create-next-style-guide 0.1.2 → 0.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-next-style-guide",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Scaffold a Next.js app with next-style-guide conventions",
   "license": "MIT",
   "type": "module",

package/template/.env.example

@@ -1,6 +1,16 @@
+# Local / development — copy to `.env`
+#   cp .env.example .env
+#
+# Other templates: `.env.staging.example`, `.env.production.example`
+
 # Public app URL (browser)
 NEXT_PUBLIC_APP_URL=http://localhost:3000
 
-# Django / API origin (server + optional browser proxy)
-API_URL=http://localhost:8000
+# API origin (server + client)
 NEXT_PUBLIC_API_URL=http://localhost:8000
+
+# Optional server-only API origin (if you proxy and keep secrets off the client)
+# API_URL=http://localhost:8000
+
+# Auth.js (only when auth=authjs was enabled at scaffold)
+# AUTH_SECRET=

package/template/.env.production.example

@@ -0,0 +1,11 @@
+# Production — do not copy secrets into git.
+# Set these in Vercel / Docker / your host secret manager.
+
+NEXT_PUBLIC_APP_URL=https://example.com
+NEXT_PUBLIC_API_URL=https://api.example.com
+
+# API_URL=https://api.example.com
+
+# Auth.js — required in production when authjs is enabled
+# AUTH_SECRET=
+# Generate: openssl rand -base64 32

package/template/.env.staging.example

@@ -0,0 +1,12 @@
+# Staging — copy to `.env.staging` (or inject via your host / CI)
+#   cp .env.staging.example .env.staging
+#
+# Never commit real secrets. Prefer the host’s secret store.
+
+NEXT_PUBLIC_APP_URL=https://staging.example.com
+NEXT_PUBLIC_API_URL=https://api.staging.example.com
+
+# API_URL=https://api.staging.example.com
+
+# Auth.js
+# AUTH_SECRET=

package/template/README.md

@@ -21,8 +21,11 @@ Next.js App Router app generated with [next-style-guide](https://github.com/alid
 
 ```bash
 cp .env.example .env
+# Staging / production templates: .env.staging.example · .env.production.example
 __PACKAGE_MANAGER__ install
 __PACKAGE_MANAGER__ dev
 ```
 
+Env docs: [`docs/style-guide/ops/env.md`](docs/style-guide/ops/env.md)
+
 App: [http://localhost:3000](http://localhost:3000)

package/template/docs/style-guide/ops/env.md

@@ -0,0 +1,23 @@
+# Environment
+
+Validated public env lives in `src/lib/env.ts` (`NEXT_PUBLIC_*` only).
+
+## Templates
+
+| File | Use |
+|------|-----|
+| `.env.example` | Local development → copy to `.env` |
+| `.env.staging.example` | Staging values / CI staging |
+| `.env.production.example` | Production checklist (set on the host) |
+
+```bash
+cp .env.example .env
+```
+
+`.env`, `.env.local`, `.env.*.local` are gitignored. `*.example` files are safe to commit.
+
+## Rules
+
+1. Browser-visible values must use the `NEXT_PUBLIC_` prefix.
+2. Secrets (e.g. `AUTH_SECRET`) never go in `NEXT_PUBLIC_*` or client bundles.
+3. Staging/production: prefer the host secret store over committed `.env` files.

package/template/docs/style-guide/overview/architecture.md

@@ -18,4 +18,4 @@ src/hooks/ · types/ · constants/
 2. **Colocate by usage** — one route → that route's `_components/`; two+ routes → `src/components/`.
 3. **Server first** — prefer RSC; `"use client"` only at the leaves that need interactivity.
 4. **One HTTP doorway** — `src/lib/http.ts` and/or generated `src/endpoints/*` (when enabled). Avoid ad-hoc `fetch` in UI.
-5. **Split server cache vs UI state** — TanStack Query for server/async cache; Zustand/Redux for client UI/session state only.
+5. **Split server cache vs UI state** — When both are enabled: **TanStack Query** owns server/async cache (lists, refetch, mutations). **Zustand/Redux** owns client-only UI/session flags. Do not mirror API lists into the store.

package/template/gitignore

@@ -32,8 +32,10 @@ yarn-error.log*
 
 # env
 .env
+.env.*
 .env*.local
 !.env.example
+!.env.*.example
 
 # vercel
 .vercel