@akasecurity/cli 0.9.6 → 0.9.8

package/web-ui/web-ui/.next/server/chunks/271.js

@@ -0,0 +1,6 @@
+exports.id=271,exports.ids=[271],exports.modules={57427:a=>{function b(a){return Array.isArray(a)?a:[a]}let c=void 0,d=/^\s+$/,e=/(?:[^\\]|^)\\$/,f=/^\\!/,g=/^\\#/,h=/\r?\n/g,i=/^\.{0,2}\/|^\.{1,2}$/,j=/\/$/,k="node-ignore";"undefined"!=typeof Symbol&&(k=Symbol.for("node-ignore"));let l=k,m=(a,b,c)=>(Object.defineProperty(a,b,{value:c}),c),n=/([0-z])-([0-z])/g,o=()=>!1,p=[[/^\uFEFF/,()=>""],[/((?:\\\\)*?)(\\?\s+)$/,(a,b,c)=>b+(0===c.indexOf("\\")?" ":"")],[/(\\+?)\s/g,(a,b)=>{let{length:c}=b;return b.slice(0,c-c%2)+" "}],[/[\\$.|*+(){^]/g,a=>`\\${a}`],[/(?!\\)\?/g,()=>"[^/]"],[/^\//,()=>"^"],[/\//g,()=>"\\/"],[/^\^*(?:\\\*\\\*\\\/)+/,()=>"^(?:.*\\/)?"],[/^(?=[^^])/,function(){return/\/(?!$)/.test(this)?"^":"(?:^|\\/)"}],[/\\\/\\\*\\\*(?=\\\/|$)/g,(a,b,c)=>b+6<c.length?"(?:\\/[^\\/]+)*":"\\/.+"],[/(^|[^\\]+)(\\\*)+(?=.+)/g,(a,b,c)=>b+c.replace(/\\\*/g,"[^\\/]*")],[/\\\\\\(?=[$.|*+(){^])/g,()=>"\\"],[/\\\\/g,()=>"\\"],[/(\\)?\[([^\]/]*?)(\\*)($|\])/g,(a,b,c,d,e)=>"\\"===b?`\\[${c}${(a=>{let{length:b}=a;return a.slice(0,b-b%2)})(d)}${e}`:"]"===e&&d.length%2==0?`[${(a=>a.startsWith("!")||a.startsWith("\\^")?`^${a.slice("!"===a[0]?1:2)}`:a)(c.replace(n,(a,b,c)=>b.charCodeAt(0)<=c.charCodeAt(0)?a:""))}${d}]`:"[]"],[/(?:[^*])$/,a=>/\/$/.test(a)?`${a}$`:`${a}(?=$|\\/$)`]],q=/(^|\\\/)?\\\*$/,r="regex",s="checkRegex",t={[r](a,b){let c=b?`${b}[^/]+`:"[^/]*";return`${c}(?=$|\\/$)`},[s](a,b){let c=b?`${b}[^/]*`:"[^/]*";return`${c}(?=$|\\/$)`}};class u{constructor(a,b,c,d,e,f){this.pattern=a,this.mark=b,this.negative=e,m(this,"body",c),m(this,"ignoreCase",d),m(this,"regexPrefix",f)}get regex(){let a="_"+r;return this[a]?this[a]:this._make(r,a)}get checkRegex(){let a="_"+s;return this[a]?this[a]:this._make(s,a)}_make(a,b){let c=this.regexPrefix.replace(q,t[a]);return m(this,b,this.ignoreCase?RegExp(c,"i"):new RegExp(c))}}class v{constructor(a){this._ignoreCase=a,this._rules=[]}_add(a){let b;if(a&&a[l]){this._rules=this._rules.concat(a._rules._rules),this._added=!0;return}if("string"==typeof a&&(a={pattern:a}),(b=a.pattern)&&"string"==typeof b&&!d.test(b)&&!e.test(b)&&0!==b.indexOf("#")){let b=(({pattern:a,mark:b},c)=>{let d,e=!1,h=a;0===h.indexOf("!")&&(e=!0,h=h.substr(1));let i=(d=h=h.replace(f,"!").replace(g,"#"),p.reduce((a,[b,c])=>a.replace(b,c.bind(d)),d));return new u(a,b,h,c,e,i)})(a,this._ignoreCase);this._added=!0,this._rules.push(b)}}add(a){return this._added=!1,b("string"==typeof a?a.split(h).filter(Boolean):a).forEach(this._add,this),this._added}test(a,b,d){let e,f=!1,g=!1;this._rules.forEach(h=>{let{negative:i}=h;(g!==i||f===g)&&(!i||f||g||b)&&h[d].test(a)&&(f=!i,g=i,e=i?c:h)});let h={ignored:f,unignored:g};return e&&(h.rule=e),h}}let w=(a,b)=>{throw new b(a)},x=(a,b,c)=>"string"!=typeof a?c(`path must be a string, but got \`${b}\``,TypeError):a?!x.isNotRelative(a)||c(`path should be a \`path.relative()\`d string, but got "${b}"`,RangeError):c("path must not be empty",TypeError),y=a=>i.test(a);x.isNotRelative=y,x.convert=a=>a;class z{constructor({ignorecase:a=!0,ignoreCase:b=a,allowRelativePaths:c=!1}={}){m(this,l,!0),this._rules=new v(b),this._strictPathCheck=!c,this._initCache()}_initCache(){this._ignoreCache=Object.create(null),this._testCache=Object.create(null)}add(a){return this._rules.add(a)&&this._initCache(),this}addPattern(a){return this.add(a)}_test(a,b,c,d){let e=a&&x.convert(a);return x(e,a,this._strictPathCheck?w:o),this._t(e,b,c,d)}checkIgnore(a){if(!j.test(a))return this.test(a);let b=a.split("/").filter(Boolean);if(b.pop(),b.length){let a=this._t(b.join("/")+"/",this._testCache,!0,b);if(a.ignored)return a}return this._rules.test(a,!1,s)}_t(a,b,c,d){if(a in b)return b[a];if(d||(d=a.split("/").filter(Boolean)),d.pop(),!d.length)return b[a]=this._rules.test(a,c,r);let e=this._t(d.join("/")+"/",b,c,d);return b[a]=e.ignored?e:this._rules.test(a,c,r)}ignores(a){return this._test(a,this._ignoreCache,!1).ignored}createFilter(){return a=>!this.ignores(a)}filter(a){return b(a).filter(this.createFilter())}test(a){return this._test(a,this._testCache,!0)}}let A=a=>new z(a),B=()=>{x.convert=a=>/^\\\\\?\\/.test(a)||/["<>|\u0000-\u001F]+/u.test(a)?a:a.replace(/\\/g,"/");let a=/^[a-z]:\//i;x.isNotRelative=b=>a.test(b)||y(b)};"undefined"!=typeof process&&"win32"===process.platform&&B(),a.exports=A,A.default=A,a.exports.isPathValid=a=>x(a&&x.convert(a),a,o),m(a.exports,Symbol.for("setupWindows"),B)},64271:(a,b,c)=>{"use strict";let d,e,f;c.d(b,{S1:()=>R,tq:()=>U,IL:()=>cq,Lr:()=>cn,yy:()=>M,UE:()=>V,US:()=>cj,f2:()=>co,u5:()=>cr,OF:()=>cl});var g=c(31421),h=c(48161);let i="win32"===process.platform,j=/[\s&|^<>()"]/;function k(a){return j.test(a)?`"${a.replaceAll('"','""')}"`:a}let l=/^[\w@%+=:,./-]+$/;function m(a){return i?a.map(k):a}let n="win32"===process.platform?{cwd:(0,h.homedir)()}:{};function o(a){let b="win32"===process.platform?"where":"command",c="win32"===process.platform?[a]:["-v",a];try{let a=(0,g.spawnSync)(b,c,{stdio:"ignore",shell:"win32"!==process.platform,...n});return 0===a.status}catch{return!1}}function p(a,b,c=15e3){try{let d=(0,g.execFileSync)(a,m(b),{encoding:"utf8",timeout:c,stdio:["ignore","pipe","pipe"],shell:i,...n});return{ok:!0,stdout:d.trim(),stderr:""}}catch(a){return{ok:!1,stdout:"string"==typeof a.stdout?a.stdout.trim():"",stderr:"string"==typeof a.stderr?a.stderr.trim():""}}}function q(a,b){try{return(0,g.execFileSync)(a,m(b),{stdio:"inherit",shell:i,...n}),!0}catch{return!1}}let r={claude:{install:a=>[["plugin","install",a]],update:a=>[["plugin","update",a]],register:a=>[["plugin","marketplace","add",a]],refresh:a=>[["plugin","marketplace","update",a]]},codex:{install:a=>[["plugin","add",a]],update:a=>[["plugin","add",a]],register:a=>[["plugin","marketplace","add",a]],refresh:a=>[["plugin","marketplace","upgrade",a]]}};function s(a){let b=r[a],c=b=>b.every(b=>q(a,[...b])),d=b=>b.map(b=>`${a} ${b.join(" ")}`),e=(a,c)=>[...b.register(a),...c?b.refresh(c):[]],f=(a,c)=>d([...c?b.register(c):[],...a]),g=(a,b,c)=>d([...b?e(b,c):[],...a]);return{available:()=>o(a),marketplaceSteps:e,installSteps:a=>b.install(a),updateSteps:a=>b.update(a),installRecipe:(a,c)=>f(b.install(a),c),updateRecipe:(a,c)=>f(b.update(a),c),installSpawnPlan:(a,c,d)=>g(b.install(a),c,d),updateSpawnPlan:(a,c,d)=>g(b.update(a),c,d),install:a=>c(b.install(a)),update:a=>c(b.update(a))}}var t=c(73024),u=c(76760),v=c(73136),w=c(85002);let x=[{id:"claude-code",name:"Claude Code",sourceTool:w.Zdp.ClaudeCode,description:"Hooks Claude Code sessions to detect + redact sensitive data in prompts, responses, and file writes.",npmPackage:"@akasecurity/ai-tc-claude-code",pluginName:"ai-tc",marketplace:"akasecurity",marketplaceSource:"akasecurity/marketplace",cliBin:"claude"},{id:"codex",name:"Codex CLI",sourceTool:w.Zdp.Codex,description:"Hooks Codex CLI sessions to detect + redact sensitive data in prompts, responses, and Bash tool calls.",npmPackage:"@akasecurity/ai-tc-codex",pluginName:"aka-codex",marketplace:"ai-tc",marketplaceSource:"akasecurity/ai-tc",cliBin:"codex"},{id:"antigravity",name:"Antigravity",sourceTool:w.Zdp.Antigravity,description:"Hooks Antigravity CLI sessions to detect sensitive data in shell commands and file writes.",npmPackage:"@akasecurity/ai-tc-antigravity",installHint:"Antigravity installs plugins from a local directory rather than a marketplace:\n  npm pack @akasecurity/ai-tc-antigravity && tar -xzf akasecurity-ai-tc-antigravity-*.tgz\n  agy plugin install ./package\nThen run `aka init` to set up the local store."}];function y(a){if(a.pluginName&&a.marketplace)return`${a.pluginName}@${a.marketplace}`}function z(a){let b=/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z-.]+))?$/.exec(a.trim());return b?{core:[Number(b[1]),Number(b[2]),Number(b[3])],pre:b[4]?b[4].split("."):[]}:null}function A(a){return null!==z(a)}function B(a,b){let c=z(a),d=z(b);if(!c||!d)return 0;for(let a=0;a<3;a++){let b=c.core[a]??0,e=d.core[a]??0;if(b!==e)return b<e?-1:1}return function(a,b){if(0===a.length&&0===b.length)return 0;if(0===a.length)return 1;if(0===b.length)return -1;let c=Math.min(a.length,b.length);for(let d=0;d<c;d++){let c=a[d]??"",e=b[d]??"";if(c===e)continue;let f=/^\d+$/.test(c),g=/^\d+$/.test(e);if(f&&!g)return -1;if(!f&&g)return 1;if(f&&g)return Number(c)<Number(e)?-1:1;return c<e?-1:1}return a.length===b.length?0:a.length<b.length?-1:1}(c.pre,d.pre)}let C="@akasecurity/cli";function D(a){return"object"==typeof a&&null!==a}function E(a){let b=p("npm",["view",a,"version"],15e3);if(!b.ok||!b.stdout)return null;let c=b.stdout.split("\n").pop()?.trim();return c&&/^\d/.test(c)?c:null}function F(a){return a.split(u.sep).filter(Boolean)}function G(a,b){for(let c=a.length-b.length;c>=0;c--)if(b.every((b,d)=>a[c+d]===b))return c;return -1}function H(a){let b=0;for(;a[b]===u.sep;)b++;return a.slice(0,b)}function I(a,b){return b+a.join(u.sep)}let J=new Set(["homebrew","local","linuxbrew",".linuxbrew"]),K=[["pnpm-lock.yaml","pnpm"],["yarn.lock","yarn"],["bun.lock","bun"],["bun.lockb","bun"],["package-lock.json","npm"]];function L(a){return"yarn"===a.toLowerCase().replace(/^\./,"")}function M(a){var b;return function(a){if(a.sea)return{kind:"sea",execPath:a.execPath,installRoot:function(a){let b=F(a),c=b[b.length-2];return b.length<4||!c?.startsWith("aka-")?null:I(b.slice(0,b.length-3),H(a))}(a.execPath)};if(void 0===a.moduleDir)return{kind:"unknown",detail:"the running module has no resolvable path"};let b=function(a,b){let c=b;for(let b=0;b<8;b++){if(a.packageName(c)===C)return c;let b=(0,u.dirname)(c);if(b===c)break;c=b}return null}(a,a.moduleDir);if(null===b){let b=function(a,b){let c=b;for(let b=0;b<8;b++){if(a.exists((0,u.join)(c,"pnpm-workspace.yaml")))return c;let b=(0,u.dirname)(c);if(b===c)break;c=b}return null}(a,a.moduleDir);return null!==b?{kind:"dev",packageDir:b}:{kind:"unknown",detail:`no ${C} package.json above ${a.moduleDir}`}}let c=function(a){let b=a.lastIndexOf(".pnpm");if(b<1)return a;let c=a.indexOf("node_modules",b+1);if(c<0)return a;let d=a.slice(0,b),e="node_modules"===d[d.length-1]?[]:["node_modules"];return[...d,...e,...a.slice(c+1)]}(F(b)),d=H(b);if(c.some((a,b)=>"Cellar"===a&&b>=1&&J.has(c[b-1]??"")))return{kind:"homebrew",packageDir:b};let e=G(c,["install","global","node_modules"]);if(e>=0)return{kind:"global",manager:"bun",root:I(c.slice(0,e+2),d),packageDir:b};let f=G(c,["global"]);if(f>=0&&"node_modules"===c[f+2]&&/^\d+$/.test(c[f+1]??""))return{kind:"global",manager:"pnpm",root:I(c.slice(0,f+1),d),packageDir:b};let g=G(c,["global","node_modules"]);if(g>=1&&c.slice(Math.max(0,g-2),g).some(L))return{kind:"global",manager:"yarn",root:I(c.slice(0,g+1),d),packageDir:b};let h=G(c,["lib","node_modules"]);if(h>=0)return{kind:"global",manager:"npm",root:I(c.slice(0,h),d),packageDir:b};let i=G(c,["node_modules"]);if(i>=0){let e=I(c.slice(0,i),d);return a.exists((0,u.join)(e,"package.json"))?a.exists((0,u.join)(e,"pnpm-workspace.yaml"))?{kind:"dev",packageDir:b}:{kind:"project",packageDir:b,projectRoot:e,manager:function(a,b){for(let[c,d]of K)if(a.exists((0,u.join)(b,c)))return d;return"npm"}(a,e)}:a.exists((0,u.join)(e,"src"))?{kind:"dev",packageDir:b}:{kind:"global",manager:"npm",root:e,packageDir:b}}return a.exists((0,u.join)(b,"src"))?{kind:"dev",packageDir:b}:{kind:"unknown",detail:`unrecognised layout at ${b}`}}((b=a,{sea:function(){try{let a=c(15895);return"function"==typeof a.isSea&&a.isSea()}catch{return!1}}(),execPath:N(process.execPath),moduleDir:void 0===b.moduleDir?void 0:N(b.moduleDir),exists:t.existsSync,packageName:O}))}function N(a){try{return(0,t.realpathSync)(a)}catch{return a}}function O(a){let b=(0,u.join)(a,"package.json");if(!(0,t.existsSync)(b))return null;try{let a=JSON.parse((0,t.readFileSync)(b,"utf8"));return D(a)&&"string"==typeof a.name?a.name:null}catch{return null}}function P(a,b,c,d=6e5){if("inherit"===c)return{ok:q(a,[...b]),output:""};let e=p(a,[...b],d);return{ok:e.ok,output:[e.stdout,e.stderr].filter(Boolean).join("\n")}}function Q(a,b,c){let d=[];for(let e of b){let b=P(a,e,c);if(b.output&&d.push(b.output),!b.ok)return{ok:!1,output:d.join("\n")}}return{ok:!0,output:d.join("\n")}}function R(a,b="capture",c=o){let d=function(a,b=process.platform){let c=`${C}@latest`;switch(a.kind){case"global":return function(a,b,c,d){let e={npm:["install","-g","--prefix",b,c],pnpm:["add","-g","--global-dir",b,c],yarn:["global","add",c],bun:["add","-g",c]}[a],f=[a,...e.map(a=>(function(a,b=process.platform){return"win32"===b?k(a):a.length>0&&l.test(a)?a:`'${a.replaceAll("'",String.raw`'\''`)}'`})(a,d))].join(" ");return{command:{bin:a,args:e},display:f}}(a.manager,a.root,c,b);case"homebrew":return{command:null,display:"brew upgrade aka",reason:"this copy is managed by Homebrew — brew owns the files under Cellar"};case"sea":return{command:null,display:"win32"===b?"irm https://raw.githubusercontent.com/akasecurity/ai-tc/bin-latest/tools/installer/install.ps1 | iex":"curl -fsSL https://raw.githubusercontent.com/akasecurity/ai-tc/bin-latest/tools/installer/install.sh | sh",reason:"this is the standalone binary — it embeds its own runtime and has no npm package behind it, so re-run the installer to replace it"};case"dev":return{command:null,display:"git pull",reason:`running from a source checkout at ${a.packageDir} — nothing to install`};case"project":{let b="npm"===a.manager?"install":"add";return{command:null,display:`${a.manager} ${b} ${c}`,reason:`this copy is a dependency of the project at ${a.projectRoot}, not a global install — update it there, in that project`}}case"unknown":return{command:null,display:`npm install -g ${c}`,reason:`could not tell how this copy of aka was installed (${a.detail})`}}}(a);if(null===d.command)return{ok:!1,output:`Cannot update automatically: ${d.reason??"unsupported install"}.
+Run: ${d.display}`};let{bin:e,args:f}=d.command;return c(e)?P(e,f,b):{ok:!1,output:`the \`${e}\` CLI isn't on your PATH — install it, then run: ${d.display}`}}function S(a){let b=x.find(b=>b.id===a);if(!b)return{ok:!1,output:`unknown agent '${a}'`};let c=y(b),d=b.cliBin;if(!c||!d)return{ok:!1,output:`${b.name} has no automated install path yet.`};let e=s(d);if(!e.available()){let a=b.marketplaceSource,f=e.installRecipe(c,a).join(" && "),g=e.updateRecipe(c,a).join(" && "),h=f===g?`\`${f}\` (that installs or updates)`:`\`${f}\` (or update with \`${g}\`)`;return{ok:!1,output:`the \`${d}\` CLI isn't on your PATH — install ${b.name}, then run ${h}.`}}return{ref:c,cliBin:d,marketplace:b.marketplace,marketplaceSource:b.marketplaceSource}}function T(a,b){if(a.marketplaceSource)for(let c of s(a.cliBin).marketplaceSteps(a.marketplaceSource,a.marketplace))P(a.cliBin,c,b,6e4)}function U(a,b="capture"){let c=S(a);if("ok"in c)return c;T(c,b);let d=s(c.cliBin);return Q(c.cliBin,d.updateSteps(c.ref),b)}function V(a,b="capture"){let c=S(a);if("ok"in c)return c;T(c,b);let d=s(c.cliBin);return Q(c.cliBin,d.installSteps(c.ref),b)}let W=s("claude");W.available,W.install,W.update;let X=s("codex");X.available,X.install,X.update;var Y=c(76258),Z=c(48844),$=c(64450);let _=$.Yj().optional().transform(a=>{if(void 0===a)return;let b=a.trim().toLowerCase();return""!==b&&"false"!==b&&"0"!==b}).catch(void 0),aa=$.vk(a=>{if("string"!=typeof a||""!==a.trim())return a},$.Yj().optional()).catch(void 0);$.Ik({CLAUDE_CODE_USE_BEDROCK:_,CLAUDE_CODE_USE_VERTEX:_,ANTHROPIC_BASE_URL:aa});let ab=JSON.parse('{"specVersion":1,"id":"code-flaws/auth-jwt-no-verify","name":"JWT decoded without signature verification","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"(verify\\\\s*=\\\\s*false|verify_signature.*false|algorithms\\\\s*=\\\\s*\\\\[\\\\])","flags":"gi"},"requiresNearby":{"labels":["jwt","decode","token"],"windowChars":160},"examples":["jwt.decode(token, options={\\"verify_signature\\": False})","jwt.decode(token, algorithms=[])"]}'),ac=JSON.parse('{"specVersion":1,"id":"code-flaws/auth-ssl-verify-false","name":"SSL certificate verification disabled","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"\\\\brequests\\\\.(get|post|put|delete|patch|request)\\\\s*\\\\([^)]*verify\\\\s*=\\\\s*False","flags":"gi"},"examples":["requests.get(url, verify=False)","requests.post(endpoint, data=payload, verify=False)"],"appliesTo":{"extensions":[".py"]}}'),ad=JSON.parse('{"specVersion":1,"id":"code-flaws/cmd-inject-exec","name":"Command injection via Java Runtime.exec","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"Runtime\\\\.getRuntime\\\\(\\\\)\\\\.exec\\\\(","flags":"g"},"requiresNearby":{"labels":["input","request","param","user"],"windowChars":200},"examples":["Runtime.getRuntime().exec(userInput)"],"appliesTo":{"extensions":[".java"]}}'),ae=JSON.parse('{"specVersion":1,"id":"code-flaws/cmd-inject-node-exec","name":"Command injection via Node.js exec with variable argument","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bexec(?:Sync)?\\\\s*\\\\(\\\\s*(?![\'\\"`])","flags":"g"},"requiresNearby":{"labels":["input","request","param","argv","user","query","body"],"windowChars":200},"examples":["exec(req.query.cmd)","execSync(userInput)"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx",".mjs",".cjs"]}}'),af=JSON.parse('{"specVersion":1,"id":"code-flaws/cmd-inject-shell","name":"Command injection via subprocess shell=True","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"subprocess\\\\.(run|Popen|call|check_output)\\\\s*\\\\([^)]*shell\\\\s*=\\\\s*True","flags":"gi"},"requiresNearby":{"labels":["input","request","param","argv","user"],"windowChars":300},"examples":["subprocess.run(user_input, shell=True)"],"appliesTo":{"extensions":[".py"]}}'),ag=JSON.parse('{"specVersion":1,"id":"code-flaws/crypto-insecure-random","name":"Insecure random number generator used for security-sensitive value","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"\\\\b(Math\\\\.random\\\\(\\\\)|random\\\\.random\\\\(\\\\)|random\\\\.randint\\\\()","flags":"gi"},"requiresNearby":{"labels":["token","session","key","password","secret","nonce","salt"],"windowChars":160},"examples":["const token = Math.random().toString(36)","session_key = str(random.random())"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx",".mjs",".cjs",".py"]}}'),ah=JSON.parse('{"specVersion":1,"id":"code-flaws/crypto-weak-hash-md5","name":"Weak cryptographic hash: MD5","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"(hashlib\\\\.md5\\\\s*\\\\(|MD5\\\\.(?:digest|hash)\\\\b|Digest::MD5|MessageDigest\\\\.getInstance\\\\s*\\\\(\\\\s*[\\"\']MD5[\\"\'])","flags":"gi"},"examples":["hashlib.md5(password.encode())","MessageDigest.getInstance(\\"MD5\\")"],"appliesTo":{"extensions":[".py",".rb",".java"]}}'),ai=JSON.parse('{"specVersion":1,"id":"code-flaws/crypto-weak-hash-sha1","name":"Weak cryptographic hash: SHA-1 in security context","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"(hashlib\\\\.sha1\\\\s*\\\\(|SHA1\\\\.(?:digest|hash)\\\\b|Digest::SHA1|MessageDigest\\\\.getInstance\\\\s*\\\\(\\\\s*[\\"\']SHA-?1[\\"\'])","flags":"gi"},"requiresNearby":{"labels":["password","credential","hash","token","secret"],"windowChars":160},"examples":["password_hash = hashlib.sha1(password.encode()).hexdigest()","MessageDigest.getInstance(\\"SHA1\\")"],"appliesTo":{"extensions":[".py",".rb",".java"]}}'),aj=JSON.parse('{"specVersion":1,"id":"code-flaws/deser-java-ois","name":"Insecure deserialization via Java ObjectInputStream","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bObjectInputStream\\\\b","flags":"g"},"requiresNearby":{"labels":["readObject"],"windowChars":200},"examples":["ObjectInputStream ois = new ObjectInputStream(inputStream); Object obj = ois.readObject();"],"appliesTo":{"extensions":[".java"]}}'),ak=JSON.parse('{"specVersion":1,"id":"code-flaws/deser-pickle","name":"Insecure deserialization via Python pickle","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bpickle\\\\.loads?\\\\s*\\\\(","flags":"gi"},"examples":["data = pickle.loads(user_data)","obj = pickle.load(request.stream)"],"appliesTo":{"extensions":[".py"]}}'),al=JSON.parse('{"specVersion":1,"id":"code-flaws/deser-yaml-unsafe","name":"Insecure deserialization via yaml.load without SafeLoader","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"\\\\byaml\\\\.load\\\\s*\\\\((?![^)]*SafeLoader|[^)]*safe_load)","flags":"gi"},"examples":["data = yaml.load(user_input)","config = yaml.load(f)"],"appliesTo":{"extensions":[".py"]}}'),am=JSON.parse('{"specVersion":1,"id":"code-flaws/dev-debug-enabled","name":"Debug mode enabled in configuration","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"\\\\bdebug\\\\s*[=:]\\\\s*(true|1|yes)","flags":"gi"},"examples":["DEBUG = True","debug: true","app.debug = True"]}'),an=JSON.parse('{"specVersion":1,"id":"code-flaws/dev-placeholder-secret","name":"Placeholder or default secret left in code","category":"code_flaw","severity":"high","matcher":{"type":"keyword","keywords":["changeme","placeholder","your-secret","dev-secret","replace-me","todo-secret"],"caseSensitive":false},"requiresNearby":{"labels":["key","secret","password","token"],"windowChars":80},"examples":["SECRET_KEY = \'changeme\'","api_token = \'your-secret\'"]}'),ao=JSON.parse('{"specVersion":1,"id":"code-flaws/dev-wildcard-cors","name":"CORS wildcard allowing all origins","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"(Access-Control-Allow-Origin:\\\\s*\\\\*|origin:\\\\s*[\\"\']\\\\*[\\"\']|allow_all_origins\\\\s*=\\\\s*True|CORS_ALLOW_ALL_ORIGINS\\\\s*=\\\\s*True)","flags":"gi"},"examples":["Access-Control-Allow-Origin: *","cors({ origin: \'*\' })","CORS_ALLOW_ALL_ORIGINS = True"]}'),ap=JSON.parse('{"specVersion":1,"id":"code-flaws/eval-dynamic-exec","name":"Dynamic code execution with user-controlled input","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(eval|exec)\\\\s*\\\\(\\\\s*(?![\'\\"`])","flags":"g"},"requiresNearby":{"labels":["input","request","param","user","query","body"],"windowChars":200},"examples":["eval(request.body.code)","exec(user_input)"]}'),aq=JSON.parse('{"specVersion":1,"id":"code-flaws/hardcoded-password","name":"Hardcoded password in source code","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"(?:password|passwd|pwd)\\\\s*=\\\\s*[\\"\']([^\\"\']{3,})[\\"\']","flags":"gi","captureGroup":1},"postValidators":[{"name":"entropy","config":{"minLength":8,"threshold":3}}],"examples":["password = \\"Tr0ub4dor&3\\"","DB_PASSWORD = \'c0rr3ctH0rseBatt3ry\'"]}'),ar=JSON.parse('{"specVersion":1,"id":"code-flaws/hardcoded-secret-key","name":"Hardcoded API key or secret key in source code","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(secret[_-]?key|api[_-]?key|auth[_-]?token)\\\\s*=\\\\s*[\\"\'][^\\"\']{8,}[\\"\']","flags":"gi"},"postValidators":["entropy"],"examples":["SECRET_KEY = \\"a9f2c8e1b4d7f3a6c9e2b5d8f1a4c7e0\\"","api_key = \'sk-proj-abc123XYZ789def456\'"]}'),as=JSON.parse('{"specVersion":1,"id":"code-flaws/path-traversal-join","name":"Path traversal via os.path.join with user-controlled component","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"os\\\\.path\\\\.join\\\\s*\\\\([^,)]+,\\\\s*(request|req|params|user)","flags":"gi"},"examples":["os.path.join(base_dir, request.args[\'file\'])","os.path.join(upload_dir, user_filename)"],"appliesTo":{"extensions":[".py"]}}'),at=JSON.parse('{"specVersion":1,"id":"code-flaws/path-traversal-open","name":"Path traversal via open() with user-controlled path","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"\\\\bopen\\\\s*\\\\(\\\\s*(request|req|params|argv|input)","flags":"gi"},"requiresNearby":{"labels":["request","param","input","argv","user"],"windowChars":200},"examples":["open(request.args[\'filename\'])","open(params[\'path\'])"],"appliesTo":{"extensions":[".py",".rb"]}}'),au=JSON.parse('{"specVersion":1,"id":"code-flaws/prototype-pollution-merge","name":"Prototype pollution via merge with user-controlled input","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"(Object\\\\.assign\\\\s*\\\\(\\\\s*\\\\w+\\\\s*,\\\\s*(req|request|body|params|query)|_\\\\.merge\\\\s*\\\\(\\\\s*\\\\w+\\\\s*,\\\\s*(req|request))","flags":"gi"},"examples":["Object.assign(config, req.body)","_.merge(target, request.body)"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx",".mjs",".cjs"]}}'),av=JSON.parse('{"specVersion":1,"id":"code-flaws/regex-redos-backtrack","name":"ReDoS via catastrophic backtracking pattern","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"\\\\((?:\\\\?:)?(?:\\\\\\\\.|\\\\[[^\\\\]]*\\\\]|[^\\\\\\\\()\\\\[\\\\]+*?|])[+*](?:(?:\\\\\\\\.|\\\\[[^\\\\]]*\\\\]|[^\\\\\\\\()\\\\[\\\\]+*?|])\\\\*)?\\\\)[+*]|\\\\((?:\\\\?:)?([^()|]+)\\\\|\\\\1\\\\)[+*]","flags":"g"},"examples":["/(a+)+/","/(\\\\w+\\\\s*)+/"]}'),aw=JSON.parse('{"specVersion":1,"id":"code-flaws/sql-inject-concat-dot","name":"SQL injection via string concatenation (PHP dot operator)","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"[\\"\'][^\\\\n]*?(select|insert|update|delete|drop|where)[^\\\\n]*?[\\"\']\\\\s*\\\\.","flags":"gi"},"appliesTo":{"extensions":[".php"]},"examples":["$query = \\"SELECT * FROM orders WHERE user = \\" . $username;"]}'),ax=JSON.parse('{"specVersion":1,"id":"code-flaws/sql-inject-concat","name":"SQL injection via string concatenation","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"[\\"\']\\\\s*(?:select\\\\b[^\\\\n]*?\\\\bfrom\\\\b|insert\\\\s+into\\\\b|update\\\\s+\\\\S+\\\\s+set\\\\b|delete\\\\s+from\\\\b|drop\\\\s+(?:table|database)\\\\b|where\\\\b[^\\\\n]*?=)[^\\\\n]*?[\\"\']\\\\s*\\\\+","flags":"gi"},"examples":["\\"SELECT * FROM users WHERE id = \\" + userId"]}'),ay=JSON.parse('{"specVersion":1,"id":"code-flaws/sql-inject-format","name":"SQL injection via format string or f-string","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:select\\\\b[^\\\\n]*?\\\\bfrom\\\\b|insert\\\\s+into\\\\b|update\\\\s+\\\\S+\\\\s+set\\\\b|delete\\\\s+from\\\\b|drop\\\\s+(?:table|database)\\\\b|where\\\\b[^\\\\n]*?=)[^\\\\n]*?(?:[%][sd]|\\\\{[^}]+\\\\})","flags":"gi"},"examples":["f\\"SELECT * FROM users WHERE id = {user_id}\\"","\\"SELECT * FROM users WHERE name = \'%s\'\\" % name"]}'),az=JSON.parse('{"specVersion":1,"id":"code-flaws/sql-inject-interp","name":"SQL injection via Ruby string interpolation or PHP variable","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"(select|insert|update|delete|where)[^\\\\n]*?(#\\\\{|\\\\$[a-z_])","flags":"gi"},"examples":["\\"SELECT * FROM users WHERE id = #{params[:id]}\\"","\\"SELECT * FROM users WHERE id = $userId\\""],"appliesTo":{"extensions":[".rb",".php"]}}'),aA=JSON.parse('{"specVersion":1,"id":"code-flaws/ssrf-user-url","name":"Server-side request forgery via user-controlled URL","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"(fetch|axios\\\\.\\\\w+|requests\\\\.get|urllib\\\\.request\\\\.urlopen)\\\\s*\\\\(\\\\s*(req|request|params|query|body)","flags":"gi"},"examples":["fetch(req.query.url)","requests.get(request.form[\'url\'])"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx",".mjs",".cjs",".py"]}}'),aB=JSON.parse('{"specVersion":1,"id":"code-flaws/xss-dangerously-set","name":"XSS via React dangerouslySetInnerHTML","category":"code_flaw","severity":"high","matcher":{"type":"keyword","keywords":["dangerouslySetInnerHTML"],"caseSensitive":true},"examples":["<div dangerouslySetInnerHTML={{ __html: userContent }} />"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx"]}}'),aC=JSON.parse('{"specVersion":1,"id":"code-flaws/xss-inner-html","name":"XSS via innerHTML assignment","category":"code_flaw","severity":"high","matcher":{"type":"keyword","keywords":["innerHTML =","innerHTML="],"caseSensitive":true},"examples":["element.innerHTML = userInput"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx",".mjs",".cjs"]}}'),aD=JSON.parse('{"specVersion":1,"id":"code-flaws/xss-unescaped-render","name":"XSS via unescaped template rendering","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"(\\\\braw\\\\s*\\\\(|\\\\bhtml_safe\\\\b|\\\\|\\\\s*safe\\\\b|\\\\bmark_safe\\\\s*\\\\()","flags":"gi"},"examples":["<%= raw(user_comment) %>","{{ user_input | safe }}","mark_safe(user_html)"],"appliesTo":{"extensions":[".rb",".py"]}}'),aE=JSON.parse('{"specVersion":1,"id":"core-code-context/db-table-name","name":"Internal database table/column name","category":"code_context","severity":"low","matcher":{"type":"keyword","keywords":["SELECT * FROM ","SELECT COUNT(*) FROM ","INSERT INTO ","DELETE FROM ","CREATE TABLE ","ALTER TABLE ","DROP TABLE ","FROM users","FROM orders","FROM employees","FROM customers","FROM accounts","FROM transactions","FROM products","FROM payments"],"caseSensitive":false},"examples":["SELECT * FROM users WHERE id = 1"]}'),aF=JSON.parse('{"specVersion":1,"id":"core-code-context/feature-flag","name":"Feature flag / toggle name","category":"code_context","severity":"low","matcher":{"type":"keyword","keywords":["feature_flag:","feature_toggle:","feature-flag:","feature-toggle:","FF_","FEATURE_FLAG_","FEATURE_TOGGLE_","unleash:","launchdarkly:","split.io:"],"caseSensitive":false},"examples":["feature_flag: new-checkout-flow","FF_ENABLE_DARK_MODE"]}'),aG=JSON.parse('{"specVersion":1,"id":"core-code-context/file-path","name":"User home / identity-bearing file path","category":"code_context","severity":"low","matcher":{"type":"regex","pattern":"(?:/home|/Users)/[A-Za-z0-9_.@-]+(?:/[A-Za-z0-9_.@+-]+)*|/root(?:/[A-Za-z0-9_.@+-]+)+|[A-Za-z]:\\\\\\\\[Uu]sers\\\\\\\\[A-Za-z0-9_.-]+(?:\\\\\\\\[A-Za-z0-9_.-]+)*","flags":"g"},"examples":["/home/user/.ssh/id_rsa","/Users/jane/projects/acme/secrets.env","C:\\\\Users\\\\admin\\\\config.yml"]}'),aH=JSON.parse('{"specVersion":1,"id":"core-code-context/internal-domain","name":"Internal domain / hostname","category":"code_context","severity":"low","matcher":{"type":"regex","pattern":"(?<![A-Za-z0-9.-])[A-Za-z0-9][A-Za-z0-9.-]{0,251}\\\\.(?:internal|corp|local|lan|intranet|private|dev|staging|test|qa)(?:\\\\.(?:com|net|org|io|co|app))?\\\\b","flags":"gi"},"examples":["db.internal.com","app.corp.local","api.staging.example.com"]}'),aI=JSON.parse('{"specVersion":1,"id":"core-code-context/internal-ip","name":"Internal (RFC 1918) IP address","category":"code_context","severity":"low","matcher":{"type":"regex","pattern":"(?<![\\\\d.])(?:10\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)|192\\\\.168\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?))(?![\\\\d])","flags":"g"},"examples":["10.0.0.1","192.168.1.1","172.16.0.1"]}'),aJ=JSON.parse('{"specVersion":1,"id":"core-code-context/internal-url","name":"Internal environment URL","category":"code_context","severity":"low","matcher":{"type":"keyword","keywords":["https://staging.","https://dev.","https://qa.","https://test.","http://staging.","http://dev.","http://qa.","http://test.",".staging.com",".dev.com",".qa.com","staging.internal","dev.internal"],"caseSensitive":false},"examples":["https://staging.example.com"]}'),aK=JSON.parse('{"specVersion":1,"id":"core-code-context/localhost-ref","name":"Localhost reference","category":"code_context","severity":"low","matcher":{"type":"regex","pattern":"(?<![A-Za-z0-9_])(?:localhost|127\\\\.0\\\\.0\\\\.1|0\\\\.0\\\\.0\\\\.0|(?<![A-Za-z0-9_]\\\\[)::1(?!:|\\\\.[0-9]))(?![A-Za-z0-9_])","flags":"g"},"examples":["localhost","127.0.0.1","0.0.0.0","::1"]}'),aL=JSON.parse('{"specVersion":1,"id":"core-code-context/stack-trace","name":"Stack trace (internal code structure)","category":"code_context","severity":"low","matcher":{"type":"regex","pattern":"(?:^|\\\\s+)at\\\\s+[A-Za-z0-9._$<>]+\\\\.[A-Za-z0-9_$]+\\\\s*\\\\([A-Za-z0-9._\\\\-/:]+:\\\\d+:\\\\d+\\\\)","flags":"g"},"examples":["at com.example.service.UserService.findUser(UserService.java:42:13)"]}'),aM=JSON.parse('{"specVersion":1,"id":"core-financial/credit-card","name":"Credit/debit card number","category":"financial","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12})\\\\b","flags":"g"},"postValidators":["luhn"],"examples":["4111111111111111","5500000000000004"]}'),aN=JSON.parse('{"specVersion":1,"id":"core-financial/cusip","name":"CUSIP security identifier","category":"financial","severity":"medium","matcher":{"type":"regex","pattern":"\\\\bcusip\\\\b[\\\\s#:=-]{0,8}(\\\\d{3}[A-Z0-9]{2}[A-Z0-9*#@]\\\\d{2}[0-9])\\\\b","flags":"gi","captureGroup":1},"examples":["CUSIP: 037833100","CUSIP 931142103"]}'),aO=JSON.parse('{"specVersion":1,"id":"core-financial/cvv","name":"Card security code (CVV/CVC)","category":"financial","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:CVV|CVC|CID|security\\\\s+code|card\\\\s+code)[:\\\\s]*\\\\d{3,4}\\\\b","flags":"gi"},"examples":["CVV: 123","CVC: 456"]}'),aP=JSON.parse('{"specVersion":1,"id":"core-financial/iban","name":"International Bank Account Number","category":"financial","severity":"high","matcher":{"type":"regex","pattern":"\\\\b[A-Z]{2}\\\\d{2}[A-Z0-9 ]{10,30}\\\\b","flags":"g"},"requiresNearby":{"labels":["iban","bank","account","bic","swift"],"windowChars":160},"examples":["IBAN: GB82 WEST 1234 5698 7654 32","IBAN: DE89 3704 0044 0532 0130 00"]}'),aQ=JSON.parse('{"specVersion":1,"id":"core-financial/paypal","name":"PayPal transaction/merchant ID","category":"financial","severity":"medium","matcher":{"type":"regex","pattern":"paypal.{0,30}?\\\\b([A-Z0-9]{17})\\\\b","flags":"gi","captureGroup":1},"examples":["PayPal transaction ID: 9HW7382910ABCDEF1"]}'),aR=JSON.parse('{"specVersion":1,"id":"core-financial/routing-number","name":"US bank routing number (ABA)","category":"financial","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:routing|aba|rtn)\\\\b[\\\\s#:=-]{0,8}(\\\\d{9})\\\\b","flags":"gi","captureGroup":1},"examples":["Routing: 021000021","ABA 111000025"]}'),aS=JSON.parse('{"specVersion":1,"id":"core-financial/salary","name":"Salary/compensation (contextual)","category":"financial","severity":"low","matcher":{"type":"keyword","keywords":["my salary is","my base salary","annual compensation","total comp","my tc is","my package is","i make $","i earn $","offered $"],"caseSensitive":false},"examples":["My salary is $150,000"]}'),aT=JSON.parse('{"specVersion":1,"id":"core-financial/swift","name":"SWIFT/BIC code","category":"financial","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:swift|bic)\\\\b[\\\\s#:=-]{0,8}([A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?)\\\\b","flags":"gi","captureGroup":1},"examples":["SWIFT: BOFAUS3N","BIC: CHASGB2LXXX"]}'),aU=JSON.parse('{"specVersion":1,"id":"core-phi/biometric-ref","name":"Biometric data reference","category":"phi","severity":"high","matcher":{"type":"keyword","keywords":["fingerprint data","fingerprint scan","my iris scan","my retina scan","my biometric","my facial recognition","my voiceprint","my palm print","my hand geometry"],"caseSensitive":false},"examples":["My fingerprint data is stored in the biometric database"]}'),aV=JSON.parse('{"specVersion":1,"id":"core-phi/genetic-data","name":"Genetic/DNA sequence reference","category":"phi","severity":"high","matcher":{"type":"keyword","keywords":["my dna sequence","my genome","my genetic","dna test results","genetic test results","my 23andme","my ancestrydna","gene variant","my genotype","my haplogroup"],"caseSensitive":false},"examples":["My DNA sequence shows a variant in the BRCA1 gene"]}'),aW=JSON.parse('{"specVersion":1,"id":"core-phi/group-id","name":"Health plan group ID","category":"phi","severity":"high","matcher":{"type":"regex","pattern":"\\\\bgroup\\\\s*(?:id|number|no|#)\\\\s*[:#]?\\\\s*[A-Za-z0-9]{6,20}\\\\b","flags":"gi"},"requiresNearby":{"ruleIds":["core-phi/member-id"],"labels":["member id","subscriber","health plan"],"windowChars":200,"confidenceBoost":0.05},"examples":["Member ID: ABC987654321, Group ID: GRP12345678"]}'),aX=JSON.parse('{"specVersion":1,"id":"core-phi/hipaa-identifier","name":"HIPAA standard identifier (health plan / beneficiary / claim number)","category":"phi","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:health\\\\s+plan|beneficiary|claim\\\\s+number|subscriber)[:\\\\s]*[A-Za-z0-9]{8,20}\\\\b","flags":"gi"},"examples":["Health Plan: XYZ123456789","Beneficiary: ABC987654321"]}'),aY=JSON.parse('{"specVersion":1,"id":"core-phi/icd10-code","name":"ICD-10 diagnosis code","category":"phi","severity":"medium","matcher":{"type":"regex","pattern":"(?:icd[- ]?10|diagnosis|\\\\bdx\\\\b).{0,12}?([A-Z][0-9]{2}(?:\\\\.[0-9]{1,4})?)\\\\b","flags":"gi","captureGroup":1},"examples":["ICD-10: I10","Diagnosis code E11.9","dx: J45.909"]}'),aZ=JSON.parse('{"specVersion":1,"id":"core-phi/member-id","name":"Health plan member ID","category":"phi","severity":"high","matcher":{"type":"regex","pattern":"\\\\bmember\\\\s*(?:id|number|no|#)\\\\s*[:#]?\\\\s*[A-Za-z0-9]{6,20}\\\\b","flags":"gi"},"examples":["Member ID: ABC987654321"]}'),a$=JSON.parse('{"specVersion":1,"id":"core-phi/mrn","name":"Medical Record Number","category":"phi","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:MRN|MR#|medical\\\\s+record)[:\\\\s]*[A-Za-z0-9]{6,16}\\\\b","flags":"gi"},"examples":["MRN: 1234567890","Medical Record: ABCD1234"]}'),a_=JSON.parse('{"specVersion":1,"id":"core-phi/ndc-code","name":"National Drug Code (NDC)","category":"phi","severity":"medium","matcher":{"type":"regex","pattern":"\\\\b\\\\d{4,5}-\\\\d{3,4}-\\\\d{1,2}\\\\b","flags":"g"},"examples":["0002-1427-01","68788-6965-1"]}'),a0=JSON.parse('{"specVersion":1,"id":"core-pii/dob","name":"Date of birth","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:(?:19[4-9]\\\\d|20[0-1]\\\\d)[/-]\\\\d{1,2}[/-]\\\\d{1,2}|\\\\d{1,2}[/-]\\\\d{1,2}[/-](?:19[4-9]\\\\d|20[0-1]\\\\d))\\\\b","flags":"g"},"requiresNearby":{"categories":["pii"],"labels":["dob","date of birth","birth","d.o.b"],"windowChars":160},"examples":["DOB: 1985-03-22","Date of birth: 03/22/1985"]}'),a1=JSON.parse('{"specVersion":1,"id":"core-pii/drivers-license-us","name":"US driver\'s license number","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"(?:driver\'?s?\\\\s*licen[sc]e|licen[sc]e|\\\\bDL\\\\b).{0,10}?([A-Z]\\\\d{6,8}|\\\\d{8,9})\\\\b","flags":"gi","captureGroup":1},"examples":["Driver\'s License: D1234567","DL: 123456789"]}'),a2=JSON.parse('{"specVersion":1,"id":"core-pii/email","name":"Email address","category":"pii","severity":"medium","matcher":{"type":"regex","pattern":"(?<![A-Za-z0-9._%+-])[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,255}\\\\.[A-Za-z]{2,24}\\\\b","flags":"g"},"examples":["user@example.com"]}'),a3=JSON.parse('{"specVersion":1,"id":"core-pii/home-address","name":"Home address (contextual)","category":"pii","severity":"medium","matcher":{"type":"keyword","keywords":["my address is","home address","shipping address","billing address","mailing address","my home is at","i reside at"],"caseSensitive":false},"examples":["My address is 123 Main St, Springfield, IL 62701"]}'),a4=JSON.parse('{"specVersion":1,"id":"core-pii/ip-address","name":"IP address","category":"pii","severity":"low","matcher":{"type":"regex","pattern":"\\\\b(?:(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\.){3}(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\b","flags":"g"},"examples":["192.168.1.1","10.0.0.1"]}'),a5=JSON.parse('{"specVersion":1,"id":"core-pii/mac-address","name":"MAC address","category":"pii","severity":"low","matcher":{"type":"regex","pattern":"\\\\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\\\\b","flags":"g"},"examples":["AA:BB:CC:DD:EE:FF"]}'),a6=JSON.parse('{"specVersion":1,"id":"core-pii/name","name":"Personal name (contextual)","category":"pii","severity":"medium","matcher":{"type":"keyword","keywords":["my name is","my full name","i am called","please call me","name:\\n","\\"full_name\\": \\"","\\"fullName\\": \\""],"caseSensitive":false},"examples":["My name is John Doe"]}'),a7=JSON.parse('{"specVersion":1,"id":"core-pii/national-id","name":"National ID number (multi-country)","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"\\\\b[A-Z]{2}\\\\d{6}[A-D]\\\\b|\\\\b[2-9]\\\\d{11}\\\\b|(?:national\\\\s*id|aadhaar|\\\\bSIN\\\\b).{0,10}?\\\\d{3}[\\\\s-]?\\\\d{3}[\\\\s-]?\\\\d{3}\\\\b","flags":"gi"},"requiresNearby":{"labels":["national id","national identity","national insurance","nino","ni","aadhaar","sin","identity number","id number"],"windowChars":160},"examples":["Aadhaar: 234567890123","NI: AB123456C","SIN: 123-456-789"]}'),a8=JSON.parse('{"specVersion":1,"id":"core-pii/passport-us","name":"US passport number","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"\\\\b[A-Z]\\\\d{8}\\\\b","flags":"g"},"requiresNearby":{"labels":["passport"],"windowChars":160},"examples":["Passport: A12345678"]}'),a9=JSON.parse('{"specVersion":1,"id":"core-pii/phone-intl","name":"International phone number","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"\\\\+\\\\d{1,3}(?:[-.\\\\s]\\\\d{1,14}){1,5}\\\\b","flags":"g"},"examples":["+44 20 7946 0958","+86 138 0013 8000"]}'),ba=JSON.parse('{"specVersion":1,"id":"core-pii/phone-us","name":"US phone number","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"(?<!\\\\d)(?:\\\\+?1[-.\\\\s]?)?(?:\\\\([2-9]\\\\d{2}\\\\)[-.\\\\s]?|[2-9]\\\\d{2}[-.\\\\s])\\\\d{3}[-.\\\\s]\\\\d{4}(?!\\\\d)","flags":"g"},"requiresNearby":{"labels":["phone","call","mobile","cell","tel","telephone","contact","fax","dial"],"windowChars":160},"examples":["(555) 123-4567","+1-555-123-4567"]}'),bb=JSON.parse('{"specVersion":1,"id":"core-pii/ssn","name":"US Social Security Number","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?!000|666|9\\\\d{2})\\\\d{3}[\\\\s\\\\-](?!00)\\\\d{2}[\\\\s\\\\-](?!0000)\\\\d{4}\\\\b","flags":"g"},"examples":["123-45-6789"]}'),bc=JSON.parse('{"specVersion":1,"id":"core-pii/vin","name":"Vehicle Identification Number","category":"pii","severity":"medium","matcher":{"type":"regex","pattern":"\\\\b[A-HJ-NPR-Z0-9]{17}\\\\b","flags":"g"},"examples":["1HGCM82633A004352"]}'),bd=JSON.parse('{"specVersion":1,"id":"core-pii/zip","name":"US ZIP / ZIP+4 postal code","category":"pii","severity":"low","matcher":{"type":"regex","pattern":"\\\\b\\\\d{5}(?:-\\\\d{4})?\\\\b","flags":"g"},"requiresNearby":{"ruleIds":["core-pii/home-address"],"labels":["address","street","avenue","boulevard","mailing","shipping","billing","suite","p.o. box","po box","postal"],"windowChars":120},"examples":["Shipping address: 123 Main Street, Springfield, IL 94107-1234"]}'),be=JSON.parse('{"specVersion":1,"id":"secrets-infra/api-key-header","name":"API key in a custom HTTP header","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"[\\"\']?\\\\bapi-?key\\\\b[\\"\']?\\\\s*:\\\\s*[\\"\']?([A-Za-z0-9+/_\\\\-.]{16,500})[\\"\']?","flags":"gi","captureGroup":1},"postValidators":["entropy"],"examples":["X-Api-Key: aBc123XyZ789kLmNoPqRsTuVwXyZ1234567890"]}'),bf=JSON.parse('{"specVersion":1,"id":"secrets-infra/basic-auth-header","name":"HTTP Basic auth Authorization header","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"authorization\\\\s*:\\\\s*basic\\\\s+[A-Za-z0-9+/=]{16,}","flags":"gi"},"examples":["Authorization: Basic dXNlcjpwYXNzd29yZDEyMzQ="]}'),bg=JSON.parse('{"specVersion":1,"id":"secrets-infra/basic-auth-url","name":"URL with embedded basic auth credentials","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"https?://[A-Za-z0-9_%\\\\-]+:[A-Za-z0-9_%\\\\-]+@[A-Za-z0-9.\\\\-]+","flags":"g"},"examples":["https://user:password@example.com/path"]}'),bh=JSON.parse('{"specVersion":1,"id":"secrets-infra/bearer-token","name":"Generic Authorization Bearer token","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:Bearer|bearer)\\\\s+([A-Za-z0-9_\\\\-.]{20,500})","flags":"g","captureGroup":1},"postValidators":["entropy"],"examples":["Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"]}'),bi=JSON.parse('{"specVersion":1,"id":"secrets-infra/db-connection-string","name":"Database connection string with credentials","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:postgres(?:ql)?|mysql|mongodb(?:\\\\+srv)?|redis|rediss)://[A-Za-z0-9_%\\\\-]+:[A-Za-z0-9_%\\\\-]+@[A-Za-z0-9.\\\\-]+(?:\\\\:\\\\d+)?","flags":"g"},"examples":["postgresql://user:password@localhost:5432/mydb"]}'),bj=JSON.parse('{"specVersion":1,"id":"secrets-infra/docker-config-auth","name":"Docker config.json auth (base64-encoded)","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\"auth\\"\\\\s*:\\\\s*\\"[A-Za-z0-9+/]{12,}={0,2}\\"","flags":"g"},"examples":["\\"auths\\": {\\"https://index.docker.io/v1/\\": {\\"auth\\": \\"dXNlcjpwYXNzd29yZA==\\"}}"]}'),bk=JSON.parse('{"specVersion":1,"id":"secrets-infra/env-key-value","name":"Environment variable assignment with sensitive key","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"\\\\b[A-Za-z0-9_]*(?:API_KEY|API_SECRET|SECRET_KEY|SECRET|TOKEN|PASSWORD|PASS|CREDENTIALS|PRIVATE_KEY|ENCRYPTION_KEY|SIGNING_KEY)\\\\s*=\\\\s*[\\"\']?([^\\\\s\\"\']{4,})","flags":"gi","captureGroup":1},"examples":["API_KEY=aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890"]}'),bl=JSON.parse('{"specVersion":1,"id":"secrets-infra/generic-high-entropy-secret","name":"Generic high-entropy secret assigned to a credential-shaped field","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"(?<![A-Za-z0-9_-])[A-Za-z0-9_]{0,34}(?:(?:secret|token|passw(?:or)?d|credentials?|(?<!api[_-]?)key)(?:[\\"\']?\\\\s*:|\\\\s+=)|(?:passwd|credential|(?<!api[_-]?)(?<!secret_)(?<!private_)(?<!encryption_)(?<!signing_)key)=)\\\\s*[\\"\']?((?!eyJ)[A-Za-z0-9+/_\\\\-]{20,200})","flags":"gi","captureGroup":1},"postValidators":["entropy"],"examples":["authToken: \\"aBc123XyZ789kLmNoPqRsTuVwXyZ1234567890\\"","MASTER_KEY=aBc123XyZ789kLmNoPqRsTuVwXyZ1234567890"]}'),bm=JSON.parse('{"specVersion":1,"id":"secrets-infra/jwt-token","name":"JSON Web Token (JWT)","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"\\\\beyJ[A-Za-z0-9_\\\\-+/]+\\\\.[A-Za-z0-9_\\\\-+/]+\\\\.[A-Za-z0-9_\\\\-+/]+\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"]}'),bn=JSON.parse('{"specVersion":1,"id":"secrets-infra/kubeconfig-token","name":"Kubernetes kubeconfig embedded token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:client-(?:certificate|key)-data|token):\\\\s+([A-Za-z0-9+/=_.-]{20,})","flags":"g","captureGroup":1},"examples":["token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9..."]}'),bo=JSON.parse('{"specVersion":1,"id":"secrets-infra/password-field","name":"JSON/YAML field with password value","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"[\\"\']?\\\\b(?:password|passwd|pwd|pass|secret|token|api[_-]?key|apikey)\\\\b[\\"\']?\\\\s*:\\\\s*[\\"\']([^\\"\'\\\\n]{4,})[\\"\']","flags":"gi","captureGroup":1},"examples":["\\"password\\": \\"supersecret123\\""]}'),bp=JSON.parse('{"specVersion":1,"id":"secrets-infra/pgp-private-key","name":"PGP private key block","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"-----BEGIN PGP PRIVATE KEY BLOCK-----","flags":"g"},"examples":["-----BEGIN PGP PRIVATE KEY BLOCK-----\\nVersion: Keybase Go 1.0.0\\n...\\n-----END PGP PRIVATE KEY BLOCK-----"]}'),bq=JSON.parse('{"specVersion":1,"id":"secrets-infra/ssh-private-key","name":"SSH private key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"-----BEGIN (?:RSA |DSA |EC |OPENSSH |SSH2 )?PRIVATE KEY-----","flags":"g"},"examples":["-----BEGIN RSA PRIVATE KEY-----\\nMIIEpAIBAAKCAQEA...\\n-----END RSA PRIVATE KEY-----"]}'),br=JSON.parse('{"specVersion":1,"id":"secrets/anthropic-api-key","name":"Anthropic API key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bsk-ant-[A-Za-z0-9_-]{40,}","flags":"g"},"postValidators":["entropy"],"examples":["sk-ant-AbCdEfGhIjKlMnOpQrStUvWxYzAbCdEfGhIjKlMnOpQrStUvWxYz"]}'),bs=JSON.parse('{"specVersion":1,"id":"secrets/aws-access-key","name":"AWS Access Key ID","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(AKIA|ASIA|AROA|AIDA|ANPA|ANVA|APKA)[A-Z0-9]{16}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["AKIAIOSFODNN7EXAMPLE"]}'),bt=JSON.parse('{"specVersion":1,"id":"secrets/aws-secret-key","name":"AWS Secret Access Key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"aws[_.-]?secret[_.-]?(?:access[_.-]?)?key[\\"\'\\\\s:=]{1,5}([A-Za-z0-9/+]{40})","flags":"gi","captureGroup":1},"postValidators":["entropy"],"examples":["AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"]}'),bu=JSON.parse('{"specVersion":1,"id":"secrets/azure-connection-string","name":"Azure connection string","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"(?<![A-Za-z0-9])(?:DefaultEndpointsProtocol|AccountEndpoint|AccountName|AccountKey|SharedAccessSignature|SharedAccessKeyName|SharedAccessKey|EndpointSuffix|BlobEndpoint|QueueEndpoint|TableEndpoint|FileEndpoint|HostName|Endpoint)=(?![{<($])[^\\\\x3B\\\\r\\\\n]{1,400}\\\\x3B(?:[A-Za-z][A-Za-z0-9_]{0,39}=[^\\\\x3B\\\\r\\\\n]{1,400}\\\\x3B){0,10}(?:DefaultEndpointsProtocol|AccountEndpoint|AccountName|AccountKey|SharedAccessSignature|SharedAccessKeyName|SharedAccessKey|EndpointSuffix|BlobEndpoint|QueueEndpoint|TableEndpoint|FileEndpoint|HostName|Endpoint)=(?![{<($])[^\\\\x3B\\\\r\\\\n]{1,400}(?:\\\\x3B[A-Za-z][A-Za-z0-9_]{0,39}=[^\\\\x3B\\\\r\\\\n]{1,400}){0,10}","flags":"g"},"examples":["AccountName=mystorage;AccountKey=abc123=="]}'),bv=JSON.parse('{"specVersion":1,"id":"secrets/cloudflare-api-key","name":"Cloudflare API token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"cloudflare.{0,40}?[\\"\'\\\\s:=]([A-Za-z0-9_-]{40})","flags":"gi","captureGroup":1},"postValidators":["entropy"],"examples":["CLOUDFLARE_API_TOKEN=kQ9fL2mP7xR4tY6wB1nC8vD3jH5sZ0aG2eU4iO7p"]}'),bw=JSON.parse('{"specVersion":1,"id":"secrets/datadog-key","name":"Datadog API/Application key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:DD_API_KEY|DD_APP_KEY|DATADOG_API_KEY|DATADOG_APP_KEY)[\\\\s:=]+([A-Za-z0-9]{32,40})\\\\b","flags":"gi","captureGroup":1},"postValidators":["entropy"],"examples":["DD_API_KEY=a3F5g8H1j4K7m2N0p9Q6r1S4t7U0v3W8"]}'),bx=JSON.parse('{"specVersion":1,"id":"secrets/digitalocean-token","name":"DigitalOcean Personal Access Token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bdop_v1_[A-Za-z0-9]{64}\\\\b","flags":"g"},"examples":["dop_v1_1234567890123456789012345678901234567890123456789012345678901234"]}'),by=JSON.parse('{"specVersion":1,"id":"secrets/discord-token","name":"Discord bot token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b[A-Za-z0-9]{24}\\\\.[A-Za-z0-9]{6}\\\\.[A-Za-z0-9_\\\\-]{27}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["AbCdEfGhIjKlMnOpQrStUvWx.YzAbCd.ABCdEfGhIjKlMnOpQrStUvWxYzAbCdEf"]}'),bz=JSON.parse('{"specVersion":1,"id":"secrets/gcp-service-account","name":"GCP service account key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"(?<![a-z0-9-])[a-z0-9-]{3,}@[a-z0-9][a-z0-9-]{2,60}\\\\.iam\\\\.gserviceaccount\\\\.com\\\\b","flags":"g"},"examples":["deploy-bot@sample-project.iam.gserviceaccount.com","12345678-1234-1234-1234-123456789012@my-project.iam.gserviceaccount.com"]}'),bA=JSON.parse('{"specVersion":1,"id":"secrets/github-pat","name":"GitHub Personal Access Token (classic and fine-grained)","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:gh[psou]_[A-Za-z0-9]{36}|github_pat_[0-9A-Za-z_]{82})\\\\b","flags":"g"},"examples":["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","ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890"]}'),bB=JSON.parse('{"specVersion":1,"id":"secrets/gitlab-token","name":"GitLab Personal/Project Access Token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bglpat-[A-Za-z0-9\\\\-_]{20,40}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["glpat-ABCdEfGhIjKlMnOpQrStUvWxYz1234567890"]}'),bC=JSON.parse('{"specVersion":1,"id":"secrets/heroku-api-key","name":"Heroku API key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"heroku.{0,40}?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})","flags":"gi","captureGroup":1},"examples":["HEROKU_API_KEY=3f8a1c2e-9b4d-4e6f-a1b2-c3d4e5f6a7b8"]}'),bD=JSON.parse('{"specVersion":1,"id":"secrets/npm-token","name":"npm access token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bnpm_[A-Za-z0-9]{36,60}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["npm_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890AbCdEfGhIjKlMnO"]}'),bE=JSON.parse('{"specVersion":1,"id":"secrets/openai-api-key","name":"OpenAI API key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bsk-proj-[A-Za-z0-9]{20,60}\\\\b|\\\\bsk-[A-Za-z0-9]{40,55}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["sk-proj-AbCdEfGhIjKlMnOpQrStUvWxYz1234567890AbCdEfGhIjK"]}'),bF=JSON.parse('{"specVersion":1,"id":"secrets/pulumi-access-token","name":"Pulumi access token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bpul-[A-Za-z0-9]{20,60}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["pul-ABCdEfGhIjKlMnOpQrStUvWxYz1234567890"]}'),bG=JSON.parse('{"specVersion":1,"id":"secrets/sendgrid-key","name":"SendGrid API key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bSG\\\\.[A-Za-z0-9_\\\\-]{20,60}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["SG.AbCdEfGhIjKlMnOpQrStUvWxYzAbCdEfGhIjKlMnOpQrStUvWxYz"]}'),bH=JSON.parse('{"specVersion":1,"id":"secrets/slack-token","name":"Slack API token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:xox[baprs]-[A-Za-z0-9]{10,60}|xapp-[A-Za-z0-9-]{10,60})\\\\b","flags":"g"},"examples":["xoxb-123456789012-123456789012-ABCdEfGhIjKlMnOpQrStUvWx"]}'),bI=JSON.parse('{"specVersion":1,"id":"secrets/stripe-live-key","name":"Stripe live API key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:sk|pk|rk)_live_[A-Za-z0-9]{24,40}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["sk_live_aBcDeFgHiJkLmNoPqRsTuVwXyZ"]}'),bJ=JSON.parse('{"specVersion":1,"id":"secrets/terraform-cloud-token","name":"Terraform Cloud / TFE user token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b[A-Za-z0-9]{14}\\\\.atlasv1\\\\.[A-Za-z0-9_\\\\-]{60,80}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["AbCdEfGhIjKlMnOp.atlasv1.XyZ1234567890123456789012345678901234567890123456789012345678901234567890"]}'),bK=[{packId:"code-flaws",name:"Code Security Flaws",version:"0.1.0",rawRules:[ax,aw,ay,az,af,ad,ae,aC,aB,aD,ak,al,aj,aq,ar,am,an,ao,ac,ab,at,as,ah,ai,ag,au,ap,aA,av]},{packId:"core-code-context",name:"Code Context",version:"0.1.0",rawRules:[aI,aK,aH,aG,aL,aJ,aF,aE]},{packId:"core-financial",name:"Financial Information",version:"0.1.0",rawRules:[aM,aP,aR,aT,aO,aN,aQ,aS]},{packId:"core-phi",name:"Protected Health Information",version:"0.1.0",rawRules:[a$,aX,aZ,aW,aY,a_,aV,aU]},{packId:"core-pii",name:"Core PII",version:"0.2.0",rawRules:[a2,bb,ba,a9,a4,a0,a1,a8,a3,a6,bc,a5,a7,bd]},{packId:"secrets",name:"Secrets & Credentials",version:"0.1.0",rawRules:[bs,bt,bz,bu,bE,br,bI,bH,by,bG,JSON.parse('{"specVersion":1,"id":"secrets/twilio-key","name":"Twilio Account SID","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bAC[A-Za-z0-9]{32}\\\\b","flags":"g"},"examples":["AC12345678901234567890123456789012"]}'),bB,bx,bw,bD,bC,bv,bF,bJ,JSON.parse('{"specVersion":1,"id":"secrets/vault-token","name":"HashiCorp Vault token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:hvs\\\\.[A-Za-z0-9\\\\-_]{20,50}|s\\\\.[A-Za-z0-9\\\\-_]{20,50})\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["hvs.AbCdEfGhIjKlMnOpQrStUvWxYz1234567890"]}'),bA]},{packId:"secrets-infra",name:"Infrastructure Secrets",version:"0.1.0",rawRules:[bq,bi,bm,bg,bf,bp,bh,bk,bo,bj,bn,be,bl]}];function bL(a){try{let b=bO(a);if(!b)return;let c=bP(b),d=c?.headRoot??b,e=c?function(a){let b=bQ(a.configPath);if(void 0===b)return;let c=function(a){let b,c={};for(let d of a.split("\n")){let a=d.trim(),e=/^\[remote "([^"]+)"\]$/.exec(a);if(e){b=e[1];continue}if(a.startsWith("[")){b=void 0;continue}if(b&&!(b in c)){let d=/^url\s*=\s*(.+)$/.exec(a)?.[1];d&&(c[b]=d.trim())}}return c}(b);return c.origin??Object.values(c)[0]}(c):void 0;return{url:e??d.split(u.sep).join("/"),name:(e?function(a){let b=a.replace(/\.git$/,"").split(/[/:]/).filter(Boolean).pop();return b&&b.length>0?b:void 0}(e):void 0)??(0,u.basename)(d)}}catch{return}}function bM(a){try{return bO(a)}catch{return}}function bN(a){try{let b=bO(a);if(!b)return;return bP(b)?.headRoot??b}catch{return}}function bO(a){let b=a;for(;;){if((0,t.existsSync)((0,u.join)(b,".git")))return b;let a=(0,u.dirname)(b);if(a===b)return;b=a}}function bP(a){let b=(0,u.join)(a,".git");try{if((0,t.statSync)(b).isDirectory())return{configPath:(0,u.join)(b,"config"),headRoot:a}}catch{return}let c=/^gitdir:\s*(.+?)\s*$/m.exec(bQ(b)??"")?.[1];if(!c)return;let d=(0,u.isAbsolute)(c)?c:(0,u.join)(a,c);if((0,t.existsSync)((0,u.join)(d,"config")))return{configPath:(0,u.join)(d,"config"),headRoot:a};let e=bQ((0,u.join)(d,"commondir"))?.trim();if(!e)return;let f=(0,u.isAbsolute)(e)?e:(0,u.join)(d,e),g=".git"===(0,u.basename)(f)?(0,u.dirname)(f):a;return{configPath:(0,u.join)(f,"config"),headRoot:g}}function bQ(a){try{return(0,t.readFileSync)(a,"utf8")}catch{return}}var bR=c(77598),bS=c(75919);function bT(a){return a instanceof Error?a.message:String(a)}function bU(a,b={}){let c,d,f,g,h=b.budgetMs??2e3,i=b.probeBudgetMs??1e3,j=b.startBudgetMs??5e3,k=b.minAttributionMs??500,l=!1,m=1,n=new Set,o=Promise.resolve();function p(){let a=g;if(a)return g=void 0,void 0!==a.startupTimer&&clearTimeout(a.startupTimer),void 0!==a.timer&&clearTimeout(a.timer),c?.unref(),a}function q(a){p()?.fail(a)}function r(a){c===a&&(c=void 0),d===a&&(d=void 0);let b=a.terminate().catch(()=>void 0);n.add(b),b.finally(()=>n.delete(b))}function s(a){void 0!==a.startupTimer&&(clearTimeout(a.startupTimer),a.startupTimer=void 0),void 0===a.timer&&(a.startedAt=performance.now(),a.progressAt=a.startedAt,a.timer=setTimeout(()=>{!function(a){if(g!==a)return;let b=performance.now(),c=b-a.progressAt,d=b-a.startedAt,e=a.progressIndex>=0&&c>=k&&c>=.5*d?a.progressIndex:void 0;r(a.worker),q({status:"timeout",culpritIndex:e,elapsedMs:d})}(a)},a.budgetMs))}function u(h,i){if(l)return void i({status:"unavailable",reason:"the scan worker is closed"});if(void 0!==f)return void i({status:"unavailable",reason:`the scan worker crashed: ${f}`});let k=function(){let h;if(c)return c;let i=b.workerUrl??function(){if(void 0!==e)return e??void 0;for(let a of["scan-worker.js","scan-worker.ts"]){let b=new URL(a,"file:///home/runner/work/ai-tc/ai-tc/packages/plugin-sdk/src/isolated-scan.ts");try{if((0,t.existsSync)((0,v.fileURLToPath)(b)))return e=b,b}catch{}}e=null}();if(!i)return{error:"the scan worker script was not found next to this bundle"};try{h=new bS.Worker(i,{workerData:a})}catch(a){return{error:`could not start the scan worker: ${bT(a)}`}}return b.onWorkerStart?.(h.threadId),h.on("message",a=>{if(c!==h)return;if("ready"===a.kind){d=h,g?.worker===h&&s(g);return}if("progress"===a.kind){g?.worker===h&&(g.progressIndex=a.index,g.progressAt=performance.now());return}if(g?.id!==a.id)return;if("failed"===a.kind)return void q({status:"unavailable",reason:`the scan worker failed: ${a.message}`});let b=p();b&&!b.reply(a)&&b.fail({status:"unavailable",reason:"the scan worker answered the wrong job"})}),h.on("error",a=>{c===h&&(f=bT(a),c=void 0,d===h&&(d=void 0),q({status:"unavailable",reason:`the scan worker crashed: ${f}`}))}),h.on("exit",()=>{c===h&&(f??="the scan worker exited before answering",c=void 0,d===h&&(d=void 0),q({status:"unavailable",reason:"the scan worker exited before answering"}))}),h.unref(),c=h,h}();if(!(k instanceof bS.Worker)){f=k.error,i({status:"unavailable",reason:k.error});return}let n=m++,o=performance.now(),u={id:n,worker:k,budgetMs:h.budgetMs,startedAt:o,progressIndex:-1,progressAt:o,startupTimer:void 0,timer:void 0,reply:h.reply,fail:i};g=u,k.ref(),d===k?s(u):u.startupTimer=setTimeout(()=>{g===u&&(r(u.worker),q({status:"unavailable",reason:`the scan worker did not start within ${String(j)}ms`}))},j);try{k.postMessage(h.build(n))}catch(a){q({status:"unavailable",reason:`could not reach the scan worker: ${bT(a)}`})}}function w(a){let b=o.then(()=>new Promise(b=>{a(b)}));return o=b.then(()=>void 0,()=>void 0),b}return{scan:(a,b,c)=>w(d=>{u({budgetMs:h,build:d=>({kind:"scan",id:d,text:a,filePath:b?.filePath,attribute:c?.attribute===!0}),reply:a=>"result"===a.kind&&(d({status:"ok",findings:a.findings}),!0)},d)}),probe:a=>w(b=>{u({budgetMs:i,build:b=>({kind:"probe",id:b,rule:a}),reply:a=>"probed"===a.kind&&(b({status:"ok",verdict:a.verdict,worstMs:a.worstMs,corroboratedMs:a.corroboratedMs}),!0)},b)}),async close(){l=!0;let a=c;c=void 0,d=void 0,q({status:"unavailable",reason:"the scan worker is closed"}),a&&r(a),await Promise.all([...n])}}}function bV(){let a="function"==typeof process.threadCpuUsage?process.threadCpuUsage():process.cpuUsage();return(a.user+a.system)/1e3}function bW(a){if("regex"===a.matcher.type){var b;return b=`${a.matcher.pattern} ${a.matcher.flags}`,(0,bR.createHash)("sha256").update(b).digest("hex")}}function bX(a,b,c,d){process.stderr.write(`[aka] ${b} rule "${a.id}": ${c}${d?" (clear it with `aka detections unquarantine`)":""}
+`)}function bY(a,b,c){bX(a,"quarantined",Number.isFinite(b)?`regex matcher exceeded the ReDoS timing budget (${b.toFixed(1)}ms); excluded from this scan.`:"the timing battery failed while measuring its regex matcher; excluded from this scan.",c)}async function bZ(a,b,c,d){let e=bW(b),f=!1;if(void 0!==e)try{await a.setRuleProbeVerdict(e,"quarantined",c),f=!0}catch{}bX(b,"quarantined",d,f)}async function b$(a,b,c){var d,e;let f=c?.passBudgetMs??2e3,g=c?.prober,h=performance.now(),i=[],j=new Map;try{for(let c of a){let a,k,l,m=bW(c);if(void 0===m){i.push(c);continue}try{a=await b.getRuleProbeVerdict(m)}catch{a=void 0}if(a){"safe"===a.verdict?i.push(c):bY(c,a.worstProbeMs,!0);continue}if(performance.now()-h>=f){bX(c,"skipped","the timing pre-flight ran out of time before this rule could be measured; excluded for the rest of this run, and measured again next time.",!1);continue}let n=0;if(g){let a=await g.probe(c);if("unavailable"===a.status){j.set(a.reason,(j.get(a.reason)??0)+1);continue}k="ok"===a.status?a.verdict:"over-budget",l="ok"===a.status?a.worstMs:a.elapsedMs,"ok"===a.status&&(n=a.corroboratedMs)}else try{({verdict:k,worstMs:l,corroboratedMs:n}=(0,Y.r4)(c,bV))}catch{k="over-budget",l=1/0}if("uncorroborated"===k){d=l,e=n,bX(c,"deferred",`its regex matcher ran past the ReDoS timing budget (${d.toFixed(1)}ms) but spent only ${e.toFixed(1)}ms of CPU doing it, which is a busy machine rather than a slow pattern; excluded from this run and measured again next time, with nothing recorded against it.`,!1);continue}let o="safe"===k,p=!1;try{await b.setRuleProbeVerdict(m,o?"safe":"quarantined",l),p=!0}catch{}o?i.push(c):bY(c,l,p)}}finally{for(let[a,b]of j)process.stderr.write(`[aka] ${String(b)} pulled/custom-pack rule(s) could not be time-checked: ${a}. That is a problem with this install, not with the rules — until it is fixed they are excluded from every scan on this machine. Nothing was quarantined, so reinstalling AKA brings them straight back.
+`)}return i}function b_(a,b,c){process.stderr.write(`[aka] isolated scanning is off for ${a}: ${c}. ${String(b)} pulled/custom-pack rule(s) are excluded; the built-in packs still run.
+`)}var b0=c(57427),b1=c.n(b0);function b2(a,b,c){try{return{matcher:b1()().add((0,t.readFileSync)((0,u.join)(a,b),"utf8")),anchorLen:c}}catch{return}}function b3(a,b,c,d){let e=d?"/":"";for(let d=a.length-1;d>=0;d--){var f;let g=a[d];if(void 0===g)continue;let h=g.matcher.test((f=g.anchorLen,(f===b.length?c:`${b.slice(0===f?0:f+1)}/${c}`)+e));if(h.ignored)return"ignored";if(h.unignored)return"unignored"}return"unmatched"}function b4(a,b){return""===a?b:`${a}/${b}`}function b5(a,b){return b?[...a,b]:a}function b6(a){return a.split(u.sep).join("/")}let b7=new Set([".git","node_modules",".pnpm-store",".venv","venv","__pycache__",".next",".turbo","dist","build","out","coverage","target",".cache"]),b8={maxDepth:64,budgetMs:4e3};function b9(a,b,c,d){return"ignored"===b3(a,b,c,d)}let ca=new Set(["pnpm-lock.yaml","package-lock.json","yarn.lock","cargo.lock","poetry.lock","gemfile.lock","composer.lock","go.sum"]),cb=new Set([".yml",".yaml",".toml",".ini",".properties",".conf"]),cc=new Set([".md",".mdx",".rst",".adoc",".txt"]),cd=new Set(["cmakelists.txt","constraints.txt","robots.txt"]),ce=new Set([".csv",".tsv",".parquet",".sql",".jsonl",".ndjson"]),cf=new Set(["package.json","dockerfile","makefile","justfile",".gitignore",".gitattributes",".npmrc",".nvmrc",".editorconfig",".akaignore"]),cg=$.vk(a=>{if("string"!=typeof a||""!==a.trim())return a},$.Yj().optional()).catch(void 0),ch=$.vk(a=>{if("string"!=typeof a)return!1;let b=a.trim().toLowerCase();return""!==b&&"0"!==b&&"false"!==b},$.zM()).catch(!1);$.Ik({GOOGLE_GENAI_USE_VERTEXAI:ch,GOOGLE_GEMINI_BASE_URL:cg});let ci=$.vk(a=>{if("string"!=typeof a||""!==a.trim())return a},$.Yj().optional()).catch(void 0);function cj(a,b,c,d=(0,Z.tI)()){try{let e,f,g,h;if(!(0,Z.xR)(d).dataSharesInPlace)return null;let i=(0,u.resolve)(b),j=(0,t.statSync)(i).isDirectory()?i:(0,u.dirname)(i),k=bL(i),l=bM(i);k&&l?(e=l,f=`git:${k.url}`,g=k.name,h=a.sourceProject.upsert({url:k.url,name:k.name,attributes:{}})):({root:e,projectKey:f,project:g}=function(a,b){let c=function(a,b){let c=a,d=null;for(let a=0;a<40;a+=1){(function(a,b){try{for(let c of(0,t.readdirSync)(a,{withFileTypes:!0}))if(c.isFile()&&null!=b(c.name))return!0}catch{}return!1})(c,b)&&(d=c);let a=(0,u.dirname)(c);if(a===c)break;c=a}return d??a}(a,b),d=(0,t.realpathSync)(c);return{root:c,projectKey:`path:${d}`,project:(0,u.basename)(d)}}(j,Y.DK),h=null);let m=[];for(let a of c.files){let b=b6((0,u.relative)(e,a.file));!(""===b||b.startsWith("../"))&&(b.startsWith(".")||b.includes("/.")||m.push({...a,file:b,vendored:(0,Y.$1)(b)}))}return{...a.shares.recordProjectEgress({projectKey:f,project:g,projectId:h,reconcile:{mode:"walk",walkedPrefix:b6((0,u.relative)(e,i))},hits:(0,Y.Ip)(m)}),project:g}}catch{return null}}$.Ik({OPENAI_BASE_URL:ci});let ck=new Set(["node_modules",".git","dist",".next","coverage",".turbo","build","out"]);async function cl(a,b,c={}){let d,e=c.scanText??(a=>Promise.resolve((0,Y.SQ)(a,c.rules))),f=0,g=0,h=[],i=[];for(let{path:j,gitignored:k}of function*(a){let b;try{b=(0,t.statSync)(a)}catch{return}if(b.isFile()){b.size<=1e6&&(yield{path:a,gitignored:!1});return}b.isDirectory()&&(yield*function* a(b,c,d,e,f){let g;try{g=(0,t.readdirSync)(b,{withFileTypes:!0})}catch(a){if(""===c)throw a;return}let h=b5(d,f?void 0:b2(b,".gitignore",c.length)),i=b5(e,b2(b,".akaignore",c.length));for(let d of g){let e=(0,u.join)(b,d.name);if(d.isDirectory()){let b=b3(i,c,d.name,!0);if("unignored"!==b&&(ck.has(d.name)||d.name.startsWith(".")||"ignored"===b))continue;let g=f||"ignored"===b3(h,c,d.name,!0);yield*a(e,b4(c,d.name),h,i,g)}else if(d.isFile()){let a;if("ignored"===b3(i,c,d.name,!1))continue;try{a=(0,t.statSync)(e).size}catch{continue}if(a>1e6)continue;yield{path:e,gitignored:f||"ignored"===b3(h,c,d.name,!1)}}}}(a,"",[],[],!1))}((0,u.resolve)(b))){let b;try{b=(0,t.readFileSync)(j,"utf8")}catch{continue}f++;let l=function(a,b){if(b.includes("\0"))return null;let c=(0,u.basename)(a);if(Y.mu.has(c))return null;let d=(0,Y.DK)(c),e=null===d?[]:(0,Y.W$)(b,d),f=null===d&&Y.Nc.has((0,u.extname)(a))?(0,Y.Pb)(b):[];return 0===f.length&&0===e.length?null:{file:a,vendored:(0,Y.$1)(b6(a)),endpoints:f,sdkHits:e}}(j,b);l&&i.push(l);let m=(0,Y.KD)(b),n=(0,Y.uT)(await e(m.text),m.spans);if(0===n.length)continue;let o=(0,bR.randomUUID)(),p={filePath:j};k&&(p.gitignored=!0);let q={id:o,sourceTool:c.sourceTool??w.Zdp.Cli,kind:"code_change",occurredAt:new Date().toISOString(),contentHash:(0,bR.createHash)("sha256").update(b).digest("hex"),content:(0,Y.E$)(b,n),metadata:p},r=n.map(a=>{let b=(0,Y.sE)(a.rawMatch),e=function(){if(void 0===d)try{d=c.dataDir?(0,Z.Rd)(c.dataDir):null}catch{d=null}return d}(),f=e?(0,Z._2)(e,a.rawMatch):b;return{id:(0,bR.randomUUID)(),eventId:o,ruleId:a.ruleId,category:a.category,severity:a.severity,span:a.span,maskedMatch:b,actionTaken:c.ruleActions?.get(a.ruleId)??w.unw[a.category],confidence:a.confidence,findingKey:(0,Z.Qo)({ruleId:a.ruleId,filePath:j,valueFingerprint:f})}});a.recordCapture(q,r),h.push({path:j,gitignored:k,findings:r}),g+=r.length}return{scanned:f,findings:g,files:h,egress:{files:i}}}let cm={status:"unavailable",reason:"this build shipped without its scan worker, so there was nowhere killable to measure them"};async function cn(a,b,c={}){let e,g={getRuleProbeVerdict:b=>Promise.resolve(a.ruleProbeCache.getVerdict(b)),setRuleProbeVerdict:(b,c,d)=>(a.ruleProbeCache.setVerdict(b,c,d),Promise.resolve())},h=c.workerUrl,i={workerUrl:h,budgetMs:c.budgetMs,probeBudgetMs:c.probeBudgetMs,startBudgetMs:c.startBudgetMs,onWorkerStart:c.onWorkerStart,minAttributionMs:void 0},j=f??=new Set((d??=bK.map(a=>({namespace:"aka",packId:a.packId,version:a.version,name:a.name,rules:a.rawRules.map(a=>w.jON.parse(a))}))).flatMap(a=>a.rules).map(bW).filter(a=>void 0!==a)),k=[],l=[];for(let a of b){let b=bW(a);void 0!==b&&j.has(b)?k.push(a):l.push(a)}let m=await b$(l,g,{passBudgetMs:c.passBudgetMs,prober:{probe:a=>void 0===h?Promise.resolve(cm):(e??=bU({verified:[],unverified:[]},i)).probe(a)}});await e?.close();let n=new Set(m),o=0,p=0;for(let a of l){let b;if(n.has(a))continue;let c=bW(a);try{b=void 0===c?void 0:(await g.getRuleProbeVerdict(c))?.verdict}catch{b=void 0}"quarantined"===b?o++:p++}let q=[...k],r=[],s=0;for(let a of m)"regex"!==a.matcher.type?q.push(a):void 0!==h?r.push(a):s++;let t=function(a,b,c){let d=c?.degradeScope??"the rest of this process",e=a.verified,f=a.unverified,g=f.length>0?bU({verified:e,unverified:f},c):void 0,h=!1;async function i(){let a=g;g=void 0,f=[],a&&await a.close()}async function j(){h=!0,await i()}async function k(a,b,c,d){try{return await a.scan(b,c,{attribute:d})}catch(a){return{status:"unavailable",reason:a instanceof Error?a.message:"the scan worker failed unexpectedly"}}}return{scan:async function(a,c){let h=g;if(!h)return(0,Y.SQ)(a,e,c);let i=await k(h,a,c,!1);if("ok"===i.status)return i.findings;"timeout"===i.status&&(i=await k(h,a,c,!0));let l=f.length;if("ok"===i.status){b_(d,l,"a scan overran its bound once and no rule could be held responsible");let a=i.findings;return await j(),a}if("timeout"===i.status){let a=void 0===i.culpritIndex?void 0:f[i.culpritIndex];a&&await bZ(b,a,i.elapsedMs,`it did not finish within the ${i.elapsedMs.toFixed(0)}ms isolated-scan bound and was terminated; excluded from every later scan.`),b_(d,l,a?`rule "${a.id}" had to be terminated mid-scan`:`a scan was terminated at the ${i.elapsedMs.toFixed(0)}ms bound and no single rule could be held responsible, so nothing was quarantined and the next process will try these rules again`)}else b_(d,l,i.reason);return await j(),(0,Y.SQ)(a,e,c)},degraded:()=>h,async close(){await i()}}}({verified:q,unverified:r},g,{...i,degradeScope:"the rest of this scan"});return p+=s,{scanText:a=>t.scan(a),dropped:()=>({quarantined:o,unmeasured:p,bound:t.degraded()?r.length:0,isolated:void 0!==h}),close:()=>t.close()}}function co(a,b){try{let c=(0,u.resolve)(b);(0,t.statSync)(c);let d=bL(c);if(!d)return null;let e=a.sourceProject.upsert({url:d.url,name:d.name,attributes:{}}),f=function(a,b={}){let c=b.bounds??b8,d=b.now??(()=>performance.now());try{let b=bM(a);if(!b)return;let e=bN(a)!==b,f=[],g={lostSubtree:!1,omitted:!1,seen:0},h=d()+c.budgetMs,i=function a(b,e,i,j){let k;try{k=(0,t.readdirSync)(b,{withFileTypes:!0,encoding:"utf8"})}catch{return g.lostSubtree=!0,!1}if(d()>h)return g.omitted=!0,!0;let l=b5(i,b2(b,".gitignore",e.length));for(let i of k){if(g.seen++,g.seen%512==0&&d()>h)return g.omitted=!0,!0;if(i.isDirectory()){if(b7.has(i.name)||b9(l,e,i.name,!0))continue;let d=(0,u.join)(b,i.name);if((0,t.existsSync)((0,u.join)(d,".git")))continue;if(j>=c.maxDepth){g.omitted=!0;continue}if(a(d,b4(e,i.name),l,j+1))return!0;continue}if(!i.isFile()||".git"===i.name||b9(l,e,i.name,!1))continue;if(f.length>=2e4)return!0;let k=b4(e,i.name);f.push({path:k,name:(0,u.basename)(i.name),origin:function(a,b){let c=b.toLowerCase(),d=c.lastIndexOf("."),e=d>0?c.slice(d):"",f=a.split("/");return ca.has(c)||c.includes(".generated.")||f.includes("__generated__")||f.includes("generated")||".map"===e||c.endsWith(".min.js")||c.endsWith(".min.css")?"generated":f.includes("vendor")||f.includes("third_party")?"vendored":cd.has(c)||".txt"===e&&c.startsWith("requirements")?"config":cc.has(e)||c.startsWith("license")||"docs"===f[0]?"docs":ce.has(e)||f.includes("fixtures")||f.includes("__fixtures__")?"data":cf.has(c)||cb.has(e)||c.startsWith(".")||c.includes(".config.")||c.startsWith("tsconfig")?"config":"source"}(k,i.name),defaultAccess:"approved"})}return!1}(b,"",[],0)||g.lostSubtree||g.omitted||e;if(0===f.length)return;return f.sort((a,b)=>a.path.localeCompare(b.path)),{files:f,truncated:i,scannedAt:new Date().toISOString()}}catch{return}}(c);f&&a.recordProjectFiles(e,f);let g=bN(c),h=bM(c);return g&&h&&a.reconcileWorktreeProjects(e,g,h),{projectId:e,name:d.name,url:d.url,fileCount:f?.files.length??0,truncated:f?.truncated??!1}}catch{return null}}function cp(a){return(0,u.join)((0,Z.KS)(a),"update-check.json")}function cq(a){try{(0,t.rmSync)(cp(a),{force:!0})}catch{}}function cr(a){let b=function(a){let b=cp(a);if(!(0,t.existsSync)(b))return null;try{let a=JSON.parse((0,t.readFileSync)(b,"utf8"));if(!D(a)||"number"!=typeof a.checkedAt||!D(a.report))return null;return a}catch{return null}}(a);var c={checkedAt:Date.now(),report:function(a){let b=a.viewVersion(C),c=[{id:"cli",name:"aka CLI",kind:"cli",installed:a.cliInstalled,latest:b,updateAvailable:null!==a.cliInstalled&&null!==b&&B(b,a.cliInstalled)>0}],d=[];for(let b of x){let e=y(b);if(!e||!b.npmPackage)continue;let f=a.viewVersion(b.npmPackage),g=a.installed.get(e)??null;if(null===g){d.push({id:b.id,name:b.name,latest:f});continue}c.push({id:b.id,name:b.name,kind:"plugin",installed:g,latest:f,updateAvailable:null!==f&&B(f,g)>0})}return{statuses:c,availablePlugins:d}}({viewVersion:E,installed:new Map([...function(a=(0,u.join)((0,h.homedir)(),".claude")){let b,c=new Map,d=(0,u.join)(a,"plugins","installed_plugins.json");if(!(0,t.existsSync)(d))return c;try{b=JSON.parse((0,t.readFileSync)(d,"utf8"))}catch{return c}if(!D(b)||!D(b.plugins))return c;for(let[a,d]of Object.entries(b.plugins)){if(!Array.isArray(d)||0===d.length)continue;let b=d.find(a=>D(a)&&"user"===a.scope)??d.find(a=>D(a));b&&"string"==typeof b.version&&c.set(a,b.version)}return c}(void 0),...function(a=(0,u.join)((0,h.homedir)(),".codex")){let b=new Map,c=(0,u.join)(a,"plugins","cache");for(let a of x){if("codex"!==a.cliBin)continue;let d=y(a);if(!d||!a.pluginName||!a.marketplace)continue;let e=function(a){let b;try{b=(0,t.readdirSync)(a,{withFileTypes:!0}).filter(a=>a.isDirectory()).map(a=>a.name)}catch{return null}if(0===b.length)return null;if(b.includes("local"))return"local";let c=b.filter(A);return 0===c.length?null:c.reduce((a,b)=>B(b,a)>0?b:a)}((0,u.join)(c,a.marketplace,a.pluginName));null!==e&&b.set(d,e)}return b}(void 0)]),cliInstalled:function(a){let b=(void 0)??(0,u.dirname)((0,v.fileURLToPath)("file:///home/runner/work/ai-tc/ai-tc/packages/local-ops/src/updates.ts"));for(let a=0;a<6;a++){let a=(0,u.join)(b,"package.json");if((0,t.existsSync)(a))try{let b=JSON.parse((0,t.readFileSync)(a,"utf8"));if(D(b)&&b.name===C&&"string"==typeof b.version)return b.version}catch{}let c=(0,u.dirname)(b);if(c===b)break;b=c}return null}()}),notifiedPluginIds:b?.notifiedPluginIds??[]};if((0,t.existsSync)((0,Z.KS)(a)))try{(0,Z.g5)(cp(a),`${JSON.stringify(c,null,2)}
+`)}catch{}}}};