@akasecurity/cli 0.9.14 → 0.9.15

package/web-ui/web-ui/.next/server/chunks/{670.js → 250.js}

@@ -1 +1 @@
-"use strict";exports.id=670,exports.ids=[670],exports.modules={55670:(a,b,c)=>{c.d(b,{Ah:()=>r,MR:()=>s});var d=c(88477),e=c(37067),f=c(44708);class g extends Error{constructor(a){super(`control-plane request failed with status ${String(a)}`),this.status=a,this.name="RemoteRequestError"}}class h extends Error{constructor(a){super(`control plane does not serve ${a}`),this.route=a,this.name="RemoteRouteAbsent"}}class i extends Error{constructor(a,b){super(`refusing to send a malformed body to ${a}`),this.cause=b,this.name="RemoteRequestInvalid"}}class j extends Error{constructor(a){super(`refusing to talk to an unsafe control-plane endpoint: ${(0,d.Vgn)(a)}`),this.name="RemoteEndpointRefused"}}class k extends Error{constructor(a,b){super(`control plane answered ${a} with ${b}`),this.name="RemoteResponseInvalid"}}class l extends Error{constructor(a,b){super(`control-plane request did not complete: ${a}`),this.status=b,this.name="RemoteTransportError"}}async function m(a){let b=new URL(a.url),c=a.timeoutMs??1e4,d="http:"===b.protocol?e.request:f.request,g={method:a.method,headers:{...a.headers,...void 0===a.apiKey?{}:{"x-api-key":a.apiKey},accept:"application/json",...void 0===a.body?{}:{"content-type":"application/json","content-length":String(Buffer.byteLength(a.body))}}};return new Promise((e,f)=>{let h=!1,i=(a,b)=>{h||(h=!0,f(new l(a,b)))},j=d(b,g,a=>{let b=[],c=0;a.on("data",d=>{if((c+=d.length)>8388608){i(`response exceeded ${String(8388608)} bytes`,a.statusCode),a.destroy(),j.destroy();return}b.push(d)}),a.on("aborted",()=>{i("the response was aborted",a.statusCode)}),a.on("end",()=>{h||(h=!0,e({status:a.statusCode??0,headers:a.headers,body:Buffer.concat(b).toString("utf8")}))})}),k=setTimeout(()=>{i(`no response within ${String(c)}ms`),j.destroy()},c);k.unref(),j.on("upgrade",(a,b)=>{i("the deployment answered with a protocol upgrade"),b.destroy()}),j.on("close",()=>{i("the connection closed before a response was read"),clearTimeout(k)}),j.on("error",a=>{i(a.message)}),void 0!==a.body&&j.write(a.body),j.end()})}let n={events:"/v1/events",auditEvents:"/v1/audit-events",auditEventsBatch:"/v1/audit-events/batch",inventory:"/v1/inventory",storePosture:"/v1/store-posture",policyBundle:"/v1/policy-bundle",whoami:"/v1/plugin/whoami",shares:"/v1/shares",commands:"/v1/plugin/commands"};function o(a,b){let c=a.headers[b];if(void 0!==c)return Array.isArray(c)?c[0]:c}function p(a){if(a.status<200||a.status>=300)throw new g(a.status);return a.body}function q(a,b,c){let d;try{d=JSON.parse(b)}catch{throw new k(c,"a body that is not JSON")}let e=a.safeParse(d);if(!e.success)throw new k(c,"a body this client cannot read");return e.data}function r(a){let b=function(a){if(!(0,d.lGs)(a))throw new j(a);let b=a.length;for(;b>0&&47===a.charCodeAt(b-1);)b-=1;return a.slice(0,b)}(a.endpoint),c=a=>`${b}${a}`,e={apiKey:a.apiKey,timeoutMs:a.timeoutMs},f=async a=>{let b=d.qhM.safeParse(a);if(!b.success)throw new i(n.auditEvents,b.error);p(await m({...e,method:"POST",url:c(n.auditEvents),body:JSON.stringify(b.data)}))};return{async ingestEvents(a){let b=await m({...e,method:"POST",url:c(n.events),body:JSON.stringify(a)});return q(d.kg1,p(b),n.events)},async ingestInventory(a){let b=await m({...e,method:"POST",url:c(n.inventory),body:JSON.stringify(a)});return q(d.PUD,p(b),n.inventory)},async recordAuditEvent(a){await f(a)},async recordAuditEvents(a,b){let g=d.lBn.safeParse({events:a});if(!g.success)throw new i(n.auditEventsBatch,g.error);let j=await m({...e,method:"POST",url:c(n.auditEventsBatch),body:JSON.stringify(g.data)});if(404===j.status){if(b?.fallbackToSingleEvents!==!0)throw new h(n.auditEventsBatch);for(let a of g.data.events)await f(a);return{accepted:g.data.events.length}}return q(d.t8P,p(j),n.auditEventsBatch)},async reportStorePosture(a){p(await m({...e,method:"POST",url:c(n.storePosture),body:JSON.stringify(a)}))},async getPolicyBundle(a){let b=await m({...e,method:"GET",url:c(n.policyBundle),...void 0===a?{}:{headers:{"if-none-match":a}}});return 304===b.status?{changed:!1,etag:o(b,"etag")??a}:{changed:!0,bundle:q(d.vap,p(b),n.policyBundle),etag:o(b,"etag")}},async whoami(){let a=await m({...e,method:"GET",url:c(n.whoami)});return q(d.NtJ,p(a),n.whoami)},async recordProjectEgress(a){let b=d.BZd.safeParse(a);if(!b.success)throw new i(n.shares,b.error);let f=await m({...e,method:"POST",url:c(n.shares),body:JSON.stringify(b.data)});if(404===f.status)throw new h(n.shares);p(f)},async pollCommand(){let a=await m({...e,method:"GET",url:c(n.commands)});return 404===a.status?null:q(d.CPm,p(a),n.commands).command},async ackCommand(a,b){let f=d.B0R.safeParse(b),g=`${n.commands}/${encodeURIComponent(a)}/ack`;if(!f.success)throw new i(g,f.error);p(await m({...e,method:"POST",url:c(g),body:JSON.stringify(f.data)}))}}}function s(a=15e3){return async(b,c)=>{try{return await r({...b,timeoutMs:a}).recordProjectEgress(c),{ok:!0}}catch(a){return{ok:!1,kind:function(a){switch("object"!=typeof a||null===a||!("name"in a)?null:"string"==typeof a.name?a.name:null){case"RemoteRouteAbsent":return"route-absent";case"RemoteRequestInvalid":case"RemoteEndpointRefused":return"invalid-request";case"RemoteResponseInvalid":return"rejected"}let b=function(a){if("object"!=typeof a||null===a||!("status"in a))return null;let{status:b}=a;return"number"==typeof b&&Number.isInteger(b)&&b>=100&&b<=599?b:null}(a);if(null===b)return"unreachable";switch(b){case 401:return"unauthorized";case 403:return"forbidden";case 429:case 404:return"unreachable";default:return b>=400&&b<=499?"rejected":"unreachable"}}(a)}}}}}};
+"use strict";exports.id=250,exports.ids=[250],exports.modules={92250:(a,b,c)=>{c.d(b,{Ah:()=>r,MR:()=>s});var d=c(40557),e=c(37067),f=c(44708);class g extends Error{constructor(a){super(`control-plane request failed with status ${String(a)}`),this.status=a,this.name="RemoteRequestError"}}class h extends Error{constructor(a){super(`control plane does not serve ${a}`),this.route=a,this.name="RemoteRouteAbsent"}}class i extends Error{constructor(a,b){super(`refusing to send a malformed body to ${a}`),this.cause=b,this.name="RemoteRequestInvalid"}}class j extends Error{constructor(a){super(`refusing to talk to an unsafe control-plane endpoint: ${(0,d.Vgn)(a)}`),this.name="RemoteEndpointRefused"}}class k extends Error{constructor(a,b){super(`control plane answered ${a} with ${b}`),this.name="RemoteResponseInvalid"}}class l extends Error{constructor(a,b){super(`control-plane request did not complete: ${a}`),this.status=b,this.name="RemoteTransportError"}}async function m(a){let b=new URL(a.url),c=a.timeoutMs??1e4,d="http:"===b.protocol?e.request:f.request,g={method:a.method,headers:{...a.headers,...void 0===a.apiKey?{}:{"x-api-key":a.apiKey},accept:"application/json",...void 0===a.body?{}:{"content-type":"application/json","content-length":String(Buffer.byteLength(a.body))}}};return new Promise((e,f)=>{let h=!1,i=(a,b)=>{h||(h=!0,f(new l(a,b)))},j=d(b,g,a=>{let b=[],c=0;a.on("data",d=>{if((c+=d.length)>8388608){i(`response exceeded ${String(8388608)} bytes`,a.statusCode),a.destroy(),j.destroy();return}b.push(d)}),a.on("aborted",()=>{i("the response was aborted",a.statusCode)}),a.on("end",()=>{h||(h=!0,e({status:a.statusCode??0,headers:a.headers,body:Buffer.concat(b).toString("utf8")}))})}),k=setTimeout(()=>{i(`no response within ${String(c)}ms`),j.destroy()},c);k.unref(),j.on("upgrade",(a,b)=>{i("the deployment answered with a protocol upgrade"),b.destroy()}),j.on("close",()=>{i("the connection closed before a response was read"),clearTimeout(k)}),j.on("error",a=>{i(a.message)}),void 0!==a.body&&j.write(a.body),j.end()})}let n={events:"/v1/events",auditEvents:"/v1/audit-events",auditEventsBatch:"/v1/audit-events/batch",inventory:"/v1/inventory",storePosture:"/v1/store-posture",policyBundle:"/v1/policy-bundle",whoami:"/v1/plugin/whoami",shares:"/v1/shares",commands:"/v1/plugin/commands"};function o(a,b){let c=a.headers[b];if(void 0!==c)return Array.isArray(c)?c[0]:c}function p(a){if(a.status<200||a.status>=300)throw new g(a.status);return a.body}function q(a,b,c){let d;try{d=JSON.parse(b)}catch{throw new k(c,"a body that is not JSON")}let e=a.safeParse(d);if(!e.success)throw new k(c,"a body this client cannot read");return e.data}function r(a){let b=function(a){if(!(0,d.lGs)(a))throw new j(a);let b=a.length;for(;b>0&&47===a.charCodeAt(b-1);)b-=1;return a.slice(0,b)}(a.endpoint),c=a=>`${b}${a}`,e={apiKey:a.apiKey,timeoutMs:a.timeoutMs},f=async a=>{let b=d.qhM.safeParse(a);if(!b.success)throw new i(n.auditEvents,b.error);p(await m({...e,method:"POST",url:c(n.auditEvents),body:JSON.stringify(b.data)}))};return{async ingestEvents(a){let b=await m({...e,method:"POST",url:c(n.events),body:JSON.stringify(a)});return q(d.kg1,p(b),n.events)},async ingestInventory(a){let b=await m({...e,method:"POST",url:c(n.inventory),body:JSON.stringify(a)});return q(d.PUD,p(b),n.inventory)},async recordAuditEvent(a){await f(a)},async recordAuditEvents(a,b){let g=d.lBn.safeParse({events:a});if(!g.success)throw new i(n.auditEventsBatch,g.error);let j=await m({...e,method:"POST",url:c(n.auditEventsBatch),body:JSON.stringify(g.data)});if(404===j.status){if(b?.fallbackToSingleEvents!==!0)throw new h(n.auditEventsBatch);for(let a of g.data.events)await f(a);return{accepted:g.data.events.length}}return q(d.t8P,p(j),n.auditEventsBatch)},async reportStorePosture(a){p(await m({...e,method:"POST",url:c(n.storePosture),body:JSON.stringify(a)}))},async getPolicyBundle(a){let b=await m({...e,method:"GET",url:c(n.policyBundle),...void 0===a?{}:{headers:{"if-none-match":a}}});return 304===b.status?{changed:!1,etag:o(b,"etag")??a}:{changed:!0,bundle:q(d.vap,p(b),n.policyBundle),etag:o(b,"etag")}},async whoami(){let a=await m({...e,method:"GET",url:c(n.whoami)});return q(d.NtJ,p(a),n.whoami)},async recordProjectEgress(a){let b=d.BZd.safeParse(a);if(!b.success)throw new i(n.shares,b.error);let f=await m({...e,method:"POST",url:c(n.shares),body:JSON.stringify(b.data)});if(404===f.status)throw new h(n.shares);p(f)},async pollCommand(){let a=await m({...e,method:"GET",url:c(n.commands)});return 404===a.status?null:q(d.CPm,p(a),n.commands).command},async ackCommand(a,b){let f=d.B0R.safeParse(b),g=`${n.commands}/${encodeURIComponent(a)}/ack`;if(!f.success)throw new i(g,f.error);p(await m({...e,method:"POST",url:c(g),body:JSON.stringify(f.data)}))}}}function s(a=15e3){return async(b,c)=>{try{return await r({...b,timeoutMs:a}).recordProjectEgress(c),{ok:!0}}catch(a){return{ok:!1,kind:function(a){switch("object"!=typeof a||null===a||!("name"in a)?null:"string"==typeof a.name?a.name:null){case"RemoteRouteAbsent":return"route-absent";case"RemoteRequestInvalid":case"RemoteEndpointRefused":return"invalid-request";case"RemoteResponseInvalid":return"rejected"}let b=function(a){if("object"!=typeof a||null===a||!("status"in a))return null;let{status:b}=a;return"number"==typeof b&&Number.isInteger(b)&&b>=100&&b<=599?b:null}(a);if(null===b)return"unreachable";switch(b){case 401:return"unauthorized";case 403:return"forbidden";case 429:case 404:return"unreachable";default:return b>=400&&b<=499?"rejected":"unreachable"}}(a)}}}}}};

package/web-ui/web-ui/.next/server/chunks/491.js

@@ -0,0 +1 @@
+"use strict";exports.id=491,exports.ids=[491],exports.modules={25491:(a,b,c)=>{c.d(b,{Zs:()=>t,cm:()=>s,h2:()=>u,h6:()=>w,oP:()=>v});var d=c(86305);c(97549);var e=c(48161),f=c(39051),g=c(43586),h=c(40557),i=c(99774),j=c(55474),k=c(4949);let l="Could not read the local store (~/.aka/data/aka.db).";function m(a){return null===a.field?"The request did not arrive in the expected shape — reload the page and try again.":a.wrongType?`The '${a.field}' field did not arrive as text — reload the page and try again.`:`The '${a.field}' field was not in the expected form — reload the page and try again.`}let n=`${l} The fingerprint key cannot be minted until it is readable, because a key that reused a stored version would produce grants that never match.`;function o(a){let b=a?.code;return"floor-unreadable"===b?n:"string"==typeof b?"Could not access the exception key file — check the permissions on ~/.aka/data. Do not delete exception.key to work around this; that invalidates every existing grant.":"The exception key file is corrupt. Delete ~/.aka/data/exception.key to mint a new key (this invalidates existing grants)."}function p(){try{return(0,e.userInfo)().username}catch{return"unknown"}}function q(a){try{return(0,h.N6N)(a)}catch(a){return{error:a instanceof Error?a.message:"invalid scope"}}}function r(a){return(0,j.db)().exceptions.create(a).then(()=>((0,i.revalidatePath)("/exceptions"),{ok:!0})).catch(a=>a instanceof g.qA?{ok:!1,error:"An active exception for this value already exists — revoke it first."}:{ok:!1,error:"Could not create the exception."})}async function s(a){let b,c,d=(0,h.K7s)(h.QcD,a);if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,f=e.reason.trim();if(""===f)return{ok:!1,error:"A reason is required — it is the audit trail."};let i=q(e.scope);if("error"in i)return{ok:!1,error:i.error};try{b=(await (0,j.db)().exceptions.recentBlocked(g.WR)).find(a=>a.reference===e.reference)}catch{return{ok:!1,error:l}}if(!b)return{ok:!1,error:"That blocked detection has expired from the ledger — trigger it again."};try{c=(0,g.y9)((0,g.KS)())}catch(a){return{ok:!1,error:o(a)}}return(0,g.Dg)(c,b.keyVersion)?"permanent"===i.scope&&e.confirmation!==b.maskedValue?{ok:!1,error:"Permanent grants require retyping the masked value exactly as shown."}:r({ruleId:b.ruleId,category:b.category,valueFingerprint:b.valueFingerprint,keyVersion:b.keyVersion,maskedValue:b.maskedValue,...i,justification:f,conditions:null,createdBy:p(),createdVia:"web-approve"}):{ok:!1,error:null===c?"The exception key file is missing, so the fingerprint recorded for this detection can no longer be matched. Trigger the detection again.":`That detection was blocked under fingerprint key v${String(b.keyVersion)}; the key is now v${String(c.version)}, so a grant from it could never match. Trigger the detection again.`}}async function t(a){let b,c,d=(0,h.K7s)(h.Nh0,a);if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,i=e.reason.trim();if(""===i)return{ok:!1,error:"A reason is required — it is the audit trail."};let k=q(e.scope);if("error"in k)return{ok:!1,error:k.error};if(""===e.value)return{ok:!1,error:"No value supplied — nothing to except."};if("permanent"===k.scope&&e.confirmation!==e.value)return{ok:!1,error:"Permanent grants require retyping the value exactly."};try{({rules:b}=(0,j.db)().installedPacks.installedRuleset())}catch{return{ok:!1,error:l}}let n=b.find(a=>a.id===e.ruleId);if(!n)return{ok:!1,error:`Unknown or disabled rule '${e.ruleId}'.`};let s=(0,f.SQ)(e.value,b).filter(a=>a.ruleId===e.ruleId);if(0===s.length)return{ok:!1,error:`The value does not match rule ${e.ruleId} — a grant for it would never apply.`};let t=[...new Set(s.map(a=>a.rawMatch))],u=t[0];if(t.length>1||void 0===u)return{ok:!1,error:`The input contains ${String(t.length)} distinct values matching ${e.ruleId} — supply exactly one.`};try{c=(0,g.Rd)((0,g.KS)())}catch(a){return{ok:!1,error:o(a)}}let v={valueFingerprint:(0,g._2)(c,u),keyVersion:c.version,maskedValue:(0,f.sE)(u)};return r({ruleId:n.id,category:n.category,...v,...k,justification:i,conditions:null,createdBy:p(),createdVia:"web-add"})}async function u(a){let b,c,d=(0,h.K7s)(h.agn,a);if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,f=e.justification.trim();if(""===f)return{ok:!1,error:"A justification is required — it is the audit trail."};let k=q(e.scope);if("error"in k)return{ok:!1,error:k.error};let l=h.jUf.safeParse(e.pointer.trim());if(!l.success)return{ok:!1,error:"Not a vault pointer — paste the full [[aka:...]] token."};try{let a=new g.Pi({repo:(0,j.db)().secretVault,keys:(0,g.Ru)((0,g.xR)().vaultKeyCustody,(0,g.Wo)()),isConsented:()=>(0,h.hds)((0,g.xR)().vaultConsent)});b=await a.resolvePointerIdentity(l.data),c=null===b?null:await a.describePointer(l.data)}catch{b=null,c=null}if(null===b)return{ok:!1,error:"The pointer could not be resolved — it is not one this machine issued, or its entry was purged."};let n=c?.category??function(a){let b=a.slice(6).split(":")[0]??"",c=h.gbA.safeParse(b);return c.success?c.data:null}(l.data);if(null===n)return{ok:!1,error:"Not a vault pointer — paste the full [[aka:...]] token."};if("permanent"===k.scope){if(null===c)return{ok:!1,error:"A permanent reveal needs the value preview to confirm against — use a time-limited scope."};if(e.confirmation!==c.maskedMatch)return{ok:!1,error:`A permanent reveal must be confirmed by retyping the masked value (${c.maskedMatch}).`}}try{let a=await (0,j.db)().exceptions.create({ruleId:b.ruleId,category:n,valueFingerprint:b.valueFingerprint,keyVersion:b.fingerprintKeyVersion,maskedValue:c?.maskedMatch??"\xb7\xb7\xb7",capability:"reveal_to_model",...k,justification:f,conditions:null,createdBy:"dashboard",createdVia:"web-approve"});return(0,i.revalidatePath)("/exceptions"),{ok:!0,grantIdPrefix:a.id.slice(0,8)}}catch(a){if(a instanceof g.qA)return{ok:!1,error:"An active exception for this value already exists — revoke it first."};return{ok:!1,error:"Could not create the reveal grant."}}}async function v(a,b){let c,d=(0,h.K7s)(h.eYL,{id:a,reason:b});if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,f=e.reason.trim();try{c=await (0,j.db)().exceptions.revoke(e.id,p(),""===f?void 0:f)}catch{return{ok:!1,error:l}}return c?((0,i.revalidatePath)("/exceptions"),(0,i.revalidatePath)(`/exceptions/${e.id}`),{ok:!0}):{ok:!1,error:"No active exception with that id."}}async function w(a){let b,c=(0,h.K7s)(h.JJC,{confirmation:a});if(!c.ok)return{ok:!1,error:m(c)};if("rotate"!==c.data.confirmation)return{ok:!1,error:'Type "rotate" to confirm.'};try{b=(0,g.v5)((0,g.KS)())}catch(a){return{ok:!1,error:`Could not rotate the fingerprint key. ${o(a)}`}}try{let a=new g.Pi({repo:(0,j.db)().secretVault,keys:(0,g.Ru)((0,g.xR)().vaultKeyCustody,(0,g.Wo)()),isConsented:()=>(0,h.hds)((0,g.xR)().vaultConsent)});await a.refreshFingerprints(b)}catch{}return(0,i.revalidatePath)("/exceptions"),{ok:!0}}(0,k.D)([s,t,u,v,w]),(0,d.A)(s,"40d4bc1d933350f66d83c89da8657f7ab361bfa2c6",null),(0,d.A)(t,"40b9617c4c1ac3a610e3a9c7894bdcb19cf83429c3",null),(0,d.A)(u,"40b40cc75f196291956b539de6bca1e3dcb07706cf",null),(0,d.A)(v,"609e55a02b44921e454b92586246d2f995ffdfe2c2",null),(0,d.A)(w,"4055455a6151d4eef7e7478839997eca734ec32956",null)},55474:(a,b,c)=>{c.d(b,{db:()=>f});var d=c(43586);let e=globalThis;function f(){if(e.__akaDb)return e.__akaDb;let a=(0,d.Ji)((0,d.KS)());return a.purgeSampleData(),e.__akaDb=a,a}}};

package/web-ui/web-ui/.next/server/chunks/51.js

@@ -0,0 +1 @@
+"use strict";exports.id=51,exports.ids=[51],exports.modules={39051:(a,b,c)=>{c.d(b,{Nc:()=>n,mu:()=>Z,r4:()=>a8,uT:()=>a3,Pb:()=>S,W$:()=>aa,$1:()=>N,DK:()=>_,sE:()=>a0,E$:()=>a_,Ip:()=>aD,SQ:()=>aZ,KD:()=>a2});let d=[{id:"stripe",name:"Stripe",category:"Payments",hostSuffixes:["stripe.com"],apiBase:"https://api.stripe.com",defaultDataClasses:["pii","customer"],sdks:{npm:["stripe"],pypi:["stripe"],go:["github.com/stripe/stripe-go"],maven:["com.stripe"],rubygems:["stripe"],composer:["stripe/stripe-php"],nuget:["Stripe.net"]}},{id:"datadog",name:"Datadog",category:"Observability",hostSuffixes:["datadoghq.com","datadoghq.eu"],apiBase:"https://api.datadoghq.com",defaultDataClasses:["telemetry","logs","metrics"],sdks:{npm:["dd-trace","@datadog/browser-logs"],pypi:["datadog","ddtrace"],go:["github.com/DataDog/dd-trace-go"],maven:["com.datadoghq"],rubygems:["ddtrace","dogapi"],nuget:["Datadog.Trace"]}},{id:"newrelic",name:"New Relic",category:"Observability",hostSuffixes:["newrelic.com","nr-data.net"],apiBase:"https://api.newrelic.com",defaultDataClasses:["telemetry","logs","metrics"],sdks:{npm:["newrelic"],pypi:["newrelic"],go:["github.com/newrelic/go-agent"],maven:["com.newrelic.agent.java"],rubygems:["newrelic_rpm"],nuget:["NewRelic.Agent"]}},{id:"sentry",name:"Sentry",category:"Error tracking",hostSuffixes:["sentry.io"],apiBase:"https://sentry.io",defaultDataClasses:["source","telemetry"],sdks:{npm:["@sentry/node","@sentry/react","@sentry/nextjs"],pypi:["sentry-sdk"],go:["github.com/getsentry/sentry-go"],maven:["io.sentry"],rubygems:["sentry-ruby"],cargo:["sentry"],composer:["sentry/sentry"],nuget:["Sentry"]}},{id:"openai",name:"OpenAI",category:"LLM provider",hostSuffixes:["openai.com"],apiBase:"https://api.openai.com",defaultDataClasses:["pii","source"],sdks:{npm:["openai"],pypi:["openai"],go:["github.com/sashabaranov/go-openai"],maven:["com.openai"],rubygems:["ruby-openai"],cargo:["async-openai"],composer:["openai-php/client"],nuget:["OpenAI"]}},{id:"anthropic",name:"Anthropic",category:"LLM provider",hostSuffixes:["anthropic.com"],apiBase:"https://api.anthropic.com",defaultDataClasses:["pii","source"],sdks:{npm:["@anthropic-ai/sdk"],pypi:["anthropic"],go:["github.com/anthropics/anthropic-sdk-go"],nuget:["Anthropic.SDK"]}},{id:"aws",name:"Amazon Web Services",category:"Cloud platform",hostSuffixes:["amazonaws.com"],apiBase:"https://s3.amazonaws.com",defaultDataClasses:["secrets","customer"],sdks:{npm:["@aws-sdk/client-s3","aws-sdk"],pypi:["boto3"],go:["github.com/aws/aws-sdk-go","github.com/aws/aws-sdk-go-v2"],maven:["com.amazonaws","software.amazon.awssdk"],rubygems:["aws-sdk-s3"],cargo:["aws-sdk-s3"],nuget:["AWSSDK.S3"]}},{id:"gcp",name:"Google Cloud",category:"Cloud platform",hostSuffixes:["googleapis.com"],apiBase:"https://storage.googleapis.com",defaultDataClasses:["customer","logs"],sdks:{npm:["@google-cloud/storage"],pypi:["google-cloud-storage"],go:["cloud.google.com/go"],maven:["com.google.cloud"],rubygems:["google-cloud-storage"],nuget:["Google.Cloud.Storage.V1"]}},{id:"google-fonts",name:"Google Fonts",category:"CDN / edge",hostSuffixes:["fonts.googleapis.com","fonts.gstatic.com"],apiBase:"https://fonts.googleapis.com",defaultDataClasses:["none"],sdks:{}},{id:"azure",name:"Microsoft Azure",category:"Cloud platform",hostSuffixes:["azure.com","windows.net"],apiBase:"https://management.azure.com",defaultDataClasses:["customer","logs"],sdks:{npm:["@azure/storage-blob"],pypi:["azure-storage-blob"],go:["github.com/Azure/azure-sdk-for-go"],maven:["com.azure"],rubygems:["azure-storage-blob"],nuget:["Azure.Storage.Blobs"]}},{id:"slack",name:"Slack",category:"Notifications",hostSuffixes:["slack.com"],apiBase:"https://slack.com/api",defaultDataClasses:["logs"],sdks:{npm:["@slack/web-api"],pypi:["slack-sdk"],go:["github.com/slack-go/slack"],maven:["com.slack.api"],rubygems:["slack-ruby-client"],composer:["slack-php/slack-api"],nuget:["SlackNet"]}},{id:"segment",name:"Segment",category:"Analytics",hostSuffixes:["segment.io","segment.com"],apiBase:"https://api.segment.io",defaultDataClasses:["customer"],sdks:{npm:["@segment/analytics-node","analytics-node"],pypi:["segment-analytics-python"],go:["github.com/segmentio/analytics-go"],maven:["com.segment.analytics.java"],rubygems:["analytics-ruby"],nuget:["Analytics"]}},{id:"twilio",name:"Twilio",category:"Communications",hostSuffixes:["twilio.com"],apiBase:"https://api.twilio.com",defaultDataClasses:["pii","customer"],sdks:{npm:["twilio"],pypi:["twilio"],go:["github.com/twilio/twilio-go"],maven:["com.twilio.sdk"],rubygems:["twilio-ruby"],composer:["twilio/sdk"],nuget:["Twilio"]}},{id:"sendgrid",name:"SendGrid",category:"Email",hostSuffixes:["sendgrid.com"],apiBase:"https://api.sendgrid.com",defaultDataClasses:["pii"],sdks:{npm:["@sendgrid/mail"],pypi:["sendgrid"],go:["github.com/sendgrid/sendgrid-go"],maven:["com.sendgrid"],rubygems:["sendgrid-ruby"],composer:["sendgrid/sendgrid"],nuget:["SendGrid"]}},{id:"mailgun",name:"Mailgun",category:"Email",hostSuffixes:["mailgun.net"],apiBase:"https://api.mailgun.net",defaultDataClasses:["pii"],sdks:{npm:["mailgun.js"],pypi:["mailgun"],rubygems:["mailgun-ruby"],composer:["mailgun/mailgun-php"],nuget:["Mailgun"]}},{id:"mixpanel",name:"Mixpanel",category:"Analytics",hostSuffixes:["mixpanel.com"],apiBase:"https://api.mixpanel.com",defaultDataClasses:["customer","telemetry"],sdks:{npm:["mixpanel"],pypi:["mixpanel"],rubygems:["mixpanel-ruby"],nuget:["Mixpanel"]}},{id:"amplitude",name:"Amplitude",category:"Analytics",hostSuffixes:["amplitude.com"],apiBase:"https://api2.amplitude.com",defaultDataClasses:["customer","telemetry"],sdks:{npm:["@amplitude/analytics-node"],pypi:["amplitude-analytics"],nuget:["Amplitude"]}},{id:"posthog",name:"PostHog",category:"Analytics",hostSuffixes:["posthog.com"],apiBase:"https://us.i.posthog.com",defaultDataClasses:["customer","telemetry"],sdks:{npm:["posthog-node","posthog-js"],pypi:["posthog"],go:["github.com/posthog/posthog-go"],rubygems:["posthog-ruby"],composer:["posthog/posthog-php"],nuget:["PostHog"]}},{id:"honeycomb",name:"Honeycomb",category:"Observability",hostSuffixes:["honeycomb.io"],apiBase:"https://api.honeycomb.io",defaultDataClasses:["telemetry","metrics"],sdks:{npm:["libhoney"],pypi:["libhoney"],go:["github.com/honeycombio/libhoney-go"],rubygems:["libhoney"]}},{id:"grafana",name:"Grafana Cloud",category:"Observability",hostSuffixes:["grafana.net"],apiBase:"https://grafana.net",defaultDataClasses:["logs","metrics"],sdks:{npm:["@grafana/faro-web-sdk"]}},{id:"splunk",name:"Splunk",category:"Observability",hostSuffixes:["splunkcloud.com","splunk.com"],apiBase:"https://http-inputs.splunkcloud.com",defaultDataClasses:["logs"],sdks:{npm:["splunk-logging"],pypi:["splunk-sdk"],maven:["com.splunk"],nuget:["Splunk.Logging.Common"]}},{id:"pagerduty",name:"PagerDuty",category:"Incident response",hostSuffixes:["pagerduty.com"],apiBase:"https://api.pagerduty.com",defaultDataClasses:["logs"],sdks:{npm:["@pagerduty/pdjs"],pypi:["pdpyras"],go:["github.com/PagerDuty/go-pagerduty"],rubygems:["pagerduty"]}},{id:"github",name:"GitHub",category:"Developer platform",hostSuffixes:["github.com","githubusercontent.com"],apiBase:"https://api.github.com",defaultDataClasses:["source"],sdks:{npm:["@octokit/rest","octokit"],pypi:["pygithub"],go:["github.com/google/go-github"],maven:["org.kohsuke.github-api"],rubygems:["octokit"],cargo:["octocrab"],composer:["knplabs/github-api"],nuget:["Octokit"]}},{id:"gitlab",name:"GitLab",category:"Developer platform",hostSuffixes:["gitlab.com"],apiBase:"https://gitlab.com/api",defaultDataClasses:["source"],sdks:{npm:["@gitbeaker/rest"],pypi:["python-gitlab"],go:["gitlab.com/gitlab-org/api/client-go"],rubygems:["gitlab"],nuget:["GitLabApiClient"]}},{id:"auth0",name:"Auth0",category:"Identity",hostSuffixes:["auth0.com"],apiBase:"https://login.auth0.com",defaultDataClasses:["pii"],sdks:{npm:["auth0"],pypi:["auth0-python"],go:["github.com/auth0/go-auth0"],maven:["com.auth0"],rubygems:["auth0"],composer:["auth0/auth0-php"],nuget:["Auth0.ManagementApi"]}},{id:"okta",name:"Okta",category:"Identity",hostSuffixes:["okta.com","oktapreview.com"],apiBase:"https://login.okta.com",defaultDataClasses:["pii"],sdks:{npm:["@okta/okta-sdk-nodejs"],pypi:["okta"],go:["github.com/okta/okta-sdk-golang"],maven:["com.okta.sdk"],nuget:["Okta.Sdk"]}},{id:"clerk",name:"Clerk",category:"Identity",hostSuffixes:["clerk.com","clerk.dev"],apiBase:"https://api.clerk.com",defaultDataClasses:["pii"],sdks:{npm:["@clerk/backend","@clerk/nextjs"],pypi:["clerk-backend-api"],go:["github.com/clerk/clerk-sdk-go"]}},{id:"supabase",name:"Supabase",category:"Backend platform",hostSuffixes:["supabase.co","supabase.com"],apiBase:"https://api.supabase.com",defaultDataClasses:["pii","customer"],sdks:{npm:["@supabase/supabase-js"],pypi:["supabase"],cargo:["postgrest"]}},{id:"firebase",name:"Firebase",category:"Backend platform",hostSuffixes:["firebaseio.com","firebase.google.com"],apiBase:"https://firebaseio.com",defaultDataClasses:["customer"],sdks:{npm:["firebase","firebase-admin"],pypi:["firebase-admin"],go:["firebase.google.com/go"],maven:["com.google.firebase"]}},{id:"mongodb-atlas",name:"MongoDB Atlas",category:"Database SaaS",hostSuffixes:["mongodb.net","mongodb.com"],apiBase:"https://cloud.mongodb.com",defaultDataClasses:["customer"],sdks:{npm:["mongodb"],pypi:["pymongo"],go:["go.mongodb.org/mongo-driver"],maven:["org.mongodb"],rubygems:["mongo"],cargo:["mongodb"],nuget:["MongoDB.Driver"]}},{id:"planetscale",name:"PlanetScale",category:"Database SaaS",hostSuffixes:["psdb.cloud","planetscale.com"],apiBase:"https://api.planetscale.com",defaultDataClasses:["customer"],sdks:{npm:["@planetscale/database"],go:["github.com/planetscale/planetscale-go"]}},{id:"algolia",name:"Algolia",category:"Search SaaS",hostSuffixes:["algolia.net","algolianet.com"],apiBase:"https://algolia.net",defaultDataClasses:["customer"],sdks:{npm:["algoliasearch"],pypi:["algoliasearch"],go:["github.com/algolia/algoliasearch-client-go"],maven:["com.algolia"],rubygems:["algolia"],composer:["algolia/algoliasearch-client-php"],nuget:["Algolia.Search"]}},{id:"cloudflare",name:"Cloudflare",category:"CDN / edge",hostSuffixes:["cloudflare.com","workers.dev"],apiBase:"https://api.cloudflare.com",defaultDataClasses:["logs"],sdks:{npm:["cloudflare"],pypi:["cloudflare"],go:["github.com/cloudflare/cloudflare-go"],nuget:["CloudFlare.Client"]}},{id:"huggingface",name:"Hugging Face",category:"LLM provider",hostSuffixes:["huggingface.co"],apiBase:"https://api-inference.huggingface.co",defaultDataClasses:["source"],sdks:{npm:["@huggingface/inference"],pypi:["huggingface-hub","transformers"],rubygems:["hugging-face"]}},{id:"cohere",name:"Cohere",category:"LLM provider",hostSuffixes:["cohere.com","cohere.ai"],apiBase:"https://api.cohere.com",defaultDataClasses:["pii","source"],sdks:{npm:["cohere-ai"],pypi:["cohere"],go:["github.com/cohere-ai/cohere-go"]}},{id:"mistral",name:"Mistral AI",category:"LLM provider",hostSuffixes:["mistral.ai"],apiBase:"https://api.mistral.ai",defaultDataClasses:["pii","source"],sdks:{npm:["@mistralai/mistralai"],pypi:["mistralai"],go:["github.com/gage-technologies/mistral-go"]}}],e=["internal","local","corp","lan","intranet","home.arpa"],f=["localhost","test","example","invalid","example.com","example.org","example.net","w3.org","schemas.openxmlformats.org","schemas.microsoft.com","schemas.android.com","maven.apache.org"];function g(a,b){return a===b||a.endsWith(`.${b}`)}function h(a){let b=a.split(".");return 4===b.length&&b.every(a=>/^\d{1,3}$/.test(a)&&255>=Number(a))}function i(a){let b=a.split(".").map(Number),c=b[0],d=b[1];return void 0!==c&&void 0!==d&&(0===c||10===c||127===c||c>=224||169===c&&254===d||172===c&&d>=16&&d<=31||192===c&&168===d||!1)}function j(a){let b=a.startsWith("[")&&a.endsWith("]")?a.slice(1,-1):a,c=b.indexOf("%");return(-1===c?b:b.slice(0,c)).toLowerCase()}let k=/^[0-9a-f]{1,4}$/,l=/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/;function m(a){return a.toLowerCase().replace(/[-_.]+/g,"-")}let n=new Set([".ts",".tsx",".js",".jsx",".mjs",".cjs",".py",".java",".rb",".cs",".php",".go",".rs"]),o=/\s/,p="••••",q=/(https?|wss?|sftp|grpcs?|smtp):\/\/(?:[^\s'"`<>()[\]{},;]|\$\{[^}\s]{1,64}\}|\{[A-Za-z_]\w{0,63}\}|%[sd])+/gi,r=/\$\{[^}\s]{1,64}\}|\{[A-Za-z_]\w{0,63}\}|%[sd]/g,s="${var}",t="akaegressvar0",u={http:"http",https:"https",ws:"ws",wss:"wss",sftp:"sftp",grpc:"grpc",grpcs:"grpc",smtp:"smtp"},v=/\.\s*(get|post|put|delete)\s*\(\s*['"`]*$/i,w=/["'](GET|POST|PUT|DELETE)["']\s*,([^)\]};]{0,150})$/i,x=/method\s*[:=]\s*['"](GET|POST|PUT|DELETE)/i,y=/\b(fetch|urlopen|got|ky)\s*\(\s*['"`]*$/i,z=/\bmethod\s*[:=]/i,A=/;|\n\s*(?:(?:const|let|var|val|function|func|fn|def|class|return|export|import|if|for|while|switch|try|public|private)\b|\w+\s*=[^=])/,B=/\b(?:\d{1,3}\.){3}\d{1,3}(?::\d{1,5})?\b/g,C=/\b(host|hostname|server|address|endpoint|ip|url|uri)\b/i,D=/\bs(ftp|cp|sh)\b/i,E=/\b(smtp|mail)\b/i,F="api[_-]?key|apikey|private[_-]?key|access[_-]?key|access[_-]?token|token|secret|credentials?|password|passwd|pwd|authorization|sig|signature|sas|assertion",G="Bearer|Basic|Token|Digest|ApiKey|SSWS|AWS4-HMAC-SHA256",H=RegExp(`((?:${F})['"\`]?\\s*[:=]\\s*['"\`]?)(?!(?:${G})[\\s'"\`])[^\\s'"\`&]+`,"gi"),I=RegExp(`((?:${F})['"\`]?\\s*[:=]\\s*['"\`]?)(${G})\\s+[^\\s'"\`]+`,"gi"),J=[{hosts:["hooks.slack.com"],prefix:"/services/"},{hosts:["discord.com","discordapp.com","ptb.discord.com","canary.discord.com"],prefix:"/api/webhooks/"},{hosts:["hooks.zapier.com"],prefix:"/hooks/"},{hosts:["outlook.office.com","outlook.office365.com"],prefix:"/webhook/"}];function K(a){return a.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}let L=RegExp(`(https?://(?:${J.flatMap(a=>a.hosts.map(b=>`${K(b)}${K(a.prefix)}`)).join("|")}))[^\\s'"\`<>()[\\]{},;]+`,"gi"),M=/(^|\/)(vendor|third_party|external)\//;function N(a){return M.test(a)}let O=[{pattern:/:\/\/[^@/\s]+@/g,replace:()=>"://"},{pattern:L,replace:a=>`${a[1]??""}${p}`},{pattern:H,replace:a=>`${a[1]??""}${p}`},{pattern:I,replace:a=>`${a[1]??""}${a[2]??""} ${p}`},{pattern:/\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi,replace:()=>`Bearer ${p}`}];function P(a){let b=a.trim(),c=[],d=b;for(let a of O){let b=function(a,b){let c=[],d=[],e=[],f=[],g="",h=0,i=0;for(let j of a.matchAll(b.pattern)){let k=j.index,l=j[0],m=b.replace(j);g+=a.slice(h,k)+m,c.push(k),d.push(k+l.length),e.push(i),i+=m.length-l.length,f.push(i),h=k+l.length}return 0===c.length?{output:a,edits:{at:c,end:d,before:e,after:f}}:{output:g+a.slice(h),edits:{at:c,end:d,before:e,after:f}}}(d,a);d=b.output,c.push(b.edits)}return d.length<=200?{redacted:d}:{redacted:d,window:{trimmed:b,edits:c,lead:a.length-a.trimStart().length}}}function Q({redacted:a,window:b},c){if(void 0===b)return a;let{trimmed:d,edits:e,lead:f}=b,g=Math.max(0,c-f);if(a.length!==d.length){for(;g>0&&o.test(d.charAt(g-1));)g-=1;for(let a of e)g=function(a,b){let c=0,d=a.at.length-1,e=-1;for(;c<=d;){let f=c+d>>1;(a.at[f]??0)<=b?(e=f,c=f+1):d=f-1}return -1===e?b:b<(a.end[e]??0)?(a.at[e]??0)+(a.before[e]??0):b+(a.after[e]??0)}(a,g)}let h=Math.min(Math.max(0,g-Math.floor(100)),a.length-200);return a.slice(h,h+200)}function R(a,b=0){return Q(P(a),b)}function S(a){let b=V(a),c=[],d=[],e=U(c=>X(a,b,c)),f=U(a=>(function(a){let b=a.replace(/[_-]+/g," ").replace(/([a-z0-9])([A-Z])/g,"$1 $2"),c="http";return D.test(b)?c="sftp":E.test(b)&&(c="smtp"),{named:C.test(b),transport:c}})(e(a))),g=U(a=>P(e(a))),j=(a,c)=>Q(g(a),c-(b[a]??0));for(let e of a.matchAll(q)){let f=e.index,g=e[0];c.push([f,f+g.length]);let h=e[1];if(void 0===h)continue;let i=function(a){let b=a.length;for(;b>0&&".,;:'\"".includes(a.charAt(b-1));)b-=1;return b===a.length?a:a.slice(0,b)}(g);if(""===i)continue;let k=function(a,b){let c,d=u[b.toLowerCase()];if(void 0===d)return null;let e=0,f=a.replace(r,()=>(e+=1,s));try{c=new URL(f.split(s).join(t))}catch{return null}let g=c.hostname.toLowerCase();if(""===g||g.includes(t))return null;let h=c.host.toLowerCase(),i=function(a,b){for(let c of J)if(c.hosts.includes(a)&&b.startsWith(c.prefix))return`${c.prefix}${p}`;return b}(g,c.pathname);return{url:`${d}://${h}${i}`.split(t).join(s),host:g,port:""===c.port?null:Number(c.port),transport:d,template:e>0}}(i,h);if(null===k)continue;let l=W(b,f);d.push({...k,method:function(a,b,c){let d=a.slice(Math.max(0,b-200),b),e=a.slice(c,c+300),f=v.exec(d);if(f?.[1]!==void 0)return T(f[1]);let g=w.exec(d);if(g?.[1]!==void 0&&!A.test(g[2]??""))return T(g[1]);let h=x.exec(e);if(h?.[1]!==void 0&&!A.test(e.slice(0,h.index)))return T(h[1]);if(y.test(d)){let a=function(a){let b=1;for(let c=0;c<a.length;c+=1){let d=a[c];if("("===d)b+=1;else if(")"===d&&0==(b-=1))return c+1}return -1}(e);if(-1!==a&&function(a,b){let c=a.slice(0,b-1).trimEnd();return!(c.endsWith(",")?c.slice(0,-1):c).includes(",")}(e,a)&&!z.test(e.slice(0,a)))return"GET"}return"REF"}(a,f,f+g.length),line:l+1,snippet:j(l,f)})}for(let e of a.matchAll(B)){let a=e.index;if(function(a,b){let c=0,d=a.length-1,e=-1;for(;c<=d;){let f=Math.floor((c+d)/2),g=a[f];if(void 0===g)break;g[0]<=b?(e=f,c=f+1):d=f-1}let f=-1===e?void 0:a[e];return void 0!==f&&b<f[1]}(c,a))continue;let g=W(b,a),k=function(a,b){let[c,d]=function(a){let b=a.indexOf(":");return -1===b?[a,null]:[a.slice(0,b),Number(a.slice(b+1))]}(a);if(!h(c)||i(c)||!b.named)return null;let{transport:e}=b;return{url:`${e}://${c}${null===d?"":`:${String(d)}`}`,host:c,port:d,transport:e,template:!1}}(e[0],f(g));null!==k&&d.push({...k,method:"REF",line:g+1,snippet:j(g,a)})}return d.sort(Y)}function T(a){return a.toUpperCase()}function U(a){let b=new Map;return c=>{let d=b.get(c);if(void 0!==d)return d;let e=a(c);return b.set(c,e),e}}function V(a){let b=[0];for(let c=0;c<a.length;c+=1)"\n"===a[c]&&b.push(c+1);return b}function W(a,b){let c=0,d=a.length-1;for(;c<d;){let e=Math.ceil((c+d)/2);(a[e]??0)<=b?c=e:d=e-1}return c}function X(a,b,c){let d=b[c]??0,e=b[c+1];return void 0===e?a.slice(d):a.slice(d,e-1)}function Y(a,b){return a.line!==b.line?a.line-b.line:a.url!==b.url?a.url<b.url?-1:1:0}let Z=new Set(["package-lock.json","yarn.lock","pnpm-lock.yaml","Cargo.lock","composer.lock","Gemfile.lock","poetry.lock","go.sum","packages.lock.json"]),$={"package.json":"package.json","requirements.txt":"requirements.txt","pyproject.toml":"pyproject.toml","go.mod":"go.mod","pom.xml":"pom.xml","build.gradle":"build.gradle","build.gradle.kts":"build.gradle",Gemfile:"Gemfile","Cargo.toml":"Cargo.toml","composer.json":"composer.json","packages.config":"packages.config"};function _(a){if(Z.has(a))return null;let b=Object.hasOwn($,a)?$[a]:void 0;return void 0!==b?b:a.endsWith(".csproj")?"csproj":null}function aa(a,b){switch(b){case"package.json":return function(a){let b=aw(a);if(null===b)return[];let c=new Set,d=[],e=ay(a),f=aA(a),g=az(a,"dependencies"),h=az(a,"optionalDependencies");for(let h of ax(b.dependencies))c.add(h),d.push(aB("npm",h,a,g,e,f));for(let g of ax(b.optionalDependencies))c.has(g)||(c.add(g),d.push(aB("npm",g,a,h,e,f)));return d}(a);case"requirements.txt":var c=a;let d=[];return av(c,(a,b,c)=>{let e=ac.exec(a),f=e?.[1];void 0!==f&&d.push(ab("pypi",m(f),b,c()))}),d;case"pyproject.toml":var e=a;let f=[],g="",h=!1;return av(e,(a,b,c)=>{let d=ad.exec(a);if(d){g=d[1]?.trim()??"",h=!1;return}if(!h&&/^\s*dependencies\s*=\s*\[/.test(a)&&(h=!0),h){for(let d of[...a.matchAll(ae)].map(a=>a[1]??a[2]??"")){let a=af.exec(d)?.[1];void 0!==a&&f.push(ab("pypi",m(a),b,c()))}a.includes("]")&&(h=!1);return}if("tool.poetry.dependencies"===g){let d=ag.exec(a)?.[1];void 0!==d&&"python"!==d&&f.push(ab("pypi",m(d),b,c()))}}),f;case"go.mod":var i=a;let j=[],k=null;return av(i,(a,b,c)=>{if(null===k){let d=ah.exec(a)?.[1];if(void 0!==d){k=d;return}let e=aj.exec(a)?.[1];void 0!==e&&j.push(ab("go",e,b,c()));return}if(ai.test(a)){k=null;return}if("require"===k){let d=ak.exec(a)?.[1];void 0!==d&&j.push(ab("go",d,b,c()))}}),j;case"pom.xml":var l=a;let n=[],o=[],p=!1;return av(l,(a,b,c)=>{let d=au(a,p);p=d.inComment;let e=d.visible;for(let a of e.matchAll(am)){let d=a[2];if(void 0===d)continue;let g="/"===a[1],h=(a[3]??"").trimEnd().endsWith("/");if(g){al.has(d)&&o[o.length-1]===d&&o.pop();continue}if(!h){if("groupId"===d){var f;let d=e.slice(a.index+a[0].length),g=an.exec(d)?.[1]?.trim()??"";""===g||"dependency"!==(f=o)[f.length-1]||"dependencies"!==f[f.length-2]||f.includes("dependencyManagement")||f.includes("parent")||f.includes("build")||n.push(ab("maven",g,b,c()));continue}al.has(d)&&o.push(d)}}}),n;case"build.gradle":var q=a;let r=[];return av(q,(a,b,c)=>{if(!ap.test(a))for(let d of a.matchAll(ao)){let a=d[1];void 0!==a&&r.push(ab("maven",a,b,c()))}}),r;case"Gemfile":var s=a;let t=[];return av(s,(a,b,c)=>{let d=aq.exec(a)?.[1];void 0!==d&&t.push(ab("rubygems",d,b,c()))}),t;case"Cargo.toml":var u=a;let v=[],w="none";return av(u,(a,b,c)=>{let d=ad.exec(a);if(d){let a=d[1]?.trim()??"";if("dependencies"===a)w="plain";else if(a.startsWith("dependencies.")){w="dotted";let d=a.slice(13);""!==d&&v.push(ab("cargo",d,b,c()))}else w="none";return}if("plain"===w){let d=ar.exec(a)?.[1];void 0!==d&&v.push(ab("cargo",d,b,c()))}}),v;case"composer.json":return function(a){let b=aw(a);if(null===b)return[];let c=ax(b.require).filter(a=>"php"!==a&&!a.startsWith("ext-")),d=ay(a),e=aA(a),f=az(a,"require");return c.map(b=>aB("composer",b,a,f,d,e))}(a);case"csproj":var x=a;let y=[],z=!1;return av(x,(a,b,c)=>{let d=au(a,z);z=d.inComment;let e=as.exec(d.visible)?.[1];void 0!==e&&y.push(ab("nuget",e,b,c()))}),y;case"packages.config":var A=a;let B=[],C=!1;return av(A,(a,b,c)=>{let d=au(a,C);C=d.inComment;let e=at.exec(d.visible)?.[1];void 0!==e&&B.push(ab("nuget",e,b,c()))}),B;default:return[]}}function ab(a,b,c,d){return{ecosystem:a,pkg:b,line:c,snippet:d}}let ac=/^\s*([A-Za-z0-9][\w.-]*)/,ad=/^\s*\[([^\]]+)\]\s*$/,ae=/"([^"]*)"|'([^']*)'/g,af=/^([A-Za-z0-9][\w.-]*)/,ag=/^\s*([A-Za-z0-9][\w.-]*)\s*=/,ah=/^\s*(require|exclude|replace|retract)\s*\(/,ai=/^\s*\)/,aj=/^\s*require\s+([\w./-]+)\s+v\d/,ak=/^\s*([\w./-]+)\s+v\d/,al=new Set(["project","parent","dependencyManagement","dependencies","dependency","build","plugins","plugin","exclusions","exclusion"]),am=/<(\/?)([A-Za-z][\w.-]*)((?:[^<>\w.-][^<>]*)?)>/g,an=/^([^<]*)/,ao=/\b(?:implementation|api|compile)\b\s*[('"]*(?:platform\s*\(\s*['"])?([\w.-]+):[\w.-]+/g,ap=/^\s*\/\//,aq=/^\s*gem\s+['"]([\w-]+)['"]/,ar=/^([A-Za-z0-9_-]+)\s*=/,as=/<PackageReference\s+Include="([^"]+)"/,at=/<package\s+id="([^"]+)"/;function au(a,b){let c="",d=a,e=b;for(;;){if(e){let a=d.indexOf("--\x3e");if(-1===a)return{visible:c,inComment:!0};d=d.slice(a+3),e=!1;continue}let a=d.indexOf("\x3c!--");if(-1===a)return{visible:c+d,inComment:!1};c+=d.slice(0,a),d=d.slice(a+4),e=!0}}function av(a,b){let c=a.split("\n");for(let a=0;a<c.length;a+=1){let d,e=c[a]??"";b(e,a+1,()=>d??=R(e))}}function aw(a){let b;try{b=JSON.parse(a)}catch{return null}if("object"!=typeof b||null===b)return null;let c=b;return{dependencies:c.dependencies,optionalDependencies:c.optionalDependencies,require:c.require}}function ax(a){return"object"!=typeof a||null===a?[]:Object.keys(a)}function ay(a){let b=V(a),c=new Map;return{numberAt:a=>W(b,a)+1,snippetAt:d=>{let e=W(b,d),f=c.get(e);if(void 0!==f)return f;let g=R(X(a,b,e));return c.set(e,g),g}}}function az(a,b){let c=a.indexOf(`"${b}"`);return -1===c?0:c}function aA(a){let b=new Map;for(let c=0;c<a.length;c+=1){if(34!==a.charCodeAt(c))continue;let d=c+1;for(;d<a.length&&34!==a.charCodeAt(d);)d+=92===a.charCodeAt(d)?2:1;if(d>=a.length)break;let e=a.slice(c+1,d),f=e.includes("\\")?function(a){try{return JSON.parse(a)}catch{return}}(a.slice(c,d+1)):e;if(void 0!==f){let a=b.get(f);void 0===a?b.set(f,[c]):a.push(c)}c=d}return b}function aB(a,b,c,d,e,f){let g=f.get(b),h=(void 0===g?void 0:function(a,b){let c,d=0,e=a.length-1;for(;d<=e;){let f=d+e>>1,g=a[f]??0;g>=b?(c=g,e=f-1):d=f+1}return c}(g,d))??c.indexOf(`"${b}"`,d);return -1===h?ab(a,b,1,R(b)):{ecosystem:a,pkg:b,line:e.numberAt(h),snippet:e.snippetAt(h)}}let aC=new Set(["GET","POST","PUT","DELETE"]);function aD(a,b){let c=[];for(let n of a){for(let a of n.endpoints){let m=function(a,b,c){let m=function(a,b){let c=a.toLowerCase();if(h(c))return i(c)?null:{kind:"ip",trust:"ip",name:c,category:"Unresolved host",providerId:null,entry:null};if(function(a){let b=j(a);if(!b.includes(":"))return!1;let c=b.split("::");if(c.length>2)return!1;let d=(2===c.length?c:[b]).flatMap(a=>""===a?[]:a.split(":"));return!!d.every(a=>k.test(a))&&(2===c.length?d.length<=7:8===d.length)}(c))return!function(a){let b=j(a);if("::"===b||"::1"===b)return!0;let c=(b.split(":")[0]??"").padStart(4,"0");return!!(c.startsWith("fc")||c.startsWith("fd")||c.startsWith("fe")&&"89ab".includes(c[2]??"")||c.startsWith("ff"))}(c)?{kind:"ip",trust:"ip",name:c,category:"Unresolved host",providerId:null,entry:null}:null;let m=function(a){let b=l.exec(j(a));return b?.[1]??null}(c);if(null!==m&&h(m))return i(m)?null:{kind:"ip",trust:"ip",name:c,category:"Unresolved host",providerId:null,entry:null};if(f.some(a=>g(c,a)))return null;let n=function(a,b){let c=null,d=-1;for(let e of b)for(let b of e.hostSuffixes)g(a,b)&&b.length>d&&(c=e,d=b.length);return c}(c,d);if(n)return{kind:"provider",trust:"recognized",name:n.name,category:n.category,providerId:n.id,entry:n};let o=b?.internalDomains??[];return!c.includes(".")&&!c.includes(":")||e.some(a=>g(c,a))||o.some(a=>g(c,a.toLowerCase()))?{kind:"internal",trust:"internal",name:c,category:"Internal services",providerId:null,entry:null}:{kind:"external",trust:"unverified",name:c,category:"External domain",providerId:null,entry:null}}(b.host,c);if(null===m)return null;let n="provider"===m.kind;return{host:b.host,kind:m.kind,name:m.name,category:m.category,providerId:m.providerId,trust:m.trust,network:n?null:{port:b.port,geo:null,ptr:null},method:b.method,transport:b.transport,url:b.url,template:b.template,dataClass:n?m.entry?.defaultDataClasses[0]??"none":"none",site:{file:a.file,line:b.line,snippet:b.snippet,dynamic:b.template,vendored:a.vendored}}}(n,a,b);null!==m&&c.push(m)}for(let a of n.sdkHits){let b=function(a,b){let c=function(a,b){for(let c of d){let d=c.sdks[a];if(void 0!==d&&d.some(c=>(function(a,b,c){switch(a){case"nuget":return b.toLowerCase()===c.toLowerCase();case"pypi":return m(b)===m(c);case"go":return b===c||b.startsWith(`${c}/`);case"maven":return b===c||b.startsWith(`${c}.`);default:return b===c}})(a,b,c)))return c}return null}(b.ecosystem,b.pkg);return null===c?null:{host:new URL(c.apiBase).hostname,kind:"provider",name:c.name,category:c.category,providerId:c.id,trust:"recognized",network:null,method:"SDK",transport:"https",url:c.apiBase,template:!1,dataClass:c.defaultDataClasses[0]??"none",site:{file:a.file,line:b.line,snippet:b.snippet,dynamic:!1,vendored:a.vendored}}}(n,a);null!==b&&c.push(b)}}var n=function(a){let b=new Set,c=[];for(let e of a){var d;let a=JSON.stringify([(d=e).host,d.method,d.url,d.site.file,d.site.line]);b.has(a)||(b.add(a),c.push(e))}return c}(c);let o=new Set;for(let a of n)aC.has(a.method)&&o.add(aE(a));return n.filter(a=>"REF"!==a.method||!o.has(aE(a)))}function aE(a){return JSON.stringify([a.host,a.url])}function aF(a){return a.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}let aG=/\p{Cf}/u,aH=/\p{Cf}/gu;function aI(a,b){let c=0,d=a.length-1;for(;c<d;){let e=c+d>>1,f=a[e];void 0!==f&&b>=f.normStart+f.length?c=e+1:d=e}let e=a[c];if(void 0===e)throw Error(`normPos ${String(b)} has no covering segment`);return e}function aJ(a,b){let c=0,d=b.length;for(;c<d;){let e=c+d>>1,f=b[e];void 0!==f&&f.origStart+f.length<=a?c=e+1:d=e}let e=b[Math.min(c,b.length-1)];return void 0===e?0:e.normStart+Math.min(Math.max(0,a-e.origStart),e.length)}let aK=new WeakMap,aL=new WeakMap,aM=new WeakMap;function aN(a,b,c){let d="keyword"===a?aL:aM,e=d.get(b);if(void 0!==e){if(e.stateful)for(let a of e.entries)void 0!==a&&(a.lastIndex=0);return e.entries}let f=c();return d.set(b,{entries:f,stateful:f.some(a=>void 0!==a&&(a.global||a.sticky))}),f}class aO{match(a,b){if("keyword"!==b.matcher.type)return[];let{keywords:c,caseSensitive:d}=b.matcher,e=[];for(let f of aN("keyword",b.matcher,()=>c.map(a=>{if(0!==a.length)return new RegExp(aF(a),d?"gu":"giu")}))){let b;if(void 0!==f){if(e.length>=1e4)break;for(;null!==(b=f.exec(a))&&(e.push({start:b.index,end:b.index+b[0].length}),!(e.length>=1e4)););}}return e}}class aP{match(a,b){let c;if("regex"!==b.matcher.type)return[];let{pattern:d,flags:e,captureGroup:f}=b.matcher,g=function(a,b){let c=aK.get(a);if(void 0!==c)return c.lastIndex=0,c;let d=b();return aK.set(a,d),d}(b.matcher,()=>new RegExp(d,e.includes("d")?e:`${e}d`)),h=a.length>2e5?a.slice(0,2e5):a,i=[],j=h.length+1,k=0;for(;null!==(c=g.exec(h))&&!(++k>j);){let a=null!=f?c[f]:c[0];if(0===c[0].length&&g.lastIndex++,a&&i.length<1e4){let b=null!=f?c.indices?.[f]:void 0,d=b?b[0]:c.index;i.push({start:d,end:d+a.length})}if(!e.includes("g")||i.length>=1e4)break}return i}}let aQ=new aO,aR=new aP,aS={keyword:(a,b)=>aQ.match(a,b),regex:(a,b)=>aR.match(a,b)},aT=new Map,aU={entropy:(a,b)=>(function(a,b=3.5,c=20){return a.length>=c&&function(a){let b={};for(let c of a)b[c]=(b[c]??0)+1;let c=0;for(let d of Object.values(b)){let b=d/a.length;c-=b*Math.log2(b)}return c}(a)>=b})(a,aV(b,"threshold"),aV(b,"minLength")),luhn:a=>(function(a){let b=a.replace(/\D/g,"");if(b.length<13)return!1;let c=0,d=!0;for(let a=b.length-1;a>=0;a--){let e=parseInt(b[a]??"0",10);!d&&(e*=2)>9&&(e-=9),c+=e,d=!d}return c%10==0})(a)};function aV(a,b){let c=a?.[b];return"number"==typeof c&&Number.isFinite(c)?c:void 0}function aW(a,b,c){let d=[];for(let e of b)if(function(a,b){return!a.appliesTo||void 0===b||a.appliesTo.extensions.some(a=>a.toLowerCase()===b)}(e,c))for(let b of aS[e.matcher.type](a,e)){let c=a.slice(b.start,b.end);(function(a,b){let c=a.postValidators;if(!c||0===c.length)return!0;for(let a of c){let c="string"==typeof a?a:a.name,d="string"==typeof a?void 0:a.config;if(!aU[c](b,d))return!1}return!0})(e,c)&&d.push({rule:e,match:{ruleId:e.id,category:e.category,severity:e.severity,span:b,rawMatch:c,confidence:.9},normSpan:b})}return d}function aX(a,b,c){let d=[];for(let e of a){let f=e.rule.requiresNearby;if(!f){d.push(e.match);continue}if(!function(a,b,c,d){let e=a.rule.requiresNearby;if(!e)return!0;let f=e.windowChars,g=a.normSpan,h=g.start-f,i=g.end+f,j=e.categories,k=e.ruleIds;if(j?.length||k?.length)for(let c of b){var l,m;if(c!==a&&!(c.normSpan.end<h)&&!(c.normSpan.start>i)&&(c.match.ruleId!==a.match.ruleId&&j?.includes(c.match.category)===!0||k?.includes(c.match.ruleId)===!0)&&!(c.match.ruleId===a.match.ruleId&&(l=c.match.span,m=a.match.span,l.start<m.end&&l.end>m.start)))return!0}let n=e.labels;if(n&&n.length>0){let{start:b,end:g}=a.match.span,j=c.slice(Math.max(0,b-f),g+f),k=void 0===d?void 0:d.normalized.slice(Math.max(0,h),i);for(let a of aN("label",e,()=>n.map(a=>{let b=a.trim();return 0===b.length?void 0:RegExp(`(?<![A-Za-z0-9])${aF(b)}(?![A-Za-z0-9])`,"i")})))if(a&&(a.test(j)||void 0!==k&&a.test(k)))return!0}return!1}(e,a,b,c))continue;let g=f.confidenceBoost;d.push(g?{...e.match,confidence:Math.min(.99,e.match.confidence+g)}:e.match)}return d}function aY(a,b){let c={start:a.start,end:a.end};return{ruleId:a.ruleId,category:a.category,severity:a.severity,span:c,rawMatch:b.slice(c.start,c.end),confidence:a.confidence}}function aZ(a,b,c){let d=b??[...aT.values()].flatMap(a=>a.rules),e=c?.filePath?function(a){let b=a.slice(Math.max(a.lastIndexOf("/"),a.lastIndexOf("\\"))+1),c=b.lastIndexOf(".");return c>0?b.slice(c).toLowerCase():void 0}(c.filePath):void 0,f=function(a){if(!aG.test(a))return;let b=[],c=[],d=0,e=0;for(let f of a.matchAll(aH)){let g=f.index;if(g>d){let f=g-d;b.push(a.slice(d,g)),c.push({normStart:e,origStart:d,length:f}),e+=f}d=g+f[0].length}if(d<a.length){let f=a.length-d;b.push(a.slice(d)),c.push({normStart:e,origStart:d,length:f})}return{normalized:b.join(""),segments:c}}(a),g=aW(a,d,e);return f?function(a,b){if(0===a.length)return a;let c=new Map,d=[];for(let b of a){let a=c.get(b.ruleId);a?a.push(b):(c.set(b.ruleId,[b]),d.push(b.ruleId))}let e=[];for(let a of d){let d;for(let f of[...c.get(a)??[]].sort((a,b)=>a.span.start-b.span.start||a.span.end-b.span.end)){if(d&&f.span.start<d.end){d.end=Math.max(d.end,f.span.end),d.confidence=Math.max(d.confidence,f.confidence);continue}d&&e.push(aY(d,b)),d={start:f.span.start,end:f.span.end,confidence:f.confidence,ruleId:f.ruleId,category:f.category,severity:f.severity}}d&&e.push(aY(d,b))}return e}(aX([...g.map(a=>({...a,normSpan:function(a,b){let{segments:c}=b;return{start:aJ(a.start,c),end:aJ(a.end,c)}}(a.match.span,f)})),...aW(f.normalized,d,e).map(b=>(function(a,b,c){let d=function(a,b){let{segments:c}=b,d=aI(c,a.start),e=d.origStart+(a.start-d.normStart),f=aI(c,a.end-1);return{start:e,end:f.origStart+(a.end-1-f.normStart)+1}}(a.match.span,b);return{rule:a.rule,match:{...a.match,span:d,rawMatch:c.slice(d.start,d.end)},normSpan:a.normSpan}})(b,f,a))],a,f),a):aX(g,a,void 0)}let a$={critical:3,high:2,medium:1,low:0};function a_(a,b){if(0===b.length)return a;let c=[...b].sort((a,b)=>a.span.start-b.span.start||a.span.end-b.span.end),d=[];for(let a of c){let b=a$[a.severity],c=d[d.length-1];c&&a.span.start<c.end?(c.end=Math.max(c.end,a.span.end),b>c.rank&&(c.rank=b,c.category=a.category)):d.push({start:a.span.start,end:a.span.end,category:a.category,rank:b})}let e=a;for(let a of[...d].reverse()){let b=`[REDACTED:${a.category.toUpperCase()}]`;e=e.slice(0,a.start)+b+e.slice(a.end)}return e}function a0(a){if(a.length<=5)return"***";let b=a.indexOf("@");if(b>0&&b<a.length-1){let c=a.slice(b+1);if(c.includes(".")){let d=a.slice(0,b),e=d.length<=1?d:d.charAt(0)+"*".repeat(d.length-1);return`${e}@${c}`}}return`${a.charAt(0)}${"*".repeat(6)}${a.charAt(a.length-1)}`}var a1=c(40557);function a2(a){let b=[],c=null;for(let d of a.matchAll((0,a1.jwX)()))b.push({start:d.index,end:d.index+d[0].length}),c??=a,c=c.slice(0,d.index)+" ".repeat(d[0].length)+c.slice(d.index+d[0].length);return{text:c??a,spans:b}}function a3(a,b){return 0===b.length?a:a.filter(a=>!b.some(b=>a.span.start<b.end&&a.span.end>b.start))}let a4=new Set(["prettier","eslint","biome","black","ruff","gofmt","rustfmt","node","npx","npm","pnpm","yarn","make","git","jq","echo"]);JSON.stringify({kind:"hook-conflict",mutation:/(--write|--fix|\s-w\b|\s-i\b|(?<![\d&>])>\s?\S)/.source,note:"two hooks on the same event with overlapping matchers, both mutating the tool target"}),JSON.stringify({kind:"hook-unknown",knownTools:[...a4]}),JSON.stringify({kind:"hook-external-egress",pattern:/\b(curl|wget|nc|ncat|netcat|ssh|scp|rsync)\b|https?:\/\//.source}),JSON.stringify({kind:"web-capture-drift",states:[...new Set(["blind","degraded"])],minParseFailures:2}),String(a1.oz);let a5=["a","0"," ","x","ab","a.","a-","a_","a@","a/","a:","a=","a;","aA0","	"].flatMap(a=>[23,25].map(b=>a.repeat(Math.ceil(b/a.length)).slice(0,b)+"!")),a6=["abc-","a.","a ","a=","x","0","a@","a/","ab"].map(a=>a.repeat(1e4).slice(0,4e4)+"!"),a7=()=>performance.now();function a8(a,b){let{ms:c,probe:d,corroboratedMs:e}=function(a,b=a7,c){let d,e=0,f="";for(let g of[..."regex"===a.matcher.type?function(a){let b=function(a){let b="",c=0;for("^"===a[0]&&c++;c<a.length;){let d=a[c];if(void 0===d)break;if("\\"===d){let d=a[c+1];if("b"===d||"B"===d){c+=2;continue}if(void 0===d||/[dDwWsSnrtfv.]/.test(d))break;b+=d,c+=2;continue}if("([{.*+?|)]}^$".includes(d))break;b+=d,c++}return b}(a),c=function(a){let b=new Set;for(let c of a.matchAll(/\[\^?([^\]]+)\]/g)){let a=c[1];if(void 0===a)continue;let d=/([A-Za-z0-9])-[A-Za-z0-9]/.exec(a),e=d?.[1];if(void 0!==e)b.add(e);else{let c=a.replace(/\\/g,"")[0];void 0!==c&&"^"!==c&&b.add(c)}}return a.includes("\\w")&&b.add("a"),a.includes("\\d")&&b.add("0"),a.includes("\\s")&&b.add(" "),/(?<!\\)\./.test(a)&&b.add("a"),0===b.size&&b.add("a"),[...b]}(a),d=["!","#","~","\n"],e=[];for(let a of c)for(let c of d)if(c!==a)for(let d of[23,25])e.push(b+a.repeat(d)+c);return e}(a.matcher.pattern):[],...a5,...a6]){let h=b(),i=c?.();aZ(g,[a]);let j=b()-h,k=c?.();if(j>e&&(e=j,f=g,d=void 0===i||void 0===k?void 0:k-i),e>=100)break}return{ms:e,probe:f,corroboratedMs:d}}(a,a7,b),f=e??0;return{verdict:c<100?"safe":f>=20?"over-budget":"uncorroborated",worstMs:c,corroboratedMs:f,probe:d}}}};