@akasecurity/cli 0.9.3 → 0.9.5

package/web-ui/web-ui/.next/server/chunks/557.js

@@ -0,0 +1,5 @@
+exports.id=557,exports.ids=[557],exports.modules={28893:a=>{function b(a){return Array.isArray(a)?a:[a]}let c=void 0,d=/^\s+$/,e=/(?:[^\\]|^)\\$/,f=/^\\!/,g=/^\\#/,h=/\r?\n/g,i=/^\.{0,2}\/|^\.{1,2}$/,j=/\/$/,k="node-ignore";"undefined"!=typeof Symbol&&(k=Symbol.for("node-ignore"));let l=k,m=(a,b,c)=>(Object.defineProperty(a,b,{value:c}),c),n=/([0-z])-([0-z])/g,o=()=>!1,p=[[/^\uFEFF/,()=>""],[/((?:\\\\)*?)(\\?\s+)$/,(a,b,c)=>b+(0===c.indexOf("\\")?" ":"")],[/(\\+?)\s/g,(a,b)=>{let{length:c}=b;return b.slice(0,c-c%2)+" "}],[/[\\$.|*+(){^]/g,a=>`\\${a}`],[/(?!\\)\?/g,()=>"[^/]"],[/^\//,()=>"^"],[/\//g,()=>"\\/"],[/^\^*(?:\\\*\\\*\\\/)+/,()=>"^(?:.*\\/)?"],[/^(?=[^^])/,function(){return/\/(?!$)/.test(this)?"^":"(?:^|\\/)"}],[/\\\/\\\*\\\*(?=\\\/|$)/g,(a,b,c)=>b+6<c.length?"(?:\\/[^\\/]+)*":"\\/.+"],[/(^|[^\\]+)(\\\*)+(?=.+)/g,(a,b,c)=>b+c.replace(/\\\*/g,"[^\\/]*")],[/\\\\\\(?=[$.|*+(){^])/g,()=>"\\"],[/\\\\/g,()=>"\\"],[/(\\)?\[([^\]/]*?)(\\*)($|\])/g,(a,b,c,d,e)=>"\\"===b?`\\[${c}${(a=>{let{length:b}=a;return a.slice(0,b-b%2)})(d)}${e}`:"]"===e&&d.length%2==0?`[${(a=>a.startsWith("!")||a.startsWith("\\^")?`^${a.slice("!"===a[0]?1:2)}`:a)(c.replace(n,(a,b,c)=>b.charCodeAt(0)<=c.charCodeAt(0)?a:""))}${d}]`:"[]"],[/(?:[^*])$/,a=>/\/$/.test(a)?`${a}$`:`${a}(?=$|\\/$)`]],q=/(^|\\\/)?\\\*$/,r="regex",s="checkRegex",t={[r](a,b){let c=b?`${b}[^/]+`:"[^/]*";return`${c}(?=$|\\/$)`},[s](a,b){let c=b?`${b}[^/]*`:"[^/]*";return`${c}(?=$|\\/$)`}};class u{constructor(a,b,c,d,e,f){this.pattern=a,this.mark=b,this.negative=e,m(this,"body",c),m(this,"ignoreCase",d),m(this,"regexPrefix",f)}get regex(){let a="_"+r;return this[a]?this[a]:this._make(r,a)}get checkRegex(){let a="_"+s;return this[a]?this[a]:this._make(s,a)}_make(a,b){let c=this.regexPrefix.replace(q,t[a]);return m(this,b,this.ignoreCase?RegExp(c,"i"):new RegExp(c))}}class v{constructor(a){this._ignoreCase=a,this._rules=[]}_add(a){let b;if(a&&a[l]){this._rules=this._rules.concat(a._rules._rules),this._added=!0;return}if("string"==typeof a&&(a={pattern:a}),(b=a.pattern)&&"string"==typeof b&&!d.test(b)&&!e.test(b)&&0!==b.indexOf("#")){let b=(({pattern:a,mark:b},c)=>{let d,e=!1,h=a;0===h.indexOf("!")&&(e=!0,h=h.substr(1));let i=(d=h=h.replace(f,"!").replace(g,"#"),p.reduce((a,[b,c])=>a.replace(b,c.bind(d)),d));return new u(a,b,h,c,e,i)})(a,this._ignoreCase);this._added=!0,this._rules.push(b)}}add(a){return this._added=!1,b("string"==typeof a?a.split(h).filter(Boolean):a).forEach(this._add,this),this._added}test(a,b,d){let e,f=!1,g=!1;this._rules.forEach(h=>{let{negative:i}=h;(g!==i||f===g)&&(!i||f||g||b)&&h[d].test(a)&&(f=!i,g=i,e=i?c:h)});let h={ignored:f,unignored:g};return e&&(h.rule=e),h}}let w=(a,b)=>{throw new b(a)},x=(a,b,c)=>"string"!=typeof a?c(`path must be a string, but got \`${b}\``,TypeError):a?!x.isNotRelative(a)||c(`path should be a \`path.relative()\`d string, but got "${b}"`,RangeError):c("path must not be empty",TypeError),y=a=>i.test(a);x.isNotRelative=y,x.convert=a=>a;class z{constructor({ignorecase:a=!0,ignoreCase:b=a,allowRelativePaths:c=!1}={}){m(this,l,!0),this._rules=new v(b),this._strictPathCheck=!c,this._initCache()}_initCache(){this._ignoreCache=Object.create(null),this._testCache=Object.create(null)}add(a){return this._rules.add(a)&&this._initCache(),this}addPattern(a){return this.add(a)}_test(a,b,c,d){let e=a&&x.convert(a);return x(e,a,this._strictPathCheck?w:o),this._t(e,b,c,d)}checkIgnore(a){if(!j.test(a))return this.test(a);let b=a.split("/").filter(Boolean);if(b.pop(),b.length){let a=this._t(b.join("/")+"/",this._testCache,!0,b);if(a.ignored)return a}return this._rules.test(a,!1,s)}_t(a,b,c,d){if(a in b)return b[a];if(d||(d=a.split("/").filter(Boolean)),d.pop(),!d.length)return b[a]=this._rules.test(a,c,r);let e=this._t(d.join("/")+"/",b,c,d);return b[a]=e.ignored?e:this._rules.test(a,c,r)}ignores(a){return this._test(a,this._ignoreCache,!1).ignored}createFilter(){return a=>!this.ignores(a)}filter(a){return b(a).filter(this.createFilter())}test(a){return this._test(a,this._testCache,!0)}}let A=a=>new z(a),B=()=>{x.convert=a=>/^\\\\\?\\/.test(a)||/["<>|\u0000-\u001F]+/u.test(a)?a:a.replace(/\\/g,"/");let a=/^[a-z]:\//i;x.isNotRelative=b=>a.test(b)||y(b)};"undefined"!=typeof process&&"win32"===process.platform&&B(),a.exports=A,A.default=A,a.exports.isPathValid=a=>x(a&&x.convert(a),a,o),m(a.exports,Symbol.for("setupWindows"),B)},37557:(a,b,c)=>{"use strict";let d,e,f;c.d(b,{S1:()=>z,tq:()=>B,IL:()=>b4,Lr:()=>b1,UE:()=>C,US:()=>bX,f2:()=>b2,u5:()=>b5,OF:()=>b_});var g=c(31421),h=c(48161);let i="win32"===process.platform,j="win32"===process.platform?{cwd:(0,h.homedir)()}:{};function k(a,b,c=15e3){try{let d=(0,g.execFileSync)(a,b,{encoding:"utf8",timeout:c,stdio:["ignore","pipe","pipe"],shell:i,...j});return{ok:!0,stdout:d.trim(),stderr:""}}catch(a){return{ok:!1,stdout:"string"==typeof a.stdout?a.stdout.trim():"",stderr:"string"==typeof a.stderr?a.stderr.trim():""}}}function l(a,b){try{return(0,g.execFileSync)(a,b,{stdio:"inherit",shell:i,...j}),!0}catch{return!1}}function m(a){return{available:()=>(function(a){let b="win32"===process.platform?"where":"command",c="win32"===process.platform?[a]:["-v",a];try{let a=(0,g.spawnSync)(b,c,{stdio:"ignore",shell:"win32"!==process.platform,...j});return 0===a.status}catch{return!1}})(a),ensureMarketplace:b=>{k(a,["plugin","marketplace","add",b],6e4)},install:b=>l(a,["plugin","install",b]),update:b=>l(a,["plugin","update",b])}}let n=[{id:"claude-code",name:"Claude Code",sourceTool:"claude-code",description:"Hooks Claude Code sessions to detect + redact sensitive data in prompts, responses, and file writes.",npmPackage:"@akasecurity/ai-tc-claude-code",pluginName:"ai-tc",marketplace:"akasecurity",marketplaceSource:"akasecurity/marketplace",cliBin:"claude"},{id:"codex",name:"Codex CLI",sourceTool:"codex",description:"Hooks Codex CLI sessions to detect + redact sensitive data in prompts, responses, and Bash tool calls.",npmPackage:"@akasecurity/ai-tc-codex",pluginName:"aka-codex",marketplace:"ai-tc",marketplaceSource:"akasecurity/ai-tc",cliBin:"codex"},{id:"antigravity",name:"Antigravity",sourceTool:"antigravity",description:"Hooks Antigravity CLI sessions to detect sensitive data in shell commands and file writes.",npmPackage:"@akasecurity/ai-tc-antigravity",installHint:"Antigravity installs plugins from a local directory rather than a marketplace:\n  npm pack @akasecurity/ai-tc-antigravity && tar -xzf akasecurity-ai-tc-antigravity-*.tgz\n  agy plugin install ./package\nThen run `aka init` to set up the local store."}];function o(a){if(a.pluginName&&a.marketplace)return`${a.pluginName}@${a.marketplace}`}var p=c(73024),q=c(76760),r=c(50755);function s(a){let b=/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z-.]+))?$/.exec(a.trim());return b?{core:[Number(b[1]),Number(b[2]),Number(b[3])],pre:b[4]?b[4].split("."):[]}:null}function t(a){return null!==s(a)}function u(a,b){let c=s(a),d=s(b);if(!c||!d)return 0;for(let a=0;a<3;a++){let b=c.core[a]??0,e=d.core[a]??0;if(b!==e)return b<e?-1:1}return function(a,b){if(0===a.length&&0===b.length)return 0;if(0===a.length)return 1;if(0===b.length)return -1;let c=Math.min(a.length,b.length);for(let d=0;d<c;d++){let c=a[d]??"",e=b[d]??"";if(c===e)continue;let f=/^\d+$/.test(c),g=/^\d+$/.test(e);if(f&&!g)return -1;if(!f&&g)return 1;if(f&&g)return Number(c)<Number(e)?-1:1;return c<e?-1:1}return a.length===b.length?0:a.length<b.length?-1:1}(c.pre,d.pre)}let v="@akasecurity/cli";function w(a){return"object"==typeof a&&null!==a}function x(a){let b=k("npm",["view",a,"version"],15e3);if(!b.ok||!b.stdout)return null;let c=b.stdout.split("\n").pop()?.trim();return c&&/^\d/.test(c)?c:null}function y(a,b,c){if("inherit"===c)return{ok:l(a,b),output:""};let d=k(a,b,6e5);return{ok:d.ok,output:[d.stdout,d.stderr].filter(Boolean).join("\n")}}function z(a="capture"){return y("npm",["install","-g",`${v}@latest`],a)}function A(a){let b=n.find(b=>b.id===a);if(!b)return{ok:!1,output:`unknown agent '${a}'`};let c=o(b),d=b.cliBin;return c&&d?m(d).available()?{ref:c,cliBin:d,marketplaceSource:b.marketplaceSource}:{ok:!1,output:`the \`${d}\` CLI isn't on your PATH — install ${b.name}, then run \`${d} plugin install ${c}\` (or update with \`${d} plugin update ${c}\`).`}:{ok:!1,output:`${b.name} has no automated install path yet.`}}function B(a,b="capture"){let c=A(a);return"ok"in c?c:(c.marketplaceSource&&m(c.cliBin).ensureMarketplace(c.marketplaceSource),y(c.cliBin,["plugin","update",c.ref],b))}function C(a,b="capture"){let c=A(a);return"ok"in c?c:(c.marketplaceSource&&m(c.cliBin).ensureMarketplace(c.marketplaceSource),y(c.cliBin,["plugin","install",c.ref],b))}let D=m("claude");D.available,D.ensureMarketplace,D.install,D.update;let E=m("codex");E.available,E.ensureMarketplace,E.install,E.update;var F=c(51330),G=c(4114),H=c(14901);let I=H.Yj().optional().transform(a=>{if(void 0===a)return;let b=a.trim().toLowerCase();return""!==b&&"false"!==b&&"0"!==b}).catch(void 0),J=H.vk(a=>{if("string"!=typeof a||""!==a.trim())return a},H.Yj().optional()).catch(void 0);H.Ik({CLAUDE_CODE_USE_BEDROCK:I,CLAUDE_CODE_USE_VERTEX:I,ANTHROPIC_BASE_URL:J});var K=c(38172);let L=JSON.parse('{"specVersion":1,"id":"code-flaws/auth-jwt-no-verify","name":"JWT decoded without signature verification","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"(verify\\\\s*=\\\\s*false|verify_signature.*false|algorithms\\\\s*=\\\\s*\\\\[\\\\])","flags":"gi"},"requiresNearby":{"labels":["jwt","decode","token"],"windowChars":160},"examples":["jwt.decode(token, options={\\"verify_signature\\": False})","jwt.decode(token, algorithms=[])"]}'),M=JSON.parse('{"specVersion":1,"id":"code-flaws/auth-ssl-verify-false","name":"SSL certificate verification disabled","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"\\\\brequests\\\\.(get|post|put|delete|patch|request)\\\\s*\\\\([^)]*verify\\\\s*=\\\\s*False","flags":"gi"},"examples":["requests.get(url, verify=False)","requests.post(endpoint, data=payload, verify=False)"],"appliesTo":{"extensions":[".py"]}}'),N=JSON.parse('{"specVersion":1,"id":"code-flaws/cmd-inject-exec","name":"Command injection via Java Runtime.exec","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"Runtime\\\\.getRuntime\\\\(\\\\)\\\\.exec\\\\(","flags":"g"},"requiresNearby":{"labels":["input","request","param","user"],"windowChars":200},"examples":["Runtime.getRuntime().exec(userInput)"],"appliesTo":{"extensions":[".java"]}}'),O=JSON.parse('{"specVersion":1,"id":"code-flaws/cmd-inject-node-exec","name":"Command injection via Node.js exec with variable argument","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bexec(?:Sync)?\\\\s*\\\\(\\\\s*(?![\'\\"`])","flags":"g"},"requiresNearby":{"labels":["input","request","param","argv","user","query","body"],"windowChars":200},"examples":["exec(req.query.cmd)","execSync(userInput)"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx",".mjs",".cjs"]}}'),P=JSON.parse('{"specVersion":1,"id":"code-flaws/cmd-inject-shell","name":"Command injection via subprocess shell=True","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"subprocess\\\\.(run|Popen|call|check_output)\\\\s*\\\\([^)]*shell\\\\s*=\\\\s*True","flags":"gi"},"requiresNearby":{"labels":["input","request","param","argv","user"],"windowChars":300},"examples":["subprocess.run(user_input, shell=True)"],"appliesTo":{"extensions":[".py"]}}'),Q=JSON.parse('{"specVersion":1,"id":"code-flaws/crypto-insecure-random","name":"Insecure random number generator used for security-sensitive value","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"\\\\b(Math\\\\.random\\\\(\\\\)|random\\\\.random\\\\(\\\\)|random\\\\.randint\\\\()","flags":"gi"},"requiresNearby":{"labels":["token","session","key","password","secret","nonce","salt"],"windowChars":160},"examples":["const token = Math.random().toString(36)","session_key = str(random.random())"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx",".mjs",".cjs",".py"]}}'),R=JSON.parse('{"specVersion":1,"id":"code-flaws/crypto-weak-hash-md5","name":"Weak cryptographic hash: MD5","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"(hashlib\\\\.md5\\\\s*\\\\(|MD5\\\\.(?:digest|hash)\\\\b|Digest::MD5|MessageDigest\\\\.getInstance\\\\s*\\\\(\\\\s*[\\"\']MD5[\\"\'])","flags":"gi"},"examples":["hashlib.md5(password.encode())","MessageDigest.getInstance(\\"MD5\\")"],"appliesTo":{"extensions":[".py",".rb",".java"]}}'),S=JSON.parse('{"specVersion":1,"id":"code-flaws/crypto-weak-hash-sha1","name":"Weak cryptographic hash: SHA-1 in security context","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"(hashlib\\\\.sha1\\\\s*\\\\(|SHA1\\\\.(?:digest|hash)\\\\b|Digest::SHA1|MessageDigest\\\\.getInstance\\\\s*\\\\(\\\\s*[\\"\']SHA-?1[\\"\'])","flags":"gi"},"requiresNearby":{"labels":["password","credential","hash","token","secret"],"windowChars":160},"examples":["password_hash = hashlib.sha1(password.encode()).hexdigest()","MessageDigest.getInstance(\\"SHA1\\")"],"appliesTo":{"extensions":[".py",".rb",".java"]}}'),T=JSON.parse('{"specVersion":1,"id":"code-flaws/deser-java-ois","name":"Insecure deserialization via Java ObjectInputStream","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bObjectInputStream\\\\b","flags":"g"},"requiresNearby":{"labels":["readObject"],"windowChars":200},"examples":["ObjectInputStream ois = new ObjectInputStream(inputStream); Object obj = ois.readObject();"],"appliesTo":{"extensions":[".java"]}}'),U=JSON.parse('{"specVersion":1,"id":"code-flaws/deser-pickle","name":"Insecure deserialization via Python pickle","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bpickle\\\\.loads?\\\\s*\\\\(","flags":"gi"},"examples":["data = pickle.loads(user_data)","obj = pickle.load(request.stream)"],"appliesTo":{"extensions":[".py"]}}'),V=JSON.parse('{"specVersion":1,"id":"code-flaws/deser-yaml-unsafe","name":"Insecure deserialization via yaml.load without SafeLoader","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"\\\\byaml\\\\.load\\\\s*\\\\((?![^)]*SafeLoader|[^)]*safe_load)","flags":"gi"},"examples":["data = yaml.load(user_input)","config = yaml.load(f)"],"appliesTo":{"extensions":[".py"]}}'),W=JSON.parse('{"specVersion":1,"id":"code-flaws/dev-debug-enabled","name":"Debug mode enabled in configuration","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"\\\\bdebug\\\\s*[=:]\\\\s*(true|1|yes)","flags":"gi"},"examples":["DEBUG = True","debug: true","app.debug = True"]}'),X=JSON.parse('{"specVersion":1,"id":"code-flaws/dev-placeholder-secret","name":"Placeholder or default secret left in code","category":"code_flaw","severity":"high","matcher":{"type":"keyword","keywords":["changeme","placeholder","your-secret","dev-secret","replace-me","todo-secret"],"caseSensitive":false},"requiresNearby":{"labels":["key","secret","password","token"],"windowChars":80},"examples":["SECRET_KEY = \'changeme\'","api_token = \'your-secret\'"]}'),Y=JSON.parse('{"specVersion":1,"id":"code-flaws/dev-wildcard-cors","name":"CORS wildcard allowing all origins","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"(Access-Control-Allow-Origin:\\\\s*\\\\*|origin:\\\\s*[\\"\']\\\\*[\\"\']|allow_all_origins\\\\s*=\\\\s*True|CORS_ALLOW_ALL_ORIGINS\\\\s*=\\\\s*True)","flags":"gi"},"examples":["Access-Control-Allow-Origin: *","cors({ origin: \'*\' })","CORS_ALLOW_ALL_ORIGINS = True"]}'),Z=JSON.parse('{"specVersion":1,"id":"code-flaws/eval-dynamic-exec","name":"Dynamic code execution with user-controlled input","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(eval|exec)\\\\s*\\\\(\\\\s*(?![\'\\"`])","flags":"g"},"requiresNearby":{"labels":["input","request","param","user","query","body"],"windowChars":200},"examples":["eval(request.body.code)","exec(user_input)"]}'),$=JSON.parse('{"specVersion":1,"id":"code-flaws/hardcoded-password","name":"Hardcoded password in source code","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"(?:password|passwd|pwd)\\\\s*=\\\\s*[\\"\']([^\\"\']{3,})[\\"\']","flags":"gi","captureGroup":1},"postValidators":[{"name":"entropy","config":{"minLength":8,"threshold":3}}],"examples":["password = \\"Tr0ub4dor&3\\"","DB_PASSWORD = \'c0rr3ctH0rseBatt3ry\'"]}'),_=JSON.parse('{"specVersion":1,"id":"code-flaws/hardcoded-secret-key","name":"Hardcoded API key or secret key in source code","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(secret[_-]?key|api[_-]?key|auth[_-]?token)\\\\s*=\\\\s*[\\"\'][^\\"\']{8,}[\\"\']","flags":"gi"},"postValidators":["entropy"],"examples":["SECRET_KEY = \\"a9f2c8e1b4d7f3a6c9e2b5d8f1a4c7e0\\"","api_key = \'sk-proj-abc123XYZ789def456\'"]}'),aa=JSON.parse('{"specVersion":1,"id":"code-flaws/path-traversal-join","name":"Path traversal via os.path.join with user-controlled component","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"os\\\\.path\\\\.join\\\\s*\\\\([^,)]+,\\\\s*(request|req|params|user)","flags":"gi"},"examples":["os.path.join(base_dir, request.args[\'file\'])","os.path.join(upload_dir, user_filename)"],"appliesTo":{"extensions":[".py"]}}'),ab=JSON.parse('{"specVersion":1,"id":"code-flaws/path-traversal-open","name":"Path traversal via open() with user-controlled path","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"\\\\bopen\\\\s*\\\\(\\\\s*(request|req|params|argv|input)","flags":"gi"},"requiresNearby":{"labels":["request","param","input","argv","user"],"windowChars":200},"examples":["open(request.args[\'filename\'])","open(params[\'path\'])"],"appliesTo":{"extensions":[".py",".rb"]}}'),ac=JSON.parse('{"specVersion":1,"id":"code-flaws/prototype-pollution-merge","name":"Prototype pollution via merge with user-controlled input","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"(Object\\\\.assign\\\\s*\\\\(\\\\s*\\\\w+\\\\s*,\\\\s*(req|request|body|params|query)|_\\\\.merge\\\\s*\\\\(\\\\s*\\\\w+\\\\s*,\\\\s*(req|request))","flags":"gi"},"examples":["Object.assign(config, req.body)","_.merge(target, request.body)"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx",".mjs",".cjs"]}}'),ad=JSON.parse('{"specVersion":1,"id":"code-flaws/regex-redos-backtrack","name":"ReDoS via catastrophic backtracking pattern","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"\\\\((?:\\\\?:)?(?:\\\\\\\\.|\\\\[[^\\\\]]*\\\\]|[^\\\\\\\\()\\\\[\\\\]+*?|])[+*](?:(?:\\\\\\\\.|\\\\[[^\\\\]]*\\\\]|[^\\\\\\\\()\\\\[\\\\]+*?|])\\\\*)?\\\\)[+*]|\\\\((?:\\\\?:)?([^()|]+)\\\\|\\\\1\\\\)[+*]","flags":"g"},"examples":["/(a+)+/","/(\\\\w+\\\\s*)+/"]}'),ae=JSON.parse('{"specVersion":1,"id":"code-flaws/sql-inject-concat-dot","name":"SQL injection via string concatenation (PHP dot operator)","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"[\\"\'][^\\\\n]*?(select|insert|update|delete|drop|where)[^\\\\n]*?[\\"\']\\\\s*\\\\.","flags":"gi"},"appliesTo":{"extensions":[".php"]},"examples":["$query = \\"SELECT * FROM orders WHERE user = \\" . $username;"]}'),af=JSON.parse('{"specVersion":1,"id":"code-flaws/sql-inject-concat","name":"SQL injection via string concatenation","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"[\\"\']\\\\s*(?:select\\\\b[^\\\\n]*?\\\\bfrom\\\\b|insert\\\\s+into\\\\b|update\\\\s+\\\\S+\\\\s+set\\\\b|delete\\\\s+from\\\\b|drop\\\\s+(?:table|database)\\\\b|where\\\\b[^\\\\n]*?=)[^\\\\n]*?[\\"\']\\\\s*\\\\+","flags":"gi"},"examples":["\\"SELECT * FROM users WHERE id = \\" + userId"]}'),ag=JSON.parse('{"specVersion":1,"id":"code-flaws/sql-inject-format","name":"SQL injection via format string or f-string","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:select\\\\b[^\\\\n]*?\\\\bfrom\\\\b|insert\\\\s+into\\\\b|update\\\\s+\\\\S+\\\\s+set\\\\b|delete\\\\s+from\\\\b|drop\\\\s+(?:table|database)\\\\b|where\\\\b[^\\\\n]*?=)[^\\\\n]*?(?:[%][sd]|\\\\{[^}]+\\\\})","flags":"gi"},"examples":["f\\"SELECT * FROM users WHERE id = {user_id}\\"","\\"SELECT * FROM users WHERE name = \'%s\'\\" % name"]}'),ah=JSON.parse('{"specVersion":1,"id":"code-flaws/sql-inject-interp","name":"SQL injection via Ruby string interpolation or PHP variable","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"(select|insert|update|delete|where)[^\\\\n]*?(#\\\\{|\\\\$[a-z_])","flags":"gi"},"examples":["\\"SELECT * FROM users WHERE id = #{params[:id]}\\"","\\"SELECT * FROM users WHERE id = $userId\\""],"appliesTo":{"extensions":[".rb",".php"]}}'),ai=JSON.parse('{"specVersion":1,"id":"code-flaws/ssrf-user-url","name":"Server-side request forgery via user-controlled URL","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"(fetch|axios\\\\.\\\\w+|requests\\\\.get|urllib\\\\.request\\\\.urlopen)\\\\s*\\\\(\\\\s*(req|request|params|query|body)","flags":"gi"},"examples":["fetch(req.query.url)","requests.get(request.form[\'url\'])"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx",".mjs",".cjs",".py"]}}'),aj=JSON.parse('{"specVersion":1,"id":"code-flaws/xss-dangerously-set","name":"XSS via React dangerouslySetInnerHTML","category":"code_flaw","severity":"high","matcher":{"type":"keyword","keywords":["dangerouslySetInnerHTML"],"caseSensitive":true},"examples":["<div dangerouslySetInnerHTML={{ __html: userContent }} />"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx"]}}'),ak=JSON.parse('{"specVersion":1,"id":"code-flaws/xss-inner-html","name":"XSS via innerHTML assignment","category":"code_flaw","severity":"high","matcher":{"type":"keyword","keywords":["innerHTML =","innerHTML="],"caseSensitive":true},"examples":["element.innerHTML = userInput"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx",".mjs",".cjs"]}}'),al=JSON.parse('{"specVersion":1,"id":"code-flaws/xss-unescaped-render","name":"XSS via unescaped template rendering","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"(\\\\braw\\\\s*\\\\(|\\\\bhtml_safe\\\\b|\\\\|\\\\s*safe\\\\b|\\\\bmark_safe\\\\s*\\\\()","flags":"gi"},"examples":["<%= raw(user_comment) %>","{{ user_input | safe }}","mark_safe(user_html)"],"appliesTo":{"extensions":[".rb",".py"]}}'),am=JSON.parse('{"specVersion":1,"id":"core-code-context/db-table-name","name":"Internal database table/column name","category":"code_context","severity":"low","matcher":{"type":"keyword","keywords":["SELECT * FROM ","SELECT COUNT(*) FROM ","INSERT INTO ","DELETE FROM ","CREATE TABLE ","ALTER TABLE ","DROP TABLE ","FROM users","FROM orders","FROM employees","FROM customers","FROM accounts","FROM transactions","FROM products","FROM payments"],"caseSensitive":false},"examples":["SELECT * FROM users WHERE id = 1"]}'),an=JSON.parse('{"specVersion":1,"id":"core-code-context/feature-flag","name":"Feature flag / toggle name","category":"code_context","severity":"low","matcher":{"type":"keyword","keywords":["feature_flag:","feature_toggle:","feature-flag:","feature-toggle:","FF_","FEATURE_FLAG_","FEATURE_TOGGLE_","unleash:","launchdarkly:","split.io:"],"caseSensitive":false},"examples":["feature_flag: new-checkout-flow","FF_ENABLE_DARK_MODE"]}'),ao=JSON.parse('{"specVersion":1,"id":"core-code-context/file-path","name":"User home / identity-bearing file path","category":"code_context","severity":"low","matcher":{"type":"regex","pattern":"(?:/home|/Users)/[A-Za-z0-9_.@-]+(?:/[A-Za-z0-9_.@+-]+)*|/root(?:/[A-Za-z0-9_.@+-]+)+|[A-Za-z]:\\\\\\\\[Uu]sers\\\\\\\\[A-Za-z0-9_.-]+(?:\\\\\\\\[A-Za-z0-9_.-]+)*","flags":"g"},"examples":["/home/user/.ssh/id_rsa","/Users/jane/projects/acme/secrets.env","C:\\\\Users\\\\admin\\\\config.yml"]}'),ap=JSON.parse('{"specVersion":1,"id":"core-code-context/internal-domain","name":"Internal domain / hostname","category":"code_context","severity":"low","matcher":{"type":"regex","pattern":"(?<![A-Za-z0-9.-])[A-Za-z0-9][A-Za-z0-9.-]{0,251}\\\\.(?:internal|corp|local|lan|intranet|private|dev|staging|test|qa)(?:\\\\.(?:com|net|org|io|co|app))?\\\\b","flags":"gi"},"examples":["db.internal.com","app.corp.local","api.staging.example.com"]}'),aq=JSON.parse('{"specVersion":1,"id":"core-code-context/internal-ip","name":"Internal (RFC 1918) IP address","category":"code_context","severity":"low","matcher":{"type":"regex","pattern":"(?<![\\\\d.])(?:10\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)|192\\\\.168\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?))(?![\\\\d])","flags":"g"},"examples":["10.0.0.1","192.168.1.1","172.16.0.1"]}'),ar=JSON.parse('{"specVersion":1,"id":"core-code-context/internal-url","name":"Internal environment URL","category":"code_context","severity":"low","matcher":{"type":"keyword","keywords":["https://staging.","https://dev.","https://qa.","https://test.","http://staging.","http://dev.","http://qa.","http://test.",".staging.com",".dev.com",".qa.com","staging.internal","dev.internal"],"caseSensitive":false},"examples":["https://staging.example.com"]}'),as=JSON.parse('{"specVersion":1,"id":"core-code-context/localhost-ref","name":"Localhost reference","category":"code_context","severity":"low","matcher":{"type":"regex","pattern":"\\\\b(?:localhost|127\\\\.0\\\\.0\\\\.1|0\\\\.0\\\\.0\\\\.0|::1)\\\\b","flags":"g"},"examples":["localhost","127.0.0.1"]}'),at=JSON.parse('{"specVersion":1,"id":"core-code-context/stack-trace","name":"Stack trace (internal code structure)","category":"code_context","severity":"low","matcher":{"type":"regex","pattern":"(?:^|\\\\s+)at\\\\s+[A-Za-z0-9._$<>]+\\\\.[A-Za-z0-9_$]+\\\\s*\\\\([A-Za-z0-9._\\\\-/:]+:\\\\d+:\\\\d+\\\\)","flags":"g"},"examples":["at com.example.service.UserService.findUser(UserService.java:42:13)"]}'),au=JSON.parse('{"specVersion":1,"id":"core-financial/credit-card","name":"Credit/debit card number","category":"financial","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12})\\\\b","flags":"g"},"postValidators":["luhn"],"examples":["4111111111111111","5500000000000004"]}'),av=JSON.parse('{"specVersion":1,"id":"core-financial/cusip","name":"CUSIP security identifier","category":"financial","severity":"medium","matcher":{"type":"regex","pattern":"\\\\bcusip\\\\b[\\\\s#:=-]{0,8}(\\\\d{3}[A-Z0-9]{2}[A-Z0-9*#@]\\\\d{2}[0-9])\\\\b","flags":"gi","captureGroup":1},"examples":["CUSIP: 037833100","CUSIP 931142103"]}'),aw=JSON.parse('{"specVersion":1,"id":"core-financial/cvv","name":"Card security code (CVV/CVC)","category":"financial","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:CVV|CVC|CID|security\\\\s+code|card\\\\s+code)[:\\\\s]*\\\\d{3,4}\\\\b","flags":"gi"},"examples":["CVV: 123","CVC: 456"]}'),ax=JSON.parse('{"specVersion":1,"id":"core-financial/iban","name":"International Bank Account Number","category":"financial","severity":"high","matcher":{"type":"regex","pattern":"\\\\b[A-Z]{2}\\\\d{2}[A-Z0-9 ]{10,30}\\\\b","flags":"g"},"requiresNearby":{"labels":["iban","bank","account","bic","swift"],"windowChars":160},"examples":["IBAN: GB82 WEST 1234 5698 7654 32","IBAN: DE89 3704 0044 0532 0130 00"]}'),ay=JSON.parse('{"specVersion":1,"id":"core-financial/paypal","name":"PayPal transaction/merchant ID","category":"financial","severity":"medium","matcher":{"type":"regex","pattern":"paypal.{0,30}?\\\\b([A-Z0-9]{17})\\\\b","flags":"gi","captureGroup":1},"examples":["PayPal transaction ID: 9HW7382910ABCDEF1"]}'),az=JSON.parse('{"specVersion":1,"id":"core-financial/routing-number","name":"US bank routing number (ABA)","category":"financial","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:routing|aba|rtn)\\\\b[\\\\s#:=-]{0,8}(\\\\d{9})\\\\b","flags":"gi","captureGroup":1},"examples":["Routing: 021000021","ABA 111000025"]}'),aA=JSON.parse('{"specVersion":1,"id":"core-financial/salary","name":"Salary/compensation (contextual)","category":"financial","severity":"low","matcher":{"type":"keyword","keywords":["my salary is","my base salary","annual compensation","total comp","my tc is","my package is","i make $","i earn $","offered $"],"caseSensitive":false},"examples":["My salary is $150,000"]}'),aB=JSON.parse('{"specVersion":1,"id":"core-financial/swift","name":"SWIFT/BIC code","category":"financial","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:swift|bic)\\\\b[\\\\s#:=-]{0,8}([A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?)\\\\b","flags":"gi","captureGroup":1},"examples":["SWIFT: BOFAUS3N","BIC: CHASGB2LXXX"]}'),aC=JSON.parse('{"specVersion":1,"id":"core-phi/biometric-ref","name":"Biometric data reference","category":"phi","severity":"high","matcher":{"type":"keyword","keywords":["fingerprint data","fingerprint scan","my iris scan","my retina scan","my biometric","my facial recognition","my voiceprint","my palm print","my hand geometry"],"caseSensitive":false},"examples":["My fingerprint data is stored in the biometric database"]}'),aD=JSON.parse('{"specVersion":1,"id":"core-phi/genetic-data","name":"Genetic/DNA sequence reference","category":"phi","severity":"high","matcher":{"type":"keyword","keywords":["my dna sequence","my genome","my genetic","dna test results","genetic test results","my 23andme","my ancestrydna","gene variant","my genotype","my haplogroup"],"caseSensitive":false},"examples":["My DNA sequence shows a variant in the BRCA1 gene"]}'),aE=JSON.parse('{"specVersion":1,"id":"core-phi/group-id","name":"Health plan group ID","category":"phi","severity":"high","matcher":{"type":"regex","pattern":"\\\\bgroup\\\\s*(?:id|number|no|#)\\\\s*[:#]?\\\\s*[A-Za-z0-9]{6,20}\\\\b","flags":"gi"},"requiresNearby":{"ruleIds":["core-phi/member-id"],"labels":["member id","subscriber","health plan"],"windowChars":200,"confidenceBoost":0.05},"examples":["Member ID: ABC987654321, Group ID: GRP12345678"]}'),aF=JSON.parse('{"specVersion":1,"id":"core-phi/hipaa-identifier","name":"HIPAA standard identifier (health plan / beneficiary / claim number)","category":"phi","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:health\\\\s+plan|beneficiary|claim\\\\s+number|subscriber)[:\\\\s]*[A-Za-z0-9]{8,20}\\\\b","flags":"gi"},"examples":["Health Plan: XYZ123456789","Beneficiary: ABC987654321"]}'),aG=JSON.parse('{"specVersion":1,"id":"core-phi/icd10-code","name":"ICD-10 diagnosis code","category":"phi","severity":"medium","matcher":{"type":"regex","pattern":"(?:icd[- ]?10|diagnosis|\\\\bdx\\\\b).{0,12}?([A-Z][0-9]{2}(?:\\\\.[0-9]{1,4})?)\\\\b","flags":"gi","captureGroup":1},"examples":["ICD-10: I10","Diagnosis code E11.9","dx: J45.909"]}'),aH=JSON.parse('{"specVersion":1,"id":"core-phi/member-id","name":"Health plan member ID","category":"phi","severity":"high","matcher":{"type":"regex","pattern":"\\\\bmember\\\\s*(?:id|number|no|#)\\\\s*[:#]?\\\\s*[A-Za-z0-9]{6,20}\\\\b","flags":"gi"},"examples":["Member ID: ABC987654321"]}'),aI=JSON.parse('{"specVersion":1,"id":"core-phi/mrn","name":"Medical Record Number","category":"phi","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:MRN|MR#|medical\\\\s+record)[:\\\\s]*[A-Za-z0-9]{6,16}\\\\b","flags":"gi"},"examples":["MRN: 1234567890","Medical Record: ABCD1234"]}'),aJ=JSON.parse('{"specVersion":1,"id":"core-phi/ndc-code","name":"National Drug Code (NDC)","category":"phi","severity":"medium","matcher":{"type":"regex","pattern":"\\\\b\\\\d{4,5}-\\\\d{3,4}-\\\\d{1,2}\\\\b","flags":"g"},"examples":["0002-1427-01","68788-6965-1"]}'),aK=JSON.parse('{"specVersion":1,"id":"core-pii/dob","name":"Date of birth","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:(?:19[4-9]\\\\d|20[0-1]\\\\d)[/-]\\\\d{1,2}[/-]\\\\d{1,2}|\\\\d{1,2}[/-]\\\\d{1,2}[/-](?:19[4-9]\\\\d|20[0-1]\\\\d))\\\\b","flags":"g"},"requiresNearby":{"categories":["pii"],"labels":["dob","date of birth","birth","d.o.b"],"windowChars":160},"examples":["DOB: 1985-03-22","Date of birth: 03/22/1985"]}'),aL=JSON.parse('{"specVersion":1,"id":"core-pii/drivers-license-us","name":"US driver\'s license number","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"(?:driver\'?s?\\\\s*licen[sc]e|licen[sc]e|\\\\bDL\\\\b).{0,10}?([A-Z]\\\\d{6,8}|\\\\d{8,9})\\\\b","flags":"gi","captureGroup":1},"examples":["Driver\'s License: D1234567","DL: 123456789"]}'),aM=JSON.parse('{"specVersion":1,"id":"core-pii/email","name":"Email address","category":"pii","severity":"medium","matcher":{"type":"regex","pattern":"(?<![A-Za-z0-9._%+-])[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,255}\\\\.[A-Za-z]{2,24}\\\\b","flags":"g"},"examples":["user@example.com"]}'),aN=JSON.parse('{"specVersion":1,"id":"core-pii/home-address","name":"Home address (contextual)","category":"pii","severity":"medium","matcher":{"type":"keyword","keywords":["my address is","home address","shipping address","billing address","mailing address","my home is at","i reside at"],"caseSensitive":false},"examples":["My address is 123 Main St, Springfield, IL 62701"]}'),aO=JSON.parse('{"specVersion":1,"id":"core-pii/ip-address","name":"IP address","category":"pii","severity":"low","matcher":{"type":"regex","pattern":"\\\\b(?:(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\.){3}(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\b","flags":"g"},"examples":["192.168.1.1","10.0.0.1"]}'),aP=JSON.parse('{"specVersion":1,"id":"core-pii/mac-address","name":"MAC address","category":"pii","severity":"low","matcher":{"type":"regex","pattern":"\\\\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\\\\b","flags":"g"},"examples":["AA:BB:CC:DD:EE:FF"]}'),aQ=JSON.parse('{"specVersion":1,"id":"core-pii/name","name":"Personal name (contextual)","category":"pii","severity":"medium","matcher":{"type":"keyword","keywords":["my name is","my full name","i am called","please call me","name:\\n","\\"full_name\\": \\"","\\"fullName\\": \\""],"caseSensitive":false},"examples":["My name is John Doe"]}'),aR=JSON.parse('{"specVersion":1,"id":"core-pii/national-id","name":"National ID number (multi-country)","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"\\\\b[A-Z]{2}\\\\d{6}[A-D]\\\\b|\\\\b[2-9]\\\\d{11}\\\\b|(?:national\\\\s*id|aadhaar|\\\\bSIN\\\\b).{0,10}?\\\\d{3}[\\\\s-]?\\\\d{3}[\\\\s-]?\\\\d{3}\\\\b","flags":"gi"},"requiresNearby":{"labels":["national id","national identity","national insurance","nino","ni","aadhaar","sin","identity number","id number"],"windowChars":160},"examples":["Aadhaar: 234567890123","NI: AB123456C","SIN: 123-456-789"]}'),aS=JSON.parse('{"specVersion":1,"id":"core-pii/passport-us","name":"US passport number","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"\\\\b[A-Z]\\\\d{8}\\\\b","flags":"g"},"requiresNearby":{"labels":["passport"],"windowChars":160},"examples":["Passport: A12345678"]}'),aT=JSON.parse('{"specVersion":1,"id":"core-pii/phone-intl","name":"International phone number","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"\\\\+\\\\d{1,3}(?:[-.\\\\s]\\\\d{1,14}){1,5}\\\\b","flags":"g"},"examples":["+44 20 7946 0958","+86 138 0013 8000"]}'),aU=JSON.parse('{"specVersion":1,"id":"core-pii/phone-us","name":"US phone number","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"(?<!\\\\d)(?:\\\\+?1[-.\\\\s]?)?(?:\\\\([2-9]\\\\d{2}\\\\)[-.\\\\s]?|[2-9]\\\\d{2}[-.\\\\s])\\\\d{3}[-.\\\\s]\\\\d{4}(?!\\\\d)","flags":"g"},"requiresNearby":{"labels":["phone","call","mobile","cell","tel","telephone","contact","fax","dial"],"windowChars":160},"examples":["(555) 123-4567","+1-555-123-4567"]}'),aV=JSON.parse('{"specVersion":1,"id":"core-pii/ssn","name":"US Social Security Number","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?!000|666|9\\\\d{2})\\\\d{3}[\\\\s\\\\-](?!00)\\\\d{2}[\\\\s\\\\-](?!0000)\\\\d{4}\\\\b","flags":"g"},"examples":["123-45-6789"]}'),aW=JSON.parse('{"specVersion":1,"id":"core-pii/vin","name":"Vehicle Identification Number","category":"pii","severity":"medium","matcher":{"type":"regex","pattern":"\\\\b[A-HJ-NPR-Z0-9]{17}\\\\b","flags":"g"},"examples":["1HGCM82633A004352"]}'),aX=JSON.parse('{"specVersion":1,"id":"core-pii/zip","name":"US ZIP / ZIP+4 postal code","category":"pii","severity":"low","matcher":{"type":"regex","pattern":"\\\\b\\\\d{5}(?:-\\\\d{4})?\\\\b","flags":"g"},"requiresNearby":{"ruleIds":["core-pii/home-address"],"labels":["address","street","avenue","boulevard","mailing","shipping","billing","suite","p.o. box","po box","postal"],"windowChars":120},"examples":["Shipping address: 123 Main Street, Springfield, IL 94107-1234"]}'),aY=JSON.parse('{"specVersion":1,"id":"secrets-infra/api-key-header","name":"API key in a custom HTTP header","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"[\\"\']?\\\\bapi-?key\\\\b[\\"\']?\\\\s*:\\\\s*[\\"\']?([A-Za-z0-9+/_\\\\-.]{16,500})[\\"\']?","flags":"gi","captureGroup":1},"postValidators":["entropy"],"examples":["X-Api-Key: aBc123XyZ789kLmNoPqRsTuVwXyZ1234567890"]}'),aZ=JSON.parse('{"specVersion":1,"id":"secrets-infra/basic-auth-header","name":"HTTP Basic auth Authorization header","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"authorization\\\\s*:\\\\s*basic\\\\s+[A-Za-z0-9+/=]{16,}","flags":"gi"},"examples":["Authorization: Basic dXNlcjpwYXNzd29yZDEyMzQ="]}'),a$=JSON.parse('{"specVersion":1,"id":"secrets-infra/basic-auth-url","name":"URL with embedded basic auth credentials","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"https?://[A-Za-z0-9_%\\\\-]+:[A-Za-z0-9_%\\\\-]+@[A-Za-z0-9.\\\\-]+","flags":"g"},"examples":["https://user:password@example.com/path"]}'),a_=JSON.parse('{"specVersion":1,"id":"secrets-infra/bearer-token","name":"Generic Authorization Bearer token","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:Bearer|bearer)\\\\s+([A-Za-z0-9_\\\\-.]{20,500})","flags":"g","captureGroup":1},"postValidators":["entropy"],"examples":["Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"]}'),a0=JSON.parse('{"specVersion":1,"id":"secrets-infra/db-connection-string","name":"Database connection string with credentials","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:postgres(?:ql)?|mysql|mongodb(?:\\\\+srv)?|redis|rediss)://[A-Za-z0-9_%\\\\-]+:[A-Za-z0-9_%\\\\-]+@[A-Za-z0-9.\\\\-]+(?:\\\\:\\\\d+)?","flags":"g"},"examples":["postgresql://user:password@localhost:5432/mydb"]}'),a1=JSON.parse('{"specVersion":1,"id":"secrets-infra/docker-config-auth","name":"Docker config.json auth (base64-encoded)","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\"auth\\"\\\\s*:\\\\s*\\"[A-Za-z0-9+/]{12,}={0,2}\\"","flags":"g"},"examples":["\\"auths\\": {\\"https://index.docker.io/v1/\\": {\\"auth\\": \\"dXNlcjpwYXNzd29yZA==\\"}}"]}'),a2=JSON.parse('{"specVersion":1,"id":"secrets-infra/env-key-value","name":"Environment variable assignment with sensitive key","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"\\\\b[A-Za-z0-9_]*(?:API_KEY|API_SECRET|SECRET_KEY|SECRET|TOKEN|PASSWORD|PASS|CREDENTIALS|PRIVATE_KEY|ENCRYPTION_KEY|SIGNING_KEY)\\\\s*=\\\\s*[\\"\']?([^\\\\s\\"\']{4,})","flags":"gi","captureGroup":1},"examples":["API_KEY=aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890"]}'),a3=JSON.parse('{"specVersion":1,"id":"secrets-infra/generic-high-entropy-secret","name":"Generic high-entropy secret assigned to a credential-shaped field","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"(?<![A-Za-z0-9_-])[A-Za-z0-9_]{0,34}(?:(?:secret|token|passw(?:or)?d|credentials?|(?<!api[_-]?)key)(?:[\\"\']?\\\\s*:|\\\\s+=)|(?:passwd|credential|(?<!api[_-]?)(?<!secret_)(?<!private_)(?<!encryption_)(?<!signing_)key)=)\\\\s*[\\"\']?((?!eyJ)[A-Za-z0-9+/_\\\\-]{20,200})","flags":"gi","captureGroup":1},"postValidators":["entropy"],"examples":["authToken: \\"aBc123XyZ789kLmNoPqRsTuVwXyZ1234567890\\"","MASTER_KEY=aBc123XyZ789kLmNoPqRsTuVwXyZ1234567890"]}'),a4=JSON.parse('{"specVersion":1,"id":"secrets-infra/jwt-token","name":"JSON Web Token (JWT)","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"\\\\beyJ[A-Za-z0-9_\\\\-+/]+\\\\.[A-Za-z0-9_\\\\-+/]+\\\\.[A-Za-z0-9_\\\\-+/]+\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"]}'),a5=JSON.parse('{"specVersion":1,"id":"secrets-infra/kubeconfig-token","name":"Kubernetes kubeconfig embedded token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:client-(?:certificate|key)-data|token):\\\\s+([A-Za-z0-9+/=_.-]{20,})","flags":"g","captureGroup":1},"examples":["token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9..."]}'),a6=JSON.parse('{"specVersion":1,"id":"secrets-infra/password-field","name":"JSON/YAML field with password value","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"[\\"\']?\\\\b(?:password|passwd|pwd|pass|secret|token|api[_-]?key|apikey)\\\\b[\\"\']?\\\\s*:\\\\s*[\\"\']([^\\"\'\\\\n]{4,})[\\"\']","flags":"gi","captureGroup":1},"examples":["\\"password\\": \\"supersecret123\\""]}'),a7=JSON.parse('{"specVersion":1,"id":"secrets-infra/pgp-private-key","name":"PGP private key block","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"-----BEGIN PGP PRIVATE KEY BLOCK-----","flags":"g"},"examples":["-----BEGIN PGP PRIVATE KEY BLOCK-----\\nVersion: Keybase Go 1.0.0\\n...\\n-----END PGP PRIVATE KEY BLOCK-----"]}'),a8=JSON.parse('{"specVersion":1,"id":"secrets-infra/ssh-private-key","name":"SSH private key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"-----BEGIN (?:RSA |DSA |EC |OPENSSH |SSH2 )?PRIVATE KEY-----","flags":"g"},"examples":["-----BEGIN RSA PRIVATE KEY-----\\nMIIEpAIBAAKCAQEA...\\n-----END RSA PRIVATE KEY-----"]}'),a9=JSON.parse('{"specVersion":1,"id":"secrets/anthropic-api-key","name":"Anthropic API key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bsk-ant-[A-Za-z0-9_-]{40,}","flags":"g"},"postValidators":["entropy"],"examples":["sk-ant-AbCdEfGhIjKlMnOpQrStUvWxYzAbCdEfGhIjKlMnOpQrStUvWxYz"]}'),ba=JSON.parse('{"specVersion":1,"id":"secrets/aws-access-key","name":"AWS Access Key ID","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(AKIA|ASIA|AROA|AIDA|ANPA|ANVA|APKA)[A-Z0-9]{16}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["AKIAIOSFODNN7EXAMPLE"]}'),bb=JSON.parse('{"specVersion":1,"id":"secrets/aws-secret-key","name":"AWS Secret Access Key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"aws[_.-]?secret[_.-]?(?:access[_.-]?)?key[\\"\'\\\\s:=]{1,5}([A-Za-z0-9/+]{40})","flags":"gi","captureGroup":1},"postValidators":["entropy"],"examples":["AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"]}'),bc=JSON.parse('{"specVersion":1,"id":"secrets/azure-connection-string","name":"Azure connection string","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"(?<![A-Za-z0-9])(?:DefaultEndpointsProtocol|AccountEndpoint|AccountName|AccountKey|SharedAccessSignature|SharedAccessKeyName|SharedAccessKey|EndpointSuffix|BlobEndpoint|QueueEndpoint|TableEndpoint|FileEndpoint|HostName|Endpoint)=(?![{<($])[^\\\\x3B\\\\r\\\\n]{1,400}\\\\x3B(?:[A-Za-z][A-Za-z0-9_]{0,39}=[^\\\\x3B\\\\r\\\\n]{1,400}\\\\x3B){0,10}(?:DefaultEndpointsProtocol|AccountEndpoint|AccountName|AccountKey|SharedAccessSignature|SharedAccessKeyName|SharedAccessKey|EndpointSuffix|BlobEndpoint|QueueEndpoint|TableEndpoint|FileEndpoint|HostName|Endpoint)=(?![{<($])[^\\\\x3B\\\\r\\\\n]{1,400}(?:\\\\x3B[A-Za-z][A-Za-z0-9_]{0,39}=[^\\\\x3B\\\\r\\\\n]{1,400}){0,10}","flags":"g"},"examples":["AccountName=mystorage;AccountKey=abc123=="]}'),bd=JSON.parse('{"specVersion":1,"id":"secrets/cloudflare-api-key","name":"Cloudflare API token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"cloudflare.{0,40}?[\\"\'\\\\s:=]([A-Za-z0-9_-]{40})","flags":"gi","captureGroup":1},"postValidators":["entropy"],"examples":["CLOUDFLARE_API_TOKEN=kQ9fL2mP7xR4tY6wB1nC8vD3jH5sZ0aG2eU4iO7p"]}'),be=JSON.parse('{"specVersion":1,"id":"secrets/datadog-key","name":"Datadog API/Application key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:DD_API_KEY|DD_APP_KEY|DATADOG_API_KEY|DATADOG_APP_KEY)[\\\\s:=]+([A-Za-z0-9]{32,40})\\\\b","flags":"gi","captureGroup":1},"postValidators":["entropy"],"examples":["DD_API_KEY=a3F5g8H1j4K7m2N0p9Q6r1S4t7U0v3W8"]}'),bf=JSON.parse('{"specVersion":1,"id":"secrets/digitalocean-token","name":"DigitalOcean Personal Access Token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bdop_v1_[A-Za-z0-9]{64}\\\\b","flags":"g"},"examples":["dop_v1_1234567890123456789012345678901234567890123456789012345678901234"]}'),bg=JSON.parse('{"specVersion":1,"id":"secrets/discord-token","name":"Discord bot token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b[A-Za-z0-9]{24}\\\\.[A-Za-z0-9]{6}\\\\.[A-Za-z0-9_\\\\-]{27}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["AbCdEfGhIjKlMnOpQrStUvWx.YzAbCd.ABCdEfGhIjKlMnOpQrStUvWxYzAbCdEf"]}'),bh=JSON.parse('{"specVersion":1,"id":"secrets/gcp-service-account","name":"GCP service account key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"(?<![a-z0-9-])[a-z0-9-]{3,}@[a-z0-9][a-z0-9-]{2,60}\\\\.iam\\\\.gserviceaccount\\\\.com\\\\b","flags":"g"},"examples":["deploy-bot@sample-project.iam.gserviceaccount.com","12345678-1234-1234-1234-123456789012@my-project.iam.gserviceaccount.com"]}'),bi=JSON.parse('{"specVersion":1,"id":"secrets/github-pat","name":"GitHub Personal Access Token (classic and fine-grained)","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:gh[psou]_[A-Za-z0-9]{36}|github_pat_[0-9A-Za-z_]{82})\\\\b","flags":"g"},"examples":["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","ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890"]}'),bj=JSON.parse('{"specVersion":1,"id":"secrets/gitlab-token","name":"GitLab Personal/Project Access Token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bglpat-[A-Za-z0-9\\\\-_]{20,40}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["glpat-ABCdEfGhIjKlMnOpQrStUvWxYz1234567890"]}'),bk=JSON.parse('{"specVersion":1,"id":"secrets/heroku-api-key","name":"Heroku API key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"heroku.{0,40}?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})","flags":"gi","captureGroup":1},"examples":["HEROKU_API_KEY=3f8a1c2e-9b4d-4e6f-a1b2-c3d4e5f6a7b8"]}'),bl=JSON.parse('{"specVersion":1,"id":"secrets/npm-token","name":"npm access token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bnpm_[A-Za-z0-9]{36,60}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["npm_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890AbCdEfGhIjKlMnO"]}'),bm=JSON.parse('{"specVersion":1,"id":"secrets/openai-api-key","name":"OpenAI API key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bsk-proj-[A-Za-z0-9]{20,60}\\\\b|\\\\bsk-[A-Za-z0-9]{40,55}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["sk-proj-AbCdEfGhIjKlMnOpQrStUvWxYz1234567890AbCdEfGhIjK"]}'),bn=JSON.parse('{"specVersion":1,"id":"secrets/pulumi-access-token","name":"Pulumi access token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bpul-[A-Za-z0-9]{20,60}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["pul-ABCdEfGhIjKlMnOpQrStUvWxYz1234567890"]}'),bo=JSON.parse('{"specVersion":1,"id":"secrets/sendgrid-key","name":"SendGrid API key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bSG\\\\.[A-Za-z0-9_\\\\-]{20,60}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["SG.AbCdEfGhIjKlMnOpQrStUvWxYzAbCdEfGhIjKlMnOpQrStUvWxYz"]}'),bp=JSON.parse('{"specVersion":1,"id":"secrets/slack-token","name":"Slack API token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:xox[baprs]-[A-Za-z0-9]{10,60}|xapp-[A-Za-z0-9-]{10,60})\\\\b","flags":"g"},"examples":["xoxb-123456789012-123456789012-ABCdEfGhIjKlMnOpQrStUvWx"]}'),bq=JSON.parse('{"specVersion":1,"id":"secrets/stripe-live-key","name":"Stripe live API key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:sk|pk|rk)_live_[A-Za-z0-9]{24,40}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["sk_live_aBcDeFgHiJkLmNoPqRsTuVwXyZ"]}'),br=JSON.parse('{"specVersion":1,"id":"secrets/terraform-cloud-token","name":"Terraform Cloud / TFE user token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b[A-Za-z0-9]{14}\\\\.atlasv1\\\\.[A-Za-z0-9_\\\\-]{60,80}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["AbCdEfGhIjKlMnOp.atlasv1.XyZ1234567890123456789012345678901234567890123456789012345678901234567890"]}'),bs=[{packId:"code-flaws",name:"Code Security Flaws",version:"0.1.0",rawRules:[af,ae,ag,ah,P,N,O,ak,aj,al,U,V,T,$,_,W,X,Y,M,L,ab,aa,R,S,Q,ac,Z,ai,ad]},{packId:"core-code-context",name:"Code Context",version:"0.1.0",rawRules:[aq,as,ap,ao,at,ar,an,am]},{packId:"core-financial",name:"Financial Information",version:"0.1.0",rawRules:[au,ax,az,aB,aw,av,ay,aA]},{packId:"core-phi",name:"Protected Health Information",version:"0.1.0",rawRules:[aI,aF,aH,aE,aG,aJ,aD,aC]},{packId:"core-pii",name:"Core PII",version:"0.2.0",rawRules:[aM,aV,aU,aT,aO,aK,aL,aS,aN,aQ,aW,aP,aR,aX]},{packId:"secrets",name:"Secrets & Credentials",version:"0.1.0",rawRules:[ba,bb,bh,bc,bm,a9,bq,bp,bg,bo,JSON.parse('{"specVersion":1,"id":"secrets/twilio-key","name":"Twilio Account SID","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bAC[A-Za-z0-9]{32}\\\\b","flags":"g"},"examples":["AC12345678901234567890123456789012"]}'),bj,bf,be,bl,bk,bd,bn,br,JSON.parse('{"specVersion":1,"id":"secrets/vault-token","name":"HashiCorp Vault token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:hvs\\\\.[A-Za-z0-9\\\\-_]{20,50}|s\\\\.[A-Za-z0-9\\\\-_]{20,50})\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["hvs.AbCdEfGhIjKlMnOpQrStUvWxYz1234567890"]}'),bi]},{packId:"secrets-infra",name:"Infrastructure Secrets",version:"0.1.0",rawRules:[a8,a0,a4,a$,aZ,a7,a_,a2,a6,a1,a5,aY,a3]}];function bt(a){try{let b=bw(a);if(!b)return;let c=bx(b),d=c?.headRoot??b,e=c?function(a){let b=by(a.configPath);if(void 0===b)return;let c=function(a){let b,c={};for(let d of a.split("\n")){let a=d.trim(),e=/^\[remote "([^"]+)"\]$/.exec(a);if(e){b=e[1];continue}if(a.startsWith("[")){b=void 0;continue}if(b&&!(b in c)){let d=/^url\s*=\s*(.+)$/.exec(a)?.[1];d&&(c[b]=d.trim())}}return c}(b);return c.origin??Object.values(c)[0]}(c):void 0;return{url:e??d.split(q.sep).join("/"),name:(e?function(a){let b=a.replace(/\.git$/,"").split(/[/:]/).filter(Boolean).pop();return b&&b.length>0?b:void 0}(e):void 0)??(0,q.basename)(d)}}catch{return}}function bu(a){try{return bw(a)}catch{return}}function bv(a){try{let b=bw(a);if(!b)return;return bx(b)?.headRoot??b}catch{return}}function bw(a){let b=a;for(;;){if((0,p.existsSync)((0,q.join)(b,".git")))return b;let a=(0,q.dirname)(b);if(a===b)return;b=a}}function bx(a){let b=(0,q.join)(a,".git");try{if((0,p.statSync)(b).isDirectory())return{configPath:(0,q.join)(b,"config"),headRoot:a}}catch{return}let c=/^gitdir:\s*(.+?)\s*$/m.exec(by(b)??"")?.[1];if(!c)return;let d=(0,q.isAbsolute)(c)?c:(0,q.join)(a,c);if((0,p.existsSync)((0,q.join)(d,"config")))return{configPath:(0,q.join)(d,"config"),headRoot:a};let e=by((0,q.join)(d,"commondir"))?.trim();if(!e)return;let f=(0,q.isAbsolute)(e)?e:(0,q.join)(d,e),g=".git"===(0,q.basename)(f)?(0,q.dirname)(f):a;return{configPath:(0,q.join)(f,"config"),headRoot:g}}function by(a){try{return(0,p.readFileSync)(a,"utf8")}catch{return}}var bz=c(77598),bA=c(75919);function bB(a){return a instanceof Error?a.message:String(a)}function bC(a,b={}){let c,d,f,g,h=b.budgetMs??2e3,i=b.probeBudgetMs??1e3,j=b.startBudgetMs??5e3,k=b.minAttributionMs??500,l=!1,m=1,n=new Set,o=Promise.resolve();function q(){let a=g;if(a)return g=void 0,void 0!==a.startupTimer&&clearTimeout(a.startupTimer),void 0!==a.timer&&clearTimeout(a.timer),c?.unref(),a}function s(a){q()?.fail(a)}function t(a){c===a&&(c=void 0),d===a&&(d=void 0);let b=a.terminate().catch(()=>void 0);n.add(b),b.finally(()=>n.delete(b))}function u(a){void 0!==a.startupTimer&&(clearTimeout(a.startupTimer),a.startupTimer=void 0),void 0===a.timer&&(a.startedAt=performance.now(),a.progressAt=a.startedAt,a.timer=setTimeout(()=>{!function(a){if(g!==a)return;let b=performance.now(),c=b-a.progressAt,d=b-a.startedAt,e=a.progressIndex>=0&&c>=k&&c>=.5*d?a.progressIndex:void 0;t(a.worker),s({status:"timeout",culpritIndex:e,elapsedMs:d})}(a)},a.budgetMs))}function v(h,i){if(l)return void i({status:"unavailable",reason:"the scan worker is closed"});if(void 0!==f)return void i({status:"unavailable",reason:`the scan worker crashed: ${f}`});let k=function(){let h;if(c)return c;let i=b.workerUrl??function(){if(void 0!==e)return e??void 0;for(let a of["scan-worker.js","scan-worker.ts"]){let b=new URL(a,"file:///home/runner/work/ai-tc/ai-tc/packages/plugin-sdk/src/isolated-scan.ts");try{if((0,p.existsSync)((0,r.fileURLToPath)(b)))return e=b,b}catch{}}e=null}();if(!i)return{error:"the scan worker script was not found next to this bundle"};try{h=new bA.Worker(i,{workerData:a})}catch(a){return{error:`could not start the scan worker: ${bB(a)}`}}return b.onWorkerStart?.(h.threadId),h.on("message",a=>{if(c!==h)return;if("ready"===a.kind){d=h,g?.worker===h&&u(g);return}if("progress"===a.kind){g?.worker===h&&(g.progressIndex=a.index,g.progressAt=performance.now());return}if(g?.id!==a.id)return;if("failed"===a.kind)return void s({status:"unavailable",reason:`the scan worker failed: ${a.message}`});let b=q();b&&!b.reply(a)&&b.fail({status:"unavailable",reason:"the scan worker answered the wrong job"})}),h.on("error",a=>{c===h&&(f=bB(a),c=void 0,d===h&&(d=void 0),s({status:"unavailable",reason:`the scan worker crashed: ${f}`}))}),h.on("exit",()=>{c===h&&(f??="the scan worker exited before answering",c=void 0,d===h&&(d=void 0),s({status:"unavailable",reason:"the scan worker exited before answering"}))}),h.unref(),c=h,h}();if(!(k instanceof bA.Worker)){f=k.error,i({status:"unavailable",reason:k.error});return}let n=m++,o=performance.now(),v={id:n,worker:k,budgetMs:h.budgetMs,startedAt:o,progressIndex:-1,progressAt:o,startupTimer:void 0,timer:void 0,reply:h.reply,fail:i};g=v,k.ref(),d===k?u(v):v.startupTimer=setTimeout(()=>{g===v&&(t(v.worker),s({status:"unavailable",reason:`the scan worker did not start within ${String(j)}ms`}))},j);try{k.postMessage(h.build(n))}catch(a){s({status:"unavailable",reason:`could not reach the scan worker: ${bB(a)}`})}}function w(a){let b=o.then(()=>new Promise(b=>{a(b)}));return o=b.then(()=>void 0,()=>void 0),b}return{scan:(a,b,c)=>w(d=>{v({budgetMs:h,build:d=>({kind:"scan",id:d,text:a,filePath:b?.filePath,attribute:c?.attribute===!0}),reply:a=>"result"===a.kind&&(d({status:"ok",findings:a.findings}),!0)},d)}),probe:a=>w(b=>{v({budgetMs:i,build:b=>({kind:"probe",id:b,rule:a}),reply:a=>"probed"===a.kind&&(b({status:"ok",safe:a.safe,worstMs:a.worstMs}),!0)},b)}),async close(){l=!0;let a=c;c=void 0,d=void 0,s({status:"unavailable",reason:"the scan worker is closed"}),a&&t(a),await Promise.all([...n])}}}function bD(a){if("regex"===a.matcher.type){var b;return b=`${a.matcher.pattern} ${a.matcher.flags}`,(0,bz.createHash)("sha256").update(b).digest("hex")}}function bE(a,b,c,d){process.stderr.write(`[aka] ${b} rule "${a.id}": ${c}${d?" (clear it with `aka detections unquarantine`)":""}
+`)}function bF(a,b,c){bE(a,"quarantined",Number.isFinite(b)?`regex matcher exceeded the ReDoS timing budget (${b.toFixed(1)}ms); excluded from this scan.`:"the timing battery failed while measuring its regex matcher; excluded from this scan.",c)}async function bG(a,b,c,d){let e=bD(b),f=!1;if(void 0!==e)try{await a.setRuleProbeVerdict(e,"quarantined",c),f=!0}catch{}bE(b,"quarantined",d,f)}async function bH(a,b,c){let d=c?.passBudgetMs??2e3,e=c?.prober,f=performance.now(),g=[],h=new Map;try{for(let c of a){let a,i,j,k=bD(c);if(void 0===k){g.push(c);continue}try{a=await b.getRuleProbeVerdict(k)}catch{a=void 0}if(a){"safe"===a.verdict?g.push(c):bF(c,a.worstProbeMs,!0);continue}if(performance.now()-f>=d){bE(c,"skipped","the timing pre-flight ran out of time before this rule could be measured; excluded for the rest of this run, and measured again next time.",!1);continue}if(e){let a=await e.probe(c);if("unavailable"===a.status){h.set(a.reason,(h.get(a.reason)??0)+1);continue}i="ok"===a.status&&a.safe,j="ok"===a.status?a.worstMs:a.elapsedMs}else try{({safe:i,worstMs:j}=(0,F.r4)(c))}catch{i=!1,j=1/0}let l=!1;try{await b.setRuleProbeVerdict(k,i?"safe":"quarantined",j),l=!0}catch{}i?g.push(c):bF(c,j,l)}}finally{for(let[a,b]of h)process.stderr.write(`[aka] ${String(b)} pulled/custom-pack rule(s) could not be time-checked: ${a}. That is a problem with this install, not with the rules — until it is fixed they are excluded from every scan on this machine. Nothing was quarantined, so reinstalling AKA brings them straight back.
+`)}return g}function bI(a,b,c){process.stderr.write(`[aka] isolated scanning is off for ${a}: ${c}. ${String(b)} pulled/custom-pack rule(s) are excluded; the built-in packs still run.
+`)}function bJ(a){return a.split(q.sep).join("/")}var bK=c(28893),bL=c.n(bK);let bM=new Set([".git","node_modules",".pnpm-store",".venv","venv","__pycache__",".next",".turbo","dist","build","out","coverage","target",".cache"]);function bN(a,b,c){let d=!1;for(let e of a){let a=(0,q.relative)(e.base,b).split(q.sep).join("/")+(c?"/":""),f=e.matcher.test(a);f.ignored?d=!0:f.unignored&&(d=!1)}return d}let bO=new Set(["pnpm-lock.yaml","package-lock.json","yarn.lock","cargo.lock","poetry.lock","gemfile.lock","composer.lock","go.sum"]),bP=new Set([".yml",".yaml",".toml",".ini",".properties",".conf"]),bQ=new Set([".md",".mdx",".rst",".adoc",".txt"]),bR=new Set(["cmakelists.txt","constraints.txt","robots.txt"]),bS=new Set([".csv",".tsv",".parquet",".sql",".jsonl",".ndjson"]),bT=new Set(["package.json","dockerfile","makefile","justfile",".gitignore",".gitattributes",".npmrc",".nvmrc",".editorconfig",".akaignore"]),bU=H.vk(a=>{if("string"!=typeof a||""!==a.trim())return a},H.Yj().optional()).catch(void 0),bV=H.vk(a=>{if("string"!=typeof a)return!1;let b=a.trim().toLowerCase();return""!==b&&"0"!==b&&"false"!==b},H.zM()).catch(!1);H.Ik({GOOGLE_GENAI_USE_VERTEXAI:bV,GOOGLE_GEMINI_BASE_URL:bU});let bW=H.vk(a=>{if("string"!=typeof a||""!==a.trim())return a},H.Yj().optional()).catch(void 0);function bX(a,b,c,d=(0,G.tI)()){try{let e,f,g,h;if(!(0,G.xR)(d).dataSharesInPlace)return null;let i=(0,q.resolve)(b),j=(0,p.statSync)(i).isDirectory()?i:(0,q.dirname)(i),k=bt(i),l=bu(i);k&&l?(e=l,f=`git:${k.url}`,g=k.name,h=a.sourceProject.upsert({url:k.url,name:k.name,attributes:{}})):({root:e,projectKey:f,project:g}=function(a,b){let c=function(a,b){let c=a,d=null;for(let a=0;a<40;a+=1){(function(a,b){try{for(let c of(0,p.readdirSync)(a,{withFileTypes:!0}))if(c.isFile()&&null!=b(c.name))return!0}catch{}return!1})(c,b)&&(d=c);let a=(0,q.dirname)(c);if(a===c)break;c=a}return d??a}(a,b),d=(0,p.realpathSync)(c);return{root:c,projectKey:`path:${d}`,project:(0,q.basename)(d)}}(j,F.DK),h=null);let m=[];for(let a of c.files){let b=bJ((0,q.relative)(e,a.file));!(""===b||b.startsWith("../"))&&(b.startsWith(".")||b.includes("/.")||m.push({...a,file:b,vendored:(0,F.$1)(b)}))}return{...a.shares.recordProjectEgress({projectKey:f,project:g,projectId:h,reconcile:{mode:"walk",walkedPrefix:bJ((0,q.relative)(e,i))},hits:(0,F.Ip)(m)}),project:g}}catch{return null}}H.Ik({OPENAI_BASE_URL:bW});let bY=new Set(["node_modules",".git","dist",".next","coverage",".turbo","build","out"]);function bZ(a,b){try{let c=(0,p.readFileSync)((0,q.join)(a,b),"utf8");return{base:a,matcher:bL()().add(c)}}catch{return}}function b$(a,b,c){let d="unmatched";for(let e of a){let a=bJ((0,q.relative)(e.base,b))+(c?"/":""),f=e.matcher.test(a);f.ignored?d="ignored":f.unignored&&(d="unignored")}return d}async function b_(a,b,c={}){let d,e=c.scanText??(a=>Promise.resolve((0,F.SQ)(a,c.rules))),f=0,g=0,h=[],i=[];for(let{path:j,gitignored:k}of function*(a){let b;try{b=(0,p.statSync)(a)}catch{return}if(b.isFile()){b.size<=1e6&&(yield{path:a,gitignored:!1});return}b.isDirectory()&&(yield*function* a(b,c,d,e){let f=e?void 0:bZ(b,".gitignore"),g=f?[...c,f]:c,h=bZ(b,".akaignore"),i=h?[...d,h]:d;for(let c of(0,p.readdirSync)(b,{withFileTypes:!0})){let d=(0,q.join)(b,c.name);if(c.isDirectory()){let b=b$(i,d,!0);if("unignored"!==b&&(bY.has(c.name)||c.name.startsWith(".")||"ignored"===b))continue;let f=e||"ignored"===b$(g,d,!0);yield*a(d,g,i,f)}else if(c.isFile()){let a;if("ignored"===b$(i,d,!1))continue;try{a=(0,p.statSync)(d).size}catch{continue}if(a>1e6)continue;yield{path:d,gitignored:e||"ignored"===b$(g,d,!1)}}}}(a,[],[],!1))}((0,q.resolve)(b))){let b;try{b=(0,p.readFileSync)(j,"utf8")}catch{continue}f++;let l=function(a,b){if(b.includes("\0"))return null;let c=(0,q.basename)(a);if(F.mu.has(c))return null;let d=(0,F.DK)(c),e=null===d?[]:(0,F.W$)(b,d),f=null===d&&F.Nc.has((0,q.extname)(a))?(0,F.Pb)(b):[];return 0===f.length&&0===e.length?null:{file:a,vendored:(0,F.$1)(bJ(a)),endpoints:f,sdkHits:e}}(j,b);l&&i.push(l);let m=(0,F.KD)(b),n=(0,F.uT)(await e(m.text),m.spans);if(0===n.length)continue;let o=(0,bz.randomUUID)(),r={filePath:j};k&&(r.gitignored=!0);let s={id:o,sourceTool:c.sourceTool??"cli",kind:"code_change",occurredAt:new Date().toISOString(),contentHash:(0,bz.createHash)("sha256").update(b).digest("hex"),content:(0,F.E$)(b,n),metadata:r},t=n.map(a=>{let b=(0,F.sE)(a.rawMatch),e=function(){if(void 0===d)try{d=c.dataDir?(0,G.Rd)(c.dataDir):null}catch{d=null}return d}(),f=e?(0,G._2)(e,a.rawMatch):b;return{id:(0,bz.randomUUID)(),eventId:o,ruleId:a.ruleId,category:a.category,severity:a.severity,span:a.span,maskedMatch:b,actionTaken:c.ruleActions?.get(a.ruleId)??K.unw[a.category],confidence:a.confidence,findingKey:(0,G.Qo)({ruleId:a.ruleId,filePath:j,valueFingerprint:f})}});a.recordCapture(s,t),h.push({path:j,gitignored:k,findings:t}),g+=t.length}return{scanned:f,findings:g,files:h,egress:{files:i}}}let b0={status:"unavailable",reason:"this build shipped without its scan worker, so there was nowhere killable to measure them"};async function b1(a,b,c={}){let e,g={getRuleProbeVerdict:b=>Promise.resolve(a.ruleProbeCache.getVerdict(b)),setRuleProbeVerdict:(b,c,d)=>(a.ruleProbeCache.setVerdict(b,c,d),Promise.resolve())},h=c.workerUrl,i={workerUrl:h,budgetMs:c.budgetMs,probeBudgetMs:c.probeBudgetMs,startBudgetMs:c.startBudgetMs},j=f??=new Set((d??=bs.map(a=>({namespace:"aka",packId:a.packId,version:a.version,name:a.name,rules:a.rawRules.map(a=>K.jON.parse(a))}))).flatMap(a=>a.rules).map(bD).filter(a=>void 0!==a)),k=[],l=[];for(let a of b){let b=bD(a);void 0!==b&&j.has(b)?k.push(a):l.push(a)}let m=await bH(l,g,{passBudgetMs:c.passBudgetMs,prober:{probe:a=>void 0===h?Promise.resolve(b0):(e??=bC({verified:[],unverified:[]},i)).probe(a)}});await e?.close();let n=new Set(m),o=0,p=0;for(let a of l){let b;if(n.has(a))continue;let c=bD(a);try{b=void 0===c?void 0:(await g.getRuleProbeVerdict(c))?.verdict}catch{b=void 0}"quarantined"===b?o++:p++}let q=[...k],r=[],s=0;for(let a of m)"regex"!==a.matcher.type?q.push(a):void 0!==h?r.push(a):s++;let t=function(a,b,c){let d=c?.degradeScope??"the rest of this process",e=a.verified,f=a.unverified,g=f.length>0?bC({verified:e,unverified:f},c):void 0,h=!1;async function i(){let a=g;g=void 0,f=[],a&&await a.close()}async function j(){h=!0,await i()}async function k(a,b,c,d){try{return await a.scan(b,c,{attribute:d})}catch(a){return{status:"unavailable",reason:a instanceof Error?a.message:"the scan worker failed unexpectedly"}}}return{scan:async function(a,c){let h=g;if(!h)return(0,F.SQ)(a,e,c);let i=await k(h,a,c,!1);if("ok"===i.status)return i.findings;"timeout"===i.status&&(i=await k(h,a,c,!0));let l=f.length;if("ok"===i.status){bI(d,l,"a scan overran its bound once and no rule could be held responsible");let a=i.findings;return await j(),a}if("timeout"===i.status){let a=void 0===i.culpritIndex?void 0:f[i.culpritIndex];a&&await bG(b,a,i.elapsedMs,`it did not finish within the ${i.elapsedMs.toFixed(0)}ms isolated-scan bound and was terminated; excluded from every later scan.`),bI(d,l,a?`rule "${a.id}" had to be terminated mid-scan`:`a scan was terminated at the ${i.elapsedMs.toFixed(0)}ms bound and no single rule could be held responsible, so nothing was quarantined and the next process will try these rules again`)}else bI(d,l,i.reason);return await j(),(0,F.SQ)(a,e,c)},degraded:()=>h,async close(){await i()}}}({verified:q,unverified:r},g,{...i,degradeScope:"the rest of this scan"});return p+=s,{scanText:a=>t.scan(a),dropped:()=>({quarantined:o,unmeasured:p,bound:t.degraded()?r.length:0,isolated:void 0!==h}),close:()=>t.close()}}function b2(a,b){try{let c=(0,q.resolve)(b);(0,p.statSync)(c);let d=bt(c);if(!d)return null;let e=a.sourceProject.upsert({url:d.url,name:d.name,attributes:{}}),f=function(a){try{let b=bu(a);if(!b)return;let c=bv(a)!==b,d=[],e={lostSubtree:!1},f=function a(c,f){let g;try{g=(0,p.readdirSync)(c,{withFileTypes:!0,encoding:"utf8"})}catch{return e.lostSubtree=!0,!1}let h=function(a){try{let b=(0,p.readFileSync)((0,q.join)(a,".gitignore"),"utf8");return{base:a,matcher:bL()().add(b)}}catch{return}}(c),i=h?[...f,h]:f;for(let e of g){let f=(0,q.join)(c,e.name);if(e.isDirectory()){if(bM.has(e.name)||bN(i,f,!0)||(0,p.existsSync)((0,q.join)(f,".git")))continue;if(a(f,i))return!0;continue}if(!e.isFile()||".git"===e.name||bN(i,f,!1))continue;if(d.length>=2e4)return!0;let g=(0,q.relative)(b,f).split(q.sep).join("/");d.push({path:g,name:(0,q.basename)(e.name),origin:function(a,b){let c=b.toLowerCase(),d=c.lastIndexOf("."),e=d>0?c.slice(d):"",f=a.split("/");return bO.has(c)||c.includes(".generated.")||f.includes("__generated__")||f.includes("generated")||".map"===e||c.endsWith(".min.js")||c.endsWith(".min.css")?"generated":f.includes("vendor")||f.includes("third_party")?"vendored":bR.has(c)||".txt"===e&&c.startsWith("requirements")?"config":bQ.has(e)||c.startsWith("license")||"docs"===f[0]?"docs":bS.has(e)||f.includes("fixtures")||f.includes("__fixtures__")?"data":bT.has(c)||bP.has(e)||c.startsWith(".")||c.includes(".config.")||c.startsWith("tsconfig")?"config":"source"}(g,e.name),defaultAccess:"approved"})}return!1}(b,[])||e.lostSubtree||c;if(0===d.length)return;return d.sort((a,b)=>a.path.localeCompare(b.path)),{files:d,truncated:f,scannedAt:new Date().toISOString()}}catch{return}}(c);f&&a.recordProjectFiles(e,f);let g=bv(c),h=bu(c);return g&&h&&a.reconcileWorktreeProjects(e,g,h),{projectId:e,name:d.name,url:d.url,fileCount:f?.files.length??0,truncated:f?.truncated??!1}}catch{return null}}function b3(a){return(0,q.join)((0,G.KS)(a),"update-check.json")}function b4(a){try{(0,p.rmSync)(b3(a),{force:!0})}catch{}}function b5(a){let b=function(a){let b=b3(a);if(!(0,p.existsSync)(b))return null;try{let a=JSON.parse((0,p.readFileSync)(b,"utf8"));if(!w(a)||"number"!=typeof a.checkedAt||!w(a.report))return null;return a}catch{return null}}(a);var c={checkedAt:Date.now(),report:function(a){let b=a.viewVersion(v),c=[{id:"cli",name:"aka CLI",kind:"cli",installed:a.cliInstalled,latest:b,updateAvailable:null!==a.cliInstalled&&null!==b&&u(b,a.cliInstalled)>0}],d=[];for(let b of n){let e=o(b);if(!e||!b.npmPackage)continue;let f=a.viewVersion(b.npmPackage),g=a.installed.get(e)??null;if(null===g){d.push({id:b.id,name:b.name,latest:f});continue}c.push({id:b.id,name:b.name,kind:"plugin",installed:g,latest:f,updateAvailable:null!==f&&u(f,g)>0})}return{statuses:c,availablePlugins:d}}({viewVersion:x,installed:new Map([...function(a=(0,q.join)((0,h.homedir)(),".claude")){let b,c=new Map,d=(0,q.join)(a,"plugins","installed_plugins.json");if(!(0,p.existsSync)(d))return c;try{b=JSON.parse((0,p.readFileSync)(d,"utf8"))}catch{return c}if(!w(b)||!w(b.plugins))return c;for(let[a,d]of Object.entries(b.plugins)){if(!Array.isArray(d)||0===d.length)continue;let b=d.find(a=>w(a)&&"user"===a.scope)??d.find(a=>w(a));b&&"string"==typeof b.version&&c.set(a,b.version)}return c}(void 0),...function(a=(0,q.join)((0,h.homedir)(),".codex")){let b=new Map,c=(0,q.join)(a,"plugins","cache");for(let a of n){if("codex"!==a.cliBin)continue;let d=o(a);if(!d||!a.pluginName||!a.marketplace)continue;let e=function(a){let b;try{b=(0,p.readdirSync)(a,{withFileTypes:!0}).filter(a=>a.isDirectory()).map(a=>a.name)}catch{return null}if(0===b.length)return null;if(b.includes("local"))return"local";let c=b.filter(t);return 0===c.length?null:c.reduce((a,b)=>u(b,a)>0?b:a)}((0,q.join)(c,a.marketplace,a.pluginName));null!==e&&b.set(d,e)}return b}(void 0)]),cliInstalled:function(a){let b=(void 0)??(0,q.dirname)((0,r.fileURLToPath)("file:///home/runner/work/ai-tc/ai-tc/packages/local-ops/src/updates.ts"));for(let a=0;a<6;a++){let a=(0,q.join)(b,"package.json");if((0,p.existsSync)(a))try{let b=JSON.parse((0,p.readFileSync)(a,"utf8"));if(w(b)&&b.name===v&&"string"==typeof b.version)return b.version}catch{}let c=(0,q.dirname)(b);if(c===b)break;b=c}return null}()}),notifiedPluginIds:b?.notifiedPluginIds??[]};if((0,p.existsSync)((0,G.KS)(a)))try{(0,G.g5)(b3(a),`${JSON.stringify(c,null,2)}
+`)}catch{}}}};