cronus-ui 0.6.0

package/dist/utils.d.ts

@@ -0,0 +1,72 @@
+import type { CronusUIConfig } from "./config.js";
+import type { RegistryItem } from "./registry.js";
+export declare const log: {
+    info: (msg: string) => void;
+    ok: (msg: string) => void;
+    warn: (msg: string) => void;
+    err: (msg: string) => void;
+    step: (msg: string) => void;
+    title: (msg: string) => void;
+};
+export type PackageManager = "bun" | "pnpm" | "yarn" | "npm";
+export declare function detectPackageManager(cwd: string): PackageManager;
+export declare function installArgs(pm: PackageManager, deps: string[]): string[];
+export declare function runInstall(pm: PackageManager, deps: string[], cwd: string): Promise<void>;
+/**
+ * Rewrite a component's canonical specifiers to the consumer's aliases:
+ *   "../lib/cn.js"         → `${aliases.lib}/cn`
+ *   "../lib/demo-store.js" → `${aliases.lib}/demo-store`
+ *   "./button.js"          → `${aliases.ui}/button`
+ * The `../lib/<name>.js` rule is generalized (F3) so any shared `registry:lib`
+ * a block depends on — `cn`, `demo-store`, `demo-saas`, … — rewrites to the
+ * consumer's `lib` alias, not just `cn`. npm imports are left untouched.
+ */
+export declare function rewriteImports(content: string, config: CronusUIConfig): string;
+export declare function targetDir(config: CronusUIConfig, target: "ui" | "lib" | "block"): string;
+export declare function writeFileEnsured(filePath: string, content: string): Promise<void>;
+/**
+ * Resolve a registry-supplied `filePath` against `<cwd>/<dir>` while guaranteeing
+ * the result stays inside that directory. `filePath` arrives raw from a remote
+ * registry, so it is untrusted: reject absolute paths and any `..` traversal that
+ * would escape the target root (e.g. "../escape" or "/etc/passwd").
+ *
+ * Returns the resolved absolute destination; throws a clear Error naming the
+ * offending path otherwise.
+ */
+export declare function resolveSafeDest(cwd: string, dir: string, filePath: string): string;
+/** Write all files of a resolved item, applying alias rewrites, return written paths. */
+export declare function writeItemFiles(item: RegistryItem, config: CronusUIConfig, cwd: string, { overwrite }: {
+    overwrite: boolean;
+}): Promise<{
+    written: string[];
+    skipped: string[];
+}>;
+/**
+ * Guard a single registry-supplied dependency token before it is handed to the
+ * package manager. Dependency strings arrive raw from a remote registry, so a
+ * malicious entry like "--registry=http://evil" or "-g" would otherwise be
+ * spawned as a package-manager flag (arg injection). Reject anything that is not
+ * a plain npm package spec, naming the offending token in the thrown Error.
+ *
+ * Note the explicit leading-`-` check: a literal `-` is a legal *internal*
+ * package-name character (so the name char class permits it), which means the
+ * regex alone would accept "-g". We reject a leading dash outright so a spec can
+ * never be parsed as a CLI flag.
+ */
+export declare function assertValidDependency(dep: string): void;
+/**
+ * Collect + de-duplicate npm deps across resolved items. Every dependency is
+ * validated here — the single point all registry deps pass through before the
+ * package-manager spawn — so an injected/malformed spec throws before install.
+ */
+export declare function collectDependencies(items: RegistryItem[]): string[];
+/** Levenshtein edit distance between two strings (small inputs: registry names). */
+export declare function levenshtein(a: string, b: string): number;
+/**
+ * Find the closest registry name to a (presumably mistyped) `name`. Prefers a
+ * substring match, then falls back to the nearest by edit distance, but only
+ * when that distance is small enough to be a plausible typo. Returns undefined
+ * when nothing is close enough to suggest.
+ */
+export declare function closestName(name: string, candidates: string[]): string | undefined;
+//# sourceMappingURL=utils.d.ts.map

package/dist/utils.js

@@ -0,0 +1,186 @@
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
+import pc from "picocolors";
+export const log = {
+    info: (msg) => console.log(`${pc.cyan("ℹ")} ${msg}`),
+    ok: (msg) => console.log(`${pc.green("✔")} ${msg}`),
+    warn: (msg) => console.log(`${pc.yellow("⚠")} ${msg}`),
+    err: (msg) => console.error(`${pc.red("✖")} ${msg}`),
+    step: (msg) => console.log(`${pc.dim("›")} ${msg}`),
+    title: (msg) => console.log(`\n${pc.bold(msg)}`),
+};
+export function detectPackageManager(cwd) {
+    if (existsSync(join(cwd, "bun.lock")) || existsSync(join(cwd, "bun.lockb")))
+        return "bun";
+    if (existsSync(join(cwd, "pnpm-lock.yaml")))
+        return "pnpm";
+    if (existsSync(join(cwd, "yarn.lock")))
+        return "yarn";
+    return "npm";
+}
+export function installArgs(pm, deps) {
+    switch (pm) {
+        case "bun":
+            return ["add", ...deps];
+        case "pnpm":
+            return ["add", ...deps];
+        case "yarn":
+            return ["add", ...deps];
+        default:
+            return ["install", ...deps];
+    }
+}
+export function runInstall(pm, deps, cwd) {
+    return new Promise((resolvePromise, reject) => {
+        const child = spawn(pm, installArgs(pm, deps), { cwd, stdio: "inherit" });
+        child.on("error", reject);
+        child.on("close", (code) => code === 0 ? resolvePromise() : reject(new Error(`${pm} exited with code ${code}`)));
+    });
+}
+/**
+ * Rewrite a component's canonical specifiers to the consumer's aliases:
+ *   "../lib/cn.js"         → `${aliases.lib}/cn`
+ *   "../lib/demo-store.js" → `${aliases.lib}/demo-store`
+ *   "./button.js"          → `${aliases.ui}/button`
+ * The `../lib/<name>.js` rule is generalized (F3) so any shared `registry:lib`
+ * a block depends on — `cn`, `demo-store`, `demo-saas`, … — rewrites to the
+ * consumer's `lib` alias, not just `cn`. npm imports are left untouched.
+ */
+export function rewriteImports(content, config) {
+    return content
+        .replace(/(["'])\.\.\/lib\/([\w-]+)\.js\1/g, `"${config.aliases.lib}/$2"`)
+        .replace(/(["'])\.\/([\w-]+)\.js\1/g, `"${config.aliases.ui}/$2"`);
+}
+export function targetDir(config, target) {
+    switch (target) {
+        case "ui":
+            return config.paths.ui;
+        case "block":
+            return config.paths.blocks;
+        default:
+            return config.paths.lib;
+    }
+}
+export async function writeFileEnsured(filePath, content) {
+    await mkdir(dirname(filePath), { recursive: true });
+    await writeFile(filePath, content, "utf8");
+}
+/**
+ * Resolve a registry-supplied `filePath` against `<cwd>/<dir>` while guaranteeing
+ * the result stays inside that directory. `filePath` arrives raw from a remote
+ * registry, so it is untrusted: reject absolute paths and any `..` traversal that
+ * would escape the target root (e.g. "../escape" or "/etc/passwd").
+ *
+ * Returns the resolved absolute destination; throws a clear Error naming the
+ * offending path otherwise.
+ */
+export function resolveSafeDest(cwd, dir, filePath) {
+    if (isAbsolute(filePath)) {
+        throw new Error(`Refusing to write absolute registry path: ${filePath}`);
+    }
+    const resolvedRoot = resolve(join(cwd, dir));
+    const resolvedDest = resolve(join(cwd, dir, filePath));
+    if (resolvedDest !== resolvedRoot && !resolvedDest.startsWith(resolvedRoot + sep)) {
+        throw new Error(`Refusing to write registry path outside target directory: ${filePath}`);
+    }
+    return resolvedDest;
+}
+/** Write all files of a resolved item, applying alias rewrites, return written paths. */
+export async function writeItemFiles(item, config, cwd, { overwrite }) {
+    const written = [];
+    const skipped = [];
+    for (const file of item.files) {
+        const dir = targetDir(config, file.target);
+        const dest = resolveSafeDest(cwd, dir, file.path);
+        if (existsSync(dest) && !overwrite) {
+            skipped.push(join(dir, file.path));
+            continue;
+        }
+        await writeFileEnsured(dest, rewriteImports(file.content, config));
+        written.push(join(dir, file.path));
+    }
+    return { written, skipped };
+}
+/**
+ * A valid npm package spec: an optionally-scoped name with an optional
+ * `@version`/range suffix (e.g. "react", "@radix-ui/react-slot", "clsx@^2.1.1").
+ * Case-insensitive.
+ */
+const VALID_DEPENDENCY_RE = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*(@[^\s]+)?$/i;
+/**
+ * Guard a single registry-supplied dependency token before it is handed to the
+ * package manager. Dependency strings arrive raw from a remote registry, so a
+ * malicious entry like "--registry=http://evil" or "-g" would otherwise be
+ * spawned as a package-manager flag (arg injection). Reject anything that is not
+ * a plain npm package spec, naming the offending token in the thrown Error.
+ *
+ * Note the explicit leading-`-` check: a literal `-` is a legal *internal*
+ * package-name character (so the name char class permits it), which means the
+ * regex alone would accept "-g". We reject a leading dash outright so a spec can
+ * never be parsed as a CLI flag.
+ */
+export function assertValidDependency(dep) {
+    if (dep.startsWith("-") || !VALID_DEPENDENCY_RE.test(dep)) {
+        throw new Error(`Refusing to install invalid dependency spec from registry: ${dep}`);
+    }
+}
+/**
+ * Collect + de-duplicate npm deps across resolved items. Every dependency is
+ * validated here — the single point all registry deps pass through before the
+ * package-manager spawn — so an injected/malformed spec throws before install.
+ */
+export function collectDependencies(items) {
+    const set = new Set();
+    for (const item of items) {
+        for (const dep of item.dependencies) {
+            assertValidDependency(dep);
+            set.add(dep);
+        }
+    }
+    return [...set].sort();
+}
+/** Levenshtein edit distance between two strings (small inputs: registry names). */
+export function levenshtein(a, b) {
+    // Single rolling row of the DP matrix (row 0 = distances against an empty `a`).
+    const row = Array.from({ length: b.length + 1 }, (_, j) => j);
+    for (let i = 1; i <= a.length; i++) {
+        let prevDiag = row[0] ?? 0; // dist[i-1][0]
+        row[0] = i;
+        for (let j = 1; j <= b.length; j++) {
+            const above = row[j] ?? 0; // dist[i-1][j], not yet overwritten
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            row[j] = Math.min(above + 1, (row[j - 1] ?? 0) + 1, prevDiag + cost);
+            prevDiag = above;
+        }
+    }
+    return row[b.length] ?? 0;
+}
+/**
+ * Find the closest registry name to a (presumably mistyped) `name`. Prefers a
+ * substring match, then falls back to the nearest by edit distance, but only
+ * when that distance is small enough to be a plausible typo. Returns undefined
+ * when nothing is close enough to suggest.
+ */
+export function closestName(name, candidates) {
+    if (candidates.length === 0)
+        return undefined;
+    const needle = name.toLowerCase();
+    const substring = candidates.find((c) => c.toLowerCase().includes(needle) || needle.includes(c.toLowerCase()));
+    if (substring)
+        return substring;
+    let best;
+    let bestDist = Number.POSITIVE_INFINITY;
+    for (const candidate of candidates) {
+        const dist = levenshtein(needle, candidate.toLowerCase());
+        if (dist < bestDist) {
+            bestDist = dist;
+            best = candidate;
+        }
+    }
+    // Only suggest when it is a plausible typo (scaled to the name length).
+    const threshold = Math.max(2, Math.floor(name.length / 2));
+    return best !== undefined && bestDist <= threshold ? best : undefined;
+}
+//# sourceMappingURL=utils.js.map

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "cronus-ui",
+  "version": "0.6.0",
+  "description": "cronus-ui — add Cronus UI components to your project, shadcn-style (copy-paste registry).",
+  "type": "module",
+  "license": "MIT",
+  "author": "Cronus",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pedrogbraz/cronus-ui.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://aicronus.com",
+  "bugs": {
+    "url": "https://github.com/pedrogbraz/cronus-ui/issues"
+  },
+  "keywords": [
+    "cronus",
+    "components",
+    "design-system",
+    "registry",
+    "shadcn",
+    "tailwind",
+    "ui"
+  ],
+  "bin": {
+    "cronus-ui": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "templates",
+    "LICENSE",
+    "README.md",
+    "!dist/**/*.map"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./compose": {
+      "types": "./dist/compose.d.ts",
+      "import": "./dist/compose.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "prepublishOnly": "tsc -p tsconfig.json",
+    "registry": "bun run scripts/build-registry.ts",
+    "registry:check": "bun run scripts/check-registry.ts"
+  },
+  "dependencies": {
+    "@cronus-ui/ai-kit": "0.6.0",
+    "commander": "^15.0.0",
+    "picocolors": "^1.1.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^6.0.3"
+  },
+  "engines": {
+    "node": ">=22.12.0"
+  }
+}

package/templates/apps/chat.json

@@ -0,0 +1,44 @@
+{
+  "name": "chat",
+  "type": "registry:app",
+  "planVersion": 1,
+  "manifest": {
+    "title": "Chat",
+    "description": "A Pro assistant app: chat thread and prompt box under an app shell, plus a replies surface and settings.",
+    "chrome": {
+      "shell": { "block": "app-shell-chrome" },
+      "bare": {}
+    },
+    "pages": [
+      {
+        "route": "/login",
+        "title": "Sign in",
+        "chrome": "bare",
+        "blocks": [{ "block": "login", "variant": "split" }]
+      },
+      {
+        "route": "/",
+        "title": "Thread",
+        "nav": "Thread",
+        "chrome": "shell",
+        "blocks": ["chat-thread"]
+      },
+      {
+        "route": "/new",
+        "title": "New",
+        "nav": "New",
+        "chrome": "shell",
+        "blocks": ["prompt-box", "ai-response"]
+      },
+      {
+        "route": "/settings",
+        "title": "Settings",
+        "nav": "Settings",
+        "chrome": "shell",
+        "blocks": ["settings"]
+      }
+    ],
+    "extras": { "not-found": "not-found" },
+    "defaults": { "theme": "aurora", "mode": "dark", "brand": "__APP_NAME__" }
+  }
+}

package/templates/apps/finance.json

@@ -0,0 +1,44 @@
+{
+  "name": "finance",
+  "type": "registry:app",
+  "planVersion": 1,
+  "manifest": {
+    "title": "Finance",
+    "description": "A Pro money app: payouts and invoices on the home, plus billing, usage, and analytics under an app shell.",
+    "chrome": {
+      "shell": { "block": "app-shell-chrome" },
+      "bare": {}
+    },
+    "pages": [
+      {
+        "route": "/login",
+        "title": "Sign in",
+        "chrome": "bare",
+        "blocks": [{ "block": "login", "variant": "split" }]
+      },
+      {
+        "route": "/",
+        "title": "Money",
+        "nav": "Money",
+        "chrome": "shell",
+        "blocks": ["payouts", "invoice"]
+      },
+      {
+        "route": "/billing",
+        "title": "Billing",
+        "nav": "Billing",
+        "chrome": "shell",
+        "blocks": ["billing", "usage-dashboard"]
+      },
+      {
+        "route": "/analytics",
+        "title": "Analytics",
+        "nav": "Analytics",
+        "chrome": "shell",
+        "blocks": ["analytics"]
+      }
+    ],
+    "extras": { "not-found": "not-found" },
+    "defaults": { "theme": "emerald", "mode": "light", "brand": "__APP_NAME__" }
+  }
+}

package/templates/apps/landing-agency.json

@@ -0,0 +1,31 @@
+{
+  "name": "landing-agency",
+  "type": "registry:app",
+  "planVersion": 1,
+  "manifest": {
+    "title": "Agency",
+    "description": "Studio/agency landing: split hero, logo cloud, about story, services grid, stats, testimonials, and CTA. Midnight, dark.",
+    "chrome": {
+      "site": { "navbar": "navbar", "footer": "footer" }
+    },
+    "pages": [
+      {
+        "route": "/",
+        "title": "Home",
+        "nav": "Home",
+        "chrome": "site",
+        "blocks": [
+          { "block": "hero", "variant": "split" },
+          "logo-cloud",
+          "about",
+          "feature-grid",
+          "stats",
+          "testimonials",
+          "cta"
+        ]
+      }
+    ],
+    "extras": { "not-found": "not-found" },
+    "defaults": { "theme": "midnight", "mode": "dark", "brand": "__APP_NAME__" }
+  }
+}

package/templates/apps/landing-agents.json

@@ -0,0 +1,32 @@
+{
+  "name": "landing-agents",
+  "type": "registry:app",
+  "planVersion": 1,
+  "manifest": {
+    "title": "Agents",
+    "description": "Automation/agent landing: split hero, marquee logos, bento features, stats, proof, pricing, FAQ, and a banner CTA. Emerald, light.",
+    "chrome": {
+      "site": { "navbar": "navbar", "footer": "footer" }
+    },
+    "pages": [
+      {
+        "route": "/",
+        "title": "Home",
+        "nav": "Home",
+        "chrome": "site",
+        "blocks": [
+          { "block": "hero", "variant": "split" },
+          { "block": "logo-cloud", "variant": "marquee" },
+          { "block": "feature-grid", "variant": "bento" },
+          "stats",
+          "testimonials",
+          "pricing",
+          "faq",
+          { "block": "cta", "variant": "banner" }
+        ]
+      }
+    ],
+    "extras": { "not-found": "not-found" },
+    "defaults": { "theme": "emerald", "mode": "light", "brand": "__APP_NAME__" }
+  }
+}

package/templates/apps/landing-broadcast.json

@@ -0,0 +1,29 @@
+{
+  "name": "landing-broadcast",
+  "type": "registry:app",
+  "planVersion": 1,
+  "manifest": {
+    "title": "Broadcast",
+    "description": "Studio/show landing: atmospheric hero, marquee logos, feature grid, testimonials, pricing, and footer chrome. Aurora, dark.",
+    "chrome": {
+      "site": { "navbar": "navbar", "footer": "footer" }
+    },
+    "pages": [
+      {
+        "route": "/",
+        "title": "Home",
+        "nav": "Home",
+        "chrome": "site",
+        "blocks": [
+          { "block": "hero", "variant": "atmosphere" },
+          { "block": "logo-cloud", "variant": "marquee" },
+          "feature-grid",
+          "testimonials",
+          "pricing"
+        ]
+      }
+    ],
+    "extras": { "not-found": "not-found" },
+    "defaults": { "theme": "aurora", "mode": "dark", "brand": "__APP_NAME__" }
+  }
+}

package/templates/apps/landing-care.json

@@ -0,0 +1,28 @@
+{
+  "name": "landing-care",
+  "type": "registry:app",
+  "planVersion": 1,
+  "manifest": {
+    "title": "Care",
+    "description": "Calm healthcare/conversion landing: waitlist hero, bento features, testimonials, and a contained CTA. Emerald, light.",
+    "chrome": {
+      "site": { "navbar": "navbar", "footer": "footer" }
+    },
+    "pages": [
+      {
+        "route": "/",
+        "title": "Home",
+        "nav": "Home",
+        "chrome": "site",
+        "blocks": [
+          "waitlist",
+          { "block": "feature-grid", "variant": "bento" },
+          "testimonials",
+          "cta"
+        ]
+      }
+    ],
+    "extras": { "not-found": "not-found" },
+    "defaults": { "theme": "emerald", "mode": "light", "brand": "__APP_NAME__" }
+  }
+}

package/templates/apps/landing-coverage.json

@@ -0,0 +1,23 @@
+{
+  "name": "landing-coverage",
+  "type": "registry:app",
+  "planVersion": 1,
+  "manifest": {
+    "title": "Coverage",
+    "description": "Global-services landing: centered hero, stats, testimonial grid, FAQ, and CTA. Sunset, light.",
+    "chrome": {
+      "site": { "navbar": "navbar", "footer": "footer" }
+    },
+    "pages": [
+      {
+        "route": "/",
+        "title": "Home",
+        "nav": "Home",
+        "chrome": "site",
+        "blocks": ["hero", "stats", { "block": "testimonials", "variant": "grid" }, "faq", "cta"]
+      }
+    ],
+    "extras": { "not-found": "not-found" },
+    "defaults": { "theme": "sunset", "mode": "light", "brand": "__APP_NAME__" }
+  }
+}

package/templates/apps/landing-docs.json

@@ -0,0 +1,29 @@
+{
+  "name": "landing-docs",
+  "type": "registry:app",
+  "planVersion": 1,
+  "manifest": {
+    "title": "Docs product",
+    "description": "Developer-tool landing: announcement navbar energy via compact hero, logo cloud, features, integrations, and CTA.",
+    "chrome": {
+      "site": { "navbar": "navbar", "footer": "footer" }
+    },
+    "pages": [
+      {
+        "route": "/",
+        "title": "Home",
+        "nav": "Home",
+        "chrome": "site",
+        "blocks": [
+          { "block": "hero", "variant": "compact" },
+          "logo-cloud",
+          "feature-grid",
+          "integrations",
+          "cta"
+        ]
+      }
+    ],
+    "extras": { "not-found": "not-found" },
+    "defaults": { "theme": "aurora", "mode": "dark", "brand": "__APP_NAME__" }
+  }
+}

package/templates/apps/landing-glass.json

@@ -0,0 +1,28 @@
+{
+  "name": "landing-glass",
+  "type": "registry:app",
+  "planVersion": 1,
+  "manifest": {
+    "title": "Glass",
+    "description": "Glass-dark landing: atmospheric hero, bento features, split FAQ, and a split-visual CTA. Midnight, dark.",
+    "chrome": {
+      "site": { "navbar": "navbar", "footer": "footer" }
+    },
+    "pages": [
+      {
+        "route": "/",
+        "title": "Home",
+        "nav": "Home",
+        "chrome": "site",
+        "blocks": [
+          { "block": "hero", "variant": "atmosphere" },
+          { "block": "feature-grid", "variant": "bento" },
+          { "block": "faq", "variant": "split" },
+          { "block": "cta", "variant": "split-visual" }
+        ]
+      }
+    ],
+    "extras": { "not-found": "not-found" },
+    "defaults": { "theme": "midnight", "mode": "dark", "brand": "__APP_NAME__" }
+  }
+}

package/templates/apps/landing-ops.json

@@ -0,0 +1,29 @@
+{
+  "name": "landing-ops",
+  "type": "registry:app",
+  "planVersion": 1,
+  "manifest": {
+    "title": "Ops",
+    "description": "Linear-style product landing: split hero with a quality panel, logo cloud, workflow features, integrations, and a full-width CTA.",
+    "chrome": {
+      "site": { "navbar": "navbar", "footer": "footer" }
+    },
+    "pages": [
+      {
+        "route": "/",
+        "title": "Home",
+        "nav": "Home",
+        "chrome": "site",
+        "blocks": [
+          { "block": "hero", "variant": "split" },
+          "logo-cloud",
+          "feature-grid",
+          "integrations",
+          { "block": "cta", "variant": "banner" }
+        ]
+      }
+    ],
+    "extras": { "not-found": "not-found" },
+    "defaults": { "theme": "aurora", "mode": "dark", "brand": "__APP_NAME__" }
+  }
+}