@aimarket/warden 0.0.1 → 0.3.0

package/dist/threat-feed.d.ts

@@ -0,0 +1,135 @@
+import type { McpServerRef, ThreatRecord, ToolDef, WardenFinding, WardenGate, WardenGateInput, WardenGateResult, WardenLogger } from "./types.js";
+/**
+ * Threat-intel feed for known-bad MCP servers/tools.
+ *
+ * Reputation answers "is this server trusted?"; the threat feed answers "is this
+ * server a *known* bad actor?". It ships with a small built-in deny-list of
+ * patterns (credential-stealing, destructive commands, crypto-drainer keywords,
+ * typosquat-style names) and can be topped up from a signed remote feed.
+ *
+ * **In the shipping configuration there is no remote feed.** `warden.threatFeedUrl`
+ * and `warden.feedPublicKey` default to `undefined` (see `src/config.ts`), so
+ * unless an operator sets both, this gate *is* the {@link BUILTIN} list — a fixed
+ * floor of 11 patterns, not live intel. That is a deliberate default: ARGUS ships
+ * no feed endpoint and no publisher key, because a feed URL baked into the binary
+ * is a single point every install would have to trust.
+ *
+ * When a feed *is* configured, three properties are enforced fail-closed — any of
+ * them failing keeps the built-in floor and changes nothing else:
+ *
+ * - **Authenticity.** An Ed25519 signature over the canonical form of
+ *   `{records, timestamp}`, verified with a pre-configured public key. Unsigned
+ *   feeds are refused outright.
+ * - **Freshness.** The signed `timestamp` must be within {@link
+ *   DEFAULT_FEED_MAX_AGE_MS} (configurable). Without this, whoever serves the feed
+ *   URL can replay a months-old snapshot forever and silently erase every threat
+ *   record added since — a signature says *who* wrote a document, never *when you
+ *   were handed it*.
+ * - **Determinism.** The signed bytes are RFC 8785 canonical (§4 of
+ *   `awr/SPEC.md`), so publisher and verifier agree on them regardless of the key
+ *   order the wire used.
+ *
+ * The remote fetch degrades silently otherwise: a feed outage must never weaken
+ * the built-in floor or crash a connection check.
+ */
+/**
+ * Default freshness window for a signed remote feed: 24 h.
+ *
+ * Rationale for a *default* rather than an opt-in: a feed whose age is unchecked
+ * is indistinguishable from a feed that is being replayed. An operator publishing
+ * on a slower cadence should raise `warden.feedMaxAgeMs`, not disable the check.
+ *
+ * (Note the deliberate difference from AWR documents, where age is *policy, not
+ * validity* — SPEC §11.3. A work receipt from two years ago is still a true
+ * statement about the past; a deny-list from two years ago is a false statement
+ * about the present.)
+ */
+export declare const DEFAULT_FEED_MAX_AGE_MS: number;
+/**
+ * Tolerance for a feed timestamp in the future — publisher/host clock skew.
+ * Beyond it the feed is refused: a future-dated snapshot would otherwise pass the
+ * freshness check for as long as the date it claims.
+ */
+export declare const FEED_CLOCK_SKEW_MS: number;
+export interface ThreatFeedOptions {
+    /** Ed25519 public key (hex-encoded SPKI DER) of the feed publisher. */
+    feedPublicKey?: string;
+    /**
+     * Maximum age of a signed feed's `timestamp`. Defaults to
+     * {@link DEFAULT_FEED_MAX_AGE_MS}; a non-finite or non-positive value falls back
+     * to the default rather than disabling the check.
+     */
+    maxAgeMs?: number;
+    log?: WardenLogger;
+    /** Clock source. Injectable so freshness is testable without waiting a day. */
+    now?: () => number;
+}
+export declare class ThreatFeed {
+    private records;
+    private feedPublicKey?;
+    private readonly maxAgeMs;
+    private readonly now;
+    private readonly log?;
+    constructor(opts?: ThreatFeedOptions);
+    /** The built-in floor, always present regardless of remote load state. */
+    get builtins(): ThreatRecord[];
+    all(): ThreatRecord[];
+    /**
+     * Fetch and verify a signed remote threat feed.
+     *
+     * Feed format: `{ records: ThreatRecord[], timestamp: number, signature: string }`
+     * where `timestamp` is **epoch milliseconds** and `signature` is a hex-encoded
+     * Ed25519 signature over the RFC 8785 (JCS) canonical form of
+     * `{records, timestamp}` — see {@link canonicalize}. A publisher that signs
+     * `JSON.stringify` output instead will not verify here, and that is the point:
+     * `JSON.stringify` bytes depend on the key order of whatever object the
+     * publisher happened to build, so the same logical feed could be signed and then
+     * fail to verify.
+     *
+     * - Without a configured `feedPublicKey`, remote feeds are refused.
+     * - Signature failure logs a warning and preserves the built-in floor.
+     * - A missing/non-integer `timestamp`, a snapshot older than `maxAgeMs`, or one
+     *   dated further ahead than {@link FEED_CLOCK_SKEW_MS} is refused — a replayed
+     *   old snapshot would otherwise erase every newer threat record.
+     * - Network/parse errors degrade silently — built-ins remain.
+     */
+    load(feedUrl?: string): Promise<void>;
+    /**
+     * Match a server — and its advertised tool definitions — against every record.
+     * One finding per matched record per surface.
+     *
+     * Two surfaces, because a threat record about an MCP server is not only a
+     * statement about the config the user wrote:
+     *
+     * - **Server identity** (`id`, `name`, `url`, `command`, `args`): the local
+     *   config. This is the only surface a pattern matches when its `scope` is
+     *   `"server"`.
+     * - **Tool definitions** (`name`, `description`, `inputSchema`): attacker-
+     *   controlled text the *server* chose, which is where a poisoned tool actually
+     *   lives. Matched for records scoped `"any"` (the default) or `"tool"`.
+     *
+     * Findings from the tool surface carry `tool`, so `Warden.partitionTools()` can
+     * quarantine the one tool instead of attributing the match to the whole
+     * connection. The connection is still blocked when the severity reaches
+     * `policy.blockAtSeverity` — per-tool attribution narrows the *blame*, it does
+     * not soften the policy.
+     */
+    match(server: McpServerRef, tools?: ToolDef[]): WardenFinding[];
+}
+/**
+ * Gate wrapper around a ThreatFeed. Any match is disqualifying for the score; a
+ * critical-severity match against the *server's identity* short-circuits the chain
+ * (fatal), because nothing about that connection is salvageable.
+ *
+ * A critical match against a single tool definition is deliberately not fatal: it
+ * still scores 0 and still blocks under the default `blockAtSeverity`, but letting
+ * the remaining gates run means the verdict names every problem and every affected
+ * tool instead of only the first one found.
+ */
+export declare class ThreatGate implements WardenGate {
+    private readonly feed;
+    readonly name = "threat-feed";
+    constructor(feed: ThreatFeed);
+    evaluate(input: WardenGateInput): Promise<WardenGateResult>;
+}
+//# sourceMappingURL=threat-feed.d.ts.map

package/dist/threat-feed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-feed.d.ts","sourceRoot":"","sources":["../src/threat-feed.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,YAAY,EAEZ,YAAY,EAEZ,OAAO,EACP,aAAa,EACb,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,QAAsB,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAAgB,CAAC;AA+GhD,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAgC;IAC/C,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAe;gBAExB,IAAI,CAAC,EAAE,iBAAiB;IAUpC,0EAA0E;IAC1E,IAAI,QAAQ,IAAI,YAAY,EAAE,CAE7B;IAED,GAAG,IAAI,YAAY,EAAE;IAIrB;;;;;;;;;;;;;;;;;;OAkBG;IACG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgH3C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,GAAE,OAAO,EAAO,GAAG,aAAa,EAAE;CA6CpE;AAED;;;;;;;;;GASG;AACH,qBAAa,UAAW,YAAW,UAAU;IAG/B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,QAAQ,CAAC,IAAI,iBAAiB;gBAED,IAAI,EAAE,UAAU;IAEvC,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAMlE"}

package/dist/threat-feed.js

@@ -0,0 +1,457 @@
+import { verify, createPublicKey } from "node:crypto";
+import { canonicalize, parseJsonStrict, CanonicalizationError } from "./jcs.js";
+/**
+ * Threat-intel feed for known-bad MCP servers/tools.
+ *
+ * Reputation answers "is this server trusted?"; the threat feed answers "is this
+ * server a *known* bad actor?". It ships with a small built-in deny-list of
+ * patterns (credential-stealing, destructive commands, crypto-drainer keywords,
+ * typosquat-style names) and can be topped up from a signed remote feed.
+ *
+ * **In the shipping configuration there is no remote feed.** `warden.threatFeedUrl`
+ * and `warden.feedPublicKey` default to `undefined` (see `src/config.ts`), so
+ * unless an operator sets both, this gate *is* the {@link BUILTIN} list — a fixed
+ * floor of 11 patterns, not live intel. That is a deliberate default: ARGUS ships
+ * no feed endpoint and no publisher key, because a feed URL baked into the binary
+ * is a single point every install would have to trust.
+ *
+ * When a feed *is* configured, three properties are enforced fail-closed — any of
+ * them failing keeps the built-in floor and changes nothing else:
+ *
+ * - **Authenticity.** An Ed25519 signature over the canonical form of
+ *   `{records, timestamp}`, verified with a pre-configured public key. Unsigned
+ *   feeds are refused outright.
+ * - **Freshness.** The signed `timestamp` must be within {@link
+ *   DEFAULT_FEED_MAX_AGE_MS} (configurable). Without this, whoever serves the feed
+ *   URL can replay a months-old snapshot forever and silently erase every threat
+ *   record added since — a signature says *who* wrote a document, never *when you
+ *   were handed it*.
+ * - **Determinism.** The signed bytes are RFC 8785 canonical (§4 of
+ *   `awr/SPEC.md`), so publisher and verifier agree on them regardless of the key
+ *   order the wire used.
+ *
+ * The remote fetch degrades silently otherwise: a feed outage must never weaken
+ * the built-in floor or crash a connection check.
+ */
+/**
+ * Default freshness window for a signed remote feed: 24 h.
+ *
+ * Rationale for a *default* rather than an opt-in: a feed whose age is unchecked
+ * is indistinguishable from a feed that is being replayed. An operator publishing
+ * on a slower cadence should raise `warden.feedMaxAgeMs`, not disable the check.
+ *
+ * (Note the deliberate difference from AWR documents, where age is *policy, not
+ * validity* — SPEC §11.3. A work receipt from two years ago is still a true
+ * statement about the past; a deny-list from two years ago is a false statement
+ * about the present.)
+ */
+export const DEFAULT_FEED_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+/**
+ * Tolerance for a feed timestamp in the future — publisher/host clock skew.
+ * Beyond it the feed is refused: a future-dated snapshot would otherwise pass the
+ * freshness check for as long as the date it claims.
+ */
+export const FEED_CLOCK_SKEW_MS = 5 * 60 * 1000;
+/** Hard cap on a feed response body (OOM guard). */
+const MAX_FEED_BYTES = 512_000;
+/**
+ * Built-in deny-list. Small but real — patterns seen in poisoned MCP servers.
+ *
+ * `scope` says where each pattern means something (see {@link ThreatFeed.match}):
+ *
+ * - `server` for the **command-line and identity** signatures. `rm -rf`, a fork
+ *   bomb or a typosquatted name are evidence in `server.command`/`args` or in a
+ *   server's name; in prose they are as likely to be documentation as attack — a
+ *   security tool's own description may well list `offical-mcp`.
+ * - `any` for the **content** signatures. A credential path, a seed phrase or a
+ *   drainer keyword appearing in a tool name, description or input schema is
+ *   exactly the tool-poisoning shape `static-scan` also looks for, so those
+ *   patterns are matched against tool definitions as well as server identity.
+ */
+const BUILTIN = [
+    {
+        pattern: "*~/.ssh*",
+        severity: "critical",
+        code: "THREAT_SSH_KEY_READ",
+        reason: "Server references the user's SSH key directory.",
+        source: "builtin",
+        scope: "any",
+    },
+    {
+        pattern: "*id_rsa*",
+        severity: "critical",
+        code: "THREAT_SSH_KEY_READ",
+        reason: "Server references a private SSH key file.",
+        source: "builtin",
+        scope: "any",
+    },
+    {
+        pattern: "*rm -rf*",
+        severity: "critical",
+        code: "THREAT_DESTRUCTIVE_CMD",
+        reason: "Server command performs a destructive recursive delete.",
+        source: "builtin",
+        scope: "server",
+    },
+    {
+        pattern: "*:(){ :|:&};:*",
+        severity: "critical",
+        code: "THREAT_FORK_BOMB",
+        reason: "Server command contains a shell fork bomb.",
+        source: "builtin",
+        scope: "server",
+    },
+    {
+        pattern: "*drain*wallet*",
+        severity: "critical",
+        code: "THREAT_CRYPTO_DRAINER",
+        reason: "Crypto-drainer keyword in server identity.",
+        source: "builtin",
+        scope: "any",
+    },
+    {
+        pattern: "*seed*phrase*",
+        severity: "high",
+        code: "THREAT_SEED_PHRASE",
+        reason: "Server references wallet seed phrases.",
+        source: "builtin",
+        scope: "any",
+    },
+    {
+        pattern: "*sweep*funds*",
+        severity: "critical",
+        code: "THREAT_CRYPTO_DRAINER",
+        reason: "Crypto-drainer keyword in server identity.",
+        source: "builtin",
+        scope: "any",
+    },
+    {
+        pattern: "*.env*exfil*",
+        severity: "critical",
+        code: "THREAT_ENV_EXFIL",
+        reason: "Server references exfiltrating environment files.",
+        source: "builtin",
+        scope: "any",
+    },
+    // Typosquat-style names mimicking the official reference servers.
+    {
+        pattern: "*offical-mcp*",
+        severity: "high",
+        code: "THREAT_TYPOSQUAT",
+        reason: "Typosquat of an official MCP server name.",
+        source: "builtin",
+        scope: "server",
+    },
+    {
+        pattern: "*modelcontextprotocoll*",
+        severity: "high",
+        code: "THREAT_TYPOSQUAT",
+        reason: "Typosquat of modelcontextprotocol.",
+        source: "builtin",
+        scope: "server",
+    },
+    {
+        pattern: "*filesytem*",
+        severity: "medium",
+        code: "THREAT_TYPOSQUAT",
+        reason: "Typosquat of the filesystem reference server.",
+        source: "builtin",
+        scope: "server",
+    },
+];
+export class ThreatFeed {
+    records = [...BUILTIN];
+    feedPublicKey;
+    maxAgeMs;
+    now;
+    log;
+    constructor(opts) {
+        this.feedPublicKey = opts?.feedPublicKey;
+        this.maxAgeMs =
+            opts?.maxAgeMs != null && Number.isFinite(opts.maxAgeMs) && opts.maxAgeMs > 0
+                ? opts.maxAgeMs
+                : DEFAULT_FEED_MAX_AGE_MS;
+        this.now = opts?.now ?? (() => Date.now());
+        this.log = opts?.log;
+    }
+    /** The built-in floor, always present regardless of remote load state. */
+    get builtins() {
+        return [...BUILTIN];
+    }
+    all() {
+        return [...this.records];
+    }
+    /**
+     * Fetch and verify a signed remote threat feed.
+     *
+     * Feed format: `{ records: ThreatRecord[], timestamp: number, signature: string }`
+     * where `timestamp` is **epoch milliseconds** and `signature` is a hex-encoded
+     * Ed25519 signature over the RFC 8785 (JCS) canonical form of
+     * `{records, timestamp}` — see {@link canonicalize}. A publisher that signs
+     * `JSON.stringify` output instead will not verify here, and that is the point:
+     * `JSON.stringify` bytes depend on the key order of whatever object the
+     * publisher happened to build, so the same logical feed could be signed and then
+     * fail to verify.
+     *
+     * - Without a configured `feedPublicKey`, remote feeds are refused.
+     * - Signature failure logs a warning and preserves the built-in floor.
+     * - A missing/non-integer `timestamp`, a snapshot older than `maxAgeMs`, or one
+     *   dated further ahead than {@link FEED_CLOCK_SKEW_MS} is refused — a replayed
+     *   old snapshot would otherwise erase every newer threat record.
+     * - Network/parse errors degrade silently — built-ins remain.
+     */
+    async load(feedUrl) {
+        if (!feedUrl)
+            return;
+        if (!this.feedPublicKey) {
+            this.log?.warn("threat feed URL configured but no feedPublicKey set — remote feed REFUSED (unsigned feeds not allowed)");
+            return;
+        }
+        try {
+            // AbortController with a 10 s timeout — a hanging feed must not block startup.
+            const ctrl = new AbortController();
+            const timer = setTimeout(() => ctrl.abort(), 10_000);
+            const res = await fetch(feedUrl, { signal: ctrl.signal }).finally(() => clearTimeout(timer));
+            if (!res.ok) {
+                this.log?.warn(`threat feed fetch returned ${res.status} — keeping built-in floor`);
+                return;
+            }
+            // Reject oversized responses before parsing (OOM guard).
+            const cl = res.headers.get("content-length");
+            if (cl && Number(cl) > MAX_FEED_BYTES) {
+                this.log?.warn(`threat feed: content-length ${cl} exceeds ${MAX_FEED_BYTES} byte limit — rejected`);
+                return;
+            }
+            // Read text, not res.json(): the received characters are what the canonical
+            // parser needs for its duplicate-key and number-literal checks.
+            const body = await res.text();
+            if (Buffer.byteLength(body, "utf8") > MAX_FEED_BYTES) {
+                this.log?.warn(`threat feed: body exceeds the ${MAX_FEED_BYTES} byte limit (content-length absent or wrong) — rejected`);
+                return;
+            }
+            let data;
+            try {
+                data = parseJsonStrict(body);
+            }
+            catch (err) {
+                this.log?.warn(`threat feed: body rejected by the canonical JSON parser (${err.message})`);
+                return;
+            }
+            if (!data || typeof data !== "object")
+                return;
+            const pkg = data;
+            const records = pkg.records;
+            const signature = pkg.signature;
+            const timestamp = pkg.timestamp;
+            if (!Array.isArray(records) || typeof signature !== "string") {
+                this.log?.warn("threat feed: missing or invalid fields (records, signature) — rejected");
+                return;
+            }
+            // The timestamp is REQUIRED: it is what the freshness check is made of, and
+            // an optional one would mean "a feed that omits it is fresh forever".
+            if (typeof timestamp !== "number" || !Number.isInteger(timestamp)) {
+                this.log?.warn("threat feed: missing or non-integer `timestamp` (epoch ms) — rejected, freshness cannot be checked");
+                return;
+            }
+            // Ed25519 signature over the CANONICAL JSON of {records, timestamp}.
+            let payload;
+            try {
+                payload = canonicalize({ records, timestamp });
+            }
+            catch (err) {
+                const detail = err instanceof CanonicalizationError ? err.message : err.message;
+                this.log?.warn(`threat feed: payload has no canonical form (${detail}) — rejected`);
+                return;
+            }
+            const sigBuf = Buffer.from(signature, "hex");
+            let pubKey;
+            try {
+                pubKey = createPublicKey({
+                    key: Buffer.from(this.feedPublicKey, "hex"),
+                    format: "der",
+                    type: "spki",
+                });
+            }
+            catch (err) {
+                // A misconfigured key must say so out loud: silently degrading here would
+                // look exactly like "the feed had nothing new".
+                this.log?.warn(`threat feed: feedPublicKey is not a valid hex SPKI DER key (${err.message}) — feed REFUSED`);
+                return;
+            }
+            const ok = verify(null, Buffer.from(payload, "utf8"), pubKey, sigBuf);
+            if (!ok) {
+                this.log?.warn("threat feed: Ed25519 signature INVALID — feed rejected, built-in floor preserved");
+                return;
+            }
+            // Freshness is checked only now: until the signature verifies, `timestamp`
+            // is a number an attacker chose, and refusing on it would prove nothing.
+            const age = this.now() - timestamp;
+            if (age > this.maxAgeMs) {
+                this.log?.warn(`threat feed: signed snapshot is ${formatDuration(age)} old, past the ${formatDuration(this.maxAgeMs)} limit — ` +
+                    `REJECTED as stale (possible replay of a superseded feed); built-in floor preserved`);
+                return;
+            }
+            if (age < -FEED_CLOCK_SKEW_MS) {
+                this.log?.warn(`threat feed: signed snapshot is dated ${formatDuration(-age)} in the future, beyond the ` +
+                    `${formatDuration(FEED_CLOCK_SKEW_MS)} clock-skew allowance — REJECTED; built-in floor preserved`);
+                return;
+            }
+            const remote = records.filter(isThreatRecord);
+            this.records = [...BUILTIN, ...remote];
+            this.log?.info(`threat feed loaded: ${this.records.length} records (${BUILTIN.length} builtin + ${remote.length} remote, ` +
+                `signature valid, snapshot ${formatDuration(age)} old)`);
+        }
+        catch (err) {
+            // Degrade gracefully: built-ins remain in effect.
+            this.log?.debug(`threat feed load error: ${err.message}`);
+        }
+    }
+    /**
+     * Match a server — and its advertised tool definitions — against every record.
+     * One finding per matched record per surface.
+     *
+     * Two surfaces, because a threat record about an MCP server is not only a
+     * statement about the config the user wrote:
+     *
+     * - **Server identity** (`id`, `name`, `url`, `command`, `args`): the local
+     *   config. This is the only surface a pattern matches when its `scope` is
+     *   `"server"`.
+     * - **Tool definitions** (`name`, `description`, `inputSchema`): attacker-
+     *   controlled text the *server* chose, which is where a poisoned tool actually
+     *   lives. Matched for records scoped `"any"` (the default) or `"tool"`.
+     *
+     * Findings from the tool surface carry `tool`, so `Warden.partitionTools()` can
+     * quarantine the one tool instead of attributing the match to the whole
+     * connection. The connection is still blocked when the severity reaches
+     * `policy.blockAtSeverity` — per-tool attribution narrows the *blame*, it does
+     * not soften the policy.
+     */
+    match(server, tools = []) {
+        const serverHay = [
+            server.id,
+            server.name,
+            server.url ?? "",
+            server.command ?? "",
+            (server.args ?? []).join(" "),
+        ]
+            .join("\n")
+            .toLowerCase();
+        // Built once: the record loop below would otherwise re-stringify every schema.
+        const toolHays = tools.map((tool) => ({
+            name: tool.name,
+            hay: [tool.name, tool.description ?? "", stringifySchema(tool.inputSchema)].join("\n").toLowerCase(),
+        }));
+        const findings = [];
+        for (const rec of this.records) {
+            const scope = rec.scope ?? "any";
+            if (scope !== "tool" && patternMatches(rec.pattern, serverHay)) {
+                findings.push({
+                    gate: "threat-feed",
+                    severity: rec.severity,
+                    code: rec.code,
+                    message: `${rec.reason} (matched "${rec.pattern}" in server identity, source: ${rec.source})`,
+                });
+            }
+            if (scope === "server")
+                continue;
+            for (const tool of toolHays) {
+                if (patternMatches(rec.pattern, tool.hay)) {
+                    findings.push({
+                        gate: "threat-feed",
+                        severity: rec.severity,
+                        code: rec.code,
+                        message: `Tool "${tool.name}": ${rec.reason} (matched "${rec.pattern}" in the tool definition, source: ${rec.source})`,
+                        tool: tool.name,
+                    });
+                }
+            }
+        }
+        return findings;
+    }
+}
+/**
+ * Gate wrapper around a ThreatFeed. Any match is disqualifying for the score; a
+ * critical-severity match against the *server's identity* short-circuits the chain
+ * (fatal), because nothing about that connection is salvageable.
+ *
+ * A critical match against a single tool definition is deliberately not fatal: it
+ * still scores 0 and still blocks under the default `blockAtSeverity`, but letting
+ * the remaining gates run means the verdict names every problem and every affected
+ * tool instead of only the first one found.
+ */
+export class ThreatGate {
+    feed;
+    name = "threat-feed";
+    constructor(feed) {
+        this.feed = feed;
+    }
+    async evaluate(input) {
+        const findings = this.feed.match(input.server, input.tools);
+        if (findings.length === 0)
+            return { findings, score: 1 };
+        const fatal = findings.some((f) => f.severity === "critical" && !f.tool);
+        return { findings, score: 0, fatal };
+    }
+}
+/**
+ * Case-insensitive match. `*` is a wildcard (glob); a pattern with no `*` is a
+ * plain substring test. `hay` is expected to be pre-lowercased.
+ */
+function patternMatches(pattern, hay) {
+    const p = pattern.toLowerCase();
+    if (!p.includes("*"))
+        return hay.includes(p);
+    const re = globToRegExp(p);
+    return re.test(hay);
+}
+/**
+ * Translate a `*`-glob into an anchored regex, escaping all other metachars.
+ * The `s` (dotAll) flag is essential: a haystack joins several fields with
+ * newlines, and without it `.*` would not cross a newline — silently defeating
+ * every `*…*` pattern. (Regression-tested in test/warden.test.ts.)
+ */
+function globToRegExp(glob) {
+    const escaped = glob
+        .split("*")
+        .map((seg) => seg.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+        .join(".*");
+    return new RegExp(`^${escaped}$`, "is");
+}
+/**
+ * Flatten a tool's input schema for pattern matching only. Key order is
+ * irrelevant here (a glob over a lowercased blob), so plain `JSON.stringify` is
+ * the right tool — unlike the signed and hashed paths, which need
+ * {@link canonicalize}.
+ */
+function stringifySchema(schema) {
+    try {
+        return JSON.stringify(schema) ?? "";
+    }
+    catch {
+        return String(schema ?? "");
+    }
+}
+/** Human-readable duration for log lines: minutes under an hour, else hours. */
+function formatDuration(ms) {
+    const minutes = Math.round(ms / 60_000);
+    if (Math.abs(minutes) < 60)
+        return `${minutes} min`;
+    return `${Math.round(ms / 360_000) / 10} h`;
+}
+const THREAT_SCOPES = ["server", "tool", "any"];
+function isThreatRecord(v) {
+    if (!v || typeof v !== "object")
+        return false;
+    const r = v;
+    const severities = ["info", "low", "medium", "high", "critical"];
+    return (typeof r.pattern === "string" && r.pattern.length > 0 && r.pattern.length <= 2000 &&
+        typeof r.code === "string" && r.code.length > 0 && r.code.length <= 200 &&
+        typeof r.reason === "string" && r.reason.length > 0 && r.reason.length <= 2000 &&
+        typeof r.source === "string" && r.source.length > 0 && r.source.length <= 200 &&
+        typeof r.severity === "string" &&
+        severities.includes(r.severity) &&
+        // An unrecognised scope drops the record instead of defaulting it: a publisher
+        // that meant "server" must not have its pattern silently widened to tool text.
+        (r.scope === undefined || (typeof r.scope === "string" && THREAT_SCOPES.includes(r.scope))));
+}
+//# sourceMappingURL=threat-feed.js.map

package/dist/threat-feed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-feed.js","sourceRoot":"","sources":["../src/threat-feed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAchF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,oDAAoD;AACpD,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,GAAmB;IAC9B;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,iDAAiD;QACzD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,2CAA2C;QACnD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,yDAAyD;QACjE,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,4CAA4C;QACpD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,4CAA4C;QACpD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD;QACE,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,wCAAwC;QAChD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD;QACE,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,4CAA4C;QACpD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD;QACE,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,mDAAmD;QAC3D,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD,kEAAkE;IAClE;QACE,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,2CAA2C;QACnD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,oCAAoC;QAC5C,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,+CAA+C;QACvD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ;KAChB;CACF,CAAC;AAgBF,MAAM,OAAO,UAAU;IACb,OAAO,GAAmB,CAAC,GAAG,OAAO,CAAC,CAAC;IACvC,aAAa,CAAU;IACd,QAAQ,CAAS;IACjB,GAAG,CAAe;IAClB,GAAG,CAAgB;IAEpC,YAAY,IAAwB;QAClC,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,aAAa,CAAC;QACzC,IAAI,CAAC,QAAQ;YACX,IAAI,EAAE,QAAQ,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC;gBAC3E,CAAC,CAAC,IAAI,CAAC,QAAQ;gBACf,CAAC,CAAC,uBAAuB,CAAC;QAC9B,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC;IACvB,CAAC;IAED,0EAA0E;IAC1E,IAAI,QAAQ;QACV,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,IAAI,CAAC,OAAgB;QACzB,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,wGAAwG,CAAC,CAAC;YACzH,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,+EAA+E;YAC/E,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7F,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,8BAA8B,GAAG,CAAC,MAAM,2BAA2B,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,yDAAyD;YACzD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC7C,IAAI,EAAE,IAAI,MAAM,CAAC,EAAE,CAAC,GAAG,cAAc,EAAE,CAAC;gBACtC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,+BAA+B,EAAE,YAAY,cAAc,wBAAwB,CAAC,CAAC;gBACpG,OAAO;YACT,CAAC;YACD,4EAA4E;YAC5E,gEAAgE;YAChE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;gBACrD,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,iCAAiC,cAAc,yDAAyD,CAAC,CAAC;gBACzH,OAAO;YACT,CAAC;YAED,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,4DAA6D,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;gBACtG,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO;YAC9C,MAAM,GAAG,GAAG,IAA+B,CAAC;YAE5C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;YAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC7D,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,wEAAwE,CAAC,CAAC;gBACzF,OAAO;YACT,CAAC;YACD,4EAA4E;YAC5E,sEAAsE;YACtE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,oGAAoG,CAAC,CAAC;gBACrH,OAAO;YACT,CAAC;YAED,qEAAqE;YACrE,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,GAAG,YAAY,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,GAAa,CAAC,OAAO,CAAC;gBAC3F,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,+CAA+C,MAAM,cAAc,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,eAAe,CAAC;oBACvB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC;oBAC3C,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,MAAM;iBACb,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,gDAAgD;gBAChD,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,+DAAgE,GAAa,CAAC,OAAO,kBAAkB,CAAC,CAAC;gBACxH,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACtE,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,kFAAkF,CAAC,CAAC;gBACnG,OAAO;YACT,CAAC;YAED,2EAA2E;YAC3E,yEAAyE;YACzE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACnC,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,GAAG,EAAE,IAAI,CACZ,mCAAmC,cAAc,CAAC,GAAG,CAAC,kBAAkB,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW;oBAC9G,oFAAoF,CACvF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,GAAG,GAAG,CAAC,kBAAkB,EAAE,CAAC;gBAC9B,IAAI,CAAC,GAAG,EAAE,IAAI,CACZ,yCAAyC,cAAc,CAAC,CAAC,GAAG,CAAC,6BAA6B;oBACxF,GAAG,cAAc,CAAC,kBAAkB,CAAC,4DAA4D,CACpG,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,GAAG,EAAE,IAAI,CACZ,uBAAuB,IAAI,CAAC,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,WAAW;gBACzG,6BAA6B,cAAc,CAAC,GAAG,CAAC,OAAO,CAC1D,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kDAAkD;YAClD,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,2BAA4B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,MAAoB,EAAE,QAAmB,EAAE;QAC/C,MAAM,SAAS,GAAG;YAChB,MAAM,CAAC,EAAE;YACT,MAAM,CAAC,IAAI;YACX,MAAM,CAAC,GAAG,IAAI,EAAE;YAChB,MAAM,CAAC,OAAO,IAAI,EAAE;YACpB,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SAC9B;aACE,IAAI,CAAC,IAAI,CAAC;aACV,WAAW,EAAE,CAAC;QAEjB,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;SACrG,CAAC,CAAC,CAAC;QAEJ,MAAM,QAAQ,GAAoB,EAAE,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAgB,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC;YAE9C,IAAI,KAAK,KAAK,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC/D,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,iCAAiC,GAAG,CAAC,MAAM,GAAG;iBAC9F,CAAC,CAAC;YACL,CAAC;YAED,IAAI,KAAK,KAAK,QAAQ;gBAAE,SAAS;YACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1C,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,aAAa;wBACnB,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,qCAAqC,GAAG,CAAC,MAAM,GAAG;wBACtH,IAAI,EAAE,IAAI,CAAC,IAAI;qBAChB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,UAAU;IAGQ;IAFpB,IAAI,GAAG,aAAa,CAAC;IAE9B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,QAAQ,CAAC,KAAsB;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,GAAW;IAClD,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;SACxD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,cAAc,CAAC,EAAU;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,OAAO,MAAM,CAAC;IACpD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,aAAa,GAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/D,SAAS,cAAc,CAAC,CAAU;IAChC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,MAAM,UAAU,GAAe,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7E,OAAO,CACL,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI;QACjF,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG;QACvE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI;QAC9E,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG;QAC7E,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAoB,CAAC;QAC3C,+EAA+E;QAC/E,+EAA+E;QAC/E,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAoB,CAAC,CAAC,CAAC,CAC3G,CAAC;AACJ,CAAC"}