@pantoken/cli 0.1.8 → 0.1.10

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { mkdirSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, join, relative, resolve } from "node:path";
 import { generateAndroid } from "@pantoken/android";
 import { generateCompose } from "@pantoken/compose";
 import { generateFlutter } from "@pantoken/flutter";
@@ -44,6 +44,51 @@ const SUPPORTED = /* @__PURE__ */ new Set([
 	"mintlify"
 ]);
 const PLANNED = /* @__PURE__ */ new Set();
+const VALID_THEMES = /* @__PURE__ */ new Set([
+	"rebrand",
+	"canvas",
+	"canvasHighContrast"
+]);
+const KNOWN_FLAGS = /* @__PURE__ */ new Set([
+	"out",
+	"theme",
+	"class",
+	"icons",
+	"format",
+	"no-scope",
+	"no-important",
+	"no-prune"
+]);
+const VALID_CLASS_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+const RUST_FORMATS = /* @__PURE__ */ new Set(["egui", "iced"]);
+/** Write an array of path+content assets into `outDir`, creating intermediate directories. */
+function writeAssets(outDir, assets) {
+	for (const asset of assets) {
+		const file = join(outDir, asset.path);
+		mkdirSync(dirname(file), { recursive: true });
+		writeFileSync(file, asset.content);
+		console.log(`✓ pantoken: wrote ${file}`);
+	}
+}
+/** Parse argv into positionals and a validated flags record; throw on unknown flags. */
+function parseFlags(argv) {
+	const positionals = [];
+	const flags = {};
+	for (let i = 0; i < argv.length; i++) {
+		const arg = argv[i];
+		if (arg.startsWith("--")) {
+			const key = arg.slice(2);
+			const next = argv[i + 1];
+			if (!KNOWN_FLAGS.has(key)) throw new Error(`Unknown flag "--${key}". Run pantoken generate --help for usage.`);
+			if (next === void 0 || next.startsWith("--")) flags[key] = "true";
+			else flags[key] = argv[++i];
+		} else positionals.push(arg);
+	}
+	return {
+		positionals,
+		flags
+	};
+}
 /**
 * Parse `generate <target> [--out dir] [--theme t] [--class Name]`.
 *
@@ -66,22 +111,17 @@ const PLANNED = /* @__PURE__ */ new Set();
 * ```
 */
 function parseArgs(argv) {
-	const positionals = [];
-	const flags = {};
-	for (let i = 0; i < argv.length; i++) {
-		const arg = argv[i];
-		if (arg.startsWith("--")) {
-			const next = argv[i + 1];
-			if (next === void 0 || next.startsWith("--")) flags[arg.slice(2)] = "true";
-			else flags[arg.slice(2)] = argv[++i];
-		} else positionals.push(arg);
-	}
+	const { positionals, flags } = parseFlags(argv);
+	const theme = flags.theme ?? "rebrand";
+	if (!VALID_THEMES.has(theme)) throw new Error(`Unknown theme "${theme}". Valid themes: ${[...VALID_THEMES].join(", ")}.`);
+	const className = flags.class ?? "PanTokens";
+	if (!VALID_CLASS_RE.test(className)) throw new Error(`Invalid class name "${className}". Must be a valid identifier.`);
 	return {
 		command: positionals[0] ?? "",
 		target: positionals[1] ?? "",
 		out: flags.out ?? "./pantoken-out",
-		theme: flags.theme ?? "rebrand",
-		className: flags.class ?? "PanTokens",
+		theme,
+		className,
 		icons: flags.icons ? flags.icons.split(",").filter(Boolean) : void 0,
 		format: flags.format,
 		noScope: "no-scope" in flags,
@@ -171,16 +211,12 @@ function runMintlify(args) {
 }
 /** Write the Drupal theme assets. */
 function runDrupal(args) {
-	for (const asset of toDrupalTheme()) {
-		const file = join(args.out, asset.path);
-		mkdirSync(dirname(file), { recursive: true });
-		writeFileSync(file, asset.content);
-		console.log(`✓ pantoken: wrote ${file}`);
-	}
+	writeAssets(args.out, toDrupalTheme());
 }
 /** Write the Rust token source for the egui or iced format. */
 function runRust(args) {
-	const format = args.format === "iced" ? "iced" : "egui";
+	const format = args.format ?? "egui";
+	if (!RUST_FORMATS.has(format)) throw new Error(`Unknown Rust format "${format}". Use egui or iced.`);
 	const file = args.out.includes(".") ? args.out : join(args.out, "tokens.rs");
 	mkdirSync(dirname(file), { recursive: true });
 	writeFileSync(file, generateRust({
@@ -228,13 +264,7 @@ async function runIconFont(args) {
 }
 /** Write the Jekyll or Hugo static-site assets (same asset shape, different source). */
 function runStaticSite(args) {
-	const assets = args.target === "jekyll" ? toJekyllAssets() : toHugoAssets();
-	for (const asset of assets) {
-		const file = join(args.out, asset.path);
-		mkdirSync(dirname(file), { recursive: true });
-		writeFileSync(file, asset.content);
-		console.log(`✓ pantoken: wrote ${file}`);
-	}
+	writeAssets(args.out, args.target === "jekyll" ? toJekyllAssets() : toHugoAssets());
 }
 /** Write the Pendo `global.css`, honouring the `--no-scope`/`--no-important`/`--no-prune` flags. */
 function runPendo(args) {
@@ -248,6 +278,10 @@ function runPendo(args) {
 	}));
 	console.log(`✓ pantoken: wrote ${file}`);
 }
+/** Warn when the resolved output path escapes cwd — guards against accidental ../traversal. */
+function warnIfUnsafePath(out) {
+	if (relative(process.cwd(), resolve(out)).startsWith("..")) console.warn(`⚠️ pantoken: output path "${out}" escapes the current directory.`);
+}
 /**
 * Run the CLI.
 *
@@ -269,6 +303,7 @@ function runPendo(args) {
 async function run(argv) {
 	const args = parseArgs(argv);
 	assertGenerateTarget(args);
+	warnIfUnsafePath(args.out);
 	if (args.target === "swift") return runSwift(args);
 	if (args.target === "android") return runAndroid(args);
 	if (args.target === "compose") return runCompose(args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pantoken/cli",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "pantoken generate <target> — emit native design-token source (Swift now; Kotlin/Dart/Drupal to follow).",
   "homepage": "https://pantoken.iywahl.com",
   "bugs": "https://github.com/thedannywahl/pantoken/issues",