@heimdall-ai/heimdall 0.1.0

package/dist/core/secure-fs.js

@@ -0,0 +1,279 @@
+/**
+ * SecureFs - Secure filesystem wrapper with symlink protection
+ *
+ * Wraps ReadWriteFs to add symlink validation before all file operations.
+ * Prevents symlink-based path traversal attacks by resolving real paths
+ * and ensuring they stay within the workspace directory.
+ *
+ * @see SECURITY-REVIEW.md for security details
+ */
+import { ReadWriteFs, } from "just-bash";
+import * as fs from "fs";
+import * as path from "path";
+/**
+ * Error thrown when a symlink attack is detected
+ */
+export class SymlinkSecurityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "SymlinkSecurityError";
+    }
+}
+/**
+ * SecureFs wraps ReadWriteFs with symlink protection
+ *
+ * Before every file operation, it validates that the resolved real path
+ * stays within the workspace directory. This prevents:
+ * - Direct symlinks pointing outside workspace
+ * - Nested symlink chains escaping workspace
+ * - Parent directory symlinks
+ * - Relative symlinks that escape
+ */
+export class SecureFs {
+    inner;
+    root;
+    resolvedRoot;
+    constructor(options) {
+        this.root = path.resolve(options.root);
+        // Resolve the root path itself (in case it's a symlink)
+        try {
+            this.resolvedRoot = fs.realpathSync(this.root);
+        }
+        catch {
+            // If root doesn't exist yet, use the absolute path
+            this.resolvedRoot = this.root;
+        }
+        this.inner = new ReadWriteFs({ root: this.root });
+    }
+    /**
+     * Convert a virtual path to a real filesystem path
+     */
+    toRealPath(virtualPath) {
+        // Normalize the virtual path
+        const normalized = path.posix.normalize(virtualPath);
+        // Join with root
+        return path.join(this.root, normalized);
+    }
+    /**
+     * Validate that a path doesn't escape the workspace via symlinks
+     *
+     * SECURITY: This is the core protection against symlink attacks.
+     * It resolves ALL symlinks in the path and verifies the final
+     * real path is within the workspace directory.
+     */
+    async validatePath(virtualPath) {
+        const hostPath = this.toRealPath(virtualPath);
+        try {
+            // Resolve all symlinks to get the real path
+            const realPath = await fs.promises.realpath(hostPath);
+            // Check if the real path is within the workspace
+            if (!this.isWithinWorkspace(realPath)) {
+                throw new SymlinkSecurityError(`Security violation: Path resolves outside workspace. ` + `Symlink attack detected.`);
+            }
+        }
+        catch (error) {
+            if (error instanceof SymlinkSecurityError) {
+                throw error;
+            }
+            // For ENOENT (file doesn't exist), validate parent directories
+            if (error.code === "ENOENT") {
+                await this.validateParentPath(hostPath);
+                return;
+            }
+            // Re-throw other errors
+            throw error;
+        }
+    }
+    /**
+     * Validate parent directories for paths that don't exist yet
+     *
+     * SECURITY: When creating new files, we need to ensure that
+     * parent directories aren't symlinks pointing outside workspace.
+     */
+    async validateParentPath(hostPath) {
+        let currentPath = hostPath;
+        // Walk up the directory tree until we find an existing path
+        while (currentPath !== this.root && currentPath !== path.dirname(currentPath)) {
+            currentPath = path.dirname(currentPath);
+            try {
+                const realPath = await fs.promises.realpath(currentPath);
+                if (!this.isWithinWorkspace(realPath)) {
+                    throw new SymlinkSecurityError(`Security violation: Parent directory resolves outside workspace. ` +
+                        `Symlink attack detected.`);
+                }
+                // Found a valid existing parent
+                return;
+            }
+            catch (error) {
+                if (error instanceof SymlinkSecurityError) {
+                    throw error;
+                }
+                // Continue up the tree if this path doesn't exist
+                if (error.code !== "ENOENT") {
+                    throw error;
+                }
+            }
+        }
+    }
+    /**
+     * Check if a real path is within the workspace
+     */
+    isWithinWorkspace(realPath) {
+        const normalizedReal = path.normalize(realPath);
+        const normalizedRoot = path.normalize(this.resolvedRoot);
+        return (normalizedReal === normalizedRoot || normalizedReal.startsWith(normalizedRoot + path.sep));
+    }
+    /**
+     * Validate symlink creation doesn't point outside workspace
+     *
+     * SECURITY: Block creation of symlinks that point to external targets
+     */
+    async validateSymlinkTarget(target, linkPath) {
+        // Get the directory where the symlink will be created
+        const linkDir = path.dirname(this.toRealPath(linkPath));
+        // Resolve the target relative to the link's directory
+        let absoluteTarget;
+        if (path.isAbsolute(target)) {
+            absoluteTarget = target;
+        }
+        else {
+            absoluteTarget = path.resolve(linkDir, target);
+        }
+        // Check if target is within workspace
+        if (!this.isWithinWorkspace(absoluteTarget)) {
+            throw new SymlinkSecurityError(`Security violation: Cannot create symlink pointing outside workspace.`);
+        }
+        // Also try to resolve the target if it exists
+        try {
+            const realTarget = await fs.promises.realpath(absoluteTarget);
+            if (!this.isWithinWorkspace(realTarget)) {
+                throw new SymlinkSecurityError(`Security violation: Symlink target resolves outside workspace.`);
+            }
+        }
+        catch (error) {
+            // Target doesn't exist yet - just check the absolute path
+            if (error.code !== "ENOENT") {
+                throw error;
+            }
+        }
+    }
+    // ============================================================
+    // IFileSystem Implementation - All methods validate symlinks
+    // ============================================================
+    async readFile(filePath, options) {
+        await this.validatePath(filePath);
+        return this.inner.readFile(filePath, options);
+    }
+    async readFileBuffer(filePath) {
+        await this.validatePath(filePath);
+        return this.inner.readFileBuffer(filePath);
+    }
+    async writeFile(filePath, content, options) {
+        await this.validatePath(filePath);
+        return this.inner.writeFile(filePath, content, options);
+    }
+    async appendFile(filePath, content, options) {
+        await this.validatePath(filePath);
+        return this.inner.appendFile(filePath, content, options);
+    }
+    async exists(filePath) {
+        try {
+            await this.validatePath(filePath);
+            return this.inner.exists(filePath);
+        }
+        catch (error) {
+            if (error instanceof SymlinkSecurityError) {
+                // Symlinks outside workspace "don't exist" from our perspective
+                return false;
+            }
+            throw error;
+        }
+    }
+    async stat(filePath) {
+        await this.validatePath(filePath);
+        return this.inner.stat(filePath);
+    }
+    async lstat(filePath) {
+        // For lstat, we validate the parent but allow checking the symlink itself
+        const hostPath = this.toRealPath(filePath);
+        await this.validateParentPath(hostPath);
+        return this.inner.lstat(filePath);
+    }
+    async mkdir(filePath, options) {
+        await this.validatePath(filePath);
+        return this.inner.mkdir(filePath, options);
+    }
+    async readdir(filePath) {
+        await this.validatePath(filePath);
+        return this.inner.readdir(filePath);
+    }
+    async readdirWithFileTypes(filePath) {
+        await this.validatePath(filePath);
+        return this.inner.readdirWithFileTypes(filePath);
+    }
+    async rm(filePath, options) {
+        // For removal, check if it's a symlink first
+        const hostPath = this.toRealPath(filePath);
+        try {
+            const lstats = await fs.promises.lstat(hostPath);
+            if (lstats.isSymbolicLink()) {
+                // For symlinks, validate the parent path (where the symlink lives)
+                await this.validateParentPath(hostPath);
+                // Allow removing symlinks that point outside (cleaning up attack artifacts)
+            }
+            else {
+                // For regular files/directories, validate the full path
+                await this.validatePath(filePath);
+            }
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                // File doesn't exist - let the underlying fs handle the error
+                if (!options?.force) {
+                    return this.inner.rm(filePath, options);
+                }
+                return;
+            }
+            throw error;
+        }
+        return this.inner.rm(filePath, options);
+    }
+    async cp(src, dest, options) {
+        await this.validatePath(src);
+        await this.validatePath(dest);
+        return this.inner.cp(src, dest, options);
+    }
+    async mv(src, dest) {
+        await this.validatePath(src);
+        await this.validatePath(dest);
+        return this.inner.mv(src, dest);
+    }
+    resolvePath(base, relativePath) {
+        return this.inner.resolvePath(base, relativePath);
+    }
+    getAllPaths() {
+        return this.inner.getAllPaths();
+    }
+    async chmod(filePath, mode) {
+        await this.validatePath(filePath);
+        return this.inner.chmod(filePath, mode);
+    }
+    async symlink(target, linkPath) {
+        // SECURITY: Validate both the link location and target
+        await this.validatePath(linkPath);
+        await this.validateSymlinkTarget(target, linkPath);
+        return this.inner.symlink(target, linkPath);
+    }
+    async link(existingPath, newPath) {
+        await this.validatePath(existingPath);
+        await this.validatePath(newPath);
+        return this.inner.link(existingPath, newPath);
+    }
+    async readlink(filePath) {
+        // Validate the symlink itself exists within workspace
+        const hostPath = this.toRealPath(filePath);
+        await this.validateParentPath(hostPath);
+        return this.inner.readlink(filePath);
+    }
+}
+//# sourceMappingURL=secure-fs.js.map

package/dist/core/secure-fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-fs.js","sourceRoot":"","sources":["../../src/core/secure-fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,WAAW,GAQZ,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AA2B7B;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,QAAQ;IACF,KAAK,CAAc;IACnB,IAAI,CAAS;IACb,YAAY,CAAS;IAEtC,YAAY,OAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEvC,wDAAwD;QACxD,IAAI,CAAC;YACH,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;YACnD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,WAAmB;QACpC,6BAA6B;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAErD,iBAAiB;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,YAAY,CAAC,WAAmB;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE9C,IAAI,CAAC;YACH,4CAA4C;YAC5C,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAEtD,iDAAiD;YACjD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,oBAAoB,CAC5B,uDAAuD,GAAG,0BAA0B,CACrF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;gBAC1C,MAAM,KAAK,CAAC;YACd,CAAC;YAED,+DAA+D;YAC/D,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YAED,wBAAwB;YACxB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QAC/C,IAAI,WAAW,GAAG,QAAQ,CAAC;QAE3B,4DAA4D;QAC5D,OAAO,WAAW,KAAK,IAAI,CAAC,IAAI,IAAI,WAAW,KAAK,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9E,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAExC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAEzD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtC,MAAM,IAAI,oBAAoB,CAC5B,mEAAmE;wBACjE,0BAA0B,CAC7B,CAAC;gBACJ,CAAC;gBAED,gCAAgC;gBAChC,OAAO;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;oBAC1C,MAAM,KAAK,CAAC;gBACd,CAAC;gBAED,kDAAkD;gBAClD,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACvD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,QAAgB;QACxC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAEzD,OAAO,CACL,cAAc,KAAK,cAAc,IAAI,cAAc,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAC1F,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,qBAAqB,CAAC,MAAc,EAAE,QAAgB;QAClE,sDAAsD;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAExD,sDAAsD;QACtD,IAAI,cAAsB,CAAC;QAC3B,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,cAAc,GAAG,MAAM,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,oBAAoB,CAC5B,uEAAuE,CACxE,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,oBAAoB,CAC5B,gEAAgE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0DAA0D;YAC1D,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,6DAA6D;IAC7D,+DAA+D;IAE/D,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,OAA0C;QACzE,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,OAAoB,EACpB,OAA2C;QAE3C,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,UAAU,CACd,QAAgB,EAChB,OAAoB,EACpB,OAA2C;QAE3C,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;gBAC1C,gEAAgE;gBAChE,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB;QAC1B,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,OAAsB;QAClD,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,QAAgB;QACzC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,EAAE,CAAC,QAAgB,EAAE,OAAmB;QAC5C,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAEjD,IAAI,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC5B,mEAAmE;gBACnE,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;gBACxC,4EAA4E;YAC9E,CAAC;iBAAM,CAAC;gBACN,wDAAwD;gBACxD,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,8DAA8D;gBAC9D,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;oBACpB,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC1C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,EAAE,CAAC,GAAW,EAAE,IAAY,EAAE,OAAmB;QACrD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,EAAE,CAAC,GAAW,EAAE,IAAY;QAChC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,WAAW,CAAC,IAAY,EAAE,YAAoB;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,IAAY;QACxC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,QAAgB;QAC5C,uDAAuD;QACvD,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,YAAoB,EAAE,OAAe;QAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAgB;QAC7B,sDAAsD;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/integration.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * MCP Integration Tests for Heimdall Server
+ *
+ * These tests spin up the MCP server and connect with a client
+ * to verify all functionality works end-to-end.
+ *
+ * Run with: npm test
+ */
+export {};
+//# sourceMappingURL=integration.test.d.ts.map

package/dist/integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.test.d.ts","sourceRoot":"","sources":["../src/integration.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}