@inhuman.tools/policy 0.0.0-stage → 0.1.0

package/dist/glob-expand.js

@@ -0,0 +1,132 @@
+/**
+ * Lexical brace expansion (`.e{nv,x}`, `a{1..3}`, `{a,b}{c,d}`), the way bash does it before
+ * globbing. Used to judge a shell word as every word it could become. Bounded: past `limit`
+ * words the caller falls back to a wildcard superset.
+ */
+const DEFAULT_LIMIT = 256;
+export function expandBraces(word, limit = DEFAULT_LIMIT) {
+    const done = [];
+    const work = [word];
+    while (work.length > 0) {
+        const next = work.pop();
+        const group = firstGroup(next);
+        if (group === undefined) {
+            done.push(next);
+        }
+        else {
+            const head = next.slice(0, group.start);
+            const tail = next.slice(group.end + 1);
+            for (const item of group.items)
+                work.push(`${head}${item}${tail}`);
+        }
+        if (done.length + work.length > limit)
+            return { words: [], overflow: true };
+    }
+    return { words: done.toReversed(), overflow: false };
+}
+/** The first top-level `{...}` that bash would expand (a comma list or a range), or undefined. */
+function firstGroup(text) {
+    for (let start = 0; start < text.length; start += 1) {
+        if (text[start] === "\\") {
+            start += 1;
+            continue;
+        }
+        if (text[start] !== "{")
+            continue;
+        const end = matchingBrace(text, start);
+        if (end === undefined)
+            continue;
+        const body = text.slice(start + 1, end);
+        const items = commaItems(body) ?? rangeItems(body);
+        if (items !== undefined)
+            return { start, end, items };
+    }
+    return undefined;
+}
+function matchingBrace(text, start) {
+    let depth = 0;
+    for (let i = start; i < text.length; i += 1) {
+        const ch = text[i];
+        switch (ch) {
+            case "\\": {
+                i += 1;
+                break;
+            }
+            case "{": {
+                depth += 1;
+                break;
+            }
+            case "}": {
+                depth -= 1;
+                if (depth === 0)
+                    return i;
+                break;
+            }
+            // No default
+        }
+    }
+    return undefined;
+}
+/** Items of a top-level comma list. Undefined when there is no top-level comma. */
+function commaItems(body) {
+    const items = [];
+    let depth = 0;
+    let from = 0;
+    for (let i = 0; i < body.length; i += 1) {
+        const ch = body[i];
+        switch (ch) {
+            case "\\": {
+                i += 1;
+                break;
+            }
+            case "{": {
+                depth += 1;
+                break;
+            }
+            case "}": {
+                depth -= 1;
+                break;
+            }
+            default:
+                if (ch === "," && depth === 0) {
+                    items.push(body.slice(from, i));
+                    from = i + 1;
+                }
+        }
+    }
+    if (items.length === 0)
+        return undefined;
+    items.push(body.slice(from));
+    return items;
+}
+const RANGE = /^(-?\d+|[A-Z])\.\.(-?\d+|[A-Z])(?:\.\.(-?\d+))?$/i;
+const MAX_RANGE = 1024;
+function rangeItems(body) {
+    const match = RANGE.exec(body);
+    if (match === null)
+        return undefined;
+    const [, a, b, stepText] = match;
+    const step = Math.max(1, Math.abs(Number(stepText ?? "1")) || 1);
+    const out = [];
+    if (/^-?\d+$/.test(a) && /^-?\d+$/.test(b)) {
+        const from = Number(a);
+        const to = Number(b);
+        const width = /^-?0\d/.test(a) || /^-?0\d/.test(b) ? Math.max(a.replace("-", "").length, b.replace("-", "").length) : 0;
+        if (Math.abs(to - from) / step > MAX_RANGE)
+            return Array.from({ length: MAX_RANGE + 1 }, (_, i) => String(i));
+        for (let n = from; from <= to ? n <= to : n >= to; n += from <= to ? step : -step) {
+            const text = String(Math.abs(n)).padStart(width, "0");
+            out.push(n < 0 ? `-${text}` : text);
+        }
+        return out;
+    }
+    if (a.length === 1 && b.length === 1 && !/\d/.test(a + b)) {
+        const from = a.codePointAt(0);
+        const to = b.codePointAt(0);
+        for (let c = from; from <= to ? c <= to : c >= to; c += from <= to ? step : -step)
+            out.push(String.fromCodePoint(c));
+        return out;
+    }
+    return undefined;
+}
+//# sourceMappingURL=glob-expand.js.map

package/dist/glob-expand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob-expand.js","sourceRoot":"","sources":["../src/glob-expand.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,aAAa,GAAG,GAAG,CAAC;AAI1B,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,QAAgB,aAAa;IAE7B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAa,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAG,CAAC;QACzB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvD,CAAC;AAED,kGAAkG;AAClG,SAAS,UAAU,CAAC,IAAY;IAC9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YACzB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG;YAAE,SAAS;QAClC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,QAAQ,EAAE,EAAE,CAAC;YACX,KAAK,IAAI,CAAC,CAAC,CAAC;gBACV,CAAC,IAAI,CAAC,CAAC;gBAEP,MAAM;YACR,CAAC;YACD,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,KAAK,IAAI,CAAC,CAAC;gBAEX,MAAM;YACR,CAAC;YACD,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,KAAK,CAAC;oBAAE,OAAO,CAAC,CAAC;gBAE1B,MAAM;YACR,CAAC;YACD,aAAa;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mFAAmF;AACnF,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,QAAQ,EAAE,EAAE,CAAC;YACX,KAAK,IAAI,CAAC,CAAC,CAAC;gBACV,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;YACD,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;YACD;gBACE,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;oBAC9B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;gBACf,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,KAAK,GAAG,mDAAmD,CAAC;AAClE,MAAM,SAAS,GAAG,IAAI,CAAC;AAEvB,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,SAAS,CAAC,IAAI,CAAC,CAAE,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAE,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,KAAK,GACT,QAAQ,CAAC,IAAI,CAAC,CAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChH,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,SAAS;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9G,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAE,GAAG,CAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,CAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;QAChC,MAAM,EAAE,GAAG,CAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YAC/E,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/guards.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Argument guards: what an option table cannot say. A guard sees the command
+ * node's positionals and flag bag and returns extra votes that join the node's
+ * own vote on the strict lattice, so a guard can tighten a verdict, never lift it.
+ *
+ * `flag_paths` (option values typed as paths, glued short values included) is
+ * a guard that every node gets for free.
+ */
+import { type PathTerm } from "./path-policy.js";
+import type { ArgType, CommandNode, FloorVerdict } from "./types.js";
+export type GuardPaths = {
+    readonly read?: PathTerm;
+    readonly write?: PathTerm;
+    /** The shell would expand this question's words: judge braces and globs as what they could become. */
+    readonly expand?: boolean;
+    /** `dotglob` is set somewhere in the command: `*` may match a leading dot. */
+    readonly dotglob?: boolean;
+};
+type Flags = Readonly<Record<string, readonly string[]>>;
+export declare function guardVotes(node: CommandNode, toks: readonly string[], flags: Flags, paths: GuardPaths): FloorVerdict[];
+export declare function pathVote(kind: ArgType, path: string, paths: GuardPaths): FloorVerdict;
+/** Conservative sed parser: true only for scripts it fully understands and finds inert. */
+export declare function sedScriptIsPlain(script: string): boolean;
+export declare const GUARDS: ReadonlySet<string>;
+export {};
+//# sourceMappingURL=guards.d.ts.map

package/dist/guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../src/guards.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAiC,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAe,YAAY,EAAE,MAAM,YAAY,CAAC;AAGlF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B,sGAAsG;IACtG,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,KAAK,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AAIzD,wBAAgB,UAAU,CACxB,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,UAAU,GAChB,YAAY,EAAE,CAMhB;AAMD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,YAAY,CAMrF;AAwKD,2FAA2F;AAC3F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CA2GxD;AAoGD,eAAO,MAAM,MAAM,EAAE,WAAW,CAAC,MAAM,CAAqC,CAAC"}

package/dist/guards.js

@@ -0,0 +1,419 @@
+/**
+ * Argument guards: what an option table cannot say. A guard sees the command
+ * node's positionals and flag bag and returns extra votes that join the node's
+ * own vote on the strict lattice, so a guard can tighten a verdict, never lift it.
+ *
+ * `flag_paths` (option values typed as paths, glued short values included) is
+ * a guard that every node gets for free.
+ */
+import { posix } from "node:path";
+import { explainPath, explainShellPath } from "./path-policy.js";
+import { cast } from "./verdict.js";
+export function guardVotes(node, toks, flags, paths) {
+    const positionals = toks.filter((tok) => tok !== "--");
+    return [
+        ...flagPathVotes(node.flagPaths, flags, paths),
+        ...node.guards.flatMap((name) => (GUARD_TABLE[name] ?? unknownGuard)(positionals, flags, paths)),
+    ];
+}
+function unknownGuard() {
+    return [cast("ask", "unmodelled", "guard:unknown")];
+}
+export function pathVote(kind, path, paths) {
+    const cluster = kind === "read_path" ? paths.read : paths.write;
+    if (cluster === undefined)
+        return cast("ask", "unmodelled", `${kind === "read_path" ? "read" : "write"}:no-policy`);
+    return paths.expand === true
+        ? explainShellPath(cluster, path, { dotglob: paths.dotglob })
+        : explainPath(cluster, path);
+}
+/**
+ * `--output=F`, `--output F`, `-o F`, and glued `-oF`. An empty value (an
+ * option that lost its operand, or a letter cluster such as `-ofile`) is an
+ * unresolvable path and asks.
+ */
+function flagPathVotes(flagPaths, flags, paths) {
+    const votes = [];
+    for (const [name, kind] of Object.entries(flagPaths)) {
+        for (const value of flags[name] ?? [])
+            votes.push(pathVote(kind, value, paths));
+        if (name.startsWith("--") || name.length !== 2)
+            continue;
+        for (const key of Object.keys(flags)) {
+            if (key.startsWith(name) && key.length > 2 && !key.startsWith("--")) {
+                votes.push(pathVote(kind, key.slice(2), paths));
+            }
+        }
+    }
+    return votes;
+}
+/** True when `key` is `full` or an unambiguous long-option prefix of it (`--out` of `--output`). */
+function isOption(key, full) {
+    return key === full || (key.startsWith("--") && key.length >= 3 && full.startsWith(key));
+}
+const GIT_CONFIG_DENY = [
+    /^alias\./,
+    /^include(if)?\./,
+    /^core\.(hookspath|fsmonitor|sshcommand|pager|editor|askpass|gitproxy|attributesfile|excludesfile)$/,
+    /^diff\..*(external|textconv|command)$/,
+    /^(pager|credential|filter|merge|mergetool|difftool|man|web|browser|sequence|gpg|url|protocol|uploadpack|receivepack|safe|http|remote|submodule)\./,
+];
+/** Keys whose value no git code path turns into a program, a file read, or a file write. */
+const GIT_CONFIG_INERT = new Set([
+    "color.ui",
+    "color.diff",
+    "color.status",
+    "color.branch",
+    "color.log",
+    "core.quotepath",
+    "core.abbrev",
+    "core.precomposeunicode",
+    "core.filemode",
+    "core.whitespace",
+    "diff.renames",
+    "diff.context",
+    "diff.algorithm",
+    "log.date",
+    "log.abbrevcommit",
+    "status.showuntrackedfiles",
+    "status.branch",
+    "status.short",
+    "advice.statushints",
+    "user.name",
+    "user.email",
+]);
+/**
+ * `-c key=value` allowlist (case-insensitive: git folds the section and key).
+ * Exec/include keys deny, anything unknown asks. `--config-env` always asks.
+ */
+function gitConfig(_toks, flags) {
+    const votes = [];
+    for (const raw of flags["-c"] ?? []) {
+        const key = raw.split("=", 1)[0].trim().toLowerCase();
+        if (GIT_CONFIG_DENY.some((rule) => rule.test(key)))
+            votes.push(cast("deny", "exec-unknown", "guard:git-config"));
+        else if (!GIT_CONFIG_INERT.has(key))
+            votes.push(cast("ask", "unmodelled", "guard:git-config"));
+    }
+    if (Object.keys(flags).includes("--config-env"))
+        votes.push(cast("ask", "exec-unknown", "guard:git-config-env"));
+    return votes;
+}
+const REV_SYNTAX = /[~^@{}]/;
+/**
+ * diff/log/show operands are revisions or paths. `--no-index` makes every
+ * operand a file git reads; otherwise a `rev:path` or bare operand that is
+ * not revision syntax is read as a path too (`git diff -- .env`, `git show HEAD:.env`).
+ */
+function gitReads(toks, flags, paths) {
+    const noIndex = Object.keys(flags).some((key) => isOption(key, "--no-index"));
+    if (noIndex)
+        return toks.map((tok) => pathVote("read_path", tok, paths));
+    const votes = [];
+    for (const tok of toks) {
+        for (const part of tok.split(/\.{2,3}/)) {
+            const target = part.includes(":") ? part.slice(part.indexOf(":") + 1) : part;
+            if (target === "" || REV_SYNTAX.test(target))
+                continue;
+            votes.push(pathVote("read_path", target, paths));
+        }
+    }
+    return votes;
+}
+const SED_SAFE_FLAGS = [
+    "--quiet",
+    "--silent",
+    "--regexp-extended",
+    "--separate",
+    "--unbuffered",
+    "--null-data",
+    "--posix",
+    "--sandbox",
+    "--debug",
+    "--follow-symlinks",
+    "--expression",
+];
+const SED_OTHER_LONG = ["--file", "--in-place", "--line-length", "--help", "--version", "--binary"];
+const SED_SAFE_SHORT = new Set(["-n", "-E", "-r", "-s", "-u", "-z", "-e"]);
+function sedFlagVote(key) {
+    if (isOption(key, "--in-place"))
+        return "deny";
+    if (key.startsWith("--")) {
+        const safe = SED_SAFE_FLAGS.some((full) => isOption(key, full));
+        const other = SED_OTHER_LONG.some((full) => isOption(key, full));
+        return safe && !other ? undefined : "ask";
+    }
+    if (key.startsWith("-i") || key.startsWith("-I"))
+        return "deny";
+    if (key.startsWith("-e") && key.length > 2)
+        return undefined; // glued script, validated below
+    return SED_SAFE_SHORT.has(key) ? undefined : "ask";
+}
+function sedIsBoolean(key) {
+    if (key.startsWith("--"))
+        return sedFlagVote(key) === undefined && !isOption(key, "--expression");
+    return SED_SAFE_SHORT.has(key) && key !== "-e";
+}
+function sedScripts(toks, flags) {
+    const scripts = [];
+    for (const [key, values] of Object.entries(flags)) {
+        if (key === "-e" || isOption(key, "--expression"))
+            scripts.push(...values.filter((value) => value !== ""));
+        else if (key.startsWith("-e") && !key.startsWith("--") && key.length > 2)
+            scripts.push(key.slice(2));
+    }
+    if (scripts.length > 0)
+        return { scripts, files: toks };
+    return { scripts: toks.slice(0, 1), files: toks.slice(1) };
+}
+/**
+ * sed: in-place edits deny; a script that is anything but plain addressed
+ * `s`/`y`/`p`/`d`/`q`/`n`-style commands with benign `s` flags asks. That drops the file
+ * writers (`w`, `W`, `s///w`) and the program runners (`e`, `s///e`), and `r`/`R` file reads.
+ * File operands are reads.
+ */
+function sed(toks, flags, paths) {
+    const votes = Object.keys(flags).flatMap((key) => {
+        const vote = sedFlagVote(key);
+        if (vote === undefined)
+            return [];
+        return [
+            vote === "deny"
+                ? cast("deny", "workspace-write", "guard:sed-in-place")
+                : cast("ask", "exec-unknown", "guard:sed-flag"),
+        ];
+    });
+    // `-n SCRIPT` also parses as `-n` taking SCRIPT as a value. The other reading (boolean flag, SCRIPT a
+    // positional) is enumerated and judged on its own, so this one has no script or files to inspect.
+    const swallowed = Object.entries(flags).some(([key, values]) => sedIsBoolean(key) && values.some((v) => v !== ""));
+    if (swallowed)
+        return votes;
+    const { scripts, files } = sedScripts(toks, flags);
+    if (scripts.length === 0 || !scripts.every((script) => sedScriptIsPlain(script))) {
+        votes.push(cast("ask", "exec-unknown", "guard:sed-script"));
+    }
+    for (const file of files)
+        votes.push(pathVote("read_path", file, paths));
+    return votes;
+}
+const SED_SIMPLE = new Set(["p", "P", "d", "D", "g", "G", "h", "H", "x", "n", "N", "=", "l", "q", "Q", "z"]);
+/** Conservative sed parser: true only for scripts it fully understands and finds inert. */
+export function sedScriptIsPlain(script) {
+    let i = 0;
+    let depth = 0;
+    const n = script.length;
+    const blank = (c) => c === " " || c === "\t";
+    const digit = (c) => c !== undefined && c >= "0" && c <= "9";
+    const space = () => {
+        while (i < n && blank(script[i]))
+            i += 1;
+    };
+    /** Consume up to the unescaped delimiter. Returns false when unterminated. */
+    const delimited = (delim) => {
+        while (i < n) {
+            const c = script[i];
+            i += 1;
+            if (c === "\\") {
+                i += 1;
+                continue;
+            }
+            if (c === delim)
+                return true;
+        }
+        return false;
+    };
+    const address = () => {
+        const c = script[i];
+        if (c === "$") {
+            i += 1;
+            return true;
+        }
+        if (digit(c)) {
+            while (digit(script[i]))
+                i += 1;
+            if (script[i] === "~") {
+                i += 1;
+                while (digit(script[i]))
+                    i += 1;
+            }
+            return true;
+        }
+        if (c === "/" || c === "\\") {
+            let delim = "/";
+            if (c === "\\") {
+                i += 1;
+                delim = script[i] ?? "";
+                if (delim === "" || delim === "\\" || delim === "\n")
+                    return false;
+            }
+            i += 1;
+            if (!delimited(delim))
+                return false;
+            while (script[i] === "I" || script[i] === "M")
+                i += 1;
+            return true;
+        }
+        return false;
+    };
+    const ending = () => {
+        space();
+        const c = script[i];
+        return c === undefined || c === ";" || c === "\n" || c === "}";
+    };
+    while (i < n) {
+        while (i < n && (blank(script[i]) || script[i] === ";" || script[i] === "\n"))
+            i += 1;
+        if (i >= n)
+            break;
+        if (script[i] === "}") {
+            depth -= 1;
+            if (depth < 0)
+                return false;
+            i += 1;
+            continue;
+        }
+        if (address()) {
+            space();
+            if (script[i] === ",") {
+                i += 1;
+                space();
+                if (script[i] === "+" || script[i] === "~")
+                    i += 1;
+                if (!address())
+                    return false;
+            }
+        }
+        space();
+        while (script[i] === "!") {
+            i += 1;
+            space();
+        }
+        const cmd = script[i];
+        if (cmd === undefined)
+            return false;
+        i += 1;
+        if (cmd === "{") {
+            depth += 1;
+            continue;
+        }
+        if (cmd === "s" || cmd === "y") {
+            const delim = script[i];
+            if (delim === undefined || delim === "\\" || delim === "\n" || blank(delim))
+                return false;
+            i += 1;
+            if (!delimited(delim) || !delimited(delim))
+                return false;
+            if (cmd === "s") {
+                while (i < n && "gpiImM0123456789".includes(script[i]))
+                    i += 1;
+            }
+            if (!ending())
+                return false;
+            continue;
+        }
+        if (SED_SIMPLE.has(cmd)) {
+            if (cmd === "q" || cmd === "Q" || cmd === "l") {
+                space();
+                while (digit(script[i]))
+                    i += 1;
+            }
+            if (!ending())
+                return false;
+            continue;
+        }
+        return false;
+    }
+    return depth === 0;
+}
+/**
+ * Catastrophic shapes: the few commands whose one run cannot be undone, so no mode may
+ * lift them (`block`, not `deny`). A guard only tightens, so the node keeps its soft vote
+ * for every other form and these arms add the hard one.
+ *
+ * Operands are read from positionals and from flag values alike: `rm -r /` parses both as
+ * a boolean `-r` plus operand `/` and as `-r` taking `/`, and either reading must see it.
+ */
+const ROOT_LIKE = new Set([
+    "/",
+    "/*",
+    "/.",
+    "~",
+    "~/",
+    "~/*",
+    "~/.",
+    "$HOME",
+    "$HOME/",
+    "$HOME/*",
+    "$HOME/.",
+    "${HOME}",
+    "${HOME}/",
+    "${HOME}/*",
+    "${HOME}/.",
+]);
+/** `/`, `/*`, `~`, `~/`, `$HOME` and their `//`, `/.` spellings. Not `/tmp/x`, not `./`. */
+function isRootLike(word) {
+    const squeezed = word.replaceAll(/\/{2,}/g, "/");
+    if (ROOT_LIKE.has(squeezed))
+        return true;
+    // `/.`, `/./`, `~/.`: no-op segments after the head.
+    const plain = squeezed.replaceAll(/(?<=.)\/\.(?=\/|$)/g, "");
+    return plain !== squeezed && ROOT_LIKE.has(plain);
+}
+function operands(toks, flags) {
+    return [...toks, ...Object.values(flags).flat()];
+}
+/** `-R`, `--recursive`, or a short cluster that carries `r`/`R` (`-rf`, `-fR`). */
+function isRecursive(flags) {
+    return Object.keys(flags).some((key) => isOption(key, "--recursive") || (/^-[A-Z]+$/i.test(key) && /r/i.test(key)));
+}
+function hasOption(flags, full) {
+    return Object.keys(flags).some((key) => isOption(key, full));
+}
+/** rm/chmod/chown: `--no-preserve-root`, or recursion over the filesystem root or the home directory. */
+function recursiveRoot(toks, flags) {
+    if (hasOption(flags, "--no-preserve-root"))
+        return [catastrophe("guard:no-preserve-root")];
+    return isRecursive(flags) && operands(toks, flags).some(isRootLike) ? [catastrophe("guard:recursive-root")] : [];
+}
+function catastrophe(ruleId) {
+    return cast("block", "destroy-catastrophic", ruleId);
+}
+/** Device nodes dd may write without harm. Everything else under /dev is a disk, a tty, or memory. */
+const DD_HARMLESS_DEVICES = new Set(["/dev/null", "/dev/zero", "/dev/full", "/dev/stdout", "/dev/stderr", "/dev/tty"]);
+/** dd: `of=` a device node. */
+function ddDevice(toks, flags) {
+    const hit = operands(toks, flags).some((word) => {
+        if (!word.startsWith("of="))
+            return false;
+        const target = posix.normalize(word.slice(3));
+        if (!target.startsWith("/dev/"))
+            return false;
+        return !DD_HARMLESS_DEVICES.has(target) && !target.startsWith("/dev/fd/");
+    });
+    return hit ? [catastrophe("guard:dd-device")] : [];
+}
+const PARTED_READS = new Set(["print", "p", "free", "all", "list", "devices"]);
+/**
+ * Partition editors. The listing forms read; every other invocation (including the
+ * interactive ones, whose commands arrive on stdin) can rewrite the table.
+ */
+function diskWrite(toks, flags) {
+    const readOnly = ["--list", "--show-size", "--version", "--help"].some((full) => hasOption(flags, full)) ||
+        ["-l", "-s", "-V", "-h"].some((short) => Object.hasOwn(flags, short));
+    if (readOnly)
+        return [];
+    // parted names the device, then commands: only the printing ones are a read.
+    const commands = toks.filter((tok) => !tok.startsWith("/dev/"));
+    const printing = commands.length > 0 && commands.every((tok) => PARTED_READS.has(tok));
+    return printing ? [] : [catastrophe("guard:disk-write")];
+}
+const GUARD_TABLE = {
+    "git-config": gitConfig,
+    "git-reads": gitReads,
+    sed,
+    "recursive-root": recursiveRoot,
+    "dd-device": ddDevice,
+    "disk-write": diskWrite,
+};
+export const GUARDS = new Set(Object.keys(GUARD_TABLE));
+//# sourceMappingURL=guards.js.map

package/dist/guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../src/guards.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAiB,MAAM,kBAAkB,CAAC;AAEhF,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAepC,MAAM,UAAU,UAAU,CACxB,IAAiB,EACjB,IAAuB,EACvB,KAAY,EACZ,KAAiB;IAEjB,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IACvD,OAAO;QACL,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC;QAC9C,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;KACjG,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAa,EAAE,IAAY,EAAE,KAAiB;IACrE,MAAM,OAAO,GAAG,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IAChE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC;IACpH,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI;QAC1B,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7D,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,SAA4C,EAAE,KAAY,EAAE,KAAiB;IAClG,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACzD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oGAAoG;AACpG,SAAS,QAAQ,CAAC,GAAW,EAAE,IAAY;IACzC,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,eAAe,GAAG;IACtB,UAAU;IACV,iBAAiB;IACjB,oGAAoG;IACpG,uCAAuC;IACvC,mJAAmJ;CACpJ,CAAC;AAEF,4FAA4F;AAC5F,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,UAAU;IACV,YAAY;IACZ,cAAc;IACd,cAAc;IACd,WAAW;IACX,gBAAgB;IAChB,aAAa;IACb,wBAAwB;IACxB,eAAe;IACf,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,UAAU;IACV,kBAAkB;IAClB,2BAA2B;IAC3B,eAAe;IACf,cAAc;IACd,oBAAoB;IACpB,WAAW;IACX,YAAY;CACb,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,SAAS,CAAC,KAAwB,EAAE,KAAY;IACvD,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC;aAC5G,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACjH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B;;;;GAIG;AACH,SAAS,QAAQ,CAAC,IAAuB,EAAE,KAAY,EAAE,KAAiB;IACxE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9E,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7E,IAAI,MAAM,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;YACvD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,cAAc,GAAG;IACrB,SAAS;IACT,UAAU;IACV,mBAAmB;IACnB,YAAY;IACZ,cAAc;IACd,aAAa;IACb,SAAS;IACT,WAAW;IACX,SAAS;IACT,mBAAmB;IACnB,cAAc;CACf,CAAC;AACF,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AACpG,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE3E,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5C,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAChE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,gCAAgC;IAC9F,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClG,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,UAAU,CAAC,IAAuB,EAAE,KAAY;IACvD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,GAAG,KAAK,IAAI,IAAI,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC;aACtG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,SAAS,GAAG,CAAC,IAAuB,EAAE,KAAY,EAAE,KAAiB;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,KAAK,MAAM;gBACb,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,EAAE,oBAAoB,CAAC;gBACvD,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,gBAAgB,CAAC;SAClD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,sGAAsG;IACtG,kGAAkG;IAClG,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnH,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACjF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE7G,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IACxB,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;IACjE,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC;IACjF,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC;IACF,8EAA8E;IAC9E,MAAM,SAAS,GAAG,CAAC,KAAa,EAAW,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;YACrB,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;QAC/B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,GAAY,EAAE;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACtB,CAAC,IAAI,CAAC,CAAC;gBACP,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAAE,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,KAAK,GAAG,GAAG,CAAC;YAChB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,CAAC,IAAI,CAAC,CAAC;gBACP,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxB,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;oBAAE,OAAO,KAAK,CAAC;YACrE,CAAC;YACD,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpC,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,IAAI,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,GAAY,EAAE;QAC3B,KAAK,EAAE,CAAC;QACR,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;IACjE,CAAC,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM;QAClB,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC5B,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,EAAE,EAAE,CAAC;YACd,KAAK,EAAE,CAAC;YACR,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACtB,CAAC,IAAI,CAAC,CAAC;gBACP,KAAK,EAAE,CAAC;gBACR,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,OAAO,EAAE;oBAAE,OAAO,KAAK,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,KAAK,EAAE,CAAC;QACR,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzB,CAAC,IAAI,CAAC,CAAC;YACP,KAAK,EAAE,CAAC;QACV,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACpC,CAAC,IAAI,CAAC,CAAC;QACP,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YAChB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1F,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACzD,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;oBAAE,CAAC,IAAI,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,CAAC,MAAM,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBAC9C,KAAK,EAAE,CAAC;gBACR,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAAE,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,CAAC,MAAM,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,KAAK,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,KAAK;IACL,KAAK;IACL,OAAO;IACP,QAAQ;IACR,SAAS;IACT,SAAS;IACT,SAAS;IACT,UAAU;IACV,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH,4FAA4F;AAC5F,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,qDAAqD;IACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAuB,EAAE,KAAY;IACrD,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,KAAY;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtH,CAAC;AAED,SAAS,SAAS,CAAC,KAAY,EAAE,IAAY;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,yGAAyG;AACzG,SAAS,aAAa,CAAC,IAAuB,EAAE,KAAY;IAC1D,IAAI,SAAS,CAAC,KAAK,EAAE,oBAAoB,CAAC;QAAE,OAAO,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC3F,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnH,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,IAAI,CAAC,OAAO,EAAE,sBAAsB,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,sGAAsG;AACtG,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAEvH,+BAA+B;AAC/B,SAAS,QAAQ,CAAC,IAAuB,EAAE,KAAY;IACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAE/E;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAuB,EAAE,KAAY;IACtD,MAAM,QAAQ,GACZ,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvF,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,QAAQ;QAAE,OAAO,EAAE,CAAC;IACxB,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,WAAW,GAAoC;IACnD,YAAY,EAAE,SAAS;IACvB,WAAW,EAAE,QAAQ;IACrB,GAAG;IACH,gBAAgB,EAAE,aAAa;IAC/B,WAAW,EAAE,QAAQ;IACrB,YAAY,EAAE,SAAS;CACxB,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Executable identity for the floor. Path-form argv0 is the named command
+ * iff `which` returns the same path; otherwise it stays a path.
+ * No process-lifetime cache — PATH/cwd are part of identity.
+ */
+import { type Which } from "@inhuman.tools/policy-bash-disassembler";
+export declare function whichOnPath(name: string): string | undefined;
+/** Path-form argv0 rewritten to the known name, or the original token. */
+export declare function identityName(raw: string, known: ReadonlySet<string>, which: Which | undefined): string;
+export { type Which } from "@inhuman.tools/policy-bash-disassembler";
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAgB,KAAK,KAAK,EAAE,MAAM,yCAAyC,CAAC;AAEnF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ5D;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAEtG;AAED,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,yCAAyC,CAAC"}

package/dist/identity.js

@@ -0,0 +1,23 @@
+/**
+ * Executable identity for the floor. Path-form argv0 is the named command
+ * iff `which` returns the same path; otherwise it stays a path.
+ * No process-lifetime cache — PATH/cwd are part of identity.
+ */
+import { execFileSync } from "node:child_process";
+import { resolveKnown } from "@inhuman.tools/policy-bash-disassembler";
+export function whichOnPath(name) {
+    if (name === "" || name.includes("/") || name.includes("\0"))
+        return undefined;
+    try {
+        const out = execFileSync("which", [name], { encoding: "utf8", timeout: 1000 }).trim();
+        return out === "" ? undefined : out.split("\n")[0];
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Path-form argv0 rewritten to the known name, or the original token. */
+export function identityName(raw, known, which) {
+    return resolveKnown(raw, known, which) ?? raw;
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,YAAY,EAAc,MAAM,yCAAyC,CAAC;AAEnF,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtF,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,KAA0B,EAAE,KAAwB;IAC5F,OAAO,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;AAChD,CAAC"}