@decantr/cli 1.10.0 → 1.11.0

package/README.md

@@ -99,11 +99,12 @@ decantr health --ci --fail-on warn
 decantr health --prompt <finding-id>
 decantr health init-ci
 decantr health init-ci --fail-on warn --cli-version latest --force
+decantr health init-ci --project apps/registry
 ```
 
 Use `--json` for machines and schema validation, `--markdown` for CI summaries, and `--prompt <finding-id>` when you want a scoped remediation prompt for an AI assistant. `--ci --fail-on error` fails only when blocking errors exist; `--ci --fail-on warn` also fails on warnings.
 
-`decantr health init-ci` installs `.github/workflows/decantr-health.yml` for GitHub Actions. The generated workflow installs project dependencies, writes `decantr-health.json`, gates with `decantr health --ci --fail-on error --markdown --output decantr-health.md`, appends the markdown report to the GitHub step summary, and uploads both files as artifacts. Use `--force` to replace an existing workflow, `--fail-on warn` for stricter repositories, or `--cli-version <version|latest>` to pin the package used by CI.
+`decantr health init-ci` installs `.github/workflows/decantr-health.yml` for GitHub Actions. The generated workflow installs project dependencies, writes `decantr-health.json`, gates with `decantr health --ci --fail-on error --markdown --output decantr-health.md`, appends the markdown report to the GitHub step summary, and uploads both files as artifacts. Use `--force` to replace an existing workflow, `--fail-on warn` for stricter repositories, or `--cli-version <version|latest>` to pin the package used by CI. In monorepos, add `--project <path>` from the repository root; dependency install stays at the root while health runs inside the app contract and uploads artifacts from that project path.
 
 `decantr studio` starts a local-only dashboard powered by the same report. It uses Node built-ins only and serves `GET /`, `GET /api/health`, and `POST /api/refresh`.
 

package/dist/bin.js

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
-import "./chunk-FLZVSNB5.js";
+import "./chunk-5RODH77L.js";
 import "./chunk-USOO77A5.js";
 import "./chunk-DI2PLOJ6.js";

package/dist/{chunk-FLZVSNB5.js → chunk-5RODH77L.js}

@@ -6927,7 +6927,7 @@ ${BOLD6}Usage:${RESET13}
   decantr registry get-pack <manifest|scaffold|review|section|page|mutation> [id] [--namespace <namespace>] [--json] [--essence <path>] [--write-context]
   decantr registry critique-file <file> [--namespace <namespace>] [--json] [--essence <path>] [--treatments <path>]
   decantr registry audit-project [--namespace <namespace>] [--json] [--essence <path>] [--dist <path>] [--sources <dir>]
-  decantr health init-ci [--force] [--fail-on <error|warn|none>] [--cli-version <version|latest>]
+  decantr health init-ci [--force] [--project <path>] [--fail-on <error|warn|none>] [--cli-version <version|latest>]
   decantr content-health [--json] [--markdown] [--ci]
   decantr rules preview [--project=<path>]
   decantr rules apply [--project=<path>]
@@ -7007,6 +7007,7 @@ ${BOLD6}Examples:${RESET13}
   decantr status
   decantr health
   decantr health init-ci
+  decantr health init-ci --project apps/web
   decantr health --ci --fail-on error
   decantr content-health --ci --fail-on error
   decantr studio
@@ -7190,7 +7191,7 @@ async function main() {
     }
     case "health": {
       try {
-        const { cmdHealth, parseHealthArgs } = await import("./health-SIKAOE2Z.js");
+        const { cmdHealth, parseHealthArgs } = await import("./health-3TJYYTX6.js");
         await cmdHealth(process.cwd(), parseHealthArgs(args));
       } catch (e) {
         console.error(error3(e.message));
@@ -7210,7 +7211,7 @@ async function main() {
     }
     case "studio": {
       try {
-        const { cmdStudio, parseStudioArgs } = await import("./studio-EQSSNA6D.js");
+        const { cmdStudio, parseStudioArgs } = await import("./studio-7TE7YXFG.js");
         await cmdStudio(process.cwd(), parseStudioArgs(args));
       } catch (e) {
         console.error(error3(e.message));

package/dist/{chunk-K5KCZSEI.js → chunk-6YCFRZZI.js}

@@ -92,17 +92,45 @@ function validateArtifactPath(value, flag) {
   }
   return normalized;
 }
+function validateProjectPath(value) {
+  if (value === void 0) return void 0;
+  const raw = value.trim();
+  if (!raw || raw === ".") return void 0;
+  const normalized = raw.replace(/^\.\/+/, "").replace(/\/+$/, "");
+  if (!normalized || normalized.startsWith("/") || normalized.startsWith("-") || normalized.includes("..") || normalized.includes("\\") || /\s/.test(normalized) || !/^[A-Za-z0-9._@/-]+$/.test(normalized)) {
+    throw new Error(
+      "Invalid --project value. Use a relative project path without spaces or parent-directory segments."
+    );
+  }
+  const segments = normalized.split("/");
+  if (segments.some((segment) => !segment || segment === "." || segment === "..")) {
+    throw new Error(
+      "Invalid --project value. Use a relative project path without empty or parent-directory segments."
+    );
+  }
+  return normalized;
+}
+function prefixArtifactPath(projectPath, artifactPath) {
+  return projectPath ? `${projectPath}/${artifactPath}` : artifactPath;
+}
 function renderProjectHealthCiWorkflow(options = {}) {
   const failOn = normalizeHealthFailOn(options.failOn);
+  const projectPath = validateProjectPath(options.projectPath);
+  const reportPath = validateArtifactPath(
+    options.reportPath || DEFAULT_HEALTH_CI_REPORT_PATH,
+    "--report-path"
+  );
+  const jsonPath = validateArtifactPath(options.jsonPath || DEFAULT_HEALTH_CI_JSON_PATH, "--json-path");
   const template = loadHealthTemplate("decantr-health.workflow.yml.template");
   return renderTemplate(template, {
     CLI_PACKAGE: normalizeCliPackageSpecifier(options.cliVersion),
     FAIL_ON: failOn,
-    REPORT_PATH: validateArtifactPath(
-      options.reportPath || DEFAULT_HEALTH_CI_REPORT_PATH,
-      "--report-path"
-    ),
-    JSON_PATH: validateArtifactPath(options.jsonPath || DEFAULT_HEALTH_CI_JSON_PATH, "--json-path")
+    PROJECT_WORKING_DIRECTORY: projectPath ? `        working-directory: ${projectPath}
+` : "",
+    REPORT_PATH: reportPath,
+    JSON_PATH: jsonPath,
+    REPORT_ARTIFACT_PATH: prefixArtifactPath(projectPath, reportPath),
+    JSON_ARTIFACT_PATH: prefixArtifactPath(projectPath, jsonPath)
   });
 }
 function writeProjectHealthCiWorkflow(projectRoot, options = {}) {
@@ -118,12 +146,15 @@ function writeProjectHealthCiWorkflow(projectRoot, options = {}) {
   }
   mkdirSync(dirname(workflowPath), { recursive: true });
   writeFileSync(workflowPath, renderProjectHealthCiWorkflow(options), "utf-8");
-  return {
+  const projectPath = validateProjectPath(options.projectPath);
+  const result = {
     path: workflowRelativePath,
     created: !alreadyExists,
     cliPackage: normalizeCliPackageSpecifier(options.cliVersion),
     failOn: normalizeHealthFailOn(options.failOn)
   };
+  if (projectPath) result.projectPath = projectPath;
+  return result;
 }
 function collectDeclaredRoutes(essence) {
   if (!essence || typeof essence !== "object") return [];
@@ -490,6 +521,9 @@ async function cmdHealth(projectRoot = process.cwd(), options = {}) {
       const action = result.created ? "Created" : "Updated";
       console.log(`${GREEN}${action} Decantr Project Health workflow:${RESET} ${result.path}`);
       console.log(`${DIM}CLI package: ${result.cliPackage}${RESET}`);
+      if (result.projectPath) {
+        console.log(`${DIM}Project: ${result.projectPath}${RESET}`);
+      }
       console.log(`${DIM}CI gate: decantr health --ci --fail-on ${result.failOn}${RESET}`);
     } catch (e) {
       console.error(`${RED}${e.message}${RESET}`);
@@ -552,9 +586,14 @@ function parseHealthArgs(args) {
         options.initCi.jsonPath = args[++index];
       } else if (arg.startsWith("--json-path=")) {
         options.initCi.jsonPath = arg.split("=")[1];
+      } else if (arg === "--project" && args[index + 1]) {
+        options.initCi.projectPath = args[++index];
+      } else if (arg.startsWith("--project=")) {
+        options.initCi.projectPath = arg.split("=")[1];
       }
     }
     normalizeHealthFailOn(options.initCi.failOn);
+    validateProjectPath(options.initCi.projectPath);
     return options;
   }
   for (let index = 1; index < args.length; index += 1) {

package/dist/{health-SIKAOE2Z.js → health-3TJYYTX6.js}

@@ -8,7 +8,7 @@ import {
   renderProjectHealthCiWorkflow,
   shouldFailHealth,
   writeProjectHealthCiWorkflow
-} from "./chunk-K5KCZSEI.js";
+} from "./chunk-6YCFRZZI.js";
 import "./chunk-RSDCWAHD.js";
 import "./chunk-DI2PLOJ6.js";
 export {

package/dist/index.js

@@ -1,3 +1,3 @@
-import "./chunk-FLZVSNB5.js";
+import "./chunk-5RODH77L.js";
 import "./chunk-USOO77A5.js";
 import "./chunk-DI2PLOJ6.js";

package/dist/{studio-EQSSNA6D.js → studio-7TE7YXFG.js}

@@ -1,6 +1,6 @@
 import {
   createProjectHealthReport
-} from "./chunk-K5KCZSEI.js";
+} from "./chunk-6YCFRZZI.js";
 import "./chunk-RSDCWAHD.js";
 import "./chunk-DI2PLOJ6.js";
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decantr/cli",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "Decantr CLI - scaffold, audit, inspect Project Health, and maintain Decantr projects from the terminal",
   "author": "Decantr AI",
   "license": "MIT",
@@ -30,12 +30,12 @@
     "access": "public"
   },
   "dependencies": {
-    "ajv": "^8.18.0",
+    "ajv": "^8.20.0",
     "@decantr/core": "1.0.6",
-    "@decantr/essence-spec": "1.0.7",
     "@decantr/registry": "1.1.0",
     "@decantr/telemetry": "0.1.2",
-    "@decantr/verifier": "1.1.0"
+    "@decantr/verifier": "1.1.1",
+    "@decantr/essence-spec": "1.0.8"
   },
   "scripts": {
     "build": "tsup",

package/src/templates/decantr-health.workflow.yml.template

@@ -38,14 +38,14 @@ jobs:
           fi
 
       - name: Generate Decantr health JSON
-        run: npx --yes {{CLI_PACKAGE}} health --json --output {{JSON_PATH}}
+{{PROJECT_WORKING_DIRECTORY}}        run: npx --yes {{CLI_PACKAGE}} health --json --output {{JSON_PATH}}
 
       - name: Audit Decantr health
-        run: npx --yes {{CLI_PACKAGE}} health --ci --fail-on {{FAIL_ON}} --markdown --output {{REPORT_PATH}}
+{{PROJECT_WORKING_DIRECTORY}}        run: npx --yes {{CLI_PACKAGE}} health --ci --fail-on {{FAIL_ON}} --markdown --output {{REPORT_PATH}}
 
       - name: Publish health summary
         if: always()
-        shell: bash
+{{PROJECT_WORKING_DIRECTORY}}        shell: bash
         run: |
           if [ -f {{REPORT_PATH}} ]; then
             cat {{REPORT_PATH}} >> "$GITHUB_STEP_SUMMARY"
@@ -57,6 +57,6 @@ jobs:
         with:
           name: decantr-project-health
           path: |
-            {{JSON_PATH}}
-            {{REPORT_PATH}}
+            {{JSON_ARTIFACT_PATH}}
+            {{REPORT_ARTIFACT_PATH}}
           if-no-files-found: ignore