@skillsmith/core 0.5.6 → 0.5.7

package/dist/security/sanitization.js

@@ -1,388 +0,0 @@
-/**
- * SMI-732: Input Sanitization Library
- * SMI-750: Added input length limits to prevent ReDoS attacks
- *
- * Provides comprehensive input sanitization functions for:
- * - HTML content (XSS prevention)
- * - File names (path traversal prevention)
- * - File paths (directory traversal prevention)
- * - URLs (injection prevention)
- *
- * All functions are defensive and return safe defaults on invalid input.
- * All functions accept maxLength parameter to prevent ReDoS attacks.
- */
-import { createLogger } from '../utils/logger.js';
-// Re-export Stripe validators for backwards compatibility
-export { isValidStripeId, sanitizeStripeCustomerId, sanitizeStripeSubscriptionId, sanitizeStripePriceId, sanitizeStripeInvoiceId, sanitizeStripeEventId, } from './stripe-validators.js';
-const logger = createLogger('Sanitization');
-/** Default maximum input length for sanitization functions to prevent ReDoS */
-export const DEFAULT_MAX_LENGTH = 100000;
-/**
- * Sanitize HTML content to prevent XSS attacks
- *
- * Removes dangerous tags, attributes, and JavaScript while preserving safe HTML.
- * Uses a whitelist approach for maximum security.
- *
- * @param input - Raw HTML string
- * @param maxLength - Maximum allowed input length (default: 100000)
- * @returns Sanitized HTML safe for rendering
- *
- * @example
- * ```typescript
- * sanitizeHtml('<script>alert("XSS")</script><p>Hello</p>')
- * // Returns: '<p>Hello</p>'
- * ```
- */
-export function sanitizeHtml(input, maxLength = DEFAULT_MAX_LENGTH) {
-    if (!input || typeof input !== 'string') {
-        return '';
-    }
-    if (input.length > maxLength) {
-        logger.warn('Input exceeds max length for sanitization', {
-            length: input.length,
-            maxLength,
-            function: 'sanitizeHtml',
-        });
-        return '';
-    }
-    // SMI-2261: Loop-based sanitization to prevent bypass with nested payloads
-    // e.g., <scr<script>ipt> becomes <script> after single-pass removal
-    let sanitized = input;
-    let previousPass = '';
-    const maxIterations = 10; // Prevent infinite loops on malformed input
-    for (let i = 0; i < maxIterations && previousPass !== sanitized; i++) {
-        previousPass = sanitized;
-        // Remove script tags and their content
-        sanitized = sanitized.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
-        // Remove event handlers (onclick, onerror, etc.)
-        sanitized = sanitized.replace(/\son\w+\s*=\s*["'][^"']*["']/gi, '');
-        sanitized = sanitized.replace(/\son\w+\s*=\s*[^\s>]*/gi, '');
-        // Remove javascript: protocol
-        sanitized = sanitized.replace(/javascript:/gi, '');
-        // Remove data: protocol (can be used for XSS)
-        sanitized = sanitized.replace(/data:text\/html/gi, '');
-        // Remove vbscript: protocol
-        sanitized = sanitized.replace(/vbscript:/gi, '');
-        // Remove object and embed tags
-        sanitized = sanitized.replace(/<(object|embed|iframe|frame|frameset)[^>]*>/gi, '');
-        // Remove style tags (can contain javascript)
-        sanitized = sanitized.replace(/<style\b[^<]*(?:(?!<\/style>)<[^<]*)*<\/style>/gi, '');
-        // Remove import statements in style attributes
-        sanitized = sanitized.replace(/style\s*=\s*["'][^"']*@import[^"']*["']/gi, '');
-    }
-    // Log if significant sanitization occurred
-    if (sanitized !== input) {
-        logger.debug('HTML sanitized', {
-            originalLength: input.length,
-            sanitizedLength: sanitized.length,
-        });
-    }
-    return sanitized;
-}
-/**
- * Sanitize file name to prevent path traversal and invalid characters
- *
- * Removes:
- * - Path separators (/, \)
- * - Parent directory references (..)
- * - Hidden file markers (leading .)
- * - Special characters that are invalid in file names
- * - Control characters
- *
- * @param name - Raw file name
- * @param maxLength - Maximum allowed input length (default: 100000)
- * @returns Safe file name or empty string if invalid
- *
- * @example
- * ```typescript
- * sanitizeFileName('../../../etc/passwd')
- * // Returns: 'etcpasswd'
- *
- * sanitizeFileName('my-file.txt')
- * // Returns: 'my-file.txt'
- * ```
- */
-export function sanitizeFileName(name, maxLength = DEFAULT_MAX_LENGTH) {
-    if (!name || typeof name !== 'string') {
-        return '';
-    }
-    if (name.length > maxLength) {
-        logger.warn('Input exceeds max length for sanitization', {
-            length: name.length,
-            maxLength,
-            function: 'sanitizeFileName',
-        });
-        return '';
-    }
-    let sanitized = name;
-    // Remove path separators
-    sanitized = sanitized.replace(/[/\\]/g, '');
-    // Remove leading dots (hidden files)
-    sanitized = sanitized.replace(/^\.+/, '');
-    // Remove control characters (0x00-0x1f, 0x7f)
-    // eslint-disable-next-line no-control-regex -- Intentional security check
-    sanitized = sanitized.replace(/[\x00-\x1f\x7f]/g, '');
-    // Remove special characters that are invalid in file names
-    // Keep: alphanumeric, hyphen, underscore, dot, space
-    sanitized = sanitized.replace(/[^a-zA-Z0-9._\-\s]/g, '');
-    // Collapse multiple consecutive dots to single dot (BEFORE parent dir check)
-    // This handles cases like 'file....txt' -> 'file.txt'
-    sanitized = sanitized.replace(/\.{2,}/g, '.');
-    // Remove multiple consecutive spaces
-    sanitized = sanitized.replace(/\s{2,}/g, ' ');
-    // Trim whitespace
-    sanitized = sanitized.trim();
-    // Ensure it's not empty and not too long
-    if (sanitized.length === 0 || sanitized.length > 255) {
-        logger.warn('Invalid file name after sanitization', { original: name });
-        return '';
-    }
-    // Reserved file names on Windows
-    const reservedNames = [
-        'CON',
-        'PRN',
-        'AUX',
-        'NUL',
-        'COM1',
-        'COM2',
-        'COM3',
-        'COM4',
-        'COM5',
-        'COM6',
-        'COM7',
-        'COM8',
-        'COM9',
-        'LPT1',
-        'LPT2',
-        'LPT3',
-        'LPT4',
-        'LPT5',
-        'LPT6',
-        'LPT7',
-        'LPT8',
-        'LPT9',
-    ];
-    const baseName = sanitized.split('.')[0].toUpperCase();
-    if (reservedNames.includes(baseName)) {
-        logger.warn('Reserved file name detected', { name: sanitized });
-        return `${sanitized}_safe`;
-    }
-    if (sanitized !== name) {
-        logger.debug('File name sanitized', { original: name, sanitized });
-    }
-    return sanitized;
-}
-/**
- * Sanitize file path to prevent directory traversal attacks
- *
- * Ensures the path:
- * - Does not escape the root directory
- * - Contains no parent directory references
- * - Uses forward slashes consistently
- * - Is normalized
- *
- * @param path - Raw file path
- * @param rootDir - Root directory to constrain path to (optional)
- * @param maxLength - Maximum allowed input length (default: 100000)
- * @returns Safe path or empty string if invalid
- *
- * @example
- * ```typescript
- * sanitizePath('../../../etc/passwd', '/app/data')
- * // Returns: ''
- *
- * sanitizePath('user/files/doc.txt', '/app/data')
- * // Returns: 'user/files/doc.txt'
- * ```
- */
-export function sanitizePath(path, rootDir, maxLength = DEFAULT_MAX_LENGTH) {
-    if (!path || typeof path !== 'string') {
-        return '';
-    }
-    if (path.length > maxLength) {
-        logger.warn('Input exceeds max length for sanitization', {
-            length: path.length,
-            maxLength,
-            function: 'sanitizePath',
-        });
-        return '';
-    }
-    let sanitized = path;
-    // Normalize path separators to forward slashes
-    sanitized = sanitized.replace(/\\/g, '/');
-    // Remove leading slashes for relative path handling
-    const isAbsolute = sanitized.startsWith('/');
-    sanitized = sanitized.replace(/^\/+/, '');
-    // Check for leading parent directory references - reject these paths entirely
-    // This catches '../../../etc/passwd' and './../file' type attacks
-    if (/^\.?\/?\.\./.test(sanitized)) {
-        logger.warn('Path traversal attempt detected', { path });
-        return '';
-    }
-    // Split into segments and process them
-    // Track depth and traversal count to detect escape attempts
-    // '..' segments are filtered out (security measure), but if there are more
-    // '..' than valid segments, we stop processing (escape attempt)
-    const rawSegments = sanitized.split('/');
-    const segments = [];
-    let depth = 0;
-    let traversalCount = 0;
-    for (const segment of rawSegments) {
-        // Remove empty segments and '.'
-        if (!segment || segment === '.')
-            continue;
-        // Handle parent directory references
-        if (segment === '..') {
-            traversalCount++;
-            if (traversalCount > depth) {
-                // Would escape - stop processing and return what we have
-                logger.warn('Path traversal attempt detected', { path, segment });
-                break;
-            }
-            // Just filter out '..' (don't resolve it, just remove it for security)
-            continue;
-        }
-        // Block segments with control characters
-        // eslint-disable-next-line no-control-regex -- Intentional security check
-        if (/[\x00-\x1f\x7f]/.test(segment)) {
-            logger.warn('Control characters in path segment', { path, segment });
-            continue;
-        }
-        // Sanitize and add segment
-        const sanitizedSegment = sanitizeFileName(segment);
-        if (sanitizedSegment.length > 0) {
-            segments.push(sanitizedSegment);
-            depth++;
-        }
-    }
-    // Rebuild path
-    sanitized = segments.join('/');
-    // Restore leading slash if original was absolute
-    if (isAbsolute && sanitized.length > 0) {
-        sanitized = '/' + sanitized;
-    }
-    // If rootDir is provided, ensure path doesn't escape it
-    if (rootDir && sanitized.length > 0) {
-        const normalizedRoot = rootDir.replace(/\\/g, '/').replace(/\/+$/, '');
-        const fullPath = isAbsolute ? sanitized : `${normalizedRoot}/${sanitized}`;
-        if (!fullPath.startsWith(normalizedRoot + '/') && fullPath !== normalizedRoot) {
-            logger.warn('Path escapes root directory', {
-                path,
-                rootDir,
-                fullPath,
-            });
-            return '';
-        }
-    }
-    if (sanitized !== path) {
-        logger.debug('Path sanitized', { original: path, sanitized });
-    }
-    return sanitized;
-}
-/**
- * Sanitize URL to prevent injection attacks
- *
- * Validates:
- * - Protocol is http or https
- * - No javascript:, data:, or vbscript: protocols
- * - No embedded credentials
- * - Valid URL structure
- *
- * @param url - Raw URL string
- * @param maxLength - Maximum allowed input length (default: 100000)
- * @returns Sanitized URL or empty string if invalid
- *
- * @example
- * ```typescript
- * sanitizeUrl('javascript:alert(1)')
- * // Returns: ''
- *
- * sanitizeUrl('https://example.com/page')
- * // Returns: 'https://example.com/page'
- * ```
- */
-export function sanitizeUrl(url, maxLength = DEFAULT_MAX_LENGTH) {
-    if (!url || typeof url !== 'string') {
-        return '';
-    }
-    if (url.length > maxLength) {
-        logger.warn('Input exceeds max length for sanitization', {
-            length: url.length,
-            maxLength,
-            function: 'sanitizeUrl',
-        });
-        return '';
-    }
-    // Trim whitespace and control characters
-    // eslint-disable-next-line no-control-regex -- Intentional security check
-    const trimmed = url.trim().replace(/[\x00-\x1f\x7f]/g, '');
-    if (trimmed.length === 0) {
-        return '';
-    }
-    try {
-        const parsed = new URL(trimmed);
-        // Only allow http and https protocols
-        if (!['http:', 'https:'].includes(parsed.protocol)) {
-            logger.warn('Invalid URL protocol', { url: trimmed, protocol: parsed.protocol });
-            return '';
-        }
-        // Block URLs with embedded credentials
-        if (parsed.username || parsed.password) {
-            logger.warn('URL contains embedded credentials', { url: trimmed });
-            return '';
-        }
-        // Reconstruct URL to ensure it's properly formatted
-        const sanitized = parsed.toString();
-        if (sanitized !== url) {
-            logger.debug('URL sanitized', { original: url, sanitized });
-        }
-        return sanitized;
-    }
-    catch (error) {
-        logger.warn('Invalid URL format', { url: trimmed, error });
-        return '';
-    }
-}
-/**
- * Sanitize arbitrary text input for safe storage and display
- *
- * Removes:
- * - Control characters
- * - Zero-width characters
- * - Invalid Unicode
- *
- * @param input - Raw text input
- * @param maxLength - Maximum allowed input length (default: 100000)
- * @returns Sanitized text
- *
- * @example
- * ```typescript
- * sanitizeText('Hello\x00World\u200B')
- * // Returns: 'HelloWorld'
- * ```
- */
-export function sanitizeText(input, maxLength = DEFAULT_MAX_LENGTH) {
-    if (!input || typeof input !== 'string') {
-        return '';
-    }
-    if (input.length > maxLength) {
-        logger.warn('Input exceeds max length for sanitization', {
-            length: input.length,
-            maxLength,
-            function: 'sanitizeText',
-        });
-        return '';
-    }
-    let sanitized = input;
-    // Remove control characters except newline and tab
-    // eslint-disable-next-line no-control-regex -- Intentional security check
-    sanitized = sanitized.replace(/[\x00-\x08\x0b-\x0c\x0e-\x1f\x7f]/g, '');
-    // Remove zero-width characters
-    sanitized = sanitized.replace(/[\u200b-\u200d\ufeff]/g, '');
-    // Normalize Unicode
-    sanitized = sanitized.normalize('NFC');
-    // Trim
-    sanitized = sanitized.trim();
-    return sanitized;
-}
-//# sourceMappingURL=sanitization.js.map

package/dist/security/sanitization.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitization.js","sourceRoot":"","sources":["../../src/security/sanitization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,0DAA0D;AAC1D,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAE/B,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,CAAA;AAE3C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAExC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,SAAS,GAAG,kBAAkB;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;YACvD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS;YACT,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAA;QACF,OAAO,EAAE,CAAA;IACX,CAAC;IAED,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,IAAI,YAAY,GAAG,EAAE,CAAA;IACrB,MAAM,aAAa,GAAG,EAAE,CAAA,CAAC,4CAA4C;IAErE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACrE,YAAY,GAAG,SAAS,CAAA;QAExB,uCAAuC;QACvC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,qDAAqD,EAAE,EAAE,CAAC,CAAA;QAExF,iDAAiD;QACjD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,gCAAgC,EAAE,EAAE,CAAC,CAAA;QACnE,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAA;QAE5D,8BAA8B;QAC9B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;QAElD,8CAA8C;QAC9C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAA;QAEtD,4BAA4B;QAC5B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;QAEhD,+BAA+B;QAC/B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAA;QAElF,6CAA6C;QAC7C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,kDAAkD,EAAE,EAAE,CAAC,CAAA;QAErF,+CAA+C;QAC/C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,2CAA2C,EAAE,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,2CAA2C;IAC3C,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC7B,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,eAAe,EAAE,SAAS,CAAC,MAAM;SAClC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,SAAS,GAAG,kBAAkB;IAC3E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS;YACT,QAAQ,EAAE,kBAAkB;SAC7B,CAAC,CAAA;QACF,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,SAAS,GAAG,IAAI,CAAA;IAEpB,yBAAyB;IACzB,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IAE3C,qCAAqC;IACrC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAEzC,8CAA8C;IAC9C,0EAA0E;IAC1E,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAA;IAErD,2DAA2D;IAC3D,qDAAqD;IACrD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAA;IAExD,6EAA6E;IAC7E,sDAAsD;IACtD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAE7C,qCAAqC;IACrC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAE7C,kBAAkB;IAClB,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;IAE5B,yCAAyC;IACzC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QACvE,OAAO,EAAE,CAAA;IACX,CAAC;IAED,iCAAiC;IACjC,MAAM,aAAa,GAAG;QACpB,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;QACN,MAAM;KACP,CAAA;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IACtD,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/D,OAAO,GAAG,SAAS,OAAO,CAAA;IAC5B,CAAC;IAED,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,OAAgB,EAChB,SAAS,GAAG,kBAAkB;IAE9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS;YACT,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAA;QACF,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,SAAS,GAAG,IAAI,CAAA;IAEpB,+CAA+C;IAC/C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAEzC,oDAAoD;IACpD,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IAC5C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAEzC,8EAA8E;IAC9E,kEAAkE;IAClE,IAAI,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,OAAO,EAAE,CAAA;IACX,CAAC;IAED,uCAAuC;IACvC,4DAA4D;IAC5D,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,cAAc,GAAG,CAAC,CAAA;IAEtB,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;YAAE,SAAQ;QAEzC,qCAAqC;QACrC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,cAAc,EAAE,CAAA;YAChB,IAAI,cAAc,GAAG,KAAK,EAAE,CAAC;gBAC3B,yDAAyD;gBACzD,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;gBACjE,MAAK;YACP,CAAC;YACD,uEAAuE;YACvE,SAAQ;QACV,CAAC;QAED,yCAAyC;QACzC,0EAA0E;QAC1E,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;YACpE,SAAQ;QACV,CAAC;QAED,2BAA2B;QAC3B,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAClD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;YAC/B,KAAK,EAAE,CAAA;QACT,CAAC;IACH,CAAC;IAED,eAAe;IACf,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAE9B,iDAAiD;IACjD,IAAI,UAAU,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,SAAS,GAAG,GAAG,GAAG,SAAS,CAAA;IAC7B,CAAC;IAED,wDAAwD;IACxD,IAAI,OAAO,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACtE,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,SAAS,EAAE,CAAA;QAE1E,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAC9E,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBACzC,IAAI;gBACJ,OAAO;gBACP,QAAQ;aACT,CAAC,CAAA;YACF,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAED,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,SAAS,GAAG,kBAAkB;IACrE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;YACvD,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS;YACT,QAAQ,EAAE,aAAa;SACxB,CAAC,CAAA;QACF,OAAO,EAAE,CAAA;IACX,CAAC;IAED,yCAAyC;IACzC,0EAA0E;IAC1E,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAA;IAE1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;QAE/B,sCAAsC;QACtC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;YAChF,OAAO,EAAE,CAAA;QACX,CAAC;QAED,uCAAuC;QACvC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAClE,OAAO,EAAE,CAAA;QACX,CAAC;QAED,oDAAoD;QACpD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAEnC,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAA;QAC7D,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1D,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,SAAS,GAAG,kBAAkB;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;YACvD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS;YACT,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAA;QACF,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,mDAAmD;IACnD,0EAA0E;IAC1E,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAA;IAEvE,+BAA+B;IAC/B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAA;IAE3D,oBAAoB;IACpB,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAEtC,OAAO;IACP,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;IAE5B,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/security/scanner/SecurityScanner.d.ts

@@ -1,45 +0,0 @@
-/**
- * Security Scanner - SMI-587, SMI-685, SMI-882, SMI-1189
- *
- * Security scanning for skill content with advanced pattern detection.
- */
-import type { ScanReport, ScannerOptions } from './types.js';
-import type { LineContext } from './SecurityScanner.helpers.js';
-import { isMultilinePattern, analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, calculateRiskScore } from './SecurityScanner.helpers.js';
-import { scanSsrfPatterns } from './SecurityScanner.ssrf.js';
-import { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary } from './SecurityScanner.formatters.js';
-export { LineContext, isMultilinePattern, analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, calculateRiskScore, };
-export { scanSsrfPatterns };
-export { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary };
-export declare class SecurityScanner {
-    private allowedDomains;
-    private blockedPatterns;
-    private maxContentLength;
-    private riskThreshold;
-    constructor(options?: ScannerOptions);
-    private extractUrls;
-    private isAllowedDomain;
-    private scanUrls;
-    private scanSensitivePaths;
-    private scanJailbreakPatterns;
-    private scanSuspiciousPatterns;
-    private scanSocialEngineering;
-    private scanPromptLeaking;
-    private scanDataExfiltration;
-    private scanPrivilegeEscalation;
-    /** SMI-3864: Detect PII patterns. Email in YAML frontmatter gets low severity. */
-    private scanPiiPatterns;
-    private scanAIDefenceVulnerabilities;
-    /** @deprecated Use standalone calculateRiskScore function for new code */
-    calculateRiskScore: typeof calculateRiskScore;
-    scan(skillId: string, content: string): ScanReport;
-    quickCheck(content: string): boolean;
-    addAllowedDomain(domain: string): void;
-    addBlockedPattern(pattern: RegExp): void;
-    static toMinimalRefs: typeof toMinimalRefs;
-    static toSARIF: typeof toSARIF;
-    static toGitHubAnnotations: typeof toGitHubAnnotations;
-    static toSummary: typeof toSummary;
-}
-export default SecurityScanner;
-//# sourceMappingURL=SecurityScanner.d.ts.map

package/dist/security/scanner/SecurityScanner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SecurityScanner.d.ts","sourceRoot":"","sources":["../../../src/security/scanner/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAmB,UAAU,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAA;AAgBhG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAEnB,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAG5D,OAAO,EACL,aAAa,EACb,OAAO,EACP,mBAAmB,EACnB,SAAS,EACV,MAAM,iCAAiC,CAAA;AAGxC,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,CAAA;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAA;AAEjE,qBAAa,eAAe;IAC1B,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,eAAe,CAAU;IACjC,OAAO,CAAC,gBAAgB,CAAQ;IAChC,OAAO,CAAC,aAAa,CAAQ;gBAEjB,OAAO,GAAE,cAAmB;IAOxC,OAAO,CAAC,WAAW;IAenB,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,QAAQ;IAmBhB,OAAO,CAAC,kBAAkB;IAiC1B,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,sBAAsB;IAqC9B,OAAO,CAAC,qBAAqB;IAkC7B,OAAO,CAAC,iBAAiB;IAkCzB,OAAO,CAAC,oBAAoB;IAkC5B,OAAO,CAAC,uBAAuB;IAqC/B,kFAAkF;IAClF,OAAO,CAAC,eAAe;IAiDvB,OAAO,CAAC,4BAA4B;IAgBpC,0EAA0E;IAC1E,kBAAkB,4BAAqB;IAEvC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU;IA2ClD,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAOpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAItC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAKxC,MAAM,CAAC,aAAa,uBAAgB;IACpC,MAAM,CAAC,OAAO,iBAAU;IACxB,MAAM,CAAC,mBAAmB,6BAAsB;IAChD,MAAM,CAAC,SAAS,mBAAY;CAC7B;AAED,eAAe,eAAe,CAAA"}

package/dist/security/scanner/SecurityScanner.formatters.d.ts

@@ -1,49 +0,0 @@
-/**
- * Security Scanner Output Formatters
- * @module @skillsmith/core/security/scanner/SecurityScanner.formatters
- */
-import type { ScanReport } from './types.js';
-/**
- * SMI-1454: Generate minimal refs output for CI/CD integration
- * Outputs findings in a compact, machine-readable format suitable for:
- * - GitHub Actions annotations
- * - IDE problem matchers
- * - CI pipeline integration
- *
- * @param report - The scan report to format
- * @returns Array of minimal ref strings in format "file:line:severity:message"
- */
-export declare function toMinimalRefs(report: ScanReport): string[];
-/**
- * SMI-1454: Generate SARIF (Static Analysis Results Interchange Format) output
- * For integration with GitHub Code Scanning and other SARIF consumers
- *
- * @param report - The scan report to format
- * @returns SARIF v2.1.0 compliant output object
- */
-export declare function toSARIF(report: ScanReport): object;
-/**
- * SMI-1454: Generate GitHub Actions annotations format
- * Outputs findings as GitHub Actions workflow commands for inline annotations
- *
- * @param report - The scan report to format
- * @returns Array of GitHub Actions annotation strings
- */
-export declare function toGitHubAnnotations(report: ScanReport): string[];
-/**
- * SMI-1454: Generate summary statistics
- * Returns a compact summary object for dashboards and reports
- *
- * @param report - The scan report to summarize
- * @returns Summary object with counts by severity and type
- */
-export declare function toSummary(report: ScanReport): {
-    skillId: string;
-    passed: boolean;
-    riskScore: number;
-    totalFindings: number;
-    bySeverity: Record<string, number>;
-    byType: Record<string, number>;
-    scanDurationMs: number;
-};
-//# sourceMappingURL=SecurityScanner.formatters.d.ts.map

package/dist/security/scanner/SecurityScanner.formatters.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SecurityScanner.formatters.d.ts","sourceRoot":"","sources":["../../../src/security/scanner/SecurityScanner.formatters.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAM5C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAQ1D;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAmElD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAQhE;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG;IAC7C,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;CACvB,CAkBA"}

package/dist/security/scanner/SecurityScanner.formatters.js

@@ -1,139 +0,0 @@
-/**
- * Security Scanner Output Formatters
- * @module @skillsmith/core/security/scanner/SecurityScanner.formatters
- */
-// ============================================================================
-// Output Formatters
-// ============================================================================
-/**
- * SMI-1454: Generate minimal refs output for CI/CD integration
- * Outputs findings in a compact, machine-readable format suitable for:
- * - GitHub Actions annotations
- * - IDE problem matchers
- * - CI pipeline integration
- *
- * @param report - The scan report to format
- * @returns Array of minimal ref strings in format "file:line:severity:message"
- */
-export function toMinimalRefs(report) {
-    return report.findings.map((finding) => {
-        const line = finding.lineNumber ?? 0;
-        const severity = finding.severity.toUpperCase();
-        const message = finding.message.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
-        // Format: skill_id:line:severity:type:message
-        return `${report.skillId}:${line}:${severity}:${finding.type}:${message}`;
-    });
-}
-/**
- * SMI-1454: Generate SARIF (Static Analysis Results Interchange Format) output
- * For integration with GitHub Code Scanning and other SARIF consumers
- *
- * @param report - The scan report to format
- * @returns SARIF v2.1.0 compliant output object
- */
-export function toSARIF(report) {
-    const rules = [
-        { id: 'jailbreak', name: 'Jailbreak Attempt', severity: 'error' },
-        { id: 'social_engineering', name: 'Social Engineering', severity: 'warning' },
-        { id: 'prompt_leaking', name: 'Prompt Leaking', severity: 'error' },
-        { id: 'data_exfiltration', name: 'Data Exfiltration', severity: 'warning' },
-        { id: 'privilege_escalation', name: 'Privilege Escalation', severity: 'error' },
-        { id: 'suspicious_pattern', name: 'Suspicious Pattern', severity: 'warning' },
-        { id: 'sensitive_path', name: 'Sensitive Path', severity: 'warning' },
-        { id: 'url', name: 'External URL', severity: 'note' },
-        { id: 'ai_defence', name: 'AI Injection', severity: 'error' },
-    ];
-    const severityToLevel = {
-        critical: 'error',
-        high: 'error',
-        medium: 'warning',
-        low: 'note',
-    };
-    return {
-        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
-        version: '2.1.0',
-        runs: [
-            {
-                tool: {
-                    driver: {
-                        name: 'Skillsmith Security Scanner',
-                        version: '1.0.0',
-                        informationUri: 'https://github.com/smith-horn/skillsmith',
-                        rules: rules.map((rule) => ({
-                            id: rule.id,
-                            name: rule.name,
-                            shortDescription: { text: rule.name },
-                            defaultConfiguration: { level: rule.severity },
-                        })),
-                    },
-                },
-                results: report.findings.map((finding) => ({
-                    ruleId: finding.type,
-                    level: severityToLevel[finding.severity] ?? 'warning',
-                    message: { text: finding.message },
-                    locations: [
-                        {
-                            physicalLocation: {
-                                artifactLocation: { uri: report.skillId },
-                                region: {
-                                    startLine: finding.lineNumber ?? 1,
-                                    snippet: finding.location ? { text: finding.location } : undefined,
-                                },
-                            },
-                        },
-                    ],
-                    properties: {
-                        confidence: finding.confidence ?? 'high',
-                        inDocumentationContext: finding.inDocumentationContext ?? false,
-                    },
-                })),
-                invocations: [
-                    {
-                        executionSuccessful: true,
-                        endTimeUtc: report.scannedAt.toISOString(),
-                    },
-                ],
-            },
-        ],
-    };
-}
-/**
- * SMI-1454: Generate GitHub Actions annotations format
- * Outputs findings as GitHub Actions workflow commands for inline annotations
- *
- * @param report - The scan report to format
- * @returns Array of GitHub Actions annotation strings
- */
-export function toGitHubAnnotations(report) {
-    return report.findings.map((finding) => {
-        const severity = finding.severity === 'critical' || finding.severity === 'high' ? 'error' : 'warning';
-        const line = finding.lineNumber ?? 1;
-        const message = finding.message.replace(/%/g, '%25').replace(/\r/g, '%0D').replace(/\n/g, '%0A');
-        return `::${severity} file=${report.skillId},line=${line}::${message}`;
-    });
-}
-/**
- * SMI-1454: Generate summary statistics
- * Returns a compact summary object for dashboards and reports
- *
- * @param report - The scan report to summarize
- * @returns Summary object with counts by severity and type
- */
-export function toSummary(report) {
-    const bySeverity = { critical: 0, high: 0, medium: 0, low: 0 };
-    const byType = {};
-    for (const finding of report.findings) {
-        bySeverity[finding.severity] = (bySeverity[finding.severity] || 0) + 1;
-        byType[finding.type] = (byType[finding.type] || 0) + 1;
-    }
-    return {
-        skillId: report.skillId,
-        passed: report.passed,
-        riskScore: report.riskScore,
-        totalFindings: report.findings.length,
-        bySeverity,
-        byType,
-        scanDurationMs: report.scanDurationMs,
-    };
-}
-//# sourceMappingURL=SecurityScanner.formatters.js.map

package/dist/security/scanner/SecurityScanner.formatters.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"SecurityScanner.formatters.js","sourceRoot":"","sources":["../../../src/security/scanner/SecurityScanner.formatters.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,MAAkB;IAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,CAAA;QACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC3E,8CAA8C;QAC9C,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAA;IAC3E,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,MAAkB;IACxC,MAAM,KAAK,GAAG;QACZ,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE;QACjE,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC7E,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE;QACnE,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC3E,EAAE,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,OAAO,EAAE;QAC/E,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC7E,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE;QACrE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE;QACrD,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE;KAC9D,CAAA;IAED,MAAM,eAAe,GAA2B;QAC9C,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,SAAS;QACjB,GAAG,EAAE,MAAM;KACZ,CAAA;IAED,OAAO;QACL,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,6BAA6B;wBACnC,OAAO,EAAE,OAAO;wBAChB,cAAc,EAAE,0CAA0C;wBAC1D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;4BAC1B,EAAE,EAAE,IAAI,CAAC,EAAE;4BACX,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;4BACrC,oBAAoB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;yBAC/C,CAAC,CAAC;qBACJ;iBACF;gBACD,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACzC,MAAM,EAAE,OAAO,CAAC,IAAI;oBACpB,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,SAAS;oBACrD,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;oBAClC,SAAS,EAAE;wBACT;4BACE,gBAAgB,EAAE;gCAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE;gCACzC,MAAM,EAAE;oCACN,SAAS,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC;oCAClC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;iCACnE;6BACF;yBACF;qBACF;oBACD,UAAU,EAAE;wBACV,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,MAAM;wBACxC,sBAAsB,EAAE,OAAO,CAAC,sBAAsB,IAAI,KAAK;qBAChE;iBACF,CAAC,CAAC;gBACH,WAAW,EAAE;oBACX;wBACE,mBAAmB,EAAE,IAAI;wBACzB,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;qBAC3C;iBACF;aACF;SACF;KACF,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAkB;IACpD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACrC,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;QACtF,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAChG,OAAO,KAAK,QAAQ,SAAS,MAAM,CAAC,OAAO,SAAS,IAAI,KAAK,OAAO,EAAE,CAAA;IACxE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,MAAkB;IAS1C,MAAM,UAAU,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAA;IACtF,MAAM,MAAM,GAA2B,EAAE,CAAA;IAEzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QACtE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IACxD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QACrC,UAAU;QACV,MAAM;QACN,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAA;AACH,CAAC"}