@aimarket/warden 0.8.2 → 0.9.0

package/dist/scan.js

@@ -0,0 +1,534 @@
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { Warden, StaticScanGate, ThreatFeed, staticScanRulesetRef, displaySafe, FilePinStore } from './index.js';
+import { asPolicy } from './mcp-tools.js';
+import { defaultStateDir } from './state.js';
+import { packageVersion } from './mcp-rpc.js';
+import { discoverServers, CLIENT_KINDS } from './scan-config.js';
+import { fetchServer, McpClientError } from './mcp-client.js';
+import { mtlToolSetDigest, MtlError } from './mtl.js';
+import { historCheck, DEFAULT_HISTOR_URL } from './histor.js';
+import { classifyTools, ClassifierError } from './classifier.js';
+import { LockStore, readLock, writeLock, lockEntryFor, diffTools, LOCK_VERSION } from './scan-lock.js';
+export const SEVERITIES = ['info', 'low', 'medium', 'high', 'critical'];
+// ── argument parsing ─────────────────────────────────────────────────────────
+export const SCAN_USAGE = `Usage: warden-mcp scan [CONFIG...] [options]
+
+Reads MCP client configs, connects to every server they start, and vets the
+tool definitions before a model sees them. Exit 0 = nothing blocked,
+1 = a server was blocked (or, with --fail-on-error, could not be checked),
+2 = usage or config error.
+
+Where to look (default: every known client file that exists)
+  CONFIG...              client config files (.mcp.json, claude_desktop_config.json, mcp.json …)
+  --project              only project files in --cwd (.mcp.json, .cursor/mcp.json, .vscode/mcp.json)
+  --client NAME          only this client: ${CLIENT_KINDS.join(', ')} (repeatable)
+  --cwd DIR              project directory (default: current directory)
+
+How to connect
+  --no-launch            do not start stdio servers; vet their launch line only
+  --public-only          refuse remote servers that resolve to private/loopback/link-local addresses
+  --timeout MS           per server (default 30000)
+  --concurrency N        servers checked at once (default 4)
+
+Verdicts
+  --fail-on SEVERITY     block at this severity: info|low|medium|high|critical (default high)
+  --policy FILE          strict JSON policy, as for wrap
+  --lock FILE            compare with reviewed definitions; a server missing from the lock is blocked
+  --update-lock          write what the servers advertise now into --lock (refuses blocked servers)
+  --state-dir DIR        where wrap keeps pins (read only here)
+  --feed URL --feed-key HEX   signed threat feed, as for wrap
+  --histor               ask the HISTOR log whether remote servers serve you what they serve everyone
+                         (sends the endpoint without query or credentials, and a digest; never tool text)
+  --histor-url URL       default ${DEFAULT_HISTOR_URL}
+  --classifier-url URL --classifier-model NAME
+                         also ask a model you choose (OpenAI-compatible: Ollama, vLLM, a hosted API)
+                         whether each tool's text directs the model. Sends tool definitions to that URL.
+                         Key, if any, from WARDEN_CLASSIFIER_API_KEY. Advisory unless --classifier-blocks.
+  --classifier-blocks    let the classifier's high/medium verdicts block like a rule
+
+Output
+  --json                 JSON report on stdout instead of a table
+  --sarif FILE           also write SARIF 2.1.0 (GitHub code scanning)
+  --markdown FILE        also write a Markdown report (e.g. $GITHUB_STEP_SUMMARY)
+  --json-file FILE       also write the JSON report to FILE
+  --fail-on-error        a server that could not be checked fails the run too
+  --no-color`;
+export async function parseScanArgs(argv, env = process.env) {
+    const opts = {
+        configs: [], project: false, cwd: process.cwd(), launch: true, publicOnly: false, timeoutMs: 30_000, concurrency: 4,
+        policy: asPolicy(undefined), updateLock: false, stateDir: defaultStateDir(), histor: false, historUrl: DEFAULT_HISTOR_URL,
+        format: 'table', failOnError: false, color: !!process.stdout.isTTY && !env.NO_COLOR,
+    };
+    let failOn, policyFile;
+    let classifierUrl, classifierModel, classifierBlocks = false;
+    const clients = [];
+    const value = (flag) => {
+        const v = argv.shift();
+        if (v === undefined || (v.startsWith('--') && v.length > 2))
+            throw new Error(`Missing value for ${flag}`);
+        return v;
+    };
+    while (argv.length) {
+        const arg = argv.shift();
+        if (!arg.startsWith('--')) {
+            opts.configs.push(arg);
+            continue;
+        }
+        switch (arg) {
+            case '--project':
+                opts.project = true;
+                break;
+            case '--client': {
+                const c = value(arg);
+                if (!CLIENT_KINDS.includes(c))
+                    throw new Error(`--client must be one of ${CLIENT_KINDS.join(', ')}`);
+                clients.push(c);
+                break;
+            }
+            case '--cwd':
+                opts.cwd = resolve(value(arg));
+                break;
+            case '--no-launch':
+                opts.launch = false;
+                break;
+            case '--public-only':
+                opts.publicOnly = true;
+                break;
+            case '--timeout': {
+                const n = Number(value(arg));
+                if (!Number.isInteger(n) || n < 100 || n > 600_000)
+                    throw new Error('--timeout must be 100–600000 ms');
+                opts.timeoutMs = n;
+                break;
+            }
+            case '--concurrency': {
+                const n = Number(value(arg));
+                if (!Number.isInteger(n) || n < 1 || n > 32)
+                    throw new Error('--concurrency must be 1–32');
+                opts.concurrency = n;
+                break;
+            }
+            case '--fail-on': {
+                const s = value(arg);
+                if (!SEVERITIES.includes(s))
+                    throw new Error(`--fail-on must be one of ${SEVERITIES.join(', ')}`);
+                failOn = s;
+                break;
+            }
+            case '--policy':
+                policyFile = value(arg);
+                break;
+            case '--lock':
+                opts.lock = resolve(value(arg));
+                break;
+            case '--update-lock':
+                opts.updateLock = true;
+                break;
+            case '--state-dir':
+                opts.stateDir = value(arg);
+                break;
+            case '--feed':
+                opts.feed = value(arg);
+                break;
+            case '--feed-key':
+                opts.feedKey = value(arg);
+                break;
+            case '--histor':
+                opts.histor = true;
+                break;
+            case '--histor-url':
+                opts.historUrl = value(arg);
+                opts.histor = true;
+                break;
+            case '--classifier-url':
+                classifierUrl = value(arg);
+                break;
+            case '--classifier-model':
+                classifierModel = value(arg);
+                break;
+            case '--classifier-blocks':
+                classifierBlocks = true;
+                break;
+            case '--json':
+                opts.format = 'json';
+                break;
+            case '--sarif':
+                opts.sarif = resolve(value(arg));
+                break;
+            case '--markdown':
+                opts.markdown = resolve(value(arg));
+                break;
+            case '--json-file':
+                opts.jsonFile = resolve(value(arg));
+                break;
+            case '--fail-on-error':
+                opts.failOnError = true;
+                break;
+            case '--no-color':
+                opts.color = false;
+                break;
+            case '--help':
+            case '-h': throw new UsageRequested();
+            default: throw new Error(`Unknown option ${arg}`);
+        }
+    }
+    if (clients.length)
+        opts.clients = clients;
+    if (opts.updateLock && !opts.lock)
+        throw new Error('--update-lock needs --lock FILE');
+    if (opts.updateLock && !opts.launch)
+        throw new Error('--update-lock needs the tool definitions, so it cannot be combined with --no-launch');
+    if (opts.project && opts.configs.length)
+        throw new Error('--project and explicit CONFIG files are alternatives');
+    if (policyFile) {
+        // Same strict reading as `wrap --policy`: a typo must stop the run, not silently relax it.
+        const raw = JSON.parse(await readFile(policyFile, 'utf8'));
+        if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+            throw new Error('policy must be an object');
+        for (const key of Object.keys(raw))
+            if (!['blockAtSeverity', 'pinToolDefs', 'allowUnknownServers', 'sensitiveToolPatterns'].includes(key))
+                throw new Error(`Unknown policy field ${key}`);
+        opts.policy = asPolicy(raw);
+    }
+    if (failOn)
+        opts.policy = { ...opts.policy, blockAtSeverity: failOn };
+    if (!!classifierUrl !== !!classifierModel)
+        throw new Error('--classifier-url and --classifier-model go together');
+    if (classifierBlocks && !classifierUrl)
+        throw new Error('--classifier-blocks needs --classifier-url and --classifier-model');
+    if (classifierUrl && classifierModel) {
+        const cu = new URL(classifierUrl);
+        if (cu.protocol !== 'https:' && cu.protocol !== 'http:')
+            throw new Error('--classifier-url must be http(s)');
+        if (cu.username || cu.password)
+            throw new Error('--classifier-url must not carry credentials; use WARDEN_CLASSIFIER_API_KEY');
+        opts.classifier = { url: classifierUrl, model: classifierModel, apiKey: env.WARDEN_CLASSIFIER_API_KEY || undefined, blocks: classifierBlocks };
+    }
+    const u = new URL(opts.historUrl);
+    if (u.protocol !== 'https:' && u.protocol !== 'http:')
+        throw new Error('--histor-url must be http(s)');
+    return opts;
+}
+export class UsageRequested extends Error {
+    constructor() { super(SCAN_USAGE); }
+}
+// ── display helpers ──────────────────────────────────────────────────────────
+const SECRET_FLAG = /(key|token|secret|password|passwd|pwd|auth|bearer|credential)/i;
+const SECRET_SHAPE = /^(?:sk-|sk_|ghp_|gho_|ghs_|github_pat_|xox[abpr]-|aimk_|AKIA|eyJ)[A-Za-z0-9._-]{8,}|^[A-Za-z0-9+/_-]{32,}={0,2}$/;
+/** A path segment or argument that looks like it carries a credential. */
+export function looksSecret(text) {
+    if (SECRET_SHAPE.test(text))
+        return true;
+    return text.length >= 24 && /[A-Za-z]/.test(text) && /\d/.test(text) && /^[A-Za-z0-9_-]+$/.test(text);
+}
+/** The launch line with credentials replaced, for terminals, reports and SARIF. */
+export function redactLaunch(server) {
+    const ref = server.ref;
+    if (ref.url)
+        return redactUrl(ref.url);
+    const out = [];
+    const args = ref.args ?? [];
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        const eq = a.indexOf('=');
+        if (a.startsWith('--') && eq > 0 && SECRET_FLAG.test(a.slice(0, eq))) {
+            out.push(a.slice(0, eq + 1) + '***');
+            continue;
+        }
+        if (i > 0 && args[i - 1].startsWith('-') && SECRET_FLAG.test(args[i - 1])) {
+            out.push('***');
+            continue;
+        }
+        out.push(looksSecret(a) ? '***' : a);
+    }
+    return [ref.command ?? '', ...out].join(' ').trim();
+}
+export function redactUrl(raw) {
+    try {
+        const u = new URL(raw);
+        u.username = '';
+        u.password = '';
+        const q = [...u.searchParams.keys()];
+        u.search = '';
+        for (const k of q)
+            u.searchParams.set(k, '***');
+        u.pathname = u.pathname.split('/').map(seg => looksSecret(decodeURIComponent(seg)) ? '***' : seg).join('/');
+        return u.toString();
+    }
+    catch {
+        return '(unparseable URL)';
+    }
+}
+/** The endpoint HISTOR may be asked about, or why it is not sent. */
+export function historEndpoint(raw) {
+    let u;
+    try {
+        u = new URL(raw);
+    }
+    catch {
+        return { reason: 'unparseable URL' };
+    }
+    if (u.protocol !== 'https:' && u.protocol !== 'http:')
+        return { reason: 'not an http(s) endpoint' };
+    const host = u.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    if (host === 'localhost' || host.endsWith('.localhost') || /\.(local|internal|lan|home|corp|intranet|test|example|invalid)$/.test(host) || !host.includes('.')) {
+        return { reason: 'private host name' };
+    }
+    if (/^[\d.]+$/.test(host) || host.includes(':')) {
+        // An address literal: only a public one names something HISTOR could have crawled.
+        const v4 = host.split('.').map(Number);
+        if (host.includes(':') || v4[0] === 10 || v4[0] === 127 || (v4[0] === 192 && v4[1] === 168) || (v4[0] === 172 && v4[1] >= 16 && v4[1] <= 31) || (v4[0] === 169 && v4[1] === 254))
+            return { reason: 'private address' };
+    }
+    if (u.pathname.split('/').some(seg => seg && looksSecret(decodeURIComponent(seg))))
+        return { reason: 'the path looks like it carries a credential' };
+    return { endpoint: `${u.protocol}//${u.host}${u.pathname}` };
+}
+// ── the scan ─────────────────────────────────────────────────────────────────
+async function pool(items, n, fn) {
+    const out = new Array(items.length);
+    let next = 0;
+    await Promise.all(Array.from({ length: Math.min(n, items.length) }, async () => {
+        while (next < items.length) {
+            const i = next++;
+            out[i] = await fn(items[i]);
+        }
+    }));
+    return out;
+}
+const READ_ONLY = (store) => ({ getPin: id => store.getPin(id), putPin: async () => { } });
+const NO_PINS = { getPin: async () => undefined, putPin: async () => { } };
+function blocking(f, policy) {
+    return !f.advisory && SEVERITIES.indexOf(f.severity) >= SEVERITIES.indexOf(policy.blockAtSeverity);
+}
+export async function runScan(opts, deps = {}) {
+    const version = packageVersion();
+    const d = { home: homedir(), cwd: opts.cwd, platform: process.platform, env: process.env, ...deps.discovery };
+    let results;
+    if (opts.project) {
+        const files = ['.mcp.json', join('.cursor', 'mcp.json'), join('.vscode', 'mcp.json')].map(f => join(opts.cwd, f));
+        const { existsSync } = await import('node:fs');
+        results = await discoverServers(files.filter(f => existsSync(f)), d);
+        // An explicit file list makes guessClient decide; mark scope honestly.
+        for (const r of results) {
+            r.source.scope = 'project';
+            for (const s of r.servers)
+                s.scope = 'project';
+        }
+        if (!results.length)
+            results = [];
+    }
+    else {
+        results = await discoverServers(opts.configs.length ? opts.configs : undefined, d, opts.clients);
+    }
+    const feed = new ThreatFeed({ feedPublicKey: opts.feedKey, stateDir: opts.stateDir });
+    await feed.load(opts.feed);
+    const lockFile = opts.lock ? await readLock(opts.lock) : undefined;
+    const lockStore = opts.lock ? new LockStore(lockFile?.servers ?? {}) : undefined;
+    const wrapPins = READ_ONLY(new FilePinStore(join(opts.stateDir, 'pins')));
+    const now = (deps.now ?? (() => new Date()))().toISOString();
+    const all = results.flatMap(r => r.servers);
+    // The same server listed by two clients is checked once per entry: they are separate launches.
+    const servers = await pool(all, opts.concurrency, async (server) => {
+        const base = {
+            id: server.id, key: server.key, client: server.client, source: server.source, scope: server.scope,
+            transport: server.ref.transport, wrapped: server.wrapped, launch: redactLaunch(server),
+            status: 'skipped', allow: null, findings: [], allowedTools: [], blockedTools: [],
+        };
+        if (server.skipped)
+            return { ...base, skipped: server.skipped };
+        const store = lockStore ?? (server.wrapped ? wrapPins : NO_PINS);
+        const warden = Warden.create({ policy: opts.policy, threatFeed: feed, store });
+        const launchVerdict = await warden.vetLaunch(server.ref);
+        const lockEntry = lockStore ? lockStore.entries.get(server.id) : undefined;
+        const lockMissing = lockStore && !lockEntry ? {
+            gate: 'lock', severity: 'high', code: 'LOCK_MISSING',
+            message: `Server "${displaySafe(server.id)}" is not in the lock file, so its tool definitions were never reviewed. Run scan --lock … --update-lock and commit the lock.`,
+        } : undefined;
+        if (!launchVerdict.allow) {
+            return { ...base, status: 'blocked-at-launch', allow: false, score: launchVerdict.score, decidedBy: launchVerdict.decidedBy,
+                findings: [...launchVerdict.findings, ...(lockMissing ? [lockMissing] : [])], lock: lockStore ? { state: lockEntry ? 'drift' : 'missing' } : undefined };
+        }
+        if (server.ref.transport === 'stdio' && !opts.launch) {
+            const findings = [...launchVerdict.findings, ...(lockMissing ? [lockMissing] : [])];
+            return { ...base, status: 'launch-only', allow: !lockMissing, score: launchVerdict.score, findings,
+                ...(lockMissing ? { decidedBy: 'lock' } : {}), lock: lockStore ? { state: lockEntry ? 'match' : 'missing' } : undefined };
+        }
+        let fetched;
+        try {
+            fetched = deps.fetch ? await deps.fetch(server, opts)
+                : await fetchServer(server.ref, { timeoutMs: opts.timeoutMs, clientVersion: version, publicOnly: opts.publicOnly, headers: server.headers, cwd: opts.cwd });
+        }
+        catch (err) {
+            const msg = err instanceof McpClientError ? err.message : err instanceof Error ? err.message : String(err);
+            return { ...base, status: 'error', error: displaySafe(msg, 400), findings: lockMissing ? [lockMissing] : [], allow: lockMissing ? false : null, ...(lockMissing ? { decidedBy: 'lock' } : {}) };
+        }
+        const verdict = await warden.vet(server.ref, fetched.tools);
+        const findings = [...verdict.findings];
+        let allow = verdict.allow, decidedBy = verdict.decidedBy, score = verdict.score;
+        if (fetched.instructions) {
+            // The same check wrap applies before passing initialize.instructions to the client.
+            const scan = await new Warden({ policy: opts.policy, gates: [new StaticScanGate()] })
+                .vet(server.ref, [{ name: 'initialize.instructions', description: fetched.instructions, inputSchema: { type: 'object' } }]);
+            for (const f of scan.findings)
+                findings.push({ ...f, tool: 'initialize.instructions' });
+            if (!scan.allow) {
+                if (allow)
+                    decidedBy = 'static-scan';
+                allow = false;
+            }
+            score *= scan.score;
+        }
+        if (lockMissing) {
+            findings.push(lockMissing);
+            if (allow)
+                decidedBy = 'lock';
+            allow = false;
+        }
+        let mtlDigest, mtlError;
+        try {
+            mtlDigest = mtlToolSetDigest(fetched.tools);
+        }
+        catch (err) {
+            mtlError = err instanceof MtlError ? err.code : String(err);
+        }
+        let histor;
+        if (opts.histor && server.ref.url) {
+            const target = historEndpoint(server.ref.url);
+            if (!target.endpoint)
+                histor = { notSent: target.reason };
+            else {
+                try {
+                    const answer = await historCheck(opts.historUrl, { endpoint: target.endpoint, ...(mtlDigest ? { toolSetDigest: mtlDigest } : {}) }, { fetchImpl: deps.historFetch, userAgent: `warden-scan/${version}` });
+                    histor = { match: String(answer.match), note: typeof answer.note === 'string' ? displaySafe(answer.note, 400) : undefined,
+                        page: answer.target?.page, unchangedSince: answer.observed?.unchangedSince, changes: answer.observed?.changes };
+                    if (answer.match === 'different')
+                        findings.push({ gate: 'histor', severity: 'medium', code: 'HISTOR_UNSEEN_TOOLSET', advisory: true,
+                            message: `HISTOR has never observed the tool set this server served you (${mtlDigest}). Either it changed after the last crawl, or it serves you something it does not serve the public crawler.` });
+                    if (answer.match === 'previously-observed')
+                        findings.push({ gate: 'histor', severity: 'low', code: 'HISTOR_OLDER_TOOLSET', advisory: true,
+                            message: 'HISTOR observed this tool set earlier, but the server now serves the public a different one.' });
+                    // The log's own classifier verdict on the set you were served, when it holds one: advisory, never a block.
+                    const cls = answer.classifier;
+                    if (answer.match === 'same' && cls && cls.status === 'classified' && Array.isArray(cls.findings)) {
+                        for (const f of cls.findings.slice(0, 50)) {
+                            const cats = Array.isArray(f.categories) ? f.categories.filter((c) => typeof c === 'string').slice(0, 4) : [];
+                            if (!cats.length || typeof f.tool !== 'string')
+                                continue;
+                            findings.push({ gate: 'histor', severity: 'medium', code: 'HISTOR_CLASSIFIER', advisory: true, tool: f.tool,
+                                message: `HISTOR's classifier (${displaySafe(String(cls.model ?? 'model'), 60)}) reads this tool as ${cats.map(c => displaySafe(c, 30)).join(', ')}: ${displaySafe(String(f.reason ?? ''), 300)}` });
+                        }
+                    }
+                }
+                catch (err) {
+                    histor = { error: displaySafe(err instanceof Error ? err.message : String(err), 200) };
+                }
+            }
+        }
+        let classifier;
+        if (opts.classifier && fetched.tools.length) {
+            try {
+                const verdicts = await classifyTools(fetched.tools, opts.classifier);
+                classifier = { model: opts.classifier.model, flagged: verdicts.length };
+                for (const v of verdicts) {
+                    const f = { gate: 'classifier', code: 'TOOL_DEF_CLASSIFIER', severity: v.severity, tool: v.tool,
+                        message: `Model ${displaySafe(opts.classifier.model, 60)} reads this tool as ${v.categories.join(', ')}: ${displaySafe(v.reason, 300)} — at "${displaySafe(v.quote, 200)}"` };
+                    if (!opts.classifier.blocks)
+                        f.advisory = true;
+                    findings.push(f);
+                    if (opts.classifier.blocks && blocking(f, opts.policy)) {
+                        if (allow)
+                            decidedBy = 'classifier';
+                        allow = false;
+                    }
+                }
+            }
+            catch (err) {
+                classifier = { model: opts.classifier.model, flagged: 0, error: displaySafe(err instanceof ClassifierError ? err.message : String(err), 200) };
+            }
+        }
+        let lock;
+        if (lockStore) {
+            const changes = diffTools(lockEntry?.tools, fetched.tools);
+            const drift = findings.some(f => f.code === 'TOOL_DEF_DRIFT' || f.code === 'SERVER_IDENTITY_DRIFT' || f.code === 'PIN_FORMAT_UPGRADE_REQUIRED' || (f.code === 'TOOL_DEF_UNCANONICAL' && !!lockEntry));
+            lock = { state: !lockEntry ? 'missing' : drift ? 'drift' : 'match', ...(changes.length && lockEntry ? { changes } : !lockEntry ? { changes } : {}) };
+        }
+        return { ...base, status: 'scanned', allow, decidedBy: allow ? undefined : decidedBy, score, findings,
+            allowedTools: verdict.allowedTools, blockedTools: verdict.blockedTools, toolCount: fetched.tools.length,
+            serverInfo: fetched.serverInfo, mtlDigest, mtlError, histor, classifier, lock, tools: fetched.tools,
+            ...(classifier && opts.classifier?.blocks ? { blockedTools: [...new Set([...verdict.blockedTools, ...findings.filter(f => f.gate === 'classifier' && !f.advisory && blocking(f, opts.policy)).map(f => f.tool)])] } : {}) };
+    });
+    let lockSummary;
+    if (opts.lock && lockStore) {
+        const ids = new Set(servers.filter(s => s.status !== 'skipped').map(s => s.id));
+        const stale = [...lockStore.entries.keys()].filter(id => !ids.has(id)).sort();
+        let written = false;
+        if (opts.updateLock) {
+            const next = {};
+            for (const s of servers) {
+                if (s.status === 'skipped')
+                    continue;
+                const previous = lockStore.entries.get(s.id);
+                if (s.status !== 'scanned' || !s.tools) {
+                    if (previous)
+                        next[s.id] = previous;
+                    if (s.lock)
+                        s.lock.state = 'refused';
+                    continue;
+                }
+                // Approve only what the non-pinning gates accept, as `pins approve` does.
+                const fresh = await Warden.create({ policy: opts.policy, threatFeed: feed, store: NO_PINS }).vet(serverRef(s, all), s.tools);
+                const instructionsBlocked = s.findings.some(f => f.tool === 'initialize.instructions' && blocking(f, opts.policy));
+                if (!fresh.allow || instructionsBlocked) {
+                    if (previous)
+                        next[s.id] = previous;
+                    s.lock = { ...(s.lock ?? { state: 'refused' }), state: 'refused' };
+                    continue;
+                }
+                const entry = lockEntryFor(serverRef(s, all), s.tools, s.mtlDigest, previous, now);
+                next[s.id] = entry;
+                const changed = !previous || previous.toolsHash !== entry.toolsHash || previous.identityHash !== entry.identityHash;
+                s.lock = { ...(s.lock ?? { state: 'updated' }), state: changed ? 'updated' : 'unchanged' };
+                // Once written, the server is reviewed: drop the findings that only said "not reviewed / drifted".
+                s.findings = s.findings.filter(f => !['LOCK_MISSING', 'TOOL_DEF_DRIFT', 'SERVER_IDENTITY_DRIFT', 'PIN_FORMAT_UPGRADE_REQUIRED', 'TOOL_DEF_UNPINNED'].includes(f.code));
+                s.allow = !s.findings.some(f => blocking(f, opts.policy));
+                if (s.allow) {
+                    s.decidedBy = undefined;
+                    s.blockedTools = fresh.blockedTools;
+                    s.allowedTools = fresh.allowedTools;
+                }
+            }
+            await writeLock(opts.lock, { lockfileVersion: LOCK_VERSION, generatedBy: `@aimarket/warden ${version}`, ruleset: staticScanRulesetRef(), servers: next });
+            written = true;
+        }
+        lockSummary = { path: opts.lock, stale: opts.updateLock ? [] : stale, written };
+    }
+    const summary = {
+        servers: servers.length,
+        scanned: servers.filter(s => s.status === 'scanned').length,
+        allowed: servers.filter(s => s.allow === true && s.status === 'scanned').length,
+        blocked: servers.filter(s => s.allow === false).length,
+        errors: servers.filter(s => s.status === 'error').length,
+        skipped: servers.filter(s => s.status === 'skipped').length,
+        launchOnly: servers.filter(s => s.status === 'launch-only').length,
+    };
+    return {
+        tool: 'warden-scan', version, scannedAt: now, ruleset: staticScanRulesetRef(), policy: opts.policy, launch: opts.launch,
+        sources: results.map(r => ({ path: r.source.path, client: r.source.client, scope: r.source.scope, servers: r.servers.length, ...(r.error ? { error: displaySafe(r.error, 300) } : {}) })),
+        servers, lock: lockSummary, summary,
+    };
+}
+function serverRef(s, all) {
+    const found = all.find(c => c.id === s.id && c.source === s.source && c.key === s.key);
+    return found.ref;
+}
+export function exitCode(report, opts) {
+    if (report.summary.blocked > 0)
+        return 1;
+    if (opts.failOnError && (report.summary.errors > 0 || report.sources.some(s => s.error)))
+        return 1;
+    return 0;
+}
+//# sourceMappingURL=scan.js.map

package/dist/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACjH,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAgF,MAAM,kBAAkB,CAAC;AAC/I,OAAO,EAAE,WAAW,EAAE,cAAc,EAAsB,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAoB,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,eAAe,EAA0B,MAAM,iBAAiB,CAAC;AACzF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAkD,MAAM,gBAAgB,CAAC;AAGvJ,MAAM,CAAC,MAAM,UAAU,GAAe,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAoFpF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;6CAUmB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;mCAkBjC,kBAAkB;;;;;;;;;;;;;aAaxC,CAAC;AAEd,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IACtF,MAAM,IAAI,GAAgB;QACxB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACnH,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,kBAAkB;QACzH,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ;KACpF,CAAC;IACF,IAAI,MAA4B,EAAE,UAA8B,CAAC;IACjE,IAAI,aAAiC,EAAE,eAAmC,EAAE,gBAAgB,GAAG,KAAK,CAAC;IACrG,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC1G,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAG,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAChE,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,WAAW;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,MAAM;YAC7C,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAe,CAAC;gBACnC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACrG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,MAAM;YACzB,CAAC;YACD,KAAK,OAAO;gBAAE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,MAAM;YACpD,KAAK,aAAa;gBAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;gBAAC,MAAM;YAC/C,KAAK,eAAe;gBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBAAC,MAAM;YACpD,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACvG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;gBAAC,MAAM;YAC5B,CAAC;YACD,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAC3F,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;gBAAC,MAAM;YAC9B,CAAC;YACD,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAa,CAAC;gBACjC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClG,MAAM,GAAG,CAAC,CAAC;gBAAC,MAAM;YACpB,CAAC;YACD,KAAK,UAAU;gBAAE,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;gBAAC,MAAM;YAChD,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,MAAM;YACtD,KAAK,eAAe;gBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBAAC,MAAM;YACpD,KAAK,aAAa;gBAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;gBAAC,MAAM;YACtD,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;gBAAC,MAAM;YAC7C,KAAK,YAAY;gBAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;gBAAC,MAAM;YACpD,KAAK,UAAU;gBAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBAAC,MAAM;YAC3C,KAAK,cAAc;gBAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;gBAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBAAC,MAAM;YAC5E,KAAK,kBAAkB;gBAAE,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;gBAAC,MAAM;YAC3D,KAAK,oBAAoB;gBAAE,eAAe,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;gBAAC,MAAM;YAC/D,KAAK,qBAAqB;gBAAE,gBAAgB,GAAG,IAAI,CAAC;gBAAC,MAAM;YAC3D,KAAK,QAAQ;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;gBAAC,MAAM;YAC3C,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,MAAM;YACxD,KAAK,YAAY;gBAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,MAAM;YAC9D,KAAK,aAAa;gBAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,MAAM;YAC/D,KAAK,iBAAiB;gBAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBAAC,MAAM;YACvD,KAAK,YAAY;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;gBAAC,MAAM;YAC7C,KAAK,QAAQ,CAAC;YAAC,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;YACrD,OAAO,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3C,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACtF,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IAC5I,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACjH,IAAI,UAAU,EAAE,CAAC;QACf,2FAA2F;QAC3F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACvG,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,CAAC,iBAAiB,EAAE,aAAa,EAAE,qBAAqB,EAAE,uBAAuB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;QAC1L,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;IACtE,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAClH,IAAI,gBAAgB,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC7H,IAAI,aAAa,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,QAAQ,KAAK,QAAQ,IAAI,EAAE,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC7G,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC9H,IAAI,CAAC,UAAU,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,yBAAyB,IAAI,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjJ,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACvG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,cAAe,SAAQ,KAAK;IAAG,gBAAgB,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;CAAE;AAElF,gFAAgF;AAEhF,MAAM,WAAW,GAAG,gEAAgE,CAAC;AACrF,MAAM,YAAY,GAAG,kHAAkH,CAAC;AAExI,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxG,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAAC,MAAwB;IACnD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,GAAG,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACzH,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC3G,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;QAAC,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5G,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,mBAAmB,CAAC;IAAC,CAAC;AACzC,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QAAC,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAAC,CAAC;IACzE,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACpG,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,iEAAiE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/J,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,mFAAmF;QACnF,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC3N,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IACrJ,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,IAAI,CAAO,KAAU,EAAE,CAAS,EAAE,EAA2B;IAC1E,MAAM,GAAG,GAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QAC7E,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAAC,CAAC;IACjF,CAAC,CAAC,CAAC,CAAC;IACJ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,KAAe,EAAY,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAC,CAAC;AAC9G,MAAM,OAAO,GAAa,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAC;AAEpF,SAAS,QAAQ,CAAC,CAAgB,EAAE,MAAoB;IACtD,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;AACrG,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAiB,EAAE,OAAiB,EAAE;IAClE,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,CAAC,GAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAC5H,IAAI,OAAuB,CAAC;IAC5B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAClH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/C,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,uEAAuE;QACvE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;YAAC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO;gBAAE,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QAAC,CAAC;QACxG,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,GAAG,EAAE,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAyB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;IAE7D,MAAM,GAAG,GAAuB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChE,+FAA+F;IAC/F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAA6B,EAAE;QAC5F,MAAM,IAAI,GAAqB;YAC7B,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK;YACjG,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;YACtF,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE;SACjF,CAAC;QACF,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAChE,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,WAAW,GAA8B,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YACvE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc;YACpD,OAAO,EAAE,WAAW,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,8HAA8H;SACzK,CAAC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS;gBACzH,QAAQ,EAAE,CAAC,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7J,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,CAAC,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACpF,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,QAAQ;gBAChG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC9H,CAAC;QAED,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;gBACnD,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAChK,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3G,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAClM,CAAC;QAED,MAAM,OAAO,GAAkB,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAChF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,oFAAoF;YACpF,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,EAAE,CAAC;iBAClF,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9H,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,IAAI,KAAK;oBAAE,SAAS,GAAG,aAAa,CAAC;gBAAC,KAAK,GAAG,KAAK,CAAC;YAAC,CAAC;YACzE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QACtB,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAAC,IAAI,KAAK;gBAAE,SAAS,GAAG,MAAM,CAAC;YAAC,KAAK,GAAG,KAAK,CAAC;QAAC,CAAC;QAE9F,IAAI,SAA6B,EAAE,QAA4B,CAAC;QAChE,IAAI,CAAC;YAAC,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACpD,OAAO,GAAG,EAAE,CAAC;YAAC,QAAQ,GAAG,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAE5E,IAAI,MAAiC,CAAC;QACtC,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,MAAM,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;iBACrD,CAAC;gBACJ,IAAI,CAAC;oBACH,MAAM,MAAM,GAAgB,MAAM,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC7I,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,eAAe,OAAO,EAAE,EAAE,CAAC,CAAC;oBACxE,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;wBACvH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;oBAClH,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW;wBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI;4BACjI,OAAO,EAAE,kEAAkE,SAAS,6GAA6G,EAAE,CAAC,CAAC;oBACvM,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB;wBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI;4BACvI,OAAO,EAAE,8FAA8F,EAAE,CAAC,CAAC;oBAC7G,2GAA2G;oBAC3G,MAAM,GAAG,GAAG,MAAM,CAAC,UAAmF,CAAC;oBACvG,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACjG,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAmC,EAAE,CAAC;4BAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC3H,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gCAAE,SAAS;4BACzD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;gCACzG,OAAO,EAAE,wBAAwB,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC,wBAAwB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;wBACzM,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBAAC,MAAM,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;gBAAC,CAAC;YAC3G,CAAC;QACH,CAAC;QAED,IAAI,UAA0C,CAAC;QAC/C,IAAI,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;gBACrE,UAAU,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACxE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,MAAM,CAAC,GAAkB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;wBAC5G,OAAO,EAAE,SAAS,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;oBAChL,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM;wBAAE,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;oBAC/C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACjB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;wBACvD,IAAI,KAAK;4BAAE,SAAS,GAAG,YAAY,CAAC;wBACpC,KAAK,GAAG,KAAK,CAAC;oBAChB,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,UAAU,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,YAAY,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACjJ,CAAC;QACH,CAAC;QAED,IAAI,IAA8B,CAAC;QACnC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,IAAI,KAAK,6BAA6B,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACtM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACvJ,CAAC;QAED,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ;YACnG,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YACvG,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;YACnG,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACjO,CAAC,CAAC,CAAC;IAEH,IAAI,WAA+B,CAAC;IACpC,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9E,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,GAA8B,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;oBAAE,SAAS;gBACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;oBAAC,IAAI,QAAQ;wBAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC;oBAAC,IAAI,CAAC,CAAC,IAAI;wBAAE,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAChI,0EAA0E;gBAC1E,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC7H,MAAM,mBAAmB,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,IAAI,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnH,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;oBAAC,IAAI,QAAQ;wBAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC;oBAAC,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAC/J,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACnF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;gBACnB,MAAM,OAAO,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC;gBACpH,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC3F,mGAAmG;gBACnG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC1D,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;oBAAC,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC;oBAAC,CAAC,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;oBAAC,CAAC,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;gBAAC,CAAC;YACrH,CAAC;YACD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,OAAO,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1J,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,WAAW,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;QAC3D,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;QAC/E,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,MAAM;QACtD,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM;QACxD,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;QAC3D,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,MAAM;KACnE,CAAC;IACF,OAAO;QACL,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;QACvH,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACzL,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAmB,EAAE,GAAuB;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;IACvF,OAAO,KAAM,CAAC,GAAG,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAkB,EAAE,IAAsC;IACjF,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACnG,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/static-scan.d.ts

@@ -69,7 +69,7 @@ type Surface = "name" | "description" | "inputSchema" | "title" | "outputSchema"
  *     autonomy phrasing (`autonomy`), and the zero-width joiner inside an emoji sequence. The
  *     hidden-character rule now also catches the Unicode-tag block and the bidi isolates.
  */
-export declare const STATIC_SCAN_RULESET_VERSION = "8";
+export declare const STATIC_SCAN_RULESET_VERSION = "10";
 export interface StaticScanRule {
     code: string;
     severity: Severity;

package/dist/static-scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static-scan.d.ts","sourceRoot":"","sources":["../src/static-scan.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,UAAU,EACV,QAAQ,EAER,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,KAAK,IAAI,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/B;;;;;;;;;;;;;;GAcG;AACH,KAAK,OAAO,GAAG,MAAM,GAAG,aAAa,GAAG,aAAa,GAAG,OAAO,GAAG,cAAc,GAAG,aAAa,GAAG,UAAU,CAAC;AA6vB9G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAQH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAmB/C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,IAAI,CAAC;IACX,iFAAiF;IACjF,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,2EAA2E;IAC3E,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,IAAI,iBAAiB,CAgBrD;AAOD,uEAAuE;AACvE,wBAAgB,oBAAoB,IAAI,UAAU,CAGjD;AAED,qBAAa,cAAe,YAAW,UAAU;IAC/C,QAAQ,CAAC,IAAI,iBAAiB;IAE9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC;;;;OAIG;gBACS,GAAG,GAAE,YAA6B;IAIxC,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAkFlE"}
+{"version":3,"file":"static-scan.d.ts","sourceRoot":"","sources":["../src/static-scan.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,UAAU,EACV,QAAQ,EAGR,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,KAAK,IAAI,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/B;;;;;;;;;;;;;;GAcG;AACH,KAAK,OAAO,GAAG,MAAM,GAAG,aAAa,GAAG,aAAa,GAAG,OAAO,GAAG,cAAc,GAAG,aAAa,GAAG,UAAU,CAAC;AA+5B9G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAQH,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAmBhD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,IAAI,CAAC;IACX,iFAAiF;IACjF,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,2EAA2E;IAC3E,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,IAAI,iBAAiB,CAgBrD;AAOD,uEAAuE;AACvE,wBAAgB,oBAAoB,IAAI,UAAU,CAGjD;AAED,qBAAa,cAAe,YAAW,UAAU;IAC/C,QAAQ,CAAC,IAAI,iBAAiB;IAE9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC;;;;OAIG;gBACS,GAAG,GAAE,YAA6B;IAIxC,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAoFlE"}