@sentientui/cli 0.2.3 → 0.2.5

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Carlos Sánchez Campos / SentientUI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.cjs

@@ -4,27 +4,17 @@ var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getOwnPropSymbols = Object.getOwnPropertySymbols;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __propIsEnum = Object.prototype.propertyIsEnumerable;
-var __defNormalProp = (obj, key2, value) => key2 in obj ? __defProp(obj, key2, { enumerable: true, configurable: true, writable: true, value }) : obj[key2] = value;
-var __spreadValues = (a, b) => {
-  for (var prop in b || (b = {}))
-    if (__hasOwnProp.call(b, prop))
-      __defNormalProp(a, prop, b[prop]);
-  if (__getOwnPropSymbols)
-    for (var prop of __getOwnPropSymbols(b)) {
-      if (__propIsEnum.call(b, prop))
-        __defNormalProp(a, prop, b[prop]);
-    }
-  return a;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
-    for (let key2 of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key2) && key2 !== except)
-        __defProp(to, key2, { get: () => from[key2], enumerable: !(desc = __getOwnPropDesc(from, key2)) || desc.enumerable });
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
   }
   return to;
 };
@@ -36,6 +26,17 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
   mod
 ));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  main: () => main,
+  parseArgs: () => parseArgs
+});
+module.exports = __toCommonJS(index_exports);
+var import_node_fs4 = require("fs");
+var import_node_url = require("url");
 
 // src/init.ts
 var import_node_child_process = require("child_process");
@@ -46,14 +47,14 @@ var import_node_path = __toESM(require("path"), 1);
 function readPackageJson(cwd) {
   try {
     return JSON.parse((0, import_node_fs.readFileSync)(import_node_path.default.join(cwd, "package.json"), "utf-8"));
-  } catch (e) {
+  } catch {
     return null;
   }
 }
 function detectFramework(cwd) {
   const pkg = readPackageJson(cwd);
   if (!pkg) return "unknown";
-  const deps = __spreadValues(__spreadValues({}, pkg.dependencies), pkg.devDependencies);
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
   const has = (dir) => (0, import_node_fs.existsSync)(import_node_path.default.join(cwd, dir));
   if (deps["next"]) {
     if (has("app") || has(import_node_path.default.join("src", "app"))) return "next-app";
@@ -88,15 +89,25 @@ function installCommand(pm, pkgName) {
 var import_node_fs2 = require("fs");
 var import_node_path2 = __toESM(require("path"), 1);
 function envVarName(framework) {
-  return framework === "vite" ? "VITE_SENTIENT_API_KEY" : "NEXT_PUBLIC_SENTIENT_API_KEY";
+  switch (framework) {
+    case "cra":
+      return "REACT_APP_SENTIENT_API_KEY";
+    case "vite":
+    case "remix":
+      return "VITE_SENTIENT_API_KEY";
+    case "next-app":
+    case "next-pages":
+    case "unknown":
+      return "NEXT_PUBLIC_SENTIENT_API_KEY";
+  }
 }
-function writeEnvFile(cwd, framework, key2) {
+function writeEnvFile(cwd, framework, key) {
   const varName = envVarName(framework);
   const file = import_node_path2.default.join(cwd, ".env.local");
   const block = [
     "",
     "# SentientUI \u2014 leave empty for local mode (decisions are simulated on-device; nothing is sent)",
-    `${varName}=${key2 != null ? key2 : ""}`,
+    `${varName}=${key ?? ""}`,
     ""
   ].join("\n");
   if (!(0, import_node_fs2.existsSync)(file)) {
@@ -104,7 +115,7 @@ function writeEnvFile(cwd, framework, key2) {
     return "created";
   }
   const existing = (0, import_node_fs2.readFileSync)(file, "utf-8");
-  const assigned = existing.split(/\r?\n/).some((line) => line.trim().startsWith(`${varName}=`));
+  const assigned = existing.split(/\r?\n/).some((line) => line.trim().replace(/^#+\s*/, "").startsWith(`${varName}=`));
   if (assigned) return "kept";
   (0, import_node_fs2.appendFileSync)(file, block, "utf-8");
   return "appended";
@@ -205,7 +216,7 @@ createRoot(document.getElementById('root')!).render(
 import { AdaptiveProvider } from '@sentientui/react';
 
 // inside the Layout/App component body:
-<AdaptiveProvider apiKey="" context="landing">
+<AdaptiveProvider apiKey={import.meta.env.${envVar} ?? ''} context="landing">
   <Outlet />
 </AdaptiveProvider>`;
     case "cra":
@@ -236,11 +247,39 @@ function finale(framework) {
   return `open http://localhost:${port}?sentient_persona=buyer`;
 }
 
+// src/validate-key.ts
+function isPublishableKey(key) {
+  return key.startsWith("pk_");
+}
+function warnIfNotPublishableKey(key, log = (line) => console.warn(line)) {
+  if (!key || isPublishableKey(key)) return false;
+  const looksSecret = key.startsWith("sk_");
+  log("");
+  log("\u26A0  ============================ SECURITY WARNING ============================");
+  log(`\u26A0  The key you passed ("${key.slice(0, 6)}\u2026") is NOT a publishable pk_ key.`);
+  if (looksSecret) {
+    log("\u26A0  It looks like a SECRET server key (sk_\u2026). Do NOT ship it to the browser.");
+  }
+  log("\u26A0  This CLI writes the key into a CLIENT-exposed env var, so it is bundled");
+  log("\u26A0  into your site and visible to every visitor. Only publishable pk_ keys");
+  log("\u26A0  belong in client env. Get your pk_ key from the SentientUI dashboard.");
+  log("\u26A0  =======================================================================");
+  log("");
+  return true;
+}
+function assertPublishableKey(key, log = (line) => console.error(line)) {
+  if (warnIfNotPublishableKey(key, log)) {
+    throw new Error(
+      "Refusing to write a non-publishable key into a client-exposed env var. Only publishable pk_ keys belong in the browser bundle \u2014 pass your pk_ key from the SentientUI dashboard, or omit --key for local mode."
+    );
+  }
+}
+
 // src/init.ts
 function runInit(opts) {
-  var _a, _b, _c;
-  const log = (_a = opts.log) != null ? _a : ((line) => console.log(line));
-  const exec = (_b = opts.exec) != null ? _b : ((command2, cwd) => (0, import_node_child_process.execSync)(command2, { cwd, stdio: "inherit" }));
+  const log = opts.log ?? ((line) => console.log(line));
+  const exec = opts.exec ?? ((command, cwd) => (0, import_node_child_process.execSync)(command, { cwd, stdio: "inherit" }));
+  assertPublishableKey(opts.key, log);
   const framework = detectFramework(opts.cwd);
   log(`[sentientui] detected framework: ${framework}`);
   if (framework === "unknown") {
@@ -253,7 +292,7 @@ function runInit(opts) {
   exec(install, opts.cwd);
   const envResult = writeEnvFile(opts.cwd, framework, opts.key);
   log(
-    `[sentientui] .env.local ${envResult}: ${envVarName(framework)}=${(_c = opts.key) != null ? _c : "(empty \u2014 local mode)"}`
+    `[sentientui] .env.local ${envResult}: ${envVarName(framework)}=${opts.key ?? "(empty \u2014 local mode)"}`
   );
   const scaffolded = scaffoldExample(opts.cwd);
   log(
@@ -268,27 +307,50 @@ function runInit(opts) {
 }
 
 // src/index.ts
+var import_meta = {};
 function parseArgs(argv) {
   const args = [...argv];
-  const command2 = args.shift();
-  let key2;
+  const command = args.shift();
+  let key;
   for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--key") {
-      key2 = args[i + 1];
+    const arg = args[i];
+    if (arg === "--key") {
+      key = args[i + 1];
       i++;
+    } else if (arg.startsWith("--key=")) {
+      key = arg.slice("--key=".length);
     }
   }
-  return { command: command2, key: key2 };
+  return { command, key };
 }
-var { command, key } = parseArgs(process.argv.slice(2));
-if (command === "init") {
+function main(argv) {
+  const { command, key } = parseArgs(argv);
+  if (command === "init") {
+    try {
+      runInit({ cwd: process.cwd(), key });
+    } catch (err) {
+      console.error(`[sentientui] init failed: ${String(err)}`);
+      process.exit(1);
+    }
+  } else {
+    console.log("Usage: npx @sentientui/cli init [--key pk_...] [--yes]");
+    process.exit(command ? 1 : 0);
+  }
+}
+function isRunAsScript() {
   try {
-    runInit({ cwd: process.cwd(), key });
-  } catch (err) {
-    console.error(`[sentientui] init failed: ${String(err)}`);
-    process.exit(1);
+    const entry = process.argv[1];
+    if (!entry) return false;
+    return (0, import_node_fs4.realpathSync)((0, import_node_url.fileURLToPath)(import_meta.url)) === (0, import_node_fs4.realpathSync)(entry);
+  } catch {
+    return false;
   }
-} else {
-  console.log("Usage: npx @sentientui/cli init [--key pk_...] [--yes]");
-  process.exit(command ? 1 : 0);
 }
+if (isRunAsScript()) {
+  main(process.argv.slice(2));
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  main,
+  parseArgs
+});

package/dist/index.js

@@ -1,20 +1,8 @@
 #!/usr/bin/env node
-var __defProp = Object.defineProperty;
-var __getOwnPropSymbols = Object.getOwnPropertySymbols;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __propIsEnum = Object.prototype.propertyIsEnumerable;
-var __defNormalProp = (obj, key2, value) => key2 in obj ? __defProp(obj, key2, { enumerable: true, configurable: true, writable: true, value }) : obj[key2] = value;
-var __spreadValues = (a, b) => {
-  for (var prop in b || (b = {}))
-    if (__hasOwnProp.call(b, prop))
-      __defNormalProp(a, prop, b[prop]);
-  if (__getOwnPropSymbols)
-    for (var prop of __getOwnPropSymbols(b)) {
-      if (__propIsEnum.call(b, prop))
-        __defNormalProp(a, prop, b[prop]);
-    }
-  return a;
-};
+
+// src/index.ts
+import { realpathSync } from "fs";
+import { fileURLToPath } from "url";
 
 // src/init.ts
 import { execSync } from "child_process";
@@ -25,14 +13,14 @@ import path from "path";
 function readPackageJson(cwd) {
   try {
     return JSON.parse(readFileSync(path.join(cwd, "package.json"), "utf-8"));
-  } catch (e) {
+  } catch {
     return null;
   }
 }
 function detectFramework(cwd) {
   const pkg = readPackageJson(cwd);
   if (!pkg) return "unknown";
-  const deps = __spreadValues(__spreadValues({}, pkg.dependencies), pkg.devDependencies);
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
   const has = (dir) => existsSync(path.join(cwd, dir));
   if (deps["next"]) {
     if (has("app") || has(path.join("src", "app"))) return "next-app";
@@ -67,15 +55,25 @@ function installCommand(pm, pkgName) {
 import { existsSync as existsSync2, readFileSync as readFileSync2, appendFileSync, writeFileSync } from "fs";
 import path2 from "path";
 function envVarName(framework) {
-  return framework === "vite" ? "VITE_SENTIENT_API_KEY" : "NEXT_PUBLIC_SENTIENT_API_KEY";
+  switch (framework) {
+    case "cra":
+      return "REACT_APP_SENTIENT_API_KEY";
+    case "vite":
+    case "remix":
+      return "VITE_SENTIENT_API_KEY";
+    case "next-app":
+    case "next-pages":
+    case "unknown":
+      return "NEXT_PUBLIC_SENTIENT_API_KEY";
+  }
 }
-function writeEnvFile(cwd, framework, key2) {
+function writeEnvFile(cwd, framework, key) {
   const varName = envVarName(framework);
   const file = path2.join(cwd, ".env.local");
   const block = [
     "",
     "# SentientUI \u2014 leave empty for local mode (decisions are simulated on-device; nothing is sent)",
-    `${varName}=${key2 != null ? key2 : ""}`,
+    `${varName}=${key ?? ""}`,
     ""
   ].join("\n");
   if (!existsSync2(file)) {
@@ -83,7 +81,7 @@ function writeEnvFile(cwd, framework, key2) {
     return "created";
   }
   const existing = readFileSync2(file, "utf-8");
-  const assigned = existing.split(/\r?\n/).some((line) => line.trim().startsWith(`${varName}=`));
+  const assigned = existing.split(/\r?\n/).some((line) => line.trim().replace(/^#+\s*/, "").startsWith(`${varName}=`));
   if (assigned) return "kept";
   appendFileSync(file, block, "utf-8");
   return "appended";
@@ -184,7 +182,7 @@ createRoot(document.getElementById('root')!).render(
 import { AdaptiveProvider } from '@sentientui/react';
 
 // inside the Layout/App component body:
-<AdaptiveProvider apiKey="" context="landing">
+<AdaptiveProvider apiKey={import.meta.env.${envVar} ?? ''} context="landing">
   <Outlet />
 </AdaptiveProvider>`;
     case "cra":
@@ -215,11 +213,39 @@ function finale(framework) {
   return `open http://localhost:${port}?sentient_persona=buyer`;
 }
 
+// src/validate-key.ts
+function isPublishableKey(key) {
+  return key.startsWith("pk_");
+}
+function warnIfNotPublishableKey(key, log = (line) => console.warn(line)) {
+  if (!key || isPublishableKey(key)) return false;
+  const looksSecret = key.startsWith("sk_");
+  log("");
+  log("\u26A0  ============================ SECURITY WARNING ============================");
+  log(`\u26A0  The key you passed ("${key.slice(0, 6)}\u2026") is NOT a publishable pk_ key.`);
+  if (looksSecret) {
+    log("\u26A0  It looks like a SECRET server key (sk_\u2026). Do NOT ship it to the browser.");
+  }
+  log("\u26A0  This CLI writes the key into a CLIENT-exposed env var, so it is bundled");
+  log("\u26A0  into your site and visible to every visitor. Only publishable pk_ keys");
+  log("\u26A0  belong in client env. Get your pk_ key from the SentientUI dashboard.");
+  log("\u26A0  =======================================================================");
+  log("");
+  return true;
+}
+function assertPublishableKey(key, log = (line) => console.error(line)) {
+  if (warnIfNotPublishableKey(key, log)) {
+    throw new Error(
+      "Refusing to write a non-publishable key into a client-exposed env var. Only publishable pk_ keys belong in the browser bundle \u2014 pass your pk_ key from the SentientUI dashboard, or omit --key for local mode."
+    );
+  }
+}
+
 // src/init.ts
 function runInit(opts) {
-  var _a, _b, _c;
-  const log = (_a = opts.log) != null ? _a : ((line) => console.log(line));
-  const exec = (_b = opts.exec) != null ? _b : ((command2, cwd) => execSync(command2, { cwd, stdio: "inherit" }));
+  const log = opts.log ?? ((line) => console.log(line));
+  const exec = opts.exec ?? ((command, cwd) => execSync(command, { cwd, stdio: "inherit" }));
+  assertPublishableKey(opts.key, log);
   const framework = detectFramework(opts.cwd);
   log(`[sentientui] detected framework: ${framework}`);
   if (framework === "unknown") {
@@ -232,7 +258,7 @@ function runInit(opts) {
   exec(install, opts.cwd);
   const envResult = writeEnvFile(opts.cwd, framework, opts.key);
   log(
-    `[sentientui] .env.local ${envResult}: ${envVarName(framework)}=${(_c = opts.key) != null ? _c : "(empty \u2014 local mode)"}`
+    `[sentientui] .env.local ${envResult}: ${envVarName(framework)}=${opts.key ?? "(empty \u2014 local mode)"}`
   );
   const scaffolded = scaffoldExample(opts.cwd);
   log(
@@ -249,25 +275,46 @@ function runInit(opts) {
 // src/index.ts
 function parseArgs(argv) {
   const args = [...argv];
-  const command2 = args.shift();
-  let key2;
+  const command = args.shift();
+  let key;
   for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--key") {
-      key2 = args[i + 1];
+    const arg = args[i];
+    if (arg === "--key") {
+      key = args[i + 1];
       i++;
+    } else if (arg.startsWith("--key=")) {
+      key = arg.slice("--key=".length);
+    }
+  }
+  return { command, key };
+}
+function main(argv) {
+  const { command, key } = parseArgs(argv);
+  if (command === "init") {
+    try {
+      runInit({ cwd: process.cwd(), key });
+    } catch (err) {
+      console.error(`[sentientui] init failed: ${String(err)}`);
+      process.exit(1);
     }
+  } else {
+    console.log("Usage: npx @sentientui/cli init [--key pk_...] [--yes]");
+    process.exit(command ? 1 : 0);
   }
-  return { command: command2, key: key2 };
 }
-var { command, key } = parseArgs(process.argv.slice(2));
-if (command === "init") {
+function isRunAsScript() {
   try {
-    runInit({ cwd: process.cwd(), key });
-  } catch (err) {
-    console.error(`[sentientui] init failed: ${String(err)}`);
-    process.exit(1);
+    const entry = process.argv[1];
+    if (!entry) return false;
+    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(entry);
+  } catch {
+    return false;
   }
-} else {
-  console.log("Usage: npx @sentientui/cli init [--key pk_...] [--yes]");
-  process.exit(command ? 1 : 0);
 }
+if (isRunAsScript()) {
+  main(process.argv.slice(2));
+}
+export {
+  main,
+  parseArgs
+};

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@sentientui/cli",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "SentientUI CLI — `npx @sentientui/cli init` sets up adaptive UI in an existing React app (installs the SDK, writes env config, scaffolds an example, and prints the wrap instructions)",
+  "license": "MIT",
   "homepage": "https://sentient-ui.com",
   "repository": {
     "type": "git",
@@ -40,6 +41,7 @@
     "build": "tsup",
     "test": "vitest run",
     "typecheck": "tsc --noEmit",
-    "dev": "tsx src/index.ts"
+    "dev": "tsx src/index.ts",
+    "lint": "eslint src"
   }
 }