agent-threat-rules 4.0.0 → 4.1.5

package/DISCLOSURE

@@ -0,0 +1,85 @@
+agent-threat-rules: dual-use disclosure
+
+This package is declared dual-use under the npm Dual-Use Content Policy
+(https://docs.npmjs.com/policies/dual-use/).
+
+What the package is
+
+agent-threat-rules (ATR) is an open detection standard for attacks against AI
+agents: prompt injection, tool and skill poisoning, credential and context
+exfiltration, privilege escalation through agents, and related threats. It
+contains a set of YAML detection rules and a JavaScript engine and CLI that
+evaluate those rules against text.
+
+Why it contains attack strings
+
+A rule has to describe an attack in order to detect it, so the files under
+rules/ contain attack strings on purpose:
+
+- detection patterns (regular expressions and literal fragments) that match
+  prompt-injection text, script and HTML injection payloads, shell commands,
+  credential-exfiltration command lines and similar content;
+- descriptions and false-positive notes that name the techniques a rule
+  covers.
+
+The rules published here leave out each rule's test samples (test_cases and
+evasion_tests): the attack inputs a rule must detect and the benign inputs it
+must not. Some of those samples are complete attack snippets, and the engine
+does not use them. They remain in the source repository, where the project's
+own tests run them.
+
+The evaluation harness under dist/eval/ carries a small built-in attack corpus
+(dist/eval/corpus.js, dist/eval/rule-corpus.js) that run-eval scores the rules
+against. It is data like the rules: the harness matches it, it never runs it.
+
+These strings are data. The engine matches the patterns, as regular expressions
+or as literal strings, against text supplied by the caller. Rule content is
+never executed, evaluated as code, or passed to a shell.
+
+What the package does not do
+
+- It has no preinstall, install or postinstall scripts.
+- It makes no network requests by default. Each network path listed below
+  stays off until the user turns it on.
+- It does not run rule content, and it starts no process through a shell.
+
+Network access (all opt-in)
+
+- Threat Cloud reporting and the Threat Cloud CLI commands contact only a URL
+  the user supplies (--tc-url, ATR_TC_URL or TC_URL). There is no built-in
+  default for them.
+- The LLM-based semantic judges run only when the caller turns them on and
+  supplies an API key: in code through createOpenAICompatibleJudge or the
+  engine's semanticModule option, and in the CLI through --semantic or
+  ATR_SEMANTIC. If no base URL is set (baseUrl, --semantic-base-url,
+  ATR_SEMANTIC_BASE_URL or LLM_BASE_URL), they send the text being evaluated
+  to https://api.openai.com. Setting a base URL points them at another
+  endpoint, including a local model.
+- The optional embedding module needs @xenova/transformers, which this package
+  does not install. If the user installs it, that library downloads its model,
+  from the Hugging Face Hub by default, the first time the module is used.
+
+Local processes
+
+- The atr tc pull command, for operators of a Threat Cloud endpoint, checks
+  that each rule the endpoint returns has a well-formed rule id and one of the
+  schema's categories before writing it under the rules directory. It then
+  runs the package's own rule validator on the file in a separate Node.js
+  process.
+- The evaluation and benchmark scripts under dist/eval/ (the eval harness CLI
+  used by run-eval, run-pint-benchmark, run-hackaprompt-benchmark and
+  skill-benchmark) start git and find through the measurement writer, to
+  record the commit they measured and count the rule files.
+- These processes are started without a shell, and none of them runs rule
+  content.
+
+Intended use
+
+Defensive: detecting attacks in AI agent inputs, outputs, tool calls, MCP
+traffic and agent skill files, inside agent frameworks, gateways, CI pipelines
+and security audits.
+
+Source and contact
+
+Source: https://github.com/Agent-Threat-Rule/agent-threat-rules (MIT License)
+Security contact: see SECURITY.md in the repository.

package/README.md

@@ -13,7 +13,7 @@ AI Agent 威脅偵測規則的開放格式
 [![GitHub Marketplace](https://img.shields.io/badge/Marketplace-ATR%20Scan-2ea44f?style=flat-square&logo=github)](https://github.com/marketplace/actions/atr-scan)
 [![License: MIT](https://img.shields.io/badge/license-MIT-brightgreen?style=flat-square)](LICENSE)
 [![DOI](https://img.shields.io/badge/DOI-10.5281%2Fzenodo.19178002-blue?style=flat-square)](https://doi.org/10.5281/zenodo.19178002)
-[![Rules](https://img.shields.io/badge/rules-785-blue?style=flat-square)](#5-specification)
+[![Rules](https://img.shields.io/badge/rules-829-blue?style=flat-square)](#5-specification)
 [![Categories](https://img.shields.io/badge/categories-10-blue?style=flat-square)](#7-coverage)
 [![OWASP Agentic](https://img.shields.io/badge/OWASP_Agentic_Top_10-10%2F10-brightgreen?style=flat-square)](#7-coverage)
 [![SAFE-MCP](https://img.shields.io/badge/SAFE--MCP-91.8%25-brightgreen?style=flat-square)](#7-coverage)
@@ -29,7 +29,7 @@ ATR (Agent Threat Rules) is an open detection rule format for AI agent security
 
 ## Status of This Document
 
-ATR is published as a **Working Draft** at version `3.0.0-alpha.1`. The rule format defined in `SPEC.md` is stable and merged into open-source repos at Microsoft, Cisco, and Gen Digital, and integrated by standards-body projects (MISP / CIRCL, OWASP Agent Security Regression Harness, SigmaHQ, FINOS Common Cloud Controls); full list with PR links in [§6 Adoption](#6-adoption). Governance is currently single-maintainer (BDFL) transitioning to a Technical Steering Committee per [GOVERNANCE.md](GOVERNANCE.md).
+ATR is published as a **Working Draft** at version `4.1.4`. The rule format defined in `SPEC.md` is stable and merged into open-source repos at Microsoft, Cisco, and Gen Digital, and integrated by standards-body projects (MISP / CIRCL, OWASP Agent Security Regression Harness, SigmaHQ, FINOS Common Cloud Controls); full list with PR links in [§6 Adoption](#6-adoption). Governance is currently single-maintainer (BDFL) transitioning to a Technical Steering Committee per [GOVERNANCE.md](GOVERNANCE.md).
 
 All numbers in this document are sourced from [`data/stats.json`](data/stats.json), which is the canonical record of the project's current state. Where this README and `stats.json` disagree, `stats.json` is authoritative.
 
@@ -70,13 +70,14 @@ ATD is ATR's technique catalog: an enumeration of agent-runtime attack *techniqu
 - [8. Evaluation](#8-evaluation)
 - [9. Governance](#9-governance)
 - [10. Security](#10-security)
-- [11. Contributing](#11-contributing)
-- [12. Citation](#12-citation)
-- [13. Maintainers](#13-maintainers)
-- [14. Sponsorship](#14-sponsorship)
-- [15. License](#15-license)
-- [16. Acknowledgments](#16-acknowledgments)
-- [17. References](#17-references)
+- [11. Telemetry](#11-telemetry)
+- [12. Contributing](#12-contributing)
+- [13. Citation](#13-citation)
+- [14. Maintainers](#14-maintainers)
+- [15. Sponsorship](#15-sponsorship)
+- [16. License](#16-license)
+- [17. Acknowledgments](#17-acknowledgments)
+- [18. References](#18-references)
 
 ---
 
@@ -212,13 +213,15 @@ the next section covers. Neither implies the other.
 
 Each rule carries a maturity-driven **lane**, so a consumer can trade recall for precision instead of running every rule at one fixed threshold:
 
-| Lane | Fires | Intended use | FP on a 65K-sample benign gate |
+| Lane | Fires | Intended use | FP on a benign gate |
 |---|---|---|---:|
-| `enforce` | `stable` only | Narrowest, highest-precision set — the one to run when blocking is on | ~0.24% |
+| `enforce` | `stable` only | Narrowest, highest-precision set — the one to run when blocking is on | withdrawn |
 | `alert` | `stable` + `test` | Analyst / correlation | — |
-| `hunt` | all rules except `deprecated` | Broadest visibility (**default**) | ~9% |
+| `hunt` | all rules except `deprecated` | Broadest visibility (**default**) | withdrawn |
 
-Lanes are opt-in and backward-compatible for detection: the default is `hunt`, so every integration sees exactly the rules it saw before. Selecting `enforce` raises precision by firing only the most mature rules — and therefore catches fewer attacks. Report false-positive rates lane-keyed (`enforce` ~0.24% / `hunt` ~9% on the 65K-sample benign gate), not as a single overall figure. That gate is a separate corpus from the per-source measurements in [§8 Evaluation](#8-evaluation).
+Lanes are opt-in and backward-compatible for detection: the default is `hunt`, so every integration sees exactly the rules it saw before. Selecting `enforce` raises precision by firing only the most mature rules — and therefore catches fewer attacks. False-positive rates should always be reported lane-keyed rather than as a single overall figure, and that gate is a separate corpus from the per-source measurements in [§8 Evaluation](#8-evaluation).
+
+**The two lane FP rates previously published here (`enforce` ~0.24% / `hunt` ~9% over a "65K-sample benign gate") are withdrawn, and should not be cited.** Three things were wrong with them. The gate was labelled 65,000 samples; both rates were actually measured on a 10,863-sample subsample of it. The benign corpus contained real jailbreak samples — material the rules are meant to catch, sitting in the set that defines a false positive — until the exclusion filter merged on 2026-08-04 (#373), so the corpus changed underneath both figures. And the ladder that produced the `hunt` figure depended on a file that is no longer in the repository, so that one cannot be reproduced at all. Re-measurement against the current benign corpus is pending; until it lands there is a gap here rather than a number.
 
 ### Detection and enforcement are separate switches
 
@@ -309,9 +312,9 @@ string, and every non-empty string is truthy, so it used to switch enforcement
 |---|---|---|
 | Specification (canonical pointer) | [SPEC.md](SPEC.md) | Resolves to the authoritative documents below |
 | Rule format spec (normative) | [SPEC.md](SPEC.md) | Rule format, identifier scheme, evaluation semantics |
-| Framework spec | [ATR-FRAMEWORK-SPEC.md](ATR-FRAMEWORK-SPEC.md) | Multi-layer detection framework design |
+| Framework spec | [ATR-FRAMEWORK-SPEC.md](ATR-FRAMEWORK-SPEC.md) | **Superseded 2026-05-16 by [SPEC.md](SPEC.md).** Kept as a historical artifact; multi-layer detection framework design |
 | Machine-readable schema | [spec/atr-schema.yaml](spec/atr-schema.yaml) | Authoritative validation source |
-| Schema field reference | [docs/schema-spec.md](docs/schema-spec.md) | Human-readable schema docs |
+| Schema field reference | [docs/schema-spec.md](docs/schema-spec.md) | **Superseded 2026-05-16 by [SPEC.md](SPEC.md).** Kept as a historical artifact; human-readable schema docs |
 | Quality standard | [docs/QUALITY-STANDARD.md](docs/QUALITY-STANDARD.md) | Rule promotion criteria (experimental → stable) |
 | Quality gate | [docs/QUALITY-GATE.md](docs/QUALITY-GATE.md) | Safety-gate semantics for community PRs |
 | Enforcement model | [docs/ENFORCEMENT-MODEL.md](docs/ENFORCEMENT-MODEL.md) | Lane and blocking switches, decision channels, migration (reference implementation, not normative) |
@@ -361,7 +364,7 @@ Production deployments and standards-body integrations, as of 2026-07-05 (every
 | Organization | Integration | Reference |
 |---|---|---|
 | Microsoft Agent Governance Toolkit | 287-rule expansion + weekly auto-sync (merged 2026-04-26); 15-rule PoC (merged 2026-04-13) | [PR #1277](https://github.com/microsoft/agent-governance-toolkit/pull/1277) · [PR #908](https://github.com/microsoft/agent-governance-toolkit/pull/908) |
-| Cisco AI Defense (skill-scanner) | Full rule pack in production (merged 2026-04-22); original PoC (merged 2026-04-03) | [PR #99](https://github.com/cisco-ai-defense/skill-scanner/pull/99) · [PR #79](https://github.com/cisco-ai-defense/skill-scanner/pull/79) |
+| Cisco AI Defense (skill-scanner) | Full rule pack merged into the open-source scanner repository (2026-04-22); original PoC (merged 2026-04-03). This is a merge into that repository, not a statement about any vendor product. | [PR #99](https://github.com/cisco-ai-defense/skill-scanner/pull/99) · [PR #79](https://github.com/cisco-ai-defense/skill-scanner/pull/79) |
 | MISP (CIRCL) | Threat-intel cluster (galaxy, merged 2026-05-10) + rule-ID tagging vocabulary (taxonomies, merged 2026-05-10) | [galaxy #1207](https://github.com/MISP/misp-galaxy/pull/1207) · [taxonomies #323](https://github.com/MISP/misp-taxonomies/pull/323) |
 | Gen Digital Sage (Norton / Avast / AVG parent) | Rule pack merged 2026-05-11 | [PR #33](https://github.com/gendigitalinc/sage/pull/33) |
 | OWASP Agent Security Regression Harness | ATR referenced as the canonical agent-threat detection ruleset in the threat catalogue (merged 2026-05-11) | [PR #74](https://github.com/OWASP/agent-security-regression-harness/pull/74) |
@@ -467,7 +470,7 @@ Aggregated into [`data/stats.json`](data/stats.json) under `benchmarks[]`.
 | promptfoo (red-team plugin fixtures) | corpus-2026-05-12 | 44 | 97.7% | 100.0% | 0.0% | 3.5.0 | 2026-06-16 |
 | PromptInject (academic adversarial) [^promptcorpora] | snapshot-2026-04 | 1,080 | 100.0% | 100.0% | 0.0% | 3.5.11 | 2026-08-05 |
 | SKILL.md benchmark (internal) [^skilllane] | internal-498 | 498 | 100.0% (hunt) / 0.0% (enforce) | 97.0% | 0.20% | 3.5.12 | 2026-08-15 |
-| Wild scan (OpenClaw + Skills.sh + Hermes + ClawHub) | corpus-2026-04-14 | 96,096 | — | 57.7% (floor) | 1.35% flag rate | 2.0.0 | 2026-04-14 |
+| Wild scan (OpenClaw + Skills.sh + Hermes + ClawHub) [^wildscan] | full-scan-v2-2026-04-13 | 101,280 | — | not measured | 1.42% flag rate | 2.0.0 | 2026-04-13 |
 
 All detection corpora were (re-)measured against ATR 3.5.0 on 2026-06-16,
 except `autoresearch` (an internal predicted-rule corpus with no standalone
@@ -544,9 +547,11 @@ See [CHANGELOG.md](CHANGELOG.md).
     benchmark. That corpus is private and roughly 5x larger; this row is a
     self-built 850-sample corpus in PINT's format, assembled from
     `deepset/prompt-injections` (660) and `Lakera/gandalf_ignore_instructions`
-    (190). It also carries a scope caveat worth stating plainly: only **63 of
+    (190). It also carries a scope caveat worth stating plainly: only **62 of
     784 rules** fire on it at all, and `ATR-2026-00001` alone accounts for 226
-    of the 295 detections. Read it as a prompt-injection-family score, not as
+    of the 295 detections. The eval report's per-rule block lists 63 entries,
+    but one of those is `tier2.5-embedding-match` — the Tier 2.5 embedding
+    stage, not a rule. Read it as a prompt-injection-family score, not as
     ATR's overall coverage. The row moved 63.6% → 60.3% between 3.5.0 and
     3.5.11 for the same reason `garak` moved: PR #327 tightened
     `ATR-2026-00001`'s persona-switch regex to stop it false-positiving on
@@ -651,10 +656,10 @@ the file path and `metadata.measurement_file` in `stats.json` for the absolute
 repo path.
 
 False-positive rate is lane-keyed as of v3.5.0, not a single overall figure.
-ATR ships detection lanes (`enforce` / `alert` / `hunt`); on a 65K-sample
-benign gate the `enforce` lane (stable + `confirm`-gated rules) holds ~0.24%
-FP, while the default `hunt` lane (all rules) runs ~9% FP. Per-corpus `FP rate`
-cells above are measured in the default `hunt` lane. See [CHANGELOG.md](CHANGELOG.md)
+ATR ships detection lanes (`enforce` / `alert` / `hunt`). The specific lane FP
+rates previously quoted here are withdrawn and awaiting re-measurement — see
+the note in the lanes section above for why. Per-corpus `FP rate` cells above
+are measured in the default `hunt` lane. See [CHANGELOG.md](CHANGELOG.md)
 (v3.5.0) for the lane definitions.
 
 ```bash
@@ -674,7 +679,9 @@ npx tsx scripts/measurement/verify.ts       # validate every measurement file
 npx tsx scripts/sync-stats-from-measurements.ts                              # refresh stats.json benchmarks[]
 ```
 
-Raw data: [`data/full-scan-v2-2026-04-14.json`](data/full-scan-v2-2026-04-14.json) (96,096-skill scan; 1,302 flagged, 552 confirmed malicious after manual review); full malware-campaign report in [`docs/research/openclaw-malware-campaign-2026-04.md`](docs/research/openclaw-malware-campaign-2026-04.md).
+Raw data: [`data/full-scan-v2-2026-04-14.json`](data/full-scan-v2-2026-04-14.json) — 101,280 skills scanned, 1,434 flagged, engine 2.0.0, timestamped 2026-04-13. The malware-campaign write-up is in [`docs/research/openclaw-malware-campaign-2026-04.md`](docs/research/openclaw-malware-campaign-2026-04.md).
+
+[^wildscan]: Scanned and flagged counts come from `total_scanned` and `total_flagged` in the raw scan file; the flag rate is those two divided. **No precision figure is given because none was measured over this run.** Earlier material paired a manual-review count against a smaller 96,096-skill analysis subset and reported the ratio as a precision floor. The review covered that subset rather than all 1,434 flags, so the ratio does not describe this scan and is not reproducible from the raw file; it has been withdrawn rather than recomputed. Establishing precision here means re-reviewing a sample of the 1,434 flags, which has not been done.
 
 ATR is honest about what it cannot detect. Regex catalogs miss paraphrased attacks, semantic rephrasings of credential exfiltration, and novel attack shapes not present in the training corpus. `PromptBench` (3,280 character- and word-level robustness perturbations) is a different threat class from prompt injection and sits largely outside ATR's content scope; ATR still matches the 23.2% that carry injection-shaped payloads, at 100% precision. See [LIMITATIONS.md](LIMITATIONS.md) for the documented evasion-test corpus (64 techniques as of 2026-05) and the layering recommendation: ATR is the content layer; pair with credential brokering, sandbox execution, and human-in-the-loop for high-blast-radius actions.
 
@@ -692,9 +699,44 @@ ATR is currently single-maintainer (BDFL) under Adam Lin, transitioning to a Tec
 
 ## 10. Security
 
-Vulnerability reports are coordinated under [SECURITY.md](SECURITY.md). Please use the private security advisory channel on the GitHub repository, not public issues, for any report concerning a vulnerability in the engine or the rule corpus.
+Vulnerability reports are coordinated under [SECURITY.md](SECURITY.md). Report privately — not in a public issue — for anything concerning a vulnerability in the engine or the rule corpus. Two channels are open: a [GitHub Security Advisory](https://github.com/Agent-Threat-Rule/agent-threat-rules/security/advisories/new) (private vulnerability reporting is enabled on this repository, verified 2026-09-22), or email to <adam@agentthreatrule.org>. Response-time commitments are in [SECURITY.md](SECURITY.md).
+
+## 11. Telemetry
+
+**Nothing in this project sends anything anywhere unless you ask it to.** Scanning is a local operation: `atr scan`, `atr scan-skill`, `atr guard`, `atr validate`, and the library (`new ATREngine(...)`) are all silent by default.
+
+Anonymous detection reporting is available as an opt-in, for deployments that want to contribute detections to a shared sensor network.
+
+- **Turn it on:** `--report-to-cloud`. Without this flag nothing leaves your machine.
+- **Endpoint:** `--tc-url <url>`, or the `ATR_TC_URL` environment variable. **One of the two is required** — there is no built-in default, so opting in without naming a recipient is an error, not a silent choice of one. ATR is an open standard rather than any single collector's client, and a package that carried a destination for detection data would be making that choice on your behalf. Pass the base URL only (`https://host`); `/api/threats` is appended for you. HTTPS is required for anything that is not localhost.
+- `--no-report` is still accepted and is now a no-op, since off is the default.
+
+When reporting is on, `atr scan` prints a notice saying so before it starts and names the endpoint when it finishes. The rest of this section describes what is sent **when you have opted in**.
+
+**Every scanned item produces at least one event, including items where no rule matched** — those are reported as a single `__clean__` event rather than being skipped. An item that matches more than one rule produces one event per match, so a noisy file can emit several. Events are batched (50 per request, or every 60 seconds, whichever comes first) and flushed once more before the process exits. An unreachable endpoint is not fatal: the batch is re-queued and your scan results are unaffected.
+
+A detection event on the wire looks like this, verbatim apart from the UUID and hash:
+
+```json
+{"events":[{"attackSourceIP":"<random UUID>","attackType":"skill-compromise","mitreTechnique":"ATR-2026-00120","sigmaRuleMatched":"ATR-2026-00120","timestamp":"2026-09-22T08:09:40.946Z","region":"unknown","severity":"critical","confidence":0.92,"contentHash":"<sha256 hex>","scanTarget":"skill"}]}
+```
+
+| Field | What it actually carries |
+|---|---|
+| `attackSourceIP` | A random UUID generated fresh for each process. Despite the field name, no IP address is read or sent — though, as with any HTTP request, the receiving server sees the network source address. The same UUID is repeated in a client-id request header, so events from one run are linkable to each other, but not across runs. |
+| `attackType` | The matched rule's category, or `clean`. |
+| `mitreTechnique` / `sigmaRuleMatched` | Both carry the ATR rule ID, or `__clean__`. The names are legacy on the receiving side; neither holds a MITRE or Sigma identifier. |
+| `severity`, `confidence` | Taken from the matched rule. |
+| `contentHash` | A full, unsalted SHA-256 of the scanned content. It is not the content and cannot be reversed into it, but it is an exact fingerprint: anyone who already holds a candidate file can hash it and learn whether you scanned that file. |
+| `scanTarget` | The literal string `skill`, or the event type for MCP event scans. Never a file path. |
+| `timestamp` | ISO 8601, when the rule was evaluated. |
+| `region` | Always the literal string `unknown`. |
+
+Not sent: the scanned content, file names, file paths, your username, hostname, environment variables, or the ATR version. Requests are unauthenticated unless `TC_API_KEY` is set in the environment, in which case it is attached as a bearer token.
+
+If you are scanning material whose existence you cannot disclose, simply do not pass `--report-to-cloud`.
 
-## 11. Contributing
+## 12. Contributing
 
 The fastest contribution path requires no local setup:
 
@@ -706,7 +748,7 @@ Other contribution paths (evasion reports, false-positive reports, full rule aut
 
 All contributions are MIT-licensed by submission. There is no CLA.
 
-## 12. Citation
+## 13. Citation
 
 If you use ATR in academic work or security research, please cite the dataset via DOI:
 
@@ -725,15 +767,15 @@ The companion research paper is published on Zenodo: [PDF](docs/paper/ATR-Paper-
 
 Machine-readable citation metadata is available in [CITATION.cff](CITATION.cff) (CFF v1.2.0).
 
-## 13. Maintainers
+## 14. Maintainers
 
 - **Adam Lin (林冠辛)** — BDFL, [@eeee2345](https://github.com/eeee2345), adam@agentthreatrule.org, Taiwan.
 
 The TSC seating process is open per [GOVERNANCE.md](GOVERNANCE.md).
 
-## 14. Sponsorship
+## 15. Sponsorship
 
-ATR's rules, engine, and pipeline are MIT licensed in perpetuity. Maintenance — CVE-class response, weekly cross-ecosystem sync, the auto-review pipeline — runs on community sponsorship through [Open Source Collective, Inc.](https://opencollective.com/opensource) (501(c)(6), EIN 81-1567737).
+ATR's rules, engine, and pipeline are MIT licensed in perpetuity. Maintenance — CVE-class response, weekly cross-ecosystem sync, the auto-review pipeline — runs on community sponsorship through [Open Source Collective, Inc.](https://opencollective.com/opensource) (501(c)(6), EIN 82-2037583).
 
 **Sponsor page: [opencollective.com/agent-threat-rules](https://opencollective.com/agent-threat-rules)**
 
@@ -749,17 +791,17 @@ Three funding milestones make the trajectory concrete:
 
 Organizations that want a deeper engagement — a named maintainer contact, faster turnaround on CVE-class updates, or co-authored rules attributed to your organization — can arrange a custom sponsorship tier through Open Source Collective. Email <adam@agentthreatrule.org>.
 
-## 15. License
+## 16. License
 
 ATR is released under the [MIT License](LICENSE). All contributions are MIT-licensed by submission.
 
-## 16. Acknowledgments
+## 17. Acknowledgments
 
 ATR's design draws on prior work in: [Sigma](https://github.com/SigmaHQ/sigma) (SIEM detection format), [YARA](https://github.com/VirusTotal/yara) (malware signature format), [OWASP LLM Top 10](https://owasp.org/www-project-top-10-for-large-language-model-applications/), [OWASP Agentic Top 10](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/), [MITRE ATLAS](https://atlas.mitre.org/), [NVIDIA garak](https://github.com/NVIDIA/garak), [Lakera PINT](https://github.com/lakeraai/pint-benchmark), [Meta LlamaFirewall](https://ai.meta.com/research/publications/llamafirewall-an-open-source-guardrail-system-for-building-secure-ai-agents/), and [SAFE-MCP (OpenSSF)](https://github.com/safe-agentic-framework/safe-mcp).
 
-The 96,096-skill ecosystem scan was made possible by the maintainers of OpenClaw, Skills.sh, Hermes Agent, and ClawHub publishing their registries openly.
+The 2026-04 ecosystem-wide skill scan was made possible by the maintainers of OpenClaw, Skills.sh, Hermes Agent, and ClawHub publishing their registries openly.
 
-## 17. References
+## 18. References
 
 ### Normative
 

package/dist/cli/scan-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan-handler.d.ts","sourceRoot":"","sources":["../../src/cli/scan-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAoC,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAC;AAsBxD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;CACtB;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,CA0B5D;AAED,6FAA6F;AAC7F,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CAoDf"}
+{"version":3,"file":"scan-handler.d.ts","sourceRoot":"","sources":["../../src/cli/scan-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAoC,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAC;AAsBxD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;CACtB;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,CA0B5D;AAED,6FAA6F;AAC7F,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CA+Df"}

package/dist/cli/scan-handler.js

@@ -8,7 +8,7 @@ import { readFileSync, existsSync, statSync, readdirSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { ATREngine } from '../engine.js';
 import { scanResultToSARIF } from '../converters/sarif.js';
-import { createTCReporter } from '../tc-reporter.js';
+import { createTCReporter, resolveTcUrl } from '../tc-reporter.js';
 import { createSemanticJudgeFromConfig } from './semantic-judge-config.js';
 const SEVERITY_ORDER = ['informational', 'low', 'medium', 'high', 'critical'];
 // ANSI colors
@@ -62,15 +62,27 @@ export async function cmdScanUnified(target, rulesDir, options) {
         console.error(`${RED}Error: Path not found: ${targetPath}${RESET}`);
         process.exit(1);
     }
-    // Threat Cloud reporting is ON by default — use --no-report to disable
-    const reporter = options.reportToCloud !== false
-        ? createTCReporter({
-            tcUrl: options.tcUrl,
-            onError: (err) => console.error(`${DIM}TC upload: ${err.message}${RESET}`),
-        })
-        : undefined;
+    // Threat Cloud reporting is OFF by default. Scanning is a local operation, and a
+    // scan of internal material must not leave the machine because of a default. Opt in
+    // explicitly with --report-to-cloud.
+    let reporter;
+    if (options.reportToCloud === true) {
+        try {
+            reporter = createTCReporter({
+                tcUrl: options.tcUrl,
+                onError: (err) => console.error(`${DIM}TC upload: ${err.message}${RESET}`),
+            });
+        }
+        catch (err) {
+            // No endpoint configured. Refusing here is the point: the alternative is
+            // picking a recipient for the operator, which is what a built-in default
+            // did. Fail with the fix in the message rather than a stack trace.
+            console.error(`${RED}Error: ${err instanceof Error ? err.message : String(err)}${RESET}`);
+            process.exit(1);
+        }
+    }
     if (reporter) {
-        console.error(`${DIM}Threat Cloud: anonymous reporting enabled (--no-report to disable)${RESET}`);
+        console.error(`${DIM}Threat Cloud: anonymous reporting enabled via --report-to-cloud${RESET}`);
     }
     if (options.failOn !== undefined && !SEVERITY_ORDER.includes(options.failOn)) {
         console.error(`${RED}Error: --fail-on must be one of: ${SEVERITY_ORDER.join(', ')}${RESET}`);
@@ -91,7 +103,7 @@ export async function cmdScanUnified(target, rulesDir, options) {
         if (reporter) {
             await reporter.destroy();
             if (!options.json && !options.sarif) {
-                console.log(`${DIM}  Threat Cloud: detections reported to ${options.tcUrl ?? 'https://tc.panguard.ai'}${RESET}`);
+                console.log(`${DIM}  Threat Cloud: detections reported to ${resolveTcUrl(options.tcUrl)}${RESET}`);
             }
         }
     }

package/dist/cli/scan-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan-handler.js","sourceRoot":"","sources":["../../src/cli/scan-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3E,MAAM,cAAc,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAEvF,cAAc;AACd,MAAM,GAAG,GAAG,UAAU,CAAC;AACvB,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,GAAG,GAAG,SAAS,CAAC;AACtB,MAAM,IAAI,GAAG,SAAS,CAAC;AACvB,MAAM,KAAK,GAAG,SAAS,CAAC;AAExB,MAAM,eAAe,GAA2B;IAC9C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,UAAU;IAClB,GAAG,EAAE,UAAU;IACf,aAAa,EAAE,UAAU;CAC1B,CAAC;AA2BF,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC/C,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/C,wCAAwC;IACxC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CAC3D,CAAC;QACF,IAAI,KAAK;YAAE,OAAO,OAAO,CAAC;QAC1B,IAAI,OAAO;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,OAAO,CAAC,CAAC,gDAAgD;IAClE,CAAC;IAED,2CAA2C;IAC3C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,KAAK,CACb,mCAAmC,UAAU,wDAAwD,CACtG,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,QAAgB,EAChB,OAAoB;IAEpB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0DAA0D,KAAK,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,uEAAuE;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,KAAK,KAAK;QAC9C,CAAC,CAAC,gBAAgB,CAAC;YACf,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,cAAc,GAAG,CAAC,OAAO,GAAG,KAAK,EAAE,CAAC;SAC3E,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qEAAqE,KAAK,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAuC,CAAC,EAAE,CAAC;QAC9G,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oCAAoC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;IAElE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,QAAQ,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,qCAAqC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,0CAA0C,OAAO,CAAC,KAAK,IAAI,wBAAwB,GAAG,KAAK,EAAE,CAAC,CAAC;YACnH,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,kEAAkE;AAElE,KAAK,UAAU,aAAa,CAC1B,UAAkB,EAClB,QAAgB,EAChB,OAAoB,EACpB,QAA8C;IAE9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,wCAAwC,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,QAAQ;QACR,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,KAAK;QAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACzB,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oDAAoD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CACnC,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAkC,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAuC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,UAAU,GAA2E,EAAE,CAAC;IAC9F,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,SAAS,CAAC,wBAAwB;QACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO;YAC7B,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CACzD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7C,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC;YAChC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC;YAChG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,YAAY,GAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,GAAG,MAAM;YACT,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,QAAQ,CAAC,MAAM;SAC9B,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,MAAM,CAAC,MAAM;YAC7B,gBAAgB,EAAE,YAAY;YAC9B,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACnC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxD,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,KAAK,EAAE;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAC7C;gBACD,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;aACvC,CAAC,CAAC;SACJ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;IAE3E,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,uBAAuB,KAAK,IAAI,CAAC,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,UAAU,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,WAAW,KAAK,CAAC,IAAI,MAAM,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,UAAU,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kEAAkE;AAElE,KAAK,UAAU,cAAc,CAC3B,UAAkB,EAClB,QAAgB,EAChB,OAAoB,EACpB,QAA8C;IAE9C,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAEjD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qCAAqC,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,QAAQ;QACR,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,KAAK;QAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACzB,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oDAAoD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CACnC,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAkC,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAuC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,UAAU,GAAsE,EAAE,CAAC;IACzF,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACrC,IAAI,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qBAAqB,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;YAC9G,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO;YAC7B,CAAC,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC;YAChD,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CACzD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5C,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC;YAChC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC;YAChG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,YAAY,GAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,GAAG,MAAM;YACT,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,QAAQ,CAAC,MAAM;SAC9B,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,SAAS,EAAE,OAAO;YAClB,cAAc,EAAE,UAAU,CAAC,MAAM;YACjC,gBAAgB,EAAE,YAAY;YAC9B,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACnC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvD,IAAI;gBACJ,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;aACvC,CAAC,CAAC;SACJ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;IAEjF,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,uBAAuB,KAAK,IAAI,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,UAAU,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kCAAkC,CAAC,OAAoB;IAC9D,OAAO,6BAA6B,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,kEAAkE;AAElE,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,GAAa;IAC/C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAW;IAClC,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK;QACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;QACzB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,kBAAkB,EAAE,CAAC,CAAC,iBAAiB;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,OAAe,EACf,WAAmB,EACnB,OAAe;IAEf,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,IAAI,gBAAgB,KAAK,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,cAAc,OAAO,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,qFAAqF,KAAK,EAAE,CAAC,CAAC;IAChH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,CAAW;IAC7B,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CACjG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CACpH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scan-handler.js","sourceRoot":"","sources":["../../src/cli/scan-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3E,MAAM,cAAc,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAEvF,cAAc;AACd,MAAM,GAAG,GAAG,UAAU,CAAC;AACvB,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,GAAG,GAAG,SAAS,CAAC;AACtB,MAAM,IAAI,GAAG,SAAS,CAAC;AACvB,MAAM,KAAK,GAAG,SAAS,CAAC;AAExB,MAAM,eAAe,GAA2B;IAC9C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,UAAU;IAClB,GAAG,EAAE,UAAU;IACf,aAAa,EAAE,UAAU;CAC1B,CAAC;AA2BF,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC/C,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/C,wCAAwC;IACxC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CAC3D,CAAC;QACF,IAAI,KAAK;YAAE,OAAO,OAAO,CAAC;QAC1B,IAAI,OAAO;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,OAAO,CAAC,CAAC,gDAAgD;IAClE,CAAC;IAED,2CAA2C;IAC3C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,KAAK,CACb,mCAAmC,UAAU,wDAAwD,CACtG,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,QAAgB,EAChB,OAAoB;IAEpB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0DAA0D,KAAK,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iFAAiF;IACjF,oFAAoF;IACpF,qCAAqC;IACrC,IAAI,QAAyD,CAAC;IAC9D,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,QAAQ,GAAG,gBAAgB,CAAC;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,cAAc,GAAG,CAAC,OAAO,GAAG,KAAK,EAAE,CAAC;aAC3E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,yEAAyE;YACzE,mEAAmE;YACnE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;YAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,kEAAkE,KAAK,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAuC,CAAC,EAAE,CAAC;QAC9G,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oCAAoC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;IAElE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,QAAQ,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,qCAAqC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,0CAA0C,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,kEAAkE;AAElE,KAAK,UAAU,aAAa,CAC1B,UAAkB,EAClB,QAAgB,EAChB,OAAoB,EACpB,QAA8C;IAE9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,wCAAwC,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,QAAQ;QACR,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,KAAK;QAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACzB,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oDAAoD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CACnC,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAkC,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAuC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,UAAU,GAA2E,EAAE,CAAC;IAC9F,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,SAAS,CAAC,wBAAwB;QACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO;YAC7B,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CACzD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7C,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC;YAChC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC;YAChG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,YAAY,GAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,GAAG,MAAM;YACT,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,QAAQ,CAAC,MAAM;SAC9B,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,MAAM,CAAC,MAAM;YAC7B,gBAAgB,EAAE,YAAY;YAC9B,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACnC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxD,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,KAAK,EAAE;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAC7C;gBACD,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;aACvC,CAAC,CAAC;SACJ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;IAE3E,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,uBAAuB,KAAK,IAAI,CAAC,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,UAAU,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,WAAW,KAAK,CAAC,IAAI,MAAM,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,UAAU,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kEAAkE;AAElE,KAAK,UAAU,cAAc,CAC3B,UAAkB,EAClB,QAAgB,EAChB,OAAoB,EACpB,QAA8C;IAE9C,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAEjD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qCAAqC,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,QAAQ;QACR,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,KAAK;QAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACzB,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oDAAoD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CACnC,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAkC,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAuC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,UAAU,GAAsE,EAAE,CAAC;IACzF,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACrC,IAAI,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qBAAqB,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;YAC9G,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO;YAC7B,CAAC,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC;YAChD,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CACzD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5C,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC;YAChC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC;YAChG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,YAAY,GAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,GAAG,MAAM;YACT,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,QAAQ,CAAC,MAAM;SAC9B,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,SAAS,EAAE,OAAO;YAClB,cAAc,EAAE,UAAU,CAAC,MAAM;YACjC,gBAAgB,EAAE,YAAY;YAC9B,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACnC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvD,IAAI;gBACJ,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;aACvC,CAAC,CAAC;SACJ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;IAEjF,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,uBAAuB,KAAK,IAAI,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,UAAU,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kCAAkC,CAAC,OAAoB;IAC9D,OAAO,6BAA6B,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,kEAAkE;AAElE,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,GAAa;IAC/C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAW;IAClC,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK;QACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;QACzB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,kBAAkB,EAAE,CAAC,CAAC,iBAAiB;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,OAAe,EACf,WAAmB,EACnB,OAAe;IAEf,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,IAAI,gBAAgB,KAAK,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,cAAc,OAAO,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,qFAAqF,KAAK,EAAE,CAAC,CAAC;IAChH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,CAAW;IAC7B,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CACjG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CACpH,CAAC;AACJ,CAAC"}

package/dist/cli/tc-pipeline.d.ts

@@ -12,6 +12,26 @@
  * @module agent-threat-rules/cli/tc-pipeline
  */
 export declare function cmdTCSync(options: Record<string, string | undefined>): Promise<void>;
+/** The tags.category enum in spec/atr-schema.yaml: the only directories a pulled rule may go in. */
+export declare const TC_PULL_CATEGORIES: ReadonlySet<string>;
+export type PulledRulePlan = {
+    readonly ok: true;
+    readonly id: string;
+    readonly category: string;
+    readonly slug: string;
+    readonly filePath: string;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/**
+ * Decide where a rule fetched from Threat Cloud may be written. The endpoint's
+ * response is untrusted, and the id and category become a file name and a
+ * directory, so both must have a form a real rule can have. Fields are read
+ * from the parsed YAML: a regex over the text picks up `subcategory:` keys in
+ * compliance blocks before the rule's own tags.
+ */
+export declare function planPulledRule(content: string, rulesDir: string): PulledRulePlan;
 export declare function cmdTCPull(options: Record<string, string | undefined>): Promise<void>;
 export declare function cmdTCCrystallize(options: Record<string, string | undefined>): Promise<void>;
 export declare function cmdTCStatus(options: Record<string, string | undefined>): Promise<void>;

package/dist/cli/tc-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tc-pipeline.d.ts","sourceRoot":"","sources":["../../src/cli/tc-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAoCH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C1F;AAID,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA0G1F;AAID,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFjG;AAID,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiD5F"}
+{"version":3,"file":"tc-pipeline.d.ts","sourceRoot":"","sources":["../../src/cli/tc-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAiDH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C1F;AAID,oGAAoG;AACpG,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAUjD,CAAC;AAQH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvH;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAWpD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CAkBhF;AAYD,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA4G1F;AAID,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFjG;AAID,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiD5F"}

package/dist/cli/tc-pipeline.js

@@ -12,16 +12,27 @@
  * @module agent-threat-rules/cli/tc-pipeline
  */
 import { readFileSync, writeFileSync, existsSync, readdirSync, statSync, mkdirSync, unlinkSync } from 'node:fs';
-import { resolve, join } from 'node:path';
-import { execSync } from 'node:child_process';
+import { resolve, join, dirname } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import yaml from 'js-yaml';
 const RED = '\x1b[31m';
 const GREEN = '\x1b[32m';
 const DIM = '\x1b[2m';
 const BOLD = '\x1b[1m';
 const RESET = '\x1b[0m';
 function getConfig(options) {
+    // No built-in endpoint, for the same reason the reporter has none: this
+    // package must not name a collector. These are operator commands, so failing
+    // here costs one flag; the alternative is a hostname nobody chose.
+    const tcUrl = options['tc-url'] ?? process.env['TC_URL'];
+    if (!tcUrl || !tcUrl.trim()) {
+        console.error(`${RED}Error: no Threat Cloud endpoint. Pass --tc-url <url> or set TC_URL. ` +
+            `ATR ships no default endpoint.${RESET}`);
+        process.exit(1);
+    }
     return {
-        tcUrl: (options['tc-url'] ?? process.env['TC_URL'] ?? 'https://tc.panguard.ai').replace(/\/+$/, ''),
+        tcUrl: tcUrl.trim().replace(/\/+$/, ''),
         adminKey: options['tc-key'] ?? process.env['TC_ADMIN_API_KEY'] ?? process.env['TC_API_KEY'] ?? '',
         rulesDir: resolve(options['rules'] ?? 'rules'),
         dryRun: options['dry-run'] === 'true',
@@ -78,6 +89,62 @@ export async function cmdTCSync(options) {
     console.log(`  TC metrics: ${metrics.data?.totalAtrRules ?? '?'} rules`);
 }
 // ── atr tc pull ───────────────────────────────────────────────
+/** The tags.category enum in spec/atr-schema.yaml: the only directories a pulled rule may go in. */
+export const TC_PULL_CATEGORIES = new Set([
+    'prompt-injection',
+    'tool-poisoning',
+    'context-exfiltration',
+    'agent-manipulation',
+    'privilege-escalation',
+    'excessive-autonomy',
+    'data-poisoning',
+    'model-abuse',
+    'skill-compromise',
+]);
+const RULE_ID_RE = /^ATR-\d{4}-\d{5}$/;
+// The validator is this package's own CLI, found next to this module (dist/cli.js)
+// rather than relative to whatever directory the command runs in.
+const CLI_PATH = fileURLToPath(new URL('../cli.js', import.meta.url));
+function describeValue(value) {
+    return (JSON.stringify(value) ?? String(value)).slice(0, 80);
+}
+/**
+ * Decide where a rule fetched from Threat Cloud may be written. The endpoint's
+ * response is untrusted, and the id and category become a file name and a
+ * directory, so both must have a form a real rule can have. Fields are read
+ * from the parsed YAML: a regex over the text picks up `subcategory:` keys in
+ * compliance blocks before the rule's own tags.
+ */
+export function planPulledRule(content, rulesDir) {
+    let doc;
+    try {
+        doc = (yaml.load(content) ?? {});
+    }
+    catch {
+        return { ok: false, reason: 'not valid YAML' };
+    }
+    const id = doc.id;
+    if (typeof id !== 'string' || !RULE_ID_RE.test(id)) {
+        return { ok: false, reason: `id ${describeValue(id)} is not of the form ATR-YYYY-NNNNN` };
+    }
+    const category = doc.tags?.category;
+    if (typeof category !== 'string' || !TC_PULL_CATEGORIES.has(category)) {
+        return { ok: false, reason: `${id}: category ${describeValue(category)} is not an ATR category` };
+    }
+    const sub = doc.tags?.subcategory;
+    const slug = (typeof sub === 'string' ? sub : id).toLowerCase().replace(/[^a-z0-9-]/g, '-').slice(0, 40);
+    return { ok: true, id, category, slug, filePath: join(rulesDir, category, `${id}-${slug}.yaml`) };
+}
+/** Run the package's rule validator on one file. No shell: the path is a single argv entry. */
+function ruleFileIsValid(filePath) {
+    try {
+        execFileSync(process.execPath, [CLI_PATH, 'validate', filePath], { encoding: 'utf-8', stdio: 'pipe' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export async function cmdTCPull(options) {
     const cfg = getConfig(options);
     const SYNC_FILE = resolve('data/.tc-last-sync');
@@ -147,26 +214,28 @@ export async function cmdTCPull(options) {
         }
         // Auto-fix LLM YAML: double-quoted regex → single-quoted
         content = content.replace(/^(\s+value:\s*)"((?:[^"\\]|\\.)*)"\s*$/gm, (_, prefix, regex) => `${prefix}'${regex.replace(/'/g, "''")}'`);
-        const id = content.match(/^id:\s*(\S+)/m)?.[1] ?? 'unknown';
-        const category = content.match(/category:\s*(\S+)/m)?.[1] ?? 'prompt-injection';
-        const sub = content.match(/subcategory:\s*(\S+)/m)?.[1] ?? id.toLowerCase();
-        const slug = sub.replace(/[^a-z0-9-]/g, '-').slice(0, 40);
-        const catDir = join(cfg.rulesDir, category);
-        if (!existsSync(catDir))
-            mkdirSync(catDir, { recursive: true });
-        const filePath = join(catDir, `${id}-${slug}.yaml`);
+        const plan = planPulledRule(content, cfg.rulesDir);
+        if (!plan.ok) {
+            console.log(`  ${RED}x${RESET} rejected, not written: ${plan.reason}`);
+            continue;
+        }
+        const { id, category, slug, filePath } = plan;
+        // The text match that built existingIds misses a quoted id; never replace a file.
+        if (existingIds.has(id) || existsSync(filePath)) {
+            console.log(`  ${RED}x${RESET} rejected, not written: ${id} is already in the repo`);
+            continue;
+        }
         if (cfg.dryRun) {
             console.log(`  ${DIM}[DRY RUN] ${filePath}${RESET}`);
             continue;
         }
+        mkdirSync(dirname(filePath), { recursive: true });
         writeFileSync(filePath, content);
-        // Validate
-        try {
-            execSync(`node dist/cli.js validate "${filePath}"`, { encoding: 'utf-8', stdio: 'pipe' });
+        if (ruleFileIsValid(filePath)) {
             written.push(filePath);
             console.log(`  ${GREEN}+${RESET} ${id} (${category}/${slug})`);
         }
-        catch {
+        else {
             console.log(`  ${RED}x${RESET} ${id} — invalid, removed`);
             unlinkSync(filePath);
         }