@skillsmith/core 0.5.6 → 0.5.7

package/dist/security/audit-types.d.ts

@@ -1,96 +0,0 @@
-/**
- * SMI-733: Audit Logger Types
- *
- * Type definitions for the audit logging system.
- * Extracted from AuditLogger.ts for file size compliance.
- */
-/**
- * Types of security events that are audited
- */
-export type AuditEventType = 'url_fetch' | 'file_access' | 'skill_install' | 'skill_uninstall' | 'security_scan' | 'cache_operation' | 'source_sync' | 'config_change' | 'quarantine_authenticated_review' | 'quarantine_multi_approval' | 'quarantine_multi_approval_complete' | 'quarantine_multi_approval_cancelled' | 'quarantine_multi_approval_timeout' | 'security_feature_flag_override';
-/**
- * Actor performing the action
- */
-export type AuditActor = 'user' | 'system' | 'adapter' | 'scanner' | 'reviewer';
-/**
- * Result of the audited action
- */
-export type AuditResult = 'success' | 'blocked' | 'error' | 'warning';
-/**
- * Database row type for audit logs
- */
-export interface AuditLogRow {
-    id: string;
-    event_type: AuditEventType;
-    timestamp: string;
-    actor: AuditActor;
-    resource: string;
-    action: string;
-    result: AuditResult;
-    metadata: string | null;
-    created_at: string;
-}
-/**
- * Audit log entry structure
- */
-export interface AuditLogEntry {
-    id: string;
-    event_type: AuditEventType;
-    timestamp: string;
-    actor: AuditActor;
-    resource: string;
-    action: string;
-    result: AuditResult;
-    metadata?: Record<string, unknown>;
-    created_at: string;
-}
-/**
- * Query filters for audit log retrieval
- */
-export interface AuditQueryFilter {
-    event_type?: AuditEventType;
-    actor?: AuditActor;
-    resource?: string;
-    result?: AuditResult;
-    since?: Date;
-    until?: Date;
-    limit?: number;
-    offset?: number;
-}
-/**
- * Minimum retention period in days (security requirement)
- */
-export declare const MIN_RETENTION_DAYS = 1;
-/**
- * Maximum retention period in days (storage constraint)
- */
-export declare const MAX_RETENTION_DAYS = 3650;
-/**
- * Configuration options for AuditLogger
- */
-export interface AuditLoggerConfig {
-    /**
-     * Enable automatic cleanup of old logs on initialization
-     * @default false
-     */
-    autoCleanup?: boolean;
-    /**
-     * Number of days to retain logs (used with autoCleanup)
-     * Must be between MIN_RETENTION_DAYS (1) and MAX_RETENTION_DAYS (3650)
-     * @default 90
-     */
-    retentionDays?: number;
-}
-/**
- * Audit statistics
- */
-export interface AuditStats {
-    total_events: number;
-    events_by_type: Record<AuditEventType, number>;
-    events_by_result: Record<AuditResult, number>;
-    blocked_events: number;
-    error_events: number;
-    oldest_event: string | null;
-    newest_event: string | null;
-}
-//# sourceMappingURL=audit-types.d.ts.map

package/dist/security/audit-types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit-types.d.ts","sourceRoot":"","sources":["../../src/security/audit-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,aAAa,GACb,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,iBAAiB,GACjB,aAAa,GACb,eAAe,GAEf,iCAAiC,GACjC,2BAA2B,GAC3B,oCAAoC,GACpC,qCAAqC,GACrC,mCAAmC,GAEnC,gCAAgC,CAAA;AAEpC;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAA;AAE/E;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;AAErE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,cAAc,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,UAAU,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,WAAW,CAAA;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,cAAc,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,UAAU,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,WAAW,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B,KAAK,CAAC,EAAE,UAAU,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,KAAK,CAAC,EAAE,IAAI,CAAA;IACZ,KAAK,CAAC,EAAE,IAAI,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAA;AAEnC;;GAEG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAA;AAEtC;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IAC9C,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IAC7C,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B"}

package/dist/security/audit-types.js

@@ -1,15 +0,0 @@
-/**
- * SMI-733: Audit Logger Types
- *
- * Type definitions for the audit logging system.
- * Extracted from AuditLogger.ts for file size compliance.
- */
-/**
- * Minimum retention period in days (security requirement)
- */
-export const MIN_RETENTION_DAYS = 1;
-/**
- * Maximum retention period in days (storage constraint)
- */
-export const MAX_RETENTION_DAYS = 3650; // 10 years
-//# sourceMappingURL=audit-types.js.map

package/dist/security/audit-types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit-types.js","sourceRoot":"","sources":["../../src/security/audit-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA6EH;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAEnC;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAA,CAAC,WAAW"}

package/dist/security/index.d.ts

@@ -1,23 +0,0 @@
-/**
- * SMI-587: Security module exports
- * SMI-685: Enhanced with severity scoring types
- * SMI-730: Rate limiting with token bucket algorithm
- * SMI-732: Input sanitization functions
- * SMI-733: Audit logging system
- * SMI-898: Path traversal protection for database paths
- * SMI-1189: Split into modular subpackages
- */
-export { SecurityScanner } from './scanner/index.js';
-export type { SecurityFinding, SecurityFindingType, SecuritySeverity, ScanReport, ScannerOptions, RiskScoreBreakdown, } from './scanner/index.js';
-export { sanitizeHtml, sanitizeFileName, sanitizePath, sanitizeUrl, sanitizeText, isValidStripeId, sanitizeStripeCustomerId, sanitizeStripeSubscriptionId, sanitizeStripePriceId, sanitizeStripeInvoiceId, sanitizeStripeEventId, } from './sanitization.js';
-export { validateDbPath, validateDbPathOrThrow, isPathSafe, DEFAULT_ALLOWED_DIRS, } from './pathValidation.js';
-export type { PathValidationOptions, PathValidationResult } from './pathValidation.js';
-export { AuditLogger } from './AuditLogger.js';
-export type { AuditLogEntry, AuditEventType, AuditActor, AuditResult, AuditQueryFilter, AuditStats, } from './AuditLogger.js';
-export { RateLimiter, InMemoryRateLimitStorage, RATE_LIMIT_PRESETS, createRateLimiterFromPreset, RateLimitQueueTimeoutError, RateLimitQueueFullError, } from './rate-limiter/index.js';
-export type { RateLimitConfig, RateLimitResult, RateLimitStorage, RateLimitMetrics, } from './rate-limiter/index.js';
-export { detectRiskTrend } from './risk-trend.js';
-export type { RiskTrendResult } from './risk-trend.js';
-export { SkillSandbox, SandboxUnavailableError, withSandbox } from './SkillSandbox.js';
-export type { SandboxOptions, ExecutionResult, SandboxFile, SandboxStatus } from './SkillSandbox.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,YAAY,EAEZ,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,UAAU,EACV,oBAAoB,GACrB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAGtF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,YAAY,EACV,aAAa,EACb,cAAc,EACd,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,UAAU,GACX,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAGtD,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtF,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/security/index.js

@@ -1,26 +0,0 @@
-/**
- * SMI-587: Security module exports
- * SMI-685: Enhanced with severity scoring types
- * SMI-730: Rate limiting with token bucket algorithm
- * SMI-732: Input sanitization functions
- * SMI-733: Audit logging system
- * SMI-898: Path traversal protection for database paths
- * SMI-1189: Split into modular subpackages
- */
-// Scanner module
-export { SecurityScanner } from './scanner/index.js';
-// Sanitization
-export { sanitizeHtml, sanitizeFileName, sanitizePath, sanitizeUrl, sanitizeText, 
-// SMI-1062: Stripe ID validators
-isValidStripeId, sanitizeStripeCustomerId, sanitizeStripeSubscriptionId, sanitizeStripePriceId, sanitizeStripeInvoiceId, sanitizeStripeEventId, } from './sanitization.js';
-// Path validation
-export { validateDbPath, validateDbPathOrThrow, isPathSafe, DEFAULT_ALLOWED_DIRS, } from './pathValidation.js';
-// Audit logger
-export { AuditLogger } from './AuditLogger.js';
-// Rate limiter module
-export { RateLimiter, InMemoryRateLimitStorage, RATE_LIMIT_PRESETS, createRateLimiterFromPreset, RateLimitQueueTimeoutError, RateLimitQueueFullError, } from './rate-limiter/index.js';
-// SMI-3874: Risk trend detection
-export { detectRiskTrend } from './risk-trend.js';
-// SMI-1534: E2B Sandbox for skill testing
-export { SkillSandbox, SandboxUnavailableError, withSandbox } from './SkillSandbox.js';
-//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iBAAiB;AACjB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAUpD,eAAe;AACf,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,YAAY;AACZ,iCAAiC;AACjC,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,mBAAmB,CAAA;AAE1B,kBAAkB;AAClB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,UAAU,EACV,oBAAoB,GACrB,MAAM,qBAAqB,CAAA;AAG5B,eAAe;AACf,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAU9C,sBAAsB;AACtB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAQhC,iCAAiC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAGjD,0CAA0C;AAC1C,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/security/pathValidation.d.ts

@@ -1,95 +0,0 @@
-/**
- * SMI-898: Path Traversal Protection for Database Paths
- *
- * Provides secure path validation for database and file storage paths.
- * Prevents path traversal attacks by:
- * - Canonicalizing paths with path.resolve() and path.normalize()
- * - Validating that resolved paths stay within allowed directories
- * - Rejecting paths with ".." traversal attempts
- * - Blocking absolute paths outside allowed directories
- */
-/**
- * Configuration for path validation
- */
-export interface PathValidationOptions {
-    /** Allowed base directories for path resolution (default: [~/.skillsmith]) */
-    allowedDirs?: string[];
-    /** Allow in-memory database path ':memory:' (default: true) */
-    allowInMemory?: boolean;
-    /** Allow paths under system temp directory (default: true for testing) */
-    allowTempDir?: boolean;
-    /** Maximum path length (default: 4096) */
-    maxLength?: number;
-}
-/**
- * Result of path validation
- */
-export interface PathValidationResult {
-    /** Whether the path is valid */
-    valid: boolean;
-    /** The sanitized and resolved path (if valid) */
-    resolvedPath?: string;
-    /** Error message (if invalid) */
-    error?: string;
-}
-/**
- * Default allowed directories for database storage
- */
-export declare const DEFAULT_ALLOWED_DIRS: string[];
-/**
- * Validate and sanitize a database path to prevent path traversal attacks.
- *
- * Security measures:
- * 1. Rejects null bytes and control characters
- * 2. Canonicalizes path with resolve() and normalize()
- * 3. Checks for ".." traversal attempts before resolution
- * 4. Validates resolved path is within allowed directories
- * 5. Handles both absolute and relative paths
- *
- * @param inputPath - The raw path to validate
- * @param options - Validation configuration options
- * @returns Validation result with resolved path or error
- *
- * @example
- * ```typescript
- * // Valid paths
- * validateDbPath('/Users/me/.skillsmith/skills.db')
- * // => { valid: true, resolvedPath: '/Users/me/.skillsmith/skills.db' }
- *
- * validateDbPath(':memory:')
- * // => { valid: true, resolvedPath: ':memory:' }
- *
- * // Invalid paths - traversal attack
- * validateDbPath('../../../etc/passwd')
- * // => { valid: false, error: 'Path traversal detected' }
- *
- * validateDbPath('/etc/passwd')
- * // => { valid: false, error: 'Path outside allowed directories' }
- * ```
- */
-export declare function validateDbPath(inputPath: string | undefined, options?: PathValidationOptions): PathValidationResult;
-/**
- * Validate a database path and throw an error if invalid.
- * Convenience wrapper for validateDbPath that throws instead of returning error.
- *
- * @param inputPath - The raw path to validate
- * @param options - Validation configuration options
- * @returns The validated and resolved path
- * @throws Error if path validation fails
- *
- * @example
- * ```typescript
- * const safePath = validateDbPathOrThrow(process.env.DB_PATH);
- * // Either returns valid path or throws
- * ```
- */
-export declare function validateDbPathOrThrow(inputPath: string | undefined, options?: PathValidationOptions): string;
-/**
- * Check if a path is safe for database usage without modifying it.
- * Quick check that doesn't resolve the path.
- *
- * @param inputPath - The path to check
- * @returns True if the path appears safe (no obvious traversal)
- */
-export declare function isPathSafe(inputPath: string): boolean;
-//# sourceMappingURL=pathValidation.d.ts.map

package/dist/security/pathValidation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pathValidation.d.ts","sourceRoot":"","sources":["../../src/security/pathValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,gCAAgC;IAChC,KAAK,EAAE,OAAO,CAAA;IACd,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,UAGhC,CAAA;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAkItB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAMR;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAuBrD"}

package/dist/security/pathValidation.js

@@ -1,216 +0,0 @@
-/**
- * SMI-898: Path Traversal Protection for Database Paths
- *
- * Provides secure path validation for database and file storage paths.
- * Prevents path traversal attacks by:
- * - Canonicalizing paths with path.resolve() and path.normalize()
- * - Validating that resolved paths stay within allowed directories
- * - Rejecting paths with ".." traversal attempts
- * - Blocking absolute paths outside allowed directories
- */
-import { resolve, normalize, dirname, isAbsolute } from 'path';
-import { homedir } from 'os';
-import { createLogger } from '../utils/logger.js';
-const logger = createLogger('PathValidation');
-/**
- * Default allowed directories for database storage
- */
-export const DEFAULT_ALLOWED_DIRS = [
-    resolve(homedir(), '.skillsmith'),
-    resolve(homedir(), '.claude'),
-];
-/**
- * System temp directory for test databases
- */
-const TEMP_DIRS = ['/tmp', '/var/tmp', '/private/tmp', process.env.TMPDIR].filter(Boolean);
-/**
- * Validate and sanitize a database path to prevent path traversal attacks.
- *
- * Security measures:
- * 1. Rejects null bytes and control characters
- * 2. Canonicalizes path with resolve() and normalize()
- * 3. Checks for ".." traversal attempts before resolution
- * 4. Validates resolved path is within allowed directories
- * 5. Handles both absolute and relative paths
- *
- * @param inputPath - The raw path to validate
- * @param options - Validation configuration options
- * @returns Validation result with resolved path or error
- *
- * @example
- * ```typescript
- * // Valid paths
- * validateDbPath('/Users/me/.skillsmith/skills.db')
- * // => { valid: true, resolvedPath: '/Users/me/.skillsmith/skills.db' }
- *
- * validateDbPath(':memory:')
- * // => { valid: true, resolvedPath: ':memory:' }
- *
- * // Invalid paths - traversal attack
- * validateDbPath('../../../etc/passwd')
- * // => { valid: false, error: 'Path traversal detected' }
- *
- * validateDbPath('/etc/passwd')
- * // => { valid: false, error: 'Path outside allowed directories' }
- * ```
- */
-export function validateDbPath(inputPath, options = {}) {
-    const { allowedDirs = DEFAULT_ALLOWED_DIRS, allowInMemory = true, allowTempDir = true, maxLength = 4096, } = options;
-    // Null/undefined check
-    if (!inputPath || typeof inputPath !== 'string') {
-        return { valid: false, error: 'Path is required' };
-    }
-    // Length check
-    if (inputPath.length > maxLength) {
-        logger.warn('Path exceeds maximum length', { length: inputPath.length, maxLength });
-        return { valid: false, error: `Path exceeds maximum length of ${maxLength}` };
-    }
-    // Allow in-memory database
-    if (inputPath === ':memory:') {
-        if (allowInMemory) {
-            return { valid: true, resolvedPath: ':memory:' };
-        }
-        return { valid: false, error: 'In-memory database not allowed' };
-    }
-    // Check for null bytes (path injection)
-    if (inputPath.includes('\0')) {
-        logger.warn('Null byte detected in path', { path: inputPath.substring(0, 50) });
-        return { valid: false, error: 'Invalid characters in path' };
-    }
-    // Check for control characters
-    // eslint-disable-next-line no-control-regex
-    if (/[\x00-\x1f\x7f]/.test(inputPath)) {
-        logger.warn('Control characters detected in path', { path: inputPath.substring(0, 50) });
-        return { valid: false, error: 'Invalid characters in path' };
-    }
-    // Check for obvious traversal attempts before normalization
-    // This catches encoded traversal and various bypass attempts
-    if (inputPath.includes('..')) {
-        // Check if the path segments contain ".."
-        const segments = inputPath.split(/[/\\]/);
-        const hasTraversal = segments.some((seg) => seg === '..' || seg === '...');
-        if (hasTraversal) {
-            logger.warn('Path traversal attempt detected', { path: inputPath.substring(0, 100) });
-            return { valid: false, error: 'Path traversal detected' };
-        }
-    }
-    // Normalize and resolve the path
-    let resolvedPath;
-    try {
-        // Normalize first to handle various path formats
-        const normalized = normalize(inputPath);
-        // If the path is absolute, use it directly
-        // If relative, resolve from home directory's .skillsmith
-        if (isAbsolute(normalized)) {
-            resolvedPath = resolve(normalized);
-        }
-        else {
-            // Relative paths are resolved from the first allowed directory
-            resolvedPath = resolve(allowedDirs[0] || homedir(), normalized);
-        }
-    }
-    catch (error) {
-        logger.warn('Path resolution failed', {
-            path: inputPath.substring(0, 100),
-            error: error instanceof Error ? error.message : 'Unknown error',
-        });
-        return { valid: false, error: 'Invalid path format' };
-    }
-    // After resolution, verify no traversal occurred by checking resolved path
-    // doesn't contain ".." (should be resolved away, but double-check)
-    if (resolvedPath.includes('..')) {
-        logger.warn('Path traversal after resolution', { path: resolvedPath.substring(0, 100) });
-        return { valid: false, error: 'Path traversal detected' };
-    }
-    // Build list of allowed directories including temp dirs if enabled
-    const effectiveAllowedDirs = [...allowedDirs];
-    if (allowTempDir) {
-        effectiveAllowedDirs.push(...TEMP_DIRS);
-    }
-    // Check if resolved path is within any allowed directory
-    const isAllowed = effectiveAllowedDirs.some((allowedDir) => {
-        const resolvedAllowed = resolve(allowedDir);
-        // Path must be exactly the allowed dir or start with allowed dir + separator
-        return (resolvedPath === resolvedAllowed ||
-            resolvedPath.startsWith(resolvedAllowed + '/') ||
-            resolvedPath.startsWith(resolvedAllowed + '\\'));
-    });
-    if (!isAllowed) {
-        logger.warn('Path outside allowed directories', {
-            path: resolvedPath.substring(0, 100),
-            allowedDirs: effectiveAllowedDirs,
-        });
-        return { valid: false, error: 'Path outside allowed directories' };
-    }
-    // Ensure parent directory path is also valid
-    const parentDir = dirname(resolvedPath);
-    const parentAllowed = effectiveAllowedDirs.some((allowedDir) => {
-        const resolvedAllowed = resolve(allowedDir);
-        return (parentDir === resolvedAllowed ||
-            parentDir.startsWith(resolvedAllowed + '/') ||
-            parentDir.startsWith(resolvedAllowed + '\\'));
-    });
-    if (!parentAllowed) {
-        logger.warn('Parent directory outside allowed directories', {
-            parentDir: parentDir.substring(0, 100),
-        });
-        return { valid: false, error: 'Parent directory outside allowed directories' };
-    }
-    logger.debug('Path validated successfully', {
-        input: inputPath.substring(0, 100),
-        resolved: resolvedPath,
-    });
-    return { valid: true, resolvedPath };
-}
-/**
- * Validate a database path and throw an error if invalid.
- * Convenience wrapper for validateDbPath that throws instead of returning error.
- *
- * @param inputPath - The raw path to validate
- * @param options - Validation configuration options
- * @returns The validated and resolved path
- * @throws Error if path validation fails
- *
- * @example
- * ```typescript
- * const safePath = validateDbPathOrThrow(process.env.DB_PATH);
- * // Either returns valid path or throws
- * ```
- */
-export function validateDbPathOrThrow(inputPath, options = {}) {
-    const result = validateDbPath(inputPath, options);
-    if (!result.valid) {
-        throw new Error(`Invalid database path: ${result.error}`);
-    }
-    return result.resolvedPath;
-}
-/**
- * Check if a path is safe for database usage without modifying it.
- * Quick check that doesn't resolve the path.
- *
- * @param inputPath - The path to check
- * @returns True if the path appears safe (no obvious traversal)
- */
-export function isPathSafe(inputPath) {
-    if (!inputPath || typeof inputPath !== 'string') {
-        return false;
-    }
-    // Allow in-memory
-    if (inputPath === ':memory:') {
-        return true;
-    }
-    // Quick checks for obvious attacks
-    if (inputPath.includes('\0'))
-        return false;
-    if (inputPath.includes('..')) {
-        const segments = inputPath.split(/[/\\]/);
-        if (segments.some((seg) => seg === '..' || seg === '...')) {
-            return false;
-        }
-    }
-    // eslint-disable-next-line no-control-regex
-    if (/[\x00-\x1f\x7f]/.test(inputPath))
-        return false;
-    return true;
-}
-//# sourceMappingURL=pathValidation.js.map

package/dist/security/pathValidation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pathValidation.js","sourceRoot":"","sources":["../../src/security/pathValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAA;AA4B7C;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC;IACjC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC;CAC9B,CAAA;AAED;;GAEG;AACH,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAC/E,OAAO,CACI,CAAA;AAEb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA6B,EAC7B,UAAiC,EAAE;IAEnC,MAAM,EACJ,WAAW,GAAG,oBAAoB,EAClC,aAAa,GAAG,IAAI,EACpB,YAAY,GAAG,IAAI,EACnB,SAAS,GAAG,IAAI,GACjB,GAAG,OAAO,CAAA;IAEX,uBAAuB;IACvB,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAA;IACpD,CAAC;IAED,eAAe;IACf,IAAI,SAAS,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QACnF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,SAAS,EAAE,EAAE,CAAA;IAC/E,CAAC;IAED,2BAA2B;IAC3B,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAA;QAClD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAA;IAClE,CAAC;IAED,wCAAwC;IACxC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;QAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAA;IAC9D,CAAC;IAED,+BAA+B;IAC/B,4CAA4C;IAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;QACxF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAA;IAC9D,CAAC;IAED,4DAA4D;IAC5D,6DAA6D;IAC7D,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,CAAA;QAC1E,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YACrF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAA;QAC3D,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,IAAI,YAAoB,CAAA;IACxB,IAAI,CAAC;QACH,iDAAiD;QACjD,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;QAEvC,2CAA2C;QAC3C,yDAAyD;QACzD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;QACpC,CAAC;aAAM,CAAC;YACN,+DAA+D;YAC/D,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,EAAE,UAAU,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACpC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;YACjC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAChE,CAAC,CAAA;QACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAA;IACvD,CAAC;IAED,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QACxF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAA;IAC3D,CAAC;IAED,mEAAmE;IACnE,MAAM,oBAAoB,GAAG,CAAC,GAAG,WAAW,CAAC,CAAA;IAC7C,IAAI,YAAY,EAAE,CAAC;QACjB,oBAAoB,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAA;IACzC,CAAC;IAED,yDAAyD;IACzD,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;QACzD,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;QAC3C,6EAA6E;QAC7E,OAAO,CACL,YAAY,KAAK,eAAe;YAChC,YAAY,CAAC,UAAU,CAAC,eAAe,GAAG,GAAG,CAAC;YAC9C,YAAY,CAAC,UAAU,CAAC,eAAe,GAAG,IAAI,CAAC,CAChD,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAC9C,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;YACpC,WAAW,EAAE,oBAAoB;SAClC,CAAC,CAAA;QACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAA;IACpE,CAAC;IAED,6CAA6C;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACvC,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;QAC7D,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;QAC3C,OAAO,CACL,SAAS,KAAK,eAAe;YAC7B,SAAS,CAAC,UAAU,CAAC,eAAe,GAAG,GAAG,CAAC;YAC3C,SAAS,CAAC,UAAU,CAAC,eAAe,GAAG,IAAI,CAAC,CAC7C,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;YAC1D,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;SACvC,CAAC,CAAA;QACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAA;IAChF,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;QAC1C,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;QAClC,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAA;IAEF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA6B,EAC7B,UAAiC,EAAE;IAEnC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACjD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC,YAAa,CAAA;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kBAAkB;IAClB,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,mCAAmC;IACnC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1C,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IAEnD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/security/rate-limiter/RateLimiter.d.ts

@@ -1,86 +0,0 @@
-/**
- * Rate Limiter - SMI-730, SMI-1013, SMI-1189
- *
- * Token bucket algorithm for rate limiting API endpoints and adapters.
- * Prevents abuse and DoS attacks with configurable limits and windows.
- *
- * Features:
- * - Token bucket algorithm for smooth rate limiting
- * - Per-IP and per-user limits
- * - Configurable limits and windows
- * - In-memory storage (Redis-compatible interface)
- * - Graceful degradation on errors
- * - Request queue for waiting when rate limited (SMI-1013)
- * - Configurable timeout for queued requests (SMI-1013)
- */
-import type { RateLimitConfig, RateLimitMetrics, RateLimitResult, RateLimitStorage, TokenBucket } from './types.js';
-/**
- * Rate Limiter using Token Bucket Algorithm
- *
- * @example
- * ```typescript
- * const limiter = new RateLimiter({
- *   maxTokens: 100,
- *   refillRate: 100 / 60,
- *   windowMs: 60000,
- * })
- *
- * const result = await limiter.checkLimit('user:123')
- * if (result.allowed) {
- *   // Process request
- * } else {
- *   // Return 429 Too Many Requests
- * }
- * ```
- */
-export declare class RateLimiter {
-    private readonly config;
-    private readonly storage;
-    private readonly metricsManager;
-    private readonly queueManager;
-    constructor(config: RateLimitConfig, storage?: RateLimitStorage);
-    /**
-     * Try to consume a token without queuing (internal method)
-     */
-    private tryConsumeToken;
-    /**
-     * Check if a request is allowed under rate limit
-     */
-    checkLimit(key: string, cost?: number): Promise<RateLimitResult>;
-    /**
-     * Wait for a token to become available (SMI-1013)
-     */
-    waitForToken(key: string, cost?: number): Promise<RateLimitResult>;
-    /**
-     * Get queue status for a key (SMI-1013)
-     */
-    getQueueStatus(key?: string): {
-        totalQueued: number;
-        queues: Map<string, number>;
-    } | number;
-    /**
-     * Clear queue for a key (SMI-1013)
-     */
-    clearQueue(key?: string): void;
-    /**
-     * Reset rate limit for a key
-     */
-    reset(key: string): Promise<void>;
-    /**
-     * Get current state for a key
-     */
-    getState(key: string): Promise<TokenBucket | null>;
-    /**
-     * Get metrics for a specific key or all keys
-     */
-    getMetrics(key?: string): Map<string, RateLimitMetrics> | RateLimitMetrics | undefined;
-    /**
-     * Reset metrics for a specific key or all keys
-     */
-    resetMetrics(key?: string): void;
-    /**
-     * Dispose of resources
-     */
-    dispose(): void;
-}
-//# sourceMappingURL=RateLimiter.d.ts.map

package/dist/security/rate-limiter/RateLimiter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"RateLimiter.d.ts","sourceRoot":"","sources":["../../../src/security/rate-limiter/RateLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACZ,MAAM,YAAY,CAAA;AAYnB;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAWtB;IACD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;gBAE/B,MAAM,EAAE,eAAe,EAAE,OAAO,GAAE,gBAAiD;IA6C/F;;OAEG;YACW,eAAe;IAI7B;;OAEG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAI,GAAG,OAAO,CAAC,eAAe,CAAC;IAsGjE;;OAEG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAI,GAAG,OAAO,CAAC,eAAe,CAAC;IA0BnE;;OAEG;IACH,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,MAAM;IAI3F;;OAEG;IACH,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI;IAO9B;;OAEG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvC;;OAEG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAIxD;;OAEG;IACH,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,gBAAgB,GAAG,SAAS;IAOtF;;OAEG;IACH,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI;IAWhC;;OAEG;IACH,OAAO,IAAI,IAAI;CAOhB"}