@hasna/shortlinks 0.1.20 → 0.1.22

package/dist/cli/index.js

@@ -3271,7 +3271,8 @@ import { mkdirSync as mkdirSync2 } from "fs";
 import { dirname as dirname2 } from "path";
 
 // src/config.ts
-import { existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { existsSync as existsSync2, linkSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";
+import { randomBytes } from "crypto";
 import { homedir as homedir2 } from "os";
 import { dirname, join as join2, resolve } from "path";
 var SERVICE_NAME = "shortlinks";
@@ -3287,6 +3288,9 @@ function ensureDataDir() {
 function getConfigPath() {
   return join2(ensureDataDir(), "config.json");
 }
+function getClickSaltPath() {
+  return join2(ensureDataDir(), "click-salt");
+}
 function getDatabasePath(explicitPath) {
   if (explicitPath)
     return resolve(explicitPath);
@@ -3294,6 +3298,51 @@ function getDatabasePath(explicitPath) {
     return resolve(process.env.SHORTLINKS_DB);
   return join2(ensureDataDir(), `${SERVICE_NAME}.db`);
 }
+function readClickSaltFile(path) {
+  try {
+    const saved = readFileSync(path, "utf-8").trim();
+    return saved || null;
+  } catch {
+    return null;
+  }
+}
+function clickSaltError(path, error) {
+  const detail = error instanceof Error ? error.message : String(error);
+  return new Error(`Could not initialize click salt at ${path}. Set SHORTLINKS_CLICK_SALT or fix data directory permissions. ${detail}`);
+}
+function getClickSalt() {
+  const explicit = process.env.SHORTLINKS_CLICK_SALT?.trim();
+  if (explicit)
+    return explicit;
+  const path = getClickSaltPath();
+  const saved = readClickSaltFile(path);
+  if (saved)
+    return saved;
+  const generated = randomBytes(32).toString("hex");
+  const tempPath = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tempPath, `${generated}
+`, { flag: "wx", mode: 384 });
+    try {
+      linkSync(tempPath, path);
+      return generated;
+    } catch (error) {
+      const winner = readClickSaltFile(path);
+      if (winner)
+        return winner;
+      throw clickSaltError(path, error);
+    } finally {
+      try {
+        unlinkSync(tempPath);
+      } catch {}
+    }
+  } catch (error) {
+    const winner = readClickSaltFile(path);
+    if (winner)
+      return winner;
+    throw clickSaltError(path, error);
+  }
+}
 function loadConfig() {
   const path = getConfigPath();
   if (!existsSync2(path))
@@ -3335,7 +3384,9 @@ function normalizeHostname(input) {
     throw new Error(`Invalid domain: ${input}`);
   }
   hostname = hostname.replace(/\.$/, "");
-  if (!/^[a-z0-9.-]+$/.test(hostname) || hostname.includes("..")) {
+  const labels = hostname.split(".");
+  const labelsAreValid = labels.every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9-]+$/.test(label) && !label.startsWith("-") && !label.endsWith("-"));
+  if (hostname.length > 253 || !labelsAreValid) {
     throw new Error(`Invalid domain: ${input}`);
   }
   return hostname;
@@ -3463,13 +3514,13 @@ import { hostname } from "os";
 import { join as join3 } from "path";
 
 // src/slug.ts
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 var SLUG_ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
 var DEFAULT_SLUG_LENGTH = 7;
 function randomToken(length = DEFAULT_SLUG_LENGTH) {
   if (length < 1 || length > 128)
     throw new Error("Token length must be between 1 and 128.");
-  const bytes = randomBytes(length);
+  const bytes = randomBytes2(length);
   let out = "";
   for (let i = 0;i < length; i += 1) {
     out += SLUG_ALPHABET[bytes[i] % SLUG_ALPHABET.length];
@@ -3789,8 +3840,7 @@ class ShortlinksStore {
     throw new Error("Could not generate an unused slug after 32 attempts.");
   }
   hashIp(ip) {
-    const salt = process.env.SHORTLINKS_CLICK_SALT || "shortlinks-local";
-    return createHash("sha256").update(`${salt}:${ip}`).digest("hex");
+    return createHash("sha256").update(`${getClickSalt()}:${ip}`).digest("hex");
   }
 }
 
@@ -4098,8 +4148,7 @@ class PgShortlinksStore {
     };
   }
   hashIp(ip) {
-    const salt = process.env.SHORTLINKS_CLICK_SALT || "shortlinks-cloud";
-    return createHash2("sha256").update(`${salt}:${ip}`).digest("hex");
+    return createHash2("sha256").update(`${getClickSalt()}:${ip}`).digest("hex");
   }
   async generateAvailableSlug(domainId, length) {
     for (let attempt = 0;attempt < 32; attempt += 1) {

package/dist/cloudflare.js

@@ -20,7 +20,9 @@ function normalizeHostname(input) {
     throw new Error(`Invalid domain: ${input}`);
   }
   hostname = hostname.replace(/\.$/, "");
-  if (!/^[a-z0-9.-]+$/.test(hostname) || hostname.includes("..")) {
+  const labels = hostname.split(".");
+  const labelsAreValid = labels.every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9-]+$/.test(label) && !label.startsWith("-") && !label.endsWith("-"));
+  if (hostname.length > 253 || !labelsAreValid) {
     throw new Error(`Invalid domain: ${input}`);
   }
   return hostname;

package/dist/config.d.ts

@@ -12,7 +12,9 @@ export interface ShortlinksConfig {
 export declare function getDataDir(): string;
 export declare function ensureDataDir(): string;
 export declare function getConfigPath(): string;
+export declare function getClickSaltPath(): string;
 export declare function getDatabasePath(explicitPath?: string): string;
+export declare function getClickSalt(): string;
 export declare function loadConfig(): ShortlinksConfig;
 export declare function saveConfig(config: ShortlinksConfig): void;
 export declare function updateConfig(patch: ShortlinksConfig): ShortlinksConfig;

package/dist/index.js

@@ -7,7 +7,8 @@ import { mkdirSync as mkdirSync2 } from "fs";
 import { dirname as dirname2 } from "path";
 
 // src/config.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { existsSync, linkSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";
+import { randomBytes } from "crypto";
 import { homedir } from "os";
 import { dirname, join, resolve } from "path";
 var SERVICE_NAME = "shortlinks";
@@ -23,6 +24,9 @@ function ensureDataDir() {
 function getConfigPath() {
   return join(ensureDataDir(), "config.json");
 }
+function getClickSaltPath() {
+  return join(ensureDataDir(), "click-salt");
+}
 function getDatabasePath(explicitPath) {
   if (explicitPath)
     return resolve(explicitPath);
@@ -30,6 +34,51 @@ function getDatabasePath(explicitPath) {
     return resolve(process.env.SHORTLINKS_DB);
   return join(ensureDataDir(), `${SERVICE_NAME}.db`);
 }
+function readClickSaltFile(path) {
+  try {
+    const saved = readFileSync(path, "utf-8").trim();
+    return saved || null;
+  } catch {
+    return null;
+  }
+}
+function clickSaltError(path, error) {
+  const detail = error instanceof Error ? error.message : String(error);
+  return new Error(`Could not initialize click salt at ${path}. Set SHORTLINKS_CLICK_SALT or fix data directory permissions. ${detail}`);
+}
+function getClickSalt() {
+  const explicit = process.env.SHORTLINKS_CLICK_SALT?.trim();
+  if (explicit)
+    return explicit;
+  const path = getClickSaltPath();
+  const saved = readClickSaltFile(path);
+  if (saved)
+    return saved;
+  const generated = randomBytes(32).toString("hex");
+  const tempPath = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tempPath, `${generated}
+`, { flag: "wx", mode: 384 });
+    try {
+      linkSync(tempPath, path);
+      return generated;
+    } catch (error) {
+      const winner = readClickSaltFile(path);
+      if (winner)
+        return winner;
+      throw clickSaltError(path, error);
+    } finally {
+      try {
+        unlinkSync(tempPath);
+      } catch {}
+    }
+  } catch (error) {
+    const winner = readClickSaltFile(path);
+    if (winner)
+      return winner;
+    throw clickSaltError(path, error);
+  }
+}
 function loadConfig() {
   const path = getConfigPath();
   if (!existsSync(path))
@@ -71,7 +120,9 @@ function normalizeHostname(input) {
     throw new Error(`Invalid domain: ${input}`);
   }
   hostname = hostname.replace(/\.$/, "");
-  if (!/^[a-z0-9.-]+$/.test(hostname) || hostname.includes("..")) {
+  const labels = hostname.split(".");
+  const labelsAreValid = labels.every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9-]+$/.test(label) && !label.startsWith("-") && !label.endsWith("-"));
+  if (hostname.length > 253 || !labelsAreValid) {
     throw new Error(`Invalid domain: ${input}`);
   }
   return hostname;
@@ -201,13 +252,13 @@ import { hostname } from "os";
 import { join as join2 } from "path";
 
 // src/slug.ts
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 var SLUG_ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
 var DEFAULT_SLUG_LENGTH = 7;
 function randomToken(length = DEFAULT_SLUG_LENGTH) {
   if (length < 1 || length > 128)
     throw new Error("Token length must be between 1 and 128.");
-  const bytes = randomBytes(length);
+  const bytes = randomBytes2(length);
   let out = "";
   for (let i = 0;i < length; i += 1) {
     out += SLUG_ALPHABET[bytes[i] % SLUG_ALPHABET.length];
@@ -527,8 +578,7 @@ class ShortlinksStore {
     throw new Error("Could not generate an unused slug after 32 attempts.");
   }
   hashIp(ip) {
-    const salt = process.env.SHORTLINKS_CLICK_SALT || "shortlinks-local";
-    return createHash("sha256").update(`${salt}:${ip}`).digest("hex");
+    return createHash("sha256").update(`${getClickSalt()}:${ip}`).digest("hex");
   }
 }
 // src/pg-store.ts
@@ -835,8 +885,7 @@ class PgShortlinksStore {
     };
   }
   hashIp(ip) {
-    const salt = process.env.SHORTLINKS_CLICK_SALT || "shortlinks-cloud";
-    return createHash2("sha256").update(`${salt}:${ip}`).digest("hex");
+    return createHash2("sha256").update(`${getClickSalt()}:${ip}`).digest("hex");
   }
   async generateAvailableSlug(domainId, length) {
     for (let attempt = 0;attempt < 32; attempt += 1) {

package/dist/server.js

@@ -8,7 +8,8 @@ import { mkdirSync as mkdirSync2 } from "fs";
 import { dirname as dirname2 } from "path";
 
 // src/config.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { existsSync, linkSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";
+import { randomBytes } from "crypto";
 import { homedir } from "os";
 import { dirname, join, resolve } from "path";
 var SERVICE_NAME = "shortlinks";
@@ -24,6 +25,9 @@ function ensureDataDir() {
 function getConfigPath() {
   return join(ensureDataDir(), "config.json");
 }
+function getClickSaltPath() {
+  return join(ensureDataDir(), "click-salt");
+}
 function getDatabasePath(explicitPath) {
   if (explicitPath)
     return resolve(explicitPath);
@@ -31,6 +35,51 @@ function getDatabasePath(explicitPath) {
     return resolve(process.env.SHORTLINKS_DB);
   return join(ensureDataDir(), `${SERVICE_NAME}.db`);
 }
+function readClickSaltFile(path) {
+  try {
+    const saved = readFileSync(path, "utf-8").trim();
+    return saved || null;
+  } catch {
+    return null;
+  }
+}
+function clickSaltError(path, error) {
+  const detail = error instanceof Error ? error.message : String(error);
+  return new Error(`Could not initialize click salt at ${path}. Set SHORTLINKS_CLICK_SALT or fix data directory permissions. ${detail}`);
+}
+function getClickSalt() {
+  const explicit = process.env.SHORTLINKS_CLICK_SALT?.trim();
+  if (explicit)
+    return explicit;
+  const path = getClickSaltPath();
+  const saved = readClickSaltFile(path);
+  if (saved)
+    return saved;
+  const generated = randomBytes(32).toString("hex");
+  const tempPath = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tempPath, `${generated}
+`, { flag: "wx", mode: 384 });
+    try {
+      linkSync(tempPath, path);
+      return generated;
+    } catch (error) {
+      const winner = readClickSaltFile(path);
+      if (winner)
+        return winner;
+      throw clickSaltError(path, error);
+    } finally {
+      try {
+        unlinkSync(tempPath);
+      } catch {}
+    }
+  } catch (error) {
+    const winner = readClickSaltFile(path);
+    if (winner)
+      return winner;
+    throw clickSaltError(path, error);
+  }
+}
 function loadConfig() {
   const path = getConfigPath();
   if (!existsSync(path))
@@ -72,7 +121,9 @@ function normalizeHostname(input) {
     throw new Error(`Invalid domain: ${input}`);
   }
   hostname = hostname.replace(/\.$/, "");
-  if (!/^[a-z0-9.-]+$/.test(hostname) || hostname.includes("..")) {
+  const labels = hostname.split(".");
+  const labelsAreValid = labels.every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9-]+$/.test(label) && !label.startsWith("-") && !label.endsWith("-"));
+  if (hostname.length > 253 || !labelsAreValid) {
     throw new Error(`Invalid domain: ${input}`);
   }
   return hostname;
@@ -200,13 +251,13 @@ import { hostname } from "os";
 import { join as join2 } from "path";
 
 // src/slug.ts
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 var SLUG_ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
 var DEFAULT_SLUG_LENGTH = 7;
 function randomToken(length = DEFAULT_SLUG_LENGTH) {
   if (length < 1 || length > 128)
     throw new Error("Token length must be between 1 and 128.");
-  const bytes = randomBytes(length);
+  const bytes = randomBytes2(length);
   let out = "";
   for (let i = 0;i < length; i += 1) {
     out += SLUG_ALPHABET[bytes[i] % SLUG_ALPHABET.length];
@@ -526,8 +577,7 @@ class ShortlinksStore {
     throw new Error("Could not generate an unused slug after 32 attempts.");
   }
   hashIp(ip) {
-    const salt = process.env.SHORTLINKS_CLICK_SALT || "shortlinks-local";
-    return createHash("sha256").update(`${salt}:${ip}`).digest("hex");
+    return createHash("sha256").update(`${getClickSalt()}:${ip}`).digest("hex");
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/shortlinks",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "CLI-only shortlink manager for custom domains, click tracking, Cloudflare setup, and @hasna cloud sync",
   "type": "module",
   "main": "dist/index.js",