@skillsmith/core 0.5.5 → 0.5.6

package/dist/security/sanitization.js

@@ -0,0 +1,388 @@
+/**
+ * SMI-732: Input Sanitization Library
+ * SMI-750: Added input length limits to prevent ReDoS attacks
+ *
+ * Provides comprehensive input sanitization functions for:
+ * - HTML content (XSS prevention)
+ * - File names (path traversal prevention)
+ * - File paths (directory traversal prevention)
+ * - URLs (injection prevention)
+ *
+ * All functions are defensive and return safe defaults on invalid input.
+ * All functions accept maxLength parameter to prevent ReDoS attacks.
+ */
+import { createLogger } from '../utils/logger.js';
+// Re-export Stripe validators for backwards compatibility
+export { isValidStripeId, sanitizeStripeCustomerId, sanitizeStripeSubscriptionId, sanitizeStripePriceId, sanitizeStripeInvoiceId, sanitizeStripeEventId, } from './stripe-validators.js';
+const logger = createLogger('Sanitization');
+/** Default maximum input length for sanitization functions to prevent ReDoS */
+export const DEFAULT_MAX_LENGTH = 100000;
+/**
+ * Sanitize HTML content to prevent XSS attacks
+ *
+ * Removes dangerous tags, attributes, and JavaScript while preserving safe HTML.
+ * Uses a whitelist approach for maximum security.
+ *
+ * @param input - Raw HTML string
+ * @param maxLength - Maximum allowed input length (default: 100000)
+ * @returns Sanitized HTML safe for rendering
+ *
+ * @example
+ * ```typescript
+ * sanitizeHtml('<script>alert("XSS")</script><p>Hello</p>')
+ * // Returns: '<p>Hello</p>'
+ * ```
+ */
+export function sanitizeHtml(input, maxLength = DEFAULT_MAX_LENGTH) {
+    if (!input || typeof input !== 'string') {
+        return '';
+    }
+    if (input.length > maxLength) {
+        logger.warn('Input exceeds max length for sanitization', {
+            length: input.length,
+            maxLength,
+            function: 'sanitizeHtml',
+        });
+        return '';
+    }
+    // SMI-2261: Loop-based sanitization to prevent bypass with nested payloads
+    // e.g., <scr<script>ipt> becomes <script> after single-pass removal
+    let sanitized = input;
+    let previousPass = '';
+    const maxIterations = 10; // Prevent infinite loops on malformed input
+    for (let i = 0; i < maxIterations && previousPass !== sanitized; i++) {
+        previousPass = sanitized;
+        // Remove script tags and their content
+        sanitized = sanitized.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
+        // Remove event handlers (onclick, onerror, etc.)
+        sanitized = sanitized.replace(/\son\w+\s*=\s*["'][^"']*["']/gi, '');
+        sanitized = sanitized.replace(/\son\w+\s*=\s*[^\s>]*/gi, '');
+        // Remove javascript: protocol
+        sanitized = sanitized.replace(/javascript:/gi, '');
+        // Remove data: protocol (can be used for XSS)
+        sanitized = sanitized.replace(/data:text\/html/gi, '');
+        // Remove vbscript: protocol
+        sanitized = sanitized.replace(/vbscript:/gi, '');
+        // Remove object and embed tags
+        sanitized = sanitized.replace(/<(object|embed|iframe|frame|frameset)[^>]*>/gi, '');
+        // Remove style tags (can contain javascript)
+        sanitized = sanitized.replace(/<style\b[^<]*(?:(?!<\/style>)<[^<]*)*<\/style>/gi, '');
+        // Remove import statements in style attributes
+        sanitized = sanitized.replace(/style\s*=\s*["'][^"']*@import[^"']*["']/gi, '');
+    }
+    // Log if significant sanitization occurred
+    if (sanitized !== input) {
+        logger.debug('HTML sanitized', {
+            originalLength: input.length,
+            sanitizedLength: sanitized.length,
+        });
+    }
+    return sanitized;
+}
+/**
+ * Sanitize file name to prevent path traversal and invalid characters
+ *
+ * Removes:
+ * - Path separators (/, \)
+ * - Parent directory references (..)
+ * - Hidden file markers (leading .)
+ * - Special characters that are invalid in file names
+ * - Control characters
+ *
+ * @param name - Raw file name
+ * @param maxLength - Maximum allowed input length (default: 100000)
+ * @returns Safe file name or empty string if invalid
+ *
+ * @example
+ * ```typescript
+ * sanitizeFileName('../../../etc/passwd')
+ * // Returns: 'etcpasswd'
+ *
+ * sanitizeFileName('my-file.txt')
+ * // Returns: 'my-file.txt'
+ * ```
+ */
+export function sanitizeFileName(name, maxLength = DEFAULT_MAX_LENGTH) {
+    if (!name || typeof name !== 'string') {
+        return '';
+    }
+    if (name.length > maxLength) {
+        logger.warn('Input exceeds max length for sanitization', {
+            length: name.length,
+            maxLength,
+            function: 'sanitizeFileName',
+        });
+        return '';
+    }
+    let sanitized = name;
+    // Remove path separators
+    sanitized = sanitized.replace(/[/\\]/g, '');
+    // Remove leading dots (hidden files)
+    sanitized = sanitized.replace(/^\.+/, '');
+    // Remove control characters (0x00-0x1f, 0x7f)
+    // eslint-disable-next-line no-control-regex -- Intentional security check
+    sanitized = sanitized.replace(/[\x00-\x1f\x7f]/g, '');
+    // Remove special characters that are invalid in file names
+    // Keep: alphanumeric, hyphen, underscore, dot, space
+    sanitized = sanitized.replace(/[^a-zA-Z0-9._\-\s]/g, '');
+    // Collapse multiple consecutive dots to single dot (BEFORE parent dir check)
+    // This handles cases like 'file....txt' -> 'file.txt'
+    sanitized = sanitized.replace(/\.{2,}/g, '.');
+    // Remove multiple consecutive spaces
+    sanitized = sanitized.replace(/\s{2,}/g, ' ');
+    // Trim whitespace
+    sanitized = sanitized.trim();
+    // Ensure it's not empty and not too long
+    if (sanitized.length === 0 || sanitized.length > 255) {
+        logger.warn('Invalid file name after sanitization', { original: name });
+        return '';
+    }
+    // Reserved file names on Windows
+    const reservedNames = [
+        'CON',
+        'PRN',
+        'AUX',
+        'NUL',
+        'COM1',
+        'COM2',
+        'COM3',
+        'COM4',
+        'COM5',
+        'COM6',
+        'COM7',
+        'COM8',
+        'COM9',
+        'LPT1',
+        'LPT2',
+        'LPT3',
+        'LPT4',
+        'LPT5',
+        'LPT6',
+        'LPT7',
+        'LPT8',
+        'LPT9',
+    ];
+    const baseName = sanitized.split('.')[0].toUpperCase();
+    if (reservedNames.includes(baseName)) {
+        logger.warn('Reserved file name detected', { name: sanitized });
+        return `${sanitized}_safe`;
+    }
+    if (sanitized !== name) {
+        logger.debug('File name sanitized', { original: name, sanitized });
+    }
+    return sanitized;
+}
+/**
+ * Sanitize file path to prevent directory traversal attacks
+ *
+ * Ensures the path:
+ * - Does not escape the root directory
+ * - Contains no parent directory references
+ * - Uses forward slashes consistently
+ * - Is normalized
+ *
+ * @param path - Raw file path
+ * @param rootDir - Root directory to constrain path to (optional)
+ * @param maxLength - Maximum allowed input length (default: 100000)
+ * @returns Safe path or empty string if invalid
+ *
+ * @example
+ * ```typescript
+ * sanitizePath('../../../etc/passwd', '/app/data')
+ * // Returns: ''
+ *
+ * sanitizePath('user/files/doc.txt', '/app/data')
+ * // Returns: 'user/files/doc.txt'
+ * ```
+ */
+export function sanitizePath(path, rootDir, maxLength = DEFAULT_MAX_LENGTH) {
+    if (!path || typeof path !== 'string') {
+        return '';
+    }
+    if (path.length > maxLength) {
+        logger.warn('Input exceeds max length for sanitization', {
+            length: path.length,
+            maxLength,
+            function: 'sanitizePath',
+        });
+        return '';
+    }
+    let sanitized = path;
+    // Normalize path separators to forward slashes
+    sanitized = sanitized.replace(/\\/g, '/');
+    // Remove leading slashes for relative path handling
+    const isAbsolute = sanitized.startsWith('/');
+    sanitized = sanitized.replace(/^\/+/, '');
+    // Check for leading parent directory references - reject these paths entirely
+    // This catches '../../../etc/passwd' and './../file' type attacks
+    if (/^\.?\/?\.\./.test(sanitized)) {
+        logger.warn('Path traversal attempt detected', { path });
+        return '';
+    }
+    // Split into segments and process them
+    // Track depth and traversal count to detect escape attempts
+    // '..' segments are filtered out (security measure), but if there are more
+    // '..' than valid segments, we stop processing (escape attempt)
+    const rawSegments = sanitized.split('/');
+    const segments = [];
+    let depth = 0;
+    let traversalCount = 0;
+    for (const segment of rawSegments) {
+        // Remove empty segments and '.'
+        if (!segment || segment === '.')
+            continue;
+        // Handle parent directory references
+        if (segment === '..') {
+            traversalCount++;
+            if (traversalCount > depth) {
+                // Would escape - stop processing and return what we have
+                logger.warn('Path traversal attempt detected', { path, segment });
+                break;
+            }
+            // Just filter out '..' (don't resolve it, just remove it for security)
+            continue;
+        }
+        // Block segments with control characters
+        // eslint-disable-next-line no-control-regex -- Intentional security check
+        if (/[\x00-\x1f\x7f]/.test(segment)) {
+            logger.warn('Control characters in path segment', { path, segment });
+            continue;
+        }
+        // Sanitize and add segment
+        const sanitizedSegment = sanitizeFileName(segment);
+        if (sanitizedSegment.length > 0) {
+            segments.push(sanitizedSegment);
+            depth++;
+        }
+    }
+    // Rebuild path
+    sanitized = segments.join('/');
+    // Restore leading slash if original was absolute
+    if (isAbsolute && sanitized.length > 0) {
+        sanitized = '/' + sanitized;
+    }
+    // If rootDir is provided, ensure path doesn't escape it
+    if (rootDir && sanitized.length > 0) {
+        const normalizedRoot = rootDir.replace(/\\/g, '/').replace(/\/+$/, '');
+        const fullPath = isAbsolute ? sanitized : `${normalizedRoot}/${sanitized}`;
+        if (!fullPath.startsWith(normalizedRoot + '/') && fullPath !== normalizedRoot) {
+            logger.warn('Path escapes root directory', {
+                path,
+                rootDir,
+                fullPath,
+            });
+            return '';
+        }
+    }
+    if (sanitized !== path) {
+        logger.debug('Path sanitized', { original: path, sanitized });
+    }
+    return sanitized;
+}
+/**
+ * Sanitize URL to prevent injection attacks
+ *
+ * Validates:
+ * - Protocol is http or https
+ * - No javascript:, data:, or vbscript: protocols
+ * - No embedded credentials
+ * - Valid URL structure
+ *
+ * @param url - Raw URL string
+ * @param maxLength - Maximum allowed input length (default: 100000)
+ * @returns Sanitized URL or empty string if invalid
+ *
+ * @example
+ * ```typescript
+ * sanitizeUrl('javascript:alert(1)')
+ * // Returns: ''
+ *
+ * sanitizeUrl('https://example.com/page')
+ * // Returns: 'https://example.com/page'
+ * ```
+ */
+export function sanitizeUrl(url, maxLength = DEFAULT_MAX_LENGTH) {
+    if (!url || typeof url !== 'string') {
+        return '';
+    }
+    if (url.length > maxLength) {
+        logger.warn('Input exceeds max length for sanitization', {
+            length: url.length,
+            maxLength,
+            function: 'sanitizeUrl',
+        });
+        return '';
+    }
+    // Trim whitespace and control characters
+    // eslint-disable-next-line no-control-regex -- Intentional security check
+    const trimmed = url.trim().replace(/[\x00-\x1f\x7f]/g, '');
+    if (trimmed.length === 0) {
+        return '';
+    }
+    try {
+        const parsed = new URL(trimmed);
+        // Only allow http and https protocols
+        if (!['http:', 'https:'].includes(parsed.protocol)) {
+            logger.warn('Invalid URL protocol', { url: trimmed, protocol: parsed.protocol });
+            return '';
+        }
+        // Block URLs with embedded credentials
+        if (parsed.username || parsed.password) {
+            logger.warn('URL contains embedded credentials', { url: trimmed });
+            return '';
+        }
+        // Reconstruct URL to ensure it's properly formatted
+        const sanitized = parsed.toString();
+        if (sanitized !== url) {
+            logger.debug('URL sanitized', { original: url, sanitized });
+        }
+        return sanitized;
+    }
+    catch (error) {
+        logger.warn('Invalid URL format', { url: trimmed, error });
+        return '';
+    }
+}
+/**
+ * Sanitize arbitrary text input for safe storage and display
+ *
+ * Removes:
+ * - Control characters
+ * - Zero-width characters
+ * - Invalid Unicode
+ *
+ * @param input - Raw text input
+ * @param maxLength - Maximum allowed input length (default: 100000)
+ * @returns Sanitized text
+ *
+ * @example
+ * ```typescript
+ * sanitizeText('Hello\x00World\u200B')
+ * // Returns: 'HelloWorld'
+ * ```
+ */
+export function sanitizeText(input, maxLength = DEFAULT_MAX_LENGTH) {
+    if (!input || typeof input !== 'string') {
+        return '';
+    }
+    if (input.length > maxLength) {
+        logger.warn('Input exceeds max length for sanitization', {
+            length: input.length,
+            maxLength,
+            function: 'sanitizeText',
+        });
+        return '';
+    }
+    let sanitized = input;
+    // Remove control characters except newline and tab
+    // eslint-disable-next-line no-control-regex -- Intentional security check
+    sanitized = sanitized.replace(/[\x00-\x08\x0b-\x0c\x0e-\x1f\x7f]/g, '');
+    // Remove zero-width characters
+    sanitized = sanitized.replace(/[\u200b-\u200d\ufeff]/g, '');
+    // Normalize Unicode
+    sanitized = sanitized.normalize('NFC');
+    // Trim
+    sanitized = sanitized.trim();
+    return sanitized;
+}
+//# sourceMappingURL=sanitization.js.map

package/dist/security/sanitization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitization.js","sourceRoot":"","sources":["../../src/security/sanitization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,0DAA0D;AAC1D,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAE/B,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,CAAA;AAE3C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAExC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,SAAS,GAAG,kBAAkB;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;YACvD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS;YACT,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAA;QACF,OAAO,EAAE,CAAA;IACX,CAAC;IAED,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,IAAI,YAAY,GAAG,EAAE,CAAA;IACrB,MAAM,aAAa,GAAG,EAAE,CAAA,CAAC,4CAA4C;IAErE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACrE,YAAY,GAAG,SAAS,CAAA;QAExB,uCAAuC;QACvC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,qDAAqD,EAAE,EAAE,CAAC,CAAA;QAExF,iDAAiD;QACjD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,gCAAgC,EAAE,EAAE,CAAC,CAAA;QACnE,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAA;QAE5D,8BAA8B;QAC9B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;QAElD,8CAA8C;QAC9C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAA;QAEtD,4BAA4B;QAC5B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;QAEhD,+BAA+B;QAC/B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAA;QAElF,6CAA6C;QAC7C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,kDAAkD,EAAE,EAAE,CAAC,CAAA;QAErF,+CAA+C;QAC/C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,2CAA2C,EAAE,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,2CAA2C;IAC3C,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC7B,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,eAAe,EAAE,SAAS,CAAC,MAAM;SAClC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,SAAS,GAAG,kBAAkB;IAC3E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS;YACT,QAAQ,EAAE,kBAAkB;SAC7B,CAAC,CAAA;QACF,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,SAAS,GAAG,IAAI,CAAA;IAEpB,yBAAyB;IACzB,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IAE3C,qCAAqC;IACrC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAEzC,8CAA8C;IAC9C,0EAA0E;IAC1E,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAA;IAErD,2DAA2D;IAC3D,qDAAqD;IACrD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAA;IAExD,6EAA6E;IAC7E,sDAAsD;IACtD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAE7C,qCAAqC;IACrC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAE7C,kBAAkB;IAClB,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;IAE5B,yCAAyC;IACzC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QACvE,OAAO,EAAE,CAAA;IACX,CAAC;IAED,iCAAiC;IACjC,MAAM,aAAa,GAAG;QACpB,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;KACP,CAAA;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IACtD,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/D,OAAO,GAAG,SAAS,OAAO,CAAA;IAC5B,CAAC;IAED,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,OAAgB,EAChB,SAAS,GAAG,kBAAkB;IAE9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS;YACT,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAA;QACF,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,SAAS,GAAG,IAAI,CAAA;IAEpB,+CAA+C;IAC/C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAEzC,oDAAoD;IACpD,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IAC5C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAEzC,8EAA8E;IAC9E,kEAAkE;IAClE,IAAI,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,OAAO,EAAE,CAAA;IACX,CAAC;IAED,uCAAuC;IACvC,4DAA4D;IAC5D,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,cAAc,GAAG,CAAC,CAAA;IAEtB,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;YAAE,SAAQ;QAEzC,qCAAqC;QACrC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,cAAc,EAAE,CAAA;YAChB,IAAI,cAAc,GAAG,KAAK,EAAE,CAAC;gBAC3B,yDAAyD;gBACzD,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;gBACjE,MAAK;YACP,CAAC;YACD,uEAAuE;YACvE,SAAQ;QACV,CAAC;QAED,yCAAyC;QACzC,0EAA0E;QAC1E,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;YACpE,SAAQ;QACV,CAAC;QAED,2BAA2B;QAC3B,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAClD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;YAC/B,KAAK,EAAE,CAAA;QACT,CAAC;IACH,CAAC;IAED,eAAe;IACf,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAE9B,iDAAiD;IACjD,IAAI,UAAU,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,SAAS,GAAG,GAAG,GAAG,SAAS,CAAA;IAC7B,CAAC;IAED,wDAAwD;IACxD,IAAI,OAAO,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACtE,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,SAAS,EAAE,CAAA;QAE1E,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAC9E,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBACzC,IAAI;gBACJ,OAAO;gBACP,QAAQ;aACT,CAAC,CAAA;YACF,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAED,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,SAAS,GAAG,kBAAkB;IACrE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;YACvD,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS;YACT,QAAQ,EAAE,aAAa;SACxB,CAAC,CAAA;QACF,OAAO,EAAE,CAAA;IACX,CAAC;IAED,yCAAyC;IACzC,0EAA0E;IAC1E,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAA;IAE1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;QAE/B,sCAAsC;QACtC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;YAChF,OAAO,EAAE,CAAA;QACX,CAAC;QAED,uCAAuC;QACvC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAClE,OAAO,EAAE,CAAA;QACX,CAAC;QAED,oDAAoD;QACpD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAEnC,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAA;QAC7D,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1D,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,SAAS,GAAG,kBAAkB;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;YACvD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS;YACT,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAA;QACF,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,mDAAmD;IACnD,0EAA0E;IAC1E,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAA;IAEvE,+BAA+B;IAC/B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAA;IAE3D,oBAAoB;IACpB,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAEtC,OAAO;IACP,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;IAE5B,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/security/scanner/SecurityScanner.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Security Scanner - SMI-587, SMI-685, SMI-882, SMI-1189
+ *
+ * Security scanning for skill content with advanced pattern detection.
+ */
+import type { ScanReport, ScannerOptions } from './types.js';
+import type { LineContext } from './SecurityScanner.helpers.js';
+import { isMultilinePattern, analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, calculateRiskScore } from './SecurityScanner.helpers.js';
+import { scanSsrfPatterns } from './SecurityScanner.ssrf.js';
+import { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary } from './SecurityScanner.formatters.js';
+export { LineContext, isMultilinePattern, analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, calculateRiskScore, };
+export { scanSsrfPatterns };
+export { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary };
+export declare class SecurityScanner {
+    private allowedDomains;
+    private blockedPatterns;
+    private maxContentLength;
+    private riskThreshold;
+    constructor(options?: ScannerOptions);
+    private extractUrls;
+    private isAllowedDomain;
+    private scanUrls;
+    private scanSensitivePaths;
+    private scanJailbreakPatterns;
+    private scanSuspiciousPatterns;
+    private scanSocialEngineering;
+    private scanPromptLeaking;
+    private scanDataExfiltration;
+    private scanPrivilegeEscalation;
+    /** SMI-3864: Detect PII patterns. Email in YAML frontmatter gets low severity. */
+    private scanPiiPatterns;
+    private scanAIDefenceVulnerabilities;
+    /** @deprecated Use standalone calculateRiskScore function for new code */
+    calculateRiskScore: typeof calculateRiskScore;
+    scan(skillId: string, content: string): ScanReport;
+    quickCheck(content: string): boolean;
+    addAllowedDomain(domain: string): void;
+    addBlockedPattern(pattern: RegExp): void;
+    static toMinimalRefs: typeof toMinimalRefs;
+    static toSARIF: typeof toSARIF;
+    static toGitHubAnnotations: typeof toGitHubAnnotations;
+    static toSummary: typeof toSummary;
+}
+export default SecurityScanner;
+//# sourceMappingURL=SecurityScanner.d.ts.map

package/dist/security/scanner/SecurityScanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.d.ts","sourceRoot":"","sources":["../../../src/security/scanner/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAmB,UAAU,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAA;AAgBhG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAEnB,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAG5D,OAAO,EACL,aAAa,EACb,OAAO,EACP,mBAAmB,EACnB,SAAS,EACV,MAAM,iCAAiC,CAAA;AAGxC,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,CAAA;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAA;AAEjE,qBAAa,eAAe;IAC1B,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,eAAe,CAAU;IACjC,OAAO,CAAC,gBAAgB,CAAQ;IAChC,OAAO,CAAC,aAAa,CAAQ;gBAEjB,OAAO,GAAE,cAAmB;IAOxC,OAAO,CAAC,WAAW;IAenB,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,QAAQ;IAmBhB,OAAO,CAAC,kBAAkB;IAiC1B,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,sBAAsB;IAqC9B,OAAO,CAAC,qBAAqB;IAkC7B,OAAO,CAAC,iBAAiB;IAkCzB,OAAO,CAAC,oBAAoB;IAkC5B,OAAO,CAAC,uBAAuB;IAqC/B,kFAAkF;IAClF,OAAO,CAAC,eAAe;IAiDvB,OAAO,CAAC,4BAA4B;IAgBpC,0EAA0E;IAC1E,kBAAkB,4BAAqB;IAEvC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU;IA2ClD,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAOpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAItC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAKxC,MAAM,CAAC,aAAa,uBAAgB;IACpC,MAAM,CAAC,OAAO,iBAAU;IACxB,MAAM,CAAC,mBAAmB,6BAAsB;IAChD,MAAM,CAAC,SAAS,mBAAY;CAC7B;AAED,eAAe,eAAe,CAAA"}

package/dist/security/scanner/SecurityScanner.formatters.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Security Scanner Output Formatters
+ * @module @skillsmith/core/security/scanner/SecurityScanner.formatters
+ */
+import type { ScanReport } from './types.js';
+/**
+ * SMI-1454: Generate minimal refs output for CI/CD integration
+ * Outputs findings in a compact, machine-readable format suitable for:
+ * - GitHub Actions annotations
+ * - IDE problem matchers
+ * - CI pipeline integration
+ *
+ * @param report - The scan report to format
+ * @returns Array of minimal ref strings in format "file:line:severity:message"
+ */
+export declare function toMinimalRefs(report: ScanReport): string[];
+/**
+ * SMI-1454: Generate SARIF (Static Analysis Results Interchange Format) output
+ * For integration with GitHub Code Scanning and other SARIF consumers
+ *
+ * @param report - The scan report to format
+ * @returns SARIF v2.1.0 compliant output object
+ */
+export declare function toSARIF(report: ScanReport): object;
+/**
+ * SMI-1454: Generate GitHub Actions annotations format
+ * Outputs findings as GitHub Actions workflow commands for inline annotations
+ *
+ * @param report - The scan report to format
+ * @returns Array of GitHub Actions annotation strings
+ */
+export declare function toGitHubAnnotations(report: ScanReport): string[];
+/**
+ * SMI-1454: Generate summary statistics
+ * Returns a compact summary object for dashboards and reports
+ *
+ * @param report - The scan report to summarize
+ * @returns Summary object with counts by severity and type
+ */
+export declare function toSummary(report: ScanReport): {
+    skillId: string;
+    passed: boolean;
+    riskScore: number;
+    totalFindings: number;
+    bySeverity: Record<string, number>;
+    byType: Record<string, number>;
+    scanDurationMs: number;
+};
+//# sourceMappingURL=SecurityScanner.formatters.d.ts.map

package/dist/security/scanner/SecurityScanner.formatters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.formatters.d.ts","sourceRoot":"","sources":["../../../src/security/scanner/SecurityScanner.formatters.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAM5C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAQ1D;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAmElD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAQhE;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG;IAC7C,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;CACvB,CAkBA"}

package/dist/security/scanner/SecurityScanner.formatters.js

@@ -0,0 +1,139 @@
+/**
+ * Security Scanner Output Formatters
+ * @module @skillsmith/core/security/scanner/SecurityScanner.formatters
+ */
+// ============================================================================
+// Output Formatters
+// ============================================================================
+/**
+ * SMI-1454: Generate minimal refs output for CI/CD integration
+ * Outputs findings in a compact, machine-readable format suitable for:
+ * - GitHub Actions annotations
+ * - IDE problem matchers
+ * - CI pipeline integration
+ *
+ * @param report - The scan report to format
+ * @returns Array of minimal ref strings in format "file:line:severity:message"
+ */
+export function toMinimalRefs(report) {
+    return report.findings.map((finding) => {
+        const line = finding.lineNumber ?? 0;
+        const severity = finding.severity.toUpperCase();
+        const message = finding.message.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+        // Format: skill_id:line:severity:type:message
+        return `${report.skillId}:${line}:${severity}:${finding.type}:${message}`;
+    });
+}
+/**
+ * SMI-1454: Generate SARIF (Static Analysis Results Interchange Format) output
+ * For integration with GitHub Code Scanning and other SARIF consumers
+ *
+ * @param report - The scan report to format
+ * @returns SARIF v2.1.0 compliant output object
+ */
+export function toSARIF(report) {
+    const rules = [
+        { id: 'jailbreak', name: 'Jailbreak Attempt', severity: 'error' },
+        { id: 'social_engineering', name: 'Social Engineering', severity: 'warning' },
+        { id: 'prompt_leaking', name: 'Prompt Leaking', severity: 'error' },
+        { id: 'data_exfiltration', name: 'Data Exfiltration', severity: 'warning' },
+        { id: 'privilege_escalation', name: 'Privilege Escalation', severity: 'error' },
+        { id: 'suspicious_pattern', name: 'Suspicious Pattern', severity: 'warning' },
+        { id: 'sensitive_path', name: 'Sensitive Path', severity: 'warning' },
+        { id: 'url', name: 'External URL', severity: 'note' },
+        { id: 'ai_defence', name: 'AI Injection', severity: 'error' },
+    ];
+    const severityToLevel = {
+        critical: 'error',
+        high: 'error',
+        medium: 'warning',
+        low: 'note',
+    };
+    return {
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        version: '2.1.0',
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: 'Skillsmith Security Scanner',
+                        version: '1.0.0',
+                        informationUri: 'https://github.com/smith-horn/skillsmith',
+                        rules: rules.map((rule) => ({
+                            id: rule.id,
+                            name: rule.name,
+                            shortDescription: { text: rule.name },
+                            defaultConfiguration: { level: rule.severity },
+                        })),
+                    },
+                },
+                results: report.findings.map((finding) => ({
+                    ruleId: finding.type,
+                    level: severityToLevel[finding.severity] ?? 'warning',
+                    message: { text: finding.message },
+                    locations: [
+                        {
+                            physicalLocation: {
+                                artifactLocation: { uri: report.skillId },
+                                region: {
+                                    startLine: finding.lineNumber ?? 1,
+                                    snippet: finding.location ? { text: finding.location } : undefined,
+                                },
+                            },
+                        },
+                    ],
+                    properties: {
+                        confidence: finding.confidence ?? 'high',
+                        inDocumentationContext: finding.inDocumentationContext ?? false,
+                    },
+                })),
+                invocations: [
+                    {
+                        executionSuccessful: true,
+                        endTimeUtc: report.scannedAt.toISOString(),
+                    },
+                ],
+            },
+        ],
+    };
+}
+/**
+ * SMI-1454: Generate GitHub Actions annotations format
+ * Outputs findings as GitHub Actions workflow commands for inline annotations
+ *
+ * @param report - The scan report to format
+ * @returns Array of GitHub Actions annotation strings
+ */
+export function toGitHubAnnotations(report) {
+    return report.findings.map((finding) => {
+        const severity = finding.severity === 'critical' || finding.severity === 'high' ? 'error' : 'warning';
+        const line = finding.lineNumber ?? 1;
+        const message = finding.message.replace(/%/g, '%25').replace(/\r/g, '%0D').replace(/\n/g, '%0A');
+        return `::${severity} file=${report.skillId},line=${line}::${message}`;
+    });
+}
+/**
+ * SMI-1454: Generate summary statistics
+ * Returns a compact summary object for dashboards and reports
+ *
+ * @param report - The scan report to summarize
+ * @returns Summary object with counts by severity and type
+ */
+export function toSummary(report) {
+    const bySeverity = { critical: 0, high: 0, medium: 0, low: 0 };
+    const byType = {};
+    for (const finding of report.findings) {
+        bySeverity[finding.severity] = (bySeverity[finding.severity] || 0) + 1;
+        byType[finding.type] = (byType[finding.type] || 0) + 1;
+    }
+    return {
+        skillId: report.skillId,
+        passed: report.passed,
+        riskScore: report.riskScore,
+        totalFindings: report.findings.length,
+        bySeverity,
+        byType,
+        scanDurationMs: report.scanDurationMs,
+    };
+}
+//# sourceMappingURL=SecurityScanner.formatters.js.map

package/dist/security/scanner/SecurityScanner.formatters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.formatters.js","sourceRoot":"","sources":["../../../src/security/scanner/SecurityScanner.formatters.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,MAAkB;IAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,CAAA;QACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC3E,8CAA8C;QAC9C,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAA;IAC3E,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,MAAkB;IACxC,MAAM,KAAK,GAAG;QACZ,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE;QACjE,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC7E,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE;QACnE,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC3E,EAAE,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,OAAO,EAAE;QAC/E,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC7E,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE;QACrE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE;QACrD,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE;KAC9D,CAAA;IAED,MAAM,eAAe,GAA2B;QAC9C,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,SAAS;QACjB,GAAG,EAAE,MAAM;KACZ,CAAA;IAED,OAAO;QACL,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,6BAA6B;wBACnC,OAAO,EAAE,OAAO;wBAChB,cAAc,EAAE,0CAA0C;wBAC1D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;4BAC1B,EAAE,EAAE,IAAI,CAAC,EAAE;4BACX,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;4BACrC,oBAAoB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;yBAC/C,CAAC,CAAC;qBACJ;iBACF;gBACD,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACzC,MAAM,EAAE,OAAO,CAAC,IAAI;oBACpB,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,SAAS;oBACrD,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;oBAClC,SAAS,EAAE;wBACT;4BACE,gBAAgB,EAAE;gCAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE;gCACzC,MAAM,EAAE;oCACN,SAAS,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC;oCAClC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;iCACnE;6BACF;yBACF;qBACF;oBACD,UAAU,EAAE;wBACV,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,MAAM;wBACxC,sBAAsB,EAAE,OAAO,CAAC,sBAAsB,IAAI,KAAK;qBAChE;iBACF,CAAC,CAAC;gBACH,WAAW,EAAE;oBACX;wBACE,mBAAmB,EAAE,IAAI;wBACzB,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;qBAC3C;iBACF;aACF;SACF;KACF,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAkB;IACpD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACrC,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;QACtF,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAChG,OAAO,KAAK,QAAQ,SAAS,MAAM,CAAC,OAAO,SAAS,IAAI,KAAK,OAAO,EAAE,CAAA;IACxE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,MAAkB;IAS1C,MAAM,UAAU,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAA;IACtF,MAAM,MAAM,GAA2B,EAAE,CAAA;IAEzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QACtE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IACxD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QACrC,UAAU;QACV,MAAM;QACN,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAA;AACH,CAAC"}