@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/guards-evaluator/command-view.js

@@ -0,0 +1,586 @@
+/**
+ * Command-position views of a shell command (BACK-174).
+ *
+ * The rule regexes are written against the flat text of a command and carry
+ * a "bypass prefix" of the form
+ *
+ *   (?:^|[;&|]\s*)(?:\w+=\S*\s+)*?(?:(?:bash|sh|python3|node|…)\b[\s\S]*?)?
+ *
+ * i.e. "at the start of a simple command, possibly after an interpreter".
+ * That prefix is right for shell text and wrong for everything a shell
+ * command can CARRY without executing it: heredoc bodies written to a file,
+ * URL query strings (`&su=` reads as `& su`), quoted data (`echo "a && su"`),
+ * code handed to a non-shell interpreter (`python3 -c "…"`). Two real blocks
+ * came from exactly those (a dict key `'su': subject`, a Gmail compose URL),
+ * and the agent then bypassed the guard with `'s'+'u'` — the worst of both
+ * worlds.
+ *
+ * `buildCommandViews(raw)` turns the raw command into one or more strings the
+ * regex is tested against; a rule matches if it matches ANY view:
+ *
+ *   - the MAIN view — the command with shell structure intact (operators,
+ *     unquoted words, `$(…)`), where
+ *       · a heredoc body is replaced by `<HEREDOC>`,
+ *       · the program handed to a general-purpose interpreter (`python3 -c`,
+ *         `node -e`, `perl -pe`) is replaced by `<CODE>`,
+ *       · URL query strings are replaced by `?<QUERY>` (unless they contain a
+ *         substitution, which runs and stays visible),
+ *       · `; & |` inside a quoted string are neutralised, UNLESS something in
+ *         the same PIPELINE interprets shell (`bash -c`, `eval`, `xargs`,
+ *         `ssh`, `sudo`, `npx -c`, `| bash`, …), the string is the value of a
+ *         code-taking flag (`find -exec`, `git rebase -x`, `--command`), an
+ *         environment assignment (`GIT_SSH_COMMAND="…" git push`), or it
+ *         contains a substitution,
+ *       · agent-harness scratch directories are rewritten to
+ *         `<AGENT_SCRATCH>/` (see `rewriteScratchDirs`),
+ *     then run through the BACK-150 data-argument masking (`-m`/`-F`).
+ *   - one CODE-LINE view per line of a heredoc fed to a shell or interpreter
+ *     anywhere in its pipeline (`bash <<EOF`, `python3 - <<EOF`,
+ *     `cat <<EOF | sh`, `psql <<EOF`) and per line of a general-purpose
+ *     interpreter's `-c` / `-e` program. Each line is tested on its own, so
+ *     `curl … | bash` on a line is still caught while nothing chains the
+ *     interpreter name to a word deep inside its code.
+ *
+ * A heredoc fed to anything else (`cat > file`, `tee`, `git commit -F -`,
+ * `kubectl apply -f -`) is content, exactly like the content of a `Write`
+ * tool call, which the guard never scans either — so it is masked outright.
+ * An UNTERMINATED heredoc is never masked: masking must not widen on
+ * malformed input (BACK-150 invariant).
+ *
+ * Accepted trade-offs, stated so the next reader does not rediscover them:
+ *   - a dangerous word reachable ONLY through the interpreter-chaining of the
+ *     prefix (`python3 -c "os.system('sudo x')"`) is no longer matched. That
+ *     chaining is what produced the false positives, and it never resisted
+ *     `'su'+'do'`. The lasting fix is on the rule-authoring side: drop the
+ *     `[\s\S]*?` chaining from the shared prefix; the `<CODE>` extraction
+ *     here becomes unnecessary the day that lands.
+ *   - the shell-context allowlists below are finite. A wrapper we do not
+ *     know that hands a quoted string to a shell has its `; & |` neutralised.
+ *     Adding a name to SHELL_WRAPPER_RE / CODE_ARG_FLAG_RE is the fix.
+ *
+ * Pure: no I/O. `lex` is total; the one try/catch exists because this runs
+ * inside `evaluate()`, whose catch-all fails CLOSED — a lexer surprise must
+ * degrade to "show the regex everything", never to "deny every tool call".
+ */
+import { delimiter, win32 } from "node:path";
+import { containsSubstitution, stripDataArgs } from "./preprocess.js";
+// ─── Command classes ─────────────────────────────────────────────────────────
+/** Shells — a quoted argument may be shell code, a heredoc body is shell code. */
+const SHELL_RE = /^(?:sh|bash|zsh|dash|ksh|fish|csh|tcsh|ash|busybox|eval|source|\.)$/;
+/**
+ * General-purpose interpreters: their `-c` / `-e` argument is a PROGRAM, not
+ * shell code. It is examined line by line, on its own, instead of inline —
+ * these are exactly the names the rule prefix chains on.
+ */
+const CODE_INTERPRETER_RE = /^(?:python(?:\d+(?:\.\d+)?)?|node|nodejs|deno|bun|ruby|perl|php|lua|Rscript)$/;
+/**
+ * Everything whose heredoc is code of some kind (shells, general-purpose
+ * interpreters, database clients, AppleScript). Their `-c` / `-e` argument is
+ * NOT extracted when they are not in CODE_INTERPRETER_RE: `psql -c "DROP …"`
+ * must stay `psql … DROP` for a rule that names both, and `redis-cli -c` is
+ * cluster mode, not code.
+ */
+const INTERPRETER_RE = /^(?:python(?:\d+(?:\.\d+)?)?|node|nodejs|deno|bun|ruby|perl|php|lua|Rscript|psql|mysql|sqlite3|redis-cli|mongo|mongosh|osascript|expect)$/;
+/**
+ * Flags after which a general-purpose interpreter takes its program as the
+ * next argument: `-c`, `-e`, `--eval`, and the perl/ruby combined switches
+ * (`-pe`, `-ne`, `-lne`). `-p` / `-r` alone are NOT code flags (perl/ruby
+ * loop switch, node preload).
+ */
+const CODE_FLAG_RE = /^(?:-[lnpwa]*[ce]|--eval)$/;
+/**
+ * Commands that hand their arguments to a shell (or to another machine's
+ * shell). A quoted string they receive may execute, so its operators stay
+ * visible.
+ */
+const SHELL_WRAPPER_RE = /^(?:xargs|parallel|ssh|su|sudo|doas|runuser|env|nohup|timeout|watch|time|nice|exec|command|builtin|trap|docker|podman|kubectl|nsenter|chroot|tmux|screen|script|systemd-run|at|batch|npx|bunx|pnpx|npm|pnpm|yarn|make|find|fd|entr|setsid|strace|ltrace|gdb|valgrind|hyperfine)$/;
+/**
+ * Flags whose VALUE is a command line, whatever the command (`find -exec`,
+ * `git rebase -x`, `--command`). `-c` is deliberately absent: it is the code
+ * flag of shells and wrappers, which SHELL_RE / SHELL_WRAPPER_RE already
+ * cover, and a count flag for `grep`.
+ */
+const CODE_ARG_FLAG_RE = /^(?:-x|--exec|-exec|-execdir|--command|--cmd|-cmd|--run|--shell|--onchange|--exec-command)$/;
+/** `NAME=value` at the start of a simple command (also `env NAME=value`). */
+const ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
+function basename(word) {
+    return win32.basename(word);
+}
+/**
+ * A command word the shell resolves only at run time — `$SHELL`, `${SHELL}`,
+ * `$(which bash)`, a backtick substitution. It cannot be classified as a known
+ * non-shell binary, so it is treated as a shell (fail closed): quoted
+ * operators stay visible to the rules instead of being neutralised.
+ * (Review of #2986.)
+ */
+function isUnresolvedCommand(word) {
+    return /[$`]/.test(word);
+}
+function isShell(word) {
+    return SHELL_RE.test(basename(word));
+}
+function isCodeInterpreter(word) {
+    return CODE_INTERPRETER_RE.test(basename(word));
+}
+function isInterpreter(word) {
+    return INTERPRETER_RE.test(basename(word));
+}
+function isShellWrapper(word) {
+    return SHELL_WRAPPER_RE.test(basename(word));
+}
+// ─── Scratch-directory whitelist ─────────────────────────────────────────────
+const SCRATCH_PLACEHOLDER = "<AGENT_SCRATCH>/";
+/** Agents whose harness gives the model a per-session temp workspace. */
+const HARNESS_NAMES = "claude|codex|cursor|windsurf|copilot";
+/**
+ * `/tmp/claude-501/<project>/<session>/scratchpad/` (Linux) and the same
+ * under `/private/tmp` (macOS, where `/tmp` is a symlink). The `<agent>-<x>/`
+ * shape is what distinguishes a harness directory from a plain `/tmp/claude/`
+ * that anyone could create.
+ */
+const POSIX_SCRATCH_RE = new RegExp(`(?:/private)?/tmp/(?:${HARNESS_NAMES})-[^/\\s'"]+/`, "g");
+/** `C:\Users\me\AppData\Local\Temp\claude-501\…\` (any drive, either slash). */
+const WINDOWS_SCRATCH_RE = new RegExp(`[A-Za-z]:[\\\\/](?:[^\\\\/\\s'"]+[\\\\/])*?[Tt]emp[\\\\/](?:${HARNESS_NAMES})-[^\\\\/\\s'"]+[\\\\/]`, "g");
+/**
+ * Extra prefixes from `CYBEDEFEND_SCRATCH_DIRS` (path-delimiter separated,
+ * like `PATH`), normalised once per distinct env value. Lets a team whitelist a
+ * harness we do not know about without waiting for a release.
+ */
+let userScratchCache = null;
+function userScratchPrefixes() {
+    const key = process.env.CYBEDEFEND_SCRATCH_DIRS ?? "";
+    if (userScratchCache && userScratchCache.key === key)
+        return userScratchCache.prefixes;
+    const prefixes = key
+        .split(delimiter)
+        .map((p) => p.trim())
+        .filter((p) => p.length > 0)
+        .map((p) => (p.endsWith("/") || p.endsWith("\\") ? p : p + "/"));
+    userScratchCache = { key, prefixes };
+    return prefixes;
+}
+/**
+ * Rewrite every agent-harness scratch directory in `text` to
+ * `<AGENT_SCRATCH>/`. The rest of the path (file name, extension) is kept so
+ * rules keyed on those still see them; only the "lives under /tmp" signal is
+ * removed — the harness put it there, not a downloaded payload.
+ *
+ * Exported for tests.
+ */
+export function rewriteScratchDirs(text) {
+    let out = text
+        .replace(POSIX_SCRATCH_RE, SCRATCH_PLACEHOLDER)
+        .replace(WINDOWS_SCRATCH_RE, SCRATCH_PLACEHOLDER);
+    for (const prefix of userScratchPrefixes())
+        out = out.split(prefix).join(SCRATCH_PLACEHOLDER);
+    return out;
+}
+// ─── URL query masking ───────────────────────────────────────────────────────
+/**
+ * `https://host/path?a=1&su=2#frag` → `https://host/path?<QUERY>`. Scheme,
+ * host and path stay visible (host rules, `curl evil.example.com` patterns);
+ * only the part where `&key=` legitimately lives is hidden. A query that
+ * carries a substitution (`?d=$(id)`) EXECUTES and is left alone.
+ */
+const URL_QUERY_RE = /([a-z][a-z0-9+.-]*:\/\/[^\s'"<>?#]*)([?#][^\s'"<>]*)/gi;
+function maskUrlQueries(text) {
+    return text.replace(URL_QUERY_RE, (whole, head, tail) => containsSubstitution(tail) ? whole : head + "?<QUERY>");
+}
+// ─── Lexer ───────────────────────────────────────────────────────────────────
+/** Chars a backslash escapes in an unquoted word; elsewhere `\` is literal. */
+const UNQUOTED_ESCAPABLE = new Set([
+    " ",
+    "\t",
+    "\n",
+    '"',
+    "'",
+    "$",
+    "`",
+    "\\",
+    "|",
+    "&",
+    ";",
+    "(",
+    ")",
+    "<",
+    ">",
+    "#",
+]);
+const HEREDOC_DELIM_RE = /^(-?)\s*(?:'([^']*)'|"([^"]*)"|\\?([^\s;&|<>]+))/;
+/** First characters of a control operator — gate before the longest-match scan. */
+const OP_START = new Set(["&", "|", ";", "(", ")"]);
+const OP_LEXEMES = ["&&", "||", "|&", ";;", ";", "|", "&", "(", ")"];
+/**
+ * Quote-, substitution- and heredoc-aware lexer. Produces words with their
+ * quoted/unquoted parts, control operators (`\n` included), and heredocs whose
+ * body has been cut out of the stream (or `body: null` when no terminator
+ * line exists).
+ */
+function lex(raw) {
+    const tokens = [];
+    let parts = [];
+    let buf = "";
+    let quote = "none";
+    // Heredocs opened on the current line, resolved at the next unquoted newline.
+    let pending = [];
+    const flushPart = () => {
+        if (buf.length > 0 || quote !== "none")
+            parts.push({ text: buf, quote });
+        buf = "";
+    };
+    const flushWord = () => {
+        flushPart();
+        if (parts.length > 0)
+            tokens.push({ kind: "word", parts });
+        parts = [];
+    };
+    const pushOp = (text) => {
+        flushWord();
+        tokens.push({ kind: "op", text });
+    };
+    /**
+     * Copy a balanced `$( … )` / `<( … )` / `>( … )` span (or a backquoted one)
+     * verbatim into `buf`. `start` points at the `$`, `<`, `>` or backquote.
+     * Returns the index just past the closer (or the end of input).
+     */
+    const copySubstitution = (start) => {
+        if (raw[start] === "`") {
+            buf += "`";
+            let i = start + 1;
+            while (i < raw.length) {
+                const c = raw[i];
+                buf += c;
+                if (c === "\\" && i + 1 < raw.length) {
+                    buf += raw[i + 1];
+                    i += 2;
+                    continue;
+                }
+                i++;
+                if (c === "`")
+                    return i;
+            }
+            return i;
+        }
+        // Two-char opener `X(`: copy it, then balance parens from depth 1.
+        buf += raw[start] + "(";
+        let depth = 1;
+        let i = start + 2;
+        while (i < raw.length) {
+            const c = raw[i];
+            buf += c;
+            if (c === "\\" && i + 1 < raw.length) {
+                buf += raw[i + 1];
+                i += 2;
+                continue;
+            }
+            i++;
+            if (c === "(")
+                depth++;
+            else if (c === ")") {
+                depth--;
+                if (depth === 0)
+                    return i;
+            }
+        }
+        return i;
+    };
+    /**
+     * Resolve heredocs opened on the line that just ended: consume body lines up
+     * to the terminator. Returns the index to resume lexing at. The remainder of
+     * the terminator line after the delimiter continues as command text — that
+     * un-masks EARLIER than a real shell would, i.e. the scanner sees more.
+     */
+    const readHeredocBodies = (from) => {
+        let i = from;
+        for (const h of pending) {
+            const lines = [];
+            let j = i;
+            let found = -1;
+            while (j <= raw.length) {
+                const nl = raw.indexOf("\n", j);
+                const line = nl === -1 ? raw.slice(j) : raw.slice(j, nl);
+                const candidate = h.strip ? line.replace(/^\t+/, "") : line;
+                const trimmed = candidate.replace(/^\s+/, "");
+                if (trimmed.startsWith(h.delim) &&
+                    (trimmed.length === h.delim.length ||
+                        /\s/.test(trimmed[h.delim.length]))) {
+                    found = j + line.indexOf(trimmed) + h.delim.length;
+                    break;
+                }
+                lines.push(line);
+                if (nl === -1)
+                    break;
+                j = nl + 1;
+            }
+            if (found === -1) {
+                // Unterminated: leave the body in the stream; the opener stays a word.
+                h.token.body = null;
+                break;
+            }
+            h.token.body = lines;
+            i = found;
+        }
+        pending = [];
+        return i;
+    };
+    let i = 0;
+    while (i < raw.length) {
+        const c = raw[i];
+        if (quote === "single") {
+            if (c === "'") {
+                flushPart();
+                quote = "none";
+            }
+            else {
+                buf += c;
+            }
+            i++;
+            continue;
+        }
+        if (quote === "double") {
+            if (c === '"') {
+                flushPart();
+                quote = "none";
+                i++;
+            }
+            else if (c === "\\" &&
+                i + 1 < raw.length &&
+                '"\\$`\n'.includes(raw[i + 1])) {
+                if (raw[i + 1] !== "\n")
+                    buf += raw[i + 1];
+                i += 2;
+            }
+            else if ((c === "$" && raw[i + 1] === "(") || c === "`") {
+                i = copySubstitution(i);
+            }
+            else {
+                buf += c;
+                i++;
+            }
+            continue;
+        }
+        // ── unquoted ──
+        if (c === "'" || c === '"') {
+            flushPart();
+            quote = c === "'" ? "single" : "double";
+            i++;
+            continue;
+        }
+        if (c === "\\") {
+            const next = raw[i + 1];
+            if (next === undefined) {
+                buf += c;
+                i++;
+            }
+            else if (next === "\n") {
+                i += 2; // line continuation
+            }
+            else if (UNQUOTED_ESCAPABLE.has(next)) {
+                buf += next;
+                i += 2;
+            }
+            else {
+                buf += c; // a Windows path separator, `\d` in a regex arg, …
+                i++;
+            }
+            continue;
+        }
+        if ((c === "$" || c === "<" || c === ">") && raw[i + 1] === "(") {
+            i = copySubstitution(i);
+            continue;
+        }
+        if (c === "`") {
+            i = copySubstitution(i);
+            continue;
+        }
+        if (c === " " || c === "\t" || c === "\r") {
+            flushWord();
+            i++;
+            continue;
+        }
+        if (c === "\n") {
+            pushOp("\n");
+            i++;
+            if (pending.length > 0)
+                i = readHeredocBodies(i);
+            continue;
+        }
+        if (c === "<" && raw[i + 1] === "<") {
+            if (raw[i + 2] === "<") {
+                buf += "<<<"; // here-string: a word, not a heredoc opener
+                i += 3;
+                continue;
+            }
+            const m = HEREDOC_DELIM_RE.exec(raw.slice(i + 2));
+            if (m) {
+                flushWord();
+                const delim = m[2] ?? m[3] ?? m[4] ?? "";
+                const open = raw.slice(i, i + 2 + m[0].length);
+                const token = {
+                    kind: "heredoc",
+                    open,
+                    body: null,
+                };
+                tokens.push(token);
+                pending.push({ token, delim, strip: m[1] === "-" });
+                i += 2 + m[0].length;
+                continue;
+            }
+        }
+        if (c === "&" && raw[i + 1] === ">") {
+            buf += "&>";
+            i += 2;
+            continue;
+        }
+        if (OP_START.has(c)) {
+            const op = OP_LEXEMES.find((o) => raw.startsWith(o, i));
+            if (op) {
+                pushOp(op);
+                i += op.length;
+                continue;
+            }
+        }
+        buf += c;
+        i++;
+    }
+    flushWord();
+    if (pending.length > 0)
+        readHeredocBodies(raw.length);
+    return tokens;
+}
+// ─── Views ───────────────────────────────────────────────────────────────────
+function plainText(parts) {
+    return parts.map((p) => p.text).join("");
+}
+/** First non-assignment word of every simple command in a pipeline. */
+function commandWords(pipeline) {
+    const out = [];
+    let expectCommand = true;
+    for (const t of pipeline) {
+        if (t.kind === "op") {
+            expectCommand = true;
+            continue;
+        }
+        if (t.kind !== "word" || !expectCommand)
+            continue;
+        const text = plainText(t.parts);
+        if (ASSIGNMENT_RE.test(text))
+            continue;
+        out.push(text);
+        expectCommand = false;
+    }
+    return out;
+}
+function codeLines(text) {
+    return text
+        .split("\n")
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0);
+}
+/**
+ * Build the views described in the module header. `raw` is the command
+ * exactly as the agent typed it — quotes intact.
+ */
+export function buildCommandViews(raw) {
+    if (!raw)
+        return [""];
+    // Both rewrites are quote-agnostic, so they run on the raw text: a URL is
+    // a URL whether or not the agent quoted it (an unquoted `?a=1&b=2` would
+    // otherwise lex its `&` as a control operator before the query is hidden).
+    const pre = maskUrlQueries(rewriteScratchDirs(raw));
+    let tokens;
+    try {
+        tokens = lex(pre);
+    }
+    catch {
+        return [pre];
+    }
+    // Split into pipelines: simple commands joined by `|` / `|&` stay together.
+    // Context is a property of the PIPELINE, not of the command that receives
+    // the quotes — `echo "x; su -" | bash` is data for echo and code for bash.
+    const pipelines = [[]];
+    for (const t of tokens) {
+        if (t.kind === "op" && t.text !== "|" && t.text !== "|&") {
+            pipelines.push([t], []);
+        }
+        else {
+            pipelines[pipelines.length - 1].push(t);
+        }
+    }
+    const main = [];
+    const extra = [];
+    for (const pipeline of pipelines) {
+        // The COMMAND word of each simple command in the pipeline (first word
+        // that is not a `NAME=value` assignment) decides the context. Arguments
+        // do not: `grep su` is not `su`, `echo bash` is not `bash`.
+        const commands = commandWords(pipeline);
+        const shellContext = commands.some((w) => isShell(w) || isShellWrapper(w) || isUnresolvedCommand(w));
+        const hasCodeInterpreter = commands.some((w) => isCodeInterpreter(w));
+        const interpreterContext = shellContext || commands.some((w) => isInterpreter(w));
+        let extractNextAsCode = false;
+        let nextIsCodeArg = false;
+        let atCommandStart = true;
+        for (const t of pipeline) {
+            if (t.kind === "op") {
+                // A newline separates commands exactly like `;`, but the rule
+                // prefix only knows `[;&|]`. Emit both: the `;` anchors the next
+                // command, the `\n` keeps `[^\n]`-bounded rules on their line.
+                if (t.text === "\n")
+                    main.push(";", "\n");
+                else
+                    main.push(t.text);
+                extractNextAsCode = false;
+                nextIsCodeArg = false;
+                atCommandStart = true;
+                continue;
+            }
+            if (t.kind === "heredoc") {
+                if (t.body === null) {
+                    main.push(t.open);
+                }
+                else {
+                    main.push("<HEREDOC>");
+                    if (interpreterContext)
+                        extra.push(...codeLines(t.body.join("\n")));
+                }
+                continue;
+            }
+            const text = plainText(t.parts);
+            const unquoted = t.parts.every((p) => p.quote === "none");
+            const isAssignment = atCommandStart && ASSIGNMENT_RE.test(text);
+            if (!isAssignment)
+                atCommandStart = false;
+            if (extractNextAsCode) {
+                extractNextAsCode = false;
+                main.push("<CODE>");
+                extra.push(...codeLines(text));
+                continue;
+            }
+            if (hasCodeInterpreter &&
+                !shellContext &&
+                unquoted &&
+                CODE_FLAG_RE.test(text)) {
+                extractNextAsCode = true;
+                main.push(text);
+                continue;
+            }
+            // A quoted string is data unless something will interpret it as a
+            // command line: the pipeline's shell context, a code-taking flag just
+            // before it, an environment assignment, or a substitution inside it.
+            const keepOperators = shellContext || nextIsCodeArg || isAssignment;
+            nextIsCodeArg = unquoted && CODE_ARG_FLAG_RE.test(text);
+            const rendered = t.parts
+                .map((p) => {
+                if (p.quote === "none" ||
+                    keepOperators ||
+                    containsSubstitution(p.text))
+                    return p.text;
+                return p.text.replace(/[;&|]/g, " ");
+            })
+                .join("");
+            main.push(rendered);
+        }
+    }
+    return [stripDataArgs(main), ...extra];
+}
+//# sourceMappingURL=command-view.js.map

package/dist/guards-evaluator/command-view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-view.js","sourceRoot":"","sources":["../../src/guards-evaluator/command-view.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAgBtE,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,QAAQ,GACZ,qEAAqE,CAAC;AAExE;;;;GAIG;AACH,MAAM,mBAAmB,GACvB,+EAA+E,CAAC;AAElF;;;;;;GAMG;AACH,MAAM,cAAc,GAClB,2IAA2I,CAAC;AAE9I;;;;;GAKG;AACH,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAElD;;;;GAIG;AACH,MAAM,gBAAgB,GACpB,kRAAkR,CAAC;AAErR;;;;;GAKG;AACH,MAAM,gBAAgB,GACpB,6FAA6F,CAAC;AAEhG,6EAA6E;AAC7E,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,gFAAgF;AAEhF,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAE/C,yEAAyE;AACzE,MAAM,aAAa,GAAG,sCAAsC,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,IAAI,MAAM,CACjC,wBAAwB,aAAa,eAAe,EACpD,GAAG,CACJ,CAAC;AAEF,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,IAAI,MAAM,CACnC,+DAA+D,aAAa,yBAAyB,EACrG,GAAG,CACJ,CAAC;AAEF;;;;GAIG;AACH,IAAI,gBAAgB,GAA+C,IAAI,CAAC;AAExE,SAAS,mBAAmB;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC;IACtD,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,GAAG,KAAK,GAAG;QAClD,OAAO,gBAAgB,CAAC,QAAQ,CAAC;IACnC,MAAM,QAAQ,GAAG,GAAG;SACjB,KAAK,CAAC,SAAS,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACnE,gBAAgB,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IACrC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,GAAG,GAAG,IAAI;SACX,OAAO,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;SAC9C,OAAO,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE;QACxC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,YAAY,GAAG,wDAAwD,CAAC;AAE9E,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,OAAO,CACjB,YAAY,EACZ,CAAC,KAAa,EAAE,IAAY,EAAE,IAAY,EAAE,EAAE,CAC5C,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,UAAU,CACzD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,IAAI;IACJ,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;CACJ,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,kDAAkD,CAAC;AAE5E,mFAAmF;AACnF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpD,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAErE;;;;;GAKG;AACH,SAAS,GAAG,CAAC,GAAW;IACtB,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAW,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,GAAc,MAAM,CAAC;IAC9B,8EAA8E;IAC9E,IAAI,OAAO,GAIN,EAAE,CAAC;IAER,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,KAAK,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,GAAG,GAAG,EAAE,CAAC;IACX,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,SAAS,EAAE,CAAC;QACZ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,KAAK,GAAG,EAAE,CAAC;IACb,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAQ,EAAE;QACpC,SAAS,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF;;;;OAIG;IACH,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAU,EAAE;QACjD,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACvB,GAAG,IAAI,GAAG,CAAC;YACX,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;YAClB,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;gBACjB,GAAG,IAAI,CAAC,CAAC;gBACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;oBACrC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBAClB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,CAAC,EAAE,CAAC;gBACJ,IAAI,CAAC,KAAK,GAAG;oBAAE,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,mEAAmE;QACnE,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;QACxB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAClB,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,GAAG,IAAI,CAAC,CAAC;YACT,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;gBACrC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,IAAI,CAAC,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACnB,KAAK,EAAE,CAAC;gBACR,IAAI,KAAK,KAAK,CAAC;oBAAE,OAAO,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAU,EAAE;QACjD,IAAI,CAAC,GAAG,IAAI,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;YACf,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAChC,MAAM,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzD,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC9C,IACE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;oBAC3B,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM;wBAChC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EACrC,CAAC;oBACD,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;oBACnD,MAAM;gBACR,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,IAAI,EAAE,KAAK,CAAC,CAAC;oBAAE,MAAM;gBACrB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACb,CAAC;YACD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,uEAAuE;gBACvE,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR,CAAC;YACD,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;YACrB,CAAC,GAAG,KAAK,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAEjB,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,SAAS,EAAE,CAAC;gBACZ,KAAK,GAAG,MAAM,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,CAAC,CAAC;YACX,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,SAAS,EAAE,CAAC;gBACZ,KAAK,GAAG,MAAM,CAAC;gBACf,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,IACL,CAAC,KAAK,IAAI;gBACV,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;gBAClB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAC9B,CAAC;gBACD,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;oBAAE,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3C,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC1D,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,CAAC,CAAC;gBACT,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QAED,iBAAiB;QACjB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,SAAS,EAAE,CAAC;YACZ,KAAK,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YACxC,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,GAAG,IAAI,CAAC,CAAC;gBACT,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzB,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB;YAC9B,CAAC;iBAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,GAAG,IAAI,IAAI,CAAC;gBACZ,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,CAAC,CAAC,CAAC,mDAAmD;gBAC7D,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAChE,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,SAAS,EAAE,CAAC;YACZ,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,CAAC,EAAE,CAAC;YACJ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACjD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACvB,GAAG,IAAI,KAAK,CAAC,CAAC,4CAA4C;gBAC1D,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,EAAE,CAAC;gBACN,SAAS,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC/C,MAAM,KAAK,GAAwC;oBACjD,IAAI,EAAE,SAAS;oBACf,IAAI;oBACJ,IAAI,EAAE,IAAI;iBACX,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;gBACpD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACrB,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpC,GAAG,IAAI,IAAI,CAAC;YACZ,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACxD,IAAI,EAAE,EAAE,CAAC;gBACP,MAAM,CAAC,EAAE,CAAC,CAAC;gBACX,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;gBACf,SAAS;YACX,CAAC;QACH,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,CAAC,EAAE,CAAC;IACN,CAAC;IACD,SAAS,EAAE,CAAC;IACZ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAEhF,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,uEAAuE;AACvE,SAAS,YAAY,CAAC,QAAiB;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,aAAa,GAAG,IAAI,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACpB,aAAa,GAAG,IAAI,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,aAAa;YAAE,SAAS;QAClD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACvC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAEtB,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,GAAG,GAAG,cAAc,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,SAAS,GAAc,CAAC,EAAE,CAAC,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACzD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,sEAAsE;QACtE,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,CACjE,CAAC;QACF,MAAM,kBAAkB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,kBAAkB,GACtB,YAAY,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAEzD,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,IAAI,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACpB,8DAA8D;gBAC9D,iEAAiE;gBACjE,+DAA+D;gBAC/D,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;oBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;;oBACrC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACvB,iBAAiB,GAAG,KAAK,CAAC;gBAC1B,aAAa,GAAG,KAAK,CAAC;gBACtB,cAAc,GAAG,IAAI,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;oBACpB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBACvB,IAAI,kBAAkB;wBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtE,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;YAC1D,MAAM,YAAY,GAAG,cAAc,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChE,IAAI,CAAC,YAAY;gBAAE,cAAc,GAAG,KAAK,CAAC;YAE1C,IAAI,iBAAiB,EAAE,CAAC;gBACtB,iBAAiB,GAAG,KAAK,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,IACE,kBAAkB;gBAClB,CAAC,YAAY;gBACb,QAAQ;gBACR,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EACvB,CAAC;gBACD,iBAAiB,GAAG,IAAI,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,aAAa,GAAG,YAAY,IAAI,aAAa,IAAI,YAAY,CAAC;YACpE,aAAa,GAAG,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK;iBACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,IACE,CAAC,CAAC,KAAK,KAAK,MAAM;oBAClB,aAAa;oBACb,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC;oBAE5B,OAAO,CAAC,CAAC,IAAI,CAAC;gBAChB,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACvC,CAAC,CAAC;iBACD,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/dist/guards-evaluator/env.js

@@ -0,0 +1,11 @@
+/**
+ * One parser for the boolean environment switches the hook runtime honours
+ * (`CYBEDEFEND_HOOK_DEBUG`, `CYBEDEFEND_GUARDS_STRICT`, …), so every site
+ * accepts the same spellings. Lives in guards-evaluator because it is the
+ * lowest layer: the evaluator must not import from hooks/runtime.
+ */
+export function envFlag(name) {
+    const v = process.env[name];
+    return v === '1' || v === 'true' || v === 'TRUE';
+}
+//# sourceMappingURL=env.js.map

package/dist/guards-evaluator/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/guards-evaluator/env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,CAAC;AACnD,CAAC"}