@aimarket/warden 0.9.0 → 0.13.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +36 -1
- package/README-es.md +36 -11
- package/README-fr.md +36 -11
- package/README-ru.md +38 -11
- package/README-zh.md +36 -11
- package/README.md +38 -11
- package/dist/classifier.d.ts +39 -10
- package/dist/classifier.d.ts.map +1 -1
- package/dist/classifier.js +241 -45
- package/dist/classifier.js.map +1 -1
- package/dist/encoded-text.d.ts +7 -0
- package/dist/encoded-text.d.ts.map +1 -0
- package/dist/encoded-text.js +63 -0
- package/dist/encoded-text.js.map +1 -0
- package/dist/fold.d.ts +1 -2
- package/dist/fold.d.ts.map +1 -1
- package/dist/fold.js +3 -2
- package/dist/fold.js.map +1 -1
- package/dist/histor.d.ts +39 -4
- package/dist/histor.d.ts.map +1 -1
- package/dist/histor.js +11 -7
- package/dist/histor.js.map +1 -1
- package/dist/index.d.ts +6 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +8 -4
- package/dist/index.js.map +1 -1
- package/dist/mcp-tools.d.ts.map +1 -1
- package/dist/mcp-tools.js +29 -4
- package/dist/mcp-tools.js.map +1 -1
- package/dist/pin-store.d.ts.map +1 -1
- package/dist/pin-store.js +1 -0
- package/dist/pin-store.js.map +1 -1
- package/dist/pinning.d.ts +1 -1
- package/dist/pinning.d.ts.map +1 -1
- package/dist/pinning.js +12 -4
- package/dist/pinning.js.map +1 -1
- package/dist/result-screen.d.ts +19 -0
- package/dist/result-screen.d.ts.map +1 -0
- package/dist/result-screen.js +86 -0
- package/dist/result-screen.js.map +1 -0
- package/dist/scan-lock.d.ts.map +1 -1
- package/dist/scan-lock.js +2 -1
- package/dist/scan-lock.js.map +1 -1
- package/dist/scan-report.d.ts.map +1 -1
- package/dist/scan-report.js +15 -0
- package/dist/scan-report.js.map +1 -1
- package/dist/scan.d.ts +40 -0
- package/dist/scan.d.ts.map +1 -1
- package/dist/scan.js +245 -25
- package/dist/scan.js.map +1 -1
- package/dist/static-scan.d.ts +4 -3
- package/dist/static-scan.d.ts.map +1 -1
- package/dist/static-scan.js +40 -9
- package/dist/static-scan.js.map +1 -1
- package/dist/toxic-flow.d.ts +33 -0
- package/dist/toxic-flow.d.ts.map +1 -0
- package/dist/toxic-flow.js +117 -0
- package/dist/toxic-flow.js.map +1 -0
- package/dist/types.d.ts +12 -0
- package/dist/types.d.ts.map +1 -1
- package/dist/wrap-cli.d.ts +3 -0
- package/dist/wrap-cli.d.ts.map +1 -1
- package/dist/wrap-cli.js +17 -6
- package/dist/wrap-cli.js.map +1 -1
- package/dist/wrap-state.js +2 -2
- package/dist/wrap-state.js.map +1 -1
- package/dist/wrap.d.ts.map +1 -1
- package/dist/wrap.js +20 -2
- package/dist/wrap.js.map +1 -1
- package/docs/scan.es.md +29 -14
- package/docs/scan.fr.md +29 -14
- package/docs/scan.md +29 -14
- package/docs/scan.ru.md +29 -14
- package/docs/scan.zh.md +29 -14
- package/docs/scanner-comparison.es.md +3 -12
- package/docs/scanner-comparison.fr.md +3 -13
- package/docs/scanner-comparison.md +3 -12
- package/docs/scanner-comparison.ru.md +3 -12
- package/docs/scanner-comparison.zh.md +3 -7
- package/docs/security-hardening-language-boundary.md +306 -0
- package/package.json +6 -3
- package/scripts/check-quality-gate.mjs +64 -0
- package/scripts/quality-public-key.pem +3 -0
package/dist/classifier.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"classifier.js","sourceRoot":"","sources":["../src/classifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAGrD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,sBAAsB,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,CAAU,CAAC;AAExH,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AACtD,MAAM,QAAQ,GAAG,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,SAAS,GAAG,GAAG,EAAE,UAAU,GAAG,GAAG,EAAE,YAAY,GAAG,GAAG,EAAE,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AACjI,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,wBAAwB,GACnC,mFAAmF;IACnF,kGAAkG;IAClG,iGAAiG;IACjG,6FAA6F;IAC7F,mCAAmC;IACnC,oGAAoG;IACpG,2FAA2F;IAC3F,0EAA0E;IAC1E,yGAAyG;IACzG,oGAAoG;IACpG,6FAA6F;IAC7F,2FAA2F;IAC3F,2BAA2B;IAC3B,6FAA6F;IAC7F,iEAAiE;IACjE,gGAAgG;IAChG,mDAAmD;IACnD,qFAAqF;IACrF,oGAAoG;IACpG,iGAAiG;IACjG,gCAAgC;IAChC,uDAAuD;IACvD,+EAA+E;IAC/E,0GAA0G;IAC1G,qDAAqD,CAAC;AAmBxD,MAAM,OAAO,eAAgB,SAAQ,KAAK;CAAG;AAE7C,qFAAqF;AACrF,SAAS,IAAI,CAAC,IAAY,EAAE,KAAa;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,iDAAiD,EAAE,GAAG,CAAC,CAAC;IACnF,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,gBAAgB,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAyB;IACnD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG;YAAE,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7I,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAkC;IAC/E,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,gCAAgC,CAAC,CAAC;IAAC,CAAC;IACzG,MAAM,GAAG,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,yCAAyC,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QAChD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM;YAAE,SAAS;QAC5F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,SAAS;QAC3C,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAA2B,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAK,qBAA2C,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxK,IAAI,CAAC,UAAU,CAAC,MAAM;YAAE,SAAS;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAK,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAyC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnK,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ;YACnE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,IAAI,CAAC,GAAQ,EAAE,IAAY,EAAE,OAA+B,EAAE,SAAiB;IACtF,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,IAAI,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,gCAAgC,CAAC,CAAC,CAAC;IACtF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,EAAE;YAC5I,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;gBAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,eAAe,CAAC,mCAAmC,GAAG,CAAC,UAAU,iBAAiB,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC3L,MAAM,MAAM,GAAa,EAAE,CAAC;YAAC,IAAI,KAAK,GAAG,CAAC,CAAC;YAC3C,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,GAAG,kBAAkB,GAAG,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,eAAe,CAAC,+BAA+B,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnM,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5G,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9F,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAyB,EAAE,IAAuB;IACpF,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,eAAe,KAAK,EAAE,EAAE,GAAG,GAAG,aAAa,KAAK,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,mEAAmE,KAAK,QAAQ,GAAG,IAAI;QAClG,iFAAiF,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC;IAC/H,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QACzH,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACxG,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;IAC5F,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC3G,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,eAAe,CAAC,4BAA4B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5F,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QAAC,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA8D,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC;IAAC,CAAC;IACpI,MAAM,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,kCAAkC,CAAC,CAAC;IAAC,CAAC;IACxE,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,4CAA4C,CAAC,CAAC;IACzG,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,kBAAkB;QAAE,MAAM,IAAI,eAAe,CAAC,6BAA6B,CAAC,CAAC;IAC9G,iEAAiE;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAyB,EAAE,IAAuB;IACpF,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,gBAAgB;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACtI,OAAO,GAAG,CAAC;AACb,CAAC"}
|
|
1
|
+
{"version":3,"file":"classifier.js","sourceRoot":"","sources":["../src/classifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAGxC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,sBAAsB,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAEtI,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AACtD,MAAM,QAAQ,GAAG,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,SAAS,GAAG,GAAG,EAAE,UAAU,GAAG,GAAG,EAAE,YAAY,GAAG,GAAG,EAAE,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AACjI,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC,MAAM,CAAC,MAAM,wBAAwB,GACnC,mFAAmF;IACnF,kGAAkG;IAClG,iGAAiG;IACjG,6FAA6F;IAC7F,mCAAmC;IACnC,oGAAoG;IACpG,2FAA2F;IAC3F,0EAA0E;IAC1E,kIAAkI;IAClI,oGAAoG;IACpG,6FAA6F;IAC7F,2FAA2F;IAC3F,2BAA2B;IAC3B,6FAA6F;IAC7F,iEAAiE;IACjE,gGAAgG;IAChG,mDAAmD;IACnD,mFAAmF;IACnF,sHAAsH;IACtH,oGAAoG;IACpG,iGAAiG;IACjG,wJAAwJ;IACxJ,mJAAmJ;IACnJ,uLAAuL;IACvL,mKAAmK;IACnK,+IAA+I;IAC/I,mHAAmH;IACnH,yIAAyI;IACzI,wHAAwH;IACxH,qHAAqH;IACrH,gGAAgG;IAChG,yIAAyI;IACzI,oGAAoG;IACpG,wKAAwK;IACxK,kDAAkD;IAClD,oEAAoE;IACpE,6FAA6F;IAC7F,iCAAiC,CAAC;AA+BpC,MAAM,OAAO,eAAgB,SAAQ,KAAK;CAAG;AAC7C,+FAA+F;AAC/F,MAAM,oBAAqB,SAAQ,eAAe;CAAG;AAErD,qFAAqF;AACrF,SAAS,IAAI,CAAC,IAAY,EAAE,KAAa;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,iDAAiD,EAAE,GAAG,CAAC,CAAC;IACnF,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,gBAAgB,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAyB;IACnD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,MAAM,MAAM,GAA0E,EAAE,CAAC;QACzF,kFAAkF;QAClF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,MAAM,KAAK,GAAG,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YACnF,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACvC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,GAAG;YAAE,SAAS,EAAE,CAAC;QACrB,0EAA0E;QAC1E,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAC7D,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAkC,EAAE,eAAe,GAAG,KAAK;IACxG,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,gCAAgC,CAAC,CAAC;IAAC,CAAC;IACzG,MAAM,MAAM,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAA8B,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3G,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,yCAAyC,CAAC,CAAC;IAC9F,IAAI,GAAG,CAAC,MAAM,GAAG,YAAY;QAAE,MAAM,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QACjG,MAAM,IAAI,eAAe,CAAC,iCAAiC,CAAC,CAAC;IAC/D,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAClG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC;YACvH,MAAM,IAAI,eAAe,CAAC,8CAA8C,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC;QACjG,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM;YAC/E,MAAM,IAAI,eAAe,CAAC,8CAA8C,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC9E,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAE,qBAA2C,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACrF,MAAM,IAAI,eAAe,CAAC,2CAA2C,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAE,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YACzF,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU;YAChF,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS;YAC9E,MAAM,IAAI,eAAe,CAAC,yCAAyC,CAAC,CAAC;QACvE,IAAI,eAAe,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;YACzF,MAAM,IAAI,eAAe,CAAC,+CAA+C,CAAC,CAAC;QAC7E,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAyB;YACvH,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,QAAyC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,IAAI,CAAC,GAAQ,EAAE,IAAY,EAAE,OAA+B,EAAE,SAAiB;IACtF,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,IAAI,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,gCAAgC,CAAC,CAAC,CAAC;IACtF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,EAAE;YAC5I,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;gBAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,eAAe,CAAC,mCAAmC,GAAG,CAAC,UAAU,iBAAiB,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC3L,MAAM,MAAM,GAAa,EAAE,CAAC;YAAC,IAAI,KAAK,GAAG,CAAC,CAAC;YAC3C,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,GAAG,kBAAkB,GAAG,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,eAAe,CAAC,+BAA+B,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnM,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5G,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9F,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8DAA8D;AAC9D,KAAK,UAAU,YAAY,CAAC,KAAyB,EAAE,IAAuB;IAC5E,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,eAAe,IAAI,SAAS;QAAE,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,yDAAyD,CAAC,CAAC;IACxI,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,eAAe,KAAK,EAAE,EAAE,GAAG,GAAG,aAAa,KAAK,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,mEAAmE,KAAK,QAAQ,GAAG,IAAI;QAClG,iFAAiF,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC;IAC/H,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QACzH,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACxG,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;IAC5F,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC3G,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,eAAe,CAAC,4BAA4B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5F,IAAI,OAAgB,CAAC;IACrB,IAAI,YAAqB,CAAC;IAC1B,IAAI,KAAyE,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACnD,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,GAAG,MAAM,EAAE,aAAa,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,oBAAoB,CAAC,kCAAkC,CAAC,CAAC;IAAC,CAAC;IAC/E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,kBAAkB;QAAE,MAAM,IAAI,eAAe,CAAC,6BAA6B,CAAC,CAAC;IAC7I,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE;QACnE,YAAY,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;QAClI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1G,CAAC,CAAC;IACH,IAAI,YAAY,KAAK,QAAQ;QAAE,MAAM,IAAI,oBAAoB,CAAC,wCAAwC,CAAC,CAAC;IACxG,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM;QAChF,MAAM,IAAI,eAAe,CAAC,sCAAsC,CAAC,CAAC;IACpE,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,oBAAoB,CAAC,4CAA4C,CAAC,CAAC;IAC9G,iEAAiE;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC;AASD,yFAAyF;AACzF,mGAAmG;AACnG,MAAM,YAAY,GAAG,IAAI,OAAO,EAA6C,CAAC;AAC9E,MAAM,UAAU,GAAG,CAAC,IAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9G,MAAM,UAAU,mBAAmB,CAAC,MAAwC,EAAE,IAAa;IACzF,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAClG,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3F,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,OAAuC,EAAE,eAAe,GAAG,IAAI;IAC9G,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,gCAAgC,CAAC,CAAC;IAAC,CAAC;IACzG,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;IACrG,mFAAmF;IACnF,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC7H,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,YAAY;QAAE,MAAM,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC;IAC/H,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0C,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM;YAC3F,MAAM,IAAI,eAAe,CAAC,0CAA0C,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAyB,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAClF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,IAAI,IAAI,EAAE,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;YACxF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACnB,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW;gBAAE,MAAM,IAAI,eAAe,CAAC,iCAAiC,CAAC,CAAC;YAC5F,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;oBACrF,MAAM,IAAI,eAAe,CAAC,gDAAgD,CAAC,CAAC;gBAC9E,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;gBAC9E,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAE,qBAA4C,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACpF,MAAM,IAAI,eAAe,CAAC,2BAA2B,CAAC,CAAC;YACzD,IAAI,CAAE,UAAiC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;YAC5G,MAAM,MAAM,GAAG,CAAC,CAAC,MAA0D,CAAC;YAC5E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CACnG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,2BAA2B,CAAC,CAAC;YACrH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC,QAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAyB;gBACnG,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,QAAyC;gBAC5E,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sCAAsC,EAAE,UAAU,CAAC,CAAC,IAAI;gBAClI,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClI,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAAC,CAAC;IAC/H,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAyB,EAAE,IAAuB;IACnF,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,6FAA6F;IAC7F,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,IAAI,UAAU;QAAE,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CACzE,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,GAAG,GAAyB,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,eAAe,IAAI,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,SAAS;YAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC,CAAC;;YACpL,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACvE,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACpG,IAAI,SAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC;gBAAC,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC;YAAC,CAAC;YACvG,OAAO,GAAG,EAAE,CAAC;gBAAC,MAAM,IAAI,oBAAoB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;YAAC,CAAC;QACxG,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;YACX,sFAAsF;YACtF,IAAI,CAAC,CAAC,GAAG,YAAY,oBAAoB,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC7I,SAAS;YACX,CAAC;YACD,SAAS,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/H,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACxF,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC;YACrC,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,EAAE,IAAI,CAAC,CAAC;gBACxD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC;gBAC7F,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;gBACnE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;YAAC,CAAC;QACzI,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACjF,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAyB,EAAE,IAAuB;IACpF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACtH,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AACD,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC"}
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Preserve the original as a separate scanner pass. Decoding changes a reading,
|
|
3
|
+
* never the tool, its pin, or what gets executed. Invalid encodings remain literal.
|
|
4
|
+
* Replacement cannot grow the input; per-token and aggregate budgets bound work.
|
|
5
|
+
*/
|
|
6
|
+
export declare function decodeForScan(text: string): string;
|
|
7
|
+
//# sourceMappingURL=encoded-text.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"encoded-text.d.ts","sourceRoot":"","sources":["../src/encoded-text.ts"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiClD"}
|
|
@@ -0,0 +1,63 @@
|
|
|
1
|
+
/** Bounded, non-executing readings of encoded text. No language vocabulary. */
|
|
2
|
+
const MAX_TOKEN = 8192;
|
|
3
|
+
const MAX_DECODED = 65536;
|
|
4
|
+
const MAX_PASSES = 4;
|
|
5
|
+
const ENTITIES = {
|
|
6
|
+
amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", colon: ':', sol: '/',
|
|
7
|
+
bsol: '\\', tab: '\t', newline: '\n', nbsp: ' ',
|
|
8
|
+
};
|
|
9
|
+
const utf8 = new TextDecoder('utf-8', { fatal: true });
|
|
10
|
+
function point(raw, radix, fallback) {
|
|
11
|
+
const n = Number.parseInt(raw, radix);
|
|
12
|
+
return n > 0 && n <= 0x10ffff && !(n >= 0xd800 && n <= 0xdfff) ? String.fromCodePoint(n) : fallback;
|
|
13
|
+
}
|
|
14
|
+
/**
|
|
15
|
+
* Preserve the original as a separate scanner pass. Decoding changes a reading,
|
|
16
|
+
* never the tool, its pin, or what gets executed. Invalid encodings remain literal.
|
|
17
|
+
* Replacement cannot grow the input; per-token and aggregate budgets bound work.
|
|
18
|
+
*/
|
|
19
|
+
export function decodeForScan(text) {
|
|
20
|
+
let out = text;
|
|
21
|
+
let budget = MAX_DECODED;
|
|
22
|
+
for (let pass = 0; pass < MAX_PASSES; pass++) {
|
|
23
|
+
const before = out;
|
|
24
|
+
const replace = (whole, decoded) => {
|
|
25
|
+
if (whole.length > MAX_TOKEN || whole.length > budget || decoded.length > whole.length)
|
|
26
|
+
return whole;
|
|
27
|
+
budget -= whole.length;
|
|
28
|
+
return decoded;
|
|
29
|
+
};
|
|
30
|
+
out = out.replace(/&#(?:x([0-9a-f]{1,6})|([0-9]{1,7}));|&(amp|lt|gt|quot|apos|colon|sol|bsol|Tab|NewLine|nbsp);/gi, (whole, hex, decimal, named) => replace(whole, named ? ENTITIES[named.toLowerCase()] ?? whole : point(hex ?? decimal, hex ? 16 : 10, whole)));
|
|
31
|
+
out = out.replace(/(?<!\\)\\{1,8}(?:u\{([0-9a-f]{1,6})\}|u([0-9a-f]{4})|x([0-9a-f]{2}))/gi, (whole, brace, unit, hex) => replace(whole, brace ? point(brace, 16, whole) : String.fromCharCode(Number.parseInt(unit ?? hex, 16))));
|
|
32
|
+
out = out.replace(/(?:%[0-9a-f]{2})+/gi, whole => {
|
|
33
|
+
if (whole.length > MAX_TOKEN || whole.length > budget)
|
|
34
|
+
return whole;
|
|
35
|
+
try {
|
|
36
|
+
return replace(whole, decodeURIComponent(whole));
|
|
37
|
+
}
|
|
38
|
+
catch {
|
|
39
|
+
return whole;
|
|
40
|
+
}
|
|
41
|
+
});
|
|
42
|
+
out = out.replace(/(?<![A-Za-z0-9+/_=-])[A-Za-z0-9+/_-]{24,}={0,2}(?![A-Za-z0-9+/_=-])/g, whole => {
|
|
43
|
+
if (whole.length > MAX_TOKEN || whole.length > budget || whole.replace(/=+$/, '').length % 4 === 1)
|
|
44
|
+
return whole;
|
|
45
|
+
try {
|
|
46
|
+
const buffer = Buffer.from(whole, 'base64url');
|
|
47
|
+
if (buffer.toString('base64url') !== whole.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, ''))
|
|
48
|
+
return whole;
|
|
49
|
+
const decoded = utf8.decode(buffer);
|
|
50
|
+
if (/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(decoded) || !/\p{L}[\s\S]*\p{L}/u.test(decoded))
|
|
51
|
+
return whole;
|
|
52
|
+
return replace(whole, decoded);
|
|
53
|
+
}
|
|
54
|
+
catch {
|
|
55
|
+
return whole;
|
|
56
|
+
}
|
|
57
|
+
});
|
|
58
|
+
if (out === before || budget <= 0)
|
|
59
|
+
break;
|
|
60
|
+
}
|
|
61
|
+
return out;
|
|
62
|
+
}
|
|
63
|
+
//# sourceMappingURL=encoded-text.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"encoded-text.js","sourceRoot":"","sources":["../src/encoded-text.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,QAAQ,GAA2B;IACvC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACtE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG;CAChD,CAAC;AACF,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvD,SAAS,KAAK,CAAC,GAAW,EAAE,KAAa,EAAE,QAAgB;IACzD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,IAAI,MAAM,GAAG,WAAW,CAAC;IACzB,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC;QACnB,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,OAAe,EAAU,EAAE;YACzD,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YACrG,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QACF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gGAAgG,EAChH,CAAC,KAAK,EAAE,GAAuB,EAAE,OAA2B,EAAE,KAAyB,EAAE,EAAE,CACzF,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,OAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACnH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,wEAAwE,EACxF,CAAC,KAAK,EAAE,KAAyB,EAAE,IAAwB,EAAE,GAAuB,EAAE,EAAE,CACtF,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9G,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,CAAC,EAAE;YAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;gBAAE,OAAO,KAAK,CAAC;YACpE,IAAI,CAAC;gBAAC,OAAO,OAAO,CAAC,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;QACnF,CAAC,CAAC,CAAC;QACH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,sEAAsE,EAAE,KAAK,CAAC,EAAE;YAChG,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjH,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;gBAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACpH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,gDAAgD,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACxH,OAAO,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,IAAI,GAAG,KAAK,MAAM,IAAI,MAAM,IAAI,CAAC;YAAE,MAAM;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
|
package/dist/fold.d.ts
CHANGED
|
@@ -28,8 +28,7 @@
|
|
|
28
28
|
* The fold is part of the published ruleset (FOLD_ID is in its digest): the same
|
|
29
29
|
* regexes over folded and unfolded text are different scans.
|
|
30
30
|
*/
|
|
31
|
-
|
|
32
|
-
export declare const FOLD_ID = "nfkc+tags-decoded+invisible-stripped+mixed-script-confusables/1";
|
|
31
|
+
export declare const FOLD_ID = "escapes+entities+percent+base64/4x64k+nfkc+tags+invisible+confusables/2";
|
|
33
32
|
/**
|
|
34
33
|
* Fold `text` for matching. Never shown to anyone: findings quote the folded span,
|
|
35
34
|
* and the raw text is what the hidden-character rules and the reader see.
|
package/dist/fold.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fold.d.ts","sourceRoot":"","sources":["../src/fold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;
|
|
1
|
+
{"version":3,"file":"fold.d.ts","sourceRoot":"","sources":["../src/fold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,eAAO,MAAM,OAAO,4EAA4E,CAAC;AAuCjG;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBhD"}
|
package/dist/fold.js
CHANGED
|
@@ -29,7 +29,8 @@
|
|
|
29
29
|
* regexes over folded and unfolded text are different scans.
|
|
30
30
|
*/
|
|
31
31
|
/** Identity of this fold, carried in the ruleset preimage. Bump on any change below. */
|
|
32
|
-
|
|
32
|
+
import { decodeForScan } from "./encoded-text.js";
|
|
33
|
+
export const FOLD_ID = "escapes+entities+percent+base64/4x64k+nfkc+tags+invisible+confusables/2";
|
|
33
34
|
/**
|
|
34
35
|
* Characters with no visible form in running text. Dropped by the fold; the
|
|
35
36
|
* hidden-character rule reports them from the raw text.
|
|
@@ -67,7 +68,7 @@ const CONFUSABLE_RE = new RegExp(`[${Object.keys(CONFUSABLE).join("")}]`, "gu");
|
|
|
67
68
|
export function foldForScan(text) {
|
|
68
69
|
if (!text)
|
|
69
70
|
return text;
|
|
70
|
-
let out = text.normalize("NFKC");
|
|
71
|
+
let out = decodeForScan(text.normalize("NFKC")).normalize("NFKC");
|
|
71
72
|
out = out.replace(TAG_RE, (ch) => String.fromCharCode((ch.codePointAt(0) ?? 0xe0020) - 0xe0000));
|
|
72
73
|
out = out.replace(INVISIBLE_RE, "");
|
|
73
74
|
CONFUSABLE_RE.lastIndex = 0;
|
package/dist/fold.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fold.js","sourceRoot":"","sources":["../src/fold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,wFAAwF;AACxF,MAAM,CAAC,MAAM,OAAO,GAAG,
|
|
1
|
+
{"version":3,"file":"fold.js","sourceRoot":"","sources":["../src/fold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,wFAAwF;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,CAAC,MAAM,OAAO,GAAG,yEAAyE,CAAC;AAEjG;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,iGAAiG;IAC/F,yFAAyF;IACzF,kCAAkC,EACpC,IAAI,CACL,CAAC;AAEF,8DAA8D;AAC9D,MAAM,MAAM,GAAG,yBAAyB,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,GAA2B;IACzC,sBAAsB;IACtB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAChD,sBAAsB;IACtB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC5B,QAAQ;IACR,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IACxF,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;CAC3D,CAAC;AAEF,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACnC,MAAM,QAAQ,GAAG,UAAU,CAAC;AAC5B,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAEhF;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IACjG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACzC,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;QACnC,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,4EAA4E;QAC5E,wCAAwC;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC7D,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,yDAAyD;AAC7F,CAAC"}
|
package/dist/histor.d.ts
CHANGED
|
@@ -2,9 +2,11 @@
|
|
|
2
2
|
* HISTOR — the public transparency log of MCP tool definitions
|
|
3
3
|
* (https://histor.modelmarket.dev, source github.com/alexar76/histor).
|
|
4
4
|
*
|
|
5
|
-
* `scan --histor` asks the log one question per
|
|
6
|
-
*
|
|
7
|
-
*
|
|
5
|
+
* `scan --histor` asks the log one question per server: is the tool set this
|
|
6
|
+
* machine was served the one the log observes for everyone? The request carries
|
|
7
|
+
* the server's endpoint — or, for a stdio server started from npm or PyPI, the
|
|
8
|
+
* package name (`npm:<name>`, `pypi:<name>`), which the log runs in a sandbox —
|
|
9
|
+
* and the MTL/1 digest of the set, nothing else:
|
|
8
10
|
* no tool description ever leaves the machine, and the log cannot learn what a
|
|
9
11
|
* private server advertises. The answer is signed by the log and says `same`,
|
|
10
12
|
* `different` (you were served something the log never saw: a targeted
|
|
@@ -17,6 +19,8 @@ export declare const HISTOR_RESPONSE_BYTES: number;
|
|
|
17
19
|
export type HistorMatch = 'same' | 'different' | 'previously-observed' | 'not-listed' | 'not-observed' | 'no-digest' | 'undigestible';
|
|
18
20
|
export interface HistorQuery {
|
|
19
21
|
endpoint?: string;
|
|
22
|
+
/** A stdio server's package: `npm:<name>` or `pypi:<name>` (see `historPackage`). */
|
|
23
|
+
package?: string;
|
|
20
24
|
name?: string;
|
|
21
25
|
/** `sha256-<base64>` from {@link mtlToolSetDigest}. */
|
|
22
26
|
toolSetDigest?: string;
|
|
@@ -34,6 +38,27 @@ export interface HistorCheck {
|
|
|
34
38
|
badge?: string;
|
|
35
39
|
lastStatus?: string;
|
|
36
40
|
listed?: boolean;
|
|
41
|
+
packageVersion?: string;
|
|
42
|
+
/** What the registry says about the version HISTOR observed, and what changed since the one before. */
|
|
43
|
+
packageSignals?: {
|
|
44
|
+
version?: string;
|
|
45
|
+
previousVersion?: string;
|
|
46
|
+
provenance?: boolean;
|
|
47
|
+
publisher?: string | null;
|
|
48
|
+
previousPublisher?: string;
|
|
49
|
+
installScripts?: string[];
|
|
50
|
+
newDependencies?: string[];
|
|
51
|
+
flags?: string[];
|
|
52
|
+
/** What the package did in HISTOR's gVisor sandbox, per phase. */
|
|
53
|
+
behaviour?: Record<string, PackageBehaviour | unknown>;
|
|
54
|
+
};
|
|
55
|
+
};
|
|
56
|
+
/** The popular package this package's name imitates, for any package asked about. */
|
|
57
|
+
packageLookalike?: {
|
|
58
|
+
of?: string;
|
|
59
|
+
weekly?: number;
|
|
60
|
+
how?: string;
|
|
61
|
+
ownWeekly?: number;
|
|
37
62
|
};
|
|
38
63
|
observed?: {
|
|
39
64
|
toolSetDigest?: string;
|
|
@@ -55,6 +80,16 @@ export interface HistorCheck {
|
|
|
55
80
|
};
|
|
56
81
|
[field: string]: unknown;
|
|
57
82
|
}
|
|
83
|
+
/** One phase of a package's run in HISTOR's sandbox: install scripts, startup, or the canary tool calls. */
|
|
84
|
+
export interface PackageBehaviour {
|
|
85
|
+
exec?: string[];
|
|
86
|
+
network?: string[];
|
|
87
|
+
lookups?: string[];
|
|
88
|
+
decoys?: string[];
|
|
89
|
+
writes?: string[];
|
|
90
|
+
packages?: string[];
|
|
91
|
+
tools?: number;
|
|
92
|
+
}
|
|
58
93
|
export interface HistorOptions {
|
|
59
94
|
timeoutMs?: number;
|
|
60
95
|
fetchImpl?: typeof fetch;
|
|
@@ -62,7 +97,7 @@ export interface HistorOptions {
|
|
|
62
97
|
}
|
|
63
98
|
export declare class HistorError extends Error {
|
|
64
99
|
}
|
|
65
|
-
/** POST /api/v1/check with endpoint/name + digest only. */
|
|
100
|
+
/** POST /api/v1/check with endpoint/package/name + digest only. */
|
|
66
101
|
export declare function historCheck(base: string, query: HistorQuery, opts?: HistorOptions): Promise<HistorCheck>;
|
|
67
102
|
/** Read a response body up to `limit` bytes; refuse a longer one. */
|
|
68
103
|
export declare function readBounded(res: Response, limit: number): Promise<string>;
|
package/dist/histor.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"histor.d.ts","sourceRoot":"","sources":["../src/histor.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"histor.d.ts","sourceRoot":"","sources":["../src/histor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AACnE,eAAO,MAAM,qBAAqB,QAAa,CAAC;AAEhD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,WAAW,GAAG,qBAAqB,GAAG,YAAY,GAAG,cAAc,GAAG,WAAW,GAAG,cAAc,CAAC;AAEtI,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACtJ,uGAAuG;QACvG,cAAc,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YAClN,kEAAkE;YAClE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,CAAA;SAAE,CAAA;KAAE,CAAC;IAC/D,qFAAqF;IACrF,gBAAgB,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjM,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,4GAA4G;AAC5G,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,WAAY,SAAQ,KAAK;CAAG;AAEzC,mEAAmE;AACnE,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CA6BlH;AAED,qEAAqE;AACrE,wBAAsB,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU/E"}
|
package/dist/histor.js
CHANGED
|
@@ -2,9 +2,11 @@
|
|
|
2
2
|
* HISTOR — the public transparency log of MCP tool definitions
|
|
3
3
|
* (https://histor.modelmarket.dev, source github.com/alexar76/histor).
|
|
4
4
|
*
|
|
5
|
-
* `scan --histor` asks the log one question per
|
|
6
|
-
*
|
|
7
|
-
*
|
|
5
|
+
* `scan --histor` asks the log one question per server: is the tool set this
|
|
6
|
+
* machine was served the one the log observes for everyone? The request carries
|
|
7
|
+
* the server's endpoint — or, for a stdio server started from npm or PyPI, the
|
|
8
|
+
* package name (`npm:<name>`, `pypi:<name>`), which the log runs in a sandbox —
|
|
9
|
+
* and the MTL/1 digest of the set, nothing else:
|
|
8
10
|
* no tool description ever leaves the machine, and the log cannot learn what a
|
|
9
11
|
* private server advertises. The answer is signed by the log and says `same`,
|
|
10
12
|
* `different` (you were served something the log never saw: a targeted
|
|
@@ -16,17 +18,19 @@ export const DEFAULT_HISTOR_URL = 'https://histor.modelmarket.dev';
|
|
|
16
18
|
export const HISTOR_RESPONSE_BYTES = 256 * 1024;
|
|
17
19
|
export class HistorError extends Error {
|
|
18
20
|
}
|
|
19
|
-
/** POST /api/v1/check with endpoint/name + digest only. */
|
|
21
|
+
/** POST /api/v1/check with endpoint/package/name + digest only. */
|
|
20
22
|
export async function historCheck(base, query, opts = {}) {
|
|
21
23
|
const root = new URL(base);
|
|
22
24
|
if (root.protocol !== 'https:' && root.protocol !== 'http:')
|
|
23
25
|
throw new HistorError('HISTOR URL must be http(s)');
|
|
24
|
-
if (!query.endpoint && !query.name)
|
|
25
|
-
throw new HistorError('a HISTOR check needs an endpoint or a name');
|
|
26
|
-
// Only these
|
|
26
|
+
if (!query.endpoint && !query.package && !query.name)
|
|
27
|
+
throw new HistorError('a HISTOR check needs an endpoint, a package or a name');
|
|
28
|
+
// Only these fields, ever. `tools` and `contribute` are deliberately not forwarded.
|
|
27
29
|
const body = {};
|
|
28
30
|
if (query.endpoint)
|
|
29
31
|
body.endpoint = query.endpoint;
|
|
32
|
+
else if (query.package)
|
|
33
|
+
body.package = query.package;
|
|
30
34
|
if (query.name)
|
|
31
35
|
body.name = query.name;
|
|
32
36
|
if (query.toolSetDigest)
|
package/dist/histor.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"histor.js","sourceRoot":"","sources":["../src/histor.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"histor.js","sourceRoot":"","sources":["../src/histor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC;AAkDhD,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAEzC,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,KAAkB,EAAE,OAAsB,EAAE;IAC1F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,4BAA4B,CAAC,CAAC;IACjH,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,MAAM,IAAI,WAAW,CAAC,uDAAuD,CAAC,CAAC;IACrI,oFAAoF;IACpF,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,QAAQ;QAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;SAC9C,IAAI,KAAK,CAAC,OAAO;QAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IACrD,IAAI,KAAK,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACvC,IAAI,KAAK,CAAC,aAAa;QAAE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE;YAC/C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO;YAC5D,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,IAAI,aAAa,EAAE;YAC1H,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAC3D,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,WAAW,CAAC,0BAA0B,CAAC,CAAC;QAAC,CAAC;QAC/F,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAQ,MAAsB,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,WAAW,CAAC,kCAAkC,CAAC,CAAC;QAC1J,OAAO,MAAqB,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,WAAW;YAAE,MAAM,GAAG,CAAC;QAC1C,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxJ,CAAC;YAAS,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;AACpC,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAa,EAAE,KAAa;IAC5D,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,CAAC,IAA4C,EAAE,CAAC;QAC3E,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAAC,MAAM,IAAI,WAAW,CAAC,oBAAoB,KAAK,QAAQ,CAAC,CAAC;QAAC,CAAC;QACzH,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,6 +1,9 @@
|
|
|
1
1
|
import type { McpServerRef, PinStore, ToolDef, WardenGate, WardenLogger, WardenPolicy, WardenVerdict } from "./types.js";
|
|
2
2
|
import { ThreatFeed } from "./threat-feed.js";
|
|
3
|
+
import { type ClassifierInspection } from "./classifier.js";
|
|
3
4
|
export { StaticScanGate, staticScanRuleset, staticScanRulesetRef, STATIC_SCAN_RULESET_VERSION, } from "./static-scan.js";
|
|
5
|
+
export { inspectTools } from "./classifier.js";
|
|
6
|
+
export type { ClassifierOptions, ClassifierInspection, ClassifierFinding } from "./classifier.js";
|
|
4
7
|
export { PinningGate, canonicalToolsHash, tryCanonicalToolsHash, pinToolsHash, RFC8785_PIN_PREFIX, serverIdentityHash, UNCANONICAL_TOOLS_HASH } from "./pinning.js";
|
|
5
8
|
export { FilePinStore } from "./pin-store.js";
|
|
6
9
|
export { OriginGate } from "./origin.js";
|
|
@@ -21,6 +24,8 @@ export interface WardenInit {
|
|
|
21
24
|
log?: WardenLogger;
|
|
22
25
|
}
|
|
23
26
|
export interface WardenCreateDeps {
|
|
27
|
+
/** Local complete inspection; clears only readable BASE64_BLOB / structured quotation ambiguity on identical tools. */
|
|
28
|
+
semanticReview?: ClassifierInspection;
|
|
24
29
|
store: PinStore;
|
|
25
30
|
policy: WardenPolicy;
|
|
26
31
|
/**
|
|
@@ -96,7 +101,7 @@ export declare class Warden {
|
|
|
96
101
|
* Record the user's approval: pin the current tool defs so future drift is
|
|
97
102
|
* detected. Idempotent — re-approving just refreshes the snapshot.
|
|
98
103
|
*/
|
|
99
|
-
approve(server: McpServerRef, tools: ToolDef[]): Promise<void>;
|
|
104
|
+
approve(server: McpServerRef, tools: ToolDef[], approvalMode?: "operator" | "automatic"): Promise<void>;
|
|
100
105
|
/**
|
|
101
106
|
* A tool is blocked if a finding naming it reaches the block threshold.
|
|
102
107
|
* Sensitive tools (per policy) stay allowed but are surfaced as flagged so the
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EAEZ,QAAQ,EAER,OAAO,EAEP,UAAU,EAEV,YAAY,EACZ,YAAY,EACZ,aAAa,EACd,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,UAAU,EAAc,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAIjF,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAClG,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpK,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACvG,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACrD,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,cAAc,YAAY,CAAC;AAU3B,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,kEAAkE;IAClE,GAAG,CAAC,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,uHAAuH;IACvH,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,KAAK,EAAE,QAAQ,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,UAAU,EAAE,UAAU,CAAC;IACvB,GAAG,CAAC,EAAE,YAAY,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE,UAAU;IAM5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,eAAe;IAWvB,yEAAyE;IACzE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM;IAU7C;;;;OAIG;IACG,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IAUvD,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAuDzE;;;;;;;;;;;;;;OAcG;YACW,OAAO;IAiCrB;;;OAGG;IACG,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,YAAY,GAAE,UAAU,GAAG,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzH;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,cAAc;CAGvB"}
|
package/dist/index.js
CHANGED
|
@@ -3,9 +3,11 @@ import { PinningGate } from "./pinning.js";
|
|
|
3
3
|
import { OriginGate } from "./origin.js";
|
|
4
4
|
import { ThreatGate } from "./threat-feed.js";
|
|
5
5
|
import { classifyTools } from "./sandbox.js";
|
|
6
|
+
import { isSemanticallyClean } from "./classifier.js";
|
|
6
7
|
import { silentLogger } from "./logger.js";
|
|
7
8
|
import { displaySafe } from "./sanitize.js";
|
|
8
9
|
export { StaticScanGate, staticScanRuleset, staticScanRulesetRef, STATIC_SCAN_RULESET_VERSION, } from "./static-scan.js";
|
|
10
|
+
export { inspectTools } from "./classifier.js";
|
|
9
11
|
export { PinningGate, canonicalToolsHash, tryCanonicalToolsHash, pinToolsHash, RFC8785_PIN_PREFIX, serverIdentityHash, UNCANONICAL_TOOLS_HASH } from "./pinning.js";
|
|
10
12
|
export { FilePinStore } from "./pin-store.js";
|
|
11
13
|
export { OriginGate } from "./origin.js";
|
|
@@ -74,7 +76,7 @@ export class Warden {
|
|
|
74
76
|
/** Build the standard gate chain: static → threat → origin → pinning. */
|
|
75
77
|
static create(deps) {
|
|
76
78
|
const gates = [
|
|
77
|
-
new StaticScanGate(deps.log),
|
|
79
|
+
new StaticScanGate(deps.log, tool => isSemanticallyClean(deps.semanticReview, tool)),
|
|
78
80
|
new ThreatGate(deps.threatFeed),
|
|
79
81
|
new OriginGate(),
|
|
80
82
|
new PinningGate(deps.store),
|
|
@@ -118,7 +120,9 @@ export class Warden {
|
|
|
118
120
|
}
|
|
119
121
|
// Composite score: product of gate contributions (one bad gate drags it down).
|
|
120
122
|
const score = scores.reduce((acc, s) => acc * s, 1);
|
|
121
|
-
const { allowedTools, blockedTools } = this.
|
|
123
|
+
const { allowedTools, blockedTools } = !allow && this.policy.requireApproval
|
|
124
|
+
? { allowedTools: [], blockedTools: tools.map(t => t.name) }
|
|
125
|
+
: this.partitionTools(tools, findings, blockThreshold);
|
|
122
126
|
if (!allow) {
|
|
123
127
|
this.log.warn(`BLOCK ${displaySafe(server.id)} (decidedBy=${displaySafe(decidedBy ?? "-", 60)}, ` +
|
|
124
128
|
`score=${score.toFixed(3)}, findings=${findings.length})`);
|
|
@@ -182,13 +186,13 @@ export class Warden {
|
|
|
182
186
|
* Record the user's approval: pin the current tool defs so future drift is
|
|
183
187
|
* detected. Idempotent — re-approving just refreshes the snapshot.
|
|
184
188
|
*/
|
|
185
|
-
async approve(server, tools) {
|
|
189
|
+
async approve(server, tools, approvalMode = "operator") {
|
|
186
190
|
const pinning = this.gates.find((g) => g instanceof PinningGate);
|
|
187
191
|
if (!pinning) {
|
|
188
192
|
this.log.warn("approve() called but no PinningGate in the chain; nothing to pin");
|
|
189
193
|
return;
|
|
190
194
|
}
|
|
191
|
-
await pinning.pin(server, tools);
|
|
195
|
+
await pinning.pin(server, tools, approvalMode);
|
|
192
196
|
this.log.info(`pinned tool defs for ${displaySafe(server.id)} (${tools.length} tools)`);
|
|
193
197
|
}
|
|
194
198
|
/**
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAc,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAA6B,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpK,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAIvG,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,cAAc,YAAY,CAAC;AAE3B,MAAM,aAAa,GAA6B;IAC9C,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAuBF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,MAAM;IACA,KAAK,CAAe;IACpB,MAAM,CAAe;IACrB,GAAG,CAAe;IAEnC,YAAY,IAAgB;QAC1B,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,eAAe,CAAC,MAAoB;QAC1C,MAAM,KAAK,GAAe,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAa,MAAM,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,IAAI,CACX,oCAAoC,WAAW,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC,IAAI;YAC/E,oBAAoB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,QAAQ,4BAA4B,CACjG,CAAC;QACF,OAAO,EAAE,GAAG,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,MAAM,CAAC,IAAsB;QAClC,MAAM,KAAK,GAAiB;YAC1B,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YACpF,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAC/B,IAAI,UAAU,EAAE;YAChB,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;SAC5B,CAAC;QACF,OAAO,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,MAAoB;QAClC,6EAA6E;QAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/E,CAAC,YAAY,WAAW;YACtB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YACtD,CAAC,CAAC,CAAC,CACN,CAAC;QACF,OAAO,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAoB,EAAE,KAAgB;QAC9C,MAAM,QAAQ,GAAoB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,IAAI,SAA6B,CAAC;QAClC,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAElE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAEnC,gFAAgF;YAChF,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,cAAc,CAClE,CAAC;YACF,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,KAAK,EAAE,CAAC;oBACV,KAAK,GAAG,KAAK,CAAC;oBACd,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC;gBACxB,CAAC;gBACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,+BAA+B,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;oBAC1G,MAAM,CAAC,0CAA0C;gBACnD,CAAC;YACH,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAEpD,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe;YAC1E,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;YAC5D,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QAEzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,IAAI,CACX,SAAS,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,WAAW,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI;gBACjF,SAAS,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,MAAM,GAAG,CAC5D,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAC1J,CAAC;QAED,OAAO;YACL,KAAK;YACL,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;YACrB,SAAS;YACT,QAAQ;YACR,YAAY;YACZ,YAAY;YACZ,QAAQ,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE,EAAE;SACjD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,OAAO,CACnB,IAAgB,EAChB,MAAoB,EACpB,KAAgB,EAChB,KAAsB;QAEtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9F,+DAA+D;YAC/D,OAAO;gBACL,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;gBAChE,KAAK,EAAE,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3D,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1F,OAAO;gBACL,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,MAAM;wBAChB,IAAI,EAAE,YAAY;wBAClB,OAAO,EACL,SAAS,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa;4BACjG,+BAA+B;qBAClC;iBACF;gBACD,KAAK,EAAE,CAAC;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAoB,EAAE,KAAgB,EAAE,eAAyC,UAAU;QACvG,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,YAAY,WAAW,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IACK,cAAc,CACpB,KAAgB,EAChB,QAAyB,EACzB,cAAsB;QAEtB,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,QAAQ;gBAAE,SAAS,CAAC,kCAAkC;YAC5D,IAAI,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,cAAc;gBAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBAC7D,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;IACxC,CAAC;IAEO,cAAc,CAAC,KAAgB;QACrC,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IAC5D,CAAC;CACF;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC"}
|
package/dist/mcp-tools.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mcp-tools.d.ts","sourceRoot":"","sources":["../src/mcp-tools.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAKV,YAAY,EAEb,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,SAAS,MAAM,CAAC;AAC7B,eAAO,MAAM,UAAU,QAAS,CAAC;AACjC,eAAO,MAAM,iBAAiB,SAAU,CAAC;AAIzC,eAAO,MAAM,kBAAkB,EAAE,YAKhC,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,OAAO,CAAC;QACxB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AA8DD,eAAO,MAAM,SAAS,EAAE,UAAU,
|
|
1
|
+
{"version":3,"file":"mcp-tools.d.ts","sourceRoot":"","sources":["../src/mcp-tools.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAKV,YAAY,EAEb,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,SAAS,MAAM,CAAC;AAC7B,eAAO,MAAM,UAAU,QAAS,CAAC;AACjC,eAAO,MAAM,iBAAiB,SAAU,CAAC;AAIzC,eAAO,MAAM,kBAAkB,EAAE,YAKhC,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,OAAO,CAAC;QACxB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AA8DD,eAAO,MAAM,SAAS,EAAE,UAAU,EAqYjC,CAAC;AA2BF,eAAO,MAAM,gBAAgB,QAUgK,CAAC;AAqE9L,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAgCnD;AAED,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAqBtG;AAqID,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAMtD"}
|
package/dist/mcp-tools.js
CHANGED
|
@@ -69,7 +69,7 @@ const RULESET_REF_SCHEMA = {
|
|
|
69
69
|
additionalProperties: false,
|
|
70
70
|
required: ["version", "digest"],
|
|
71
71
|
properties: {
|
|
72
|
-
version: { type: "string", description: "Monotonic static-scan ruleset version (currently \"
|
|
72
|
+
version: { type: "string", description: "Monotonic static-scan ruleset version (currently \"12\")." },
|
|
73
73
|
digest: {
|
|
74
74
|
type: "string",
|
|
75
75
|
description: "sha256-<base64> over the RFC 8785 canonical form of the published rule table. A recorded scan is not reproducible without this.",
|
|
@@ -166,10 +166,21 @@ export const MCP_TOOLS = [
|
|
|
166
166
|
maxItems: 64,
|
|
167
167
|
description: "Case-insensitive * globs matched against tool names. Hits are still advertised; they go to blockedTools only when a finding also trips. For a glob-only split, call classify_sensitive_tools.",
|
|
168
168
|
},
|
|
169
|
+
capabilityBindings: {
|
|
170
|
+
type: "array", maxItems: 1000,
|
|
171
|
+
description: "Operator-reviewed capabilities, bound to launch identity and complete definitions. Unbound capabilities remain unknown.",
|
|
172
|
+
items: { type: "object", required: ["serverId", "identityHash", "toolsHash", "tools"], additionalProperties: false,
|
|
173
|
+
properties: { serverId: { type: "string" }, identityHash: { type: "string" }, toolsHash: { type: "string" },
|
|
174
|
+
tools: { type: "object", additionalProperties: { type: "array", items: { enum: ["private", "untrusted", "outbound"] } } } } },
|
|
175
|
+
},
|
|
169
176
|
allowUnknownServers: {
|
|
170
177
|
type: "boolean",
|
|
171
178
|
description: "When false, servers that carry server.catalog are refused by the origin gate. Default true on this stdio scanner so you can inspect catalog entries without declaring them.",
|
|
172
179
|
},
|
|
180
|
+
requireApproval: {
|
|
181
|
+
type: "boolean",
|
|
182
|
+
description: "Require an explicit operator approval of every advertised field and server identity. Automatic and legacy pins do not qualify. Default false.",
|
|
183
|
+
},
|
|
173
184
|
pinToolDefs: {
|
|
174
185
|
type: "boolean",
|
|
175
186
|
description: "When true, tool-def drift after a stored pin is fatal. Pins persist across calls and restarts; first contact stays UNPINNED/advisory. Default true.",
|
|
@@ -207,7 +218,7 @@ export const MCP_TOOLS = [
|
|
|
207
218
|
{
|
|
208
219
|
name: "static_scan_tools",
|
|
209
220
|
title: "Static-scan MCP tool definitions for injection and exfil",
|
|
210
|
-
description: "Run only the static-scan gate (ruleset
|
|
221
|
+
description: "Run only the static-scan gate (ruleset v12, 35 signatures with context guards, text folded first) over every advertised tool field: name, description, input schema, title, output schema, annotations and extension metadata. Returns findings, a 0..1 gate score, and the published ruleset digest.\n\n" +
|
|
211
222
|
"When to use: you have a tools/list dump and want injection / credential / hidden-Unicode hits without origin, pinning, or the threat feed. Cheaper and narrower than vet_mcp_server.\n\n" +
|
|
212
223
|
"When NOT to use: you need the full host decision (vet_mcp_server); you want operator glob classification (classify_sensitive_tools); you want the published rule table itself (list_scan_rules).\n\n" +
|
|
213
224
|
"Behaviour: local regex+guard evaluation, no network, no mutation. Advisory-tier hits are reported with advisory=true and do not reduce the score. Does not launch servers or send tool output to a model.\n\n" +
|
|
@@ -380,7 +391,7 @@ export const MCP_TOOLS = [
|
|
|
380
391
|
name: "list_scan_rules",
|
|
381
392
|
title: "List the published WARDEN static-scan rule table",
|
|
382
393
|
description: "Return the in-force static-scan ruleset: version, digest, and every rule's code, severity, tier (block vs advise), surfaces (name / description / inputSchema / title / outputSchema / annotations / metadata), optional regex source, and named guards. A recorded verdict is only reproducible together with this identity.\n\n" +
|
|
383
|
-
"When to use: explain a finding code, confirm you are on ruleset
|
|
394
|
+
"When to use: explain a finding code, confirm you are on ruleset v12, or re-run a scan with the same table. include_source=true adds the regex source and flags for an independent re-implementation.\n\n" +
|
|
384
395
|
"When NOT to use: evaluating a live tools/list (static_scan_tools or vet_mcp_server — those apply the table). This tool does not scan anything.\n\n" +
|
|
385
396
|
"Behaviour: local snapshot of the compiled rule table, no network, no mutation. Digest is sha256 over the RFC 8785 form of {version, fold, rules} (each rule carries its `raw` flag).\n\n" +
|
|
386
397
|
"Returns the ruleset object. Example: list_scan_rules({ include_source: false }).",
|
|
@@ -561,10 +572,24 @@ export function asPolicy(raw) {
|
|
|
561
572
|
throw new McpToolError("policy.sensitiveToolPatterns must be an array");
|
|
562
573
|
policy.sensitiveToolPatterns = rec.sensitiveToolPatterns.map(String);
|
|
563
574
|
}
|
|
575
|
+
if (rec.capabilityBindings !== undefined) {
|
|
576
|
+
if (!Array.isArray(rec.capabilityBindings) || rec.capabilityBindings.some(b => !b || typeof b !== 'object' || typeof b.serverId !== 'string' || !b.serverId ||
|
|
577
|
+
typeof b.identityHash !== 'string' || !/^[a-f0-9]{64}$/.test(b.identityHash) ||
|
|
578
|
+
typeof b.toolsHash !== 'string' || !/^(?:rfc8785:)?[a-f0-9]{64}$/.test(b.toolsHash) ||
|
|
579
|
+
!b.tools || typeof b.tools !== 'object' || Array.isArray(b.tools) ||
|
|
580
|
+
Object.values(b.tools).some(v => !Array.isArray(v) || v.some(c => !['private', 'untrusted', 'outbound'].includes(c)))))
|
|
581
|
+
throw new McpToolError('policy.capabilityBindings must bind capabilities to serverId, identityHash and toolsHash');
|
|
582
|
+
policy.capabilityBindings = structuredClone(rec.capabilityBindings);
|
|
583
|
+
}
|
|
564
584
|
if (typeof rec.allowUnknownServers === "boolean")
|
|
565
585
|
policy.allowUnknownServers = rec.allowUnknownServers;
|
|
566
586
|
if (typeof rec.pinToolDefs === "boolean")
|
|
567
587
|
policy.pinToolDefs = rec.pinToolDefs;
|
|
588
|
+
if ("requireApproval" in rec) {
|
|
589
|
+
if (typeof rec.requireApproval !== "boolean")
|
|
590
|
+
throw new McpToolError("policy.requireApproval must be boolean");
|
|
591
|
+
policy.requireApproval = rec.requireApproval;
|
|
592
|
+
}
|
|
568
593
|
return policy;
|
|
569
594
|
}
|
|
570
595
|
export class McpToolError extends Error {
|
|
@@ -639,7 +664,7 @@ async function managePin(name, args) {
|
|
|
639
664
|
const verdict = await warden.vet(server, tools);
|
|
640
665
|
if (!verdict.allow)
|
|
641
666
|
throw new McpToolError("Server failed security checks; approval refused");
|
|
642
|
-
const pin = { serverId: server.id, toolsHash, toolsHashVersion: 2, identityHash, tools,
|
|
667
|
+
const pin = { serverId: server.id, toolsHash, toolsHashVersion: 2, identityHash, tools, approvalMode: "operator",
|
|
643
668
|
toolNames: tools.map(t => t.name).sort(), approvedAt: new Date().toISOString() };
|
|
644
669
|
await store.replace(server.id, args.previous_pin_revision, pin);
|
|
645
670
|
return { approved: true, pin };
|