agent-threat-rules 4.0.0 → 4.2.0

package/dist/cli/scan-handler.js

@@ -8,8 +8,10 @@ import { readFileSync, existsSync, statSync, readdirSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { ATREngine } from '../engine.js';
 import { scanResultToSARIF } from '../converters/sarif.js';
-import { createTCReporter } from '../tc-reporter.js';
+import { createTCReporter, resolveTcUrl } from '../tc-reporter.js';
 import { createSemanticJudgeFromConfig } from './semantic-judge-config.js';
+import { isModelDecided } from '../verdict.js';
+import { toolsDocumentToEvents } from './mcp-tools-document.js';
 const SEVERITY_ORDER = ['informational', 'low', 'medium', 'high', 'critical'];
 // ANSI colors
 const RED = '\x1b[31m';
@@ -62,15 +64,27 @@ export async function cmdScanUnified(target, rulesDir, options) {
         console.error(`${RED}Error: Path not found: ${targetPath}${RESET}`);
         process.exit(1);
     }
-    // Threat Cloud reporting is ON by default — use --no-report to disable
-    const reporter = options.reportToCloud !== false
-        ? createTCReporter({
-            tcUrl: options.tcUrl,
-            onError: (err) => console.error(`${DIM}TC upload: ${err.message}${RESET}`),
-        })
-        : undefined;
+    // Threat Cloud reporting is OFF by default. Scanning is a local operation, and a
+    // scan of internal material must not leave the machine because of a default. Opt in
+    // explicitly with --report-to-cloud.
+    let reporter;
+    if (options.reportToCloud === true) {
+        try {
+            reporter = createTCReporter({
+                tcUrl: options.tcUrl,
+                onError: (err) => console.error(`${DIM}TC upload: ${err.message}${RESET}`),
+            });
+        }
+        catch (err) {
+            // No endpoint configured. Refusing here is the point: the alternative is
+            // picking a recipient for the operator, which is what a built-in default
+            // did. Fail with the fix in the message rather than a stack trace.
+            console.error(`${RED}Error: ${err instanceof Error ? err.message : String(err)}${RESET}`);
+            process.exit(1);
+        }
+    }
     if (reporter) {
-        console.error(`${DIM}Threat Cloud: anonymous reporting enabled (--no-report to disable)${RESET}`);
+        console.error(`${DIM}Threat Cloud: anonymous reporting enabled via --report-to-cloud${RESET}`);
     }
     if (options.failOn !== undefined && !SEVERITY_ORDER.includes(options.failOn)) {
         console.error(`${RED}Error: --fail-on must be one of: ${SEVERITY_ORDER.join(', ')}${RESET}`);
@@ -91,7 +105,7 @@ export async function cmdScanUnified(target, rulesDir, options) {
         if (reporter) {
             await reporter.destroy();
             if (!options.json && !options.sarif) {
-                console.log(`${DIM}  Threat Cloud: detections reported to ${options.tcUrl ?? 'https://tc.panguard.ai'}${RESET}`);
+                console.log(`${DIM}  Threat Cloud: detections reported to ${resolveTcUrl(options.tcUrl)}${RESET}`);
             }
         }
     }
@@ -102,6 +116,36 @@ export async function cmdScanUnified(target, rulesDir, options) {
     }
 }
 // ── MCP Event Scan ─────────────────────────────────────────────
+/**
+ * A `.mcp.json` is a configuration document, not an event.
+ *
+ * `atr scan .mcp.json` — the invocation the README shows — parsed the file, wrapped it as one
+ * event, found no `content` on it and skipped it, while the summary still said one event had been
+ * scanned. The rules never saw a single server, so a config that sets `NODE_OPTIONS` to a require
+ * payload came back as `threats_detected: 0` instead of as an error.
+ *
+ * Each server becomes its own event, with the config as its content, which is the shape the MCP
+ * rules evaluate (ATR-2026-02300, the rule written for exactly this `.mcp.json` env-block surface,
+ * fires on it — see tests/cli-mcp-config-scan.test.ts). One event per server also keeps a finding
+ * attributable to a server name.
+ */
+function configDocumentToEvents(parsed) {
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return null;
+    const servers = parsed.mcpServers;
+    if (!servers || typeof servers !== 'object' || Array.isArray(servers))
+        return null;
+    const timestamp = new Date().toISOString();
+    const events = [];
+    for (const [name, config] of Object.entries(servers)) {
+        events.push({
+            type: 'mcp_exchange',
+            timestamp,
+            content: JSON.stringify({ mcpServers: { [name]: config } }),
+        });
+    }
+    return events.length > 0 ? events : null;
+}
 async function scanMcpEvents(eventsPath, rulesDir, options, reporter) {
     const fileStat = statSync(eventsPath);
     if (fileStat.size > 50 * 1024 * 1024) {
@@ -110,9 +154,18 @@ async function scanMcpEvents(eventsPath, rulesDir, options, reporter) {
     }
     const raw = readFileSync(eventsPath, 'utf-8');
     let events;
+    // Whether the input is a tools/list document: every event is then a tool definition, and the
+    // engine is told so (toolDefinitions), so the rules written for a tool being called do not run
+    // on it (src/tool-definition-scope.ts). Config documents and event files are scanned as before.
+    let toolDefinitions = false;
     try {
         const parsed = JSON.parse(raw);
-        events = Array.isArray(parsed) ? parsed : [parsed];
+        // A config document becomes one event per server, a tools/list document one event per
+        // tool; every other input is unchanged.
+        const configEvents = configDocumentToEvents(parsed);
+        const toolEvents = configEvents === null ? toolsDocumentToEvents(parsed) : null;
+        toolDefinitions = toolEvents !== null;
+        events = configEvents ?? toolEvents ?? (Array.isArray(parsed) ? parsed : [parsed]);
     }
     catch {
         console.error(`${RED}Error: Invalid JSON in ${eventsPath}${RESET}`);
@@ -124,7 +177,10 @@ async function scanMcpEvents(eventsPath, rulesDir, options, reporter) {
         reporter,
         semanticJudge: semantic.judge,
         ...(options.lane ? { lane: options.lane } : {}),
+        ...(options.modelDecisions ? { modelDecisions: options.modelDecisions } : {}),
+        ...(toolDefinitions ? { toolDefinitions: true } : {}),
     });
+    const heldBack = (m) => engine.getModelDecisions() === 'advisory' && isModelDecided(m);
     await engine.loadRules();
     if (semantic.enabled && !options.json && !options.sarif) {
         console.error(`${DIM}Semantic judge: enabled for method=semantic rules${RESET}`);
@@ -134,9 +190,14 @@ async function scanMcpEvents(eventsPath, rulesDir, options, reporter) {
     const allResults = [];
     let totalThreats = 0;
     let failHits = 0;
+    let eventsEvaluated = 0;
+    let eventsSkipped = 0;
     for (const event of events) {
-        if (!event.content)
-            continue; // skip malformed events
+        if (!event.content) {
+            eventsSkipped += 1; // skip malformed events, but never silently
+            continue;
+        }
+        eventsEvaluated += 1;
         const result = semantic.enabled
             ? await engine.evaluateFullAsync(event, eventsPath)
             : engine.evaluateFull(event, eventsPath);
@@ -145,48 +206,85 @@ async function scanMcpEvents(eventsPath, rulesDir, options, reporter) {
             allResults.push({ event, result, filtered });
             totalThreats += filtered.length;
             if (failIdx >= 0) {
-                failHits += filtered.filter((m) => SEVERITY_ORDER.indexOf(m.rule.severity) >= failIdx).length;
+                failHits += filtered.filter((m) => !heldBack(m) && SEVERITY_ORDER.indexOf(m.rule.severity) >= failIdx).length;
             }
         }
     }
+    // An event that never reached the engine is not a clean result, and the counts have to say so:
+    // `events_scanned` used to be `events.length`, computed before the skip.
+    if (events.length === 0) {
+        console.error(`${RED}Error: nothing was scanned — the input contains no events and no tools${RESET}`);
+    }
+    else if (eventsEvaluated === 0) {
+        console.error(`${RED}Error: nothing was scanned — ${eventsSkipped} event(s) had no content${RESET}`);
+    }
+    else if (eventsSkipped > 0) {
+        console.error(`${DIM}Warning: ${eventsSkipped} event(s) had no content and were not scanned${RESET}`);
+    }
+    // On a tools/list document some rules do not run (src/tool-definition-scope.ts): say so, and how
+    // many, so "not run" cannot read as "ran and found nothing"; and name the tool of each result.
+    const scope = engine.getToolDefinitionScope();
+    const scopeReport = scope
+        ? { tool_definition_scope: true, rules_evaluated: scope.rulesEvaluated, rules_skipped_by_scope: scope.rulesSkippedByScope }
+        : {};
+    const toolNameOf = (event) => toolDefinitions ? event.fields?.['tool_name'] : undefined;
     if (options.sarif) {
-        const sarifResults = allResults.map(({ result, filtered }) => ({
-            ...result,
-            matches: filtered,
-            threat_count: filtered.length,
-        }));
+        const toolNames = new Map();
+        const sarifResults = allResults.map(({ event, result, filtered }) => {
+            const scoped = { ...result, matches: filtered, threat_count: filtered.length };
+            const name = toolNameOf(event);
+            if (name !== undefined)
+                toolNames.set(scoped, name);
+            return scoped;
+        });
         const version = process.env['npm_package_version'] ?? '1.0.0';
-        console.log(JSON.stringify(scanResultToSARIF(sarifResults, version), null, 2));
-        return failHits;
+        console.log(JSON.stringify(scanResultToSARIF(sarifResults, version, {
+            heldBack,
+            ...(scope ? { runProperties: scopeReport } : {}),
+            resultProperties: (r) => (toolNames.has(r) ? { tool_name: toolNames.get(r) } : undefined),
+        }), null, 2));
+        return eventsEvaluated === 0 ? 1 : failHits;
     }
     if (options.json) {
         console.log(JSON.stringify({
             scan_type: 'mcp',
-            events_scanned: events.length,
+            events_scanned: eventsEvaluated,
+            events_skipped: eventsSkipped,
             threats_detected: totalThreats,
             rules_loaded: engine.getRuleCount(),
-            results: allResults.map(({ event, result, filtered }) => ({
-                content_hash: result.content_hash,
-                event: {
-                    type: event.type,
-                    timestamp: event.timestamp,
-                    content_preview: event.content.slice(0, 100),
-                },
-                matches: filtered.map(formatMatchJson),
-            })),
+            ...scopeReport,
+            results: allResults.map(({ event, result, filtered }) => {
+                const toolName = toolNameOf(event);
+                return {
+                    content_hash: result.content_hash,
+                    event: {
+                        type: event.type,
+                        timestamp: event.timestamp,
+                        ...(toolName !== undefined ? { tool_name: toolName } : {}),
+                        content_preview: event.content.slice(0, 100),
+                    },
+                    matches: filtered.map((m) => formatMatchJson(m, heldBack(m))),
+                };
+            }),
         }, null, 2));
-        return failHits;
+        return eventsEvaluated === 0 ? 1 : failHits;
+    }
+    printScanHeader('MCP', eventsEvaluated, engine.getRuleCount(), totalThreats);
+    if (scope) {
+        console.log(`${DIM}  Tool definitions: ${scope.rulesSkippedByScope} rule(s) written for a tool being called were not run; ${scope.rulesEvaluated} were.${RESET}\n`);
     }
-    printScanHeader('MCP', events.length, engine.getRuleCount(), totalThreats);
     if (totalThreats === 0) {
-        console.log(`${GREEN}No threats detected.${RESET}\n`);
-        return failHits;
+        console.log(eventsEvaluated === 0
+            ? `${RED}Nothing was scanned.${RESET}\n`
+            : `${GREEN}No threats detected.${RESET}\n`);
+        return eventsEvaluated === 0 ? 1 : failHits;
     }
     for (const { event, filtered } of allResults) {
         const preview = event.content.slice(0, 80).replace(/\n/g, ' ');
-        console.log(`  ${DIM}Event: [${event.type}] "${preview}..."${RESET}`);
+        const toolName = toolNameOf(event);
+        console.log(`  ${DIM}Event: [${event.type}]${toolName !== undefined ? ` tool ${toolName}` : ''} "${preview}..."${RESET}`);
         for (const m of filtered) {
-            printMatch(m);
+            printMatch(m, heldBack(m));
         }
         console.log('');
     }
@@ -205,7 +303,9 @@ async function scanSkillFiles(targetPath, rulesDir, options, reporter) {
         reporter,
         semanticJudge: semantic.judge,
         ...(options.lane ? { lane: options.lane } : {}),
+        ...(options.modelDecisions ? { modelDecisions: options.modelDecisions } : {}),
     });
+    const heldBack = (m) => engine.getModelDecisions() === 'advisory' && isModelDecided(m);
     await engine.loadRules();
     if (semantic.enabled && !options.json && !options.sarif) {
         console.error(`${DIM}Semantic judge: enabled for method=semantic rules${RESET}`);
@@ -230,7 +330,7 @@ async function scanSkillFiles(targetPath, rulesDir, options, reporter) {
             allResults.push({ file, result, filtered });
             totalThreats += filtered.length;
             if (failIdx >= 0) {
-                failHits += filtered.filter((m) => SEVERITY_ORDER.indexOf(m.rule.severity) >= failIdx).length;
+                failHits += filtered.filter((m) => !heldBack(m) && SEVERITY_ORDER.indexOf(m.rule.severity) >= failIdx).length;
             }
         }
     }
@@ -241,7 +341,7 @@ async function scanSkillFiles(targetPath, rulesDir, options, reporter) {
             threat_count: filtered.length,
         }));
         const version = process.env['npm_package_version'] ?? '1.0.0';
-        console.log(JSON.stringify(scanResultToSARIF(sarifResults, version), null, 2));
+        console.log(JSON.stringify(scanResultToSARIF(sarifResults, version, { heldBack }), null, 2));
         return failHits;
     }
     if (options.json) {
@@ -253,7 +353,7 @@ async function scanSkillFiles(targetPath, rulesDir, options, reporter) {
             results: allResults.map(({ file, result, filtered }) => ({
                 file,
                 content_hash: result.content_hash,
-                matches: filtered.map(formatMatchJson),
+                matches: filtered.map((m) => formatMatchJson(m, heldBack(m))),
             })),
         }, null, 2));
         return failHits;
@@ -267,7 +367,7 @@ async function scanSkillFiles(targetPath, rulesDir, options, reporter) {
         const relPath = file.replace(process.cwd() + '/', '');
         console.log(`  ${BOLD}${relPath}${RESET}`);
         for (const m of filtered) {
-            printMatch(m);
+            printMatch(m, heldBack(m));
         }
         console.log('');
     }
@@ -306,13 +406,16 @@ function walkForSkills(dir, out) {
         }
     }
 }
-function formatMatchJson(m) {
+function formatMatchJson(m, heldBack) {
     return {
         rule_id: m.rule.id,
         title: m.rule.title,
         severity: m.rule.severity,
         confidence: m.confidence,
         matched_conditions: m.matchedConditions,
+        decided_by: m.decidedBy ?? null,
+        // false: a model decided it and it does not count toward --fail-on.
+        enforced: !heldBack,
     };
 }
 function printScanHeader(type, scanned, rulesLoaded, threats) {
@@ -326,9 +429,10 @@ function printScanHeader(type, scanned, rulesLoaded, threats) {
     console.log(`${DIM}  Open source (MIT). Star: https://github.com/Agent-Threat-Rule/agent-threat-rules${RESET}`);
     console.log('');
 }
-function printMatch(m) {
+function printMatch(m, heldBack) {
     const color = SEVERITY_COLORS[m.rule.severity] ?? '';
-    console.log(`    ${color}${m.rule.severity.toUpperCase().padEnd(13)}${RESET} ${m.rule.id} - ${m.rule.title}`);
+    const note = heldBack ? ` ${DIM}(decided by ${m.decidedBy}: reported, not counted toward --fail-on)${RESET}` : '';
+    console.log(`    ${color}${m.rule.severity.toUpperCase().padEnd(13)}${RESET} ${m.rule.id} - ${m.rule.title}${note}`);
     console.log(`    ${DIM}Confidence: ${(m.confidence * 100).toFixed(0)}% | Conditions: ${m.matchedConditions.join(', ')}${RESET}`);
 }
 //# sourceMappingURL=scan-handler.js.map

package/dist/cli/scan-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan-handler.js","sourceRoot":"","sources":["../../src/cli/scan-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3E,MAAM,cAAc,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAEvF,cAAc;AACd,MAAM,GAAG,GAAG,UAAU,CAAC;AACvB,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,GAAG,GAAG,SAAS,CAAC;AACtB,MAAM,IAAI,GAAG,SAAS,CAAC;AACvB,MAAM,KAAK,GAAG,SAAS,CAAC;AAExB,MAAM,eAAe,GAA2B;IAC9C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,UAAU;IAClB,GAAG,EAAE,UAAU;IACf,aAAa,EAAE,UAAU;CAC1B,CAAC;AA2BF,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC/C,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/C,wCAAwC;IACxC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CAC3D,CAAC;QACF,IAAI,KAAK;YAAE,OAAO,OAAO,CAAC;QAC1B,IAAI,OAAO;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,OAAO,CAAC,CAAC,gDAAgD;IAClE,CAAC;IAED,2CAA2C;IAC3C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,KAAK,CACb,mCAAmC,UAAU,wDAAwD,CACtG,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,QAAgB,EAChB,OAAoB;IAEpB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0DAA0D,KAAK,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,uEAAuE;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,KAAK,KAAK;QAC9C,CAAC,CAAC,gBAAgB,CAAC;YACf,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,cAAc,GAAG,CAAC,OAAO,GAAG,KAAK,EAAE,CAAC;SAC3E,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qEAAqE,KAAK,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAuC,CAAC,EAAE,CAAC;QAC9G,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oCAAoC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;IAElE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,QAAQ,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,qCAAqC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,0CAA0C,OAAO,CAAC,KAAK,IAAI,wBAAwB,GAAG,KAAK,EAAE,CAAC,CAAC;YACnH,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,kEAAkE;AAElE,KAAK,UAAU,aAAa,CAC1B,UAAkB,EAClB,QAAgB,EAChB,OAAoB,EACpB,QAA8C;IAE9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,wCAAwC,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,QAAQ;QACR,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,KAAK;QAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACzB,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oDAAoD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CACnC,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAkC,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAuC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,UAAU,GAA2E,EAAE,CAAC;IAC9F,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,SAAS,CAAC,wBAAwB;QACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO;YAC7B,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CACzD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7C,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC;YAChC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC;YAChG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,YAAY,GAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,GAAG,MAAM;YACT,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,QAAQ,CAAC,MAAM;SAC9B,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,MAAM,CAAC,MAAM;YAC7B,gBAAgB,EAAE,YAAY;YAC9B,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACnC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxD,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,KAAK,EAAE;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAC7C;gBACD,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;aACvC,CAAC,CAAC;SACJ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;IAE3E,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,uBAAuB,KAAK,IAAI,CAAC,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,UAAU,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,WAAW,KAAK,CAAC,IAAI,MAAM,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,UAAU,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kEAAkE;AAElE,KAAK,UAAU,cAAc,CAC3B,UAAkB,EAClB,QAAgB,EAChB,OAAoB,EACpB,QAA8C;IAE9C,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAEjD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qCAAqC,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,QAAQ;QACR,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,KAAK;QAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACzB,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oDAAoD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CACnC,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAkC,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAuC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,UAAU,GAAsE,EAAE,CAAC;IACzF,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACrC,IAAI,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qBAAqB,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;YAC9G,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO;YAC7B,CAAC,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC;YAChD,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CACzD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5C,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC;YAChC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC;YAChG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,YAAY,GAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,GAAG,MAAM;YACT,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,QAAQ,CAAC,MAAM;SAC9B,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,SAAS,EAAE,OAAO;YAClB,cAAc,EAAE,UAAU,CAAC,MAAM;YACjC,gBAAgB,EAAE,YAAY;YAC9B,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACnC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvD,IAAI;gBACJ,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;aACvC,CAAC,CAAC;SACJ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;IAEjF,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,uBAAuB,KAAK,IAAI,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,UAAU,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kCAAkC,CAAC,OAAoB;IAC9D,OAAO,6BAA6B,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,kEAAkE;AAElE,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,GAAa;IAC/C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAW;IAClC,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK;QACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;QACzB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,kBAAkB,EAAE,CAAC,CAAC,iBAAiB;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,OAAe,EACf,WAAmB,EACnB,OAAe;IAEf,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,IAAI,gBAAgB,KAAK,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,cAAc,OAAO,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,qFAAqF,KAAK,EAAE,CAAC,CAAC;IAChH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,CAAW;IAC7B,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CACjG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CACpH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scan-handler.js","sourceRoot":"","sources":["../../src/cli/scan-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAuB,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,MAAM,cAAc,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAEvF,cAAc;AACd,MAAM,GAAG,GAAG,UAAU,CAAC;AACvB,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,GAAG,GAAG,SAAS,CAAC;AACtB,MAAM,IAAI,GAAG,SAAS,CAAC;AACvB,MAAM,KAAK,GAAG,SAAS,CAAC;AAExB,MAAM,eAAe,GAA2B;IAC9C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,UAAU;IAClB,GAAG,EAAE,UAAU;IACf,aAAa,EAAE,UAAU;CAC1B,CAAC;AAkCF,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC/C,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/C,wCAAwC;IACxC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CAC3D,CAAC;QACF,IAAI,KAAK;YAAE,OAAO,OAAO,CAAC;QAC1B,IAAI,OAAO;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,OAAO,CAAC,CAAC,gDAAgD;IAClE,CAAC;IAED,2CAA2C;IAC3C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,KAAK,CACb,mCAAmC,UAAU,wDAAwD,CACtG,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,QAAgB,EAChB,OAAoB;IAEpB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0DAA0D,KAAK,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iFAAiF;IACjF,oFAAoF;IACpF,qCAAqC;IACrC,IAAI,QAAyD,CAAC;IAC9D,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,QAAQ,GAAG,gBAAgB,CAAC;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,cAAc,GAAG,CAAC,OAAO,GAAG,KAAK,EAAE,CAAC;aAC3E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,yEAAyE;YACzE,mEAAmE;YACnE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;YAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,kEAAkE,KAAK,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAuC,CAAC,EAAE,CAAC;QAC9G,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oCAAoC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;IAElE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,QAAQ,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,qCAAqC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,0CAA0C,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,kEAAkE;AAElE;;;;;;;;;;;;GAYG;AACH,SAAS,sBAAsB,CAAC,MAAe;IAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,OAAO,GAAI,MAAmC,CAAC,UAAU,CAAC;IAChE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,UAAkB,EAClB,QAAgB,EAChB,OAAoB,EACpB,QAA8C;IAE9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,wCAAwC,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAoB,CAAC;IACzB,6FAA6F;IAC7F,+FAA+F;IAC/F,gGAAgG;IAChG,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,sFAAsF;QACtF,wCAAwC;QACxC,MAAM,YAAY,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,eAAe,GAAG,UAAU,KAAK,IAAI,CAAC;QACtC,MAAM,GAAG,YAAY,IAAI,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,QAAQ;QACR,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,KAAK;QAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,UAAU,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC;IAC1G,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACzB,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oDAAoD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CACnC,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAkC,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAuC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,UAAU,GAA2E,EAAE,CAAC;IAC9F,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,aAAa,IAAI,CAAC,CAAC,CAAC,4CAA4C;YAChE,SAAS;QACX,CAAC;QACD,eAAe,IAAI,CAAC,CAAC;QACrB,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO;YAC7B,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CACzD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7C,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC;YAChC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,QAAQ,IAAI,QAAQ,CAAC,MAAM,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAC1E,CAAC,MAAM,CAAC;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,yEAAyE;IACzE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,yEAAyE,KAAK,EAAE,CAAC,CAAC;IACxG,CAAC;SAAM,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,gCAAgC,aAAa,2BAA2B,KAAK,EAAE,CAAC,CAAC;IACvG,CAAC;SAAM,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,aAAa,gDAAgD,KAAK,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,iGAAiG;IACjG,+FAA+F;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,KAAK;QACvB,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC,cAAc,EAAE,sBAAsB,EAAE,KAAK,CAAC,mBAAmB,EAAE;QAC3H,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,CAAC,KAAiB,EAAsB,EAAE,CAC3D,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE5D,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;QAChD,MAAM,YAAY,GAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;YAChF,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC/E,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACpD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,YAAY,EAAE,OAAO,EAAE;YAClE,QAAQ;YACR,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;SAC1F,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACd,OAAO,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,eAAe;YAC/B,cAAc,EAAE,aAAa;YAC7B,gBAAgB,EAAE,YAAY;YAC9B,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACnC,GAAG,WAAW;YACd,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;gBACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;gBACnC,OAAO;oBACL,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,KAAK,EAAE;wBACL,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1D,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;qBAC7C;oBACD,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC9D,CAAC;YACJ,CAAC,CAAC;SACH,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED,eAAe,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;IAC7E,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,uBAAuB,KAAK,CAAC,mBAAmB,0DAA0D,KAAK,CAAC,cAAc,SAAS,KAAK,IAAI,CAAC,CAAC;IACtK,CAAC;IAED,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC;YAC/B,CAAC,CAAC,GAAG,GAAG,uBAAuB,KAAK,IAAI;YACxC,CAAC,CAAC,GAAG,KAAK,uBAAuB,KAAK,IAAI,CAAC,CAAC;QAC9C,OAAO,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED,KAAK,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,UAAU,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,WAAW,KAAK,CAAC,IAAI,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC;QAC1H,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kEAAkE;AAElE,KAAK,UAAU,cAAc,CAC3B,UAAkB,EAClB,QAAgB,EAChB,OAAoB,EACpB,QAA8C;IAE9C,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAEjD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qCAAqC,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,QAAQ;QACR,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,KAAK;QAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,UAAU,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC;IAC1G,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACzB,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oDAAoD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CACnC,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAkC,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAuC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,UAAU,GAAsE,EAAE,CAAC;IACzF,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACrC,IAAI,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,qBAAqB,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;YAC9G,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO;YAC7B,CAAC,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC;YAChD,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CACzD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5C,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC;YAChC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,QAAQ,IAAI,QAAQ,CAAC,MAAM,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAC1E,CAAC,MAAM,CAAC;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,YAAY,GAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,GAAG,MAAM;YACT,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,QAAQ,CAAC,MAAM;SAC9B,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,SAAS,EAAE,OAAO;YAClB,cAAc,EAAE,UAAU,CAAC,MAAM;YACjC,gBAAgB,EAAE,YAAY;YAC9B,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACnC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBACvD,IAAI;gBACJ,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;aAC9D,CAAC,CAAC;SACJ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;IAEjF,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,uBAAuB,KAAK,IAAI,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kCAAkC,CAAC,OAAoB;IAC9D,OAAO,6BAA6B,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,kEAAkE;AAElE,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,GAAa;IAC/C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAW,EAAE,QAAiB;IACrD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK;QACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;QACzB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,kBAAkB,EAAE,CAAC,CAAC,iBAAiB;QACvC,UAAU,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC/B,oEAAoE;QACpE,QAAQ,EAAE,CAAC,QAAQ;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,OAAe,EACf,WAAmB,EACnB,OAAe;IAEf,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,IAAI,gBAAgB,KAAK,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,cAAc,OAAO,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,qFAAqF,KAAK,EAAE,CAAC,CAAC;IAChH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,CAAW,EAAE,QAAiB;IAChD,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,eAAe,CAAC,CAAC,SAAS,4CAA4C,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,CACxG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CACpH,CAAC;AACJ,CAAC"}

package/dist/cli/tc-pipeline.d.ts

@@ -12,6 +12,26 @@
  * @module agent-threat-rules/cli/tc-pipeline
  */
 export declare function cmdTCSync(options: Record<string, string | undefined>): Promise<void>;
+/** The tags.category enum in spec/atr-schema.yaml: the only directories a pulled rule may go in. */
+export declare const TC_PULL_CATEGORIES: ReadonlySet<string>;
+export type PulledRulePlan = {
+    readonly ok: true;
+    readonly id: string;
+    readonly category: string;
+    readonly slug: string;
+    readonly filePath: string;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/**
+ * Decide where a rule fetched from Threat Cloud may be written. The endpoint's
+ * response is untrusted, and the id and category become a file name and a
+ * directory, so both must have a form a real rule can have. Fields are read
+ * from the parsed YAML: a regex over the text picks up `subcategory:` keys in
+ * compliance blocks before the rule's own tags.
+ */
+export declare function planPulledRule(content: string, rulesDir: string): PulledRulePlan;
 export declare function cmdTCPull(options: Record<string, string | undefined>): Promise<void>;
 export declare function cmdTCCrystallize(options: Record<string, string | undefined>): Promise<void>;
 export declare function cmdTCStatus(options: Record<string, string | undefined>): Promise<void>;

package/dist/cli/tc-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tc-pipeline.d.ts","sourceRoot":"","sources":["../../src/cli/tc-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAoCH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C1F;AAID,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA0G1F;AAID,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFjG;AAID,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiD5F"}
+{"version":3,"file":"tc-pipeline.d.ts","sourceRoot":"","sources":["../../src/cli/tc-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAiDH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C1F;AAID,oGAAoG;AACpG,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAUjD,CAAC;AAQH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvH;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAWpD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CAkBhF;AAYD,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA4G1F;AAID,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFjG;AAID,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiD5F"}

package/dist/cli/tc-pipeline.js

@@ -12,16 +12,27 @@
  * @module agent-threat-rules/cli/tc-pipeline
  */
 import { readFileSync, writeFileSync, existsSync, readdirSync, statSync, mkdirSync, unlinkSync } from 'node:fs';
-import { resolve, join } from 'node:path';
-import { execSync } from 'node:child_process';
+import { resolve, join, dirname } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import yaml from 'js-yaml';
 const RED = '\x1b[31m';
 const GREEN = '\x1b[32m';
 const DIM = '\x1b[2m';
 const BOLD = '\x1b[1m';
 const RESET = '\x1b[0m';
 function getConfig(options) {
+    // No built-in endpoint, for the same reason the reporter has none: this
+    // package must not name a collector. These are operator commands, so failing
+    // here costs one flag; the alternative is a hostname nobody chose.
+    const tcUrl = options['tc-url'] ?? process.env['TC_URL'];
+    if (!tcUrl || !tcUrl.trim()) {
+        console.error(`${RED}Error: no Threat Cloud endpoint. Pass --tc-url <url> or set TC_URL. ` +
+            `ATR ships no default endpoint.${RESET}`);
+        process.exit(1);
+    }
     return {
-        tcUrl: (options['tc-url'] ?? process.env['TC_URL'] ?? 'https://tc.panguard.ai').replace(/\/+$/, ''),
+        tcUrl: tcUrl.trim().replace(/\/+$/, ''),
         adminKey: options['tc-key'] ?? process.env['TC_ADMIN_API_KEY'] ?? process.env['TC_API_KEY'] ?? '',
         rulesDir: resolve(options['rules'] ?? 'rules'),
         dryRun: options['dry-run'] === 'true',
@@ -78,6 +89,62 @@ export async function cmdTCSync(options) {
     console.log(`  TC metrics: ${metrics.data?.totalAtrRules ?? '?'} rules`);
 }
 // ── atr tc pull ───────────────────────────────────────────────
+/** The tags.category enum in spec/atr-schema.yaml: the only directories a pulled rule may go in. */
+export const TC_PULL_CATEGORIES = new Set([
+    'prompt-injection',
+    'tool-poisoning',
+    'context-exfiltration',
+    'agent-manipulation',
+    'privilege-escalation',
+    'excessive-autonomy',
+    'data-poisoning',
+    'model-abuse',
+    'skill-compromise',
+]);
+const RULE_ID_RE = /^ATR-\d{4}-\d{5}$/;
+// The validator is this package's own CLI, found next to this module (dist/cli.js)
+// rather than relative to whatever directory the command runs in.
+const CLI_PATH = fileURLToPath(new URL('../cli.js', import.meta.url));
+function describeValue(value) {
+    return (JSON.stringify(value) ?? String(value)).slice(0, 80);
+}
+/**
+ * Decide where a rule fetched from Threat Cloud may be written. The endpoint's
+ * response is untrusted, and the id and category become a file name and a
+ * directory, so both must have a form a real rule can have. Fields are read
+ * from the parsed YAML: a regex over the text picks up `subcategory:` keys in
+ * compliance blocks before the rule's own tags.
+ */
+export function planPulledRule(content, rulesDir) {
+    let doc;
+    try {
+        doc = (yaml.load(content) ?? {});
+    }
+    catch {
+        return { ok: false, reason: 'not valid YAML' };
+    }
+    const id = doc.id;
+    if (typeof id !== 'string' || !RULE_ID_RE.test(id)) {
+        return { ok: false, reason: `id ${describeValue(id)} is not of the form ATR-YYYY-NNNNN` };
+    }
+    const category = doc.tags?.category;
+    if (typeof category !== 'string' || !TC_PULL_CATEGORIES.has(category)) {
+        return { ok: false, reason: `${id}: category ${describeValue(category)} is not an ATR category` };
+    }
+    const sub = doc.tags?.subcategory;
+    const slug = (typeof sub === 'string' ? sub : id).toLowerCase().replace(/[^a-z0-9-]/g, '-').slice(0, 40);
+    return { ok: true, id, category, slug, filePath: join(rulesDir, category, `${id}-${slug}.yaml`) };
+}
+/** Run the package's rule validator on one file. No shell: the path is a single argv entry. */
+function ruleFileIsValid(filePath) {
+    try {
+        execFileSync(process.execPath, [CLI_PATH, 'validate', filePath], { encoding: 'utf-8', stdio: 'pipe' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export async function cmdTCPull(options) {
     const cfg = getConfig(options);
     const SYNC_FILE = resolve('data/.tc-last-sync');
@@ -147,26 +214,28 @@ export async function cmdTCPull(options) {
         }
         // Auto-fix LLM YAML: double-quoted regex → single-quoted
         content = content.replace(/^(\s+value:\s*)"((?:[^"\\]|\\.)*)"\s*$/gm, (_, prefix, regex) => `${prefix}'${regex.replace(/'/g, "''")}'`);
-        const id = content.match(/^id:\s*(\S+)/m)?.[1] ?? 'unknown';
-        const category = content.match(/category:\s*(\S+)/m)?.[1] ?? 'prompt-injection';
-        const sub = content.match(/subcategory:\s*(\S+)/m)?.[1] ?? id.toLowerCase();
-        const slug = sub.replace(/[^a-z0-9-]/g, '-').slice(0, 40);
-        const catDir = join(cfg.rulesDir, category);
-        if (!existsSync(catDir))
-            mkdirSync(catDir, { recursive: true });
-        const filePath = join(catDir, `${id}-${slug}.yaml`);
+        const plan = planPulledRule(content, cfg.rulesDir);
+        if (!plan.ok) {
+            console.log(`  ${RED}x${RESET} rejected, not written: ${plan.reason}`);
+            continue;
+        }
+        const { id, category, slug, filePath } = plan;
+        // The text match that built existingIds misses a quoted id; never replace a file.
+        if (existingIds.has(id) || existsSync(filePath)) {
+            console.log(`  ${RED}x${RESET} rejected, not written: ${id} is already in the repo`);
+            continue;
+        }
         if (cfg.dryRun) {
             console.log(`  ${DIM}[DRY RUN] ${filePath}${RESET}`);
             continue;
         }
+        mkdirSync(dirname(filePath), { recursive: true });
         writeFileSync(filePath, content);
-        // Validate
-        try {
-            execSync(`node dist/cli.js validate "${filePath}"`, { encoding: 'utf-8', stdio: 'pipe' });
+        if (ruleFileIsValid(filePath)) {
             written.push(filePath);
             console.log(`  ${GREEN}+${RESET} ${id} (${category}/${slug})`);
         }
-        catch {
+        else {
             console.log(`  ${RED}x${RESET} ${id} — invalid, removed`);
             unlinkSync(filePath);
         }