@gravito/nebula 1.0.0-beta.1 → 1.0.0

package/README.md

@@ -13,7 +13,7 @@ bun add @gravito/nebula
 ## 🚀 Usage
 
 ```typescript
-import { PlanetCore } from 'gravito-core';
+import { PlanetCore } from '@gravito/core';
 import orbitStorage from '@gravito/nebula';
 
 const core = new PlanetCore();

package/README.zh-TW.md

@@ -11,7 +11,7 @@ bun add @gravito/nebula
 ## 快速開始
 
 ```typescript
-import { PlanetCore } from 'gravito-core'
+import { PlanetCore } from '@gravito/core'
 import orbitStorage from '@gravito/nebula'
 
 const core = new PlanetCore()

package/dist/index.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,14 +15,6 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
@@ -38,9 +28,11 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 var import_promises = require("fs/promises");
 var import_node_path = require("path");
+var import_core = require("@gravito/core");
 var LocalStorageProvider = class {
   rootDir;
   baseUrl;
+  runtime = (0, import_core.getRuntimeAdapter)();
   /**
    * Create a new LocalStorageProvider.
    *
@@ -58,12 +50,12 @@ var LocalStorageProvider = class {
    * @param data - The data to store.
    */
   async put(key, data) {
-    const path = (0, import_node_path.join)(this.rootDir, key);
+    const path = this.resolveKeyPath(key);
     const dir = path.substring(0, path.lastIndexOf("/"));
     if (dir && dir !== this.rootDir) {
       await (0, import_promises.mkdir)(dir, { recursive: true });
     }
-    await Bun.write(path, data);
+    await this.runtime.writeFile(path, data);
   }
   /**
    * Retrieve a file.
@@ -72,11 +64,11 @@ var LocalStorageProvider = class {
    * @returns A promise resolving to the file Blob or null if not found.
    */
   async get(key) {
-    const file = Bun.file((0, import_node_path.join)(this.rootDir, key));
-    if (!await file.exists()) {
+    const path = this.resolveKeyPath(key);
+    if (!await this.runtime.exists(path)) {
       return null;
     }
-    return file;
+    return await this.runtime.readFileAsBlob(path);
   }
   /**
    * Delete a file.
@@ -84,11 +76,7 @@ var LocalStorageProvider = class {
    * @param key - The storage key.
    */
   async delete(key) {
-    const fs = await import("fs/promises");
-    try {
-      await fs.unlink((0, import_node_path.join)(this.rootDir, key));
-    } catch {
-    }
+    await this.runtime.deleteFile(this.resolveKeyPath(key));
   }
   /**
    * Get the public URL for a file.
@@ -97,7 +85,28 @@ var LocalStorageProvider = class {
    * @returns The public URL string.
    */
   getUrl(key) {
-    return `${this.baseUrl}/${key}`;
+    const safeKey = this.normalizeKey(key);
+    return `${this.baseUrl}/${safeKey}`;
+  }
+  normalizeKey(key) {
+    if (!key || key.includes("\0")) {
+      throw new Error("Invalid storage key.");
+    }
+    const normalized = (0, import_node_path.normalize)(key).replace(/^[/\\]+/, "");
+    if (normalized === "." || normalized === ".." || normalized.startsWith(`..${import_node_path.sep}`) || (0, import_node_path.isAbsolute)(normalized)) {
+      throw new Error("Invalid storage key.");
+    }
+    return normalized.replace(/\\/g, "/");
+  }
+  resolveKeyPath(key) {
+    const normalized = this.normalizeKey(key);
+    const root = (0, import_node_path.resolve)(this.rootDir);
+    const resolved = (0, import_node_path.resolve)(root, normalized);
+    const rootPrefix = root.endsWith(import_node_path.sep) ? root : `${root}${import_node_path.sep}`;
+    if (!resolved.startsWith(rootPrefix) && resolved !== root) {
+      throw new Error("Invalid storage key.");
+    }
+    return resolved;
   }
 };
 var OrbitNebula = class {

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { PlanetCore, GravitoOrbit } from 'gravito-core';
+import { PlanetCore, GravitoOrbit } from '@gravito/core';
 
 interface StorageProvider {
     put(key: string, data: Blob | Buffer | string): Promise<void>;
@@ -12,6 +12,7 @@ interface StorageProvider {
 declare class LocalStorageProvider implements StorageProvider {
     private rootDir;
     private baseUrl;
+    private runtime;
     /**
      * Create a new LocalStorageProvider.
      *
@@ -46,6 +47,8 @@ declare class LocalStorageProvider implements StorageProvider {
      * @returns The public URL string.
      */
     getUrl(key: string): string;
+    private normalizeKey;
+    private resolveKeyPath;
 }
 interface OrbitNebulaOptions {
     provider?: StorageProvider;

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { PlanetCore, GravitoOrbit } from 'gravito-core';
+import { PlanetCore, GravitoOrbit } from '@gravito/core';
 
 interface StorageProvider {
     put(key: string, data: Blob | Buffer | string): Promise<void>;
@@ -12,6 +12,7 @@ interface StorageProvider {
 declare class LocalStorageProvider implements StorageProvider {
     private rootDir;
     private baseUrl;
+    private runtime;
     /**
      * Create a new LocalStorageProvider.
      *
@@ -46,6 +47,8 @@ declare class LocalStorageProvider implements StorageProvider {
      * @returns The public URL string.
      */
     getUrl(key: string): string;
+    private normalizeKey;
+    private resolveKeyPath;
 }
 interface OrbitNebulaOptions {
     provider?: StorageProvider;

package/dist/index.js

@@ -1,9 +1,13 @@
 // src/index.ts
 import { mkdir } from "fs/promises";
-import { join } from "path";
+import { isAbsolute, normalize, resolve, sep } from "path";
+import {
+  getRuntimeAdapter
+} from "@gravito/core";
 var LocalStorageProvider = class {
   rootDir;
   baseUrl;
+  runtime = getRuntimeAdapter();
   /**
    * Create a new LocalStorageProvider.
    *
@@ -21,12 +25,12 @@ var LocalStorageProvider = class {
    * @param data - The data to store.
    */
   async put(key, data) {
-    const path = join(this.rootDir, key);
+    const path = this.resolveKeyPath(key);
     const dir = path.substring(0, path.lastIndexOf("/"));
     if (dir && dir !== this.rootDir) {
       await mkdir(dir, { recursive: true });
     }
-    await Bun.write(path, data);
+    await this.runtime.writeFile(path, data);
   }
   /**
    * Retrieve a file.
@@ -35,11 +39,11 @@ var LocalStorageProvider = class {
    * @returns A promise resolving to the file Blob or null if not found.
    */
   async get(key) {
-    const file = Bun.file(join(this.rootDir, key));
-    if (!await file.exists()) {
+    const path = this.resolveKeyPath(key);
+    if (!await this.runtime.exists(path)) {
       return null;
     }
-    return file;
+    return await this.runtime.readFileAsBlob(path);
   }
   /**
    * Delete a file.
@@ -47,11 +51,7 @@ var LocalStorageProvider = class {
    * @param key - The storage key.
    */
   async delete(key) {
-    const fs = await import("fs/promises");
-    try {
-      await fs.unlink(join(this.rootDir, key));
-    } catch {
-    }
+    await this.runtime.deleteFile(this.resolveKeyPath(key));
   }
   /**
    * Get the public URL for a file.
@@ -60,7 +60,28 @@ var LocalStorageProvider = class {
    * @returns The public URL string.
    */
   getUrl(key) {
-    return `${this.baseUrl}/${key}`;
+    const safeKey = this.normalizeKey(key);
+    return `${this.baseUrl}/${safeKey}`;
+  }
+  normalizeKey(key) {
+    if (!key || key.includes("\0")) {
+      throw new Error("Invalid storage key.");
+    }
+    const normalized = normalize(key).replace(/^[/\\]+/, "");
+    if (normalized === "." || normalized === ".." || normalized.startsWith(`..${sep}`) || isAbsolute(normalized)) {
+      throw new Error("Invalid storage key.");
+    }
+    return normalized.replace(/\\/g, "/");
+  }
+  resolveKeyPath(key) {
+    const normalized = this.normalizeKey(key);
+    const root = resolve(this.rootDir);
+    const resolved = resolve(root, normalized);
+    const rootPrefix = root.endsWith(sep) ? root : `${root}${sep}`;
+    if (!resolved.startsWith(rootPrefix) && resolved !== root) {
+      throw new Error("Invalid storage key.");
+    }
+    return resolved;
   }
 };
 var OrbitNebula = class {

package/package.json

@@ -1,18 +1,18 @@
 {
   "name": "@gravito/nebula",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0",
   "publishConfig": {
     "access": "public"
   },
   "description": "Standard Storage Orbit for Galaxy Architecture",
-  "module": "./dist/index.mjs",
   "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
   "type": "module",
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.mjs",
+      "import": "./dist/index.js",
       "require": "./dist/index.cjs"
     }
   },
@@ -24,7 +24,9 @@
   "scripts": {
     "build": "bun run build.ts",
     "test": "bun test",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "bun tsc -p tsconfig.json --noEmit --skipLibCheck",
+    "test:coverage": "bun test --coverage --coverage-threshold=80",
+    "test:ci": "bun test --coverage --coverage-threshold=80"
   },
   "keywords": [
     "gravito",
@@ -35,12 +37,12 @@
   "author": "Carl Lee <carllee0520@gmail.com>",
   "license": "MIT",
   "peerDependencies": {
-    "gravito-core": "1.0.0-beta.6"
+    "@gravito/core": "workspace:*"
   },
   "devDependencies": {
     "bun-types": "latest",
-    "gravito-core": "1.0.0-beta.6",
-    "@gravito/photon": "1.0.0-beta.1",
+    "@gravito/core": "workspace:*",
+    "@gravito/photon": "workspace:*",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3"
   },
@@ -50,4 +52,4 @@
     "url": "git+https://github.com/gravito-framework/gravito.git",
     "directory": "packages/nebula"
   }
-}
+}