zudojs-cli 1.0.0 → 1.1.1

package/dist/src/templates/shared/pnpm.template.d.ts

@@ -0,0 +1,27 @@
+/**
+ * zudojs-cli — pnpm settings for generated projects
+ *
+ * pnpm 10 stopped running the install scripts of dependencies unless the
+ * project lists them, and pnpm 11 turned the resulting notice into a failing
+ * `ERR_PNPM_IGNORED_BUILDS`. Every generated project depends on `tsx`
+ * (backend) or Vite (frontend), both of which pull in esbuild and its
+ * postinstall, so a fresh `pnpm install` exited with code 1 and
+ * `pnpm run dev` — which re-verifies the install first — never started.
+ *
+ * pnpm 10 reads `onlyBuiltDependencies`; pnpm 11 reads `allowBuilds`. Both
+ * are written so either version installs cleanly, and both live in
+ * `pnpm-workspace.yaml`, the file pnpm itself creates for this purpose.
+ *
+ * @module templates/shared/pnpm
+ */
+/** Dependencies whose install scripts a generated project allows. */
+export declare const PNPM_ALLOWED_BUILD_SCRIPTS: readonly ["esbuild", "@swc/core", "sharp", "@parcel/watcher", "@tailwindcss/oxide", "unrs-resolver"];
+/**
+ * Renders `pnpm-workspace.yaml`.
+ *
+ * `packages` is omitted for a single-package project: pnpm then treats the
+ * directory as the sole workspace member, which is what it already does
+ * when it writes the file itself.
+ */
+export declare function renderPnpmWorkspaceFile(packages?: readonly string[]): string;
+//# sourceMappingURL=pnpm.template.d.ts.map

package/dist/src/templates/shared/pnpm.template.js

@@ -0,0 +1,57 @@
+/**
+ * zudojs-cli — pnpm settings for generated projects
+ *
+ * pnpm 10 stopped running the install scripts of dependencies unless the
+ * project lists them, and pnpm 11 turned the resulting notice into a failing
+ * `ERR_PNPM_IGNORED_BUILDS`. Every generated project depends on `tsx`
+ * (backend) or Vite (frontend), both of which pull in esbuild and its
+ * postinstall, so a fresh `pnpm install` exited with code 1 and
+ * `pnpm run dev` — which re-verifies the install first — never started.
+ *
+ * pnpm 10 reads `onlyBuiltDependencies`; pnpm 11 reads `allowBuilds`. Both
+ * are written so either version installs cleanly, and both live in
+ * `pnpm-workspace.yaml`, the file pnpm itself creates for this purpose.
+ *
+ * @module templates/shared/pnpm
+ */
+/** Dependencies whose install scripts a generated project allows. */
+export const PNPM_ALLOWED_BUILD_SCRIPTS = [
+    "esbuild",
+    "@swc/core",
+    "sharp",
+    "@parcel/watcher",
+    "@tailwindcss/oxide",
+    "unrs-resolver",
+];
+/**
+ * Renders `pnpm-workspace.yaml`.
+ *
+ * `packages` is omitted for a single-package project: pnpm then treats the
+ * directory as the sole workspace member, which is what it already does
+ * when it writes the file itself.
+ */
+export function renderPnpmWorkspaceFile(packages = []) {
+    const lines = [];
+    if (packages.length > 0) {
+        lines.push("packages:");
+        for (const glob of packages) {
+            lines.push(`  - ${JSON.stringify(glob)}`);
+        }
+        lines.push("");
+    }
+    lines.push("# Dependencies allowed to run install scripts (pnpm 10).");
+    lines.push("onlyBuiltDependencies:");
+    for (const name of PNPM_ALLOWED_BUILD_SCRIPTS) {
+        // Quoted: a bare leading "@" is a reserved YAML indicator.
+        lines.push(`  - ${JSON.stringify(name)}`);
+    }
+    lines.push("");
+    lines.push("# The same list in the form pnpm 11 reads.");
+    lines.push("allowBuilds:");
+    for (const name of PNPM_ALLOWED_BUILD_SCRIPTS) {
+        lines.push(`  ${JSON.stringify(name)}: true`);
+    }
+    lines.push("");
+    return lines.join("\n");
+}
+//# sourceMappingURL=pnpm.template.js.map

package/dist/src/utils/utils.detect.d.ts

@@ -1,2 +1,11 @@
+/**
+ * Returns the recorded architecture of the project at `cwd`, or `null` when
+ * the directory is not a Zudojs project.
+ *
+ * Used to read a `zudojs.config.json` that no template has ever written, so
+ * it returned `null` for every project. It now reads the same sources as
+ * every other command: the manifest, the legacy `zudojs.config.ts`, then
+ * the `zudojs` block in `package.json`.
+ */
 export declare function detectArchitecture(cwd: string): Promise<string | null>;
 //# sourceMappingURL=utils.detect.d.ts.map

package/dist/src/utils/utils.detect.js

@@ -1,14 +1,14 @@
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
+import { resolveProjectLayout } from "../resolvers/layout/projectLayout.core.js";
+/**
+ * Returns the recorded architecture of the project at `cwd`, or `null` when
+ * the directory is not a Zudojs project.
+ *
+ * Used to read a `zudojs.config.json` that no template has ever written, so
+ * it returned `null` for every project. It now reads the same sources as
+ * every other command: the manifest, the legacy `zudojs.config.ts`, then
+ * the `zudojs` block in `package.json`.
+ */
 export async function detectArchitecture(cwd) {
-    try {
-        const configPath = join(cwd, "zudojs.config.json");
-        const content = await readFile(configPath, "utf-8");
-        const config = JSON.parse(content);
-        return config.architecture ?? null;
-    }
-    catch {
-        return null;
-    }
+    return resolveProjectLayout(cwd)?.architecture ?? null;
 }
 //# sourceMappingURL=utils.detect.js.map

package/dist/src/utils/utils.exec.d.ts

@@ -5,7 +5,21 @@ export interface ExecResult {
 export interface ExecOptions {
     readonly env?: NodeJS.ProcessEnv;
     readonly timeout?: number;
+    /** Aborting the signal terminates the child process. */
+    readonly signal?: AbortSignal;
 }
+/**
+ * Quotes one argument for cmd.exe. Arguments are validated before they reach
+ * here (project and service names are `[A-Za-z0-9_-]`), so this is defence
+ * in depth rather than the only barrier.
+ */
+export declare function quoteForWindowsShell(argument: string): string;
+/** The spawn arguments and shell flag a command needs on this platform. */
+export declare function resolveSpawnTarget(file: string, args: readonly string[], platform?: NodeJS.Platform): {
+    readonly file: string;
+    readonly args: string[];
+    readonly shell: boolean;
+};
 /**
  * Runs a short-lived command and buffers its output.
  *
@@ -18,7 +32,9 @@ export declare function execCommand(file: string, args: readonly string[], cwd:
  * Runs a command with inherited stdio and no timeout.
  *
  * Use for long-running processes (dev servers) and for dependency installs
- * so output streams to the user and slow commands are not killed.
+ * so output streams to the user and slow commands are not killed. Pass a
+ * `signal` to stop the process from the outside; an aborted run resolves
+ * rather than rejects, since stopping it was the caller's intent.
  */
 export declare function runStreaming(file: string, args: readonly string[], cwd: string, options?: ExecOptions): Promise<void>;
 //# sourceMappingURL=utils.exec.d.ts.map

package/dist/src/utils/utils.exec.js

@@ -1,6 +1,51 @@
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
+/**
+ * Commands that are `.cmd` shims rather than executables on Windows.
+ *
+ * Node refuses to spawn a `.cmd`/`.bat` file without a shell (EINVAL since
+ * the fix for CVE-2024-27980), and spawning the bare name fails with ENOENT
+ * because only `pnpm.cmd` exists. Every `zudojs create` on Windows therefore
+ * failed at the install step, and `zudojs dev` never started anything.
+ */
+const WINDOWS_SHIM_COMMANDS = new Set([
+    "npm",
+    "npx",
+    "pnpm",
+    "pnpx",
+    "yarn",
+    "bun",
+    "bunx",
+    "ng",
+    "flutter",
+    "tsx",
+]);
+/** Characters that need quoting when a command line goes through cmd.exe. */
+const CMD_UNSAFE = /[\s"&|<>^()%!]/;
+/**
+ * Quotes one argument for cmd.exe. Arguments are validated before they reach
+ * here (project and service names are `[A-Za-z0-9_-]`), so this is defence
+ * in depth rather than the only barrier.
+ */
+export function quoteForWindowsShell(argument) {
+    if (argument.length === 0)
+        return '""';
+    if (!CMD_UNSAFE.test(argument))
+        return argument;
+    return `"${argument.replace(/"/g, '\\"')}"`;
+}
+/** The spawn arguments and shell flag a command needs on this platform. */
+export function resolveSpawnTarget(file, args, platform = process.platform) {
+    if (platform === "win32" && WINDOWS_SHIM_COMMANDS.has(file)) {
+        return {
+            file,
+            args: args.map(quoteForWindowsShell),
+            shell: true,
+        };
+    }
+    return { file, args: Array.from(args), shell: false };
+}
 /**
  * Runs a short-lived command and buffers its output.
  *
@@ -9,10 +54,13 @@ const execFileAsync = promisify(execFile);
  * use {@link runStreaming} instead.
  */
 export async function execCommand(file, args, cwd, options = {}) {
-    const { stdout, stderr } = await execFileAsync(file, args, {
+    const target = resolveSpawnTarget(file, args);
+    const { stdout, stderr } = await execFileAsync(target.file, target.args, {
         cwd,
         timeout: options.timeout ?? 120000,
+        shell: target.shell,
         ...(options.env ? { env: options.env } : {}),
+        ...(options.signal ? { signal: options.signal } : {}),
     });
     return { stdout, stderr };
 }
@@ -20,20 +68,33 @@ export async function execCommand(file, args, cwd, options = {}) {
  * Runs a command with inherited stdio and no timeout.
  *
  * Use for long-running processes (dev servers) and for dependency installs
- * so output streams to the user and slow commands are not killed.
+ * so output streams to the user and slow commands are not killed. Pass a
+ * `signal` to stop the process from the outside; an aborted run resolves
+ * rather than rejects, since stopping it was the caller's intent.
  */
 export function runStreaming(file, args, cwd, options = {}) {
+    const target = resolveSpawnTarget(file, args);
     return new Promise((resolve, reject) => {
-        const child = spawn(file, Array.from(args), {
+        const child = spawn(target.file, target.args, {
             cwd,
             stdio: "inherit",
+            shell: target.shell,
             ...(options.env ? { env: options.env } : {}),
+            ...(options.signal ? { signal: options.signal } : {}),
         });
         child.on("error", (error) => {
+            if (error.name === "AbortError") {
+                resolve();
+                return;
+            }
+            if (error.code === "ENOENT") {
+                reject(new Error(`Command "${file}" was not found. Install it and make sure it is on your PATH.`));
+                return;
+            }
             reject(error);
         });
         child.on("exit", (code, signal) => {
-            if (code === 0) {
+            if (code === 0 || options.signal?.aborted) {
                 resolve();
             }
             else {

package/package.json

@@ -1,8 +1,12 @@
 {
   "name": "zudojs-cli",
-  "version": "1.0.0",
+  "version": "1.1.1",
   "description": "Command-line interface for scaffolding, generating, and managing Zudojs framework projects.",
   "license": "MIT",
+  "author": {
+    "name": "Oluwayemi Oyinlola",
+    "url": "https://github.com/oyinlola-tech"
+  },
   "type": "module",
   "main": "./dist/src/index.js",
   "module": "./dist/src/index.js",
@@ -20,15 +24,14 @@
     "dist",
     "!dist/**/*.map",
     "!dist/**/*.tsbuildinfo",
-    "!dist/.tsbuildinfo",
-    "src/scripts/postinstall.cjs"
+    "!dist/.tsbuildinfo"
   ],
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@zudojs/config": "1.0.0",
-    "@zudojs/core": "1.0.0",
-    "@zudojs/errors": "1.0.0",
-    "@zudojs/logger": "1.0.0"
+    "@zudojs/config": "1.0.1",
+    "@zudojs/core": "1.1.0",
+    "@zudojs/errors": "1.0.1",
+    "@zudojs/logger": "1.1.0"
   },
   "devDependencies": {
     "@types/node": "^26.4.1",
@@ -59,12 +62,11 @@
     "directory": "packages/cli"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json && mkdir -p dist/src/scripts && cp src/scripts/postinstall.cjs dist/src/scripts/postinstall.cjs",
+    "build": "tsc -p tsconfig.json",
     "dev": "tsx src/bin/zudojs.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
     "clean": "rm -rf dist",
     "test": "vitest run",
-    "test:watch": "vitest",
-    "postinstall": "node src/scripts/postinstall.cjs"
+    "test:watch": "vitest"
   }
 }

package/dist/src/scripts/postinstall.cjs

@@ -1,77 +0,0 @@
-/**
- * @zudojs/cli — Postinstall Version Check
- *
- * Runs after `npm install -g` to warn users if a newer version is available.
- */
-
-const fs = require("node:fs");
-const path = require("node:path");
-
-const packageJsonPath = path.join(__dirname, "..", "..", "package.json");
-
-function getInstalledVersion() {
-  try {
-    const content = fs.readFileSync(packageJsonPath, "utf-8");
-    const pkg = JSON.parse(content);
-    return pkg.version || "unknown";
-  } catch {
-    return "unknown";
-  }
-}
-
-async function checkLatestVersion(packageName) {
-  try {
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 5000);
-
-    const response = await fetch(
-      `https://registry.npmjs.org/${packageName}/latest`,
-      { signal: controller.signal },
-    );
-    clearTimeout(timeout);
-
-    if (!response.ok) {
-      return null;
-    }
-
-    const data = await response.json();
-    return data.version || null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Whether the update check should be skipped.
- *
- * The check reaches out to registry.npmjs.org on every install. That is
- * unwanted in CI, in Docker builds and on air-gapped machines, and there was
- * previously no way to turn it off.
- */
-function shouldSkip() {
-  if (process.env.ZUDOJS_NO_UPDATE_CHECK) return true;
-  if (process.env.CI) return true;
-  if (process.env.NODE_ENV === "test") return true;
-  if (process.env.npm_config_offline === "true") return true;
-  // Only a global install is the one the user upgrades with `npm i -g`.
-  if (process.env.npm_config_global !== "true") return true;
-  return false;
-}
-
-async function main() {
-  if (shouldSkip()) {
-    return;
-  }
-
-  const installed = getInstalledVersion();
-  const latest = await checkLatestVersion("zudojs-cli");
-
-  if (latest && latest !== installed) {
-    console.log(
-      `\n  zudojs ${installed} is installed, but version ${latest} is available.`,
-    );
-    console.log(`   Run: npm install -g zudojs-cli@latest\n`);
-  }
-}
-
-main().catch(() => {});

package/src/scripts/postinstall.cjs

@@ -1,77 +0,0 @@
-/**
- * @zudojs/cli — Postinstall Version Check
- *
- * Runs after `npm install -g` to warn users if a newer version is available.
- */
-
-const fs = require("node:fs");
-const path = require("node:path");
-
-const packageJsonPath = path.join(__dirname, "..", "..", "package.json");
-
-function getInstalledVersion() {
-  try {
-    const content = fs.readFileSync(packageJsonPath, "utf-8");
-    const pkg = JSON.parse(content);
-    return pkg.version || "unknown";
-  } catch {
-    return "unknown";
-  }
-}
-
-async function checkLatestVersion(packageName) {
-  try {
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 5000);
-
-    const response = await fetch(
-      `https://registry.npmjs.org/${packageName}/latest`,
-      { signal: controller.signal },
-    );
-    clearTimeout(timeout);
-
-    if (!response.ok) {
-      return null;
-    }
-
-    const data = await response.json();
-    return data.version || null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Whether the update check should be skipped.
- *
- * The check reaches out to registry.npmjs.org on every install. That is
- * unwanted in CI, in Docker builds and on air-gapped machines, and there was
- * previously no way to turn it off.
- */
-function shouldSkip() {
-  if (process.env.ZUDOJS_NO_UPDATE_CHECK) return true;
-  if (process.env.CI) return true;
-  if (process.env.NODE_ENV === "test") return true;
-  if (process.env.npm_config_offline === "true") return true;
-  // Only a global install is the one the user upgrades with `npm i -g`.
-  if (process.env.npm_config_global !== "true") return true;
-  return false;
-}
-
-async function main() {
-  if (shouldSkip()) {
-    return;
-  }
-
-  const installed = getInstalledVersion();
-  const latest = await checkLatestVersion("zudojs-cli");
-
-  if (latest && latest !== installed) {
-    console.log(
-      `\n  zudojs ${installed} is installed, but version ${latest} is available.`,
-    );
-    console.log(`   Run: npm install -g zudojs-cli@latest\n`);
-  }
-}
-
-main().catch(() => {});