/** * Secure YAML Parser for DollhouseMCP - For Markdown Files with YAML Frontmatter * * IMPORTANT: This parser is specifically designed for Markdown files with YAML frontmatter * (the format used by personas, skills, templates, and other elements). * * USE THIS FOR: * - Persona files (e.g., creative-writer.md) * - Skill files (e.g., code-review.md) * - Template files (e.g., meeting-notes.md) * - Any Markdown file with YAML frontmatter between --- markers * * DO NOT USE THIS FOR: * - Pure YAML configuration files (use js-yaml directly with FAILSAFE_SCHEMA) * - JSON files * - Plain text files without frontmatter * * FILE FORMAT EXPECTED: * ``` * --- * name: Element Name * description: Element description * version: 1.0.0 * --- * * # Markdown content here * The actual content/instructions go here... * ``` * * Provides safe YAML parsing that prevents deserialization attacks * by using a restricted schema and pre-validation. * * Security: SEC-003 - YAML parsing vulnerability protection */ import matter from 'gray-matter'; export interface SecureParseOptions { maxYamlSize?: number; maxContentSize?: number; allowedKeys?: string[]; validateContent?: boolean; validateFields?: boolean; /** Content context for ContentValidator — exempts legitimate patterns (e.g.,