@wp-typia/project-tools 0.19.2 → 0.20.0

package/dist/runtime/scaffold-compatibility.js

@@ -0,0 +1,152 @@
+/**
+ * Compatibility policy helpers for generated scaffold outputs.
+ *
+ * The policy keeps plugin headers, runtime gates, and workspace inventory
+ * metadata aligned when optional or required AI-capable features are added.
+ */
+import { AI_FEATURE_DEFINITIONS, resolveAiFeatureCapabilityPlan, } from "./ai-feature-capability.js";
+/**
+ * Baseline headers used by scaffold output before optional features are added.
+ */
+export const DEFAULT_SCAFFOLD_COMPATIBILITY = {
+    requiresAtLeast: "6.7",
+    requiresPhp: "8.0",
+    testedUpTo: "6.9",
+};
+/**
+ * Optional WordPress AI Client surface used by server-only AI feature scaffold.
+ */
+export const OPTIONAL_WORDPRESS_AI_CLIENT_COMPATIBILITY = [
+    {
+        featureId: AI_FEATURE_DEFINITIONS.wordpressAiClient.id,
+        mode: "optional",
+    },
+];
+/**
+ * Required Abilities API surface used by typed workflow ability scaffold.
+ */
+export const REQUIRED_WORKSPACE_ABILITY_COMPATIBILITY = [
+    {
+        featureId: AI_FEATURE_DEFINITIONS.wordpressServerAbilities.id,
+        mode: "required",
+    },
+    {
+        featureId: AI_FEATURE_DEFINITIONS.wordpressCoreAbilities.id,
+        mode: "required",
+    },
+];
+function parseVersionFloorParts(value) {
+    return value.split(".").map((part, index) => {
+        if (!/^\d+$/u.test(part)) {
+            throw new Error(`parseVersionFloorParts received an invalid version floor "${value}" at segment ${index + 1}.`);
+        }
+        return Number.parseInt(part, 10);
+    });
+}
+function compareVersionFloors(left, right) {
+    const leftParts = parseVersionFloorParts(left);
+    const rightParts = parseVersionFloorParts(right);
+    const length = Math.max(leftParts.length, rightParts.length);
+    for (let index = 0; index < length; index += 1) {
+        const leftValue = leftParts[index] ?? 0;
+        const rightValue = rightParts[index] ?? 0;
+        if (leftValue > rightValue) {
+            return 1;
+        }
+        if (leftValue < rightValue) {
+            return -1;
+        }
+    }
+    return 0;
+}
+function pickHigherVersionFloor(current, candidate) {
+    if (!candidate) {
+        return current;
+    }
+    return compareVersionFloors(current, candidate) >= 0 ? current : candidate;
+}
+function pickHigherHeaderVersionFloor(policyValue, currentValue) {
+    const normalizedCurrentValue = currentValue.trim();
+    if (!normalizedCurrentValue) {
+        return policyValue;
+    }
+    try {
+        return pickHigherVersionFloor(policyValue, normalizedCurrentValue);
+    }
+    catch {
+        return policyValue;
+    }
+}
+function formatRuntimeGate(feature) {
+    return (feature.runtimeGates ?? []).map((gate) => `${feature.label}: ${gate.kind} ${gate.value}`);
+}
+function getPolicyMode(capabilityPlan) {
+    if (capabilityPlan.requiredFeatures.length > 0) {
+        return "required";
+    }
+    if (capabilityPlan.optionalFeatures.length > 0) {
+        return "optional";
+    }
+    return "baseline";
+}
+/**
+ * Resolve plugin header floors and capability gates for scaffold selections.
+ */
+export function resolveScaffoldCompatibilityPolicy(selections, { baseline = DEFAULT_SCAFFOLD_COMPATIBILITY, } = {}) {
+    const capabilityPlan = resolveAiFeatureCapabilityPlan(selections);
+    const requiresAtLeast = pickHigherVersionFloor(baseline.requiresAtLeast, capabilityPlan.hardMinimums.wordpress);
+    const requiresPhp = pickHigherVersionFloor(baseline.requiresPhp, capabilityPlan.hardMinimums.php);
+    const testedUpTo = pickHigherVersionFloor(baseline.testedUpTo, requiresAtLeast);
+    return {
+        capabilityPlan,
+        pluginHeader: {
+            requiresAtLeast,
+            requiresPhp,
+            testedUpTo,
+        },
+    };
+}
+/**
+ * Convert a resolved policy into workspace-inventory-safe JSON metadata.
+ */
+export function createScaffoldCompatibilityConfig(policy) {
+    const { capabilityPlan } = policy;
+    return {
+        hardMinimums: capabilityPlan.hardMinimums,
+        mode: getPolicyMode(capabilityPlan),
+        optionalFeatures: capabilityPlan.optionalFeatures.map((feature) => feature.label),
+        requiredFeatures: capabilityPlan.requiredFeatures.map((feature) => feature.label),
+        runtimeGates: [
+            ...capabilityPlan.requiredFeatures.flatMap(formatRuntimeGate),
+            ...capabilityPlan.optionalFeatures.flatMap(formatRuntimeGate),
+        ],
+    };
+}
+/**
+ * Render compatibility metadata as formatted TypeScript object literal JSON.
+ */
+export function renderScaffoldCompatibilityConfig(policy, indent = "\t\t") {
+    const config = createScaffoldCompatibilityConfig(policy);
+    return JSON.stringify(config, null, "\t")
+        .split("\n")
+        .map((line, index) => (index === 0 ? line : `${indent}${line}`))
+        .join("\n");
+}
+function replacePluginHeaderVersionFloor(source, pattern, policyValue) {
+    return source.replace(pattern, (_match, prefix, currentValue, lineEnding) => {
+        const versionPrefix = prefix.endsWith(":") ? `${prefix} ` : prefix;
+        return `${versionPrefix}${pickHigherHeaderVersionFloor(policyValue, currentValue)}${lineEnding}`;
+    });
+}
+/**
+ * Patch a generated plugin bootstrap header without lowering custom floors.
+ *
+ * Preserves the original header line endings while replacing empty or invalid
+ * version strings with the policy values.
+ */
+export function updatePluginHeaderCompatibility(source, policy) {
+    const { pluginHeader } = policy;
+    const nextSource = replacePluginHeaderVersionFloor(source, /(\* Requires at least:[^\S\r\n]*)([^\r\n]*)(\r?)/u, pluginHeader.requiresAtLeast);
+    const nextSourceWithTestedUpTo = replacePluginHeaderVersionFloor(nextSource, /(\* Tested up to:[^\S\r\n]*)([^\r\n]*)(\r?)/u, pluginHeader.testedUpTo);
+    return replacePluginHeaderVersionFloor(nextSourceWithTestedUpTo, /(\* Requires PHP:[^\S\r\n]*)([^\r\n]*)(\r?)/u, pluginHeader.requiresPhp);
+}

package/dist/runtime/scaffold-documents.js

@@ -3,6 +3,24 @@ import { getCompoundExtensionWorkflowSection, getInitialCommitCommands, getIniti
 import { formatPackageExecCommand, formatInstallCommand, formatRunScript, } from './package-managers.js';
 import { getPackageVersions } from './package-versions.js';
 import { getScaffoldTemplateVariableGroups } from './scaffold-template-variable-groups.js';
+import { OFFICIAL_WORKSPACE_TEMPLATE_ALIAS, OFFICIAL_WORKSPACE_TEMPLATE_PACKAGE, isBuiltInTemplateId, normalizeTemplateLookupId, } from './template-registry.js';
+function formatReadmeTemplateIdentity(templateId) {
+    const normalizedTemplateId = normalizeTemplateLookupId(templateId);
+    if (normalizedTemplateId === OFFICIAL_WORKSPACE_TEMPLATE_PACKAGE) {
+        return [
+            `- Alias: ${OFFICIAL_WORKSPACE_TEMPLATE_ALIAS}`,
+            `- Package: ${OFFICIAL_WORKSPACE_TEMPLATE_PACKAGE}`,
+            '- Type: official workspace scaffold',
+        ].join('\n');
+    }
+    if (normalizedTemplateId === 'query-loop') {
+        return ['- Family: query-loop', '- Type: create-time core/query variation scaffold'].join('\n');
+    }
+    if (isBuiltInTemplateId(normalizedTemplateId)) {
+        return [`- Family: ${normalizedTemplateId}`, '- Type: built-in block scaffold'].join('\n');
+    }
+    return [`- Template id: ${templateId}`, '- Type: custom or external scaffold'].join('\n');
+}
 /**
  * Builds the generated README markdown for one scaffolded project.
  *
@@ -73,7 +91,7 @@ ${variables.description}
 
 ## Template
 
-${templateId}
+${formatReadmeTemplateIdentity(templateId)}
 
 ## Quick Start
 

package/dist/runtime/scaffold-onboarding.d.ts

@@ -22,6 +22,10 @@ export declare function getQuickStartWorkflowNote(packageManager: PackageManager
  * Returns the onboarding note explaining when manual sync is optional.
  */
 export declare function getOptionalOnboardingNote(packageManager: PackageManagerId, templateId?: string, options?: SyncOnboardingOptions): string;
+/**
+ * Returns a shorter optional onboarding note suitable for create completion output.
+ */
+export declare function getOptionalOnboardingShortNote(packageManager: PackageManagerId, templateId?: string, options?: SyncOnboardingOptions): string;
 /**
  * Returns the recommended version-control commands for a fresh scaffold.
  */

package/dist/runtime/scaffold-onboarding.js

@@ -1,7 +1,7 @@
 import { formatPackageExecCommand, formatRunScript, } from "./package-managers.js";
 import { getPackageVersions } from "./package-versions.js";
 import { getPrimaryDevelopmentScript } from "./local-dev-presets.js";
-import { OFFICIAL_WORKSPACE_TEMPLATE_PACKAGE, isBuiltInTemplateId, } from "./template-registry.js";
+import { OFFICIAL_WORKSPACE_TEMPLATE_PACKAGE, isBuiltInTemplateId, normalizeTemplateLookupId, } from "./template-registry.js";
 const INITIAL_COMMIT_COMMANDS = [
     "git init",
     "git add .",
@@ -99,6 +99,30 @@ export function getOptionalOnboardingNote(packageManager, templateId = "basic",
     }
     return `You usually do not need to run ${syncCommand} during a normal ${formatRunScript(packageManager, developmentScript)} session. Run ${syncCommand} before ${formatRunScript(packageManager, "build")}, ${typecheckCommand}, or ${doctorCommand} when you want a reviewable refresh. ${syncTypesCommand} stays warn-only by default; use \`${failOnLossySyncCommand}\` or \`${strictSyncCommand}\` for stricter CI checks.${advancedPersistenceNote} Generated syncs do not create migration history, so refresh before your first commit if this directory is new.`;
 }
+/**
+ * Returns a shorter optional onboarding note suitable for create completion output.
+ */
+export function getOptionalOnboardingShortNote(packageManager, templateId = "basic", options = {}) {
+    const normalizedTemplateId = normalizeTemplateLookupId(templateId);
+    const doctorCommand = getDoctorVerificationCommand(packageManager);
+    if (normalizedTemplateId === "query-loop") {
+        return `No sync step is generated for this Query Loop scaffold. Edit the variation files directly, then rerun ${formatRunScript(packageManager, "build")}, ${formatRunScript(packageManager, "typecheck")}, or ${doctorCommand} when you want a review pass.`;
+    }
+    const optionalSyncScripts = getOptionalSyncScriptNames(normalizedTemplateId, options);
+    const developmentScript = getPrimaryDevelopmentScript(normalizedTemplateId);
+    const devCommand = formatRunScript(packageManager, developmentScript);
+    const isCustomTemplate = !isBuiltInTemplateId(normalizedTemplateId) &&
+        normalizedTemplateId !== OFFICIAL_WORKSPACE_TEMPLATE_PACKAGE;
+    if (isCustomTemplate && optionalSyncScripts.length === 0) {
+        return `Follow the template's own artifact-refresh guidance, then use ${doctorCommand} for a quick environment and workspace sanity check.`;
+    }
+    if (isCustomTemplate && optionalSyncScripts.length > 0) {
+        const syncSteps = optionalSyncScripts.map((scriptName) => formatRunScript(packageManager, scriptName));
+        return `Run ${syncSteps.join(" then ")} before build, typecheck, or ${doctorCommand} when you want a reviewable refresh.`;
+    }
+    const syncCommand = formatRunScript(packageManager, optionalSyncScripts.includes("sync") ? "sync" : "sync-types");
+    return `Skip ${syncCommand} during normal ${devCommand} work. Re-run it before build, typecheck, or ${doctorCommand} when you want a reviewable refresh.`;
+}
 /**
  * Returns the recommended version-control commands for a fresh scaffold.
  */

package/dist/runtime/scaffold-template-variable-groups.d.ts

@@ -1,9 +1,11 @@
+import type { ScaffoldPluginHeaderCompatibility } from "./scaffold-compatibility.js";
 export declare const SCAFFOLD_TEMPLATE_VARIABLE_GROUPS: unique symbol;
 export type ScaffoldTemplateFamily = "basic" | "interactivity" | "persistence" | "compound" | "query-loop" | "external";
 export interface ScaffoldSharedTemplateVariableGroup {
     author: string;
     blockMetadataVersion: string;
     category: string;
+    compatibility: ScaffoldPluginHeaderCompatibility;
     cssClassName: string;
     description: string;
     descriptionJson: string;

package/dist/runtime/scaffold-template-variables.js

@@ -6,6 +6,7 @@ import { DEFAULT_COMPOUND_INNER_BLOCKS_PRESET_ID, getCompoundInnerBlocksPresetDe
 import { getTemplateById, isBuiltInTemplateId, } from './template-registry.js';
 import { toPascalCase, toSnakeCase, } from './string-case.js';
 import { attachScaffoldTemplateVariableGroups } from "./scaffold-template-variable-groups.js";
+import { resolveScaffoldCompatibilityPolicy } from "./scaffold-compatibility.js";
 /**
  * Build the normalized template variables used by scaffold rendering.
  *
@@ -58,6 +59,7 @@ export function getTemplateVariables(templateId, answers) {
     const persistencePolicy = templateId === 'persistence' || compoundPersistenceEnabled
         ? answers.persistencePolicy ?? 'authenticated'
         : 'authenticated';
+    const compatibility = resolveScaffoldCompatibilityPolicy([]);
     const flatVariables = {
         alternateRenderTargetsCsv: '',
         alternateRenderTargetsJson: '[]',
@@ -92,6 +94,8 @@ export function getTemplateVariables(templateId, answers) {
         hasAlternatePlainTextRenderTarget: 'false',
         hasAlternateRenderTargets: 'false',
         projectToolsPackageVersion,
+        requiresAtLeast: compatibility.pluginHeader.requiresAtLeast,
+        requiresPhp: compatibility.pluginHeader.requiresPhp,
         cssClassName,
         dataStorageMode,
         dashCase: slug,
@@ -118,6 +122,7 @@ export function getTemplateVariables(templateId, answers) {
         phpPrefix,
         phpPrefixUpper,
         restPackageVersion,
+        testedUpTo: compatibility.pluginHeader.testedUpTo,
         publicWriteRequestIdDeclaration: persistencePolicy === 'public'
             ? "publicWriteRequestId: string & tags.MinLength< 1 > & tags.MaxLength< 128 >;"
             : "publicWriteRequestId?: string & tags.MinLength< 1 > & tags.MaxLength< 128 >;",
@@ -162,6 +167,7 @@ export function getTemplateVariables(templateId, answers) {
             author: answers.author.trim(),
             blockMetadataVersion: BUILTIN_BLOCK_METADATA_VERSION,
             category: metadataDefaults?.category ?? template?.defaultCategory ?? 'widgets',
+            compatibility: compatibility.pluginHeader,
             cssClassName,
             description,
             descriptionJson: JSON.stringify(description),

package/dist/runtime/scaffold.d.ts

@@ -58,6 +58,8 @@ export interface FlatScaffoldTemplateVariables extends Record<string, string> {
     hasAlternatePlainTextRenderTarget: "false" | "true";
     hasAlternateRenderTargets: "false" | "true";
     projectToolsPackageVersion: string;
+    requiresAtLeast: string;
+    requiresPhp: string;
     cssClassName: string;
     dashCase: string;
     dataStorageMode: DataStorageMode;
@@ -90,6 +92,7 @@ export interface FlatScaffoldTemplateVariables extends Record<string, string> {
     slugSnakeCase: string;
     textDomain: string;
     textdomain: string;
+    testedUpTo: string;
     title: string;
     titleJson: string;
     titleCase: string;

package/dist/runtime/scaffold.js

@@ -8,13 +8,12 @@ import { applyMigrationUiCapability } from "./migration-ui-capability.js";
 import { applyWorkspaceMigrationCapability, ensureScaffoldDirectory, isWorkspaceProject, seedBuiltInPersistenceArtifacts, writeStarterManifestFiles, } from "./scaffold-bootstrap.js";
 import { defaultInstallDependencies, normalizePackageJson, normalizePackageManagerFiles, removeUnexpectedLockfiles, } from "./scaffold-package-manager-files.js";
 import { copyInterpolatedDirectory } from "./template-render.js";
-import { OFFICIAL_WORKSPACE_TEMPLATE_PACKAGE, isBuiltInTemplateId, } from "./template-registry.js";
+import { isBuiltInTemplateId, normalizeTemplateLookupId, } from "./template-registry.js";
 import { resolveTemplateSource } from "./template-source.js";
 import { BlockGeneratorService, } from "./block-generator-service.js";
 import { getTemplateVariables } from "./scaffold-template-variables.js";
 import { getScaffoldTemplateVariableGroups } from "./scaffold-template-variable-groups.js";
 import { assertExternalLayerCompositionOptions, } from "./cli-validation.js";
-const WORKSPACE_TEMPLATE_ALIAS = "workspace";
 export const DATA_STORAGE_MODES = ["post-meta", "custom-table"];
 export const PERSISTENCE_POLICIES = ["authenticated", "public"];
 export { buildBlockCssClassName } from "./scaffold-identifiers.js";
@@ -28,9 +27,7 @@ export function isPersistencePolicy(value) {
     return PERSISTENCE_POLICIES.includes(value);
 }
 function normalizeTemplateSelection(templateId) {
-    return templateId === WORKSPACE_TEMPLATE_ALIAS
-        ? OFFICIAL_WORKSPACE_TEMPLATE_PACKAGE
-        : templateId;
+    return normalizeTemplateLookupId(templateId);
 }
 async function reportScaffoldProgress(onProgress, event) {
     await onProgress?.(event);

package/dist/runtime/template-registry.d.ts

@@ -24,6 +24,7 @@ export declare const SHARED_TEST_PRESET_TEMPLATE_ROOT: string;
 export declare const SHARED_WP_ENV_PRESET_TEMPLATE_ROOT: string;
 export declare const BUILTIN_TEMPLATE_IDS: readonly ["basic", "interactivity", "persistence", "compound", "query-loop"];
 export declare const OFFICIAL_WORKSPACE_TEMPLATE_PACKAGE = "@wp-typia/create-workspace-template";
+export declare const OFFICIAL_WORKSPACE_TEMPLATE_ALIAS = "workspace";
 export type BuiltInTemplateId = (typeof BUILTIN_TEMPLATE_IDS)[number];
 export type PersistencePolicy = "authenticated" | "public";
 export interface TemplateDefinition {
@@ -36,10 +37,31 @@ export interface TemplateDefinition {
 export declare const TEMPLATE_REGISTRY: readonly TemplateDefinition[];
 export declare const TEMPLATE_IDS: BuiltInTemplateId[];
 export declare function isBuiltInTemplateId(templateId: string): templateId is BuiltInTemplateId;
+/**
+ * Returns whether a template id matches the user-facing official workspace alias.
+ *
+ * @param templateId Template id or alias supplied by a caller.
+ * @returns `true` when the id is the `workspace` alias.
+ */
+export declare function isOfficialWorkspaceTemplateAlias(templateId: string): boolean;
+/**
+ * Converts user-facing template aliases into the registry lookup id.
+ *
+ * @param templateId Template id or alias supplied by a caller.
+ * @returns The registry id used for template resolution.
+ */
+export declare function normalizeTemplateLookupId(templateId: string): string;
+/**
+ * Converts internal template ids into the id shown in human-facing output.
+ *
+ * @param templateId Template id stored in the registry.
+ * @returns The user-facing template id or alias for display.
+ */
+export declare function getUserFacingTemplateId(templateId: string): string;
 export declare function listTemplates(): readonly TemplateDefinition[];
 export declare function getTemplateById(templateId: string): TemplateDefinition;
 export declare function getTemplateSelectOptions(): Array<{
     label: string;
-    value: TemplateDefinition["id"];
+    value: string;
     hint: string;
 }>;

package/dist/runtime/template-registry.js

@@ -81,6 +81,7 @@ export const BUILTIN_TEMPLATE_IDS = [
     "query-loop",
 ];
 export const OFFICIAL_WORKSPACE_TEMPLATE_PACKAGE = "@wp-typia/create-workspace-template";
+export const OFFICIAL_WORKSPACE_TEMPLATE_ALIAS = "workspace";
 export const TEMPLATE_REGISTRY = Object.freeze([
     {
         id: "basic",
@@ -129,14 +130,47 @@ export const TEMPLATE_IDS = [...BUILTIN_TEMPLATE_IDS];
 export function isBuiltInTemplateId(templateId) {
     return BUILTIN_TEMPLATE_IDS.includes(templateId);
 }
+/**
+ * Returns whether a template id matches the user-facing official workspace alias.
+ *
+ * @param templateId Template id or alias supplied by a caller.
+ * @returns `true` when the id is the `workspace` alias.
+ */
+export function isOfficialWorkspaceTemplateAlias(templateId) {
+    return templateId === OFFICIAL_WORKSPACE_TEMPLATE_ALIAS;
+}
+/**
+ * Converts user-facing template aliases into the registry lookup id.
+ *
+ * @param templateId Template id or alias supplied by a caller.
+ * @returns The registry id used for template resolution.
+ */
+export function normalizeTemplateLookupId(templateId) {
+    return isOfficialWorkspaceTemplateAlias(templateId)
+        ? OFFICIAL_WORKSPACE_TEMPLATE_PACKAGE
+        : templateId;
+}
+/**
+ * Converts internal template ids into the id shown in human-facing output.
+ *
+ * @param templateId Template id stored in the registry.
+ * @returns The user-facing template id or alias for display.
+ */
+export function getUserFacingTemplateId(templateId) {
+    return templateId === OFFICIAL_WORKSPACE_TEMPLATE_PACKAGE
+        ? OFFICIAL_WORKSPACE_TEMPLATE_ALIAS
+        : templateId;
+}
 export function listTemplates() {
     return TEMPLATE_REGISTRY;
 }
 export function getTemplateById(templateId) {
-    const template = TEMPLATE_REGISTRY.find((entry) => entry.id === templateId);
+    const normalizedTemplateId = normalizeTemplateLookupId(templateId);
+    const template = TEMPLATE_REGISTRY.find((entry) => entry.id === normalizedTemplateId);
     if (!template) {
         throw new Error(`Unknown template "${templateId}". Expected one of: ${[
             ...TEMPLATE_IDS,
+            OFFICIAL_WORKSPACE_TEMPLATE_ALIAS,
             OFFICIAL_WORKSPACE_TEMPLATE_PACKAGE,
         ].join(", ")}`);
     }
@@ -144,8 +178,8 @@ export function getTemplateById(templateId) {
 }
 export function getTemplateSelectOptions() {
     return TEMPLATE_REGISTRY.map((template) => ({
-        label: template.id,
-        value: template.id,
+        label: getUserFacingTemplateId(template.id),
+        value: getUserFacingTemplateId(template.id),
         hint: template.features.join(", "),
     }));
 }

package/dist/runtime/template-source-external.js

@@ -2,6 +2,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
+import { assertExternalTemplateFileSize, getExternalTemplateConfigMaxBytes, withExternalTemplateTimeout, } from './external-template-guards.js';
 import { isPlainObject } from './object-utils.js';
 import { toSegmentPascalCase } from './string-case.js';
 import { createManagedTempRoot } from './temp-roots.js';
@@ -47,8 +48,12 @@ async function loadExternalTemplateConfig(sourceDir) {
     if (!entryPath) {
         throw new Error(`No external template config entry found in ${sourceDir}.`);
     }
+    assertExternalTemplateFileSize(entryPath, {
+        label: `External template config "${entryPath}"`,
+        maxBytes: getExternalTemplateConfigMaxBytes(),
+    });
     const moduleUrl = `${pathToFileURL(entryPath).href}?mtime=${fs.statSync(entryPath).mtimeMs}`;
-    const loadedModule = (await import(moduleUrl));
+    const loadedModule = (await withExternalTemplateTimeout(`loading external template config "${entryPath}"`, () => import(moduleUrl)));
     const loadedConfig = loadedModule.default ?? loadedModule;
     if (!isPlainObject(loadedConfig)) {
         throw new Error(`External template config must export an object: ${entryPath}`);
@@ -150,10 +155,11 @@ async function buildExternalTemplateView(context, config, selectedVariant, varia
         mergedView.variant = selectedVariant;
         mergedView[getVariantFlagName(selectedVariant)] = true;
     }
-    if (!config.transformer) {
+    const transformer = config.transformer;
+    if (!transformer) {
         return mergedView;
     }
-    const transformed = await config.transformer(mergedView);
+    const transformed = await withExternalTemplateTimeout(`running external template transformer for "${context.slug}"`, () => Promise.resolve(transformer(mergedView)));
     if (!isPlainObject(transformed)) {
         throw new Error('External template transformer(view) must return an object.');
     }

package/dist/runtime/template-source-remote.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import { promises as fsp } from 'node:fs';
 import path from 'node:path';
+import { assertExternalTemplateFileSize, getExternalTemplatePackageJsonMaxBytes, } from './external-template-guards.js';
 import { getBuiltInTemplateLayerDirs, isOmittableBuiltInTemplateLayerDir, } from './template-builtins.js';
 import { copyRawDirectory } from './template-render.js';
 import { createManagedTempRoot } from './temp-roots.js';
@@ -66,6 +67,10 @@ function readTemplatePackageJson(sourceDir) {
             continue;
         }
         try {
+            assertExternalTemplateFileSize(candidate, {
+                label: `Template metadata file "${candidate}"`,
+                maxBytes: getExternalTemplatePackageJsonMaxBytes(),
+            });
             return {
                 packageJson: JSON.parse(fs.readFileSync(candidate, 'utf8')),
                 sourcePath: candidate,

package/dist/runtime/template-source-seeds.js

@@ -2,9 +2,10 @@ import fs from 'node:fs';
 import { promises as fsp } from 'node:fs';
 import { createRequire } from 'node:module';
 import path from 'node:path';
-import { execFileSync } from 'node:child_process';
+import { spawnSync } from 'node:child_process';
 import semver from 'semver';
 import { x as extractTarball } from 'tar';
+import { createExternalTemplateTimeoutError, fetchWithExternalTemplateTimeout, getExternalTemplateMetadataMaxBytes, getExternalTemplateTarballMaxBytes, getExternalTemplateTimeoutMs, readBufferResponseWithLimit, readJsonResponseWithLimit, } from './external-template-guards.js';
 import { OFFICIAL_WORKSPACE_TEMPLATE_PACKAGE, PROJECT_TOOLS_PACKAGE_ROOT, } from './template-registry.js';
 import { isPlainObject } from './object-utils.js';
 import { createManagedTempRoot } from './temp-roots.js';
@@ -43,11 +44,17 @@ function selectRegistryVersion(metadata, locator) {
 }
 async function fetchNpmTemplateSource(locator) {
     const registryBase = (process.env.NPM_CONFIG_REGISTRY ?? 'https://registry.npmjs.org').replace(/\/$/, '');
-    const metadataResponse = await fetch(`${registryBase}/${encodeURIComponent(locator.name)}`);
+    const metadataLabel = `fetching npm template metadata for ${locator.raw}`;
+    const metadataResponse = await fetchWithExternalTemplateTimeout(`${registryBase}/${encodeURIComponent(locator.name)}`, {
+        label: metadataLabel,
+    });
     if (!metadataResponse.ok) {
         throw new Error(`Failed to fetch npm template metadata for ${locator.raw}: ${metadataResponse.status}`);
     }
-    const metadata = (await metadataResponse.json());
+    const metadata = await readJsonResponseWithLimit(metadataResponse, {
+        label: `npm template metadata for ${locator.raw}`,
+        maxBytes: getExternalTemplateMetadataMaxBytes(),
+    });
     const resolvedVersion = selectRegistryVersion(metadata, locator);
     const versions = isPlainObject(metadata.versions) ? metadata.versions : {};
     const versionMetadata = versions[resolvedVersion];
@@ -60,14 +67,19 @@ async function fetchNpmTemplateSource(locator) {
     }
     const { path: tempRoot, cleanup } = await createManagedTempRoot('wp-typia-template-source-');
     try {
-        const tarballResponse = await fetch(tarballUrl);
+        const tarballResponse = await fetchWithExternalTemplateTimeout(tarballUrl, {
+            label: `downloading npm template tarball for ${locator.raw}@${resolvedVersion}`,
+        });
         if (!tarballResponse.ok) {
             throw new Error(`Failed to download npm template tarball for ${locator.raw}: ${tarballResponse.status}`);
         }
         const tarballPath = path.join(tempRoot, 'template.tgz');
         const unpackDir = path.join(tempRoot, 'source');
         await fsp.mkdir(unpackDir, { recursive: true });
-        await fsp.writeFile(tarballPath, Buffer.from(await tarballResponse.arrayBuffer()));
+        await fsp.writeFile(tarballPath, await readBufferResponseWithLimit(tarballResponse, {
+            label: `npm template tarball for ${locator.raw}@${resolvedVersion}`,
+            maxBytes: getExternalTemplateTarballMaxBytes(),
+        }));
         await extractTarball({
             cwd: unpackDir,
             file: tarballPath,
@@ -183,7 +195,29 @@ async function resolveGitHubTemplateSource(locator) {
             args.push('--branch', locator.ref);
         }
         args.push(`https://github.com/${locator.owner}/${locator.repo}.git`, checkoutDir);
-        execFileSync('git', args, { stdio: 'ignore' });
+        const cloneTimeoutMs = getExternalTemplateTimeoutMs();
+        const cloneResult = spawnSync('git', args, {
+            stdio: 'ignore',
+            timeout: cloneTimeoutMs,
+        });
+        if (cloneResult.error) {
+            const errorCode = typeof cloneResult.error === 'object' &&
+                cloneResult.error !== null &&
+                'code' in cloneResult.error
+                ? String(cloneResult.error.code)
+                : '';
+            if (errorCode === 'ETIMEDOUT') {
+                throw createExternalTemplateTimeoutError(`cloning GitHub template ${locator.owner}/${locator.repo}`, cloneTimeoutMs);
+            }
+            throw cloneResult.error;
+        }
+        if (cloneResult.signal === 'SIGTERM' ||
+            cloneResult.signal === 'SIGKILL') {
+            throw createExternalTemplateTimeoutError(`cloning GitHub template ${locator.owner}/${locator.repo}`, cloneTimeoutMs);
+        }
+        if (cloneResult.status !== 0) {
+            throw new Error(`Failed to clone GitHub template source ${locator.owner}/${locator.repo}.`);
+        }
         const sourceDir = path.resolve(checkoutDir, locator.sourcePath);
         const relativeSourceDir = path.relative(checkoutDir, sourceDir);
         if (relativeSourceDir.startsWith('..') ||