approval-md 0.3.0 → 0.4.1

package/dist/src/core/prompt-layout.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-layout.js","sourceRoot":"","sources":["../../../src/core/prompt-layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAKH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,YAAY;IACZ,MAAM;IACN,OAAO;IACP,mBAAmB;IACnB,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,UAAU;IACV,YAAY;IACZ,OAAO;IACP,cAAc;IACd,SAAS;IACT,kBAAkB;IAClB,cAAc;IACd,aAAa;IACb,SAAS;IACT,OAAO;IACP,gBAAgB;IAChB,cAAc;IACd,OAAO;IACP,SAAS;IACT,WAAW;IACX,YAAY;CACJ,CAAC;AAKX,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,WAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAyB;IACxD,YAAY;IACZ,OAAO;IACP,mBAAmB;IACnB,gBAAgB;IAChB,aAAa;IACb,aAAa;CACd,CAAC;AAuBF,uDAAuD;AACvD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAU,CAAC;AAKnE,SAAS,QAAQ,CAAC,KAA2B,EAAE,UAAqD;IAClG,MAAM,IAAI,GAAG,EAAsC,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,WAAW;QAAE,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;IACpE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiB,QAAQ,CAC1D;IACE,YAAY;IACZ,MAAM;IACN,OAAO;IACP,mBAAmB;IACnB,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,UAAU;IACV,SAAS;IACT,aAAa;IACb,YAAY;IACZ,OAAO;IACP,cAAc;IACd,SAAS;IACT,kBAAkB;IAClB,cAAc;IACd,OAAO;IACP,gBAAgB;IAChB,OAAO;IACP,SAAS;IACT,cAAc;IACd,WAAW;IACX,YAAY;CACb,EACD;IACE,KAAK,EAAE,QAAQ;IACf,iBAAiB,EAAE,QAAQ;IAC3B,cAAc,EAAE,QAAQ;IACxB,WAAW,EAAE,QAAQ;IACrB,WAAW,EAAE,QAAQ;IACrB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,UAAU;IACnB,WAAW,EAAE,UAAU;IACvB,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,QAAQ;IACtB,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,QAAQ;CACrB,CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAyB;IAC3C,YAAY;IACZ,MAAM;IACN,OAAO;IACP,mBAAmB;IACnB,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,UAAU;IACV,YAAY;IACZ,OAAO;IACP,cAAc;IACd,SAAS;IACT,kBAAkB;IAClB,cAAc;IACd,aAAa;IACb,SAAS;IACT,OAAO;IACP,cAAc;IACd,OAAO;IACP,SAAS;IACT,WAAW;IACX,YAAY;IACZ,gBAAgB;CACjB,CAAC;AAEF,MAAM,UAAU,GAA8C,MAAM,CAAC,WAAW,CAC9E,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,QAAyB,CAAC,CAAC,CAC3D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAiB,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;AAEpF,qFAAqF;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAAiB,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;AAEpF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAkD;IACnF,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,iBAAiB;IACtB,QAAQ,EAAE,sBAAsB;CACjC,CAAC;AA6BF;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,IAAsB,EAAE,OAAe;IACrE,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAwB,CAAC,IAAI,iBAAiB,CAAC;IACnF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAkB,EAAE,KAAkB;IACrE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK;QAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAExE,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAsC,CAAC;IAC9E,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;QAAE,IAAI,WAAW,CAAC,GAAG,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACvF,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;QAAE,IAAI,WAAW,CAAC,GAAG,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClF,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAI,KAAiC,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpG,MAAM,KAAK,GAAG,GAA8B,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAA2B,EAAE;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO;QACL,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,4CAA4C;IAC5C,oBAAoB;IACpB,oDAAoD;IACpD,qBAAqB;IACrB,6DAA6D;IAC7D,oBAAoB;IACpB,iDAAiD;IACjD,qBAAqB;IACrB,gDAAgD;IAChD,oBAAoB;CACZ,CAAC;AAEX,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAE9D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE/F,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QAClF,MAAM,GAAG,GAAI,KAAiC,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,MAAM,EAAE,GAAG,aAAa,OAAO,SAAS,CAAC;QAEzC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,EAAE;gBACR,OAAO,EAAE,oBAAoB;gBAC7B,OAAO,EAAE,yDAAyD;aACnE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,GAA8B,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAE,iBAAuC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5D,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE;oBACpB,OAAO,EAAE,oBAAoB;oBAC7B,OAAO,EAAE,yCAAyC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACjF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAgC,EAAE,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE;oBACpB,OAAO,EAAE,oBAAoB;oBAC7B,OAAO,EAAE,gCAAgC;iBAC1C,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;YAChC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE;wBACrC,OAAO,EAAE,oBAAoB;wBAC7B,OAAO,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBAC7F,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACf,IAAI,GAAG,KAAK,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzD,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE;wBACrC,OAAO,EAAE,qBAAqB;wBAC9B,OAAO,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,sFAAsF,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBAC3J,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAU,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,GAAG,EAAE,OAAO;oBAClB,OAAO,EAAE,qBAAqB;oBAC9B,OAAO,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,4DAA4D;iBAChG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"prompt-layout.js","sourceRoot":"","sources":["../../../src/core/prompt-layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAIxD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,YAAY;IACZ,MAAM;IACN,OAAO;IACP,mBAAmB;IACnB,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,UAAU;IACV,YAAY;IACZ,OAAO;IACP,cAAc;IACd,SAAS;IACT,kBAAkB;IAClB,cAAc;IACd,aAAa;IACb,SAAS;IACT,OAAO;IACP,gBAAgB;IAChB,cAAc;IACd,OAAO;IACP,SAAS;IACT,WAAW;IACX,YAAY;CACJ,CAAC;AAKX,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,WAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAyB;IACxD,YAAY;IACZ,OAAO;IACP,mBAAmB;IACnB,gBAAgB;IAChB,aAAa;IACb,aAAa;CACd,CAAC;AAuBF,uDAAuD;AACvD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAU,CAAC;AAKnE,SAAS,QAAQ,CAAC,KAA2B,EAAE,UAAqD;IAClG,MAAM,IAAI,GAAG,EAAsC,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,WAAW;QAAE,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;IACpE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiB,QAAQ,CAC1D;IACE,YAAY;IACZ,MAAM;IACN,OAAO;IACP,mBAAmB;IACnB,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,UAAU;IACV,SAAS;IACT,aAAa;IACb,YAAY;IACZ,OAAO;IACP,cAAc;IACd,SAAS;IACT,kBAAkB;IAClB,cAAc;IACd,OAAO;IACP,gBAAgB;IAChB,OAAO;IACP,SAAS;IACT,cAAc;IACd,WAAW;IACX,YAAY;CACb,EACD;IACE,KAAK,EAAE,QAAQ;IACf,iBAAiB,EAAE,QAAQ;IAC3B,cAAc,EAAE,QAAQ;IACxB,WAAW,EAAE,QAAQ;IACrB,WAAW,EAAE,QAAQ;IACrB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,UAAU;IACnB,WAAW,EAAE,UAAU;IACvB,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,QAAQ;IACtB,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,QAAQ;CACrB,CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAyB;IAC3C,YAAY;IACZ,MAAM;IACN,OAAO;IACP,mBAAmB;IACnB,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,UAAU;IACV,YAAY;IACZ,OAAO;IACP,cAAc;IACd,SAAS;IACT,kBAAkB;IAClB,cAAc;IACd,aAAa;IACb,SAAS;IACT,OAAO;IACP,cAAc;IACd,OAAO;IACP,SAAS;IACT,WAAW;IACX,YAAY;IACZ,gBAAgB;CACjB,CAAC;AAEF,MAAM,UAAU,GAA8C,MAAM,CAAC,WAAW,CAC9E,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,QAAyB,CAAC,CAAC,CAC3D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAiB,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;AAEpF,qFAAqF;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAAiB,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;AAEpF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAkD;IACnF,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,iBAAiB;IACtB,QAAQ,EAAE,sBAAsB;CACjC,CAAC;AAiCF,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,SAAS,CAAU,CAAC;AAK/D,+FAA+F;AAC/F,MAAM,CAAC,MAAM,oBAAoB,GAAgB,WAAW,CAAC;AAE7D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,CAAC,UAAU,CAAC,CAAC;AA+B5E,gDAAgD;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,MAAM,CAAU,CAAC;AAuC7D,mFAAmF;AACnF,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC,gDAAgD;AAChD,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAqC;IACrE,cAAc,EAAE,qCAAqC;IACrD,UAAU,EAAE,iBAAiB;IAC7B,cAAc,EAAE,mBAAmB;IACnC,aAAa,EAAE,2BAA2B;IAC1C,eAAe,EAAE,iCAAiC;IAClD,cAAc,EAAE,iCAAiC;IACjD,gBAAgB,EAAE,8BAA8B;IAChD,cAAc,EAAE,gBAAgB;IAChC,sBAAsB,EAAE,mCAAmC;CAC5D,CAAC;AAEF,iDAAiD;AACjD,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACxF,CAAC;AAED,sDAAsD;AACtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,IAAsB,EAAE,OAAe;IACpE,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,oBAAoB,CAAC;IAC1C,IAAI,CAAE,qBAA2C,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,oBAAoB,CAAC;IACjG,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,oBAAoB,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAsB,EAAE,OAAe;IAClE,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,CAAE,qBAA2C,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7E,MAAM,GAAG,GAAmC,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QAC9E,IAAI,cAAc,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QAC1F,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAA8C,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAA8B,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAuB,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,GAAG;YACb,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACvC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CACzB,GAAc,EACd,WAAmB;IAEnB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/B,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACtE,CAAC;AAED,wGAAwG;AACxG,MAAM,WAAW,GAAG,kDAAkD,CAAC;AAEvE,oFAAoF;AACpF,MAAM,aAAa,GAAG,gEAAgE,CAAC;AAEvF;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,uHAAuH;AACvH,MAAM,SAAS,GAAG,6BAA6B,CAAC;AAEhD,8DAA8D;AAC9D,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAI,KAAiC,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpG,OAAO,GAA8B,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,+CAA+C,CAAC;AAEnE,qFAAqF;AACrF,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,0FAA0F;AAC1F,SAAS,cAAc,CAAC,KAAc,EAAE,EAAU,EAAE,SAAiB;IACnE,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,OAAe,EAAQ,EAAE;QACpD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC;IACF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,KAAK,CAAC,EAAE,EAAE,kDAAkD,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACxD,KAAK,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,oDAAoD,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,GAAG,EAAE,OAAO;YAClB,OAAO,EAAE,oBAAoB;YAC7B,OAAO,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,2DAA2D;SAC1K,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,GAAG,EAAE,OAAO;YAClB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,gCAAgC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,qKAAqK;SACxO,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,GAAG,EAAE,OAAO;YAClB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,kDAAkD;SAC5D,CAAC,CAAC;IACL,CAAC;SAAM,IACL,IAAI,KAAK,SAAS;QAClB,CAAC,OAAO,IAAI,KAAK,QAAQ;YACvB,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,mBAAmB;YACtC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,EACtC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,GAAG,EAAE,OAAO;YAClB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,kCAAkC,MAAM,CAAC,mBAAmB,CAAC,sHAAsH,oBAAoB,EAAE;SACnN,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,iDAAiD,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;YACvE,qEAAqE;YACrE,yEAAyE;YACzE,+DAA+D;YAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,6DAA6D,CAAC,CAAC;YAC5G,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC9F,IAAI,CAAC,KAAK;oBAAE,KAAK,CAAC,GAAG,EAAE,UAAU,GAAG,EAAE,EAAE,kCAAkC,MAAM,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;gBACnH,IAAI,KAAK,KAAK,IAAI;oBAAE,SAAS;gBAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,GAAG,oBAAoB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACtG,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,EAAE;wBAC1B,OAAO,EAAE,kBAAkB;wBAC3B,OAAO,EAAE,2DAA2D,MAAM,CAAC,oBAAoB,CAAC,mBAAmB;qBACpH,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzD,qEAAqE;oBACrE,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,EAAE;wBAC1B,OAAO,EAAE,kBAAkB;wBAC3B,OAAO,EAAE,6HAA6H;qBACvI,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAE,gBAAuC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,mBAAmB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,IAAsB,EAAE,OAAe;IACrE,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAwB,CAAC,IAAI,iBAAiB,CAAC;IACnF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAkB,EAAE,KAAkB;IACrE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK;QAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAExE,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAsC,CAAC;IAC9E,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;QAAE,IAAI,WAAW,CAAC,GAAG,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACvF,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;QAAE,IAAI,WAAW,CAAC,GAAG,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClF,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAI,KAAiC,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpG,MAAM,KAAK,GAAG,GAA8B,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,GAAW,EAA2B,EAAE;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO;QACL,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,4CAA4C;IAC5C,oBAAoB;IACpB,oDAAoD;IACpD,qBAAqB;IACrB,6DAA6D;IAC7D,oBAAoB;IACpB,iDAAiD;IACjD,qBAAqB;IACrB,gDAAgD;IAChD,oBAAoB;IACpB,8DAA8D;IAC9D,sBAAsB;IACtB,gFAAgF;IAChF,kBAAkB;IAClB,6FAA6F;IAC7F,qBAAqB;IACrB,sFAAsF;IACtF,oBAAoB;IACpB,gIAAgI;IAChI,iBAAiB;IACjB,iHAAiH;IACjH,iBAAiB;IACjB,4GAA4G;IAC5G,kBAAkB;CACV,CAAC;AAEX,2DAA2D;AAC3D,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,iBAAiB,GAAG,CAAC,GAAG,eAAe,EAAE,OAAO,EAAE,KAAK,CAAU,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE/F,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QAClF,MAAM,GAAG,GAAI,KAAiC,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,MAAM,EAAE,GAAG,aAAa,OAAO,SAAS,CAAC;QAEzC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,EAAE;gBACR,OAAO,EAAE,oBAAoB;gBAC7B,OAAO,EAAE,yEAAyE;aACnF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,GAA8B,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAE,iBAAuC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5D,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE;oBACpB,OAAO,EAAE,oBAAoB;oBAC7B,OAAO,EAAE,yCAAyC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACjF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,GAAG,EAAE,QAAQ;gBACnB,OAAO,EAAE,sBAAsB;gBAC/B,OAAO,EAAE,wBAAwB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,sBAAsB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACvG,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClE,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,GAAG,EAAE,MAAM;oBACjB,OAAO,EAAE,kBAAkB;oBAC3B,OAAO,EAAE,4DAA4D;iBACtE,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;oBACzE,MAAM,OAAO,GAAG,GAAG,EAAE,QAAQ,OAAO,EAAE,CAAC;oBACvC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC/B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAC7C,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,OAAO;4BACb,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kBAAkB;4BAC9D,OAAO,EAAE,QAAQ;gCACf,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,6GAA6G;gCACzI,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,sBAAsB;yBACrD,CAAC,CAAC;oBACL,CAAC;oBACD,KAAK,MAAM,OAAO,IAAI,cAAc,CAAE,GAA+B,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;wBAClG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACvB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAgC,EAAE,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE;oBACpB,OAAO,EAAE,oBAAoB;oBAC7B,OAAO,EAAE,gCAAgC;iBAC1C,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;YAChC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE;wBACrC,OAAO,EAAE,oBAAoB;wBAC7B,OAAO,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBAC7F,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACf,IAAI,GAAG,KAAK,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzD,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE;wBACrC,OAAO,EAAE,qBAAqB;wBAC9B,OAAO,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,sFAAsF,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBAC3J,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAU,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,GAAG,EAAE,OAAO;oBAClB,OAAO,EAAE,qBAAqB;oBAC9B,OAAO,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,4DAA4D;iBAChG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/core/read-scope.d.ts

@@ -128,6 +128,16 @@ export declare function effectiveReadRoots(options: {
  *   `read.shell` (this repository's policy: autonomous), which is a widening,
  *   and a task that exists to narrow reads has no business doing that in
  *   passing. They are named in the follow-up in `docs/sandboxed-exec.md`.
+ *
+ * APRV-397 adds the packaging readers, so the reads the new classifier rows
+ * answer are scoped by the same arithmetic every other reader's are: `tar`,
+ * `gunzip` and `base64` are `all` (their operands are files, and a flag value
+ * that lands among the positionals resolves against the working directory,
+ * which costs nothing: see the note below), and `openssl` is `after-pattern`,
+ * because its first positional is the digest subcommand and the files follow it. Only
+ * the READ forms of those binaries ever reach this table: `tar -x`, a plain
+ * `gunzip` and `base64 -o` take write classes in the classifier, and this module
+ * scopes `read.shell` alone.
  */
 export type ReadTargetShape = "all" | "after-pattern" | "walk";
 /** Which readers take paths, and where. Keyed by the binary's basename. */

package/dist/src/core/read-scope.js

@@ -129,6 +129,7 @@ export function effectiveReadRoots(options) {
 }
 /** Which readers take paths, and where. Keyed by the binary's basename. */
 export const READ_TARGET_SHAPES = {
+    base64: "all",
     cat: "all",
     cksum: "all",
     cut: "all",
@@ -137,10 +138,12 @@ export const READ_TARGET_SHAPES = {
     file: "all",
     find: "walk",
     grep: "after-pattern",
+    gunzip: "all",
     head: "all",
     jq: "after-pattern",
     ls: "all",
     md5sum: "all",
+    openssl: "after-pattern",
     rg: "after-pattern",
     sed: "after-pattern",
     sha256sum: "all",
@@ -148,6 +151,7 @@ export const READ_TARGET_SHAPES = {
     sort: "all",
     stat: "all",
     tail: "all",
+    tar: "all",
     tree: "all",
     uniq: "all",
     wc: "all",

package/dist/src/core/read-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-scope.js","sourceRoot":"","sources":["../../../src/core/read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAchE,+EAA+E;AAC/E,SAAS,UAAU,CAAC,SAAiB;IACnC,OAAO,SAAS;SACb,KAAK,CAAC,SAAS,CAAC;SAChB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,IAAY;IACjE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,KAAwB;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAIlC;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACtC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACnC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC,CAAC;IACF,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC9D,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,SAAS;QACxC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAoCD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAA8C;IAC3E,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,KAAK;IACZ,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,KAAK;IACX,EAAE,EAAE,KAAK;IACT,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,KAAK;IACX,EAAE,EAAE,eAAe;IACnB,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,KAAK;IACb,EAAE,EAAE,eAAe;IACnB,GAAG,EAAE,eAAe;IACpB,SAAS,EAAE,KAAK;IAChB,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,EAAE,EAAE,KAAK;CACV,CAAC;AAEF;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,IAAuB;IAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM;QAChC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAsB;IAC/C,IAAI;IACJ,IAAI;IACJ,UAAU;IACV,cAAc;IACd,QAAQ;CACT,CAAC;AAEF,kFAAkF;AAClF,SAAS,mBAAmB,CAAC,IAAuB;IAClD,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,GAAG,EAAE,EAAE,CACN,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnC,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAC5F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,WAA8B,EAC9B,IAAI,GAAsB,EAAE;IAE5B,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,KAAK;YACR,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC;QAC1B,KAAK,eAAe;YAClB,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7E,KAAK,MAAM;YACT,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;AAC9C,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,KAAwB;IAExB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IAC7C,IAAI,kBAAkB,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC;IAC3D,OAAO,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAwB;IACtD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"read-scope.js","sourceRoot":"","sources":["../../../src/core/read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAchE,+EAA+E;AAC/E,SAAS,UAAU,CAAC,SAAiB;IACnC,OAAO,SAAS;SACb,KAAK,CAAC,SAAS,CAAC;SAChB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,IAAY;IACjE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,KAAwB;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAIlC;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACtC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACnC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC,CAAC;IACF,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC9D,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,SAAS;QACxC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AA8CD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAA8C;IAC3E,MAAM,EAAE,KAAK;IACb,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,KAAK;IACZ,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,KAAK;IACX,EAAE,EAAE,KAAK;IACT,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,eAAe;IACrB,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,KAAK;IACX,EAAE,EAAE,eAAe;IACnB,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,KAAK;IACb,OAAO,EAAE,eAAe;IACxB,EAAE,EAAE,eAAe;IACnB,GAAG,EAAE,eAAe;IACpB,SAAS,EAAE,KAAK;IAChB,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,EAAE,EAAE,KAAK;CACV,CAAC;AAEF;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,IAAuB;IAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM;QAChC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAsB;IAC/C,IAAI;IACJ,IAAI;IACJ,UAAU;IACV,cAAc;IACd,QAAQ;CACT,CAAC;AAEF,kFAAkF;AAClF,SAAS,mBAAmB,CAAC,IAAuB;IAClD,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,GAAG,EAAE,EAAE,CACN,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnC,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAC5F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,WAA8B,EAC9B,IAAI,GAAsB,EAAE;IAE5B,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,KAAK;YACR,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC;QAC1B,KAAK,eAAe;YAClB,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7E,KAAK,MAAM;YACT,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;AAC9C,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,KAAwB;IAExB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IAC7C,IAAI,kBAAkB,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC;IAC3D,OAAO,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAwB;IACtD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1D,CAAC"}

package/dist/src/core/run-payload.d.ts

@@ -0,0 +1,160 @@
+/**
+ * The `approval run` payload: the argv, the cwd, and the bytes of the script
+ * the argv names (SPEC.md §6.2, §10.4; APRV-401).
+ *
+ * ## The hazard this closes
+ *
+ * §6.2 defined this payload as "the argv array and cwd", and `approval run`
+ * recomputes it from the argv and cwd it is about to spawn. For a command that
+ * IS its own bytes (`npm update @types/node`) that is the whole action. For a
+ * command that names a script it is not: the payload binds a NAME, and the
+ * bytes behind that name are whatever the path holds at execution time. The
+ * requester controls the file between the request and the grant, so a human
+ * approved a path and the runtime executed a file. Found on a live grant during
+ * APRV-398, exploited by nobody, filed as APRV-401.
+ *
+ * The payload hash is supposed to BE the binding (§10.4: "A grant therefore
+ * approves specific bytes"), so the repair is to put the bytes inside it. A
+ * script edited between the declaration and the execution hashes differently,
+ * and the difference refuses `payload-mismatch` before the child is spawned and
+ * before anything is appended, exactly as a changed argv already did.
+ *
+ * ## The shape, as the operator ruled it (APRV-401 notes, 2026-09-21)
+ *
+ * > the script digest is PART OF THE BINDING, never advisory. Shape: when argv
+ * > names an interpreter (bash, sh, zsh, node, python3 and kin) followed by a
+ * > path that resolves to a regular file at request time, the runtime reads and
+ * > hashes the file into the bound payload, the card shows the digest, byte
+ * > count and path, and approval run re-reads the file and refuses
+ * > payload-mismatch if the bytes changed. No interpretation of the script and
+ * > no second pass for files it sources; the limit is documented. Out of scope:
+ * > piped installers (already opaque), sourced files, interpreters the
+ * > classifier does not name.
+ *
+ * So this is an INTERPRETER-KEYED rule and not "every argv word that happens to
+ * name a file". One script per invocation: the first word after the interpreter
+ * that resolves to a readable regular file, which is the interpreter's operand
+ * whether or not a subcommand comes first (`deno run job.ts`).
+ * {@link SCRIPT_INTERPRETERS} is the list, and every member of it is a name
+ * `core/command-class.ts` already knows: the six shells of its unwrappable set,
+ * `node` from its own branch, and `python`, `python3`, `perl`, `ruby` and
+ * `deno` from its inline-source table. A launcher neither file names binds
+ * nothing, which is the documented limit rather than an oversight.
+ *
+ * The one thing here that the ruling does not spell out is the DEGENERATE case:
+ * `./install.sh` with no interpreter word at all, where the kernel reads the
+ * shebang and the script is `argv[0]` itself. It is bound, because it is the
+ * same fact with the interpreter implied rather than typed, and leaving it out
+ * would be a hole in the rule shaped exactly like the rule.
+ *
+ * ## What is NOT bound, stated plainly
+ *
+ * - **An inline program.** `bash -c '…'`, `node -e '…'`, `python3 -c '…'`: the
+ *   program is a word of the argv, so it was always bound, and there is no file
+ *   to read. The inline flags per interpreter are in {@link SCRIPT_INTERPRETERS}.
+ * - **Nothing resolved through PATH.** The interpreter itself is not hashed. Its
+ *   bytes are the host's rather than the requester's, and resolving a program
+ *   name through `PATH` would make the payload a function of the environment the
+ *   process happens to hold, which §11 says is never read implicitly.
+ * - **Nothing transitive.** A bound script that sources another file, curls a
+ *   second one, or execs a third binds only its own bytes. The digest is a
+ *   binding, not a sandbox.
+ * - **A piped installer.** `curl … | sh` has no file operand and is opaque to
+ *   the classifier for the same reason it is unbindable here.
+ * - **The instant between hashing and spawning.** The digest is taken, then
+ *   `execution.started` is appended, then the child is spawned. A file rewritten
+ *   inside that window runs unbound. Closing it needs the executor to hold the
+ *   bytes rather than the path, which is the adapter contract of §10.4.
+ *
+ * ## Absence is not a claim
+ *
+ * `script` is omitted when nothing is bound, and that omission is deliberate: an
+ * invocation naming no readable script hashes to exactly the value it hashed
+ * before this module existed, so every record already in the log, and every
+ * declaration already written into a task file, verifies unchanged. What the
+ * absence does NOT say is "this runtime checked and there was nothing" — it is
+ * the ordinary shape of a payload with no script to bind, and a reader wanting
+ * to know whether a digest was possible reads the argv, which is right there.
+ *
+ * Every skip is safe for one reason, and it is the same reason in each case: the
+ * value is recomputed at execution by this same rule. A file that was
+ * unreadable at declaration time and readable at execution time gains an entry
+ * and refuses; one that existed and was deleted loses one and refuses. The rule
+ * does not have to decide correctly what a command will do, because both ends
+ * apply it to the same tree and any disagreement is a refusal.
+ *
+ * Reads the filesystem, by design and by necessity: at most one file per call,
+ * and only the one the argv names. Writes nothing, appends nothing, reads no
+ * log, no policy, no environment and no clock.
+ */
+/** The payload key carrying the bound script. Omitted when there is none. */
+export declare const BOUND_SCRIPT_KEY = "script";
+/**
+ * How much of a file is read at once while digesting it.
+ *
+ * Chunked rather than `readFileSync`, because a script may be of any size and
+ * the executor must not be the thing that runs out of memory: a refusal to
+ * compute the binding is a refusal to execute.
+ */
+export declare const DIGEST_CHUNK_BYTES: number;
+/**
+ * The interpreters whose script operand is bound, and the flags that mean
+ * "the program is inline, there is no file".
+ *
+ * Every name here is one `core/command-class.ts` already knows, which is the
+ * ruling's "interpreters the classifier does not name" read as a positive list:
+ * the six shells of its unwrappable set, `node` from its own classification
+ * branch, and `python`, `python3`, `perl`, `ruby`, `deno` from its
+ * inline-source table. The list is duplicated rather than imported because
+ * those tables are private to that module and a public export of them would be
+ * a second consumer of a decision that belongs to classification; the comment
+ * is the seam, and a name added there without being added here binds nothing,
+ * which fails toward the old behaviour rather than toward a wrong digest.
+ *
+ * The shell inline flag is `-c` with any run of `l` and `i` before it, which is
+ * `INLINE_SCRIPT_FLAG` in that module, spelled here as the same regular
+ * expression for the same reason.
+ */
+export declare const SCRIPT_INTERPRETERS: ReadonlyMap<string, readonly (string | RegExp)[]>;
+/** One script the argv names, bound by its bytes. */
+export interface BoundScript {
+    /** Which argv word named it. */
+    argv_index: number;
+    /** The path as resolved against the payload's `cwd`: absolute, always. */
+    path: string;
+    /** The file's size in bytes, which the approver's card shows beside the digest. */
+    bytes: number;
+    /** SHA-256 (lowercase hex) of the file's bytes. */
+    sha256: string;
+}
+/** The `approval run` payload value, canonicalized and hashed by the caller. */
+export interface RunPayload {
+    argv: string[];
+    cwd: string;
+    /** Present only when the argv named a readable script. */
+    script?: BoundScript;
+}
+/**
+ * The script this argv runs, bound by its bytes, or `null` (APRV-401).
+ *
+ * Two shapes, and only two: an interpreter this module names followed by a path
+ * operand, and a path at `argv[0]` that the kernel will read a shebang from.
+ * Anything else binds nothing and the payload is what it always was.
+ */
+export declare function boundScript(argv: readonly string[], cwd: string): BoundScript | null;
+/**
+ * The value `approval run`'s `payload_hash` is taken over (SPEC.md §6.2).
+ *
+ * `{argv, cwd}` when the argv names no readable script, byte for byte what it
+ * has always been; `{argv, cwd, script}` when it does. The caller canonicalizes
+ * and hashes it — this function decides WHAT is bound and never how it is
+ * digested into an approval.
+ */
+export declare function runPayloadValue(argv: readonly string[], cwd: string): RunPayload;
+/**
+ * One line naming the bound script, for a refusal message or a terminal.
+ *
+ * Not a rendering an approver signs: the canonical renderer owns that, and this
+ * is the executor explaining to an agent WHICH file moved.
+ */
+export declare function describeBoundScript(script: BoundScript | null): string;

package/dist/src/core/run-payload.js

@@ -0,0 +1,304 @@
+/**
+ * The `approval run` payload: the argv, the cwd, and the bytes of the script
+ * the argv names (SPEC.md §6.2, §10.4; APRV-401).
+ *
+ * ## The hazard this closes
+ *
+ * §6.2 defined this payload as "the argv array and cwd", and `approval run`
+ * recomputes it from the argv and cwd it is about to spawn. For a command that
+ * IS its own bytes (`npm update @types/node`) that is the whole action. For a
+ * command that names a script it is not: the payload binds a NAME, and the
+ * bytes behind that name are whatever the path holds at execution time. The
+ * requester controls the file between the request and the grant, so a human
+ * approved a path and the runtime executed a file. Found on a live grant during
+ * APRV-398, exploited by nobody, filed as APRV-401.
+ *
+ * The payload hash is supposed to BE the binding (§10.4: "A grant therefore
+ * approves specific bytes"), so the repair is to put the bytes inside it. A
+ * script edited between the declaration and the execution hashes differently,
+ * and the difference refuses `payload-mismatch` before the child is spawned and
+ * before anything is appended, exactly as a changed argv already did.
+ *
+ * ## The shape, as the operator ruled it (APRV-401 notes, 2026-09-21)
+ *
+ * > the script digest is PART OF THE BINDING, never advisory. Shape: when argv
+ * > names an interpreter (bash, sh, zsh, node, python3 and kin) followed by a
+ * > path that resolves to a regular file at request time, the runtime reads and
+ * > hashes the file into the bound payload, the card shows the digest, byte
+ * > count and path, and approval run re-reads the file and refuses
+ * > payload-mismatch if the bytes changed. No interpretation of the script and
+ * > no second pass for files it sources; the limit is documented. Out of scope:
+ * > piped installers (already opaque), sourced files, interpreters the
+ * > classifier does not name.
+ *
+ * So this is an INTERPRETER-KEYED rule and not "every argv word that happens to
+ * name a file". One script per invocation: the first word after the interpreter
+ * that resolves to a readable regular file, which is the interpreter's operand
+ * whether or not a subcommand comes first (`deno run job.ts`).
+ * {@link SCRIPT_INTERPRETERS} is the list, and every member of it is a name
+ * `core/command-class.ts` already knows: the six shells of its unwrappable set,
+ * `node` from its own branch, and `python`, `python3`, `perl`, `ruby` and
+ * `deno` from its inline-source table. A launcher neither file names binds
+ * nothing, which is the documented limit rather than an oversight.
+ *
+ * The one thing here that the ruling does not spell out is the DEGENERATE case:
+ * `./install.sh` with no interpreter word at all, where the kernel reads the
+ * shebang and the script is `argv[0]` itself. It is bound, because it is the
+ * same fact with the interpreter implied rather than typed, and leaving it out
+ * would be a hole in the rule shaped exactly like the rule.
+ *
+ * ## What is NOT bound, stated plainly
+ *
+ * - **An inline program.** `bash -c '…'`, `node -e '…'`, `python3 -c '…'`: the
+ *   program is a word of the argv, so it was always bound, and there is no file
+ *   to read. The inline flags per interpreter are in {@link SCRIPT_INTERPRETERS}.
+ * - **Nothing resolved through PATH.** The interpreter itself is not hashed. Its
+ *   bytes are the host's rather than the requester's, and resolving a program
+ *   name through `PATH` would make the payload a function of the environment the
+ *   process happens to hold, which §11 says is never read implicitly.
+ * - **Nothing transitive.** A bound script that sources another file, curls a
+ *   second one, or execs a third binds only its own bytes. The digest is a
+ *   binding, not a sandbox.
+ * - **A piped installer.** `curl … | sh` has no file operand and is opaque to
+ *   the classifier for the same reason it is unbindable here.
+ * - **The instant between hashing and spawning.** The digest is taken, then
+ *   `execution.started` is appended, then the child is spawned. A file rewritten
+ *   inside that window runs unbound. Closing it needs the executor to hold the
+ *   bytes rather than the path, which is the adapter contract of §10.4.
+ *
+ * ## Absence is not a claim
+ *
+ * `script` is omitted when nothing is bound, and that omission is deliberate: an
+ * invocation naming no readable script hashes to exactly the value it hashed
+ * before this module existed, so every record already in the log, and every
+ * declaration already written into a task file, verifies unchanged. What the
+ * absence does NOT say is "this runtime checked and there was nothing" — it is
+ * the ordinary shape of a payload with no script to bind, and a reader wanting
+ * to know whether a digest was possible reads the argv, which is right there.
+ *
+ * Every skip is safe for one reason, and it is the same reason in each case: the
+ * value is recomputed at execution by this same rule. A file that was
+ * unreadable at declaration time and readable at execution time gains an entry
+ * and refuses; one that existed and was deleted loses one and refuses. The rule
+ * does not have to decide correctly what a command will do, because both ends
+ * apply it to the same tree and any disagreement is a refusal.
+ *
+ * Reads the filesystem, by design and by necessity: at most one file per call,
+ * and only the one the argv names. Writes nothing, appends nothing, reads no
+ * log, no policy, no environment and no clock.
+ */
+import { createHash } from "node:crypto";
+import { closeSync, openSync, readSync, statSync } from "node:fs";
+import { isAbsolute, resolve as resolvePath } from "node:path";
+/** The payload key carrying the bound script. Omitted when there is none. */
+export const BOUND_SCRIPT_KEY = "script";
+/**
+ * How much of a file is read at once while digesting it.
+ *
+ * Chunked rather than `readFileSync`, because a script may be of any size and
+ * the executor must not be the thing that runs out of memory: a refusal to
+ * compute the binding is a refusal to execute.
+ */
+export const DIGEST_CHUNK_BYTES = 64 * 1024;
+/**
+ * The interpreters whose script operand is bound, and the flags that mean
+ * "the program is inline, there is no file".
+ *
+ * Every name here is one `core/command-class.ts` already knows, which is the
+ * ruling's "interpreters the classifier does not name" read as a positive list:
+ * the six shells of its unwrappable set, `node` from its own classification
+ * branch, and `python`, `python3`, `perl`, `ruby`, `deno` from its
+ * inline-source table. The list is duplicated rather than imported because
+ * those tables are private to that module and a public export of them would be
+ * a second consumer of a decision that belongs to classification; the comment
+ * is the seam, and a name added there without being added here binds nothing,
+ * which fails toward the old behaviour rather than toward a wrong digest.
+ *
+ * The shell inline flag is `-c` with any run of `l` and `i` before it, which is
+ * `INLINE_SCRIPT_FLAG` in that module, spelled here as the same regular
+ * expression for the same reason.
+ */
+export const SCRIPT_INTERPRETERS = new Map([
+    ["bash", [/^-[li]*c$/u]],
+    ["sh", [/^-[li]*c$/u]],
+    ["zsh", [/^-[li]*c$/u]],
+    ["dash", [/^-[li]*c$/u]],
+    ["ksh", [/^-[li]*c$/u]],
+    ["fish", [/^-[li]*c$/u, "--command"]],
+    ["node", ["-e", "--eval", "-p", "--print", "--input-type=module"]],
+    ["nodejs", ["-e", "--eval", "-p", "--print"]],
+    ["python", ["-c"]],
+    ["python3", ["-c"]],
+    ["perl", ["-e", "-E"]],
+    ["ruby", ["-e"]],
+    ["deno", ["eval"]],
+]);
+/**
+ * The digest and size of one file, read in bounded chunks, or `null` when it
+ * cannot be read at all.
+ *
+ * `null` for every failure — gone, a directory, a device, permission denied, a
+ * disappearing file, a read error partway — and the reason is not recorded
+ * anywhere. Recording it would put a local errno inside hashed material, so two
+ * machines that agree about the bytes could disagree about the payload; and the
+ * only thing a reader could do with it is treat "unreadable" as a state, which
+ * the recomputation already handles better than any field could.
+ */
+function fileDigest(path) {
+    let fd;
+    try {
+        const stats = statSync(path);
+        if (!stats.isFile())
+            return null;
+        fd = openSync(path, "r");
+    }
+    catch {
+        return null;
+    }
+    const hash = createHash("sha256");
+    const buffer = Buffer.allocUnsafe(DIGEST_CHUNK_BYTES);
+    let bytes = 0;
+    try {
+        let read = readSync(fd, buffer, 0, DIGEST_CHUNK_BYTES, null);
+        while (read > 0) {
+            hash.update(buffer.subarray(0, read));
+            bytes += read;
+            read = readSync(fd, buffer, 0, DIGEST_CHUNK_BYTES, null);
+        }
+    }
+    catch {
+        return null;
+    }
+    finally {
+        try {
+            closeSync(fd);
+        }
+        catch {
+            // A close that fails has nothing to do with the bytes already hashed.
+        }
+    }
+    return { bytes, sha256: hash.digest("hex") };
+}
+/** The last path segment of an argv word: `/usr/bin/bash` reads as `bash`. */
+function basenameOf(word) {
+    const segments = word.split("/");
+    return segments[segments.length - 1] ?? word;
+}
+/** Does `word` mean "the program is inline" for this interpreter? */
+function isInlineProgramFlag(word, markers) {
+    return markers.some((marker) => typeof marker === "string" ? word === marker : marker.test(word));
+}
+/**
+ * The words of an interpreter invocation that could be its script, in order,
+ * or `null` when the program is inline and there is no file at all.
+ *
+ * An inline-program marker anywhere in the options answers `null` rather than
+ * "keep looking": the program is a word of the argv and already bound, and a
+ * file that happens to share its spelling is a file the command never opens.
+ *
+ * Otherwise every non-option word is a candidate, in argv order, and the caller
+ * binds the first that resolves to a readable regular file. Not just the first
+ * non-option word, because interpreters take SUBCOMMANDS: `deno run job.ts`
+ * would otherwise offer `run` and stop, and `python3 -m pkg job.py` would offer
+ * `pkg`. Walking on cannot bind anything the argv does not name, and the worst
+ * case is the harmless direction — a command whose script is missing and whose
+ * later argument happens to be a file binds that file, which is one more thing
+ * bound rather than one fewer.
+ *
+ * An option that takes a separate path value is the one place this can pick the
+ * wrong file (`node --require ./a.js job.js` binds `./a.js`), and both are
+ * files that invocation executes.
+ */
+function scriptCandidateIndexes(argv, markers) {
+    const candidates = [];
+    for (let index = 1; index < argv.length; index += 1) {
+        const word = argv[index];
+        if (isInlineProgramFlag(word, markers))
+            return null;
+        if (word === "--")
+            continue;
+        if (word.startsWith("-") && word.length > 1)
+            continue;
+        candidates.push(index);
+    }
+    return candidates;
+}
+/**
+ * Where an argv word points, resolved against the payload's own `cwd`.
+ *
+ * The cwd is the payload's, never `process.cwd()`: the payload already carries
+ * the directory the child will run in, and resolving against anything else
+ * would make the binding a function of where the hashing process happened to
+ * stand.
+ */
+function resolveArgvPath(word, cwd) {
+    if (word === "" || word === "-" || word === "--")
+        return null;
+    if (word.includes("\0"))
+        return null;
+    return isAbsolute(word) ? word : resolvePath(cwd, word);
+}
+/**
+ * The script this argv runs, bound by its bytes, or `null` (APRV-401).
+ *
+ * Two shapes, and only two: an interpreter this module names followed by a path
+ * operand, and a path at `argv[0]` that the kernel will read a shebang from.
+ * Anything else binds nothing and the payload is what it always was.
+ */
+export function boundScript(argv, cwd) {
+    const program = argv[0];
+    if (program === undefined || program === "")
+        return null;
+    const markers = SCRIPT_INTERPRETERS.get(basenameOf(program));
+    if (markers !== undefined) {
+        const candidates = scriptCandidateIndexes(argv, markers);
+        if (candidates === null)
+            return null;
+        for (const index of candidates) {
+            const path = resolveArgvPath(argv[index], cwd);
+            if (path === null)
+                continue;
+            const digest = fileDigest(path);
+            if (digest !== null)
+                return { argv_index: index, path, ...digest };
+        }
+        return null;
+    }
+    // The degenerate case: no interpreter word, so the script IS argv[0] and the
+    // interpreter is whatever its shebang names. A program with no separator in
+    // it is a PATH lookup and is not this (see the module header).
+    if (!isAbsolute(program) && !program.includes("/"))
+        return null;
+    const path = resolveArgvPath(program, cwd);
+    if (path === null)
+        return null;
+    const digest = fileDigest(path);
+    return digest === null ? null : { argv_index: 0, path, ...digest };
+}
+/**
+ * The value `approval run`'s `payload_hash` is taken over (SPEC.md §6.2).
+ *
+ * `{argv, cwd}` when the argv names no readable script, byte for byte what it
+ * has always been; `{argv, cwd, script}` when it does. The caller canonicalizes
+ * and hashes it — this function decides WHAT is bound and never how it is
+ * digested into an approval.
+ */
+export function runPayloadValue(argv, cwd) {
+    const script = boundScript(argv, cwd);
+    const payload = { argv: [...argv], cwd };
+    if (script !== null)
+        payload.script = script;
+    return payload;
+}
+/**
+ * One line naming the bound script, for a refusal message or a terminal.
+ *
+ * Not a rendering an approver signs: the canonical renderer owns that, and this
+ * is the executor explaining to an agent WHICH file moved.
+ */
+export function describeBoundScript(script) {
+    if (script === null)
+        return "no script";
+    return `argv[${String(script.argv_index)}] ${script.path}, ${String(script.bytes)} bytes, sha256 ${script.sha256}`;
+}
+//# sourceMappingURL=run-payload.js.map

package/dist/src/core/run-payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-payload.js","sourceRoot":"","sources":["../../../src/core/run-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAE/D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsD,IAAI,GAAG,CAAC;IAC5F,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;IACxB,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC;IACtB,CAAC,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC;IACvB,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;IACxB,CAAC,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC;IACvB,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACrC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAClE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;CACnB,CAAC,CAAC;AAsBH;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QACjC,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IACtD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,IAAI,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAC7D,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YACtC,KAAK,IAAI,IAAI,CAAC;YACd,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED,qEAAqE;AACrE,SAAS,mBAAmB,CAAC,IAAY,EAAE,OAAqC;IAC9E,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7B,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CACjE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,sBAAsB,CAC7B,IAAuB,EACvB,OAAqC;IAErC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAW,CAAC;QACnC,IAAI,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACtD,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,GAAW;IAChD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,IAAuB,EAAE,GAAW;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAW,EAAE,GAAG,CAAC,CAAC;YACzD,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,+DAA+D;IAC/D,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,GAAW;IAClE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,OAAO,GAAe,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACrD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IAC7C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0B;IAC5D,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,WAAW,CAAC;IACxC,OAAO,QAAQ,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,MAAM,CAAC,MAAM,EAAE,CAAC;AACrH,CAAC"}