agent-threat-rules 4.2.3 → 4.3.0

package/dist/converters/numbat.js

@@ -0,0 +1,281 @@
+/**
+ * ATR-to-numbat converter
+ *
+ * Exports ATR rules as numbat operator rules: one YAML rule file per ATR rule,
+ * plus a companion `_tests.yaml` built from the rule's own test cases, so
+ * `numbat rules check --rules-dir <dir>` runs ATR's true positives and true
+ * negatives through numbat's RE2 matcher.
+ *
+ * Field mapping (numbat event model, schema 0.5.0):
+ *   user_input     -> prompt.user content, and tool_result of a tool result
+ *   agent_output   -> message.assistant content, and tool_result of a tool
+ *                     result (the ATR engine reads both on tool output, so
+ *                     indirect injection riding in on a tool result is seen)
+ *   tool_args      -> tool_input of a tool request (tool.call, command.exec,
+ *                     file.*, network.indicator)
+ *   tool_response  -> tool_result of a tool result (tool.result, command.result)
+ *   tool_name      -> tool_name of a tool request or result
+ *   content        -> the event's own text: content on prompt.user and
+ *                     message.assistant, tool_input on a request, tool_result
+ *                     on a result
+ *
+ * What does not carry over:
+ *   - Conditions on other fields, and patterns RE2 cannot express, are
+ *     dropped. A rule whose detection is "all" loses its meaning if any
+ *     condition is dropped, so it is skipped; an "any" rule keeps the
+ *     conditions that convert.
+ *   - The ATR engine folds Unicode confusables and normalizes NFKC/NFC before
+ *     matching; numbat matches the raw text, so obfuscated input can match in
+ *     ATR and not here.
+ *   - JavaScript and RE2 differ in a few classes: JS `\s` also matches NBSP,
+ *     U+2028 and the BOM, JS `.` excludes `\r`, and a JS pattern without the
+ *     `u` flag counts an astral character as two. The companion tests catch
+ *     a difference only where a test case exercises it.
+ *   - Rules are monitor-only (`enforce: false`); blocking is an operator
+ *     decision in numbat.
+ *
+ * @module agent-threat-rules/converters/numbat
+ */
+import yaml from 'js-yaml';
+import { regexConditionSpec } from '../regex-dialect.js';
+import { toRe2 } from '../re2.js';
+import { laneAllows, requiresConfirm } from '../quality/rule-contract.js';
+const REQUEST_TYPES = ['tool.call', 'command.exec', 'file.read', 'file.write', 'file.delete', 'network.indicator'];
+const RESULT_TYPES = ['tool.result', 'command.result'];
+/** numbat field name and the event types it is read on, per ATR field. */
+const FIELD_TARGETS = {
+    user_input: [
+        ['content', ['prompt.user']],
+        ['tool_result', RESULT_TYPES],
+    ],
+    agent_output: [
+        ['content', ['message.assistant']],
+        ['tool_result', RESULT_TYPES],
+    ],
+    tool_args: [['tool_input', REQUEST_TYPES]],
+    tool_response: [['tool_result', RESULT_TYPES]],
+    tool_name: [['tool_name', [...REQUEST_TYPES, ...RESULT_TYPES]]],
+    content: [
+        ['content', ['prompt.user', 'message.assistant']],
+        ['tool_input', REQUEST_TYPES],
+        ['tool_result', RESULT_TYPES],
+    ],
+};
+const SEVERITY = {
+    critical: 'critical',
+    high: 'high',
+    medium: 'medium',
+    low: 'low',
+    informational: 'info',
+    info: 'info',
+};
+/** numbat rule id for an ATR id: `atr.atr-2026-00432`. */
+export function numbatRuleId(atrId) {
+    return `atr.${atrId.toLowerCase()}`;
+}
+/** A CEL double-quoted string literal. */
+function celString(s) {
+    const escaped = s
+        .replace(/\\/g, '\\\\')
+        .replace(/"/g, '\\"')
+        .replace(/\n/g, '\\n')
+        .replace(/\r/g, '\\r')
+        .replace(/\t/g, '\\t');
+    return `"${escaped}"`;
+}
+function typeTest(types) {
+    return types.length === 1
+        ? `event.event_type == ${celString(types[0])}`
+        : `event.event_type in [${types.map(celString).join(', ')}]`;
+}
+/** One ATR regex condition as CEL, or null when it cannot be converted. */
+function convertCondition(cond) {
+    const targets = FIELD_TARGETS[cond.field];
+    if (!targets || cond.operator !== 'regex' || !cond.value)
+        return null;
+    const spec = regexConditionSpec(cond.value);
+    const source = toRe2(spec.source);
+    if (source === null)
+        return null;
+    let js;
+    try {
+        js = new RegExp(spec.source, spec.flags);
+    }
+    catch {
+        return null; // the ATR engine cannot compile it either
+    }
+    // SPEC §6.4: every condition matches case-insensitively.
+    const pattern = celString(`(?i)${source}`);
+    const branches = targets.map(([field, types]) => `(${typeTest(types)} && event.${field}.matches(${pattern}))`);
+    return {
+        cel: branches.length === 1 ? branches[0] : `(${branches.join(' || ')})`,
+        targets,
+        js,
+    };
+}
+/** Does a converted condition match this test event? */
+function conditionMatches(cond, event) {
+    return cond.targets.some(([field, types]) => {
+        const value = event[field];
+        return types.includes(String(event['event_type'])) && typeof value === 'string' && cond.js.test(value);
+    });
+}
+/** Is there one numbat event type that every condition can read? */
+function shareAnEventType(conditions) {
+    const typesOf = (c) => new Set(c.targets.flatMap(([, types]) => types));
+    const [first, ...rest] = conditions.map(typesOf);
+    return [...(first ?? [])].some((t) => rest.every((types) => types.has(t)));
+}
+function arrayConditions(rule) {
+    return Array.isArray(rule.detection.conditions) ? rule.detection.conditions : null;
+}
+const utf8Bytes = (s) => Buffer.byteLength(s, 'utf8');
+/**
+ * The event a plain-text test case stands for. ATR's `input` key is the text
+ * of whatever the rule reads, so a rule that reads only tool output gets a
+ * tool result, and one that reads only tool arguments gets a tool call.
+ */
+function plainTextEventType(fields) {
+    // A named field says which event the text belongs to; `content` alone does not.
+    if (fields.has('tool_response'))
+        return 'tool.result';
+    if (fields.has('tool_args'))
+        return 'tool.call';
+    if (fields.has('user_input'))
+        return 'prompt.user';
+    if (fields.has('agent_output'))
+        return 'message.assistant';
+    return 'prompt.user';
+}
+/** One numbat test event per ATR test case, or null when the case has no mappable field. */
+function testEvent(tc, fields) {
+    const str = (v) => (typeof v === 'string' ? v : JSON.stringify(v));
+    const name = typeof tc['tool_name'] === 'string' ? tc['tool_name'] : 'atr-test-tool';
+    if (tc['tool_args'] !== undefined) {
+        const input = str(tc['tool_args']);
+        return { event_type: 'tool.call', tool_name: name, tool_input: input, tool_input_bytes: utf8Bytes(input) };
+    }
+    if (tc['tool_response'] !== undefined) {
+        const result = str(tc['tool_response']);
+        return { event_type: 'tool.result', tool_name: name, tool_result: result, tool_result_bytes: utf8Bytes(result) };
+    }
+    const message = (type, text) => ({ event_type: type, content: text, content_bytes: utf8Bytes(text) });
+    if (typeof tc['agent_output'] === 'string')
+        return message('message.assistant', tc['agent_output']);
+    const text = tc['user_input'] ?? tc['input'] ?? tc['content'];
+    if (typeof text !== 'string')
+        return null;
+    const type = plainTextEventType(fields);
+    if (type === 'tool.result')
+        return { event_type: type, tool_name: name, tool_result: text, tool_result_bytes: utf8Bytes(text) };
+    if (type === 'tool.call')
+        return { event_type: type, tool_name: name, tool_input: text, tool_input_bytes: utf8Bytes(text) };
+    return message(type, text);
+}
+/**
+ * The companion test file. A true positive that only a dropped condition
+ * caught would fail in numbat, so it is left out and reported instead.
+ */
+function companionTests(rule, id, converted, logic) {
+    const fields = new Set(arrayConditions(rule)?.map((c) => c.field) ?? []);
+    const cases = [];
+    const uncovered = [];
+    const unmapped = [];
+    const matches = (event) => logic === 'all' ? converted.every((c) => conditionMatches(c, event)) : converted.some((c) => conditionMatches(c, event));
+    const add = (list, expect, label) => {
+        if (!Array.isArray(list))
+            return;
+        list.forEach((tc, i) => {
+            const event = tc && typeof tc === 'object' ? testEvent(tc, fields) : null;
+            if (!event) {
+                unmapped.push(`${expect === 'match' ? 'tp' : 'tn'}-${i + 1}`);
+                return;
+            }
+            if (expect === 'match' && !matches(event)) {
+                uncovered.push(i + 1);
+                return;
+            }
+            cases.push({ name: `${label}-${i + 1}`, expect, events: [event] });
+        });
+    };
+    add(rule.test_cases?.true_positives, 'match', 'atr-true-positive');
+    add(rule.test_cases?.true_negatives, 'no_match', 'atr-true-negative');
+    return {
+        yaml: cases.length === 0 ? null : yaml.dump({ rule_id: id, cases }, { lineWidth: -1, noRefs: true }),
+        uncovered,
+        unmapped,
+    };
+}
+/** Convert one ATR rule, or say why it cannot be converted. */
+export function ruleToNumbat(rule) {
+    const conditions = arrayConditions(rule);
+    if (!conditions)
+        return { ruleId: rule.id, reason: 'named-format conditions are not supported' };
+    const converted = [];
+    const dropped = [];
+    conditions.forEach((cond, i) => {
+        const c = convertCondition(cond);
+        if (c === null)
+            dropped.push(i);
+        else
+            converted.push(c);
+    });
+    const logic = String(rule.detection.condition ?? 'any').trim().toLowerCase();
+    if (logic !== 'any' && logic !== 'all')
+        return { ruleId: rule.id, reason: `detection condition "${logic}" is not supported` };
+    if (converted.length === 0)
+        return { ruleId: rule.id, reason: 'no condition converts (fields or RE2)' };
+    if (logic === 'all' && dropped.length > 0) {
+        return { ruleId: rule.id, reason: 'an "all" rule with an unconvertible condition would change meaning' };
+    }
+    if (logic === 'all' && !shareAnEventType(converted)) {
+        return { ruleId: rule.id, reason: 'an "all" rule whose conditions read different numbat events can never match' };
+    }
+    if (!/^ATR-\d{4}-\d{5}$/.test(rule.id))
+        return { ruleId: rule.id, reason: 'rule id is not in ATR-YYYY-NNNNN form' };
+    const id = numbatRuleId(rule.id);
+    const doc = {
+        id,
+        version: String(rule.rule_version ?? 1),
+        title: rule.title,
+        severity: SEVERITY[rule.severity] ?? 'medium',
+        description: `${String(rule.description ?? '').trim()}\n\nConverted from Agent Threat Rules ${rule.id} (https://github.com/Agent-Threat-Rule/agent-threat-rules).`.trim(),
+        enabled: true,
+        enforce: false,
+        tags: ['atr', `atr:${rule.id}`, `atr-category:${rule.tags.category}`],
+        expr: converted.map((c) => c.cel).join(logic === 'all' ? ' &&\n' : ' ||\n'),
+    };
+    const tests = companionTests(rule, id, converted, logic);
+    return {
+        ruleId: rule.id,
+        stem: rule.id.toLowerCase(),
+        rule: yaml.dump(doc, { lineWidth: -1, noRefs: true }),
+        tests: tests.yaml,
+        droppedConditions: dropped,
+        uncoveredTruePositives: tests.uncovered,
+        unmappedCases: tests.unmapped,
+    };
+}
+/** Convert the rules in `lane` (default `enforce`). Embedding-confirmed rules are left out of enforce and alert. */
+export function rulesToNumbat(rules, options = {}) {
+    const lane = options.lane ?? 'enforce';
+    const files = [];
+    const skipped = [];
+    for (const rule of rules) {
+        if (rule.status === 'draft' || rule.status === 'deprecated')
+            continue;
+        if (!laneAllows(rule.maturity, lane))
+            continue;
+        if (lane !== 'hunt' && requiresConfirm(rule)) {
+            skipped.push({ ruleId: rule.id, reason: 'needs embedding confirmation, which numbat does not run' });
+            continue;
+        }
+        const out = ruleToNumbat(rule);
+        if ('reason' in out)
+            skipped.push(out);
+        else
+            files.push(out);
+    }
+    return { files, skipped };
+}
+//# sourceMappingURL=numbat.js.map

package/dist/converters/numbat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"numbat.js","sourceRoot":"","sources":["../../src/converters/numbat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,IAAI,MAAM,SAAS,CAAC;AAE3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAa,MAAM,6BAA6B,CAAC;AAErF,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;AACnH,MAAM,YAAY,GAAG,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAEvD,0EAA0E;AAC1E,MAAM,aAAa,GAAgF;IACjG,UAAU,EAAE;QACV,CAAC,SAAS,EAAE,CAAC,aAAa,CAAC,CAAC;QAC5B,CAAC,aAAa,EAAE,YAAY,CAAC;KAC9B;IACD,YAAY,EAAE;QACZ,CAAC,SAAS,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAClC,CAAC,aAAa,EAAE,YAAY,CAAC;KAC9B;IACD,SAAS,EAAE,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC1C,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE;QACP,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;QACjD,CAAC,YAAY,EAAE,aAAa,CAAC;QAC7B,CAAC,aAAa,EAAE,YAAY,CAAC;KAC9B;CACF,CAAC;AAEF,MAAM,QAAQ,GAAqC;IACjD,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,aAAa,EAAE,MAAM;IACrB,IAAI,EAAE,MAAM;CACb,CAAC;AAgCF,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,OAAO,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;AACtC,CAAC;AAED,0CAA0C;AAC1C,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,OAAO,GAAG,CAAC;SACd,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACzB,OAAO,IAAI,OAAO,GAAG,CAAC;AACxB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAwB;IACxC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,uBAAuB,SAAS,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE;QAC/C,CAAC,CAAC,wBAAwB,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACjE,CAAC;AASD,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,IAAuB;IAC/C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,0CAA0C;IACzD,CAAC;IACD,yDAAyD;IACzD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,aAAa,KAAK,YAAY,OAAO,IAAI,CAAC,CAAC;IAC/G,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG;QACxE,OAAO;QACP,EAAE;KACH,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,SAAS,gBAAgB,CAAC,IAAwB,EAAE,KAAgB;IAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,SAAS,gBAAgB,CAAC,UAAyC;IACjE,MAAM,OAAO,GAAG,CAAC,CAAqB,EAAe,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACzG,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,eAAe,CAAC,IAAa;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACrF,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAItE;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,MAA2B;IACrD,gFAAgF;IAChF,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,aAAa,CAAC;IACtD,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAChD,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,aAAa,CAAC;IACnD,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAC3D,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,4FAA4F;AAC5F,SAAS,SAAS,CAAC,EAA2B,EAAE,MAA2B;IACzE,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,eAAe,CAAC;IACjG,IAAI,EAAE,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACnC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7G,CAAC;IACD,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;QACxC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IACnH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtH,IAAI,OAAO,EAAE,CAAC,cAAc,CAAC,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IACpG,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;IAChI,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;IAC5H,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AASD;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAa,EAAE,EAAU,EAAE,SAAwC,EAAE,KAAa;IACxG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAA8B,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,KAAgB,EAAW,EAAE,CAC5C,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3H,MAAM,GAAG,GAAG,CAAC,IAAa,EAAE,MAA4B,EAAE,KAAa,EAAQ,EAAE;QAC/E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO;QACjC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YACrB,MAAM,KAAK,GAAG,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAA6B,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACnE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;IACtE,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpG,SAAS;QACT,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAEjG,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAC3B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7E,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,wBAAwB,KAAK,oBAAoB,EAAE,CAAC;IAC9H,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACxG,IAAI,KAAK,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,oEAAoE,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,6EAA6E,EAAE,CAAC;IACpH,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAEpH,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG;QACV,EAAE;QACF,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;QACvC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ;QAC7C,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,yCAAyC,IAAI,CAAC,EAAE,6DAA6D,CAAC,IAAI,EAAE;QACzK,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;KAC5E,CAAC;IACF,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACzD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrD,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,iBAAiB,EAAE,OAAO;QAC1B,sBAAsB,EAAE,KAAK,CAAC,SAAS;QACvC,aAAa,EAAE,KAAK,CAAC,QAAQ;KAC9B,CAAC;AACJ,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,aAAa,CAAC,KAAyB,EAAE,UAA+B,EAAE;IACxF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IACvC,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY;YAAE,SAAS;QACtE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,SAAS;QAC/C,IAAI,IAAI,KAAK,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,yDAAyD,EAAE,CAAC,CAAC;YACrG,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,QAAQ,IAAI,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YAClC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC"}

package/dist/converters/quarry.d.ts

@@ -0,0 +1,122 @@
+/**
+ * ATR-to-Quarry converter
+ *
+ * Exports ATR rules as Project Quarry rules (Cisco AI Defense, DSL 0.1): one
+ * `.rule` file per ATR rule, a `quarry.yaml` that loads them, and one test
+ * file per rule built from the rule's own test cases as OpenAI-shaped
+ * conversations. `check_atr_tests.py`, written next to them, runs those
+ * conversations through Quarry's scanner, so a JS/RE2 difference that a test
+ * case exercises shows up as a failing case.
+ *
+ * Field mapping (Quarry data surfaces):
+ *   user_input       -> user_messages.content, and tool_responses.content
+ *   agent_output     -> assistant_messages.content, and tool_responses.content
+ *                       (the ATR engine reads both on tool output, so
+ *                       indirect injection riding in on a tool result is seen)
+ *   tool_args        -> tool_calls.raw_arguments
+ *   tool_response    -> tool_responses.content
+ *   tool_name        -> tool_calls.name and tool_responses.name
+ *   tool_description -> tools.description
+ *   content          -> the text of user and assistant messages, tool call
+ *                       arguments and tool results. System and developer
+ *                       messages are not read: the ATR engine sees them only
+ *                       when a producer sends them as user input.
+ *
+ * What does not carry over:
+ *   - Conditions on other fields, and patterns RE2 cannot express, are
+ *     dropped. A rule whose detection is "all" loses its meaning if any
+ *     condition is dropped, so it is skipped; an "any" rule keeps the
+ *     conditions that convert. The ATR engine tests an "all" rule's
+ *     conditions on one event, so here they must hold on one item of one
+ *     surface; a rule whose conditions share no surface is skipped.
+ *   - The ATR engine folds Unicode confusables and normalizes NFKC/NFC before
+ *     matching; Quarry matches the raw text, so obfuscated input can match in
+ *     ATR and not here.
+ *   - JavaScript and RE2 differ in a few classes: JS `\s` also matches `\v`,
+ *     NBSP, the other Unicode spaces and the BOM (RE2's is ASCII only), JS `.` excludes `\r`, and a JS pattern without the
+ *     `u` flag counts an astral character as two. RE2's case folding also
+ *     maps U+017F to `s` and U+212A to `k`. The tests catch a
+ *     difference only where a test case exercises it.
+ *   - Quarry reports matches; the rules carry the ATR severity as metadata
+ *     and blocking is the application's decision.
+ *
+ * @module agent-threat-rules/converters/quarry
+ */
+import type { ATRRule } from '../types.js';
+import { type Lane } from '../quality/rule-contract.js';
+export interface QuarryExportOptions {
+    /** Which ATR rules to export, by maturity lane. Default `enforce` (stable rules). */
+    readonly lane?: Lane;
+}
+export interface QuarryTestCase {
+    readonly name: string;
+    readonly expect: 'match' | 'no_match';
+    readonly conversation: Conversation;
+}
+export interface QuarryRuleFile {
+    readonly ruleId: string;
+    /** File stem, e.g. `atr-2026-00432`; write `rules/<stem>.rule` and `tests/<stem>.json`. */
+    readonly stem: string;
+    readonly rule: string;
+    /** Empty when no test case maps onto a conversation. */
+    readonly tests: readonly QuarryTestCase[];
+    /** ATR conditions that could not be converted, by index. */
+    readonly droppedConditions: readonly number[];
+    /** ATR true positives (1-based) the converted rule does not match, left out of the tests. */
+    readonly uncoveredTruePositives: readonly number[];
+    /** ATR test cases (labelled tp-N / tn-N) with no field that maps onto a conversation. */
+    readonly unmappedCases: readonly string[];
+}
+export interface QuarrySkip {
+    readonly ruleId: string;
+    readonly reason: string;
+}
+export interface QuarryExport {
+    readonly files: readonly QuarryRuleFile[];
+    readonly skipped: readonly QuarrySkip[];
+}
+interface ToolCall {
+    readonly id: string;
+    readonly type: 'function';
+    readonly function: {
+        readonly name: string;
+        readonly arguments: string;
+    };
+}
+type Message = {
+    readonly role: 'user';
+    readonly content: string;
+} | {
+    readonly role: 'assistant';
+    readonly content: string | null;
+    readonly tool_calls?: readonly ToolCall[];
+} | {
+    readonly role: 'tool';
+    readonly tool_call_id: string;
+    readonly content: string;
+};
+interface ToolDefinition {
+    readonly type: 'function';
+    readonly function: {
+        readonly name: string;
+        readonly description: string;
+        readonly parameters: {
+            readonly type: 'object';
+            readonly properties: Record<string, never>;
+        };
+    };
+}
+export interface Conversation {
+    readonly messages: readonly Message[];
+    readonly tools?: readonly ToolDefinition[];
+}
+/** Convert one ATR rule, or say why it cannot be converted. */
+export declare function ruleToQuarry(rule: ATRRule): QuarryRuleFile | QuarrySkip;
+/** Convert the rules in `lane` (default `enforce`). Embedding-confirmed rules are left out of enforce and alert. */
+export declare function rulesToQuarry(rules: readonly ATRRule[], options?: QuarryExportOptions): QuarryExport;
+/** `quarry.yaml`, loading the exported rules. Quarry resolves `rules/` against the working directory. */
+export declare const QUARRY_CONFIG = "config_version: 2\nrules:\n  - rules/\n";
+/** `check_atr_tests.py`: runs each rule's ATR test conversations through Quarry. */
+export declare const QUARRY_CHECK_SCRIPT = "\"\"\"Run the ATR test cases exported with these rules through Quarry.\n\nWith Quarry installed:\n\n    python check_atr_tests.py\n\nEach tests/<rule>.json holds that rule's ATR true positives (expect \"match\")\nand true negatives (expect \"no_match\") as conversations. A case passes when\nthe named rule's verdict is what the case expects; other rules may match too.\nExits 1 if any case fails or any scan is incomplete.\n\"\"\"\n\nimport json\nimport os\nimport sys\nfrom pathlib import Path\n\nfrom quarry import DSLScanner\nfrom quarry.config import QuarryConfig\n\nHERE = Path(__file__).resolve().parent\n\n\ndef main() -> int:\n    # Quarry resolves the rules path in quarry.yaml against the working directory.\n    os.chdir(HERE)\n    scanner = DSLScanner(QuarryConfig.from_yaml(HERE / \"quarry.yaml\"))\n    total = failed = 0\n    for path in sorted((HERE / \"tests\").glob(\"*.json\")):\n        suite = json.loads(path.read_text(encoding=\"utf-8\"))\n        for case in suite[\"cases\"]:\n            total += 1\n            result = scanner.scan_data(case[\"conversation\"])\n            if not result.is_complete:\n                failed += 1\n                print(f\"{suite['rule']} {case['name']}: scan {result.completion_state}\")\n                continue\n            matched = suite[\"rule\"] in result.rule_matches\n            if matched != (case[\"expect\"] == \"match\"):\n                failed += 1\n                print(f\"{suite['rule']} {case['name']}: expected {case['expect']}\")\n    print(f\"{total - failed}/{total} cases pass\")\n    return 1 if failed else 0\n\n\nif __name__ == \"__main__\":\n    sys.exit(main())\n";
+export {};
+//# sourceMappingURL=quarry.d.ts.map

package/dist/converters/quarry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quarry.d.ts","sourceRoot":"","sources":["../../src/converters/quarry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAqB,OAAO,EAAE,MAAM,aAAa,CAAC;AAG9D,OAAO,EAA+B,KAAK,IAAI,EAAE,MAAM,6BAA6B,CAAC;AAgCrF,MAAM,WAAW,mBAAmB;IAClC,qFAAqF;IACrF,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,4DAA4D;IAC5D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,yFAAyF;IACzF,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;CACzC;AA2FD,UAAU,QAAQ;IAChB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1E;AAED,KAAK,OAAO,GACR;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAA;CAAE,GAC1G;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvF,UAAU,cAAc;IACtB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;SAAE,CAAC;KAC9F,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAC5C;AAuJD,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,GAAG,UAAU,CAoDvE;AAED,oHAAoH;AACpH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,EAAE,OAAO,GAAE,mBAAwB,GAAG,YAAY,CAgBxG;AAED,yGAAyG;AACzG,eAAO,MAAM,aAAa,4CAA4C,CAAC;AAEvE,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,6nDA+C/B,CAAC"}