@lessonkit/lxpack 0.9.1 → 0.9.2

package/dist/index.cjs

@@ -63,7 +63,7 @@ function isSafeRelativeSpaPath(spaPath) {
   if (spaPath.startsWith("/") || spaPath.startsWith("\\")) return false;
   if (/^[a-zA-Z]:[/\\]/.test(spaPath)) return false;
   const segments = spaPath.split(/[/\\]/).filter((s) => s.length > 0);
-  if (segments.some((s) => s === ".." || s === ".")) return false;
+  if (segments.some((s) => s === "..")) return false;
   return true;
 }
 function assertResolvedPathUnderRoot(root, target) {
@@ -447,6 +447,9 @@ async function writeLxpackProject(options) {
   }
   const descriptor = validation.descriptor;
   const outDir = (0, import_node_path4.resolve)(options.outDir);
+  if (options.projectRoot) {
+    assertResolvedPathUnderRoot((0, import_node_path4.resolve)(options.projectRoot), outDir);
+  }
   const spaDirs = await resolveSpaDirs({ ...options, descriptor });
   const interchange = descriptorToInterchange(descriptor);
   const materialized = await (0, import_validators.materializeLessonkitProject)({
@@ -509,7 +512,14 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
     await fsp.rename(tmpPromote, outDir);
   } catch (promoteError) {
     if (hadOutDir) {
-      await fsp.rename(backup, outDir).catch(() => void 0);
+      try {
+        await fsp.rename(backup, outDir);
+      } catch (restoreError) {
+        console.warn(
+          `[lessonkit/lxpack] failed to restore ${outDir} after promote error:`,
+          restoreError instanceof Error ? restoreError.message : restoreError
+        );
+      }
     }
     await fsp.rm(tmpPromote, { recursive: true, force: true }).catch(() => void 0);
     throw promoteError;
@@ -521,6 +531,36 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
 async function packageLessonkitCourse(options) {
   const { target, output, dir, outputBaseDir, ...writeOpts } = options;
   const outDir = (0, import_node_path5.resolve)(writeOpts.outDir);
+  const projectRoot = writeOpts.projectRoot ? (0, import_node_path5.resolve)(writeOpts.projectRoot) : void 0;
+  if (projectRoot) {
+    assertResolvedPathUnderRoot(projectRoot, outDir);
+  }
+  if (outputBaseDir && !isSafeRelativeSpaPath(outputBaseDir)) {
+    return {
+      ok: false,
+      courseDir: outDir,
+      target,
+      issues: [{ path: "outputBaseDir", message: `unsafe outputBaseDir: ${outputBaseDir}` }]
+    };
+  }
+  if (projectRoot && output) {
+    const resolvedOutput = (0, import_node_path5.resolve)(projectRoot, output);
+    try {
+      assertResolvedPathUnderRoot(projectRoot, resolvedOutput);
+    } catch (err) {
+      return {
+        ok: false,
+        courseDir: outDir,
+        target,
+        issues: [
+          {
+            path: "output",
+            message: err instanceof Error ? err.message : String(err)
+          }
+        ]
+      };
+    }
+  }
   const descriptorValidation = validateDescriptor(writeOpts.descriptor);
   if (!descriptorValidation.ok) {
     return {

package/dist/index.d.cts

@@ -36,6 +36,10 @@ type LessonkitCourseDescriptor = {
         completion?: {
             threshold?: number;
         };
+        /** Required for xAPI / cmi5 export targets (`activityIri` on the course activity). */
+        xapi?: {
+            activityIri?: string;
+        };
     };
     /** Source Vite `dist` directory for `single-spa` (default: `dist`). */
     spaDistDir?: string;

package/dist/index.d.ts

@@ -36,6 +36,10 @@ type LessonkitCourseDescriptor = {
         completion?: {
             threshold?: number;
         };
+        /** Required for xAPI / cmi5 export targets (`activityIri` on the course activity). */
+        xapi?: {
+            activityIri?: string;
+        };
     };
     /** Source Vite `dist` directory for `single-spa` (default: `dist`). */
     spaDistDir?: string;

package/dist/index.js

@@ -12,7 +12,7 @@ function isSafeRelativeSpaPath(spaPath) {
   if (spaPath.startsWith("/") || spaPath.startsWith("\\")) return false;
   if (/^[a-zA-Z]:[/\\]/.test(spaPath)) return false;
   const segments = spaPath.split(/[/\\]/).filter((s) => s.length > 0);
-  if (segments.some((s) => s === ".." || s === ".")) return false;
+  if (segments.some((s) => s === "..")) return false;
   return true;
 }
 function assertResolvedPathUnderRoot(root, target) {
@@ -396,6 +396,9 @@ async function writeLxpackProject(options) {
   }
   const descriptor = validation.descriptor;
   const outDir = resolve4(options.outDir);
+  if (options.projectRoot) {
+    assertResolvedPathUnderRoot(resolve4(options.projectRoot), outDir);
+  }
   const spaDirs = await resolveSpaDirs({ ...options, descriptor });
   const interchange = descriptorToInterchange(descriptor);
   const materialized = await materializeLessonkitProject({
@@ -462,7 +465,14 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
     await fsp.rename(tmpPromote, outDir);
   } catch (promoteError) {
     if (hadOutDir) {
-      await fsp.rename(backup, outDir).catch(() => void 0);
+      try {
+        await fsp.rename(backup, outDir);
+      } catch (restoreError) {
+        console.warn(
+          `[lessonkit/lxpack] failed to restore ${outDir} after promote error:`,
+          restoreError instanceof Error ? restoreError.message : restoreError
+        );
+      }
     }
     await fsp.rm(tmpPromote, { recursive: true, force: true }).catch(() => void 0);
     throw promoteError;
@@ -474,6 +484,36 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
 async function packageLessonkitCourse(options) {
   const { target, output, dir, outputBaseDir, ...writeOpts } = options;
   const outDir = resolve5(writeOpts.outDir);
+  const projectRoot = writeOpts.projectRoot ? resolve5(writeOpts.projectRoot) : void 0;
+  if (projectRoot) {
+    assertResolvedPathUnderRoot(projectRoot, outDir);
+  }
+  if (outputBaseDir && !isSafeRelativeSpaPath(outputBaseDir)) {
+    return {
+      ok: false,
+      courseDir: outDir,
+      target,
+      issues: [{ path: "outputBaseDir", message: `unsafe outputBaseDir: ${outputBaseDir}` }]
+    };
+  }
+  if (projectRoot && output) {
+    const resolvedOutput = resolve5(projectRoot, output);
+    try {
+      assertResolvedPathUnderRoot(projectRoot, resolvedOutput);
+    } catch (err) {
+      return {
+        ok: false,
+        courseDir: outDir,
+        target,
+        issues: [
+          {
+            path: "output",
+            message: err instanceof Error ? err.message : String(err)
+          }
+        ]
+      };
+    }
+  }
   const descriptorValidation = validateDescriptor(writeOpts.descriptor);
   if (!descriptorValidation.ok) {
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lessonkit/lxpack",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "private": false,
   "description": "LXPack export adapter for LessonKit courses (SCORM, standalone, xAPI, cmi5).",
   "license": "Apache-2.0",
@@ -53,8 +53,8 @@
     "lint": "echo \"(no lint configured yet)\""
   },
   "dependencies": {
-    "@lessonkit/core": "0.9.1",
-    "@lessonkit/themes": "0.9.1",
+    "@lessonkit/core": "0.9.2",
+    "@lessonkit/themes": "0.9.2",
     "@lxpack/api": "^0.6.0",
     "@lxpack/spa-bridge": "^0.6.0",
     "@lxpack/tracking-schema": "^0.6.0",