@scopebond/hook 0.5.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (31) hide show
  1. package/README.md +52 -6
  2. package/dist/cli.js +64 -8
  3. package/dist/cli.js.map +1 -1
  4. package/dist/index.d.ts +2 -2
  5. package/dist/index.d.ts.map +1 -1
  6. package/dist/index.js +2 -2
  7. package/dist/index.js.map +1 -1
  8. package/dist/init.d.ts.map +1 -1
  9. package/dist/init.js +2 -9
  10. package/dist/init.js.map +1 -1
  11. package/dist/install.d.ts +18 -1
  12. package/dist/install.d.ts.map +1 -1
  13. package/dist/install.js +84 -19
  14. package/dist/install.js.map +1 -1
  15. package/dist/map.d.ts +6 -3
  16. package/dist/map.d.ts.map +1 -1
  17. package/dist/map.js +762 -60
  18. package/dist/map.js.map +1 -1
  19. package/dist/minimize.d.ts +6 -3
  20. package/dist/minimize.d.ts.map +1 -1
  21. package/dist/minimize.js +24 -4
  22. package/dist/minimize.js.map +1 -1
  23. package/dist/runtime.d.ts +4 -0
  24. package/dist/runtime.d.ts.map +1 -1
  25. package/dist/runtime.js +75 -9
  26. package/dist/runtime.js.map +1 -1
  27. package/dist/shell.d.ts +53 -4
  28. package/dist/shell.d.ts.map +1 -1
  29. package/dist/shell.js +737 -81
  30. package/dist/shell.js.map +1 -1
  31. package/package.json +3 -3
package/dist/map.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"map.js","sourceRoot":"","sources":["../src/map.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,iFAAiF;AACjF,kEAAkE;AAClE,EAAE;AACF,kFAAkF;AAClF,6EAA6E;AAC7E,kFAAkF;AAClF,gDAAgD;AAEhD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAsB,MAAM,YAAY,CAAC;AAgB9E,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAElE,iFAAiF;AACjF,oFAAoF;AACpF,4EAA4E;AAC5E,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAE9D,MAAM,GAAG,GAAG,CAAC,KAAc,EAAE,GAAY,EAAU,EAAE;IACnD,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,kFAAkF;AAClF,oFAAoF;AACpF,qFAAqF;AACrF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;IACtB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS;IAC1E,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI;CACxD,CAAC,CAAC;AAEH;;;;8CAI8C;AAC9C,SAAS,gBAAgB,CAAC,EAAiB,EAAE,GAAY;IACvD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS,CAAC,yCAAyC;YAC7F,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAClI,CAAC;IACH,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,iGAAiG;QACjG,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1I,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;yFAEyF;AACzF,SAAS,gBAAgB,CAAC,EAAiB,EAAE,GAAY;IACvD,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;QACd,OAAO,CAAC;gBACN,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACvH,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO;aAClC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,MAAM,GAA4B,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9D,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,IAAI,GAAW;QACnB,MAAM,EAAE;YACN,WAAW,EAAE,YAAY;YACzB,6EAA6E;YAC7E,6EAA6E;YAC7E,6DAA6D;YAC7D,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACpH;QACD,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO;KACjC,CAAC;IACF,OAAO,CAAC,IAAI,EAAE,GAAG,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;4DAC4D;AAC5D,SAAS,QAAQ,CAAC,OAAe,EAAE,GAAY;IAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAClJ,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,sFAAsF;IACtF,IAAI,CAAC;QAAC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IAAC,CAAC;IACtF,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAAC,CAAC;AACvD,CAAC;AAED;;;qFAGqF;AACrF,SAAS,aAAa,CAAC,OAAe,EAAE,GAAY;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAG,CAAC,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC3F,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1B,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE;QACvD,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,aAAa;KACtB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,MAAwB,EAAE,SAAkB,EAAE,MAAc,EAAY,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;AAExH;;;uCAGuC;AACvC,MAAM,UAAU,cAAc,CAAC,MAAgB,EAAE,MAAiC;IAChF,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC3B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACtB,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS;QACtE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;QAC5F,CAAC,CAAC,CAAC,CAAC,CAAC;AACX,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,KAA8B;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAA4B,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,gFAAgF;IAChF,kFAAkF;IAClF,kFAAkF;IAClF,8CAA8C;IAC9C,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,OAAO;QAC9D,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW;QAC7D,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClG,IAAI,IAAI,KAAK,cAAc;QACzB,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACtH,IAAI,IAAI,KAAK,MAAM;QACjB,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjG,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3I,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,QAAQ,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACrF,CAAC;AAED;;kFAEkF;AAClF,MAAM,UAAU,eAAe,CAAC,KAA8B;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAA4B,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,cAAc;QACpH,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO;QAC/D,OAAO,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3I,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,QAAQ,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACrF,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,OAAgC;IAC5E,MAAM,CAAC,GAAG,OAAO,IAAI,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,sBAAsB;YACzB,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAChD,KAAK,gBAAgB;YACnB,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3G,KAAK,eAAe;YAClB,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5G,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACjD,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACxI,CAAC;QACD;YACE,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,QAAQ,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzF,CAAC;AACH,CAAC","sourcesContent":["// The mapper: a pure function from a coding agent's native tool call to the\n// normalized Scopebond actions (Action Taxonomy v1) it represents. Deterministic\n// and side-effect free, so it can be conformance-tested directly.\n//\n// A shell tool call can carry several commands (`a && b`, `$(c)`, `bash -c '…'`);\n// the mapper decomposes it and returns one intent per simple command, so the\n// runtime evaluates every one and denies if any is out of policy. Non-shell tools\n// map to a single intent (a one-element array).\n\nimport { digest, redactCommand, scrubParam, scrubSecrets } from \"./minimize.js\";\nimport { decomposeShell, parseGitPush, type SimpleCommand } from \"./shell.js\";\n\nexport interface NormalizedIntent {\n action_type: string;\n params: Record<string, unknown>;\n}\nexport interface Mapped {\n intent: NormalizedIntent;\n /** false when no taxonomy type applies (an unknown tool, or a shell command that\n * could not be parsed): emitted to the observation path (not_evaluated) in normal\n * mode and denied by the closed allowlist in strict mode — never granted. */\n evaluated: boolean;\n /** The native tool/event name, for diagnostics. */\n source: string;\n}\n\nconst basename = (t: string): string => t.replace(/^.*[\\\\/]/, \"\");\n\n// Normalize Windows backslash separators to \"/\" so a path guard written with \"/\"\n// (the hook's own .scopebond/**, .claude/settings*, *.key rules) cannot be bypassed\n// on Windows by a backslash path. The taxonomy path space is \"/\"-separated.\nconst normPath = (s: string): string => s.replace(/\\\\/g, \"/\");\n\nconst rel = (value: unknown, cwd?: string): string => {\n const s = normPath(String(value ?? \"\"));\n const c = cwd ? normPath(cwd) : undefined;\n if (c && s.startsWith(c)) return s.slice(c.length).replace(/^\\/+/, \"\");\n return s;\n};\n\n// Shell programs that READ a file given as an operand. A read of the signing keys\n// or a secret file through the shell (`cat .scopebond/attester.key`) must reach the\n// same file.read guard as the Read tool, or the cooperative protection is a fiction.\nconst READERS = new Set([\n \"cat\", \"tac\", \"less\", \"more\", \"head\", \"tail\", \"nl\", \"od\", \"xxd\", \"hexdump\",\n \"strings\", \"base64\", \"bat\", \"type\", \"get-content\", \"gc\",\n]);\n\n/** Derive the additional file.read / file.write intents a simple shell command\n * implies: operands of a reader program, and the targets of `>`/`>>` redirections.\n * These flow through the same protect-read / protect-write clauses as the native\n * file tools. A false positive (a non-protected operand) is a harmless extra\n * receipt that the starter policy allows. */\nfunction fileOpsFromShell(sc: SimpleCommand, cwd?: string): Mapped[] {\n const ops: Mapped[] = [];\n if (READERS.has(sc.program.toLowerCase())) {\n for (const t of sc.argv) {\n if (t.startsWith(\"-\") || /^\\d+$/.test(t)) continue; // skip flags and flag values (head -n 5)\n ops.push({ intent: { action_type: \"file.read\", params: { path: rel(scrubParam(t), cwd) } }, evaluated: true, source: \"shell\" });\n }\n }\n for (let i = 0; i < sc.argv.length; i++) {\n // `> file`, `>>file`, `2>file`, `&>file` — the token after the redirection op is a write target.\n const m = /^(?:\\d|&)?(>>?)(.*)$/.exec(sc.argv[i]);\n if (!m) continue;\n const target = m[2] || sc.argv[i + 1];\n if (target && !target.startsWith(\"-\") && !/^(?:\\d|&)?>>?/.test(target))\n ops.push({ intent: { action_type: \"file.write\", params: { path: rel(scrubParam(target), cwd) } }, evaluated: true, source: \"shell\" });\n }\n return ops;\n}\n\n/** Map one parsed simple command to the intents it implies: the git.push or\n * shell.exec itself, plus any file reads/writes it performs. An opaque\n * (unparseable) command becomes a single un-evaluated shell.exec so it fails closed. */\nfunction mapSimpleCommand(sc: SimpleCommand, cwd?: string): Mapped[] {\n if (sc.opaque) {\n return [{\n intent: { action_type: \"shell.exec\", params: { command: redactCommand(sc.raw), program: \"\", ...(cwd ? { cwd } : {}) } },\n evaluated: false, source: \"shell\",\n }];\n }\n const push = parseGitPush(sc);\n if (push) {\n const params: Record<string, unknown> = { force: push.force };\n if (push.remote !== undefined) params.remote = scrubParam(push.remote);\n if (push.ref !== undefined) params.ref = scrubParam(push.ref);\n return [{ intent: { action_type: \"git.push\", params }, evaluated: true, source: \"shell\" }];\n }\n const exec: Mapped = {\n intent: {\n action_type: \"shell.exec\",\n // Scrub before storing: the raw command through the blob-aware scrubber, and\n // the whole first token BEFORE taking its basename, so a bare-secret command\n // containing \"/\" cannot leak a path-fragment as the program.\n params: { command: redactCommand(sc.raw), program: basename(scrubSecrets(sc.programRaw)), ...(cwd ? { cwd } : {}) },\n },\n evaluated: true, source: \"shell\",\n };\n return [exec, ...fileOpsFromShell(sc, cwd)];\n}\n\n/** Decompose a shell command into the intents it will run. An empty command yields\n * a single un-evaluated placeholder (nothing to grant). */\nfunction mapShell(command: string, cwd?: string): Mapped[] {\n const commands = decomposeShell(command);\n if (commands.length === 0) {\n return [{ intent: { action_type: \"shell.exec\", params: { command: redactCommand(command), program: \"\" } }, evaluated: false, source: \"shell\" }];\n }\n return commands.flatMap((sc) => mapSimpleCommand(sc, cwd));\n}\n\nfunction parseMcpName(name: string): { server: string; tool: string } | null {\n if (!name.startsWith(\"mcp__\")) return null;\n const parts = name.split(\"__\");\n if (parts.length < 3) return null;\n return { server: parts[1], tool: parts.slice(2).join(\"__\") };\n}\n\nfunction splitUrl(url: string): { host: string; path: string } {\n // The query string is dropped; a token in the path or an unparseable URL is scrubbed.\n try { const u = new URL(url); return { host: u.host, path: scrubParam(u.pathname) }; }\n catch { return { host: scrubParam(url), path: \"\" }; }\n}\n\n/** Extract every path changed by an apply_patch call. Codex sends the patch in\n * `tool_input.command`; recording one file.write per path lets the same protected-\n * path rules cover file edits made by Claude Code, Cursor and Codex. A patch with\n * no recognizable path is deliberately not evaluated so strict mode can deny it. */\nfunction mapApplyPatch(command: string, cwd?: string): Mapped[] {\n const paths: string[] = [];\n const seen = new Set<string>();\n const prefixes = [\"*** Add File:\", \"*** Update File:\", \"*** Delete File:\", \"*** Move to:\"];\n for (const line of command.split(/\\r?\\n/)) {\n const prefix = prefixes.find((candidate) => line.startsWith(candidate));\n if (!prefix) continue;\n const path = rel(scrubParam(line.slice(prefix.length).trim()), cwd);\n if (!path || seen.has(path)) continue;\n seen.add(path);\n paths.push(path);\n }\n if (paths.length === 0) {\n return one({ action_type: \"file.write\", params: { path: \"\" } }, false, \"apply_patch\");\n }\n return paths.map((path) => ({\n intent: { action_type: \"file.write\", params: { path } },\n evaluated: true,\n source: \"apply_patch\",\n }));\n}\n\nconst one = (intent: NormalizedIntent, evaluated: boolean, source: string): Mapped[] => [{ intent, evaluated, source }];\n\n/** A bare `git push` (no ref) pushes the current branch. The mapper cannot know it,\n * so the runtime resolves it and fills it in here, before evaluation — otherwise the\n * starter policy's ref bound would fail-closed on every plain push. Only git.push\n * intents with no ref are touched. */\nexport function fillPushBranch(mapped: Mapped[], branch: string | null | undefined): Mapped[] {\n if (!branch) return mapped;\n return mapped.map((m) =>\n m.intent.action_type === \"git.push\" && m.intent.params.ref === undefined\n ? { ...m, intent: { ...m.intent, params: { ...m.intent.params, ref: scrubParam(branch) } } }\n : m);\n}\n\n/** Map a Claude Code PreToolUse payload to the normalized actions it represents. */\nexport function mapClaudeToolUse(input: Record<string, unknown>): Mapped[] {\n const name = String(input?.tool_name ?? \"\");\n const ti = (input?.tool_input ?? {}) as Record<string, unknown>;\n const cwd = input?.cwd ? String(input.cwd) : undefined;\n // Every shell-executing tool decomposes the same way. Claude Code exposes Bash;\n // some hosts/agents expose PowerShell or a generic Shell tool — mapping only Bash\n // let a PowerShell command (e.g. `Remove-Item -Recurse -Force .`) fall through to\n // an un-evaluated tool.<name> and be allowed.\n if (name === \"Bash\" || name === \"PowerShell\" || name === \"Shell\")\n return mapShell(String(ti.command ?? \"\"), cwd);\n if (name === \"Write\" || name === \"Edit\" || name === \"MultiEdit\")\n return one({ action_type: \"file.write\", params: { path: rel(ti.file_path, cwd) } }, true, name);\n if (name === \"NotebookEdit\")\n return one({ action_type: \"file.write\", params: { path: rel(ti.notebook_path ?? ti.file_path, cwd) } }, true, name);\n if (name === \"Read\")\n return one({ action_type: \"file.read\", params: { path: rel(ti.file_path, cwd) } }, true, name);\n if (name === \"WebFetch\") {\n const { host, path } = splitUrl(String(ti.url ?? \"\"));\n return one({ action_type: \"net.fetch\", params: { host, path, method: \"GET\" } }, true, name);\n }\n const mcp = parseMcpName(name);\n if (mcp) return one({ action_type: \"mcp.tool.call\", params: { server: mcp.server, tool: mcp.tool, args_digest: digest(ti) } }, true, name);\n return one({ action_type: `tool.${name.toLowerCase()}`, params: {} }, false, name);\n}\n\n/** Map an OpenAI Codex PreToolUse payload. Codex reports shell and unified-exec\n * calls as `Bash`, file patches as `apply_patch`, and MCP calls by their native\n * `mcp__server__tool` name. Other local tools remain visible but unevaluated. */\nexport function mapCodexToolUse(input: Record<string, unknown>): Mapped[] {\n const name = String(input?.tool_name ?? \"\");\n const ti = (input?.tool_input ?? {}) as Record<string, unknown>;\n const cwd = input?.cwd ? String(input.cwd) : undefined;\n if (name === \"Bash\" || name === \"PowerShell\" || name === \"Shell\" || name === \"exec_command\" || name === \"unified_exec\")\n return mapShell(String(ti.command ?? ti.cmd ?? \"\"), cwd);\n if (name === \"apply_patch\" || name === \"Edit\" || name === \"Write\")\n return mapApplyPatch(String(ti.command ?? ti.patch ?? \"\"), cwd);\n const mcp = parseMcpName(name);\n if (mcp) return one({ action_type: \"mcp.tool.call\", params: { server: mcp.server, tool: mcp.tool, args_digest: digest(ti) } }, true, name);\n return one({ action_type: `tool.${name.toLowerCase()}`, params: {} }, false, name);\n}\n\n/** Map a Cursor hook event to the normalized actions it represents. */\nexport function mapCursorEvent(event: string, payload: Record<string, unknown>): Mapped[] {\n const p = payload ?? {};\n const cwd = p.cwd ? String(p.cwd) : undefined;\n switch (event) {\n case \"beforeShellExecution\":\n return mapShell(String(p.command ?? \"\"), cwd);\n case \"beforeReadFile\":\n return one({ action_type: \"file.read\", params: { path: rel(p.path ?? p.file_path, cwd) } }, true, event);\n case \"afterFileEdit\":\n return one({ action_type: \"file.write\", params: { path: rel(p.path ?? p.file_path, cwd) } }, true, event);\n case \"beforeMCPExecution\": {\n const server = String(p.server ?? p.server_name ?? \"\");\n const tool = String(p.tool ?? p.tool_name ?? \"\");\n return one({ action_type: \"mcp.tool.call\", params: { server, tool, args_digest: digest(p.args ?? p.arguments ?? {}) } }, true, event);\n }\n default:\n return one({ action_type: `tool.${event.toLowerCase()}`, params: {} }, false, event);\n }\n}\n"]}
1
+ {"version":3,"file":"map.js","sourceRoot":"","sources":["../src/map.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,iFAAiF;AACjF,kEAAkE;AAClE,EAAE;AACF,kFAAkF;AAClF,6EAA6E;AAC7E,kFAAkF;AAClF,0EAA0E;AAC1E,gCAAgC;AAEhC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAsB,MAAM,YAAY,CAAC;AAmBrG,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAElE,gDAAgD;AAChD,mFAAmF;AACnF,oEAAoE;AACpE,iFAAiF;AACjF,qFAAqF;AACrF,yCAAyC;AACzC,8BAA8B;AAC9B,qFAAqF;AACrF,8DAA8D;AAC9D,MAAM,cAAc,GAAG,CAAC,GAAW,EAAU,EAAE;IAC7C,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;QAAE,GAAG,EAAE,CAAC;IACxE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE,CACrC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;KAClB,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;KAC1B,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;KAC5F,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAE1D,MAAM,GAAG,GAAG,CAAC,KAAc,EAAE,GAAY,EAAU,EAAE;IACnD,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE;QAAE,OAAO,GAAG,CAAC;IACzD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,sFAAsF;AACtF,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,iCAAiC;AACjC,MAAM,aAAa,GAAG,gDAAgD,CAAC;AACvE,MAAM,aAAa,GAAG;IACpB,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,iBAAiB;IAC3H,WAAW,EAAE,qBAAqB,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,qBAAqB,EAAE,YAAY;IAC/H,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB;IACnI,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,aAAa,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa;IAC5H,mBAAmB,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY;CACnF,CAAC;AACF,SAAS,WAAW,CAAC,MAAc,EAAE,GAAW,EAAE,IAAY;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvF,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,WAAW,EAAE;WACvG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7F,CAAC;AACD,sFAAsF;AACtF,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,QAAQ,GAAe,CAAC,EAAE,CAAC,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAe,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;oBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9F,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,6DAA6D;AAC7D,SAAS,WAAW,CAAC,MAAkC,EAAE,IAAY,EAAE,MAAc,EAAE,QAAiC,EAAE;IACxH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACtI,CAAC;AAED,kFAAkF;AAClF,0EAA0E;AAC1E,oFAAoF;AACpF,mFAAmF;AACnF,gFAAgF;AAChF,oFAAoF;AACpF,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG;IACxB,sBAAsB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,uBAAuB;IACpG,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ;IACzE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ;IACjD,aAAa,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB;IACvG,cAAc,EAAE,qBAAqB,EAAE,+BAA+B,EAAE,0BAA0B;IAClG,sBAAsB,EAAE,2BAA2B;IACnD,uBAAuB,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,yBAAyB;IAC1G,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,WAAW;IAC5E,uBAAuB,EAAE,aAAa,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,8BAA8B;IACvH,gBAAgB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,aAAa;IACjG,0FAA0F;IAC1F,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY;CACrG,CAAC;AAEF,MAAM,UAAU,GAAG,aAAa,CAAC;AACjC,MAAM,SAAS,GAAG,4DAA4D,CAAC;AAE/E;;;2CAG2C;AAC3C,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG;YAAE,EAAE,IAAI,UAAU,GAAG,OAAO,CAAC;aACrC,IAAI,CAAC,KAAK,GAAG;YAAE,EAAE,IAAI,UAAU,GAAG,MAAM,CAAC;aACzC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,EAAE,IAAI,UAAU,GAAG,MAAM,CAAC;YAAC,IAAI,GAAG,GAAG,CAAC;gBAAE,CAAC,GAAG,GAAG,CAAC;QAAC,CAAC;aACzG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,EAAE,IAAI,OAAO,CAAC;YAAC,IAAI,GAAG,GAAG,CAAC;gBAAE,CAAC,GAAG,GAAG,CAAC;QAAC,CAAC;aAC7F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAChC,mEAAmE;YACnE,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAAC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,IAAI,GAAG,GAAG,CAAC;oBAAE,CAAC,GAAG,GAAG,CAAC;YAAC,CAAC;iBAC3J,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,IAAI,GAAG,GAAG,CAAC;oBAAE,CAAC,GAAG,GAAG,CAAC;YAAC,CAAC;;gBAC9E,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,CAAC,EAAE,CAAC;YACzE,EAAE,IAAI,IAAI,CAAC;QACb,CAAC;;YAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC9C,QAAQ,GAAG,CAAC,KAAK,GAAG,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,iFAAiF;AACjF,oFAAoF;AACpF,qFAAqF;AACrF,uFAAuF;AACvF,oFAAoF;AACpF,8EAA8E;AAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,SAAS,kBAAkB,CAAC,IAAY;IACtC,kFAAkF;IAClF,qEAAqE;IACrE,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ;QAAE,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC9B,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACxE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IACzC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,MAAkC,EAAE,IAAY,EAAE,GAAW,EAAE,GAAY;IAC7F,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,IAAI,GAAG,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,GAAG;YAAE,OAAO,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,qFAAqF;AACrF,8FAA8F;AAC9F,gFAAgF;AAChF,8EAA8E;AAC9E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;IACtB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ;IACzG,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACtH,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ;IAC3G,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK;IACpF,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAChH,CAAC,CAAC;AACH,iFAAiF;AACjF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpI,iFAAiF;AACjF,oDAAoD;AACpD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;AACzK,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;AAChF,gFAAgF;AAChF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9O,kFAAkF;AAClF,oDAAoD;AACpD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;IAC9H,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACtH,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU;CACjE,CAAC,CAAC;AACH,gGAAgG;AAChG,0FAA0F;AAC1F,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AACjP,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,cAAc,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAC/H,qFAAqF;AACrF,uFAAuF;AACvF,kFAAkF;AAClF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;AACnI,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;AAC7D,6FAA6F;AAC7F,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAC3F,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACnF,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,sFAAsF;AACtF,4EAA4E;AAC5E,MAAM,SAAS,GAAG,qUAAqU,CAAC;AAExV,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AACrI,qFAAqF;AACrF,qFAAqF;AACrF,yDAAyD;AACzD,MAAM,iBAAiB,GAAG,qXAAqX,CAAC;AAChZ,oFAAoF;AACpF,uFAAuF;AACvF,qFAAqF;AACrF,qFAAqF;AACrF,4EAA4E;AAC5E,MAAM,QAAQ,GAAG,yoBAAyoB,CAAC;AAC3pB,MAAM,eAAe,GAAG,KAAK,CAAC;AAO9B,MAAM,IAAI,GAAe,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;AACvU,MAAM,GAAG,GAAe,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,mBAAmB,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;AAC3I,MAAM,GAAG,GAAe,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;AACzG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAqB;IAC1C,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC;IAChD,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC;IACld,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,qBAAqB,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,CAAC;IACtN,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,CAAC,EAAE,CAAC;IACvK,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC;IACzD,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;IACvF,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,CAAC,EAAE,CAAC;IACnH,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;IACvD,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,EAAE,CAAC;IAC7G,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;IAChM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE,CAAC;IAC9G,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IACtG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACtD,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;IAC9O,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAC/B,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,oBAAoB,CAAC,EAAE,CAAC;IAC/F,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,gBAAgB,CAAC,EAAE,CAAC;IACxS,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;IACnH,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;IACpE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;CAC5G,CAAC,CAAC;AACH,qFAAqF;AACrF,4EAA4E;AAC5E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;AAChJ,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;AAEnG,4FAA4F;AAC5F,SAAS,YAAY,CAAC,IAA4B,EAAE,CAAS;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACpD,IAAI,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;IACrG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uFAAuF;AACvF,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,sYAAsY,CAAC;AAEja;;;2DAG2D;AAC3D,SAAS,cAAc,CAAC,IAAc;IACpC,IAAI,IAAwB,CAAC;IAC7B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;IAClG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACjE,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5D,IAAI,uEAAuE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QACjH,IAAI,yFAAyF,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAClI,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,IAAI,IAAI,KAAK,MAAM;QAAE,IAAI,GAAG,IAAI,CAAC;SAC5B,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;SACxI,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM;QAAE,KAAK,GAAG,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,OAAO,GAAG,sGAAsG,CAAC;IACvH,OAAO,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;AAChI,CAAC;AAED;mCACmC;AACnC,SAAS,cAAc,CAAC,IAAc,EAAE,SAAmB,EAAE;IAC3D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/G,MAAM,kBAAkB,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;AAE9I;;;;;;;;qDAQqD;AACrD,SAAS,gBAAgB,CAAC,EAAiB,EAAE,GAAW,EAAE,GAAY;IACpE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,CAAqB,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,SAAS,IAAI,UAAU,CAAC,CAAC,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrI,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,SAAS,IAAI,UAAU,CAAC,CAAC,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvI,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;IACrB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAErG,2FAA2F;IAC3F,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,IAAI,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,KAAK,CAAC,CAAC;aACnE,IAAI,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;aACtG,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC1E,IAAI,KAAyB,CAAC;gBAC9B,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;oBAAE,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;;oBACrD,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBAAC,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAAC,IAAI,CAAC,KAAK,SAAS;wBAAE,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAC9F,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAuB,eAAe;YACtE,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC9B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,IAAI,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;iBAClG,IAAI,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YACnM,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,wEAAwE;YACxE,IAAI,IAAI,KAAK,IAAI,IAAI,uCAAuC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnI,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAClC,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;gBACzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;oBAAE,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,KAAK,KAAK,SAAS;oBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACpD,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAAC,CAAC,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC,CAAC,YAAY;gBAClF,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAAC,CAAC,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC,CAAC,sBAAsB;gBAChI,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAAC,CAAC,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAC5D,IAAI,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;oBAAC,CAAC,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACzF,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;oBAAC,CAAC,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC;YACrE,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC3G,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACtD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAE9I,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzG,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;QACnB,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;YAClB,0DAA0D;YAC1D,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC;YACtE,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzE,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,sBAAsB,CAAC,CAAC,CAAC;YAC5G,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC;YACxF,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC;YACtE,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ;YAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;aACjD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9C,+DAA+D;YAC/D,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QACtI,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,IAAI;YAAE,aAAa,GAAG,IAAI,CAAC;IACnE,CAAC;SAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,uEAAuE;QACvE,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK;gBAAE,MAAM;YAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QACrF,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;SAAM,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClG,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChH,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,sFAAsF;QACtF,aAAa,GAAG,IAAI,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;SAAM,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACpL,aAAa,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,aAAa;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClJ,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;SAAM,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,aAAa,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;SAAM,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACvE,aAAa,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;SAAM,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;SAAM,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjE,gFAAgF;QAChF,wCAAwC;QACxC,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mDAAmD,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClI,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,IAAI,OAAO,GAAG,QAAQ,CAAC;QACvB,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,+DAA+D,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;aACrK,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1E,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;SACI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACxH,qFAAqF;QACrF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,kFAAkF;QAClF,oFAAoF;QACpF,kFAAkF;QAClF,uFAAuF;QACvF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC;gBAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QAC7E,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;aACrC,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;;YACvD,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,uFAAuF;AACvF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AACvF,MAAM,SAAS,GAAG,CAAC,CAAS,EAAW,EAAE,CACvC,gCAAgC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,4CAA4C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/J,SAAS,WAAW,CAAC,EAAiB;IACpC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,IAAI,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;iEAGiE;AACjE,SAAS,gBAAgB,CAAC,EAAiB,EAAE,GAAW,EAAE,GAAY;IACpE,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;QACd,OAAO,CAAC;gBACN,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACvH,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO;aACjC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,IAAI,EAAE,CAAC;QACT,8EAA8E;QAC9E,mDAAmD;QACnD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5B,MAAM,MAAM,GAA4B,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvE,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,CAAC,CAAC,GAAG;gBAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;YAChC,IAAI,CAAC,CAAC,GAAG;gBAAE,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAY,CAAC;QACrG,CAAC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,gBAAgB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACrE,sFAAsF;IACtF,IAAI,WAAW,CAAC,EAAE,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,YAAY,EAAE,wBAAwB,EAAE,OAAO,CAAC,CAAC,CAAC;IACjG,mFAAmF;IACnF,IAAI,CAAC,EAAE,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,IAAI,GAAW;QACnB,MAAM,EAAE;YACN,WAAW,EAAE,YAAY;YACzB,6EAA6E;YAC7E,6EAA6E;YAC7E,6DAA6D;YAC7D,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACpH;QACD,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO;KACjC,CAAC;IACF,qFAAqF;IACrF,mFAAmF;IACnF,kFAAkF;IAClF,8BAA8B;IAC9B,IAAI,aAAa;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAClI,OAAO,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;AAEnE;;;2EAG2E;AAC3E,SAAS,QAAQ,CAAC,OAAe,EAAE,GAAY,EAAE,UAAkC,OAAO;IACxF,+EAA+E;IAC/E,mFAAmF;IACnF,8DAA8D;IAC9D,MAAM,GAAG,GAAG,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACpG,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAClJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAAqB,EAAE,SAAkB,EAAY,EAAE;QACnE,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YACnG,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,GAAG;oBAAE,GAAG,GAAG,EAAE,CAAC;qBAChD,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;oBAAE,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;;oBACvE,GAAG,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,+EAA+E;IAC/E,iFAAiF;IACjF,oFAAoF;IACpF,IAAI,OAAO,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAChG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YACpE,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,sFAAsF;IACtF,IAAI,CAAC;QAAC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IAAC,CAAC;IACtF,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAAC,CAAC;AACvD,CAAC;AAED;;;qFAGqF;AACrF,SAAS,aAAa,CAAC,OAAe,EAAE,GAAY;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAG,CAAC,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC3F,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,MAAwB,EAAE,SAAkB,EAAE,MAAc,EAAY,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;AAExH;;;uCAGuC;AACvC,MAAM,UAAU,cAAc,CAAC,MAAgB,EAAE,MAAiC;IAChF,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC3B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACtB,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS;QACtE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;QAC5F,CAAC,CAAC,CAAC,CAAC,CAAC;AACX,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,KAA8B;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAA4B,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,gFAAgF;IAChF,kFAAkF;IAClF,kFAAkF;IAClF,8CAA8C;IAC9C,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO;QACrC,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,YAAY;QACvB,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IAC/D,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW;QAC7D,OAAO,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,IAAI,IAAI,KAAK,cAAc;QACzB,OAAO,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACrF,IAAI,IAAI,KAAK,MAAM;QACjB,OAAO,WAAW,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAChE,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3I,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,QAAQ,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACrF,CAAC;AAED;;kFAEkF;AAClF,MAAM,UAAU,eAAe,CAAC,KAA8B;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAA4B,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,IAAI,IAAI,KAAK,YAAY;QACvB,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IACzE,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,cAAc;QAC3F,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO;QAC/D,OAAO,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3I,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,QAAQ,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACrF,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,OAAgC;IAC5E,MAAM,CAAC,GAAG,OAAO,IAAI,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,sBAAsB;YACzB,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAChD,KAAK,gBAAgB;YACnB,OAAO,WAAW,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1E,KAAK,eAAe;YAClB,OAAO,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3E,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACjD,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACxI,CAAC;QACD;YACE,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,QAAQ,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzF,CAAC;AACH,CAAC","sourcesContent":["// The mapper: a pure function from a coding agent's native tool call to the\n// normalized Scopebond actions (Action Taxonomy v1) it represents. Deterministic\n// and side-effect free, so it can be conformance-tested directly.\n//\n// A shell tool call can carry several commands (`a && b`, `$(c)`, `bash -c '…'`);\n// the mapper decomposes it and returns one intent per simple command, so the\n// runtime evaluates every one and denies if any is out of policy. Non-shell tools\n// map to a single intent (a one-element array), or one per spelling of an\n// ambiguous Windows short path.\n\nimport { digest, redactCommand, scrubParam, scrubSecrets } from \"./minimize.js\";\nimport { canonProgram, decomposeShell, gitArgs, parseGitPush, type SimpleCommand } from \"./shell.js\";\n\nexport interface NormalizedIntent {\n action_type: string;\n params: Record<string, unknown>;\n}\nexport interface Mapped {\n intent: NormalizedIntent;\n /** false when no taxonomy type applies (an unknown tool) or when the command's\n * effect cannot be judged from its text (`patch`, `git apply`, `tar x`): emitted to\n * the observation path (not_evaluated) in normal mode and denied by the closed\n * allowlist in strict mode — never granted. A shell command that could not be\n * parsed, or whose program is only known at run time, is evaluated with an empty\n * program, which the starter policy denies in every mode. */\n evaluated: boolean;\n /** The native tool/event name, for diagnostics. */\n source: string;\n}\n\nconst basename = (t: string): string => t.replace(/^.*[\\\\/]/, \"\");\n\n// Canonicalize a path before any guard sees it:\n// - Windows backslash separators become \"/\" (the taxonomy path space), so a guard\n// written with \"/\" cannot be bypassed by `.scopebond\\agent.key`;\n// - NTFS alternate-stream suffixes (`.env::$DATA`) and the trailing dots/spaces\n// Windows silently drops from a name (`.env.`, `agent.key `) are removed, so they\n// cannot disguise the file they open;\n// - `//` and `/./` collapse.\n// Case is preserved (it is evidence); the starter policy matches case-insensitively.\n// Linear (no regex backtracking on long runs of dots/spaces).\nconst trimDotsSpaces = (seg: string): string => {\n let end = seg.length;\n while (end > 0 && (seg[end - 1] === \".\" || seg[end - 1] === \" \")) end--;\n return end === 0 ? seg : seg.slice(0, end);\n};\nconst normPath = (s: string): string =>\n s.replace(/\\\\/g, \"/\")\n .replace(/::?\\$data$/i, \"\")\n .split(\"/\").map((seg) => (seg === \".\" || seg === \"..\" ? seg : trimDotsSpaces(seg))).join(\"/\")\n .replace(/\\/(?:\\.\\/)+/g, \"/\").replace(/\\/{2,}/g, \"/\");\n\nconst rel = (value: unknown, cwd?: string): string => {\n const s = normPath(String(value ?? \"\"));\n const c = cwd ? normPath(cwd) : undefined;\n if (c && s.toLowerCase().startsWith(c.toLowerCase() + \"/\")) return s.slice(c.length + 1);\n if (c && s.toLowerCase() === c.toLowerCase()) return \".\";\n return s;\n};\n\n// Windows 8.3 short names: `CLAUDE~1` opens `.claude`, `SCOPEB~1` opens `.scopebond`,\n// `SETTIN~1.JSO` opens `settings.json`. A short segment that could abbreviate a\n// protected name is expanded to every protected name it could stand for, and the\n// path is checked in each spelling. Only the names below are expanded; any other\n// short name is left as written.\nconst SHORT_SEGMENT = /^([^.~\\s/]{1,6})~\\d{1,6}(?:\\.([^.\\s/]{1,3}))?$/;\nconst SHORT_TARGETS = [\n \".scopebond\", \".claude\", \".cursor\", \".codex\", \".github\", \".git\", \".husky\", \".circleci\", \".gitlab-ci.yml\", \".gitlab-ci.yaml\",\n \".mcp.json\", \"azure-pipelines.yml\", \"Jenkinsfile\", \"workflows\", \"actions\", \"settings.json\", \"settings.local.json\", \"hooks.json\",\n \"config.toml\", \"agents\", \".ssh\", \".aws\", \".kube\", \".docker\", \".azure\", \".gnupg\", \".config\", \".env\", \".env.local\", \".env.production\",\n \".envrc\", \".npmrc\", \".pypirc\", \".netrc\", \".git-credentials\", \"credentials\", \".credentials.json\", \"id_ed25519\", \"config.json\",\n \"accessTokens.json\", \"credentials.db\", \"attester.key\", \"policy.json\", \"cloud.json\",\n];\nfunction abbreviates(prefix: string, ext: string, long: string): boolean {\n const name = long.replace(/^\\.+/, \"\");\n const dot = name.lastIndexOf(\".\");\n const base = (dot > 0 ? name.slice(0, dot) : name).replace(/[.\\s]/g, \"\").toUpperCase();\n const longExt = dot > 0 ? name.slice(dot + 1).toUpperCase() : \"\";\n return base.length > 0 && base.startsWith(prefix.toUpperCase()) && longExt.slice(0, 3) === ext.toUpperCase()\n && (base.length > 8 || long.startsWith(\".\") || longExt.length > 3 || name.includes(\" \"));\n}\n/** Every spelling a path could have with its short segments expanded (at most 16). */\nfunction pathVariants(path: string): string[] {\n if (!path.includes(\"~\")) return [path];\n let variants: string[][] = [[]];\n for (const seg of path.split(\"/\")) {\n const m = SHORT_SEGMENT.exec(seg);\n const long = m ? SHORT_TARGETS.filter((t) => abbreviates(m[1], m[2] ?? \"\", t)) : [];\n const choices = long.length ? long : [seg];\n const next: string[][] = [];\n for (const v of variants) for (const c of choices) if (next.length < 16) next.push([...v, c]);\n variants = next;\n }\n return [...new Set(variants.map((v) => v.join(\"/\")))];\n}\n\n/** One file intent per spelling of `path` (normally one). */\nfunction pathIntents(action: \"file.read\" | \"file.write\", path: string, source: string, extra: Record<string, unknown> = {}): Mapped[] {\n return pathVariants(path).map((p) => ({ intent: { action_type: action, params: { path: p, ...extra } }, evaluated: true, source }));\n}\n\n// Locations the starter policy protects, as concrete sample paths (files, and the\n// protected directories themselves). An operand the mapper cannot resolve\n// statically — a glob (`.scope*/agent.key`, `.*/*`), a variable (`$D/agent.key`), a\n// brace list or a command substitution — is tested against these: if it could name\n// one, the intent carries that protected path so the guard sees it (the literal\n// operand is kept as `pattern` for the record). Otherwise the literal is used. This\n// keeps shell expansion from hiding a protected file from the path guard.\nconst PROTECTED_SAMPLES = [\n \".scopebond/agent.key\", \".scopebond/attester.key\", \".scopebond/policy.json\", \".scopebond/cloud.json\",\n \"agent.key\", \"attester.key\", \"server.key\", \"cert.pem\", \"id.p12\", \"id.pfx\",\n \".env\", \".env.local\", \".env.production\", \".envrc\",\n \".ssh/id_rsa\", \".ssh/id_ed25519\", \".aws/credentials\", \".npmrc\", \".pypirc\", \".netrc\", \".git-credentials\",\n \".kube/config\", \".docker/config.json\", \".config/gcloud/credentials.db\", \".azure/accessTokens.json\",\n \".config/gh/hosts.yml\", \".claude/.credentials.json\",\n \".claude/settings.json\", \".claude/settings.local.json\", \".claude/hooks/hook.sh\", \".claude/agents/agent.md\",\n \".cursor/hooks.json\", \".codex/hooks.json\", \".codex/config.toml\", \".mcp.json\",\n \".git/hooks/pre-commit\", \".git/config\", \".husky/pre-commit\", \".github/workflows/ci.yml\", \".github/actions/a/action.yml\",\n \".gitlab-ci.yml\", \".gitlab-ci.yaml\", \".circleci/config.yml\", \"azure-pipelines.yml\", \"Jenkinsfile\",\n // the protected directories themselves (a recursive reader or copier given the directory)\n \".scopebond\", \".ssh\", \".aws\", \".kube\", \".docker\", \".azure\", \".gnupg\", \".config/gcloud\", \".config/gh\",\n];\n\nconst UNRESOLVED = /[*?[\\]{}$`]/;\nconst EXPANSION = /\\$\\{[^}]*\\}|\\$\\([^)]*\\)|`[^`]*`|\\$[A-Za-z0-9_]+|[*?[\\]{}]/g;\n\n/** Convert a shell word with globs/variables/braces into an anchored matcher. Glob\n * metacharacters stay within one path segment; a variable or substitution may span\n * segments. Like the shell, a segment wildcard does not match a leading dot. Linear:\n * no nested quantifiers are generated. */\nfunction wordMatcher(word: string): RegExp {\n let re = \"\";\n let segStart = true;\n for (let i = 0; i < word.length; i++) {\n const c = word[i];\n const leadingDot = segStart ? \"(?!\\\\.)\" : \"\";\n if (c === \"*\") re += leadingDot + \"[^/]*\";\n else if (c === \"?\") re += leadingDot + \"[^/]\";\n else if (c === \"[\") { const end = word.indexOf(\"]\", i + 1); re += leadingDot + \"[^/]\"; if (end > i) i = end; }\n else if (c === \"{\") { const end = word.indexOf(\"}\", i + 1); re += \"[^/]*\"; if (end > i) i = end; }\n else if (c === \"$\" || c === \"`\") {\n // $VAR, ${VAR…}, $(…) or `…`: any text, possibly several segments.\n if (word[i + 1] === \"{\" || word[i + 1] === \"(\") { const close = word[i + 1] === \"{\" ? \"}\" : \")\"; const end = word.indexOf(close, i + 2); if (end > i) i = end; }\n else if (c === \"`\") { const end = word.indexOf(\"`\", i + 1); if (end > i) i = end; }\n else while (i + 1 < word.length && /[A-Za-z0-9_]/.test(word[i + 1])) i++;\n re += \".*\";\n } else re += c.replace(/[.+^()|\\\\]/g, \"\\\\$&\");\n segStart = c === \"/\";\n }\n return new RegExp(\"^(?:\" + re + \")$\", \"i\");\n}\n\n// The protected sample an unresolvable operand could name, if any. The operand's\n// last N segments are compared with each N-segment sample, so any prefix — `x/../`,\n// `$HOME/`, an absolute path — cannot move the tail out of view. A tail made only of\n// wildcards or variables (`*`, the last segment of `src/*`, `$FILE`) names nothing and\n// is not compared — `cat logs/*` is not a read of `agent.key` — but a tail with any\n// literal text, even a lone dot, is: `.*/*` can reach `.scopebond/agent.key`.\nconst MAX_WORD = 4096;\nfunction protectedCandidate(word: string): string | undefined {\n // An absurdly long unresolvable operand is not worth analysing: treat it as if it\n // could name the hook's own files (fail closed) rather than scan it.\n if (word.length > MAX_WORD) return PROTECTED_SAMPLES[0];\n const segs = word.split(\"/\");\n const cache = new Map<number, RegExp | null>();\n for (const sample of PROTECTED_SAMPLES) {\n const n = sample.split(\"/\").length;\n if (segs.length < n) continue;\n let m = cache.get(n);\n if (m === undefined) {\n const tail = segs.slice(-n).join(\"/\");\n m = /[^/]/.test(tail.replace(EXPANSION, \"\")) ? wordMatcher(tail) : null;\n cache.set(n, m);\n }\n if (m && m.test(sample)) return sample;\n }\n return undefined;\n}\n\n/** The file intents for one path operand, resolving it against a `cd` prefix. */\nfunction fileIntent(action: \"file.read\" | \"file.write\", word: string, dir: string, cwd?: string): Mapped[] {\n let w = word;\n if (dir && !/^(?:[\\\\/]|~|[A-Za-z]:|\\$)/.test(w)) w = dir.replace(/\\/+$/, \"\") + \"/\" + w;\n const path = rel(scrubParam(w), cwd);\n if (UNRESOLVED.test(w)) {\n const hit = protectedCandidate(normPath(w));\n if (hit) return pathIntents(action, hit, \"shell\", { pattern: path });\n }\n return pathIntents(action, path, \"shell\");\n}\n\n// Shell programs whose operands are files whose CONTENT they output, copy or send. A\n// read of the signing keys or a secret file through the shell (`cat .scopebond/attester.key`,\n// `grep -r . .scopebond`) must reach the same file.read guard as the Read tool.\n// Metadata-only programs (`ls`, `stat`, `test`, `[`, `file`) are not readers.\nconst READERS = new Set([\n \"cat\", \"tac\", \"less\", \"more\", \"head\", \"tail\", \"nl\", \"od\", \"xxd\", \"hexdump\", \"strings\", \"base64\", \"base32\",\n \"bat\", \"type\", \"get-content\", \"gc\", \"grep\", \"egrep\", \"fgrep\", \"rg\", \"ag\", \"ack\", \"awk\", \"gawk\", \"mawk\", \"nawk\", \"sort\",\n \"uniq\", \"cut\", \"paste\", \"diff\", \"cmp\", \"comm\", \"wc\", \"jq\", \"yq\", \"sed\", \"iconv\", \"openssl\", \"gpg\", \"md5sum\",\n \"sha1sum\", \"sha256sum\", \"sha512sum\", \"shasum\", \"source\", \".\", \"select-string\", \"sls\",\n \"import-csv\", \"tar\", \"bsdtar\", \"zip\", \"7z\", \"7za\", \"7zz\", \"gzip\", \"bzip2\", \"xz\", \"zstd\", \"zcat\", \"view\", \"code\",\n]);\n// Editors read their operands and can write them (`vim -es -c ':wq' f`, `ed f`).\nconst EDITORS = new Set([\"vi\", \"vim\", \"nvim\", \"ex\", \"ed\", \"nano\", \"pico\", \"emacs\", \"micro\", \"joe\", \"kak\", \"hx\", \"helix\", \"mcedit\"]);\n// Programs that copy or move: sources are read, the destination is written; `mv`\n// also removes its sources, so they are writes too.\nconst COPIERS = new Set([\"cp\", \"mv\", \"rsync\", \"scp\", \"install\", \"ln\", \"copy-item\", \"cpi\", \"copy\", \"move-item\", \"mi\", \"move\", \"robocopy\", \"xcopy\", \"rename-item\", \"ren\"]);\nconst MOVERS = new Set([\"mv\", \"move-item\", \"mi\", \"move\", \"rename-item\", \"ren\"]);\n// Programs whose operands are files they WRITE (or whose metadata they change).\nconst WRITERS = new Set([\"tee\", \"touch\", \"truncate\", \"set-content\", \"sc\", \"add-content\", \"ac\", \"out-file\", \"new-item\", \"ni\", \"clear-content\", \"clc\", \"chmod\", \"chown\", \"chattr\", \"attrib\", \"icacls\", \"set-acl\", \"shred\", \"unlink\", \"sponge\"]);\n// Programs that send what they are given elsewhere (network, clipboard, mail): an\n// operand naming a secret location is a read of it.\nconst UPLOADERS = new Set([\n \"curl\", \"wget\", \"http\", \"https\", \"xh\", \"httpie\", \"nc\", \"ncat\", \"netcat\", \"socat\", \"telnet\", \"ftp\", \"sftp\", \"lftp\", \"smbclient\",\n \"aws\", \"gsutil\", \"gcloud\", \"az\", \"rclone\", \"s3cmd\", \"gh\", \"glab\", \"mail\", \"mailx\", \"sendmail\", \"mutt\", \"xclip\", \"xsel\",\n \"pbcopy\", \"wl-copy\", \"clip\", \"set-clipboard\", \"croc\", \"wormhole\",\n]);\n// Flags whose value is a file the program reads (`curl -T f`, `curl -d @f`) or writes (`-o f`).\n// Read flags apply to readers, copiers and uploaders only (`test -f .env` reads nothing).\nconst READ_FLAGS = new Set([\"-t\", \"--upload-file\", \"-k\", \"--config\", \"--input-file\", \"--post-file\", \"--body-file\", \"-in\", \"-inkey\", \"-key\", \"-infile\", \"--key\", \"--cert\", \"-f\", \"--file\", \"-literalpath\", \"-path\", \"-filepath\", \"-inputobject\"]);\nconst WRITE_FLAGS = new Set([\"-o\", \"--output\", \"-out\", \"--output-document\", \"-destination\", \"-outfile\", \"--target-directory\"]);\n// curl/wget request-body and form flags carry inline data, not a filename — a quoted\n// JSON body must not be read as a glob over a protected path. Their value names a file\n// only through `@`: `-d @.env`, `-F upload=@secret`, `--data-urlencode key@file`.\nconst CURL_DATA = new Set([\"-d\", \"--data\", \"--data-ascii\", \"--data-binary\", \"--data-raw\", \"--json\", \"--post-data\", \"--body-data\"]);\nconst CURL_URLENCODE = \"--data-urlencode\";\nconst CURL_FORM = new Set([\"-F\", \"--form\", \"--form-string\"]);\n/** The file a curl/wget body/form value points at with `@`, or undefined for inline data. */\nfunction curlFileRef(flag: string, value: string): string | undefined {\n if (value.startsWith(\"@\")) return value.slice(1).split(\";\")[0];\n if (flag === CURL_URLENCODE) { const m = /^[^=@]*@(.+)$/.exec(value); if (m) return m[1]; }\n if (CURL_FORM.has(flag)) { const m = /=@([^;]+)/.exec(value); if (m) return m[1]; }\n return undefined;\n}\n// Names an uploader's operand, or `git add`'s, is checked against: a secret path sent\n// or staged (`gh gist create .env`, `git add .env`) is a read of that path.\nconst SENSITIVE = /(?:^|[/\\\\])(?:\\.scopebond(?:[/\\\\]|$)|\\.env(?:\\.[^/\\\\]*)?$|\\.envrc$|\\.ssh(?:[/\\\\]|$)|\\.aws(?:[/\\\\]|$)|\\.npmrc$|\\.pypirc$|_?\\.?netrc$|\\.git-credentials$|\\.kube(?:[/\\\\]|$)|\\.docker(?:[/\\\\]|$)|\\.azure(?:[/\\\\]|$)|\\.gnupg(?:[/\\\\]|$)|\\.config[/\\\\](?:gcloud|gh)(?:[/\\\\]|$)|\\.credentials\\.json$)|\\.(?:key|pem|p12|pfx|jks|keystore)$/i;\n\nconst INTERPRETERS = new Set([\"node\", \"deno\", \"bun\", \"python\", \"python3\", \"py\", \"ruby\", \"perl\", \"php\", \"osascript\", \"lua\", \"tclsh\"]);\n// Path literals inside inline code. Each alternative starts at a boundary (not after\n// a word character — so `process.env` is not `.env`) and has no overlapping repeats,\n// keeping the scan linear; input is capped per argument.\nconst SENSITIVE_IN_CODE = /(?<![\\w$])(?:\\.scopebond[\\\\/][\\w.-]*|\\.env(?:\\.[\\w-]+)?(?![\\w.-])|\\.envrc|\\.ssh[\\\\/][\\w.-]+|\\.aws[\\\\/]credentials|\\.claude[\\\\/]settings[\\w.-]*|\\.cursor[\\\\/]hooks\\.json|\\.codex[\\\\/](?:hooks\\.json|config\\.toml)|\\.git[\\\\/](?:hooks[\\\\/][\\w.-]*|config)|\\.github[\\\\/](?:workflows|actions)[\\\\/][\\w./-]*|\\.npmrc|\\.git-credentials)|(?<![\\w.-])[\\w-]+\\.(?:key|pem|p12|pfx)(?![\\w])/gi;\n// A file or process API in the same inline snippet, required in call or member form\n// (not a bare English word — \"your .env file\" must not read like `File`). Without one,\n// a protected path in a string literal opens nothing. Covers Node (fs/child_process/\n// streams), Python (open, os, subprocess, pathlib, shutil), Ruby/PHP (File/IO/fopen/\n// file_get_contents) and PowerShell (Get-/Set-Content, Out-File, Invoke-*).\nconst FILE_API = /\\b(?:open|fopen|readlink|read_file|readfile|read_to_string|readfilesync|writefile|writefilesync|appendfile|appendfilesync|createreadstream|createwritestream|openfile|opensync|copyfile|copyfilesync|rename|renamesync|unlink|unlinksync|popen|spawn|spawnsync|exec|execsync|execfile|execfilesync|system|shell_exec|proc_open|file_get_contents|file_put_contents|urlopen)\\s*\\(|\\b(?:fs|io|os|subprocess|child_process|pathlib|shutil|File|Dir|IO|Pathname|Path|FileUtils)\\s*\\.\\s*\\w|\\bimport\\s+(?:os|subprocess|shutil|pathlib|io)\\b|\\brequire\\s*\\(\\s*['\"`](?:node:)?(?:fs|child_process)|\\b(?:Get-Content|Set-Content|Out-File|Add-Content|Import-Csv|Invoke-\\w+)\\b/i;\nconst CODE_SCAN_LIMIT = 20000;\n\n/** Option arities of the content readers, so an option's value (`grep -C 3`, `rg -g\n * '!*.key'`, `head -n 1`) is never taken for a file operand. `short`: letters that\n * take a value; `optional`: letters whose value can only be attached; `long`: long\n * options that take the next word; `read`/`write`: options whose value is a file. */\ninterface OptionSpec { short?: string; optional?: string; long?: string[]; read?: string[]; write?: string[] }\nconst GREP: OptionSpec = { short: \"efmABCdD\", long: [\"--regexp\", \"--file\", \"--max-count\", \"--after-context\", \"--before-context\", \"--context\", \"--include\", \"--exclude\", \"--exclude-dir\", \"--exclude-from\", \"--directories\", \"--devices\", \"--label\", \"--binary-files\", \"--group-separator\"], read: [\"-f\", \"--file\", \"--exclude-from\"] };\nconst AWK: OptionSpec = { short: \"fvF\", long: [\"--file\", \"--assign\", \"--field-separator\", \"--include\", \"--load\"], read: [\"-f\", \"--file\"] };\nconst VIM: OptionSpec = { short: \"cSuiTwWtq\", long: [\"--cmd\"], read: [\"-S\", \"-u\"], write: [\"-w\", \"-W\"] };\nconst OPTIONS = new Map<string, OptionSpec>([\n [\"grep\", GREP], [\"egrep\", GREP], [\"fgrep\", GREP],\n [\"rg\", { short: \"efgtTmABCjMErd\", long: [\"--regexp\", \"--file\", \"--glob\", \"--iglob\", \"--type\", \"--type-not\", \"--type-add\", \"--type-clear\", \"--max-count\", \"--after-context\", \"--before-context\", \"--context\", \"--threads\", \"--max-columns\", \"--encoding\", \"--replace\", \"--max-depth\", \"--max-filesize\", \"--pre\", \"--pre-glob\", \"--ignore-file\", \"--sort\", \"--sortr\", \"--colors\", \"--path-separator\", \"--context-separator\", \"--engine\"], read: [\"-f\", \"--file\", \"--ignore-file\"] }],\n [\"ag\", { short: \"ABCGgmp\", long: [\"--ignore\", \"--ignore-dir\", \"--file-search-regex\", \"--depth\", \"--pager\", \"--after\", \"--before\", \"--context\", \"--max-count\", \"--path-to-ignore\"], read: [\"-p\", \"--path-to-ignore\"] }],\n [\"ack\", { short: \"ABCm\", long: [\"--type\", \"--ignore-dir\", \"--ignore-file\", \"--match\", \"--max-count\", \"--output\", \"--after-context\", \"--before-context\", \"--context\"] }],\n [\"awk\", AWK], [\"gawk\", AWK], [\"mawk\", AWK], [\"nawk\", AWK],\n [\"jq\", { short: \"fL\", long: [\"--from-file\", \"--indent\"], read: [\"-f\", \"--from-file\"] }],\n [\"yq\", { short: \"Iop\", long: [\"--indent\", \"--output-format\", \"--input-format\", \"--expression\", \"--front-matter\"] }],\n [\"head\", { short: \"nc\", long: [\"--lines\", \"--bytes\"] }],\n [\"tail\", { short: \"nc\", long: [\"--lines\", \"--bytes\", \"--pid\", \"--sleep-interval\", \"--max-unchanged-stats\"] }],\n [\"sort\", { short: \"ktoST\", long: [\"--key\", \"--field-separator\", \"--output\", \"--buffer-size\", \"--temporary-directory\", \"--files0-from\", \"--batch-size\", \"--parallel\"], read: [\"--files0-from\"] }],\n [\"cut\", { short: \"bcdf\", long: [\"--bytes\", \"--characters\", \"--delimiter\", \"--fields\", \"--output-delimiter\"] }],\n [\"od\", { short: \"AjNStw\" }], [\"xxd\", { short: \"cglos\" }], [\"hexdump\", { short: \"efns\", read: [\"-f\"] }],\n [\"base64\", { short: \"w\" }], [\"base32\", { short: \"w\" }],\n [\"diff\", { short: \"CUFILXx\", long: [\"--label\", \"--ignore-matching-lines\", \"--show-function-line\", \"--exclude\", \"--exclude-from\", \"--from-file\", \"--to-file\", \"--horizon-lines\"], read: [\"-X\", \"--exclude-from\", \"--from-file\", \"--to-file\"] }],\n [\"nl\", { short: \"bdfhilnsvw\" }],\n [\"strings\", { short: \"nte\", long: [\"--bytes\", \"--radix\", \"--encoding\", \"--output-separator\"] }],\n [\"tar\", { short: \"fCTXbHKLNVg\", long: [\"--file\", \"--directory\", \"--files-from\", \"--exclude-from\", \"--exclude\", \"--transform\", \"--owner\", \"--group\", \"--mode\", \"--mtime\", \"--newer\", \"--after-date\", \"--label\", \"--format\", \"--blocking-factor\"], read: [\"-T\", \"-X\", \"--files-from\", \"--exclude-from\"] }],\n [\"unzip\", { short: \"dxP\" }],\n [\"sed\", { short: \"efl\", optional: \"i\", long: [\"--expression\", \"--file\", \"--line-length\"], read: [\"-f\", \"--file\"] }],\n [\"vi\", VIM], [\"vim\", VIM], [\"nvim\", VIM], [\"view\", VIM], [\"ex\", VIM],\n [\"ed\", { short: \"p\" }],\n [\"gpg\", { short: \"orRu\", long: [\"--output\", \"--recipient\", \"--local-user\", \"--homedir\", \"--default-key\"] }],\n]);\n// Programs whose first operand is a pattern or program text, not a file — unless the\n// pattern came from an option (`grep -e p`, `awk -f prog`, `jq -f filter`).\nconst PATTERN_FIRST = new Set([\"grep\", \"egrep\", \"fgrep\", \"rg\", \"ag\", \"ack\", \"awk\", \"gawk\", \"mawk\", \"nawk\", \"jq\", \"yq\", \"select-string\", \"sls\"]);\nconst PATTERN_OPTIONS = new Set([\"-e\", \"-f\", \"--regexp\", \"--file\", \"--from-file\", \"--expression\"]);\n\n/** If `t` is an option that takes a value under `spec`, its name and any attached value. */\nfunction valuedOption(spec: OptionSpec | undefined, t: string): { name: string; attached?: string } | undefined {\n if (!spec) return undefined;\n if (t.startsWith(\"--\")) return spec.long?.includes(t) ? { name: t } : undefined;\n for (let k = 1; k < t.length; k++) {\n if (spec.optional?.includes(t[k])) return undefined;\n if (spec.short?.includes(t[k])) return { name: \"-\" + t[k], attached: t.slice(k + 1) || undefined };\n }\n return undefined;\n}\n\n// `git config` keys whose value runs a program, redirects a push or reroutes a remote:\n// setting one is a write to the protected git config.\nconst DANGEROUS_GIT_KEY = /^(?:core\\.(?:hookspath|fsmonitor|sshcommand|pager|editor|askpass|gitproxy)|alias\\..+|include\\.path|includeif\\..+|remote\\..+\\.(?:push|pushurl|url|receivepack|uploadpack)|url\\..+\\.(?:insteadof|pushinsteadof)|push\\.default|remote\\.pushdefault|credential\\..*helper|filter\\..+\\.(?:clean|smudge|process)|diff\\..+\\.(?:textconv|command)|merge\\..+\\.driver|sequence\\.editor|gpg\\.(?:.+\\.)?program)$/i;\n\n/** The file a `git config …` invocation writes, or undefined when it only reads (or\n * sets a harmless key). `--file F` writes F for any key; otherwise setting a\n * dangerous key (or `--edit`) writes the git config (`--global` included, recorded as\n * `.git/config` so the protected-write guard applies). */\nfunction gitConfigWrite(args: string[]): string | undefined {\n let file: string | undefined;\n let edit = false;\n let mutate = false;\n let query = false;\n const positional: string[] = [];\n const valued = new Set([\"-f\", \"--file\", \"--blob\", \"--type\", \"--default\", \"--comment\", \"--value\"]);\n for (let i = 0; i < args.length; i++) {\n const a = args[i];\n if (a === \"-f\" || a === \"--file\") { file = args[++i]; continue; }\n if (a.startsWith(\"--file=\")) { file = a.slice(7); continue; }\n if (valued.has(a)) { i++; continue; }\n if (a === \"-e\" || a === \"--edit\") { edit = true; continue; }\n if (/^--(?:add|replace-all|unset|unset-all|rename-section|remove-section)$/.test(a)) { mutate = true; continue; }\n if (/^(?:--get|--get-all|--get-regexp|--get-urlmatch|-l|--list|--get-color|--get-colorbool)$/.test(a)) { query = true; continue; }\n if (a.startsWith(\"-\")) continue;\n positional.push(a);\n }\n const verb = positional[0]?.toLowerCase();\n if (verb === \"edit\") edit = true;\n else if (verb === \"set\" || verb === \"unset\" || verb === \"rename-section\" || verb === \"remove-section\") { mutate = true; positional.shift(); }\n else if (verb === \"get\" || verb === \"list\") query = true;\n const key = positional[0] ?? \"\";\n const writes = edit || (!query && (mutate || positional.length >= 2));\n if (!writes) return undefined;\n if (file !== undefined) return file;\n const section = /^(?:alias|core|include|includeif|remote|url|filter|diff|merge|credential|push|gpg|sequence)(?:\\.|$)/i;\n return edit || DANGEROUS_GIT_KEY.test(key) || (mutate && positional.some((p) => section.test(p))) ? \".git/config\" : undefined;\n}\n\n/** Split git subcommand arguments into positionals, honoring `--` and skipping the\n * values of the given options. */\nfunction gitPositionals(args: string[], valued: string[] = []): { before: string[]; after: string[] | null } {\n const before: string[] = [];\n for (let i = 0; i < args.length; i++) {\n const a = args[i];\n if (a === \"--\") return { before, after: args.slice(i + 1) };\n if (valued.includes(a)) { i++; continue; }\n if (a.startsWith(\"-\")) continue;\n before.push(a);\n }\n return { before, after: null };\n}\n\nconst isPathWord = (t: string): boolean => t !== \"\" && !/^\\d+$/.test(t) && !/^[a-z][a-z0-9+.-]*:\\/\\//i.test(t);\nconst isSensitiveOperand = (w: string): boolean => SENSITIVE.test(w) || (UNRESOLVED.test(w) && protectedCandidate(normPath(w)) !== undefined);\n\n/** Derive the file.read / file.write intents a simple shell command implies —\n * operands of reader, copier, writer and editor programs, flag values that name\n * files, redirection targets, the sensitive operands of uploaders and `git add`, and\n * the paths git writes (`checkout -- p`, `restore`, `mv`, `rm`, `config`) — resolved\n * against the directory an earlier `cd` in the same call moved to. These flow through\n * the same protect-read / protect-write clauses as the native file tools; a false\n * positive (a non-protected operand) is a harmless extra receipt the starter policy\n * allows. `unknownTarget` is set when the command writes files its text does not\n * name (`patch`, `git apply`, `tar x`, `unzip`). */\nfunction fileOpsFromShell(sc: SimpleCommand, dir: string, cwd?: string): { ops: Mapped[]; unknownTarget: boolean } {\n const ops: Mapped[] = [];\n let unknownTarget = false;\n const prog = canonProgram(sc.program);\n const read = (w: string | undefined) => { if (w !== undefined && isPathWord(w)) ops.push(...fileIntent(\"file.read\", w, dir, cwd)); };\n const write = (w: string | undefined) => { if (w !== undefined && isPathWord(w)) ops.push(...fileIntent(\"file.write\", w, dir, cwd)); };\n const args = sc.argv;\n const spec = OPTIONS.get(prog);\n const flagFiles = READERS.has(prog) || EDITORS.has(prog) || COPIERS.has(prog) || UPLOADERS.has(prog);\n\n // Operands (non-flag words) and flag values (`--flag=value`, `-T value`, `@file`, `if=f`).\n const operands: string[] = [];\n const given = new Set<string>();\n const flagValue = (name: string, value: string) => {\n const lower = name.toLowerCase();\n given.add(name);\n if (spec?.write?.includes(name) || WRITE_FLAGS.has(lower)) write(value);\n else if (spec?.read?.includes(name) || (flagFiles && READ_FLAGS.has(lower))) read(value.replace(/^@/, \"\"));\n else if (value.startsWith(\"@\")) read(value.slice(1));\n };\n for (let i = 0; i < args.length; i++) {\n const t = args[i];\n if (t === \"--\") { operands.push(...args.slice(i + 1)); break; }\n const lower = t.toLowerCase();\n const eq = t.indexOf(\"=\");\n if (prog === \"curl\" || prog === \"wget\") {\n const flag = eq > 0 && t.startsWith(\"--\") ? t.slice(0, eq) : t;\n if (CURL_DATA.has(flag) || CURL_FORM.has(flag) || flag === CURL_URLENCODE) {\n let value: string | undefined;\n if (eq > 0 && t.startsWith(\"--\")) value = t.slice(eq + 1);\n else value = args[++i];\n given.add(flag);\n if (value !== undefined) { const f = curlFileRef(flag, value); if (f !== undefined) read(f); }\n continue;\n }\n }\n if (t.startsWith(\"-\") && eq > 0) { // --flag=value\n const flag = t.slice(0, eq);\n const value = t.slice(eq + 1);\n given.add(flag);\n if (spec?.write?.includes(flag) || WRITE_FLAGS.has(flag.toLowerCase())) write(value.replace(/^@/, \"\"));\n else if (spec?.read?.includes(flag) || (flagFiles && READ_FLAGS.has(flag.toLowerCase())) || value.startsWith(\"@\") || (UPLOADERS.has(prog) && SENSITIVE.test(value))) read(value.replace(/^@/, \"\"));\n continue;\n }\n if (t.startsWith(\"-\") && t.length > 1) {\n // jq's two-valued options: `--arg name value`, `--slurpfile name file`.\n if (prog === \"jq\" && /^--(?:arg|argjson|slurpfile|rawfile)$/.test(t)) { if (/file$/.test(t)) read(args[i + 2]); i += 2; continue; }\n const opt = valuedOption(spec, t);\n if (opt) {\n let value = opt.attached;\n if (value === undefined && i + 1 < args.length) value = args[++i];\n if (value !== undefined) flagValue(opt.name, value);\n continue;\n }\n const value = args[i + 1];\n if (value !== undefined && !value.startsWith(\"-\")) {\n if (COPIERS.has(prog) && t === \"-t\") { write(value); i++; continue; } // cp -t DIR\n if (WRITERS.has(prog) && /^-(?:path|literalpath|filepath)$/.test(lower)) { write(value); i++; continue; } // Set-Content -Path f\n if (WRITE_FLAGS.has(lower)) { write(value); i++; continue; }\n if (flagFiles && READ_FLAGS.has(lower)) { read(value.replace(/^@/, \"\")); i++; continue; }\n if (value.startsWith(\"@\")) { read(value.slice(1)); i++; continue; }\n }\n continue;\n }\n if (prog === \"dd\" && /^(?:if|of)=/.test(t)) { (t.startsWith(\"of=\") ? write : read)(t.slice(3)); continue; }\n if (t.startsWith(\"@\")) { read(t.slice(1)); continue; }\n operands.push(t);\n }\n if (PATTERN_FIRST.has(prog) && ![...given].some((g) => PATTERN_OPTIONS.has(g)) && !(prog === \"yq\" && operands.length === 1)) operands.shift();\n\n const git = gitArgs(sc);\n const inPlace = (a: string) => a === \"--inplace\" || a.startsWith(\"--in-place\") || /^-[a-hj-z]*i/.test(a);\n if (git) {\n const sub = git.sub?.toLowerCase();\n const a = git.args;\n if (sub === \"add\") {\n // Staging a secret is one commit away from publishing it.\n const { before, after } = gitPositionals(a, [\"--pathspec-from-file\"]);\n [...before, ...(after ?? [])].filter(isSensitiveOperand).forEach(read);\n } else if (sub === \"checkout\") {\n const { before, after } = gitPositionals(a, [\"-b\", \"-B\", \"--orphan\", \"--conflict\", \"--pathspec-from-file\"]);\n (after ?? before).forEach(write);\n } else if (sub === \"restore\") {\n const { before, after } = gitPositionals(a, [\"-s\", \"--source\", \"--pathspec-from-file\"]);\n [...before, ...(after ?? [])].forEach(write);\n } else if (sub === \"mv\") {\n const { before, after } = gitPositionals(a);\n const all = [...before, ...(after ?? [])];\n all.slice(0, -1).forEach(read);\n all.forEach(write);\n } else if (sub === \"rm\" && !a.includes(\"--cached\")) {\n const { before, after } = gitPositionals(a, [\"--pathspec-from-file\"]);\n [...before, ...(after ?? [])].forEach(write);\n } else if (sub === \"config\") write(gitConfigWrite(a));\n else if (sub === \"show\" || sub === \"cat-file\") {\n // `git show REV:path` prints that file's content from history.\n for (const w of a) { const m = /^(?:[^-:][^:]*)?:(?:\\d:)?(.+)$/.exec(w); if (m && !/^[a-z][a-z0-9+.-]*:\\/\\//i.test(w)) read(m[1]); }\n } else if (sub === \"apply\" || sub === \"am\") unknownTarget = true;\n } else if (prog === \"find\") {\n // `find DIR … -exec cat {} +` reads DIR's files; `-fprint F` writes F.\n const starts: string[] = [];\n for (const w of args) { if (/^[-(!]/.test(w) || w === \"\\\\(\") break; starts.push(w); }\n if (args.some((w) => /^-(?:exec|execdir|ok|okdir)$/.test(w))) starts.forEach(read);\n args.forEach((w, k) => { if (/^-(?:fprint0?|fprintf|fls)$/.test(w)) write(args[k + 1]); });\n } else if ((prog === \"docker\" || prog === \"podman\" || prog === \"kubectl\") && operands[0] === \"cp\") {\n const local = (p: string | undefined) => p !== undefined && (!/^[^/\\\\]+:/.test(p) || /^[A-Za-z]:[\\\\/]/.test(p));\n if (local(operands[1])) read(operands[1]);\n if (local(operands[2])) write(operands[2]);\n } else if (prog === \"patch\") {\n // The file a patch changes is named inside the patch; an explicit operand is written.\n unknownTarget = true;\n write(operands[0]);\n } else if ((prog === \"tar\" || prog === \"bsdtar\") && (args.some((w) => w === \"--extract\" || w === \"--get\" || /^-[A-Za-z]*x/.test(w)) || /^[A-Za-z]*x[A-Za-z]*$/.test(args[0] ?? \"\"))) {\n unknownTarget = true;\n args.forEach((w, k) => { if (w === \"-C\" || w === \"--directory\") write(args[k + 1]); else if (w.startsWith(\"--directory=\")) write(w.slice(12)); });\n operands.forEach(read);\n } else if (prog === \"unzip\" && !args.some((w) => /^-[ltvZpcz]$/.test(w))) {\n unknownTarget = true;\n args.forEach((w, k) => { if (w === \"-d\") write(args[k + 1]); });\n read(operands[0]);\n } else if (/^7z[arz]?$/.test(prog) && /^[xe]$/.test(operands[0] ?? \"\")) {\n unknownTarget = true;\n args.forEach((w) => { if (/^-o./.test(w)) write(w.slice(2)); });\n read(operands[1]);\n } else if (prog === \"cpio\" && args.some((w) => w === \"--extract\" || /^-[A-Za-z]*i/.test(w))) {\n unknownTarget = true;\n } else if (prog === \"gpg\" && args.some((w) => /^--export-secret-(?:sub)?keys$/.test(w))) {\n read(\".gnupg/private-keys-v1.d\");\n } else if (READERS.has(prog)) {\n operands.forEach(read);\n if (prog === \"yq\" && args.some(inPlace)) operands.forEach(write);\n // `sed -i 's/x/y/' f…` rewrites its operands in place; the first operand is the\n // script unless `-e`/`-f` supplied one.\n if (prog === \"sed\" && args.some((a) => /^-[A-Za-z]*i/.test(a) || a.startsWith(\"--in-place\"))) {\n const scriptGiven = args.some((a) => a === \"-e\" || a === \"-f\" || a.startsWith(\"--expression\")) || given.has(\"-e\") || given.has(\"-f\");\n (scriptGiven ? operands : operands.slice(1)).forEach(write);\n }\n } else if (EDITORS.has(prog)) {\n operands.forEach(read);\n operands.forEach(write);\n } else if (COPIERS.has(prog) && operands.length) {\n const hasTarget = args.some((a) => /^(?:-t|--target-directory(?:=.*)?|-destination)$/i.test(a) || /^--target-directory=/.test(a));\n const sources = hasTarget ? operands : operands.slice(0, -1);\n sources.forEach(read);\n if (MOVERS.has(prog)) sources.forEach(write);\n if (!hasTarget) write(operands[operands.length - 1]);\n } else if (WRITERS.has(prog)) {\n // A permission/owner spec is not a path: `chmod +x f`, `chmod 0755 f`,\n // `chattr +i f`, `chown root:wheel f`, `attrib +r f` write f, not \"+x\".\n let targets = operands;\n if (prog === \"chmod\" || prog === \"chattr\" || prog === \"attrib\") targets = targets.filter((o) => !/^[+\\-=][rwxstugoa+-]*$|^[ugoa]+[+\\-=][rwxXst]*$|^[0-7]{3,4}$/i.test(o));\n else if (prog === \"chown\" || prog === \"chgrp\") targets = targets.slice(1);\n targets.forEach(write);\n }\n else if ((prog === \"perl\" || prog === \"ruby\") && args.some((a) => /^-[A-Za-z]*i/.test(a) || a.startsWith(\"--in-place\"))) {\n // `perl -i -pe 's/x/y/' f…`: the first operand is the script (unless -e/-f gave it).\n const scriptGiven = args.some((a) => a === \"-e\" || a === \"-f\" || a.startsWith(\"--expression\")) || given.has(\"-e\") || given.has(\"-f\");\n (scriptGiven ? operands : operands.slice(1)).forEach(write);\n } else if (INTERPRETERS.has(prog)) {\n // Inline code (`node -e \"…\"`, `python -c \"…\"`): best effort — a protected-looking\n // path literal is recorded as a read and a write only when the same code also calls\n // a file or process API, so a path merely named in a log string is not a finding.\n // Code that assembles a path at run time is beyond a cooperative hook (use a gateway).\n for (const w of args) {\n const code = w.slice(0, CODE_SCAN_LIMIT);\n if (!FILE_API.test(code)) continue;\n for (const m of code.match(SENSITIVE_IN_CODE) ?? []) { read(m); write(m); }\n }\n } else if (UPLOADERS.has(prog)) {\n operands.filter(isSensitiveOperand).forEach(read);\n }\n\n for (const r of sc.redirects) {\n if (r.op.startsWith(\">\")) write(r.target);\n else if (r.op === \"<>\") { read(r.target); write(r.target); }\n else read(r.target);\n }\n return { ops, unknownTarget };\n}\n\n// The hook's own CLI run by the agent to switch itself off or re-scope itself\n// (`npx @scopebond/hook uninstall`, `scopebond trust`, `scopebond-hook init --force`).\nconst SELF_SUBCOMMANDS = new Set([\"uninstall\", \"trust\", \"init\", \"install\", \"connect\"]);\nconst isHookCli = (w: string): boolean =>\n /^scopebond(?:-hook)?(?:\\.js)?$/.test(canonProgram(w)) || /^@scopebond\\/hook(?:@[^/\\s]*)?$/i.test(w) || /@scopebond[\\\\/]hook[\\\\/]dist[\\\\/]cli\\.js$/i.test(w);\nfunction selfDisable(sc: SimpleCommand): boolean {\n const all = [sc.programRaw, ...sc.argv];\n for (let k = 0; k < all.length; k++) {\n if (!isHookCli(all[k])) continue;\n const sub = all.slice(k + 1).find((a) => !a.startsWith(\"-\"));\n if (sub && SELF_SUBCOMMANDS.has(sub.toLowerCase())) return true;\n }\n return false;\n}\n\n/** Map one parsed simple command to the intents it implies: the git.push or\n * shell.exec itself, plus any file reads/writes it performs. An opaque command\n * (unparseable, or a program known only at run time) becomes a shell.exec with an\n * empty program, evaluated, which the starter policy denies. */\nfunction mapSimpleCommand(sc: SimpleCommand, dir: string, cwd?: string): Mapped[] {\n if (sc.opaque) {\n return [{\n intent: { action_type: \"shell.exec\", params: { command: redactCommand(sc.raw), program: \"\", ...(cwd ? { cwd } : {}) } },\n evaluated: true, source: \"shell\",\n }];\n }\n const push = parseGitPush(sc);\n if (push) {\n // One intent per pushed destination, so a protected branch cannot ride behind\n // an allowed one (`git push origin feature main`).\n return push.targets.map((t) => {\n const params: Record<string, unknown> = { force: t.force };\n if (push.remote !== undefined) params.remote = scrubParam(push.remote);\n if (t.ref !== undefined) params.ref = scrubParam(t.ref);\n if (t.del) params.delete = true;\n if (t.all) params.all = true;\n return { intent: { action_type: \"git.push\", params }, evaluated: true, source: \"shell\" } as Mapped;\n });\n }\n const { ops: files, unknownTarget } = fileOpsFromShell(sc, dir, cwd);\n // The hook disabling itself is a write to its own policy, which the starter protects.\n if (selfDisable(sc)) files.push(...pathIntents(\"file.write\", \".scopebond/policy.json\", \"shell\"));\n // A bare redirection (`> file`) runs no program: only its file effect is recorded.\n if (!sc.program) return files;\n const exec: Mapped = {\n intent: {\n action_type: \"shell.exec\",\n // Scrub before storing: the raw command through the blob-aware scrubber, and\n // the whole first token BEFORE taking its basename, so a bare-secret command\n // containing \"/\" cannot leak a path-fragment as the program.\n params: { command: redactCommand(sc.raw), program: basename(scrubSecrets(sc.programRaw)), ...(cwd ? { cwd } : {}) },\n },\n evaluated: true, source: \"shell\",\n };\n // A command that writes files its text does not name (`patch`, `git apply`, `tar x`)\n // cannot be judged here: its writes are recorded as a file.write with no path, not\n // evaluated — observed in normal mode, denied by strict mode (like an apply_patch\n // with no recognizable path).\n if (unknownTarget) files.push({ intent: { action_type: \"file.write\", params: { path: \"\" } }, evaluated: false, source: \"shell\" });\n return [exec, ...files];\n}\n\nconst CD = new Set([\"cd\", \"pushd\", \"chdir\", \"set-location\", \"sl\"]);\n\n/** Decompose a shell command into the intents it will run. A `cd` earlier in the same\n * call changes the directory later relative operands resolve against\n * (`cd .scopebond && cp x policy.json` writes `.scopebond/policy.json`). An empty\n * command yields a single un-evaluated placeholder (nothing to grant). */\nfunction mapShell(command: string, cwd?: string, dialect: \"posix\" | \"powershell\" = \"posix\"): Mapped[] {\n // PowerShell: `\\` is a path separator and the backtick is the escape character\n // (``Re`move-Item`` runs Remove-Item). Normalize both before the POSIX parser sees\n // them, so neither hides a program or mangles a Windows path.\n const src = dialect === \"powershell\" ? command.replace(/`(.)/g, \"$1\").replace(/\\\\/g, \"/\") : command;\n const commands = decomposeShell(src);\n if (commands.length === 0) {\n return [{ intent: { action_type: \"shell.exec\", params: { command: redactCommand(command), program: \"\" } }, evaluated: false, source: \"shell\" }];\n }\n const walk = (list: SimpleCommand[], filesOnly: boolean): Mapped[] => {\n let dir = \"\";\n const out: Mapped[] = [];\n for (const sc of list) {\n const mapped = mapSimpleCommand(sc, dir, cwd);\n out.push(...(filesOnly ? mapped.filter((m) => m.intent.action_type.startsWith(\"file.\")) : mapped));\n if (!sc.opaque && CD.has(canonProgram(sc.program))) {\n const target = sc.argv.find((a) => !a.startsWith(\"-\"));\n if (target === undefined || target === \"~\") dir = \"\";\n else if (/^(?:[\\\\/]|~[\\\\/]|[A-Za-z]:)/.test(target)) dir = normPath(target);\n else dir = normPath((dir ? dir + \"/\" : \"\") + target);\n }\n }\n return out;\n };\n const out = walk(commands, false);\n // A \"Bash\" command may really run under PowerShell or cmd (Codex and Cursor on\n // Windows), where `\\` separates paths instead of escaping. Read it both ways for\n // file effects, so `.scopebond\\policy.json` is not lost as `.scopebondpolicy.json`.\n if (dialect === \"posix\" && src.includes(\"\\\\\")) {\n const seen = new Set(out.map((m) => `${m.intent.action_type} ${String(m.intent.params.path)}`));\n for (const m of walk(decomposeShell(src.replace(/\\\\/g, \"/\")), true)) {\n const key = `${m.intent.action_type} ${String(m.intent.params.path)}`;\n if (!seen.has(key)) { seen.add(key); out.push(m); }\n }\n }\n return out;\n}\n\nfunction parseMcpName(name: string): { server: string; tool: string } | null {\n if (!name.startsWith(\"mcp__\")) return null;\n const parts = name.split(\"__\");\n if (parts.length < 3) return null;\n return { server: parts[1], tool: parts.slice(2).join(\"__\") };\n}\n\nfunction splitUrl(url: string): { host: string; path: string } {\n // The query string is dropped; a token in the path or an unparseable URL is scrubbed.\n try { const u = new URL(url); return { host: u.host, path: scrubParam(u.pathname) }; }\n catch { return { host: scrubParam(url), path: \"\" }; }\n}\n\n/** Extract every path changed by an apply_patch call. Codex sends the patch in\n * `tool_input.command`; recording one file.write per path lets the same protected-\n * path rules cover file edits made by Claude Code, Cursor and Codex. A patch with\n * no recognizable path is deliberately not evaluated so strict mode can deny it. */\nfunction mapApplyPatch(command: string, cwd?: string): Mapped[] {\n const paths: string[] = [];\n const seen = new Set<string>();\n const prefixes = [\"*** Add File:\", \"*** Update File:\", \"*** Delete File:\", \"*** Move to:\"];\n for (const line of command.split(/\\r?\\n/)) {\n const prefix = prefixes.find((candidate) => line.startsWith(candidate));\n if (!prefix) continue;\n const path = rel(scrubParam(line.slice(prefix.length).trim()), cwd);\n if (!path || seen.has(path)) continue;\n seen.add(path);\n paths.push(path);\n }\n if (paths.length === 0) {\n return one({ action_type: \"file.write\", params: { path: \"\" } }, false, \"apply_patch\");\n }\n return paths.flatMap((path) => pathIntents(\"file.write\", path, \"apply_patch\"));\n}\n\nconst one = (intent: NormalizedIntent, evaluated: boolean, source: string): Mapped[] => [{ intent, evaluated, source }];\n\n/** A bare `git push` (no ref) pushes the current branch. The mapper cannot know it,\n * so the runtime resolves it and fills it in here, before evaluation — otherwise the\n * starter policy's ref bound would fail-closed on every plain push. Only git.push\n * intents with no ref are touched. */\nexport function fillPushBranch(mapped: Mapped[], branch: string | null | undefined): Mapped[] {\n if (!branch) return mapped;\n return mapped.map((m) =>\n m.intent.action_type === \"git.push\" && m.intent.params.ref === undefined\n ? { ...m, intent: { ...m.intent, params: { ...m.intent.params, ref: scrubParam(branch) } } }\n : m);\n}\n\n/** Map a Claude Code PreToolUse payload to the normalized actions it represents. */\nexport function mapClaudeToolUse(input: Record<string, unknown>): Mapped[] {\n const name = String(input?.tool_name ?? \"\");\n const ti = (input?.tool_input ?? {}) as Record<string, unknown>;\n const cwd = input?.cwd ? String(input.cwd) : undefined;\n // Every shell-executing tool decomposes the same way. Claude Code exposes Bash;\n // some hosts/agents expose PowerShell or a generic Shell tool — mapping only Bash\n // let a PowerShell command (e.g. `Remove-Item -Recurse -Force .`) fall through to\n // an un-evaluated tool.<name> and be allowed.\n if (name === \"Bash\" || name === \"Shell\")\n return mapShell(String(ti.command ?? \"\"), cwd);\n if (name === \"PowerShell\")\n return mapShell(String(ti.command ?? \"\"), cwd, \"powershell\");\n if (name === \"Write\" || name === \"Edit\" || name === \"MultiEdit\")\n return pathIntents(\"file.write\", rel(ti.file_path, cwd), name);\n if (name === \"NotebookEdit\")\n return pathIntents(\"file.write\", rel(ti.notebook_path ?? ti.file_path, cwd), name);\n if (name === \"Read\")\n return pathIntents(\"file.read\", rel(ti.file_path, cwd), name);\n if (name === \"WebFetch\") {\n const { host, path } = splitUrl(String(ti.url ?? \"\"));\n return one({ action_type: \"net.fetch\", params: { host, path, method: \"GET\" } }, true, name);\n }\n const mcp = parseMcpName(name);\n if (mcp) return one({ action_type: \"mcp.tool.call\", params: { server: mcp.server, tool: mcp.tool, args_digest: digest(ti) } }, true, name);\n return one({ action_type: `tool.${name.toLowerCase()}`, params: {} }, false, name);\n}\n\n/** Map an OpenAI Codex PreToolUse payload. Codex reports shell and unified-exec\n * calls as `Bash`, file patches as `apply_patch`, and MCP calls by their native\n * `mcp__server__tool` name. Other local tools remain visible but unevaluated. */\nexport function mapCodexToolUse(input: Record<string, unknown>): Mapped[] {\n const name = String(input?.tool_name ?? \"\");\n const ti = (input?.tool_input ?? {}) as Record<string, unknown>;\n const cwd = input?.cwd ? String(input.cwd) : undefined;\n if (name === \"PowerShell\")\n return mapShell(String(ti.command ?? ti.cmd ?? \"\"), cwd, \"powershell\");\n if (name === \"Bash\" || name === \"Shell\" || name === \"exec_command\" || name === \"unified_exec\")\n return mapShell(String(ti.command ?? ti.cmd ?? \"\"), cwd);\n if (name === \"apply_patch\" || name === \"Edit\" || name === \"Write\")\n return mapApplyPatch(String(ti.command ?? ti.patch ?? \"\"), cwd);\n const mcp = parseMcpName(name);\n if (mcp) return one({ action_type: \"mcp.tool.call\", params: { server: mcp.server, tool: mcp.tool, args_digest: digest(ti) } }, true, name);\n return one({ action_type: `tool.${name.toLowerCase()}`, params: {} }, false, name);\n}\n\n/** Map a Cursor hook event to the normalized actions it represents. */\nexport function mapCursorEvent(event: string, payload: Record<string, unknown>): Mapped[] {\n const p = payload ?? {};\n const cwd = p.cwd ? String(p.cwd) : undefined;\n switch (event) {\n case \"beforeShellExecution\":\n return mapShell(String(p.command ?? \"\"), cwd);\n case \"beforeReadFile\":\n return pathIntents(\"file.read\", rel(p.path ?? p.file_path, cwd), event);\n case \"afterFileEdit\":\n return pathIntents(\"file.write\", rel(p.path ?? p.file_path, cwd), event);\n case \"beforeMCPExecution\": {\n const server = String(p.server ?? p.server_name ?? \"\");\n const tool = String(p.tool ?? p.tool_name ?? \"\");\n return one({ action_type: \"mcp.tool.call\", params: { server, tool, args_digest: digest(p.args ?? p.arguments ?? {}) } }, true, event);\n }\n default:\n return one({ action_type: `tool.${event.toLowerCase()}`, params: {} }, false, event);\n }\n}\n"]}
package/dist/minimize.d.ts CHANGED
@@ -4,9 +4,12 @@ export declare const digest: (value: unknown) => string;
4
4
  * assignments and recognizable token shapes only, so policy matching on ordinary
5
5
  * values is unaffected. */
6
6
  export declare function scrubParam(text: string): string;
7
- /** Scrub free text: everything `scrubParam` removes plus generic high-entropy blobs. */
7
+ /** Scrub free text: everything `scrubParam` removes, plus the free-text-only argv and
8
+ * header shapes and generic high-entropy blobs. */
8
9
  export declare function scrubSecrets(text: string): string;
9
- /** A privacy-preserving representation of a shell command: a scrubbed, truncated
10
- * head plus a digest of the full original. The full command is never retained. */
10
+ /** A privacy-preserving representation of a shell command: a scrubbed, truncated head
11
+ * plus a digest of the scrubbed command. The full original is never retained, and the
12
+ * digest is taken over the scrubbed text so a secret the head removed cannot be
13
+ * brute-forced back from the digest. */
11
14
  export declare function redactCommand(command: string, headLen?: number): string;
12
15
  //# sourceMappingURL=minimize.d.ts.map
package/dist/minimize.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"minimize.d.ts","sourceRoot":"","sources":["../src/minimize.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM,KAAG,MAAsE,CAAC;AAC9G,eAAO,MAAM,MAAM,GAAI,OAAO,OAAO,KAAG,MAA2C,CAAC;AAmDpF;;4BAE4B;AAC5B,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIjD;AAED;mFACmF;AACnF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,MAAM,CAInE"}
1
+ {"version":3,"file":"minimize.d.ts","sourceRoot":"","sources":["../src/minimize.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM,KAAG,MAAsE,CAAC;AAC9G,eAAO,MAAM,MAAM,GAAI,OAAO,OAAO,KAAG,MAA2C,CAAC;AAmEpF;;4BAE4B;AAC5B,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED;oDACoD;AACpD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKjD;AAED;;;yCAGyC;AACzC,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,MAAM,CAInE"}
package/dist/minimize.js CHANGED
@@ -30,6 +30,21 @@ const SECRET_RULES = [
30
30
  [/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, MASK], // AWS access key ids
31
31
  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, MASK], // JWTs
32
32
  ];
33
+ // Free-text-only rules (the command head), never applied to structured parameters a
34
+ // policy matches on. These cover common shapes that carry a secret on argv without a
35
+ // recognizable token format:
36
+ // - an attached `-p`/`-u` value (`mysql -phunter2`, `psql -uadmin`) — the single most
37
+ // common way a password reaches a shell. A space-separated `-p value` (the mkdir
38
+ // flag, or `-u origin`) is not attached and is left alone; the `--password`/`--user`
39
+ // forms are handled by the labelled rules above.
40
+ // - a header whose name looks like a credential (`X-Custom-Secret: …`, `My-Token: …`).
41
+ // Bare `key:` is deliberately excluded so ordinary `key: value` text is untouched.
42
+ const HEAD_RULES = [
43
+ [/(^|\s)(-[pu])[^\s=-]\S*/g, `$1$2${MASK}`],
44
+ // `auth` is omitted: `Authorization:` is handled above (with its Bearer/Basic label),
45
+ // and other auth headers (`X-Auth-Token`) still match on `token`.
46
+ [/(\b[\w-]*(?:secret|token|api[-_]?key|apikey|password|passwd|credential)[\w-]*\s*:\s*)[^\s"']+/gi, `$1${MASK}`],
47
+ ];
33
48
  // Generic high-entropy shapes. Applied to free text only (the command head), never to
34
49
  // structured parameters a policy matches on: a long path or a commit id is not a secret.
35
50
  const BLOB_RULES = [
@@ -60,18 +75,23 @@ export function scrubParam(text) {
60
75
  out = out.replace(re, replacement);
61
76
  return out;
62
77
  }
63
- /** Scrub free text: everything `scrubParam` removes plus generic high-entropy blobs. */
78
+ /** Scrub free text: everything `scrubParam` removes, plus the free-text-only argv and
79
+ * header shapes and generic high-entropy blobs. */
64
80
  export function scrubSecrets(text) {
65
81
  let out = scrubParam(text);
82
+ for (const [re, replacement] of HEAD_RULES)
83
+ out = out.replace(re, replacement);
66
84
  for (const [re, replacement] of BLOB_RULES)
67
85
  out = out.replace(re, replacement);
68
86
  return out;
69
87
  }
70
- /** A privacy-preserving representation of a shell command: a scrubbed, truncated
71
- * head plus a digest of the full original. The full command is never retained. */
88
+ /** A privacy-preserving representation of a shell command: a scrubbed, truncated head
89
+ * plus a digest of the scrubbed command. The full original is never retained, and the
90
+ * digest is taken over the scrubbed text so a secret the head removed cannot be
91
+ * brute-forced back from the digest. */
72
92
  export function redactCommand(command, headLen = 64) {
73
93
  const scrubbed = scrubSecrets(command);
74
94
  const head = scrubbed.length > headLen ? `${scrubbed.slice(0, headLen)}…` : scrubbed;
75
- return `${head} (${sha256(command)})`;
95
+ return `${head} (${sha256(scrubbed)})`;
76
96
  }
77
97
  //# sourceMappingURL=minimize.js.map
package/dist/minimize.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"minimize.js","sourceRoot":"","sources":["../src/minimize.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,6EAA6E;AAC7E,uDAAuD;AAEvD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAE/D,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9G,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAc,CAAC,CAAC,CAAC;AAEpF,MAAM,IAAI,GAAG,KAAK,CAAC;AACnB,sEAAsE;AACtE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAA,uBAAuB,CAAC;AAEhD,iFAAiF;AACjF,mFAAmF;AACnF,0EAA0E;AAC1E,gEAAgE;AAChE,MAAM,YAAY,GAA6C;IAC7D,CAAC,mFAAmF,EAAE,IAAI,CAAC;IAC3F,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,+FAA+F,KAAK,EAAE,EAAE,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IACjJ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,gCAAgC,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IACjF,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE,CAAC;IACvE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE,CAAC;IACnG,CAAC,6BAA6B,EAAE,KAAK,IAAI,GAAG,CAAC,EAAsB,eAAe;IAClF,CAAC,+BAA+B,EAAE,IAAI,CAAC,EAA4B,gBAAgB;IACnF,CAAC,iCAAiC,EAAE,IAAI,CAAC,EAA0B,6BAA6B;IAChG,CAAC,6BAA6B,EAAE,IAAI,CAAC,EAA8B,gBAAgB;IACnF,CAAC,yBAAyB,EAAE,IAAI,CAAC,EAAkC,aAAa;IAChF,CAAC,mCAAmC,EAAE,IAAI,CAAC,EAAwB,eAAe;IAClF,CAAC,yCAAyC,EAAE,IAAI,CAAC,EAAkB,cAAc;IACjF,CAAC,0BAA0B,EAAE,IAAI,CAAC,EAAiC,8BAA8B;IACjG,CAAC,2BAA2B,EAAE,IAAI,CAAC,EAAgC,kBAAkB;IACrF,CAAC,gCAAgC,EAAE,IAAI,CAAC,EAA2B,qBAAqB;IACxF,CAAC,+DAA+D,EAAE,IAAI,CAAC,EAAE,OAAO;CACjF,CAAC;AAEF,sFAAsF;AACtF,yFAAyF;AACzF,MAAM,UAAU,GAA6C;IAC3D,CAAC,uBAAuB,EAAE,IAAI,CAAC,EAAoC,iBAAiB;IACpF,CAAC,6BAA6B,EAAE,IAAI,CAAC,EAA8B,8BAA8B;CAClG,CAAC;AAEF,MAAM,WAAW,GAAG,mFAAmF,CAAC;AAExG,6EAA6E;AAC7E,iFAAiF;AACjF,4DAA4D;AAC5D,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,oCAAoC;QACtG,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;4BAE4B;AAC5B,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,YAAY;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACjF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,UAAU;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAC/E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAO,GAAG,EAAE;IACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrF,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;AACxC,CAAC","sourcesContent":["// Data minimization for the hook: file contents are never stored, shell commands\n// are reduced to a scrubbed head plus a digest, and common secret shapes are\n// removed before anything is written or signed (SB09).\n\nimport { createHash } from \"node:crypto\";\nimport { canonical } from \"@scopebond/policy-schema/canonical\";\n\nexport const sha256 = (value: string): string => \"sha256:\" + createHash(\"sha256\").update(value).digest(\"hex\");\nexport const digest = (value: unknown): string => sha256(canonical(value as never));\n\nconst MASK = \"***\";\n// A flag or header value: a quoted string or a run of non-whitespace.\nconst VALUE = String.raw`(\"[^\"]*\"|'[^']*'|\\S+)`;\n\n// Each rule states its own replacement. `$1` keeps a non-secret label (a flag or\n// header name); the secret itself is always dropped whole. Over-scrubbing is safe.\n// Every pattern is a single pass over simple character classes (no nested\n// quantifiers), so matching stays linear in the command length.\nconst SECRET_RULES: ReadonlyArray<readonly [RegExp, string]> = [\n [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, MASK],\n [new RegExp(String.raw`(--?(?:password|passwd|pwd|token|secret|api[-_]?key|access[-_]?key|auth|credentials?)[=\\s]+)${VALUE}`, \"gi\"), `$1${MASK}`],\n [new RegExp(String.raw`((?:^|\\s)(?:-u|--user)[=\\s]+)${VALUE}`, \"g\"), `$1${MASK}`],\n [/(Authorization:\\s*(?:Bearer|Basic|Token)\\s+)[^\\s\"']+/gi, `$1${MASK}`],\n [/((?:x-api-key|api-key|x-auth-token|x-access-token|private-token)\\s*:\\s*)[^\\s\"']+/gi, `$1${MASK}`],\n [/(:\\/\\/)[^\\s/@:]+:[^\\s/@]+@/g, `$1${MASK}@`], // URL userinfo\n [/\\bgh[pousr]_[A-Za-z0-9]{20,}/g, MASK], // GitHub tokens\n [/\\bgithub_pat_[A-Za-z0-9_]{20,}/g, MASK], // GitHub fine-grained tokens\n [/\\bglpat-[A-Za-z0-9_-]{20,}/g, MASK], // GitLab tokens\n [/\\bnpm_[A-Za-z0-9]{20,}/g, MASK], // npm tokens\n [/\\bxox[abeoprs]-[A-Za-z0-9-]{10,}/g, MASK], // Slack tokens\n [/\\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/g, MASK], // Stripe keys\n [/\\bsk-[A-Za-z0-9_-]{20,}/g, MASK], // OpenAI/Anthropic-style keys\n [/\\bAIza[0-9A-Za-z_-]{30,}/g, MASK], // Google API keys\n [/\\b(?:AKIA|ASIA)[0-9A-Z]{16}\\b/g, MASK], // AWS access key ids\n [/\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}/g, MASK], // JWTs\n];\n\n// Generic high-entropy shapes. Applied to free text only (the command head), never to\n// structured parameters a policy matches on: a long path or a commit id is not a secret.\nconst BLOB_RULES: ReadonlyArray<readonly [RegExp, string]> = [\n [/\\b[A-Fa-f0-9]{32,}\\b/g, MASK], // long hex blobs\n [/[A-Za-z0-9+/_-]{40,}={0,2}/g, MASK], // long base64/base64url blobs\n];\n\nconst SECRET_NAME = /token|secret|passw|pwd|api_?key|access_?key|private_?key|auth|credential|session/i;\n\n// `NAME=value` where the name looks like a credential (`GH_TOKEN=…`, `export\n// AWS_SECRET_ACCESS_KEY=…`). Done per whitespace-delimited word rather than with\n// one regex so a long identifier cannot cause backtracking.\nfunction scrubAssignments(text: string): string {\n return text.replace(/\\S+/g, (word) => {\n const eq = word.indexOf(\"=\");\n if (eq <= 0 || eq === word.length - 1) return word;\n const name = word.slice(0, eq);\n if (name.startsWith(\"-\") || !SECRET_NAME.test(name)) return word; // flags are handled by SECRET_RULES\n return `${name}=${MASK}`;\n });\n}\n\n/** Scrub a structured parameter (a program name, a remote, a URL path): credential\n * assignments and recognizable token shapes only, so policy matching on ordinary\n * values is unaffected. */\nexport function scrubParam(text: string): string {\n let out = scrubAssignments(text);\n for (const [re, replacement] of SECRET_RULES) out = out.replace(re, replacement);\n return out;\n}\n\n/** Scrub free text: everything `scrubParam` removes plus generic high-entropy blobs. */\nexport function scrubSecrets(text: string): string {\n let out = scrubParam(text);\n for (const [re, replacement] of BLOB_RULES) out = out.replace(re, replacement);\n return out;\n}\n\n/** A privacy-preserving representation of a shell command: a scrubbed, truncated\n * head plus a digest of the full original. The full command is never retained. */\nexport function redactCommand(command: string, headLen = 64): string {\n const scrubbed = scrubSecrets(command);\n const head = scrubbed.length > headLen ? `${scrubbed.slice(0, headLen)}…` : scrubbed;\n return `${head} (${sha256(command)})`;\n}\n"]}
1
+ {"version":3,"file":"minimize.js","sourceRoot":"","sources":["../src/minimize.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,6EAA6E;AAC7E,uDAAuD;AAEvD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAE/D,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9G,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAc,CAAC,CAAC,CAAC;AAEpF,MAAM,IAAI,GAAG,KAAK,CAAC;AACnB,sEAAsE;AACtE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAA,uBAAuB,CAAC;AAEhD,iFAAiF;AACjF,mFAAmF;AACnF,0EAA0E;AAC1E,gEAAgE;AAChE,MAAM,YAAY,GAA6C;IAC7D,CAAC,mFAAmF,EAAE,IAAI,CAAC;IAC3F,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,+FAA+F,KAAK,EAAE,EAAE,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IACjJ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,gCAAgC,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IACjF,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE,CAAC;IACvE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE,CAAC;IACnG,CAAC,6BAA6B,EAAE,KAAK,IAAI,GAAG,CAAC,EAAsB,eAAe;IAClF,CAAC,+BAA+B,EAAE,IAAI,CAAC,EAA4B,gBAAgB;IACnF,CAAC,iCAAiC,EAAE,IAAI,CAAC,EAA0B,6BAA6B;IAChG,CAAC,6BAA6B,EAAE,IAAI,CAAC,EAA8B,gBAAgB;IACnF,CAAC,yBAAyB,EAAE,IAAI,CAAC,EAAkC,aAAa;IAChF,CAAC,mCAAmC,EAAE,IAAI,CAAC,EAAwB,eAAe;IAClF,CAAC,yCAAyC,EAAE,IAAI,CAAC,EAAkB,cAAc;IACjF,CAAC,0BAA0B,EAAE,IAAI,CAAC,EAAiC,8BAA8B;IACjG,CAAC,2BAA2B,EAAE,IAAI,CAAC,EAAgC,kBAAkB;IACrF,CAAC,gCAAgC,EAAE,IAAI,CAAC,EAA2B,qBAAqB;IACxF,CAAC,+DAA+D,EAAE,IAAI,CAAC,EAAE,OAAO;CACjF,CAAC;AAEF,oFAAoF;AACpF,qFAAqF;AACrF,6BAA6B;AAC7B,uFAAuF;AACvF,oFAAoF;AACpF,wFAAwF;AACxF,oDAAoD;AACpD,wFAAwF;AACxF,sFAAsF;AACtF,MAAM,UAAU,GAA6C;IAC3D,CAAC,0BAA0B,EAAE,OAAO,IAAI,EAAE,CAAC;IAC3C,sFAAsF;IACtF,kEAAkE;IAClE,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE,CAAC;CACjH,CAAC;AAEF,sFAAsF;AACtF,yFAAyF;AACzF,MAAM,UAAU,GAA6C;IAC3D,CAAC,uBAAuB,EAAE,IAAI,CAAC,EAAoC,iBAAiB;IACpF,CAAC,6BAA6B,EAAE,IAAI,CAAC,EAA8B,8BAA8B;CAClG,CAAC;AAEF,MAAM,WAAW,GAAG,mFAAmF,CAAC;AAExG,6EAA6E;AAC7E,iFAAiF;AACjF,4DAA4D;AAC5D,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,oCAAoC;QACtG,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;4BAE4B;AAC5B,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,YAAY;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACjF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;oDACoD;AACpD,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,UAAU;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,UAAU;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAC/E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;yCAGyC;AACzC,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAO,GAAG,EAAE;IACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrF,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;AACzC,CAAC","sourcesContent":["// Data minimization for the hook: file contents are never stored, shell commands\n// are reduced to a scrubbed head plus a digest, and common secret shapes are\n// removed before anything is written or signed (SB09).\n\nimport { createHash } from \"node:crypto\";\nimport { canonical } from \"@scopebond/policy-schema/canonical\";\n\nexport const sha256 = (value: string): string => \"sha256:\" + createHash(\"sha256\").update(value).digest(\"hex\");\nexport const digest = (value: unknown): string => sha256(canonical(value as never));\n\nconst MASK = \"***\";\n// A flag or header value: a quoted string or a run of non-whitespace.\nconst VALUE = String.raw`(\"[^\"]*\"|'[^']*'|\\S+)`;\n\n// Each rule states its own replacement. `$1` keeps a non-secret label (a flag or\n// header name); the secret itself is always dropped whole. Over-scrubbing is safe.\n// Every pattern is a single pass over simple character classes (no nested\n// quantifiers), so matching stays linear in the command length.\nconst SECRET_RULES: ReadonlyArray<readonly [RegExp, string]> = [\n [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, MASK],\n [new RegExp(String.raw`(--?(?:password|passwd|pwd|token|secret|api[-_]?key|access[-_]?key|auth|credentials?)[=\\s]+)${VALUE}`, \"gi\"), `$1${MASK}`],\n [new RegExp(String.raw`((?:^|\\s)(?:-u|--user)[=\\s]+)${VALUE}`, \"g\"), `$1${MASK}`],\n [/(Authorization:\\s*(?:Bearer|Basic|Token)\\s+)[^\\s\"']+/gi, `$1${MASK}`],\n [/((?:x-api-key|api-key|x-auth-token|x-access-token|private-token)\\s*:\\s*)[^\\s\"']+/gi, `$1${MASK}`],\n [/(:\\/\\/)[^\\s/@:]+:[^\\s/@]+@/g, `$1${MASK}@`], // URL userinfo\n [/\\bgh[pousr]_[A-Za-z0-9]{20,}/g, MASK], // GitHub tokens\n [/\\bgithub_pat_[A-Za-z0-9_]{20,}/g, MASK], // GitHub fine-grained tokens\n [/\\bglpat-[A-Za-z0-9_-]{20,}/g, MASK], // GitLab tokens\n [/\\bnpm_[A-Za-z0-9]{20,}/g, MASK], // npm tokens\n [/\\bxox[abeoprs]-[A-Za-z0-9-]{10,}/g, MASK], // Slack tokens\n [/\\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/g, MASK], // Stripe keys\n [/\\bsk-[A-Za-z0-9_-]{20,}/g, MASK], // OpenAI/Anthropic-style keys\n [/\\bAIza[0-9A-Za-z_-]{30,}/g, MASK], // Google API keys\n [/\\b(?:AKIA|ASIA)[0-9A-Z]{16}\\b/g, MASK], // AWS access key ids\n [/\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}/g, MASK], // JWTs\n];\n\n// Free-text-only rules (the command head), never applied to structured parameters a\n// policy matches on. These cover common shapes that carry a secret on argv without a\n// recognizable token format:\n// - an attached `-p`/`-u` value (`mysql -phunter2`, `psql -uadmin`) — the single most\n// common way a password reaches a shell. A space-separated `-p value` (the mkdir\n// flag, or `-u origin`) is not attached and is left alone; the `--password`/`--user`\n// forms are handled by the labelled rules above.\n// - a header whose name looks like a credential (`X-Custom-Secret: …`, `My-Token: …`).\n// Bare `key:` is deliberately excluded so ordinary `key: value` text is untouched.\nconst HEAD_RULES: ReadonlyArray<readonly [RegExp, string]> = [\n [/(^|\\s)(-[pu])[^\\s=-]\\S*/g, `$1$2${MASK}`],\n // `auth` is omitted: `Authorization:` is handled above (with its Bearer/Basic label),\n // and other auth headers (`X-Auth-Token`) still match on `token`.\n [/(\\b[\\w-]*(?:secret|token|api[-_]?key|apikey|password|passwd|credential)[\\w-]*\\s*:\\s*)[^\\s\"']+/gi, `$1${MASK}`],\n];\n\n// Generic high-entropy shapes. Applied to free text only (the command head), never to\n// structured parameters a policy matches on: a long path or a commit id is not a secret.\nconst BLOB_RULES: ReadonlyArray<readonly [RegExp, string]> = [\n [/\\b[A-Fa-f0-9]{32,}\\b/g, MASK], // long hex blobs\n [/[A-Za-z0-9+/_-]{40,}={0,2}/g, MASK], // long base64/base64url blobs\n];\n\nconst SECRET_NAME = /token|secret|passw|pwd|api_?key|access_?key|private_?key|auth|credential|session/i;\n\n// `NAME=value` where the name looks like a credential (`GH_TOKEN=…`, `export\n// AWS_SECRET_ACCESS_KEY=…`). Done per whitespace-delimited word rather than with\n// one regex so a long identifier cannot cause backtracking.\nfunction scrubAssignments(text: string): string {\n return text.replace(/\\S+/g, (word) => {\n const eq = word.indexOf(\"=\");\n if (eq <= 0 || eq === word.length - 1) return word;\n const name = word.slice(0, eq);\n if (name.startsWith(\"-\") || !SECRET_NAME.test(name)) return word; // flags are handled by SECRET_RULES\n return `${name}=${MASK}`;\n });\n}\n\n/** Scrub a structured parameter (a program name, a remote, a URL path): credential\n * assignments and recognizable token shapes only, so policy matching on ordinary\n * values is unaffected. */\nexport function scrubParam(text: string): string {\n let out = scrubAssignments(text);\n for (const [re, replacement] of SECRET_RULES) out = out.replace(re, replacement);\n return out;\n}\n\n/** Scrub free text: everything `scrubParam` removes, plus the free-text-only argv and\n * header shapes and generic high-entropy blobs. */\nexport function scrubSecrets(text: string): string {\n let out = scrubParam(text);\n for (const [re, replacement] of HEAD_RULES) out = out.replace(re, replacement);\n for (const [re, replacement] of BLOB_RULES) out = out.replace(re, replacement);\n return out;\n}\n\n/** A privacy-preserving representation of a shell command: a scrubbed, truncated head\n * plus a digest of the scrubbed command. The full original is never retained, and the\n * digest is taken over the scrubbed text so a secret the head removed cannot be\n * brute-forced back from the digest. */\nexport function redactCommand(command: string, headLen = 64): string {\n const scrubbed = scrubSecrets(command);\n const head = scrubbed.length > headLen ? `${scrubbed.slice(0, headLen)}…` : scrubbed;\n return `${head} (${sha256(scrubbed)})`;\n}\n"]}
package/dist/runtime.d.ts CHANGED
@@ -26,6 +26,10 @@ export interface Decision {
26
26
  /** Every receipt produced — one per simple command in a decomposed shell call. */
27
27
  receipts?: unknown[];
28
28
  }
29
+ /** Upgrade the starter-policy patterns an older hook wrote, in memory, so a user who
30
+ * installed an earlier version gets the current protections without re-running init.
31
+ * Only exact legacy strings are replaced; any other pattern is the operator's own. */
32
+ export declare function upgradeStarterPolicy<T>(policy: T): T;
29
33
  /** The default starter policy for a coding agent: protect release branches, deny
30
34
  * destructive programs, allow workspace file access except the hook's own config
31
35
  * and keys, and trust only the enrolled machine key. Every threshold is the
package/dist/runtime.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAMA,OAAO,EAA6C,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/E,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf;;uFAEmF;IACnF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;sEACkE;IAClE,KAAK,CAAC,EAAE;QAAE,UAAU,EAAE,cAAc,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvF;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,eAAe,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;CACtB;AAUD;;;0BAG0B;AAC1B,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgCvE;AAED;4EAC4E;AAC5E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa;;;;IAuBnD;qFACiF;aAClE,OAAO,CAAC,IAAI,CAAC;IAG5B,gEAAgE;wBACtC,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAapD;8EAC0E;qBACnD,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;EAkB/D"}
1
+ {"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAMA,OAAO,EAA6C,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/E,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf;;uFAEmF;IACnF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;sEACkE;IAClE,KAAK,CAAC,EAAE;QAAE,UAAU,EAAE,cAAc,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvF;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,eAAe,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;CACtB;AAoED;;uFAEuF;AACvF,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAQpD;AAED;;;0BAG0B;AAC1B,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgCvE;AAED;4EAC4E;AAC5E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa;;;;IAuBnD;qFACiF;aAClE,OAAO,CAAC,IAAI,CAAC;IAG5B,gEAAgE;wBACtC,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAapD;8EAC0E;qBACnD,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;EAkB/D"}
package/dist/runtime.js CHANGED
@@ -12,8 +12,74 @@ import { attachExporter, flushBounded } from "./cloud.js";
12
12
  // receipts stop meaning anything. These patterns are "allow if the path does NOT
13
13
  // match a protected location"; they run against the cwd-relative path the mapper
14
14
  // produces (and equally against an absolute one).
15
- const PROTECTED_WRITE = "^(?!(?:.*/)?\\.scopebond/)(?!(?:.*/)?\\.claude/settings)(?!(?:.*/)?\\.cursor/hooks)(?!(?:.*/)?\\.codex/(?:hooks\\.json|config\\.toml)$)(?!(?:.*/)?\\.git/hooks/)(?!(?:.*/)?\\.github/workflows/)(?!(?:.*/)?\\.github/actions/)(?!(?:.*/)?\\.gitlab-ci\\.yml$)(?!(?:.*/)?\\.circleci/)(?!(?:.*/)?azure-pipelines\\.yml$)(?!(?:.*/)?Jenkinsfile$).+";
16
- const PROTECTED_READ = "^(?!(?:.*/)?\\.scopebond/)(?!.*\\.key$)(?!(?:.*/)?\\.env(?:\\.(?!example$|sample$|template$)[^/]*)?$).+";
15
+ //
16
+ // Matching is case-insensitive — Windows and macOS open `.ENV` and `.env` as the
17
+ // same file — by expanding each letter to a two-case class (policy patterns are
18
+ // plain regular expressions with no flags). `ci()` is applied to literal text only.
19
+ const ci = (s) => s.replace(/[A-Za-z]/g, (c) => `[${c.toLowerCase()}${c.toUpperCase()}]`);
20
+ const under = (dir) => `(?!(?:.*/)?${ci(dir)}(?:/|$))`; // dir itself or anything inside it
21
+ const named = (file) => `(?!(?:.*/)?${ci(file)}$)`; // exactly this file name
22
+ const dir = (d) => `(?!(?:.*/)?${ci(d)}/?$)`; // the directory itself (a recursive read or copy)
23
+ const PROTECTED_WRITE = "^" + [
24
+ under("\\.scopebond"), `(?!(?:.*/)?${ci("\\.claude/settings")})`, under("\\.claude/hooks"), under("\\.claude/agents"),
25
+ `(?!(?:.*/)?${ci("\\.cursor/hooks")})`, named("\\.codex/hooks\\.json"), named("\\.codex/config\\.toml"), named("\\.mcp\\.json"),
26
+ under("\\.git/hooks"), named("\\.git/config"), under("\\.husky"),
27
+ under("\\.github/workflows"), under("\\.github/actions"), named("\\.gitlab-ci\\.yml"), named("\\.gitlab-ci\\.yaml"), under("\\.circleci"),
28
+ named("azure-pipelines\\.yml"), named("Jenkinsfile"),
29
+ ].join("") + ".+";
30
+ const PROTECTED_READ = "^" + [
31
+ under("\\.scopebond"),
32
+ `(?!.*${ci("\\.(?:key|pem|p12|pfx|jks|keystore)")}$)`,
33
+ // .env, .env.* — except templates whose name ends in .example/.sample/.template/.dist
34
+ `(?!(?:.*/)?${ci("\\.env")}(?!(?:\\.[^/]*)?\\.(?:${ci("example")}|${ci("sample")}|${ci("template")}|${ci("dist")})$)(?:\\.[^/]*)?$)`,
35
+ named("\\.envrc"),
36
+ // Credentials outside the workspace that an agent can reach by absolute or ~ path,
37
+ // and their directories as a whole (`cp -r ~/.ssh`, `grep -r x ~/.aws`).
38
+ `(?!(?:.*/)?${ci("\\.ssh")}(?:$|/(?!.*${ci("\\.pub")}$)(?!${ci("known_hosts")}$)(?!${ci("config")}$)))`,
39
+ `(?!(?:.*/)?${ci("\\.aws")}(?:$|/(?!${ci("config")}$)))`,
40
+ named("\\.npmrc"), named("\\.pypirc"), named("\\.netrc"), named("_netrc"), named("\\.git-credentials"),
41
+ dir("\\.kube"), named("\\.kube/config"), dir("\\.docker"), named("\\.docker/config\\.json"),
42
+ under("\\.config/gcloud"), under("\\.azure"), under("\\.gnupg"),
43
+ dir("\\.config/gh"), named("\\.config/gh/hosts\\.yml"), named("\\.claude/\\.credentials\\.json"),
44
+ ].join("") + ".+";
45
+ // Destructive programs, POSIX and Windows. The mapper records the program as typed,
46
+ // so the pattern accepts any case and an executable suffix (`RM.exe`, `Remove-Item`).
47
+ const DESTRUCTIVE = [
48
+ "rm", "sudo", "doas", "shutdown", "reboot", "halt", "poweroff", "mkfs", "dd", "shred", "truncate", "unlink", "wipe", "srm",
49
+ "del", "rd", "rmdir", "erase", "deltree", "format", "diskpart", "remove-item", "ri", "clear-content", "clc", "stop-computer", "restart-computer",
50
+ ];
51
+ const SAFE_SHELL = `^(?!(?:${DESTRUCTIVE.map(ci).join("|")})(?:${ci("\\.(?:exe|cmd|bat|com|ps1)")})?$).+`;
52
+ // A push destination the starter policy refuses: main, master, release/*, the
53
+ // "every branch" flags (`--all`, `--mirror`, `--branches`) and a push whose
54
+ // destination the mapper could not read (`--unknown`: a git alias, a configured push
55
+ // refspec, `send-pack`), in any case. `--tags` alone pushes only tags and is allowed.
56
+ const SAFE_REF = `^(?!(?:${ci("main")}|${ci("master")})$)(?!${ci("release")}/)(?!-(?!-${ci("tags")}$)).+`;
57
+ // Patterns written by earlier starter policies (0.3–0.5), upgraded in memory when a
58
+ // policy on disk still carries them verbatim. An operator's own edits never match
59
+ // these strings and are left untouched.
60
+ const LEGACY_STARTER_PATTERNS = {
61
+ "^(?!(?:main|master)$)(?!release/).+": SAFE_REF,
62
+ "^(?!(?:rm|sudo|shutdown|reboot|mkfs|dd|del|rd|rmdir|erase|deltree|format|Remove-Item|ri)$).+": SAFE_SHELL,
63
+ "^(?!(?:rm|sudo|shutdown|reboot|mkfs|dd)$).+": SAFE_SHELL,
64
+ "^(?!(?:.*/)?\\.scopebond/)(?!(?:.*/)?\\.claude/settings)(?!(?:.*/)?\\.cursor/hooks)(?!(?:.*/)?\\.codex/(?:hooks\\.json|config\\.toml)$)(?!(?:.*/)?\\.git/hooks/)(?!(?:.*/)?\\.github/workflows/)(?!(?:.*/)?\\.github/actions/)(?!(?:.*/)?\\.gitlab-ci\\.yml$)(?!(?:.*/)?\\.circleci/)(?!(?:.*/)?azure-pipelines\\.yml$)(?!(?:.*/)?Jenkinsfile$).+": PROTECTED_WRITE,
65
+ "^(?!(?:.*/)?\\.scopebond/)(?!(?:.*/)?\\.claude/settings)(?!(?:.*/)?\\.cursor/hooks)(?!(?:.*/)?\\.git/hooks/)(?!(?:.*/)?\\.github/workflows/)(?!(?:.*/)?\\.github/actions/)(?!(?:.*/)?\\.gitlab-ci\\.yml$)(?!(?:.*/)?\\.circleci/)(?!(?:.*/)?azure-pipelines\\.yml$)(?!(?:.*/)?Jenkinsfile$).+": PROTECTED_WRITE,
66
+ "^(?!(?:.*/)?\\.scopebond/)(?!(?:.*/)?\\.claude/settings)(?!(?:.*/)?\\.cursor/hooks)(?!(?:.*/)?\\.git/hooks/).+": PROTECTED_WRITE,
67
+ "^(?!(?:.*/)?\\.scopebond/)(?!.*\\.key$)(?!(?:.*/)?\\.env(?:\\.(?!example$|sample$|template$)[^/]*)?$).+": PROTECTED_READ,
68
+ "^(?!(?:.*/)?\\.scopebond/)(?!.*\\.key$).+": PROTECTED_READ,
69
+ };
70
+ /** Upgrade the starter-policy patterns an older hook wrote, in memory, so a user who
71
+ * installed an earlier version gets the current protections without re-running init.
72
+ * Only exact legacy strings are replaced; any other pattern is the operator's own. */
73
+ export function upgradeStarterPolicy(policy) {
74
+ const p = policy;
75
+ for (const clause of p?.clauses ?? []) {
76
+ for (const bound of Object.values(clause?.param_bounds ?? {})) {
77
+ if (bound && typeof bound.pattern === "string" && LEGACY_STARTER_PATTERNS[bound.pattern])
78
+ bound.pattern = LEGACY_STARTER_PATTERNS[bound.pattern];
79
+ }
80
+ }
81
+ return policy;
82
+ }
17
83
  /** The default starter policy for a coding agent: protect release branches, deny
18
84
  * destructive programs, allow workspace file access except the hook's own config
19
85
  * and keys, and trust only the enrolled machine key. Every threshold is the
@@ -24,23 +90,23 @@ export function starterPolicy(agentKid) {
24
90
  clauses: [
25
91
  {
26
92
  id: "protect-branches", type: "action_allowlist", mode: "enforce", action_types: ["git.push"],
27
- param_bounds: { ref: { pattern: "^(?!(?:main|master)$)(?!release/).+" } },
28
- description: "Deny pushes to main, master and release/*.",
93
+ param_bounds: { ref: { pattern: SAFE_REF } },
94
+ description: "Deny pushes to main, master and release/* (any case, any refspec spelling), pushes of every branch at once (--all, --mirror) and pushes whose destination cannot be read from the command (a git alias, a configured push refspec, send-pack). A tags-only push (--tags) is allowed.",
29
95
  },
30
96
  {
31
97
  id: "safe-shell", type: "action_allowlist", mode: "enforce", action_types: ["shell.exec"],
32
- param_bounds: { program: { pattern: "^(?!(?:rm|sudo|shutdown|reboot|mkfs|dd|del|rd|rmdir|erase|deltree|format|Remove-Item|ri)$).+" } },
33
- description: "Deny destructive programs — POSIX (rm, sudo, shutdown, reboot, mkfs, dd) and Windows/PowerShell (del, rd, rmdir, erase, deltree, format, Remove-Item). An empty program (an unparseable command) is denied.",
98
+ param_bounds: { program: { pattern: SAFE_SHELL } },
99
+ description: "Deny destructive programs — POSIX (rm, sudo, doas, shutdown, reboot, mkfs, dd, shred, truncate, unlink, wipe) and Windows/PowerShell (del, rd, rmdir, erase, deltree, format, diskpart, Remove-Item, Clear-Content) — in any case and with or without .exe. An empty program (a command that could not be parsed, or whose program is only known at run time: $VAR, $(…), eval of a variable) is denied. Argument-shaped deletion (find -delete, git clean) is not a program name and is not covered here.",
34
100
  },
35
101
  {
36
102
  id: "protect-write", type: "action_allowlist", mode: "enforce", action_types: ["file.write"],
37
103
  param_bounds: { path: { pattern: PROTECTED_WRITE } },
38
- description: "Allow workspace writes, but never to the hook's policy/keys, Claude Code, Cursor or Codex hook settings, git hooks, or CI config (.github/workflows, .github/actions, .gitlab-ci.yml, .circleci, azure-pipelines.yml, Jenkinsfile).",
104
+ description: "Allow workspace writes, but never to the hook's policy/keys, Claude Code settings, hooks and agents, Cursor or Codex hook settings, .mcp.json, git hooks and git config, Husky hooks, or CI config (.github/workflows, .github/actions, .gitlab-ci.yml/.yaml, .circleci, azure-pipelines.yml, Jenkinsfile). Case-insensitive.",
39
105
  },
40
106
  {
41
107
  id: "protect-read", type: "action_allowlist", mode: "enforce", action_types: ["file.read"],
42
108
  param_bounds: { path: { pattern: PROTECTED_READ } },
43
- description: "Allow workspace reads, but never the signing keys (*.key), environment secret files (.env, .env.*, except .env.example/.sample/.template) or the hook's own .scopebond directory.",
109
+ description: "Allow workspace reads, but never signing keys and key containers (*.key, *.pem, *.p12, *.pfx, *.jks), environment secret files (.env, .env.*, .envrc — except names ending in .example/.sample/.template/.dist), SSH private keys and the .ssh directory, cloud/registry/git credentials (.aws except .aws/config, .npmrc, .pypirc, .netrc, .git-credentials, .kube/config, .docker/config.json, gcloud, Azure, GnuPG, the GitHub CLI's hosts.yml, Claude Code's .credentials.json) or the hook's own .scopebond directory. Case-insensitive.",
44
110
  },
45
111
  {
46
112
  id: "observe-net-mcp", type: "action_allowlist", mode: "monitor",
@@ -54,7 +120,7 @@ export function starterPolicy(agentKid) {
54
120
  /** Build the runtime. Throws on any setup failure (unparseable policy, missing
55
121
  * key, unavailable store) — the CLI turns that into a fail-closed deny. */
56
122
  export function createHookRuntime(config) {
57
- const policy = JSON.parse(readFileSync(config.policyPath, "utf8"));
123
+ const policy = upgradeStarterPolicy(JSON.parse(readFileSync(config.policyPath, "utf8")));
58
124
  const agent = createSigner({ privateKeyPem: readFileSync(config.keyPath, "utf8") });
59
125
  const keys = new StaticPrincipalKeyRegistry([
60
126
  { kid: agent.kid, publicKeyPem: agent.publicKeyPem, purposes: ["agent"], status: "active" },