mythik 0.0.1 → 0.1.0

package/dist/security/app-spec-validator.js

@@ -0,0 +1,200 @@
+import { validateSpec } from './spec-validator.js';
+import { suggest } from '../utils/levenshtein.js';
+import { validateIdentityTokens } from './identity-token-validator.js';
+import { RESERVED_PATHS } from '../state/reserved-paths.js';
+export function validateAppSpec(appSpec, context = {}) {
+    const errors = [];
+    const warnings = [];
+    const screenIds = Object.keys(appSpec.screens);
+    const nav = appSpec.navigation;
+    // Level 1: Layout validation — reuse validateSpec on virtual Spec
+    const virtualSpec = {
+        root: appSpec.layout.root,
+        elements: appSpec.layout.elements,
+    };
+    const layoutValidation = validateSpec(virtualSpec, context);
+    for (const err of layoutValidation.errors) {
+        errors.push({
+            ...err,
+            path: err.path ? `/layout${err.path}` : err.path,
+        });
+    }
+    // Level 2: Cross-reference checks
+    if (appSpec.tokens?.identity !== undefined) {
+        validateIdentityTokens(appSpec.tokens.identity, '/tokens/identity', errors);
+    }
+    // initialScreen must exist in screens
+    if (!appSpec.screens[nav.initialScreen]) {
+        errors.push({
+            message: `navigation.initialScreen "${nav.initialScreen}" not found in screens`,
+            path: '/navigation/initialScreen',
+        });
+    }
+    validateEditorSessionGuard(nav.editorSessionGuard, errors);
+    // Auth checks
+    if (nav.auth) {
+        const auth = nav.auth;
+        // loginScreen must exist
+        if (!appSpec.screens[auth.loginScreen]) {
+            errors.push({
+                message: `navigation.auth.loginScreen "${auth.loginScreen}" not found in screens`,
+                path: '/navigation/auth/loginScreen',
+            });
+        }
+        // protectedScreens items must exist (except *)
+        if (auth.protectedScreens) {
+            for (let i = 0; i < auth.protectedScreens.length; i++) {
+                const s = auth.protectedScreens[i];
+                if (s !== '*' && !appSpec.screens[s]) {
+                    errors.push({
+                        message: `navigation.auth.protectedScreens[${i}] "${s}" not found in screens`,
+                        path: `/navigation/auth/protectedScreens/${i}`,
+                    });
+                }
+            }
+        }
+        // roleAccess screen references must exist (except *)
+        if (auth.roleAccess) {
+            for (const [role, screens] of Object.entries(auth.roleAccess)) {
+                for (let i = 0; i < screens.length; i++) {
+                    const s = screens[i];
+                    if (s !== '*' && !appSpec.screens[s]) {
+                        const error = {
+                            message: `navigation.auth.roleAccess.${role}[${i}] "${s}" not found in screens`,
+                            path: `/navigation/auth/roleAccess/${role}/${i}`,
+                        };
+                        const suggested = suggest(s, screenIds);
+                        if (suggested) {
+                            error.suggestedFixes = [{
+                                    patch: { op: 'replace', path: `/navigation/auth/roleAccess/${role}/${i}`, value: suggested },
+                                    confidence: 'high',
+                                    description: `screen '${s}' → '${suggested}' (Levenshtein match)`,
+                                }];
+                        }
+                        errors.push(error);
+                    }
+                }
+            }
+        }
+    }
+    // menu items must exist in screens
+    if (nav.menu) {
+        for (let i = 0; i < nav.menu.length; i++) {
+            const s = nav.menu[i];
+            if (!appSpec.screens[s]) {
+                const error = {
+                    message: `navigation.menu[${i}] "${s}" not found in screens`,
+                    path: `/navigation/menu/${i}`,
+                };
+                const suggested = suggest(s, screenIds);
+                if (suggested) {
+                    error.suggestedFixes = [{
+                            patch: { op: 'replace', path: `/navigation/menu/${i}`, value: suggested },
+                            confidence: 'high',
+                            description: `screen '${s}' → '${suggested}' (Levenshtein match)`,
+                        }];
+                }
+                errors.push(error);
+            }
+        }
+    }
+    // Translation key consistency (warnings only)
+    if (appSpec.translations) {
+        const locales = Object.entries(appSpec.translations);
+        if (locales.length > 1) {
+            const allKeys = new Set();
+            for (const [, keys] of locales) {
+                for (const k of Object.keys(keys))
+                    allKeys.add(k);
+            }
+            for (const [locale, keys] of locales) {
+                const localeKeys = new Set(Object.keys(keys));
+                const missing = [...allKeys].filter(k => !localeKeys.has(k));
+                if (missing.length > 0) {
+                    warnings.push({
+                        message: `translations.${locale}: ${missing.length} key${missing.length !== 1 ? 's' : ''} missing (${missing.slice(0, 5).join(', ')}${missing.length > 5 ? '...' : ''})`,
+                        path: `/translations/${locale}`,
+                    });
+                }
+            }
+        }
+    }
+    // Warnings don't affect validity
+    const allIssues = [...errors, ...warnings];
+    return { valid: errors.length === 0, errors: allIssues };
+}
+function validateEditorSessionGuard(value, errors) {
+    if (value === undefined)
+        return;
+    if (!isRecord(value)) {
+        errors.push({
+            message: 'navigation.editorSessionGuard must be an object',
+            path: '/navigation/editorSessionGuard',
+        });
+        return;
+    }
+    validateOptionalBoolean(value, 'enabled', errors);
+    validateOptionalBoolean(value, 'blockNavigation', errors);
+    validateOptionalBoolean(value, 'blockGoBack', errors);
+    validateOptionalBoolean(value, 'blockBrowserUnload', errors);
+    if (value.sessions !== undefined) {
+        if (!Array.isArray(value.sessions)) {
+            errors.push({
+                message: 'navigation.editorSessionGuard.sessions must be an array of editor session ids',
+                path: '/navigation/editorSessionGuard/sessions',
+            });
+        }
+        else {
+            value.sessions.forEach((session, index) => {
+                if (typeof session !== 'string' || session.length === 0) {
+                    errors.push({
+                        message: `navigation.editorSessionGuard.sessions[${index}] must be a non-empty string`,
+                        path: `/navigation/editorSessionGuard/sessions/${index}`,
+                    });
+                }
+            });
+        }
+    }
+    if (value.pendingPath !== undefined) {
+        if (typeof value.pendingPath !== 'string') {
+            errors.push({
+                message: 'navigation.editorSessionGuard.pendingPath must be a state path string',
+                path: '/navigation/editorSessionGuard/pendingPath',
+            });
+            return;
+        }
+        if (!isConcreteUiPath(value.pendingPath)) {
+            errors.push({
+                message: 'navigation.editorSessionGuard.pendingPath must be under /ui/<segment>',
+                path: '/navigation/editorSessionGuard/pendingPath',
+            });
+            return;
+        }
+        if (isReservedPathCollision(value.pendingPath)) {
+            errors.push({
+                message: `navigation.editorSessionGuard.pendingPath "${value.pendingPath}" collides with a framework-reserved path`,
+                path: '/navigation/editorSessionGuard/pendingPath',
+            });
+        }
+    }
+}
+function validateOptionalBoolean(value, key, errors) {
+    if (value[key] === undefined || typeof value[key] === 'boolean')
+        return;
+    errors.push({
+        message: `navigation.editorSessionGuard.${key} must be a boolean`,
+        path: `/navigation/editorSessionGuard/${key}`,
+    });
+}
+function isConcreteUiPath(path) {
+    return /^\/ui\/[^/]+(?:\/.*)?$/.test(path);
+}
+function isReservedPathCollision(path) {
+    return Object.values(RESERVED_PATHS).some((reserved) => (path === reserved
+        || path.startsWith(`${reserved}/`)
+        || reserved.startsWith(`${path}/`)));
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=app-spec-validator.js.map

package/dist/security/app-spec-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-spec-validator.js","sourceRoot":"","sources":["../../src/security/app-spec-validator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAElD,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,UAA6B,EAAE;IAC/E,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC;IAE/B,kEAAkE;IAClE,MAAM,WAAW,GAAG;QAClB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;QACzB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAmC;KAC7D,CAAC;IACF,MAAM,gBAAgB,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5D,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,GAAG;YACN,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI;SACjD,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAElC,IAAI,OAAO,CAAC,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3C,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED,sCAAsC;IACtC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,6BAA6B,GAAG,CAAC,aAAa,wBAAwB;YAC/E,IAAI,EAAE,2BAA2B;SAClC,CAAC,CAAC;IACL,CAAC;IAED,0BAA0B,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAE3D,cAAc;IACd,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAEtB,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,gCAAgC,IAAI,CAAC,WAAW,wBAAwB;gBACjF,IAAI,EAAE,8BAA8B;aACrC,CAAC,CAAC;QACL,CAAC;QAED,+CAA+C;QAC/C,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtD,MAAM,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrC,MAAM,CAAC,IAAI,CAAC;wBACV,OAAO,EAAE,oCAAoC,CAAC,MAAM,CAAC,wBAAwB;wBAC7E,IAAI,EAAE,qCAAqC,CAAC,EAAE;qBAC/C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;oBACrB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;wBACrC,MAAM,KAAK,GAAoB;4BAC7B,OAAO,EAAE,8BAA8B,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB;4BAC/E,IAAI,EAAE,+BAA+B,IAAI,IAAI,CAAC,EAAE;yBACjD,CAAC;wBACF,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;wBACxC,IAAI,SAAS,EAAE,CAAC;4BACd,KAAK,CAAC,cAAc,GAAG,CAAC;oCACtB,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,+BAA+B,IAAI,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;oCAC5F,UAAU,EAAE,MAAM;oCAClB,WAAW,EAAE,WAAW,CAAC,QAAQ,SAAS,uBAAuB;iCAClE,CAAC,CAAC;wBACL,CAAC;wBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAoB;oBAC7B,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,wBAAwB;oBAC5D,IAAI,EAAE,oBAAoB,CAAC,EAAE;iBAC9B,CAAC;gBACF,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBACxC,IAAI,SAAS,EAAE,CAAC;oBACd,KAAK,CAAC,cAAc,GAAG,CAAC;4BACtB,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;4BACzE,UAAU,EAAE,MAAM;4BAClB,WAAW,EAAE,WAAW,CAAC,QAAQ,SAAS,uBAAuB;yBAClE,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;YAClC,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACpD,CAAC;YACD,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;gBACrC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9C,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvB,QAAQ,CAAC,IAAI,CAAC;wBACZ,OAAO,EAAE,gBAAgB,MAAM,KAAK,OAAO,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG;wBACxK,IAAI,EAAE,iBAAiB,MAAM,EAAE;qBAChC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC;IAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc,EAAE,MAAyB;IAC3E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAEhC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,iDAAiD;YAC1D,IAAI,EAAE,gCAAgC;SACvC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAClD,uBAAuB,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAC1D,uBAAuB,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACtD,uBAAuB,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,+EAA+E;gBACxF,IAAI,EAAE,yCAAyC;aAChD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;gBACxC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACxD,MAAM,CAAC,IAAI,CAAC;wBACV,OAAO,EAAE,0CAA0C,KAAK,8BAA8B;wBACtF,IAAI,EAAE,2CAA2C,KAAK,EAAE;qBACzD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,uEAAuE;gBAChF,IAAI,EAAE,4CAA4C;aACnD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,uEAAuE;gBAChF,IAAI,EAAE,4CAA4C;aACnD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,uBAAuB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,8CAA8C,KAAK,CAAC,WAAW,2CAA2C;gBACnH,IAAI,EAAE,4CAA4C;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,KAA8B,EAAE,GAAW,EAAE,MAAyB;IACrG,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO;IACxE,MAAM,CAAC,IAAI,CAAC;QACV,OAAO,EAAE,iCAAiC,GAAG,oBAAoB;QACjE,IAAI,EAAE,kCAAkC,GAAG,EAAE;KAC9C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CACtD,IAAI,KAAK,QAAQ;WACd,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;WAC/B,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CACnC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/security/identifier-guard.d.ts

@@ -0,0 +1,3 @@
+export declare function isValidIdentifier(name: string): boolean;
+export declare function assertValidIdentifier(name: string, context: string): void;
+//# sourceMappingURL=identifier-guard.d.ts.map

package/dist/security/identifier-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifier-guard.d.ts","sourceRoot":"","sources":["../../src/security/identifier-guard.ts"],"names":[],"mappings":"AAGA,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIvD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAIzE"}

package/dist/security/identifier-guard.js

@@ -0,0 +1,15 @@
+const IDENTIFIER_REGEX = /^[a-zA-Z_][a-zA-Z0-9_.]*$/;
+const MAX_IDENTIFIER_LENGTH = 128;
+export function isValidIdentifier(name) {
+    if (!name || name.length === 0)
+        return false;
+    if (name.length > MAX_IDENTIFIER_LENGTH)
+        return false;
+    return IDENTIFIER_REGEX.test(name);
+}
+export function assertValidIdentifier(name, context) {
+    if (!isValidIdentifier(name)) {
+        throw new Error(`Invalid SQL identifier "${name}" in ${context} — must match ${IDENTIFIER_REGEX} and be ≤${MAX_IDENTIFIER_LENGTH} chars`);
+    }
+}
+//# sourceMappingURL=identifier-guard.js.map

package/dist/security/identifier-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifier-guard.js","sourceRoot":"","sources":["../../src/security/identifier-guard.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AACrD,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,OAAe;IACjE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,QAAQ,OAAO,iBAAiB,gBAAgB,YAAY,qBAAqB,QAAQ,CAAC,CAAC;IAC5I,CAAC;AACH,CAAC"}

package/dist/security/identity-token-validator.d.ts

@@ -0,0 +1,3 @@
+import type { ValidationError } from './spec-validator.js';
+export declare function validateIdentityTokens(identity: unknown, basePath: string, errors: ValidationError[]): void;
+//# sourceMappingURL=identity-token-validator.d.ts.map

package/dist/security/identity-token-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-token-validator.d.ts","sourceRoot":"","sources":["../../src/security/identity-token-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AA0F3D,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAgE3G"}

package/dist/security/identity-token-validator.js

@@ -0,0 +1,121 @@
+import { BORDER_COLOR_SOURCES, BORDER_STYLES, CARD_LINE_POSITIONS, COLOR_SCHEMES, COLOR_WEIGHTS, ELEVATION_COLORS, ELEVATION_STYLES, GRADIENT_MODES, HEADING_COLORS, ICON_CONTAINER_COLORS, ICON_CONTAINERS, ICON_WEIGHTS, IMAGE_CORNERS, IMAGE_OVERLAYS, LABEL_STYLES, RADIUS_PATTERNS, SURFACE_TYPES, TEXT_DECORATIONS, TYPOGRAPHY_HIERARCHIES, } from '../design/identity/types.js';
+const ENUM_FIELDS = {
+    surface: SURFACE_TYPES,
+    radiusPattern: RADIUS_PATTERNS,
+    borderStyle: BORDER_STYLES,
+    borderColor: BORDER_COLOR_SOURCES,
+    elevationStyle: ELEVATION_STYLES,
+    elevationColor: ELEVATION_COLORS,
+    typographyHierarchy: TYPOGRAPHY_HIERARCHIES,
+    labelStyle: LABEL_STYLES,
+    headingColor: HEADING_COLORS,
+    colorScheme: COLOR_SCHEMES,
+    colorWeight: COLOR_WEIGHTS,
+};
+function addEnumError(errors, path, value, allowed) {
+    errors.push({
+        message: `${path} must be one of: ${allowed.join(', ')} (received ${JSON.stringify(value)})`,
+        path,
+    });
+}
+function isAllowed(value, allowed) {
+    return allowed.includes(value);
+}
+function validateEnum(errors, obj, key, basePath, allowed) {
+    const value = obj[key];
+    if (value !== undefined && (typeof value !== 'string' || !isAllowed(value, allowed))) {
+        addEnumError(errors, `${basePath}/${key}`, value, allowed);
+    }
+}
+function validateBoolean(errors, obj, key, basePath) {
+    const value = obj[key];
+    if (value !== undefined && typeof value !== 'boolean') {
+        errors.push({ message: `${basePath}/${key} must be a boolean`, path: `${basePath}/${key}` });
+    }
+}
+function validateNumberRange(errors, obj, key, basePath, min, max) {
+    const value = obj[key];
+    if (value !== undefined && (typeof value !== 'number' || value < min || value > max)) {
+        errors.push({ message: `${basePath}/${key} must be a number from ${min} to ${max}`, path: `${basePath}/${key}` });
+    }
+}
+function validateObject(value, path, errors) {
+    if (value === undefined)
+        return undefined;
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        errors.push({ message: `${path} must be an object`, path });
+        return undefined;
+    }
+    return value;
+}
+function validateStringArray(errors, value, path, allowed) {
+    if (!Array.isArray(value)) {
+        errors.push({ message: `${path} must be an array`, path });
+        return;
+    }
+    value.forEach((item, index) => {
+        if (typeof item !== 'string' || !isAllowed(item, allowed)) {
+            addEnumError(errors, `${path}/${index}`, item, allowed);
+        }
+    });
+}
+export function validateIdentityTokens(identity, basePath, errors) {
+    const id = validateObject(identity, basePath, errors);
+    if (!id)
+        return;
+    for (const [key, allowed] of Object.entries(ENUM_FIELDS)) {
+        validateEnum(errors, id, key, basePath, allowed);
+    }
+    const textDecoration = id.textDecoration;
+    if (textDecoration !== undefined) {
+        if (Array.isArray(textDecoration)) {
+            validateStringArray(errors, textDecoration, `${basePath}/textDecoration`, TEXT_DECORATIONS);
+        }
+        else if (typeof textDecoration !== 'string' || !isAllowed(textDecoration, TEXT_DECORATIONS)) {
+            addEnumError(errors, `${basePath}/textDecoration`, textDecoration, TEXT_DECORATIONS);
+        }
+    }
+    validateNumberRange(errors, id, 'depth', basePath, 0, 1);
+    validateNumberRange(errors, id, 'shadowAngle', basePath, 0, 360);
+    validateNumberRange(errors, id, 'borderWidth', basePath, 0, 3);
+    validateBoolean(errors, id, 'overrideSurfaceBorders', basePath);
+    validateBoolean(errors, id, 'overrideInputButtons', basePath);
+    const accent = validateObject(id.accentApplication, `${basePath}/accentApplication`, errors);
+    if (accent) {
+        for (const key of ['buttons', 'navItems', 'links', 'backgrounds', 'iconContainers']) {
+            validateBoolean(errors, accent, key, `${basePath}/accentApplication`);
+        }
+        if (accent.cardLine !== undefined) {
+            validateStringArray(errors, accent.cardLine, `${basePath}/accentApplication/cardLine`, CARD_LINE_POSITIONS);
+        }
+    }
+    const layers = validateObject(id.coloredSurfaceLayers, `${basePath}/coloredSurfaceLayers`, errors);
+    if (layers) {
+        for (const key of ['background', 'surface', 'primitive']) {
+            validateNumberRange(errors, layers, key, `${basePath}/coloredSurfaceLayers`, 0, 100);
+        }
+    }
+    const gradients = validateObject(id.gradients, `${basePath}/gradients`, errors);
+    if (gradients) {
+        for (const key of ['buttons', 'cards', 'text']) {
+            const value = gradients[key];
+            if (value !== undefined && typeof value !== 'boolean' && (typeof value !== 'string' || !isAllowed(value, GRADIENT_MODES))) {
+                addEnumError(errors, `${basePath}/gradients/${key}`, value, GRADIENT_MODES);
+            }
+        }
+        validateBoolean(errors, gradients, 'headers', `${basePath}/gradients`);
+    }
+    const icons = validateObject(id.icons, `${basePath}/icons`, errors);
+    if (icons) {
+        validateEnum(errors, icons, 'weight', `${basePath}/icons`, ICON_WEIGHTS);
+        validateEnum(errors, icons, 'container', `${basePath}/icons`, ICON_CONTAINERS);
+        validateEnum(errors, icons, 'containerColor', `${basePath}/icons`, ICON_CONTAINER_COLORS);
+    }
+    const images = validateObject(id.images, `${basePath}/images`, errors);
+    if (images) {
+        validateEnum(errors, images, 'corners', `${basePath}/images`, IMAGE_CORNERS);
+        validateEnum(errors, images, 'overlay', `${basePath}/images`, IMAGE_OVERLAYS);
+        validateBoolean(errors, images, 'border', `${basePath}/images`);
+    }
+}
+//# sourceMappingURL=identity-token-validator.js.map

package/dist/security/identity-token-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-token-validator.js","sourceRoot":"","sources":["../../src/security/identity-token-validator.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,EACZ,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AAErC,MAAM,WAAW,GAAsC;IACrD,OAAO,EAAE,aAAa;IACtB,aAAa,EAAE,eAAe;IAC9B,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,oBAAoB;IACjC,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,mBAAmB,EAAE,sBAAsB;IAC3C,UAAU,EAAE,YAAY;IACxB,YAAY,EAAE,cAAc;IAC5B,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;CAC3B,CAAC;AAEF,SAAS,YAAY,CAAC,MAAyB,EAAE,IAAY,EAAE,KAAc,EAAE,OAA0B;IACvG,MAAM,CAAC,IAAI,CAAC;QACV,OAAO,EAAE,GAAG,IAAI,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG;QAC5F,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,OAA0B;IAC1D,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,MAAyB,EAAE,GAA4B,EAAE,GAAW,EAAE,QAAgB,EAAE,OAA0B;IACtI,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QACrF,YAAY,CAAC,MAAM,EAAE,GAAG,QAAQ,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAyB,EAAE,GAA4B,EAAE,GAAW,EAAE,QAAgB;IAC7G,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,GAAG,oBAAoB,EAAE,IAAI,EAAE,GAAG,QAAQ,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAyB,EAAE,GAA4B,EAAE,GAAW,EAAE,QAAgB,EAAE,GAAW,EAAE,GAAW;IAC3I,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,GAAG,0BAA0B,GAAG,OAAO,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,QAAQ,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IACpH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY,EAAE,MAAyB;IAC7E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAyB,EAAE,KAAc,EAAE,IAAY,EAAE,OAA0B;IAC9G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1D,YAAY,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAiB,EAAE,QAAgB,EAAE,MAAyB;IACnG,MAAM,EAAE,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,EAAE;QAAE,OAAO;IAEhB,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACzD,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,cAAc,GAAG,EAAE,CAAC,cAAc,CAAC;IACzC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAClC,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,QAAQ,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;QAC9F,CAAC;aAAM,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,CAAC,EAAE,CAAC;YAC9F,YAAY,CAAC,MAAM,EAAE,GAAG,QAAQ,iBAAiB,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,mBAAmB,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,mBAAmB,CAAC,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACjE,mBAAmB,CAAC,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,wBAAwB,EAAE,QAAQ,CAAC,CAAC;IAChE,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,sBAAsB,EAAE,QAAQ,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,iBAAiB,EAAE,GAAG,QAAQ,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAC7F,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACpF,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,oBAAoB,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,QAAQ,6BAA6B,EAAE,mBAAmB,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,oBAAoB,EAAE,GAAG,QAAQ,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACnG,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;YACzD,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,uBAAuB,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,QAAQ,YAAY,EAAE,MAAM,CAAC,CAAC;IAChF,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;gBAC1H,YAAY,CAAC,MAAM,EAAE,GAAG,QAAQ,cAAc,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,QAAQ,YAAY,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,QAAQ,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,KAAK,EAAE,CAAC;QACV,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,QAAQ,QAAQ,EAAE,YAAY,CAAC,CAAC;QACzE,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,QAAQ,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC/E,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,QAAQ,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,QAAQ,SAAS,EAAE,MAAM,CAAC,CAAC;IACvE,IAAI,MAAM,EAAE,CAAC;QACX,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,SAAS,EAAE,aAAa,CAAC,CAAC;QAC7E,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,SAAS,EAAE,cAAc,CAAC,CAAC;QAC9E,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,SAAS,CAAC,CAAC;IAClE,CAAC;AACH,CAAC"}

package/dist/security/index.d.ts

@@ -0,0 +1,14 @@
+export { validateSpec } from './spec-validator.js';
+export type { SpecValidationResult, ValidationContext, ValidationError, SuggestedFix } from './spec-validator.js';
+export { createUrlGuard } from './url-whitelist.js';
+export type { UrlGuard } from './url-whitelist.js';
+export { createStateGuard } from './state-protection.js';
+export type { StateGuard } from './state-protection.js';
+export { createSpecSigner } from './spec-signing.js';
+export type { SpecSignerConfig, SpecSigner } from './spec-signing.js';
+export { createRateLimiter } from './rate-limiter.js';
+export type { RateLimiterConfig, RateLimiter } from './rate-limiter.js';
+export { isValidIdentifier, assertValidIdentifier } from './identifier-guard.js';
+export { validateApiSpec } from './api-spec-validator.js';
+export type { ApiSpecValidationResult } from './api-spec-validator.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/security/index.js

@@ -0,0 +1,8 @@
+export { validateSpec } from './spec-validator.js';
+export { createUrlGuard } from './url-whitelist.js';
+export { createStateGuard } from './state-protection.js';
+export { createSpecSigner } from './spec-signing.js';
+export { createRateLimiter } from './rate-limiter.js';
+export { isValidIdentifier, assertValidIdentifier } from './identifier-guard.js';
+export { validateApiSpec } from './api-spec-validator.js';
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/security/protection-registry.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Protection registry for state paths. Used by createStateGuard (state-protection.ts)
+ * via lazy callback to determine which paths are protected at any moment.
+ *
+ * Contributors call `contribute(paths)` to add paths and receive a release token.
+ * Calling the release token removes only that contribution — other contributors'
+ * paths remain protected. RAII pattern: release token is captured in a cleanup
+ * closure (e.g., useEffect cleanup) so releases can't be forgotten.
+ *
+ * Internal — not re-exported from `core/index.ts`. Accessed by mountSpecRuntime
+ * via MythikInstance.
+ */
+export interface ProtectionRegistry {
+    /** Add a set of protected paths. Returns a release token. */
+    contribute: (paths: string[]) => () => void;
+    /** Snapshot all currently protected paths from all contributors. */
+    allPaths: () => string[];
+}
+export interface ProtectionRegistryConfig {
+    /** Default paths included from registry creation; never released. */
+    defaultPaths?: string[];
+}
+export declare function createProtectionRegistry(config?: ProtectionRegistryConfig): ProtectionRegistry;
+//# sourceMappingURL=protection-registry.d.ts.map

package/dist/security/protection-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protection-registry.d.ts","sourceRoot":"","sources":["../../src/security/protection-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,MAAM,IAAI,CAAC;IAC5C,oEAAoE;IACpE,QAAQ,EAAE,MAAM,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,kBAAkB,CAuB9F"}

package/dist/security/protection-registry.js

@@ -0,0 +1,35 @@
+/**
+ * Protection registry for state paths. Used by createStateGuard (state-protection.ts)
+ * via lazy callback to determine which paths are protected at any moment.
+ *
+ * Contributors call `contribute(paths)` to add paths and receive a release token.
+ * Calling the release token removes only that contribution — other contributors'
+ * paths remain protected. RAII pattern: release token is captured in a cleanup
+ * closure (e.g., useEffect cleanup) so releases can't be forgotten.
+ *
+ * Internal — not re-exported from `core/index.ts`. Accessed by mountSpecRuntime
+ * via MythikInstance.
+ */
+export function createProtectionRegistry(config) {
+    const contributions = new Map();
+    if (config?.defaultPaths && config.defaultPaths.length > 0) {
+        contributions.set(Symbol('default'), [...config.defaultPaths]);
+    }
+    return {
+        contribute(paths) {
+            const token = Symbol('contributor');
+            contributions.set(token, [...paths]);
+            return () => {
+                contributions.delete(token);
+            };
+        },
+        allPaths() {
+            const all = [];
+            for (const paths of contributions.values()) {
+                all.push(...paths);
+            }
+            return all;
+        },
+    };
+}
+//# sourceMappingURL=protection-registry.js.map

package/dist/security/protection-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protection-registry.js","sourceRoot":"","sources":["../../src/security/protection-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAcH,MAAM,UAAU,wBAAwB,CAAC,MAAiC;IACxE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;IAElD,IAAI,MAAM,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,UAAU,CAAC,KAAe;YACxB,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;YACpC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YACrC,OAAO,GAAG,EAAE;gBACV,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC,CAAC;QACJ,CAAC;QACD,QAAQ;YACN,MAAM,GAAG,GAAa,EAAE,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC3C,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YACrB,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/security/rate-limiter.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Rate limiter — prevents infinite loops from watchers/actions.
+ *
+ * If more than maxActionsPerSecond actions fire within a window,
+ * subsequent actions are blocked and an error is reported.
+ *
+ * Usage:
+ *   const limiter = createRateLimiter({ maxActionsPerSecond: 100 });
+ *   limiter.check() → true (allowed)
+ *   // ... after 100 rapid calls ...
+ *   limiter.check() → false (blocked)
+ */
+export interface RateLimiterConfig {
+    maxActionsPerSecond: number;
+}
+export interface RateLimiter {
+    check: () => boolean;
+    assertAllowed: () => void;
+    reset: () => void;
+    getCount: () => number;
+}
+export declare function createRateLimiter(config: RateLimiterConfig): RateLimiter;
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/security/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../src/security/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,OAAO,CAAC;IACrB,aAAa,EAAE,MAAM,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,QAAQ,EAAE,MAAM,MAAM,CAAC;CACxB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CAsCxE"}

package/dist/security/rate-limiter.js

@@ -0,0 +1,44 @@
+/**
+ * Rate limiter — prevents infinite loops from watchers/actions.
+ *
+ * If more than maxActionsPerSecond actions fire within a window,
+ * subsequent actions are blocked and an error is reported.
+ *
+ * Usage:
+ *   const limiter = createRateLimiter({ maxActionsPerSecond: 100 });
+ *   limiter.check() → true (allowed)
+ *   // ... after 100 rapid calls ...
+ *   limiter.check() → false (blocked)
+ */
+export function createRateLimiter(config) {
+    let count = 0;
+    let windowStart = Date.now();
+    function resetIfNeeded() {
+        const now = Date.now();
+        if (now - windowStart >= 1000) {
+            count = 0;
+            windowStart = now;
+        }
+    }
+    function check() {
+        resetIfNeeded();
+        count++;
+        return count <= config.maxActionsPerSecond;
+    }
+    function assertAllowed() {
+        if (!check()) {
+            throw new Error(`Rate limit exceeded: ${config.maxActionsPerSecond} actions/second. ` +
+                `This usually indicates an infinite loop in watchers or actions.`);
+        }
+    }
+    function reset() {
+        count = 0;
+        windowStart = Date.now();
+    }
+    function getCount() {
+        resetIfNeeded();
+        return count;
+    }
+    return { check, assertAllowed, reset, getCount };
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/security/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../src/security/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,SAAS,aAAa;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC;YAC9B,KAAK,GAAG,CAAC,CAAC;YACV,WAAW,GAAG,GAAG,CAAC;QACpB,CAAC;IACH,CAAC;IAED,SAAS,KAAK;QACZ,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,CAAC;QACR,OAAO,KAAK,IAAI,MAAM,CAAC,mBAAmB,CAAC;IAC7C,CAAC;IAED,SAAS,aAAa;QACpB,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,wBAAwB,MAAM,CAAC,mBAAmB,mBAAmB;gBACrE,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,SAAS,KAAK;QACZ,KAAK,GAAG,CAAC,CAAC;QACV,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,CAAC;IAED,SAAS,QAAQ;QACf,aAAa,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACnD,CAAC"}

package/dist/security/spec-signing.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Spec signing — detects tampered specs using HMAC.
+ *
+ * In development: disabled (no friction).
+ * In production: each spec has a signature that must match.
+ *
+ * Usage:
+ *   const signer = createSpecSigner({ enabled: true, secret: 'my-secret' });
+ *   const signature = signer.sign(spec);
+ *   signer.verify(spec, signature) → true
+ *   signer.verify(tamperedSpec, signature) → false
+ */
+export interface SpecSignerConfig {
+    enabled: boolean;
+    secret?: string;
+}
+export interface SpecSigner {
+    sign: (spec: unknown) => Promise<string>;
+    verify: (spec: unknown, signature: string) => Promise<boolean>;
+    isEnabled: () => boolean;
+}
+export declare function createSpecSigner(config: SpecSignerConfig): SpecSigner;
+//# sourceMappingURL=spec-signing.d.ts.map

package/dist/security/spec-signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-signing.d.ts","sourceRoot":"","sources":["../../src/security/spec-signing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,SAAS,EAAE,MAAM,OAAO,CAAC;CAC1B;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAsDrE"}