@dalexto/lexsys-cli 0.0.5 → 0.1.0

package/dist/commands/status.d.ts

@@ -1,5 +1,11 @@
 interface RunStatusOptions {
+    json?: boolean;
     noFallback?: boolean;
 }
+export interface StatusEntry {
+    name: string;
+    canonicalName: string;
+    drift: "synced" | "drift" | "missing";
+}
 export declare const runStatus: (options?: RunStatusOptions) => Promise<void>;
 export {};

package/dist/config/config.d.ts

@@ -17,6 +17,7 @@ export interface LexsysConfig {
     tailwind: LexsysTailwindConfig;
     installed?: string[];
     registryUrl?: string | null;
+    registryAllowlist?: string[];
 }
 export interface LexsysTailwindConfig {
     version: "v4";

package/dist/index.js

@@ -131,7 +131,8 @@ var defaultConfig = {
   aliases: defaultAliasesConfig,
   tailwind: defaultTailwindConfig,
   installed: [],
-  registryUrl: null
+  registryUrl: null,
+  registryAllowlist: []
 };
 var getConfigPath = () => {
   return join(getCwd(), "lexsys.config.json");
@@ -158,7 +159,10 @@ var loadConfig = async () => {
       ...defaultTailwindConfig,
       ...parsed.tailwind
     },
-    installed: normalizeInstalled(parsed.installed)
+    installed: normalizeInstalled(parsed.installed),
+    registryAllowlist: Array.isArray(parsed.registryAllowlist) ? parsed.registryAllowlist.filter((entry) => {
+      return typeof entry === "string" && entry.length > 0;
+    }) : defaultConfig.registryAllowlist
   };
   if (isLegacyInstalledRecord(parsed.installed)) {
     await saveConfig(config);
@@ -313,9 +317,14 @@ var getRegistryTemplatePath = (templatePath) => {
   );
   return fileURLToPath(templateUrl);
 };
-var generatedStyleHeader = "/* Generated by @dalexto/lexsys-tokens. Do not edit directly. */";
+var generatedStyleFileHeader = `/**
+ * AUTO-GENERATED FILE.
+ *
+ * Generated by @dalexto/lexsys-tokens.
+ * Manual changes will be overwritten.
+`;
 var isGeneratedLexsysStyle = (content) => {
-  return content.startsWith(generatedStyleHeader);
+  return content.startsWith(generatedStyleFileHeader);
 };
 var ensureProjectStructure = async (config) => {
   await mkdir(join(getCwd(), config.paths.components), { recursive: true });
@@ -817,6 +826,21 @@ var parseRegistryStyles = (styles) => {
   }
   return styles;
 };
+var computeRemoteRegistryChecksum = (manifest) => {
+  return hashContent(JSON.stringify(manifest));
+};
+var verifyRemoteRegistryChecksum = (manifest) => {
+  if (!manifest.checksum) {
+    return;
+  }
+  const { checksum, ...rest } = manifest;
+  const computed = computeRemoteRegistryChecksum(rest);
+  if (computed !== checksum) {
+    throw new Error(
+      `Remote registry checksum mismatch. Expected ${checksum}, computed ${computed}.`
+    );
+  }
+};
 var parseRemoteRegistry = (value) => {
   if (Array.isArray(value)) {
     return {
@@ -841,8 +865,36 @@ var parseRemoteRegistry = (value) => {
     }
     parsed.styles = parseRegistryStyles(manifest.styles);
   }
+  if (manifest.checksum !== void 0) {
+    if (typeof manifest.checksum !== "string" || manifest.checksum.length === 0) {
+      throw new Error(
+        "Remote registry manifest checksum must be a non-empty string."
+      );
+    }
+    parsed.checksum = manifest.checksum;
+  }
+  verifyRemoteRegistryChecksum(parsed);
   return parsed;
 };
+var isRegistryUrlAllowed = (url, allowlist) => {
+  if (!allowlist?.length) {
+    return true;
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  const host = parsed.hostname;
+  const origin = parsed.origin;
+  return allowlist.some((entry) => {
+    if (entry === host || entry === origin || entry === url) {
+      return true;
+    }
+    return url.startsWith(entry);
+  });
+};
 var fetchRemoteRegistry = async (url) => {
   const response = await fetch(url);
   if (!response.ok) {
@@ -855,7 +907,16 @@ var fetchRemoteRegistry = async (url) => {
 // src/registry/source.ts
 var getRegistrySource = async () => {
   const config = await loadConfig();
-  return config.registryUrl ?? "local";
+  const registryUrl = config.registryUrl;
+  if (!registryUrl) {
+    return "local";
+  }
+  if (!isRegistryUrlAllowed(registryUrl, config.registryAllowlist)) {
+    throw new Error(
+      `Registry URL is not allowed by registryAllowlist: ${registryUrl}`
+    );
+  }
+  return registryUrl;
 };
 
 // src/registry/provider.ts
@@ -1119,7 +1180,14 @@ var runAdd = async (args2) => {
   ]);
   if (!items.length) {
     if (yes) {
-      console.log("No components specified. Pass component names to add them.");
+      console.log(
+        "No components specified. Pass names to install non-interactively, for example:"
+      );
+      console.log("  lexsys add button dialog --yes");
+      console.log(
+        "To refresh all tracked components, use `lexsys update --yes` instead."
+      );
+      process.exitCode = 1;
       return;
     }
     items = await promptSelectItems();
@@ -1255,6 +1323,29 @@ var runConfig = async (options = {}) => {
   const config = await loadConfig();
   console.log(JSON.stringify(config, null, 2));
 };
+
+// src/utils/registry-errors.ts
+var formatRegistryResolveError = (error) => {
+  return error instanceof Error ? error.message : String(error);
+};
+var markRegistryResolveFailure = () => {
+  process.exitCode = 1;
+};
+var printRegistryResolveFailure = (error) => {
+  console.log("Failed to resolve registry.");
+  console.log(formatRegistryResolveError(error));
+  markRegistryResolveFailure();
+};
+var printRegistryResolveFailureChecklist = (error, options = {}) => {
+  if (options.sectionHeading) {
+    console.log(options.sectionHeading);
+  }
+  console.log("\xD7 failed to resolve registry");
+  console.log(formatRegistryResolveError(error));
+  markRegistryResolveFailure();
+};
+
+// src/commands/doctor.ts
 var runDoctor = async (options = {}) => {
   console.log("Lexsys doctor\n");
   const config = await loadConfig();
@@ -1295,10 +1386,9 @@ var runDoctor = async (options = {}) => {
     console.log(`\u2713 items: ${registryResult.items.length}`);
   } catch (error) {
     registryFailed = true;
-    console.log("\nRegistry:");
-    console.log("\xD7 failed to resolve registry");
-    console.log(error instanceof Error ? error.message : String(error));
-    process.exitCode = 1;
+    printRegistryResolveFailureChecklist(error, {
+      sectionHeading: "\nRegistry:"
+    });
   }
   if (registryFailed && options.noFallback) {
     return;
@@ -1352,7 +1442,7 @@ Usage
 
 Options
   --dry-run, -d       Preview files, dependencies, and install paths
-  --yes, -y           Auto-confirm safe prompts
+  --yes, -y           Non-interactive when component names are provided
   --no-fallback       Fail instead of falling back to local registry
   --cwd, -C <path>    Run from a different project directory
   --help, -h          Show this help
@@ -1381,6 +1471,7 @@ Options
   --help, -h          Show this help
 
   Run without arguments for guided update picker.
+  With --yes and no names, updates all tracked components.
 
 Examples
   lexsys up
@@ -1408,9 +1499,17 @@ Usage
   lexsys status
   lexsys st
 
+Shows template drift for tracked components (up to date vs out of sync).
+For project paths and registry connectivity, use \`lexsys doctor\`.
+
 Options
+  --json, -j          Print installed component drift as JSON
   --no-fallback       Fail instead of falling back to local registry
   --help, -h          Show this help
+
+Examples
+  lexsys st
+  lexsys st --json
 `,
   reset: `
 Usage
@@ -1419,6 +1518,7 @@ Usage
 Options
   --dry-run, -d       Preview reset without writing files
   --with-deps, -w     Also reset installed registry dependencies in the closure
+  --yes, -y           Non-interactive; with no names, resets all tracked components
   --no-fallback       Fail instead of falling back to local registry
   --cwd, -C <path>    Run from a different project directory
   --help, -h          Show this help
@@ -1438,6 +1538,8 @@ Usage
 Options
   --dry-run, -d       Preview uninstall without removing files
   --with-deps, -w     Also remove registry-owned shared dependencies
+  --yes, -y           Non-interactive; with no names, uninstalls all tracked components
+  --no-fallback       Fail instead of falling back to local registry
   --help, -h          Show this help
 
   Run without arguments for guided uninstall picker.
@@ -1451,6 +1553,9 @@ Usage
   lexsys doctor
   lexsys dr
 
+Checks project paths, registry connectivity, and on-disk component folders.
+For template drift vs the registry, use \`lexsys status\`.
+
 Options
   --no-fallback       Fail instead of falling back to local registry
   --help, -h          Show this help
@@ -1516,8 +1621,8 @@ Components
 
 Inspect
   list                      List available registry items              [alias: ls]
-  status                    Show installed component status            [alias: st]
-  doctor                    Check local project setup                  [alias: dr]
+  status                    Template drift for installed components    [alias: st]
+  doctor                    Project paths and registry health          [alias: dr]
   registry                  Inspect registry source and manifest       [alias: reg]
   config                    Print or update Lexsys config              [alias: cfg]
 
@@ -1527,7 +1632,7 @@ Meta
 
 Global Options
   --cwd, -C <path>          Run from a different project directory
-  --yes, -y                 Auto-confirm safe prompts where supported
+  --yes, -y                 Non-interactive mode (add, update, reset, uninstall)
   --no-fallback             Disable local registry fallback
   --help, -h                Show help
   --version, -v             Show CLI version
@@ -2622,6 +2727,10 @@ var runStatus = async (options = {}) => {
   const config = await loadConfig();
   const installed = config.installed ?? [];
   if (!installed.length) {
+    if (options.json) {
+      console.log(JSON.stringify({ installed: [] }, null, 2));
+      return;
+    }
     console.log("No Lexsys components are currently tracked.");
     return;
   }
@@ -2630,21 +2739,52 @@ var runStatus = async (options = {}) => {
       fallback: !options.noFallback
     });
   } catch (error) {
-    console.log("Failed to resolve registry.");
-    console.log(error instanceof Error ? error.message : String(error));
-    process.exitCode = 1;
+    if (options.json) {
+      console.log(
+        JSON.stringify(
+          {
+            error: error instanceof Error ? error.message : String(error)
+          },
+          null,
+          2
+        )
+      );
+      process.exitCode = 1;
+      return;
+    }
+    printRegistryResolveFailure(error);
     return;
   }
-  console.log("Installed Lexsys components:\n");
+  const entries = [];
   for (const name of installed) {
     const item = await findItem(name);
     if (!item) {
-      console.log(`- ${name} (missing from registry)`);
+      entries.push({
+        name,
+        canonicalName: name,
+        drift: "missing"
+      });
       continue;
     }
     const driftStatus = await getComponentDriftStatus(name);
-    const status = driftStatus === "drift" ? "out of sync with registry" : "up to date with registry";
-    console.log(`- ${item.canonicalName} (${status})`);
+    entries.push({
+      name: item.name,
+      canonicalName: item.canonicalName,
+      drift: driftStatus === "drift" ? "drift" : "synced"
+    });
+  }
+  if (options.json) {
+    console.log(JSON.stringify({ installed: entries }, null, 2));
+    return;
+  }
+  console.log("Installed Lexsys components:\n");
+  for (const entry of entries) {
+    if (entry.drift === "missing") {
+      console.log(`- ${entry.name} (missing from registry)`);
+      continue;
+    }
+    const status = entry.drift === "drift" ? "out of sync with registry" : "up to date with registry";
+    console.log(`- ${entry.canonicalName} (${status})`);
   }
 };
 
@@ -2862,6 +3002,7 @@ var resolveInstalledKey = async (name, installed) => {
 var runReset = async (args2) => {
   const dryRun = hasFlag(args2, "--dry-run", "-d");
   const withDeps = hasFlag(args2, "--with-deps", "-w");
+  const yes = hasFlag(args2, "--yes", "-y");
   const noFallback = hasFlag(args2, "--no-fallback");
   const targetArgs = removeFlagsWithValues(
     removeFlags(args2, [
@@ -2869,6 +3010,8 @@ var runReset = async (args2) => {
       "-d",
       "--with-deps",
       "-w",
+      "--yes",
+      "-y",
       "--no-fallback"
     ]),
     ["--cwd", "-C"]
@@ -2890,13 +3033,17 @@ var runReset = async (args2) => {
     return;
   }
   if (!targetArgs.length) {
-    const selected = await promptMultiselect(
-      "Select components to reset",
-      installed.map((name) => ({ title: name, value: name })),
-      { min: 1 }
-    );
-    if (!selected.length) return;
-    targetArgs.push(...selected);
+    if (yes) {
+      targetArgs.push(...installed);
+    } else {
+      const selected = await promptMultiselect(
+        "Select components to reset",
+        installed.map((name) => ({ title: name, value: name })),
+        { min: 1 }
+      );
+      if (!selected.length) return;
+      targetArgs.push(...selected);
+    }
   }
   const resetNames = /* @__PURE__ */ new Set();
   for (const name of targetArgs) {
@@ -2963,6 +3110,7 @@ var collectOrphanedSharedResources = (removedItems, remainingItems) => {
 var runUninstall = async (args2) => {
   const dryRun = hasFlag(args2, "--dry-run", "-d");
   const withDeps = hasFlag(args2, "--with-deps", "-w");
+  const yes = hasFlag(args2, "--yes", "-y");
   const noFallback = hasFlag(args2, "--no-fallback");
   const targetArgs = removeFlagsWithValues(
     removeFlags(args2, [
@@ -2970,27 +3118,31 @@ var runUninstall = async (args2) => {
       "-d",
       "--with-deps",
       "-w",
+      "--yes",
+      "-y",
       "--no-fallback"
     ]),
     ["--cwd", "-C"]
   );
+  const config = await loadConfig();
+  const installed = [...config.installed ?? []];
   if (!targetArgs.length) {
-    const preConfig = await loadConfig();
-    const installedNames = preConfig.installed ?? [];
-    if (installedNames.length === 0) {
+    if (!installed.length) {
       console.log("No components installed.");
       return;
     }
-    const selected = await promptMultiselect(
-      "Select components to uninstall",
-      installedNames.map((name) => ({ title: name, value: name })),
-      { min: 1 }
-    );
-    if (!selected.length) return;
-    targetArgs.push(...selected);
+    if (yes) {
+      targetArgs.push(...installed);
+    } else {
+      const selected = await promptMultiselect(
+        "Select components to uninstall",
+        installed.map((name) => ({ title: name, value: name })),
+        { min: 1 }
+      );
+      if (!selected.length) return;
+      targetArgs.push(...selected);
+    }
   }
-  const config = await loadConfig();
-  const installed = [...config.installed ?? []];
   const resolvedTargets = [];
   const notTracked = [];
   for (const name of targetArgs) {
@@ -3375,6 +3527,7 @@ try {
       process.exit(0);
     }
     await runStatus({
+      json: hasFlag(args, "--json", "-j"),
       noFallback: args.includes("--no-fallback")
     });
     process.exit(0);

package/dist/registry/remote.d.ts

@@ -3,13 +3,26 @@ export interface RemoteRegistryManifest {
     version: string;
     items: RegistryItem[];
     styles?: RegistryStyle[];
+    checksum?: string;
 }
+/**
+ * Computes a SHA-256 checksum for a remote manifest (excluding the checksum field).
+ */
+export declare const computeRemoteRegistryChecksum: (manifest: Omit<RemoteRegistryManifest, "checksum">) => string;
+/**
+ * Verifies an optional manifest checksum when publishers include one.
+ */
+export declare const verifyRemoteRegistryChecksum: (manifest: RemoteRegistryManifest) => void;
 /**
  * Parses a remote registry JSON payload into a manifest object.
  *
  * Accepts either:
- * - a manifest object `{ version, items, styles? }`
+ * - a manifest object `{ version, items, styles?, checksum? }`
  * - a legacy bare array of registry items (version becomes `"unknown"`)
  */
 export declare const parseRemoteRegistry: (value: unknown) => RemoteRegistryManifest;
+/**
+ * Returns true when the registry URL host or prefix matches an allowlist entry.
+ */
+export declare const isRegistryUrlAllowed: (url: string, allowlist: string[] | undefined) => boolean;
 export declare const fetchRemoteRegistry: (url: string) => Promise<RemoteRegistryManifest>;

package/dist/utils/registry-errors.d.ts

@@ -0,0 +1,6 @@
+export declare const formatRegistryResolveError: (error: unknown) => string;
+export declare const markRegistryResolveFailure: () => void;
+export declare const printRegistryResolveFailure: (error: unknown) => void;
+export declare const printRegistryResolveFailureChecklist: (error: unknown, options?: {
+    sectionHeading?: string;
+}) => void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dalexto/lexsys-cli",
-  "version": "0.0.5",
+  "version": "0.1.0",
   "description": "Registry-first CLI that installs Lexsys React UI components into your project",
   "type": "module",
   "license": "MIT",
@@ -32,7 +32,7 @@
   },
   "dependencies": {
     "prompts": "^2.4.2",
-    "@dalexto/lexsys-registry": "0.0.5"
+    "@dalexto/lexsys-registry": "0.1.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",