@kryptosai/mcp-observatory 0.28.0 → 1.28.1

package/dist/src/receipt.js

@@ -0,0 +1,375 @@
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { auditScore, renderAuditMarkdown, renderAuditSarif } from "./audit.js";
+const SAFE_MODE_STATEMENT = "Safe-mode only: MCP Observatory inspects metadata, schemas, startup behavior, and inert attack-readiness evidence. It does not execute destructive payloads, exfiltrate secrets, or contact attacker-controlled callbacks.";
+function quoteArg(value) {
+    if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(value))
+        return value;
+    return JSON.stringify(value);
+}
+function targetCommand(target) {
+    if (target.adapter === "http")
+        return target.url;
+    return [target.command, ...target.args].map(quoteArg).join(" ");
+}
+function targetPackageOrRepo(target) {
+    const metadata = target.metadata ?? {};
+    return metadata["package"] ?? metadata["repo"] ?? metadata["repository"] ?? metadata["source"] ?? null;
+}
+function packageManager(target) {
+    if (target.adapter !== "local-process")
+        return null;
+    if (target.command === "npx" || target.command === "npm" || target.args.some((arg) => arg.includes("npm")))
+        return "npm";
+    if (target.command === "pnpm" || target.args.some((arg) => arg.includes("pnpm")))
+        return "pnpm";
+    if (target.command === "yarn" || target.args.some((arg) => arg.includes("yarn")))
+        return "yarn";
+    if (target.command === "uvx" || target.command === "uv")
+        return "uv";
+    if (target.command === "pipx" || target.command === "python" || target.command === "python3")
+        return "python";
+    return null;
+}
+function resolvedIdentity(report, target) {
+    const serverName = report.artifact.target.serverName;
+    const serverVersion = report.artifact.target.serverVersion;
+    if (serverName && serverVersion)
+        return `${serverName}@${serverVersion}`;
+    if (serverName)
+        return serverName;
+    if (target.adapter === "local-process" && target.command === "npx") {
+        const pkg = target.args.find((arg) => !arg.startsWith("-"));
+        return pkg ?? null;
+    }
+    return null;
+}
+function safeWorkingDirectory(target) {
+    if (target.adapter !== "local-process" || !target.cwd)
+        return null;
+    const resolved = path.resolve(target.cwd);
+    const home = os.homedir();
+    if (resolved === home || resolved.startsWith(`${home}${path.sep}`))
+        return null;
+    return resolved;
+}
+function safePath(value) {
+    if (!value)
+        return null;
+    const resolved = path.resolve(value);
+    const home = os.homedir();
+    if (resolved === home || resolved.startsWith(`${home}${path.sep}`))
+        return path.basename(value);
+    return value;
+}
+function inferEnvironmentClass() {
+    if (process.env["MCP_OBSERVATORY_PUBLIC_SAFETY_INDEX"] === "1")
+        return "public_safety_index";
+    if (process.env["MCP_OBSERVATORY_PRIVATE_FLEET"] === "1")
+        return "private_fleet";
+    if (process.env["CI"] === "true" || process.env["GITHUB_ACTIONS"] === "true")
+        return "ci";
+    return "local";
+}
+function sha256Text(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+async function sha256File(filePath) {
+    if (!filePath || !existsSync(filePath))
+        return null;
+    return sha256Text(await readFile(filePath, "utf8"));
+}
+function schemaSummary(report) {
+    const schemaCheck = report.artifact.checks.find((check) => check.id === "schema-quality");
+    if (!schemaCheck)
+        return "No dedicated schema-quality check was present.";
+    const findingCount = schemaCheck.evidence.reduce((sum, evidence) => sum + (evidence.findings?.length ?? 0), 0);
+    return `${schemaCheck.status}: ${schemaCheck.message}${findingCount > 0 ? ` (${findingCount} schema finding(s))` : ""}`;
+}
+function toolSurfaceSummary(report) {
+    const toolsCheck = report.artifact.checks.find((check) => check.id === "tools");
+    if (!toolsCheck)
+        return "Tool surface was not listed.";
+    const identifiers = toolsCheck.evidence.flatMap((evidence) => evidence.identifiers ?? []);
+    const count = identifiers.length > 0 ? identifiers.length : toolsCheck.evidence.reduce((sum, evidence) => sum + (evidence.itemCount ?? 0), 0);
+    const sample = identifiers.slice(0, 5).join(", ");
+    return `${toolsCheck.status}: ${count} tool(s) observed${sample ? ` (${sample}${identifiers.length > 5 ? ", ..." : ""})` : ""}.`;
+}
+function attackSimulationSummary(report) {
+    const attackCheck = report.artifact.checks.find((check) => check.id === "attack-sim");
+    if (!attackCheck)
+        return "Attack simulation evidence was not generated for this run.";
+    const findingCount = attackCheck.evidence.reduce((sum, evidence) => sum + (evidence.findings?.length ?? 0), 0);
+    return `${attackCheck.status}: ${attackCheck.message}${findingCount > 0 ? ` (${findingCount} attack-sim finding(s))` : ""}`;
+}
+function driftSummary(report) {
+    const driftFindings = report.findings.filter((finding) => finding.rule_id.includes("drift") || finding.category.includes("drift"));
+    if (driftFindings.length === 0)
+        return "No baseline or drift finding was included in this receipt.";
+    return `${driftFindings.length} baseline/drift finding(s) summarized.`;
+}
+export function mapStatusToReceiptVerdict(report) {
+    if (report.artifact.fatalError) {
+        return {
+            score: report.summary.score,
+            status: report.summary.trust_status,
+            state: "could_not_evaluate",
+            action: "rerun",
+            reason: report.artifact.fatalError.split("\n")[0] ?? "Evaluation did not complete.",
+        };
+    }
+    const counts = report.summary.severity_counts;
+    const status = auditScore(report).status;
+    if (counts.critical > 0 || status === "critical_risk") {
+        return { score: report.summary.score, status, state: "blocked", action: "escalate", reason: "Critical MCP release-gate findings require escalation before agent dependency." };
+    }
+    if (counts.high > 0 || status === "high_risk") {
+        return { score: report.summary.score, status, state: "blocked", action: "gate", reason: "High-risk MCP findings should block CI until reviewed or fixed." };
+    }
+    if (counts.medium > 0 || status === "needs_review") {
+        return { score: report.summary.score, status, state: "needs_review", action: "gate", reason: "Medium-risk MCP findings need maintainer review before broad agent dependency." };
+    }
+    return { score: report.summary.score, status, state: "ready_for_ci", action: "allow", reason: "No blocking MCP readiness findings were detected." };
+}
+function findingRank(severity) {
+    return severity === "critical" ? 5
+        : severity === "high" ? 4
+            : severity === "medium" ? 3
+                : severity === "low" ? 2
+                    : 1;
+}
+function summarizeEvidence(finding) {
+    const evidence = JSON.stringify(finding.evidence ?? {});
+    if (evidence.length <= 240)
+        return evidence;
+    return `${evidence.slice(0, 237)}...`;
+}
+function blocksCi(severity) {
+    return severity === "critical" || severity === "high" || severity === "medium";
+}
+function receiptFindings(report, limit) {
+    return [...report.findings]
+        .sort((a, b) => findingRank(b.severity) - findingRank(a.severity) || a.title.localeCompare(b.title))
+        .slice(0, limit)
+        .map((finding) => ({
+        id: finding.id,
+        title: finding.title,
+        severity: finding.severity,
+        control_area: finding.control_mappings[0] ?? "trust_boundaries",
+        evidence_summary: summarizeEvidence(finding),
+        recommended_fix: finding.recommendation,
+        blocks_ci: blocksCi(finding.severity),
+        fingerprint: finding.fingerprint,
+    }));
+}
+function ciCommand(target) {
+    return `mcp-observatory setup-ci --all --command ${quoteArg(targetCommand(target))} --sarif --schedule weekly`;
+}
+function rerunCommand(target, profile) {
+    return `mcp-observatory audit ${targetCommand(target)} --profile ${quoteArg(profile)} --format json --output report.json`;
+}
+export async function buildMcpReceipt(report, target, options = {}) {
+    const jsonReportText = JSON.stringify(report, null, 2);
+    const markdownReportText = renderAuditMarkdown(report);
+    const sarifText = renderAuditSarif(report);
+    const expectedArtifacts = [
+        options.jsonReportPath ?? "report.json",
+        options.markdownReportPath ?? "report.md",
+        options.sarifPath ?? "results.sarif",
+    ];
+    const metadata = target.metadata ?? {};
+    return {
+        receipt_type: "mcp-observatory-receipt",
+        schema_version: "1.0.0",
+        subject: {
+            mcp_server_name: report.artifact.target.serverName ?? target.targetId,
+            package_or_repo: targetPackageOrRepo(target),
+            source: target.adapter === "http" ? "http" : "local-process",
+            startup_command: target.adapter === "local-process" ? targetCommand(target) : null,
+            version: report.artifact.target.serverVersion ?? metadata["version"] ?? null,
+            resolved_identity: resolvedIdentity(report, target),
+            target_path_or_url: target.adapter === "http" ? target.url : safePath(target.cwd),
+            commit_sha: metadata["commit_sha"] ?? metadata["commit"] ?? process.env["GITHUB_SHA"] ?? null,
+            package_manager: packageManager(target),
+        },
+        run_context: {
+            generated_at: report.summary.generated_at,
+            mcp_observatory_version: report.artifact.toolVersion,
+            profile: report.summary.profile,
+            safe_mode_statement: SAFE_MODE_STATEMENT,
+            environment_class: options.environmentClass ?? inferEnvironmentClass(),
+            command_invoked: options.commandInvoked ?? rerunCommand(target, report.summary.profile),
+            config_file_used: safePath(options.configFileUsed),
+            runner_os: report.artifact.environment.platform,
+            working_directory: safeWorkingDirectory(target),
+        },
+        evidence: {
+            json_report_path: options.jsonReportPath ?? null,
+            json_report_sha256: options.jsonReportPath ? await sha256File(options.jsonReportPath) : sha256Text(jsonReportText),
+            markdown_report_path: options.markdownReportPath ?? null,
+            markdown_report_sha256: options.markdownReportPath ? await sha256File(options.markdownReportPath) : sha256Text(markdownReportText),
+            html_report_path: options.htmlReportPath ?? null,
+            html_report_sha256: await sha256File(options.htmlReportPath),
+            sarif_path: options.sarifPath ?? null,
+            sarif_sha256: options.sarifPath ? await sha256File(options.sarifPath) : sha256Text(sarifText),
+            schema_summary: schemaSummary(report),
+            tool_surface_summary: toolSurfaceSummary(report),
+            attack_simulation_summary: attackSimulationSummary(report),
+            baseline_or_drift_summary: driftSummary(report),
+        },
+        verdict: mapStatusToReceiptVerdict(report),
+        findings: receiptFindings(report, options.topFindingsLimit ?? 5),
+        reproduction: {
+            rerun_command: rerunCommand(target, report.summary.profile),
+            ci_command: ciCommand(target),
+            sarif_upload_hint: "Generate SARIF with `mcp-observatory audit <target> --format sarif --output results.sarif`, then upload it with GitHub Code Scanning.",
+            expected_artifacts: expectedArtifacts,
+        },
+        maintainer_cta: [
+            { id: "claim_or_update_receipt", label: "Claim this receipt", description: "Confirm the target command and update the receipt with maintainer-approved startup details." },
+            { id: "add_ci", label: "Add CI gate", description: "Run the CI command so every release keeps this MCP receipt current." },
+            { id: "fix_findings", label: "Fix blocking findings", description: "Address findings that block CI or require review." },
+            { id: "request_rerun", label: "Request rerun", description: "Ask MCP Observatory to regenerate this receipt after fixes or target changes." },
+            { id: "provide_safe_startup_mode", label: "Provide safe startup mode", description: "Share a no-secret, non-destructive startup command for public receipt generation." },
+        ],
+        buyer_cta: [
+            { id: "request_private_fleet_receipt_pack", label: "Request private fleet receipt pack", description: "Generate receipts for internal MCP servers without publishing private evidence." },
+            { id: "request_attack_simulation_evidence_pack", label: "Request attack simulation evidence pack", description: "Package safe-mode attack simulation evidence for security review." },
+            { id: "request_ci_sarif_rollout", label: "Request CI/SARIF rollout", description: "Add release gates and GitHub Code Scanning for MCP dependencies." },
+            { id: "request_government_enterprise_pilot", label: "Request government/enterprise pilot", description: "Map receipts to procurement-friendly security evidence and pilot deliverables." },
+        ],
+    };
+}
+function markdownTable(rows) {
+    if (rows.length === 0)
+        return "";
+    return [
+        `| ${rows[0].join(" | ")} |`,
+        `| ${rows[0].map(() => "---").join(" | ")} |`,
+        ...rows.slice(1).map((row) => `| ${row.join(" | ")} |`),
+    ].join("\n");
+}
+function cell(value) {
+    const text = value == null ? "" : typeof value === "string" ? value : JSON.stringify(value);
+    return text.replaceAll("|", "\\|").replaceAll("\n", " ");
+}
+export function renderReceiptMarkdown(receipt) {
+    const lines = [
+        "# MCP Observatory Receipt",
+        "",
+        "A scan finds facts. A report explains facts. A receipt makes facts portable, reproducible, citable, and actionable.",
+        "",
+        "## Verdict",
+        "",
+        `**State:** \`${receipt.verdict.state}\``,
+        `**Action:** \`${receipt.verdict.action}\``,
+        `**Trust status:** \`${receipt.verdict.status}\``,
+        `**Score:** ${receipt.verdict.score}/100`,
+        `**Reason:** ${receipt.verdict.reason}`,
+        "",
+        "## Subject",
+        "",
+        markdownTable([
+            ["Field", "Value"],
+            ["MCP server", cell(receipt.subject.mcp_server_name)],
+            ["Package or repo", cell(receipt.subject.package_or_repo)],
+            ["Source", receipt.subject.source],
+            ["Startup command", cell(receipt.subject.startup_command)],
+            ["Version", cell(receipt.subject.version)],
+            ["Resolved identity", cell(receipt.subject.resolved_identity)],
+            ["Target path or URL", cell(receipt.subject.target_path_or_url)],
+            ["Commit SHA", cell(receipt.subject.commit_sha)],
+            ["Package manager", cell(receipt.subject.package_manager)],
+        ]),
+        "",
+        "## Run Context",
+        "",
+        markdownTable([
+            ["Field", "Value"],
+            ["Generated at", receipt.run_context.generated_at],
+            ["MCP Observatory version", receipt.run_context.mcp_observatory_version],
+            ["Profile", receipt.run_context.profile],
+            ["Environment", receipt.run_context.environment_class],
+            ["Command invoked", cell(receipt.run_context.command_invoked)],
+            ["Config file", cell(receipt.run_context.config_file_used)],
+            ["Runner OS", cell(receipt.run_context.runner_os)],
+            ["Working directory", cell(receipt.run_context.working_directory)],
+        ]),
+        "",
+        `> ${receipt.run_context.safe_mode_statement}`,
+        "",
+        "## Evidence",
+        "",
+        markdownTable([
+            ["Artifact", "Path", "SHA-256"],
+            ["JSON report", cell(receipt.evidence.json_report_path), cell(receipt.evidence.json_report_sha256)],
+            ["Markdown report", cell(receipt.evidence.markdown_report_path), cell(receipt.evidence.markdown_report_sha256)],
+            ["HTML report", cell(receipt.evidence.html_report_path), cell(receipt.evidence.html_report_sha256)],
+            ["SARIF", cell(receipt.evidence.sarif_path), cell(receipt.evidence.sarif_sha256)],
+        ]),
+        "",
+        `- Schema summary: ${receipt.evidence.schema_summary}`,
+        `- Tool surface summary: ${receipt.evidence.tool_surface_summary}`,
+        `- Attack simulation summary: ${receipt.evidence.attack_simulation_summary}`,
+        `- Baseline/drift summary: ${receipt.evidence.baseline_or_drift_summary}`,
+        "",
+        "## Top Findings",
+        "",
+        receipt.findings.length === 0
+            ? "No top findings were included in this receipt."
+            : markdownTable([
+                ["Severity", "Title", "Control", "Blocks CI", "Fingerprint", "Fix"],
+                ...receipt.findings.map((finding) => [
+                    finding.severity,
+                    cell(finding.title),
+                    cell(finding.control_area),
+                    finding.blocks_ci ? "yes" : "no",
+                    finding.fingerprint,
+                    cell(finding.recommended_fix),
+                ]),
+            ]),
+        "",
+        "## Reproduction",
+        "",
+        "Rerun this evaluation:",
+        "",
+        "```bash",
+        receipt.reproduction.rerun_command,
+        "```",
+        "",
+        "Add CI:",
+        "",
+        "```bash",
+        receipt.reproduction.ci_command,
+        "```",
+        "",
+        receipt.reproduction.sarif_upload_hint,
+        "",
+        "Expected artifacts:",
+        "",
+        ...receipt.reproduction.expected_artifacts.map((artifact) => `- \`${artifact}\``),
+        "",
+        "## Maintainer Actions",
+        "",
+        ...receipt.maintainer_cta.map((cta) => `- **${cta.label}:** ${cta.description}`),
+        "",
+        "## Buyer Actions",
+        "",
+        ...receipt.buyer_cta.map((cta) => `- **${cta.label}:** ${cta.description}`),
+    ];
+    return lines.join("\n");
+}
+export function renderReceipt(receipt, format) {
+    if (format === "json")
+        return JSON.stringify(receipt, null, 2);
+    return renderReceiptMarkdown(receipt);
+}
+export function receiptFormatFromPath(outputPath, fallback) {
+    if (!outputPath)
+        return fallback;
+    return /\.json$/i.test(outputPath) ? "json" : "markdown";
+}
+//# sourceMappingURL=receipt.js.map

package/dist/src/receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../../src/receipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAA0F,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA2GvK,MAAM,mBAAmB,GAAG,4NAA4N,CAAC;AAEzP,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,MAAoB;IACzC,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC;IACjD,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAoB;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;AACzG,CAAC;AAED,SAAS,cAAc,CAAC,MAAoB;IAC1C,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzH,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAChG,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAChG,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC9G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAmB,EAAE,MAAoB;IACjE,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;IACrD,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC;IAC3D,IAAI,UAAU,IAAI,aAAa;QAAE,OAAO,GAAG,UAAU,IAAI,aAAa,EAAE,CAAC;IACzE,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QACnE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAoB;IAChD,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,KAAK,GAAG;QAAE,OAAO,qBAAqB,CAAC;IAC7F,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,KAAK,GAAG;QAAE,OAAO,eAAe,CAAC;IACjF,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC1F,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAA4B;IACpD,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB;IACxC,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,gBAAgB,CAAC,CAAC;IAC1F,IAAI,CAAC,WAAW;QAAE,OAAO,gDAAgD,CAAC;IAC1E,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/G,OAAO,GAAG,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,OAAO,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY,qBAAqB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC1H,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAmB;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;IAChF,IAAI,CAAC,UAAU;QAAE,OAAO,8BAA8B,CAAC;IACvD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9I,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,GAAG,UAAU,CAAC,MAAM,KAAK,KAAK,oBAAoB,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;AACnI,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAmB;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;IACtF,IAAI,CAAC,WAAW;QAAE,OAAO,4DAA4D,CAAC;IACtF,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/G,OAAO,GAAG,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,OAAO,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY,yBAAyB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC9H,CAAC;AAED,SAAS,YAAY,CAAC,MAAmB;IACvC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACnI,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,4DAA4D,CAAC;IACpG,OAAO,GAAG,aAAa,CAAC,MAAM,wCAAwC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAmB;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;YAC3B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;YACnC,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,8BAA8B;SACpF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;IAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,gFAAgF,EAAE,CAAC;IACjL,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;IAC9J,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gFAAgF,EAAE,CAAC;IAClL,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;AACtJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAuB;IAC1C,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;YACvB,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACzB,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC;oBACtB,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAkC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,QAAuB;IACvC,OAAO,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,QAAQ,CAAC;AACjF,CAAC;AAED,SAAS,eAAe,CAAC,MAAmB,EAAE,KAAa;IACzD,OAAO,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;SACxB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;SACnG,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;SACf,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACjB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,kBAAkB;QAC/D,gBAAgB,EAAE,iBAAiB,CAAC,OAAO,CAAC;QAC5C,eAAe,EAAE,OAAO,CAAC,cAAc;QACvC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;QACrC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,SAAS,CAAC,MAAoB;IACrC,OAAO,4CAA4C,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC;AACjH,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB,EAAE,OAAe;IACzD,OAAO,yBAAyB,aAAa,CAAC,MAAM,CAAC,cAAc,QAAQ,CAAC,OAAO,CAAC,qCAAqC,CAAC;AAC5H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAmB,EAAE,MAAoB,EAAE,UAA+B,EAAE;IAChH,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,iBAAiB,GAAG;QACxB,OAAO,CAAC,cAAc,IAAI,aAAa;QACvC,OAAO,CAAC,kBAAkB,IAAI,WAAW;QACzC,OAAO,CAAC,SAAS,IAAI,eAAe;KACrC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,OAAO;QACL,YAAY,EAAE,yBAAyB;QACvC,cAAc,EAAE,OAAO;QACvB,OAAO,EAAE;YACP,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ;YACrE,eAAe,EAAE,mBAAmB,CAAC,MAAM,CAAC;YAC5C,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe;YAC5D,eAAe,EAAE,MAAM,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YAClF,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI;YAC5E,iBAAiB,EAAE,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC;YACnD,kBAAkB,EAAE,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;YACjF,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI;YAC7F,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC;SACxC;QACD,WAAW,EAAE;YACX,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;YACzC,uBAAuB,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW;YACpD,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;YAC/B,mBAAmB,EAAE,mBAAmB;YACxC,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,IAAI,qBAAqB,EAAE;YACtE,eAAe,EAAE,OAAO,CAAC,cAAc,IAAI,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YACvF,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC;YAClD,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ;YAC/C,iBAAiB,EAAE,oBAAoB,CAAC,MAAM,CAAC;SAChD;QACD,QAAQ,EAAE;YACR,gBAAgB,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;YAChD,kBAAkB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC;YAClH,oBAAoB,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI;YACxD,sBAAsB,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC;YAClI,gBAAgB,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;YAChD,kBAAkB,EAAE,MAAM,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC;YAC5D,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACrC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YAC7F,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC;YACrC,oBAAoB,EAAE,kBAAkB,CAAC,MAAM,CAAC;YAChD,yBAAyB,EAAE,uBAAuB,CAAC,MAAM,CAAC;YAC1D,yBAAyB,EAAE,YAAY,CAAC,MAAM,CAAC;SAChD;QACD,OAAO,EAAE,yBAAyB,CAAC,MAAM,CAAC;QAC1C,QAAQ,EAAE,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAChE,YAAY,EAAE;YACZ,aAAa,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAC3D,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC;YAC7B,iBAAiB,EAAE,uIAAuI;YAC1J,kBAAkB,EAAE,iBAAiB;SACtC;QACD,cAAc,EAAE;YACd,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,6FAA6F,EAAE;YAC1K,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,qEAAqE,EAAE;YAC1H,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,mDAAmD,EAAE;YACxH,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,+EAA+E,EAAE;YAC7I,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,2BAA2B,EAAE,WAAW,EAAE,mFAAmF,EAAE;SAC1K;QACD,SAAS,EAAE;YACT,EAAE,EAAE,EAAE,oCAAoC,EAAE,KAAK,EAAE,oCAAoC,EAAE,WAAW,EAAE,iFAAiF,EAAE;YACzL,EAAE,EAAE,EAAE,yCAAyC,EAAE,KAAK,EAAE,yCAAyC,EAAE,WAAW,EAAE,mEAAmE,EAAE;YACrL,EAAE,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,0BAA0B,EAAE,WAAW,EAAE,kEAAkE,EAAE;YACtJ,EAAE,EAAE,EAAE,qCAAqC,EAAE,KAAK,EAAE,qCAAqC,EAAE,WAAW,EAAE,gFAAgF,EAAE;SAC3L;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB;IACrC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO;QACL,KAAK,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI;QAC7B,KAAK,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI;QAC9C,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;KACxD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,MAAM,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAmB;IACvD,MAAM,KAAK,GAAG;QACZ,2BAA2B;QAC3B,EAAE;QACF,qHAAqH;QACrH,EAAE;QACF,YAAY;QACZ,EAAE;QACF,gBAAgB,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI;QACzC,iBAAiB,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI;QAC3C,uBAAuB,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI;QACjD,cAAc,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM;QACzC,eAAe,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE;QACvC,EAAE;QACF,YAAY;QACZ,EAAE;QACF,aAAa,CAAC;YACZ,CAAC,OAAO,EAAE,OAAO,CAAC;YAClB,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACrD,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1D,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1D,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1C,CAAC,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAC9D,CAAC,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;YAChE,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAChD,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;SAC3D,CAAC;QACF,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,aAAa,CAAC;YACZ,CAAC,OAAO,EAAE,OAAO,CAAC;YAClB,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC;YAClD,CAAC,yBAAyB,EAAE,OAAO,CAAC,WAAW,CAAC,uBAAuB,CAAC;YACxE,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;YACxC,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,iBAAiB,CAAC;YACtD,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YAC9D,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;YAC3D,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAClD,CAAC,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;SACnE,CAAC;QACF,EAAE;QACF,KAAK,OAAO,CAAC,WAAW,CAAC,mBAAmB,EAAE;QAC9C,EAAE;QACF,aAAa;QACb,EAAE;QACF,aAAa,CAAC;YACZ,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC;YAC/B,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YACnG,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YAC/G,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YACnG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;SAClF,CAAC;QACF,EAAE;QACF,qBAAqB,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE;QACtD,2BAA2B,OAAO,CAAC,QAAQ,CAAC,oBAAoB,EAAE;QAClE,gCAAgC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,EAAE;QAC5E,6BAA6B,OAAO,CAAC,QAAQ,CAAC,yBAAyB,EAAE;QACzE,EAAE;QACF,iBAAiB;QACjB,EAAE;QACF,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC3B,CAAC,CAAC,gDAAgD;YAClD,CAAC,CAAC,aAAa,CAAC;gBACd,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,CAAC;gBACnE,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;oBACnC,OAAO,CAAC,QAAQ;oBAChB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;oBACnB,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;oBAC1B,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;oBAChC,OAAO,CAAC,WAAW;oBACnB,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;iBAC9B,CAAC;aACH,CAAC;QACJ,EAAE;QACF,iBAAiB;QACjB,EAAE;QACF,wBAAwB;QACxB,EAAE;QACF,SAAS;QACT,OAAO,CAAC,YAAY,CAAC,aAAa;QAClC,KAAK;QACL,EAAE;QACF,SAAS;QACT,EAAE;QACF,SAAS;QACT,OAAO,CAAC,YAAY,CAAC,UAAU;QAC/B,KAAK;QACL,EAAE;QACF,OAAO,CAAC,YAAY,CAAC,iBAAiB;QACtC,EAAE;QACF,qBAAqB;QACrB,EAAE;QACF,GAAG,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,QAAQ,IAAI,CAAC;QACjF,EAAE;QACF,uBAAuB;QACvB,EAAE;QACF,GAAG,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;QAChF,EAAE;QACF,kBAAkB;QAClB,EAAE;QACF,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;KAC5E,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAmB,EAAE,MAAqB;IACtE,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAA8B,EAAE,QAAuB;IAC3F,IAAI,CAAC,UAAU;QAAE,OAAO,QAAQ,CAAC;IACjC,OAAO,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;AAC3D,CAAC"}

package/dist/src/reporters/attack-sim.js

@@ -1,4 +1,5 @@
 import { extractObservatoryFindings } from "../findings.js";
+import { buildActionReceipt } from "../action-receipt.js";
 function table(rows) {
     if (rows.length === 0)
         return "_None._";
@@ -31,6 +32,7 @@ export function renderAttackSimulationMarkdown(artifact, reproductionCommand) {
         : medium > 0
             ? "Medium-risk simulated attack findings should be reviewed before production use."
             : "No high-risk simulated attack findings were detected.";
+    const actionReceipt = buildActionReceipt(artifact);
     return [
         "# MCP Attack Simulation Report",
         "",
@@ -40,6 +42,8 @@ export function renderAttackSimulationMarkdown(artifact, reproductionCommand) {
         "",
         `**${verdict}**`,
         "",
+        `**Action receipt:** \`${actionReceipt.action}\` — ${actionReceipt.reason}`,
+        "",
         table([
             ["Target", "Attack Check", "High", "Medium", "Low", "Total"],
             [escapeCell(artifact.target.targetId), escapeCell(attackCheck?.status ?? "skipped"), String(high), String(medium), String(low), String(findings.length)],
@@ -55,9 +59,10 @@ export function renderAttackSimulationMarkdown(artifact, reproductionCommand) {
         "## Findings",
         "",
         table([
-            ["Severity", "Rule", "Subject", "Message", "Recommendation"],
+            ["Severity", "Action", "Rule", "Subject", "Message", "Recommendation"],
             ...findings.map((finding) => [
                 finding.severity,
+                escapeCell(finding.recommendedAction ?? "gate"),
                 `\`${escapeCell(finding.ruleId)}\``,
                 escapeCell(`${finding.subject.type}:${finding.subject.name ?? ""}`),
                 escapeCell(finding.message),

package/dist/src/reporters/attack-sim.js.map

@@ -1 +1 @@
-{"version":3,"file":"attack-sim.js","sourceRoot":"","sources":["../../../src/reporters/attack-sim.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAG5D,SAAS,KAAK,CAAC,IAAgB;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO;QACL,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI;QAC3B,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI;QAC5C,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;KAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,QAAqB;IAC3C,OAAO,0BAA0B,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,QAAqB,EAAE,mBAA2B;IAC/F,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IAClF,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;IAC5E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,CAAC,CAAC,0EAA0E;QAC5E,CAAC,CAAC,MAAM,GAAG,CAAC;YACV,CAAC,CAAC,iFAAiF;YACnF,CAAC,CAAC,uDAAuD,CAAC;IAE9D,OAAO;QACL,gCAAgC;QAChC,EAAE;QACF,gBAAgB,QAAQ,CAAC,SAAS,EAAE;QACpC,EAAE;QACF,sBAAsB;QACtB,EAAE;QACF,KAAK,OAAO,IAAI;QAChB,EAAE;QACF,KAAK,CAAC;YACJ,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC;YAC5D,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,WAAW,EAAE,MAAM,IAAI,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACzJ,CAAC;QACF,EAAE;QACF,0BAA0B;QAC1B,EAAE;QACF,kEAAkE;QAClE,0EAA0E;QAC1E,6EAA6E;QAC7E,kEAAkE;QAClE,EAAE;QACF,aAAa;QACb,EAAE;QACF,KAAK,CAAC;YACJ,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAC;YAC5D,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC3B,OAAO,CAAC,QAAQ;gBAChB,KAAK,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;gBACnC,UAAU,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;gBACnE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC3B,UAAU,CAAC,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC;aAC/D,CAAC;SACH,CAAC;QACF,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,SAAS,CAAC,mBAAmB,CAAC;QAC9B,EAAE;QACF,qBAAqB;QACrB,EAAE;QACF,6EAA6E;QAC7E,6FAA6F;QAC7F,oEAAoE;QACpE,iFAAiF;QACjF,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,uMAAuM;KACxM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"attack-sim.js","sourceRoot":"","sources":["../../../src/reporters/attack-sim.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,SAAS,KAAK,CAAC,IAAgB;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO;QACL,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI;QAC3B,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI;QAC5C,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;KAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,QAAqB;IAC3C,OAAO,0BAA0B,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,QAAqB,EAAE,mBAA2B;IAC/F,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IAClF,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;IAC5E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,CAAC,CAAC,0EAA0E;QAC5E,CAAC,CAAC,MAAM,GAAG,CAAC;YACV,CAAC,CAAC,iFAAiF;YACnF,CAAC,CAAC,uDAAuD,CAAC;IAC9D,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAEnD,OAAO;QACL,gCAAgC;QAChC,EAAE;QACF,gBAAgB,QAAQ,CAAC,SAAS,EAAE;QACpC,EAAE;QACF,sBAAsB;QACtB,EAAE;QACF,KAAK,OAAO,IAAI;QAChB,EAAE;QACF,yBAAyB,aAAa,CAAC,MAAM,QAAQ,aAAa,CAAC,MAAM,EAAE;QAC3E,EAAE;QACF,KAAK,CAAC;YACJ,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC;YAC5D,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,WAAW,EAAE,MAAM,IAAI,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACzJ,CAAC;QACF,EAAE;QACF,0BAA0B;QAC1B,EAAE;QACF,kEAAkE;QAClE,0EAA0E;QAC1E,6EAA6E;QAC7E,kEAAkE;QAClE,EAAE;QACF,aAAa;QACb,EAAE;QACF,KAAK,CAAC;YACJ,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAC;YACtE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC3B,OAAO,CAAC,QAAQ;gBAChB,UAAU,CAAC,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC;gBAC/C,KAAK,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;gBACnC,UAAU,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;gBACnE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC3B,UAAU,CAAC,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC;aAC/D,CAAC;SACH,CAAC;QACF,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,SAAS,CAAC,mBAAmB,CAAC;QAC9B,EAAE;QACF,qBAAqB;QACrB,EAAE;QACF,6EAA6E;QAC7E,6FAA6F;QAC7F,oEAAoE;QACpE,iFAAiF;QACjF,EAAE;QACF,yBAAyB;QACzB,EAAE;QACF,uMAAuM;KACxM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/src/reporters/sarif.js

@@ -13,6 +13,13 @@ function defaultArtifactUri(artifact) {
 function ruleTitle(finding) {
     return finding.title.length > 0 ? finding.title : finding.ruleId;
 }
+function helpText(finding) {
+    const parts = [
+        finding.recommendation,
+        finding.recommendedAction ? `Recommended action: ${finding.recommendedAction}.` : undefined,
+    ].filter(Boolean);
+    return parts.length > 0 ? parts.join("\n\n") : undefined;
+}
 export function renderSarif(artifact, options = {}) {
     const rules = [];
     const results = [];
@@ -22,16 +29,18 @@ export function renderSarif(artifact, options = {}) {
     for (const finding of findings) {
         if (!seenRules.has(finding.ruleId)) {
             seenRules.add(finding.ruleId);
+            const ruleHelp = helpText(finding);
             rules.push({
                 id: finding.ruleId,
                 name: ruleTitle(finding),
                 shortDescription: { text: ruleTitle(finding) },
                 defaultConfiguration: { level: levelFromSeverity(finding.severity) },
-                help: finding.recommendation ? { text: finding.recommendation } : undefined,
+                help: ruleHelp ? { text: ruleHelp } : undefined,
                 helpUri: `https://github.com/KryptosAI/mcp-observatory/tree/main/docs`,
                 properties: {
                     category: finding.category,
                     checkId: finding.checkId,
+                    recommendedAction: finding.recommendedAction,
                     controlRefs: finding.controlRefs,
                     tags: ["mcp", "mcp-observatory", finding.category, ...finding.controlRefs],
                 },
@@ -57,6 +66,7 @@ export function renderSarif(artifact, options = {}) {
                 targetId: artifact.target.targetId,
                 subject: finding.subject,
                 severity: finding.severity,
+                recommendedAction: finding.recommendedAction,
                 controlRefs: finding.controlRefs,
                 tags: ["mcp", "mcp-observatory", finding.category, ...finding.controlRefs],
             },

package/dist/src/reporters/sarif.js.map

@@ -1 +1 @@
-{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../../src/reporters/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAA2B,MAAM,gBAAgB,CAAC;AAErF,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AA8B7C,SAAS,iBAAiB,CAAC,QAAwC;IACjE,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAqB;IAC/C,OAAO,yBAAyB,QAAQ,CAAC,KAAK,OAAO,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,OAA2B;IAC5C,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAqB,EAAE,UAA8B,EAAE;IACjF,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAExE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,OAAO,CAAC,MAAM;gBAClB,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC;gBACxB,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE;gBAC9C,oBAAoB,EAAE,EAAE,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBACpE,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC3E,OAAO,EAAE,6DAA6D;gBACtE,UAAU,EAAE;oBACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;iBAC3E;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;YAClC,SAAS,EAAE,CAAC;oBACV,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE;wBACtC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;qBACzB;iBACF,CAAC;YACF,mBAAmB,EAAE;gBACnB,4BAA4B,EAAE,OAAO,CAAC,EAAE;aACzC;YACD,UAAU,EAAE;gBACV,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBAClC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;aAC3E;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,OAAO,EAAE,4FAA4F;QACrG,OAAO,EAAE,OAAgB;QACzB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,iBAAiB;wBACvB,OAAO,EAAE,YAAY;wBACrB,cAAc,EAAE,8CAA8C;wBAC9D,KAAK;qBACN;iBACF;gBACD,iBAAiB,EAAE;oBACjB,EAAE,EAAE,mBAAmB,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE;iBAClD;gBACD,OAAO;aACR;SACF;KACF,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../../src/reporters/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAA2B,MAAM,gBAAgB,CAAC;AAErF,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AA8B7C,SAAS,iBAAiB,CAAC,QAAwC;IACjE,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAqB;IAC/C,OAAO,yBAAyB,QAAQ,CAAC,KAAK,OAAO,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,OAA2B;IAC5C,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AACnE,CAAC;AAED,SAAS,QAAQ,CAAC,OAA2B;IAC3C,MAAM,KAAK,GAAG;QACZ,OAAO,CAAC,cAAc;QACtB,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,uBAAuB,OAAO,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,SAAS;KAC5F,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAqB,EAAE,UAA8B,EAAE;IACjF,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAExE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,OAAO,CAAC,MAAM;gBAClB,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC;gBACxB,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE;gBAC9C,oBAAoB,EAAE,EAAE,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBACpE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC/C,OAAO,EAAE,6DAA6D;gBACtE,UAAU,EAAE;oBACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;oBAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;iBAC3E;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;YAClC,SAAS,EAAE,CAAC;oBACV,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE;wBACtC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;qBACzB;iBACF,CAAC;YACF,mBAAmB,EAAE;gBACnB,4BAA4B,EAAE,OAAO,CAAC,EAAE;aACzC;YACD,UAAU,EAAE;gBACV,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBAClC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;aAC3E;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,OAAO,EAAE,4FAA4F;QACrG,OAAO,EAAE,OAAgB;QACzB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,iBAAiB;wBACvB,OAAO,EAAE,YAAY;wBACrB,cAAc,EAAE,8CAA8C;wBAC9D,KAAK;qBACN;iBACF;gBACD,iBAAiB,EAAE;oBACjB,EAAE,EAAE,mBAAmB,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE;iBAClD;gBACD,OAAO;aACR;SACF;KACF,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC"}

package/dist/src/security-profiles.d.ts

@@ -0,0 +1,13 @@
+export type SecurityProfileId = "nsa-mcp";
+export type SecurityControlArea = "trust_boundaries" | "tool_permissions" | "tool_description_integrity" | "authentication" | "secrets_exposure" | "schema_validation" | "input_validation" | "auditability" | "runtime_safety" | "supply_chain";
+export interface SecurityProfile {
+    id: SecurityProfileId;
+    title: string;
+    description: string;
+    disclaimer: string;
+    controlAreas: SecurityControlArea[];
+    ruleControls: Record<string, SecurityControlArea[]>;
+    categoryControls: Record<string, SecurityControlArea[]>;
+}
+export declare function loadSecurityProfile(id: string): SecurityProfile;
+export declare function availableSecurityProfiles(): SecurityProfile[];

package/dist/src/security-profiles.js

@@ -0,0 +1,59 @@
+const NSA_MCP_PROFILE = {
+    id: "nsa-mcp",
+    title: "NSA-MCP Public Guidance Profile",
+    description: "Operationalizes public security guidance into practical MCP release-gate checks for sensitive, regulated, or mission-critical agentic AI environments.",
+    disclaimer: "This profile is not an official NSA certification, endorsement, or compliance authorization.",
+    controlAreas: [
+        "trust_boundaries",
+        "tool_permissions",
+        "tool_description_integrity",
+        "authentication",
+        "secrets_exposure",
+        "schema_validation",
+        "input_validation",
+        "auditability",
+        "runtime_safety",
+        "supply_chain",
+    ],
+    ruleControls: {
+        "mcp-observatory/security/no-auth-http": ["authentication", "trust_boundaries"],
+        "mcp-observatory/security/shell-injection": ["tool_permissions", "runtime_safety", "input_validation"],
+        "mcp-observatory/security/broad-filesystem": ["tool_permissions", "trust_boundaries"],
+        "mcp-observatory/security/permissive-schema": ["schema_validation", "input_validation"],
+        "mcp-observatory/security/credential-pattern": ["secrets_exposure", "auditability"],
+        "mcp-observatory/attack-sim/tool-poisoning/hidden-instruction": ["tool_description_integrity", "trust_boundaries"],
+        "mcp-observatory/attack-sim/tool-poisoning/exfiltration-language": ["tool_description_integrity", "secrets_exposure"],
+        "mcp-observatory/attack-sim/tool-poisoning/autonomy-escalation": ["tool_description_integrity", "runtime_safety"],
+        "mcp-observatory/attack-sim/permission-boundary/broad-destructive-tool": ["tool_permissions", "runtime_safety", "trust_boundaries"],
+        "mcp-observatory/attack-sim/exfiltration-canary/canary-exposed": ["secrets_exposure", "auditability"],
+        "mcp-observatory/attack-sim/exfiltration-canary/credential-like-output": ["secrets_exposure", "auditability"],
+        "mcp-observatory/attack-sim/contract-drift/new-destructive-tool": ["supply_chain", "tool_permissions"],
+        "mcp-observatory/attack-sim/contract-drift/required-fields-removed": ["supply_chain", "schema_validation"],
+        "mcp-observatory/attack-sim/contract-drift/schema-broadened": ["supply_chain", "schema_validation"],
+        "mcp-observatory/schema-quality/schema-diagnostic": ["schema_validation", "input_validation"],
+        "mcp-observatory/run/fatal-error": ["runtime_safety", "auditability"],
+    },
+    categoryControls: {
+        "security": ["tool_permissions", "runtime_safety"],
+        "security-lite": ["tool_permissions", "runtime_safety"],
+        "attack-sim": ["trust_boundaries", "tool_permissions"],
+        "schema-quality": ["schema_validation", "input_validation"],
+        "conformance": ["runtime_safety"],
+        "tools": ["runtime_safety"],
+        "tools-invoke": ["runtime_safety", "auditability"],
+    },
+};
+const PROFILES = {
+    "nsa-mcp": NSA_MCP_PROFILE,
+};
+export function loadSecurityProfile(id) {
+    const profile = PROFILES[id];
+    if (!profile) {
+        throw new Error(`Unknown security profile "${id}". Available profiles: ${Object.keys(PROFILES).join(", ")}`);
+    }
+    return profile;
+}
+export function availableSecurityProfiles() {
+    return Object.values(PROFILES);
+}
+//# sourceMappingURL=security-profiles.js.map

package/dist/src/security-profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-profiles.js","sourceRoot":"","sources":["../../src/security-profiles.ts"],"names":[],"mappings":"AAwBA,MAAM,eAAe,GAAoB;IACvC,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,iCAAiC;IACxC,WAAW,EAAE,wJAAwJ;IACrK,UAAU,EAAE,8FAA8F;IAC1G,YAAY,EAAE;QACZ,kBAAkB;QAClB,kBAAkB;QAClB,4BAA4B;QAC5B,gBAAgB;QAChB,kBAAkB;QAClB,mBAAmB;QACnB,kBAAkB;QAClB,cAAc;QACd,gBAAgB;QAChB,cAAc;KACf;IACD,YAAY,EAAE;QACZ,uCAAuC,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QAC/E,0CAA0C,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,CAAC;QACtG,2CAA2C,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QACrF,4CAA4C,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvF,6CAA6C,EAAE,CAAC,kBAAkB,EAAE,cAAc,CAAC;QACnF,8DAA8D,EAAE,CAAC,4BAA4B,EAAE,kBAAkB,CAAC;QAClH,iEAAiE,EAAE,CAAC,4BAA4B,EAAE,kBAAkB,CAAC;QACrH,+DAA+D,EAAE,CAAC,4BAA4B,EAAE,gBAAgB,CAAC;QACjH,uEAAuE,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,CAAC;QACnI,+DAA+D,EAAE,CAAC,kBAAkB,EAAE,cAAc,CAAC;QACrG,uEAAuE,EAAE,CAAC,kBAAkB,EAAE,cAAc,CAAC;QAC7G,gEAAgE,EAAE,CAAC,cAAc,EAAE,kBAAkB,CAAC;QACtG,mEAAmE,EAAE,CAAC,cAAc,EAAE,mBAAmB,CAAC;QAC1G,4DAA4D,EAAE,CAAC,cAAc,EAAE,mBAAmB,CAAC;QACnG,kDAAkD,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QAC7F,iCAAiC,EAAE,CAAC,gBAAgB,EAAE,cAAc,CAAC;KACtE;IACD,gBAAgB,EAAE;QAChB,UAAU,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QAClD,eAAe,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QACvD,YAAY,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QACtD,gBAAgB,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QAC3D,aAAa,EAAE,CAAC,gBAAgB,CAAC;QACjC,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,cAAc,EAAE,CAAC,gBAAgB,EAAE,cAAc,CAAC;KACnD;CACF,CAAC;AAEF,MAAM,QAAQ,GAA+C;IAC3D,SAAS,EAAE,eAAe;CAC3B,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,EAAU;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,EAAuB,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,6BAA6B,EAAE,0BAA0B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC"}

package/dist/src/telemetry.d.ts

@@ -52,7 +52,14 @@ export interface TelemetryEnrichment {
     setupCiConversionStatus?: string;
     setupCiPromptShown?: boolean;
     setupCiAutoRequested?: boolean;
+    setupCiSarif?: boolean;
+    setupCiFixApplied?: boolean;
     sampleReport?: boolean;
+    receiptGenerated?: boolean;
+    receiptFormat?: string;
+    receiptProfile?: string;
+    receiptEnvironmentClass?: string;
+    receiptTopFindings?: number;
     nightlyScan?: boolean;
     issueCreated?: boolean;
     issueNumber?: number;