mythik 0.0.1 → 0.1.0

package/dist/security/spec-signing.js

@@ -0,0 +1,62 @@
+/**
+ * Spec signing — detects tampered specs using HMAC.
+ *
+ * In development: disabled (no friction).
+ * In production: each spec has a signature that must match.
+ *
+ * Usage:
+ *   const signer = createSpecSigner({ enabled: true, secret: 'my-secret' });
+ *   const signature = signer.sign(spec);
+ *   signer.verify(spec, signature) → true
+ *   signer.verify(tamperedSpec, signature) → false
+ */
+export function createSpecSigner(config) {
+    function isEnabled() {
+        return config.enabled && !!config.secret;
+    }
+    async function computeHash(data, secret) {
+        // Use Web Crypto API (works in browser and Node 18+)
+        if (typeof globalThis.crypto?.subtle !== 'undefined') {
+            const encoder = new TextEncoder();
+            const keyData = encoder.encode(secret);
+            const msgData = encoder.encode(data);
+            const key = await crypto.subtle.importKey('raw', keyData, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+            const signature = await crypto.subtle.sign('HMAC', key, msgData);
+            return Array.from(new Uint8Array(signature))
+                .map((b) => b.toString(16).padStart(2, '0'))
+                .join('');
+        }
+        // Fallback: FNV-1a hash with secret prefix (not cryptographically secure, but deterministic)
+        const str = secret + '::' + data;
+        let h1 = 0x811c9dc5 >>> 0;
+        let h2 = 0x01000193 >>> 0;
+        for (let i = 0; i < str.length; i++) {
+            const c = str.charCodeAt(i);
+            h1 = Math.imul(h1 ^ c, 0x01000193) >>> 0;
+            h2 = Math.imul(h2 ^ c, 0x811c9dc5) >>> 0;
+        }
+        return h1.toString(16).padStart(8, '0') + h2.toString(16).padStart(8, '0');
+    }
+    function stableStringify(obj) {
+        if (obj === null || obj === undefined || typeof obj !== 'object')
+            return JSON.stringify(obj);
+        if (Array.isArray(obj))
+            return '[' + obj.map(stableStringify).join(',') + ']';
+        const sorted = Object.keys(obj).sort();
+        return '{' + sorted.map((k) => JSON.stringify(k) + ':' + stableStringify(obj[k])).join(',') + '}';
+    }
+    async function sign(spec) {
+        if (!isEnabled())
+            return '';
+        const json = stableStringify(spec);
+        return computeHash(json, config.secret);
+    }
+    async function verify(spec, signature) {
+        if (!isEnabled())
+            return true;
+        const expected = await sign(spec);
+        return expected === signature;
+    }
+    return { sign, verify, isEnabled };
+}
+//# sourceMappingURL=spec-signing.js.map

package/dist/security/spec-signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-signing.js","sourceRoot":"","sources":["../../src/security/spec-signing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,SAAS,SAAS;QAChB,OAAO,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IAC3C,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;QACrD,qDAAqD;QACrD,IAAI,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,KAAK,WAAW,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAErC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CACnE,CAAC;YAEF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YACjE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;iBACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;iBAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;QAED,6FAA6F;QAC7F,MAAM,GAAG,GAAG,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;QACjC,IAAI,EAAE,GAAG,UAAU,KAAK,CAAC,CAAC;QAC1B,IAAI,EAAE,GAAG,UAAU,KAAK,CAAC,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;YACzC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,SAAS,eAAe,CAAC,GAAY;QACnC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7F,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC,CAAC,IAAI,EAAE,CAAC;QAClE,OAAO,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,eAAe,CAAE,GAA+B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACjI,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,IAAa;QAC/B,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAO,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,IAAa,EAAE,SAAiB;QACpD,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,QAAQ,KAAK,SAAS,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC"}

package/dist/security/spec-validator.d.ts

@@ -0,0 +1,60 @@
+import type { PrimitiveRegistry } from '../renderer/registry.js';
+import type { ElementRegistry } from '../elements/composer.js';
+import type { JsonPatch } from '../streaming/patch.js';
+import type { PrimitiveSchema } from '../renderer/prop-schemas.js';
+export interface SuggestedFix {
+    patch: JsonPatch;
+    confidence: 'high';
+    description: string;
+}
+/**
+ * Validation error/warning structure used by all validators in `mythik`.
+ *
+ * @property message - Human-readable description.
+ * @property elementId - Optional element ID context (Spec docs).
+ * @property path - JSON Pointer path to the offending location.
+ * @property suggestedFixes - Optional auto-fix patches (RFC 6902).
+ * @property ruleId - Optional lint rule identifier (e.g. 'spec-row-literal').
+ *   Convention: `<surface>-<short-name>` where surface ∈ `spec` | `code`.
+ *   Set by lint-rule emitters; left undefined for non-lint validation errors.
+ *   Used by `runLint` orchestrator to identify lint findings vs other output.
+ */
+export interface ValidationError {
+    message: string;
+    elementId?: string;
+    path?: string;
+    suggestedFixes?: SuggestedFix[];
+    ruleId?: string;
+}
+export interface SpecValidationResult {
+    valid: boolean;
+    errors: ValidationError[];
+    warnings?: ValidationError[];
+    /**
+     * Additive lint findings (v49 Item I). For ApiSpec docs, this propagates
+     * `ApiSpecValidationResult.lintWarnings` through the DocumentHandler boundary
+     * so `mythik validate` / `mythik push` can surface rules 2+3 (spec-crud-id-collision,
+     * spec-auth-domains-port). For Spec docs, lint findings emit via `warnings` with
+     * `ruleId` set; this field stays undefined.
+     */
+    lintWarnings?: ValidationError[];
+}
+export interface ValidationContext {
+    primitiveRegistry?: PrimitiveRegistry;
+    /** Layer 3 element definitions. Types present here are NOT flagged as "unknown primitive type" — custom elements dispatch through the ElementRegistry at render time. */
+    elementRegistry?: ElementRegistry;
+    /** Primitive types that support CSS className for hover/active/focus. If provided, elements with CSS-only interactions on unsupported types generate warnings. */
+    cssHoverTypes?: Set<string>;
+    /** Generate suggested fix patches for auto-fixable errors. Default: true */
+    generateFixes?: boolean;
+    /** Tokens object for variant validation. When provided, checks that variant references exist in tokens.components. */
+    variantTokens?: Record<string, unknown>;
+    /** Valid prop names per primitive type. When provided, unknown props generate warnings. */
+    propSchemas?: Record<string, PrimitiveSchema>;
+}
+/**
+ * Validates a Spec structure before rendering.
+ * With primitiveRegistry: also validates primitive types, expressions, and action params.
+ */
+export declare function validateSpec(spec: unknown, context?: ValidationContext): SpecValidationResult;
+//# sourceMappingURL=spec-validator.d.ts.map

package/dist/security/spec-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-validator.d.ts","sourceRoot":"","sources":["../../src/security/spec-validator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAGnE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;IAC7B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,eAAe,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,yKAAyK;IACzK,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,kKAAkK;IAClK,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,4EAA4E;IAC5E,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sHAAsH;IACtH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,2FAA2F;IAC3F,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC/C;AAwUD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,GAAE,iBAAsB,GAAG,oBAAoB,CAknBjG"}