@ic-reactor/codegen 0.12.0 → 0.12.1

package/dist/index.d.cts

@@ -1,6 +1,3 @@
-export { generateCodecDeclarations } from './renderer.cjs';
-import '@ic-reactor/parser';
-
 /**
  * @ic-reactor/codegen — Core Types
  *
@@ -143,6 +140,116 @@ declare function getReactorName(canisterName: string): string;
  */
 declare function getServiceTypeName(canisterName: string): string;
 
+/**
+ * Config validation for the codegen pipeline.
+ *
+ * Every value validated here arrives from a project's `ic-reactor.json` or from
+ * `@ic-reactor/vite-plugin` options — that is, from a file in a repository the
+ * user may have merely cloned. The pipeline turns those values into filesystem
+ * paths it recursively deletes and into source text it writes into the user's
+ * bundle, so they are treated as untrusted input rather than as configuration.
+ *
+ * Validation lives here, at the pipeline's own entry point, rather than in the
+ * CLI's interactive prompt: the prompt only covers one of the three entry paths
+ * (hand-edited config and plugin options bypass it entirely).
+ */
+
+/**
+ * Thrown when a canister config would produce an unsafe path or unsafe
+ * generated source. Callers convert this into a `PipelineResult` error.
+ */
+declare class CodegenConfigError extends Error {
+    readonly name = "CodegenConfigError";
+    constructor(message: string);
+}
+/**
+ * Characters allowed in a canister name.
+ *
+ * A canister name becomes a directory segment, so this excludes path
+ * separators, quotes, whitespace and control characters. It deliberately does
+ * NOT require a leading letter: `dfx` places no restriction on canister names,
+ * and real projects use `_private` and `my.canister`, both of which derive
+ * perfectly good identifiers. Identifier validity is enforced separately, on
+ * the *derived* names, by {@link assertSafeCanisterName}.
+ */
+declare const CANISTER_NAME_PATTERN: RegExp;
+/**
+ * Assert that a canister name is safe to use as a path segment and as the stem
+ * of a generated identifier.
+ *
+ * Rejecting a leading digit here is what stops `2048_game` from reaching the
+ * generator, where it would become `export const 2048GameReactor` — invalid
+ * TypeScript emitted with a success status.
+ */
+declare function assertSafeCanisterName(name: unknown): asserts name is string;
+/**
+ * Assert that a module specifier we interpolate into an `import` statement is a
+ * relative path or a bare package name — never a URL.
+ *
+ * A `https://…` specifier here would make the generated module pull code from a
+ * remote host at import time, inside the user's own bundle.
+ */
+declare function assertSafeModuleSpecifier(label: string, specifier: unknown): asserts specifier is string;
+/** Reactor classes the generator knows how to emit an import for. */
+declare const REACTOR_CLASS_NAMES: readonly ReactorClassName[];
+/** Runtime targets the generator knows how to emit. */
+declare const CODEGEN_TARGETS: readonly CodegenTarget[];
+/**
+ * Assert a config value is one of a closed set.
+ *
+ * `mode` and `target` are interpolated into emitted source as bare identifiers
+ * and module specifiers, so an unrecognized value is not merely unsupported —
+ * it is injected.
+ */
+declare function assertOneOf<T extends string>(label: string, value: unknown, allowed: readonly T[]): asserts value is T;
+/**
+ * Assert that an already-resolved absolute path lies inside `projectRoot`.
+ *
+ * Containment is decided on the real on-disk locations: `path.resolve` does not
+ * follow symlinks, so a purely lexical comparison can be walked out of via a
+ * symlink placed inside the project root.
+ *
+ * @param original - the path as the user wrote it, for the error message
+ */
+declare function assertContainedPath(label: string, resolved: string, projectRoot: string, original?: string): void;
+/**
+ * Resolve `outDir` against `projectRoot` and assert the result stays inside it.
+ *
+ * The pipeline recursively deletes `<outDir>/declarations` before every
+ * generation, so an `outDir` that escapes the project root turns a config file
+ * into an arbitrary-directory delete.
+ */
+declare function resolveContainedOutDir(label: string, outDir: unknown, projectRoot: string): string;
+interface ValidatedCanisterPaths {
+    /** The validated canister name. */
+    name: string;
+    /** Absolute output directory, guaranteed to be inside `projectRoot`. */
+    outDir: string;
+    /** Validated module specifier for the client manager import. */
+    clientManagerPath: string;
+}
+interface ValidateCanisterConfigOptions {
+    name: unknown;
+    /** Per-canister `outDir`, if the config sets one. */
+    canisterOutDir?: unknown;
+    /** Global `outDir`; the canister name is appended to it when used. */
+    globalOutDir: unknown;
+    clientManagerPath: unknown;
+    projectRoot: string;
+    /** Resolved reactor class (`canisterConfig.mode`), if the config sets one. */
+    mode?: unknown;
+    /** Resolved runtime target (`canisterConfig.target` / global `target`). */
+    target?: unknown;
+}
+/**
+ * Validate one canister's config and return the resolved, contained paths the
+ * pipeline should use.
+ *
+ * Call this before any filesystem work: it is the single choke point that all
+ * three entry paths (CLI, vite plugin, direct API) share.
+ */
+declare function assertSafeCanisterConfig(options: ValidateCanisterConfigOptions): ValidatedCanisterPaths;
+
 /**
  * Candid Parser Utilities
  *
@@ -286,4 +393,4 @@ interface ClientGeneratorOptions {
  */
 declare function generateClientFile(options?: ClientGeneratorOptions): string;
 
-export { type CanisterConfig, type ClientGeneratorOptions, type CodegenConfig, type CodegenTarget, type DeclarationsGeneratorOptions, type DeclarationsGeneratorResult, type GeneratorResult, type MethodInfo, type MethodType, type PipelineOptions, type PipelineResult, type ReactorClassName, type ReactorGeneratorOptions, declarationsExist, extractMethods, generateClientFile, generateDeclarations, generateReactorEntryFile, generateReactorFile, getReactorName, getServiceTypeName, parseDIDFile, runCanisterPipeline, toPascalCase };
+export { CANISTER_NAME_PATTERN, CODEGEN_TARGETS, type CanisterConfig, type ClientGeneratorOptions, type CodegenConfig, CodegenConfigError, type CodegenTarget, type DeclarationsGeneratorOptions, type DeclarationsGeneratorResult, type GeneratorResult, type MethodInfo, type MethodType, type PipelineOptions, type PipelineResult, REACTOR_CLASS_NAMES, type ReactorClassName, type ReactorGeneratorOptions, type ValidateCanisterConfigOptions, type ValidatedCanisterPaths, assertContainedPath, assertOneOf, assertSafeCanisterConfig, assertSafeCanisterName, assertSafeModuleSpecifier, declarationsExist, extractMethods, generateClientFile, generateDeclarations, generateReactorEntryFile, generateReactorFile, getReactorName, getServiceTypeName, parseDIDFile, resolveContainedOutDir, runCanisterPipeline, toPascalCase };

package/dist/index.d.ts

@@ -1,6 +1,3 @@
-export { generateCodecDeclarations } from './renderer.js';
-import '@ic-reactor/parser';
-
 /**
  * @ic-reactor/codegen — Core Types
  *
@@ -143,6 +140,116 @@ declare function getReactorName(canisterName: string): string;
  */
 declare function getServiceTypeName(canisterName: string): string;
 
+/**
+ * Config validation for the codegen pipeline.
+ *
+ * Every value validated here arrives from a project's `ic-reactor.json` or from
+ * `@ic-reactor/vite-plugin` options — that is, from a file in a repository the
+ * user may have merely cloned. The pipeline turns those values into filesystem
+ * paths it recursively deletes and into source text it writes into the user's
+ * bundle, so they are treated as untrusted input rather than as configuration.
+ *
+ * Validation lives here, at the pipeline's own entry point, rather than in the
+ * CLI's interactive prompt: the prompt only covers one of the three entry paths
+ * (hand-edited config and plugin options bypass it entirely).
+ */
+
+/**
+ * Thrown when a canister config would produce an unsafe path or unsafe
+ * generated source. Callers convert this into a `PipelineResult` error.
+ */
+declare class CodegenConfigError extends Error {
+    readonly name = "CodegenConfigError";
+    constructor(message: string);
+}
+/**
+ * Characters allowed in a canister name.
+ *
+ * A canister name becomes a directory segment, so this excludes path
+ * separators, quotes, whitespace and control characters. It deliberately does
+ * NOT require a leading letter: `dfx` places no restriction on canister names,
+ * and real projects use `_private` and `my.canister`, both of which derive
+ * perfectly good identifiers. Identifier validity is enforced separately, on
+ * the *derived* names, by {@link assertSafeCanisterName}.
+ */
+declare const CANISTER_NAME_PATTERN: RegExp;
+/**
+ * Assert that a canister name is safe to use as a path segment and as the stem
+ * of a generated identifier.
+ *
+ * Rejecting a leading digit here is what stops `2048_game` from reaching the
+ * generator, where it would become `export const 2048GameReactor` — invalid
+ * TypeScript emitted with a success status.
+ */
+declare function assertSafeCanisterName(name: unknown): asserts name is string;
+/**
+ * Assert that a module specifier we interpolate into an `import` statement is a
+ * relative path or a bare package name — never a URL.
+ *
+ * A `https://…` specifier here would make the generated module pull code from a
+ * remote host at import time, inside the user's own bundle.
+ */
+declare function assertSafeModuleSpecifier(label: string, specifier: unknown): asserts specifier is string;
+/** Reactor classes the generator knows how to emit an import for. */
+declare const REACTOR_CLASS_NAMES: readonly ReactorClassName[];
+/** Runtime targets the generator knows how to emit. */
+declare const CODEGEN_TARGETS: readonly CodegenTarget[];
+/**
+ * Assert a config value is one of a closed set.
+ *
+ * `mode` and `target` are interpolated into emitted source as bare identifiers
+ * and module specifiers, so an unrecognized value is not merely unsupported —
+ * it is injected.
+ */
+declare function assertOneOf<T extends string>(label: string, value: unknown, allowed: readonly T[]): asserts value is T;
+/**
+ * Assert that an already-resolved absolute path lies inside `projectRoot`.
+ *
+ * Containment is decided on the real on-disk locations: `path.resolve` does not
+ * follow symlinks, so a purely lexical comparison can be walked out of via a
+ * symlink placed inside the project root.
+ *
+ * @param original - the path as the user wrote it, for the error message
+ */
+declare function assertContainedPath(label: string, resolved: string, projectRoot: string, original?: string): void;
+/**
+ * Resolve `outDir` against `projectRoot` and assert the result stays inside it.
+ *
+ * The pipeline recursively deletes `<outDir>/declarations` before every
+ * generation, so an `outDir` that escapes the project root turns a config file
+ * into an arbitrary-directory delete.
+ */
+declare function resolveContainedOutDir(label: string, outDir: unknown, projectRoot: string): string;
+interface ValidatedCanisterPaths {
+    /** The validated canister name. */
+    name: string;
+    /** Absolute output directory, guaranteed to be inside `projectRoot`. */
+    outDir: string;
+    /** Validated module specifier for the client manager import. */
+    clientManagerPath: string;
+}
+interface ValidateCanisterConfigOptions {
+    name: unknown;
+    /** Per-canister `outDir`, if the config sets one. */
+    canisterOutDir?: unknown;
+    /** Global `outDir`; the canister name is appended to it when used. */
+    globalOutDir: unknown;
+    clientManagerPath: unknown;
+    projectRoot: string;
+    /** Resolved reactor class (`canisterConfig.mode`), if the config sets one. */
+    mode?: unknown;
+    /** Resolved runtime target (`canisterConfig.target` / global `target`). */
+    target?: unknown;
+}
+/**
+ * Validate one canister's config and return the resolved, contained paths the
+ * pipeline should use.
+ *
+ * Call this before any filesystem work: it is the single choke point that all
+ * three entry paths (CLI, vite plugin, direct API) share.
+ */
+declare function assertSafeCanisterConfig(options: ValidateCanisterConfigOptions): ValidatedCanisterPaths;
+
 /**
  * Candid Parser Utilities
  *
@@ -286,4 +393,4 @@ interface ClientGeneratorOptions {
  */
 declare function generateClientFile(options?: ClientGeneratorOptions): string;
 
-export { type CanisterConfig, type ClientGeneratorOptions, type CodegenConfig, type CodegenTarget, type DeclarationsGeneratorOptions, type DeclarationsGeneratorResult, type GeneratorResult, type MethodInfo, type MethodType, type PipelineOptions, type PipelineResult, type ReactorClassName, type ReactorGeneratorOptions, declarationsExist, extractMethods, generateClientFile, generateDeclarations, generateReactorEntryFile, generateReactorFile, getReactorName, getServiceTypeName, parseDIDFile, runCanisterPipeline, toPascalCase };
+export { CANISTER_NAME_PATTERN, CODEGEN_TARGETS, type CanisterConfig, type ClientGeneratorOptions, type CodegenConfig, CodegenConfigError, type CodegenTarget, type DeclarationsGeneratorOptions, type DeclarationsGeneratorResult, type GeneratorResult, type MethodInfo, type MethodType, type PipelineOptions, type PipelineResult, REACTOR_CLASS_NAMES, type ReactorClassName, type ReactorGeneratorOptions, type ValidateCanisterConfigOptions, type ValidatedCanisterPaths, assertContainedPath, assertOneOf, assertSafeCanisterConfig, assertSafeCanisterName, assertSafeModuleSpecifier, declarationsExist, extractMethods, generateClientFile, generateDeclarations, generateReactorEntryFile, generateReactorFile, getReactorName, getServiceTypeName, parseDIDFile, resolveContainedOutDir, runCanisterPipeline, toPascalCase };

package/dist/index.js

@@ -1,10 +1,6 @@
-import {
-  generateCodecDeclarations
-} from "./chunk-VBCR5IVT.js";
-
 // src/pipeline.ts
-import fs2 from "fs";
-import path3 from "path";
+import fs3 from "fs";
+import path4 from "path";
 
 // src/generators/declarations.ts
 import { didToJs, didToTs } from "@ic-reactor/parser";
@@ -80,6 +76,9 @@ function getReactorName(canisterName) {
 function getServiceTypeName(canisterName) {
   return `${toPascalCase(canisterName)}Service`;
 }
+function getHookPrefix(canisterName) {
+  return toPascalCase(canisterName);
+}
 
 // src/generators/reactor.ts
 function getReactorClassImportSource(reactorClass, runtimeTarget) {
@@ -91,6 +90,10 @@ function getReactorClassImportSource(reactorClass, runtimeTarget) {
     case "CandidDisplayReactor":
     case "MetadataDisplayReactor":
       return "@ic-reactor/candid";
+    default:
+      throw new Error(
+        `Unknown reactor class ${JSON.stringify(reactorClass)}. Expected one of: Reactor, DisplayReactor, CandidReactor, CandidDisplayReactor, MetadataDisplayReactor.`
+      );
   }
 }
 function generateReactorFile(options) {
@@ -124,9 +127,9 @@ export const {
   useActorMethod: use${pascalName}Method,
 } = createActorHooks(${reactorName})
 ` : "";
-  return `${runtimeTarget === "react" ? 'import { createActorHooks } from "@ic-reactor/react"\n' : ""}import { ${reactorClass} } from "${reactorImportSource}"
-import { clientManager } from "${clientManagerPath}"
-import { idlFactory, type _SERVICE } from "${declarationsPath}"
+  return `${runtimeTarget === "react" ? 'import { createActorHooks } from "@ic-reactor/react"\n' : ""}import { ${reactorClass} } from ${JSON.stringify(reactorImportSource)}
+import { clientManager } from ${JSON.stringify(clientManagerPath)}
+import { idlFactory, type _SERVICE } from ${JSON.stringify(declarationsPath)}
 
 export type ${serviceName} = _SERVICE
 
@@ -142,7 +145,7 @@ export type ${serviceName} = _SERVICE
 export const ${reactorName} = new ${reactorClass}<${serviceName}>({
   clientManager,
   idlFactory,
-${canisterIdLine}  name: "${canisterName}",
+${canisterIdLine}  name: ${JSON.stringify(canisterName)},
 })${hookExports || "\n"}`;
 }
 function generateReactorEntryFile() {
@@ -165,6 +168,162 @@ export * from "./index.generated"
 `;
 }
 
+// src/validate.ts
+import fs2 from "fs";
+import path3 from "path";
+var CodegenConfigError = class extends Error {
+  name = "CodegenConfigError";
+  constructor(message) {
+    super(message);
+  }
+};
+var CANISTER_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/;
+var IDENTIFIER_PATTERN = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+var MAX_CANISTER_NAME_LENGTH = 64;
+var HAS_URI_SCHEME = /^(?:[A-Za-z][A-Za-z0-9+.-]*:|\/\/)/;
+var BREAKS_OUT_OF_LITERAL = /["'`\\\u0000-\u001f\u2028\u2029]/;
+function assertSafeCanisterName(name) {
+  if (typeof name !== "string" || name.length === 0) {
+    throw new CodegenConfigError(
+      `Invalid canister name: expected a non-empty string, received ${name === void 0 ? "undefined" : JSON.stringify(name)}. Check the "canisters" entries in your ic-reactor.json (or the plugin's "canisters" option).`
+    );
+  }
+  if (name.length > MAX_CANISTER_NAME_LENGTH) {
+    throw new CodegenConfigError(
+      `Invalid canister name ${JSON.stringify(name)}: must be at most ${MAX_CANISTER_NAME_LENGTH} characters.`
+    );
+  }
+  if (!CANISTER_NAME_PATTERN.test(name)) {
+    throw new CodegenConfigError(
+      `Invalid canister name ${JSON.stringify(name)}: may contain only letters, digits, "_", "." and "-" (${CANISTER_NAME_PATTERN.source}). Canister names become directory names, so path separators, quotes and whitespace are not allowed.`
+    );
+  }
+  if (name === "." || name === "..") {
+    throw new CodegenConfigError(
+      `Invalid canister name ${JSON.stringify(name)}: refers to a directory, not a canister.`
+    );
+  }
+  if (toPascalCase(name).length === 0) {
+    throw new CodegenConfigError(
+      `Invalid canister name ${JSON.stringify(name)}: contains no letters or digits, so it collapses to an empty identifier in generated code.`
+    );
+  }
+  const derived = [
+    ["reactor constant", getReactorName(name)],
+    ["service type", getServiceTypeName(name)],
+    ["hook name", `use${getHookPrefix(name)}Query`]
+  ];
+  for (const [what, identifier] of derived) {
+    if (!IDENTIFIER_PATTERN.test(identifier)) {
+      throw new CodegenConfigError(
+        `Invalid canister name ${JSON.stringify(name)}: it derives the ${what} ${JSON.stringify(identifier)}, which is not a valid TypeScript identifier. Rename the canister so it does not begin with a digit.`
+      );
+    }
+  }
+}
+function assertSafeModuleSpecifier(label, specifier) {
+  if (typeof specifier !== "string" || specifier.length === 0) {
+    throw new CodegenConfigError(
+      `Invalid ${label}: expected a non-empty string, received ${specifier === void 0 ? "undefined" : JSON.stringify(specifier)}.`
+    );
+  }
+  if (BREAKS_OUT_OF_LITERAL.test(specifier)) {
+    throw new CodegenConfigError(
+      `Invalid ${label} ${JSON.stringify(specifier)}: must not contain quotes, backslashes or control characters.`
+    );
+  }
+  if (/^\s|\s$/.test(specifier)) {
+    throw new CodegenConfigError(
+      `Invalid ${label} ${JSON.stringify(specifier)}: must not begin or end with whitespace.`
+    );
+  }
+  if (HAS_URI_SCHEME.test(specifier.trim())) {
+    throw new CodegenConfigError(
+      `Invalid ${label} ${JSON.stringify(specifier)}: must be a relative path ("./\u2026", "../\u2026") or a bare package name. URLs are not allowed \u2014 the generated file imports from this specifier.`
+    );
+  }
+}
+var REACTOR_CLASS_NAMES = [
+  "Reactor",
+  "DisplayReactor",
+  "CandidReactor",
+  "CandidDisplayReactor",
+  "MetadataDisplayReactor"
+];
+var CODEGEN_TARGETS = ["react", "core"];
+function assertOneOf(label, value, allowed) {
+  if (typeof value !== "string" || !allowed.includes(value)) {
+    throw new CodegenConfigError(
+      `Invalid ${label} ${JSON.stringify(value)}: must be one of ${allowed.map((a) => JSON.stringify(a)).join(", ")}.`
+    );
+  }
+}
+function realpathAllowingMissing(target) {
+  let current = path3.resolve(target);
+  const missing = [];
+  for (; ; ) {
+    try {
+      return path3.join(fs2.realpathSync(current), ...missing);
+    } catch {
+      const parent = path3.dirname(current);
+      if (parent === current) return path3.resolve(target);
+      missing.unshift(path3.basename(current));
+      current = parent;
+    }
+  }
+}
+function assertContainedPath(label, resolved, projectRoot, original = resolved) {
+  const relative = path3.relative(
+    realpathAllowingMissing(projectRoot),
+    realpathAllowingMissing(resolved)
+  );
+  const [firstSegment] = relative.split(/[\\/]/);
+  if (firstSegment === ".." || path3.isAbsolute(relative)) {
+    throw new CodegenConfigError(
+      `Invalid ${label} ${JSON.stringify(original)}: resolves to ${JSON.stringify(resolved)}, which is outside the project root ${JSON.stringify(path3.resolve(projectRoot))}. Generated output must stay inside the project \u2014 generated directories are deleted and rewritten on every run.`
+    );
+  }
+}
+function resolveContainedOutDir(label, outDir, projectRoot) {
+  if (typeof outDir !== "string" || outDir.length === 0) {
+    throw new CodegenConfigError(
+      `Invalid ${label}: expected a non-empty string, received ${outDir === void 0 ? "undefined" : JSON.stringify(outDir)}.`
+    );
+  }
+  const resolved = path3.isAbsolute(outDir) ? path3.resolve(outDir) : path3.resolve(projectRoot, outDir);
+  assertContainedPath(label, resolved, projectRoot, outDir);
+  return resolved;
+}
+function assertSafeCanisterConfig(options) {
+  const {
+    name,
+    canisterOutDir,
+    globalOutDir,
+    clientManagerPath,
+    projectRoot,
+    mode,
+    target
+  } = options;
+  assertSafeCanisterName(name);
+  assertSafeModuleSpecifier("clientManagerPath", clientManagerPath);
+  if (mode != null) assertOneOf("mode", mode, REACTOR_CLASS_NAMES);
+  if (target != null) assertOneOf("target", target, CODEGEN_TARGETS);
+  const outDir = canisterOutDir != null ? resolveContainedOutDir(
+    `outDir for canister ${JSON.stringify(name)}`,
+    canisterOutDir,
+    projectRoot
+  ) : path3.join(
+    resolveContainedOutDir("outDir", globalOutDir, projectRoot),
+    name
+  );
+  assertContainedPath(
+    `output directory for canister ${JSON.stringify(name)}`,
+    outDir,
+    projectRoot
+  );
+  return { name, outDir, clientManagerPath };
+}
+
 // src/pipeline.ts
 function resolveReactorClass(canisterConfig) {
   return canisterConfig.mode ?? "DisplayReactor";
@@ -190,8 +349,30 @@ async function runCanisterPipeline(options) {
   } = options;
   const { name, didFile, clientManagerPath } = canisterConfig;
   const files = [];
-  const resolvedDidFile = path3.isAbsolute(didFile) ? didFile : path3.resolve(projectRoot, didFile);
-  if (!fs2.existsSync(resolvedDidFile)) {
+  let validated;
+  try {
+    validated = assertSafeCanisterConfig({
+      name,
+      canisterOutDir: canisterConfig.outDir,
+      globalOutDir: globalConfig.outDir,
+      clientManagerPath: clientManagerPath ?? globalConfig.clientManagerPath ?? "../../clients",
+      projectRoot,
+      mode: canisterConfig.mode,
+      target: canisterConfig.target ?? globalConfig.target
+    });
+  } catch (err) {
+    if (err instanceof CodegenConfigError) {
+      return {
+        canisterName: typeof name === "string" ? name : String(name),
+        success: false,
+        files,
+        error: err.message
+      };
+    }
+    throw err;
+  }
+  const resolvedDidFile = path4.isAbsolute(didFile) ? didFile : path4.resolve(projectRoot, didFile);
+  if (!fs3.existsSync(resolvedDidFile)) {
     return {
       canisterName: name,
       success: false,
@@ -199,8 +380,8 @@ async function runCanisterPipeline(options) {
       error: `DID file not found: ${resolvedDidFile}`
     };
   }
-  const canisterOutDir = canisterConfig.outDir != null ? path3.isAbsolute(canisterConfig.outDir) ? canisterConfig.outDir : path3.resolve(projectRoot, canisterConfig.outDir) : path3.resolve(projectRoot, globalConfig.outDir, name);
-  const resolvedClientManagerPath = clientManagerPath ?? globalConfig.clientManagerPath ?? "../../clients";
+  const canisterOutDir = validated.outDir;
+  const resolvedClientManagerPath = validated.clientManagerPath;
   try {
     const declResult = await generateDeclarations({
       didFile: resolvedDidFile,
@@ -231,8 +412,8 @@ async function runCanisterPipeline(options) {
       files
     };
   }
-  const reactorPath = path3.join(canisterOutDir, "index.generated.ts");
-  const entryPath = path3.join(canisterOutDir, "index.ts");
+  const reactorPath = path4.join(canisterOutDir, "index.generated.ts");
+  const entryPath = path4.join(canisterOutDir, "index.ts");
   const reactorClass = resolveReactorClass(canisterConfig);
   const runtimeTarget = resolveRuntimeTarget(canisterConfig, globalConfig);
   try {
@@ -245,16 +426,16 @@ async function runCanisterPipeline(options) {
       reactorClass
     });
     const entryContent = generateReactorEntryFile();
-    fs2.mkdirSync(canisterOutDir, { recursive: true });
-    fs2.writeFileSync(reactorPath, reactorContent);
+    fs3.mkdirSync(canisterOutDir, { recursive: true });
+    fs3.writeFileSync(reactorPath, reactorContent);
     files.push({ success: true, filePath: reactorPath });
-    if (!fs2.existsSync(entryPath)) {
-      fs2.writeFileSync(entryPath, entryContent);
+    if (!fs3.existsSync(entryPath)) {
+      fs3.writeFileSync(entryPath, entryContent);
       files.push({ success: true, filePath: entryPath });
     } else {
-      const existingEntryContent = fs2.readFileSync(entryPath, "utf-8");
+      const existingEntryContent = fs3.readFileSync(entryPath, "utf-8");
       if (isLegacyGeneratedIndexFile(existingEntryContent) || isManagedEntryWrapper(existingEntryContent, entryContent)) {
-        fs2.writeFileSync(entryPath, entryContent);
+        fs3.writeFileSync(entryPath, entryContent);
         files.push({ success: true, filePath: entryPath });
       } else {
         files.push({ success: true, filePath: entryPath, skipped: true });
@@ -282,7 +463,7 @@ async function runCanisterPipeline(options) {
 
 // src/parser.ts
 import { didToJs as didToJs2 } from "@ic-reactor/parser";
-import fs3 from "fs";
+import fs4 from "fs";
 function extractMethods(didContent) {
   try {
     const jsContent = didToJs2(didContent);
@@ -307,10 +488,10 @@ function extractMethods(didContent) {
   }
 }
 function parseDIDFile(didFilePath) {
-  if (!fs3.existsSync(didFilePath)) {
+  if (!fs4.existsSync(didFilePath)) {
     throw new Error(`DID file not found: ${didFilePath}`);
   }
-  const content = fs3.readFileSync(didFilePath, "utf-8");
+  const content = fs4.readFileSync(didFilePath, "utf-8");
   return extractMethods(content);
 }
 
@@ -335,16 +516,25 @@ export const clientManager = new ClientManager({
 `;
 }
 export {
+  CANISTER_NAME_PATTERN,
+  CODEGEN_TARGETS,
+  CodegenConfigError,
+  REACTOR_CLASS_NAMES,
+  assertContainedPath,
+  assertOneOf,
+  assertSafeCanisterConfig,
+  assertSafeCanisterName,
+  assertSafeModuleSpecifier,
   declarationsExist,
   extractMethods,
   generateClientFile,
-  generateCodecDeclarations,
   generateDeclarations,
   generateReactorEntryFile,
   generateReactorFile,
   getReactorName,
   getServiceTypeName,
   parseDIDFile,
+  resolveContainedOutDir,
   runCanisterPipeline,
   toPascalCase
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ic-reactor/codegen",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Shared code generation utilities for IC Reactor",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -17,16 +17,6 @@
         "default": "./dist/index.cjs"
       }
     },
-    "./renderer": {
-      "import": {
-        "types": "./dist/renderer.d.ts",
-        "default": "./dist/renderer.js"
-      },
-      "require": {
-        "types": "./dist/renderer.d.cts",
-        "default": "./dist/renderer.cjs"
-      }
-    },
     "./package.json": "./package.json"
   },
   "files": [
@@ -62,8 +52,8 @@
     "vitest": "^4.1.10"
   },
   "scripts": {
-    "build": "tsup src/index.ts src/renderer.ts --format esm,cjs --dts --tsconfig tsconfig.json",
-    "dev": "tsup src/index.ts src/renderer.ts --format esm,cjs --dts --watch --tsconfig tsconfig.json",
+    "build": "tsup src/index.ts --format esm,cjs --dts --clean --tsconfig tsconfig.json",
+    "dev": "tsup src/index.ts --format esm,cjs --dts --watch --tsconfig tsconfig.json",
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit -p tsconfig.typecheck.json"

package/src/generators/reactor.ts

@@ -60,6 +60,14 @@ function getReactorClassImportSource(
     case "CandidDisplayReactor":
     case "MetadataDisplayReactor":
       return "@ic-reactor/candid"
+    default:
+      // The pipeline validates `mode` against a closed set before we are
+      // reached. Failing closed here means a caller that skips validation gets
+      // an error rather than an unknown class name interpolated into source.
+      throw new Error(
+        `Unknown reactor class ${JSON.stringify(reactorClass)}. Expected one of: ` +
+          `Reactor, DisplayReactor, CandidReactor, CandidDisplayReactor, MetadataDisplayReactor.`
+      )
   }
 }
 
@@ -105,9 +113,12 @@ export const {
 `
       : ""
 
-  return `${runtimeTarget === "react" ? 'import { createActorHooks } from "@ic-reactor/react"\n' : ""}import { ${reactorClass} } from "${reactorImportSource}"
-import { clientManager } from "${clientManagerPath}"
-import { idlFactory, type _SERVICE } from "${declarationsPath}"
+  // Every interpolation into emitted source is JSON.stringify'd. The pipeline
+  // validates these values before we are called; quoting them here as well
+  // means a future caller that skips validation cannot inject source text.
+  return `${runtimeTarget === "react" ? 'import { createActorHooks } from "@ic-reactor/react"\n' : ""}import { ${reactorClass} } from ${JSON.stringify(reactorImportSource)}
+import { clientManager } from ${JSON.stringify(clientManagerPath)}
+import { idlFactory, type _SERVICE } from ${JSON.stringify(declarationsPath)}
 
 export type ${serviceName} = _SERVICE
 
@@ -123,7 +134,7 @@ export type ${serviceName} = _SERVICE
 export const ${reactorName} = new ${reactorClass}<${serviceName}>({
   clientManager,
   idlFactory,
-${canisterIdLine}  name: "${canisterName}",
+${canisterIdLine}  name: ${JSON.stringify(canisterName)},
 })${hookExports || "\n"}`
 }