@weave_protocol/mund 0.2.3 → 0.3.0

package/src/osv.ts

@@ -0,0 +1,310 @@
+/**
+ * Mund - The Guardian Protocol
+ * OSV.dev dependency vulnerability lookups with an offline fallback
+ *
+ * Live path: POST /v1/querybatch for every name@version in a lockfile,
+ * then GET /v1/vulns/{id} once per unique advisory for details.
+ *
+ * Offline path: every successful live lookup is written to an on-disk
+ * cache. When the network is unavailable (or MUND_OFFLINE=1 / --offline),
+ * results come from that cache and are reported with source "cache", so
+ * callers can tell a clean result from an unchecked one. Packages that
+ * were never looked up are reported as unchecked, never as clean.
+ */
+
+import { readFile, writeFile, mkdir } from 'fs/promises';
+import { homedir } from 'os';
+import { dirname, join } from 'path';
+import type { SecurityIssue, Severity } from './types.js';
+
+const OSV_API = 'https://api.osv.dev/v1';
+const BATCH_SIZE = 1000;
+const DETAIL_CONCURRENCY = 8;
+
+export interface LockedPackage {
+  name: string;
+  version: string;
+  /** Lockfile key, e.g. "node_modules/qs", used to locate the finding. */
+  path?: string;
+}
+
+export interface OsvAdvisory {
+  id: string;
+  summary: string;
+  severity: Severity;
+  aliases: string[];
+  fixed?: string;
+  url: string;
+}
+
+export type OsvSource = 'live' | 'cache' | 'unavailable';
+
+export interface OsvLookupResult {
+  source: OsvSource;
+  /** Keyed by "name@version". */
+  advisories: Map<string, OsvAdvisory[]>;
+  /** name@version keys with no live or cached answer. */
+  unchecked: string[];
+  /** Why the live lookup did not run or failed, if it didn't. */
+  error?: string;
+}
+
+export interface OsvClientOptions {
+  offline?: boolean;
+  cachePath?: string;
+  timeoutMs?: number;
+  fetch?: typeof fetch;
+}
+
+interface CacheFile {
+  version: 1;
+  packages: Record<string, { checkedAt: string; advisories: OsvAdvisory[] }>;
+}
+
+interface OsvVuln {
+  id: string;
+  summary?: string;
+  details?: string;
+  aliases?: string[];
+  severity?: Array<{ type: string; score: string }>;
+  database_specific?: { severity?: string };
+  affected?: Array<{
+    package?: { name: string; ecosystem: string };
+    ranges?: Array<{ events: Array<{ introduced?: string; fixed?: string }> }>;
+  }>;
+}
+
+export function defaultCachePath(): string {
+  if (process.env.MUND_OSV_CACHE) return process.env.MUND_OSV_CACHE;
+  const base = process.env.XDG_CACHE_HOME || join(homedir(), '.cache');
+  return join(base, 'mund', 'osv-cache.json');
+}
+
+// ============================================================================
+// Lockfile parsing
+// ============================================================================
+
+/** Parse an npm package-lock.json (lockfileVersion 1, 2 or 3). */
+export function parseNpmLockfile(content: string): LockedPackage[] {
+  const lock = JSON.parse(content) as {
+    packages?: Record<string, { version?: string; name?: string; link?: boolean }>;
+    dependencies?: Record<string, V1Dep>;
+  };
+  const seen = new Map<string, LockedPackage>();
+  const add = (pkg: LockedPackage) => {
+    const key = `${pkg.name}@${pkg.version}`;
+    if (!seen.has(key)) seen.set(key, pkg);
+  };
+
+  if (lock.packages) {
+    for (const [path, entry] of Object.entries(lock.packages)) {
+      if (!path || entry.link || !entry.version) continue;
+      const idx = path.lastIndexOf('node_modules/');
+      if (idx === -1) continue; // workspace package, not a dependency
+      add({ name: entry.name ?? path.slice(idx + 'node_modules/'.length), version: entry.version, path });
+    }
+  } else if (lock.dependencies) {
+    const walk = (deps: Record<string, V1Dep>) => {
+      for (const [name, dep] of Object.entries(deps)) {
+        if (dep.version && !dep.version.startsWith('file:')) add({ name, version: dep.version });
+        if (dep.dependencies) walk(dep.dependencies);
+      }
+    };
+    walk(lock.dependencies);
+  }
+
+  return [...seen.values()];
+}
+
+interface V1Dep {
+  version?: string;
+  dependencies?: Record<string, V1Dep>;
+}
+
+// ============================================================================
+// Client
+// ============================================================================
+
+export class OsvClient {
+  private readonly offline: boolean;
+  private readonly cachePath: string;
+  private readonly timeoutMs: number;
+  private readonly fetchImpl: typeof fetch;
+
+  constructor(options: OsvClientOptions = {}) {
+    this.offline = options.offline ?? process.env.MUND_OFFLINE === '1';
+    this.cachePath = options.cachePath ?? defaultCachePath();
+    this.timeoutMs = options.timeoutMs ?? 15000;
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+
+  async lookup(packages: LockedPackage[], ecosystem = 'npm'): Promise<OsvLookupResult> {
+    const keys = packages.map(p => `${p.name}@${p.version}`);
+    if (packages.length === 0) return { source: 'live', advisories: new Map(), unchecked: [] };
+
+    if (!this.offline) {
+      try {
+        const advisories = await this.lookupLive(packages, ecosystem);
+        await this.writeCache(advisories);
+        return { source: 'live', advisories, unchecked: [] };
+      } catch (error) {
+        return this.lookupCached(keys, `OSV.dev unreachable: ${(error as Error).message}`);
+      }
+    }
+    return this.lookupCached(keys, 'offline mode');
+  }
+
+  private async lookupLive(packages: LockedPackage[], ecosystem: string): Promise<Map<string, OsvAdvisory[]>> {
+    const idsByKey = new Map<string, string[]>();
+
+    for (let i = 0; i < packages.length; i += BATCH_SIZE) {
+      const chunk = packages.slice(i, i + BATCH_SIZE);
+      const body = { queries: chunk.map(p => ({ package: { name: p.name, ecosystem }, version: p.version })) };
+      const data = await this.request<{ results: Array<{ vulns?: Array<{ id: string }> }> }>(
+        `${OSV_API}/querybatch`, { method: 'POST', body: JSON.stringify(body) },
+      );
+      chunk.forEach((p, j) => {
+        idsByKey.set(`${p.name}@${p.version}`, (data.results[j]?.vulns ?? []).map(v => v.id));
+      });
+    }
+
+    const uniqueIds = [...new Set([...idsByKey.values()].flat())];
+    const details = new Map<string, OsvVuln>();
+    for (let i = 0; i < uniqueIds.length; i += DETAIL_CONCURRENCY) {
+      const batch = uniqueIds.slice(i, i + DETAIL_CONCURRENCY);
+      const fetched = await Promise.all(batch.map(id => this.request<OsvVuln>(`${OSV_API}/vulns/${encodeURIComponent(id)}`)));
+      fetched.forEach(v => details.set(v.id, v));
+    }
+
+    const advisories = new Map<string, OsvAdvisory[]>();
+    for (const [key, ids] of idsByKey) {
+      const name = key.slice(0, key.lastIndexOf('@'));
+      advisories.set(key, ids.map(id => toAdvisory(details.get(id) ?? { id }, name)));
+    }
+    return advisories;
+  }
+
+  private async lookupCached(keys: string[], reason: string): Promise<OsvLookupResult> {
+    const cache = await this.readCache();
+    const advisories = new Map<string, OsvAdvisory[]>();
+    const unchecked: string[] = [];
+
+    for (const key of keys) {
+      const hit = cache?.packages[key];
+      if (hit) advisories.set(key, hit.advisories);
+      else unchecked.push(key);
+    }
+
+    const source: OsvSource = advisories.size > 0 ? 'cache' : 'unavailable';
+    return { source, advisories, unchecked, error: reason };
+  }
+
+  private async request<T>(url: string, init: RequestInit = {}): Promise<T> {
+    const res = await this.fetchImpl(url, {
+      ...init,
+      headers: { 'Content-Type': 'application/json' },
+      signal: AbortSignal.timeout(this.timeoutMs),
+    });
+    if (!res.ok) throw new Error(`${res.status} ${res.statusText} from ${url}`);
+    return (await res.json()) as T;
+  }
+
+  private async readCache(): Promise<CacheFile | null> {
+    try {
+      const cache = JSON.parse(await readFile(this.cachePath, 'utf8')) as CacheFile;
+      return cache.version === 1 && cache.packages ? cache : null;
+    } catch {
+      return null;
+    }
+  }
+
+  private async writeCache(advisories: Map<string, OsvAdvisory[]>): Promise<void> {
+    const cache: CacheFile = (await this.readCache()) ?? { version: 1, packages: {} };
+    const checkedAt = new Date().toISOString();
+    for (const [key, list] of advisories) cache.packages[key] = { checkedAt, advisories: list };
+    try {
+      await mkdir(dirname(this.cachePath), { recursive: true });
+      await writeFile(this.cachePath, JSON.stringify(cache));
+    } catch {
+      // A read-only cache dir shouldn't fail the scan; we just lose the fallback.
+    }
+  }
+}
+
+function toAdvisory(vuln: OsvVuln, packageName: string): OsvAdvisory {
+  let fixed: string | undefined;
+  for (const affected of vuln.affected ?? []) {
+    if (affected.package && affected.package.name !== packageName) continue;
+    for (const range of affected.ranges ?? []) {
+      for (const event of range.events) if (event.fixed) fixed = event.fixed;
+    }
+  }
+
+  return {
+    id: vuln.id,
+    summary: vuln.summary || vuln.details?.split('\n')[0]?.slice(0, 200) || 'No summary available',
+    severity: parseSeverity(vuln),
+    aliases: vuln.aliases ?? [],
+    fixed,
+    url: `https://osv.dev/vulnerability/${encodeURIComponent(vuln.id)}`,
+  };
+}
+
+/**
+ * OSV `severity[].score` is usually a CVSS *vector* string, not a number,
+ * so prefer the database's own label (GHSA sets it for npm advisories).
+ */
+export function parseSeverity(vuln: Pick<OsvVuln, 'severity' | 'database_specific'>): Severity {
+  const label = vuln.database_specific?.severity?.toLowerCase();
+  if (label === 'critical') return 'critical';
+  if (label === 'high') return 'high';
+  if (label === 'moderate' || label === 'medium') return 'medium';
+  if (label === 'low') return 'low';
+
+  for (const s of vuln.severity ?? []) {
+    const score = Number(s.score);
+    if (!Number.isNaN(score)) {
+      if (score >= 9) return 'critical';
+      if (score >= 7) return 'high';
+      if (score >= 4) return 'medium';
+      if (score > 0) return 'low';
+    }
+  }
+  return 'medium';
+}
+
+// ============================================================================
+// Findings
+// ============================================================================
+
+/** Turn lookup results into SecurityIssues located in the lockfile. */
+export function advisoriesToIssues(
+  packages: LockedPackage[],
+  result: OsvLookupResult,
+  lockfileContent: string,
+): SecurityIssue[] {
+  const issues: SecurityIssue[] = [];
+
+  for (const pkg of packages) {
+    const key = `${pkg.name}@${pkg.version}`;
+    for (const adv of result.advisories.get(key) ?? []) {
+      const needle = pkg.path ? `"${pkg.path}"` : `"${pkg.name}"`;
+      const start = Math.max(0, lockfileContent.indexOf(needle));
+      const before = lockfileContent.slice(0, start).split('\n');
+
+      issues.push({
+        rule_id: adv.id,
+        rule_name: `${key}: ${adv.summary}`,
+        type: 'dependency',
+        severity: adv.severity,
+        action: 'alert',
+        match: key,
+        location: { start, end: start + needle.length, line: before.length, column: before[before.length - 1].length + 1 },
+        suggestion: adv.fixed
+          ? `Upgrade ${pkg.name} to ${adv.fixed} or later. ${adv.url}`
+          : `No fixed version published yet. ${adv.url}`,
+      });
+    }
+  }
+  return issues;
+}

package/src/sarif.ts

@@ -0,0 +1,146 @@
+/**
+ * Mund - The Guardian Protocol
+ * SARIF 2.1.0 output - for GitHub code scanning and other SARIF consumers
+ *
+ * https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html
+ * GitHub-specific: rules carry `security-severity` (0.0-10.0) so code
+ * scanning ranks alerts as critical/high/medium/low.
+ */
+
+import { createHash } from 'crypto';
+import type { SecurityIssue, Severity } from './types.js';
+import { computeRiskScore } from './scoring.js';
+
+export interface SarifTarget {
+  /** Path relative to the repository root, using forward slashes. */
+  uri: string;
+  issues: SecurityIssue[];
+}
+
+export interface SarifOptions {
+  toolVersion: string;
+  informationUri?: string;
+}
+
+type SarifLevel = 'error' | 'warning' | 'note' | 'none';
+
+const LEVELS: Record<Severity, SarifLevel> = {
+  critical: 'error',
+  high: 'error',
+  medium: 'warning',
+  low: 'note',
+  info: 'note',
+};
+
+/** GitHub maps >=9.0 critical, >=7.0 high, >=4.0 medium, >0.1 low. */
+const SECURITY_SEVERITY: Record<Severity, string> = {
+  critical: '9.5',
+  high: '8.0',
+  medium: '5.5',
+  low: '3.0',
+  info: '0.0',
+};
+
+export function toSarif(targets: SarifTarget[], options: SarifOptions): object {
+  const rules = new Map<string, { issue: SecurityIssue; index: number }>();
+  const results: object[] = [];
+  const allIssues: SecurityIssue[] = [];
+
+  for (const target of targets) {
+    for (const issue of target.issues) {
+      allIssues.push(issue);
+
+      let rule = rules.get(issue.rule_id);
+      if (!rule) {
+        rule = { issue, index: rules.size };
+        rules.set(issue.rule_id, rule);
+      } else if (severityRank(issue.severity) < severityRank(rule.issue.severity)) {
+        // A rule's descriptor takes the worst severity seen for it.
+        rule.issue = issue;
+      }
+
+      results.push({
+        ruleId: issue.rule_id,
+        ruleIndex: rule.index,
+        level: LEVELS[issue.severity] ?? 'warning',
+        message: { text: issue.suggestion ? `${issue.rule_name}. ${issue.suggestion}` : issue.rule_name },
+        locations: [{
+          physicalLocation: {
+            artifactLocation: { uri: target.uri },
+            ...(issue.location?.line ? { region: toRegion(issue) } : {}),
+          },
+        }],
+        partialFingerprints: {
+          'mundFinding/v1': fingerprint(target.uri, issue),
+        },
+        properties: {
+          severity: issue.severity,
+          type: issue.type,
+        },
+      });
+    }
+  }
+
+  const risk = computeRiskScore(allIssues);
+
+  return {
+    $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+    version: '2.1.0',
+    runs: [{
+      tool: {
+        driver: {
+          name: 'Mund',
+          fullName: 'Mund - The Guardian Protocol',
+          version: options.toolVersion,
+          semanticVersion: options.toolVersion,
+          informationUri: options.informationUri ?? 'https://github.com/Tyox-all/Weave_Protocol/tree/main/mund',
+          rules: [...rules.values()].map(({ issue }) => ({
+            id: issue.rule_id,
+            name: toPascalCase(issue.rule_name),
+            shortDescription: { text: issue.rule_name },
+            ...(issue.suggestion ? { help: { text: issue.suggestion } } : {}),
+            defaultConfiguration: { level: LEVELS[issue.severity] ?? 'warning' },
+            properties: {
+              'security-severity': SECURITY_SEVERITY[issue.severity] ?? '5.5',
+              tags: ['security', issue.type],
+            },
+          })),
+        },
+      },
+      results,
+      properties: {
+        riskScore: risk.score,
+        riskLabel: risk.label,
+      },
+    }],
+  };
+}
+
+function toRegion(issue: SecurityIssue): object {
+  const loc = issue.location!;
+  const region: Record<string, number> = { startLine: loc.line! };
+  if (loc.column) {
+    region.startColumn = loc.column;
+    const length = loc.end - loc.start;
+    // Only emit endColumn for single-line matches; multi-line spans would
+    // need the source text to compute endLine.
+    if (length > 0 && !issue.match.includes('\n')) region.endColumn = loc.column + length;
+  }
+  return region;
+}
+
+function fingerprint(uri: string, issue: SecurityIssue): string {
+  return createHash('sha256')
+    .update(`${uri}\0${issue.rule_id}\0${issue.location?.line ?? 0}\0${issue.match}`)
+    .digest('hex')
+    .slice(0, 32);
+}
+
+function severityRank(severity: Severity): number {
+  return ['critical', 'high', 'medium', 'low', 'info'].indexOf(severity);
+}
+
+function toPascalCase(text: string): string {
+  return text.replace(/[^A-Za-z0-9]+(.)?/g, (_, c: string | undefined) => (c ? c.toUpperCase() : ''))
+    .replace(/^./, c => c.toUpperCase());
+}

package/src/scoring.ts

@@ -0,0 +1,64 @@
+/**
+ * Mund - The Guardian Protocol
+ * Risk Scoring - collapse a set of findings into a 0-100 score + label
+ *
+ * Each finding independently "consumes" a fraction of the remaining
+ * headroom, so the score rises quickly with severe findings, has
+ * diminishing returns for many minor ones, and never exceeds 100:
+ *
+ *   score = 100 * (1 - Π (1 - weight_i))
+ *
+ * One critical finding alone lands in the critical band; one high in the
+ * high band; it takes many low findings to escalate past "low".
+ */
+
+import type { SecurityIssue, Severity } from './types.js';
+
+export type RiskLabel = 'none' | 'low' | 'medium' | 'high' | 'critical';
+
+export interface RiskScore {
+  score: number;
+  label: RiskLabel;
+  counts: Record<Severity, number>;
+}
+
+export const SEVERITY_WEIGHTS: Record<Severity, number> = {
+  critical: 0.8,
+  high: 0.4,
+  medium: 0.15,
+  low: 0.05,
+  info: 0,
+};
+
+/** Lower bound (inclusive) of each label band. */
+export const RISK_BANDS: Array<[RiskLabel, number]> = [
+  ['critical', 80],
+  ['high', 40],
+  ['medium', 15],
+  ['low', 1],
+];
+
+export function labelForScore(score: number): RiskLabel {
+  for (const [label, min] of RISK_BANDS) {
+    if (score >= min) return label;
+  }
+  return 'none';
+}
+
+export function computeRiskScore(issues: Array<Pick<SecurityIssue, 'severity'>>): RiskScore {
+  const counts: Record<Severity, number> = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+  let headroom = 1;
+
+  for (const issue of issues) {
+    const severity = issue.severity in SEVERITY_WEIGHTS ? issue.severity : 'info';
+    counts[severity]++;
+    headroom *= 1 - SEVERITY_WEIGHTS[severity];
+  }
+
+  // Any non-info finding scores at least 1 so it never reads as "none".
+  const raw = Math.round(100 * (1 - headroom));
+  const hasFinding = counts.critical + counts.high + counts.medium + counts.low > 0;
+  const score = hasFinding ? Math.max(1, raw) : 0;
+
+  return { score, label: labelForScore(score), counts };
+}

package/src/threat-intel-manager.ts

@@ -16,6 +16,7 @@ import type {
   ThreatScanResult,
   Severity,
 } from './threat-intel-types.js';
+import { compileRulePattern } from './analyzers/regex.js';
 
 // ============================================================================
 // Built-in Threat Patterns
@@ -759,7 +760,7 @@ export class ThreatIntelManager {
 
       // Check pattern
       try {
-        const regex = new RegExp(pattern.pattern, 'gi');
+        const regex = compileRulePattern(pattern.pattern, 'gi');
         let match;
         while ((match = regex.exec(content)) !== null) {
           matches.push({

package/src/tools/configuration.ts

@@ -12,6 +12,7 @@ import type {
   Severity,
   ActionType
 } from '../types.js';
+import { compileRulePattern } from '../analyzers/regex.js';
 
 // ============================================================================
 // Input Schemas
@@ -131,7 +132,7 @@ Returns:
     async (params) => {
       // Validate the regex pattern
       try {
-        new RegExp(params.pattern);
+        compileRulePattern(params.pattern);
       } catch {
         return {
           content: [{ type: 'text', text: JSON.stringify({

package/src/tools/mcp-scanning.ts

@@ -17,6 +17,7 @@ import {
   type McpScanResult 
 } from '../analyzers/mcp-server-analyzer.js';
 import type { SecurityIssue } from '../types.js';
+import { computeRiskScore } from '../scoring.js';
 
 // ============================================================================
 // Tool Schemas
@@ -76,6 +77,8 @@ export function registerMcpScanningTools(server: McpServer): void {
         const capabilities = McpServerAnalyzer.analyzeCapabilities(parsed);
         const riskLevel = McpServerAnalyzer.getRiskLevel(capabilities);
 
+        const risk = computeRiskScore(issues);
+
         // Count by severity
         const bySeverity = {
           critical: issues.filter(i => i.severity === 'critical').length,
@@ -103,6 +106,8 @@ export function registerMcpScanningTools(server: McpServer): void {
           scanned_at: new Date().toISOString(),
           source,
           issue_count: issues.length,
+          risk_score: risk.score,
+          risk_label: risk.label,
           by_severity: bySeverity,
           recommendation,
           capabilities,

package/src/tools/monitoring.ts

@@ -18,6 +18,9 @@ import type {
 } from '../types.js';
 import { AnalyzerEngine } from '../analyzers/index.js';
 import { NotificationHub } from '../notifications/index.js';
+import { computeRiskScore } from '../scoring.js';
+import { toSarif } from '../sarif.js';
+import { getVersion } from '../version.js';
 import { MAX_SNIPPET_LENGTH, DEFAULT_EVENTS_LIMIT, MAX_EVENTS_PER_QUERY } from '../constants.js';
 
 // ============================================================================
@@ -34,7 +37,11 @@ const ScanContentInputSchema = z.object({
     .describe('Type of content being scanned'),
   tool_name: z.string().optional().describe('Name of the tool that generated this content'),
   agent_id: z.string().optional().describe('ID of the agent making this request'),
-  session_id: z.string().optional().describe('Current session ID')
+  session_id: z.string().optional().describe('Current session ID'),
+  format: z.enum(['json', 'sarif']).default('json')
+    .describe('Response format: json (default) or sarif (SARIF 2.1.0 for code-scanning tools)'),
+  file_path: z.string().optional()
+    .describe('Path to report in SARIF locations (defaults to "content")')
 }).strict();
 
 const CheckUrlInputSchema = z.object({
@@ -103,11 +110,15 @@ Args:
   - tool_name (string): Name of tool that generated this content (optional)
   - agent_id (string): ID of the requesting agent (optional)
   - session_id (string): Current session ID (optional)
+  - format ('json' | 'sarif'): Response format (default: 'json')
+  - file_path (string): Path to use in SARIF locations (optional)
 
 Returns:
   JSON object with:
   - scan_id: Unique identifier for this scan
   - issues_found: Number of security issues detected
+  - risk_score: 0-100 aggregate risk
+  - risk_label: none | low | medium | high | critical
   - blocked: Whether the content was blocked (if block_mode is enabled)
   - issues: Array of detected issues with severity, type, and suggestions
   - scan_duration_ms: Time taken to complete the scan
@@ -173,10 +184,21 @@ Examples:
         await notificationHub.notify(event);
       }
 
+      if (params.format === 'sarif') {
+        const sarif = toSarif([{ uri: params.file_path ?? 'content', issues }], { toolVersion: getVersion() });
+        return {
+          content: [{ type: 'text', text: JSON.stringify(sarif, null, 2) }],
+          structuredContent: sarif as Record<string, unknown>
+        };
+      }
+
       // Format response
+      const risk = computeRiskScore(issues);
       const response = {
         scan_id: scanResult.id,
         issues_found: issues.length,
+        risk_score: risk.score,
+        risk_label: risk.label,
         blocked: shouldBlock,
         issues: issues.map(i => ({
           rule_id: i.rule_id,

package/src/version.ts

@@ -0,0 +1,20 @@
+/**
+ * Mund - The Guardian Protocol
+ * Package version, read from package.json at runtime (dist/version.js -> ../package.json)
+ */
+
+import { readFileSync } from 'fs';
+
+let cached: string | undefined;
+
+export function getVersion(): string {
+  if (!cached) {
+    try {
+      const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')) as { version?: string };
+      cached = pkg.version ?? '0.0.0';
+    } catch {
+      cached = '0.0.0';
+    }
+  }
+  return cached;
+}