Prefer pnpm for init and typegen

.changeset/npm-pnpm-warning.md

@@ -0,0 +1,5 @@
+---
+"@proofkit/cli": patch
+---
+
+Prefer pnpm when npm invokes scaffolding and warn npm fallback users to use pnpm 11+.

.changeset/package-manager-dev-engines.md

@@ -0,0 +1,5 @@
+---
+"@proofkit/cli": patch
+---
+
+Use devEngines packageManager in generated apps.

.changeset/typegen-exec-command.md

@@ -0,0 +1,5 @@
+---
+"@proofkit/cli": patch
+---
+
+Use package-manager exec command in generated typegen scripts.

packages/cli/src/cli/init.ts

@@ -126,6 +126,13 @@ type ProofKitPackageJSON = PackageJson & {
   proofkitMetadata?: {
     initVersion: string;
   };
+  devEngines?: {
+    packageManager: {
+      name: string;
+      version: string;
+      onFail: "download";
+    };
+  };
 };
 
 const missingTypegenCommandPatterns = [
@@ -286,7 +293,14 @@ export const runInit = async (name?: string, opts?: CliFlags) => {
     const { stdout } = await execa(pkgManager, ["-v"], {
       cwd: projectDir,
     });
-    pkgJson.packageManager = `${pkgManager}@${stdout.trim()}`;
+    pkgJson.packageManager = undefined;
+    pkgJson.devEngines = {
+      packageManager: {
+        name: pkgManager,
+        version: `^${stdout.trim()}`,
+        onFail: "download",
+      },
+    };
   }
 
   fs.writeJSONSync(path.join(projectDir, "package.json"), pkgJson, {

packages/cli/src/core/executeInitPlan.ts

@@ -30,6 +30,8 @@ const chalk = new Chalk({ level: 1 });
 const formatCommand = (command: string) => chalk.cyan(command);
 const formatHeading = (heading: string) => chalk.bold(heading);
 const formatPath = (value: string) => chalk.yellow(value);
+const NPM_PACKAGE_MANAGER_WARNING =
+  "Warning: We strongly suggest using PNPM 11 or greater as your package manager to better protect your computer and your app.";
 
 function renderNextSteps(plan: InitPlan, additionalSteps: string[] = []) {
   const lines = [
@@ -48,6 +50,10 @@ function renderNextSteps(plan: InitPlan, additionalSteps: string[] = []) {
     );
   }
 
+  if (plan.request.packageManager === "npm") {
+    lines.push("", chalk.yellow(NPM_PACKAGE_MANAGER_WARNING));
+  }
+
   lines.push("", formatHeading("Start the app:"), `  ${formatCommand(`${plan.packageManagerCommand} dev`)}`);
 
   if (plan.request.appType === "webviewer") {
@@ -242,6 +248,22 @@ export const executeInitPlan = (plan: InitPlan) =>
           cause,
         }),
     });
+    yield* Effect.tryPromise({
+      try: () =>
+        replaceTextInFiles(
+          projectFilesFs,
+          plan.targetDir,
+          "__PNPM_EXECUTE_COMMAND__",
+          plan.packageManagerExecuteCommand,
+        ),
+      catch: (cause) =>
+        new FileSystemError({
+          message: "Unable to rewrite scaffold placeholders.",
+          operation: "replaceTextInFiles",
+          path: plan.targetDir,
+          cause,
+        }),
+    });
     yield* Effect.tryPromise({
       try: () => replaceTextInFiles(projectFilesFs, plan.targetDir, "__PACKAGE_MANAGER__", plan.request.packageManager),
       catch: (cause) =>

packages/cli/src/core/planInit.ts

@@ -9,7 +9,12 @@ import {
   getTypegenVersion,
   getVersion,
 } from "~/utils/getProofKitVersion.js";
-import { formatPackageManagerCommand, getScaffoldVersion, getTemplatePackageCommand } from "~/utils/projectFiles.js";
+import {
+  formatPackageManagerCommand,
+  getScaffoldVersion,
+  getTemplatePackageCommand,
+  getTemplatePackageExecuteCommand,
+} from "~/utils/projectFiles.js";
 import { getNodeMajorVersion } from "~/utils/versioning.js";
 
 const PNPM_BUILD_POLICY = {
@@ -19,6 +24,8 @@ const PNPM_BUILD_POLICY = {
   msw: true,
   sharp: true,
 } as const;
+const NPM_PACKAGE_MANAGER_WARNING =
+  "Warning: We strongly suggest using PNPM 11 or greater as your package manager to better protect your computer and your app.";
 function getPackageManagerMajorVersion(version?: string) {
   if (!version) {
     return undefined;
@@ -84,13 +91,20 @@ export function planInit(
   const proofkitWebviewerVersion = getProofkitDependencyVersion(getProofkitWebviewerVersion());
   const settings = createDefaultSettings(request);
   const packageManagerCommand = getTemplatePackageCommand(request.packageManager);
+  const packageManagerExecuteCommand = getTemplatePackageExecuteCommand(request.packageManager);
   const packageManagerMajorVersion = getPackageManagerMajorVersion(options.packageManagerVersion);
   const shouldWritePnpmWorkspaceFile = request.packageManager === "pnpm" && (packageManagerMajorVersion ?? 0) >= 11;
 
   const packageJson: InitPlan["packageJson"] = {
     name: request.scopedAppName,
-    packageManager: options.packageManagerVersion
-      ? `${request.packageManager}@${options.packageManagerVersion}`
+    devEngines: options.packageManagerVersion
+      ? {
+          packageManager: {
+            name: request.packageManager,
+            version: `^${options.packageManagerVersion}`,
+            onFail: "download",
+          },
+        }
       : undefined,
     proofkitMetadata: {
       initVersion: getScaffoldVersion(),
@@ -137,6 +151,7 @@ export function planInit(
     targetDir,
     templateDir: options.templateDir,
     packageManagerCommand,
+    packageManagerExecuteCommand,
     packageJson,
     settings,
     envFile: {
@@ -171,6 +186,7 @@ export function planInit(
     },
     nextSteps: [
       `cd ${request.appDir}`,
+      ...(request.packageManager === "npm" ? [NPM_PACKAGE_MANAGER_WARNING] : []),
       ...(request.noInstall ? [request.packageManager === "yarn" ? "yarn" : `${request.packageManager} install`] : []),
       "npx @tanstack/intent@latest install",
       formatPackageManagerCommand(request.packageManager, "dev"),
@@ -192,8 +208,9 @@ export function applyPackageJsonMutations(
 ) {
   packageJson.name = mutations.name;
   packageJson.proofkitMetadata = mutations.proofkitMetadata as PackageJson["proofkitMetadata"];
-  if (mutations.packageManager) {
-    packageJson.packageManager = mutations.packageManager;
+  if (mutations.devEngines) {
+    packageJson.devEngines = mutations.devEngines;
+    packageJson.packageManager = undefined;
   }
 
   if (!packageJson.dependencies) {

packages/cli/src/core/resolveInitRequest.ts

@@ -1,8 +1,14 @@
 import { Effect } from "effect";
 
 import { DEFAULT_APP_NAME } from "~/consts.js";
-import { CliContext, ConsoleService, FileMakerService, PromptService } from "~/core/context.js";
-import { CliValidationError, FileMakerSetupError, isCliError, NonInteractiveInputError } from "~/core/errors.js";
+import { CliContext, ConsoleService, FileMakerService, PackageManagerService, PromptService } from "~/core/context.js";
+import {
+  CliValidationError,
+  FileMakerSetupError,
+  isCliError,
+  NonInteractiveInputError,
+  UserCancelledError,
+} from "~/core/errors.js";
 import type { AppType, CliFlags, DataSourceType, FileMakerInputs, InitRequest } from "~/core/types.js";
 import { createDataSourceEnvNames, getDefaultSchemaName } from "~/utils/projectFiles.js";
 import { parseNameAndPath, validateAppName } from "~/utils/projectName.js";
@@ -80,6 +86,62 @@ function createMissingInputsMessage(scope: string, flags: string[]) {
   return `Missing required ${scope} inputs in non-interactive mode: ${flags.join(", ")}.`;
 }
 
+function resolvePackageManager({
+  cwd,
+  packageManager,
+  nonInteractive,
+}: {
+  cwd: string;
+  packageManager: "npm" | "pnpm" | "yarn" | "bun";
+  nonInteractive: boolean;
+}) {
+  return Effect.gen(function* () {
+    if (packageManager !== "npm") {
+      return packageManager;
+    }
+
+    const packageManagerService = yield* PackageManagerService;
+    const prompt = yield* PromptService;
+    const pnpmVersionResult = yield* Effect.either(packageManagerService.getVersion("pnpm", cwd));
+    if (pnpmVersionResult._tag === "Right") {
+      return "pnpm" as const;
+    }
+
+    if (nonInteractive) {
+      return packageManager;
+    }
+
+    const packageManagerChoice = yield* promptEffect("Unable to choose package manager.", () =>
+      prompt.select<"abort" | "continue">({
+        message:
+          "We strongly suggest you use PNPM instead of NPM to better secure yourself and the apps you build. https://pnpm.io/installation",
+        options: [
+          {
+            value: "abort",
+            label: "Abort",
+            hint: "Install PNPM first",
+          },
+          {
+            value: "continue",
+            label: "Continue with NPM",
+            hint: "Ignore this warning",
+          },
+        ],
+      }),
+    );
+
+    if (packageManagerChoice === "abort") {
+      return yield* Effect.fail(
+        new UserCancelledError({
+          message: "User aborted to install pnpm first.",
+        }),
+      );
+    }
+
+    return packageManager;
+  });
+}
+
 function resolveHostedFileMakerInputs({
   prompt,
   fileMakerService,
@@ -577,6 +639,11 @@ export const resolveInitRequest = (name?: string, rawFlags?: CliFlags) =>
     const fileMakerService = yield* FileMakerService;
     const cliContext = yield* CliContext;
     const nonInteractive = cliContext.nonInteractive || flags.CI || flags.nonInteractive === true;
+    const packageManager = yield* resolvePackageManager({
+      cwd: cliContext.cwd,
+      packageManager: cliContext.packageManager,
+      nonInteractive,
+    });
 
     let projectName = name;
     if (!projectName) {
@@ -700,7 +767,7 @@ export const resolveInitRequest = (name?: string, rawFlags?: CliFlags) =>
       appType,
       ui: flags.ui ?? "shadcn",
       dataSource,
-      packageManager: cliContext.packageManager,
+      packageManager,
       noInstall: flags.noInstall,
       noGit: flags.noGit,
       force: flags.force,

packages/cli/src/core/types.ts

@@ -102,9 +102,16 @@ export interface InitPlan {
   templateDir: string;
   overwriteMode?: OverwriteMode;
   packageManagerCommand: string;
+  packageManagerExecuteCommand: string;
   packageJson: {
     name: string;
-    packageManager?: string;
+    devEngines?: {
+      packageManager: {
+        name: PackageManager;
+        version: string;
+        onFail: "download";
+      };
+    };
     proofkitMetadata: {
       initVersion: string;
       scaffoldPackage: "@proofkit/cli";

packages/cli/src/utils/projectFiles.ts

@@ -61,6 +61,19 @@ export function getTemplatePackageCommand(packageManager: PackageManager) {
   return packageManager;
 }
 
+export function getTemplatePackageExecuteCommand(packageManager: PackageManager) {
+  if (packageManager === "npm") {
+    return "npx";
+  }
+  if (packageManager === "pnpm") {
+    return "pnpx";
+  }
+  if (packageManager === "bun") {
+    return "bunx";
+  }
+  return `${packageManager} dlx`;
+}
+
 export function normalizeImportAlias(importAlias: string) {
   return importAlias.replace(/\*/g, "").replace(TRAILING_SLASH_REGEX, "$&/");
 }

packages/cli/src/utils/sortPackageJson.ts

@@ -13,6 +13,7 @@ const ROOT_KEY_ORDER = [
   "funding",
   "type",
   "packageManager",
+  "devEngines",
   "engines",
   "bin",
   "exports",

packages/cli/template/vite-wv/package.json

@@ -10,8 +10,8 @@
     "proofkit": "proofkit",
     "serve": "vite preview",
     "start": "vite",
-    "typegen": "npx @proofkit/typegen",
-    "typegen:ui": "npx @proofkit/typegen ui",
+    "typegen": "__PNPM_EXECUTE_COMMAND__ @proofkit/typegen",
+    "typegen:ui": "__PNPM_EXECUTE_COMMAND__ @proofkit/typegen ui",
     "upload": "node ./scripts/upload.js",
     "lint": "ultracite check .",
     "format": "ultracite fix ."

packages/cli/tests/executor.test.ts

@@ -338,6 +338,38 @@ describe("executeInitPlan command paths", () => {
     );
   });
 
+  it("prints pnpm warning in npm next steps", async () => {
+    const cwd = await fs.mkdtemp(path.join(os.tmpdir(), "proofkit-new-npm-warning-"));
+    const console = {
+      info: [] as string[],
+      warn: [] as string[],
+      error: [] as string[],
+      success: [] as string[],
+      note: [] as Array<{ message: string; title?: string }>,
+    };
+    const plan = planInit(
+      makeInitRequest({
+        projectName: "npm-app",
+        scopedAppName: "npm-app",
+        appDir: "npm-app",
+        packageManager: "npm",
+        noInstall: true,
+        noGit: true,
+        cwd,
+      }),
+      {
+        templateDir: getSharedTemplateDir("nextjs-shadcn"),
+        packageManagerVersion: "10.0.0",
+      },
+    );
+
+    await Effect.runPromise(executeInitPlan(plan).pipe(makeTestLayer({ cwd, packageManager: "npm", console })));
+
+    expect(console.info.join("\n")).toContain(
+      "Warning: We strongly suggest using PNPM 11 or greater as your package manager to better protect your computer and your app.",
+    );
+  });
+
   it("fails with a typed external command error when install fails", async () => {
     const cwd = await fs.mkdtemp(path.join(os.tmpdir(), "proofkit-new-install-fail-"));
     const plan = planInit(