@integsec/agentic-pentest-proxy 0.2.5 → 0.2.6

package/dist/src/validator.js

@@ -4,44 +4,103 @@
  * ScopeValidator — the core orchestrator that ties all validation together.
  *
  * Validation steps (in exact order):
- *  1. Technique block check
+ *  0. Request shape check (tool name string, arguments object) — fail closed
+ *  1. Technique check (excluded_techniques, then authorized_techniques)
  *  2. Time window check
- *  3. Target extraction
+ *  3. Target extraction — EVERY target in the call (arrays, lists, nested
+ *     options, command lines)
  *  4. If no target found → ALLOWED_NO_TARGET
- *  5. DNS resolution (fail closed on NXDOMAIN)
- *  6. Exclusion check (exclusions win over authorizations)
- *  7. Authorization check (domain pattern match OR IP CIDR match)
- *  8. No match → BLOCKED_NOT_IN_SCOPE
+ *  Then, for each target (the call is blocked if ANY target is blocked):
+ *  5. Cloud account match (authorized_targets.cloud_accounts)
+ *  6. CIDR targets: must not overlap an exclusion, must sit inside an
+ *     authorized range (no DNS)
+ *  7. DNS resolution (fail closed on NXDOMAIN)
+ *  8. Exclusion check (exclusions win over authorizations)
+ *  9. Authorization check (domain / URL host match, or IP CIDR match);
+ *     authorized hostnames resolving to loopback / link-local / metadata
+ *     addresses are blocked unless those IPs are explicitly in ip_ranges
+ * 10. No match → BLOCKED_NOT_IN_SCOPE
  *
  * SECURITY NOTE: This module is the gatekeeper for all tool calls. Every
  * check order matters — do not reorder without updating tests.
  */
-import { extractTarget } from "./extractor.js";
+import { isIP } from "node:net";
+import { extractTargets } from "./extractor.js";
 import { DnsResolver } from "./dns-resolver.js";
-import { isIpInCidr } from "./ip-matcher.js";
+import { isCidr, isIpInCidr, isRangeWithin, isRestrictedIp, rangesOverlap } from "./ip-matcher.js";
 import { matchesDomain } from "./domain-matcher.js";
 import { TechniqueChecker } from "./technique-checker.js";
+const SAFE_TARGETLESS_TOOLS = new Set([
+    "whoami", "date", "ls", "list_tools", "get_version", "list_pentests",
+]);
+const UNSTRUCTURED_KEYS = new Set([
+    "command", "cmd", "command_line", "commandline", "cmdline", "shell_command",
+    "args", "extra_args", "additional_args",
+]);
 export class ScopeValidator {
     manifest;
     dnsResolver;
     techniqueChecker;
-    constructor(manifest, dnsResolver, techniqueChecker) {
+    /** URL scope entries paired with their hostnames for prefix checks. */
+    urlHosts;
+    allowUnstructuredCommands;
+    constructor(manifest, dnsResolver, techniqueChecker, allowUnstructuredCommands = false) {
         this.manifest = manifest;
         this.dnsResolver = dnsResolver ?? new DnsResolver();
         this.techniqueChecker = techniqueChecker ?? new TechniqueChecker();
+        this.allowUnstructuredCommands = allowUnstructuredCommands;
+        this.urlHosts = manifest.authorized_targets.urls
+            .map((url) => ({ host: hostOf(url), url }))
+            .filter((u) => u.host !== null);
     }
     async validate(toolName, params) {
         const startTime = Date.now();
         // ─────────────────────────────────────────────────────────────────────────
-        // Step 1: Technique block check
+        // Step 0: Request shape — anything we cannot inspect is blocked
         // ─────────────────────────────────────────────────────────────────────────
-        if (this.techniqueChecker.isBlocked(toolName, this.manifest.excluded_techniques)) {
-            const category = this.techniqueChecker.getCategory(toolName) ?? "unknown";
+        if (typeof toolName !== "string" || toolName === "") {
+            return this.result(startTime, {
+                decision: "BLOCKED_INVALID_REQUEST",
+                reason: "Tool name is missing or not a string; cannot validate.",
+            });
+        }
+        if (typeof params !== "object" || params === null || Array.isArray(params)) {
+            return this.result(startTime, {
+                decision: "BLOCKED_INVALID_REQUEST",
+                reason: `Tool arguments must be a JSON object (got ${Array.isArray(params) ? "array" : typeof params}); cannot validate.`,
+            });
+        }
+        if (hasUninspectableDepth(params)) {
+            return this.result(startTime, {
+                decision: "BLOCKED_INVALID_REQUEST",
+                reason: "Tool arguments are nested more deeply than the target extractor can inspect.",
+            });
+        }
+        // ─────────────────────────────────────────────────────────────────────────
+        // Step 1: Technique checks
+        // ─────────────────────────────────────────────────────────────────────────
+        const category = this.techniqueChecker.getCategory(toolName);
+        if (category !== null && this.manifest.excluded_techniques.includes(category)) {
             return this.result(startTime, {
                 decision: "BLOCKED_TECHNIQUE",
                 reason: `Tool "${toolName}" belongs to the blocked technique category "${category}".`,
             });
         }
+        const authorizedTechniques = this.manifest.authorized_techniques;
+        if (category !== null &&
+            authorizedTechniques.length > 0 &&
+            !authorizedTechniques.includes(category)) {
+            return this.result(startTime, {
+                decision: "BLOCKED_TECHNIQUE",
+                reason: `Tool "${toolName}" belongs to technique category "${category}", which is not in authorized_techniques (${authorizedTechniques.join(", ")}).`,
+            });
+        }
+        if (!this.allowUnstructuredCommands && hasUnstructuredCommand(params)) {
+            return this.result(startTime, {
+                decision: "BLOCKED_UNINSPECTABLE_COMMAND",
+                reason: "Free-form command or argument fields cannot be reliably checked against engagement scope.",
+            });
+        }
         // ─────────────────────────────────────────────────────────────────────────
         // Step 2: Time window check
         // ─────────────────────────────────────────────────────────────────────────
@@ -55,137 +114,172 @@ export class ScopeValidator {
             });
         }
         // ─────────────────────────────────────────────────────────────────────────
-        // Step 3: Target extraction
-        // ─────────────────────────────────────────────────────────────────────────
-        const extraction = extractTarget(toolName, params);
-        // ─────────────────────────────────────────────────────────────────────────
-        // Step 4: If no target found → ALLOWED_NO_TARGET
+        // Steps 3–4: Extract every target
         // ─────────────────────────────────────────────────────────────────────────
-        if (extraction === null) {
-            return this.result(startTime, {
-                decision: "ALLOWED_NO_TARGET",
-                reason: "No target-like parameter found in tool call; allowing by default.",
-            });
+        const extractions = extractTargets(toolName, params);
+        if (extractions.length === 0) {
+            return this.result(startTime, SAFE_TARGETLESS_TOOLS.has(toolName.toLowerCase())
+                ? { decision: "ALLOWED_NO_TARGET", reason: `Targetless local tool "${toolName}" is explicitly allowed.` }
+                : { decision: "BLOCKED_INVALID_REQUEST", reason: `No target could be verified for tool "${toolName}".` });
         }
-        const target = extraction.target;
         // ─────────────────────────────────────────────────────────────────────────
-        // Step 5: DNS resolution
+        // Steps 5–10: Every target must be in scope
         // ─────────────────────────────────────────────────────────────────────────
+        const allowed = [];
+        const requestUrls = collectHttpUrls(params);
+        for (const { target } of extractions) {
+            const r = await this.validateTarget(target, requestUrls);
+            if (r.decision !== "ALLOWED") {
+                return this.result(startTime, r);
+            }
+            allowed.push(r);
+        }
+        if (allowed.length === 1) {
+            return this.result(startTime, allowed[0]);
+        }
+        return this.result(startTime, {
+            decision: "ALLOWED",
+            reason: `All ${allowed.length} targets are in scope: ${allowed.map((r) => r.reason).join(" ")}`,
+            matchedScopeItem: [...new Set(allowed.map((r) => r.matchedScopeItem))].join(", "),
+            extractedTarget: allowed.map((r) => r.extractedTarget).join(", "),
+            resolvedIps: [...new Set(allowed.flatMap((r) => r.resolvedIps ?? []))],
+        });
+    }
+    // ---------------------------------------------------------------------------
+    // Per-target pipeline
+    // ---------------------------------------------------------------------------
+    async validateTarget(rawTarget, requestUrls) {
+        const target = normalizeHost(rawTarget);
+        const { ip_ranges: authorizedIpRanges, domains: authorizedDomains, cloud_accounts } = this.manifest.authorized_targets;
+        const excluded = this.manifest.excluded_targets;
+        const urlsForTarget = requestUrls.filter((url) => normalizeHost(url.hostname) === target);
+        // An explicit hostname or account exclusion does not need DNS. Check it
+        // first so an excluded target cannot turn into a DNS timeout or be
+        // authorized as a cloud account before the exclusion is considered.
+        const hostHit = excluded.find((entry) => matchesExclusion(target, entry));
+        if (hostHit !== undefined) {
+            return {
+                decision: "BLOCKED_EXCLUDED_TARGET",
+                reason: `Target "${target}" matches excluded target "${hostHit}".`,
+                extractedTarget: target,
+                resolvedIps: [],
+            };
+        }
+        // URL scope entries authorize only their scheme, host, port and path.
+        if (this.urlHosts.some((u) => u.host === target) &&
+            urlsForTarget.some((url) => !this.urlHosts.some((u) => u.host === target && urlWithinScope(url, u.url)))) {
+            return {
+                decision: "BLOCKED_NOT_IN_SCOPE",
+                reason: `A requested URL for "${target}" is outside its authorized URL prefix.`,
+                extractedTarget: target,
+                resolvedIps: [],
+            };
+        }
+        // Step 5: Cloud accounts (e.g. prowler/scoutsuite account IDs)
+        const matchedAccount = cloud_accounts.find((entry) => matchesCloudAccount(target, entry));
+        if (matchedAccount !== undefined) {
+            return {
+                decision: "ALLOWED",
+                reason: `Target "${target}" matches authorized cloud account "${matchedAccount}".`,
+                matchedScopeItem: matchedAccount,
+                extractedTarget: target,
+                resolvedIps: [],
+            };
+        }
+        // Step 6: CIDR targets — the whole range is what the tool will touch
+        if (isCidr(target)) {
+            const hit = excluded.find((entry) => rangesOverlap(target, entry));
+            if (hit !== undefined) {
+                return {
+                    decision: "BLOCKED_EXCLUDED_TARGET",
+                    reason: `Target range "${target}" includes excluded target "${hit}".`,
+                    extractedTarget: target,
+                    resolvedIps: [target],
+                };
+            }
+            const range = authorizedIpRanges.find((r) => isRangeWithin(target, r));
+            if (range !== undefined) {
+                return {
+                    decision: "ALLOWED",
+                    reason: `Target range "${target}" is within authorized range "${range}".`,
+                    matchedScopeItem: range,
+                    extractedTarget: target,
+                    resolvedIps: [target],
+                };
+            }
+            return {
+                decision: "BLOCKED_NOT_IN_SCOPE",
+                reason: `Target range "${target}" is not fully contained in any authorized IP range.`,
+                extractedTarget: target,
+                resolvedIps: [target],
+            };
+        }
+        // Step 7: DNS resolution
         const resolvedIps = await this.dnsResolver.resolve(target);
         // For hostnames (not raw IPs), an empty resolution means NXDOMAIN — fail closed.
         // For raw IPs the resolver returns [ip] so resolvedIps will never be empty.
         if (resolvedIps.length === 0) {
-            return this.result(startTime, {
+            return {
                 decision: "BLOCKED_DNS_FAILED",
                 reason: `DNS resolution for "${target}" returned no addresses (NXDOMAIN or resolution failure). Failing closed.`,
                 extractedTarget: target,
                 resolvedIps: [],
-            });
+            };
         }
-        // ─────────────────────────────────────────────────────────────────────────
-        // Step 6: Exclusion check (exclusions win — checked before authorization)
-        // ─────────────────────────────────────────────────────────────────────────
-        const excluded = this.manifest.excluded_targets;
-        // Check hostname/IP target against excluded list (case-insensitive exact match)
-        if (this.isExcluded(target, excluded)) {
-            return this.result(startTime, {
-                decision: "BLOCKED_EXCLUDED_TARGET",
-                reason: `Target "${target}" matches an excluded target.`,
-                extractedTarget: target,
-                resolvedIps,
-            });
-        }
-        // Check each resolved IP against excluded list
+        // Step 8: Exclusion check (exclusions win — checked before authorization)
         for (const ip of resolvedIps) {
-            if (this.isExcluded(ip, excluded)) {
-                return this.result(startTime, {
+            const ipHit = excluded.find((entry) => matchesExclusion(ip, entry));
+            if (ipHit !== undefined) {
+                return {
                     decision: "BLOCKED_EXCLUDED_TARGET",
-                    reason: `Resolved IP "${ip}" for target "${target}" matches an excluded target.`,
+                    reason: `Resolved IP "${ip}" for target "${target}" matches excluded target "${ipHit}".`,
                     extractedTarget: target,
                     resolvedIps,
-                });
+                };
             }
         }
-        // ─────────────────────────────────────────────────────────────────────────
-        // Step 7: Authorization check
-        // ─────────────────────────────────────────────────────────────────────────
-        const authorizedIpRanges = this.manifest.authorized_targets.ip_ranges;
-        const authorizedDomains = this.manifest.authorized_targets.domains;
-        // 7a: Check hostname against authorized domain patterns
-        const matchedDomain = this.findMatchingDomain(target, authorizedDomains);
+        // Step 9a: Hostname against authorized domain patterns and URL hosts
+        const matchedDomain = authorizedDomains.find((pattern) => matchesDomain(target, pattern)) ??
+            this.urlHosts.find((u) => u.host === target &&
+                urlsForTarget.some((url) => urlWithinScope(url, u.url)))?.url ??
+            null;
         if (matchedDomain !== null) {
-            return this.result(startTime, {
+            const restricted = resolvedIps.filter((ip) => isRestrictedIp(ip) && !authorizedIpRanges.some((r) => isIpInCidr(ip, r)));
+            if (restricted.length > 0) {
+                return {
+                    decision: "BLOCKED_RESTRICTED_IP",
+                    reason: `Target "${target}" matches "${matchedDomain}" but resolves to restricted address(es) ${restricted.join(", ")} (loopback/link-local/cloud metadata) that are not explicitly authorized in ip_ranges.`,
+                    extractedTarget: target,
+                    resolvedIps,
+                };
+            }
+            return {
                 decision: "ALLOWED",
-                reason: `Target "${target}" matches authorized domain pattern "${matchedDomain}".`,
+                reason: `Target "${target}" matches authorized scope item "${matchedDomain}".`,
                 matchedScopeItem: matchedDomain,
                 extractedTarget: target,
                 resolvedIps,
-            });
+            };
         }
-        // 7b: Check resolved IPs against authorized IP ranges.
-        //     For RFC-1918 and cloud metadata IPs: only allow if explicitly in authorized ip_ranges.
-        for (const ip of resolvedIps) {
-            const matchedRange = this.findMatchingIpRange(ip, authorizedIpRanges);
-            if (matchedRange !== null) {
-                return this.result(startTime, {
-                    decision: "ALLOWED",
-                    reason: `Resolved IP "${ip}" for target "${target}" is in authorized range "${matchedRange}".`,
-                    matchedScopeItem: matchedRange,
-                    extractedTarget: target,
-                    resolvedIps,
-                });
-            }
+        // Step 9b: Resolved IPs against authorized IP ranges. Private, loopback
+        // and metadata IPs are only allowed when an ip_range explicitly covers them.
+        const matchedRanges = resolvedIps.map((ip) => authorizedIpRanges.find((r) => isIpInCidr(ip, r)));
+        if (matchedRanges.every((range) => range !== undefined)) {
+            return {
+                decision: "ALLOWED",
+                reason: `All resolved IPs for target "${target}" are within authorized IP ranges.`,
+                matchedScopeItem: [...new Set(matchedRanges)].join(", "),
+                extractedTarget: target,
+                resolvedIps,
+            };
         }
-        // ─────────────────────────────────────────────────────────────────────────
-        // Step 8: No match → BLOCKED_NOT_IN_SCOPE
-        // ─────────────────────────────────────────────────────────────────────────
-        return this.result(startTime, {
+        // Step 10: No match → BLOCKED_NOT_IN_SCOPE
+        return {
             decision: "BLOCKED_NOT_IN_SCOPE",
             reason: `Target "${target}" (resolved IPs: ${resolvedIps.join(", ")}) does not match any authorized target or domain.`,
             extractedTarget: target,
             resolvedIps,
-        });
-    }
-    // ---------------------------------------------------------------------------
-    // Private helpers
-    // ---------------------------------------------------------------------------
-    /**
-     * Check whether `target` matches any entry in `excluded` (case-insensitive
-     * exact string match).
-     */
-    isExcluded(target, excluded) {
-        const lower = target.toLowerCase();
-        return excluded.some((entry) => entry.toLowerCase() === lower);
-    }
-    /**
-     * Find the first authorized domain pattern that matches `hostname`.
-     * Returns the matching pattern string, or null if no match.
-     */
-    findMatchingDomain(hostname, patterns) {
-        for (const pattern of patterns) {
-            if (matchesDomain(hostname, pattern)) {
-                return pattern;
-            }
-        }
-        return null;
-    }
-    /**
-     * Find the first authorized CIDR range that contains `ip`.
-     * Returns the matching CIDR string, or null if no match.
-     *
-     * Note: RFC-1918 and cloud metadata IPs are only allowed if they explicitly
-     * appear within an authorized ip_range entry.  This function performs an
-     * exact `isIpInCidr` check — there is no implicit deny for private ranges
-     * because the exclusion of a private IP from the authorized list naturally
-     * means it will fall through to BLOCKED_NOT_IN_SCOPE in Step 8.
-     */
-    findMatchingIpRange(ip, ranges) {
-        for (const range of ranges) {
-            if (isIpInCidr(ip, range)) {
-                return range;
-            }
-        }
-        return null;
+        };
     }
     /**
      * Build a ValidationResult, automatically populating durationMs.
@@ -197,4 +291,112 @@ export class ScopeValidator {
         };
     }
 }
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Canonical form for comparisons: lower-case, IPv6 brackets removed, trailing
+ * DNS dots stripped ("hr.acme.com." and "HR.ACME.COM" both → "hr.acme.com").
+ */
+function normalizeHost(value) {
+    let s = value.trim().toLowerCase();
+    if (s.startsWith("[") && s.endsWith("]"))
+        s = s.slice(1, -1);
+    while (s.endsWith("."))
+        s = s.slice(0, -1);
+    return s;
+}
+/** Hostname of a URL scope entry, or null if it is not a parseable URL. */
+function hostOf(url) {
+    try {
+        const host = new URL(url).hostname;
+        return host ? normalizeHost(host) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function urlWithinScope(request, scope) {
+    try {
+        const allowed = new URL(scope);
+        const basePath = allowed.pathname.replace(/\/$/, "");
+        return request.origin === allowed.origin &&
+            (request.pathname === basePath || request.pathname.startsWith(`${basePath}/`));
+    }
+    catch {
+        return false;
+    }
+}
+/** Find URLs in structured arguments and free-form command strings. */
+function collectHttpUrls(value, depth = 0) {
+    if (depth > 8)
+        return [];
+    if (typeof value === "string") {
+        const urls = [];
+        for (const match of value.matchAll(/https?:\/\/[^\s"'`<>]+/gi)) {
+            try {
+                urls.push(new URL(match[0]));
+            }
+            catch { /* invalid URLs fail target validation */ }
+        }
+        return urls;
+    }
+    if (Array.isArray(value))
+        return value.flatMap((item) => collectHttpUrls(item, depth + 1));
+    if (value !== null && typeof value === "object") {
+        return Object.values(value).flatMap((item) => collectHttpUrls(item, depth + 1));
+    }
+    return [];
+}
+function hasUnstructuredCommand(value, depth = 0) {
+    if (depth > 8 || value === null || typeof value !== "object")
+        return false;
+    if (Array.isArray(value))
+        return value.some((item) => hasUnstructuredCommand(item, depth + 1));
+    return Object.entries(value).some(([key, item]) => UNSTRUCTURED_KEYS.has(key.toLowerCase()) || hasUnstructuredCommand(item, depth + 1));
+}
+function hasUninspectableDepth(value, depth = 0) {
+    if (value === null || typeof value !== "object")
+        return false;
+    if (depth > 4)
+        return true;
+    return Object.values(value).some((item) => hasUninspectableDepth(item, depth + 1));
+}
+/**
+ * Does `target` (normalized hostname or IP) match an excluded_targets entry?
+ *  - IP / CIDR entries: target IP must fall inside the range.
+ *  - "*.domain" entries: any subdomain of domain, at any depth.
+ *  - URL entries: compared by hostname.
+ *  - Anything else: exact hostname match.
+ */
+function matchesExclusion(target, entry) {
+    const e = normalizeHost(entry);
+    if (!e)
+        return false;
+    if (isIP(e) !== 0 || isCidr(e)) {
+        return isIP(target) !== 0 && isIpInCidr(target, e);
+    }
+    if (e.startsWith("*.")) {
+        const base = e.slice(2);
+        return base.length > 0 && target.endsWith("." + base);
+    }
+    if (e.includes("://")) {
+        const host = hostOf(e);
+        return host !== null && host === target;
+    }
+    return e === target;
+}
+/**
+ * Cloud account entries look like "aws:123456789012". A target matches when it
+ * equals the entry or the part after the provider prefix.
+ */
+function matchesCloudAccount(target, entry) {
+    const e = entry.trim().toLowerCase();
+    if (!e)
+        return false;
+    if (e === target)
+        return true;
+    const colon = e.indexOf(":");
+    return colon !== -1 && e.slice(colon + 1) === target;
+}
 //# sourceMappingURL=validator.js.map

package/dist/src/validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../src/validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,MAAM,OAAO,cAAc;IACR,QAAQ,CAAgB;IACxB,WAAW,CAAc;IACzB,gBAAgB,CAAmB;IAEpD,YACE,QAAuB,EACvB,WAAyB,EACzB,gBAAmC;QAEnC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,IAAI,WAAW,EAAE,CAAC;QACpD,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,IAAI,IAAI,gBAAgB,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,MAA+B;QAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,4EAA4E;QAC5E,gCAAgC;QAChC,4EAA4E;QAC5E,IACE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAC5E,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;YAC1E,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC5B,QAAQ,EAAE,mBAAmB;gBAC7B,MAAM,EAAE,SAAS,QAAQ,gDAAgD,QAAQ,IAAI;aACtF,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,4BAA4B;QAC5B,4EAA4E;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAElE,IAAI,GAAG,GAAG,WAAW,IAAI,GAAG,GAAG,SAAS,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC5B,QAAQ,EAAE,wBAAwB;gBAClC,MAAM,EAAE,kDAAkD,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,GAAG,IAAI;aAC7I,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,4BAA4B;QAC5B,4EAA4E;QAC5E,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEnD,4EAA4E;QAC5E,iDAAiD;QACjD,4EAA4E;QAC5E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC5B,QAAQ,EAAE,mBAAmB;gBAC7B,MAAM,EAAE,mEAAmE;aAC5E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAEjC,4EAA4E;QAC5E,yBAAyB;QACzB,4EAA4E;QAC5E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE3D,iFAAiF;QACjF,4EAA4E;QAC5E,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC5B,QAAQ,EAAE,oBAAoB;gBAC9B,MAAM,EAAE,uBAAuB,MAAM,2EAA2E;gBAChH,eAAe,EAAE,MAAM;gBACvB,WAAW,EAAE,EAAE;aAChB,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAEhD,gFAAgF;QAChF,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC5B,QAAQ,EAAE,yBAAyB;gBACnC,MAAM,EAAE,WAAW,MAAM,+BAA+B;gBACxD,eAAe,EAAE,MAAM;gBACvB,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;QAED,+CAA+C;QAC/C,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;oBAC5B,QAAQ,EAAE,yBAAyB;oBACnC,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,MAAM,+BAA+B;oBAChF,eAAe,EAAE,MAAM;oBACvB,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,8BAA8B;QAC9B,4EAA4E;QAC5E,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,SAAS,CAAC;QACtE,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAEnE,wDAAwD;QACxD,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACzE,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC5B,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,WAAW,MAAM,wCAAwC,aAAa,IAAI;gBAClF,gBAAgB,EAAE,aAAa;gBAC/B,eAAe,EAAE,MAAM;gBACvB,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;QAED,uDAAuD;QACvD,6FAA6F;QAC7F,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;YACtE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;oBAC5B,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,MAAM,6BAA6B,YAAY,IAAI;oBAC9F,gBAAgB,EAAE,YAAY;oBAC9B,eAAe,EAAE,MAAM;oBACvB,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,0CAA0C;QAC1C,4EAA4E;QAC5E,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;YAC5B,QAAQ,EAAE,sBAAsB;YAChC,MAAM,EAAE,WAAW,MAAM,oBAAoB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD;YACtH,eAAe,EAAE,MAAM;YACvB,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;OAGG;IACK,UAAU,CAAC,MAAc,EAAE,QAAkB;QACnD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IACjE,CAAC;IAED;;;OAGG;IACK,kBAAkB,CACxB,QAAgB,EAChB,QAAkB;QAElB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;gBACrC,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;OASG;IACK,mBAAmB,CAAC,EAAU,EAAE,MAAgB;QACtD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,MAAM,CACZ,SAAiB,EACjB,MAA4C;QAE5C,OAAO;YACL,GAAG,MAAM;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../src/validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAI1D,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe;CACrE,CAAC,CAAC;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe;IAC3E,MAAM,EAAE,YAAY,EAAE,iBAAiB;CACxC,CAAC,CAAC;AAEH,MAAM,OAAO,cAAc;IACR,QAAQ,CAAgB;IACxB,WAAW,CAAc;IACzB,gBAAgB,CAAmB;IACpD,uEAAuE;IACtD,QAAQ,CAAkC;IAC1C,yBAAyB,CAAU;IAEpD,YACE,QAAuB,EACvB,WAAyB,EACzB,gBAAmC,EACnC,yBAAyB,GAAG,KAAK;QAEjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,IAAI,WAAW,EAAE,CAAC;QACpD,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACnE,IAAI,CAAC,yBAAyB,GAAG,yBAAyB,CAAC;QAC3D,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,kBAAkB,CAAC,IAAI;aAC7C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;aAC1C,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,MAA+B;QAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,4EAA4E;QAC5E,gEAAgE;QAChE,4EAA4E;QAC5E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC5B,QAAQ,EAAE,yBAAyB;gBACnC,MAAM,EAAE,wDAAwD;aACjE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC5B,QAAQ,EAAE,yBAAyB;gBACnC,MAAM,EAAE,6CAA6C,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,MAAM,qBAAqB;aAC1H,CAAC,CAAC;QACL,CAAC;QACD,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC5B,QAAQ,EAAE,yBAAyB;gBACnC,MAAM,EAAE,8EAA8E;aACvF,CAAC,CAAC;QACL,CAAC;QACD,4EAA4E;QAC5E,2BAA2B;QAC3B,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC5B,QAAQ,EAAE,mBAAmB;gBAC7B,MAAM,EAAE,SAAS,QAAQ,gDAAgD,QAAQ,IAAI;aACtF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,oBAAoB,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACjE,IACE,QAAQ,KAAK,IAAI;YACjB,oBAAoB,CAAC,MAAM,GAAG,CAAC;YAC/B,CAAC,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACxC,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC5B,QAAQ,EAAE,mBAAmB;gBAC7B,MAAM,EAAE,SAAS,QAAQ,oCAAoC,QAAQ,6CAA6C,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;aACtJ,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,yBAAyB,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC5B,QAAQ,EAAE,+BAA+B;gBACzC,MAAM,EAAE,2FAA2F;aACpG,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,4BAA4B;QAC5B,4EAA4E;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAElE,IAAI,GAAG,GAAG,WAAW,IAAI,GAAG,GAAG,SAAS,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC5B,QAAQ,EAAE,wBAAwB;gBAClC,MAAM,EAAE,kDAAkD,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,GAAG,IAAI;aAC7I,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,kCAAkC;QAClC,4EAA4E;QAC5E,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC7E,CAAC,CAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,EAAE,0BAA0B,QAAQ,0BAA0B,EAAE;gBACzG,CAAC,CAAC,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,EAAE,yCAAyC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC9G,CAAC;QAED,4EAA4E;QAC5E,4CAA4C;QAC5C,4EAA4E;QAC5E,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACzD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;YAC5B,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,OAAO,OAAO,CAAC,MAAM,0BAA0B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAC/F,gBAAgB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACjF,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACjE,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;SACvE,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,sBAAsB;IACtB,8EAA8E;IAEtE,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,WAAkB;QAChE,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,GACjF,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAChD,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,CAAC;QAE1F,wEAAwE;QACxE,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO;gBACL,QAAQ,EAAE,yBAAyB;gBACnC,MAAM,EAAE,WAAW,MAAM,8BAA8B,OAAO,IAAI;gBAClE,eAAe,EAAE,MAAM;gBACvB,WAAW,EAAE,EAAE;aAChB,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;YAC5C,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACpD,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO;gBACL,QAAQ,EAAE,sBAAsB;gBAChC,MAAM,EAAE,wBAAwB,MAAM,yCAAyC;gBAC/E,eAAe,EAAE,MAAM;gBACvB,WAAW,EAAE,EAAE;aAChB,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1F,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO;gBACL,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,WAAW,MAAM,uCAAuC,cAAc,IAAI;gBAClF,gBAAgB,EAAE,cAAc;gBAChC,eAAe,EAAE,MAAM;gBACvB,WAAW,EAAE,EAAE;aAChB,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACnE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO;oBACL,QAAQ,EAAE,yBAAyB;oBACnC,MAAM,EAAE,iBAAiB,MAAM,+BAA+B,GAAG,IAAI;oBACrE,eAAe,EAAE,MAAM;oBACvB,WAAW,EAAE,CAAC,MAAM,CAAC;iBACtB,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;YACvE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO;oBACL,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,iBAAiB,MAAM,iCAAiC,KAAK,IAAI;oBACzE,gBAAgB,EAAE,KAAK;oBACvB,eAAe,EAAE,MAAM;oBACvB,WAAW,EAAE,CAAC,MAAM,CAAC;iBACtB,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,sBAAsB;gBAChC,MAAM,EAAE,iBAAiB,MAAM,sDAAsD;gBACrF,eAAe,EAAE,MAAM;gBACvB,WAAW,EAAE,CAAC,MAAM,CAAC;aACtB,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE3D,iFAAiF;QACjF,4EAA4E;QAC5E,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,QAAQ,EAAE,oBAAoB;gBAC9B,MAAM,EAAE,uBAAuB,MAAM,2EAA2E;gBAChH,eAAe,EAAE,MAAM;gBACvB,WAAW,EAAE,EAAE;aAChB,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;YACpE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO;oBACL,QAAQ,EAAE,yBAAyB;oBACnC,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,MAAM,8BAA8B,KAAK,IAAI;oBACxF,eAAe,EAAE,MAAM;oBACvB,WAAW;iBACZ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,MAAM,aAAa,GACjB,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM;gBACzC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;YAC/D,IAAI,CAAC;QACP,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CACnC,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CACjF,CAAC;YACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO;oBACL,QAAQ,EAAE,uBAAuB;oBACjC,MAAM,EAAE,WAAW,MAAM,cAAc,aAAa,4CAA4C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,wFAAwF;oBAC7M,eAAe,EAAE,MAAM;oBACvB,WAAW;iBACZ,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,WAAW,MAAM,oCAAoC,aAAa,IAAI;gBAC9E,gBAAgB,EAAE,aAAa;gBAC/B,eAAe,EAAE,MAAM;gBACvB,WAAW;aACZ,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,6EAA6E;QAC7E,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAC3C,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAClD,CAAC;QACF,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;YACxD,OAAO;gBACL,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,gCAAgC,MAAM,oCAAoC;gBAClF,gBAAgB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBACxD,eAAe,EAAE,MAAM;gBACvB,WAAW;aACZ,CAAC;QACJ,CAAC;QAED,2CAA2C;QAC3C,OAAO;YACL,QAAQ,EAAE,sBAAsB;YAChC,MAAM,EAAE,WAAW,MAAM,oBAAoB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD;YACtH,eAAe,EAAE,MAAM;YACvB,WAAW;SACZ,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,SAAiB,EAAE,MAAoB;QACpD,OAAO;YACL,GAAG,MAAM;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;CACF;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,2EAA2E;AAC3E,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACnC,OAAO,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,OAAY,EAAE,KAAa;IACjD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrD,OAAO,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YACtC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,eAAe,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAChD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAU,EAAE,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IACvD,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/F,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAChD,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,sBAAsB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,KAAa;IACrD,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAErB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,KAAK,MAAM,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,MAAc,EAAE,KAAa;IACxD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC;AACvD,CAAC"}

package/examples/claude-desktop-burp-config.json

@@ -1,14 +1,14 @@
 {
   "mcpServers": {
     "burp-scoped": {
-      "command": "C:\\Users\\MichelChamberland\\AppData\\Roaming\\npm\\integsec-agentic-pentest-proxy.cmd",
-      "args": [],
+      "command": "npx",
+      "args": ["-y", "@integsec/agentic-pentest-proxy"],
       "env": {
-        "SCOPE_MANIFEST_PATH": "C:/Work/mcp-scope-proxy/examples/scope-test-integsec.json",
+        "SCOPE_MANIFEST_PATH": "C:/path/to/scope.json",
         "MCP_TRANSPORT": "stdio",
-        "UPSTREAM_MCP_COMMAND": "c:\\users\\michelchamberland\\appdata\\local\\programs\\burpsuitepro\\jre\\bin\\java.exe",
-        "UPSTREAM_MCP_ARGS": "-jar,C:\\Users\\MichelChamberland\\AppData\\Roaming\\BurpSuite\\mcp-proxy\\mcp-proxy-all.jar,--sse-url,http://127.0.0.1:9876",
-        "AUDIT_LOG_PATH": "C:/Work/mcp-scope-proxy/audit"
+        "UPSTREAM_MCP_COMMAND": "java",
+        "UPSTREAM_MCP_ARGS": "-jar,C:/path/to/mcp-proxy-all.jar,--sse-url,http://127.0.0.1:9876",
+        "AUDIT_LOG_PATH": "C:/path/to/audit"
       }
     }
   }

package/package.json

@@ -1,24 +1,31 @@
 {
   "name": "@integsec/agentic-pentest-proxy",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "IntegSec Agentic Pentest MCP Proxy — enforce penetration testing engagement scope for AI agents",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/IntegSec/agentic-pentest-proxy.git"
+  },
   "type": "module",
   "bin": {
     "integsec-agentic-pentest-proxy": "dist/bin/integsec-agentic-pentest-proxy.js",
-    "integsec-agentic-pentest-tui": "dist/bin/integsec-agentic-pentest-tui.js"
+    "integsec-agentic-pentest-tui": "dist/bin/integsec-agentic-pentest-tui.js",
+    "integsec-agentic-pentest-manifest": "dist/bin/integsec-agentic-pentest-manifest.js"
   },
   "files": [
     "dist/",
     "examples/",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "main": "./dist/src/index.js",
   "types": "./dist/src/index.d.ts",
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && node -e \"const fs=require('fs'),path=require('path');const src='src/builder/web/client-form.html',dst='dist/src/builder/web/client-form.html';fs.mkdirSync(path.dirname(dst),{recursive:true});fs.copyFileSync(src,dst);console.log('Copied',src,'->',dst);\"",
     "dev": "tsc --watch",
     "test": "vitest run",
     "test:watch": "vitest",
+    "driver": "vitest run --config vitest.driver.config.ts",
     "lint": "tsc --noEmit",
     "start": "node dist/bin/integsec-agentic-pentest-proxy.js"
   },
@@ -35,29 +42,32 @@
     "offensive-security"
   ],
   "author": "IntegSec",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.0",
     "dotenv": "^16.4.0",
     "ink": "^5.2.1",
     "ink-spinner": "^5.0.0",
-    "ip-cidr": "^4.0.1",
+    "ipaddr.js": "^2.5.0",
     "react": "^18.3.1",
-    "zod": "^3.24.0"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@types/node": "^20.0.0",
+    "@types/node": "^22.20.5",
     "@types/react": "^18.3.28",
     "typescript": "^5.7.0",
-    "vitest": "^3.0.0"
+    "vitest": "^5.1.0"
   },
   "optionalDependencies": {
     "@aws-sdk/client-cloudwatch-logs": "^3.700.0",
+    "@aws-sdk/client-secrets-manager": "^3.1164.0",
     "@azure/identity": "^4.5.0",
+    "@azure/keyvault-secrets": "^4.12.0",
     "@azure/monitor-ingestion": "^1.1.0",
-    "@google-cloud/logging": "^11.0.0"
+    "@google-cloud/logging": "^12.3.0",
+    "@google-cloud/secret-manager": "^7.2.0"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.0.0"
   }
 }