@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/guards-evaluator/command-analysis.js

@@ -0,0 +1,572 @@
+/**
+ * Action Guards hardening — the integration layer that ties Level 0/1 together.
+ *
+ * The regex evaluator (`evaluate`) matches the RAW command string, so trivial
+ * rewrites slip past it as `allow`: `/bin/rm`, `rm --recursive --force`,
+ * `bash -c "rm -rf ~"`, `eval "…"`, `$( … )`, a heredoc body, `xargs`,
+ * `find -exec`. This module re-runs the SAME, already-reviewed rules against
+ * de-obfuscated forms of the action, and adds a tight local backstop for the
+ * handful of patterns that are dangerous on their face (`triage.ts`).
+ *
+ * Design guarantees:
+ *   - It REUSES the existing rules; it never invents new deny logic beyond the
+ *     curated `triage` dangerous set, and each local block is raised under the
+ *     project's rule for that family (`LOCAL_BLOCK_RULES`), with its action.
+ *   - The local backstop reads commands (executable, flags, operands), never
+ *     the text of a data argument.
+ *   - It NEVER REORDERS tokens and keeps each argument a single token, so the
+ *     data-arg masking in `evaluate`/`preprocess` still fires — a commit message
+ *     `git commit -m "fix rm -rf"` cannot become a false positive.
+ *   - PURE + NEVER THROWS. Disk-backed resolution (globs/symlinks, executed
+ *     scripts) is injected by the caller; absent it, this is a pure function.
+ *
+ * It is consumed by the PreToolUse hook (guard-check.ts) and by the corpus
+ * measurement; keeping the orchestration here means both see the same verdict.
+ */
+import { parse as shellParse } from 'shell-quote';
+import { evaluate } from './evaluate.js';
+import { extractInlineCode } from './inline-code.js';
+import { normalizeCommand } from './normalize.js';
+import { isCatastrophicPathArg, triageCommand } from './triage.js';
+const SEVERITY_RANK = {
+    critical: 4,
+    high: 3,
+    medium: 2,
+    low: 1,
+};
+const VERDICT_RANK = { deny: 3, warn: 2, allow: 1 };
+/** Shell operators that end a simple command segment. */
+const SEGMENT_OPS = new Set([';', '&&', '||', '|', '|&', '&', '(', ')']);
+/** Leading wrappers that don't change what runs; skipped to expose the real exe. */
+const TRANSPARENT_PREFIXES = new Set([
+    'sudo', 'doas', 'nohup', 'command', 'time', 'nice', 'stdbuf', 'setsid', 'env',
+]);
+/** Long→short flag spellings for the destructive commands whose rules key on `-rf`/`-R`. */
+const LONG_TO_SHORT = {
+    rm: { recursive: 'r', force: 'f' },
+    cp: { recursive: 'r', force: 'f' },
+    mv: { force: 'f' },
+    chmod: { recursive: 'R' },
+    chown: { recursive: 'R' },
+};
+const MAX_FORMS = 64;
+function canonicalExecutable(token) {
+    // strip a single leading backslash (`\rm`), take the basename, lower-case.
+    const noEsc = token.startsWith('\\') ? token.slice(1) : token;
+    const base = noEsc.split('/').pop() ?? noEsc;
+    return base.toLowerCase();
+}
+/** Stronger of two decisions: deny > warn > allow; ties broken by severity. */
+function strongest(a, b) {
+    const av = VERDICT_RANK[a.verdict];
+    const bv = VERDICT_RANK[b.verdict];
+    if (bv > av)
+        return mergeMatched(b, a);
+    if (av > bv)
+        return mergeMatched(a, b);
+    // same verdict: keep the higher max severity, union matched ids.
+    const as = a.maxSeverity ? SEVERITY_RANK[a.maxSeverity] : 0;
+    const bs = b.maxSeverity ? SEVERITY_RANK[b.maxSeverity] : 0;
+    return mergeMatched(bs > as ? b : a, bs > as ? a : b);
+}
+function mergeMatched(primary, other) {
+    const ids = [...new Set([...primary.matchedRuleIds, ...other.matchedRuleIds])];
+    return { ...primary, matchedRuleIds: ids };
+}
+/**
+ * Split a raw command line into ordered token segments. Each segment keeps its
+ * tokens in ORIGINAL order (no reordering) so argument masking downstream still
+ * works. `$VAR` is preserved (never substituted to empty). Op objects and the
+ * argv path's bare-string ops both split a segment.
+ */
+function tokenSegments(raw) {
+    let tokens;
+    try {
+        tokens = shellParse(raw, (k) => '$' + k);
+    }
+    catch {
+        return [raw.split(/\s+/).filter(Boolean)];
+    }
+    const segments = [];
+    let current = [];
+    for (const tok of tokens) {
+        if (typeof tok === 'object' && 'op' in tok) {
+            if (current.length)
+                segments.push(current);
+            current = [];
+            continue;
+        }
+        if (typeof tok === 'string') {
+            if (SEGMENT_OPS.has(tok)) {
+                if (current.length)
+                    segments.push(current);
+                current = [];
+                continue;
+            }
+            current.push(tok);
+        }
+        // patterns/comments: ignore for canonical evaluation (the raw form still runs)
+    }
+    if (current.length)
+        segments.push(current);
+    return segments;
+}
+/** Drop leading `VAR=value` assignments and transparent wrappers to expose the real exe. */
+function stripLeading(tokens) {
+    let i = 0;
+    while (i < tokens.length) {
+        const t = tokens[i];
+        if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(t)) {
+            i++;
+            continue;
+        }
+        if (TRANSPARENT_PREFIXES.has(canonicalExecutable(t))) {
+            // `env`/`nice`/… may take their own options; skip a following VAR= or -opt value conservatively.
+            i++;
+            continue;
+        }
+        break;
+    }
+    return tokens.slice(i);
+}
+/**
+ * Canonicalise one segment's tokens: exe basename + long→short flags.
+ *
+ * For a DESTRUCTIVE command (one in LONG_TO_SHORT: rm/cp/mv/chmod/chown) the
+ * flags are COMBINED into one `-rf`-style cluster so the existing rule regexes
+ * (which key on `-rf` / `-R`) match `rm --recursive --force ~` and `rm -r -f ~`
+ * alike. Reordering is safe here because these commands take no free-text data
+ * argument (unlike `git commit -m`), so argument-masking can never be defeated.
+ * For every other command, tokens are rewritten IN PLACE (no reorder, no flag
+ * merge) so `git commit -m "fix rm -rf"` keeps its message as one masked token.
+ */
+function canonicalizeSegment(tokens) {
+    const stripped = stripLeading(tokens);
+    if (stripped.length === 0)
+        return null;
+    const exe = canonicalExecutable(stripped[0]);
+    if (!exe)
+        return null;
+    const flagMap = LONG_TO_SHORT[exe];
+    const rest = stripped.slice(1);
+    if (flagMap) {
+        const letters = new Set();
+        const nonFlags = [];
+        for (const t of rest) {
+            if (t === '--')
+                continue;
+            if (t.startsWith('--')) {
+                const name = t.replace(/^--/, '').split('=')[0];
+                const short = flagMap[name];
+                if (short)
+                    letters.add(short);
+                // an unmapped long flag on a destructive cmd carries no data: drop it
+                continue;
+            }
+            if (/^-[A-Za-z]+$/.test(t)) {
+                for (const ch of t.slice(1))
+                    letters.add(ch);
+                continue;
+            }
+            nonFlags.push(t);
+        }
+        const argv = letters.size ? ['-' + [...letters].join(''), ...nonFlags] : nonFlags;
+        return { command: exe, argv };
+    }
+    const argv = rest.map((t) => t); // in-place, order + quote boundaries preserved
+    return { command: exe, argv };
+}
+function evaluateCommandForm(rules, req, command, argv) {
+    const target = { type: 'command', command, argv, cwd: req.cwd };
+    return evaluate(rules, { ...req, target });
+}
+/** The judge reads at most this many scripts per command. */
+export const MAX_JUDGED_SCRIPTS = 3;
+/**
+ * Third-party code the agent runs through a tool (`node_modules/.bin/jest`,
+ * `.venv/bin/pytest`, a package's `__main__.py`): not the agent's script, so it
+ * is not judged — unless the agent wrote it this session.
+ */
+const THIRD_PARTY_PATH = /\/(node_modules|site-packages|dist-packages|\.tox)\/|\/\.?venv\/(bin|lib)\//;
+function scriptLabel(path, cwd, homeDir) {
+    if (cwd && path.startsWith(cwd.endsWith('/') ? cwd : `${cwd}/`)) {
+        return path.slice(cwd.endsWith('/') ? cwd.length : cwd.length + 1);
+    }
+    if (homeDir && path.startsWith(`${homeDir}/`))
+        return `~/${path.slice(homeDir.length + 1)}`;
+    return path;
+}
+/** Add a script unless the list is full or holds the same text. */
+function addScript(list, script) {
+    if (list.length >= MAX_JUDGED_SCRIPTS)
+        return;
+    if (script.body.trim().length === 0)
+        return;
+    if (list.some((s) => s.language === script.language && s.body === script.body))
+        return;
+    list.push(script);
+}
+function addInline(list, command) {
+    for (const code of extractInlineCode(command)) {
+        addScript(list, { origin: 'inline', language: code.language, label: 'inline', body: code.code, truncated: false });
+    }
+}
+/**
+ * Script hops: a command's script (hop 0 → 1), and a script that script or a
+ * package script runs (hop 1 → 2). A third level is not read.
+ */
+const MAX_SCRIPT_HOPS = 2;
+export function analyzeCommandAction(rules, req, rawCommand, opts = {}) {
+    const forms = [];
+    let decision = evaluate(rules, req); // candidate (a): the raw action, as today
+    // The scripts this command runs, for the script judge. Collecting one never
+    // changes the verdict here.
+    const scripts = [];
+    try {
+        addInline(scripts, rawCommand);
+    }
+    catch {
+        /* never throw */
+    }
+    try {
+        // Candidate set (b): in-place canonical forms of each top-level segment.
+        for (const seg of tokenSegments(rawCommand)) {
+            const canon = canonicalizeSegment(seg);
+            if (!canon)
+                continue;
+            const form = [canon.command, ...canon.argv].join(' ');
+            if (forms.length < MAX_FORMS && !forms.includes(form)) {
+                forms.push(form);
+                decision = strongest(decision, evaluateCommandForm(rules, req, canon.command, canon.argv));
+            }
+        }
+    }
+    catch {
+        /* never throw */
+    }
+    // Candidate set (c): de-nested inner commands (bash -c, eval, $(), heredoc,
+    // xargs, find -exec). normalize recovers them; we evaluate each inner raw the
+    // same way (one more de-obfuscation hop).
+    let normalize;
+    let triage;
+    try {
+        normalize = normalizeCommand(rawCommand);
+        for (const cmd of normalize.commands) {
+            if (cmd.depth === 0)
+                continue; // top-level already covered above
+            for (const seg of tokenSegments(cmd.raw)) {
+                const canon = canonicalizeSegment(seg);
+                if (!canon)
+                    continue;
+                const form = [canon.command, ...canon.argv].join(' ');
+                if (forms.length < MAX_FORMS && !forms.includes(form)) {
+                    forms.push(form);
+                    decision = strongest(decision, evaluateCommandForm(rules, req, canon.command, canon.argv));
+                }
+            }
+        }
+        triage = triageCommand(normalize);
+    }
+    catch {
+        /* never throw */
+    }
+    // Local backstop: a tight, curated "dangerous on its face" set (rm -rf of
+    // ~ / /, decode|shell, chmod 777 broad) that the regex may still miss after
+    // de-obfuscation. These are safe to block locally (see triage.ts).
+    let localBlockReason;
+    if (decision.verdict !== 'allow' && forms.length > 0 && decision.matchedRuleIds.length > 0) {
+        // raw already denied/warned OR a de-obfuscated form did
+        localBlockReason = decision.verdict === 'deny' ? 'regex-deobfuscated' : localBlockReason;
+    }
+    // A local block is raised under the project's rule for that family
+    // (LOCAL_BLOCK_RULES) and takes its effective action: it is recorded like any
+    // violation, the judge may overturn it, and a project that set the rule to
+    // `warn` or `off` is obeyed.
+    const supplementReason = supplementDangerous(normalize, rawCommand);
+    const localReasons = [
+        ...(supplementReason ? [supplementReason] : []),
+        ...(triage?.class === 'dangerous' ? triage.reasons : []),
+    ];
+    for (const reason of localReasons) {
+        const local = localBlockDecision(rules, reason);
+        if (!local)
+            continue;
+        if (local.verdict === 'deny' && decision.verdict !== 'deny')
+            localBlockReason = 'triage-dangerous';
+        decision = strongest(decision, local);
+    }
+    if (decision.verdict === 'deny' && !localBlockReason && forms.length > 0) {
+        localBlockReason = 'regex-deobfuscated';
+    }
+    // Level 1 — executed scripts. When the command runs a local file the agent
+    // can control (`bash x.sh`, `./x`, `npm run …`), read it and fold the verdict
+    // of its inner commands in. A script the agent WROTE this session that runs
+    // something dangerous is the write-then-run blind spot; a script that is only
+    // suspicious escalates the judge route rather than hard-blocking (FP-averse).
+    const hop = opts._scriptHop ?? 0;
+    let scriptEscalation = 'none';
+    if (opts.resolveScript && hop < MAX_SCRIPT_HOPS) {
+        try {
+            const script = opts.resolveScript(rawCommand);
+            if (script) {
+                const writtenHere = script.path ? opts.wasWrittenThisSession?.(script.path) ?? false : false;
+                const language = script.language ?? (script.kind === 'shell' ? 'shell' : undefined);
+                if (script.kind !== 'npm-script' &&
+                    script.path &&
+                    language &&
+                    typeof script.content === 'string' &&
+                    (writtenHere || !THIRD_PARTY_PATH.test(script.path))) {
+                    addScript(scripts, {
+                        origin: 'file',
+                        language,
+                        label: scriptLabel(script.path, req.cwd, req.homeDir),
+                        body: script.content,
+                        truncated: script.truncated ?? false,
+                    });
+                }
+                for (const inner of script.shellCommands.slice(0, MAX_FORMS)) {
+                    const innerReq = {
+                        ...req,
+                        target: { type: 'command', command: inner.split(/\s+/)[0] ?? '', argv: [], cwd: req.cwd },
+                    };
+                    const innerAnalysis = analyzeCommandAction(rules, innerReq, inner, {
+                        ...opts,
+                        _scriptHop: hop + 1,
+                    });
+                    decision = strongest(decision, innerAnalysis.decision);
+                    if (innerAnalysis.routeHint === 'catch')
+                        scriptEscalation = 'catch';
+                    forms.push(`script:${inner}`);
+                    // A file the script runs is judged too. Inline code on a line of a
+                    // shell file is already in that file's text; a package script's
+                    // body is not judged as a file, so its inline code is.
+                    for (const s of innerAnalysis.scripts) {
+                        if (s.origin === 'file' || script.kind === 'npm-script')
+                            addScript(scripts, s);
+                    }
+                }
+                // An interpreter body (python/node) is not parsed as shell; a script the
+                // agent wrote and now executes is worth the judge even if its body reads clean.
+                if (script.kind === 'interpreter' || writtenHere)
+                    scriptEscalation = 'catch';
+                if (writtenHere && decision.verdict === 'allow') {
+                    // record the signal for the route; do not hard-block on "written here" alone.
+                    scriptEscalation = 'catch';
+                }
+            }
+        }
+        catch {
+            /* never throw */
+        }
+    }
+    let routeHint = decideRouteHint(decision, triage, normalize);
+    if (routeHint === 'none' && scriptEscalation === 'catch')
+        routeHint = 'catch';
+    return { decision, normalize, triage, localBlockReason, routeHint, evaluatedForms: forms, scripts };
+}
+/**
+ * A curated, LOW-false-positive local-deny supplement for dangerous families
+ * the built-in regex corpus does not yet cover after de-obfuscation. Each
+ * pattern is unambiguous enough to block locally (no cloud judge); anything
+ * fuzzier (inline-interpreter destructive calls, etc.) is left to the judge via
+ * the `catch` route instead, to keep false positives at zero.
+ *
+ * Returns a stable reason slug, or null when nothing fires.
+ */
+const SECRET_PATH_RE = /(^|[\/@])(\.env(\.[\w.-]+)?|\.npmrc|\.netrc|id_rsa|id_ed25519|id_ecdsa|\.pem|\.p12|\.pfx|credentials|\.aws\/|\.ssh\/|\.kube\/config|\.docker\/config)(?![\w.-]*\.example)/i;
+const METADATA_HOST_RE = /\b(169\.254\.169\.254|169\.254\.170\.2|metadata\.google\.internal|100\.100\.100\.200)\b/;
+/**
+ * The project rule each local block belongs to (by `builtinKey`). The block
+ * takes that rule's effective action; with no such rule, or the rule `off`,
+ * there is no local block.
+ */
+const LOCAL_BLOCK_RULES = {
+    'reverse-shell-devtcp': 'shell.net.netcat',
+    'reverse-shell-socat': 'shell.net.netcat',
+    'privilege-escalation': 'shell.priv.sudo',
+    'find-destructive-root-home': 'fs.delete.root_or_home',
+    'chmod-777-recursive-broad': 'shell.priv.chmod_777',
+    'secret-exfiltration-http': 'fs.read.secrets_via_shell',
+    'cloud-metadata-fetch': 'net.http.cloud_metadata',
+    'git-force-push': 'git.push.force_other',
+    'git-delete-ref': 'git.history.rewrite',
+    // triage.ts `dangerous` reasons
+    'rm-rf-root-home': 'fs.delete.root_or_home',
+    'chmod-777-broad': 'shell.priv.chmod_777',
+    'encoded-pipe-to-shell': 'shell.exec.dynamic_eval',
+};
+function localBlockDecision(rules, reason) {
+    const key = LOCAL_BLOCK_RULES[reason];
+    const rule = key ? rules.find((r) => (r.builtinKey ?? r.id) === key) : undefined;
+    if (!rule || (rule.action !== 'deny' && rule.action !== 'warn'))
+        return null;
+    return {
+        verdict: rule.action,
+        matchedRuleIds: [rule.id],
+        message: `${rule.action === 'deny' ? 'Blocked' : 'Flagged'} (${rule.name ?? rule.id}): this command ` +
+            `matches a dangerous pattern (${reason}) even after removing obfuscation. ` +
+            `Confirm intent before re-running.`,
+        maxSeverity: rule.severity,
+    };
+}
+/** Names whose presence next to a `/dev/tcp/…` target makes a reverse shell. */
+const REVERSE_SHELL_EXES = new Set(['bash', 'sh', 'zsh', 'ksh', 'dash', 'nc', 'ncat', 'exec', 'eval']);
+const PRIVILEGE_WRAPPERS = new Set(['doas', 'pkexec']);
+const UPLOAD_FLAGS = new Set(['-d', '--data', '--data-binary', '-T', '--upload-file']);
+/**
+ * Segments of the raw line, split on command separators only: a redirect
+ * target (`>& /dev/tcp/…`) stays in its command's segment, and a quoted
+ * argument stays ONE token, so a message or a pattern is never read as a command.
+ */
+function segmentsWithRedirects(raw) {
+    const segments = [];
+    for (const line of raw.split('\n')) {
+        let tokens;
+        try {
+            tokens = shellParse(line, (k) => '$' + k);
+        }
+        catch {
+            continue;
+        }
+        let current = [];
+        for (const tok of tokens) {
+            if (typeof tok === 'string') {
+                current.push(tok);
+            }
+            else if ('op' in tok && SEGMENT_OPS.has(tok.op)) {
+                if (current.length)
+                    segments.push(current);
+                current = [];
+            }
+            else if ('pattern' in tok) {
+                current.push(tok.pattern);
+            }
+        }
+        if (current.length)
+            segments.push(current);
+    }
+    return segments;
+}
+/** The command runs under `doas` / `pkexec` (leading assignments and wrappers skipped). */
+function runsUnder(tokens, wrappers) {
+    for (const t of tokens) {
+        if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(t) || t.startsWith('-'))
+            continue;
+        const exe = canonicalExecutable(t);
+        if (wrappers.has(exe))
+            return true;
+        if (!TRANSPARENT_PREFIXES.has(exe))
+            return false;
+    }
+    return false;
+}
+/** The git subcommand and what follows it (`-C <dir>` / `-c <k=v>` skipped). */
+function gitSubcommand(args) {
+    for (let i = 0; i < args.length; i++) {
+        const t = args[i];
+        if (t === '-C' || t === '-c') {
+            i++;
+            continue;
+        }
+        if (t.startsWith('-'))
+            continue;
+        return { sub: t, rest: args.slice(i + 1) };
+    }
+    return null;
+}
+/** `-f`, a short cluster holding `f`, `--force` or a `+refspec`; never `--force-with-lease`. */
+function isForcePushToken(t) {
+    return /^-[A-Za-z]*f[A-Za-z]*$/.test(t) || t === '--force' || /^\+\S/.test(t);
+}
+/** The operands curl/wget uploads (`-d @f`, `--data=@f`, `-d@f`, `-T f`). */
+function uploadOperands(args) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const t = args[i];
+        if (UPLOAD_FLAGS.has(t)) {
+            if (i + 1 < args.length)
+                out.push(args[i + 1]);
+            continue;
+        }
+        const m = /^(?:--data|--data-binary|--upload-file)=(.+)$/.exec(t) ?? /^-[dT](.+)$/.exec(t);
+        if (m)
+            out.push(m[1]);
+    }
+    return out;
+}
+/** One effective command, read by its executable, flags and operands. */
+function commandDanger(cmd) {
+    const tokens = cmd.raw.split(/\s+/).filter(Boolean);
+    if (runsUnder(tokens, PRIVILEGE_WRAPPERS))
+        return 'privilege-escalation';
+    const at = tokens.findIndex((t) => canonicalExecutable(t) === cmd.executable);
+    const after = at >= 0 ? tokens.slice(at + 1) : [];
+    switch (cmd.executable) {
+        case 'find': {
+            const roots = [];
+            for (const t of after) {
+                if (t === '-H' || t === '-L' || t === '-P')
+                    continue;
+                if (t.startsWith('-') || t === '(' || t === '!')
+                    break;
+                roots.push(t);
+            }
+            const exec = after.findIndex((t) => ['-exec', '-execdir', '-ok', '-okdir'].includes(t));
+            const removes = after.includes('-delete') ||
+                (exec >= 0 && after.slice(exec + 1).some((t) => /^(rm|unlink|shred)$/.test(canonicalExecutable(t))));
+            return removes && roots.some(isCatastrophicPathArg) ? 'find-destructive-root-home' : null;
+        }
+        case 'chmod': {
+            const recursive = cmd.flagLetters.has('R') || cmd.longFlags.includes('recursive');
+            const mode777 = cmd.args.some((a) => /^0*777$/.test(a) || /^a[+=]rwx$/.test(a));
+            const broad = cmd.args.some((a) => /^[/~]/.test(a));
+            return recursive && mode777 && broad ? 'chmod-777-recursive-broad' : null;
+        }
+        case 'curl':
+        case 'wget':
+            if (uploadOperands(after).some((o) => SECRET_PATH_RE.test(o)))
+                return 'secret-exfiltration-http';
+            return cmd.args.some((a) => METADATA_HOST_RE.test(a)) ? 'cloud-metadata-fetch' : null;
+        case 'git': {
+            const git = gitSubcommand(after);
+            if (git?.sub === 'push' && git.rest.some(isForcePushToken))
+                return 'git-force-push';
+            if (git?.sub === 'update-ref' && git.rest.includes('-d'))
+                return 'git-delete-ref';
+            return null;
+        }
+        default:
+            return null;
+    }
+}
+export function supplementDangerous(normalize, rawCommand) {
+    // Reverse shells live in redirect targets and socat addresses, which do not
+    // survive into a parsed command: read them on the raw line's segments.
+    for (const seg of segmentsWithRedirects(rawCommand)) {
+        const names = seg.map(canonicalExecutable);
+        if (seg.some((t) => /\/dev\/(tcp|udp)\//.test(t)) && names.some((n) => REVERSE_SHELL_EXES.has(n))) {
+            return 'reverse-shell-devtcp';
+        }
+        if (names.includes('socat') && seg.some((t) => /\b(EXEC|SYSTEM):/i.test(t)))
+            return 'reverse-shell-socat';
+    }
+    // Everything else, on each effective command the normalizer recovered
+    // (nested `bash -c`, `eval`, `$( … )`, heredocs included).
+    for (const cmd of normalize?.commands ?? []) {
+        const reason = commandDanger(cmd);
+        if (reason)
+            return reason;
+    }
+    return null;
+}
+/** Advisory judge route (the hook turns this into a real call via judge-triage). */
+function decideRouteHint(decision, triage, normalize) {
+    if (decision.verdict === 'deny')
+        return 'confirm';
+    if (triage && triage.class !== 'safe')
+        return 'catch';
+    if (normalize?.incomplete)
+        return 'catch';
+    return 'none';
+}
+//# sourceMappingURL=command-analysis.js.map

package/dist/guards-evaluator/command-analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-analysis.js","sourceRoot":"","sources":["../../src/guards-evaluator/command-analysis.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAoCnE,MAAM,aAAa,GAA6B;IAC9C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;CACP,CAAC;AACF,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAW,CAAC;AAE7D,yDAAyD;AACzD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACzE,oFAAoF;AACpF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK;CAC9E,CAAC,CAAC;AACH,4FAA4F;AAC5F,MAAM,aAAa,GAA2C;IAC5D,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;IAClC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;IAClC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;IAClB,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;IACzB,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;CAC1B,CAAC;AAEF,MAAM,SAAS,GAAG,EAAE,CAAC;AAIrB,SAAS,mBAAmB,CAAC,KAAa;IACxC,2EAA2E;IAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC;IAC7C,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED,+EAA+E;AAC/E,SAAS,SAAS,CAAC,CAAW,EAAE,CAAW;IACzC,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,EAAE,GAAG,EAAE;QAAE,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,IAAI,EAAE,GAAG,EAAE;QAAE,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,iEAAiE;IACjE,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,OAAiB,EAAE,KAAe;IACtD,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAiB,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,OAAO,GAAG,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,IAAI,OAAO,CAAC,MAAM;oBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3C,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QACD,+EAA+E;IACjF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4FAA4F;AAC5F,SAAS,YAAY,CAAC,MAAgB;IACpC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC1D,IAAI,oBAAoB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,iGAAiG;YACjG,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,MAAM;IACR,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAAC,MAAgB;IAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE/B,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS;YACzB,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC5B,IAAI,KAAK;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC9B,sEAAsE;gBACtE,SAAS;YACX,CAAC;YACD,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClF,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,+CAA+C;IAChF,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAa,EACb,GAAiB,EACjB,OAAe,EACf,IAAc;IAEd,MAAM,MAAM,GAAW,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IACxE,OAAO,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;AAC7C,CAAC;AAoBD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,6EAA6E,CAAC;AAEvG,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW,EAAE,OAAe;IAC7D,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC;QAAE,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mEAAmE;AACnE,SAAS,SAAS,CAAC,IAAoB,EAAE,MAAoB;IAC3D,IAAI,IAAI,CAAC,MAAM,IAAI,kBAAkB;QAAE,OAAO;IAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC5C,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO;IACvF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,SAAS,CAAC,IAAoB,EAAE,OAAe;IACtD,KAAK,MAAM,IAAI,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACrH,CAAC;AACH,CAAC;AAYD;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,GAAiB,EACjB,UAAkB,EAClB,OAAoB,EAAE;IAEtB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,0CAA0C;IAC/E,4EAA4E;IAC5E,4BAA4B;IAC5B,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IAED,IAAI,CAAC;QACH,yEAAyE;QACzE,KAAK,MAAM,GAAG,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtD,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,QAAQ,GAAG,SAAS,CAAC,QAAQ,EAAE,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,0CAA0C;IAC1C,IAAI,SAAsC,CAAC;IAC3C,IAAI,MAAiC,CAAC;IACtC,IAAI,CAAC;QACH,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC;gBAAE,SAAS,CAAC,kCAAkC;YACjE,KAAK,MAAM,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;gBACvC,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACrB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtD,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACjB,QAAQ,GAAG,SAAS,CAAC,QAAQ,EAAE,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC7F,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,mEAAmE;IACnE,IAAI,gBAAoD,CAAC;IACzD,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3F,wDAAwD;QACxD,gBAAgB,GAAG,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAC3F,CAAC;IACD,mEAAmE;IACnE,8EAA8E;IAC9E,2EAA2E;IAC3E,6BAA6B;IAC7B,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG;QACnB,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,EAAE,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM;YAAE,gBAAgB,GAAG,kBAAkB,CAAC;QACnG,QAAQ,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzE,gBAAgB,GAAG,oBAAoB,CAAC;IAC1C,CAAC;IAED,2EAA2E;IAC3E,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;IACjC,IAAI,gBAAgB,GAAqB,MAAM,CAAC;IAChD,IAAI,IAAI,CAAC,aAAa,IAAI,GAAG,GAAG,eAAe,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC7F,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACpF,IACE,MAAM,CAAC,IAAI,KAAK,YAAY;oBAC5B,MAAM,CAAC,IAAI;oBACX,QAAQ;oBACR,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;oBAClC,CAAC,WAAW,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EACpD,CAAC;oBACD,SAAS,CAAC,OAAO,EAAE;wBACjB,MAAM,EAAE,MAAM;wBACd,QAAQ;wBACR,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;wBACrD,IAAI,EAAE,MAAM,CAAC,OAAO;wBACpB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK;qBACrC,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;oBAC7D,MAAM,QAAQ,GAAiB;wBAC7B,GAAG,GAAG;wBACN,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE;qBAC1F,CAAC;oBACF,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;wBACjE,GAAG,IAAI;wBACP,UAAU,EAAE,GAAG,GAAG,CAAC;qBACpB,CAAC,CAAC;oBACH,QAAQ,GAAG,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;oBACvD,IAAI,aAAa,CAAC,SAAS,KAAK,OAAO;wBAAE,gBAAgB,GAAG,OAAO,CAAC;oBACpE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;oBAC9B,mEAAmE;oBACnE,gEAAgE;oBAChE,uDAAuD;oBACvD,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;wBACtC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;4BAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBACjF,CAAC;gBACH,CAAC;gBACD,yEAAyE;gBACzE,gFAAgF;gBAChF,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,WAAW;oBAAE,gBAAgB,GAAG,OAAO,CAAC;gBAC7E,IAAI,WAAW,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;oBAChD,8EAA8E;oBAC9E,gBAAgB,GAAG,OAAO,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,IAAI,SAAS,GAAG,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7D,IAAI,SAAS,KAAK,MAAM,IAAI,gBAAgB,KAAK,OAAO;QAAE,SAAS,GAAG,OAAO,CAAC;IAC9E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,cAAc,GAClB,4KAA4K,CAAC;AAC/K,MAAM,gBAAgB,GAAG,yFAAyF,CAAC;AAEnH;;;;GAIG;AACH,MAAM,iBAAiB,GAA2B;IAChD,sBAAsB,EAAE,kBAAkB;IAC1C,qBAAqB,EAAE,kBAAkB;IACzC,sBAAsB,EAAE,iBAAiB;IACzC,4BAA4B,EAAE,wBAAwB;IACtD,2BAA2B,EAAE,sBAAsB;IACnD,0BAA0B,EAAE,2BAA2B;IACvD,sBAAsB,EAAE,yBAAyB;IACjD,gBAAgB,EAAE,sBAAsB;IACxC,gBAAgB,EAAE,qBAAqB;IACvC,gCAAgC;IAChC,iBAAiB,EAAE,wBAAwB;IAC3C,iBAAiB,EAAE,sBAAsB;IACzC,uBAAuB,EAAE,yBAAyB;CACnD,CAAC;AAEF,SAAS,kBAAkB,CAAC,KAAa,EAAE,MAAc;IACvD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,MAAM;QACpB,cAAc,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EACL,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,kBAAkB;YAC5F,gCAAgC,MAAM,qCAAqC;YAC3E,mCAAmC;QACrC,WAAW,EAAE,IAAI,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACvG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;AAEvF;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAiB,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;iBAAM,IAAI,IAAI,IAAI,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClD,IAAI,OAAO,CAAC,MAAM;oBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3C,OAAO,GAAG,EAAE,CAAC;YACf,CAAC;iBAAM,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,MAAgB,EAAE,QAAqB;IACxD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACtE,MAAM,GAAG,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,SAAS,aAAa,CAAC,IAAc;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7B,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gGAAgG;AAChG,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,6EAA6E;AAC7E,SAAS,cAAc,CAAC,IAAc;IACpC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,+CAA+C,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,SAAS,aAAa,CAAC,GAAqB;IAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,SAAS,CAAC,MAAM,EAAE,kBAAkB,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACzE,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,QAAQ,GAAG,CAAC,UAAU,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;oBAAE,SAAS;gBACrD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;oBAAE,MAAM;gBACvD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACxF,MAAM,OAAO,GACX,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACzB,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvG,OAAO,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAClF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO,SAAS,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,CAAC;QACD,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM;YACT,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,0BAA0B,CAAC;YACjG,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC;QACxF,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,GAAG,EAAE,GAAG,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBAAE,OAAO,gBAAgB,CAAC;YACpF,IAAI,GAAG,EAAE,GAAG,KAAK,YAAY,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,gBAAgB,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,SAAsC,EACtC,UAAkB;IAElB,4EAA4E;IAC5E,uEAAuE;IACvE,KAAK,MAAM,GAAG,IAAI,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClG,OAAO,sBAAsB,CAAC;QAChC,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,qBAAqB,CAAC;IAC5G,CAAC;IACD,sEAAsE;IACtE,2DAA2D;IAC3D,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,SAAS,eAAe,CACtB,QAAkB,EAClB,MAAiC,EACjC,SAAsC;IAEtC,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAClD,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACtD,IAAI,SAAS,EAAE,UAAU;QAAE,OAAO,OAAO,CAAC;IAC1C,OAAO,MAAM,CAAC;AAChB,CAAC"}