Hmm ya, Maker shouldn't have anything todo with the vendor dir. I suspect this is happening either when we call createClassNameDetails() or when $generator->execute(). In either of those 2 paths, we use our autoloader to validate class names. Ultimately, we need to:

1. "global conditional" that throws an exception if $fs is attempting to CRUD $root_project_dir/vendor. 4 is a better idea
2. In our autoloader, exclude any classes that are
   • Outside of the maker.root_namespace NS (defaults to App)
3. This should effectively limit $fs to only CRUD php files within the maker.root_ namespace.
4. Throw an exception if makers $fs is trying to modify php files outside of the src/ / maker.root_namespace dir paths.

I think it should be checked if an alias exists as FQCN as well as in the mapping files (which are not read, afaik, since it's not possible to know what kind of setup people have?) and then provide a list of possible targets for classes, instead of picking one?

I think it should be possible to read Doctrine's ORM configuration after they've been processed, since the container has been built during maker's runtime, so maybe validate against that?

I've noticed a similar, but unrelated issue, as maker's config is very basic. It should be left in place for the time being, but I believe something like ORM should rely on the underlying framework configuration first (since, for example, we have multiple ORM mappings and it's a pain to switch maker between them), which would also allow for better validation in these types of cases.

Any idea if/when this will get looked at? I could look into it myself but it'll prolly take me way longer to familiarize myself with exactly what has to be done