@decantr/cli 1.7.25 → 1.7.26

package/dist/bin.js

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
-import "./chunk-7FXMRAC3.js";
+import "./chunk-RAAUNHXD.js";
 import "./chunk-3K6HWLD5.js";
 import "./chunk-QRQCPD3C.js";

package/dist/{chunk-7FXMRAC3.js → chunk-RAAUNHXD.js}

@@ -40,29 +40,63 @@ import {
 } from "@decantr/verifier";
 
 // src/auth.ts
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "fs";
 import { homedir } from "os";
 import { join } from "path";
-var CONFIG_DIR = join(homedir(), ".config", "decantr");
-var AUTH_FILE = join(CONFIG_DIR, "auth.json");
+var CONFIG_DIR_MODE = 448;
+var AUTH_FILE_MODE = 384;
+function getConfigDir() {
+  return process.env.DECANTR_CONFIG_DIR || join(homedir(), ".config", "decantr");
+}
+function getAuthFile() {
+  return join(getConfigDir(), "auth.json");
+}
+function chmodIfNeeded(path, mode) {
+  try {
+    if ((statSync(path).mode & 511) !== mode) {
+      chmodSync(path, mode);
+    }
+  } catch {
+  }
+}
+function ensureConfigDir() {
+  const configDir = getConfigDir();
+  mkdirSync(configDir, { recursive: true, mode: CONFIG_DIR_MODE });
+  chmodIfNeeded(configDir, CONFIG_DIR_MODE);
+}
 function getCredentials() {
-  if (!existsSync(AUTH_FILE)) return null;
+  const authFile = getAuthFile();
+  if (!existsSync(authFile)) return null;
   try {
-    return JSON.parse(readFileSync(AUTH_FILE, "utf-8"));
+    chmodIfNeeded(authFile, AUTH_FILE_MODE);
+    return JSON.parse(readFileSync(authFile, "utf-8"));
   } catch {
     return null;
   }
 }
 function saveCredentials(creds) {
-  mkdirSync(CONFIG_DIR, { recursive: true });
-  writeFileSync(AUTH_FILE, JSON.stringify(creds, null, 2));
+  ensureConfigDir();
+  const authFile = getAuthFile();
+  writeFileSync(authFile, JSON.stringify(creds, null, 2), { mode: AUTH_FILE_MODE });
+  chmodIfNeeded(authFile, AUTH_FILE_MODE);
 }
 function clearCredentials() {
-  if (existsSync(AUTH_FILE)) {
-    rmSync(AUTH_FILE);
+  const authFile = getAuthFile();
+  if (existsSync(authFile)) {
+    rmSync(authFile);
   }
 }
 function getApiKeyOrToken() {
+  const envKey = process.env.DECANTR_API_KEY?.trim();
+  if (envKey) return envKey;
   const creds = getCredentials();
   if (!creds) return null;
   return creds.api_key || creds.access_token || null;
@@ -341,7 +375,7 @@ import { existsSync as existsSync12, mkdirSync as mkdirSync3, writeFileSync as w
 import { join as join12 } from "path";
 
 // src/analyzers/components.ts
-import { existsSync as existsSync4, readdirSync, statSync } from "fs";
+import { existsSync as existsSync4, readdirSync, statSync as statSync2 } from "fs";
 import { join as join4 } from "path";
 var PAGE_EXTENSIONS = /* @__PURE__ */ new Set([".tsx", ".ts", ".jsx", ".js"]);
 var ROOT_COMPONENT_CANDIDATES = [
@@ -366,7 +400,7 @@ function countFilesRecursive(dir, extensions) {
     if (entry.startsWith(".") || entry === "node_modules") continue;
     const fullPath = join4(dir, entry);
     try {
-      const stat = statSync(fullPath);
+      const stat = statSync2(fullPath);
       if (stat.isDirectory()) {
         count += countFilesRecursive(fullPath, extensions);
       } else if (stat.isFile()) {
@@ -392,7 +426,7 @@ function countPageFiles(dir) {
     if (entry.startsWith(".") || entry === "node_modules") continue;
     const fullPath = join4(dir, entry);
     try {
-      const stat = statSync(fullPath);
+      const stat = statSync2(fullPath);
       if (stat.isDirectory()) {
         count += countPageFiles(fullPath);
       } else if (stat.isFile()) {
@@ -632,7 +666,7 @@ function scanDependencies(projectRoot) {
 }
 
 // src/analyzers/features.ts
-import { existsSync as existsSync6, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { existsSync as existsSync6, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
 import { join as join6 } from "path";
 var FEATURE_PATTERNS = {
   auth: [
@@ -690,7 +724,7 @@ function collectPaths(dir, baseDir, depth = 0) {
     const relPath = fullPath.slice(baseDir.length + 1);
     paths.push(relPath);
     try {
-      if (statSync2(fullPath).isDirectory()) {
+      if (statSync3(fullPath).isDirectory()) {
         paths.push(...collectPaths(fullPath, baseDir, depth + 1));
       }
     } catch {
@@ -861,7 +895,7 @@ function scanLayout(projectRoot) {
 }
 
 // src/analyzers/routes.ts
-import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync6, statSync as statSync3 } from "fs";
+import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
 import { join as join8, relative } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".next", ".git", "api", "_app", "_document"]);
 function shouldSkipDir(name) {
@@ -910,7 +944,7 @@ function walkAppDir(dir, baseDir, segments) {
     if (shouldSkipDir(entry)) continue;
     const fullPath = join8(dir, entry);
     try {
-      if (!statSync3(fullPath).isDirectory()) continue;
+      if (!statSync4(fullPath).isDirectory()) continue;
     } catch {
       continue;
     }
@@ -932,7 +966,7 @@ function walkPagesDir(dir, baseDir, segments) {
     if (shouldSkipDir(entry)) continue;
     const fullPath = join8(dir, entry);
     try {
-      const stat = statSync3(fullPath);
+      const stat = statSync4(fullPath);
       if (stat.isDirectory()) {
         const routeSegment = segmentToRoute(entry);
         const nextSegments = routeSegment === null ? [...segments] : [...segments, routeSegment];
@@ -968,7 +1002,7 @@ function collectRouteCandidateFiles(dir, files, depth = 0) {
     if (entry.startsWith(".") || entry === "node_modules") continue;
     const fullPath = join8(dir, entry);
     try {
-      const stat = statSync3(fullPath);
+      const stat = statSync4(fullPath);
       if (stat.isDirectory()) {
         collectRouteCandidateFiles(fullPath, files, depth + 1);
       } else if (stat.isFile()) {
@@ -2668,7 +2702,7 @@ async function cmdMigrate(projectRoot = process.cwd()) {
 }
 
 // src/commands/new-project.ts
-import { execSync } from "child_process";
+import { spawnSync } from "child_process";
 import { existsSync as existsSync18, mkdirSync as mkdirSync8 } from "fs";
 import { join as join19, resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
@@ -3118,6 +3152,72 @@ function dim2(text) {
 function cyan2(text) {
   return `${CYAN3}${text}${RESET6}`;
 }
+function validatePassThroughFlagValue(flag, value) {
+  if (value.length === 0) {
+    throw new Error(`--${flag} cannot be empty.`);
+  }
+  if (value.length > 512) {
+    throw new Error(`--${flag} is too long.`);
+  }
+  if (/[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(`--${flag} contains unsupported control characters.`);
+  }
+  return value;
+}
+function pushPassThroughFlag(flags, flag, value) {
+  if (value == null) return;
+  flags.push(`--${flag}=${validatePassThroughFlagValue(flag, value)}`);
+}
+function buildNewProjectInitArgs(options, inferredAdoption) {
+  const initFlags = [
+    "--yes",
+    "--workflow=greenfield",
+    `--adoption=${validatePassThroughFlagValue("mode", inferredAdoption)}`
+  ];
+  pushPassThroughFlag(initFlags, "blueprint", options.blueprint);
+  pushPassThroughFlag(initFlags, "archetype", options.archetype);
+  pushPassThroughFlag(initFlags, "theme", options.theme);
+  pushPassThroughFlag(initFlags, "mode", options.mode);
+  pushPassThroughFlag(initFlags, "shape", options.shape);
+  pushPassThroughFlag(initFlags, "target", options.target);
+  if (options.offline) initFlags.push("--offline");
+  pushPassThroughFlag(initFlags, "registry", options.registry);
+  pushPassThroughFlag(initFlags, "assistant-bridge", options.assistantBridge);
+  return initFlags;
+}
+function commandForPlatform(command) {
+  if (process.platform !== "win32") {
+    return command;
+  }
+  return /^(?:npm|pnpm|yarn|bun|npx)$/.test(command) ? `${command}.cmd` : command;
+}
+function runArgvCommand(command, args, cwd) {
+  const result = spawnSync(commandForPlatform(command), args, {
+    cwd,
+    stdio: "inherit",
+    shell: false
+  });
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    throw new Error(`Command failed: ${command} ${args.join(" ")}`);
+  }
+}
+function resolveInitCommand(initFlags) {
+  const bundledCliEntrypoint = fileURLToPath(new URL("./bin.js", import.meta.url));
+  const cliEntrypoint = existsSync18(bundledCliEntrypoint) ? bundledCliEntrypoint : process.argv[1] && existsSync18(process.argv[1]) ? process.argv[1] : null;
+  if (cliEntrypoint) {
+    return {
+      command: process.execPath,
+      args: [cliEntrypoint, "init", ...initFlags]
+    };
+  }
+  return {
+    command: "npx",
+    args: ["decantr", "init", ...initFlags]
+  };
+}
 async function cmdNewProject(projectName, options) {
   const workspaceRoot = process.cwd();
   const projectDir = resolve2(workspaceRoot, projectName);
@@ -3138,6 +3238,14 @@ async function cmdNewProject(projectName, options) {
     process.exitCode = 1;
     return;
   }
+  let initFlags;
+  try {
+    initFlags = buildNewProjectInitArgs(options, inferredAdoption);
+  } catch (err) {
+    console.error(error2(err.message));
+    process.exitCode = 1;
+    return;
+  }
   console.log(heading(`Creating ${projectName}...`));
   mkdirSync8(projectDir, { recursive: true });
   console.log(dim2(`  Created ${projectName}/`));
@@ -3165,7 +3273,7 @@ async function cmdNewProject(projectName, options) {
   if (shouldBootstrapRuntime) {
     console.log(heading("Installing dependencies..."));
     try {
-      execSync(`${packageManager} install`, { cwd: projectDir, stdio: "inherit" });
+      runArgvCommand(packageManager, ["install"], projectDir);
     } catch {
       console.log(
         `
@@ -3202,21 +3310,9 @@ ${YELLOW4}Dependency install failed. Run \`${packageManager} install\` manually.
     return;
   }
   console.log(heading("Initializing Decantr..."));
-  const initFlags = ["--yes", "--workflow=greenfield", `--adoption=${inferredAdoption}`];
-  if (options.blueprint) initFlags.push(`--blueprint=${options.blueprint}`);
-  if (options.archetype) initFlags.push(`--archetype=${options.archetype}`);
-  if (options.theme) initFlags.push(`--theme=${options.theme}`);
-  if (options.mode) initFlags.push(`--mode=${options.mode}`);
-  if (options.shape) initFlags.push(`--shape=${options.shape}`);
-  if (options.target) initFlags.push(`--target=${options.target}`);
-  if (options.offline) initFlags.push("--offline");
-  if (options.registry) initFlags.push(`--registry=${options.registry}`);
-  if (options.assistantBridge) initFlags.push(`--assistant-bridge=${options.assistantBridge}`);
   try {
-    const bundledCliEntrypoint = fileURLToPath(new URL("./bin.js", import.meta.url));
-    const cliEntrypoint = existsSync18(bundledCliEntrypoint) ? bundledCliEntrypoint : process.argv[1] && existsSync18(process.argv[1]) ? process.argv[1] : null;
-    const cliPath = cliEntrypoint ? `"${process.execPath}" "${cliEntrypoint}"` : "npx decantr";
-    execSync(`${cliPath} init ${initFlags.join(" ")}`, { cwd: projectDir, stdio: "inherit" });
+    const initCommand = resolveInitCommand(initFlags);
+    runArgvCommand(initCommand.command, initCommand.args, projectDir);
     if (shouldBootstrapRuntime && bootstrapAdapter) {
       bootstrapAdapter.writeProjectFiles(projectDir, title, detectRoutingMode(projectDir));
     }

package/dist/index.js

@@ -1,3 +1,3 @@
-import "./chunk-7FXMRAC3.js";
+import "./chunk-RAAUNHXD.js";
 import "./chunk-3K6HWLD5.js";
 import "./chunk-QRQCPD3C.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decantr/cli",
-  "version": "1.7.25",
+  "version": "1.7.26",
   "description": "Decantr CLI — scaffold, audit, and maintain Decantr projects from the terminal",
   "author": "Decantr AI",
   "license": "MIT",
@@ -23,21 +23,25 @@
     "src/templates",
     "src/bundled"
   ],
+  "engines": {
+    "node": ">=20"
+  },
   "publishConfig": {
     "access": "public"
   },
-  "dependencies": {
-    "@decantr/core": "1.0.5",
-    "@decantr/essence-spec": "1.0.5",
-    "@decantr/registry": "1.0.3",
-    "@decantr/verifier": "1.0.4"
-  },
   "scripts": {
     "build": "tsup",
     "certify:blueprints": "pnpm build && node scripts/certify-blueprints.mjs",
     "certify:workflows": "pnpm build && node scripts/certify-workflows.mjs",
     "test": "vitest run",
     "test:watch": "vitest",
+    "prepublishOnly": "pnpm build",
     "preversion": "pnpm build && pnpm test"
+  },
+  "dependencies": {
+    "@decantr/core": "workspace:*",
+    "@decantr/essence-spec": "workspace:*",
+    "@decantr/registry": "workspace:*",
+    "@decantr/verifier": "workspace:*"
   }
-}
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Decantr AI
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.