create-skybridge 0.0.0-dev.9c78db9 → 0.0.0-dev.ac1e392

package/dist/index.d.ts

@@ -1 +1 @@
-export {};
+export declare function init(args?: string[]): Promise<void>;

package/dist/index.js

@@ -1,12 +1,8 @@
 import fs from "node:fs";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import * as prompts from "@clack/prompts";
 import mri from "mri";
-const argv = mri(process.argv.slice(2), {
-    boolean: ["help", "overwrite"],
-    alias: { h: "help" },
-});
-const cwd = process.cwd();
 const defaultProjectName = "skybridge-project";
 // prettier-ignore
 const helpMessage = `\
@@ -22,9 +18,13 @@ Examples:
   create-skybridge my-app
   create-skybridge . --overwrite
 `;
-async function init() {
+export async function init(args = process.argv.slice(2)) {
+    const argv = mri(args, {
+        boolean: ["help", "overwrite"],
+        alias: { h: "help" },
+    });
     const argTargetDir = argv._[0]
-        ? formatTargetDir(String(argv._[0]))
+        ? sanitizeTargetDir(String(argv._[0]))
         : undefined;
     const argOverwrite = argv.overwrite;
     const help = argv.help;
@@ -43,14 +43,14 @@ async function init() {
                 defaultValue: defaultProjectName,
                 placeholder: defaultProjectName,
                 validate: (value) => {
-                    return value.length === 0 || formatTargetDir(value).length > 0
+                    return value.length === 0 || sanitizeTargetDir(value).length > 0
                         ? undefined
                         : "Invalid project name";
                 },
             });
             if (prompts.isCancel(projectName))
                 return cancel();
-            targetDir = formatTargetDir(projectName);
+            targetDir = sanitizeTargetDir(projectName);
         }
         else {
             targetDir = defaultProjectName;
@@ -94,20 +94,23 @@ async function init() {
                 return;
         }
     }
-    const root = path.join(cwd, targetDir);
+    const root = path.join(process.cwd(), targetDir);
     // 3. Copy the repository
     prompts.log.step(`Copying template...`);
     try {
-        const templateDir = new URL("../template", import.meta.url).pathname;
+        const templateDir = fileURLToPath(new URL("../template", import.meta.url));
         // Copy template to target directory
         fs.cpSync(templateDir, root, { recursive: true });
         // Rename _gitignore to .gitignore
         fs.renameSync(path.join(root, "_gitignore"), path.join(root, ".gitignore"));
         // Update project name in package.json
-        const pkgPath = path.join(root, "package.json");
-        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
-        pkg.name = path.basename(root);
-        fs.writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+        const name = path.basename(root);
+        for (const dir of ["", "server", "web"]) {
+            const pkgPath = path.join(root, dir, "package.json");
+            const pkg = fs.readFileSync(pkgPath, "utf-8");
+            const fixed = pkg.replace(/apps-sdk-template/g, name);
+            fs.writeFileSync(pkgPath, fixed);
+        }
         prompts.log.success(`Project created in ${root}`);
         prompts.outro(`Done! Next steps:\n\n  cd ${targetDir}\n  pnpm install\n  pnpm dev`);
     }
@@ -117,8 +120,17 @@ async function init() {
         process.exit(1);
     }
 }
-function formatTargetDir(targetDir) {
-    return targetDir.trim().replace(/\/+$/g, "");
+function sanitizeTargetDir(targetDir) {
+    return (targetDir
+        .trim()
+        // Only keep alphanumeric, dash, underscore, dot, @, /
+        .replace(/[^a-zA-Z0-9\-_.@/]/g, "")
+        // Prevent path traversal
+        .replace(/\.\./g, "")
+        // Collapse multiple slashes
+        .replace(/\/+/g, "/")
+        // Remove leading/trailing slashes
+        .replace(/^\/+|\/+$/g, ""));
 }
 function isEmpty(path) {
     const files = fs.readdirSync(path);
@@ -135,7 +147,3 @@ function emptyDir(dir) {
         fs.rmSync(path.resolve(dir, file), { recursive: true, force: true });
     }
 }
-init().catch((e) => {
-    console.error(e);
-    process.exit(1);
-});

package/dist/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/index.test.js

@@ -0,0 +1,22 @@
+import { randomBytes } from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { afterEach, beforeEach, describe, it } from "vitest";
+import { init } from "./index.js";
+describe("create-skybridge", () => {
+    let tempDirName;
+    beforeEach(() => {
+        tempDirName = `test-${randomBytes(2).toString("hex")}`;
+    });
+    afterEach(async () => {
+        await fs.rm(path.join(process.cwd(), tempDirName), {
+            recursive: true,
+            force: true,
+        });
+    });
+    it("should scaffold a new project", async () => {
+        const name = `../../${tempDirName}//project$`;
+        await init([name]);
+        await fs.access(path.join(process.cwd(), tempDirName, "project", ".gitignore"));
+    });
+});

package/index.js

@@ -1,3 +1,8 @@
 #!/usr/bin/env node
 
-import "./dist/index.js";
+import { init } from "./dist/index.js";
+
+init().catch((e) => {
+  console.error(e);
+  process.exit(1);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-skybridge",
-  "version": "0.0.0-dev.9c78db9",
+  "version": "0.0.0-dev.ac1e392",
   "type": "module",
   "license": "MIT",
   "author": "Alpic",
@@ -18,6 +18,8 @@
   ],
   "scripts": {
     "build": "tsc",
+    "test": "pnpm run test:unit && pnpm run test:type && pnpm run test:format",
+    "test:unit": "vitest run",
     "test:type": "tsc --noEmit",
     "test:format": "biome ci",
     "prepublishOnly": "pnpm run build"
@@ -28,6 +30,7 @@
   },
   "devDependencies": {
     "@types/node": "^25.0.3",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "vitest": "^2.1.9"
   }
 }