@taliesinb/mash 0.0.0-stage → 0.1.1

package/dist/bin/mash.js

@@ -0,0 +1,281 @@
+#!/usr/bin/env node
+/**
+ * mash CLI.
+ *
+ *   mash run     [options] (-c SCRIPT | FILE) [ARGS...]   pre-flight, then run under the policy
+ *   mash analyze [options] (-c SCRIPT | FILE)              static analysis report
+ *   mash parse   (-c SCRIPT | FILE)                        AST as JSON
+ *   mash fmt     [fmt options] (-c SCRIPT | FILE)          pretty-print as equivalent bash
+ *
+ * Options:
+ *   --mode MODE        read-only | workspace-write (default) | danger-full-access
+ *   --root DIR         workspace root (default: cwd)
+ *   --allow DIR        extra writable root (repeatable)
+ *   --no-temp          temp dirs are not writable
+ *   --no-network       deny network access
+ *   --allow-host HOST  allow network access only to HOST (repeatable; *.example.com for subdomains)
+ *   --deny-credentials deny reading credential stores (~/.ssh, ~/.aws, ~/.config/gh, keychains, ...)
+ *   --deny CMD         deny a command by name (repeatable)
+ *   --deny-unknown     deny commands whose effects cannot be shown safe
+ *   --abort-on-deny    abort the run at the first denial
+ *   --no-preflight     skip the static pre-flight check
+ *   --dry-run          do not execute external commands; show predicted effects
+ *   --trace            human-readable trace on stderr
+ *   --trace-json FILE  JSONL trace events to FILE
+ *   --data             include stream data in traces
+ *   --json             machine-readable analyze output
+ *
+ * fmt options (docs/pretty-printer.md):
+ *   -w, --width N              line width (80)
+ *   --indent N                 indentation step (2)
+ *   --operators trailing|leading
+ *   --assignments auto|always|inline
+ *   --compounds auto|expanded
+ *   --statements continuation|newline|preserve
+ *   --format-substitutions     reformat multi-line $(…) bodies
+ *   --check                    exit 1 if the input is not already formatted
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { Machine, describe, describeEffect, format } from "../src/index.js";
+function usage(code = 2) {
+    const text = fs.readFileSync(new URL(import.meta.url), 'utf8').split('*/')[0].replace(/^#!.*\n\/\*\*?/, '').replace(/^ \* ?/gm, '');
+    process.stderr.write(text.trim() + '\n');
+    process.exit(code);
+}
+function parseCli(argv) {
+    const o = {
+        cmd: argv[0] ?? '', args: [], mode: 'workspace-write', root: process.cwd(), allow: [], temp: true, network: true, hosts: [], credentials: false, deny: [],
+        denyUnknown: false, abortOnDeny: false, preflight: true, dryRun: false, trace: false, data: false, json: false,
+        fmt: {}, check: false,
+    };
+    if (!['run', 'analyze', 'parse', 'fmt'].includes(o.cmd))
+        usage();
+    let i = 1;
+    for (; i < argv.length; i++) {
+        const a = argv[i];
+        const val = () => {
+            const v = argv[++i];
+            if (v === undefined)
+                usage();
+            return v;
+        };
+        switch (a) {
+            case '-c':
+                o.script = val();
+                i++;
+                o.args = argv.slice(i);
+                return o;
+            case '--mode':
+                o.mode = val();
+                break;
+            case '--root':
+                o.root = path.resolve(val());
+                break;
+            case '--allow':
+                o.allow.push(path.resolve(val()));
+                break;
+            case '--no-temp':
+                o.temp = false;
+                break;
+            case '--no-network':
+                o.network = false;
+                break;
+            case '--allow-host':
+                o.hosts.push(val());
+                break;
+            case '--deny-credentials':
+                o.credentials = true;
+                break;
+            case '--deny':
+                o.deny.push(val());
+                break;
+            case '--deny-unknown':
+                o.denyUnknown = true;
+                break;
+            case '--abort-on-deny':
+                o.abortOnDeny = true;
+                break;
+            case '--no-preflight':
+                o.preflight = false;
+                break;
+            case '--dry-run':
+                o.dryRun = true;
+                break;
+            case '--trace':
+                o.trace = true;
+                break;
+            case '--trace-json':
+                o.traceJson = val();
+                break;
+            case '--data':
+                o.data = true;
+                break;
+            case '--json':
+                o.json = true;
+                break;
+            case '-w':
+            case '--width':
+                o.fmt.width = Number(val());
+                break;
+            case '--indent':
+                o.fmt.indent = Number(val());
+                break;
+            case '--operators':
+                o.fmt.operators = val();
+                break;
+            case '--assignments':
+                o.fmt.assignments = val();
+                break;
+            case '--compounds':
+                o.fmt.compounds = val();
+                break;
+            case '--statements':
+                o.fmt.statements = val();
+                break;
+            case '--format-substitutions':
+                o.fmt.formatSubstitutions = true;
+                break;
+            case '--check':
+                o.check = true;
+                break;
+            case '-h':
+            case '--help': usage(0);
+            default:
+                if (a.startsWith('-'))
+                    usage();
+                o.file = a;
+                o.args = argv.slice(i + 1);
+                return o;
+        }
+    }
+    return o;
+}
+const o = parseCli(process.argv.slice(2));
+const source = o.script ?? (o.file ? fs.readFileSync(o.file, 'utf8') : fs.readFileSync(0, 'utf8'));
+const policy = {
+    mode: o.mode,
+    workspaceRoot: o.root,
+    additionalWritableRoots: o.allow,
+    writableTemp: o.temp,
+    network: !o.network ? 'deny' : o.hosts.length > 0 ? { allow: o.hosts } : 'allow',
+    readDenyCredentials: o.credentials,
+    deniedCommands: o.deny,
+};
+const isTty = process.stderr.isTTY;
+const c = (code, s) => (isTty ? `\x1b[${code}m${s}\x1b[0m` : s);
+const machine = new Machine({
+    cwd: process.cwd(),
+    policy,
+    denyUnknown: o.denyUnknown,
+    abortOnDeny: o.abortOnDeny,
+    dryRun: o.dryRun,
+    traceData: o.data,
+    arg0: o.file ?? 'mash',
+    stdin: process.stdin.isTTY ? undefined : process.stdin,
+    stdout: (chunk) => new Promise((r) => (process.stdout.write(chunk) ? r() : process.stdout.once('drain', r))),
+    stderr: (chunk) => void process.stderr.write(chunk),
+    hooks: o.dryRun
+        ? { beforeCommand: (ctx) => void process.stderr.write(c('36', `[dry-run] ${ctx.argv.join(' ')}`) + (ctx.effects.length ? c('2', `  → ${ctx.effects.map(describeEffect).join(', ')}`) : '') + '\n') }
+        : undefined,
+});
+if (o.cmd === 'fmt') {
+    const { text } = format(source, o.fmt);
+    if (o.check) {
+        const same = text === source.replace(/\n$/, '');
+        if (!same)
+            process.stderr.write('mash fmt: not formatted\n');
+        process.exit(same ? 0 : 1);
+    }
+    process.stdout.write(text + '\n');
+    process.exit(0);
+}
+if (o.cmd === 'parse') {
+    const ast = machine.parse(source);
+    process.stdout.write(JSON.stringify(ast, null, 2) + '\n');
+    process.exit(0);
+}
+const script = machine.parse(source, o.file ?? '-c');
+const report = machine.analyze(script);
+function printReport() {
+    if (o.json) {
+        process.stdout.write(JSON.stringify(report, (k, v) => (typeof v === 'bigint' ? String(v) : v), 2) + '\n');
+        return;
+    }
+    const out = (s) => void process.stdout.write(s + '\n');
+    out(c('1', `verdict: ${report.verdict}`));
+    for (const r of report.reasons)
+        out(c('31', `  ✗ ${r}`));
+    out(c('1', '\ncommands:'));
+    for (const cmd of report.commands) {
+        const flags = [cmd.reach, cmd.context.loop ? 'loop' : '', cmd.context.pipeline ? 'pipe' : '', cmd.context.cmdsubst ? '$()' : '', cmd.context.function ? `fn:${cmd.context.function}` : ''].filter(Boolean).join(',');
+        const mark = cmd.verdict === 'deny' ? c('31', '✗') : cmd.verdict === 'unknown' ? c('33', '?') : c('32', '✓');
+        out(`  ${mark} L${cmd.line} ${c('2', `[${flags}]`)} ${cmd.display}${cmd.complete ? '' : c('33', ' (effects incomplete)')}`);
+        for (const f of cmd.findings) {
+            if (f.verdict === 'allow' && f.effect.kind !== 'write' && f.effect.kind !== 'delete')
+                continue;
+            out(`      ${f.verdict === 'deny' ? c('31', 'deny') : f.verdict === 'unknown' ? c('33', 'unknown') : c('32', 'allow')} ${describeEffect(f.effect)}${f.verdict !== 'allow' ? c('2', ` — ${f.reason}`) : ''}`);
+        }
+    }
+    if (report.variables.length) {
+        out(c('1', '\nvariables:'));
+        for (const v of report.variables)
+            out(`  ${v.name}: ${c('36', v.type)} = ${v.value}`);
+    }
+}
+if (o.cmd === 'analyze') {
+    printReport();
+    process.exit(report.verdict === 'reject' ? 1 : 0);
+}
+// run
+if (o.preflight && report.verdict === 'reject') {
+    process.stderr.write(c('31', 'mash: refusing to run: the snippet would definitely violate the sandbox policy\n'));
+    for (const r of report.reasons)
+        process.stderr.write(c('31', `  ✗ ${r}\n`));
+    process.exit(126);
+}
+const traceFile = o.traceJson ? fs.openSync(o.traceJson, 'w') : undefined;
+const depthOf = new Map();
+machine.on((e) => {
+    if (traceFile !== undefined) {
+        fs.writeSync(traceFile, JSON.stringify(e, (k, v) => (v instanceof Uint8Array ? new TextDecoder().decode(v) : v)) + '\n');
+    }
+    if (!o.trace)
+        return;
+    const ind = (pid) => '  '.repeat(depthOf.get(pid) ?? 0);
+    const w = (s) => void process.stderr.write(s + '\n');
+    switch (e.type) {
+        case 'subshell:start':
+            depthOf.set(e.pid, (depthOf.get(e.parentPid) ?? 0) + 1);
+            w(c('2', `${ind(e.parentPid)}┌ ${e.reason} pid ${e.pid}`));
+            break;
+        case 'subshell:end':
+            w(c('2', `${ind(e.pid).slice(2)}└ pid ${e.pid} exit ${e.status}`));
+            break;
+        case 'command:start':
+            w(`${ind(e.pid)}${c('36', '$')} ${e.argv.join(' ')}${e.kind === 'external' ? '' : c('2', ` (${e.kind})`)}`);
+            break;
+        case 'command:end':
+            if (e.status !== 0)
+                w(c('33', `  ↳ exit ${e.status} (${e.durationMs}ms)`));
+            break;
+        case 'command:denied':
+            w(c('31', `⛔ ${e.argv.join(' ')}: ${e.reason}`));
+            break;
+        case 'loop:iteration':
+            w(c('35', `${ind(e.pid)}↻ iteration ${e.iteration}${e.variable ? ` ${e.variable}=${e.value}` : ''}`));
+            break;
+        case 'data':
+            if (e.channel.kind !== 'host')
+                w(c('2', `  ⇢ ${e.channel.label}: ${JSON.stringify(new TextDecoder().decode(e.bytes).slice(0, 80))}`));
+            break;
+        default:
+            break;
+    }
+});
+const result = await machine.run(script, { args: o.args });
+if (traceFile !== undefined)
+    fs.closeSync(traceFile);
+process.exitCode = result.status;
+void describe;
+//# sourceMappingURL=mash.js.map

package/dist/bin/mash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mash.js","sourceRoot":"","sources":["../../bin/mash.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAoD,MAAM,iBAAiB,CAAA;AA2B7H,SAAS,KAAK,CAAC,IAAI,GAAG,CAAC;IACrB,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IACnI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAA;IACxC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAc;IAC9B,MAAM,CAAC,GAAS;QACd,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACzJ,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK;QAC9G,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK;KACtB,CAAA;IACD,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,KAAK,EAAE,CAAA;IAChE,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,MAAM,GAAG,GAAG,GAAW,EAAE;YACvB,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;YACnB,IAAI,CAAC,KAAK,SAAS;gBAAE,KAAK,EAAE,CAAA;YAC5B,OAAO,CAAC,CAAA;QACV,CAAC,CAAA;QACD,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,IAAI;gBAAE,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAC,OAAO,CAAC,CAAA;YAClE,KAAK,QAAQ;gBAAE,CAAC,CAAC,IAAI,GAAG,GAAG,EAAoB,CAAC;gBAAC,MAAK;YACtD,KAAK,QAAQ;gBAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAAC,MAAK;YAClD,KAAK,SAAS;gBAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAAC,MAAK;YACxD,KAAK,WAAW;gBAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;gBAAC,MAAK;YACvC,KAAK,cAAc;gBAAE,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC;gBAAC,MAAK;YAC7C,KAAK,cAAc;gBAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAAC,MAAK;YAC/C,KAAK,oBAAoB;gBAAE,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;gBAAC,MAAK;YACtD,KAAK,QAAQ;gBAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAAC,MAAK;YACxC,KAAK,gBAAgB;gBAAE,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;gBAAC,MAAK;YAClD,KAAK,iBAAiB;gBAAE,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;gBAAC,MAAK;YACnD,KAAK,gBAAgB;gBAAE,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC;gBAAC,MAAK;YACjD,KAAK,WAAW;gBAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;gBAAC,MAAK;YACxC,KAAK,SAAS;gBAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC;gBAAC,MAAK;YACrC,KAAK,cAAc;gBAAE,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAAC,MAAK;YAC/C,KAAK,QAAQ;gBAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;gBAAC,MAAK;YACnC,KAAK,QAAQ;gBAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;gBAAC,MAAK;YACnC,KAAK,IAAI,CAAC;YAAC,KAAK,SAAS;gBAAE,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;gBAAC,MAAK;YAC7D,KAAK,UAAU;gBAAE,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;gBAAC,MAAK;YACpD,KAAK,aAAa;gBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,GAAG,EAAgC,CAAC;gBAAC,MAAK;YAChF,KAAK,eAAe;gBAAE,CAAC,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,EAAkC,CAAC;gBAAC,MAAK;YACtF,KAAK,aAAa;gBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,GAAG,EAAgC,CAAC;gBAAC,MAAK;YAChF,KAAK,cAAc;gBAAE,CAAC,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,EAAiC,CAAC;gBAAC,MAAK;YACnF,KAAK,wBAAwB;gBAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC;gBAAC,MAAK;YACtE,KAAK,SAAS;gBAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC;gBAAC,MAAK;YACrC,KAAK,IAAI,CAAC;YAAC,KAAK,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAClC;gBACE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,KAAK,EAAE,CAAA;gBAC9B,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;gBACV,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC1B,OAAO,CAAC,CAAA;QACZ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AACzC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;AAClG,MAAM,MAAM,GAAW;IACrB,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,aAAa,EAAE,CAAC,CAAC,IAAI;IACrB,uBAAuB,EAAE,CAAC,CAAC,KAAK;IAChC,YAAY,EAAE,CAAC,CAAC,IAAI;IACpB,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO;IAChF,mBAAmB,EAAE,CAAC,CAAC,WAAW;IAClC,cAAc,EAAE,CAAC,CAAC,IAAI;CACvB,CAAA;AAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAA;AAClC,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,CAAS,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAEvF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;IAC1B,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;IAClB,MAAM;IACN,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,SAAS,EAAE,CAAC,CAAC,IAAI;IACjB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,MAAM;IACtB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;IACtD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAClH,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM;QACb,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;QACpM,CAAC,CAAC,SAAS;CACd,CAAC,CAAA;AAEF,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAC/C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAA;AACpD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;AAEtC,SAAS,WAAW;IAClB,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;QACzG,OAAM;IACR,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAQ,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IACpE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACzC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;IACxD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAA;IAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACpN,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC5G,GAAG,CAAC,KAAK,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,uBAAuB,CAAC,EAAE,CAAC,CAAA;QAC3H,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,SAAQ;YAC9F,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC9M,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAA;QAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;IACvF,CAAC;AACH,CAAC;AAED,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;IACxB,WAAW,EAAE,CAAA;IACb,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED,MAAM;AACN,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;IAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,kFAAkF,CAAC,CAAC,CAAA;IACjH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3E,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACnB,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACzE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;AACzC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAa,EAAE,EAAE;IAC3B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IAC1H,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,KAAK;QAAE,OAAM;IACpB,MAAM,GAAG,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IACvE,MAAM,CAAC,GAAG,CAAC,CAAS,EAAQ,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IAClE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,gBAAgB;YACnB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACvD,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;YAC1D,MAAK;QACP,KAAK,cAAc;YACjB,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YAClE,MAAK;QACP,KAAK,eAAe;YAClB,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;YAC3G,MAAK;QACP,KAAK,aAAa;YAChB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAA;YAC1E,MAAK;QACP,KAAK,gBAAgB;YACnB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YAChD,MAAK;QACP,KAAK,gBAAgB;YACnB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;YACrG,MAAK;QACP,KAAK,MAAM;YACT,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM;gBAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YACrI,MAAK;QACP;YACE,MAAK;IACT,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AAC1D,IAAI,SAAS,KAAK,SAAS;IAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;AACpD,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAA;AAChC,KAAK,QAAQ,CAAA"}

package/dist/src/analysis/analyze.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Static analysis by abstract interpretation.
+ *
+ * Walks the AST with an abstract environment (variables → {@link AValue}s,
+ * abstract cwd, positional parameters), expands every simple command's words
+ * abstractly, applies the same behavior definitions the VM uses at runtime,
+ * and checks the predicted effects against the policy.
+ *
+ * Each command site gets a reachability: `must` when it runs on every
+ * execution that does not terminate earlier (not under a condition, loop body
+ * that may not run, `&&`/`||`, case arm, or uncalled function), else `may`.
+ * The report's verdict is `reject` when some `must` site has a definite
+ * policy violation — the snippet would certainly violate the policy if it
+ * gets that far — and `check-at-runtime` when violations are only possible.
+ */
+import type * as A from '../parser/ast.ts';
+import type { BehaviorRegistry } from '../behaviors/registry.ts';
+import type { Effect } from '../policy/effects.ts';
+import { type Via } from '../policy/effects.ts';
+import { type Policy, type PolicyFinding, type Verdict } from '../policy/policy.ts';
+import { type AValue, type HoleType } from './value.ts';
+export interface AnalyzeOptions {
+    cwd: AValue;
+    /** Concrete initial environment. */
+    env: Record<string, string>;
+    /** Abstract environment lookup (nested analysis of `bash -c`). Overrides `env`. */
+    envValues?: (name: string) => AValue | undefined;
+    policy: Policy;
+    behaviors: BehaviorRegistry;
+    positional?: AValue[];
+    /** Nested analysis (bash -c, eval): suppress uncalled-function reporting. */
+    nested?: boolean;
+    /** Reject definite violations reached on these paths (default: must and happy). */
+    rejectOn?: Reach[];
+}
+/**
+ * `must`: runs on every execution that does not terminate earlier.
+ * `happy`: runs if every preceding command succeeds (`a && b`, `cd x && cmd`).
+ * `may`: runs only under some condition (if/case arms, `||`, loop bodies that may not run).
+ */
+export type Reach = 'must' | 'happy' | 'may';
+export interface CommandSite {
+    nodeId: number;
+    span: A.Span;
+    line: number;
+    text: string;
+    /** Abstractly expanded argv. */
+    argv: AValue[];
+    /** Human-readable argv (unknowns shown as ⟨origin⟩). */
+    display: string;
+    kind: 'builtin' | 'function' | 'external' | 'not-found' | 'unknown' | 'assignment';
+    reach: Reach;
+    context: {
+        loop: boolean;
+        subshell: boolean;
+        cmdsubst: boolean;
+        pipeline: boolean;
+        background: boolean;
+        function?: string;
+    };
+    cwd: AValue;
+    effects: Effect[];
+    /** The behavior definition fully determined the effects. */
+    complete: boolean;
+    findings: PolicyFinding[];
+    verdict: Verdict;
+}
+export interface VariableInfo {
+    name: string;
+    value: string;
+    type: HoleType | 'literal' | 'mixed' | 'array';
+}
+export interface Violation {
+    nodeId: number;
+    line: number;
+    text: string;
+    reach: Reach;
+    verdict: 'deny' | 'unknown';
+    reason: string;
+    /** The effect, with its provenance (`… (via \`rm x\` (s.sh:3))`) for nested commands. */
+    effect: string;
+    /** For effects of nested code (`bash -c`, scripts, `eval`, `source`): the inner commands, outermost first. */
+    via?: Via[];
+}
+export interface AnalysisReport {
+    commands: CommandSite[];
+    variables: VariableInfo[];
+    functions: string[];
+    violations: Violation[];
+    /** `reject`: a definite violation on a must-reach path. */
+    verdict: 'allow' | 'check-at-runtime' | 'reject';
+    reasons: string[];
+}
+export declare function analyzeScript(script: A.Script, source: string, opts: AnalyzeOptions): AnalysisReport;
+/** Parse and analyze in one step. */
+export declare function analyzeSource(source: string, opts: AnalyzeOptions): AnalysisReport;
+//# sourceMappingURL=analyze.d.ts.map

package/dist/src/analysis/analyze.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze.d.ts","sourceRoot":"","sources":["../../../src/analysis/analyze.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,KAAK,CAAC,MAAM,kBAAkB,CAAA;AAE1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAGhE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAA2B,KAAK,GAAG,EAAE,MAAM,sBAAsB,CAAA;AACxE,OAAO,EAA4E,KAAK,MAAM,EAAE,KAAK,aAAa,EAAE,KAAK,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAO7J,OAAO,EACoH,KAAK,MAAM,EAAE,KAAK,QAAQ,EACpJ,MAAM,YAAY,CAAA;AAEnB,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,mFAAmF;IACnF,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IAChD,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,gBAAgB,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAA;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAA;AAE5C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,CAAC,CAAC,IAAI,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,gCAAgC;IAChC,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,YAAY,CAAA;IAClF,KAAK,EAAE,KAAK,CAAA;IACZ,OAAO,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3H,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,4DAA4D;IAC5D,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,aAAa,EAAE,CAAA;IACzB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAA;CAC/C;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,KAAK,CAAA;IACZ,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAA;IACd,8GAA8G;IAC9G,GAAG,CAAC,EAAE,GAAG,EAAE,CAAA;CACZ;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,WAAW,EAAE,CAAA;IACvB,SAAS,EAAE,YAAY,EAAE,CAAA;IACzB,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,2DAA2D;IAC3D,OAAO,EAAE,OAAO,GAAG,kBAAkB,GAAG,QAAQ,CAAA;IAChD,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAqFD,wBAAgB,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,cAAc,CAEpG;AAED,qCAAqC;AACrC,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,cAAc,CAElF"}