@aimarket/warden 0.0.1 → 0.3.0

package/dist/pinning.js

@@ -0,0 +1,179 @@
+import { createHash } from "node:crypto";
+import { canonicalize, CanonicalizationError } from "./jcs.js";
+/**
+ * Tool-definition pinning + drift detection ("rug-pull" defence).
+ *
+ * A server can advertise benign tools at approval time and silently swap in a
+ * poisoned definition later. We hash the canonical tool-def set on approval and
+ * compare on every subsequent connection: a changed hash means the contract the
+ * user approved no longer holds, so (under policy.pinToolDefs) we block and force
+ * re-approval. First-contact servers are flagged UNPINNED so the chain knows the
+ * pin is established only when the user approves.
+ */
+export class PinningGate {
+    store;
+    name = "pinning";
+    constructor(store) {
+        this.store = store;
+    }
+    async evaluate(input) {
+        const pin = await this.store.getPin(input.server.id);
+        let hash;
+        try {
+            hash = canonicalToolsHash(input.tools);
+        }
+        catch (err) {
+            if (!(err instanceof CanonicalizationError))
+                throw err;
+            return this.uncanonical(input, pin, err);
+        }
+        if (!pin) {
+            const finding = {
+                gate: this.name,
+                severity: "info",
+                code: "TOOL_DEF_UNPINNED",
+                message: `Server "${input.server.id}" has no pinned tool-def snapshot yet; it will be pinned on approval.`,
+                // Report-only by necessity, not by preference: a server at first contact
+                // cannot be anything but unpinned, and Warden.approve() runs only after
+                // vet() passes. Letting this finding block — which it did at
+                // blockAtSeverity "info" — makes first contact impossible for every
+                // server, so no pin can ever be created.
+                advisory: true,
+            };
+            // Neutral-to-good: unpinned isn't unsafe, it's just unestablished.
+            return { findings: [finding], score: 0.9 };
+        }
+        if (pin.toolsHash !== hash) {
+            const finding = {
+                gate: this.name,
+                severity: "high",
+                code: "TOOL_DEF_DRIFT",
+                message: `Tool definitions for "${input.server.id}" changed since approval ` +
+                    `(pinned ${short(pin.toolsHash)} → now ${short(hash)}). Possible rug-pull; re-approval required.`,
+            };
+            return {
+                findings: [finding],
+                score: 0,
+                fatal: input.policy.pinToolDefs === true,
+            };
+        }
+        return { findings: [], score: 1 };
+    }
+    /**
+     * The tool-def set has no canonical form (see {@link canonicalToolsHash}), so no
+     * hash can be produced for it. What that means depends on whether a pin exists:
+     *
+     * - **No pin yet** — nothing is being contradicted; the pin simply cannot be
+     *   established, which is a `medium` warning and not evidence of an attack.
+     * - **Pin exists** — the snapshot the user approved can no longer be re-verified,
+     *   which is indistinguishable from drift and is treated as drift. Otherwise a
+     *   server could disarm the rug-pull defence at will by adding one fractional
+     *   number to a schema.
+     */
+    uncanonical(input, pin, err) {
+        if (!pin) {
+            return {
+                findings: [
+                    {
+                        gate: this.name,
+                        severity: "medium",
+                        code: "TOOL_DEF_UNCANONICAL",
+                        message: `Tool definitions for "${input.server.id}" have no canonical form (${err.message}), ` +
+                            `so no reproducible pin can be taken — drift detection is unavailable for this server.`,
+                    },
+                ],
+                score: 0.5,
+            };
+        }
+        return {
+            findings: [
+                {
+                    gate: this.name,
+                    severity: "high",
+                    code: "TOOL_DEF_UNCANONICAL",
+                    message: `Tool definitions for "${input.server.id}" have no canonical form (${err.message}), so the pinned ` +
+                        `snapshot ${short(pin.toolsHash)} cannot be re-verified. Treated as drift; re-approval required.`,
+                },
+            ],
+            score: 0,
+            fatal: input.policy.pinToolDefs === true,
+        };
+    }
+    /**
+     * Persist the current tool-def set as the trusted snapshot for this server.
+     * Called by Warden.approve() once a user has accepted the connection.
+     *
+     * Throws {@link CanonicalizationError} when the set has no canonical form; the
+     * caller (`McpHost.connect`) already reports a pin failure as a degraded
+     * rug-pull defence rather than failing the connection.
+     */
+    async pin(server, tools) {
+        const pinned = {
+            serverId: server.id,
+            toolsHash: canonicalToolsHash(tools),
+            approvedAt: new Date().toISOString(),
+            toolNames: [...tools.map((t) => t.name)].sort(),
+        };
+        await this.store.putPin(pinned);
+    }
+}
+/**
+ * Marker used where a tool-def hash is *recorded* rather than compared, and the set
+ * turned out to have no canonical form. It can never collide with a sha256 hex
+ * digest, so anything that later compares it simply reports a mismatch.
+ */
+export const UNCANONICAL_TOOLS_HASH = "uncanonical:non-canonical-tool-defs";
+/**
+ * sha256 over the canonical tool-def set: tools sorted by name, each reduced to
+ * the security-relevant fields (name, description, schema), serialised with
+ * {@link canonicalize} — RFC 8785 (JCS) as profiled in `awr/SPEC.md` §4.
+ *
+ * This digest is quoted in receipts and re-checked elsewhere (`argus verify`, the
+ * sealed mandate), so it has to be reproducible by an implementation that is not
+ * this one. Two consequences:
+ *
+ * - **Ordering is by UTF-16 code unit, never `localeCompare`.** `localeCompare`
+ *   depends on the host locale and ICU version — `["a", "B"]` sorts one way under
+ *   `en-US` and another under the C locale — so a digest built on it is not even
+ *   stable across two machines running this same code, let alone across languages.
+ *   JavaScript's `<`/`>` on strings compare UTF-16 code units, which is exactly
+ *   RFC 8785 §3.2.3's rule.
+ * - **Non-integer numbers are refused** (`AWR-CANON-001`, SPEC §4.3) rather than
+ *   serialised. Whether `1` is an integer or a double is a language accident that
+ *   silently changes the bytes, so a schema carrying e.g. `"multipleOf": 0.01` has
+ *   no canonical form here and this function throws
+ *   {@link CanonicalizationError}. Callers must handle that — refusing to emit a
+ *   digest is honest; emitting one nobody else can reproduce is not.
+ */
+export function canonicalToolsHash(tools) {
+    const canonical = [...tools]
+        .sort((a, b) => compareCodeUnits(a.name, b.name))
+        .map((t) => ({
+        name: t.name,
+        description: t.description ?? "",
+        inputSchema: t.inputSchema ?? {},
+    }));
+    return createHash("sha256").update(canonicalize(canonical), "utf8").digest("hex");
+}
+/**
+ * Like {@link canonicalToolsHash} but total: returns `undefined` instead of
+ * throwing, for call sites that record a hash rather than enforce one.
+ */
+export function tryCanonicalToolsHash(tools) {
+    try {
+        return canonicalToolsHash(tools);
+    }
+    catch (err) {
+        if (err instanceof CanonicalizationError)
+            return undefined;
+        throw err;
+    }
+}
+/** RFC 8785 §3.2.3 ordering: arrays of UTF-16 code units as unsigned integers. */
+function compareCodeUnits(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+function short(hash) {
+    return hash.slice(0, 12);
+}
+//# sourceMappingURL=pinning.js.map

package/dist/pinning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinning.js","sourceRoot":"","sources":["../src/pinning.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAY/D;;;;;;;;;GASG;AACH,MAAM,OAAO,WAAW;IAGO;IAFpB,IAAI,GAAG,SAAS,CAAC;IAE1B,YAA6B,KAAe;QAAf,UAAK,GAAL,KAAK,CAAU;IAAG,CAAC;IAEhD,KAAK,CAAC,QAAQ,CAAC,KAAsB;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAErD,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,qBAAqB,CAAC;gBAAE,MAAM,GAAG,CAAC;YACvD,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,OAAO,GAAkB;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,WAAW,KAAK,CAAC,MAAM,CAAC,EAAE,uEAAuE;gBAC1G,yEAAyE;gBACzE,wEAAwE;gBACxE,6DAA6D;gBAC7D,oEAAoE;gBACpE,yCAAyC;gBACzC,QAAQ,EAAE,IAAI;aACf,CAAC;YACF,mEAAmE;YACnE,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAkB;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EACL,yBAAyB,KAAK,CAAC,MAAM,CAAC,EAAE,2BAA2B;oBACnE,WAAW,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,6CAA6C;aACpG,CAAC;YACF,OAAO;gBACL,QAAQ,EAAE,CAAC,OAAO,CAAC;gBACnB,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI;aACzC,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;;;;;OAUG;IACK,WAAW,CAAC,KAAsB,EAAE,GAA6B,EAAE,GAA0B;QACnG,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,QAAQ;wBAClB,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EACL,yBAAyB,KAAK,CAAC,MAAM,CAAC,EAAE,6BAA6B,GAAG,CAAC,OAAO,KAAK;4BACrF,uFAAuF;qBAC1F;iBACF;gBACD,KAAK,EAAE,GAAG;aACX,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EACL,yBAAyB,KAAK,CAAC,MAAM,CAAC,EAAE,6BAA6B,GAAG,CAAC,OAAO,mBAAmB;wBACnG,YAAY,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,iEAAiE;iBACpG;aACF;YACD,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI;SACzC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CAAC,MAAoB,EAAE,KAAgB;QAC9C,MAAM,MAAM,GAAiB;YAC3B,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC;YACpC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;SAChD,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,qCAAqC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAgB;IACjD,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,CAAC;SACzB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;QAChC,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;KACjC,CAAC,CAAC,CAAC;IACN,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAgB;IACpD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB;YAAE,OAAO,SAAS,CAAC;QAC3D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,gBAAgB,CAAC,CAAS,EAAE,CAAS;IAC5C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC"}

package/dist/sandbox.d.ts

@@ -0,0 +1,38 @@
+import type { ToolDef, WardenPolicy } from "./types.js";
+/**
+ * Runtime policy layer for tool execution.
+ *
+ * NOTE: this is the JS-level policy layer, not a true sandbox. It classifies
+ * tools, gates sensitive calls behind explicit approval, and watches egress for
+ * a tool trying to phone home. OS-level process isolation
+ * (seccomp / Landlock on Linux, sandbox-exec on macOS) is the v2 hardening that
+ * confines the actual child process; until then these helpers are the boundary
+ * the agent loop enforces in-process.
+ */
+/**
+ * True if a tool name matches any sensitive pattern in the policy. Patterns use
+ * `*` as a wildcard and match case-insensitively (e.g. "*delete*", "*transfer*").
+ * Sensitive tools are still allowed to be advertised — they just require explicit
+ * per-call approval before WARDEN lets them run.
+ */
+export declare function isSensitiveTool(toolName: string, policy: WardenPolicy): boolean;
+/** Split a server's advertised tools into sensitive vs. safe by policy. */
+export declare function classifyTools(tools: ToolDef[], policy: WardenPolicy): {
+    sensitive: string[];
+    safe: string[];
+};
+/**
+ * Outbound-request allowlist. Wrap any network egress a tool performs in
+ * `check()` — a tool that tries to reach a host outside the allowlist is the
+ * classic "phone home" exfiltration tell. Hostnames are matched case-insensitively
+ * and a leading "*." entry matches subdomains (e.g. "*.example.com").
+ */
+export declare class EgressGuard {
+    private readonly allow;
+    constructor(allowlist: string[]);
+    check(url: string): {
+        allowed: boolean;
+        reason?: string;
+    };
+}
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAExD;;;;;;;;;GASG;AAEH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAG/E;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EAAE,EAChB,MAAM,EAAE,YAAY,GACnB;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAQzC;AAED;;;;;GAKG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;gBAErB,SAAS,EAAE,MAAM,EAAE;IAI/B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;CAmB1D"}

package/dist/sandbox.js

@@ -0,0 +1,76 @@
+/**
+ * Runtime policy layer for tool execution.
+ *
+ * NOTE: this is the JS-level policy layer, not a true sandbox. It classifies
+ * tools, gates sensitive calls behind explicit approval, and watches egress for
+ * a tool trying to phone home. OS-level process isolation
+ * (seccomp / Landlock on Linux, sandbox-exec on macOS) is the v2 hardening that
+ * confines the actual child process; until then these helpers are the boundary
+ * the agent loop enforces in-process.
+ */
+/**
+ * True if a tool name matches any sensitive pattern in the policy. Patterns use
+ * `*` as a wildcard and match case-insensitively (e.g. "*delete*", "*transfer*").
+ * Sensitive tools are still allowed to be advertised — they just require explicit
+ * per-call approval before WARDEN lets them run.
+ */
+export function isSensitiveTool(toolName, policy) {
+    const name = toolName.toLowerCase();
+    return policy.sensitiveToolPatterns.some((pat) => globMatch(pat, name));
+}
+/** Split a server's advertised tools into sensitive vs. safe by policy. */
+export function classifyTools(tools, policy) {
+    const sensitive = [];
+    const safe = [];
+    for (const tool of tools) {
+        if (isSensitiveTool(tool.name, policy))
+            sensitive.push(tool.name);
+        else
+            safe.push(tool.name);
+    }
+    return { sensitive, safe };
+}
+/**
+ * Outbound-request allowlist. Wrap any network egress a tool performs in
+ * `check()` — a tool that tries to reach a host outside the allowlist is the
+ * classic "phone home" exfiltration tell. Hostnames are matched case-insensitively
+ * and a leading "*." entry matches subdomains (e.g. "*.example.com").
+ */
+export class EgressGuard {
+    allow;
+    constructor(allowlist) {
+        this.allow = allowlist.map((h) => h.trim().toLowerCase()).filter(Boolean);
+    }
+    check(url) {
+        let host;
+        try {
+            host = new URL(url).hostname.toLowerCase();
+        }
+        catch {
+            return { allowed: false, reason: `Unparseable URL: ${url}` };
+        }
+        if (this.allow.length === 0) {
+            return { allowed: false, reason: `Egress blocked (empty allowlist): ${host}` };
+        }
+        for (const entry of this.allow) {
+            if (entry === host)
+                return { allowed: true };
+            if (entry.startsWith("*.")) {
+                const suffix = entry.slice(1); // ".example.com"
+                if (host.endsWith(suffix) && host.length > suffix.length)
+                    return { allowed: true };
+            }
+        }
+        return { allowed: false, reason: `Host not in egress allowlist: ${host}` };
+    }
+}
+/** `*`-glob match (case-insensitive). Inputs are matched as whole strings. */
+function globMatch(pattern, value) {
+    const re = pattern
+        .toLowerCase()
+        .split("*")
+        .map((seg) => seg.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+        .join(".*");
+    return new RegExp(`^${re}$`, "i").test(value);
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,MAAoB;IACpE,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAC3B,KAAgB,EAChB,MAAoB;IAEpB,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YAC7D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IACL,KAAK,CAAW;IAEjC,YAAY,SAAmB;QAC7B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,GAAW;QACf,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,GAAG,EAAE,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,IAAI,EAAE,EAAE,CAAC;QACjF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;gBAChD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;oBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACrF,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,IAAI,EAAE,EAAE,CAAC;IAC7E,CAAC;CACF;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa;IAC/C,MAAM,EAAE,GAAG,OAAO;SACf,WAAW,EAAE;SACb,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;SACxD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC"}

package/dist/static-scan.d.ts

@@ -0,0 +1,66 @@
+import type { RulesetRef, Severity, WardenGate, WardenGateInput, WardenGateResult } from "./types.js";
+/**
+ * Static tool-definition scanner.
+ *
+ * The MCP tool *description* and *input schema* are attacker-controlled text the
+ * model reads as trusted instructions — this is the tool-poisoning / prompt-
+ * injection surface. We scan that text (never the live tool output) for known
+ * signatures before a single token of it reaches the model. Cheap, deterministic,
+ * and runs first so later gates can reason about its findings.
+ *
+ * Rules are TIERED, and the tier is what decides blocking — not severity:
+ *
+ *   block  — no plausible benign reading in a tool definition. Blocks at the
+ *            policy threshold like any other finding.
+ *   advise — legitimately appears in honest tool definitions. Reported, never
+ *            blocks, never reduces the score, at any `blockAtSeverity`.
+ *
+ * Ruleset v1 had one tier, so `api_key` in a schema carried the same weight as
+ * "ignore all previous instructions". A GitHub-style server whose `create_issue`
+ * takes an `api_key` and mentions a personal access token scored 0.40 and had the
+ * tool blocked under the default policy — i.e. most real MCP servers were refused,
+ * which is how a scanner gets switched off entirely.
+ */
+type Tier = "block" | "advise";
+/**
+ * Ruleset version. Bump on ANY change to the table above — a scan result is only
+ * comparable to another scan made under the same version and digest.
+ *
+ * 1 — single tier; credential parameter names blocked real servers.
+ * 2 — block/advise tiers; exfil "send … to" anchored on an external destination;
+ *     TOOL_DEF_SECRET_HARVEST added so demoting the credential nouns does not
+ *     open a hole; advisory findings no longer affect the score.
+ */
+export declare const STATIC_SCAN_RULESET_VERSION = "2";
+export interface StaticScanRule {
+    code: string;
+    severity: Severity;
+    tier: Tier;
+    /** The regex source, so a third party can re-run the exact rule. */
+    source: string;
+    flags: string;
+}
+export interface StaticScanRuleset extends RulesetRef {
+    rules: StaticScanRule[];
+}
+/**
+ * The rule table plus its digest, so a scan result stays checkable after the
+ * rules change.
+ *
+ * Sorted, so the digest depends on the rules and not on the order they happen to
+ * be declared in — and sorted by CODE-UNIT comparison, not `localeCompare`: the
+ * digest is a cross-machine identifier, and a locale-dependent collation would
+ * make the same rule table digest differently on a differently-configured host,
+ * which is exactly the divergence the digest exists to detect. The preimage is
+ * the RFC 8785 canonical form (see ./jcs.ts) so this file does not invent a
+ * second serialization of its own.
+ */
+export declare function staticScanRuleset(): StaticScanRuleset;
+/** Just the identity of the rule table, for embedding in a verdict. */
+export declare function staticScanRulesetRef(): RulesetRef;
+export declare class StaticScanGate implements WardenGate {
+    readonly name = "static-scan";
+    evaluate(input: WardenGateInput): Promise<WardenGateResult>;
+}
+export {};
+//# sourceMappingURL=static-scan.d.ts.map

package/dist/static-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-scan.d.ts","sourceRoot":"","sources":["../src/static-scan.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,UAAU,EACV,QAAQ,EAER,UAAU,EACV,eAAe,EACf,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,KAAK,IAAI,GAAG,OAAO,GAAG,QAAQ,CAAC;AA2G/B;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAmB/C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,IAAI,CAAC;IACX,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,IAAI,iBAAiB,CAarD;AAOD,uEAAuE;AACvE,wBAAgB,oBAAoB,IAAI,UAAU,CAGjD;AAED,qBAAa,cAAe,YAAW,UAAU;IAC/C,QAAQ,CAAC,IAAI,iBAAiB;IAExB,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;CA+BlE"}

package/dist/static-scan.js

@@ -0,0 +1,215 @@
+import { createHash } from "node:crypto";
+import { canonicalize } from "./jcs.js";
+// Imperative instructions aimed at the model — the classic injection tells.
+const INJECTION_PATTERNS = [
+    { re: /\bignore\s+(?:all\s+|the\s+)?(?:previous|prior|above|preceding)\b/i, code: "TOOL_DEF_INJECTION", severity: "critical", tier: "block" },
+    { re: /\bdisregard\s+(?:all\s+|the\s+|any\s+)?(?:previous|prior|above|instructions?|rules?)\b/i, code: "TOOL_DEF_INJECTION", severity: "critical", tier: "block" },
+    { re: /\bdo\s+not\s+(?:tell|inform|mention|reveal\s+to|notify)\s+(?:the\s+)?user\b/i, code: "TOOL_DEF_INJECTION", severity: "critical", tier: "block" },
+    { re: /\bwithout\s+(?:telling|informing|asking)\s+(?:the\s+)?user\b/i, code: "TOOL_DEF_INJECTION", severity: "high", tier: "block" },
+    { re: /<\s*\/?\s*(?:system|instructions?|important)\s*>/i, code: "TOOL_DEF_INJECTION", severity: "high", tier: "block" },
+    // A tool DEFINITION that talks about the model's own instructions is arguing
+    // with the system prompt, not describing a capability. Honest servers describe
+    // user-supplied prompts instead. This is the blocking rule most likely to need
+    // a policy override — a prompt-management server may legitimately trip it.
+    { re: /\b(?:system\s+prompt|developer\s+(?:message|prompt))\b/i, code: "TOOL_DEF_INJECTION", severity: "high", tier: "block" },
+    // Ordinary English. Kept as a signal because it co-occurs with real poisoning,
+    // demoted because on its own it is noise: "You must supply a subject."
+    { re: /\byou\s+must\b/i, code: "TOOL_DEF_IMPERATIVE", severity: "low", tier: "advise" },
+    { re: /\binstead\s+of\b/i, code: "TOOL_DEF_IMPERATIVE", severity: "info", tier: "advise" },
+];
+// Data-exfiltration phrasing.
+const EXFIL_PATTERNS = [
+    { re: /\bexfiltrat\w*/i, code: "TOOL_DEF_EXFIL", severity: "critical", tier: "block" },
+    // Anchored on an EXTERNAL destination. Unanchored, this matched "Send the
+    // message to the recipient" in any honest email or webhook tool.
+    {
+        re: /\b(?:send|post|forward|relay)\s+(?:it|them|this|the\s+\w+|all|results?|output|data|contents?)\s+to\s+(?:https?:\/\/|\b[\w-]+(?:\.[\w-]+)*\.[a-z]{2,}\b)/i,
+        code: "TOOL_DEF_EXFIL",
+        severity: "high",
+        tier: "block",
+    },
+    { re: /\b(?:post|send|put)\s+to\s+https?:\/\//i, code: "TOOL_DEF_EXFIL", severity: "critical", tier: "block" },
+    { re: /\bupload\b[\s\S]{0,40}\bto\s+(?:https?:\/\/|[\w.-]+\.[a-z]{2,})/i, code: "TOOL_DEF_EXFIL", severity: "high", tier: "block" },
+];
+// Secrets. Naming a credential PARAMETER is what normal tools do; demanding the
+// material that is never a parameter is not.
+//
+// The discriminator is the VERB, not the noun. "Requires a personal access token
+// with repo scope" describes an input. "read the user's api_key from the .env
+// file" instructs the model to go and get one. Tiering on the noun alone is what
+// blocked every real server, and dropping the noun rules entirely would have let
+// a harvest instruction through whenever it omitted an injection phrase.
+const SECRET_PATTERNS = [
+    {
+        re: /\b(?:read|extract|retrieve|fetch|obtain|dump|reveal|collect|harvest|grab|copy|print)\s[\s\S]{0,30}?\b(?:api[_\s-]?key|access[_\s-]?token|bearer\s+token|credential|password|passwd|secret|\.env\b|environment\s+variable)/i,
+        code: "TOOL_DEF_SECRET_HARVEST",
+        severity: "critical",
+        tier: "block",
+    },
+    { re: /\bprivate[_\s-]?key\b/i, code: "TOOL_DEF_SECRET_REQUEST", severity: "critical", tier: "block" },
+    { re: /\bseed[_\s-]?phrase\b|\bmnemonic\b/i, code: "TOOL_DEF_SECRET_REQUEST", severity: "critical", tier: "block" },
+    { re: /~\/\.ssh|\bid_rsa\b|\.ssh\/[\w.-]+/i, code: "TOOL_DEF_SECRET_REQUEST", severity: "critical", tier: "block" },
+    // Advisory: these are ordinary parameter names and ordinary setup prose.
+    { re: /\bapi[_\s-]?key\b/i, code: "TOOL_DEF_CREDENTIAL_PARAM", severity: "low", tier: "advise" },
+    { re: /\bcredentials?\b|\baccess[_\s-]?token\b|\bbearer\s+token\b/i, code: "TOOL_DEF_CREDENTIAL_PARAM", severity: "low", tier: "advise" },
+    { re: /\bsecret(?:s)?\b/i, code: "TOOL_DEF_CREDENTIAL_PARAM", severity: "low", tier: "advise" },
+    { re: /\bpassword\b|\bpasswd\b/i, code: "TOOL_DEF_CREDENTIAL_PARAM", severity: "medium", tier: "advise" },
+    { re: /(?:^|[^.\w])\.env\b|\benvironment\s+variables?\b/i, code: "TOOL_DEF_ENV_REFERENCE", severity: "medium", tier: "advise" },
+];
+// Dangerous URL schemes embedded in text.
+const URL_SCHEME_PATTERNS = [
+    { re: /\bdata:[\w/+.-]+;base64,/i, code: "TOOL_DEF_DATA_URL", severity: "high", tier: "block" },
+    { re: /\bjavascript:/i, code: "TOOL_DEF_DATA_URL", severity: "high", tier: "block" },
+];
+// Hidden payloads. Part of the rule table (and therefore the digest) rather than
+// special cases in the scan loop.
+const PAYLOAD_PATTERNS = [
+    {
+        // Standard (RFC 4648 §4) AND URL-safe (§5) base64, padded or not — JWTs and
+        // web payloads commonly omit padding.
+        re: /[A-Za-z0-9+/_-]{120,}={0,2}/,
+        code: "TOOL_DEF_BASE64_BLOB",
+        severity: "high",
+        tier: "block",
+        note: "contains a long base64-encoded blob — possible hidden payload",
+    },
+    {
+        // U+200B–200F, U+202A–202E, U+2060, U+FEFF. Built from a \u-escaped string so
+        // the source stays reviewable (the characters are, by definition, invisible).
+        re: new RegExp("[\\u200B-\\u200F\\u202A-\\u202E\\u2060\\uFEFF]"),
+        code: "TOOL_DEF_HIDDEN_UNICODE",
+        severity: "high",
+        tier: "block",
+        note: "contains zero-width or bidi control characters hiding text from review",
+    },
+];
+const RULES = [
+    ...INJECTION_PATTERNS,
+    ...EXFIL_PATTERNS,
+    ...SECRET_PATTERNS,
+    ...URL_SCHEME_PATTERNS,
+    ...PAYLOAD_PATTERNS,
+];
+/**
+ * Ruleset version. Bump on ANY change to the table above — a scan result is only
+ * comparable to another scan made under the same version and digest.
+ *
+ * 1 — single tier; credential parameter names blocked real servers.
+ * 2 — block/advise tiers; exfil "send … to" anchored on an external destination;
+ *     TOOL_DEF_SECRET_HARVEST added so demoting the credential nouns does not
+ *     open a hole; advisory findings no longer affect the score.
+ */
+export const STATIC_SCAN_RULESET_VERSION = "2";
+const SEVERITY_RANK = {
+    info: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+/** Penalty applied to the gate score per worst BLOCKING severity found. */
+const SEVERITY_PENALTY = {
+    info: 0,
+    low: 0.1,
+    medium: 0.3,
+    high: 0.6,
+    critical: 1,
+};
+/**
+ * The rule table plus its digest, so a scan result stays checkable after the
+ * rules change.
+ *
+ * Sorted, so the digest depends on the rules and not on the order they happen to
+ * be declared in — and sorted by CODE-UNIT comparison, not `localeCompare`: the
+ * digest is a cross-machine identifier, and a locale-dependent collation would
+ * make the same rule table digest differently on a differently-configured host,
+ * which is exactly the divergence the digest exists to detect. The preimage is
+ * the RFC 8785 canonical form (see ./jcs.ts) so this file does not invent a
+ * second serialization of its own.
+ */
+export function staticScanRuleset() {
+    const rules = RULES.map((r) => ({
+        code: r.code,
+        severity: r.severity,
+        tier: r.tier,
+        source: r.re.source,
+        flags: r.re.flags,
+    })).sort((a, b) => cmp(a.code, b.code) || cmp(a.source, b.source) || cmp(a.flags, b.flags));
+    const preimage = canonicalize({ version: STATIC_SCAN_RULESET_VERSION, rules });
+    const digest = `sha256-${createHash("sha256").update(preimage, "utf8").digest("base64")}`;
+    return { version: STATIC_SCAN_RULESET_VERSION, digest, rules };
+}
+/** Code-unit comparison. See staticScanRuleset for why not localeCompare. */
+function cmp(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+/** Just the identity of the rule table, for embedding in a verdict. */
+export function staticScanRulesetRef() {
+    const { version, digest } = staticScanRuleset();
+    return { version, digest };
+}
+export class StaticScanGate {
+    name = "static-scan";
+    async evaluate(input) {
+        const findings = [];
+        for (const tool of input.tools) {
+            const schemaText = safeStringifySchema(tool.inputSchema);
+            // Description is prose; schema text is field names + descriptions + enums.
+            const haystacks = [
+                { text: tool.description ?? "", where: "description" },
+                { text: schemaText, where: "input schema" },
+            ];
+            for (const { text, where } of haystacks) {
+                for (const rule of RULES) {
+                    if (!rule.re.test(text))
+                        continue;
+                    const finding = {
+                        gate: this.name,
+                        severity: rule.severity,
+                        code: rule.code,
+                        message: rule.note
+                            ? `Tool "${tool.name}" ${where} ${rule.note}.`
+                            : `Tool "${tool.name}" ${where} matches ${rule.code} signature (${describe(rule.re)}).`,
+                        tool: tool.name,
+                    };
+                    if (rule.tier === "advise")
+                        finding.advisory = true;
+                    findings.push(finding);
+                }
+            }
+        }
+        return { findings, score: scoreFor(findings) };
+    }
+}
+/**
+ * 1 minus the penalty for the worst BLOCKING severity found; clamped to [0,1].
+ *
+ * Advisory findings are excluded on purpose. The composite is presented to users
+ * as a safety score, and a credential parameter name is not a safety defect —
+ * letting it drag the number down made a clean server look like a compromised one.
+ */
+function scoreFor(findings) {
+    let worst = "info";
+    for (const f of findings) {
+        if (f.advisory)
+            continue;
+        if (SEVERITY_RANK[f.severity] > SEVERITY_RANK[worst])
+            worst = f.severity;
+    }
+    const score = 1 - SEVERITY_PENALTY[worst];
+    return Math.max(0, Math.min(1, score));
+}
+/** Deterministic, total stringify of a JSON schema for scanning. */
+function safeStringifySchema(schema) {
+    try {
+        return JSON.stringify(schema) ?? "";
+    }
+    catch {
+        return String(schema ?? "");
+    }
+}
+/** Short human label for a signature regex, for the finding message. */
+function describe(re) {
+    return re.source.length > 48 ? `${re.source.slice(0, 45)}…` : re.source;
+}
+//# sourceMappingURL=static-scan.js.map

package/dist/static-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-scan.js","sourceRoot":"","sources":["../src/static-scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AA4CxC,4EAA4E;AAC5E,MAAM,kBAAkB,GAAuB;IAC7C,EAAE,EAAE,EAAE,oEAAoE,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;IAC7I,EAAE,EAAE,EAAE,yFAAyF,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;IAClK,EAAE,EAAE,EAAE,8EAA8E,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;IACvJ,EAAE,EAAE,EAAE,+DAA+D,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;IACpI,EAAE,EAAE,EAAE,mDAAmD,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;IACxH,6EAA6E;IAC7E,+EAA+E;IAC/E,+EAA+E;IAC/E,2EAA2E;IAC3E,EAAE,EAAE,EAAE,yDAAyD,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;IAC9H,+EAA+E;IAC/E,uEAAuE;IACvE,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvF,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;CAC3F,CAAC;AAEF,8BAA8B;AAC9B,MAAM,cAAc,GAAuB;IACzC,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;IACtF,0EAA0E;IAC1E,iEAAiE;IACjE;QACE,EAAE,EAAE,0JAA0J;QAC9J,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,OAAO;KACd;IACD,EAAE,EAAE,EAAE,yCAAyC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;IAC9G,EAAE,EAAE,EAAE,kEAAkE,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;CACpI,CAAC;AAEF,gFAAgF;AAChF,6CAA6C;AAC7C,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,iFAAiF;AACjF,iFAAiF;AACjF,yEAAyE;AACzE,MAAM,eAAe,GAAuB;IAC1C;QACE,EAAE,EAAE,4NAA4N;QAChO,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,OAAO;KACd;IACD,EAAE,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;IACtG,EAAE,EAAE,EAAE,qCAAqC,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;IACnH,EAAE,EAAE,EAAE,qCAAqC,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;IACnH,yEAAyE;IACzE,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChG,EAAE,EAAE,EAAE,6DAA6D,EAAE,IAAI,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzI,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/F,EAAE,EAAE,EAAE,0BAA0B,EAAE,IAAI,EAAE,2BAA2B,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzG,EAAE,EAAE,EAAE,mDAAmD,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;CAChI,CAAC;AAEF,0CAA0C;AAC1C,MAAM,mBAAmB,GAAuB;IAC9C,EAAE,EAAE,EAAE,2BAA2B,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;IAC/F,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;CACrF,CAAC;AAEF,iFAAiF;AACjF,kCAAkC;AAClC,MAAM,gBAAgB,GAAuB;IAC3C;QACE,4EAA4E;QAC5E,sCAAsC;QACtC,EAAE,EAAE,6BAA6B;QACjC,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,+DAA+D;KACtE;IACD;QACE,8EAA8E;QAC9E,8EAA8E;QAC9E,EAAE,EAAE,IAAI,MAAM,CAAC,gDAAgD,CAAC;QAChE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,wEAAwE;KAC/E;CACF,CAAC;AAEF,MAAM,KAAK,GAAuB;IAChC,GAAG,kBAAkB;IACrB,GAAG,cAAc;IACjB,GAAG,eAAe;IAClB,GAAG,mBAAmB;IACtB,GAAG,gBAAgB;CACpB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAE/C,MAAM,aAAa,GAA6B;IAC9C,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,2EAA2E;AAC3E,MAAM,gBAAgB,GAA6B;IACjD,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,GAAG;IACR,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,CAAC;CACZ,CAAC;AAeF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAqB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM;QACnB,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK;KAClB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAE5F,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IAE1F,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACjE,CAAC;AAED,6EAA6E;AAC7E,SAAS,GAAG,CAAC,CAAS,EAAE,CAAS;IAC/B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB;IAClC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAChD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,aAAa,CAAC;IAE9B,KAAK,CAAC,QAAQ,CAAC,KAAsB;QACnC,MAAM,QAAQ,GAAoB,EAAE,CAAC;QAErC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzD,2EAA2E;YAC3E,MAAM,SAAS,GAA2C;gBACxD,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE;gBACtD,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE;aAC5C,CAAC;YAEF,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,SAAS,EAAE,CAAC;gBACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAClC,MAAM,OAAO,GAAkB;wBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,OAAO,EAAE,IAAI,CAAC,IAAI;4BAChB,CAAC,CAAC,SAAS,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,GAAG;4BAC9C,CAAC,CAAC,SAAS,IAAI,CAAC,IAAI,KAAK,KAAK,YAAY,IAAI,CAAC,IAAI,eAAe,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI;wBACzF,IAAI,EAAE,IAAI,CAAC,IAAI;qBAChB,CAAC;oBACF,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;wBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;oBACpD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjD,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,QAAyB;IACzC,IAAI,KAAK,GAAa,MAAM,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ;YAAE,SAAS;QACzB,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,oEAAoE;AACpE,SAAS,mBAAmB,CAAC,MAAe;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,QAAQ,CAAC,EAAU;IAC1B,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC;AAC1E,CAAC"}