claude-flow-novice 2.15.11 → 2.16.1

package/dist/lib/environment-contract.js

@@ -0,0 +1,258 @@
+/**
+ * Environment Variable Contract Resolver
+ *
+ * Provides single source of truth for environment variables with mode-specific overrides.
+ * Implements Phase 3 of CLI/Trigger.dev collision mitigation strategy.
+ *
+ * Reference: planning/trigger/CLI_TRIGGER_COLLISION_ANALYSIS.md (Phase 3)
+ * Contract: docker/runtime/cfn-runtime.contract.yml
+ *
+ * Variable Resolution Order (First Set Wins):
+ * 1. Mode-specific overrides (if specified in contract)
+ * 2. Environment variable with CFN_ prefix (standard)
+ * 3. Legacy environment variable (with deprecation warning)
+ * 4. Default value from contract
+ * 5. Error if no value found and required=true
+ *
+ * Usage:
+ *   import { getEnvValue } from './environment-contract';
+ *
+ *   // CLI mode - uses mcp-network
+ *   const cliRedisHost = getEnvValue('redis_host', 'cli');
+ *
+ *   // Trigger.dev mode - uses trigger-cfn-network
+ *   const triggerRedisHost = getEnvValue('redis_host', 'trigger');
+ *
+ *   // Environment override takes precedence
+ *   process.env.CFN_REDIS_HOST = 'custom-redis';
+ *   const overriddenHost = getEnvValue('redis_host', 'cli'); // Returns 'custom-redis'
+ */ import * as fs from 'fs';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+import * as yaml from 'js-yaml';
+// ESM-compatible __dirname
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+/**
+ * Loaded contract cache (lazy-loaded on first use)
+ */ let contractCache = null;
+/**
+ * Clears the contract cache (for testing purposes)
+ * @internal
+ */ export function _clearContractCache() {
+    contractCache = null;
+}
+/**
+ * Loads the environment variable contract from YAML file
+ * Cached after first load for performance
+ *
+ * @returns Contract specification mapping
+ * @throws Error if contract file not found or invalid YAML
+ */ function loadContract() {
+    if (contractCache) {
+        return contractCache;
+    }
+    const projectRoot = process.env.PROJECT_ROOT || path.resolve(__dirname, '../../');
+    const contractPath = path.resolve(projectRoot, 'docker/runtime/cfn-runtime.contract.yml');
+    if (!fs.existsSync(contractPath)) {
+        throw new Error(`Environment contract not found at ${contractPath}. ` + `Ensure docker/runtime/cfn-runtime.contract.yml exists.`);
+    }
+    const contractYaml = fs.readFileSync(contractPath, 'utf8');
+    const contractData = yaml.load(contractYaml);
+    // Flatten nested contract structure (e.g., redis.CFN_REDIS_HOST becomes redis_host)
+    contractCache = flattenContract(contractData);
+    return contractCache;
+}
+/**
+ * Flattens nested contract structure into flat key mapping
+ * Maps environment variable names (CFN_REDIS_HOST) to their specs
+ *
+ * @param nested - Nested contract from YAML
+ * @returns Flattened mapping with both simple keys and spec metadata
+ */ function flattenContract(nested) {
+    const flattened = {};
+    // Process each top-level category (redis, agent, task, etc.)
+    for (const [category, variables] of Object.entries(nested)){
+        // Skip metadata fields
+        if (category === 'version' || category === 'last_updated') {
+            continue;
+        }
+        if (typeof variables !== 'object' || variables === null) {
+            continue;
+        }
+        // Process each variable in category
+        for (const [envVarName, spec] of Object.entries(variables)){
+            if (typeof spec === 'object' && spec !== null) {
+                // Create a simple key from env var name (e.g., CFN_REDIS_HOST -> redis_host)
+                const simpleKey = envVarName.replace(/^CFN_/, '').toLowerCase().replace(/_/g, '_');
+                const specWithCfnName = {
+                    ...spec,
+                    _cfnVarName: envVarName
+                };
+                flattened[simpleKey] = specWithCfnName;
+            }
+        }
+    }
+    return flattened;
+}
+/**
+ * Gets environment value with mode-specific override support
+ *
+ * Resolution order:
+ * 1. Mode-specific override from contract (if defined)
+ * 2. CFN_-prefixed environment variable
+ * 3. Legacy environment variable (with warning)
+ * 4. Default from contract
+ * 5. Error if required and no value found
+ *
+ * @param key - Contract key (e.g., 'redis_host')
+ * @param mode - Execution mode ('cli' or 'trigger')
+ * @returns Resolved environment variable value as string
+ * @throws Error if key not found in contract or required value missing
+ */ export function getEnvValue(key, mode) {
+    const contract = loadContract();
+    const spec = contract[key];
+    if (!spec) {
+        throw new Error(`Unknown contract key: '${key}'. ` + `Available keys: ${Object.keys(contract).filter((k)=>!k.startsWith('_')).join(', ')}`);
+    }
+    // Get the CFN variable name for this spec
+    const cfnVarName = spec._cfnVarName || 'CFN_VAR';
+    // Step 1: Check CFN_ prefixed environment variable (highest priority explicit env var)
+    if (process.env[cfnVarName]) {
+        return process.env[cfnVarName];
+    }
+    // Step 2: Check legacy environment variables
+    if (spec.legacy_aliases && spec.legacy_aliases.length > 0) {
+        for (const legacy of spec.legacy_aliases){
+            if (process.env[legacy]) {
+                console.warn(`[ENV DEPRECATION] Using legacy environment variable '${legacy}', ` + `migrate to '${cfnVarName}' (see docker/runtime/cfn-runtime.contract.yml)`);
+                return process.env[legacy];
+            }
+        }
+    }
+    // Step 3: Use mode-specific override if no explicit env var was set
+    if (spec.modes?.[mode]?.override !== undefined) {
+        return String(spec.modes[mode].override);
+    }
+    // Step 4: Use default value
+    if (spec.default !== null && spec.default !== undefined) {
+        return String(spec.default);
+    }
+    // Step 5: Error if required
+    if (spec.required) {
+        throw new Error(`Required environment variable '${cfnVarName}' not set. ` + `See docker/runtime/cfn-runtime.contract.yml for configuration.`);
+    }
+    // No value found and not required - return empty string
+    return '';
+}
+/**
+ * Gets mode-specific network name from contract
+ *
+ * @param mode - Execution mode ('cli' or 'trigger')
+ * @returns Network name for the mode
+ */ export function getNetworkName(mode) {
+    const contract = loadContract();
+    const spec = contract['network_name'];
+    if (!spec) {
+        // Fallback to default if not in contract
+        return mode === 'cli' ? 'mcp-network' : 'trigger-cfn-network';
+    }
+    return getEnvValue('network_name', mode);
+}
+/**
+ * Gets all environment variables for a specific mode
+ * Useful for Docker environment setup
+ *
+ * @param mode - Execution mode ('cli' or 'trigger')
+ * @returns Object with resolved environment variables
+ */ export function getAllEnvValues(mode) {
+    const contract = loadContract();
+    const envVars = {};
+    for (const [key, spec] of Object.entries(contract)){
+        if (spec && typeof spec === 'object' && 'description' in spec) {
+            try {
+                const value = getEnvValue(key, mode);
+                if (value) {
+                    envVars[key] = value;
+                }
+            } catch  {
+            // Skip variables that can't be resolved (optional)
+            }
+        }
+    }
+    return envVars;
+}
+/**
+ * Validates an environment variable against contract rules
+ *
+ * @param key - Contract key
+ * @param value - Value to validate
+ * @returns Validation result with optional error message
+ */ export function validateEnvValue(key, value) {
+    const contract = loadContract();
+    const spec = contract[key];
+    if (!spec) {
+        return {
+            valid: false,
+            error: `Unknown contract key: '${key}'`
+        };
+    }
+    const rules = spec.validation;
+    if (!rules) {
+        return {
+            valid: true
+        };
+    }
+    // Pattern validation
+    if (rules.pattern) {
+        const regex = new RegExp(rules.pattern);
+        if (!regex.test(value)) {
+            return {
+                valid: false,
+                error: `Value '${value}' does not match pattern '${rules.pattern}'`
+            };
+        }
+    }
+    // Numeric validations
+    if (spec.type === 'integer' || spec.type === 'float') {
+        const numValue = spec.type === 'integer' ? parseInt(value, 10) : parseFloat(value);
+        if (isNaN(numValue)) {
+            return {
+                valid: false,
+                error: `Value '${value}' is not a valid ${spec.type}`
+            };
+        }
+        if (rules.min !== undefined && numValue < rules.min) {
+            return {
+                valid: false,
+                error: `Value ${numValue} is less than minimum ${rules.min}`
+            };
+        }
+        if (rules.max !== undefined && numValue > rules.max) {
+            return {
+                valid: false,
+                error: `Value ${numValue} is greater than maximum ${rules.max}`
+            };
+        }
+    }
+    // Allowed values
+    if (rules.allowed_values && !rules.allowed_values.includes(value)) {
+        return {
+            valid: false,
+            error: `Value '${value}' is not in allowed values: ${rules.allowed_values.join(', ')}`
+        };
+    }
+    return {
+        valid: true
+    };
+}
+/**
+ * Exports for barrel import
+ */ export default {
+    getEnvValue,
+    getNetworkName,
+    getAllEnvValues,
+    validateEnvValue
+};
+
+//# sourceMappingURL=environment-contract.js.map

package/dist/lib/environment-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/environment-contract.ts"],"sourcesContent":["/**\r\n * Environment Variable Contract Resolver\r\n *\r\n * Provides single source of truth for environment variables with mode-specific overrides.\r\n * Implements Phase 3 of CLI/Trigger.dev collision mitigation strategy.\r\n *\r\n * Reference: planning/trigger/CLI_TRIGGER_COLLISION_ANALYSIS.md (Phase 3)\r\n * Contract: docker/runtime/cfn-runtime.contract.yml\r\n *\r\n * Variable Resolution Order (First Set Wins):\r\n * 1. Mode-specific overrides (if specified in contract)\r\n * 2. Environment variable with CFN_ prefix (standard)\r\n * 3. Legacy environment variable (with deprecation warning)\r\n * 4. Default value from contract\r\n * 5. Error if no value found and required=true\r\n *\r\n * Usage:\r\n *   import { getEnvValue } from './environment-contract';\r\n *\r\n *   // CLI mode - uses mcp-network\r\n *   const cliRedisHost = getEnvValue('redis_host', 'cli');\r\n *\r\n *   // Trigger.dev mode - uses trigger-cfn-network\r\n *   const triggerRedisHost = getEnvValue('redis_host', 'trigger');\r\n *\r\n *   // Environment override takes precedence\r\n *   process.env.CFN_REDIS_HOST = 'custom-redis';\r\n *   const overriddenHost = getEnvValue('redis_host', 'cli'); // Returns 'custom-redis'\r\n */\r\n\r\nimport * as fs from 'fs';\r\nimport * as path from 'path';\r\nimport { fileURLToPath } from 'url';\r\nimport * as yaml from 'js-yaml';\r\n\r\n// ESM-compatible __dirname\r\nconst __filename = fileURLToPath(import.meta.url);\r\nconst __dirname = path.dirname(__filename);\r\n\r\n/**\r\n * Validation constraints for contract values\r\n */\r\ninterface ValidationRules {\r\n  pattern?: string;\r\n  min?: number;\r\n  max?: number;\r\n  allowed_values?: string[];\r\n  description?: string;\r\n}\r\n\r\n/**\r\n * Mode-specific overrides in contract\r\n */\r\ninterface ModeOverride {\r\n  override?: string | number;\r\n  network?: string;\r\n}\r\n\r\n/**\r\n * Contract specification for a single environment variable\r\n */\r\ninterface ContractSpec {\r\n  description: string;\r\n  default: string | number | null;\r\n  type: 'string' | 'integer' | 'boolean' | 'float';\r\n  scope: string[];\r\n  legacy_aliases?: string[];\r\n  required?: boolean;\r\n  required_in_production?: boolean;\r\n  example?: string;\r\n  security_notes?: string;\r\n  validation?: ValidationRules;\r\n  mode_defaults?: Record<string, string | number>;\r\n  modes?: {\r\n    cli?: ModeOverride;\r\n    trigger?: ModeOverride;\r\n  };\r\n}\r\n\r\n/**\r\n * Loaded contract cache (lazy-loaded on first use)\r\n */\r\nlet contractCache: Record<string, ContractSpec & { _cfnVarName?: string }> | null = null;\r\n\r\n/**\r\n * Clears the contract cache (for testing purposes)\r\n * @internal\r\n */\r\nexport function _clearContractCache(): void {\r\n  contractCache = null;\r\n}\r\n\r\n/**\r\n * Loads the environment variable contract from YAML file\r\n * Cached after first load for performance\r\n *\r\n * @returns Contract specification mapping\r\n * @throws Error if contract file not found or invalid YAML\r\n */\r\nfunction loadContract(): Record<string, ContractSpec> {\r\n  if (contractCache) {\r\n    return contractCache;\r\n  }\r\n\r\n  const projectRoot = process.env.PROJECT_ROOT || path.resolve(__dirname, '../../');\r\n  const contractPath = path.resolve(projectRoot, 'docker/runtime/cfn-runtime.contract.yml');\r\n\r\n  if (!fs.existsSync(contractPath)) {\r\n    throw new Error(\r\n      `Environment contract not found at ${contractPath}. ` +\r\n        `Ensure docker/runtime/cfn-runtime.contract.yml exists.`\r\n    );\r\n  }\r\n\r\n  const contractYaml = fs.readFileSync(contractPath, 'utf8');\r\n  const contractData = yaml.load(contractYaml) as Record<string, any>;\r\n\r\n  // Flatten nested contract structure (e.g., redis.CFN_REDIS_HOST becomes redis_host)\r\n  contractCache = flattenContract(contractData);\r\n\r\n  return contractCache;\r\n}\r\n\r\n/**\r\n * Flattens nested contract structure into flat key mapping\r\n * Maps environment variable names (CFN_REDIS_HOST) to their specs\r\n *\r\n * @param nested - Nested contract from YAML\r\n * @returns Flattened mapping with both simple keys and spec metadata\r\n */\r\nfunction flattenContract(nested: Record<string, any>): Record<string, ContractSpec & { _cfnVarName?: string }> {\r\n  const flattened: Record<string, ContractSpec & { _cfnVarName?: string }> = {};\r\n\r\n  // Process each top-level category (redis, agent, task, etc.)\r\n  for (const [category, variables] of Object.entries(nested)) {\r\n    // Skip metadata fields\r\n    if (category === 'version' || category === 'last_updated') {\r\n      continue;\r\n    }\r\n\r\n    if (typeof variables !== 'object' || variables === null) {\r\n      continue;\r\n    }\r\n\r\n    // Process each variable in category\r\n    for (const [envVarName, spec] of Object.entries(variables)) {\r\n      if (typeof spec === 'object' && spec !== null) {\r\n        // Create a simple key from env var name (e.g., CFN_REDIS_HOST -> redis_host)\r\n        const simpleKey = envVarName\r\n          .replace(/^CFN_/, '')\r\n          .toLowerCase()\r\n          .replace(/_/g, '_');\r\n\r\n        const specWithCfnName = {\r\n          ...(spec as ContractSpec),\r\n          _cfnVarName: envVarName, // Store the CFN variable name for later lookup\r\n        };\r\n\r\n        flattened[simpleKey] = specWithCfnName;\r\n      }\r\n    }\r\n  }\r\n\r\n  return flattened;\r\n}\r\n\r\n/**\r\n * Gets environment value with mode-specific override support\r\n *\r\n * Resolution order:\r\n * 1. Mode-specific override from contract (if defined)\r\n * 2. CFN_-prefixed environment variable\r\n * 3. Legacy environment variable (with warning)\r\n * 4. Default from contract\r\n * 5. Error if required and no value found\r\n *\r\n * @param key - Contract key (e.g., 'redis_host')\r\n * @param mode - Execution mode ('cli' or 'trigger')\r\n * @returns Resolved environment variable value as string\r\n * @throws Error if key not found in contract or required value missing\r\n */\r\nexport function getEnvValue(key: string, mode: 'cli' | 'trigger'): string {\r\n  const contract = loadContract();\r\n  const spec = contract[key] as (ContractSpec & { _cfnVarName?: string }) | undefined;\r\n\r\n  if (!spec) {\r\n    throw new Error(\r\n      `Unknown contract key: '${key}'. ` +\r\n        `Available keys: ${Object.keys(contract).filter(k => !k.startsWith('_')).join(', ')}`\r\n    );\r\n  }\r\n\r\n  // Get the CFN variable name for this spec\r\n  const cfnVarName = spec._cfnVarName || 'CFN_VAR';\r\n\r\n  // Step 1: Check CFN_ prefixed environment variable (highest priority explicit env var)\r\n  if (process.env[cfnVarName]) {\r\n    return process.env[cfnVarName];\r\n  }\r\n\r\n  // Step 2: Check legacy environment variables\r\n  if (spec.legacy_aliases && spec.legacy_aliases.length > 0) {\r\n    for (const legacy of spec.legacy_aliases) {\r\n      if (process.env[legacy]) {\r\n        console.warn(\r\n          `[ENV DEPRECATION] Using legacy environment variable '${legacy}', ` +\r\n            `migrate to '${cfnVarName}' (see docker/runtime/cfn-runtime.contract.yml)`\r\n        );\r\n        return process.env[legacy];\r\n      }\r\n    }\r\n  }\r\n\r\n  // Step 3: Use mode-specific override if no explicit env var was set\r\n  if (spec.modes?.[mode]?.override !== undefined) {\r\n    return String(spec.modes[mode].override);\r\n  }\r\n\r\n  // Step 4: Use default value\r\n  if (spec.default !== null && spec.default !== undefined) {\r\n    return String(spec.default);\r\n  }\r\n\r\n  // Step 5: Error if required\r\n  if (spec.required) {\r\n    throw new Error(\r\n      `Required environment variable '${cfnVarName}' not set. ` +\r\n        `See docker/runtime/cfn-runtime.contract.yml for configuration.`\r\n    );\r\n  }\r\n\r\n  // No value found and not required - return empty string\r\n  return '';\r\n}\r\n\r\n/**\r\n * Gets mode-specific network name from contract\r\n *\r\n * @param mode - Execution mode ('cli' or 'trigger')\r\n * @returns Network name for the mode\r\n */\r\nexport function getNetworkName(mode: 'cli' | 'trigger'): string {\r\n  const contract = loadContract();\r\n  const spec = contract['network_name'];\r\n\r\n  if (!spec) {\r\n    // Fallback to default if not in contract\r\n    return mode === 'cli' ? 'mcp-network' : 'trigger-cfn-network';\r\n  }\r\n\r\n  return getEnvValue('network_name', mode);\r\n}\r\n\r\n/**\r\n * Gets all environment variables for a specific mode\r\n * Useful for Docker environment setup\r\n *\r\n * @param mode - Execution mode ('cli' or 'trigger')\r\n * @returns Object with resolved environment variables\r\n */\r\nexport function getAllEnvValues(mode: 'cli' | 'trigger'): Record<string, string> {\r\n  const contract = loadContract();\r\n  const envVars: Record<string, string> = {};\r\n\r\n  for (const [key, spec] of Object.entries(contract)) {\r\n    if (spec && typeof spec === 'object' && 'description' in spec) {\r\n      try {\r\n        const value = getEnvValue(key, mode);\r\n        if (value) {\r\n          envVars[key] = value;\r\n        }\r\n      } catch {\r\n        // Skip variables that can't be resolved (optional)\r\n      }\r\n    }\r\n  }\r\n\r\n  return envVars;\r\n}\r\n\r\n/**\r\n * Validates an environment variable against contract rules\r\n *\r\n * @param key - Contract key\r\n * @param value - Value to validate\r\n * @returns Validation result with optional error message\r\n */\r\nexport function validateEnvValue(key: string, value: string): { valid: boolean; error?: string } {\r\n  const contract = loadContract();\r\n  const spec = contract[key];\r\n\r\n  if (!spec) {\r\n    return { valid: false, error: `Unknown contract key: '${key}'` };\r\n  }\r\n\r\n  const rules = spec.validation;\r\n  if (!rules) {\r\n    return { valid: true };\r\n  }\r\n\r\n  // Pattern validation\r\n  if (rules.pattern) {\r\n    const regex = new RegExp(rules.pattern);\r\n    if (!regex.test(value)) {\r\n      return {\r\n        valid: false,\r\n        error: `Value '${value}' does not match pattern '${rules.pattern}'`,\r\n      };\r\n    }\r\n  }\r\n\r\n  // Numeric validations\r\n  if (spec.type === 'integer' || spec.type === 'float') {\r\n    const numValue = spec.type === 'integer' ? parseInt(value, 10) : parseFloat(value);\r\n\r\n    if (isNaN(numValue)) {\r\n      return {\r\n        valid: false,\r\n        error: `Value '${value}' is not a valid ${spec.type}`,\r\n      };\r\n    }\r\n\r\n    if (rules.min !== undefined && numValue < rules.min) {\r\n      return {\r\n        valid: false,\r\n        error: `Value ${numValue} is less than minimum ${rules.min}`,\r\n      };\r\n    }\r\n\r\n    if (rules.max !== undefined && numValue > rules.max) {\r\n      return {\r\n        valid: false,\r\n        error: `Value ${numValue} is greater than maximum ${rules.max}`,\r\n      };\r\n    }\r\n  }\r\n\r\n  // Allowed values\r\n  if (rules.allowed_values && !rules.allowed_values.includes(value)) {\r\n    return {\r\n      valid: false,\r\n      error: `Value '${value}' is not in allowed values: ${rules.allowed_values.join(', ')}`,\r\n    };\r\n  }\r\n\r\n  return { valid: true };\r\n}\r\n\r\n\r\n/**\r\n * Exports for barrel import\r\n */\r\nexport default {\r\n  getEnvValue,\r\n  getNetworkName,\r\n  getAllEnvValues,\r\n  validateEnvValue,\r\n};\r\n"],"names":["fs","path","fileURLToPath","yaml","__filename","url","__dirname","dirname","contractCache","_clearContractCache","loadContract","projectRoot","process","env","PROJECT_ROOT","resolve","contractPath","existsSync","Error","contractYaml","readFileSync","contractData","load","flattenContract","nested","flattened","category","variables","Object","entries","envVarName","spec","simpleKey","replace","toLowerCase","specWithCfnName","_cfnVarName","getEnvValue","key","mode","contract","keys","filter","k","startsWith","join","cfnVarName","legacy_aliases","length","legacy","console","warn","modes","override","undefined","String","default","required","getNetworkName","getAllEnvValues","envVars","value","validateEnvValue","valid","error","rules","validation","pattern","regex","RegExp","test","type","numValue","parseInt","parseFloat","isNaN","min","max","allowed_values","includes"],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GAED,YAAYA,QAAQ,KAAK;AACzB,YAAYC,UAAU,OAAO;AAC7B,SAASC,aAAa,QAAQ,MAAM;AACpC,YAAYC,UAAU,UAAU;AAEhC,2BAA2B;AAC3B,MAAMC,aAAaF,cAAc,YAAYG,GAAG;AAChD,MAAMC,YAAYL,KAAKM,OAAO,CAACH;AA0C/B;;CAEC,GACD,IAAII,gBAAgF;AAEpF;;;CAGC,GACD,OAAO,SAASC;IACdD,gBAAgB;AAClB;AAEA;;;;;;CAMC,GACD,SAASE;IACP,IAAIF,eAAe;QACjB,OAAOA;IACT;IAEA,MAAMG,cAAcC,QAAQC,GAAG,CAACC,YAAY,IAAIb,KAAKc,OAAO,CAACT,WAAW;IACxE,MAAMU,eAAef,KAAKc,OAAO,CAACJ,aAAa;IAE/C,IAAI,CAACX,GAAGiB,UAAU,CAACD,eAAe;QAChC,MAAM,IAAIE,MACR,CAAC,kCAAkC,EAAEF,aAAa,EAAE,CAAC,GACnD,CAAC,sDAAsD,CAAC;IAE9D;IAEA,MAAMG,eAAenB,GAAGoB,YAAY,CAACJ,cAAc;IACnD,MAAMK,eAAelB,KAAKmB,IAAI,CAACH;IAE/B,oFAAoF;IACpFX,gBAAgBe,gBAAgBF;IAEhC,OAAOb;AACT;AAEA;;;;;;CAMC,GACD,SAASe,gBAAgBC,MAA2B;IAClD,MAAMC,YAAqE,CAAC;IAE5E,6DAA6D;IAC7D,KAAK,MAAM,CAACC,UAAUC,UAAU,IAAIC,OAAOC,OAAO,CAACL,QAAS;QAC1D,uBAAuB;QACvB,IAAIE,aAAa,aAAaA,aAAa,gBAAgB;YACzD;QACF;QAEA,IAAI,OAAOC,cAAc,YAAYA,cAAc,MAAM;YACvD;QACF;QAEA,oCAAoC;QACpC,KAAK,MAAM,CAACG,YAAYC,KAAK,IAAIH,OAAOC,OAAO,CAACF,WAAY;YAC1D,IAAI,OAAOI,SAAS,YAAYA,SAAS,MAAM;gBAC7C,6EAA6E;gBAC7E,MAAMC,YAAYF,WACfG,OAAO,CAAC,SAAS,IACjBC,WAAW,GACXD,OAAO,CAAC,MAAM;gBAEjB,MAAME,kBAAkB;oBACtB,GAAIJ,IAAI;oBACRK,aAAaN;gBACf;gBAEAL,SAAS,CAACO,UAAU,GAAGG;YACzB;QACF;IACF;IAEA,OAAOV;AACT;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASY,YAAYC,GAAW,EAAEC,IAAuB;IAC9D,MAAMC,WAAW9B;IACjB,MAAMqB,OAAOS,QAAQ,CAACF,IAAI;IAE1B,IAAI,CAACP,MAAM;QACT,MAAM,IAAIb,MACR,CAAC,uBAAuB,EAAEoB,IAAI,GAAG,CAAC,GAChC,CAAC,gBAAgB,EAAEV,OAAOa,IAAI,CAACD,UAAUE,MAAM,CAACC,CAAAA,IAAK,CAACA,EAAEC,UAAU,CAAC,MAAMC,IAAI,CAAC,OAAO;IAE3F;IAEA,0CAA0C;IAC1C,MAAMC,aAAaf,KAAKK,WAAW,IAAI;IAEvC,uFAAuF;IACvF,IAAIxB,QAAQC,GAAG,CAACiC,WAAW,EAAE;QAC3B,OAAOlC,QAAQC,GAAG,CAACiC,WAAW;IAChC;IAEA,6CAA6C;IAC7C,IAAIf,KAAKgB,cAAc,IAAIhB,KAAKgB,cAAc,CAACC,MAAM,GAAG,GAAG;QACzD,KAAK,MAAMC,UAAUlB,KAAKgB,cAAc,CAAE;YACxC,IAAInC,QAAQC,GAAG,CAACoC,OAAO,EAAE;gBACvBC,QAAQC,IAAI,CACV,CAAC,qDAAqD,EAAEF,OAAO,GAAG,CAAC,GACjE,CAAC,YAAY,EAAEH,WAAW,+CAA+C,CAAC;gBAE9E,OAAOlC,QAAQC,GAAG,CAACoC,OAAO;YAC5B;QACF;IACF;IAEA,oEAAoE;IACpE,IAAIlB,KAAKqB,KAAK,EAAE,CAACb,KAAK,EAAEc,aAAaC,WAAW;QAC9C,OAAOC,OAAOxB,KAAKqB,KAAK,CAACb,KAAK,CAACc,QAAQ;IACzC;IAEA,4BAA4B;IAC5B,IAAItB,KAAKyB,OAAO,KAAK,QAAQzB,KAAKyB,OAAO,KAAKF,WAAW;QACvD,OAAOC,OAAOxB,KAAKyB,OAAO;IAC5B;IAEA,4BAA4B;IAC5B,IAAIzB,KAAK0B,QAAQ,EAAE;QACjB,MAAM,IAAIvC,MACR,CAAC,+BAA+B,EAAE4B,WAAW,WAAW,CAAC,GACvD,CAAC,8DAA8D,CAAC;IAEtE;IAEA,wDAAwD;IACxD,OAAO;AACT;AAEA;;;;;CAKC,GACD,OAAO,SAASY,eAAenB,IAAuB;IACpD,MAAMC,WAAW9B;IACjB,MAAMqB,OAAOS,QAAQ,CAAC,eAAe;IAErC,IAAI,CAACT,MAAM;QACT,yCAAyC;QACzC,OAAOQ,SAAS,QAAQ,gBAAgB;IAC1C;IAEA,OAAOF,YAAY,gBAAgBE;AACrC;AAEA;;;;;;CAMC,GACD,OAAO,SAASoB,gBAAgBpB,IAAuB;IACrD,MAAMC,WAAW9B;IACjB,MAAMkD,UAAkC,CAAC;IAEzC,KAAK,MAAM,CAACtB,KAAKP,KAAK,IAAIH,OAAOC,OAAO,CAACW,UAAW;QAClD,IAAIT,QAAQ,OAAOA,SAAS,YAAY,iBAAiBA,MAAM;YAC7D,IAAI;gBACF,MAAM8B,QAAQxB,YAAYC,KAAKC;gBAC/B,IAAIsB,OAAO;oBACTD,OAAO,CAACtB,IAAI,GAAGuB;gBACjB;YACF,EAAE,OAAM;YACN,mDAAmD;YACrD;QACF;IACF;IAEA,OAAOD;AACT;AAEA;;;;;;CAMC,GACD,OAAO,SAASE,iBAAiBxB,GAAW,EAAEuB,KAAa;IACzD,MAAMrB,WAAW9B;IACjB,MAAMqB,OAAOS,QAAQ,CAACF,IAAI;IAE1B,IAAI,CAACP,MAAM;QACT,OAAO;YAAEgC,OAAO;YAAOC,OAAO,CAAC,uBAAuB,EAAE1B,IAAI,CAAC,CAAC;QAAC;IACjE;IAEA,MAAM2B,QAAQlC,KAAKmC,UAAU;IAC7B,IAAI,CAACD,OAAO;QACV,OAAO;YAAEF,OAAO;QAAK;IACvB;IAEA,qBAAqB;IACrB,IAAIE,MAAME,OAAO,EAAE;QACjB,MAAMC,QAAQ,IAAIC,OAAOJ,MAAME,OAAO;QACtC,IAAI,CAACC,MAAME,IAAI,CAACT,QAAQ;YACtB,OAAO;gBACLE,OAAO;gBACPC,OAAO,CAAC,OAAO,EAAEH,MAAM,0BAA0B,EAAEI,MAAME,OAAO,CAAC,CAAC,CAAC;YACrE;QACF;IACF;IAEA,sBAAsB;IACtB,IAAIpC,KAAKwC,IAAI,KAAK,aAAaxC,KAAKwC,IAAI,KAAK,SAAS;QACpD,MAAMC,WAAWzC,KAAKwC,IAAI,KAAK,YAAYE,SAASZ,OAAO,MAAMa,WAAWb;QAE5E,IAAIc,MAAMH,WAAW;YACnB,OAAO;gBACLT,OAAO;gBACPC,OAAO,CAAC,OAAO,EAAEH,MAAM,iBAAiB,EAAE9B,KAAKwC,IAAI,EAAE;YACvD;QACF;QAEA,IAAIN,MAAMW,GAAG,KAAKtB,aAAakB,WAAWP,MAAMW,GAAG,EAAE;YACnD,OAAO;gBACLb,OAAO;gBACPC,OAAO,CAAC,MAAM,EAAEQ,SAAS,sBAAsB,EAAEP,MAAMW,GAAG,EAAE;YAC9D;QACF;QAEA,IAAIX,MAAMY,GAAG,KAAKvB,aAAakB,WAAWP,MAAMY,GAAG,EAAE;YACnD,OAAO;gBACLd,OAAO;gBACPC,OAAO,CAAC,MAAM,EAAEQ,SAAS,yBAAyB,EAAEP,MAAMY,GAAG,EAAE;YACjE;QACF;IACF;IAEA,iBAAiB;IACjB,IAAIZ,MAAMa,cAAc,IAAI,CAACb,MAAMa,cAAc,CAACC,QAAQ,CAAClB,QAAQ;QACjE,OAAO;YACLE,OAAO;YACPC,OAAO,CAAC,OAAO,EAAEH,MAAM,4BAA4B,EAAEI,MAAMa,cAAc,CAACjC,IAAI,CAAC,OAAO;QACxF;IACF;IAEA,OAAO;QAAEkB,OAAO;IAAK;AACvB;AAGA;;CAEC,GACD,eAAe;IACb1B;IACAqB;IACAC;IACAG;AACF,EAAE"}

package/dist/lib/path-validator.js

@@ -60,9 +60,15 @@ import { StandardError } from './errors';
         try {
             decoded = decodeURIComponent(decoded);
         } catch (error) {
-            // Invalid URL encoding (including malformed UTF-8) indicates attack
-            // e.g., %c0%ae is malformed UTF-8 for overlong encoding
-            invalidEncodingDetected = true;
+            // Invalid URL encoding can be legitimate (e.g., file100%, %PATH%)
+            // These are literal percent signs in filenames, not attacks
+            // Only flag as attack if it's malformed UTF-8 (overlong encoding)
+            const errorMessage = error.message || '';
+            // Malformed UTF-8 sequences like %c0%ae are attacks
+            if (decoded.match(/%[cC][0-9a-fA-F]/) || decoded.match(/%[eE][0-9a-fA-F]/)) {
+                invalidEncodingDetected = true;
+                break;
+            }
             break;
         }
         iterations++;
@@ -85,8 +91,11 @@ import { StandardError } from './errors';
             reason: 'INVALID_ENCODING_DETECTED'
         });
     }
-    // Detect if decoding required multiple iterations (possible double-encoding attack)
-    const encodingAttackDetected = iterations > 1;
+    // Detect double+ encoding attacks (3+ iterations = double-encoded or more)
+    // Single-level URL encoding requires 2 iterations: decode + stability check
+    // Example: subdir%2ffile.txt → subdir/file.txt → stable (2 iterations, legitimate)
+    // Example: %252e%252e%252f → %2e%2e%2f → ../ (3 iterations, attack)
+    const encodingAttackDetected = iterations > 2;
     // Unicode normalization to handle overlong UTF-8 sequences
     // e.g., %c0%ae (%c0%ae = UTF-8 overlong encoding for ".")
     let normalized = decoded;

package/dist/lib/path-validator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/path-validator.ts"],"sourcesContent":["/**\r\n * Path Validator - Security Utility for Safe File Operations\r\n *\r\n * Provides robust path sanitization and validation to prevent path traversal attacks (CVSS 7.0+).\r\n * Enforces strict rules on file access with protection against encoding attacks:\r\n *\r\n * CRITICAL FIXES (CVSS 7.0+):\r\n * - Iterative URL decoding prevents double-encoding bypasses (%252e%252e%252f → ../)\r\n * - Unicode normalization (NFC) prevents overlong UTF-8 bypasses (%c0%ae → .)\r\n * - Null byte detection prevents null injection attacks\r\n * - All decoding performed BEFORE path normalization to prevent layered attacks\r\n * - Encoding attack detection with security logging\r\n *\r\n * Base Security Controls:\r\n * - Path normalization to resolve \"..\" and \".\" sequences\r\n * - Validation that resolved paths stay within allowed directories\r\n * - Detection and rejection of symlinks\r\n * - Rejection of absolute paths outside allowed directories\r\n * - Prevention of home directory access (\"~\")\r\n *\r\n * @module path-validator\r\n * @version 2.0.0 (SECURITY CRITICAL)\r\n */\r\n\r\nimport * as path from 'path';\r\nimport * as fs from 'fs';\r\nimport { StandardError } from './errors';\r\n\r\n/**\r\n * Path validation error - thrown when a path violates security constraints\r\n */\r\nexport class PathValidationError extends StandardError {\r\n  constructor(message: string, context?: Record<string, unknown>) {\r\n    super('PATH_VALIDATION_ERROR', message, context);\r\n    this.name = 'PathValidationError';\r\n  }\r\n}\r\n\r\n/**\r\n * Security encoding attack detection\r\n */\r\nexport interface EncodingAttackDetection {\r\n  detected: boolean;\r\n  type?: 'double_encoding' | 'unicode_encoding' | 'mixed_encoding';\r\n  originalInput: string;\r\n  decodedOutput: string;\r\n  iterationsRequired: number;\r\n}\r\n\r\n/**\r\n * Path validation result with detailed information\r\n */\r\nexport interface PathValidationResult {\r\n  valid: boolean;\r\n  resolvedPath: string;\r\n  normalizedPath: string;\r\n  isWithinBase: boolean;\r\n  isSymlink: boolean;\r\n  reason?: string;\r\n}\r\n\r\n/**\r\n * Safely decode a path with protection against encoding attacks\r\n *\r\n * Performs iterative URL decoding and Unicode normalization to prevent:\r\n * - Double encoding bypass (e.g., %252e%252e%252f → %2e%2e%2f → ../)\r\n * - Overlong UTF-8 encoding (e.g., %c0%ae%c0%ae/ → ../)\r\n * - Mixed encoding attacks\r\n *\r\n * @param inputPath - The potentially encoded path\r\n * @returns Decoded path and attack detection info\r\n * @throws PathValidationError if encoding attack detected\r\n *\r\n * @example\r\n * const { decoded, encoding } = decodePathSafely('%252e%252e%252f');\r\n * // Detects double-encoding attempt\r\n */\r\nfunction decodePathSafely(inputPath: string): {\r\n  decoded: string;\r\n  encoding: EncodingAttackDetection;\r\n} {\r\n  let decoded = inputPath;\r\n  let previous = '';\r\n  let iterations = 0;\r\n  const MAX_ITERATIONS = 5;\r\n  const originalInput = inputPath;\r\n  let invalidEncodingDetected = false;\r\n\r\n  // Iteratively decode URL-encoded characters until stable\r\n  // This prevents bypass attacks using multiple encoding layers\r\n  while (decoded !== previous && iterations < MAX_ITERATIONS) {\r\n    previous = decoded;\r\n    try {\r\n      decoded = decodeURIComponent(decoded);\r\n    } catch (error) {\r\n      // Invalid URL encoding (including malformed UTF-8) indicates attack\r\n      // e.g., %c0%ae is malformed UTF-8 for overlong encoding\r\n      invalidEncodingDetected = true;\r\n      // Treat invalid encoding as a suspicious attack indicator\r\n      // but continue with the path as-is for analysis\r\n      break;\r\n    }\r\n    iterations++;\r\n  }\r\n\r\n  // Check if we hit max iterations (indicates potential encoding attack)\r\n  if (iterations >= MAX_ITERATIONS && decoded !== previous) {\r\n    throw new PathValidationError(\r\n      'Path validation failed: excessive encoding layers detected',\r\n      {\r\n        originalInput,\r\n        decodedOutput: decoded,\r\n        iterations,\r\n        reason: 'ENCODING_ATTACK_DETECTED',\r\n      }\r\n    );\r\n  }\r\n\r\n  // Invalid encoding like malformed UTF-8 is itself an attack indicator\r\n  if (invalidEncodingDetected) {\r\n    throw new PathValidationError(\r\n      'Path validation failed: invalid encoding detected (possible encoding attack)',\r\n      {\r\n        originalInput,\r\n        decodedOutput: decoded,\r\n        iterations,\r\n        reason: 'INVALID_ENCODING_DETECTED',\r\n      }\r\n    );\r\n  }\r\n\r\n  // Detect if decoding required multiple iterations (possible double-encoding attack)\r\n  const encodingAttackDetected = iterations > 1;\r\n\r\n  // Unicode normalization to handle overlong UTF-8 sequences\r\n  // e.g., %c0%ae (%c0%ae = UTF-8 overlong encoding for \".\")\r\n  let normalized = decoded;\r\n  try {\r\n    normalized = decoded.normalize('NFC');\r\n  } catch (error) {\r\n    // Some paths may not be valid Unicode, continue with non-normalized version\r\n  }\r\n\r\n  // Check for null bytes (another common encoding attack vector)\r\n  if (normalized.includes('\\0')) {\r\n    throw new PathValidationError(\r\n      'Path validation failed: null byte injection detected',\r\n      {\r\n        originalInput,\r\n        decodedOutput: normalized,\r\n        reason: 'NULL_BYTE_INJECTION',\r\n      }\r\n    );\r\n  }\r\n\r\n  return {\r\n    decoded: normalized,\r\n    encoding: {\r\n      detected: encodingAttackDetected,\r\n      type: encodingAttackDetected ? 'double_encoding' : undefined,\r\n      originalInput,\r\n      decodedOutput: normalized,\r\n      iterationsRequired: iterations,\r\n    },\r\n  };\r\n}\r\n\r\n/**\r\n * Validate a file path to prevent directory traversal attacks\r\n *\r\n * Security checks performed (in order):\r\n * 1. CRITICAL: Iteratively decode URL encoding to handle %252e%252e%252f and similar bypasses\r\n * 2. CRITICAL: Normalize Unicode (NFC) to handle overlong UTF-8 like %c0%ae%c0%ae/\r\n * 3. CRITICAL: Detect null bytes and excessive encoding layers\r\n * 4. Check for home directory expansion (\"~\") on DECODED path\r\n * 5. Normalize path to resolve \"..\" and \".\"\r\n * 6. Verify all suspicious patterns are eliminated\r\n * 7. Check if path is within base directory\r\n * 8. Reject symlinks to prevent symlink attacks\r\n * 9. Log any encoding attacks detected for security monitoring\r\n *\r\n * @param filePath - The file path to validate (may be encoded)\r\n * @param baseDirectory - The base directory that file must reside within\r\n * @returns PathValidationResult with validation details\r\n * @throws PathValidationError if path validation fails or encoding attack detected\r\n *\r\n * @example\r\n * const result = validatePath('docs/FEATURE.md', './.claude/skills');\r\n * if (!result.valid) {\r\n *   throw result; // Safe to throw, contains all context\r\n * }\r\n * // Use result.resolvedPath\r\n *\r\n * @security\r\n * Designed to prevent:\r\n * - Double-encoding bypasses: %252e%252e%252f\r\n * - Overlong UTF-8: %c0%ae%c0%ae/\r\n * - Mixed encoding: URL + Unicode combinations\r\n * - Null byte injection: file.txt%00.jpg\r\n * - Traditional path traversal: ../../../etc/passwd\r\n */\r\nexport function validatePath(filePath: string, baseDirectory: string): PathValidationResult {\r\n  // SECURITY FIX: Decode all encoding layers first before any path normalization\r\n  // This prevents double-encoding bypasses like %252e%252e%252f\r\n  const { decoded: decodedPath, encoding: pathEncoding } = decodePathSafely(filePath);\r\n  const { decoded: decodedBase } = decodePathSafely(baseDirectory);\r\n\r\n  // Log encoding attacks for security monitoring\r\n  if (pathEncoding.detected) {\r\n    // In production, this should trigger security alerts\r\n    console.warn('Security: Encoding attack detected in path input', {\r\n      originalInput: pathEncoding.originalInput,\r\n      decodedOutput: pathEncoding.decodedOutput,\r\n      iterationsRequired: pathEncoding.iterationsRequired,\r\n    });\r\n  }\r\n\r\n  // Check for home directory expansion attempts on DECODED path\r\n  if (decodedPath.startsWith('~') || decodedPath.includes('/~') || decodedPath.includes('\\\\~')) {\r\n    throw new PathValidationError(\r\n      'Path validation failed: home directory access denied',\r\n      {\r\n        filePath,\r\n        decodedPath,\r\n        baseDirectory,\r\n        reason: 'HOME_DIRECTORY_ACCESS',\r\n      }\r\n    );\r\n  }\r\n\r\n  // Check for home directory expansion attempts in baseDirectory\r\n  if (decodedBase.startsWith('~')) {\r\n    throw new PathValidationError(\r\n      'Base directory validation failed: home directory access denied',\r\n      {\r\n        baseDirectory,\r\n        decodedBase,\r\n        reason: 'BASE_HOME_DIRECTORY_ACCESS',\r\n      }\r\n    );\r\n  }\r\n\r\n  // Normalize the base directory first\r\n  const normalizedBase = path.normalize(decodedBase);\r\n  const resolvedBase = path.resolve(normalizedBase);\r\n\r\n  // Normalize and resolve the file path relative to base\r\n  // NOW normalized on already-decoded path to prevent encoding bypasses\r\n  const normalizedPath = path.normalize(decodedPath);\r\n\r\n  // Check if path contains suspicious patterns after normalization\r\n  if (normalizedPath.includes('..') || normalizedPath === '.' || normalizedPath.includes('/./')) {\r\n    throw new PathValidationError(\r\n      'Path validation failed: path contains directory traversal patterns',\r\n      {\r\n        filePath,\r\n        decodedPath,\r\n        normalizedPath,\r\n        baseDirectory,\r\n        reason: 'TRAVERSAL_PATTERN_DETECTED',\r\n      }\r\n    );\r\n  }\r\n\r\n  // Resolve the path relative to base directory\r\n  const resolvedPath = path.resolve(resolvedBase, normalizedPath);\r\n\r\n  // Check if resolved path is within base directory\r\n  const isWithinBase = isPathWithinBase(resolvedPath, resolvedBase);\r\n\r\n  if (!isWithinBase) {\r\n    throw new PathValidationError(\r\n      'Path validation failed: resolved path is outside allowed directory',\r\n      {\r\n        filePath,\r\n        resolvedPath,\r\n        baseDirectory: resolvedBase,\r\n        reason: 'PATH_OUTSIDE_BASE',\r\n      }\r\n    );\r\n  }\r\n\r\n  // Check for symlinks (prevents symlink attacks)\r\n  let isSymlink = false;\r\n  try {\r\n    const stats = fs.lstatSync(resolvedPath);\r\n    isSymlink = stats.isSymbolicLink();\r\n\r\n    if (isSymlink) {\r\n      throw new PathValidationError(\r\n        'Path validation failed: symbolic links are not allowed',\r\n        {\r\n          filePath,\r\n          resolvedPath,\r\n          reason: 'SYMLINK_NOT_ALLOWED',\r\n        }\r\n      );\r\n    }\r\n  } catch (error) {\r\n    // File doesn't exist yet (expected for validation before creation)\r\n    // or it's a symlink that was rejected above\r\n    if (error instanceof PathValidationError) {\r\n      throw error;\r\n    }\r\n    // Other errors (permission denied, etc.) are not path validation failures\r\n    // The file validation happens later\r\n  }\r\n\r\n  return {\r\n    valid: true,\r\n    resolvedPath,\r\n    normalizedPath,\r\n    isWithinBase: true,\r\n    isSymlink: false,\r\n  };\r\n}\r\n\r\n/**\r\n * Check if a path is within a base directory\r\n *\r\n * Uses path resolution and string comparison to ensure the resolved path\r\n * is actually within the base directory (not just sharing a prefix).\r\n *\r\n * @param filePath - The path to check\r\n * @param baseDirectory - The base directory\r\n * @returns True if filePath is within baseDirectory\r\n *\r\n * @example\r\n * isPathWithinBase('/home/user/project/src/file.ts', '/home/user/project')  // true\r\n * isPathWithinBase('/home/user/project-evil/file.ts', '/home/user/project') // false\r\n */\r\nexport function isPathWithinBase(filePath: string, baseDirectory: string): boolean {\r\n  // Ensure both paths are normalized and absolute\r\n  const normalizedFile = path.normalize(path.resolve(filePath));\r\n  const normalizedBase = path.normalize(path.resolve(baseDirectory));\r\n\r\n  // Exact match\r\n  if (normalizedFile === normalizedBase) {\r\n    return true;\r\n  }\r\n\r\n  // Check if file is within base (use path.relative to ensure it's not going up)\r\n  const relative = path.relative(normalizedBase, normalizedFile);\r\n\r\n  // If relative path starts with \"..\", it's outside the base directory\r\n  if (relative.startsWith('..')) {\r\n    return false;\r\n  }\r\n\r\n  // If relative path is absolute, it's outside the base directory\r\n  if (path.isAbsolute(relative)) {\r\n    return false;\r\n  }\r\n\r\n  return true;\r\n}\r\n\r\n/**\r\n * Validate multiple paths within the same base directory\r\n *\r\n * Efficiently validates multiple paths, returning results for each.\r\n *\r\n * @param filePaths - Array of file paths to validate\r\n * @param baseDirectory - The base directory that all files must reside within\r\n * @returns Map of file path to validation result\r\n *\r\n * @example\r\n * const results = validatePaths(['docs/SKILL.md', 'src/index.ts'], './.claude/skills');\r\n * results.forEach((result, filePath) => {\r\n *   if (!result.valid) {\r\n *     console.error(`Invalid path: ${filePath}`, result.reason);\r\n *   }\r\n * });\r\n */\r\nexport function validatePaths(\r\n  filePaths: string[],\r\n  baseDirectory: string\r\n): Map<string, PathValidationResult> {\r\n  const results = new Map<string, PathValidationResult>();\r\n\r\n  for (const filePath of filePaths) {\r\n    try {\r\n      const result = validatePath(filePath, baseDirectory);\r\n      results.set(filePath, result);\r\n    } catch (error) {\r\n      if (error instanceof PathValidationError) {\r\n        results.set(filePath, {\r\n          valid: false,\r\n          resolvedPath: '',\r\n          normalizedPath: '',\r\n          isWithinBase: false,\r\n          isSymlink: false,\r\n          reason: error.context?.reason as string | undefined,\r\n        });\r\n      } else {\r\n        throw error;\r\n      }\r\n    }\r\n  }\r\n\r\n  return results;\r\n}\r\n\r\n/**\r\n * Get the safe path for a file (or throw if validation fails)\r\n *\r\n * Convenience function that validates and returns the resolved path,\r\n * or throws an error if validation fails.\r\n *\r\n * @param filePath - The file path to validate\r\n * @param baseDirectory - The base directory that file must reside within\r\n * @returns The resolved, validated absolute path\r\n * @throws PathValidationError if path validation fails\r\n *\r\n * @example\r\n * const safePath = getSafePath('docs/SKILL.md', './.claude/skills');\r\n * fs.readFileSync(safePath); // Safe to use\r\n */\r\nexport function getSafePath(filePath: string, baseDirectory: string): string {\r\n  const result = validatePath(filePath, baseDirectory);\r\n  return result.resolvedPath;\r\n}\r\n\r\n/**\r\n * Check if a path is considered safe for operations\r\n *\r\n * This is a non-throwing version of validatePath for conditional logic.\r\n *\r\n * @param filePath - The file path to check\r\n * @param baseDirectory - The base directory\r\n * @returns True if path is safe, false otherwise\r\n *\r\n * @example\r\n * if (isPathSafe(userInput, './.claude/skills')) {\r\n *   // Process the file\r\n * } else {\r\n *   // Reject the request\r\n * }\r\n */\r\nexport function isPathSafe(filePath: string, baseDirectory: string): boolean {\r\n  try {\r\n    validatePath(filePath, baseDirectory);\r\n    return true;\r\n  } catch {\r\n    return false;\r\n  }\r\n}\r\n\r\n/**\r\n * Get validation error details for a path (if invalid)\r\n *\r\n * Useful for logging and diagnostics.\r\n *\r\n * @param filePath - The file path to validate\r\n * @param baseDirectory - The base directory\r\n * @returns Error with details, or undefined if path is valid\r\n *\r\n * @example\r\n * const error = getPathValidationError('../../etc/passwd', './.claude/skills');\r\n * if (error) {\r\n *   logger.error(error.message, error.context);\r\n * }\r\n */\r\nexport function getPathValidationError(\r\n  filePath: string,\r\n  baseDirectory: string\r\n): PathValidationError | undefined {\r\n  try {\r\n    validatePath(filePath, baseDirectory);\r\n    return undefined;\r\n  } catch (error) {\r\n    if (error instanceof PathValidationError) {\r\n      return error;\r\n    }\r\n    throw error;\r\n  }\r\n}\r\n\r\n/**\r\n * List allowed files within a base directory (safely)\r\n *\r\n * Recursively lists all files within base directory, validating\r\n * each path to ensure it's within bounds.\r\n *\r\n * @param baseDirectory - The base directory to scan\r\n * @param options - Options for listing (maxDepth, filter)\r\n * @returns Array of validated, safe paths relative to baseDirectory\r\n *\r\n * @example\r\n * const files = safeListDirectory('./.claude/skills');\r\n * files.forEach(file => {\r\n *   // All paths are guaranteed safe\r\n *   console.log(file);\r\n * });\r\n */\r\nexport function safeListDirectory(\r\n  baseDirectory: string,\r\n  options?: {\r\n    maxDepth?: number;\r\n    filter?: (path: string) => boolean;\r\n  }\r\n): string[] {\r\n  const safeFiles: string[] = [];\r\n  const maxDepth = options?.maxDepth ?? Infinity;\r\n  const filter = options?.filter ?? (() => true);\r\n\r\n  function walkDirectory(dir: string, currentDepth: number = 0): void {\r\n    if (currentDepth > maxDepth) {\r\n      return;\r\n    }\r\n\r\n    try {\r\n      const entries = fs.readdirSync(dir, { withFileTypes: true });\r\n\r\n      for (const entry of entries) {\r\n        const fullPath = path.join(dir, entry.name);\r\n        const relativePath = path.relative(baseDirectory, fullPath);\r\n\r\n        // Validate the path is still within base\r\n        if (!isPathWithinBase(fullPath, baseDirectory)) {\r\n          continue;\r\n        }\r\n\r\n        // Apply filter\r\n        if (!filter(relativePath)) {\r\n          continue;\r\n        }\r\n\r\n        safeFiles.push(relativePath);\r\n\r\n        // Recursively walk directories\r\n        if (entry.isDirectory() && !entry.isSymbolicLink()) {\r\n          walkDirectory(fullPath, currentDepth + 1);\r\n        }\r\n      }\r\n    } catch (error) {\r\n      // Silently skip directories we can't read (permission denied, etc.)\r\n    }\r\n  }\r\n\r\n  walkDirectory(baseDirectory);\r\n  return safeFiles;\r\n}\r\n"],"names":["path","fs","StandardError","PathValidationError","message","context","name","decodePathSafely","inputPath","decoded","previous","iterations","MAX_ITERATIONS","originalInput","invalidEncodingDetected","decodeURIComponent","error","decodedOutput","reason","encodingAttackDetected","normalized","normalize","includes","encoding","detected","type","undefined","iterationsRequired","validatePath","filePath","baseDirectory","decodedPath","pathEncoding","decodedBase","console","warn","startsWith","normalizedBase","resolvedBase","resolve","normalizedPath","resolvedPath","isWithinBase","isPathWithinBase","isSymlink","stats","lstatSync","isSymbolicLink","valid","normalizedFile","relative","isAbsolute","validatePaths","filePaths","results","Map","result","set","getSafePath","isPathSafe","getPathValidationError","safeListDirectory","options","safeFiles","maxDepth","Infinity","filter","walkDirectory","dir","currentDepth","entries","readdirSync","withFileTypes","entry","fullPath","join","relativePath","push","isDirectory"],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;CAsBC,GAED,YAAYA,UAAU,OAAO;AAC7B,YAAYC,QAAQ,KAAK;AACzB,SAASC,aAAa,QAAQ,WAAW;AAEzC;;CAEC,GACD,OAAO,MAAMC,4BAA4BD;IACvC,YAAYE,OAAe,EAAEC,OAAiC,CAAE;QAC9D,KAAK,CAAC,yBAAyBD,SAASC;QACxC,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAyBA;;;;;;;;;;;;;;;CAeC,GACD,SAASC,iBAAiBC,SAAiB;IAIzC,IAAIC,UAAUD;IACd,IAAIE,WAAW;IACf,IAAIC,aAAa;IACjB,MAAMC,iBAAiB;IACvB,MAAMC,gBAAgBL;IACtB,IAAIM,0BAA0B;IAE9B,yDAAyD;IACzD,8DAA8D;IAC9D,MAAOL,YAAYC,YAAYC,aAAaC,eAAgB;QAC1DF,WAAWD;QACX,IAAI;YACFA,UAAUM,mBAAmBN;QAC/B,EAAE,OAAOO,OAAO;YACd,oEAAoE;YACpE,wDAAwD;YACxDF,0BAA0B;YAG1B;QACF;QACAH;IACF;IAEA,uEAAuE;IACvE,IAAIA,cAAcC,kBAAkBH,YAAYC,UAAU;QACxD,MAAM,IAAIP,oBACR,8DACA;YACEU;YACAI,eAAeR;YACfE;YACAO,QAAQ;QACV;IAEJ;IAEA,sEAAsE;IACtE,IAAIJ,yBAAyB;QAC3B,MAAM,IAAIX,oBACR,gFACA;YACEU;YACAI,eAAeR;YACfE;YACAO,QAAQ;QACV;IAEJ;IAEA,oFAAoF;IACpF,MAAMC,yBAAyBR,aAAa;IAE5C,2DAA2D;IAC3D,0DAA0D;IAC1D,IAAIS,aAAaX;IACjB,IAAI;QACFW,aAAaX,QAAQY,SAAS,CAAC;IACjC,EAAE,OAAOL,OAAO;IACd,4EAA4E;IAC9E;IAEA,+DAA+D;IAC/D,IAAII,WAAWE,QAAQ,CAAC,OAAO;QAC7B,MAAM,IAAInB,oBACR,wDACA;YACEU;YACAI,eAAeG;YACfF,QAAQ;QACV;IAEJ;IAEA,OAAO;QACLT,SAASW;QACTG,UAAU;YACRC,UAAUL;YACVM,MAAMN,yBAAyB,oBAAoBO;YACnDb;YACAI,eAAeG;YACfO,oBAAoBhB;QACtB;IACF;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCC,GACD,OAAO,SAASiB,aAAaC,QAAgB,EAAEC,aAAqB;IAClE,+EAA+E;IAC/E,8DAA8D;IAC9D,MAAM,EAAErB,SAASsB,WAAW,EAAER,UAAUS,YAAY,EAAE,GAAGzB,iBAAiBsB;IAC1E,MAAM,EAAEpB,SAASwB,WAAW,EAAE,GAAG1B,iBAAiBuB;IAElD,+CAA+C;IAC/C,IAAIE,aAAaR,QAAQ,EAAE;QACzB,qDAAqD;QACrDU,QAAQC,IAAI,CAAC,oDAAoD;YAC/DtB,eAAemB,aAAanB,aAAa;YACzCI,eAAee,aAAaf,aAAa;YACzCU,oBAAoBK,aAAaL,kBAAkB;QACrD;IACF;IAEA,8DAA8D;IAC9D,IAAII,YAAYK,UAAU,CAAC,QAAQL,YAAYT,QAAQ,CAAC,SAASS,YAAYT,QAAQ,CAAC,QAAQ;QAC5F,MAAM,IAAInB,oBACR,wDACA;YACE0B;YACAE;YACAD;YACAZ,QAAQ;QACV;IAEJ;IAEA,+DAA+D;IAC/D,IAAIe,YAAYG,UAAU,CAAC,MAAM;QAC/B,MAAM,IAAIjC,oBACR,kEACA;YACE2B;YACAG;YACAf,QAAQ;QACV;IAEJ;IAEA,qCAAqC;IACrC,MAAMmB,iBAAiBrC,KAAKqB,SAAS,CAACY;IACtC,MAAMK,eAAetC,KAAKuC,OAAO,CAACF;IAElC,uDAAuD;IACvD,sEAAsE;IACtE,MAAMG,iBAAiBxC,KAAKqB,SAAS,CAACU;IAEtC,iEAAiE;IACjE,IAAIS,eAAelB,QAAQ,CAAC,SAASkB,mBAAmB,OAAOA,eAAelB,QAAQ,CAAC,QAAQ;QAC7F,MAAM,IAAInB,oBACR,sEACA;YACE0B;YACAE;YACAS;YACAV;YACAZ,QAAQ;QACV;IAEJ;IAEA,8CAA8C;IAC9C,MAAMuB,eAAezC,KAAKuC,OAAO,CAACD,cAAcE;IAEhD,kDAAkD;IAClD,MAAME,eAAeC,iBAAiBF,cAAcH;IAEpD,IAAI,CAACI,cAAc;QACjB,MAAM,IAAIvC,oBACR,sEACA;YACE0B;YACAY;YACAX,eAAeQ;YACfpB,QAAQ;QACV;IAEJ;IAEA,gDAAgD;IAChD,IAAI0B,YAAY;IAChB,IAAI;QACF,MAAMC,QAAQ5C,GAAG6C,SAAS,CAACL;QAC3BG,YAAYC,MAAME,cAAc;QAEhC,IAAIH,WAAW;YACb,MAAM,IAAIzC,oBACR,0DACA;gBACE0B;gBACAY;gBACAvB,QAAQ;YACV;QAEJ;IACF,EAAE,OAAOF,OAAO;QACd,mEAAmE;QACnE,4CAA4C;QAC5C,IAAIA,iBAAiBb,qBAAqB;YACxC,MAAMa;QACR;IACA,0EAA0E;IAC1E,oCAAoC;IACtC;IAEA,OAAO;QACLgC,OAAO;QACPP;QACAD;QACAE,cAAc;QACdE,WAAW;IACb;AACF;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASD,iBAAiBd,QAAgB,EAAEC,aAAqB;IACtE,gDAAgD;IAChD,MAAMmB,iBAAiBjD,KAAKqB,SAAS,CAACrB,KAAKuC,OAAO,CAACV;IACnD,MAAMQ,iBAAiBrC,KAAKqB,SAAS,CAACrB,KAAKuC,OAAO,CAACT;IAEnD,cAAc;IACd,IAAImB,mBAAmBZ,gBAAgB;QACrC,OAAO;IACT;IAEA,+EAA+E;IAC/E,MAAMa,WAAWlD,KAAKkD,QAAQ,CAACb,gBAAgBY;IAE/C,qEAAqE;IACrE,IAAIC,SAASd,UAAU,CAAC,OAAO;QAC7B,OAAO;IACT;IAEA,gEAAgE;IAChE,IAAIpC,KAAKmD,UAAU,CAACD,WAAW;QAC7B,OAAO;IACT;IAEA,OAAO;AACT;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASE,cACdC,SAAmB,EACnBvB,aAAqB;IAErB,MAAMwB,UAAU,IAAIC;IAEpB,KAAK,MAAM1B,YAAYwB,UAAW;QAChC,IAAI;YACF,MAAMG,SAAS5B,aAAaC,UAAUC;YACtCwB,QAAQG,GAAG,CAAC5B,UAAU2B;QACxB,EAAE,OAAOxC,OAAO;YACd,IAAIA,iBAAiBb,qBAAqB;gBACxCmD,QAAQG,GAAG,CAAC5B,UAAU;oBACpBmB,OAAO;oBACPP,cAAc;oBACdD,gBAAgB;oBAChBE,cAAc;oBACdE,WAAW;oBACX1B,QAAQF,MAAMX,OAAO,EAAEa;gBACzB;YACF,OAAO;gBACL,MAAMF;YACR;QACF;IACF;IAEA,OAAOsC;AACT;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASI,YAAY7B,QAAgB,EAAEC,aAAqB;IACjE,MAAM0B,SAAS5B,aAAaC,UAAUC;IACtC,OAAO0B,OAAOf,YAAY;AAC5B;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASkB,WAAW9B,QAAgB,EAAEC,aAAqB;IAChE,IAAI;QACFF,aAAaC,UAAUC;QACvB,OAAO;IACT,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAAS8B,uBACd/B,QAAgB,EAChBC,aAAqB;IAErB,IAAI;QACFF,aAAaC,UAAUC;QACvB,OAAOJ;IACT,EAAE,OAAOV,OAAO;QACd,IAAIA,iBAAiBb,qBAAqB;YACxC,OAAOa;QACT;QACA,MAAMA;IACR;AACF;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAAS6C,kBACd/B,aAAqB,EACrBgC,OAGC;IAED,MAAMC,YAAsB,EAAE;IAC9B,MAAMC,WAAWF,SAASE,YAAYC;IACtC,MAAMC,SAASJ,SAASI,UAAW,CAAA,IAAM,IAAG;IAE5C,SAASC,cAAcC,GAAW,EAAEC,eAAuB,CAAC;QAC1D,IAAIA,eAAeL,UAAU;YAC3B;QACF;QAEA,IAAI;YACF,MAAMM,UAAUrE,GAAGsE,WAAW,CAACH,KAAK;gBAAEI,eAAe;YAAK;YAE1D,KAAK,MAAMC,SAASH,QAAS;gBAC3B,MAAMI,WAAW1E,KAAK2E,IAAI,CAACP,KAAKK,MAAMnE,IAAI;gBAC1C,MAAMsE,eAAe5E,KAAKkD,QAAQ,CAACpB,eAAe4C;gBAElD,yCAAyC;gBACzC,IAAI,CAAC/B,iBAAiB+B,UAAU5C,gBAAgB;oBAC9C;gBACF;gBAEA,eAAe;gBACf,IAAI,CAACoC,OAAOU,eAAe;oBACzB;gBACF;gBAEAb,UAAUc,IAAI,CAACD;gBAEf,+BAA+B;gBAC/B,IAAIH,MAAMK,WAAW,MAAM,CAACL,MAAM1B,cAAc,IAAI;oBAClDoB,cAAcO,UAAUL,eAAe;gBACzC;YACF;QACF,EAAE,OAAOrD,OAAO;QACd,oEAAoE;QACtE;IACF;IAEAmD,cAAcrC;IACd,OAAOiC;AACT"}
+{"version":3,"sources":["../../src/lib/path-validator.ts"],"sourcesContent":["/**\r\n * Path Validator - Security Utility for Safe File Operations\r\n *\r\n * Provides robust path sanitization and validation to prevent path traversal attacks (CVSS 7.0+).\r\n * Enforces strict rules on file access with protection against encoding attacks:\r\n *\r\n * CRITICAL FIXES (CVSS 7.0+):\r\n * - Iterative URL decoding prevents double-encoding bypasses (%252e%252e%252f → ../)\r\n * - Unicode normalization (NFC) prevents overlong UTF-8 bypasses (%c0%ae → .)\r\n * - Null byte detection prevents null injection attacks\r\n * - All decoding performed BEFORE path normalization to prevent layered attacks\r\n * - Encoding attack detection with security logging\r\n *\r\n * Base Security Controls:\r\n * - Path normalization to resolve \"..\" and \".\" sequences\r\n * - Validation that resolved paths stay within allowed directories\r\n * - Detection and rejection of symlinks\r\n * - Rejection of absolute paths outside allowed directories\r\n * - Prevention of home directory access (\"~\")\r\n *\r\n * @module path-validator\r\n * @version 2.0.0 (SECURITY CRITICAL)\r\n */\r\n\r\nimport * as path from 'path';\r\nimport * as fs from 'fs';\r\nimport { StandardError } from './errors';\r\n\r\n/**\r\n * Path validation error - thrown when a path violates security constraints\r\n */\r\nexport class PathValidationError extends StandardError {\r\n  constructor(message: string, context?: Record<string, unknown>) {\r\n    super('PATH_VALIDATION_ERROR', message, context);\r\n    this.name = 'PathValidationError';\r\n  }\r\n}\r\n\r\n/**\r\n * Security encoding attack detection\r\n */\r\nexport interface EncodingAttackDetection {\r\n  detected: boolean;\r\n  type?: 'double_encoding' | 'unicode_encoding' | 'mixed_encoding';\r\n  originalInput: string;\r\n  decodedOutput: string;\r\n  iterationsRequired: number;\r\n}\r\n\r\n/**\r\n * Path validation result with detailed information\r\n */\r\nexport interface PathValidationResult {\r\n  valid: boolean;\r\n  resolvedPath: string;\r\n  normalizedPath: string;\r\n  isWithinBase: boolean;\r\n  isSymlink: boolean;\r\n  reason?: string;\r\n}\r\n\r\n/**\r\n * Safely decode a path with protection against encoding attacks\r\n *\r\n * Performs iterative URL decoding and Unicode normalization to prevent:\r\n * - Double encoding bypass (e.g., %252e%252e%252f → %2e%2e%2f → ../)\r\n * - Overlong UTF-8 encoding (e.g., %c0%ae%c0%ae/ → ../)\r\n * - Mixed encoding attacks\r\n *\r\n * @param inputPath - The potentially encoded path\r\n * @returns Decoded path and attack detection info\r\n * @throws PathValidationError if encoding attack detected\r\n *\r\n * @example\r\n * const { decoded, encoding } = decodePathSafely('%252e%252e%252f');\r\n * // Detects double-encoding attempt\r\n */\r\nfunction decodePathSafely(inputPath: string): {\r\n  decoded: string;\r\n  encoding: EncodingAttackDetection;\r\n} {\r\n  let decoded = inputPath;\r\n  let previous = '';\r\n  let iterations = 0;\r\n  const MAX_ITERATIONS = 5;\r\n  const originalInput = inputPath;\r\n  let invalidEncodingDetected = false;\r\n\r\n  // Iteratively decode URL-encoded characters until stable\r\n  // This prevents bypass attacks using multiple encoding layers\r\n  while (decoded !== previous && iterations < MAX_ITERATIONS) {\r\n    previous = decoded;\r\n    try {\r\n      decoded = decodeURIComponent(decoded);\r\n    } catch (error) {\r\n      // Invalid URL encoding can be legitimate (e.g., file100%, %PATH%)\r\n      // These are literal percent signs in filenames, not attacks\r\n      // Only flag as attack if it's malformed UTF-8 (overlong encoding)\r\n      const errorMessage = (error as Error).message || '';\r\n\r\n      // Malformed UTF-8 sequences like %c0%ae are attacks\r\n      if (decoded.match(/%[cC][0-9a-fA-F]/) || decoded.match(/%[eE][0-9a-fA-F]/)) {\r\n        invalidEncodingDetected = true;\r\n        break;\r\n      }\r\n\r\n      // Otherwise, it's just a literal % in the filename - OK\r\n      // Keep the path as-is and stop decoding\r\n      break;\r\n    }\r\n    iterations++;\r\n  }\r\n\r\n  // Check if we hit max iterations (indicates potential encoding attack)\r\n  if (iterations >= MAX_ITERATIONS && decoded !== previous) {\r\n    throw new PathValidationError(\r\n      'Path validation failed: excessive encoding layers detected',\r\n      {\r\n        originalInput,\r\n        decodedOutput: decoded,\r\n        iterations,\r\n        reason: 'ENCODING_ATTACK_DETECTED',\r\n      }\r\n    );\r\n  }\r\n\r\n  // Invalid encoding like malformed UTF-8 is itself an attack indicator\r\n  if (invalidEncodingDetected) {\r\n    throw new PathValidationError(\r\n      'Path validation failed: invalid encoding detected (possible encoding attack)',\r\n      {\r\n        originalInput,\r\n        decodedOutput: decoded,\r\n        iterations,\r\n        reason: 'INVALID_ENCODING_DETECTED',\r\n      }\r\n    );\r\n  }\r\n\r\n  // Detect double+ encoding attacks (3+ iterations = double-encoded or more)\r\n  // Single-level URL encoding requires 2 iterations: decode + stability check\r\n  // Example: subdir%2ffile.txt → subdir/file.txt → stable (2 iterations, legitimate)\r\n  // Example: %252e%252e%252f → %2e%2e%2f → ../ (3 iterations, attack)\r\n  const encodingAttackDetected = iterations > 2;\r\n\r\n  // Unicode normalization to handle overlong UTF-8 sequences\r\n  // e.g., %c0%ae (%c0%ae = UTF-8 overlong encoding for \".\")\r\n  let normalized = decoded;\r\n  try {\r\n    normalized = decoded.normalize('NFC');\r\n  } catch (error) {\r\n    // Some paths may not be valid Unicode, continue with non-normalized version\r\n  }\r\n\r\n  // Check for null bytes (another common encoding attack vector)\r\n  if (normalized.includes('\\0')) {\r\n    throw new PathValidationError(\r\n      'Path validation failed: null byte injection detected',\r\n      {\r\n        originalInput,\r\n        decodedOutput: normalized,\r\n        reason: 'NULL_BYTE_INJECTION',\r\n      }\r\n    );\r\n  }\r\n\r\n  return {\r\n    decoded: normalized,\r\n    encoding: {\r\n      detected: encodingAttackDetected,\r\n      type: encodingAttackDetected ? 'double_encoding' : undefined,\r\n      originalInput,\r\n      decodedOutput: normalized,\r\n      iterationsRequired: iterations,\r\n    },\r\n  };\r\n}\r\n\r\n/**\r\n * Validate a file path to prevent directory traversal attacks\r\n *\r\n * Security checks performed (in order):\r\n * 1. CRITICAL: Iteratively decode URL encoding to handle %252e%252e%252f and similar bypasses\r\n * 2. CRITICAL: Normalize Unicode (NFC) to handle overlong UTF-8 like %c0%ae%c0%ae/\r\n * 3. CRITICAL: Detect null bytes and excessive encoding layers\r\n * 4. Check for home directory expansion (\"~\") on DECODED path\r\n * 5. Normalize path to resolve \"..\" and \".\"\r\n * 6. Verify all suspicious patterns are eliminated\r\n * 7. Check if path is within base directory\r\n * 8. Reject symlinks to prevent symlink attacks\r\n * 9. Log any encoding attacks detected for security monitoring\r\n *\r\n * @param filePath - The file path to validate (may be encoded)\r\n * @param baseDirectory - The base directory that file must reside within\r\n * @returns PathValidationResult with validation details\r\n * @throws PathValidationError if path validation fails or encoding attack detected\r\n *\r\n * @example\r\n * const result = validatePath('docs/FEATURE.md', './.claude/skills');\r\n * if (!result.valid) {\r\n *   throw result; // Safe to throw, contains all context\r\n * }\r\n * // Use result.resolvedPath\r\n *\r\n * @security\r\n * Designed to prevent:\r\n * - Double-encoding bypasses: %252e%252e%252f\r\n * - Overlong UTF-8: %c0%ae%c0%ae/\r\n * - Mixed encoding: URL + Unicode combinations\r\n * - Null byte injection: file.txt%00.jpg\r\n * - Traditional path traversal: ../../../etc/passwd\r\n */\r\nexport function validatePath(filePath: string, baseDirectory: string): PathValidationResult {\r\n  // SECURITY FIX: Decode all encoding layers first before any path normalization\r\n  // This prevents double-encoding bypasses like %252e%252e%252f\r\n  const { decoded: decodedPath, encoding: pathEncoding } = decodePathSafely(filePath);\r\n  const { decoded: decodedBase } = decodePathSafely(baseDirectory);\r\n\r\n  // Log encoding attacks for security monitoring\r\n  if (pathEncoding.detected) {\r\n    // In production, this should trigger security alerts\r\n    console.warn('Security: Encoding attack detected in path input', {\r\n      originalInput: pathEncoding.originalInput,\r\n      decodedOutput: pathEncoding.decodedOutput,\r\n      iterationsRequired: pathEncoding.iterationsRequired,\r\n    });\r\n  }\r\n\r\n  // Check for home directory expansion attempts on DECODED path\r\n  if (decodedPath.startsWith('~') || decodedPath.includes('/~') || decodedPath.includes('\\\\~')) {\r\n    throw new PathValidationError(\r\n      'Path validation failed: home directory access denied',\r\n      {\r\n        filePath,\r\n        decodedPath,\r\n        baseDirectory,\r\n        reason: 'HOME_DIRECTORY_ACCESS',\r\n      }\r\n    );\r\n  }\r\n\r\n  // Check for home directory expansion attempts in baseDirectory\r\n  if (decodedBase.startsWith('~')) {\r\n    throw new PathValidationError(\r\n      'Base directory validation failed: home directory access denied',\r\n      {\r\n        baseDirectory,\r\n        decodedBase,\r\n        reason: 'BASE_HOME_DIRECTORY_ACCESS',\r\n      }\r\n    );\r\n  }\r\n\r\n  // Normalize the base directory first\r\n  const normalizedBase = path.normalize(decodedBase);\r\n  const resolvedBase = path.resolve(normalizedBase);\r\n\r\n  // Normalize and resolve the file path relative to base\r\n  // NOW normalized on already-decoded path to prevent encoding bypasses\r\n  const normalizedPath = path.normalize(decodedPath);\r\n\r\n  // Check if path contains suspicious patterns after normalization\r\n  if (normalizedPath.includes('..') || normalizedPath === '.' || normalizedPath.includes('/./')) {\r\n    throw new PathValidationError(\r\n      'Path validation failed: path contains directory traversal patterns',\r\n      {\r\n        filePath,\r\n        decodedPath,\r\n        normalizedPath,\r\n        baseDirectory,\r\n        reason: 'TRAVERSAL_PATTERN_DETECTED',\r\n      }\r\n    );\r\n  }\r\n\r\n  // Resolve the path relative to base directory\r\n  const resolvedPath = path.resolve(resolvedBase, normalizedPath);\r\n\r\n  // Check if resolved path is within base directory\r\n  const isWithinBase = isPathWithinBase(resolvedPath, resolvedBase);\r\n\r\n  if (!isWithinBase) {\r\n    throw new PathValidationError(\r\n      'Path validation failed: resolved path is outside allowed directory',\r\n      {\r\n        filePath,\r\n        resolvedPath,\r\n        baseDirectory: resolvedBase,\r\n        reason: 'PATH_OUTSIDE_BASE',\r\n      }\r\n    );\r\n  }\r\n\r\n  // Check for symlinks (prevents symlink attacks)\r\n  let isSymlink = false;\r\n  try {\r\n    const stats = fs.lstatSync(resolvedPath);\r\n    isSymlink = stats.isSymbolicLink();\r\n\r\n    if (isSymlink) {\r\n      throw new PathValidationError(\r\n        'Path validation failed: symbolic links are not allowed',\r\n        {\r\n          filePath,\r\n          resolvedPath,\r\n          reason: 'SYMLINK_NOT_ALLOWED',\r\n        }\r\n      );\r\n    }\r\n  } catch (error) {\r\n    // File doesn't exist yet (expected for validation before creation)\r\n    // or it's a symlink that was rejected above\r\n    if (error instanceof PathValidationError) {\r\n      throw error;\r\n    }\r\n    // Other errors (permission denied, etc.) are not path validation failures\r\n    // The file validation happens later\r\n  }\r\n\r\n  return {\r\n    valid: true,\r\n    resolvedPath,\r\n    normalizedPath,\r\n    isWithinBase: true,\r\n    isSymlink: false,\r\n  };\r\n}\r\n\r\n/**\r\n * Check if a path is within a base directory\r\n *\r\n * Uses path resolution and string comparison to ensure the resolved path\r\n * is actually within the base directory (not just sharing a prefix).\r\n *\r\n * @param filePath - The path to check\r\n * @param baseDirectory - The base directory\r\n * @returns True if filePath is within baseDirectory\r\n *\r\n * @example\r\n * isPathWithinBase('/home/user/project/src/file.ts', '/home/user/project')  // true\r\n * isPathWithinBase('/home/user/project-evil/file.ts', '/home/user/project') // false\r\n */\r\nexport function isPathWithinBase(filePath: string, baseDirectory: string): boolean {\r\n  // Ensure both paths are normalized and absolute\r\n  const normalizedFile = path.normalize(path.resolve(filePath));\r\n  const normalizedBase = path.normalize(path.resolve(baseDirectory));\r\n\r\n  // Exact match\r\n  if (normalizedFile === normalizedBase) {\r\n    return true;\r\n  }\r\n\r\n  // Check if file is within base (use path.relative to ensure it's not going up)\r\n  const relative = path.relative(normalizedBase, normalizedFile);\r\n\r\n  // If relative path starts with \"..\", it's outside the base directory\r\n  if (relative.startsWith('..')) {\r\n    return false;\r\n  }\r\n\r\n  // If relative path is absolute, it's outside the base directory\r\n  if (path.isAbsolute(relative)) {\r\n    return false;\r\n  }\r\n\r\n  return true;\r\n}\r\n\r\n/**\r\n * Validate multiple paths within the same base directory\r\n *\r\n * Efficiently validates multiple paths, returning results for each.\r\n *\r\n * @param filePaths - Array of file paths to validate\r\n * @param baseDirectory - The base directory that all files must reside within\r\n * @returns Map of file path to validation result\r\n *\r\n * @example\r\n * const results = validatePaths(['docs/SKILL.md', 'src/index.ts'], './.claude/skills');\r\n * results.forEach((result, filePath) => {\r\n *   if (!result.valid) {\r\n *     console.error(`Invalid path: ${filePath}`, result.reason);\r\n *   }\r\n * });\r\n */\r\nexport function validatePaths(\r\n  filePaths: string[],\r\n  baseDirectory: string\r\n): Map<string, PathValidationResult> {\r\n  const results = new Map<string, PathValidationResult>();\r\n\r\n  for (const filePath of filePaths) {\r\n    try {\r\n      const result = validatePath(filePath, baseDirectory);\r\n      results.set(filePath, result);\r\n    } catch (error) {\r\n      if (error instanceof PathValidationError) {\r\n        results.set(filePath, {\r\n          valid: false,\r\n          resolvedPath: '',\r\n          normalizedPath: '',\r\n          isWithinBase: false,\r\n          isSymlink: false,\r\n          reason: error.context?.reason as string | undefined,\r\n        });\r\n      } else {\r\n        throw error;\r\n      }\r\n    }\r\n  }\r\n\r\n  return results;\r\n}\r\n\r\n/**\r\n * Get the safe path for a file (or throw if validation fails)\r\n *\r\n * Convenience function that validates and returns the resolved path,\r\n * or throws an error if validation fails.\r\n *\r\n * @param filePath - The file path to validate\r\n * @param baseDirectory - The base directory that file must reside within\r\n * @returns The resolved, validated absolute path\r\n * @throws PathValidationError if path validation fails\r\n *\r\n * @example\r\n * const safePath = getSafePath('docs/SKILL.md', './.claude/skills');\r\n * fs.readFileSync(safePath); // Safe to use\r\n */\r\nexport function getSafePath(filePath: string, baseDirectory: string): string {\r\n  const result = validatePath(filePath, baseDirectory);\r\n  return result.resolvedPath;\r\n}\r\n\r\n/**\r\n * Check if a path is considered safe for operations\r\n *\r\n * This is a non-throwing version of validatePath for conditional logic.\r\n *\r\n * @param filePath - The file path to check\r\n * @param baseDirectory - The base directory\r\n * @returns True if path is safe, false otherwise\r\n *\r\n * @example\r\n * if (isPathSafe(userInput, './.claude/skills')) {\r\n *   // Process the file\r\n * } else {\r\n *   // Reject the request\r\n * }\r\n */\r\nexport function isPathSafe(filePath: string, baseDirectory: string): boolean {\r\n  try {\r\n    validatePath(filePath, baseDirectory);\r\n    return true;\r\n  } catch {\r\n    return false;\r\n  }\r\n}\r\n\r\n/**\r\n * Get validation error details for a path (if invalid)\r\n *\r\n * Useful for logging and diagnostics.\r\n *\r\n * @param filePath - The file path to validate\r\n * @param baseDirectory - The base directory\r\n * @returns Error with details, or undefined if path is valid\r\n *\r\n * @example\r\n * const error = getPathValidationError('../../etc/passwd', './.claude/skills');\r\n * if (error) {\r\n *   logger.error(error.message, error.context);\r\n * }\r\n */\r\nexport function getPathValidationError(\r\n  filePath: string,\r\n  baseDirectory: string\r\n): PathValidationError | undefined {\r\n  try {\r\n    validatePath(filePath, baseDirectory);\r\n    return undefined;\r\n  } catch (error) {\r\n    if (error instanceof PathValidationError) {\r\n      return error;\r\n    }\r\n    throw error;\r\n  }\r\n}\r\n\r\n/**\r\n * List allowed files within a base directory (safely)\r\n *\r\n * Recursively lists all files within base directory, validating\r\n * each path to ensure it's within bounds.\r\n *\r\n * @param baseDirectory - The base directory to scan\r\n * @param options - Options for listing (maxDepth, filter)\r\n * @returns Array of validated, safe paths relative to baseDirectory\r\n *\r\n * @example\r\n * const files = safeListDirectory('./.claude/skills');\r\n * files.forEach(file => {\r\n *   // All paths are guaranteed safe\r\n *   console.log(file);\r\n * });\r\n */\r\nexport function safeListDirectory(\r\n  baseDirectory: string,\r\n  options?: {\r\n    maxDepth?: number;\r\n    filter?: (path: string) => boolean;\r\n  }\r\n): string[] {\r\n  const safeFiles: string[] = [];\r\n  const maxDepth = options?.maxDepth ?? Infinity;\r\n  const filter = options?.filter ?? (() => true);\r\n\r\n  function walkDirectory(dir: string, currentDepth: number = 0): void {\r\n    if (currentDepth > maxDepth) {\r\n      return;\r\n    }\r\n\r\n    try {\r\n      const entries = fs.readdirSync(dir, { withFileTypes: true });\r\n\r\n      for (const entry of entries) {\r\n        const fullPath = path.join(dir, entry.name);\r\n        const relativePath = path.relative(baseDirectory, fullPath);\r\n\r\n        // Validate the path is still within base\r\n        if (!isPathWithinBase(fullPath, baseDirectory)) {\r\n          continue;\r\n        }\r\n\r\n        // Apply filter\r\n        if (!filter(relativePath)) {\r\n          continue;\r\n        }\r\n\r\n        safeFiles.push(relativePath);\r\n\r\n        // Recursively walk directories\r\n        if (entry.isDirectory() && !entry.isSymbolicLink()) {\r\n          walkDirectory(fullPath, currentDepth + 1);\r\n        }\r\n      }\r\n    } catch (error) {\r\n      // Silently skip directories we can't read (permission denied, etc.)\r\n    }\r\n  }\r\n\r\n  walkDirectory(baseDirectory);\r\n  return safeFiles;\r\n}\r\n"],"names":["path","fs","StandardError","PathValidationError","message","context","name","decodePathSafely","inputPath","decoded","previous","iterations","MAX_ITERATIONS","originalInput","invalidEncodingDetected","decodeURIComponent","error","errorMessage","match","decodedOutput","reason","encodingAttackDetected","normalized","normalize","includes","encoding","detected","type","undefined","iterationsRequired","validatePath","filePath","baseDirectory","decodedPath","pathEncoding","decodedBase","console","warn","startsWith","normalizedBase","resolvedBase","resolve","normalizedPath","resolvedPath","isWithinBase","isPathWithinBase","isSymlink","stats","lstatSync","isSymbolicLink","valid","normalizedFile","relative","isAbsolute","validatePaths","filePaths","results","Map","result","set","getSafePath","isPathSafe","getPathValidationError","safeListDirectory","options","safeFiles","maxDepth","Infinity","filter","walkDirectory","dir","currentDepth","entries","readdirSync","withFileTypes","entry","fullPath","join","relativePath","push","isDirectory"],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;CAsBC,GAED,YAAYA,UAAU,OAAO;AAC7B,YAAYC,QAAQ,KAAK;AACzB,SAASC,aAAa,QAAQ,WAAW;AAEzC;;CAEC,GACD,OAAO,MAAMC,4BAA4BD;IACvC,YAAYE,OAAe,EAAEC,OAAiC,CAAE;QAC9D,KAAK,CAAC,yBAAyBD,SAASC;QACxC,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAyBA;;;;;;;;;;;;;;;CAeC,GACD,SAASC,iBAAiBC,SAAiB;IAIzC,IAAIC,UAAUD;IACd,IAAIE,WAAW;IACf,IAAIC,aAAa;IACjB,MAAMC,iBAAiB;IACvB,MAAMC,gBAAgBL;IACtB,IAAIM,0BAA0B;IAE9B,yDAAyD;IACzD,8DAA8D;IAC9D,MAAOL,YAAYC,YAAYC,aAAaC,eAAgB;QAC1DF,WAAWD;QACX,IAAI;YACFA,UAAUM,mBAAmBN;QAC/B,EAAE,OAAOO,OAAO;YACd,kEAAkE;YAClE,4DAA4D;YAC5D,kEAAkE;YAClE,MAAMC,eAAe,AAACD,MAAgBZ,OAAO,IAAI;YAEjD,oDAAoD;YACpD,IAAIK,QAAQS,KAAK,CAAC,uBAAuBT,QAAQS,KAAK,CAAC,qBAAqB;gBAC1EJ,0BAA0B;gBAC1B;YACF;YAIA;QACF;QACAH;IACF;IAEA,uEAAuE;IACvE,IAAIA,cAAcC,kBAAkBH,YAAYC,UAAU;QACxD,MAAM,IAAIP,oBACR,8DACA;YACEU;YACAM,eAAeV;YACfE;YACAS,QAAQ;QACV;IAEJ;IAEA,sEAAsE;IACtE,IAAIN,yBAAyB;QAC3B,MAAM,IAAIX,oBACR,gFACA;YACEU;YACAM,eAAeV;YACfE;YACAS,QAAQ;QACV;IAEJ;IAEA,2EAA2E;IAC3E,4EAA4E;IAC5E,mFAAmF;IACnF,oEAAoE;IACpE,MAAMC,yBAAyBV,aAAa;IAE5C,2DAA2D;IAC3D,0DAA0D;IAC1D,IAAIW,aAAab;IACjB,IAAI;QACFa,aAAab,QAAQc,SAAS,CAAC;IACjC,EAAE,OAAOP,OAAO;IACd,4EAA4E;IAC9E;IAEA,+DAA+D;IAC/D,IAAIM,WAAWE,QAAQ,CAAC,OAAO;QAC7B,MAAM,IAAIrB,oBACR,wDACA;YACEU;YACAM,eAAeG;YACfF,QAAQ;QACV;IAEJ;IAEA,OAAO;QACLX,SAASa;QACTG,UAAU;YACRC,UAAUL;YACVM,MAAMN,yBAAyB,oBAAoBO;YACnDf;YACAM,eAAeG;YACfO,oBAAoBlB;QACtB;IACF;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCC,GACD,OAAO,SAASmB,aAAaC,QAAgB,EAAEC,aAAqB;IAClE,+EAA+E;IAC/E,8DAA8D;IAC9D,MAAM,EAAEvB,SAASwB,WAAW,EAAER,UAAUS,YAAY,EAAE,GAAG3B,iBAAiBwB;IAC1E,MAAM,EAAEtB,SAAS0B,WAAW,EAAE,GAAG5B,iBAAiByB;IAElD,+CAA+C;IAC/C,IAAIE,aAAaR,QAAQ,EAAE;QACzB,qDAAqD;QACrDU,QAAQC,IAAI,CAAC,oDAAoD;YAC/DxB,eAAeqB,aAAarB,aAAa;YACzCM,eAAee,aAAaf,aAAa;YACzCU,oBAAoBK,aAAaL,kBAAkB;QACrD;IACF;IAEA,8DAA8D;IAC9D,IAAII,YAAYK,UAAU,CAAC,QAAQL,YAAYT,QAAQ,CAAC,SAASS,YAAYT,QAAQ,CAAC,QAAQ;QAC5F,MAAM,IAAIrB,oBACR,wDACA;YACE4B;YACAE;YACAD;YACAZ,QAAQ;QACV;IAEJ;IAEA,+DAA+D;IAC/D,IAAIe,YAAYG,UAAU,CAAC,MAAM;QAC/B,MAAM,IAAInC,oBACR,kEACA;YACE6B;YACAG;YACAf,QAAQ;QACV;IAEJ;IAEA,qCAAqC;IACrC,MAAMmB,iBAAiBvC,KAAKuB,SAAS,CAACY;IACtC,MAAMK,eAAexC,KAAKyC,OAAO,CAACF;IAElC,uDAAuD;IACvD,sEAAsE;IACtE,MAAMG,iBAAiB1C,KAAKuB,SAAS,CAACU;IAEtC,iEAAiE;IACjE,IAAIS,eAAelB,QAAQ,CAAC,SAASkB,mBAAmB,OAAOA,eAAelB,QAAQ,CAAC,QAAQ;QAC7F,MAAM,IAAIrB,oBACR,sEACA;YACE4B;YACAE;YACAS;YACAV;YACAZ,QAAQ;QACV;IAEJ;IAEA,8CAA8C;IAC9C,MAAMuB,eAAe3C,KAAKyC,OAAO,CAACD,cAAcE;IAEhD,kDAAkD;IAClD,MAAME,eAAeC,iBAAiBF,cAAcH;IAEpD,IAAI,CAACI,cAAc;QACjB,MAAM,IAAIzC,oBACR,sEACA;YACE4B;YACAY;YACAX,eAAeQ;YACfpB,QAAQ;QACV;IAEJ;IAEA,gDAAgD;IAChD,IAAI0B,YAAY;IAChB,IAAI;QACF,MAAMC,QAAQ9C,GAAG+C,SAAS,CAACL;QAC3BG,YAAYC,MAAME,cAAc;QAEhC,IAAIH,WAAW;YACb,MAAM,IAAI3C,oBACR,0DACA;gBACE4B;gBACAY;gBACAvB,QAAQ;YACV;QAEJ;IACF,EAAE,OAAOJ,OAAO;QACd,mEAAmE;QACnE,4CAA4C;QAC5C,IAAIA,iBAAiBb,qBAAqB;YACxC,MAAMa;QACR;IACA,0EAA0E;IAC1E,oCAAoC;IACtC;IAEA,OAAO;QACLkC,OAAO;QACPP;QACAD;QACAE,cAAc;QACdE,WAAW;IACb;AACF;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASD,iBAAiBd,QAAgB,EAAEC,aAAqB;IACtE,gDAAgD;IAChD,MAAMmB,iBAAiBnD,KAAKuB,SAAS,CAACvB,KAAKyC,OAAO,CAACV;IACnD,MAAMQ,iBAAiBvC,KAAKuB,SAAS,CAACvB,KAAKyC,OAAO,CAACT;IAEnD,cAAc;IACd,IAAImB,mBAAmBZ,gBAAgB;QACrC,OAAO;IACT;IAEA,+EAA+E;IAC/E,MAAMa,WAAWpD,KAAKoD,QAAQ,CAACb,gBAAgBY;IAE/C,qEAAqE;IACrE,IAAIC,SAASd,UAAU,CAAC,OAAO;QAC7B,OAAO;IACT;IAEA,gEAAgE;IAChE,IAAItC,KAAKqD,UAAU,CAACD,WAAW;QAC7B,OAAO;IACT;IAEA,OAAO;AACT;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASE,cACdC,SAAmB,EACnBvB,aAAqB;IAErB,MAAMwB,UAAU,IAAIC;IAEpB,KAAK,MAAM1B,YAAYwB,UAAW;QAChC,IAAI;YACF,MAAMG,SAAS5B,aAAaC,UAAUC;YACtCwB,QAAQG,GAAG,CAAC5B,UAAU2B;QACxB,EAAE,OAAO1C,OAAO;YACd,IAAIA,iBAAiBb,qBAAqB;gBACxCqD,QAAQG,GAAG,CAAC5B,UAAU;oBACpBmB,OAAO;oBACPP,cAAc;oBACdD,gBAAgB;oBAChBE,cAAc;oBACdE,WAAW;oBACX1B,QAAQJ,MAAMX,OAAO,EAAEe;gBACzB;YACF,OAAO;gBACL,MAAMJ;YACR;QACF;IACF;IAEA,OAAOwC;AACT;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASI,YAAY7B,QAAgB,EAAEC,aAAqB;IACjE,MAAM0B,SAAS5B,aAAaC,UAAUC;IACtC,OAAO0B,OAAOf,YAAY;AAC5B;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASkB,WAAW9B,QAAgB,EAAEC,aAAqB;IAChE,IAAI;QACFF,aAAaC,UAAUC;QACvB,OAAO;IACT,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAAS8B,uBACd/B,QAAgB,EAChBC,aAAqB;IAErB,IAAI;QACFF,aAAaC,UAAUC;QACvB,OAAOJ;IACT,EAAE,OAAOZ,OAAO;QACd,IAAIA,iBAAiBb,qBAAqB;YACxC,OAAOa;QACT;QACA,MAAMA;IACR;AACF;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAAS+C,kBACd/B,aAAqB,EACrBgC,OAGC;IAED,MAAMC,YAAsB,EAAE;IAC9B,MAAMC,WAAWF,SAASE,YAAYC;IACtC,MAAMC,SAASJ,SAASI,UAAW,CAAA,IAAM,IAAG;IAE5C,SAASC,cAAcC,GAAW,EAAEC,eAAuB,CAAC;QAC1D,IAAIA,eAAeL,UAAU;YAC3B;QACF;QAEA,IAAI;YACF,MAAMM,UAAUvE,GAAGwE,WAAW,CAACH,KAAK;gBAAEI,eAAe;YAAK;YAE1D,KAAK,MAAMC,SAASH,QAAS;gBAC3B,MAAMI,WAAW5E,KAAK6E,IAAI,CAACP,KAAKK,MAAMrE,IAAI;gBAC1C,MAAMwE,eAAe9E,KAAKoD,QAAQ,CAACpB,eAAe4C;gBAElD,yCAAyC;gBACzC,IAAI,CAAC/B,iBAAiB+B,UAAU5C,gBAAgB;oBAC9C;gBACF;gBAEA,eAAe;gBACf,IAAI,CAACoC,OAAOU,eAAe;oBACzB;gBACF;gBAEAb,UAAUc,IAAI,CAACD;gBAEf,+BAA+B;gBAC/B,IAAIH,MAAMK,WAAW,MAAM,CAACL,MAAM1B,cAAc,IAAI;oBAClDoB,cAAcO,UAAUL,eAAe;gBACzC;YACF;QACF,EAAE,OAAOvD,OAAO;QACd,oEAAoE;QACtE;IACF;IAEAqD,cAAcrC;IACd,OAAOiC;AACT"}