hooklatch 0.0.0-stage → 1.0.0

package/dist/cli/args.js

@@ -0,0 +1,358 @@
+import { SUPPORTED_PROVIDERS } from '../providers/index.js';
+export const FRAMEWORKS = ['express', 'nextjs', 'hono', 'cloudflare'];
+const DEFAULT_BODY_LIMIT = 1048576;
+const DEFAULT_OUT = 'hooklatch';
+const SECRET_ENV_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Grafana's own default signature header name, matching the provider factory. */
+const DEFAULT_SIGNATURE_HEADER = 'x-grafana-alerting-signature';
+/** RFC 9110 field-name token characters, matching the Grafana provider factory. */
+const FIELD_NAME_TOKEN = /^[!#$%&'*+.^_`|~\dA-Za-z-]+$/;
+/**
+ * Header names that configured Grafana fields must not replace. This is
+ * Hooklatch configuration policy, not a Grafana rule; it matches the Grafana
+ * provider factory exactly.
+ */
+const RESERVED_HEADER_NAMES = new Set([
+    'host',
+    'content-length',
+    'transfer-encoding',
+    'connection',
+    'upgrade',
+    'trailer',
+    'te',
+    'proxy-authorization',
+    'proxy-authenticate',
+    'authorization',
+    'cookie',
+    'set-cookie',
+]);
+const DEFAULT_SECRET_ENV = {
+    stripe: 'STRIPE_WEBHOOK_SECRET',
+    github: 'GITHUB_WEBHOOK_SECRET',
+    shopify: 'SHOPIFY_WEBHOOK_SECRET',
+    'standard-webhooks': 'STANDARD_WEBHOOKS_SECRET',
+    clerk: 'CLERK_WEBHOOK_SIGNING_SECRET',
+    svix: 'SVIX_WEBHOOK_SECRET',
+    razorpay: 'RAZORPAY_WEBHOOK_SECRET',
+    paddle: 'PADDLE_WEBHOOK_SECRET',
+    'lemon-squeezy': 'LEMON_SQUEEZY_WEBHOOK_SECRET',
+    'dodo-payments': 'DODO_WEBHOOK_SECRET',
+    gitlab: 'GITLAB_WEBHOOK_SECRET',
+    replicate: 'REPLICATE_WEBHOOK_SECRET',
+    workos: 'WORKOS_WEBHOOK_SECRET',
+    sentry: 'SENTRY_WEBHOOK_SECRET',
+    doppler: 'DOPPLER_WEBHOOK_SECRET',
+    sanity: 'SANITY_WEBHOOK_SECRET',
+    grafana: 'GRAFANA_WEBHOOK_SECRET',
+    polar: 'POLAR_WEBHOOK_SECRET',
+    linear: 'LINEAR_WEBHOOK_SECRET',
+    vercel: 'VERCEL_WEBHOOK_SECRET',
+};
+export const HELP_TEXT = `Usage: hooklatch init webhook --provider <id> --framework <id> [options]
+
+Generate one TypeScript webhook endpoint file from an existing Hooklatch adapter.
+
+Required:
+  --provider <id>       Implemented provider id.
+  --framework <id>      One of: express, nextjs, hono, cloudflare.
+
+Options:
+  --out <dir>           Output directory (default: ${DEFAULT_OUT}).
+  --secret-env <NAME>   Environment variable holding the secret (default by provider).
+  --body-limit <bytes>  Positive safe integer body limit (default: ${DEFAULT_BODY_LIMIT}).
+  --grafana-mode <mode> Grafana only: body or timestamped (required for grafana).
+  --signature-header <NAME>
+                        Grafana only: RFC 9110 header token (default ${DEFAULT_SIGNATURE_HEADER}).
+  --timestamp-header <NAME>
+                        Grafana only: required with timestamped; forbidden with body.
+  --polar-secret-mode <mode>
+                        Polar only: current (default) or legacy.
+  --public-key-env <NAME>
+                        Fal only: env var holding comma-separated Base64url public keys (default FAL_WEBHOOK_PUBLIC_KEYS).
+  --expected-user-env <NAME>
+                        Fal only: env var holding the expected user id (default FAL_WEBHOOK_USER_ID).
+  --dry-run             Print the target path and contents without writing.
+  -h, --help            Show this help.
+
+Exit codes:
+  0  Success, dry run, or help.
+  1  Unexpected generation or I/O error.
+  2  Invalid arguments or unsafe path.
+  3  Target file already exists.
+`;
+function isFramework(value) {
+    // SAFETY: FRAMEWORKS is a fixed readonly tuple of literal framework names; widening to string[] only supports Array.includes.
+    return FRAMEWORKS.includes(value);
+}
+// CLI accepted providers come solely from SUPPORTED_PROVIDERS (Codex-owned registry).
+// Shadow registration of 'vercel'/'fal' is intentionally removed: those providers
+// are not registered at this base and cannot honestly be scaffolded through the CLI.
+function isProvider(value) {
+    // SAFETY: SUPPORTED_PROVIDERS is a fixed readonly tuple of implemented provider ids; widening to string[] only supports Array.includes.
+    return SUPPORTED_PROVIDERS.includes(value);
+}
+function isPositiveSafeInteger(value) {
+    if (!/^[0-9]+$/.test(value))
+        return false;
+    const number = Number(value);
+    return Number.isSafeInteger(number) && number > 0;
+}
+function optionsError(message) {
+    return { kind: 'error', message };
+}
+/** A nonempty RFC 9110 field-name token that is not reserved by Hooklatch policy. */
+function isConfiguredHeaderName(value) {
+    return FIELD_NAME_TOKEN.test(value) && !RESERVED_HEADER_NAMES.has(value.toLowerCase());
+}
+function firstGrafanaFlag(flags) {
+    if (flags.grafanaMode !== undefined)
+        return '--grafana-mode';
+    if (flags.signatureHeader !== undefined)
+        return '--signature-header';
+    if (flags.timestampHeader !== undefined)
+        return '--timestamp-header';
+    return null;
+}
+function buildGrafanaOptions(flags) {
+    if (flags.polarSecretMode !== undefined) {
+        return optionsError('The --polar-secret-mode flag is only valid for polar.');
+    }
+    const mode = flags.grafanaMode;
+    if (mode === undefined)
+        return optionsError('Missing required --grafana-mode for grafana.');
+    if (mode !== 'body' && mode !== 'timestamped') {
+        return optionsError('Invalid --grafana-mode: expected body or timestamped.');
+    }
+    if (flags.signatureHeader !== undefined && !isConfiguredHeaderName(flags.signatureHeader)) {
+        return optionsError('Invalid --signature-header: expected an RFC 9110 field-name token that is not reserved.');
+    }
+    if (mode === 'body') {
+        if (flags.timestampHeader !== undefined) {
+            return optionsError('The --timestamp-header flag is not allowed in Grafana body mode.');
+        }
+        if (flags.signatureHeader === undefined) {
+            return { kind: 'options', options: { provider: 'grafana', options: { mode: 'body' } } };
+        }
+        return {
+            kind: 'options',
+            options: { provider: 'grafana', options: { mode: 'body', signatureHeader: flags.signatureHeader } },
+        };
+    }
+    const timestampHeader = flags.timestampHeader;
+    if (timestampHeader === undefined) {
+        return optionsError('Missing required --timestamp-header for Grafana timestamped mode.');
+    }
+    if (!isConfiguredHeaderName(timestampHeader)) {
+        return optionsError('Invalid --timestamp-header: expected an RFC 9110 field-name token that is not reserved.');
+    }
+    const signatureHeader = flags.signatureHeader;
+    const effectiveSignatureHeader = signatureHeader === undefined ? DEFAULT_SIGNATURE_HEADER : signatureHeader;
+    if (effectiveSignatureHeader.toLowerCase() === timestampHeader.toLowerCase()) {
+        return optionsError('The Grafana signature and timestamp headers must differ (case-insensitive).');
+    }
+    if (signatureHeader === undefined) {
+        return {
+            kind: 'options',
+            options: { provider: 'grafana', options: { mode: 'timestamped', timestampHeader } },
+        };
+    }
+    return {
+        kind: 'options',
+        options: { provider: 'grafana', options: { mode: 'timestamped', signatureHeader, timestampHeader } },
+    };
+}
+function buildFalOptions(flags) {
+    if (flags.grafanaMode !== undefined || flags.signatureHeader !== undefined || flags.timestampHeader !== undefined) {
+        return optionsError('The --grafana-mode, --signature-header and --timestamp-header flags are only valid for grafana.');
+    }
+    if (flags.polarSecretMode !== undefined) {
+        return optionsError('The --polar-secret-mode flag is only valid for polar.');
+    }
+    const publicKeyEnv = flags.publicKeyEnv ?? 'FAL_WEBHOOK_PUBLIC_KEYS';
+    const expectedUserEnv = flags.expectedUserEnv ?? 'FAL_WEBHOOK_USER_ID';
+    if (!SECRET_ENV_PATTERN.test(publicKeyEnv)) {
+        return optionsError('Invalid --public-key-env: expected an identifier.');
+    }
+    if (!SECRET_ENV_PATTERN.test(expectedUserEnv)) {
+        return optionsError('Invalid --expected-user-env: expected an identifier.');
+    }
+    return {
+        kind: 'options',
+        options: {
+            provider: 'fal',
+            options: { publicKeyEnv, expectedUserEnv },
+        },
+    };
+}
+function buildPolarOptions(flags) {
+    const grafanaFlag = firstGrafanaFlag(flags);
+    if (grafanaFlag !== null)
+        return optionsError(`The ${grafanaFlag} flag is only valid for grafana.`);
+    const mode = flags.polarSecretMode;
+    if (mode === undefined) {
+        return { kind: 'options', options: { provider: 'polar', options: { secretMode: 'current' } } };
+    }
+    if (mode !== 'current' && mode !== 'legacy') {
+        return optionsError('Invalid --polar-secret-mode: expected current or legacy.');
+    }
+    return { kind: 'options', options: { provider: 'polar', options: { secretMode: mode } } };
+}
+/**
+ * Apply provider-specific flag rules. Registration stays coordinator-owned:
+ * a provider that is not yet in the public registry is rejected by
+ * `parseArgs` before this function runs.
+ */
+export function buildProviderCliOptions(provider, flags) {
+    if (provider === 'grafana')
+        return buildGrafanaOptions(flags);
+    if (provider === 'polar')
+        return buildPolarOptions(flags);
+    if (provider === 'fal')
+        return buildFalOptions(flags);
+    const grafanaFlag = firstGrafanaFlag(flags);
+    if (grafanaFlag !== null)
+        return optionsError(`The ${grafanaFlag} flag is only valid for grafana.`);
+    if (flags.polarSecretMode !== undefined) {
+        return optionsError('The --polar-secret-mode flag is only valid for polar.');
+    }
+    if (flags.publicKeyEnv !== undefined || flags.expectedUserEnv !== undefined) {
+        return optionsError('The --public-key-env and --expected-user-env flags are only valid for fal.');
+    }
+    return { kind: 'none' };
+}
+export function parseArgs(argv) {
+    if (argv.length === 0)
+        return { kind: 'help' };
+    if (argv.includes('--help') || argv.includes('-h')) {
+        // Help is allowed only as a standalone/global request.
+        if (argv.length === 1)
+            return { kind: 'help' };
+        // Allow "init webhook --help" specifically.
+        if (argv[0] === 'init' && argv[1] === 'webhook' && argv.length === 3 && (argv[2] === '--help' || argv[2] === '-h')) {
+            return { kind: 'help' };
+        }
+        return { kind: 'error', exitCode: 2, message: 'Invalid arguments.' };
+    }
+    if (argv[0] !== 'init' || argv[1] !== 'webhook') {
+        return { kind: 'error', exitCode: 2, message: 'Invalid command. Use: hooklatch init webhook ...' };
+    }
+    const rest = argv.slice(2);
+    const seen = new Set();
+    let provider;
+    let framework;
+    let out = DEFAULT_OUT;
+    let secretEnv;
+    let bodyLimit = DEFAULT_BODY_LIMIT;
+    let dryRun = false;
+    let grafanaMode;
+    let signatureHeader;
+    let timestampHeader;
+    let polarSecretMode;
+    let publicKeyEnv;
+    let expectedUserEnv;
+    for (let i = 0; i < rest.length; i += 1) {
+        const flag = rest[i];
+        if (flag === '--dry-run') {
+            if (seen.has(flag))
+                return { kind: 'error', exitCode: 2, message: 'Duplicate flag: --dry-run.' };
+            seen.add(flag);
+            dryRun = true;
+            continue;
+        }
+        if (flag === '--provider' || flag === '--framework' || flag === '--out' || flag === '--secret-env' || flag === '--body-limit'
+            || flag === '--grafana-mode' || flag === '--signature-header' || flag === '--timestamp-header' || flag === '--polar-secret-mode'
+            || flag === '--public-key-env' || flag === '--expected-user-env') {
+            if (seen.has(flag))
+                return { kind: 'error', exitCode: 2, message: `Duplicate flag: ${flag}.` };
+            seen.add(flag);
+            const value = rest[i + 1];
+            if (value === undefined || value.startsWith('--') || value === '-h') {
+                return { kind: 'error', exitCode: 2, message: `Missing value for ${flag}.` };
+            }
+            i += 1;
+            if (flag === '--provider')
+                provider = value;
+            else if (flag === '--framework')
+                framework = value;
+            else if (flag === '--out')
+                out = value;
+            else if (flag === '--secret-env')
+                secretEnv = value;
+            else if (flag === '--grafana-mode')
+                grafanaMode = value;
+            else if (flag === '--signature-header')
+                signatureHeader = value;
+            else if (flag === '--timestamp-header')
+                timestampHeader = value;
+            else if (flag === '--polar-secret-mode')
+                polarSecretMode = value;
+            else if (flag === '--public-key-env')
+                publicKeyEnv = value;
+            else if (flag === '--expected-user-env')
+                expectedUserEnv = value;
+            else if (flag === '--body-limit') {
+                if (!isPositiveSafeInteger(value)) {
+                    return { kind: 'error', exitCode: 2, message: 'Invalid --body-limit: expected a positive safe integer.' };
+                }
+                bodyLimit = Number(value);
+            }
+            continue;
+        }
+        return { kind: 'error', exitCode: 2, message: 'Unknown flag.' };
+    }
+    if (!provider)
+        return { kind: 'error', exitCode: 2, message: 'Missing required --provider.' };
+    if (!framework)
+        return { kind: 'error', exitCode: 2, message: 'Missing required --framework.' };
+    if (!isProvider(provider)) {
+        return { kind: 'error', exitCode: 2, message: 'Unsupported provider.' };
+    }
+    if (!isFramework(framework)) {
+        return { kind: 'error', exitCode: 2, message: 'Unsupported framework.' };
+    }
+    if (out.length === 0)
+        return { kind: 'error', exitCode: 2, message: 'Invalid --out: empty path.' };
+    // grafana/polar and existing HMAC providers.
+    const providerOptionsResult = buildProviderCliOptions(provider, {
+        grafanaMode,
+        signatureHeader,
+        timestampHeader,
+        polarSecretMode,
+        publicKeyEnv,
+        expectedUserEnv,
+    });
+    if (providerOptionsResult.kind === 'error') {
+        return { kind: 'error', exitCode: 2, message: providerOptionsResult.message };
+    }
+    if (provider === 'fal') {
+        if (secretEnv !== undefined) {
+            return { kind: 'error', exitCode: 2, message: 'The --secret-env flag is not valid for fal.' };
+        }
+        if (providerOptionsResult.kind !== 'options' || providerOptionsResult.options.provider !== 'fal') {
+            return { kind: 'error', exitCode: 2, message: 'Invalid fal credential configuration.' };
+        }
+        return { kind: 'command', command: { provider, framework, out, bodyLimit, dryRun,
+                publicKeyEnv: providerOptionsResult.options.options.publicKeyEnv,
+                expectedUserEnv: providerOptionsResult.options.options.expectedUserEnv } };
+    }
+    const resolvedSecretEnv = secretEnv ?? DEFAULT_SECRET_ENV[provider];
+    if (!SECRET_ENV_PATTERN.test(resolvedSecretEnv)) {
+        return { kind: 'error', exitCode: 2, message: 'Invalid --secret-env: expected an identifier.' };
+    }
+    const baseCommand = {
+        provider,
+        framework,
+        out,
+        secretEnv: resolvedSecretEnv,
+        bodyLimit,
+        dryRun,
+    };
+    if (providerOptionsResult.kind === 'none') {
+        return { kind: 'command', command: baseCommand };
+    }
+    const configured = providerOptionsResult.options;
+    if (configured.provider === 'fal')
+        return { kind: 'error', exitCode: 2, message: 'Invalid HMAC credential configuration.' };
+    return { kind: 'command', command: { ...baseCommand, providerOptions: configured } };
+}
+//# sourceMappingURL=args.js.map

package/dist/cli/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../../src/cli/args.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAK5D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAU,CAAC;AA6D/E,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,WAAW,GAAG,WAAW,CAAC;AAChC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAEtD,kFAAkF;AAClF,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AAEhE,mFAAmF;AACnF,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAExD;;;;GAIG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,MAAM;IACN,gBAAgB;IAChB,mBAAmB;IACnB,YAAY;IACZ,SAAS;IACT,SAAS;IACT,IAAI;IACJ,qBAAqB;IACrB,oBAAoB;IACpB,eAAe;IACf,QAAQ;IACR,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG;IACzB,MAAM,EAAE,uBAAuB;IAC/B,MAAM,EAAE,uBAAuB;IAC/B,OAAO,EAAE,wBAAwB;IACjC,mBAAmB,EAAE,0BAA0B;IAC/C,KAAK,EAAE,8BAA8B;IACrC,IAAI,EAAE,qBAAqB;IAC3B,QAAQ,EAAE,yBAAyB;IACnC,MAAM,EAAE,uBAAuB;IAC/B,eAAe,EAAE,8BAA8B;IAC/C,eAAe,EAAE,qBAAqB;IACtC,MAAM,EAAE,uBAAuB;IAC/B,SAAS,EAAE,0BAA0B;IACrC,MAAM,EAAE,uBAAuB;IAC/B,MAAM,EAAE,uBAAuB;IAC/B,OAAO,EAAE,wBAAwB;IACjC,MAAM,EAAE,uBAAuB;IAC/B,OAAO,EAAE,wBAAwB;IACjC,KAAK,EAAE,sBAAsB;IAC7B,MAAM,EAAE,uBAAuB;IAC/B,MAAM,EAAE,uBAAuB;CAC6B,CAAC;AAE/D,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;qDAS4B,WAAW;;qEAEK,kBAAkB;;;uEAGhB,wBAAwB;;;;;;;;;;;;;;;;;CAiB9F,CAAC;AAEF,SAAS,WAAW,CAAC,KAAa;IAChC,8HAA8H;IAC9H,OAAQ,UAAgC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,sFAAsF;AACtF,kFAAkF;AAClF,qFAAqF;AAErF,SAAS,UAAU,CAAC,KAAa;IAC/B,wIAAwI;IACxI,OAAQ,mBAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAE7B,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,qFAAqF;AACrF,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAuB;IAC/C,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC;IAE7D,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,oBAAoB,CAAC;IAErE,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,oBAAoB,CAAC;IAErE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAuB;IAClD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,YAAY,CAAC,uDAAuD,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC;IAE/B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC,8CAA8C,CAAC,CAAC;IAE5F,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC9C,OAAO,YAAY,CAAC,uDAAuD,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QAC1F,OAAO,YAAY,CAAC,yFAAyF,CAAC,CAAC;IACjH,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,YAAY,CAAC,kEAAkE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC1F,CAAC;QAED,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,EAAE;SACpG,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAE9C,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,YAAY,CAAC,mEAAmE,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7C,OAAO,YAAY,CAAC,yFAAyF,CAAC,CAAC;IACjH,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAC9C,MAAM,wBAAwB,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,eAAe,CAAC;IAE5G,IAAI,wBAAwB,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7E,OAAO,YAAY,CAAC,6EAA6E,CAAC,CAAC;IACrG,CAAC;IAED,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,EAAE;SACpF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,EAAE;KACrG,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAuB;IAC9C,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAClH,OAAO,YAAY,CAAC,iGAAiG,CAAC,CAAC;IACzH,CAAC;IAED,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,YAAY,CAAC,uDAAuD,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,yBAAyB,CAAC;IACrE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,qBAAqB,CAAC;IAEvE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,OAAO,YAAY,CAAC,mDAAmD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9C,OAAO,YAAY,CAAC,sDAAsD,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS;QACf,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,EAAE,YAAY,EAAE,eAAe,EAAE;SAC3C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAuB;IAChD,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAE5C,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC,OAAO,WAAW,kCAAkC,CAAC,CAAC;IAEpG,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,CAAC;IAEnC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACjG,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,YAAY,CAAC,0DAA0D,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,KAAuB;IAC/E,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAE9D,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAE1D,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAEtD,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAE5C,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC,OAAO,WAAW,kCAAkC,CAAC,CAAC;IAEpG,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,YAAY,CAAC,uDAAuD,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC5E,OAAO,YAAY,CAAC,4EAA4E,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAE/C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,uDAAuD;QACvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAE/C,4CAA4C;QAC5C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACnH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;IACrG,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,QAA4B,CAAC;IACjC,IAAI,SAA6B,CAAC;IAClC,IAAI,GAAG,GAAG,WAAW,CAAC;IACtB,IAAI,SAA6B,CAAC;IAClC,IAAI,SAAS,GAAG,kBAAkB,CAAC;IACnC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,WAA+B,CAAC;IACpC,IAAI,eAAmC,CAAC;IACxC,IAAI,eAAmC,CAAC;IACxC,IAAI,eAAmC,CAAC;IACxC,IAAI,YAAgC,CAAC;IACrC,IAAI,eAAmC,CAAC;IAExC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAErB,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;YACjG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,cAAc;eACxH,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,qBAAqB;eACjI,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAC/D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,mBAAmB,IAAI,GAAG,EAAE,CAAC;YAC/F,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAE1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACpE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,qBAAqB,IAAI,GAAG,EAAE,CAAC;YAC/E,CAAC;YAED,CAAC,IAAI,CAAC,CAAC;YAEP,IAAI,IAAI,KAAK,YAAY;gBAAE,QAAQ,GAAG,KAAK,CAAC;iBACvC,IAAI,IAAI,KAAK,aAAa;gBAAE,SAAS,GAAG,KAAK,CAAC;iBAC9C,IAAI,IAAI,KAAK,OAAO;gBAAE,GAAG,GAAG,KAAK,CAAC;iBAClC,IAAI,IAAI,KAAK,cAAc;gBAAE,SAAS,GAAG,KAAK,CAAC;iBAC/C,IAAI,IAAI,KAAK,gBAAgB;gBAAE,WAAW,GAAG,KAAK,CAAC;iBACnD,IAAI,IAAI,KAAK,oBAAoB;gBAAE,eAAe,GAAG,KAAK,CAAC;iBAC3D,IAAI,IAAI,KAAK,oBAAoB;gBAAE,eAAe,GAAG,KAAK,CAAC;iBAC3D,IAAI,IAAI,KAAK,qBAAqB;gBAAE,eAAe,GAAG,KAAK,CAAC;iBAC5D,IAAI,IAAI,KAAK,kBAAkB;gBAAE,YAAY,GAAG,KAAK,CAAC;iBACtD,IAAI,IAAI,KAAK,qBAAqB;gBAAE,eAAe,GAAG,KAAK,CAAC;iBAC5D,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBACjC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC;gBAC5G,CAAC;gBAED,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;YAED,SAAS;QACX,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IAE9F,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;IAEhG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;IAEnG,6CAA6C;IAC7C,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,QAAQ,EAAE;QAC9D,WAAW;QACX,eAAe;QACf,eAAe;QACf,eAAe;QACf,YAAY;QACZ,eAAe;KAChB,CAAC,CAAC;IAEH,IAAI,qBAAqB,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC;IAChF,CAAC;IAED,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;QAChG,CAAC;QAED,IAAI,qBAAqB,CAAC,IAAI,KAAK,SAAS,IAAI,qBAAqB,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YACjG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;QAC1F,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM;gBAC9E,YAAY,EAAE,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY;gBAChE,eAAe,EAAE,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,iBAAiB,GAAG,SAAS,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAEpE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;IAClG,CAAC;IAED,MAAM,WAAW,GAAG;QAClB,QAAQ;QACR,SAAS;QACT,GAAG;QACH,SAAS,EAAE,iBAAiB;QAC5B,SAAS;QACT,MAAM;KACkB,CAAC;IAE3B,IAAI,qBAAqB,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC;IAEjD,IAAI,UAAU,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IAE5H,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC;AACvF,CAAC"}

package/dist/cli/filesystem.d.ts

@@ -0,0 +1,15 @@
+export declare class CliError extends Error {
+    readonly exitCode: number;
+    constructor(exitCode: number, message: string);
+}
+export declare function validateOutDir(input: string): string[];
+export declare function targetFileName(provider: string, framework: string): string;
+interface ResolvedOutput {
+    readonly relativePath: string;
+    readonly absolutePath: string;
+}
+export declare function resolveOutput(cwd: string, outDir: string, fileName: string): ResolvedOutput;
+export declare function ensureParentDirectories(cwd: string, absoluteFilePath: string): void;
+export declare function writeFileExclusive(filePath: string, content: string): void;
+export {};
+//# sourceMappingURL=filesystem.d.ts.map

package/dist/cli/filesystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.d.ts","sourceRoot":"","sources":["../../src/cli/filesystem.ts"],"names":[],"mappings":"AAGA,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK9C;AA+CD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAatD;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAS1E;AAED,UAAU,cAAc;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CAmD3F;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAoBnF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAwB1E"}

package/dist/cli/filesystem.js

@@ -0,0 +1,170 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export class CliError extends Error {
+    exitCode;
+    constructor(exitCode, message) {
+        super(message);
+        this.name = 'CliError';
+        this.exitCode = exitCode;
+    }
+}
+/** Narrow an unknown thrown value to a Node error with an errno `code`. */
+function isErrnoException(error) {
+    return typeof error === 'object' && error !== null && 'code' in error && typeof error.code === 'string';
+}
+function rejectUnsafeSegment(segment) {
+    if (segment === '' || segment === '.' || segment === '..') {
+        throw new CliError(2, 'Unsafe output path.');
+    }
+    if (segment.toLowerCase() === '.git' || segment.toLowerCase() === 'node_modules') {
+        throw new CliError(2, 'Unsafe output path.');
+    }
+    if (/[<>:"|?*]/.test(segment) || [...segment].some((character) => character.charCodeAt(0) < 32)
+        || /[. ]$/.test(segment)) {
+        throw new CliError(2, 'Unsafe output path.');
+    }
+    // Windows reserved device names.
+    if (/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(segment)) {
+        throw new CliError(2, 'Unsafe output path.');
+    }
+}
+function inspectPath(target) {
+    try {
+        return fs.lstatSync(target);
+    }
+    catch (error) {
+        if (isErrnoException(error) && error.code === 'ENOENT')
+            return undefined;
+        throw new CliError(1, 'Unable to inspect output path.');
+    }
+}
+function splitPath(input) {
+    const normalized = input.replace(/\\/g, '/');
+    const trimmed = normalized.replace(/\/+$/, '');
+    if (trimmed.length === 0)
+        throw new CliError(2, 'Unsafe output path.');
+    const segments = trimmed.split('/');
+    for (const segment of segments)
+        rejectUnsafeSegment(segment);
+    return segments;
+}
+export function validateOutDir(input) {
+    if (input.length === 0) {
+        throw new CliError(2, 'Unsafe output path.');
+    }
+    if (input.includes('\0'))
+        throw new CliError(2, 'Unsafe output path.');
+    const normalized = input.replace(/\\/g, '/');
+    if (path.isAbsolute(input) || /^[a-zA-Z]:/.test(input) || normalized.startsWith('//')) {
+        throw new CliError(2, 'Unsafe output path.');
+    }
+    return splitPath(input);
+}
+export function targetFileName(provider, framework) {
+    if (framework === 'nextjs')
+        return 'route.ts';
+    if (framework === 'cloudflare')
+        return `${provider}.cloudflare.ts`;
+    if (framework === 'hono')
+        return `${provider}.hono.ts`;
+    if (framework === 'express')
+        return `${provider}.express.ts`;
+    throw new CliError(2, 'Unsupported framework.');
+}
+export function resolveOutput(cwd, outDir, fileName) {
+    const outSegments = validateOutDir(outDir);
+    const fileSegments = [fileName];
+    // validate file name segments too (no traversal)
+    for (const segment of fileSegments) {
+        if (segment.includes('/') || segment.includes('\\') || segment.includes('\0')) {
+            throw new CliError(2, 'Unsafe output path.');
+        }
+        if (segment === '..' || segment === '.' || segment === '')
+            throw new CliError(2, 'Unsafe output path.');
+    }
+    const relativeSegments = [...outSegments, ...fileSegments];
+    const absolutePath = path.resolve(cwd, ...relativeSegments);
+    const relativePath = relativeSegments.join('/');
+    const relativeFromCwd = path.relative(cwd, absolutePath);
+    if (relativeFromCwd === '' || relativeFromCwd === '..'
+        || relativeFromCwd.startsWith(`..${path.sep}`) || path.isAbsolute(relativeFromCwd)) {
+        throw new CliError(2, 'Unsafe output path.');
+    }
+    // Check existing ancestors for symlinks/junctions/non-directories.
+    let current = cwd;
+    const ancestorSegments = relativeSegments.slice(0, -1);
+    for (const segment of ancestorSegments) {
+        current = path.join(current, segment);
+        const stat = inspectPath(current);
+        if (stat !== undefined) {
+            if (stat.isSymbolicLink())
+                throw new CliError(2, 'Unsafe output path.');
+            if (!stat.isDirectory())
+                throw new CliError(2, 'Unsafe output path.');
+        }
+    }
+    // Existing target.
+    const targetStat = inspectPath(absolutePath);
+    if (targetStat !== undefined) {
+        if (targetStat.isSymbolicLink())
+            throw new CliError(2, 'Unsafe output path.');
+        throw new CliError(3, 'Target file already exists.');
+    }
+    return { relativePath, absolutePath };
+}
+export function ensureParentDirectories(cwd, absoluteFilePath) {
+    const dir = path.dirname(absoluteFilePath);
+    const relative = path.relative(cwd, dir);
+    const segments = relative === '' ? [] : relative.split(path.sep);
+    let current = cwd;
+    for (const segment of segments) {
+        current = path.join(current, segment);
+        const stat = inspectPath(current);
+        if (stat !== undefined) {
+            if (stat.isSymbolicLink() || !stat.isDirectory()) {
+                throw new CliError(2, 'Unsafe output path.');
+            }
+        }
+        else {
+            try {
+                fs.mkdirSync(current);
+            }
+            catch {
+                throw new CliError(1, 'Unable to create output directory.');
+            }
+        }
+    }
+}
+export function writeFileExclusive(filePath, content) {
+    let fd;
+    try {
+        fd = fs.openSync(filePath, 'wx');
+        fs.writeFileSync(fd, content, 'utf8');
+        try {
+            fs.fsyncSync(fd);
+        }
+        catch { /* best effort */ }
+    }
+    catch (error) {
+        if (fd !== undefined) {
+            // Operate on our descriptor, never unlink a path another creator may replace.
+            try {
+                fs.ftruncateSync(fd, 0);
+            }
+            catch { /* A partial owned file may remain. */ }
+        }
+        if (isErrnoException(error) && error.code === 'EEXIST') {
+            throw new CliError(3, 'Target file already exists.');
+        }
+        throw new CliError(1, 'Unable to write output file.');
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch { /* ignore */ }
+        }
+    }
+}
+//# sourceMappingURL=filesystem.js.map

package/dist/cli/filesystem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.js","sourceRoot":"","sources":["../../src/cli/filesystem.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,QAAQ,CAAS;IAC1B,YAAY,QAAgB,EAAE,OAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC1G,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1D,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,cAAc,EAAE,CAAC;QACjF,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;WAC1F,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAED,iCAAiC;IACjC,IAAI,+CAA+C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,CAAC;QAAC,OAAO,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IACpC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEpC,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE7D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE7C,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,SAAiB;IAChE,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC;IAE9C,IAAI,SAAS,KAAK,YAAY;QAAE,OAAO,GAAG,QAAQ,gBAAgB,CAAC;IAEnE,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,GAAG,QAAQ,UAAU,CAAC;IAEvD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,GAAG,QAAQ,aAAa,CAAC;IAC7D,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;AAClD,CAAC;AAOD,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,MAAc,EAAE,QAAgB;IACzE,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEhC,iDAAiD;IACjD,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,EAAE;YAAE,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC1G,CAAC;IAED,MAAM,gBAAgB,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,YAAY,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEhD,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAEzD,IAAI,eAAe,KAAK,EAAE,IAAI,eAAe,KAAK,IAAI;WACjD,eAAe,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAED,mEAAmE;IACnE,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEvD,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEtC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAElC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAEvB,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;YAExE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,MAAM,UAAU,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IAE7C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAE7B,IAAI,UAAU,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAC9E,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAW,EAAE,gBAAwB;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,OAAO,GAAG,GAAG,CAAC;IAElB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEtC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAElC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAEvB,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACjD,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAAC;YAAC,CAAC;QACvG,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,OAAe;IAClE,IAAI,EAAsB,CAAC;IAE3B,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEtC,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,8EAA8E;YAC9E,IAAI,CAAC;gBAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC;IACxD,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":""}

package/dist/cli/index.js

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+import { parseArgs, HELP_TEXT } from './args.js';
+import { renderTemplate } from './templates.js';
+import { resolveOutput, targetFileName, ensureParentDirectories, writeFileExclusive, CliError } from './filesystem.js';
+function main() {
+    const result = parseArgs(process.argv.slice(2));
+    if (result.kind === 'help') {
+        process.stdout.write(HELP_TEXT);
+        return;
+    }
+    if (result.kind === 'error') {
+        process.stderr.write(`${result.message}\n`);
+        process.exitCode = result.exitCode;
+        return;
+    }
+    const command = result.command;
+    const fileName = targetFileName(command.provider, command.framework);
+    let resolved;
+    try {
+        resolved = resolveOutput(process.cwd(), command.out, fileName);
+    }
+    catch (error) {
+        const message = error instanceof CliError ? error.message : 'Unable to inspect output path.';
+        const exitCode = error instanceof CliError ? error.exitCode : 2;
+        process.stderr.write(`${message}\n`);
+        process.exitCode = exitCode;
+        return;
+    }
+    let templateOptions;
+    if (command.provider === 'fal') {
+        templateOptions = { publicKeyEnv: command.publicKeyEnv, expectedUserEnv: command.expectedUserEnv,
+            bodyLimit: command.bodyLimit };
+    }
+    else {
+        templateOptions = command.providerOptions === undefined
+            ? { secretEnv: command.secretEnv, bodyLimit: command.bodyLimit }
+            : { secretEnv: command.secretEnv, bodyLimit: command.bodyLimit, providerOptions: command.providerOptions };
+    }
+    const content = renderTemplate(command.provider, command.framework, templateOptions);
+    if (command.dryRun) {
+        process.stdout.write(`${resolved.relativePath}\n${content}`);
+        return;
+    }
+    try {
+        ensureParentDirectories(process.cwd(), resolved.absolutePath);
+        writeFileExclusive(resolved.absolutePath, content);
+    }
+    catch (error) {
+        const message = error instanceof CliError ? error.message : 'Unable to write output file.';
+        const exitCode = error instanceof CliError ? error.exitCode : 1;
+        process.stderr.write(`${message}\n`);
+        process.exitCode = exitCode;
+        return;
+    }
+    process.stdout.write(`Created ${resolved.relativePath}\n`);
+}
+try {
+    main();
+}
+catch {
+    process.stderr.write('Unexpected error.\n');
+    process.exitCode = 1;
+}
+//# sourceMappingURL=index.js.map