@pauldvlp/vp-pkg-shadcn 0.5.0 → 0.5.1

package/dist/index.js

@@ -101,6 +101,16 @@ function addIconDeps(pkg, iconLibrary) {
   const iconDeps = ICON_LIBS[iconLibrary] ?? ICON_LIBS.hugeicons;
   pkg.dependencies = { ...pkg.dependencies, ...iconDeps };
 }
+function validateScope(value) {
+  return /^@?[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(value.trim()) ? void 0 : "must be a package scope/name, e.g. @acme";
+}
+function validatePreset(value) {
+  return /^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(value.trim()) ? void 0 : "must be a style name or ui.shadcn.com code";
+}
+function validateComponents(value) {
+  const parts = value.split(",").map((c) => c.trim()).filter(Boolean);
+  return parts.every((c) => /^[a-z0-9][a-z0-9-]*$/.test(c)) ? void 0 : "comma-separated component names, e.g. button,card,dialog";
+}
 function withRequiredComponents(csv, required = ["button", "badge"]) {
   const requested = csv.split(",").map((c) => c.trim()).filter(Boolean);
   return Array.from(/* @__PURE__ */ new Set([...required, ...requested]));
@@ -125,30 +135,36 @@ function uiComponentsJson(theme) {
     }
   };
 }
-function shadcnInitFlags(opts) {
+function shadcnInitArgs(opts) {
   return [
-    `--base ${opts.base}`,
-    `--preset ${opts.preset}`,
+    "--base",
+    opts.base,
+    "--preset",
+    opts.preset,
     opts.cssVariables ? "--css-variables" : "--no-css-variables",
     opts.rtl ? "--rtl" : "--no-rtl",
     opts.pointer ? "--pointer" : "--no-pointer",
     "--no-reinstall",
     "-y",
     "-f"
-  ].join(" ");
+  ];
 }
 function defineTemplate(config) {
   return config;
 }
-function writeTree(node, dir) {
+function writeTree(node, dir, root = path.resolve(dir)) {
   for (const [name, value] of Object.entries(node)) {
-    const p = path.join(dir, name);
+    const p = path.resolve(dir, name);
+    const rel = path.relative(root, p);
+    if (rel === "" || rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
+      throw new Error(`Refusing to write outside the target directory: ${name}`);
+    }
     if (typeof value === "string") {
       fs.mkdirSync(path.dirname(p), { recursive: true });
       fs.writeFileSync(p, value);
     } else {
       fs.mkdirSync(p, { recursive: true });
-      writeTree(value, p);
+      writeTree(value, p, root);
     }
   }
 }
@@ -288,8 +304,9 @@ async function runTemplateCLI(template) {
   writeTree(creation.files, directory);
   if (creation.scripts?.length) {
     for (const step of [...creation.scripts].sort((a, b) => a.phase - b.phase)) {
-      for (const command of step.commands) {
-        execFileSync(command, { cwd: directory, stdio: "inherit", shell: true });
+      for (const [program, ...commandArgs] of step.commands) {
+        if (!program) continue;
+        execFileSync(program, commandArgs, { cwd: directory, stdio: "inherit" });
       }
     }
   }
@@ -302,75 +319,31 @@ async function runTemplateCLI(template) {
 }
 
 // src/template.ts
+import { readFileSync } from "node:fs";
 import path2 from "node:path";
 import { fileURLToPath } from "node:url";
-
-// package.json
-var package_default = {
-  name: "@pauldvlp/vp-pkg-shadcn",
-  version: "0.5.0",
-  description: "Add a shared, fully customizable shadcn UI package (packages/ui) into an existing Vite+ monorepo, themeable via shadcn presets.",
-  author: "pauldvlp (https://github.com/pauldvlp/vp-templates)",
-  license: "MIT",
-  homepage: "https://github.com/pauldvlp/vp-templates",
-  repository: {
-    type: "git",
-    url: "git+https://github.com/pauldvlp/vp-templates.git",
-    directory: "packages/vp-pkg-shadcn"
-  },
-  bugs: "https://github.com/pauldvlp/vp-templates/issues",
-  keywords: [
-    "vite-plus-generator",
-    "vite-plus",
-    "shadcn",
-    "react",
-    "template"
-  ],
-  bin: "./dist/index.js",
-  type: "module",
-  files: [
-    "dist",
-    "template"
-  ],
-  scripts: {
-    build: "esbuild bin/index.ts --bundle --outfile=dist/index.js --format=esm --platform=node --target=node22 --packages=external",
-    dev: "node bin/index.ts",
-    prepack: "pnpm run build"
-  },
-  dependencies: {
-    "@clack/prompts": "^1.6.0"
-  },
-  devDependencies: {
-    "@pauldvlp/template-kit": "workspace:*",
-    "@types/node": "^24",
-    esbuild: "^0.25.0",
-    typescript: "^5"
-  },
-  engines: {
-    node: ">=22.18.0"
-  }
-};
-
-// src/template.ts
 var TEMPLATE_DIR = path2.join(path2.dirname(fileURLToPath(import.meta.url)), "..", "template");
+var { name: pkgName, description: pkgDescription } = JSON.parse(
+  readFileSync(new URL("../package.json", import.meta.url), "utf8")
+);
 var template_default = defineTemplate({
   about: {
-    name: package_default.name,
-    description: package_default.description
+    name: pkgName,
+    description: pkgDescription
   },
   // This generator drops a package into an *existing* repo, so it must never create a git repo of its own.
   git: false,
   options: [
     // Default the scope to the surrounding monorepo's scope (e.g. `@acme`) so it tracks the repo
     // instead of a fixed `@app`. Falls back to `@app` when run outside a pnpm workspace.
-    { key: "scope", type: "string", message: "npm scope for the workspace package, e.g. @acme", default: () => detectMonorepoScope() ?? "@app" },
+    { key: "scope", type: "string", message: "npm scope for the workspace package, e.g. @acme", default: () => detectMonorepoScope() ?? "@app", validate: validateScope },
     { key: "base", type: "select", message: "shadcn component library base (radix-ui or @base-ui)", choices: ["radix", "base"], default: "radix" },
-    { key: "preset", type: "string", message: "shadcn preset: a style name (nova, vega, maia, lyra, mira, luma, sera, rhea) or a code from ui.shadcn.com", default: DEFAULT_PRESET },
+    { key: "preset", type: "string", message: "shadcn preset: a style name (nova, vega, maia, lyra, mira, luma, sera, rhea) or a code from ui.shadcn.com", default: DEFAULT_PRESET, validate: validatePreset },
     { key: "iconLibrary", type: "select", message: "Icon library", choices: ["lucide", "hugeicons", "radix", "tabler"], default: "hugeicons" },
     { key: "cssVariables", type: "boolean", message: "Use CSS variables for theming", default: true },
     { key: "rtl", type: "boolean", message: "Enable RTL support", default: false },
     { key: "pointer", type: "boolean", message: "Use pointer cursor on interactive elements", default: false },
-    { key: "components", type: "string", message: "Comma-separated shadcn components to pre-install, e.g. button,card,dialog", default: "button,badge" },
+    { key: "components", type: "string", message: "Comma-separated shadcn components to pre-install, e.g. button,card,dialog", default: "button,badge", validate: validateComponents },
     { key: "install", type: "boolean", message: "Install deps and apply the shadcn theme after scaffolding", default: true }
   ],
   async produce({ options }) {
@@ -384,11 +357,11 @@ var template_default = defineTemplate({
 `);
     const adds = withRequiredComponents(options.components);
     const ui = `${scope}/ui`;
-    const initFlags = shadcnInitFlags(options);
+    const initArgs = shadcnInitArgs(options);
     const scripts = options.install ? [
-      { commands: ["pnpm install --silent"], phase: 0 },
-      { commands: [`pnpm --filter ${ui} exec shadcn init ${initFlags}`], phase: 1 },
-      { commands: [`pnpm --filter ${ui} exec shadcn add ${adds.join(" ")} -y`], phase: 2 }
+      { commands: [["pnpm", "install", "--silent"]], phase: 0 },
+      { commands: [["pnpm", "--filter", ui, "exec", "shadcn", "init", ...initArgs]], phase: 1 },
+      { commands: [["pnpm", "--filter", ui, "exec", "shadcn", "add", ...adds, "-y"]], phase: 2 }
     ] : [];
     return {
       files,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pauldvlp/vp-pkg-shadcn",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Add a shared, fully customizable shadcn UI package (packages/ui) into an existing Vite+ monorepo, themeable via shadcn presets.",
   "author": "pauldvlp (https://github.com/pauldvlp/vp-templates)",
   "license": "MIT",