@aquex/cmos-mcp 1.0.0

package/dist/intelligence/worker-manifest-loader.js

@@ -0,0 +1,387 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.__test__ = exports.WorkerManifestLoader = void 0;
+const fs_1 = require("fs");
+const path = __importStar(require("path"));
+const yaml_loader_1 = require("../loaders/yaml-loader");
+const io_error_1 = require("../errors/io-error");
+const errors_1 = require("../types/errors");
+const DEFAULT_MANIFEST_PATH = 'cmos/workers/manifest.yaml';
+const DEFAULT_ALLOWED_PATTERNS = ['rsip', 'delegation', 'boomerang'];
+const MANIFEST_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/;
+const DEFAULT_MAX_WORKERS = 32;
+function isRecord(value) {
+    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+function toStringArray(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value
+        .filter((entry) => typeof entry === 'string')
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+}
+class WorkerManifestLoader {
+    constructor(options = {}) {
+        this.manifestPath = options.manifestPath ?? DEFAULT_MANIFEST_PATH;
+        this.allowedPatterns = options.allowedPatterns ?? DEFAULT_ALLOWED_PATTERNS;
+        this.maxWorkers = Math.max(1, options.maxWorkers ?? DEFAULT_MAX_WORKERS);
+    }
+    async load(projectRoot) {
+        const loader = new yaml_loader_1.SecureYAMLLoader({ baseDir: projectRoot });
+        let absoluteManifestPath;
+        const validations = [];
+        try {
+            absoluteManifestPath = loader.sanitizePath(this.manifestPath);
+        }
+        catch (error) {
+            if (error instanceof errors_1.PathTraversalError) {
+                return {
+                    manifestPath: this.manifestPath,
+                    relativePath: this.manifestPath,
+                    loaded: false,
+                    validations: [
+                        {
+                            level: 'error',
+                            code: 'WORKER_MANIFEST_PATH_INVALID',
+                            message: `Manifest path escapes project root: ${this.manifestPath}`,
+                        },
+                    ],
+                    loadedAt: new Date().toISOString(),
+                };
+            }
+            throw error;
+        }
+        let rawManifest;
+        try {
+            rawManifest = await loader.load(this.manifestPath);
+        }
+        catch (error) {
+            const loadError = error;
+            if (loadError instanceof io_error_1.IOError && loadError.code === 'IO_NOT_FOUND') {
+                return {
+                    manifestPath: absoluteManifestPath,
+                    relativePath: path.relative(projectRoot, absoluteManifestPath) || this.manifestPath,
+                    loaded: false,
+                    validations: [
+                        {
+                            level: 'error',
+                            code: 'WORKER_MANIFEST_NOT_FOUND',
+                            message: `Worker manifest not found at ${absoluteManifestPath}`,
+                        },
+                    ],
+                    loadedAt: new Date().toISOString(),
+                };
+            }
+            if (loadError instanceof errors_1.PathTraversalError ||
+                loadError instanceof errors_1.UnsafeYAMLError ||
+                loadError instanceof errors_1.SchemaValidationError) {
+                return {
+                    manifestPath: absoluteManifestPath,
+                    relativePath: path.relative(projectRoot, absoluteManifestPath) || this.manifestPath,
+                    loaded: false,
+                    validations: [
+                        {
+                            level: 'error',
+                            code: 'WORKER_MANIFEST_LOAD_FAILED',
+                            message: loadError.message,
+                        },
+                    ],
+                    loadedAt: new Date().toISOString(),
+                };
+            }
+            return {
+                manifestPath: absoluteManifestPath,
+                relativePath: path.relative(projectRoot, absoluteManifestPath) || this.manifestPath,
+                loaded: false,
+                validations: [
+                    {
+                        level: 'error',
+                        code: 'WORKER_MANIFEST_LOAD_FAILED',
+                        message: loadError.message,
+                    },
+                ],
+                loadedAt: new Date().toISOString(),
+            };
+        }
+        const { manifest, manifestValidations } = this.normalizeManifest(rawManifest);
+        validations.push(...manifestValidations);
+        if (manifest && manifest.workers.length > this.maxWorkers) {
+            validations.push({
+                level: 'warning',
+                code: 'WORKER_MANIFEST_MAX_WORKERS_EXCEEDED',
+                message: `Manifest defines ${manifest.workers.length} workers (recommended <= ${this.maxWorkers}).`,
+            });
+        }
+        const loaded = manifest !== null && !validations.some((entry) => entry.level === 'error');
+        const sizeBytes = await this.safeStatSize(absoluteManifestPath);
+        return {
+            manifestPath: absoluteManifestPath,
+            relativePath: path.relative(projectRoot, absoluteManifestPath) || this.manifestPath,
+            loaded,
+            manifest: loaded ? (manifest ?? undefined) : undefined,
+            validations,
+            sizeBytes: sizeBytes ?? undefined,
+            loadedAt: new Date().toISOString(),
+        };
+    }
+    normalizeManifest(raw) {
+        const validations = [];
+        if (!isRecord(raw)) {
+            return {
+                manifest: null,
+                manifestValidations: [
+                    {
+                        level: 'error',
+                        code: 'WORKER_MANIFEST_INVALID_FORMAT',
+                        message: 'Worker manifest must be an object.',
+                    },
+                ],
+            };
+        }
+        const manifestVersion = typeof raw.manifest_version === 'string' ? raw.manifest_version : '';
+        if (!MANIFEST_VERSION_PATTERN.test(manifestVersion)) {
+            validations.push({
+                level: 'error',
+                code: 'WORKER_MANIFEST_VERSION_INVALID',
+                message: 'manifest_version must be a SemVer string.',
+            });
+        }
+        const patternSupportRaw = isRecord(raw.pattern_support) ? raw.pattern_support : {};
+        const mutuallyExclusive = Boolean(patternSupportRaw.mutually_exclusive);
+        const allowedPatterns = toStringArray(patternSupportRaw.allowed_patterns);
+        const fallbackPatternRaw = typeof patternSupportRaw.fallback_pattern === 'string'
+            ? patternSupportRaw.fallback_pattern.trim()
+            : undefined;
+        if (allowedPatterns.length === 0) {
+            validations.push({
+                level: 'error',
+                code: 'WORKER_MANIFEST_PATTERNS_EMPTY',
+                message: 'pattern_support.allowed_patterns must include at least one pattern.',
+            });
+        }
+        const unsupportedPatterns = allowedPatterns.filter((pattern) => !this.allowedPatterns.includes(pattern));
+        for (const pattern of unsupportedPatterns) {
+            validations.push({
+                level: 'warning',
+                code: 'WORKER_MANIFEST_PATTERN_UNRECOGNIZED',
+                message: `Pattern "${pattern}" is not recognized by this runtime.`,
+            });
+        }
+        const patternSupport = {
+            mutuallyExclusive,
+            allowedPatterns,
+            fallbackPattern: fallbackPatternRaw && fallbackPatternRaw.length > 0 ? fallbackPatternRaw : undefined,
+        };
+        const workerEntries = Array.isArray(raw.workers) ? raw.workers : [];
+        if (workerEntries.length === 0) {
+            validations.push({
+                level: 'error',
+                code: 'WORKER_MANIFEST_NO_WORKERS',
+                message: 'Worker manifest must define at least one worker.',
+            });
+        }
+        const workers = [];
+        const seenWorkerIds = new Set();
+        for (const entry of workerEntries) {
+            if (!isRecord(entry)) {
+                validations.push({
+                    level: 'error',
+                    code: 'WORKER_ENTRY_INVALID',
+                    message: 'Worker entry must be an object.',
+                });
+                continue;
+            }
+            const rawWorkerId = typeof entry.workerId === 'string' ? entry.workerId : '';
+            const workerId = rawWorkerId.trim();
+            const workerLabel = workerId.length > 0 ? workerId : '(unknown)';
+            let entryHasError = false;
+            if (workerId.length === 0) {
+                validations.push({
+                    level: 'error',
+                    code: 'WORKER_ID_MISSING',
+                    message: 'Worker entry missing workerId.',
+                });
+                entryHasError = true;
+            }
+            else if (seenWorkerIds.has(workerId)) {
+                validations.push({
+                    level: 'error',
+                    code: 'WORKER_ID_DUPLICATE',
+                    message: `Duplicate workerId "${workerId}" detected.`,
+                    workerId,
+                });
+                entryHasError = true;
+            }
+            else {
+                seenWorkerIds.add(workerId);
+            }
+            const name = typeof entry.name === 'string' && entry.name.trim().length > 0 ? entry.name.trim() : '';
+            if (name.length === 0) {
+                validations.push({
+                    level: 'error',
+                    code: 'WORKER_NAME_MISSING',
+                    message: `Worker "${workerLabel}" missing name.`,
+                    workerId: workerId.length > 0 ? workerId : undefined,
+                });
+                entryHasError = true;
+            }
+            const description = typeof entry.description === 'string' && entry.description.trim().length > 0
+                ? entry.description.trim()
+                : undefined;
+            const templatePath = typeof entry.template_path === 'string' ? entry.template_path.trim() : '';
+            if (!templatePath || templatePath.includes('..') || path.isAbsolute(templatePath)) {
+                validations.push({
+                    level: 'error',
+                    code: 'WORKER_TEMPLATE_PATH_INVALID',
+                    message: `Worker "${workerLabel}" has invalid template_path "${entry.template_path}".`,
+                    workerId: workerId.length > 0 ? workerId : undefined,
+                });
+                entryHasError = true;
+            }
+            else if (!templatePath.startsWith('cmos/workers/')) {
+                validations.push({
+                    level: 'warning',
+                    code: 'WORKER_TEMPLATE_PATH_NONSTANDARD',
+                    message: `Worker "${workerLabel}" template_path should reside under cmos/workers/.`,
+                    workerId: workerId.length > 0 ? workerId : undefined,
+                });
+            }
+            const capabilities = toStringArray(entry.capabilities);
+            if (capabilities.length === 0) {
+                validations.push({
+                    level: 'warning',
+                    code: 'WORKER_CAPABILITIES_EMPTY',
+                    message: `Worker "${workerLabel}" defines no capabilities.`,
+                    workerId: workerId.length > 0 ? workerId : undefined,
+                });
+            }
+            const patternsRaw = isRecord(entry.patterns) ? entry.patterns : {};
+            const supports = toStringArray(patternsRaw.supports);
+            const unsupportedWorkerPatterns = supports.filter((pattern) => !allowedPatterns.includes(pattern));
+            for (const pattern of unsupportedWorkerPatterns) {
+                validations.push({
+                    level: 'error',
+                    code: 'WORKER_PATTERN_UNSUPPORTED',
+                    message: `Worker "${workerLabel}" references unsupported pattern "${pattern}".`,
+                    workerId: workerId.length > 0 ? workerId : undefined,
+                });
+                entryHasError = true;
+            }
+            const constraintsRaw = isRecord(entry.constraints) ? entry.constraints : {};
+            const maxConcurrent = typeof constraintsRaw.max_concurrent === 'number' &&
+                Number.isFinite(constraintsRaw.max_concurrent)
+                ? Math.floor(constraintsRaw.max_concurrent)
+                : NaN;
+            if (!Number.isFinite(maxConcurrent) || maxConcurrent < 1) {
+                validations.push({
+                    level: 'error',
+                    code: 'WORKER_MAX_CONCURRENT_INVALID',
+                    message: `Worker "${workerLabel}" must specify constraints.max_concurrent >= 1.`,
+                    workerId: workerId.length > 0 ? workerId : undefined,
+                });
+                entryHasError = true;
+            }
+            const requiredTools = toStringArray(constraintsRaw.required_tools);
+            const timeoutSeconds = typeof constraintsRaw.timeout_seconds === 'number' &&
+                Number.isFinite(constraintsRaw.timeout_seconds) &&
+                constraintsRaw.timeout_seconds > 0
+                ? Math.floor(constraintsRaw.timeout_seconds)
+                : undefined;
+            const tokenBudget = typeof constraintsRaw.token_budget === 'number' &&
+                Number.isFinite(constraintsRaw.token_budget) &&
+                constraintsRaw.token_budget > 0
+                ? Math.floor(constraintsRaw.token_budget)
+                : undefined;
+            const telemetryRaw = isRecord(entry.telemetry) ? entry.telemetry : undefined;
+            const telemetryEmits = telemetryRaw ? toStringArray(telemetryRaw.emits) : [];
+            if (telemetryRaw && telemetryEmits.length === 0) {
+                validations.push({
+                    level: 'warning',
+                    code: 'WORKER_TELEMETRY_EMPTY',
+                    message: `Worker "${workerLabel}" defines telemetry but no events.`,
+                    workerId: workerId.length > 0 ? workerId : undefined,
+                });
+            }
+            if (!entryHasError && workerId.length > 0) {
+                workers.push({
+                    workerId,
+                    name,
+                    description,
+                    templatePath,
+                    capabilities,
+                    patterns: {
+                        supports,
+                    },
+                    constraints: {
+                        requiredTools,
+                        maxConcurrent: Number.isFinite(maxConcurrent) ? maxConcurrent : 1,
+                        timeoutSeconds,
+                        tokenBudget,
+                    },
+                    telemetry: telemetryEmits.length > 0 ? { emits: telemetryEmits } : undefined,
+                });
+            }
+        }
+        return {
+            manifest: validations.some((entry) => entry.level === 'error') ||
+                !MANIFEST_VERSION_PATTERN.test(manifestVersion)
+                ? null
+                : {
+                    version: manifestVersion,
+                    patternSupport,
+                    workers,
+                },
+            manifestValidations: validations,
+        };
+    }
+    async safeStatSize(absolutePath) {
+        try {
+            const stats = await fs_1.promises.stat(absolutePath);
+            return stats.size;
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+exports.WorkerManifestLoader = WorkerManifestLoader;
+exports.__test__ = {
+    toStringArray,
+    isRecord,
+};
+//# sourceMappingURL=worker-manifest-loader.js.map

package/dist/intelligence/worker-manifest-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-manifest-loader.js","sourceRoot":"","sources":["../../src/intelligence/worker-manifest-loader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2BAAoC;AACpC,2CAA6B;AAE7B,wDAA0D;AAC1D,iDAA6C;AAC7C,4CAA6F;AAiE7F,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAC3D,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAC9E,MAAM,wBAAwB,GAAG,iCAAiC,CAAC;AACnE,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,MAAa,oBAAoB;IAK/B,YAAY,UAAuC,EAAE;QACnD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;QAClE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,wBAAwB,CAAC;QAC3E,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC5B,MAAM,MAAM,GAAG,IAAI,8BAAgB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9D,IAAI,oBAA4B,CAAC;QACjC,MAAM,WAAW,GAA+B,EAAE,CAAC;QAEnD,IAAI,CAAC;YACH,oBAAoB,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,2BAAkB,EAAE,CAAC;gBACxC,OAAO;oBACL,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,MAAM,EAAE,KAAK;oBACb,WAAW,EAAE;wBACX;4BACE,KAAK,EAAE,OAAO;4BACd,IAAI,EAAE,8BAA8B;4BACpC,OAAO,EAAE,uCAAuC,IAAI,CAAC,YAAY,EAAE;yBACpE;qBACF;oBACD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACnC,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,WAAoB,CAAC;QACzB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,CAAU,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,KAAc,CAAC;YACjC,IAAI,SAAS,YAAY,kBAAO,IAAI,SAAS,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACtE,OAAO;oBACL,YAAY,EAAE,oBAAoB;oBAClC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC,IAAI,IAAI,CAAC,YAAY;oBACnF,MAAM,EAAE,KAAK;oBACb,WAAW,EAAE;wBACX;4BACE,KAAK,EAAE,OAAO;4BACd,IAAI,EAAE,2BAA2B;4BACjC,OAAO,EAAE,gCAAgC,oBAAoB,EAAE;yBAChE;qBACF;oBACD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACnC,CAAC;YACJ,CAAC;YAED,IACE,SAAS,YAAY,2BAAkB;gBACvC,SAAS,YAAY,wBAAe;gBACpC,SAAS,YAAY,8BAAqB,EAC1C,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,oBAAoB;oBAClC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC,IAAI,IAAI,CAAC,YAAY;oBACnF,MAAM,EAAE,KAAK;oBACb,WAAW,EAAE;wBACX;4BACE,KAAK,EAAE,OAAO;4BACd,IAAI,EAAE,6BAA6B;4BACnC,OAAO,EAAE,SAAS,CAAC,OAAO;yBAC3B;qBACF;oBACD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACnC,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,YAAY,EAAE,oBAAoB;gBAClC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC,IAAI,IAAI,CAAC,YAAY;gBACnF,MAAM,EAAE,KAAK;gBACb,WAAW,EAAE;oBACX;wBACE,KAAK,EAAE,OAAO;wBACd,IAAI,EAAE,6BAA6B;wBACnC,OAAO,EAAE,SAAS,CAAC,OAAO;qBAC3B;iBACF;gBACD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC9E,WAAW,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC;QAEzC,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1D,WAAW,CAAC,IAAI,CAAC;gBACf,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,sCAAsC;gBAC5C,OAAO,EAAE,oBAAoB,QAAQ,CAAC,OAAO,CAAC,MAAM,4BAA4B,IAAI,CAAC,UAAU,IAAI;aACpG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;QAC1F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC;QAEhE,OAAO;YACL,YAAY,EAAE,oBAAoB;YAClC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC,IAAI,IAAI,CAAC,YAAY;YACnF,MAAM;YACN,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;YACtD,WAAW;YACX,SAAS,EAAE,SAAS,IAAI,SAAS;YACjC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACnC,CAAC;IACJ,CAAC;IAEO,iBAAiB,CAAC,GAAY;QAIpC,MAAM,WAAW,GAA+B,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,mBAAmB,EAAE;oBACnB;wBACE,KAAK,EAAE,OAAO;wBACd,IAAI,EAAE,gCAAgC;wBACtC,OAAO,EAAE,oCAAoC;qBAC9C;iBACF;aACF,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACpD,WAAW,CAAC,IAAI,CAAC;gBACf,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,iCAAiC;gBACvC,OAAO,EAAE,2CAA2C;aACrD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,iBAAiB,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QACxE,MAAM,eAAe,GAAG,aAAa,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAC1E,MAAM,kBAAkB,GACtB,OAAO,iBAAiB,CAAC,gBAAgB,KAAK,QAAQ;YACpD,CAAC,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,IAAI,EAAE;YAC3C,CAAC,CAAC,SAAS,CAAC;QAEhB,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,WAAW,CAAC,IAAI,CAAC;gBACf,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EAAE,qEAAqE;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,mBAAmB,GAAG,eAAe,CAAC,MAAM,CAChD,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CACrD,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;YAC1C,WAAW,CAAC,IAAI,CAAC;gBACf,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,sCAAsC;gBAC5C,OAAO,EAAE,YAAY,OAAO,sCAAsC;aACnE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAyB;YAC3C,iBAAiB;YACjB,eAAe;YACf,eAAe,EACb,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;SACvF,CAAC;QAEF,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,WAAW,CAAC,IAAI,CAAC;gBACf,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,kDAAkD;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QAExC,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,WAAW,CAAC,IAAI,CAAC;oBACf,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,iCAAiC;iBAC3C,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;YACjE,IAAI,aAAa,GAAG,KAAK,CAAC;YAE1B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,WAAW,CAAC,IAAI,CAAC;oBACf,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,gCAAgC;iBAC1C,CAAC,CAAC;gBACH,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;iBAAM,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,WAAW,CAAC,IAAI,CAAC;oBACf,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,uBAAuB,QAAQ,aAAa;oBACrD,QAAQ;iBACT,CAAC,CAAC;gBACH,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;YAED,MAAM,IAAI,GACR,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,WAAW,CAAC,IAAI,CAAC;oBACf,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,WAAW,WAAW,iBAAiB;oBAChD,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;iBACrD,CAAC,CAAC;gBACH,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;YAED,MAAM,WAAW,GACf,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBAC1E,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE;gBAC1B,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,YAAY,GAChB,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClF,WAAW,CAAC,IAAI,CAAC;oBACf,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,8BAA8B;oBACpC,OAAO,EAAE,WAAW,WAAW,gCAAgC,KAAK,CAAC,aAAa,IAAI;oBACtF,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;iBACrD,CAAC,CAAC;gBACH,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;iBAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACrD,WAAW,CAAC,IAAI,CAAC;oBACf,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,kCAAkC;oBACxC,OAAO,EAAE,WAAW,WAAW,oDAAoD;oBACnF,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACvD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,WAAW,CAAC,IAAI,CAAC;oBACf,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EAAE,WAAW,WAAW,4BAA4B;oBAC3D,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAErD,MAAM,yBAAyB,GAAG,QAAQ,CAAC,MAAM,CAC/C,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAChD,CAAC;YACF,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;gBAChD,WAAW,CAAC,IAAI,CAAC;oBACf,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,WAAW,WAAW,qCAAqC,OAAO,IAAI;oBAC/E,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;iBACrD,CAAC,CAAC;gBACH,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;YAED,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,MAAM,aAAa,GACjB,OAAO,cAAc,CAAC,cAAc,KAAK,QAAQ;gBACjD,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,cAAc,CAAC;gBAC5C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,cAAc,CAAC;gBAC3C,CAAC,CAAC,GAAG,CAAC;YACV,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;gBACzD,WAAW,CAAC,IAAI,CAAC;oBACf,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,+BAA+B;oBACrC,OAAO,EAAE,WAAW,WAAW,iDAAiD;oBAChF,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;iBACrD,CAAC,CAAC;gBACH,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;YAED,MAAM,aAAa,GAAG,aAAa,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YACnE,MAAM,cAAc,GAClB,OAAO,cAAc,CAAC,eAAe,KAAK,QAAQ;gBAClD,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,eAAe,CAAC;gBAC/C,cAAc,CAAC,eAAe,GAAG,CAAC;gBAChC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,eAAe,CAAC;gBAC5C,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,WAAW,GACf,OAAO,cAAc,CAAC,YAAY,KAAK,QAAQ;gBAC/C,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC;gBAC5C,cAAc,CAAC,YAAY,GAAG,CAAC;gBAC7B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC;gBACzC,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,MAAM,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,IAAI,YAAY,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,WAAW,CAAC,IAAI,CAAC;oBACf,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,WAAW,WAAW,oCAAoC;oBACnE,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ;oBACR,IAAI;oBACJ,WAAW;oBACX,YAAY;oBACZ,YAAY;oBACZ,QAAQ,EAAE;wBACR,QAAQ;qBACT;oBACD,WAAW,EAAE;wBACX,aAAa;wBACb,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;wBACjE,cAAc;wBACd,WAAW;qBACZ;oBACD,SAAS,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS;iBAC7E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EACN,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC;gBACpD,CAAC,wBAAwB,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC7C,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC;oBACE,OAAO,EAAE,eAAe;oBACxB,cAAc;oBACd,OAAO;iBACR;YACP,mBAAmB,EAAE,WAAW;SACjC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,YAAoB;QAC7C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,aAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AAnXD,oDAmXC;AAEY,QAAA,QAAQ,GAAG;IACtB,aAAa;IACb,QAAQ;CACT,CAAC"}

package/dist/loaders/yaml-loader.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Secure YAML Loader with Three-Layer Defense
+ *
+ * Layer 1: Path Sanitization - Prevents directory traversal attacks
+ * Layer 2: Safe Parsing - Prevents code execution via YAML tags
+ * Layer 3: Schema Validation - Ensures structural integrity
+ *
+ * @module loaders/yaml-loader
+ */
+import { JSONSchema } from '../types/schemas';
+export interface SecureYAMLLoaderOptions {
+    /**
+     * Base directory for all file operations
+     * All loaded files must be within this directory
+     */
+    baseDir: string;
+    /**
+     * Whether to follow symbolic links (default: false)
+     */
+    followSymlinks?: boolean;
+    /**
+     * Maximum file size in bytes (default: 10MB)
+     */
+    maxFileSize?: number;
+}
+/**
+ * SecureYAMLLoader provides defense-in-depth for loading YAML files
+ */
+export declare class SecureYAMLLoader {
+    private readonly baseDir;
+    private readonly followSymlinks;
+    private readonly maxFileSize;
+    private ajv?;
+    private readonly schemaValidatorCache;
+    constructor(options: SecureYAMLLoaderOptions);
+    /**
+     * Layer 1: Path Sanitization
+     * Prevents directory traversal attacks by ensuring the resolved path
+     * is within the base directory
+     *
+     * @param filePath - Relative or absolute file path
+     * @returns Sanitized absolute path
+     * @throws PathTraversalError if path escapes base directory
+     */
+    sanitizePath(filePath: string): string;
+    /**
+     * Layer 2: Safe YAML Parsing
+     * Uses YAML.parse which is safe by default (no custom tags)
+     * Prevents code execution via malicious YAML constructs
+     *
+     * @param content - YAML string content
+     * @returns Parsed object
+     * @throws UnsafeYAMLError if parsing fails or detects unsafe content
+     */
+    private safeParse;
+    /**
+     * Recursively check for function objects in parsed data
+     * This prevents any executable code from being loaded
+     */
+    private validateNoFunctions;
+    /**
+     * Layer 3: Schema Validation
+     * Validates parsed data against a JSON Schema
+     *
+     * @param data - Parsed data to validate
+     * @param schema - JSON Schema for validation
+     * @returns Validated and typed data
+     * @throws SchemaValidationError if validation fails
+     */
+    validateSchema<T>(data: unknown, schema: JSONSchema): T;
+    /**
+     * Load and parse a YAML file with all security layers
+     *
+     * @param filePath - Path to YAML file (relative to baseDir)
+     * @param schema - Optional JSON Schema for validation
+     * @returns Parsed and validated data
+     * @throws PathTraversalError, UnsafeYAMLError, SchemaValidationError
+     */
+    load<T = unknown>(filePath: string, schema?: JSONSchema): Promise<T>;
+    /**
+     * Retrieve (or compile) a validator for the supplied schema.
+     * WeakMap cache ensures we only compile static schemas once.
+     */
+    private getAjv;
+    private getValidator;
+    /**
+     * Load multiple YAML files
+     *
+     * @param filePaths - Array of file paths
+     * @param schema - Optional schema to validate each file
+     * @returns Array of parsed data
+     */
+    loadMultiple<T = unknown>(filePaths: string[], schema?: JSONSchema): Promise<T[]>;
+    /**
+     * Get the base directory
+     */
+    getBaseDir(): string;
+}
+//# sourceMappingURL=yaml-loader.d.ts.map

package/dist/loaders/yaml-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml-loader.d.ts","sourceRoot":"","sources":["../../src/loaders/yaml-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,GAAG,CAAC,CAAM;IAClB,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAwC;gBAEjE,OAAO,EAAE,uBAAuB;IAU5C;;;;;;;;OAQG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAqBtC;;;;;;;;OAQG;IACH,OAAO,CAAC,SAAS;IAkBjB;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;;;;;;;OAQG;IACH,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,CAAC;IAYvD;;;;;;;OAOG;IACG,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC;IAiD1E;;;OAGG;IACH,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,YAAY;IAYpB;;;;;;OAMG;IACG,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAIvF;;OAEG;IACH,UAAU,IAAI,MAAM;CAGrB"}