@skillsmith/core 0.5.6 → 0.5.7

package/dist/utils/version-check.test.js

@@ -1,113 +0,0 @@
-/**
- * Tests for version-check utility
- * @see SMI-1952: Add auto-update check to MCP server startup
- */
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { checkForUpdates, formatUpdateNotification, } from './version-check.js';
-describe('version-check', () => {
-    const originalFetch = global.fetch;
-    beforeEach(() => {
-        vi.useFakeTimers();
-    });
-    afterEach(() => {
-        global.fetch = originalFetch;
-        vi.useRealTimers();
-    });
-    describe('checkForUpdates', () => {
-        it('returns update available when newer version exists', async () => {
-            global.fetch = vi.fn().mockResolvedValue({
-                ok: true,
-                json: () => Promise.resolve({ version: '1.2.0' }),
-            });
-            const result = await checkForUpdates('@skillsmith/mcp-server', '1.0.0');
-            expect(result).toEqual({
-                currentVersion: '1.0.0',
-                latestVersion: '1.2.0',
-                updateAvailable: true,
-                updateCommand: 'npx @skillsmith/mcp-server@latest',
-            });
-            expect(fetch).toHaveBeenCalledWith('https://registry.npmjs.org/@skillsmith/mcp-server/latest', expect.objectContaining({
-                headers: { Accept: 'application/json' },
-            }));
-        });
-        it('returns no update when version is current', async () => {
-            global.fetch = vi.fn().mockResolvedValue({
-                ok: true,
-                json: () => Promise.resolve({ version: '1.0.0' }),
-            });
-            const result = await checkForUpdates('@skillsmith/mcp-server', '1.0.0');
-            expect(result).toEqual({
-                currentVersion: '1.0.0',
-                latestVersion: '1.0.0',
-                updateAvailable: false,
-                updateCommand: 'npx @skillsmith/mcp-server@latest',
-            });
-        });
-        it('returns null on HTTP error', async () => {
-            global.fetch = vi.fn().mockResolvedValue({
-                ok: false,
-                status: 404,
-            });
-            const result = await checkForUpdates('nonexistent-package', '1.0.0');
-            expect(result).toBeNull();
-        });
-        it('returns null on network error', async () => {
-            global.fetch = vi.fn().mockRejectedValue(new Error('Network error'));
-            const result = await checkForUpdates('@skillsmith/mcp-server', '1.0.0');
-            expect(result).toBeNull();
-        });
-        it('returns null on invalid JSON response', async () => {
-            global.fetch = vi.fn().mockResolvedValue({
-                ok: true,
-                json: () => Promise.reject(new Error('Invalid JSON')),
-            });
-            const result = await checkForUpdates('@skillsmith/mcp-server', '1.0.0');
-            expect(result).toBeNull();
-        });
-        it('returns null when version field is missing', async () => {
-            global.fetch = vi.fn().mockResolvedValue({
-                ok: true,
-                json: () => Promise.resolve({ name: 'package', description: 'test' }),
-            });
-            const result = await checkForUpdates('@skillsmith/mcp-server', '1.0.0');
-            expect(result).toBeNull();
-        });
-        it('uses 3 second timeout via AbortSignal', async () => {
-            // Mock fetch to extract the signal
-            let capturedSignal;
-            global.fetch = vi.fn().mockImplementation((_url, options) => {
-                capturedSignal = options?.signal;
-                return Promise.resolve({
-                    ok: true,
-                    json: () => Promise.resolve({ version: '1.0.0' }),
-                });
-            });
-            await checkForUpdates('@skillsmith/mcp-server', '1.0.0');
-            // Verify AbortSignal was passed (we can't easily test the exact timeout value)
-            expect(capturedSignal).toBeDefined();
-        });
-        it('handles timeout gracefully', async () => {
-            global.fetch = vi.fn().mockImplementation(() => {
-                const error = new Error('The operation was aborted');
-                error.name = 'AbortError';
-                return Promise.reject(error);
-            });
-            const result = await checkForUpdates('@skillsmith/mcp-server', '1.0.0');
-            expect(result).toBeNull();
-        });
-    });
-    describe('formatUpdateNotification', () => {
-        it('formats notification message correctly', () => {
-            const result = {
-                currentVersion: '0.3.0',
-                latestVersion: '0.4.0',
-                updateAvailable: true,
-                updateCommand: 'npx @skillsmith/mcp-server@latest',
-            };
-            const message = formatUpdateNotification(result);
-            expect(message).toBe('[skillsmith] Update available: 0.3.0 → 0.4.0\n' +
-                'Restart Claude Code to use the latest version.');
-        });
-    });
-});
-//# sourceMappingURL=version-check.test.js.map

package/dist/utils/version-check.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"version-check.test.js","sourceRoot":"","sources":["../../src/utils/version-check.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACxE,OAAO,EACL,eAAe,EACf,wBAAwB,GAEzB,MAAM,oBAAoB,CAAA;AAE3B,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAA;IAElC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,KAAK,GAAG,aAAa,CAAA;QAC5B,EAAE,CAAC,aAAa,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACvC,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;aAClD,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YAEvE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACrB,cAAc,EAAE,OAAO;gBACvB,aAAa,EAAE,OAAO;gBACtB,eAAe,EAAE,IAAI;gBACrB,aAAa,EAAE,mCAAmC;aACnD,CAAC,CAAA;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAChC,0DAA0D,EAC1D,MAAM,CAAC,gBAAgB,CAAC;gBACtB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CACH,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACvC,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;aAClD,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YAEvE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACrB,cAAc,EAAE,OAAO;gBACvB,aAAa,EAAE,OAAO;gBACtB,eAAe,EAAE,KAAK;gBACtB,aAAa,EAAE,mCAAmC;aACnD,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACvC,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAA;YAEpE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAA;YAEpE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YAEvE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACvC,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;aACtD,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YAEvE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACvC,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;aACtE,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YAEvE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,mCAAmC;YACnC,IAAI,cAAuC,CAAA;YAC3C,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;gBAC1D,cAAc,GAAG,OAAO,EAAE,MAAM,CAAA;gBAChC,OAAO,OAAO,CAAC,OAAO,CAAC;oBACrB,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;iBAClD,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YAEF,MAAM,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YAExD,+EAA+E;YAC/E,MAAM,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE;gBAC7C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;gBACpD,KAAK,CAAC,IAAI,GAAG,YAAY,CAAA;gBACzB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC9B,CAAC,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YAEvE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC3B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACxC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,MAAM,GAAuB;gBACjC,cAAc,EAAE,OAAO;gBACvB,aAAa,EAAE,OAAO;gBACtB,eAAe,EAAE,IAAI;gBACrB,aAAa,EAAE,mCAAmC;aACnD,CAAA;YAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAA;YAEhD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAClB,gDAAgD;gBAC9C,gDAAgD,CACnD,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/validation/index.d.ts

@@ -1,18 +0,0 @@
-/**
- * Validation Utilities (SMI-726)
- *
- * Centralized validation patterns for security-critical operations.
- * Extracted from RawUrlSourceAdapter and LocalFilesystemAdapter.
- *
- * Security Features:
- * - SSRF prevention (SMI-721, SMI-729)
- * - Path traversal prevention (SMI-720)
- * - RegExp injection prevention (SMI-722)
- *
- * @module validation
- */
-export { ValidationError } from './validation-error.js';
-export { validateUrl, validateIPv6, getIpRangeName } from './url-validators.js';
-export { validatePath } from './path-validators.js';
-export { sanitizeInput, safePatternMatch, validatePatterns } from './input-validators.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/validation/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/validation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAGvD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAG/E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAGnD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA"}

package/dist/validation/index.js

@@ -1,22 +0,0 @@
-/**
- * Validation Utilities (SMI-726)
- *
- * Centralized validation patterns for security-critical operations.
- * Extracted from RawUrlSourceAdapter and LocalFilesystemAdapter.
- *
- * Security Features:
- * - SSRF prevention (SMI-721, SMI-729)
- * - Path traversal prevention (SMI-720)
- * - RegExp injection prevention (SMI-722)
- *
- * @module validation
- */
-// Validation Error
-export { ValidationError } from './validation-error.js';
-// URL Validators (SSRF prevention)
-export { validateUrl, validateIPv6, getIpRangeName } from './url-validators.js';
-// Path Validators (Path traversal prevention)
-export { validatePath } from './path-validators.js';
-// Input Validators (General sanitization)
-export { sanitizeInput, safePatternMatch, validatePatterns } from './input-validators.js';
-//# sourceMappingURL=index.js.map

package/dist/validation/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/validation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,mCAAmC;AACnC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAE/E,8CAA8C;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,0CAA0C;AAC1C,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA"}

package/dist/validation/input-validators.d.ts

@@ -1,68 +0,0 @@
-/**
- * Input Validation Utilities
- *
- * General input sanitization and pattern matching.
- *
- * Security Features:
- * - RegExp injection prevention (SMI-722)
- * - Input sanitization
- * - Pattern validation
- */
-/**
- * Sanitize input string for safe use in various contexts
- *
- * Removes or escapes potentially dangerous characters.
- *
- * @param input - Input string to sanitize
- * @param options - Sanitization options
- * @returns Sanitized string
- *
- * @example
- * ```typescript
- * sanitizeInput('<script>alert(1)</script>')  // Returns: '&lt;script&gt;alert(1)&lt;/script&gt;'
- * sanitizeInput('../../etc/passwd')           // Returns: 'etc/passwd'
- * ```
- */
-export declare function sanitizeInput(input: string, options?: {
-    /** Remove path traversal sequences like '../' (default: true) */
-    removePathTraversal?: boolean;
-    /** HTML-escape special characters (default: true) */
-    escapeHtml?: boolean;
-    /** Remove null bytes (default: true) */
-    removeNullBytes?: boolean;
-}): string;
-/**
- * Safely test a string against a pattern, preventing RegExp injection (SMI-722)
- *
- * Tries exact match, prefix match, and regex match (with error handling).
- * Falls back to includes check if regex is invalid.
- *
- * @param value - Value to test
- * @param pattern - Pattern to match (string or regex)
- * @returns True if value matches pattern
- *
- * @example
- * ```typescript
- * safePatternMatch('node_modules', 'node_modules')  // true (exact)
- * safePatternMatch('node_modules/pkg', 'node_')     // true (prefix)
- * safePatternMatch('test.js', '\\.js$')             // true (regex)
- * safePatternMatch('test.js', '(evil')              // false (invalid regex, falls back)
- * ```
- */
-export declare function safePatternMatch(value: string, pattern: string): boolean;
-/**
- * Validate that patterns array is safe to use
- *
- * Checks for potentially dangerous regex patterns that could cause ReDoS.
- *
- * @param patterns - Array of patterns to validate
- * @returns Array of validation warnings (empty if all patterns are safe)
- *
- * @example
- * ```typescript
- * validatePatterns(['node_modules', '\\.js$'])  // []
- * validatePatterns(['(a+)+b'])                  // ['Pattern may cause ReDoS: (a+)+b']
- * ```
- */
-export declare function validatePatterns(patterns: string[]): string[];
-//# sourceMappingURL=input-validators.d.ts.map

package/dist/validation/input-validators.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"input-validators.d.ts","sourceRoot":"","sources":["../../src/validation/input-validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IACP,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,qDAAqD;IACrD,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,wCAAwC;IACxC,eAAe,CAAC,EAAE,OAAO,CAAA;CACrB,GACL,MAAM,CAqCR;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAuBxE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAyB7D"}

package/dist/validation/input-validators.js

@@ -1,133 +0,0 @@
-/**
- * Input Validation Utilities
- *
- * General input sanitization and pattern matching.
- *
- * Security Features:
- * - RegExp injection prevention (SMI-722)
- * - Input sanitization
- * - Pattern validation
- */
-/**
- * Sanitize input string for safe use in various contexts
- *
- * Removes or escapes potentially dangerous characters.
- *
- * @param input - Input string to sanitize
- * @param options - Sanitization options
- * @returns Sanitized string
- *
- * @example
- * ```typescript
- * sanitizeInput('<script>alert(1)</script>')  // Returns: '&lt;script&gt;alert(1)&lt;/script&gt;'
- * sanitizeInput('../../etc/passwd')           // Returns: 'etc/passwd'
- * ```
- */
-export function sanitizeInput(input, options = {}) {
-    const { removePathTraversal = true, escapeHtml = true, removeNullBytes = true } = options;
-    let sanitized = input;
-    // Remove null bytes (security risk)
-    if (removeNullBytes) {
-        sanitized = sanitized.replace(/\0/g, '');
-    }
-    // Remove path traversal sequences
-    // SMI-2262: Loop-based sanitization to prevent bypass with nested patterns
-    // e.g., '..././' becomes '../' after single-pass removal
-    if (removePathTraversal) {
-        let previousPass = '';
-        const maxIterations = 10; // Prevent infinite loops on malformed input
-        for (let i = 0; i < maxIterations && previousPass !== sanitized; i++) {
-            previousPass = sanitized;
-            // Remove '../' and '..\' patterns
-            sanitized = sanitized.replace(/\.\.[\\/]/g, '');
-            // Remove leading '../' or '..\'
-            sanitized = sanitized.replace(/^\.\.[\\/]+/, '');
-        }
-    }
-    // HTML escape
-    if (escapeHtml) {
-        sanitized = sanitized
-            .replace(/&/g, '&amp;')
-            .replace(/</g, '&lt;')
-            .replace(/>/g, '&gt;')
-            .replace(/"/g, '&quot;')
-            .replace(/'/g, '&#x27;');
-    }
-    return sanitized;
-}
-/**
- * Safely test a string against a pattern, preventing RegExp injection (SMI-722)
- *
- * Tries exact match, prefix match, and regex match (with error handling).
- * Falls back to includes check if regex is invalid.
- *
- * @param value - Value to test
- * @param pattern - Pattern to match (string or regex)
- * @returns True if value matches pattern
- *
- * @example
- * ```typescript
- * safePatternMatch('node_modules', 'node_modules')  // true (exact)
- * safePatternMatch('node_modules/pkg', 'node_')     // true (prefix)
- * safePatternMatch('test.js', '\\.js$')             // true (regex)
- * safePatternMatch('test.js', '(evil')              // false (invalid regex, falls back)
- * ```
- */
-export function safePatternMatch(value, pattern) {
-    // Exact match
-    if (value === pattern) {
-        return true;
-    }
-    // Check if pattern looks like a regex (contains special chars)
-    // If it's a simple alphanumeric pattern, only do prefix matching
-    const isLikelyRegex = /[\\^$.*+?()[\]{}|]/.test(pattern);
-    if (!isLikelyRegex) {
-        // Simple pattern - only match as prefix
-        return value.startsWith(pattern);
-    }
-    // Try regex match with error handling for patterns that look like regex
-    try {
-        const regex = new RegExp(pattern);
-        return regex.test(value);
-    }
-    catch {
-        // Invalid regex - fall back to safe includes check
-        return value.includes(pattern);
-    }
-}
-/**
- * Validate that patterns array is safe to use
- *
- * Checks for potentially dangerous regex patterns that could cause ReDoS.
- *
- * @param patterns - Array of patterns to validate
- * @returns Array of validation warnings (empty if all patterns are safe)
- *
- * @example
- * ```typescript
- * validatePatterns(['node_modules', '\\.js$'])  // []
- * validatePatterns(['(a+)+b'])                  // ['Pattern may cause ReDoS: (a+)+b']
- * ```
- */
-export function validatePatterns(patterns) {
-    const warnings = [];
-    for (const pattern of patterns) {
-        // Check for potentially dangerous nested quantifiers (ReDoS)
-        if (/(\(.*\+.*\))\+/.test(pattern) || /(\(.*\*.*\))\*/.test(pattern)) {
-            warnings.push(`Pattern may cause ReDoS (nested quantifiers): ${pattern}`);
-        }
-        // Check for extremely long patterns
-        if (pattern.length > 1000) {
-            warnings.push(`Pattern is suspiciously long (${pattern.length} chars): ${pattern.slice(0, 50)}...`);
-        }
-        // Try to compile as regex to check validity
-        try {
-            new RegExp(pattern);
-        }
-        catch {
-            warnings.push(`Invalid regex pattern: ${pattern}`);
-        }
-    }
-    return warnings;
-}
-//# sourceMappingURL=input-validators.js.map

package/dist/validation/input-validators.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"input-validators.js","sourceRoot":"","sources":["../../src/validation/input-validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,UAOI,EAAE;IAEN,MAAM,EAAE,mBAAmB,GAAG,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,eAAe,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IAEzF,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,oCAAoC;IACpC,IAAI,eAAe,EAAE,CAAC;QACpB,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC1C,CAAC;IAED,kCAAkC;IAClC,2EAA2E;IAC3E,yDAAyD;IACzD,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,YAAY,GAAG,EAAE,CAAA;QACrB,MAAM,aAAa,GAAG,EAAE,CAAA,CAAC,4CAA4C;QAErE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACrE,YAAY,GAAG,SAAS,CAAA;YACxB,kCAAkC;YAClC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;YAC/C,gCAAgC;YAChC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IAED,cAAc;IACd,IAAI,UAAU,EAAE,CAAC;QACf,SAAS,GAAG,SAAS;aAClB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;aACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;aACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC5B,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAAe;IAC7D,cAAc;IACd,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+DAA+D;IAC/D,iEAAiE;IACjE,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAExD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,wCAAwC;QACxC,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;QACjC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAkB;IACjD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,6DAA6D;QAC7D,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,QAAQ,CAAC,IAAI,CAAC,iDAAiD,OAAO,EAAE,CAAC,CAAA;QAC3E,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CACX,iCAAiC,OAAO,CAAC,MAAM,YAAY,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CACrF,CAAA;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/validation/path-validators.d.ts

@@ -1,23 +0,0 @@
-/**
- * Path Validation Utilities (SMI-720)
- *
- * Path traversal prevention validators.
- */
-/**
- * Validate file path to prevent path traversal attacks (SMI-720)
- *
- * Ensures the resolved path remains within the allowed root directory.
- *
- * @param path - Path to validate (can be relative or absolute)
- * @param rootDir - Root directory that must contain the path
- * @throws {ValidationError} if path escapes root directory
- *
- * @example
- * ```typescript
- * validatePath('skills/my-skill', '/home/user/.claude')  // OK
- * validatePath('../etc/passwd', '/home/user/.claude')    // Throws ValidationError
- * validatePath('/etc/passwd', '/home/user/.claude')      // Throws ValidationError
- * ```
- */
-export declare function validatePath(path: string, rootDir: string): void;
-//# sourceMappingURL=path-validators.d.ts.map

package/dist/validation/path-validators.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"path-validators.d.ts","sourceRoot":"","sources":["../../src/validation/path-validators.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CA2BhE"}

package/dist/validation/path-validators.js

@@ -1,47 +0,0 @@
-/**
- * Path Validation Utilities (SMI-720)
- *
- * Path traversal prevention validators.
- */
-import { resolve } from 'path';
-import { ValidationError } from './validation-error.js';
-/**
- * Validate file path to prevent path traversal attacks (SMI-720)
- *
- * Ensures the resolved path remains within the allowed root directory.
- *
- * @param path - Path to validate (can be relative or absolute)
- * @param rootDir - Root directory that must contain the path
- * @throws {ValidationError} if path escapes root directory
- *
- * @example
- * ```typescript
- * validatePath('skills/my-skill', '/home/user/.claude')  // OK
- * validatePath('../etc/passwd', '/home/user/.claude')    // Throws ValidationError
- * validatePath('/etc/passwd', '/home/user/.claude')      // Throws ValidationError
- * ```
- */
-export function validatePath(path, rootDir) {
-    if (!path) {
-        throw new ValidationError('Path cannot be empty', 'EMPTY_PATH');
-    }
-    if (!rootDir) {
-        throw new ValidationError('Root directory cannot be empty', 'EMPTY_ROOT_DIR');
-    }
-    // Normalize both paths to resolve '..' and '.'
-    // Resolve path relative to rootDir so relative paths work correctly
-    const normalizedPath = resolve(rootDir, path);
-    const normalizedRoot = resolve(rootDir);
-    // Check that normalized path is within root directory
-    // Handle edge case where path equals root exactly
-    const isWithinRoot = normalizedPath.startsWith(normalizedRoot + '/') || normalizedPath === normalizedRoot;
-    if (!isWithinRoot) {
-        throw new ValidationError(`Path traversal detected: ${path}`, 'PATH_TRAVERSAL', {
-            originalPath: path,
-            normalizedPath,
-            rootDir,
-            normalizedRoot,
-        });
-    }
-}
-//# sourceMappingURL=path-validators.js.map

package/dist/validation/path-validators.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"path-validators.js","sourceRoot":"","sources":["../../src/validation/path-validators.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,eAAe,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,gBAAgB,CAAC,CAAA;IAC/E,CAAC;IAED,+CAA+C;IAC/C,oEAAoE;IACpE,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC7C,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEvC,sDAAsD;IACtD,kDAAkD;IAClD,MAAM,YAAY,GAChB,cAAc,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,IAAI,cAAc,KAAK,cAAc,CAAA;IAEtF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,eAAe,CAAC,4BAA4B,IAAI,EAAE,EAAE,gBAAgB,EAAE;YAC9E,YAAY,EAAE,IAAI;YAClB,cAAc;YACd,OAAO;YACP,cAAc;SACf,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/dist/validation/url-validators.d.ts

@@ -1,55 +0,0 @@
-/**
- * URL Validation Utilities (SMI-721, SMI-729)
- *
- * SSRF prevention validators for URL access.
- *
- * Security Features:
- * - Protocol validation (http/https only)
- * - Private IPv4 range blocking
- * - Private IPv6 range blocking
- * - Localhost and loopback blocking
- */
-/**
- * Get human-readable IP range name for error messages
- */
-export declare function getIpRangeName(a: number, b: number): string;
-/**
- * Validate IPv6 address to prevent SSRF attacks (SMI-729)
- *
- * Blocks:
- * - Link-local: fe80::/10
- * - Unique local addresses (ULA): fc00::/7
- * - Multicast: ff00::/8
- * - IPv4-mapped IPv6: ::ffff:0:0/96
- * - Loopback ::1 (already blocked above)
- *
- * @param hostname - IPv6 hostname to validate
- * @param url - Full URL for error context
- * @throws {ValidationError} if IPv6 address is not allowed
- */
-export declare function validateIPv6(hostname: string, url: string): void;
-/**
- * Validate URL to prevent SSRF attacks (SMI-721, SMI-729)
- *
- * Blocks:
- * - Non-http(s) protocols
- * - Private IPv4 ranges (10.x, 172.16-31.x, 192.168.x)
- * - Private IPv6 ranges (fe80::/10, fc00::/7, ff00::/8, ::ffff:0:0/96)
- * - Localhost variants (127.x, localhost, ::1, 0.0.0.0)
- * - Link-local addresses (169.254.x, fe80::/10)
- * - Current network (0.x)
- *
- * @param url - URL to validate
- * @throws {ValidationError} if URL is not allowed
- *
- * @example
- * ```typescript
- * validateUrl('https://example.com/api')  // OK
- * validateUrl('http://localhost:3000')    // Throws ValidationError
- * validateUrl('ftp://example.com')        // Throws ValidationError
- * validateUrl('http://192.168.1.1')       // Throws ValidationError
- * validateUrl('http://[fe80::1]')         // Throws ValidationError (IPv6 link-local)
- * ```
- */
-export declare function validateUrl(url: string): void;
-//# sourceMappingURL=url-validators.d.ts.map

package/dist/validation/url-validators.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"url-validators.d.ts","sourceRoot":"","sources":["../../src/validation/url-validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ3D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAgNhE;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAoE7C"}