@skillsmith/core 0.5.4 → 0.5.6

package/dist/security/SkillSandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SkillSandbox.d.ts","sourceRoot":"","sources":["../../src/security/SkillSandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,sCAAsC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAA;IAClB,kCAAkC;IAClC,QAAQ,EAAE,OAAO,CAAA;IACjB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,mBAAmB;IACnB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,OAAO,CAAmC;IAClD,OAAO,CAAC,OAAO,CAAiB;gBAEpB,OAAO,GAAE,cAAmB;IASxC;;;OAGG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAwD7B;;;OAGG;IACG,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpD;;;;OAIG;IACG,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjF;;;;;OAKG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,GAAE,MAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAuFvF;;;;OAIG;IACG,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAUzD;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB9B;;OAEG;IACH,QAAQ,IAAI,OAAO;IAInB;;OAEG;IACH,SAAS,IAAI,aAAa;IAQ1B,OAAO,CAAC,aAAa;IAMrB;;;OAGG;YACW,sBAAsB;CAsBrC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;IACf,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAA;CAClC;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AA4BD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,CAAC,EACjC,EAAE,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,EACzC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,CAAC,CAQZ;AAED,eAAe,YAAY,CAAA"}

package/dist/security/SkillSandbox.js

@@ -0,0 +1,303 @@
+/**
+ * SMI-1534: E2B Sandbox Execution for Skill Testing
+ *
+ * Provides isolated execution environment for testing untrusted skills.
+ * Uses E2B (e2b.dev) sandboxes for secure, containerized execution.
+ *
+ * Features:
+ * - Isolated filesystem per skill test
+ * - Network isolation
+ * - Resource limits (CPU, memory)
+ * - Automatic cleanup after test
+ * - Configurable timeout (default: 30s)
+ */
+/**
+ * E2B Sandbox wrapper for skill testing
+ *
+ * @example
+ * ```typescript
+ * const sandbox = new SkillSandbox({ timeout: 60000 })
+ * try {
+ *   await sandbox.create()
+ *   await sandbox.copyFiles([
+ *     { path: '/skill/SKILL.md', content: skillContent },
+ *     { path: '/skill/test.ts', content: testCode }
+ *   ])
+ *   const result = await sandbox.execute('node /skill/test.ts')
+ *   console.log(result.stdout)
+ * } finally {
+ *   await sandbox.destroy()
+ * }
+ * ```
+ */
+export class SkillSandbox {
+    options;
+    sandbox = null;
+    created = false;
+    constructor(options = {}) {
+        this.options = {
+            timeout: options.timeout ?? 30000,
+            memoryMB: options.memoryMB ?? 256,
+            allowNetwork: options.allowNetwork ?? false,
+            env: options.env ?? {},
+        };
+    }
+    /**
+     * Create and initialize the sandbox environment
+     * @throws Error if sandbox creation fails or E2B is unavailable
+     */
+    async create() {
+        if (this.created) {
+            throw new Error('Sandbox already created. Call destroy() first.');
+        }
+        try {
+            // Dynamic import to allow graceful degradation if E2B is not installed
+            // SMI-1534: Use native dynamic import instead of Function constructor for CSP compliance
+            // @ts-expect-error - Dynamic import of optional dependency
+            const e2bModule = await import('@e2b/code-interpreter');
+            const Sandbox = e2bModule.Sandbox;
+            // Build sandbox configuration with security settings
+            const sandboxConfig = {
+                timeout: this.options.timeout,
+                // E2B template for Node.js execution
+                template: 'node-v20',
+                metadata: {
+                    source: 'skillsmith',
+                    purpose: 'skill-testing',
+                    networkIsolation: !this.options.allowNetwork, // Track isolation state
+                },
+            };
+            // Network isolation: E2B may support different mechanisms
+            // depending on version. We set the configuration to signal intent.
+            if (!this.options.allowNetwork) {
+                // Request network isolation when supported by E2B
+                sandboxConfig.enableNetworking = false;
+                sandboxConfig.internetAccess = false; // Alternative E2B API field
+            }
+            this.sandbox = await Sandbox.create(sandboxConfig);
+            // SMI-1534: Verify network isolation is actually in effect
+            if (!this.options.allowNetwork) {
+                await this.verifyNetworkIsolation();
+            }
+            this.created = true;
+        }
+        catch (error) {
+            // Check if it's a missing module error
+            if (error instanceof Error &&
+                (error.message.includes('Cannot find module') ||
+                    error.message.includes('Cannot find package') ||
+                    error.message.includes('ERR_MODULE_NOT_FOUND'))) {
+                throw new SandboxUnavailableError('E2B sandbox not available. Install @e2b/code-interpreter to enable sandboxed execution.');
+            }
+            throw error;
+        }
+    }
+    /**
+     * Copy files into the sandbox filesystem
+     * @param files - Array of files to copy
+     */
+    async copyFiles(files) {
+        this.ensureCreated();
+        for (const file of files) {
+            await this.sandbox.filesystem.write(file.path, file.content);
+        }
+    }
+    /**
+     * Copy a skill directory into the sandbox
+     * @param skillPath - Local path to skill directory
+     * @param destPath - Destination path in sandbox (default: /skill)
+     */
+    async copySkill(skillContent, destPath = '/skill') {
+        this.ensureCreated();
+        // Create skill directory structure
+        await this.sandbox.filesystem.makeDir(destPath);
+        await this.sandbox.filesystem.write(`${destPath}/SKILL.md`, skillContent);
+    }
+    /**
+     * Execute a command in the sandbox
+     * @param command - Command to execute
+     * @param workingDir - Working directory (default: /skill)
+     * @returns Execution result
+     */
+    async execute(command, workingDir = '/skill') {
+        this.ensureCreated();
+        const startTime = performance.now();
+        let timedOut = false;
+        let timeoutId = null;
+        try {
+            // Create a timeout promise with clearable timer (fixes memory leak)
+            const timeoutPromise = new Promise((_, reject) => {
+                timeoutId = setTimeout(() => {
+                    timedOut = true;
+                    reject(new Error('Execution timed out'));
+                }, this.options.timeout);
+            });
+            // Execute command with timeout race
+            const executionPromise = this.sandbox.process.startAndWait({
+                cmd: command,
+                cwd: workingDir,
+                env: this.options.env,
+            });
+            const result = await Promise.race([executionPromise, timeoutPromise]);
+            // Clear timeout on successful completion (fixes race condition)
+            if (timeoutId) {
+                clearTimeout(timeoutId);
+                timeoutId = null;
+            }
+            const durationMs = performance.now() - startTime;
+            return {
+                success: result.exitCode === 0,
+                exitCode: result.exitCode,
+                stdout: result.stdout,
+                stderr: result.stderr,
+                durationMs,
+                timedOut: false,
+            };
+        }
+        catch (error) {
+            const durationMs = performance.now() - startTime;
+            // Clear timeout if still pending
+            if (timeoutId) {
+                clearTimeout(timeoutId);
+                timeoutId = null;
+            }
+            if (timedOut) {
+                // Kill sandbox process on timeout to free resources
+                try {
+                    await this.sandbox.kill();
+                    this.sandbox = null;
+                    this.created = false;
+                }
+                catch (cleanupError) {
+                    // SMI-1534: Log cleanup errors for debugging instead of silently ignoring
+                    console.debug('[SkillSandbox] Cleanup error after timeout:', cleanupError instanceof Error ? cleanupError.message : cleanupError);
+                }
+                return {
+                    success: false,
+                    exitCode: -1,
+                    stdout: '',
+                    stderr: 'Execution timed out after ' + this.options.timeout + 'ms',
+                    durationMs,
+                    timedOut: true,
+                    error: 'Timeout',
+                };
+            }
+            return {
+                success: false,
+                exitCode: -1,
+                stdout: '',
+                stderr: error instanceof Error ? error.message : String(error),
+                durationMs,
+                timedOut: false,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    /**
+     * Execute TypeScript/JavaScript code directly
+     * @param code - Code to execute
+     * @returns Execution result
+     */
+    async executeCode(code) {
+        this.ensureCreated();
+        // Write code to temp file and execute
+        const tempPath = '/tmp/skill-test-' + Date.now() + '.js';
+        await this.sandbox.filesystem.write(tempPath, code);
+        return this.execute('node ' + tempPath, '/tmp');
+    }
+    /**
+     * Destroy the sandbox and clean up resources
+     * Should always be called in a finally block
+     */
+    async destroy() {
+        if (this.sandbox) {
+            try {
+                await this.sandbox.kill();
+            }
+            catch (cleanupError) {
+                // SMI-1534: Log cleanup errors for debugging instead of silently ignoring
+                console.debug('[SkillSandbox] Cleanup error during destroy:', cleanupError instanceof Error ? cleanupError.message : cleanupError);
+            }
+            this.sandbox = null;
+            this.created = false;
+        }
+    }
+    /**
+     * Check if sandbox is active
+     */
+    isActive() {
+        return this.created && this.sandbox !== null;
+    }
+    /**
+     * Get sandbox status
+     */
+    getStatus() {
+        return {
+            created: this.created,
+            active: this.isActive(),
+            options: this.options,
+        };
+    }
+    ensureCreated() {
+        if (!this.created || !this.sandbox) {
+            throw new Error('Sandbox not created. Call create() first.');
+        }
+    }
+    /**
+     * SMI-1534: Verify network isolation is actually in effect
+     * Attempts to make a network request and expects it to fail
+     */
+    async verifyNetworkIsolation() {
+        if (!this.sandbox)
+            return;
+        try {
+            // Try to ping a well-known address - should fail if isolated
+            const result = await this.sandbox.process.startAndWait({
+                cmd: 'timeout 2 curl -s --connect-timeout 1 http://1.1.1.1 2>&1 || echo "NETWORK_BLOCKED"',
+                cwd: '/tmp',
+            });
+            // If we don't see NETWORK_BLOCKED and exit code is 0, network is accessible
+            if (result.exitCode === 0 && !result.stdout.includes('NETWORK_BLOCKED')) {
+                console.warn('[SkillSandbox] WARNING: Network isolation verification failed. ' +
+                    'Network may be accessible despite isolation being requested.');
+            }
+        }
+        catch {
+            // Verification command failed - this is expected in isolated environment
+            // No action needed
+        }
+    }
+}
+/**
+ * Error thrown when E2B sandbox is not available
+ */
+export class SandboxUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'SandboxUnavailableError';
+    }
+}
+/**
+ * Factory function for creating sandboxes with proper cleanup
+ * Ensures sandbox is destroyed even if test throws
+ *
+ * @example
+ * ```typescript
+ * const result = await withSandbox(async (sandbox) => {
+ *   await sandbox.copySkill(skillContent)
+ *   return sandbox.execute('node test.js')
+ * })
+ * ```
+ */
+export async function withSandbox(fn, options) {
+    const sandbox = new SkillSandbox(options);
+    try {
+        await sandbox.create();
+        return await fn(sandbox);
+    }
+    finally {
+        await sandbox.destroy();
+    }
+}
+export default SkillSandbox;
+//# sourceMappingURL=SkillSandbox.js.map

package/dist/security/SkillSandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SkillSandbox.js","sourceRoot":"","sources":["../../src/security/SkillSandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA8CH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,YAAY;IACf,OAAO,CAA0B;IACjC,OAAO,GAA+B,IAAI,CAAA;IAC1C,OAAO,GAAY,KAAK,CAAA;IAEhC,YAAY,UAA0B,EAAE;QACtC,IAAI,CAAC,OAAO,GAAG;YACb,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;YACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;YACjC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK;YAC3C,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;SACvB,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,CAAC;QAED,IAAI,CAAC;YACH,uEAAuE;YACvE,yFAAyF;YACzF,2DAA2D;YAC3D,MAAM,SAAS,GAAuC,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAA;YAC3F,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAA;YAEjC,qDAAqD;YACrD,MAAM,aAAa,GAA4B;gBAC7C,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;gBAC7B,qCAAqC;gBACrC,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE;oBACR,MAAM,EAAE,YAAY;oBACpB,OAAO,EAAE,eAAe;oBACxB,gBAAgB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,wBAAwB;iBACvE;aACF,CAAA;YAED,0DAA0D;YAC1D,mEAAmE;YACnE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC/B,kDAAkD;gBAClD,aAAa,CAAC,gBAAgB,GAAG,KAAK,CAAA;gBACtC,aAAa,CAAC,cAAc,GAAG,KAAK,CAAA,CAAC,4BAA4B;YACnE,CAAC;YAED,IAAI,CAAC,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;YAElD,2DAA2D;YAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAA;YACrC,CAAC;YAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uCAAuC;YACvC,IACE,KAAK,YAAY,KAAK;gBACtB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;oBAC3C,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;oBAC7C,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,EACjD,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,yFAAyF,CAC1F,CAAA;YACH,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,KAAoB;QAClC,IAAI,CAAC,aAAa,EAAE,CAAA;QAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,OAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,WAAmB,QAAQ;QAC/D,IAAI,CAAC,aAAa,EAAE,CAAA;QAEpB,mCAAmC;QACnC,MAAM,IAAI,CAAC,OAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAChD,MAAM,IAAI,CAAC,OAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,QAAQ,WAAW,EAAE,YAAY,CAAC,CAAA;IAC5E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,aAAqB,QAAQ;QAC1D,IAAI,CAAC,aAAa,EAAE,CAAA;QAEpB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACnC,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,SAAS,GAAyC,IAAI,CAAA;QAE1D,IAAI,CAAC;YACH,oEAAoE;YACpE,MAAM,cAAc,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBACtD,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC1B,QAAQ,GAAG,IAAI,CAAA;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAA;gBAC1C,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1B,CAAC,CAAC,CAAA;YAEF,oCAAoC;YACpC,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAQ,CAAC,OAAO,CAAC,YAAY,CAAC;gBAC1D,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,UAAU;gBACf,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;aACtB,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAA;YAErE,gEAAgE;YAChE,IAAI,SAAS,EAAE,CAAC;gBACd,YAAY,CAAC,SAAS,CAAC,CAAA;gBACvB,SAAS,GAAG,IAAI,CAAA;YAClB,CAAC;YAED,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;YAEhD,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;gBAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU;gBACV,QAAQ,EAAE,KAAK;aAChB,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;YAEhD,iCAAiC;YACjC,IAAI,SAAS,EAAE,CAAC;gBACd,YAAY,CAAC,SAAS,CAAC,CAAA;gBACvB,SAAS,GAAG,IAAI,CAAA;YAClB,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,oDAAoD;gBACpD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,OAAQ,CAAC,IAAI,EAAE,CAAA;oBAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;oBACnB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;gBACtB,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,0EAA0E;oBAC1E,OAAO,CAAC,KAAK,CACX,6CAA6C,EAC7C,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CACpE,CAAA;gBACH,CAAC;gBAED,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,CAAC,CAAC;oBACZ,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,4BAA4B,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,IAAI;oBAClE,UAAU;oBACV,QAAQ,EAAE,IAAI;oBACd,KAAK,EAAE,SAAS;iBACjB,CAAA;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC9D,UAAU;gBACV,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,IAAI,CAAC,aAAa,EAAE,CAAA;QAEpB,sCAAsC;QACtC,MAAM,QAAQ,GAAG,kBAAkB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAA;QACxD,MAAM,IAAI,CAAC,OAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAEpD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAA;IACjD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;YAC3B,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACtB,0EAA0E;gBAC1E,OAAO,CAAC,KAAK,CACX,8CAA8C,EAC9C,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CACpE,CAAA;YACH,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;YACnB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;QACtB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAA;IAC9C,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAA;IACH,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAM;QAEzB,IAAI,CAAC;YACH,6DAA6D;YAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;gBACrD,GAAG,EAAE,qFAAqF;gBAC1F,GAAG,EAAE,MAAM;aACZ,CAAC,CAAA;YAEF,4EAA4E;YAC5E,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACxE,OAAO,CAAC,IAAI,CACV,iEAAiE;oBAC/D,8DAA8D,CACjE,CAAA;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,mBAAmB;QACrB,CAAC;IACH,CAAC;CACF;AAWD;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AA4BD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAyC,EACzC,OAAwB;IAExB,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;QACtB,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC,CAAA;IAC1B,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;IACzB,CAAC;AACH,CAAC;AAED,eAAe,YAAY,CAAA"}

package/dist/security/__tests__/pathValidation.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * SMI-898: Path Traversal Protection Tests
+ *
+ * Comprehensive tests for the path validation security module.
+ * Tests various path traversal attack vectors and ensures proper rejection.
+ */
+export {};
+//# sourceMappingURL=pathValidation.test.d.ts.map

package/dist/security/__tests__/pathValidation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathValidation.test.d.ts","sourceRoot":"","sources":["../../../src/security/__tests__/pathValidation.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/security/__tests__/pathValidation.test.js

@@ -0,0 +1,249 @@
+/**
+ * SMI-898: Path Traversal Protection Tests
+ *
+ * Comprehensive tests for the path validation security module.
+ * Tests various path traversal attack vectors and ensures proper rejection.
+ */
+import { describe, it, expect } from 'vitest';
+import { resolve } from 'path';
+import { homedir } from 'os';
+import { validateDbPath, validateDbPathOrThrow, isPathSafe } from '../pathValidation.js';
+describe('SMI-898: Path Traversal Protection', () => {
+    const homeDir = homedir();
+    const skillsmithDir = resolve(homeDir, '.skillsmith');
+    const claudeDir = resolve(homeDir, '.claude');
+    describe('validateDbPath', () => {
+        describe('valid paths', () => {
+            it('should accept in-memory database', () => {
+                const result = validateDbPath(':memory:');
+                expect(result.valid).toBe(true);
+                expect(result.resolvedPath).toBe(':memory:');
+            });
+            it('should accept paths in ~/.skillsmith', () => {
+                const testPath = resolve(skillsmithDir, 'test.db');
+                const result = validateDbPath(testPath);
+                expect(result.valid).toBe(true);
+                expect(result.resolvedPath).toBe(testPath);
+            });
+            it('should accept paths in ~/.claude', () => {
+                const testPath = resolve(claudeDir, 'skills/test.db');
+                const result = validateDbPath(testPath);
+                expect(result.valid).toBe(true);
+                expect(result.resolvedPath).toBe(testPath);
+            });
+            it('should accept nested paths in allowed directories', () => {
+                const testPath = resolve(skillsmithDir, 'data/nested/deep/test.db');
+                const result = validateDbPath(testPath);
+                expect(result.valid).toBe(true);
+                expect(result.resolvedPath).toBe(testPath);
+            });
+            it('should accept paths in temp directories', () => {
+                const testPath = '/tmp/skillsmith-test/test.db';
+                const result = validateDbPath(testPath, { allowTempDir: true });
+                expect(result.valid).toBe(true);
+                expect(result.resolvedPath).toBe(testPath);
+            });
+        });
+        describe('path traversal attacks', () => {
+            it('should reject simple .. traversal', () => {
+                const result = validateDbPath('../../../etc/passwd');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('traversal');
+            });
+            it('should reject .. traversal in middle of path', () => {
+                const result = validateDbPath(`${skillsmithDir}/../../../etc/passwd`);
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('traversal');
+            });
+            it('should reject encoded traversal attempts when decoded', () => {
+                // URL-encoded ".." - if decoded before validation, would be traversal
+                // Note: Our function checks for literal ".." not URL-encoded
+                // This test ensures basic ".." detection works
+                const decodedAttack = decodeURIComponent('%2e%2e/%2e%2e/etc/passwd');
+                const result = validateDbPath(decodedAttack);
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('traversal');
+            });
+            it('should reject mixed slash traversal', () => {
+                const result = validateDbPath('..\\..\\..\\etc\\passwd');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('traversal');
+            });
+            it('should reject double-encoded traversal when decoded', () => {
+                // %252e%252e decodes to %2e%2e, then to ..
+                // Test the fully decoded version
+                const doubleDecoded = decodeURIComponent(decodeURIComponent('%252e%252e'));
+                expect(doubleDecoded).toBe('..');
+                const result = validateDbPath(`/home/user/${doubleDecoded}/etc/passwd`);
+                expect(result.valid).toBe(false);
+            });
+            it('should reject hidden dot segment traversal (./..)', () => {
+                const result = validateDbPath('./../../../etc/passwd');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('traversal');
+            });
+            it('should reject traversal with extra dots (...)', () => {
+                const result = validateDbPath('.../etc/passwd');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('traversal');
+            });
+        });
+        describe('paths outside allowed directories', () => {
+            it('should reject absolute paths to system directories', () => {
+                const result = validateDbPath('/etc/passwd');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('outside allowed');
+            });
+            it('should reject absolute paths to other user directories', () => {
+                // Use a path that's definitely NOT in allowed dirs (not current user's home)
+                const result = validateDbPath('/home/otheruser/data/secret.db');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('outside allowed');
+            });
+            it('should reject paths in home but outside allowed subdirs', () => {
+                const result = validateDbPath(resolve(homeDir, 'Documents/secret.db'));
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('outside allowed');
+            });
+            it('should reject Windows-style system paths when run on Windows or when backslashes are normalized', () => {
+                // On Unix, Windows paths are treated as regular paths with backslash as separator
+                // The path resolves relative to allowed dir, so test with explicit outside path
+                const result = validateDbPath('/mnt/c/Windows/System32/config');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('outside allowed');
+            });
+        });
+        describe('invalid inputs', () => {
+            it('should reject null bytes', () => {
+                const result = validateDbPath(`${skillsmithDir}/test\0.db`);
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('Invalid characters');
+            });
+            it('should reject control characters', () => {
+                const result = validateDbPath(`${skillsmithDir}/test\x07.db`);
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('Invalid characters');
+            });
+            it('should reject empty string', () => {
+                const result = validateDbPath('');
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('required');
+            });
+            it('should reject undefined', () => {
+                const result = validateDbPath(undefined);
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('required');
+            });
+            it('should reject paths exceeding max length', () => {
+                const longPath = skillsmithDir + '/' + 'a'.repeat(5000) + '.db';
+                const result = validateDbPath(longPath);
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('length');
+            });
+        });
+        describe('edge cases', () => {
+            it('should reject in-memory when disabled', () => {
+                const result = validateDbPath(':memory:', { allowInMemory: false });
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('In-memory');
+            });
+            it('should reject temp dirs when disabled', () => {
+                const result = validateDbPath('/tmp/test.db', { allowTempDir: false });
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('outside allowed');
+            });
+            it('should handle symlink-like paths (detected by resolve)', () => {
+                // This tests that resolve() properly handles the path
+                const result = validateDbPath(`${skillsmithDir}/./test.db`);
+                expect(result.valid).toBe(true);
+                expect(result.resolvedPath).toBe(resolve(skillsmithDir, 'test.db'));
+            });
+            it('should handle relative paths by resolving to first allowed dir', () => {
+                const result = validateDbPath('custom.db');
+                expect(result.valid).toBe(true);
+                expect(result.resolvedPath).toBe(resolve(skillsmithDir, 'custom.db'));
+            });
+            it('should accept custom allowed directories', () => {
+                const customDir = '/var/lib/skillsmith';
+                const result = validateDbPath('/var/lib/skillsmith/test.db', {
+                    allowedDirs: [customDir],
+                    allowTempDir: false,
+                });
+                expect(result.valid).toBe(true);
+            });
+        });
+    });
+    describe('validateDbPathOrThrow', () => {
+        it('should return resolved path for valid input', () => {
+            const result = validateDbPathOrThrow(':memory:');
+            expect(result).toBe(':memory:');
+        });
+        it('should throw for invalid input', () => {
+            expect(() => validateDbPathOrThrow('../../../etc/passwd')).toThrow('Invalid database path');
+        });
+        it('should throw with descriptive error message', () => {
+            expect(() => validateDbPathOrThrow('/etc/passwd')).toThrow('outside allowed');
+        });
+    });
+    describe('isPathSafe', () => {
+        it('should return true for safe paths', () => {
+            expect(isPathSafe('/home/user/.skillsmith/test.db')).toBe(true);
+            expect(isPathSafe(':memory:')).toBe(true);
+            expect(isPathSafe('relative/path.db')).toBe(true);
+        });
+        it('should return false for paths with ..', () => {
+            expect(isPathSafe('../../../etc/passwd')).toBe(false);
+            expect(isPathSafe('foo/../bar/../../../etc')).toBe(false);
+        });
+        it('should return false for paths with null bytes', () => {
+            expect(isPathSafe('test\0.db')).toBe(false);
+        });
+        it('should return false for paths with control characters', () => {
+            expect(isPathSafe('test\x07.db')).toBe(false);
+        });
+        it('should return false for empty/undefined', () => {
+            expect(isPathSafe('')).toBe(false);
+            expect(isPathSafe(undefined)).toBe(false);
+        });
+    });
+    describe('real-world attack vectors', () => {
+        it('should block CVE-style path traversal', () => {
+            // Common attack patterns - focus on actual ".." traversal
+            // URL-encoded versions would need to be decoded first by the application layer
+            const attacks = [
+                '../../../etc/passwd',
+                '..\\..\\..\\etc\\passwd',
+                '..//..//..//etc/passwd',
+                './../../../etc/passwd',
+                'foo/../../../etc/passwd',
+                '.../.../etc/passwd',
+            ];
+            for (const attack of attacks) {
+                const result = validateDbPath(attack);
+                expect(result.valid).toBe(false);
+            }
+        });
+        it('should block Unicode dot attacks when normalized', () => {
+            // Unicode dots (\u002e is regular ASCII dot)
+            // \u002e\u002e is literally ".."
+            const dotDotPath = '\u002e\u002e/\u002e\u002e/etc/passwd';
+            expect(dotDotPath).toBe('../../etc/passwd'); // Confirm it's actual ..
+            const result = validateDbPath(dotDotPath);
+            expect(result.valid).toBe(false);
+            expect(result.error).toContain('traversal');
+        });
+        it('should block symlink escape attempts via path construction', () => {
+            // While we can't prevent actual symlink attacks without filesystem access,
+            // we can block paths that attempt to escape via naming patterns
+            const attacks = [
+                `${skillsmithDir}/../../etc/passwd`,
+                `${skillsmithDir}/../other-user/.ssh/id_rsa`,
+            ];
+            for (const attack of attacks) {
+                const result = validateDbPath(attack);
+                expect(result.valid).toBe(false);
+            }
+        });
+    });
+});
+//# sourceMappingURL=pathValidation.test.js.map

package/dist/security/__tests__/pathValidation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathValidation.test.js","sourceRoot":"","sources":["../../../src/security/__tests__/pathValidation.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAExF,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,MAAM,OAAO,GAAG,OAAO,EAAE,CAAA;IACzB,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAE7C,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;YAC3B,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;gBAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAC9C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;gBAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;gBAClD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;gBAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;gBACrD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;gBAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAE,0BAA0B,CAAC,CAAA;gBACnE,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;gBACjD,MAAM,QAAQ,GAAG,8BAA8B,CAAA;gBAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC/D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;YACtC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;gBAC3C,MAAM,MAAM,GAAG,cAAc,CAAC,qBAAqB,CAAC,CAAA;gBACpD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;gBACtD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,sBAAsB,CAAC,CAAA;gBACrE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;gBAC/D,sEAAsE;gBACtE,6DAA6D;gBAC7D,+CAA+C;gBAC/C,MAAM,aAAa,GAAG,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;gBACpE,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,CAAC,CAAA;gBAC5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;gBAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,yBAAyB,CAAC,CAAA;gBACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;gBAC7D,2CAA2C;gBAC3C,iCAAiC;gBACjC,MAAM,aAAa,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAA;gBAC1E,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChC,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,aAAa,aAAa,CAAC,CAAA;gBACvE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;gBAC3D,MAAM,MAAM,GAAG,cAAc,CAAC,uBAAuB,CAAC,CAAA;gBACtD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;gBACvD,MAAM,MAAM,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAA;gBAC/C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;YACjD,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;gBAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,CAAC,CAAA;gBAC5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;gBAChE,6EAA6E;gBAC7E,MAAM,MAAM,GAAG,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAC/D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;gBACjE,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAA;gBACtE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,iGAAiG,EAAE,GAAG,EAAE;gBACzG,kFAAkF;gBAClF,gFAAgF;gBAChF,MAAM,MAAM,GAAG,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAC/D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;YAC9B,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;gBAClC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,YAAY,CAAC,CAAA;gBAC3D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YACtD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;gBAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,cAAc,CAAC,CAAA;gBAC7D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YACtD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;gBACpC,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;gBACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;gBACjC,MAAM,MAAM,GAAG,cAAc,CAAC,SAA8B,CAAC,CAAA;gBAC7D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;gBAClD,MAAM,QAAQ,GAAG,aAAa,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;gBAC/D,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC1C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;YAC1B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;gBAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;gBAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAA;gBACtE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;gBAChE,sDAAsD;gBACtD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,YAAY,CAAC,CAAA;gBAC3D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAA;YACrE,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;gBACxE,MAAM,MAAM,GAAG,cAAc,CAAC,WAAW,CAAC,CAAA;gBAC1C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YACvE,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;gBAClD,MAAM,SAAS,GAAG,qBAAqB,CAAA;gBACvC,MAAM,MAAM,GAAG,cAAc,CAAC,6BAA6B,EAAE;oBAC3D,WAAW,EAAE,CAAC,SAAS,CAAC;oBACxB,YAAY,EAAE,KAAK;iBACpB,CAAC,CAAA;gBACF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjC,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAA;YAChD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAA;QAC7F,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;QAC/E,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC/D,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACzC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACrD,MAAM,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3D,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,MAAM,CAAC,UAAU,CAAC,SAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,0DAA0D;YAC1D,+EAA+E;YAC/E,MAAM,OAAO,GAAG;gBACd,qBAAqB;gBACrB,yBAAyB;gBACzB,wBAAwB;gBACxB,uBAAuB;gBACvB,yBAAyB;gBACzB,oBAAoB;aACrB,CAAA;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;gBACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,6CAA6C;YAC7C,iCAAiC;YACjC,MAAM,UAAU,GAAG,sCAAsC,CAAA;YACzD,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA,CAAC,yBAAyB;YACrE,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;YACzC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,2EAA2E;YAC3E,gEAAgE;YAChE,MAAM,OAAO,GAAG;gBACd,GAAG,aAAa,mBAAmB;gBACnC,GAAG,aAAa,4BAA4B;aAC7C,CAAA;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;gBACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}