create-projx 1.7.1 → 1.7.2

package/dist/{baseline-FKCXQFRD.js → baseline-ZPPJKHBN.js}

@@ -8,8 +8,8 @@ import {
   matchesSkip,
   saveBaselineRef,
   writeTemplateToDir
-} from "./chunk-N4WD4VN3.js";
-import "./chunk-OLPF7FAN.js";
+} from "./chunk-XAYCVTHL.js";
+import "./chunk-FQPOK3QZ.js";
 export {
   BASELINE_REF,
   applyTemplate,

package/dist/{chunk-OLPF7FAN.js → chunk-FQPOK3QZ.js}

@@ -223,6 +223,7 @@ async function copyStaticFiles(repoDir, dest) {
   }
   const staticScripts = [
     "ci-local.sh",
+    "check-bundle-size.sh",
     "setup-docker.sh",
     "setup-ssl.sh",
     "style-check.py"
@@ -343,6 +344,7 @@ var DEFAULT_ROOT_SKIP_PATTERNS = [
   ".githooks/pre-commit",
   ".github/workflows/ci.yml",
   "scripts/ci-local.sh",
+  "scripts/check-bundle-size.sh",
   "scripts/setup.sh",
   "scripts/setup-docker.sh",
   "scripts/setup-ssl.sh"
@@ -394,10 +396,15 @@ function render(template, vars) {
 function evalExpr(expr, vars) {
   const components = vars.components;
   const projectName = vars.projectName;
-  const pmName = vars.pm?.name ?? "npm";
+  if (vars.pm !== void 0 && typeof vars.pm !== "object") {
+    throw new Error(
+      `render: vars.pm must be a PmCommands object (got ${typeof vars.pm}). Templates use pm.exec, pm.name etc.; passing the package-manager name as a bare string silently breaks those references.`
+    );
+  }
+  const pm = typeof vars.pm === "object" && vars.pm !== null ? vars.pm : { name: "npm" };
   const orm = vars.orm ?? "prisma";
   const argNames = ["components", "projectName", "pm", "orm"];
-  const argValues = [components, projectName, pmName, orm];
+  const argValues = [components, projectName, pm, orm];
   for (const [k, v] of Object.entries(vars)) {
     if (["components", "projectName", "pm", "orm"].includes(k)) continue;
     if (!/^[a-zA-Z_$][\w$]*$/.test(k)) continue;

package/dist/{chunk-N4WD4VN3.js → chunk-XAYCVTHL.js}

@@ -13,7 +13,7 @@ import {
   toSnake,
   upsertComponentMarker,
   writeProjxConfig
-} from "./chunk-OLPF7FAN.js";
+} from "./chunk-FQPOK3QZ.js";
 
 // src/baseline.ts
 import { existsSync, writeFileSync, unlinkSync } from "fs";
@@ -126,7 +126,7 @@ function generateVscodeSettings(vars) {
 // src/baseline.ts
 var BASELINE_REF = "refs/projx/baseline";
 async function migrateComponentMarkers(cwd, components, componentPaths, applyDefaults) {
-  const { readComponentMarker: readComponentMarker2, writeComponentMarker } = await import("./utils-4G3HNHES.js");
+  const { readComponentMarker: readComponentMarker2, writeComponentMarker } = await import("./utils-MC7VKL2U.js");
   for (const component of components) {
     const dir = componentPaths[component];
     const markerDir = join2(cwd, dir);

package/dist/index.js

@@ -9,7 +9,7 @@ import {
   matchesSkip,
   saveBaselineRef,
   writeTemplateToDir
-} from "./chunk-N4WD4VN3.js";
+} from "./chunk-XAYCVTHL.js";
 import {
   COMPONENTS,
   COMPONENT_MARKER,
@@ -36,7 +36,7 @@ import {
   toSnake,
   writeComponentMarker,
   writeProjxConfig
-} from "./chunk-OLPF7FAN.js";
+} from "./chunk-FQPOK3QZ.js";
 
 // src/index.ts
 import { existsSync as existsSync11 } from "fs";
@@ -851,7 +851,7 @@ function hasUncommittedChanges(cwd) {
 async function findPinnedFilesWithUpdates(cwd, repoDir, components, componentPaths, vars, version, componentSkips, rootSkip) {
   const { mkdtemp: mkdtemp2, rm: rm2, readFile: readFile8 } = await import("fs/promises");
   const { tmpdir: tmpdir2 } = await import("os");
-  const { writeTemplateToDir: writeTemplateToDir2 } = await import("./baseline-FKCXQFRD.js");
+  const { writeTemplateToDir: writeTemplateToDir2 } = await import("./baseline-ZPPJKHBN.js");
   const config = await readProjxConfig(cwd);
   const rootPinned = Array.isArray(config.skip) ? config.skip : [];
   const componentPinned = [];

package/dist/{utils-4G3HNHES.js → utils-MC7VKL2U.js}

@@ -35,7 +35,7 @@ import {
   upsertComponentMarker,
   writeComponentMarker,
   writeProjxConfig
-} from "./chunk-OLPF7FAN.js";
+} from "./chunk-FQPOK3QZ.js";
 export {
   COMPONENTS,
   COMPONENT_MARKER,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-projx",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "Scaffold production-grade fullstack projects in seconds. FastAPI, Fastify, Express, React, Flutter, Terraform — with auth, database, CI/CD, E2E tests, and Docker. One command, ready to deploy.",
   "type": "module",
   "bin": {

package/src/templates/ci.yml.ejs

@@ -123,7 +123,7 @@ jobs:
         run: |
           run_pip_audit() {
             for attempt in 1 2 3; do
-              if uv run pip-audit --ignore-vuln CVE-2026-3219; then
+              if uv run pip-audit --ignore-vuln CVE-2026-3219 --ignore-vuln PYSEC-2025-183; then
                 return 0
               fi
               if [ "$attempt" -eq 3 ]; then
@@ -163,15 +163,15 @@ jobs:
       JWT_SECRET: ci-test-secret # gitleaks:allow
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-<% if (pm === 'pnpm') { %>
+<% if (pm.name === 'pnpm') { %>
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10
 <% } %>
-<% if (pm === 'bun') { %>
+<% if (pm.name === 'bun') { %>
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 <% } %>
-<% if (pm !== 'bun') { %>
+<% if (pm.name !== 'bun') { %>
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
@@ -196,7 +196,7 @@ jobs:
 <% for (const inst of expressInstances) { %>
 
   <%= inst.path %>:
-    name: <%= inst.display %> (format + lint + typecheck + build + test + audit)
+    name: <%= inst.display %> (format + lint + typecheck + build + audit)
     needs: changes
     if: github.event_name == 'workflow_dispatch' || needs.changes.outputs.<%= inst.path %> == 'true'
     runs-on: ubuntu-latest
@@ -221,15 +221,15 @@ jobs:
       DATABASE_URL: postgresql://postgres:postgres@localhost:5432/ci_test
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-<% if (pm === 'pnpm') { %>
+<% if (pm.name === 'pnpm') { %>
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10
 <% } %>
-<% if (pm === 'bun') { %>
+<% if (pm.name === 'bun') { %>
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 <% } %>
-<% if (pm !== 'bun') { %>
+<% if (pm.name !== 'bun') { %>
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
@@ -249,7 +249,6 @@ jobs:
       - run: <%= pm.exec %> eslint .
       - run: <%= pm.exec %> tsc --noEmit
       - run: <%= pm.run %> build
-      - run: <%= pm.exec %> vitest run --coverage.enabled=false
       - run: <%= pm.audit %>
 <% } %>
 <% for (const inst of frontendInstances) { %>
@@ -264,15 +263,15 @@ jobs:
         working-directory: <%= inst.path %>
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-<% if (pm === 'pnpm') { %>
+<% if (pm.name === 'pnpm') { %>
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10
 <% } %>
-<% if (pm === 'bun') { %>
+<% if (pm.name === 'bun') { %>
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 <% } %>
-<% if (pm !== 'bun') { %>
+<% if (pm.name !== 'bun') { %>
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
@@ -321,15 +320,15 @@ jobs:
         working-directory: <%= inst.path %>
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-<% if (pm === 'pnpm') { %>
+<% if (pm.name === 'pnpm') { %>
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10
 <% } %>
-<% if (pm === 'bun') { %>
+<% if (pm.name === 'bun') { %>
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 <% } %>
-<% if (pm !== 'bun') { %>
+<% if (pm.name !== 'bun') { %>
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22

package/src/templates/pre-commit.ejs

@@ -135,9 +135,21 @@ fi
 <%= inst.upper %>_TF=$(echo "$STAGED_FILES" | grep '^<%= inst.path %>/.*\.tf$' || true)
 if [ -n "$<%= inst.upper %>_TF" ]; then
   if command -v terraform &> /dev/null; then
-    echo "Formatting <%= inst.path %>..."
+    echo "Checking <%= inst.path %>..."
     cd <%= inst.path %>/stack
     echo "$<%= inst.upper %>_TF" | sed 's|^<%= inst.path %>/stack/||' | xargs terraform fmt
+    [ -d .terraform ] || terraform init -backend=false -input=false >/dev/null
+    terraform validate
+    if command -v tflint &> /dev/null; then
+      tflint --recursive
+    else
+      echo "Skipping tflint (not installed)"
+    fi
+    if command -v trivy &> /dev/null; then
+      trivy config --exit-code 1 --severity HIGH,CRITICAL .
+    else
+      echo "Skipping trivy config scan (not installed)"
+    fi
     cd ../..
     echo "$<%= inst.upper %>_TF" | xargs git add
   else