create-next-pro-cli 0.1.30 → 0.1.32

package/templates/Projects/default/package.json

@@ -28,11 +28,12 @@
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
     "lucide-react": "1.24.0",
-    "next": "16.2.10",
-    "next-auth": "5.0.0-beta.31",
+    "next": "16.2.11",
+    "next-auth": "5.0.0-beta.32",
     "next-intl": "4.13.2",
     "react": "19.2.7",
     "react-dom": "19.2.7",
+    "sharp": "0.35.3",
     "simple-icons": "16.26.0",
     "tailwind-merge": "3.6.0",
     "tailwindcss-animate": "1.0.7"
@@ -43,15 +44,16 @@
     "@types/node": "24.13.3",
     "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
-    "eslint": "9.39.4",
-    "eslint-config-next": "16.2.10",
+    "eslint": "9.39.5",
+    "eslint-config-next": "16.2.11",
     "prettier": "3.9.5",
     "tailwindcss": "4.3.3",
     "typescript": "6.0.3",
     "vitest": "4.1.10"
   },
   "overrides": {
-    "postcss": "8.5.15"
+    "postcss": "8.5.23",
+    "sharp": "0.35.3"
   },
   "allowScripts": {
     "@parcel/watcher": true,

package/templates/Projects/default/pnpm-workspace.yaml

@@ -4,4 +4,5 @@ allowBuilds:
   sharp: true
   unrs-resolver: true
 overrides:
-  postcss: 8.5.15
+  postcss: 8.5.23
+  sharp: 0.35.3

package/templates/Projects/default/scripts/audit-policy.ts

@@ -0,0 +1,376 @@
+import { createHash } from "node:crypto";
+
+import type { PackageManager } from "./package-manager.ts";
+
+export interface AuditFinding {
+  advisoryId: string;
+  packageName: string;
+  severity: string;
+  paths: string[];
+  devOnly: boolean | null;
+}
+
+export interface NormalizedAuditReport {
+  manager: PackageManager;
+  findings: AuditFinding[];
+  graphPackages: string[];
+  graphPaths: string[];
+}
+
+export interface AuditManifest {
+  name?: string;
+  dependencies?: Record<string, string>;
+  devDependencies?: Record<string, string>;
+}
+
+export interface AuditPolicyContext {
+  now: Date;
+  manifest: AuditManifest;
+  bunWhy?: string;
+}
+
+export interface AuditPolicyDecision {
+  accepted: boolean;
+  allowedAdvisories: string[];
+  errors: string[];
+}
+
+interface TemporaryAuditException {
+  advisoryId: string;
+  packageName: string;
+  justification: string;
+  expiresOn: string;
+  dependencyRoots: string[];
+  npm: {
+    packageCount: number;
+    packageFingerprint: string;
+    pathCount: number;
+    pathFingerprint: string;
+  };
+  pnpm: {
+    pathCount: number;
+    pathFingerprint: string;
+  };
+  bun: {
+    graphFingerprint: string;
+  };
+  rootBun: {
+    projectName: string;
+    dependencyRoots: string[];
+    graphFingerprint: string;
+  };
+}
+
+export const TEMPORARY_AUDIT_EXCEPTION: TemporaryAuditException = {
+  advisoryId: "GHSA-mh99-v99m-4gvg",
+  packageName: "brace-expansion",
+  justification:
+    "The vulnerable version is reachable only from ESLint development tooling, and no compatible upstream ESLint plugin release is available.",
+  expiresOn: "2026-08-08",
+  dependencyRoots: ["eslint", "eslint-config-next"],
+  npm: {
+    packageCount: 9,
+    packageFingerprint:
+      "5c2f95af65c41494d74ca588887b735d7f53598759c1f4a550a534118ef9e21c",
+    pathCount: 9,
+    pathFingerprint:
+      "266ffc5bacefb7aba510ab245573622ec8a47d32ce6408bfd4c3560f698fd589",
+  },
+  pnpm: {
+    pathCount: 82,
+    pathFingerprint:
+      "135eeca335243a379f1c232df59dd641cd9d1684de814d4eac9105ded322e30f",
+  },
+  bun: {
+    graphFingerprint:
+      "bb8a9e09875f4a36186f4b43b8035cd6baa47b35a2614cd1e110b4129692cc62",
+  },
+  rootBun: {
+    projectName: "create-next-pro-cli",
+    dependencyRoots: ["eslint", "typescript-eslint", "tsup"],
+    graphFingerprint:
+      "9526795395c1d3983bb9d8fbcfce098103420ebe6f48169ab3fb4acc8f3aa769",
+  },
+};
+
+function asRecord(value: unknown, label: string): Record<string, unknown> {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`Invalid ${label} in audit JSON.`);
+  }
+  return value as Record<string, unknown>;
+}
+
+function asArray(value: unknown, label: string): unknown[] {
+  if (!Array.isArray(value)) throw new Error(`Invalid ${label} in audit JSON.`);
+  return value;
+}
+
+function asString(value: unknown, label: string): string {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`Invalid ${label} in audit JSON.`);
+  }
+  return value;
+}
+
+function strings(value: unknown, label: string): string[] {
+  return asArray(value, label).map((entry) => asString(entry, label));
+}
+
+function advisoryIdFromUrl(value: unknown): string {
+  const url = asString(value, "advisory URL");
+  const match = /\/(GHSA-[a-z0-9-]+)$/i.exec(url);
+  if (!match) throw new Error(`Unsupported advisory URL: ${url}.`);
+  return match[1];
+}
+
+function parseJsonPayload(output: string): Record<string, unknown> {
+  const start = output.indexOf("{");
+  const end = output.lastIndexOf("}");
+  if (start < 0 || end < start)
+    throw new Error("Audit output contains no JSON object.");
+  try {
+    return asRecord(JSON.parse(output.slice(start, end + 1)), "audit report");
+  } catch (error) {
+    if (error instanceof SyntaxError)
+      throw new Error("Audit output contains invalid JSON.");
+    throw error;
+  }
+}
+
+function deduplicateFindings(findings: AuditFinding[]): AuditFinding[] {
+  const unique = new Map<string, AuditFinding>();
+  for (const finding of findings) {
+    const key = `${finding.advisoryId}:${finding.packageName}`;
+    const previous = unique.get(key);
+    if (!previous) {
+      unique.set(key, {
+        ...finding,
+        paths: [...new Set(finding.paths)].sort(),
+      });
+      continue;
+    }
+    previous.paths = [...new Set([...previous.paths, ...finding.paths])].sort();
+    previous.devOnly = previous.devOnly === true && finding.devOnly === true;
+  }
+  return [...unique.values()].sort((left, right) =>
+    left.advisoryId.localeCompare(right.advisoryId),
+  );
+}
+
+function parseBunReport(root: Record<string, unknown>): NormalizedAuditReport {
+  const findings: AuditFinding[] = [];
+  for (const [packageName, advisories] of Object.entries(root)) {
+    for (const entry of asArray(
+      advisories,
+      `Bun advisories for ${packageName}`,
+    )) {
+      const advisory = asRecord(entry, `Bun advisory for ${packageName}`);
+      findings.push({
+        advisoryId: advisoryIdFromUrl(advisory.url),
+        packageName,
+        severity: asString(advisory.severity, "Bun advisory severity"),
+        paths: [],
+        devOnly: null,
+      });
+    }
+  }
+  return {
+    manager: "bun",
+    findings: deduplicateFindings(findings),
+    graphPackages: Object.keys(root).sort(),
+    graphPaths: [],
+  };
+}
+
+function parseNpmReport(root: Record<string, unknown>): NormalizedAuditReport {
+  const vulnerabilities = asRecord(root.vulnerabilities, "npm vulnerabilities");
+  const findings: AuditFinding[] = [];
+  const graphPaths: string[] = [];
+  for (const [packageName, value] of Object.entries(vulnerabilities)) {
+    const vulnerability = asRecord(
+      value,
+      `npm vulnerability for ${packageName}`,
+    );
+    const nodes = strings(vulnerability.nodes, `npm nodes for ${packageName}`);
+    graphPaths.push(...nodes);
+    for (const viaEntry of asArray(
+      vulnerability.via,
+      `npm via for ${packageName}`,
+    )) {
+      if (typeof viaEntry === "string") continue;
+      const advisory = asRecord(viaEntry, `npm advisory for ${packageName}`);
+      findings.push({
+        advisoryId: advisoryIdFromUrl(advisory.url),
+        packageName: asString(advisory.dependency, "npm advisory dependency"),
+        severity: asString(advisory.severity, "npm advisory severity"),
+        paths: nodes,
+        devOnly: null,
+      });
+    }
+  }
+  return {
+    manager: "npm",
+    findings: deduplicateFindings(findings),
+    graphPackages: Object.keys(vulnerabilities).sort(),
+    graphPaths: [...new Set(graphPaths)].sort(),
+  };
+}
+
+function parsePnpmReport(root: Record<string, unknown>): NormalizedAuditReport {
+  const advisories = asRecord(root.advisories, "pnpm advisories");
+  const findings: AuditFinding[] = [];
+  for (const value of Object.values(advisories)) {
+    const advisory = asRecord(value, "pnpm advisory");
+    const paths: string[] = [];
+    let devOnly = true;
+    for (const entry of asArray(advisory.findings, "pnpm findings")) {
+      const finding = asRecord(entry, "pnpm finding");
+      paths.push(...strings(finding.paths, "pnpm finding paths"));
+      devOnly = devOnly && finding.dev === true;
+    }
+    findings.push({
+      advisoryId: asString(advisory.github_advisory_id, "pnpm advisory ID"),
+      packageName: asString(advisory.module_name, "pnpm advisory package"),
+      severity: asString(advisory.severity, "pnpm advisory severity"),
+      paths,
+      devOnly,
+    });
+  }
+  const normalized = deduplicateFindings(findings);
+  return {
+    manager: "pnpm",
+    findings: normalized,
+    graphPackages: normalized.map((finding) => finding.packageName).sort(),
+    graphPaths: normalized.flatMap((finding) => finding.paths).sort(),
+  };
+}
+
+export function normalizeAuditReport(
+  manager: PackageManager,
+  output: string,
+): NormalizedAuditReport {
+  const root = parseJsonPayload(output);
+  if (manager === "bun") return parseBunReport(root);
+  if (manager === "npm") return parseNpmReport(root);
+  return parsePnpmReport(root);
+}
+
+function fingerprint(values: string[]): string {
+  return createHash("sha256")
+    .update([...new Set(values)].sort().join("\n"))
+    .digest("hex");
+}
+
+function isDevelopmentOnly(
+  manifest: AuditManifest,
+  packageName: string,
+): boolean {
+  return (
+    Object.hasOwn(manifest.devDependencies ?? {}, packageName) &&
+    !Object.hasOwn(manifest.dependencies ?? {}, packageName)
+  );
+}
+
+function normalizedBunGraph(output: string): string {
+  return output
+    .replace(/\u001b\[[0-9;]*m/g, "")
+    .replace(/dev [^\s(]+/g, "dev <project>")
+    .replaceAll("\r\n", "\n")
+    .trim();
+}
+
+function validateManagerEvidence(
+  report: NormalizedAuditReport,
+  context: AuditPolicyContext,
+): string[] {
+  const policy = TEMPORARY_AUDIT_EXCEPTION;
+  if (report.manager === "pnpm") {
+    const finding = report.findings[0];
+    if (!finding.devOnly) return ["The pnpm advisory is not development-only."];
+    if (
+      report.graphPaths.length !== policy.pnpm.pathCount ||
+      fingerprint(report.graphPaths) !== policy.pnpm.pathFingerprint
+    ) {
+      return [
+        "The pnpm advisory dependency paths do not match the approved graph.",
+      ];
+    }
+    return [];
+  }
+
+  if (report.manager === "npm") {
+    if (
+      report.graphPackages.length !== policy.npm.packageCount ||
+      fingerprint(report.graphPackages) !== policy.npm.packageFingerprint ||
+      report.graphPaths.length !== policy.npm.pathCount ||
+      fingerprint(report.graphPaths) !== policy.npm.pathFingerprint
+    ) {
+      return [
+        "The npm advisory dependency graph does not match the approved graph.",
+      ];
+    }
+    return [];
+  }
+
+  const projectName = context.manifest.name;
+  if (!projectName || !context.bunWhy) {
+    return ["Bun audit policy requires the project name and dependency graph."];
+  }
+  const graphFingerprint = createHash("sha256")
+    .update(normalizedBunGraph(context.bunWhy))
+    .digest("hex");
+  const expectedFingerprint =
+    projectName === policy.rootBun.projectName
+      ? policy.rootBun.graphFingerprint
+      : policy.bun.graphFingerprint;
+  if (graphFingerprint !== expectedFingerprint) {
+    return [
+      "The Bun advisory dependency graph does not match the approved graph.",
+    ];
+  }
+  return [];
+}
+
+export function evaluateAuditPolicy(
+  report: NormalizedAuditReport,
+  context: AuditPolicyContext,
+): AuditPolicyDecision {
+  if (report.findings.length === 0) {
+    return { accepted: true, allowedAdvisories: [], errors: [] };
+  }
+
+  const policy = TEMPORARY_AUDIT_EXCEPTION;
+  const errors: string[] = [];
+  const currentDate = context.now.toISOString().slice(0, 10);
+  if (currentDate > policy.expiresOn) {
+    errors.push(`The audit exception expired on ${policy.expiresOn}.`);
+  }
+  if (
+    report.findings.length !== 1 ||
+    report.findings[0].advisoryId !== policy.advisoryId ||
+    report.findings[0].packageName !== policy.packageName
+  ) {
+    errors.push(
+      "The audit contains an advisory that is not explicitly allowed.",
+    );
+  }
+  const dependencyRoots =
+    report.manager === "bun" &&
+    context.manifest.name === policy.rootBun.projectName
+      ? policy.rootBun.dependencyRoots
+      : policy.dependencyRoots;
+  for (const dependencyRoot of dependencyRoots) {
+    if (!isDevelopmentOnly(context.manifest, dependencyRoot)) {
+      errors.push(`${dependencyRoot} is not confined to devDependencies.`);
+    }
+  }
+  if (errors.length === 0) {
+    errors.push(...validateManagerEvidence(report, context));
+  }
+
+  return {
+    accepted: errors.length === 0,
+    allowedAdvisories: errors.length === 0 ? [policy.advisoryId] : [],
+    errors,
+  };
+}

package/templates/Projects/default/scripts/audit.ts

@@ -1,4 +1,73 @@
-import { resolvePackageManager, runPackageManager } from "./package-manager.ts";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
 
-const manager = resolvePackageManager();
-await runPackageManager(manager, ["audit"]);
+import {
+  evaluateAuditPolicy,
+  normalizeAuditReport,
+  TEMPORARY_AUDIT_EXCEPTION,
+} from "./audit-policy.ts";
+import {
+  capturePackageManager,
+  resolvePackageManager,
+} from "./package-manager.ts";
+
+async function runAudit(): Promise<void> {
+  const manager = resolvePackageManager();
+  const root = process.cwd();
+  const manifest = JSON.parse(
+    await readFile(path.join(root, "package.json"), "utf8"),
+  ) as {
+    name?: string;
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+  };
+  const audit = await capturePackageManager(manager, ["audit", "--json"], {
+    cwd: root,
+  });
+  if (audit.exitCode !== 0 && audit.exitCode !== 1) {
+    throw new Error(
+      `${manager} audit failed${audit.signal ? ` with signal ${audit.signal}` : ` with exit code ${audit.exitCode ?? "unknown"}`}: ${audit.stderr.trim() || "no diagnostic was provided"}`,
+    );
+  }
+
+  const report = normalizeAuditReport(manager, audit.stdout);
+  let bunWhy: string | undefined;
+  if (manager === "bun" && report.findings.length > 0) {
+    const why = await capturePackageManager(
+      manager,
+      ["why", TEMPORARY_AUDIT_EXCEPTION.packageName, "--depth", "20"],
+      { cwd: root },
+    );
+    if (why.exitCode !== 0) {
+      throw new Error(
+        `bun why failed with exit code ${why.exitCode ?? "unknown"}: ${why.stderr.trim() || "no diagnostic was provided"}`,
+      );
+    }
+    bunWhy = why.stdout;
+  }
+
+  const decision = evaluateAuditPolicy(report, {
+    now: new Date(),
+    manifest,
+    bunWhy,
+  });
+  if (!decision.accepted) {
+    throw new Error(`Security audit rejected: ${decision.errors.join(" ")}`);
+  }
+  if (decision.allowedAdvisories.length === 0) {
+    process.stdout.write(`Security audit passed for ${manager}.\n`);
+    return;
+  }
+  process.stdout.write(
+    `Security audit passed for ${manager} with temporary development-only exception ${TEMPORARY_AUDIT_EXCEPTION.advisoryId} (${TEMPORARY_AUDIT_EXCEPTION.packageName}); expires ${TEMPORARY_AUDIT_EXCEPTION.expiresOn}.\n`,
+  );
+}
+
+try {
+  await runAudit();
+} catch (error) {
+  process.stderr.write(
+    `${error instanceof Error ? error.message : String(error)}\n`,
+  );
+  process.exitCode = 1;
+}

package/templates/Projects/default/scripts/package-manager.ts

@@ -66,3 +66,40 @@ export function runPackageManager(
     });
   });
 }
+
+export interface PackageManagerCommandResult {
+  exitCode: number | null;
+  signal: NodeJS.Signals | null;
+  stdout: string;
+  stderr: string;
+}
+
+export function capturePackageManager(
+  manager: PackageManager,
+  args: string[],
+  options: { cwd?: string; env?: NodeJS.ProcessEnv } = {},
+): Promise<PackageManagerCommandResult> {
+  return new Promise((resolve, reject) => {
+    const executable = packageManagerExecutable(manager);
+    const child = spawn(executable, args, {
+      cwd: options.cwd,
+      env: options.env ?? process.env,
+      shell: false,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdout.on("data", (chunk: string) => {
+      stdout += chunk;
+    });
+    child.stderr.on("data", (chunk: string) => {
+      stderr += chunk;
+    });
+    child.once("error", reject);
+    child.once("close", (exitCode, signal) => {
+      resolve({ exitCode, signal, stdout, stderr });
+    });
+  });
+}

package/templates/Projects/default/tests/consumer/validate-template.ts

@@ -17,9 +17,11 @@ const gitignoreSource = await stat(path.join(root, ".gitignore.template")).then(
   () => ".gitignore",
 );
 const entries = [
+  [".agents", ".agents"],
   [".env.example", ".env.example"],
   [gitignoreSource, ".gitignore"],
   [".prettierignore", ".prettierignore"],
+  ["AGENTS.md", "AGENTS.md"],
   ["README.md", "README.md"],
   ["bun.lock", "bun.lock"],
   ["eslint.config.mjs", "eslint.config.mjs"],

package/templates/Projects/default/tests/unit/audit-policy.test.ts

@@ -0,0 +1,152 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  evaluateAuditPolicy,
+  normalizeAuditReport,
+  type AuditManifest,
+  type NormalizedAuditReport,
+} from "../../scripts/audit-policy.ts";
+
+const npmGraphPackages = [
+  "@eslint/config-array",
+  "@eslint/eslintrc",
+  "brace-expansion",
+  "eslint",
+  "eslint-config-next",
+  "eslint-plugin-import",
+  "eslint-plugin-jsx-a11y",
+  "eslint-plugin-react",
+  "minimatch",
+];
+
+const npmGraphPaths = [
+  "node_modules/@eslint/config-array",
+  "node_modules/@eslint/eslintrc",
+  "node_modules/brace-expansion",
+  "node_modules/eslint",
+  "node_modules/eslint-config-next",
+  "node_modules/eslint-plugin-import",
+  "node_modules/eslint-plugin-jsx-a11y",
+  "node_modules/eslint-plugin-react",
+  "node_modules/minimatch",
+];
+
+const manifest: AuditManifest = {
+  name: "fixture",
+  dependencies: { next: "16.2.11" },
+  devDependencies: {
+    eslint: "9.39.5",
+    "eslint-config-next": "16.2.11",
+  },
+};
+
+function npmReport(): NormalizedAuditReport {
+  return {
+    manager: "npm",
+    findings: [
+      {
+        advisoryId: "GHSA-mh99-v99m-4gvg",
+        packageName: "brace-expansion",
+        severity: "high",
+        paths: ["node_modules/brace-expansion"],
+        devOnly: null,
+      },
+    ],
+    graphPackages: npmGraphPackages,
+    graphPaths: npmGraphPaths,
+  };
+}
+
+describe("temporary audit policy", () => {
+  test.each([
+    ["bun", "{}"],
+    ["npm", '{"vulnerabilities":{}}'],
+    ["pnpm", '{"advisories":{}}'],
+  ] as const)("normalizes a clean %s audit report", (manager, output) => {
+    expect(normalizeAuditReport(manager, output)).toEqual({
+      manager,
+      findings: [],
+      graphPackages: [],
+      graphPaths: [],
+    });
+  });
+
+  test("accepts only the pinned development dependency graph", () => {
+    expect(
+      evaluateAuditPolicy(npmReport(), {
+        now: new Date("2026-08-08T23:59:59.000Z"),
+        manifest,
+      }),
+    ).toEqual({
+      accepted: true,
+      allowedAdvisories: ["GHSA-mh99-v99m-4gvg"],
+      errors: [],
+    });
+  });
+
+  test("rejects the exception after its expiration date", () => {
+    const decision = evaluateAuditPolicy(npmReport(), {
+      now: new Date("2026-08-09T00:00:00.000Z"),
+      manifest,
+    });
+    expect(decision.accepted).toBe(false);
+    expect(decision.errors).toContain(
+      "The audit exception expired on 2026-08-08.",
+    );
+  });
+
+  test("rejects an unexpected dependency path", () => {
+    const report = npmReport();
+    report.graphPaths.push("node_modules/production/brace-expansion");
+    const decision = evaluateAuditPolicy(report, {
+      now: new Date("2026-07-25T00:00:00.000Z"),
+      manifest,
+    });
+    expect(decision.accepted).toBe(false);
+    expect(decision.errors).toContain(
+      "The npm advisory dependency graph does not match the approved graph.",
+    );
+  });
+
+  test("rejects a dependency root that enters production dependencies", () => {
+    const decision = evaluateAuditPolicy(npmReport(), {
+      now: new Date("2026-07-25T00:00:00.000Z"),
+      manifest: {
+        ...manifest,
+        dependencies: { eslint: "9.39.5" },
+      },
+    });
+    expect(decision.accepted).toBe(false);
+    expect(decision.errors).toContain(
+      "eslint is not confined to devDependencies.",
+    );
+  });
+
+  test("rejects invalid audit JSON", () => {
+    expect(() => normalizeAuditReport("bun", "not-json")).toThrow(
+      "Audit output contains no JSON object.",
+    );
+    expect(() => normalizeAuditReport("npm", "{broken}")).toThrow(
+      "Audit output contains invalid JSON.",
+    );
+  });
+
+  test("rejects every new advisory", () => {
+    const report = npmReport();
+    report.findings.push({
+      advisoryId: "GHSA-new-advisory",
+      packageName: "unexpected-package",
+      severity: "critical",
+      paths: ["node_modules/unexpected-package"],
+      devOnly: true,
+    });
+    const decision = evaluateAuditPolicy(report, {
+      now: new Date("2026-07-25T00:00:00.000Z"),
+      manifest,
+    });
+    expect(decision.accepted).toBe(false);
+    expect(decision.errors).toContain(
+      "The audit contains an advisory that is not explicitly allowed.",
+    );
+  });
+});