create-next-pro-cli 0.1.27 → 0.1.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-next-pro-cli",
-  "version": "0.1.27",
+  "version": "0.1.29",
   "description": "Advanced Next.js project scaffolder with i18n, Tailwind, App Router and more.",
   "repository": {
     "type": "git",
@@ -38,12 +38,13 @@
     "format:check": "prettier --check --ignore-unknown .github/workflows/ci.yml .husky scripts bunfig.toml bin.bun.ts bin.node.ts src tsup.config.ts eslint.config.mjs package.json tsconfig.base.json tsconfig.json tsconfig.node.json",
     "lint": "eslint bin.bun.ts bin.node.ts scripts src tsup.config.ts",
     "typecheck": "tsc --project tsconfig.json --noEmit",
+    "language:check": "bun scripts/check-public-language.ts",
     "test": "bun test",
     "clean": "rm -rf dist",
     "build": "bun run clean && bun run build:node && bun run build:bun && cp scripts/create-next-pro dist/create-next-pro && chmod +x dist/create-next-pro",
     "build:node": "tsup",
     "build:bun": "bun build bin.bun.ts --outdir dist --target=bun",
-    "check": "bun run format:check && bun run lint && bun run typecheck && bun test && bun run build",
+    "check": "bun run format:check && bun run lint && bun run typecheck && bun run language:check && bun test && bun run build",
     "prepublishOnly": "bun run check",
     "commitlint:range": "commitlint",
     "release:check": "bun scripts/release.ts check",

package/templates/Projects/default/.env.example

@@ -3,15 +3,17 @@ NEXT_PUBLIC_APP_URL=http://localhost:3000
 
 # Auth.js v5
 AUTH_URL=http://localhost:3000
-AUTH_SECRET=
-AUTH_GOOGLE_ID=
-AUTH_GOOGLE_SECRET=
-AUTH_TRUST_HOST=false
+AUTH_SECRET=5gIEEQCHbA73SpylgkvVBX72k1x3wEOsvXKIos6ajXw= #Generate a random secret with: openssl rand -base64 32
+# AUTH_GOOGLE_ID=
+# AUTH_GOOGLE_SECRET=
+AUTH_TRUST_HOST=true # This is necessary for the local development.
 AUTH_DISABLED=false
 
 # Legacy aliases are still accepted by the template code:
 # PROJECT_PRODUCTION_URL=
 # NEXTAUTH_URL=
 # NEXTAUTH_SECRET=
-# GOOGLE_CLIENT_ID=
-# GOOGLE_CLIENT_SECRET=
+
+# This credentials are public published from Rising Corporation for the Google OAuth2.0 authentication local development.
+GOOGLE_CLIENT_ID=603158603730-f5rnolm4vnmgocb68msogofd9ujf61t9.apps.googleusercontent.com
+GOOGLE_CLIENT_SECRET=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

package/templates/Projects/default/.github/workflows/quality.yml

@@ -8,17 +8,48 @@ on:
 jobs:
   validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        manager: [bun, npm, pnpm]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
       - uses: oven-sh/setup-bun@v2
+        if: matrix.manager == 'bun'
         with:
           bun-version: 1.3.14
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v4
+        if: matrix.manager == 'pnpm'
         with:
-          node-version: 24
-      - run: bun install --frozen-lockfile
-      - run: bun run check
-      - run: bun run audit
-      - run: bun run test:consumer
-      - run: bunx playwright install --with-deps chromium
-      - run: bun run test:e2e
+          version: 11
+      - name: Verify runtime isolation
+        if: matrix.manager != 'bun'
+        run: test -z "$(command -v bun || true)"
+      - name: Prepare package-manager-neutral checkout
+        if: matrix.manager != 'bun'
+        run: npm pkg delete packageManager
+      - name: Install dependencies
+        run: |
+          if [ "${{ matrix.manager }}" = bun ]; then
+            bun install --frozen-lockfile
+          elif [ "${{ matrix.manager }}" = npm ]; then
+            npm install
+          else
+            pnpm install --no-frozen-lockfile
+          fi
+      - run: ${{ matrix.manager }} run check
+      - run: ${{ matrix.manager }} run audit
+      - name: Validate an isolated consumer
+        env:
+          CNP_PACKAGE_MANAGER: ${{ matrix.manager }}
+        run: ${{ matrix.manager }} run test:consumer
+      - name: Install Chromium
+        if: matrix.manager == 'npm'
+        run: npx playwright install --with-deps chromium
+      - name: Run visual integration tests without Bun
+        if: matrix.manager == 'npm'
+        run: npm run test:e2e

package/templates/Projects/default/.gitignore.template

@@ -1,5 +1,7 @@
-# dependencies
-/node_modules
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+
+# dependencies and package-manager caches
+/node_modules/
 /.pnp
 .pnp.*
 .yarn/*
@@ -7,41 +9,57 @@
 !.yarn/plugins
 !.yarn/releases
 !.yarn/versions
+/.bun/
 
 # testing
-/coverage
-/artifacts
-/playwright-report
-/test-results
+/coverage/
+/artifacts/
+/playwright-report/
+/test-results/
 
 # next.js
 /.next/
 /out/
 
-# production
-/build
+# production and tool caches
+/build/
+/dist/
+/.cache/
+/.turbo/
+.eslintcache
+.stylelintcache
 
-# misc
+# operating system and editor files
 .DS_Store
+Thumbs.db
+*.swp
+*.swo
+*~
 *.pem
 
 # debug
+*.log
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 .pnpm-debug.log*
+bun-debug.log*
 
-# env files
+# env files (can opt-in for committing if needed)
 .env*
 !.env.example
 
-# vercel
-.vercel
+# deployment metadata
+/.vercel/
+/.netlify/
+/.wrangler/
 
 # typescript
 *.tsbuildinfo
 next-env.d.ts
 
-# development
-.cursor
-.vscode
+# local development metadata
+/.cursor/
+/.vscode/
+/.idea/
+/.agent/

package/templates/Projects/default/README.md

@@ -4,16 +4,25 @@ Next.js App Router template for `create-next-pro-cli`.
 
 ## Runtime
 
-This template is Bun-first. Do not use npm, pnpm, or yarn for project scripts.
+Choose Bun, npm, or pnpm for dependency installation and project scripts. The
+repository keeps `bun.lock` as its reproducible source lockfile, while npm and
+pnpm consumers create their own lockfiles in their working copies.
 
 Required:
 
 ```bash
-bun --version
 node --version
+bun --version # optional
+npm --version # optional
+pnpm --version # optional
 ```
 
-Node must satisfy `>=24.0.0`.
+Node must satisfy `>=24.0.0`. Bun must satisfy `>=1.3.14` when selected, and
+pnpm 11 or later is supported.
+
+The npm `allowScripts` policy and pnpm `allowBuilds` policy approve only the
+native build steps required by Next.js and the file-watcher toolchain. Security
+overrides are declared for both npm-compatible and pnpm dependency graphs.
 
 ## Setup
 
@@ -21,16 +30,29 @@ Node must satisfy `>=24.0.0`.
 bun install
 cp .env.example .env
 bun run dev
+
+# or
+npm install
+cp .env.example .env
+npm run dev
+
+# or
+pnpm install
+cp .env.example .env
+pnpm run dev
 ```
 
 Open `http://localhost:3000`.
 
 ## Environment
 
-Auth.js v5 supports Google OAuth when credentials are configured. The public
-application, checks and production build work without OAuth credentials.
+Auth.js v5 supports Google OAuth. The canonical `.env.example` intentionally
+contains public, limited development credentials so a generated project can be
+tested immediately. Treat every value in that file as public and replace all
+authentication credentials before production use.
 
-Optional Google OAuth values (set all three together):
+Auth.js requires the application secret, Google client ID, and Google client
+secret to be set together:
 
 ```bash
 AUTH_SECRET=
@@ -41,7 +63,10 @@ AUTH_TRUST_HOST=false
 AUTH_DISABLED=false
 ```
 
-The template also accepts the legacy aliases `NEXTAUTH_SECRET`, `NEXTAUTH_URL`, `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, and `PROJECT_PRODUCTION_URL` to ease migration from older generated projects.
+The template also accepts the legacy aliases `NEXTAUTH_SECRET`, `NEXTAUTH_URL`,
+`GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, and `PROJECT_PRODUCTION_URL` to ease
+migration from older generated projects. Set `AUTH_DISABLED=true` when a check
+must run without initializing the Google provider.
 
 ## Scripts
 
@@ -58,6 +83,10 @@ bun run audit
 bun run check
 ```
 
+Replace `bun run` with `npm run` or `pnpm run` for the selected manager. The
+`audit` and `test:consumer` scripts detect the invoking manager without shell
+commands, including on Windows.
+
 ## Template Features
 
 - Next.js 16 App Router
@@ -72,8 +101,8 @@ bun run check
 ## Rendering and CSP
 
 Public localized pages are prerendered for `en` and `fr`. Authenticated routes
-and Auth.js handlers stay dynamic. `bun run verify:rendering` checks this boundary
-after every production build.
+and Auth.js handlers stay dynamic. `verify:rendering` checks this boundary after
+every production build, regardless of the selected package manager.
 
 The default Content Security Policy follows the stable static-rendering setup
 documented by Next.js and allows the framework's inline bootstrap scripts. Projects