@claude-flow/security 3.0.0-alpha.1 → 3.0.0-alpha.10

package/dist/authorization/propagator.d.ts

@@ -0,0 +1,148 @@
+/**
+ * AgentAuthorizationPropagator — action-layer security for agent delegation.
+ *
+ * Implements P1 of ADR-144 (ruvnet/ruflo#2248): scope-envelope on SendMessage
+ * + per-action authorization checks. P2-P5 wire this into the comms layer,
+ * MCP dispatcher, MCP auth validator, and provenance log respectively.
+ *
+ * Threat model
+ * ------------
+ * When agent A delegates a task to agent B via SendMessage, B can today
+ * escalate the granted scope by calling tools A was never authorized to
+ * invoke. RBAC/ABAC on agent roles do not solve this — roles don't compose
+ * under dynamic LLM delegation (arXiv:2605.05440, Grade A formal analysis).
+ *
+ * The fix is scope-based propagation: every SendMessage carries an
+ * `AuthScope` that is *monotonically reducing* — each hop can drop tools or
+ * servers from the granted set but never add them. This is the same shape
+ * as OAuth scope reduction; adding back a tool requires talking to the
+ * original principal out-of-band.
+ *
+ * Scope
+ * -----
+ * - P1 (this file): the component, the envelope, the type-level invariants.
+ *   No call sites yet — adding the wrapping/enforcement in P2-P4.
+ * - All operations synchronous, pure, allocation-light. Targets < 1 ms p99
+ *   for `wrapOutbound` + `checkToolCall` so it can sit on every SendMessage.
+ *
+ * Backwards compatibility
+ * -----------------------
+ * `scope` on the envelope is optional in v1. Agents without scope set
+ * operate in legacy permissive mode (all tools allowed, depth unlimited,
+ * server auth unchecked). `CLAUDE_FLOW_STRICT_AUTH=true` enables enforcement.
+ *
+ * Reference: ADR-144, arXiv:2605.05440 (Authorization Propagation),
+ * arXiv:2605.28914 (AIRGuard), arXiv:2605.22333 (MCP auth survey).
+ */
+/** Scope granted to an agent at a delegation hop. Monotonically reducing. */
+export interface AuthScope {
+    /** Stable identifier of the originating principal (agent or user). */
+    readonly principalId: string;
+    /** MCP tool IDs this scope is allowed to call. */
+    readonly grantedTools: ReadonlyArray<string>;
+    /** MCP server IDs whose tool responses this scope will accept. */
+    readonly grantedServers: ReadonlyArray<string>;
+    /** Max remaining delegation hops. Decrements on every `wrapOutbound`. */
+    readonly delegationDepth: number;
+    /** Unix ms after which this scope is no longer valid. */
+    readonly expiresAt: number;
+    /**
+     * Optional opaque ID for cross-referencing with ADR-144 P5 provenance log
+     * and ADR-146 telemetry events. Callers should treat as a correlation
+     * handle, not a security claim.
+     */
+    readonly scopeId?: string;
+}
+/** Envelope shape attached to every SendMessage when strict-auth is on. */
+export interface SendMessageEnvelope<T = unknown> {
+    /** Authorization scope governing what the receiver may do. */
+    readonly scope: AuthScope;
+    /** The original SendMessage payload, untouched. */
+    readonly payload: T;
+}
+/** Decision returned by `checkToolCall`. Never throws. */
+export interface ToolCallDecision {
+    readonly allowed: boolean;
+    /** Human-readable reason; stable enough to match in tests/telemetry. */
+    readonly reason?: 'tool-not-in-scope' | 'server-not-in-scope' | 'scope-expired' | 'delegation-depth-exhausted' | 'principal-mismatch';
+}
+/**
+ * Wrap-failure reasons surfaced to callers as a typed error. We use a
+ * discriminated union rather than throwing so the comms layer (P2) can
+ * decide whether to drop the SendMessage or surface to the user.
+ */
+export declare class AuthorizationPropagationError extends Error {
+    readonly code: 'scope-cannot-grow' | 'depth-underflow' | 'scope-expired' | 'principal-mismatch';
+    constructor(code: 'scope-cannot-grow' | 'depth-underflow' | 'scope-expired' | 'principal-mismatch', message: string);
+}
+/**
+ * Construct a default permissive scope. Used in legacy mode when no scope
+ * was attached upstream. Callers SHOULD migrate to explicit scopes; this is
+ * here so the propagator never has to special-case "no scope".
+ */
+export declare function makeLegacyPermissiveScope(principalId?: string): AuthScope;
+/**
+ * `AgentAuthorizationPropagator` — the load-bearing component for ADR-144.
+ *
+ * Construction is intentionally cheap (no I/O, no async). Callers can build
+ * a fresh instance per task without overhead, or share one — it holds no
+ * mutable state beyond the optional provenance buffer.
+ */
+export declare class AgentAuthorizationPropagator {
+    private readonly opts;
+    /**
+     * In-memory provenance buffer. P5 will flush this to the structured
+     * telemetry sink (ADR-146 GuardrailEvent shape). For P1 we just retain
+     * the last N events for inspection/tests.
+     */
+    private readonly provenance;
+    constructor(opts?: {
+        provenanceBufferMax?: number;
+    });
+    /**
+     * Attach a reduced scope to an outbound SendMessage.
+     *
+     * Invariants enforced (throws `AuthorizationPropagationError` on violation):
+     *   - newly granted tools MUST be a subset of `currentScope.grantedTools`
+     *   - newly granted servers MUST be a subset of `currentScope.grantedServers`
+     *   - delegationDepth MUST decrement by ≥ 1 (must remain ≥ 0)
+     *   - principalId is propagated unchanged
+     *   - expiresAt cannot be extended; copied from the holder
+     */
+    wrapOutbound<T>(payload: T, currentScope: AuthScope, requested?: {
+        tools?: ReadonlyArray<string>;
+        servers?: ReadonlyArray<string>;
+    }): SendMessageEnvelope<T>;
+    /**
+     * Validate a single tool call against a scope. Pure; never throws. Use the
+     * result's `allowed` to make the dispatch decision.
+     */
+    checkToolCall(toolId: string, scope: AuthScope, opts?: {
+        serverId?: string;
+        now?: number;
+    }): ToolCallDecision;
+    /**
+     * Verify an MCP server presented a valid credential before its response is
+     * consumed. P1 ships a permissive default (any non-empty credential is
+     * accepted) so the API is stable; P4 wires this to a real validator.
+     *
+     * Returns `false` on missing/empty credential; callers MUST treat `false`
+     * as a hard reject (same rule as ADR-131 reject findings).
+     */
+    verifyServerAuth(serverId: string, credential: unknown): boolean;
+    /**
+     * Record an action in the provenance buffer. P5 will route to telemetry;
+     * P1 keeps the last N events for test inspection and post-incident audit.
+     */
+    recordAction(agentId: string, toolId: string, scope: AuthScope, outcome: 'allowed' | 'denied', reason?: string): void;
+    /** Read-only view of recorded provenance for tests + audit CLI (P5). */
+    getProvenance(): ReadonlyArray<{
+        agentId: string;
+        toolId: string;
+        scope: AuthScope;
+        outcome: 'allowed' | 'denied';
+        reason?: string;
+        ts: number;
+    }>;
+}
+//# sourceMappingURL=propagator.d.ts.map

package/dist/authorization/propagator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"propagator.d.ts","sourceRoot":"","sources":["../../src/authorization/propagator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C,yEAAyE;IACzE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB,CAAC,CAAC,GAAG,OAAO;IAC9C,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;CACrB;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EACZ,mBAAmB,GACnB,qBAAqB,GACrB,eAAe,GACf,4BAA4B,GAC5B,oBAAoB,CAAC;CAC1B;AAED;;;;GAIG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;aAEpC,IAAI,EAChB,mBAAmB,GACnB,iBAAiB,GACjB,eAAe,GACf,oBAAoB;gBAJR,IAAI,EAChB,mBAAmB,GACnB,iBAAiB,GACjB,eAAe,GACf,oBAAoB,EACxB,OAAO,EAAE,MAAM;CAKlB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,SAAW,GAAG,SAAS,CAQ3E;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IAe3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAdjC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAOnB;gBAEqB,IAAI,GAAE;QAAE,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAO;IAExE;;;;;;;;;OASG;IACH,YAAY,CAAC,CAAC,EACZ,OAAO,EAAE,CAAC,EACV,YAAY,EAAE,SAAS,EACvB,SAAS,GAAE;QAAE,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;KAAO,GACjF,mBAAmB,CAAC,CAAC,CAAC;IAsCzB;;;OAGG;IACH,aAAa,CACX,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,SAAS,EAChB,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7C,gBAAgB;IAanB;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO;IAOhE;;;OAGG;IACH,YAAY,CACV,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,SAAS,GAAG,QAAQ,EAC7B,MAAM,CAAC,EAAE,MAAM,GACd,IAAI;IAMP,wEAAwE;IACxE,aAAa,IAAI,aAAa,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,SAAS,CAAC;QACjB,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;QAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;CAGH"}

package/dist/authorization/propagator.js

@@ -0,0 +1,182 @@
+/**
+ * AgentAuthorizationPropagator — action-layer security for agent delegation.
+ *
+ * Implements P1 of ADR-144 (ruvnet/ruflo#2248): scope-envelope on SendMessage
+ * + per-action authorization checks. P2-P5 wire this into the comms layer,
+ * MCP dispatcher, MCP auth validator, and provenance log respectively.
+ *
+ * Threat model
+ * ------------
+ * When agent A delegates a task to agent B via SendMessage, B can today
+ * escalate the granted scope by calling tools A was never authorized to
+ * invoke. RBAC/ABAC on agent roles do not solve this — roles don't compose
+ * under dynamic LLM delegation (arXiv:2605.05440, Grade A formal analysis).
+ *
+ * The fix is scope-based propagation: every SendMessage carries an
+ * `AuthScope` that is *monotonically reducing* — each hop can drop tools or
+ * servers from the granted set but never add them. This is the same shape
+ * as OAuth scope reduction; adding back a tool requires talking to the
+ * original principal out-of-band.
+ *
+ * Scope
+ * -----
+ * - P1 (this file): the component, the envelope, the type-level invariants.
+ *   No call sites yet — adding the wrapping/enforcement in P2-P4.
+ * - All operations synchronous, pure, allocation-light. Targets < 1 ms p99
+ *   for `wrapOutbound` + `checkToolCall` so it can sit on every SendMessage.
+ *
+ * Backwards compatibility
+ * -----------------------
+ * `scope` on the envelope is optional in v1. Agents without scope set
+ * operate in legacy permissive mode (all tools allowed, depth unlimited,
+ * server auth unchecked). `CLAUDE_FLOW_STRICT_AUTH=true` enables enforcement.
+ *
+ * Reference: ADR-144, arXiv:2605.05440 (Authorization Propagation),
+ * arXiv:2605.28914 (AIRGuard), arXiv:2605.22333 (MCP auth survey).
+ */
+/**
+ * Wrap-failure reasons surfaced to callers as a typed error. We use a
+ * discriminated union rather than throwing so the comms layer (P2) can
+ * decide whether to drop the SendMessage or surface to the user.
+ */
+export class AuthorizationPropagationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'AuthorizationPropagationError';
+    }
+}
+/**
+ * Construct a default permissive scope. Used in legacy mode when no scope
+ * was attached upstream. Callers SHOULD migrate to explicit scopes; this is
+ * here so the propagator never has to special-case "no scope".
+ */
+export function makeLegacyPermissiveScope(principalId = 'legacy') {
+    return {
+        principalId,
+        grantedTools: ['*'], // sentinel — see `checkToolCall`
+        grantedServers: ['*'],
+        delegationDepth: Number.MAX_SAFE_INTEGER,
+        expiresAt: Number.MAX_SAFE_INTEGER,
+    };
+}
+/**
+ * `AgentAuthorizationPropagator` — the load-bearing component for ADR-144.
+ *
+ * Construction is intentionally cheap (no I/O, no async). Callers can build
+ * a fresh instance per task without overhead, or share one — it holds no
+ * mutable state beyond the optional provenance buffer.
+ */
+export class AgentAuthorizationPropagator {
+    opts;
+    /**
+     * In-memory provenance buffer. P5 will flush this to the structured
+     * telemetry sink (ADR-146 GuardrailEvent shape). For P1 we just retain
+     * the last N events for inspection/tests.
+     */
+    provenance = [];
+    constructor(opts = {}) {
+        this.opts = opts;
+    }
+    /**
+     * Attach a reduced scope to an outbound SendMessage.
+     *
+     * Invariants enforced (throws `AuthorizationPropagationError` on violation):
+     *   - newly granted tools MUST be a subset of `currentScope.grantedTools`
+     *   - newly granted servers MUST be a subset of `currentScope.grantedServers`
+     *   - delegationDepth MUST decrement by ≥ 1 (must remain ≥ 0)
+     *   - principalId is propagated unchanged
+     *   - expiresAt cannot be extended; copied from the holder
+     */
+    wrapOutbound(payload, currentScope, requested = {}) {
+        if (currentScope.delegationDepth <= 0) {
+            throw new AuthorizationPropagationError('depth-underflow', `cannot delegate further — delegationDepth=${currentScope.delegationDepth}`);
+        }
+        const now = Date.now();
+        if (currentScope.expiresAt <= now) {
+            throw new AuthorizationPropagationError('scope-expired', `scope expired at ${new Date(currentScope.expiresAt).toISOString()}`);
+        }
+        const reducedTools = subsetOrThrow(currentScope.grantedTools, requested.tools ?? currentScope.grantedTools, 'tools');
+        const reducedServers = subsetOrThrow(currentScope.grantedServers, requested.servers ?? currentScope.grantedServers, 'servers');
+        const reducedScope = {
+            principalId: currentScope.principalId,
+            grantedTools: reducedTools,
+            grantedServers: reducedServers,
+            delegationDepth: currentScope.delegationDepth - 1,
+            expiresAt: currentScope.expiresAt,
+            scopeId: currentScope.scopeId,
+        };
+        return { scope: reducedScope, payload };
+    }
+    /**
+     * Validate a single tool call against a scope. Pure; never throws. Use the
+     * result's `allowed` to make the dispatch decision.
+     */
+    checkToolCall(toolId, scope, opts = {}) {
+        const now = opts.now ?? Date.now();
+        if (scope.expiresAt <= now)
+            return { allowed: false, reason: 'scope-expired' };
+        if (!matchesScopeList(scope.grantedTools, toolId)) {
+            return { allowed: false, reason: 'tool-not-in-scope' };
+        }
+        if (opts.serverId && !matchesScopeList(scope.grantedServers, opts.serverId)) {
+            return { allowed: false, reason: 'server-not-in-scope' };
+        }
+        return { allowed: true };
+    }
+    /**
+     * Verify an MCP server presented a valid credential before its response is
+     * consumed. P1 ships a permissive default (any non-empty credential is
+     * accepted) so the API is stable; P4 wires this to a real validator.
+     *
+     * Returns `false` on missing/empty credential; callers MUST treat `false`
+     * as a hard reject (same rule as ADR-131 reject findings).
+     */
+    verifyServerAuth(serverId, credential) {
+        if (!serverId || typeof serverId !== 'string')
+            return false;
+        if (credential == null)
+            return false;
+        if (typeof credential === 'string' && credential.trim().length === 0)
+            return false;
+        return true;
+    }
+    /**
+     * Record an action in the provenance buffer. P5 will route to telemetry;
+     * P1 keeps the last N events for test inspection and post-incident audit.
+     */
+    recordAction(agentId, toolId, scope, outcome, reason) {
+        const max = this.opts.provenanceBufferMax ?? 1024;
+        this.provenance.push({ agentId, toolId, scope, outcome, reason, ts: Date.now() });
+        if (this.provenance.length > max)
+            this.provenance.splice(0, this.provenance.length - max);
+    }
+    /** Read-only view of recorded provenance for tests + audit CLI (P5). */
+    getProvenance() {
+        return this.provenance.slice();
+    }
+}
+// ─── helpers ────────────────────────────────────────────────────────────
+function subsetOrThrow(parent, requested, kind) {
+    if (parent.includes('*'))
+        return Array.from(new Set(requested));
+    for (const item of requested) {
+        if (!parent.includes(item) && item !== '*') {
+            throw new AuthorizationPropagationError('scope-cannot-grow', `cannot grant ${kind} '${item}' — not in parent scope`);
+        }
+    }
+    // De-duplicate; preserve requested order
+    const seen = new Set();
+    const out = [];
+    for (const r of requested)
+        if (!seen.has(r))
+            (seen.add(r), out.push(r));
+    return out;
+}
+function matchesScopeList(list, item) {
+    if (list.includes('*'))
+        return true;
+    return list.includes(item);
+}
+//# sourceMappingURL=propagator.js.map

package/dist/authorization/propagator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"propagator.js","sourceRoot":"","sources":["../../src/authorization/propagator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AA0CH;;;;GAIG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAEpC;IADlB,YACkB,IAIQ,EACxB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAPC,SAAI,GAAJ,IAAI,CAII;QAIxB,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAW,GAAG,QAAQ;IAC9D,OAAO;QACL,WAAW;QACX,YAAY,EAAE,CAAC,GAAG,CAAC,EAAM,iCAAiC;QAC1D,cAAc,EAAE,CAAC,GAAG,CAAC;QACrB,eAAe,EAAE,MAAM,CAAC,gBAAgB;QACxC,SAAS,EAAE,MAAM,CAAC,gBAAgB;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IAeV;IAd7B;;;;OAIG;IACc,UAAU,GAOtB,EAAE,CAAC;IAER,YAA6B,OAAyC,EAAE;QAA3C,SAAI,GAAJ,IAAI,CAAuC;IAAG,CAAC;IAE5E;;;;;;;;;OASG;IACH,YAAY,CACV,OAAU,EACV,YAAuB,EACvB,YAAgF,EAAE;QAElF,IAAI,YAAY,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,6BAA6B,CACrC,iBAAiB,EACjB,6CAA6C,YAAY,CAAC,eAAe,EAAE,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,YAAY,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YAClC,MAAM,IAAI,6BAA6B,CACrC,eAAe,EACf,oBAAoB,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CACrE,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,aAAa,CAChC,YAAY,CAAC,YAAY,EACzB,SAAS,CAAC,KAAK,IAAI,YAAY,CAAC,YAAY,EAC5C,OAAO,CACR,CAAC;QACF,MAAM,cAAc,GAAG,aAAa,CAClC,YAAY,CAAC,cAAc,EAC3B,SAAS,CAAC,OAAO,IAAI,YAAY,CAAC,cAAc,EAChD,SAAS,CACV,CAAC;QAEF,MAAM,YAAY,GAAc;YAC9B,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,YAAY,EAAE,YAAY;YAC1B,cAAc,EAAE,cAAc;YAC9B,eAAe,EAAE,YAAY,CAAC,eAAe,GAAG,CAAC;YACjD,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,aAAa,CACX,MAAc,EACd,KAAgB,EAChB,OAA4C,EAAE;QAE9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAE/E,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACzD,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAgB,EAAE,UAAmB;QACpD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5D,IAAI,UAAU,IAAI,IAAI;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,YAAY,CACV,OAAe,EACf,MAAc,EACd,KAAgB,EAChB,OAA6B,EAC7B,MAAe;QAEf,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG;YAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC5F,CAAC;IAED,wEAAwE;IACxE,aAAa;QAQX,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;CACF;AAED,2EAA2E;AAE3E,SAAS,aAAa,CACpB,MAA6B,EAC7B,SAAgC,EAChC,IAAyB;IAEzB,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC3C,MAAM,IAAI,6BAA6B,CACrC,mBAAmB,EACnB,gBAAgB,IAAI,KAAK,IAAI,yBAAyB,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,yCAAyC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,IAA2B,EAAE,IAAY;IACjE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC"}

package/dist/credential-generator.js

@@ -223,15 +223,15 @@ export class CredentialGenerator {
      * @returns Environment variable export script
      */
     createEnvScript(credentials) {
-        return `# Claude Flow V3 - Generated Credentials
-# Generated: ${credentials.generatedAt.toISOString()}
-# IMPORTANT: Store these securely and delete this file after use
-
-export CLAUDE_FLOW_ADMIN_PASSWORD="${credentials.adminPassword}"
-export CLAUDE_FLOW_SERVICE_PASSWORD="${credentials.servicePassword}"
-export CLAUDE_FLOW_JWT_SECRET="${credentials.jwtSecret}"
-export CLAUDE_FLOW_SESSION_SECRET="${credentials.sessionSecret}"
-export CLAUDE_FLOW_ENCRYPTION_KEY="${credentials.encryptionKey}"
+        return `# Claude Flow V3 - Generated Credentials
+# Generated: ${credentials.generatedAt.toISOString()}
+# IMPORTANT: Store these securely and delete this file after use
+
+export CLAUDE_FLOW_ADMIN_PASSWORD="${credentials.adminPassword}"
+export CLAUDE_FLOW_SERVICE_PASSWORD="${credentials.servicePassword}"
+export CLAUDE_FLOW_JWT_SECRET="${credentials.jwtSecret}"
+export CLAUDE_FLOW_SESSION_SECRET="${credentials.sessionSecret}"
+export CLAUDE_FLOW_ENCRYPTION_KEY="${credentials.encryptionKey}"
 `;
     }
     /**

package/dist/domain/services/security-domain-service.js

@@ -229,7 +229,7 @@ export class SecurityDomainService {
             permissions,
             allowedPaths: customPaths ?? ['./src', './tests', './docs'],
             blockedPaths: ['/etc', '/var', '~/', '../'],
-            allowedCommands: ['npm', 'npx', 'node', 'git', 'vitest'],
+            allowedCommands: ['npm', 'node', 'git', 'vitest'],
             blockedCommands: ['rm -rf /', 'dd', 'mkfs', 'format'],
         });
     }

package/dist/domain/services/security-domain-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-domain-service.js","sourceRoot":"","sources":["../../../src/domain/services/security-domain-service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAmB,MAAM,iCAAiC,CAAC;AAyBnF;;GAEG;AACH,MAAM,OAAO,qBAAqB;IAChC,wCAAwC;IAChC,MAAM,CAAU,uBAAuB,GAAG;QAChD,MAAM;QACN,KAAK;QACL,UAAU;QACV,UAAU;QACV,eAAe;QACf,eAAe;QACf,8BAA8B;KAC/B,CAAC;IAEF,6BAA6B;IACrB,MAAM,CAAU,kBAAkB,GAAG;QAC3C,gBAAgB;QAChB,gBAAgB;QAChB,WAAW;QACX,SAAS;QACT,aAAa;QACb,mBAAmB;QACnB,oBAAoB;QACpB,YAAY;QACZ,UAAU;QACV,WAAW;QACX,WAAW;KACZ,CAAC;IAEF,yBAAyB;IACjB,MAAM,CAAU,sBAAsB,GAAG;QAC/C,wBAAwB;QACxB,qBAAqB;QACrB,mBAAmB;QACnB,oBAAoB;QACpB,iBAAiB;QACjB,QAAQ;KACT,CAAC;IAEF,eAAe;IACP,MAAM,CAAU,YAAY,GAAG;QACrC,eAAe;QACf,cAAc;QACd,YAAY;QACZ,UAAU;QACV,UAAU;QACV,SAAS;KACV,CAAC;IAEF;;OAEG;IACH,YAAY,CAAC,IAAY,EAAE,OAAwB;QACjD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,uBAAuB;QACvB,KAAK,MAAM,OAAO,IAAI,qBAAqB,CAAC,uBAAuB,EAAE,CAAC;YACpE,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,4BAA4B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,6BAA6B;QAC7B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;SACnC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAe,EAAE,OAAwB;QACvD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,2BAA2B;QAC3B,KAAK,MAAM,OAAO,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,CAAC;YAC/D,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,uCAAuC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QAED,4BAA4B;QAC5B,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACzD,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;SACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAa;QACzB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,0BAA0B;QAC1B,KAAK,MAAM,OAAO,IAAI,qBAAqB,CAAC,sBAAsB,EAAE,CAAC;YACnE,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBAC9C,MAAM;YACR,CAAC;QACH,CAAC;QAED,gBAAgB;QAChB,KAAK,MAAM,OAAO,IAAI,qBAAqB,CAAC,YAAY,EAAE,CAAC;YACzD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBACpC,MAAM;YACR,CAAC;QACH,CAAC;QAED,eAAe;QACf,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACpD,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;SACrC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAe;QAC3B,MAAM,OAAO,GAAqC,EAAE,CAAC;QAErD,oCAAoC;QACpC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,qBAAqB;aACnC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,UAAU;gBACpB,WAAW,EAAE,6BAA6B;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,UAAU;gBACpB,WAAW,EAAE,kBAAkB;aAChC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,yBAAyB;aACvC,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;YAC1B,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,IAAY;QAC/B,OAAO,IAAI;aACR,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;aACpB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;aACrB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,IAAI,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,OAAe;QACrC,OAAO,OAAO;aACX,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;aACvB,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;aAC3B,IAAI,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,KAAa;QACjC,OAAO,KAAK;aACT,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;aACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;aACvB,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,kBAAkB,CAChB,OAAe,EACf,IAAY,EACZ,WAAsB;QAEtB,oCAAoC;QACpC,MAAM,eAAe,GAAsC;YACzD,mBAAmB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;YAC1D,oBAAoB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;YAC3D,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;YACrC,UAAU,EAAE,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;YAC7B,OAAO,EAAE,CAAC,MAAM,CAAC;SAClB,CAAC;QAEF,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC;QAErE,OAAO,eAAe,CAAC,MAAM,CAAC;YAC5B,WAAW,EAAE,OAAO;YACpB,aAAa,EAAE,OAAO;YACtB,WAAW;YACX,YAAY,EAAE,WAAW,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;YAC3D,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;YAC3C,eAAe,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC;YACxD,eAAe,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC;SACtD,CAAC,CAAC;IACL,CAAC"}
+{"version":3,"file":"security-domain-service.js","sourceRoot":"","sources":["../../../src/domain/services/security-domain-service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAmB,MAAM,iCAAiC,CAAC;AAyBnF;;GAEG;AACH,MAAM,OAAO,qBAAqB;IAChC,wCAAwC;IAChC,MAAM,CAAU,uBAAuB,GAAG;QAChD,MAAM;QACN,KAAK;QACL,UAAU;QACV,UAAU;QACV,eAAe;QACf,eAAe;QACf,8BAA8B;KAC/B,CAAC;IAEF,6BAA6B;IACrB,MAAM,CAAU,kBAAkB,GAAG;QAC3C,gBAAgB;QAChB,gBAAgB;QAChB,WAAW;QACX,SAAS;QACT,aAAa;QACb,mBAAmB;QACnB,oBAAoB;QACpB,YAAY;QACZ,UAAU;QACV,WAAW;QACX,WAAW;KACZ,CAAC;IAEF,yBAAyB;IACjB,MAAM,CAAU,sBAAsB,GAAG;QAC/C,wBAAwB;QACxB,qBAAqB;QACrB,mBAAmB;QACnB,oBAAoB;QACpB,iBAAiB;QACjB,QAAQ;KACT,CAAC;IAEF,eAAe;IACP,MAAM,CAAU,YAAY,GAAG;QACrC,eAAe;QACf,cAAc;QACd,YAAY;QACZ,UAAU;QACV,UAAU;QACV,SAAS;KACV,CAAC;IAEF;;OAEG;IACH,YAAY,CAAC,IAAY,EAAE,OAAwB;QACjD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,uBAAuB;QACvB,KAAK,MAAM,OAAO,IAAI,qBAAqB,CAAC,uBAAuB,EAAE,CAAC;YACpE,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,4BAA4B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,6BAA6B;QAC7B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;SACnC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAe,EAAE,OAAwB;QACvD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,2BAA2B;QAC3B,KAAK,MAAM,OAAO,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,CAAC;YAC/D,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,uCAAuC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QAED,4BAA4B;QAC5B,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACzD,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;SACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAa;QACzB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,0BAA0B;QAC1B,KAAK,MAAM,OAAO,IAAI,qBAAqB,CAAC,sBAAsB,EAAE,CAAC;YACnE,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBAC9C,MAAM;YACR,CAAC;QACH,CAAC;QAED,gBAAgB;QAChB,KAAK,MAAM,OAAO,IAAI,qBAAqB,CAAC,YAAY,EAAE,CAAC;YACzD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBACpC,MAAM;YACR,CAAC;QACH,CAAC;QAED,eAAe;QACf,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACpD,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;SACrC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAe;QAC3B,MAAM,OAAO,GAAqC,EAAE,CAAC;QAErD,oCAAoC;QACpC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,qBAAqB;aACnC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,UAAU;gBACpB,WAAW,EAAE,6BAA6B;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,UAAU;gBACpB,WAAW,EAAE,kBAAkB;aAChC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,yBAAyB;aACvC,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;YAC1B,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,IAAY;QAC/B,OAAO,IAAI;aACR,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;aACpB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;aACrB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,IAAI,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,OAAe;QACrC,OAAO,OAAO;aACX,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;aACvB,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;aAC3B,IAAI,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,KAAa;QACjC,OAAO,KAAK;aACT,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;aACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;aACvB,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,kBAAkB,CAChB,OAAe,EACf,IAAY,EACZ,WAAsB;QAEtB,oCAAoC;QACpC,MAAM,eAAe,GAAsC;YACzD,mBAAmB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;YAC1D,oBAAoB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;YAC3D,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;YACrC,UAAU,EAAE,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;YAC7B,OAAO,EAAE,CAAC,MAAM,CAAC;SAClB,CAAC;QAEF,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC;QAErE,OAAO,eAAe,CAAC,MAAM,CAAC;YAC5B,WAAW,EAAE,OAAO;YACpB,aAAa,EAAE,OAAO;YACtB,WAAW;YACX,YAAY,EAAE,WAAW,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;YAC3D,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;YAC3C,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC;YACjD,eAAe,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC;SACtD,CAAC,CAAC;IACL,CAAC"}

package/dist/index.d.ts

@@ -19,6 +19,9 @@ export { SafeExecutor, SafeExecutorError, createDevelopmentExecutor, createReadO
 export { PathValidator, PathValidatorError, createProjectPathValidator, createFullProjectPathValidator, type PathValidatorConfig, type PathValidationResult, } from './path-validator.js';
 export { InputValidator, sanitizeString, sanitizeHtml, sanitizePath, SafeStringSchema, IdentifierSchema, FilenameSchema, EmailSchema, PasswordSchema, UUIDSchema, HttpsUrlSchema, UrlSchema, SemverSchema, PortSchema, IPv4Schema, IPSchema, UserRoleSchema, PermissionSchema, LoginRequestSchema, CreateUserSchema, CreateApiKeySchema, AgentTypeSchema, SpawnAgentSchema, TaskInputSchema, CommandArgumentSchema, PathSchema, SecurityConfigSchema, ExecutorConfigSchema, PATTERNS, LIMITS, z, } from './input-validator.js';
 export { TokenGenerator, TokenGeneratorError, createTokenGenerator, getDefaultGenerator, quickGenerate, type TokenConfig, type Token, type SignedToken, type VerificationCode, } from './token-generator.js';
+export { ToolOutputGuardrail, createToolOutputGuardrail, isToolOutputSafe, type GuardrailConfig, type GuardrailResult, type GuardrailAction, type InjectionFinding, type InjectionSeverity, type InjectionCategory, } from './tool-output-guardrail.js';
+export { AgentAuthorizationPropagator, AuthorizationPropagationError, makeLegacyPermissiveScope, type AuthScope, type SendMessageEnvelope, type ToolCallDecision, } from './authorization/propagator.js';
+export { PluginIntegrityVerifier, canonicalize, hashManifest, fingerprint, findAnchor, type PluginManifest, type SignedPluginManifest, type TrustAnchor, type TrustAnchors, type VerificationStatus, type VerificationResult, type VerifierConfig, } from './plugins/integrity-verifier.js';
 import { PasswordHasher } from './password-hasher.js';
 import { CredentialGenerator } from './credential-generator.js';
 import { SafeExecutor } from './safe-executor.js';
@@ -43,7 +46,7 @@ export interface SecurityModuleConfig {
     bcryptRounds?: number;
     /**
      * Allowed commands for safe executor
-     * Default: ['git', 'npm', 'npx', 'node']
+     * Default: ['git', 'npm', 'node']
      */
     allowedCommands?: string[];
 }

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EAEZ,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ,EAER,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAElB,eAAe,EACf,gBAAgB,EAChB,eAAe,EAEf,qBAAqB,EACrB,UAAU,EAEV,oBAAoB,EACpB,oBAAoB,EAEpB,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,cAAc,CAAC;IAC/B,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CAiBjF;AAMD;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,0BAA0B,QAAQ,CAAC;AAMhD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,EAAE,CAoBnF;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EAEZ,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ,EAER,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAElB,eAAe,EACf,gBAAgB,EAChB,eAAe,EAEf,qBAAqB,EACrB,UAAU,EAEV,oBAAoB,EACpB,oBAAoB,EAEpB,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,+BAA+B,CAAC;AAKvC,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,cAAc,GACpB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,cAAc,CAAC;IAC/B,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CAiBjF;AAMD;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,0BAA0B,QAAQ,CAAC;AAMhD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,EAAE,CAoBnF;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,kBAAkB,CAAC"}

package/dist/index.js

@@ -37,6 +37,16 @@ SecurityConfigSchema, ExecutorConfigSchema,
 PATTERNS, LIMITS, z, } from './input-validator.js';
 // Token Generation
 export { TokenGenerator, TokenGeneratorError, createTokenGenerator, getDefaultGenerator, quickGenerate, } from './token-generator.js';
+// Tool-Output Guardrail (ADR-131 — closes OWASP ASI01 gap; ruvnet/ruflo#2149)
+export { ToolOutputGuardrail, createToolOutputGuardrail, isToolOutputSafe, } from './tool-output-guardrail.js';
+// Agent Authorization Propagation (ADR-144 P1 — ruvnet/ruflo#2248)
+// Action-layer: SendMessage envelope + per-action scope check + MCP server
+// identity probe. Wraps the comms layer in P2; wraps the dispatcher in P3.
+export { AgentAuthorizationPropagator, AuthorizationPropagationError, makeLegacyPermissiveScope, } from './authorization/propagator.js';
+// Plugin Integrity Verifier (ADR-145 P1 — ruvnet/ruflo#2254)
+// Install-layer: Ed25519 signature verification + trust-anchor allowlist.
+// Stage-2 semantic-intent scan (SCH defence) lands in P2.
+export { PluginIntegrityVerifier, canonicalize, hashManifest, fingerprint, findAnchor, } from './plugins/integrity-verifier.js';
 // ============================================================================
 // Convenience Factory Functions
 // ============================================================================
@@ -75,7 +85,7 @@ export function createSecurityModule(config) {
         }),
         credentialGenerator: new CredentialGenerator(),
         safeExecutor: new SafeExecutor({
-            allowedCommands: config.allowedCommands ?? ['git', 'npm', 'npx', 'node'],
+            allowedCommands: config.allowedCommands ?? ['git', 'npm', 'node'],
         }),
         pathValidator: new PathValidator({
             allowedPrefixes: [config.projectRoot],

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,+BAA+B;AAC/B,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,sBAAsB,CAAC;AAE9B,oCAAoC;AACpC,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,GAIpB,MAAM,2BAA2B,CAAC;AAEnC,sCAAsC;AACtC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,GAIvB,MAAM,oBAAoB,CAAC;AAE5B,+BAA+B;AAC/B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,GAG/B,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY;AACZ,eAAe;AACf,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ;AACR,eAAe;AACf,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB;AAClB,uBAAuB;AACvB,eAAe,EACf,gBAAgB,EAChB,eAAe;AACf,yBAAyB;AACzB,qBAAqB,EACrB,UAAU;AACV,iBAAiB;AACjB,oBAAoB,EACpB,oBAAoB;AACpB,YAAY;AACZ,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAE9B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GAKd,MAAM,sBAAsB,CAAC;AAE9B,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwCtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA4B;IAC/D,OAAO;QACL,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;SAClC,CAAC;QACF,mBAAmB,EAAE,IAAI,mBAAmB,EAAE;QAC9C,YAAY,EAAE,IAAI,YAAY,CAAC;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC;SACzE,CAAC;QACF,aAAa,EAAE,IAAI,aAAa,CAAC;YAC/B,eAAe,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;YACrC,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;KACH,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEhD,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqC;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,GAAG,iBAAiB,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,YAAY,gCAAgC,iBAAiB,GAAG,CAAC,CAAC;IAC1G,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,+BAA+B;AAC/B,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,sBAAsB,CAAC;AAE9B,oCAAoC;AACpC,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,GAIpB,MAAM,2BAA2B,CAAC;AAEnC,sCAAsC;AACtC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,GAIvB,MAAM,oBAAoB,CAAC;AAE5B,+BAA+B;AAC/B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,GAG/B,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY;AACZ,eAAe;AACf,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ;AACR,eAAe;AACf,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB;AAClB,uBAAuB;AACvB,eAAe,EACf,gBAAgB,EAChB,eAAe;AACf,yBAAyB;AACzB,qBAAqB,EACrB,UAAU;AACV,iBAAiB;AACjB,oBAAoB,EACpB,oBAAoB;AACpB,YAAY;AACZ,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAE9B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GAKd,MAAM,sBAAsB,CAAC;AAE9B,8EAA8E;AAC9E,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,GAOjB,MAAM,4BAA4B,CAAC;AAEpC,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,yBAAyB,GAI1B,MAAM,+BAA+B,CAAC;AAEvC,6DAA6D;AAC7D,0EAA0E;AAC1E,0DAA0D;AAC1D,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,GAQX,MAAM,iCAAiC,CAAC;AAEzC,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwCtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA4B;IAC/D,OAAO;QACL,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;SAClC,CAAC;QACF,mBAAmB,EAAE,IAAI,mBAAmB,EAAE;QAC9C,YAAY,EAAE,IAAI,YAAY,CAAC;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC;SAClE,CAAC;QACF,aAAa,EAAE,IAAI,aAAa,CAAC;YAC/B,eAAe,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;YACrC,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;KACH,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEhD,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqC;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,GAAG,iBAAiB,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,YAAY,gCAAgC,iBAAiB,GAAG,CAAC,CAAC;IAC1G,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC"}

package/dist/password-hasher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-hasher.d.ts","sourceRoot":"","sources":["../src/password-hasher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;aAGxB,IAAI,EAAE,MAAM;gBAD5B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM;CAK/B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;gBAE5C,MAAM,GAAE,oBAAyB;IA2B7C;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB;IAsCpD;;;;;;OAMG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAqB7C;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB9D;;;;;;OAMG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAelC;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAMzB;;OAEG;IACH,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,CAAC;CAGnE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,SAAK,GAAG,cAAc,CAEhE"}
+{"version":3,"file":"password-hasher.d.ts","sourceRoot":"","sources":["../src/password-hasher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAWH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;aAGxB,IAAI,EAAE,MAAM;gBAD5B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM;CAK/B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;gBAE5C,MAAM,GAAE,oBAAyB;IA2B7C;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB;IAsCpD;;;;;;OAMG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAqB7C;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB9D;;;;;;OAMG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAelC;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAMzB;;OAEG;IACH,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,CAAC;CAGnE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,SAAK,GAAG,cAAc,CAEhE"}

package/dist/password-hasher.js

@@ -12,7 +12,14 @@
  *
  * @module v3/security/password-hasher
  */
-import * as bcrypt from 'bcrypt';
+// #1608 — switched from `bcrypt` to `bcryptjs` to drop the
+// `@mapbox/node-pre-gyp → tar <=7.5.10` transitive chain that pulled in
+// 6 HIGH-severity CVEs (GHSA-34x7-hfp2-rc4v, GHSA-8qq5-rm4j-mr97, etc.).
+// `bcryptjs` is a pure-JS implementation that produces the same `$2a$` /
+// `$2b$` hash format and exposes the same `hash()` / `compare()` API
+// surface this module uses, so the swap is transparent to callers and to
+// any persisted hashes.
+import * as bcrypt from 'bcryptjs';
 export class PasswordHashError extends Error {
     code;
     constructor(message, code) {

package/dist/password-hasher.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-hasher.js","sourceRoot":"","sources":["../src/password-hasher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAoDjC,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAGxB;IAFlB,YACE,OAAe,EACC,IAAY;QAE5B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,cAAc;IACR,MAAM,CAAiC;IAExD,YAAY,SAA+B,EAAE;QAC3C,IAAI,CAAC,MAAM,GAAG;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,CAAC;YAChC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,GAAG;YAClC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;YACjD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;YACjD,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;YACzC,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,KAAK;SAC/C,CAAC;QAEF,yBAAyB;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACvD,MAAM,IAAI,iBAAiB,CACzB,8EAA8E,EAC9E,gBAAgB,CACjB,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CACzB,uDAAuD,EACvD,oBAAoB,CACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,QAAgB;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,CAAC,MAAM,CAAC,SAAS,aAAa,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,MAAM,CAAC,SAAS,aAAa,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,uCAAuC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1F,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACtE,CAAC;QAED,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC5B,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE3C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CACzB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,mBAAmB,CACpB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,wDAAwD;YACxD,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,EACzB,aAAa,CACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,IAAY;QACzC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,sEAAsE;QACtE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,6CAA6C;YAC7C,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sDAAsD;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,IAAY;QACtB,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,gDAAgD;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,IAAY;QACpC,oDAAoD;QACpD,8BAA8B;QAC9B,OAAO,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAM,GAAG,EAAE;IAC9C,OAAO,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"password-hasher.js","sourceRoot":"","sources":["../src/password-hasher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,2DAA2D;AAC3D,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,qEAAqE;AACrE,yEAAyE;AACzE,wBAAwB;AACxB,OAAO,KAAK,MAAM,MAAM,UAAU,CAAC;AAoDnC,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAGxB;IAFlB,YACE,OAAe,EACC,IAAY;QAE5B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,cAAc;IACR,MAAM,CAAiC;IAExD,YAAY,SAA+B,EAAE;QAC3C,IAAI,CAAC,MAAM,GAAG;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,CAAC;YAChC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,GAAG;YAClC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;YACjD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;YACjD,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;YACzC,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,KAAK;SAC/C,CAAC;QAEF,yBAAyB;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACvD,MAAM,IAAI,iBAAiB,CACzB,8EAA8E,EAC9E,gBAAgB,CACjB,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CACzB,uDAAuD,EACvD,oBAAoB,CACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,QAAgB;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,CAAC,MAAM,CAAC,SAAS,aAAa,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,MAAM,CAAC,SAAS,aAAa,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,uCAAuC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1F,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACtE,CAAC;QAED,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC5B,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE3C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CACzB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,mBAAmB,CACpB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,wDAAwD;YACxD,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,EACzB,aAAa,CACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,IAAY;QACzC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,sEAAsE;QACtE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,6CAA6C;YAC7C,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sDAAsD;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,IAAY;QACtB,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,gDAAgD;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,IAAY;QACpC,oDAAoD;QACpD,8BAA8B;QAC9B,OAAO,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAM,GAAG,EAAE;IAC9C,OAAO,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC"}