specky-sdd 3.4.0 → 3.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +22 -0
- package/README.md +24 -8
- package/SECURITY.md +15 -8
- package/apm.yml +1 -1
- package/config.yml +1 -1
- package/dist/cli/commands/serve.d.ts.map +1 -1
- package/dist/cli/commands/serve.js +3 -2
- package/dist/cli/commands/serve.js.map +1 -1
- package/dist/cli/index.js +3 -1
- package/dist/cli/index.js.map +1 -1
- package/dist/config.d.ts +21 -1
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +82 -6
- package/dist/config.js.map +1 -1
- package/dist/index.js +63 -14
- package/dist/index.js.map +1 -1
- package/dist/services/audit-logger.d.ts +54 -5
- package/dist/services/audit-logger.d.ts.map +1 -1
- package/dist/services/audit-logger.js +121 -9
- package/dist/services/audit-logger.js.map +1 -1
- package/dist/services/file-manager.d.ts.map +1 -1
- package/dist/services/file-manager.js +9 -3
- package/dist/services/file-manager.js.map +1 -1
- package/dist/tools/audit.js +1 -1
- package/dist/tools/audit.js.map +1 -1
- package/dist/tools/rbac.d.ts.map +1 -1
- package/dist/tools/rbac.js +18 -11
- package/dist/tools/rbac.js.map +1 -1
- package/dist/tools/tool-enforcement.d.ts +15 -1
- package/dist/tools/tool-enforcement.d.ts.map +1 -1
- package/dist/tools/tool-enforcement.js +70 -9
- package/dist/tools/tool-enforcement.js.map +1 -1
- package/dist/utils/token-table.d.ts +41 -0
- package/dist/utils/token-table.d.ts.map +1 -0
- package/dist/utils/token-table.js +103 -0
- package/dist/utils/token-table.js.map +1 -0
- package/package.json +1 -1
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnE,8BAA8B;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,iCAAiC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,yBAAyB;AACzB,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACpE,OAAO,CAAC,KAAK,CAAC,4BAA4B,aAAa,EAAE,CAAC,CAAC;AAE3D,oDAAoD;AACpD,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;AACzC,IAAI,MAAM,CAAC,cAAc;IAAE,OAAO,CAAC,KAAK,CAAC,8BAA8B,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;AAChG,IAAI,MAAM,CAAC,aAAa;IAAE,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;AAEzE,wBAAwB;AACxB,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;IACE,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,QAAQ;IACf,WAAW,EAAE,8IAA8I;IAC3J,UAAU,EAAE,sBAAsB;IAClC,KAAK,EAAE;QACL;YACE,GAAG,EAAE,0FAA0F;YAC/F,QAAQ,EAAE,eAAe;SAC1B;QACD;YACE,GAAG,EAAE,wFAAwF;YAC7F,QAAQ,EAAE,WAAW;YACrB,KAAK,EAAE,CAAC,SAAS,CAAC;SACnB;KACF;CACF,EACD;IACE,YAAY,EAAE,2SAA2S;CAC1T,CACF,CAAC;AAEF,2BAA2B;AAC3B,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,aAAa,CAAC,CAAC;AACnD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AAClE,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,IAAI,SAAS,CAAC,CAAC;AAC3F,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;AAC1C,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;AACzD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAE3D,2BAA2B;AAC3B,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC;AAC7D,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAC3D,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;AACnD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAC3D,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;AACrD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAChD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACjE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;AAC/C,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;AACrD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;AACnD,MAAM,WAAW,GAAG,IAAI,WAAW,CACjC,aAAa,EACb,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,KAAK,CAAC,aAAa,EAC1B,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAC9B,CAAC;AACF,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,EAC5B,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,aAAa,CAC1C,CAAC;AACF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAC3D,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;AACpD,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,EAAE,CAAC;AACxD,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,EAAE,CAAC;AACtD,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAClD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAChD,MAAM,sBAAsB,GAAG,IAAI,sBAAsB,EAAE,CAAC;AAE5D,sBAAsB,CAAC,MAAM,EAAE;IAC7B,WAAW;IACX,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAEH,gCAAgC;AAChC,WAAW;AACX,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;AACxF,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;AAC5F,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC;AAC5G,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAE5G,YAAY;AACZ,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;AACzE,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;AACxH,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;AAChF,2BAA2B,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAC7E,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;AAC3F,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;AAC1G,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAC5E,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;AACjH,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;AAC3D,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;AACvF,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAClE,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;AAClH,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AACjD,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;AAC9E,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACtC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAExC,oBAAoB;AACpB,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,cAAc;QAAE,OAAO;IAC3B,cAAc,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,KAAK,CAAC,qBAAqB,MAAM,+BAA+B,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACxB,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;AAEvD,eAAe;AACf,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAExC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;QAE5E,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,WAAW,CAAC;QACpE,MAAM,UAAU,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;QAElF,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;QACzC,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CACX,gEAAgE,IAAI,4BAA4B;gBAChG,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,MAA0B,EAAW,EAAE,CAC3D,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAExC,MAAM,EAAE,6BAA6B,EAAE,GAAG,MAAM,MAAM,CACpD,oDAAoD,CACrD,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;YACtC,0EAA0E;YAC1E,oEAAoE;YACpE,4BAA4B,EAAE,IAAI;YAClC,YAAY,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,aAAa,IAAI,EAAE,EAAE,aAAa,IAAI,EAAE,CAAC;SAC5E,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,iEAAiE;QACjE,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO;YAC3C,CAAC,CAAC,IAAI,WAAW,CACb,MAAM,CAAC,UAAU,CAAC,uBAAuB,IAAI,EAAE,EAC/C,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAC9B;YACH,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CACX,mCAAmC,MAAM,CAAC,UAAU,CAAC,uBAAuB,eAAe,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CACrH,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtD,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBACvB,sCAAsC;gBACtC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;oBAChD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;wBACjB,cAAc,EAAE,kBAAkB;wBAClC,kBAAkB,EAAE,QAAQ;qBAC7B,CAAC,CAAC;oBACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;oBACnD,OAAO;gBACT,CAAC;gBACD,uDAAuD;gBACvD,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;oBACvD,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;oBACnD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;wBACnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;wBACvE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;4BACjB,cAAc,EAAE,kBAAkB;4BAClC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC;yBACrC,CAAC,CAAC;wBACH,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;4BACb,KAAK,EAAE,mBAAmB;4BAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;yBACrC,CAAC,CACH,CAAC;wBACF,OAAO;oBACT,CAAC;gBACH,CAAC;gBACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1C,CAAC;iBAAM,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YACjC,OAAO,CAAC,KAAK,CAAC,qCAAqC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,sCAAsC,OAAO,GAAG,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnE,8BAA8B;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,iCAAiC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,SAAS,EAAwB,MAAM,wBAAwB,CAAC;AAChH,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,yBAAyB;AACzB,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACpE,OAAO,CAAC,KAAK,CAAC,4BAA4B,aAAa,EAAE,CAAC,CAAC;AAE3D,wEAAwE;AACxE,+EAA+E;AAC/E,yCAAyC;AACzC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;AACzC,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;AAC3C,IAAI,MAAM,CAAC,cAAc;IAAE,OAAO,CAAC,KAAK,CAAC,8BAA8B,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;AAChG,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;IACpC,OAAO,CAAC,KAAK,CACX,wCAAwC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE;QAC7E,iBAAiB,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;QAChG,UAAU,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,kBAAkB,MAAM,CAAC,IAAI,CAAC,YAAY,GAAG;QACzF,gBAAgB,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAC3D,CAAC;IACF,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1C,OAAO,CAAC,KAAK,CACX,8EAA8E;YAC9E,uGAAuG,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;KAAM,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,gCAAgC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,wBAAwB;AACxB,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;IACE,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,QAAQ;IACf,WAAW,EAAE,8IAA8I;IAC3J,UAAU,EAAE,sBAAsB;IAClC,KAAK,EAAE;QACL;YACE,GAAG,EAAE,0FAA0F;YAC/F,QAAQ,EAAE,eAAe;SAC1B;QACD;YACE,GAAG,EAAE,wFAAwF;YAC7F,QAAQ,EAAE,WAAW;YACrB,KAAK,EAAE,CAAC,SAAS,CAAC;SACnB;KACF;CACF,EACD;IACE,YAAY,EAAE,2SAA2S;CAC1T,CACF,CAAC;AAEF,2BAA2B;AAC3B,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,aAAa,CAAC,CAAC;AACnD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AAClE,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,IAAI,SAAS,CAAC,CAAC;AAC3F,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;AAC1C,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;AACzD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAE3D,2BAA2B;AAC3B,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC;AAC7D,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAC3D,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;AACnD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAC3D,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;AACrD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAChD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACjE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;AAC/C,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;AACrD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;AACnD,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE;IACvE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;IACxC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB;IAC5C,OAAO,EAAE,YAAY;IACrB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW;CACrC,CAAC,CAAC;AACH,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,EAC5B,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,aAAa,CAC1C,CAAC;AACF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAC3D,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;AACpD,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,EAAE,CAAC;AACxD,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,EAAE,CAAC;AACtD,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAClD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAChD,MAAM,sBAAsB,GAAG,IAAI,sBAAsB,EAAE,CAAC;AAE5D,sBAAsB,CAAC,MAAM,EAAE;IAC7B,WAAW;IACX,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAEH,gCAAgC;AAChC,WAAW;AACX,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;AACxF,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;AAC5F,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC;AAC5G,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAE5G,YAAY;AACZ,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;AACzE,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;AACxH,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;AAChF,2BAA2B,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAC7E,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;AAC3F,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;AAC1G,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAC5E,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;AACjH,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;AAC3D,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;AACvF,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAClE,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;AAClH,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AACjD,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;AAC9E,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACtC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAExC,oBAAoB;AACpB,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,cAAc;QAAE,OAAO;IAC3B,cAAc,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,KAAK,CAAC,qBAAqB,MAAM,+BAA+B,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACxB,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;AAEvD,eAAe;AACf,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAExC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;QAE5E,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,WAAW,CAAC;QACpE,MAAM,UAAU,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;QAElF,2CAA2C;QAC3C,yEAAyE;QACzE,gCAAgC;QAChC,qEAAqE;QACrE,+EAA+E;QAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;QAC7D,IAAI,UAAU,GAAsB,EAAE,CAAC;QACvC,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;gBACxC,OAAO,CAAC,KAAK,CACX,qCAAqC,UAAU,CAAC,MAAM,sBAAsB,UAAU,EAAE,CACzF,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CACX,gEAAgE,IAAI,4BAA4B;gBAChG,qHAAqH,CACtH,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtF,OAAO,CAAC,KAAK,CACX,wFAAwF;gBACxF,0FAA0F,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,6BAA6B,EAAE,GAAG,MAAM,MAAM,CACpD,oDAAoD,CACrD,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;YACtC,0EAA0E;YAC1E,oEAAoE;YACpE,4BAA4B,EAAE,IAAI;YAClC,YAAY,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,aAAa,IAAI,EAAE,EAAE,aAAa,IAAI,EAAE,CAAC;SAC5E,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,iEAAiE;QACjE,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO;YAC3C,CAAC,CAAC,IAAI,WAAW,CACb,MAAM,CAAC,UAAU,CAAC,uBAAuB,IAAI,EAAE,EAC/C,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAC9B;YACH,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CACX,mCAAmC,MAAM,CAAC,UAAU,CAAC,uBAAuB,eAAe,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CACrH,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtD,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBACvB,sCAAsC;gBACtC,MAAM,QAAQ,GAAG,qBAAqB,CACpC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAC5B,UAAU,EACV,SAAS,CACV,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;oBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;wBACjB,cAAc,EAAE,kBAAkB;wBAClC,kBAAkB,EAAE,QAAQ;qBAC7B,CAAC,CAAC;oBACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;oBACnD,OAAO;gBACT,CAAC;gBACD,sEAAsE;gBACtE,oEAAoE;gBACpE,oEAAoE;gBACpE,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;oBACtB,GAAuC,CAAC,IAAI,GAAG;wBAC9C,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;wBACpD,QAAQ,EAAE,QAAQ,CAAC,SAAS;wBAC5B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;wBACtD,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;qBAC9D,CAAC;gBACJ,CAAC;gBACD,uDAAuD;gBACvD,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;oBACvD,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;oBACnD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;wBACnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;wBACvE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;4BACjB,cAAc,EAAE,kBAAkB;4BAClC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC;yBACrC,CAAC,CAAC;wBACH,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;4BACb,KAAK,EAAE,mBAAmB;4BAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;yBACrC,CAAC,CACH,CAAC;wBACF,OAAO;oBACT,CAAC;gBACH,CAAC;gBACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1C,CAAC;iBAAM,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YACjC,OAAO,CAAC,KAAK,CAAC,qCAAqC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,sCAAsC,OAAO,GAAG,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
|
@@ -6,6 +6,17 @@
|
|
|
6
6
|
* - Hash-chaining: each entry includes SHA-256 hash of the previous entry line
|
|
7
7
|
* - Log rotation: when file exceeds max_file_size_mb, rotates to .audit.jsonl.1
|
|
8
8
|
* - Export formats: jsonl (default), syslog (RFC 5424), otlp (stub)
|
|
9
|
+
*
|
|
10
|
+
* v3.5.0 enterprise enhancements (all opt-in):
|
|
11
|
+
* - Tamper evidence: when an HMAC key is provided (SDD_AUDIT_HMAC_KEY or
|
|
12
|
+
* SDD_AUDIT_HMAC_KEY_FILE — held OUTSIDE the workspace), every entry is
|
|
13
|
+
* signed with HMAC-SHA256 over its serialized form (which includes
|
|
14
|
+
* previous_hash, chaining the signatures). A workspace-writing attacker
|
|
15
|
+
* can recompute the plain hash chain but cannot forge HMACs without the
|
|
16
|
+
* key. Truncation of the log tail is NOT detectable by the chain alone —
|
|
17
|
+
* anchor `current_hash` externally (e.g. in CI logs) to close that gap.
|
|
18
|
+
* - Fail-closed: when enabled, a failed audit write throws instead of being
|
|
19
|
+
* swallowed, so the enforcement layer can refuse to run unaudited tools.
|
|
9
20
|
*/
|
|
10
21
|
export interface AuditEntry {
|
|
11
22
|
timestamp: string;
|
|
@@ -14,11 +25,15 @@ export interface AuditEntry {
|
|
|
14
25
|
feature_number?: string;
|
|
15
26
|
phase?: string;
|
|
16
27
|
role?: string;
|
|
28
|
+
/** Authenticated identity (HTTP token principal) or local fallback. */
|
|
29
|
+
principal?: string;
|
|
17
30
|
result: "success" | "error";
|
|
18
31
|
summary?: string;
|
|
19
32
|
input_hash?: string;
|
|
20
33
|
output_hash?: string;
|
|
21
34
|
previous_hash: string;
|
|
35
|
+
/** HMAC-SHA256 signature — present only when an HMAC key is configured. */
|
|
36
|
+
hmac?: string;
|
|
22
37
|
}
|
|
23
38
|
export interface AuditVerificationResult {
|
|
24
39
|
valid: boolean;
|
|
@@ -26,17 +41,44 @@ export interface AuditVerificationResult {
|
|
|
26
41
|
total_entries: number;
|
|
27
42
|
current_hash: string;
|
|
28
43
|
errors: string[];
|
|
44
|
+
/** True when an HMAC key was available and used for verification. */
|
|
45
|
+
hmac_checked: boolean;
|
|
46
|
+
/** Entries carrying an hmac field (signed entries). */
|
|
47
|
+
signed_entries: number;
|
|
48
|
+
}
|
|
49
|
+
export interface AuditLoggerOptions {
|
|
50
|
+
exportFormat?: "jsonl" | "syslog" | "otlp";
|
|
51
|
+
maxFileSizeMb?: number;
|
|
52
|
+
/** Secret for HMAC-SHA256 tamper evidence. Empty string disables signing. */
|
|
53
|
+
hmacKey?: string;
|
|
54
|
+
/** When true, a failed audit write throws (enforcement then denies the call). */
|
|
55
|
+
failClosed?: boolean;
|
|
29
56
|
}
|
|
57
|
+
/**
|
|
58
|
+
* Resolve the audit HMAC key from the environment: SDD_AUDIT_HMAC_KEY wins,
|
|
59
|
+
* else SDD_AUDIT_HMAC_KEY_FILE is read (trimmed). Returns "" when unset so the
|
|
60
|
+
* feature stays off. The key file should live OUTSIDE the workspace with 0600
|
|
61
|
+
* permissions — a key readable/writable from the workspace defeats the purpose.
|
|
62
|
+
*/
|
|
63
|
+
export declare function resolveAuditHmacKey(env?: Record<string, string | undefined>): string;
|
|
30
64
|
export declare class AuditLogger {
|
|
31
65
|
private workspaceRoot;
|
|
32
66
|
private enabled;
|
|
33
|
-
private exportFormat;
|
|
34
|
-
private maxFileSizeMb;
|
|
35
67
|
private lastHash;
|
|
36
|
-
|
|
68
|
+
private readonly exportFormat;
|
|
69
|
+
private readonly maxFileSizeMb;
|
|
70
|
+
private readonly hmacKey;
|
|
71
|
+
private readonly failClosed;
|
|
72
|
+
constructor(workspaceRoot: string, enabled: boolean, exportFormatOrOptions?: AuditLoggerOptions | "jsonl" | "syslog" | "otlp", maxFileSizeMb?: number);
|
|
73
|
+
/** True when entries are signed (an HMAC key is configured). */
|
|
74
|
+
get isTamperEvident(): boolean;
|
|
75
|
+
/** True when audit-write failures propagate instead of being swallowed. */
|
|
76
|
+
get isFailClosed(): boolean;
|
|
37
77
|
/**
|
|
38
78
|
* Log a tool call to the audit file.
|
|
39
|
-
* No-ops when disabled.
|
|
79
|
+
* No-ops when disabled. By default never throws — audit failures must not
|
|
80
|
+
* break tool calls. In fail-closed mode the error propagates so the
|
|
81
|
+
* enforcement wrapper can refuse to execute unaudited work.
|
|
40
82
|
*/
|
|
41
83
|
log(entry: AuditEntry): Promise<void>;
|
|
42
84
|
/** Convenience: log a successful tool call */
|
|
@@ -47,8 +89,15 @@ export declare class AuditLogger {
|
|
|
47
89
|
get currentHash(): string;
|
|
48
90
|
/** Reset chain hash (for testing) */
|
|
49
91
|
resetChain(): void;
|
|
50
|
-
/**
|
|
92
|
+
/**
|
|
93
|
+
* Verify audit integrity for an audit file: always checks the previous_hash
|
|
94
|
+
* chain; additionally verifies HMAC signatures when a key is configured.
|
|
95
|
+
* With the key, a rewritten/reordered log is detected even if the attacker
|
|
96
|
+
* recomputed the plain hash chain.
|
|
97
|
+
*/
|
|
51
98
|
verifyChain(specDir: string): Promise<AuditVerificationResult>;
|
|
99
|
+
/** Check one line's HMAC. Returns an error string or null when valid. */
|
|
100
|
+
private verifyLineHmac;
|
|
52
101
|
private resolveAuditFile;
|
|
53
102
|
/** Read the hash of the current last audit entry from disk. */
|
|
54
103
|
private readCurrentChainHash;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-logger.d.ts","sourceRoot":"","sources":["../../src/services/audit-logger.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"audit-logger.d.ts","sourceRoot":"","sources":["../../src/services/audit-logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,iBAAiB,EAAE,OAAO,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qEAAqE;IACrE,YAAY,EAAE,OAAO,CAAC;IACtB,uDAAuD;IACvD,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAQD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAiBR;AAaD,qBAAa,WAAW;IAQpB,OAAO,CAAC,aAAa;IACrB,OAAO,CAAC,OAAO;IARjB,OAAO,CAAC,QAAQ,CAAsB;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA8B;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;gBAG3B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,OAAO,EACxB,qBAAqB,GAAE,kBAAkB,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAW,EAC5E,aAAa,GAAE,MAAW;IAa5B,gEAAgE;IAChE,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,2EAA2E;IAC3E,IAAI,YAAY,IAAI,OAAO,CAE1B;IAED;;;;;OAKG;IACG,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA0C3C,8CAA8C;IACxC,UAAU,CACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAahB,0CAA0C;IACpC,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAYhB,wEAAwE;IACxE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,qCAAqC;IACrC,UAAU,IAAI,IAAI;IAIlB;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA2DpE,yEAAyE;IACzE,OAAO,CAAC,cAAc;IAuBtB,OAAO,CAAC,gBAAgB;IAIxB,+DAA+D;YACjD,oBAAoB;IAelC,mDAAmD;YACrC,cAAc;IA2B5B,oEAAoE;YACtD,YAAY;CAsB3B"}
|
|
@@ -6,29 +6,92 @@
|
|
|
6
6
|
* - Hash-chaining: each entry includes SHA-256 hash of the previous entry line
|
|
7
7
|
* - Log rotation: when file exceeds max_file_size_mb, rotates to .audit.jsonl.1
|
|
8
8
|
* - Export formats: jsonl (default), syslog (RFC 5424), otlp (stub)
|
|
9
|
+
*
|
|
10
|
+
* v3.5.0 enterprise enhancements (all opt-in):
|
|
11
|
+
* - Tamper evidence: when an HMAC key is provided (SDD_AUDIT_HMAC_KEY or
|
|
12
|
+
* SDD_AUDIT_HMAC_KEY_FILE — held OUTSIDE the workspace), every entry is
|
|
13
|
+
* signed with HMAC-SHA256 over its serialized form (which includes
|
|
14
|
+
* previous_hash, chaining the signatures). A workspace-writing attacker
|
|
15
|
+
* can recompute the plain hash chain but cannot forge HMACs without the
|
|
16
|
+
* key. Truncation of the log tail is NOT detectable by the chain alone —
|
|
17
|
+
* anchor `current_hash` externally (e.g. in CI logs) to close that gap.
|
|
18
|
+
* - Fail-closed: when enabled, a failed audit write throws instead of being
|
|
19
|
+
* swallowed, so the enforcement layer can refuse to run unaudited tools.
|
|
9
20
|
*/
|
|
10
21
|
import { appendFile, mkdir, stat, rename, unlink, readFile } from "node:fs/promises";
|
|
22
|
+
import { readFileSync } from "node:fs";
|
|
11
23
|
import { join, dirname } from "node:path";
|
|
12
|
-
import { createHash } from "node:crypto";
|
|
24
|
+
import { createHash, createHmac, timingSafeEqual } from "node:crypto";
|
|
13
25
|
/** Seed value for the first entry's previous_hash field */
|
|
14
26
|
const CHAIN_SEED = "specky-audit-v1";
|
|
15
27
|
/** Max rotated log files to keep */
|
|
16
28
|
const MAX_ROTATIONS = 3;
|
|
29
|
+
/**
|
|
30
|
+
* Resolve the audit HMAC key from the environment: SDD_AUDIT_HMAC_KEY wins,
|
|
31
|
+
* else SDD_AUDIT_HMAC_KEY_FILE is read (trimmed). Returns "" when unset so the
|
|
32
|
+
* feature stays off. The key file should live OUTSIDE the workspace with 0600
|
|
33
|
+
* permissions — a key readable/writable from the workspace defeats the purpose.
|
|
34
|
+
*/
|
|
35
|
+
export function resolveAuditHmacKey(env = process.env) {
|
|
36
|
+
const direct = env["SDD_AUDIT_HMAC_KEY"];
|
|
37
|
+
if (direct && direct.trim())
|
|
38
|
+
return direct.trim();
|
|
39
|
+
const keyFile = env["SDD_AUDIT_HMAC_KEY_FILE"];
|
|
40
|
+
if (keyFile && keyFile.trim()) {
|
|
41
|
+
try {
|
|
42
|
+
const key = readFileSync(keyFile.trim(), "utf-8").trim();
|
|
43
|
+
if (key)
|
|
44
|
+
return key;
|
|
45
|
+
console.error(`[specky] Audit HMAC key file is empty: ${keyFile}`);
|
|
46
|
+
}
|
|
47
|
+
catch (err) {
|
|
48
|
+
console.error(`[specky] Cannot read SDD_AUDIT_HMAC_KEY_FILE (${keyFile}): ${err.message}`);
|
|
49
|
+
}
|
|
50
|
+
}
|
|
51
|
+
return "";
|
|
52
|
+
}
|
|
53
|
+
/** HMAC-SHA256 over the serialized entry (without its hmac field). */
|
|
54
|
+
function signLine(baseLine, key) {
|
|
55
|
+
return createHmac("sha256", key).update(baseLine).digest("hex");
|
|
56
|
+
}
|
|
57
|
+
function constantTimeEqualHex(a, b) {
|
|
58
|
+
const bufA = Buffer.from(a);
|
|
59
|
+
const bufB = Buffer.from(b);
|
|
60
|
+
return bufA.length === bufB.length && timingSafeEqual(bufA, bufB);
|
|
61
|
+
}
|
|
17
62
|
export class AuditLogger {
|
|
18
63
|
workspaceRoot;
|
|
19
64
|
enabled;
|
|
65
|
+
lastHash = CHAIN_SEED;
|
|
20
66
|
exportFormat;
|
|
21
67
|
maxFileSizeMb;
|
|
22
|
-
|
|
23
|
-
|
|
68
|
+
hmacKey;
|
|
69
|
+
failClosed;
|
|
70
|
+
constructor(workspaceRoot, enabled, exportFormatOrOptions = {}, maxFileSizeMb = 10) {
|
|
24
71
|
this.workspaceRoot = workspaceRoot;
|
|
25
72
|
this.enabled = enabled;
|
|
26
|
-
|
|
27
|
-
|
|
73
|
+
// Back-compat: the pre-3.5 signature was (root, enabled, exportFormat, maxFileSizeMb).
|
|
74
|
+
const options = typeof exportFormatOrOptions === "string"
|
|
75
|
+
? { exportFormat: exportFormatOrOptions, maxFileSizeMb }
|
|
76
|
+
: exportFormatOrOptions;
|
|
77
|
+
this.exportFormat = options.exportFormat ?? "jsonl";
|
|
78
|
+
this.maxFileSizeMb = options.maxFileSizeMb ?? 10;
|
|
79
|
+
this.hmacKey = options.hmacKey ?? "";
|
|
80
|
+
this.failClosed = options.failClosed ?? false;
|
|
81
|
+
}
|
|
82
|
+
/** True when entries are signed (an HMAC key is configured). */
|
|
83
|
+
get isTamperEvident() {
|
|
84
|
+
return this.hmacKey.length > 0;
|
|
85
|
+
}
|
|
86
|
+
/** True when audit-write failures propagate instead of being swallowed. */
|
|
87
|
+
get isFailClosed() {
|
|
88
|
+
return this.failClosed;
|
|
28
89
|
}
|
|
29
90
|
/**
|
|
30
91
|
* Log a tool call to the audit file.
|
|
31
|
-
* No-ops when disabled.
|
|
92
|
+
* No-ops when disabled. By default never throws — audit failures must not
|
|
93
|
+
* break tool calls. In fail-closed mode the error propagates so the
|
|
94
|
+
* enforcement wrapper can refuse to execute unaudited work.
|
|
32
95
|
*/
|
|
33
96
|
async log(entry) {
|
|
34
97
|
if (!this.enabled)
|
|
@@ -39,7 +102,15 @@ export class AuditLogger {
|
|
|
39
102
|
// Rotate if needed before appending
|
|
40
103
|
await this.rotateIfNeeded(auditFile);
|
|
41
104
|
entry.previous_hash = await this.readCurrentChainHash(auditFile);
|
|
42
|
-
|
|
105
|
+
// Serialize without hmac, sign, then append the signature as the final
|
|
106
|
+
// field by string surgery — verification can strip it back off without
|
|
107
|
+
// depending on JSON key-order round-trips.
|
|
108
|
+
delete entry.hmac;
|
|
109
|
+
const baseLine = JSON.stringify(entry);
|
|
110
|
+
const signedLine = this.hmacKey
|
|
111
|
+
? `${baseLine.slice(0, -1)},"hmac":"${signLine(baseLine, this.hmacKey)}"}`
|
|
112
|
+
: baseLine;
|
|
113
|
+
const line = signedLine + "\n";
|
|
43
114
|
if (this.exportFormat === "syslog") {
|
|
44
115
|
await this.appendSyslog(auditFile, entry, line);
|
|
45
116
|
}
|
|
@@ -53,7 +124,11 @@ export class AuditLogger {
|
|
|
53
124
|
// Advance chain: hash of the line just written
|
|
54
125
|
this.lastHash = createHash("sha256").update(line.trimEnd()).digest("hex");
|
|
55
126
|
}
|
|
56
|
-
catch {
|
|
127
|
+
catch (error) {
|
|
128
|
+
if (this.failClosed) {
|
|
129
|
+
const message = error instanceof Error ? error.message : String(error);
|
|
130
|
+
throw new Error(`Audit write failed (fail-closed mode): ${message}`);
|
|
131
|
+
}
|
|
57
132
|
// Audit failures must never break the tool call — silently ignore
|
|
58
133
|
}
|
|
59
134
|
}
|
|
@@ -90,15 +165,22 @@ export class AuditLogger {
|
|
|
90
165
|
resetChain() {
|
|
91
166
|
this.lastHash = CHAIN_SEED;
|
|
92
167
|
}
|
|
93
|
-
/**
|
|
168
|
+
/**
|
|
169
|
+
* Verify audit integrity for an audit file: always checks the previous_hash
|
|
170
|
+
* chain; additionally verifies HMAC signatures when a key is configured.
|
|
171
|
+
* With the key, a rewritten/reordered log is detected even if the attacker
|
|
172
|
+
* recomputed the plain hash chain.
|
|
173
|
+
*/
|
|
94
174
|
async verifyChain(specDir) {
|
|
95
175
|
const auditFile = this.resolveAuditFile(specDir);
|
|
176
|
+
const hmacChecked = this.hmacKey.length > 0;
|
|
96
177
|
try {
|
|
97
178
|
const raw = await readFile(auditFile, "utf-8");
|
|
98
179
|
const lines = raw.split("\n").filter((line) => line.trim().length > 0);
|
|
99
180
|
const errors = [];
|
|
100
181
|
let expectedPreviousHash = CHAIN_SEED;
|
|
101
182
|
let currentHash = CHAIN_SEED;
|
|
183
|
+
let signedEntries = 0;
|
|
102
184
|
for (let index = 0; index < lines.length; index++) {
|
|
103
185
|
const line = lines[index];
|
|
104
186
|
let entry;
|
|
@@ -113,6 +195,13 @@ export class AuditLogger {
|
|
|
113
195
|
if (entry.previous_hash !== expectedPreviousHash) {
|
|
114
196
|
errors.push(`Line ${index + 1}: previous_hash mismatch`);
|
|
115
197
|
}
|
|
198
|
+
if (typeof entry.hmac === "string")
|
|
199
|
+
signedEntries++;
|
|
200
|
+
if (hmacChecked) {
|
|
201
|
+
const hmacError = this.verifyLineHmac(line, entry, index + 1);
|
|
202
|
+
if (hmacError)
|
|
203
|
+
errors.push(hmacError);
|
|
204
|
+
}
|
|
116
205
|
currentHash = createHash("sha256").update(line).digest("hex");
|
|
117
206
|
expectedPreviousHash = currentHash;
|
|
118
207
|
}
|
|
@@ -122,6 +211,8 @@ export class AuditLogger {
|
|
|
122
211
|
total_entries: lines.length,
|
|
123
212
|
current_hash: currentHash,
|
|
124
213
|
errors,
|
|
214
|
+
hmac_checked: hmacChecked,
|
|
215
|
+
signed_entries: signedEntries,
|
|
125
216
|
};
|
|
126
217
|
}
|
|
127
218
|
catch {
|
|
@@ -131,9 +222,30 @@ export class AuditLogger {
|
|
|
131
222
|
total_entries: 0,
|
|
132
223
|
current_hash: CHAIN_SEED,
|
|
133
224
|
errors: [],
|
|
225
|
+
hmac_checked: hmacChecked,
|
|
226
|
+
signed_entries: 0,
|
|
134
227
|
};
|
|
135
228
|
}
|
|
136
229
|
}
|
|
230
|
+
/** Check one line's HMAC. Returns an error string or null when valid. */
|
|
231
|
+
verifyLineHmac(line, entry, lineNumber) {
|
|
232
|
+
if (typeof entry.hmac !== "string") {
|
|
233
|
+
return `Line ${lineNumber}: missing hmac (entry written without the signing key)`;
|
|
234
|
+
}
|
|
235
|
+
// The writer appends `,"hmac":"<hex>"}` as the final field; strip it to
|
|
236
|
+
// recover the exact signed serialization.
|
|
237
|
+
const marker = `,"hmac":"`;
|
|
238
|
+
const markerIndex = line.lastIndexOf(marker);
|
|
239
|
+
if (markerIndex === -1 || !line.endsWith(`"}`)) {
|
|
240
|
+
return `Line ${lineNumber}: hmac field is not in canonical position`;
|
|
241
|
+
}
|
|
242
|
+
const baseLine = line.slice(0, markerIndex) + "}";
|
|
243
|
+
const expected = signLine(baseLine, this.hmacKey);
|
|
244
|
+
if (!constantTimeEqualHex(entry.hmac, expected)) {
|
|
245
|
+
return `Line ${lineNumber}: hmac mismatch (entry modified or signed with a different key)`;
|
|
246
|
+
}
|
|
247
|
+
return null;
|
|
248
|
+
}
|
|
137
249
|
resolveAuditFile(specDir, _featureNumber) {
|
|
138
250
|
return join(this.workspaceRoot, specDir, ".audit.jsonl");
|
|
139
251
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../src/services/audit-logger.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../src/services/audit-logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAyCtE,2DAA2D;AAC3D,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAErC,oCAAoC;AACpC,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,MAAM,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAElD,MAAM,OAAO,GAAG,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC/C,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YACzD,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,0CAA0C,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,iDAAiD,OAAO,MAAO,GAAa,CAAC,OAAO,EAAE,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,sEAAsE;AACtE,SAAS,QAAQ,CAAC,QAAgB,EAAE,GAAW;IAC7C,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,OAAO,WAAW;IAQZ;IACA;IARF,QAAQ,GAAW,UAAU,CAAC;IACrB,YAAY,CAA8B;IAC1C,aAAa,CAAS;IACtB,OAAO,CAAS;IAChB,UAAU,CAAU;IAErC,YACU,aAAqB,EACrB,OAAgB,EACxB,wBAA0E,EAAE,EAC5E,gBAAwB,EAAE;QAHlB,kBAAa,GAAb,aAAa,CAAQ;QACrB,YAAO,GAAP,OAAO,CAAS;QAIxB,uFAAuF;QACvF,MAAM,OAAO,GACX,OAAO,qBAAqB,KAAK,QAAQ;YACvC,CAAC,CAAC,EAAE,YAAY,EAAE,qBAAqB,EAAE,aAAa,EAAE;YACxD,CAAC,CAAC,qBAAqB,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC;QACpD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;IAChD,CAAC;IAED,gEAAgE;IAChE,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,2EAA2E;IAC3E,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAE1B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;YAC9E,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAErD,oCAAoC;YACpC,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;YAErC,KAAK,CAAC,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;YAEjE,uEAAuE;YACvE,uEAAuE;YACvE,2CAA2C;YAC3C,OAAO,KAAK,CAAC,IAAI,CAAC;YAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACvC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO;gBAC7B,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBAC1E,CAAC,CAAC,QAAQ,CAAC;YACb,MAAM,IAAI,GAAG,UAAU,GAAG,IAAI,CAAC;YAE/B,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,CAAC;iBAAM,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;gBACxC,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC1D,MAAM,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7C,CAAC;YAED,+CAA+C;YAC/C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,kEAAkE;QACpE,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,UAAU,CACd,IAAY,EACZ,OAAe,EACf,aAAsB,EACtB,KAAc,EACd,OAAgB;QAEhB,MAAM,IAAI,CAAC,GAAG,CAAC;YACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI;YACJ,QAAQ,EAAE,OAAO;YACjB,cAAc,EAAE,aAAa;YAC7B,KAAK;YACL,MAAM,EAAE,SAAS;YACjB,OAAO;YACP,aAAa,EAAE,IAAI,CAAC,QAAQ;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,QAAQ,CACZ,IAAY,EACZ,OAAe,EACf,aAAsB,EACtB,YAAqB;QAErB,MAAM,IAAI,CAAC,GAAG,CAAC;YACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI;YACJ,QAAQ,EAAE,OAAO;YACjB,cAAc,EAAE,aAAa;YAC7B,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,YAAY;YACrB,aAAa,EAAE,IAAI,CAAC,QAAQ;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,qCAAqC;IACrC,UAAU;QACR,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACvE,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,oBAAoB,GAAG,UAAU,CAAC;YACtC,IAAI,WAAW,GAAG,UAAU,CAAC;YAC7B,IAAI,aAAa,GAAG,CAAC,CAAC;YAEtB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;gBAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC1B,IAAI,KAA0B,CAAC;gBAC/B,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;gBAClD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACvE,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,mBAAmB,OAAO,GAAG,CAAC,CAAC;oBAC5D,SAAS;gBACX,CAAC;gBAED,IAAI,KAAK,CAAC,aAAa,KAAK,oBAAoB,EAAE,CAAC;oBACjD,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,0BAA0B,CAAC,CAAC;gBAC3D,CAAC;gBAED,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,aAAa,EAAE,CAAC;gBAEpD,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;oBAC9D,IAAI,SAAS;wBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxC,CAAC;gBAED,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9D,oBAAoB,GAAG,WAAW,CAAC;YACrC,CAAC;YAED,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;gBAC1B,iBAAiB,EAAE,IAAI;gBACvB,aAAa,EAAE,KAAK,CAAC,MAAM;gBAC3B,YAAY,EAAE,WAAW;gBACzB,MAAM;gBACN,YAAY,EAAE,WAAW;gBACzB,cAAc,EAAE,aAAa;aAC9B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,iBAAiB,EAAE,KAAK;gBACxB,aAAa,EAAE,CAAC;gBAChB,YAAY,EAAE,UAAU;gBACxB,MAAM,EAAE,EAAE;gBACV,YAAY,EAAE,WAAW;gBACzB,cAAc,EAAE,CAAC;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACjE,cAAc,CACpB,IAAY,EACZ,KAA0B,EAC1B,UAAkB;QAElB,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,QAAQ,UAAU,wDAAwD,CAAC;QACpF,CAAC;QACD,wEAAwE;QACxE,0CAA0C;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC;QAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,OAAO,QAAQ,UAAU,2CAA2C,CAAC;QACvE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,GAAG,GAAG,CAAC;QAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YAChD,OAAO,QAAQ,UAAU,iEAAiE,CAAC;QAC7F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,gBAAgB,CAAC,OAAe,EAAE,cAAuB;QAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAC3D,CAAC;IAED,+DAA+D;IACvD,KAAK,CAAC,oBAAoB,CAAC,SAAiB;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,QAAQ;gBAAE,OAAO,UAAU,CAAC;YACjC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC;YAC3B,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,mDAAmD;IAC3C,KAAK,CAAC,cAAc,CAAC,SAAiB;QAC5C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC;YACxD,IAAI,QAAQ,CAAC,IAAI,IAAI,cAAc;gBAAE,OAAO;YAE5C,iEAAiE;YACjE,KAAK,IAAI,CAAC,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,GAAG,SAAS,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,GAAG,SAAS,IAAI,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC;gBAAC,MAAM,CAAC;oBACP,8BAA8B;gBAChC,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,8BAA8B;gBAChC,CAAC;YACH,CAAC;YACD,MAAM,MAAM,CAAC,SAAS,EAAE,GAAG,SAAS,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;IACH,CAAC;IAED,oEAAoE;IAC5D,KAAK,CAAC,YAAY,CACxB,SAAiB,EACjB,KAAiB,EACjB,QAAgB;QAEhB,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;QACtE,sFAAsF;QACtF,yDAAyD;QACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC;QAC1B,MAAM,OAAO,GAAG,YAAY,CAAC;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC;QAC1C,MAAM,UAAU,GACd,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,IAAI,QAAQ,IAAI,OAAO,IAAI,MAAM,IAAI,KAAK,MAAM,GAAG,IAAI,CAAC;QAEtF,MAAM,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,uBAAuB;QACvB,MAAM,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;CACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"file-manager.d.ts","sourceRoot":"","sources":["../../src/services/file-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE9D,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,aAAa,EAAE,MAAM;IAIjC,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;OAGG;IACH,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;
|
|
1
|
+
{"version":3,"file":"file-manager.d.ts","sourceRoot":"","sources":["../../src/services/file-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE9D,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,aAAa,EAAE,MAAM;IAIjC,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;OAGG;IACH,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAsB1C;;OAEG;IACG,aAAa,CAAC,OAAO,GAAE,MAAyB,GAAG,OAAO,CAAC,MAAM,CAAC;IAMxE;;;;OAIG;IACG,aAAa,CACjB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,OAAe,GACrB,OAAO,CAAC,MAAM,CAAC;IAiClB;;OAEG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKzE;;OAEG;IACG,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKxD;;OAEG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAU1D;;OAEG;IACG,YAAY,CAAC,OAAO,GAAE,MAAyB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IA6B9E;;OAEG;IACG,aAAa,CACjB,GAAG,GAAE,MAAY,EACjB,KAAK,GAAE,MAA2B,EAClC,OAAO,GAAE,SAAS,MAAM,EAA6B,GACpD,OAAO,CAAC,aAAa,CAAC;IAMzB;;OAEG;IACG,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK5D;;OAEG;IACG,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKlE;;OAEG;IACG,oBAAoB,CACxB,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,OAAO,CAAC,MAAM,EAAE,CAAC;YAsBN,UAAU;YASV,aAAa;CAoC5B"}
|
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
* Path sanitization, atomic writes, directory scanning.
|
|
4
4
|
*/
|
|
5
5
|
import { mkdir, readFile, writeFile, readdir, stat, rename, access, unlink } from "node:fs/promises";
|
|
6
|
-
import { join, resolve, relative, basename, dirname } from "node:path";
|
|
6
|
+
import { join, resolve, relative, basename, dirname, sep } from "node:path";
|
|
7
7
|
import { randomUUID } from "node:crypto";
|
|
8
8
|
import { DEFAULT_SPEC_DIR, DEFAULT_EXCLUDE_PATTERNS, DEFAULT_SCAN_DEPTH, MAX_SCAN_DEPTH } from "../constants.js";
|
|
9
9
|
export class FileManager {
|
|
@@ -19,14 +19,20 @@ export class FileManager {
|
|
|
19
19
|
* Returns resolved absolute path within workspace.
|
|
20
20
|
*/
|
|
21
21
|
sanitizePath(relativePath) {
|
|
22
|
-
|
|
22
|
+
// Reject absolute paths on every OS: POSIX ("/…"), UNC/Windows-separator
|
|
23
|
+
// ("\…"), and Windows drive-absolute ("C:\…"). The drive-letter form is not
|
|
24
|
+
// caught by a "/" or "\" prefix check and slips through on POSIX runtimes
|
|
25
|
+
// too, so guard it explicitly — mirrors the Zod specDirSchema guard.
|
|
26
|
+
if (relativePath.startsWith("/") ||
|
|
27
|
+
relativePath.startsWith("\\") ||
|
|
28
|
+
/^[a-zA-Z]:/.test(relativePath)) {
|
|
23
29
|
throw new Error(`Absolute paths are not allowed: ${relativePath}`);
|
|
24
30
|
}
|
|
25
31
|
if (relativePath.includes("..")) {
|
|
26
32
|
throw new Error(`Path traversal is not allowed: ${relativePath}`);
|
|
27
33
|
}
|
|
28
34
|
const resolved = resolve(this.root, relativePath);
|
|
29
|
-
if (!resolved.startsWith(this.root)) {
|
|
35
|
+
if (resolved !== this.root && !resolved.startsWith(this.root + sep)) {
|
|
30
36
|
throw new Error(`Path escapes workspace root: ${relativePath}`);
|
|
31
37
|
}
|
|
32
38
|
return resolved;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"file-manager.js","sourceRoot":"","sources":["../../src/services/file-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"file-manager.js","sourceRoot":"","sources":["../../src/services/file-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGjH,MAAM,OAAO,WAAW;IACL,IAAI,CAAS;IAE9B,YAAY,aAAqB;QAC/B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,YAAoB;QAC/B,yEAAyE;QACzE,4EAA4E;QAC5E,0EAA0E;QAC1E,qEAAqE;QACrE,IACE,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;YAC5B,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC;YAC7B,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,YAAY,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,gCAAgC,YAAY,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,UAAkB,gBAAgB;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,UAAkB,EAClB,QAAgB,EAChB,OAAe,EACf,QAAiB,KAAK;QAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QAE9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CACb,wBAAwB,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,iCAAiC,CACtF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEnD,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,GAAG,OAAO,IAAI,UAAU,EAAE,MAAM,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5C,MAAM,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,gCAAgC;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,QAAgB;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9D,OAAO,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,YAAoB;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,UAAkB,gBAAgB;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAkB,EAAE,CAAC;QAEnC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,MAAM,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChF,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBACjD,IAAI,KAAK,EAAE,CAAC;wBACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;wBACnD,QAAQ,CAAC,IAAI,CAAC;4BACZ,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;4BAChB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;4BACd,SAAS,EAAE,UAAU;4BACrB,KAAK;yBACN,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,MAAc,GAAG,EACjB,QAAgB,kBAAkB,EAClC,UAA6B,wBAAwB;QAErD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IACtF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,YAAoB;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,YAAoB;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,GAAW,EACX,UAA6B;QAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,MAAM,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChF,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;oBACnB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACvC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;wBAClD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;oBACtC,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,0BAA0B;IAElB,KAAK,CAAC,UAAU,CAAC,OAAe;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,OAAe,EACf,IAAY,EACZ,KAAa,EACb,OAA0B;QAE1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAoB,EAAE,CAAC;QAErC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/D,SAAS;YACX,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,QAAQ,CAAC,IAAI,CACX,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CACpE,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACrB,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;gBAAE,OAAO,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;CACF"}
|
package/dist/tools/audit.js
CHANGED
|
@@ -7,7 +7,7 @@ const verifyAuditInputSchema = z.object({
|
|
|
7
7
|
export function registerAuditTools(server, auditLogger) {
|
|
8
8
|
server.registerTool(TOOL_NAMES.VERIFY_AUDIT, {
|
|
9
9
|
title: "Verify Audit Trail",
|
|
10
|
-
description: "Verifies the hash-chain integrity of the Specky audit log for a spec directory. Returns whether the chain is valid, entry count, current hash, and any mismatch errors.",
|
|
10
|
+
description: "Verifies the hash-chain integrity of the Specky audit log for a spec directory. When an HMAC key is configured (SDD_AUDIT_HMAC_KEY / SDD_AUDIT_HMAC_KEY_FILE), also verifies each entry's HMAC-SHA256 signature (tamper evidence). Returns whether the chain is valid, entry count, current hash, hmac_checked/signed_entries, and any mismatch errors.",
|
|
11
11
|
inputSchema: verifyAuditInputSchema,
|
|
12
12
|
annotations: {
|
|
13
13
|
readOnlyHint: true,
|
package/dist/tools/audit.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/tools/audit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,UAAU,kBAAkB,CAChC,MAAiB,EACjB,WAAwB;IAExB,MAAM,CAAC,YAAY,CACjB,UAAU,CAAC,YAAY,EACvB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,
|
|
1
|
+
{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/tools/audit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ,EAAE,aAAa;CACxB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,UAAU,kBAAkB,CAChC,MAAiB,EACjB,WAAwB;IAExB,MAAM,CAAC,YAAY,CACjB,UAAU,CAAC,YAAY,EACvB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,yVAAyV;QAC3V,WAAW,EAAE,sBAAsB;QACnC,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrB,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
|
package/dist/tools/rbac.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/tools/rbac.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAiB,MAAM,4BAA4B,CAAC;
|
|
1
|
+
{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/tools/rbac.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAiB,MAAM,4BAA4B,CAAC;AAmBvE,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,UAAU,GACrB,IAAI,CA8DN"}
|
package/dist/tools/rbac.js
CHANGED
|
@@ -5,11 +5,12 @@
|
|
|
5
5
|
import { z } from "zod";
|
|
6
6
|
import { RbacEngine } from "../services/rbac-engine.js";
|
|
7
7
|
import { TOOL_NAMES } from "../constants.js";
|
|
8
|
+
import { getCallerIdentity } from "./tool-enforcement.js";
|
|
8
9
|
const checkAccessInputSchema = z.object({
|
|
9
10
|
role_override: z
|
|
10
11
|
.enum(["viewer", "contributor", "admin"])
|
|
11
12
|
.optional()
|
|
12
|
-
.describe("Override the active role for this check (for testing access). Defaults to SDD_ROLE env var
|
|
13
|
+
.describe("Override the active role for this check (for testing access). Defaults to the authenticated token role, then SDD_ROLE env var, then the configured default_role."),
|
|
13
14
|
tool_name: z
|
|
14
15
|
.string()
|
|
15
16
|
.optional()
|
|
@@ -17,25 +18,31 @@ const checkAccessInputSchema = z.object({
|
|
|
17
18
|
}).strict();
|
|
18
19
|
export function registerRbacTools(server, rbacEngine) {
|
|
19
20
|
server.registerTool(TOOL_NAMES.CHECK_ACCESS, {
|
|
20
|
-
description: "Check RBAC access for the current
|
|
21
|
+
description: "Check RBAC access for the current caller. Returns the active role (authenticated token role > SDD_ROLE > default_role), whether a specific tool is accessible, and a summary of what each role can do. Useful for diagnosing permission issues in enterprise deployments.",
|
|
21
22
|
inputSchema: checkAccessInputSchema,
|
|
22
|
-
}, async (input) => {
|
|
23
|
+
}, async (input, extra) => {
|
|
24
|
+
const identity = getCallerIdentity([input, extra]);
|
|
23
25
|
const activeRole = input.role_override ??
|
|
26
|
+
identity.role ??
|
|
24
27
|
(process.env["SDD_ROLE"] ?? rbacEngine.roleDefault);
|
|
25
28
|
let toolCheck;
|
|
26
29
|
if (input.tool_name) {
|
|
27
30
|
const result = rbacEngine.checkAccess(activeRole, input.tool_name);
|
|
28
31
|
toolCheck = { tool: input.tool_name, ...result };
|
|
29
32
|
}
|
|
33
|
+
const roleSource = input.role_override
|
|
34
|
+
? "role_override parameter"
|
|
35
|
+
: identity.role
|
|
36
|
+
? "authenticated token (SDD_HTTP_TOKENS_FILE)"
|
|
37
|
+
: process.env["SDD_ROLE"]
|
|
38
|
+
? "SDD_ROLE environment variable"
|
|
39
|
+
: "config default_role";
|
|
30
40
|
const response = {
|
|
31
41
|
rbac_enabled: rbacEngine.isEnabled,
|
|
32
42
|
active_role: activeRole,
|
|
43
|
+
...(identity.principal ? { principal: identity.principal } : {}),
|
|
33
44
|
default_role: rbacEngine.roleDefault,
|
|
34
|
-
role_source:
|
|
35
|
-
? "role_override parameter"
|
|
36
|
-
: process.env["SDD_ROLE"]
|
|
37
|
-
? "SDD_ROLE environment variable"
|
|
38
|
-
: "config default_role",
|
|
45
|
+
role_source: roleSource,
|
|
39
46
|
...(toolCheck ? { tool_check: toolCheck } : {}),
|
|
40
47
|
role_summary: {
|
|
41
48
|
viewer: {
|
|
@@ -52,9 +59,9 @@ export function registerRbacTools(server, rbacEngine) {
|
|
|
52
59
|
},
|
|
53
60
|
},
|
|
54
61
|
next_steps: rbacEngine.isEnabled
|
|
55
|
-
? "
|
|
56
|
-
: "RBAC is disabled. Enable with rbac.enabled: true in .specky/config.yml.",
|
|
57
|
-
learning_note: "RBAC is opt-in and defaults to disabled.
|
|
62
|
+
? "For identity-based roles over HTTP, configure SDD_HTTP_TOKENS_FILE (principal + role per token). Locally, set SDD_ROLE=viewer|contributor|admin per process; configure rbac.default_role in .specky/config.yml."
|
|
63
|
+
: "RBAC is disabled. Enable with rbac.enabled: true in .specky/config.yml, or switch to profile: enterprise.",
|
|
64
|
+
learning_note: "RBAC is opt-in and defaults to disabled (the enterprise profile turns it on). Authenticated token roles always win over SDD_ROLE — a remote caller cannot out-vote its token. Admin role is required for sdd_create_pr (release gate).",
|
|
58
65
|
};
|
|
59
66
|
return {
|
|
60
67
|
content: [{ type: "text", text: JSON.stringify(response, null, 2) }],
|
package/dist/tools/rbac.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../src/tools/rbac.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAiB,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../src/tools/rbac.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAiB,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,aAAa,EAAE,CAAC;SACb,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;SACxC,QAAQ,EAAE;SACV,QAAQ,CACP,kKAAkK,CACnK;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F,CAC3F;CACJ,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,UAAU,iBAAiB,CAC/B,MAAiB,EACjB,UAAsB;IAEtB,MAAM,CAAC,YAAY,CACjB,UAAU,CAAC,YAAY,EACvB;QACE,WAAW,EACT,2QAA2Q;QAC7Q,WAAW,EAAE,sBAAsB;KACpC,EACD,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACnD,MAAM,UAAU,GACb,KAAK,CAAC,aAAsC;YAC7C,QAAQ,CAAC,IAAI;YACb,CAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAA0B,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;QAEhF,IAAI,SAA0E,CAAC;QAC/E,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACnE,SAAS,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa;YACpC,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACf,CAAC,CAAC,4CAA4C;gBAC9C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;oBACzB,CAAC,CAAC,+BAA+B;oBACjC,CAAC,CAAC,qBAAqB,CAAC;QAE1B,MAAM,QAAQ,GAAG;YACf,YAAY,EAAE,UAAU,CAAC,SAAS;YAClC,WAAW,EAAE,UAAU;YACvB,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,YAAY,EAAE,UAAU,CAAC,WAAW;YACpC,WAAW,EAAE,UAAU;YACvB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,YAAY,EAAE;gBACZ,MAAM,EAAE;oBACN,WAAW,EAAE,iEAAiE;oBAC9E,aAAa,EAAE,CAAC,GAAG,UAAU,CAAC,YAAY,CAAC;iBAC5C;gBACD,WAAW,EAAE;oBACX,WAAW,EAAE,0CAA0C;oBACvD,aAAa,EAAE,CAAC,GAAG,UAAU,CAAC,uBAAuB,CAAC;iBACvD;gBACD,KAAK,EAAE;oBACL,WAAW,EAAE,gCAAgC;oBAC7C,aAAa,EAAE,EAAE;iBAClB;aACF;YACD,UAAU,EAAE,UAAU,CAAC,SAAS;gBAC9B,CAAC,CAAC,iNAAiN;gBACnN,CAAC,CAAC,2GAA2G;YAC/G,aAAa,EACX,wOAAwO;SAC3O,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
|
|
2
2
|
import type { AuditLogger } from "../services/audit-logger.js";
|
|
3
|
-
import { RbacEngine } from "../services/rbac-engine.js";
|
|
3
|
+
import { type RbacRole, RbacEngine } from "../services/rbac-engine.js";
|
|
4
4
|
import type { StateMachine } from "../services/state-machine.js";
|
|
5
5
|
export interface ToolEnforcementOptions {
|
|
6
6
|
auditLogger: AuditLogger;
|
|
@@ -14,6 +14,20 @@ export interface ToolEnforcementDeniedResponse {
|
|
|
14
14
|
}>;
|
|
15
15
|
isError: true;
|
|
16
16
|
}
|
|
17
|
+
/**
|
|
18
|
+
* The slice of the MCP request context we consume. The HTTP transport fills
|
|
19
|
+
* `authInfo` from `req.auth` (set after bearer validation); stdio has none.
|
|
20
|
+
*/
|
|
21
|
+
export interface CallerIdentity {
|
|
22
|
+
principal?: string;
|
|
23
|
+
role?: RbacRole;
|
|
24
|
+
}
|
|
17
25
|
export declare function hashValue(value: unknown): string;
|
|
26
|
+
/**
|
|
27
|
+
* Extract the authenticated identity from the MCP request extra (second
|
|
28
|
+
* handler argument). The HTTP transport propagates `req.auth` as
|
|
29
|
+
* `extra.authInfo`; the principal/role live in `authInfo.extra`.
|
|
30
|
+
*/
|
|
31
|
+
export declare function getCallerIdentity(args: unknown[]): CallerIdentity;
|
|
18
32
|
export declare function installToolEnforcement(server: McpServer, options: ToolEnforcementOptions): void;
|
|
19
33
|
//# sourceMappingURL=tool-enforcement.d.ts.map
|