@intutic/shared-types 2.2.0 → 2.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (202) hide show
  1. package/dist/anomaly.d.ts +6 -10
  2. package/dist/anomaly.d.ts.map +1 -1
  3. package/dist/anomaly.js +0 -2
  4. package/dist/anomaly.js.map +1 -1
  5. package/dist/api-contracts.d.ts +1 -1
  6. package/dist/api-contracts.js +1 -1
  7. package/dist/attenuation.d.ts +1 -1
  8. package/dist/attenuation.js +1 -1
  9. package/dist/auth.d.ts +116 -9
  10. package/dist/auth.d.ts.map +1 -1
  11. package/dist/auth.js +20 -5
  12. package/dist/auth.js.map +1 -1
  13. package/dist/billing.d.ts +1 -1
  14. package/dist/billing.js +1 -1
  15. package/dist/cloudProbe.d.ts +54 -0
  16. package/dist/cloudProbe.d.ts.map +1 -0
  17. package/dist/cloudProbe.js +254 -0
  18. package/dist/cloudProbe.js.map +1 -0
  19. package/dist/destructiveSql.d.ts +48 -0
  20. package/dist/destructiveSql.d.ts.map +1 -0
  21. package/dist/destructiveSql.js +43 -0
  22. package/dist/destructiveSql.js.map +1 -0
  23. package/dist/devInventory.d.ts +120 -0
  24. package/dist/devInventory.d.ts.map +1 -0
  25. package/dist/devInventory.js +80 -0
  26. package/dist/devInventory.js.map +1 -0
  27. package/dist/enums.d.ts +66 -21
  28. package/dist/enums.d.ts.map +1 -1
  29. package/dist/enums.js +55 -31
  30. package/dist/enums.js.map +1 -1
  31. package/dist/errors.js +3 -3
  32. package/dist/errors.js.map +1 -1
  33. package/dist/finops.d.ts +52 -2
  34. package/dist/finops.d.ts.map +1 -1
  35. package/dist/finops.js +15 -1
  36. package/dist/finops.js.map +1 -1
  37. package/dist/gateDecisions.d.ts +18 -0
  38. package/dist/gateDecisions.d.ts.map +1 -0
  39. package/dist/gateDecisions.js +20 -0
  40. package/dist/gateDecisions.js.map +1 -0
  41. package/dist/gateIdentity.d.ts +23 -0
  42. package/dist/gateIdentity.d.ts.map +1 -0
  43. package/dist/gateIdentity.js +32 -0
  44. package/dist/gateIdentity.js.map +1 -0
  45. package/dist/gateKind.d.ts +172 -0
  46. package/dist/gateKind.d.ts.map +1 -0
  47. package/dist/gateKind.js +160 -0
  48. package/dist/gateKind.js.map +1 -0
  49. package/dist/gateLimits.d.ts +170 -0
  50. package/dist/gateLimits.d.ts.map +1 -0
  51. package/dist/gateLimits.js +96 -0
  52. package/dist/gateLimits.js.map +1 -0
  53. package/dist/gitRemote.d.ts +17 -0
  54. package/dist/gitRemote.d.ts.map +1 -0
  55. package/dist/gitRemote.js +71 -0
  56. package/dist/gitRemote.js.map +1 -0
  57. package/dist/governanceCoverage.d.ts +1 -1
  58. package/dist/governanceCoverage.js +1 -1
  59. package/dist/guardrailIr.d.ts +9 -9
  60. package/dist/guardrailIr.d.ts.map +1 -1
  61. package/dist/guardrailIr.js +3 -3
  62. package/dist/guardrailIr.js.map +1 -1
  63. package/dist/guardrailRender.d.ts +1 -1
  64. package/dist/guardrailRender.js +1 -1
  65. package/dist/harnessRules.d.ts +74 -0
  66. package/dist/harnessRules.d.ts.map +1 -0
  67. package/dist/harnessRules.js +142 -0
  68. package/dist/harnessRules.js.map +1 -0
  69. package/dist/holdMessages.d.ts +25 -0
  70. package/dist/holdMessages.d.ts.map +1 -0
  71. package/dist/holdMessages.js +34 -0
  72. package/dist/holdMessages.js.map +1 -0
  73. package/dist/identity.d.ts +1 -1
  74. package/dist/identity.js +2 -2
  75. package/dist/identity.js.map +1 -1
  76. package/dist/index.d.ts +42 -9
  77. package/dist/index.d.ts.map +1 -1
  78. package/dist/index.js +161 -10
  79. package/dist/index.js.map +1 -1
  80. package/dist/intelligence.d.ts +1 -1
  81. package/dist/mcpBudgets.d.ts +191 -0
  82. package/dist/mcpBudgets.d.ts.map +1 -0
  83. package/dist/mcpBudgets.js +144 -0
  84. package/dist/mcpBudgets.js.map +1 -0
  85. package/dist/mcpRegistryRecord.d.ts +143 -0
  86. package/dist/mcpRegistryRecord.d.ts.map +1 -0
  87. package/dist/mcpRegistryRecord.js +229 -0
  88. package/dist/mcpRegistryRecord.js.map +1 -0
  89. package/dist/mcpToolRisk.d.ts +82 -0
  90. package/dist/mcpToolRisk.d.ts.map +1 -0
  91. package/dist/mcpToolRisk.js +334 -0
  92. package/dist/mcpToolRisk.js.map +1 -0
  93. package/dist/modelCatalog.d.ts +2 -2
  94. package/dist/modelCatalog.generated.js +1 -1
  95. package/dist/modelCatalog.generated.js.map +1 -1
  96. package/dist/modelCatalog.js +2 -2
  97. package/dist/notifications.d.ts +24 -151
  98. package/dist/notifications.d.ts.map +1 -1
  99. package/dist/notifications.js +266 -1
  100. package/dist/notifications.js.map +1 -1
  101. package/dist/phrases.d.ts +87 -0
  102. package/dist/phrases.d.ts.map +1 -0
  103. package/dist/phrases.js +241 -0
  104. package/dist/phrases.js.map +1 -0
  105. package/dist/piiDetectors.d.ts +97 -0
  106. package/dist/piiDetectors.d.ts.map +1 -0
  107. package/dist/piiDetectors.js +96 -0
  108. package/dist/piiDetectors.js.map +1 -0
  109. package/dist/piiDetectors.json +71 -0
  110. package/dist/policy.d.ts +1 -1
  111. package/dist/policy.js +1 -1
  112. package/dist/policyGuardrails.d.ts +127 -10
  113. package/dist/policyGuardrails.d.ts.map +1 -1
  114. package/dist/policyGuardrails.js +59 -6
  115. package/dist/policyGuardrails.js.map +1 -1
  116. package/dist/posturePresets.js +1 -1
  117. package/dist/posturePresets.js.map +1 -1
  118. package/dist/providerVerification.d.ts +36 -10
  119. package/dist/providerVerification.d.ts.map +1 -1
  120. package/dist/providerVerification.js +80 -20
  121. package/dist/providerVerification.js.map +1 -1
  122. package/dist/providers.d.ts +54 -17
  123. package/dist/providers.d.ts.map +1 -1
  124. package/dist/providers.js +135 -26
  125. package/dist/providers.js.map +1 -1
  126. package/dist/regoBuiltins.d.ts +42 -0
  127. package/dist/regoBuiltins.d.ts.map +1 -0
  128. package/dist/regoBuiltins.js +732 -0
  129. package/dist/regoBuiltins.js.map +1 -0
  130. package/dist/regoRules.d.ts +105 -0
  131. package/dist/regoRules.d.ts.map +1 -0
  132. package/dist/regoRules.js +407 -0
  133. package/dist/regoRules.js.map +1 -0
  134. package/dist/ruleLoadFailures.d.ts +15 -0
  135. package/dist/ruleLoadFailures.d.ts.map +1 -0
  136. package/dist/ruleLoadFailures.js +26 -0
  137. package/dist/ruleLoadFailures.js.map +1 -0
  138. package/dist/scriptScan.d.ts +5 -5
  139. package/dist/scriptScan.js +3 -3
  140. package/dist/sequence.d.ts +52 -0
  141. package/dist/sequence.d.ts.map +1 -0
  142. package/dist/sequence.js +127 -0
  143. package/dist/sequence.js.map +1 -0
  144. package/dist/session.d.ts +1 -1
  145. package/dist/session.js +1 -1
  146. package/dist/skillScan.d.ts +3 -3
  147. package/dist/skillScan.d.ts.map +1 -1
  148. package/dist/skillScan.js +26 -4
  149. package/dist/skillScan.js.map +1 -1
  150. package/dist/sop.d.ts +5 -5
  151. package/dist/sop.js +2 -2
  152. package/dist/sourceProviders.d.ts +1 -8
  153. package/dist/sourceProviders.d.ts.map +1 -1
  154. package/dist/sourceProviders.js +2 -9
  155. package/dist/sourceProviders.js.map +1 -1
  156. package/dist/spendBudgets.d.ts +122 -0
  157. package/dist/spendBudgets.d.ts.map +1 -0
  158. package/dist/spendBudgets.js +92 -0
  159. package/dist/spendBudgets.js.map +1 -0
  160. package/dist/ssoGroupClearance.d.ts +18 -2
  161. package/dist/ssoGroupClearance.d.ts.map +1 -1
  162. package/dist/ssoGroupClearance.js +43 -4
  163. package/dist/ssoGroupClearance.js.map +1 -1
  164. package/dist/sync.d.ts +0 -1
  165. package/dist/sync.d.ts.map +1 -1
  166. package/dist/sync.js +0 -1
  167. package/dist/sync.js.map +1 -1
  168. package/dist/taskManagement.d.ts +0 -2
  169. package/dist/taskManagement.d.ts.map +1 -1
  170. package/dist/taskManagement.js +0 -2
  171. package/dist/taskManagement.js.map +1 -1
  172. package/dist/toolPoison.d.ts +33 -0
  173. package/dist/toolPoison.d.ts.map +1 -0
  174. package/dist/toolPoison.js +85 -0
  175. package/dist/toolPoison.js.map +1 -0
  176. package/dist/upstreamRetry.d.ts +121 -0
  177. package/dist/upstreamRetry.d.ts.map +1 -0
  178. package/dist/upstreamRetry.js +90 -0
  179. package/dist/upstreamRetry.js.map +1 -0
  180. package/dist/usage.d.ts +186 -0
  181. package/dist/usage.d.ts.map +1 -1
  182. package/dist/wasmBinary.d.ts +25 -0
  183. package/dist/wasmBinary.d.ts.map +1 -0
  184. package/dist/wasmBinary.js +111 -0
  185. package/dist/wasmBinary.js.map +1 -0
  186. package/dist/wasmFuel.d.ts +52 -0
  187. package/dist/wasmFuel.d.ts.map +1 -0
  188. package/dist/wasmFuel.js +320 -0
  189. package/dist/wasmFuel.js.map +1 -0
  190. package/dist/wasmMemoryCap.d.ts +21 -0
  191. package/dist/wasmMemoryCap.d.ts.map +1 -0
  192. package/dist/wasmMemoryCap.js +58 -0
  193. package/dist/wasmMemoryCap.js.map +1 -0
  194. package/dist/wasmRuleDescriptor.d.ts +43 -0
  195. package/dist/wasmRuleDescriptor.d.ts.map +1 -0
  196. package/dist/wasmRuleDescriptor.js +65 -0
  197. package/dist/wasmRuleDescriptor.js.map +1 -0
  198. package/dist/workspaceSettings.d.ts +95 -17
  199. package/dist/workspaceSettings.d.ts.map +1 -1
  200. package/dist/workspaceSettings.js +2 -1
  201. package/dist/workspaceSettings.js.map +1 -1
  202. package/package.json +2 -2
@@ -0,0 +1,334 @@
1
+ "use strict";
2
+ /**
3
+ * Risk score for a change to an MCP server's tool set.
4
+ *
5
+ * When a server the registry already knows declares a different tool set — a
6
+ * tool added or removed, a description or input schema changed — the control
7
+ * plane scores the change with {@link scoreToolSetChange} and stores the score
8
+ * and its reasons on the registry's change record
9
+ * (`services/control-plane/src/services/mcpRegistryService.ts`).
10
+ *
11
+ * Rules only, no model: the same two tool sets always produce the same score
12
+ * and the same reasons, in the same order, so a score can be reproduced from
13
+ * the stored definitions and argued with. Each rule adds points:
14
+ *
15
+ * | rule | points | when |
16
+ * |------------------------|--------|--------------------------------------------------------------|
17
+ * | `description_poisoned` | 60 | a new or changed description matches a poisoning pattern it did not match before |
18
+ * | `new_tool_capability` | 20–40 | a new tool's name or description implies write, network, exec or credential access (per capability) |
19
+ * | `capability_gained` | 20–40 | a changed tool implies a capability it did not before (per capability) |
20
+ * | `confirmation_removed` | 35 | a changed tool lost a confirmation or dry-run argument, or stopped requiring or defaulting it |
21
+ * | `schema_widened` | 15 | a changed tool accepts more than before: new arguments, fewer required ones, lifted enums, patterns or limits |
22
+ * | `tool_added` | 5 | a new tool none of the rules above flag |
23
+ * | `description_changed` | 5 | a changed description none of the rules above flag |
24
+ *
25
+ * Capability points: exec 40, credential 40, network 25, write 20. A removed
26
+ * tool adds nothing: it narrows what an agent can do. The score is the sum,
27
+ * capped at 100; 50 or more is `high`, 20 or more `medium`, anything above 0
28
+ * `low`.
29
+ *
30
+ * @module
31
+ */
32
+ Object.defineProperty(exports, "__esModule", { value: true });
33
+ exports.MCP_TOOL_CAPABILITY_POINTS = exports.MCP_TOOL_RISK_MEDIUM = exports.MCP_TOOL_RISK_HIGH = exports.MAX_TOOL_SCHEMA_CHARS = exports.MAX_TOOL_DESCRIPTION_CHARS = void 0;
34
+ exports.normalizeToolDefinition = normalizeToolDefinition;
35
+ exports.riskLevelOf = riskLevelOf;
36
+ exports.scoreToolSetChange = scoreToolSetChange;
37
+ const toolPoison_js_1 = require("./toolPoison.js");
38
+ /**
39
+ * How much of a definition the registry keeps. A longer description is cut
40
+ * here (its scanned prefix is what the risk score sees); a larger input
41
+ * schema is left out. Real servers' tools sit far below both.
42
+ */
43
+ exports.MAX_TOOL_DESCRIPTION_CHARS = 8_192;
44
+ exports.MAX_TOOL_SCHEMA_CHARS = 16_384;
45
+ /**
46
+ * One `tools/list` entry as the registry stores it: the name, the description
47
+ * cut to {@link MAX_TOOL_DESCRIPTION_CHARS}, and the input schema when it is an
48
+ * object no larger than {@link MAX_TOOL_SCHEMA_CHARS} serialised. `null` for an
49
+ * entry without a name.
50
+ */
51
+ function normalizeToolDefinition(raw) {
52
+ if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
53
+ return null;
54
+ const entry = raw;
55
+ const name = entry['name'];
56
+ if (typeof name !== 'string' || name.length === 0 || name.length > 256)
57
+ return null;
58
+ const def = { name };
59
+ if (typeof entry['description'] === 'string')
60
+ def.description = entry['description'].slice(0, exports.MAX_TOOL_DESCRIPTION_CHARS);
61
+ const schema = entry['inputSchema'];
62
+ if (schema !== null && typeof schema === 'object' && !Array.isArray(schema) && JSON.stringify(schema).length <= exports.MAX_TOOL_SCHEMA_CHARS) {
63
+ def.inputSchema = schema;
64
+ }
65
+ return def;
66
+ }
67
+ exports.MCP_TOOL_RISK_HIGH = 50;
68
+ exports.MCP_TOOL_RISK_MEDIUM = 20;
69
+ exports.MCP_TOOL_CAPABILITY_POINTS = {
70
+ exec: 40,
71
+ credential: 40,
72
+ network: 25,
73
+ write: 20,
74
+ };
75
+ const RULE_POINTS = {
76
+ description_poisoned: 60,
77
+ confirmation_removed: 35,
78
+ schema_widened: 15,
79
+ tool_added: 5,
80
+ description_changed: 5,
81
+ };
82
+ const CAPABILITIES = ['exec', 'credential', 'network', 'write'];
83
+ /** Words in a tool's name that name a capability. Matched against whole name tokens. */
84
+ const NAME_TOKENS = {
85
+ exec: new Set(['exec', 'execute', 'run', 'shell', 'bash', 'sh', 'cmd', 'command', 'commands', 'spawn', 'eval', 'script', 'terminal', 'subprocess']),
86
+ credential: new Set(['credential', 'credentials', 'secret', 'secrets', 'password', 'passwords', 'passwd', 'token', 'tokens', 'apikey', 'auth', 'oauth', 'login', 'keychain', 'vault', 'ssh']),
87
+ network: new Set(['http', 'https', 'url', 'fetch', 'request', 'webhook', 'download', 'upload', 'curl', 'wget', 'browse', 'navigate', 'email', 'mail', 'smtp', 'socket', 'send']),
88
+ write: new Set(['write', 'delete', 'remove', 'rm', 'update', 'create', 'modify', 'edit', 'insert', 'drop', 'truncate', 'overwrite', 'move', 'rename', 'push', 'commit', 'deploy', 'publish', 'put', 'patch', 'upsert', 'append', 'merge', 'set']),
89
+ };
90
+ /**
91
+ * Phrases in a description that name a capability. Narrower than the name
92
+ * tokens on purpose: descriptions are prose, where "update" or "token" turn up
93
+ * in tools that neither write nor touch credentials.
94
+ */
95
+ const DESCRIPTION_PATTERNS = {
96
+ exec: /\b(execut(e|es|ing)\b|runs? (an? |any |arbitrary )?(shell |system |terminal )?commands?\b|shell commands?\b|spawn(s|ing)? (a |new )?process|arbitrary code\b)/i,
97
+ credential: /\b(read|reads|return|returns|get|gets|list|lists|retriev\w*|fetch\w*|export\w*|dump\w*|access\w*)\b[^.]{0,40}\b(credentials?|passwords?|secrets?|api[ _-]?keys?|access tokens?|private keys?|ssh keys?)\b/i,
98
+ network: /(https?:\/\/|\bhttp requests?\b|\bfetch(es)? (a |the |any )?(url|web ?page)s?\b|\bwebhooks?\b|\bdownloads?\b|\buploads?\b|\bsends? (an? )?(email|e-mail|message|request)s?\b)/i,
99
+ write: /\b(write|writes|delete|deletes|remove|removes|overwrite|overwrites|modif(y|ies)|truncate|truncates|drop|drops)\b[^.]{0,40}\b(files?|director(y|ies)|records?|rows?|tables?|database|repositor(y|ies)|branch(es)?|data)\b/i,
100
+ };
101
+ /** Argument names that ask for confirmation or a dry run, compared lowercased with `_` and `-` removed. */
102
+ const CONFIRMATION_ARGS = new Set([
103
+ 'confirm', 'confirmed', 'confirmation', 'requireconfirmation', 'dryrun', 'preview', 'approval', 'approve', 'approved', 'safemode',
104
+ ]);
105
+ function nameTokens(name) {
106
+ return name
107
+ .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
108
+ .toLowerCase()
109
+ .split(/[^a-z0-9]+/)
110
+ .filter(Boolean);
111
+ }
112
+ function capabilitiesOf(tool) {
113
+ const tokens = nameTokens(tool.name);
114
+ const found = new Set();
115
+ for (const cap of CAPABILITIES) {
116
+ if (tokens.some((t) => NAME_TOKENS[cap].has(t)))
117
+ found.add(cap);
118
+ else if (tool.description && DESCRIPTION_PATTERNS[cap].test(tool.description))
119
+ found.add(cap);
120
+ }
121
+ return found;
122
+ }
123
+ function isConfirmationArg(name) {
124
+ return CONFIRMATION_ARGS.has(name.toLowerCase().replace(/[_-]/g, ''));
125
+ }
126
+ /** JSON with object keys sorted, so equal schemas compare equal whatever their key order. */
127
+ function stableJson(value) {
128
+ if (Array.isArray(value))
129
+ return `[${value.map(stableJson).join(',')}]`;
130
+ if (value !== null && typeof value === 'object') {
131
+ const obj = value;
132
+ return `{${Object.keys(obj).sort().map((k) => `${JSON.stringify(k)}:${stableJson(obj[k])}`).join(',')}}`;
133
+ }
134
+ return JSON.stringify(value) ?? 'null';
135
+ }
136
+ function asSchema(value) {
137
+ return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
138
+ }
139
+ function propertiesOf(schema) {
140
+ return asSchema(schema['properties']) ?? {};
141
+ }
142
+ function requiredOf(schema) {
143
+ return Array.isArray(schema['required']) ? schema['required'].filter((r) => typeof r === 'string') : [];
144
+ }
145
+ function typesOf(schema) {
146
+ const t = schema['type'];
147
+ if (typeof t === 'string')
148
+ return [t];
149
+ if (Array.isArray(t))
150
+ return t.filter((x) => typeof x === 'string');
151
+ return null;
152
+ }
153
+ /** Upper bounds whose removal or increase accepts more input. */
154
+ const UPPER_BOUNDS = ['maxLength', 'maximum', 'exclusiveMaximum', 'maxItems', 'maxProperties'];
155
+ /** Lower bounds whose removal or decrease accepts more input. */
156
+ const LOWER_BOUNDS = ['minLength', 'minimum', 'exclusiveMinimum', 'minItems', 'minProperties'];
157
+ /**
158
+ * Everything `next` accepts that `prev` did not, as phrases — and, separately,
159
+ * the confirmation arguments `next` weakened. Recurses into nested object
160
+ * properties and array items; `at` is the argument path for the phrases.
161
+ */
162
+ function compareSchemas(prev, next, at, widened, confirmations) {
163
+ const label = (name) => (at ? `${at}.${name}` : name);
164
+ const here = at ? `\`${at}\`` : 'the input';
165
+ const prevTypes = typesOf(prev);
166
+ const nextTypes = typesOf(next);
167
+ if (prevTypes && (!nextTypes || nextTypes.some((t) => !prevTypes.includes(t)))) {
168
+ widened.push(`${here} accepts ${nextTypes ? nextTypes.filter((t) => !prevTypes.includes(t)).join(', ') : 'any type'} now`);
169
+ }
170
+ if ('enum' in prev) {
171
+ const before = Array.isArray(prev['enum']) ? prev['enum'].map(stableJson) : [];
172
+ const after = Array.isArray(next['enum']) ? next['enum'].map(stableJson) : null;
173
+ if (!after)
174
+ widened.push(`${here} lost its list of allowed values`);
175
+ else if (after.some((v) => !before.includes(v)))
176
+ widened.push(`${here} allows new values`);
177
+ }
178
+ if ('const' in prev && stableJson(prev['const']) !== stableJson(next['const'])) {
179
+ widened.push(`${here} is no longer fixed to ${stableJson(prev['const'])}`);
180
+ }
181
+ if (typeof prev['pattern'] === 'string' && prev['pattern'] !== next['pattern']) {
182
+ widened.push(`${here} ${typeof next['pattern'] === 'string' ? 'has a different' : 'lost its'} pattern`);
183
+ }
184
+ for (const bound of UPPER_BOUNDS) {
185
+ const b = prev[bound];
186
+ if (typeof b === 'number' && !(typeof next[bound] === 'number' && next[bound] <= b)) {
187
+ widened.push(`${here} ${typeof next[bound] === 'number' ? 'raised' : 'dropped'} its ${bound}`);
188
+ }
189
+ }
190
+ for (const bound of LOWER_BOUNDS) {
191
+ const b = prev[bound];
192
+ if (typeof b === 'number' && !(typeof next[bound] === 'number' && next[bound] >= b)) {
193
+ widened.push(`${here} ${typeof next[bound] === 'number' ? 'lowered' : 'dropped'} its ${bound}`);
194
+ }
195
+ }
196
+ if (prev['additionalProperties'] === false && next['additionalProperties'] !== false) {
197
+ widened.push(`${here} accepts arguments it does not declare`);
198
+ }
199
+ const prevProps = propertiesOf(prev);
200
+ const nextProps = propertiesOf(next);
201
+ const prevRequired = requiredOf(prev);
202
+ const nextRequired = new Set(requiredOf(next));
203
+ for (const name of Object.keys(nextProps).sort()) {
204
+ if (!(name in prevProps))
205
+ widened.push(`new argument \`${label(name)}\``);
206
+ }
207
+ for (const name of Object.keys(prevProps).sort()) {
208
+ const confirmation = isConfirmationArg(name);
209
+ if (!(name in nextProps)) {
210
+ if (confirmation)
211
+ confirmations.push(`\`${label(name)}\` was removed`);
212
+ continue;
213
+ }
214
+ const prevProp = asSchema(prevProps[name]);
215
+ const nextProp = asSchema(nextProps[name]);
216
+ if (prevRequired.includes(name) && !nextRequired.has(name)) {
217
+ if (confirmation)
218
+ confirmations.push(`\`${label(name)}\` is no longer required`);
219
+ else
220
+ widened.push(`\`${label(name)}\` is no longer required`);
221
+ }
222
+ if (confirmation && prevProp?.['default'] === true && nextProp?.['default'] !== true) {
223
+ confirmations.push(`\`${label(name)}\` no longer defaults to true`);
224
+ }
225
+ if (prevProp && nextProp)
226
+ compareSchemas(prevProp, nextProp, label(name), widened, confirmations);
227
+ else if (prevProp && !nextProp)
228
+ widened.push(`\`${label(name)}\` lost its schema`);
229
+ }
230
+ const prevItems = asSchema(prev['items']);
231
+ const nextItems = asSchema(next['items']);
232
+ if (prevItems && nextItems)
233
+ compareSchemas(prevItems, nextItems, at ? `${at}[]` : '[]', widened, confirmations);
234
+ else if (prevItems && !nextItems)
235
+ widened.push(`${here} lost its item schema`);
236
+ }
237
+ function capabilityList(caps) {
238
+ const set = new Set(caps);
239
+ return CAPABILITIES.filter((c) => set.has(c));
240
+ }
241
+ const CAPABILITY_WORDS = {
242
+ exec: 'command execution',
243
+ credential: 'credential access',
244
+ network: 'network access',
245
+ write: 'write access',
246
+ };
247
+ function indexByName(tools) {
248
+ const map = new Map();
249
+ for (const t of tools)
250
+ if (typeof t.name === 'string' && t.name && !map.has(t.name))
251
+ map.set(t.name, t);
252
+ return map;
253
+ }
254
+ function riskLevelOf(score) {
255
+ if (score >= exports.MCP_TOOL_RISK_HIGH)
256
+ return 'high';
257
+ if (score >= exports.MCP_TOOL_RISK_MEDIUM)
258
+ return 'medium';
259
+ return score > 0 ? 'low' : 'none';
260
+ }
261
+ /**
262
+ * Compares the tool set a server declared before with the one it declares
263
+ * now. Tools are matched by name; order and duplicate names (the first wins)
264
+ * do not affect the result.
265
+ */
266
+ function scoreToolSetChange(previous, next) {
267
+ const before = indexByName(previous);
268
+ const after = indexByName(next);
269
+ const added = [...after.keys()].filter((n) => !before.has(n)).sort();
270
+ const removed = [...before.keys()].filter((n) => !after.has(n)).sort();
271
+ const changed = [];
272
+ const reasons = [];
273
+ const reason = (rule, tool, points, detail) => reasons.push({ rule, tool, points, detail });
274
+ for (const name of added) {
275
+ const tool = after.get(name);
276
+ const start = reasons.length;
277
+ const poison = tool.description ? (0, toolPoison_js_1.scanToolDescription)(tool.description) : [];
278
+ if (poison.length > 0) {
279
+ reason('description_poisoned', name, RULE_POINTS.description_poisoned, `new tool's description matches ${poison.join(', ')}`);
280
+ }
281
+ for (const cap of capabilityList(capabilitiesOf(tool))) {
282
+ reason('new_tool_capability', name, exports.MCP_TOOL_CAPABILITY_POINTS[cap], `new tool implies ${CAPABILITY_WORDS[cap]}`);
283
+ }
284
+ if (reasons.length === start)
285
+ reason('tool_added', name, RULE_POINTS.tool_added, 'new tool');
286
+ }
287
+ for (const name of [...after.keys()].filter((n) => before.has(n)).sort()) {
288
+ const prev = before.get(name);
289
+ const cur = after.get(name);
290
+ const descriptionChanged = (prev.description ?? '') !== (cur.description ?? '');
291
+ const schemaChanged = stableJson(prev.inputSchema ?? null) !== stableJson(cur.inputSchema ?? null);
292
+ if (!descriptionChanged && !schemaChanged)
293
+ continue;
294
+ changed.push(name);
295
+ const start = reasons.length;
296
+ if (descriptionChanged && cur.description) {
297
+ const was = new Set(prev.description ? (0, toolPoison_js_1.scanToolDescription)(prev.description) : []);
298
+ const now = (0, toolPoison_js_1.scanToolDescription)(cur.description).filter((p) => !was.has(p));
299
+ if (now.length > 0) {
300
+ reason('description_poisoned', name, RULE_POINTS.description_poisoned, `description now matches ${now.join(', ')}`);
301
+ }
302
+ }
303
+ const hadCaps = capabilitiesOf(prev);
304
+ for (const cap of capabilityList(capabilitiesOf(cur))) {
305
+ if (!hadCaps.has(cap)) {
306
+ reason('capability_gained', name, exports.MCP_TOOL_CAPABILITY_POINTS[cap], `now implies ${CAPABILITY_WORDS[cap]}`);
307
+ }
308
+ }
309
+ if (schemaChanged) {
310
+ const widened = [];
311
+ const confirmations = [];
312
+ compareSchemas(asSchema(prev.inputSchema) ?? {}, asSchema(cur.inputSchema) ?? {}, '', widened, confirmations);
313
+ if (confirmations.length > 0) {
314
+ reason('confirmation_removed', name, RULE_POINTS.confirmation_removed, confirmations.join('; '));
315
+ }
316
+ if (widened.length > 0)
317
+ reason('schema_widened', name, RULE_POINTS.schema_widened, widened.join('; '));
318
+ }
319
+ if (reasons.length === start && descriptionChanged) {
320
+ reason('description_changed', name, RULE_POINTS.description_changed, 'description changed');
321
+ }
322
+ }
323
+ const order = (r) => [r.tool, r.rule, r.detail];
324
+ reasons.sort((a, b) => {
325
+ const [x, y] = [order(a), order(b)];
326
+ for (let i = 0; i < x.length; i++)
327
+ if (x[i] !== y[i])
328
+ return x[i] < y[i] ? -1 : 1;
329
+ return 0;
330
+ });
331
+ const score = Math.min(100, reasons.reduce((sum, r) => sum + r.points, 0));
332
+ return { added, removed, changed: changed.sort(), score, level: riskLevelOf(score), reasons };
333
+ }
334
+ //# sourceMappingURL=mcpToolRisk.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"mcpToolRisk.js","sourceRoot":"","sources":["../src/mcpToolRisk.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;;;AAyBH,0DAYC;AAuOD,kCAIC;AAOD,gDAsEC;AA3VD,mDAAqD;AASrD;;;;GAIG;AACU,QAAA,0BAA0B,GAAG,KAAK,CAAA;AAClC,QAAA,qBAAqB,GAAG,MAAM,CAAA;AAE3C;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,GAAY;IAClD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9E,MAAM,KAAK,GAAG,GAA8B,CAAA;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAA;IACnF,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,CAAA;IACvC,IAAI,OAAO,KAAK,CAAC,aAAa,CAAC,KAAK,QAAQ;QAAE,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,kCAA0B,CAAC,CAAA;IACzH,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,CAAA;IACnC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,IAAI,6BAAqB,EAAE,CAAC;QACtI,GAAG,CAAC,WAAW,GAAG,MAAM,CAAA;IAC1B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAmCY,QAAA,kBAAkB,GAAG,EAAE,CAAA;AACvB,QAAA,oBAAoB,GAAG,EAAE,CAAA;AAEzB,QAAA,0BAA0B,GAAgD;IACrF,IAAI,EAAE,EAAE;IACR,UAAU,EAAE,EAAE;IACd,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,EAAE;CACV,CAAA;AAED,MAAM,WAAW,GAAG;IAClB,oBAAoB,EAAE,EAAE;IACxB,oBAAoB,EAAE,EAAE;IACxB,cAAc,EAAE,EAAE;IAClB,UAAU,EAAE,CAAC;IACb,mBAAmB,EAAE,CAAC;CACd,CAAA;AAEV,MAAM,YAAY,GAAiC,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;AAE7F,wFAAwF;AACxF,MAAM,WAAW,GAAmD;IAClE,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IACnJ,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7L,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChL,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;CAClP,CAAA;AAED;;;;GAIG;AACH,MAAM,oBAAoB,GAAsC;IAC9D,IAAI,EAAE,gKAAgK;IACtK,UAAU,EAAE,4MAA4M;IACxN,OAAO,EAAE,gLAAgL;IACzL,KAAK,EAAE,2NAA2N;CACnO,CAAA;AAED,2GAA2G;AAC3G,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,qBAAqB,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU;CAClI,CAAC,CAAA;AAEF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,KAAK,CAAC,YAAY,CAAC;SACnB,MAAM,CAAC,OAAO,CAAC,CAAA;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,IAAuB;IAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;IAC1C,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;aAC1D,IAAI,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC/F,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AACvE,CAAC;AAED,6FAA6F;AAC7F,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACvE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,KAAgC,CAAA;QAC5C,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC1G,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAA;AACxC,CAAC;AAID,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,IAAI,CAAA;AACxG,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAA;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACtH,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IACxB,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAA;IAChF,OAAO,IAAI,CAAA;AACb,CAAC;AAED,iEAAiE;AACjE,MAAM,YAAY,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,kBAAkB,EAAE,UAAU,EAAE,eAAe,CAAU,CAAA;AACvG,iEAAiE;AACjE,MAAM,YAAY,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,kBAAkB,EAAE,UAAU,EAAE,eAAe,CAAU,CAAA;AAEvG;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY,EAAE,EAAU,EAAE,OAAiB,EAAE,aAAuB;IACxG,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC7D,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAA;IAE3C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,YAAY,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,CAAA;IAC5H,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/E,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAA;aAC9D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,OAAO,IAAI,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,0BAA0B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;IAC5E,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,UAAU,CAAC,CAAA;IACzG,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,IAAI,CAAC,KAAK,CAAY,IAAI,CAAC,CAAC,EAAE,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,KAAK,EAAE,CAAC,CAAA;QAChG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,IAAI,CAAC,KAAK,CAAY,IAAI,CAAC,CAAC,EAAE,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,QAAQ,KAAK,EAAE,CAAC,CAAA;QACjG,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,sBAAsB,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,sBAAsB,CAAC,KAAK,KAAK,EAAE,CAAC;QACrF,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;IAE9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3E,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACjD,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC;YACzB,IAAI,YAAY;gBAAE,aAAa,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;YACtE,SAAQ;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1C,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,IAAI,YAAY;gBAAE,aAAa,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;;gBAC3E,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;QAC/D,CAAC;QACD,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,QAAQ,EAAE,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;YACrF,aAAa,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;QACrE,CAAC;QACD,IAAI,QAAQ,IAAI,QAAQ;YAAE,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;aAC5F,IAAI,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IACzC,IAAI,SAAS,IAAI,SAAS;QAAE,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;SAC1G,IAAI,SAAS,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAA;AAChF,CAAC;AAED,SAAS,cAAc,CAAC,IAAiC;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;IACzB,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,gBAAgB,GAAsC;IAC1D,IAAI,EAAE,mBAAmB;IACzB,UAAU,EAAE,mBAAmB;IAC/B,OAAO,EAAE,gBAAgB;IACzB,KAAK,EAAE,cAAc;CACtB,CAAA;AAED,SAAS,WAAW,CAAC,KAAmC;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA6B,CAAA;IAChD,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IACvG,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAgB,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,IAAI,0BAAkB;QAAE,OAAO,MAAM,CAAA;IAC9C,IAAI,KAAK,IAAI,4BAAoB;QAAE,OAAO,QAAQ,CAAA;IAClD,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAChC,QAAsC,EACtC,IAAkC;IAElC,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACpE,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACtE,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,OAAO,GAAwB,EAAE,CAAA;IACvC,MAAM,MAAM,GAAG,CAAC,IAAqB,EAAE,IAAY,EAAE,MAAc,EAAE,MAAc,EAAE,EAAE,CACrF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAE9C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAA,mCAAmB,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,WAAW,CAAC,oBAAoB,EAAE,kCAAkC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/H,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,kCAA0B,CAAC,GAAG,CAAC,EAAE,oBAAoB,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACnH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;YAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAC9F,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;QAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;QAC5B,MAAM,kBAAkB,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;QAC/E,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,UAAU,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAA;QAClG,IAAI,CAAC,kBAAkB,IAAI,CAAC,aAAa;YAAE,SAAQ;QACnD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAA;QAE5B,IAAI,kBAAkB,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAA,mCAAmB,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YAClF,MAAM,GAAG,GAAG,IAAA,mCAAmB,EAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YAC3E,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnB,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,WAAW,CAAC,oBAAoB,EAAE,2BAA2B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACrH,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QACpC,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,CAAC,mBAAmB,EAAE,IAAI,EAAE,kCAA0B,CAAC,GAAG,CAAC,EAAE,eAAe,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5G,CAAC;QACH,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,OAAO,GAAa,EAAE,CAAA;YAC5B,MAAM,aAAa,GAAa,EAAE,CAAA;YAClC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;YAC7G,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,WAAW,CAAC,oBAAoB,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YAClG,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACxG,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,kBAAkB,EAAE,CAAC;YACnD,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,WAAW,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAA;QAC7F,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,CAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;IAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACnF,OAAO,CAAC,CAAA;IACV,CAAC,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1E,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAA;AAC/F,CAAC"}
@@ -1,5 +1,5 @@
1
1
  /**
2
- * Model catalog (LLD #70, model catalog & cohort wizard).
2
+ * Model catalog (model catalog & cohort wizard).
3
3
  *
4
4
  * `packages/shared-types/src/providers.ts` describes what a provider's
5
5
  * CREDENTIAL looks like — field names, types, docs URL. It says nothing about
@@ -72,7 +72,7 @@ export declare function findCatalogModel(input: string): ModelCatalogEntry | und
72
72
  /**
73
73
  * Providers whose models run on infrastructure the operator controls. Every
74
74
  * other registry provider is a hosted API. Judges are self-hosted only (owner
75
- * rule, 2026-10-03; LLD #72), so these are the only providers a judge model
75
+ * rule, 2026-10-03), so these are the only providers a judge model
76
76
  * may come from.
77
77
  */
78
78
  export declare const SELF_HOSTED_MODEL_PROVIDER_IDS: ReadonlySet<string>;
@@ -8,7 +8,7 @@
8
8
  //
9
9
  // See packages/shared-types/src/modelCatalog.ts for the ModelCatalogEntry type
10
10
  // and the helpers (findCatalogModel, normalizeModelRef, selfHostedJudgeModelChoices) that
11
- // consume this data. LLD #70.
11
+ // consume this data.
12
12
  Object.defineProperty(exports, "__esModule", { value: true });
13
13
  exports.MODEL_CATALOG_GENERATED = void 0;
14
14
  exports.MODEL_CATALOG_GENERATED = [