@skillsmith/mcp-server 0.3.3 → 0.3.5

package/dist/src/tools/validate.helpers.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Validate Tool Helper Functions
+ * @module @skillsmith/mcp-server/tools/validate.helpers
+ */
+import type { ValidationError } from './validate.types.js';
+/**
+ * Parse YAML frontmatter from markdown content
+ */
+export declare function parseYamlFrontmatter(content: string): Record<string, unknown> | null;
+/**
+ * Check for SSRF patterns in a URL
+ */
+export declare function hasSsrfPattern(url: string): boolean;
+/**
+ * Check for path traversal patterns
+ */
+export declare function hasPathTraversal(path: string): boolean;
+/**
+ * Validate skill metadata
+ */
+export declare function validateMetadata(metadata: Record<string, unknown>, strict: boolean): ValidationError[];
+//# sourceMappingURL=validate.helpers.d.ts.map

package/dist/src/tools/validate.helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.helpers.d.ts","sourceRoot":"","sources":["../../../src/tools/validate.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAG1D;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAqFpF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,MAAM,EAAE,OAAO,GACd,eAAe,EAAE,CA4KnB"}

package/dist/src/tools/validate.helpers.js

@@ -0,0 +1,276 @@
+/**
+ * Validate Tool Helper Functions
+ * @module @skillsmith/mcp-server/tools/validate.helpers
+ */
+import { FIELD_LIMITS, SSRF_PATTERNS, PATH_TRAVERSAL_PATTERNS } from './validate.types.js';
+/**
+ * Parse YAML frontmatter from markdown content
+ */
+export function parseYamlFrontmatter(content) {
+    const trimmed = content.trim();
+    if (!trimmed.startsWith('---')) {
+        return null;
+    }
+    const endIndex = trimmed.indexOf('---', 3);
+    if (endIndex === -1) {
+        return null;
+    }
+    const yamlContent = trimmed.slice(3, endIndex).trim();
+    const result = {};
+    const lines = yamlContent.split('\n');
+    let currentKey = null;
+    let arrayBuffer = [];
+    let inArray = false;
+    for (const line of lines) {
+        const trimmedLine = line.trim();
+        if (!trimmedLine || trimmedLine.startsWith('#')) {
+            continue;
+        }
+        if (trimmedLine.startsWith('- ')) {
+            if (currentKey && inArray) {
+                const value = trimmedLine
+                    .slice(2)
+                    .trim()
+                    .replace(/^["']|["']$/g, '');
+                arrayBuffer.push(value);
+            }
+            continue;
+        }
+        const colonIndex = trimmedLine.indexOf(':');
+        if (colonIndex > 0) {
+            if (currentKey && inArray && arrayBuffer.length > 0) {
+                result[currentKey] = arrayBuffer;
+                arrayBuffer = [];
+            }
+            const key = trimmedLine.slice(0, colonIndex).trim();
+            const value = trimmedLine.slice(colonIndex + 1).trim();
+            if (value === '' || value === '|' || value === '>') {
+                currentKey = key;
+                inArray = true;
+                arrayBuffer = [];
+            }
+            else {
+                currentKey = null;
+                inArray = false;
+                let parsedValue = value;
+                if ((value.startsWith('"') && value.endsWith('"')) ||
+                    (value.startsWith("'") && value.endsWith("'"))) {
+                    parsedValue = value.slice(1, -1);
+                }
+                else if (value === 'true') {
+                    parsedValue = true;
+                }
+                else if (value === 'false') {
+                    parsedValue = false;
+                }
+                else if (/^-?\d+(\.\d+)?$/.test(value)) {
+                    parsedValue = parseFloat(value);
+                }
+                else if (value.startsWith('[') && value.endsWith(']')) {
+                    parsedValue = value
+                        .slice(1, -1)
+                        .split(',')
+                        .map((item) => item.trim().replace(/^["']|["']$/g, ''))
+                        .filter((item) => item.length > 0);
+                }
+                result[key] = parsedValue;
+            }
+        }
+    }
+    if (currentKey && inArray && arrayBuffer.length > 0) {
+        result[currentKey] = arrayBuffer;
+    }
+    return result;
+}
+/**
+ * Check for SSRF patterns in a URL
+ */
+export function hasSsrfPattern(url) {
+    return SSRF_PATTERNS.some((pattern) => pattern.test(url));
+}
+/**
+ * Check for path traversal patterns
+ */
+export function hasPathTraversal(path) {
+    return PATH_TRAVERSAL_PATTERNS.some((pattern) => pattern.test(path));
+}
+/**
+ * Validate skill metadata
+ */
+export function validateMetadata(metadata, strict) {
+    const errors = [];
+    // Required fields - name
+    if (!metadata.name) {
+        errors.push({
+            field: 'name',
+            message: 'Required field "name" is missing',
+            severity: 'error',
+        });
+    }
+    else if (typeof metadata.name !== 'string') {
+        errors.push({
+            field: 'name',
+            message: 'Field "name" must be a string',
+            severity: 'error',
+        });
+    }
+    else if (metadata.name.length > FIELD_LIMITS.name) {
+        errors.push({
+            field: 'name',
+            message: `Field "name" exceeds maximum length of ${FIELD_LIMITS.name} characters`,
+            severity: 'error',
+        });
+    }
+    // Description validation
+    if (!metadata.description) {
+        errors.push({
+            field: 'description',
+            message: 'Required field "description" is missing',
+            severity: strict ? 'error' : 'warning',
+        });
+    }
+    else if (typeof metadata.description !== 'string') {
+        errors.push({
+            field: 'description',
+            message: 'Field "description" must be a string',
+            severity: 'error',
+        });
+    }
+    else if (metadata.description.length > FIELD_LIMITS.description) {
+        errors.push({
+            field: 'description',
+            message: `Field "description" exceeds maximum length of ${FIELD_LIMITS.description} characters`,
+            severity: 'error',
+        });
+    }
+    // Author validation
+    if (metadata.author !== undefined) {
+        if (typeof metadata.author !== 'string') {
+            errors.push({
+                field: 'author',
+                message: 'Field "author" must be a string',
+                severity: 'error',
+            });
+        }
+        else if (metadata.author.length > FIELD_LIMITS.author) {
+            errors.push({
+                field: 'author',
+                message: `Field "author" exceeds maximum length of ${FIELD_LIMITS.author} characters`,
+                severity: 'error',
+            });
+        }
+    }
+    // Version validation
+    if (metadata.version !== undefined) {
+        if (typeof metadata.version !== 'string') {
+            errors.push({
+                field: 'version',
+                message: 'Field "version" must be a string',
+                severity: 'error',
+            });
+        }
+        else if (metadata.version.length > FIELD_LIMITS.version) {
+            errors.push({
+                field: 'version',
+                message: `Field "version" exceeds maximum length of ${FIELD_LIMITS.version} characters`,
+                severity: 'error',
+            });
+        }
+    }
+    else if (strict) {
+        errors.push({
+            field: 'version',
+            message: 'Field "version" is recommended',
+            severity: 'warning',
+        });
+    }
+    // Tags validation
+    if (metadata.tags !== undefined) {
+        if (!Array.isArray(metadata.tags)) {
+            errors.push({
+                field: 'tags',
+                message: 'Field "tags" must be an array',
+                severity: 'error',
+            });
+        }
+        else {
+            if (metadata.tags.length > FIELD_LIMITS.maxTags) {
+                errors.push({
+                    field: 'tags',
+                    message: `Field "tags" exceeds maximum count of ${FIELD_LIMITS.maxTags}`,
+                    severity: 'error',
+                });
+            }
+            for (let i = 0; i < metadata.tags.length; i++) {
+                const tag = metadata.tags[i];
+                if (typeof tag !== 'string') {
+                    errors.push({
+                        field: `tags[${i}]`,
+                        message: 'Tag must be a string',
+                        severity: 'error',
+                    });
+                }
+                else if (tag.length > FIELD_LIMITS.tagLength) {
+                    errors.push({
+                        field: `tags[${i}]`,
+                        message: `Tag exceeds maximum length of ${FIELD_LIMITS.tagLength} characters`,
+                        severity: 'error',
+                    });
+                }
+            }
+        }
+    }
+    else if (strict) {
+        errors.push({
+            field: 'tags',
+            message: 'Field "tags" is recommended for discoverability',
+            severity: 'warning',
+        });
+    }
+    // Security: Check repository URL for SSRF
+    if (metadata.repository !== undefined) {
+        if (typeof metadata.repository !== 'string') {
+            errors.push({
+                field: 'repository',
+                message: 'Field "repository" must be a string',
+                severity: 'error',
+            });
+        }
+        else if (hasSsrfPattern(metadata.repository)) {
+            errors.push({
+                field: 'repository',
+                message: 'Field "repository" contains potentially dangerous URL pattern',
+                severity: 'error',
+            });
+        }
+    }
+    // Security: Check homepage URL for SSRF
+    if (metadata.homepage !== undefined) {
+        if (typeof metadata.homepage !== 'string') {
+            errors.push({
+                field: 'homepage',
+                message: 'Field "homepage" must be a string',
+                severity: 'error',
+            });
+        }
+        else if (hasSsrfPattern(metadata.homepage)) {
+            errors.push({
+                field: 'homepage',
+                message: 'Field "homepage" contains potentially dangerous URL pattern',
+                severity: 'error',
+            });
+        }
+    }
+    // Security: Check for path traversal in any string fields
+    for (const [key, value] of Object.entries(metadata)) {
+        if (typeof value === 'string' && hasPathTraversal(value)) {
+            errors.push({
+                field: key,
+                message: `Field "${key}" contains path traversal pattern`,
+                severity: 'error',
+            });
+        }
+    }
+    return errors;
+}
+//# sourceMappingURL=validate.helpers.js.map

package/dist/src/tools/validate.helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.helpers.js","sourceRoot":"","sources":["../../../src/tools/validate.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAE1F;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;IAE9B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAC1C,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAA;IACrD,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACrC,IAAI,UAAU,GAAkB,IAAI,CAAA;IACpC,IAAI,WAAW,GAAa,EAAE,CAAA;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAA;IAEnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAE/B,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,SAAQ;QACV,CAAC;QAED,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,WAAW;qBACtB,KAAK,CAAC,CAAC,CAAC;qBACR,IAAI,EAAE;qBACN,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;gBAC9B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACzB,CAAC;YACD,SAAQ;QACV,CAAC;QAED,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,UAAU,IAAI,OAAO,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,UAAU,CAAC,GAAG,WAAW,CAAA;gBAChC,WAAW,GAAG,EAAE,CAAA;YAClB,CAAC;YAED,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;YACnD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAEtD,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBACnD,UAAU,GAAG,GAAG,CAAA;gBAChB,OAAO,GAAG,IAAI,CAAA;gBACd,WAAW,GAAG,EAAE,CAAA;YAClB,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,IAAI,CAAA;gBACjB,OAAO,GAAG,KAAK,CAAA;gBAEf,IAAI,WAAW,GAAY,KAAK,CAAA;gBAChC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;oBACD,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAClC,CAAC;qBAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;oBAC5B,WAAW,GAAG,IAAI,CAAA;gBACpB,CAAC;qBAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;oBAC7B,WAAW,GAAG,KAAK,CAAA;gBACrB,CAAC;qBAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzC,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;gBACjC,CAAC;qBAAM,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxD,WAAW,GAAG,KAAK;yBAChB,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;yBACZ,KAAK,CAAC,GAAG,CAAC;yBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;yBACtD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;gBACtC,CAAC;gBAED,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAA;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,IAAI,OAAO,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,UAAU,CAAC,GAAG,WAAW,CAAA;IAClC,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACtE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAiC,EACjC,MAAe;IAEf,MAAM,MAAM,GAAsB,EAAE,CAAA;IAEpC,yBAAyB;IACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,kCAAkC;YAC3C,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,+BAA+B;YACxC,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,0CAA0C,YAAY,CAAC,IAAI,aAAa;YACjF,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAA;IACJ,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,yCAAyC;YAClD,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SACvC,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,sCAAsC;YAC/C,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,iDAAiD,YAAY,CAAC,WAAW,aAAa;YAC/F,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAA;IACJ,CAAC;IAED,oBAAoB;IACpB,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,iCAAiC;gBAC1C,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,4CAA4C,YAAY,CAAC,MAAM,aAAa;gBACrF,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,kCAAkC;gBAC3C,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,6CAA6C,YAAY,CAAC,OAAO,aAAa;gBACvF,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,gCAAgC;YACzC,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAA;IACJ,CAAC;IAED,kBAAkB;IAClB,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,+BAA+B;gBACxC,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,MAAM;oBACb,OAAO,EAAE,yCAAyC,YAAY,CAAC,OAAO,EAAE;oBACxE,QAAQ,EAAE,OAAO;iBAClB,CAAC,CAAA;YACJ,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC5B,MAAM,CAAC,IAAI,CAAC;wBACV,KAAK,EAAE,QAAQ,CAAC,GAAG;wBACnB,OAAO,EAAE,sBAAsB;wBAC/B,QAAQ,EAAE,OAAO;qBAClB,CAAC,CAAA;gBACJ,CAAC;qBAAM,IAAI,GAAG,CAAC,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC;oBAC/C,MAAM,CAAC,IAAI,CAAC;wBACV,KAAK,EAAE,QAAQ,CAAC,GAAG;wBACnB,OAAO,EAAE,iCAAiC,YAAY,CAAC,SAAS,aAAa;wBAC7E,QAAQ,EAAE,OAAO;qBAClB,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,iDAAiD;YAC1D,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAA;IACJ,CAAC;IAED,0CAA0C;IAC1C,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,qCAAqC;gBAC9C,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,+DAA+D;gBACxE,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,mCAAmC;gBAC5C,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,6DAA6D;gBACtE,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,GAAG;gBACV,OAAO,EAAE,UAAU,GAAG,mCAAmC;gBACzD,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/src/tools/validate.js

@@ -22,344 +22,13 @@
  *   strict: true
  * });
  */
-import { z } from 'zod';
 import { promises as fs } from 'fs';
 import { join } from 'path';
 import { SkillsmithError, ErrorCodes } from '@skillsmith/core';
-/**
- * Zod schema for validate tool input
- */
-export const validateInputSchema = z.object({
-    /** Path to SKILL.md file or skill directory */
-    skill_path: z.string().min(1, 'skill_path is required'),
-    /** Enable strict validation (default false) */
-    strict: z.boolean().default(false),
-});
-/**
- * MCP tool schema definition for skill_validate
- */
-export const validateToolSchema = {
-    name: 'skill_validate',
-    description: 'Validate a SKILL.md file or skill directory against Skillsmith specification. Checks structure, required fields, and security patterns.',
-    inputSchema: {
-        type: 'object',
-        properties: {
-            skill_path: {
-                type: 'string',
-                description: 'Path to SKILL.md file or skill directory containing SKILL.md',
-            },
-            strict: {
-                type: 'boolean',
-                description: 'Enable strict validation mode (default false). Strict mode treats warnings as errors.',
-                default: false,
-            },
-        },
-        required: ['skill_path'],
-    },
-};
-/**
- * Maximum field lengths for validation
- */
-const FIELD_LIMITS = {
-    name: 64,
-    description: 1024,
-    author: 128,
-    version: 32,
-    category: 64,
-    license: 64,
-    tagLength: 32,
-    maxTags: 20,
-};
-/**
- * Dangerous URL patterns for SSRF prevention
- */
-const SSRF_PATTERNS = [
-    /^file:\/\//i,
-    /^gopher:\/\//i,
-    /^dict:\/\//i,
-    /^ldap:\/\//i,
-    /localhost/i,
-    /127\.0\.0\.\d+/,
-    /0\.0\.0\.0/,
-    /\[::1\]/,
-    /10\.\d+\.\d+\.\d+/,
-    /172\.(1[6-9]|2\d|3[01])\.\d+\.\d+/,
-    /192\.168\.\d+\.\d+/,
-];
-/**
- * Path traversal patterns
- */
-const PATH_TRAVERSAL_PATTERNS = [/\.\./, /\.\.%2[fF]/, /%2[eE]%2[eE]/, /\\\.\\./];
-/**
- * Parse YAML frontmatter from markdown content
- */
-function parseYamlFrontmatter(content) {
-    const trimmed = content.trim();
-    if (!trimmed.startsWith('---')) {
-        return null;
-    }
-    const endIndex = trimmed.indexOf('---', 3);
-    if (endIndex === -1) {
-        return null;
-    }
-    const yamlContent = trimmed.slice(3, endIndex).trim();
-    const result = {};
-    const lines = yamlContent.split('\n');
-    let currentKey = null;
-    let arrayBuffer = [];
-    let inArray = false;
-    for (const line of lines) {
-        const trimmedLine = line.trim();
-        if (!trimmedLine || trimmedLine.startsWith('#')) {
-            continue;
-        }
-        if (trimmedLine.startsWith('- ')) {
-            if (currentKey && inArray) {
-                const value = trimmedLine
-                    .slice(2)
-                    .trim()
-                    .replace(/^["']|["']$/g, '');
-                arrayBuffer.push(value);
-            }
-            continue;
-        }
-        const colonIndex = trimmedLine.indexOf(':');
-        if (colonIndex > 0) {
-            if (currentKey && inArray && arrayBuffer.length > 0) {
-                result[currentKey] = arrayBuffer;
-                arrayBuffer = [];
-            }
-            const key = trimmedLine.slice(0, colonIndex).trim();
-            const value = trimmedLine.slice(colonIndex + 1).trim();
-            if (value === '' || value === '|' || value === '>') {
-                currentKey = key;
-                inArray = true;
-                arrayBuffer = [];
-            }
-            else {
-                currentKey = null;
-                inArray = false;
-                let parsedValue = value;
-                if ((value.startsWith('"') && value.endsWith('"')) ||
-                    (value.startsWith("'") && value.endsWith("'"))) {
-                    parsedValue = value.slice(1, -1);
-                }
-                else if (value === 'true') {
-                    parsedValue = true;
-                }
-                else if (value === 'false') {
-                    parsedValue = false;
-                }
-                else if (/^-?\d+(\.\d+)?$/.test(value)) {
-                    parsedValue = parseFloat(value);
-                }
-                else if (value.startsWith('[') && value.endsWith(']')) {
-                    parsedValue = value
-                        .slice(1, -1)
-                        .split(',')
-                        .map((item) => item.trim().replace(/^["']|["']$/g, ''))
-                        .filter((item) => item.length > 0);
-                }
-                result[key] = parsedValue;
-            }
-        }
-    }
-    if (currentKey && inArray && arrayBuffer.length > 0) {
-        result[currentKey] = arrayBuffer;
-    }
-    return result;
-}
-/**
- * Check for SSRF patterns in a URL
- */
-function hasSsrfPattern(url) {
-    return SSRF_PATTERNS.some((pattern) => pattern.test(url));
-}
-/**
- * Check for path traversal patterns
- */
-function hasPathTraversal(path) {
-    return PATH_TRAVERSAL_PATTERNS.some((pattern) => pattern.test(path));
-}
-/**
- * Validate skill metadata
- */
-function validateMetadata(metadata, strict) {
-    const errors = [];
-    // Required fields
-    if (!metadata.name) {
-        errors.push({
-            field: 'name',
-            message: 'Required field "name" is missing',
-            severity: 'error',
-        });
-    }
-    else if (typeof metadata.name !== 'string') {
-        errors.push({
-            field: 'name',
-            message: 'Field "name" must be a string',
-            severity: 'error',
-        });
-    }
-    else if (metadata.name.length > FIELD_LIMITS.name) {
-        errors.push({
-            field: 'name',
-            message: `Field "name" exceeds maximum length of ${FIELD_LIMITS.name} characters`,
-            severity: 'error',
-        });
-    }
-    // Description validation
-    if (!metadata.description) {
-        errors.push({
-            field: 'description',
-            message: 'Required field "description" is missing',
-            severity: strict ? 'error' : 'warning',
-        });
-    }
-    else if (typeof metadata.description !== 'string') {
-        errors.push({
-            field: 'description',
-            message: 'Field "description" must be a string',
-            severity: 'error',
-        });
-    }
-    else if (metadata.description.length > FIELD_LIMITS.description) {
-        errors.push({
-            field: 'description',
-            message: `Field "description" exceeds maximum length of ${FIELD_LIMITS.description} characters`,
-            severity: 'error',
-        });
-    }
-    // Author validation
-    if (metadata.author !== undefined) {
-        if (typeof metadata.author !== 'string') {
-            errors.push({
-                field: 'author',
-                message: 'Field "author" must be a string',
-                severity: 'error',
-            });
-        }
-        else if (metadata.author.length > FIELD_LIMITS.author) {
-            errors.push({
-                field: 'author',
-                message: `Field "author" exceeds maximum length of ${FIELD_LIMITS.author} characters`,
-                severity: 'error',
-            });
-        }
-    }
-    // Version validation
-    if (metadata.version !== undefined) {
-        if (typeof metadata.version !== 'string') {
-            errors.push({
-                field: 'version',
-                message: 'Field "version" must be a string',
-                severity: 'error',
-            });
-        }
-        else if (metadata.version.length > FIELD_LIMITS.version) {
-            errors.push({
-                field: 'version',
-                message: `Field "version" exceeds maximum length of ${FIELD_LIMITS.version} characters`,
-                severity: 'error',
-            });
-        }
-    }
-    else if (strict) {
-        errors.push({
-            field: 'version',
-            message: 'Field "version" is recommended',
-            severity: 'warning',
-        });
-    }
-    // Tags validation
-    if (metadata.tags !== undefined) {
-        if (!Array.isArray(metadata.tags)) {
-            errors.push({
-                field: 'tags',
-                message: 'Field "tags" must be an array',
-                severity: 'error',
-            });
-        }
-        else {
-            if (metadata.tags.length > FIELD_LIMITS.maxTags) {
-                errors.push({
-                    field: 'tags',
-                    message: `Field "tags" exceeds maximum count of ${FIELD_LIMITS.maxTags}`,
-                    severity: 'error',
-                });
-            }
-            for (let i = 0; i < metadata.tags.length; i++) {
-                const tag = metadata.tags[i];
-                if (typeof tag !== 'string') {
-                    errors.push({
-                        field: `tags[${i}]`,
-                        message: 'Tag must be a string',
-                        severity: 'error',
-                    });
-                }
-                else if (tag.length > FIELD_LIMITS.tagLength) {
-                    errors.push({
-                        field: `tags[${i}]`,
-                        message: `Tag exceeds maximum length of ${FIELD_LIMITS.tagLength} characters`,
-                        severity: 'error',
-                    });
-                }
-            }
-        }
-    }
-    else if (strict) {
-        errors.push({
-            field: 'tags',
-            message: 'Field "tags" is recommended for discoverability',
-            severity: 'warning',
-        });
-    }
-    // Security: Check repository URL for SSRF
-    if (metadata.repository !== undefined) {
-        if (typeof metadata.repository !== 'string') {
-            errors.push({
-                field: 'repository',
-                message: 'Field "repository" must be a string',
-                severity: 'error',
-            });
-        }
-        else if (hasSsrfPattern(metadata.repository)) {
-            errors.push({
-                field: 'repository',
-                message: 'Field "repository" contains potentially dangerous URL pattern',
-                severity: 'error',
-            });
-        }
-    }
-    // Security: Check homepage URL for SSRF
-    if (metadata.homepage !== undefined) {
-        if (typeof metadata.homepage !== 'string') {
-            errors.push({
-                field: 'homepage',
-                message: 'Field "homepage" must be a string',
-                severity: 'error',
-            });
-        }
-        else if (hasSsrfPattern(metadata.homepage)) {
-            errors.push({
-                field: 'homepage',
-                message: 'Field "homepage" contains potentially dangerous URL pattern',
-                severity: 'error',
-            });
-        }
-    }
-    // Security: Check for path traversal in any string fields
-    for (const [key, value] of Object.entries(metadata)) {
-        if (typeof value === 'string' && hasPathTraversal(value)) {
-            errors.push({
-                field: key,
-                message: `Field "${key}" contains path traversal pattern`,
-                severity: 'error',
-            });
-        }
-    }
-    return errors;
-}
+import { validateInputSchema } from './validate.types.js';
+// Import helpers
+import { parseYamlFrontmatter, hasPathTraversal, validateMetadata } from './validate.helpers.js';
+export { validateInputSchema, validateToolSchema } from './validate.types.js';
 /**
  * Execute skill validation.
  *
@@ -401,7 +70,6 @@ export async function executeValidate(input, _context) {
         }
     }
     catch {
-        // Path doesn't exist or is inaccessible
         throw new SkillsmithError(ErrorCodes.SKILL_NOT_FOUND, `Path not found: ${skill_path}`, {
             details: { path: skill_path },
         });
@@ -427,7 +95,6 @@ export async function executeValidate(input, _context) {
         });
     }
     else {
-        // Validate metadata
         errors.push(...validateMetadata(metadata, strict));
     }
     // Determine validity