@grainulation/silo 1.0.4 → 1.0.5

package/lib/import-export.js

@@ -9,10 +9,21 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { Store } = require("./store.js");
 
+const VALID_TYPES = [
+  "constraint",
+  "factual",
+  "estimate",
+  "risk",
+  "recommendation",
+  "feedback",
+];
+const VALID_EVIDENCE = ["stated", "web", "documented", "tested", "production"];
+
 /**
  * Normalize a claim to wheat's canonical schema.
  * Handles legacy fields: tier -> evidence, text -> content.
  * Fills in missing required fields with sensible defaults.
+ * Validates enums, sanitizes content, and ensures provenance.
  */
 function normalizeClaim(claim) {
   const normalized = { ...claim };
@@ -41,6 +52,21 @@ function normalizeClaim(claim) {
   normalized.resolved_by = normalized.resolved_by || null;
   normalized.tags = normalized.tags || [];
 
+  // Enum validation: clamp type to allowed set
+  if (!VALID_TYPES.includes(normalized.type)) {
+    normalized.type = "factual";
+  }
+
+  // Enum validation: clamp evidence to allowed set
+  if (!VALID_EVIDENCE.includes(normalized.evidence)) {
+    normalized.evidence = "stated";
+  }
+
+  // String sanitization: strip HTML tags from content
+  if (typeof normalized.content === "string") {
+    normalized.content = normalized.content.replace(/<[^>]*>/g, "");
+  }
+
   // Normalize source to object form
   if (!normalized.source || typeof normalized.source === "string") {
     normalized.source = {
@@ -53,6 +79,11 @@ function normalizeClaim(claim) {
     };
   }
 
+  // Ensure provenance: if source.origin is missing, set default
+  if (!normalized.source.origin) {
+    normalized.source.origin = "silo-import";
+  }
+
   return normalized;
 }
 
@@ -176,4 +207,4 @@ class ImportExport {
   }
 }
 
-module.exports = { ImportExport, normalizeClaim };
+module.exports = { ImportExport, normalizeClaim, VALID_TYPES, VALID_EVIDENCE };

package/lib/packs.js

@@ -140,7 +140,20 @@ class Packs {
     }
 
     const pack = JSON.parse(fs.readFileSync(filePath, "utf-8"));
-    const slug = (pack.name || path.basename(filePath, ".json"))
+
+    // Validate pack name against path traversal
+    const rawName = pack.name || path.basename(filePath, ".json");
+    if (
+      /[/\\]/.test(rawName) ||
+      rawName.includes("..") ||
+      rawName.startsWith(".")
+    ) {
+      throw new Error(
+        `Invalid pack name "${rawName}": must not contain /, \\, .., or start with .`,
+      );
+    }
+
+    const slug = rawName
       .toLowerCase()
       .replace(/[^a-z0-9]+/g, "-")
       .replace(/^-|-$/g, "");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grainulation/silo",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Reusable knowledge for research sprints -- shared claim libraries, templates, and knowledge packs",
   "main": "lib/index.js",
   "exports": {