@christopher_dondici/mcp-gen 2.1.2

package/dist/core/security-lint.js

@@ -0,0 +1,470 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXPECTED_AUTH_CONTEXT_FIELDS = exports.RESERVED_TOOL_NAMES = exports.RAW_CREDENTIAL_KEYWORDS = void 0;
+exports.scanForCredentials = scanForCredentials;
+exports.validateAuthContext = validateAuthContext;
+exports.validateToolPolicies = validateToolPolicies;
+exports.lintNaming = lintNaming;
+exports.lintDescriptions = lintDescriptions;
+exports.lintIncrementalMarkers = lintIncrementalMarkers;
+exports.lintSchemas = lintSchemas;
+exports.scanProject = scanProject;
+exports.formatReport = formatReport;
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+/** Keywords that indicate raw credentials (blocked by default) */
+exports.RAW_CREDENTIAL_KEYWORDS = [
+    "authorization",
+    "token",
+    "access_token",
+    "api_key",
+    "apikey",
+    "x-api-key",
+    "x_api_key",
+    "client_secret",
+    "client_id",
+    "refresh_token",
+    "password",
+    "secret",
+    "bearer",
+    "basic",
+    "jwt",
+    "private_key",
+    "ssh_key",
+];
+/** Reserved words that shouldn't be tool names */
+exports.RESERVED_TOOL_NAMES = [
+    "new", "delete", "class", "function", "var", "let", "const",
+    "if", "else", "for", "while", "switch", "case", "default",
+    "try", "catch", "finally", "throw", "return", "await",
+    "async", "yield", "import", "export", "from", "as",
+    "typeof", "instanceof", "in", "of", "void", "null",
+    "undefined", "true", "false", "this", "super", "extends",
+    "implements", "interface", "type", "enum", "package",
+    "private", "protected", "public", "static", "abstract",
+];
+/** Expected authContext fields */
+exports.EXPECTED_AUTH_CONTEXT_FIELDS = [
+    "tokenId",
+    "principal",
+    "expiresAt",
+    "allowedTools",
+    "endpointAllowlist",
+    "spendLimitUsd",
+    "spendUsedUsd",
+    "revoked",
+    "requestId",
+];
+/** Scan a string for credential-like patterns */
+function scanForCredentials(content, filePath = "unknown") {
+    const rules = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const lowerLine = line.toLowerCase();
+        // Check for credential keywords
+        for (const keyword of exports.RAW_CREDENTIAL_KEYWORDS) {
+            const regex = new RegExp(`\\b${keyword}\\b`, "i");
+            if (regex.test(lowerLine)) {
+                // Skip if it's in a comment about blocking credentials
+                if (lowerLine.includes("block") || lowerLine.includes("deny") ||
+                    lowerLine.includes("not allowed") || lowerLine.includes("forbidden") ||
+                    lowerLine.includes("raw_credential") || lowerLine.includes("rawcredential")) {
+                    continue;
+                }
+                rules.push({
+                    id: `SEC-CRED-${keyword.toUpperCase()}`,
+                    severity: "warning",
+                    category: "credentials",
+                    message: `Potential raw credential keyword "${keyword}" found`,
+                    file: filePath,
+                    line: i + 1,
+                    suggestion: "Use authContext scoped metadata instead of raw credentials",
+                });
+            }
+        }
+        // Check for actual secret patterns (high entropy strings, common prefixes)
+        const secretPatterns = [
+            { pattern: /sk_[a-zA-Z0-9]{20,}/g, type: "sk_" },
+            { pattern: /pk_[a-zA-Z0-9]{20,}/g, type: "pk_" },
+            { pattern: /ghp_[a-zA-Z0-9]{36}/g, type: "github_pat" },
+            { pattern: /gho_[a-zA-Z0-9]{36}/g, type: "github_oauth" },
+            { pattern: /ghu_[a-zA-Z0-9]{36}/g, type: "github_user" },
+            { pattern: /glpat-[a-zA-Z0-9]{20,}/g, type: "gitlab_pat" },
+            { pattern: /xoxb-[a-zA-Z0-9-]{20,}/g, type: "slack_bot" },
+            { pattern: /xoxp-[a-zA-Z0-9-]{20,}/g, type: "slack_user" },
+            { pattern: /ya29\.[a-zA-Z0-9_-]{20,}/g, type: "google_oauth" },
+            { pattern: /eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/g, type: "jwt" },
+            { pattern: /AKIA[0-9A-Z]{16}/g, type: "aws_access_key" },
+            { pattern: /[a-zA-Z0-9/+=]{40}/g, type: "base64_secret" },
+        ];
+        for (const { pattern, type } of secretPatterns) {
+            const matches = line.match(pattern);
+            if (matches) {
+                rules.push({
+                    id: `SEC-SECRET-${type.toUpperCase()}`,
+                    severity: "error",
+                    category: "credentials",
+                    message: `Potential ${type} secret detected`,
+                    file: filePath,
+                    line: i + 1,
+                    suggestion: "Remove secrets from source code; use environment variables or secret manager",
+                });
+            }
+        }
+    }
+    return rules;
+}
+/** Validate authContext structure in generated code */
+function validateAuthContext(content, filePath = "unknown") {
+    const rules = [];
+    const lines = content.split("\n");
+    let hasAuthContextParam = false;
+    let hasAuthContextValidation = false;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Check for auth_context parameter in tool handlers
+        if (line.includes("auth_context") || line.includes("authContext")) {
+            hasAuthContextParam = true;
+        }
+        // Check for require_security or similar validation call
+        if (line.includes("require_security") || line.includes("requireSecurity") ||
+            line.includes("validate_auth") || line.includes("validateAuth")) {
+            hasAuthContextValidation = true;
+        }
+    }
+    if (hasAuthContextParam && !hasAuthContextValidation) {
+        rules.push({
+            id: "SEC-AUTHCTX-NO-VALIDATION",
+            severity: "warning",
+            category: "authcontext",
+            message: "authContext parameter present but no validation call found",
+            file: filePath,
+            suggestion: "Call require_security() or validateAuth() with authContext",
+        });
+    }
+    return rules;
+}
+/** Validate tool policies are defined */
+function validateToolPolicies(content, filePath = "unknown") {
+    const rules = [];
+    const lines = content.split("\n");
+    let hasToolPolicies = false;
+    let hasRawCredentialCheck = false;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (line.includes("TOOL_POLICIES") || line.includes("toolPolicies")) {
+            hasToolPolicies = true;
+        }
+        if (line.includes("RAW_CREDENTIAL_KEYS") || line.includes("rawCredentialKeys")) {
+            hasRawCredentialCheck = true;
+        }
+    }
+    if (!hasToolPolicies) {
+        rules.push({
+            id: "LINT-NO-TOOL-POLICIES",
+            severity: "info",
+            category: "policy",
+            message: "No TOOL_POLICIES defined — consider adding per-tool security policies",
+            file: filePath,
+            suggestion: "Define toolPolicies with requires_ttl, requires_spend_limit, etc.",
+        });
+    }
+    if (!hasRawCredentialCheck) {
+        rules.push({
+            id: "LINT-NO-RAW-CREDENTIAL-CHECK",
+            severity: "warning",
+            category: "credentials",
+            message: "No raw credential keyword blocking defined",
+            file: filePath,
+            suggestion: "Add RAW_CREDENTIAL_KEYS set and check in require_security",
+        });
+    }
+    return rules;
+}
+/** Lint naming conventions */
+function lintNaming(content, filePath = "unknown") {
+    const rules = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Check for snake_case function names in TypeScript (should be camelCase)
+        if (filePath.endsWith(".ts") || filePath.endsWith(".js")) {
+            const fnMatch = line.match(/^\s*(async\s+)?function\s+([a-z_][a-z0-9_]*)/);
+            if (fnMatch && fnMatch[2].includes("_")) {
+                rules.push({
+                    id: "LINT-TS-SNAKE-CASE",
+                    severity: "info",
+                    category: "lint",
+                    message: `Function "${fnMatch[2]}" uses snake_case; prefer camelCase in TypeScript`,
+                    file: filePath,
+                    line: i + 1,
+                    suggestion: "Rename to camelCase (e.g., get_user → getUser)",
+                });
+            }
+        }
+        // Check for PascalCase variable names
+        const varMatch = line.match(/(?:const|let|var)\s+([A-Z][a-zA-Z0-9]*)\s*=/);
+        if (varMatch && !varMatch[1].match(/^[A-Z_]+$/)) {
+            // Allow UPPER_CASE constants
+            rules.push({
+                id: "LINT-PASCAL-VAR",
+                severity: "info",
+                category: "lint",
+                message: `Variable "${varMatch[1]}" uses PascalCase; prefer camelCase`,
+                file: filePath,
+                line: i + 1,
+                suggestion: "Use camelCase for variables",
+            });
+        }
+    }
+    return rules;
+}
+/** Lint descriptions */
+function lintDescriptions(content, filePath = "unknown") {
+    const rules = [];
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Check for empty descriptions in tool definitions
+        if (line.includes("WithDescription") || line.includes("withDescription")) {
+            if (line.includes('""') || line.includes("''") || line.includes('""') ||
+                line.match(/WithDescription\(\s*\)/)) {
+                rules.push({
+                    id: "LINT-EMPTY-DESCRIPTION",
+                    severity: "warning",
+                    category: "lint",
+                    message: "Empty description found",
+                    file: filePath,
+                    line: i + 1,
+                    suggestion: "Provide a meaningful description for the tool/parameter",
+                });
+            }
+        }
+        // Check for TODO/FIXME in generated code
+        if (line.match(/TODO|FIXME|XXX|HACK/i)) {
+            rules.push({
+                id: "LINT-TODO-IN-GENERATED",
+                severity: "info",
+                category: "lint",
+                message: "TODO/FIXME comment in generated code",
+                file: filePath,
+                line: i + 1,
+                suggestion: "Remove or resolve before production",
+            });
+        }
+    }
+    return rules;
+}
+/** Lint incremental markers */
+function lintIncrementalMarkers(content, filePath = "unknown") {
+    const rules = [];
+    const lines = content.split("\n");
+    let startCount = 0;
+    let endCount = 0;
+    const startLines = [];
+    const endLines = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (line.includes("@@mcp-gen:start:")) {
+            startCount++;
+            startLines.push(i + 1);
+        }
+        if (line.includes("@@mcp-gen:end:")) {
+            endCount++;
+            endLines.push(i + 1);
+        }
+    }
+    if (startCount !== endCount) {
+        rules.push({
+            id: "LINT-UNBALANCED-MARKERS",
+            severity: "error",
+            category: "lint",
+            message: `Unbalanced incremental markers: ${startCount} start, ${endCount} end`,
+            file: filePath,
+            suggestion: "Each @@mcp-gen:start: must have matching @@mcp-gen:end:",
+        });
+    }
+    // Check for nested markers (which shouldn't happen)
+    for (const start of startLines) {
+        const matchingEnd = endLines.find(e => e > start);
+        if (matchingEnd) {
+            const between = lines.slice(start, matchingEnd);
+            const nestedStart = between.findIndex(l => l.includes("@@mcp-gen:start:"));
+            if (nestedStart >= 0) {
+                rules.push({
+                    id: "LINT-NESTED-MARKERS",
+                    severity: "warning",
+                    category: "lint",
+                    message: "Nested incremental markers detected",
+                    file: filePath,
+                    line: start + nestedStart,
+                    suggestion: "Flatten marker structure; one start/end per tool",
+                });
+            }
+        }
+    }
+    return rules;
+}
+/** Lint schema usage */
+function lintSchemas(spec, filePath = "spec") {
+    const rules = [];
+    if (!spec.paths)
+        return rules;
+    for (const [path, pathItem] of Object.entries(spec.paths)) {
+        if (!pathItem)
+            continue;
+        const methods = ["get", "post", "put", "patch", "delete", "head", "options", "trace"];
+        for (const method of methods) {
+            const op = pathItem[method];
+            if (!op)
+                continue;
+            // Check for missing summary/description
+            if (!op.summary && !op.description) {
+                rules.push({
+                    id: "LINT-NO-OP-DESCRIPTION",
+                    severity: "warning",
+                    category: "lint",
+                    message: `Operation ${method.toUpperCase()} ${path} has no summary or description`,
+                    file: filePath,
+                    suggestion: "Add summary and description for better generated tool docs",
+                });
+            }
+            // Check for missing examples in responses
+            if (op.responses) {
+                for (const [status, response] of Object.entries(op.responses)) {
+                    if (response && "content" in response) {
+                        const resp = response;
+                        if (resp.content) {
+                            for (const media of Object.values(resp.content)) {
+                                if (media && !media.example && !media.examples) {
+                                    rules.push({
+                                        id: "LINT-NO-RESPONSE-EXAMPLE",
+                                        severity: "info",
+                                        category: "lint",
+                                        message: `Response ${status} for ${method.toUpperCase()} ${path} has no example`,
+                                        file: filePath,
+                                        suggestion: "Add example to enable stub handlers",
+                                    });
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return rules;
+}
+/** Main security/lint scan for a generated project */
+async function scanProject(projectPath) {
+    const allRules = [];
+    // Scan all files in project
+    const files = findFiles(projectPath, [".ts", ".js", ".py", ".go", ".json", ".yaml", ".yml"]);
+    for (const file of files) {
+        const content = fs_1.default.readFileSync(file, "utf-8");
+        const relativePath = path_1.default.relative(projectPath, file);
+        // Credential scanning
+        allRules.push(...scanForCredentials(content, relativePath));
+        // AuthContext validation
+        allRules.push(...validateAuthContext(content, relativePath));
+        // Tool policies
+        allRules.push(...validateToolPolicies(content, relativePath));
+        // Naming conventions
+        allRules.push(...lintNaming(content, relativePath));
+        // Descriptions
+        allRules.push(...lintDescriptions(content, relativePath));
+        // Incremental markers
+        allRules.push(...lintIncrementalMarkers(content, relativePath));
+    }
+    // Scan OpenAPI spec if present
+    const specFiles = findFiles(projectPath, [".json", ".yaml", ".yml"])
+        .filter(f => f.includes("openapi") || f.includes("swagger") || f.includes("api"));
+    for (const specFile of specFiles.slice(0, 1)) { // Only first spec
+        try {
+            const specContent = fs_1.default.readFileSync(specFile, "utf-8");
+            const spec = specFile.endsWith(".json")
+                ? JSON.parse(specContent)
+                : require("js-yaml").load(specContent);
+            allRules.push(...lintSchemas(spec, path_1.default.relative(projectPath, specFile)));
+        }
+        catch {
+            // Ignore parse errors
+        }
+    }
+    const summary = {
+        errors: allRules.filter(r => r.severity === "error").length,
+        warnings: allRules.filter(r => r.severity === "warning").length,
+        info: allRules.filter(r => r.severity === "info").length,
+    };
+    return {
+        rules: allRules,
+        summary,
+        passed: summary.errors === 0,
+    };
+}
+/** Find files with given extensions */
+function findFiles(dir, extensions) {
+    const results = [];
+    function walk(currentDir) {
+        const entries = fs_1.default.readdirSync(currentDir, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = path_1.default.join(currentDir, entry.name);
+            if (entry.isDirectory()) {
+                // Skip node_modules, .git, dist, build
+                if (![".git", "node_modules", "dist", "build", "__pycache__", ".github"].includes(entry.name)) {
+                    walk(fullPath);
+                }
+            }
+            else if (entry.isFile()) {
+                if (extensions.some(ext => entry.name.endsWith(ext))) {
+                    results.push(fullPath);
+                }
+            }
+        }
+    }
+    walk(dir);
+    return results;
+}
+/** Format report for console output */
+function formatReport(report) {
+    const lines = [];
+    lines.push("");
+    lines.push("═══════════════════════════════════════════");
+    lines.push("  MCP Security & Lint Report");
+    lines.push("═══════════════════════════════════════════");
+    lines.push("");
+    lines.push(`  Errors:   ${report.summary.errors}`);
+    lines.push(`  Warnings: ${report.summary.warnings}`);
+    lines.push(`  Info:     ${report.summary.info}`);
+    lines.push(`  Status:   ${report.passed ? "✅ PASSED" : "❌ FAILED"}`);
+    lines.push("");
+    if (report.rules.length === 0) {
+        lines.push("  No issues found.");
+        return lines.join("\n");
+    }
+    // Group by category
+    const byCategory = {};
+    for (const rule of report.rules) {
+        if (!byCategory[rule.category])
+            byCategory[rule.category] = [];
+        byCategory[rule.category].push(rule);
+    }
+    for (const [category, rules] of Object.entries(byCategory)) {
+        lines.push(`  ${category.toUpperCase()}:`);
+        for (const rule of rules) {
+            const icon = rule.severity === "error" ? "✗" : rule.severity === "warning" ? "⚠" : "ℹ";
+            const loc = rule.file ? ` (${rule.file}${rule.line ? `:${rule.line}` : ""})` : "";
+            lines.push(`    ${icon} [${rule.id}] ${rule.message}${loc}`);
+            if (rule.suggestion) {
+                lines.push(`       → ${rule.suggestion}`);
+            }
+        }
+        lines.push("");
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=security-lint.js.map

package/dist/core/security-lint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-lint.js","sourceRoot":"","sources":["../../src/core/security-lint.ts"],"names":[],"mappings":";;;;;;AAiFA,gDAmEC;AAGD,kDAqCC;AAGD,oDA6CC;AAGD,gCA2CC;AAGD,4CAyCC;AAGD,wDA0DC;AAGD,kCAsDC;AAGD,kCAwDC;AA8BD,oCAwCC;AA7jBD,gDAAwB;AACxB,4CAAoB;AAiCpB,kEAAkE;AACrD,QAAA,uBAAuB,GAAG;IACrC,eAAe;IACf,OAAO;IACP,cAAc;IACd,SAAS;IACT,QAAQ;IACR,WAAW;IACX,WAAW;IACX,eAAe;IACf,WAAW;IACX,eAAe;IACf,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,KAAK;IACL,aAAa;IACb,SAAS;CACV,CAAC;AAEF,kDAAkD;AACrC,QAAA,mBAAmB,GAAG;IACjC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO;IAC3D,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS;IACzD,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO;IACrD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI;IAClD,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM;IAClD,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS;IACxD,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;IACpD,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU;CACvD,CAAC;AAEF,kCAAkC;AACrB,QAAA,4BAA4B,GAAG;IAC1C,SAAS;IACT,WAAW;IACX,WAAW;IACX,cAAc;IACd,mBAAmB;IACnB,eAAe;IACf,cAAc;IACd,SAAS;IACT,WAAW;CACZ,CAAC;AAEF,iDAAiD;AACjD,SAAgB,kBAAkB,CAChC,OAAe,EACf,WAAmB,SAAS;IAE5B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAErC,gCAAgC;QAChC,KAAK,MAAM,OAAO,IAAI,+BAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,OAAO,KAAK,EAAE,GAAG,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,uDAAuD;gBACvD,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACzD,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACpE,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;oBAChF,SAAS;gBACX,CAAC;gBAED,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,YAAY,OAAO,CAAC,WAAW,EAAE,EAAE;oBACvC,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,aAAa;oBACvB,OAAO,EAAE,qCAAqC,OAAO,SAAS;oBAC9D,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,UAAU,EAAE,4DAA4D;iBACzE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,MAAM,cAAc,GAAG;YACrB,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,KAAK,EAAE;YAChD,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,KAAK,EAAE;YAChD,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,YAAY,EAAE;YACvD,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,cAAc,EAAE;YACzD,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE;YACxD,EAAE,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,YAAY,EAAE;YAC1D,EAAE,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,WAAW,EAAE;YACzD,EAAE,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,YAAY,EAAE;YAC1D,EAAE,OAAO,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE;YAC9D,EAAE,OAAO,EAAE,gEAAgE,EAAE,IAAI,EAAE,KAAK,EAAE;YAC1F,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE;YACxD,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,eAAe,EAAE;SAC1D,CAAC;QAEF,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,cAAc,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,cAAc,IAAI,CAAC,WAAW,EAAE,EAAE;oBACtC,QAAQ,EAAE,OAAO;oBACjB,QAAQ,EAAE,aAAa;oBACvB,OAAO,EAAE,aAAa,IAAI,kBAAkB;oBAC5C,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,UAAU,EAAE,8EAA8E;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uDAAuD;AACvD,SAAgB,mBAAmB,CACjC,OAAe,EACf,WAAmB,SAAS;IAE5B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,wBAAwB,GAAG,KAAK,CAAC;IAErC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,oDAAoD;QACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAClE,mBAAmB,GAAG,IAAI,CAAC;QAC7B,CAAC;QAED,wDAAwD;QACxD,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACrE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACpE,wBAAwB,GAAG,IAAI,CAAC;QAClC,CAAC;IACH,CAAC;IAED,IAAI,mBAAmB,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,2BAA2B;YAC/B,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,4DAA4D;YACrE,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,4DAA4D;SACzE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yCAAyC;AACzC,SAAgB,oBAAoB,CAClC,OAAe,EACf,WAAmB,SAAS;IAE5B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACpE,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC/E,qBAAqB,GAAG,IAAI,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,uBAAuB;YAC3B,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,uEAAuE;YAChF,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,mEAAmE;SAChF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,8BAA8B;YAClC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,4CAA4C;YACrD,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,2DAA2D;SACxE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8BAA8B;AAC9B,SAAgB,UAAU,CACxB,OAAe,EACf,WAAmB,SAAS;IAE5B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,0EAA0E;QAC1E,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC3E,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,oBAAoB;oBACxB,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,aAAa,OAAO,CAAC,CAAC,CAAC,mDAAmD;oBACnF,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,UAAU,EAAE,gDAAgD;iBAC7D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC3E,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,6BAA6B;YAC7B,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,iBAAiB;gBACrB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,aAAa,QAAQ,CAAC,CAAC,CAAC,qCAAqC;gBACtE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,UAAU,EAAE,6BAA6B;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wBAAwB;AACxB,SAAgB,gBAAgB,CAC9B,OAAe,EACf,WAAmB,SAAS;IAE5B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,mDAAmD;QACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACzE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjE,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC;gBACzC,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,wBAAwB;oBAC5B,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,yBAAyB;oBAClC,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,UAAU,EAAE,yDAAyD;iBACtE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,wBAAwB;gBAC5B,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,sCAAsC;gBAC/C,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,UAAU,EAAE,qCAAqC;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+BAA+B;AAC/B,SAAgB,sBAAsB,CACpC,OAAe,EACf,WAAmB,SAAS;IAE5B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtC,UAAU,EAAE,CAAC;YACb,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,QAAQ,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,yBAAyB;YAC7B,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,mCAAmC,UAAU,WAAW,QAAQ,MAAM;YAC/E,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,yDAAyD;SACtE,CAAC,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAClD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAC3E,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,qBAAqB;oBACzB,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,qCAAqC;oBAC9C,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,KAAK,GAAG,WAAW;oBACzB,UAAU,EAAE,kDAAkD;iBAC/D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wBAAwB;AACxB,SAAgB,WAAW,CACzB,IAAwB,EACxB,WAAmB,MAAM;IAEzB,MAAM,KAAK,GAAmB,EAAE,CAAC;IAEjC,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAE9B,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACtF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,MAA+B,CAA0C,CAAC;YAC9F,IAAI,CAAC,EAAE;gBAAE,SAAS;YAElB,wCAAwC;YACxC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,wBAAwB;oBAC5B,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,aAAa,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,gCAAgC;oBAClF,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,4DAA4D;iBACzE,CAAC,CAAC;YACL,CAAC;YAED,0CAA0C;YAC1C,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;gBACjB,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9D,IAAI,QAAQ,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;wBACtC,MAAM,IAAI,GAAG,QAAoC,CAAC;wBAClD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;4BACjB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gCAChD,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;oCAC/C,KAAK,CAAC,IAAI,CAAC;wCACT,EAAE,EAAE,0BAA0B;wCAC9B,QAAQ,EAAE,MAAM;wCAChB,QAAQ,EAAE,MAAM;wCAChB,OAAO,EAAE,YAAY,MAAM,QAAQ,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,iBAAiB;wCAChF,IAAI,EAAE,QAAQ;wCACd,UAAU,EAAE,qCAAqC;qCAClD,CAAC,CAAC;gCACL,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sDAAsD;AAC/C,KAAK,UAAU,WAAW,CAAC,WAAmB;IACnD,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,4BAA4B;IAC5B,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAE7F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,cAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAEtD,sBAAsB;QACtB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAE5D,yBAAyB;QACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAE7D,gBAAgB;QAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAE9D,qBAAqB;QACrB,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAEpD,eAAe;QACf,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAE1D,sBAAsB;QACtB,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,+BAA+B;IAC/B,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;SACjE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAEpF,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,kBAAkB;QAChE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,YAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACrC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;gBACzB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,cAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM;QAC3D,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM;QAC/D,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;KACzD,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,uCAAuC;AACvC,SAAS,SAAS,CAAC,GAAW,EAAE,UAAoB;IAClD,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,SAAS,IAAI,CAAC,UAAkB;QAC9B,MAAM,OAAO,GAAG,YAAE,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAEnD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,uCAAuC;gBACvC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9F,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACrD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uCAAuC;AACvC,SAAgB,YAAY,CAAC,MAAsB;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACrE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,oBAAoB;IACpB,MAAM,UAAU,GAAmC,EAAE,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC/D,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACvF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC;YAC7D,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/core/security.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Validates that a file path is within an allowed directory.
+ * Prevents path traversal attacks (e.g., ../../../etc/passwd).
+ */
+export declare function validateOutputPath(filePath: string, baseDir: string): void;
+/**
+ * Validates that a plugin path exists and is a directory.
+ * Prevents loading arbitrary code from unexpected locations.
+ */
+export declare function validatePluginPath(pluginPath: string): void;
+/**
+ * Validates a remote URL for fetching OpenAPI specs.
+ * Only allows HTTPS and known safe domains.
+ */
+export declare function validateRemoteUrl(urlString: string): void;
+/**
+ * Validates the size of remote content to prevent DoS attacks.
+ * Max size: 50MB
+ */
+export declare function validateContentSize(size: number, maxBytes?: number): void;
+/**
+ * Validates Content-Type of remote response.
+ * Only allows JSON and YAML for OpenAPI specs.
+ */
+export declare function validateContentType(contentType: string | null): void;
+/**
+ * Sanitizes user input to prevent injection attacks.
+ * Removes/escapes potentially dangerous characters.
+ */
+export declare function sanitizeInput(input: string, maxLength?: number): string;
+/**
+ * Creates a whitelist of allowed plugin modules.
+ * Returns true if plugin is in the whitelist.
+ */
+export declare function isPluginWhitelisted(pluginName: string, whitelist: string[]): boolean;
+/**
+ * Validates that the plugin module exports a valid structure.
+ * Prevents malicious modules from executing arbitrary code.
+ */
+export declare function validatePluginModule(module: unknown): boolean;
+//# sourceMappingURL=security.d.ts.map

package/dist/core/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/core/security.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAS1E;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAiB3D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAoCzD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAyB,GAAG,IAAI,CAM3F;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAWpE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,GAAE,MAAY,GAAG,MAAM,CAW5E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAEpF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAuB7D"}