@pauldvlp/vp-react-ts-nestjs 0.2.0 → 0.2.1

package/dist/index.js

@@ -42,18 +42,28 @@ function patchJson(tree, relPath, mutate) {
   node[key] = `${JSON.stringify(json, null, 2)}
 `;
 }
+function validateScope(value) {
+  return /^@?[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(value.trim()) ? void 0 : "must be a package scope/name, e.g. @acme";
+}
+function validateName(value) {
+  return /^@?[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(value.trim()) ? void 0 : "must be a package name, e.g. my-app or @acme/app";
+}
 function defineTemplate(config) {
   return config;
 }
-function writeTree(node, dir) {
+function writeTree(node, dir, root = path.resolve(dir)) {
   for (const [name, value] of Object.entries(node)) {
-    const p = path.join(dir, name);
+    const p = path.resolve(dir, name);
+    const rel = path.relative(root, p);
+    if (rel === "" || rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
+      throw new Error(`Refusing to write outside the target directory: ${name}`);
+    }
     if (typeof value === "string") {
       fs.mkdirSync(path.dirname(p), { recursive: true });
       fs.writeFileSync(p, value);
     } else {
       fs.mkdirSync(p, { recursive: true });
-      writeTree(value, p);
+      writeTree(value, p, root);
     }
   }
 }
@@ -193,8 +203,9 @@ async function runTemplateCLI(template) {
   writeTree(creation.files, directory);
   if (creation.scripts?.length) {
     for (const step of [...creation.scripts].sort((a, b) => a.phase - b.phase)) {
-      for (const command of step.commands) {
-        execFileSync(command, { cwd: directory, stdio: "inherit", shell: true });
+      for (const [program, ...commandArgs] of step.commands) {
+        if (!program) continue;
+        execFileSync(program, commandArgs, { cwd: directory, stdio: "inherit" });
       }
     }
   }
@@ -207,60 +218,16 @@ async function runTemplateCLI(template) {
 }
 
 // src/template.ts
+import { readFileSync } from "node:fs";
 import path2 from "node:path";
 import { fileURLToPath } from "node:url";
-
-// package.json
-var package_default = {
-  name: "@pauldvlp/vp-react-ts-nestjs",
-  version: "0.2.0",
-  description: "Vite+ monorepo template: a React web app + a NestJS api (conformed to the Vite+ toolchain) sharing Zod contracts.",
-  author: "pauldvlp (https://github.com/pauldvlp/vp-templates)",
-  license: "MIT",
-  homepage: "https://github.com/pauldvlp/vp-templates",
-  repository: {
-    type: "git",
-    url: "git+https://github.com/pauldvlp/vp-templates.git",
-    directory: "packages/vp-react-ts-nestjs"
-  },
-  bugs: "https://github.com/pauldvlp/vp-templates/issues",
-  keywords: [
-    "vite-plus-generator",
-    "vite-plus",
-    "nestjs",
-    "react",
-    "template"
-  ],
-  bin: "./dist/index.js",
-  type: "module",
-  files: [
-    "dist",
-    "template"
-  ],
-  scripts: {
-    build: "esbuild bin/index.ts --bundle --outfile=dist/index.js --format=esm --platform=node --target=node22 --packages=external",
-    dev: "node bin/index.ts",
-    prepack: "pnpm run build"
-  },
-  dependencies: {
-    "@clack/prompts": "^1.6.0"
-  },
-  devDependencies: {
-    "@pauldvlp/template-kit": "workspace:*",
-    "@types/node": "^24",
-    esbuild: "^0.25.0",
-    typescript: "^5"
-  },
-  engines: {
-    node: ">=22.18.0"
-  }
-};
-
-// src/template.ts
 function validatePort(value) {
   return /^\d+$/.test(value) && Number(value) > 0 && Number(value) < 65536 ? void 0 : "must be a number between 1 and 65535";
 }
 var TEMPLATE_DIR = path2.join(path2.dirname(fileURLToPath(import.meta.url)), "..", "template");
+var { name: pkgName, description: pkgDescription } = JSON.parse(
+  readFileSync(new URL("../package.json", import.meta.url), "utf8")
+);
 var MAIN_TS = path2.join("apps", "api", "src", "main.ts");
 var SWAGGER_IMPORT = "import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger'";
 var APP_MODULE = path2.join("apps", "api", "src", "app.module.ts");
@@ -277,15 +244,15 @@ function applyDocBlock(text2, tag, keep) {
 }
 var template_default = defineTemplate({
   about: {
-    name: package_default.name,
-    description: package_default.description
+    name: pkgName,
+    description: pkgDescription
   },
   options: [
     // Default the name to the target directory the user chose, so they don't retype it.
-    { key: "name", type: "string", message: "Root project / package name", default: ({ directory }) => dirName(directory) },
+    { key: "name", type: "string", message: "Root project / package name", default: ({ directory }) => dirName(directory), validate: validateName },
     // Lazily default the package scope to `@<name>` (prefixing `@` unless the name already has one),
     // so it tracks the project name instead of a fixed value. Falls back to `@app` when no name is set.
-    { key: "scope", type: "string", message: "npm scope for workspace packages, e.g. @acme (defaults to @<name>)", default: ({ options }) => options.name ? toScope(options.name) : "@app" },
+    { key: "scope", type: "string", message: "npm scope for workspace packages, e.g. @acme (defaults to @<name>)", default: ({ options }) => options.name ? toScope(options.name) : "@app", validate: validateScope },
     // Ports stay strings (validated as integers): they're only ever substituted into config files as text.
     { key: "apiPort", type: "string", message: "Port the NestJS api listens on", default: "3000", validate: validatePort },
     { key: "webPort", type: "string", message: "Port the web dev server listens on", default: "5173", validate: validatePort },
@@ -327,7 +294,7 @@ var template_default = defineTemplate({
       delete files[".dockerignore"];
       delete files.apps.api["Dockerfile"];
     }
-    const scripts = options.install ? [{ commands: ["pnpm install --silent"], phase: 0 }] : [];
+    const scripts = options.install ? [{ commands: [["pnpm", "install", "--silent"]], phase: 0 }] : [];
     return {
       files,
       scripts,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pauldvlp/vp-react-ts-nestjs",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Vite+ monorepo template: a React web app + a NestJS api (conformed to the Vite+ toolchain) sharing Zod contracts.",
   "author": "pauldvlp (https://github.com/pauldvlp/vp-templates)",
   "license": "MIT",