@riotprompt/riotprompt 0.0.20 → 1.0.0

package/dist/security/audit-logger.js

@@ -0,0 +1,281 @@
+import { wrapLogger, DEFAULT_LOGGER } from '../logger.js';
+
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+const DEFAULT_CONFIG = {
+    enabled: true,
+    logLevel: 'warning',
+    includeContext: true,
+    maxContextSize: 1000
+};
+class SecurityAuditLogger {
+    /**
+     * Log a security event
+     */ log(event) {
+        var // Always call event handler for monitoring (before log level filter)
+        _this_config_onEvent, _this_config;
+        if (!this.config.enabled) return;
+        const fullEvent = {
+            ...event,
+            timestamp: new Date(),
+            context: this.sanitizeContext(event.context)
+        };
+        // Track event counts
+        const count = this.eventCount.get(event.type) || 0;
+        this.eventCount.set(event.type, count + 1);
+        (_this_config_onEvent = (_this_config = this.config).onEvent) === null || _this_config_onEvent === void 0 ? void 0 : _this_config_onEvent.call(_this_config, fullEvent);
+        // Check log level for actual logging output
+        if (!this.shouldLog(event.severity)) return;
+        // Log the event
+        const logMessage = this.formatEvent(fullEvent);
+        switch(event.severity){
+            case 'critical':
+                this.logger.error(`[CRITICAL] ${logMessage}`);
+                break;
+            case 'error':
+                this.logger.error(logMessage);
+                break;
+            case 'warning':
+                this.logger.warn(logMessage);
+                break;
+            case 'info':
+                this.logger.info(logMessage);
+                break;
+        }
+    }
+    /**
+     * Convenience methods for common events
+     */ pathTraversalBlocked(path, reason) {
+        this.log({
+            type: 'path_traversal_blocked',
+            severity: 'warning',
+            message: `Path traversal attempt blocked: ${reason}`,
+            context: {
+                attemptedPath: this.sanitizePath(path)
+            }
+        });
+    }
+    pathValidationFailed(path, reason) {
+        this.log({
+            type: 'path_validation_failed',
+            severity: 'warning',
+            message: `Path validation failed: ${reason}`,
+            context: {
+                attemptedPath: this.sanitizePath(path)
+            }
+        });
+    }
+    toolValidationFailed(toolName, reason) {
+        this.log({
+            type: 'tool_validation_failed',
+            severity: 'warning',
+            message: `Tool parameter validation failed for "${toolName}": ${reason}`,
+            context: {
+                toolName
+            }
+        });
+    }
+    toolExecutionBlocked(toolName, reason) {
+        this.log({
+            type: 'tool_execution_blocked',
+            severity: 'error',
+            message: `Tool execution blocked for "${toolName}": ${reason}`,
+            context: {
+                toolName
+            }
+        });
+    }
+    toolTimeout(toolName, timeoutMs) {
+        this.log({
+            type: 'tool_timeout',
+            severity: 'warning',
+            message: `Tool "${toolName}" timed out after ${timeoutMs}ms`,
+            context: {
+                toolName,
+                timeoutMs
+            }
+        });
+    }
+    secretRedacted(source) {
+        this.log({
+            type: 'secret_redacted',
+            severity: 'info',
+            message: `Sensitive data redacted from ${source}`,
+            context: {
+                source
+            }
+        });
+    }
+    apiKeyUsed(provider) {
+        this.log({
+            type: 'api_key_used',
+            severity: 'info',
+            message: `API key accessed for provider: ${provider}`,
+            context: {
+                provider
+            }
+        });
+    }
+    deserializationFailed(source, reason) {
+        this.log({
+            type: 'deserialization_failed',
+            severity: 'warning',
+            message: `Deserialization failed from ${source}: ${reason}`,
+            context: {
+                source
+            }
+        });
+    }
+    regexTimeout(pattern, timeoutMs) {
+        this.log({
+            type: 'regex_timeout',
+            severity: 'warning',
+            message: `Regex operation timed out after ${timeoutMs}ms`,
+            context: {
+                patternLength: pattern.length,
+                timeoutMs
+            }
+        });
+    }
+    requestTimeout(operation, timeoutMs) {
+        this.log({
+            type: 'request_timeout',
+            severity: 'warning',
+            message: `Operation "${operation}" timed out after ${timeoutMs}ms`,
+            context: {
+                operation,
+                timeoutMs
+            }
+        });
+    }
+    rateLimitExceeded(resource, limit) {
+        this.log({
+            type: 'rate_limit_exceeded',
+            severity: 'warning',
+            message: `Rate limit exceeded for ${resource}: limit is ${limit}`,
+            context: {
+                resource,
+                limit
+            }
+        });
+    }
+    /**
+     * Get event statistics
+     */ getStats() {
+        return new Map(this.eventCount);
+    }
+    /**
+     * Get total event count
+     */ getTotalEventCount() {
+        let total = 0;
+        for (const count of this.eventCount.values()){
+            total += count;
+        }
+        return total;
+    }
+    /**
+     * Reset statistics
+     */ resetStats() {
+        this.eventCount.clear();
+    }
+    /**
+     * Check if any events of a specific type have been logged
+     */ hasEventsOfType(type) {
+        return (this.eventCount.get(type) || 0) > 0;
+    }
+    /**
+     * Get count for a specific event type
+     */ getEventCount(type) {
+        return this.eventCount.get(type) || 0;
+    }
+    shouldLog(severity) {
+        const levels = [
+            'info',
+            'warning',
+            'error',
+            'critical'
+        ];
+        const configLevel = levels.indexOf(this.config.logLevel === 'all' ? 'info' : this.config.logLevel);
+        const eventLevel = levels.indexOf(severity);
+        return eventLevel >= configLevel;
+    }
+    formatEvent(event) {
+        let message = `[${event.type}] ${event.message}`;
+        if (this.config.includeContext && event.context) {
+            message += ` | Context: ${JSON.stringify(event.context)}`;
+        }
+        return message;
+    }
+    sanitizeContext(context) {
+        if (!context || !this.config.includeContext) return undefined;
+        const sanitized = {};
+        let size = 0;
+        for (const [key, value] of Object.entries(context)){
+            const stringValue = String(value);
+            if (size + stringValue.length > this.config.maxContextSize) break;
+            // Never log sensitive-looking values
+            if (this.looksLikeSensitiveKey(key)) {
+                sanitized[key] = '[REDACTED]';
+            } else {
+                sanitized[key] = value;
+            }
+            size += stringValue.length;
+        }
+        return sanitized;
+    }
+    sanitizePath(path) {
+        // Only show last component and length
+        const parts = path.split(/[/\\]/);
+        const lastPart = parts[parts.length - 1];
+        return `.../${lastPart} (${path.length} chars)`;
+    }
+    looksLikeSensitiveKey(key) {
+        const sensitivePatterns = [
+            /key/i,
+            /secret/i,
+            /password/i,
+            /token/i,
+            /auth/i,
+            /credential/i
+        ];
+        return sensitivePatterns.some((p)=>p.test(key));
+    }
+    constructor(config = {}, logger){
+        _define_property(this, "config", void 0);
+        _define_property(this, "logger", void 0);
+        _define_property(this, "eventCount", new Map());
+        this.config = {
+            ...DEFAULT_CONFIG,
+            ...config
+        };
+        this.logger = wrapLogger(logger || DEFAULT_LOGGER, 'SecurityAudit');
+    }
+}
+// Global instance for convenience
+let globalAuditLogger = null;
+function getAuditLogger() {
+    if (!globalAuditLogger) {
+        globalAuditLogger = new SecurityAuditLogger();
+    }
+    return globalAuditLogger;
+}
+function configureAuditLogger(config, logger) {
+    globalAuditLogger = new SecurityAuditLogger(config, logger);
+}
+function resetAuditLogger() {
+    globalAuditLogger = null;
+}
+
+export { SecurityAuditLogger, configureAuditLogger, getAuditLogger, resetAuditLogger };
+//# sourceMappingURL=audit-logger.js.map

package/dist/security/audit-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.js","sources":["../../src/security/audit-logger.ts"],"sourcesContent":["import { SecurityEvent, SecurityEventType } from './events';\nimport { Logger, DEFAULT_LOGGER, wrapLogger } from '../logger';\n\nexport interface AuditLoggerConfig {\n    enabled: boolean;\n    logLevel: 'all' | 'warning' | 'error' | 'critical';\n    includeContext: boolean;\n    maxContextSize: number;\n    onEvent?: (event: SecurityEvent) => void;\n}\n\nconst DEFAULT_CONFIG: AuditLoggerConfig = {\n    enabled: true,\n    logLevel: 'warning',\n    includeContext: true,\n    maxContextSize: 1000,\n};\n\nexport class SecurityAuditLogger {\n    private config: AuditLoggerConfig;\n    private logger: Logger;\n    private eventCount: Map<SecurityEventType, number> = new Map();\n\n    constructor(config: Partial<AuditLoggerConfig> = {}, logger?: Logger) {\n        this.config = { ...DEFAULT_CONFIG, ...config };\n        this.logger = wrapLogger(logger || DEFAULT_LOGGER, 'SecurityAudit');\n    }\n\n    /**\n     * Log a security event\n     */\n    log(event: Omit<SecurityEvent, 'timestamp'>): void {\n        if (!this.config.enabled) return;\n\n        const fullEvent: SecurityEvent = {\n            ...event,\n            timestamp: new Date(),\n            context: this.sanitizeContext(event.context),\n        };\n\n        // Track event counts\n        const count = this.eventCount.get(event.type) || 0;\n        this.eventCount.set(event.type, count + 1);\n\n        // Always call event handler for monitoring (before log level filter)\n        this.config.onEvent?.(fullEvent);\n\n        // Check log level for actual logging output\n        if (!this.shouldLog(event.severity)) return;\n\n        // Log the event\n        const logMessage = this.formatEvent(fullEvent);\n    \n        switch (event.severity) {\n            case 'critical':\n                this.logger.error(`[CRITICAL] ${logMessage}`);\n                break;\n            case 'error':\n                this.logger.error(logMessage);\n                break;\n            case 'warning':\n                this.logger.warn(logMessage);\n                break;\n            case 'info':\n                this.logger.info(logMessage);\n                break;\n        }\n    }\n\n    /**\n     * Convenience methods for common events\n     */\n    pathTraversalBlocked(path: string, reason: string): void {\n        this.log({\n            type: 'path_traversal_blocked',\n            severity: 'warning',\n            message: `Path traversal attempt blocked: ${reason}`,\n            context: { attemptedPath: this.sanitizePath(path) },\n        });\n    }\n\n    pathValidationFailed(path: string, reason: string): void {\n        this.log({\n            type: 'path_validation_failed',\n            severity: 'warning',\n            message: `Path validation failed: ${reason}`,\n            context: { attemptedPath: this.sanitizePath(path) },\n        });\n    }\n\n    toolValidationFailed(toolName: string, reason: string): void {\n        this.log({\n            type: 'tool_validation_failed',\n            severity: 'warning',\n            message: `Tool parameter validation failed for \"${toolName}\": ${reason}`,\n            context: { toolName },\n        });\n    }\n\n    toolExecutionBlocked(toolName: string, reason: string): void {\n        this.log({\n            type: 'tool_execution_blocked',\n            severity: 'error',\n            message: `Tool execution blocked for \"${toolName}\": ${reason}`,\n            context: { toolName },\n        });\n    }\n\n    toolTimeout(toolName: string, timeoutMs: number): void {\n        this.log({\n            type: 'tool_timeout',\n            severity: 'warning',\n            message: `Tool \"${toolName}\" timed out after ${timeoutMs}ms`,\n            context: { toolName, timeoutMs },\n        });\n    }\n\n    secretRedacted(source: string): void {\n        this.log({\n            type: 'secret_redacted',\n            severity: 'info',\n            message: `Sensitive data redacted from ${source}`,\n            context: { source },\n        });\n    }\n\n    apiKeyUsed(provider: string): void {\n        this.log({\n            type: 'api_key_used',\n            severity: 'info',\n            message: `API key accessed for provider: ${provider}`,\n            context: { provider },\n        });\n    }\n\n    deserializationFailed(source: string, reason: string): void {\n        this.log({\n            type: 'deserialization_failed',\n            severity: 'warning',\n            message: `Deserialization failed from ${source}: ${reason}`,\n            context: { source },\n        });\n    }\n\n    regexTimeout(pattern: string, timeoutMs: number): void {\n        this.log({\n            type: 'regex_timeout',\n            severity: 'warning',\n            message: `Regex operation timed out after ${timeoutMs}ms`,\n            context: { patternLength: pattern.length, timeoutMs },\n        });\n    }\n\n    requestTimeout(operation: string, timeoutMs: number): void {\n        this.log({\n            type: 'request_timeout',\n            severity: 'warning',\n            message: `Operation \"${operation}\" timed out after ${timeoutMs}ms`,\n            context: { operation, timeoutMs },\n        });\n    }\n\n    rateLimitExceeded(resource: string, limit: number): void {\n        this.log({\n            type: 'rate_limit_exceeded',\n            severity: 'warning',\n            message: `Rate limit exceeded for ${resource}: limit is ${limit}`,\n            context: { resource, limit },\n        });\n    }\n\n    /**\n     * Get event statistics\n     */\n    getStats(): Map<SecurityEventType, number> {\n        return new Map(this.eventCount);\n    }\n\n    /**\n     * Get total event count\n     */\n    getTotalEventCount(): number {\n        let total = 0;\n        for (const count of this.eventCount.values()) {\n            total += count;\n        }\n        return total;\n    }\n\n    /**\n     * Reset statistics\n     */\n    resetStats(): void {\n        this.eventCount.clear();\n    }\n\n    /**\n     * Check if any events of a specific type have been logged\n     */\n    hasEventsOfType(type: SecurityEventType): boolean {\n        return (this.eventCount.get(type) || 0) > 0;\n    }\n\n    /**\n     * Get count for a specific event type\n     */\n    getEventCount(type: SecurityEventType): number {\n        return this.eventCount.get(type) || 0;\n    }\n\n    private shouldLog(severity: SecurityEvent['severity']): boolean {\n        const levels = ['info', 'warning', 'error', 'critical'];\n        const configLevel = levels.indexOf(this.config.logLevel === 'all' ? 'info' : this.config.logLevel);\n        const eventLevel = levels.indexOf(severity);\n        return eventLevel >= configLevel;\n    }\n\n    private formatEvent(event: SecurityEvent): string {\n        let message = `[${event.type}] ${event.message}`;\n        if (this.config.includeContext && event.context) {\n            message += ` | Context: ${JSON.stringify(event.context)}`;\n        }\n        return message;\n    }\n\n    private sanitizeContext(context?: Record<string, unknown>): Record<string, unknown> | undefined {\n        if (!context || !this.config.includeContext) return undefined;\n\n        const sanitized: Record<string, unknown> = {};\n        let size = 0;\n\n        for (const [key, value] of Object.entries(context)) {\n            const stringValue = String(value);\n            if (size + stringValue.length > this.config.maxContextSize) break;\n      \n            // Never log sensitive-looking values\n            if (this.looksLikeSensitiveKey(key)) {\n                sanitized[key] = '[REDACTED]';\n            } else {\n                sanitized[key] = value;\n            }\n            size += stringValue.length;\n        }\n\n        return sanitized;\n    }\n\n    private sanitizePath(path: string): string {\n        // Only show last component and length\n        const parts = path.split(/[/\\\\]/);\n        const lastPart = parts[parts.length - 1];\n        return `.../${lastPart} (${path.length} chars)`;\n    }\n\n    private looksLikeSensitiveKey(key: string): boolean {\n        const sensitivePatterns = [\n            /key/i, /secret/i, /password/i, /token/i, /auth/i, /credential/i\n        ];\n        return sensitivePatterns.some(p => p.test(key));\n    }\n}\n\n// Global instance for convenience\nlet globalAuditLogger: SecurityAuditLogger | null = null;\n\nexport function getAuditLogger(): SecurityAuditLogger {\n    if (!globalAuditLogger) {\n        globalAuditLogger = new SecurityAuditLogger();\n    }\n    return globalAuditLogger;\n}\n\nexport function configureAuditLogger(config: Partial<AuditLoggerConfig>, logger?: Logger): void {\n    globalAuditLogger = new SecurityAuditLogger(config, logger);\n}\n\nexport function resetAuditLogger(): void {\n    globalAuditLogger = null;\n}\n\n"],"names":["DEFAULT_CONFIG","enabled","logLevel","includeContext","maxContextSize","SecurityAuditLogger","log","event","config","fullEvent","timestamp","Date","context","sanitizeContext","count","eventCount","get","type","set","onEvent","shouldLog","severity","logMessage","formatEvent","logger","error","warn","info","pathTraversalBlocked","path","reason","message","attemptedPath","sanitizePath","pathValidationFailed","toolValidationFailed","toolName","toolExecutionBlocked","toolTimeout","timeoutMs","secretRedacted","source","apiKeyUsed","provider","deserializationFailed","regexTimeout","pattern","patternLength","length","requestTimeout","operation","rateLimitExceeded","resource","limit","getStats","Map","getTotalEventCount","total","values","resetStats","clear","hasEventsOfType","getEventCount","levels","configLevel","indexOf","eventLevel","JSON","stringify","undefined","sanitized","size","key","value","Object","entries","stringValue","String","looksLikeSensitiveKey","parts","split","lastPart","sensitivePatterns","some","p","test","wrapLogger","DEFAULT_LOGGER","globalAuditLogger","getAuditLogger","configureAuditLogger","resetAuditLogger"],"mappings":";;;;;;;;;;;;;;;AAWA,MAAMA,cAAAA,GAAoC;IACtCC,OAAAA,EAAS,IAAA;IACTC,QAAAA,EAAU,SAAA;IACVC,cAAAA,EAAgB,IAAA;IAChBC,cAAAA,EAAgB;AACpB,CAAA;AAEO,MAAMC,mBAAAA,CAAAA;AAUT;;QAGAC,GAAAA,CAAIC,KAAuC,EAAQ;;QAc/C,oBAAA,EAAA,YAAA;AAbA,QAAA,IAAI,CAAC,IAAI,CAACC,MAAM,CAACP,OAAO,EAAE;AAE1B,QAAA,MAAMQ,SAAAA,GAA2B;AAC7B,YAAA,GAAGF,KAAK;AACRG,YAAAA,SAAAA,EAAW,IAAIC,IAAAA,EAAAA;AACfC,YAAAA,OAAAA,EAAS,IAAI,CAACC,eAAe,CAACN,MAAMK,OAAO;AAC/C,SAAA;;QAGA,MAAME,KAAAA,GAAQ,IAAI,CAACC,UAAU,CAACC,GAAG,CAACT,KAAAA,CAAMU,IAAI,CAAA,IAAK,CAAA;QACjD,IAAI,CAACF,UAAU,CAACG,GAAG,CAACX,KAAAA,CAAMU,IAAI,EAAEH,KAAAA,GAAQ,CAAA,CAAA;SAGxC,oBAAA,GAAA,CAAA,YAAA,GAAA,IAAI,CAACN,MAAM,EAACW,OAAO,MAAA,IAAA,IAAnB,oBAAA,KAAA,MAAA,GAAA,MAAA,GAAA,oBAAA,CAAA,IAAA,CAAA,YAAA,EAAsBV,SAAAA,CAAAA;;AAGtB,QAAA,IAAI,CAAC,IAAI,CAACW,SAAS,CAACb,KAAAA,CAAMc,QAAQ,CAAA,EAAG;;AAGrC,QAAA,MAAMC,UAAAA,GAAa,IAAI,CAACC,WAAW,CAACd,SAAAA,CAAAA;AAEpC,QAAA,OAAQF,MAAMc,QAAQ;YAClB,KAAK,UAAA;gBACD,IAAI,CAACG,MAAM,CAACC,KAAK,CAAC,CAAC,WAAW,EAAEH,UAAAA,CAAAA,CAAY,CAAA;AAC5C,gBAAA;YACJ,KAAK,OAAA;AACD,gBAAA,IAAI,CAACE,MAAM,CAACC,KAAK,CAACH,UAAAA,CAAAA;AAClB,gBAAA;YACJ,KAAK,SAAA;AACD,gBAAA,IAAI,CAACE,MAAM,CAACE,IAAI,CAACJ,UAAAA,CAAAA;AACjB,gBAAA;YACJ,KAAK,MAAA;AACD,gBAAA,IAAI,CAACE,MAAM,CAACG,IAAI,CAACL,UAAAA,CAAAA;AACjB,gBAAA;AACR;AACJ,IAAA;AAEA;;AAEC,QACDM,oBAAAA,CAAqBC,IAAY,EAAEC,MAAc,EAAQ;QACrD,IAAI,CAACxB,GAAG,CAAC;YACLW,IAAAA,EAAM,wBAAA;YACNI,QAAAA,EAAU,SAAA;YACVU,OAAAA,EAAS,CAAC,gCAAgC,EAAED,MAAAA,CAAAA,CAAQ;YACpDlB,OAAAA,EAAS;gBAAEoB,aAAAA,EAAe,IAAI,CAACC,YAAY,CAACJ,IAAAA;AAAM;AACtD,SAAA,CAAA;AACJ,IAAA;IAEAK,oBAAAA,CAAqBL,IAAY,EAAEC,MAAc,EAAQ;QACrD,IAAI,CAACxB,GAAG,CAAC;YACLW,IAAAA,EAAM,wBAAA;YACNI,QAAAA,EAAU,SAAA;YACVU,OAAAA,EAAS,CAAC,wBAAwB,EAAED,MAAAA,CAAAA,CAAQ;YAC5ClB,OAAAA,EAAS;gBAAEoB,aAAAA,EAAe,IAAI,CAACC,YAAY,CAACJ,IAAAA;AAAM;AACtD,SAAA,CAAA;AACJ,IAAA;IAEAM,oBAAAA,CAAqBC,QAAgB,EAAEN,MAAc,EAAQ;QACzD,IAAI,CAACxB,GAAG,CAAC;YACLW,IAAAA,EAAM,wBAAA;YACNI,QAAAA,EAAU,SAAA;AACVU,YAAAA,OAAAA,EAAS,CAAC,sCAAsC,EAAEK,QAAAA,CAAS,GAAG,EAAEN,MAAAA,CAAAA,CAAQ;YACxElB,OAAAA,EAAS;AAAEwB,gBAAAA;AAAS;AACxB,SAAA,CAAA;AACJ,IAAA;IAEAC,oBAAAA,CAAqBD,QAAgB,EAAEN,MAAc,EAAQ;QACzD,IAAI,CAACxB,GAAG,CAAC;YACLW,IAAAA,EAAM,wBAAA;YACNI,QAAAA,EAAU,OAAA;AACVU,YAAAA,OAAAA,EAAS,CAAC,4BAA4B,EAAEK,QAAAA,CAAS,GAAG,EAAEN,MAAAA,CAAAA,CAAQ;YAC9DlB,OAAAA,EAAS;AAAEwB,gBAAAA;AAAS;AACxB,SAAA,CAAA;AACJ,IAAA;IAEAE,WAAAA,CAAYF,QAAgB,EAAEG,SAAiB,EAAQ;QACnD,IAAI,CAACjC,GAAG,CAAC;YACLW,IAAAA,EAAM,cAAA;YACNI,QAAAA,EAAU,SAAA;YACVU,OAAAA,EAAS,CAAC,MAAM,EAAEK,QAAAA,CAAS,kBAAkB,EAAEG,SAAAA,CAAU,EAAE,CAAC;YAC5D3B,OAAAA,EAAS;AAAEwB,gBAAAA,QAAAA;AAAUG,gBAAAA;AAAU;AACnC,SAAA,CAAA;AACJ,IAAA;AAEAC,IAAAA,cAAAA,CAAeC,MAAc,EAAQ;QACjC,IAAI,CAACnC,GAAG,CAAC;YACLW,IAAAA,EAAM,iBAAA;YACNI,QAAAA,EAAU,MAAA;YACVU,OAAAA,EAAS,CAAC,6BAA6B,EAAEU,MAAAA,CAAAA,CAAQ;YACjD7B,OAAAA,EAAS;AAAE6B,gBAAAA;AAAO;AACtB,SAAA,CAAA;AACJ,IAAA;AAEAC,IAAAA,UAAAA,CAAWC,QAAgB,EAAQ;QAC/B,IAAI,CAACrC,GAAG,CAAC;YACLW,IAAAA,EAAM,cAAA;YACNI,QAAAA,EAAU,MAAA;YACVU,OAAAA,EAAS,CAAC,+BAA+B,EAAEY,QAAAA,CAAAA,CAAU;YACrD/B,OAAAA,EAAS;AAAE+B,gBAAAA;AAAS;AACxB,SAAA,CAAA;AACJ,IAAA;IAEAC,qBAAAA,CAAsBH,MAAc,EAAEX,MAAc,EAAQ;QACxD,IAAI,CAACxB,GAAG,CAAC;YACLW,IAAAA,EAAM,wBAAA;YACNI,QAAAA,EAAU,SAAA;AACVU,YAAAA,OAAAA,EAAS,CAAC,4BAA4B,EAAEU,MAAAA,CAAO,EAAE,EAAEX,MAAAA,CAAAA,CAAQ;YAC3DlB,OAAAA,EAAS;AAAE6B,gBAAAA;AAAO;AACtB,SAAA,CAAA;AACJ,IAAA;IAEAI,YAAAA,CAAaC,OAAe,EAAEP,SAAiB,EAAQ;QACnD,IAAI,CAACjC,GAAG,CAAC;YACLW,IAAAA,EAAM,eAAA;YACNI,QAAAA,EAAU,SAAA;AACVU,YAAAA,OAAAA,EAAS,CAAC,gCAAgC,EAAEQ,SAAAA,CAAU,EAAE,CAAC;YACzD3B,OAAAA,EAAS;AAAEmC,gBAAAA,aAAAA,EAAeD,QAAQE,MAAM;AAAET,gBAAAA;AAAU;AACxD,SAAA,CAAA;AACJ,IAAA;IAEAU,cAAAA,CAAeC,SAAiB,EAAEX,SAAiB,EAAQ;QACvD,IAAI,CAACjC,GAAG,CAAC;YACLW,IAAAA,EAAM,iBAAA;YACNI,QAAAA,EAAU,SAAA;YACVU,OAAAA,EAAS,CAAC,WAAW,EAAEmB,SAAAA,CAAU,kBAAkB,EAAEX,SAAAA,CAAU,EAAE,CAAC;YAClE3B,OAAAA,EAAS;AAAEsC,gBAAAA,SAAAA;AAAWX,gBAAAA;AAAU;AACpC,SAAA,CAAA;AACJ,IAAA;IAEAY,iBAAAA,CAAkBC,QAAgB,EAAEC,KAAa,EAAQ;QACrD,IAAI,CAAC/C,GAAG,CAAC;YACLW,IAAAA,EAAM,qBAAA;YACNI,QAAAA,EAAU,SAAA;AACVU,YAAAA,OAAAA,EAAS,CAAC,wBAAwB,EAAEqB,QAAAA,CAAS,WAAW,EAAEC,KAAAA,CAAAA,CAAO;YACjEzC,OAAAA,EAAS;AAAEwC,gBAAAA,QAAAA;AAAUC,gBAAAA;AAAM;AAC/B,SAAA,CAAA;AACJ,IAAA;AAEA;;AAEC,QACDC,QAAAA,GAA2C;AACvC,QAAA,OAAO,IAAIC,GAAAA,CAAI,IAAI,CAACxC,UAAU,CAAA;AAClC,IAAA;AAEA;;AAEC,QACDyC,kBAAAA,GAA6B;AACzB,QAAA,IAAIC,KAAAA,GAAQ,CAAA;AACZ,QAAA,KAAK,MAAM3C,KAAAA,IAAS,IAAI,CAACC,UAAU,CAAC2C,MAAM,EAAA,CAAI;YAC1CD,KAAAA,IAAS3C,KAAAA;AACb,QAAA;QACA,OAAO2C,KAAAA;AACX,IAAA;AAEA;;AAEC,QACDE,UAAAA,GAAmB;QACf,IAAI,CAAC5C,UAAU,CAAC6C,KAAK,EAAA;AACzB,IAAA;AAEA;;QAGAC,eAAAA,CAAgB5C,IAAuB,EAAW;QAC9C,OAAQ,CAAA,IAAI,CAACF,UAAU,CAACC,GAAG,CAACC,IAAAA,CAAAA,IAAS,CAAA,IAAK,CAAA;AAC9C,IAAA;AAEA;;QAGA6C,aAAAA,CAAc7C,IAAuB,EAAU;AAC3C,QAAA,OAAO,IAAI,CAACF,UAAU,CAACC,GAAG,CAACC,IAAAA,CAAAA,IAAS,CAAA;AACxC,IAAA;AAEQG,IAAAA,SAAAA,CAAUC,QAAmC,EAAW;AAC5D,QAAA,MAAM0C,MAAAA,GAAS;AAAC,YAAA,MAAA;AAAQ,YAAA,SAAA;AAAW,YAAA,OAAA;AAAS,YAAA;AAAW,SAAA;AACvD,QAAA,MAAMC,cAAcD,MAAAA,CAAOE,OAAO,CAAC,IAAI,CAACzD,MAAM,CAACN,QAAQ,KAAK,QAAQ,MAAA,GAAS,IAAI,CAACM,MAAM,CAACN,QAAQ,CAAA;QACjG,MAAMgE,UAAAA,GAAaH,MAAAA,CAAOE,OAAO,CAAC5C,QAAAA,CAAAA;AAClC,QAAA,OAAO6C,UAAAA,IAAcF,WAAAA;AACzB,IAAA;AAEQzC,IAAAA,WAAAA,CAAYhB,KAAoB,EAAU;QAC9C,IAAIwB,OAAAA,GAAU,CAAC,CAAC,EAAExB,KAAAA,CAAMU,IAAI,CAAC,EAAE,EAAEV,KAAAA,CAAMwB,OAAO,CAAA,CAAE;QAChD,IAAI,IAAI,CAACvB,MAAM,CAACL,cAAc,IAAII,KAAAA,CAAMK,OAAO,EAAE;YAC7CmB,OAAAA,IAAW,CAAC,YAAY,EAAEoC,IAAAA,CAAKC,SAAS,CAAC7D,KAAAA,CAAMK,OAAO,CAAA,CAAA,CAAG;AAC7D,QAAA;QACA,OAAOmB,OAAAA;AACX,IAAA;AAEQlB,IAAAA,eAAAA,CAAgBD,OAAiC,EAAuC;QAC5F,IAAI,CAACA,WAAW,CAAC,IAAI,CAACJ,MAAM,CAACL,cAAc,EAAE,OAAOkE,SAAAA;AAEpD,QAAA,MAAMC,YAAqC,EAAC;AAC5C,QAAA,IAAIC,IAAAA,GAAO,CAAA;QAEX,KAAK,MAAM,CAACC,GAAAA,EAAKC,KAAAA,CAAM,IAAIC,MAAAA,CAAOC,OAAO,CAAC/D,OAAAA,CAAAA,CAAU;AAChD,YAAA,MAAMgE,cAAcC,MAAAA,CAAOJ,KAAAA,CAAAA;YAC3B,IAAIF,IAAAA,GAAOK,YAAY5B,MAAM,GAAG,IAAI,CAACxC,MAAM,CAACJ,cAAc,EAAE;;AAG5D,YAAA,IAAI,IAAI,CAAC0E,qBAAqB,CAACN,GAAAA,CAAAA,EAAM;gBACjCF,SAAS,CAACE,IAAI,GAAG,YAAA;YACrB,CAAA,MAAO;gBACHF,SAAS,CAACE,IAAI,GAAGC,KAAAA;AACrB,YAAA;AACAF,YAAAA,IAAAA,IAAQK,YAAY5B,MAAM;AAC9B,QAAA;QAEA,OAAOsB,SAAAA;AACX,IAAA;AAEQrC,IAAAA,YAAAA,CAAaJ,IAAY,EAAU;;QAEvC,MAAMkD,KAAAA,GAAQlD,IAAAA,CAAKmD,KAAK,CAAC,OAAA,CAAA;AACzB,QAAA,MAAMC,WAAWF,KAAK,CAACA,KAAAA,CAAM/B,MAAM,GAAG,CAAA,CAAE;QACxC,OAAO,CAAC,IAAI,EAAEiC,QAAAA,CAAS,EAAE,EAAEpD,IAAAA,CAAKmB,MAAM,CAAC,OAAO,CAAC;AACnD,IAAA;AAEQ8B,IAAAA,qBAAAA,CAAsBN,GAAW,EAAW;AAChD,QAAA,MAAMU,iBAAAA,GAAoB;AACtB,YAAA,MAAA;AAAQ,YAAA,SAAA;AAAW,YAAA,WAAA;AAAa,YAAA,QAAA;AAAU,YAAA,OAAA;AAAS,YAAA;AACtD,SAAA;AACD,QAAA,OAAOA,kBAAkBC,IAAI,CAACC,CAAAA,CAAAA,GAAKA,CAAAA,CAAEC,IAAI,CAACb,GAAAA,CAAAA,CAAAA;AAC9C,IAAA;AA5OA,IAAA,WAAA,CAAYhE,MAAAA,GAAqC,EAAE,EAAEgB,MAAe,CAAE;AAJtE,QAAA,gBAAA,CAAA,IAAA,EAAQhB,UAAR,MAAA,CAAA;AACA,QAAA,gBAAA,CAAA,IAAA,EAAQgB,UAAR,MAAA,CAAA;AACA,QAAA,gBAAA,CAAA,IAAA,EAAQT,cAA6C,IAAIwC,GAAAA,EAAAA,CAAAA;QAGrD,IAAI,CAAC/C,MAAM,GAAG;AAAE,YAAA,GAAGR,cAAc;AAAE,YAAA,GAAGQ;AAAO,SAAA;AAC7C,QAAA,IAAI,CAACgB,MAAM,GAAG8D,UAAAA,CAAW9D,UAAU+D,cAAAA,EAAgB,eAAA,CAAA;AACvD,IAAA;AA0OJ;AAEA;AACA,IAAIC,iBAAAA,GAAgD,IAAA;AAE7C,SAASC,cAAAA,GAAAA;AACZ,IAAA,IAAI,CAACD,iBAAAA,EAAmB;AACpBA,QAAAA,iBAAAA,GAAoB,IAAInF,mBAAAA,EAAAA;AAC5B,IAAA;IACA,OAAOmF,iBAAAA;AACX;AAEO,SAASE,oBAAAA,CAAqBlF,MAAkC,EAAEgB,MAAe,EAAA;IACpFgE,iBAAAA,GAAoB,IAAInF,oBAAoBG,MAAAA,EAAQgB,MAAAA,CAAAA;AACxD;AAEO,SAASmE,gBAAAA,GAAAA;IACZH,iBAAAA,GAAoB,IAAA;AACxB;;;;"}

package/dist/security/cli-security.d.ts

@@ -0,0 +1,143 @@
+import { z } from 'zod';
+import { PathGuard, PathSecurityConfig } from './path-guard';
+/**
+ * CLI Security configuration
+ */
+export interface CLISecurityConfig {
+    /** Enable CLI security validation */
+    enabled: boolean;
+    /** Path security configuration */
+    paths: Partial<PathSecurityConfig>;
+    /** Allowed file extensions for input files */
+    allowedExtensions: string[];
+    /** Maximum string length for inputs */
+    maxStringLength: number;
+    /** Allow null bytes in strings */
+    allowNullBytes: boolean;
+    /** Allow control characters in strings */
+    allowControlChars: boolean;
+}
+/**
+ * Default CLI security configuration
+ */
+export declare const DEFAULT_CLI_SECURITY: CLISecurityConfig;
+/**
+ * String validation result
+ */
+export interface StringValidationResult {
+    valid: boolean;
+    sanitized?: string;
+    error?: string;
+    violation?: string;
+}
+/**
+ * CLIValidator provides security validation for CLI inputs.
+ *
+ * Features:
+ * - Path validation with traversal prevention
+ * - String sanitization
+ * - Extension filtering
+ * - Audit logging
+ *
+ * @example
+ * ```typescript
+ * const validator = new CLIValidator();
+ *
+ * // Validate a path argument
+ * const pathResult = validator.validatePath('../../../etc/passwd');
+ * if (!pathResult.valid) {
+ *   console.error(pathResult.error);
+ *   process.exit(1);
+ * }
+ *
+ * // Validate a string argument
+ * const stringResult = validator.validateString(userInput);
+ * ```
+ */
+export declare class CLIValidator {
+    private config;
+    private pathGuard;
+    private auditLogger;
+    constructor(config?: Partial<CLISecurityConfig>);
+    /**
+     * Validate a path argument
+     *
+     * @param inputPath - The path to validate
+     * @param options - Additional validation options
+     * @returns Validation result
+     */
+    validatePath(inputPath: string, options?: {
+        checkExtension?: boolean;
+        operation?: string;
+    }): {
+        valid: boolean;
+        normalizedPath?: string;
+        error?: string;
+    };
+    /**
+     * Validate a string argument
+     *
+     * @param input - The string to validate
+     * @returns Validation result with sanitized string
+     */
+    validateString(input: string): StringValidationResult;
+    /**
+     * Validate a numeric argument
+     *
+     * @param input - The number to validate
+     * @param options - Validation options
+     * @returns Validation result
+     */
+    validateNumber(input: number, options?: {
+        min?: number;
+        max?: number;
+        integer?: boolean;
+        allowNaN?: boolean;
+        allowInfinity?: boolean;
+    }): {
+        valid: boolean;
+        error?: string;
+    };
+    /**
+     * Create a Zod schema for secure path validation
+     */
+    securePathSchema(options?: {
+        checkExtension?: boolean;
+    }): z.ZodString;
+    /**
+     * Create a Zod schema for secure string validation
+     */
+    secureStringSchema(): z.ZodString;
+    /**
+     * Create a Zod schema for secure number validation
+     */
+    secureNumberSchema(options?: {
+        min?: number;
+        max?: number;
+        integer?: boolean;
+    }): z.ZodNumber;
+    /**
+     * Get the underlying PathGuard
+     */
+    getPathGuard(): PathGuard;
+    /**
+     * Add a base path for path validation
+     */
+    addBasePath(basePath: string): void;
+}
+/**
+ * Create a CLI validator with RiotPrompt defaults
+ */
+export declare function createRiotPromptValidator(basePaths?: string[]): CLIValidator;
+/**
+ * Get the global CLI validator
+ */
+export declare function getCLIValidator(): CLIValidator;
+/**
+ * Configure the global CLI validator
+ */
+export declare function configureCLIValidator(config: Partial<CLISecurityConfig>): void;
+/**
+ * Reset the global CLI validator
+ */
+export declare function resetCLIValidator(): void;