@larose-ui/cli 0.1.1 → 0.1.2

package/dist/cli.js

@@ -2,7 +2,7 @@
 
 // src/cli.ts
 import { writeFileSync } from "fs";
-import { resolve } from "path";
+import { resolve as resolve2 } from "path";
 
 // src/doctor.ts
 import { readdir as readdir2, readFile as readFile2, stat, writeFile } from "fs/promises";
@@ -730,16 +730,16 @@ function formatVisualRegressionReport(result) {
 
 // src/doctor.ts
 var BUNDLE_BUDGETS_KB = {
-  "@larose-ui/core": 10,
-  "@larose-ui/tokens": 5,
+  "@larose-ui/core": 15,
+  "@larose-ui/tokens": 65,
   "@larose-ui/network": 6,
   "@larose-ui/offline": 5,
   "@larose-ui/permissions": 8,
   "@larose-ui/data": 15,
   "@larose-ui/forms": 10,
-  "@larose-ui/react": 70,
-  "@larose-ui/runtime": 36,
-  "@larose-ui/observability": 26,
+  "@larose-ui/react": 460,
+  "@larose-ui/runtime": 40,
+  "@larose-ui/observability": 28,
   "@larose-ui/contracts": 5,
   "@larose-ui/migration": 14,
   "@larose-ui/testing": 10,
@@ -1099,10 +1099,24 @@ async function runRelease(rootDir2, json = false) {
   return { output, ready };
 }
 
+// src/pathSafety.ts
+import { resolve, sep } from "path";
+function resolveSafePath(rootDir2, targetPath) {
+  const root = resolve(rootDir2);
+  const resolved = resolve(root, targetPath);
+  if (resolved === root) {
+    return resolved;
+  }
+  if (!resolved.startsWith(root + sep)) {
+    throw new Error(`Path must stay within the project directory: ${targetPath}`);
+  }
+  return resolved;
+}
+
 // src/cli.ts
 var args = process.argv.slice(2);
 var command = args[0] ?? "help";
-var rootDir = resolve(process.cwd());
+var rootDir = resolve2(process.cwd());
 function hasFlag(flag) {
   return args.includes(flag);
 }
@@ -1142,8 +1156,9 @@ async function main() {
       const output = args[3];
       const code = runGenerate(type, name);
       if (output) {
-        writeFileSync(output, code);
-        console.log(`Generated ${output}`);
+        const safeOutput = resolveSafePath(rootDir, output);
+        writeFileSync(safeOutput, code);
+        console.log(`Generated ${safeOutput}`);
       } else {
         console.log(code);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@larose-ui/cli",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "CLI for laRose UI platform — doctor, migrate, generate",
   "type": "module",
   "bin": {
@@ -11,9 +11,9 @@
     "README.md"
   ],
   "dependencies": {
-    "@larose-ui/contracts": "0.1.1",
-    "@larose-ui/migration": "0.1.1",
-    "@larose-ui/accessibility": "0.1.1"
+    "@larose-ui/accessibility": "0.1.2",
+    "@larose-ui/contracts": "0.1.2",
+    "@larose-ui/migration": "0.1.1"
   },
   "devDependencies": {
     "tsup": "^8.3.5",