create-next-pro-cli 0.1.28 → 0.1.30

package/README.md

@@ -71,13 +71,16 @@ cd my-app
 Then install dependencies with your preferred package manager:
 
 ```bash
-bun install && bun run dev
+bun install && cp .env.example .env && bun run dev
 # or
-npm install && npm run dev
+npm install && cp .env.example .env && npm run dev
 # or
-pnpm install && pnpm run dev
+pnpm install && cp .env.example .env && pnpm run dev
 ```
 
+The creation result reports `.env.example` explicitly and provides the same
+local-development commands in both human and JSON output.
+
 An existing destination is rejected by default. `--force` only permits replacement of the requested child destination:
 
 ```bash
@@ -130,6 +133,9 @@ The Next.js route and its interface are separate: `src/app` owns routing while `
 ```text
 my-app/
 ├── .env.example
+├── .gitignore
+├── .prettierignore
+├── bun.lock
 ├── cnp.config.json
 ├── messages/
 │   ├── en/
@@ -183,11 +189,15 @@ my-app/
 │   ├── e2e/
 │   ├── rendering/
 │   └── unit/
+├── scripts/
+│   ├── audit.ts
+│   └── package-manager.ts
 ├── next.config.ts
 ├── package.json
 ├── playwright.config.ts
 ├── pnpm-workspace.yaml
-└── tsconfig.json
+├── tsconfig.json
+└── vitest.config.ts
 ```
 
 Template working files (`.env`, the nested Git repository, caches, screenshots, and test results) are not copied into generated projects. The CLI creates `cnp.config.json` with the project name and selected alias.
@@ -322,13 +332,13 @@ Interactive input is never attempted in JSON mode. Pass every required argument
 
 ## Environment and security
 
-Generated projects contain `.env.example`, never the template's local `.env`. Copy it before configuring Auth.js:
+Generated projects contain only the canonical `.env.example`, never the template's local `.env` or other environment copies. Copy it before configuring Auth.js:
 
 ```bash
-cp .env.example .env.local
+cp .env.example .env
 ```
 
-OAuth credentials, nested Git repositories, caches, installed dependencies, Playwright artifacts, and agent context are excluded from generated projects and the npm package. For deployments without authentication, use `AUTH_DISABLED=true`.
+The Google and Auth.js values shipped in `.env.example` are intentionally public, limited development credentials. Replace all of them before production use. Nested Git repositories, caches, installed dependencies, Playwright artifacts, agent context, the local `.env`, and every non-canonical `.env*` file are excluded from generated projects and the npm package. For checks without authentication, use `AUTH_DISABLED=true`.
 
 ## Quality
 
@@ -349,6 +359,13 @@ pnpm run check
 
 Validation covers formatting, linting, TypeScript, Vitest, the Next.js build, and the rendering contract. Use `npm pack --dry-run --json` to inspect the CLI's distributable contents.
 
+The template source keeps one official `bun.lock`. npm and pnpm create their
+manager-specific lockfiles only in consumer worktrees; `.prettierignore` keeps
+those generated locks outside formatting checks. The generated GitHub Actions
+workflow validates all three managers independently and runs its npm job without
+Bun installed. Explicit npm `allowScripts` and pnpm `allowBuilds` policies limit
+native install scripts to the four dependencies required by the toolchain.
+
 ## Development
 
 ```bash

package/dist/bin.bun.js

@@ -6849,6 +6849,7 @@ import path8 from "path";
 var TEMPLATE_DENY_NAMES = new Set([
   ".env",
   ".git",
+  ".gitignore",
   ".agent",
   ".cursor",
   ".next",
@@ -6860,7 +6861,7 @@ var TEMPLATE_DENY_NAMES = new Set([
 ]);
 function isDistributableTemplatePath(relativePath) {
   const segments = relativePath.split(path8.sep);
-  return !segments.some((segment) => TEMPLATE_DENY_NAMES.has(segment) || segment.endsWith(".tsbuildinfo") || segment === ".DS_Store");
+  return !segments.some((segment) => TEMPLATE_DENY_NAMES.has(segment) || segment.startsWith(".env") && segment !== ".env.example" || segment.endsWith(".tsbuildinfo") || segment === ".DS_Store");
 }
 async function templateManifest(root, fs) {
   const files = [];
@@ -6891,7 +6892,20 @@ async function templateManifest(root, fs) {
 }
 async function validateScaffoldTemplate(root, fs) {
   const manifest = await templateManifest(root, fs);
-  for (const required of ["package.json", "tsconfig.json"]) {
+  for (const required of [
+    "package.json",
+    "tsconfig.json",
+    ".env.example",
+    ".gitignore.template",
+    ".prettierignore",
+    "bun.lock",
+    "pnpm-workspace.yaml",
+    "vitest.config.ts",
+    path8.join("scripts", "audit.ts"),
+    path8.join("scripts", "package-manager.ts"),
+    path8.join("tests", "consumer", "validate-template.ts"),
+    path8.join(".github", "workflows", "quality.yml")
+  ]) {
     if (!manifest.includes(required)) {
       throw new CliError(`Required template file was not found: ${required}.`, {
         code: "TEMPLATE_MISSING",
@@ -7046,6 +7060,17 @@ async function createProjectFromOptions(options, context) {
         message: "Run the generated project checks before development.",
         paths: [{ scope: "project", path: "package.json" }],
         commands: ["bun run check", "npm run check", "pnpm run check"]
+      },
+      {
+        kind: "run",
+        required: false,
+        message: "To run the project locally, copy the development environment example and start the development server.",
+        paths: [{ scope: "project", path: ".env.example" }],
+        commands: [
+          `cd ${options.projectName} && cp .env.example .env && bun run dev`,
+          `cd ${options.projectName} && cp .env.example .env && npm run dev`,
+          `cd ${options.projectName} && cp .env.example .env && pnpm run dev`
+        ]
       }
     ],
     data: {

package/dist/bin.node.js

@@ -2070,6 +2070,7 @@ import path8 from "path";
 var TEMPLATE_DENY_NAMES = /* @__PURE__ */ new Set([
   ".env",
   ".git",
+  ".gitignore",
   ".agent",
   ".cursor",
   ".next",
@@ -2082,7 +2083,7 @@ var TEMPLATE_DENY_NAMES = /* @__PURE__ */ new Set([
 function isDistributableTemplatePath(relativePath) {
   const segments = relativePath.split(path8.sep);
   return !segments.some(
-    (segment) => TEMPLATE_DENY_NAMES.has(segment) || segment.endsWith(".tsbuildinfo") || segment === ".DS_Store"
+    (segment) => TEMPLATE_DENY_NAMES.has(segment) || segment.startsWith(".env") && segment !== ".env.example" || segment.endsWith(".tsbuildinfo") || segment === ".DS_Store"
   );
 }
 async function templateManifest(root, fs) {
@@ -2114,7 +2115,20 @@ async function templateManifest(root, fs) {
 }
 async function validateScaffoldTemplate(root, fs) {
   const manifest = await templateManifest(root, fs);
-  for (const required of ["package.json", "tsconfig.json"]) {
+  for (const required of [
+    "package.json",
+    "tsconfig.json",
+    ".env.example",
+    ".gitignore.template",
+    ".prettierignore",
+    "bun.lock",
+    "pnpm-workspace.yaml",
+    "vitest.config.ts",
+    path8.join("scripts", "audit.ts"),
+    path8.join("scripts", "package-manager.ts"),
+    path8.join("tests", "consumer", "validate-template.ts"),
+    path8.join(".github", "workflows", "quality.yml")
+  ]) {
     if (!manifest.includes(required)) {
       throw new CliError(`Required template file was not found: ${required}.`, {
         code: "TEMPLATE_MISSING",
@@ -2320,6 +2334,17 @@ async function createProjectFromOptions(options, context) {
         message: "Run the generated project checks before development.",
         paths: [{ scope: "project", path: "package.json" }],
         commands: ["bun run check", "npm run check", "pnpm run check"]
+      },
+      {
+        kind: "run",
+        required: false,
+        message: "To run the project locally, copy the development environment example and start the development server.",
+        paths: [{ scope: "project", path: ".env.example" }],
+        commands: [
+          `cd ${options.projectName} && cp .env.example .env && bun run dev`,
+          `cd ${options.projectName} && cp .env.example .env && npm run dev`,
+          `cd ${options.projectName} && cp .env.example .env && pnpm run dev`
+        ]
       }
     ],
     data: {