main.go

package main

import (
	"bufio"
	"context"
	"encoding/json"
	"flag"
	"fmt"
	"io"
	"net/http"
	"os"
	"path/filepath"
	"strings"
	"time"

	"gopkg.in/yaml.v3"

	"TelemetryCollectionManager/internal/auth"
	"TelemetryCollectionManager/internal/banner"
	"TelemetryCollectionManager/internal/mdeapi"
	"TelemetryCollectionManager/internal/model"
	"TelemetryCollectionManager/internal/rule"
	"TelemetryCollectionManager/internal/validate"
	embedmodel "TelemetryCollectionManager/model"
)

const azureMTPResource = "https://securitycenter.microsoft.com/mtp"

// loadDotEnv loads KEY=VALUE pairs from one or more .env files.
// Existing environment variables take precedence and are not overwritten.
func loadDotEnv(paths ...string) {
	if len(paths) == 0 {
		paths = []string{".env"}
	}
	for _, p := range paths {
		f, err := os.Open(p)
		if err != nil {
			continue
		}
		scanner := bufio.NewScanner(f)
		for scanner.Scan() {
			line := strings.TrimSpace(scanner.Text())
			if line == "" || strings.HasPrefix(line, "#") {
				continue
			}
			// find first '='
			eq := strings.IndexRune(line, '=')
			if eq <= 0 {
				continue
			}
			key := strings.TrimSpace(line[:eq])
			val := strings.TrimSpace(line[eq+1:])
			// strip surrounding quotes
			if (strings.HasPrefix(val, "\"") && strings.HasSuffix(val, "\"")) || (strings.HasPrefix(val, "'") && strings.HasSuffix(val, "'")) {
				if len(val) >= 2 {
					val = val[1 : len(val)-1]
				}
			}
			if os.Getenv(key) == "" {
				_ = os.Setenv(key, val)
			}
		}
		_ = f.Close()
	}
}

func maskToken(t string, full bool) string {
	if full || t == "" {
		return t
	}
	if len(t) <= 16 {
		return "***" // too short; avoid leaking
	}
	return t[:8] + "..." + t[len(t)-8:]
}

func main() {
	var (
		rulesDir         string
		outputPath       string
		validateOnly     bool
		diagnosticsOut   string
		schemaPath       string
		emitAuthorSchema string
		apiBaseURL       string
		exportRules      bool
		clearRules       bool
		postRules        bool
		authMode         string
		tenantID         string
		clientID         string
		clientSecret     string
		miClientID       string
		aadScope         string
		verbose          bool
		listRules        bool
		deleteRules      string
		importJSON       string
		importUpdate     bool
		updateModel      bool
	)
	// Load .env before reading env for defaults
	loadDotEnv()

	flag.StringVar(&rulesDir, "rules", "rules", "Directory containing author YAML rules")
	flag.StringVar(&outputPath, "out", "export-rules.json", "Output JSON file of transformed rules (ignored with --validate-only)")
	flag.BoolVar(&validateOnly, "validate-only", false, "Validate rules without producing output JSON")
	flag.StringVar(&diagnosticsOut, "diagnostics", "", "Optional path to write validation diagnostics JSON (errors & warnings)")
	flag.StringVar(&schemaPath, "schema", filepath.Join("model", "mde-model.json"), "Path to MDE model schema JSON (default model/mde-model.json)")
	flag.StringVar(&emitAuthorSchema, "emit-author-schema", "", "Write generated authoring JSON Schema to this path and exit")

	flag.StringVar(&apiBaseURL, "api-base", "https://wdatpprd-weu.securitycenter.windows.com", "Base URL for Defender API")
	flag.BoolVar(&exportRules, "export-rules", false, "Export rules from Defender API as JSON and exit")
	flag.BoolVar(&postRules, "post-rules", false, "Post generated/validated rules to the Defender API")
 flag.BoolVar(&listRules, "list-rules", false, "List rules in a table (ruleId, ruleName, status, lastModifiedBy, lastModificationDateTimeUtc)")
	flag.BoolVar(&updateModel, "update-model", false, "Download latest model JSON from MDE and save to model/mde-model.json. (Only needed when self building from source.)")
	flag.StringVar(&deleteRules, "delete-rules", "", "Comma-separated rule IDs to delete, or 'all' to delete all")
	flag.StringVar(&importJSON, "import-json", "", "Path to rules JSON export to convert into YAML in --rules directory")
	flag.BoolVar(&importUpdate, "import-update", false, "When importing JSON, update existing YAML files if content differs (default: only add new)")
	// Auth flags
	flag.StringVar(&authMode, "auth", "token", "Auth mode: token|msi|sp (currently only token is supported by Microsoft for API operations")
	flag.StringVar(&tenantID, "tenant-id", os.Getenv("AZURE_TENANT_ID"), "Azure AD tenant ID (sp mode)")
	flag.StringVar(&clientID, "client-id", os.Getenv("AZURE_CLIENT_ID"), "Azure AD application/client ID (sp or msi user-assigned)")
	flag.StringVar(&clientSecret, "client-secret", os.Getenv("AZURE_CLIENT_SECRET"), "Azure AD client secret (sp mode)")
	flag.StringVar(&miClientID, "mi-client-id", "", "User-assigned managed identity client ID (msi mode)")
	flag.StringVar(&aadScope, "aad-scope", "https://api.securitycenter.microsoft.com/.default", "AAD scope to request")
	flag.BoolVar(&verbose, "verbose", false, "Verbose logging for API calls and auth context")
	// Custom grouped help
	flag.Usage = func() {
		out := flag.CommandLine.Output()
		banner.PrintBanner()
		fmt.Fprintf(out, "Usage: %s [options]\n\n", filepath.Base(os.Args[0]))
		printFlag := func(name string) {
			if f := flag.Lookup(name); f != nil {
				// align output similar to default flag package
				if f.DefValue == "" {
					fmt.Fprintf(out, "  --%s\n\t%s\n", f.Name, f.Usage)
				} else {
					fmt.Fprintf(out, "  --%s\n\t%s (default %q)\n", f.Name, f.Usage, f.DefValue)
				}
			}
		}
		// Sections
		fmt.Fprintln(out, "Rules & Output:")
		for _, n := range []string{"rules", "schema", "emit-author-schema", "out", "diagnostics", "validate-only", "import-json", "import-update"} {
			printFlag(n)
		}
		fmt.Fprintln(out, "\nAPI:")
		for _, n := range []string{"update-model", "api-base", "export-rules", "list-rules", "delete-rules", "post-rules"} {
			printFlag(n)
		}
		// Added for future readiness:
		//fmt.Fprintln(out, "\nAuth:")
		//for _, n := range []string{"auth", "tenant-id", "client-id", "client-secret", "mi-client-id", "aad-scope"} {
		//	printFlag(n)
		//}
		fmt.Fprintln(out)
		fmt.Fprintln(out, "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-")
		fmt.Fprintln(out, "Token mode: set AZURE_TOKEN (or ACCESS_TOKEN) in environment/.env; if unset, the current az CLI session is used to request https://securitycenter.microsoft.com/mtp.")
		fmt.Fprintln(out, "Note: Service Principal and Managed Identity are not officially supported by Microsoft for this API yet; included for future readiness.")
		fmt.Fprintln(out, "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-")
		fmt.Fprintln(out)
	}

	// If no arguments were provided, show help and exit without doing anything.
	if len(os.Args) == 1 {
		flag.Usage()
		return
	}

	flag.Parse()

	// Load model schema: prefer embedded for single-binary usage, then override with file if provided
	schemaBytes := embedmodel.MDEModel
	if schemaPath != "" {
		if b, err := os.ReadFile(schemaPath); err == nil {
			schemaBytes = b
		}
	}
	if len(schemaBytes) == 0 {
		fatalErr(fmt.Errorf("no model available: embedded model empty and path '%s' not readable", schemaPath))
	}
	var schema model.Schema
	if err := json.Unmarshal(schemaBytes, &schema); err != nil {
		fatalErr(fmt.Errorf("parsing schema: %w", err))
	}
	idx := schema.BuildIndex()

	// Build token provider if any API operation will be invoked
	var provider auth.TokenProvider
	switch authMode {
	case "token":
		provider = &auth.EnvOrCLITokenProvider{EnvKeys: []string{"AZURE_TOKEN", "ACCESS_TOKEN"}, Resource: azureMTPResource}
	case "msi":
		provider = &auth.ManagedIdentityProvider{ClientID: miClientID, Scope: aadScope}
	case "sp":
		provider = &auth.ServicePrincipalProvider{TenantID: tenantID, ClientID: clientID, ClientSecret: clientSecret, Scope: aadScope}
	default:
		fatalErr(fmt.Errorf("unknown --auth mode: %s", authMode))
	}

	// Emit authoring JSON Schema and exit if requested
	if emitAuthorSchema != "" {
		js, err := model.GenerateAuthoringJSONSchema(&schema)
		if err != nil {
			fatalErr(fmt.Errorf("generate author schema: %w", err))
		}
		if err := os.MkdirAll(filepath.Dir(emitAuthorSchema), 0o755); err != nil {
			fatalErr(err)
		}
		if err := os.WriteFile(emitAuthorSchema, js, 0o644); err != nil {
			fatalErr(err)
		}
		fmt.Fprintf(os.Stderr, "Wrote authoring JSON Schema to %s\n", emitAuthorSchema)
		return
	}

	// Pre-handle API-only operations (do not require local rules)
	if exportRules || clearRules || listRules || deleteRules != "" || updateModel {
		tok, err := provider.Token(context.Background())
		if err != nil {
			fatalErr(fmt.Errorf("acquire token: %w", err))
		}
		if tok == "" {
			fatalErr(fmt.Errorf("token is required (set AZURE_TOKEN/ACCESS_TOKEN in env/.env or ensure az CLI session is logged in, or configure --auth msi|sp)"))
		}
		if verbose {
			fmt.Fprintf(os.Stderr, "Auth mode: %s\n", authMode)
			fmt.Fprintf(os.Stderr, "AAD scope: %s\n", aadScope)
			fmt.Fprintf(os.Stderr, "Using token: %s\n", maskToken(tok, false))
		}
		if updateModel {
			// Fetch the model JSON from the fixed endpoint using the same bearer token
			const modelURL = "https://mde-dtc-snsexclusions-prd-weu.securitycenter.windows.com/api/sense-collection/model"
			httpClient := &http.Client{Timeout: 60 * time.Second}
			req, err := http.NewRequest(http.MethodGet, modelURL, nil)
			if err != nil {
				fatalErr(fmt.Errorf("create request: %w", err))
			}
			req.Header.Set("Authorization", "Bearer "+tok)
			if verbose {
				fmt.Fprintf(os.Stderr, "API GET %s\n", modelURL)
			}
			resp, err := httpClient.Do(req)
			if err != nil {
				fatalErr(fmt.Errorf("request model: %w", err))
			}
			defer resp.Body.Close()
			b, err := io.ReadAll(resp.Body)
			if err != nil {
				fatalErr(fmt.Errorf("read model response: %w", err))
			}
			if resp.StatusCode < 200 || resp.StatusCode >= 300 {
				if len(b) > 0 {
					fatalErr(fmt.Errorf("GET %s failed: %s: %s", modelURL, resp.Status, string(b)))
				}
				fatalErr(fmt.Errorf("GET %s failed: %s", modelURL, resp.Status))
			}
			// Ensure destination directory exists and write file
			destPath := filepath.Join("model", "mde-model.json")
			if err := os.MkdirAll(filepath.Dir(destPath), 0o755); err != nil {
				fatalErr(err)
			}
			if err := os.WriteFile(destPath, b, 0o644); err != nil {
				fatalErr(err)
			}
			fmt.Fprintf(os.Stderr, "Wrote model to %s\n", destPath)
			return
		}
		client := mdeapi.New(apiBaseURL, tok)
		client.Verbose = verbose
		if exportRules {
			b, err := client.GetRules()
			if err != nil {
				fatalErr(err)
			}
			if outputPath == "-" || outputPath == "" {
				os.Stdout.Write(append(b, '\n'))
			} else {
				if err := os.WriteFile(outputPath, b, 0o644); err != nil {
					fatalErr(err)
				}
				fmt.Fprintf(os.Stderr, "Wrote rules export to %s\n", outputPath)
			}
			return
		}
  if listRules {
            b, err := client.GetRules()
            if err != nil {
                fatalErr(err)
            }
            // minimal struct for tabular list
            var arr []struct {
                RuleID                      string `json:"ruleId"`
                RuleName                    string `json:"ruleName"`
                IsEnabled                   bool   `json:"isEnabled"`
                LastModifiedBy              string `json:"lastModifiedBy"`
                LastModificationDateTimeUtc string `json:"lastModificationDateTimeUtc"`
            }
            if err := json.Unmarshal(b, &arr); err != nil {
                fatalErr(err)
            }
            // header
            fmt.Fprintf(os.Stdout, "%-36s  %-40s  %-8s  %-30s  %s\n", "ruleId", "ruleName", "status", "lastModifiedBy", "lastModificationDateTimeUtc")
            for _, it := range arr {
                status := "disabled"
                if it.IsEnabled {
                    status = "enabled"
                }
                fmt.Fprintf(os.Stdout, "%-36s  %-40s  %-8s  %-30s  %s\n", it.RuleID, truncate(it.RuleName, 40), status, truncate(it.LastModifiedBy, 30), it.LastModificationDateTimeUtc)
            }
            return
        }
		// Delete rules: specific IDs or all
		if deleteRules != "" || clearRules {
			if clearRules && deleteRules == "" {
				// Back-compat. Warn and proceed to delete all.
				fmt.Fprintln(os.Stderr, "Warning: --clear-rules is deprecated; use --delete-rules=all")
			}
			if deleteRules == "all" || (clearRules && deleteRules == "") {
				b, err := client.GetRules()
				if err != nil {
					fatalErr(err)
				}
				var arr []struct {
					RuleID string `json:"ruleId"`
				}
				if err := json.Unmarshal(b, &arr); err != nil {
					fatalErr(err)
				}
				deleted := 0
				for _, it := range arr {
					if it.RuleID == "" {
						continue
					}
					if err := client.DeleteRule(it.RuleID); err != nil {
						fmt.Fprintf(os.Stderr, "Failed to delete %s: %v\n", it.RuleID, err)
						continue
					}
					deleted++
				}
				fmt.Fprintf(os.Stderr, "Deleted %d rules\n", deleted)
				return
			}
			if deleteRules != "" && deleteRules != "all" {
				ids := strings.Split(deleteRules, ",")
				deleted := 0
				for _, raw := range ids {
					id := strings.TrimSpace(raw)
					if id == "" {
						continue
					}
					if err := client.DeleteRule(id); err != nil {
						fmt.Fprintf(os.Stderr, "Failed to delete %s: %v\n", id, err)
						continue
					}
					deleted++
				}
				fmt.Fprintf(os.Stderr, "Deleted %d specified rules\n", deleted)
				return
			}
			// If we got here, delete-rules provided but not 'all' and no valid IDs (e.g., empty list)
			b, err := client.GetRules()
			if err != nil {
				fatalErr(err)
			}
			// Show user a helpful hint: perhaps they intended 'all'
			fmt.Fprintln(os.Stderr, "No valid rule IDs provided. Use --delete-rules=all to delete all, or provide comma-separated rule IDs.")
			// Also print a quick count for visibility
			var arr []struct {
				RuleID string `json:"ruleId"`
			}
			_ = json.Unmarshal(b, &arr)
			fmt.Fprintf(os.Stderr, "There are currently %d rules in the tenant.\n", len(arr))
			os.Exit(1)
		}
	}

	// Ensure rules directory exists
	if _, err := os.Stat(rulesDir); os.IsNotExist(err) {
		fatalErr(fmt.Errorf("rules directory does not exist: %s", rulesDir))
	}
	// Optional: import JSON export into YAML before processing
	if importJSON != "" {
		created, updated, skipped, total, err := importJSONToYAML(importJSON, rulesDir, importUpdate)
		if err != nil {
			fatalErr(err)
		}
		// Provide a clear summary and exit when only importing
		fmt.Printf("Imported %d rules from %s into %s\n", total, importJSON, rulesDir)
		fmt.Printf("Created %d YAML files, updated %d, skipped %d (existing/identical)\n", created, updated, skipped)
		return
	}

	authorRules, err := rule.LoadAuthorRules(rulesDir)
	if err != nil {
		fatalErr(err)
	}

	v := validate.New(idx)
	var apiRules []rule.APIExportRule
	hadErrors := false
	type diag struct {
		RuleName string   `json:"ruleName"`
		Errors   []string `json:"errors,omitempty"`
		Warnings []string `json:"warnings,omitempty"`
	}
	var diagnostics []diag
	for _, ar := range authorRules {
		res := v.ValidateAuthorRule(ar)
		if len(res.Errors) > 0 {
			hadErrors = true
		}
		diagnostics = append(diagnostics, diag{RuleName: ar.Name, Errors: res.Errors, Warnings: res.Warnings})
		if len(res.Errors) == 0 {
			apiRules = append(apiRules, rule.Transform(ar))
		}
	}

	if diagnosticsOut != "" {
		db, err := json.MarshalIndent(diagnostics, "", "  ")
		if err != nil {
			fatalErr(err)
		}
		if err := os.WriteFile(diagnosticsOut, db, 0o644); err != nil {
			fatalErr(err)
		}
	}
	// If validation failed and no diagnostics file was requested, print human-readable diagnostics to stderr
	if hadErrors && diagnosticsOut == "" {
		fmt.Fprintln(os.Stderr, "Validation diagnostics:")
		for _, d := range diagnostics {
			if len(d.Errors) == 0 {
				continue
			}
			fmt.Fprintf(os.Stderr, "- Rule: %s\n", d.RuleName)
			for _, e := range d.Errors {
				fmt.Fprintf(os.Stderr, "  ERROR: %s\n", e)
			}
			for _, w := range d.Warnings {
				fmt.Fprintf(os.Stderr, "  WARN: %s\n", w)
			}
		}
	}
	if hadErrors {
		fmt.Fprintln(os.Stderr, "Validation failed (see diagnostics)")
		if validateOnly {
			// Stricter exit for validate-only when errors exist
			os.Exit(2)
		}
		// Non-validate-only: prevent writing output and exit non-zero
		os.Exit(1)
	}

	if validateOnly {
		fmt.Printf("Validated %d rules (errors=%v). No output generated due to --validate-only.\n", len(diagnostics), hadErrors)
		return
	}

	// Create output or post to API
	b, err := json.MarshalIndent(apiRules, "", "  ")
	if err != nil {
		fatalErr(err)
	}
	if postRules {
		tok, err := provider.Token(context.Background())
		if err != nil {
			fatalErr(fmt.Errorf("acquire token: %w", err))
		}
		if tok == "" {
			fatalErr(fmt.Errorf("token is required (set AZURE_TOKEN/ACCESS_TOKEN in env/.env or ensure az CLI session is logged in, or configure --auth msi|sp)"))
		}
		if verbose {
			fmt.Fprintf(os.Stderr, "Auth mode: %s\n", authMode)
			fmt.Fprintf(os.Stderr, "AAD scope: %s\n", aadScope)
			fmt.Fprintf(os.Stderr, "Using token: %s\n", maskToken(tok, false))
		}
		client := mdeapi.New(apiBaseURL, tok)
		client.Verbose = verbose
		// Fetch existing rules to detect create/update/skip
		existingBytes, err := client.GetRules()
		if err != nil {
			fatalErr(fmt.Errorf("fetch existing rules: %w", err))
		}
		type apiRule struct {
			RuleID          string               `json:"ruleId"`
			RuleName        string               `json:"ruleName"`
			RuleDescription string               `json:"ruleDescription"`
			IsEnabled       bool                 `json:"isEnabled"`
			Table           string               `json:"table"`
			Platform        string               `json:"platform"`
			ActionType      string               `json:"actionType"`
			Scope           string               `json:"scope"`
			Filters         rule.APIFilterGroupS `json:"filters"`
			GroupID         string               `json:"groupId"`
			CreatedBy       string               `json:"createdBy"`
			UpdateKey       string               `json:"updateKey"`
		}
		var existing []apiRule
		if err := json.Unmarshal(existingBytes, &existing); err != nil {
			fatalErr(fmt.Errorf("unmarshal existing rules: %w", err))
		}
		byName := make(map[string]apiRule, len(existing))
		for _, e := range existing {
			byName[e.RuleName] = e
		}
		created, updated, skipped, failed := 0, 0, 0, 0
		for _, ar := range authorRules {
			postable := rule.TransformForAPIPost(ar, "")
			if ex, ok := byName[postable.RuleName]; ok {
				// Compare content ignoring RuleID/CreatedBy/GroupID
				exCopy := ex
				exCopy.RuleID = "00000000-0000-0000-0000-000000000000"
				exCopy.CreatedBy = ""
				exCopy.GroupID = ""
				// Preserve updateKey if present for comparison transparency
				exJSON, _ := json.Marshal(exCopy)
				newCopy := postable
				newCopy.CreatedBy = ""
				newCopy.GroupID = ""
				// copy through updateKey if present in existing
				if ex.UpdateKey != "" {
					newCopy.UpdateKey = ex.UpdateKey
				}
				newJSON, _ := json.Marshal(newCopy)
				if string(exJSON) == string(newJSON) {
					if verbose {
						fmt.Fprintf(os.Stderr, "Unchanged, skipping: %s\n", postable.RuleName)
					}
					skipped++
					continue
				}
				// Update existing: set matching RuleID in body and pass updateKey/ETag if provided
				postable.RuleID = ex.RuleID
				if ex.UpdateKey != "" {
					postable.UpdateKey = ex.UpdateKey
				}
				rb, _ := json.Marshal(postable)
				if err := client.UpdateRule(ex.RuleID, rb); err != nil {
					fmt.Fprintf(os.Stderr, "Failed to update rule %s (%s): %v\n", postable.RuleName, ex.RuleID, err)
					failed++
					continue
				}
				if verbose {
					fmt.Fprintf(os.Stderr, "Updated: %s (%s)\n", postable.RuleName, ex.RuleID)
				}
				updated++
				continue
			}
			// Create new
			rb, _ := json.Marshal(postable)
			if err := client.PostRule(rb); err != nil {
				fmt.Fprintf(os.Stderr, "Failed to post rule %s: %v\n", postable.RuleName, err)
				failed++
				continue
			}
			if verbose {
				fmt.Fprintf(os.Stderr, "Created: %s\n", postable.RuleName)
			}
			created++
		}
		fmt.Fprintf(os.Stderr, "Summary: created=%d updated=%d skipped=%d failed=%d\n", created, updated, skipped, failed)
	} else if outputPath == "-" {
		// Write JSON to stdout without additional noise
		if _, err := os.Stdout.Write(append(b, '\n')); err != nil {
			fatalErr(err)
		}
		fmt.Fprintf(os.Stderr, "Wrote %d rules to stdout\n", len(apiRules))
	} else {
		if err := os.MkdirAll(filepath.Dir(outputPath), 0o755); err != nil {
			fatalErr(err)
		}
		if err := os.WriteFile(outputPath, b, 0o644); err != nil {
			fatalErr(err)
		}
		fmt.Printf("Wrote %d rules to %s\n", len(apiRules), outputPath)
	}
}

func fatalErr(err error) {
	fmt.Fprintln(os.Stderr, err)
	os.Exit(1)
}

func truncate(s string, max int) string {
	if len(s) <= max {
		return s
	}
	if max <= 3 {
		return s[:max]
	}
	return s[:max-3] + "..."
}

// importJSONToYAML converts a Defender rules JSON export into YAML author files.
// Default behavior: only add new rules (by name). If updateExisting is true, overwrite when content differs.
// Returns the counts of created, updated, skipped, and total processed rules.
func importJSONToYAML(jsonPath, rulesDir string, updateExisting bool) (created, updated, skipped, total int, err error) {
	b, rerr := os.ReadFile(jsonPath)
	if rerr != nil {
		err = fmt.Errorf("read json export: %w", rerr)
		return
	}
	// We only need fields that map back to AuthorRule.
	var arr []struct {
		RuleName        string               `json:"ruleName"`
		RuleDescription string               `json:"ruleDescription"`
		IsEnabled       bool                 `json:"isEnabled"`
		Platform        string               `json:"platform"`
		Scope           string               `json:"scope"`
		Table           string               `json:"table"`
		ActionType      string               `json:"actionType"`
		Filters         rule.APIFilterGroupS `json:"filters"`
	}
	if uerr := json.Unmarshal(b, &arr); uerr != nil {
		err = fmt.Errorf("parse json export: %w", uerr)
		return
	}
	// Index existing YAML by rule name
	existingIdx, ierr := rule.LoadAuthorRuleIndex(rulesDir)
	if ierr != nil {
		err = fmt.Errorf("index existing yaml: %w", ierr)
		return
	}
	for _, it := range arr {
		total++
		ar := rule.AuthorRule{
			Name:        it.RuleName,
			Description: it.RuleDescription,
			Enabled:     it.IsEnabled,
			Platform:    it.Platform,
			Scope:       it.Scope,
			Table:       it.Table,
			ActionType:  it.ActionType,
			Filters:     fromAPIFilterGroupS(it.Filters),
		}
		// Merge duplicate predicates (same source+filter) into multi-value expressions for YAML convenience
		ar.Filters = mergeFilterGroup(ar.Filters)
		// Determine file path under table-named subfolder
		tableDir := filepath.Join(rulesDir, ar.Table)
		if merr := os.MkdirAll(tableDir, 0o755); merr != nil {
			err = fmt.Errorf("make table dir: %w", merr)
			return
		}
		target := filepath.Join(tableDir, safeFileName(ar.Name)+".yaml")
		if p, ok := existingIdx[ar.Name]; ok {
			// already exists
			if !updateExisting {
				skipped++
				continue
			}
			// load existing and compare
			oldB, oerr := os.ReadFile(p)
			if oerr == nil {
				var old rule.AuthorRule
				if yerr := yaml.Unmarshal(oldB, &old); yerr == nil {
					nb, _ := yaml.Marshal(ar)
					ob, _ := yaml.Marshal(old)
					if string(nb) == string(ob) {
						skipped++ // identical
						continue
					}
				}
			}
			target = p // overwrite
			// will count as updated below after writing
		}
		// write YAML with schema header for editor support
		out, merr := yaml.Marshal(ar)
		if merr != nil {
			err = fmt.Errorf("marshal yaml: %w", merr)
			return
		}
  // Compute schema path relative to target directory
  relSchema := "../rule-schema.json"
  // The schema now resides inside the rules directory (rules/rule-schema.json)
  // Build the absolute path accordingly so relative computation is correct.
  absSchema := filepath.Join(rulesDir, "rule-schema.json")
  if r, rerr := filepath.Rel(filepath.Dir(target), absSchema); rerr == nil && r != "" {
      relSchema = filepath.ToSlash(r)
  }
		header := []byte("# yaml-language-server: $schema=" + relSchema + "\n")
		content := append(header, out...)
		if werr := os.WriteFile(target, content, 0o644); werr != nil {
			err = fmt.Errorf("write yaml: %w", werr)
			return
		}
		if _, existed := existingIdx[ar.Name]; existed {
			updated++
		} else {
			created++
		}
	}
	return
}

func fromAPIFilterGroupS(in rule.APIFilterGroupS) rule.FilterGroup {
	out := rule.FilterGroup{Operator: in.Operator}
	for _, e := range in.Expressions {
		if e.ExpressionType == "Nested" {
			nested := fromAPIFilterGroupS(rule.APIFilterGroupS{Operator: e.Operator, Expressions: e.Expressions, ExpressionType: "Nested"})
			out.Expressions = append(out.Expressions, rule.FilterExpression{Group: &nested})
			continue
		}
		vals := make([]interface{}, len(e.Values))
		for i, s := range e.Values {
			vals[i] = s
		}
		out.Expressions = append(out.Expressions, rule.FilterExpression{
			Filter: e.Filter,
			Source: e.Source,
			Values: vals,
		})
	}
	return out
}

// mergeFilterGroup collapses sibling predicate expressions with the same (source, filter)
// by combining their values into a single expression. Recurses into nested groups.
func mergeFilterGroup(g rule.FilterGroup) rule.FilterGroup {
	out := rule.FilterGroup{Operator: g.Operator}
	// Track first occurrence index to preserve order
	indexByKey := map[string]int{}
	// For deduplication of values per key
	valuesSeen := map[string]map[string]struct{}{}
	for _, e := range g.Expressions {
		if e.Group != nil {
			merged := mergeFilterGroup(*e.Group)
			out.Expressions = append(out.Expressions, rule.FilterExpression{Group: &merged})
			continue
		}
		key := e.Source + "|" + e.Filter
		if idx, ok := indexByKey[key]; ok {
			// merge into existing
			if valuesSeen[key] == nil {
				valuesSeen[key] = map[string]struct{}{}
				for _, v := range out.Expressions[idx].Values {
					valuesSeen[key][fmt.Sprintf("%v", v)] = struct{}{}
				}
			}
			for _, v := range e.Values {
				sv := fmt.Sprintf("%v", v)
				if _, seen := valuesSeen[key][sv]; !seen {
					out.Expressions[idx].Values = append(out.Expressions[idx].Values, v)
					valuesSeen[key][sv] = struct{}{}
				}
			}
		} else {
			idx := len(out.Expressions)
			indexByKey[key] = idx
			// copy expression
			out.Expressions = append(out.Expressions, rule.FilterExpression{
				Source: e.Source,
				Filter: e.Filter,
				Values: append([]interface{}(nil), e.Values...),
			})
		}
	}
	return out
}

func safeFileName(name string) string {
	s := name
	s = strings.ReplaceAll(s, "/", "-")
	s = strings.ReplaceAll(s, "\\", "-")
	s = strings.ReplaceAll(s, ":", "-")
	s = strings.ReplaceAll(s, "|", "-")
	s = strings.ReplaceAll(s, "\n", " ")
	s = strings.TrimSpace(s)
	if s == "" {
		s = "rule"
	}
	return s
}