@aimarket/warden 0.0.1 → 0.4.0

package/dist/glob.js

@@ -0,0 +1,180 @@
+/**
+ * `*`-glob matching, without a regular expression.
+ *
+ * WARDEN matches two kinds of glob against attacker-controlled text: threat-feed
+ * patterns (a signed publisher chooses the pattern, a hostile server chooses the
+ * haystack) and `policy.sensitiveToolPatterns` (the operator chooses the pattern,
+ * the server chooses the tool name). Both used to compile `*` into `.*` and run a
+ * regex, which is a denial of service:
+ *
+ *     pattern  "*a*a*a*a*a*a*a*a*a*a*a*a*a*a*zzz"   (32 characters)
+ *     haystack "aaaa..."                            (220 characters)
+ *     -> 112 SECONDS inside one RegExp.test
+ *
+ * The engine has to try every way of distributing the wildcards over the haystack
+ * before it can conclude "no match" - exponential in the number of `*`. That
+ * mattered more than an ordinary performance bug: the threat feed's whole trust
+ * story is that a compromised publisher can only ever ADD protection, never
+ * remove it, and a record that hangs `vet()` forever removes all of it. The same
+ * shape let a hostile server freeze the agent inspecting it, by advertising a
+ * long enough tool name against an operator's own `*a*b*c*` pattern.
+ *
+ * The two-pointer algorithm below is the standard wildcard matcher: it walks the
+ * haystack once and remembers only the most recent `*` to fall back to, so the
+ * work is bounded by `pattern.length x value.length` with no backtracking tree to
+ * explode. The same 32/220 case returns in microseconds.
+ *
+ * Semantics, matching what the regex did: `*` matches any run of zero or more
+ * UTF-16 code units (including newlines - the old regex needed the `s` flag for
+ * that), every other character is literal, and the match is anchored at both
+ * ends. Case folding is the caller's job: both sides arrive already lowercased.
+ */
+export function wildcardMatch(pattern, value) {
+    const STAR = 0x2a;
+    let p = 0;
+    let v = 0;
+    let star = -1;
+    let resume = 0;
+    while (v < value.length) {
+        if (p < pattern.length && pattern.charCodeAt(p) === value.charCodeAt(v)) {
+            p++;
+            v++;
+        }
+        else if (p < pattern.length && pattern.charCodeAt(p) === STAR) {
+            // Remember this wildcard and let it match nothing for now.
+            star = p++;
+            resume = v;
+        }
+        else if (star >= 0) {
+            // Backtrack: hand one more character to the last wildcard. There is only
+            // ever one fallback point, which is what keeps this linear-bounded.
+            p = star + 1;
+            v = ++resume;
+        }
+        else {
+            return false;
+        }
+    }
+    // Trailing wildcards may still match the empty remainder.
+    while (p < pattern.length && pattern.charCodeAt(p) === STAR)
+        p++;
+    return p === pattern.length;
+}
+/**
+ * How many wildcards a pattern may carry.
+ *
+ * The matcher above is not exponential, but `*`-heavy patterns still cost
+ * `pattern x value` per match and buy nothing: a real threat pattern names a
+ * command, a path or a keyword. A record with more than this many wildcards is
+ * refused rather than run - refusing an *addition* to the deny-list is the safe
+ * direction, and it is reported loudly.
+ */
+export const MAX_GLOB_WILDCARDS = 12;
+/** Count `*` in a pattern, for the record validator. */
+export function countWildcards(pattern) {
+    let n = 0;
+    for (let i = 0; i < pattern.length; i++) {
+        if (pattern.charCodeAt(i) === 0x2a)
+            n++;
+    }
+    return n;
+}
+/**
+ * Largest gap an INTERIOR `*` in a threat pattern may span.
+ *
+ * A field survey of 1 108 public MCP servers (see docs/mcp-survey.md) found every
+ * multi-segment built-in firing on unrelated words that merely happened to appear
+ * in the same paragraph: `*drain*wallet*` matched an anti-drainer scanner because
+ * it says "drainer" in one clause and "wallet" in another, and `*seed*phrase*`
+ * matched "for a **seed** topic, returns suggested search **phrases**". A real
+ * threat pattern names something whose parts sit next to each other; 24 characters
+ * is roughly "a few words apart" and comfortably covers "wallet seed or recovery
+ * phrase".
+ */
+export const THREAT_MAX_GAP = 24;
+/**
+ * Threat-pattern matching: `wildcardMatch` plus two constraints that only make
+ * sense for a deny-list.
+ *
+ * 1. **Interior gaps are bounded** to {@link THREAT_MAX_GAP}. Leading and trailing
+ *    `*` stay unbounded — `*id_rsa*` must still find `id_rsa` anywhere.
+ * 2. **A segment that starts with a word character must start at a word boundary.**
+ *    `*sweep*funds*` matched an ENS floor-sweeping tool because `funds` sits inside
+ *    "re**funds**". Only the START is anchored: a pattern author writing `*drain*`
+ *    means "drainer" too, so anchoring the end as well would break ordinary
+ *    stemming.
+ *
+ * Kept separate from {@link wildcardMatch} on purpose. That function is also what
+ * `policy.sensitiveToolPatterns` runs on, where the operator wrote the pattern
+ * against their own tool names and plain glob semantics are what they expect.
+ *
+ * Completeness matters here in a way it does not for a display filter: a missed
+ * match is a deny-list entry that silently stopped working. So this explores every
+ * reachable position per segment (deduplicated, so the work stays bounded by
+ * `segments x value.length`) rather than taking the leftmost occurrence greedily,
+ * which would report "no match" for a pattern that does match further along.
+ */
+export function threatMatch(pattern, value) {
+    if (!pattern.includes("*"))
+        return value.includes(pattern);
+    const parts = pattern.split("*");
+    const openStart = parts[0] === "";
+    const openEnd = parts[parts.length - 1] === "";
+    const segments = parts.filter((s) => s !== "");
+    if (segments.length === 0)
+        return true;
+    // Reachable end positions after matching the segments consumed so far.
+    let ends = [0];
+    for (let i = 0; i < segments.length; i++) {
+        const seg = segments[i];
+        // The first segment is anchored at 0 unless the pattern opened with `*`.
+        const unbounded = i === 0 ? openStart : false;
+        const next = new Set();
+        for (const from of ends) {
+            const limit = unbounded ? value.length : Math.min(value.length, from + THREAT_MAX_GAP + seg.length);
+            let at = from;
+            for (;;) {
+                const found = value.indexOf(seg, at);
+                if (found < 0 || found + seg.length > limit)
+                    break;
+                if (i === 0 && !openStart && found !== 0)
+                    break;
+                if (startsOnBoundary(seg, value, found))
+                    next.add(found + seg.length);
+                at = found + 1;
+            }
+        }
+        if (next.size === 0)
+            return false;
+        ends = [...next];
+    }
+    return openEnd || ends.some((e) => e === value.length);
+}
+/**
+ * Is `seg` at `at` starting on a word boundary?
+ *
+ * Only asked when the segment's own first character is a word character — a
+ * pattern starting with `~`, `.` or `/` has no boundary to respect.
+ */
+function startsOnBoundary(seg, value, at) {
+    if (!isWordChar(seg.charCodeAt(0)))
+        return true;
+    if (at === 0)
+        return true;
+    return !isWordChar(value.charCodeAt(at - 1));
+}
+/**
+ * Letters and digits only — `_` and `-` are BOUNDARIES here, not word characters.
+ *
+ * Tool schemas are written in snake_case and kebab-case, so a field named
+ * `seed_phrase` must still satisfy `*seed*phrase*`; treating `_` as a word
+ * character silently switched that built-in off. "re**funds**" is still rejected,
+ * because there the preceding character is a letter.
+ */
+function isWordChar(c) {
+    return ((c >= 0x30 && c <= 0x39) || // 0-9
+        (c >= 0x41 && c <= 0x5a) || // A-Z
+        (c >= 0x61 && c <= 0x7a) // a-z
+    );
+}
+//# sourceMappingURL=glob.js.map

package/dist/glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.js","sourceRoot":"","sources":["../src/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,KAAa;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC;IAClB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChE,2DAA2D;YAC3D,IAAI,GAAG,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACrB,yEAAyE;YACzE,oEAAoE;YACpE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;YACb,CAAC,GAAG,EAAE,MAAM,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,CAAC,EAAE,CAAC;IACjE,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,wDAAwD;AACxD,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,CAAC,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,KAAa;IACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,uEAAuE;IACvE,IAAI,IAAI,GAAa,CAAC,CAAC,CAAC,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QACzB,yEAAyE;QACzE,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,GAAG,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;YACpG,IAAI,EAAE,GAAG,IAAI,CAAC;YACd,SAAS,CAAC;gBACR,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACrC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,KAAK;oBAAE,MAAM;gBACnD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,KAAK,CAAC;oBAAE,MAAM;gBAChD,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;gBACtE,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,KAAa,EAAE,EAAU;IAC9D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CACL,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,MAAM;QAClC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,MAAM;QAClC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM;KAChC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,106 @@
+import type { McpServerRef, PinStore, ToolDef, WardenGate, WardenLogger, WardenPolicy, WardenVerdict } from "./types.js";
+import { ThreatFeed } from "./threat-feed.js";
+export { StaticScanGate, staticScanRuleset, staticScanRulesetRef, STATIC_SCAN_RULESET_VERSION, } from "./static-scan.js";
+export { PinningGate, canonicalToolsHash, tryCanonicalToolsHash, serverIdentityHash, UNCANONICAL_TOOLS_HASH } from "./pinning.js";
+export { OriginGate } from "./origin.js";
+export { ThreatFeed, ThreatGate, DEFAULT_FEED_MAX_AGE_MS, FEED_CLOCK_SKEW_MS } from "./threat-feed.js";
+export { EgressGuard, isSensitiveTool, classifyTools } from "./sandbox.js";
+export { canonicalize, parseJsonStrict, CanonicalizationError, MAX_SAFE_JSON_INTEGER } from "./jcs.js";
+export type { CanonicalizationCode } from "./jcs.js";
+export type { StaticScanRule, StaticScanRuleset } from "./static-scan.js";
+export type { ThreatFeedOptions } from "./threat-feed.js";
+export { silentLogger } from "./logger.js";
+export { displaySafe, DEFAULT_DISPLAY_MAX } from "./sanitize.js";
+export { wildcardMatch } from "./glob.js";
+export * from "./types.js";
+export interface WardenInit {
+    gates: WardenGate[];
+    policy: WardenPolicy;
+    /** Where decisions are reported. Defaults to `silentLogger()`. */
+    log?: WardenLogger;
+}
+export interface WardenCreateDeps {
+    store: PinStore;
+    policy: WardenPolicy;
+    /**
+     * The known-bad feed. Required, not defaulted: a `ThreatFeed` the host never
+     * loaded still carries the built-in floor, but silently constructing one here
+     * would hide from the host that no external intel is in play.
+     */
+    threatFeed: ThreatFeed;
+    log?: WardenLogger;
+}
+/**
+ * WARDEN — the MCP security firewall.
+ *
+ * Every MCP server is vetted through an ordered gate chain before its tools are
+ * exposed to the agent: cheap static scanning first, then the known-bad threat
+ * feed, then origin (declared by the operator, or offered by a remote catalog),
+ * then drift/pinning. Findings accumulate across gates; the verdict is allow/block
+ * plus a composite 0..1 safety score and a per-tool partition so a mostly-trusted
+ * server can have one poisoned tool quarantined without severing the whole
+ * connection.
+ *
+ * The score is WARDEN's OWN — the product of what each gate contributed, computed
+ * from local facts. No reputation oracle is consulted and no socket is opened while
+ * vetting. Slot three used to be a reputation gate that asked an oracle for a score
+ * it had no data to compute; it is gone, and test/no-phantom-gate.test.ts fails if
+ * anything like it comes back.
+ */
+export declare class Warden {
+    private readonly gates;
+    private readonly policy;
+    private readonly log;
+    constructor(init: WardenInit);
+    /**
+     * Guard against config typos that silently disable blocking, on a COPY.
+     *
+     * If `blockAtSeverity` isn't a valid Severity key, `SEVERITY_RANK[bad]` is
+     * undefined and every comparison `number >= undefined` is false — zero blocks,
+     * zero warnings — so the value is repaired. Repairing it in place used to write
+     * into the host's own policy object, which is both a surprise (their config
+     * silently changes under them, and any other Warden sharing the object sees it)
+     * and a crash: `Object.freeze(policy)` is a reasonable thing for a host to do,
+     * and assigning to a frozen property throws a TypeError out of the constructor
+     * under ESM strict mode. A firewall that refuses to be constructed because the
+     * config was immutable is not a firewall.
+     */
+    private normalizePolicy;
+    /** Build the standard gate chain: static → threat → origin → pinning. */
+    static create(deps: WardenCreateDeps): Warden;
+    /**
+     * Vet a server and its advertised tools. Runs every gate in order, short-
+     * circuiting only on a fatal gate result. A connection is blocked if any gate
+     * is fatal or any finding reaches policy.blockAtSeverity.
+     */
+    vet(server: McpServerRef, tools: ToolDef[]): Promise<WardenVerdict>;
+    /**
+     * Run one gate, converting a thrown error into a blocking finding.
+     *
+     * A gate that crashed did not clear the server, so the honest result is a
+     * finding at `high` with a zero score — which blocks at the default threshold
+     * and, under a report-only policy (`blockAtSeverity: "critical"`), is reported
+     * without blocking, exactly like every other high-severity finding.
+     *
+     * Letting the exception escape instead was worse than it looks: `vet()`
+     * rejected, so the host got no verdict at all — not the findings the earlier
+     * gates had already produced, not the per-tool partition — and whether that
+     * ended in a blocked connection or an unhandled rejection was up to the host.
+     * A store with a full disk or a custom gate with a bug should not be able to
+     * decide that.
+     */
+    private runGate;
+    /**
+     * Record the user's approval: pin the current tool defs so future drift is
+     * detected. Idempotent — re-approving just refreshes the snapshot.
+     */
+    approve(server: McpServerRef, tools: ToolDef[]): Promise<void>;
+    /**
+     * A tool is blocked if a finding naming it reaches the block threshold.
+     * Sensitive tools (per policy) stay allowed but are surfaced as flagged so the
+     * agent loop can demand per-call approval at run time.
+     */
+    private partitionTools;
+    private sensitiveCount;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,QAAQ,EAER,OAAO,EAEP,UAAU,EAEV,YAAY,EACZ,YAAY,EACZ,aAAa,EACd,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,UAAU,EAAc,MAAM,kBAAkB,CAAC;AAK1D,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAClI,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACvG,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACrD,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,cAAc,YAAY,CAAC;AAU3B,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,kEAAkE;IAClE,GAAG,CAAC,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,QAAQ,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,UAAU,EAAE,UAAU,CAAC;IACvB,GAAG,CAAC,EAAE,YAAY,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE,UAAU;IAM5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,eAAe;IAWvB,yEAAyE;IACzE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM;IAU7C;;;;OAIG;IACG,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAqDzE;;;;;;;;;;;;;;OAcG;YACW,OAAO;IAiCrB;;;OAGG;IACG,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpE;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,cAAc;CAGvB"}

package/dist/index.js

@@ -0,0 +1,218 @@
+import { StaticScanGate, staticScanRulesetRef } from "./static-scan.js";
+import { PinningGate } from "./pinning.js";
+import { OriginGate } from "./origin.js";
+import { ThreatGate } from "./threat-feed.js";
+import { classifyTools } from "./sandbox.js";
+import { silentLogger } from "./logger.js";
+import { displaySafe } from "./sanitize.js";
+export { StaticScanGate, staticScanRuleset, staticScanRulesetRef, STATIC_SCAN_RULESET_VERSION, } from "./static-scan.js";
+export { PinningGate, canonicalToolsHash, tryCanonicalToolsHash, serverIdentityHash, UNCANONICAL_TOOLS_HASH } from "./pinning.js";
+export { OriginGate } from "./origin.js";
+export { ThreatFeed, ThreatGate, DEFAULT_FEED_MAX_AGE_MS, FEED_CLOCK_SKEW_MS } from "./threat-feed.js";
+export { EgressGuard, isSensitiveTool, classifyTools } from "./sandbox.js";
+export { canonicalize, parseJsonStrict, CanonicalizationError, MAX_SAFE_JSON_INTEGER } from "./jcs.js";
+export { silentLogger } from "./logger.js";
+export { displaySafe, DEFAULT_DISPLAY_MAX } from "./sanitize.js";
+export { wildcardMatch } from "./glob.js";
+export * from "./types.js";
+const SEVERITY_RANK = {
+    info: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+/**
+ * WARDEN — the MCP security firewall.
+ *
+ * Every MCP server is vetted through an ordered gate chain before its tools are
+ * exposed to the agent: cheap static scanning first, then the known-bad threat
+ * feed, then origin (declared by the operator, or offered by a remote catalog),
+ * then drift/pinning. Findings accumulate across gates; the verdict is allow/block
+ * plus a composite 0..1 safety score and a per-tool partition so a mostly-trusted
+ * server can have one poisoned tool quarantined without severing the whole
+ * connection.
+ *
+ * The score is WARDEN's OWN — the product of what each gate contributed, computed
+ * from local facts. No reputation oracle is consulted and no socket is opened while
+ * vetting. Slot three used to be a reputation gate that asked an oracle for a score
+ * it had no data to compute; it is gone, and test/no-phantom-gate.test.ts fails if
+ * anything like it comes back.
+ */
+export class Warden {
+    gates;
+    policy;
+    log;
+    constructor(init) {
+        this.gates = [...init.gates];
+        this.log = (init.log ?? silentLogger()).child("warden");
+        this.policy = this.normalizePolicy(init.policy);
+    }
+    /**
+     * Guard against config typos that silently disable blocking, on a COPY.
+     *
+     * If `blockAtSeverity` isn't a valid Severity key, `SEVERITY_RANK[bad]` is
+     * undefined and every comparison `number >= undefined` is false — zero blocks,
+     * zero warnings — so the value is repaired. Repairing it in place used to write
+     * into the host's own policy object, which is both a surprise (their config
+     * silently changes under them, and any other Warden sharing the object sees it)
+     * and a crash: `Object.freeze(policy)` is a reasonable thing for a host to do,
+     * and assigning to a frozen property throws a TypeError out of the constructor
+     * under ESM strict mode. A firewall that refuses to be constructed because the
+     * config was immutable is not a firewall.
+     */
+    normalizePolicy(policy) {
+        const valid = ["info", "low", "medium", "high", "critical"];
+        if (valid.includes(policy.blockAtSeverity))
+            return { ...policy };
+        const fallback = "high";
+        this.log.warn(`WARDEN: invalid blockAtSeverity "${displaySafe(policy.blockAtSeverity, 40)}" ` +
+            `(expected one of ${valid.join(", ")}) — falling back to "${fallback}" to keep blocking enabled`);
+        return { ...policy, blockAtSeverity: fallback };
+    }
+    /** Build the standard gate chain: static → threat → origin → pinning. */
+    static create(deps) {
+        const gates = [
+            new StaticScanGate(deps.log),
+            new ThreatGate(deps.threatFeed),
+            new OriginGate(),
+            new PinningGate(deps.store),
+        ];
+        return new Warden({ gates, policy: deps.policy, log: deps.log });
+    }
+    /**
+     * Vet a server and its advertised tools. Runs every gate in order, short-
+     * circuiting only on a fatal gate result. A connection is blocked if any gate
+     * is fatal or any finding reaches policy.blockAtSeverity.
+     */
+    async vet(server, tools) {
+        const findings = [];
+        const scores = [];
+        let allow = true;
+        let decidedBy;
+        const blockThreshold = SEVERITY_RANK[this.policy.blockAtSeverity];
+        for (const gate of this.gates) {
+            const result = await this.runGate(gate, server, tools, findings);
+            findings.push(...result.findings);
+            scores.push(clamp01(result.score));
+            // Advisory findings never block, at any threshold — see WardenFinding.advisory.
+            const tripped = result.findings.some((f) => !f.advisory && SEVERITY_RANK[f.severity] >= blockThreshold);
+            if (result.fatal || tripped) {
+                if (allow) {
+                    allow = false;
+                    decidedBy = gate.name;
+                }
+                if (result.fatal) {
+                    this.log.warn(`gate "${displaySafe(gate.name, 60)}" returned fatal for server ${displaySafe(server.id)}`);
+                    break; // short-circuit only on an explicit fatal
+                }
+            }
+        }
+        // Composite score: product of gate contributions (one bad gate drags it down).
+        const score = scores.reduce((acc, s) => acc * s, 1);
+        const { allowedTools, blockedTools } = this.partitionTools(tools, findings, blockThreshold);
+        if (!allow) {
+            this.log.warn(`BLOCK ${displaySafe(server.id)} (decidedBy=${displaySafe(decidedBy ?? "-", 60)}, ` +
+                `score=${score.toFixed(3)}, findings=${findings.length})`);
+        }
+        else {
+            this.log.info(`ALLOW ${displaySafe(server.id)} (score=${score.toFixed(3)}, sensitive=${blockedTools.length === 0 ? this.sensitiveCount(tools) : "?"})`);
+        }
+        return {
+            allow,
+            score: clamp01(score),
+            decidedBy,
+            findings,
+            allowedTools,
+            blockedTools,
+            rulesets: { staticScan: staticScanRulesetRef() },
+        };
+    }
+    /**
+     * Run one gate, converting a thrown error into a blocking finding.
+     *
+     * A gate that crashed did not clear the server, so the honest result is a
+     * finding at `high` with a zero score — which blocks at the default threshold
+     * and, under a report-only policy (`blockAtSeverity: "critical"`), is reported
+     * without blocking, exactly like every other high-severity finding.
+     *
+     * Letting the exception escape instead was worse than it looks: `vet()`
+     * rejected, so the host got no verdict at all — not the findings the earlier
+     * gates had already produced, not the per-tool partition — and whether that
+     * ended in a blocked connection or an unhandled rejection was up to the host.
+     * A store with a full disk or a custom gate with a bug should not be able to
+     * decide that.
+     */
+    async runGate(gate, server, tools, prior) {
+        try {
+            const result = await gate.evaluate({ server, tools, prior: [...prior], policy: this.policy });
+            // A third-party gate is not obliged to be well-behaved either.
+            return {
+                findings: Array.isArray(result?.findings) ? result.findings : [],
+                score: typeof result?.score === "number" ? result.score : 0,
+                ...(result?.fatal ? { fatal: true } : {}),
+            };
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            this.log.error(`gate "${displaySafe(gate.name, 60)}" threw: ${displaySafe(detail, 300)}`);
+            return {
+                findings: [
+                    {
+                        gate: gate.name,
+                        severity: "high",
+                        code: "GATE_ERROR",
+                        message: `Gate "${displaySafe(gate.name, 60)}" failed to complete (${displaySafe(detail, 300)}), so this ` +
+                            `server was not checked by it.`,
+                    },
+                ],
+                score: 0,
+            };
+        }
+    }
+    /**
+     * Record the user's approval: pin the current tool defs so future drift is
+     * detected. Idempotent — re-approving just refreshes the snapshot.
+     */
+    async approve(server, tools) {
+        const pinning = this.gates.find((g) => g instanceof PinningGate);
+        if (!pinning) {
+            this.log.warn("approve() called but no PinningGate in the chain; nothing to pin");
+            return;
+        }
+        await pinning.pin(server, tools);
+        this.log.info(`pinned tool defs for ${displaySafe(server.id)} (${tools.length} tools)`);
+    }
+    /**
+     * A tool is blocked if a finding naming it reaches the block threshold.
+     * Sensitive tools (per policy) stay allowed but are surfaced as flagged so the
+     * agent loop can demand per-call approval at run time.
+     */
+    partitionTools(tools, findings, blockThreshold) {
+        const blockedByFinding = new Set();
+        for (const f of findings) {
+            if (f.advisory)
+                continue; // report-only, never costs a tool
+            if (f.tool && SEVERITY_RANK[f.severity] >= blockThreshold)
+                blockedByFinding.add(f.tool);
+        }
+        const allowedTools = [];
+        const blockedTools = [];
+        for (const tool of tools) {
+            if (blockedByFinding.has(tool.name))
+                blockedTools.push(tool.name);
+            else
+                allowedTools.push(tool.name);
+        }
+        return { allowedTools, blockedTools };
+    }
+    sensitiveCount(tools) {
+        return classifyTools(tools, this.policy).sensitive.length;
+    }
+}
+function clamp01(n) {
+    if (!Number.isFinite(n))
+        return 0;
+    return Math.max(0, Math.min(1, n));
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAc,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAClI,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAIvG,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,cAAc,YAAY,CAAC;AAE3B,MAAM,aAAa,GAA6B;IAC9C,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAqBF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,MAAM;IACA,KAAK,CAAe;IACpB,MAAM,CAAe;IACrB,GAAG,CAAe;IAEnC,YAAY,IAAgB;QAC1B,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,eAAe,CAAC,MAAoB;QAC1C,MAAM,KAAK,GAAe,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAa,MAAM,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,IAAI,CACX,oCAAoC,WAAW,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC,IAAI;YAC/E,oBAAoB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,QAAQ,4BAA4B,CACjG,CAAC;QACF,OAAO,EAAE,GAAG,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,MAAM,CAAC,IAAsB;QAClC,MAAM,KAAK,GAAiB;YAC1B,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;YAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAC/B,IAAI,UAAU,EAAE;YAChB,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;SAC5B,CAAC;QACF,OAAO,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,MAAoB,EAAE,KAAgB;QAC9C,MAAM,QAAQ,GAAoB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,IAAI,SAA6B,CAAC;QAClC,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAElE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAEnC,gFAAgF;YAChF,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,cAAc,CAClE,CAAC;YACF,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,KAAK,EAAE,CAAC;oBACV,KAAK,GAAG,KAAK,CAAC;oBACd,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC;gBACxB,CAAC;gBACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,+BAA+B,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;oBAC1G,MAAM,CAAC,0CAA0C;gBACnD,CAAC;YACH,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAEpD,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QAE5F,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,IAAI,CACX,SAAS,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,WAAW,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI;gBACjF,SAAS,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,MAAM,GAAG,CAC5D,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAC1J,CAAC;QAED,OAAO;YACL,KAAK;YACL,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;YACrB,SAAS;YACT,QAAQ;YACR,YAAY;YACZ,YAAY;YACZ,QAAQ,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE,EAAE;SACjD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,OAAO,CACnB,IAAgB,EAChB,MAAoB,EACpB,KAAgB,EAChB,KAAsB;QAEtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9F,+DAA+D;YAC/D,OAAO;gBACL,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;gBAChE,KAAK,EAAE,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3D,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1F,OAAO;gBACL,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,MAAM;wBAChB,IAAI,EAAE,YAAY;wBAClB,OAAO,EACL,SAAS,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa;4BACjG,+BAA+B;qBAClC;iBACF;gBACD,KAAK,EAAE,CAAC;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAoB,EAAE,KAAgB;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,YAAY,WAAW,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IACK,cAAc,CACpB,KAAgB,EAChB,QAAyB,EACzB,cAAsB;QAEtB,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,QAAQ;gBAAE,SAAS,CAAC,kCAAkC;YAC5D,IAAI,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,cAAc;gBAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBAC7D,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;IACxC,CAAC;IAEO,cAAc,CAAC,KAAgB;QACrC,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IAC5D,CAAC;CACF;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC"}

package/dist/jcs.d.ts

@@ -0,0 +1,86 @@
+/**
+ * RFC 8785 (JSON Canonicalization Scheme) as profiled by AWR/2 (`awr/SPEC.md` §4).
+ *
+ * Two places in WARDEN turn a JSON value into bytes that a *different*
+ * implementation has to reproduce exactly: the signed threat feed (a publisher
+ * signs, ARGUS verifies) and the tool-def pin (a sha256 quoted in receipts and
+ * re-checked by `argus verify`). `JSON.stringify` cannot do that job — its output
+ * depends on the key order the wire happened to use, so one logical document
+ * serialises to different bytes on the two sides and the signature fails for no
+ * security reason at all.
+ *
+ * The profile implemented here, rule by rule:
+ *
+ * 1. **Property names sort as arrays of UTF-16 code units** (RFC 8785 §3.2.3).
+ *    JavaScript's default `Array.prototype.sort()` on strings compares exactly
+ *    that, so this is the one rule the platform gives away for free.
+ *    `String.prototype.localeCompare` does *not*: it depends on the host locale
+ *    and ICU version, which makes it unusable as a digest input.
+ * 2. **No Unicode normalization, ever** (SPEC §4.1 item 2). NFC would collide two
+ *    property names that RFC 8785 keeps distinct.
+ * 3. **Two-character escapes plus lowercase `\uXXXX` for the remaining C0
+ *    controls** (§3.2.2.2) — which is precisely what `JSON.stringify` emits for a
+ *    string, so string bodies are delegated to it rather than re-implemented.
+ * 4. **Lone surrogates terminate with an error** instead of being substituted
+ *    (§4.1 item 4). `JSON.stringify` would quietly escape them into
+ *    valid-looking bytes, so they are rejected before it is called.
+ * 5. **Integers only, within ±(2^53−1)**; every non-integer number is refused
+ *    rather than arbitrated (§4.3), because whether `1` parses as an integer or
+ *    as a double is a language accident that silently changes the signed bytes.
+ *
+ * Scope: this module is *only* the byte-level canonicalization. It knows nothing
+ * about AWR documents, Data Integrity proofs, `did:key` or profiles.
+ */
+/** Reason codes from the SPEC §11.2 `AWR-CANON-*` registry that this module raises. */
+export type CanonicalizationCode = 
+/** Non-integer JSON number present. */
+"AWR-CANON-001"
+/** Integer outside ±(2^53−1). */
+ | "AWR-CANON-002"
+/** Invalid Unicode (lone surrogate) in string data. */
+ | "AWR-CANON-003"
+/** Duplicate object property name. */
+ | "AWR-CANON-004"
+/** Input is not well-formed JSON / not representable in JSON. */
+ | "AWR-CANON-005";
+/**
+ * A value could not be canonicalized (or parsed) under the AWR profile.
+ *
+ * Callers are expected to *handle* this rather than let it escape: refusing to
+ * produce bytes is the honest outcome, but it must not crash a connection check.
+ */
+export declare class CanonicalizationError extends Error {
+    readonly code: CanonicalizationCode;
+    constructor(code: CanonicalizationCode, detail: string);
+}
+/** Largest magnitude of a JSON integer permitted in canonical bytes (2^53−1). */
+export declare const MAX_SAFE_JSON_INTEGER = 9007199254740991;
+/**
+ * Return the RFC 8785 canonical serialization of `value` as a UTF-8-ready string.
+ *
+ * Throws {@link CanonicalizationError} rather than emitting bytes it cannot
+ * defend: a non-integer number, an integer beyond 2^53−1, a lone surrogate, an
+ * `undefined` property (which `JSON.stringify` would silently drop), a
+ * non-plain object, or a cycle.
+ */
+export declare function canonicalize(value: unknown): string;
+/**
+ * Parse JSON with the profile's parser requirements, for input whose bytes were
+ * signed by someone else.
+ *
+ * `JSON.parse` alone is not enough on a verification path:
+ *
+ * - **Duplicate property names** (§4.1 item 5, `AWR-CANON-004`) are resolved
+ *   last-wins and silently, which would let the parser — not the signer — decide
+ *   which of two records was the signed one.
+ * - **Non-integer number literals** (§4.3, `AWR-CANON-001`) are rejected
+ *   *lexically*, not by value: `2340.0` and `2340` parse to the same JavaScript
+ *   number, and a publisher written in a language that distinguishes them would
+ *   have signed different bytes.
+ *
+ * Both checks run over the received text after `JSON.parse` has confirmed it is
+ * well-formed, so the scanner below only has to find tokens, never validate
+ * grammar.
+ */
+export declare function parseJsonStrict(text: string): unknown;
+//# sourceMappingURL=jcs.d.ts.map

package/dist/jcs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jcs.d.ts","sourceRoot":"","sources":["../src/jcs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,uFAAuF;AACvF,MAAM,MAAM,oBAAoB;AAC9B,uCAAuC;AACrC,eAAe;AACjB,iCAAiC;GAC/B,eAAe;AACjB,uDAAuD;GACrD,eAAe;AACjB,sCAAsC;GACpC,eAAe;AACjB,iEAAiE;GAC/D,eAAe,CAAC;AAEpB;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAClC,QAAQ,CAAC,IAAI,EAAE,oBAAoB;gBAA1B,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM;CAIhE;AAED,iFAAiF;AACjF,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAStD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAInD;AA8HD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CASrD"}