@tinycld/bootstrap 2.4.3 → 2.4.4

package/dist/validate.js

@@ -3,6 +3,32 @@ const SLUG_RE = /^[a-z][a-z0-9-]*[a-z0-9]$/;
 const RESERVED_SLUGS = new Set(['core', 'main', 'test', 'tests', 'node_modules', 'packages']);
 const SHORTCUT_RE = /^[a-z]$/;
 const ICON_RE = /^[a-z][a-z0-9-]*$/;
+// Free-text fields (name, description) are substituted VERBATIM into single-quoted
+// TS strings, JSON, JSX text, and Go/Markdown comments in the generated scaffold.
+// Quotes, backslashes, backticks, template-literal openers, and control chars
+// (newlines/tabs) would break — or inject into — that output. Reject them so the
+// user re-runs with a clean value; escaping correctly per-context is far more
+// fragile than disallowing characters that have no business in a package name.
+const UNSAFE_CHARS = ["'", '"', '`', '\\'];
+function hasControlChar(value) {
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code < 0x20 || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+function validateFreeText(value) {
+    if (hasControlChar(value))
+        return 'must not contain newlines, tabs, or other control characters';
+    if (value.includes('${'))
+        return 'must not contain "${" (template-literal syntax)';
+    for (const ch of UNSAFE_CHARS) {
+        if (value.includes(ch))
+            return `must not contain the ${ch} character`;
+    }
+    return null;
+}
 export function validateSlug(slug) {
     if (!slug || slug.length < 3)
         return 'Slug must be at least 3 characters';
@@ -20,6 +46,9 @@ export function validateName(name) {
         return 'Name is required';
     if (name.length > 60)
         return 'Name must be 60 characters or fewer';
+    const err = validateFreeText(name);
+    if (err)
+        return `Name ${err}`;
     return null;
 }
 export function validateDescription(desc) {
@@ -27,6 +56,9 @@ export function validateDescription(desc) {
         return 'Description is required';
     if (desc.length > 200)
         return 'Description must be 200 characters or fewer';
+    const err = validateFreeText(desc);
+    if (err)
+        return `Description ${err}`;
     return null;
 }
 export function validateIcon(icon) {

package/dist/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAE3D,MAAM,OAAO,GAAG,2BAA2B,CAAA;AAC3C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAA;AAC7F,MAAM,WAAW,GAAG,SAAS,CAAA;AAC7B,MAAM,OAAO,GAAG,mBAAmB,CAAA;AAEnC,MAAM,UAAU,YAAY,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,oCAAoC,CAAA;IACzE,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,qCAAqC,CAAA;IAClE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,0FAA0F,CAAA;IACrG,CAAC;IACD,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,IAAI,eAAe,CAAA;IAC5D,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAA;IAChE,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,qCAAqC,CAAA;IAClE,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,yBAAyB,CAAA;IACvE,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,6CAA6C,CAAA;IAC3E,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,WAAW;IACvD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,8DAA8D,CAAA;IAC9F,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAAE,OAAO,8BAA8B,CAAA;IAC/D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,oCAAoC,CAAA;IAChE,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,WAAW;IACjD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,4CAA4C,CAAA;IAC7E,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO,GAAG,GAAG,gCAAgC,CAAA;IACtE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,CAAA;IACjE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,GAAG,0BAA0B,CAAA;IAC/D,OAAO,IAAI,CAAA;AACf,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAE3D,MAAM,OAAO,GAAG,2BAA2B,CAAA;AAC3C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAA;AAC7F,MAAM,WAAW,GAAG,SAAS,CAAA;AAC7B,MAAM,OAAO,GAAG,mBAAmB,CAAA;AAEnC,mFAAmF;AACnF,kFAAkF;AAClF,8EAA8E;AAC9E,iFAAiF;AACjF,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAU,CAAA;AAEnD,SAAS,cAAc,CAAC,KAAa;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAChC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;IACjD,CAAC;IACD,OAAO,KAAK,CAAA;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACnC,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,8DAA8D,CAAA;IAChG,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,iDAAiD,CAAA;IAClF,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,OAAO,wBAAwB,EAAE,YAAY,CAAA;IACzE,CAAC;IACD,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,oCAAoC,CAAA;IACzE,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,qCAAqC,CAAA;IAClE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,0FAA0F,CAAA;IACrG,CAAC;IACD,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,IAAI,eAAe,CAAA;IAC5D,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAA;IAChE,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,qCAAqC,CAAA;IAClE,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,GAAG;QAAE,OAAO,QAAQ,GAAG,EAAE,CAAA;IAC7B,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,yBAAyB,CAAA;IACvE,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,6CAA6C,CAAA;IAC3E,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,GAAG;QAAE,OAAO,eAAe,GAAG,EAAE,CAAA;IACpC,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,WAAW;IACvD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,8DAA8D,CAAA;IAC9F,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAAE,OAAO,8BAA8B,CAAA;IAC/D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,oCAAoC,CAAA;IAChE,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,WAAW;IACjD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,4CAA4C,CAAA;IAC7E,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO,GAAG,GAAG,gCAAgC,CAAA;IACtE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,CAAA;IACjE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,GAAG,0BAA0B,CAAA;IAC/D,OAAO,IAAI,CAAA;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycld/bootstrap",
-  "version": "2.4.3",
+  "version": "2.4.4",
   "description": "Scaffolder for @tinycld feature packages",
   "type": "module",
   "license": "MIT",

package/templates/full/playwright.config.ts

@@ -1,6 +1,6 @@
 import path from 'node:path'
 import { defineConfig } from '@playwright/test'
-import appConfig from '../app/playwright.config'
+import appConfig from '@tinycld/core/playwright-config'
 
 // Package-scoped Playwright: inherit the app shell's webServer + browser config,
 // then point testDir at THIS package's tests/e2e through the app shell's

package/templates/shared/.github/workflows/ci.yml

@@ -28,9 +28,10 @@ jobs:
         with:
           node-version: '24'
       # 3. Assemble the workspace root: writes package.json + tinycld.packages.ts
-      #    from bootstrap's embedded templates, clones app + core as siblings.
-      #    The PR's PACKAGE dir is already there and is skipped.
-      - name: Assemble workspace (app + core)
+      #    from bootstrap's embedded templates, clones the tinycld member (app
+      #    shell + core + package-scripts) as a sibling. The PR's PACKAGE dir is
+      #    already there and is skipped.
+      - name: Assemble workspace (tinycld + this package)
         working-directory: ws
         run: TINYCLD_REPO_BASE=https://github.com/tinycld npx @tinycld/bootstrap@latest --assemble-only
       # 4. Now switch to the version the assembled workspace pins (ws/.node-version
@@ -66,7 +67,7 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: '24'
-      - name: Assemble workspace (app + core)
+      - name: Assemble workspace (tinycld + this package)
         working-directory: ws
         run: TINYCLD_REPO_BASE=https://github.com/tinycld npx @tinycld/bootstrap@latest --assemble-only
       # Switch to the version the assembled workspace pins.
@@ -81,16 +82,16 @@ jobs:
       - name: Install (workspace root)
         working-directory: ws
         run: pnpm install --no-frozen-lockfile
-      # Installs watchman so Metro's file watcher doesn't fall back to
-      # polling — see tinycld/app#21 for the trace evidence and the
-      # blank-page-after-reload flake it fixed.
+      # Installs the Playwright browser and pre-builds the web bundle. The
+      # composite action lives in the tinycld member, assembled at ws/tinycld.
       - name: Configure test env
-        uses: tinycld/app/.github/actions/configure-test-env@main
-      - name: Install Playwright browsers
-        working-directory: ws/app
-        run: pnpm exec playwright install --with-deps chromium
+        uses: ./ws/tinycld/.github/actions/configure-test-env
       - name: E2E
         working-directory: ws/${{ env.PACKAGE }}
+        env:
+          # The bundle was built by the action above; reuse it (the webServer
+          # still seeds + promotes + serves, just doesn't export a second time).
+          TINYCLD_E2E_SKIP_EXPORT: '1'
         run: pnpm exec tinycld-pkg test:e2e
       # Capture Playwright's per-failure artifacts (trace, screenshot,
       # video, error-context.md) so a CI failure can be diagnosed

package/templates/shared/vitest.config.ts

@@ -1,6 +1,6 @@
 import path from 'node:path'
+import appConfig from '@tinycld/core/vitest-config'
 import { mergeConfig } from 'vitest/config'
-import appConfig from '../app/vitest.config'
 
 // Package-scoped vitest: inherit the app shell's canonical aliases (so
 // @tinycld/core/* etc. resolve identically), then add this package's own

package/templates/workspace/vitest.config.ts

@@ -6,8 +6,8 @@ import { defineConfig } from 'vitest/config'
 // react-native/expo/sentry mocks that let the broader core suite run under
 // Node without the Metro/RN runtime.
 const ROOT = import.meta.dirname
-const CORE_DIR = path.join(ROOT, 'core')
-const APP_GENERATED = path.join(ROOT, 'app', 'lib', 'generated')
+const CORE_DIR = path.join(ROOT, 'tinycld', 'core')
+const APP_GENERATED = path.join(ROOT, 'tinycld', 'lib', 'generated')
 
 // Locate a hoisted dependency's dir. In this workspace layout deps hoist to
 // the workspace-root node_modules (all members declare framework deps as
@@ -62,7 +62,7 @@ export default defineConfig({
                 replacement: `${CORE_DIR}/$1`,
             },
             // --- @tinycld/app-generated/* build-time contract (written to
-            //     app/lib/generated/ by the generator; Vitest doesn't read
+            //     tinycld/lib/generated/ by the generator; Vitest doesn't read
             //     tsconfig paths) ---
             {
                 find: /^@tinycld\/app-generated\/(.+)$/,
@@ -102,10 +102,10 @@ export default defineConfig({
         environment: 'node',
         include: [
             'tests/**/*.test.{ts,tsx}',
-            'core/**/__tests__/**/*.test.{ts,tsx}',
-            'core/**/*.test.{ts,tsx}',
-            'app/scripts/**/__tests__/**/*.test.{ts,tsx}',
-            'package-scripts/tests/**/*.test.{ts,tsx}',
+            'tinycld/core/**/__tests__/**/*.test.{ts,tsx}',
+            'tinycld/core/**/*.test.{ts,tsx}',
+            'tinycld/scripts/**/__tests__/**/*.test.{ts,tsx}',
+            'tinycld/package-scripts/tests/**/*.test.{ts,tsx}',
         ],
         setupFiles: ['tests/unit-setup.ts'],
     },