@reapit/elements 5.0.0-beta.71 → 5.0.0-beta.73

package/codemods/bin.ts

@@ -1,205 +0,0 @@
-import { run } from './runner.ts'
-import { listCodemods, getCodemodDescription, getCodemodReadme, validateCodemodName } from './codemods.ts'
-import { parseFrontMatter } from './readme-parser.ts'
-
-function printHelp(): void {
-  console.log(`
-Usage: yarn dlx @reapit/elements@beta codemod <command> [options]
-
-Commands:
-  list                    List available codemods
-  info <name>             Show detailed info about a codemod
-  apply <name> <dir>      Apply a codemod to a directory
-
-Options:
-  --help, -h              Show this help message
-
-Examples:
-  yarn dlx @reapit/elements@beta codemod list
-  yarn dlx @reapit/elements@beta codemod info at-a-glance-article-card
-  yarn dlx @reapit/elements@beta codemod apply at-a-glance-article-card src/
-  yarn dlx @reapit/elements@beta codemod apply at-a-glance-article-card src/ --dry-run
-`)
-}
-
-function printApplyHelp(codemodName: string): void {
-  console.log(`
-Usage: yarn dlx @reapit/elements@beta codemod apply ${codemodName} <directory> [options]
-
-Arguments:
-  <directory>             Directory to search for files to transform
-
-Options:
-  --ext <extensions>      File extensions to process (default: .tsx,.ts,.jsx,.js)
-  --facade-package <pkg>  Package name that re-exports @reapit/elements
-  --dry-run, -d           Preview changes without writing files
-  --help, -h              Show this help message
-
-Examples:
-  yarn dlx @reapit/elements@beta codemod apply ${codemodName} src/
-  yarn dlx @reapit/elements@beta codemod apply ${codemodName} src/ --dry-run
-  yarn dlx @reapit/elements@beta codemod apply ${codemodName} src/ --ext .tsx,.jsx
-  yarn dlx @reapit/elements@beta codemod apply ${codemodName} src/ --facade-package @company/ui-components
-`)
-}
-
-function printList(): void {
-  const codemods = listCodemods()
-
-  if (codemods.length === 0) {
-    console.log('No codemods available.')
-    return
-  }
-
-  console.log('\nAvailable codemods:\n')
-
-  // Calculate padding for alignment
-  const maxNameLength = Math.max(...codemods.map((name) => name.length))
-
-  for (const name of codemods) {
-    const description = getCodemodDescription(name)
-    const padding = ' '.repeat(maxNameLength - name.length + 4)
-    if (description) {
-      console.log(`  ${name}${padding}${description}`)
-    } else {
-      console.log(`  ${name}`)
-    }
-  }
-
-  console.log("\nRun 'yarn dlx @reapit/elements@beta codemod info <name>' for more details.")
-}
-
-function printInfo(name: string): void {
-  // Security: Validate codemod name against manifest before any operations
-  // This prevents path traversal attacks by ensuring only known codemods are accessed
-  // validateCodemodName() checks against CODEMOD_NAMES, a compile-time constant array
-  const sanitizedName = validateCodemodName(name)
-
-  if (!sanitizedName) {
-    console.error(`Error: Unknown codemod '${name}'`)
-    printAvailableCodemods()
-    process.exit(1)
-  }
-
-  // SECURITY: sanitizedName is guaranteed to be a valid CodemodName from the static manifest
-  // It cannot contain path traversal sequences (e.g., '../') as it's validated against CODEMOD_NAMES
-  const readme = getCodemodReadme(sanitizedName)
-
-  if (!readme) {
-    console.log(`No documentation available for codemod '${sanitizedName}'.`)
-    return
-  }
-
-  const { body } = parseFrontMatter(readme)
-  console.log(body)
-}
-
-function printAvailableCodemods(): void {
-  const codemods = listCodemods()
-
-  if (codemods.length === 0) {
-    console.log('No codemods available.')
-    return
-  }
-
-  console.log('\nAvailable codemods:')
-
-  const maxNameLength = Math.max(...codemods.map((name) => name.length))
-
-  for (const name of codemods) {
-    const description = getCodemodDescription(name)
-    const padding = ' '.repeat(maxNameLength - name.length + 4)
-    if (description) {
-      console.log(`  ${name}${padding}${description}`)
-    } else {
-      console.log(`  ${name}`)
-    }
-  }
-}
-
-async function handleApply(args: string[]): Promise<void> {
-  const codemodName = args[0]
-
-  if (!codemodName || codemodName.startsWith('-')) {
-    console.error('Error: No codemod name provided')
-    console.log('\nUsage: yarn dlx @reapit/elements@beta codemod apply <name> <directory> [options]')
-    console.log("\nRun 'yarn dlx @reapit/elements@beta codemod list' to see available codemods.")
-    process.exit(1)
-  }
-
-  // Security: Sanitize codemod name by validating it against the allowlist
-  // This prevents path traversal attacks in the dynamic import below
-  const sanitizedCodemodName = validateCodemodName(codemodName)
-
-  if (!sanitizedCodemodName) {
-    console.error(`Error: Unknown codemod '${codemodName}'`)
-    printAvailableCodemods()
-    process.exit(1)
-  }
-
-  const remainingArgs = args.slice(1)
-
-  // Handle help for specific codemod
-  if (remainingArgs.includes('--help') || remainingArgs.includes('-h')) {
-    printApplyHelp(sanitizedCodemodName)
-    process.exit(0)
-  }
-
-  // Load and run the codemod
-  const codemodModule = await import(`./${sanitizedCodemodName}/transform.ts`)
-  const transform = codemodModule.default
-
-  if (typeof transform !== 'function') {
-    console.error(`Error: Codemod '${codemodName}' does not export a default transform function`)
-    process.exit(1)
-  }
-
-  await run({
-    transform,
-    codemodName: sanitizedCodemodName,
-    args: remainingArgs,
-  })
-}
-
-async function main(): Promise<void> {
-  const args = process.argv.slice(2)
-  const command = args[0]
-
-  // Handle no command or help
-  if (!command || command === '--help' || command === '-h') {
-    printHelp()
-    process.exit(0)
-  }
-
-  switch (command) {
-    case 'list':
-      printList()
-      break
-
-    case 'info': {
-      const name = args[1]
-      if (!name || name.startsWith('-')) {
-        console.error('Error: No codemod name provided')
-        console.log('\nUsage: yarn dlx @reapit/elements@beta codemod info <name>')
-        console.log("\nRun 'yarn dlx @reapit/elements@beta codemod list' to see available codemods.")
-        process.exit(1)
-      }
-      printInfo(name)
-      break
-    }
-
-    case 'apply':
-      await handleApply(args.slice(1))
-      break
-
-    default:
-      console.error(`Error: Unknown command '${command}'`)
-      printHelp()
-      process.exit(1)
-  }
-}
-
-main().catch((error: Error) => {
-  console.error('Error:', error.message)
-  process.exit(1)
-})

package/codemods/codemods.ts

@@ -1,75 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { join, dirname } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-// Get current directory for loading manifest
-const __filename = fileURLToPath(import.meta.url)
-const __dirname = dirname(__filename)
-
-// Type definitions for the manifest
-export interface CodemodMetadata {
-  readonly name: string
-  readonly description: string | null
-}
-
-interface Manifest {
-  codemods: CodemodMetadata[]
-}
-
-// Load manifest from JSON file
-const manifestPath = join(__dirname, 'manifest.json')
-const manifestData = JSON.parse(readFileSync(manifestPath, 'utf-8')) as Manifest
-
-export const AVAILABLE_CODEMODS: readonly CodemodMetadata[] = manifestData.codemods
-export const CODEMOD_NAMES: readonly string[] = manifestData.codemods.map((c) => c.name)
-export type CodemodName = (typeof CODEMOD_NAMES)[number]
-
-/**
- * Returns available codemods from the generated manifest.
- *
- * @returns Array of codemod names
- */
-export function listCodemods(): string[] {
-  return CODEMOD_NAMES.slice() // Return copy to prevent mutation
-}
-
-/**
- * Retrieves the README content for a specific codemod.
- * SECURITY: This function should only be called with a validated CodemodName from validateCodemodName().
- * The name parameter is guaranteed to be from the static manifest, preventing path traversal.
- *
- * @param name - The validated codemod name (must come from validateCodemodName())
- * @returns The README content, or null if not found
- */
-export function getCodemodReadme(name: CodemodName | string): string | null {
-  try {
-    // SECURITY NOTE: The 'name' parameter has been validated against the static manifest
-    // via validateCodemodName() before reaching this function. Only names from CODEMOD_NAMES
-    // (a compile-time constant array) can be passed here, preventing path traversal attacks.
-    return readFileSync(join(__dirname, name, 'README.md'), 'utf-8')
-  } catch {
-    return null
-  }
-}
-
-/**
- * Retrieves the description from the manifest for a specific codemod.
- *
- * @param name - The codemod name
- * @returns The description, or null if not found
- */
-export function getCodemodDescription(name: string): string | null {
-  const metadata = AVAILABLE_CODEMODS.find((c) => c.name === name)
-  return metadata?.description ?? null
-}
-
-/**
- * Validates that a codemod exists in the manifest.
- * Returns the sanitized name to prevent path traversal attacks.
- *
- * @param name - The codemod name to validate
- * @returns The sanitized codemod name, or null if invalid
- */
-export function validateCodemodName(name: string): CodemodName | null {
-  return CODEMOD_NAMES.includes(name as CodemodName) ? (name as CodemodName) : null
-}

package/codemods/generate-manifest.ts

@@ -1,120 +0,0 @@
-import { dirname, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs'
-import { parseFrontMatter } from './readme-parser.ts'
-import { styleText } from 'node:util'
-
-const __filename = fileURLToPath(import.meta.url)
-const __dirname = dirname(__filename)
-
-interface CodemodMetadata {
-  name: string
-  description: string | null
-}
-
-/**
- * Discovers available codemods by scanning for directories with transform.ts files.
- * Exported for testing.
- *
- * @param codemodDir - The directory to scan for codemods
- * @returns Array of codemod names sorted alphabetically
- */
-export function discoverCodemods(codemodDir: string): string[] {
-  try {
-    const entries = readdirSync(codemodDir, { withFileTypes: true })
-
-    return entries
-      .filter((entry) => {
-        if (!entry.isDirectory()) return false
-        // Skip special directories
-        if (entry.name === 'node_modules' || entry.name === '__tests__' || entry.name.startsWith('.')) {
-          return false
-        }
-        // Check if directory contains a transform.ts file
-        try {
-          statSync(join(codemodDir, entry.name, 'transform.ts'))
-          return true
-        } catch {
-          return false
-        }
-      })
-      .map((entry) => entry.name)
-      .sort() // Sort alphabetically for consistent output
-  } catch {
-    return []
-  }
-}
-
-/**
- * Extracts metadata for a specific codemod from its README.
- * Exported for testing.
- *
- * @param codemodDir - The directory containing the codemod
- * @param name - The codemod name
- * @returns CodemodMetadata object
- */
-export function getCodemodMetadata(codemodDir: string, name: string): CodemodMetadata {
-  try {
-    const readmePath = join(codemodDir, name, 'README.md')
-    const readme = readFileSync(readmePath, 'utf-8')
-    const { description } = parseFrontMatter(readme)
-
-    return {
-      name,
-      description: description ?? null,
-    }
-  } catch (error) {
-    console.warn(
-      styleText('yellow', `Warning: Could not read README for codemod '${name}': ${(error as Error).message}`),
-    )
-    return {
-      name,
-      description: null,
-    }
-  }
-}
-
-/**
- * Generates the JSON manifest content.
- */
-function generateManifestContent(codemods: CodemodMetadata[]): string {
-  const manifest = {
-    $schema: './manifest.schema.json',
-    generated: new Date().toISOString(),
-    codemods: codemods.map((c) => ({
-      name: c.name,
-      description: c.description,
-    })),
-  }
-
-  return JSON.stringify(manifest, null, 2) + '\n'
-}
-
-/**
- * Main function to generate the manifest file.
- */
-function main(): void {
-  console.log('Generating codemod manifest...')
-
-  // Discover available codemods
-  const codemodNames = discoverCodemods(__dirname)
-  console.log(`Found ${codemodNames.length} codemod(s): ${codemodNames.join(', ')}`)
-
-  // Get metadata for each codemod
-  const codemods = codemodNames.map((name) => getCodemodMetadata(__dirname, name))
-
-  // Generate manifest content
-  const manifestContent = generateManifestContent(codemods)
-
-  // Write to file
-  const outputPath = join(__dirname, 'manifest.json')
-  writeFileSync(outputPath, manifestContent, 'utf-8')
-
-  console.log(styleText('green', `✓ Generated manifest at ${outputPath}`))
-  console.log(`  ${codemods.length} codemod(s) registered`)
-  console.log('\nTo regenerate this file, run: yarn generate:codemod-manifest')
-}
-
-if (import.meta.main) {
-  main()
-}

package/codemods/manifest.schema.json

@@ -1,39 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "Codemod Manifest",
-  "description": "Manifest file listing all available codemods with their metadata. Auto-generated by 'yarn generate:codemod-manifest'.",
-  "type": "object",
-  "required": ["codemods"],
-  "properties": {
-    "$schema": {
-      "type": "string",
-      "description": "JSON Schema reference"
-    },
-    "generated": {
-      "type": "string",
-      "format": "date-time",
-      "description": "Timestamp when this manifest was generated"
-    },
-    "codemods": {
-      "type": "array",
-      "description": "List of available codemods",
-      "items": {
-        "type": "object",
-        "required": ["name"],
-        "properties": {
-          "name": {
-            "type": "string",
-            "description": "Unique identifier for the codemod (must match directory name)",
-            "pattern": "^[a-z0-9-]+$"
-          },
-          "description": {
-            "type": ["string", "null"],
-            "description": "Brief description of what the codemod does (extracted from README front matter)"
-          }
-        },
-        "additionalProperties": false
-      }
-    }
-  },
-  "additionalProperties": false
-}

package/codemods/readme-parser.ts

@@ -1,37 +0,0 @@
-export interface FrontMatter {
-  description?: string
-  body: string
-}
-
-/**
- * Parses front matter from a markdown file.
- * Front matter should be in YAML format between --- delimiters.
- *
- * @param content - The raw markdown content
- * @returns Parsed front matter and body
- *
- * @example
- * ```
- * const content = `---
- * description: My description
- * ---
- * # My Content
- * `
- * const { description, body } = parseFrontMatter(content)
- * // description = "My description"
- * // body = "# My Content"
- * ```
- */
-export function parseFrontMatter(content: string): FrontMatter {
-  const match = content.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/)
-  if (!match) return { body: content }
-
-  const frontMatter = match[1]
-  const body = match[2]
-  const descMatch = frontMatter.match(/^description:\s*(.+)$/m)
-
-  return {
-    description: descMatch?.[1],
-    body: body.trim(),
-  }
-}

package/codemods/runner.ts

@@ -1,196 +0,0 @@
-import { readFileSync, writeFileSync, readdirSync, statSync } from 'node:fs'
-import { join, resolve, relative } from 'node:path'
-
-export type Transform = (source: string, filePath: string, options?: { facadePackage?: string }) => string
-
-export interface RunOptions {
-  transform: Transform
-  codemodName: string
-  args: string[]
-}
-
-/**
- * Validates that a path is safe and doesn't attempt directory traversal.
- * This prevents malicious paths like "../../../etc/passwd" from being accessed.
- *
- * @param basePath - The trusted base directory path
- * @param targetPath - The path to validate against the base
- * @returns true if the target path is within the base directory, false otherwise
- */
-function isPathSafe(basePath: string, targetPath: string): boolean {
-  const resolvedBase = resolve(basePath)
-  const resolvedTarget = resolve(targetPath)
-  const relativePath = relative(resolvedBase, resolvedTarget)
-
-  // Empty string means target === base, which is safe
-  if (relativePath === '') {
-    return true
-  }
-
-  // Check if relativePath tries to escape the base directory:
-  // - Starts with '..' means going up and out of base (e.g., '../../etc/passwd')
-  // - Starts with '/' means absolute Unix path (e.g., '/etc/passwd')
-  // - Windows cross-drive paths return absolute paths from relative() (e.g., 'C:\Windows')
-  return !relativePath.startsWith('..') && !relativePath.startsWith('/') && !/^[a-zA-Z]:[\\/]/.test(relativePath)
-}
-
-/**
- * Recursively finds files matching the given patterns within a directory.
- * Includes path traversal protection via isPathSafe validation.
- *
- * @param dir - The directory to search
- * @param patterns - File patterns to match (e.g., ["*.ts", "*.tsx"])
- * @param results - Accumulator for matching file paths
- * @returns Array of absolute paths to matching files
- */
-export function findFiles(dir: string, patterns: string[], results: string[] = []): string[] {
-  // readdirSync is safe here - dir is validated by isPathSafe, and entry names from filesystem are trusted
-  const entries = readdirSync(dir, { withFileTypes: true })
-
-  for (const entry of entries) {
-    const fullPath = join(dir, entry.name)
-
-    // Validate path safety to prevent directory traversal
-    if (!isPathSafe(dir, fullPath)) {
-      continue
-    }
-
-    // Skip node_modules and dist
-    if (entry.name === 'node_modules' || entry.name === 'dist') {
-      continue
-    }
-
-    if (entry.isDirectory()) {
-      findFiles(fullPath, patterns, results)
-    } else if (entry.isFile() && matchesPatterns(entry.name, patterns)) {
-      results.push(fullPath)
-    }
-  }
-
-  return results
-}
-
-export function matchesPatterns(filename: string, patterns: string[]): boolean {
-  return patterns.some((pattern) => {
-    // Security: Validate pattern to prevent ReDoS attacks
-    // Limit pattern length and check for excessive wildcards
-    if (pattern.length > 100 || (pattern.match(/\*/g) || []).length > 5) {
-      console.warn(`Warning: Skipping potentially unsafe pattern: ${pattern}`)
-      return false
-    }
-
-    // Simple pattern matching for common cases
-    if (pattern.startsWith('*.')) {
-      return filename.endsWith(pattern.slice(1))
-    }
-    if (pattern.includes('*')) {
-      // Additional protection: limit filename length to prevent catastrophic backtracking
-      // Even with wildcard limits, long filenames + multiple wildcards can cause issues
-      if (filename.length > 500) {
-        console.warn(`Warning: Filename too long for pattern matching: ${filename}`)
-        return false
-      }
-      const regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$')
-      return regex.test(filename)
-    }
-    return filename === pattern
-  })
-}
-
-function printUsage(codemodName: string): void {
-  console.log(`
-Usage: codemod apply ${codemodName} <directory> [options]
-
-Arguments:
-  <directory>         Directory to search for files to transform
-
-Options:
-  --ext <extensions>  File extensions to process (default: .tsx,.ts,.jsx,.js)
-  --facade-package <pkg>  Package name that re-exports @reapit/elements
-  --dry-run, -d       Preview changes without writing files
-  --help, -h          Show this help message
-
-Examples:
-  yarn dlx @reapit/elements codemod apply ${codemodName} src/
-  yarn dlx @reapit/elements codemod apply ${codemodName} src/ --dry-run
-  yarn dlx @reapit/elements codemod apply ${codemodName} src/ --ext .tsx,.jsx
-  yarn dlx @reapit/elements codemod apply ${codemodName} src/ --facade-package @company/ui-components
-`)
-}
-
-export async function run({ transform, codemodName, args }: RunOptions): Promise<void> {
-  if (args.length === 0 || args.includes('--help') || args.includes('-h')) {
-    printUsage(codemodName)
-    process.exit(0)
-  }
-
-  const dryRun = args.includes('--dry-run') || args.includes('-d')
-  const extIndex = args.indexOf('--ext')
-  const extensions = extIndex !== -1 ? args[extIndex + 1].split(',') : ['.tsx', '.ts', '.jsx', '.js']
-  const patterns = extensions.map((ext) => `*${ext}`)
-  const facadePackageIndex = args.indexOf('--facade-package')
-  const facadePackage = facadePackageIndex !== -1 ? args[facadePackageIndex + 1] : undefined
-
-  // Get directory argument (first non-flag argument, excluding --ext value if present)
-  const extValue = extIndex !== -1 ? args[extIndex + 1] : null
-  const facadePackageValue = facadePackageIndex !== -1 ? args[facadePackageIndex + 1] : null
-  const directory = args.find((arg) => !arg.startsWith('-') && arg !== extValue && arg !== facadePackageValue)
-
-  if (!directory) {
-    console.error('Error: No directory provided')
-    process.exit(1)
-  }
-
-  const cwd = process.cwd()
-  const resolvedDir = resolve(directory)
-
-  // Security: Validate path to prevent directory traversal attacks
-  // Use isPathSafe to ensure the resolved directory is within the current working directory
-  // This prevents accessing files outside the project (e.g., /etc/passwd, ../../../../sensitive-file)
-  if (!isPathSafe(cwd, resolvedDir)) {
-    console.error('Error: Directory path is outside the current working directory')
-    process.exit(1)
-  }
-
-  try {
-    // NOTE: Path traversal protection implemented above via isPathSafe validation
-    statSync(resolvedDir)
-  } catch {
-    console.error(`Error: Directory not found: ${directory}`)
-    process.exit(1)
-  }
-
-  // NOTE: Path traversal protection implemented via isPathSafe validation in findFiles
-  const files = findFiles(resolvedDir, patterns)
-
-  if (files.length === 0) {
-    console.log('No matching files found')
-    process.exit(0)
-  }
-
-  console.log(`Found ${files.length} file(s) to process${dryRun ? ' (dry run)' : ''}...\n`)
-
-  let transformedCount = 0
-
-  for (const filePath of files) {
-    try {
-      const source = readFileSync(filePath, 'utf-8')
-      const result = transform(source, filePath, facadePackage ? { facadePackage } : undefined)
-
-      if (result !== source) {
-        transformedCount++
-        const relativePath = filePath.replace(process.cwd() + '/', '')
-        console.log(`  ${dryRun ? 'Would transform' : 'Transformed'}: ${relativePath}`)
-
-        if (!dryRun) {
-          writeFileSync(filePath, result, 'utf-8')
-        }
-      }
-    } catch (error) {
-      const relativePath = filePath.replace(process.cwd() + '/', '')
-      console.error(`  Error processing ${relativePath}: ${(error as Error).message}`)
-    }
-  }
-
-  console.log(`\n${dryRun ? 'Would transform' : 'Transformed'} ${transformedCount} file(s)`)
-}