create-next-pro-cli 0.1.28 → 0.1.29

package/README.md

@@ -130,6 +130,9 @@ The Next.js route and its interface are separate: `src/app` owns routing while `
 ```text
 my-app/
 ├── .env.example
+├── .gitignore
+├── .prettierignore
+├── bun.lock
 ├── cnp.config.json
 ├── messages/
 │   ├── en/
@@ -183,11 +186,15 @@ my-app/
 │   ├── e2e/
 │   ├── rendering/
 │   └── unit/
+├── scripts/
+│   ├── audit.ts
+│   └── package-manager.ts
 ├── next.config.ts
 ├── package.json
 ├── playwright.config.ts
 ├── pnpm-workspace.yaml
-└── tsconfig.json
+├── tsconfig.json
+└── vitest.config.ts
 ```
 
 Template working files (`.env`, the nested Git repository, caches, screenshots, and test results) are not copied into generated projects. The CLI creates `cnp.config.json` with the project name and selected alias.
@@ -322,13 +329,13 @@ Interactive input is never attempted in JSON mode. Pass every required argument
 
 ## Environment and security
 
-Generated projects contain `.env.example`, never the template's local `.env`. Copy it before configuring Auth.js:
+Generated projects contain only the canonical `.env.example`, never the template's local `.env` or other environment copies. Copy it before configuring Auth.js:
 
 ```bash
 cp .env.example .env.local
 ```
 
-OAuth credentials, nested Git repositories, caches, installed dependencies, Playwright artifacts, and agent context are excluded from generated projects and the npm package. For deployments without authentication, use `AUTH_DISABLED=true`.
+The Google and Auth.js values shipped in `.env.example` are intentionally public, limited development credentials. Replace all of them before production use. Nested Git repositories, caches, installed dependencies, Playwright artifacts, agent context, the local `.env`, and every non-canonical `.env*` file are excluded from generated projects and the npm package. For checks without authentication, use `AUTH_DISABLED=true`.
 
 ## Quality
 
@@ -349,6 +356,13 @@ pnpm run check
 
 Validation covers formatting, linting, TypeScript, Vitest, the Next.js build, and the rendering contract. Use `npm pack --dry-run --json` to inspect the CLI's distributable contents.
 
+The template source keeps one official `bun.lock`. npm and pnpm create their
+manager-specific lockfiles only in consumer worktrees; `.prettierignore` keeps
+those generated locks outside formatting checks. The generated GitHub Actions
+workflow validates all three managers independently and runs its npm job without
+Bun installed. Explicit npm `allowScripts` and pnpm `allowBuilds` policies limit
+native install scripts to the four dependencies required by the toolchain.
+
 ## Development
 
 ```bash

package/dist/bin.bun.js

@@ -6849,6 +6849,7 @@ import path8 from "path";
 var TEMPLATE_DENY_NAMES = new Set([
   ".env",
   ".git",
+  ".gitignore",
   ".agent",
   ".cursor",
   ".next",
@@ -6860,7 +6861,7 @@ var TEMPLATE_DENY_NAMES = new Set([
 ]);
 function isDistributableTemplatePath(relativePath) {
   const segments = relativePath.split(path8.sep);
-  return !segments.some((segment) => TEMPLATE_DENY_NAMES.has(segment) || segment.endsWith(".tsbuildinfo") || segment === ".DS_Store");
+  return !segments.some((segment) => TEMPLATE_DENY_NAMES.has(segment) || segment.startsWith(".env") && segment !== ".env.example" || segment.endsWith(".tsbuildinfo") || segment === ".DS_Store");
 }
 async function templateManifest(root, fs) {
   const files = [];
@@ -6891,7 +6892,20 @@ async function templateManifest(root, fs) {
 }
 async function validateScaffoldTemplate(root, fs) {
   const manifest = await templateManifest(root, fs);
-  for (const required of ["package.json", "tsconfig.json"]) {
+  for (const required of [
+    "package.json",
+    "tsconfig.json",
+    ".env.example",
+    ".gitignore.template",
+    ".prettierignore",
+    "bun.lock",
+    "pnpm-workspace.yaml",
+    "vitest.config.ts",
+    path8.join("scripts", "audit.ts"),
+    path8.join("scripts", "package-manager.ts"),
+    path8.join("tests", "consumer", "validate-template.ts"),
+    path8.join(".github", "workflows", "quality.yml")
+  ]) {
     if (!manifest.includes(required)) {
       throw new CliError(`Required template file was not found: ${required}.`, {
         code: "TEMPLATE_MISSING",

package/dist/bin.node.js

@@ -2070,6 +2070,7 @@ import path8 from "path";
 var TEMPLATE_DENY_NAMES = /* @__PURE__ */ new Set([
   ".env",
   ".git",
+  ".gitignore",
   ".agent",
   ".cursor",
   ".next",
@@ -2082,7 +2083,7 @@ var TEMPLATE_DENY_NAMES = /* @__PURE__ */ new Set([
 function isDistributableTemplatePath(relativePath) {
   const segments = relativePath.split(path8.sep);
   return !segments.some(
-    (segment) => TEMPLATE_DENY_NAMES.has(segment) || segment.endsWith(".tsbuildinfo") || segment === ".DS_Store"
+    (segment) => TEMPLATE_DENY_NAMES.has(segment) || segment.startsWith(".env") && segment !== ".env.example" || segment.endsWith(".tsbuildinfo") || segment === ".DS_Store"
   );
 }
 async function templateManifest(root, fs) {
@@ -2114,7 +2115,20 @@ async function templateManifest(root, fs) {
 }
 async function validateScaffoldTemplate(root, fs) {
   const manifest = await templateManifest(root, fs);
-  for (const required of ["package.json", "tsconfig.json"]) {
+  for (const required of [
+    "package.json",
+    "tsconfig.json",
+    ".env.example",
+    ".gitignore.template",
+    ".prettierignore",
+    "bun.lock",
+    "pnpm-workspace.yaml",
+    "vitest.config.ts",
+    path8.join("scripts", "audit.ts"),
+    path8.join("scripts", "package-manager.ts"),
+    path8.join("tests", "consumer", "validate-template.ts"),
+    path8.join(".github", "workflows", "quality.yml")
+  ]) {
     if (!manifest.includes(required)) {
       throw new CliError(`Required template file was not found: ${required}.`, {
         code: "TEMPLATE_MISSING",