create-meridian-app 0.1.13 → 0.1.15

package/dist/{chunk-U5TMTVEV.js → chunk-DUCNQ62I.js}

@@ -419,6 +419,7 @@ ${handlers.join("\n\n")}
 
 // src/utils.ts
 import path from "path";
+import { randomBytes } from "crypto";
 import fs from "fs/promises";
 import { existsSync } from "fs";
 import { execa } from "execa";
@@ -462,8 +463,8 @@ process.stdout.write(JSON.stringify({
   dashboardPort: c?.admin?.port ?? 5174,
 }))
 `;
-  const scriptPath = path.join(rootDir, ".meridian-ports-tmp.mjs");
-  await fs.writeFile(scriptPath, script, "utf-8");
+  const scriptPath = path.join(rootDir, `.meridian-ports-${randomBytes(8).toString("hex")}.mjs`);
+  await fs.writeFile(scriptPath, script, { encoding: "utf-8", mode: 384 });
   try {
     const result = await execa("node", ["--import", "tsx/esm", scriptPath], { cwd: rootDir });
     return JSON.parse(result.stdout);
@@ -480,6 +481,10 @@ async function runNew(projectName) {
   console.log(chalk.bold("  Create Meridian App"));
   console.log();
   let name = projectName;
+  if (name && !/^[a-z0-9-_]+$/.test(name)) {
+    console.error(chalk.red("  \u2716 Project name must contain only lowercase letters, numbers, hyphens, and underscores"));
+    process.exit(1);
+  }
   if (!name) {
     const res = await prompts(
       {

package/dist/cli.js

@@ -14,10 +14,11 @@ import {
   toKebabCase,
   toPascalCase,
   writeFile
-} from "./chunk-U5TMTVEV.js";
+} from "./chunk-DUCNQ62I.js";
 
 // src/cli.ts
 import { Command } from "commander";
+import chalk13 from "chalk";
 
 // src/commands/dev.ts
 import path2 from "path";
@@ -131,6 +132,13 @@ function startDashboardServer(distDir, port, apiPort, apiHost = "localhost", adm
         return;
       }
       let filePath = path.join(distDir, urlPath === "/" ? "index.html" : urlPath);
+      const resolvedFile = path.resolve(filePath);
+      const resolvedDist = path.resolve(distDir);
+      if (!resolvedFile.startsWith(resolvedDist + path.sep) && resolvedFile !== resolvedDist) {
+        res.writeHead(403);
+        res.end("Forbidden");
+        return;
+      }
       if (!existsSync(filePath) || fs.statSync(filePath).isDirectory()) {
         filePath = path.join(distDir, "index.html");
       }
@@ -306,9 +314,10 @@ const app = await bootstrap({ rootDir: ${JSON.stringify(rootDir)} })
 await app.stop()
 process.exit(0)
 `;
-  const scriptPath = path3.join(rootDir, ".meridian-migrate-tmp.mjs");
+  const { randomBytes } = await import("crypto");
+  const scriptPath = path3.join(rootDir, `.meridian-migrate-${randomBytes(8).toString("hex")}.mjs`);
   const { writeFile: writeFile2, unlink } = await import("fs/promises");
-  await writeFile2(scriptPath, script, "utf-8");
+  await writeFile2(scriptPath, script, { encoding: "utf-8", mode: 384 });
   try {
     await execa3("node", ["--import", "tsx/esm", scriptPath], {
       cwd: rootDir,
@@ -586,6 +595,12 @@ async function generateRoute(routePath, methods) {
   }
   const normalized = routePath.replace(/^\//, "");
   const filePath = path10.join(rootDir, "src", "api", normalized, "route.ts");
+  const resolvedFile = path10.resolve(filePath);
+  const resolvedBase = path10.resolve(rootDir, "src", "api");
+  if (!resolvedFile.startsWith(resolvedBase + path10.sep)) {
+    console.error(chalk11.red("  \u2716 Invalid route path: must resolve within src/api/"));
+    process.exit(1);
+  }
   if (existsSync8(filePath)) {
     console.error(chalk11.red(`  \u2716 Route already exists: src/api/${normalized}/route.ts`));
     process.exit(1);
@@ -613,6 +628,7 @@ import chalk12 from "chalk";
 import ora2 from "ora";
 import prompts from "prompts";
 import { execa as execa4 } from "execa";
+var ROLES = ["super-admin", "admin", "moderator", "member"];
 async function runUserCreate(opts) {
   const rootDir = findProjectRoot();
   if (!rootDir) {
@@ -623,6 +639,10 @@ async function runUserCreate(opts) {
     );
     process.exit(1);
   }
+  if (opts.role && !ROLES.includes(opts.role)) {
+    console.error(chalk12.red(`  \u2716 Invalid role "${opts.role}". Must be one of: ${ROLES.join(", ")}`));
+    process.exit(1);
+  }
   const response = await prompts(
     [
       {
@@ -703,7 +723,7 @@ let output
 try {
   const result = await authService.register({
     email: ${JSON.stringify(email)},
-    password: ${JSON.stringify(password)},
+    password: process.env.MERIDIAN_USER_PASSWORD,
     first_name: ${JSON.stringify(first_name || null)},
     last_name: ${JSON.stringify(last_name || null)},
     role: ${JSON.stringify(role)},
@@ -717,14 +737,15 @@ console.log(JSON.stringify(output))
 await app.stop()
 process.exit(output.success ? 0 : 1)
 `;
-  const scriptPath = path11.join(rootDir, ".meridian-user-create-tmp.mjs");
+  const { randomBytes } = await import("crypto");
+  const scriptPath = path11.join(rootDir, `.meridian-user-create-${randomBytes(8).toString("hex")}.mjs`);
   const { writeFile: writeFile2, unlink } = await import("fs/promises");
-  await writeFile2(scriptPath, script, "utf-8");
+  await writeFile2(scriptPath, script, { encoding: "utf-8", mode: 384 });
   try {
     const result = await execa4("node", ["--import", "tsx/esm", scriptPath], {
       cwd: rootDir,
       stdio: "pipe",
-      env: { ...process.env, NODE_ENV: "development" }
+      env: { ...process.env, NODE_ENV: "development", MERIDIAN_USER_PASSWORD: password }
     });
     const lines = result.stdout.trim().split("\n");
     const output = JSON.parse(lines[lines.length - 1]);
@@ -788,7 +809,12 @@ program.command("db:generate <name>").description("Generate a new migration file
   });
 });
 program.command("serve-dashboard").description("Serve the admin dashboard as a static site").option("-p, --port <port>", "Port to serve on", "5174").action((options) => {
-  runServeDashboard(Number(options.port)).catch((err) => {
+  const port = Number(options.port);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    console.error(chalk13.red(`  \u2716 Invalid port: ${options.port}`));
+    process.exit(1);
+  }
+  runServeDashboard(port).catch((err) => {
     console.error(err);
     process.exit(1);
   });

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runNew
-} from "./chunk-U5TMTVEV.js";
+} from "./chunk-DUCNQ62I.js";
 
 // src/index.ts
 var projectName = process.argv[2];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-meridian-app",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Create a new Meridian project or manage an existing one",
   "main": "./dist/index.js",
   "type": "module",