chore(release): v1.2.0

.github/dependabot.yml

@@ -21,12 +21,13 @@ updates:
 
   # The project templates. Every dependency in them ships in each scaffolded
   # project, so an update is a fix and releases a patch. Ranges are raised to
-  # the new version. Updates arrive as at most three pull requests for all
+  # the new version. Updates arrive as at most two pull requests for all
   # templates together (a dependency joins the first group it matches):
-  #   - pp-dev on its own;
-  #   - every other minor and patch update;
-  #   - every other major update, separately, since those can need changes to
-  #     the templates.
+  #   - pp-dev on its own, since its bump is usually made by hand with the
+  #     release that needs it;
+  #   - everything else in one group. A split by update type did not hold:
+  #     with ranges raised rather than versions pinned, Dependabot filed
+  #     minor and patch bumps under the "major" group (#356).
   - package-ecosystem: 'npm'
     directories: ['/template-*']
     target-branch: 'develop'
@@ -41,10 +42,6 @@ updates:
         patterns: ['@metricinsights/pp-dev']
       templates:
         patterns: ['*']
-        update-types: ['minor', 'patch']
-      templates-major:
-        patterns: ['*']
-        update-types: ['major']
     ignore:
       # TypeScript 7 conflicts with the typescript-eslint peer range
       # (>=4.8.4 <6.1.0) in the templates and here. Remove this once

.github/mi-examples-workflows.json

@@ -8,7 +8,11 @@
   ],
   "inputs": {
     "ci": {
-      "dist-dir": "dist"
+      "dist-dir": "dist",
+      "audit-command": "npm run audit:all"
+    },
+    "dependency-audit": {
+      "audit-command": "npm run audit:all"
     }
   }
 }

.github/workflows/ci.yml

@@ -24,3 +24,4 @@ jobs:
     uses: mi-examples/mi-examples-workflows/.github/workflows/node-ci.yml@75e92a129ce7adbf059e73e83ce9e14222e7c7a2 # v0.10.0
     with:
       dist-dir: "dist"
+      audit-command: "npm run audit:all"

.github/workflows/dependency-audit.yml

@@ -21,3 +21,5 @@ jobs:
     permissions:
       contents: read
     uses: mi-examples/mi-examples-workflows/.github/workflows/dependency-audit.yml@75e92a129ce7adbf059e73e83ce9e14222e7c7a2 # v0.10.0
+    with:
+      audit-command: "npm run audit:all"

.prettierignore

@@ -4,3 +4,7 @@ template-*
 *.tgz
 package-lock.json
 CHANGELOG.md
+# analysis notes in prose, not code
+docs
+# generated by mi-examples-workflows and Dependabot; formatted by their generators
+.github

.prettierrc.cjs

@@ -4,4 +4,6 @@ module.exports = {
   singleQuote: true,
   trailingComma: 'all',
   printWidth: 120,
+  // the checkout is CRLF on Windows (core.autocrlf) and LF in git; check the style, not the line ending
+  endOfLine: 'auto',
 };

CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## [1.2.0](https://github.com/mi-examples/create-pp-dev/compare/v1.1.7...v1.2.0) (2026-11-10)
+
+### Features
+
+- Added `--help` to print usage with every flag, the template list and examples, and `--version` to print the package version.
+- `--yes` now works and asks nothing: it uses the default project name, derives the package name from the directory, installs packages and skips Cursor rules and `@metricinsights/pp-components`. It requires `--template`.
+- The CLI can run without a terminal. It never prompts, and if any required flag is missing it exits with code 1 before writing anything, listing all of the missing flags.
+
+### Bug fixes
+
+- Unknown flags and flags missing a value now exit with code 1 and point to `--help`. Previously they were silently accepted.
+- An unknown template or an invalid `--package-name` is now reported before the target directory is touched, so existing files are no longer deleted.
+- A failed package install now exits with code 1 instead of reporting "Project created successfully!", and the scaffolded files are kept.
+- With `--yes`, a non-empty target directory is only accepted when nothing in it would be overwritten, including template files and existing `.cursor/rules/*.mdc` files; otherwise the run stops and lists the conflicting files.
+- Adding `@metricinsights/pp-components` no longer crashes when the registry is unreachable: the lookup times out, writes `^1.0.0` and prints a warning.
+- The registry warning and error text no longer print credentials embedded in the registry URL.
+- A filesystem root such as `C:\` as the target is no longer turned into the current directory.
+- The generated `.gitignore` now ignores `.env` and `.env.*` (keeping `.env.example`), so `MI_ACCESS_TOKEN` is no longer committed by accident; the Next.js templates also ignore `dist`, `dist-zip` and `backups`.
+- The Next.js templates now import their logos and favicon as static assets, so they load under both `pp-dev next` and the exported build instead of returning 404 in development.
+- The Next.js templates ship the `tsconfig.json` values Next 16 writes on first run, so a new project's `tsconfig.json` is no longer modified by `pp-dev next`.
+- The `vanilla-ts` template's `tsconfig.node.json` no longer references a `vite.config.ts` that doesn't exist.
+
+### Other changes
+
+- The Next.js templates now use `next` and `eslint-config-next` 16.4.5, which fixes two critical remote code execution advisories and a high-severity denial-of-service advisory present in 16.3.8.
+- The templates now require `@metricinsights/pp-dev` `^1.5.1`. With this version, `pp-dev generate-icon-font` needs `svgtofont` installed in the project (`npm install --save-dev svgtofont`).
+- The templates pin `minimatch` in both `overrides` and `resolutions` to clear a denial-of-service advisory with npm, yarn and pnpm alike.
+- Updated the template dependencies, including `react` and `react-dom` 19.3.1, `vite`, `@vitejs/plugin-react`, `eslint`, `prettier`, `globals` and `typescript-eslint`.
+- The MI Cursor rule copied into new projects now describes `pp-dev` 1.5 (commands, config sections with defaults, Next.js base paths and dev server) instead of an outdated copy of its README.
+- The package's `license` field now correctly says MIT.
+
 ## [1.1.7](https://github.com/mi-examples/create-pp-dev/compare/v1.1.6...v1.1.7) (2026-10-22)
 
 ### Bug fixes

CLAUDE.md

@@ -0,0 +1,53 @@
+# create-pp-dev — Claude Code Instructions
+
+## What this project is
+
+`@metricinsights/create-pp-dev` is the scaffolder behind `npm create @metricinsights/pp-dev`: a small CLI that copies one of five templates into a new directory, rewrites its `package.json` name and optionally copies the MI Cursor rules, adds `@metricinsights/pp-components` and runs the install. Every template depends on `@metricinsights/pp-dev`, the local development framework for Metric Insights Portal Pages.
+
+## Essential commands
+
+```bash
+npm run build          # unbuild src/index.ts -> dist/index.mjs, then pack to <name>-latest.tgz
+npm run lint           # eslint (the templates are linted by their own configs, not here)
+npm run typecheck      # tsc --noEmit
+npm run format:check   # prettier --check (templates, CHANGELOG and docs are ignored)
+npm test               # builds, then the Playwright suite: scaffolds and installs the templates (minutes)
+npx playwright test --grep @offline   # the quick subset: no network, under half a minute
+```
+
+The templates have no lockfiles in the repository (`.gitignore`, `scripts/clean-templates.js`), so a plain `npm audit` covers the package itself only. `npm run audit:all` audits the root and every template (each template is resolved in a temporary directory with `npm install --package-lock-only`); the shared CI runs it on pull requests and weekly. A high or critical advisory without a fix goes into the shared `audit-allowlist.json` in mi-examples-workflows with a reason and an `until` date, never into this repository.
+
+`overrides` in the root and in every template `package.json` pin transitive packages whose fixed version no dependency asks for yet: `minimatch` (GHSA-g3hv-75wg-m249, fixed in 11.0.1; eslint and typescript-eslint still ask for 10.x). A scaffolded project carries them. The templates used to pin `glob` as well (GHSA-3g3m-2fjr-6pw4, through `svgtofont` behind pp-dev); pp-dev 1.5.1 made `svgtofont` an optional peer dependency, so that chain is gone and the pin with it. In the templates every pin is written twice, with the same value: `overrides` is what npm reads, `resolutions` is what yarn and pnpm read (each ignores the other field; checked with pnpm 10 and yarn 1.22, which resolve minimatch 10 without `resolutions`). Change both together; a test compares them. Dependabot maintains neither, so when a template dependency moves on, remove the entry from both and check that `npm run audit:all` stays clean.
+
+## Layout
+
+```
+index.js                 — bin: imports dist/index.mjs
+src/index.ts             — the whole CLI: parseArgs, prompts (@clack/prompts), copy, install
+scripts/clean-templates.js — prepack: removes template-*/node_modules and lockfiles (see the comment there)
+scripts/postbuild.js     — packs the tarball and keeps <name>-latest.tgz
+template-nextjs/         — Next.js (CommonJS next.config.js), pp-dev next
+template-nextjs-esm/     — Next.js ("type": "module")
+template-react/          — React + Vite
+template-vanilla/        — Vite, JavaScript
+template-vanilla-ts/     — Vite, TypeScript
+mi-cursor-rules/         — copied into a new project's .cursor/rules on request
+test/scaffold.spec.mjs   — Playwright as a test runner (no browser): runs dist/index.mjs and npm
+.github/                 — generated shared-workflow callers; settings in mi-examples-workflows.json
+```
+
+Template conventions: `_gitignore` is renamed to `.gitignore` on copy (npm would drop a `.gitignore` from the package); `package.json#name` is replaced with the project name; the pp-dev config ships with `mi.url` and `app.id` commented out.
+
+## Key conventions
+
+- **Every template ships to users.** A change to a template's dependencies or config is a `fix` and should be released soon after merging; keep the five templates on the same `@metricinsights/pp-dev` range and the same ESLint/Prettier rules.
+- **The CLI must work without a terminal.** Every prompt has a flag; with stdin not a TTY and no flag, exit 1 with a hint. `--yes` takes the defaults. Validate the flags before touching the disk.
+- **Tests run the built CLI.** `pretest` runs unbuild; tests that need the registry are not tagged `@offline`, failures of the registry are simulated with `npm_config_registry=http://127.0.0.1:9`.
+- **Line endings.** The checkout uses `core.autocrlf=true` on Windows: files are CRLF in the working tree and LF in git. Scripts that edit files must not assume LF.
+- Change only the code the task needs; check what else uses the code you change.
+
+## Commits, PRs, releases
+
+- Commit messages follow Conventional Commits, `<type>(<scope>): <subject>` — types, scopes and the release process are in `CONTRIBUTING.md`. `fix`, `perf` and `revert` release a patch, `feat` a minor.
+- PR descriptions follow `.cursor/rules/pr-message-format.mdc` (🚀 features, 🔧 fixes, 🔐 security, 🧪 tests, 🧹 chore). Copilot review is requested automatically.
+- Releases use the shared release flow (betas from `develop`, production through `release/vX.Y.Z → main`); tags and `CHANGELOG.md` are written by the workflow. Never create a tag by hand.

CONTRIBUTING.md

@@ -0,0 +1,75 @@
+# Contributing to create-pp-dev
+
+## Commit Message Convention
+
+We follow the [Conventional Commits](https://www.conventionalcommits.org/) specification. The commit messages decide the version of the next release and become its changelog.
+
+### Commit Message Format
+
+```
+<type>(<scope>): <description>
+
+[optional body]
+
+[optional footer]
+```
+
+- imperative mood ("add", not "added"), lower-case start, no period at the end;
+- the body says what and why, not how;
+- a breaking change gets a `!` after the type/scope or a `BREAKING CHANGE:` footer.
+
+### Types
+
+- `feat`: a new feature (a new template, a new CLI flag)
+- `fix`: a bug fix; also a dependency bump in a template or in the CLI's runtime dependencies, since that ships to every new project
+- `docs`: documentation only
+- `style`: formatting, no change in meaning
+- `refactor`: a code change that neither fixes a bug nor adds a feature
+- `perf`: a performance improvement
+- `test`: adding or correcting tests
+- `chore`: tooling, development dependencies, repository upkeep
+- `ci`: the GitHub workflows and Dependabot configuration
+
+### Scopes
+
+- `cli` — `src/index.ts`
+- `templates` — a change across templates; `react`, `nextjs`, `vanilla`, `vanilla-ts` for one of them
+- `deps` — dependency updates
+- `rules` — `mi-cursor-rules/`
+- `test`, `docs`, `release`
+
+### Examples
+
+```
+fix(cli): report a failed npm install and exit 1
+fix(deps): bump @metricinsights/pp-dev to ^1.5.0 in the templates
+feat(templates): add a Vue template
+docs(readme): document the non-interactive flags
+test: cover the CLI error paths
+```
+
+## Release Process
+
+Releases use the shared workflows from [mi-examples-workflows](https://github.com/mi-examples/mi-examples-workflows) ([release flow](https://github.com/mi-examples/mi-examples-workflows/blob/main/docs/workflows.md#release-workflows)). The caller is [`.github/workflows/release.yml`](.github/workflows/release.yml).
+
+- **Betas.** Every push to `develop` with releasable commits publishes `X.Y.Z-beta.N` to npm under the `beta` dist-tag, with a GitHub prerelease. Try one with `npm create @metricinsights/pp-dev@beta`.
+- **Production releases.**
+  1. Run **Actions → Release → Run workflow**. It opens a release pull request `release/vX.Y.Z → main` with the version bump and the new `CHANGELOG.md` entry.
+  2. Review and edit the entry in the pull request, then merge it (merge commit, not squash).
+  3. Merging publishes to npm under `latest` and creates the tag and the GitHub release. It also opens the back-merge pull request into `develop`.
+- **Versions** come from the commit messages (see above):
+  - `feat` → minor;
+  - `fix`, `perf` and `revert` → patch;
+  - `!` or a `BREAKING CHANGE:` footer → major;
+  - other types don't release.
+- **Tags and `CHANGELOG.md`** are written by the workflow. Don't create tags by hand and don't edit the changelog outside a release pull request.
+- **Publishing** uses npm Trusted Publishing (OIDC) from `release.yml` in the `npm-publish` environment. No npm token is needed or stored. Don't rename `release.yml`: the trusted publisher is registered for that filename.
+- **`main` ahead of `develop`.** After a production release the back-merge pull request `main → develop` opens automatically. Until it is merged, the "Main ahead check" fails pull requests into `develop` and re-runs them once `develop` contains `main` again.
+- **CI and release callers** are generated from `.github/mi-examples-workflows.json`. To change a CI setting, edit that file and run `npx github:mi-examples/mi-examples-workflows`; don't edit the callers by hand.
+
+## Pull Requests
+
+- Branch from `develop`; pull requests go into `develop`. Only release pull requests go into `main`.
+- The PR description follows `.cursor/rules/pr-message-format.mdc` (summary, key changes, testing, included commits).
+- Copilot review is requested automatically by the organisation's ruleset.
+- Dependency updates to the templates ship in every new project: a template bump is a `fix(deps)` and should be released soon after it is merged.