@namzu/sdk 45.1.0 → 48.0.0

package/dist/authorization/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/authorization/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAGjE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAYzE,MAAM,UAAU,YAAY,CAC3B,IAAuB,EACvB,QAAgB,EAChB,SAAkB,EAClB,OAAmC,EACnC,eAAwB,EACxB,OAAqB,EACrB,UAA+B,EAAE;IAEjC,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAA;IAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACxB,kEAAkE;YAClE,oEAAoE;YACpE,sBAAsB;YACtB,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAA;YAEvD,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,6CAA6C;YAC7C,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAA;YAClC,IAAI,QAAQ,IAAI,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YAEvE,OAAO,OAAO,CAAA;QACf,CAAC;QAED,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAChC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC5C,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;gBAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9B,OAAO,MAAM,CAAA;gBACd,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YAC1B,IAAI,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrE,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/C,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACrB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9C,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAA;YAEjC,IAAI,MAAc,CAAA;YAClB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrB,KAAK,MAAM;oBACV,MAAM,GAAG,QAAQ,CAAA;oBACjB,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;oBAClC,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAA;oBACnD,MAAK;gBACN,OAAO,CAAC,CAAC,CAAC;oBACT,MAAM,WAAW,GAAU,IAAI,CAAC,MAAM,CAAA;oBACtC,MAAM,IAAI,KAAK,CAAC,oCAAoC,WAAqB,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAC3D,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAA;YACjC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YAExC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YACpE,MAAM,KAAK,GAAI,SAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAEnE,oEAAoE;YACpE,iEAAiE;YACjE,2DAA2D;YAC3D,EAAE;YACF,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,MAAM,OAAO,GACZ,OAAO,KAAK,KAAK,QAAQ;gBACxB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;oBACxD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACf,CAAC,CAAC,SAAS,CAAA;YACd,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAEtC,iEAAiE;YACjE,iEAAiE;YACjE,iEAAiE;YACjE,IACC,OAAO,KAAK,KAAK,QAAQ;gBACzB,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC,QAAQ;gBACvC,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,QAAQ,EACxC,CAAC;gBACF,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;YAC5D,CAAC;YAED,mEAAmE;YACnE,qEAAqE;YACrE,qDAAqD;YACrD,6DAA6D;YAC7D,8CAA8C;YAC9C,EAAE;YACF,oEAAoE;YACpE,+DAA+D;YAC/D,iDAAiD;YACjD,gCAAgC;YAChC,MAAM,KAAK,GAAG,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC,QAAQ,CAAA;YACpD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK;gBACjC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;gBACxC,CAAC,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAEzC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC5D,uDAAuD;gBACvD,0DAA0D;gBAC1D,6DAA6D;gBAC7D,iEAAiE;gBACjE,EAAE;gBACF,iEAAiE;gBACjE,mDAAmD;gBACnD,8DAA8D;gBAC9D,iEAAiE;gBACjE,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;oBAAE,OAAO,IAAI,CAAC,QAAQ,CAAA;gBACvD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC,QAAQ,CAAA;gBACnF,IAAI,KAAK;oBAAE,OAAO,IAAI,CAAA;gBACtB,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAClF,CAAC,CAAC,IAAI,CAAC,QAAQ;oBACf,CAAC,CAAC,IAAI,CAAA;YACR,CAAC;YAED,mEAAmE;YACnE,mEAAmE;YACnE,yDAAyD;YACzD,iBAAiB;YACjB,IAAI,MAAM;gBAAE,OAAO,IAAI,CAAA;YACvB,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QACnF,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,WAAW,CAAC,CAAC,CAAC;YAClB,mEAAmE;YACnE,kEAAkE;YAClE,+CAA+C;YAC/C,IAAI,CAAC;gBACJ,OAAO,IAAI,CAAC,MAAM,CAAC;oBAClB,QAAQ;oBACR,SAAS;oBACT,OAAO;oBACP,cAAc,EAAE,OAAO;iBACvB,CAAC,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,MAAM,CAAA;YACd,CAAC;QACF,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,IAAI,CAAA;YAC/B,MAAM,IAAI,KAAK,CAAC,qCAAsC,WAAgC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC/F,CAAC;IACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/authorization/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAIhE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAoBzE,MAAM,UAAU,YAAY,CAC3B,IAAuB,EACvB,QAAgB,EAChB,SAAkB,EAClB,OAAmC,EACnC,eAAwB,EACxB,OAAqB,EACrB,UAA+B,EAAE;IAEjC,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAA;IAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACxB,kEAAkE;YAClE,oEAAoE;YACpE,sBAAsB;YACtB,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAA;YAE3E,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,6CAA6C;YAC7C,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAA;YAClC,IAAI,QAAQ,IAAI,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YAEvE,mEAAmE;YACnE,gDAAgD;YAChD,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,gDAAgD;YAChD,IAAI,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAA;YAEnD,OAAO,OAAO,CAAA;QACf,CAAC;QAED,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAChC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC5C,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;gBAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9B,OAAO,MAAM,CAAA;gBACd,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YAC1B,IAAI,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrE,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/C,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACrB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9C,CAAC;QAED,KAAK,WAAW,CAAC,CAAC,CAAC;YAClB,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAA;YACjC,OAAO,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC3F,CAAC,CAAC,IAAI,CAAC,QAAQ;gBACf,CAAC,CAAC,IAAI,CAAA;QACR,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAA;YAEjC,IAAI,MAAc,CAAA;YAClB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrB,KAAK,MAAM;oBACV,MAAM,GAAG,QAAQ,CAAA;oBACjB,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;oBAClC,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAA;oBACnD,MAAK;gBACN,OAAO,CAAC,CAAC,CAAC;oBACT,MAAM,WAAW,GAAU,IAAI,CAAC,MAAM,CAAA;oBACtC,MAAM,IAAI,KAAK,CAAC,oCAAoC,WAAqB,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAC3D,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAA;YACjC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YAExC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YACpE,MAAM,KAAK,GAAI,SAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAEnE,oEAAoE;YACpE,iEAAiE;YACjE,2DAA2D;YAC3D,EAAE;YACF,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,MAAM,OAAO,GACZ,OAAO,KAAK,KAAK,QAAQ;gBACxB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;oBACxD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACf,CAAC,CAAC,SAAS,CAAA;YACd,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAEtC,iEAAiE;YACjE,iEAAiE;YACjE,iEAAiE;YACjE,IACC,OAAO,KAAK,KAAK,QAAQ;gBACzB,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC,QAAQ;gBACvC,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,QAAQ,EACxC,CAAC;gBACF,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;YAC5D,CAAC;YAED,mEAAmE;YACnE,qEAAqE;YACrE,qDAAqD;YACrD,6DAA6D;YAC7D,8CAA8C;YAC9C,EAAE;YACF,oEAAoE;YACpE,+DAA+D;YAC/D,iDAAiD;YACjD,gCAAgC;YAChC,MAAM,KAAK,GAAG,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC,QAAQ,CAAA;YACpD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK;gBACjC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;gBACxC,CAAC,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAEzC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC5D,uDAAuD;gBACvD,0DAA0D;gBAC1D,6DAA6D;gBAC7D,iEAAiE;gBACjE,EAAE;gBACF,iEAAiE;gBACjE,mDAAmD;gBACnD,8DAA8D;gBAC9D,iEAAiE;gBACjE,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;oBAAE,OAAO,IAAI,CAAC,QAAQ,CAAA;gBACvD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC,QAAQ,CAAA;gBACnF,IAAI,KAAK;oBAAE,OAAO,IAAI,CAAA;gBACtB,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAClF,CAAC,CAAC,IAAI,CAAC,QAAQ;oBACf,CAAC,CAAC,IAAI,CAAA;YACR,CAAC;YAED,mEAAmE;YACnE,mEAAmE;YACnE,yDAAyD;YACzD,iBAAiB;YACjB,IAAI,MAAM;gBAAE,OAAO,IAAI,CAAA;YACvB,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QACnF,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,WAAW,CAAC,CAAC,CAAC;YAClB,mEAAmE;YACnE,kEAAkE;YAClE,+CAA+C;YAC/C,IAAI,CAAC;gBACJ,OAAO,IAAI,CAAC,MAAM,CAAC;oBAClB,QAAQ;oBACR,SAAS;oBACT,OAAO;oBACP,cAAc,EAAE,OAAO;iBACvB,CAAC,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,MAAM,CAAA;YACd,CAAC;QACF,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,IAAI,CAAA;YAC/B,MAAM,IAAI,KAAK,CAAC,qCAAsC,WAAgC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC/F,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,OAAmC,EAAE,SAAkB;IAC9E,IAAI,CAAC,OAAO,EAAE,cAAc;QAAE,OAAO,KAAK,CAAA;IAC1C,IAAI,CAAC;QACJ,OAAO,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACR,+DAA+D;QAC/D,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC"}

package/dist/authorization/shell-lexer.d.ts

@@ -69,6 +69,14 @@ export interface ShellWord {
     readonly expands: boolean;
     /** True when any part of the word was quoted or escaped. */
     readonly quoted: boolean;
+    /**
+     * True when the word reads a `$(…)` or backtick substitution. Read by
+     * `redirectionTarget()`: an unquoted substitution used as a `<`/`>`
+     * redirection target can run twice (measured, bash 5.2.21 and 5.3.15,
+     * for a `${var:-…}`-style default value that turns out ambiguous), so
+     * such a target is opaque rather than trusted to run once.
+     */
+    readonly substitutes: boolean;
 }
 /** A redirection: `2>&1`, `> file`, `<<EOF` and the rest. */
 export interface ShellRedirection {
@@ -141,6 +149,37 @@ export interface ShellLexResult {
  * is a close approximation, and the line is only as exact as that.
  */
 export declare const NESTED_SHELLS: ReadonlySet<string>;
+/** What {@link nestedShellCommand} found: the payload the lexer reads, or why it could not. */
+export type NestedShellCommand = {
+    /** The shell's basename, one of {@link NESTED_SHELLS}. */
+    readonly shell: string;
+    /** The `-c` argument, read as a command line of its own. */
+    readonly payload: ShellWord;
+} | {
+    /** Why the lexer calls the line opaque instead (`nested shell option` …). */
+    readonly opaque: string;
+};
+/**
+ * Whether the lexer reads a simple command's payload as a command line of
+ * its own: `words` are the command's words without its leading assignments.
+ * The command must, after unwrapping a chain of re-exec wrappers this
+ * recognises (`sudo`, `env`, `nice`, `timeout`, … — {@link unwrapReexecChain}
+ * in `reexec-wrapper.ts`, shared with `program.ts` so the two can never
+ * quietly disagree about where one ends), start a shell in
+ * {@link NESTED_SHELLS} by basename, exactly as written (`bash`, `/bin/sh`;
+ * not `bash.exe`, `BASH` or `fish`), or `busybox`/`toybox` running one, with
+ * `-c` among its options (clustered short forms included, `-ec`, `-lc`); the
+ * payload is the first argument that is not an option. `null` when it reads
+ * no payload — including when a wrapper consumed the whole line (`chroot
+ * /mnt` alone) or hit an option it does not recognise, in which case the
+ * whole line is opaque instead (below), not silently read as unremarkable.
+ *
+ * A host deciding on {@link lexShellCommandLine}'s reading uses this to know
+ * which text that reading already includes. Every other text a program runs
+ * as code — `powershell -c '…'`, `fish -c '…'`, `bash.exe -c '…'`, a script
+ * — is not in it.
+ */
+export declare function nestedShellCommand(words: readonly ShellWord[]): NestedShellCommand | null;
 import type { ShellDialect } from '../types/tool/index.js';
 export type { ShellDialect };
 export interface ShellLexOptions {

package/dist/authorization/shell-lexer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell-lexer.d.ts","sourceRoot":"","sources":["../../src/authorization/shell-lexer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,uEAAuE;AACvE,MAAM,WAAW,SAAS;IACzB,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACxB;AAED,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,0BAA0B;AAC1B,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAA;IACpC,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAClD;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,OAAO,CAAA;IAClD,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,cAAc;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAA;IAC1C;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAClD;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,SAAS,SAAS,EAAE,CAAA;IAC5C,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAQ5C,CAAA;AAOF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAE1D,YAAY,EAAE,YAAY,EAAE,CAAA;AAE5B,MAAM,WAAW,eAAe;IAC/B,sBAAsB;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;CAC/B;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,cAAc,CAmB/F;AA2mED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG7C"}
+{"version":3,"file":"shell-lexer.d.ts","sourceRoot":"","sources":["../../src/authorization/shell-lexer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,uEAAuE;AACvE,MAAM,WAAW,SAAS;IACzB,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC7B;AAED,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,0BAA0B;AAC1B,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAA;IACpC,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAClD;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,OAAO,CAAA;IAClD,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,cAAc;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAA;IAC1C;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAClD;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,SAAS,SAAS,EAAE,CAAA;IAC5C,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAAqB,CAAA;AAEnE,+FAA+F;AAC/F,MAAM,MAAM,kBAAkB,GAC3B;IACA,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;CAC1B,GACD;IACA,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACtB,CAAA;AAEJ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,kBAAkB,GAAG,IAAI,CAWzF;AAOD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAS1D,YAAY,EAAE,YAAY,EAAE,CAAA;AAE5B,MAAM,WAAW,eAAe;IAC/B,sBAAsB;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;CAC/B;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,cAAc,CAmB/F;AA+nED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG7C"}

package/dist/authorization/shell-lexer.js

@@ -56,19 +56,50 @@
  * payload is decoded as bash reads it; for `dash` and friends the bash reading
  * is a close approximation, and the line is only as exact as that.
  */
-export const NESTED_SHELLS = new Set([
-    'sh',
-    'bash',
-    'zsh',
-    'dash',
-    'ksh',
-    'ash',
-    'mksh',
-]);
+export const NESTED_SHELLS = PLAIN_SHELL_NAMES;
+/**
+ * Whether the lexer reads a simple command's payload as a command line of
+ * its own: `words` are the command's words without its leading assignments.
+ * The command must, after unwrapping a chain of re-exec wrappers this
+ * recognises (`sudo`, `env`, `nice`, `timeout`, … — {@link unwrapReexecChain}
+ * in `reexec-wrapper.ts`, shared with `program.ts` so the two can never
+ * quietly disagree about where one ends), start a shell in
+ * {@link NESTED_SHELLS} by basename, exactly as written (`bash`, `/bin/sh`;
+ * not `bash.exe`, `BASH` or `fish`), or `busybox`/`toybox` running one, with
+ * `-c` among its options (clustered short forms included, `-ec`, `-lc`); the
+ * payload is the first argument that is not an option. `null` when it reads
+ * no payload — including when a wrapper consumed the whole line (`chroot
+ * /mnt` alone) or hit an option it does not recognise, in which case the
+ * whole line is opaque instead (below), not silently read as unremarkable.
+ *
+ * A host deciding on {@link lexShellCommandLine}'s reading uses this to know
+ * which text that reading already includes. Every other text a program runs
+ * as code — `powershell -c '…'`, `fish -c '…'`, `bash.exe -c '…'`, a script
+ * — is not in it.
+ */
+export function nestedShellCommand(words) {
+    if (words.length === 0)
+        return null;
+    const chained = unwrapReexecChain(words);
+    if ('unknown' in chained)
+        return { opaque: chained.unknown };
+    if ('none' in chained)
+        return null;
+    const invocation = shellInvocation(chained.rest);
+    if (invocation === null)
+        return null;
+    const found = shellDashC(invocation.rest);
+    if ('unknown' in found)
+        return { opaque: found.unknown };
+    if ('none' in found)
+        return null;
+    return { shell: invocation.shell, payload: found.payload };
+}
 /** How many `bash -c` payloads deep the lexer follows before it gives up. */
 const MAX_SHELL_DEPTH = 4;
 /** How deep compound commands and expansions may nest before it gives up. */
 const MAX_NESTING = 100;
+import { PLAIN_SHELL_NAMES, REEXEC_WRAPPER_NAMES, shellDashC, shellInvocation, unwrapReexecChain, } from './reexec-wrapper.js';
 export function lexShellCommandLine(line, options = {}) {
     const context = new Context(line.length);
     context.setDialect(line, options.dialect ?? 'bash');
@@ -226,6 +257,14 @@ class WordBuilder {
     quoted = false;
     /** A brace expansion, which POSIX shells do not perform. */
     brace = false;
+    /**
+     * A `$(…)` or backtick substitution read in this word. Brace expansion
+     * happens on the word's raw text BEFORE any expansion runs, so `{a,b}`
+     * beside one duplicates it — `$(cmd){a,b}` runs `cmd` once per brace
+     * alternative, not once — which the recursive read below does not
+     * model; `brace && substitutes` together are opaque instead of trusted.
+     */
+    substitutes = false;
     /** Unquoted `{` seen, and whether a `,` or `..` followed it: brace expansion. */
     braceOpen = false;
     braceSeparator = false;
@@ -270,6 +309,11 @@ class WordBuilder {
         this.value += text;
         this.empty = false;
     }
+    /** A `$(…)` or backtick substitution, kept as written. */
+    substitution(text) {
+        this.substitutes = true;
+        this.expansion(text);
+    }
 }
 // ---------------------------------------------------------------------------
 // The parser. One instance per string and per nesting of `$(…)`; the token
@@ -950,6 +994,19 @@ class Parser {
             // Ubuntu ship).
             this.context.opaque('quoted or expanding target of >& or <&');
         }
+        if (['<', '>', '<>', '>>', '>|'].includes(operator.op) &&
+            !target.word.quoted &&
+            target.word.substitutes) {
+            // A `<`/`>`-family target must be exactly one word; when it is not
+            // (empty, or several), bash reports "ambiguous redirect" — and for
+            // a `${var:-…}`-style default value, running that check evaluates
+            // the substitution in it a SECOND time (measured, bash 5.2.21 and
+            // 5.3.15: `<${a:-$(a)}` and `>${a:-$(a)}` both run `a` twice, a
+            // bare `<$(a)` or `<a$(a)` only once). Whether the default branch
+            // even runs depends on whether the variable is set at runtime, so
+            // this is opaque rather than trusted to run once.
+            this.context.opaque('unquoted substitution in a redirection target');
+        }
         const redirection = {
             operator: operator.op,
             ...(operator.fd !== undefined ? { fd: operator.fd } : {}),
@@ -990,8 +1047,8 @@ class Parser {
         if (name !== 'shopt' &&
             name !== 'enable' &&
             name !== 'set' &&
-            name !== 'busybox' &&
-            !NESTED_SHELLS.has(name))
+            !NESTED_SHELLS.has(name) &&
+            !REEXEC_WRAPPER_NAMES.has(name))
             return;
         const words = command.words.slice(command.assignments);
         if (name === 'shopt' || name === 'enable') {
@@ -1012,60 +1069,17 @@ class Parser {
             }
             return;
         }
-        if (name === 'busybox' && words[1] !== undefined && !words[1].expands) {
-            if (NESTED_SHELLS.has(basename(words[1].value)))
-                this.nestedShell(words.slice(1));
-            return;
-        }
-        if (!NESTED_SHELLS.has(name))
-            return;
-        this.nestedShell(words);
-    }
-    /**
-     * `bash [options] -c payload [name args…]`: the payload is the first
-     * non-option argument once `-c` has been seen among the options.
-     */
-    nestedShell(words) {
-        const shell = basename(words[0]?.value ?? '');
-        let command = false;
-        let payload;
-        for (let i = 1; i < words.length; i += 1) {
-            const word = words[i];
-            if (word.expands) {
-                this.context.opaque('nested shell option');
-                return;
-            }
-            const value = word.value;
-            if (value === '--' || value === '-') {
-                payload = words[i + 1];
-                break;
-            }
-            if (value.startsWith('--')) {
-                if (value === '--rcfile' || value === '--init-file')
-                    i += 1;
-                continue;
-            }
-            if (/^[-+][A-Za-z]+$/.test(value)) {
-                if (value.startsWith('-') && value.includes('c'))
-                    command = true;
-                // `-o name`, `-O name`: the option takes the next word.
-                if (/[oO]$/.test(value))
-                    i += 1;
-                continue;
-            }
-            payload = word;
-            break;
-        }
-        if (!command)
-            return;
-        if (payload === undefined) {
-            this.context.opaque('nested shell without a command');
+        const nested = nestedShellCommand(words);
+        if (nested === null)
             return;
-        }
-        if (payload.expands) {
-            this.context.opaque('nested shell command is expanded at runtime');
+        if ('opaque' in nested) {
+            this.context.opaque(nested.opaque);
             return;
         }
+        this.nestedShell(nested.shell, nested.payload);
+    }
+    /** Read the payload of `bash -c payload` as a command line of its own. */
+    nestedShell(shell, payload) {
         if (this.depth + 1 >= MAX_SHELL_DEPTH) {
             this.context.opaque('nested shells too deep');
             return;
@@ -1230,7 +1244,7 @@ class Parser {
                     kind: 'word',
                     start,
                     end: start + 1,
-                    word: { text: '-', value: '-', expands: false, quoted: false },
+                    word: { text: '-', value: '-', expands: false, quoted: false, substitutes: false },
                     reservedOk: false,
                 };
             }
@@ -1620,11 +1634,19 @@ class Parser {
         this.pos = i;
         if (builder.brace)
             this.bashOnly('brace expansion');
+        // Brace expansion runs on the word's raw text before any substitution
+        // does, so `$(cmd){a,b}` duplicates `$(cmd)` into two copies that
+        // each run `cmd` — the commands pushed while reading this word are
+        // not the one-time account the recursive read otherwise gives.
+        if (builder.brace && builder.substitutes) {
+            this.context.opaque('command substitution duplicated by brace expansion');
+        }
         const word = {
             text: src.slice(start, i),
             value: builder.value,
             expands: builder.expands,
             quoted: builder.quoted,
+            substitutes: builder.substitutes,
         };
         // A descriptor before a redirection operator: `2>`, `{fd}>`.
         const next = src[i];
@@ -1795,7 +1817,7 @@ class Parser {
                 builder.expansion(src.slice(at, end));
                 return end;
             }
-            const end = this.parameterBraces(n + 1, inDouble);
+            const end = this.parameterBraces(n + 1, inDouble, builder);
             builder.expansion(src.slice(at, end));
             return end;
         }
@@ -1809,10 +1831,21 @@ class Parser {
                     return end;
                 }
             }
-            this.context.opaque('command substitution');
+            // `$(…)`'s body is read as a command list of its own, the same
+            // way `nestedShell()` reads a `bash -c` payload: each command
+            // found inside it is pushed to the shared `context.commands`
+            // (marked `origin: 'substitution'`), checked by the same deny
+            // rules, instead of the containing line being called opaque
+            // outright. Finding the matching `)` requires the parse to
+            // succeed — a `)` inside a quoted string or a `case` pattern is
+            // not it — so a substitution that does not parse throws all the
+            // way to `lexShellCommandLine`'s own catch, which is the only
+            // sound way to be wrong about its extent, and marks the whole
+            // line opaque (`internal error`) exactly as any other
+            // unmodeled construct does.
             const inner = new Parser(src, n + 1, this.context, 'substitution', this.depth, this.nestingNow + 1);
             const end = inner.substitution();
-            builder.expansion(src.slice(at, end));
+            builder.substitution(src.slice(at, end));
             return end;
         }
         if (next === '[') {
@@ -1887,7 +1920,7 @@ class Parser {
      * (indirection, a subscript or offset evaluated as arithmetic, a
      * transformation) is opaque.
      */
-    parameterBraces(from, inDouble) {
+    parameterBraces(from, inDouble, builder) {
         const src = this.src;
         let i = from;
         const scratch = new WordBuilder();
@@ -1942,6 +1975,12 @@ class Parser {
             this.context.opaque('parameter expansion');
         else if (!POSIX_PARAMETER.test(content))
             this.bashOnly('parameter expansion');
+        // A substitution inside the default-value expression (`${a:-$(cmd)}`)
+        // is read into a scratch builder discarded above; propagate whether
+        // it happened onto the enclosing word, which is what the caller's
+        // own brace-expansion check reads.
+        if (scratch.substitutes)
+            builder.substitutes = true;
         return i + 1;
     }
     /** After `$'`: decode to the closing quote. */
@@ -2087,8 +2126,12 @@ class Parser {
             body += char;
             i += 1;
         }
-        this.context.opaque('command substitution');
-        builder.expansion(src.slice(at, i + 1));
+        // Backtick's extent is found lexically, above — unlike `$(…)`, its
+        // boundary does not depend on the body parsing as commands. So a
+        // body that fails to parse is caught here, the same way a `bash -c`
+        // payload's own failure is (`nestedShell()`): the rest of the LINE
+        // is still read, only this substitution's own commands are unknown.
+        builder.substitution(src.slice(at, i + 1));
         this.context.rescan(body.length);
         this.inherit(body);
         const inner = new Parser(body, 0, this.context, 'substitution', this.depth, this.nestingNow + 1);
@@ -2098,6 +2141,7 @@ class Parser {
         catch (error) {
             if (!(error instanceof Stop))
                 throw error;
+            this.context.opaque(`command substitution: ${error.reason}`);
         }
         return i + 1;
     }