@kryptosai/mcp-observatory 0.27.0 → 1.28.1

package/dist/src/audit.js

@@ -0,0 +1,359 @@
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { extractObservatoryFindings } from "./findings.js";
+import { runTarget } from "./runner.js";
+import { loadSecurityProfile } from "./security-profiles.js";
+import { validateTargetConfig } from "./validate.js";
+function stableHash(value) {
+    return createHash("sha256").update(JSON.stringify(value)).digest("hex").slice(0, 24);
+}
+function severityFromObservatory(finding) {
+    if (finding.category === "security" && finding.ruleId.includes("credential-pattern"))
+        return "critical";
+    if (finding.category === "attack-sim" && finding.ruleId.includes("credential-like-output"))
+        return "critical";
+    if (finding.category === "attack-sim" && finding.ruleId.includes("canary-exposed"))
+        return "critical";
+    return finding.severity;
+}
+function controlsForFinding(profile, finding) {
+    const direct = profile.ruleControls[finding.ruleId];
+    if (direct)
+        return direct;
+    const fromCategory = profile.categoryControls[finding.category] ?? profile.categoryControls[finding.checkId];
+    return fromCategory ?? ["trust_boundaries"];
+}
+function normalizeFinding(profile, artifact, finding, generatedAt) {
+    const severity = severityFromObservatory(finding);
+    const controlMappings = controlsForFinding(profile, finding);
+    const fingerprint = stableHash({
+        target: artifact.target.targetId,
+        rule: finding.ruleId,
+        subject: finding.subject,
+        description: finding.message,
+    });
+    return {
+        id: finding.id,
+        check_id: finding.checkId,
+        rule_id: finding.ruleId,
+        title: finding.title,
+        description: finding.message,
+        severity,
+        category: finding.category,
+        target: {
+            target_id: artifact.target.targetId,
+            subject_type: finding.subject.type,
+            subject_name: finding.subject.name,
+        },
+        evidence: finding.evidence ?? {},
+        recommendation: finding.recommendation ?? "Review this MCP release-gate finding before production deployment.",
+        confidence: severity === "info" ? "medium" : "high",
+        fingerprint,
+        control_mappings: controlMappings,
+        generated_at: generatedAt,
+    };
+}
+function envSecretFindings(profile, target, generatedAt) {
+    if (target.adapter !== "local-process" || !target.env)
+        return [];
+    const secretLikeNames = Object.keys(target.env).filter((name) => /(?:secret|token|password|passwd|api[_-]?key|credential)/i.test(name));
+    return secretLikeNames.map((name) => {
+        const fingerprint = stableHash({ target: target.targetId, env: name, rule: "env-secret" });
+        return {
+            id: `mcp-observatory/audit/env-secret/${fingerprint}`,
+            check_id: "security",
+            rule_id: "mcp-observatory/audit/env-secret",
+            title: "Secret-like environment variable configured",
+            description: `Target environment contains secret-like variable "${name}".`,
+            severity: "critical",
+            category: "secrets_exposure",
+            target: { target_id: target.targetId, subject_type: "target", subject_name: target.targetId },
+            evidence: { env_var: name, value_redacted: true },
+            recommendation: "Use a secret manager or CI secret store and verify the MCP server never returns this value in tool responses or logs.",
+            confidence: "high",
+            fingerprint,
+            control_mappings: profile.ruleControls["mcp-observatory/security/credential-pattern"] ?? ["secrets_exposure", "auditability"],
+            generated_at: generatedAt,
+        };
+    });
+}
+function auditabilityFindings(profile, artifact, generatedAt) {
+    const hasAuditHint = Object.values(artifact.target.metadata ?? {}).some((value) => /audit|log|event|trace/i.test(value));
+    if (hasAuditHint)
+        return [];
+    const fingerprint = stableHash({ target: artifact.target.targetId, rule: "auditability-not-declared" });
+    return [{
+            id: `mcp-observatory/audit/auditability/${fingerprint}`,
+            check_id: "conformance",
+            rule_id: "mcp-observatory/audit/auditability-not-declared",
+            title: "Audit logging not declared",
+            description: "The target did not declare structured audit logging, event output, or traceability metadata for tool calls.",
+            severity: "medium",
+            category: "auditability",
+            target: { target_id: artifact.target.targetId, subject_type: "target", subject_name: artifact.target.targetId },
+            evidence: { metadata_keys: Object.keys(artifact.target.metadata ?? {}) },
+            recommendation: "Document how tool calls, permission decisions, failures, and sensitive data handling are logged for security review.",
+            confidence: "medium",
+            fingerprint,
+            control_mappings: profile.categoryControls["tools-invoke"] ?? ["auditability"],
+            generated_at: generatedAt,
+        }];
+}
+function computeTrustStatus(findings) {
+    if (findings.some((finding) => finding.severity === "critical"))
+        return "critical_risk";
+    if (findings.some((finding) => finding.severity === "high"))
+        return "high_risk";
+    if (findings.some((finding) => finding.severity === "medium"))
+        return "needs_review";
+    if (findings.length === 0 || findings.every((finding) => finding.severity === "info"))
+        return "enterprise_ready";
+    return "scanned";
+}
+function computeScore(findings) {
+    const penalty = findings.reduce((sum, finding) => {
+        if (finding.severity === "critical")
+            return sum + 35;
+        if (finding.severity === "high")
+            return sum + 22;
+        if (finding.severity === "medium")
+            return sum + 10;
+        if (finding.severity === "low")
+            return sum + 3;
+        return sum + 0;
+    }, 0);
+    return Math.max(0, Math.min(100, 100 - penalty));
+}
+function countSeverities(findings) {
+    return {
+        critical: findings.filter((finding) => finding.severity === "critical").length,
+        high: findings.filter((finding) => finding.severity === "high").length,
+        medium: findings.filter((finding) => finding.severity === "medium").length,
+        low: findings.filter((finding) => finding.severity === "low").length,
+        info: findings.filter((finding) => finding.severity === "info").length,
+    };
+}
+function countControls(profile, findings) {
+    const counts = Object.fromEntries(profile.controlAreas.map((control) => [control, 0]));
+    for (const finding of findings) {
+        for (const control of finding.control_mappings)
+            counts[control] += 1;
+    }
+    return counts;
+}
+export function buildAuditReport(artifact, target, profileId = "nsa-mcp") {
+    const profile = loadSecurityProfile(profileId);
+    const generatedAt = new Date().toISOString();
+    const normalized = extractObservatoryFindings(artifact)
+        .map((finding) => normalizeFinding(profile, artifact, finding, generatedAt));
+    const rawFindings = [
+        ...normalized,
+        ...envSecretFindings(profile, target, generatedAt),
+        ...auditabilityFindings(profile, artifact, generatedAt),
+    ];
+    const findings = [...new Map(rawFindings.map((finding) => [finding.fingerprint, finding])).values()];
+    const severityCounts = countSeverities(findings);
+    const score = computeScore(findings);
+    const trustStatus = computeTrustStatus(findings);
+    const summary = {
+        profile: profile.id,
+        generated_at: generatedAt,
+        target_id: artifact.target.targetId,
+        score,
+        trust_status: trustStatus,
+        finding_count: findings.length,
+        pass_count: artifact.checks.filter((check) => check.status === "pass").length,
+        warning_count: severityCounts.medium + severityCounts.low,
+        fail_count: severityCounts.critical + severityCounts.high,
+        severity_counts: severityCounts,
+        control_counts: countControls(profile, findings),
+    };
+    return {
+        report_type: "mcp-observatory-audit",
+        schema_version: "1.0.0",
+        profile: {
+            id: profile.id,
+            title: profile.title,
+            description: profile.description,
+            disclaimer: profile.disclaimer,
+            controlAreas: profile.controlAreas,
+        },
+        artifact,
+        summary,
+        findings,
+    };
+}
+export async function runAudit(target, profileId = "nsa-mcp") {
+    const artifact = await runTarget(target, { invokeTools: true, securityCheck: true, attackSimulation: {} });
+    return buildAuditReport(artifact, target, profileId);
+}
+export function auditScore(report) {
+    return {
+        target_id: report.summary.target_id,
+        profile: report.summary.profile,
+        score: report.summary.score,
+        status: report.summary.trust_status,
+        finding_count: report.summary.finding_count,
+        critical: report.summary.severity_counts.critical,
+        high: report.summary.severity_counts.high,
+        medium: report.summary.severity_counts.medium,
+        low: report.summary.severity_counts.low,
+        info: report.summary.severity_counts.info,
+        generated_at: report.summary.generated_at,
+    };
+}
+function markdownTable(rows) {
+    if (rows.length === 0)
+        return "";
+    return [
+        `| ${rows[0].join(" | ")} |`,
+        `| ${rows[0].map(() => "---").join(" | ")} |`,
+        ...rows.slice(1).map((row) => `| ${row.join(" | ")} |`),
+    ].join("\n");
+}
+function escapeCell(value) {
+    const text = typeof value === "string" ? value : JSON.stringify(value ?? "");
+    return text.replaceAll("|", "\\|").replaceAll("\n", " ");
+}
+export function renderAuditMarkdown(report) {
+    const grouped = new Map();
+    for (const control of report.profile.controlAreas)
+        grouped.set(control, []);
+    for (const finding of report.findings) {
+        for (const control of finding.control_mappings) {
+            grouped.get(control)?.push(finding);
+        }
+    }
+    const lines = [
+        "# MCP Observatory Security Audit",
+        "",
+        `**Target:** \`${report.summary.target_id}\``,
+        `**Profile:** \`${report.profile.id}\` - ${report.profile.title}`,
+        `**Generated:** ${report.summary.generated_at}`,
+        "",
+        "## Executive Summary",
+        "",
+        `MCP Observatory evaluated this server as a security release gate before deployment into sensitive, regulated, or mission-critical agentic AI environments.`,
+        "",
+        `**Overall risk score:** ${report.summary.score}/100`,
+        `**Trust status:** \`${report.summary.trust_status}\``,
+        `**Findings:** ${report.summary.finding_count} total (${report.summary.severity_counts.critical} critical, ${report.summary.severity_counts.high} high, ${report.summary.severity_counts.medium} medium, ${report.summary.severity_counts.low} low, ${report.summary.severity_counts.info} info)`,
+        `**Checks:** ${report.summary.pass_count} pass, ${report.summary.warning_count} warning, ${report.summary.fail_count} fail`,
+        "",
+        `> ${report.profile.disclaimer}`,
+        "",
+        "## Control Summary",
+        "",
+        markdownTable([
+            ["Control Area", "Findings"],
+            ...report.profile.controlAreas.map((control) => [control, String(report.summary.control_counts[control] ?? 0)]),
+        ]),
+        "",
+        "## Findings By Control Area",
+    ];
+    for (const [control, findings] of grouped) {
+        if (findings.length === 0)
+            continue;
+        lines.push("", `### ${control}`, "");
+        for (const finding of findings) {
+            lines.push(`#### [${finding.severity}] ${finding.title}`, "", finding.description, "", `- Rule: \`${finding.rule_id}\``, `- Check: \`${finding.check_id}\``, `- Target: \`${finding.target.subject_name ?? finding.target.target_id}\``, `- Confidence: \`${finding.confidence}\``, `- Fingerprint: \`${finding.fingerprint}\``, `- Evidence: \`${escapeCell(JSON.stringify(finding.evidence))}\``, `- Recommendation: ${finding.recommendation}`, "");
+        }
+    }
+    lines.push("## GitHub Code Scanning", "", "Run the same audit with `--format sarif` and upload the result with GitHub Code Scanning. Each normalized finding is emitted as one SARIF result with control mapping tags.");
+    return lines.join("\n");
+}
+function sarifLevel(severity) {
+    if (severity === "critical" || severity === "high")
+        return "error";
+    if (severity === "medium")
+        return "warning";
+    return "note";
+}
+export function renderAuditSarif(report, artifactUri = "mcp-observatory-audit.json") {
+    const seenRules = new Set();
+    const rules = [];
+    const results = [];
+    for (const finding of report.findings) {
+        if (!seenRules.has(finding.rule_id)) {
+            seenRules.add(finding.rule_id);
+            rules.push({
+                id: finding.rule_id,
+                name: finding.title,
+                shortDescription: { text: finding.title },
+                fullDescription: { text: finding.description },
+                defaultConfiguration: { level: sarifLevel(finding.severity) },
+                help: { text: `${finding.recommendation}\n\nTrust status: ${report.summary.trust_status}. Controls: ${finding.control_mappings.join(", ")}.` },
+                properties: {
+                    tags: ["mcp", "mcp-observatory", report.profile.id, ...finding.control_mappings],
+                    control_mappings: finding.control_mappings,
+                    confidence: finding.confidence,
+                },
+            });
+        }
+        results.push({
+            ruleId: finding.rule_id,
+            level: sarifLevel(finding.severity),
+            message: { text: finding.description },
+            locations: [{
+                    physicalLocation: {
+                        artifactLocation: { uri: artifactUri },
+                        region: { startLine: 1 },
+                    },
+                }],
+            partialFingerprints: {
+                "mcp-observatory/fingerprint": finding.fingerprint,
+            },
+            properties: {
+                id: finding.id,
+                check_id: finding.check_id,
+                severity: finding.severity,
+                category: finding.category,
+                target: finding.target,
+                control_mappings: finding.control_mappings,
+                confidence: finding.confidence,
+                tags: ["mcp", "mcp-observatory", report.profile.id, ...finding.control_mappings],
+            },
+        });
+    }
+    return JSON.stringify({
+        $schema: "https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json",
+        version: "2.1.0",
+        runs: [{
+                tool: {
+                    driver: {
+                        name: "mcp-observatory",
+                        informationUri: "https://github.com/KryptosAI/mcp-observatory",
+                        rules,
+                    },
+                },
+                automationDetails: { id: `mcp-observatory/audit/${report.summary.target_id}` },
+                results,
+            }],
+    }, null, 2);
+}
+export async function resolveAuditTarget(input) {
+    if (input.length === 0)
+        throw new Error("Provide a target path or command.");
+    const first = input[0];
+    const resolved = path.resolve(first);
+    if (input.length === 1 && existsSync(resolved)) {
+        const statPath = resolved;
+        const targetPath = path.join(statPath, "mcp-observatory.target.json");
+        const filePath = statPath.endsWith(".json") ? statPath : targetPath;
+        const target = validateTargetConfig(JSON.parse(await readFile(filePath, "utf8")));
+        if (target.adapter === "local-process" && !target.cwd && !statPath.endsWith(".json")) {
+            return { ...target, cwd: statPath };
+        }
+        return target;
+    }
+    return {
+        targetId: input[0],
+        adapter: "local-process",
+        command: input[0],
+        args: input.slice(1),
+        timeoutMs: 15_000,
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/src/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,0BAA0B,EAA2B,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAkD,MAAM,wBAAwB,CAAC;AAE7G,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AA+DrD,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,uBAAuB,CAAC,OAA2B;IAC1D,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAAE,OAAO,UAAU,CAAC;IACxG,IAAI,OAAO,CAAC,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9G,IAAI,OAAO,CAAC,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,UAAU,CAAC;IACtG,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAwB,EAAE,OAA2B;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7G,OAAO,YAAY,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAwB,EACxB,QAAqB,EACrB,OAA2B,EAC3B,WAAmB;IAEnB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,UAAU,CAAC;QAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;QAChC,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,OAAO;KAC7B,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,QAAQ;QACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE;YACN,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;YACnC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAClC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;SACnC;QACD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;QAChC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,oEAAoE;QAC9G,UAAU,EAAE,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;QACnD,WAAW;QACX,gBAAgB,EAAE,eAAe;QACjC,YAAY,EAAE,WAAW;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAwB,EAAE,MAAoB,EAAE,WAAmB;IAC5F,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACjE,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACxI,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,MAAM,WAAW,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3F,OAAO;YACL,EAAE,EAAE,oCAAoC,WAAW,EAAE;YACrD,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,kCAAkC;YAC3C,KAAK,EAAE,6CAA6C;YACpD,WAAW,EAAE,qDAAqD,IAAI,IAAI;YAC1E,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,QAAQ,EAAE;YAC7F,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE;YACjD,cAAc,EAAE,uHAAuH;YACvI,UAAU,EAAE,MAAM;YAClB,WAAW;YACX,gBAAgB,EAAE,OAAO,CAAC,YAAY,CAAC,6CAA6C,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,CAAC;YAC7H,YAAY,EAAE,WAAW;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAwB,EAAE,QAAqB,EAAE,WAAmB;IAChG,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACzH,IAAI,YAAY;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACxG,OAAO,CAAC;YACN,EAAE,EAAE,sCAAsC,WAAW,EAAE;YACvD,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,iDAAiD;YAC1D,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,6GAA6G;YAC1H,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE;YAC/G,QAAQ,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE;YACxE,cAAc,EAAE,sHAAsH;YACtI,UAAU,EAAE,QAAQ;YACpB,WAAW;YACX,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC;YAC9E,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAqC;IAC/D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC;QAAE,OAAO,eAAe,CAAC;IACxF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC;QAAE,OAAO,WAAW,CAAC;IAChF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAAE,OAAO,cAAc,CAAC;IACrF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACjH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,QAAqC;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;QAC/C,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU;YAAE,OAAO,GAAG,GAAG,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,GAAG,GAAG,EAAE,CAAC;QACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,GAAG,GAAG,EAAE,CAAC;QACnD,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK;YAAE,OAAO,GAAG,GAAG,CAAC,CAAC;QAC/C,OAAO,GAAG,GAAG,CAAC,CAAC;IACjB,CAAC,EAAE,CAAC,CAAC,CAAC;IACN,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,eAAe,CAAC,QAAqC;IAC5D,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;QAC9E,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;QACtE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;QAC1E,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM;QACpE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAwB,EAAE,QAAqC;IACpF,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAwC,CAAC;IAC9H,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,gBAAgB;YAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAqB,EAAE,MAAoB,EAAE,SAAS,GAAG,SAAS;IACjG,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,0BAA0B,CAAC,QAAQ,CAAC;SACpD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/E,MAAM,WAAW,GAAG;QAClB,GAAG,UAAU;QACb,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC;QAClD,GAAG,oBAAoB,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC;KACxD,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACrG,MAAM,cAAc,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,OAAO,GAAiB;QAC5B,OAAO,EAAE,OAAO,CAAC,EAAE;QACnB,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;QACnC,KAAK;QACL,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;QAC7E,aAAa,EAAE,cAAc,CAAC,MAAM,GAAG,cAAc,CAAC,GAAG;QACzD,UAAU,EAAE,cAAc,CAAC,QAAQ,GAAG,cAAc,CAAC,IAAI;QACzD,eAAe,EAAE,cAAc;QAC/B,cAAc,EAAE,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;KACjD,CAAC;IACF,OAAO;QACL,WAAW,EAAE,uBAAuB;QACpC,cAAc,EAAE,OAAO;QACvB,OAAO,EAAE;YACP,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC;QACD,QAAQ;QACR,OAAO;QACP,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAoB,EAAE,SAAS,GAAG,SAAS;IACxE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3G,OAAO,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAmB;IAC5C,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;QACnC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;QAC/B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;QAC3B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;QACnC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;QAC3C,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ;QACjD,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI;QACzC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM;QAC7C,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG;QACvC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI;QACzC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB;IACrC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO;QACL,KAAK,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI;QAC7B,KAAK,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI;QAC9C,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;KACxD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC5E,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5E,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,kCAAkC;QAClC,EAAE;QACF,iBAAiB,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI;QAC7C,kBAAkB,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE;QACjE,kBAAkB,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE;QAC/C,EAAE;QACF,sBAAsB;QACtB,EAAE;QACF,4JAA4J;QAC5J,EAAE;QACF,2BAA2B,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM;QACrD,uBAAuB,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI;QACtD,iBAAiB,MAAM,CAAC,OAAO,CAAC,aAAa,WAAW,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,cAAc,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,UAAU,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,YAAY,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,QAAQ;QACjS,eAAe,MAAM,CAAC,OAAO,CAAC,UAAU,UAAU,MAAM,CAAC,OAAO,CAAC,aAAa,aAAa,MAAM,CAAC,OAAO,CAAC,UAAU,OAAO;QAC3H,EAAE;QACF,KAAK,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE;QAChC,EAAE;QACF,oBAAoB;QACpB,EAAE;QACF,aAAa,CAAC;YACZ,CAAC,cAAc,EAAE,UAAU,CAAC;YAC5B,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAChH,CAAC;QACF,EAAE;QACF,6BAA6B;KAC9B,CAAC;IAEF,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACpC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CACR,SAAS,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,KAAK,EAAE,EAC7C,EAAE,EACF,OAAO,CAAC,WAAW,EACnB,EAAE,EACF,aAAa,OAAO,CAAC,OAAO,IAAI,EAChC,cAAc,OAAO,CAAC,QAAQ,IAAI,EAClC,eAAe,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAC1E,mBAAmB,OAAO,CAAC,UAAU,IAAI,EACzC,oBAAoB,OAAO,CAAC,WAAW,IAAI,EAC3C,iBAAiB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EACjE,qBAAqB,OAAO,CAAC,cAAc,EAAE,EAC7C,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR,yBAAyB,EACzB,EAAE,EACF,6KAA6K,CAC9K,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,QAAuB;IACzC,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACnE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAmB,EAAE,WAAW,GAAG,4BAA4B;IAC9F,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,OAAO,CAAC,OAAO;gBACnB,IAAI,EAAE,OAAO,CAAC,KAAK;gBACnB,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE;gBACzC,eAAe,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE;gBAC9C,oBAAoB,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAC7D,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,cAAc,qBAAqB,MAAM,CAAC,OAAO,CAAC,YAAY,eAAe,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC9I,UAAU,EAAE;oBACV,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;oBAChF,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;oBAC1C,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;YACnC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE;YACtC,SAAS,EAAE,CAAC;oBACV,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE;wBACtC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;qBACzB;iBACF,CAAC;YACF,mBAAmB,EAAE;gBACnB,6BAA6B,EAAE,OAAO,CAAC,WAAW;aACnD;YACD,UAAU,EAAE;gBACV,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;aACjF;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,4FAA4F;QACrG,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,CAAC;gBACL,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,iBAAiB;wBACvB,cAAc,EAAE,8CAA8C;wBAC9D,KAAK;qBACN;iBACF;gBACD,iBAAiB,EAAE,EAAE,EAAE,EAAE,yBAAyB,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE;gBAC9E,OAAO;aACR,CAAC;KACH,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAe;IACtD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,QAAQ,CAAC;QAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QACpE,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrF,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAE;QACnB,OAAO,EAAE,eAAe;QACxB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAE;QAClB,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACpB,SAAS,EAAE,MAAM;KAClB,CAAC;AACJ,CAAC"}

package/dist/src/cassette.js

@@ -1,6 +1,7 @@
-import { readFile, writeFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { ensureDirectory } from "./storage.js";
+import { writeTextFileAtomic } from "./utils/files.js";
 import { slugify } from "./utils/ids.js";
 // ── I/O ──────────────────────────────────────────────────────────────────────
 export function defaultCassettesDirectory(cwd = process.cwd()) {
@@ -11,7 +12,7 @@ export async function saveCassette(cassette, outDir) {
     const timestamp = new Date().toISOString().replaceAll(":", "-");
     const fileName = `${timestamp}--${slugify(cassette.targetId)}.cassette.json`;
     const filePath = path.join(outDir, fileName);
-    await writeFile(filePath, JSON.stringify(cassette, null, 2) + "\n", "utf8");
+    await writeTextFileAtomic(filePath, JSON.stringify(cassette, null, 2) + "\n");
     return filePath;
 }
 export async function loadCassette(filePath) {

package/dist/src/cassette.js.map

@@ -1 +1 @@
-{"version":3,"file":"cassette.js","sourceRoot":"","sources":["../../src/cassette.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAqBzC,gFAAgF;AAEhF,MAAM,UAAU,yBAAyB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAkB,EAClB,MAAc;IAEd,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,GAAG,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE1C,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAAgC,CAAC,SAAS,CAAC,KAAK,CAAC;QAClD,CAAC,KAAK,CAAC,OAAO,CAAE,IAAgC,CAAC,SAAS,CAAC,CAAC,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,4CAA4C,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,IAAgB,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"cassette.js","sourceRoot":"","sources":["../../src/cassette.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAqBzC,gFAAgF;AAEhF,MAAM,UAAU,yBAAyB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAkB,EAClB,MAAc;IAEd,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,GAAG,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE1C,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAAgC,CAAC,SAAS,CAAC,KAAK,CAAC;QAClD,CAAC,KAAK,CAAC,OAAO,CAAE,IAAgC,CAAC,SAAS,CAAC,CAAC,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,4CAA4C,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,IAAgB,CAAC;AAC1B,CAAC"}

package/dist/src/checks/attack-sim.d.ts

@@ -0,0 +1,20 @@
+import type { CheckResult, RunArtifact } from "../types.js";
+import { type ReceiptAction } from "../action-receipt.js";
+import { type CheckContext, type ObservedCheck } from "./base.js";
+export type AttackClass = "tool-poisoning" | "exfiltration-canary" | "permission-boundary" | "contract-drift";
+export type AttackFindingSeverity = "high" | "medium" | "low";
+export interface AttackSimulationFinding {
+    ruleId: string;
+    attackClass: AttackClass;
+    severity: AttackFindingSeverity;
+    itemType: "target" | "tool" | "prompt" | "resource" | "schema" | "response";
+    itemName: string;
+    message: string;
+    evidence: Record<string, unknown>;
+    recommendation: string;
+    recommendedAction?: ReceiptAction;
+}
+export interface AttackSimulationOptions {
+    baseline?: RunArtifact;
+}
+export declare function runAttackSimulationCheck(context: CheckContext, previousChecks: CheckResult[], options?: AttackSimulationOptions): Promise<ObservedCheck>;