@skillsmith/core 0.1.0

package/dist/src/validation/index.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Validation Utilities (SMI-726)
+ *
+ * Centralized validation patterns for security-critical operations.
+ * Extracted from RawUrlSourceAdapter and LocalFilesystemAdapter.
+ *
+ * Security Features:
+ * - SSRF prevention (SMI-721, SMI-729)
+ * - Path traversal prevention (SMI-720)
+ * - RegExp injection prevention (SMI-722)
+ */
+/**
+ * Validation error thrown when input fails security checks
+ */
+export declare class ValidationError extends Error {
+    readonly code: string;
+    readonly details?: unknown | undefined;
+    constructor(message: string, code: string, details?: unknown | undefined);
+}
+/**
+ * Validate URL to prevent SSRF attacks (SMI-721, SMI-729)
+ *
+ * Blocks:
+ * - Non-http(s) protocols
+ * - Private IPv4 ranges (10.x, 172.16-31.x, 192.168.x)
+ * - Private IPv6 ranges (fe80::/10, fc00::/7, ff00::/8, ::ffff:0:0/96)
+ * - Localhost variants (127.x, localhost, ::1, 0.0.0.0)
+ * - Link-local addresses (169.254.x, fe80::/10)
+ * - Current network (0.x)
+ *
+ * @param url - URL to validate
+ * @throws {ValidationError} if URL is not allowed
+ *
+ * @example
+ * ```typescript
+ * validateUrl('https://example.com/api')  // OK
+ * validateUrl('http://localhost:3000')    // Throws ValidationError
+ * validateUrl('ftp://example.com')        // Throws ValidationError
+ * validateUrl('http://192.168.1.1')       // Throws ValidationError
+ * validateUrl('http://[fe80::1]')         // Throws ValidationError (IPv6 link-local)
+ * ```
+ */
+export declare function validateUrl(url: string): void;
+/**
+ * Validate file path to prevent path traversal attacks (SMI-720)
+ *
+ * Ensures the resolved path remains within the allowed root directory.
+ *
+ * @param path - Path to validate (can be relative or absolute)
+ * @param rootDir - Root directory that must contain the path
+ * @throws {ValidationError} if path escapes root directory
+ *
+ * @example
+ * ```typescript
+ * validatePath('skills/my-skill', '/home/user/.claude')  // OK
+ * validatePath('../etc/passwd', '/home/user/.claude')    // Throws ValidationError
+ * validatePath('/etc/passwd', '/home/user/.claude')      // Throws ValidationError
+ * ```
+ */
+export declare function validatePath(path: string, rootDir: string): void;
+/**
+ * Sanitize input string for safe use in various contexts
+ *
+ * Removes or escapes potentially dangerous characters.
+ *
+ * @param input - Input string to sanitize
+ * @param options - Sanitization options
+ * @returns Sanitized string
+ *
+ * @example
+ * ```typescript
+ * sanitizeInput('<script>alert(1)</script>')  // Returns: '&lt;script&gt;alert(1)&lt;/script&gt;'
+ * sanitizeInput('../../etc/passwd')           // Returns: 'etc/passwd'
+ * ```
+ */
+export declare function sanitizeInput(input: string, options?: {
+    /** Remove path traversal sequences like '../' (default: true) */
+    removePathTraversal?: boolean;
+    /** HTML-escape special characters (default: true) */
+    escapeHtml?: boolean;
+    /** Remove null bytes (default: true) */
+    removeNullBytes?: boolean;
+}): string;
+/**
+ * Safely test a string against a pattern, preventing RegExp injection (SMI-722)
+ *
+ * Tries exact match, prefix match, and regex match (with error handling).
+ * Falls back to includes check if regex is invalid.
+ *
+ * @param value - Value to test
+ * @param pattern - Pattern to match (string or regex)
+ * @returns True if value matches pattern
+ *
+ * @example
+ * ```typescript
+ * safePatternMatch('node_modules', 'node_modules')  // true (exact)
+ * safePatternMatch('node_modules/pkg', 'node_')     // true (prefix)
+ * safePatternMatch('test.js', '\\.js$')             // true (regex)
+ * safePatternMatch('test.js', '(evil')              // false (invalid regex, falls back)
+ * ```
+ */
+export declare function safePatternMatch(value: string, pattern: string): boolean;
+/**
+ * Validate that patterns array is safe to use
+ *
+ * Checks for potentially dangerous regex patterns that could cause ReDoS.
+ *
+ * @param patterns - Array of patterns to validate
+ * @returns Array of validation warnings (empty if all patterns are safe)
+ *
+ * @example
+ * ```typescript
+ * validatePatterns(['node_modules', '\\.js$'])  // []
+ * validatePatterns(['(a+)+b'])                  // ['Pattern may cause ReDoS: (a+)+b']
+ * ```
+ */
+export declare function validatePatterns(patterns: string[]): string[];
+//# sourceMappingURL=index.d.ts.map

package/dist/src/validation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/validation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,IAAI,EAAE,MAAM;aACZ,OAAO,CAAC,EAAE,OAAO;gBAFjC,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,OAAO,YAAA;CAKpC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAoE7C;AA+OD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CA2BhE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IACP,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,qDAAqD;IACrD,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,wCAAwC;IACxC,eAAe,CAAC,EAAE,OAAO,CAAA;CACrB,GACL,MAAM,CA6BR;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAuBxE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAyB7D"}

package/dist/src/validation/index.js

@@ -0,0 +1,434 @@
+/**
+ * Validation Utilities (SMI-726)
+ *
+ * Centralized validation patterns for security-critical operations.
+ * Extracted from RawUrlSourceAdapter and LocalFilesystemAdapter.
+ *
+ * Security Features:
+ * - SSRF prevention (SMI-721, SMI-729)
+ * - Path traversal prevention (SMI-720)
+ * - RegExp injection prevention (SMI-722)
+ */
+import { resolve } from 'path';
+/**
+ * Validation error thrown when input fails security checks
+ */
+export class ValidationError extends Error {
+    code;
+    details;
+    constructor(message, code, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = 'ValidationError';
+    }
+}
+/**
+ * Validate URL to prevent SSRF attacks (SMI-721, SMI-729)
+ *
+ * Blocks:
+ * - Non-http(s) protocols
+ * - Private IPv4 ranges (10.x, 172.16-31.x, 192.168.x)
+ * - Private IPv6 ranges (fe80::/10, fc00::/7, ff00::/8, ::ffff:0:0/96)
+ * - Localhost variants (127.x, localhost, ::1, 0.0.0.0)
+ * - Link-local addresses (169.254.x, fe80::/10)
+ * - Current network (0.x)
+ *
+ * @param url - URL to validate
+ * @throws {ValidationError} if URL is not allowed
+ *
+ * @example
+ * ```typescript
+ * validateUrl('https://example.com/api')  // OK
+ * validateUrl('http://localhost:3000')    // Throws ValidationError
+ * validateUrl('ftp://example.com')        // Throws ValidationError
+ * validateUrl('http://192.168.1.1')       // Throws ValidationError
+ * validateUrl('http://[fe80::1]')         // Throws ValidationError (IPv6 link-local)
+ * ```
+ */
+export function validateUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch (error) {
+        throw new ValidationError(`Invalid URL format: ${url}`, 'INVALID_URL_FORMAT', error);
+    }
+    // Only allow http/https protocols
+    if (!['http:', 'https:'].includes(parsed.protocol)) {
+        throw new ValidationError(`Invalid protocol: ${parsed.protocol}. Only http and https are allowed.`, 'INVALID_PROTOCOL', { protocol: parsed.protocol, url });
+    }
+    let hostname = parsed.hostname.toLowerCase();
+    // Strip brackets from IPv6 addresses for easier comparison
+    // Node.js URL keeps brackets in hostname for IPv6 (e.g., "[::1]")
+    if (hostname.startsWith('[') && hostname.endsWith(']')) {
+        hostname = hostname.slice(1, -1);
+    }
+    // Block localhost variants
+    if (hostname === 'localhost' || hostname === '::1' || hostname === '0.0.0.0') {
+        throw new ValidationError(`Access to localhost is blocked: ${hostname}`, 'LOCALHOST_BLOCKED', {
+            hostname,
+            url,
+        });
+    }
+    // Check for IPv4 addresses
+    const ipv4Match = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (ipv4Match) {
+        const [, a, b, c, d] = ipv4Match.map(Number);
+        // Validate IPv4 octets are in valid range
+        if (a > 255 || b > 255 || c > 255 || d > 255) {
+            throw new ValidationError(`Invalid IPv4 address: ${hostname}`, 'INVALID_IPV4', {
+                hostname,
+                url,
+            });
+        }
+        // Block private/internal IP ranges
+        if (a === 10 || // 10.0.0.0/8 - Private network
+            (a === 172 && b >= 16 && b <= 31) || // 172.16.0.0/12 - Private network
+            (a === 192 && b === 168) || // 192.168.0.0/16 - Private network
+            a === 127 || // 127.0.0.0/8 - Loopback
+            (a === 169 && b === 254) || // 169.254.0.0/16 - Link-local
+            a === 0 // 0.0.0.0/8 - Current network
+        ) {
+            throw new ValidationError(`Access to private/internal network blocked: ${hostname}`, 'PRIVATE_NETWORK_BLOCKED', { hostname, url, ipRange: getIpRangeName(a, b) });
+        }
+    }
+    // Check for IPv6 addresses (SMI-729)
+    // IPv6 addresses in URLs are enclosed in square brackets, but hostname strips them
+    if (hostname.includes(':')) {
+        validateIPv6(hostname, url);
+    }
+}
+/**
+ * Validate IPv6 address to prevent SSRF attacks (SMI-729)
+ *
+ * Blocks:
+ * - Link-local: fe80::/10
+ * - Unique local addresses (ULA): fc00::/7
+ * - Multicast: ff00::/8
+ * - IPv4-mapped IPv6: ::ffff:0:0/96
+ * - Loopback ::1 (already blocked above)
+ *
+ * @param hostname - IPv6 hostname to validate
+ * @param url - Full URL for error context
+ * @throws {ValidationError} if IPv6 address is not allowed
+ */
+function validateIPv6(hostname, url) {
+    // Normalize IPv6 address
+    const normalized = hostname.toLowerCase();
+    // Block IPv6 loopback (::1 and its full form)
+    // This is defense-in-depth since line 76 should also catch ::1
+    if (normalized === '::1' || normalized === '0:0:0:0:0:0:0:1') {
+        throw new ValidationError(`Access to localhost is blocked: ${hostname}`, 'LOCALHOST_BLOCKED', {
+            hostname,
+            url,
+        });
+    }
+    // Block link-local addresses (fe80::/10)
+    // fe80 to febf range
+    if (normalized.startsWith('fe8') ||
+        normalized.startsWith('fe9') ||
+        normalized.startsWith('fea') ||
+        normalized.startsWith('feb')) {
+        throw new ValidationError(`Access to IPv6 link-local address blocked: ${hostname}`, 'IPV6_LINK_LOCAL_BLOCKED', { hostname, url });
+    }
+    // Block unique local addresses (fc00::/7)
+    // fc00 to fdff range
+    if (normalized.startsWith('fc') || normalized.startsWith('fd')) {
+        throw new ValidationError(`Access to IPv6 unique local address blocked: ${hostname}`, 'IPV6_ULA_BLOCKED', { hostname, url });
+    }
+    // Block multicast addresses (ff00::/8)
+    if (normalized.startsWith('ff')) {
+        throw new ValidationError(`Access to IPv6 multicast address blocked: ${hostname}`, 'IPV6_MULTICAST_BLOCKED', { hostname, url });
+    }
+    // Block IPv4-mapped IPv6 addresses (::ffff:0:0/96)
+    // These map IPv4 addresses into IPv6 space
+    if (normalized.includes('::ffff:')) {
+        // Extract the IPv4 part and validate it
+        const ipv4Part = normalized.split('::ffff:')[1];
+        if (ipv4Part) {
+            // Check if it's in dotted decimal notation
+            const ipv4Match = ipv4Part.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/);
+            if (ipv4Match) {
+                const [, a, b] = ipv4Match.map(Number);
+                // Apply same private IP checks as IPv4
+                if (a === 10 ||
+                    (a === 172 && b >= 16 && b <= 31) ||
+                    (a === 192 && b === 168) ||
+                    a === 127 ||
+                    (a === 169 && b === 254) ||
+                    a === 0) {
+                    throw new ValidationError(`Access to IPv4-mapped IPv6 private address blocked: ${hostname}`, 'IPV4_MAPPED_IPV6_BLOCKED', { hostname, url, ipRange: getIpRangeName(a, b) });
+                }
+            }
+            else {
+                // IPv4 in hex notation (e.g., ::ffff:7f00:1 for 127.0.0.1)
+                // Parse hex format: high:low where high = (a<<8)|b, low = (c<<8)|d
+                const hexMatch = ipv4Part.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+                if (hexMatch) {
+                    const high = parseInt(hexMatch[1], 16);
+                    const low = parseInt(hexMatch[2], 16);
+                    const a = (high >> 8) & 0xff;
+                    const b = high & 0xff;
+                    // Apply same private IP checks as IPv4
+                    if (a === 10 ||
+                        (a === 172 && b >= 16 && b <= 31) ||
+                        (a === 192 && b === 168) ||
+                        a === 127 ||
+                        (a === 169 && b === 254) ||
+                        a === 0) {
+                        throw new ValidationError(`Access to IPv4-mapped IPv6 private address blocked: ${hostname}`, 'IPV4_MAPPED_IPV6_BLOCKED', { hostname, url, ipRange: getIpRangeName(a, b) });
+                    }
+                }
+                // If we can't parse it, block it to be safe
+                throw new ValidationError(`Access to IPv4-mapped IPv6 address blocked: ${hostname}`, 'IPV4_MAPPED_IPV6_BLOCKED', { hostname, url });
+            }
+        }
+    }
+    // Block 6to4 addresses with embedded private IPv4 (2002::/16) - SMI-1004
+    // 6to4 embeds IPv4 in bits 16-48: 2002:AABB:CCDD::/48 where IPv4 is AA.BB.CC.DD
+    if (normalized.startsWith('2002:')) {
+        // Extract the two hex segments after 2002:
+        const segments = normalized.split(':');
+        if (segments.length >= 3 && segments[1] && segments[2]) {
+            // Parse hex segments: 2002:AABB:CCDD -> IPv4 is 0xAA.0xBB.0xCC.0xDD
+            const highHex = segments[1].padStart(4, '0');
+            const lowHex = segments[2].padStart(4, '0');
+            const a = parseInt(highHex.slice(0, 2), 16);
+            const b = parseInt(highHex.slice(2, 4), 16);
+            const c = parseInt(lowHex.slice(0, 2), 16);
+            const d = parseInt(lowHex.slice(2, 4), 16);
+            // Check if embedded IPv4 is private
+            if (a === 10 ||
+                (a === 172 && b >= 16 && b <= 31) ||
+                (a === 192 && b === 168) ||
+                a === 127 ||
+                (a === 169 && b === 254) ||
+                a === 0) {
+                throw new ValidationError(`Access to 6to4 address with embedded private IPv4 blocked: ${hostname}`, 'IPV6_6TO4_PRIVATE', { hostname, url, embeddedIPv4: `${a}.${b}.${c}.${d}`, ipRange: getIpRangeName(a, b) });
+            }
+        }
+    }
+    // Block IPv4-compatible addresses (::IPv4) without ffff prefix - SMI-1005
+    // Pattern: ::x.x.x.x (deprecated but still valid)
+    // Note: URL parser normalizes ::192.168.1.1 to ::c0a8:101 (hex format)
+    // So we need to match both dotted-decimal and the normalized hex format
+    const ipv4CompatibleMatch = normalized.match(/^::(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (ipv4CompatibleMatch) {
+        const [, aStr, bStr, cStr, dStr] = ipv4CompatibleMatch;
+        const a = parseInt(aStr, 10);
+        const b = parseInt(bStr, 10);
+        const c = parseInt(cStr, 10);
+        const d = parseInt(dStr, 10);
+        // Validate octets
+        if (a <= 255 && b <= 255 && c <= 255 && d <= 255) {
+            // Check if embedded IPv4 is private
+            if (a === 10 ||
+                (a === 172 && b >= 16 && b <= 31) ||
+                (a === 192 && b === 168) ||
+                a === 127 ||
+                (a === 169 && b === 254) ||
+                a === 0) {
+                throw new ValidationError(`Access to IPv4-compatible IPv6 address with private IPv4 blocked: ${hostname}`, 'IPV6_COMPATIBLE_PRIVATE', { hostname, url, embeddedIPv4: `${a}.${b}.${c}.${d}`, ipRange: getIpRangeName(a, b) });
+            }
+        }
+    }
+    // Also check for normalized hex format: ::XXXX:XXXX (without ffff: prefix)
+    // URL parser normalizes ::192.168.1.1 to ::c0a8:101
+    const ipv4CompatibleHexMatch = normalized.match(/^::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+    if (ipv4CompatibleHexMatch) {
+        const high = parseInt(ipv4CompatibleHexMatch[1], 16);
+        const low = parseInt(ipv4CompatibleHexMatch[2], 16);
+        const a = (high >> 8) & 0xff;
+        const b = high & 0xff;
+        const c = (low >> 8) & 0xff;
+        const d = low & 0xff;
+        // Check if embedded IPv4 is private
+        if (a === 10 ||
+            (a === 172 && b >= 16 && b <= 31) ||
+            (a === 192 && b === 168) ||
+            a === 127 ||
+            (a === 169 && b === 254) ||
+            a === 0) {
+            throw new ValidationError(`Access to IPv4-compatible IPv6 address with private IPv4 blocked: ${hostname}`, 'IPV6_COMPATIBLE_PRIVATE', { hostname, url, embeddedIPv4: `${a}.${b}.${c}.${d}`, ipRange: getIpRangeName(a, b) });
+        }
+    }
+    // Block Teredo addresses (2001:0::/32) - SMI-1006
+    // Teredo tunneling can bypass firewall rules
+    if (normalized.startsWith('2001:0000:') || normalized.startsWith('2001:0:')) {
+        throw new ValidationError(`Access to Teredo tunnel address blocked: ${hostname}`, 'IPV6_TEREDO_BLOCKED', { hostname, url });
+    }
+}
+/**
+ * Get human-readable IP range name for error messages
+ */
+function getIpRangeName(a, b) {
+    if (a === 10)
+        return '10.0.0.0/8 (Private)';
+    if (a === 172 && b >= 16 && b <= 31)
+        return '172.16.0.0/12 (Private)';
+    if (a === 192 && b === 168)
+        return '192.168.0.0/16 (Private)';
+    if (a === 127)
+        return '127.0.0.0/8 (Loopback)';
+    if (a === 169 && b === 254)
+        return '169.254.0.0/16 (Link-local)';
+    if (a === 0)
+        return '0.0.0.0/8 (Current network)';
+    return 'Unknown';
+}
+/**
+ * Validate file path to prevent path traversal attacks (SMI-720)
+ *
+ * Ensures the resolved path remains within the allowed root directory.
+ *
+ * @param path - Path to validate (can be relative or absolute)
+ * @param rootDir - Root directory that must contain the path
+ * @throws {ValidationError} if path escapes root directory
+ *
+ * @example
+ * ```typescript
+ * validatePath('skills/my-skill', '/home/user/.claude')  // OK
+ * validatePath('../etc/passwd', '/home/user/.claude')    // Throws ValidationError
+ * validatePath('/etc/passwd', '/home/user/.claude')      // Throws ValidationError
+ * ```
+ */
+export function validatePath(path, rootDir) {
+    if (!path) {
+        throw new ValidationError('Path cannot be empty', 'EMPTY_PATH');
+    }
+    if (!rootDir) {
+        throw new ValidationError('Root directory cannot be empty', 'EMPTY_ROOT_DIR');
+    }
+    // Normalize both paths to resolve '..' and '.'
+    // Resolve path relative to rootDir so relative paths work correctly
+    const normalizedPath = resolve(rootDir, path);
+    const normalizedRoot = resolve(rootDir);
+    // Check that normalized path is within root directory
+    // Handle edge case where path equals root exactly
+    const isWithinRoot = normalizedPath.startsWith(normalizedRoot + '/') || normalizedPath === normalizedRoot;
+    if (!isWithinRoot) {
+        throw new ValidationError(`Path traversal detected: ${path}`, 'PATH_TRAVERSAL', {
+            originalPath: path,
+            normalizedPath,
+            rootDir,
+            normalizedRoot,
+        });
+    }
+}
+/**
+ * Sanitize input string for safe use in various contexts
+ *
+ * Removes or escapes potentially dangerous characters.
+ *
+ * @param input - Input string to sanitize
+ * @param options - Sanitization options
+ * @returns Sanitized string
+ *
+ * @example
+ * ```typescript
+ * sanitizeInput('<script>alert(1)</script>')  // Returns: '&lt;script&gt;alert(1)&lt;/script&gt;'
+ * sanitizeInput('../../etc/passwd')           // Returns: 'etc/passwd'
+ * ```
+ */
+export function sanitizeInput(input, options = {}) {
+    const { removePathTraversal = true, escapeHtml = true, removeNullBytes = true } = options;
+    let sanitized = input;
+    // Remove null bytes (security risk)
+    if (removeNullBytes) {
+        sanitized = sanitized.replace(/\0/g, '');
+    }
+    // Remove path traversal sequences
+    if (removePathTraversal) {
+        // Remove '../' and '..\' patterns
+        sanitized = sanitized.replace(/\.\.[\\/]/g, '');
+        // Remove leading '../' or '..\'
+        sanitized = sanitized.replace(/^\.\.[\\/]+/, '');
+    }
+    // HTML escape
+    if (escapeHtml) {
+        sanitized = sanitized
+            .replace(/&/g, '&amp;')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#x27;');
+    }
+    return sanitized;
+}
+/**
+ * Safely test a string against a pattern, preventing RegExp injection (SMI-722)
+ *
+ * Tries exact match, prefix match, and regex match (with error handling).
+ * Falls back to includes check if regex is invalid.
+ *
+ * @param value - Value to test
+ * @param pattern - Pattern to match (string or regex)
+ * @returns True if value matches pattern
+ *
+ * @example
+ * ```typescript
+ * safePatternMatch('node_modules', 'node_modules')  // true (exact)
+ * safePatternMatch('node_modules/pkg', 'node_')     // true (prefix)
+ * safePatternMatch('test.js', '\\.js$')             // true (regex)
+ * safePatternMatch('test.js', '(evil')              // false (invalid regex, falls back)
+ * ```
+ */
+export function safePatternMatch(value, pattern) {
+    // Exact match
+    if (value === pattern) {
+        return true;
+    }
+    // Check if pattern looks like a regex (contains special chars)
+    // If it's a simple alphanumeric pattern, only do prefix matching
+    const isLikelyRegex = /[\\^$.*+?()[\]{}|]/.test(pattern);
+    if (!isLikelyRegex) {
+        // Simple pattern - only match as prefix
+        return value.startsWith(pattern);
+    }
+    // Try regex match with error handling for patterns that look like regex
+    try {
+        const regex = new RegExp(pattern);
+        return regex.test(value);
+    }
+    catch {
+        // Invalid regex - fall back to safe includes check
+        return value.includes(pattern);
+    }
+}
+/**
+ * Validate that patterns array is safe to use
+ *
+ * Checks for potentially dangerous regex patterns that could cause ReDoS.
+ *
+ * @param patterns - Array of patterns to validate
+ * @returns Array of validation warnings (empty if all patterns are safe)
+ *
+ * @example
+ * ```typescript
+ * validatePatterns(['node_modules', '\\.js$'])  // []
+ * validatePatterns(['(a+)+b'])                  // ['Pattern may cause ReDoS: (a+)+b']
+ * ```
+ */
+export function validatePatterns(patterns) {
+    const warnings = [];
+    for (const pattern of patterns) {
+        // Check for potentially dangerous nested quantifiers (ReDoS)
+        if (/(\(.*\+.*\))\+/.test(pattern) || /(\(.*\*.*\))\*/.test(pattern)) {
+            warnings.push(`Pattern may cause ReDoS (nested quantifiers): ${pattern}`);
+        }
+        // Check for extremely long patterns
+        if (pattern.length > 1000) {
+            warnings.push(`Pattern is suspiciously long (${pattern.length} chars): ${pattern.slice(0, 50)}...`);
+        }
+        // Try to compile as regex to check validity
+        try {
+            new RegExp(pattern);
+        }
+        catch (error) {
+            warnings.push(`Invalid regex pattern: ${pattern}`);
+        }
+    }
+    return warnings;
+}
+//# sourceMappingURL=index.js.map

package/dist/src/validation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/validation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAE9B;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAGtB;IACA;IAHlB,YACE,OAAe,EACC,IAAY,EACZ,OAAiB;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAA;QAHE,SAAI,GAAJ,IAAI,CAAQ;QACZ,YAAO,GAAP,OAAO,CAAU;QAGjC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CAAC,uBAAuB,GAAG,EAAE,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAA;IACtF,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,eAAe,CACvB,qBAAqB,MAAM,CAAC,QAAQ,oCAAoC,EACxE,kBAAkB,EAClB,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,CACnC,CAAA;IACH,CAAC;IAED,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAE5C,2DAA2D;IAC3D,kEAAkE;IAClE,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAClC,CAAC;IAED,2BAA2B;IAC3B,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC7E,MAAM,IAAI,eAAe,CAAC,mCAAmC,QAAQ,EAAE,EAAE,mBAAmB,EAAE;YAC5F,QAAQ;YACR,GAAG;SACJ,CAAC,CAAA;IACJ,CAAC;IAED,2BAA2B;IAC3B,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAA;IAChF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAE5C,0CAA0C;QAC1C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,eAAe,CAAC,yBAAyB,QAAQ,EAAE,EAAE,cAAc,EAAE;gBAC7E,QAAQ;gBACR,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAED,mCAAmC;QACnC,IACE,CAAC,KAAK,EAAE,IAAI,+BAA+B;YAC3C,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,kCAAkC;YACvE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,mCAAmC;YAC/D,CAAC,KAAK,GAAG,IAAI,yBAAyB;YACtC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,8BAA8B;YAC1D,CAAC,KAAK,CAAC,CAAC,8BAA8B;UACtC,CAAC;YACD,MAAM,IAAI,eAAe,CACvB,+CAA+C,QAAQ,EAAE,EACzD,yBAAyB,EACzB,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CACjD,CAAA;QACH,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,mFAAmF;IACnF,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,YAAY,CAAC,QAAgB,EAAE,GAAW;IACjD,yBAAyB;IACzB,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IAEzC,8CAA8C;IAC9C,+DAA+D;IAC/D,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;QAC7D,MAAM,IAAI,eAAe,CAAC,mCAAmC,QAAQ,EAAE,EAAE,mBAAmB,EAAE;YAC5F,QAAQ;YACR,GAAG;SACJ,CAAC,CAAA;IACJ,CAAC;IAED,yCAAyC;IACzC,qBAAqB;IACrB,IACE,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAC5B,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,8CAA8C,QAAQ,EAAE,EACxD,yBAAyB,EACzB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAClB,CAAA;IACH,CAAC;IAED,0CAA0C;IAC1C,qBAAqB;IACrB,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,eAAe,CACvB,gDAAgD,QAAQ,EAAE,EAC1D,kBAAkB,EAClB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAClB,CAAA;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CACvB,6CAA6C,QAAQ,EAAE,EACvD,wBAAwB,EACxB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAClB,CAAA;IACH,CAAC;IAED,mDAAmD;IACnD,2CAA2C;IAC3C,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,wCAAwC;QACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/C,IAAI,QAAQ,EAAE,CAAC;YACb,2CAA2C;YAC3C,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC/E,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACtC,uCAAuC;gBACvC,IACE,CAAC,KAAK,EAAE;oBACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;oBACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;oBACxB,CAAC,KAAK,GAAG;oBACT,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;oBACxB,CAAC,KAAK,CAAC,EACP,CAAC;oBACD,MAAM,IAAI,eAAe,CACvB,uDAAuD,QAAQ,EAAE,EACjE,0BAA0B,EAC1B,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CACjD,CAAA;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,2DAA2D;gBAC3D,mEAAmE;gBACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAA;gBACrE,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAA;oBACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAA;oBACtC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;oBAC5B,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;oBACrB,uCAAuC;oBACvC,IACE,CAAC,KAAK,EAAE;wBACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;wBACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;wBACxB,CAAC,KAAK,GAAG;wBACT,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;wBACxB,CAAC,KAAK,CAAC,EACP,CAAC;wBACD,MAAM,IAAI,eAAe,CACvB,uDAAuD,QAAQ,EAAE,EACjE,0BAA0B,EAC1B,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CACjD,CAAA;oBACH,CAAC;gBACH,CAAC;gBACD,4CAA4C;gBAC5C,MAAM,IAAI,eAAe,CACvB,+CAA+C,QAAQ,EAAE,EACzD,0BAA0B,EAC1B,EAAE,QAAQ,EAAE,GAAG,EAAE,CAClB,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,gFAAgF;IAChF,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,oEAAoE;YACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC1C,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAE1C,oCAAoC;YACpC,IACE,CAAC,KAAK,EAAE;gBACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;gBACxB,CAAC,KAAK,GAAG;gBACT,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;gBACxB,CAAC,KAAK,CAAC,EACP,CAAC;gBACD,MAAM,IAAI,eAAe,CACvB,8DAA8D,QAAQ,EAAE,EACxE,mBAAmB,EACnB,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CACtF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,kDAAkD;IAClD,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,mBAAmB,GAAG,UAAU,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAA;IAC9F,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,mBAAmB,CAAA;QACtD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAK,EAAE,EAAE,CAAC,CAAA;QAC7B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAK,EAAE,EAAE,CAAC,CAAA;QAC7B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAK,EAAE,EAAE,CAAC,CAAA;QAC7B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAK,EAAE,EAAE,CAAC,CAAA;QAE7B,kBAAkB;QAClB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;YACjD,oCAAoC;YACpC,IACE,CAAC,KAAK,EAAE;gBACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;gBACxB,CAAC,KAAK,GAAG;gBACT,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;gBACxB,CAAC,KAAK,CAAC,EACP,CAAC;gBACD,MAAM,IAAI,eAAe,CACvB,qEAAqE,QAAQ,EAAE,EAC/E,yBAAyB,EACzB,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CACtF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,sBAAsB,GAAG,UAAU,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACtF,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAA;QACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAA;QACpD,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;QAC5B,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;QACrB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;QAC3B,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAA;QAEpB,oCAAoC;QACpC,IACE,CAAC,KAAK,EAAE;YACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;YACxB,CAAC,KAAK,GAAG;YACT,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;YACxB,CAAC,KAAK,CAAC,EACP,CAAC;YACD,MAAM,IAAI,eAAe,CACvB,qEAAqE,QAAQ,EAAE,EAC/E,yBAAyB,EACzB,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CACtF,CAAA;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,6CAA6C;IAC7C,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,eAAe,CACvB,4CAA4C,QAAQ,EAAE,EACtD,qBAAqB,EACrB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAClB,CAAA;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,CAAS,EAAE,CAAS;IAC1C,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,sBAAsB,CAAA;IAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,yBAAyB,CAAA;IACrE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,0BAA0B,CAAA;IAC7D,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,wBAAwB,CAAA;IAC9C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,6BAA6B,CAAA;IAChE,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,6BAA6B,CAAA;IACjD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,eAAe,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,gBAAgB,CAAC,CAAA;IAC/E,CAAC;IAED,+CAA+C;IAC/C,oEAAoE;IACpE,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC7C,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEvC,sDAAsD;IACtD,kDAAkD;IAClD,MAAM,YAAY,GAChB,cAAc,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,IAAI,cAAc,KAAK,cAAc,CAAA;IAEtF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,eAAe,CAAC,4BAA4B,IAAI,EAAE,EAAE,gBAAgB,EAAE;YAC9E,YAAY,EAAE,IAAI;YAClB,cAAc;YACd,OAAO;YACP,cAAc;SACf,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,UAOI,EAAE;IAEN,MAAM,EAAE,mBAAmB,GAAG,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,eAAe,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IAEzF,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,oCAAoC;IACpC,IAAI,eAAe,EAAE,CAAC;QACpB,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC1C,CAAC;IAED,kCAAkC;IAClC,IAAI,mBAAmB,EAAE,CAAC;QACxB,kCAAkC;QAClC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;QAC/C,gCAAgC;QAChC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,cAAc;IACd,IAAI,UAAU,EAAE,CAAC;QACf,SAAS,GAAG,SAAS;aAClB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;aACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;aACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC5B,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAAe;IAC7D,cAAc;IACd,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+DAA+D;IAC/D,iEAAiE;IACjE,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAExD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,wCAAwC;QACxC,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;QACjC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAkB;IACjD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,6DAA6D;QAC7D,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,QAAQ,CAAC,IAAI,CAAC,iDAAiD,OAAO,EAAE,CAAC,CAAA;QAC3E,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CACX,iCAAiC,OAAO,CAAC,MAAM,YAAY,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CACrF,CAAA;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC"}