@gravito/constellation 1.0.0-beta.1 → 2.0.0

package/dist/{DiskSitemapStorage-EKADBB2W.js → DiskSitemapStorage-7ZZMGC4K.js}

@@ -1,6 +1,6 @@
 import {
   DiskSitemapStorage
-} from "./chunk-OGZECOH5.js";
+} from "./chunk-7WHLC3OJ.js";
 export {
   DiskSitemapStorage
 };

package/dist/chunk-7WHLC3OJ.js

@@ -0,0 +1,56 @@
+// src/storage/DiskSitemapStorage.ts
+import fs from "fs/promises";
+import path from "path";
+function sanitizeFilename(filename) {
+  if (!filename) {
+    throw new Error("Invalid sitemap filename.");
+  }
+  if (filename.includes("\0")) {
+    throw new Error("Invalid sitemap filename.");
+  }
+  if (filename.includes("/") || filename.includes("\\")) {
+    throw new Error("Invalid sitemap filename.");
+  }
+  if (filename.includes("..")) {
+    throw new Error("Invalid sitemap filename.");
+  }
+  return filename;
+}
+var DiskSitemapStorage = class {
+  constructor(outDir, baseUrl) {
+    this.outDir = outDir;
+    this.baseUrl = baseUrl;
+  }
+  async write(filename, content) {
+    const safeName = sanitizeFilename(filename);
+    await fs.mkdir(this.outDir, { recursive: true });
+    await fs.writeFile(path.join(this.outDir, safeName), content);
+  }
+  async read(filename) {
+    try {
+      const safeName = sanitizeFilename(filename);
+      return await fs.readFile(path.join(this.outDir, safeName), "utf-8");
+    } catch {
+      return null;
+    }
+  }
+  async exists(filename) {
+    try {
+      const safeName = sanitizeFilename(filename);
+      await fs.access(path.join(this.outDir, safeName));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  getUrl(filename) {
+    const safeName = sanitizeFilename(filename);
+    const base = this.baseUrl.endsWith("/") ? this.baseUrl.slice(0, -1) : this.baseUrl;
+    const file = safeName.startsWith("/") ? safeName.slice(1) : safeName;
+    return `${base}/${file}`;
+  }
+};
+
+export {
+  DiskSitemapStorage
+};

package/dist/index.cjs

@@ -35,6 +35,21 @@ var DiskSitemapStorage_exports = {};
 __export(DiskSitemapStorage_exports, {
   DiskSitemapStorage: () => DiskSitemapStorage
 });
+function sanitizeFilename(filename) {
+  if (!filename) {
+    throw new Error("Invalid sitemap filename.");
+  }
+  if (filename.includes("\0")) {
+    throw new Error("Invalid sitemap filename.");
+  }
+  if (filename.includes("/") || filename.includes("\\")) {
+    throw new Error("Invalid sitemap filename.");
+  }
+  if (filename.includes("..")) {
+    throw new Error("Invalid sitemap filename.");
+  }
+  return filename;
+}
 var import_promises, import_node_path, DiskSitemapStorage;
 var init_DiskSitemapStorage = __esm({
   "src/storage/DiskSitemapStorage.ts"() {
@@ -47,27 +62,31 @@ var init_DiskSitemapStorage = __esm({
         this.baseUrl = baseUrl;
       }
       async write(filename, content) {
+        const safeName = sanitizeFilename(filename);
         await import_promises.default.mkdir(this.outDir, { recursive: true });
-        await import_promises.default.writeFile(import_node_path.default.join(this.outDir, filename), content);
+        await import_promises.default.writeFile(import_node_path.default.join(this.outDir, safeName), content);
       }
       async read(filename) {
         try {
-          return await import_promises.default.readFile(import_node_path.default.join(this.outDir, filename), "utf-8");
+          const safeName = sanitizeFilename(filename);
+          return await import_promises.default.readFile(import_node_path.default.join(this.outDir, safeName), "utf-8");
         } catch {
           return null;
         }
       }
       async exists(filename) {
         try {
-          await import_promises.default.access(import_node_path.default.join(this.outDir, filename));
+          const safeName = sanitizeFilename(filename);
+          await import_promises.default.access(import_node_path.default.join(this.outDir, safeName));
           return true;
         } catch {
           return false;
         }
       }
       getUrl(filename) {
+        const safeName = sanitizeFilename(filename);
         const base = this.baseUrl.endsWith("/") ? this.baseUrl.slice(0, -1) : this.baseUrl;
-        const file = filename.startsWith("/") ? filename.slice(1) : filename;
+        const file = safeName.startsWith("/") ? safeName.slice(1) : safeName;
         return `${base}/${file}`;
       }
     };
@@ -1185,6 +1204,21 @@ var MemorySitemapStorage = class {
 };
 
 // src/OrbitSitemap.ts
+function sanitizeFilename2(value) {
+  if (!value) {
+    return null;
+  }
+  if (value.includes("\0")) {
+    return null;
+  }
+  if (value.includes("/") || value.includes("\\")) {
+    return null;
+  }
+  if (value.includes("..")) {
+    return null;
+  }
+  return value;
+}
 var OrbitSitemap = class _OrbitSitemap {
   options;
   mode;
@@ -1235,7 +1269,11 @@ var OrbitSitemap = class _OrbitSitemap {
     const baseDir = opts.path ? opts.path.substring(0, opts.path.lastIndexOf("/")) : void 0;
     const handler = async (ctx) => {
       const reqPath = ctx.req.path;
-      const filename = reqPath.split("/").pop() || indexFilename;
+      const rawName = reqPath.split("/").pop() || indexFilename;
+      const filename = sanitizeFilename2(rawName);
+      if (!filename) {
+        return ctx.text("Not Found", 404);
+      }
       const isIndex = filename === indexFilename;
       let content = await storage.read(filename);
       if (!content && isIndex) {

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import { Job } from '@gravito/stream';
-import { PlanetCore } from 'gravito-core';
+import { PlanetCore } from '@gravito/core';
 
 type ChangeFreq = 'always' | 'hourly' | 'daily' | 'weekly' | 'monthly' | 'yearly' | 'never';
 interface AlternateUrl {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { Job } from '@gravito/stream';
-import { PlanetCore } from 'gravito-core';
+import { PlanetCore } from '@gravito/core';
 
 type ChangeFreq = 'always' | 'hourly' | 'daily' | 'weekly' | 'monthly' | 'yearly' | 'never';
 interface AlternateUrl {

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   DiskSitemapStorage
-} from "./chunk-OGZECOH5.js";
+} from "./chunk-7WHLC3OJ.js";
 
 // src/core/ChangeTracker.ts
 var MemoryChangeTracker = class {
@@ -1083,6 +1083,21 @@ var MemorySitemapStorage = class {
 };
 
 // src/OrbitSitemap.ts
+function sanitizeFilename(value) {
+  if (!value) {
+    return null;
+  }
+  if (value.includes("\0")) {
+    return null;
+  }
+  if (value.includes("/") || value.includes("\\")) {
+    return null;
+  }
+  if (value.includes("..")) {
+    return null;
+  }
+  return value;
+}
 var OrbitSitemap = class _OrbitSitemap {
   options;
   mode;
@@ -1133,7 +1148,11 @@ var OrbitSitemap = class _OrbitSitemap {
     const baseDir = opts.path ? opts.path.substring(0, opts.path.lastIndexOf("/")) : void 0;
     const handler = async (ctx) => {
       const reqPath = ctx.req.path;
-      const filename = reqPath.split("/").pop() || indexFilename;
+      const rawName = reqPath.split("/").pop() || indexFilename;
+      const filename = sanitizeFilename(rawName);
+      if (!filename) {
+        return ctx.text("Not Found", 404);
+      }
       const isIndex = filename === indexFilename;
       let content = await storage.read(filename);
       if (!content && isIndex) {
@@ -1191,7 +1210,7 @@ var OrbitSitemap = class _OrbitSitemap {
     const opts = this.options;
     let storage = opts.storage;
     if (!storage) {
-      const { DiskSitemapStorage: DiskSitemapStorage2 } = await import("./DiskSitemapStorage-EKADBB2W.js");
+      const { DiskSitemapStorage: DiskSitemapStorage2 } = await import("./DiskSitemapStorage-7ZZMGC4K.js");
       storage = new DiskSitemapStorage2(opts.outDir, opts.baseUrl);
     }
     let providers = opts.providers;
@@ -1237,7 +1256,7 @@ var OrbitSitemap = class _OrbitSitemap {
     }
     let storage = opts.storage;
     if (!storage) {
-      const { DiskSitemapStorage: DiskSitemapStorage2 } = await import("./DiskSitemapStorage-EKADBB2W.js");
+      const { DiskSitemapStorage: DiskSitemapStorage2 } = await import("./DiskSitemapStorage-7ZZMGC4K.js");
       storage = new DiskSitemapStorage2(opts.outDir, opts.baseUrl);
     }
     const incrementalGenerator = new IncrementalGenerator({
@@ -1266,7 +1285,7 @@ var OrbitSitemap = class _OrbitSitemap {
     const jobId = randomUUID();
     let storage = opts.storage;
     if (!storage) {
-      const { DiskSitemapStorage: DiskSitemapStorage2 } = await import("./DiskSitemapStorage-EKADBB2W.js");
+      const { DiskSitemapStorage: DiskSitemapStorage2 } = await import("./DiskSitemapStorage-7ZZMGC4K.js");
       storage = new DiskSitemapStorage2(opts.outDir, opts.baseUrl);
     }
     let providers = opts.providers;

package/package.json

@@ -1,11 +1,18 @@
 {
   "name": "@gravito/constellation",
-  "version": "1.0.0-beta.1",
+  "version": "2.0.0",
   "description": "Powerful sitemap generation for Gravito applications with dynamic/static support, sharding, and caching.",
-  "type": "module",
   "main": "./dist/index.cjs",
-  "module": "./dist/index.mjs",
+  "module": "./dist/index.js",
+  "type": "module",
   "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
   "files": [
     "dist",
     "README.md",
@@ -13,22 +20,24 @@
   ],
   "scripts": {
     "build": "bun run build.ts",
-    "typecheck": "tsc --noEmit",
-    "test": "bun test"
+    "typecheck": "bun tsc -p tsconfig.json --noEmit --skipLibCheck",
+    "test": "bun test",
+    "test:coverage": "bun test --coverage --coverage-threshold=80",
+    "test:ci": "bun test --coverage --coverage-threshold=80"
   },
   "peerDependencies": {
-    "gravito-core": "1.0.0-beta.6"
+    "@gravito/core": "workspace:*"
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.956.0",
     "@google-cloud/storage": "^7.18.0",
-    "@gravito/stream": "1.0.0-beta.1",
-    "@gravito/photon": "1.0.0-beta.1"
+    "@gravito/stream": "workspace:*",
+    "@gravito/photon": "workspace:*"
   },
   "devDependencies": {
     "bun-plugin-dts": "^0.3.0",
     "bun-types": "latest",
-    "gravito-core": "1.0.0-beta.6",
+    "@gravito/core": "workspace:*",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3"
   },
@@ -47,4 +56,4 @@
   "license": "MIT",
   "author": "Carl Lee <carllee0520@gmail.com>",
   "homepage": "https://github.com/gravito-framework/gravito#readme"
-}
+}

package/dist/chunk-OGZECOH5.js

@@ -1,37 +0,0 @@
-// src/storage/DiskSitemapStorage.ts
-import fs from "fs/promises";
-import path from "path";
-var DiskSitemapStorage = class {
-  constructor(outDir, baseUrl) {
-    this.outDir = outDir;
-    this.baseUrl = baseUrl;
-  }
-  async write(filename, content) {
-    await fs.mkdir(this.outDir, { recursive: true });
-    await fs.writeFile(path.join(this.outDir, filename), content);
-  }
-  async read(filename) {
-    try {
-      return await fs.readFile(path.join(this.outDir, filename), "utf-8");
-    } catch {
-      return null;
-    }
-  }
-  async exists(filename) {
-    try {
-      await fs.access(path.join(this.outDir, filename));
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  getUrl(filename) {
-    const base = this.baseUrl.endsWith("/") ? this.baseUrl.slice(0, -1) : this.baseUrl;
-    const file = filename.startsWith("/") ? filename.slice(1) : filename;
-    return `${base}/${file}`;
-  }
-};
-
-export {
-  DiskSitemapStorage
-};