create-next-pro-cli 0.1.31 → 0.1.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-next-pro-cli",
-  "version": "0.1.31",
+  "version": "0.1.33",
   "description": "Advanced Next.js project scaffolder with i18n, Tailwind, App Router and more.",
   "repository": {
     "type": "git",
@@ -40,6 +40,7 @@
     "typecheck": "tsc --project tsconfig.json --noEmit",
     "language:check": "bun scripts/check-public-language.ts",
     "test": "bun test",
+    "audit": "bun templates/Projects/default/scripts/audit.ts",
     "clean": "rm -rf dist",
     "build": "bun run clean && bun run build:node && bun run build:bun && cp scripts/create-next-pro dist/create-next-pro && chmod +x dist/create-next-pro",
     "build:node": "tsup",
@@ -60,13 +61,13 @@
     ]
   },
   "overrides": {
-    "brace-expansion": "2.0.3",
+    "brace-expansion": "2.1.2",
     "esbuild": "0.28.1",
-    "fast-uri": "3.1.2",
+    "fast-uri": "3.1.4",
     "glob": "10.5.0",
-    "js-yaml": "5.2.1",
+    "js-yaml": "5.2.2",
     "picomatch": "4.0.5",
-    "postcss": "8.5.17",
+    "postcss": "8.5.23",
     "rollup": "4.62.2",
     "vite": "8.1.5"
   },

package/templates/Page/layout.tsx

@@ -1,11 +1,5 @@
-import React from "react";
+import type { ReactNode } from "react";
 
-export default function templateLayout({
-  children,
-  params,
-}: {
-  children: React.ReactNode;
-  params: { locale: string };
-}) {
+export default function templateLayout({ children }: { children: ReactNode }) {
   return children;
 }

package/templates/Page/page-ui.tsx

@@ -5,12 +5,12 @@ import BackButton from "@/ui/_global/BackButton";
 export default function template() {
   const t = useTranslations("template");
   return (
-    <main className="py-8 px-4 max-w-3xl mx-auto">
+    <main className="px-4 pb-8 pt-24 max-w-3xl mx-auto">
       <div className="flex items-center justify-between mb-6">
         <h1 className="text-2xl font-bold">{t("title")}</h1>
         <BackButton />
       </div>
-      <p className="text-muted mb-8">{t("description")}</p>
+      <p className="text-muted-foreground mb-8">{t("description")}</p>
       <section className="grid grid-cols-1 md:grid-cols-2 gap-6"></section>
     </main>
   );

package/templates/Page/page-ui.user.tsx

@@ -0,0 +1,17 @@
+"use client";
+import { useTranslations } from "next-intl";
+import BackButton from "@/ui/_global/BackButton";
+
+export default function template() {
+  const t = useTranslations("template");
+  return (
+    <section className="px-4 pb-8 pt-24 max-w-3xl mx-auto">
+      <div className="flex items-center justify-between mb-6">
+        <h1 className="text-2xl font-bold">{t("title")}</h1>
+        <BackButton />
+      </div>
+      <p className="text-muted-foreground mb-8">{t("description")}</p>
+      <section className="grid grid-cols-1 md:grid-cols-2 gap-6"></section>
+    </section>
+  );
+}

package/templates/Projects/default/.agents/skills/create-next-pro-addcomponent/SKILL.md

@@ -9,15 +9,15 @@ description: Add a global or page-scoped UI component to a generated create-next
 
 - Work from the generated project root containing `cnp.config.json`.
 - Use one safe component-name segment.
-- Use a simple or `Parent.Child` page scope when `--page` is present.
+- Use a simple or `Parent.Child` page scope when `--page` is present, and identify its existing route area explicitly.
 
 ## Command
 
 ```bash
-create-next-pro addcomponent <Component> [--page <Page|Parent.Child>] [--json]
+create-next-pro addcomponent <Component> [--page <Page|Parent.Child> --area <public|user>] [--json]
 ```
 
-`-P` is the short form of `--page`. The option requires a page name.
+`-P` is the short form of `--page`. The option requires a page name and `--area`. A global component must not receive `--area`. Area values are exact lowercase values and `--area=value` is not supported.
 
 ## Effects
 
@@ -26,17 +26,17 @@ Without `--page`, the command creates:
 - `src/ui/_global/<Component>.tsx`
 - a `<Component>` key in `messages/<locale>/_global_ui.json`
 
-With `--page Account.Security`, the command creates:
+With `--page Account.Security --area user`, the command first resolves exactly that page in the area-aware route catalog, then creates:
 
 - `src/ui/Account/Security/<Component>.tsx`
 - a `<Component>` key in the `Account.Security` translation namespace
 
-The component name is normalized to a TypeScript identifier. Existing component code and existing message keys are preserved and reported as `unchanged`.
+The component name is normalized to a TypeScript identifier. Existing component code and existing message keys are preserved and reported as `unchanged`. Missing pages return `TARGET_NOT_FOUND`; flat, unknown-group, or ambiguous routes return `INCONSISTENT_ROUTE` before any write.
 
 ## Workflow
 
 1. Decide whether the component is global or owned by one page.
-2. Verify the page scope and translation namespace when using `--page`.
+2. Verify the page scope, area, and translation namespace when using `--page`.
 3. Run the complete command with `--json`.
 4. Inspect the component and per-locale message events.
 5. Implement the component behavior and review all generated translations.
@@ -53,7 +53,7 @@ create-next-pro addcomponent Alert
 Create a component for a nested page:
 
 ```bash
-create-next-pro addcomponent PasswordForm --page Account.Security --json
+create-next-pro addcomponent PasswordForm --page Account.Security --area user --json
 ```
 
 ## Validate

package/templates/Projects/default/.agents/skills/create-next-pro-addpage/SKILL.md

@@ -9,14 +9,17 @@ description: Add a simple or Parent.Child page to a generated create-next-pro pr
 
 - Work from the generated project root containing `cnp.config.json`.
 - Use a safe logical page name with one segment or exactly `Parent.Child`.
-- Inspect the requested route and UI scope before generating files.
+- Choose the route area explicitly: `public` uses the public layout, while `user` uses the authenticated user layout.
+- Inspect the requested route and UI scope before generating files. A logical page name can belong to only one area.
 
 ## Command
 
 ```bash
-create-next-pro addpage <Page|Parent.Child> [options] [--json]
+create-next-pro addpage <Page|Parent.Child> --area <public|user> [options] [--json]
 ```
 
+`--area` accepts only the exact lowercase values `public` and `user`. It may appear before or after the page name, but it cannot be repeated or written as `--area=value`. With no page name, human mode asks for both the name and area; JSON mode requires both explicitly.
+
 With no file options, the command selects `layout`, `page`, and `loading`.
 
 | Long option      | Short option | Generated route file |
@@ -35,18 +38,22 @@ Short options can be combined, for example `-PLl`. Unknown options fail with `IN
 
 ## Effects
 
-For `Account.Security`, expect resources under:
+For `Account.Security --area user`, expect resources under:
 
-- `src/app/[locale]/Account/Security/`
+- `src/app/[locale]/(user)/Account/Security/`
 - `src/ui/Account/Security/page-ui.tsx`
 - `messages/<locale>/Account.json` at the `Security` namespace
 - `messages/<locale>.ts` when the message file needs registration
 
-The command creates only missing code files and preserves existing ones as `unchanged`. It prepares all required templates and locale updates before writing.
+The route area affects only the App Router path and layout. UI and message paths remain area-independent. Public page UI uses its own `<main>` landmark; user page UI uses `<section>` because the user layout already provides `<main>`.
+
+The generated page-level `layout.tsx` accepts only `children` because it does not read route parameters. If you customize it to read the locale under Next.js 16, make the component asynchronous, type `params` as `Promise<{ locale: string }>` and await it before use.
+
+The command creates only missing code files and preserves existing ones as `unchanged`. Repeating the command in the same area is idempotent and can add requested missing route files. Requesting the same logical page in the other area fails with `TARGET_EXISTS`. Flat historical routes or ambiguous route definitions fail with `INCONSISTENT_ROUTE` before any write.
 
 ## Workflow
 
-1. Select the logical page name and only the required route file options.
+1. Select the logical page name, area, and only the required route file options.
 2. Run the command with `--json`.
 3. Inspect route, UI, translation, and aggregator events separately.
 4. Review every generated UI and route file.
@@ -58,19 +65,19 @@ The command creates only missing code files and preserves existing ones as `unch
 Create the default page resources:
 
 ```bash
-create-next-pro addpage Profile
+create-next-pro addpage Profile --area public
 ```
 
 Create only `page.tsx`, `layout.tsx`, and the page UI for a nested page:
 
 ```bash
-create-next-pro addpage Account.Security -PL --json
+create-next-pro addpage Account.Security --area user -PL --json
 ```
 
 Create an error and not-found boundary:
 
 ```bash
-create-next-pro addpage Checkout --error --not-found --json
+create-next-pro addpage Checkout --area public --error --not-found --json
 ```
 
 ## Validate
@@ -82,3 +89,5 @@ bun run check
 ```
 
 Confirm every `created` or `updated` event path exists. A repeated command should preserve existing code and normally report those resources as `unchanged`.
+
+When a generated or customized layout reads route parameters, include `next build` in validation so Next.js checks the inferred `LayoutProps` contract.

package/templates/Projects/default/.agents/skills/create-next-pro-rmpage/SKILL.md

@@ -9,16 +9,17 @@ description: Remove a catalogued page and its associated route, UI, and message
 
 - Work from the generated project root containing `cnp.config.json`.
 - Confirm the target is a page that contains an actual `page.tsx` and appears in the CLI page catalog.
+- Confirm whether the page belongs to the `public` or `user` route area.
 - Review uncommitted work and references to the route before deletion.
 - Use a simple logical name or `Parent.Child`, never a filesystem path.
 
 ## Command
 
 ```bash
-create-next-pro rmpage [Page|Parent.Child] [--json]
+create-next-pro rmpage [Page|Parent.Child] [--area <public|user>] [--json]
 ```
 
-Without a name, human mode displays an autocomplete tree and asks for confirmation. JSON mode requires the explicit page name and never prompts.
+With a page name, `--area` is required. Without a name, human mode displays an autocomplete tree grouped as `Public > ...` and `User > ...`, then asks for confirmation. Passing only `--area` filters that menu. JSON mode requires the explicit page name and area and never prompts. Area values are exact lowercase values and `--area=value` is not supported.
 
 ## Effects
 
@@ -29,11 +30,11 @@ The command can remove:
 - a top-level locale JSON file and its aggregator registration; or
 - only the nested message key for `Parent.Child`.
 
-The page catalog excludes technical directories and routes without `page.tsx`. Resolution and deletion remain confined to the project. Shared parents and unrelated files are preserved.
+The page catalog excludes technical directories and routes without `page.tsx`. Resolution uses the exact `{area, logicalName}` pair and deletion remains confined to the project. Shared parents and unrelated files are preserved. Flat historical routes, unknown route groups, and ambiguous route definitions fail with `INCONSISTENT_ROUTE` and are never deleted automatically.
 
 ## Workflow
 
-1. Discover the target with human autocomplete or confirm its logical name from the project structure.
+1. Discover the target with the area-aware human autocomplete or confirm its logical name and area from the project structure.
 2. Inspect references, navigation entries, tests, and uncommitted changes that may depend on the page.
 3. Prefer an explicit name with `--json` for agentic deletion.
 4. Require a successful result and inspect every `deleted`, `updated`, and `unchanged` event.
@@ -52,7 +53,7 @@ create-next-pro rmpage
 Remove a nested page non-interactively:
 
 ```bash
-create-next-pro rmpage Account.Security --json
+create-next-pro rmpage Account.Security --area user --json
 ```
 
 ## Validate
@@ -63,4 +64,4 @@ bun run check
 # or: pnpm run check
 ```
 
-Treat `TARGET_NOT_FOUND` as a request or state mismatch. Do not substitute a filesystem deletion command, and do not infer deletion from exit code alone.
+Treat `TARGET_NOT_FOUND` as a request or state mismatch. Treat `INCONSISTENT_ROUTE` as a request for manual route inspection, not permission to remove a flat or ambiguous route. Do not substitute a filesystem deletion command, and do not infer deletion from exit code alone.

package/templates/Projects/default/.github/workflows/quality.yml

@@ -42,7 +42,6 @@ jobs:
             pnpm install --no-frozen-lockfile
           fi
       - run: ${{ matrix.manager }} run check
-      - run: ${{ matrix.manager }} run audit
       - name: Validate an isolated consumer
         env:
           CNP_PACKAGE_MANAGER: ${{ matrix.manager }}
@@ -53,3 +52,5 @@ jobs:
       - name: Run visual integration tests without Bun
         if: matrix.manager == 'npm'
         run: npm run test:e2e
+      - name: Run blocking security audit
+        run: ${{ matrix.manager }} run audit

package/templates/Projects/default/AGENTS.md

@@ -51,21 +51,22 @@ Do not commit an additional lockfile unless the project has intentionally change
 - Use `.env.example` as the public development contract. Create a local file with `cp .env.example .env`, then replace credentials for production.
 - Use `--force` only after resolving and inspecting the exact destination. It deletes the existing child destination before scaffolding.
 - Pass logical names, not filesystem paths. Names use safe dot-separated segments such as `account.security`; never pass absolute paths, slashes, empty segments, or `..`.
+- Select `--area public` or `--area user` explicitly for page creation, direct page removal, and page-scoped components. A route area controls the layout and authorization boundary without changing the public URL.
 - Preserve existing source files. The add commands report existing resources as `unchanged` instead of overwriting them.
-- Use `rmpage` only for a page returned by the CLI page catalog, and inspect deletion events before making follow-up edits.
+- Use `rmpage` only for a page returned by the area-aware CLI page catalog, and inspect deletion events before making follow-up edits.
 
 ## CLI operations
 
 | Operation        | Purpose                                                         | Skill                                                                                       |
 | ---------------- | --------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
 | Create a project | Scaffold the complete Next.js project in a new child directory. | [`$create-next-pro-create-project`](.agents/skills/create-next-pro-create-project/SKILL.md) |
-| `addpage`        | Add a route, page UI, and localized message resources.          | [`$create-next-pro-addpage`](.agents/skills/create-next-pro-addpage/SKILL.md)               |
-| `addcomponent`   | Add a global or page-scoped UI component and messages.          | [`$create-next-pro-addcomponent`](.agents/skills/create-next-pro-addcomponent/SKILL.md)     |
+| `addpage`        | Add an explicitly zoned route, page UI, and localized messages. | [`$create-next-pro-addpage`](.agents/skills/create-next-pro-addpage/SKILL.md)               |
+| `addcomponent`   | Add a global or area-qualified page component and messages.     | [`$create-next-pro-addcomponent`](.agents/skills/create-next-pro-addcomponent/SKILL.md)     |
 | `addlib`         | Add a library directory or a library module and export.         | [`$create-next-pro-addlib`](.agents/skills/create-next-pro-addlib/SKILL.md)                 |
 | `addapi`         | Add an App Router API route handler.                            | [`$create-next-pro-addapi`](.agents/skills/create-next-pro-addapi/SKILL.md)                 |
 | `addlanguage`    | Copy and register a new locale that must then be translated.    | [`$create-next-pro-addlanguage`](.agents/skills/create-next-pro-addlanguage/SKILL.md)       |
 | `addtext`        | Set one translation path across all configured locales.         | [`$create-next-pro-addtext`](.agents/skills/create-next-pro-addtext/SKILL.md)               |
-| `rmpage`         | Remove a catalogued page and its associated resources safely.   | [`$create-next-pro-rmpage`](.agents/skills/create-next-pro-rmpage/SKILL.md)                 |
+| `rmpage`         | Remove one area-qualified page and its resources safely.        | [`$create-next-pro-rmpage`](.agents/skills/create-next-pro-rmpage/SKILL.md)                 |
 
 ## Global options
 
@@ -75,6 +76,13 @@ Do not commit an additional lockfile unless the project has intentionally change
 - `--help`: display public command help.
 - `--version` or `-v`: display the CLI version.
 
+## Page-area option
+
+- `--area public`: target the public route group and layout.
+- `--area user`: target the authenticated user route group and layout.
+- The option is required for direct `addpage`, direct `rmpage`, and `addcomponent --page` commands. It is rejected for global components.
+- Do not infer an area from a page name or persist one as a project-wide default.
+
 ## Finish every mutation
 
 1. Inspect the CLI result and all changed paths.

package/templates/Projects/default/README.md

@@ -101,6 +101,18 @@ skills under `.agents/skills` document project creation and every public
 with `--json`, inspect all reported events and complete every required next
 step before running the project checks.
 
+Page operations use explicit route areas. Pass `--area public` or `--area user`
+to direct `addpage` and `rmpage` commands and to `addcomponent --page`. The
+interactive page flows expose the same area-aware catalog. Areas select a route
+layout without changing the public URL; see the linked command skills for the
+complete contract.
+
+Page-level layouts generated by the CLI accept only `children` when they do not
+read route parameters. A customized Next.js 16 layout that reads the locale must
+type `params` as `Promise<{ locale: string }>` and await it. Projects created
+with `create-next-pro-cli@0.1.32` should remove the obsolete synchronous
+`params` property when unused, or migrate it to this asynchronous contract.
+
 ## Template Features
 
 - Next.js 16 App Router