create-thally-docs 0.9.0 → 0.10.0

package/dist/chunk-ENQIF6MA.js

@@ -0,0 +1,164 @@
+#!/usr/bin/env node
+import {
+  readStarterReleaseManifest
+} from "./chunk-KXJT2MG5.js";
+import {
+  STABLE_SCAFFOLD_RELEASE
+} from "./chunk-WMHBVXWW.js";
+
+// src/download.ts
+import { Readable, Transform, pipeline } from "stream";
+import { promisify } from "util";
+import {
+  cpSync,
+  lstatSync,
+  mkdtempSync,
+  readdirSync,
+  renameSync,
+  rmdirSync,
+  rmSync
+} from "fs";
+import { tmpdir } from "os";
+import { dirname, join } from "path";
+import { extract } from "tar";
+var pipelineAsync = promisify(pipeline);
+var STARTER_FETCH_TIMEOUT_MS = 15e3;
+var MAX_COMPRESSED_ARCHIVE_BYTES = 64 * 1024 * 1024;
+var MAX_EXTRACTED_ARCHIVE_BYTES = 256 * 1024 * 1024;
+var MAX_ARCHIVE_FILE_BYTES = 32 * 1024 * 1024;
+var MAX_ARCHIVE_ENTRIES = 1e4;
+var STARTER_REPOSITORY = STABLE_SCAFFOLD_RELEASE.source.repository;
+var STARTER_COMMIT_SHA = STABLE_SCAFFOLD_RELEASE.source.commitSha;
+var STARTER_ARCHIVE_ROOT = `${STARTER_REPOSITORY.split("/").at(-1)}-${STARTER_COMMIT_SHA}`;
+function starterArchiveRoot(release) {
+  return `${release.source.repository.split("/").at(-1)}-${release.source.commitSha}`;
+}
+function validateStarterArchiveEntry(archivePath, entry, archiveRoot = STARTER_ARCHIVE_ROOT) {
+  if (!archivePath || archivePath.includes("\0") || archivePath.includes("\\") || archivePath.startsWith("/")) {
+    throw new Error("The stable Thally starter archive contains an unsafe path.");
+  }
+  const pathWithoutTrailingSlash = archivePath.endsWith("/") ? archivePath.slice(0, -1) : archivePath;
+  const parts = pathWithoutTrailingSlash.split("/");
+  const [root, ...relativeParts] = parts;
+  if (root !== archiveRoot || relativeParts.some((part) => !part || part === "." || part === "..")) {
+    throw new Error("The stable Thally starter archive contains an unsafe path.");
+  }
+  if (relativeParts.length === 0 && entry.type !== "Directory") {
+    throw new Error("The stable Thally starter archive has an invalid root entry.");
+  }
+  if (!["File", "OldFile", "Directory"].includes(entry.type)) {
+    throw new Error(
+      `The stable Thally starter archive contains unsupported entry type ${entry.type}.`
+    );
+  }
+  if (!Number.isSafeInteger(entry.size) || entry.size < 0 || entry.size > MAX_ARCHIVE_FILE_BYTES) {
+    throw new Error("The stable Thally starter archive contains an oversized file.");
+  }
+}
+function starterArchiveFilter(archiveRoot) {
+  let entryCount = 0;
+  let extractedBytes = 0;
+  return (path, entry) => {
+    if (!("type" in entry)) {
+      throw new Error("The starter archive filter requires extraction metadata.");
+    }
+    validateStarterArchiveEntry(path, entry, archiveRoot);
+    entryCount += 1;
+    extractedBytes += entry.size;
+    if (entryCount > MAX_ARCHIVE_ENTRIES || extractedBytes > MAX_EXTRACTED_ARCHIVE_BYTES) {
+      throw new Error("The stable Thally starter archive exceeds extraction limits.");
+    }
+    return true;
+  };
+}
+function compressedArchiveLimit() {
+  let compressedBytes = 0;
+  return new Transform({
+    transform(chunk, _encoding, callback) {
+      compressedBytes += chunk.length;
+      if (compressedBytes > MAX_COMPRESSED_ARCHIVE_BYTES) {
+        callback(new Error("The stable Thally starter archive is too large."));
+        return;
+      }
+      callback(null, chunk);
+    }
+  });
+}
+async function downloadStarter(targetDir, siteName, release = STABLE_SCAFFOLD_RELEASE, options = {}) {
+  if (options.announce !== false) {
+    console.log("");
+    console.log(`  \u23F3 Creating ${siteName?.trim() || "your docs site"}...`);
+  }
+  const targetEntry = lstatSync(targetDir);
+  if (!targetEntry.isDirectory() || targetEntry.isSymbolicLink()) {
+    throw new Error("The Thally starter target must be a regular directory.");
+  }
+  if (readdirSync(targetDir).length > 0) {
+    throw new Error("The Thally starter target directory must be empty.");
+  }
+  const response = await fetch(release.source.archiveUrl, {
+    headers: { accept: "application/gzip, application/octet-stream;q=0.9" },
+    cache: "no-store",
+    signal: AbortSignal.timeout(STARTER_FETCH_TIMEOUT_MS)
+  });
+  if (!response.ok) {
+    throw new Error(
+      `Failed to download the stable Thally starter: ${response.status} ${response.statusText}`
+    );
+  }
+  if (!response.body) {
+    throw new Error("The stable Thally starter response body is empty.");
+  }
+  const contentLength = Number(response.headers.get("content-length"));
+  if (Number.isFinite(contentLength) && contentLength > MAX_COMPRESSED_ARCHIVE_BYTES) {
+    throw new Error("The stable Thally starter archive is too large.");
+  }
+  const nodeStream = Readable.fromWeb(
+    response.body
+  );
+  const stagingDir = mkdtempSync(join(tmpdir(), "thally-starter-download-"));
+  try {
+    await pipelineAsync(
+      nodeStream,
+      compressedArchiveLimit(),
+      extract({
+        cwd: stagingDir,
+        strip: 1,
+        filter: starterArchiveFilter(starterArchiveRoot(release)),
+        preservePaths: false,
+        strict: true,
+        unlink: true,
+        maxDecompressionRatio: 100
+      })
+    );
+    readStarterReleaseManifest(stagingDir, release);
+    const deliveryDir = mkdtempSync(
+      join(dirname(targetDir), ".thally-starter-delivery-")
+    );
+    try {
+      for (const entry of readdirSync(stagingDir)) {
+        cpSync(join(stagingDir, entry), join(deliveryDir, entry), {
+          recursive: true,
+          errorOnExist: true
+        });
+      }
+      if (readdirSync(targetDir).length > 0) {
+        throw new Error("The Thally starter target changed during download.");
+      }
+      rmdirSync(targetDir);
+      renameSync(deliveryDir, targetDir);
+    } finally {
+      rmSync(deliveryDir, { recursive: true, force: true });
+    }
+  } finally {
+    rmSync(stagingDir, { recursive: true, force: true });
+  }
+}
+
+export {
+  STARTER_REPOSITORY,
+  STARTER_COMMIT_SHA,
+  STARTER_ARCHIVE_ROOT,
+  validateStarterArchiveEntry,
+  downloadStarter
+};

package/dist/{chunk-YWNWLSZ2.js → chunk-GAFCLXU4.js}

@@ -3,7 +3,7 @@ import {
   initGit,
   installDeps,
   scaffold
-} from "./chunk-JNDRCCJV.js";
+} from "./chunk-GTGHYJXS.js";
 
 // src/migrate/index.ts
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";

package/dist/{chunk-JNDRCCJV.js → chunk-GTGHYJXS.js}

@@ -1,83 +1,16 @@
 #!/usr/bin/env node
 import {
-  patchApiReferenceGuard,
-  patchGitignore,
-  patchOpenApiFetch,
-  patchPackageJson,
-  patchTopBarNavigation,
-  updateEnvExample,
-  updateSiteConfig,
-  writeCloudflareRuntimeConfig,
-  writeStarterAgentGuide,
-  writeStarterContent,
-  writeStarterReadme
-} from "./chunk-BW7J7DJV.js";
+  personalizeStarter,
+  updateEnvExample
+} from "./chunk-ORUAMPNF.js";
 import {
-  STABLE_SCAFFOLD_RELEASE
-} from "./chunk-PJW4JJIT.js";
+  downloadStarter
+} from "./chunk-ENQIF6MA.js";
 
 // src/scaffold.ts
 import { existsSync, mkdirSync, readdirSync } from "fs";
 import { resolve } from "path";
 
-// src/download.ts
-import { Readable, pipeline } from "stream";
-import { promisify } from "util";
-import { extract } from "tar";
-var pipelineAsync = promisify(pipeline);
-var TEMPLATE_REPOSITORY = STABLE_SCAFFOLD_RELEASE.source.repository;
-var TEMPLATE_COMMIT_SHA = STABLE_SCAFFOLD_RELEASE.source.commitSha;
-var TARBALL_URL = STABLE_SCAFFOLD_RELEASE.source.archiveUrl;
-var EXCLUDE_PATHS = [
-  // Match both the directory entry itself and every nested file. Tar invokes
-  // the filter for `.../node_modules` before descendants, without a trailing `/`.
-  "/node_modules",
-  // The canonical docs repository may temporarily retain package sources while
-  // runtime work is being upstreamed. A scaffold consumes the published
-  // packages declared in package.json; it must never inherit those sources.
-  "/packages",
-  "/.git/",
-  "/.next/",
-  "/.data/",
-  "/.thally/",
-  // The first-party docs deployment pins its own canonical origin.
-  "/.env.production",
-  "/thally-track.yml",
-  "/CODEOWNERS",
-  "/CLAUDE.md",
-  "/notes/",
-  "/public/images/",
-  "/src/public/",
-  "/snippets/",
-  "/.github/ISSUE_TEMPLATE/",
-  "/.github/PULL_REQUEST_TEMPLATE.md",
-  "/README.md"
-];
-function shouldInclude(path) {
-  for (const excluded of EXCLUDE_PATHS) {
-    if (path.includes(excluded)) {
-      return false;
-    }
-  }
-  return true;
-}
-async function downloadTemplate(targetDir, siteName) {
-  console.log("");
-  console.log(`  \u23F3 Creating ${siteName?.trim() || "your docs site"}...`);
-  const response = await fetch(TARBALL_URL);
-  if (!response.ok) {
-    throw new Error(`Failed to download template: ${response.status} ${response.statusText}`);
-  }
-  if (!response.body) {
-    throw new Error("Response body is empty");
-  }
-  const nodeStream = Readable.fromWeb(response.body);
-  await pipelineAsync(
-    nodeStream,
-    extract({ cwd: targetDir, strip: 1, filter: shouldInclude })
-  );
-}
-
 // src/docs-json.ts
 import { readFileSync, writeFileSync } from "fs";
 import { join } from "path";
@@ -189,7 +122,16 @@ async function scaffold(options) {
   }
   mkdirSync(targetDir, { recursive: true });
   const slug = slugify(projectName);
-  await downloadTemplate(targetDir, projectName);
+  await downloadStarter(targetDir, projectName);
+  personalizeStarter(targetDir, {
+    projectName,
+    packageName: slug,
+    description,
+    brandPreset,
+    repoUrl,
+    enableAiChat,
+    i18nLocales
+  });
   resetTrackingConfig(targetDir);
   if (trackRepos?.length) {
     writeTrackingConfig(targetDir, trackRepos);
@@ -198,16 +140,6 @@ async function scaffold(options) {
     console.log("    To finish wiring it: `thally track setup` (pick a trigger) + `thally agent init`,");
     console.log("    then add your ANTHROPIC_API_KEY. See /guides/thally-track.");
   }
-  writeStarterContent(targetDir, projectName, enableAiChat, repoUrl, i18nLocales);
-  writeStarterReadme(targetDir, projectName);
-  writeStarterAgentGuide(targetDir, projectName);
-  updateSiteConfig(targetDir, projectName, description, brandPreset, repoUrl);
-  patchApiReferenceGuard(targetDir);
-  patchTopBarNavigation(targetDir);
-  patchOpenApiFetch(targetDir);
-  patchPackageJson(targetDir, slug);
-  writeCloudflareRuntimeConfig(targetDir, slug);
-  patchGitignore(targetDir);
   updateEnvExample(targetDir);
   if (doInstall) {
     installDeps(targetDir);
@@ -222,10 +154,6 @@ export {
   installDeps,
   logo,
   success,
-  TEMPLATE_REPOSITORY,
-  TEMPLATE_COMMIT_SHA,
-  EXCLUDE_PATHS,
-  shouldInclude,
   readDocsJson,
   writeDocsJson,
   scaffold