@aimarket/warden 0.3.0 → 0.5.0

package/dist/threat-feed.js

@@ -1,5 +1,7 @@
 import { verify, createPublicKey } from "node:crypto";
+import { countWildcards, MAX_GLOB_WILDCARDS, threatMatch } from "./glob.js";
 import { canonicalize, parseJsonStrict, CanonicalizationError } from "./jcs.js";
+import { displaySafe } from "./sanitize.js";
 /**
  * Threat-intel feed for known-bad MCP servers/tools.
  *
@@ -54,6 +56,17 @@ export const DEFAULT_FEED_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 export const FEED_CLOCK_SKEW_MS = 5 * 60 * 1000;
 /** Hard cap on a feed response body (OOM guard). */
 const MAX_FEED_BYTES = 512_000;
+/**
+ * Hard cap on how many records a feed may add.
+ *
+ * Matching is `records x (1 + tools)` string walks on every single connection
+ * check, so an enormous deny-list is a way to make vetting too slow to keep
+ * enabled. The body cap alone bounds this loosely (a minimal record is ~120
+ * bytes); this states the limit instead of leaving it to arithmetic. Exceeding it
+ * refuses the whole feed loudly rather than truncating it silently: a deny-list
+ * quietly cut off at record 2000 is worse than one that says it was refused.
+ */
+const MAX_FEED_RECORDS = 2000;
 /**
  * Built-in deny-list. Small but real — patterns seen in poisoned MCP servers.
  *
@@ -161,6 +174,7 @@ const BUILTIN = [
 ];
 export class ThreatFeed {
     records = [...BUILTIN];
+    compiled = compile([...BUILTIN]);
     feedPublicKey;
     maxAgeMs;
     now;
@@ -181,6 +195,11 @@ export class ThreatFeed {
     all() {
         return [...this.records];
     }
+    /** Single place where the record set changes, so the match cache cannot go stale. */
+    setRecords(records) {
+        this.records = records;
+        this.compiled = compile(records);
+    }
     /**
      * Fetch and verify a signed remote threat feed.
      *
@@ -216,17 +235,22 @@ export class ThreatFeed {
                 this.log?.warn(`threat feed fetch returned ${res.status} — keeping built-in floor`);
                 return;
             }
-            // Reject oversized responses before parsing (OOM guard).
+            // Reject oversized responses before reading them (OOM guard).
             const cl = res.headers.get("content-length");
             if (cl && Number(cl) > MAX_FEED_BYTES) {
                 this.log?.warn(`threat feed: content-length ${cl} exceeds ${MAX_FEED_BYTES} byte limit — rejected`);
                 return;
             }
             // Read text, not res.json(): the received characters are what the canonical
-            // parser needs for its duplicate-key and number-literal checks.
-            const body = await res.text();
-            if (Buffer.byteLength(body, "utf8") > MAX_FEED_BYTES) {
-                this.log?.warn(`threat feed: body exceeds the ${MAX_FEED_BYTES} byte limit (content-length absent or wrong) — rejected`);
+            // parser needs for its duplicate-key and number-literal checks. Read it in
+            // BOUNDED chunks rather than with res.text(): content-length is advisory —
+            // a chunked response can omit it or lie — and res.text() buffers whatever
+            // arrives before anyone can check the size, so the guard above was one
+            // missing header away from being no guard at all.
+            const body = await readCapped(res, MAX_FEED_BYTES);
+            if (body === undefined) {
+                this.log?.warn(`threat feed: response exceeds the ${MAX_FEED_BYTES} byte limit (content-length absent or wrong) — ` +
+                    `download aborted, feed rejected`);
                 return;
             }
             let data;
@@ -278,6 +302,14 @@ export class ThreatFeed {
                 this.log?.warn(`threat feed: feedPublicKey is not a valid hex SPKI DER key (${err.message}) — feed REFUSED`);
                 return;
             }
+            // An RSA or P-256 key parses fine and then makes verify() throw, which used
+            // to land in the outer catch and be logged at debug — indistinguishable from
+            // "the feed had nothing new". Say it here, once, at warn level.
+            if (pubKey.asymmetricKeyType !== "ed25519") {
+                this.log?.warn(`threat feed: feedPublicKey is a ${String(pubKey.asymmetricKeyType)} key, but feed signatures are ` +
+                    `Ed25519 — feed REFUSED (built-in floor preserved)`);
+                return;
+            }
             const ok = verify(null, Buffer.from(payload, "utf8"), pubKey, sigBuf);
             if (!ok) {
                 this.log?.warn("threat feed: Ed25519 signature INVALID — feed rejected, built-in floor preserved");
@@ -296,8 +328,19 @@ export class ThreatFeed {
                     `${formatDuration(FEED_CLOCK_SKEW_MS)} clock-skew allowance — REJECTED; built-in floor preserved`);
                 return;
             }
+            if (records.length > MAX_FEED_RECORDS) {
+                this.log?.warn(`threat feed: ${records.length} records exceeds the ${MAX_FEED_RECORDS} cap — feed REFUSED ` +
+                    `(built-in floor preserved); split the feed or raise the cap deliberately`);
+                return;
+            }
             const remote = records.filter(isThreatRecord);
-            this.records = [...BUILTIN, ...remote];
+            const dropped = records.length - remote.length;
+            if (dropped > 0) {
+                // Silence here used to hide a publisher shipping records nobody enforces:
+                // a wildcard-heavy pattern or a bad severity is dropped, not applied.
+                this.log?.warn(`threat feed: ${dropped} record(s) refused by validation — the rest are in effect`);
+            }
+            this.setRecords([...BUILTIN, ...remote]);
             this.log?.info(`threat feed loaded: ${this.records.length} records (${BUILTIN.length} builtin + ${remote.length} remote, ` +
                 `signature valid, snapshot ${formatDuration(age)} old)`);
         }
@@ -342,25 +385,31 @@ export class ThreatFeed {
             hay: [tool.name, tool.description ?? "", stringifySchema(tool.inputSchema)].join("\n").toLowerCase(),
         }));
         const findings = [];
-        for (const rec of this.records) {
+        for (const { rec, pattern, glob } of this.compiled) {
             const scope = rec.scope ?? "any";
-            if (scope !== "tool" && patternMatches(rec.pattern, serverHay)) {
+            // `reason`, `pattern` and `source` come off the wire from a publisher; the
+            // tool name comes from the server being inspected. All four end up in an
+            // operator's terminal, so none of them is interpolated raw.
+            const why = `${displaySafe(rec.reason, 400)} (matched "${displaySafe(pattern)}" in`;
+            const from = `source: ${displaySafe(rec.source, 80)})`;
+            if (scope !== "tool" && matches(pattern, glob, serverHay)) {
                 findings.push({
                     gate: "threat-feed",
                     severity: rec.severity,
                     code: rec.code,
-                    message: `${rec.reason} (matched "${rec.pattern}" in server identity, source: ${rec.source})`,
+                    message: `${why} server identity, ${from}`,
                 });
             }
             if (scope === "server")
                 continue;
             for (const tool of toolHays) {
-                if (patternMatches(rec.pattern, tool.hay)) {
+                if (matches(pattern, glob, tool.hay)) {
                     findings.push({
                         gate: "threat-feed",
                         severity: rec.severity,
                         code: rec.code,
-                        message: `Tool "${tool.name}": ${rec.reason} (matched "${rec.pattern}" in the tool definition, source: ${rec.source})`,
+                        message: `Tool "${displaySafe(tool.name)}": ${why} the tool definition, ${from}`,
+                        // Raw name: this is the key the host filters its tool list with.
                         tool: tool.name,
                     });
                 }
@@ -394,28 +443,65 @@ export class ThreatGate {
     }
 }
 /**
- * Case-insensitive match. `*` is a wildcard (glob); a pattern with no `*` is a
- * plain substring test. `hay` is expected to be pre-lowercased.
+ * Read a response body as UTF-8 text, giving up as soon as it passes `cap` bytes.
+ *
+ * Returns `undefined` when the cap is exceeded, having cancelled the download —
+ * the point is to stop reading, not to read it all and then complain. Falls back
+ * to `res.text()` only when the runtime gives us no stream to read.
  */
-function patternMatches(pattern, hay) {
-    const p = pattern.toLowerCase();
-    if (!p.includes("*"))
-        return hay.includes(p);
-    const re = globToRegExp(p);
-    return re.test(hay);
+async function readCapped(res, cap) {
+    const stream = res.body;
+    if (!stream) {
+        const text = await res.text();
+        return Buffer.byteLength(text, "utf8") > cap ? undefined : text;
+    }
+    const reader = stream.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > cap) {
+                await reader.cancel().catch(() => { });
+                return undefined;
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+/** Lowercase every pattern once, and note whether it needs wildcard matching. */
+function compile(records) {
+    return records.map((rec) => {
+        const pattern = rec.pattern.toLowerCase();
+        return { rec, pattern, glob: pattern.includes("*") };
+    });
 }
 /**
- * Translate a `*`-glob into an anchored regex, escaping all other metachars.
- * The `s` (dotAll) flag is essential: a haystack joins several fields with
- * newlines, and without it `.*` would not cross a newline — silently defeating
- * every `*…*` pattern. (Regression-tested in test/warden.test.ts.)
+ * Case-insensitive match against a pre-lowercased haystack. A pattern with no
+ * `*` is a plain substring test; one with `*` goes to `threatMatch`, which is the
+ * linear glob matcher plus a bounded interior gap and a word-boundary start.
+ *
+ * This used to compile `*` into `.*` and run a regex, which took 112 seconds on a
+ * 32-character pattern against a 220-character haystack — see ./glob.ts. A signed
+ * record could therefore hang every connection check, which is the one thing the
+ * feed's trust model says a publisher must not be able to do.
+ *
+ * It then used plain glob semantics, and the field survey (docs/mcp-survey.md)
+ * showed what that costs on real tool definitions: every multi-segment built-in
+ * fired on unrelated words in the same paragraph, and `*sweep*funds*` matched
+ * `funds` inside "refunds". Those are the constraints `threatMatch` adds.
  */
-function globToRegExp(glob) {
-    const escaped = glob
-        .split("*")
-        .map((seg) => seg.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
-        .join(".*");
-    return new RegExp(`^${escaped}$`, "is");
+function matches(pattern, glob, hay) {
+    return glob ? threatMatch(pattern, hay) : hay.includes(pattern);
 }
 /**
  * Flatten a tool's input schema for pattern matching only. Key order is
@@ -445,6 +531,9 @@ function isThreatRecord(v) {
     const r = v;
     const severities = ["info", "low", "medium", "high", "critical"];
     return (typeof r.pattern === "string" && r.pattern.length > 0 && r.pattern.length <= 2000 &&
+        // Bounded wildcards: see MAX_GLOB_WILDCARDS. A pattern past the bound is
+        // refused, never run, because the cost of running it is the attack.
+        countWildcards(r.pattern) <= MAX_GLOB_WILDCARDS &&
         typeof r.code === "string" && r.code.length > 0 && r.code.length <= 200 &&
         typeof r.reason === "string" && r.reason.length > 0 && r.reason.length <= 2000 &&
         typeof r.source === "string" && r.source.length > 0 && r.source.length <= 200 &&

package/dist/threat-feed.js.map

@@ -1 +1 @@
-{"version":3,"file":"threat-feed.js","sourceRoot":"","sources":["../src/threat-feed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAchF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,oDAAoD;AACpD,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,GAAmB;IAC9B;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,iDAAiD;QACzD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,2CAA2C;QACnD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,yDAAyD;QACjE,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,4CAA4C;QACpD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,4CAA4C;QACpD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD;QACE,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,wCAAwC;QAChD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD;QACE,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,4CAA4C;QACpD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD;QACE,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,mDAAmD;QAC3D,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD,kEAAkE;IAClE;QACE,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,2CAA2C;QACnD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,oCAAoC;QAC5C,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,+CAA+C;QACvD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ;KAChB;CACF,CAAC;AAgBF,MAAM,OAAO,UAAU;IACb,OAAO,GAAmB,CAAC,GAAG,OAAO,CAAC,CAAC;IACvC,aAAa,CAAU;IACd,QAAQ,CAAS;IACjB,GAAG,CAAe;IAClB,GAAG,CAAgB;IAEpC,YAAY,IAAwB;QAClC,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,aAAa,CAAC;QACzC,IAAI,CAAC,QAAQ;YACX,IAAI,EAAE,QAAQ,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC;gBAC3E,CAAC,CAAC,IAAI,CAAC,QAAQ;gBACf,CAAC,CAAC,uBAAuB,CAAC;QAC9B,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC;IACvB,CAAC;IAED,0EAA0E;IAC1E,IAAI,QAAQ;QACV,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,IAAI,CAAC,OAAgB;QACzB,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,wGAAwG,CAAC,CAAC;YACzH,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,+EAA+E;YAC/E,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7F,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,8BAA8B,GAAG,CAAC,MAAM,2BAA2B,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,yDAAyD;YACzD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC7C,IAAI,EAAE,IAAI,MAAM,CAAC,EAAE,CAAC,GAAG,cAAc,EAAE,CAAC;gBACtC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,+BAA+B,EAAE,YAAY,cAAc,wBAAwB,CAAC,CAAC;gBACpG,OAAO;YACT,CAAC;YACD,4EAA4E;YAC5E,gEAAgE;YAChE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;gBACrD,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,iCAAiC,cAAc,yDAAyD,CAAC,CAAC;gBACzH,OAAO;YACT,CAAC;YAED,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,4DAA6D,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;gBACtG,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO;YAC9C,MAAM,GAAG,GAAG,IAA+B,CAAC;YAE5C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;YAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC7D,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,wEAAwE,CAAC,CAAC;gBACzF,OAAO;YACT,CAAC;YACD,4EAA4E;YAC5E,sEAAsE;YACtE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,oGAAoG,CAAC,CAAC;gBACrH,OAAO;YACT,CAAC;YAED,qEAAqE;YACrE,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,GAAG,YAAY,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,GAAa,CAAC,OAAO,CAAC;gBAC3F,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,+CAA+C,MAAM,cAAc,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,eAAe,CAAC;oBACvB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC;oBAC3C,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,MAAM;iBACb,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,gDAAgD;gBAChD,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,+DAAgE,GAAa,CAAC,OAAO,kBAAkB,CAAC,CAAC;gBACxH,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACtE,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,kFAAkF,CAAC,CAAC;gBACnG,OAAO;YACT,CAAC;YAED,2EAA2E;YAC3E,yEAAyE;YACzE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACnC,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,GAAG,EAAE,IAAI,CACZ,mCAAmC,cAAc,CAAC,GAAG,CAAC,kBAAkB,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW;oBAC9G,oFAAoF,CACvF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,GAAG,GAAG,CAAC,kBAAkB,EAAE,CAAC;gBAC9B,IAAI,CAAC,GAAG,EAAE,IAAI,CACZ,yCAAyC,cAAc,CAAC,CAAC,GAAG,CAAC,6BAA6B;oBACxF,GAAG,cAAc,CAAC,kBAAkB,CAAC,4DAA4D,CACpG,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,GAAG,EAAE,IAAI,CACZ,uBAAuB,IAAI,CAAC,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,WAAW;gBACzG,6BAA6B,cAAc,CAAC,GAAG,CAAC,OAAO,CAC1D,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kDAAkD;YAClD,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,2BAA4B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,MAAoB,EAAE,QAAmB,EAAE;QAC/C,MAAM,SAAS,GAAG;YAChB,MAAM,CAAC,EAAE;YACT,MAAM,CAAC,IAAI;YACX,MAAM,CAAC,GAAG,IAAI,EAAE;YAChB,MAAM,CAAC,OAAO,IAAI,EAAE;YACpB,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SAC9B;aACE,IAAI,CAAC,IAAI,CAAC;aACV,WAAW,EAAE,CAAC;QAEjB,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;SACrG,CAAC,CAAC,CAAC;QAEJ,MAAM,QAAQ,GAAoB,EAAE,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAgB,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC;YAE9C,IAAI,KAAK,KAAK,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC/D,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,iCAAiC,GAAG,CAAC,MAAM,GAAG;iBAC9F,CAAC,CAAC;YACL,CAAC;YAED,IAAI,KAAK,KAAK,QAAQ;gBAAE,SAAS;YACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1C,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,aAAa;wBACnB,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,qCAAqC,GAAG,CAAC,MAAM,GAAG;wBACtH,IAAI,EAAE,IAAI,CAAC,IAAI;qBAChB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,UAAU;IAGQ;IAFpB,IAAI,GAAG,aAAa,CAAC;IAE9B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,QAAQ,CAAC,KAAsB;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,GAAW;IAClD,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;SACxD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,cAAc,CAAC,EAAU;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,OAAO,MAAM,CAAC;IACpD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,aAAa,GAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/D,SAAS,cAAc,CAAC,CAAU;IAChC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,MAAM,UAAU,GAAe,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7E,OAAO,CACL,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI;QACjF,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG;QACvE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI;QAC9E,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG;QAC7E,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAoB,CAAC;QAC3C,+EAA+E;QAC/E,+EAA+E;QAC/E,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAoB,CAAC,CAAC,CAAC,CAC3G,CAAC;AACJ,CAAC"}
+{"version":3,"file":"threat-feed.js","sourceRoot":"","sources":["../src/threat-feed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAc5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,oDAAoD;AACpD,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,GAAmB;IAC9B;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,iDAAiD;QACzD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,2CAA2C;QACnD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD;QACE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,yDAAyD;QACjE,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,4CAA4C;QACpD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,4CAA4C;QACpD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD;QACE,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,wCAAwC;QAChD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD;QACE,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,4CAA4C;QACpD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD;QACE,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,mDAAmD;QAC3D,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,KAAK;KACb;IACD,kEAAkE;IAClE;QACE,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,2CAA2C;QACnD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,oCAAoC;QAC5C,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,+CAA+C;QACvD,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ;KAChB;CACF,CAAC;AA4BF,MAAM,OAAO,UAAU;IACb,OAAO,GAAmB,CAAC,GAAG,OAAO,CAAC,CAAC;IACvC,QAAQ,GAAqB,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IACnD,aAAa,CAAU;IACd,QAAQ,CAAS;IACjB,GAAG,CAAe;IAClB,GAAG,CAAgB;IAEpC,YAAY,IAAwB;QAClC,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,aAAa,CAAC;QACzC,IAAI,CAAC,QAAQ;YACX,IAAI,EAAE,QAAQ,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC;gBAC3E,CAAC,CAAC,IAAI,CAAC,QAAQ;gBACf,CAAC,CAAC,uBAAuB,CAAC;QAC9B,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC;IACvB,CAAC;IAED,0EAA0E;IAC1E,IAAI,QAAQ;QACV,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,qFAAqF;IAC7E,UAAU,CAAC,OAAuB;QACxC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,IAAI,CAAC,OAAgB;QACzB,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,wGAAwG,CAAC,CAAC;YACzH,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,+EAA+E;YAC/E,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7F,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,8BAA8B,GAAG,CAAC,MAAM,2BAA2B,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,8DAA8D;YAC9D,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC7C,IAAI,EAAE,IAAI,MAAM,CAAC,EAAE,CAAC,GAAG,cAAc,EAAE,CAAC;gBACtC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,+BAA+B,EAAE,YAAY,cAAc,wBAAwB,CAAC,CAAC;gBACpG,OAAO;YACT,CAAC;YACD,4EAA4E;YAC5E,2EAA2E;YAC3E,2EAA2E;YAC3E,0EAA0E;YAC1E,uEAAuE;YACvE,kDAAkD;YAClD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACnD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,CAAC,GAAG,EAAE,IAAI,CACZ,qCAAqC,cAAc,iDAAiD;oBAClG,iCAAiC,CACpC,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,4DAA6D,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;gBACtG,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO;YAC9C,MAAM,GAAG,GAAG,IAA+B,CAAC;YAE5C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;YAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC7D,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,wEAAwE,CAAC,CAAC;gBACzF,OAAO;YACT,CAAC;YACD,4EAA4E;YAC5E,sEAAsE;YACtE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,oGAAoG,CAAC,CAAC;gBACrH,OAAO;YACT,CAAC;YAED,qEAAqE;YACrE,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,GAAG,YAAY,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,GAAa,CAAC,OAAO,CAAC;gBAC3F,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,+CAA+C,MAAM,cAAc,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,eAAe,CAAC;oBACvB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC;oBAC3C,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,MAAM;iBACb,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,gDAAgD;gBAChD,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,+DAAgE,GAAa,CAAC,OAAO,kBAAkB,CAAC,CAAC;gBACxH,OAAO;YACT,CAAC;YACD,4EAA4E;YAC5E,6EAA6E;YAC7E,gEAAgE;YAChE,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBAC3C,IAAI,CAAC,GAAG,EAAE,IAAI,CACZ,mCAAmC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,gCAAgC;oBACjG,mDAAmD,CACtD,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACtE,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,kFAAkF,CAAC,CAAC;gBACnG,OAAO;YACT,CAAC;YAED,2EAA2E;YAC3E,yEAAyE;YACzE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACnC,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,GAAG,EAAE,IAAI,CACZ,mCAAmC,cAAc,CAAC,GAAG,CAAC,kBAAkB,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW;oBAC9G,oFAAoF,CACvF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,GAAG,GAAG,CAAC,kBAAkB,EAAE,CAAC;gBAC9B,IAAI,CAAC,GAAG,EAAE,IAAI,CACZ,yCAAyC,cAAc,CAAC,CAAC,GAAG,CAAC,6BAA6B;oBACxF,GAAG,cAAc,CAAC,kBAAkB,CAAC,4DAA4D,CACpG,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBACtC,IAAI,CAAC,GAAG,EAAE,IAAI,CACZ,gBAAgB,OAAO,CAAC,MAAM,wBAAwB,gBAAgB,sBAAsB;oBAC1F,0EAA0E,CAC7E,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,0EAA0E;gBAC1E,sEAAsE;gBACtE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,OAAO,2DAA2D,CAAC,CAAC;YACrG,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,EAAE,IAAI,CACZ,uBAAuB,IAAI,CAAC,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,WAAW;gBACzG,6BAA6B,cAAc,CAAC,GAAG,CAAC,OAAO,CAC1D,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kDAAkD;YAClD,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,2BAA4B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,MAAoB,EAAE,QAAmB,EAAE;QAC/C,MAAM,SAAS,GAAG;YAChB,MAAM,CAAC,EAAE;YACT,MAAM,CAAC,IAAI;YACX,MAAM,CAAC,GAAG,IAAI,EAAE;YAChB,MAAM,CAAC,OAAO,IAAI,EAAE;YACpB,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SAC9B;aACE,IAAI,CAAC,IAAI,CAAC;aACV,WAAW,EAAE,CAAC;QAEjB,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;SACrG,CAAC,CAAC,CAAC;QAEJ,MAAM,QAAQ,GAAoB,EAAE,CAAC;QACrC,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,KAAK,GAAgB,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC;YAC9C,2EAA2E;YAC3E,yEAAyE;YACzE,4DAA4D;YAC5D,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACpF,MAAM,IAAI,GAAG,WAAW,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC;YAEvD,IAAI,KAAK,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,OAAO,EAAE,GAAG,GAAG,qBAAqB,IAAI,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,IAAI,KAAK,KAAK,QAAQ;gBAAE,SAAS;YACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrC,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,aAAa;wBACnB,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EAAE,SAAS,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,yBAAyB,IAAI,EAAE;wBAChF,iEAAiE;wBACjE,IAAI,EAAE,IAAI,CAAC,IAAI;qBAChB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,UAAU;IAGQ;IAFpB,IAAI,GAAG,aAAa,CAAC;IAE9B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,QAAQ,CAAC,KAAsB;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;CACF;AAED;;;;;;GAMG;AACH,KAAK,UAAU,UAAU,CAAC,GAAa,EAAE,GAAW;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC;IACxB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;gBAChB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACtC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,SAAS,OAAO,CAAC,OAAuB;IACtC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC1C,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,OAAO,CAAC,OAAe,EAAE,IAAa,EAAE,GAAW;IAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,cAAc,CAAC,EAAU;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,OAAO,MAAM,CAAC;IACpD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,aAAa,GAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/D,SAAS,cAAc,CAAC,CAAU;IAChC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,MAAM,UAAU,GAAe,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7E,OAAO,CACL,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI;QACjF,yEAAyE;QACzE,oEAAoE;QACpE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,kBAAkB;QAC/C,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG;QACvE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI;QAC9E,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG;QAC7E,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAoB,CAAC;QAC3C,+EAA+E;QAC/E,+EAA+E;QAC/E,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAoB,CAAC,CAAC,CAAC,CAC3G,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -113,6 +113,21 @@ export interface PinnedServer {
     toolsHash: string;
     approvedAt: string;
     toolNames: string[];
+    /**
+     * sha256 over the server's launch identity — transport, command, args, url,
+     * name — as it stood when the user approved it.
+     *
+     * Tool-def pinning catches a server that changes what it advertises. It does
+     * not catch a server that keeps the advertisement and changes the program
+     * behind it: same id, same tools, different `command`. For an operator-declared
+     * server that is a local config edit and not much of a threat. For a server
+     * discovered from a remote **catalog** it is one, because the catalog decides
+     * the command and can repoint an already-approved id at a new one.
+     *
+     * Optional because pins written before this field existed do not have it, and a
+     * missing value must not be read as a change. Re-approving fills it in.
+     */
+    identityHash?: string;
 }
 /**
  * Where approvals are remembered between runs — the only persistence WARDEN

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAEvE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,wDAAwD;IACxD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,EAAE;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAC;CACtC;AAED,oFAAoF;AACpF,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,6CAA6C;IAC7C,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,eAAe,EAAE,QAAQ,CAAC;IAC1B,4EAA4E;IAC5E,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAC5D,MAAM,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;AAEpD,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC1C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC1C,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAAC;CACpC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAEvE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,wDAAwD;IACxD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,EAAE;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAC;CACtC;AAED,oFAAoF;AACpF,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,6CAA6C;IAC7C,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,eAAe,EAAE,QAAQ,CAAC;IAC1B,4EAA4E;IAC5E,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAC5D,MAAM,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;AAEpD,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC1C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC1C,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAAC;CACpC"}

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@aimarket/warden",
-  "version": "0.3.0",
-  "description": "WARDEN — MCP security firewall. Vets an MCP server's tool definitions, threat feed, origin and pinning before any tool runs. Zero runtime dependencies.",
+  "version": "0.5.0",
+  "description": "WARDEN — MCP security firewall. Library + stdio MCP server: vets tool definitions (static-scan → threat-feed → origin → pinning) before they reach the model. Zero npm runtime dependencies.",
   "type": "module",
   "license": "MIT",
   "author": "AICOM (alexar76)",
-  "homepage": "https://github.com/alexar76/warden",
+  "homepage": "https://warden.modelmarket.dev/",
+  "mcpName": "io.github.alexar76/warden",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/alexar76/warden.git"
@@ -13,6 +14,9 @@
   "bugs": {
     "url": "https://github.com/alexar76/warden/issues"
   },
+  "bin": {
+    "warden-mcp": "./dist/mcp-server.js"
+  },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -42,15 +46,18 @@
   },
   "sideEffects": false,
   "scripts": {
+    "mcp": "node dist/mcp-server.js",
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "test:watch": "vitest",
-    "prepublishOnly": "npm run build && npm test"
+    "prepublishOnly": "npm run build && npm test && npm run check:ruleset",
+    "check:ruleset": "node scripts/check-published-ruleset.mjs"
   },
   "keywords": [
     "mcp",
+    "mcp-server",
     "mcp-security",
     "model-context-protocol",
     "prompt-injection",