zudojs-cli 0.1.2 → 1.1.0

package/dist/src/utils/utils.exec.js

@@ -1,11 +1,106 @@
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
-export async function execCommand(file, args, cwd) {
-    const { stdout, stderr } = await execFileAsync(file, args, {
+/**
+ * Commands that are `.cmd` shims rather than executables on Windows.
+ *
+ * Node refuses to spawn a `.cmd`/`.bat` file without a shell (EINVAL since
+ * the fix for CVE-2024-27980), and spawning the bare name fails with ENOENT
+ * because only `pnpm.cmd` exists. Every `zudojs create` on Windows therefore
+ * failed at the install step, and `zudojs dev` never started anything.
+ */
+const WINDOWS_SHIM_COMMANDS = new Set([
+    "npm",
+    "npx",
+    "pnpm",
+    "pnpx",
+    "yarn",
+    "bun",
+    "bunx",
+    "ng",
+    "flutter",
+    "tsx",
+]);
+/** Characters that need quoting when a command line goes through cmd.exe. */
+const CMD_UNSAFE = /[\s"&|<>^()%!]/;
+/**
+ * Quotes one argument for cmd.exe. Arguments are validated before they reach
+ * here (project and service names are `[A-Za-z0-9_-]`), so this is defence
+ * in depth rather than the only barrier.
+ */
+export function quoteForWindowsShell(argument) {
+    if (argument.length === 0)
+        return '""';
+    if (!CMD_UNSAFE.test(argument))
+        return argument;
+    return `"${argument.replace(/"/g, '\\"')}"`;
+}
+/** The spawn arguments and shell flag a command needs on this platform. */
+export function resolveSpawnTarget(file, args, platform = process.platform) {
+    if (platform === "win32" && WINDOWS_SHIM_COMMANDS.has(file)) {
+        return {
+            file,
+            args: args.map(quoteForWindowsShell),
+            shell: true,
+        };
+    }
+    return { file, args: Array.from(args), shell: false };
+}
+/**
+ * Runs a short-lived command and buffers its output.
+ *
+ * Suitable for quick probes (version checks, git commands). Do NOT use this
+ * for long-running processes such as dev servers or dependency installs —
+ * use {@link runStreaming} instead.
+ */
+export async function execCommand(file, args, cwd, options = {}) {
+    const target = resolveSpawnTarget(file, args);
+    const { stdout, stderr } = await execFileAsync(target.file, target.args, {
         cwd,
-        timeout: 120000,
+        timeout: options.timeout ?? 120000,
+        shell: target.shell,
+        ...(options.env ? { env: options.env } : {}),
+        ...(options.signal ? { signal: options.signal } : {}),
     });
     return { stdout, stderr };
 }
+/**
+ * Runs a command with inherited stdio and no timeout.
+ *
+ * Use for long-running processes (dev servers) and for dependency installs
+ * so output streams to the user and slow commands are not killed. Pass a
+ * `signal` to stop the process from the outside; an aborted run resolves
+ * rather than rejects, since stopping it was the caller's intent.
+ */
+export function runStreaming(file, args, cwd, options = {}) {
+    const target = resolveSpawnTarget(file, args);
+    return new Promise((resolve, reject) => {
+        const child = spawn(target.file, target.args, {
+            cwd,
+            stdio: "inherit",
+            shell: target.shell,
+            ...(options.env ? { env: options.env } : {}),
+            ...(options.signal ? { signal: options.signal } : {}),
+        });
+        child.on("error", (error) => {
+            if (error.name === "AbortError") {
+                resolve();
+                return;
+            }
+            if (error.code === "ENOENT") {
+                reject(new Error(`Command "${file}" was not found. Install it and make sure it is on your PATH.`));
+                return;
+            }
+            reject(error);
+        });
+        child.on("exit", (code, signal) => {
+            if (code === 0 || options.signal?.aborted) {
+                resolve();
+            }
+            else {
+                reject(new Error(`Command "${file} ${args.join(" ")}" exited with ${signal ? `signal ${signal}` : `code ${code}`}`));
+            }
+        });
+    });
+}
 //# sourceMappingURL=utils.exec.js.map

package/dist/src/utils/utils.fileSystem.d.ts

@@ -1,3 +1,9 @@
 export declare function writeFile(basePath: string, filePath: string, content: string): Promise<void>;
 export declare function writeFileTree(basePath: string, files: Readonly<Record<string, string>>): Promise<void>;
+/**
+ * Returns the content of a barrel index file with `exportLine` appended,
+ * preserving any existing exports. If the line is already present, the
+ * existing content is returned unchanged.
+ */
+export declare function mergeBarrelExport(basePath: string, indexPath: string, exportLine: string): string;
 //# sourceMappingURL=utils.fileSystem.d.ts.map

package/dist/src/utils/utils.fileSystem.js

@@ -1,3 +1,4 @@
+import { existsSync, readFileSync } from "node:fs";
 import { mkdir, writeFile as writeFileAsync } from "node:fs/promises";
 import { dirname, join, relative } from "node:path";
 function assertSafePath(basePath, filePath) {
@@ -18,4 +19,22 @@ export async function writeFileTree(basePath, files) {
         await writeFile(basePath, filePath, content);
     }
 }
+/**
+ * Returns the content of a barrel index file with `exportLine` appended,
+ * preserving any existing exports. If the line is already present, the
+ * existing content is returned unchanged.
+ */
+export function mergeBarrelExport(basePath, indexPath, exportLine) {
+    const fullPath = join(basePath, indexPath);
+    const line = exportLine.trim();
+    let existing = "";
+    if (existsSync(fullPath)) {
+        existing = readFileSync(fullPath, "utf-8");
+    }
+    if (existing.includes(line)) {
+        return existing;
+    }
+    const separator = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    return existing + separator + line + "\n";
+}
 //# sourceMappingURL=utils.fileSystem.js.map

package/dist/src/utils/utils.name.d.ts

@@ -1,2 +1,28 @@
 export declare function normalizeName(name: string): string;
+/** Converts an arbitrary name to PascalCase (safe as a TS identifier). */
+export declare function toPascalCase(name: string): string;
+/** Converts an arbitrary name to camelCase (safe as a TS identifier). */
+export declare function toCamelCase(name: string): string;
+/**
+ * Pattern for names that may be used verbatim as a path segment
+ * (`--service`, `--module`, manifest service entries).
+ */
+export declare const SAFE_PATH_SEGMENT: RegExp;
+/**
+ * Validates a name that a generator will normalize into file paths and
+ * identifiers.
+ *
+ * `normalizeName` strips everything outside `[a-z0-9-]`, so a name such as
+ * `"..."` or `"!!!"` collapses to the empty string and the generator writes
+ * `src//.event.ts` with an anonymous exported class. Reject it up front.
+ */
+export declare function assertGeneratableName(name: string, kind?: string): string;
+/**
+ * Validates a value that is interpolated verbatim into a generated file path.
+ *
+ * Unlike {@link assertGeneratableName} this does not normalize: the value is
+ * used as-is, so `..` or a path separator here would let a generator write
+ * outside its base path.
+ */
+export declare function assertSafePathSegment(value: string, kind?: string): string;
 //# sourceMappingURL=utils.name.d.ts.map

package/dist/src/utils/utils.name.js

@@ -1,8 +1,58 @@
+import { CLIValidationError } from "../errors/index.js";
 export function normalizeName(name) {
     return name
         .trim()
         .toLowerCase()
         .replace(/[^a-z0-9-]+/g, "-")
-        .replace(/^-+|-+$/g, "");
+        // Trim leading/trailing dashes without the quadratic `-+$` scan: the
+        // lookbehind pins each attempt to the start of a dash run.
+        .replace(/^-+/, "")
+        .replace(/(?<!-)-+$/, "");
+}
+/** Converts an arbitrary name to PascalCase (safe as a TS identifier). */
+export function toPascalCase(name) {
+    return normalizeName(name)
+        .split("-")
+        .filter(Boolean)
+        .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+        .join("");
+}
+/** Converts an arbitrary name to camelCase (safe as a TS identifier). */
+export function toCamelCase(name) {
+    const pascal = toPascalCase(name);
+    return pascal.charAt(0).toLowerCase() + pascal.slice(1);
+}
+/**
+ * Pattern for names that may be used verbatim as a path segment
+ * (`--service`, `--module`, manifest service entries).
+ */
+export const SAFE_PATH_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+/**
+ * Validates a name that a generator will normalize into file paths and
+ * identifiers.
+ *
+ * `normalizeName` strips everything outside `[a-z0-9-]`, so a name such as
+ * `"..."` or `"!!!"` collapses to the empty string and the generator writes
+ * `src//.event.ts` with an anonymous exported class. Reject it up front.
+ */
+export function assertGeneratableName(name, kind = "name") {
+    const normalized = normalizeName(name);
+    if (normalized === "") {
+        throw new CLIValidationError(`Invalid ${kind}: "${name}". It must contain at least one letter or digit.`);
+    }
+    return normalized;
+}
+/**
+ * Validates a value that is interpolated verbatim into a generated file path.
+ *
+ * Unlike {@link assertGeneratableName} this does not normalize: the value is
+ * used as-is, so `..` or a path separator here would let a generator write
+ * outside its base path.
+ */
+export function assertSafePathSegment(value, kind = "value") {
+    if (!SAFE_PATH_SEGMENT.test(value)) {
+        throw new CLIValidationError(`Invalid ${kind}: "${value}". Only alphanumeric characters, hyphens, and underscores are allowed.`);
+    }
+    return value;
 }
 //# sourceMappingURL=utils.name.js.map

package/package.json

@@ -1,16 +1,20 @@
 {
   "name": "zudojs-cli",
-  "version": "0.1.2",
+  "version": "1.1.0",
   "description": "Command-line interface for scaffolding, generating, and managing Zudojs framework projects.",
   "license": "MIT",
+  "author": {
+    "name": "Oluwayemi Oyinlola",
+    "url": "https://github.com/oyinlola-tech"
+  },
   "type": "module",
-  "main": "./dist/index.js",
-  "module": "./dist/index.js",
-  "types": "./dist/index.d.ts",
+  "main": "./dist/src/index.js",
+  "module": "./dist/src/index.js",
+  "types": "./dist/src/index.d.ts",
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "types": "./dist/src/index.d.ts",
+      "import": "./dist/src/index.js"
     }
   },
   "bin": {
@@ -18,28 +22,21 @@
   },
   "files": [
     "dist",
-    "src/scripts/postinstall.cjs"
+    "!dist/**/*.map",
+    "!dist/**/*.tsbuildinfo",
+    "!dist/.tsbuildinfo"
   ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json && mkdir -p dist/src/scripts && cp src/scripts/postinstall.cjs dist/src/scripts/postinstall.cjs",
-    "dev": "tsx src/bin/zudojs.ts",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "clean": "rm -rf dist",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "postinstall": "node src/scripts/postinstall.cjs"
-  },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@zudojs/config": "0.1.0",
-    "@zudojs/core": "0.1.0",
-    "@zudojs/errors": "0.1.0",
-    "@zudojs/logger": "0.1.0"
+    "@zudojs/config": "1.0.0",
+    "@zudojs/core": "1.0.0",
+    "@zudojs/errors": "1.0.0",
+    "@zudojs/logger": "1.0.0"
   },
   "devDependencies": {
     "@types/node": "^26.4.1",
     "tsx": "^4.23.12",
-    "typescript": "^7.0.2",
+    "typescript": "7.0.2",
     "vitest": "^4.1.11"
   },
   "engines": {
@@ -56,8 +53,20 @@
     "dev"
   ],
   "homepage": "https://github.com/oyinlola-tech/zudo#readme",
+  "bugs": {
+    "url": "https://github.com/oyinlola-tech/zudo/issues"
+  },
   "repository": {
     "type": "git",
-    "url": "https://github.com/oyinlola-tech/zudo"
+    "url": "https://github.com/oyinlola-tech/zudo",
+    "directory": "packages/cli"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsx src/bin/zudojs.ts",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "clean": "rm -rf dist",
+    "test": "vitest run",
+    "test:watch": "vitest"
   }
-}
+}