@dollhousemcp/mcp-server 1.3.0

package/dist/security/audit/types.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Security Audit Types and Interfaces
+ * Part of the Security Audit Automation system (Issue #53)
+ */
+export type SeverityLevel = 'info' | 'low' | 'medium' | 'high' | 'critical';
+export interface SecurityRule {
+    id: string;
+    name: string;
+    description: string;
+    severity: SeverityLevel;
+    category: 'code' | 'dependency' | 'configuration' | 'custom';
+    pattern?: RegExp;
+    check?: (content: string, context?: ScanContext) => SecurityFinding[];
+    remediation: string;
+    references?: string[];
+    tags?: string[];
+}
+export interface SecurityFinding {
+    ruleId: string;
+    severity: SeverityLevel;
+    message: string;
+    file?: string;
+    line?: number;
+    column?: number;
+    code?: string;
+    remediation: string;
+    confidence: 'low' | 'medium' | 'high';
+    falsePositive?: boolean;
+}
+export interface ScanContext {
+    projectRoot: string;
+    fileType?: string;
+    isTest?: boolean;
+    metadata?: Record<string, any>;
+}
+export interface ScanResult {
+    timestamp: Date;
+    duration: number;
+    scannedFiles: number;
+    findings: SecurityFinding[];
+    summary: {
+        total: number;
+        bySeverity: Record<SeverityLevel, number>;
+        byCategory: Record<string, number>;
+    };
+    errors?: string[];
+}
+export interface SecurityAuditConfig {
+    enabled: boolean;
+    scanners: {
+        code: {
+            enabled: boolean;
+            rules: string[];
+            exclude?: string[];
+        };
+        dependencies: {
+            enabled: boolean;
+            severityThreshold: SeverityLevel;
+            checkLicenses: boolean;
+            allowedLicenses?: string[];
+        };
+        configuration: {
+            enabled: boolean;
+            checkFiles: string[];
+        };
+        custom?: {
+            enabled: boolean;
+            rules: SecurityRule[];
+        };
+    };
+    reporting: {
+        formats: ('console' | 'markdown' | 'json' | 'sarif')[];
+        createIssues: boolean;
+        commentOnPr: boolean;
+        failOnSeverity: SeverityLevel;
+        verbose?: boolean;
+    };
+    suppressions?: {
+        rule: string;
+        file?: string;
+        reason: string;
+    }[];
+}
+export interface SecurityReport {
+    generate(): string | object;
+    getSummary(): string;
+    getFindings(): SecurityFinding[];
+}
+export interface SecurityScanner {
+    name: string;
+    scan(context: ScanContext): Promise<SecurityFinding[]>;
+    isEnabled(): boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/security/audit/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/security/audit/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE5E,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,aAAa,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,eAAe,GAAG,QAAQ,CAAC;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,KAAK,eAAe,EAAE,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACtC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC1C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE;QACR,IAAI,EAAE;YACJ,OAAO,EAAE,OAAO,CAAC;YACjB,KAAK,EAAE,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;SACpB,CAAC;QACF,YAAY,EAAE;YACZ,OAAO,EAAE,OAAO,CAAC;YACjB,iBAAiB,EAAE,aAAa,CAAC;YACjC,aAAa,EAAE,OAAO,CAAC;YACvB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5B,CAAC;QACF,aAAa,EAAE;YACb,OAAO,EAAE,OAAO,CAAC;YACjB,UAAU,EAAE,MAAM,EAAE,CAAC;SACtB,CAAC;QACF,MAAM,CAAC,EAAE;YACP,OAAO,EAAE,OAAO,CAAC;YACjB,KAAK,EAAE,YAAY,EAAE,CAAC;SACvB,CAAC;KACH,CAAC;IACF,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;QACvD,YAAY,EAAE,OAAO,CAAC;QACtB,WAAW,EAAE,OAAO,CAAC;QACrB,cAAc,EAAE,aAAa,CAAC;QAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAChB,EAAE,CAAC;CACL;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,IAAI,MAAM,GAAG,MAAM,CAAC;IAC5B,UAAU,IAAI,MAAM,CAAC;IACrB,WAAW,IAAI,eAAe,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACvD,SAAS,IAAI,OAAO,CAAC;CACtB"}

package/dist/security/audit/types.js

@@ -0,0 +1,6 @@
+/**
+ * Security Audit Types and Interfaces
+ * Part of the Security Audit Automation system (Issue #53)
+ */
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvc2VjdXJpdHkvYXVkaXQvdHlwZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7OztHQUdHIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBTZWN1cml0eSBBdWRpdCBUeXBlcyBhbmQgSW50ZXJmYWNlc1xuICogUGFydCBvZiB0aGUgU2VjdXJpdHkgQXVkaXQgQXV0b21hdGlvbiBzeXN0ZW0gKElzc3VlICM1MylcbiAqL1xuXG5leHBvcnQgdHlwZSBTZXZlcml0eUxldmVsID0gJ2luZm8nIHwgJ2xvdycgfCAnbWVkaXVtJyB8ICdoaWdoJyB8ICdjcml0aWNhbCc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgU2VjdXJpdHlSdWxlIHtcbiAgaWQ6IHN0cmluZztcbiAgbmFtZTogc3RyaW5nO1xuICBkZXNjcmlwdGlvbjogc3RyaW5nO1xuICBzZXZlcml0eTogU2V2ZXJpdHlMZXZlbDtcbiAgY2F0ZWdvcnk6ICdjb2RlJyB8ICdkZXBlbmRlbmN5JyB8ICdjb25maWd1cmF0aW9uJyB8ICdjdXN0b20nO1xuICBwYXR0ZXJuPzogUmVnRXhwO1xuICBjaGVjaz86IChjb250ZW50OiBzdHJpbmcsIGNvbnRleHQ/OiBTY2FuQ29udGV4dCkgPT4gU2VjdXJpdHlGaW5kaW5nW107XG4gIHJlbWVkaWF0aW9uOiBzdHJpbmc7XG4gIHJlZmVyZW5jZXM/OiBzdHJpbmdbXTtcbiAgdGFncz86IHN0cmluZ1tdO1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIFNlY3VyaXR5RmluZGluZyB7XG4gIHJ1bGVJZDogc3RyaW5nO1xuICBzZXZlcml0eTogU2V2ZXJpdHlMZXZlbDtcbiAgbWVzc2FnZTogc3RyaW5nO1xuICBmaWxlPzogc3RyaW5nO1xuICBsaW5lPzogbnVtYmVyO1xuICBjb2x1bW4/OiBudW1iZXI7XG4gIGNvZGU/OiBzdHJpbmc7XG4gIHJlbWVkaWF0aW9uOiBzdHJpbmc7XG4gIGNvbmZpZGVuY2U6ICdsb3cnIHwgJ21lZGl1bScgfCAnaGlnaCc7XG4gIGZhbHNlUG9zaXRpdmU/OiBib29sZWFuO1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIFNjYW5Db250ZXh0IHtcbiAgcHJvamVjdFJvb3Q6IHN0cmluZztcbiAgZmlsZVR5cGU/OiBzdHJpbmc7XG4gIGlzVGVzdD86IGJvb2xlYW47XG4gIG1ldGFkYXRhPzogUmVjb3JkPHN0cmluZywgYW55Pjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBTY2FuUmVzdWx0IHtcbiAgdGltZXN0YW1wOiBEYXRlO1xuICBkdXJhdGlvbjogbnVtYmVyO1xuICBzY2FubmVkRmlsZXM6IG51bWJlcjtcbiAgZmluZGluZ3M6IFNlY3VyaXR5RmluZGluZ1tdO1xuICBzdW1tYXJ5OiB7XG4gICAgdG90YWw6IG51bWJlcjtcbiAgICBieVNldmVyaXR5OiBSZWNvcmQ8U2V2ZXJpdHlMZXZlbCwgbnVtYmVyPjtcbiAgICBieUNhdGVnb3J5OiBSZWNvcmQ8c3RyaW5nLCBudW1iZXI+O1xuICB9O1xuICBlcnJvcnM/OiBzdHJpbmdbXTtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBTZWN1cml0eUF1ZGl0Q29uZmlnIHtcbiAgZW5hYmxlZDogYm9vbGVhbjtcbiAgc2Nhbm5lcnM6IHtcbiAgICBjb2RlOiB7XG4gICAgICBlbmFibGVkOiBib29sZWFuO1xuICAgICAgcnVsZXM6IHN0cmluZ1tdO1xuICAgICAgZXhjbHVkZT86IHN0cmluZ1tdO1xuICAgIH07XG4gICAgZGVwZW5kZW5jaWVzOiB7XG4gICAgICBlbmFibGVkOiBib29sZWFuO1xuICAgICAgc2V2ZXJpdHlUaHJlc2hvbGQ6IFNldmVyaXR5TGV2ZWw7XG4gICAgICBjaGVja0xpY2Vuc2VzOiBib29sZWFuO1xuICAgICAgYWxsb3dlZExpY2Vuc2VzPzogc3RyaW5nW107XG4gICAgfTtcbiAgICBjb25maWd1cmF0aW9uOiB7XG4gICAgICBlbmFibGVkOiBib29sZWFuO1xuICAgICAgY2hlY2tGaWxlczogc3RyaW5nW107XG4gICAgfTtcbiAgICBjdXN0b20/OiB7XG4gICAgICBlbmFibGVkOiBib29sZWFuO1xuICAgICAgcnVsZXM6IFNlY3VyaXR5UnVsZVtdO1xuICAgIH07XG4gIH07XG4gIHJlcG9ydGluZzoge1xuICAgIGZvcm1hdHM6ICgnY29uc29sZScgfCAnbWFya2Rvd24nIHwgJ2pzb24nIHwgJ3NhcmlmJylbXTtcbiAgICBjcmVhdGVJc3N1ZXM6IGJvb2xlYW47XG4gICAgY29tbWVudE9uUHI6IGJvb2xlYW47XG4gICAgZmFpbE9uU2V2ZXJpdHk6IFNldmVyaXR5TGV2ZWw7XG4gICAgdmVyYm9zZT86IGJvb2xlYW47XG4gIH07XG4gIHN1cHByZXNzaW9ucz86IHtcbiAgICBydWxlOiBzdHJpbmc7XG4gICAgZmlsZT86IHN0cmluZztcbiAgICByZWFzb246IHN0cmluZztcbiAgfVtdO1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIFNlY3VyaXR5UmVwb3J0IHtcbiAgZ2VuZXJhdGUoKTogc3RyaW5nIHwgb2JqZWN0O1xuICBnZXRTdW1tYXJ5KCk6IHN0cmluZztcbiAgZ2V0RmluZGluZ3MoKTogU2VjdXJpdHlGaW5kaW5nW107XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgU2VjdXJpdHlTY2FubmVyIHtcbiAgbmFtZTogc3RyaW5nO1xuICBzY2FuKGNvbnRleHQ6IFNjYW5Db250ZXh0KTogUHJvbWlzZTxTZWN1cml0eUZpbmRpbmdbXT47XG4gIGlzRW5hYmxlZCgpOiBib29sZWFuO1xufSJdfQ==

package/dist/security/commandValidator.d.ts

@@ -0,0 +1,7 @@
+import { SpawnOptions } from 'child_process';
+export declare class CommandValidator {
+    static sanitizeCommand(cmd: string, args: string[]): void;
+    private static isSafeArgument;
+    static secureExec(command: string, args: string[], options?: SpawnOptions): Promise<string>;
+}
+//# sourceMappingURL=commandValidator.d.ts.map

package/dist/security/commandValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandValidator.d.ts","sourceRoot":"","sources":["../../src/security/commandValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,YAAY,EAAE,MAAM,eAAe,CAAC;AAWpD,qBAAa,gBAAgB;IAC3B,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI;IAczD,OAAO,CAAC,MAAM,CAAC,cAAc;WAKhB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;CA0DlG"}

package/dist/security/commandValidator.js

@@ -0,0 +1,78 @@
+import { spawn } from 'child_process';
+import { RegexValidator } from './regexValidator.js';
+const ALLOWED_COMMANDS = {
+    git: ['pull', 'status', 'log', 'rev-parse', 'branch', 'checkout', 'fetch', '--abbrev-ref', 'HEAD', '--porcelain'],
+    npm: ['install', 'run', 'audit', 'ci', '--version', 'build'],
+    node: ['--version'],
+    npx: ['--version']
+};
+export class CommandValidator {
+    static sanitizeCommand(cmd, args) {
+        if (!ALLOWED_COMMANDS[cmd]) {
+            throw new Error(`Command not allowed: ${cmd}`);
+        }
+        const allowedArgs = ALLOWED_COMMANDS[cmd];
+        for (const arg of args) {
+            // Check if it's in allowed list or matches safe pattern
+            if (!allowedArgs.includes(arg) && !this.isSafeArgument(arg)) {
+                throw new Error(`Argument not allowed: ${arg}`);
+            }
+        }
+    }
+    static isSafeArgument(arg) {
+        // Allow alphanumeric, dash, underscore, dot, and forward slash
+        return RegexValidator.validate(arg, /^[a-zA-Z0-9\-_.\/]+$/, { maxLength: 1000 });
+    }
+    static async secureExec(command, args, options) {
+        this.sanitizeCommand(command, args);
+        const safeOptions = {
+            ...options,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: {
+                ...process.env,
+                PATH: '/usr/bin:/bin:/usr/local/bin' // Restrict PATH
+            },
+            cwd: options?.cwd || process.cwd(),
+            timeout: options?.timeout || 30000 // 30 second default
+        };
+        return new Promise((resolve, reject) => {
+            const proc = spawn(command, args, safeOptions);
+            let stdout = '';
+            let stderr = '';
+            let timeoutHandle;
+            let isCompleted = false;
+            // Helper to safely resolve/reject only once
+            const complete = (fn) => {
+                if (!isCompleted) {
+                    isCompleted = true;
+                    if (timeoutHandle) {
+                        clearTimeout(timeoutHandle);
+                    }
+                    fn();
+                }
+            };
+            // Handle timeout
+            if (options?.timeout) {
+                timeoutHandle = setTimeout(() => {
+                    proc.kill('SIGTERM');
+                    complete(() => reject(new Error(`Command timed out after ${options.timeout}ms`)));
+                }, options.timeout);
+                timeoutHandle.unref();
+            }
+            proc.stdout?.on('data', (data) => stdout += data);
+            proc.stderr?.on('data', (data) => stderr += data);
+            proc.on('exit', (code) => {
+                if (code === 0) {
+                    complete(() => resolve(stdout.trim()));
+                }
+                else {
+                    complete(() => reject(new Error(`Command failed (${code}): ${stderr}`)));
+                }
+            });
+            proc.on('error', (error) => {
+                complete(() => reject(error));
+            });
+        });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tbWFuZFZhbGlkYXRvci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZWN1cml0eS9jb21tYW5kVmFsaWRhdG9yLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxLQUFLLEVBQWdCLE1BQU0sZUFBZSxDQUFDO0FBRXBELE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUVyRCxNQUFNLGdCQUFnQixHQUE2QjtJQUNqRCxHQUFHLEVBQUUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxXQUFXLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sRUFBRSxhQUFhLENBQUM7SUFDakgsR0FBRyxFQUFFLENBQUMsU0FBUyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLFdBQVcsRUFBRSxPQUFPLENBQUM7SUFDNUQsSUFBSSxFQUFFLENBQUMsV0FBVyxDQUFDO0lBQ25CLEdBQUcsRUFBRSxDQUFDLFdBQVcsQ0FBQztDQUNuQixDQUFDO0FBRUYsTUFBTSxPQUFPLGdCQUFnQjtJQUMzQixNQUFNLENBQUMsZUFBZSxDQUFDLEdBQVcsRUFBRSxJQUFjO1FBQ2hELElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzNCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0JBQXdCLEdBQUcsRUFBRSxDQUFDLENBQUM7UUFDakQsQ0FBQztRQUVELE1BQU0sV0FBVyxHQUFHLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzFDLEtBQUssTUFBTSxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7WUFDdkIsd0RBQXdEO1lBQ3hELElBQUksQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUM1RCxNQUFNLElBQUksS0FBSyxDQUFDLHlCQUF5QixHQUFHLEVBQUUsQ0FBQyxDQUFDO1lBQ2xELENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVPLE1BQU0sQ0FBQyxjQUFjLENBQUMsR0FBVztRQUN2QywrREFBK0Q7UUFDL0QsT0FBTyxjQUFjLENBQUMsUUFBUSxDQUFDLEdBQUcsRUFBRSxzQkFBc0IsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFFRCxNQUFNLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxPQUFlLEVBQUUsSUFBYyxFQUFFLE9BQXNCO1FBQzdFLElBQUksQ0FBQyxlQUFlLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBRXBDLE1BQU0sV0FBVyxHQUFpQjtZQUNoQyxHQUFHLE9BQU87WUFDVixLQUFLLEVBQUUsQ0FBQyxRQUFRLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQztZQUNqQyxHQUFHLEVBQUU7Z0JBQ0gsR0FBRyxPQUFPLENBQUMsR0FBRztnQkFDZCxJQUFJLEVBQUUsOEJBQThCLENBQUMsZ0JBQWdCO2FBQ3REO1lBQ0QsR0FBRyxFQUFFLE9BQU8sRUFBRSxHQUFHLElBQUksT0FBTyxDQUFDLEdBQUcsRUFBRTtZQUNsQyxPQUFPLEVBQUUsT0FBTyxFQUFFLE9BQU8sSUFBSSxLQUFLLENBQUMsb0JBQW9CO1NBQ3hELENBQUM7UUFFRixPQUFPLElBQUksT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQ3JDLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxPQUFPLEVBQUUsSUFBSSxFQUFFLFdBQVcsQ0FBQyxDQUFDO1lBRS9DLElBQUksTUFBTSxHQUFHLEVBQUUsQ0FBQztZQUNoQixJQUFJLE1BQU0sR0FBRyxFQUFFLENBQUM7WUFDaEIsSUFBSSxhQUF5QyxDQUFDO1lBQzlDLElBQUksV0FBVyxHQUFHLEtBQUssQ0FBQztZQUV4Qiw0Q0FBNEM7WUFDNUMsTUFBTSxRQUFRLEdBQUcsQ0FBQyxFQUFjLEVBQUUsRUFBRTtnQkFDbEMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO29CQUNqQixXQUFXLEdBQUcsSUFBSSxDQUFDO29CQUNuQixJQUFJLGFBQWEsRUFBRSxDQUFDO3dCQUNsQixZQUFZLENBQUMsYUFBYSxDQUFDLENBQUM7b0JBQzlCLENBQUM7b0JBQ0QsRUFBRSxFQUFFLENBQUM7Z0JBQ1AsQ0FBQztZQUNILENBQUMsQ0FBQztZQUVGLGlCQUFpQjtZQUNqQixJQUFJLE9BQU8sRUFBRSxPQUFPLEVBQUUsQ0FBQztnQkFDckIsYUFBYSxHQUFHLFVBQVUsQ0FBQyxHQUFHLEVBQUU7b0JBQzlCLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7b0JBQ3JCLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsMkJBQTJCLE9BQU8sQ0FBQyxPQUFPLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztnQkFDcEYsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxPQUFPLENBQUMsQ0FBQztnQkFDcEIsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ3hCLENBQUM7WUFFRCxJQUFJLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQUMsQ0FBQztZQUNsRCxJQUFJLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQUMsQ0FBQztZQUVsRCxJQUFJLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDLElBQUksRUFBRSxFQUFFO2dCQUN2QixJQUFJLElBQUksS0FBSyxDQUFDLEVBQUUsQ0FBQztvQkFDZixRQUFRLENBQUMsR0FBRyxFQUFFLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7Z0JBQ3pDLENBQUM7cUJBQU0sQ0FBQztvQkFDTixRQUFRLENBQUMsR0FBRyxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxDQUFDLG1CQUFtQixJQUFJLE1BQU0sTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7Z0JBQzNFLENBQUM7WUFDSCxDQUFDLENBQUMsQ0FBQztZQUVILElBQUksQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUU7Z0JBQ3pCLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztZQUNoQyxDQUFDLENBQUMsQ0FBQztRQUNMLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztDQUNGIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgc3Bhd24sIFNwYXduT3B0aW9ucyB9IGZyb20gJ2NoaWxkX3Byb2Nlc3MnO1xuaW1wb3J0IHBhdGggZnJvbSAncGF0aCc7XG5pbXBvcnQgeyBSZWdleFZhbGlkYXRvciB9IGZyb20gJy4vcmVnZXhWYWxpZGF0b3IuanMnO1xuXG5jb25zdCBBTExPV0VEX0NPTU1BTkRTOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmdbXT4gPSB7XG4gIGdpdDogWydwdWxsJywgJ3N0YXR1cycsICdsb2cnLCAncmV2LXBhcnNlJywgJ2JyYW5jaCcsICdjaGVja291dCcsICdmZXRjaCcsICctLWFiYnJldi1yZWYnLCAnSEVBRCcsICctLXBvcmNlbGFpbiddLFxuICBucG06IFsnaW5zdGFsbCcsICdydW4nLCAnYXVkaXQnLCAnY2knLCAnLS12ZXJzaW9uJywgJ2J1aWxkJ10sXG4gIG5vZGU6IFsnLS12ZXJzaW9uJ10sXG4gIG5weDogWyctLXZlcnNpb24nXVxufTtcblxuZXhwb3J0IGNsYXNzIENvbW1hbmRWYWxpZGF0b3Ige1xuICBzdGF0aWMgc2FuaXRpemVDb21tYW5kKGNtZDogc3RyaW5nLCBhcmdzOiBzdHJpbmdbXSk6IHZvaWQge1xuICAgIGlmICghQUxMT1dFRF9DT01NQU5EU1tjbWRdKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYENvbW1hbmQgbm90IGFsbG93ZWQ6ICR7Y21kfWApO1xuICAgIH1cbiAgICBcbiAgICBjb25zdCBhbGxvd2VkQXJncyA9IEFMTE9XRURfQ09NTUFORFNbY21kXTtcbiAgICBmb3IgKGNvbnN0IGFyZyBvZiBhcmdzKSB7XG4gICAgICAvLyBDaGVjayBpZiBpdCdzIGluIGFsbG93ZWQgbGlzdCBvciBtYXRjaGVzIHNhZmUgcGF0dGVyblxuICAgICAgaWYgKCFhbGxvd2VkQXJncy5pbmNsdWRlcyhhcmcpICYmICF0aGlzLmlzU2FmZUFyZ3VtZW50KGFyZykpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBBcmd1bWVudCBub3QgYWxsb3dlZDogJHthcmd9YCk7XG4gICAgICB9XG4gICAgfVxuICB9XG5cbiAgcHJpdmF0ZSBzdGF0aWMgaXNTYWZlQXJndW1lbnQoYXJnOiBzdHJpbmcpOiBib29sZWFuIHtcbiAgICAvLyBBbGxvdyBhbHBoYW51bWVyaWMsIGRhc2gsIHVuZGVyc2NvcmUsIGRvdCwgYW5kIGZvcndhcmQgc2xhc2hcbiAgICByZXR1cm4gUmVnZXhWYWxpZGF0b3IudmFsaWRhdGUoYXJnLCAvXlthLXpBLVowLTlcXC1fLlxcL10rJC8sIHsgbWF4TGVuZ3RoOiAxMDAwIH0pO1xuICB9XG5cbiAgc3RhdGljIGFzeW5jIHNlY3VyZUV4ZWMoY29tbWFuZDogc3RyaW5nLCBhcmdzOiBzdHJpbmdbXSwgb3B0aW9ucz86IFNwYXduT3B0aW9ucyk6IFByb21pc2U8c3RyaW5nPiB7XG4gICAgdGhpcy5zYW5pdGl6ZUNvbW1hbmQoY29tbWFuZCwgYXJncyk7XG4gICAgXG4gICAgY29uc3Qgc2FmZU9wdGlvbnM6IFNwYXduT3B0aW9ucyA9IHtcbiAgICAgIC4uLm9wdGlvbnMsXG4gICAgICBzdGRpbzogWydpZ25vcmUnLCAncGlwZScsICdwaXBlJ10sXG4gICAgICBlbnY6IHtcbiAgICAgICAgLi4ucHJvY2Vzcy5lbnYsXG4gICAgICAgIFBBVEg6ICcvdXNyL2JpbjovYmluOi91c3IvbG9jYWwvYmluJyAvLyBSZXN0cmljdCBQQVRIXG4gICAgICB9LFxuICAgICAgY3dkOiBvcHRpb25zPy5jd2QgfHwgcHJvY2Vzcy5jd2QoKSxcbiAgICAgIHRpbWVvdXQ6IG9wdGlvbnM/LnRpbWVvdXQgfHwgMzAwMDAgLy8gMzAgc2Vjb25kIGRlZmF1bHRcbiAgICB9O1xuICAgIFxuICAgIHJldHVybiBuZXcgUHJvbWlzZSgocmVzb2x2ZSwgcmVqZWN0KSA9PiB7XG4gICAgICBjb25zdCBwcm9jID0gc3Bhd24oY29tbWFuZCwgYXJncywgc2FmZU9wdGlvbnMpO1xuICAgICAgXG4gICAgICBsZXQgc3Rkb3V0ID0gJyc7XG4gICAgICBsZXQgc3RkZXJyID0gJyc7XG4gICAgICBsZXQgdGltZW91dEhhbmRsZTogTm9kZUpTLlRpbWVvdXQgfCB1bmRlZmluZWQ7XG4gICAgICBsZXQgaXNDb21wbGV0ZWQgPSBmYWxzZTtcbiAgICAgIFxuICAgICAgLy8gSGVscGVyIHRvIHNhZmVseSByZXNvbHZlL3JlamVjdCBvbmx5IG9uY2VcbiAgICAgIGNvbnN0IGNvbXBsZXRlID0gKGZuOiAoKSA9PiB2b2lkKSA9PiB7XG4gICAgICAgIGlmICghaXNDb21wbGV0ZWQpIHtcbiAgICAgICAgICBpc0NvbXBsZXRlZCA9IHRydWU7XG4gICAgICAgICAgaWYgKHRpbWVvdXRIYW5kbGUpIHtcbiAgICAgICAgICAgIGNsZWFyVGltZW91dCh0aW1lb3V0SGFuZGxlKTtcbiAgICAgICAgICB9XG4gICAgICAgICAgZm4oKTtcbiAgICAgICAgfVxuICAgICAgfTtcbiAgICAgIFxuICAgICAgLy8gSGFuZGxlIHRpbWVvdXRcbiAgICAgIGlmIChvcHRpb25zPy50aW1lb3V0KSB7XG4gICAgICAgIHRpbWVvdXRIYW5kbGUgPSBzZXRUaW1lb3V0KCgpID0+IHtcbiAgICAgICAgICBwcm9jLmtpbGwoJ1NJR1RFUk0nKTtcbiAgICAgICAgICBjb21wbGV0ZSgoKSA9PiByZWplY3QobmV3IEVycm9yKGBDb21tYW5kIHRpbWVkIG91dCBhZnRlciAke29wdGlvbnMudGltZW91dH1tc2ApKSk7XG4gICAgICAgIH0sIG9wdGlvbnMudGltZW91dCk7XG4gICAgICAgIHRpbWVvdXRIYW5kbGUudW5yZWYoKTtcbiAgICAgIH1cbiAgICAgIFxuICAgICAgcHJvYy5zdGRvdXQ/Lm9uKCdkYXRhJywgKGRhdGEpID0+IHN0ZG91dCArPSBkYXRhKTtcbiAgICAgIHByb2Muc3RkZXJyPy5vbignZGF0YScsIChkYXRhKSA9PiBzdGRlcnIgKz0gZGF0YSk7XG4gICAgICBcbiAgICAgIHByb2Mub24oJ2V4aXQnLCAoY29kZSkgPT4ge1xuICAgICAgICBpZiAoY29kZSA9PT0gMCkge1xuICAgICAgICAgIGNvbXBsZXRlKCgpID0+IHJlc29sdmUoc3Rkb3V0LnRyaW0oKSkpO1xuICAgICAgICB9IGVsc2Uge1xuICAgICAgICAgIGNvbXBsZXRlKCgpID0+IHJlamVjdChuZXcgRXJyb3IoYENvbW1hbmQgZmFpbGVkICgke2NvZGV9KTogJHtzdGRlcnJ9YCkpKTtcbiAgICAgICAgfVxuICAgICAgfSk7XG4gICAgICBcbiAgICAgIHByb2Mub24oJ2Vycm9yJywgKGVycm9yKSA9PiB7XG4gICAgICAgIGNvbXBsZXRlKCgpID0+IHJlamVjdChlcnJvcikpO1xuICAgICAgfSk7XG4gICAgfSk7XG4gIH1cbn0iXX0=

package/dist/security/constants.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Security-related constants and limits
+ */
+export declare const SECURITY_LIMITS: {
+    MAX_PERSONA_SIZE_BYTES: number;
+    MAX_FILENAME_LENGTH: number;
+    MAX_PATH_DEPTH: number;
+    MAX_CONTENT_LENGTH: number;
+    MAX_YAML_LENGTH: number;
+    MAX_METADATA_FIELD_LENGTH: number;
+    MAX_FILE_SIZE: number;
+    RATE_LIMIT_REQUESTS: number;
+    RATE_LIMIT_WINDOW_MS: number;
+    CACHE_TTL_MS: number;
+    MAX_SEARCH_RESULTS: number;
+};
+export declare const VALIDATION_PATTERNS: {
+    SAFE_FILENAME: RegExp;
+    SAFE_PATH: RegExp;
+    SAFE_USERNAME: RegExp;
+    SAFE_CATEGORY: RegExp;
+    SAFE_EMAIL: RegExp;
+};
+//# sourceMappingURL=constants.d.ts.map

package/dist/security/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/security/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,eAAO,MAAM,eAAe;;;;;;;;;;;;CAY3B,CAAC;AAGF,eAAO,MAAM,mBAAmB;;;;;;CAM/B,CAAC"}

package/dist/security/constants.js

@@ -0,0 +1,26 @@
+/**
+ * Security-related constants and limits
+ */
+// Security and performance limits
+export const SECURITY_LIMITS = {
+    MAX_PERSONA_SIZE_BYTES: 1024 * 1024 * 2, // 2MB max persona file size
+    MAX_FILENAME_LENGTH: 255, // Max filename length
+    MAX_PATH_DEPTH: 10, // Max directory depth for paths
+    MAX_CONTENT_LENGTH: 500000, // Max persona content length (500KB)
+    MAX_YAML_LENGTH: 64 * 1024, // Max YAML frontmatter length (64KB)
+    MAX_METADATA_FIELD_LENGTH: 1024, // Max individual metadata field length (1KB)
+    MAX_FILE_SIZE: 1024 * 1024 * 2, // Max file size (2MB)
+    RATE_LIMIT_REQUESTS: 100, // Max requests per window
+    RATE_LIMIT_WINDOW_MS: 60 * 1000, // 1 minute window
+    CACHE_TTL_MS: 5 * 60 * 1000, // 5 minute cache TTL
+    MAX_SEARCH_RESULTS: 50 // Max search results to return
+};
+// Input validation patterns
+export const VALIDATION_PATTERNS = {
+    SAFE_FILENAME: /^[a-zA-Z0-9][a-zA-Z0-9\-_.]{0,250}[a-zA-Z0-9]$/,
+    SAFE_PATH: /^[a-zA-Z0-9:/\-_.~]{1,500}$/,
+    SAFE_USERNAME: /^[a-zA-Z0-9][a-zA-Z0-9\-_.]{0,30}[a-zA-Z0-9]$/,
+    SAFE_CATEGORY: /^[a-zA-Z][a-zA-Z0-9\-_]{0,20}$/,
+    SAFE_EMAIL: /^[^\s@]{1,64}@[^\s@]{1,253}\.[^\s@]{1,63}$/ // RFC 5321 compliant limits
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uc3RhbnRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3NlY3VyaXR5L2NvbnN0YW50cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7R0FFRztBQUVILGtDQUFrQztBQUNsQyxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUc7SUFDN0Isc0JBQXNCLEVBQUUsSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLEVBQUcsNEJBQTRCO0lBQ3RFLG1CQUFtQixFQUFFLEdBQUcsRUFBbUIsc0JBQXNCO0lBQ2pFLGNBQWMsRUFBRSxFQUFFLEVBQXdCLGdDQUFnQztJQUMxRSxrQkFBa0IsRUFBRSxNQUFNLEVBQWdCLHFDQUFxQztJQUMvRSxlQUFlLEVBQUUsRUFBRSxHQUFHLElBQUksRUFBZ0IscUNBQXFDO0lBQy9FLHlCQUF5QixFQUFFLElBQUksRUFBVyw2Q0FBNkM7SUFDdkYsYUFBYSxFQUFFLElBQUksR0FBRyxJQUFJLEdBQUcsQ0FBQyxFQUFXLHNCQUFzQjtJQUMvRCxtQkFBbUIsRUFBRSxHQUFHLEVBQWtCLDBCQUEwQjtJQUNwRSxvQkFBb0IsRUFBRSxFQUFFLEdBQUcsSUFBSSxFQUFVLGtCQUFrQjtJQUMzRCxZQUFZLEVBQUUsQ0FBQyxHQUFHLEVBQUUsR0FBRyxJQUFJLEVBQWMscUJBQXFCO0lBQzlELGtCQUFrQixFQUFFLEVBQUUsQ0FBb0IsK0JBQStCO0NBQzFFLENBQUM7QUFFRiw0QkFBNEI7QUFDNUIsTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUc7SUFDakMsYUFBYSxFQUFFLGdEQUFnRDtJQUMvRCxTQUFTLEVBQUUsNkJBQTZCO0lBQ3hDLGFBQWEsRUFBRSwrQ0FBK0M7SUFDOUQsYUFBYSxFQUFFLGdDQUFnQztJQUMvQyxVQUFVLEVBQUUsNENBQTRDLENBQUUsNEJBQTRCO0NBQ3ZGLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIFNlY3VyaXR5LXJlbGF0ZWQgY29uc3RhbnRzIGFuZCBsaW1pdHNcbiAqL1xuXG4vLyBTZWN1cml0eSBhbmQgcGVyZm9ybWFuY2UgbGltaXRzXG5leHBvcnQgY29uc3QgU0VDVVJJVFlfTElNSVRTID0ge1xuICBNQVhfUEVSU09OQV9TSVpFX0JZVEVTOiAxMDI0ICogMTAyNCAqIDIsICAvLyAyTUIgbWF4IHBlcnNvbmEgZmlsZSBzaXplXG4gIE1BWF9GSUxFTkFNRV9MRU5HVEg6IDI1NSwgICAgICAgICAgICAgICAgICAvLyBNYXggZmlsZW5hbWUgbGVuZ3RoXG4gIE1BWF9QQVRIX0RFUFRIOiAxMCwgICAgICAgICAgICAgICAgICAgICAgIC8vIE1heCBkaXJlY3RvcnkgZGVwdGggZm9yIHBhdGhzXG4gIE1BWF9DT05URU5UX0xFTkdUSDogNTAwMDAwLCAgICAgICAgICAgICAgIC8vIE1heCBwZXJzb25hIGNvbnRlbnQgbGVuZ3RoICg1MDBLQilcbiAgTUFYX1lBTUxfTEVOR1RIOiA2NCAqIDEwMjQsICAgICAgICAgICAgICAgLy8gTWF4IFlBTUwgZnJvbnRtYXR0ZXIgbGVuZ3RoICg2NEtCKVxuICBNQVhfTUVUQURBVEFfRklFTERfTEVOR1RIOiAxMDI0LCAgICAgICAgICAvLyBNYXggaW5kaXZpZHVhbCBtZXRhZGF0YSBmaWVsZCBsZW5ndGggKDFLQilcbiAgTUFYX0ZJTEVfU0laRTogMTAyNCAqIDEwMjQgKiAyLCAgICAgICAgICAvLyBNYXggZmlsZSBzaXplICgyTUIpXG4gIFJBVEVfTElNSVRfUkVRVUVTVFM6IDEwMCwgICAgICAgICAgICAgICAgIC8vIE1heCByZXF1ZXN0cyBwZXIgd2luZG93XG4gIFJBVEVfTElNSVRfV0lORE9XX01TOiA2MCAqIDEwMDAsICAgICAgICAgLy8gMSBtaW51dGUgd2luZG93XG4gIENBQ0hFX1RUTF9NUzogNSAqIDYwICogMTAwMCwgICAgICAgICAgICAgLy8gNSBtaW51dGUgY2FjaGUgVFRMXG4gIE1BWF9TRUFSQ0hfUkVTVUxUUzogNTAgICAgICAgICAgICAgICAgICAgIC8vIE1heCBzZWFyY2ggcmVzdWx0cyB0byByZXR1cm5cbn07XG5cbi8vIElucHV0IHZhbGlkYXRpb24gcGF0dGVybnNcbmV4cG9ydCBjb25zdCBWQUxJREFUSU9OX1BBVFRFUk5TID0ge1xuICBTQUZFX0ZJTEVOQU1FOiAvXlthLXpBLVowLTldW2EtekEtWjAtOVxcLV8uXXswLDI1MH1bYS16QS1aMC05XSQvLFxuICBTQUZFX1BBVEg6IC9eW2EtekEtWjAtOTovXFwtXy5+XXsxLDUwMH0kLyxcbiAgU0FGRV9VU0VSTkFNRTogL15bYS16QS1aMC05XVthLXpBLVowLTlcXC1fLl17MCwzMH1bYS16QS1aMC05XSQvLFxuICBTQUZFX0NBVEVHT1JZOiAvXlthLXpBLVpdW2EtekEtWjAtOVxcLV9dezAsMjB9JC8sXG4gIFNBRkVfRU1BSUw6IC9eW15cXHNAXXsxLDY0fUBbXlxcc0BdezEsMjUzfVxcLlteXFxzQF17MSw2M30kLyAgLy8gUkZDIDUzMjEgY29tcGxpYW50IGxpbWl0c1xufTsiXX0=

package/dist/security/contentValidator.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Content Validator for DollhouseMCP
+ *
+ * Protects against prompt injection attacks in collection personas
+ * by detecting and sanitizing malicious content patterns.
+ *
+ * Security: SEC-001 - Critical vulnerability protection
+ */
+export interface ContentValidationResult {
+    isValid: boolean;
+    sanitizedContent?: string;
+    detectedPatterns?: string[];
+    severity?: 'low' | 'medium' | 'high' | 'critical';
+}
+export declare class ContentValidator {
+    /**
+     * Pattern-based detection system for prompt injection attacks.
+     *
+     * This approach was chosen over AI-based detection because:
+     * 1. Pattern matching cannot be socially engineered or confused
+     * 2. Deterministic results ensure consistent security
+     * 3. No additional API calls or latency
+     * 4. Can't be bypassed by clever prompt engineering
+     *
+     * The patterns below represent known attack vectors from security research
+     * and real-world exploit attempts against AI systems.
+     */
+    private static readonly INJECTION_PATTERNS;
+    private static readonly MALICIOUS_YAML_PATTERNS;
+    /**
+     * Validates and sanitizes persona content for security threats
+     */
+    static validateAndSanitize(content: string): ContentValidationResult;
+    /**
+     * Validates YAML frontmatter for malicious content
+     */
+    static validateYamlContent(yamlContent: string): boolean;
+    /**
+     * Validates persona metadata fields
+     */
+    static validateMetadata(metadata: any): ContentValidationResult;
+    /**
+     * Sanitizes a complete persona file (frontmatter + content)
+     */
+    static sanitizePersonaContent(content: string): string;
+}
+//# sourceMappingURL=contentValidator.d.ts.map

package/dist/security/contentValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contentValidator.d.ts","sourceRoot":"","sources":["../../src/security/contentValidator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;CACnD;AAED,qBAAa,gBAAgB;IAC3B;;;;;;;;;;;OAWG;IAEH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAwCxC;IAGF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAkF7C;IAEF;;OAEG;IACH,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB;IA2DpE;;OAEG;IACH,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IA8CxD;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,GAAG,uBAAuB;IAuC/D;;OAEG;IACH,MAAM,CAAC,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;CA8BvD"}