create-kide-app 0.1.7 → 0.1.9

package/README.md

@@ -5,7 +5,7 @@ Scaffold a new [Kide CMS](https://github.com/mhernesniemi/kide-cms) project.
 ## Usage
 
 ```bash
-pnpx create-kide-app my-project
+pnpm create kide-app my-project
 ```
 
 The CLI asks for:

package/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import * as p from "@clack/prompts";
-import { execSync, spawn } from "node:child_process";
+import { execFileSync, execSync, spawn } from "node:child_process";
 import {
   cpSync,
   existsSync,
@@ -59,6 +59,19 @@ const CLEANUP = [
   ".DS_Store",
 ];
 
+// The project name reaches shell commands (git, wrangler) and path.resolve, so it is
+// validated before either. Restricting it to one path segment of safe characters keeps
+// `$(...)`, backticks, `;` and separators out of those commands and out of the target
+// path. Must start alphanumeric so "." and ".." can never be the whole name.
+const PROJECT_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+
+const validateProjectName = (value) => {
+  if (!PROJECT_NAME_PATTERN.test(value)) {
+    return "Project name must start with a letter or number and contain only letters, numbers, dots, dashes and underscores.";
+  }
+  return undefined;
+};
+
 // Resolve the latest release tag (v-prefixed semver) so scaffolds pin to a
 // deliberate release instead of whatever HEAD happens to be. Returns null when
 // the repo has no tags (falls back to the default branch).
@@ -91,6 +104,7 @@ async function main() {
       placeholder: "my-cms-app",
       validate: (value) => {
         if (!value) return "Project name is required";
+        return validateProjectName(value);
       },
     }));
 
@@ -99,6 +113,14 @@ async function main() {
     process.exit(0);
   }
 
+  // Re-check: the interactive path validates above, but a name from argv skips it,
+  // and this value reaches shell commands and path.resolve below.
+  const nameError = validateProjectName(projectName);
+  if (nameError) {
+    p.cancel(nameError);
+    process.exit(1);
+  }
+
   const projectDir = path.resolve(process.cwd(), projectName);
   if (existsSync(projectDir)) {
     p.cancel(`Directory "${projectName}" already exists.`);
@@ -144,10 +166,16 @@ async function main() {
   let templateCommit = null;
 
   try {
-    const branchFlag = templateRef ? `--branch "${templateRef}" ` : "";
-    execSync(`git clone --depth 1 ${branchFlag}${REPO} "${projectDir}"`, {
-      stdio: "pipe",
-    });
+    const branchArgs = templateRef ? ["--branch", templateRef] : [];
+    // execFileSync, not execSync: no shell, so projectDir is passed as one argv entry
+    // and can never be reinterpreted as a command regardless of what it contains.
+    execFileSync(
+      "git",
+      ["clone", "--depth", "1", ...branchArgs, REPO, projectDir],
+      {
+        stdio: "pipe",
+      },
+    );
     try {
       templateCommit = execSync("git rev-parse HEAD", {
         cwd: projectDir,
@@ -184,31 +212,24 @@ async function main() {
   const targetDir = path.join(adaptersDir, target);
 
   if (target === "cloudflare") {
+    // The Cloudflare adapter/storage/env implementations live in the tree at
+    // src/cms/platform/cloudflare. We only copy the target's Astro/Drizzle/wrangler config and
+    // flip the two platform selectors to point at that profile — no source files are overwritten.
     cpSync(
       path.join(targetDir, "astro.config.mjs"),
       path.join(projectDir, "astro.config.mjs"),
     );
-    cpSync(
-      path.join(targetDir, "src/cms/adapters/db.ts"),
-      path.join(projectDir, "src/cms/adapters/db.ts"),
-    );
     cpSync(
       path.join(targetDir, "drizzle.config.ts"),
       path.join(projectDir, "drizzle.config.ts"),
     );
-    cpSync(
-      path.join(targetDir, "src/cms/adapters/storage.ts"),
-      path.join(projectDir, "src/cms/adapters/storage.ts"),
-    );
-    cpSync(
-      path.join(targetDir, "src/cms/adapters/cf-env.ts"),
-      path.join(projectDir, "src/cms/adapters/cf-env.ts"),
+    writeFileSync(
+      path.join(projectDir, "src/cms/adapters/db.ts"),
+      'export * from "../platform/cloudflare/database";\n',
     );
-    const uploadsRouteDir = path.join(projectDir, "src/pages/uploads");
-    mkdirSync(uploadsRouteDir, { recursive: true });
-    cpSync(
-      path.join(targetDir, "src/pages/uploads/[...path].ts"),
-      path.join(uploadsRouteDir, "[...path].ts"),
+    writeFileSync(
+      path.join(projectDir, "src/cms/adapters/storage.ts"),
+      'export * from "../platform/cloudflare/storage";\n',
     );
   }
 
@@ -219,7 +240,7 @@ async function main() {
 
   if (target === "cloudflare") {
     delete pkg.dependencies["@astrojs/node"];
-    pkg.dependencies["@astrojs/cloudflare"] = "^13.0.0";
+    pkg.dependencies["@astrojs/cloudflare"] = "~14.1.7";
 
     // Move better-sqlite3 to devDependencies — drizzle-kit needs it to push schema to local D1
     if (pkg.dependencies["better-sqlite3"]) {
@@ -248,7 +269,7 @@ async function main() {
     );
     writeFileSync(path.join(projectDir, "wrangler.toml"), wranglerContent);
 
-    pkg.devDependencies.wrangler = "^4.0.0";
+    pkg.devDependencies.wrangler = "^4.83.0";
 
     pkg.scripts.dev = "astro dev";
     pkg.scripts.build = "astro build";
@@ -689,12 +710,25 @@ async function main() {
   // --- Done ---
 
   if (target === "local") {
-    p.outro("Starting dev server...");
-    try {
-      execSync(`${pm.run} dev`, { cwd: projectDir, stdio: "inherit" });
-    } catch {
-      console.log(`\n  Project directory: ${projectDir}`);
-      console.log(`  To start again:   cd ${projectName} && pnpm dev\n`);
+    const startDev = await p.confirm({
+      message: "Start the dev server now?",
+      initialValue: true,
+    });
+
+    if (!p.isCancel(startDev) && startDev) {
+      p.outro("Starting dev server...");
+      try {
+        execSync(`${pm.run} dev`, { cwd: projectDir, stdio: "inherit" });
+      } catch {
+        console.log(`\n  Project directory: ${projectDir}`);
+        console.log(`  To start again:   cd ${projectName} && pnpm dev\n`);
+      }
+    } else {
+      p.note(
+        [`cd ${projectName}`, "", `${pm.run} dev`].join("\n"),
+        "Next steps",
+      );
+      p.outro("Project created!");
     }
   } else {
     if (cf.deployed && cf.url) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kide-app",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Scaffold a new Kide CMS project",
   "author": "Matti Hernesniemi",
   "license": "MIT",
@@ -8,6 +8,9 @@
   "bin": {
     "create-kide-app": "./index.js"
   },
+  "scripts": {
+    "release": "npm version patch && git push --follow-tags && npm publish"
+  },
   "files": [
     "index.js"
   ],