agent-threat-rules 3.5.11 → 4.0.0

package/dist/cli/scan-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan-handler.js","sourceRoot":"","sources":["../../src/cli/scan-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3E,MAAM,cAAc,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAEvF,cAAc;AACd,MAAM,GAAG,GAAG,UAAU,CAAC;AACvB,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,GAAG,GAAG,SAAS,CAAC;AACtB,MAAM,IAAI,GAAG,SAAS,CAAC;AACvB,MAAM,KAAK,GAAG,SAAS,CAAC;AAExB,MAAM,eAAe,GAA2B;IAC9C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,UAAU;IAClB,GAAG,EAAE,UAAU;IACf,aAAa,EAAE,UAAU;CAC1B,CAAC;AAmBF,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC/C,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/C,wCAAwC;IACxC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CAC3D,CAAC;QACF,IAAI,KAAK;YAAE,OAAO,OAAO,CAAC;QAC1B,IAAI,OAAO;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,OAAO,CAAC,CAAC,gDAAgD;IAClE,CAAC;IAED,2CAA2C;IAC3C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,KAAK,CACb,mCAAmC,UAAU,wDAAwD,CACtG,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,QAAgB,EAChB,OAAoB;IAEpB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0DAA0D,KAAK,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,uEAAuE;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,KAAK,KAAK;QAC9C,CAAC,CAAC,gBAAgB,CAAC;YACf,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,cAAc,GAAG,CAAC,OAAO,GAAG,KAAK,EAAE,CAAC;SAC3E,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qEAAqE,KAAK,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAuC,CAAC,EAAE,CAAC;QAC9G,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oCAAoC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;IAElE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,QAAQ,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,qCAAqC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,0CAA0C,OAAO,CAAC,KAAK,IAAI,wBAAwB,GAAG,KAAK,EAAE,CAAC,CAAC;YACnH,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,kEAAkE;AAElE,KAAK,UAAU,aAAa,CAC1B,UAAkB,EAClB,QAAgB,EAChB,OAAoB,EACpB,QAA8C;IAE9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,wCAAwC,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACpF,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACzB,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oDAAoD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CACnC,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAkC,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAuC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,UAAU,GAA2E,EAAE,CAAC;IAC9F,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,SAAS,CAAC,wBAAwB;QACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO;YAC7B,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CACzD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7C,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC;YAChC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC;YAChG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,YAAY,GAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,GAAG,MAAM;YACT,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,QAAQ,CAAC,MAAM;SAC9B,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,MAAM,CAAC,MAAM;YAC7B,gBAAgB,EAAE,YAAY;YAC9B,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACnC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxD,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,KAAK,EAAE;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAC7C;gBACD,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;aACvC,CAAC,CAAC;SACJ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;IAE3E,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,uBAAuB,KAAK,IAAI,CAAC,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,UAAU,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,WAAW,KAAK,CAAC,IAAI,MAAM,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,UAAU,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kEAAkE;AAElE,KAAK,UAAU,cAAc,CAC3B,UAAkB,EAClB,QAAgB,EAChB,OAAoB,EACpB,QAA8C;IAE9C,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAEjD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qCAAqC,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACpF,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACzB,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oDAAoD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CACnC,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAkC,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAuC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,UAAU,GAAsE,EAAE,CAAC;IACzF,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACrC,IAAI,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qBAAqB,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;YAC9G,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO;YAC7B,CAAC,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC;YAChD,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CACzD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5C,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC;YAChC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC;YAChG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,YAAY,GAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,GAAG,MAAM;YACT,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,QAAQ,CAAC,MAAM;SAC9B,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,SAAS,EAAE,OAAO;YAClB,cAAc,EAAE,UAAU,CAAC,MAAM;YACjC,gBAAgB,EAAE,YAAY;YAC9B,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACnC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvD,IAAI;gBACJ,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;aACvC,CAAC,CAAC;SACJ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;IAEjF,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,uBAAuB,KAAK,IAAI,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,UAAU,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kCAAkC,CAAC,OAAoB;IAC9D,OAAO,6BAA6B,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,kEAAkE;AAElE,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,GAAa;IAC/C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAW;IAClC,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK;QACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;QACzB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,kBAAkB,EAAE,CAAC,CAAC,iBAAiB;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,OAAe,EACf,WAAmB,EACnB,OAAe;IAEf,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,IAAI,gBAAgB,KAAK,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,cAAc,OAAO,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,qFAAqF,KAAK,EAAE,CAAC,CAAC;IAChH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,CAAW;IAC7B,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CACjG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CACpH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scan-handler.js","sourceRoot":"","sources":["../../src/cli/scan-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3E,MAAM,cAAc,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAEvF,cAAc;AACd,MAAM,GAAG,GAAG,UAAU,CAAC;AACvB,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,GAAG,GAAG,SAAS,CAAC;AACtB,MAAM,IAAI,GAAG,SAAS,CAAC;AACvB,MAAM,KAAK,GAAG,SAAS,CAAC;AAExB,MAAM,eAAe,GAA2B;IAC9C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,UAAU;IAClB,GAAG,EAAE,UAAU;IACf,aAAa,EAAE,UAAU;CAC1B,CAAC;AA2BF,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC/C,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/C,wCAAwC;IACxC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CAC3D,CAAC;QACF,IAAI,KAAK;YAAE,OAAO,OAAO,CAAC;QAC1B,IAAI,OAAO;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,OAAO,CAAC,CAAC,gDAAgD;IAClE,CAAC;IAED,2CAA2C;IAC3C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,KAAK,CACb,mCAAmC,UAAU,wDAAwD,CACtG,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,QAAgB,EAChB,OAAoB;IAEpB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0DAA0D,KAAK,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,uEAAuE;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,KAAK,KAAK;QAC9C,CAAC,CAAC,gBAAgB,CAAC;YACf,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,cAAc,GAAG,CAAC,OAAO,GAAG,KAAK,EAAE,CAAC;SAC3E,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qEAAqE,KAAK,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAuC,CAAC,EAAE,CAAC;QAC9G,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oCAAoC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;IAElE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,QAAQ,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,qCAAqC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,0CAA0C,OAAO,CAAC,KAAK,IAAI,wBAAwB,GAAG,KAAK,EAAE,CAAC,CAAC;YACnH,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,kEAAkE;AAElE,KAAK,UAAU,aAAa,CAC1B,UAAkB,EAClB,QAAgB,EAChB,OAAoB,EACpB,QAA8C;IAE9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,wCAAwC,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,QAAQ;QACR,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,KAAK;QAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACzB,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oDAAoD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CACnC,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAkC,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAuC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,UAAU,GAA2E,EAAE,CAAC;IAC9F,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,SAAS,CAAC,wBAAwB;QACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO;YAC7B,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CACzD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7C,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC;YAChC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC;YAChG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,YAAY,GAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,GAAG,MAAM;YACT,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,QAAQ,CAAC,MAAM;SAC9B,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,MAAM,CAAC,MAAM;YAC7B,gBAAgB,EAAE,YAAY;YAC9B,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACnC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxD,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,KAAK,EAAE;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAC7C;gBACD,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;aACvC,CAAC,CAAC;SACJ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;IAE3E,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,uBAAuB,KAAK,IAAI,CAAC,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,UAAU,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,WAAW,KAAK,CAAC,IAAI,MAAM,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,UAAU,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kEAAkE;AAElE,KAAK,UAAU,cAAc,CAC3B,UAAkB,EAClB,QAAgB,EAChB,OAAoB,EACpB,QAA8C;IAE9C,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAEjD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qCAAqC,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,QAAQ;QACR,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,KAAK;QAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACzB,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oDAAoD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CACnC,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAkC,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAuC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,UAAU,GAAsE,EAAE,CAAC;IACzF,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACrC,IAAI,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qBAAqB,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;YAC9G,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO;YAC7B,CAAC,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC;YAChD,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CACzD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5C,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC;YAChC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC;YAChG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,YAAY,GAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,GAAG,MAAM;YACT,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,QAAQ,CAAC,MAAM;SAC9B,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,SAAS,EAAE,OAAO;YAClB,cAAc,EAAE,UAAU,CAAC,MAAM;YACjC,gBAAgB,EAAE,YAAY;YAC9B,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACnC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvD,IAAI;gBACJ,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;aACvC,CAAC,CAAC;SACJ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;IAEjF,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,uBAAuB,KAAK,IAAI,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,UAAU,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kCAAkC,CAAC,OAAoB;IAC9D,OAAO,6BAA6B,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,kEAAkE;AAElE,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,GAAa;IAC/C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAW;IAClC,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK;QACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;QACzB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,kBAAkB,EAAE,CAAC,CAAC,iBAAiB;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,OAAe,EACf,WAAmB,EACnB,OAAe;IAEf,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,IAAI,gBAAgB,KAAK,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,cAAc,OAAO,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,qFAAqF,KAAK,EAAE,CAAC,CAAC;IAChH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,CAAW;IAC7B,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CACjG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CACpH,CAAC;AACJ,CAAC"}

package/dist/cli.js

@@ -16,6 +16,8 @@ import { ATREngine } from './engine.js';
 import { loadRuleFile, loadRulesFromDirectory, validateRule } from './loader.js';
 import { generateBadgeSvg, generateBadgeEndpoint, lookupPackageScan, generateBadgeMarkdown } from './badge.js';
 import { cmdScanUnified } from './cli/scan-handler.js';
+import { BLOCKING_ENV_VAR, LANE_ENV_VAR, parseLane, resolveEnforcementPolicy, } from './enforcement.js';
+import { LANES } from './quality/rule-contract.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const RULES_DIR = resolve(__dirname, '..', 'rules');
@@ -31,6 +33,7 @@ const GREEN = '\x1b[32m';
 const RED = '\x1b[31m';
 const DIM = '\x1b[2m';
 const BOLD = '\x1b[1m';
+const YELLOW = '\x1b[33m';
 function printUsage() {
     console.log(`
 ${BOLD}ATR - Agent Threat Rules${RESET}
@@ -44,7 +47,8 @@ ${BOLD}Usage:${RESET}
   atr stats [--rules <dir>]                Show rule collection statistics
   atr convert <splunk|elastic> [--rules <dir>] [--output <file>]
                                            Convert rules to SIEM query format
-  atr guard [--rules <dir>] [--dry-run]    Start as Claude Code hook (stdio)
+  atr guard [--rules <dir>] [--dry-run] [--lane <l>] [--blocking]
+                                           Start as Claude Code hook (stdio)
   atr init [--global]                      Setup ATR guard hook for Claude Code
   atr mcp                                  Start MCP server (stdio transport)
   atr scaffold                             Interactive rule scaffolding
@@ -73,6 +77,14 @@ ${BOLD}Options:${RESET}
   --no-report        Disable anonymous Threat Cloud reporting (enabled by default)
   --fail-on <sev>    Exit non-zero if matches at/above this severity are found (for CI / pre-commit gates)
   --tc-url <url>     Threat Cloud endpoint (default: https://tc.panguard.ai)
+  --lane <lane>    Detection lane: enforce (stable rules only) | alert
+                   (stable+test) | hunt (all maturities). Overrides ATR_LANE.
+                   Default: hunt.
+  --blocking       Allow ATR to block. OFF BY DEFAULT: without it the guard
+                   reports detections but emits no permissionDecision and runs
+                   no response action above the observe tier. Overrides
+                   ATR_BLOCKING.
+  --no-blocking    Force blocking off even if ATR_BLOCKING is set.
   --dry-run        Log actions without executing (guard mode)
   --fail-open      Default to allow on errors (guard mode, default: true)
   --timeout <ms>   Evaluation timeout in ms (guard mode, default: 5000)
@@ -95,9 +107,15 @@ ${BOLD}Examples:${RESET}
   ${DIM}# One-command Claude Code hook setup${RESET}
   atr init
 
-  ${DIM}# Run as a Claude Code guard hook${RESET}
+  ${DIM}# Run as a Claude Code guard hook (advisory: reports, never blocks)${RESET}
   atr guard --rules ./my-rules
 
+  ${DIM}# Opt in to blocking, restricted to stable rules${RESET}
+  atr guard --lane enforce --blocking
+
+  ${DIM}# Same, via the environment${RESET}
+  ${LANE_ENV_VAR}=enforce ${BLOCKING_ENV_VAR}=1 atr guard
+
   ${DIM}# Start MCP server for AI agent integration${RESET}
   atr mcp
 
@@ -119,7 +137,7 @@ function parseArgs(argv) {
     for (let i = 1; i < args.length; i++) {
         if (args[i].startsWith('--')) {
             const key = args[i].slice(2);
-            if (key === 'json' || key === 'sarif' || key === 'help' || key === 'dry-run' || key === 'fail-open' || key === 'global' || key === 'svg' || key === 'no-report' || key === 'report-to-cloud' || key === 'semantic' || key === 'semantic-no-json-mode') {
+            if (key === 'json' || key === 'sarif' || key === 'help' || key === 'dry-run' || key === 'fail-open' || key === 'global' || key === 'svg' || key === 'no-report' || key === 'report-to-cloud' || key === 'semantic' || key === 'semantic-no-json-mode' || key === 'blocking' || key === 'no-blocking') {
                 options[key] = 'true';
             }
             else {
@@ -132,6 +150,73 @@ function parseArgs(argv) {
     }
     return { command, target, options };
 }
+// --- ENFORCEMENT policy options (shared by guard + scan) ---
+/**
+ * Read `--lane <enforce|alert|hunt>`.
+ *
+ * Returns undefined when the flag is absent, so resolveEnforcementPolicy falls
+ * through to ATR_LANE and then to the built-in default; an unrecognised value
+ * is a usage error and exits, never a silent fallback (an operator who typed
+ * `--lane enfroce` must not be left believing they are enforcing). A flag is
+ * typed at a prompt by someone who will see the exit code — unlike an inherited
+ * environment variable, which degrades instead. See resolvePolicyAndReport.
+ */
+function readLaneOption(options) {
+    const raw = options['lane'];
+    if (raw === undefined || raw.trim() === '')
+        return undefined;
+    const parsed = parseLane(raw);
+    if (parsed === null) {
+        console.error(`${RED}Error: Invalid --lane "${raw}". Expected one of: ${LANES.join(', ')}.${RESET}`);
+        process.exit(1);
+    }
+    return parsed;
+}
+/**
+ * Read the blocking opt-in: `--blocking` turns enforcement on, `--no-blocking`
+ * turns it off explicitly. Absent means "no opinion" -> the environment
+ * (ATR_BLOCKING) decides, then the default (off).
+ */
+function readBlockingOption(options) {
+    const on = options['blocking'] === 'true';
+    const off = options['no-blocking'] === 'true';
+    if (on && off) {
+        console.error(`${RED}Error: --blocking and --no-blocking are mutually exclusive.${RESET}`);
+        process.exit(1);
+    }
+    if (on)
+        return true;
+    if (off)
+        return false;
+    return undefined;
+}
+/**
+ * Resolve the enforcement posture for this process and report any problems.
+ *
+ * This is the CLI's half of the library/CLI split: `src/enforcement.ts` reads
+ * the environment here and nowhere else, and the resolved lane/blocking values
+ * are then passed EXPLICITLY into ATREngine / ActionExecutor / HookHandler.
+ *
+ * Notes are warnings, not errors, and the process keeps running. A bad flag has
+ * already exited by the time this runs — readLaneOption / readBlockingOption
+ * validate and exit while the arguments are being evaluated. A bad environment
+ * variable degrades to the advisory
+ * posture instead, because `atr guard` runs as a Claude Code command hook where
+ * a non-zero exit is measurably worse than a warning: the host maps any exit
+ * status other than 0 or 2 to a non-blocking error, runs the tool anyway, hands
+ * the model nothing, and renders only "<hookName> hook error" WITHOUT the
+ * stderr text. Exiting would therefore discard every detection and still not
+ * tell the operator why. (Status 2 is the only loud one, and it blocks the tool
+ * outright — a stray shell variable must not do that.) Verified against the
+ * Claude Code 2.1.76 hook dispatcher; see resolveEnforcementPolicy.
+ */
+function resolvePolicyAndReport(flags) {
+    const policy = resolveEnforcementPolicy(flags);
+    for (const note of policy.notes) {
+        console.error(`${RED}[atr] ${note}${RESET}`);
+    }
+    return policy;
+}
 // --- VALIDATE command ---
 function cmdValidate(target, options) {
     if (!target) {
@@ -227,7 +312,9 @@ async function cmdTest(target, options) {
     let totalTests = 0;
     let passed = 0;
     let failed = 0;
+    let skipped = 0;
     const failures = [];
+    const skippedRules = [];
     // Map extended agent_source types to basic event-compatible source types
     // so the engine's source type filter doesn't skip rules during testing.
     // The engine only recognizes: llm_io, tool_call, mcp_exchange, agent_behavior, multi_agent_comm
@@ -241,6 +328,22 @@ async function cmdTest(target, options) {
     for (const rule of rules) {
         if (!rule.test_cases)
             continue;
+        // method=behavioral rules cannot be evaluated here, and that is by design:
+        // engine.ts returns null for them because windowed metric evaluation needs
+        // state across many events, which the synchronous evaluate() API does not
+        // carry. Running their cases anyway reports "Expected: triggered, Got:
+        // not_triggered" for every true_positive, which reads as a detection
+        // failure when the truth is that this engine never looked. Count them as
+        // unevaluable and say so, rather than failing them or passing them
+        // silently. (method=trace is different: it has a real evaluation path
+        // below, so its cases still run.)
+        if (rule.detection?.method === 'behavioral') {
+            const cases = (rule.test_cases.true_positives?.length ?? 0) + (rule.test_cases.true_negatives?.length ?? 0);
+            totalTests += cases;
+            skipped += cases;
+            skippedRules.push({ ruleId: rule.id, cases, reason: 'method=behavioral requires a streaming evaluator' });
+            continue;
+        }
         // For testing, normalize extended source types so the engine doesn't filter them out
         const originalSourceType = rule.agent_source?.type;
         const baseSourceType = EXTENDED_SOURCE_TO_BASE[originalSourceType ?? ''];
@@ -306,7 +409,7 @@ async function cmdTest(target, options) {
         }
     }
     if (jsonOutput) {
-        console.log(JSON.stringify({ totalRules: rules.length, totalTests, passed, failed, failures }, null, 2));
+        console.log(JSON.stringify({ totalRules: rules.length, totalTests, passed, failed, skipped, failures, skippedRules }, null, 2));
         return;
     }
     console.log(`\n${BOLD}ATR Test Runner${RESET}`);
@@ -317,6 +420,12 @@ async function cmdTest(target, options) {
     if (failed > 0) {
         console.log(`  ${RED}Failed:${RESET}          ${failed}`);
     }
+    if (skipped > 0) {
+        console.log(`  ${YELLOW}Unevaluable:${RESET}     ${skipped}`);
+        for (const s of skippedRules) {
+            console.log(`    ${DIM}${s.ruleId}: ${s.cases} case(s) — ${s.reason}${RESET}`);
+        }
+    }
     console.log(`${DIM}${'─'.repeat(60)}${RESET}`);
     if (failures.length > 0) {
         console.log(`\n${RED}Failures:${RESET}\n`);
@@ -328,7 +437,11 @@ async function cmdTest(target, options) {
         process.exit(1);
     }
     else {
-        console.log(`\n${GREEN}All tests passed.${RESET}\n`);
+        // The literal "All tests passed" is what rule-quality.yml greps for, so it
+        // has to survive; the suffix keeps it from overstating what actually ran.
+        console.log(skipped > 0
+            ? `\n${GREEN}All tests passed.${RESET} ${DIM}(${skipped} case(s) unevaluable — see above)${RESET}\n`
+            : `\n${GREEN}All tests passed.${RESET}\n`);
     }
 }
 function buildEventFromTestCase(tc, rule) {
@@ -344,7 +457,12 @@ function buildEventFromTestCase(tc, rule) {
     // Object-style: input: { tool_name: "...", tool_args: "...", response: "..." }
     // Flat-style: input: "...", tool_response: "...", tool_name: "..."
     // Tool-call-style: tool_call: { name: "...", args: "..." }
-    const rawInput = tc['input'];
+    // Accept `user_input:` as a top-level alias for `input:` — several tool_call
+    // rules write their natural-language TPs as `- user_input: "..."`, which the
+    // harness previously ignored (it only read `input`), building an EMPTY event so
+    // the rule's own documented attack tested as not_triggered (a false failure that
+    // left the rule looking broken while it detects fine in production).
+    const rawInput = tc['input'] ?? tc['user_input'];
     let input = '';
     let toolName = str(tc['tool_name']);
     let toolArgs = str(tc['tool_args']);
@@ -400,13 +518,16 @@ function buildEventFromTestCase(tc, rule) {
         skill_chain: 'tool_call',
     };
     let type = SOURCE_TO_EVENT[sourceType] ?? 'llm_input';
-    // If rule expects tool_call but test case has only plain text input
-    // (no tool_name, tool_args, or tool_response), use llm_input event type
-    // since the content is natural language, not a tool invocation.
-    // This prevents the engine's tool_name fallback from treating text as a tool name.
-    if (type === 'tool_call' && !toolName && !toolArgs && !toolResponse && !toolDescription) {
-        type = 'llm_input';
-    }
+    // NOTE: previously, a tool_call rule with a plain-string TP was downgraded to
+    // an llm_input event. That mis-tested tool_call-native rules: a shell command or
+    // SQL string IS a tool invocation, and evaluating it as llm_input made the engine
+    // apply its cross-context confidence penalty, dropping the match below threshold
+    // so the rule's own documented attack tested as not_triggered (false failure that
+    // silently left broken rules in the enforce lane). We now keep the native
+    // tool_call type — the string flows in via `content` (below), and tool_name is
+    // pinned to "" (below) so the engine's tool_name fallback never treats the
+    // content as a tool name. Plain-string TPs of tool_call rules therefore test in
+    // their real (native) context.
     // Determine the primary content based on what the rule conditions check
     // Problem 2 & 3: For rules that check tool_response, the tool_response
     // should be the primary content when the event type resolves tool_response from content
@@ -431,8 +552,27 @@ function buildEventFromTestCase(tc, rule) {
     // Always set tool_name (even empty) to prevent engine fallback
     // from using event.content as tool_name for tool_call events
     fields['tool_name'] = toolName;
-    if (toolArgs)
-        fields['tool_args'] = toolArgs;
+    // Production ALWAYS populates tool_args: src/hook-handler.ts builds
+    // `tool_args: JSON.stringify(toolInput)` for BOTH the PreToolUse (tool_call)
+    // and the PostToolUse (tool_response) event. The engine resolves this field as
+    // `event.fields.tool_args ?? (event.type === 'tool_call' ? event.content :
+    // undefined)` (src/engine.ts resolveField), so a test case that supplies only
+    // a plain `input:` string leaves tool_args unresolvable on every non-tool_call
+    // event and EVERY `field: tool_args` condition silently evaluates to false.
+    // The rule then reports not_triggered on its own documented attack while
+    // detecting it correctly in production — a harness defect that reads exactly
+    // like a broken rule and invites weakening a rule that is right. 40 rules
+    // declare `field: tool_args`.
+    // This is the test-case-runner twin of the measurement-shape defect that
+    // scripts/lib/corpus-event.ts fixed for the FP gate: a true positive must be
+    // exercised on the same shape the benign corpus is charged against.
+    // Deliberately narrower than that harness's wide shape: only the INPUT string
+    // is offered as tool_args. A `tool_response:` test case asserts what a tool
+    // RETURNED, which is not an argument, so pouring it into tool_args would let a
+    // tool_args layer pass a TP for the wrong reason.
+    const toolArgsValue = toolArgs || input;
+    if (toolArgsValue)
+        fields['tool_args'] = toolArgsValue;
     // For content-based rules, set content and agent_message fields
     fields['content'] = content;
     fields['agent_message'] = content;
@@ -543,22 +683,45 @@ async function cmdGuard(options) {
     const failOpen = options['fail-open'] !== 'false';
     const parsedTimeout = options['timeout'] ? parseInt(options['timeout'], 10) : 5000;
     const timeoutMs = (Number.isFinite(parsedTimeout) && parsedTimeout > 0) ? parsedTimeout : 5000;
+    // Absent flags stay undefined so the environment can still speak;
+    // --no-blocking is an explicit "no" that overrides it.
+    const policy = resolvePolicyAndReport({
+        lane: readLaneOption(options),
+        blocking: readBlockingOption(options),
+    });
     const { ActionExecutor } = await import('./action-executor.js');
     const { StdioAdapter } = await import('./adapters/stdio-adapter.js');
     const { HookHandler } = await import('./hook-handler.js');
-    const engine = new ATREngine({ rulesDir });
+    // Everything below receives the resolved posture explicitly. None of these
+    // constructors reads the environment.
+    const engine = new ATREngine({ rulesDir, lane: policy.lane });
     const ruleCount = await engine.loadRules();
     const adapter = new StdioAdapter();
-    const executor = new ActionExecutor({ adapter, dryRun });
-    const handler = new HookHandler({ engine, executor, timeoutMs, failOpen });
+    const executor = new ActionExecutor({ adapter, dryRun, blocking: policy.blocking });
+    const handler = new HookHandler({
+        engine,
+        executor,
+        timeoutMs,
+        failOpen,
+        blocking: policy.blocking,
+    });
+    // State the enforcement posture out loud. "Installed" must never be mistaken
+    // for "enforcing": in advisory mode this guard emits no permissionDecision at
+    // all and dispatches no action above the OBSERVE tier. Even with blocking on,
+    // ATR only ever emits deny/ask — never an affirmative allow.
     process.stderr.write(`[atr-guard] Loaded ${ruleCount} rules from ${rulesDir}` +
-        `${dryRun ? ' (dry-run)' : ''}\n`);
+        `${dryRun ? ' (dry-run)' : ''}\n` +
+        `[atr-guard] lane=${engine.getLane()} blocking=${handler.isBlocking() ? 'on' : 'off'}` +
+        `${handler.isBlocking()
+            ? ' (deny/ask only; never approves a tool call)'
+            : ' (advisory: detections are reported, nothing is blocked)'}\n`);
     await handler.startStdioLoop();
 }
 // --- MCP command ---
 async function cmdMcp() {
     const { startMCPServer } = await import('./mcp-server.js');
-    await startMCPServer();
+    // The MCP server never blocks, so only the lane half of the policy applies.
+    await startMCPServer({ lane: resolvePolicyAndReport({}).lane });
 }
 // --- SCAFFOLD command ---
 async function cmdScaffold() {
@@ -884,6 +1047,10 @@ function cmdInit(options) {
     console.log(`${DIM}Every tool call Claude Code makes will now be scanned against ATR`);
     console.log(`threat detection rules before execution. Suspicious actions will be`);
     console.log(`flagged with severity and recommendation.${RESET}\n`);
+    console.log(`${BOLD}Mode: advisory.${RESET} ${DIM}The guard reports detections and does NOT block:`);
+    console.log(`it emits no permissionDecision, so Claude Code's own permission flow is`);
+    console.log(`untouched. Turn blocking on when you have chosen a lane you trust:`);
+    console.log(`  ${BLOCKING_ENV_VAR}=1 ${LANE_ENV_VAR}=enforce   (or: atr guard --blocking --lane enforce)${RESET}\n`);
 }
 // --- CONVERT command ---
 async function cmdConvert(target, options) {
@@ -1016,6 +1183,16 @@ async function main() {
         return;
     }
     const rulesDir = options['rules'] ? resolve(options['rules']) : RULES_DIR;
+    /**
+     * Lane for the scanning commands. Resolved lazily so only the commands that
+     * actually have a lane pay for it — resolving eagerly would print an ATR_LANE
+     * warning while running `atr stats`, and would print it a second time inside
+     * `atr guard`, which resolves its own (blocking-aware) policy.
+     *
+     * `--lane typo` exits before any rule loads; ATR_LANE is read here because
+     * the engine no longer reads it.
+     */
+    const scanLane = () => resolvePolicyAndReport({ lane: readLaneOption(options) }).lane;
     switch (command) {
         case 'scan':
             await cmdScanUnified(target, rulesDir, {
@@ -1031,6 +1208,7 @@ async function main() {
                 semanticModel: options['semantic-model'],
                 semanticTimeout: options['semantic-timeout'],
                 semanticNoJsonMode: options['semantic-no-json-mode'] === 'true',
+                lane: scanLane(),
             });
             break;
         case 'scan-skill':
@@ -1048,6 +1226,7 @@ async function main() {
                 semanticModel: options['semantic-model'],
                 semanticTimeout: options['semantic-timeout'],
                 semanticNoJsonMode: options['semantic-no-json-mode'] === 'true',
+                lane: scanLane(),
             });
             break;
         case 'validate':