@agent-beam/beam 0.2.38 → 0.2.40

package/dist/policy.d.ts

@@ -6,10 +6,13 @@ export interface PolicyRule {
     id: string;
     title?: string;
     action: PolicyAction;
+    enforce?: true;
     risk?: number;
+    eventType?: string;
     tool?: string;
     command?: string;
     commandLine?: string;
+    commandRegex?: string;
     args?: string[];
     path?: string;
     url?: string;
@@ -27,6 +30,10 @@ export interface PolicyRule {
     reason?: string;
     approval?: ApprovalPolicy;
 }
+export interface IgnoredRule {
+    ruleId: string;
+    agent?: string;
+}
 export interface PolicyRules {
     mode: PolicyMode;
     blockedTools: string[];
@@ -38,6 +45,7 @@ export interface PolicyRules {
         blockAt?: number;
     };
     customDetectors?: CustomDetector[];
+    ignoredRules?: (string | IgnoredRule)[];
 }
 export interface PolicyBundle {
     version: number;
@@ -50,6 +58,8 @@ export declare function lastGoodPolicyPath(): string;
 export declare function readPolicy(): Promise<PolicyBundle | null>;
 export type DecisionAction = "allow" | "ask" | "block" | "redact" | "audit" | "warn" | "deny";
 export interface ActionContext {
+    eventType?: string;
+    input?: Record<string, unknown>;
     agent: string;
     tool: string;
     command: string;

package/dist/policy.js

@@ -1,7 +1,12 @@
+import { activityType } from "./activity.js";
+import { classifyActionContext } from "./action-context.js";
+import { environmentRisk } from "./access-risk.js";
+import { builtinRulesById } from "./rule-catalog.js";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { getDataDirectory } from "./config.js";
-const EMPTY = { mode: "observe", blockedTools: [], blockedCommandPatterns: [], disabledAgents: [], rules: [], customDetectors: [] };
+import { canonicalPolicyPath, canonicalPolicyPattern, policyPathTargets } from "./policy-paths.js";
+const EMPTY = { mode: "observe", blockedTools: [], blockedCommandPatterns: [], disabledAgents: [], rules: [], customDetectors: [], ignoredRules: [] };
 export function policyPath() { return join(getDataDirectory(), "policy.json"); }
 export function lastGoodPolicyPath() { return join(getDataDirectory(), "policy.last-good.json"); }
 function validAction(v) { return ["ALLOW", "ASK", "BLOCK", "REDACT", "AUDIT"].includes(String(v).toUpperCase()); }
@@ -19,6 +24,30 @@ function validRule(v, index, errors) {
         errors.push(`rules[${index}] (${r.id}) has an invalid action`);
         return undefined;
     }
+    if (r.enforce !== undefined && (r.enforce !== true || String(r.action).toUpperCase() !== "BLOCK")) {
+        errors.push(`rules[${index}] (${r.id}).enforce is only supported for explicit BLOCK rules`);
+        return undefined;
+    }
+    if (r.eventType !== undefined && (typeof r.eventType !== "string" || !r.eventType.trim())) {
+        errors.push(`rules[${index}] (${r.id}).eventType must be a non-empty string`);
+        return undefined;
+    }
+    if (r.commandRegex !== undefined) {
+        if (typeof r.commandRegex !== "string" || r.commandRegex.length < 3 || r.commandRegex.length > 1000) {
+            errors.push(`rules[${index}] (${r.id}).commandRegex must be 3-1000 characters`);
+            return undefined;
+        }
+        try {
+            if (new RegExp(r.commandRegex, "i").test("")) {
+                errors.push(`rules[${index}] (${r.id}).commandRegex matches every command`);
+                return undefined;
+            }
+        }
+        catch {
+            errors.push(`rules[${index}] (${r.id}).commandRegex is invalid`);
+            return undefined;
+        }
+    }
     if (r.args !== undefined && (!Array.isArray(r.args) || r.args.some(a => typeof a !== "string"))) {
         errors.push(`rules[${index}] (${r.id}).args must be strings`);
         return undefined;
@@ -38,6 +67,15 @@ export async function readPolicy() {
         const source = parsed.rules;
         if (source.customDetectors !== undefined && (!Array.isArray(source.customDetectors) || source.customDetectors.some(d => !d || typeof d.name !== "string" || typeof d.pattern !== "string" || typeof d.replacement !== "string")))
             errors.push("customDetectors must contain name, pattern, and replacement strings");
+        if (source.ignoredRules !== undefined && (!Array.isArray(source.ignoredRules) || source.ignoredRules.some(e => {
+            if (typeof e === "string")
+                return !e.trim();
+            if (!e || typeof e !== "object" || Array.isArray(e))
+                return true;
+            const entry = e;
+            return typeof entry.ruleId !== "string" || !entry.ruleId.trim() || (entry.agent !== undefined && (typeof entry.agent !== "string" || !entry.agent.trim()));
+        })))
+            errors.push("ignoredRules must contain rule id strings, or {ruleId, agent?} objects");
         for (const detector of Array.isArray(source.customDetectors) ? source.customDetectors : []) {
             try {
                 new RegExp(detector.pattern);
@@ -69,7 +107,11 @@ export async function readPolicy() {
 const safety = { ALLOW: 0, AUDIT: 1, REDACT: 2, ASK: 3, BLOCK: 4 };
 function glob(pattern, value) { const e = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "§§").replace(/\*/g, "[^/]*").replace(/§§/g, ".*").replace(/\?/g, "."); return new RegExp(`^${e}$`, "i").test(value); }
 function same(a, b) { return !a || (b ?? "").toLowerCase() === a.toLowerCase(); }
-function riskInfo(c) { const s = `${c.command} ${c.path ?? ""} ${c.url ?? ""}`; const factors = []; let n = 0; if (/\brm\s+.*-rf\s+\//i.test(s)) {
+function riskInfo(c) { const s = `${c.command} ${c.path ?? ""} ${c.url ?? ""}`; const factors = []; const accessContext = classifyActionContext(c.tool, { file_path: c.path }, c.cwd ?? "", c.command, v => v, false); const access = environmentRisk(accessContext); const routineNamed = !!access && "severity" in access && access.severity === "info" && accessContext.actions.every(a => a.operation === "environment-lookup"); let n = 0; if (builtinRulesById(["destructive.delete"])[0]?.severityFor?.(c.command) === "medium") {
+    n += 35;
+    factors.push("scoped temporary test cleanup");
+}
+else if (/\brm\s+.*-rf\s+\//i.test(s)) {
     n += 98;
     factors.push("destructive operation");
 }
@@ -83,12 +125,14 @@ else if (/\brm\b/i.test(s)) {
     n += 25;
     factors.push("external destination");
 } if (/\.env|\.ssh|\.aws|private.?key|api.?key|token|secret/i.test(s)) {
-    n += 35;
-    factors.push("sensitive data or file");
+    n += routineNamed ? 5 : 35;
+    factors.push(routineNamed ? "scoped named environment lookup" : "sensitive data or file");
 } const score = Math.min(100, n); return { score, level: score >= 90 ? "CRITICAL" : score >= 70 ? "HIGH" : score >= 30 ? "MEDIUM" : "LOW", factors }; }
 function matches(r, c) {
     // r.tool supports glob wildcards (e.g. "mcp__posthog__*") so a dashboard rule can target one
     // MCP server's tools without matching every MCP call; other identity fields stay exact-match.
+    if (!r.path && r.eventType && !glob(r.eventType, c.eventType ?? ""))
+        return false;
     if (r.tool && !glob(r.tool, c.tool))
         return false;
     if (!same(r.role, c.role) || !same(r.user, c.user) || !same(r.agent, c.agent) || !same(r.repository, c.repository) || !same(r.branch, c.branch) || !same(r.environment, c.environment))
@@ -99,8 +143,28 @@ function matches(r, c) {
         return false;
     if (r.commandLine && !glob(r.commandLine, c.command))
         return false;
-    if (r.path && !glob(r.path, c.path ?? ""))
-        return false;
+    if (r.commandRegex) {
+        try {
+            if (!new RegExp(r.commandRegex, "i").test(c.command))
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    if (r.path) {
+        const rulePath = r.path;
+        const pattern = canonicalPolicyPattern(rulePath, c.cwd) ?? rulePath;
+        const targets = c.pathTargets ?? (c.path ? [{ path: c.path, eventType: c.eventType ?? "" }] : []);
+        if (!targets.some((target) => {
+            if (r.eventType && !glob(r.eventType, target.eventType) && !glob(r.eventType, c.eventType ?? ""))
+                return false;
+            const path = canonicalPolicyPath(target.path, c.cwd) ?? target.path;
+            // A subtree restriction covers both the directory itself and its contents.
+            return glob(pattern, path) || (pattern.endsWith("/**") && glob(pattern.slice(0, -3), path)) || glob(rulePath, target.path);
+        }))
+            return false;
+    }
     if (r.url && !glob(r.url, c.url ?? ""))
         return false;
     if (r.args && r.args.some((a, i) => !glob(a, c.args?.[i] ?? "")))
@@ -114,8 +178,10 @@ function matches(r, c) {
     }
     return true;
 }
-function specificity(r) { return [r.tool, r.command, r.commandLine, r.args?.length, r.path, r.url, r.role, r.user, r.agent, r.cwd, r.repository, r.branch, r.environment, r.time].filter(Boolean).length; }
+function specificity(r) { return [r.eventType, r.tool, r.command, r.commandLine, r.commandRegex, r.args?.length, r.path, r.url, r.role, r.user, r.agent, r.cwd, r.repository, r.branch, r.environment, r.time].filter(Boolean).length; }
 export function evaluate(bundle, ctx) {
+    // Use the same classifier as Activity, including argument-dependent web tools.
+    ctx = { ...ctx, eventType: ctx.eventType ?? activityType({ tool_name: ctx.tool, tool_input: ctx.input }, "tool.call") };
     const info = riskInfo(ctx);
     const score = info.score;
     const base = { mode: bundle?.rules.mode ?? "observe", policyVersion: bundle?.version ?? 0, riskScore: score, riskLevel: info.level, riskFactors: info.factors, customDetectors: bundle?.rules.customDetectors ?? [], actor: ctx.user, role: ctx.role, agent: ctx.agent, tool: ctx.tool, command: ctx.command, args: ctx.args, resource: ctx.path ?? ctx.url, errors: bundle?.errors };
@@ -123,19 +189,33 @@ export function evaluate(bundle, ctx) {
         return { action: "allow", ...base };
     if (bundle.errors?.length)
         return { action: "deny", ...base, reason: `Security policy rejected: ${bundle.errors.join("; ")}`, rule: "policy.invalid" };
-    if (bundle.rules.mode === "observe" || (bundle.notAfter && Date.parse(bundle.notAfter) < Date.now()))
+    if (bundle.notAfter && Date.parse(bundle.notAfter) < Date.now())
         return { action: "allow", ...base };
+    const pathTargets = bundle.rules.rules?.some((r) => r.path) ? policyPathTargets(ctx) : undefined;
+    // A manager can enforce a narrow mitigation without enabling unrelated policy
+    // rules or risk thresholds for this member's other tools and agents.
+    const mandatory = (bundle.rules.rules ?? []).filter((r) => r.enforce === true && r.action === "BLOCK" && matches(r, { ...ctx, riskScore: score, pathTargets })).sort((a, b) => specificity(b) - specificity(a))[0];
+    if (mandatory)
+        return { ...base, mode: "enforce", action: "deny", reason: mandatory.reason, policy: "local policy", rule: mandatory.id };
+    const observe = bundle.rules.mode === "observe";
+    // A disabled agent is a suspension, so a more specific command ALLOW must not re-enable it.
+    // User-scoped bundles limit this suspension to their recipient. This is an explicit block, same
+    // as a BLOCK rule below -- it takes effect in Observe mode too, same reasoning as those: Observe
+    // only ever suppresses the *implicit* risk-score heuristic and ASK/REDACT rules, which need a
+    // human actually watching to act on them; an explicit "block this" does not need a human to mean
+    // what it says. Advisory still softens it to "ask" rather than a silent local deny.
+    if (bundle.rules.disabledAgents.some(a => a.toLowerCase() === ctx.agent.toLowerCase())) {
+        return { ...base, action: bundle.rules.mode === "advisory" ? "ask" : "deny", reason: `${ctx.agent} is disabled by workspace policy.`, policy: "local policy", rule: "legacy.disabled-agent" };
+    }
     const candidates = [];
     for (const r of bundle.rules.rules ?? [])
-        if (matches(r, { ...ctx, riskScore: score }))
+        if (matches(r, { ...ctx, riskScore: score, pathTargets }))
             candidates.push({ r, rank: specificity(r) });
     for (const tool of bundle.rules.blockedTools) {
         const r = { id: `legacy.tool.${tool}`, tool, action: "BLOCK", reason: `The ${tool} tool is blocked by workspace policy.` };
         if (matches(r, { ...ctx, riskScore: score }))
             candidates.push({ r, rank: 1 });
     }
-    if (bundle.rules.disabledAgents.some(a => a.toLowerCase() === ctx.agent.toLowerCase()))
-        candidates.push({ r: { id: "legacy.disabled-agent", agent: ctx.agent, action: "BLOCK", reason: `${ctx.agent} is disabled by workspace policy.` }, rank: 1 });
     for (const pattern of bundle.rules.blockedCommandPatterns) {
         try {
             if (new RegExp(pattern, "i").test(ctx.command))
@@ -144,6 +224,14 @@ export function evaluate(bundle, ctx) {
         catch { /* preserve legacy fail-open behavior; structured rules are validated and reported */ }
     }
     const selected = candidates.sort((a, b) => b.rank - a.rank || safety[b.r.action] - safety[a.r.action])[0]?.r;
+    if (observe) {
+        // Pure monitoring, except an explicit BLOCK still blocks: a structured BLOCK rule, a legacy
+        // blocked tool, or a blocked command pattern. ASK/REDACT rules and the risk-score heuristic
+        // below need a human watching this device to act on them, so those stay silent in Observe.
+        if (selected?.action === "BLOCK")
+            return { ...base, action: "deny", reason: selected.reason, policy: "local policy", rule: selected.id };
+        return { action: "allow", ...base };
+    }
     const thresholds = bundle.rules.risk ?? { askAt: 30, blockAt: 70 };
     let action = selected?.action ?? "ALLOW";
     if (!selected && score >= (thresholds.blockAt ?? 70))

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAS/C,MAAM,KAAK,GAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;AACjJ,MAAM,UAAU,UAAU,KAAa,OAAO,IAAI,CAAC,gBAAgB,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;AACxF,MAAM,UAAU,kBAAkB,KAAa,OAAO,IAAI,CAAC,gBAAgB,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC;AAE1G,SAAS,WAAW,CAAC,CAAU,IAAuB,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9I,SAAS,SAAS,CAAC,CAAU,EAAE,KAAa,EAAE,MAAgB;IAC5D,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IAC5H,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,kBAAkB,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IAClH,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IACjH,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IACrL,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IAC1K,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAkB,EAAgB,CAAC;AACxF,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAyB,EAAE;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA0B,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACxF,MAAM,MAAM,GAAa,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,CAAC,KAA6B,CAAC;QACjF,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QACrT,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;QAAC,CAAC;QACjN,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChJ,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACtG,OAAO,EAAE,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC;IACrM,CAAC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,IAAI,CAAC;YAAC,OAAO,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YACtD,4EAA4E;YAC5E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,iFAAiF,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;QAC3K,CAAC;IACH,CAAC;AACH,CAAC;AAKD,MAAM,MAAM,GAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACjG,SAAS,IAAI,CAAC,OAAe,EAAE,KAAa,IAAa,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxP,SAAS,IAAI,CAAC,CAAqB,EAAE,CAAqB,IAAa,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAClI,SAAS,QAAQ,CAAC,CAAgB,IAAyF,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,GAAa,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC,IAAI,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAAC,CAAC;KAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC,IAAI,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAAC,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC,IAAI,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC,IAAI,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAAC,CAAC,CAAC,IAAI,uDAAuD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC,IAAI,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAAC,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC5zB,SAAS,OAAO,CAAC,CAAa,EAAE,CAAwC;IACtE,6FAA6F;IAC7F,8FAA8F;IAC9F,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IACrM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACjF,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;IAAC,CAAC;IACnJ,OAAO,IAAI,CAAC;AACd,CAAC;AACD,SAAS,WAAW,CAAC,CAAa,IAAY,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE/N,MAAM,UAAU,QAAQ,CAAC,MAA2B,EAAE,GAAkB;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAAC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,eAAe,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5a,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,6BAA6B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACvJ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAC1I,MAAM,UAAU,GAA2C,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;QAAE,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrI,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAAC,MAAM,CAAC,GAAe,EAAE,EAAE,EAAE,eAAe,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,uCAAuC,EAAE,CAAC;QAAC,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IACxQ,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,mCAAmC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACrP,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,kBAAkB,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,qCAAqC,OAAO,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,qFAAqF,CAAC,CAAC;IAAC,CAAC;IACtW,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7G,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAAC,IAAI,MAAM,GAAiB,QAAQ,EAAE,MAAM,IAAI,OAAO,CAAC;IAC3H,IAAI,CAAC,QAAQ,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;QAAE,MAAM,GAAG,OAAO,CAAC;SAAM,IAAI,CAAC,QAAQ,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QAAE,MAAM,GAAG,KAAK,CAAC;IAChJ,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,KAAK,+BAA+B,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,KAAK,qBAAqB,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxQ,sFAAsF;IACtF,2FAA2F;IAC3F,+FAA+F;IAC/F,8FAA8F;IAC9F,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,2FAA2F;IAC3F,4DAA4D;IAC5D,MAAM,MAAM,GAAmB,MAAM,KAAK,OAAO;QAC/C,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACjI,CAAC,CAAC,MAAM,CAAC,WAAW,EAAoB,CAAC;IAC3C,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACvH,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAyB,MAAM,mBAAmB,CAAC;AAW1H,MAAM,KAAK,GAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;AACnK,MAAM,UAAU,UAAU,KAAa,OAAO,IAAI,CAAC,gBAAgB,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;AACxF,MAAM,UAAU,kBAAkB,KAAa,OAAO,IAAI,CAAC,gBAAgB,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC;AAE1G,SAAS,WAAW,CAAC,CAAU,IAAuB,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9I,SAAS,SAAS,CAAC,CAAU,EAAE,KAAa,EAAE,MAAgB;IAC5D,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IAC5H,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,kBAAkB,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IAClH,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IACjH,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EAAE,sDAAsD,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IACrN,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IAC/L,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EAAE,0CAA0C,CAAC,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QAC3M,IAAI,CAAC;YAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EAAE,sCAAsC,CAAC,CAAC;gBAAC,OAAO,SAAS,CAAC;YAAC,CAAC;QAAC,CAAC;QACxJ,MAAM,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IACrL,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IAC1K,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAkB,EAAgB,CAAC;AACxF,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAyB,EAAE;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA0B,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACxF,MAAM,MAAM,GAAa,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,CAAC,KAA6B,CAAC;QACjF,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QACrT,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAC5G,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjE,MAAM,KAAK,GAAG,CAAuC,CAAC;YACtD,OAAO,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7J,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC3F,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;QAAC,CAAC;QACjN,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChJ,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACtG,OAAO,EAAE,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC;IACrM,CAAC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,IAAI,CAAC;YAAC,OAAO,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YACtD,4EAA4E;YAC5E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,iFAAiF,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;QAC3K,CAAC;IACH,CAAC;AACH,CAAC;AAKD,MAAM,MAAM,GAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACjG,SAAS,IAAI,CAAC,OAAe,EAAE,KAAa,IAAa,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxP,SAAS,IAAI,CAAC,CAAqB,EAAE,CAAqB,IAAa,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAClI,SAAS,QAAQ,CAAC,CAAgB,IAAyF,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,GAAa,EAAE,CAAC,CAAC,MAAM,aAAa,GAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAC,EAAC,SAAS,EAAC,CAAC,CAAC,IAAI,EAAC,EAAC,CAAC,CAAC,GAAG,IAAE,EAAE,EAAC,CAAC,CAAC,OAAO,EAAC,CAAC,CAAA,EAAE,CAAA,CAAC,EAAC,KAAK,CAAC,CAAC,CAAC,MAAM,MAAM,GAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,YAAY,GAAC,CAAC,CAAC,MAAM,IAAI,UAAU,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAG,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,SAAS,KAAG,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;IAAC,CAAC,IAAI,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;AAAC,CAAC;KAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC,IAAI,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAAC,CAAC;KAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC,IAAI,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAAC,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC,IAAI,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC,IAAI,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAAC,CAAC,CAAC,IAAI,uDAAuD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;AAAC,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACp0C,SAAS,OAAO,CAAC,CAAa,EAAE,CAA0E;IACxG,6FAA6F;IAC7F,8FAA8F;IAC9F,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAClF,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IACrM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACjF,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAAC,CAAC;IAC3H,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC;QACxB,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;QACpE,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC/G,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC;YACpE,2EAA2E;YAC3E,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7H,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;IAAC,CAAC;IACnJ,OAAO,IAAI,CAAC;AACd,CAAC;AACD,SAAS,WAAW,CAAC,CAAa,IAAY,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5P,MAAM,UAAU,QAAQ,CAAC,MAA2B,EAAE,GAAkB;IACtE,+EAA+E;IAC/E,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,YAAY,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC;IACxH,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAAC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,eAAe,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5a,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,6BAA6B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACvJ,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACrG,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnN,IAAI,SAAS;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;IACzI,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;IAChD,4FAA4F;IAC5F,gGAAgG;IAChG,iGAAiG;IACjG,8FAA8F;IAC9F,iGAAiG;IACjG,oFAAoF;IACpF,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACvF,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,mCAAmC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;IAChM,CAAC;IACD,MAAM,UAAU,GAA2C,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;QAAE,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClJ,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAAC,MAAM,CAAC,GAAe,EAAE,EAAE,EAAE,eAAe,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,uCAAuC,EAAE,CAAC;QAAC,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IACxQ,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,kBAAkB,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,qCAAqC,OAAO,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,qFAAqF,CAAC,CAAC;IAAC,CAAC;IACtW,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7G,IAAI,OAAO,EAAE,CAAC;QACZ,4FAA4F;QAC5F,4FAA4F;QAC5F,2FAA2F;QAC3F,IAAI,QAAQ,EAAE,MAAM,KAAK,OAAO;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACzI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAAC,IAAI,MAAM,GAAiB,QAAQ,EAAE,MAAM,IAAI,OAAO,CAAC;IAC3H,IAAI,CAAC,QAAQ,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;QAAE,MAAM,GAAG,OAAO,CAAC;SAAM,IAAI,CAAC,QAAQ,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QAAE,MAAM,GAAG,KAAK,CAAC;IAChJ,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,KAAK,+BAA+B,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,KAAK,qBAAqB,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxQ,sFAAsF;IACtF,2FAA2F;IAC3F,+FAA+F;IAC/F,8FAA8F;IAC9F,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,2FAA2F;IAC3F,4DAA4D;IAC5D,MAAM,MAAM,GAAmB,MAAM,KAAK,OAAO;QAC/C,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACjI,CAAC,CAAC,MAAM,CAAC,WAAW,EAAoB,CAAC;IAC3C,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACvH,CAAC"}

package/dist/rule-catalog.d.ts

@@ -1,4 +1,5 @@
-export type Severity = "critical" | "high" | "medium" | "info";
+import { type Matcher } from "./rule-matches.js";
+export type Severity = "critical" | "high" | "medium" | "low" | "info";
 export type RuleCategory = "exec" | "exfil" | "impact" | "integrity" | "persistence" | "privilege" | "recon" | "secrets" | "source_control" | "custom";
 export type Rule = {
     id: string;
@@ -6,7 +7,8 @@ export type Rule = {
     severity: Severity;
     category: RuleCategory;
     explanation: string;
-    match: (s: string) => boolean;
+    match: Matcher;
+    severityFor?: (s: string) => Severity;
 };
 export declare const builtinRules: Rule[];
 /** Built-in rules by id, for callers (like `beam monitor`) that reuse a subset of the catalog. */

package/dist/rule-catalog.js

@@ -1,9 +1,16 @@
-const secret = /(?:\.env(?:\b|[./])|\.ssh[\\/]|id_rsa|id_ed25519|\.aws[\\/]credentials|(?:api[_-]?key|access[_-]?token|password|secret)\b)/i;
-const egress = /(?:https?:\/\/|\bcurl\b|\bwget\b|\bupload\b|\bwebhook\b|\bsend\b|\bexfiltrat\w*)/i;
-// Linear checks for "something | sh". As regexes (/curl[^\n]*\|\s*sh/) they backtrack
-// quadratically or worse on long hostile lines, and these rules also run on attacker-written
-// text inside customer apps (App monitoring). Each line's pipes are split once and scanned in order.
-const SHELL_AFTER_PIPE = /^\s*(?:sudo\s+)?(?:ba|z|fi)?sh\b/i;
+// The built-in detection rules: pure data and regular expressions, with no Node.js built-ins, so
+// the same catalog backs agent hooks (core.ts) and the in-app SDK (sdk.ts), which can run in
+// edge runtimes.
+import { promptAttack } from "./prompt-attacks.js";
+import { isScopedTemporaryCleanup } from "./destructive-risk.js";
+import { patternMatch, anyMatch, allMatch, functionalMatch } from "./rule-matches.js";
+import { credentialExposureSpans, possibleCredentialExposure } from "./credential-egress.js";
+const secret = /(?:\.env(?:\b|[./])|\.ssh[\\/]|id_rsa|id_ed25519|\.aws[\\/]credentials|\.pgpass\b|\.docker[\\/]config\.json|\.gnupg[\\/]|credentials\.json|(?:api[_-]?key|access[_-]?token|password|secret)\b)/i;
+// Linear checks for "something | sh" or "something | <interpreter>". As regexes
+// (/curl[^\n]*\|\s*sh/) they backtrack quadratically or worse on long hostile lines, and these
+// rules also run on attacker-written text inside customer apps (App monitoring). Each line's
+// pipes are split once and scanned in order.
+const EXEC_AFTER_PIPE = /^\s*(?:sudo\s+)?(?:(?:ba|z|fi)?sh|python3?|node|ruby|perl|pwsh|powershell)\b/i;
 function pipesIntoShell(s, newArmer) {
     for (const line of s.split("\n")) {
         if (!line.includes("|"))
@@ -11,13 +18,38 @@ function pipesIntoShell(s, newArmer) {
         const arms = newArmer();
         let armed = false;
         for (const [i, segment] of line.split("|").entries()) {
-            if (i > 0 && armed && SHELL_AFTER_PIPE.test(segment))
+            if (i > 0 && armed && EXEC_AFTER_PIPE.test(segment))
                 return true;
             armed = arms(segment) || armed;
         }
     }
     return false;
 }
+function pipelineMatcher(newArmer) {
+    return functionalMatch(text => pipesIntoShell(text, newArmer), text => {
+        const spans = [];
+        let offset = 0;
+        for (const line of text.split("\n")) {
+            const arms = newArmer();
+            let armedAt;
+            let cursor = 0;
+            for (const segment of line.split("|")) {
+                const executed = EXEC_AFTER_PIPE.exec(segment);
+                if (armedAt !== undefined && executed) {
+                    spans.push({ start: offset + armedAt, end: offset + cursor + executed[0].length, label: "Pipeline into an interpreter" });
+                    break;
+                }
+                if (arms(segment))
+                    armedAt = cursor;
+                else
+                    armedAt = undefined;
+                cursor += segment.length + 1;
+            }
+            offset += line.length + 1;
+        }
+        return spans;
+    });
+}
 const downloads = () => (segment) => /\b(?:curl|wget)\b/i.test(segment);
 // base64, then a decode flag after it (in the same segment or a later one).
 const decodes = () => {
@@ -30,24 +62,92 @@ const decodes = () => {
         return /(?:^|\s)(?:-\w*d\w*|--decode)\b/i.test(segment.slice(at));
     };
 };
+// "rm" with recursive-force intent, however the flags are written: combined (-rf, -fr), split
+// (-r -f), long-form (--recursive --force), or mixed (-r --force). A single regex over the whole
+// command missed the split-flag case entirely (an easy, common bypass), so each command segment
+// (split on ; && || | and newlines, the points a shell actually starts a new command) is checked
+// for "rm" plus both an r-flag and an f-flag anywhere in that segment, in any order.
+const CMD_SPLIT = /[;&|\n]|&&|\|\|/;
+function recursiveDeleteSpans(s) {
+    const spans = [];
+    let offset = 0;
+    for (const segment of s.split(CMD_SPLIT)) {
+        const start = offset;
+        offset += segment.length + 1;
+        if (!/\brm\b/i.test(segment))
+            continue;
+        const hasR = /(?:^|\s)-[a-z]*r[a-z]*(?:\s|$)/i.test(segment) || /--recursive\b/i.test(segment);
+        const hasF = /(?:^|\s)-[a-z]*f[a-z]*(?:\s|$)/i.test(segment) || /--force\b/i.test(segment);
+        if (hasR && hasF) {
+            const at = segment.search(/\brm\b/i);
+            spans.push({ start: start + at, end: start + segment.trimEnd().length, label: "Recursive forced deletion" });
+        }
+    }
+    return spans;
+}
+function rmRecursiveForce(s) { return recursiveDeleteSpans(s).length > 0; }
+// Download-then-execute split across a command chain instead of a pipe: `curl -o x.sh ... && chmod
+// +x x.sh && ./x.sh`. One segment fetches, a later segment (joined by && or ;) runs what it fetched.
+const DOWNLOAD_THEN_EXEC = /\b(?:curl|wget)\b[^\n]{0,300}?(?:\s-[oO]\s|--output\b)[^\n]{0,300}?(?:&&|;)[^\n]{0,300}?(?:chmod\s+\+x|\.\/\S|(?:ba|z)?sh\b|python3?\b|node\b)/i;
+// PowerShell's `IEX (New-Object Net.WebClient).DownloadString(...)` / `iwr ... | iex`, the
+// single most common Windows download-and-run one-liner; and a Python process that fetches and
+// executes in the same call instead of piping to a shell.
+const POWERSHELL_DOWNLOAD_EXEC = /\bdownloadstring\s*\(|\b(?:iex|invoke-expression)\b[^\n]{0,300}?(?:iwr|invoke-webrequest|downloadstring)\b|\b(?:iwr|invoke-webrequest)\b[^\n]{0,300}?\|\s*(?:iex|invoke-expression)\b/i;
+const PYTHON_FETCH_EXEC = /\b(?:exec|eval)\s*\(\s*(?:compile\s*\(\s*)?(?:urllib\.request\.urlopen|urlopen|requests\.get|urlretrieve)\b/i;
+// Disk, partition and filesystem-level wipes: destroy an entire volume rather than files inside
+// it, and are unrecoverable even with the deleted file still referenced elsewhere.
+const DISK_WIPE = /\bdd\b[^\n]{0,300}?\bof=\/dev\/(?:[sh]d|nvme|disk)\w*|\bmkfs\b|\bmke2fs\b|\bwipefs\b|\bblkdiscard\b|\b(?:fdisk|gdisk|sgdisk|parted)\b|\bdiskutil\s+(?:eraseDisk|eraseVolume|reformat)\b|\bdiskpart\b[\s\S]{0,200}?\bclean\b|\bClear-Disk\b[^\n]{0,300}?-RemoveData|\bRemove-Partition\b|\bcipher\s+\/w:|\bformat\s+[a-z]:\s*\/y\b/i;
+// The classic bash fork bomb and close variants (whitespace and function-name tolerant).
+const FORK_BOMB = /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/;
+// Dropping an entire datastore instead of rows in it: Redis/Mongo have no SQL DROP/TRUNCATE syntax.
+const DATASTORE_WIPE = /\bFLUSHALL\b|\bFLUSHDB\b|db\.dropDatabase\s*\(\)/i;
+const otherDestructiveMatcher = anyMatch(patternMatch(/\bfind\b[^\n]{0,300}?-delete\b|\brsync\b[^\n]{0,300}?--delete\b|\bshred\b[^\n]{0,100}?-\w*u|\bshutil\.rmtree\s*\(|(?:\bfs\.)?\brm(?:dir)?Sync\s*\([^\n]{0,200}?recursive\s*:\s*true|\brd\s+\/s\s+\/q\b|\bRemove-Item\b[^\n]{0,1000}?(?:-Recurse|-Force)|\b(?:drop\s+(?:table|database)|truncate\s+(?:table\s+)?\w+)|\bgit\s+(?:reset\s+--hard|clean\s+-[^\n]{0,1000}?f)/i), patternMatch(DATASTORE_WIPE));
+function otherDestructiveOperation(s) { return otherDestructiveMatcher(s); }
+// A vault/secret-manager reference (op://, Azure Key Vault, HashiCorp Vault, Infisical, Doppler,
+// a GitHub Actions secrets expression, or a generic broker placeholder) typed literally into a
+// live command instead of being resolved by its own CLI/platform first. An agent can't resolve
+// one of these into the real value itself (that's the point of the convention -- the real value
+// never reaches it), so seeing the raw reference token in a command about to run means either the
+// command is about to fail with it unresolved, or -- worse -- the agent is about to "fix" that by
+// asking for the real value and inlining it instead. Either way, a human/CI process starting the
+// real service (with its own resolver already wired up) is what should happen next, not the agent
+// improvising. Mirrors the CREDENTIAL_REFERENCE check in data-detectors.ts.
+const UNRESOLVED_REFERENCE = /\bop:\/\/|@Microsoft\.KeyVault\(|\bvault:[\w/-]|\binfisical:\/\/|\bdoppler:\/\/|\$\{\{\s*secrets\.|__[A-Z][A-Z0-9_]*_REF_[\w-]+__/i;
 export const builtinRules = [
-    { id: "destructive.delete", title: "Destructive operation", severity: "high", category: "impact", explanation: "Review the target and backups before allowing a recursive delete or destructive data operation.", match: s => /\brm\s+[^\n]{0,1000}?(?:-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r|--recursive)|\b(?:drop\s+(?:table|database)|truncate\s+(?:table\s+)?\w+)|\bRemove-Item\b[^\n]{0,1000}?(?:-Recurse|-Force)|\bgit\s+(?:reset\s+--hard|clean\s+-[^\n]{0,1000}?f)/i.test(s) },
-    { id: "destructive.production", title: "Production change", severity: "high", category: "impact", explanation: "This action targets a production environment. Confirm the scope and rollback plan before proceeding.", match: s => /\b(?:production|prod)\b/i.test(s) && /\b(?:deploy|delete|drop|truncate|migrate|apply|destroy|restart|rollback|scale)\b/i.test(s) },
-    { id: "credentials.environment", title: "Environment variable access", severity: "high", category: "secrets", explanation: "The action reads exported environment variables that may contain credentials or private configuration.", match: s => /\b(?:printenv|env|export\s+-p|process\.env|os\.environ|System\.getenv)\b|\$\{?[A-Z][A-Z0-9_]*\}?/i.test(s) },
-    { id: "credentials.access", title: "Sensitive credential reference", severity: "medium", category: "secrets", explanation: "This action or instruction references a credential location. Confirm the agent needs access.", match: s => secret.test(s) },
-    { id: "source.private_files", title: "Private source or configuration access", severity: "high", category: "secrets", explanation: "This action accesses a private credential or configuration file. Confirm that the agent needs the contents.", match: s => /(?:\.env(?:\.[\w.-]+)?|\.ssh[\\/]|\.aws[\\/]credentials|id_(?:rsa|ed25519)|\.npmrc|\.netrc|kubeconfig|private.?key)/i.test(s) },
-    { id: "mcp.write", title: "MCP write operation", severity: "high", category: "impact", explanation: "The MCP tool appears to modify data or send an external side effect. Require approval before allowing it.", match: s => /\bmcp(?:__|:)[^\s]*(?:create|update|delete|write|send|post|put|patch|execute|run|publish|deploy|remove)\b/i.test(s) },
-    { id: "credentials.egress", title: "Possible credential exposure", severity: "critical", category: "exfil", explanation: "Credential references and outbound delivery appear together. Inspect the destination and data before running this.", match: s => secret.test(s) && egress.test(s) },
-    { id: "execution.remote", title: "Remote code execution pattern", severity: "high", category: "exec", explanation: "Downloaded content is piped directly into a shell without review.", match: s => pipesIntoShell(s, downloads) },
-    { id: "execution.obfuscated", title: "Encoded execution", severity: "high", category: "exec", explanation: "Encoded content is decoded for execution. Review the decoded payload separately; Beam never executes it.", match: s => pipesIntoShell(s, decodes) || /\b(?:powershell|pwsh)\b[^\n]{0,500}?\s-(?:enc|encodedcommand)\b/i.test(s) },
-    { id: "recon.network_sweep", title: "Network sweep", severity: "medium", category: "recon", explanation: "A scanner targets a network range. Verify scope and authorization before the agent probes other systems (ATT&CK T1046).", match: s => /\b(?:nmap|masscan|rustscan)\b/i.test(s) && /(?:\d{1,3}\.){3}\d{1,3}\/\d{1,2}|(?:\d{1,3}\.){3}\d{1,3}-\d{1,3}/.test(s) },
-    { id: "privilege.elevation", title: "Elevated privileges", severity: "medium", category: "privilege", explanation: "The action requests elevated privileges or broad write permissions.", match: s => /\bsudo\s|\bchmod\s+(?:-R\s+)?777\b/i.test(s) },
-    { id: "network.metadata", title: "Cloud metadata access", severity: "high", category: "secrets", explanation: "Cloud metadata endpoints can expose temporary instance credentials.", match: s => /169\.254\.169\.254|metadata\.google\.internal/i.test(s) },
-    { id: "persistence.config", title: "Security-sensitive configuration", severity: "high", category: "persistence", explanation: "A persistence or agent configuration target is referenced. Check the intended change and trust boundary.", match: s => /authorized_keys|\bcrontab\b|LaunchAgents[\\/]|ANTHROPIC_BASE_URL/i.test(s) },
-    { id: "network.reverse-shell", title: "Reverse shell pattern", severity: "critical", category: "exec", explanation: "This pattern can connect a command shell to another machine.", match: s => /\/dev\/tcp\/|\bnc\b[^\n]{0,300}?\s-e\s|socket[\s\S]{0,200}?subprocess/i.test(s) },
-    { id: "instructions.override", title: "Instruction override attempt", severity: "high", category: "integrity", explanation: "Instructions attempt to override existing safeguards or conceal activity from the user.", match: s => /ignore\s+(?:all\s+)?(?:previous|prior|system|safety)\s+(?:instructions|rules|prompts)|(?:do not|don't|never)\s+(?:tell|inform|notify)\s+(?:the\s+)?user|disable\s+(?:security|safety|logging|audit)/i.test(s) },
-    { id: "source_control.history_rewrite", title: "Git history rewrite", severity: "medium", category: "source_control", explanation: "Force-pushing or rewriting shared history can silently discard other people's commits. Confirm the branch isn't shared before proceeding.", match: s => /\bgit\s+push\s+[^\n]{0,1000}?(?:--force(?:-with-lease)?|-f\b)|\bgit\s+filter-(?:branch|repo)\b/i.test(s) },
-    { id: "integrity.tls_bypass", title: "Certificate or signature verification disabled", severity: "medium", category: "integrity", explanation: "Disabling TLS/certificate verification removes protection against a tampered or impersonated destination.", match: s => /\bcurl\b[^\n]{0,1000}?(?:-k\b|--insecure)|\bwget\b[^\n]{0,1000}?--no-check-certificate|NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*['"]?0|\bgit\b[^\n]{0,1000}?-c\s+http\.sslVerify=false/i.test(s) },
+    { id: "destructive.delete", title: "Destructive operation", severity: "high", category: "impact", explanation: "Recursive deletion or a destructive data operation. Scoped temporary test cleanup is MEDIUM; broad or uncertain targets remain HIGH. Review the target before allowing it.", match: anyMatch(functionalMatch(rmRecursiveForce, recursiveDeleteSpans), otherDestructiveMatcher), severityFor: s => !otherDestructiveOperation(s) && isScopedTemporaryCleanup(s) ? "medium" : "high" },
+    { id: "destructive.disk_wipe", title: "Disk or partition wipe", severity: "critical", category: "impact", explanation: "This targets an entire disk, partition or filesystem rather than individual files, and is unrecoverable. Confirm this is an authorized, intentional wipe.", match: patternMatch(DISK_WIPE) },
+    { id: "destructive.fork_bomb", title: "Fork bomb", severity: "critical", category: "impact", explanation: "This pattern spawns processes exponentially and can make the machine unresponsive.", match: patternMatch(FORK_BOMB) },
+    { id: "destructive.audit_trail", title: "Audit trail or recovery point erased", severity: "critical", category: "integrity", explanation: "This clears shadow copies, event logs or shell history. It is also the standard precursor to covering up a destructive or malicious action; confirm the reason before allowing it.", match: patternMatch(/\bvssadmin\b[^\n]{0,100}?delete\s+shadows|\bwevtutil\b[^\n]{0,50}?\bcl\b|\bClear-EventLog\b|\bhistory\s+-c\b|\bunset\s+HISTFILE\b|\bHISTSIZE\s*=\s*0\b|\bbcdedit\b[^\n]{0,50}?\/deletevalue/i) },
+    { id: "destructive.orchestration", title: "Destroys infrastructure or a deployed workload", severity: "high", category: "impact", explanation: "This tears down a namespace, persistent volume, release, or an entire infrastructure stack. Confirm the environment and that nothing else depends on it.", match: patternMatch(/\bkubectl\s+delete\s+(?:namespace|pvc|persistentvolumeclaim)\b|\bhelm\s+uninstall\b|\bterraform\s+(?:destroy|apply\s+[^\n]{0,100}?-destroy)\b|\bdocker\s+system\s+prune\s+-a[^\n]{0,50}?--volumes|\bdocker\s+rm\s+-f\s+\$\(\s*docker\s+ps\s+-aq\s*\)/i) },
+    { id: "destructive.cloud_resource", title: "Deletes a cloud resource", severity: "high", category: "impact", explanation: "This permanently removes a cloud resource (instance, database, bucket, or repository). Confirm this isn't a production or shared resource before allowing it.", match: patternMatch(/\baws\s+(?:ec2\s+terminate-instances|rds\s+delete-db-instance|s3\s+rb\b[^\n]{0,100}?--force)\b|\bgcloud\s+(?:compute\s+instances|sql\s+instances)\s+delete\b|\baz\s+(?:vm|group)\s+delete\b|\bgh\s+repo\s+delete\b|\bvercel\s+remove\b[^\n]{0,50}?--yes|\bnetlify\s+sites:delete\b/i) },
+    { id: "destructive.account", title: "Deletes a system account", severity: "high", category: "impact", explanation: "This removes a user or group account, which can include its home directory and files. Confirm the account is no longer needed.", match: patternMatch(/\buserdel\s+-r\b|\bgroupdel\b|\bRemove-LocalUser\b|\bnet\s+user\s+\S+\s+\/delete\b|\bdscl\s+\.\s+-delete\s+\/Users\//i) },
+    { id: "integrity.protection_disabled", title: "OS security control disabled", severity: "critical", category: "integrity", explanation: "This turns off a platform security control (System Integrity Protection, Gatekeeper, execution policy, or System Restore), which weakens the machine's security posture beyond this one action.", match: patternMatch(/\bcsrutil\s+disable\b|\bspctl\s+--master-disable\b|\bsecurity\s+delete-keychain\b|\bSet-ExecutionPolicy\s+Unrestricted\b|\bDisable-WindowsOptionalFeature\b|\bDisable-ComputerRestore\b/i) },
+    { id: "network.firewall_disabled", title: "Firewall rules flushed or disabled", severity: "high", category: "integrity", explanation: "This removes or disables firewall protection on the host. Confirm the host doesn't need it, or that replacement rules are applied immediately.", match: patternMatch(/\biptables\s+-F\b|\bufw\s+(?:--force\s+reset|disable)\b|\bnetsh\s+advfirewall\s+set\s+allprofiles\s+state\s+off\b/i) },
+    { id: "destructive.production", title: "Production change", severity: "high", category: "impact", explanation: "This action targets a production environment. Confirm the scope and rollback plan before proceeding.", match: allMatch(patternMatch(/\b(?:production|prod|prd)\b/i), patternMatch(/\b(?:deploy|delete|drop|truncate|migrate|apply|destroy|restart|rollback|scale)\b/i)) },
+    // Dumping the *whole* environment (every var, name and value) is the risky shape: that's what
+    // can hand over credentials the agent was never told about. Referencing one named variable
+    // ($PORT, $NODE_ENV, ${DATABASE_URL}) is how every normal dev workflow reads its own config and
+    // used to trip this rule on every touch -- real alert fatigue, and the reason this rule got
+    // called out as noisy. That case now only shows up (at "info", logged but not an approval gate)
+    // in credentials.environment_ref below, and only for the few var-name shapes anyone would
+    // actually call a credential; everyday vars like $PORT or $NODE_ENV don't get flagged anywhere.
+    { id: "credentials.environment", title: "Environment variable access", severity: "high", category: "secrets", explanation: "The action reads every exported environment variable at once (not one named variable), which can expose credentials the agent was never told about.", match: patternMatch(/\b(?:printenv|env|export\s+-p|process\.env|os\.environ|System\.getenv|declare\s+-x|Get-ChildItem\s+env:)\b|\/proc\/self\/environ\b|(?:^|[;&|]\s*)set(?:\s*$|\s+-o\b)/i) },
+    { id: "credentials.environment_ref", title: "Named credential variable referenced", severity: "info", category: "secrets", explanation: "A single environment variable whose name looks like a credential (KEY/SECRET/TOKEN/PASSWORD/CREDENTIAL) is referenced by name. Logged for visibility; this alone isn't a reason to block the ordinary case of an app reading its own configured secret.", match: patternMatch(/\$\{?[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*_(?:KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL)S?\}?\b/) },
+    { id: "credentials.access", title: "Sensitive credential reference", severity: "medium", category: "secrets", explanation: "This action or instruction references a credential location. Confirm the agent needs access.", match: patternMatch(secret) },
+    { id: "source.private_files", title: "Private source or configuration access", severity: "high", category: "secrets", explanation: "This action accesses a private credential or configuration file. Confirm that the agent needs the contents.", match: patternMatch(/(?:\.env(?:\.[\w.-]+)?|\.ssh[\\/]|\.aws[\\/]credentials|id_(?:rsa|ed25519)|\.npmrc|\.netrc|kubeconfig|private.?key|\.pgpass\b|\.docker[\\/]config\.json|\.gnupg[\\/]|credentials\.json)/i) },
+    { id: "mcp.write", title: "MCP write operation", severity: "high", category: "impact", explanation: "The MCP tool appears to modify data or send an external side effect. Require approval before allowing it.", match: patternMatch(/\bmcp(?:__|:)[^\s]*(?:create|update|delete|write|send|post|put|patch|execute|run|publish|deploy|remove|save|insert|add|grant|revoke|assign)\b/i) },
+    { id: "credentials.egress", title: "Possible credential exposure", severity: "critical", category: "exfil", explanation: "A transfer command carries a sensitive payload, or sensitive output feeds an outbound command. This is a possible exposure, not proof of delivery; check the destination and authorization.", match: functionalMatch(possibleCredentialExposure, credentialExposureSpans) },
+    { id: "secrets.unresolved_reference_launch", title: "Vault reference used directly instead of resolved", severity: "medium", category: "secrets", explanation: "This command includes a secret-manager reference (op://, Azure Key Vault, Vault, Infisical, Doppler, a GitHub Actions secrets expression, or a broker placeholder) typed in literally rather than resolved by its own CLI or platform. The agent cannot resolve it into the real value -- have a human or CI process start the real service instead, with its existing resolver already wired up.", match: patternMatch(UNRESOLVED_REFERENCE) },
+    { id: "execution.remote", title: "Remote code execution pattern", severity: "high", category: "exec", explanation: "Downloaded content is fetched and run without review: piped into a shell or interpreter, fetched and executed in one step, or downloaded and run as separate chained commands.", match: anyMatch(anyMatch(anyMatch(pipelineMatcher(downloads), patternMatch(DOWNLOAD_THEN_EXEC)), patternMatch(POWERSHELL_DOWNLOAD_EXEC)), patternMatch(PYTHON_FETCH_EXEC)) },
+    { id: "execution.obfuscated", title: "Encoded execution", severity: "high", category: "exec", explanation: "Encoded content is decoded for execution. Review the decoded payload separately; Beam never executes it.", match: anyMatch(pipelineMatcher(decodes), patternMatch(/\b(?:powershell|pwsh)\b[^\n]{0,500}?\s-(?:enc|encodedcommand)\b/i)) },
+    { id: "recon.network_sweep", title: "Network sweep", severity: "medium", category: "recon", explanation: "A scanner targets a network range. Verify scope and authorization before the agent probes other systems (ATT&CK T1046).", match: allMatch(patternMatch(/\b(?:nmap|masscan|rustscan)\b/i), patternMatch(/(?:\d{1,3}\.){3}\d{1,3}\/\d{1,2}|(?:\d{1,3}\.){3}\d{1,3}-\d{1,3}/)) },
+    { id: "privilege.elevation", title: "Elevated privileges", severity: "medium", category: "privilege", explanation: "The action requests elevated privileges or broad write permissions.", match: patternMatch(/\bsudo\s|\bdoas\s|(?:^|[\s;&|`(])su\s+(?:-\s*\w*|root)\b|\bpkexec\b|\brunas\s+\/user:|\bchmod\s+(?:-R\s+)?(?:777\b|[ugoa]*\+s\b|[2467][0-7]{3}\b)/i) },
+    { id: "network.metadata", title: "Cloud metadata access", severity: "high", category: "secrets", explanation: "Cloud metadata endpoints can expose temporary instance credentials.", match: patternMatch(/169\.254\.169\.254|metadata\.google\.internal|100\.100\.100\.200/i) },
+    { id: "persistence.config", title: "Security-sensitive configuration", severity: "high", category: "persistence", explanation: "A persistence or agent configuration target is referenced. Check the intended change and trust boundary.", match: patternMatch(/authorized_keys|\bcrontab\b|LaunchAgents[\\/]|ANTHROPIC_BASE_URL/i) },
+    { id: "network.reverse-shell", title: "Reverse shell pattern", severity: "critical", category: "exec", explanation: "This pattern can connect a command shell to another machine.", match: patternMatch(/\/dev\/tcp\/|\bnc\b[^\n]{0,300}?\s-e\s|socket[\s\S]{0,200}?subprocess|\bNew-Object\s+(?:System\.)?Net\.Sockets\.TCPClient\b|\bsocat\b[^\n]{0,300}?\bexec[:=]|\bsocket\([^\n]{0,150}?getprotobyname\(["']tcp["']\)[\s\S]{0,200}?\bconnect\(/i) },
+    { id: "instructions.override", title: "Instruction override attempt", severity: "high", category: "integrity", explanation: "Instructions attempt to override existing safeguards or conceal activity from the user. Checked against the same folded view used for prompt-injection monitoring (Unicode/width normalization and base64 decoding), not a literal-text match, so stylized or encoded phrasing is caught too.", match: functionalMatch(promptAttack.override) },
+    { id: "source_control.history_rewrite", title: "Git history rewrite", severity: "medium", category: "source_control", explanation: "Force-pushing or rewriting shared history can silently discard other people's commits. Confirm the branch isn't shared before proceeding.", match: patternMatch(/\bgit\s+push\s+[^\n]{0,1000}?(?:--force(?:-with-lease)?|-f\b)|\bgit\s+filter-(?:branch|repo)\b/i) },
+    { id: "integrity.tls_bypass", title: "Certificate or signature verification disabled", severity: "medium", category: "integrity", explanation: "Disabling TLS/certificate verification removes protection against a tampered or impersonated destination.", match: patternMatch(/\bcurl\b[^\n]{0,1000}?(?:-k\b|--insecure)|\bwget\b[^\n]{0,1000}?--no-check-certificate|NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*['"]?0|\bgit\b[^\n]{0,1000}?-c\s+http\.sslVerify=false|\bverify\s*=\s*False\b|\brejectUnauthorized\s*:\s*false\b/i) },
 ];
 /** Built-in rules by id, for callers (like `beam monitor`) that reuse a subset of the catalog. */
 export function builtinRulesById(ids) {

package/dist/rule-catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"rule-catalog.js","sourceRoot":"","sources":["../src/rule-catalog.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,GAAG,6HAA6H,CAAC;AAC7I,MAAM,MAAM,GAAG,mFAAmF,CAAC;AAEnG,sFAAsF;AACtF,6FAA6F;AAC7F,qGAAqG;AACrG,MAAM,gBAAgB,GAAG,mCAAmC,CAAC;AAC7D,SAAS,cAAc,CAAC,CAAS,EAAE,QAA4C;IAC7E,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChF,4EAA4E;AAC5E,MAAM,OAAO,GAAG,GAAG,EAAE;IACnB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO,CAAC,OAAe,EAAE,EAAE;QACzB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAW;IAClC,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,iGAAiG,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,wOAAwO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAChd,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,sGAAsG,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,mFAAmF,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACtW,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,wGAAwG,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,mGAAmG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC9V,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,gCAAgC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,8FAA8F,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACvP,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,6GAA6G,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,sHAAsH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC9X,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,2GAA2G,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,4GAA4G,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACnV,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,oHAAoH,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC7R,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,+BAA+B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,mEAAmE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE;IAClO,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,0GAA0G,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,kEAAkE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC7U,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,yHAAyH,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,kEAAkE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACxW,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,qEAAqE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACrP,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,qEAAqE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,gDAAgD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC3P,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,kCAAkC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,0GAA0G,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,mEAAmE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACpU,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,8DAA8D,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,wEAAwE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAClR,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,yFAAyF,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,sMAAsM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACnb,EAAE,EAAE,EAAE,gCAAgC,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,2IAA2I,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,iGAAiG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACvY,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,gDAAgD,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,2GAA2G,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,mLAAmL,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;CACtc,CAAC;AAEF,kGAAkG;AAClG,MAAM,UAAU,gBAAgB,CAAC,GAAa;IAC5C,OAAO,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAa,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC"}
+{"version":3,"file":"rule-catalog.js","sourceRoot":"","sources":["../src/rule-catalog.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,6FAA6F;AAC7F,iBAAiB;AACjB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAgC,MAAM,mBAAmB,CAAC;AACpH,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAO7F,MAAM,MAAM,GAAG,iMAAiM,CAAC;AACjN,gFAAgF;AAChF,+FAA+F;AAC/F,6FAA6F;AAC7F,6CAA6C;AAC7C,MAAM,eAAe,GAAG,+EAA+E,CAAC;AACxG,SAAS,cAAc,CAAC,CAAS,EAAE,QAA4C;IAC7E,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,eAAe,CAAC,QAA4C;IACnE,OAAO,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE;QACpE,MAAM,KAAK,GAAgB,EAAE,CAAC;QAAC,IAAI,MAAM,GAAG,CAAC,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;YAAC,IAAI,OAA2B,CAAC;YAAC,IAAI,MAAM,GAAG,CAAC,CAAC;YACzE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC/C,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,EAAE,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,8BAA8B,EAAC,CAAC,CAAC;oBAAC,MAAM;gBAAC,CAAC;gBAC1K,IAAI,IAAI,CAAC,OAAO,CAAC;oBAAE,OAAO,GAAG,MAAM,CAAC;;oBAC/B,OAAO,GAAG,SAAS,CAAC;gBACzB,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChF,4EAA4E;AAC5E,MAAM,OAAO,GAAG,GAAG,EAAE;IACnB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO,CAAC,OAAe,EAAE,EAAE;QACzB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,8FAA8F;AAC9F,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,qFAAqF;AACrF,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,SAAS,oBAAoB,CAAC,CAAS;IACrC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC;QAAC,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/F,MAAM,IAAI,GAAG,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3F,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YAAC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAAC,CAAC;IAC3K,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,gBAAgB,CAAC,CAAS,IAAa,OAAO,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAE5F,mGAAmG;AACnG,qGAAqG;AACrG,MAAM,kBAAkB,GAAG,iJAAiJ,CAAC;AAC7K,2FAA2F;AAC3F,+FAA+F;AAC/F,0DAA0D;AAC1D,MAAM,wBAAwB,GAAG,wLAAwL,CAAC;AAC1N,MAAM,iBAAiB,GAAG,8GAA8G,CAAC;AAEzI,gGAAgG;AAChG,mFAAmF;AACnF,MAAM,SAAS,GAAG,oUAAoU,CAAC;AACvV,yFAAyF;AACzF,MAAM,SAAS,GAAG,gDAAgD,CAAC;AACnE,oGAAoG;AACpG,MAAM,cAAc,GAAG,mDAAmD,CAAC;AAE3E,MAAM,uBAAuB,GAAG,QAAQ,CAAC,YAAY,CAAC,0WAA0W,CAAC,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;AACjc,SAAS,yBAAyB,CAAC,CAAS,IAAa,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7F,iGAAiG;AACjG,+FAA+F;AAC/F,+FAA+F;AAC/F,gGAAgG;AAChG,kGAAkG;AAClG,kGAAkG;AAClG,iGAAiG;AACjG,kGAAkG;AAClG,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,oIAAoI,CAAC;AAElK,MAAM,CAAC,MAAM,YAAY,GAAW;IAClC,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,4KAA4K,EAAE,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,EAAE,uBAAuB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE;IACpe,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,2JAA2J,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE;IACpT,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,oFAAoF,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE;IAChO,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,sCAAsC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,oLAAoL,EAAE,KAAK,EAAE,YAAY,CAAC,8LAA8L,CAAC,EAAE;IACrhB,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,gDAAgD,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,0JAA0J,EAAE,KAAK,EAAE,YAAY,CAAC,uPAAuP,CAAC,EAAE;IACzjB,EAAE,EAAE,EAAE,4BAA4B,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,+JAA+J,EAAE,KAAK,EAAE,YAAY,CAAC,qRAAqR,CAAC,EAAE;IACvkB,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,gIAAgI,EAAE,KAAK,EAAE,YAAY,CAAC,uHAAuH,CAAC,EAAE;IACnY,EAAE,EAAE,EAAE,+BAA+B,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,iMAAiM,EAAE,KAAK,EAAE,YAAY,CAAC,0LAA0L,CAAC,EAAE;IAC5hB,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,oCAAoC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,gJAAgJ,EAAE,KAAK,EAAE,YAAY,CAAC,oHAAoH,CAAC,EAAE;IACna,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,sGAAsG,EAAE,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,8BAA8B,CAAC,EAAE,YAAY,CAAC,mFAAmF,CAAC,CAAC,EAAE;IACzX,8FAA8F;IAC9F,2FAA2F;IAC3F,gGAAgG;IAChG,4FAA4F;IAC5F,gGAAgG;IAChG,0FAA0F;IAC1F,gGAAgG;IAChG,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,qJAAqJ,EAAE,KAAK,EAAE,YAAY,CAAC,uKAAuK,CAAC,EAAE;IAChd,EAAE,EAAE,EAAE,6BAA6B,EAAE,KAAK,EAAE,sCAAsC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,yPAAyP,EAAE,KAAK,EAAE,YAAY,CAAC,oFAAoF,CAAC,EAAE;IAC9e,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,gCAAgC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,8FAA8F,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE;IACxP,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,6GAA6G,EAAE,KAAK,EAAE,YAAY,CAAC,0LAA0L,CAAC,EAAE;IACnc,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,2GAA2G,EAAE,KAAK,EAAE,YAAY,CAAC,gJAAgJ,CAAC,EAAE;IACxX,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,6LAA6L,EAAE,KAAK,EAAE,eAAe,CAAC,0BAA0B,EAAE,uBAAuB,CAAC,EAAE;IACrY,EAAE,EAAE,EAAE,qCAAqC,EAAE,KAAK,EAAE,mDAAmD,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,mYAAmY,EAAE,KAAK,EAAE,YAAY,CAAC,oBAAoB,CAAC,EAAE;IAC/kB,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,+BAA+B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,gLAAgL,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,kBAAkB,CAAC,CAAC,EAAE,YAAY,CAAC,wBAAwB,CAAC,CAAC,EAAE,YAAY,CAAC,iBAAiB,CAAC,CAAC,EAAE;IACjd,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,0GAA0G,EAAE,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,kEAAkE,CAAC,CAAC,EAAE;IACpV,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,yHAAyH,EAAE,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,gCAAgC,CAAC,EAAE,YAAY,CAAC,kEAAkE,CAAC,CAAC,EAAE;IACvX,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,qEAAqE,EAAE,KAAK,EAAE,YAAY,CAAC,oJAAoJ,CAAC,EAAE;IACrW,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,qEAAqE,EAAE,KAAK,EAAE,YAAY,CAAC,mEAAmE,CAAC,EAAE;IAC/Q,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,kCAAkC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,0GAA0G,EAAE,KAAK,EAAE,YAAY,CAAC,mEAAmE,CAAC,EAAE;IACrU,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,8DAA8D,EAAE,KAAK,EAAE,YAAY,CAAC,6OAA6O,CAAC,EAAE;IACxb,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,+RAA+R,EAAE,KAAK,EAAE,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE;IAC5c,EAAE,EAAE,EAAE,gCAAgC,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,2IAA2I,EAAE,KAAK,EAAE,YAAY,CAAC,iGAAiG,CAAC,EAAE;IACxY,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,gDAAgD,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,2GAA2G,EAAE,KAAK,EAAE,YAAY,CAAC,6OAA6O,CAAC,EAAE;CACjgB,CAAC;AAEF,kGAAkG;AAClG,MAAM,UAAU,gBAAgB,CAAC,GAAa;IAC5C,OAAO,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAa,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC"}

package/dist/rule-matches.d.ts

@@ -0,0 +1,13 @@
+/** Positions use UTF-16 offsets in the original inspected input. Never ship the input itself here. */
+export type MatchSpan = {
+    start: number;
+    end: number;
+    label?: string;
+};
+export type Matcher = ((text: string) => boolean) & {
+    spans?: (text: string) => MatchSpan[];
+};
+export declare function patternMatch(pattern: RegExp): Matcher;
+export declare function anyMatch(...rules: Matcher[]): Matcher;
+export declare function allMatch(...rules: Matcher[]): Matcher;
+export declare function functionalMatch(predicate: (text: string) => boolean, spans?: (text: string) => MatchSpan[]): Matcher;