@orc-brain/core 1.0.0

package/dist/safety/denyRules.js

@@ -0,0 +1,498 @@
+/**
+ * Destructive-command interception (§8.2). Bash input is parsed with a real
+ * shell tokenizer (not regex-only) to unwrap `sh -c`, `xargs`, `env`, `sudo`,
+ * command substitution, and `&&` chains, then each resolved command is matched
+ * against rule classes. A regex backstop covers unparseable input and
+ * substitution-hidden binaries; unparseable input denies in production scopes.
+ */
+import { parse as shellParse } from "shell-quote";
+import { isProductionLike } from "./envClassifier.js";
+import { isCredentialPath, isDotenvPath, isPathAllowed, toAbsolute, } from "./paths.js";
+const SEVERITY = {
+    deny: 3,
+    require_approval: 2,
+    allow_with_audit: 1,
+    allow: 0,
+};
+const ALLOW = { verdict: "allow", match: null };
+/** Maps a matched rule class to a verdict given the scope environment (§8.2). */
+function verdictFor(cls, ctx) {
+    // Production-flagged scopes always deny. Not configurable off (§2, §8).
+    if (isProductionLike(ctx.environment))
+        return "deny";
+    const posture = ctx.dev_posture[cls] ?? "require_approval";
+    if (posture === "allow_with_audit")
+        return "allow_with_audit";
+    if (posture === "deny")
+        return "deny";
+    return "require_approval";
+}
+/** Wraps a rule match into an environment-aware decision. */
+function decide(match, ctx) {
+    return { verdict: verdictFor(match.rule_class, ctx), match };
+}
+/** Keeps the most-severe of two decisions. */
+function worse(a, b) {
+    return SEVERITY[b.verdict] > SEVERITY[a.verdict] ? b : a;
+}
+const CONTROL_OPS = new Set([";", "&&", "||", "|", "&", "\n"]);
+const REDIR_OPS = new Set([">", ">>", "<", ">&", "&>", "<<", "<<<"]);
+/** Splits a shell-quote token stream into individual commands. */
+function splitCommands(tokens) {
+    const cmds = [];
+    let cur = { args: [], redirects: [] };
+    let expectRedirTarget = false;
+    const flush = (op) => {
+        if (cur.args.length || cur.redirects.length) {
+            cur.nextOp = op;
+            cmds.push(cur);
+        }
+        cur = { args: [], redirects: [] };
+    };
+    for (const tok of tokens) {
+        if (typeof tok === "string") {
+            if (expectRedirTarget) {
+                cur.redirects.push(tok);
+                expectRedirTarget = false;
+            }
+            else {
+                cur.args.push(tok);
+            }
+            continue;
+        }
+        // Object token: operator or glob.
+        if ("pattern" in tok && typeof tok.pattern === "string") {
+            if (expectRedirTarget) {
+                cur.redirects.push(tok.pattern);
+                expectRedirTarget = false;
+            }
+            else {
+                cur.args.push(tok.pattern);
+            }
+            continue;
+        }
+        const op = "op" in tok ? tok.op : undefined;
+        if (!op)
+            continue;
+        if (CONTROL_OPS.has(op)) {
+            flush(op);
+        }
+        else if (REDIR_OPS.has(op)) {
+            expectRedirTarget = true;
+        }
+        else if (op === "(" || op === ")") {
+            // Subshell boundary — treat inner commands as their own segments.
+            flush();
+        }
+        // `$`, other ops ignored.
+    }
+    flush();
+    return cmds;
+}
+const WRAPPERS = new Set([
+    "sudo",
+    "nice",
+    "nohup",
+    "time",
+    "command",
+    "builtin",
+    "doas",
+]);
+const SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh", "fish"]);
+/**
+ * Resolves wrapper commands to the real command they invoke, returning the
+ * inner shell scripts that must be parsed recursively.
+ */
+function unwrap(cmd) {
+    let args = [...cmd.args];
+    const nestedScripts = [];
+    // Strip `env VAR=val ...`.
+    if (args[0] === "env") {
+        args = args.slice(1);
+        while (args.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(args[0])) {
+            args = args.slice(1);
+        }
+    }
+    // Strip wrappers and any options they carry, so `nice -n 10 rm -rf` and
+    // `sudo -u root rm -rf` resolve to the real command (§13.1 bypass class).
+    const OPT_WITH_VALUE = new Set([
+        "-n",
+        "-u",
+        "-g",
+        "-p",
+        "--user",
+        "--group",
+        "--adjustment",
+    ]);
+    while (args.length && WRAPPERS.has(args[0])) {
+        args = args.slice(1);
+        while (args.length && args[0].startsWith("-")) {
+            const opt = args[0];
+            args = args.slice(1);
+            if (OPT_WITH_VALUE.has(opt) && args.length && !args[0].startsWith("-")) {
+                args = args.slice(1); // consume the option's value (e.g. `-n 10`)
+            }
+        }
+    }
+    // `timeout <dur> cmd...`
+    if (args[0] === "timeout" && args.length > 2)
+        args = args.slice(2);
+    // `xargs [opts] cmd ...` — the real command follows the options.
+    if (args[0] === "xargs") {
+        let i = 1;
+        while (i < args.length && args[i].startsWith("-"))
+            i++;
+        args = args.slice(i);
+    }
+    // `sh -c "<script>"` / `bash -c ...`
+    if (args.length >= 3 && SHELLS.has(args[0]) && args.includes("-c")) {
+        const ci = args.indexOf("-c");
+        const script = args[ci + 1];
+        if (typeof script === "string")
+            nestedScripts.push(script);
+    }
+    return { resolved: { ...cmd, args }, nestedScripts };
+}
+// ---------------------------------------------------------------------------
+// Rule matchers
+// ---------------------------------------------------------------------------
+/** Collects short-flag characters from an argv (e.g. `-rf` → "rf"). */
+function collectFlags(args) {
+    return args
+        .filter((a) => /^-[^-]/.test(a))
+        .map((a) => a.slice(1))
+        .join("");
+}
+/** Detects destructive SQL inside a string (DROP/TRUNCATE, unqualified DML). */
+export function matchSql(sql) {
+    const s = sql.replace(/\s+/g, " ").trim();
+    if (/\bDROP\s+(TABLE|DATABASE|SCHEMA|INDEX)\b/i.test(s)) {
+        return {
+            rule_id: "DB-1",
+            rule_class: "database",
+            reason: "DROP statement",
+        };
+    }
+    if (/\bTRUNCATE\b/i.test(s)) {
+        return {
+            rule_id: "DB-2",
+            rule_class: "database",
+            reason: "TRUNCATE statement",
+        };
+    }
+    if (/\b(DELETE\s+FROM|UPDATE)\b/i.test(s) && !/\bWHERE\b/i.test(s)) {
+        return {
+            rule_id: "DB-3",
+            rule_class: "database",
+            reason: "DELETE/UPDATE without WHERE",
+        };
+    }
+    return null;
+}
+const DB_CLIENTS = new Set([
+    "psql",
+    "mysql",
+    "mariadb",
+    "sqlite3",
+    "mongo",
+    "mongosh",
+    "redis-cli",
+    "cockroach",
+    "clickhouse-client",
+]);
+const PROTECTED_BRANCHES = /(^|[\s,])(main|master|prod|production|release\/)/i;
+/** Matches a single resolved command against every rule class (§8.2). */
+export function matchCommand(cmd, ctx) {
+    const [name, ...args] = cmd.args;
+    if (!name)
+        return null;
+    const joined = cmd.args.join(" ");
+    const flags = collectFlags(args);
+    // --- filesystem destruction ---
+    if (name === "rm") {
+        const recursive = /r/.test(flags) || args.includes("--recursive");
+        if (recursive) {
+            return {
+                rule_id: "FS-1",
+                rule_class: "filesystem",
+                reason: "recursive rm",
+            };
+        }
+    }
+    if (name === "find" && args.includes("-delete")) {
+        return {
+            rule_id: "FS-2",
+            rule_class: "filesystem",
+            reason: "find -delete",
+        };
+    }
+    if (name === "shred") {
+        return { rule_id: "FS-3", rule_class: "filesystem", reason: "shred" };
+    }
+    if (name === "mkfs" || name.startsWith("mkfs.")) {
+        return { rule_id: "FS-4", rule_class: "filesystem", reason: "mkfs" };
+    }
+    if (name === "dd" && args.some((a) => /^of=\/dev\//.test(a))) {
+        return {
+            rule_id: "FS-5",
+            rule_class: "filesystem",
+            reason: "dd to device",
+        };
+    }
+    if (cmd.redirects.some((r) => /^\/dev\//.test(r) && !/^\/dev\/(null|stdout|stderr)$/.test(r))) {
+        return {
+            rule_id: "FS-5",
+            rule_class: "filesystem",
+            reason: "write to device",
+        };
+    }
+    // --- VCS destruction ---
+    if (name === "git") {
+        const sub = args[0];
+        if (sub === "push" &&
+            args.some((a) => a === "--force" || a === "-f" || a === "--force-with-lease")) {
+            return {
+                rule_id: "VCS-1",
+                rule_class: "vcs",
+                reason: "git push --force",
+            };
+        }
+        if (sub === "push" && args.some((a) => a.startsWith("+"))) {
+            return {
+                rule_id: "VCS-1",
+                rule_class: "vcs",
+                reason: "git push +ref (force)",
+            };
+        }
+        if (sub === "push" && args.includes("--delete")) {
+            return {
+                rule_id: "VCS-2",
+                rule_class: "vcs",
+                reason: "git push --delete",
+            };
+        }
+        if (sub === "reset" && args.includes("--hard")) {
+            return {
+                rule_id: "VCS-3",
+                rule_class: "vcs",
+                reason: "git reset --hard",
+            };
+        }
+        if (sub === "clean" && args.some((a) => /^-\w*f/.test(a))) {
+            return { rule_id: "VCS-4", rule_class: "vcs", reason: "git clean -f" };
+        }
+        if (sub === "branch" &&
+            args.some((a) => /^-\w*D/.test(a)) &&
+            PROTECTED_BRANCHES.test(joined)) {
+            return {
+                rule_id: "VCS-5",
+                rule_class: "vcs",
+                reason: "delete protected branch",
+            };
+        }
+        if (sub === "filter-repo" || sub === "filter-branch") {
+            return { rule_id: "VCS-6", rule_class: "vcs", reason: "history rewrite" };
+        }
+    }
+    // --- database destruction ---
+    if (DB_CLIENTS.has(name)) {
+        const sqlMatch = matchSql(joined);
+        if (sqlMatch)
+            return sqlMatch;
+    }
+    // --- infra teardown ---
+    if (name === "terraform" && (args[0] === "destroy" || args[0] === "apply")) {
+        return {
+            rule_id: "INF-1",
+            rule_class: "infra",
+            reason: `terraform ${args[0]}`,
+        };
+    }
+    if (name === "kubectl" && args[0] === "delete") {
+        return { rule_id: "INF-2", rule_class: "infra", reason: "kubectl delete" };
+    }
+    if (name === "docker" && args[0] === "system" && args[1] === "prune") {
+        return {
+            rule_id: "INF-3",
+            rule_class: "infra",
+            reason: "docker system prune",
+        };
+    }
+    if (name === "helm" && args[0] === "uninstall") {
+        return { rule_id: "INF-5", rule_class: "infra", reason: "helm uninstall" };
+    }
+    if ((name === "aws" || name === "gcloud" || name === "az") &&
+        args.some((a) => /^(delete|rm|destroy|terminate|remove|drop)$/.test(a))) {
+        return {
+            rule_id: "INF-4",
+            rule_class: "infra",
+            reason: `${name} mutating verb`,
+        };
+    }
+    // --- publish / deploy ---
+    if ((name === "npm" || name === "pnpm" || name === "yarn") &&
+        args.includes("publish")) {
+        return {
+            rule_id: "PUB-1",
+            rule_class: "publish",
+            reason: "package publish",
+        };
+    }
+    if (name === "cargo" && args.includes("publish")) {
+        return { rule_id: "PUB-1", rule_class: "publish", reason: "cargo publish" };
+    }
+    if (name === "docker" && args[0] === "push") {
+        return { rule_id: "PUB-2", rule_class: "publish", reason: "docker push" };
+    }
+    if (name === "gh" && args[0] === "release") {
+        return { rule_id: "PUB-3", rule_class: "publish", reason: "gh release" };
+    }
+    if (name === "vercel" && args.includes("--prod")) {
+        return { rule_id: "PUB-4", rule_class: "publish", reason: "vercel --prod" };
+    }
+    if ((name === "flyctl" || name === "fly") && args[0] === "deploy") {
+        return { rule_id: "PUB-5", rule_class: "publish", reason: "flyctl deploy" };
+    }
+    // --- credential access ---
+    if ((name === "cat" ||
+        name === "less" ||
+        name === "head" ||
+        name === "tail" ||
+        name === "cp") &&
+        args.some((a) => isCredentialPath(toAbsolute(a, ctx.cwd)))) {
+        return {
+            rule_id: "CRED-1",
+            rule_class: "credential",
+            reason: "reads credential file",
+        };
+    }
+    if (name === "security" || name === "keychain") {
+        return {
+            rule_id: "CRED-2",
+            rule_class: "credential",
+            reason: "keychain access",
+        };
+    }
+    return null;
+}
+// Backstop patterns for substitution-hidden or unparseable danger (§8.2, §13.1).
+const BACKSTOP_PATTERNS = [
+    {
+        re: /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;/,
+        match: { rule_id: "FS-7", rule_class: "filesystem", reason: "fork bomb" },
+    },
+    {
+        re: /\|\s*(sudo\s+)?(sh|bash|zsh)\b/,
+        match: { rule_id: "NET-1", rule_class: "network", reason: "pipe to shell" },
+    },
+];
+/**
+ * Evaluates a Bash command string (§8.2). Recursively unwraps shells, xargs,
+ * env, and command substitution; on parse failure denies in production scopes.
+ */
+export function evaluateBash(command, ctx) {
+    let decision = ALLOW;
+    let tokens;
+    try {
+        tokens = shellParse(command);
+    }
+    catch {
+        // Unparseable ⇒ deny in production scopes; audit elsewhere (§8.2).
+        return isProductionLike(ctx.environment)
+            ? {
+                verdict: "deny",
+                match: {
+                    rule_id: "PARSE-1",
+                    rule_class: "filesystem",
+                    reason: "unparseable command",
+                },
+            }
+            : { verdict: "allow_with_audit", match: null };
+    }
+    const commands = splitCommands(tokens);
+    // curl|wget … | sh network-exfil detection across the pipeline (§8.2).
+    for (let i = 0; i < commands.length - 1; i++) {
+        const c = commands[i];
+        const nxt = commands[i + 1];
+        const head = c.args[0];
+        const pipedTo = nxt.args[0];
+        if (c.nextOp === "|" &&
+            (head === "curl" || head === "wget") &&
+            (pipedTo === "sh" || pipedTo === "bash" || pipedTo === "zsh")) {
+            decision = worse(decision, decide({
+                rule_id: "NET-1",
+                rule_class: "network",
+                reason: "curl|wget → shell",
+            }, ctx));
+        }
+    }
+    for (const cmd of commands) {
+        const { resolved, nestedScripts } = unwrap(cmd);
+        const m = matchCommand(resolved, ctx);
+        if (m)
+            decision = worse(decision, decide(m, ctx));
+        for (const script of nestedScripts) {
+            decision = worse(decision, evaluateBash(script, ctx));
+        }
+    }
+    // Command-substitution / backstop regex sweep (§13.1). A binary hidden inside
+    // `$(which rm) -rf .` is caught here even when the token walk cannot bind it.
+    const hasSubstitution = /\$\(|`/.test(command);
+    for (const { re, match } of BACKSTOP_PATTERNS) {
+        if (re.test(command))
+            decision = worse(decision, decide(match, ctx));
+    }
+    if (hasSubstitution &&
+        isProductionLike(ctx.environment) &&
+        /\brm\b|\bdd\b|\bmkfs\b|\bshred\b/.test(command)) {
+        decision = worse(decision, decide({
+            rule_id: "SUBST-1",
+            rule_class: "filesystem",
+            reason: "destructive binary inside command substitution",
+        }, ctx));
+    }
+    return decision;
+}
+/**
+ * Evaluates a Write/Edit file target against the scope allowlist (§8.2, §8.3).
+ * A write outside the allowlist (or inside the denylist) is filesystem-class.
+ */
+export function evaluatePathWrite(filePath, ctx) {
+    const abs = toAbsolute(filePath, ctx.cwd);
+    if (isCredentialPath(abs)) {
+        return decide({
+            rule_id: "CRED-1",
+            rule_class: "credential",
+            reason: "write to credential path",
+        }, ctx);
+    }
+    if (!isPathAllowed(abs, ctx.path_allowlist, ctx.path_denylist, ctx.cwd)) {
+        return decide({
+            rule_id: "FS-6",
+            rule_class: "filesystem",
+            reason: "write outside path allowlist",
+        }, ctx);
+    }
+    return ALLOW;
+}
+/** Evaluates a Read file target — blocks credential/dotenv reads (§8.2). */
+export function evaluatePathRead(filePath, ctx) {
+    const abs = toAbsolute(filePath, ctx.cwd);
+    if (isCredentialPath(abs)) {
+        return decide({
+            rule_id: "CRED-1",
+            rule_class: "credential",
+            reason: "read credential file",
+        }, ctx);
+    }
+    if (isDotenvPath(abs) &&
+        !isPathAllowed(abs, ctx.path_allowlist, ctx.path_denylist, ctx.cwd)) {
+        return decide({
+            rule_id: "CRED-3",
+            rule_class: "credential",
+            reason: ".env read outside allowlist",
+        }, ctx);
+    }
+    return ALLOW;
+}
+//# sourceMappingURL=denyRules.js.map

package/dist/safety/denyRules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"denyRules.js","sourceRoot":"","sources":["../../src/safety/denyRules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,UAAU,GACX,MAAM,YAAY,CAAC;AAgBpB,MAAM,QAAQ,GAA4B;IACxC,IAAI,EAAE,CAAC;IACP,gBAAgB,EAAE,CAAC;IACnB,gBAAgB,EAAE,CAAC;IACnB,KAAK,EAAE,CAAC;CACT,CAAC;AAwBF,MAAM,KAAK,GAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAE9D,iFAAiF;AACjF,SAAS,UAAU,CAAC,GAAc,EAAE,GAAgB;IAClD,wEAAwE;IACxE,IAAI,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,MAAM,CAAC;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC;IAC3D,IAAI,OAAO,KAAK,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IAC9D,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACtC,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,6DAA6D;AAC7D,SAAS,MAAM,CAAC,KAAgB,EAAE,GAAgB;IAChD,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC;AAED,8CAA8C;AAC9C,SAAS,KAAK,CAAC,CAAe,EAAE,CAAe;IAC7C,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAeD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC/D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAErE,kEAAkE;AAClE,SAAS,aAAa,CAAC,MAAqC;IAC1D,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,IAAI,GAAG,GAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACrD,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,MAAM,KAAK,GAAG,CAAC,EAAW,EAAE,EAAE;QAC5B,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC5C,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACpC,CAAC,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,iBAAiB,EAAE,CAAC;gBACtB,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACxB,iBAAiB,GAAG,KAAK,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;YACD,SAAS;QACX,CAAC;QACD,kCAAkC;QAClC,IAAI,SAAS,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACxD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChC,iBAAiB,GAAG,KAAK,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5C,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,EAAE,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7B,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,kEAAkE;YAClE,KAAK,EAAE,CAAC;QACV,CAAC;QACD,0BAA0B;IAC5B,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,SAAS;IACT,SAAS;IACT,MAAM;CACP,CAAC,CAAC;AACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAErE;;;GAGG;AACH,SAAS,MAAM,CAAC,GAAkB;IAIhC,IAAI,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,2BAA2B;IAC3B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QACtB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAChE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;QAC7B,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,QAAQ;QACR,SAAS;QACT,cAAc;KACf,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QAC7C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACrB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,4CAA4C;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IACD,yBAAyB;IACzB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,iEAAiE;IACjE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,CAAC,EAAE,CAAC;QACxD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,qCAAqC;IACrC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC;AACvD,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,uEAAuE;AACvE,SAAS,YAAY,CAAC,IAAc;IAClC,OAAO,IAAI;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACtB,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,2CAA2C,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,MAAM;YACf,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,gBAAgB;SACzB,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,MAAM;YACf,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,oBAAoB;SAC7B,CAAC;IACJ,CAAC;IACD,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,OAAO,EAAE,MAAM;YACf,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,6BAA6B;SACtC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,MAAM;IACN,OAAO;IACP,SAAS;IACT,SAAS;IACT,OAAO;IACP,SAAS;IACT,WAAW;IACX,WAAW;IACX,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,mDAAmD,CAAC;AAE/E,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAC1B,GAAkB,EAClB,GAAgB;IAEhB,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEjC,iCAAiC;IACjC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAClE,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,OAAO,EAAE,MAAM;gBACf,UAAU,EAAE,YAAY;gBACxB,MAAM,EAAE,cAAc;aACvB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,OAAO,EAAE,MAAM;YACf,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,cAAc;SACvB,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE,MAAM;YACf,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,cAAc;SACvB,CAAC;IACJ,CAAC;IACD,IACE,GAAG,CAAC,SAAS,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CACtE,EACD,CAAC;QACD,OAAO;YACL,OAAO,EAAE,MAAM;YACf,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,iBAAiB;SAC1B,CAAC;IACJ,CAAC;IAED,0BAA0B;IAC1B,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IACE,GAAG,KAAK,MAAM;YACd,IAAI,CAAC,IAAI,CACP,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,oBAAoB,CACnE,EACD,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,OAAO;gBAChB,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,kBAAkB;aAC3B,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1D,OAAO;gBACL,OAAO,EAAE,OAAO;gBAChB,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,uBAAuB;aAChC,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,OAAO;gBACL,OAAO,EAAE,OAAO;gBAChB,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,mBAAmB;aAC5B,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO;gBACL,OAAO,EAAE,OAAO;gBAChB,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,kBAAkB;aAC3B,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACzE,CAAC;QACD,IACE,GAAG,KAAK,QAAQ;YAChB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAC/B,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,OAAO;gBAChB,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,yBAAyB;aAClC,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YACrD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IAED,yBAAyB;IACzB,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,EAAE,CAAC;QAC3E,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,UAAU,EAAE,OAAO;YACnB,MAAM,EAAE,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE;SAC/B,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACrE,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,UAAU,EAAE,OAAO;YACnB,MAAM,EAAE,qBAAqB;SAC9B,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC7E,CAAC;IACD,IACE,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,6CAA6C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EACvE,CAAC;QACD,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,UAAU,EAAE,OAAO;YACnB,MAAM,EAAE,GAAG,IAAI,gBAAgB;SAChC,CAAC;IACJ,CAAC;IAED,2BAA2B;IAC3B,IACE,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EACxB,CAAC;QACD,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,iBAAiB;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC9E,CAAC;IAED,4BAA4B;IAC5B,IACE,CAAC,IAAI,KAAK,KAAK;QACb,IAAI,KAAK,MAAM;QACf,IAAI,KAAK,MAAM;QACf,IAAI,KAAK,MAAM;QACf,IAAI,KAAK,IAAI,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAC1D,CAAC;QACD,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,uBAAuB;SAChC,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/C,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,iBAAiB;SAC1B,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,iBAAiB,GAAuC;IAC5D;QACE,EAAE,EAAE,sCAAsC;QAC1C,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE;KAC1E;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE;KAC5E;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,GAAgB;IAC5D,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,IAAI,MAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC;YACtC,CAAC,CAAC;gBACE,OAAO,EAAE,MAAM;gBACf,KAAK,EAAE;oBACL,OAAO,EAAE,SAAS;oBAClB,UAAU,EAAE,YAAY;oBACxB,MAAM,EAAE,qBAAqB;iBAC9B;aACF;YACH,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,uEAAuE;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,IACE,CAAC,CAAC,MAAM,KAAK,GAAG;YAChB,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,CAAC;YACpC,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,KAAK,CAAC,EAC7D,CAAC;YACD,QAAQ,GAAG,KAAK,CACd,QAAQ,EACR,MAAM,CACJ;gBACE,OAAO,EAAE,OAAO;gBAChB,UAAU,EAAE,SAAS;gBACrB,MAAM,EAAE,mBAAmB;aAC5B,EACD,GAAG,CACJ,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC;YAAE,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,iBAAiB,EAAE,CAAC;QAC9C,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,IACE,eAAe;QACf,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC;QACjC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,EAChD,CAAC;QACD,QAAQ,GAAG,KAAK,CACd,QAAQ,EACR,MAAM,CACJ;YACE,OAAO,EAAE,SAAS;YAClB,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,gDAAgD;SACzD,EACD,GAAG,CACJ,CACF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,GAAgB;IAEhB,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CACX;YACE,OAAO,EAAE,QAAQ;YACjB,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,0BAA0B;SACnC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACxE,OAAO,MAAM,CACX;YACE,OAAO,EAAE,MAAM;YACf,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,8BAA8B;SACvC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,GAAgB;IAEhB,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CACX;YACE,OAAO,EAAE,QAAQ;YACjB,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,sBAAsB;SAC/B,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IACE,YAAY,CAAC,GAAG,CAAC;QACjB,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,EACnE,CAAC;QACD,OAAO,MAAM,CACX;YACE,OAAO,EAAE,QAAQ;YACjB,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,6BAA6B;SACtC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/safety/envClassifier.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Environment classifier (§8.1). A scope's `environment` is set explicitly in
+ * the plan, but the classifier re-evaluates continuously and can only *raise*
+ * severity, never lower it. The ambiguity rule is absolute: `unknown` is
+ * treated as `production`.
+ */
+import type { Environment, SafetyConfig } from "@orc-brain/shared";
+/** True when this environment must be treated as production for enforcement. */
+export declare function isProductionLike(env: Environment): boolean;
+/** Returns whichever environment carries the higher (never-lower) severity. */
+export declare function raise(a: Environment, b: Environment): Environment;
+/** True when `branch` matches any configured production branch pattern (§8.1). */
+export declare function isProductionBranch(branch: string, prodBranches: string[]): boolean;
+/** Extracts a bare host from a URL, connection string, or host:port token. */
+export declare function extractHost(raw: string): string | null;
+/**
+ * Classifies a single host reference (§8.1). Local/RFC-1918 hosts are
+ * `development`; anything explicitly listed as a prod indicator is
+ * `production`; everything else is `unknown` (⇒ production).
+ */
+export declare function classifyHost(host: string, prodIndicators: string[]): Environment;
+/** Signals fed to {@link classifyEnvironment}. */
+export interface EnvSignals {
+    /** The scope's declared environment (operator-reviewed). */
+    declared: Environment;
+    /** Current git branch of the scope's cwd, if known. */
+    branch?: string;
+    /** Host/URL/connection-string tokens seen in tool input or path allowlist. */
+    hosts?: string[];
+    /** Operator explicitly forced production. */
+    forcedProduction?: boolean;
+}
+/** Result of a classification pass. */
+export interface EnvClassification {
+    environment: Environment;
+    /** Human-readable reasons the classification landed where it did. */
+    signals: string[];
+}
+/**
+ * Continuous re-classification (§8.1). Starts from the declared environment and
+ * only ever raises. Returns the effective environment plus the signals that
+ * produced it, for the audit log and the UI's "why prod?" explanation.
+ */
+export declare function classifyEnvironment(input: EnvSignals, config: SafetyConfig): EnvClassification;
+//# sourceMappingURL=envClassifier.d.ts.map

package/dist/safety/envClassifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envClassifier.d.ts","sourceRoot":"","sources":["../../src/safety/envClassifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAUnE,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAE1D;AAED,+EAA+E;AAC/E,wBAAgB,KAAK,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,GAAG,WAAW,CAOjE;AAUD,kFAAkF;AAClF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAET;AAOD,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYtD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,EAAE,GACvB,WAAW,CAOb;AAED,kDAAkD;AAClD,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,QAAQ,EAAE,WAAW,CAAC;IACtB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,WAAW,CAAC;IACzB,qEAAqE;IACrE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,YAAY,GACnB,iBAAiB,CAyBnB"}

package/dist/safety/envClassifier.js

@@ -0,0 +1,99 @@
+/**
+ * Environment classifier (§8.1). A scope's `environment` is set explicitly in
+ * the plan, but the classifier re-evaluates continuously and can only *raise*
+ * severity, never lower it. The ambiguity rule is absolute: `unknown` is
+ * treated as `production`.
+ */
+/** Severity ordering. `unknown` sits at production level (§8.1). */
+const SEVERITY = {
+    development: 0,
+    staging: 1,
+    unknown: 2,
+    production: 2,
+};
+/** True when this environment must be treated as production for enforcement. */
+export function isProductionLike(env) {
+    return SEVERITY[env] >= SEVERITY.production;
+}
+/** Returns whichever environment carries the higher (never-lower) severity. */
+export function raise(a, b) {
+    if (SEVERITY[b] > SEVERITY[a])
+        return b;
+    // Prefer the more specific label when severities tie (unknown vs production).
+    if (SEVERITY[a] === SEVERITY[b] && a === "unknown" && b === "production") {
+        return "production";
+    }
+    return a;
+}
+/** Compiles a branch glob like `release/*` into an anchored RegExp. */
+function branchGlobToRegExp(glob) {
+    const escaped = glob
+        .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+        .replace(/\*/g, ".*");
+    return new RegExp(`^${escaped}$`);
+}
+/** True when `branch` matches any configured production branch pattern (§8.1). */
+export function isProductionBranch(branch, prodBranches) {
+    return prodBranches.some((p) => branchGlobToRegExp(p).test(branch));
+}
+const LOCAL_HOST = /^(localhost|127\.0\.0\.1|::1|.*\.local)$/i;
+// RFC-1918 private ranges + link-local — treated as non-production.
+const PRIVATE_HOST = /^(10\.|127\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|169\.254\.|fe80:|fc00:|fd00:)/i;
+/** Extracts a bare host from a URL, connection string, or host:port token. */
+export function extractHost(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    // scheme://[user:pass@]host[:port]/...
+    const urlMatch = trimmed.match(/^[a-z][a-z0-9+.-]*:\/\/(?:[^/@]*@)?([^/:?#]+)/i);
+    if (urlMatch?.[1])
+        return urlMatch[1].toLowerCase();
+    // host:port or bare host
+    const hostMatch = trimmed.match(/^([a-z0-9._-]+)(?::\d+)?$/i);
+    if (hostMatch?.[1])
+        return hostMatch[1].toLowerCase();
+    return null;
+}
+/**
+ * Classifies a single host reference (§8.1). Local/RFC-1918 hosts are
+ * `development`; anything explicitly listed as a prod indicator is
+ * `production`; everything else is `unknown` (⇒ production).
+ */
+export function classifyHost(host, prodIndicators) {
+    const h = host.toLowerCase();
+    if (prodIndicators.some((ind) => h.includes(ind.toLowerCase()))) {
+        return "production";
+    }
+    if (LOCAL_HOST.test(h) || PRIVATE_HOST.test(h))
+        return "development";
+    return "unknown";
+}
+/**
+ * Continuous re-classification (§8.1). Starts from the declared environment and
+ * only ever raises. Returns the effective environment plus the signals that
+ * produced it, for the audit log and the UI's "why prod?" explanation.
+ */
+export function classifyEnvironment(input, config) {
+    let env = input.declared;
+    const signals = [`declared=${input.declared}`];
+    if (input.forcedProduction) {
+        env = raise(env, "production");
+        signals.push("operator forced production");
+    }
+    if (input.branch && isProductionBranch(input.branch, config.prod_branches)) {
+        env = raise(env, "production");
+        signals.push(`branch '${input.branch}' is a protected/production branch`);
+    }
+    for (const raw of input.hosts ?? []) {
+        const host = extractHost(raw);
+        if (!host)
+            continue;
+        const hostEnv = classifyHost(host, config.prod_host_indicators);
+        if (hostEnv !== "development") {
+            env = raise(env, hostEnv);
+            signals.push(`host '${host}' classified ${hostEnv}`);
+        }
+    }
+    return { environment: env, signals };
+}
+//# sourceMappingURL=envClassifier.js.map