@claude-flow/security 3.0.0-alpha.1

package/dist/index.d.ts

@@ -0,0 +1,119 @@
+/**
+ * V3 Security Module
+ *
+ * Comprehensive security module addressing all identified vulnerabilities:
+ * - CVE-2: Weak Password Hashing (password-hasher.ts)
+ * - CVE-3: Hardcoded Default Credentials (credential-generator.ts)
+ * - HIGH-1: Command Injection (safe-executor.ts)
+ * - HIGH-2: Path Traversal (path-validator.ts)
+ *
+ * Also provides:
+ * - Input validation with Zod schemas
+ * - Secure token generation
+ *
+ * @module v3/security
+ */
+export { PasswordHasher, PasswordHashError, createPasswordHasher, type PasswordHasherConfig, type PasswordValidationResult, } from './password-hasher.js';
+export { CredentialGenerator, CredentialGeneratorError, createCredentialGenerator, generateCredentials, type CredentialConfig, type GeneratedCredentials, type ApiKeyCredential, } from './credential-generator.js';
+export { SafeExecutor, SafeExecutorError, createDevelopmentExecutor, createReadOnlyExecutor, type ExecutorConfig, type ExecutionResult, type StreamingExecutor, } from './safe-executor.js';
+export { PathValidator, PathValidatorError, createProjectPathValidator, createFullProjectPathValidator, type PathValidatorConfig, type PathValidationResult, } from './path-validator.js';
+export { InputValidator, sanitizeString, sanitizeHtml, sanitizePath, SafeStringSchema, IdentifierSchema, FilenameSchema, EmailSchema, PasswordSchema, UUIDSchema, HttpsUrlSchema, UrlSchema, SemverSchema, PortSchema, IPv4Schema, IPSchema, UserRoleSchema, PermissionSchema, LoginRequestSchema, CreateUserSchema, CreateApiKeySchema, AgentTypeSchema, SpawnAgentSchema, TaskInputSchema, CommandArgumentSchema, PathSchema, SecurityConfigSchema, ExecutorConfigSchema, PATTERNS, LIMITS, z, } from './input-validator.js';
+export { TokenGenerator, TokenGeneratorError, createTokenGenerator, getDefaultGenerator, quickGenerate, type TokenConfig, type Token, type SignedToken, type VerificationCode, } from './token-generator.js';
+import { PasswordHasher } from './password-hasher.js';
+import { CredentialGenerator } from './credential-generator.js';
+import { SafeExecutor } from './safe-executor.js';
+import { PathValidator } from './path-validator.js';
+import { TokenGenerator } from './token-generator.js';
+/**
+ * Security module configuration
+ */
+export interface SecurityModuleConfig {
+    /**
+     * Project root directory for path validation
+     */
+    projectRoot: string;
+    /**
+     * HMAC secret for token signing
+     */
+    hmacSecret: string;
+    /**
+     * Bcrypt rounds for password hashing
+     * Default: 12
+     */
+    bcryptRounds?: number;
+    /**
+     * Allowed commands for safe executor
+     * Default: ['git', 'npm', 'npx', 'node']
+     */
+    allowedCommands?: string[];
+}
+/**
+ * Complete security module instance
+ */
+export interface SecurityModule {
+    passwordHasher: PasswordHasher;
+    credentialGenerator: CredentialGenerator;
+    safeExecutor: SafeExecutor;
+    pathValidator: PathValidator;
+    tokenGenerator: TokenGenerator;
+}
+/**
+ * Creates a complete security module with all components configured.
+ *
+ * @param config - Module configuration
+ * @returns Complete security module
+ *
+ * @example
+ * ```typescript
+ * const security = createSecurityModule({
+ *   projectRoot: '/workspaces/project',
+ *   hmacSecret: process.env.HMAC_SECRET!,
+ * });
+ *
+ * // Hash password
+ * const hash = await security.passwordHasher.hash('password');
+ *
+ * // Validate path
+ * const result = await security.pathValidator.validate('/workspaces/project/src/file.ts');
+ *
+ * // Execute command safely
+ * const output = await security.safeExecutor.execute('git', ['status']);
+ * ```
+ */
+export declare function createSecurityModule(config: SecurityModuleConfig): SecurityModule;
+/**
+ * Minimum recommended bcrypt rounds for production
+ */
+export declare const MIN_BCRYPT_ROUNDS = 12;
+/**
+ * Maximum recommended bcrypt rounds (performance consideration)
+ */
+export declare const MAX_BCRYPT_ROUNDS = 14;
+/**
+ * Minimum password length
+ */
+export declare const MIN_PASSWORD_LENGTH = 8;
+/**
+ * Maximum password length (bcrypt limitation)
+ */
+export declare const MAX_PASSWORD_LENGTH = 72;
+/**
+ * Default token expiration in seconds (1 hour)
+ */
+export declare const DEFAULT_TOKEN_EXPIRATION = 3600;
+/**
+ * Default session expiration in seconds (24 hours)
+ */
+export declare const DEFAULT_SESSION_EXPIRATION = 86400;
+/**
+ * Checks security configuration for common issues.
+ *
+ * @param config - Configuration to audit
+ * @returns Array of security warnings
+ */
+export declare function auditSecurityConfig(config: Partial<SecurityModuleConfig>): string[];
+/**
+ * Security module version
+ */
+export declare const SECURITY_MODULE_VERSION = "3.0.0-alpha.1";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EAEZ,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ,EAER,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAElB,eAAe,EACf,gBAAgB,EAChB,eAAe,EAEf,qBAAqB,EACrB,UAAU,EAEV,oBAAoB,EACpB,oBAAoB,EAEpB,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,cAAc,CAAC;IAC/B,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CAiBjF;AAMD;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,0BAA0B,QAAQ,CAAC;AAMhD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,EAAE,CAoBnF;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,145 @@
+/**
+ * V3 Security Module
+ *
+ * Comprehensive security module addressing all identified vulnerabilities:
+ * - CVE-2: Weak Password Hashing (password-hasher.ts)
+ * - CVE-3: Hardcoded Default Credentials (credential-generator.ts)
+ * - HIGH-1: Command Injection (safe-executor.ts)
+ * - HIGH-2: Path Traversal (path-validator.ts)
+ *
+ * Also provides:
+ * - Input validation with Zod schemas
+ * - Secure token generation
+ *
+ * @module v3/security
+ */
+// Password Hashing (CVE-2 Fix)
+export { PasswordHasher, PasswordHashError, createPasswordHasher, } from './password-hasher.js';
+// Credential Generation (CVE-3 Fix)
+export { CredentialGenerator, CredentialGeneratorError, createCredentialGenerator, generateCredentials, } from './credential-generator.js';
+// Safe Command Execution (HIGH-1 Fix)
+export { SafeExecutor, SafeExecutorError, createDevelopmentExecutor, createReadOnlyExecutor, } from './safe-executor.js';
+// Path Validation (HIGH-2 Fix)
+export { PathValidator, PathValidatorError, createProjectPathValidator, createFullProjectPathValidator, } from './path-validator.js';
+// Input Validation
+export { InputValidator, sanitizeString, sanitizeHtml, sanitizePath, 
+// Base schemas
+SafeStringSchema, IdentifierSchema, FilenameSchema, EmailSchema, PasswordSchema, UUIDSchema, HttpsUrlSchema, UrlSchema, SemverSchema, PortSchema, IPv4Schema, IPSchema, 
+// Auth schemas
+UserRoleSchema, PermissionSchema, LoginRequestSchema, CreateUserSchema, CreateApiKeySchema, 
+// Agent & Task schemas
+AgentTypeSchema, SpawnAgentSchema, TaskInputSchema, 
+// Command & Path schemas
+CommandArgumentSchema, PathSchema, 
+// Config schemas
+SecurityConfigSchema, ExecutorConfigSchema, 
+// Utilities
+PATTERNS, LIMITS, z, } from './input-validator.js';
+// Token Generation
+export { TokenGenerator, TokenGeneratorError, createTokenGenerator, getDefaultGenerator, quickGenerate, } from './token-generator.js';
+// ============================================================================
+// Convenience Factory Functions
+// ============================================================================
+import { PasswordHasher } from './password-hasher.js';
+import { CredentialGenerator } from './credential-generator.js';
+import { SafeExecutor } from './safe-executor.js';
+import { PathValidator } from './path-validator.js';
+import { TokenGenerator } from './token-generator.js';
+/**
+ * Creates a complete security module with all components configured.
+ *
+ * @param config - Module configuration
+ * @returns Complete security module
+ *
+ * @example
+ * ```typescript
+ * const security = createSecurityModule({
+ *   projectRoot: '/workspaces/project',
+ *   hmacSecret: process.env.HMAC_SECRET!,
+ * });
+ *
+ * // Hash password
+ * const hash = await security.passwordHasher.hash('password');
+ *
+ * // Validate path
+ * const result = await security.pathValidator.validate('/workspaces/project/src/file.ts');
+ *
+ * // Execute command safely
+ * const output = await security.safeExecutor.execute('git', ['status']);
+ * ```
+ */
+export function createSecurityModule(config) {
+    return {
+        passwordHasher: new PasswordHasher({
+            rounds: config.bcryptRounds ?? 12,
+        }),
+        credentialGenerator: new CredentialGenerator(),
+        safeExecutor: new SafeExecutor({
+            allowedCommands: config.allowedCommands ?? ['git', 'npm', 'npx', 'node'],
+        }),
+        pathValidator: new PathValidator({
+            allowedPrefixes: [config.projectRoot],
+            allowHidden: true,
+        }),
+        tokenGenerator: new TokenGenerator({
+            hmacSecret: config.hmacSecret,
+        }),
+    };
+}
+// ============================================================================
+// Security Constants
+// ============================================================================
+/**
+ * Minimum recommended bcrypt rounds for production
+ */
+export const MIN_BCRYPT_ROUNDS = 12;
+/**
+ * Maximum recommended bcrypt rounds (performance consideration)
+ */
+export const MAX_BCRYPT_ROUNDS = 14;
+/**
+ * Minimum password length
+ */
+export const MIN_PASSWORD_LENGTH = 8;
+/**
+ * Maximum password length (bcrypt limitation)
+ */
+export const MAX_PASSWORD_LENGTH = 72;
+/**
+ * Default token expiration in seconds (1 hour)
+ */
+export const DEFAULT_TOKEN_EXPIRATION = 3600;
+/**
+ * Default session expiration in seconds (24 hours)
+ */
+export const DEFAULT_SESSION_EXPIRATION = 86400;
+// ============================================================================
+// Security Audit Helper
+// ============================================================================
+/**
+ * Checks security configuration for common issues.
+ *
+ * @param config - Configuration to audit
+ * @returns Array of security warnings
+ */
+export function auditSecurityConfig(config) {
+    const warnings = [];
+    if (config.bcryptRounds && config.bcryptRounds < MIN_BCRYPT_ROUNDS) {
+        warnings.push(`bcryptRounds (${config.bcryptRounds}) below recommended minimum (${MIN_BCRYPT_ROUNDS})`);
+    }
+    if (config.hmacSecret && config.hmacSecret.length < 32) {
+        warnings.push('hmacSecret should be at least 32 characters');
+    }
+    if (!config.projectRoot) {
+        warnings.push('projectRoot not configured - path validation may be disabled');
+    }
+    if (config.allowedCommands && config.allowedCommands.length === 0) {
+        warnings.push('No commands allowed - executor will reject all commands');
+    }
+    return warnings;
+}
+/**
+ * Security module version
+ */
+export const SECURITY_MODULE_VERSION = '3.0.0-alpha.1';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,+BAA+B;AAC/B,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,sBAAsB,CAAC;AAE9B,oCAAoC;AACpC,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,GAIpB,MAAM,2BAA2B,CAAC;AAEnC,sCAAsC;AACtC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,GAIvB,MAAM,oBAAoB,CAAC;AAE5B,+BAA+B;AAC/B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,GAG/B,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY;AACZ,eAAe;AACf,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ;AACR,eAAe;AACf,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB;AAClB,uBAAuB;AACvB,eAAe,EACf,gBAAgB,EAChB,eAAe;AACf,yBAAyB;AACzB,qBAAqB,EACrB,UAAU;AACV,iBAAiB;AACjB,oBAAoB,EACpB,oBAAoB;AACpB,YAAY;AACZ,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAE9B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GAKd,MAAM,sBAAsB,CAAC;AAE9B,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwCtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA4B;IAC/D,OAAO;QACL,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;SAClC,CAAC;QACF,mBAAmB,EAAE,IAAI,mBAAmB,EAAE;QAC9C,YAAY,EAAE,IAAI,YAAY,CAAC;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC;SACzE,CAAC;QACF,aAAa,EAAE,IAAI,aAAa,CAAC;YAC/B,eAAe,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;YACrC,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;KACH,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEhD,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqC;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,GAAG,iBAAiB,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,YAAY,gCAAgC,iBAAiB,GAAG,CAAC,CAAC;IAC1G,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC"}

package/dist/input-validator.d.ts

@@ -0,0 +1,306 @@
+/**
+ * Input Validator - Comprehensive Input Validation
+ *
+ * Provides Zod-based validation schemas for all security-critical inputs.
+ *
+ * Security Properties:
+ * - Type-safe validation
+ * - Custom error messages
+ * - Sanitization transforms
+ * - Reusable schemas
+ *
+ * @module v3/security/input-validator
+ */
+import { z } from 'zod';
+/**
+ * Common validation patterns as reusable regex
+ */
+declare const PATTERNS: {
+    SAFE_IDENTIFIER: RegExp;
+    SAFE_FILENAME: RegExp;
+    SAFE_PATH_SEGMENT: RegExp;
+    NO_SHELL_CHARS: RegExp;
+    SEMVER: RegExp;
+};
+/**
+ * Validation limits
+ */
+declare const LIMITS: {
+    MIN_PASSWORD_LENGTH: number;
+    MAX_PASSWORD_LENGTH: number;
+    MAX_EMAIL_LENGTH: number;
+    MAX_IDENTIFIER_LENGTH: number;
+    MAX_PATH_LENGTH: number;
+    MAX_CONTENT_LENGTH: number;
+    MAX_ARRAY_LENGTH: number;
+    MAX_OBJECT_KEYS: number;
+};
+/**
+ * Safe string that cannot contain shell metacharacters
+ */
+export declare const SafeStringSchema: z.ZodString;
+/**
+ * Safe identifier for IDs, names, etc.
+ */
+export declare const IdentifierSchema: z.ZodString;
+/**
+ * Safe filename
+ */
+export declare const FilenameSchema: z.ZodString;
+/**
+ * Email schema with length limit
+ */
+export declare const EmailSchema: z.ZodString;
+/**
+ * Password schema with complexity requirements
+ */
+export declare const PasswordSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>;
+/**
+ * UUID schema
+ */
+export declare const UUIDSchema: z.ZodString;
+/**
+ * URL schema with HTTPS enforcement
+ */
+export declare const HttpsUrlSchema: z.ZodEffects<z.ZodString, string, string>;
+/**
+ * URL schema (allows HTTP for development)
+ */
+export declare const UrlSchema: z.ZodString;
+/**
+ * Semantic version schema
+ */
+export declare const SemverSchema: z.ZodString;
+/**
+ * Port number schema
+ */
+export declare const PortSchema: z.ZodNumber;
+/**
+ * IP address schema (v4)
+ */
+export declare const IPv4Schema: z.ZodString;
+/**
+ * IP address schema (v4 or v6)
+ */
+export declare const IPSchema: z.ZodString;
+/**
+ * User role schema
+ */
+export declare const UserRoleSchema: z.ZodEnum<["admin", "operator", "developer", "viewer", "service"]>;
+/**
+ * Permission schema
+ */
+export declare const PermissionSchema: z.ZodEnum<["swarm.create", "swarm.read", "swarm.update", "swarm.delete", "swarm.scale", "agent.spawn", "agent.read", "agent.terminate", "task.create", "task.read", "task.cancel", "metrics.read", "system.admin", "api.access"]>;
+/**
+ * Login request schema
+ */
+export declare const LoginRequestSchema: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+    mfaCode: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+    password: string;
+    mfaCode?: string | undefined;
+}, {
+    email: string;
+    password: string;
+    mfaCode?: string | undefined;
+}>;
+/**
+ * User creation schema
+ */
+export declare const CreateUserSchema: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>;
+    role: z.ZodEnum<["admin", "operator", "developer", "viewer", "service"]>;
+    permissions: z.ZodOptional<z.ZodArray<z.ZodEnum<["swarm.create", "swarm.read", "swarm.update", "swarm.delete", "swarm.scale", "agent.spawn", "agent.read", "agent.terminate", "task.create", "task.read", "task.cancel", "metrics.read", "system.admin", "api.access"]>, "many">>;
+    isActive: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+    password: string;
+    role: "admin" | "operator" | "developer" | "viewer" | "service";
+    isActive: boolean;
+    permissions?: ("swarm.create" | "swarm.read" | "swarm.update" | "swarm.delete" | "swarm.scale" | "agent.spawn" | "agent.read" | "agent.terminate" | "task.create" | "task.read" | "task.cancel" | "metrics.read" | "system.admin" | "api.access")[] | undefined;
+}, {
+    email: string;
+    password: string;
+    role: "admin" | "operator" | "developer" | "viewer" | "service";
+    permissions?: ("swarm.create" | "swarm.read" | "swarm.update" | "swarm.delete" | "swarm.scale" | "agent.spawn" | "agent.read" | "agent.terminate" | "task.create" | "task.read" | "task.cancel" | "metrics.read" | "system.admin" | "api.access")[] | undefined;
+    isActive?: boolean | undefined;
+}>;
+/**
+ * API key creation schema
+ */
+export declare const CreateApiKeySchema: z.ZodObject<{
+    name: z.ZodString;
+    permissions: z.ZodOptional<z.ZodArray<z.ZodEnum<["swarm.create", "swarm.read", "swarm.update", "swarm.delete", "swarm.scale", "agent.spawn", "agent.read", "agent.terminate", "task.create", "task.read", "task.cancel", "metrics.read", "system.admin", "api.access"]>, "many">>;
+    expiresAt: z.ZodOptional<z.ZodDate>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    permissions?: ("swarm.create" | "swarm.read" | "swarm.update" | "swarm.delete" | "swarm.scale" | "agent.spawn" | "agent.read" | "agent.terminate" | "task.create" | "task.read" | "task.cancel" | "metrics.read" | "system.admin" | "api.access")[] | undefined;
+    expiresAt?: Date | undefined;
+}, {
+    name: string;
+    permissions?: ("swarm.create" | "swarm.read" | "swarm.update" | "swarm.delete" | "swarm.scale" | "agent.spawn" | "agent.read" | "agent.terminate" | "task.create" | "task.read" | "task.cancel" | "metrics.read" | "system.admin" | "api.access")[] | undefined;
+    expiresAt?: Date | undefined;
+}>;
+/**
+ * Agent type schema
+ */
+export declare const AgentTypeSchema: z.ZodEnum<["coder", "reviewer", "tester", "planner", "researcher", "security-architect", "security-auditor", "memory-specialist", "swarm-specialist", "integration-architect", "performance-engineer", "core-architect", "test-architect", "queen-coordinator", "project-coordinator"]>;
+/**
+ * Agent spawn request schema
+ */
+export declare const SpawnAgentSchema: z.ZodObject<{
+    type: z.ZodEnum<["coder", "reviewer", "tester", "planner", "researcher", "security-architect", "security-auditor", "memory-specialist", "swarm-specialist", "integration-architect", "performance-engineer", "core-architect", "test-architect", "queen-coordinator", "project-coordinator"]>;
+    id: z.ZodOptional<z.ZodString>;
+    config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    timeout: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    type: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
+    config?: Record<string, unknown> | undefined;
+    timeout?: number | undefined;
+    id?: string | undefined;
+}, {
+    type: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
+    config?: Record<string, unknown> | undefined;
+    timeout?: number | undefined;
+    id?: string | undefined;
+}>;
+/**
+ * Task input schema
+ */
+export declare const TaskInputSchema: z.ZodObject<{
+    taskId: z.ZodString;
+    content: z.ZodString;
+    agentType: z.ZodEnum<["coder", "reviewer", "tester", "planner", "researcher", "security-architect", "security-auditor", "memory-specialist", "swarm-specialist", "integration-architect", "performance-engineer", "core-architect", "test-architect", "queen-coordinator", "project-coordinator"]>;
+    priority: z.ZodOptional<z.ZodEnum<["low", "medium", "high", "critical"]>>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    taskId: string;
+    content: string;
+    agentType: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
+    priority?: "critical" | "high" | "medium" | "low" | undefined;
+    metadata?: Record<string, unknown> | undefined;
+}, {
+    taskId: string;
+    content: string;
+    agentType: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
+    priority?: "critical" | "high" | "medium" | "low" | undefined;
+    metadata?: Record<string, unknown> | undefined;
+}>;
+/**
+ * Command argument schema
+ */
+export declare const CommandArgumentSchema: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+/**
+ * Path schema
+ */
+export declare const PathSchema: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+/**
+ * Security configuration schema
+ */
+export declare const SecurityConfigSchema: z.ZodObject<{
+    bcryptRounds: z.ZodDefault<z.ZodNumber>;
+    jwtExpiresIn: z.ZodDefault<z.ZodString>;
+    sessionTimeout: z.ZodDefault<z.ZodNumber>;
+    maxLoginAttempts: z.ZodDefault<z.ZodNumber>;
+    lockoutDuration: z.ZodDefault<z.ZodNumber>;
+    requireMFA: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    bcryptRounds: number;
+    jwtExpiresIn: string;
+    sessionTimeout: number;
+    maxLoginAttempts: number;
+    lockoutDuration: number;
+    requireMFA: boolean;
+}, {
+    bcryptRounds?: number | undefined;
+    jwtExpiresIn?: string | undefined;
+    sessionTimeout?: number | undefined;
+    maxLoginAttempts?: number | undefined;
+    lockoutDuration?: number | undefined;
+    requireMFA?: boolean | undefined;
+}>;
+/**
+ * Executor configuration schema
+ */
+export declare const ExecutorConfigSchema: z.ZodObject<{
+    allowedCommands: z.ZodArray<z.ZodString, "many">;
+    blockedPatterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    timeout: z.ZodDefault<z.ZodNumber>;
+    maxBuffer: z.ZodDefault<z.ZodNumber>;
+    cwd: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>;
+    allowSudo: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    allowedCommands: string[];
+    timeout: number;
+    maxBuffer: number;
+    allowSudo: boolean;
+    blockedPatterns?: string[] | undefined;
+    cwd?: string | undefined;
+}, {
+    allowedCommands: string[];
+    blockedPatterns?: string[] | undefined;
+    timeout?: number | undefined;
+    maxBuffer?: number | undefined;
+    cwd?: string | undefined;
+    allowSudo?: boolean | undefined;
+}>;
+/**
+ * Sanitizes a string by removing dangerous characters
+ */
+export declare function sanitizeString(input: string): string;
+/**
+ * Sanitizes HTML entities
+ */
+export declare function sanitizeHtml(input: string): string;
+/**
+ * Sanitizes a path by removing traversal patterns
+ */
+export declare function sanitizePath(input: string): string;
+export declare class InputValidator {
+    /**
+     * Validates input against a schema
+     */
+    static validate<T>(schema: z.ZodSchema<T>, input: unknown): T;
+    /**
+     * Safely validates input, returning result
+     */
+    static safeParse<T>(schema: z.ZodSchema<T>, input: unknown): z.SafeParseReturnType<unknown, T>;
+    /**
+     * Validates email
+     */
+    static validateEmail(email: string): string;
+    /**
+     * Validates password
+     */
+    static validatePassword(password: string): string;
+    /**
+     * Validates identifier
+     */
+    static validateIdentifier(id: string): string;
+    /**
+     * Validates path
+     */
+    static validatePath(path: string): string;
+    /**
+     * Validates command argument
+     */
+    static validateCommandArg(arg: string): string;
+    /**
+     * Validates login request
+     */
+    static validateLoginRequest(data: unknown): z.infer<typeof LoginRequestSchema>;
+    /**
+     * Validates user creation request
+     */
+    static validateCreateUser(data: unknown): z.infer<typeof CreateUserSchema>;
+    /**
+     * Validates task input
+     */
+    static validateTaskInput(data: unknown): z.infer<typeof TaskInputSchema>;
+}
+export { z, PATTERNS, LIMITS, };
+//# sourceMappingURL=input-validator.d.ts.map

package/dist/input-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-validator.d.ts","sourceRoot":"","sources":["../src/input-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA8BxB;;GAEG;AACH,QAAA,MAAM,QAAQ;;;;;;CAeb,CAAC;AAEF;;GAEG;AACH,QAAA,MAAM,MAAM;;;;;;;;;CASX,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,gBAAgB,aAG0C,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,gBAAgB,aAGkC,CAAC;AAEhE;;GAEG;AACH,eAAO,MAAM,cAAc,aAGgC,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,WAAW,aAGR,CAAC;AAEjB;;GAEG;AACH,eAAO,MAAM,cAAc,uGAKsC,CAAC;AAElE;;GAEG;AACH,eAAO,MAAM,UAAU,aAAyC,CAAC;AAEjE;;GAEG;AACH,eAAO,MAAM,cAAc,2CAKxB,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,SAAS,aACM,CAAC;AAE7B;;GAEG;AACH,eAAO,MAAM,YAAY,aACmC,CAAC;AAE7D;;GAEG;AACH,eAAO,MAAM,UAAU,aAGoB,CAAC;AAE5C;;GAEG;AACH,eAAO,MAAM,UAAU,aACkC,CAAC;AAE1D;;GAEG;AACH,eAAO,MAAM,QAAQ,aACmB,CAAC;AAMzC;;GAEG;AACH,eAAO,MAAM,cAAc,oEAMzB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,gBAAgB,mOAe3B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;EAI7B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;EAM3B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;EAI7B,CAAC;AAMH;;GAEG;AACH,eAAO,MAAM,eAAe,yRAgB1B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;EAK3B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;EAM1B,CAAC;AAMH;;GAEG;AACH,eAAO,MAAM,qBAAqB,yEAS/B,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,UAAU,yEASpB,CAAC;AAMJ;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;EAO/B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;EAO/B,CAAC;AAMH;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOpD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOlD;AAMD,qBAAa,cAAc;IACzB;;OAEG;IACH,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC;IAI7D;;OAEG;IACH,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,CAAC,CAAC;IAI9F;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAI3C;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAIjD;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM;IAI7C;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAIzC;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAI9C;;OAEG;IACH,MAAM,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC;IAI9E;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC;IAI1E;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC;CAGzE;AAMD,OAAO,EACL,CAAC,EACD,QAAQ,EACR,MAAM,GACP,CAAC"}