. The docs and generated Rocket skill now cover constrained dev-server fallbacks, curl HTML smoke tests, and the starter theming path; the staged README cleanup and build script update are included with the setup pass.

Author: daKmoR

.agents/skills/rocket/SKILL.md

@@ -15,8 +15,13 @@ description: Use when editing Rocket Pages, config, layouts, component reference
 - Markdown using Rocket custom elements needs a `components` export; use Atlas component maps or `rocketDemoComponents`.
 - Add `menu.iconName` to Atlas docs navigation Pages so the left navigation has icons.
 - Direct layout re-exports are supported when no local wrapper function is needed.
+- For Atlas theming, use shared layout data with `stylesheets` and centralized CSS variables instead of per-Page style injection.
+- To add a general Page, create `docs/pages/name.rocket.md`, set `config.path`, `metadata`, `menu.iconName`, and use the shared docs layout.
 - Custom layouts rendering `rocket-icon` need `addBootstrapIconLibrary(pageData)` before `document()`.
 - Static JavaScript Pages render once per concrete path; query/header/cookie/live-data output needs `render: 'server'`.
 - Static Request Demos should target concrete non-query URLs.
 - After adding a `js demo`, verify the parent Page and Standalone Demo URL `/page/_demo/demoName/`.
+- If `rocket init` fails because package.json has `"type": "commonjs"`, change it to `"type": "module"` or rerun `npx rocket init --yes`.
+- If dev server watchers fail with `EMFILE`, run `npm start -- --no-watch --no-open` and use `Ctrl+R` for manual restarts.
+- When smoke-testing Pages with curl, send `Accept: text/html`: `curl -H 'Accept: text/html' http://localhost:8888/path`.
 - Keep `npm run build` passing; record Rocket package issues separately from local workarounds.

.changeset/atlas-theme-init.md

@@ -0,0 +1,5 @@
+---
+'@rocket/js': patch
+---
+
+Add project-owned stylesheet hooks to Atlas layout data and wire `rocket init` to scaffold a central theme stylesheet. The initializer also supports an explicit `--yes` path for converting CommonJS package metadata to ESM, and the docs now cover constrained dev-server fallbacks and curl Page smoke tests.

CHANGELOG.md

@@ -11,7 +11,7 @@ release PR can update this file with the final version and package notes.
 
 ## 0.1.0
 
-- Relaunches Rocket as `@rocket/js`.
-- Marks the package as alpha.
+- Starts Rocket's current public alpha as `@rocket/js`.
+- Marks the package as alpha before `1.0.0`.
 - Introduces the AI-assisted setup path, explicit Page config docs, static output docs, and Web
   Component documentation examples.

README.md

@@ -1,4 +1,4 @@
-> Rocket is in alpha. Expect APIs and documentation to keep improving before 1.0.
+> Rocket is in public alpha. Expect APIs and documentation to keep improving before 1.0.
 
 <p align="center">
   <picture width="60%">
@@ -157,29 +157,14 @@ Use Rocket for:
 - documentation sites
 - Web Component and design-system docs
 - AI-generated sites you want to own afterward
-- pages that should ship as HTML before they ship JavaScript
+- pages that should ship as HTML before JavaScript
 
 Do not use Rocket for:
 
 - SPA products with complex client-side routing
 - backend applications
-- projects that need a huge plugin marketplace today
-- teams that want React, Astro, Eleventy, or VitePress conventions specifically
-
-## Why not Astro, Eleventy, or VitePress?
-
-Those are good tools. Rocket chooses a narrower shape:
-
-| Need                       | Rocket |
-| -------------------------- | ------ |
-| Content-first static sites | Yes    |
-| Web Component docs         | Strong |
-| Zero JS default            | Core   |
-| Explicit page config       | Core   |
-| AI-friendly project shape  | Core   |
-| Full app framework         | No     |
-| Huge plugin ecosystem      | No     |
-| React-first authoring      | No     |
+- projects that need a large plugin ecosystem today
+- teams that specifically want React, Astro, Eleventy, or VitePress conventions
 
 ## Package and dependency philosophy
 
@@ -190,8 +175,8 @@ browser JavaScript is only emitted for loading strategies you choose.
 
 ## Status and docs
 
-Rocket is currently **alpha** at `0.1.x`. APIs can change before `1.0.0`; breaking changes are
-documented through changesets and release notes.
+Rocket is currently in **public alpha** at `0.1.x`. APIs can change before `1.0.0`;
+breaking changes are documented through changesets and release notes.
 
 - [Start With AI](https://rocket.modern-web.dev/setup/build-with-ai/)
 - [Manual Quick Start](https://rocket.modern-web.dev/setup/manual-quick-start/)

ROADMAP.md

@@ -1,13 +1,14 @@
 # Roadmap
 
-Rocket is currently alpha. This roadmap describes the work that makes the relaunch credible and the
-criteria for a future `1.0.0`.
+Rocket is currently in public alpha. This roadmap describes the work that keeps the public alpha
+credible and the criteria for a future `1.0.0`.
 
-## Relaunch
+## Public Alpha
 
 - Keep the public positioning focused on AI-generated, owned static sites and Web Component docs.
 - Keep README, docs, npm package metadata, and release notes aligned on `@rocket/js`.
-- Publish with npm provenance from GitHub Actions.
+- Treat npm as the `@rocket/js` release channel, not a separate launch status.
+- Continue publishing with npm provenance from GitHub Actions.
 - Maintain `SECURITY.md`, `CHANGELOG.md`, `CONTRIBUTING.md`, and a committed lockfile.
 - Surface one polished marketing-site example, one component-library docs example, and one
   AI-generated-from-brief example.

SECURITY.md

@@ -2,8 +2,8 @@
 
 ## Supported Versions
 
-Rocket is in alpha. Security fixes target the latest published `0.1.x` release and the `main`
-branch unless a release note says otherwise.
+Rocket is in public alpha. Security fixes target the latest published `0.1.x` release and the
+`main` branch unless a release note says otherwise.
 
 ## Reporting a Vulnerability
 
@@ -16,14 +16,30 @@ request a private security contact. Do not open a public issue for an active vul
 
 ## Release Security
 
+Rocket's public alpha is the adoption status. npm is the release channel for `@rocket/js`.
 Maintainers should publish npm releases from GitHub Actions, not local machines. The release workflow
-is configured for npm provenance. For npm trusted publishing, configure the `@rocket/js` package on
-npm to trust this repository and `.github/workflows/release.yml` on the `main` branch.
+is configured for trusted publishing and npm provenance. Published `@rocket/js` versions have
+already been released through the trusted publisher, and the npm package is configured to require
+two-factor authentication and disallow token-based publishing.
 
-Before public npm launch, maintainers should verify:
+Before the public alpha announcement, maintainers should verify:
 
+- README, docs, package metadata, roadmap, changelog, and release notes call Rocket a public alpha at
+  the latest `0.1.x` version; avoid suggesting the already-published package is not yet available
+  on npm.
 - npm organization 2FA is enabled for maintainers and publishers.
-- npm trusted publishing is configured for the release workflow.
-- The package page shows provenance for the published version.
-- Release PRs keep `package-lock.json` synchronized with `package.json`.
+- The `@rocket/js` npm package settings still show the GitHub Actions trusted publisher for
+  `modernweb-dev/rocket`, `.github/workflows/release.yml`, and the `main` branch.
+- The npm package publishing policy still requires 2FA and disallows token-based publishing; unused
+  automation tokens are revoked.
+- `.github/workflows/release.yml` keeps `id-token: write`, uses GitHub-hosted runners, disables the
+  package-manager cache for release installs, and does not publish with `NPM_TOKEN` or
+  `NODE_AUTH_TOKEN`.
+- `package.json` has a public `repository.url` that matches the GitHub repository used by trusted
+  publishing and provenance.
+- Release PRs keep `package-lock.json` synchronized with `package.json`, include required
+  changesets, and update changelog output.
 - Dependency changes pass GitHub dependency review.
+- `npm pack --dry-run` output contains only intended package files.
+- The npm package page shows provenance for the latest published version; maintainers can also run
+  `npm audit signatures` with the latest npm CLI from a project that installs `@rocket/js`.

docs/adr/0007-rocket-initializer-creates-atlas-docs-starter.md

@@ -1,7 +1,7 @@
 # Rocket initializer creates an Atlas docs starter
 
-The Rocket Initializer is a post-install project initializer, not a package bootstrapper or full site generator. `rocket init` should create a compact Atlas-backed documentation starter by default: `rocket-config.js`, shared Atlas data, a hero home Page, a general docs Page, a JavaScript Demo Page, a Request Demo Page backed by a concrete static JSON Page, and a removable project-local Rocket Agent Skill at `.agents/skills/rocket/SKILL.md`. This starter gives Site Authors and Coding Agents a buildable example of the package-provided Atlas layouts, matching component-map exports, `menu.iconName` navigation icons, Standalone Demo URLs, and static Request Demos without requiring a custom layout first.
+The Rocket Initializer is a post-install project initializer, not a package bootstrapper or full site generator. `rocket init` should create a compact Atlas-backed documentation starter by default: `rocket-config.js`, shared Atlas data, a public theme stylesheet, a hero home Page, a general docs Page, a JavaScript Demo Page, a Request Demo Page backed by a concrete static JSON Page, and a removable project-local Rocket Agent Skill at `.agents/skills/rocket/SKILL.md`. This starter gives Site Authors and Coding Agents a buildable example of the package-provided Atlas layouts, matching component-map exports, project-owned Atlas theme stylesheets, `menu.iconName` navigation icons, Standalone Demo URLs, and static Request Demos without requiring a custom layout first.
 
-When `package.json` exists, the initializer should add missing `type`, `start`, and `build` fields without replacing existing choices. If generic `start` or `build` scripts already exist, it should add missing `rocket:start` or `rocket:build` scripts instead. Rocket remains ESM-only for this initializer: missing `type` becomes `"module"`, existing `"module"` is preserved, and existing `"commonjs"` fails before writing files. General Documentation Pages always start under `docs/pages`, while the config also discovers colocated Component Reference Pages under `src`, so the same initializer works for Standalone Rocket Sites and existing codebases without modes, flags, `AGENTS.md`, dependency installation, or dependency mutation.
+When `package.json` exists, the initializer should add missing `type`, `start`, and `build` fields without replacing existing choices. If generic `start` or `build` scripts already exist, it should add missing `rocket:start` or `rocket:build` scripts instead. Rocket remains ESM-only for this initializer: missing `type` becomes `"module"`, existing `"module"` is preserved, and existing `"commonjs"` fails before writing files unless the caller explicitly passes `--yes` to approve changing it to `"module"`. General Documentation Pages always start under `docs/pages`, while the config also discovers colocated Component Reference Pages under `src`, so the same initializer works for Standalone Rocket Sites and existing codebases without dependency installation or dependency mutation.
 
 Existing files and package fields should never be overwritten by default; when a Rocket-related starter file already exists, the initializer should leave it untouched and report the skipped path. The initializer should not run install, start, build, or validation commands; it only writes starter files and prints next steps.

docs/pages/advanced/10-atlas-layouts.rocket.md

@@ -111,6 +111,7 @@ export const siteData = {
     ],
   },
   footerData: [],
+  stylesheets: ['/rocket-theme.css'],
   navigationIconServerBudget: 35,
 };
 ```
@@ -126,14 +127,18 @@ URLs are treated as external even when `external` is omitted.
 icon when Rocket has a matching icon asset. The optional `label` shows visible text to the right of
 the icon. Omit `label` for an icon-only link.
 
+`stylesheets` is optional. Use it for project-owned theme CSS loaded after the package Atlas CSS.
+Keep color and spacing overrides centralized there, usually as CSS variables, instead of injecting
+Page-specific style blocks.
+
 `navigationIconServerBudget` controls how many automatic `rocket-icon` hosts in the docs
 navigation are server-rendered before the remaining navigation icons are deferred to the browser.
 Atlas defaults this to `35`, which keeps likely above-the-fold navigation icons in the first HTML
 response while avoiding work for deep navigation entries. Set it in your project-owned `siteData` to
 raise, lower, or zero the budget.
 
-The docs layout reads `headerData` and `navigationIconServerBudget`; keep `footerData` as an empty
-array when the same data module is not used by another layout.
+The docs layout reads `headerData`, `stylesheets`, and `navigationIconServerBudget`; keep
+`footerData` as an empty array when the same data module is not used by another layout.
 
 Keep this data in your project. Do not import Rocket's docs-site `docs/pages/globalData.js` into a
 user site.

docs/pages/advanced/30-dev-server.rocket.md

@@ -53,10 +53,13 @@ Use flags when you need a different startup shape:
 npx rocket start --port 3000
 npx rocket start --no-open
 npx rocket start --no-watch
+npx rocket start --no-watch --no-open
 ```
 
 `--no-open` leaves the browser closed. `--no-watch` disables automatic reload watchers; use
-`Ctrl+R` for manual restarts when you want to reload after a change.
+`Ctrl+R` for manual restarts when you want to reload after a change. If startup fails with
+`EMFILE`, retry with `npm start -- --no-watch --no-open` or
+`npx rocket start --no-watch --no-open`.
 
 ## Restart
 
@@ -132,6 +135,13 @@ The dev server also distinguishes document requests from asset requests. For non
 Rocket tries to resolve the requested path relative to the current Page's source file when a
 matching file exists.
 
+Plain `curl` sends `Accept: */*`, which Rocket treats as asset-like in development. When
+smoke-testing a Page from the terminal, send an HTML accept header:
+
+```bash
+curl -H 'Accept: text/html' http://localhost:8888/docs
+```
+
 For build-safe asset URLs, prefer the [`resolve` function](/reference/assets) in Page server code or
 layout code. For stable root-relative files such as favicons, verification files, and downloads,
 use [Public Assets](/reference/assets).

docs/pages/build-a-site/0-index.rocket.md

@@ -54,6 +54,7 @@ The track covers the current Atlas docs shape:
 
 - a local `docs/docsLayout.js` wrapper around `atlasDocLayout`
 - project-owned `DocData` in `docs/siteData.js`
+- centralized Atlas theme variables in `public/rocket-theme.css`
 - Site Head Metadata in `rocket-config.js`
 - top header links, social links, and menu icon rendering
 - page-specific Atlas aside tips through `metadata.custom.atlasDoc`