@skillsmith/core 0.5.4 → 0.5.6

package/dist/security/audit-types.d.ts

@@ -0,0 +1,96 @@
+/**
+ * SMI-733: Audit Logger Types
+ *
+ * Type definitions for the audit logging system.
+ * Extracted from AuditLogger.ts for file size compliance.
+ */
+/**
+ * Types of security events that are audited
+ */
+export type AuditEventType = 'url_fetch' | 'file_access' | 'skill_install' | 'skill_uninstall' | 'security_scan' | 'cache_operation' | 'source_sync' | 'config_change' | 'quarantine_authenticated_review' | 'quarantine_multi_approval' | 'quarantine_multi_approval_complete' | 'quarantine_multi_approval_cancelled' | 'quarantine_multi_approval_timeout' | 'security_feature_flag_override';
+/**
+ * Actor performing the action
+ */
+export type AuditActor = 'user' | 'system' | 'adapter' | 'scanner' | 'reviewer';
+/**
+ * Result of the audited action
+ */
+export type AuditResult = 'success' | 'blocked' | 'error' | 'warning';
+/**
+ * Database row type for audit logs
+ */
+export interface AuditLogRow {
+    id: string;
+    event_type: AuditEventType;
+    timestamp: string;
+    actor: AuditActor;
+    resource: string;
+    action: string;
+    result: AuditResult;
+    metadata: string | null;
+    created_at: string;
+}
+/**
+ * Audit log entry structure
+ */
+export interface AuditLogEntry {
+    id: string;
+    event_type: AuditEventType;
+    timestamp: string;
+    actor: AuditActor;
+    resource: string;
+    action: string;
+    result: AuditResult;
+    metadata?: Record<string, unknown>;
+    created_at: string;
+}
+/**
+ * Query filters for audit log retrieval
+ */
+export interface AuditQueryFilter {
+    event_type?: AuditEventType;
+    actor?: AuditActor;
+    resource?: string;
+    result?: AuditResult;
+    since?: Date;
+    until?: Date;
+    limit?: number;
+    offset?: number;
+}
+/**
+ * Minimum retention period in days (security requirement)
+ */
+export declare const MIN_RETENTION_DAYS = 1;
+/**
+ * Maximum retention period in days (storage constraint)
+ */
+export declare const MAX_RETENTION_DAYS = 3650;
+/**
+ * Configuration options for AuditLogger
+ */
+export interface AuditLoggerConfig {
+    /**
+     * Enable automatic cleanup of old logs on initialization
+     * @default false
+     */
+    autoCleanup?: boolean;
+    /**
+     * Number of days to retain logs (used with autoCleanup)
+     * Must be between MIN_RETENTION_DAYS (1) and MAX_RETENTION_DAYS (3650)
+     * @default 90
+     */
+    retentionDays?: number;
+}
+/**
+ * Audit statistics
+ */
+export interface AuditStats {
+    total_events: number;
+    events_by_type: Record<AuditEventType, number>;
+    events_by_result: Record<AuditResult, number>;
+    blocked_events: number;
+    error_events: number;
+    oldest_event: string | null;
+    newest_event: string | null;
+}
+//# sourceMappingURL=audit-types.d.ts.map

package/dist/security/audit-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-types.d.ts","sourceRoot":"","sources":["../../src/security/audit-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,aAAa,GACb,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,iBAAiB,GACjB,aAAa,GACb,eAAe,GAEf,iCAAiC,GACjC,2BAA2B,GAC3B,oCAAoC,GACpC,qCAAqC,GACrC,mCAAmC,GAEnC,gCAAgC,CAAA;AAEpC;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAA;AAE/E;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;AAErE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,cAAc,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,UAAU,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,WAAW,CAAA;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,cAAc,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,UAAU,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,WAAW,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B,KAAK,CAAC,EAAE,UAAU,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,KAAK,CAAC,EAAE,IAAI,CAAA;IACZ,KAAK,CAAC,EAAE,IAAI,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAA;AAEnC;;GAEG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAA;AAEtC;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IAC9C,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IAC7C,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B"}

package/dist/security/audit-types.js

@@ -0,0 +1,15 @@
+/**
+ * SMI-733: Audit Logger Types
+ *
+ * Type definitions for the audit logging system.
+ * Extracted from AuditLogger.ts for file size compliance.
+ */
+/**
+ * Minimum retention period in days (security requirement)
+ */
+export const MIN_RETENTION_DAYS = 1;
+/**
+ * Maximum retention period in days (storage constraint)
+ */
+export const MAX_RETENTION_DAYS = 3650; // 10 years
+//# sourceMappingURL=audit-types.js.map

package/dist/security/audit-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-types.js","sourceRoot":"","sources":["../../src/security/audit-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA6EH;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAEnC;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAA,CAAC,WAAW"}

package/dist/security/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * SMI-587: Security module exports
+ * SMI-685: Enhanced with severity scoring types
+ * SMI-730: Rate limiting with token bucket algorithm
+ * SMI-732: Input sanitization functions
+ * SMI-733: Audit logging system
+ * SMI-898: Path traversal protection for database paths
+ * SMI-1189: Split into modular subpackages
+ */
+export { SecurityScanner } from './scanner/index.js';
+export type { SecurityFinding, SecurityFindingType, SecuritySeverity, ScanReport, ScannerOptions, RiskScoreBreakdown, } from './scanner/index.js';
+export { sanitizeHtml, sanitizeFileName, sanitizePath, sanitizeUrl, sanitizeText, isValidStripeId, sanitizeStripeCustomerId, sanitizeStripeSubscriptionId, sanitizeStripePriceId, sanitizeStripeInvoiceId, sanitizeStripeEventId, } from './sanitization.js';
+export { validateDbPath, validateDbPathOrThrow, isPathSafe, DEFAULT_ALLOWED_DIRS, } from './pathValidation.js';
+export type { PathValidationOptions, PathValidationResult } from './pathValidation.js';
+export { AuditLogger } from './AuditLogger.js';
+export type { AuditLogEntry, AuditEventType, AuditActor, AuditResult, AuditQueryFilter, AuditStats, } from './AuditLogger.js';
+export { RateLimiter, InMemoryRateLimitStorage, RATE_LIMIT_PRESETS, createRateLimiterFromPreset, RateLimitQueueTimeoutError, RateLimitQueueFullError, } from './rate-limiter/index.js';
+export type { RateLimitConfig, RateLimitResult, RateLimitStorage, RateLimitMetrics, } from './rate-limiter/index.js';
+export { detectRiskTrend } from './risk-trend.js';
+export type { RiskTrendResult } from './risk-trend.js';
+export { SkillSandbox, SandboxUnavailableError, withSandbox } from './SkillSandbox.js';
+export type { SandboxOptions, ExecutionResult, SandboxFile, SandboxStatus } from './SkillSandbox.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,YAAY,EAEZ,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,UAAU,EACV,oBAAoB,GACrB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAGtF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,YAAY,EACV,aAAa,EACb,cAAc,EACd,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,UAAU,GACX,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAGtD,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtF,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/security/index.js

@@ -0,0 +1,26 @@
+/**
+ * SMI-587: Security module exports
+ * SMI-685: Enhanced with severity scoring types
+ * SMI-730: Rate limiting with token bucket algorithm
+ * SMI-732: Input sanitization functions
+ * SMI-733: Audit logging system
+ * SMI-898: Path traversal protection for database paths
+ * SMI-1189: Split into modular subpackages
+ */
+// Scanner module
+export { SecurityScanner } from './scanner/index.js';
+// Sanitization
+export { sanitizeHtml, sanitizeFileName, sanitizePath, sanitizeUrl, sanitizeText, 
+// SMI-1062: Stripe ID validators
+isValidStripeId, sanitizeStripeCustomerId, sanitizeStripeSubscriptionId, sanitizeStripePriceId, sanitizeStripeInvoiceId, sanitizeStripeEventId, } from './sanitization.js';
+// Path validation
+export { validateDbPath, validateDbPathOrThrow, isPathSafe, DEFAULT_ALLOWED_DIRS, } from './pathValidation.js';
+// Audit logger
+export { AuditLogger } from './AuditLogger.js';
+// Rate limiter module
+export { RateLimiter, InMemoryRateLimitStorage, RATE_LIMIT_PRESETS, createRateLimiterFromPreset, RateLimitQueueTimeoutError, RateLimitQueueFullError, } from './rate-limiter/index.js';
+// SMI-3874: Risk trend detection
+export { detectRiskTrend } from './risk-trend.js';
+// SMI-1534: E2B Sandbox for skill testing
+export { SkillSandbox, SandboxUnavailableError, withSandbox } from './SkillSandbox.js';
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iBAAiB;AACjB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAUpD,eAAe;AACf,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,YAAY;AACZ,iCAAiC;AACjC,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,mBAAmB,CAAA;AAE1B,kBAAkB;AAClB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,UAAU,EACV,oBAAoB,GACrB,MAAM,qBAAqB,CAAA;AAG5B,eAAe;AACf,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAU9C,sBAAsB;AACtB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAQhC,iCAAiC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAGjD,0CAA0C;AAC1C,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/security/pathValidation.d.ts

@@ -0,0 +1,95 @@
+/**
+ * SMI-898: Path Traversal Protection for Database Paths
+ *
+ * Provides secure path validation for database and file storage paths.
+ * Prevents path traversal attacks by:
+ * - Canonicalizing paths with path.resolve() and path.normalize()
+ * - Validating that resolved paths stay within allowed directories
+ * - Rejecting paths with ".." traversal attempts
+ * - Blocking absolute paths outside allowed directories
+ */
+/**
+ * Configuration for path validation
+ */
+export interface PathValidationOptions {
+    /** Allowed base directories for path resolution (default: [~/.skillsmith]) */
+    allowedDirs?: string[];
+    /** Allow in-memory database path ':memory:' (default: true) */
+    allowInMemory?: boolean;
+    /** Allow paths under system temp directory (default: true for testing) */
+    allowTempDir?: boolean;
+    /** Maximum path length (default: 4096) */
+    maxLength?: number;
+}
+/**
+ * Result of path validation
+ */
+export interface PathValidationResult {
+    /** Whether the path is valid */
+    valid: boolean;
+    /** The sanitized and resolved path (if valid) */
+    resolvedPath?: string;
+    /** Error message (if invalid) */
+    error?: string;
+}
+/**
+ * Default allowed directories for database storage
+ */
+export declare const DEFAULT_ALLOWED_DIRS: string[];
+/**
+ * Validate and sanitize a database path to prevent path traversal attacks.
+ *
+ * Security measures:
+ * 1. Rejects null bytes and control characters
+ * 2. Canonicalizes path with resolve() and normalize()
+ * 3. Checks for ".." traversal attempts before resolution
+ * 4. Validates resolved path is within allowed directories
+ * 5. Handles both absolute and relative paths
+ *
+ * @param inputPath - The raw path to validate
+ * @param options - Validation configuration options
+ * @returns Validation result with resolved path or error
+ *
+ * @example
+ * ```typescript
+ * // Valid paths
+ * validateDbPath('/Users/me/.skillsmith/skills.db')
+ * // => { valid: true, resolvedPath: '/Users/me/.skillsmith/skills.db' }
+ *
+ * validateDbPath(':memory:')
+ * // => { valid: true, resolvedPath: ':memory:' }
+ *
+ * // Invalid paths - traversal attack
+ * validateDbPath('../../../etc/passwd')
+ * // => { valid: false, error: 'Path traversal detected' }
+ *
+ * validateDbPath('/etc/passwd')
+ * // => { valid: false, error: 'Path outside allowed directories' }
+ * ```
+ */
+export declare function validateDbPath(inputPath: string | undefined, options?: PathValidationOptions): PathValidationResult;
+/**
+ * Validate a database path and throw an error if invalid.
+ * Convenience wrapper for validateDbPath that throws instead of returning error.
+ *
+ * @param inputPath - The raw path to validate
+ * @param options - Validation configuration options
+ * @returns The validated and resolved path
+ * @throws Error if path validation fails
+ *
+ * @example
+ * ```typescript
+ * const safePath = validateDbPathOrThrow(process.env.DB_PATH);
+ * // Either returns valid path or throws
+ * ```
+ */
+export declare function validateDbPathOrThrow(inputPath: string | undefined, options?: PathValidationOptions): string;
+/**
+ * Check if a path is safe for database usage without modifying it.
+ * Quick check that doesn't resolve the path.
+ *
+ * @param inputPath - The path to check
+ * @returns True if the path appears safe (no obvious traversal)
+ */
+export declare function isPathSafe(inputPath: string): boolean;
+//# sourceMappingURL=pathValidation.d.ts.map

package/dist/security/pathValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathValidation.d.ts","sourceRoot":"","sources":["../../src/security/pathValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,gCAAgC;IAChC,KAAK,EAAE,OAAO,CAAA;IACd,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,UAGhC,CAAA;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAkItB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAMR;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAuBrD"}

package/dist/security/pathValidation.js

@@ -0,0 +1,216 @@
+/**
+ * SMI-898: Path Traversal Protection for Database Paths
+ *
+ * Provides secure path validation for database and file storage paths.
+ * Prevents path traversal attacks by:
+ * - Canonicalizing paths with path.resolve() and path.normalize()
+ * - Validating that resolved paths stay within allowed directories
+ * - Rejecting paths with ".." traversal attempts
+ * - Blocking absolute paths outside allowed directories
+ */
+import { resolve, normalize, dirname, isAbsolute } from 'path';
+import { homedir } from 'os';
+import { createLogger } from '../utils/logger.js';
+const logger = createLogger('PathValidation');
+/**
+ * Default allowed directories for database storage
+ */
+export const DEFAULT_ALLOWED_DIRS = [
+    resolve(homedir(), '.skillsmith'),
+    resolve(homedir(), '.claude'),
+];
+/**
+ * System temp directory for test databases
+ */
+const TEMP_DIRS = ['/tmp', '/var/tmp', '/private/tmp', process.env.TMPDIR].filter(Boolean);
+/**
+ * Validate and sanitize a database path to prevent path traversal attacks.
+ *
+ * Security measures:
+ * 1. Rejects null bytes and control characters
+ * 2. Canonicalizes path with resolve() and normalize()
+ * 3. Checks for ".." traversal attempts before resolution
+ * 4. Validates resolved path is within allowed directories
+ * 5. Handles both absolute and relative paths
+ *
+ * @param inputPath - The raw path to validate
+ * @param options - Validation configuration options
+ * @returns Validation result with resolved path or error
+ *
+ * @example
+ * ```typescript
+ * // Valid paths
+ * validateDbPath('/Users/me/.skillsmith/skills.db')
+ * // => { valid: true, resolvedPath: '/Users/me/.skillsmith/skills.db' }
+ *
+ * validateDbPath(':memory:')
+ * // => { valid: true, resolvedPath: ':memory:' }
+ *
+ * // Invalid paths - traversal attack
+ * validateDbPath('../../../etc/passwd')
+ * // => { valid: false, error: 'Path traversal detected' }
+ *
+ * validateDbPath('/etc/passwd')
+ * // => { valid: false, error: 'Path outside allowed directories' }
+ * ```
+ */
+export function validateDbPath(inputPath, options = {}) {
+    const { allowedDirs = DEFAULT_ALLOWED_DIRS, allowInMemory = true, allowTempDir = true, maxLength = 4096, } = options;
+    // Null/undefined check
+    if (!inputPath || typeof inputPath !== 'string') {
+        return { valid: false, error: 'Path is required' };
+    }
+    // Length check
+    if (inputPath.length > maxLength) {
+        logger.warn('Path exceeds maximum length', { length: inputPath.length, maxLength });
+        return { valid: false, error: `Path exceeds maximum length of ${maxLength}` };
+    }
+    // Allow in-memory database
+    if (inputPath === ':memory:') {
+        if (allowInMemory) {
+            return { valid: true, resolvedPath: ':memory:' };
+        }
+        return { valid: false, error: 'In-memory database not allowed' };
+    }
+    // Check for null bytes (path injection)
+    if (inputPath.includes('\0')) {
+        logger.warn('Null byte detected in path', { path: inputPath.substring(0, 50) });
+        return { valid: false, error: 'Invalid characters in path' };
+    }
+    // Check for control characters
+    // eslint-disable-next-line no-control-regex
+    if (/[\x00-\x1f\x7f]/.test(inputPath)) {
+        logger.warn('Control characters detected in path', { path: inputPath.substring(0, 50) });
+        return { valid: false, error: 'Invalid characters in path' };
+    }
+    // Check for obvious traversal attempts before normalization
+    // This catches encoded traversal and various bypass attempts
+    if (inputPath.includes('..')) {
+        // Check if the path segments contain ".."
+        const segments = inputPath.split(/[/\\]/);
+        const hasTraversal = segments.some((seg) => seg === '..' || seg === '...');
+        if (hasTraversal) {
+            logger.warn('Path traversal attempt detected', { path: inputPath.substring(0, 100) });
+            return { valid: false, error: 'Path traversal detected' };
+        }
+    }
+    // Normalize and resolve the path
+    let resolvedPath;
+    try {
+        // Normalize first to handle various path formats
+        const normalized = normalize(inputPath);
+        // If the path is absolute, use it directly
+        // If relative, resolve from home directory's .skillsmith
+        if (isAbsolute(normalized)) {
+            resolvedPath = resolve(normalized);
+        }
+        else {
+            // Relative paths are resolved from the first allowed directory
+            resolvedPath = resolve(allowedDirs[0] || homedir(), normalized);
+        }
+    }
+    catch (error) {
+        logger.warn('Path resolution failed', {
+            path: inputPath.substring(0, 100),
+            error: error instanceof Error ? error.message : 'Unknown error',
+        });
+        return { valid: false, error: 'Invalid path format' };
+    }
+    // After resolution, verify no traversal occurred by checking resolved path
+    // doesn't contain ".." (should be resolved away, but double-check)
+    if (resolvedPath.includes('..')) {
+        logger.warn('Path traversal after resolution', { path: resolvedPath.substring(0, 100) });
+        return { valid: false, error: 'Path traversal detected' };
+    }
+    // Build list of allowed directories including temp dirs if enabled
+    const effectiveAllowedDirs = [...allowedDirs];
+    if (allowTempDir) {
+        effectiveAllowedDirs.push(...TEMP_DIRS);
+    }
+    // Check if resolved path is within any allowed directory
+    const isAllowed = effectiveAllowedDirs.some((allowedDir) => {
+        const resolvedAllowed = resolve(allowedDir);
+        // Path must be exactly the allowed dir or start with allowed dir + separator
+        return (resolvedPath === resolvedAllowed ||
+            resolvedPath.startsWith(resolvedAllowed + '/') ||
+            resolvedPath.startsWith(resolvedAllowed + '\\'));
+    });
+    if (!isAllowed) {
+        logger.warn('Path outside allowed directories', {
+            path: resolvedPath.substring(0, 100),
+            allowedDirs: effectiveAllowedDirs,
+        });
+        return { valid: false, error: 'Path outside allowed directories' };
+    }
+    // Ensure parent directory path is also valid
+    const parentDir = dirname(resolvedPath);
+    const parentAllowed = effectiveAllowedDirs.some((allowedDir) => {
+        const resolvedAllowed = resolve(allowedDir);
+        return (parentDir === resolvedAllowed ||
+            parentDir.startsWith(resolvedAllowed + '/') ||
+            parentDir.startsWith(resolvedAllowed + '\\'));
+    });
+    if (!parentAllowed) {
+        logger.warn('Parent directory outside allowed directories', {
+            parentDir: parentDir.substring(0, 100),
+        });
+        return { valid: false, error: 'Parent directory outside allowed directories' };
+    }
+    logger.debug('Path validated successfully', {
+        input: inputPath.substring(0, 100),
+        resolved: resolvedPath,
+    });
+    return { valid: true, resolvedPath };
+}
+/**
+ * Validate a database path and throw an error if invalid.
+ * Convenience wrapper for validateDbPath that throws instead of returning error.
+ *
+ * @param inputPath - The raw path to validate
+ * @param options - Validation configuration options
+ * @returns The validated and resolved path
+ * @throws Error if path validation fails
+ *
+ * @example
+ * ```typescript
+ * const safePath = validateDbPathOrThrow(process.env.DB_PATH);
+ * // Either returns valid path or throws
+ * ```
+ */
+export function validateDbPathOrThrow(inputPath, options = {}) {
+    const result = validateDbPath(inputPath, options);
+    if (!result.valid) {
+        throw new Error(`Invalid database path: ${result.error}`);
+    }
+    return result.resolvedPath;
+}
+/**
+ * Check if a path is safe for database usage without modifying it.
+ * Quick check that doesn't resolve the path.
+ *
+ * @param inputPath - The path to check
+ * @returns True if the path appears safe (no obvious traversal)
+ */
+export function isPathSafe(inputPath) {
+    if (!inputPath || typeof inputPath !== 'string') {
+        return false;
+    }
+    // Allow in-memory
+    if (inputPath === ':memory:') {
+        return true;
+    }
+    // Quick checks for obvious attacks
+    if (inputPath.includes('\0'))
+        return false;
+    if (inputPath.includes('..')) {
+        const segments = inputPath.split(/[/\\]/);
+        if (segments.some((seg) => seg === '..' || seg === '...')) {
+            return false;
+        }
+    }
+    // eslint-disable-next-line no-control-regex
+    if (/[\x00-\x1f\x7f]/.test(inputPath))
+        return false;
+    return true;
+}
+//# sourceMappingURL=pathValidation.js.map

package/dist/security/pathValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathValidation.js","sourceRoot":"","sources":["../../src/security/pathValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAA;AA4B7C;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC;IACjC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC;CAC9B,CAAA;AAED;;GAEG;AACH,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAC/E,OAAO,CACI,CAAA;AAEb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA6B,EAC7B,UAAiC,EAAE;IAEnC,MAAM,EACJ,WAAW,GAAG,oBAAoB,EAClC,aAAa,GAAG,IAAI,EACpB,YAAY,GAAG,IAAI,EACnB,SAAS,GAAG,IAAI,GACjB,GAAG,OAAO,CAAA;IAEX,uBAAuB;IACvB,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAA;IACpD,CAAC;IAED,eAAe;IACf,IAAI,SAAS,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QACnF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,SAAS,EAAE,EAAE,CAAA;IAC/E,CAAC;IAED,2BAA2B;IAC3B,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAA;QAClD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAA;IAClE,CAAC;IAED,wCAAwC;IACxC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;QAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAA;IAC9D,CAAC;IAED,+BAA+B;IAC/B,4CAA4C;IAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;QACxF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAA;IAC9D,CAAC;IAED,4DAA4D;IAC5D,6DAA6D;IAC7D,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,CAAA;QAC1E,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YACrF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAA;QAC3D,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,IAAI,YAAoB,CAAA;IACxB,IAAI,CAAC;QACH,iDAAiD;QACjD,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;QAEvC,2CAA2C;QAC3C,yDAAyD;QACzD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;QACpC,CAAC;aAAM,CAAC;YACN,+DAA+D;YAC/D,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,EAAE,UAAU,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACpC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;YACjC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAChE,CAAC,CAAA;QACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAA;IACvD,CAAC;IAED,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QACxF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAA;IAC3D,CAAC;IAED,mEAAmE;IACnE,MAAM,oBAAoB,GAAG,CAAC,GAAG,WAAW,CAAC,CAAA;IAC7C,IAAI,YAAY,EAAE,CAAC;QACjB,oBAAoB,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAA;IACzC,CAAC;IAED,yDAAyD;IACzD,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;QACzD,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;QAC3C,6EAA6E;QAC7E,OAAO,CACL,YAAY,KAAK,eAAe;YAChC,YAAY,CAAC,UAAU,CAAC,eAAe,GAAG,GAAG,CAAC;YAC9C,YAAY,CAAC,UAAU,CAAC,eAAe,GAAG,IAAI,CAAC,CAChD,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAC9C,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;YACpC,WAAW,EAAE,oBAAoB;SAClC,CAAC,CAAA;QACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAA;IACpE,CAAC;IAED,6CAA6C;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACvC,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;QAC7D,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;QAC3C,OAAO,CACL,SAAS,KAAK,eAAe;YAC7B,SAAS,CAAC,UAAU,CAAC,eAAe,GAAG,GAAG,CAAC;YAC3C,SAAS,CAAC,UAAU,CAAC,eAAe,GAAG,IAAI,CAAC,CAC7C,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;YAC1D,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;SACvC,CAAC,CAAA;QACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAA;IAChF,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;QAC1C,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;QAClC,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAA;IAEF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA6B,EAC7B,UAAiC,EAAE;IAEnC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACjD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC,YAAa,CAAA;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kBAAkB;IAClB,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,mCAAmC;IACnC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1C,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IAEnD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/security/rate-limiter/RateLimiter.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Rate Limiter - SMI-730, SMI-1013, SMI-1189
+ *
+ * Token bucket algorithm for rate limiting API endpoints and adapters.
+ * Prevents abuse and DoS attacks with configurable limits and windows.
+ *
+ * Features:
+ * - Token bucket algorithm for smooth rate limiting
+ * - Per-IP and per-user limits
+ * - Configurable limits and windows
+ * - In-memory storage (Redis-compatible interface)
+ * - Graceful degradation on errors
+ * - Request queue for waiting when rate limited (SMI-1013)
+ * - Configurable timeout for queued requests (SMI-1013)
+ */
+import type { RateLimitConfig, RateLimitMetrics, RateLimitResult, RateLimitStorage, TokenBucket } from './types.js';
+/**
+ * Rate Limiter using Token Bucket Algorithm
+ *
+ * @example
+ * ```typescript
+ * const limiter = new RateLimiter({
+ *   maxTokens: 100,
+ *   refillRate: 100 / 60,
+ *   windowMs: 60000,
+ * })
+ *
+ * const result = await limiter.checkLimit('user:123')
+ * if (result.allowed) {
+ *   // Process request
+ * } else {
+ *   // Return 429 Too Many Requests
+ * }
+ * ```
+ */
+export declare class RateLimiter {
+    private readonly config;
+    private readonly storage;
+    private readonly metricsManager;
+    private readonly queueManager;
+    constructor(config: RateLimitConfig, storage?: RateLimitStorage);
+    /**
+     * Try to consume a token without queuing (internal method)
+     */
+    private tryConsumeToken;
+    /**
+     * Check if a request is allowed under rate limit
+     */
+    checkLimit(key: string, cost?: number): Promise<RateLimitResult>;
+    /**
+     * Wait for a token to become available (SMI-1013)
+     */
+    waitForToken(key: string, cost?: number): Promise<RateLimitResult>;
+    /**
+     * Get queue status for a key (SMI-1013)
+     */
+    getQueueStatus(key?: string): {
+        totalQueued: number;
+        queues: Map<string, number>;
+    } | number;
+    /**
+     * Clear queue for a key (SMI-1013)
+     */
+    clearQueue(key?: string): void;
+    /**
+     * Reset rate limit for a key
+     */
+    reset(key: string): Promise<void>;
+    /**
+     * Get current state for a key
+     */
+    getState(key: string): Promise<TokenBucket | null>;
+    /**
+     * Get metrics for a specific key or all keys
+     */
+    getMetrics(key?: string): Map<string, RateLimitMetrics> | RateLimitMetrics | undefined;
+    /**
+     * Reset metrics for a specific key or all keys
+     */
+    resetMetrics(key?: string): void;
+    /**
+     * Dispose of resources
+     */
+    dispose(): void;
+}
+//# sourceMappingURL=RateLimiter.d.ts.map

package/dist/security/rate-limiter/RateLimiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimiter.d.ts","sourceRoot":"","sources":["../../../src/security/rate-limiter/RateLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACZ,MAAM,YAAY,CAAA;AAYnB;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAWtB;IACD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;gBAE/B,MAAM,EAAE,eAAe,EAAE,OAAO,GAAE,gBAAiD;IA6C/F;;OAEG;YACW,eAAe;IAI7B;;OAEG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAI,GAAG,OAAO,CAAC,eAAe,CAAC;IAsGjE;;OAEG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAI,GAAG,OAAO,CAAC,eAAe,CAAC;IA0BnE;;OAEG;IACH,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,MAAM;IAI3F;;OAEG;IACH,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI;IAO9B;;OAEG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvC;;OAEG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAIxD;;OAEG;IACH,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,gBAAgB,GAAG,SAAS;IAOtF;;OAEG;IACH,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI;IAWhC;;OAEG;IACH,OAAO,IAAI,IAAI;CAOhB"}