wotann 0.5.0 → 0.5.39

package/dist/security/osv-check.d.ts

@@ -0,0 +1,174 @@
+/**
+ * OSV malware check — supply-chain pre-flight for MCP server installs.
+ *
+ * Before persisting an MCP server config (`wotann mcp import`,
+ * `wotann mcp add`, `wotann mcp import-mcpb`) we ask OSV.dev whether the
+ * underlying package has any published malware (`MAL-…`) or critical CVE
+ * advisories. This catches the two common supply-chain attacks:
+ *
+ *   1. **Typosquats** — a tutorial that says `@modelcontextprotocol/...`
+ *      copied as `@modelcontextprotocl/...` (one missing `o`). OSV has
+ *      MAL-records for many published typosquats.
+ *   2. **Compromised packages** — legitimate package names whose latest
+ *      version was hijacked (e.g. `event-stream`, `ua-parser-js` 2021).
+ *
+ * Goose's `osv-scanner` integration was the prior art (aaif-goose/goose
+ * 2024-Q4). We hand-port the pattern here in TypeScript so it works on
+ * the daemon side without a Go dependency.
+ *
+ * QUALITY BARS
+ *   - QB#1 No vendor bias — npm + PyPI both supported, no special-casing
+ *   - QB#3 Honest stub — network failures return `{error}`, never silently pass
+ *   - QB#7 Per-call state — every check re-queries; no cache poisoning
+ *   - QB#11 Real I/O test path — `WOTANN_OSV_OFFLINE=1` gates network in tests
+ *
+ * USAGE
+ *
+ *   import { checkServers, formatBlockReport } from "./security/osv-check.js";
+ *
+ *   const results = await checkServers(servers, { timeoutMs: 5000 });
+ *   const blocked = Object.entries(results).filter(([, r]) => r.hasMalware);
+ *   if (blocked.length > 0) {
+ *     console.error(formatBlockReport(results));
+ *     process.exit(1); // abort install
+ *   }
+ *
+ * The OSV API is documented at https://google.github.io/osv.dev/api/.
+ */
+export interface OsvVulnerability {
+    readonly id: string;
+    readonly summary?: string;
+    readonly severity?: ReadonlyArray<{
+        readonly type: string;
+        readonly score: string;
+    }>;
+    readonly database_specific?: {
+        readonly severity?: string;
+    };
+    readonly aliases?: readonly string[];
+}
+export interface PackageRef {
+    readonly ecosystem: "npm" | "PyPI";
+    readonly name: string;
+}
+export type Severity = "none" | "low" | "medium" | "high" | "critical";
+export interface OsvCheckResult {
+    /** Package extracted from the server command (null if unsupported runner). */
+    readonly packageRef: PackageRef | null;
+    /** All advisories returned by OSV. Empty when there are none or when skipped/errored. */
+    readonly vulnerabilities: readonly OsvVulnerability[];
+    /** True when at least one MAL- record matches. */
+    readonly hasMalware: boolean;
+    /** Highest CVSS / db severity seen across all advisories. */
+    readonly highestSeverity: Severity;
+    /** Set when the check was skipped (e.g. unsupported runner, offline). */
+    readonly skipped: {
+        readonly reason: string;
+    } | null;
+    /** Set when the network query failed. */
+    readonly error: string | null;
+}
+export interface CheckOptions {
+    /** Per-package timeout. Default 5000 ms. */
+    readonly timeoutMs?: number;
+    /** Optional fetch override for tests. */
+    readonly fetchImpl?: typeof fetch;
+}
+interface MinimalServer {
+    readonly command: string;
+    readonly args: readonly string[];
+}
+/**
+ * Extract the package name + ecosystem from an MCP server's command/args.
+ * Returns null when the runner is unrecognized (e.g. a local script,
+ * `node ./server.js`, `bash -c …`, or a binary path).
+ */
+export declare function extractPackage(server: MinimalServer): PackageRef | null;
+/**
+ * Strip an optional version specifier from a package reference.
+ *
+ *   @scope/foo@1.2.3   → @scope/foo
+ *   foo@^1.0.0         → foo
+ *   foo==1.2.3         → foo
+ *   foo>=1.0           → foo
+ */
+export declare function stripVersionSpec(spec: string): string;
+/**
+ * Map an OSV vulnerability to a normalized severity bucket. CVSS v3 base
+ * score thresholds follow NVD's published bands (low <4, medium 4-6.9,
+ * high 7-8.9, critical >=9). Falls back to `database_specific.severity`
+ * when no CVSS vector is attached.
+ */
+export declare function classifySeverity(v: OsvVulnerability): Severity;
+/**
+ * Run the OSV pre-flight check against a single server.
+ * Always returns a result — never throws — so callers can decide
+ * which level of failure (block / warn / log) to apply.
+ */
+export declare function checkServer(server: MinimalServer, opts?: CheckOptions): Promise<OsvCheckResult>;
+/**
+ * Run the check against many servers. Each server is queried in
+ * parallel; the per-package timeout prevents one slow lookup from
+ * stalling the rest. Map keys are the server names supplied by caller.
+ */
+export declare function checkServers(servers: ReadonlyArray<MinimalServer & {
+    readonly name: string;
+}>, opts?: CheckOptions): Promise<Readonly<Record<string, OsvCheckResult>>>;
+/**
+ * Returns names of servers that should be blocked (malware records).
+ */
+export declare function blockedServers(results: Readonly<Record<string, OsvCheckResult>>): readonly string[];
+/**
+ * Returns names of servers that warrant a warning (high/critical CVE
+ * but not confirmed malware).
+ */
+export declare function warningServers(results: Readonly<Record<string, OsvCheckResult>>): readonly string[];
+/**
+ * Compose a human-readable report for blocked + warning servers.
+ * Returns empty string when neither category is populated.
+ */
+export declare function formatReport(results: Readonly<Record<string, OsvCheckResult>>): string;
+export interface PreflightOptions {
+    /** Bypass the entire check (e.g. user passed --skip-malware-check). */
+    readonly skip?: boolean;
+    /** Treat high/critical CVEs as blocking (in addition to MAL- records). */
+    readonly strict?: boolean;
+    /** Per-package timeout. */
+    readonly timeoutMs?: number;
+    /** Test seam — override fetch implementation. */
+    readonly fetchImpl?: typeof fetch;
+    /** Sink for status output. Defaults to console.log/error. */
+    readonly logger?: {
+        readonly info: (msg: string) => void;
+        readonly warn: (msg: string) => void;
+        readonly error: (msg: string) => void;
+    };
+}
+export interface PreflightVerdict {
+    /** True when the install should proceed (no blocking findings). */
+    readonly proceed: boolean;
+    /** Server names with confirmed-malware findings. */
+    readonly blocked: readonly string[];
+    /** Server names with high/critical CVEs (not malware). */
+    readonly warnings: readonly string[];
+    /** Raw per-server results — for callers that want to render their own UI. */
+    readonly results: Readonly<Record<string, OsvCheckResult>>;
+}
+/**
+ * One-call pre-flight wrapper. Designed for CLI use sites:
+ *
+ *   const verdict = await preflight(servers, { skip: opts.skipMalwareCheck });
+ *   if (!verdict.proceed) process.exit(1);
+ *
+ * Behaviour:
+ *   - `skip:true` → returns `proceed:true` immediately, no network.
+ *   - confirmed malware → blocks, logs "MALWARE" report, `proceed:false`.
+ *   - high/critical CVE in non-strict mode → warns + proceeds.
+ *   - high/critical CVE in strict mode → blocks like malware.
+ *   - network failure or unsupported runner → logged at info level, no block.
+ */
+export declare function preflight(servers: ReadonlyArray<MinimalServer & {
+    readonly name: string;
+}>, opts?: PreflightOptions): Promise<PreflightVerdict>;
+export {};
+//# sourceMappingURL=osv-check.d.ts.map

package/dist/security/osv-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv-check.d.ts","sourceRoot":"","sources":["../../src/security/osv-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAMH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,QAAQ,CAAC,iBAAiB,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAEvE,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACvC,yFAAyF;IACzF,QAAQ,CAAC,eAAe,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACtD,kDAAkD;IAClD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC;IACnC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACrD,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,yCAAyC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACnC;AAED,UAAU,aAAa;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAQD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,UAAU,GAAG,IAAI,CAkBvE;AAkCD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASrD;AAUD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,gBAAgB,GAAG,QAAQ,CAiB9D;AA0FD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,aAAa,EACrB,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,cAAc,CAAC,CAmDzB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,aAAa,CAAC,aAAa,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EACjE,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CASnD;AAID;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,GAChD,SAAS,MAAM,EAAE,CAInB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,GAChD,SAAS,MAAM,EAAE,CAOnB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,GAAG,MAAM,CAsBtF;AAID,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,2BAA2B;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QACrC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QACrC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;KACvC,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CAC5D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,aAAa,CAAC,aAAa,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EACjE,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CAsD3B"}

package/dist/security/osv-check.js

@@ -0,0 +1,409 @@
+/**
+ * OSV malware check — supply-chain pre-flight for MCP server installs.
+ *
+ * Before persisting an MCP server config (`wotann mcp import`,
+ * `wotann mcp add`, `wotann mcp import-mcpb`) we ask OSV.dev whether the
+ * underlying package has any published malware (`MAL-…`) or critical CVE
+ * advisories. This catches the two common supply-chain attacks:
+ *
+ *   1. **Typosquats** — a tutorial that says `@modelcontextprotocol/...`
+ *      copied as `@modelcontextprotocl/...` (one missing `o`). OSV has
+ *      MAL-records for many published typosquats.
+ *   2. **Compromised packages** — legitimate package names whose latest
+ *      version was hijacked (e.g. `event-stream`, `ua-parser-js` 2021).
+ *
+ * Goose's `osv-scanner` integration was the prior art (aaif-goose/goose
+ * 2024-Q4). We hand-port the pattern here in TypeScript so it works on
+ * the daemon side without a Go dependency.
+ *
+ * QUALITY BARS
+ *   - QB#1 No vendor bias — npm + PyPI both supported, no special-casing
+ *   - QB#3 Honest stub — network failures return `{error}`, never silently pass
+ *   - QB#7 Per-call state — every check re-queries; no cache poisoning
+ *   - QB#11 Real I/O test path — `WOTANN_OSV_OFFLINE=1` gates network in tests
+ *
+ * USAGE
+ *
+ *   import { checkServers, formatBlockReport } from "./security/osv-check.js";
+ *
+ *   const results = await checkServers(servers, { timeoutMs: 5000 });
+ *   const blocked = Object.entries(results).filter(([, r]) => r.hasMalware);
+ *   if (blocked.length > 0) {
+ *     console.error(formatBlockReport(results));
+ *     process.exit(1); // abort install
+ *   }
+ *
+ * The OSV API is documented at https://google.github.io/osv.dev/api/.
+ */
+const OSV_QUERY_URL = "https://api.osv.dev/v1/query";
+// ── Package extraction ─────────────────────────────────────────
+const NPM_RUNNERS = new Set(["npx", "bunx", "pnpx", "pnpm", "yarn"]);
+const PIP_RUNNERS = new Set(["uvx", "pipx"]);
+const PIP_INSTALL_RUNNER = "pip"; // followed by "install"
+/**
+ * Extract the package name + ecosystem from an MCP server's command/args.
+ * Returns null when the runner is unrecognized (e.g. a local script,
+ * `node ./server.js`, `bash -c …`, or a binary path).
+ */
+export function extractPackage(server) {
+    const cmd = (server.command ?? "").trim().toLowerCase();
+    const baseCmd = cmd.split("/").pop() ?? cmd; // /usr/local/bin/npx → npx
+    const args = server.args ?? [];
+    if (NPM_RUNNERS.has(baseCmd)) {
+        return extractNpmPackage(args);
+    }
+    if (PIP_RUNNERS.has(baseCmd)) {
+        return extractPipPackage(args, 0);
+    }
+    if (baseCmd === PIP_INSTALL_RUNNER) {
+        if (args[0] === "install") {
+            return extractPipPackage(args, 1);
+        }
+        return null;
+    }
+    return null;
+}
+function extractNpmPackage(args) {
+    // Handle: npx -y @scope/pkg   |   npx --package=foo bar   |   npx --package foo bar
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i] ?? "";
+        if (a.startsWith("--package=")) {
+            const name = a.slice("--package=".length);
+            if (name)
+                return { ecosystem: "npm", name: stripVersionSpec(name) };
+        }
+        if (a === "--package" && i + 1 < args.length) {
+            const next = args[i + 1] ?? "";
+            if (next)
+                return { ecosystem: "npm", name: stripVersionSpec(next) };
+        }
+    }
+    // First non-flag, non-script argument that looks like a package
+    for (const a of args) {
+        if (a.startsWith("-"))
+            continue;
+        if (looksLikeLocalScript(a))
+            continue;
+        return { ecosystem: "npm", name: stripVersionSpec(a) };
+    }
+    return null;
+}
+function extractPipPackage(args, startAt) {
+    for (let i = startAt; i < args.length; i++) {
+        const a = args[i] ?? "";
+        if (a.startsWith("-"))
+            continue;
+        if (looksLikeLocalScript(a))
+            continue;
+        return { ecosystem: "PyPI", name: stripVersionSpec(a) };
+    }
+    return null;
+}
+/**
+ * Strip an optional version specifier from a package reference.
+ *
+ *   @scope/foo@1.2.3   → @scope/foo
+ *   foo@^1.0.0         → foo
+ *   foo==1.2.3         → foo
+ *   foo>=1.0           → foo
+ */
+export function stripVersionSpec(spec) {
+    // npm scoped: @scope/name@version → keep through second @
+    if (spec.startsWith("@")) {
+        const sep = spec.indexOf("@", 1);
+        return sep === -1 ? spec : spec.slice(0, sep);
+    }
+    // npm unscoped + python: stop at first version-spec character
+    const m = spec.match(/^([A-Za-z0-9._-]+)/);
+    return m && m[1] ? m[1] : spec;
+}
+function looksLikeLocalScript(arg) {
+    // ./foo.js   ../foo   /abs/path   foo.js   server.py   server.mjs
+    if (arg.startsWith("./") || arg.startsWith("../") || arg.startsWith("/"))
+        return true;
+    return /\.(?:js|cjs|mjs|ts|tsx|py|sh|rb|exe)$/i.test(arg);
+}
+// ── Severity classification ────────────────────────────────────
+/**
+ * Map an OSV vulnerability to a normalized severity bucket. CVSS v3 base
+ * score thresholds follow NVD's published bands (low <4, medium 4-6.9,
+ * high 7-8.9, critical >=9). Falls back to `database_specific.severity`
+ * when no CVSS vector is attached.
+ */
+export function classifySeverity(v) {
+    // MAL- records always rank as critical even when no CVSS attached.
+    if (v.id?.startsWith("MAL-"))
+        return "critical";
+    const dbSev = v.database_specific?.severity?.toUpperCase() ?? "";
+    if (dbSev.includes("MALICIOUS"))
+        return "critical";
+    const cvssEntry = (v.severity ?? []).find((s) => s.type === "CVSS_V3" || s.type === "CVSS_V4");
+    if (cvssEntry) {
+        const score = parseCvssScore(cvssEntry.score);
+        if (score === null)
+            return mapDbSev(dbSev);
+        if (score >= 9.0)
+            return "critical";
+        if (score >= 7.0)
+            return "high";
+        if (score >= 4.0)
+            return "medium";
+        if (score > 0)
+            return "low";
+    }
+    return mapDbSev(dbSev);
+}
+function mapDbSev(s) {
+    if (s === "CRITICAL")
+        return "critical";
+    if (s === "HIGH")
+        return "high";
+    if (s === "MODERATE" || s === "MEDIUM")
+        return "medium";
+    if (s === "LOW")
+        return "low";
+    return "none";
+}
+function parseCvssScore(scoreOrVector) {
+    // OSV may publish `7.5` or full vector `CVSS:3.1/AV:N/...`. Pull a
+    // base score if present; else null.
+    const numeric = Number.parseFloat(scoreOrVector);
+    if (Number.isFinite(numeric) && numeric >= 0 && numeric <= 10)
+        return numeric;
+    return null;
+}
+const SEV_RANK = {
+    none: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+function maxSeverity(a, b) {
+    return SEV_RANK[a] >= SEV_RANK[b] ? a : b;
+}
+// ── Network query ──────────────────────────────────────────────
+/**
+ * POST a single OSV query. The OSV.dev v1/query endpoint is anonymous
+ * and rate-limited generously enough for batch installs; we still cap
+ * each call with a per-package timeout.
+ */
+async function queryOsv(pkg, opts) {
+    const ctrl = new AbortController();
+    const t = setTimeout(() => ctrl.abort(), opts.timeoutMs);
+    try {
+        const res = await opts.fetchImpl(OSV_QUERY_URL, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                package: { name: pkg.name, ecosystem: pkg.ecosystem },
+            }),
+            signal: ctrl.signal,
+        });
+        if (!res.ok) {
+            return { error: `osv.dev HTTP ${res.status}` };
+        }
+        const body = (await res.json());
+        return { vulns: Array.isArray(body.vulns) ? body.vulns : [] };
+    }
+    catch (err) {
+        return {
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+    finally {
+        clearTimeout(t);
+    }
+}
+// ── Public API ────────────────────────────────────────────────
+const OFFLINE_REASON = "WOTANN_OSV_OFFLINE=1 — skipping malware check (unset to enable)";
+const offlineSkip = (pkg) => ({
+    packageRef: pkg,
+    vulnerabilities: [],
+    hasMalware: false,
+    highestSeverity: "none",
+    skipped: { reason: OFFLINE_REASON },
+    error: null,
+});
+const unsupportedSkip = (server) => ({
+    packageRef: null,
+    vulnerabilities: [],
+    hasMalware: false,
+    highestSeverity: "none",
+    skipped: {
+        reason: `command "${server.command}" is not a known package runner — pre-flight cannot extract a package name`,
+    },
+    error: null,
+});
+/**
+ * Run the OSV pre-flight check against a single server.
+ * Always returns a result — never throws — so callers can decide
+ * which level of failure (block / warn / log) to apply.
+ */
+export async function checkServer(server, opts = {}) {
+    if (process.env["WOTANN_OSV_OFFLINE"] === "1") {
+        return offlineSkip(extractPackage(server));
+    }
+    const pkg = extractPackage(server);
+    if (!pkg)
+        return unsupportedSkip(server);
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    if (typeof fetchImpl !== "function") {
+        return {
+            packageRef: pkg,
+            vulnerabilities: [],
+            hasMalware: false,
+            highestSeverity: "none",
+            skipped: null,
+            error: "fetch is unavailable in this Node runtime — upgrade to Node >=18",
+        };
+    }
+    const timeoutMs = typeof opts.timeoutMs === "number" && opts.timeoutMs > 0 ? opts.timeoutMs : 5_000;
+    const reply = await queryOsv(pkg, { timeoutMs, fetchImpl });
+    if ("error" in reply) {
+        return {
+            packageRef: pkg,
+            vulnerabilities: [],
+            hasMalware: false,
+            highestSeverity: "none",
+            skipped: null,
+            error: reply.error,
+        };
+    }
+    const vulns = reply.vulns;
+    let highestSeverity = "none";
+    let hasMalware = false;
+    for (const v of vulns) {
+        if (v.id?.startsWith("MAL-"))
+            hasMalware = true;
+        if (v.database_specific?.severity?.toUpperCase().includes("MALICIOUS")) {
+            hasMalware = true;
+        }
+        highestSeverity = maxSeverity(highestSeverity, classifySeverity(v));
+    }
+    return {
+        packageRef: pkg,
+        vulnerabilities: vulns,
+        hasMalware,
+        highestSeverity,
+        skipped: null,
+        error: null,
+    };
+}
+/**
+ * Run the check against many servers. Each server is queried in
+ * parallel; the per-package timeout prevents one slow lookup from
+ * stalling the rest. Map keys are the server names supplied by caller.
+ */
+export async function checkServers(servers, opts = {}) {
+    const entries = await Promise.all(servers.map(async (s) => [s.name, await checkServer(s, opts)]));
+    const out = {};
+    for (const [name, result] of entries) {
+        out[name] = result;
+    }
+    return Object.freeze(out);
+}
+// ── Reporting helpers ──────────────────────────────────────────
+/**
+ * Returns names of servers that should be blocked (malware records).
+ */
+export function blockedServers(results) {
+    return Object.entries(results)
+        .filter(([, r]) => r.hasMalware)
+        .map(([name]) => name);
+}
+/**
+ * Returns names of servers that warrant a warning (high/critical CVE
+ * but not confirmed malware).
+ */
+export function warningServers(results) {
+    return Object.entries(results)
+        .filter(([, r]) => !r.hasMalware && (r.highestSeverity === "high" || r.highestSeverity === "critical"))
+        .map(([name]) => name);
+}
+/**
+ * Compose a human-readable report for blocked + warning servers.
+ * Returns empty string when neither category is populated.
+ */
+export function formatReport(results) {
+    const lines = [];
+    for (const [name, r] of Object.entries(results)) {
+        if (!r.hasMalware && r.highestSeverity !== "high" && r.highestSeverity !== "critical") {
+            continue;
+        }
+        const tag = r.hasMalware ? "MALWARE" : r.highestSeverity.toUpperCase();
+        const pkgLabel = r.packageRef
+            ? `${r.packageRef.ecosystem}:${r.packageRef.name}`
+            : "(unknown package)";
+        lines.push(`  [${tag}] ${name} → ${pkgLabel}`);
+        for (const v of r.vulnerabilities.slice(0, 3)) {
+            const aliasNote = v.aliases && v.aliases.length > 0 ? ` (${v.aliases.slice(0, 2).join(", ")})` : "";
+            const summary = v.summary ? ` — ${v.summary.slice(0, 120)}` : "";
+            lines.push(`      ${v.id}${aliasNote}${summary}`);
+        }
+        if (r.vulnerabilities.length > 3) {
+            lines.push(`      … and ${r.vulnerabilities.length - 3} more`);
+        }
+    }
+    return lines.join("\n");
+}
+/**
+ * One-call pre-flight wrapper. Designed for CLI use sites:
+ *
+ *   const verdict = await preflight(servers, { skip: opts.skipMalwareCheck });
+ *   if (!verdict.proceed) process.exit(1);
+ *
+ * Behaviour:
+ *   - `skip:true` → returns `proceed:true` immediately, no network.
+ *   - confirmed malware → blocks, logs "MALWARE" report, `proceed:false`.
+ *   - high/critical CVE in non-strict mode → warns + proceeds.
+ *   - high/critical CVE in strict mode → blocks like malware.
+ *   - network failure or unsupported runner → logged at info level, no block.
+ */
+export async function preflight(servers, opts = {}) {
+    const log = opts.logger ?? {
+        info: (m) => console.log(m),
+        warn: (m) => console.warn(m),
+        error: (m) => console.error(m),
+    };
+    const empty = Object.freeze({});
+    if (opts.skip) {
+        return { proceed: true, blocked: [], warnings: [], results: empty };
+    }
+    if (servers.length === 0) {
+        return { proceed: true, blocked: [], warnings: [], results: empty };
+    }
+    const results = await checkServers(servers, {
+        ...(typeof opts.timeoutMs === "number" ? { timeoutMs: opts.timeoutMs } : {}),
+        ...(opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {}),
+    });
+    const blocked = blockedServers(results);
+    const warnings = warningServers(results);
+    const report = formatReport(results);
+    // Surface skip/error notes (one line) so users know when a check was inconclusive.
+    for (const [name, r] of Object.entries(results)) {
+        if (r.skipped) {
+            log.info(`  [skipped] ${name}: ${r.skipped.reason}`);
+        }
+        else if (r.error) {
+            log.warn(`  [warn] OSV lookup failed for ${name}: ${r.error}`);
+        }
+    }
+    if (blocked.length > 0) {
+        log.error(`Aborting MCP install — ${blocked.length} server(s) match confirmed-malware records:`);
+        log.error(report);
+        log.error("Re-run with --skip-malware-check to override (not recommended).");
+        return { proceed: false, blocked, warnings, results };
+    }
+    if (warnings.length > 0) {
+        if (opts.strict) {
+            log.error(`Aborting MCP install (--strict) — ${warnings.length} server(s) have high/critical advisories:`);
+            log.error(report);
+            return { proceed: false, blocked: warnings, warnings: [], results };
+        }
+        log.warn(`Proceeding with warnings — ${warnings.length} server(s) have high/critical advisories:`);
+        log.warn(report);
+    }
+    return { proceed: true, blocked, warnings, results };
+}
+//# sourceMappingURL=osv-check.js.map

package/dist/security/osv-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv-check.js","sourceRoot":"","sources":["../../src/security/osv-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,MAAM,aAAa,GAAG,8BAA8B,CAAC;AA8CrD,kEAAkE;AAElE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACrE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7C,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,wBAAwB;AAE1D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,2BAA2B;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAE/B,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAuB;IAChD,oFAAoF;IACpF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,IAAI;gBAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,IAAI;gBAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,CAAC;IACH,CAAC;IACD,gEAAgE;IAChE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,IAAI,oBAAoB,CAAC,CAAC,CAAC;YAAE,SAAS;QACtC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAuB,EAAE,OAAe;IACjE,KAAK,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,IAAI,oBAAoB,CAAC,CAAC,CAAC;YAAE,SAAS;QACtC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,0DAA0D;IAC1D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,8DAA8D;IAC9D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,kEAAkE;IAClE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtF,OAAO,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,kEAAkE;AAElE;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAmB;IAClD,mEAAmE;IACnE,IAAI,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,UAAU,CAAC;IAEhD,MAAM,KAAK,GAAG,CAAC,CAAC,iBAAiB,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,UAAU,CAAC;IAEnD,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAC/F,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,KAAK,IAAI,GAAG;YAAE,OAAO,UAAU,CAAC;QACpC,IAAI,KAAK,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC;QAChC,IAAI,KAAK,IAAI,GAAG;YAAE,OAAO,QAAQ,CAAC;QAClC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAC9B,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IACxC,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACxD,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,aAAqB;IAC3C,mEAAmE;IACnE,oCAAoC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,QAAQ,GAA6B;IACzC,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,SAAS,WAAW,CAAC,CAAW,EAAE,CAAW;IAC3C,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,kEAAkE;AAElE;;;;GAIG;AACH,KAAK,UAAU,QAAQ,CACrB,GAAe,EACf,IAAoD;IAEpD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;aACtD,CAAC;YACF,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,gBAAgB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmC,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,iEAAiE;AAEjE,MAAM,cAAc,GAAG,iEAAiE,CAAC;AAEzF,MAAM,WAAW,GAAG,CAAC,GAAsB,EAAkB,EAAE,CAAC,CAAC;IAC/D,UAAU,EAAE,GAAG;IACf,eAAe,EAAE,EAAE;IACnB,UAAU,EAAE,KAAK;IACjB,eAAe,EAAE,MAAM;IACvB,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;IACnC,KAAK,EAAE,IAAI;CACZ,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,MAAqB,EAAkB,EAAE,CAAC,CAAC;IAClE,UAAU,EAAE,IAAI;IAChB,eAAe,EAAE,EAAE;IACnB,UAAU,EAAE,KAAK;IACjB,eAAe,EAAE,MAAM;IACvB,OAAO,EAAE;QACP,MAAM,EAAE,YAAY,MAAM,CAAC,OAAO,4EAA4E;KAC/G;IACD,KAAK,EAAE,IAAI;CACZ,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAqB,EACrB,OAAqB,EAAE;IAEvB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,GAAG,EAAE,CAAC;QAC9C,OAAO,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG;QAAE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACrD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO;YACL,UAAU,EAAE,GAAG;YACf,eAAe,EAAE,EAAE;YACnB,UAAU,EAAE,KAAK;YACjB,eAAe,EAAE,MAAM;YACvB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,kEAAkE;SAC1E,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAEpF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5D,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;QACrB,OAAO;YACL,UAAU,EAAE,GAAG;YACf,eAAe,EAAE,EAAE;YACnB,UAAU,EAAE,KAAK;YACjB,eAAe,EAAE,MAAM;YACvB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,IAAI,eAAe,GAAa,MAAM,CAAC;IACvC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;QAChD,IAAI,CAAC,CAAC,iBAAiB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACvE,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,eAAe,GAAG,WAAW,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO;QACL,UAAU,EAAE,GAAG;QACf,eAAe,EAAE,KAAK;QACtB,UAAU;QACV,eAAe;QACf,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAiE,EACjE,OAAqB,EAAE;IAEvB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAU,CAAC,CACxE,CAAC;IACF,MAAM,GAAG,GAAmC,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,kEAAkE;AAElE;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAiD;IAEjD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAiD;IAEjD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SAC3B,MAAM,CACL,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CACR,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,eAAe,KAAK,MAAM,IAAI,CAAC,CAAC,eAAe,KAAK,UAAU,CAAC,CACtF;SACA,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAiD;IAC5E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,eAAe,KAAK,MAAM,IAAI,CAAC,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YACtF,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU;YAC3B,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE;YAClD,CAAC,CAAC,mBAAmB,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,MAAM,QAAQ,EAAE,CAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,SAAS,GACb,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAgCD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAiE,EACjE,OAAyB,EAAE;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI;QACzB,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;KACvC,CAAC;IACF,MAAM,KAAK,GAA6C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE;QAC1C,GAAG,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAErC,mFAAmF;IACnF,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,kCAAkC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CACP,0BAA0B,OAAO,CAAC,MAAM,6CAA6C,CACtF,CAAC;QACF,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClB,GAAG,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;QAC7E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CACP,qCAAqC,QAAQ,CAAC,MAAM,2CAA2C,CAChG,CAAC;YACF,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QACtE,CAAC;QACD,GAAG,CAAC,IAAI,CACN,8BAA8B,QAAQ,CAAC,MAAM,2CAA2C,CACzF,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACvD,CAAC"}