@mitre-attack/attack-data-model/dist/schemas/common/stix-identifier.cjs

A TypeScript API for the MITRE ATT&CK data model

"use strict";
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
  for (var name in all)
    __defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
  if (from && typeof from === "object" || typeof from === "function") {
    for (let key of __getOwnPropNames(from))
      if (!__hasOwnProp.call(to, key) && key !== except)
        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
  }
  return to;
};
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

// src/schemas/common/stix-identifier.ts
var stix_identifier_exports = {};
__export(stix_identifier_exports, {
  createStixIdValidator: () => createStixIdValidator,
  stixIdentifierSchema: () => stixIdentifierSchema
});
module.exports = __toCommonJS(stix_identifier_exports);
var import_v42 = require("zod/v4");

// src/schemas/common/stix-type.ts
var import_v4 = require("zod/v4");
var stixTypeToTypeName = {
  "attack-pattern": "Technique",
  bundle: "StixBundle",
  campaign: "Campaign",
  "course-of-action": "Mitigation",
  "extension-definition": null,
  identity: "Identity",
  "intrusion-set": "Group",
  malware: "Malware",
  tool: "Tool",
  "marking-definition": "MarkingDefinition",
  "x-mitre-analytic": "Analytic",
  "x-mitre-data-component": "DataComponent",
  "x-mitre-detection-strategy": "DetectionStrategy",
  "x-mitre-data-source": "DataSource",
  "x-mitre-log-source": "LogSource",
  "x-mitre-tactic": "Tactic",
  "x-mitre-asset": "Asset",
  "x-mitre-matrix": "Matrix",
  "x-mitre-collection": "Collection",
  relationship: "Relationship",
  file: "",
  // not used in ATT&CK but used in sample_refs for Malware
  artifact: ""
  // not used in ATT&CK but used in sample_refs for Malware
  // 'observed-data': 'ObservedData',     // not used in ATT&CK
  // 'report': 'Report',                  // not used in ATT&CK
  // 'threat-actor': 'ThreatActor',       // not used in ATT&CK
  // 'vulnerability': 'Vulnerability',    // not used in ATT&CK
};
var supportedStixTypes = [
  "attack-pattern",
  "bundle",
  "campaign",
  "course-of-action",
  "extension-definition",
  "identity",
  "intrusion-set",
  "malware",
  "tool",
  "marking-definition",
  "x-mitre-analytic",
  "x-mitre-data-component",
  "x-mitre-detection-strategy",
  "x-mitre-tactic",
  "x-mitre-asset",
  "x-mitre-data-source",
  "x-mitre-log-source",
  "x-mitre-matrix",
  "x-mitre-collection",
  "relationship",
  "file",
  // not used in ATT&CK but used in sample_refs for Malware
  "artifact"
  // not used in ATT&CK but used in sample_refs for Malware
  // "indicator",         // not used in ATT&CK
  // "observed-data",     // not used in ATT&CK
  // "report",            // not used in ATT&CK
  // "threat-actor",      // not used in ATT&CK
  // "vulnerability",     // not used in ATT&CK
];
var stixTypeSchema = import_v4.z.enum(supportedStixTypes, {
  error: (issue) => {
    if (issue.code === "invalid_value") {
      const received = typeof issue.input === "string" ? issue.input : String(issue.input);
      return `Invalid STIX type '${received}'. Expected one of the supported STIX types.`;
    }
    return void 0;
  }
}).meta({
  description: "The type property identifies the type of STIX Object (SDO, Relationship Object, etc). The value of the type field MUST be one of the types defined by a STIX Object (e.g., indicator)."
});

// src/schemas/common/stix-identifier.ts
var stixIdentifierSchema = import_v42.z.string().refine((val) => val.includes("--") && val.split("--").length === 2, {
  error: (issue) => ({
    code: "custom",
    message: "Invalid STIX Identifier: must comply with format 'type--UUIDv4'",
    input: issue.input,
    path: []
  })
}).refine(
  (val) => {
    const [type] = val.split("--");
    return stixTypeSchema.safeParse(type).success;
  },
  {
    error: (issue) => {
      const val = issue.input;
      const [type] = val.split("--");
      const typeName = type in stixTypeToTypeName ? stixTypeToTypeName[type] : "STIX";
      return {
        code: "custom",
        message: `Invalid STIX Identifier for ${typeName} object: contains invalid STIX type '${type}'`,
        input: issue.input,
        path: []
      };
    }
  }
).refine(
  (val) => {
    const [, uuid] = val.split("--");
    return import_v42.z.uuid().safeParse(uuid).success;
  },
  {
    error: (issue) => {
      const val = issue.input;
      const [type] = val.split("--");
      const typeName = type in stixTypeToTypeName ? stixTypeToTypeName[type] : "STIX";
      return {
        code: "custom",
        message: `Invalid STIX Identifier for ${typeName} object: contains invalid UUIDv4 format`,
        input: issue.input,
        path: []
      };
    }
  }
).meta({
  description: "Represents identifiers across the CTI specifications. The format consists of the name of the top-level object being identified, followed by two dashes (--), followed by a UUIDv4."
});
function createStixIdValidator(expectedType) {
  return stixIdentifierSchema.refine(
    (val) => val.startsWith(`${expectedType}--`),
    {
      error: () => ({
        code: "custom",
        message: `Invalid STIX Identifier: must start with '${expectedType}--'`,
        input: expectedType,
        path: []
      })
    }
  );
}
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
  createStixIdValidator,
  stixIdentifierSchema
});