agentic-flow 2.0.7 → 3.0.0-alpha.2

package/dist/security/input-validation.js

@@ -0,0 +1,192 @@
+/**
+ * Input Validation Security Module
+ * Centralized validation for all user inputs
+ */
+import validator from 'validator';
+export class InputValidator {
+    /**
+     * Validate string input
+     */
+    validateString(input, fieldName, options = {}) {
+        // Type check
+        if (typeof input !== 'string') {
+            throw new Error(`${fieldName} must be a string`);
+        }
+        // Empty check
+        if (!options.allowEmpty && input.trim().length === 0) {
+            throw new Error(`${fieldName} cannot be empty`);
+        }
+        // Length checks
+        if (options.minLength && input.length < options.minLength) {
+            throw new Error(`${fieldName} must be at least ${options.minLength} characters`);
+        }
+        if (options.maxLength && input.length > options.maxLength) {
+            throw new Error(`${fieldName} exceeds maximum length of ${options.maxLength}`);
+        }
+        // Pattern matching
+        if (options.pattern && !options.pattern.test(input)) {
+            throw new Error(`${fieldName} format is invalid`);
+        }
+        // Allowed values
+        if (options.allowedValues && !options.allowedValues.includes(input)) {
+            throw new Error(`${fieldName} must be one of: ${options.allowedValues.join(', ')}`);
+        }
+        // Remove null bytes
+        if (input.includes('\0') || input.includes('\x00')) {
+            throw new Error(`${fieldName} contains null bytes`);
+        }
+        // Remove control characters (except newline, tab)
+        const sanitized = input.replace(/[\x00-\x08\x0B-\x0C\x0E-\x1F\x7F]/g, '');
+        return sanitized;
+    }
+    /**
+     * Validate language identifier (for Agent Booster)
+     */
+    validateLanguage(language) {
+        const allowedLanguages = [
+            'typescript',
+            'javascript',
+            'python',
+            'rust',
+            'go',
+            'java',
+            'c',
+            'cpp',
+            'csharp',
+            'ruby',
+            'php',
+            'swift',
+            'kotlin',
+            'scala',
+        ];
+        return this.validateString(language, 'language', {
+            allowedValues: allowedLanguages,
+            maxLength: 20,
+        });
+    }
+    /**
+     * Validate run ID format
+     */
+    validateRunId(runId) {
+        return this.validateString(runId, 'runId', {
+            pattern: /^[a-zA-Z0-9_-]+$/,
+            minLength: 1,
+            maxLength: 128,
+        });
+    }
+    /**
+     * Validate memory key format
+     */
+    validateMemoryKey(key) {
+        return this.validateString(key, 'memory key', {
+            pattern: /^[a-zA-Z0-9_-]+$/,
+            minLength: 1,
+            maxLength: 256,
+        });
+    }
+    /**
+     * Sanitize HTML to prevent XSS
+     */
+    sanitizeHtml(input) {
+        return validator.escape(input);
+    }
+    /**
+     * Validate and sanitize memory value
+     */
+    validateMemoryValue(value, maxSize = 100000) {
+        if (typeof value === 'string') {
+            // Remove null bytes and control characters
+            let sanitized = value.replace(/[\x00-\x1F\x7F]/g, '');
+            // Escape HTML for UI safety
+            sanitized = validator.escape(sanitized);
+            // Check size
+            if (sanitized.length > maxSize) {
+                throw new Error(`Memory value exceeds maximum size of ${maxSize} bytes`);
+            }
+            return sanitized;
+        }
+        // For objects, check JSON size
+        if (typeof value === 'object') {
+            const jsonStr = JSON.stringify(value);
+            if (jsonStr.length > maxSize) {
+                throw new Error(`Memory value exceeds maximum size of ${maxSize} bytes`);
+            }
+            return value;
+        }
+        return value;
+    }
+    /**
+     * Validate task description
+     */
+    validateTaskDescription(description) {
+        return this.validateString(description, 'task description', {
+            minLength: 1,
+            maxLength: 10000,
+        });
+    }
+    /**
+     * Validate number within range
+     */
+    validateNumber(input, fieldName, min, max) {
+        if (typeof input !== 'number' || isNaN(input)) {
+            throw new Error(`${fieldName} must be a valid number`);
+        }
+        if (min !== undefined && input < min) {
+            throw new Error(`${fieldName} must be at least ${min}`);
+        }
+        if (max !== undefined && input > max) {
+            throw new Error(`${fieldName} must be at most ${max}`);
+        }
+        return input;
+    }
+    /**
+     * Validate array
+     */
+    validateArray(input, fieldName, maxLength) {
+        if (!Array.isArray(input)) {
+            throw new Error(`${fieldName} must be an array`);
+        }
+        if (maxLength && input.length > maxLength) {
+            throw new Error(`${fieldName} exceeds maximum length of ${maxLength}`);
+        }
+        return input;
+    }
+    /**
+     * Validate metadata object
+     */
+    validateMetadata(metadata, maxSize = 10000) {
+        if (typeof metadata !== 'object' || metadata === null || Array.isArray(metadata)) {
+            throw new Error('Metadata must be a plain object');
+        }
+        const jsonStr = JSON.stringify(metadata);
+        if (jsonStr.length > maxSize) {
+            throw new Error(`Metadata exceeds maximum size of ${maxSize} bytes`);
+        }
+        // Check for suspicious keys
+        const suspiciousKeys = ['__proto__', 'constructor', 'prototype'];
+        for (const key of Object.keys(metadata)) {
+            if (suspiciousKeys.includes(key)) {
+                throw new Error(`Metadata contains forbidden key: ${key}`);
+            }
+        }
+        return metadata;
+    }
+    /**
+     * Validate provenance object
+     */
+    validateProvenance(provenance) {
+        const validated = this.validateMetadata(provenance);
+        // Check for path traversal in values
+        for (const [key, value] of Object.entries(validated)) {
+            if (typeof value === 'string' && (value.includes('..') || value.startsWith('/'))) {
+                throw new Error(`Path traversal detected in provenance.${key}: ${value}`);
+            }
+        }
+        return validated;
+    }
+}
+// Singleton instance
+export const inputValidator = new InputValidator();
+// Convenience exports
+export const { validateString, validateLanguage, validateRunId, validateMemoryKey, sanitizeHtml, validateMemoryValue, validateTaskDescription, validateNumber, validateArray, validateMetadata, validateProvenance, } = inputValidator;
+//# sourceMappingURL=input-validation.js.map

package/dist/security/input-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-validation.js","sourceRoot":"","sources":["../../src/security/input-validation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,SAAS,MAAM,WAAW,CAAC;AAUlC,MAAM,OAAO,cAAc;IACzB;;OAEG;IACH,cAAc,CACZ,KAAa,EACb,SAAiB,EACjB,UAA6B,EAAE;QAE/B,aAAa;QACb,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,mBAAmB,CAAC,CAAC;QACnD,CAAC;QAED,cAAc;QACd,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,kBAAkB,CAAC,CAAC;QAClD,CAAC;QAED,gBAAgB;QAChB,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,qBAAqB,OAAO,CAAC,SAAS,aAAa,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,8BAA8B,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,mBAAmB;QACnB,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,oBAAoB,CAAC,CAAC;QACpD,CAAC;QAED,iBAAiB;QACjB,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,oBAAoB,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,oBAAoB;QACpB,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAED,kDAAkD;QAClD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;QAE1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAAgB;QAC/B,MAAM,gBAAgB,GAAG;YACvB,YAAY;YACZ,YAAY;YACZ,QAAQ;YACR,MAAM;YACN,IAAI;YACJ,MAAM;YACN,GAAG;YACH,KAAK;YACL,QAAQ;YACR,MAAM;YACN,KAAK;YACL,OAAO;YACP,QAAQ;YACR,OAAO;SACR,CAAC;QAEF,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE;YAC/C,aAAa,EAAE,gBAAgB;YAC/B,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAa;QACzB,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE;YACzC,OAAO,EAAE,kBAAkB;YAC3B,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,GAAW;QAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE;YAC5C,OAAO,EAAE,kBAAkB;YAC3B,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,KAAa;QACxB,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,KAAU,EAAE,UAAkB,MAAM;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,2CAA2C;YAC3C,IAAI,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;YAEtD,4BAA4B;YAC5B,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAExC,aAAa;YACb,IAAI,SAAS,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,QAAQ,CAAC,CAAC;YAC3E,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,+BAA+B;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,QAAQ,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,WAAmB;QACzC,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,kBAAkB,EAAE;YAC1D,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,KAAa,EACb,SAAiB,EACjB,GAAY,EACZ,GAAY;QAEZ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,yBAAyB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,qBAAqB,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,oBAAoB,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,aAAa,CACX,KAAU,EACV,SAAiB,EACjB,SAAkB;QAElB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,mBAAmB,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,8BAA8B,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAA6B,EAAE,UAAkB,KAAK;QACrE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,QAAQ,CAAC,CAAC;QACvE,CAAC;QAED,4BAA4B;QAC5B,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;QACjE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,UAA+B;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAEpD,qCAAqC;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,qBAAqB;AACrB,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;AAEnD,sBAAsB;AACtB,MAAM,CAAC,MAAM,EACX,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,kBAAkB,GACnB,GAAG,cAAc,CAAC","sourcesContent":["/**\n * Input Validation Security Module\n * Centralized validation for all user inputs\n */\n\nimport validator from 'validator';\n\nexport interface ValidationOptions {\n  maxLength?: number;\n  minLength?: number;\n  allowEmpty?: boolean;\n  pattern?: RegExp;\n  allowedValues?: string[];\n}\n\nexport class InputValidator {\n  /**\n   * Validate string input\n   */\n  validateString(\n    input: string,\n    fieldName: string,\n    options: ValidationOptions = {}\n  ): string {\n    // Type check\n    if (typeof input !== 'string') {\n      throw new Error(`${fieldName} must be a string`);\n    }\n\n    // Empty check\n    if (!options.allowEmpty && input.trim().length === 0) {\n      throw new Error(`${fieldName} cannot be empty`);\n    }\n\n    // Length checks\n    if (options.minLength && input.length < options.minLength) {\n      throw new Error(`${fieldName} must be at least ${options.minLength} characters`);\n    }\n\n    if (options.maxLength && input.length > options.maxLength) {\n      throw new Error(`${fieldName} exceeds maximum length of ${options.maxLength}`);\n    }\n\n    // Pattern matching\n    if (options.pattern && !options.pattern.test(input)) {\n      throw new Error(`${fieldName} format is invalid`);\n    }\n\n    // Allowed values\n    if (options.allowedValues && !options.allowedValues.includes(input)) {\n      throw new Error(`${fieldName} must be one of: ${options.allowedValues.join(', ')}`);\n    }\n\n    // Remove null bytes\n    if (input.includes('\\0') || input.includes('\\x00')) {\n      throw new Error(`${fieldName} contains null bytes`);\n    }\n\n    // Remove control characters (except newline, tab)\n    const sanitized = input.replace(/[\\x00-\\x08\\x0B-\\x0C\\x0E-\\x1F\\x7F]/g, '');\n\n    return sanitized;\n  }\n\n  /**\n   * Validate language identifier (for Agent Booster)\n   */\n  validateLanguage(language: string): string {\n    const allowedLanguages = [\n      'typescript',\n      'javascript',\n      'python',\n      'rust',\n      'go',\n      'java',\n      'c',\n      'cpp',\n      'csharp',\n      'ruby',\n      'php',\n      'swift',\n      'kotlin',\n      'scala',\n    ];\n\n    return this.validateString(language, 'language', {\n      allowedValues: allowedLanguages,\n      maxLength: 20,\n    });\n  }\n\n  /**\n   * Validate run ID format\n   */\n  validateRunId(runId: string): string {\n    return this.validateString(runId, 'runId', {\n      pattern: /^[a-zA-Z0-9_-]+$/,\n      minLength: 1,\n      maxLength: 128,\n    });\n  }\n\n  /**\n   * Validate memory key format\n   */\n  validateMemoryKey(key: string): string {\n    return this.validateString(key, 'memory key', {\n      pattern: /^[a-zA-Z0-9_-]+$/,\n      minLength: 1,\n      maxLength: 256,\n    });\n  }\n\n  /**\n   * Sanitize HTML to prevent XSS\n   */\n  sanitizeHtml(input: string): string {\n    return validator.escape(input);\n  }\n\n  /**\n   * Validate and sanitize memory value\n   */\n  validateMemoryValue(value: any, maxSize: number = 100000): any {\n    if (typeof value === 'string') {\n      // Remove null bytes and control characters\n      let sanitized = value.replace(/[\\x00-\\x1F\\x7F]/g, '');\n\n      // Escape HTML for UI safety\n      sanitized = validator.escape(sanitized);\n\n      // Check size\n      if (sanitized.length > maxSize) {\n        throw new Error(`Memory value exceeds maximum size of ${maxSize} bytes`);\n      }\n\n      return sanitized;\n    }\n\n    // For objects, check JSON size\n    if (typeof value === 'object') {\n      const jsonStr = JSON.stringify(value);\n      if (jsonStr.length > maxSize) {\n        throw new Error(`Memory value exceeds maximum size of ${maxSize} bytes`);\n      }\n      return value;\n    }\n\n    return value;\n  }\n\n  /**\n   * Validate task description\n   */\n  validateTaskDescription(description: string): string {\n    return this.validateString(description, 'task description', {\n      minLength: 1,\n      maxLength: 10000,\n    });\n  }\n\n  /**\n   * Validate number within range\n   */\n  validateNumber(\n    input: number,\n    fieldName: string,\n    min?: number,\n    max?: number\n  ): number {\n    if (typeof input !== 'number' || isNaN(input)) {\n      throw new Error(`${fieldName} must be a valid number`);\n    }\n\n    if (min !== undefined && input < min) {\n      throw new Error(`${fieldName} must be at least ${min}`);\n    }\n\n    if (max !== undefined && input > max) {\n      throw new Error(`${fieldName} must be at most ${max}`);\n    }\n\n    return input;\n  }\n\n  /**\n   * Validate array\n   */\n  validateArray<T>(\n    input: T[],\n    fieldName: string,\n    maxLength?: number\n  ): T[] {\n    if (!Array.isArray(input)) {\n      throw new Error(`${fieldName} must be an array`);\n    }\n\n    if (maxLength && input.length > maxLength) {\n      throw new Error(`${fieldName} exceeds maximum length of ${maxLength}`);\n    }\n\n    return input;\n  }\n\n  /**\n   * Validate metadata object\n   */\n  validateMetadata(metadata: Record<string, any>, maxSize: number = 10000): Record<string, any> {\n    if (typeof metadata !== 'object' || metadata === null || Array.isArray(metadata)) {\n      throw new Error('Metadata must be a plain object');\n    }\n\n    const jsonStr = JSON.stringify(metadata);\n    if (jsonStr.length > maxSize) {\n      throw new Error(`Metadata exceeds maximum size of ${maxSize} bytes`);\n    }\n\n    // Check for suspicious keys\n    const suspiciousKeys = ['__proto__', 'constructor', 'prototype'];\n    for (const key of Object.keys(metadata)) {\n      if (suspiciousKeys.includes(key)) {\n        throw new Error(`Metadata contains forbidden key: ${key}`);\n      }\n    }\n\n    return metadata;\n  }\n\n  /**\n   * Validate provenance object\n   */\n  validateProvenance(provenance: Record<string, any>): Record<string, any> {\n    const validated = this.validateMetadata(provenance);\n\n    // Check for path traversal in values\n    for (const [key, value] of Object.entries(validated)) {\n      if (typeof value === 'string' && (value.includes('..') || value.startsWith('/'))) {\n        throw new Error(`Path traversal detected in provenance.${key}: ${value}`);\n      }\n    }\n\n    return validated;\n  }\n}\n\n// Singleton instance\nexport const inputValidator = new InputValidator();\n\n// Convenience exports\nexport const {\n  validateString,\n  validateLanguage,\n  validateRunId,\n  validateMemoryKey,\n  sanitizeHtml,\n  validateMemoryValue,\n  validateTaskDescription,\n  validateNumber,\n  validateArray,\n  validateMetadata,\n  validateProvenance,\n} = inputValidator;\n"]}

package/dist/security/path-validator.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Path Validation Security Module
+ * Prevents path traversal attacks (CVE-2026-004)
+ */
+export interface PathValidationOptions {
+    allowedDir?: string;
+    blockedPaths?: string[];
+    allowAbsolute?: boolean;
+    mustExist?: boolean;
+    mustBeFile?: boolean;
+    mustBeDirectory?: boolean;
+}
+export declare class PathValidator {
+    private allowedDir;
+    private blockedPaths;
+    constructor(allowedDir?: string, blockedPaths?: string[]);
+    /**
+     * Validate a file path against traversal and sensitive path attacks
+     */
+    validate(filePath: string, options?: PathValidationOptions): string;
+    /**
+     * Validate multiple paths at once
+     */
+    validateMany(paths: string[], options?: PathValidationOptions): string[];
+    /**
+     * Check if a path is safe without throwing
+     */
+    isSafe(filePath: string, options?: PathValidationOptions): boolean;
+}
+export declare const pathValidator: PathValidator;
+/**
+ * Quick validation helper
+ */
+export declare function validateFilePath(filePath: string, allowedDir?: string, options?: PathValidationOptions): string;
+/**
+ * Validate path is safe to read
+ */
+export declare function validateReadPath(filePath: string, allowedDir?: string): string;
+/**
+ * Validate path is safe to write
+ */
+export declare function validateWritePath(filePath: string, allowedDir?: string): string;
+/**
+ * Validate directory path
+ */
+export declare function validateDirPath(filePath: string, allowedDir?: string): string;
+//# sourceMappingURL=path-validator.d.ts.map

package/dist/security/path-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-validator.d.ts","sourceRoot":"","sources":["../../src/security/path-validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAqBD,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,YAAY,CAAW;gBAEnB,UAAU,GAAE,MAAsB,EAAE,YAAY,GAAE,MAAM,EAA0B;IAK9F;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM;IAqEvE;;OAEG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM,EAAE;IAI5E;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO;CAQvE;AAGD,eAAO,MAAM,aAAa,eAAsB,CAAC;AAEjD;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,MAAsB,EAClC,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAGR;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAK9E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAI/E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAK7E"}

package/dist/security/path-validator.js

@@ -0,0 +1,144 @@
+/**
+ * Path Validation Security Module
+ * Prevents path traversal attacks (CVE-2026-004)
+ */
+import { resolve, relative, isAbsolute, normalize } from 'path';
+import { existsSync, statSync } from 'fs';
+const DEFAULT_BLOCKED_PATHS = [
+    '/etc/',
+    '/sys/',
+    '/proc/',
+    '/dev/',
+    '/root/',
+    '.env',
+    '.git/',
+    'node_modules/',
+    '.ssh/',
+    '.aws/',
+    '.config/',
+    'id_rsa',
+    'id_ed25519',
+    'credentials',
+    'secret',
+    'private',
+];
+export class PathValidator {
+    allowedDir;
+    blockedPaths;
+    constructor(allowedDir = process.cwd(), blockedPaths = DEFAULT_BLOCKED_PATHS) {
+        this.allowedDir = resolve(allowedDir);
+        this.blockedPaths = [...blockedPaths];
+    }
+    /**
+     * Validate a file path against traversal and sensitive path attacks
+     */
+    validate(filePath, options = {}) {
+        // 1. Basic validation
+        if (!filePath || typeof filePath !== 'string') {
+            throw new Error('Invalid file path: must be a non-empty string');
+        }
+        if (filePath.length > 4096) {
+            throw new Error('File path too long (max 4096 characters)');
+        }
+        // 2. Normalize and resolve path
+        const normalizedPath = normalize(filePath);
+        const resolvedPath = resolve(normalizedPath);
+        // 3. Check for null bytes (common attack vector)
+        if (filePath.includes('\0') || filePath.includes('\x00')) {
+            throw new Error('Path contains null bytes');
+        }
+        // 4. Check for path traversal patterns
+        if (filePath.includes('..') && !options.allowAbsolute) {
+            // Additional check: ensure resolved path doesn't escape allowed dir
+            const allowedDirResolved = resolve(options.allowedDir || this.allowedDir);
+            const relativePath = relative(allowedDirResolved, resolvedPath);
+            if (relativePath.startsWith('..') || isAbsolute(relativePath)) {
+                throw new Error(`Path traversal detected: ${filePath}`);
+            }
+        }
+        // 5. Check if path is within allowed directory
+        if (!options.allowAbsolute) {
+            const allowedDirResolved = resolve(options.allowedDir || this.allowedDir);
+            const relativePath = relative(allowedDirResolved, resolvedPath);
+            if (relativePath.startsWith('..') || isAbsolute(relativePath)) {
+                throw new Error(`Path outside allowed directory: ${filePath}`);
+            }
+        }
+        // 6. Check against blocked paths
+        const blockedPaths = options.blockedPaths || this.blockedPaths;
+        for (const blocked of blockedPaths) {
+            if (resolvedPath.toLowerCase().includes(blocked.toLowerCase())) {
+                throw new Error(`Access to blocked path: ${blocked}`);
+            }
+        }
+        // 7. Existence checks
+        if (options.mustExist && !existsSync(resolvedPath)) {
+            throw new Error(`Path does not exist: ${filePath}`);
+        }
+        // 8. Type checks
+        if (existsSync(resolvedPath)) {
+            const stats = statSync(resolvedPath);
+            if (options.mustBeFile && !stats.isFile()) {
+                throw new Error(`Path is not a file: ${filePath}`);
+            }
+            if (options.mustBeDirectory && !stats.isDirectory()) {
+                throw new Error(`Path is not a directory: ${filePath}`);
+            }
+        }
+        return resolvedPath;
+    }
+    /**
+     * Validate multiple paths at once
+     */
+    validateMany(paths, options = {}) {
+        return paths.map(path => this.validate(path, options));
+    }
+    /**
+     * Check if a path is safe without throwing
+     */
+    isSafe(filePath, options = {}) {
+        try {
+            this.validate(filePath, options);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+// Singleton instance for convenience
+export const pathValidator = new PathValidator();
+/**
+ * Quick validation helper
+ */
+export function validateFilePath(filePath, allowedDir = process.cwd(), options = {}) {
+    const validator = new PathValidator(allowedDir);
+    return validator.validate(filePath, options);
+}
+/**
+ * Validate path is safe to read
+ */
+export function validateReadPath(filePath, allowedDir) {
+    return validateFilePath(filePath, allowedDir, {
+        mustExist: true,
+        mustBeFile: true,
+    });
+}
+/**
+ * Validate path is safe to write
+ */
+export function validateWritePath(filePath, allowedDir) {
+    return validateFilePath(filePath, allowedDir, {
+        mustBeFile: false, // File may not exist yet
+    });
+}
+/**
+ * Validate directory path
+ */
+export function validateDirPath(filePath, allowedDir) {
+    return validateFilePath(filePath, allowedDir, {
+        mustExist: true,
+        mustBeDirectory: true,
+    });
+}
+//# sourceMappingURL=path-validator.js.map

package/dist/security/path-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-validator.js","sourceRoot":"","sources":["../../src/security/path-validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAW1C,MAAM,qBAAqB,GAAG;IAC5B,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,eAAe;IACf,OAAO;IACP,OAAO;IACP,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,SAAS;CACV,CAAC;AAEF,MAAM,OAAO,aAAa;IAChB,UAAU,CAAS;IACnB,YAAY,CAAW;IAE/B,YAAY,aAAqB,OAAO,CAAC,GAAG,EAAE,EAAE,eAAyB,qBAAqB;QAC5F,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB,EAAE,UAAiC,EAAE;QAC5D,sBAAsB;QACtB,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QAE7C,iDAAiD;QACjD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,uCAAuC;QACvC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,oEAAoE;YACpE,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;YAEhE,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;YAEhE,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC;QAC/D,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,iBAAiB;QACjB,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;YAErC,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,EAAE,CAAC,CAAC;YACrD,CAAC;YAED,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,KAAe,EAAE,UAAiC,EAAE;QAC/D,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAgB,EAAE,UAAiC,EAAE;QAC1D,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,qCAAqC;AACrC,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;AAEjD;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,aAAqB,OAAO,CAAC,GAAG,EAAE,EAClC,UAAiC,EAAE;IAEnC,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,UAAmB;IACpE,OAAO,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE;QAC5C,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,UAAmB;IACrE,OAAO,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE;QAC5C,UAAU,EAAE,KAAK,EAAE,yBAAyB;KAC7C,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,UAAmB;IACnE,OAAO,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE;QAC5C,SAAS,EAAE,IAAI;QACf,eAAe,EAAE,IAAI;KACtB,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Path Validation Security Module\n * Prevents path traversal attacks (CVE-2026-004)\n */\n\nimport { resolve, relative, isAbsolute, normalize } from 'path';\nimport { existsSync, statSync } from 'fs';\n\nexport interface PathValidationOptions {\n  allowedDir?: string;\n  blockedPaths?: string[];\n  allowAbsolute?: boolean;\n  mustExist?: boolean;\n  mustBeFile?: boolean;\n  mustBeDirectory?: boolean;\n}\n\nconst DEFAULT_BLOCKED_PATHS = [\n  '/etc/',\n  '/sys/',\n  '/proc/',\n  '/dev/',\n  '/root/',\n  '.env',\n  '.git/',\n  'node_modules/',\n  '.ssh/',\n  '.aws/',\n  '.config/',\n  'id_rsa',\n  'id_ed25519',\n  'credentials',\n  'secret',\n  'private',\n];\n\nexport class PathValidator {\n  private allowedDir: string;\n  private blockedPaths: string[];\n\n  constructor(allowedDir: string = process.cwd(), blockedPaths: string[] = DEFAULT_BLOCKED_PATHS) {\n    this.allowedDir = resolve(allowedDir);\n    this.blockedPaths = [...blockedPaths];\n  }\n\n  /**\n   * Validate a file path against traversal and sensitive path attacks\n   */\n  validate(filePath: string, options: PathValidationOptions = {}): string {\n    // 1. Basic validation\n    if (!filePath || typeof filePath !== 'string') {\n      throw new Error('Invalid file path: must be a non-empty string');\n    }\n\n    if (filePath.length > 4096) {\n      throw new Error('File path too long (max 4096 characters)');\n    }\n\n    // 2. Normalize and resolve path\n    const normalizedPath = normalize(filePath);\n    const resolvedPath = resolve(normalizedPath);\n\n    // 3. Check for null bytes (common attack vector)\n    if (filePath.includes('\\0') || filePath.includes('\\x00')) {\n      throw new Error('Path contains null bytes');\n    }\n\n    // 4. Check for path traversal patterns\n    if (filePath.includes('..') && !options.allowAbsolute) {\n      // Additional check: ensure resolved path doesn't escape allowed dir\n      const allowedDirResolved = resolve(options.allowedDir || this.allowedDir);\n      const relativePath = relative(allowedDirResolved, resolvedPath);\n\n      if (relativePath.startsWith('..') || isAbsolute(relativePath)) {\n        throw new Error(`Path traversal detected: ${filePath}`);\n      }\n    }\n\n    // 5. Check if path is within allowed directory\n    if (!options.allowAbsolute) {\n      const allowedDirResolved = resolve(options.allowedDir || this.allowedDir);\n      const relativePath = relative(allowedDirResolved, resolvedPath);\n\n      if (relativePath.startsWith('..') || isAbsolute(relativePath)) {\n        throw new Error(`Path outside allowed directory: ${filePath}`);\n      }\n    }\n\n    // 6. Check against blocked paths\n    const blockedPaths = options.blockedPaths || this.blockedPaths;\n    for (const blocked of blockedPaths) {\n      if (resolvedPath.toLowerCase().includes(blocked.toLowerCase())) {\n        throw new Error(`Access to blocked path: ${blocked}`);\n      }\n    }\n\n    // 7. Existence checks\n    if (options.mustExist && !existsSync(resolvedPath)) {\n      throw new Error(`Path does not exist: ${filePath}`);\n    }\n\n    // 8. Type checks\n    if (existsSync(resolvedPath)) {\n      const stats = statSync(resolvedPath);\n\n      if (options.mustBeFile && !stats.isFile()) {\n        throw new Error(`Path is not a file: ${filePath}`);\n      }\n\n      if (options.mustBeDirectory && !stats.isDirectory()) {\n        throw new Error(`Path is not a directory: ${filePath}`);\n      }\n    }\n\n    return resolvedPath;\n  }\n\n  /**\n   * Validate multiple paths at once\n   */\n  validateMany(paths: string[], options: PathValidationOptions = {}): string[] {\n    return paths.map(path => this.validate(path, options));\n  }\n\n  /**\n   * Check if a path is safe without throwing\n   */\n  isSafe(filePath: string, options: PathValidationOptions = {}): boolean {\n    try {\n      this.validate(filePath, options);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n\n// Singleton instance for convenience\nexport const pathValidator = new PathValidator();\n\n/**\n * Quick validation helper\n */\nexport function validateFilePath(\n  filePath: string,\n  allowedDir: string = process.cwd(),\n  options: PathValidationOptions = {}\n): string {\n  const validator = new PathValidator(allowedDir);\n  return validator.validate(filePath, options);\n}\n\n/**\n * Validate path is safe to read\n */\nexport function validateReadPath(filePath: string, allowedDir?: string): string {\n  return validateFilePath(filePath, allowedDir, {\n    mustExist: true,\n    mustBeFile: true,\n  });\n}\n\n/**\n * Validate path is safe to write\n */\nexport function validateWritePath(filePath: string, allowedDir?: string): string {\n  return validateFilePath(filePath, allowedDir, {\n    mustBeFile: false, // File may not exist yet\n  });\n}\n\n/**\n * Validate directory path\n */\nexport function validateDirPath(filePath: string, allowedDir?: string): string {\n  return validateFilePath(filePath, allowedDir, {\n    mustExist: true,\n    mustBeDirectory: true,\n  });\n}\n"]}

package/dist/security/rate-limiter.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Rate Limiting Security Module
+ * Prevents DoS attacks (VUL-010)
+ */
+export interface RateLimitConfig {
+    maxRequests: number;
+    windowMs: number;
+    keyGenerator?: (context: any) => string;
+}
+export interface RateLimitInfo {
+    remaining: number;
+    resetTime: number;
+    retryAfter?: number;
+}
+export declare class RateLimiter {
+    private requests;
+    private config;
+    constructor(config: RateLimitConfig);
+    /**
+     * Check if request should be allowed
+     */
+    consume(key?: string): Promise<RateLimitInfo>;
+    /**
+     * Get current limit status without consuming
+     */
+    getStatus(key?: string): RateLimitInfo;
+    /**
+     * Reset limit for a specific key
+     */
+    reset(key?: string): void;
+    /**
+     * Cleanup expired entries
+     */
+    private cleanup;
+}
+export declare class RateLimitError extends Error {
+    info: RateLimitInfo;
+    constructor(message: string, info: RateLimitInfo);
+}
+export declare const orchestrationLimiter: RateLimiter;
+export declare const memoryOperationLimiter: RateLimiter;
+export declare const fileOperationLimiter: RateLimiter;
+/**
+ * Max concurrent runs tracker
+ */
+export declare class ConcurrencyLimiter {
+    private activeRuns;
+    private maxConcurrent;
+    constructor(maxConcurrent?: number);
+    /**
+     * Acquire a run slot
+     */
+    acquire(runId: string): void;
+    /**
+     * Release a run slot
+     */
+    release(runId: string): void;
+    /**
+     * Get current status
+     */
+    getStatus(): {
+        active: number;
+        available: number;
+        max: number;
+    };
+}
+export declare const concurrencyLimiter: ConcurrencyLimiter;
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/security/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../src/security/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAoC;IACpD,OAAO,CAAC,MAAM,CAAkB;gBAEpB,MAAM,EAAE,eAAe;IAOnC;;OAEG;IACG,OAAO,CAAC,GAAG,GAAE,MAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;IAmC9D;;OAEG;IACH,SAAS,CAAC,GAAG,GAAE,MAAkB,GAAG,aAAa;IAcjD;;OAEG;IACH,KAAK,CAAC,GAAG,GAAE,MAAkB,GAAG,IAAI;IAIpC;;OAEG;IACH,OAAO,CAAC,OAAO;CAchB;AAED,qBAAa,cAAe,SAAQ,KAAK;IAG9B,IAAI,EAAE,aAAa;gBAD1B,OAAO,EAAE,MAAM,EACR,IAAI,EAAE,aAAa;CAK7B;AAGD,eAAO,MAAM,oBAAoB,aAG/B,CAAC;AAEH,eAAO,MAAM,sBAAsB,aAGjC,CAAC;AAEH,eAAO,MAAM,oBAAoB,aAG/B,CAAC;AAEH;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,UAAU,CAA0B;IAC5C,OAAO,CAAC,aAAa,CAAS;gBAElB,aAAa,GAAE,MAAY;IAIvC;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAU5B;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI5B;;OAEG;IACH,SAAS,IAAI;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;CAOhE;AAED,eAAO,MAAM,kBAAkB,oBAA8B,CAAC"}

package/dist/security/rate-limiter.js

@@ -0,0 +1,133 @@
+/**
+ * Rate Limiting Security Module
+ * Prevents DoS attacks (VUL-010)
+ */
+export class RateLimiter {
+    requests = new Map();
+    config;
+    constructor(config) {
+        this.config = config;
+        // Cleanup old entries every minute
+        setInterval(() => this.cleanup(), 60000);
+    }
+    /**
+     * Check if request should be allowed
+     */
+    async consume(key = 'default') {
+        const now = Date.now();
+        const windowStart = now - this.config.windowMs;
+        // Get or create request history for this key
+        let history = this.requests.get(key) || [];
+        // Remove expired requests
+        history = history.filter((timestamp) => timestamp > windowStart);
+        // Check if limit exceeded
+        if (history.length >= this.config.maxRequests) {
+            const oldestRequest = Math.min(...history);
+            const retryAfter = Math.ceil((oldestRequest + this.config.windowMs - now) / 1000);
+            throw new RateLimitError(`Rate limit exceeded: max ${this.config.maxRequests} requests per ${this.config.windowMs / 1000}s`, {
+                remaining: 0,
+                resetTime: oldestRequest + this.config.windowMs,
+                retryAfter,
+            });
+        }
+        // Add current request
+        history.push(now);
+        this.requests.set(key, history);
+        return {
+            remaining: this.config.maxRequests - history.length,
+            resetTime: now + this.config.windowMs,
+        };
+    }
+    /**
+     * Get current limit status without consuming
+     */
+    getStatus(key = 'default') {
+        const now = Date.now();
+        const windowStart = now - this.config.windowMs;
+        const history = (this.requests.get(key) || []).filter((timestamp) => timestamp > windowStart);
+        return {
+            remaining: this.config.maxRequests - history.length,
+            resetTime: now + this.config.windowMs,
+        };
+    }
+    /**
+     * Reset limit for a specific key
+     */
+    reset(key = 'default') {
+        this.requests.delete(key);
+    }
+    /**
+     * Cleanup expired entries
+     */
+    cleanup() {
+        const now = Date.now();
+        const windowStart = now - this.config.windowMs;
+        for (const [key, history] of this.requests.entries()) {
+            const validRequests = history.filter((timestamp) => timestamp > windowStart);
+            if (validRequests.length === 0) {
+                this.requests.delete(key);
+            }
+            else {
+                this.requests.set(key, validRequests);
+            }
+        }
+    }
+}
+export class RateLimitError extends Error {
+    info;
+    constructor(message, info) {
+        super(message);
+        this.info = info;
+        this.name = 'RateLimitError';
+    }
+}
+// Pre-configured rate limiters for different use cases
+export const orchestrationLimiter = new RateLimiter({
+    maxRequests: 10,
+    windowMs: 60000, // 10 requests per minute
+});
+export const memoryOperationLimiter = new RateLimiter({
+    maxRequests: 100,
+    windowMs: 60000, // 100 operations per minute
+});
+export const fileOperationLimiter = new RateLimiter({
+    maxRequests: 50,
+    windowMs: 60000, // 50 file ops per minute
+});
+/**
+ * Max concurrent runs tracker
+ */
+export class ConcurrencyLimiter {
+    activeRuns = new Set();
+    maxConcurrent;
+    constructor(maxConcurrent = 100) {
+        this.maxConcurrent = maxConcurrent;
+    }
+    /**
+     * Acquire a run slot
+     */
+    acquire(runId) {
+        if (this.activeRuns.size >= this.maxConcurrent) {
+            throw new Error(`Maximum concurrent runs (${this.maxConcurrent}) exceeded. Active: ${this.activeRuns.size}`);
+        }
+        this.activeRuns.add(runId);
+    }
+    /**
+     * Release a run slot
+     */
+    release(runId) {
+        this.activeRuns.delete(runId);
+    }
+    /**
+     * Get current status
+     */
+    getStatus() {
+        return {
+            active: this.activeRuns.size,
+            available: this.maxConcurrent - this.activeRuns.size,
+            max: this.maxConcurrent,
+        };
+    }
+}
+export const concurrencyLimiter = new ConcurrencyLimiter(100);
+//# sourceMappingURL=rate-limiter.js.map

package/dist/security/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../src/security/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAcH,MAAM,OAAO,WAAW;IACd,QAAQ,GAA0B,IAAI,GAAG,EAAE,CAAC;IAC5C,MAAM,CAAkB;IAEhC,YAAY,MAAuB;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,mCAAmC;QACnC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc,SAAS;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAE/C,6CAA6C;QAC7C,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAE3C,0BAA0B;QAC1B,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC;QAEjE,0BAA0B;QAC1B,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;YAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAElF,MAAM,IAAI,cAAc,CACtB,4BAA4B,IAAI,CAAC,MAAM,CAAC,WAAW,iBAAiB,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,GAAG,EAClG;gBACE,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/C,UAAU;aACX,CACF,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAEhC,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM;YACnD,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ;SACtC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAc,SAAS;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAE/C,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CACnD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,GAAG,WAAW,CACvC,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM;YACnD,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ;SACtC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAc,SAAS;QAC3B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACK,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAE/C,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC;YAE7E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,KAAK;IAG9B;IAFT,YACE,OAAe,EACR,IAAmB;QAE1B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFR,SAAI,GAAJ,IAAI,CAAe;QAG1B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,WAAW,CAAC;IAClD,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,KAAK,EAAE,yBAAyB;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,WAAW,CAAC;IACpD,WAAW,EAAE,GAAG;IAChB,QAAQ,EAAE,KAAK,EAAE,4BAA4B;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,WAAW,CAAC;IAClD,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,KAAK,EAAE,yBAAyB;CAC3C,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,OAAO,kBAAkB;IACrB,UAAU,GAAgB,IAAI,GAAG,EAAE,CAAC;IACpC,aAAa,CAAS;IAE9B,YAAY,gBAAwB,GAAG;QACrC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,KAAa;QACnB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,CAAC,aAAa,uBAAuB,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAC5F,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,KAAa;QACnB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAC5B,SAAS,EAAE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI;YACpD,GAAG,EAAE,IAAI,CAAC,aAAa;SACxB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC","sourcesContent":["/**\n * Rate Limiting Security Module\n * Prevents DoS attacks (VUL-010)\n */\n\nexport interface RateLimitConfig {\n  maxRequests: number;\n  windowMs: number;\n  keyGenerator?: (context: any) => string;\n}\n\nexport interface RateLimitInfo {\n  remaining: number;\n  resetTime: number;\n  retryAfter?: number;\n}\n\nexport class RateLimiter {\n  private requests: Map<string, number[]> = new Map();\n  private config: RateLimitConfig;\n\n  constructor(config: RateLimitConfig) {\n    this.config = config;\n\n    // Cleanup old entries every minute\n    setInterval(() => this.cleanup(), 60000);\n  }\n\n  /**\n   * Check if request should be allowed\n   */\n  async consume(key: string = 'default'): Promise<RateLimitInfo> {\n    const now = Date.now();\n    const windowStart = now - this.config.windowMs;\n\n    // Get or create request history for this key\n    let history = this.requests.get(key) || [];\n\n    // Remove expired requests\n    history = history.filter((timestamp) => timestamp > windowStart);\n\n    // Check if limit exceeded\n    if (history.length >= this.config.maxRequests) {\n      const oldestRequest = Math.min(...history);\n      const retryAfter = Math.ceil((oldestRequest + this.config.windowMs - now) / 1000);\n\n      throw new RateLimitError(\n        `Rate limit exceeded: max ${this.config.maxRequests} requests per ${this.config.windowMs / 1000}s`,\n        {\n          remaining: 0,\n          resetTime: oldestRequest + this.config.windowMs,\n          retryAfter,\n        }\n      );\n    }\n\n    // Add current request\n    history.push(now);\n    this.requests.set(key, history);\n\n    return {\n      remaining: this.config.maxRequests - history.length,\n      resetTime: now + this.config.windowMs,\n    };\n  }\n\n  /**\n   * Get current limit status without consuming\n   */\n  getStatus(key: string = 'default'): RateLimitInfo {\n    const now = Date.now();\n    const windowStart = now - this.config.windowMs;\n\n    const history = (this.requests.get(key) || []).filter(\n      (timestamp) => timestamp > windowStart\n    );\n\n    return {\n      remaining: this.config.maxRequests - history.length,\n      resetTime: now + this.config.windowMs,\n    };\n  }\n\n  /**\n   * Reset limit for a specific key\n   */\n  reset(key: string = 'default'): void {\n    this.requests.delete(key);\n  }\n\n  /**\n   * Cleanup expired entries\n   */\n  private cleanup(): void {\n    const now = Date.now();\n    const windowStart = now - this.config.windowMs;\n\n    for (const [key, history] of this.requests.entries()) {\n      const validRequests = history.filter((timestamp) => timestamp > windowStart);\n\n      if (validRequests.length === 0) {\n        this.requests.delete(key);\n      } else {\n        this.requests.set(key, validRequests);\n      }\n    }\n  }\n}\n\nexport class RateLimitError extends Error {\n  constructor(\n    message: string,\n    public info: RateLimitInfo\n  ) {\n    super(message);\n    this.name = 'RateLimitError';\n  }\n}\n\n// Pre-configured rate limiters for different use cases\nexport const orchestrationLimiter = new RateLimiter({\n  maxRequests: 10,\n  windowMs: 60000, // 10 requests per minute\n});\n\nexport const memoryOperationLimiter = new RateLimiter({\n  maxRequests: 100,\n  windowMs: 60000, // 100 operations per minute\n});\n\nexport const fileOperationLimiter = new RateLimiter({\n  maxRequests: 50,\n  windowMs: 60000, // 50 file ops per minute\n});\n\n/**\n * Max concurrent runs tracker\n */\nexport class ConcurrencyLimiter {\n  private activeRuns: Set<string> = new Set();\n  private maxConcurrent: number;\n\n  constructor(maxConcurrent: number = 100) {\n    this.maxConcurrent = maxConcurrent;\n  }\n\n  /**\n   * Acquire a run slot\n   */\n  acquire(runId: string): void {\n    if (this.activeRuns.size >= this.maxConcurrent) {\n      throw new Error(\n        `Maximum concurrent runs (${this.maxConcurrent}) exceeded. Active: ${this.activeRuns.size}`\n      );\n    }\n\n    this.activeRuns.add(runId);\n  }\n\n  /**\n   * Release a run slot\n   */\n  release(runId: string): void {\n    this.activeRuns.delete(runId);\n  }\n\n  /**\n   * Get current status\n   */\n  getStatus(): { active: number; available: number; max: number } {\n    return {\n      active: this.activeRuns.size,\n      available: this.maxConcurrent - this.activeRuns.size,\n      max: this.maxConcurrent,\n    };\n  }\n}\n\nexport const concurrencyLimiter = new ConcurrencyLimiter(100);\n"]}