comparisons are currently not duplicated. I don't think it's necessary as of this writing; they are never changed. But revisit this if/when necessary. :param ast: The AST to duplicate :return: The duplicate AST zCan't duplicate ) isinstancer operands _dupe_astr r TypeErrortype__name__)astoperandresults i/home/james-whalen/.local/lib/python3.13/site-packages/stix2/equivalence/patterns/transform/comparison.pyrrs#+,,%.1ll' .:7Ig l'  " M C, - -$.1ll& .:7Ig l&   M C. / / M*T#Y-?-??@@' & s C/C c*\rSrSrSrSrSrSrSrg)ComparisonExpressionTransformer6a5 Transformer base class with special support for transforming comparison expressions. The transform method implemented here performs a bottom-up in-place transformation, with support for some comparison expression-specific callbacks. Specifically, subclasses can implement methods: "transform_or" for OR nodes "transform_and" for AND nodes "transform_comparison" for plain comparison nodes ( ) "transform_default" for both types of nodes "transform_default" is a fallback, if a type-specific callback is not found. The default implementation does nothing to the AST. The type-specific callbacks are preferred over the default, if both exist. In all cases, the callbacks are called with an AST for a subtree rooted at the appropriate node type, where the subtree's children have already been transformed. They must return the same thing as the base transform() method: a 2-tuple with the transformed AST and a boolean for change detection. See doc for the superclass' method. This process currently silently drops parenthetical nodes. c[U[5(aiSn[UR5H/up4UR U5upVU(aSnXQRU'M1 UR U5upvU(aSnXr4$[U[ 5(aUR U5uprXr4$[U[5(a UR UR5uprXr4$[S[U5-5e)NFTzNot a comparison expression: ) rr enumerater transform4_ComparisonExpressionTransformer__dispatch_transformrr expressionrstr)selfrchangediroperand_result this_changedrs rr)ComparisonExpressionTransformer.transformPs c- . .G' 5 /3~~g/F,"G"0 Q 6$(#<# A A or A => A cJ[UR[R"[5S9n[ R "U[R"[5S9VVs/sHup4URPM nnn[URU[5S:gnXQlX4$s snnf)z Sort/dedupe children. AND and OR can be treated identically. :param ast: The comparison expression AST :return: The same AST node, but with sorted children )keyr) sortedr functools cmp_to_keyr itertoolsgroupbyobjr)r#rsorted_childrenk_deduped_childrenr$s r __transform"OrderDedupeTransformer.__transforms! LLi223LM (//Y%9%9-&  daAEE    LL*,E ( |#  sBc$URU5$N"_OrderDedupeTransformer__transformr5s rr,#OrderDedupeTransformer.transform_or$$r)c$URU5$rNrOr5s rr+$OrderDedupeTransformer.transform_andrRr)r4N) rr7r8r9r:rPr,r+r;r4r)rr=r=s<%%r)r=c*\rSrSrSrSrSrSrSrg)FlattenTransformerzz Flatten all nodes of the AST. E.g.: A and (B and C) => A and B and C A or (B or C) => A or B or C (A) => A cZSn[UR5S:XaURSnSnX4$/nURHbn[U[5(a9URUR:XaUR UR5 SnMQUR U5 Md X1lX4$)a  Flatten children. AND and OR can be treated mostly identically. The little difference is that we can absorb AND children if we're an AND ourselves; and OR for OR. :param ast: The comparison expression AST :return: The same AST node, but with flattened children FrT)lenrrr operatorextendappend)r#rr$ flat_operandsrs rrKFlattenTransformer.__transforms s||  !,,q/CG|M<<g'9::LLG,<,<<!(()9)9:"G"((1()L|r)c$URU5$rN_FlattenTransformer__transformr5s rr,FlattenTransformer.transform_orrRr)c$URU5$rNrar5s rr+ FlattenTransformer.transform_andrRr)r4N) rr7r8r9r:rbr,r+r;r4r)rrVrVs>%%r)rVc*\rSrSrSrSrSrSrSrg)AbsorptionTransformerzr Applies boolean "absorption" rules for AST simplification. E.g.: A and (A or B) = A A or (A and B) = A c^SnURS:XaSOSn[5n[UR5HupVXT;aM [UR5HunmXW:XdXt;aM[ T[ 5(aTRU:waM9[ UTR[5(aURU5 MlURTR:XdM[U4SjUR55(dMURU5 M M U(a*Sn[[U55HnURU M X4$)NFORANDc3Z># UH n[UTR[5v M" g7frN)rrr).0child1_operandchild2s r 4AbsorptionTransformer.__transform..s2 />N  *FOO5/>s(+T) r[setrrrr rraddallreversedrA) r#rr$ secondary_op to_deleter%child1jros @rrK!AbsorptionTransformer.__transforms #  4u$ E #3<<0IA~&s||4 66Q^ "&*<==!??l:FOO-FMM!$__7 /5oo " a(95 1D GfY/0LLO1|r)c$URU5$rN!_AbsorptionTransformer__transformr5s rr,"AbsorptionTransformer.transform_or(rRr)c$URU5$rNr|r5s rr+#AbsorptionTransformer.transform_and+rRr)r4N) rr7r8r9r:r}r,r+r;r4r)rrgrgs0d%%r)rgc\rSrSrSrSrSrg)DNFTransformeri/zb Convert a comparison expression AST to DNF. E.g.: A and (B or C) => (A and B) or (A and C) c 0/n/nSnURHVn[U[5(a-URS:XaUR UR5 MEUR U5 MX U(a[ R "U6VVs/sH<n[[ R"X65Vs/sHn[U5PM sn5PM> nnnUVs/sHoPRU5SPM nn[U5n SnX4$Un X4$s snfs snnfs snf)NFrjrT) rrr r[r]rDproductr chainrrr ) r#r or_childrenother_childrenr$childprod_seqsub_astdistributed_childrenrs rr+DNFTransformer.transform_and5s/ \\E%!34449O""5>>2%%e, " !* 1 1; ? $!@H%7@oo&7 &77Ig&7 &!@ ! $*7K$6JUu%a(6J !$))=>FG F=& $($s #D -D D DD r4N)rr7r8r9r:r+r;r4r)rrr/s  .r)rc\rSrSrSrSrSrg)SpecialValueCanonicalizationifz Try to find particular leaf-node comparison expressions whose rhs (i.e. the constant) can be canonicalized. This is an idiosyncratic transformation based on some ideas people had for context-sensitive semantic equivalence in constant values. cURRS:Xa[U5 US4$URRS:Xa[U5 US4$URRS:Xa [ U5 US4$)Nzwindows-registry-keyz ipv4-addrz ipv6-addrF)lhsobject_type_namer rrr5s rr-1SpecialValueCanonicalization.transform_comparisonmsw 77 # #'= = C EzWW % % 4 cNEz WW % % 4 cN Ezr)r4N)rr7r8r9r:r-r;r4r)rrrfs  r)r)r:rBrD"stix2.equivalence.patterns.comparerr-stix2.equivalence.patterns.compare.comparisonr$stix2.equivalence.patterns.transformr-stix2.equivalence.patterns.transform.specialsrrr stix2.patternsr r r r rrrr=rVrgrrr4r)rrsD= BRkRj/%#/%d,%8,%^@%#@%F444n#Br)