@mitre-attack/attack-data-model/dist/generator/index.cjs

A TypeScript API for the MITRE ATT&CK data model

"use strict";
var __create = Object.create;
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __getProtoOf = Object.getPrototypeOf;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
  for (var name in all)
    __defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
  if (from && typeof from === "object" || typeof from === "function") {
    for (let key of __getOwnPropNames(from))
      if (!__hasOwnProp.call(to, key) && key !== except)
        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
  }
  return to;
};
var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
  // If the importer is in node compatibility mode or this is not an ESM
  // file that has been converted to a CommonJS file using a Babel-
  // compatible transform (i.e. "__esModule" has not been set), then set
  // "default" to the CommonJS "module.exports" for node compatibility.
  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
  mod
));
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

// src/generator/index.ts
var generator_exports = {};
__export(generator_exports, {
  createSyntheticStixObject: () => createSyntheticStixObject
});
module.exports = __toCommonJS(generator_exports);

// src/schemas/common/attack-core.ts
var import_v414 = require("zod/v4");

// src/schemas/common/property-schemas/generics.ts
var import_zod = require("zod");
var nonEmptyRequiredString = import_zod.z.string().trim().min(1, { error: "At least one character is required. Whitespace is not permissible." });
var emptyStixListErrorMessage = "Empty lists are prohibited in STIX and MUST NOT be used as a substitute for omitting the property if it is optional. The list MUST be present and MUST have at least one value.";
var stixListOfString = import_zod.z.array(nonEmptyRequiredString).min(1, { error: emptyStixListErrorMessage });

// src/schemas/common/property-schemas/attack-attribution.ts
var import_v43 = require("zod/v4");

// src/schemas/common/property-schemas/stix-id.ts
var import_v42 = require("zod/v4");

// src/schemas/common/property-schemas/stix-type.ts
var import_v4 = require("zod/v4");
var stixTypeToTypeName = {
  "attack-pattern": "Technique",
  bundle: "StixBundle",
  campaign: "Campaign",
  "course-of-action": "Mitigation",
  "extension-definition": null,
  identity: "Identity",
  "intrusion-set": "Group",
  malware: "Malware",
  tool: "Tool",
  "marking-definition": "MarkingDefinition",
  "x-mitre-analytic": "Analytic",
  "x-mitre-data-component": "DataComponent",
  "x-mitre-detection-strategy": "DetectionStrategy",
  "x-mitre-data-source": "DataSource",
  "x-mitre-tactic": "Tactic",
  "x-mitre-asset": "Asset",
  "x-mitre-matrix": "Matrix",
  "x-mitre-collection": "Collection",
  relationship: "Relationship",
  file: "",
  // not used in ATT&CK but used in sample_refs for Malware
  artifact: ""
  // not used in ATT&CK but used in sample_refs for Malware
  // 'observed-data': 'ObservedData',     // not used in ATT&CK
  // 'report': 'Report',                  // not used in ATT&CK
  // 'threat-actor': 'ThreatActor',       // not used in ATT&CK
  // 'vulnerability': 'Vulnerability',    // not used in ATT&CK
};
var supportedStixTypes = [
  "attack-pattern",
  "bundle",
  "campaign",
  "course-of-action",
  "extension-definition",
  "identity",
  "intrusion-set",
  "malware",
  "tool",
  "marking-definition",
  "x-mitre-analytic",
  "x-mitre-data-component",
  "x-mitre-detection-strategy",
  "x-mitre-tactic",
  "x-mitre-asset",
  "x-mitre-data-source",
  "x-mitre-matrix",
  "x-mitre-collection",
  "relationship",
  "file",
  // not used in ATT&CK but used in sample_refs for Malware
  "artifact"
  // not used in ATT&CK but used in sample_refs for Malware
  // "indicator",         // not used in ATT&CK
  // "observed-data",     // not used in ATT&CK
  // "report",            // not used in ATT&CK
  // "threat-actor",      // not used in ATT&CK
  // "vulnerability",     // not used in ATT&CK
];
var stixTypeSchema = import_v4.z.enum(supportedStixTypes, {
  error: (issue) => {
    if (issue.code === "invalid_value") {
      const received = typeof issue.input === "string" ? issue.input : String(issue.input);
      return `Invalid STIX type '${received}'. Expected one of the supported STIX types.`;
    }
    return void 0;
  }
}).meta({
  description: "The type property identifies the type of STIX Object (SDO, Relationship Object, etc). The value of the type field MUST be one of the types defined by a STIX Object (e.g., indicator)."
});
function createStixTypeValidator(stixType) {
  const objectName = stixTypeToTypeName[stixType];
  return import_v4.z.literal(stixType).refine((val) => val === stixType, {
    error: (issue) => `Invalid 'type' property. Expected '${stixType}' for ${objectName} object, but received '${issue.input}'.`
  });
}
function createMultiStixTypeValidator(stixTypes) {
  const objectNames = stixTypes.map((type) => stixTypeToTypeName[type]).join(" or ");
  const typeList = stixTypes.map((t) => `'${t}'`).join(" or ");
  const literals = stixTypes.map((type) => import_v4.z.literal(type));
  return import_v4.z.union(literals).refine((val) => stixTypes.includes(val), {
    error: (issue) => `Invalid 'type' property. Expected ${typeList} for ${objectNames} object, but received '${issue.input}'.`
  });
}

// src/schemas/common/property-schemas/stix-id.ts
var stixIdentifierSchema = import_v42.z.string().refine((val) => val.includes("--") && val.split("--").length === 2, {
  error: (issue) => ({
    code: "custom",
    message: "Invalid STIX Identifier: must comply with format 'type--UUIDv4'",
    input: issue.input,
    path: []
  })
}).refine(
  (val) => {
    const [type] = val.split("--");
    return stixTypeSchema.safeParse(type).success;
  },
  {
    error: (issue) => {
      const val = issue.input;
      const [type] = val.split("--");
      const typeName = type in stixTypeToTypeName ? stixTypeToTypeName[type] : "STIX";
      return {
        code: "custom",
        message: `Invalid STIX Identifier for ${typeName} object: contains invalid STIX type '${type}'`,
        input: issue.input,
        path: []
      };
    }
  }
).refine(
  (val) => {
    const [, uuid] = val.split("--");
    return import_v42.z.uuid().safeParse(uuid).success;
  },
  {
    error: (issue) => {
      const val = issue.input;
      const [type] = val.split("--");
      const typeName = type in stixTypeToTypeName ? stixTypeToTypeName[type] : "STIX";
      return {
        code: "custom",
        message: `Invalid STIX Identifier for ${typeName} object: contains invalid UUIDv4 format`,
        input: issue.input,
        path: []
      };
    }
  }
).meta({
  description: "Represents identifiers across the CTI specifications. The format consists of the name of the top-level object being identified, followed by two dashes (--), followed by a UUIDv4."
});
function createStixIdValidator(expectedType) {
  return stixIdentifierSchema.refine(
    (val) => val.startsWith(`${expectedType}--`),
    {
      error: () => ({
        code: "custom",
        message: `Invalid STIX Identifier: must start with '${expectedType}--'`,
        input: expectedType,
        path: []
      })
    }
  );
}

// src/schemas/common/property-schemas/attack-attribution.ts
var xMitreIdentity = "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5";
var xMitreIdentitySchema = import_v43.z.literal(xMitreIdentity).meta({ description: "STIX Identity for The MITRE Corporation" });
var xMitreModifiedByRefSchema = xMitreIdentitySchema.meta({
  description: "The STIX ID of the MITRE identity object. Used to track the identity of the MITRE organization, which created the current version of the object. Previous versions of the object may have been created by other individuals or organizations."
});
var xMitreContributorsSchema = stixListOfString.meta({
  description: "People and organizations who have contributed to the object. Not found on objects of type `relationship`."
});

// src/schemas/common/property-schemas/attack-domains.ts
var import_v44 = require("zod/v4");
var attackDomainSchema = import_v44.z.enum(["enterprise-attack", "mobile-attack", "ics-attack"]).meta({
  description: "ATT&CK is organized in a series of \u201Ctechnology domains\u201D - the ecosystem an adversary      operates within that provides a set of constraints the adversary must circumvent or take      advantage of to accomplish a set of objectives. To date MITRE has defined three technology      domains."
});
var xMitreDomainsSchema = import_v44.z.array(attackDomainSchema).min(1, {
  message: "At least one MITRE ATT&CK domain must be specified."
}).meta({
  description: "The technology domains to which the ATT&CK object belongs."
});

// src/schemas/common/property-schemas/attack-id.ts
var import_v45 = require("zod/v4");
var attackIdConfig = {
  tactic: {
    pattern: /^TA\d{4}$/,
    message: "Must match ATT&CK Tactic ID format (TA####)",
    example: "TA####",
    stixTypes: ["x-mitre-tactic"]
  },
  technique: {
    pattern: /^T\d{4}$/,
    message: "Must match ATT&CK Technique ID format (T####)",
    example: "T####",
    stixTypes: ["attack-pattern"]
    // Note: attack-pattern can be technique or subtechnique
  },
  subtechnique: {
    pattern: /^T\d{4}\.\d{3}$/,
    message: "Must match ATT&CK Sub-technique ID format (T####.###)",
    example: "T####.###",
    stixTypes: ["attack-pattern"]
    // Note: attack-pattern can be technique or subtechnique
  },
  group: {
    pattern: /^G\d{4}$/,
    message: "Must match ATT&CK Group ID format (G####)",
    example: "G####",
    stixTypes: ["intrusion-set"]
  },
  software: {
    pattern: /^S\d{4}$/,
    message: "Must match ATT&CK Software ID format (S####)",
    example: "S####",
    stixTypes: ["malware", "tool"]
  },
  mitigation: {
    pattern: /^M\d{4}$/,
    message: "Must match ATT&CK Mitigation ID format (M####)",
    example: "M####",
    stixTypes: ["course-of-action"]
  },
  asset: {
    pattern: /^A\d{4}$/,
    message: "Must match ATT&CK Asset ID format (A####)",
    example: "A####",
    stixTypes: ["x-mitre-asset"]
  },
  "data-source": {
    pattern: /^DS\d{4}$/,
    message: "Must match ATT&CK Data Source ID format (DS####)",
    example: "DS####",
    stixTypes: ["x-mitre-data-source"]
  },
  campaign: {
    pattern: /^C\d{4}$/,
    message: "Must match ATT&CK Campaign ID format (C####)",
    example: "C####",
    stixTypes: ["campaign"]
  },
  "data-component": {
    pattern: /^DC\d{4}$/,
    message: "Must match ATT&CK Data Component Source ID format (DC####)",
    example: "DC####",
    stixTypes: ["x-mitre-data-component"]
  },
  "detection-strategy": {
    pattern: /^DET\d{4}$/,
    message: "Must match ATT&CK Detection Strategy Source ID format (DET####)",
    example: "DET####",
    stixTypes: ["x-mitre-detection-strategy"]
  },
  analytic: {
    pattern: /^AN\d{4}$/,
    message: "Must match ATT&CK Analytic Source ID format (AN####)",
    example: "AN####",
    stixTypes: ["x-mitre-analytic"]
  }
};
var stixTypeToAttackIdMapping = {
  "x-mitre-tactic": "tactic",
  "attack-pattern": "technique",
  // Default to technique; subtechnique handling is done contextually
  "intrusion-set": "group",
  malware: "software",
  tool: "software",
  "course-of-action": "mitigation",
  "x-mitre-asset": "asset",
  "x-mitre-data-source": "data-source",
  campaign: "campaign",
  "x-mitre-data-component": "data-component",
  "x-mitre-detection-strategy": "detection-strategy",
  "x-mitre-analytic": "analytic"
};
var attackIdPatterns = Object.fromEntries(
  Object.entries(attackIdConfig).map(([key, config]) => [key, config.pattern])
);
var attackIdMessages = Object.fromEntries(
  Object.entries(attackIdConfig).map(([key, config]) => [key, config.message])
);
var attackIdExamples = Object.fromEntries(
  Object.entries(attackIdConfig).map(([key, config]) => [key, config.example])
);
function getAttackIdExample(stixType) {
  if (stixType === "attack-pattern") {
    return `${attackIdExamples.technique} or ${attackIdExamples.subtechnique}`;
  }
  const attackIdType = stixTypeToAttackIdMapping[stixType];
  return attackIdExamples[attackIdType];
}
var oldAttackIdRegex = /^MOB-(M|S)\d{4}$/;
function createOldMitreAttackIdSchema(stixType) {
  const baseSchema = nonEmptyRequiredString.meta({
    description: "Old ATT&CK IDs that may have been associated with this object"
  });
  switch (stixType) {
    case "malware":
    case "tool":
      return baseSchema.refine(
        (value) => {
          return /^MOB-S\d{4}$/.test(value);
        },
        {
          message: `x_mitre_old_attack_id for ${stixType} need to be in the format MOB-S####`
        }
      );
    case "course-of-action":
      return baseSchema.refine(
        (value) => {
          return /^MOB-M\d{4}$/.test(value);
        },
        {
          message: `x_mitre_old_attack_id for ${stixType} need to be in the format MOB-M####`
        }
      );
    default:
      throw new Error(`Unsupported STIX type: ${stixType}`);
  }
}
var xMitreOldAttackIdSchema = nonEmptyRequiredString.refine(
  (value) => {
    return oldAttackIdRegex.test(value);
  },
  {
    message: "Must be in the format 'MOB-X0000' where X is either 'M' or 'S', followed by exactly four digits"
  }
).meta({ description: "Old ATT&CK IDs that may have been associated with this object" });

// src/schemas/common/property-schemas/attack-platforms.ts
var import_zod2 = require("zod");
var supportedMitrePlatforms = [
  "Field Controller/RTU/PLC/IED",
  "Network Devices",
  "Data Historian",
  "Google Workspace",
  "Office Suite",
  "ESXi",
  "Identity Provider",
  "Containers",
  "Azure AD",
  "Engineering Workstation",
  "Control Server",
  "Human-Machine Interface",
  "Windows",
  "Linux",
  "IaaS",
  "None",
  "iOS",
  "PRE",
  "SaaS",
  "Input/Output Server",
  "macOS",
  "Android",
  "Safety Instrumented System/Protection Relay",
  "Embedded"
];
var xMitrePlatformSchema = import_zod2.z.enum(supportedMitrePlatforms, {
  error: () => `Platform must be one of: ${supportedMitrePlatforms.join(", ")}`
}).meta({
  description: "A technology environments and/or operating system that ATT&CK techniques are applicable within."
});
var xMitrePlatformsSchema = import_zod2.z.array(xMitrePlatformSchema, {
  error: (issue) => issue.code === "invalid_type" ? "x_mitre_platforms must be an array of strings" : "Invalid platforms array"
}).min(1, "At least one platform is required").refine((items) => new Set(items).size === items.length, {
  message: "Platforms must be unique (no duplicates allowed)."
}).meta({ description: "List of platforms that apply to the object." });

// src/schemas/common/property-schemas/attack-statuses.ts
var import_zod3 = require("zod");
var xMitreDeprecatedSchema = import_zod3.z.boolean({
  error: "x_mitre_deprecated must be a boolean."
}).meta({ description: "Indicates whether the object has been deprecated." });

// src/schemas/common/property-schemas/attack-versioning.ts
var import_v46 = require("zod/v4");
var xMitreVersionSchema = nonEmptyRequiredString.regex(/^(\d{1,2})\.(\d{1,2})$/, "Version must be in format 'M.N' where M and N are 0-99").meta({
  description: "Represents the version of the object in a 'major.minor' format, where both 'major' and 'minor' are integers between 0 and 99. This versioning follows semantic versioning principles but excludes the patch number. The version number is incremented by ATT&CK when the content of the object is updated. This property does not apply to relationship objects."
});
var semverRegex = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
var xMitreAttackSpecVersionSchema = nonEmptyRequiredString.regex(semverRegex, "Must be valid semantic version (MAJOR.MINOR.PATCH)").meta({
  description: "The version of the ATT&CK spec used by the object. This field helps consuming software determine if the data format is supported. If the field is not present on an object, the spec version will be assumed to be 2.0.0. Refer to the ATT&CK CHANGELOG for all supported versions."
});

// src/schemas/common/property-schemas/stix-attribution.ts
var import_v47 = require("zod/v4");
var objectMarkingRefsSchema = import_v47.z.array(
  stixIdentifierSchema.startsWith(
    "marking-definition--",
    'Identifier must start with "marking-definition--"'
  )
).meta({ description: "The list of marking-definition objects to be applied to this object." });
var stixCreatedByRefSchema = createStixIdValidator("identity").meta({
  description: "The created_by_ref property specifies the id property of the identity object that describes the entity that created this object. If this attribute is omitted, the source of this information is undefined. This may be used by object creators who wish to remain anonymous."
});

// src/schemas/common/property-schemas/stix-common-properties.ts
var import_v48 = require("zod/v4");
var descriptionSchema = nonEmptyRequiredString.meta({ description: "A description of the object." });
var nameSchema = nonEmptyRequiredString.meta({ description: "The name of the object." });
var aliasesSchema = stixListOfString.meta({
  description: "Alternative names used to identify this object. The first alias must match the object's name."
});

// src/schemas/common/property-schemas/stix-extensions.ts
var import_v410 = require("zod/v4");

// src/schemas/common/property-schemas/stix-external-references.ts
var import_zod4 = __toESM(require("zod"), 1);
var externalReferenceSchema = import_zod4.default.object({
  source_name: nonEmptyRequiredString,
  description: nonEmptyRequiredString.optional(),
  url: import_zod4.default.url({
    error: (issue) => issue.input === null ? "URL cannot be null" : "Invalid URL format. Please provide a valid URL"
  }).optional(),
  external_id: nonEmptyRequiredString.optional()
});
var externalReferencesSchema = import_zod4.default.array(externalReferenceSchema).min(1).meta({ description: "A list of external references which refers to non-STIX information" });
var createAttackExternalReferencesSchema = (stixType) => {
  return import_zod4.default.array(externalReferenceSchema).min(1, "At least one external reference is required").refine((refs) => !!refs[0]?.external_id, {
    message: "ATT&CK ID must be defined in the first external_references entry.",
    path: [0, "external_id"]
  }).refine(
    (refs) => {
      if (!refs[0]?.external_id) return true;
      const attackIdType = stixTypeToAttackIdMapping[stixType];
      if (attackIdType === "technique") {
        return attackIdPatterns["technique"].test(refs[0].external_id) || attackIdPatterns["subtechnique"].test(refs[0].external_id);
      }
      return attackIdPatterns[attackIdType].test(refs[0].external_id);
    },
    {
      message: `The first external_reference must match the ATT&CK ID format ${getAttackIdExample(stixType)}.`,
      path: [0, "external_id"]
    }
  ).meta({
    description: "A list of external references with the first containing a valid ATT&CK ID"
  });
};

// src/schemas/common/property-schemas/stix-granular-marking.ts
var import_zod5 = require("zod");
var granularMarkingSchema = import_zod5.z.object({
  lang: nonEmptyRequiredString.optional().meta({
    description: "The lang property identifies the language of the text identified by this marking. The value of the lang property, if present, MUST be an [RFC5646] language code.         If the marking_ref property is not present, this property MUST be present.         If the marking_ref property is present, this property MUST NOT be present."
  }),
  marking_ref: stixIdentifierSchema.optional().meta({
    description: "The marking_ref property specifies the ID of the marking-definition object that describes the marking.         If the lang property is not present, this property MUST be present. If the lang property is present, this property MUST NOT be present."
  }),
  selectors: stixListOfString.meta({
    description: "The selectors property specifies a list of selectors for content contained within the STIX Object in which this property appears."
  })
}).check((ctx) => {
  const { lang, marking_ref } = ctx.value;
  const hasLang = lang !== void 0;
  const hasMarkingRef = marking_ref !== void 0;
  if (hasLang && hasMarkingRef) {
    ctx.issues.push({
      path: ["lang"],
      message: "If the marking_ref property is present, the lang property MUST NOT be present.",
      code: "custom",
      input: {
        lang: ctx.value.lang,
        marking_ref: ctx.value.marking_ref
      }
    });
    ctx.issues.push({
      path: ["marking_ref"],
      message: "If the lang property is present, the marking_ref property MUST NOT be present.",
      code: "custom",
      input: {
        lang: ctx.value.lang,
        marking_ref: ctx.value.marking_ref
      }
    });
  } else if (!hasLang && !hasMarkingRef) {
    ctx.issues.push({
      path: ["lang"],
      message: "If the marking_ref property is not present, the lang property MUST be present.",
      code: "custom",
      input: {
        lang: ctx.value.lang,
        marking_ref: ctx.value.marking_ref
      }
    });
    ctx.issues.push({
      path: ["marking_ref"],
      message: "If the lang property is not present, the marking_ref property MUST be present.",
      code: "custom",
      input: {
        lang: ctx.value.lang,
        marking_ref: ctx.value.marking_ref
      }
    });
  }
}).meta({
  description: "The `granular-marking` type defines how the `marking-definition` object referenced by the **marking_ref** property or a language specified by the **lang** property applies to a set of content identified by the list of selectors in the selectors property."
});

// src/schemas/common/property-schemas/stix-versioning.ts
var import_v49 = require("zod/v4");
var specVersionDescription = [
  "The version of the STIX specification used to represent this object.",
  "The value of this property MUST be 2.1 for STIX Objects defined according to this specification.",
  "If objects are found where this property is not present, the implicit value for all STIX Objects other than SCOs is 2.0.",
  "Since SCOs are now top-level objects in STIX 2.1, the default value for SCOs is 2.1."
].join(" ");
var stixSpecVersionSchema = import_v49.z.literal("2.1").meta({ description: specVersionDescription });

// src/schemas/common/property-schemas/stix-extensions.ts
var extensionTypeSchema = import_v410.z.enum([
  "new-sdo",
  "new-sco",
  "new-sro",
  "property-extension",
  "toplevel-property-extension"
]);
var extensionSchema = import_v410.z.object({
  extension_type: extensionTypeSchema
  // Additional properties depend on extension type - using record for flexibility
}).catchall(import_v410.z.unknown());
var extensionsSchema = import_v410.z.record(
  nonEmptyRequiredString,
  import_v410.z.union([extensionSchema, import_v410.z.record(nonEmptyRequiredString, import_v410.z.unknown())])
).meta({
  description: "Specifies any extensions of the object, as a dictionary where keys are extension definition UUIDs"
});
var extensionPropertyNameSchema = import_v410.z.string().trim().min(3, "Extension property names must be at least 3 characters").max(250, "Extension property names must be no longer than 250 characters").regex(
  /^[a-z0-9_]+$/,
  "Extension property names must only contain lowercase letters, digits, and underscores"
);
var extensionObjectTypeSchema = import_v410.z.string().trim().min(3, "Extension object type must be at least 3 characters").max(250, "Extension object type must be no longer than 250 characters").regex(
  /^[a-z0-9-]+$/,
  "Extension object type must only contain lowercase letters, digits, and hyphens"
).refine(
  (value) => !value.includes("--"),
  "Extension object type must not contain consecutive hyphens"
);
var extensionDefinitionSchema = import_v410.z.object({
  // Required common properties
  id: createStixIdValidator("extension-definition"),
  type: createStixTypeValidator("extension-definition"),
  spec_version: stixSpecVersionSchema,
  created: import_v410.z.iso.datetime(),
  modified: import_v410.z.iso.datetime(),
  created_by_ref: stixCreatedByRefSchema,
  // Optional common properties
  revoked: import_v410.z.boolean().optional(),
  labels: stixListOfString.optional(),
  external_references: externalReferencesSchema.optional(),
  object_marking_refs: objectMarkingRefsSchema.optional(),
  granular_markings: import_v410.z.array(granularMarkingSchema).optional(),
  // Extension definition specific properties
  name: nameSchema,
  description: nonEmptyRequiredString.optional(),
  schema: nonEmptyRequiredString,
  version: nonEmptyRequiredString.regex(
    /^\d+\.\d+\.\d+$/,
    "Version must follow semantic versioning (MAJOR.MINOR.PATCH)"
  ),
  extension_types: import_v410.z.array(extensionTypeSchema).min(1, "At least one extension type is required"),
  extension_properties: import_v410.z.array(extensionPropertyNameSchema).optional()
}).strict().refine(
  (data) => {
    if (data.extension_types.includes("toplevel-property-extension")) {
      return data.extension_properties && data.extension_properties.length > 0;
    }
    return true;
  },
  {
    message: "extension_properties must be provided when extension_types includes toplevel-property-extension"
  }
).meta({
  description: "Extension Definition object allows producers to extend existing STIX objects or create new STIX objects"
});

// src/schemas/common/property-schemas/stix-kill-chains.ts
var import_zod6 = require("zod");
var killChainNameSchema = import_zod6.z.enum([
  "mitre-attack",
  "mitre-mobile-attack",
  "mitre-ics-attack"
]);
var killChainPhaseSchema = import_zod6.z.object({
  phase_name: nonEmptyRequiredString.refine(
    (value) => {
      const isLowercase = value === value.toLowerCase();
      const usesHyphens = !value.includes(" ") && !value.includes("_");
      return isLowercase && usesHyphens;
    },
    {
      message: "Phase name should be all lowercase and use hyphens instead of spaces or underscores."
    }
  ).meta({
    description: "The name of the phase in the kill chain. The value of this property SHOULD be all lowercase and SHOULD use hyphens instead of spaces or underscores as word separators."
  }),
  kill_chain_name: killChainNameSchema
}).strict();

// src/schemas/common/property-schemas/stix-open-vocabulary.ts
var import_v411 = require("zod/v4");
var MalwareTypeOV = import_v411.z.enum([
  "adware",
  "backdoor",
  "bot",
  "bootkit",
  "ddos",
  "downloader",
  "dropper",
  "exploit-kit",
  "keylogger",
  "ransomware",
  "remote-access-trojan",
  "resource-exploitation",
  "rogue-security-software",
  "rootkit",
  "screen-capture",
  "spyware",
  "trojan",
  "virus",
  "webshell",
  "wiper",
  "worm",
  "unknown"
]);
var ProcessorArchitectureOV = import_v411.z.enum([
  "alpha",
  "arm",
  "ia-64",
  "mips",
  "powerpc",
  "sparc",
  "x86",
  "x86-64"
]);
var ImplementationLanguageOV = import_v411.z.enum([
  "applescript",
  "bash",
  "c",
  "c++",
  "c#",
  "go",
  "java",
  "javascript",
  "lua",
  "objective-c",
  "perl",
  "php",
  "powershell",
  "python",
  "ruby",
  "scala",
  "swift",
  "typescript",
  "visual-basic",
  "x86-32",
  "x86-64"
]);
var MalwareCapabilityOV = import_v411.z.enum([
  "accesses-remote-machines",
  "anti-debugging",
  "anti-disassembly",
  "anti-emulation",
  "anti-memory-forensics",
  "anti-sandbox",
  "anti-vm",
  "captures-input-peripherals",
  "captures-output-peripherals",
  "captures-system-state-data",
  "cleans-traces-of-infection",
  "commits-fraud",
  "communicates-with-c2",
  "compromises-data-integrity",
  "compromises-data-availability",
  "compromises-system-availability",
  "controls-local-machine",
  "degrades-security-software",
  "degrades-system-updates",
  "determines-c2-server",
  "emails-spam",
  "escalates-privileges",
  "evades-av",
  "exfiltrates-data",
  "fingerprints-host",
  "hides-artifacts",
  "hides-executing-code",
  "infects-files",
  "infects-remote-machines",
  "installs-other-components",
  "persists-after-system-reboot",
  "prevents-artifact-access",
  "prevents-artifact-deletion",
  "probes-network-environment",
  "self-modifies",
  "steals-authentication-credentials",
  "violates-system-operational-integrity"
]);
var ToolTypeOV = import_v411.z.enum([
  "denial-of-service",
  "exploitation",
  "information-gathering",
  "network-capture",
  "credential-exploitation",
  "remote-access",
  "vulnerability-scanning",
  "unknown"
]);
var IdentityClassOV = import_v411.z.enum([
  "individual",
  "group",
  "system",
  "organization",
  "class",
  "unspecified"
]);
var AttackMotivationOV = import_v411.z.enum([
  "accidental",
  "coercion",
  "dominance",
  "ideology",
  "notoriety",
  "organizational-gain",
  "personal-gain",
  "personal-satisfaction",
  "revenge",
  "unpredictable"
]);
var AttackResourceLevelOV = import_v411.z.enum([
  "individual",
  "club",
  "contest",
  "team",
  "organization",
  "government"
]);
var IndustrySectorOV = import_v411.z.enum([
  "agriculture",
  "aerospace",
  "automotive",
  "chemical",
  "commercial",
  "communications",
  "construction",
  "defense",
  "education",
  "energy",
  "entertainment",
  "financial-services",
  "government",
  "government-emergency-services",
  "government-local",
  "government-national",
  "government-public-services",
  "government-regional",
  "healthcare",
  "hospitality-leisure",
  "infrastructure",
  "infrastructure-dams",
  "infrastructure-nuclear",
  "infrastructure-water",
  "insurance",
  "manufacturing",
  "mining",
  "non-profit",
  "pharmaceuticals",
  "retail",
  "technology",
  "telecommunications",
  "transportation",
  "utilities"
]);
var MitreCollectionLayerOV = import_v411.z.enum([
  "Cloud Control Plane",
  "Host",
  "Report",
  "Container",
  "Device",
  "OSINT",
  "Network"
]);
var PatternTypeOV = import_v411.z.enum(["spl", "stix", "pcre", "sigma", "snort", "suricata", "yara"]).meta({
  description: "This is a non-exhaustive, open vocabulary that covers common pattern languages and is intended to characterize the pattern language that the indicator pattern is expressed in."
});
var IndicatorTypeOV = import_v411.z.enum([
  "anomalous-activity",
  "anonymization",
  "benign",
  "compromised",
  "malicious-activity",
  "attribution",
  "unknown"
]).meta({
  description: "Indicator type is an open vocabulary used to categorize Indicators. It is intended to be high-level to promote consistent practices. Indicator types should not be used to capture information that can be better captured via related Malware or Attack Pattern objects. It is better to link an Indicator to a Malware object describing Poison Ivy rather than simply providing a type or label of 'poison-ivy.'"
});

// src/schemas/common/property-schemas/stix-timestamp.ts
var import_v412 = require("zod/v4");
var stixTimestampSchema = import_v412.z.iso.datetime({
  error: "Invalid STIX timestamp format: must be an RFC3339 timestamp with a timezone specification of 'Z'."
}).refine((val) => val.endsWith("Z"), {
  message: "STIX timestamps must use 'Z' timezone specification"
}).meta({
  description: "Represents timestamps across the CTI specifications. The format is an RFC3339 timestamp, with a required timezone specification of 'Z'."
});
var stixCreatedTimestampSchema = stixTimestampSchema;
var stixModifiedTimestampSchema = stixTimestampSchema;

// src/schemas/common/stix-core.ts
var import_v413 = require("zod/v4");
var stixBaseObjectSchema = import_v413.z.object({
  id: stixIdentifierSchema.meta({
    description: "The id property universally and uniquely identifies this object."
  }),
  type: stixTypeSchema,
  spec_version: stixSpecVersionSchema.meta({
    description: "The version of the STIX specification used to represent this object."
  }),
  created: stixCreatedTimestampSchema.meta({
    description: "The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest millisecond."
  }),
  modified: stixModifiedTimestampSchema.meta({
    description: "The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest millisecond."
  }),
  created_by_ref: stixCreatedByRefSchema.optional(),
  labels: stixListOfString.optional().meta({
    description: "The labels property specifies a set of terms used to meta this object."
  }),
  revoked: import_v413.z.boolean().optional().meta({ description: "The revoked property indicates whether the object has been revoked." }),
  confidence: import_v413.z.number().int().min(1).max(99).optional().refine((val) => val === void 0 || val > 0 && val < 100, {
    message: "Confidence must be between 1 and 99 inclusive."
  }).optional().meta({
    description: "Identifies the confidence that the creator has in the correctness of their data."
  }),
  lang: nonEmptyRequiredString.optional().meta({ description: "Identifies the language of the text content in this object." }),
  external_references: externalReferencesSchema.optional(),
  object_marking_refs: objectMarkingRefsSchema.optional(),
  granular_markings: import_v413.z.array(granularMarkingSchema).optional().meta({ description: "The set of granular markings that apply to this object." }),
  extensions: extensionsSchema.optional()
}).strict();
var stixDomainObjectSchema = stixBaseObjectSchema.extend({});
var stixRelationshipObjectSchema = stixBaseObjectSchema.extend({});

// src/schemas/common/attack-core.ts
var attackBaseObjectSchema = stixDomainObjectSchema.extend({
  name: nameSchema,
  /**
   * Required on all ATT&CK schemas except:
   *  - Marking Definition
   */
  x_mitre_attack_spec_version: xMitreAttackSpecVersionSchema,
  /**
   * Required on all ATT&CK schemas except:
   *  - Marking Definition
   *  - Identity
   *  - Relationship
   */
  x_mitre_version: xMitreVersionSchema,
  x_mitre_old_attack_id: xMitreOldAttackIdSchema.optional(),
  x_mitre_deprecated: xMitreDeprecatedSchema.optional()
});
var attackBaseDomainObjectSchema = attackBaseObjectSchema.extend({});
var attackBaseRelationshipObjectSchema = attackBaseObjectSchema.extend({});
var attackBaseMetaObjectSchema = attackBaseObjectSchema.extend({}).omit({ modified: true });

// src/schemas/sdo/analytic.schema.ts
var import_v416 = require("zod/v4");

// src/refinements/index.ts
var import_v415 = require("zod/v4");
function createFirstAliasRefinement() {
  return (ctx) => {
    if (ctx.value.aliases && ctx.value.aliases.length > 0 && ctx.value.name) {
      if (ctx.value.aliases[0] !== ctx.value.name) {
        ctx.issues.push({
          code: "custom",
          message: "The first alias must match the object's name.",
          path: ["aliases"],
          input: ctx.value.aliases
        });
      }
    }
  };
}
function createFirstXMitreAliasRefinement() {
  return (ctx) => {
    if (ctx.value.x_mitre_aliases && ctx.value.x_mitre_aliases.length > 0 && ctx.value.name) {
      if (ctx.value.x_mitre_aliases[0] !== ctx.value.name) {
        ctx.issues.push({
          code: "custom",
          message: "The first alias must match the object's name.",
          path: ["x_mitre_aliases"],
          input: ctx.value.x_mitre_aliases
        });
      }
    }
  };
}
function createCitationsRefinement() {
  return (ctx) => {
    const { external_references, x_mitre_first_seen_citation, x_mitre_last_seen_citation } = ctx.value;
    if (!Array.isArray(external_references)) {
      return;
    }
    const extractCitationNames = (citations) => {
      const matches = citations.match(/\(Citation: ([^)]+)\)/g);
      return matches ? matches.map((match) => match.slice(10, -1).trim()) : [];
    };
    const validateCitationString = (citations, path) => {
      const citationNames = extractCitationNames(citations);
      citationNames.forEach((citationName, index) => {
        const citationExists = external_references.some((ref) => ref.source_name === citationName);
        if (!citationExists) {
          ctx.issues.push({
            code: "custom",
            message: `Citation ${citationName} not found in external_references.`,
            path: [...path, index],
            input: citationName
          });
        }
      });
      if (!citations.match(/^(\(Citation: [^)]+\))+$/)) {
        ctx.issues.push({
          code: "custom",
          message: "Citations must be in the format '(Citation: Name1)(Citation: Name2)...' without any separators.",
          path,
          input: citations
        });
      }
    };
    if (x_mitre_first_seen_citation) {
      validateCitationString(x_mitre_first_seen_citation, ["x_mitre_first_seen_citation"]);
    }
    if (x_mitre_last_seen_citation) {
      validateCitationString(x_mitre_last_seen_citation, ["x_mitre_last_seen_citation"]);
    }
  };
}
function validateXMitreCollection() {
  return (ctx) => {
    const objects = ctx.value.objects;
    if (objects.length === 0) {
      return;
    }
    const firstObject = objects[0];
    if (firstObject.type !== "x-mitre-collection") {
      ctx.issues.push({
        code: "custom",
        message: "The first object in the 'objects' array must be of type 'x-mitre-collection'",
        path: ["objects", 0, "type"],
        input: firstObject.type
      });
    }
    const collectionObjects = objects.filter((obj) => obj.type === "x-mitre-collection");
    if (collectionObjects.length > 1) {
      objects.forEach((obj, index) => {
        if (index > 0 && obj.type === "x-mitre-collection") {
          ctx.issues.push({
            code: "custom",
            message: "Only one 'x-mitre-collection' object is allowed in the bundle. Found multiple collection objects.",
            path: ["objects", index, "type"],
            input: obj.type
          });
        }
      });
    }
  };
}
function validateNoDuplicates(arrayPath, keys, errorMessage) {
  return (ctx) => {
    let arr = ctx.value;
    for (const pathSegment of arrayPath) {
      if (arr && typeof arr === "object") {
        arr = arr[pathSegment];
      } else {
        return;
      }
    }
    if (!Array.isArray(arr)) {
      return;
    }
    const seen = /* @__PURE__ */ new Map();
    arr.forEach((item, index) => {
      const keyValues = keys.length === 0 ? [String(item)] : keys.map((key) => {
        const value = item?.[key];
        return value !== void 0 ? String(value) : "";
      });
      const compositeKey = keyValues.join("||");
      if (seen.has(compositeKey)) {
        const keyValuePairs = keys.reduce(
          (acc, key, i) => {
            acc[key] = keyValues[i];
            return acc;
          },
          {}
        );
        let message = errorMessage;
        if (!message) {
          if (keys.length === 0) {
            message = `Duplicate value "${keyValues[0]}" found at index ${index}. Previously seen at index ${seen.get(compositeKey)}.`;
          } else if (keys.length === 1) {
            message = `Duplicate object with ${keys[0]}="${keyValues[0]}" found at index ${index}. Previously seen at index ${seen.get(compositeKey)}.`;
          } else {
            const keyPairs = keys.map((key, i) => `${key}="${keyValues[i]}"`).join(", ");
            message = `Duplicate object with ${keyPairs} found at index ${index}. Previously seen at index ${seen.get(compositeKey)}.`;
          }
        } else {
          message = message.replace(/\{(\w+)\}/g, (match, key) => {
            if (key === "index") return String(index);
            if (key === "value" && keys.length === 0) return keyValues[0];
            return keyValuePairs[key] ?? match;
          });
        }
        ctx.issues.push({
          code: "custom",
          message,
          path: keys.length === 0 ? [...arrayPath, index] : [...arrayPath, index, ...keys],
          input: keys.length === 0 ? item : keys.length === 1 ? item?.[keys[0]] : keyValuePairs
        });
      } else {
        seen.set(compositeKey, index);
      }
    });
  };
}
function validateXMitreContentsReferences() {
  return (ctx) => {
    const collectionObject = ctx.value.objects[0];
    const collectionContents = collectionObject.x_mitre_contents;
    if (!collectionContents) {
      return;
    }
    const objectIds = new Set(ctx.value.objects.map((obj) => obj.id));
    collectionContents.forEach((contentRef, index) => {
      const ref = contentRef.object_ref;
      if (!objectIds.has(ref)) {
        ctx.issues.push({
          code: "custom",
          message: `STIX ID "${ref}" referenced in x_mitre_contents is not present in the bundle's objects array`,
          path: ["objects", 0, "x_mitre_contents", index, "object_ref"],
          input: ref
        });
      }
    });
  };
}
function createAttackIdInExternalReferencesRefinement() {
  return (ctx) => {
    if (ctx.value.external_references === void 0) {
      return;
    }
    if (ctx.value.x_mitre_is_subtechnique === void 0) {
      return;
    }
    if (!Array.isArray(ctx.value.external_references) || ctx.value.external_references.length === 0) {
      ctx.issues.push({
        code: "custom",
        message: "At least one external reference with an ATT&CK ID is required.",
        path: ["external_references"],
        input: ctx.value.external_references
      });
      return;
    }
    const attackIdEntry = ctx.value.external_references[0];
    if (!attackIdEntry || typeof attackIdEntry !== "object") {
      ctx.issues.push({
        code: "custom",
        message: "First external reference must be a valid object.",
        path: ["external_references", 0],
        input: attackIdEntry
      });
      return;
    }
    if (!attackIdEntry.external_id || typeof attackIdEntry.external_id !== "string") {
      ctx.issues.push({
        code: "custom",
        message: "ATT&CK ID must be defined in the first external_references entry.",
        path: ["external_references", 0, "external_id"],
        input: attackIdEntry.external_id
      });
      return;
    }
    const idPattern = ctx.value.x_mitre_is_subtechnique ? attackIdPatterns.subtechnique : attackIdPatterns.technique;
    const message = ctx.value.x_mitre_is_subtechnique ? `The first external_reference must match the ATT&CK ID format ${attackIdExamples.subtechnique}.` : `The first external_reference must match the ATT&CK ID format ${attackIdExamples.technique}.`;
    if (!idPattern.test(attackIdEntry.external_id)) {
      ctx.issues.push({
        code: "custom",
        message,
        path: ["external_references", 0, "external_id"],
        input: attackIdEntry.external_id
      });
    }
    if (!attackIdEntry.source_name || attackIdEntry.source_name !== "mitre-attack") {
      ctx.issues.push({
        code: "custom",
        message: 'The first external_reference must have source_name set to "mitre-attack".',
        path: ["external_references", 0, "source_name"],
        input: attackIdEntry.source_name
      });
    }
  };
}
function createEnterpriseOnlyPropertiesRefinement() {
  return (ctx) => {
    if (!Array.isArray(ctx.value.x_mitre_domains)) {
      return;
    }
    const inEnterpriseDomain = ctx.value.x_mitre_domains.includes(
      attackDomainSchema.enum["enterprise-attack"]
    );
    const tactics = ctx.value.kill_chain_phases?.map((tactic) => tactic.phase_name) || [];
    function validateEnterpriseOnlyField(fieldName, value, requiredTactic = null) {
      if (value !== void 0) {
        if (!inEnterpriseDomain) {
          ctx.issues.push({
            code: "custom",
            message: `${fieldName} is only supported in the 'enterprise-attack' domain.`,
            path: [fieldName],
            input: value
          });
        } else if (requiredTactic && ctx.value.kill_chain_phases !== void 0 && !tactics.includes(requiredTactic)) {
          ctx.issues.push({
            code: "custom",
            message: `${fieldName} is only supported in the ${requiredTactic} tactic.`,
            path: [fieldName],
            input: value
          });
        }
      }
    }
    validateEnterpriseOnlyField(
      "x_mitre_system_requirements",
      ctx.value.x_mitre_system_requirements
    );
    validateEnterpriseOnlyField(
      "x_mitre_permissions_required",
      ctx.value.x_mitre_permissions_required,
      "privilege-escalation"
    );
    validateEnterpriseOnlyField(
      "x_mitre_effective_permissions",
      ctx.value.x_mitre_effective_permissions,
      "privilege-escalation"
    );
    validateEnterpriseOnlyField(
      "x_mitre_defense_bypassed",
      ctx.value.x_mitre_defense_bypassed,
      "defense-evasion"
    );
    validateEnterpriseOnlyField(
      "x_mitre_remote_support",
      ctx.value.x_mitre_remote_support,
      "execution"
    );
    validateEnterpriseOnlyField("x_mitre_impact_type", ctx.value.x_mitre_impact_type, "impact");
    if (ctx.value.x_mitre_data_sources && inEnterpriseDomain && ctx.value.x_mitre_domains.includes(attackDomainSchema.enum["mobile-attack"])) {
      ctx.issues.push({
        code: "custom",
        message: "x_mitre_data_sources is not supported in the 'mobile-attack' domain.",
        path: ["x_mitre_data_sources"],
        input: ctx.value.x_mitre_data_sources
      });
    }
  };
}
function createMobileOnlyPropertiesRefinement() {
  return (ctx) => {
    if (!Array.isArray(ctx.value.x_mitre_domains)) {
      return;
    }
    const inMobileDomain = ctx.value.x_mitre_domains.includes(
      attackDomainSchema.enum["mobile-attack"]
    );
    if (ctx.value.x_mitre_tactic_type?.length && !inMobileDomain) {
      ctx.issues.push({
        code: "custom",
        message: "x_mitre_tactic_type is only supported in the 'mobile-attack' domain.",
        path: ["x_mitre_tactic_type"],
        input: ctx.value.x_mitre_tactic_type
      });
    }
    if (ctx.value.x_mitre_data_sources && inMobileDomain) {
      ctx.issues.push({
        code: "custom",
        message: "x_mitre_data_sources is not supported in the 'mobile-attack' domain.",
        path: ["x_mitre_data_sources"],
        input: ctx.value.x_mitre_data_sources
      });
    }
  };
}

// src/schemas/sdo/analytic.schema.ts
var xMitreLogSourceReferenceSchema = import_v416.z.object({
  x_mitre_data_component_ref: createStixIdValidator("x-mitre-data-component"),
  name: nonEmptyRequiredString.meta({
    description: "Log source name from the associated data component's `x_mitre_log_sources` array"
  }),
  channel: nonEmptyRequiredString.meta({
    description: "Log source channel from the data component's `x_mitre_log_sources` array"
  })
}).meta({
  description: "The `log_source_reference` object links analytics to specific data components with log source details"
});
var xMitreLogSourceReferencesSchema = import_v416.z.array(xMitreLogSourceReferenceSchema).min(1).check((ctx) => {
  validateNoDuplicates(
    [],
    ["x_mitre_data_component_ref", "name", "channel"],
    "Duplicate log source reference found: each (x_mitre_data_component_ref, name, channel) tuple must be unique"
  )(ctx);
}).meta({
  description: "A list of log source references, which are delineated by a Data Component STIX ID and the (`name`, `channel`) that is being targeted."
});
var xMitreMutableElementSchema = import_v416.z.object({
  field: nonEmptyRequiredString.meta({
    description: "Name of the detection field that can be tuned"
  }),
  description: nonEmptyRequiredString.meta({
    description: "Rationale for tunability and environment-specific considerations"
  })
}).meta({
  description: "The `mutable_element` object defines tunable parameters within analytics"
});
var xMitreMutableElementsSchema = import_v416.z.array(xMitreMutableElementSchema).min(1).meta({
  description: "Environment-specific tuning knobs like TimeWindow, UserContext, or PortRange, so defenders can adapt without changing core behavior."
});
var analyticSchema = attackBaseDomainObjectSchema.extend({
  id: createStixIdValidator("x-mitre-analytic"),
  type: createStixTypeValidator("x-mitre-analytic"),
  description: descriptionSchema,
  x_mitre_platforms: xMitrePlatformsSchema.max(1).meta({ description: "Target platform for this Analytic." }),
  // 0 or 1
  external_references: createAttackExternalReferencesSchema("x-mitre-analytic"),
  x_mitre_log_source_references: xMitreLogSourceReferencesSchema.optional(),
  x_mitre_mutable_elements: xMitreMutableElementsSchema.optional(),
  x_mitre_domains: xMitreDomainsSchema,
  x_mitre_modified_by_ref: xMitreModifiedByRefSchema.optional()
}).required({
  created_by_ref: true,
  object_marking_refs: true
}).strict().meta({
  description: `
Analytics contain platform-specific detection logic and represent the implementation details of a detection strategy.
They are defined as \`x-mitre-analytic\` objects extending the generic
[STIX Domain Object pattern](https://docs.oasis-open.org/cti/stix/v2.0/csprd01/part2-stix-objects/stix-v2.0-csprd01-part2-stix-objects.html#_Toc476230920).
    `.trim()
});

// src/schemas/sdo/asset.schema.ts
var import_v417 = require("zod/v4");
var supportedAssetSectors = [
  "Electric",
  "Water and Wastewater",
  "Manufacturing",
  "Rail",
  "Maritime",
  "General"
];
var xMitreSectorsSchema = import_v417.z.array(
  import_v417.z.enum(supportedAssetSectors, {
    error: () => `Sector must be one of: ${supportedAssetSectors.join(", ")}`
  }),
  {
    error: (issue) => issue.code === "invalid_type" ? "related_asset_sectors must be an array" : "Invalid asset sectors array"
  }
).min(1).meta({
  description: "List of industry sector(s) where this asset is commonly observed."
});
var relatedAssetSchema = import_v417.z.object({
  name: nameSchema.meta({
    description: "Sector-specific name or alias for the related asset"
  }),
  related_asse