@akasecurity/cli 0.9.9 → 0.9.11

package/web-ui/web-ui/.next/server/chunks/475.js

@@ -1 +1 @@
-"use strict";exports.id=475,exports.ids=[475],exports.modules={19524:(a,b,c)=>{c.d(b,{db:()=>f});var d=c(90793);let e=globalThis;function f(){if(e.__akaDb)return e.__akaDb;let a=(0,d.Ji)((0,d.KS)());return a.purgeSampleData(),e.__akaDb=a,a}},32625:(a,b,c)=>{c.d(b,{Zs:()=>t,cm:()=>s,h2:()=>u,h6:()=>w,oP:()=>v});var d=c(15644);c(33898);var e=c(48161),f=c(80007),g=c(90793),h=c(39e3),i=c(69585),j=c(19524),k=c(90550);let l="Could not read the local store (~/.aka/data/aka.db).";function m(a){return null===a.field?"The request did not arrive in the expected shape — reload the page and try again.":a.wrongType?`The '${a.field}' field did not arrive as text — reload the page and try again.`:`The '${a.field}' field was not in the expected form — reload the page and try again.`}let n=`${l} The fingerprint key cannot be minted until it is readable, because a key that reused a stored version would produce grants that never match.`;function o(a){let b=a?.code;return"floor-unreadable"===b?n:"string"==typeof b?"Could not access the exception key file — check the permissions on ~/.aka/data. Do not delete exception.key to work around this; that invalidates every existing grant.":"The exception key file is corrupt. Delete ~/.aka/data/exception.key to mint a new key (this invalidates existing grants)."}function p(){try{return(0,e.userInfo)().username}catch{return"unknown"}}function q(a){try{return(0,h.N6N)(a)}catch(a){return{error:a instanceof Error?a.message:"invalid scope"}}}function r(a){return(0,j.db)().exceptions.create(a).then(()=>((0,i.revalidatePath)("/exceptions"),{ok:!0})).catch(a=>a instanceof g.qA?{ok:!1,error:"An active exception for this value already exists — revoke it first."}:{ok:!1,error:"Could not create the exception."})}async function s(a){let b,c,d=(0,h.K7s)(h.QcD,a);if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,f=e.reason.trim();if(""===f)return{ok:!1,error:"A reason is required — it is the audit trail."};let i=q(e.scope);if("error"in i)return{ok:!1,error:i.error};try{b=(await (0,j.db)().exceptions.recentBlocked(g.WR)).find(a=>a.reference===e.reference)}catch{return{ok:!1,error:l}}if(!b)return{ok:!1,error:"That blocked detection has expired from the ledger — trigger it again."};try{c=(0,g.y9)((0,g.KS)())}catch(a){return{ok:!1,error:o(a)}}return(0,g.Dg)(c,b.keyVersion)?"permanent"===i.scope&&e.confirmation!==b.maskedValue?{ok:!1,error:"Permanent grants require retyping the masked value exactly as shown."}:r({ruleId:b.ruleId,category:b.category,valueFingerprint:b.valueFingerprint,keyVersion:b.keyVersion,maskedValue:b.maskedValue,...i,justification:f,conditions:null,createdBy:p(),createdVia:"web-approve"}):{ok:!1,error:null===c?"The exception key file is missing, so the fingerprint recorded for this detection can no longer be matched. Trigger the detection again.":`That detection was blocked under fingerprint key v${String(b.keyVersion)}; the key is now v${String(c.version)}, so a grant from it could never match. Trigger the detection again.`}}async function t(a){let b,c,d=(0,h.K7s)(h.Nh0,a);if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,i=e.reason.trim();if(""===i)return{ok:!1,error:"A reason is required — it is the audit trail."};let k=q(e.scope);if("error"in k)return{ok:!1,error:k.error};if(""===e.value)return{ok:!1,error:"No value supplied — nothing to except."};if("permanent"===k.scope&&e.confirmation!==e.value)return{ok:!1,error:"Permanent grants require retyping the value exactly."};try{({rules:b}=(0,j.db)().installedPacks.installedRuleset())}catch{return{ok:!1,error:l}}let n=b.find(a=>a.id===e.ruleId);if(!n)return{ok:!1,error:`Unknown or disabled rule '${e.ruleId}'.`};let s=(0,f.SQ)(e.value,b).filter(a=>a.ruleId===e.ruleId);if(0===s.length)return{ok:!1,error:`The value does not match rule ${e.ruleId} — a grant for it would never apply.`};let t=[...new Set(s.map(a=>a.rawMatch))],u=t[0];if(t.length>1||void 0===u)return{ok:!1,error:`The input contains ${String(t.length)} distinct values matching ${e.ruleId} — supply exactly one.`};try{c=(0,g.Rd)((0,g.KS)())}catch(a){return{ok:!1,error:o(a)}}let v={valueFingerprint:(0,g._2)(c,u),keyVersion:c.version,maskedValue:(0,f.sE)(u)};return r({ruleId:n.id,category:n.category,...v,...k,justification:i,conditions:null,createdBy:p(),createdVia:"web-add"})}async function u(a){let b,c,d=(0,h.K7s)(h.agn,a);if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,f=e.justification.trim();if(""===f)return{ok:!1,error:"A justification is required — it is the audit trail."};let k=q(e.scope);if("error"in k)return{ok:!1,error:k.error};let l=h.jUf.safeParse(e.pointer.trim());if(!l.success)return{ok:!1,error:"Not a vault pointer — paste the full [[aka:...]] token."};try{let a=new g.Pi({repo:(0,j.db)().secretVault,keys:(0,g.Ru)((0,g.xR)().vaultKeyCustody,(0,g.Wo)()),isConsented:()=>(0,h.hds)((0,g.xR)().vaultConsent)});b=await a.resolvePointerIdentity(l.data),c=null===b?null:await a.describePointer(l.data)}catch{b=null,c=null}if(null===b)return{ok:!1,error:"The pointer could not be resolved — it is not one this machine issued, or its entry was purged."};let n=c?.category??function(a){let b=a.slice(6).split(":")[0]??"",c=h.gbA.safeParse(b);return c.success?c.data:null}(l.data);if(null===n)return{ok:!1,error:"Not a vault pointer — paste the full [[aka:...]] token."};if("permanent"===k.scope){if(null===c)return{ok:!1,error:"A permanent reveal needs the value preview to confirm against — use a time-limited scope."};if(e.confirmation!==c.maskedMatch)return{ok:!1,error:`A permanent reveal must be confirmed by retyping the masked value (${c.maskedMatch}).`}}try{let a=await (0,j.db)().exceptions.create({ruleId:b.ruleId,category:n,valueFingerprint:b.valueFingerprint,keyVersion:b.fingerprintKeyVersion,maskedValue:c?.maskedMatch??"\xb7\xb7\xb7",capability:"reveal_to_model",...k,justification:f,conditions:null,createdBy:"dashboard",createdVia:"web-approve"});return(0,i.revalidatePath)("/exceptions"),{ok:!0,grantIdPrefix:a.id.slice(0,8)}}catch(a){if(a instanceof g.qA)return{ok:!1,error:"An active exception for this value already exists — revoke it first."};return{ok:!1,error:"Could not create the reveal grant."}}}async function v(a,b){let c,d=(0,h.K7s)(h.eYL,{id:a,reason:b});if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,f=e.reason.trim();try{c=await (0,j.db)().exceptions.revoke(e.id,p(),""===f?void 0:f)}catch{return{ok:!1,error:l}}return c?((0,i.revalidatePath)("/exceptions"),(0,i.revalidatePath)(`/exceptions/${e.id}`),{ok:!0}):{ok:!1,error:"No active exception with that id."}}async function w(a){let b,c=(0,h.K7s)(h.JJC,{confirmation:a});if(!c.ok)return{ok:!1,error:m(c)};if("rotate"!==c.data.confirmation)return{ok:!1,error:'Type "rotate" to confirm.'};try{b=(0,g.v5)((0,g.KS)())}catch(a){return{ok:!1,error:`Could not rotate the fingerprint key. ${o(a)}`}}try{let a=new g.Pi({repo:(0,j.db)().secretVault,keys:(0,g.Ru)((0,g.xR)().vaultKeyCustody,(0,g.Wo)()),isConsented:()=>(0,h.hds)((0,g.xR)().vaultConsent)});await a.refreshFingerprints(b)}catch{}return(0,i.revalidatePath)("/exceptions"),{ok:!0}}(0,k.D)([s,t,u,v,w]),(0,d.A)(s,"405880b75d5f65a57414362f311c70536fa102c8a6",null),(0,d.A)(t,"40244e553ffd5230f4c4a4258cfed96eca83a21ad3",null),(0,d.A)(u,"40c362800d96d77a1dbb381495d970d8821cf6ffca",null),(0,d.A)(v,"60793d405d4ee06afe843025742bee47b46acedf5a",null),(0,d.A)(w,"4027dd09f07fe77cc6616933f8c100f6a6e04ca99c",null)},60667:(a,b,c)=>{c.d(b,{db:()=>f});var d=c(82312);let e=globalThis;function f(){if(e.__akaDb)return e.__akaDb;let a=(0,d.Ji)((0,d.KS)());return a.purgeSampleData(),e.__akaDb=a,a}}};
+"use strict";exports.id=475,exports.ids=[475],exports.modules={19524:(a,b,c)=>{c.d(b,{db:()=>f});var d=c(15905);let e=globalThis;function f(){if(e.__akaDb)return e.__akaDb;let a=(0,d.Ji)((0,d.KS)());return a.purgeSampleData(),e.__akaDb=a,a}},32625:(a,b,c)=>{c.d(b,{Zs:()=>t,cm:()=>s,h2:()=>u,h6:()=>w,oP:()=>v});var d=c(15644);c(33898);var e=c(48161),f=c(80007),g=c(15905),h=c(49008),i=c(69585),j=c(19524),k=c(90550);let l="Could not read the local store (~/.aka/data/aka.db).";function m(a){return null===a.field?"The request did not arrive in the expected shape — reload the page and try again.":a.wrongType?`The '${a.field}' field did not arrive as text — reload the page and try again.`:`The '${a.field}' field was not in the expected form — reload the page and try again.`}let n=`${l} The fingerprint key cannot be minted until it is readable, because a key that reused a stored version would produce grants that never match.`;function o(a){let b=a?.code;return"floor-unreadable"===b?n:"string"==typeof b?"Could not access the exception key file — check the permissions on ~/.aka/data. Do not delete exception.key to work around this; that invalidates every existing grant.":"The exception key file is corrupt. Delete ~/.aka/data/exception.key to mint a new key (this invalidates existing grants)."}function p(){try{return(0,e.userInfo)().username}catch{return"unknown"}}function q(a){try{return(0,h.N6N)(a)}catch(a){return{error:a instanceof Error?a.message:"invalid scope"}}}function r(a){return(0,j.db)().exceptions.create(a).then(()=>((0,i.revalidatePath)("/exceptions"),{ok:!0})).catch(a=>a instanceof g.qA?{ok:!1,error:"An active exception for this value already exists — revoke it first."}:{ok:!1,error:"Could not create the exception."})}async function s(a){let b,c,d=(0,h.K7s)(h.QcD,a);if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,f=e.reason.trim();if(""===f)return{ok:!1,error:"A reason is required — it is the audit trail."};let i=q(e.scope);if("error"in i)return{ok:!1,error:i.error};try{b=(await (0,j.db)().exceptions.recentBlocked(g.WR)).find(a=>a.reference===e.reference)}catch{return{ok:!1,error:l}}if(!b)return{ok:!1,error:"That blocked detection has expired from the ledger — trigger it again."};try{c=(0,g.y9)((0,g.KS)())}catch(a){return{ok:!1,error:o(a)}}return(0,g.Dg)(c,b.keyVersion)?"permanent"===i.scope&&e.confirmation!==b.maskedValue?{ok:!1,error:"Permanent grants require retyping the masked value exactly as shown."}:r({ruleId:b.ruleId,category:b.category,valueFingerprint:b.valueFingerprint,keyVersion:b.keyVersion,maskedValue:b.maskedValue,...i,justification:f,conditions:null,createdBy:p(),createdVia:"web-approve"}):{ok:!1,error:null===c?"The exception key file is missing, so the fingerprint recorded for this detection can no longer be matched. Trigger the detection again.":`That detection was blocked under fingerprint key v${String(b.keyVersion)}; the key is now v${String(c.version)}, so a grant from it could never match. Trigger the detection again.`}}async function t(a){let b,c,d=(0,h.K7s)(h.Nh0,a);if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,i=e.reason.trim();if(""===i)return{ok:!1,error:"A reason is required — it is the audit trail."};let k=q(e.scope);if("error"in k)return{ok:!1,error:k.error};if(""===e.value)return{ok:!1,error:"No value supplied — nothing to except."};if("permanent"===k.scope&&e.confirmation!==e.value)return{ok:!1,error:"Permanent grants require retyping the value exactly."};try{({rules:b}=(0,j.db)().installedPacks.installedRuleset())}catch{return{ok:!1,error:l}}let n=b.find(a=>a.id===e.ruleId);if(!n)return{ok:!1,error:`Unknown or disabled rule '${e.ruleId}'.`};let s=(0,f.SQ)(e.value,b).filter(a=>a.ruleId===e.ruleId);if(0===s.length)return{ok:!1,error:`The value does not match rule ${e.ruleId} — a grant for it would never apply.`};let t=[...new Set(s.map(a=>a.rawMatch))],u=t[0];if(t.length>1||void 0===u)return{ok:!1,error:`The input contains ${String(t.length)} distinct values matching ${e.ruleId} — supply exactly one.`};try{c=(0,g.Rd)((0,g.KS)())}catch(a){return{ok:!1,error:o(a)}}let v={valueFingerprint:(0,g._2)(c,u),keyVersion:c.version,maskedValue:(0,f.sE)(u)};return r({ruleId:n.id,category:n.category,...v,...k,justification:i,conditions:null,createdBy:p(),createdVia:"web-add"})}async function u(a){let b,c,d=(0,h.K7s)(h.agn,a);if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,f=e.justification.trim();if(""===f)return{ok:!1,error:"A justification is required — it is the audit trail."};let k=q(e.scope);if("error"in k)return{ok:!1,error:k.error};let l=h.jUf.safeParse(e.pointer.trim());if(!l.success)return{ok:!1,error:"Not a vault pointer — paste the full [[aka:...]] token."};try{let a=new g.Pi({repo:(0,j.db)().secretVault,keys:(0,g.Ru)((0,g.xR)().vaultKeyCustody,(0,g.Wo)()),isConsented:()=>(0,h.hds)((0,g.xR)().vaultConsent)});b=await a.resolvePointerIdentity(l.data),c=null===b?null:await a.describePointer(l.data)}catch{b=null,c=null}if(null===b)return{ok:!1,error:"The pointer could not be resolved — it is not one this machine issued, or its entry was purged."};let n=c?.category??function(a){let b=a.slice(6).split(":")[0]??"",c=h.gbA.safeParse(b);return c.success?c.data:null}(l.data);if(null===n)return{ok:!1,error:"Not a vault pointer — paste the full [[aka:...]] token."};if("permanent"===k.scope){if(null===c)return{ok:!1,error:"A permanent reveal needs the value preview to confirm against — use a time-limited scope."};if(e.confirmation!==c.maskedMatch)return{ok:!1,error:`A permanent reveal must be confirmed by retyping the masked value (${c.maskedMatch}).`}}try{let a=await (0,j.db)().exceptions.create({ruleId:b.ruleId,category:n,valueFingerprint:b.valueFingerprint,keyVersion:b.fingerprintKeyVersion,maskedValue:c?.maskedMatch??"\xb7\xb7\xb7",capability:"reveal_to_model",...k,justification:f,conditions:null,createdBy:"dashboard",createdVia:"web-approve"});return(0,i.revalidatePath)("/exceptions"),{ok:!0,grantIdPrefix:a.id.slice(0,8)}}catch(a){if(a instanceof g.qA)return{ok:!1,error:"An active exception for this value already exists — revoke it first."};return{ok:!1,error:"Could not create the reveal grant."}}}async function v(a,b){let c,d=(0,h.K7s)(h.eYL,{id:a,reason:b});if(!d.ok)return{ok:!1,error:m(d)};let e=d.data,f=e.reason.trim();try{c=await (0,j.db)().exceptions.revoke(e.id,p(),""===f?void 0:f)}catch{return{ok:!1,error:l}}return c?((0,i.revalidatePath)("/exceptions"),(0,i.revalidatePath)(`/exceptions/${e.id}`),{ok:!0}):{ok:!1,error:"No active exception with that id."}}async function w(a){let b,c=(0,h.K7s)(h.JJC,{confirmation:a});if(!c.ok)return{ok:!1,error:m(c)};if("rotate"!==c.data.confirmation)return{ok:!1,error:'Type "rotate" to confirm.'};try{b=(0,g.v5)((0,g.KS)())}catch(a){return{ok:!1,error:`Could not rotate the fingerprint key. ${o(a)}`}}try{let a=new g.Pi({repo:(0,j.db)().secretVault,keys:(0,g.Ru)((0,g.xR)().vaultKeyCustody,(0,g.Wo)()),isConsented:()=>(0,h.hds)((0,g.xR)().vaultConsent)});await a.refreshFingerprints(b)}catch{}return(0,i.revalidatePath)("/exceptions"),{ok:!0}}(0,k.D)([s,t,u,v,w]),(0,d.A)(s,"408b5427079caf9b30833528c8bab491867be2a64b",null),(0,d.A)(t,"40728cc2ad154102de8725aeb7b95aefd974fa9a07",null),(0,d.A)(u,"409614ccfb6901368cf1bd6fd6e0bf71a0f265749a",null),(0,d.A)(v,"608657ad8f83025db42d8cd579240599cdac8b336f",null),(0,d.A)(w,"40e13d8389bbb3bd5dcff887c3717d1e64eadc1868",null)},60667:(a,b,c)=>{c.d(b,{db:()=>f});var d=c(93142);let e=globalThis;function f(){if(e.__akaDb)return e.__akaDb;let a=(0,d.Ji)((0,d.KS)());return a.purgeSampleData(),e.__akaDb=a,a}}};

package/web-ui/web-ui/.next/server/chunks/7.js

@@ -1 +1 @@
-"use strict";exports.id=7,exports.ids=[7],exports.modules={80007:(a,b,c)=>{c.d(b,{Nc:()=>n,mu:()=>X,r4:()=>aY,uT:()=>aT,Pb:()=>S,W$:()=>$,$1:()=>P,DK:()=>Z,sE:()=>aQ,E$:()=>aP,Ip:()=>ay,SQ:()=>aN,KD:()=>aS});let d=[{id:"stripe",name:"Stripe",category:"Payments",hostSuffixes:["stripe.com"],apiBase:"https://api.stripe.com",defaultDataClasses:["pii","customer"],sdks:{npm:["stripe"],pypi:["stripe"],go:["github.com/stripe/stripe-go"],maven:["com.stripe"],rubygems:["stripe"],composer:["stripe/stripe-php"],nuget:["Stripe.net"]}},{id:"datadog",name:"Datadog",category:"Observability",hostSuffixes:["datadoghq.com","datadoghq.eu"],apiBase:"https://api.datadoghq.com",defaultDataClasses:["telemetry","logs","metrics"],sdks:{npm:["dd-trace","@datadog/browser-logs"],pypi:["datadog","ddtrace"],go:["github.com/DataDog/dd-trace-go"],maven:["com.datadoghq"],rubygems:["ddtrace","dogapi"],nuget:["Datadog.Trace"]}},{id:"newrelic",name:"New Relic",category:"Observability",hostSuffixes:["newrelic.com","nr-data.net"],apiBase:"https://api.newrelic.com",defaultDataClasses:["telemetry","logs","metrics"],sdks:{npm:["newrelic"],pypi:["newrelic"],go:["github.com/newrelic/go-agent"],maven:["com.newrelic.agent.java"],rubygems:["newrelic_rpm"],nuget:["NewRelic.Agent"]}},{id:"sentry",name:"Sentry",category:"Error tracking",hostSuffixes:["sentry.io"],apiBase:"https://sentry.io",defaultDataClasses:["source","telemetry"],sdks:{npm:["@sentry/node","@sentry/react","@sentry/nextjs"],pypi:["sentry-sdk"],go:["github.com/getsentry/sentry-go"],maven:["io.sentry"],rubygems:["sentry-ruby"],cargo:["sentry"],composer:["sentry/sentry"],nuget:["Sentry"]}},{id:"openai",name:"OpenAI",category:"LLM provider",hostSuffixes:["openai.com"],apiBase:"https://api.openai.com",defaultDataClasses:["pii","source"],sdks:{npm:["openai"],pypi:["openai"],go:["github.com/sashabaranov/go-openai"],maven:["com.openai"],rubygems:["ruby-openai"],cargo:["async-openai"],composer:["openai-php/client"],nuget:["OpenAI"]}},{id:"anthropic",name:"Anthropic",category:"LLM provider",hostSuffixes:["anthropic.com"],apiBase:"https://api.anthropic.com",defaultDataClasses:["pii","source"],sdks:{npm:["@anthropic-ai/sdk"],pypi:["anthropic"],go:["github.com/anthropics/anthropic-sdk-go"],nuget:["Anthropic.SDK"]}},{id:"aws",name:"Amazon Web Services",category:"Cloud platform",hostSuffixes:["amazonaws.com"],apiBase:"https://s3.amazonaws.com",defaultDataClasses:["secrets","customer"],sdks:{npm:["@aws-sdk/client-s3","aws-sdk"],pypi:["boto3"],go:["github.com/aws/aws-sdk-go","github.com/aws/aws-sdk-go-v2"],maven:["com.amazonaws","software.amazon.awssdk"],rubygems:["aws-sdk-s3"],cargo:["aws-sdk-s3"],nuget:["AWSSDK.S3"]}},{id:"gcp",name:"Google Cloud",category:"Cloud platform",hostSuffixes:["googleapis.com"],apiBase:"https://storage.googleapis.com",defaultDataClasses:["customer","logs"],sdks:{npm:["@google-cloud/storage"],pypi:["google-cloud-storage"],go:["cloud.google.com/go"],maven:["com.google.cloud"],rubygems:["google-cloud-storage"],nuget:["Google.Cloud.Storage.V1"]}},{id:"azure",name:"Microsoft Azure",category:"Cloud platform",hostSuffixes:["azure.com","windows.net"],apiBase:"https://management.azure.com",defaultDataClasses:["customer","logs"],sdks:{npm:["@azure/storage-blob"],pypi:["azure-storage-blob"],go:["github.com/Azure/azure-sdk-for-go"],maven:["com.azure"],rubygems:["azure-storage-blob"],nuget:["Azure.Storage.Blobs"]}},{id:"slack",name:"Slack",category:"Notifications",hostSuffixes:["slack.com"],apiBase:"https://slack.com/api",defaultDataClasses:["logs"],sdks:{npm:["@slack/web-api"],pypi:["slack-sdk"],go:["github.com/slack-go/slack"],maven:["com.slack.api"],rubygems:["slack-ruby-client"],composer:["slack-php/slack-api"],nuget:["SlackNet"]}},{id:"segment",name:"Segment",category:"Analytics",hostSuffixes:["segment.io","segment.com"],apiBase:"https://api.segment.io",defaultDataClasses:["customer"],sdks:{npm:["@segment/analytics-node","analytics-node"],pypi:["segment-analytics-python"],go:["github.com/segmentio/analytics-go"],maven:["com.segment.analytics.java"],rubygems:["analytics-ruby"],nuget:["Analytics"]}},{id:"twilio",name:"Twilio",category:"Communications",hostSuffixes:["twilio.com"],apiBase:"https://api.twilio.com",defaultDataClasses:["pii","customer"],sdks:{npm:["twilio"],pypi:["twilio"],go:["github.com/twilio/twilio-go"],maven:["com.twilio.sdk"],rubygems:["twilio-ruby"],composer:["twilio/sdk"],nuget:["Twilio"]}},{id:"sendgrid",name:"SendGrid",category:"Email",hostSuffixes:["sendgrid.com"],apiBase:"https://api.sendgrid.com",defaultDataClasses:["pii"],sdks:{npm:["@sendgrid/mail"],pypi:["sendgrid"],go:["github.com/sendgrid/sendgrid-go"],maven:["com.sendgrid"],rubygems:["sendgrid-ruby"],composer:["sendgrid/sendgrid"],nuget:["SendGrid"]}},{id:"mailgun",name:"Mailgun",category:"Email",hostSuffixes:["mailgun.net"],apiBase:"https://api.mailgun.net",defaultDataClasses:["pii"],sdks:{npm:["mailgun.js"],pypi:["mailgun"],rubygems:["mailgun-ruby"],composer:["mailgun/mailgun-php"],nuget:["Mailgun"]}},{id:"mixpanel",name:"Mixpanel",category:"Analytics",hostSuffixes:["mixpanel.com"],apiBase:"https://api.mixpanel.com",defaultDataClasses:["customer","telemetry"],sdks:{npm:["mixpanel"],pypi:["mixpanel"],rubygems:["mixpanel-ruby"],nuget:["Mixpanel"]}},{id:"amplitude",name:"Amplitude",category:"Analytics",hostSuffixes:["amplitude.com"],apiBase:"https://api2.amplitude.com",defaultDataClasses:["customer","telemetry"],sdks:{npm:["@amplitude/analytics-node"],pypi:["amplitude-analytics"],nuget:["Amplitude"]}},{id:"posthog",name:"PostHog",category:"Analytics",hostSuffixes:["posthog.com"],apiBase:"https://us.i.posthog.com",defaultDataClasses:["customer","telemetry"],sdks:{npm:["posthog-node","posthog-js"],pypi:["posthog"],go:["github.com/posthog/posthog-go"],rubygems:["posthog-ruby"],composer:["posthog/posthog-php"],nuget:["PostHog"]}},{id:"honeycomb",name:"Honeycomb",category:"Observability",hostSuffixes:["honeycomb.io"],apiBase:"https://api.honeycomb.io",defaultDataClasses:["telemetry","metrics"],sdks:{npm:["libhoney"],pypi:["libhoney"],go:["github.com/honeycombio/libhoney-go"],rubygems:["libhoney"]}},{id:"grafana",name:"Grafana Cloud",category:"Observability",hostSuffixes:["grafana.net"],apiBase:"https://grafana.net",defaultDataClasses:["logs","metrics"],sdks:{npm:["@grafana/faro-web-sdk"]}},{id:"splunk",name:"Splunk",category:"Observability",hostSuffixes:["splunkcloud.com","splunk.com"],apiBase:"https://http-inputs.splunkcloud.com",defaultDataClasses:["logs"],sdks:{npm:["splunk-logging"],pypi:["splunk-sdk"],maven:["com.splunk"],nuget:["Splunk.Logging.Common"]}},{id:"pagerduty",name:"PagerDuty",category:"Incident response",hostSuffixes:["pagerduty.com"],apiBase:"https://api.pagerduty.com",defaultDataClasses:["logs"],sdks:{npm:["@pagerduty/pdjs"],pypi:["pdpyras"],go:["github.com/PagerDuty/go-pagerduty"],rubygems:["pagerduty"]}},{id:"github",name:"GitHub",category:"Developer platform",hostSuffixes:["github.com","githubusercontent.com"],apiBase:"https://api.github.com",defaultDataClasses:["source"],sdks:{npm:["@octokit/rest","octokit"],pypi:["pygithub"],go:["github.com/google/go-github"],maven:["org.kohsuke.github-api"],rubygems:["octokit"],cargo:["octocrab"],composer:["knplabs/github-api"],nuget:["Octokit"]}},{id:"gitlab",name:"GitLab",category:"Developer platform",hostSuffixes:["gitlab.com"],apiBase:"https://gitlab.com/api",defaultDataClasses:["source"],sdks:{npm:["@gitbeaker/rest"],pypi:["python-gitlab"],go:["gitlab.com/gitlab-org/api/client-go"],rubygems:["gitlab"],nuget:["GitLabApiClient"]}},{id:"auth0",name:"Auth0",category:"Identity",hostSuffixes:["auth0.com"],apiBase:"https://login.auth0.com",defaultDataClasses:["pii"],sdks:{npm:["auth0"],pypi:["auth0-python"],go:["github.com/auth0/go-auth0"],maven:["com.auth0"],rubygems:["auth0"],composer:["auth0/auth0-php"],nuget:["Auth0.ManagementApi"]}},{id:"okta",name:"Okta",category:"Identity",hostSuffixes:["okta.com","oktapreview.com"],apiBase:"https://login.okta.com",defaultDataClasses:["pii"],sdks:{npm:["@okta/okta-sdk-nodejs"],pypi:["okta"],go:["github.com/okta/okta-sdk-golang"],maven:["com.okta.sdk"],nuget:["Okta.Sdk"]}},{id:"clerk",name:"Clerk",category:"Identity",hostSuffixes:["clerk.com","clerk.dev"],apiBase:"https://api.clerk.com",defaultDataClasses:["pii"],sdks:{npm:["@clerk/backend","@clerk/nextjs"],pypi:["clerk-backend-api"],go:["github.com/clerk/clerk-sdk-go"]}},{id:"supabase",name:"Supabase",category:"Backend platform",hostSuffixes:["supabase.co","supabase.com"],apiBase:"https://api.supabase.com",defaultDataClasses:["pii","customer"],sdks:{npm:["@supabase/supabase-js"],pypi:["supabase"],cargo:["postgrest"]}},{id:"firebase",name:"Firebase",category:"Backend platform",hostSuffixes:["firebaseio.com","firebase.google.com"],apiBase:"https://firebaseio.com",defaultDataClasses:["customer"],sdks:{npm:["firebase","firebase-admin"],pypi:["firebase-admin"],go:["firebase.google.com/go"],maven:["com.google.firebase"]}},{id:"mongodb-atlas",name:"MongoDB Atlas",category:"Database SaaS",hostSuffixes:["mongodb.net","mongodb.com"],apiBase:"https://cloud.mongodb.com",defaultDataClasses:["customer"],sdks:{npm:["mongodb"],pypi:["pymongo"],go:["go.mongodb.org/mongo-driver"],maven:["org.mongodb"],rubygems:["mongo"],cargo:["mongodb"],nuget:["MongoDB.Driver"]}},{id:"planetscale",name:"PlanetScale",category:"Database SaaS",hostSuffixes:["psdb.cloud","planetscale.com"],apiBase:"https://api.planetscale.com",defaultDataClasses:["customer"],sdks:{npm:["@planetscale/database"],go:["github.com/planetscale/planetscale-go"]}},{id:"algolia",name:"Algolia",category:"Search SaaS",hostSuffixes:["algolia.net","algolianet.com"],apiBase:"https://algolia.net",defaultDataClasses:["customer"],sdks:{npm:["algoliasearch"],pypi:["algoliasearch"],go:["github.com/algolia/algoliasearch-client-go"],maven:["com.algolia"],rubygems:["algolia"],composer:["algolia/algoliasearch-client-php"],nuget:["Algolia.Search"]}},{id:"cloudflare",name:"Cloudflare",category:"CDN / edge",hostSuffixes:["cloudflare.com","workers.dev"],apiBase:"https://api.cloudflare.com",defaultDataClasses:["logs"],sdks:{npm:["cloudflare"],pypi:["cloudflare"],go:["github.com/cloudflare/cloudflare-go"],nuget:["CloudFlare.Client"]}},{id:"huggingface",name:"Hugging Face",category:"LLM provider",hostSuffixes:["huggingface.co"],apiBase:"https://api-inference.huggingface.co",defaultDataClasses:["source"],sdks:{npm:["@huggingface/inference"],pypi:["huggingface-hub","transformers"],rubygems:["hugging-face"]}},{id:"cohere",name:"Cohere",category:"LLM provider",hostSuffixes:["cohere.com","cohere.ai"],apiBase:"https://api.cohere.com",defaultDataClasses:["pii","source"],sdks:{npm:["cohere-ai"],pypi:["cohere"],go:["github.com/cohere-ai/cohere-go"]}},{id:"mistral",name:"Mistral AI",category:"LLM provider",hostSuffixes:["mistral.ai"],apiBase:"https://api.mistral.ai",defaultDataClasses:["pii","source"],sdks:{npm:["@mistralai/mistralai"],pypi:["mistralai"],go:["github.com/gage-technologies/mistral-go"]}}],e=["internal","local","corp","lan","intranet","home.arpa"],f=["localhost","test","example","invalid","example.com","example.org","example.net","w3.org","schemas.openxmlformats.org","schemas.microsoft.com","schemas.android.com","maven.apache.org"];function g(a,b){return a===b||a.endsWith(`.${b}`)}function h(a){let b=a.split(".");return 4===b.length&&b.every(a=>/^\d{1,3}$/.test(a)&&255>=Number(a))}function i(a){let b=a.split(".").map(Number),c=b[0],d=b[1];return void 0!==c&&void 0!==d&&(0===c||10===c||127===c||c>=224||169===c&&254===d||172===c&&d>=16&&d<=31||192===c&&168===d||!1)}function j(a){let b=a.startsWith("[")&&a.endsWith("]")?a.slice(1,-1):a,c=b.indexOf("%");return(-1===c?b:b.slice(0,c)).toLowerCase()}let k=/^[0-9a-f]{1,4}$/,l=/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/;function m(a){return a.toLowerCase().replace(/[-_.]+/g,"-")}let n=new Set([".ts",".tsx",".js",".jsx",".mjs",".cjs",".py",".java",".rb",".cs",".php",".go",".rs"]),o="••••",p=/(https?|wss?|sftp|grpcs?|smtp):\/\/(?:[^\s'"`<>()[\]{},;]|\$\{[^}\s]{1,64}\}|\{[A-Za-z_]\w{0,63}\}|%[sd])+/gi,q=/\$\{[^}\s]{1,64}\}|\{[A-Za-z_]\w{0,63}\}|%[sd]/g,r="${var}",s="akaegressvar0",t=/[.,;:'"]+$/,u={http:"http",https:"https",ws:"ws",wss:"wss",sftp:"sftp",grpc:"grpc",grpcs:"grpc",smtp:"smtp"},v=/\.\s*(get|post|put|delete)\s*\(\s*['"`]*$/i,w=/["'](GET|POST|PUT|DELETE)["']\s*,([^)\]};]{0,150})$/i,x=/method\s*[:=]\s*['"](GET|POST|PUT|DELETE)/i,y=/\b(fetch|urlopen|got|ky)\s*\(\s*['"`]*$/i,z=/\bmethod\s*[:=]/i,A=/;|\n\s*(?:(?:const|let|var|val|function|func|fn|def|class|return|export|import|if|for|while|switch|try|public|private)\b|\w+\s*=[^=])/,B=/\b(?:\d{1,3}\.){3}\d{1,3}(?::\d{1,5})?\b/g,C=/\b(host|hostname|server|address|endpoint|ip|url|uri)\b/i,D=/\bs(ftp|cp|sh)\b/i,E=/\b(smtp|mail)\b/i,F="api[_-]?key|apikey|private[_-]?key|access[_-]?key|access[_-]?token|token|secret|credentials?|password|passwd|pwd|authorization|sig|signature|sas|assertion",G="Bearer|Basic|Token|Digest|ApiKey|SSWS|AWS4-HMAC-SHA256",H=/:\/\/[^@/\s]+@/g,I=RegExp(`((?:${F})['"\`]?\\s*[:=]\\s*['"\`]?)(?!(?:${G})[\\s'"\`])[^\\s'"\`&]+`,"gi"),J=RegExp(`((?:${F})['"\`]?\\s*[:=]\\s*['"\`]?)(${G})\\s+[^\\s'"\`]+`,"gi"),K=/\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi,L=[{hosts:["hooks.slack.com"],prefix:"/services/"},{hosts:["discord.com","discordapp.com","ptb.discord.com","canary.discord.com"],prefix:"/api/webhooks/"},{hosts:["hooks.zapier.com"],prefix:"/hooks/"},{hosts:["outlook.office.com","outlook.office365.com"],prefix:"/webhook/"}];function M(a){return a.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}let N=RegExp(`(https?://(?:${L.flatMap(a=>a.hosts.map(b=>`${M(b)}${M(a.prefix)}`)).join("|")}))[^\\s'"\`<>()[\\]{},;]+`,"gi"),O=/(^|\/)(vendor|third_party|external)\//;function P(a){return O.test(a)}function Q(a){return a.trim().replace(H,"://").replace(N,`$1${o}`).replace(I,`$1${o}`).replace(J,`$1$2 ${o}`).replace(K,`Bearer ${o}`)}function R(a,b=0){let c=Q(a);if(c.length<=200)return c;let d=a.length-a.trimStart().length,e=a.trim(),f=Math.min(Math.max(0,(c.length===e.length?b-d:Q(e.slice(0,Math.max(0,b-d))).length)-Math.floor(100)),c.length-200);return c.slice(f,f+200)}function S(a){let b=function(a){let b=[0];for(let c=0;c<a.length;c+=1)"\n"===a[c]&&b.push(c+1);return b}(a),c=[],d=[],e=U(c=>(function(a,b,c){let d=b[c]??0,e=b[c+1];return void 0===e?a.slice(d):a.slice(d,e-1)})(a,b,c)),f=U(a=>(function(a){let b=a.replace(/[_-]+/g," ").replace(/([a-z0-9])([A-Z])/g,"$1 $2"),c="http";return D.test(b)?c="sftp":E.test(b)&&(c="smtp"),{named:C.test(b),transport:c}})(e(a))),g=(a,c)=>R(e(a),c-(b[a]??0));for(let e of a.matchAll(p)){let f=e.index,h=e[0];c.push([f,f+h.length]);let i=e[1];if(void 0===i)continue;let j=h.replace(t,"");if(""===j)continue;let k=function(a,b){let c,d=u[b.toLowerCase()];if(void 0===d)return null;let e=0,f=a.replace(q,()=>(e+=1,r));try{c=new URL(f.split(r).join(s))}catch{return null}let g=c.hostname.toLowerCase();if(""===g||g.includes(s))return null;let h=c.host.toLowerCase(),i=function(a,b){for(let c of L)if(c.hosts.includes(a)&&b.startsWith(c.prefix))return`${c.prefix}${o}`;return b}(g,c.pathname);return{url:`${d}://${h}${i}`.split(s).join(r),host:g,port:""===c.port?null:Number(c.port),transport:d,template:e>0}}(j,i);if(null===k)continue;let l=V(b,f);d.push({...k,method:function(a,b,c){let d=a.slice(Math.max(0,b-200),b),e=a.slice(c,c+300),f=v.exec(d);if(f?.[1]!==void 0)return T(f[1]);let g=w.exec(d);if(g?.[1]!==void 0&&!A.test(g[2]??""))return T(g[1]);let h=x.exec(e);if(h?.[1]!==void 0&&!A.test(e.slice(0,h.index)))return T(h[1]);if(y.test(d)){let a=function(a){let b=1;for(let c=0;c<a.length;c+=1){let d=a[c];if("("===d)b+=1;else if(")"===d&&0==(b-=1))return c+1}return -1}(e);if(-1!==a&&function(a,b){let c=a.slice(0,b-1).trimEnd();return!(c.endsWith(",")?c.slice(0,-1):c).includes(",")}(e,a)&&!z.test(e.slice(0,a)))return"GET"}return"REF"}(a,f,f+h.length),line:l+1,snippet:g(l,f)})}for(let e of a.matchAll(B)){let a=e.index;if(function(a,b){let c=0,d=a.length-1,e=-1;for(;c<=d;){let f=Math.floor((c+d)/2),g=a[f];if(void 0===g)break;g[0]<=b?(e=f,c=f+1):d=f-1}let f=-1===e?void 0:a[e];return void 0!==f&&b<f[1]}(c,a))continue;let j=V(b,a),k=function(a,b){let[c,d]=function(a){let b=a.indexOf(":");return -1===b?[a,null]:[a.slice(0,b),Number(a.slice(b+1))]}(a);if(!h(c)||i(c)||!b.named)return null;let{transport:e}=b;return{url:`${e}://${c}${null===d?"":`:${String(d)}`}`,host:c,port:d,transport:e,template:!1}}(e[0],f(j));null!==k&&d.push({...k,method:"REF",line:j+1,snippet:g(j,a)})}return d.sort(W)}function T(a){return a.toUpperCase()}function U(a){let b=new Map;return c=>{let d=b.get(c);if(void 0!==d)return d;let e=a(c);return b.set(c,e),e}}function V(a,b){let c=0,d=a.length-1;for(;c<d;){let e=Math.ceil((c+d)/2);(a[e]??0)<=b?c=e:d=e-1}return c}function W(a,b){return a.line!==b.line?a.line-b.line:a.url!==b.url?a.url<b.url?-1:1:0}let X=new Set(["package-lock.json","yarn.lock","pnpm-lock.yaml","Cargo.lock","composer.lock","Gemfile.lock","poetry.lock","go.sum","packages.lock.json"]),Y={"package.json":"package.json","requirements.txt":"requirements.txt","pyproject.toml":"pyproject.toml","go.mod":"go.mod","pom.xml":"pom.xml","build.gradle":"build.gradle","build.gradle.kts":"build.gradle",Gemfile:"Gemfile","Cargo.toml":"Cargo.toml","composer.json":"composer.json","packages.config":"packages.config"};function Z(a){if(X.has(a))return null;let b=Object.hasOwn(Y,a)?Y[a]:void 0;return void 0!==b?b:a.endsWith(".csproj")?"csproj":null}function $(a,b){switch(b){case"package.json":var c=a;let d=au(c);if(null===d)return[];let e=new Set,f=[];for(let a of av(d.dependencies))e.add(a),f.push(aw("npm",a,c,"dependencies"));for(let a of av(d.optionalDependencies))e.has(a)||(e.add(a),f.push(aw("npm",a,c,"optionalDependencies")));return f;case"requirements.txt":var g=a;let h=[];return at(g,(a,b)=>{let c=aa.exec(a),d=c?.[1];void 0!==d&&h.push(_("pypi",m(d),b,a))}),h;case"pyproject.toml":var i=a;let j=[],k="",l=!1;return at(i,(a,b)=>{let c=ab.exec(a);if(c){k=c[1]?.trim()??"",l=!1;return}if(!l&&/^\s*dependencies\s*=\s*\[/.test(a)&&(l=!0),l){for(let c of[...a.matchAll(ac)].map(a=>a[1]??a[2]??"")){let d=ad.exec(c)?.[1];void 0!==d&&j.push(_("pypi",m(d),b,a))}a.includes("]")&&(l=!1);return}if("tool.poetry.dependencies"===k){let c=ae.exec(a)?.[1];void 0!==c&&"python"!==c&&j.push(_("pypi",m(c),b,a))}}),j;case"go.mod":var n=a;let o=[],p=null;return at(n,(a,b)=>{if(null===p){let c=af.exec(a)?.[1];if(void 0!==c){p=c;return}let d=ah.exec(a)?.[1];void 0!==d&&o.push(_("go",d,b,a));return}if(ag.test(a)){p=null;return}if("require"===p){let c=ai.exec(a)?.[1];void 0!==c&&o.push(_("go",c,b,a))}}),o;case"pom.xml":var q=a;let r=[],s=[],t=!1;return at(q,(a,b)=>{let c=as(a,t);t=c.inComment;let d=c.visible;for(let c of d.matchAll(ak)){let f=c[2];if(void 0===f)continue;let g="/"===c[1],h=(c[3]??"").trimEnd().endsWith("/");if(g){aj.has(f)&&s[s.length-1]===f&&s.pop();continue}if(!h){if("groupId"===f){var e;let f=d.slice(c.index+c[0].length),g=al.exec(f)?.[1]?.trim()??"";""===g||"dependency"!==(e=s)[e.length-1]||"dependencies"!==e[e.length-2]||e.includes("dependencyManagement")||e.includes("parent")||e.includes("build")||r.push(_("maven",g,b,a));continue}aj.has(f)&&s.push(f)}}}),r;case"build.gradle":var u=a;let v=[];return at(u,(a,b)=>{if(!an.test(a))for(let c of a.matchAll(am)){let d=c[1];void 0!==d&&v.push(_("maven",d,b,a))}}),v;case"Gemfile":var w=a;let x=[];return at(w,(a,b)=>{let c=ao.exec(a)?.[1];void 0!==c&&x.push(_("rubygems",c,b,a))}),x;case"Cargo.toml":var y=a;let z=[],A="none";return at(y,(a,b)=>{let c=ab.exec(a);if(c){let d=c[1]?.trim()??"";if("dependencies"===d)A="plain";else if(d.startsWith("dependencies.")){A="dotted";let c=d.slice(13);""!==c&&z.push(_("cargo",c,b,a))}else A="none";return}if("plain"===A){let c=ap.exec(a)?.[1];void 0!==c&&z.push(_("cargo",c,b,a))}}),z;case"composer.json":var B=a;let C=au(B);return null===C?[]:av(C.require).filter(a=>"php"!==a&&!a.startsWith("ext-")).map(a=>aw("composer",a,B,"require"));case"csproj":var D=a;let E=[],F=!1;return at(D,(a,b)=>{let c=as(a,F);F=c.inComment;let d=aq.exec(c.visible)?.[1];void 0!==d&&E.push(_("nuget",d,b,a))}),E;case"packages.config":var G=a;let H=[],I=!1;return at(G,(a,b)=>{let c=as(a,I);I=c.inComment;let d=ar.exec(c.visible)?.[1];void 0!==d&&H.push(_("nuget",d,b,a))}),H;default:return[]}}function _(a,b,c,d){return{ecosystem:a,pkg:b,line:c,snippet:R(d)}}let aa=/^\s*([A-Za-z0-9][\w.-]*)/,ab=/^\s*\[([^\]]+)\]\s*$/,ac=/"([^"]*)"|'([^']*)'/g,ad=/^([A-Za-z0-9][\w.-]*)/,ae=/^\s*([A-Za-z0-9][\w.-]*)\s*=/,af=/^\s*(require|exclude|replace|retract)\s*\(/,ag=/^\s*\)/,ah=/^\s*require\s+([\w./-]+)\s+v\d/,ai=/^\s*([\w./-]+)\s+v\d/,aj=new Set(["project","parent","dependencyManagement","dependencies","dependency","build","plugins","plugin","exclusions","exclusion"]),ak=/<(\/?)([A-Za-z][\w.-]*)([^<>]*)>/g,al=/^([^<]*)/,am=/\b(?:implementation|api|compile)\b\s*[('"]*(?:platform\s*\(\s*['"])?([\w.-]+):[\w.-]+/g,an=/^\s*\/\//,ao=/^\s*gem\s+['"]([\w-]+)['"]/,ap=/^([A-Za-z0-9_-]+)\s*=/,aq=/<PackageReference\s+Include="([^"]+)"/,ar=/<package\s+id="([^"]+)"/;function as(a,b){let c="",d=a,e=b;for(;;){if(e){let a=d.indexOf("--\x3e");if(-1===a)return{visible:c,inComment:!0};d=d.slice(a+3),e=!1;continue}let a=d.indexOf("\x3c!--");if(-1===a)return{visible:c+d,inComment:!1};c+=d.slice(0,a),d=d.slice(a+4),e=!0}}function at(a,b){let c=a.split("\n");for(let a=0;a<c.length;a+=1)b(c[a]??"",a+1)}function au(a){let b;try{b=JSON.parse(a)}catch{return null}if("object"!=typeof b||null===b)return null;let c=b;return{dependencies:c.dependencies,optionalDependencies:c.optionalDependencies,require:c.require}}function av(a){return"object"!=typeof a||null===a?[]:Object.keys(a)}function aw(a,b,c,d){let e=c.indexOf(`"${d}"`),f=c.indexOf(`"${b}"`,-1===e?0:e);return -1===f?_(a,b,1,b):_(a,b,function(a,b){let c=1;for(let d=0;d<b;d+=1)"\n"===a[d]&&(c+=1);return c}(c,f),function(a,b){let c=a.lastIndexOf("\n",b)+1,d=a.indexOf("\n",b);return a.slice(c,-1===d?a.length:d)}(c,f))}let ax=new Set(["GET","POST","PUT","DELETE"]);function ay(a,b){let c=[];for(let n of a){for(let a of n.endpoints){let m=function(a,b,c){let m=function(a,b){let c=a.toLowerCase();if(h(c))return i(c)?null:{kind:"ip",trust:"ip",name:c,category:"Unresolved host",entry:null};if(function(a){let b=j(a);if(!b.includes(":"))return!1;let c=b.split("::");if(c.length>2)return!1;let d=(2===c.length?c:[b]).flatMap(a=>""===a?[]:a.split(":"));return!!d.every(a=>k.test(a))&&(2===c.length?d.length<=7:8===d.length)}(c))return!function(a){let b=j(a);if("::"===b||"::1"===b)return!0;let c=(b.split(":")[0]??"").padStart(4,"0");return!!(c.startsWith("fc")||c.startsWith("fd")||c.startsWith("fe")&&"89ab".includes(c[2]??"")||c.startsWith("ff"))}(c)?{kind:"ip",trust:"ip",name:c,category:"Unresolved host",entry:null}:null;let m=function(a){let b=l.exec(j(a));return b?.[1]??null}(c);if(null!==m&&h(m))return i(m)?null:{kind:"ip",trust:"ip",name:c,category:"Unresolved host",entry:null};if(f.some(a=>g(c,a)))return null;let n=d.find(a=>a.hostSuffixes.some(a=>g(c,a)));if(n)return{kind:"provider",trust:"recognized",name:n.name,category:n.category,entry:n};let o=b?.internalDomains??[];return!c.includes(".")&&!c.includes(":")||e.some(a=>g(c,a))||o.some(a=>g(c,a.toLowerCase()))?{kind:"internal",trust:"internal",name:c,category:"Internal services",entry:null}:{kind:"external",trust:"unverified",name:c,category:"External domain",entry:null}}(b.host,c);if(null===m)return null;let n="provider"===m.kind;return{host:b.host,kind:m.kind,name:m.name,category:m.category,trust:m.trust,network:n?null:{port:b.port,geo:null,ptr:null},method:b.method,transport:b.transport,url:b.url,template:b.template,dataClass:n?m.entry?.defaultDataClasses[0]??"none":"none",site:{file:a.file,line:b.line,snippet:b.snippet,dynamic:b.template,vendored:a.vendored}}}(n,a,b);null!==m&&c.push(m)}for(let a of n.sdkHits){let b=function(a,b){let c=function(a,b){for(let c of d){let d=c.sdks[a];if(void 0!==d&&d.some(c=>(function(a,b,c){switch(a){case"nuget":return b.toLowerCase()===c.toLowerCase();case"pypi":return m(b)===m(c);case"go":return b===c||b.startsWith(`${c}/`);case"maven":return b===c||b.startsWith(`${c}.`);default:return b===c}})(a,b,c)))return c}return null}(b.ecosystem,b.pkg);return null===c?null:{host:new URL(c.apiBase).hostname,kind:"provider",name:c.name,category:c.category,trust:"recognized",network:null,method:"SDK",transport:"https",url:c.apiBase,template:!1,dataClass:c.defaultDataClasses[0]??"none",site:{file:a.file,line:b.line,snippet:b.snippet,dynamic:!1,vendored:a.vendored}}}(n,a);null!==b&&c.push(b)}}var n=function(a){let b=new Set,c=[];for(let e of a){var d;let a=JSON.stringify([(d=e).host,d.method,d.url,d.site.file,d.site.line]);b.has(a)||(b.add(a),c.push(e))}return c}(c);let o=new Set;for(let a of n)ax.has(a.method)&&o.add(az(a));return n.filter(a=>"REF"!==a.method||!o.has(az(a)))}function az(a){return JSON.stringify([a.host,a.url])}function aA(a){return a.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}let aB=new WeakMap,aC=new WeakMap,aD=new WeakMap;function aE(a,b,c){let d="keyword"===a?aC:aD,e=d.get(b);if(void 0!==e){if(e.stateful)for(let a of e.entries)void 0!==a&&(a.lastIndex=0);return e.entries}let f=c();return d.set(b,{entries:f,stateful:f.some(a=>void 0!==a&&(a.global||a.sticky))}),f}class aF{match(a,b){if("keyword"!==b.matcher.type)return[];let{keywords:c,caseSensitive:d}=b.matcher,e=[];for(let f of aE("keyword",b.matcher,()=>c.map(a=>{if(0!==a.length)return new RegExp(aA(a),d?"gu":"giu")}))){let b;if(void 0!==f){if(e.length>=1e4)break;for(;null!==(b=f.exec(a))&&(e.push({start:b.index,end:b.index+b[0].length}),!(e.length>=1e4)););}}return e}}class aG{match(a,b){let c;if("regex"!==b.matcher.type)return[];let{pattern:d,flags:e,captureGroup:f}=b.matcher,g=function(a,b){let c=aB.get(a);if(void 0!==c)return c.lastIndex=0,c;let d=b();return aB.set(a,d),d}(b.matcher,()=>new RegExp(d,e.includes("d")?e:`${e}d`)),h=a.length>2e5?a.slice(0,2e5):a,i=[],j=h.length+1,k=0;for(;null!==(c=g.exec(h))&&!(++k>j);){let a=null!=f?c[f]:c[0];if(0===c[0].length&&g.lastIndex++,a&&i.length<1e4){let b=null!=f?c.indices?.[f]:void 0,d=b?b[0]:c.index;i.push({start:d,end:d+a.length})}if(!e.includes("g")||i.length>=1e4)break}return i}}let aH=new aF,aI=new aG,aJ={keyword:(a,b)=>aH.match(a,b),regex:(a,b)=>aI.match(a,b)},aK=new Map,aL={entropy:(a,b)=>(function(a,b=3.5,c=20){return a.length>=c&&function(a){let b={};for(let c of a)b[c]=(b[c]??0)+1;let c=0;for(let d of Object.values(b)){let b=d/a.length;c-=b*Math.log2(b)}return c}(a)>=b})(a,aM(b,"threshold"),aM(b,"minLength")),luhn:a=>(function(a){let b=a.replace(/\D/g,"");if(b.length<13)return!1;let c=0,d=!0;for(let a=b.length-1;a>=0;a--){let e=parseInt(b[a]??"0",10);!d&&(e*=2)>9&&(e-=9),c+=e,d=!d}return c%10==0})(a)};function aM(a,b){let c=a?.[b];return"number"==typeof c&&Number.isFinite(c)?c:void 0}function aN(a,b,c){let d=b??[...aK.values()].flatMap(a=>a.rules),e=c?.filePath?function(a){let b=a.slice(Math.max(a.lastIndexOf("/"),a.lastIndexOf("\\"))+1),c=b.lastIndexOf(".");return c>0?b.slice(c).toLowerCase():void 0}(c.filePath):void 0,f=[];for(let b of d)if(function(a,b){return!a.appliesTo||void 0===b||a.appliesTo.extensions.some(a=>a.toLowerCase()===b)}(b,e))for(let c of aJ[b.matcher.type](a,b)){let d=a.slice(c.start,c.end);(function(a,b){let c=a.postValidators;if(!c||0===c.length)return!0;for(let a of c){let c="string"==typeof a?a:a.name,d="string"==typeof a?void 0:a.config;if(!aL[c](b,d))return!1}return!0})(b,d)&&f.push({rule:b,match:{ruleId:b.id,category:b.category,severity:b.severity,span:c,rawMatch:d,confidence:.9}})}let g=[];for(let b of f){let c=b.rule.requiresNearby;if(!c){g.push(b.match);continue}if(!function(a,b,c){let d=a.rule.requiresNearby;if(!d)return!0;let e=d.windowChars,{start:f,end:g}=a.match.span,h=f-e,i=g+e,j=d.categories,k=d.ruleIds;if(j?.length||k?.length)for(let c of b){if(c===a)continue;let b=c.match.span;if(!(b.end<h)&&!(b.start>i)&&(c.match.ruleId!==a.match.ruleId&&j?.includes(c.match.category)||k?.includes(c.match.ruleId)))return!0}let l=d.labels;if(l&&l.length>0){let a=c.slice(Math.max(0,h),i);for(let b of aE("label",d,()=>l.map(a=>{let b=a.trim();return 0===b.length?void 0:RegExp(`(?<![A-Za-z0-9])${aA(b)}(?![A-Za-z0-9])`,"i")})))if(b?.test(a))return!0}return!1}(b,f,a))continue;let d=c.confidenceBoost;g.push(d?{...b.match,confidence:Math.min(.99,b.match.confidence+d)}:b.match)}return g}let aO={critical:3,high:2,medium:1,low:0};function aP(a,b){if(0===b.length)return a;let c=[...b].sort((a,b)=>a.span.start-b.span.start||a.span.end-b.span.end),d=[];for(let a of c){let b=aO[a.severity],c=d[d.length-1];c&&a.span.start<c.end?(c.end=Math.max(c.end,a.span.end),b>c.rank&&(c.rank=b,c.category=a.category)):d.push({start:a.span.start,end:a.span.end,category:a.category,rank:b})}let e=a;for(let a of[...d].reverse()){let b=`[REDACTED:${a.category.toUpperCase()}]`;e=e.slice(0,a.start)+b+e.slice(a.end)}return e}function aQ(a){if(a.length<=5)return"***";let b=a.indexOf("@");if(b>0&&b<a.length-1){let c=a.slice(b+1);if(c.includes(".")){let d=a.slice(0,b),e=d.length<=1?d:d.charAt(0)+"*".repeat(d.length-1);return`${e}@${c}`}}return`${a.charAt(0)}${"*".repeat(6)}${a.charAt(a.length-1)}`}var aR=c(39e3);function aS(a){let b=[],c=null;for(let d of a.matchAll((0,aR.jwX)()))b.push({start:d.index,end:d.index+d[0].length}),c??=a,c=c.slice(0,d.index)+" ".repeat(d[0].length)+c.slice(d.index+d[0].length);return{text:c??a,spans:b}}function aT(a,b){return 0===b.length?a:a.filter(a=>!b.some(b=>a.span.start<b.end&&a.span.end>b.start))}let aU=new Set(["prettier","eslint","biome","black","ruff","gofmt","rustfmt","node","npx","npm","pnpm","yarn","make","git","jq","echo"]);JSON.stringify({kind:"hook-conflict",mutation:/(--write|--fix|\s-w\b|\s-i\b|(?<![\d&>])>\s?\S)/.source,note:"two hooks on the same event with overlapping matchers, both mutating the tool target"}),JSON.stringify({kind:"hook-unknown",knownTools:[...aU]}),JSON.stringify({kind:"hook-external-egress",pattern:/\b(curl|wget|nc|ncat|netcat|ssh|scp|rsync)\b|https?:\/\//.source});let aV=["a","0"," ","x","ab","a.","a-","a_","a@","a/","a:","a=","a;","aA0","	"].flatMap(a=>[23,25].map(b=>a.repeat(Math.ceil(b/a.length)).slice(0,b)+"!")),aW=["abc-","a.","a ","a=","x","0","a@","a/","ab"].map(a=>a.repeat(1e4).slice(0,4e4)+"!"),aX=()=>performance.now();function aY(a,b){let{ms:c,probe:d,corroboratedMs:e}=function(a,b=aX,c){let d,e=0,f="";for(let g of[..."regex"===a.matcher.type?function(a){let b=function(a){let b="",c=0;for("^"===a[0]&&c++;c<a.length;){let d=a[c];if(void 0===d)break;if("\\"===d){let d=a[c+1];if("b"===d||"B"===d){c+=2;continue}if(void 0===d||/[dDwWsSnrtfv.]/.test(d))break;b+=d,c+=2;continue}if("([{.*+?|)]}^$".includes(d))break;b+=d,c++}return b}(a),c=function(a){let b=new Set;for(let c of a.matchAll(/\[\^?([^\]]+)\]/g)){let a=c[1];if(void 0===a)continue;let d=/([A-Za-z0-9])-[A-Za-z0-9]/.exec(a),e=d?.[1];if(void 0!==e)b.add(e);else{let c=a.replace(/\\/g,"")[0];void 0!==c&&"^"!==c&&b.add(c)}}return a.includes("\\w")&&b.add("a"),a.includes("\\d")&&b.add("0"),a.includes("\\s")&&b.add(" "),/(?<!\\)\./.test(a)&&b.add("a"),0===b.size&&b.add("a"),[...b]}(a),d=["!","#","~","\n"],e=[];for(let a of c)for(let c of d)if(c!==a)for(let d of[23,25])e.push(b+a.repeat(d)+c);return e}(a.matcher.pattern):[],...aV,...aW]){let h=b(),i=c?.();aN(g,[a]);let j=b()-h,k=c?.();if(j>e&&(e=j,f=g,d=void 0===i||void 0===k?void 0:k-i),e>=100)break}return{ms:e,probe:f,corroboratedMs:d}}(a,aX,b),f=e??0;return{verdict:c<100?"safe":f>=20?"over-budget":"uncorroborated",worstMs:c,corroboratedMs:f,probe:d}}}};
+"use strict";exports.id=7,exports.ids=[7],exports.modules={80007:(a,b,c)=>{c.d(b,{Nc:()=>n,mu:()=>X,r4:()=>aY,uT:()=>aT,Pb:()=>S,W$:()=>$,$1:()=>P,DK:()=>Z,sE:()=>aQ,E$:()=>aP,Ip:()=>ay,SQ:()=>aN,KD:()=>aS});let d=[{id:"stripe",name:"Stripe",category:"Payments",hostSuffixes:["stripe.com"],apiBase:"https://api.stripe.com",defaultDataClasses:["pii","customer"],sdks:{npm:["stripe"],pypi:["stripe"],go:["github.com/stripe/stripe-go"],maven:["com.stripe"],rubygems:["stripe"],composer:["stripe/stripe-php"],nuget:["Stripe.net"]}},{id:"datadog",name:"Datadog",category:"Observability",hostSuffixes:["datadoghq.com","datadoghq.eu"],apiBase:"https://api.datadoghq.com",defaultDataClasses:["telemetry","logs","metrics"],sdks:{npm:["dd-trace","@datadog/browser-logs"],pypi:["datadog","ddtrace"],go:["github.com/DataDog/dd-trace-go"],maven:["com.datadoghq"],rubygems:["ddtrace","dogapi"],nuget:["Datadog.Trace"]}},{id:"newrelic",name:"New Relic",category:"Observability",hostSuffixes:["newrelic.com","nr-data.net"],apiBase:"https://api.newrelic.com",defaultDataClasses:["telemetry","logs","metrics"],sdks:{npm:["newrelic"],pypi:["newrelic"],go:["github.com/newrelic/go-agent"],maven:["com.newrelic.agent.java"],rubygems:["newrelic_rpm"],nuget:["NewRelic.Agent"]}},{id:"sentry",name:"Sentry",category:"Error tracking",hostSuffixes:["sentry.io"],apiBase:"https://sentry.io",defaultDataClasses:["source","telemetry"],sdks:{npm:["@sentry/node","@sentry/react","@sentry/nextjs"],pypi:["sentry-sdk"],go:["github.com/getsentry/sentry-go"],maven:["io.sentry"],rubygems:["sentry-ruby"],cargo:["sentry"],composer:["sentry/sentry"],nuget:["Sentry"]}},{id:"openai",name:"OpenAI",category:"LLM provider",hostSuffixes:["openai.com"],apiBase:"https://api.openai.com",defaultDataClasses:["pii","source"],sdks:{npm:["openai"],pypi:["openai"],go:["github.com/sashabaranov/go-openai"],maven:["com.openai"],rubygems:["ruby-openai"],cargo:["async-openai"],composer:["openai-php/client"],nuget:["OpenAI"]}},{id:"anthropic",name:"Anthropic",category:"LLM provider",hostSuffixes:["anthropic.com"],apiBase:"https://api.anthropic.com",defaultDataClasses:["pii","source"],sdks:{npm:["@anthropic-ai/sdk"],pypi:["anthropic"],go:["github.com/anthropics/anthropic-sdk-go"],nuget:["Anthropic.SDK"]}},{id:"aws",name:"Amazon Web Services",category:"Cloud platform",hostSuffixes:["amazonaws.com"],apiBase:"https://s3.amazonaws.com",defaultDataClasses:["secrets","customer"],sdks:{npm:["@aws-sdk/client-s3","aws-sdk"],pypi:["boto3"],go:["github.com/aws/aws-sdk-go","github.com/aws/aws-sdk-go-v2"],maven:["com.amazonaws","software.amazon.awssdk"],rubygems:["aws-sdk-s3"],cargo:["aws-sdk-s3"],nuget:["AWSSDK.S3"]}},{id:"gcp",name:"Google Cloud",category:"Cloud platform",hostSuffixes:["googleapis.com"],apiBase:"https://storage.googleapis.com",defaultDataClasses:["customer","logs"],sdks:{npm:["@google-cloud/storage"],pypi:["google-cloud-storage"],go:["cloud.google.com/go"],maven:["com.google.cloud"],rubygems:["google-cloud-storage"],nuget:["Google.Cloud.Storage.V1"]}},{id:"azure",name:"Microsoft Azure",category:"Cloud platform",hostSuffixes:["azure.com","windows.net"],apiBase:"https://management.azure.com",defaultDataClasses:["customer","logs"],sdks:{npm:["@azure/storage-blob"],pypi:["azure-storage-blob"],go:["github.com/Azure/azure-sdk-for-go"],maven:["com.azure"],rubygems:["azure-storage-blob"],nuget:["Azure.Storage.Blobs"]}},{id:"slack",name:"Slack",category:"Notifications",hostSuffixes:["slack.com"],apiBase:"https://slack.com/api",defaultDataClasses:["logs"],sdks:{npm:["@slack/web-api"],pypi:["slack-sdk"],go:["github.com/slack-go/slack"],maven:["com.slack.api"],rubygems:["slack-ruby-client"],composer:["slack-php/slack-api"],nuget:["SlackNet"]}},{id:"segment",name:"Segment",category:"Analytics",hostSuffixes:["segment.io","segment.com"],apiBase:"https://api.segment.io",defaultDataClasses:["customer"],sdks:{npm:["@segment/analytics-node","analytics-node"],pypi:["segment-analytics-python"],go:["github.com/segmentio/analytics-go"],maven:["com.segment.analytics.java"],rubygems:["analytics-ruby"],nuget:["Analytics"]}},{id:"twilio",name:"Twilio",category:"Communications",hostSuffixes:["twilio.com"],apiBase:"https://api.twilio.com",defaultDataClasses:["pii","customer"],sdks:{npm:["twilio"],pypi:["twilio"],go:["github.com/twilio/twilio-go"],maven:["com.twilio.sdk"],rubygems:["twilio-ruby"],composer:["twilio/sdk"],nuget:["Twilio"]}},{id:"sendgrid",name:"SendGrid",category:"Email",hostSuffixes:["sendgrid.com"],apiBase:"https://api.sendgrid.com",defaultDataClasses:["pii"],sdks:{npm:["@sendgrid/mail"],pypi:["sendgrid"],go:["github.com/sendgrid/sendgrid-go"],maven:["com.sendgrid"],rubygems:["sendgrid-ruby"],composer:["sendgrid/sendgrid"],nuget:["SendGrid"]}},{id:"mailgun",name:"Mailgun",category:"Email",hostSuffixes:["mailgun.net"],apiBase:"https://api.mailgun.net",defaultDataClasses:["pii"],sdks:{npm:["mailgun.js"],pypi:["mailgun"],rubygems:["mailgun-ruby"],composer:["mailgun/mailgun-php"],nuget:["Mailgun"]}},{id:"mixpanel",name:"Mixpanel",category:"Analytics",hostSuffixes:["mixpanel.com"],apiBase:"https://api.mixpanel.com",defaultDataClasses:["customer","telemetry"],sdks:{npm:["mixpanel"],pypi:["mixpanel"],rubygems:["mixpanel-ruby"],nuget:["Mixpanel"]}},{id:"amplitude",name:"Amplitude",category:"Analytics",hostSuffixes:["amplitude.com"],apiBase:"https://api2.amplitude.com",defaultDataClasses:["customer","telemetry"],sdks:{npm:["@amplitude/analytics-node"],pypi:["amplitude-analytics"],nuget:["Amplitude"]}},{id:"posthog",name:"PostHog",category:"Analytics",hostSuffixes:["posthog.com"],apiBase:"https://us.i.posthog.com",defaultDataClasses:["customer","telemetry"],sdks:{npm:["posthog-node","posthog-js"],pypi:["posthog"],go:["github.com/posthog/posthog-go"],rubygems:["posthog-ruby"],composer:["posthog/posthog-php"],nuget:["PostHog"]}},{id:"honeycomb",name:"Honeycomb",category:"Observability",hostSuffixes:["honeycomb.io"],apiBase:"https://api.honeycomb.io",defaultDataClasses:["telemetry","metrics"],sdks:{npm:["libhoney"],pypi:["libhoney"],go:["github.com/honeycombio/libhoney-go"],rubygems:["libhoney"]}},{id:"grafana",name:"Grafana Cloud",category:"Observability",hostSuffixes:["grafana.net"],apiBase:"https://grafana.net",defaultDataClasses:["logs","metrics"],sdks:{npm:["@grafana/faro-web-sdk"]}},{id:"splunk",name:"Splunk",category:"Observability",hostSuffixes:["splunkcloud.com","splunk.com"],apiBase:"https://http-inputs.splunkcloud.com",defaultDataClasses:["logs"],sdks:{npm:["splunk-logging"],pypi:["splunk-sdk"],maven:["com.splunk"],nuget:["Splunk.Logging.Common"]}},{id:"pagerduty",name:"PagerDuty",category:"Incident response",hostSuffixes:["pagerduty.com"],apiBase:"https://api.pagerduty.com",defaultDataClasses:["logs"],sdks:{npm:["@pagerduty/pdjs"],pypi:["pdpyras"],go:["github.com/PagerDuty/go-pagerduty"],rubygems:["pagerduty"]}},{id:"github",name:"GitHub",category:"Developer platform",hostSuffixes:["github.com","githubusercontent.com"],apiBase:"https://api.github.com",defaultDataClasses:["source"],sdks:{npm:["@octokit/rest","octokit"],pypi:["pygithub"],go:["github.com/google/go-github"],maven:["org.kohsuke.github-api"],rubygems:["octokit"],cargo:["octocrab"],composer:["knplabs/github-api"],nuget:["Octokit"]}},{id:"gitlab",name:"GitLab",category:"Developer platform",hostSuffixes:["gitlab.com"],apiBase:"https://gitlab.com/api",defaultDataClasses:["source"],sdks:{npm:["@gitbeaker/rest"],pypi:["python-gitlab"],go:["gitlab.com/gitlab-org/api/client-go"],rubygems:["gitlab"],nuget:["GitLabApiClient"]}},{id:"auth0",name:"Auth0",category:"Identity",hostSuffixes:["auth0.com"],apiBase:"https://login.auth0.com",defaultDataClasses:["pii"],sdks:{npm:["auth0"],pypi:["auth0-python"],go:["github.com/auth0/go-auth0"],maven:["com.auth0"],rubygems:["auth0"],composer:["auth0/auth0-php"],nuget:["Auth0.ManagementApi"]}},{id:"okta",name:"Okta",category:"Identity",hostSuffixes:["okta.com","oktapreview.com"],apiBase:"https://login.okta.com",defaultDataClasses:["pii"],sdks:{npm:["@okta/okta-sdk-nodejs"],pypi:["okta"],go:["github.com/okta/okta-sdk-golang"],maven:["com.okta.sdk"],nuget:["Okta.Sdk"]}},{id:"clerk",name:"Clerk",category:"Identity",hostSuffixes:["clerk.com","clerk.dev"],apiBase:"https://api.clerk.com",defaultDataClasses:["pii"],sdks:{npm:["@clerk/backend","@clerk/nextjs"],pypi:["clerk-backend-api"],go:["github.com/clerk/clerk-sdk-go"]}},{id:"supabase",name:"Supabase",category:"Backend platform",hostSuffixes:["supabase.co","supabase.com"],apiBase:"https://api.supabase.com",defaultDataClasses:["pii","customer"],sdks:{npm:["@supabase/supabase-js"],pypi:["supabase"],cargo:["postgrest"]}},{id:"firebase",name:"Firebase",category:"Backend platform",hostSuffixes:["firebaseio.com","firebase.google.com"],apiBase:"https://firebaseio.com",defaultDataClasses:["customer"],sdks:{npm:["firebase","firebase-admin"],pypi:["firebase-admin"],go:["firebase.google.com/go"],maven:["com.google.firebase"]}},{id:"mongodb-atlas",name:"MongoDB Atlas",category:"Database SaaS",hostSuffixes:["mongodb.net","mongodb.com"],apiBase:"https://cloud.mongodb.com",defaultDataClasses:["customer"],sdks:{npm:["mongodb"],pypi:["pymongo"],go:["go.mongodb.org/mongo-driver"],maven:["org.mongodb"],rubygems:["mongo"],cargo:["mongodb"],nuget:["MongoDB.Driver"]}},{id:"planetscale",name:"PlanetScale",category:"Database SaaS",hostSuffixes:["psdb.cloud","planetscale.com"],apiBase:"https://api.planetscale.com",defaultDataClasses:["customer"],sdks:{npm:["@planetscale/database"],go:["github.com/planetscale/planetscale-go"]}},{id:"algolia",name:"Algolia",category:"Search SaaS",hostSuffixes:["algolia.net","algolianet.com"],apiBase:"https://algolia.net",defaultDataClasses:["customer"],sdks:{npm:["algoliasearch"],pypi:["algoliasearch"],go:["github.com/algolia/algoliasearch-client-go"],maven:["com.algolia"],rubygems:["algolia"],composer:["algolia/algoliasearch-client-php"],nuget:["Algolia.Search"]}},{id:"cloudflare",name:"Cloudflare",category:"CDN / edge",hostSuffixes:["cloudflare.com","workers.dev"],apiBase:"https://api.cloudflare.com",defaultDataClasses:["logs"],sdks:{npm:["cloudflare"],pypi:["cloudflare"],go:["github.com/cloudflare/cloudflare-go"],nuget:["CloudFlare.Client"]}},{id:"huggingface",name:"Hugging Face",category:"LLM provider",hostSuffixes:["huggingface.co"],apiBase:"https://api-inference.huggingface.co",defaultDataClasses:["source"],sdks:{npm:["@huggingface/inference"],pypi:["huggingface-hub","transformers"],rubygems:["hugging-face"]}},{id:"cohere",name:"Cohere",category:"LLM provider",hostSuffixes:["cohere.com","cohere.ai"],apiBase:"https://api.cohere.com",defaultDataClasses:["pii","source"],sdks:{npm:["cohere-ai"],pypi:["cohere"],go:["github.com/cohere-ai/cohere-go"]}},{id:"mistral",name:"Mistral AI",category:"LLM provider",hostSuffixes:["mistral.ai"],apiBase:"https://api.mistral.ai",defaultDataClasses:["pii","source"],sdks:{npm:["@mistralai/mistralai"],pypi:["mistralai"],go:["github.com/gage-technologies/mistral-go"]}}],e=["internal","local","corp","lan","intranet","home.arpa"],f=["localhost","test","example","invalid","example.com","example.org","example.net","w3.org","schemas.openxmlformats.org","schemas.microsoft.com","schemas.android.com","maven.apache.org"];function g(a,b){return a===b||a.endsWith(`.${b}`)}function h(a){let b=a.split(".");return 4===b.length&&b.every(a=>/^\d{1,3}$/.test(a)&&255>=Number(a))}function i(a){let b=a.split(".").map(Number),c=b[0],d=b[1];return void 0!==c&&void 0!==d&&(0===c||10===c||127===c||c>=224||169===c&&254===d||172===c&&d>=16&&d<=31||192===c&&168===d||!1)}function j(a){let b=a.startsWith("[")&&a.endsWith("]")?a.slice(1,-1):a,c=b.indexOf("%");return(-1===c?b:b.slice(0,c)).toLowerCase()}let k=/^[0-9a-f]{1,4}$/,l=/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/;function m(a){return a.toLowerCase().replace(/[-_.]+/g,"-")}let n=new Set([".ts",".tsx",".js",".jsx",".mjs",".cjs",".py",".java",".rb",".cs",".php",".go",".rs"]),o="••••",p=/(https?|wss?|sftp|grpcs?|smtp):\/\/(?:[^\s'"`<>()[\]{},;]|\$\{[^}\s]{1,64}\}|\{[A-Za-z_]\w{0,63}\}|%[sd])+/gi,q=/\$\{[^}\s]{1,64}\}|\{[A-Za-z_]\w{0,63}\}|%[sd]/g,r="${var}",s="akaegressvar0",t=/[.,;:'"]+$/,u={http:"http",https:"https",ws:"ws",wss:"wss",sftp:"sftp",grpc:"grpc",grpcs:"grpc",smtp:"smtp"},v=/\.\s*(get|post|put|delete)\s*\(\s*['"`]*$/i,w=/["'](GET|POST|PUT|DELETE)["']\s*,([^)\]};]{0,150})$/i,x=/method\s*[:=]\s*['"](GET|POST|PUT|DELETE)/i,y=/\b(fetch|urlopen|got|ky)\s*\(\s*['"`]*$/i,z=/\bmethod\s*[:=]/i,A=/;|\n\s*(?:(?:const|let|var|val|function|func|fn|def|class|return|export|import|if|for|while|switch|try|public|private)\b|\w+\s*=[^=])/,B=/\b(?:\d{1,3}\.){3}\d{1,3}(?::\d{1,5})?\b/g,C=/\b(host|hostname|server|address|endpoint|ip|url|uri)\b/i,D=/\bs(ftp|cp|sh)\b/i,E=/\b(smtp|mail)\b/i,F="api[_-]?key|apikey|private[_-]?key|access[_-]?key|access[_-]?token|token|secret|credentials?|password|passwd|pwd|authorization|sig|signature|sas|assertion",G="Bearer|Basic|Token|Digest|ApiKey|SSWS|AWS4-HMAC-SHA256",H=/:\/\/[^@/\s]+@/g,I=RegExp(`((?:${F})['"\`]?\\s*[:=]\\s*['"\`]?)(?!(?:${G})[\\s'"\`])[^\\s'"\`&]+`,"gi"),J=RegExp(`((?:${F})['"\`]?\\s*[:=]\\s*['"\`]?)(${G})\\s+[^\\s'"\`]+`,"gi"),K=/\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi,L=[{hosts:["hooks.slack.com"],prefix:"/services/"},{hosts:["discord.com","discordapp.com","ptb.discord.com","canary.discord.com"],prefix:"/api/webhooks/"},{hosts:["hooks.zapier.com"],prefix:"/hooks/"},{hosts:["outlook.office.com","outlook.office365.com"],prefix:"/webhook/"}];function M(a){return a.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}let N=RegExp(`(https?://(?:${L.flatMap(a=>a.hosts.map(b=>`${M(b)}${M(a.prefix)}`)).join("|")}))[^\\s'"\`<>()[\\]{},;]+`,"gi"),O=/(^|\/)(vendor|third_party|external)\//;function P(a){return O.test(a)}function Q(a){return a.trim().replace(H,"://").replace(N,`$1${o}`).replace(I,`$1${o}`).replace(J,`$1$2 ${o}`).replace(K,`Bearer ${o}`)}function R(a,b=0){let c=Q(a);if(c.length<=200)return c;let d=a.length-a.trimStart().length,e=a.trim(),f=Math.min(Math.max(0,(c.length===e.length?b-d:Q(e.slice(0,Math.max(0,b-d))).length)-Math.floor(100)),c.length-200);return c.slice(f,f+200)}function S(a){let b=function(a){let b=[0];for(let c=0;c<a.length;c+=1)"\n"===a[c]&&b.push(c+1);return b}(a),c=[],d=[],e=U(c=>(function(a,b,c){let d=b[c]??0,e=b[c+1];return void 0===e?a.slice(d):a.slice(d,e-1)})(a,b,c)),f=U(a=>(function(a){let b=a.replace(/[_-]+/g," ").replace(/([a-z0-9])([A-Z])/g,"$1 $2"),c="http";return D.test(b)?c="sftp":E.test(b)&&(c="smtp"),{named:C.test(b),transport:c}})(e(a))),g=(a,c)=>R(e(a),c-(b[a]??0));for(let e of a.matchAll(p)){let f=e.index,h=e[0];c.push([f,f+h.length]);let i=e[1];if(void 0===i)continue;let j=h.replace(t,"");if(""===j)continue;let k=function(a,b){let c,d=u[b.toLowerCase()];if(void 0===d)return null;let e=0,f=a.replace(q,()=>(e+=1,r));try{c=new URL(f.split(r).join(s))}catch{return null}let g=c.hostname.toLowerCase();if(""===g||g.includes(s))return null;let h=c.host.toLowerCase(),i=function(a,b){for(let c of L)if(c.hosts.includes(a)&&b.startsWith(c.prefix))return`${c.prefix}${o}`;return b}(g,c.pathname);return{url:`${d}://${h}${i}`.split(s).join(r),host:g,port:""===c.port?null:Number(c.port),transport:d,template:e>0}}(j,i);if(null===k)continue;let l=V(b,f);d.push({...k,method:function(a,b,c){let d=a.slice(Math.max(0,b-200),b),e=a.slice(c,c+300),f=v.exec(d);if(f?.[1]!==void 0)return T(f[1]);let g=w.exec(d);if(g?.[1]!==void 0&&!A.test(g[2]??""))return T(g[1]);let h=x.exec(e);if(h?.[1]!==void 0&&!A.test(e.slice(0,h.index)))return T(h[1]);if(y.test(d)){let a=function(a){let b=1;for(let c=0;c<a.length;c+=1){let d=a[c];if("("===d)b+=1;else if(")"===d&&0==(b-=1))return c+1}return -1}(e);if(-1!==a&&function(a,b){let c=a.slice(0,b-1).trimEnd();return!(c.endsWith(",")?c.slice(0,-1):c).includes(",")}(e,a)&&!z.test(e.slice(0,a)))return"GET"}return"REF"}(a,f,f+h.length),line:l+1,snippet:g(l,f)})}for(let e of a.matchAll(B)){let a=e.index;if(function(a,b){let c=0,d=a.length-1,e=-1;for(;c<=d;){let f=Math.floor((c+d)/2),g=a[f];if(void 0===g)break;g[0]<=b?(e=f,c=f+1):d=f-1}let f=-1===e?void 0:a[e];return void 0!==f&&b<f[1]}(c,a))continue;let j=V(b,a),k=function(a,b){let[c,d]=function(a){let b=a.indexOf(":");return -1===b?[a,null]:[a.slice(0,b),Number(a.slice(b+1))]}(a);if(!h(c)||i(c)||!b.named)return null;let{transport:e}=b;return{url:`${e}://${c}${null===d?"":`:${String(d)}`}`,host:c,port:d,transport:e,template:!1}}(e[0],f(j));null!==k&&d.push({...k,method:"REF",line:j+1,snippet:g(j,a)})}return d.sort(W)}function T(a){return a.toUpperCase()}function U(a){let b=new Map;return c=>{let d=b.get(c);if(void 0!==d)return d;let e=a(c);return b.set(c,e),e}}function V(a,b){let c=0,d=a.length-1;for(;c<d;){let e=Math.ceil((c+d)/2);(a[e]??0)<=b?c=e:d=e-1}return c}function W(a,b){return a.line!==b.line?a.line-b.line:a.url!==b.url?a.url<b.url?-1:1:0}let X=new Set(["package-lock.json","yarn.lock","pnpm-lock.yaml","Cargo.lock","composer.lock","Gemfile.lock","poetry.lock","go.sum","packages.lock.json"]),Y={"package.json":"package.json","requirements.txt":"requirements.txt","pyproject.toml":"pyproject.toml","go.mod":"go.mod","pom.xml":"pom.xml","build.gradle":"build.gradle","build.gradle.kts":"build.gradle",Gemfile:"Gemfile","Cargo.toml":"Cargo.toml","composer.json":"composer.json","packages.config":"packages.config"};function Z(a){if(X.has(a))return null;let b=Object.hasOwn(Y,a)?Y[a]:void 0;return void 0!==b?b:a.endsWith(".csproj")?"csproj":null}function $(a,b){switch(b){case"package.json":var c=a;let d=au(c);if(null===d)return[];let e=new Set,f=[];for(let a of av(d.dependencies))e.add(a),f.push(aw("npm",a,c,"dependencies"));for(let a of av(d.optionalDependencies))e.has(a)||(e.add(a),f.push(aw("npm",a,c,"optionalDependencies")));return f;case"requirements.txt":var g=a;let h=[];return at(g,(a,b)=>{let c=aa.exec(a),d=c?.[1];void 0!==d&&h.push(_("pypi",m(d),b,a))}),h;case"pyproject.toml":var i=a;let j=[],k="",l=!1;return at(i,(a,b)=>{let c=ab.exec(a);if(c){k=c[1]?.trim()??"",l=!1;return}if(!l&&/^\s*dependencies\s*=\s*\[/.test(a)&&(l=!0),l){for(let c of[...a.matchAll(ac)].map(a=>a[1]??a[2]??"")){let d=ad.exec(c)?.[1];void 0!==d&&j.push(_("pypi",m(d),b,a))}a.includes("]")&&(l=!1);return}if("tool.poetry.dependencies"===k){let c=ae.exec(a)?.[1];void 0!==c&&"python"!==c&&j.push(_("pypi",m(c),b,a))}}),j;case"go.mod":var n=a;let o=[],p=null;return at(n,(a,b)=>{if(null===p){let c=af.exec(a)?.[1];if(void 0!==c){p=c;return}let d=ah.exec(a)?.[1];void 0!==d&&o.push(_("go",d,b,a));return}if(ag.test(a)){p=null;return}if("require"===p){let c=ai.exec(a)?.[1];void 0!==c&&o.push(_("go",c,b,a))}}),o;case"pom.xml":var q=a;let r=[],s=[],t=!1;return at(q,(a,b)=>{let c=as(a,t);t=c.inComment;let d=c.visible;for(let c of d.matchAll(ak)){let f=c[2];if(void 0===f)continue;let g="/"===c[1],h=(c[3]??"").trimEnd().endsWith("/");if(g){aj.has(f)&&s[s.length-1]===f&&s.pop();continue}if(!h){if("groupId"===f){var e;let f=d.slice(c.index+c[0].length),g=al.exec(f)?.[1]?.trim()??"";""===g||"dependency"!==(e=s)[e.length-1]||"dependencies"!==e[e.length-2]||e.includes("dependencyManagement")||e.includes("parent")||e.includes("build")||r.push(_("maven",g,b,a));continue}aj.has(f)&&s.push(f)}}}),r;case"build.gradle":var u=a;let v=[];return at(u,(a,b)=>{if(!an.test(a))for(let c of a.matchAll(am)){let d=c[1];void 0!==d&&v.push(_("maven",d,b,a))}}),v;case"Gemfile":var w=a;let x=[];return at(w,(a,b)=>{let c=ao.exec(a)?.[1];void 0!==c&&x.push(_("rubygems",c,b,a))}),x;case"Cargo.toml":var y=a;let z=[],A="none";return at(y,(a,b)=>{let c=ab.exec(a);if(c){let d=c[1]?.trim()??"";if("dependencies"===d)A="plain";else if(d.startsWith("dependencies.")){A="dotted";let c=d.slice(13);""!==c&&z.push(_("cargo",c,b,a))}else A="none";return}if("plain"===A){let c=ap.exec(a)?.[1];void 0!==c&&z.push(_("cargo",c,b,a))}}),z;case"composer.json":var B=a;let C=au(B);return null===C?[]:av(C.require).filter(a=>"php"!==a&&!a.startsWith("ext-")).map(a=>aw("composer",a,B,"require"));case"csproj":var D=a;let E=[],F=!1;return at(D,(a,b)=>{let c=as(a,F);F=c.inComment;let d=aq.exec(c.visible)?.[1];void 0!==d&&E.push(_("nuget",d,b,a))}),E;case"packages.config":var G=a;let H=[],I=!1;return at(G,(a,b)=>{let c=as(a,I);I=c.inComment;let d=ar.exec(c.visible)?.[1];void 0!==d&&H.push(_("nuget",d,b,a))}),H;default:return[]}}function _(a,b,c,d){return{ecosystem:a,pkg:b,line:c,snippet:R(d)}}let aa=/^\s*([A-Za-z0-9][\w.-]*)/,ab=/^\s*\[([^\]]+)\]\s*$/,ac=/"([^"]*)"|'([^']*)'/g,ad=/^([A-Za-z0-9][\w.-]*)/,ae=/^\s*([A-Za-z0-9][\w.-]*)\s*=/,af=/^\s*(require|exclude|replace|retract)\s*\(/,ag=/^\s*\)/,ah=/^\s*require\s+([\w./-]+)\s+v\d/,ai=/^\s*([\w./-]+)\s+v\d/,aj=new Set(["project","parent","dependencyManagement","dependencies","dependency","build","plugins","plugin","exclusions","exclusion"]),ak=/<(\/?)([A-Za-z][\w.-]*)([^<>]*)>/g,al=/^([^<]*)/,am=/\b(?:implementation|api|compile)\b\s*[('"]*(?:platform\s*\(\s*['"])?([\w.-]+):[\w.-]+/g,an=/^\s*\/\//,ao=/^\s*gem\s+['"]([\w-]+)['"]/,ap=/^([A-Za-z0-9_-]+)\s*=/,aq=/<PackageReference\s+Include="([^"]+)"/,ar=/<package\s+id="([^"]+)"/;function as(a,b){let c="",d=a,e=b;for(;;){if(e){let a=d.indexOf("--\x3e");if(-1===a)return{visible:c,inComment:!0};d=d.slice(a+3),e=!1;continue}let a=d.indexOf("\x3c!--");if(-1===a)return{visible:c+d,inComment:!1};c+=d.slice(0,a),d=d.slice(a+4),e=!0}}function at(a,b){let c=a.split("\n");for(let a=0;a<c.length;a+=1)b(c[a]??"",a+1)}function au(a){let b;try{b=JSON.parse(a)}catch{return null}if("object"!=typeof b||null===b)return null;let c=b;return{dependencies:c.dependencies,optionalDependencies:c.optionalDependencies,require:c.require}}function av(a){return"object"!=typeof a||null===a?[]:Object.keys(a)}function aw(a,b,c,d){let e=c.indexOf(`"${d}"`),f=c.indexOf(`"${b}"`,-1===e?0:e);return -1===f?_(a,b,1,b):_(a,b,function(a,b){let c=1;for(let d=0;d<b;d+=1)"\n"===a[d]&&(c+=1);return c}(c,f),function(a,b){let c=a.lastIndexOf("\n",b)+1,d=a.indexOf("\n",b);return a.slice(c,-1===d?a.length:d)}(c,f))}let ax=new Set(["GET","POST","PUT","DELETE"]);function ay(a,b){let c=[];for(let n of a){for(let a of n.endpoints){let m=function(a,b,c){let m=function(a,b){let c=a.toLowerCase();if(h(c))return i(c)?null:{kind:"ip",trust:"ip",name:c,category:"Unresolved host",entry:null};if(function(a){let b=j(a);if(!b.includes(":"))return!1;let c=b.split("::");if(c.length>2)return!1;let d=(2===c.length?c:[b]).flatMap(a=>""===a?[]:a.split(":"));return!!d.every(a=>k.test(a))&&(2===c.length?d.length<=7:8===d.length)}(c))return!function(a){let b=j(a);if("::"===b||"::1"===b)return!0;let c=(b.split(":")[0]??"").padStart(4,"0");return!!(c.startsWith("fc")||c.startsWith("fd")||c.startsWith("fe")&&"89ab".includes(c[2]??"")||c.startsWith("ff"))}(c)?{kind:"ip",trust:"ip",name:c,category:"Unresolved host",entry:null}:null;let m=function(a){let b=l.exec(j(a));return b?.[1]??null}(c);if(null!==m&&h(m))return i(m)?null:{kind:"ip",trust:"ip",name:c,category:"Unresolved host",entry:null};if(f.some(a=>g(c,a)))return null;let n=d.find(a=>a.hostSuffixes.some(a=>g(c,a)));if(n)return{kind:"provider",trust:"recognized",name:n.name,category:n.category,entry:n};let o=b?.internalDomains??[];return!c.includes(".")&&!c.includes(":")||e.some(a=>g(c,a))||o.some(a=>g(c,a.toLowerCase()))?{kind:"internal",trust:"internal",name:c,category:"Internal services",entry:null}:{kind:"external",trust:"unverified",name:c,category:"External domain",entry:null}}(b.host,c);if(null===m)return null;let n="provider"===m.kind;return{host:b.host,kind:m.kind,name:m.name,category:m.category,trust:m.trust,network:n?null:{port:b.port,geo:null,ptr:null},method:b.method,transport:b.transport,url:b.url,template:b.template,dataClass:n?m.entry?.defaultDataClasses[0]??"none":"none",site:{file:a.file,line:b.line,snippet:b.snippet,dynamic:b.template,vendored:a.vendored}}}(n,a,b);null!==m&&c.push(m)}for(let a of n.sdkHits){let b=function(a,b){let c=function(a,b){for(let c of d){let d=c.sdks[a];if(void 0!==d&&d.some(c=>(function(a,b,c){switch(a){case"nuget":return b.toLowerCase()===c.toLowerCase();case"pypi":return m(b)===m(c);case"go":return b===c||b.startsWith(`${c}/`);case"maven":return b===c||b.startsWith(`${c}.`);default:return b===c}})(a,b,c)))return c}return null}(b.ecosystem,b.pkg);return null===c?null:{host:new URL(c.apiBase).hostname,kind:"provider",name:c.name,category:c.category,trust:"recognized",network:null,method:"SDK",transport:"https",url:c.apiBase,template:!1,dataClass:c.defaultDataClasses[0]??"none",site:{file:a.file,line:b.line,snippet:b.snippet,dynamic:!1,vendored:a.vendored}}}(n,a);null!==b&&c.push(b)}}var n=function(a){let b=new Set,c=[];for(let e of a){var d;let a=JSON.stringify([(d=e).host,d.method,d.url,d.site.file,d.site.line]);b.has(a)||(b.add(a),c.push(e))}return c}(c);let o=new Set;for(let a of n)ax.has(a.method)&&o.add(az(a));return n.filter(a=>"REF"!==a.method||!o.has(az(a)))}function az(a){return JSON.stringify([a.host,a.url])}function aA(a){return a.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}let aB=new WeakMap,aC=new WeakMap,aD=new WeakMap;function aE(a,b,c){let d="keyword"===a?aC:aD,e=d.get(b);if(void 0!==e){if(e.stateful)for(let a of e.entries)void 0!==a&&(a.lastIndex=0);return e.entries}let f=c();return d.set(b,{entries:f,stateful:f.some(a=>void 0!==a&&(a.global||a.sticky))}),f}class aF{match(a,b){if("keyword"!==b.matcher.type)return[];let{keywords:c,caseSensitive:d}=b.matcher,e=[];for(let f of aE("keyword",b.matcher,()=>c.map(a=>{if(0!==a.length)return new RegExp(aA(a),d?"gu":"giu")}))){let b;if(void 0!==f){if(e.length>=1e4)break;for(;null!==(b=f.exec(a))&&(e.push({start:b.index,end:b.index+b[0].length}),!(e.length>=1e4)););}}return e}}class aG{match(a,b){let c;if("regex"!==b.matcher.type)return[];let{pattern:d,flags:e,captureGroup:f}=b.matcher,g=function(a,b){let c=aB.get(a);if(void 0!==c)return c.lastIndex=0,c;let d=b();return aB.set(a,d),d}(b.matcher,()=>new RegExp(d,e.includes("d")?e:`${e}d`)),h=a.length>2e5?a.slice(0,2e5):a,i=[],j=h.length+1,k=0;for(;null!==(c=g.exec(h))&&!(++k>j);){let a=null!=f?c[f]:c[0];if(0===c[0].length&&g.lastIndex++,a&&i.length<1e4){let b=null!=f?c.indices?.[f]:void 0,d=b?b[0]:c.index;i.push({start:d,end:d+a.length})}if(!e.includes("g")||i.length>=1e4)break}return i}}let aH=new aF,aI=new aG,aJ={keyword:(a,b)=>aH.match(a,b),regex:(a,b)=>aI.match(a,b)},aK=new Map,aL={entropy:(a,b)=>(function(a,b=3.5,c=20){return a.length>=c&&function(a){let b={};for(let c of a)b[c]=(b[c]??0)+1;let c=0;for(let d of Object.values(b)){let b=d/a.length;c-=b*Math.log2(b)}return c}(a)>=b})(a,aM(b,"threshold"),aM(b,"minLength")),luhn:a=>(function(a){let b=a.replace(/\D/g,"");if(b.length<13)return!1;let c=0,d=!0;for(let a=b.length-1;a>=0;a--){let e=parseInt(b[a]??"0",10);!d&&(e*=2)>9&&(e-=9),c+=e,d=!d}return c%10==0})(a)};function aM(a,b){let c=a?.[b];return"number"==typeof c&&Number.isFinite(c)?c:void 0}function aN(a,b,c){let d=b??[...aK.values()].flatMap(a=>a.rules),e=c?.filePath?function(a){let b=a.slice(Math.max(a.lastIndexOf("/"),a.lastIndexOf("\\"))+1),c=b.lastIndexOf(".");return c>0?b.slice(c).toLowerCase():void 0}(c.filePath):void 0,f=[];for(let b of d)if(function(a,b){return!a.appliesTo||void 0===b||a.appliesTo.extensions.some(a=>a.toLowerCase()===b)}(b,e))for(let c of aJ[b.matcher.type](a,b)){let d=a.slice(c.start,c.end);(function(a,b){let c=a.postValidators;if(!c||0===c.length)return!0;for(let a of c){let c="string"==typeof a?a:a.name,d="string"==typeof a?void 0:a.config;if(!aL[c](b,d))return!1}return!0})(b,d)&&f.push({rule:b,match:{ruleId:b.id,category:b.category,severity:b.severity,span:c,rawMatch:d,confidence:.9}})}let g=[];for(let b of f){let c=b.rule.requiresNearby;if(!c){g.push(b.match);continue}if(!function(a,b,c){let d=a.rule.requiresNearby;if(!d)return!0;let e=d.windowChars,{start:f,end:g}=a.match.span,h=f-e,i=g+e,j=d.categories,k=d.ruleIds;if(j?.length||k?.length)for(let c of b){if(c===a)continue;let b=c.match.span;if(!(b.end<h)&&!(b.start>i)&&(c.match.ruleId!==a.match.ruleId&&j?.includes(c.match.category)||k?.includes(c.match.ruleId)))return!0}let l=d.labels;if(l&&l.length>0){let a=c.slice(Math.max(0,h),i);for(let b of aE("label",d,()=>l.map(a=>{let b=a.trim();return 0===b.length?void 0:RegExp(`(?<![A-Za-z0-9])${aA(b)}(?![A-Za-z0-9])`,"i")})))if(b?.test(a))return!0}return!1}(b,f,a))continue;let d=c.confidenceBoost;g.push(d?{...b.match,confidence:Math.min(.99,b.match.confidence+d)}:b.match)}return g}let aO={critical:3,high:2,medium:1,low:0};function aP(a,b){if(0===b.length)return a;let c=[...b].sort((a,b)=>a.span.start-b.span.start||a.span.end-b.span.end),d=[];for(let a of c){let b=aO[a.severity],c=d[d.length-1];c&&a.span.start<c.end?(c.end=Math.max(c.end,a.span.end),b>c.rank&&(c.rank=b,c.category=a.category)):d.push({start:a.span.start,end:a.span.end,category:a.category,rank:b})}let e=a;for(let a of[...d].reverse()){let b=`[REDACTED:${a.category.toUpperCase()}]`;e=e.slice(0,a.start)+b+e.slice(a.end)}return e}function aQ(a){if(a.length<=5)return"***";let b=a.indexOf("@");if(b>0&&b<a.length-1){let c=a.slice(b+1);if(c.includes(".")){let d=a.slice(0,b),e=d.length<=1?d:d.charAt(0)+"*".repeat(d.length-1);return`${e}@${c}`}}return`${a.charAt(0)}${"*".repeat(6)}${a.charAt(a.length-1)}`}var aR=c(49008);function aS(a){let b=[],c=null;for(let d of a.matchAll((0,aR.jwX)()))b.push({start:d.index,end:d.index+d[0].length}),c??=a,c=c.slice(0,d.index)+" ".repeat(d[0].length)+c.slice(d.index+d[0].length);return{text:c??a,spans:b}}function aT(a,b){return 0===b.length?a:a.filter(a=>!b.some(b=>a.span.start<b.end&&a.span.end>b.start))}let aU=new Set(["prettier","eslint","biome","black","ruff","gofmt","rustfmt","node","npx","npm","pnpm","yarn","make","git","jq","echo"]);JSON.stringify({kind:"hook-conflict",mutation:/(--write|--fix|\s-w\b|\s-i\b|(?<![\d&>])>\s?\S)/.source,note:"two hooks on the same event with overlapping matchers, both mutating the tool target"}),JSON.stringify({kind:"hook-unknown",knownTools:[...aU]}),JSON.stringify({kind:"hook-external-egress",pattern:/\b(curl|wget|nc|ncat|netcat|ssh|scp|rsync)\b|https?:\/\//.source});let aV=["a","0"," ","x","ab","a.","a-","a_","a@","a/","a:","a=","a;","aA0","	"].flatMap(a=>[23,25].map(b=>a.repeat(Math.ceil(b/a.length)).slice(0,b)+"!")),aW=["abc-","a.","a ","a=","x","0","a@","a/","ab"].map(a=>a.repeat(1e4).slice(0,4e4)+"!"),aX=()=>performance.now();function aY(a,b){let{ms:c,probe:d,corroboratedMs:e}=function(a,b=aX,c){let d,e=0,f="";for(let g of[..."regex"===a.matcher.type?function(a){let b=function(a){let b="",c=0;for("^"===a[0]&&c++;c<a.length;){let d=a[c];if(void 0===d)break;if("\\"===d){let d=a[c+1];if("b"===d||"B"===d){c+=2;continue}if(void 0===d||/[dDwWsSnrtfv.]/.test(d))break;b+=d,c+=2;continue}if("([{.*+?|)]}^$".includes(d))break;b+=d,c++}return b}(a),c=function(a){let b=new Set;for(let c of a.matchAll(/\[\^?([^\]]+)\]/g)){let a=c[1];if(void 0===a)continue;let d=/([A-Za-z0-9])-[A-Za-z0-9]/.exec(a),e=d?.[1];if(void 0!==e)b.add(e);else{let c=a.replace(/\\/g,"")[0];void 0!==c&&"^"!==c&&b.add(c)}}return a.includes("\\w")&&b.add("a"),a.includes("\\d")&&b.add("0"),a.includes("\\s")&&b.add(" "),/(?<!\\)\./.test(a)&&b.add("a"),0===b.size&&b.add("a"),[...b]}(a),d=["!","#","~","\n"],e=[];for(let a of c)for(let c of d)if(c!==a)for(let d of[23,25])e.push(b+a.repeat(d)+c);return e}(a.matcher.pattern):[],...aV,...aW]){let h=b(),i=c?.();aN(g,[a]);let j=b()-h,k=c?.();if(j>e&&(e=j,f=g,d=void 0===i||void 0===k?void 0:k-i),e>=100)break}return{ms:e,probe:f,corroboratedMs:d}}(a,aX,b),f=e??0;return{verdict:c<100?"safe":f>=20?"over-budget":"uncorroborated",worstMs:c,corroboratedMs:f,probe:d}}}};

package/web-ui/web-ui/.next/server/chunks/739.js

@@ -0,0 +1 @@
+"use strict";exports.id=739,exports.ids=[739],exports.modules={10739:(a,b,c)=>{c.d(b,{Ah:()=>q,MR:()=>r});var d=c(49008),e=c(37067),f=c(44708);class g extends Error{constructor(a){super(`control-plane request failed with status ${String(a)}`),this.status=a,this.name="RemoteRequestError"}}class h extends Error{constructor(a){super(`control plane does not serve ${a}`),this.route=a,this.name="RemoteRouteAbsent"}}class i extends Error{constructor(a,b){super(`refusing to send a malformed body to ${a}`),this.cause=b,this.name="RemoteRequestInvalid"}}class j extends Error{constructor(a,b){super(`control plane answered ${a} with ${b}`),this.name="RemoteResponseInvalid"}}class k extends Error{constructor(a,b){super(`control-plane request did not complete: ${a}`),this.status=b,this.name="RemoteTransportError"}}async function l(a){let b=new URL(a.url),c=a.timeoutMs??1e4,d="http:"===b.protocol?e.request:f.request,g={method:a.method,headers:{...a.headers,...void 0===a.apiKey?{}:{"x-api-key":a.apiKey},accept:"application/json",...void 0===a.body?{}:{"content-type":"application/json","content-length":String(Buffer.byteLength(a.body))}}};return new Promise((e,f)=>{let h=!1,i=(a,b)=>{h||(h=!0,f(new k(a,b)))},j=d(b,g,a=>{let b=[],c=0;a.on("data",d=>{if((c+=d.length)>8388608){i(`response exceeded ${String(8388608)} bytes`,a.statusCode),a.destroy(),j.destroy();return}b.push(d)}),a.on("aborted",()=>{i("the response was aborted",a.statusCode)}),a.on("end",()=>{h||(h=!0,e({status:a.statusCode??0,headers:a.headers,body:Buffer.concat(b).toString("utf8")}))})}),l=setTimeout(()=>{i(`no response within ${String(c)}ms`),j.destroy()},c);l.unref(),j.on("upgrade",(a,b)=>{i("the deployment answered with a protocol upgrade"),b.destroy()}),j.on("close",()=>{i("the connection closed before a response was read"),clearTimeout(l)}),j.on("error",a=>{i(a.message)}),void 0!==a.body&&j.write(a.body),j.end()})}let m={events:"/v1/events",auditEvents:"/v1/audit-events",auditEventsBatch:"/v1/audit-events/batch",inventory:"/v1/inventory",storePosture:"/v1/store-posture",policyBundle:"/v1/policy-bundle",whoami:"/v1/plugin/whoami",shares:"/v1/shares",commands:"/v1/plugin/commands"};function n(a,b){let c=a.headers[b];if(void 0!==c)return Array.isArray(c)?c[0]:c}function o(a){if(a.status<200||a.status>=300)throw new g(a.status);return a.body}function p(a,b,c){let d;try{d=JSON.parse(b)}catch{throw new j(c,"a body that is not JSON")}let e=a.safeParse(d);if(!e.success)throw new j(c,"a body this client cannot read");return e.data}function q(a){let b=function(a){let b=a.length;for(;b>0&&47===a.charCodeAt(b-1);)b-=1;return a.slice(0,b)}(a.endpoint),c=a=>`${b}${a}`,e={apiKey:a.apiKey,timeoutMs:a.timeoutMs},f=async a=>{let b=d.qhM.safeParse(a);if(!b.success)throw new i(m.auditEvents,b.error);o(await l({...e,method:"POST",url:c(m.auditEvents),body:JSON.stringify(b.data)}))};return{async ingestEvents(a){let b=await l({...e,method:"POST",url:c(m.events),body:JSON.stringify(a)});return p(d.kg1,o(b),m.events)},async ingestInventory(a){let b=await l({...e,method:"POST",url:c(m.inventory),body:JSON.stringify(a)});return p(d.PUD,o(b),m.inventory)},async recordAuditEvent(a){await f(a)},async recordAuditEvents(a,b){let g=d.lBn.safeParse({events:a});if(!g.success)throw new i(m.auditEventsBatch,g.error);let j=await l({...e,method:"POST",url:c(m.auditEventsBatch),body:JSON.stringify(g.data)});if(404===j.status){if(b?.fallbackToSingleEvents!==!0)throw new h(m.auditEventsBatch);for(let a of g.data.events)await f(a);return{accepted:g.data.events.length}}return p(d.t8P,o(j),m.auditEventsBatch)},async reportStorePosture(a){o(await l({...e,method:"POST",url:c(m.storePosture),body:JSON.stringify(a)}))},async getPolicyBundle(a){let b=await l({...e,method:"GET",url:c(m.policyBundle),...void 0===a?{}:{headers:{"if-none-match":a}}});return 304===b.status?{changed:!1,etag:n(b,"etag")??a}:{changed:!0,bundle:p(d.vap,o(b),m.policyBundle),etag:n(b,"etag")}},async whoami(){let a=await l({...e,method:"GET",url:c(m.whoami)});return p(d.NtJ,o(a),m.whoami)},async recordProjectEgress(a){let b=d.BZd.safeParse(a);if(!b.success)throw new i(m.shares,b.error);let f=await l({...e,method:"POST",url:c(m.shares),body:JSON.stringify(b.data)});if(404===f.status)throw new h(m.shares);o(f)},async pollCommand(){let a=await l({...e,method:"GET",url:c(m.commands)});return 404===a.status?null:p(d.CPm,o(a),m.commands).command},async ackCommand(a,b){let f=d.B0R.safeParse(b),g=`${m.commands}/${encodeURIComponent(a)}/ack`;if(!f.success)throw new i(g,f.error);o(await l({...e,method:"POST",url:c(g),body:JSON.stringify(f.data)}))}}}function r(a=15e3){return async(b,c)=>{try{return await q({...b,timeoutMs:a}).recordProjectEgress(c),{ok:!0}}catch(a){return{ok:!1,kind:function(a){switch("object"!=typeof a||null===a||!("name"in a)?null:"string"==typeof a.name?a.name:null){case"RemoteRouteAbsent":return"route-absent";case"RemoteRequestInvalid":return"invalid-request";case"RemoteResponseInvalid":return"rejected"}let b=function(a){if("object"!=typeof a||null===a||!("status"in a))return null;let{status:b}=a;return"number"==typeof b&&Number.isInteger(b)&&b>=100&&b<=599?b:null}(a);if(null===b)return"unreachable";switch(b){case 401:return"unauthorized";case 403:return"forbidden";case 429:case 404:return"unreachable";default:return b>=400&&b<=499?"rejected":"unreachable"}}(a)}}}}}};

package/web-ui/web-ui/.next/server/chunks/766.js

@@ -0,0 +1,6 @@
+exports.id=766,exports.ids=[766],exports.modules={35653:a=>{function b(a){return Array.isArray(a)?a:[a]}let c=void 0,d=/^\s+$/,e=/(?:[^\\]|^)\\$/,f=/^\\!/,g=/^\\#/,h=/\r?\n/g,i=/^\.{0,2}\/|^\.{1,2}$/,j=/\/$/,k="node-ignore";"undefined"!=typeof Symbol&&(k=Symbol.for("node-ignore"));let l=k,m=(a,b,c)=>(Object.defineProperty(a,b,{value:c}),c),n=/([0-z])-([0-z])/g,o=()=>!1,p=[[/^\uFEFF/,()=>""],[/((?:\\\\)*?)(\\?\s+)$/,(a,b,c)=>b+(0===c.indexOf("\\")?" ":"")],[/(\\+?)\s/g,(a,b)=>{let{length:c}=b;return b.slice(0,c-c%2)+" "}],[/[\\$.|*+(){^]/g,a=>`\\${a}`],[/(?!\\)\?/g,()=>"[^/]"],[/^\//,()=>"^"],[/\//g,()=>"\\/"],[/^\^*(?:\\\*\\\*\\\/)+/,()=>"^(?:.*\\/)?"],[/^(?=[^^])/,function(){return/\/(?!$)/.test(this)?"^":"(?:^|\\/)"}],[/\\\/\\\*\\\*(?=\\\/|$)/g,(a,b,c)=>b+6<c.length?"(?:\\/[^\\/]+)*":"\\/.+"],[/(^|[^\\]+)(\\\*)+(?=.+)/g,(a,b,c)=>b+c.replace(/\\\*/g,"[^\\/]*")],[/\\\\\\(?=[$.|*+(){^])/g,()=>"\\"],[/\\\\/g,()=>"\\"],[/(\\)?\[([^\]/]*?)(\\*)($|\])/g,(a,b,c,d,e)=>"\\"===b?`\\[${c}${(a=>{let{length:b}=a;return a.slice(0,b-b%2)})(d)}${e}`:"]"===e&&d.length%2==0?`[${(a=>a.startsWith("!")||a.startsWith("\\^")?`^${a.slice("!"===a[0]?1:2)}`:a)(c.replace(n,(a,b,c)=>b.charCodeAt(0)<=c.charCodeAt(0)?a:""))}${d}]`:"[]"],[/(?:[^*])$/,a=>/\/$/.test(a)?`${a}$`:`${a}(?=$|\\/$)`]],q=/(^|\\\/)?\\\*$/,r="regex",s="checkRegex",t={[r](a,b){let c=b?`${b}[^/]+`:"[^/]*";return`${c}(?=$|\\/$)`},[s](a,b){let c=b?`${b}[^/]*`:"[^/]*";return`${c}(?=$|\\/$)`}};class u{constructor(a,b,c,d,e,f){this.pattern=a,this.mark=b,this.negative=e,m(this,"body",c),m(this,"ignoreCase",d),m(this,"regexPrefix",f)}get regex(){let a="_"+r;return this[a]?this[a]:this._make(r,a)}get checkRegex(){let a="_"+s;return this[a]?this[a]:this._make(s,a)}_make(a,b){let c=this.regexPrefix.replace(q,t[a]);return m(this,b,this.ignoreCase?RegExp(c,"i"):new RegExp(c))}}class v{constructor(a){this._ignoreCase=a,this._rules=[]}_add(a){let b;if(a&&a[l]){this._rules=this._rules.concat(a._rules._rules),this._added=!0;return}if("string"==typeof a&&(a={pattern:a}),(b=a.pattern)&&"string"==typeof b&&!d.test(b)&&!e.test(b)&&0!==b.indexOf("#")){let b=(({pattern:a,mark:b},c)=>{let d,e=!1,h=a;0===h.indexOf("!")&&(e=!0,h=h.substr(1));let i=(d=h=h.replace(f,"!").replace(g,"#"),p.reduce((a,[b,c])=>a.replace(b,c.bind(d)),d));return new u(a,b,h,c,e,i)})(a,this._ignoreCase);this._added=!0,this._rules.push(b)}}add(a){return this._added=!1,b("string"==typeof a?a.split(h).filter(Boolean):a).forEach(this._add,this),this._added}test(a,b,d){let e,f=!1,g=!1;this._rules.forEach(h=>{let{negative:i}=h;(g!==i||f===g)&&(!i||f||g||b)&&h[d].test(a)&&(f=!i,g=i,e=i?c:h)});let h={ignored:f,unignored:g};return e&&(h.rule=e),h}}let w=(a,b)=>{throw new b(a)},x=(a,b,c)=>"string"!=typeof a?c(`path must be a string, but got \`${b}\``,TypeError):a?!x.isNotRelative(a)||c(`path should be a \`path.relative()\`d string, but got "${b}"`,RangeError):c("path must not be empty",TypeError),y=a=>i.test(a);x.isNotRelative=y,x.convert=a=>a;class z{constructor({ignorecase:a=!0,ignoreCase:b=a,allowRelativePaths:c=!1}={}){m(this,l,!0),this._rules=new v(b),this._strictPathCheck=!c,this._initCache()}_initCache(){this._ignoreCache=Object.create(null),this._testCache=Object.create(null)}add(a){return this._rules.add(a)&&this._initCache(),this}addPattern(a){return this.add(a)}_test(a,b,c,d){let e=a&&x.convert(a);return x(e,a,this._strictPathCheck?w:o),this._t(e,b,c,d)}checkIgnore(a){if(!j.test(a))return this.test(a);let b=a.split("/").filter(Boolean);if(b.pop(),b.length){let a=this._t(b.join("/")+"/",this._testCache,!0,b);if(a.ignored)return a}return this._rules.test(a,!1,s)}_t(a,b,c,d){if(a in b)return b[a];if(d||(d=a.split("/").filter(Boolean)),d.pop(),!d.length)return b[a]=this._rules.test(a,c,r);let e=this._t(d.join("/")+"/",b,c,d);return b[a]=e.ignored?e:this._rules.test(a,c,r)}ignores(a){return this._test(a,this._ignoreCache,!1).ignored}createFilter(){return a=>!this.ignores(a)}filter(a){return b(a).filter(this.createFilter())}test(a){return this._test(a,this._testCache,!0)}}let A=a=>new z(a),B=()=>{x.convert=a=>/^\\\\\?\\/.test(a)||/["<>|\u0000-\u001F]+/u.test(a)?a:a.replace(/\\/g,"/");let a=/^[a-z]:\//i;x.isNotRelative=b=>a.test(b)||y(b)};"undefined"!=typeof process&&"win32"===process.platform&&B(),a.exports=A,A.default=A,a.exports.isPathValid=a=>x(a&&x.convert(a),a,o),m(a.exports,Symbol.for("setupWindows"),B)},82766:(a,b,c)=>{"use strict";let d,e,f;c.d(b,{Pi:()=>cx,S1:()=>R,tq:()=>U,IL:()=>cA,Lr:()=>cv,yy:()=>M,Kq:()=>cy,UE:()=>V,I9:()=>cr,US:()=>cm,f2:()=>cw,u5:()=>cB,OF:()=>ct,cW:()=>Y});var g=c(31421),h=c(48161);let i="win32"===process.platform,j=/[\s&|^<>()"]/;function k(a){return j.test(a)?`"${a.replaceAll('"','""')}"`:a}let l=/^[\w@%+=:,./-]+$/;function m(a){return i?a.map(k):a}let n="win32"===process.platform?{cwd:(0,h.homedir)()}:{};function o(a){let b="win32"===process.platform?"where":"command",c="win32"===process.platform?[a]:["-v",a];try{let a=(0,g.spawnSync)(b,c,{stdio:"ignore",shell:"win32"!==process.platform,...n});return 0===a.status}catch{return!1}}function p(a,b,c=15e3){try{let d=(0,g.execFileSync)(a,m(b),{encoding:"utf8",timeout:c,stdio:["ignore","pipe","pipe"],shell:i,...n});return{ok:!0,stdout:d.trim(),stderr:""}}catch(a){return{ok:!1,stdout:"string"==typeof a.stdout?a.stdout.trim():"",stderr:"string"==typeof a.stderr?a.stderr.trim():""}}}function q(a,b){try{return(0,g.execFileSync)(a,m(b),{stdio:"inherit",shell:i,...n}),!0}catch{return!1}}let r={claude:{install:a=>[["plugin","install",a]],update:a=>[["plugin","update",a]],register:a=>[["plugin","marketplace","add",a]],refresh:a=>[["plugin","marketplace","update",a]]},codex:{install:a=>[["plugin","add",a]],update:a=>[["plugin","add",a]],register:a=>[["plugin","marketplace","add",a]],refresh:a=>[["plugin","marketplace","upgrade",a]]}};function s(a){let b=r[a],c=b=>b.every(b=>q(a,[...b])),d=b=>b.map(b=>`${a} ${b.join(" ")}`),e=(a,c)=>[...b.register(a),...c?b.refresh(c):[]],f=(a,c)=>d([...c?b.register(c):[],...a]),g=(a,b,c)=>d([...b?e(b,c):[],...a]);return{available:()=>o(a),marketplaceSteps:e,installSteps:a=>b.install(a),updateSteps:a=>b.update(a),installRecipe:(a,c)=>f(b.install(a),c),updateRecipe:(a,c)=>f(b.update(a),c),installSpawnPlan:(a,c,d)=>g(b.install(a),c,d),updateSpawnPlan:(a,c,d)=>g(b.update(a),c,d),install:a=>c(b.install(a)),update:a=>c(b.update(a))}}var t=c(73024),u=c(76760),v=c(73136),w=c(49008);let x=[{id:"claude-code",name:"Claude Code",sourceTool:w.Zdp.ClaudeCode,description:"Hooks Claude Code sessions to detect + redact sensitive data in prompts, responses, and file writes.",npmPackage:"@akasecurity/ai-tc-claude-code",pluginName:"ai-tc",marketplace:"akasecurity",marketplaceSource:"akasecurity/marketplace",cliBin:"claude"},{id:"codex",name:"Codex CLI",sourceTool:w.Zdp.Codex,description:"Hooks Codex CLI sessions to detect + redact sensitive data in prompts, responses, and Bash tool calls.",npmPackage:"@akasecurity/ai-tc-codex",pluginName:"aka-codex",marketplace:"ai-tc",marketplaceSource:"akasecurity/ai-tc",cliBin:"codex"},{id:"antigravity",name:"Antigravity",sourceTool:w.Zdp.Antigravity,description:"Hooks Antigravity CLI sessions to detect sensitive data in shell commands and file writes.",npmPackage:"@akasecurity/ai-tc-antigravity",installHint:"Antigravity installs plugins from a local directory rather than a marketplace:\n  npm pack @akasecurity/ai-tc-antigravity && tar -xzf akasecurity-ai-tc-antigravity-*.tgz\n  agy plugin install ./package\nThen run `aka init` to set up the local store."}];function y(a){if(a.pluginName&&a.marketplace)return`${a.pluginName}@${a.marketplace}`}function z(a){let b=/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z-.]+))?$/.exec(a.trim());return b?{core:[Number(b[1]),Number(b[2]),Number(b[3])],pre:b[4]?b[4].split("."):[]}:null}function A(a){return null!==z(a)}function B(a,b){let c=z(a),d=z(b);if(!c||!d)return 0;for(let a=0;a<3;a++){let b=c.core[a]??0,e=d.core[a]??0;if(b!==e)return b<e?-1:1}return function(a,b){if(0===a.length&&0===b.length)return 0;if(0===a.length)return 1;if(0===b.length)return -1;let c=Math.min(a.length,b.length);for(let d=0;d<c;d++){let c=a[d]??"",e=b[d]??"";if(c===e)continue;let f=/^\d+$/.test(c),g=/^\d+$/.test(e);if(f&&!g)return -1;if(!f&&g)return 1;if(f&&g)return Number(c)<Number(e)?-1:1;return c<e?-1:1}return a.length===b.length?0:a.length<b.length?-1:1}(c.pre,d.pre)}let C="@akasecurity/cli";function D(a){return"object"==typeof a&&null!==a}function E(a){let b=p("npm",["view",a,"version"],15e3);if(!b.ok||!b.stdout)return null;let c=b.stdout.split("\n").pop()?.trim();return c&&/^\d/.test(c)?c:null}function F(a){return a.split(u.sep).filter(Boolean)}function G(a,b){for(let c=a.length-b.length;c>=0;c--)if(b.every((b,d)=>a[c+d]===b))return c;return -1}function H(a){let b=0;for(;a[b]===u.sep;)b++;return a.slice(0,b)}function I(a,b){return b+a.join(u.sep)}let J=new Set(["homebrew","local","linuxbrew",".linuxbrew"]),K=[["pnpm-lock.yaml","pnpm"],["yarn.lock","yarn"],["bun.lock","bun"],["bun.lockb","bun"],["package-lock.json","npm"]];function L(a){return"yarn"===a.toLowerCase().replace(/^\./,"")}function M(a){var b;return function(a){if(a.sea)return{kind:"sea",execPath:a.execPath,installRoot:function(a){let b=F(a),c=b[b.length-2];return b.length<4||!c?.startsWith("aka-")?null:I(b.slice(0,b.length-3),H(a))}(a.execPath)};if(void 0===a.moduleDir)return{kind:"unknown",detail:"the running module has no resolvable path"};let b=function(a,b){let c=b;for(let b=0;b<8;b++){if(a.packageName(c)===C)return c;let b=(0,u.dirname)(c);if(b===c)break;c=b}return null}(a,a.moduleDir);if(null===b){let b=function(a,b){let c=b;for(let b=0;b<8;b++){if(a.exists((0,u.join)(c,"pnpm-workspace.yaml")))return c;let b=(0,u.dirname)(c);if(b===c)break;c=b}return null}(a,a.moduleDir);return null!==b?{kind:"dev",packageDir:b}:{kind:"unknown",detail:`no ${C} package.json above ${a.moduleDir}`}}let c=function(a){let b=a.lastIndexOf(".pnpm");if(b<1)return a;let c=a.indexOf("node_modules",b+1);if(c<0)return a;let d=a.slice(0,b),e="node_modules"===d[d.length-1]?[]:["node_modules"];return[...d,...e,...a.slice(c+1)]}(F(b)),d=H(b);if(c.some((a,b)=>"Cellar"===a&&b>=1&&J.has(c[b-1]??"")))return{kind:"homebrew",packageDir:b};let e=G(c,["install","global","node_modules"]);if(e>=0)return{kind:"global",manager:"bun",root:I(c.slice(0,e+2),d),packageDir:b};let f=G(c,["global"]);if(f>=0&&"node_modules"===c[f+2]&&/^\d+$/.test(c[f+1]??""))return{kind:"global",manager:"pnpm",root:I(c.slice(0,f+1),d),packageDir:b};let g=G(c,["global","node_modules"]);if(g>=1&&c.slice(Math.max(0,g-2),g).some(L))return{kind:"global",manager:"yarn",root:I(c.slice(0,g+1),d),packageDir:b};let h=G(c,["lib","node_modules"]);if(h>=0)return{kind:"global",manager:"npm",root:I(c.slice(0,h),d),packageDir:b};let i=G(c,["node_modules"]);if(i>=0){let e=I(c.slice(0,i),d);return a.exists((0,u.join)(e,"package.json"))?a.exists((0,u.join)(e,"pnpm-workspace.yaml"))?{kind:"dev",packageDir:b}:{kind:"project",packageDir:b,projectRoot:e,manager:function(a,b){for(let[c,d]of K)if(a.exists((0,u.join)(b,c)))return d;return"npm"}(a,e)}:a.exists((0,u.join)(e,"src"))?{kind:"dev",packageDir:b}:{kind:"global",manager:"npm",root:e,packageDir:b}}return a.exists((0,u.join)(b,"src"))?{kind:"dev",packageDir:b}:{kind:"unknown",detail:`unrecognised layout at ${b}`}}((b=a,{sea:function(){try{let a=c(15895);return"function"==typeof a.isSea&&a.isSea()}catch{return!1}}(),execPath:N(process.execPath),moduleDir:void 0===b.moduleDir?void 0:N(b.moduleDir),exists:t.existsSync,packageName:O}))}function N(a){try{return(0,t.realpathSync)(a)}catch{return a}}function O(a){let b=(0,u.join)(a,"package.json");if(!(0,t.existsSync)(b))return null;try{let a=JSON.parse((0,t.readFileSync)(b,"utf8"));return D(a)&&"string"==typeof a.name?a.name:null}catch{return null}}function P(a,b,c,d=6e5){if("inherit"===c)return{ok:q(a,[...b]),output:""};let e=p(a,[...b],d);return{ok:e.ok,output:[e.stdout,e.stderr].filter(Boolean).join("\n")}}function Q(a,b,c){let d=[];for(let e of b){let b=P(a,e,c);if(b.output&&d.push(b.output),!b.ok)return{ok:!1,output:d.join("\n")}}return{ok:!0,output:d.join("\n")}}function R(a,b="capture",c=o){let d=function(a,b=process.platform){let c=`${C}@latest`;switch(a.kind){case"global":return function(a,b,c,d){let e={npm:["install","-g","--prefix",b,c],pnpm:["add","-g","--global-dir",b,c],yarn:["global","add",c],bun:["add","-g",c]}[a],f=[a,...e.map(a=>(function(a,b=process.platform){return"win32"===b?k(a):a.length>0&&l.test(a)?a:`'${a.replaceAll("'",String.raw`'\''`)}'`})(a,d))].join(" ");return{command:{bin:a,args:e},display:f}}(a.manager,a.root,c,b);case"homebrew":return{command:null,display:"brew upgrade aka",reason:"this copy is managed by Homebrew — brew owns the files under Cellar"};case"sea":return{command:null,display:"win32"===b?"irm https://raw.githubusercontent.com/akasecurity/ai-tc/bin-latest/tools/installer/install.ps1 | iex":"curl -fsSL https://raw.githubusercontent.com/akasecurity/ai-tc/bin-latest/tools/installer/install.sh | sh",reason:"this is the standalone binary — it embeds its own runtime and has no npm package behind it, so re-run the installer to replace it"};case"dev":return{command:null,display:"git pull",reason:`running from a source checkout at ${a.packageDir} — nothing to install`};case"project":{let b="npm"===a.manager?"install":"add";return{command:null,display:`${a.manager} ${b} ${c}`,reason:`this copy is a dependency of the project at ${a.projectRoot}, not a global install — update it there, in that project`}}case"unknown":return{command:null,display:`npm install -g ${c}`,reason:`could not tell how this copy of aka was installed (${a.detail})`}}}(a);if(null===d.command)return{ok:!1,output:`Cannot update automatically: ${d.reason??"unsupported install"}.
+Run: ${d.display}`};let{bin:e,args:f}=d.command;return c(e)?P(e,f,b):{ok:!1,output:`the \`${e}\` CLI isn't on your PATH — install it, then run: ${d.display}`}}function S(a){let b=x.find(b=>b.id===a);if(!b)return{ok:!1,output:`unknown agent '${a}'`};let c=y(b),d=b.cliBin;if(!c||!d)return{ok:!1,output:`${b.name} has no automated install path yet.`};let e=s(d);if(!e.available()){let a=b.marketplaceSource,f=e.installRecipe(c,a).join(" && "),g=e.updateRecipe(c,a).join(" && "),h=f===g?`\`${f}\` (that installs or updates)`:`\`${f}\` (or update with \`${g}\`)`;return{ok:!1,output:`the \`${d}\` CLI isn't on your PATH — install ${b.name}, then run ${h}.`}}return{ref:c,cliBin:d,marketplace:b.marketplace,marketplaceSource:b.marketplaceSource}}function T(a,b){if(a.marketplaceSource)for(let c of s(a.cliBin).marketplaceSteps(a.marketplaceSource,a.marketplace))P(a.cliBin,c,b,6e4)}function U(a,b="capture"){let c=S(a);if("ok"in c)return c;T(c,b);let d=s(c.cliBin);return Q(c.cliBin,d.updateSteps(c.ref),b)}function V(a,b="capture"){let c=S(a);if("ok"in c)return c;T(c,b);let d=s(c.cliBin);return Q(c.cliBin,d.installSteps(c.ref),b)}var W=c(77598);function X(a){return`com.akasecurity.aka.background-sync.${(0,W.createHash)("sha256").update(a).digest("hex").slice(0,12)}`}function Y(a,b={}){try{if((b.platform??process.platform)!=="darwin")return;(b.runLaunchctl??function(a){return p("launchctl",a).ok})(["bootout",`${function(){let a=process.getuid;return`gui/${String("function"==typeof a?a():0)}`}()}/${X(a)}`]),(b.removeFile??(a=>{(0,t.rmSync)(a,{force:!0})}))(u.posix.join(u.posix.join((b.homeDir??h.homedir)(),"Library","LaunchAgents"),`${X(a)}.plist`))}catch{}}let Z=s("claude");Z.available,Z.install,Z.update;let $=s("codex");$.available,$.install,$.update;var _=c(80007),aa=c(15905),ab=c(86879);let ac=ab.Yj().optional().transform(a=>{if(void 0===a)return;let b=a.trim().toLowerCase();return""!==b&&"false"!==b&&"0"!==b}).catch(void 0),ad=ab.vk(a=>{if("string"!=typeof a||""!==a.trim())return a},ab.Yj().optional()).catch(void 0);ab.Ik({CLAUDE_CODE_USE_BEDROCK:ac,CLAUDE_CODE_USE_VERTEX:ac,ANTHROPIC_BASE_URL:ad});let ae=JSON.parse('{"specVersion":1,"id":"code-flaws/auth-jwt-no-verify","name":"JWT decoded without signature verification","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"(verify\\\\s*=\\\\s*false|verify_signature.*false|algorithms\\\\s*=\\\\s*\\\\[\\\\])","flags":"gi"},"requiresNearby":{"labels":["jwt","decode","token"],"windowChars":160},"examples":["jwt.decode(token, options={\\"verify_signature\\": False})","jwt.decode(token, algorithms=[])"]}'),af=JSON.parse('{"specVersion":1,"id":"code-flaws/auth-ssl-verify-false","name":"SSL certificate verification disabled","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"\\\\brequests\\\\.(get|post|put|delete|patch|request)\\\\s*\\\\([^)]*verify\\\\s*=\\\\s*False","flags":"gi"},"examples":["requests.get(url, verify=False)","requests.post(endpoint, data=payload, verify=False)"],"appliesTo":{"extensions":[".py"]}}'),ag=JSON.parse('{"specVersion":1,"id":"code-flaws/cmd-inject-exec","name":"Command injection via Java Runtime.exec","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"Runtime\\\\.getRuntime\\\\(\\\\)\\\\.exec\\\\(","flags":"g"},"requiresNearby":{"labels":["input","request","param","user"],"windowChars":200},"examples":["Runtime.getRuntime().exec(userInput)"],"appliesTo":{"extensions":[".java"]}}'),ah=JSON.parse('{"specVersion":1,"id":"code-flaws/cmd-inject-node-exec","name":"Command injection via Node.js exec with variable argument","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bexec(?:Sync)?\\\\s*\\\\(\\\\s*(?![\'\\"`])","flags":"g"},"requiresNearby":{"labels":["input","request","param","argv","user","query","body"],"windowChars":200},"examples":["exec(req.query.cmd)","execSync(userInput)"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx",".mjs",".cjs"]}}'),ai=JSON.parse('{"specVersion":1,"id":"code-flaws/cmd-inject-shell","name":"Command injection via subprocess shell=True","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"subprocess\\\\.(run|Popen|call|check_output)\\\\s*\\\\([^)]*shell\\\\s*=\\\\s*True","flags":"gi"},"requiresNearby":{"labels":["input","request","param","argv","user"],"windowChars":300},"examples":["subprocess.run(user_input, shell=True)"],"appliesTo":{"extensions":[".py"]}}'),aj=JSON.parse('{"specVersion":1,"id":"code-flaws/crypto-insecure-random","name":"Insecure random number generator used for security-sensitive value","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"\\\\b(Math\\\\.random\\\\(\\\\)|random\\\\.random\\\\(\\\\)|random\\\\.randint\\\\()","flags":"gi"},"requiresNearby":{"labels":["token","session","key","password","secret","nonce","salt"],"windowChars":160},"examples":["const token = Math.random().toString(36)","session_key = str(random.random())"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx",".mjs",".cjs",".py"]}}'),ak=JSON.parse('{"specVersion":1,"id":"code-flaws/crypto-weak-hash-md5","name":"Weak cryptographic hash: MD5","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"(hashlib\\\\.md5\\\\s*\\\\(|MD5\\\\.(?:digest|hash)\\\\b|Digest::MD5|MessageDigest\\\\.getInstance\\\\s*\\\\(\\\\s*[\\"\']MD5[\\"\'])","flags":"gi"},"examples":["hashlib.md5(password.encode())","MessageDigest.getInstance(\\"MD5\\")"],"appliesTo":{"extensions":[".py",".rb",".java"]}}'),al=JSON.parse('{"specVersion":1,"id":"code-flaws/crypto-weak-hash-sha1","name":"Weak cryptographic hash: SHA-1 in security context","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"(hashlib\\\\.sha1\\\\s*\\\\(|SHA1\\\\.(?:digest|hash)\\\\b|Digest::SHA1|MessageDigest\\\\.getInstance\\\\s*\\\\(\\\\s*[\\"\']SHA-?1[\\"\'])","flags":"gi"},"requiresNearby":{"labels":["password","credential","hash","token","secret"],"windowChars":160},"examples":["password_hash = hashlib.sha1(password.encode()).hexdigest()","MessageDigest.getInstance(\\"SHA1\\")"],"appliesTo":{"extensions":[".py",".rb",".java"]}}'),am=JSON.parse('{"specVersion":1,"id":"code-flaws/deser-java-ois","name":"Insecure deserialization via Java ObjectInputStream","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bObjectInputStream\\\\b","flags":"g"},"requiresNearby":{"labels":["readObject"],"windowChars":200},"examples":["ObjectInputStream ois = new ObjectInputStream(inputStream); Object obj = ois.readObject();"],"appliesTo":{"extensions":[".java"]}}'),an=JSON.parse('{"specVersion":1,"id":"code-flaws/deser-pickle","name":"Insecure deserialization via Python pickle","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bpickle\\\\.loads?\\\\s*\\\\(","flags":"gi"},"examples":["data = pickle.loads(user_data)","obj = pickle.load(request.stream)"],"appliesTo":{"extensions":[".py"]}}'),ao=JSON.parse('{"specVersion":1,"id":"code-flaws/deser-yaml-unsafe","name":"Insecure deserialization via yaml.load without SafeLoader","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"\\\\byaml\\\\.load\\\\s*\\\\((?![^)]*SafeLoader|[^)]*safe_load)","flags":"gi"},"examples":["data = yaml.load(user_input)","config = yaml.load(f)"],"appliesTo":{"extensions":[".py"]}}'),ap=JSON.parse('{"specVersion":1,"id":"code-flaws/dev-debug-enabled","name":"Debug mode enabled in configuration","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"\\\\bdebug\\\\s*[=:]\\\\s*(true|1|yes)","flags":"gi"},"examples":["DEBUG = True","debug: true","app.debug = True"]}'),aq=JSON.parse('{"specVersion":1,"id":"code-flaws/dev-placeholder-secret","name":"Placeholder or default secret left in code","category":"code_flaw","severity":"high","matcher":{"type":"keyword","keywords":["changeme","placeholder","your-secret","dev-secret","replace-me","todo-secret"],"caseSensitive":false},"requiresNearby":{"labels":["key","secret","password","token"],"windowChars":80},"examples":["SECRET_KEY = \'changeme\'","api_token = \'your-secret\'"]}'),ar=JSON.parse('{"specVersion":1,"id":"code-flaws/dev-wildcard-cors","name":"CORS wildcard allowing all origins","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"(Access-Control-Allow-Origin:\\\\s*\\\\*|origin:\\\\s*[\\"\']\\\\*[\\"\']|allow_all_origins\\\\s*=\\\\s*True|CORS_ALLOW_ALL_ORIGINS\\\\s*=\\\\s*True)","flags":"gi"},"examples":["Access-Control-Allow-Origin: *","cors({ origin: \'*\' })","CORS_ALLOW_ALL_ORIGINS = True"]}'),as=JSON.parse('{"specVersion":1,"id":"code-flaws/eval-dynamic-exec","name":"Dynamic code execution with user-controlled input","category":"code_flaw","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(eval|exec)\\\\s*\\\\(\\\\s*(?![\'\\"`])","flags":"g"},"requiresNearby":{"labels":["input","request","param","user","query","body"],"windowChars":200},"examples":["eval(request.body.code)","exec(user_input)"]}'),at=JSON.parse('{"specVersion":1,"id":"code-flaws/hardcoded-password","name":"Hardcoded password in source code","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"(?:password|passwd|pwd)\\\\s*=\\\\s*[\\"\']([^\\"\']{3,})[\\"\']","flags":"gi","captureGroup":1},"postValidators":[{"name":"entropy","config":{"minLength":8,"threshold":3}}],"examples":["password = \\"Tr0ub4dor&3\\"","DB_PASSWORD = \'c0rr3ctH0rseBatt3ry\'"]}'),au=JSON.parse('{"specVersion":1,"id":"code-flaws/hardcoded-secret-key","name":"Hardcoded API key or secret key in source code","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(secret[_-]?key|api[_-]?key|auth[_-]?token)\\\\s*=\\\\s*[\\"\'][^\\"\']{8,}[\\"\']","flags":"gi"},"postValidators":["entropy"],"examples":["SECRET_KEY = \\"a9f2c8e1b4d7f3a6c9e2b5d8f1a4c7e0\\"","api_key = \'sk-proj-abc123XYZ789def456\'"]}'),av=JSON.parse('{"specVersion":1,"id":"code-flaws/path-traversal-join","name":"Path traversal via os.path.join with user-controlled component","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"os\\\\.path\\\\.join\\\\s*\\\\([^,)]+,\\\\s*(request|req|params|user)","flags":"gi"},"examples":["os.path.join(base_dir, request.args[\'file\'])","os.path.join(upload_dir, user_filename)"],"appliesTo":{"extensions":[".py"]}}'),aw=JSON.parse('{"specVersion":1,"id":"code-flaws/path-traversal-open","name":"Path traversal via open() with user-controlled path","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"\\\\bopen\\\\s*\\\\(\\\\s*(request|req|params|argv|input)","flags":"gi"},"requiresNearby":{"labels":["request","param","input","argv","user"],"windowChars":200},"examples":["open(request.args[\'filename\'])","open(params[\'path\'])"],"appliesTo":{"extensions":[".py",".rb"]}}'),ax=JSON.parse('{"specVersion":1,"id":"code-flaws/prototype-pollution-merge","name":"Prototype pollution via merge with user-controlled input","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"(Object\\\\.assign\\\\s*\\\\(\\\\s*\\\\w+\\\\s*,\\\\s*(req|request|body|params|query)|_\\\\.merge\\\\s*\\\\(\\\\s*\\\\w+\\\\s*,\\\\s*(req|request))","flags":"gi"},"examples":["Object.assign(config, req.body)","_.merge(target, request.body)"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx",".mjs",".cjs"]}}'),ay=JSON.parse('{"specVersion":1,"id":"code-flaws/regex-redos-backtrack","name":"ReDoS via catastrophic backtracking pattern","category":"code_flaw","severity":"medium","matcher":{"type":"regex","pattern":"\\\\((?:\\\\?:)?(?:\\\\\\\\.|\\\\[[^\\\\]]*\\\\]|[^\\\\\\\\()\\\\[\\\\]+*?|])[+*](?:(?:\\\\\\\\.|\\\\[[^\\\\]]*\\\\]|[^\\\\\\\\()\\\\[\\\\]+*?|])\\\\*)?\\\\)[+*]|\\\\((?:\\\\?:)?([^()|]+)\\\\|\\\\1\\\\)[+*]","flags":"g"},"examples":["/(a+)+/","/(\\\\w+\\\\s*)+/"]}'),az=JSON.parse('{"specVersion":1,"id":"code-flaws/sql-inject-concat-dot","name":"SQL injection via string concatenation (PHP dot operator)","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"[\\"\'][^\\\\n]*?(select|insert|update|delete|drop|where)[^\\\\n]*?[\\"\']\\\\s*\\\\.","flags":"gi"},"appliesTo":{"extensions":[".php"]},"examples":["$query = \\"SELECT * FROM orders WHERE user = \\" . $username;"]}'),aA=JSON.parse('{"specVersion":1,"id":"code-flaws/sql-inject-concat","name":"SQL injection via string concatenation","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"[\\"\']\\\\s*(?:select\\\\b[^\\\\n]*?\\\\bfrom\\\\b|insert\\\\s+into\\\\b|update\\\\s+\\\\S+\\\\s+set\\\\b|delete\\\\s+from\\\\b|drop\\\\s+(?:table|database)\\\\b|where\\\\b[^\\\\n]*?=)[^\\\\n]*?[\\"\']\\\\s*\\\\+","flags":"gi"},"examples":["\\"SELECT * FROM users WHERE id = \\" + userId"]}'),aB=JSON.parse('{"specVersion":1,"id":"code-flaws/sql-inject-format","name":"SQL injection via format string or f-string","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:select\\\\b[^\\\\n]*?\\\\bfrom\\\\b|insert\\\\s+into\\\\b|update\\\\s+\\\\S+\\\\s+set\\\\b|delete\\\\s+from\\\\b|drop\\\\s+(?:table|database)\\\\b|where\\\\b[^\\\\n]*?=)[^\\\\n]*?(?:[%][sd]|\\\\{[^}]+\\\\})","flags":"gi"},"examples":["f\\"SELECT * FROM users WHERE id = {user_id}\\"","\\"SELECT * FROM users WHERE name = \'%s\'\\" % name"]}'),aC=JSON.parse('{"specVersion":1,"id":"code-flaws/sql-inject-interp","name":"SQL injection via Ruby string interpolation or PHP variable","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"(select|insert|update|delete|where)[^\\\\n]*?(#\\\\{|\\\\$[a-z_])","flags":"gi"},"examples":["\\"SELECT * FROM users WHERE id = #{params[:id]}\\"","\\"SELECT * FROM users WHERE id = $userId\\""],"appliesTo":{"extensions":[".rb",".php"]}}'),aD=JSON.parse('{"specVersion":1,"id":"code-flaws/ssrf-user-url","name":"Server-side request forgery via user-controlled URL","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"(fetch|axios\\\\.\\\\w+|requests\\\\.get|urllib\\\\.request\\\\.urlopen)\\\\s*\\\\(\\\\s*(req|request|params|query|body)","flags":"gi"},"examples":["fetch(req.query.url)","requests.get(request.form[\'url\'])"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx",".mjs",".cjs",".py"]}}'),aE=JSON.parse('{"specVersion":1,"id":"code-flaws/xss-dangerously-set","name":"XSS via React dangerouslySetInnerHTML","category":"code_flaw","severity":"high","matcher":{"type":"keyword","keywords":["dangerouslySetInnerHTML"],"caseSensitive":true},"examples":["<div dangerouslySetInnerHTML={{ __html: userContent }} />"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx"]}}'),aF=JSON.parse('{"specVersion":1,"id":"code-flaws/xss-inner-html","name":"XSS via innerHTML assignment","category":"code_flaw","severity":"high","matcher":{"type":"keyword","keywords":["innerHTML =","innerHTML="],"caseSensitive":true},"examples":["element.innerHTML = userInput"],"appliesTo":{"extensions":[".js",".jsx",".ts",".tsx",".mjs",".cjs"]}}'),aG=JSON.parse('{"specVersion":1,"id":"code-flaws/xss-unescaped-render","name":"XSS via unescaped template rendering","category":"code_flaw","severity":"high","matcher":{"type":"regex","pattern":"(\\\\braw\\\\s*\\\\(|\\\\bhtml_safe\\\\b|\\\\|\\\\s*safe\\\\b|\\\\bmark_safe\\\\s*\\\\()","flags":"gi"},"examples":["<%= raw(user_comment) %>","{{ user_input | safe }}","mark_safe(user_html)"],"appliesTo":{"extensions":[".rb",".py"]}}'),aH=JSON.parse('{"specVersion":1,"id":"core-code-context/db-table-name","name":"Internal database table/column name","category":"code_context","severity":"low","matcher":{"type":"keyword","keywords":["SELECT * FROM ","SELECT COUNT(*) FROM ","INSERT INTO ","DELETE FROM ","CREATE TABLE ","ALTER TABLE ","DROP TABLE ","FROM users","FROM orders","FROM employees","FROM customers","FROM accounts","FROM transactions","FROM products","FROM payments"],"caseSensitive":false},"examples":["SELECT * FROM users WHERE id = 1"]}'),aI=JSON.parse('{"specVersion":1,"id":"core-code-context/feature-flag","name":"Feature flag / toggle name","category":"code_context","severity":"low","matcher":{"type":"keyword","keywords":["feature_flag:","feature_toggle:","feature-flag:","feature-toggle:","FF_","FEATURE_FLAG_","FEATURE_TOGGLE_","unleash:","launchdarkly:","split.io:"],"caseSensitive":false},"examples":["feature_flag: new-checkout-flow","FF_ENABLE_DARK_MODE"]}'),aJ=JSON.parse('{"specVersion":1,"id":"core-code-context/file-path","name":"User home / identity-bearing file path","category":"code_context","severity":"low","matcher":{"type":"regex","pattern":"(?:/home|/Users)/[A-Za-z0-9_.@-]+(?:/[A-Za-z0-9_.@+-]+)*|/root(?:/[A-Za-z0-9_.@+-]+)+|[A-Za-z]:\\\\\\\\[Uu]sers\\\\\\\\[A-Za-z0-9_.-]+(?:\\\\\\\\[A-Za-z0-9_.-]+)*","flags":"g"},"examples":["/home/user/.ssh/id_rsa","/Users/jane/projects/acme/secrets.env","C:\\\\Users\\\\admin\\\\config.yml"]}'),aK=JSON.parse('{"specVersion":1,"id":"core-code-context/internal-domain","name":"Internal domain / hostname","category":"code_context","severity":"low","matcher":{"type":"regex","pattern":"(?<![A-Za-z0-9.-])[A-Za-z0-9][A-Za-z0-9.-]{0,251}\\\\.(?:internal|corp|local|lan|intranet|private|dev|staging|test|qa)(?:\\\\.(?:com|net|org|io|co|app))?\\\\b","flags":"gi"},"examples":["db.internal.com","app.corp.local","api.staging.example.com"]}'),aL=JSON.parse('{"specVersion":1,"id":"core-code-context/internal-ip","name":"Internal (RFC 1918) IP address","category":"code_context","severity":"low","matcher":{"type":"regex","pattern":"(?<![\\\\d.])(?:10\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)|192\\\\.168\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\.(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?))(?![\\\\d])","flags":"g"},"examples":["10.0.0.1","192.168.1.1","172.16.0.1"]}'),aM=JSON.parse('{"specVersion":1,"id":"core-code-context/internal-url","name":"Internal environment URL","category":"code_context","severity":"low","matcher":{"type":"keyword","keywords":["https://staging.","https://dev.","https://qa.","https://test.","http://staging.","http://dev.","http://qa.","http://test.",".staging.com",".dev.com",".qa.com","staging.internal","dev.internal"],"caseSensitive":false},"examples":["https://staging.example.com"]}'),aN=JSON.parse('{"specVersion":1,"id":"core-code-context/localhost-ref","name":"Localhost reference","category":"code_context","severity":"low","matcher":{"type":"regex","pattern":"(?<![A-Za-z0-9_])(?:localhost|127\\\\.0\\\\.0\\\\.1|0\\\\.0\\\\.0\\\\.0|(?<![A-Za-z0-9_]\\\\[)::1(?!:|\\\\.[0-9]))(?![A-Za-z0-9_])","flags":"g"},"examples":["localhost","127.0.0.1","0.0.0.0","::1"]}'),aO=JSON.parse('{"specVersion":1,"id":"core-code-context/stack-trace","name":"Stack trace (internal code structure)","category":"code_context","severity":"low","matcher":{"type":"regex","pattern":"(?:^|\\\\s+)at\\\\s+[A-Za-z0-9._$<>]+\\\\.[A-Za-z0-9_$]+\\\\s*\\\\([A-Za-z0-9._\\\\-/:]+:\\\\d+:\\\\d+\\\\)","flags":"g"},"examples":["at com.example.service.UserService.findUser(UserService.java:42:13)"]}'),aP=JSON.parse('{"specVersion":1,"id":"core-financial/credit-card","name":"Credit/debit card number","category":"financial","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12})\\\\b","flags":"g"},"postValidators":["luhn"],"examples":["4111111111111111","5500000000000004"]}'),aQ=JSON.parse('{"specVersion":1,"id":"core-financial/cusip","name":"CUSIP security identifier","category":"financial","severity":"medium","matcher":{"type":"regex","pattern":"\\\\bcusip\\\\b[\\\\s#:=-]{0,8}(\\\\d{3}[A-Z0-9]{2}[A-Z0-9*#@]\\\\d{2}[0-9])\\\\b","flags":"gi","captureGroup":1},"examples":["CUSIP: 037833100","CUSIP 931142103"]}'),aR=JSON.parse('{"specVersion":1,"id":"core-financial/cvv","name":"Card security code (CVV/CVC)","category":"financial","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:CVV|CVC|CID|security\\\\s+code|card\\\\s+code)[:\\\\s]*\\\\d{3,4}\\\\b","flags":"gi"},"examples":["CVV: 123","CVC: 456"]}'),aS=JSON.parse('{"specVersion":1,"id":"core-financial/iban","name":"International Bank Account Number","category":"financial","severity":"high","matcher":{"type":"regex","pattern":"\\\\b[A-Z]{2}\\\\d{2}[A-Z0-9 ]{10,30}\\\\b","flags":"g"},"requiresNearby":{"labels":["iban","bank","account","bic","swift"],"windowChars":160},"examples":["IBAN: GB82 WEST 1234 5698 7654 32","IBAN: DE89 3704 0044 0532 0130 00"]}'),aT=JSON.parse('{"specVersion":1,"id":"core-financial/paypal","name":"PayPal transaction/merchant ID","category":"financial","severity":"medium","matcher":{"type":"regex","pattern":"paypal.{0,30}?\\\\b([A-Z0-9]{17})\\\\b","flags":"gi","captureGroup":1},"examples":["PayPal transaction ID: 9HW7382910ABCDEF1"]}'),aU=JSON.parse('{"specVersion":1,"id":"core-financial/routing-number","name":"US bank routing number (ABA)","category":"financial","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:routing|aba|rtn)\\\\b[\\\\s#:=-]{0,8}(\\\\d{9})\\\\b","flags":"gi","captureGroup":1},"examples":["Routing: 021000021","ABA 111000025"]}'),aV=JSON.parse('{"specVersion":1,"id":"core-financial/salary","name":"Salary/compensation (contextual)","category":"financial","severity":"low","matcher":{"type":"keyword","keywords":["my salary is","my base salary","annual compensation","total comp","my tc is","my package is","i make $","i earn $","offered $"],"caseSensitive":false},"examples":["My salary is $150,000"]}'),aW=JSON.parse('{"specVersion":1,"id":"core-financial/swift","name":"SWIFT/BIC code","category":"financial","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:swift|bic)\\\\b[\\\\s#:=-]{0,8}([A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?)\\\\b","flags":"gi","captureGroup":1},"examples":["SWIFT: BOFAUS3N","BIC: CHASGB2LXXX"]}'),aX=JSON.parse('{"specVersion":1,"id":"core-phi/biometric-ref","name":"Biometric data reference","category":"phi","severity":"high","matcher":{"type":"keyword","keywords":["fingerprint data","fingerprint scan","my iris scan","my retina scan","my biometric","my facial recognition","my voiceprint","my palm print","my hand geometry"],"caseSensitive":false},"examples":["My fingerprint data is stored in the biometric database"]}'),aY=JSON.parse('{"specVersion":1,"id":"core-phi/genetic-data","name":"Genetic/DNA sequence reference","category":"phi","severity":"high","matcher":{"type":"keyword","keywords":["my dna sequence","my genome","my genetic","dna test results","genetic test results","my 23andme","my ancestrydna","gene variant","my genotype","my haplogroup"],"caseSensitive":false},"examples":["My DNA sequence shows a variant in the BRCA1 gene"]}'),aZ=JSON.parse('{"specVersion":1,"id":"core-phi/group-id","name":"Health plan group ID","category":"phi","severity":"high","matcher":{"type":"regex","pattern":"\\\\bgroup\\\\s*(?:id|number|no|#)\\\\s*[:#]?\\\\s*[A-Za-z0-9]{6,20}\\\\b","flags":"gi"},"requiresNearby":{"ruleIds":["core-phi/member-id"],"labels":["member id","subscriber","health plan"],"windowChars":200,"confidenceBoost":0.05},"examples":["Member ID: ABC987654321, Group ID: GRP12345678"]}'),a$=JSON.parse('{"specVersion":1,"id":"core-phi/hipaa-identifier","name":"HIPAA standard identifier (health plan / beneficiary / claim number)","category":"phi","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:health\\\\s+plan|beneficiary|claim\\\\s+number|subscriber)[:\\\\s]*[A-Za-z0-9]{8,20}\\\\b","flags":"gi"},"examples":["Health Plan: XYZ123456789","Beneficiary: ABC987654321"]}'),a_=JSON.parse('{"specVersion":1,"id":"core-phi/icd10-code","name":"ICD-10 diagnosis code","category":"phi","severity":"medium","matcher":{"type":"regex","pattern":"(?:icd[- ]?10|diagnosis|\\\\bdx\\\\b).{0,12}?([A-Z][0-9]{2}(?:\\\\.[0-9]{1,4})?)\\\\b","flags":"gi","captureGroup":1},"examples":["ICD-10: I10","Diagnosis code E11.9","dx: J45.909"]}'),a0=JSON.parse('{"specVersion":1,"id":"core-phi/member-id","name":"Health plan member ID","category":"phi","severity":"high","matcher":{"type":"regex","pattern":"\\\\bmember\\\\s*(?:id|number|no|#)\\\\s*[:#]?\\\\s*[A-Za-z0-9]{6,20}\\\\b","flags":"gi"},"examples":["Member ID: ABC987654321"]}'),a1=JSON.parse('{"specVersion":1,"id":"core-phi/mrn","name":"Medical Record Number","category":"phi","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:MRN|MR#|medical\\\\s+record)[:\\\\s]*[A-Za-z0-9]{6,16}\\\\b","flags":"gi"},"examples":["MRN: 1234567890","Medical Record: ABCD1234"]}'),a2=JSON.parse('{"specVersion":1,"id":"core-phi/ndc-code","name":"National Drug Code (NDC)","category":"phi","severity":"medium","matcher":{"type":"regex","pattern":"\\\\b\\\\d{4,5}-\\\\d{3,4}-\\\\d{1,2}\\\\b","flags":"g"},"examples":["0002-1427-01","68788-6965-1"]}'),a3=JSON.parse('{"specVersion":1,"id":"core-pii/dob","name":"Date of birth","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:(?:19[4-9]\\\\d|20[0-1]\\\\d)[/-]\\\\d{1,2}[/-]\\\\d{1,2}|\\\\d{1,2}[/-]\\\\d{1,2}[/-](?:19[4-9]\\\\d|20[0-1]\\\\d))\\\\b","flags":"g"},"requiresNearby":{"categories":["pii"],"labels":["dob","date of birth","birth","d.o.b"],"windowChars":160},"examples":["DOB: 1985-03-22","Date of birth: 03/22/1985"]}'),a4=JSON.parse('{"specVersion":1,"id":"core-pii/drivers-license-us","name":"US driver\'s license number","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"(?:driver\'?s?\\\\s*licen[sc]e|licen[sc]e|\\\\bDL\\\\b).{0,10}?([A-Z]\\\\d{6,8}|\\\\d{8,9})\\\\b","flags":"gi","captureGroup":1},"examples":["Driver\'s License: D1234567","DL: 123456789"]}'),a5=JSON.parse('{"specVersion":1,"id":"core-pii/email","name":"Email address","category":"pii","severity":"medium","matcher":{"type":"regex","pattern":"(?<![A-Za-z0-9._%+-])[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,255}\\\\.[A-Za-z]{2,24}\\\\b","flags":"g"},"examples":["user@example.com"]}'),a6=JSON.parse('{"specVersion":1,"id":"core-pii/home-address","name":"Home address (contextual)","category":"pii","severity":"medium","matcher":{"type":"keyword","keywords":["my address is","home address","shipping address","billing address","mailing address","my home is at","i reside at"],"caseSensitive":false},"examples":["My address is 123 Main St, Springfield, IL 62701"]}'),a7=JSON.parse('{"specVersion":1,"id":"core-pii/ip-address","name":"IP address","category":"pii","severity":"low","matcher":{"type":"regex","pattern":"\\\\b(?:(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\.){3}(?:25[0-5]|2[0-4]\\\\d|[01]?\\\\d\\\\d?)\\\\b","flags":"g"},"examples":["192.168.1.1","10.0.0.1"]}'),a8=JSON.parse('{"specVersion":1,"id":"core-pii/mac-address","name":"MAC address","category":"pii","severity":"low","matcher":{"type":"regex","pattern":"\\\\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\\\\b","flags":"g"},"examples":["AA:BB:CC:DD:EE:FF"]}'),a9=JSON.parse('{"specVersion":1,"id":"core-pii/name","name":"Personal name (contextual)","category":"pii","severity":"medium","matcher":{"type":"keyword","keywords":["my name is","my full name","i am called","please call me","name:\\n","\\"full_name\\": \\"","\\"fullName\\": \\""],"caseSensitive":false},"examples":["My name is John Doe"]}'),ba=JSON.parse('{"specVersion":1,"id":"core-pii/national-id","name":"National ID number (multi-country)","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"\\\\b[A-Z]{2}\\\\d{6}[A-D]\\\\b|\\\\b[2-9]\\\\d{11}\\\\b|(?:national\\\\s*id|aadhaar|\\\\bSIN\\\\b).{0,10}?\\\\d{3}[\\\\s-]?\\\\d{3}[\\\\s-]?\\\\d{3}\\\\b","flags":"gi"},"requiresNearby":{"labels":["national id","national identity","national insurance","nino","ni","aadhaar","sin","identity number","id number"],"windowChars":160},"examples":["Aadhaar: 234567890123","NI: AB123456C","SIN: 123-456-789"]}'),bb=JSON.parse('{"specVersion":1,"id":"core-pii/passport-us","name":"US passport number","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"\\\\b[A-Z]\\\\d{8}\\\\b","flags":"g"},"requiresNearby":{"labels":["passport"],"windowChars":160},"examples":["Passport: A12345678"]}'),bc=JSON.parse('{"specVersion":1,"id":"core-pii/phone-intl","name":"International phone number","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"\\\\+\\\\d{1,3}(?:[-.\\\\s]\\\\d{1,14}){1,5}\\\\b","flags":"g"},"examples":["+44 20 7946 0958","+86 138 0013 8000"]}'),bd=JSON.parse('{"specVersion":1,"id":"core-pii/phone-us","name":"US phone number","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"(?<!\\\\d)(?:\\\\+?1[-.\\\\s]?)?(?:\\\\([2-9]\\\\d{2}\\\\)[-.\\\\s]?|[2-9]\\\\d{2}[-.\\\\s])\\\\d{3}[-.\\\\s]\\\\d{4}(?!\\\\d)","flags":"g"},"requiresNearby":{"labels":["phone","call","mobile","cell","tel","telephone","contact","fax","dial"],"windowChars":160},"examples":["(555) 123-4567","+1-555-123-4567"]}'),be=JSON.parse('{"specVersion":1,"id":"core-pii/ssn","name":"US Social Security Number","category":"pii","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?!000|666|9\\\\d{2})\\\\d{3}[\\\\s\\\\-](?!00)\\\\d{2}[\\\\s\\\\-](?!0000)\\\\d{4}\\\\b","flags":"g"},"examples":["123-45-6789"]}'),bf=JSON.parse('{"specVersion":1,"id":"core-pii/vin","name":"Vehicle Identification Number","category":"pii","severity":"medium","matcher":{"type":"regex","pattern":"\\\\b[A-HJ-NPR-Z0-9]{17}\\\\b","flags":"g"},"examples":["1HGCM82633A004352"]}'),bg=JSON.parse('{"specVersion":1,"id":"core-pii/zip","name":"US ZIP / ZIP+4 postal code","category":"pii","severity":"low","matcher":{"type":"regex","pattern":"\\\\b\\\\d{5}(?:-\\\\d{4})?\\\\b","flags":"g"},"requiresNearby":{"ruleIds":["core-pii/home-address"],"labels":["address","street","avenue","boulevard","mailing","shipping","billing","suite","p.o. box","po box","postal"],"windowChars":120},"examples":["Shipping address: 123 Main Street, Springfield, IL 94107-1234"]}'),bh=JSON.parse('{"specVersion":1,"id":"secrets-infra/api-key-header","name":"API key in a custom HTTP header","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"[\\"\']?\\\\bapi-?key\\\\b[\\"\']?\\\\s*:\\\\s*[\\"\']?([A-Za-z0-9+/_\\\\-.]{16,500})[\\"\']?","flags":"gi","captureGroup":1},"postValidators":["entropy"],"examples":["X-Api-Key: aBc123XyZ789kLmNoPqRsTuVwXyZ1234567890"]}'),bi=JSON.parse('{"specVersion":1,"id":"secrets-infra/basic-auth-header","name":"HTTP Basic auth Authorization header","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"authorization\\\\s*:\\\\s*basic\\\\s+[A-Za-z0-9+/=]{16,}","flags":"gi"},"examples":["Authorization: Basic dXNlcjpwYXNzd29yZDEyMzQ="]}'),bj=JSON.parse('{"specVersion":1,"id":"secrets-infra/basic-auth-url","name":"URL with embedded basic auth credentials","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"https?://[A-Za-z0-9_%\\\\-]+:[A-Za-z0-9_%\\\\-]+@[A-Za-z0-9.\\\\-]+","flags":"g"},"examples":["https://user:password@example.com/path"]}'),bk=JSON.parse('{"specVersion":1,"id":"secrets-infra/bearer-token","name":"Generic Authorization Bearer token","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"\\\\b(?:Bearer|bearer)\\\\s+([A-Za-z0-9_\\\\-.]{20,500})","flags":"g","captureGroup":1},"postValidators":["entropy"],"examples":["Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"]}'),bl=JSON.parse('{"specVersion":1,"id":"secrets-infra/db-connection-string","name":"Database connection string with credentials","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:postgres(?:ql)?|mysql|mongodb(?:\\\\+srv)?|redis|rediss)://[A-Za-z0-9_%\\\\-]+:[A-Za-z0-9_%\\\\-]+@[A-Za-z0-9.\\\\-]+(?:\\\\:\\\\d+)?","flags":"g"},"examples":["postgresql://user:password@localhost:5432/mydb"]}'),bm=JSON.parse('{"specVersion":1,"id":"secrets-infra/docker-config-auth","name":"Docker config.json auth (base64-encoded)","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\"auth\\"\\\\s*:\\\\s*\\"[A-Za-z0-9+/]{12,}={0,2}\\"","flags":"g"},"examples":["\\"auths\\": {\\"https://index.docker.io/v1/\\": {\\"auth\\": \\"dXNlcjpwYXNzd29yZA==\\"}}"]}'),bn=JSON.parse('{"specVersion":1,"id":"secrets-infra/env-key-value","name":"Environment variable assignment with sensitive key","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"\\\\b[A-Za-z0-9_]*(?:API_KEY|API_SECRET|SECRET_KEY|SECRET|TOKEN|PASSWORD|PASS|CREDENTIALS|PRIVATE_KEY|ENCRYPTION_KEY|SIGNING_KEY)\\\\s*=\\\\s*[\\"\']?([^\\\\s\\"\']{4,})","flags":"gi","captureGroup":1},"examples":["API_KEY=aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890"]}'),bo=JSON.parse('{"specVersion":1,"id":"secrets-infra/generic-high-entropy-secret","name":"Generic high-entropy secret assigned to a credential-shaped field","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"(?<![A-Za-z0-9_-])[A-Za-z0-9_]{0,34}(?:(?:secret|token|passw(?:or)?d|credentials?|(?<!api[_-]?)key)(?:[\\"\']?\\\\s*:|\\\\s+=)|(?:passwd|credential|(?<!api[_-]?)(?<!secret_)(?<!private_)(?<!encryption_)(?<!signing_)key)=)\\\\s*[\\"\']?((?!eyJ)[A-Za-z0-9+/_\\\\-]{20,200})","flags":"gi","captureGroup":1},"postValidators":["entropy"],"examples":["authToken: \\"aBc123XyZ789kLmNoPqRsTuVwXyZ1234567890\\"","MASTER_KEY=aBc123XyZ789kLmNoPqRsTuVwXyZ1234567890"]}'),bp=JSON.parse('{"specVersion":1,"id":"secrets-infra/jwt-token","name":"JSON Web Token (JWT)","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"\\\\beyJ[A-Za-z0-9_\\\\-+/]+\\\\.[A-Za-z0-9_\\\\-+/]+\\\\.[A-Za-z0-9_\\\\-+/]+\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"]}'),bq=JSON.parse('{"specVersion":1,"id":"secrets-infra/kubeconfig-token","name":"Kubernetes kubeconfig embedded token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:client-(?:certificate|key)-data|token):\\\\s+([A-Za-z0-9+/=_.-]{20,})","flags":"g","captureGroup":1},"examples":["token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9..."]}'),br=JSON.parse('{"specVersion":1,"id":"secrets-infra/password-field","name":"JSON/YAML field with password value","category":"secret","severity":"high","matcher":{"type":"regex","pattern":"[\\"\']?\\\\b(?:password|passwd|pwd|pass|secret|token|api[_-]?key|apikey)\\\\b[\\"\']?\\\\s*:\\\\s*[\\"\']([^\\"\'\\\\n]{4,})[\\"\']","flags":"gi","captureGroup":1},"examples":["\\"password\\": \\"supersecret123\\""]}'),bs=JSON.parse('{"specVersion":1,"id":"secrets-infra/pgp-private-key","name":"PGP private key block","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"-----BEGIN PGP PRIVATE KEY BLOCK-----","flags":"g"},"examples":["-----BEGIN PGP PRIVATE KEY BLOCK-----\\nVersion: Keybase Go 1.0.0\\n...\\n-----END PGP PRIVATE KEY BLOCK-----"]}'),bt=JSON.parse('{"specVersion":1,"id":"secrets-infra/ssh-private-key","name":"SSH private key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"-----BEGIN (?:RSA |DSA |EC |OPENSSH |SSH2 )?PRIVATE KEY-----","flags":"g"},"examples":["-----BEGIN RSA PRIVATE KEY-----\\nMIIEpAIBAAKCAQEA...\\n-----END RSA PRIVATE KEY-----"]}'),bu=JSON.parse('{"specVersion":1,"id":"secrets/anthropic-api-key","name":"Anthropic API key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bsk-ant-[A-Za-z0-9_-]{40,}","flags":"g"},"postValidators":["entropy"],"examples":["sk-ant-AbCdEfGhIjKlMnOpQrStUvWxYzAbCdEfGhIjKlMnOpQrStUvWxYz"]}'),bv=JSON.parse('{"specVersion":1,"id":"secrets/aws-access-key","name":"AWS Access Key ID","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(AKIA|ASIA|AROA|AIDA|ANPA|ANVA|APKA)[A-Z0-9]{16}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["AKIAIOSFODNN7EXAMPLE"]}'),bw=JSON.parse('{"specVersion":1,"id":"secrets/aws-secret-key","name":"AWS Secret Access Key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"aws[_.-]?secret[_.-]?(?:access[_.-]?)?key[\\"\'\\\\s:=]{1,5}([A-Za-z0-9/+]{40})","flags":"gi","captureGroup":1},"postValidators":["entropy"],"examples":["AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"]}'),bx=JSON.parse('{"specVersion":1,"id":"secrets/azure-connection-string","name":"Azure connection string","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"(?<![A-Za-z0-9])(?:DefaultEndpointsProtocol|AccountEndpoint|AccountName|AccountKey|SharedAccessSignature|SharedAccessKeyName|SharedAccessKey|EndpointSuffix|BlobEndpoint|QueueEndpoint|TableEndpoint|FileEndpoint|HostName|Endpoint)=(?![{<($])[^\\\\x3B\\\\r\\\\n]{1,400}\\\\x3B(?:[A-Za-z][A-Za-z0-9_]{0,39}=[^\\\\x3B\\\\r\\\\n]{1,400}\\\\x3B){0,10}(?:DefaultEndpointsProtocol|AccountEndpoint|AccountName|AccountKey|SharedAccessSignature|SharedAccessKeyName|SharedAccessKey|EndpointSuffix|BlobEndpoint|QueueEndpoint|TableEndpoint|FileEndpoint|HostName|Endpoint)=(?![{<($])[^\\\\x3B\\\\r\\\\n]{1,400}(?:\\\\x3B[A-Za-z][A-Za-z0-9_]{0,39}=[^\\\\x3B\\\\r\\\\n]{1,400}){0,10}","flags":"g"},"examples":["AccountName=mystorage;AccountKey=abc123=="]}'),by=JSON.parse('{"specVersion":1,"id":"secrets/cloudflare-api-key","name":"Cloudflare API token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"cloudflare.{0,40}?[\\"\'\\\\s:=]([A-Za-z0-9_-]{40})","flags":"gi","captureGroup":1},"postValidators":["entropy"],"examples":["CLOUDFLARE_API_TOKEN=kQ9fL2mP7xR4tY6wB1nC8vD3jH5sZ0aG2eU4iO7p"]}'),bz=JSON.parse('{"specVersion":1,"id":"secrets/datadog-key","name":"Datadog API/Application key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:DD_API_KEY|DD_APP_KEY|DATADOG_API_KEY|DATADOG_APP_KEY)[\\\\s:=]+([A-Za-z0-9]{32,40})\\\\b","flags":"gi","captureGroup":1},"postValidators":["entropy"],"examples":["DD_API_KEY=a3F5g8H1j4K7m2N0p9Q6r1S4t7U0v3W8"]}'),bA=JSON.parse('{"specVersion":1,"id":"secrets/digitalocean-token","name":"DigitalOcean Personal Access Token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bdop_v1_[A-Za-z0-9]{64}\\\\b","flags":"g"},"examples":["dop_v1_1234567890123456789012345678901234567890123456789012345678901234"]}'),bB=JSON.parse('{"specVersion":1,"id":"secrets/discord-token","name":"Discord bot token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b[A-Za-z0-9]{24}\\\\.[A-Za-z0-9]{6}\\\\.[A-Za-z0-9_\\\\-]{27}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["AbCdEfGhIjKlMnOpQrStUvWx.YzAbCd.ABCdEfGhIjKlMnOpQrStUvWxYzAbCdEf"]}'),bC=JSON.parse('{"specVersion":1,"id":"secrets/gcp-service-account","name":"GCP service account key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"(?<![a-z0-9-])[a-z0-9-]{3,}@[a-z0-9][a-z0-9-]{2,60}\\\\.iam\\\\.gserviceaccount\\\\.com\\\\b","flags":"g"},"examples":["deploy-bot@sample-project.iam.gserviceaccount.com","12345678-1234-1234-1234-123456789012@my-project.iam.gserviceaccount.com"]}'),bD=JSON.parse('{"specVersion":1,"id":"secrets/github-pat","name":"GitHub Personal Access Token (classic and fine-grained)","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:gh[psou]_[A-Za-z0-9]{36}|github_pat_[0-9A-Za-z_]{82})\\\\b","flags":"g"},"examples":["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","ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890"]}'),bE=JSON.parse('{"specVersion":1,"id":"secrets/gitlab-token","name":"GitLab Personal/Project Access Token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bglpat-[A-Za-z0-9\\\\-_]{20,40}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["glpat-ABCdEfGhIjKlMnOpQrStUvWxYz1234567890"]}'),bF=JSON.parse('{"specVersion":1,"id":"secrets/heroku-api-key","name":"Heroku API key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"heroku.{0,40}?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})","flags":"gi","captureGroup":1},"examples":["HEROKU_API_KEY=3f8a1c2e-9b4d-4e6f-a1b2-c3d4e5f6a7b8"]}'),bG=JSON.parse('{"specVersion":1,"id":"secrets/npm-token","name":"npm access token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bnpm_[A-Za-z0-9]{36,60}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["npm_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890AbCdEfGhIjKlMnO"]}'),bH=JSON.parse('{"specVersion":1,"id":"secrets/openai-api-key","name":"OpenAI API key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bsk-proj-[A-Za-z0-9]{20,60}\\\\b|\\\\bsk-[A-Za-z0-9]{40,55}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["sk-proj-AbCdEfGhIjKlMnOpQrStUvWxYz1234567890AbCdEfGhIjK"]}'),bI=JSON.parse('{"specVersion":1,"id":"secrets/pulumi-access-token","name":"Pulumi access token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bpul-[A-Za-z0-9]{20,60}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["pul-ABCdEfGhIjKlMnOpQrStUvWxYz1234567890"]}'),bJ=JSON.parse('{"specVersion":1,"id":"secrets/sendgrid-key","name":"SendGrid API key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bSG\\\\.[A-Za-z0-9_\\\\-]{20,60}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["SG.AbCdEfGhIjKlMnOpQrStUvWxYzAbCdEfGhIjKlMnOpQrStUvWxYz"]}'),bK=JSON.parse('{"specVersion":1,"id":"secrets/slack-token","name":"Slack API token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:xox[baprs]-[A-Za-z0-9]{10,60}|xapp-[A-Za-z0-9-]{10,60})\\\\b","flags":"g"},"examples":["xoxb-123456789012-123456789012-ABCdEfGhIjKlMnOpQrStUvWx"]}'),bL=JSON.parse('{"specVersion":1,"id":"secrets/stripe-live-key","name":"Stripe live API key","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:sk|pk|rk)_live_[A-Za-z0-9]{24,40}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["sk_live_aBcDeFgHiJkLmNoPqRsTuVwXyZ"]}'),bM=JSON.parse('{"specVersion":1,"id":"secrets/terraform-cloud-token","name":"Terraform Cloud / TFE user token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b[A-Za-z0-9]{14}\\\\.atlasv1\\\\.[A-Za-z0-9_\\\\-]{60,80}\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["AbCdEfGhIjKlMnOp.atlasv1.XyZ1234567890123456789012345678901234567890123456789012345678901234567890"]}'),bN=[{packId:"code-flaws",name:"Code Security Flaws",version:"0.1.0",rawRules:[aA,az,aB,aC,ai,ag,ah,aF,aE,aG,an,ao,am,at,au,ap,aq,ar,af,ae,aw,av,ak,al,aj,ax,as,aD,ay]},{packId:"core-code-context",name:"Code Context",version:"0.1.0",rawRules:[aL,aN,aK,aJ,aO,aM,aI,aH]},{packId:"core-financial",name:"Financial Information",version:"0.1.0",rawRules:[aP,aS,aU,aW,aR,aQ,aT,aV]},{packId:"core-phi",name:"Protected Health Information",version:"0.1.0",rawRules:[a1,a$,a0,aZ,a_,a2,aY,aX]},{packId:"core-pii",name:"Core PII",version:"0.2.0",rawRules:[a5,be,bd,bc,a7,a3,a4,bb,a6,a9,bf,a8,ba,bg]},{packId:"secrets",name:"Secrets & Credentials",version:"0.1.0",rawRules:[bv,bw,bC,bx,bH,bu,bL,bK,bB,bJ,JSON.parse('{"specVersion":1,"id":"secrets/twilio-key","name":"Twilio Account SID","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\bAC[A-Za-z0-9]{32}\\\\b","flags":"g"},"examples":["AC12345678901234567890123456789012"]}'),bE,bA,bz,bG,bF,by,bI,bM,JSON.parse('{"specVersion":1,"id":"secrets/vault-token","name":"HashiCorp Vault token","category":"secret","severity":"critical","matcher":{"type":"regex","pattern":"\\\\b(?:hvs\\\\.[A-Za-z0-9\\\\-_]{20,50}|s\\\\.[A-Za-z0-9\\\\-_]{20,50})\\\\b","flags":"g"},"postValidators":["entropy"],"examples":["hvs.AbCdEfGhIjKlMnOpQrStUvWxYz1234567890"]}'),bD]},{packId:"secrets-infra",name:"Infrastructure Secrets",version:"0.1.0",rawRules:[bt,bl,bp,bj,bi,bs,bk,bn,br,bm,bq,bh,bo]}];function bO(a){try{let b=bR(a);if(!b)return;let c=bS(b),d=c?.headRoot??b,e=c?function(a){let b=bT(a.configPath);if(void 0===b)return;let c=function(a){let b,c={};for(let d of a.split("\n")){let a=d.trim(),e=/^\[remote "([^"]+)"\]$/.exec(a);if(e){b=e[1];continue}if(a.startsWith("[")){b=void 0;continue}if(b&&!(b in c)){let d=/^url\s*=\s*(.+)$/.exec(a)?.[1];d&&(c[b]=d.trim())}}return c}(b);return c.origin??Object.values(c)[0]}(c):void 0;return{url:e??d.split(u.sep).join("/"),name:(e?function(a){let b=a.replace(/\.git$/,"").split(/[/:]/).filter(Boolean).pop();return b&&b.length>0?b:void 0}(e):void 0)??(0,u.basename)(d)}}catch{return}}function bP(a){try{return bR(a)}catch{return}}function bQ(a){try{let b=bR(a);if(!b)return;return bS(b)?.headRoot??b}catch{return}}function bR(a){let b=a;for(;;){if((0,t.existsSync)((0,u.join)(b,".git")))return b;let a=(0,u.dirname)(b);if(a===b)return;b=a}}function bS(a){let b=(0,u.join)(a,".git");try{if((0,t.statSync)(b).isDirectory())return{configPath:(0,u.join)(b,"config"),headRoot:a}}catch{return}let c=/^gitdir:\s*(.+?)\s*$/m.exec(bT(b)??"")?.[1];if(!c)return;let d=(0,u.isAbsolute)(c)?c:(0,u.join)(a,c);if((0,t.existsSync)((0,u.join)(d,"config")))return{configPath:(0,u.join)(d,"config"),headRoot:a};let e=bT((0,u.join)(d,"commondir"))?.trim();if(!e)return;let f=(0,u.isAbsolute)(e)?e:(0,u.join)(d,e),g=".git"===(0,u.basename)(f)?(0,u.dirname)(f):a;return{configPath:(0,u.join)(f,"config"),headRoot:g}}function bT(a){try{return(0,t.readFileSync)(a,"utf8")}catch{return}}var bU=c(75919);function bV(a){return a instanceof Error?a.message:String(a)}function bW(a,b={}){let c,d,f,g,h=b.budgetMs??2e3,i=b.probeBudgetMs??1e3,j=b.startBudgetMs??5e3,k=b.minAttributionMs??500,l=!1,m=1,n=new Set,o=Promise.resolve();function p(){let a=g;if(a)return g=void 0,void 0!==a.startupTimer&&clearTimeout(a.startupTimer),void 0!==a.timer&&clearTimeout(a.timer),c?.unref(),a}function q(a){p()?.fail(a)}function r(a){c===a&&(c=void 0),d===a&&(d=void 0);let b=a.terminate().catch(()=>void 0);n.add(b),b.finally(()=>n.delete(b))}function s(a){void 0!==a.startupTimer&&(clearTimeout(a.startupTimer),a.startupTimer=void 0),void 0===a.timer&&(a.startedAt=performance.now(),a.progressAt=a.startedAt,a.timer=setTimeout(()=>{!function(a){if(g!==a)return;let b=performance.now(),c=b-a.progressAt,d=b-a.startedAt,e=a.progressIndex>=0&&c>=k&&c>=.5*d?a.progressIndex:void 0;r(a.worker),q({status:"timeout",culpritIndex:e,elapsedMs:d})}(a)},a.budgetMs))}function u(h,i){if(l)return void i({status:"unavailable",reason:"the scan worker is closed"});if(void 0!==f)return void i({status:"unavailable",reason:`the scan worker crashed: ${f}`});let k=function(){let h;if(c)return c;let i=b.workerUrl??function(){if(void 0!==e)return e??void 0;for(let a of["scan-worker.js","scan-worker.ts"]){let b=new URL(a,"file:///home/runner/work/ai-tc/ai-tc/packages/plugin-sdk/src/isolated-scan.ts");try{if((0,t.existsSync)((0,v.fileURLToPath)(b)))return e=b,b}catch{}}e=null}();if(!i)return{error:"the scan worker script was not found next to this bundle"};try{h=new bU.Worker(i,{workerData:a})}catch(a){return{error:`could not start the scan worker: ${bV(a)}`}}return b.onWorkerStart?.(h.threadId),h.on("message",a=>{if(c!==h)return;if("ready"===a.kind){d=h,g?.worker===h&&s(g);return}if("progress"===a.kind){g?.worker===h&&(g.progressIndex=a.index,g.progressAt=performance.now());return}if(g?.id!==a.id)return;if("failed"===a.kind)return void q({status:"unavailable",reason:`the scan worker failed: ${a.message}`});let b=p();b&&!b.reply(a)&&b.fail({status:"unavailable",reason:"the scan worker answered the wrong job"})}),h.on("error",a=>{c===h&&(f=bV(a),c=void 0,d===h&&(d=void 0),q({status:"unavailable",reason:`the scan worker crashed: ${f}`}))}),h.on("exit",()=>{c===h&&(f??="the scan worker exited before answering",c=void 0,d===h&&(d=void 0),q({status:"unavailable",reason:"the scan worker exited before answering"}))}),h.unref(),c=h,h}();if(!(k instanceof bU.Worker)){f=k.error,i({status:"unavailable",reason:k.error});return}let n=m++,o=performance.now(),u={id:n,worker:k,budgetMs:h.budgetMs,startedAt:o,progressIndex:-1,progressAt:o,startupTimer:void 0,timer:void 0,reply:h.reply,fail:i};g=u,k.ref(),d===k?s(u):u.startupTimer=setTimeout(()=>{g===u&&(r(u.worker),q({status:"unavailable",reason:`the scan worker did not start within ${String(j)}ms`}))},j);try{k.postMessage(h.build(n))}catch(a){q({status:"unavailable",reason:`could not reach the scan worker: ${bV(a)}`})}}function w(a){let b=o.then(()=>new Promise(b=>{a(b)}));return o=b.then(()=>void 0,()=>void 0),b}return{scan:(a,b,c)=>w(d=>{u({budgetMs:h,build:d=>({kind:"scan",id:d,text:a,filePath:b?.filePath,attribute:c?.attribute===!0}),reply:a=>"result"===a.kind&&(d({status:"ok",findings:a.findings}),!0)},d)}),probe:a=>w(b=>{u({budgetMs:i,build:b=>({kind:"probe",id:b,rule:a}),reply:a=>"probed"===a.kind&&(b({status:"ok",verdict:a.verdict,worstMs:a.worstMs,corroboratedMs:a.corroboratedMs}),!0)},b)}),async close(){l=!0;let a=c;c=void 0,d=void 0,q({status:"unavailable",reason:"the scan worker is closed"}),a&&r(a),await Promise.all([...n])}}}function bX(){let a="function"==typeof process.threadCpuUsage?process.threadCpuUsage():process.cpuUsage();return(a.user+a.system)/1e3}function bY(a){if("regex"===a.matcher.type){var b;return b=`${a.matcher.pattern} ${a.matcher.flags}`,(0,W.createHash)("sha256").update(b).digest("hex")}}function bZ(a,b,c,d){process.stderr.write(`[aka] ${b} rule "${a.id}": ${c}${d?" (clear it with `aka detections unquarantine`)":""}
+`)}function b$(a,b,c){bZ(a,"quarantined",Number.isFinite(b)?`regex matcher exceeded the ReDoS timing budget (${b.toFixed(1)}ms); excluded from this scan.`:"the timing battery failed while measuring its regex matcher; excluded from this scan.",c)}async function b_(a,b,c,d){let e=bY(b),f=!1;if(void 0!==e)try{await a.setRuleProbeVerdict(e,"quarantined",c),f=!0}catch{}bZ(b,"quarantined",d,f)}async function b0(a,b,c){var d,e;let f=c?.passBudgetMs??2e3,g=c?.prober,h=performance.now(),i=[],j=new Map;try{for(let c of a){let a,k,l,m=bY(c);if(void 0===m){i.push(c);continue}try{a=await b.getRuleProbeVerdict(m)}catch{a=void 0}if(a){"safe"===a.verdict?i.push(c):b$(c,a.worstProbeMs,!0);continue}if(performance.now()-h>=f){bZ(c,"skipped","the timing pre-flight ran out of time before this rule could be measured; excluded for the rest of this run, and measured again next time.",!1);continue}let n=0;if(g){let a=await g.probe(c);if("unavailable"===a.status){j.set(a.reason,(j.get(a.reason)??0)+1);continue}k="ok"===a.status?a.verdict:"over-budget",l="ok"===a.status?a.worstMs:a.elapsedMs,"ok"===a.status&&(n=a.corroboratedMs)}else try{({verdict:k,worstMs:l,corroboratedMs:n}=(0,_.r4)(c,bX))}catch{k="over-budget",l=1/0}if("uncorroborated"===k){d=l,e=n,bZ(c,"deferred",`its regex matcher ran past the ReDoS timing budget (${d.toFixed(1)}ms) but spent only ${e.toFixed(1)}ms of CPU doing it, which is a busy machine rather than a slow pattern; excluded from this run and measured again next time, with nothing recorded against it.`,!1);continue}let o="safe"===k,p=!1;try{await b.setRuleProbeVerdict(m,o?"safe":"quarantined",l),p=!0}catch{}o?i.push(c):b$(c,l,p)}}finally{for(let[a,b]of j)process.stderr.write(`[aka] ${String(b)} pulled/custom-pack rule(s) could not be time-checked: ${a}. That is a problem with this install, not with the rules — until it is fixed they are excluded from every scan on this machine. Nothing was quarantined, so reinstalling AKA brings them straight back.
+`)}return i}function b1(a,b,c){process.stderr.write(`[aka] isolated scanning is off for ${a}: ${c}. ${String(b)} pulled/custom-pack rule(s) are excluded; the built-in packs still run.
+`)}let b2={ModelSwitch:"model-switch",VaultPointerDisplay:"vault-pointer-display"};b2.ModelSwitch,b2.VaultPointerDisplay;var b3=c(35653),b4=c.n(b3);function b5(a,b,c){try{return{matcher:b4()().add((0,t.readFileSync)((0,u.join)(a,b),"utf8")),anchorLen:c}}catch{return}}function b6(a,b,c,d){let e=d?"/":"";for(let d=a.length-1;d>=0;d--){var f;let g=a[d];if(void 0===g)continue;let h=g.matcher.test((f=g.anchorLen,(f===b.length?c:`${b.slice(0===f?0:f+1)}/${c}`)+e));if(h.ignored)return"ignored";if(h.unignored)return"unignored"}return"unmatched"}function b7(a,b){return""===a?b:`${a}/${b}`}function b8(a,b){return b?[...a,b]:a}function b9(a){return a.split(u.sep).join("/")}let ca=new Set([".git","node_modules",".pnpm-store",".venv","venv","__pycache__",".next",".turbo","dist","build","out","coverage","target",".cache"]),cb={maxDepth:64,budgetMs:4e3};function cc(a,b,c,d){return"ignored"===b6(a,b,c,d)}let cd=new Set(["pnpm-lock.yaml","package-lock.json","yarn.lock","cargo.lock","poetry.lock","gemfile.lock","composer.lock","go.sum"]),ce=new Set([".yml",".yaml",".toml",".ini",".properties",".conf"]),cf=new Set([".md",".mdx",".rst",".adoc",".txt"]),cg=new Set(["cmakelists.txt","constraints.txt","robots.txt"]),ch=new Set([".csv",".tsv",".parquet",".sql",".jsonl",".ndjson"]),ci=new Set(["package.json","dockerfile","makefile","justfile",".gitignore",".gitattributes",".npmrc",".nvmrc",".editorconfig",".akaignore"]),cj=ab.vk(a=>{if("string"!=typeof a||""!==a.trim())return a},ab.Yj().optional()).catch(void 0),ck=ab.vk(a=>{if("string"!=typeof a)return!1;let b=a.trim().toLowerCase();return""!==b&&"0"!==b&&"false"!==b},ab.zM()).catch(!1);ab.Ik({GOOGLE_GENAI_USE_VERTEXAI:ck,GOOGLE_GEMINI_BASE_URL:cj});let cl=ab.vk(a=>{if("string"!=typeof a||""!==a.trim())return a},ab.Yj().optional()).catch(void 0);function cm(a,b,c,d=(0,aa.tI)()){try{let e,f,g,h;if(!(0,aa.xR)(d).dataSharesInPlace)return null;let i=(0,u.resolve)(b),j=(0,t.statSync)(i).isDirectory()?i:(0,u.dirname)(i),k=bO(i),l=bP(i);k&&l?(e=l,f=`git:${k.url}`,g=k.name,h=a.sourceProject.upsert({url:k.url,name:k.name,attributes:{}})):({root:e,projectKey:f,project:g}=function(a,b){let c=function(a,b){let c=a,d=null;for(let a=0;a<40;a+=1){(function(a,b){try{for(let c of(0,t.readdirSync)(a,{withFileTypes:!0}))if(c.isFile()&&null!=b(c.name))return!0}catch{}return!1})(c,b)&&(d=c);let a=(0,u.dirname)(c);if(a===c)break;c=a}return d??a}(a,b),d=(0,t.realpathSync)(c);return{root:c,projectKey:`path:${d}`,project:(0,u.basename)(d)}}(j,_.DK),h=null);let m=[];for(let a of c.files){let b=b9((0,u.relative)(e,a.file));!(""===b||b.startsWith("../"))&&(b.startsWith(".")||b.includes("/.")||m.push({...a,file:b,vendored:(0,_.$1)(b)}))}let n={projectKey:f,project:g,projectId:h,reconcile:{mode:"walk",walkedPrefix:b9((0,u.relative)(e,i))},hits:(0,_.Ip)(m)};return{...a.shares.recordProjectEgress(n),project:n.project,input:n}}catch{return null}}function cn(a){try{return t.realpathSync.native(a)}catch{return(0,u.resolve)(a)}}function co(a,b){return b.some(b=>a===b||a.startsWith(b+u.sep))}ab.Ik({OPENAI_BASE_URL:cl});let cp="AKA_PROTECTED_SCAN_TARGET";class cq extends Error{constructor(a){super(`refusing to scan ${a}: it holds credentials this scanner must never read`),this.code=cp,this.name="ProtectedTargetError",this.path=a}}function cr(a){return"object"==typeof a&&null!==a&&a.code===cp}let cs=new Set(["node_modules",".git","dist",".next","coverage",".turbo","build","out"]);async function ct(a,b,c={}){let d,e=c.scanText??(a=>Promise.resolve((0,_.SQ)(a,c.rules))),f=0,g=0,i=[],j=[];for(let{path:k,gitignored:l}of function*(a,b={}){let c,d=function(a,b){let c=(0,u.basename)((0,aa.tI)());return[...new Set([(0,u.resolve)(a,".claude","ide"),(0,u.resolve)(a,".claude",".credentials.json"),(0,u.resolve)(a,".codex","auth.json"),(0,u.resolve)(b),(0,aa.tI)(),(0,u.resolve)(a,c)].map(cn))]}(b.home??(0,h.homedir)(),b.akaHome??(0,aa.tI)()),e=cn(a);try{c=(0,t.statSync)(a)}catch{return}if(co(e,d))throw new cq(a);if(c.isFile()){c.size<=1e6&&(yield{path:a,gitignored:!1});return}c.isDirectory()&&(yield*function* a(b,c,d,e,f,g,h){let i;try{i=(0,t.readdirSync)(b,{withFileTypes:!0})}catch(a){if(""===d)throw a;return}let j=b8(e,g?void 0:b5(b,".gitignore",d.length)),k=b8(f,b5(b,".akaignore",d.length));for(let e of i){let f=(0,u.join)(b,e.name),i=c===b?f:(0,u.join)(c,e.name);if(e.isDirectory()){if(co(i,h))continue;let b=b6(k,d,e.name,!0);if("unignored"!==b&&(cs.has(e.name)||e.name.startsWith(".")||"ignored"===b))continue;let c=g||"ignored"===b6(j,d,e.name,!0);yield*a(f,i,b7(d,e.name),j,k,c,h)}else if(e.isFile()){let a;if(co(i,h)||"ignored"===b6(k,d,e.name,!1))continue;try{a=(0,t.statSync)(f).size}catch{continue}if(a>1e6)continue;yield{path:f,gitignored:g||"ignored"===b6(j,d,e.name,!1)}}}}(a,e,"",[],[],!1,d))}((0,u.resolve)(b),{akaHome:c.akaHome})){let b;try{b=(0,t.readFileSync)(k,"utf8")}catch{continue}f++;let h=function(a,b){if(b.includes("\0"))return null;let c=(0,u.basename)(a);if(_.mu.has(c))return null;let d=(0,_.DK)(c),e=null===d?[]:(0,_.W$)(b,d),f=null===d&&_.Nc.has((0,u.extname)(a))?(0,_.Pb)(b):[];return 0===f.length&&0===e.length?null:{file:a,vendored:(0,_.$1)(b9(a)),endpoints:f,sdkHits:e}}(k,b);h&&j.push(h);let m=(0,_.KD)(b),n=(0,_.uT)(await e(m.text),m.spans);if(0===n.length)continue;let o=n.map(a=>({match:a,action:c.ruleActions?.get(a.ruleId)??w.unw[a.category]})),p=o.filter(({action:a})=>(0,w.T2I)(a,"redact")),q=(0,W.randomUUID)(),r={filePath:k};l&&(r.gitignored=!0);let s={id:q,sourceTool:c.sourceTool??w.Zdp.Cli,kind:"code_change",occurredAt:new Date().toISOString(),contentHash:(0,W.createHash)("sha256").update(b).digest("hex"),content:(0,_.E$)(b,p.map(({match:a})=>a)),metadata:r},v=o.map(({match:a,action:b})=>{let e=(0,_.sE)(a.rawMatch),f=function(){if(void 0===d)try{d=c.dataDir?(0,aa.Rd)(c.dataDir):null}catch{d=null}return d}(),g=f?(0,aa._2)(f,a.rawMatch):e;return{id:(0,W.randomUUID)(),eventId:q,ruleId:a.ruleId,category:a.category,severity:a.severity,span:a.span,maskedMatch:e,actionTaken:b,confidence:a.confidence,findingKey:(0,aa.Qo)({ruleId:a.ruleId,filePath:k,valueFingerprint:g})}});a.recordCapture(s,v),i.push({path:k,gitignored:l,findings:v}),g+=v.length}return{scanned:f,findings:g,files:i,egress:{files:j}}}let cu={status:"unavailable",reason:"this build shipped without its scan worker, so there was nowhere killable to measure them"};async function cv(a,b,c={}){let e,g={getRuleProbeVerdict:b=>Promise.resolve(a.ruleProbeCache.getVerdict(b)),setRuleProbeVerdict:(b,c,d)=>(a.ruleProbeCache.setVerdict(b,c,d),Promise.resolve())},h=c.workerUrl,i={workerUrl:h,budgetMs:c.budgetMs,probeBudgetMs:c.probeBudgetMs,startBudgetMs:c.startBudgetMs,onWorkerStart:c.onWorkerStart,minAttributionMs:void 0},j=f??=new Set((d??=bN.map(a=>({namespace:"aka",packId:a.packId,version:a.version,name:a.name,rules:a.rawRules.map(a=>w.jON.parse(a))}))).flatMap(a=>a.rules).map(bY).filter(a=>void 0!==a)),k=[],l=[];for(let a of b){let b=bY(a);void 0!==b&&j.has(b)?k.push(a):l.push(a)}let m=await b0(l,g,{passBudgetMs:c.passBudgetMs,prober:{probe:a=>void 0===h?Promise.resolve(cu):(e??=bW({verified:[],unverified:[]},i)).probe(a)}});await e?.close();let n=new Set(m),o=0,p=0;for(let a of l){let b;if(n.has(a))continue;let c=bY(a);try{b=void 0===c?void 0:(await g.getRuleProbeVerdict(c))?.verdict}catch{b=void 0}"quarantined"===b?o++:p++}let q=[...k],r=[],s=0;for(let a of m)"regex"!==a.matcher.type?q.push(a):void 0!==h?r.push(a):s++;let t=function(a,b,c){let d=c?.degradeScope??"the rest of this process",e=a.verified,f=a.unverified,g=f.length>0?bW({verified:e,unverified:f},c):void 0,h=!1;async function i(){let a=g;g=void 0,f=[],a&&await a.close()}async function j(){h=!0,await i()}async function k(a,b,c,d){try{return await a.scan(b,c,{attribute:d})}catch(a){return{status:"unavailable",reason:a instanceof Error?a.message:"the scan worker failed unexpectedly"}}}return{scan:async function(a,c){let h=g;if(!h)return(0,_.SQ)(a,e,c);let i=await k(h,a,c,!1);if("ok"===i.status)return i.findings;"timeout"===i.status&&(i=await k(h,a,c,!0));let l=f.length;if("ok"===i.status){b1(d,l,"a scan overran its bound once and no rule could be held responsible");let a=i.findings;return await j(),a}if("timeout"===i.status){let a=void 0===i.culpritIndex?void 0:f[i.culpritIndex];a&&await b_(b,a,i.elapsedMs,`it did not finish within the ${i.elapsedMs.toFixed(0)}ms isolated-scan bound and was terminated; excluded from every later scan.`),b1(d,l,a?`rule "${a.id}" had to be terminated mid-scan`:`a scan was terminated at the ${i.elapsedMs.toFixed(0)}ms bound and no single rule could be held responsible, so nothing was quarantined and the next process will try these rules again`)}else b1(d,l,i.reason);return await j(),(0,_.SQ)(a,e,c)},degraded:()=>h,async close(){await i()}}}({verified:q,unverified:r},g,{...i,degradeScope:"the rest of this scan"});return p+=s,{scanText:a=>t.scan(a),dropped:()=>({quarantined:o,unmeasured:p,bound:t.degraded()?r.length:0,isolated:void 0!==h}),close:()=>t.close()}}function cw(a,b){try{let c=(0,u.resolve)(b);(0,t.statSync)(c);let d=bO(c);if(!d)return null;let e=a.sourceProject.upsert({url:d.url,name:d.name,attributes:{}}),f=function(a,b={}){let c=b.bounds??cb,d=b.now??(()=>performance.now());try{let b=bP(a);if(!b)return;let e=bQ(a)!==b,f=[],g={lostSubtree:!1,omitted:!1,seen:0},h=d()+c.budgetMs,i=function a(b,e,i,j){let k;try{k=(0,t.readdirSync)(b,{withFileTypes:!0,encoding:"utf8"})}catch{return g.lostSubtree=!0,!1}if(d()>h)return g.omitted=!0,!0;let l=b8(i,b5(b,".gitignore",e.length));for(let i of k){if(g.seen++,g.seen%512==0&&d()>h)return g.omitted=!0,!0;if(i.isDirectory()){if(ca.has(i.name)||cc(l,e,i.name,!0))continue;let d=(0,u.join)(b,i.name);if((0,t.existsSync)((0,u.join)(d,".git")))continue;if(j>=c.maxDepth){g.omitted=!0;continue}if(a(d,b7(e,i.name),l,j+1))return!0;continue}if(!i.isFile()||".git"===i.name||cc(l,e,i.name,!1))continue;if(f.length>=2e4)return!0;let k=b7(e,i.name);f.push({path:k,name:(0,u.basename)(i.name),origin:function(a,b){let c=b.toLowerCase(),d=c.lastIndexOf("."),e=d>0?c.slice(d):"",f=a.split("/");return cd.has(c)||c.includes(".generated.")||f.includes("__generated__")||f.includes("generated")||".map"===e||c.endsWith(".min.js")||c.endsWith(".min.css")?"generated":f.includes("vendor")||f.includes("third_party")?"vendored":cg.has(c)||".txt"===e&&c.startsWith("requirements")?"config":cf.has(e)||c.startsWith("license")||"docs"===f[0]?"docs":ch.has(e)||f.includes("fixtures")||f.includes("__fixtures__")?"data":ci.has(c)||ce.has(e)||c.startsWith(".")||c.includes(".config.")||c.startsWith("tsconfig")?"config":"source"}(k,i.name),defaultAccess:"approved"})}return!1}(b,"",[],0)||g.lostSubtree||g.omitted||e;if(0===f.length)return;return f.sort((a,b)=>a.path.localeCompare(b.path)),{files:f,truncated:i,scannedAt:new Date().toISOString()}}catch{return}}(c);f&&a.recordProjectFiles(e,f);let g=bQ(c),h=bP(c);return g&&h&&a.reconcileWorktreeProjects(e,g,h),{projectId:e,name:d.name,url:d.url,fileCount:f?.files.length??0,truncated:f?.truncated??!1}}catch{return null}}let cx={unauthorized:"key rejected; re-attach with a valid plugin key",forbidden:"key is valid but not permitted for Data Shares ingest; a key minted before Data Shares ingest existed needs a re-attach, otherwise ask your org admin","route-absent":"the deployment predates Data Shares ingest; upgrade it, then re-run the scan","invalid-request":"this build assembled a request the contract refuses; please report it",rejected:"the deployment refused the request body; this build and the deployment are out of step — upgrade one of them",unreachable:"control plane unreachable (timeout or server error); the next scan retries"};async function cy(a,b,c){let d=null;try{let e=(0,aa.xR)(a),f=e.controlPlane;if(!(0,w.lgf)(e)||void 0===f)return{status:"not-attached"};let g=(0,w.F$B)(f);if(d=g,!1===c.enabled)return{status:"disabled",endpoint:g,reason:"opt-out"};if(!e.dataSharesInPlace)return{status:"disabled",endpoint:g,reason:"data-shares-off"};let h=(0,aa.R8)((0,aa.VL)(a),f);if(null===h)return{status:"no-credential",endpoint:g};let i=(0,aa.Yf)(b),j=await c.send({endpoint:f.endpoint,apiKey:h.apiKey},i);return j.ok?{status:"forwarded",endpoint:g,callSites:i.hits.length}:{status:"failed",endpoint:g,kind:j.kind}}catch{return null===d?{status:"not-attached"}:{status:"failed",endpoint:d,kind:"unreachable"}}}function cz(a){return(0,u.join)((0,aa.KS)(a),"update-check.json")}function cA(a){try{(0,t.rmSync)(cz(a),{force:!0})}catch{}}function cB(a){let b=function(a){let b=cz(a);if(!(0,t.existsSync)(b))return null;try{let a=JSON.parse((0,t.readFileSync)(b,"utf8"));if(!D(a)||"number"!=typeof a.checkedAt||!D(a.report))return null;return a}catch{return null}}(a);var c={checkedAt:Date.now(),report:function(a){let b=a.viewVersion(C),c=[{id:"cli",name:"aka CLI",kind:"cli",installed:a.cliInstalled,latest:b,updateAvailable:null!==a.cliInstalled&&null!==b&&B(b,a.cliInstalled)>0}],d=[];for(let b of x){let e=y(b);if(!e||!b.npmPackage)continue;let f=a.viewVersion(b.npmPackage),g=a.installed.get(e)??null;if(null===g){d.push({id:b.id,name:b.name,latest:f});continue}c.push({id:b.id,name:b.name,kind:"plugin",installed:g,latest:f,updateAvailable:null!==f&&B(f,g)>0})}return{statuses:c,availablePlugins:d}}({viewVersion:E,installed:new Map([...function(a=(0,u.join)((0,h.homedir)(),".claude")){let b,c=new Map,d=(0,u.join)(a,"plugins","installed_plugins.json");if(!(0,t.existsSync)(d))return c;try{b=JSON.parse((0,t.readFileSync)(d,"utf8"))}catch{return c}if(!D(b)||!D(b.plugins))return c;for(let[a,d]of Object.entries(b.plugins)){if(!Array.isArray(d)||0===d.length)continue;let b=d.find(a=>D(a)&&"user"===a.scope)??d.find(a=>D(a));b&&"string"==typeof b.version&&c.set(a,b.version)}return c}(void 0),...function(a=(0,u.join)((0,h.homedir)(),".codex")){let b=new Map,c=(0,u.join)(a,"plugins","cache");for(let a of x){if("codex"!==a.cliBin)continue;let d=y(a);if(!d||!a.pluginName||!a.marketplace)continue;let e=function(a){let b;try{b=(0,t.readdirSync)(a,{withFileTypes:!0}).filter(a=>a.isDirectory()).map(a=>a.name)}catch{return null}if(0===b.length)return null;if(b.includes("local"))return"local";let c=b.filter(A);return 0===c.length?null:c.reduce((a,b)=>B(b,a)>0?b:a)}((0,u.join)(c,a.marketplace,a.pluginName));null!==e&&b.set(d,e)}return b}(void 0)]),cliInstalled:function(a){let b=(void 0)??(0,u.dirname)((0,v.fileURLToPath)("file:///home/runner/work/ai-tc/ai-tc/packages/local-ops/src/updates.ts"));for(let a=0;a<6;a++){let a=(0,u.join)(b,"package.json");if((0,t.existsSync)(a))try{let b=JSON.parse((0,t.readFileSync)(a,"utf8"));if(D(b)&&b.name===C&&"string"==typeof b.version)return b.version}catch{}let c=(0,u.dirname)(b);if(c===b)break;b=c}return null}()}),notifiedPluginIds:b?.notifiedPluginIds??[]};if((0,t.existsSync)((0,aa.KS)(a)))try{(0,aa.g5)(cz(a),`${JSON.stringify(c,null,2)}
+`)}catch{}}}};