@bastani/atomic 0.8.31-alpha.4 → 0.9.0-alpha.1

package/dist/core/tools/bash-policy-shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-policy-shell.d.ts","sourceRoot":"","sources":["../../../src/core/tools/bash-policy-shell.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,qBAAqB,EACrB,kBAAkB,EAGlB,mBAAmB,EACnB,MAAM,wBAAwB,CAAC;AAEhC,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAK3E;AAgBD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAWrE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7E;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAG7E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,qBAAqB,CAa3F;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAwExG;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAkH/E","sourcesContent":["import type {\n\tClosingBacktickResult,\n\tClosingParenResult,\n\tShellQuoteState,\n\tShellWordMetadata,\n\tShellWordReadResult,\n} from \"./bash-policy-types.ts\";\n\nexport function isWhitespace(char: string): boolean {\n\treturn char === \" \" || char === \"\\t\" || char === \"\\n\" || char === \"\\r\";\n}\n\nexport function lineTerminatorLengthAt(input: string, index: number): number {\n\tconst char = input[index];\n\tif (char === \"\\r\") return input[index + 1] === \"\\n\" ? 2 : 1;\n\tif (char === \"\\n\") return 1;\n\treturn 0;\n}\n\nfunction previousNonWhitespace(input: string, index: number): string | undefined {\n\tfor (let i = index - 1; i >= 0; i -= 1) {\n\t\tconst char = input[i]!;\n\t\tif (!isWhitespace(char)) return char;\n\t}\n\treturn undefined;\n}\n\nfunction isRedirectionAmpersand(input: string, index: number): boolean {\n\tconst previous = previousNonWhitespace(input, index);\n\tconst next = input[index + 1];\n\treturn previous === \">\" || previous === \"<\" || next === \">\";\n}\n\nexport function operatorLengthAt(input: string, index: number): number {\n\tconst char = input[index];\n\tconst next = input[index + 1];\n\tif (char === \"|\" && input[index - 1] === \">\") return 0;\n\tif (char === \"|\" && next === \"&\") return 2;\n\tif (char === \"&\" && next === \"&\") return 2;\n\tif (char === \"|\" && next === \"|\") return 2;\n\tif (char === \"|\") return 1;\n\tif (char === \";\") return 1;\n\tif (char === \"&\" && !isRedirectionAmpersand(input, index)) return 1;\n\treturn 0;\n}\n\nexport function isHereDocumentAt(input: string, index: number): boolean {\n\treturn input[index] === \"<\" && input[index + 1] === \"<\";\n}\n\nexport function isCommandSubstitutionAt(input: string, index: number): boolean {\n\treturn input[index] === \"$\" && input[index + 1] === \"(\";\n}\n\nexport function isProcessSubstitutionAt(input: string, index: number): boolean {\n\tconst char = input[index];\n\treturn (char === \"<\" || char === \">\") && input[index + 1] === \"(\";\n}\n\nexport function findClosingBacktick(input: string, openIndex: number): ClosingBacktickResult {\n\tfor (let i = openIndex + 1; i < input.length; i += 1) {\n\t\tconst char = input[i]!;\n\t\tif (char === \"\\\\\") {\n\t\t\tif (i + 1 >= input.length) {\n\t\t\t\treturn { ok: false, reason: \"trailing escape in backtick command substitution\", offset: i };\n\t\t\t}\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"`\") return { ok: true, closeIndex: i };\n\t}\n\treturn { ok: false, reason: \"unclosed backtick command substitution\", offset: openIndex };\n}\n\nexport function findClosingParen(input: string, openIndex: number, construct: string): ClosingParenResult {\n\tlet quote: ShellQuoteState = \"none\";\n\tlet depth = 1;\n\tfor (let i = openIndex + 1; i < input.length; i += 1) {\n\t\tconst char = input[i]!;\n\n\t\tif (quote === \"single\") {\n\t\t\tif (char === \"'\") quote = \"none\";\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"\\\\\") {\n\t\t\tif (i + 1 >= input.length) {\n\t\t\t\treturn { ok: false, reason: `trailing escape in ${construct}`, offset: i };\n\t\t\t}\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote === \"double\") {\n\t\t\tif (char === \"\\\"\") {\n\t\t\t\tquote = \"none\";\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (isCommandSubstitutionAt(input, i) || isProcessSubstitutionAt(input, i)) {\n\t\t\t\tdepth += 1;\n\t\t\t\ti += 1;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (char === \"`\") {\n\t\t\t\tconst close = findClosingBacktick(input, i);\n\t\t\t\tif (!close.ok) return close;\n\t\t\t\ti = close.closeIndex;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"'\") {\n\t\t\tquote = \"single\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"\\\"\") {\n\t\t\tquote = \"double\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (isCommandSubstitutionAt(input, i) || isProcessSubstitutionAt(input, i)) {\n\t\t\tdepth += 1;\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"`\") {\n\t\t\tconst close = findClosingBacktick(input, i);\n\t\t\tif (!close.ok) return close;\n\t\t\ti = close.closeIndex;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"(\") {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\treason: `unsupported shell grouping parentheses in ${construct}`,\n\t\t\t\toffset: i,\n\t\t\t};\n\t\t}\n\t\tif (char === \")\") {\n\t\t\tdepth -= 1;\n\t\t\tif (depth === 0) return { ok: true, closeIndex: i };\n\t\t}\n\t}\n\n\tif (quote === \"single\") return { ok: false, reason: `unclosed single quote in ${construct}`, offset: openIndex };\n\tif (quote === \"double\") return { ok: false, reason: `unclosed double quote in ${construct}`, offset: openIndex };\n\treturn { ok: false, reason: `unclosed ${construct}`, offset: openIndex };\n}\n\nexport function readShellWord(input: string, start: number): ShellWordReadResult {\n\tlet quote: ShellQuoteState = \"none\";\n\tlet sawSingleQuote = false;\n\tlet sawDoubleQuote = false;\n\tlet sawEscape = false;\n\tlet sawParameterExpansion = false;\n\tlet sawCommandSubstitution = false;\n\tlet sawProcessSubstitution = false;\n\tlet sawBacktick = false;\n\tlet sawGlobPattern = false;\n\tlet sawBraceExpansion = false;\n\tlet sawTildePrefix = false;\n\n\tconst metadata = (): ShellWordMetadata => ({\n\t\tsawSingleQuote,\n\t\tsawDoubleQuote,\n\t\tsawEscape,\n\t\tsawParameterExpansion,\n\t\tsawCommandSubstitution,\n\t\tsawProcessSubstitution,\n\t\tsawBacktick,\n\t\tsawGlobPattern,\n\t\tsawBraceExpansion,\n\t\tsawTildePrefix,\n\t});\n\n\tfor (let i = start; i < input.length; i += 1) {\n\t\tconst char = input[i]!;\n\t\tif (quote === \"single\") {\n\t\t\tif (char === \"'\") quote = \"none\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"\\\\\") {\n\t\t\tsawEscape = true;\n\t\t\tif (i + 1 >= input.length) return { ok: false, reason: \"trailing escape in shell word\", offset: i };\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote === \"double\") {\n\t\t\tif (char === \"\\\"\") {\n\t\t\t\tquote = \"none\";\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (isCommandSubstitutionAt(input, i) || isProcessSubstitutionAt(input, i)) {\n\t\t\t\tif (isCommandSubstitutionAt(input, i)) {\n\t\t\t\t\tsawCommandSubstitution = true;\n\t\t\t\t} else {\n\t\t\t\t\tsawProcessSubstitution = true;\n\t\t\t\t}\n\t\t\t\tconst close = findClosingParen(input, i + 1, isCommandSubstitutionAt(input, i) ? \"command substitution `$(`\" : \"process substitution\");\n\t\t\t\tif (!close.ok) return { ok: false, reason: close.reason, offset: close.offset };\n\t\t\t\ti = close.closeIndex;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (char === \"`\") {\n\t\t\t\tsawBacktick = true;\n\t\t\t\tconst close = findClosingBacktick(input, i);\n\t\t\t\tif (!close.ok) return { ok: false, reason: close.reason, offset: close.offset };\n\t\t\t\ti = close.closeIndex;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (char === \"$\") sawParameterExpansion = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (isWhitespace(char)) {\n\t\t\treturn { ok: true, word: input.slice(start, i), end: i, metadata: metadata() };\n\t\t}\n\t\tif (char === \"'\") {\n\t\t\tsawSingleQuote = true;\n\t\t\tquote = \"single\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"\\\"\") {\n\t\t\tsawDoubleQuote = true;\n\t\t\tquote = \"double\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (i === start && char === \"~\") {\n\t\t\tsawTildePrefix = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (isCommandSubstitutionAt(input, i) || isProcessSubstitutionAt(input, i)) {\n\t\t\tif (isCommandSubstitutionAt(input, i)) {\n\t\t\t\tsawCommandSubstitution = true;\n\t\t\t} else {\n\t\t\t\tsawProcessSubstitution = true;\n\t\t\t}\n\t\t\tconst close = findClosingParen(input, i + 1, isCommandSubstitutionAt(input, i) ? \"command substitution `$(`\" : \"process substitution\");\n\t\t\tif (!close.ok) return { ok: false, reason: close.reason, offset: close.offset };\n\t\t\ti = close.closeIndex;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"`\") {\n\t\t\tsawBacktick = true;\n\t\t\tconst close = findClosingBacktick(input, i);\n\t\t\tif (!close.ok) return { ok: false, reason: close.reason, offset: close.offset };\n\t\t\ti = close.closeIndex;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"$\") {\n\t\t\tsawParameterExpansion = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"*\" || char === \"?\" || char === \"[\" || char === \"]\") {\n\t\t\tsawGlobPattern = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"{\" || char === \"}\") {\n\t\t\tsawBraceExpansion = true;\n\t\t}\n\t}\n\tif (quote === \"single\") return { ok: false, reason: \"unclosed single quote in shell word\", offset: start };\n\tif (quote === \"double\") return { ok: false, reason: \"unclosed double quote in shell word\", offset: start };\n\treturn { ok: true, word: input.slice(start), end: input.length, metadata: metadata() };\n}\n\n"]}

package/dist/core/tools/bash-policy-shell.js

@@ -0,0 +1,267 @@
+export function isWhitespace(char) {
+    return char === " " || char === "\t" || char === "\n" || char === "\r";
+}
+export function lineTerminatorLengthAt(input, index) {
+    const char = input[index];
+    if (char === "\r")
+        return input[index + 1] === "\n" ? 2 : 1;
+    if (char === "\n")
+        return 1;
+    return 0;
+}
+function previousNonWhitespace(input, index) {
+    for (let i = index - 1; i >= 0; i -= 1) {
+        const char = input[i];
+        if (!isWhitespace(char))
+            return char;
+    }
+    return undefined;
+}
+function isRedirectionAmpersand(input, index) {
+    const previous = previousNonWhitespace(input, index);
+    const next = input[index + 1];
+    return previous === ">" || previous === "<" || next === ">";
+}
+export function operatorLengthAt(input, index) {
+    const char = input[index];
+    const next = input[index + 1];
+    if (char === "|" && input[index - 1] === ">")
+        return 0;
+    if (char === "|" && next === "&")
+        return 2;
+    if (char === "&" && next === "&")
+        return 2;
+    if (char === "|" && next === "|")
+        return 2;
+    if (char === "|")
+        return 1;
+    if (char === ";")
+        return 1;
+    if (char === "&" && !isRedirectionAmpersand(input, index))
+        return 1;
+    return 0;
+}
+export function isHereDocumentAt(input, index) {
+    return input[index] === "<" && input[index + 1] === "<";
+}
+export function isCommandSubstitutionAt(input, index) {
+    return input[index] === "$" && input[index + 1] === "(";
+}
+export function isProcessSubstitutionAt(input, index) {
+    const char = input[index];
+    return (char === "<" || char === ">") && input[index + 1] === "(";
+}
+export function findClosingBacktick(input, openIndex) {
+    for (let i = openIndex + 1; i < input.length; i += 1) {
+        const char = input[i];
+        if (char === "\\") {
+            if (i + 1 >= input.length) {
+                return { ok: false, reason: "trailing escape in backtick command substitution", offset: i };
+            }
+            i += 1;
+            continue;
+        }
+        if (char === "`")
+            return { ok: true, closeIndex: i };
+    }
+    return { ok: false, reason: "unclosed backtick command substitution", offset: openIndex };
+}
+export function findClosingParen(input, openIndex, construct) {
+    let quote = "none";
+    let depth = 1;
+    for (let i = openIndex + 1; i < input.length; i += 1) {
+        const char = input[i];
+        if (quote === "single") {
+            if (char === "'")
+                quote = "none";
+            continue;
+        }
+        if (char === "\\") {
+            if (i + 1 >= input.length) {
+                return { ok: false, reason: `trailing escape in ${construct}`, offset: i };
+            }
+            i += 1;
+            continue;
+        }
+        if (quote === "double") {
+            if (char === "\"") {
+                quote = "none";
+                continue;
+            }
+            if (isCommandSubstitutionAt(input, i) || isProcessSubstitutionAt(input, i)) {
+                depth += 1;
+                i += 1;
+                continue;
+            }
+            if (char === "`") {
+                const close = findClosingBacktick(input, i);
+                if (!close.ok)
+                    return close;
+                i = close.closeIndex;
+            }
+            continue;
+        }
+        if (char === "'") {
+            quote = "single";
+            continue;
+        }
+        if (char === "\"") {
+            quote = "double";
+            continue;
+        }
+        if (isCommandSubstitutionAt(input, i) || isProcessSubstitutionAt(input, i)) {
+            depth += 1;
+            i += 1;
+            continue;
+        }
+        if (char === "`") {
+            const close = findClosingBacktick(input, i);
+            if (!close.ok)
+                return close;
+            i = close.closeIndex;
+            continue;
+        }
+        if (char === "(") {
+            return {
+                ok: false,
+                reason: `unsupported shell grouping parentheses in ${construct}`,
+                offset: i,
+            };
+        }
+        if (char === ")") {
+            depth -= 1;
+            if (depth === 0)
+                return { ok: true, closeIndex: i };
+        }
+    }
+    if (quote === "single")
+        return { ok: false, reason: `unclosed single quote in ${construct}`, offset: openIndex };
+    if (quote === "double")
+        return { ok: false, reason: `unclosed double quote in ${construct}`, offset: openIndex };
+    return { ok: false, reason: `unclosed ${construct}`, offset: openIndex };
+}
+export function readShellWord(input, start) {
+    let quote = "none";
+    let sawSingleQuote = false;
+    let sawDoubleQuote = false;
+    let sawEscape = false;
+    let sawParameterExpansion = false;
+    let sawCommandSubstitution = false;
+    let sawProcessSubstitution = false;
+    let sawBacktick = false;
+    let sawGlobPattern = false;
+    let sawBraceExpansion = false;
+    let sawTildePrefix = false;
+    const metadata = () => ({
+        sawSingleQuote,
+        sawDoubleQuote,
+        sawEscape,
+        sawParameterExpansion,
+        sawCommandSubstitution,
+        sawProcessSubstitution,
+        sawBacktick,
+        sawGlobPattern,
+        sawBraceExpansion,
+        sawTildePrefix,
+    });
+    for (let i = start; i < input.length; i += 1) {
+        const char = input[i];
+        if (quote === "single") {
+            if (char === "'")
+                quote = "none";
+            continue;
+        }
+        if (char === "\\") {
+            sawEscape = true;
+            if (i + 1 >= input.length)
+                return { ok: false, reason: "trailing escape in shell word", offset: i };
+            i += 1;
+            continue;
+        }
+        if (quote === "double") {
+            if (char === "\"") {
+                quote = "none";
+                continue;
+            }
+            if (isCommandSubstitutionAt(input, i) || isProcessSubstitutionAt(input, i)) {
+                if (isCommandSubstitutionAt(input, i)) {
+                    sawCommandSubstitution = true;
+                }
+                else {
+                    sawProcessSubstitution = true;
+                }
+                const close = findClosingParen(input, i + 1, isCommandSubstitutionAt(input, i) ? "command substitution `$(`" : "process substitution");
+                if (!close.ok)
+                    return { ok: false, reason: close.reason, offset: close.offset };
+                i = close.closeIndex;
+                continue;
+            }
+            if (char === "`") {
+                sawBacktick = true;
+                const close = findClosingBacktick(input, i);
+                if (!close.ok)
+                    return { ok: false, reason: close.reason, offset: close.offset };
+                i = close.closeIndex;
+                continue;
+            }
+            if (char === "$")
+                sawParameterExpansion = true;
+            continue;
+        }
+        if (isWhitespace(char)) {
+            return { ok: true, word: input.slice(start, i), end: i, metadata: metadata() };
+        }
+        if (char === "'") {
+            sawSingleQuote = true;
+            quote = "single";
+            continue;
+        }
+        if (char === "\"") {
+            sawDoubleQuote = true;
+            quote = "double";
+            continue;
+        }
+        if (i === start && char === "~") {
+            sawTildePrefix = true;
+            continue;
+        }
+        if (isCommandSubstitutionAt(input, i) || isProcessSubstitutionAt(input, i)) {
+            if (isCommandSubstitutionAt(input, i)) {
+                sawCommandSubstitution = true;
+            }
+            else {
+                sawProcessSubstitution = true;
+            }
+            const close = findClosingParen(input, i + 1, isCommandSubstitutionAt(input, i) ? "command substitution `$(`" : "process substitution");
+            if (!close.ok)
+                return { ok: false, reason: close.reason, offset: close.offset };
+            i = close.closeIndex;
+            continue;
+        }
+        if (char === "`") {
+            sawBacktick = true;
+            const close = findClosingBacktick(input, i);
+            if (!close.ok)
+                return { ok: false, reason: close.reason, offset: close.offset };
+            i = close.closeIndex;
+            continue;
+        }
+        if (char === "$") {
+            sawParameterExpansion = true;
+            continue;
+        }
+        if (char === "*" || char === "?" || char === "[" || char === "]") {
+            sawGlobPattern = true;
+            continue;
+        }
+        if (char === "{" || char === "}") {
+            sawBraceExpansion = true;
+        }
+    }
+    if (quote === "single")
+        return { ok: false, reason: "unclosed single quote in shell word", offset: start };
+    if (quote === "double")
+        return { ok: false, reason: "unclosed double quote in shell word", offset: start };
+    return { ok: true, word: input.slice(start), end: input.length, metadata: metadata() };
+}
+//# sourceMappingURL=bash-policy-shell.js.map

package/dist/core/tools/bash-policy-shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-policy-shell.js","sourceRoot":"","sources":["../../../src/core/tools/bash-policy-shell.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,YAAY,CAAC,IAAY;IACxC,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,KAAa;IAClE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC5B,OAAO,CAAC,CAAC;AACV,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa,EAAE,KAAa;IAC1D,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,KAAa;IAC3D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,KAAa;IAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IACvD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACpE,OAAO,CAAC,CAAC;AACV,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,KAAa;IAC5D,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,KAAa;IACnE,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,KAAa;IACnE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,SAAiB;IACnE,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAC7F,CAAC;YACD,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,SAAiB,EAAE,SAAiB;IACnF,IAAI,KAAK,GAAoB,MAAM,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAEvB,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,IAAI,KAAK,GAAG;gBAAE,KAAK,GAAG,MAAM,CAAC;YACjC,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAC5E,CAAC;YACD,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QAED,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACnB,KAAK,GAAG,MAAM,CAAC;gBACf,SAAS;YACV,CAAC;YACD,IAAI,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC5E,KAAK,IAAI,CAAC,CAAC;gBACX,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC5C,IAAI,CAAC,KAAK,CAAC,EAAE;oBAAE,OAAO,KAAK,CAAC;gBAC5B,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;YACtB,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,KAAK,GAAG,QAAQ,CAAC;YACjB,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,KAAK,GAAG,QAAQ,CAAC;YACjB,SAAS;QACV,CAAC;QACD,IAAI,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5E,KAAK,IAAI,CAAC,CAAC;YACX,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC5B,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;YACrB,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,6CAA6C,SAAS,EAAE;gBAChE,MAAM,EAAE,CAAC;aACT,CAAC;QACH,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QACrD,CAAC;IACF,CAAC;IAED,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,SAAS,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjH,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,SAAS,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,SAAS,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,KAAa;IACzD,IAAI,KAAK,GAAoB,MAAM,CAAC;IACpC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAClC,IAAI,sBAAsB,GAAG,KAAK,CAAC;IACnC,IAAI,sBAAsB,GAAG,KAAK,CAAC;IACnC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,MAAM,QAAQ,GAAG,GAAsB,EAAE,CAAC,CAAC;QAC1C,cAAc;QACd,cAAc;QACd,SAAS;QACT,qBAAqB;QACrB,sBAAsB;QACtB,sBAAsB;QACtB,WAAW;QACX,cAAc;QACd,iBAAiB;QACjB,cAAc;KACd,CAAC,CAAC;IAEH,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,IAAI,KAAK,GAAG;gBAAE,KAAK,GAAG,MAAM,CAAC;YACjC,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YACpG,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACnB,KAAK,GAAG,MAAM,CAAC;gBACf,SAAS;YACV,CAAC;YACD,IAAI,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC5E,IAAI,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;oBACvC,sBAAsB,GAAG,IAAI,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACP,sBAAsB,GAAG,IAAI,CAAC;gBAC/B,CAAC;gBACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;gBACvI,IAAI,CAAC,KAAK,CAAC,EAAE;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;gBAChF,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;gBACrB,SAAS;YACV,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,WAAW,GAAG,IAAI,CAAC;gBACnB,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC5C,IAAI,CAAC,KAAK,CAAC,EAAE;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;gBAChF,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;gBACrB,SAAS;YACV,CAAC;YACD,IAAI,IAAI,KAAK,GAAG;gBAAE,qBAAqB,GAAG,IAAI,CAAC;YAC/C,SAAS;QACV,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,cAAc,GAAG,IAAI,CAAC;YACtB,KAAK,GAAG,QAAQ,CAAC;YACjB,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,cAAc,GAAG,IAAI,CAAC;YACtB,KAAK,GAAG,QAAQ,CAAC;YACjB,SAAS;QACV,CAAC;QACD,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,cAAc,GAAG,IAAI,CAAC;YACtB,SAAS;QACV,CAAC;QACD,IAAI,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;gBACvC,sBAAsB,GAAG,IAAI,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACP,sBAAsB,GAAG,IAAI,CAAC;YAC/B,CAAC;YACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;YACvI,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAChF,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;YACrB,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,WAAW,GAAG,IAAI,CAAC;YACnB,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAChF,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;YACrB,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,qBAAqB,GAAG,IAAI,CAAC;YAC7B,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClE,cAAc,GAAG,IAAI,CAAC;YACtB,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,iBAAiB,GAAG,IAAI,CAAC;QAC1B,CAAC;IACF,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3G,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC;AACxF,CAAC","sourcesContent":["import type {\n\tClosingBacktickResult,\n\tClosingParenResult,\n\tShellQuoteState,\n\tShellWordMetadata,\n\tShellWordReadResult,\n} from \"./bash-policy-types.ts\";\n\nexport function isWhitespace(char: string): boolean {\n\treturn char === \" \" || char === \"\\t\" || char === \"\\n\" || char === \"\\r\";\n}\n\nexport function lineTerminatorLengthAt(input: string, index: number): number {\n\tconst char = input[index];\n\tif (char === \"\\r\") return input[index + 1] === \"\\n\" ? 2 : 1;\n\tif (char === \"\\n\") return 1;\n\treturn 0;\n}\n\nfunction previousNonWhitespace(input: string, index: number): string | undefined {\n\tfor (let i = index - 1; i >= 0; i -= 1) {\n\t\tconst char = input[i]!;\n\t\tif (!isWhitespace(char)) return char;\n\t}\n\treturn undefined;\n}\n\nfunction isRedirectionAmpersand(input: string, index: number): boolean {\n\tconst previous = previousNonWhitespace(input, index);\n\tconst next = input[index + 1];\n\treturn previous === \">\" || previous === \"<\" || next === \">\";\n}\n\nexport function operatorLengthAt(input: string, index: number): number {\n\tconst char = input[index];\n\tconst next = input[index + 1];\n\tif (char === \"|\" && input[index - 1] === \">\") return 0;\n\tif (char === \"|\" && next === \"&\") return 2;\n\tif (char === \"&\" && next === \"&\") return 2;\n\tif (char === \"|\" && next === \"|\") return 2;\n\tif (char === \"|\") return 1;\n\tif (char === \";\") return 1;\n\tif (char === \"&\" && !isRedirectionAmpersand(input, index)) return 1;\n\treturn 0;\n}\n\nexport function isHereDocumentAt(input: string, index: number): boolean {\n\treturn input[index] === \"<\" && input[index + 1] === \"<\";\n}\n\nexport function isCommandSubstitutionAt(input: string, index: number): boolean {\n\treturn input[index] === \"$\" && input[index + 1] === \"(\";\n}\n\nexport function isProcessSubstitutionAt(input: string, index: number): boolean {\n\tconst char = input[index];\n\treturn (char === \"<\" || char === \">\") && input[index + 1] === \"(\";\n}\n\nexport function findClosingBacktick(input: string, openIndex: number): ClosingBacktickResult {\n\tfor (let i = openIndex + 1; i < input.length; i += 1) {\n\t\tconst char = input[i]!;\n\t\tif (char === \"\\\\\") {\n\t\t\tif (i + 1 >= input.length) {\n\t\t\t\treturn { ok: false, reason: \"trailing escape in backtick command substitution\", offset: i };\n\t\t\t}\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"`\") return { ok: true, closeIndex: i };\n\t}\n\treturn { ok: false, reason: \"unclosed backtick command substitution\", offset: openIndex };\n}\n\nexport function findClosingParen(input: string, openIndex: number, construct: string): ClosingParenResult {\n\tlet quote: ShellQuoteState = \"none\";\n\tlet depth = 1;\n\tfor (let i = openIndex + 1; i < input.length; i += 1) {\n\t\tconst char = input[i]!;\n\n\t\tif (quote === \"single\") {\n\t\t\tif (char === \"'\") quote = \"none\";\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"\\\\\") {\n\t\t\tif (i + 1 >= input.length) {\n\t\t\t\treturn { ok: false, reason: `trailing escape in ${construct}`, offset: i };\n\t\t\t}\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote === \"double\") {\n\t\t\tif (char === \"\\\"\") {\n\t\t\t\tquote = \"none\";\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (isCommandSubstitutionAt(input, i) || isProcessSubstitutionAt(input, i)) {\n\t\t\t\tdepth += 1;\n\t\t\t\ti += 1;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (char === \"`\") {\n\t\t\t\tconst close = findClosingBacktick(input, i);\n\t\t\t\tif (!close.ok) return close;\n\t\t\t\ti = close.closeIndex;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"'\") {\n\t\t\tquote = \"single\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"\\\"\") {\n\t\t\tquote = \"double\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (isCommandSubstitutionAt(input, i) || isProcessSubstitutionAt(input, i)) {\n\t\t\tdepth += 1;\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"`\") {\n\t\t\tconst close = findClosingBacktick(input, i);\n\t\t\tif (!close.ok) return close;\n\t\t\ti = close.closeIndex;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"(\") {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\treason: `unsupported shell grouping parentheses in ${construct}`,\n\t\t\t\toffset: i,\n\t\t\t};\n\t\t}\n\t\tif (char === \")\") {\n\t\t\tdepth -= 1;\n\t\t\tif (depth === 0) return { ok: true, closeIndex: i };\n\t\t}\n\t}\n\n\tif (quote === \"single\") return { ok: false, reason: `unclosed single quote in ${construct}`, offset: openIndex };\n\tif (quote === \"double\") return { ok: false, reason: `unclosed double quote in ${construct}`, offset: openIndex };\n\treturn { ok: false, reason: `unclosed ${construct}`, offset: openIndex };\n}\n\nexport function readShellWord(input: string, start: number): ShellWordReadResult {\n\tlet quote: ShellQuoteState = \"none\";\n\tlet sawSingleQuote = false;\n\tlet sawDoubleQuote = false;\n\tlet sawEscape = false;\n\tlet sawParameterExpansion = false;\n\tlet sawCommandSubstitution = false;\n\tlet sawProcessSubstitution = false;\n\tlet sawBacktick = false;\n\tlet sawGlobPattern = false;\n\tlet sawBraceExpansion = false;\n\tlet sawTildePrefix = false;\n\n\tconst metadata = (): ShellWordMetadata => ({\n\t\tsawSingleQuote,\n\t\tsawDoubleQuote,\n\t\tsawEscape,\n\t\tsawParameterExpansion,\n\t\tsawCommandSubstitution,\n\t\tsawProcessSubstitution,\n\t\tsawBacktick,\n\t\tsawGlobPattern,\n\t\tsawBraceExpansion,\n\t\tsawTildePrefix,\n\t});\n\n\tfor (let i = start; i < input.length; i += 1) {\n\t\tconst char = input[i]!;\n\t\tif (quote === \"single\") {\n\t\t\tif (char === \"'\") quote = \"none\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"\\\\\") {\n\t\t\tsawEscape = true;\n\t\t\tif (i + 1 >= input.length) return { ok: false, reason: \"trailing escape in shell word\", offset: i };\n\t\t\ti += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote === \"double\") {\n\t\t\tif (char === \"\\\"\") {\n\t\t\t\tquote = \"none\";\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (isCommandSubstitutionAt(input, i) || isProcessSubstitutionAt(input, i)) {\n\t\t\t\tif (isCommandSubstitutionAt(input, i)) {\n\t\t\t\t\tsawCommandSubstitution = true;\n\t\t\t\t} else {\n\t\t\t\t\tsawProcessSubstitution = true;\n\t\t\t\t}\n\t\t\t\tconst close = findClosingParen(input, i + 1, isCommandSubstitutionAt(input, i) ? \"command substitution `$(`\" : \"process substitution\");\n\t\t\t\tif (!close.ok) return { ok: false, reason: close.reason, offset: close.offset };\n\t\t\t\ti = close.closeIndex;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (char === \"`\") {\n\t\t\t\tsawBacktick = true;\n\t\t\t\tconst close = findClosingBacktick(input, i);\n\t\t\t\tif (!close.ok) return { ok: false, reason: close.reason, offset: close.offset };\n\t\t\t\ti = close.closeIndex;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (char === \"$\") sawParameterExpansion = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (isWhitespace(char)) {\n\t\t\treturn { ok: true, word: input.slice(start, i), end: i, metadata: metadata() };\n\t\t}\n\t\tif (char === \"'\") {\n\t\t\tsawSingleQuote = true;\n\t\t\tquote = \"single\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"\\\"\") {\n\t\t\tsawDoubleQuote = true;\n\t\t\tquote = \"double\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (i === start && char === \"~\") {\n\t\t\tsawTildePrefix = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (isCommandSubstitutionAt(input, i) || isProcessSubstitutionAt(input, i)) {\n\t\t\tif (isCommandSubstitutionAt(input, i)) {\n\t\t\t\tsawCommandSubstitution = true;\n\t\t\t} else {\n\t\t\t\tsawProcessSubstitution = true;\n\t\t\t}\n\t\t\tconst close = findClosingParen(input, i + 1, isCommandSubstitutionAt(input, i) ? \"command substitution `$(`\" : \"process substitution\");\n\t\t\tif (!close.ok) return { ok: false, reason: close.reason, offset: close.offset };\n\t\t\ti = close.closeIndex;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"`\") {\n\t\t\tsawBacktick = true;\n\t\t\tconst close = findClosingBacktick(input, i);\n\t\t\tif (!close.ok) return { ok: false, reason: close.reason, offset: close.offset };\n\t\t\ti = close.closeIndex;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"$\") {\n\t\t\tsawParameterExpansion = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"*\" || char === \"?\" || char === \"[\" || char === \"]\") {\n\t\t\tsawGlobPattern = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"{\" || char === \"}\") {\n\t\t\tsawBraceExpansion = true;\n\t\t}\n\t}\n\tif (quote === \"single\") return { ok: false, reason: \"unclosed single quote in shell word\", offset: start };\n\tif (quote === \"double\") return { ok: false, reason: \"unclosed double quote in shell word\", offset: start };\n\treturn { ok: true, word: input.slice(start), end: input.length, metadata: metadata() };\n}\n\n"]}

package/dist/core/tools/bash-policy-types.d.ts

@@ -0,0 +1,146 @@
+export type BashCommandRule = string | {
+    readonly prefix: string;
+} | {
+    readonly glob: string;
+} | {
+    readonly regex: string;
+    readonly flags?: string;
+};
+export type BashCommandPolicyDefault = "allow" | "deny";
+export type BashCommandPolicyMatchMode = "whole" | "segments";
+export interface BashCommandPolicy {
+    readonly default?: BashCommandPolicyDefault;
+    readonly allow?: readonly BashCommandRule[];
+    readonly deny?: readonly BashCommandRule[];
+    readonly match?: BashCommandPolicyMatchMode;
+}
+export type BashCommandSegmentSource = "top-level" | "command-substitution" | "process-substitution" | "backtick";
+export interface BashCommandSegment {
+    readonly raw: string;
+    readonly target: string;
+    readonly head: string;
+    readonly start: number;
+    readonly end: number;
+    readonly source: BashCommandSegmentSource;
+}
+export interface BashCommandParseError {
+    readonly reason: string;
+    readonly offset: number;
+    readonly source: BashCommandSegmentSource;
+}
+export type BashCommandParseResult = {
+    readonly ok: true;
+    readonly segments: readonly BashCommandSegment[];
+} | {
+    readonly ok: false;
+    readonly error: BashCommandParseError;
+};
+export type BashCommandPolicyDenialReason = "invalid-policy" | "unsupported-shell-syntax" | "matched-deny" | "default-deny";
+export interface BashCommandPolicyRejection {
+    readonly reason: BashCommandPolicyDenialReason;
+    readonly message: string;
+    readonly target?: BashCommandSegment;
+    readonly matchedRule?: BashCommandRule;
+    readonly parseError?: BashCommandParseError;
+}
+export type BashCommandPolicyDecision = {
+    readonly allowed: true;
+    readonly mode: BashCommandPolicyMatchMode;
+    readonly targets: readonly BashCommandSegment[];
+} | {
+    readonly allowed: false;
+    readonly mode: BashCommandPolicyMatchMode;
+    readonly targets: readonly BashCommandSegment[];
+    readonly rejection: BashCommandPolicyRejection;
+};
+export type CompiledRule = {
+    readonly kind: "exact";
+    readonly source: BashCommandRule;
+    readonly value: string;
+} | {
+    readonly kind: "prefix";
+    readonly source: BashCommandRule;
+    readonly value: string;
+} | {
+    readonly kind: "glob";
+    readonly source: BashCommandRule;
+    readonly value: RegExp;
+} | {
+    readonly kind: "regex";
+    readonly source: BashCommandRule;
+    readonly value: RegExp;
+};
+export interface CompiledBashCommandPolicy {
+    readonly defaultDecision: BashCommandPolicyDefault;
+    readonly match: BashCommandPolicyMatchMode;
+    readonly allow: readonly CompiledRule[];
+    readonly deny: readonly CompiledRule[];
+}
+export type CompileResult = {
+    readonly ok: true;
+    readonly policy: CompiledBashCommandPolicy;
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+export type CompileRuleResult = {
+    readonly ok: true;
+    readonly rule: CompiledRule;
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+export type CompileRulesResult = {
+    readonly ok: true;
+    readonly rules: readonly CompiledRule[];
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+export type SegmentBuildResult = {
+    readonly ok: true;
+    readonly segment?: BashCommandSegment;
+} | {
+    readonly ok: false;
+    readonly error: BashCommandParseError;
+};
+export type ClosingParenResult = {
+    readonly ok: true;
+    readonly closeIndex: number;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+    readonly offset: number;
+};
+export type ClosingBacktickResult = {
+    readonly ok: true;
+    readonly closeIndex: number;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+    readonly offset: number;
+};
+export type ShellQuoteState = "none" | "single" | "double";
+export interface ShellWordMetadata {
+    readonly sawSingleQuote: boolean;
+    readonly sawDoubleQuote: boolean;
+    readonly sawEscape: boolean;
+    readonly sawParameterExpansion: boolean;
+    readonly sawCommandSubstitution: boolean;
+    readonly sawProcessSubstitution: boolean;
+    readonly sawBacktick: boolean;
+    readonly sawGlobPattern: boolean;
+    readonly sawBraceExpansion: boolean;
+    readonly sawTildePrefix: boolean;
+}
+export type ShellWordReadResult = {
+    readonly ok: true;
+    readonly word: string;
+    readonly end: number;
+    readonly metadata: ShellWordMetadata;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+    readonly offset: number;
+};
+//# sourceMappingURL=bash-policy-types.d.ts.map

package/dist/core/tools/bash-policy-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-policy-types.d.ts","sourceRoot":"","sources":["../../../src/core/tools/bash-policy-types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GACxB,MAAM,GACN;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,MAAM,MAAM,wBAAwB,GAAG,OAAO,GAAG,MAAM,CAAC;AACxD,MAAM,MAAM,0BAA0B,GAAG,OAAO,GAAG,UAAU,CAAC;AAE9D,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,0BAA0B,CAAC;CAC5C;AAED,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,sBAAsB,GAAG,sBAAsB,GAAG,UAAU,CAAC;AAElH,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC1C;AAED,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC1C;AAED,MAAM,MAAM,sBAAsB,GAC/B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAA;CAAE,GACvE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAEjE,MAAM,MAAM,6BAA6B,GACtC,gBAAgB,GAChB,0BAA0B,GAC1B,cAAc,GACd,cAAc,CAAC;AAElB,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC;CAC5C;AAED,MAAM,MAAM,yBAAyB,GAClC;IACA,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC/C,GACD;IACA,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAC;CAC9C,CAAC;AAEL,MAAM,MAAM,YAAY,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrF;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,eAAe,EAAE,wBAAwB,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,CAAC;CACvC;AAED,MAAM,MAAM,aAAa,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,MAAM,MAAM,iBAAiB,GAC1B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,MAAM,MAAM,kBAAkB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,MAAM,MAAM,kBAAkB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAEjE,MAAM,MAAM,kBAAkB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,MAAM,MAAM,qBAAqB,GAC9B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,MAAM,mBAAmB,GAC5B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,GACxG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC","sourcesContent":["export type BashCommandRule =\n\t| string\n\t| { readonly prefix: string }\n\t| { readonly glob: string }\n\t| { readonly regex: string; readonly flags?: string };\n\nexport type BashCommandPolicyDefault = \"allow\" | \"deny\";\nexport type BashCommandPolicyMatchMode = \"whole\" | \"segments\";\n\nexport interface BashCommandPolicy {\n\treadonly default?: BashCommandPolicyDefault;\n\treadonly allow?: readonly BashCommandRule[];\n\treadonly deny?: readonly BashCommandRule[];\n\treadonly match?: BashCommandPolicyMatchMode;\n}\n\nexport type BashCommandSegmentSource = \"top-level\" | \"command-substitution\" | \"process-substitution\" | \"backtick\";\n\nexport interface BashCommandSegment {\n\treadonly raw: string;\n\treadonly target: string;\n\treadonly head: string;\n\treadonly start: number;\n\treadonly end: number;\n\treadonly source: BashCommandSegmentSource;\n}\n\nexport interface BashCommandParseError {\n\treadonly reason: string;\n\treadonly offset: number;\n\treadonly source: BashCommandSegmentSource;\n}\n\nexport type BashCommandParseResult =\n\t| { readonly ok: true; readonly segments: readonly BashCommandSegment[] }\n\t| { readonly ok: false; readonly error: BashCommandParseError };\n\nexport type BashCommandPolicyDenialReason =\n\t| \"invalid-policy\"\n\t| \"unsupported-shell-syntax\"\n\t| \"matched-deny\"\n\t| \"default-deny\";\n\nexport interface BashCommandPolicyRejection {\n\treadonly reason: BashCommandPolicyDenialReason;\n\treadonly message: string;\n\treadonly target?: BashCommandSegment;\n\treadonly matchedRule?: BashCommandRule;\n\treadonly parseError?: BashCommandParseError;\n}\n\nexport type BashCommandPolicyDecision =\n\t| {\n\t\t\treadonly allowed: true;\n\t\t\treadonly mode: BashCommandPolicyMatchMode;\n\t\t\treadonly targets: readonly BashCommandSegment[];\n\t  }\n\t| {\n\t\t\treadonly allowed: false;\n\t\t\treadonly mode: BashCommandPolicyMatchMode;\n\t\t\treadonly targets: readonly BashCommandSegment[];\n\t\t\treadonly rejection: BashCommandPolicyRejection;\n\t  };\n\nexport type CompiledRule =\n\t| { readonly kind: \"exact\"; readonly source: BashCommandRule; readonly value: string }\n\t| { readonly kind: \"prefix\"; readonly source: BashCommandRule; readonly value: string }\n\t| { readonly kind: \"glob\"; readonly source: BashCommandRule; readonly value: RegExp }\n\t| { readonly kind: \"regex\"; readonly source: BashCommandRule; readonly value: RegExp };\n\nexport interface CompiledBashCommandPolicy {\n\treadonly defaultDecision: BashCommandPolicyDefault;\n\treadonly match: BashCommandPolicyMatchMode;\n\treadonly allow: readonly CompiledRule[];\n\treadonly deny: readonly CompiledRule[];\n}\n\nexport type CompileResult =\n\t| { readonly ok: true; readonly policy: CompiledBashCommandPolicy }\n\t| { readonly ok: false; readonly message: string };\n\nexport type CompileRuleResult =\n\t| { readonly ok: true; readonly rule: CompiledRule }\n\t| { readonly ok: false; readonly message: string };\n\nexport type CompileRulesResult =\n\t| { readonly ok: true; readonly rules: readonly CompiledRule[] }\n\t| { readonly ok: false; readonly message: string };\n\nexport type SegmentBuildResult =\n\t| { readonly ok: true; readonly segment?: BashCommandSegment }\n\t| { readonly ok: false; readonly error: BashCommandParseError };\n\nexport type ClosingParenResult =\n\t| { readonly ok: true; readonly closeIndex: number }\n\t| { readonly ok: false; readonly reason: string; readonly offset: number };\n\nexport type ClosingBacktickResult =\n\t| { readonly ok: true; readonly closeIndex: number }\n\t| { readonly ok: false; readonly reason: string; readonly offset: number };\n\nexport type ShellQuoteState = \"none\" | \"single\" | \"double\";\n\nexport interface ShellWordMetadata {\n\treadonly sawSingleQuote: boolean;\n\treadonly sawDoubleQuote: boolean;\n\treadonly sawEscape: boolean;\n\treadonly sawParameterExpansion: boolean;\n\treadonly sawCommandSubstitution: boolean;\n\treadonly sawProcessSubstitution: boolean;\n\treadonly sawBacktick: boolean;\n\treadonly sawGlobPattern: boolean;\n\treadonly sawBraceExpansion: boolean;\n\treadonly sawTildePrefix: boolean;\n}\n\nexport type ShellWordReadResult =\n\t| { readonly ok: true; readonly word: string; readonly end: number; readonly metadata: ShellWordMetadata }\n\t| { readonly ok: false; readonly reason: string; readonly offset: number };\n"]}

package/dist/core/tools/bash-policy-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bash-policy-types.js.map

package/dist/core/tools/bash-policy-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-policy-types.js","sourceRoot":"","sources":["../../../src/core/tools/bash-policy-types.ts"],"names":[],"mappings":"","sourcesContent":["export type BashCommandRule =\n\t| string\n\t| { readonly prefix: string }\n\t| { readonly glob: string }\n\t| { readonly regex: string; readonly flags?: string };\n\nexport type BashCommandPolicyDefault = \"allow\" | \"deny\";\nexport type BashCommandPolicyMatchMode = \"whole\" | \"segments\";\n\nexport interface BashCommandPolicy {\n\treadonly default?: BashCommandPolicyDefault;\n\treadonly allow?: readonly BashCommandRule[];\n\treadonly deny?: readonly BashCommandRule[];\n\treadonly match?: BashCommandPolicyMatchMode;\n}\n\nexport type BashCommandSegmentSource = \"top-level\" | \"command-substitution\" | \"process-substitution\" | \"backtick\";\n\nexport interface BashCommandSegment {\n\treadonly raw: string;\n\treadonly target: string;\n\treadonly head: string;\n\treadonly start: number;\n\treadonly end: number;\n\treadonly source: BashCommandSegmentSource;\n}\n\nexport interface BashCommandParseError {\n\treadonly reason: string;\n\treadonly offset: number;\n\treadonly source: BashCommandSegmentSource;\n}\n\nexport type BashCommandParseResult =\n\t| { readonly ok: true; readonly segments: readonly BashCommandSegment[] }\n\t| { readonly ok: false; readonly error: BashCommandParseError };\n\nexport type BashCommandPolicyDenialReason =\n\t| \"invalid-policy\"\n\t| \"unsupported-shell-syntax\"\n\t| \"matched-deny\"\n\t| \"default-deny\";\n\nexport interface BashCommandPolicyRejection {\n\treadonly reason: BashCommandPolicyDenialReason;\n\treadonly message: string;\n\treadonly target?: BashCommandSegment;\n\treadonly matchedRule?: BashCommandRule;\n\treadonly parseError?: BashCommandParseError;\n}\n\nexport type BashCommandPolicyDecision =\n\t| {\n\t\t\treadonly allowed: true;\n\t\t\treadonly mode: BashCommandPolicyMatchMode;\n\t\t\treadonly targets: readonly BashCommandSegment[];\n\t  }\n\t| {\n\t\t\treadonly allowed: false;\n\t\t\treadonly mode: BashCommandPolicyMatchMode;\n\t\t\treadonly targets: readonly BashCommandSegment[];\n\t\t\treadonly rejection: BashCommandPolicyRejection;\n\t  };\n\nexport type CompiledRule =\n\t| { readonly kind: \"exact\"; readonly source: BashCommandRule; readonly value: string }\n\t| { readonly kind: \"prefix\"; readonly source: BashCommandRule; readonly value: string }\n\t| { readonly kind: \"glob\"; readonly source: BashCommandRule; readonly value: RegExp }\n\t| { readonly kind: \"regex\"; readonly source: BashCommandRule; readonly value: RegExp };\n\nexport interface CompiledBashCommandPolicy {\n\treadonly defaultDecision: BashCommandPolicyDefault;\n\treadonly match: BashCommandPolicyMatchMode;\n\treadonly allow: readonly CompiledRule[];\n\treadonly deny: readonly CompiledRule[];\n}\n\nexport type CompileResult =\n\t| { readonly ok: true; readonly policy: CompiledBashCommandPolicy }\n\t| { readonly ok: false; readonly message: string };\n\nexport type CompileRuleResult =\n\t| { readonly ok: true; readonly rule: CompiledRule }\n\t| { readonly ok: false; readonly message: string };\n\nexport type CompileRulesResult =\n\t| { readonly ok: true; readonly rules: readonly CompiledRule[] }\n\t| { readonly ok: false; readonly message: string };\n\nexport type SegmentBuildResult =\n\t| { readonly ok: true; readonly segment?: BashCommandSegment }\n\t| { readonly ok: false; readonly error: BashCommandParseError };\n\nexport type ClosingParenResult =\n\t| { readonly ok: true; readonly closeIndex: number }\n\t| { readonly ok: false; readonly reason: string; readonly offset: number };\n\nexport type ClosingBacktickResult =\n\t| { readonly ok: true; readonly closeIndex: number }\n\t| { readonly ok: false; readonly reason: string; readonly offset: number };\n\nexport type ShellQuoteState = \"none\" | \"single\" | \"double\";\n\nexport interface ShellWordMetadata {\n\treadonly sawSingleQuote: boolean;\n\treadonly sawDoubleQuote: boolean;\n\treadonly sawEscape: boolean;\n\treadonly sawParameterExpansion: boolean;\n\treadonly sawCommandSubstitution: boolean;\n\treadonly sawProcessSubstitution: boolean;\n\treadonly sawBacktick: boolean;\n\treadonly sawGlobPattern: boolean;\n\treadonly sawBraceExpansion: boolean;\n\treadonly sawTildePrefix: boolean;\n}\n\nexport type ShellWordReadResult =\n\t| { readonly ok: true; readonly word: string; readonly end: number; readonly metadata: ShellWordMetadata }\n\t| { readonly ok: false; readonly reason: string; readonly offset: number };\n"]}

package/dist/core/tools/bash-policy.d.ts

@@ -1,62 +1,6 @@
-export type BashCommandRule = string | {
-    readonly prefix: string;
-} | {
-    readonly glob: string;
-} | {
-    readonly regex: string;
-    readonly flags?: string;
-};
-export type BashCommandPolicyDefault = "allow" | "deny";
-export type BashCommandPolicyMatchMode = "whole" | "segments";
-export interface BashCommandPolicy {
-    readonly default?: BashCommandPolicyDefault;
-    readonly allow?: readonly BashCommandRule[];
-    readonly deny?: readonly BashCommandRule[];
-    readonly match?: BashCommandPolicyMatchMode;
-}
-export type BashCommandSegmentSource = "top-level" | "command-substitution" | "process-substitution" | "backtick";
-export interface BashCommandSegment {
-    readonly raw: string;
-    readonly target: string;
-    readonly head: string;
-    readonly start: number;
-    readonly end: number;
-    readonly source: BashCommandSegmentSource;
-}
-export interface BashCommandParseError {
-    readonly reason: string;
-    readonly offset: number;
-    readonly source: BashCommandSegmentSource;
-}
-export type BashCommandParseResult = {
-    readonly ok: true;
-    readonly segments: readonly BashCommandSegment[];
-} | {
-    readonly ok: false;
-    readonly error: BashCommandParseError;
-};
-export type BashCommandPolicyDenialReason = "invalid-policy" | "unsupported-shell-syntax" | "matched-deny" | "default-deny";
-export interface BashCommandPolicyRejection {
-    readonly reason: BashCommandPolicyDenialReason;
-    readonly message: string;
-    readonly target?: BashCommandSegment;
-    readonly matchedRule?: BashCommandRule;
-    readonly parseError?: BashCommandParseError;
-}
-export type BashCommandPolicyDecision = {
-    readonly allowed: true;
-    readonly mode: BashCommandPolicyMatchMode;
-    readonly targets: readonly BashCommandSegment[];
-} | {
-    readonly allowed: false;
-    readonly mode: BashCommandPolicyMatchMode;
-    readonly targets: readonly BashCommandSegment[];
-    readonly rejection: BashCommandPolicyRejection;
-};
-export declare function validateBashCommandPolicy(policy: BashCommandPolicy): void;
-export declare function parseBashCommandSegments(command: string): BashCommandParseResult;
-export declare function evaluateBashCommandPolicy(command: string, policy: BashCommandPolicy | undefined): BashCommandPolicyDecision;
-export declare function formatBashCommandPolicyRejection(decision: Extract<BashCommandPolicyDecision, {
-    readonly allowed: false;
-}>, policyLabel?: string): string;
+export type { BashCommandParseError, BashCommandParseResult, BashCommandPolicy, BashCommandPolicyDecision, BashCommandPolicyDefault, BashCommandPolicyDenialReason, BashCommandPolicyMatchMode, BashCommandPolicyRejection, BashCommandRule, BashCommandSegment, BashCommandSegmentSource, } from "./bash-policy-types.ts";
+export { parseBashCommandSegments } from "./bash-policy-parser.ts";
+export { validateBashCommandPolicy } from "./bash-policy-compile.ts";
+export { evaluateBashCommandPolicy } from "./bash-policy-evaluate.ts";
+export { formatBashCommandPolicyRejection } from "./bash-policy-format.ts";
 //# sourceMappingURL=bash-policy.d.ts.map