@inhuman.tools/policy 0.0.0-stage → 0.2.0

package/dist/guards.js

@@ -0,0 +1,419 @@
+/**
+ * Argument guards: what an option table cannot say. A guard sees the command
+ * node's positionals and flag bag and returns extra votes that join the node's
+ * own vote on the strict lattice, so a guard can tighten a verdict, never lift it.
+ *
+ * `flag_paths` (option values typed as paths, glued short values included) is
+ * a guard that every node gets for free.
+ */
+import { posix } from "node:path";
+import { explainPath, explainShellPath } from "./path-policy.js";
+import { cast } from "./verdict.js";
+export function guardVotes(node, toks, flags, paths) {
+    const positionals = toks.filter((tok) => tok !== "--");
+    return [
+        ...flagPathVotes(node.flagPaths, flags, paths),
+        ...node.guards.flatMap((name) => (GUARD_TABLE[name] ?? unknownGuard)(positionals, flags, paths)),
+    ];
+}
+function unknownGuard() {
+    return [cast("ask", "unmodelled", "guard:unknown")];
+}
+export function pathVote(kind, path, paths) {
+    const cluster = kind === "read_path" ? paths.read : paths.write;
+    if (cluster === undefined)
+        return cast("ask", "unmodelled", `${kind === "read_path" ? "read" : "write"}:no-policy`);
+    return paths.expand === true
+        ? explainShellPath(cluster, path, { dotglob: paths.dotglob })
+        : explainPath(cluster, path);
+}
+/**
+ * `--output=F`, `--output F`, `-o F`, and glued `-oF`. An empty value (an
+ * option that lost its operand, or a letter cluster such as `-ofile`) is an
+ * unresolvable path and asks.
+ */
+function flagPathVotes(flagPaths, flags, paths) {
+    const votes = [];
+    for (const [name, kind] of Object.entries(flagPaths)) {
+        for (const value of flags[name] ?? [])
+            votes.push(pathVote(kind, value, paths));
+        if (name.startsWith("--") || name.length !== 2)
+            continue;
+        for (const key of Object.keys(flags)) {
+            if (key.startsWith(name) && key.length > 2 && !key.startsWith("--")) {
+                votes.push(pathVote(kind, key.slice(2), paths));
+            }
+        }
+    }
+    return votes;
+}
+/** True when `key` is `full` or an unambiguous long-option prefix of it (`--out` of `--output`). */
+function isOption(key, full) {
+    return key === full || (key.startsWith("--") && key.length >= 3 && full.startsWith(key));
+}
+const GIT_CONFIG_DENY = [
+    /^alias\./,
+    /^include(if)?\./,
+    /^core\.(hookspath|fsmonitor|sshcommand|pager|editor|askpass|gitproxy|attributesfile|excludesfile)$/,
+    /^diff\..*(external|textconv|command)$/,
+    /^(pager|credential|filter|merge|mergetool|difftool|man|web|browser|sequence|gpg|url|protocol|uploadpack|receivepack|safe|http|remote|submodule)\./,
+];
+/** Keys whose value no git code path turns into a program, a file read, or a file write. */
+const GIT_CONFIG_INERT = new Set([
+    "color.ui",
+    "color.diff",
+    "color.status",
+    "color.branch",
+    "color.log",
+    "core.quotepath",
+    "core.abbrev",
+    "core.precomposeunicode",
+    "core.filemode",
+    "core.whitespace",
+    "diff.renames",
+    "diff.context",
+    "diff.algorithm",
+    "log.date",
+    "log.abbrevcommit",
+    "status.showuntrackedfiles",
+    "status.branch",
+    "status.short",
+    "advice.statushints",
+    "user.name",
+    "user.email",
+]);
+/**
+ * `-c key=value` allowlist (case-insensitive: git folds the section and key).
+ * Exec/include keys deny, anything unknown asks. `--config-env` always asks.
+ */
+function gitConfig(_toks, flags) {
+    const votes = [];
+    for (const raw of flags["-c"] ?? []) {
+        const key = raw.split("=", 1)[0].trim().toLowerCase();
+        if (GIT_CONFIG_DENY.some((rule) => rule.test(key)))
+            votes.push(cast("deny", "exec-unknown", "guard:git-config"));
+        else if (!GIT_CONFIG_INERT.has(key))
+            votes.push(cast("ask", "unmodelled", "guard:git-config"));
+    }
+    if (Object.keys(flags).includes("--config-env"))
+        votes.push(cast("ask", "exec-unknown", "guard:git-config-env"));
+    return votes;
+}
+const REV_SYNTAX = /[~^@{}]/;
+/**
+ * diff/log/show operands are revisions or paths. `--no-index` makes every
+ * operand a file git reads; otherwise a `rev:path` or bare operand that is
+ * not revision syntax is read as a path too (`git diff -- .env`, `git show HEAD:.env`).
+ */
+function gitReads(toks, flags, paths) {
+    const noIndex = Object.keys(flags).some((key) => isOption(key, "--no-index"));
+    if (noIndex)
+        return toks.map((tok) => pathVote("read_path", tok, paths));
+    const votes = [];
+    for (const tok of toks) {
+        for (const part of tok.split(/\.{2,3}/)) {
+            const target = part.includes(":") ? part.slice(part.indexOf(":") + 1) : part;
+            if (target === "" || REV_SYNTAX.test(target))
+                continue;
+            votes.push(pathVote("read_path", target, paths));
+        }
+    }
+    return votes;
+}
+const SED_SAFE_FLAGS = [
+    "--quiet",
+    "--silent",
+    "--regexp-extended",
+    "--separate",
+    "--unbuffered",
+    "--null-data",
+    "--posix",
+    "--sandbox",
+    "--debug",
+    "--follow-symlinks",
+    "--expression",
+];
+const SED_OTHER_LONG = ["--file", "--in-place", "--line-length", "--help", "--version", "--binary"];
+const SED_SAFE_SHORT = new Set(["-n", "-E", "-r", "-s", "-u", "-z", "-e"]);
+function sedFlagVote(key) {
+    if (isOption(key, "--in-place"))
+        return "deny";
+    if (key.startsWith("--")) {
+        const safe = SED_SAFE_FLAGS.some((full) => isOption(key, full));
+        const other = SED_OTHER_LONG.some((full) => isOption(key, full));
+        return safe && !other ? undefined : "ask";
+    }
+    if (key.startsWith("-i") || key.startsWith("-I"))
+        return "deny";
+    if (key.startsWith("-e") && key.length > 2)
+        return undefined; // glued script, validated below
+    return SED_SAFE_SHORT.has(key) ? undefined : "ask";
+}
+function sedIsBoolean(key) {
+    if (key.startsWith("--"))
+        return sedFlagVote(key) === undefined && !isOption(key, "--expression");
+    return SED_SAFE_SHORT.has(key) && key !== "-e";
+}
+function sedScripts(toks, flags) {
+    const scripts = [];
+    for (const [key, values] of Object.entries(flags)) {
+        if (key === "-e" || isOption(key, "--expression"))
+            scripts.push(...values.filter((value) => value !== ""));
+        else if (key.startsWith("-e") && !key.startsWith("--") && key.length > 2)
+            scripts.push(key.slice(2));
+    }
+    if (scripts.length > 0)
+        return { scripts, files: toks };
+    return { scripts: toks.slice(0, 1), files: toks.slice(1) };
+}
+/**
+ * sed: in-place edits deny; a script that is anything but plain addressed
+ * `s`/`y`/`p`/`d`/`q`/`n`-style commands with benign `s` flags asks. That drops the file
+ * writers (`w`, `W`, `s///w`) and the program runners (`e`, `s///e`), and `r`/`R` file reads.
+ * File operands are reads.
+ */
+function sed(toks, flags, paths) {
+    const votes = Object.keys(flags).flatMap((key) => {
+        const vote = sedFlagVote(key);
+        if (vote === undefined)
+            return [];
+        return [
+            vote === "deny"
+                ? cast("deny", "workspace-write", "guard:sed-in-place")
+                : cast("ask", "exec-unknown", "guard:sed-flag"),
+        ];
+    });
+    // `-n SCRIPT` also parses as `-n` taking SCRIPT as a value. The other reading (boolean flag, SCRIPT a
+    // positional) is enumerated and judged on its own, so this one has no script or files to inspect.
+    const swallowed = Object.entries(flags).some(([key, values]) => sedIsBoolean(key) && values.some((v) => v !== ""));
+    if (swallowed)
+        return votes;
+    const { scripts, files } = sedScripts(toks, flags);
+    if (scripts.length === 0 || !scripts.every((script) => sedScriptIsPlain(script))) {
+        votes.push(cast("ask", "exec-unknown", "guard:sed-script"));
+    }
+    for (const file of files)
+        votes.push(pathVote("read_path", file, paths));
+    return votes;
+}
+const SED_SIMPLE = new Set(["p", "P", "d", "D", "g", "G", "h", "H", "x", "n", "N", "=", "l", "q", "Q", "z"]);
+/** Conservative sed parser: true only for scripts it fully understands and finds inert. */
+export function sedScriptIsPlain(script) {
+    let i = 0;
+    let depth = 0;
+    const n = script.length;
+    const blank = (c) => c === " " || c === "\t";
+    const digit = (c) => c !== undefined && c >= "0" && c <= "9";
+    const space = () => {
+        while (i < n && blank(script[i]))
+            i += 1;
+    };
+    /** Consume up to the unescaped delimiter. Returns false when unterminated. */
+    const delimited = (delim) => {
+        while (i < n) {
+            const c = script[i];
+            i += 1;
+            if (c === "\\") {
+                i += 1;
+                continue;
+            }
+            if (c === delim)
+                return true;
+        }
+        return false;
+    };
+    const address = () => {
+        const c = script[i];
+        if (c === "$") {
+            i += 1;
+            return true;
+        }
+        if (digit(c)) {
+            while (digit(script[i]))
+                i += 1;
+            if (script[i] === "~") {
+                i += 1;
+                while (digit(script[i]))
+                    i += 1;
+            }
+            return true;
+        }
+        if (c === "/" || c === "\\") {
+            let delim = "/";
+            if (c === "\\") {
+                i += 1;
+                delim = script[i] ?? "";
+                if (delim === "" || delim === "\\" || delim === "\n")
+                    return false;
+            }
+            i += 1;
+            if (!delimited(delim))
+                return false;
+            while (script[i] === "I" || script[i] === "M")
+                i += 1;
+            return true;
+        }
+        return false;
+    };
+    const ending = () => {
+        space();
+        const c = script[i];
+        return c === undefined || c === ";" || c === "\n" || c === "}";
+    };
+    while (i < n) {
+        while (i < n && (blank(script[i]) || script[i] === ";" || script[i] === "\n"))
+            i += 1;
+        if (i >= n)
+            break;
+        if (script[i] === "}") {
+            depth -= 1;
+            if (depth < 0)
+                return false;
+            i += 1;
+            continue;
+        }
+        if (address()) {
+            space();
+            if (script[i] === ",") {
+                i += 1;
+                space();
+                if (script[i] === "+" || script[i] === "~")
+                    i += 1;
+                if (!address())
+                    return false;
+            }
+        }
+        space();
+        while (script[i] === "!") {
+            i += 1;
+            space();
+        }
+        const cmd = script[i];
+        if (cmd === undefined)
+            return false;
+        i += 1;
+        if (cmd === "{") {
+            depth += 1;
+            continue;
+        }
+        if (cmd === "s" || cmd === "y") {
+            const delim = script[i];
+            if (delim === undefined || delim === "\\" || delim === "\n" || blank(delim))
+                return false;
+            i += 1;
+            if (!delimited(delim) || !delimited(delim))
+                return false;
+            if (cmd === "s") {
+                while (i < n && "gpiImM0123456789".includes(script[i]))
+                    i += 1;
+            }
+            if (!ending())
+                return false;
+            continue;
+        }
+        if (SED_SIMPLE.has(cmd)) {
+            if (cmd === "q" || cmd === "Q" || cmd === "l") {
+                space();
+                while (digit(script[i]))
+                    i += 1;
+            }
+            if (!ending())
+                return false;
+            continue;
+        }
+        return false;
+    }
+    return depth === 0;
+}
+/**
+ * Catastrophic shapes: the few commands whose one run cannot be undone, so no mode may
+ * lift them (`block`, not `deny`). A guard only tightens, so the node keeps its soft vote
+ * for every other form and these arms add the hard one.
+ *
+ * Operands are read from positionals and from flag values alike: `rm -r /` parses both as
+ * a boolean `-r` plus operand `/` and as `-r` taking `/`, and either reading must see it.
+ */
+const ROOT_LIKE = new Set([
+    "/",
+    "/*",
+    "/.",
+    "~",
+    "~/",
+    "~/*",
+    "~/.",
+    "$HOME",
+    "$HOME/",
+    "$HOME/*",
+    "$HOME/.",
+    "${HOME}",
+    "${HOME}/",
+    "${HOME}/*",
+    "${HOME}/.",
+]);
+/** `/`, `/*`, `~`, `~/`, `$HOME` and their `//`, `/.` spellings. Not `/tmp/x`, not `./`. */
+function isRootLike(word) {
+    const squeezed = word.replaceAll(/\/{2,}/g, "/");
+    if (ROOT_LIKE.has(squeezed))
+        return true;
+    // `/.`, `/./`, `~/.`: no-op segments after the head.
+    const plain = squeezed.replaceAll(/(?<=.)\/\.(?=\/|$)/g, "");
+    return plain !== squeezed && ROOT_LIKE.has(plain);
+}
+function operands(toks, flags) {
+    return [...toks, ...Object.values(flags).flat()];
+}
+/** `-R`, `--recursive`, or a short cluster that carries `r`/`R` (`-rf`, `-fR`). */
+function isRecursive(flags) {
+    return Object.keys(flags).some((key) => isOption(key, "--recursive") || (/^-[A-Z]+$/i.test(key) && /r/i.test(key)));
+}
+function hasOption(flags, full) {
+    return Object.keys(flags).some((key) => isOption(key, full));
+}
+/** rm/chmod/chown: `--no-preserve-root`, or recursion over the filesystem root or the home directory. */
+function recursiveRoot(toks, flags) {
+    if (hasOption(flags, "--no-preserve-root"))
+        return [catastrophe("guard:no-preserve-root")];
+    return isRecursive(flags) && operands(toks, flags).some(isRootLike) ? [catastrophe("guard:recursive-root")] : [];
+}
+function catastrophe(ruleId) {
+    return cast("block", "destroy-catastrophic", ruleId);
+}
+/** Device nodes dd may write without harm. Everything else under /dev is a disk, a tty, or memory. */
+const DD_HARMLESS_DEVICES = new Set(["/dev/null", "/dev/zero", "/dev/full", "/dev/stdout", "/dev/stderr", "/dev/tty"]);
+/** dd: `of=` a device node. */
+function ddDevice(toks, flags) {
+    const hit = operands(toks, flags).some((word) => {
+        if (!word.startsWith("of="))
+            return false;
+        const target = posix.normalize(word.slice(3));
+        if (!target.startsWith("/dev/"))
+            return false;
+        return !DD_HARMLESS_DEVICES.has(target) && !target.startsWith("/dev/fd/");
+    });
+    return hit ? [catastrophe("guard:dd-device")] : [];
+}
+const PARTED_READS = new Set(["print", "p", "free", "all", "list", "devices"]);
+/**
+ * Partition editors. The listing forms read; every other invocation (including the
+ * interactive ones, whose commands arrive on stdin) can rewrite the table.
+ */
+function diskWrite(toks, flags) {
+    const readOnly = ["--list", "--show-size", "--version", "--help"].some((full) => hasOption(flags, full)) ||
+        ["-l", "-s", "-V", "-h"].some((short) => Object.hasOwn(flags, short));
+    if (readOnly)
+        return [];
+    // parted names the device, then commands: only the printing ones are a read.
+    const commands = toks.filter((tok) => !tok.startsWith("/dev/"));
+    const printing = commands.length > 0 && commands.every((tok) => PARTED_READS.has(tok));
+    return printing ? [] : [catastrophe("guard:disk-write")];
+}
+const GUARD_TABLE = {
+    "git-config": gitConfig,
+    "git-reads": gitReads,
+    sed,
+    "recursive-root": recursiveRoot,
+    "dd-device": ddDevice,
+    "disk-write": diskWrite,
+};
+export const GUARDS = new Set(Object.keys(GUARD_TABLE));
+//# sourceMappingURL=guards.js.map

package/dist/guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../src/guards.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAiB,MAAM,kBAAkB,CAAC;AAEhF,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAepC,MAAM,UAAU,UAAU,CACxB,IAAiB,EACjB,IAAuB,EACvB,KAAY,EACZ,KAAiB;IAEjB,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IACvD,OAAO;QACL,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC;QAC9C,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;KACjG,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAa,EAAE,IAAY,EAAE,KAAiB;IACrE,MAAM,OAAO,GAAG,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IAChE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC;IACpH,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI;QAC1B,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7D,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,SAA4C,EAAE,KAAY,EAAE,KAAiB;IAClG,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACzD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oGAAoG;AACpG,SAAS,QAAQ,CAAC,GAAW,EAAE,IAAY;IACzC,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,eAAe,GAAG;IACtB,UAAU;IACV,iBAAiB;IACjB,oGAAoG;IACpG,uCAAuC;IACvC,mJAAmJ;CACpJ,CAAC;AAEF,4FAA4F;AAC5F,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,UAAU;IACV,YAAY;IACZ,cAAc;IACd,cAAc;IACd,WAAW;IACX,gBAAgB;IAChB,aAAa;IACb,wBAAwB;IACxB,eAAe;IACf,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,UAAU;IACV,kBAAkB;IAClB,2BAA2B;IAC3B,eAAe;IACf,cAAc;IACd,oBAAoB;IACpB,WAAW;IACX,YAAY;CACb,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,SAAS,CAAC,KAAwB,EAAE,KAAY;IACvD,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC;aAC5G,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACjH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B;;;;GAIG;AACH,SAAS,QAAQ,CAAC,IAAuB,EAAE,KAAY,EAAE,KAAiB;IACxE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9E,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7E,IAAI,MAAM,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;YACvD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,cAAc,GAAG;IACrB,SAAS;IACT,UAAU;IACV,mBAAmB;IACnB,YAAY;IACZ,cAAc;IACd,aAAa;IACb,SAAS;IACT,WAAW;IACX,SAAS;IACT,mBAAmB;IACnB,cAAc;CACf,CAAC;AACF,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AACpG,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE3E,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5C,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAChE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,gCAAgC;IAC9F,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClG,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,UAAU,CAAC,IAAuB,EAAE,KAAY;IACvD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,GAAG,KAAK,IAAI,IAAI,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC;aACtG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,SAAS,GAAG,CAAC,IAAuB,EAAE,KAAY,EAAE,KAAiB;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,KAAK,MAAM;gBACb,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,EAAE,oBAAoB,CAAC;gBACvD,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,gBAAgB,CAAC;SAClD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,sGAAsG;IACtG,kGAAkG;IAClG,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnH,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACjF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE7G,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IACxB,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;IACjE,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC;IACjF,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC;IACF,8EAA8E;IAC9E,MAAM,SAAS,GAAG,CAAC,KAAa,EAAW,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;YACrB,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;QAC/B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,GAAY,EAAE;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACtB,CAAC,IAAI,CAAC,CAAC;gBACP,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAAE,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,KAAK,GAAG,GAAG,CAAC;YAChB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,CAAC,IAAI,CAAC,CAAC;gBACP,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxB,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;oBAAE,OAAO,KAAK,CAAC;YACrE,CAAC;YACD,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpC,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,IAAI,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,GAAY,EAAE;QAC3B,KAAK,EAAE,CAAC;QACR,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;IACjE,CAAC,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM;QAClB,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC5B,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,EAAE,EAAE,CAAC;YACd,KAAK,EAAE,CAAC;YACR,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACtB,CAAC,IAAI,CAAC,CAAC;gBACP,KAAK,EAAE,CAAC;gBACR,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,CAAC,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,OAAO,EAAE;oBAAE,OAAO,KAAK,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,KAAK,EAAE,CAAC;QACR,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzB,CAAC,IAAI,CAAC,CAAC;YACP,KAAK,EAAE,CAAC;QACV,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACpC,CAAC,IAAI,CAAC,CAAC;QACP,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YAChB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1F,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACzD,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;oBAAE,CAAC,IAAI,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,CAAC,MAAM,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBAC9C,KAAK,EAAE,CAAC;gBACR,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAAE,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,CAAC,MAAM,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,KAAK,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,KAAK;IACL,KAAK;IACL,OAAO;IACP,QAAQ;IACR,SAAS;IACT,SAAS;IACT,SAAS;IACT,UAAU;IACV,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH,4FAA4F;AAC5F,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,qDAAqD;IACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAuB,EAAE,KAAY;IACrD,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,KAAY;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtH,CAAC;AAED,SAAS,SAAS,CAAC,KAAY,EAAE,IAAY;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,yGAAyG;AACzG,SAAS,aAAa,CAAC,IAAuB,EAAE,KAAY;IAC1D,IAAI,SAAS,CAAC,KAAK,EAAE,oBAAoB,CAAC;QAAE,OAAO,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC3F,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnH,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,IAAI,CAAC,OAAO,EAAE,sBAAsB,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,sGAAsG;AACtG,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAEvH,+BAA+B;AAC/B,SAAS,QAAQ,CAAC,IAAuB,EAAE,KAAY;IACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAE/E;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAuB,EAAE,KAAY;IACtD,MAAM,QAAQ,GACZ,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvF,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,QAAQ;QAAE,OAAO,EAAE,CAAC;IACxB,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,WAAW,GAAoC;IACnD,YAAY,EAAE,SAAS;IACvB,WAAW,EAAE,QAAQ;IACrB,GAAG;IACH,gBAAgB,EAAE,aAAa;IAC/B,WAAW,EAAE,QAAQ;IACrB,YAAY,EAAE,SAAS;CACxB,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Executable identity for the floor. Path-form argv0 is the named command
+ * iff `which` returns the same path; otherwise it stays a path.
+ * No process-lifetime cache — PATH/cwd are part of identity.
+ */
+import { type Which } from "@inhuman.tools/policy-bash-disassembler";
+export declare function whichOnPath(name: string): string | undefined;
+/** Path-form argv0 rewritten to the known name, or the original token. */
+export declare function identityName(raw: string, known: ReadonlySet<string>, which: Which | undefined): string;
+export { type Which } from "@inhuman.tools/policy-bash-disassembler";
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAgB,KAAK,KAAK,EAAE,MAAM,yCAAyC,CAAC;AAEnF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ5D;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAEtG;AAED,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,yCAAyC,CAAC"}

package/dist/identity.js

@@ -0,0 +1,23 @@
+/**
+ * Executable identity for the floor. Path-form argv0 is the named command
+ * iff `which` returns the same path; otherwise it stays a path.
+ * No process-lifetime cache — PATH/cwd are part of identity.
+ */
+import { execFileSync } from "node:child_process";
+import { resolveKnown } from "@inhuman.tools/policy-bash-disassembler";
+export function whichOnPath(name) {
+    if (name === "" || name.includes("/") || name.includes("\0"))
+        return undefined;
+    try {
+        const out = execFileSync("which", [name], { encoding: "utf8", timeout: 1000 }).trim();
+        return out === "" ? undefined : out.split("\n")[0];
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Path-form argv0 rewritten to the known name, or the original token. */
+export function identityName(raw, known, which) {
+    return resolveKnown(raw, known, which) ?? raw;
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,YAAY,EAAc,MAAM,yCAAyC,CAAC;AAEnF,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtF,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,KAA0B,EAAE,KAAwB;IAC5F,OAAO,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;AAChD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+/** Plugin door: the dist floor and the authorization program. */
+export { authorizationProgram } from "./authorize.js";
+export { authorize } from "./run-authorization.js";
+export { defaultPolicy } from "./bind.js";
+export { JUDGE_DEADLINE_MS, withDeadline } from "./deadline.js";
+export { checkToolPath, normalizeToolPath } from "./tool-path.js";
+export { acknowledgeRequest, acknowledgeRequirement, blockReason, floorVerdictOf, labelOf, mcpOf, mergeAcknowledge, parseAcknowledge, parseAcknowledgeText, requestAcknowledgement, type AckFlag, type AckMatch, type AckRequest, type AckRequirement, type AckSubject, type Acknowledger, } from "./acknowledge.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACX,cAAc,EACd,OAAO,EACP,KAAK,EACL,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+/** Plugin door: the dist floor and the authorization program. */
+export { authorizationProgram } from "./authorize.js";
+export { authorize } from "./run-authorization.js";
+export { defaultPolicy } from "./bind.js";
+export { JUDGE_DEADLINE_MS, withDeadline } from "./deadline.js";
+export { checkToolPath, normalizeToolPath } from "./tool-path.js";
+export { acknowledgeRequest, acknowledgeRequirement, blockReason, floorVerdictOf, labelOf, mcpOf, mergeAcknowledge, parseAcknowledge, parseAcknowledgeText, requestAcknowledgement, } from "./acknowledge.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACX,cAAc,EACd,OAAO,EACP,KAAK,EACL,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,GAOvB,MAAM,kBAAkB,CAAC"}

package/dist/lift.d.ts

@@ -0,0 +1,4 @@
+import type { Disposition } from "./types.js";
+/** Match-all / pipeline lattice: any-block > any-deny > any-ask > all-approve. */
+export declare function lattice(hits: readonly Disposition[]): Disposition;
+//# sourceMappingURL=lift.d.ts.map

package/dist/lift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lift.d.ts","sourceRoot":"","sources":["../src/lift.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,kFAAkF;AAClF,wBAAgB,OAAO,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,GAAG,WAAW,CAWjE"}

package/dist/lift.js

@@ -0,0 +1,14 @@
+/** Match-all / pipeline lattice: any-block > any-deny > any-ask > all-approve. */
+export function lattice(hits) {
+    switch (true) {
+        case hits.includes("block"):
+            return "block";
+        case hits.includes("deny"):
+            return "deny";
+        case hits.includes("ask"):
+            return "ask";
+        default:
+            return "policyApprove";
+    }
+}
+//# sourceMappingURL=lift.js.map

package/dist/lift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lift.js","sourceRoot":"","sources":["../src/lift.ts"],"names":[],"mappings":"AAEA,kFAAkF;AAClF,MAAM,UAAU,OAAO,CAAC,IAA4B;IAClD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YACzB,OAAO,OAAO,CAAC;QACjB,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxB,OAAO,MAAM,CAAC;QAChB,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvB,OAAO,KAAK,CAAC;QACf;YACE,OAAO,eAAe,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/dist/path-policy.d.ts

@@ -0,0 +1,53 @@
+/**
+ * File-access cluster: policy.json `read_file` / `write_file` enable lists
+ * and `read_block` / `write_block` hard-block lists.
+ * Enable `!` is deny (remainder carve-out). Block lists are unliftable.
+ * Suffix wildcard is implied — PAT matches itself and descendants.
+ * Miss is deny (closed). Unresolvable path is ask.
+ * Read enable is approve (silent in-tree). Write enable is ask: the list is
+ * what the agent may attempt, not a grant. Yolo rewrites that ask and deny.
+ * Realpath / cwd / ~ live on the host; this matcher sees the prepared string.
+ *
+ * Every rule carries a class (why it votes). Brace and glob words from the shell are expanded
+ * lexically against the block rules: if any expansion or match could hit one, the word is `block`.
+ */
+import type { ClassId } from "./classes.js";
+import type { Disposition, FloorVerdict, WriteRemainderKind } from "./types.js";
+type PathRule = {
+    readonly id: string;
+    readonly polarity: "policyApprove" | "ask" | "deny" | "block";
+    readonly stem: string;
+    readonly unanchored: boolean;
+    readonly class: ClassId;
+};
+export type PathTerm = {
+    readonly cluster: "read" | "write";
+    readonly rules: PathRule[];
+    /** Class of a miss (deny: outside the enable roots). */
+    readonly missClass: ClassId;
+};
+export declare function mergePathTerms(cluster: "read" | "write", missClass: ClassId, enable: readonly PathRule[] | undefined, block: readonly PathRule[] | undefined): PathTerm | undefined;
+export declare function checkPath(term: PathTerm, path: string): Disposition;
+/** The disposition of one path with the rules that decided it. */
+export declare function explainPath(term: PathTerm, path: string): FloorVerdict;
+/**
+ * Shell words may carry braces and globs. A word the shell would expand is judged as every
+ * word it could expand to; a glob is judged as everything it could match. The result is the
+ * strictest of those and the word itself, so this can only tighten. Only block rules can be
+ * hit by a pattern (an enable root never needs a glob to be understood: the word asks).
+ */
+export declare function explainShellPath(term: PathTerm, word: string, options?: {
+    readonly dotglob?: boolean;
+}): FloorVerdict;
+/**
+ * Write-deny remainder intern. Null when the floor is not deny.
+ * protected: enable `!` inside an enable root. outside: miss, left the
+ * enable set. risky: enable `!` and left the enable set. `write_block`
+ * never reaches this.
+ */
+export declare function writeRemainderKind(term: PathTerm, path: string): WriteRemainderKind | null;
+/** Undefined = unresolvable (ask). No `..`, `~`, `$`, glob, NUL. */
+export declare function normalizePath(raw: string): string | undefined;
+export { lattice } from "./lift.js";
+export { APPROVE } from "./verdict.js";
+//# sourceMappingURL=path-policy.d.ts.map

package/dist/path-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-policy.d.ts","sourceRoot":"","sources":["../src/path-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhF,KAAK,QAAQ,GAAG;IACd,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,GAAG,OAAO,EACzB,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,EACvC,KAAK,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,GACrC,QAAQ,GAAG,SAAS,CAGtB;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAEnE;AAED,kEAAkE;AAClE,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAStE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3C,YAAY,CAsBd;AAwED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAkB1F;AAkED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiB7D;AAED,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC"}