synapse-mcp 1.0.0 → 1.0.2

package/dist/utils/init-detection.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Supported init systems
+ */
+export type InitSystem = "systemd" | "openrc" | "sysv" | "upstart" | "unknown";
+/**
+ * Command structure for listing services
+ */
+export interface ServiceListCommand {
+    command: string;
+    args: string[];
+}
+/**
+ * Detect the init system from command output.
+ * Typically called with output from: ps -p 1 -o comm= or readlink /proc/1/exe
+ *
+ * @param output - Command output to analyze
+ * @returns Detected init system type
+ */
+export declare function detectInitSystem(output: string): InitSystem;
+/**
+ * Get the appropriate command to list services for a given init system.
+ *
+ * @param initSystem - The detected init system
+ * @param state - Optional state filter (only works with systemd)
+ * @param service - Optional service name filter (only works with systemd)
+ * @returns Command and arguments to list services
+ */
+export declare function getServiceListCommand(initSystem: InitSystem, state?: string, service?: string): ServiceListCommand;
+/**
+ * Format the output title based on the init system.
+ *
+ * @param initSystem - The detected init system
+ * @returns Human-readable title for the service list
+ */
+export declare function getServiceListTitle(initSystem: InitSystem): string;
+//# sourceMappingURL=init-detection.d.ts.map

package/dist/utils/init-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-detection.d.ts","sourceRoot":"","sources":["../../src/utils/init-detection.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/E;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAqB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,UAAU,EACtB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,GACf,kBAAkB,CA8BpB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAclE"}

package/dist/utils/init-detection.js

@@ -0,0 +1,79 @@
+// src/utils/init-detection.ts
+/**
+ * Detect the init system from command output.
+ * Typically called with output from: ps -p 1 -o comm= or readlink /proc/1/exe
+ *
+ * @param output - Command output to analyze
+ * @returns Detected init system type
+ */
+export function detectInitSystem(output) {
+    const normalized = output.toLowerCase().trim();
+    if (normalized.includes("systemd")) {
+        return "systemd";
+    }
+    if (normalized.includes("openrc")) {
+        return "openrc";
+    }
+    // SysV init often shows as 'init' in process list
+    if (normalized.includes("init") && !normalized.includes("upstart")) {
+        return "sysv";
+    }
+    if (normalized.includes("upstart")) {
+        return "upstart";
+    }
+    return "unknown";
+}
+/**
+ * Get the appropriate command to list services for a given init system.
+ *
+ * @param initSystem - The detected init system
+ * @param state - Optional state filter (only works with systemd)
+ * @param service - Optional service name filter (only works with systemd)
+ * @returns Command and arguments to list services
+ */
+export function getServiceListCommand(initSystem, state, service) {
+    switch (initSystem) {
+        case "systemd": {
+            const args = ["list-units", "--type=service", "--no-pager"];
+            if (state && state !== "all") {
+                args.push(`--state=${state}`);
+            }
+            if (service) {
+                args.push(service);
+            }
+            return { command: "systemctl", args };
+        }
+        case "openrc":
+            return { command: "rc-status", args: ["--servicelist"] };
+        case "sysv":
+            return { command: "service", args: ["--status-all"] };
+        case "upstart":
+            return { command: "initctl", args: ["list"] };
+        case "unknown":
+        default:
+            // Fallback to showing all processes
+            return { command: "ps", args: ["aux"] };
+    }
+}
+/**
+ * Format the output title based on the init system.
+ *
+ * @param initSystem - The detected init system
+ * @returns Human-readable title for the service list
+ */
+export function getServiceListTitle(initSystem) {
+    switch (initSystem) {
+        case "systemd":
+            return "Systemd Services";
+        case "openrc":
+            return "OpenRC Services";
+        case "sysv":
+            return "SysV Init Services";
+        case "upstart":
+            return "Upstart Services";
+        case "unknown":
+        default:
+            return "Running Processes (init system unknown)";
+    }
+}
+//# sourceMappingURL=init-detection.js.map

package/dist/utils/init-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-detection.js","sourceRoot":"","sources":["../../src/utils/init-detection.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAe9B;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAE/C,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,kDAAkD;IAClD,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAsB,EACtB,KAAc,EACd,OAAgB;IAEhB,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;YAE5D,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;YAChC,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACxC,CAAC;QAED,KAAK,QAAQ;YACX,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;QAE3D,KAAK,MAAM;YACT,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;QAExD,KAAK,SAAS;YACZ,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QAEhD,KAAK,SAAS,CAAC;QACf;YACE,oCAAoC;YACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAsB;IACxD,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,kBAAkB,CAAC;QAC5B,KAAK,QAAQ;YACX,OAAO,iBAAiB,CAAC;QAC3B,KAAK,MAAM;YACT,OAAO,oBAAoB,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,kBAAkB,CAAC;QAC5B,KAAK,SAAS,CAAC;QACf;YACE,OAAO,yCAAyC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/utils/logger.d.ts

@@ -0,0 +1,11 @@
+import pino from "pino";
+/**
+ * Creates a structured logger instance with Pino
+ * Uses stderr (process.stderr.fd = 2) to keep stdout clean for MCP protocol
+ */
+export declare const logger: pino.Logger<never, boolean>;
+/**
+ * Creates a child logger with additional context
+ */
+export declare function createLogger(context: Record<string, unknown>): pino.Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/utils/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,MAAM,6BAsBlB,CAAC;AAEF;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAE1E"}

package/dist/utils/logger.js

@@ -0,0 +1,32 @@
+import pino from "pino";
+/**
+ * Creates a structured logger instance with Pino
+ * Uses stderr (process.stderr.fd = 2) to keep stdout clean for MCP protocol
+ */
+export const logger = pino({
+    level: process.env.LOG_LEVEL || "info",
+    transport: process.env.NODE_ENV !== "production"
+        ? {
+            target: "pino-pretty",
+            options: {
+                colorize: true,
+                translateTime: "HH:MM:ss | mm/dd/yyyy",
+                ignore: "pid,hostname"
+            }
+        }
+        : undefined,
+    formatters: {
+        level: (label) => {
+            return { level: label.toUpperCase() };
+        }
+    },
+    timestamp: () => `,"time":"${new Date().toISOString()}"`
+}, pino.destination({ dest: 2, sync: false }) // Use stderr (fd 2) instead of stdout (fd 1)
+);
+/**
+ * Creates a child logger with additional context
+ */
+export function createLogger(context) {
+    return logger.child(context);
+}
+//# sourceMappingURL=logger.js.map

package/dist/utils/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CACxB;IACE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM;IACtC,SAAS,EACP,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACnC,CAAC,CAAC;YACE,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE;gBACP,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,uBAAuB;gBACtC,MAAM,EAAE,cAAc;aACvB;SACF;QACH,CAAC,CAAC,SAAS;IACf,UAAU,EAAE;QACV,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACxC,CAAC;KACF;IACD,SAAS,EAAE,GAAG,EAAE,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG;CACzD,EACD,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,6CAA6C;CACzF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAgC;IAC3D,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC"}

package/dist/utils/pagination.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Apply pagination to an array of items.
+ *
+ * @param items - Array of items to paginate
+ * @param offset - Number of items to skip (default: 0)
+ * @param limit - Maximum number of items to return (default: undefined, returns all)
+ * @returns Paginated slice of the input array
+ *
+ * @example
+ * ```typescript
+ * const items = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+ *
+ * applyPagination(items, 0, 5);     // [1, 2, 3, 4, 5]
+ * applyPagination(items, 5, 5);     // [6, 7, 8, 9, 10]
+ * applyPagination(items, 5);        // [6, 7, 8, 9, 10]
+ * applyPagination(items, 100, 5);   // []
+ * ```
+ */
+export declare function applyPagination<T>(items: T[], offset?: number, limit?: number): T[];
+//# sourceMappingURL=pagination.d.ts.map

package/dist/utils/pagination.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../../src/utils/pagination.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE,CAYnF"}

package/dist/utils/pagination.js

@@ -0,0 +1,29 @@
+/**
+ * Apply pagination to an array of items.
+ *
+ * @param items - Array of items to paginate
+ * @param offset - Number of items to skip (default: 0)
+ * @param limit - Maximum number of items to return (default: undefined, returns all)
+ * @returns Paginated slice of the input array
+ *
+ * @example
+ * ```typescript
+ * const items = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+ *
+ * applyPagination(items, 0, 5);     // [1, 2, 3, 4, 5]
+ * applyPagination(items, 5, 5);     // [6, 7, 8, 9, 10]
+ * applyPagination(items, 5);        // [6, 7, 8, 9, 10]
+ * applyPagination(items, 100, 5);   // []
+ * ```
+ */
+export function applyPagination(items, offset, limit) {
+    const start = offset ?? 0;
+    // No pagination needed
+    if (start === 0 && limit === undefined) {
+        return items;
+    }
+    // Calculate end index
+    const end = limit !== undefined ? start + limit : undefined;
+    return items.slice(start, end);
+}
+//# sourceMappingURL=pagination.js.map

package/dist/utils/pagination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.js","sourceRoot":"","sources":["../../src/utils/pagination.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAAI,KAAU,EAAE,MAAe,EAAE,KAAc;IAC5E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC;IAE1B,uBAAuB;IACvB,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sBAAsB;IACtB,MAAM,GAAG,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAE5D,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC"}

package/dist/utils/path-security.d.ts

@@ -26,39 +26,153 @@ export declare class HostSecurityError extends Error {
     constructor(message: string, host: string);
 }
 /**
- * Validates hostname format to prevent command injection
+ * Pattern for valid systemd service names
+ * Allows alphanumeric characters plus @ . _ -
+ */
+export declare const SYSTEMD_SERVICE_NAME_PATTERN: RegExp;
+/**
+ * Validates hostname format to prevent command injection.
+ *
+ * Security: Prevents CWE-78 (OS Command Injection) by rejecting shell metacharacters
+ * that could be used to inject arbitrary commands when hostname is used in SSH commands.
+ * @see https://cwe.mitre.org/data/definitions/78.html
  *
- * @param host - Hostname to validate
- * @throws HostSecurityError if host contains dangerous characters
+ * @param hostname - Hostname to validate (must match pattern: alphanumeric, dots, hyphens, underscores)
+ * @throws {HostSecurityError} If hostname is empty, contains dangerous characters, or has invalid format
+ * @example
+ * ```typescript
+ * validateHostname("proxy.example.com"); // valid
+ * validateHostname("host-01"); // valid
+ * validateHostname("bad;rm -rf /"); // throws HostSecurityError
+ * ```
  */
-export declare function validateHostFormat(host: string): void;
+export declare function validateHostname(hostname: string): void;
+/**
+ * Security error for SSH argument validation
+ */
+export declare class SSHArgSecurityError extends Error {
+    readonly arg: string;
+    readonly paramName: string;
+    constructor(message: string, arg: string, paramName: string);
+}
+/**
+ * Validates SSH command argument to prevent command injection.
+ *
+ * Security: Prevents CWE-77 (Command Injection) and CWE-78 (OS Command Injection)
+ * by rejecting shell metacharacters. The SSH service joins args with spaces and executes
+ * as a shell command, so an attacker could inject arbitrary commands (e.g., "running; rm -rf /").
+ * @see https://cwe.mitre.org/data/definitions/77.html
+ * @see https://cwe.mitre.org/data/definitions/78.html
+ *
+ * @param arg - Argument value to validate (max 500 characters, no shell metacharacters)
+ * @param paramName - Name of the parameter (used in error messages for context)
+ * @throws {SSHArgSecurityError} If arg is empty, contains shell metacharacters, or exceeds 500 characters
+ * @example
+ * ```typescript
+ * validateSSHArg("running", "status"); // valid
+ * validateSSHArg("docker-compose.yml", "file"); // valid
+ * validateSSHArg("arg; rm -rf /", "input"); // throws SSHArgSecurityError
+ * ```
+ */
+export declare function validateSSHArg(arg: string, paramName: string): void;
+/**
+ * @deprecated Use validateServiceName from validation.ts instead
+ * Re-exported for backwards compatibility
+ */
+export { validateServiceName as validateSystemdServiceName } from "./validation.js";
 /**
  * Escapes a string for safe use as a shell argument.
- * Uses single quotes with proper escaping for embedded single quotes.
  *
- * @param arg - String to escape
- * @returns Safely quoted string
+ * Security: Prevents CWE-78 (OS Command Injection) by wrapping argument in single quotes
+ * and properly escaping any embedded single quotes using the '\'' sequence.
+ * @see https://cwe.mitre.org/data/definitions/78.html
+ *
+ * @param arg - String to escape for shell usage
+ * @returns Safely quoted string suitable for shell command construction
+ * @example
+ * ```typescript
+ * escapeShellArg("hello world"); // returns: 'hello world'
+ * escapeShellArg("it's a test"); // returns: 'it'\''s a test'
+ * escapeShellArg("$(rm -rf /)"); // returns: '$(rm -rf /)' (neutered)
+ * ```
  */
 export declare function escapeShellArg(arg: string): string;
 /**
- * Checks if a path is a system path that should be protected
+ * Checks if a path is a system path that should be protected from modification.
  *
- * @param path - Path to check
- * @returns true if path is in a system directory
+ * Identifies paths in critical system directories (/etc, /bin, /sbin, /usr/bin, /usr/sbin,
+ * /lib, /lib64, /boot, /root) that typically require elevated privileges and should
+ * trigger warnings when used as transfer targets.
+ *
+ * @param path - Absolute path to check against system directory prefixes
+ * @returns true if path is in a system directory, false otherwise
+ * @example
+ * ```typescript
+ * isSystemPath("/etc/nginx/nginx.conf"); // true
+ * isSystemPath("/home/user/file.txt"); // false
+ * isSystemPath("/usr/bin/curl"); // true
+ * ```
  */
 export declare function isSystemPath(path: string): boolean;
 /**
- * Validates that a file path is safe from directory traversal attacks
+ * Validates that a file path is safe from directory traversal attacks.
+ *
+ * Security: Prevents CWE-22 (Path Traversal) by enforcing strict path validation rules
+ * to prevent attackers from accessing files outside intended directories.
+ * @see https://cwe.mitre.org/data/definitions/22.html
  *
- * Rules:
+ * SECURITY (S-M5, CWE-22): Character Set Restrictions
+ * ----------------------------------------------------
+ * This function deliberately uses a conservative character whitelist to prioritize
+ * security over flexibility. The allowed character set is: [a-zA-Z0-9._\-/]
+ *
+ * **Allowed:**
+ * - Alphanumeric: a-z, A-Z, 0-9
+ * - Separators: forward slash (/)
+ * - Safe punctuation: dot (.), hyphen (-), underscore (_)
+ *
+ * **Explicitly Rejected:**
+ * - Spaces: Rejected to prevent parsing ambiguity in shell contexts and URL encoding issues
+ * - Colons: Rejected to prevent NTFS alternate data stream access (Windows) and URL scheme confusion
+ * - Backslashes: Rejected to prevent Windows path traversal and escape sequence injection
+ * - Shell metacharacters: &, |, ;, $, `, <, >, (, ), {, }, [, ], *, ?, ~, !, #, @
+ *
+ * **Design Rationale:**
+ * While spaces and colons are technically valid in POSIX paths, they create security risks:
+ * 1. Spaces require proper quoting in shell contexts (SSH commands, Docker exec)
+ * 2. Colons enable Windows alternate data streams (file.txt:hidden) and path separator confusion
+ * 3. Conservative whitelist prevents future attack vectors as new exploits are discovered
+ *
+ * **If you need paths with spaces or colons:**
+ * Use escapeShellArg() for shell command construction, but understand this function
+ * deliberately rejects them at the validation layer as a defense-in-depth measure.
+ * The security review (02-security-performance.md, S-M5) concluded: "Security over flexibility."
+ *
+ * Validation rules:
  * 1. Must be absolute path (starts with /)
- * 2. Cannot contain .. (parent directory)
- * 3. Cannot contain . as a path component (except in filenames)
- * 4. Must contain only allowed characters: a-zA-Z0-9._-/
+ * 2. Cannot contain .. (parent directory traversal)
+ * 3. Cannot contain . as a standalone component (current directory)
+ * 4. Must contain only safe characters: a-zA-Z0-9._-/
+ * 5. Path resolution must not result in traversal
+ *
+ * @param path - The file path to validate (must be absolute)
+ * @param paramName - Name of the parameter (used in error messages for context)
+ * @throws {Error} If path is empty, contains traversal sequences, has invalid characters, or is not absolute
+ * @example
+ * ```typescript
+ * // Valid paths
+ * validateSecurePath("/data/files/doc.txt", "file"); // OK
+ * validateSecurePath("/app/config.json", "config"); // OK
+ * validateSecurePath("/srv/docker-compose.yml", "file"); // OK (hyphens allowed)
+ * validateSecurePath("/home/user_name/file.tar.gz", "archive"); // OK (underscores, dots allowed)
  *
- * @param path - The file path to validate
- * @param paramName - Name of the parameter (for error messages)
- * @throws Error if path contains directory traversal or is invalid
+ * // Rejected for security
+ * validateSecurePath("../../../etc/passwd", "file"); // throws: relative path with traversal
+ * validateSecurePath("/valid/../../../etc/passwd", "file"); // throws: traversal sequence
+ * validateSecurePath("/path with spaces/file.txt", "file"); // throws: spaces not allowed
+ * validateSecurePath("/path:alternate/file", "file"); // throws: colons not allowed
+ * validateSecurePath("/path/$(rm -rf /)", "file"); // throws: shell metacharacters not allowed
+ * ```
  */
 export declare function validateSecurePath(path: string, paramName: string): void;
 //# sourceMappingURL=path-security.d.ts.map

package/dist/utils/path-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-security.d.ts","sourceRoot":"","sources":["../../src/utils/path-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;aAGxB,IAAI,EAAE,MAAM;gBAD5B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM;CAK/B;AAQD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAYrD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIlD;AAiBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAyCxE"}
+{"version":3,"file":"path-security.d.ts","sourceRoot":"","sources":["../../src/utils/path-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;aAGxB,IAAI,EAAE,MAAM;gBAD5B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM;CAK/B;AAcD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,QAAuB,CAAC;AAEjE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAevD;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;aAG1B,GAAG,EAAE,MAAM;aACX,SAAS,EAAE,MAAM;gBAFjC,OAAO,EAAE,MAAM,EACC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM;CAKpC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAqBnE;AAED;;;GAGG;AACH,OAAO,EAAE,mBAAmB,IAAI,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAEpF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIlD;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAoCxE"}