rouge-xql 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: c8498c1b6b5b8343b0c4697c926cb1d7802e477bcec93b83d3b9466c303153d3
+  data.tar.gz: 978ccccd64668854812bc8917fce25231c1f5f2d8fa814a4aa716e34eead26e2
+SHA512:
+  metadata.gz: 8b50cc65c64c569318a18ea20ffd9bd937810bcd37569ea211ed322866bdd921512df1eeec5cfa2d0d33fb02be5edb65d666c46d8a44a2fc25c9e2138949739e
+  data.tar.gz: 902b9f14103808ab065b537085275851fc5e2e199ee0c80d64b21bbb5677b9781a4066f600839b322618fdd84cbf11b8d7387ce286bf0ee3f7e715e6b16e6b79

data/CHANGELOG.md

@@ -0,0 +1,38 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0]
+
+Initial release.
+
+### Added
+
+- `Rouge::Lexers::XQL`, registered under the tag `xql` with aliases `xif` and `xsiam`,
+  and associated with `*.xql` and `*.xif`.
+- Support for both XQL dialects in one lexer: pipeline queries
+  (`dataset = x | filter ... | alter ...`) and parsing/modeling rule files
+  (`[INGEST:...]`, `[RULE: NAME]`, `[MODEL:...]`, `[CONST]`).
+- Highlighting for the constructs that generic highlighters tend to miss: `xdm.*` model
+  fields as single tokens, `ENUM.*` and `XDM_CONST.*` constants, `$` parameter and
+  constant references, backtick-quoted identifiers, time literals (`30d`, `24H`, `3mo`),
+  the `->` JSON-path operator with its `[]` and `{}` forms, and section markers.
+- A string directly after `~=` / `!~=` is lexed as a regex, with its escapes picked out.
+- Only standard Rouge token types are emitted, so any stock theme styles the output with
+  no extra CSS.
+
+### Notes
+
+The string rules follow what the language actually accepts rather than the more widely
+copied approximations: inside `"..."` the only escape is `\"`, so `\d` and `\s` are
+ordinary characters and regexes are written raw; `"""..."""` takes the JSON escape set and
+is the only string form that may span a newline; and because `\\` is not an escape, a
+string ending `...\\"` resolves by longest valid token. There are no hex literals, no
+exponent floats, no `=>` or `<>`, and no single-quoted strings.
+
+[Unreleased]: https://github.com/vanhecke/rouge-xql/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/vanhecke/rouge-xql/releases/tag/v0.1.0

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Joris
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,90 @@
+# rouge-xql
+
+A [Rouge](https://github.com/rouge-ruby/rouge) lexer for **XQL**, the Cortex XSIAM/XDR query
+language — covering both of its dialects:
+
+* **XQL Queries** — `config timeframe = 30d | dataset = xdr_data | filter a ~= "b"`
+* **Parsing & Modeling rules** — `[INGEST:...]`, `[RULE: NAME]`, `[MODEL:...]`, `[CONST]`
+
+Both register under one tag, `xql`, because they share the entire expression language and
+real-world tooling feeds both through the same highlighter.
+
+## Install
+
+```ruby
+# Gemfile
+gem "rouge-xql"
+```
+
+```ruby
+require "rouge-xql"
+
+Rouge::Lexer.find("xql")             # => Rouge::Lexers::XQL
+Rouge.highlight(source, "xql", "html")
+```
+
+Requiring the gem is all that is needed: Rouge's `tag` DSL registers the class as a side
+effect of defining it. `xif` and `xsiam` work as aliases, and `*.xql` / `*.xif` are
+recognised by `Rouge::Lexer.guess`.
+
+Pair it with any Rouge theme — the lexer emits only standard token types, so stock
+stylesheets (including a plain `rougify style github` dump) style it correctly with no
+extra CSS.
+
+## Notes on the language
+
+XQL has a few properties that highlighters routinely get wrong. This lexer follows what
+the language actually accepts, and each case is covered by a test:
+
+* Inside `"..."` **the only escape is `\"`**. `\d`, `\s` and `\\` are ordinary characters,
+  which is why regexes are written raw. `"""..."""` is different — it takes the JSON escape
+  set and is the only string form that may span a newline.
+* Because `\\` is not an escape, `"...\\"` is ambiguous. It resolves by longest valid
+  token: `\"` counts as an escape only when a closing quote is still reachable on the line.
+  Get this wrong and a regex ending in a backslash swallows the rest of the line.
+* `-` binds greedily into a number: `a-1` is `Name(a) Num(-1)`, but `fields -foo` is
+  `Keyword(fields) Operator(-) Name(foo)`.
+* `xdm.a.b.c` is a single token. `ENUM.X` and `XDM_CONST.X` are three, but are highlighted
+  as one unit since that is what they mean.
+* Backticks are an identifier quote, not a string — that is how a reserved word becomes a
+  field name (`` `target` ``).
+* `[]`, `{}` and `->` are single tokens; a lone `{` or `}` is invalid.
+* There are **no** hex literals, no exponent floats, no `=>` or `<>`, and no single-quoted
+  strings. All are common in third-party XQL highlighting definitions and none is real.
+* Every keyword is case-insensitive; `OR`, `AND` and `IN` are commonly uppercase in the
+  wild.
+
+Two spellings are deliberately **not** treated as keywords: `colddataset` and `callmacro`.
+Some tooling lists them, but the language accepts only `cold_dataset` and `call_macro`, so
+highlighting them as commands would hide a real syntax error.
+
+Field names are not baked in. They are per-deployment schema rather than language vocabulary,
+and the language itself draws no distinction between a field and any other identifier.
+Fields are highlighted structurally instead: `xdm.*` paths, `XDM_CONST.*` / `ENUM.*`
+constants, `$refs` and backtick-quoted names each get their own token type.
+
+### Known limitation
+
+A string directly after `~=` / `!~=` is lexed as a regex (`Str::Regex`), with its escapes
+picked out. The regex argument of `regextract(field, "...")` and `replex` is **not** —
+finding it needs paren-depth tracking through nested calls like
+`regextract(to_string(_time), "...")`. Those render as ordinary strings.
+
+## Development
+
+```sh
+bundle install
+bundle exec rake                                   # specs
+TEST=spec/lexers/xql_spec.rb bundle exec rake spec # one file
+```
+
+The suite covers the token types, the string and comment edge cases above, filename and
+mimetype guessing, and asserts that both the demo and the visual sample lex with zero
+`Error` tokens and round-trip byte for byte.
+
+`spec/visual/samples/xql` is a single file exercising both dialects and most of the
+language; it is the quickest way to eyeball a change. Every identifier in it is invented.
+
+## Licence
+
+MIT. Not affiliated with, or endorsed by, Palo Alto Networks.

data/lib/rouge/demos/xql

@@ -0,0 +1,10 @@
+config timeframe = 30d
+| dataset = xdr_data // agent telemetry
+| filter event_type = ENUM.NETWORK and lowercase(actor_process_image_name) in ("winword.exe", "excel.exe")
+| filter action_remote_ip !~= "^10\.|^192\.168\."
+| alter host = arrayindex(regextract(_raw_log, "from (\S+) port"), 0),
+        user = coalesce(`target` -> [0].alternateId, actor_effective_username)
+| comp count(event_id) as connections by host, user, xdm.source.host.hostname
+| filter connections >= 5 and user != null
+| sort desc connections
+| limit 10

data/lib/rouge/lexers/xql/builtins.rb

@@ -0,0 +1,51 @@
+# -*- coding: utf-8 -*- #
+# frozen_string_literal: true
+
+# The 139 built-in functions of XQL, as listed in the Cortex XQL
+# reference documentation. Generated -- do not edit by hand.
+
+module Rouge
+  module Lexers
+    class XQL < RegexLexer
+      def self.functions
+        @functions ||= Set.new %w(
+          abs acos add approx_count
+          approx_quantiles approx_top array_all array_any
+          array_length arrayconcat arraycreate arraydistinct
+          arrayfilter arrayindex arrayindexof arraymap
+          arraymerge arrayrange arraystring asin
+          avg bitwise_and bitwise_or bitwise_sleft
+          bitwise_sright bitwise_xor cbrt ceil
+          coalesce concat convert_from_base_64 convert_to_base_64
+          cos cosine_distance cot count
+          count_distinct csc current_time date_floor
+          divide earliest euclidean_distance exp
+          extract_time extract_url_host extract_url_pub_suffix extract_url_registered_domain
+          first first_value floor format_string
+          format_timestamp greatest hierarchy_match if
+          incidr incidr6 incidrlist int_to_ip
+          ip_to_int is_ipv4 is_ipv6 is_known_private_ipv4
+          is_known_private_ipv6 json_extract json_extract_array json_extract_scalar
+          json_extract_scalar_array json_path_extract lag last
+          last_value latest least len
+          list ln log log10
+          lowercase ltrim max md5
+          median min mod multiply
+          object_create object_merge parse_epoch parse_timestamp
+          pow rand range_bucket rank
+          regextract replace replex round
+          row_number rtrim safe_add safe_divide
+          safe_ip_to_int safe_multiply safe_negate safe_subtract
+          sec sha1 sha256 sha512
+          sign sin split sqrt
+          stddev_population stddev_sample string_count subtract
+          sum tan time_frame_end timestamp_diff
+          timestamp_seconds to_boolean to_epoch to_float
+          to_integer to_json_string to_number to_string
+          to_timestamp trim trunc uppercase
+          values var wildcard_match
+        )
+      end
+    end
+  end
+end

data/lib/rouge/lexers/xql.rb

@@ -0,0 +1,281 @@
+# -*- coding: utf-8 -*- #
+# frozen_string_literal: true
+
+require "rouge"
+
+module Rouge
+  module Lexers
+    # Lexer for XQL, the Cortex XSIAM/XDR query language.
+    #
+    # Covers both dialects, which share one expression language:
+    #
+    #   * pipeline queries    `config timeframe = 30d | dataset = x | filter a ~= "b"`
+    #   * XIF rule files      `[INGEST:vendor="x", ...]` / `[RULE: NAME]` / `[MODEL: dataset="x"]`
+    #
+    # Three properties of the language drive most of the rule ordering:
+    #
+    #   * inside `"..."` the ONLY escape is `\"` -- `\d`, `\s` and `\\` are ordinary
+    #     characters, which is why regexes are written raw. `"""..."""` is different: it
+    #     takes the JSON escape set, and is the only string form that may span newlines.
+    #   * `-` binds greedily into a number, so `a-1` is two tokens: `a` and `-1`.
+    #   * the language resolves ambiguity by longest match where Rouge takes the first
+    #     match, so `4625abc` is a single identifier and the number rules need a trailing
+    #     `(?!#{WORD_CHAR})` guard or they would split it.
+    class XQL < RegexLexer
+      title "XQL"
+      desc "Cortex XSIAM/XDR Query Language and XIF parsing/modeling rules"
+      tag "xql"
+      aliases "xif", "xsiam"
+      filenames "*.xql", "*.xif"
+      mimetypes "text/x-xql"
+
+      # Required for an out-of-tree lexer: Lexer.demo_file defaults to a path inside
+      # rouge's own lib/rouge, so `.demo` would raise Errno::ENOENT without this.
+      demo_file File.expand_path("../demos/xql", __dir__)
+
+      lazy { require_relative "xql/builtins" }
+
+      # Stage commands -- the word that opens a query or follows a pipe.
+      # The last six are valid only in XIF rule files.
+      def self.commands
+        @commands ||= Set.new %w(
+          aihelper search preset call call_macro dataset cold_dataset datamodel
+          filter sort limit fields alter comp windowcomp target dedup bin union
+          join pivot view arrayexpand replacenull config iploc transaction tag
+          top getrole transpose hl highlight table graph
+          drop storeset storeget switch case default
+        )
+      end
+
+      # Deliberately NOT commands: `colddataset` and `callmacro`. Some tooling lists these
+      # spellings, but the language accepts only `cold_dataset` and `call_macro`.
+      # Highlighting them as commands would hide a real syntax error.
+
+      # Words that modify a stage rather than opening one.
+      def self.clause_keywords
+        @clause_keywords ||= Set.new %w(
+          as by asc desc for span bins suffix timeshift timezone
+        )
+      end
+
+      def self.operator_words
+        @operator_words ||= Set.new %w(
+          and or not in contains like between incidr incidr6
+        )
+      end
+
+      def self.constants
+        @constants ||= Set.new %w(true false null)
+      end
+
+      # Only consulted directly before a `(`, where these are join types
+      # (`join type = inner (...)`) rather than calls. None is a builtin function.
+      def self.join_types
+        @join_types ||= Set.new %w(inner left right outer full cross)
+      end
+
+      # An identifier is one or more of: digit, ASCII letter, underscore, or a character in
+      # [\u0080-\u201B] / [\u201E-\uFFFE] -- note the hole, which excludes the smart quotes
+      # U+201C and U+201D. Backtick-quoted names are handled by their own rule.
+      WORD_CHAR = /[0-9A-Za-z_\u0080-\u201B\u201E-\uFFFE]/.freeze
+
+      # A double-quoted string, which cannot span a newline.
+      QUOTED = /"(?:\\"|[^"\r\n])*"/.freeze
+
+      # `\"` is the only escape, and `\\` is NOT one -- so `"\\"` is ambiguous: the last
+      # two characters are either an escaped quote (leaving the string open) or a literal
+      # backslash and the closing quote. The language resolves this by longest valid token,
+      # i.e. `\"` is an escape only when a closing quote is still reachable on the same
+      # line. This lookahead, applied at the opening quote and at each `\"`, reproduces
+      # that. Regexes ending in a backslash depend on it.
+      CLOSING_QUOTE_AHEAD = /(?=(?:\\"|[^"\r\n])*")/.freeze
+
+      def self.detect?(text)
+        # An XIF section header is unambiguous; nothing else opens a file this way.
+        return true if text =~ /\A\s*(?:\/\*.*?\*\/|\/\/[^\n]*\n|\s)*\[\s*(?:INGEST|MODEL|RULE|CONST)\b/im
+
+        false
+      end
+
+      state :root do
+        mixin :comments
+
+        # [RULE: NAME] -- matched whole so the macro name can be picked out. Every other
+        # header form falls through to the generic rule below.
+        rule %r/(\[)(\s*)(RULE)(\s*)(:)(\s*)(#{WORD_CHAR}+)(\s*)(\])/i do
+          groups Punctuation, Text::Whitespace, Keyword::Namespace, Text::Whitespace,
+                 Punctuation, Text::Whitespace, Name::Function, Text::Whitespace, Punctuation
+        end
+
+        # [INGEST:...] [MODEL:...] [CONST] [CALL ...]. Not distinct tokens in the language
+        # -- they lex as `[` name `:` ... `]` -- but they are the file's structure.
+        rule %r/(\[)(\s*)(INGEST|MODEL|CONST|CALL|RULE)\b/i do
+          groups Punctuation, Text::Whitespace, Keyword::Namespace
+          push :section_header
+        end
+
+        mixin :expression
+      end
+
+      state :section_header do
+        rule %r/\]/, Punctuation, :pop!
+        mixin :comments
+        rule %r/\b(?:keep|drop)\b/i, Keyword::Constant
+        rule QUOTED, Str::Double
+        rule %r/#{WORD_CHAR}+(?=\s*=)/, Name::Attribute
+        rule %r/#{WORD_CHAR}+/, Name
+        rule %r/=/, Operator
+        rule %r/[:,]/, Punctuation
+        rule %r/./m, Error
+      end
+
+      state :comments do
+        rule %r/\s+/m, Text::Whitespace
+        # A section-marker comment. Highest priority of all rules, and conventionally
+        # rendered in the background colour, i.e. invisible.
+        rule %r/§.*?§/m, Comment::Special
+        rule %r(//[^\n]*), Comment::Single
+        # Non-greedy and does NOT nest: `/* a /* b */` ends at the first `*/`.
+        rule %r(/\*.*?\*/)m, Comment::Multiline
+        # A dangling delimiter is always an error.
+        rule %r(/\*|\*/), Error
+      end
+
+      state :expression do
+        mixin :comments
+
+        # -- strings ---------------------------------------------------------------
+        # Triple quotes first: they take the JSON escape set and may span newlines.
+        rule %r/"""/, Str::Double, :triple_string
+        rule %r/"#{CLOSING_QUOTE_AHEAD}/, Str::Double, :string
+        # No closing quote on this line, so this cannot be a string at all.
+        rule %r/"[^\r\n]*/, Error
+
+        # The identifier quote, used to name a field that collides with a reserved word or
+        # contains a space -- `filter `target` = 1`.
+        rule %r/`(?:\\`|[^`\r\n])*`/, Str::Backtick
+        rule %r/`/, Error
+
+        # -- names -----------------------------------------------------------------
+        # A query parameter ($user) or an XIF [CONST] reference ($MY_REGEX).
+        rule %r/\$#{WORD_CHAR}*(?:\.#{WORD_CHAR}+)*/, Name::Variable
+
+        # Three tokens in the language (name, dot, name), but one visual unit.
+        rule %r/\b(?:ENUM|XDM_CONST)\.#{WORD_CHAR}+/i, Name::Constant
+
+        # `xdm.source.user.username` really is a single token.
+        rule %r/\bxdm\.#{WORD_CHAR}+(?:\.#{WORD_CHAR}+)*/i, Name::Attribute
+
+        # -- numbers ---------------------------------------------------------------
+        # Time literals before plain numbers, and `ms`/`mo` before the single letters.
+        rule %r/-?\d+(?:\.\d+)?(?:ms|mo|[smhdwy])(?!#{WORD_CHAR})/i, Literal::Date
+        rule %r/-?\d+\.\d+(?!#{WORD_CHAR})/, Num::Float
+        rule %r/-?\d+(?!#{WORD_CHAR})/, Num::Integer
+
+        # -- words -----------------------------------------------------------------
+        # Set lookups rather than Rouge's `keywords` DSL, which is not present in 5.1.0 and
+        # this gem supports rouge >= 4.0. It also avoids building a large alternation.
+        #
+        # Directly before a `(`. Commands and word operators keep their own colour here
+        # (`filter (a or b)`, `not (...)`, `in (...)`).
+        rule %r/#{WORD_CHAR}+(?=\s*\()/ do |m|
+          word = m[0].downcase
+          token(if self.class.commands.include?(word) then Keyword::Declaration
+                elsif self.class.operator_words.include?(word) then Operator::Word
+                elsif self.class.join_types.include?(word) then Keyword
+                elsif self.class.functions.include?(word) then Name::Builtin
+                else Name::Function
+                end)
+        end
+
+        # Everywhere else. Builtin function names are deliberately absent: bare `count`
+        # or `min` is a field name, not a call.
+        rule %r/#{WORD_CHAR}+/ do |m|
+          word = m[0].downcase
+          token(if self.class.commands.include?(word) then Keyword::Declaration
+                elsif self.class.clause_keywords.include?(word) then Keyword
+                elsif self.class.operator_words.include?(word) then Operator::Word
+                elsif self.class.constants.include?(word) then Keyword::Constant
+                else Name
+                end)
+        end
+
+        # -- operators and punctuation --------------------------------------------
+        rule %r/->/, Operator
+        # A regex match takes a regex on the right, so colour that string as one.
+        rule %r/!~=|~=/, Operator, :regex_expected
+        rule %r/!=|<=|>=/, Operator
+        rule %r/[=<>|*+-]/, Operator
+        # `[]` (whole array) and `{}` (whole object) are single tokens; a lone brace is not.
+        rule %r/\[\]|\{\}/, Punctuation
+        rule %r/[()\[\],.:;]/, Punctuation
+
+        # `#`, `%`, `@`, `'`, `&`, `^`, `?`, `{`, `}`, `\` and the smart quotes are not
+        # valid anywhere outside a string.
+        rule %r/./m, Error
+      end
+
+      # After `~=` / `!~=`: colour a string literal here as a regex, then resume.
+      # `goto` rather than `push` so the string state pops straight back to :expression.
+      state :regex_expected do
+        mixin :comments
+
+        rule %r/"""/ do
+          token Str::Regex
+          goto :triple_regex
+        end
+
+        rule %r/"#{CLOSING_QUOTE_AHEAD}/ do
+          token Str::Regex
+          goto :regex
+        end
+
+        rule %r/"[^\r\n]*/, Error, :pop!
+
+        # Not a literal (a field, a $param, a call) -- nothing to do.
+        rule %r/(?=\S)/ do
+          pop!
+        end
+      end
+
+      state :string do
+        rule %r/\\"#{CLOSING_QUOTE_AHEAD}/, Str::Escape
+        rule %r/"/, Str::Double, :pop!
+        rule %r/[^"\\\r\n]+/, Str::Double
+        # A backslash that is not part of `\"` is an ordinary character here.
+        rule %r/\\/, Str::Double
+        # Defensive only: the entry rule already diverts an unterminated string to Error.
+        rule %r/\r?\n/, Error, :pop!
+      end
+
+      # Same content, but every backslash escape gets picked out -- these are regexes.
+      state :regex do
+        rule %r/\\"#{CLOSING_QUOTE_AHEAD}/, Str::Escape
+        rule %r/"/, Str::Regex, :pop!
+        # Deliberately excludes `\\`: consuming a backslash pair here would step over the
+        # `\"` above and close the string early on a regex ending in `...\\"`.
+        rule %r/\\[^"\\\r\n]/, Str::Escape
+        rule %r/[^"\\\r\n]+/, Str::Regex
+        rule %r/\\/, Str::Regex
+        # Defensive only: the entry rule already diverts an unterminated string to Error.
+        rule %r/\r?\n/, Error, :pop!
+      end
+
+      # Takes the JSON escape set (\" \/ \\ \b \f \n \r \t) and, unlike a plain
+      # double-quoted string, may span newlines.
+      state :triple_string do
+        rule %r/"""/, Str::Double, :pop!
+        rule %r(\\["/\\bfnrt]), Str::Escape
+        rule %r/[^"\\]+/m, Str::Double
+        rule %r/[\\"]/, Str::Double
+      end
+
+      state :triple_regex do
+        rule %r/"""/, Str::Regex, :pop!
+        rule %r(\\["/\\bfnrt]), Str::Escape
+        rule %r/[^"\\]+/m, Str::Regex
+        rule %r/[\\"]/, Str::Regex
+      end
+    end
+  end
+end

data/lib/rouge-xql.rb

@@ -0,0 +1,8 @@
+# -*- coding: utf-8 -*- #
+# frozen_string_literal: true
+
+require "rouge"
+
+# Defining the class registers it: Rouge::Lexer.tag calls Lexer.register as a side
+# effect, so after this require Rouge::Lexer.find("xql") resolves. Nothing else to wire up.
+require_relative "rouge/lexers/xql"

metadata

@@ -0,0 +1,74 @@
+--- !ruby/object:Gem::Specification
+name: rouge-xql
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Joris Vanhecke
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rouge
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6.0'
+description: 'A Rouge syntax-highlighting lexer for XQL. Registers under the tag "xql".
+
+  '
+email:
+- joris@joris.be
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- lib/rouge-xql.rb
+- lib/rouge/demos/xql
+- lib/rouge/lexers/xql.rb
+- lib/rouge/lexers/xql/builtins.rb
+homepage: https://github.com/vanhecke/rouge-xql
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/vanhecke/rouge-xql
+  source_code_uri: https://github.com/vanhecke/rouge-xql
+  bug_tracker_uri: https://github.com/vanhecke/rouge-xql/issues
+  changelog_uri: https://github.com/vanhecke/rouge-xql/blob/main/CHANGELOG.md
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.16
+specification_version: 4
+summary: Rouge lexer for XQL, the Cortex XSIAM/XDR query and rule language
+test_files: []