@skillsmith/core 0.1.0

package/dist/src/security/RateLimiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimiter.js","sourceRoot":"","sources":["../../../src/security/RateLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAEnC,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,CAAC,CAAA;AAEvC;;;GAGG;AACH,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B;;GAEG;AACH,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAgGrC;;GAEG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAEjC;IACA;IAFlB,YACkB,GAAW,EACX,SAAiB;QAEjC,KAAK,CAAC,8CAA8C,GAAG,WAAW,SAAS,IAAI,CAAC,CAAA;QAHhE,QAAG,GAAH,GAAG,CAAQ;QACX,cAAS,GAAT,SAAS,CAAQ;QAGjC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAE9B;IACA;IAFlB,YACkB,GAAW,EACX,YAAoB;QAEpC,KAAK,CAAC,kCAAkC,GAAG,WAAW,YAAY,GAAG,CAAC,CAAA;QAHtD,QAAG,GAAH,GAAG,CAAQ;QACX,iBAAY,GAAZ,YAAY,CAAQ;QAGpC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AAYD;;GAEG;AACH,MAAM,OAAO,wBAAwB;IAC3B,KAAK,GAAG,IAAI,GAAG,EAAsD,CAAA;IACrE,eAAe,GAA0B,IAAI,CAAA;IAErD,YAAY,iBAAiB,GAAG,KAAK;QACnC,sCAAsC;QACtC,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;YACtC,IAAI,CAAC,OAAO,EAAE,CAAA;QAChB,CAAC,EAAE,iBAAiB,CAAC,CAAA;IACvB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,mBAAmB;QACnB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAA;IACrB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAkB,EAAE,KAAa;QACtD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;IAED;;OAEG;IACK,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,IAAI,OAAO,GAAG,CAAC,CAAA;QAEf,yDAAyD;QACzD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;YACxD,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACtB,OAAO,EAAE,CAAA;YACX,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,cAAc,OAAO,6BAA6B,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YACnC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAA;QAC7B,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SACpC,CAAA;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,WAAW;IACL,MAAM,CAWtB;IACgB,OAAO,CAAkB;IACzB,OAAO,GAAkC,IAAI,GAAG,EAAE,CAAA;IACnE,mDAAmD;IAClC,MAAM,GAAiC,IAAI,GAAG,EAAE,CAAA;IACjE,6CAA6C;IACrC,sBAAsB,GAA0B,IAAI,CAAA;IAC5D,0CAA0C;IAClC,sBAAsB,GAA0B,IAAI,CAAA;IAC5D,yEAAyE;IACxD,cAAc,GAA+B,IAAI,GAAG,EAAE,CAAA;IACvE,kDAAkD;IAC1C,kBAAkB,GAAG,KAAK,CAAA;IAElC,YAAY,MAAuB,EAAE,UAA4B,IAAI,wBAAwB,EAAE;QAC7F,IAAI,CAAC,MAAM,GAAG;YACZ,SAAS,EAAE,WAAW;YACtB,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,KAAK;YACrB,YAAY,EAAE,GAAG;YACjB,GAAG,MAAM;SACV,CAAA;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QAEtB,yDAAyD;QACzD,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC,mBAAmB,EAAE,CAAA;QAC5B,CAAC;QAED,iCAAiC;QACjC,IAAI,CAAC,mBAAmB,EAAE,CAAA;QAE1B,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE;gBACnC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC9B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC9B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBACpC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;gBAC1C,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;aACvC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB;QACzB,0BAA0B;QAC1B,IAAI,CAAC,sBAAsB,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7C,IAAI,CAAC,aAAa,EAAE,CAAA;QACtB,CAAC,EAAE,GAAG,CAAC,CAAA;IACT,CAAC;IAED;;OAEG;IACK,mBAAmB;QACzB,yCAAyC;QACzC,IAAI,CAAC,sBAAsB,GAAG,WAAW,CACvC,GAAG,EAAE;YACH,IAAI,CAAC,mBAAmB,EAAE,CAAA;QAC5B,CAAC,EACD,CAAC,GAAG,EAAE,GAAG,IAAI,CACd,CAAA;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB;QACzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,IAAI,OAAO,GAAG,CAAC,CAAA;QAEf,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;gBACnE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACxB,OAAO,EAAE,CAAA;YACX,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,eAAe,EAAE,CAAC;YACxC,gDAAgD;YAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CACrD,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,CAClE,CAAA;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,eAAe,CAAC,CAAA;YACtE,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACxB,OAAO,EAAE,CAAA;YACX,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrC,GAAG,CAAC,KAAK,CAAC,cAAc,OAAO,uBAAuB,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CAAC,GAAW;QACnC,8CAA8C;QAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,YAAY,CAAA;QACpB,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa;QACzB,sCAAsC;QACtC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,OAAM;QACR,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAA;QAE9B,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;gBACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvB,+CAA+C;oBAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;oBACvB,SAAQ;gBACV,CAAC;gBAED,gDAAgD;gBAChD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;gBACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;gBAE5D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,uDAAuD;oBACvD,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAA;oBACzD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;wBACjB,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;oBACxB,CAAC;oBACD,gBAAgB;oBAChB,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;oBACnC,0BAA0B;oBAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAA;oBACjD,OAAO,CAAC,OAAO,CAAC;wBACd,GAAG,MAAM;wBACT,MAAM,EAAE,IAAI;wBACZ,WAAW;qBACZ,CAAC,CAAA;oBAEF,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;wBACtB,GAAG,CAAC,KAAK,CAAC,8BAA8B,GAAG,EAAE,EAAE;4BAC7C,SAAS,EAAE,OAAO,CAAC,EAAE;4BACrB,WAAW;4BACX,SAAS,EAAE,MAAM,CAAC,SAAS;yBAC5B,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAA;QACjC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe,CAAC,GAAW,EAAE,IAAY;QACrD,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,EAAE,CAAA;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEtB,IAAI,CAAC;YACH,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAE/C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG;oBACP,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAC7B,UAAU,EAAE,GAAG;oBACf,YAAY,EAAE,GAAG;iBAClB,CAAA;YACH,CAAC;YAED,sCAAsC;YACtC,MAAM,SAAS,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,CAAA;YACzC,MAAM,cAAc,GAAG,SAAS,GAAG,IAAI,CAAA;YACvC,MAAM,WAAW,GAAG,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAA;YAE3D,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,CAAA;gBAC5E,MAAM,CAAC,UAAU,GAAG,GAAG,CAAA;YACzB,CAAC;YAED,iCAAiC;YACjC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAA;YAErC,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,MAAM,IAAI,IAAI,CAAA;gBACrB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBAEhE,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;oBACpC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;iBAC7B,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,YAAY,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAA;gBACzC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAA;gBAC9E,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,WAAW,EAAE,CAAA;gBAE1D,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;oBACpC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAC5B,YAAY;oBACZ,OAAO;iBACR,CAAA;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;YACtC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,SAAS,EAAE,CAAC;oBACZ,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAC5B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;iBACnC,CAAA;YACH,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;aAC7B,CAAA;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,GAAW,EAAE,OAAgB,EAAE,KAAK,GAAG,KAAK;QAChE,+CAA+C;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;YACnE,2CAA2C;YAC3C,IAAI,SAAS,GAAkB,IAAI,CAAA;YACnC,IAAI,UAAU,GAAG,QAAQ,CAAA;YAEzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC5C,IAAI,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC;oBACzC,UAAU,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,CAAA;oBACpC,SAAS,GAAG,CAAC,CAAA;gBACf,CAAC;YACH,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;gBAC9B,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBACtB,GAAG,CAAC,KAAK,CAAC,iCAAiC,SAAS,EAAE,CAAC,CAAA;gBACzD,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI;YACxC,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC;YACT,SAAS,EAAE,GAAG;YACd,WAAW,EAAE,GAAG;SACjB,CAAA;QAED,IAAI,KAAK,EAAE,CAAC;YACV,QAAQ,CAAC,MAAM,EAAE,CAAA;YACjB,wEAAwE;YACxE,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,CAAC,OAAO,EAAE,CAAA;YACpB,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,OAAO,EAAE,CAAA;YACpB,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,QAAQ,CAAC,OAAO,EAAE,CAAA;QACpB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,OAAO,EAAE,CAAA;QACpB,CAAC;QAED,QAAQ,CAAC,WAAW,GAAG,GAAG,CAAA;QAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACjC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,IAAI,GAAG,CAAC;QACpC,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,EAAE,CAAA;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEtB,IAAI,CAAC;YACH,2BAA2B;YAC3B,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAE/C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,wBAAwB;gBACxB,MAAM,GAAG;oBACP,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAC7B,UAAU,EAAE,GAAG;oBACf,YAAY,EAAE,GAAG;iBAClB,CAAA;YACH,CAAC;YAED,sCAAsC;YACtC,MAAM,SAAS,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,CAAA;YACzC,MAAM,cAAc,GAAG,SAAS,GAAG,IAAI,CAAA;YACvC,MAAM,WAAW,GAAG,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAA;YAE3D,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,CAAA;gBAC5E,MAAM,CAAC,UAAU,GAAG,GAAG,CAAA;YACzB,CAAC;YAED,iCAAiC;YACjC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAA;YAErC,IAAI,OAAO,EAAE,CAAC;gBACZ,iBAAiB;gBACjB,MAAM,CAAC,MAAM,IAAI,IAAI,CAAA;gBAErB,sBAAsB;gBACtB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBAEhE,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBACtB,GAAG,CAAC,KAAK,CAAC,qBAAqB,GAAG,EAAE,EAAE;wBACpC,OAAO,EAAE,IAAI;wBACb,SAAS,EAAE,MAAM,CAAC,MAAM;wBACxB,IAAI;qBACL,CAAC,CAAA;gBACJ,CAAC;gBAED,oCAAoC;gBACpC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;gBAE7B,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;oBACpC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAC5B,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;iBAC/B,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,2CAA2C;gBAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAA;gBACzC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAA;gBAC9E,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,WAAW,EAAE,CAAA;gBAE1D,sDAAsD;gBACtD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBACtB,GAAG,CAAC,KAAK,CAAC,wBAAwB,GAAG,EAAE,EAAE;wBACvC,OAAO,EAAE,KAAK;wBACd,SAAS,EAAE,MAAM,CAAC,MAAM;wBACxB,IAAI;wBACJ,YAAY;qBACb,CAAC,CAAA;gBACJ,CAAC;gBAED,oCAAoC;gBACpC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAE9B,8CAA8C;gBAC9C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,cAAc,EAAE,CAAC;oBAClD,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;gBAClD,CAAC;gBAED,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;oBACpC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAC5B,YAAY;oBACZ,OAAO;oBACP,OAAO,EAAE,cAAc;iBACxB,CAAA;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yBAAyB;YACzB,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,IAAI,CAAC,CAAA;YAE9D,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtC,6EAA6E;gBAC7E,GAAG,CAAC,KAAK,CACP,wCAAwC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACzG,CAAA;gBAED,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,SAAS,EAAE,CAAC;oBACZ,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAC5B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;oBAClC,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;oBAClE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;iBAC/B,CAAA;YACH,CAAC;YAED,oEAAoE;YACpE,GAAG,CAAC,KAAK,CACP,sCAAsC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACvG,CAAA;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAC5B,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;aAC/B,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,IAAI,GAAG,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7B,sDAAsD;YACtD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC;QAED,sCAAsC;QACtC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAE7D,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC7B,OAAO;gBACL,GAAG,eAAe;gBAClB,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;aAC/B,CAAA;QACH,CAAC;QAED,mBAAmB;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QACxC,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC7C,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC9B,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QAClE,CAAC;QAED,yDAAyD;QACzD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;YACjE,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC9B,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QAClE,CAAC;QAED,oBAAoB;QACpB,OAAO,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtD,uEAAuE;YACvE,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAE3B,iBAAiB;YACjB,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;gBACpC,iCAAiC;gBACjC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;gBAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAA;gBAC/D,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACjB,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;gBAC/B,CAAC;gBAED,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC9B,MAAM,CAAC,IAAI,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;YACzE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;YAE9B,MAAM,OAAO,GAAkB;gBAC7B,EAAE,EAAE,SAAS;gBACb,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE;oBAClB,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;oBAC7B,OAAO,CAAC;wBACN,GAAG,MAAM;wBACT,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;qBAC/B,CAAC,CAAA;gBACJ,CAAC;gBACD,MAAM;gBACN,IAAI;gBACJ,QAAQ;gBACR,aAAa;aACd,CAAA;YAED,eAAe;YACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC1B,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAEnC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACtB,GAAG,CAAC,KAAK,CAAC,sBAAsB,GAAG,EAAE,EAAE;oBACrC,SAAS;oBACT,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,MAAM;oBACvC,IAAI;oBACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;iBACtC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,GAAY;QACzB,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC,CAAA;QAC1C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;QACxC,IAAI,WAAW,GAAG,CAAC,CAAA;QACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;YACvB,WAAW,IAAI,CAAC,CAAC,MAAM,CAAA;QACzB,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IAChC,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,GAAY;QACrB,MAAM,gBAAgB,GAAG,CAAC,CAAS,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAChC,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;oBAC5B,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;oBACnC,OAAO,CAAC,MAAM,CAAC,IAAI,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBACtD,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YACvB,CAAC;QACH,CAAC,CAAA;QAED,IAAI,GAAG,EAAE,CAAC;YACR,gBAAgB,CAAC,GAAG,CAAC,CAAA;QACvB,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnC,gBAAgB,CAAC,CAAC,CAAC,CAAA;YACrB,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,GAAG,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,EAAE,CAAA;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAErC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,GAAG,CAAC,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAA;QACvC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,EAAE,CAAA;QACpD,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC3C,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,GAAY;QACrB,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9B,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,GAAY;QACvB,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;QACtB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,GAAG,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO;QACL,kCAAkC;QAClC,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;YAC1C,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAA;QACpC,CAAC;QAED,uBAAuB;QACvB,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;YAC1C,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAA;QACpC,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC,UAAU,EAAE,CAAA;QAEjB,wBAAwB;QACxB,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAA;QAE3B,IAAI,IAAI,CAAC,OAAO,YAAY,wBAAwB,EAAE,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;QACxB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,yEAAyE;IACzE,MAAM,EAAE;QACN,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,mBAAmB;QACxC,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,QAAiB;KAC5B;IACD,8DAA8D;IAC9D,QAAQ,EAAE;QACR,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,iBAAiB;QACtC,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,MAAe;KAC1B;IACD,sCAAsC;IACtC,OAAO,EAAE;QACP,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,cAAc;QACnC,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,MAAe;KAC1B;IACD,wCAAwC;IACxC,QAAQ,EAAE;QACR,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,GAAG,GAAG,EAAE,EAAE,eAAe;QACrC,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,MAAe;KAC1B;IACD,+CAA+C;IAC/C,eAAe,EAAE;QACf,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,GAAG,GAAG,EAAE,EAAE,eAAe;QACrC,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,MAAe;KAC1B;CACO,CAAA;AAEV;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAuC,EACvC,OAA0B;IAE1B,OAAO,IAAI,WAAW,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAA;AAC7D,CAAC"}

package/dist/src/security/__tests__/pathValidation.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * SMI-898: Path Traversal Protection Tests
+ *
+ * Comprehensive tests for the path validation security module.
+ * Tests various path traversal attack vectors and ensures proper rejection.
+ */
+export {};
+//# sourceMappingURL=pathValidation.test.d.ts.map

package/dist/src/security/__tests__/pathValidation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathValidation.test.d.ts","sourceRoot":"","sources":["../../../../src/security/__tests__/pathValidation.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/src/security/__tests__/pathValidation.test.js

@@ -0,0 +1,249 @@
+/**
+ * SMI-898: Path Traversal Protection Tests
+ *
+ * Comprehensive tests for the path validation security module.
+ * Tests various path traversal attack vectors and ensures proper rejection.
+ */
+import { describe, it, expect } from 'vitest';
+import { resolve } from 'path';
+import { homedir } from 'os';
+import { validateDbPath, validateDbPathOrThrow, isPathSafe } from '../pathValidation.js';
+describe('SMI-898: Path Traversal Protection', () => {
+    const homeDir = homedir();
+    const skillsmithDir = resolve(homeDir, '.skillsmith');
+    const claudeDir = resolve(homeDir, '.claude');
+    describe('validateDbPath', () => {
+        describe('valid paths', () => {
+            it('should accept in-memory database', () => {
+                const result = validateDbPath(':memory:');
+                expect(result.valid).toBe(true);
+                expect(result.resolvedPath).toBe(':memory:');
+            });
+            it('should accept paths in ~/.skillsmith', () => {
+                const testPath = resolve(skillsmithDir, 'test.db');
+                const result = validateDbPath(testPath);
+                expect(result.valid).toBe(true);
+                expect(result.resolvedPath).toBe(testPath);
+            });
+            it('should accept paths in ~/.claude', () => {
+                const testPath = resolve(claudeDir, 'skills/test.db');
+                const result = validateDbPath(testPath);
+                expect(result.valid).toBe(true);
+                expect(result.resolvedPath).toBe(testPath);
+            });
+            it('should accept nested paths in allowed directories', () => {
+                const testPath = resolve(skillsmithDir, 'data/nested/deep/test.db');
+                const result = validateDbPath(testPath);
+                expect(result.valid).toBe(true);
+                expect(result.resolvedPath).toBe(testPath);
+            });
+            it('should accept paths in temp directories', () => {
+                const testPath = '/tmp/skillsmith-test/test.db';
+                const result = validateDbPath(testPath, { allowTempDir: true });
+                expect(result.valid).toBe(true);
+                expect(result.resolvedPath).toBe(testPath);
+            });
+        });
+        describe('path traversal attacks', () => {
+            it('should reject simple .. traversal', () => {
+                const result = validateDbPath('../../../etc/passwd');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('traversal');
+            });
+            it('should reject .. traversal in middle of path', () => {
+                const result = validateDbPath(`${skillsmithDir}/../../../etc/passwd`);
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('traversal');
+            });
+            it('should reject encoded traversal attempts when decoded', () => {
+                // URL-encoded ".." - if decoded before validation, would be traversal
+                // Note: Our function checks for literal ".." not URL-encoded
+                // This test ensures basic ".." detection works
+                const decodedAttack = decodeURIComponent('%2e%2e/%2e%2e/etc/passwd');
+                const result = validateDbPath(decodedAttack);
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('traversal');
+            });
+            it('should reject mixed slash traversal', () => {
+                const result = validateDbPath('..\\..\\..\\etc\\passwd');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('traversal');
+            });
+            it('should reject double-encoded traversal when decoded', () => {
+                // %252e%252e decodes to %2e%2e, then to ..
+                // Test the fully decoded version
+                const doubleDecoded = decodeURIComponent(decodeURIComponent('%252e%252e'));
+                expect(doubleDecoded).toBe('..');
+                const result = validateDbPath(`/home/user/${doubleDecoded}/etc/passwd`);
+                expect(result.valid).toBe(false);
+            });
+            it('should reject hidden dot segment traversal (./..)', () => {
+                const result = validateDbPath('./../../../etc/passwd');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('traversal');
+            });
+            it('should reject traversal with extra dots (...)', () => {
+                const result = validateDbPath('.../etc/passwd');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('traversal');
+            });
+        });
+        describe('paths outside allowed directories', () => {
+            it('should reject absolute paths to system directories', () => {
+                const result = validateDbPath('/etc/passwd');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('outside allowed');
+            });
+            it('should reject absolute paths to other user directories', () => {
+                // Use a path that's definitely NOT in allowed dirs (not current user's home)
+                const result = validateDbPath('/home/otheruser/data/secret.db');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('outside allowed');
+            });
+            it('should reject paths in home but outside allowed subdirs', () => {
+                const result = validateDbPath(resolve(homeDir, 'Documents/secret.db'));
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('outside allowed');
+            });
+            it('should reject Windows-style system paths when run on Windows or when backslashes are normalized', () => {
+                // On Unix, Windows paths are treated as regular paths with backslash as separator
+                // The path resolves relative to allowed dir, so test with explicit outside path
+                const result = validateDbPath('/mnt/c/Windows/System32/config');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('outside allowed');
+            });
+        });
+        describe('invalid inputs', () => {
+            it('should reject null bytes', () => {
+                const result = validateDbPath(`${skillsmithDir}/test\0.db`);
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('Invalid characters');
+            });
+            it('should reject control characters', () => {
+                const result = validateDbPath(`${skillsmithDir}/test\x07.db`);
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('Invalid characters');
+            });
+            it('should reject empty string', () => {
+                const result = validateDbPath('');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('required');
+            });
+            it('should reject undefined', () => {
+                const result = validateDbPath(undefined);
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('required');
+            });
+            it('should reject paths exceeding max length', () => {
+                const longPath = skillsmithDir + '/' + 'a'.repeat(5000) + '.db';
+                const result = validateDbPath(longPath);
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('length');
+            });
+        });
+        describe('edge cases', () => {
+            it('should reject in-memory when disabled', () => {
+                const result = validateDbPath(':memory:', { allowInMemory: false });
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('In-memory');
+            });
+            it('should reject temp dirs when disabled', () => {
+                const result = validateDbPath('/tmp/test.db', { allowTempDir: false });
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('outside allowed');
+            });
+            it('should handle symlink-like paths (detected by resolve)', () => {
+                // This tests that resolve() properly handles the path
+                const result = validateDbPath(`${skillsmithDir}/./test.db`);
+                expect(result.valid).toBe(true);
+                expect(result.resolvedPath).toBe(resolve(skillsmithDir, 'test.db'));
+            });
+            it('should handle relative paths by resolving to first allowed dir', () => {
+                const result = validateDbPath('custom.db');
+                expect(result.valid).toBe(true);
+                expect(result.resolvedPath).toBe(resolve(skillsmithDir, 'custom.db'));
+            });
+            it('should accept custom allowed directories', () => {
+                const customDir = '/var/lib/skillsmith';
+                const result = validateDbPath('/var/lib/skillsmith/test.db', {
+                    allowedDirs: [customDir],
+                    allowTempDir: false,
+                });
+                expect(result.valid).toBe(true);
+            });
+        });
+    });
+    describe('validateDbPathOrThrow', () => {
+        it('should return resolved path for valid input', () => {
+            const result = validateDbPathOrThrow(':memory:');
+            expect(result).toBe(':memory:');
+        });
+        it('should throw for invalid input', () => {
+            expect(() => validateDbPathOrThrow('../../../etc/passwd')).toThrow('Invalid database path');
+        });
+        it('should throw with descriptive error message', () => {
+            expect(() => validateDbPathOrThrow('/etc/passwd')).toThrow('outside allowed');
+        });
+    });
+    describe('isPathSafe', () => {
+        it('should return true for safe paths', () => {
+            expect(isPathSafe('/home/user/.skillsmith/test.db')).toBe(true);
+            expect(isPathSafe(':memory:')).toBe(true);
+            expect(isPathSafe('relative/path.db')).toBe(true);
+        });
+        it('should return false for paths with ..', () => {
+            expect(isPathSafe('../../../etc/passwd')).toBe(false);
+            expect(isPathSafe('foo/../bar/../../../etc')).toBe(false);
+        });
+        it('should return false for paths with null bytes', () => {
+            expect(isPathSafe('test\0.db')).toBe(false);
+        });
+        it('should return false for paths with control characters', () => {
+            expect(isPathSafe('test\x07.db')).toBe(false);
+        });
+        it('should return false for empty/undefined', () => {
+            expect(isPathSafe('')).toBe(false);
+            expect(isPathSafe(undefined)).toBe(false);
+        });
+    });
+    describe('real-world attack vectors', () => {
+        it('should block CVE-style path traversal', () => {
+            // Common attack patterns - focus on actual ".." traversal
+            // URL-encoded versions would need to be decoded first by the application layer
+            const attacks = [
+                '../../../etc/passwd',
+                '..\\..\\..\\etc\\passwd',
+                '..//..//..//etc/passwd',
+                './../../../etc/passwd',
+                'foo/../../../etc/passwd',
+                '.../.../etc/passwd',
+            ];
+            for (const attack of attacks) {
+                const result = validateDbPath(attack);
+                expect(result.valid).toBe(false);
+            }
+        });
+        it('should block Unicode dot attacks when normalized', () => {
+            // Unicode dots (\u002e is regular ASCII dot)
+            // \u002e\u002e is literally ".."
+            const dotDotPath = '\u002e\u002e/\u002e\u002e/etc/passwd';
+            expect(dotDotPath).toBe('../../etc/passwd'); // Confirm it's actual ..
+            const result = validateDbPath(dotDotPath);
+            expect(result.valid).toBe(false);
+            expect(result.error).toContain('traversal');
+        });
+        it('should block symlink escape attempts via path construction', () => {
+            // While we can't prevent actual symlink attacks without filesystem access,
+            // we can block paths that attempt to escape via naming patterns
+            const attacks = [
+                `${skillsmithDir}/../../etc/passwd`,
+                `${skillsmithDir}/../other-user/.ssh/id_rsa`,
+            ];
+            for (const attack of attacks) {
+                const result = validateDbPath(attack);
+                expect(result.valid).toBe(false);
+            }
+        });
+    });
+});
+//# sourceMappingURL=pathValidation.test.js.map

package/dist/src/security/__tests__/pathValidation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathValidation.test.js","sourceRoot":"","sources":["../../../../src/security/__tests__/pathValidation.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAyB,MAAM,QAAQ,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAExF,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,MAAM,OAAO,GAAG,OAAO,EAAE,CAAA;IACzB,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAE7C,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;YAC3B,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;gBAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAC9C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;gBAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;gBAClD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;gBAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;gBACrD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;gBAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAE,0BAA0B,CAAC,CAAA;gBACnE,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;gBACjD,MAAM,QAAQ,GAAG,8BAA8B,CAAA;gBAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC/D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;YACtC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;gBAC3C,MAAM,MAAM,GAAG,cAAc,CAAC,qBAAqB,CAAC,CAAA;gBACpD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;gBACtD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,sBAAsB,CAAC,CAAA;gBACrE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;gBAC/D,sEAAsE;gBACtE,6DAA6D;gBAC7D,+CAA+C;gBAC/C,MAAM,aAAa,GAAG,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;gBACpE,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,CAAC,CAAA;gBAC5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;gBAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,yBAAyB,CAAC,CAAA;gBACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;gBAC7D,2CAA2C;gBAC3C,iCAAiC;gBACjC,MAAM,aAAa,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAA;gBAC1E,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChC,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,aAAa,aAAa,CAAC,CAAA;gBACvE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;gBAC3D,MAAM,MAAM,GAAG,cAAc,CAAC,uBAAuB,CAAC,CAAA;gBACtD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;gBACvD,MAAM,MAAM,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAA;gBAC/C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;YACjD,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;gBAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,CAAC,CAAA;gBAC5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;gBAChE,6EAA6E;gBAC7E,MAAM,MAAM,GAAG,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAC/D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;gBACjE,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAA;gBACtE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,iGAAiG,EAAE,GAAG,EAAE;gBACzG,kFAAkF;gBAClF,gFAAgF;gBAChF,MAAM,MAAM,GAAG,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAC/D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;YAC9B,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;gBAClC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,YAAY,CAAC,CAAA;gBAC3D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YACtD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;gBAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,cAAc,CAAC,CAAA;gBAC7D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YACtD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;gBACpC,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;gBACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;gBACjC,MAAM,MAAM,GAAG,cAAc,CAAC,SAA8B,CAAC,CAAA;gBAC7D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;gBAClD,MAAM,QAAQ,GAAG,aAAa,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;gBAC/D,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC1C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;YAC1B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;gBAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;gBAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAA;gBACtE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;gBAChE,sDAAsD;gBACtD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,YAAY,CAAC,CAAA;gBAC3D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAA;YACrE,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;gBACxE,MAAM,MAAM,GAAG,cAAc,CAAC,WAAW,CAAC,CAAA;gBAC1C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YACvE,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;gBAClD,MAAM,SAAS,GAAG,qBAAqB,CAAA;gBACvC,MAAM,MAAM,GAAG,cAAc,CAAC,6BAA6B,EAAE;oBAC3D,WAAW,EAAE,CAAC,SAAS,CAAC;oBACxB,YAAY,EAAE,KAAK;iBACpB,CAAC,CAAA;gBACF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjC,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAA;YAChD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAA;QAC7F,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;QAC/E,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC/D,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACzC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACrD,MAAM,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3D,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,MAAM,CAAC,UAAU,CAAC,SAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,0DAA0D;YAC1D,+EAA+E;YAC/E,MAAM,OAAO,GAAG;gBACd,qBAAqB;gBACrB,yBAAyB;gBACzB,wBAAwB;gBACxB,uBAAuB;gBACvB,yBAAyB;gBACzB,oBAAoB;aACrB,CAAA;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;gBACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,6CAA6C;YAC7C,iCAAiC;YACjC,MAAM,UAAU,GAAG,sCAAsC,CAAA;YACzD,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA,CAAC,yBAAyB;YACrE,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;YACzC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,2EAA2E;YAC3E,gEAAgE;YAChE,MAAM,OAAO,GAAG;gBACd,GAAG,aAAa,mBAAmB;gBACnC,GAAG,aAAa,4BAA4B;aAC7C,CAAA;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;gBACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/security/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * SMI-587: Security module exports
+ * SMI-685: Enhanced with severity scoring types
+ * SMI-730: Rate limiting with token bucket algorithm
+ * SMI-732: Input sanitization functions
+ * SMI-733: Audit logging system
+ * SMI-898: Path traversal protection for database paths
+ */
+export { SecurityScanner } from './scanner.js';
+export type { SecurityFinding, SecurityFindingType, SecuritySeverity, ScanReport, ScannerOptions, RiskScoreBreakdown, } from './scanner.js';
+export { sanitizeHtml, sanitizeFileName, sanitizePath, sanitizeUrl, sanitizeText, } from './sanitization.js';
+export { validateDbPath, validateDbPathOrThrow, isPathSafe, DEFAULT_ALLOWED_DIRS, } from './pathValidation.js';
+export type { PathValidationOptions, PathValidationResult } from './pathValidation.js';
+export { AuditLogger } from './AuditLogger.js';
+export type { AuditLogEntry, AuditEventType, AuditActor, AuditResult, AuditQueryFilter, AuditStats, } from './AuditLogger.js';
+export { RateLimiter, InMemoryRateLimitStorage, RATE_LIMIT_PRESETS, createRateLimiterFromPreset, RateLimitQueueTimeoutError, RateLimitQueueFullError, } from './RateLimiter.js';
+export type { RateLimitConfig, RateLimitResult, RateLimitStorage, RateLimitMetrics, } from './RateLimiter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,YAAY,GACb,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,UAAU,EACV,oBAAoB,GACrB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAEtF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,YAAY,EACV,aAAa,EACb,cAAc,EACd,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,UAAU,GACX,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,kBAAkB,CAAA"}

package/dist/src/security/index.js

@@ -0,0 +1,14 @@
+/**
+ * SMI-587: Security module exports
+ * SMI-685: Enhanced with severity scoring types
+ * SMI-730: Rate limiting with token bucket algorithm
+ * SMI-732: Input sanitization functions
+ * SMI-733: Audit logging system
+ * SMI-898: Path traversal protection for database paths
+ */
+export { SecurityScanner } from './scanner.js';
+export { sanitizeHtml, sanitizeFileName, sanitizePath, sanitizeUrl, sanitizeText, } from './sanitization.js';
+export { validateDbPath, validateDbPathOrThrow, isPathSafe, DEFAULT_ALLOWED_DIRS, } from './pathValidation.js';
+export { AuditLogger } from './AuditLogger.js';
+export { RateLimiter, InMemoryRateLimitStorage, RATE_LIMIT_PRESETS, createRateLimiterFromPreset, RateLimitQueueTimeoutError, RateLimitQueueFullError, } from './RateLimiter.js';
+//# sourceMappingURL=index.js.map

package/dist/src/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAU9C,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,YAAY,GACb,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,UAAU,EACV,oBAAoB,GACrB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAU9C,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,kBAAkB,CAAA"}

package/dist/src/security/pathValidation.d.ts

@@ -0,0 +1,95 @@
+/**
+ * SMI-898: Path Traversal Protection for Database Paths
+ *
+ * Provides secure path validation for database and file storage paths.
+ * Prevents path traversal attacks by:
+ * - Canonicalizing paths with path.resolve() and path.normalize()
+ * - Validating that resolved paths stay within allowed directories
+ * - Rejecting paths with ".." traversal attempts
+ * - Blocking absolute paths outside allowed directories
+ */
+/**
+ * Configuration for path validation
+ */
+export interface PathValidationOptions {
+    /** Allowed base directories for path resolution (default: [~/.skillsmith]) */
+    allowedDirs?: string[];
+    /** Allow in-memory database path ':memory:' (default: true) */
+    allowInMemory?: boolean;
+    /** Allow paths under system temp directory (default: true for testing) */
+    allowTempDir?: boolean;
+    /** Maximum path length (default: 4096) */
+    maxLength?: number;
+}
+/**
+ * Result of path validation
+ */
+export interface PathValidationResult {
+    /** Whether the path is valid */
+    valid: boolean;
+    /** The sanitized and resolved path (if valid) */
+    resolvedPath?: string;
+    /** Error message (if invalid) */
+    error?: string;
+}
+/**
+ * Default allowed directories for database storage
+ */
+export declare const DEFAULT_ALLOWED_DIRS: string[];
+/**
+ * Validate and sanitize a database path to prevent path traversal attacks.
+ *
+ * Security measures:
+ * 1. Rejects null bytes and control characters
+ * 2. Canonicalizes path with resolve() and normalize()
+ * 3. Checks for ".." traversal attempts before resolution
+ * 4. Validates resolved path is within allowed directories
+ * 5. Handles both absolute and relative paths
+ *
+ * @param inputPath - The raw path to validate
+ * @param options - Validation configuration options
+ * @returns Validation result with resolved path or error
+ *
+ * @example
+ * ```typescript
+ * // Valid paths
+ * validateDbPath('/Users/me/.skillsmith/skills.db')
+ * // => { valid: true, resolvedPath: '/Users/me/.skillsmith/skills.db' }
+ *
+ * validateDbPath(':memory:')
+ * // => { valid: true, resolvedPath: ':memory:' }
+ *
+ * // Invalid paths - traversal attack
+ * validateDbPath('../../../etc/passwd')
+ * // => { valid: false, error: 'Path traversal detected' }
+ *
+ * validateDbPath('/etc/passwd')
+ * // => { valid: false, error: 'Path outside allowed directories' }
+ * ```
+ */
+export declare function validateDbPath(inputPath: string | undefined, options?: PathValidationOptions): PathValidationResult;
+/**
+ * Validate a database path and throw an error if invalid.
+ * Convenience wrapper for validateDbPath that throws instead of returning error.
+ *
+ * @param inputPath - The raw path to validate
+ * @param options - Validation configuration options
+ * @returns The validated and resolved path
+ * @throws Error if path validation fails
+ *
+ * @example
+ * ```typescript
+ * const safePath = validateDbPathOrThrow(process.env.DB_PATH);
+ * // Either returns valid path or throws
+ * ```
+ */
+export declare function validateDbPathOrThrow(inputPath: string | undefined, options?: PathValidationOptions): string;
+/**
+ * Check if a path is safe for database usage without modifying it.
+ * Quick check that doesn't resolve the path.
+ *
+ * @param inputPath - The path to check
+ * @returns True if the path appears safe (no obvious traversal)
+ */
+export declare function isPathSafe(inputPath: string): boolean;
+//# sourceMappingURL=pathValidation.d.ts.map

package/dist/src/security/pathValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathValidation.d.ts","sourceRoot":"","sources":["../../../src/security/pathValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,gCAAgC;IAChC,KAAK,EAAE,OAAO,CAAA;IACd,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,UAGhC,CAAA;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAkItB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAMR;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAuBrD"}