@lannguyensi/harness 0.63.0 → 1.0.0

package/dist/runtime/destructive-shell-floor.js

@@ -1,611 +0,0 @@
-// Built-in destructive-shell floor for the Risk Classifier (task 2929c5b7).
-//
-// WHY THIS IS CODE AND NOT ONLY A MANIFEST PATTERN. `when-eval.ts` no
-// longer lets an UNCLASSIFIED action satisfy `risk.severity_at_least:
-// critical` on its own. That change ships in the binary and takes effect
-// for every install on upgrade. Its compensating half, explicit
-// classification for the mutating heads that used to ride the blanket
-// fail-close (`dd`, `truncate`, `shred`, `mkfs`, `find -delete`, ...),
-// would take effect only for installs that ADOPT the new `dangerous-shell`
-// template patterns, because `harness init` writes the manifest once and
-// never rewrites it. An existing manifest carrying the original four
-// patterns would have kept the loosened fallback and lost the hard block
-// in the same upgrade. So the recognition ships HERE, composed into
-// `classifyRisk` like the existing built-in floors, and the template
-// patterns are its operator-visible, operator-editable mirror.
-//
-// FLOOR SEMANTICS, same as every other built-in floor: it composes under
-// highest-severity-wins. It can only RAISE an action's severity, never
-// lower one an operator classifier already assigned, and an operator
-// pattern can always raise above it.
-//
-// SCOPE, deliberately narrow. This is not a general "is this command
-// dangerous" oracle and must not grow into one: it recognises a closed set
-// of heads whose DESTRUCTIVE INVOCATION SHAPE is decidable from argv
-// tokens alone. Anything else stays unclassified and rides the "high" rung
-// fallback (approval-gated), which is the honest answer. A truncating
-// redirection (`cmd > file`) is NOT recognised here for the same reason it
-// is not a template pattern: this module has no redirection model, and a
-// text heuristic for a bare `>` over-matches `2>&1`, heredocs, and
-// comparison operators. See docs/risk-gate.md.
-//
-// TWO KNOWN OVER-BLOCKS, both in the raise-severity direction and both
-// accepted. (1) The boundary split is not quote-aware, so a floored head
-// name inside a torn-open quoted string is examined as if it were a real
-// invocation. (2) `shred` and `mkfs` are matched on their HEAD TOKEN
-// ALONE, with no argument shape to check, so any such fragment starting
-// with one of them classifies `critical`. The single exception carved out
-// of (2) is an invocation whose only argument is a help/version flag
-// (`isLoneVersionOrHelp`), which cannot destroy anything.
-//
-// HEAD-RESOLUTION SPELLINGS THIS FLOOR DOES NOT REACH, by design and
-// measured: a brace group (`{ dd of=y; }`), a backtick substitution
-// (`` `dd of=y` ``), `eval "dd of=y"`, an `-exec sh -c '<cmd>'` payload
-// (only a direct `-exec rm` is recognised), and `git -c k=v push --force`
-// (`-c` is deliberately absent from the git global-flag skip list because
-// config injection can execute code, so the subcommand walk stops there).
-// Each stays UNCLASSIFIED, which is approval-gated rather than silently
-// allowed, and each is pinned as such in
-// tests/runtime/destructive-shell-floor.test.ts so a future change to the
-// split or the wrapper peel cannot flip one without a test noticing.
-// Closing them would mean a real shell parser; see docs/risk-gate.md's
-// "Not recognized, by design".
-import { GIT_GLOBAL_NO_VALUE_FLAGS, GIT_GLOBAL_VALUE_TAKING_FLAGS, GIT_TOKEN_RE, peelWrapperPrefixes, } from "./command-normalize.js";
-import { decodeShellWord, truncateNulRuns } from "./shell-word.js";
-// Shell boundary characters. The command text is split on these before any
-// head resolution, so a destructive invocation after `;`, `&&`, `||`, `|`,
-// `&`, a subshell paren, or a newline is still examined. Splitting is
-// deliberately NOT quote-aware: over-splitting inside a quoted string only
-// produces MORE candidate heads to examine, which is the safe direction
-// for a floor that raises severity. Under-splitting is what would hide a
-// destructive tail, and that cannot happen here.
-const BOUNDARY_SPLIT_RE = /[;&|()\n]+/;
-/** Multi-call binaries: `busybox dd if=... of=...` really runs `dd`. */
-const MULTICALL_HEADS = new Set(["busybox", "toybox"]);
-/** Shells whose `-c` argument is a nested command string. */
-const SHELL_HEADS = new Set([
-    "sh", "bash", "zsh", "dash", "ksh", "ash",
-]);
-/** Depth bound for `sh -c "sh -c ..."` nesting. */
-const MAX_NESTING_DEPTH = 4;
-/**
- * Recognise every built-in destructive invocation in `command`.
- *
- * Pure and linear in the length of the command: whitespace tokenisation,
- * set lookups, and a bounded wrapper peel. No regex with a backtracking
- * risk runs over the command text (`BOUNDARY_SPLIT_RE` is a character
- * class), so this may be called on the UNCAPPED command string, which it
- * must be, so a destructive tail past the classifier's 16 KiB ReDoS cap
- * cannot be laundered by a long benign head.
- */
-export function classifyDestructiveShellFloor(command) {
-    const hits = [];
-    scanCommand(command, 0, hits);
-    // A word with a NUL-decoding ANSI-C escape decodes to a value that keeps a
-    // literal U+0000 (`$'--force\0'`, `$'dd\0'`), which no exact comparison
-    // below (a whole flag, a head or subcommand name) can equal, while bash cuts
-    // the run at the NUL and runs the plain command (task `5cc64860`, GNU bash
-    // 3.2.57). The command is therefore scanned a second time with each such
-    // run replaced by the value bash passes (`truncateNulRuns`), and the hits of
-    // both scans are kept: the second scan can only add a hit, so no verdict is
-    // lowered, and the NUL spelling is classified at least as severely as its
-    // plain twin. The rewrite runs before the boundary split, so a boundary
-    // character inside the cut-off part of a run (`$'--force\0;'`) cannot tear
-    // the word. A command without such a run is scanned once, as before.
-    const nul = truncateNulRuns(command);
-    if (nul !== null)
-        scanCommand(nul, 0, hits);
-    return dedupe(hits);
-}
-function dedupe(hits) {
-    const seen = new Set();
-    const out = [];
-    for (const hit of hits) {
-        if (seen.has(hit.reason))
-            continue;
-        seen.add(hit.reason);
-        out.push(hit);
-    }
-    return out;
-}
-function scanCommand(command, depth, hits) {
-    if (depth > MAX_NESTING_DEPTH)
-        return;
-    // WHOLE-STRING pass first, and only for the `<shell> -c "<command>"`
-    // shape. The boundary split below is not quote-aware, so it would tear
-    // `sh -c "dd if=x of=y; rm -rf /"` apart mid-quote and leave the nested
-    // `dd` unrecognisable. Resolving the shell head before splitting keeps
-    // the nested command intact for the recursive scan.
-    const wholeTokens = tokenize(command);
-    const wholeHead = resolveHead(wholeTokens);
-    if (wholeHead !== null && SHELL_HEADS.has(wholeHead.name)) {
-        scanShellDashC(wholeTokens.slice(wholeHead.idx + 1), depth, hits);
-    }
-    for (const piece of command.split(BOUNDARY_SPLIT_RE)) {
-        const tokens = tokenize(piece);
-        if (tokens.length === 0)
-            continue;
-        scanInvocation(tokens, depth, hits);
-    }
-}
-function tokenize(s) {
-    return s.trim().split(/\s+/).filter((t) => t !== "");
-}
-/**
- * Resolve the real head of one invocation: peel `VAR=x` assignments and
- * the `sudo`/`env`/`command`/`timeout`/... wrapper chain, then any
- * `busybox`/`toybox` multi-call prefix. Returns the head's literal name
- * (decoded, path prefix stripped) and its token index, or `null` when no
- * head token survives.
- */
-function resolveHead(rawTokens) {
-    // Basename + decode every token that is not a flag and not a `NAME=value`
-    // assignment, so `/bin/dd`, `/usr/bin/env`, and `"sudo"` all resolve like
-    // their bare spellings. Assignments and `of=`-style operands keep their
-    // text (their `=` is load-bearing), and flags keep theirs (a flag has no
-    // path prefix to strip).
-    const peelTokens = rawTokens.map((t) => ({ text: headNameOf(t) }));
-    let idx = 0;
-    for (let guard = 0; guard <= MAX_NESTING_DEPTH; guard += 1) {
-        const before = idx;
-        // Shared wrapper vocabulary (`peelWrapperPrefixes`, command-normalize.ts)
-        // rather than a second hand-rolled copy of it: a wrapper added there
-        // benefits this floor automatically.
-        idx = peelWrapperPrefixes(peelTokens, idx).idx;
-        const peeled = peelTokens[idx]?.text;
-        if (peeled !== undefined && MULTICALL_HEADS.has(peeled)) {
-            idx += 1;
-            continue;
-        }
-        if (idx === before)
-            break;
-    }
-    const name = peelTokens[idx]?.text;
-    return name === undefined ? null : { name, idx };
-}
-/** Resolve one boundary-delimited invocation's head, then dispatch on it. */
-function scanInvocation(rawTokens, depth, hits) {
-    const resolved = resolveHead(rawTokens);
-    if (resolved === null)
-        return;
-    const head = resolved.name;
-    const args = rawTokens.slice(resolved.idx + 1);
-    if (SHELL_HEADS.has(head)) {
-        scanShellDashC(args, depth, hits);
-        return;
-    }
-    if (head === "dd")
-        return scanDd(args, hits);
-    if (head === "truncate")
-        return scanTruncate(args, hits);
-    if (head === "shred") {
-        if (isLoneVersionOrHelp(args))
-            return;
-        hits.push({
-            severity: "critical",
-            categories: ["destructive", "data_loss", "irreversible_action"],
-            reason: "built-in destructive floor: shred overwrites a file in place",
-        });
-        return;
-    }
-    if (head === "mkfs" || head.startsWith("mkfs.")) {
-        if (isLoneVersionOrHelp(args))
-            return;
-        hits.push({
-            severity: "critical",
-            categories: ["destructive", "data_loss", "infrastructure_change"],
-            reason: "built-in destructive floor: mkfs formats a filesystem",
-        });
-        return;
-    }
-    if (head === "find")
-        return scanFind(args, hits);
-    if (GIT_TOKEN_RE.test(head))
-        return scanGit(args, hits);
-    if (head === "chmod" || head === "chown")
-        return scanChmodChown(head, args, hits);
-    if (head === "sed")
-        return scanSed(args, hits);
-    if (head === "curl")
-        return scanCurl(args, hits);
-}
-/**
- * `sh -c "<command>"` / `bash -lc '<command>'`: the nested command string
- * is re-scanned from the top. The `-c` value is reconstructed by rejoining
- * the tokens after the flag run (the whitespace tokenizer split the quoted
- * string apart) and stripping one layer of surrounding quotes.
- */
-function scanShellDashC(args, depth, hits) {
-    let i = 0;
-    let sawDashC = false;
-    for (; i < args.length; i += 1) {
-        const t = decodeShellWord(args[i]);
-        if (!t.startsWith("-"))
-            break;
-        if (t === "--") {
-            i += 1;
-            break;
-        }
-        if (!t.startsWith("--") && t.includes("c")) {
-            sawDashC = true;
-            i += 1;
-            break;
-        }
-        if (t === "--command") {
-            sawDashC = true;
-            i += 1;
-            break;
-        }
-    }
-    if (!sawDashC)
-        return;
-    const nested = stripOuterQuotes(args.slice(i).join(" "));
-    if (nested === "")
-        return;
-    scanCommand(nested, depth + 1, hits);
-}
-function stripOuterQuotes(s) {
-    const t = s.trim();
-    if (t.length >= 2) {
-        const first = t[0];
-        const last = t[t.length - 1];
-        if ((first === "'" || first === '"') && first === last)
-            return t.slice(1, -1);
-    }
-    return t;
-}
-/**
- * The literal name a head token invokes: decoded, with any path prefix
- * stripped. `NAME=value` assignment tokens and flags are returned
- * unchanged (stripping a `/` out of an assignment's VALUE would corrupt
- * the token `peelWrapperPrefixes` needs to recognise, and a flag has no
- * path prefix).
- */
-function headNameOf(token) {
-    const decoded = decodeShellWord(token);
-    if (decoded.startsWith("-"))
-        return decoded;
-    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(decoded))
-        return decoded;
-    const slash = decoded.lastIndexOf("/");
-    return slash === -1 ? decoded : decoded.slice(slash + 1);
-}
-/** `true` when `arg`, raw or decoded, satisfies `pred`. */
-function eitherForm(arg, pred) {
-    return pred(arg) || pred(decodeShellWord(arg));
-}
-/** `true` when `t` is a single-dash short-flag cluster containing `ch`. */
-function shortClusterHas(t, ch) {
-    return t.startsWith("-") && !t.startsWith("--") && t.slice(1).includes(ch);
-}
-/**
- * Flags that mean "print and exit", never "act". Same set and same
- * precedent as `VERSION_OR_HELP_FLAGS` in `read-only-bash.ts` (kept as a
- * local copy rather than an import so this module stays free of that
- * 2000-line predicate; the two sets are five literals and are pinned
- * against each other in tests/runtime/destructive-shell-floor.test.ts).
- */
-const VERSION_OR_HELP_FLAGS = new Set([
-    "--version", "-V", "-v", "--help", "-h",
-]);
-/**
- * `true` for an invocation whose ONLY argument is a help/version flag.
- *
- * The argument-free heads below (`shred`, `mkfs`) are matched on the head
- * token alone, because every real invocation of them destroys something.
- * That over-blocks the one shape that destroys nothing: `shred --help`.
- * The LONE requirement is what keeps this safe: `shred -v secret.txt` is
- * a real shred with a verbose flag and keeps its `critical`, and a bare
- * `shred -v` has no operand to destroy.
- *
- * NOTE, the same over-block in general: an argument-free head match fires
- * on ANY boundary-split fragment whose first token resolves to that head,
- * so a fragment like `echo mkfs` never reaches here (its head is `echo`)
- * but `mkfs` inside a quoted string the non-quote-aware split tore open
- * does. That is the deliberate direction for a floor that only RAISES
- * severity, and is the same trade the split itself documents.
- */
-function isLoneVersionOrHelp(args) {
-    return args.length === 1 && VERSION_OR_HELP_FLAGS.has(decodeShellWord(args[0]));
-}
-// `dd` writes only when it is given an output file. `dd if=/dev/sda | gzip`
-// (a read into a pipe) is deliberately NOT floored: it mutates nothing, and
-// flooring it would hard-block a backup on a production-resolved session,
-// the exact false positive this task exists to remove.
-function scanDd(args, hits) {
-    if (!args.some((a) => eitherForm(a, (t) => t.startsWith("of="))))
-        return;
-    hits.push({
-        severity: "critical",
-        categories: ["destructive", "data_loss"],
-        reason: "built-in destructive floor: dd with an of= write target",
-    });
-}
-// `truncate -s <size>` / `--size=<size>`, including the glued `-s0` form
-// and any cluster carrying `s` (`-cs 0`). Without a size there is nothing
-// to truncate to.
-function scanTruncate(args, hits) {
-    const sized = args.some((a) => eitherForm(a, (t) => t === "--size" || t.startsWith("--size=") || shortClusterHas(t, "s")));
-    if (!sized)
-        return;
-    hits.push({
-        severity: "critical",
-        categories: ["destructive", "data_loss"],
-        reason: "built-in destructive floor: truncate with a size argument",
-    });
-}
-// `find ... -delete` and `find ... -exec/-execdir rm`. Both spellings are
-// compared raw OR decoded, the measured bypass class from task fdee7d0f
-// (`-"delete"`, `-'delete'`, `-\delete` all reach find as `-delete`).
-function scanFind(args, hits) {
-    for (let i = 0; i < args.length; i += 1) {
-        const a = args[i];
-        if (eitherForm(a, (t) => t === "-delete")) {
-            hits.push({
-                severity: "critical",
-                categories: ["destructive", "data_loss"],
-                reason: "built-in destructive floor: find -delete",
-            });
-            continue;
-        }
-        if (eitherForm(a, (t) => t === "-exec" || t === "-execdir")) {
-            const payload = args[i + 1];
-            if (payload !== undefined && headNameOf(payload) === "rm") {
-                hits.push({
-                    severity: "critical",
-                    categories: ["destructive", "data_loss"],
-                    reason: "built-in destructive floor: find -exec rm",
-                });
-            }
-        }
-    }
-}
-/**
- * git's own global options sit BETWEEN the binary and the subcommand
- * (`git -C /repo push -f`), so they are skipped before the subcommand is
- * read, reusing command-normalize.ts's exported flag sets. `-c` is
- * deliberately absent from `GIT_GLOBAL_VALUE_TAKING_FLAGS` (config
- * injection can execute code); a command carrying it stops the walk and
- * simply yields no subcommand here.
- */
-function scanGit(args, hits) {
-    let i = 0;
-    while (i < args.length) {
-        const t = decodeShellWord(args[i]);
-        if (!t.startsWith("-"))
-            break;
-        if (GIT_GLOBAL_NO_VALUE_FLAGS.has(t)) {
-            i += 1;
-            continue;
-        }
-        const eq = t.indexOf("=");
-        const name = eq === -1 ? t : t.slice(0, eq);
-        if (GIT_GLOBAL_VALUE_TAKING_FLAGS.has(name)) {
-            i += eq === -1 ? 2 : 1;
-            continue;
-        }
-        break;
-    }
-    const sub = args[i] === undefined ? "" : decodeShellWord(args[i]);
-    const subArgs = args.slice(i + 1);
-    const push = (categories, reason) => {
-        hits.push({ severity: "high", categories, reason: `built-in destructive floor: ${reason}` });
-    };
-    if (sub === "reset" && subArgs.some((a) => eitherForm(a, (t) => t === "--hard"))) {
-        push(["destructive", "data_loss"], "git reset --hard");
-        return;
-    }
-    if (sub === "push") {
-        const forced = subArgs.some((a) => eitherForm(a, (t) => t === "--force" ||
-            t === "--force-with-lease" ||
-            t.startsWith("--force-with-lease=") ||
-            t.startsWith("+") ||
-            shortClusterHas(t, "f")));
-        if (forced)
-            push(["destructive", "production_mutation", "deployment_change"], "git push --force");
-        return;
-    }
-    if (sub === "clean") {
-        const forced = subArgs.some((a) => eitherForm(a, (t) => t === "--force" || shortClusterHas(t, "f")));
-        if (forced)
-            push(["destructive", "data_loss"], "git clean --force");
-        return;
-    }
-    if (sub === "checkout" || sub === "restore") {
-        const operands = subArgs.map((a) => decodeShellWord(a)).filter((t) => t !== "--");
-        if (operands.length === 1 && operands[0] === ".") {
-            push(["destructive", "data_loss"], `git ${sub} . discards every uncommitted change`);
-        }
-    }
-}
-// `chmod -R` / `chown -R` (and `--recursive`), cluster-aware so `-Rf` and
-// `-fR` are both caught. Categories: `mass_update` only, deliberately NOT
-// `destructive`/`data_loss`: a recursive mode or owner change rewrites
-// metadata across a tree (worth a `high` gate) but is reversible by the
-// inverse command, so the profile stays `reversible: true`.
-function scanChmodChown(head, args, hits) {
-    const recursive = args.some((a) => eitherForm(a, (t) => t === "--recursive" || shortClusterHas(t, "R")));
-    if (!recursive)
-        return;
-    hits.push({
-        severity: "high",
-        categories: ["mass_update"],
-        reason: `built-in destructive floor: ${head} -R rewrites a whole tree`,
-    });
-}
-// `sed -i` in every spelling: `-i`, `-i.bak`, the cluster `-ni`,
-// `--in-place`, `--in-place=SUFFIX`.
-function scanSed(args, hits) {
-    const inPlace = args.some((a) => eitherForm(a, (t) => t === "--in-place" || t.startsWith("--in-place=") || shortClusterHas(t, "i")));
-    if (!inPlace)
-        return;
-    hits.push({
-        severity: "high",
-        categories: ["destructive", "data_loss"],
-        reason: "built-in destructive floor: sed in-place edit",
-    });
-}
-/** curl flags that write a LOCAL file. */
-const CURL_LOCAL_WRITE_LONG_FLAGS = new Set([
-    "--output", "--remote-name", "--dump-header", "--cookie-jar", "--config",
-    "--create-dirs", "--output-dir", "--etag-save", "--trace", "--trace-ascii",
-    "--stderr", "--remote-header-name",
-]);
-const CURL_LOCAL_WRITE_SHORT_CHARS = ["o", "O", "D", "c", "K"];
-/** curl flags that send a REQUEST BODY (making the request a write). */
-const CURL_BODY_LONG_FLAGS = new Set([
-    "--data", "--data-raw", "--data-binary", "--data-urlencode", "--data-ascii",
-    "--json", "--form", "--form-string", "--form-escape", "--upload-file",
-]);
-const CURL_BODY_SHORT_CHARS = ["d", "F", "T"];
-/**
- * `-H`/`--header`: curl reads the VALUE from a local file when it starts
- * with `@` (`-H @/etc/passwd` sends that file's lines as request
- * headers).
- */
-const CURL_HEADER_FLAG = { long: "--header", short: "H" };
-/**
- * `-b`/`--cookie` uses a DIFFERENT rule than `-H`, measured on curl 8.7.1:
- * a value containing no `=` is read as a cookie-jar FILENAME, `@`-prefixed
- * or not (`curl -b jar.txt` reads the jar; `curl -b @jar.txt` opens a file
- * literally named `@jar.txt`, the `@` is not a file marker for this
- * flag). A value containing `=` is sent as inline cookie data
- * (`-b 'name=value'`) and stays inert.
- */
-const CURL_COOKIE_FLAG = { long: "--cookie", short: "b" };
-/**
- * The value curl reads for one flag, whichever of the three ways it is
- * spelled: `=`-joined (`--header=@f`), glued into a short-flag cluster
- * (`-H@f`, `-sH@f`), or the next argv token (`-H @f`, `--header @f`).
- * `undefined` when this token does not carry the flag at all.
- *
- * Short-flag lookup is a plain cluster search, so a value character that
- * happens to sit inside ANOTHER flag's glued value can be misread as this
- * flag. That direction only ever adds a candidate value to inspect, which
- * for a floor that exclusively RAISES severity is the safe one.
- */
-function curlFlagValue(token, next, longName, shortChar) {
-    const nextValue = () => next === undefined ? undefined : decodeShellWord(next);
-    if (token.startsWith("--")) {
-        const eq = token.indexOf("=");
-        if ((eq === -1 ? token : token.slice(0, eq)) !== longName)
-            return undefined;
-        return eq === -1 ? nextValue() : token.slice(eq + 1);
-    }
-    if (!token.startsWith("-"))
-        return undefined;
-    const at = token.indexOf(shortChar, 1);
-    if (at === -1)
-        return undefined;
-    const glued = token.slice(at + 1);
-    return glued.length > 0 ? glued : nextValue();
-}
-/** `true` when `t` is `-w`/`--write-out` in any spelling. */
-function isCurlWriteOutFlag(t) {
-    return t === "--write-out" || t.startsWith("--write-out=") || shortClusterHas(t, "w");
-}
-// What the read-only side no longer tries to decide. Decision D-013 removed
-// the `curl` `low` floor entirely: a per-flag allowlist has to know every
-// curl flag's write capability across curl versions, and two rounds of it
-// leaked. This scan carries the opposite, tractable obligation: it names
-// only capability it CAN name, and everything it does not name stays
-// unclassified (approval-gated) rather than floored.
-function scanCurl(args, hits) {
-    let localWrite = false;
-    let body = false;
-    let atFile = false;
-    // `-w`/`--write-out`'s format string writes a LOCAL FILE when it carries
-    // curl 8.3.0's `%output{FILE}` directive (verified on curl 8.7.1), which
-    // is the hole review round 3 found in the removed read-only floor: it
-    // allowlisted `-w` as inert. The format string is operator text that this
-    // module's whitespace tokenizer may have split across several tokens
-    // (`-w 'code=%{http_code} %output{/etc/x}'`), so `%output` is looked for
-    // in EVERY token once a write-out flag is present, not only in the one
-    // token that follows the flag. That over-matches a URL or an unrelated
-    // argument carrying the literal `%output`, which is the safe direction.
-    const decoded = args.map((a) => decodeShellWord(a));
-    if (decoded.some(isCurlWriteOutFlag) && decoded.some((t) => t.includes("%output"))) {
-        localWrite = true;
-    }
-    // `-H @FILE`: a LOCAL file read into the outgoing request. The `@` sits
-    // at the very start of the value, so the first token of the value is
-    // always the right place to look and the precise per-flag extraction is
-    // hole-free here.
-    //
-    // `-b`/`--cookie` is checked separately, by its own rule (see
-    // CURL_COOKIE_FLAG above): a value with no `=` is a filename curl reads,
-    // regardless of an `@` prefix.
-    for (let i = 0; i < args.length; i += 1) {
-        const headerValue = curlFlagValue(decoded[i], args[i + 1], CURL_HEADER_FLAG.long, CURL_HEADER_FLAG.short);
-        if (headerValue !== undefined && headerValue.startsWith("@"))
-            atFile = true;
-        const cookieValue = curlFlagValue(decoded[i], args[i + 1], CURL_COOKIE_FLAG.long, CURL_COOKIE_FLAG.short);
-        // An empty value (-b '') only switches curl's cookie engine on without
-        // opening a file; it is raised anyway, an accepted over-block in the safe
-        // direction.
-        if (cookieValue !== undefined && !cookieValue.includes("="))
-            atFile = true;
-    }
-    for (let i = 0; i < args.length; i += 1) {
-        const t = decodeShellWord(args[i]);
-        if (!t.startsWith("-") || t === "-" || t === "--")
-            continue;
-        const eq = t.indexOf("=");
-        const name = eq === -1 ? t : t.slice(0, eq);
-        if (name === "--request" || (t.startsWith("-X") && !t.startsWith("--"))) {
-            let value;
-            if (name === "--request") {
-                value = eq === -1 ? (args[i + 1] === undefined ? undefined : decodeShellWord(args[i + 1])) : t.slice(eq + 1);
-            }
-            else {
-                const glued = t.slice(2);
-                value = glued.length > 0 ? glued : args[i + 1] === undefined ? undefined : decodeShellWord(args[i + 1]);
-            }
-            const method = (value ?? "").toUpperCase();
-            if (method !== "" && method !== "GET" && method !== "HEAD")
-                body = true;
-            continue;
-        }
-        if (CURL_LOCAL_WRITE_LONG_FLAGS.has(name)) {
-            localWrite = true;
-            continue;
-        }
-        if (CURL_BODY_LONG_FLAGS.has(name)) {
-            body = true;
-            continue;
-        }
-        if (t.startsWith("--"))
-            continue;
-        if (CURL_LOCAL_WRITE_SHORT_CHARS.some((c) => shortClusterHas(t, c)))
-            localWrite = true;
-        if (CURL_BODY_SHORT_CHARS.some((c) => shortClusterHas(t, c)))
-            body = true;
-    }
-    if (localWrite) {
-        hits.push({
-            severity: "high",
-            categories: ["destructive", "data_loss"],
-            reason: "built-in destructive floor: curl writes a local file",
-        });
-    }
-    if (body) {
-        hits.push({
-            severity: "high",
-            categories: ["production_mutation", "network_exfiltration"],
-            reason: "built-in destructive floor: curl sends a request body or a non-GET/HEAD method",
-        });
-    }
-    if (atFile) {
-        // `network_exfiltration` alone, not the request-body pair: reading a
-        // local file into a header or a cookie ships data OUT, but it does not
-        // by itself mutate the remote resource, so `production_mutation` would
-        // be a claim this scan cannot make. Without an irreversible category
-        // the profile stays `reversible: true`, which is honest for a read.
-        hits.push({
-            severity: "high",
-            categories: ["network_exfiltration"],
-            reason: "built-in destructive floor: curl reads a local file into the request (@ value on -H, or a no-= value on -b)",
-        });
-    }
-}
-//# sourceMappingURL=destructive-shell-floor.js.map

package/dist/runtime/destructive-shell-floor.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"destructive-shell-floor.js","sourceRoot":"","sources":["../../src/runtime/destructive-shell-floor.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,yEAAyE;AACzE,gEAAgE;AAChE,sEAAsE;AACtE,uEAAuE;AACvE,2EAA2E;AAC3E,yEAAyE;AACzE,qEAAqE;AACrE,yEAAyE;AACzE,oEAAoE;AACpE,qEAAqE;AACrE,+DAA+D;AAC/D,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qCAAqC;AACrC,EAAE;AACF,qEAAqE;AACrE,2EAA2E;AAC3E,qEAAqE;AACrE,2EAA2E;AAC3E,sEAAsE;AACtE,2EAA2E;AAC3E,yEAAyE;AACzE,mEAAmE;AACnE,+CAA+C;AAC/C,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,qEAAqE;AACrE,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,0DAA0D;AAC1D,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,wEAAwE;AACxE,yCAAyC;AACzC,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,+BAA+B;AAG/B,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAUnE,2EAA2E;AAC3E,2EAA2E;AAC3E,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,yEAAyE;AACzE,iDAAiD;AACjD,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAEvC,wEAAwE;AACxE,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE5E,6DAA6D;AAC7D,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IAC/C,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;CAC1C,CAAC,CAAC;AAEH,mDAAmD;AACnD,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,MAAM,IAAI,GAA0B,EAAE,CAAC;IACvC,WAAW,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9B,2EAA2E;IAC3E,wEAAwE;IACxE,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,GAAG,KAAK,IAAI;QAAE,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,MAAM,CAAC,IAAoC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAA0B,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,KAAa,EAAE,IAA2B;IAC9E,IAAI,KAAK,GAAG,iBAAiB;QAAE,OAAO;IAEtC,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAClC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,SAA4B;IAC/C,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,yBAAyB;IACzB,MAAM,UAAU,GAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvF,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,iBAAiB,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,GAAG,CAAC;QACnB,0EAA0E;QAC1E,qEAAqE;QACrE,qCAAqC;QACrC,GAAG,GAAG,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,GAAG,IAAI,CAAC,CAAC;YACT,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,MAAM;YAAE,MAAM;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IACnC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD,CAAC;AAED,6EAA6E;AAC7E,SAAS,cAAc,CAAC,SAA4B,EAAE,KAAa,EAAE,IAA2B;IAC9F,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO;IAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAE/C,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,IAAI,mBAAmB,CAAC,IAAI,CAAC;YAAE,OAAO;QACtC,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,qBAAqB,CAAC;YAC/D,MAAM,EAAE,8DAA8D;SACvE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,IAAI,mBAAmB,CAAC,IAAI,CAAC;YAAE,OAAO;QACtC,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,uBAAuB,CAAC;YACjE,MAAM,EAAE,uDAAuD;SAChE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClF,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,IAAuB,EAAE,KAAa,EAAE,IAA2B;IACzF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM;QAC9B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,CAAC,IAAI,CAAC,CAAC;YACP,MAAM;QACR,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,QAAQ,GAAG,IAAI,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,MAAM;QACR,CAAC;QACD,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YACtB,QAAQ,GAAG,IAAI,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO;IAC1B,WAAW,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,2DAA2D;AAC3D,SAAS,UAAU,CAAC,GAAW,EAAE,IAA4B;IAC3D,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,2EAA2E;AAC3E,SAAS,eAAe,CAAC,CAAS,EAAE,EAAU;IAC5C,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI;CACxC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,mBAAmB,CAAC,IAAuB;IAClD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,uDAAuD;AACvD,SAAS,MAAM,CAAC,IAAuB,EAAE,IAA2B;IAClE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO;IACzE,IAAI,CAAC,IAAI,CAAC;QACR,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;QACxC,MAAM,EAAE,yDAAyD;KAClE,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,0EAA0E;AAC1E,kBAAkB;AAClB,SAAS,YAAY,CAAC,IAAuB,EAAE,IAA2B;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5B,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAC3F,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,CAAC,IAAI,CAAC;QACR,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;QACxC,MAAM,EAAE,2DAA2D;KACpE,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,wEAAwE;AACxE,sEAAsE;AACtE,SAAS,QAAQ,CAAC,IAAuB,EAAE,IAA2B;IACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC;gBACR,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;gBACxC,MAAM,EAAE,0CAA0C;aACnD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC1D,IAAI,CAAC,IAAI,CAAC;oBACR,QAAQ,EAAE,UAAU;oBACpB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;oBACxC,MAAM,EAAE,2CAA2C;iBACpD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,OAAO,CAAC,IAAuB,EAAE,IAA2B;IACnE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM;QAC9B,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,MAAM;IACR,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,UAAmC,EAAE,MAAc,EAAQ,EAAE;QACzE,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,+BAA+B,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC;IAEF,IAAI,GAAG,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAChC,UAAU,CACR,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,SAAS;YACf,CAAC,KAAK,oBAAoB;YAC1B,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC;YACnC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YACjB,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAC1B,CACF,CAAC;QACF,IAAI,MAAM;YAAE,IAAI,CAAC,CAAC,aAAa,EAAE,qBAAqB,EAAE,mBAAmB,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAChC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CACjE,CAAC;QACF,IAAI,MAAM;YAAE,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAClF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACjD,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,GAAG,sCAAsC,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,wEAAwE;AACxE,4DAA4D;AAC5D,SAAS,cAAc,CAAC,IAAY,EAAE,IAAuB,EAAE,IAA2B;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAChC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,IAAI,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CACrE,CAAC;IACF,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,IAAI,CAAC,IAAI,CAAC;QACR,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,aAAa,CAAC;QAC3B,MAAM,EAAE,+BAA+B,IAAI,2BAA2B;KACvE,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,qCAAqC;AACrC,SAAS,OAAO,CAAC,IAAuB,EAAE,IAA2B;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9B,UAAU,CACR,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CACpF,CACF,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,CAAC,IAAI,CAAC;QACR,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;QACxC,MAAM,EAAE,+CAA+C;KACxD,CAAC,CAAC;AACL,CAAC;AAED,0CAA0C;AAC1C,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAC;IAC/D,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,UAAU;IACxE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe;IAC1E,UAAU,EAAE,sBAAsB;CACnC,CAAC,CAAC;AACH,MAAM,4BAA4B,GAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAClF,wEAAwE;AACxE,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IACxD,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc;IAC3E,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe;CACtE,CAAC,CAAC;AACH,MAAM,qBAAqB,GAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,gBAAgB,GAAoC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAE3F;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAoC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAE3F;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CACpB,KAAa,EACb,IAAwB,EACxB,QAAgB,EAChB,SAAiB;IAEjB,MAAM,SAAS,GAAG,GAAuB,EAAE,CACzC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5E,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACvC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,6DAA6D;AAC7D,SAAS,kBAAkB,CAAC,CAAS;IACnC,OAAO,CAAC,KAAK,aAAa,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxF,CAAC;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,qEAAqE;AACrE,qDAAqD;AACrD,SAAS,QAAQ,CAAC,IAAuB,EAAE,IAA2B;IACpE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,0EAA0E;IAC1E,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACnF,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,wEAAwE;IACxE,kBAAkB;IAClB,EAAE;IACF,8DAA8D;IAC9D,yEAAyE;IACzE,+BAA+B;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,aAAa,CAC/B,OAAO,CAAC,CAAC,CAAE,EACX,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EACX,gBAAgB,CAAC,IAAI,EACrB,gBAAgB,CAAC,KAAK,CACvB,CAAC;QACF,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,IAAI,CAAC;QAE5E,MAAM,WAAW,GAAG,aAAa,CAC/B,OAAO,CAAC,CAAC,CAAE,EACX,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EACX,gBAAgB,CAAC,IAAI,EACrB,gBAAgB,CAAC,KAAK,CACvB,CAAC;QACF,uEAAuE;QACvE,0EAA0E;QAC1E,aAAa;QACb,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,IAAI,CAAC;IAC7E,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAC5D,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACxE,IAAI,KAAyB,CAAC;YAC9B,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACzB,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAChH,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3C,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;gBAAE,IAAI,GAAG,IAAI,CAAC;YACxE,SAAS;QACX,CAAC;QACD,IAAI,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,UAAU,GAAG,IAAI,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,GAAG,IAAI,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACjC,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;QACvF,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC;IAC5E,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;YACxC,MAAM,EAAE,sDAAsD;SAC/D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;YAC3D,MAAM,EAAE,gFAAgF;SACzF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,CAAC,sBAAsB,CAAC;YACpC,MAAM,EACJ,6GAA6G;SAChH,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}