agentic-flow 3.0.0-alpha.2 → 3.1.0

package/dist/agentic-flow/src/security/index.js

@@ -1,14 +0,0 @@
-/**
- * Security Module Index
- * Centralized security utilities for agentic-flow v3
- */
-export * from './path-validator.js';
-export * from './input-validation.js';
-export * from './secret-redaction.js';
-export * from './rate-limiter.js';
-// Re-export commonly used validators
-export { validateFilePath, validateReadPath, validateWritePath, validateDirPath, PathValidator, } from './path-validator.js';
-export { validateString, validateLanguage, validateRunId, validateMemoryKey, validateTaskDescription, validateNumber, validateArray, validateMetadata, validateProvenance, sanitizeHtml, InputValidator, } from './input-validation.js';
-export { redactKey, redactString, redactObject, sanitizeEnvironment, logEnvStatus, SecretRedactor, } from './secret-redaction.js';
-export { orchestrationLimiter, memoryOperationLimiter, fileOperationLimiter, concurrencyLimiter, RateLimiter, ConcurrencyLimiter, RateLimitError, } from './rate-limiter.js';
-//# sourceMappingURL=index.js.map

package/dist/agentic-flow/src/security/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAElC,qCAAqC;AACrC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,aAAa,GACd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,cAAc,GACf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,cAAc,GACf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,cAAc,GACf,MAAM,mBAAmB,CAAC","sourcesContent":["/**\n * Security Module Index\n * Centralized security utilities for agentic-flow v3\n */\n\nexport * from './path-validator.js';\nexport * from './input-validation.js';\nexport * from './secret-redaction.js';\nexport * from './rate-limiter.js';\n\n// Re-export commonly used validators\nexport {\n  validateFilePath,\n  validateReadPath,\n  validateWritePath,\n  validateDirPath,\n  PathValidator,\n} from './path-validator.js';\n\nexport {\n  validateString,\n  validateLanguage,\n  validateRunId,\n  validateMemoryKey,\n  validateTaskDescription,\n  validateNumber,\n  validateArray,\n  validateMetadata,\n  validateProvenance,\n  sanitizeHtml,\n  InputValidator,\n} from './input-validation.js';\n\nexport {\n  redactKey,\n  redactString,\n  redactObject,\n  sanitizeEnvironment,\n  logEnvStatus,\n  SecretRedactor,\n} from './secret-redaction.js';\n\nexport {\n  orchestrationLimiter,\n  memoryOperationLimiter,\n  fileOperationLimiter,\n  concurrencyLimiter,\n  RateLimiter,\n  ConcurrencyLimiter,\n  RateLimitError,\n} from './rate-limiter.js';\n"]}

package/dist/agentic-flow/src/security/input-validation.d.ts

@@ -1,60 +0,0 @@
-/**
- * Input Validation Security Module
- * Centralized validation for all user inputs
- */
-export interface ValidationOptions {
-    maxLength?: number;
-    minLength?: number;
-    allowEmpty?: boolean;
-    pattern?: RegExp;
-    allowedValues?: string[];
-}
-export declare class InputValidator {
-    /**
-     * Validate string input
-     */
-    validateString(input: string, fieldName: string, options?: ValidationOptions): string;
-    /**
-     * Validate language identifier (for Agent Booster)
-     */
-    validateLanguage(language: string): string;
-    /**
-     * Validate run ID format
-     */
-    validateRunId(runId: string): string;
-    /**
-     * Validate memory key format
-     */
-    validateMemoryKey(key: string): string;
-    /**
-     * Sanitize HTML to prevent XSS
-     */
-    sanitizeHtml(input: string): string;
-    /**
-     * Validate and sanitize memory value
-     */
-    validateMemoryValue(value: any, maxSize?: number): any;
-    /**
-     * Validate task description
-     */
-    validateTaskDescription(description: string): string;
-    /**
-     * Validate number within range
-     */
-    validateNumber(input: number, fieldName: string, min?: number, max?: number): number;
-    /**
-     * Validate array
-     */
-    validateArray<T>(input: T[], fieldName: string, maxLength?: number): T[];
-    /**
-     * Validate metadata object
-     */
-    validateMetadata(metadata: Record<string, any>, maxSize?: number): Record<string, any>;
-    /**
-     * Validate provenance object
-     */
-    validateProvenance(provenance: Record<string, any>): Record<string, any>;
-}
-export declare const inputValidator: InputValidator;
-export declare const validateString: (input: string, fieldName: string, options?: ValidationOptions) => string, validateLanguage: (language: string) => string, validateRunId: (runId: string) => string, validateMemoryKey: (key: string) => string, sanitizeHtml: (input: string) => string, validateMemoryValue: (value: any, maxSize?: number) => any, validateTaskDescription: (description: string) => string, validateNumber: (input: number, fieldName: string, min?: number, max?: number) => number, validateArray: <T>(input: T[], fieldName: string, maxLength?: number) => T[], validateMetadata: (metadata: Record<string, any>, maxSize?: number) => Record<string, any>, validateProvenance: (provenance: Record<string, any>) => Record<string, any>;
-//# sourceMappingURL=input-validation.d.ts.map

package/dist/agentic-flow/src/security/input-validation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"input-validation.d.ts","sourceRoot":"","sources":["../../../../src/security/input-validation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,qBAAa,cAAc;IACzB;;OAEG;IACH,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,iBAAsB,GAC9B,MAAM;IAyCT;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAwB1C;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAQpC;;OAEG;IACH,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAQtC;;OAEG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAInC;;OAEG;IACH,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,GAAE,MAAe,GAAG,GAAG;IA4B9D;;OAEG;IACH,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAOpD;;OAEG;IACH,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,GACX,MAAM;IAgBT;;OAEG;IACH,aAAa,CAAC,CAAC,EACb,KAAK,EAAE,CAAC,EAAE,EACV,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,CAAC,EAAE;IAYN;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,GAAE,MAAc,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAqB7F;;OAEG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;CAYzE;AAGD,eAAO,MAAM,cAAc,gBAAuB,CAAC;AAGnD,eAAO,MACL,cAAc,UAtOL,MAAM,aACF,MAAM,YACR,iBAAiB,KACzB,MAAM,EAoOT,gBAAgB,aAxLW,MAAM,KAAG,MAAM,EAyL1C,aAAa,UA9JQ,MAAM,KAAG,MAAM,EA+JpC,iBAAiB,QApJM,MAAM,KAAG,MAAM,EAqJtC,YAAY,UA1IQ,MAAM,KAAG,MAAM,EA2InC,mBAAmB,UApIQ,GAAG,YAAW,MAAM,KAAY,GAAG,EAqI9D,uBAAuB,gBAtGc,MAAM,KAAG,MAAM,EAuGpD,cAAc,UA5FL,MAAM,aACF,MAAM,QACX,MAAM,QACN,MAAM,KACX,MAAM,EAyFT,aAAa,GAtEC,CAAC,SACN,CAAC,EAAE,aACC,MAAM,cACL,MAAM,KACjB,CAAC,EAAE,EAmEN,gBAAgB,aApDW,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,YAAW,MAAM,KAAW,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAqD7F,kBAAkB,eA7Ba,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CA8BvD,CAAC"}

package/dist/agentic-flow/src/security/input-validation.js

@@ -1,192 +0,0 @@
-/**
- * Input Validation Security Module
- * Centralized validation for all user inputs
- */
-import validator from 'validator';
-export class InputValidator {
-    /**
-     * Validate string input
-     */
-    validateString(input, fieldName, options = {}) {
-        // Type check
-        if (typeof input !== 'string') {
-            throw new Error(`${fieldName} must be a string`);
-        }
-        // Empty check
-        if (!options.allowEmpty && input.trim().length === 0) {
-            throw new Error(`${fieldName} cannot be empty`);
-        }
-        // Length checks
-        if (options.minLength && input.length < options.minLength) {
-            throw new Error(`${fieldName} must be at least ${options.minLength} characters`);
-        }
-        if (options.maxLength && input.length > options.maxLength) {
-            throw new Error(`${fieldName} exceeds maximum length of ${options.maxLength}`);
-        }
-        // Pattern matching
-        if (options.pattern && !options.pattern.test(input)) {
-            throw new Error(`${fieldName} format is invalid`);
-        }
-        // Allowed values
-        if (options.allowedValues && !options.allowedValues.includes(input)) {
-            throw new Error(`${fieldName} must be one of: ${options.allowedValues.join(', ')}`);
-        }
-        // Remove null bytes
-        if (input.includes('\0') || input.includes('\x00')) {
-            throw new Error(`${fieldName} contains null bytes`);
-        }
-        // Remove control characters (except newline, tab)
-        const sanitized = input.replace(/[\x00-\x08\x0B-\x0C\x0E-\x1F\x7F]/g, '');
-        return sanitized;
-    }
-    /**
-     * Validate language identifier (for Agent Booster)
-     */
-    validateLanguage(language) {
-        const allowedLanguages = [
-            'typescript',
-            'javascript',
-            'python',
-            'rust',
-            'go',
-            'java',
-            'c',
-            'cpp',
-            'csharp',
-            'ruby',
-            'php',
-            'swift',
-            'kotlin',
-            'scala',
-        ];
-        return this.validateString(language, 'language', {
-            allowedValues: allowedLanguages,
-            maxLength: 20,
-        });
-    }
-    /**
-     * Validate run ID format
-     */
-    validateRunId(runId) {
-        return this.validateString(runId, 'runId', {
-            pattern: /^[a-zA-Z0-9_-]+$/,
-            minLength: 1,
-            maxLength: 128,
-        });
-    }
-    /**
-     * Validate memory key format
-     */
-    validateMemoryKey(key) {
-        return this.validateString(key, 'memory key', {
-            pattern: /^[a-zA-Z0-9_-]+$/,
-            minLength: 1,
-            maxLength: 256,
-        });
-    }
-    /**
-     * Sanitize HTML to prevent XSS
-     */
-    sanitizeHtml(input) {
-        return validator.escape(input);
-    }
-    /**
-     * Validate and sanitize memory value
-     */
-    validateMemoryValue(value, maxSize = 100000) {
-        if (typeof value === 'string') {
-            // Remove null bytes and control characters
-            let sanitized = value.replace(/[\x00-\x1F\x7F]/g, '');
-            // Escape HTML for UI safety
-            sanitized = validator.escape(sanitized);
-            // Check size
-            if (sanitized.length > maxSize) {
-                throw new Error(`Memory value exceeds maximum size of ${maxSize} bytes`);
-            }
-            return sanitized;
-        }
-        // For objects, check JSON size
-        if (typeof value === 'object') {
-            const jsonStr = JSON.stringify(value);
-            if (jsonStr.length > maxSize) {
-                throw new Error(`Memory value exceeds maximum size of ${maxSize} bytes`);
-            }
-            return value;
-        }
-        return value;
-    }
-    /**
-     * Validate task description
-     */
-    validateTaskDescription(description) {
-        return this.validateString(description, 'task description', {
-            minLength: 1,
-            maxLength: 10000,
-        });
-    }
-    /**
-     * Validate number within range
-     */
-    validateNumber(input, fieldName, min, max) {
-        if (typeof input !== 'number' || isNaN(input)) {
-            throw new Error(`${fieldName} must be a valid number`);
-        }
-        if (min !== undefined && input < min) {
-            throw new Error(`${fieldName} must be at least ${min}`);
-        }
-        if (max !== undefined && input > max) {
-            throw new Error(`${fieldName} must be at most ${max}`);
-        }
-        return input;
-    }
-    /**
-     * Validate array
-     */
-    validateArray(input, fieldName, maxLength) {
-        if (!Array.isArray(input)) {
-            throw new Error(`${fieldName} must be an array`);
-        }
-        if (maxLength && input.length > maxLength) {
-            throw new Error(`${fieldName} exceeds maximum length of ${maxLength}`);
-        }
-        return input;
-    }
-    /**
-     * Validate metadata object
-     */
-    validateMetadata(metadata, maxSize = 10000) {
-        if (typeof metadata !== 'object' || metadata === null || Array.isArray(metadata)) {
-            throw new Error('Metadata must be a plain object');
-        }
-        const jsonStr = JSON.stringify(metadata);
-        if (jsonStr.length > maxSize) {
-            throw new Error(`Metadata exceeds maximum size of ${maxSize} bytes`);
-        }
-        // Check for suspicious keys
-        const suspiciousKeys = ['__proto__', 'constructor', 'prototype'];
-        for (const key of Object.keys(metadata)) {
-            if (suspiciousKeys.includes(key)) {
-                throw new Error(`Metadata contains forbidden key: ${key}`);
-            }
-        }
-        return metadata;
-    }
-    /**
-     * Validate provenance object
-     */
-    validateProvenance(provenance) {
-        const validated = this.validateMetadata(provenance);
-        // Check for path traversal in values
-        for (const [key, value] of Object.entries(validated)) {
-            if (typeof value === 'string' && (value.includes('..') || value.startsWith('/'))) {
-                throw new Error(`Path traversal detected in provenance.${key}: ${value}`);
-            }
-        }
-        return validated;
-    }
-}
-// Singleton instance
-export const inputValidator = new InputValidator();
-// Convenience exports
-export const { validateString, validateLanguage, validateRunId, validateMemoryKey, sanitizeHtml, validateMemoryValue, validateTaskDescription, validateNumber, validateArray, validateMetadata, validateProvenance, } = inputValidator;
-//# sourceMappingURL=input-validation.js.map

package/dist/agentic-flow/src/security/input-validation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"input-validation.js","sourceRoot":"","sources":["../../../../src/security/input-validation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,SAAS,MAAM,WAAW,CAAC;AAUlC,MAAM,OAAO,cAAc;IACzB;;OAEG;IACH,cAAc,CACZ,KAAa,EACb,SAAiB,EACjB,UAA6B,EAAE;QAE/B,aAAa;QACb,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,mBAAmB,CAAC,CAAC;QACnD,CAAC;QAED,cAAc;QACd,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,kBAAkB,CAAC,CAAC;QAClD,CAAC;QAED,gBAAgB;QAChB,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,qBAAqB,OAAO,CAAC,SAAS,aAAa,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,8BAA8B,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,mBAAmB;QACnB,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,oBAAoB,CAAC,CAAC;QACpD,CAAC;QAED,iBAAiB;QACjB,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,oBAAoB,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,oBAAoB;QACpB,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAED,kDAAkD;QAClD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;QAE1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAAgB;QAC/B,MAAM,gBAAgB,GAAG;YACvB,YAAY;YACZ,YAAY;YACZ,QAAQ;YACR,MAAM;YACN,IAAI;YACJ,MAAM;YACN,GAAG;YACH,KAAK;YACL,QAAQ;YACR,MAAM;YACN,KAAK;YACL,OAAO;YACP,QAAQ;YACR,OAAO;SACR,CAAC;QAEF,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE;YAC/C,aAAa,EAAE,gBAAgB;YAC/B,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAa;QACzB,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE;YACzC,OAAO,EAAE,kBAAkB;YAC3B,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,GAAW;QAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE;YAC5C,OAAO,EAAE,kBAAkB;YAC3B,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,KAAa;QACxB,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,KAAU,EAAE,UAAkB,MAAM;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,2CAA2C;YAC3C,IAAI,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;YAEtD,4BAA4B;YAC5B,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAExC,aAAa;YACb,IAAI,SAAS,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,QAAQ,CAAC,CAAC;YAC3E,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,+BAA+B;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,QAAQ,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,WAAmB;QACzC,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,kBAAkB,EAAE;YAC1D,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,KAAa,EACb,SAAiB,EACjB,GAAY,EACZ,GAAY;QAEZ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,yBAAyB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,qBAAqB,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,oBAAoB,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,aAAa,CACX,KAAU,EACV,SAAiB,EACjB,SAAkB;QAElB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,mBAAmB,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,8BAA8B,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAA6B,EAAE,UAAkB,KAAK;QACrE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,QAAQ,CAAC,CAAC;QACvE,CAAC;QAED,4BAA4B;QAC5B,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;QACjE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,UAA+B;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAEpD,qCAAqC;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,qBAAqB;AACrB,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;AAEnD,sBAAsB;AACtB,MAAM,CAAC,MAAM,EACX,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,kBAAkB,GACnB,GAAG,cAAc,CAAC","sourcesContent":["/**\n * Input Validation Security Module\n * Centralized validation for all user inputs\n */\n\nimport validator from 'validator';\n\nexport interface ValidationOptions {\n  maxLength?: number;\n  minLength?: number;\n  allowEmpty?: boolean;\n  pattern?: RegExp;\n  allowedValues?: string[];\n}\n\nexport class InputValidator {\n  /**\n   * Validate string input\n   */\n  validateString(\n    input: string,\n    fieldName: string,\n    options: ValidationOptions = {}\n  ): string {\n    // Type check\n    if (typeof input !== 'string') {\n      throw new Error(`${fieldName} must be a string`);\n    }\n\n    // Empty check\n    if (!options.allowEmpty && input.trim().length === 0) {\n      throw new Error(`${fieldName} cannot be empty`);\n    }\n\n    // Length checks\n    if (options.minLength && input.length < options.minLength) {\n      throw new Error(`${fieldName} must be at least ${options.minLength} characters`);\n    }\n\n    if (options.maxLength && input.length > options.maxLength) {\n      throw new Error(`${fieldName} exceeds maximum length of ${options.maxLength}`);\n    }\n\n    // Pattern matching\n    if (options.pattern && !options.pattern.test(input)) {\n      throw new Error(`${fieldName} format is invalid`);\n    }\n\n    // Allowed values\n    if (options.allowedValues && !options.allowedValues.includes(input)) {\n      throw new Error(`${fieldName} must be one of: ${options.allowedValues.join(', ')}`);\n    }\n\n    // Remove null bytes\n    if (input.includes('\\0') || input.includes('\\x00')) {\n      throw new Error(`${fieldName} contains null bytes`);\n    }\n\n    // Remove control characters (except newline, tab)\n    const sanitized = input.replace(/[\\x00-\\x08\\x0B-\\x0C\\x0E-\\x1F\\x7F]/g, '');\n\n    return sanitized;\n  }\n\n  /**\n   * Validate language identifier (for Agent Booster)\n   */\n  validateLanguage(language: string): string {\n    const allowedLanguages = [\n      'typescript',\n      'javascript',\n      'python',\n      'rust',\n      'go',\n      'java',\n      'c',\n      'cpp',\n      'csharp',\n      'ruby',\n      'php',\n      'swift',\n      'kotlin',\n      'scala',\n    ];\n\n    return this.validateString(language, 'language', {\n      allowedValues: allowedLanguages,\n      maxLength: 20,\n    });\n  }\n\n  /**\n   * Validate run ID format\n   */\n  validateRunId(runId: string): string {\n    return this.validateString(runId, 'runId', {\n      pattern: /^[a-zA-Z0-9_-]+$/,\n      minLength: 1,\n      maxLength: 128,\n    });\n  }\n\n  /**\n   * Validate memory key format\n   */\n  validateMemoryKey(key: string): string {\n    return this.validateString(key, 'memory key', {\n      pattern: /^[a-zA-Z0-9_-]+$/,\n      minLength: 1,\n      maxLength: 256,\n    });\n  }\n\n  /**\n   * Sanitize HTML to prevent XSS\n   */\n  sanitizeHtml(input: string): string {\n    return validator.escape(input);\n  }\n\n  /**\n   * Validate and sanitize memory value\n   */\n  validateMemoryValue(value: any, maxSize: number = 100000): any {\n    if (typeof value === 'string') {\n      // Remove null bytes and control characters\n      let sanitized = value.replace(/[\\x00-\\x1F\\x7F]/g, '');\n\n      // Escape HTML for UI safety\n      sanitized = validator.escape(sanitized);\n\n      // Check size\n      if (sanitized.length > maxSize) {\n        throw new Error(`Memory value exceeds maximum size of ${maxSize} bytes`);\n      }\n\n      return sanitized;\n    }\n\n    // For objects, check JSON size\n    if (typeof value === 'object') {\n      const jsonStr = JSON.stringify(value);\n      if (jsonStr.length > maxSize) {\n        throw new Error(`Memory value exceeds maximum size of ${maxSize} bytes`);\n      }\n      return value;\n    }\n\n    return value;\n  }\n\n  /**\n   * Validate task description\n   */\n  validateTaskDescription(description: string): string {\n    return this.validateString(description, 'task description', {\n      minLength: 1,\n      maxLength: 10000,\n    });\n  }\n\n  /**\n   * Validate number within range\n   */\n  validateNumber(\n    input: number,\n    fieldName: string,\n    min?: number,\n    max?: number\n  ): number {\n    if (typeof input !== 'number' || isNaN(input)) {\n      throw new Error(`${fieldName} must be a valid number`);\n    }\n\n    if (min !== undefined && input < min) {\n      throw new Error(`${fieldName} must be at least ${min}`);\n    }\n\n    if (max !== undefined && input > max) {\n      throw new Error(`${fieldName} must be at most ${max}`);\n    }\n\n    return input;\n  }\n\n  /**\n   * Validate array\n   */\n  validateArray<T>(\n    input: T[],\n    fieldName: string,\n    maxLength?: number\n  ): T[] {\n    if (!Array.isArray(input)) {\n      throw new Error(`${fieldName} must be an array`);\n    }\n\n    if (maxLength && input.length > maxLength) {\n      throw new Error(`${fieldName} exceeds maximum length of ${maxLength}`);\n    }\n\n    return input;\n  }\n\n  /**\n   * Validate metadata object\n   */\n  validateMetadata(metadata: Record<string, any>, maxSize: number = 10000): Record<string, any> {\n    if (typeof metadata !== 'object' || metadata === null || Array.isArray(metadata)) {\n      throw new Error('Metadata must be a plain object');\n    }\n\n    const jsonStr = JSON.stringify(metadata);\n    if (jsonStr.length > maxSize) {\n      throw new Error(`Metadata exceeds maximum size of ${maxSize} bytes`);\n    }\n\n    // Check for suspicious keys\n    const suspiciousKeys = ['__proto__', 'constructor', 'prototype'];\n    for (const key of Object.keys(metadata)) {\n      if (suspiciousKeys.includes(key)) {\n        throw new Error(`Metadata contains forbidden key: ${key}`);\n      }\n    }\n\n    return metadata;\n  }\n\n  /**\n   * Validate provenance object\n   */\n  validateProvenance(provenance: Record<string, any>): Record<string, any> {\n    const validated = this.validateMetadata(provenance);\n\n    // Check for path traversal in values\n    for (const [key, value] of Object.entries(validated)) {\n      if (typeof value === 'string' && (value.includes('..') || value.startsWith('/'))) {\n        throw new Error(`Path traversal detected in provenance.${key}: ${value}`);\n      }\n    }\n\n    return validated;\n  }\n}\n\n// Singleton instance\nexport const inputValidator = new InputValidator();\n\n// Convenience exports\nexport const {\n  validateString,\n  validateLanguage,\n  validateRunId,\n  validateMemoryKey,\n  sanitizeHtml,\n  validateMemoryValue,\n  validateTaskDescription,\n  validateNumber,\n  validateArray,\n  validateMetadata,\n  validateProvenance,\n} = inputValidator;\n"]}

package/dist/agentic-flow/src/security/path-validator.d.ts

@@ -1,47 +0,0 @@
-/**
- * Path Validation Security Module
- * Prevents path traversal attacks (CVE-2026-004)
- */
-export interface PathValidationOptions {
-    allowedDir?: string;
-    blockedPaths?: string[];
-    allowAbsolute?: boolean;
-    mustExist?: boolean;
-    mustBeFile?: boolean;
-    mustBeDirectory?: boolean;
-}
-export declare class PathValidator {
-    private allowedDir;
-    private blockedPaths;
-    constructor(allowedDir?: string, blockedPaths?: string[]);
-    /**
-     * Validate a file path against traversal and sensitive path attacks
-     */
-    validate(filePath: string, options?: PathValidationOptions): string;
-    /**
-     * Validate multiple paths at once
-     */
-    validateMany(paths: string[], options?: PathValidationOptions): string[];
-    /**
-     * Check if a path is safe without throwing
-     */
-    isSafe(filePath: string, options?: PathValidationOptions): boolean;
-}
-export declare const pathValidator: PathValidator;
-/**
- * Quick validation helper
- */
-export declare function validateFilePath(filePath: string, allowedDir?: string, options?: PathValidationOptions): string;
-/**
- * Validate path is safe to read
- */
-export declare function validateReadPath(filePath: string, allowedDir?: string): string;
-/**
- * Validate path is safe to write
- */
-export declare function validateWritePath(filePath: string, allowedDir?: string): string;
-/**
- * Validate directory path
- */
-export declare function validateDirPath(filePath: string, allowedDir?: string): string;
-//# sourceMappingURL=path-validator.d.ts.map

package/dist/agentic-flow/src/security/path-validator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"path-validator.d.ts","sourceRoot":"","sources":["../../../../src/security/path-validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAqBD,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,YAAY,CAAW;gBAEnB,UAAU,GAAE,MAAsB,EAAE,YAAY,GAAE,MAAM,EAA0B;IAK9F;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM;IAqEvE;;OAEG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE,qBAA0B,GAAG,MAAM,EAAE;IAI5E;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO;CAQvE;AAGD,eAAO,MAAM,aAAa,eAAsB,CAAC;AAEjD;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,MAAsB,EAClC,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAGR;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAK9E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAI/E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAK7E"}

package/dist/agentic-flow/src/security/path-validator.js

@@ -1,144 +0,0 @@
-/**
- * Path Validation Security Module
- * Prevents path traversal attacks (CVE-2026-004)
- */
-import { resolve, relative, isAbsolute, normalize } from 'path';
-import { existsSync, statSync } from 'fs';
-const DEFAULT_BLOCKED_PATHS = [
-    '/etc/',
-    '/sys/',
-    '/proc/',
-    '/dev/',
-    '/root/',
-    '.env',
-    '.git/',
-    'node_modules/',
-    '.ssh/',
-    '.aws/',
-    '.config/',
-    'id_rsa',
-    'id_ed25519',
-    'credentials',
-    'secret',
-    'private',
-];
-export class PathValidator {
-    allowedDir;
-    blockedPaths;
-    constructor(allowedDir = process.cwd(), blockedPaths = DEFAULT_BLOCKED_PATHS) {
-        this.allowedDir = resolve(allowedDir);
-        this.blockedPaths = [...blockedPaths];
-    }
-    /**
-     * Validate a file path against traversal and sensitive path attacks
-     */
-    validate(filePath, options = {}) {
-        // 1. Basic validation
-        if (!filePath || typeof filePath !== 'string') {
-            throw new Error('Invalid file path: must be a non-empty string');
-        }
-        if (filePath.length > 4096) {
-            throw new Error('File path too long (max 4096 characters)');
-        }
-        // 2. Normalize and resolve path
-        const normalizedPath = normalize(filePath);
-        const resolvedPath = resolve(normalizedPath);
-        // 3. Check for null bytes (common attack vector)
-        if (filePath.includes('\0') || filePath.includes('\x00')) {
-            throw new Error('Path contains null bytes');
-        }
-        // 4. Check for path traversal patterns
-        if (filePath.includes('..') && !options.allowAbsolute) {
-            // Additional check: ensure resolved path doesn't escape allowed dir
-            const allowedDirResolved = resolve(options.allowedDir || this.allowedDir);
-            const relativePath = relative(allowedDirResolved, resolvedPath);
-            if (relativePath.startsWith('..') || isAbsolute(relativePath)) {
-                throw new Error(`Path traversal detected: ${filePath}`);
-            }
-        }
-        // 5. Check if path is within allowed directory
-        if (!options.allowAbsolute) {
-            const allowedDirResolved = resolve(options.allowedDir || this.allowedDir);
-            const relativePath = relative(allowedDirResolved, resolvedPath);
-            if (relativePath.startsWith('..') || isAbsolute(relativePath)) {
-                throw new Error(`Path outside allowed directory: ${filePath}`);
-            }
-        }
-        // 6. Check against blocked paths
-        const blockedPaths = options.blockedPaths || this.blockedPaths;
-        for (const blocked of blockedPaths) {
-            if (resolvedPath.toLowerCase().includes(blocked.toLowerCase())) {
-                throw new Error(`Access to blocked path: ${blocked}`);
-            }
-        }
-        // 7. Existence checks
-        if (options.mustExist && !existsSync(resolvedPath)) {
-            throw new Error(`Path does not exist: ${filePath}`);
-        }
-        // 8. Type checks
-        if (existsSync(resolvedPath)) {
-            const stats = statSync(resolvedPath);
-            if (options.mustBeFile && !stats.isFile()) {
-                throw new Error(`Path is not a file: ${filePath}`);
-            }
-            if (options.mustBeDirectory && !stats.isDirectory()) {
-                throw new Error(`Path is not a directory: ${filePath}`);
-            }
-        }
-        return resolvedPath;
-    }
-    /**
-     * Validate multiple paths at once
-     */
-    validateMany(paths, options = {}) {
-        return paths.map(path => this.validate(path, options));
-    }
-    /**
-     * Check if a path is safe without throwing
-     */
-    isSafe(filePath, options = {}) {
-        try {
-            this.validate(filePath, options);
-            return true;
-        }
-        catch {
-            return false;
-        }
-    }
-}
-// Singleton instance for convenience
-export const pathValidator = new PathValidator();
-/**
- * Quick validation helper
- */
-export function validateFilePath(filePath, allowedDir = process.cwd(), options = {}) {
-    const validator = new PathValidator(allowedDir);
-    return validator.validate(filePath, options);
-}
-/**
- * Validate path is safe to read
- */
-export function validateReadPath(filePath, allowedDir) {
-    return validateFilePath(filePath, allowedDir, {
-        mustExist: true,
-        mustBeFile: true,
-    });
-}
-/**
- * Validate path is safe to write
- */
-export function validateWritePath(filePath, allowedDir) {
-    return validateFilePath(filePath, allowedDir, {
-        mustBeFile: false, // File may not exist yet
-    });
-}
-/**
- * Validate directory path
- */
-export function validateDirPath(filePath, allowedDir) {
-    return validateFilePath(filePath, allowedDir, {
-        mustExist: true,
-        mustBeDirectory: true,
-    });
-}
-//# sourceMappingURL=path-validator.js.map

package/dist/agentic-flow/src/security/path-validator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"path-validator.js","sourceRoot":"","sources":["../../../../src/security/path-validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAW1C,MAAM,qBAAqB,GAAG;IAC5B,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,eAAe;IACf,OAAO;IACP,OAAO;IACP,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,SAAS;CACV,CAAC;AAEF,MAAM,OAAO,aAAa;IAChB,UAAU,CAAS;IACnB,YAAY,CAAW;IAE/B,YAAY,aAAqB,OAAO,CAAC,GAAG,EAAE,EAAE,eAAyB,qBAAqB;QAC5F,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB,EAAE,UAAiC,EAAE;QAC5D,sBAAsB;QACtB,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QAE7C,iDAAiD;QACjD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,uCAAuC;QACvC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,oEAAoE;YACpE,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;YAEhE,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;YAEhE,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC;QAC/D,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,iBAAiB;QACjB,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;YAErC,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,EAAE,CAAC,CAAC;YACrD,CAAC;YAED,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,KAAe,EAAE,UAAiC,EAAE;QAC/D,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAgB,EAAE,UAAiC,EAAE;QAC1D,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,qCAAqC;AACrC,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;AAEjD;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,aAAqB,OAAO,CAAC,GAAG,EAAE,EAClC,UAAiC,EAAE;IAEnC,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,UAAmB;IACpE,OAAO,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE;QAC5C,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,UAAmB;IACrE,OAAO,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE;QAC5C,UAAU,EAAE,KAAK,EAAE,yBAAyB;KAC7C,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,UAAmB;IACnE,OAAO,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE;QAC5C,SAAS,EAAE,IAAI;QACf,eAAe,EAAE,IAAI;KACtB,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Path Validation Security Module\n * Prevents path traversal attacks (CVE-2026-004)\n */\n\nimport { resolve, relative, isAbsolute, normalize } from 'path';\nimport { existsSync, statSync } from 'fs';\n\nexport interface PathValidationOptions {\n  allowedDir?: string;\n  blockedPaths?: string[];\n  allowAbsolute?: boolean;\n  mustExist?: boolean;\n  mustBeFile?: boolean;\n  mustBeDirectory?: boolean;\n}\n\nconst DEFAULT_BLOCKED_PATHS = [\n  '/etc/',\n  '/sys/',\n  '/proc/',\n  '/dev/',\n  '/root/',\n  '.env',\n  '.git/',\n  'node_modules/',\n  '.ssh/',\n  '.aws/',\n  '.config/',\n  'id_rsa',\n  'id_ed25519',\n  'credentials',\n  'secret',\n  'private',\n];\n\nexport class PathValidator {\n  private allowedDir: string;\n  private blockedPaths: string[];\n\n  constructor(allowedDir: string = process.cwd(), blockedPaths: string[] = DEFAULT_BLOCKED_PATHS) {\n    this.allowedDir = resolve(allowedDir);\n    this.blockedPaths = [...blockedPaths];\n  }\n\n  /**\n   * Validate a file path against traversal and sensitive path attacks\n   */\n  validate(filePath: string, options: PathValidationOptions = {}): string {\n    // 1. Basic validation\n    if (!filePath || typeof filePath !== 'string') {\n      throw new Error('Invalid file path: must be a non-empty string');\n    }\n\n    if (filePath.length > 4096) {\n      throw new Error('File path too long (max 4096 characters)');\n    }\n\n    // 2. Normalize and resolve path\n    const normalizedPath = normalize(filePath);\n    const resolvedPath = resolve(normalizedPath);\n\n    // 3. Check for null bytes (common attack vector)\n    if (filePath.includes('\\0') || filePath.includes('\\x00')) {\n      throw new Error('Path contains null bytes');\n    }\n\n    // 4. Check for path traversal patterns\n    if (filePath.includes('..') && !options.allowAbsolute) {\n      // Additional check: ensure resolved path doesn't escape allowed dir\n      const allowedDirResolved = resolve(options.allowedDir || this.allowedDir);\n      const relativePath = relative(allowedDirResolved, resolvedPath);\n\n      if (relativePath.startsWith('..') || isAbsolute(relativePath)) {\n        throw new Error(`Path traversal detected: ${filePath}`);\n      }\n    }\n\n    // 5. Check if path is within allowed directory\n    if (!options.allowAbsolute) {\n      const allowedDirResolved = resolve(options.allowedDir || this.allowedDir);\n      const relativePath = relative(allowedDirResolved, resolvedPath);\n\n      if (relativePath.startsWith('..') || isAbsolute(relativePath)) {\n        throw new Error(`Path outside allowed directory: ${filePath}`);\n      }\n    }\n\n    // 6. Check against blocked paths\n    const blockedPaths = options.blockedPaths || this.blockedPaths;\n    for (const blocked of blockedPaths) {\n      if (resolvedPath.toLowerCase().includes(blocked.toLowerCase())) {\n        throw new Error(`Access to blocked path: ${blocked}`);\n      }\n    }\n\n    // 7. Existence checks\n    if (options.mustExist && !existsSync(resolvedPath)) {\n      throw new Error(`Path does not exist: ${filePath}`);\n    }\n\n    // 8. Type checks\n    if (existsSync(resolvedPath)) {\n      const stats = statSync(resolvedPath);\n\n      if (options.mustBeFile && !stats.isFile()) {\n        throw new Error(`Path is not a file: ${filePath}`);\n      }\n\n      if (options.mustBeDirectory && !stats.isDirectory()) {\n        throw new Error(`Path is not a directory: ${filePath}`);\n      }\n    }\n\n    return resolvedPath;\n  }\n\n  /**\n   * Validate multiple paths at once\n   */\n  validateMany(paths: string[], options: PathValidationOptions = {}): string[] {\n    return paths.map(path => this.validate(path, options));\n  }\n\n  /**\n   * Check if a path is safe without throwing\n   */\n  isSafe(filePath: string, options: PathValidationOptions = {}): boolean {\n    try {\n      this.validate(filePath, options);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n\n// Singleton instance for convenience\nexport const pathValidator = new PathValidator();\n\n/**\n * Quick validation helper\n */\nexport function validateFilePath(\n  filePath: string,\n  allowedDir: string = process.cwd(),\n  options: PathValidationOptions = {}\n): string {\n  const validator = new PathValidator(allowedDir);\n  return validator.validate(filePath, options);\n}\n\n/**\n * Validate path is safe to read\n */\nexport function validateReadPath(filePath: string, allowedDir?: string): string {\n  return validateFilePath(filePath, allowedDir, {\n    mustExist: true,\n    mustBeFile: true,\n  });\n}\n\n/**\n * Validate path is safe to write\n */\nexport function validateWritePath(filePath: string, allowedDir?: string): string {\n  return validateFilePath(filePath, allowedDir, {\n    mustBeFile: false, // File may not exist yet\n  });\n}\n\n/**\n * Validate directory path\n */\nexport function validateDirPath(filePath: string, allowedDir?: string): string {\n  return validateFilePath(filePath, allowedDir, {\n    mustExist: true,\n    mustBeDirectory: true,\n  });\n}\n"]}

package/dist/agentic-flow/src/security/rate-limiter.d.ts

@@ -1,68 +0,0 @@
-/**
- * Rate Limiting Security Module
- * Prevents DoS attacks (VUL-010)
- */
-export interface RateLimitConfig {
-    maxRequests: number;
-    windowMs: number;
-    keyGenerator?: (context: any) => string;
-}
-export interface RateLimitInfo {
-    remaining: number;
-    resetTime: number;
-    retryAfter?: number;
-}
-export declare class RateLimiter {
-    private requests;
-    private config;
-    constructor(config: RateLimitConfig);
-    /**
-     * Check if request should be allowed
-     */
-    consume(key?: string): Promise<RateLimitInfo>;
-    /**
-     * Get current limit status without consuming
-     */
-    getStatus(key?: string): RateLimitInfo;
-    /**
-     * Reset limit for a specific key
-     */
-    reset(key?: string): void;
-    /**
-     * Cleanup expired entries
-     */
-    private cleanup;
-}
-export declare class RateLimitError extends Error {
-    info: RateLimitInfo;
-    constructor(message: string, info: RateLimitInfo);
-}
-export declare const orchestrationLimiter: RateLimiter;
-export declare const memoryOperationLimiter: RateLimiter;
-export declare const fileOperationLimiter: RateLimiter;
-/**
- * Max concurrent runs tracker
- */
-export declare class ConcurrencyLimiter {
-    private activeRuns;
-    private maxConcurrent;
-    constructor(maxConcurrent?: number);
-    /**
-     * Acquire a run slot
-     */
-    acquire(runId: string): void;
-    /**
-     * Release a run slot
-     */
-    release(runId: string): void;
-    /**
-     * Get current status
-     */
-    getStatus(): {
-        active: number;
-        available: number;
-        max: number;
-    };
-}
-export declare const concurrencyLimiter: ConcurrencyLimiter;
-//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/agentic-flow/src/security/rate-limiter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../../src/security/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAoC;IACpD,OAAO,CAAC,MAAM,CAAkB;gBAEpB,MAAM,EAAE,eAAe;IAOnC;;OAEG;IACG,OAAO,CAAC,GAAG,GAAE,MAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;IAmC9D;;OAEG;IACH,SAAS,CAAC,GAAG,GAAE,MAAkB,GAAG,aAAa;IAcjD;;OAEG;IACH,KAAK,CAAC,GAAG,GAAE,MAAkB,GAAG,IAAI;IAIpC;;OAEG;IACH,OAAO,CAAC,OAAO;CAchB;AAED,qBAAa,cAAe,SAAQ,KAAK;IAG9B,IAAI,EAAE,aAAa;gBAD1B,OAAO,EAAE,MAAM,EACR,IAAI,EAAE,aAAa;CAK7B;AAGD,eAAO,MAAM,oBAAoB,aAG/B,CAAC;AAEH,eAAO,MAAM,sBAAsB,aAGjC,CAAC;AAEH,eAAO,MAAM,oBAAoB,aAG/B,CAAC;AAEH;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,UAAU,CAA0B;IAC5C,OAAO,CAAC,aAAa,CAAS;gBAElB,aAAa,GAAE,MAAY;IAIvC;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAU5B;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI5B;;OAEG;IACH,SAAS,IAAI;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;CAOhE;AAED,eAAO,MAAM,kBAAkB,oBAA8B,CAAC"}