@sentientui/cli 0.2.3 → 0.2.4

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Carlos Sánchez Campos / SentientUI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.cjs

@@ -8,7 +8,7 @@ var __getOwnPropSymbols = Object.getOwnPropertySymbols;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __propIsEnum = Object.prototype.propertyIsEnumerable;
-var __defNormalProp = (obj, key2, value) => key2 in obj ? __defProp(obj, key2, { enumerable: true, configurable: true, writable: true, value }) : obj[key2] = value;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __spreadValues = (a, b) => {
   for (var prop in b || (b = {}))
     if (__hasOwnProp.call(b, prop))
@@ -20,11 +20,15 @@ var __spreadValues = (a, b) => {
     }
   return a;
 };
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
-    for (let key2 of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key2) && key2 !== except)
-        __defProp(to, key2, { get: () => from[key2], enumerable: !(desc = __getOwnPropDesc(from, key2)) || desc.enumerable });
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
   }
   return to;
 };
@@ -36,6 +40,23 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
   mod
 ));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  main: () => main,
+  parseArgs: () => parseArgs
+});
+module.exports = __toCommonJS(index_exports);
+
+// ../../node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.14_tsx@4.22.1_typescript@5.9.3_yaml@2.9.0/node_modules/tsup/assets/cjs_shims.js
+var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href;
+var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
+
+// src/index.ts
+var import_node_fs4 = require("fs");
+var import_node_url = require("url");
 
 // src/init.ts
 var import_node_child_process = require("child_process");
@@ -88,15 +109,25 @@ function installCommand(pm, pkgName) {
 var import_node_fs2 = require("fs");
 var import_node_path2 = __toESM(require("path"), 1);
 function envVarName(framework) {
-  return framework === "vite" ? "VITE_SENTIENT_API_KEY" : "NEXT_PUBLIC_SENTIENT_API_KEY";
+  switch (framework) {
+    case "cra":
+      return "REACT_APP_SENTIENT_API_KEY";
+    case "vite":
+    case "remix":
+      return "VITE_SENTIENT_API_KEY";
+    case "next-app":
+    case "next-pages":
+    case "unknown":
+      return "NEXT_PUBLIC_SENTIENT_API_KEY";
+  }
 }
-function writeEnvFile(cwd, framework, key2) {
+function writeEnvFile(cwd, framework, key) {
   const varName = envVarName(framework);
   const file = import_node_path2.default.join(cwd, ".env.local");
   const block = [
     "",
     "# SentientUI \u2014 leave empty for local mode (decisions are simulated on-device; nothing is sent)",
-    `${varName}=${key2 != null ? key2 : ""}`,
+    `${varName}=${key != null ? key : ""}`,
     ""
   ].join("\n");
   if (!(0, import_node_fs2.existsSync)(file)) {
@@ -205,7 +236,7 @@ createRoot(document.getElementById('root')!).render(
 import { AdaptiveProvider } from '@sentientui/react';
 
 // inside the Layout/App component body:
-<AdaptiveProvider apiKey="" context="landing">
+<AdaptiveProvider apiKey={import.meta.env.${envVar} ?? ''} context="landing">
   <Outlet />
 </AdaptiveProvider>`;
     case "cra":
@@ -236,11 +267,33 @@ function finale(framework) {
   return `open http://localhost:${port}?sentient_persona=buyer`;
 }
 
+// src/validate-key.ts
+function isPublishableKey(key) {
+  return key.startsWith("pk_");
+}
+function warnIfNotPublishableKey(key, log = (line) => console.warn(line)) {
+  if (!key || isPublishableKey(key)) return false;
+  const looksSecret = key.startsWith("sk_");
+  log("");
+  log("\u26A0  ============================ SECURITY WARNING ============================");
+  log(`\u26A0  The key you passed ("${key.slice(0, 6)}\u2026") is NOT a publishable pk_ key.`);
+  if (looksSecret) {
+    log("\u26A0  It looks like a SECRET server key (sk_\u2026). Do NOT ship it to the browser.");
+  }
+  log("\u26A0  This CLI writes the key into a CLIENT-exposed env var, so it is bundled");
+  log("\u26A0  into your site and visible to every visitor. Only publishable pk_ keys");
+  log("\u26A0  belong in client env. Get your pk_ key from the SentientUI dashboard.");
+  log("\u26A0  =======================================================================");
+  log("");
+  return true;
+}
+
 // src/init.ts
 function runInit(opts) {
   var _a, _b, _c;
   const log = (_a = opts.log) != null ? _a : ((line) => console.log(line));
-  const exec = (_b = opts.exec) != null ? _b : ((command2, cwd) => (0, import_node_child_process.execSync)(command2, { cwd, stdio: "inherit" }));
+  const exec = (_b = opts.exec) != null ? _b : ((command, cwd) => (0, import_node_child_process.execSync)(command, { cwd, stdio: "inherit" }));
+  warnIfNotPublishableKey(opts.key, log);
   const framework = detectFramework(opts.cwd);
   log(`[sentientui] detected framework: ${framework}`);
   if (framework === "unknown") {
@@ -270,25 +323,47 @@ function runInit(opts) {
 // src/index.ts
 function parseArgs(argv) {
   const args = [...argv];
-  const command2 = args.shift();
-  let key2;
+  const command = args.shift();
+  let key;
   for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--key") {
-      key2 = args[i + 1];
+    const arg = args[i];
+    if (arg === "--key") {
+      key = args[i + 1];
       i++;
+    } else if (arg.startsWith("--key=")) {
+      key = arg.slice("--key=".length);
+    }
+  }
+  return { command, key };
+}
+function main(argv) {
+  const { command, key } = parseArgs(argv);
+  if (command === "init") {
+    try {
+      runInit({ cwd: process.cwd(), key });
+    } catch (err) {
+      console.error(`[sentientui] init failed: ${String(err)}`);
+      process.exit(1);
     }
+  } else {
+    console.log("Usage: npx @sentientui/cli init [--key pk_...] [--yes]");
+    process.exit(command ? 1 : 0);
   }
-  return { command: command2, key: key2 };
 }
-var { command, key } = parseArgs(process.argv.slice(2));
-if (command === "init") {
+function isRunAsScript() {
   try {
-    runInit({ cwd: process.cwd(), key });
-  } catch (err) {
-    console.error(`[sentientui] init failed: ${String(err)}`);
-    process.exit(1);
+    const entry = process.argv[1];
+    if (!entry) return false;
+    return (0, import_node_fs4.realpathSync)((0, import_node_url.fileURLToPath)(importMetaUrl)) === (0, import_node_fs4.realpathSync)(entry);
+  } catch (e) {
+    return false;
   }
-} else {
-  console.log("Usage: npx @sentientui/cli init [--key pk_...] [--yes]");
-  process.exit(command ? 1 : 0);
 }
+if (isRunAsScript()) {
+  main(process.argv.slice(2));
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  main,
+  parseArgs
+});

package/dist/index.js

@@ -3,7 +3,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropSymbols = Object.getOwnPropertySymbols;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __propIsEnum = Object.prototype.propertyIsEnumerable;
-var __defNormalProp = (obj, key2, value) => key2 in obj ? __defProp(obj, key2, { enumerable: true, configurable: true, writable: true, value }) : obj[key2] = value;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __spreadValues = (a, b) => {
   for (var prop in b || (b = {}))
     if (__hasOwnProp.call(b, prop))
@@ -16,6 +16,10 @@ var __spreadValues = (a, b) => {
   return a;
 };
 
+// src/index.ts
+import { realpathSync } from "fs";
+import { fileURLToPath } from "url";
+
 // src/init.ts
 import { execSync } from "child_process";
 
@@ -67,15 +71,25 @@ function installCommand(pm, pkgName) {
 import { existsSync as existsSync2, readFileSync as readFileSync2, appendFileSync, writeFileSync } from "fs";
 import path2 from "path";
 function envVarName(framework) {
-  return framework === "vite" ? "VITE_SENTIENT_API_KEY" : "NEXT_PUBLIC_SENTIENT_API_KEY";
+  switch (framework) {
+    case "cra":
+      return "REACT_APP_SENTIENT_API_KEY";
+    case "vite":
+    case "remix":
+      return "VITE_SENTIENT_API_KEY";
+    case "next-app":
+    case "next-pages":
+    case "unknown":
+      return "NEXT_PUBLIC_SENTIENT_API_KEY";
+  }
 }
-function writeEnvFile(cwd, framework, key2) {
+function writeEnvFile(cwd, framework, key) {
   const varName = envVarName(framework);
   const file = path2.join(cwd, ".env.local");
   const block = [
     "",
     "# SentientUI \u2014 leave empty for local mode (decisions are simulated on-device; nothing is sent)",
-    `${varName}=${key2 != null ? key2 : ""}`,
+    `${varName}=${key != null ? key : ""}`,
     ""
   ].join("\n");
   if (!existsSync2(file)) {
@@ -184,7 +198,7 @@ createRoot(document.getElementById('root')!).render(
 import { AdaptiveProvider } from '@sentientui/react';
 
 // inside the Layout/App component body:
-<AdaptiveProvider apiKey="" context="landing">
+<AdaptiveProvider apiKey={import.meta.env.${envVar} ?? ''} context="landing">
   <Outlet />
 </AdaptiveProvider>`;
     case "cra":
@@ -215,11 +229,33 @@ function finale(framework) {
   return `open http://localhost:${port}?sentient_persona=buyer`;
 }
 
+// src/validate-key.ts
+function isPublishableKey(key) {
+  return key.startsWith("pk_");
+}
+function warnIfNotPublishableKey(key, log = (line) => console.warn(line)) {
+  if (!key || isPublishableKey(key)) return false;
+  const looksSecret = key.startsWith("sk_");
+  log("");
+  log("\u26A0  ============================ SECURITY WARNING ============================");
+  log(`\u26A0  The key you passed ("${key.slice(0, 6)}\u2026") is NOT a publishable pk_ key.`);
+  if (looksSecret) {
+    log("\u26A0  It looks like a SECRET server key (sk_\u2026). Do NOT ship it to the browser.");
+  }
+  log("\u26A0  This CLI writes the key into a CLIENT-exposed env var, so it is bundled");
+  log("\u26A0  into your site and visible to every visitor. Only publishable pk_ keys");
+  log("\u26A0  belong in client env. Get your pk_ key from the SentientUI dashboard.");
+  log("\u26A0  =======================================================================");
+  log("");
+  return true;
+}
+
 // src/init.ts
 function runInit(opts) {
   var _a, _b, _c;
   const log = (_a = opts.log) != null ? _a : ((line) => console.log(line));
-  const exec = (_b = opts.exec) != null ? _b : ((command2, cwd) => execSync(command2, { cwd, stdio: "inherit" }));
+  const exec = (_b = opts.exec) != null ? _b : ((command, cwd) => execSync(command, { cwd, stdio: "inherit" }));
+  warnIfNotPublishableKey(opts.key, log);
   const framework = detectFramework(opts.cwd);
   log(`[sentientui] detected framework: ${framework}`);
   if (framework === "unknown") {
@@ -247,27 +283,49 @@ function runInit(opts) {
 }
 
 // src/index.ts
+var import_meta = {};
 function parseArgs(argv) {
   const args = [...argv];
-  const command2 = args.shift();
-  let key2;
+  const command = args.shift();
+  let key;
   for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--key") {
-      key2 = args[i + 1];
+    const arg = args[i];
+    if (arg === "--key") {
+      key = args[i + 1];
       i++;
+    } else if (arg.startsWith("--key=")) {
+      key = arg.slice("--key=".length);
     }
   }
-  return { command: command2, key: key2 };
+  return { command, key };
 }
-var { command, key } = parseArgs(process.argv.slice(2));
-if (command === "init") {
+function main(argv) {
+  const { command, key } = parseArgs(argv);
+  if (command === "init") {
+    try {
+      runInit({ cwd: process.cwd(), key });
+    } catch (err) {
+      console.error(`[sentientui] init failed: ${String(err)}`);
+      process.exit(1);
+    }
+  } else {
+    console.log("Usage: npx @sentientui/cli init [--key pk_...] [--yes]");
+    process.exit(command ? 1 : 0);
+  }
+}
+function isRunAsScript() {
   try {
-    runInit({ cwd: process.cwd(), key });
-  } catch (err) {
-    console.error(`[sentientui] init failed: ${String(err)}`);
-    process.exit(1);
+    const entry = process.argv[1];
+    if (!entry) return false;
+    return realpathSync(fileURLToPath(import_meta.url)) === realpathSync(entry);
+  } catch (e) {
+    return false;
   }
-} else {
-  console.log("Usage: npx @sentientui/cli init [--key pk_...] [--yes]");
-  process.exit(command ? 1 : 0);
 }
+if (isRunAsScript()) {
+  main(process.argv.slice(2));
+}
+export {
+  main,
+  parseArgs
+};

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@sentientui/cli",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "SentientUI CLI — `npx @sentientui/cli init` sets up adaptive UI in an existing React app (installs the SDK, writes env config, scaffolds an example, and prints the wrap instructions)",
+  "license": "MIT",
   "homepage": "https://sentient-ui.com",
   "repository": {
     "type": "git",
@@ -40,6 +41,7 @@
     "build": "tsup",
     "test": "vitest run",
     "typecheck": "tsc --noEmit",
-    "dev": "tsx src/index.ts"
+    "dev": "tsx src/index.ts",
+    "lint": "eslint src"
   }
 }