@cybedefend/vibedefend 1.5.0 → 1.6.0

package/dist/guards-evaluator/evaluate.js

@@ -14,6 +14,8 @@ import { matchAnyGlob, matchAllGlobExcludes, matchGlob } from './glob.js';
 import { compileRegex } from './regex.js';
 import { bucketRules, targetTypeBucket } from './bucketing.js';
 import { stripDataArgs } from './preprocess.js';
+import { buildCommandViews } from './command-view.js';
+import { redactTarget } from './redact.js';
 // -----------------------------------------------------------------------
 // Severity ordering
 // -----------------------------------------------------------------------
@@ -29,35 +31,53 @@ function compareSeverityDesc(a, b) {
 // -----------------------------------------------------------------------
 // Message formatter
 // -----------------------------------------------------------------------
+/**
+ * Longest command {target} echoes back. A heredoc runs to kilobytes, and the
+ * message lands both in a terminal and in the model's context.
+ */
+const COMMAND_TARGET_MAX = 160;
+/**
+ * {target} of a command is the WHOLE command. `target.command` alone is only
+ * its first word — the mapper splits `cd x && cat .env` into `cd` + argv — and
+ * a deny message then accused `cd` of containing credentials (BACK-207).
+ *
+ * The command as the tokenizer left it (quotes are gone), on one line, redacted
+ * like the violation summary, then capped: redacting after the cap would let
+ * the head of a secret cut in half slip through. The cap counts code points so
+ * it never splits an emoji into a lone surrogate.
+ */
+function describeCommand(target) {
+    const oneLine = [target.command, ...target.argv].join(' ').replace(/\s+/g, ' ').trim();
+    const chars = Array.from(redactTarget(oneLine, Number.MAX_SAFE_INTEGER));
+    return chars.length > COMMAND_TARGET_MAX
+        ? chars.slice(0, COMMAND_TARGET_MAX - 1).join('') + '…'
+        : chars.join('');
+}
+function describeTarget(target) {
+    switch (target.type) {
+        case 'file': return target.path;
+        case 'command': return describeCommand(target);
+        case 'env': return target.name;
+        case 'http': return target.url;
+        case 'git': return `git ${target.subcommand}`;
+    }
+}
 /**
  * Format a message template substituting {target} and {rule_name}.
  *
- * {target}    → human-readable description of the target
+ * {target}    → human-readable description of the target (a command: the
+ *               whole command, redacted and capped — see describeCommand)
  * {rule_name} → rule.name if set, else rule.id
+ *
+ * One pass with a function replacer on purpose: a command is arbitrary text. A
+ * string replacement would expand the `$&` / `$'` it contains, and a second
+ * pass would substitute a `{rule_name}` written inside the command. The target
+ * is only described when the template asks for it: no built-in command rule
+ * does, and redacting a kilobyte heredoc for nothing is wasted work.
  */
 export function formatMessage(template, target, rule) {
-    let targetStr;
-    switch (target.type) {
-        case 'file':
-            targetStr = target.path;
-            break;
-        case 'command':
-            targetStr = target.command;
-            break;
-        case 'env':
-            targetStr = target.name;
-            break;
-        case 'http':
-            targetStr = target.url;
-            break;
-        case 'git':
-            targetStr = `git ${target.subcommand}`;
-            break;
-    }
     const ruleName = rule.name ?? rule.id;
-    return template
-        .replace(/\{target\}/g, targetStr)
-        .replace(/\{rule_name\}/g, ruleName);
+    return template.replace(/\{(target|rule_name)\}/g, (_, key) => key === 'target' ? describeTarget(target) : ruleName);
 }
 // -----------------------------------------------------------------------
 // Per-target matchers
@@ -77,25 +97,51 @@ function matchesFile(rule, target, homeDir) {
         return false;
     return true;
 }
-function matchesCommand(rule, target, homeDir) {
+/**
+ * What the command regexes see — computed ONCE per evaluation, not per rule.
+ *
+ * With the raw command available (BACK-174) the evaluator builds
+ * command-position VIEWS: shell structure intact, but heredoc bodies, URL
+ * query strings, quoted data and non-shell interpreter code no longer chain
+ * into the rule's bypass prefix. See command-view.ts.
+ *
+ * Legacy path (no `raw`): reconstruct the command from the argv-tuple and
+ * strip data-bearing arg values (`git commit -m "..."`). CRITICAL: pass the
+ * argv-tuple to stripDataArgs directly (not a joined string) — joining loses
+ * quote boundaries and the preprocessor would only strip the first token of
+ * a message containing spaces.
+ */
+function commandViews(target) {
+    return target.raw !== undefined
+        ? buildCommandViews(target.raw)
+        : [stripDataArgs([target.command, ...target.argv])];
+}
+/**
+ * BACK-207's built-in secret-file rule was hardened server-side against the
+ * `process.env` false positive using the quote-stripped argv representation.
+ * BACK-174 normally replaces that representation with command-position views;
+ * those deliberately remove the interpreter prefix from `python -c` / `node
+ * -e` code, which would make the hardened rule miss a real `open('.env')`.
+ *
+ * Keep the legacy view for this one stable built-in key in addition to the
+ * structured views. The exception is intentionally metadata-driven: applying
+ * it to every command rule would undo BACK-174 and make quoted data look like
+ * executable shell syntax again.
+ */
+function viewsForRule(rule, target, views) {
+    if (rule.builtinKey !== 'fs.read.secrets_via_shell' ||
+        target.raw === undefined) {
+        return views;
+    }
+    const legacy = stripDataArgs([target.command, ...target.argv]);
+    return views.includes(legacy) ? views : [...views, legacy];
+}
+function matchesCommand(rule, target, homeDir, views) {
     const opts = { homeDir };
     const hasRegex = !!rule.commandRegex;
     const hasArgGlobs = rule.commandArgGlobs && rule.commandArgGlobs.length > 0;
     if (!hasRegex && !hasArgGlobs)
         return false;
-    // Reconstruct full command string for regex matching (command + args joined).
-    // Then strip data-bearing arg values (e.g. `git commit -m "..."`, `gh pr
-    // --body "..."`) so the regex doesn't false-positive on user-provided text
-    // that happens to mention a dangerous keyword. See preprocess.ts header for
-    // the full rationale.
-    //
-    // CRITICAL: pass the argv-tuple to stripDataArgs directly (not the joined
-    // string). Naively joining `[cmd, ...argv].join(' ')` LOSES quote boundaries
-    // — a message arg "fix: drop table users" becomes 4 separate tokens, and
-    // the preprocessor only strips the first one. Passing the already-tokenized
-    // argv preserves each argument as one indivisible token regardless of
-    // whether it contains spaces.
-    const fullCommand = stripDataArgs([target.command, ...target.argv]);
     if (hasRegex) {
         // A single malformed rule (e.g. an unsupported `(?i)` inline flag rejected
         // by native RegExp when re2-wasm isn't available) MUST NOT poison the
@@ -104,7 +150,7 @@ function matchesCommand(rule, target, homeDir) {
         // rule as non-matching, and continue. The other rules still enforce.
         try {
             const re = compileRegex(rule.commandRegex);
-            if (!re.test(fullCommand))
+            if (!viewsForRule(rule, target, views).some((v) => re.test(v)))
                 return false;
         }
         catch (e) {
@@ -195,7 +241,7 @@ function matchesGit(rule, target, homeDir) {
         return false;
     return true;
 }
-function ruleMatches(rule, req) {
+function ruleMatches(rule, req, ctx) {
     // toolMatch filter
     if (rule.toolMatch && rule.toolMatch.length > 0) {
         if (!rule.toolMatch.includes(req.tool))
@@ -204,7 +250,7 @@ function ruleMatches(rule, req) {
     const { target, homeDir } = req;
     switch (target.type) {
         case 'file': return matchesFile(rule, target, homeDir);
-        case 'command': return matchesCommand(rule, target, homeDir);
+        case 'command': return matchesCommand(rule, target, homeDir, ctx.commandViews ?? []);
         case 'env': return matchesEnv(rule, target, homeDir);
         case 'http': return matchesHttp(rule, target, homeDir);
         case 'git': return matchesGit(rule, target, homeDir);
@@ -227,10 +273,14 @@ export function evaluate(rules, req) {
         const bucketed = bucketRules(active);
         const bucket = targetTypeBucket(req.target);
         const candidates = bucketed[bucket];
-        // 3. Match each candidate
+        // 3. Match each candidate. The command views are lexed once here, not
+        //    once per rule — this runs on every Bash tool call.
+        const ctx = {
+            commandViews: req.target.type === 'command' ? commandViews(req.target) : null,
+        };
         const matched = [];
         for (const rule of candidates) {
-            if (ruleMatches(rule, req)) {
+            if (ruleMatches(rule, req, ctx)) {
                 matched.push(rule);
             }
         }

package/dist/guards-evaluator/evaluate.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/guards-evaluator/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,0EAA0E;AAC1E,oBAAoB;AACpB,0EAA0E;AAE1E,MAAM,cAAc,GAA6B;IAC/C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAM,CAAC;IACX,MAAM,EAAI,CAAC;IACX,GAAG,EAAO,CAAC;CACZ,CAAC;AAEF,SAAS,mBAAmB,CAAC,CAAO,EAAE,CAAO;IAC3C,OAAO,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED,0EAA0E;AAC1E,oBAAoB;AACpB,0EAA0E;AAE1E;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,MAAc,EACd,IAAU;IAEV,IAAI,SAAiB,CAAC;IACtB,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM;YAAK,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC;YAAC,MAAM;QAC/C,KAAK,SAAS;YAAE,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC;YAAC,MAAM;QAClD,KAAK,KAAK;YAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC;YAAC,MAAM;QAC/C,KAAK,MAAM;YAAK,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC;YAAC,MAAM;QAC9C,KAAK,KAAK;YAAM,SAAS,GAAG,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;YAAC,MAAM;IAChE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;IACtC,OAAO,QAAQ;SACZ,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC;SACjC,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,0EAA0E;AAC1E,sBAAsB;AACtB,0EAA0E;AAE1E,SAAS,WAAW,CAClB,IAAU,EACV,MAAyC,EACzC,OAAe;IAEf,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IACrE,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClF,2EAA2E;IAC3E,4BAA4B;IAC5B,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CACrB,IAAU,EACV,MAA4C,EAC5C,OAAe;IAEf,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAE5E,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAE5C,8EAA8E;IAC9E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,sBAAsB;IACtB,EAAE;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,sEAAsE;IACtE,8BAA8B;IAC9B,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAEpE,IAAI,QAAQ,EAAE,CAAC;QACb,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,YAAsB,CAAC,CAAC;YACrD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,sCAAsC;YACtC,OAAO,CAAC,KAAK,CACX,oCAAoC,IAAI,CAAC,EAAE,4BAA4B,GAAG,EAAE,CAC7E,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,sEAAsE;QACtE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,eAA2B,EAAE,CAAC;YACpD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CACjB,IAAU,EACV,MAAwC,EACxC,OAAe;IAEf,OAAO,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAClB,IAAU,EACV,MAAyC,EACzC,OAAe;IAEf,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;IAEzB,mCAAmC;IACnC,IAAI,QAAgB,CAAC;IACrB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;QACtB,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;QACzC,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC;QACtB,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,0CAA0C;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IACzE,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACtE,CAAC;IAED,qCAAqC;IACrC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/E,kDAAkD;IAClD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3E,CAAC;IAED,2DAA2D;IAC3D,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACtE,CAAC;IAED,0CAA0C;IAC1C,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEhC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CACjB,IAAU,EACV,MAAwC,EACxC,OAAe;IAEf,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;IAEzB,yDAAyD;IACzD,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;IACpE,CAAC;IAED,iEAAiE;IACjE,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5E,CAAC;IAED,iEAAiE;IACjE,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5E,CAAC;IAED,8CAA8C;IAC9C,MAAM,MAAM,GACV,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;QACrD,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;QACvD,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAU,EAAE,GAAiB;IAChD,mBAAmB;IACnB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACvD,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAEhC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,CAAI,OAAO,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1D,KAAK,SAAS,CAAC,CAAC,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7D,KAAK,KAAK,CAAC,CAAK,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,KAAK,MAAM,CAAC,CAAI,OAAO,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1D,KAAK,KAAK,CAAC,CAAK,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,mBAAmB;AACnB,0EAA0E;AAE1E;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa,EAAE,GAAiB;IACvD,IAAI,CAAC;QACH,sBAAsB;QACtB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;QAEvD,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEpC,0BAA0B;QAC1B,MAAM,OAAO,GAAW,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACzF,CAAC;QAED,iCAAiC;QACjC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAElC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAExC,uBAAuB;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;YAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,gDAAgD,CAAC;YACzF,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QACnE,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,gDAAgD,CAAC;YACzF,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QACnE,CAAC;QAED,8EAA8E;QAC9E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACzF,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC;QAC3E,OAAO;YACL,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,EAAE;YAClB,OAAO,EAAE,2BAA2B,OAAO,uCAAuC;YAClF,WAAW,EAAE,UAAU;SACxB,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/guards-evaluator/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,0EAA0E;AAC1E,oBAAoB;AACpB,0EAA0E;AAE1E,MAAM,cAAc,GAA6B;IAC/C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAM,CAAC;IACX,MAAM,EAAI,CAAC;IACX,GAAG,EAAO,CAAC;CACZ,CAAC;AAEF,SAAS,mBAAmB,CAAC,CAAO,EAAE,CAAO;IAC3C,OAAO,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED,0EAA0E;AAC1E,oBAAoB;AACpB,0EAA0E;AAE1E;;;GAGG;AACH,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,MAA4C;IACnE,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACvF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,MAAM,GAAG,kBAAkB;QACtC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,GAAG;QACvD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,CAAI,OAAO,MAAM,CAAC,IAAI,CAAC;QACnC,KAAK,SAAS,CAAC,CAAC,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QAC/C,KAAK,KAAK,CAAC,CAAK,OAAO,MAAM,CAAC,IAAI,CAAC;QACnC,KAAK,MAAM,CAAC,CAAI,OAAO,MAAM,CAAC,GAAG,CAAC;QAClC,KAAK,KAAK,CAAC,CAAK,OAAO,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,MAAc,EACd,IAAU;IAEV,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;IACtC,OAAO,QAAQ,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC,EAAE,GAAW,EAAE,EAAE,CACpE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CACrD,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,sBAAsB;AACtB,0EAA0E;AAE1E,SAAS,WAAW,CAClB,IAAU,EACV,MAAyC,EACzC,OAAe;IAEf,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IACrE,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClF,2EAA2E;IAC3E,4BAA4B;IAC5B,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,YAAY,CAAC,MAA4C;IAChE,OAAO,MAAM,CAAC,GAAG,KAAK,SAAS;QAC7B,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC;QAC/B,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,YAAY,CACnB,IAAU,EACV,MAA4C,EAC5C,KAAe;IAEf,IACE,IAAI,CAAC,UAAU,KAAK,2BAA2B;QAC/C,MAAM,CAAC,GAAG,KAAK,SAAS,EACxB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,cAAc,CACrB,IAAU,EACV,MAA4C,EAC5C,OAAe,EACf,KAAe;IAEf,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAE5E,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAE5C,IAAI,QAAQ,EAAE,CAAC;QACb,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,YAAsB,CAAC,CAAC;YACrD,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC/E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,sCAAsC;YACtC,OAAO,CAAC,KAAK,CACX,oCAAoC,IAAI,CAAC,EAAE,4BAA4B,GAAG,EAAE,CAC7E,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,sEAAsE;QACtE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,eAA2B,EAAE,CAAC;YACpD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CACjB,IAAU,EACV,MAAwC,EACxC,OAAe;IAEf,OAAO,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAClB,IAAU,EACV,MAAyC,EACzC,OAAe;IAEf,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;IAEzB,mCAAmC;IACnC,IAAI,QAAgB,CAAC;IACrB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;QACtB,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;QACzC,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC;QACtB,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,0CAA0C;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IACzE,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACtE,CAAC;IAED,qCAAqC;IACrC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/E,kDAAkD;IAClD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3E,CAAC;IAED,2DAA2D;IAC3D,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACtE,CAAC;IAED,0CAA0C;IAC1C,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEhC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CACjB,IAAU,EACV,MAAwC,EACxC,OAAe;IAEf,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;IAEzB,yDAAyD;IACzD,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;IACpE,CAAC;IAED,iEAAiE;IACjE,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5E,CAAC;IAED,iEAAiE;IACjE,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5E,CAAC;IAED,8CAA8C;IAC9C,MAAM,MAAM,GACV,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;QACrD,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;QACvD,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,SAAS,WAAW,CAAC,IAAU,EAAE,GAAiB,EAAE,GAAgB;IAClE,mBAAmB;IACnB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACvD,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAEhC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,CAAI,OAAO,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1D,KAAK,SAAS,CAAC,CAAC,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACrF,KAAK,KAAK,CAAC,CAAK,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,KAAK,MAAM,CAAC,CAAI,OAAO,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1D,KAAK,KAAK,CAAC,CAAK,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,mBAAmB;AACnB,0EAA0E;AAE1E;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa,EAAE,GAAiB;IACvD,IAAI,CAAC;QACH,sBAAsB;QACtB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;QAEvD,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEpC,sEAAsE;QACtE,wDAAwD;QACxD,MAAM,GAAG,GAAgB;YACvB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;SAC9E,CAAC;QACF,MAAM,OAAO,GAAW,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACzF,CAAC;QAED,iCAAiC;QACjC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAElC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAExC,uBAAuB;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;YAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,gDAAgD,CAAC;YACzF,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QACnE,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,gDAAgD,CAAC;YACzF,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QACnE,CAAC;QAED,8EAA8E;QAC9E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACzF,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC;QAC3E,OAAO;YACL,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,EAAE;YAClB,OAAO,EAAE,2BAA2B,OAAO,uCAAuC;YAClF,WAAW,EAAE,UAAU;SACxB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/guards-evaluator/index.js

@@ -1,9 +1,10 @@
 export * from './types.js';
 export { evaluate, formatMessage } from './evaluate.js';
 export { validateRule } from './validation.js';
-export { redactTarget, hashTarget } from './redact.js';
+export { redactTarget, redactScriptText, hashTarget } from './redact.js';
 export { matchGlob, matchAnyGlob, matchAllGlobExcludes } from './glob.js';
 export { compileRegex, isRegexSafe, isRe2Available, waitForRe2 } from './regex.js';
 export { targetTypeBucket, ruleBuckets, bucketRules } from './bucketing.js';
 export { stripDataArgs } from './preprocess.js';
+export { buildCommandViews, rewriteScratchDirs } from './command-view.js';
 //# sourceMappingURL=index.js.map

package/dist/guards-evaluator/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/guards-evaluator/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/guards-evaluator/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/guards-evaluator/inline-code.js

@@ -0,0 +1,259 @@
+/**
+ * The program text an agent hands to an interpreter on the command line, for
+ * the script judge (guard-check.ts) to read like a script file:
+ *
+ *   - a flag: `python -c`, `node -e/--eval/-p/--print`, `tsx -e`, `bun -e`,
+ *     `ruby -e`, `perl -e` (and clusters such as `-ne`, `-pi -e`), `php -r`,
+ *     `Rscript -e`, `lua -e`, `deno eval`;
+ *   - a heredoc fed to an interpreter that reads its program from stdin
+ *     (`python3 - <<EOF`, `node <<EOF`). A heredoc given to an interpreter that
+ *     also names a script file is that script's input, not code.
+ *
+ * Shell code (`bash -c`, `eval`, a heredoc fed to `sh`) is not returned: it is
+ * a command, which the normalizer de-nests and the rules evaluate. Its text is
+ * read for the interpreter code it runs (`bash -c "python3 -c '…'"`), two
+ * levels deep.
+ *
+ * Pure (no I/O), never throws, at most `MAX_INLINE` pieces per command.
+ */
+import { parse as shellParse } from 'shell-quote';
+const MAX_INLINE = 3;
+const PYTHON = {
+    language: 'python',
+    codeFlags: new Set(['-c']),
+    valueFlags: new Set(['-W', '-X', '-Q']),
+    stopFlags: new Set(['-m']),
+    readsStdin: true,
+};
+const NODE_FLAGS = new Set(['-e', '--eval', '-p', '--print']);
+const NODE_VALUE_FLAGS = new Set(['-r', '--require', '--loader', '--import', '--experimental-loader']);
+const NODE = {
+    language: 'javascript',
+    codeFlags: NODE_FLAGS,
+    codeFlagPrefixes: ['--eval=', '--print='],
+    valueFlags: NODE_VALUE_FLAGS,
+    readsStdin: true,
+};
+const TS_NODE = { ...NODE, language: 'typescript' };
+const SPECS = new Map([
+    ['python', PYTHON],
+    ['python2', PYTHON],
+    ['python3', PYTHON],
+    ['node', NODE],
+    ['nodejs', NODE],
+    ['bun', { ...NODE, readsStdin: false }],
+    ['tsx', TS_NODE],
+    ['ts-node', TS_NODE],
+    ['ruby', { language: 'ruby', codeFlags: new Set(['-e']), valueFlags: new Set(['-r', '-I', '-C']), readsStdin: true }],
+    [
+        'perl',
+        {
+            language: 'perl',
+            codeFlags: new Set(['-e', '-E']),
+            codeCluster: /^-[A-Za-z0-9]*[eE]$/,
+            valueFlags: new Set(['-I']),
+            readsStdin: true,
+        },
+    ],
+    ['php', { language: 'php', codeFlags: new Set(['-r']), valueFlags: new Set(['-c', '-d', '-z']), readsStdin: true }],
+    ['rscript', { language: 'r', codeFlags: new Set(['-e']), valueFlags: new Set(), readsStdin: true }],
+    ['lua', { language: 'lua', codeFlags: new Set(['-e']), valueFlags: new Set(['-l']), readsStdin: true }],
+]);
+/** Wrappers that do not change which program runs. */
+const TRANSPARENT = new Set(['sudo', 'doas', 'nohup', 'command', 'time', 'nice', 'stdbuf', 'setsid', 'exec']);
+const SEGMENT_OPS = new Set([';', '&&', '||', '|', '|&', '&', '(', ')', '\n']);
+/** Same opener as the normalizer's (normalize.ts `HEREDOC_OPEN`). */
+const HEREDOC_OPEN = /<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/;
+function canonical(token) {
+    const noEsc = token.startsWith('\\') ? token.slice(1) : token;
+    return (noEsc.split('/').pop() ?? noEsc).toLowerCase();
+}
+/** Simple-command argv arrays of a command line, `$VAR` kept literal. */
+function segments(text) {
+    let tokens;
+    try {
+        tokens = shellParse(text, (k) => '$' + k);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    let argv = [];
+    for (const tok of tokens) {
+        if (typeof tok === 'object' && tok !== null && 'op' in tok) {
+            if (SEGMENT_OPS.has(tok.op)) {
+                if (argv.length)
+                    out.push(argv);
+                argv = [];
+            }
+            continue;
+        }
+        if (typeof tok === 'string')
+            argv.push(tok);
+        else if (typeof tok === 'object' && tok !== null && 'pattern' in tok)
+            argv.push(tok.pattern);
+    }
+    if (argv.length)
+        out.push(argv);
+    return out;
+}
+/** Drop `VAR=v`, wrappers (`sudo`, `env -i …`) and package launchers. */
+function peel(argv) {
+    let i = 0;
+    while (i < argv.length) {
+        const tok = argv[i];
+        const name = canonical(tok);
+        const sub = argv[i + 1];
+        if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(tok) || TRANSPARENT.has(name)) {
+            i++;
+        }
+        else if (name === 'env') {
+            i++;
+            while (i < argv.length && (argv[i].startsWith('-') || /^[A-Za-z_][A-Za-z0-9_]*=/.test(argv[i]))) {
+                if (argv[i] === '-u' || argv[i] === '--unset')
+                    i++;
+                i++;
+            }
+        }
+        else if (name === 'npx' || name === 'bunx' || name === 'pnpx') {
+            i++;
+            while (i < argv.length && argv[i].startsWith('-'))
+                i++;
+        }
+        else if (((name === 'pnpm' || name === 'yarn') && (sub === 'exec' || sub === 'dlx')) ||
+            ((name === 'uv' || name === 'poetry' || name === 'pipenv') && sub === 'run')) {
+            i += 2;
+            while (i < argv.length && argv[i].startsWith('-'))
+                i++;
+        }
+        else {
+            break;
+        }
+    }
+    return argv.slice(i);
+}
+/** The program text of a flag-passed inline program, or null. */
+function codeOfFlags(exe, args) {
+    if (exe === 'deno') {
+        if (args[0] !== 'eval')
+            return null;
+        const code = args.slice(1).find((a) => !a.startsWith('-'));
+        return code ?? null;
+    }
+    const spec = SPECS.get(exe);
+    if (!spec)
+        return null;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (spec.stopFlags?.has(a))
+            return null;
+        if (spec.codeFlags.has(a))
+            return args[i + 1] ?? null;
+        const prefix = spec.codeFlagPrefixes?.find((p) => a.startsWith(p));
+        if (prefix)
+            return a.slice(prefix.length);
+        if (spec.codeCluster && spec.codeCluster.test(a))
+            return args[i + 1] ?? null;
+        if (spec.valueFlags.has(a)) {
+            i++;
+            continue;
+        }
+        if (a.startsWith('-'))
+            continue;
+        return null; // a script file: what follows are its own arguments
+    }
+    return null;
+}
+/** The interpreter a heredoc opener line feeds, when it reads code from stdin. */
+function stdinInterpreter(opener) {
+    const segs = segments(opener);
+    const last = segs[segs.length - 1];
+    if (!last)
+        return null;
+    const argv = peel(last);
+    if (argv.length === 0)
+        return null;
+    const spec = SPECS.get(canonical(argv[0]));
+    if (!spec || !spec.readsStdin)
+        return null;
+    // Every argument is a flag or `-` (stdin): no script file is named.
+    const namesFile = argv.slice(1).some((a) => a !== '-' && !a.startsWith('-'));
+    return namesFile ? null : spec;
+}
+function push(out, language, code) {
+    if (typeof code !== 'string' || code.trim().length === 0)
+        return;
+    if (out.length >= MAX_INLINE)
+        return;
+    if (out.some((c) => c.language === language && c.code === code))
+        return;
+    out.push({ language, code });
+}
+const SHELLS = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh', 'ash']);
+/** A shell's `-c`, alone or in a cluster (`-lc`, `-xc`). */
+const SHELL_C = /^-[A-Za-z]*c[A-Za-z]*$/;
+/** How deep `bash -c "…"` / `eval "…"` are followed. */
+const MAX_SHELL_DEPTH = 2;
+/** The shell command a `bash -c` / `eval` segment runs, or null. */
+function nestedShellCommand(exe, args) {
+    if (exe === 'eval')
+        return args.length > 0 ? args.join(' ') : null;
+    if (!SHELLS.has(exe))
+        return null;
+    const at = args.findIndex((a) => SHELL_C.test(a));
+    return at >= 0 ? (args[at + 1] ?? null) : null;
+}
+/** The inline programs of a raw Bash command, in order, at most three. */
+export function extractInlineCode(raw) {
+    const out = [];
+    collect(raw, 0, out);
+    return out;
+}
+function collect(raw, depth, out) {
+    try {
+        if (typeof raw !== 'string' || raw.trim().length === 0)
+            return;
+        // Heredocs first: their bodies are removed from what the flag scan reads.
+        const lines = raw.split('\n');
+        const kept = [];
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            const m = HEREDOC_OPEN.exec(line);
+            if (!m) {
+                kept.push(line);
+                continue;
+            }
+            const delim = m[2];
+            kept.push(line.slice(0, m.index) + line.slice(m.index + m[0].length));
+            const body = [];
+            i++;
+            while (i < lines.length && lines[i].trim() !== delim) {
+                body.push(lines[i]);
+                i++;
+            }
+            const spec = stdinInterpreter(line.slice(0, m.index));
+            if (spec)
+                push(out, spec.language, body.join('\n'));
+        }
+        for (const argv of segments(kept.join('\n'))) {
+            const peeled = peel(argv);
+            if (peeled.length === 0)
+                continue;
+            const exe = canonical(peeled[0]);
+            const nested = nestedShellCommand(exe, peeled.slice(1));
+            if (nested !== null) {
+                if (depth < MAX_SHELL_DEPTH)
+                    collect(nested, depth + 1, out);
+                continue;
+            }
+            const language = exe === 'deno' ? 'typescript' : SPECS.get(exe)?.language;
+            if (!language)
+                continue;
+            push(out, language, codeOfFlags(exe, peeled.slice(1)));
+        }
+    }
+    catch {
+        /* never throw: keep what was found */
+    }
+}
+//# sourceMappingURL=inline-code.js.map

package/dist/guards-evaluator/inline-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline-code.js","sourceRoot":"","sources":["../../src/guards-evaluator/inline-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AASlD,MAAM,UAAU,GAAG,CAAC,CAAC;AAkBrB,MAAM,MAAM,GAAe;IACzB,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1B,UAAU,EAAE,IAAI;CACjB,CAAC;AACF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAC,CAAC;AACvG,MAAM,IAAI,GAAe;IACvB,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,UAAU;IACrB,gBAAgB,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;IACzC,UAAU,EAAE,gBAAgB;IAC5B,UAAU,EAAE,IAAI;CACjB,CAAC;AACF,MAAM,OAAO,GAAe,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AAEhE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAqB;IACxC,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,SAAS,EAAE,MAAM,CAAC;IACnB,CAAC,SAAS,EAAE,MAAM,CAAC;IACnB,CAAC,MAAM,EAAE,IAAI,CAAC;IACd,CAAC,QAAQ,EAAE,IAAI,CAAC;IAChB,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC,KAAK,EAAE,OAAO,CAAC;IAChB,CAAC,SAAS,EAAE,OAAO,CAAC;IACpB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACrH;QACE,MAAM;QACN;YACE,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAChC,WAAW,EAAE,qBAAqB;YAClC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3B,UAAU,EAAE,IAAI;SACjB;KACF;IACD,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACnH,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACnG,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;CACxG,CAAC,CAAC;AAEH,sDAAsD;AACtD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9G,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAE/E,qEAAqE;AACrE,MAAM,YAAY,GAAG,0CAA0C,CAAC;AAIhE,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,yEAAyE;AACzE,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAiB,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAa,EAAE,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;YAC3D,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC5B,IAAI,IAAI,CAAC,MAAM;oBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,GAAG,EAAE,CAAC;YACZ,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS,IAAI,GAAG;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,SAAS,IAAI,CAAC,IAAc;IAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;oBAAE,CAAC,EAAE,CAAC;gBACnD,CAAC,EAAE,CAAC;YACN,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAChE,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;QACzD,CAAC;aAAM,IACL,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC;YAC3E,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,EAC5E,CAAC;YACD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,iEAAiE;AACjE,SAAS,WAAW,CAAC,GAAW,EAAE,IAAc;IAC9C,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,MAAM;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;QAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,OAAO,IAAI,CAAC,CAAC,oDAAoD;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC3C,oEAAoE;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,IAAI,CAAC,GAAiB,EAAE,QAAwB,EAAE,IAAmB;IAC5E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjE,IAAI,GAAG,CAAC,MAAM,IAAI,UAAU;QAAE,OAAO;IACrC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO;IACxE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AACpE,4DAA4D;AAC5D,MAAM,OAAO,GAAG,wBAAwB,CAAC;AACzC,wDAAwD;AACxD,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,oEAAoE;AACpE,SAAS,kBAAkB,CAAC,GAAW,EAAE,IAAc;IACrD,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,KAAa,EAAE,GAAiB;IAC5D,IAAI,CAAC;QACH,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE/D,0EAA0E;QAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBACrD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpB,CAAC,EAAE,CAAC;YACN,CAAC;YACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,IAAI,IAAI;gBAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAClC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,IAAI,KAAK,GAAG,eAAe;oBAAE,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC7D,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC;YAC1E,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;AACH,CAAC"}