base-themes 0.1.2 → 0.1.3

package/SECURITY.md

@@ -0,0 +1,49 @@
+# Security Policy
+
+Base Themes is a public npm package for React applications. Security reports are handled through GitHub so fixes can be coordinated before public disclosure.
+
+## Supported Versions
+
+Security fixes target the latest published minor version of `base-themes`. Older versions may receive guidance, but patches are not guaranteed until the project has a stable major release policy.
+
+## Reporting a Vulnerability
+
+Use GitHub private vulnerability reporting if it is enabled for the repository. If it is not available, open a minimal public issue that says you need a private security contact, without including exploit details.
+
+Do not include secrets, tokens, private keys, customer data, or production credentials in a report.
+
+Please include:
+
+- Affected package version.
+- Affected component, script, workflow, or registry entry.
+- Reproduction steps or proof of concept.
+- Impact and likely attack scenario.
+- Any known mitigation.
+
+## Response Expectations
+
+- Initial triage target: 3 business days.
+- Fix or mitigation target: depends on severity and reproducibility.
+- Public disclosure: after a patched release or clear mitigation is available.
+
+## Supply Chain Posture
+
+- Releases are published by GitHub Actions using npm provenance.
+- CI runs registry validation, lint, and build before publish.
+- Runtime dependencies are intentionally small.
+- Dependency updates are managed through Dependabot once configured.
+
+## Scope
+
+In scope:
+
+- Package source and bundled output.
+- Registry metadata that could cause unsafe installs or copied files.
+- GitHub Actions workflows and release pipeline.
+- Documentation examples that create unsafe defaults.
+
+Out of scope:
+
+- Vulnerabilities in user applications after local modifications.
+- Issues requiring access to private user environments.
+- Social engineering or spam reports.

package/bin/base-themes.mjs

@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+import { createDoctorReport, createRegistryAdd, createRegistryPlan, formatDoctorReport, formatRegistryAdd, formatRegistryList, formatRegistryPlan, loadRegistry } from '../scripts/registry-plan.mjs'
+
+const [command, ...args] = process.argv.slice(2)
+const registry = loadRegistry(new URL('../registry/registry.json', import.meta.url))
+
+function printHelp() {
+  console.log(`Base Themes CLI
+
+Usage:
+  base-themes list [--json]
+  base-themes plan <component...> [block:<block-name>...] [theme:<style>...] [--json]
+  base-themes add <component...> [block:<block-name>...] [theme:<style>...] [--target <dir>] [--dry-run] [--force] [--json]
+  base-themes doctor [project-root] [--json]
+
+Examples:
+  base-themes list
+  base-themes list --json
+  base-themes plan button select block:dashboard-shell theme:enterprise
+  base-themes plan button select block:dashboard-shell theme:enterprise --json
+  base-themes add button select block:dashboard-shell theme:enterprise --target . --dry-run
+  base-themes doctor . --json
+`)
+}
+
+function parseRegistryArgs(args) {
+  const requested = []
+  const options = {}
+
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index]
+    if (arg === '--dry-run') {
+      options.dryRun = true
+      continue
+    }
+    if (arg === '--force') {
+      options.force = true
+      continue
+    }
+    if (arg === '--json') {
+      options.json = true
+      continue
+    }
+    if (arg === '--target') {
+      const target = args[index + 1]
+      if (!target) throw new Error('Missing value for --target')
+      options.target = target
+      index += 1
+      continue
+    }
+    if (arg.startsWith('--target=')) {
+      options.target = arg.slice('--target='.length)
+      continue
+    }
+    if (arg.startsWith('--')) throw new Error(`Unknown add option: ${arg}`)
+    requested.push(arg)
+  }
+
+  return { requested, options }
+}
+
+function printResult(value, json, formatter) {
+  console.log(json ? JSON.stringify(value, null, 2) : formatter(value))
+}
+
+if (!command || command === 'help' || command === '--help' || command === '-h') {
+  printHelp()
+  process.exit(0)
+}
+
+if (command === 'list') {
+  const json = args.includes('--json')
+  const unknownArgs = args.filter((arg) => arg !== '--json')
+  if (unknownArgs.length > 0) {
+    console.error(`Unknown list option: ${unknownArgs[0]}`)
+    console.error('Usage: base-themes list [--json]')
+    process.exit(1)
+  }
+  printResult(registry, json, formatRegistryList)
+  process.exit(0)
+}
+
+if (command === 'plan') {
+  let parsed
+  try {
+    parsed = parseRegistryArgs(args)
+  } catch (error) {
+    console.error(error.message)
+    console.error('Usage: base-themes plan <component...> [block:<block-name>...] [theme:<style>...] [--json]')
+    process.exit(1)
+  }
+
+  if (parsed.requested.length === 0) {
+    console.error('Usage: base-themes plan <component...> [block:<block-name>...] [theme:<style>...] [--json]')
+    process.exit(1)
+  }
+
+  const plan = createRegistryPlan(registry, parsed.requested)
+  printResult(plan, parsed.options.json, formatRegistryPlan)
+  process.exit(plan.ok ? 0 : 1)
+}
+
+if (command === 'add') {
+  let parsed
+  try {
+    parsed = parseRegistryArgs(args)
+  } catch (error) {
+    console.error(error.message)
+    console.error('Usage: base-themes add <component...> [block:<block-name>...] [theme:<style>...] [--target <dir>] [--dry-run] [--force] [--json]')
+    process.exit(1)
+  }
+
+  if (parsed.requested.length === 0) {
+    console.error('Usage: base-themes add <component...> [block:<block-name>...] [theme:<style>...] [--target <dir>] [--dry-run] [--force] [--json]')
+    process.exit(1)
+  }
+
+  const result = createRegistryAdd(registry, parsed.requested, parsed.options)
+  printResult(result, parsed.options.json, formatRegistryAdd)
+  process.exit(result.ok ? 0 : 1)
+}
+
+if (command === 'doctor') {
+  const json = args.includes('--json')
+  const positional = args.filter((arg) => arg !== '--json')
+  if (positional.some((arg) => arg.startsWith('--'))) {
+    console.error(`Unknown doctor option: ${positional.find((arg) => arg.startsWith('--'))}`)
+    console.error('Usage: base-themes doctor [project-root] [--json]')
+    process.exit(1)
+  }
+  if (positional.length > 1) {
+    console.error('Usage: base-themes doctor [project-root] [--json]')
+    process.exit(1)
+  }
+  const root = positional[0] ?? process.cwd()
+  const report = createDoctorReport(root)
+  printResult(report, json, formatDoctorReport)
+  process.exit(report.ok ? 0 : 1)
+}
+
+console.error(`Unknown command: ${command}`)
+printHelp()
+process.exit(1)