cc-safety-net 2.3.3 → 2.4.0

package/dist/amp/cc-safety-net/index.ts

@@ -1,100 +1,52 @@
 // cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp
-// version: 2.3.3
+// version: 2.4.0
 // @bun
-var XE=Object.defineProperty;var QE=(e)=>e;function ew(e,t){this[e]=QE.bind(null,t)}var ln=(e,t)=>{for(var n in t)XE(e,n,{get:t[n],enumerable:!0,configurable:!0,set:ew.bind(t,n)})};import{randomBytes as Kw}from"crypto";import{appendFileSync as Yw,mkdirSync as Jw}from"fs";import{homedir as Xw,userInfo as Qw}from"os";import{isAbsolute as eR,join as Il}from"path";var tw=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function Tt(e){let t=e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>");return nw(t)}function nw(e){let t=e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>");for(let n of tw)t=t.replace(n,"<redacted>");return t.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}import{lstatSync as ey,readdirSync as Mw,readFileSync as oy,rmdirSync as $w,statSync as ty,unlinkSync as Lw,utimesSync as Ww,writeFileSync as Fw}from"fs";import{dirname as Gw,join as Hn}from"path";var Oi=30,Cl=1,El=365;function zi(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}import{homedir as Ew}from"os";import{dirname as Un,isAbsolute as ww,join as Bn,relative as Rw,resolve as fn,sep as Pw}from"path";import{lstatSync as rw,realpathSync as ow}from"fs";import{homedir as iw,tmpdir as sw}from"os";var Be={realpath:(e)=>{try{return ow(e)}catch{return null}},entryKind:(e)=>{let t=rw(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"}};function ze(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function un(){return ze(process.env.HOME||iw())}function Qe(){return{env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:un(),tmpdir:sw(),paths:Be}}import{closeSync as aw,constants as Mh,fstatSync as cw,fsyncSync as C1,lstatSync as $h,mkdirSync as E1,openSync as lw,readdirSync as w1,readFileSync as uw,realpathSync as Ni,renameSync as R1,rmdirSync as P1,statSync as dw,unlinkSync as A1,writeFileSync as k1}from"fs";import{isAbsolute as Lh,join as Wh,normalize as mw,parse as fw,relative as wl,resolve as Rl,sep as Pl}from"path";var pw=Symbol("PolicyFilesystemScope"),gw=Symbol("PolicyFilesystemTarget"),hw=Mh.O_NOFOLLOW??0;class pe extends Error{constructor(e){super(`Unable to access ${e} filesystem safely.`);this.name="PolicyFilesystemError"}}function dn(e,t){return{[pw]:!0,root:Rl(e),label:t}}function Fh(e,t){let n=mw(t);if(t===""||Lh(t)||n===".."||n.startsWith(`..${Pl}`))throw new pe(e.label);return{[gw]:!0,scope:e,relativePath:n,path:Wh(e.root,n)}}function Jr(e,t){let n=wl(e.root,Rl(t));return Fh(e,n)}function Gh(e,t="rules policy"){let n=Rl(e),r=fw(n).dir;return Fh(dn(r,t),wl(r,n))}function Mi(e){try{if(!Di(e,!1).exists)return null;let n=lw(e.path,Mh.O_RDONLY|hw);try{let r=cw(n);if(!r.isFile())throw new pe(e.scope.label);let o=uw(n,"utf-8"),i=$h(e.path);if(!i.isFile()||i.isSymbolicLink()||r.dev!==i.dev||r.ino!==i.ino)throw new pe(e.scope.label);return Di(e,!1),o}finally{aw(n)}}catch(t){vw(e.scope.label,t)}}function Zh(e,t){if(e.path===t.path)return!0;try{if(!Di(e,!1).exists||!Di(t,!1).exists)return!1;return Ni(e.path)===Ni(t.path)}catch(n){if(n instanceof pe)throw n;throw new pe(e.scope.label)}}function Di(e,t,n="file"){let r=yw(e.scope);if(!r)return{exists:!1};let o=e.relativePath.split(Pl);for(let i of o.keys()){let s=Wh(e.scope.root,...o.slice(0,i+1)),a=jh(s);if(!a){if(i===o.length-1&&t)return{exists:!1};return{exists:!1}}if(a.isSymbolicLink())throw new pe(e.scope.label);if(i<o.length-1&&!a.isDirectory())throw new pe(e.scope.label);if(i===o.length-1&&(n==="file"?!a.isFile():!a.isDirectory()))throw new pe(e.scope.label);bw(r,Ni(s),e.scope.label)}return{exists:!0}}function yw(e){if(!jh(e.root))return null;if(!dw(e.root).isDirectory())throw new pe(e.label);return Ni(e.root)}function bw(e,t,n){let r=wl(e,t);if(r===".."||r.startsWith(`..${Pl}`)||Lh(r))throw new pe(n)}function jh(e){try{return $h(e)}catch(t){if(_w(t)&&t.code==="ENOENT")return null;throw t}}function vw(e,t){if(t instanceof pe)throw t;throw new pe(e)}function _w(e){return e instanceof Error&&"code"in e}var mn=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Uh="rulebook.json",Bh=".cc-safety-net/rules";var Vh=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Sw=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,xw=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Cw="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),O1=new RegExp(`^${xw}/(${mn.source.slice(1,-1)})/${Cw}$`);function Hh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function qh(e){if($i(e))try{return Al(e),null}catch(t){return t instanceof Error?t.message:String(t)}return mn.test(e)?null:`Local rulebook sources must be bare names matching ${mn}: ${e}`}function Al(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Vh);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Sw.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!mn.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Hh(o),name:o}}function $i(e){return Vh.test(e)}var Kh="rule.json",pn="policy.json";var Yh=".cc-safety-net",Aw="rules",kw="CC_SAFETY_NET_HOME",Jh="`cc-safety-net rule update`";function Tw(e){return fn(e??process.cwd(),Bh)}function Iw(e){return Bn(Tw(e),Kh)}function Xr(e){return Bn(fn(e??process.cwd()),Yh,pn)}function Vn(e){return e?.userConfigDir??(e?.userConfigPath?Un(e.userConfigPath):Bn(Ow(),Aw))}function Ow(){let e=process.env[kw];return e?fn(ze(e)):Bn(Ew(),Yh)}function zw(e){return Bn(Vn(e),Kh)}function Xh(e){let t=e.userConfigPath??zw(e),n=e.projectConfigPath??Iw(e.cwd),r=Nw(t,e),o=Dw(n,e);return{userConfigPath:t,projectConfigPath:n,userScope:r,projectScope:o,userConfigTarget:Jr(r,t),projectConfigTarget:Jr(o,n)}}function Nw(e,t){let n=t.userConfigPath?Un(Un(fn(t.userConfigPath))):Un(fn(t.userConfigDir??Vn(t)));return dn(n,"user policy")}function Dw(e,t){let n=fn(t.cwd??process.cwd()),r=fn(e),o=Rw(n,r);if(o!==".."&&!o.startsWith(`..${Pw}`)&&!ww(o))return dn(n,"project policy");return dn(Un(Un(r)),"project policy")}function Qh(e,t){return Bn(e,t,Uh)}var Tl=86400000,Zw=".last-prune",jw=/^\d{4}-\d{2}$/,Uw=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,ny=(e)=>Math.floor(e/Tl);function Bw(e){try{let t=Hn(Gw(Vn(e)),pn),n=JSON.parse(oy(t,"utf-8"));return zi(n?.audit?.retention_days)}catch{return Oi}}function iy(e,t=()=>new Date){try{let n=t().getTime();if(!ty(e,{throwIfNoEntry:!1})?.isDirectory())return;let r=Hn(e,Zw),o=ty(r,{throwIfNoEntry:!1})?.mtimeMs;if(o!==void 0&&ny(o)===ny(n))return;let i=n-Bw()*Tl,s=new Date(n).toISOString().slice(0,7);for(let a of kl(e)){if(a.isDirectory()){Vw(Hn(e,a.name),i,s);continue}if(a.isFile()&&a.name.endsWith(".jsonl"))Hw(Hn(e,a.name),i)}Fw(r,"",{mode:384}),Ww(r,n/1000,n/1000)}catch{}}function Vw(e,t,n){for(let r of kl(e)){if(!r.isDirectory()||!jw.test(r.name))continue;let o=Hn(e,r.name);for(let i of kl(o)){if(!i.isFile())continue;let s=Uw.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+Tl;if(!Number.isFinite(a)||a>=t)continue;sy(Hn(o,i.name))}if(r.name!==n)ry(o)}ry(e)}function Hw(e,t){try{let n=ey(e);if(n.mtimeMs>=t)return;let r=oy(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(qw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(ey(e).mtimeMs!==n.mtimeMs)return;sy(e)}catch{}}function qw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function kl(e){try{return Mw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function sy(e){try{Lw(e)}catch{}}function ry(e){try{$w(e)}catch{}}var tR="2.3.3",nR=1e4,rR=2000,oR=256,iR=32768;function sR(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function aR(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Ol(e,t,n,r,o,i={}){let s=sR(e);if(!s)return;let a=i.homeDir??ay();if(!a)return;let c=cR(a);if(!c)return;try{let l=(i.now??(()=>new Date))().toISOString(),u=Li(Tt(t),i.failureStage?Number.POSITIVE_INFINITY:nR),d=Li(Tt(n),rR),m=i.toolName?Li(Tt(i.toolName),oR):void 0,f=o===null?void 0:Li(Tt(o),iR),p=Il(c,aR(f?.value??null),l.slice(0,7));Jw(p,{recursive:!0,mode:448});let h=Il(p,`${l.slice(0,10)}-${s}.jsonl`),y={ts:l,id:(i.createId??(()=>Kw(8).toString("hex")))(),v:tR,sessionId:s,decision:i.decision??"deny",agent:i.agent,shape:i.shape,level:i.level,configFallback:i.configFallback,toolName:m?.value,command:u.value,segment:d.value,...u.truncated||d.truncated||m?.truncated||f?.truncated?{truncated:!0}:{},reason:r,ruleId:i.ruleId,intent:i.intent,failureStage:i.failureStage,errorCode:i.errorCode,cwd:f?.value??null};Yw(h,`${JSON.stringify(y)}
-`,{encoding:"utf-8",mode:384}),iy(c,i.now)}catch{}}function Li(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function ay(e=process.env.CC_SAFETY_NET_AUDIT_HOME||process.env.HOME){let t=e||Xw()||Qw().homedir;return t&&eR(t)?t:null}function cR(e=ay()){return e?Il(e,".cc-safety-net","logs"):null}function ly(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=cy(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence.find((a)=>a.kind==="command"),s=i?.command??(r?cy(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function cy(e){return"command"in e?e.command??"":""}function uy(e,t,n){if(!e)return;let r;try{r=t()}catch{return}if(typeof r!=="string"||!r.trim())return;Ol(r,e.command,e.segment,e.reason,e.cwd,{homeDir:n.homeDir,decision:e.decision,agent:n.agent,shape:n.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function dy(e,t,n){let r;try{r=t()}catch{return}if(typeof r!=="string"||!r.trim())return;Ol(r,e.command??"",e.segment??e.command??"",e.reason,n.cwd??null,{homeDir:n.homeDir,decision:"deny",agent:n.agent,shape:n.shape,toolName:n.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}import{accessSync as sL,constants as aL,realpathSync as hR,statSync as yR}from"fs";import{isAbsolute as Nl,relative as bR,resolve as my,sep as vR}from"path";import{dirname as lR,isAbsolute as uR,parse as dR,sep as mR}from"path";function Zt(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function jt(e,t,n){if(Zt(t))throw Error("Unsupported Windows namespace path");let r=uR(t)?pR(t):"",o=r||e;for(let i of gR(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=lR(o);continue}let s=fR(o,i),a=n.entryKind(s),c=a==="symlink"?n.realpath(s):s;if(a==="missing"||c===null)throw Error(`Cannot resolve path component: ${s}`);o=c}return o}function fR(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${mR}${t}`}function pR(e){return dR(e).root}function gR(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}function Dl(e,t){if(Zt(e))return;let n=t.flatMap((o)=>zl(o));if(!n[0])return;let r=zl(Nl(e)?e:my(n[0],e))[0];if(!r)return;return n.some((o)=>py(r,o))?r:void 0}function fy(e,t){if(Zt(e))return;return zl(Nl(e)?e:my(t,e))[0]}function zl(e){try{let t=hR(e);return yR(t).isDirectory()?[t]:[]}catch{return[]}}function py(e,t){let n=bR(t,e);return n===""||n!==".."&&!n.startsWith(`..${vR}`)&&!Nl(n)}var Ut="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",It="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",gy="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.",hy="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Wi="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";function by(e){let{reason:t,command:n,segment:r,toolName:o}=e,i=e.maxLen??200,s=e.redact??((c)=>c),a=`BLOCKED by CC Safety Net
+var bi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",je="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",In="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Ci={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},bp={errorCode:"structural-shell-syntax-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},xt={errorCode:"tool-input-limit",reason:"CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user."},Tn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},Pr={errorCode:"structural-shell-syntax-limit",reason:"Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry."},P=Object.freeze({realpathAttempts:{cap:16384,...Ci},processedCandidateBytes:{cap:4194304,...Ci},pathEnvironmentExpansion:{cap:64,...Ci},structuralShellSyntax:bp,recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Tn},trackedHeredocFiles:{cap:64,...Tn},controlFlowStates:{cap:64,...Tn},wrapperPeelIterations:{cap:20,...Tn},derivedCommandShape:Tn,parallelChildAnalyses:{cap:1024,...Pr},parallelDerivedTokens:{cap:16384,...Pr},parallelDerivedBytes:{cap:1048576,...Pr},parallelPlaceholderReplacements:{cap:16384,...Pr},hookInputBytes:{cap:8388608,errorCode:"tool-input-limit",reason:"Failed to parse hook input JSON."},toolInputDepth:{cap:64,...xt},toolInputNodes:{cap:1e4,...xt},toolInputKeys:{cap:1e4,...xt},toolInputStringBytes:{cap:1048576,...xt},toolInputAggregateStringBytes:{cap:4194304,...xt},toolInputGitDiffCandidates:{cap:64,...xt},toolInputShape:xt});class F extends Error{kind;name="AnalysisLimit";constructor(e){super(P[e].reason);this.kind=e}}function Ce(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>P[t].cap)throw new F(t)}}}var vp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function ct(e){return Ep(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Ep(e){return vp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Rp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function xp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,Rp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-Reason: ${s(t)}`;if(e.ruleId)a+=`
-
-Rule: ${e.ruleId}`;if(o)a+=`
-
-Tool: ${o}`;if(n){let c=s(n);a+=`
-
-Command: ${yy(c,i)}`}if(r&&r!==n){let c=s(r);a+=`
-
-Segment: ${yy(c,i)}`}if(e.configWarning)a+=`
-
-Config warning: ${s(e.configWarning)}`;return a+=`
-
-${_R(e.intent??"manual_only")}`,a}function _R(e){switch(e){case"hard_stop":return"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.";case"use_alternative":return"Do not retry the blocked form. Continue the task using the safer alternative described above.";case"scope_down":return"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.";case"manual_only":return"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.";case"stop_and_explain":return"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."}}function yy(e,t){return e.length>t?`${e.slice(0,t)}...`:e}function vy(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence.find((r)=>r.kind==="command"):void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function _y(e={}){return{reason:Wi,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function Sy(e){return by({...e,redact:Tt})}function xy(e){return Tt(e instanceof Error?e.message:String(e))}import{basename as SR,dirname as xR,join as Ml}from"path";var qn=Object.freeze({maxEnvironmentExpansionDepth:64,maxMissingSuffixComponents:256,maxRealpathAttempts:16384,maxProcessedCandidateBytes:4194304});class Se extends Error{name="PathCanonicalizationLimitError";constructor(){super("Path canonicalization work limit exceeded.")}}function Qr(){return{realpathAttempts:0,processedCandidateBytes:0,resolvedPaths:new Map}}function Ot(e){return{...Qr(),environment:e}}var Fi=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Gi(e,t){return $l(e,0,t)}function $l(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Ll(e,o+2),a=CR(e,o,t);if(a===null){if(Fi.has(s))throw new Se;r+=e.slice(o);break}let c=e.slice(o,a+1);r+=ER(c,t,n),o=a+1;continue}let i=Ll(e,o+1);if(!i){r+="$",o++;continue}r+=Wl(i,n)??`$${i}`,o+=i.length+1}return r}function CR(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>qn.maxEnvironmentExpansionDepth)throw new Se;o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function ER(e,t,n){let r=e.slice(2,-1),o=Ll(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Wl(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((l)=>i.startsWith(l));if(!s){if(Fi.has(o))throw new Se;return e}if(!Fi.has(o))return e;if(s.endsWith("="))throw new Se;let a=Wl(o,n),c=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!c)throw new Se;if(s.endsWith("-")||s.endsWith("?"))return c?a??"":$l(i.slice(s.length),t+1,n);return c?$l(i.slice(s.length),t+1,n):""}function Ll(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function X(e,t,n=Qr()){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){if(n.realpathAttempts++,n.processedCandidateBytes+=Buffer.byteLength(i),n.realpathAttempts>qn.maxRealpathAttempts||n.processedCandidateBytes>qn.maxProcessedCandidateBytes)throw new Se;let s=t.realpath(i);if(s!==null){let c=o.length===0?s:Ml(s,...o.reverse());return n.resolvedPaths.set(e,c),c}let a=xR(i);if(a===i){let c=o.length===0?i:Ml(i,...o.reverse());return n.resolvedPaths.set(e,c),c}if(o.length>=qn.maxMissingSuffixComponents){let c=Ml(i,...o.reverse());return n.resolvedPaths.set(e,c),c}o.push(SR(i)),i=a}}function Cy(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;if(n.realpathAttempts++,n.processedCandidateBytes+=Buffer.byteLength(e),n.realpathAttempts>qn.maxRealpathAttempts||n.processedCandidateBytes>qn.maxProcessedCandidateBytes)throw new Se;let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Wl(e,t){if(!Fi.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function N(e){return e.provenance==="command-substitution"?e.raw:e.text}function Kn(e,t){return e==="posix"?t:j(t.map((n)=>n.text))}function Zi(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function j(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}import{existsSync as jl,lstatSync as PR,readFileSync as Vi,realpathSync as no,statSync as to}from"fs";import{dirname as Ul,isAbsolute as Bl,join as Hi,resolve as qi}from"path";var Fl=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],wR=new Set(Fl);var Ey=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),ji=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),RR=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Gl(e){return wR.has(e)}function eo(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Zl(e){return Gl(e)||Ey.has(e)||ji.has(e)||eo(e)}function Ve(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Ui(e,t){let n=Ve("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=1024?{state:"valid",count:r}:{state:"invalid"}}function Bi(e,t,n){let o=e.match(RR)?.[1];if(!o||!Zl(o))return null;let i=e.indexOf("=");return{name:o,value:`${Ve(o,t,n)??""}${e.slice(i+1)}`}}function wy(e){return Py(e,ji)}function Ry(e){return Py(e,Ey)}function Py(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var He=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]);function Ty(e,t){return Fl.some((n)=>t?.has(n)||e.has(n))}function Iy(e,t){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let n;try{n=no(qi(t))}catch{return{gitCwd:null,hasExplicitGitContext:!1}}if(!Ny(n))return{gitCwd:null,hasExplicitGitContext:!1};let r=!1,o=1;while(o<e.length){let i=e[o];if(!i)break;if(i==="--")break;if(!i.startsWith("-"))break;if(i==="-C"){let s=e[o+1];if(!s)return{gitCwd:null,hasExplicitGitContext:r};let a=ky(n,s);if(!a)return{gitCwd:null,hasExplicitGitContext:r};n=a,o+=2;continue}if(i.startsWith("-C")&&i.length>2){let s=ky(n,i.slice(2));if(!s)return{gitCwd:null,hasExplicitGitContext:r};n=s,o++;continue}if(i==="--git-dir"||i==="--work-tree"){r=!0,o+=2;continue}if(i.startsWith("--git-dir=")||i.startsWith("--work-tree=")){r=!0,o++;continue}if(He.has(i))o+=2;else if(i.startsWith("-c")&&i.length>2)o++;else o++}return{gitCwd:n,hasExplicitGitContext:r}}function Oy(e){let t=GR(e);if(!t)return!1;try{let n=PR(t);if(n.isSymbolicLink()||!n.isFile())return!1;let r=Vl(t);if(!r?.commonDir)return!1;if(!TR(r.gitDir,t))return!1;return IR(r.gitDir,Ul(t))}catch{return!1}}function Vl(e){try{let t=AR(e);if(!t)return null;let n=no(Bl(t)?t:qi(Ul(e),t));if(!to(n).isDirectory())return null;return{gitDir:n,commonDir:kR(n)}}catch{return null}}function AR(e){let t=Vi(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function kR(e){try{let t=Vi(Hi(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=no(Bl(t)?t:qi(e,t));return to(n).isDirectory()?n:null}catch{return null}}function TR(e,t){let n=OR(e);return n===null?!1:zy(e,n,t)}function IR(e,t){let n=zR(e);return n===null?!0:zy(e,n,t)}function OR(e){let t=Hi(e,"gitdir");if(!jl(t))return null;let n=Vi(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function zR(e){let t=Hi(e,"config.worktree");return jl(t)?LR(t):null}function zy(e,t,n){return DR(NR(e,t),n)}function NR(e,t){return Bl(t)?t:qi(e,t)}function DR(e,t){try{return MR(e,t)}catch{return!1}}function MR(e,t){try{let n=to(e),r=to(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Ay(e)===Ay(t)}function Ay(e){return $R(no.native(e))}function $R(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"");if(t=t.replace(/\\/g,"/"),t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return process.platform==="win32"?t.toLowerCase():t}function LR(e){let t=Vi(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=WR(s[1]??"")}return r}function WR(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return FR(t.slice(1,-1))}function FR(e){let t="";for(let n=0;n<e.length;n++){let r=e[n];if(r!=="\\"){t+=r;continue}let o=e[n+1];if(o===void 0){t+=r;continue}switch(o){case"\\":case'"':t+=o;break;case"n":t+=`
-`;break;case"t":t+="\t";break;case"b":t+="\b";break;default:t+=`\\${o}`;break}n++}return t}function ky(e,t){try{let n=jt(e,t,Be);return Ny(n)?n:null}catch{return null}}function Ny(e){try{return to(e).isDirectory()}catch{return!1}}function GR(e){try{return ro(no(e))}catch{return null}}function ro(e){let t=e;while(!0){let n=Hi(t,".git");if(jl(n))return n;let r=Ul(t);if(r===t)return null;t=r}}function Hl(e,t){return{value:e,work:t}}function x(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function ue(e){return e.value.length}function oo(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ne(e,t){oo(e,t)}function gn(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function ae(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function ql(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function ce(e,t,n){if(t+n.length>ue(e))return!1;for(let r=0;r<n.length;r++)if(x(e,t+r)!==n[r])return!1;return!0}function zt(e,t,n){return!gn(x(e,t-1))&&ce(e,t,n)&&!gn(x(e,t+n.length))}function Nt(e,t){return gn(x(e,t-1))!==gn(x(e,t))}function he(e){return e===`
-`||e===";"||e==="&"||e==="|"}function Yn(e){return e==="|"||e===";"}function Ki(e,t,n){let r=Hl(e,n);if(t==="rm")return ZR(r);if(t==="dd")return UR(r);return Fy(r,!0)}function Yi(e,t,n){let r=Hl(e,n);if(t==="rm")return BR(r);if(t==="reset-hard")return Ly(r,"--ha","rd");if(t==="reset-merge")return Ly(r,"--me","rge");if(t==="clean")return KR(r);if(t==="checkout")return JR(r);if(t==="push-force")return XR(r);if(t==="push-refspec")return QR(r);if(t==="push-delete")return eP(r);if(t==="branch")return tP(r);if(t==="tag")return oP(r);if(t==="restore")return iP(r);return Fy(r,!1)}function ZR(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=ue(e);i++){let s=x(e,i);if(!t){let c=x(e,i+2);if(zt(e,i,"rm")&&ae(c)&&c!==`
-`)t=!0,i++;continue}let a=jR(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===ue(e)){if(o>=0){let c=Dy(e,o,i);n||=c.recursive,r||=c.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(ae(s)){if(o>=0){if(ce(e,o,"--")&&i-o===2)t=!1,n=!1,r=!1;else{let c=Dy(e,o,i);if(n||=c.recursive,r||=c.force,n&&r)return!0}o=-1}continue}if(o<0)o=i}return!1}function jR(e,t){if(x(e,t)!=="\\"||x(e,t-1)==="\\")return-1;if(ce(e,t,String.raw`\n`))return t+2;if(ce(e,t,String.raw`\x0a`)||ce(e,t,String.raw`\x0A`))return t+5;if(ce(e,t,String.raw`\u000a`)||ce(e,t,String.raw`\u000A`))return t+7;return ce(e,t,String.raw`\012`)?t+4:-1}function Dy(e,t,n){if(My(e,t,n,"recursive"))return{recursive:!0,force:!1};if(My(e,t,n,"force"))return{recursive:!1,force:!0};if(x(e,t)!=="-"||x(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=x(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function My(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!ce(e,t,"--"))return!1;for(let i=0;i<o;i++)if(x(e,t+i+2)!==r[i])return!1;return!0}function UR(e){let t=!1;for(let n=0;n<ue(e);n++){if(he(x(e,n))){t=!1;continue}if(zt(e,n,"dd")){t=!0,n++;continue}if(!t||!zt(e,n,"of")||!ce(e,n,"of=/dev/"))continue;let r=n+8;if(r<ue(e)&&!ae(x(e,r))&&x(e,r)!=="'"&&x(e,r)!=='"')return!0}return!1}function BR(e){let t=!1,n=!1,r=!1;for(let o=0;o<=ue(e);){let i=x(e,o);if(o===ue(e)||he(i)){t=!1,n=!1,r=!1,o++;continue}let s=HR(e,o);if(s>=0){if(VR(e,s))return!0;let a=s,c=!1;while(ae(x(e,a)))c||=x(e,a)===`
-`,a++;if(c)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(ce(e,o,"--")&&(o===0||ae(x(e,o-1)))&&(!x(e,o+2)||ae(x(e,o+2))||he(x(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=ce(e,o,"--recursive")&&Nt(e,o+11)||Kl(e,o,"recursive"),r||=ce(e,o,"--force")&&Nt(e,o+7)||Kl(e,o,"force"),n&&r)return!0;o++}return!1}function Kl(e,t,n){if(!ce(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=x(e,t+r+2);if(!o||ae(o)||he(o))break;if(o!==n[r])return!1;r++}return r>0&&Nt(e,t+r+2)}function VR(e,t){let n=t,r=!1,o=!1;while(n<ue(e)){while(ae(x(e,n)))n++;let i=n;while(n<ue(e)&&!ae(x(e,n)))n++;if(x(e,i)!=="-"||n-i===2&&ce(e,i,"--"))return!1;let s=$y(e,i,"recursive"),a=$y(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,x(e,i+1)==="-")continue;let c=qR(e,i,n);if(c.combined||r&&c.forceAtBoundary||o&&c.recursiveAtBoundary)return!0;r||=c.recursive,o||=c.force}return!1}function $y(e,t,n){return ce(e,t,`--${n}`)&&Nt(e,t+n.length+2)||Kl(e,t,n)}function HR(e,t){if(t>0&&gn(x(e,t-1)))return-1;let n=t;if(x(e,n)==="\\")n++;if(x(e,n)!=="r")return-1;if(n++,x(e,n)==="\\")n++;if(x(e,n)!=="m"||!ae(x(e,n+1)))return-1;return n+1}function qR(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(x(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let c="";for(let l=t+1;l<n;l++){let u=x(e,l)??"",d=(u==="r"||u==="f")&&Nt(e,l+1);r||=u==="r",o||=u==="f",i||=u==="r"&&d,s||=u==="f"&&d,a||=(c==="r"&&u==="f"||c==="f"&&u==="r")&&d,c=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Ly(e,t,n){return so(e,"reset",Yn,!0,(r)=>x(e,r)==="-"&&Jn(e,r,t,n)?!0:r)}function KR(e){return so(e,"clean",Yn,!0,(t)=>{if(x(e,t)!=="-")return t;if(Jn(e,t,"--fo","rce"))return!0;let n=io(e,t,Yn);for(let r=t+1;r<n;r++)if(x(e,r)==="f")return!0;return n-1})}function Ji(e,t,n){if(!zt(e,t,"git"))return null;let r=t+3;if(!ae(x(e,r)))return{commandEnd:-1,next:r};while(ae(x(e,r)))r++;while(r<ue(e)){if(he(x(e,r)))return{commandEnd:-1,next:r};let o=io(e,r,he);if(zt(e,r,n))return{commandEnd:r+n.length,next:o};if(x(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&ce(e,r,"--"),s=YR(e,r,o);r=o;while(ae(x(e,r)))r++;if(i)return{commandEnd:zt(e,r,n)?r+n.length:-1,next:io(e,r,he)};if(!s)continue;if(r>=ue(e)||he(x(e,r)))return{commandEnd:-1,next:r};r=io(e,r,he);while(ae(x(e,r)))r++}return{commandEnd:-1,next:r}}function YR(e,t,n){for(let r of He)if(n-t===r.length&&ce(e,t,r))return!0;return!1}function JR(e){return Wy(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function XR(e){return so(e,"push",Yn,!0,(t)=>{if(x(e,t)!=="-")return t;if(x(e,t+1)==="f"&&!gn(x(e,t+2))&&!ce(e,t+2,"-with-lease"))return!0;let n=Gy(e,t,"--fo","rce");if(n>=0&&!ce(e,n,"-with-lease"))return!0;return t})}function QR(e){return so(e,"push",he,!1,(t)=>{if(ae(x(e,t))&&x(e,t+1)==="+"&&t+2<ue(e)&&!he(x(e,t+2))&&!ae(x(e,t+2)))return!0;if(x(e,t)===":"&&x(e,t+1)==="+")return!0;return t})}function eP(e){return so(e,"push",he,!1,(t)=>{if(x(e,t)==="-"&&Jn(e,t,"--de","lete"))return!0;if(ae(x(e,t))&&x(e,t+1)===":"&&t+2<ue(e)&&!ae(x(e,t+2))&&!he(x(e,t+2)))return!0;return t})}function tP(e){let t=!1,n=!1,r=!1;for(let o=0;o<=ue(e);o++){if(o===ue(e)||he(x(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Ji(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||x(e,o)!=="-")continue;let i=io(e,o,he),s=nP(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function nP(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(x(e,i)!=="-")continue;if(Jn(e,i,"--de","lete"))r=!0;if(Jn(e,i,"--fo","rce"))o=!0;if(x(e,i+1)==="-")continue;let s=i+1,a=!1,c=!1,l=!1;while(s<n&&rP(x(e,s))){let u=x(e,s);a||=u==="d"||u==="D",c||=u==="f",l||=u==="D",s++}if(!Nt(e,s))continue;r||=a,o||=c||l}return{deletion:r,force:o}}function rP(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function oP(e){return Wy(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Wy(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<ue(e);r++){let o=x(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&x(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(ae(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Ji(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&ae(x(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(Jn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(x(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Nt(e,r+1))return!0;if(Yn(o))i.outerActive=!1}return!1}function so(e,t,n,r,o){let i=!1;for(let s=0;s<ue(e);s++){let a=x(e,s),c=n(a);if(!i&&!c){let l=Ji(e,s,t);if(l){i=l.commandEnd>=0&&(!r||ae(x(e,l.commandEnd))),s=Math.max(s,(i?l.commandEnd:l.next)-1);continue}}if(i){let l=o(s);if(l===!0)return!0;for(let u=s;u<=l;u++)if(n(x(e,u)))i=!1;s=l}if(c)i=!1}return!1}function iP(e){let t=!1;for(let n=0;n<ue(e);n++){if(ql(x(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Ji(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&x(e,n)==="-"&&x(e,n+1)==="-"&&(ce(e,n+2,"staged")||ce(e,n+2,"help")))t=!1}return t}function Fy(e,t){let n=!1;for(let r=0;r<ue(e);r++){let o=x(e,r),i=t?ql(o):he(o);if(n&&ae(o)&&x(e,r+1)==="-"&&zt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(zt(e,r,"find"))n=!0,r+=3}return!1}function io(e,t,n){let r=t;while(r<ue(e)&&!ae(x(e,r))&&!n(x(e,r)))r++;return r}function Gy(e,t,n,r){if(!ce(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&x(e,o)===r[i];i++)o++;return Nt(e,o)?o:-1}function Jn(e,t,n,r){return Gy(e,t,n,r)>=0}var Zy=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],ao=new Set(Zy.map((e)=>e.id)),Xi=Zy,sP=new Map(Xi.map((e)=>[e.id,e.intent])),jy=new Set(Xi.filter((e)=>e.catastrophic).map((e)=>e.id));function v(e,t){return{id:e,reason:t,intent:sP.get(e)??"manual_only"}}function z(e,t){if(!e)return null;if(jy.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function de(e,t,n){if(jy.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Uy(e,t){return Object.freeze(Object.fromEntries(Xi.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function By(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Uy(e,t)})}function Dt(e,t){oo(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ne(t,a);if((s.regex?.test(a)??!1)||s.scan&&Yi(a,s.scan,t))return v("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var aP=/^[A-Za-z_][A-Za-z0-9_]*=/;function Hy(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;oo(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return qy(t.nodes,r,i)}function qy(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return qy(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return cP(r,t,n)})}function cP(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!aP.test(o.text));return e.words.every((o,i)=>o===t||Vy(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Vy(o.target.raw,n.anchored,!0)))}function Vy(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}var Ky=Object.freeze({maxDerivedTokens:16384}),Yy="Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry.";class De extends Error{constructor(){super("Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry.");this.name="DerivedCommandWorkLimitError"}}function Qi(){return{derivedTokens:0}}function et(e,t){if(!Number.isSafeInteger(e.derivedTokens)||e.derivedTokens<0||e.derivedTokens>Ky.maxDerivedTokens||!Number.isSafeInteger(t)||t<0||t>Ky.maxDerivedTokens-e.derivedTokens)throw new De;e.derivedTokens+=t}import{isAbsolute as lP,resolve as Jy}from"path";var Xy=64;function co(e,t,n){let r=lP(e)?Jy(e):t?Jy(t,e):void 0;if(!r)return;try{return X(r,n)}catch{return r}}function Qy(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}function H(e){return F(e).toLowerCase()}function F(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}var es=10,Xn=20,hn=/^[a-zA-Z][a-zA-Z0-9_-]*$/,Qn=256,me=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),eb=new Set(["python","python3","python2","node","ruby","perl"]),tb=/^python(?:[23](?:\.\d+)*)?$/,ts=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var yn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",er="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",ns=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),uP=new Set(["-p","--print"]),dP=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),mP=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),fP=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),pP=new Map([["python",new Set(["m"])]]),gP=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),hP=new Set(["always","default","never"]),yP=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),bP=/\\\r?\n/g,vP=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function rs(e){return is(e).code}function os(e){return is(e).sources}function rb(e){return vP.get(as(e))??[]}function is(e){let t=as(e[0]??"");if(!ns.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return tt(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return tt(t,n,r,o,i,s);if(t==="node"&&uP.has(s)){let d=e[i+1];if(d===void 0)return tt(t,n,r,o);if(d.startsWith("-"))continue;n.push({tokenIndex:i+1,value:d}),r.push({tokenIndex:i+1,kind:"inline-code",value:d}),i++;continue}if(SP(t,s)){let d=e[i+1];if(d===void 0)return tt(t,n,r,o);if(n.push({tokenIndex:i+1,value:d}),r.push({tokenIndex:i+1,kind:"inline-code",value:d}),t==="python")return tt(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(xP(t)&&a){let d=a[1]??"";n.push({tokenIndex:i,value:d}),r.push({tokenIndex:i,kind:"inline-code",value:d});continue}if(t==="node"){let d=_P(s);if(d){if(d.attached){if(o&&=d.value!=="",d.value!=="")r.push({tokenIndex:i,kind:"module-file",value:d.value});continue}let m=e[i+1];if(m===void 0||m.startsWith("-"))return o=!1,tt(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:m}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return tt(t,n,r,o);if(gP.get(t)?.has(s)){let d=e[i+1];if(d===void 0||d.startsWith("-")&&!(t==="ruby"&&yP.has(s))||t==="python"&&!hP.has(d))return tt(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let c,l=!1;for(let d=1;d<s.length;d++){let m=s[d];if(m===void 0)break;if(pP.get(t)?.has(m)){let f=s.slice(d+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return tt(t,n,r,o)}if(dP.get(t)?.has(m)){c=s.slice(d+1)||e[i+1],l=d+1===s.length;break}if(t==="node"&&m==="r"){if(s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}else o=!1;break}if(t==="ruby"&&m==="r"){let f=s.slice(d+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(m==="M"||m==="m")){let f=s.slice(d+1);if(f)r.push({tokenIndex:i,kind:"module-file",value:f});else if(o=!1,d+1===s.length)i++;break}if(mP.get(t)?.has(m)){if(d+1===s.length)i++;break}if(fP.get(t)?.has(m)&&d+1<s.length)break}if(c===void 0)continue;let u=l?i+1:i;if(n.push({tokenIndex:u,value:c}),r.push({tokenIndex:u,kind:"inline-code",value:c}),t==="python")return tt(t,n,r,o);if(l)i++}return tt(t,n,r,o,void 0,void 0,!0)}function tt(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,c=new Set(a.map((u)=>u.tokenIndex)),l=n.filter((u)=>u.kind!=="inline-code"||c.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)l.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
-`))||null,sources:r?l:[],optionsOpen:r&&s}}function _P(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Me(e){return ns.has(as(e))}function ss(e,t){return as(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function as(e){let t=F(e).toLowerCase();return tb.test(t)?"python":t}function SP(e,t){return ns.get(e)?.has(t)??!1}function xP(e){return ns.get(e)?.has("--eval")??!1}function tr(e,t){let n=wP(e,t);if(!nb(n,t))return!1;Ne(t,n);let r=EP(n);if(nb(r,t))return!0;return Ne(t,r),CP.test(r)}var CP=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function EP(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function nb(e,t){if(Ki(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ne(t,e),r.test(e))return!0;if(Ki(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ne(t,e),r.test(e))return!0;if(Ki(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ne(t,e),n.some((o)=>Yi(o,r))))}function wP(e,t){return Ne(t,e),e.replace(bP,"")}var q=Object.freeze({maxChildAnalyses:1024,maxDerivedTokens:16384,maxDerivedBytes:1048576,maxPlaceholderReplacements:16384}),ob="Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry.";class ls extends Error{constructor(){super("Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry.");this.name="ParallelAnalysisLimitError"}}function ib(){return{childAnalyses:0,derivedTokens:0,derivedBytes:0,placeholderReplacements:0}}function $e(e,t){let n=t.childAnalyses??0,r=t.derivedTokens??0,o=t.derivedBytes??0,i=t.placeholderReplacements??0;if(cs(e.childAnalyses,n,q.maxChildAnalyses)||cs(e.derivedTokens,r,q.maxDerivedTokens)||cs(e.derivedBytes,o,q.maxDerivedBytes)||cs(e.placeholderReplacements,i,q.maxPlaceholderReplacements))throw new ls;e.childAnalyses+=n,e.derivedTokens+=r,e.derivedBytes+=o,e.placeholderReplacements+=i}function cs(e,t,n){return!Number.isSafeInteger(e)||e<0||e>n||!Number.isSafeInteger(t)||t<0||t>n-e}import{isAbsolute as Pu,normalize as Bk,parse as Vk,posix as Cv,resolve as ar,sep as Ru}from"path";import{isAbsolute as RP,join as sb,normalize as lb,parse as PP,sep as ab}from"path";var AP=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],kP=` 	
-`;function lo(e,t){if(pt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Yl(e.get("TMPDIR")??"",t)}function Mt(e,t){if(e.has("TMPDIR"))return Yl(e.get("TMPDIR")??"",t);let n=Jl(e,t);if(n===void 0)return!0;return Yl(n,t)}function Jl(e,t){return mb(e,t,"TMPDIR")}function Yl(e,t){if(!e)return!1;if(IP(e))return!1;return Xl(e,t)}function pt(e,t){let n=mb(e,t,"IFS");return n!==void 0&&n!==""&&n!==kP}function Xl(e,t){let n=us(e,t.paths);if(n===null)return!1;return db(t).some((r)=>zP(n,r))}function ub(e,t){let n=us(e,t.paths);if(n===null)return!1;return db(t).some((r)=>ds(r)===ds(n))}var cb=new WeakMap;function db(e){let t=cb.get(e);if(t)return t;let n=TP(e);return cb.set(e,n),n}function TP(e){let t=AP.map((r)=>us(r,e.paths)??lb(r)),n=us(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&OP(n))return[...t,n];return t}function IP(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function mb(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function OP(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function us(e,t){try{let n=lb(e);if(!RP(n))return n;let r=PP(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=sb(i,o[s]??"");if(t.entryKind(a)==="missing")return sb(a,...o.slice(s+1));let c=t.realpath(a);if(c===null)return null;i=c}return i}catch{return null}}function zP(e,t){let n=ds(e),r=ds(t);if(n===r)return!0;let o=r.endsWith(ab)?r:`${r}${ab}`;return n.startsWith(o)}function ds(e){return process.platform==="win32"?e.toLowerCase():e}import{statSync as Tk}from"fs";import{isAbsolute as pv,join as Ik,relative as gv}from"path";import{isAbsolute as fb,parse as NP}from"path";var gb=/^[A-Za-z_][A-Za-z0-9_]*=/;function qe(e){if(!gb.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function ms(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=qe(N(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function hb(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function bn(e,t,n,r){if(!hb(nr(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),c=[],l=n;for(let d=0;d<Xn;d++){let m=pb(i),f=ms(i);for(let[h,y]of f.envAssignments)s.set(h,y),a.set(h,y);if(i=f.words,i.length===0)break;while(i.length>0&&nr(i).includes("=")&&!MP(i)){let h=$P(nr(i),a,t.env)??Bi(nr(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=nr(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=WP(i,t.paths,l);if(i=h.words,h.cwd!==void 0)l=h.cwd}if(p==="env"){let h=ZP(i,l,a,t);if(c.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)l=h.cwd;for(let[y,b]of h.envAssignments)s.set(y,b),a.set(y,b)}if(p==="command")i=jP(i);if(p==="builtin")i=i.slice(nt(i,1)==="--"?2:1);if(pb(i)===m)break}let u=ms(i);for(let[d,m]of u.envAssignments)s.set(d,m),a.set(d,m);return{words:u.words,envAssignments:s,cwd:l,envSplitValues:c.length>0?c:void 0,rewritten:DP(u.words,o)}}function DP(e,t){return e.some((n)=>!t.has(n))}function pb(e){return e.map(N).join(" ")}function nr(e){let t=e[0];return t?N(t):""}function nt(e,t){let n=e[t];return n?N(n):void 0}function MP(e){return gb.test(nr(e))}function $P(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var LP=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function WP(e,t,n){let r=1,o=n;while(r<e.length){let i=nt(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=nt(e,r+1);o=s?uo(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=uo(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=uo(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(LP.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var FP=new Set(["-i","-0","--null"]),GP=new Set(["-u","--unset","-C","--chdir","-P"]);function ZP(e,t,n,r){let o=new Map,i=[],s=t,a=1,c=(l)=>({words:e.slice(l),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let l=nt(e,a);if(!l)break;if(l==="--")return c(a+1);if(l==="-i"||l==="--ignore-environment"||l==="-"){o.clear();for(let d of n.keys())o.set(d,"");o.set("TMPDIR",""),a++;continue}if(FP.has(l)){a++;continue}if(l==="-u"||l==="--unset"){let d=nt(e,a+1);if(d!==void 0)o.set(d,"");a+=2;continue}if(l.startsWith("-u")&&l.length>2&&!l.startsWith("-u=")){o.set(l.slice(2),""),a++;continue}if(l.startsWith("--unset=")){o.set(l.slice(8),""),a++;continue}let u=l==="-S"||l==="--split-string"?{value:nt(e,a+1),consumed:2}:l.startsWith("-S")&&l.length>2?{value:l.slice(2),consumed:1}:l.startsWith("--split-string=")?{value:l.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,c(a+u.consumed)}if(GP.has(l)){if(l==="-C"||l==="--chdir"){let d=nt(e,a+1);s=d?uo(s,d,r.paths):null}a+=2;continue}if(l.startsWith("-u=")){a++;continue}if(l.startsWith("-C")&&l.length>2||l.startsWith("--chdir=")){let d=l.startsWith("--chdir=")?l.slice(8):l.startsWith("-C=")?l.slice(3):l.slice(2);s=uo(s,d,r.paths),a++;continue}if(l.startsWith("-P")){a++;continue}if(l.startsWith("-")){a++;continue}if(!qe(l))break;while(a<e.length){let d=qe(nt(e,a)??"");if(!d)break;o.set(d.name,d.value),a++}if(nt(e,a)==="--")a++;return c(a)}return c(a)}function uo(e,t,n){if(t==="")return null;if(!e&&!fb(t))return null;let r=fb(t)?NP(t).root:n.realpath(e??"/");if(r===null)return null;try{return jt(r,t,n)}catch{return null}}function jP(e){if(nt(e,1)==="-v")return[...j(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=nt(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var UP=/['"\\$`{}#]/;function fs(e,t){if(e.some((r)=>UP.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function Bt(e,t,n){return ps(e,t,n).tokens}function BP(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Vt(e,t,n,r=0){let o=ps(e,t,n),i=(o.envSplitValues??[]).flatMap(BP);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Vt(s,t,n,r+1)}function ps(e,t,n,r){if(!hb(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=bn(j(e),t,n,r);return{tokens:o.words.map(N),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}import{basename as Ek,isAbsolute as wk,normalize as Rk,resolve as uv}from"path";function gs(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function VP(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>Re(t)))})}function hs(e,t,n){e.push(n),t.reset()}function HP(e,t,n,r,o){if(r<=n)return;e.push({raw:t.slice(n,r),span:{start:n,end:r},provenance:o})}function ys(e){let t=[];return{parts:t,push:(n,r,o)=>HP(t,e,n,r,o)}}function Ql(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function rr(e,t,n,r,o,i,s){return Ql({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function Re(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t,span:Object.freeze(t.span)}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return VP(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:Re(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function eu(e,t,n){if(t>=n||bb(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!bb(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let c=yb(e,s+1,n,"'");r+=c.text,i||=!c.closed,s=c.next;continue}if(a==='"'){o=!0;let c=yb(e,s+1,n,'"');r+=c.text,i||=!c.closed,s=c.next;continue}if(a==="\\"){o=!0;let c=e[s+1];if(!c||c===`
-`||c==="\r"){i=!0;break}r+=c,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,span:{start:t,end:s},ambiguous:i}}function tu(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,c=!1;while(i<n){let l=qP(e,i,n);if((s.stripTabs?l.text.replace(/^\t+/,""):l.text)===s.delimiter){s.attach({body:s.stripTabs?KP(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:l.contentEnd}}),i=l.next,c=!0;break}if(l.next<=i)break;i=l.next}if(c)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`,span:s.declarationSpan}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function yb(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function bb(e){return/[\s;&|<>)]/u.test(e)||e==="`"}function qP(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)}function dl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence.find((r)=>r.kind==="command"):void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function Tr(e={}){return{reason:In,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function ml(e){return xp({...e,redact:ct})}function fl(e){return ct(e instanceof Error?e.message:String(e))}import{lstatSync as cg,realpathSync as ug,statSync as dg}from"fs";import{homedir as mg,tmpdir as fg}from"os";import{statSync as sg}from"fs";import{join as ag}from"path";import{basename as hl,dirname as _p,isAbsolute as wp,join as Ap,normalize as Pp,resolve as pl}from"path";var Tp=256,Ir=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function be(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Ze(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function xi(e,t){return vi(e,0,t)}function vi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Ei(e,o+2),a=Ip(e,o,t);if(a===null){if(Ir.has(s))throw new F("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=kp(l,t,n),o=a+1;continue}let i=Ei(e,o+1);if(!i){r+="$",o++;continue}r+=Ri(i,n)??`$${i}`,o+=i.length+1}return r}function Ip(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>P.pathEnvironmentExpansion.cap)throw new F("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function kp(e,t,n){let r=e.slice(2,-1),o=Ei(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Ri(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Ir.has(o))throw new F("pathEnvironmentExpansion");return e}if(!Ir.has(o))return e;if(s.endsWith("="))throw new F("pathEnvironmentExpansion");let a=Ri(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new F("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":vi(i.slice(s.length),t+1,n);return l?vi(i.slice(s.length),t+1,n):""}function Ei(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Ri(e,t){if(!Ir.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function B(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){yl(n,i);let s=t.realpath(i);if(s!==null)return gl(n,e,s,o);let a=_p(i);if(a===i||o.length>=Tp)return gl(n,e,i,o);o.push(hl(i)),i=a}}function gl(e,t,n,r){let o=r.length===0?n:Ap(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Op(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;yl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function yl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ie(e,t,n,r){let o=Cl(e,t,n);if(!o)return"";return B(o,n.paths,r).replace(/\\/g,"/")}function Sl(e,t,n,r,o){let i=Cl(e,t,n);if(!i)return null;if(o(hl(i)))return B(i,n.paths,r).replace(/\\/g,"/");let s=Op(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Cl(e,t,n){let r=n.home,o=xi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?pl(r,o.slice(2)):o,s=be(i);return Pp(wp(s)?s:pl(t,s))}import{spawnSync as Mp}from"child_process";import{existsSync as nn,lstatSync as Dp,readFileSync as wt,realpathSync as tn,statSync as kn}from"fs";import{dirname as kr,isAbsolute as On,join as _t,resolve as rn}from"path";var Np=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Lp=5000;function vl(e,t=Qp(),n=Lp){let r=Wp(e);if(r===null||!Fp(r))return null;let o=Xp(r,t,n);return o===null?null:{recursiveSubmodules:o}}function Wp(e){try{let t=tn(rn(e));return kn(t).isDirectory()?t:null}catch{return null}}function Fp(e){let t=Zp(e);if(!t)return!1;try{let n=Dp(t);if(n.isSymbolicLink()||!n.isFile())return!1;let r=_i(t);if(!r?.commonDir)return!1;if(!Bp(r.gitDir,t))return!1;return $p(r.gitDir,kr(t))}catch{return!1}}function _i(e){try{let t=Gp(e);if(!t)return null;let n=tn(On(t)?t:rn(kr(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:zp(n)}}catch{return null}}function Gp(e){let t=wt(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function zp(e){try{let t=wt(_t(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=tn(On(t)?t:rn(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function Bp(e,t){let n=Up(e);return n===null?!1:El(e,n,t)}function $p(e,t){let n=Hp(e);return n===null?!0:El(e,n,t)}function Up(e){let t=_t(e,"gitdir");if(!nn(t))return null;let n=wt(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Hp(e){let t=_t(e,"config.worktree");return nn(t)?Vp(t):null}function El(e,t,n){try{return jp(On(t)?t:rn(e,t),n)}catch{return!1}}function jp(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return bl(tn.native(e))===bl(tn.native(t))}function bl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Vp(e){let t=wt(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Kp(s[1]??"")}return r}function Kp(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Yp(t.slice(1,-1))}var qp={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function Yp(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:qp[n]??t)}function Zp(e){try{return Or(tn(e))}catch{return null}}function Or(e){let t=e;while(!0){let n=_t(t,".git");if(nn(n))return n;let r=kr(t);if(r===t)return null;t=r}}function Xp(e,t,n){let r=Jp(e);if(r===null||r)return!0;if(t===null)return!0;let o=Mp(t,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:eg(process.env),stdio:["ignore","pipe","ignore"],timeout:n});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Rl(o.stdout.trim())}function Jp(e){let t=tg(e);if(t===null)return null;return t.filter((n)=>nn(n)).some((n)=>og(n))}function Qp(){return Np.find((e)=>nn(e))??null}function Mn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function eg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Mn(t)))}function tg(e){let t=Or(e);if(t===null)return null;let n=ng(t);if(n===null)return null;let r=rg(n);if(r===null)return null;return[_t(r,"config"),_t(n,"config.worktree")]}function ng(e){try{let n=wt(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!n.startsWith("gitdir:"))return e;let r=n.slice(7).trim();if(r==="")return null;return On(r)?r:rn(kr(e),r)}catch{return null}}function rg(e){let t=_t(e,"commondir");if(!nn(t))return e;try{let n=wt(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(n==="")return null;return On(n)?n:rn(e,n)}catch{return null}}function og(e){let t;try{t=wt(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(ig(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Rl(c)}return r}function ig(e){return e==="include"||e.startsWith("includeif ")}function Rl(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function xl(e,t){if(e==="")return null;let n=Ce(),r=Or(ie(e,e,t,n)),o=r?lg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function lg(e,t,n,r){try{let o=ie(e,t,n,r),i=sg(e),s=i.isFile()?o:null,a=i.isFile()?_i(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((d)=>d?[on(ie(d,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[on(e.replace(/\\/g,"/")),...l]:l)];return{entry:on(o),markerFile:s?on(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((d)=>{let m=on(ag(d,"hooks").replace(/\\/g,"/"));return[m,on(ie(m,t,n,r))]}))]}}catch{return null}}function on(e){return process.platform==="win32"?e.toLowerCase():e}var pg={realpath:(e)=>{try{return ug(e)}catch{return null}},entryKind:(e)=>{let t=cg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return dg(e).isDirectory()}catch{return!1}}};function wl(){return gg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:be(process.env.HOME||mg()),tmpdir:fg(),paths:pg})}function gg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>_l(n,i,()=>xl(i,o)),worktreeFacts:(i)=>_l(r,i,()=>vl(i)),...t};return o}function _l(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var sn=["fail_closed","paranoid_rm","paranoid_interpreters"],Mr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ee={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Dr=["standard","strict","paranoid"];function hg(e,t){if(!t)return e;return Dr.indexOf(t)>Dr.indexOf(e)?t:e}function yg(e){let t=Ti(ee.level,e);if(t===void 0||t==="")return;if(Dr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${ee.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Dr.join(", ")}.`);return}function Sg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Al(e){return Sg(Ti(ee.auditScope,e))==="all"}function Ai(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Pi(e={},t){let n=e.safety?.level??"standard",r=yg(t),o=hg(n,r),i=Mr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ee.level.name}=${r}`),l.paranoidRm.push(`env ${ee.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ee.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(At(ee.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ee.strict.name}`);if(At(ee.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ee.paranoid.name}`),l.paranoidInterpreters.push(`env ${ee.paranoid.name}`);if(At(ee.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ee.paranoidRm.name}`);if(At(ee.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ee.paranoidInterpreters.name}`);let c=!!e.worktreeMode||At(ee.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Ai(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function At(e,t){let n=typeof e==="string"?wi(e,t):Ti(e,t);return n==="1"||n?.toLowerCase()==="true"}function wi(e,t){return t.get(e)}function Ti(e,t){let n=wi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return wi(e.legacyName,t);return}import{types as Cg}from"util";var bg=new Set(["applypatch","patch"]),vg=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Eg=new Set(["grep","grepsearch","rg"]),Rg=new Set(["find","findbyname","glob"]),xg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),_g=new Set(["command","diff","input","patch","patchtext"]),Pl=new TextEncoder,wg=new TextDecoder,Ag=/\s/,Pg=64;class Xe extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Dn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Ml(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Lr(e){return xg.has(Ml(e))}function Mi(e){let t=Ml(e);if(bg.has(t))return"patch";if(Eg.has(t))return"grep";if(Rg.has(t))return"glob";if(vg.has(t))return"path";return"unknown"}function Ln(e){if(!e||typeof e!=="object")return;zl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ve();return}if(t.get||t.set)Ve();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Dl(e,t){return Nl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Nl(e,t,n,r){let o=Gl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Nl(a,t,n,r+1);return typeof a==="string"&&t.has(Ll(s))?[a]:l});return n.ancestors.delete(o.object),i}function Ll(e){return e.replace(/-/g,"_").toLowerCase()}function Wl(e){return Fl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Ig)}function Fl(e,t,n,r){let o=Gl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Fl(a,o.array?t:_g.has(Ll(s)),n,r+1));return n.ancestors.delete(o.object),i}function Tg(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Dn.maxDepth||t.nodes>Dn.maxNodes)Ve();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Dn.maxStringBytes||t.stringBytes>Dn.maxAggregateStringBytes)Ve()}function Gl(e,t,n){if(Tg(e,t,n),!e||typeof e!=="object")return null;let r=zl(e);if(t.ancestors.has(e))Ve();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Dn.maxKeys)Ve();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ve();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function zl(e){if(Cg.isProxy(e))Ve();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ve();return t}function Ve(){throw new Xe}function Ig(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let d=kg(c);if(o=!0,i=d?.oldLines??null,s=d?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let d=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-d),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ii(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ii(c));continue}if(c.startsWith("--- ")){let d=n[l+1]??"";if(!d.startsWith("+++ "))continue;t.push(...Oi(Nr(c.slice(4),!0),Nr(d.slice(4),!0))),l++;continue}if(!r)t.push(...Ii(c))}return t}function kg(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ii(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Ol(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Ol(n[1]);if(e.startsWith("diff --git "))return Og(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return kl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return kl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Gg(i[1]);return[]}function Og(e){let t=Mg(e);if(t.length===2&&t[0]&&t[1])return Oi(t[0],t[1]);let n=Dg(e);return n?Oi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Mg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Pt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Pt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Bl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Pt(e[n]))n++;return n===e.length?t:[]}function Dg(e){let t=0;while(t<e.length&&Pt(e[t]))t++;let n=e.length;while(n>t&&Pt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Pt(e[o])){o++;continue}let i=o;while(o<n&&Pt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Pg)Ve();if(Ng(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Ng(e,t,n,r,o){if(ki(e,t,n,r,o))return!0;let i=Tl(e,"/",t,n),s=Tl(e,"/",r,o);if(i<=t||s<=r)return!1;if(ki(e,t,i,r,s))return!1;return ki(e,i+1,n,s+1,o)}function ki(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Tl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Pt(e){return e!==void 0&&Ag.test(e)}function Bl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:wg.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Pl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Pl.encode(Lg(s[0]??""))),o+=2}return null}function Lg(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function Wg(e){return Nn(zg(e))}function Oi(e,t){if(e==="/dev/null")return Il(t);if(t==="/dev/null")return Il(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Nn);let n=Fg(e,t)??(e===t?$l(e):null);return[e,t,...n?[n]:[]].flatMap(Nn)}function Il(e){let t=$l(e);return[e,...t?[t]:[]].flatMap(Nn)}function $l(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Fg(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function kl(e){return Wg(Nr(e,!0))}function Gg(e){return Nn(Nr(e,!1))}function Nr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Bl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function zg(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Nn(e){return e===""||e==="/dev/null"?[]:[e]}function Ol(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Ni,relative as $g,resolve as Ul,sep as Ug}from"path";function Hl(e,t,n){if(Ze(e))return;let r=t.flatMap((i)=>Di(i,n));if(!r[0])return;let o=Di(Ni(e)?e:Ul(r[0],e),n)[0];if(!o)return;return r.some((i)=>Hg(o,i))?o:void 0}function jl(e,t,n){if(Ze(e))return;return Di(Ni(e)?e:Ul(t,e),n)[0]}function Di(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Hg(e,t){let n=$g(t,e);return n===""||n!==".."&&!n.startsWith(`..${Ug}`)&&!Ni(n)}function an(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{dirname as Vr}from"path";import{closeSync as Vg,constants as Vl,fstatSync as Kg,fsyncSync as pP,lstatSync as Wi,mkdirSync as gP,openSync as qg,readdirSync as hP,readFileSync as Yg,realpathSync as Wr,renameSync as yP,rmdirSync as SP,statSync as Zg,unlinkSync as CP,writeFileSync as bP}from"fs";import{isAbsolute as Kl,join as ql,normalize as Xg,parse as Jg,relative as Fi,resolve as Gi,sep as zi}from"path";function Li(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Qg=Symbol("PolicyFilesystemScope"),eh=Symbol("PolicyFilesystemTarget"),th=Vl.O_NOFOLLOW??0;class se extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function Tt(e,t){return{[Qg]:!0,root:Gi(e),label:t}}function Yl(e,t){let n=Xg(t);if(t===""||Kl(t)||n===".."||n.startsWith(`..${zi}`))throw new se(e.label);return{[eh]:!0,scope:e,relativePath:n,path:ql(e.root,n)}}function Wn(e,t){return Yl(e,Fi(e.root,Gi(t)))}function Zl(e,t="rules policy"){let n=Gi(e),r=Jg(n).dir;return Yl(Tt(r,t),Fi(r,n))}function Gr(e){return Jl(e.scope.label,()=>{if(!Fr(e))return null;let t=qg(e.path,Vl.O_RDONLY|th);return nh(t,()=>{let n=Kg(t);if(!n.isFile())throw new se(e.scope.label);let r=Yg(t,"utf-8"),o=Wi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new se(e.scope.label);return Fr(e),r})})}function Xl(e,t){if(e.path===t.path)return!0;return Jl(e.scope.label,()=>{if(!Fr(e)||!Fr(t))return!1;return Wr(e.path)===Wr(t.path)})}function Jl(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof se)throw r;throw new se(e)}}function nh(e,t){try{return t()}finally{Vg(e)}}function Fr(e,t="file"){let n=rh(e.scope);if(!n)return!1;let r=e.relativePath.split(zi);for(let o of r.keys()){let i=ql(e.scope.root,...r.slice(0,o+1)),s=Wi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new se(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new se(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new se(e.scope.label);oh(n,Wr(i),e.scope.label)}return!0}function rh(e){if(!Wi(e.root,{throwIfNoEntry:!1}))return null;if(!Zg(e.root).isDirectory())throw new se(e.label);return Wr(e.root)}function oh(e,t,n){let r=Fi(e,t);if(r===".."||r.startsWith(`..${zi}`)||Kl(r))throw new se(n)}import{dirname as kt,isAbsolute as ch,join as Mt,relative as uh,resolve as Ot,sep as dh}from"path";var It=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Ql="rulebook.json",ec=".cc-safety-net/rules";var tc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var ih=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,sh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),ah="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),xP=new RegExp(`^${sh}/(${It.source.slice(1,-1)})/${ah}$`);function lh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function nc(e){if(zr(e))try{return Bi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return It.test(e)?null:`Local rulebook sources must be bare names matching ${It}: ${e}`}function Bi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(tc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!ih.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!It.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:lh(o),name:o}}function zr(e){return tc.test(e)}var rc="rule.json",Br="policy.json",oc=".cc-safety-net",mh="rules",fh="CC_SAFETY_NET_HOME",ic="`cc-safety-net rule update`";function ph(e){return Ot(e,ec)}function gh(e){return Mt(ph(e),rc)}function Fn(e){return Mt(Ot(e),oc,Br)}function $i(e,t={}){return t.userConfigDir??(t.userConfigPath?kt(t.userConfigPath):Mt(hh(e),mh))}function hh(e){let t=e.env.get(fh);return t?Ot(be(t)):Mt(e.home,oc)}function yh(e,t={}){return Mt($i(e,t),rc)}function ln(e,t={}){return Mt(kt($i(e,t)),Br)}function sc(e,t){let n=t.userConfigPath??yh(e,t),r=t.projectConfigPath??gh(t.cwd),o=Sh(e,t),i=Ch(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Wn(o,n),projectConfigTarget:Wn(i,r)}}function Sh(e,t){let n=t.userConfigPath?kt(kt(Ot(t.userConfigPath))):kt(Ot(t.userConfigDir??$i(e,t)));return Tt(n,"user policy")}function Ch(e,t){let n=Ot(t),r=Ot(e),o=uh(n,r);if(o!==".."&&!o.startsWith(`..${dh}`)&&!ch(o))return Tt(n,"project policy");return Tt(kt(kt(r)),"project policy")}function ac(e,t){return Mt(e,t,Ql)}var le=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ut=/^[a-zA-Z][a-zA-Z0-9_-]*$/,dt=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),lc=new Set(["python","python3","python2","node","ruby","perl"]),$r=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Ur=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var cc="Rulebook exceeds CC Safety Net's safe validation limits.",uc="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function dc(e){if(Ui(e.allowed_commands,Oe.maxAllowedCommands)||Ui(e.rules,Oe.maxRules)||Ui(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Ui(e,t){return Array.isArray(e)&&e.length>t}var Hi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var ji=64,Vi="Rule config exceeds CC Safety Net's safe source limit.";function L(e){return I(e).toLowerCase()}function I(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function fe(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var bh=new Map([["bash",new Set(["O","o"])],["dash",new Set(["o"])],["ksh",new Set(["o"])],["sh",new Set(["o"])],["zsh",new Set(["o"])]]),vh=new Map([["zsh",new Set(["o"])]]),Eh=new Map([["bash",new Set(["--init-file","--rcfile"])]]);function mc(e,t){for(let n=0;n<t.length;n++){let r=t[n];if(r===void 0||r==="--"||r==="-"||r[0]!=="-"&&r[0]!=="+")return null;if(r.startsWith("--")){let s=Eh.get(e);if(xh(r,s))continue;if(!s?.has(r))continue;if(t[n+1]===void 0)return null;n++;continue}let o=Rh(e,r);if(o.commandSelected)return t[n+o.followingValues+1]??null;let i=t[n+1];if(e==="ksh"&&(r==="-o"||r==="+o")&&i!==void 0&&i[0]!=="-"&&i[0]!=="+")n++;n+=o.followingValues}return null}function Rh(e,t){let n=bh.get(e),r=vh.get(e),o=!1,i=0;for(let s=1;s<t.length;s++){let a=t[s];if(a===void 0)break;if(t[0]==="-"&&a==="c")o=!0;if(e==="ksh"&&a==="o"){if(s+1<t.length){let l=t.slice(s+1);if(!o&&t[0]==="-"&&l==="c")continue;if(!o&&t[0]==="-"&&l[0]==="-"&&l.endsWith("c"))o=!0;break}if(o)i++;continue}if(!n?.has(a))continue;if(r?.has(a)&&s+1<t.length)break;i++}return{commandSelected:o,followingValues:i}}function xh(e,t){return t!==void 0&&[...t].some((n)=>e.startsWith(`${n}=`))}function Gn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Hr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of _h(e))Gn(n,t);return t.inSingle||t.inDouble}function _h(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Gn(s,n)}return t}var Ki=new Set(["rm","find","xargs","parallel"]),wh=new Set(["git","busybox",...Ki,...J,...lc,...we]),Ah=new Set(["python","node","ruby","perl"]);function fc(e){let t=L(e);return wh.has(t)||Me(t)}function Me(e){return Ah.has(Ph(e))}function Ph(e){let t=I(e).toLowerCase();return $r.test(t)?"python":t}function qi(e){try{let t=Gr(Th(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Oh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof se)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Th(e){return typeof e==="string"?Zl(e):e}var O=(e,t)=>({path:e,message:t,kind:"typed"}),ce=(e,t)=>({path:e,message:t,kind:"custom"});function pc(e){let t=new Set;return e.flatMap((n,r)=>{let o=cn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ce(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Yi=`must be one of ${Hi.join(", ")}`,Ih=/^[^/]+\/[^/]+$/,kh=["version","rules","overrides","transparent_wrappers"];function Oh(e){let t=Mh(e);return{errors:Zi($h(t,kh,(n)=>n.kind==="custom"),": "," "),sources:Bh(e,t)}}function Mh(e){if(!cn(e))return[O([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>ji;return[...e.version===1?[]:[O(["version"],"must be 1")],...Dh(e.rules,t),...Wh(e.overrides),...Gh(e.transparent_wrappers),...t?[]:Lh(e.rules),...cn(e.overrides)?Object.keys(e.overrides).filter((n)=>!Ih.test(n)).map((n)=>ce(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...zh(e.transparent_wrappers)]}function Dh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[O(["rules"],"must be an array of rulebook source strings"),...gc(e,ji)?[O(["rules"],Vi)]:[]];if(t)return[{path:["rules"],message:Vi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[O(["rules",r],"must be a rulebook source string"),...Nh(n,1)?[O(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[O(["rules",r],"must be a non-empty rulebook source string")]:[]})}function gc(e,t){let n=hc(e);return n!==void 0&&!(n<=t)}function Nh(e,t){let n=hc(e);return n!==void 0&&!(n>=t)}function hc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Lh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ce(["rules",r],"must be a non-empty rulebook source string")];let o=nc(n);if(o)return[ce(["rules",r],o)];if(t.has(n))return[ce(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Wh(e){if(e===void 0)return[];if(!cn(e))return[O(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!cn(n))return[O(["overrides",t],'must be "off" or an object')];return[...Fh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||Xi(n.intent)?[]:[O(["overrides",t,"intent"],Yi)]]})}function Fh(e,t){if(typeof e!=="string")return[O(t,"required non-empty string"),...gc(e,dt)?[O(t,`must be at most ${dt} characters`)]:[]];if(e==="")return[O(t,"required non-empty string")];return e.length>dt?[O(t,`must be at most ${dt} characters`)]:[]}function Gh(e){if(e===void 0)return[];if(!Array.isArray(e))return[O(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[O(["transparent_wrappers",n],"must be a command string")];return ut.test(t)?[]:[O(["transparent_wrappers",n],"must match command pattern")]})}function zh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ut.test(n))return[];if(t.has(n))return[ce(["transparent_wrappers",r],`duplicate command "${n}"`)];if(fc(n))return[ce(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Bh(e,t){let n=cn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function $h(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function Zi(e,t,n){return[...new Set(e.map((r)=>{let o=Uh(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function Uh(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Xi(e){return Hi.includes(e)}function cn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Sc(e){let t=Vh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Hh=`required non-empty string up to ${dt} characters`,yc="must be a non-empty array of unique non-empty strings",jh="required non-empty array of non-empty strings";function Vh(e){if(!mt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!dc(e))return{errors:[cc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...Zi(Kh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),uc]:t,ruleNames:new Set(Cc(e).map((n)=>n.toLowerCase()))}}function Cc(e){let t=mt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=mt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Kh(e,t){return[...typeof e.name==="string"&&It.test(e.name)?[]:[O(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[O(["version"],"required non-empty string")],...qh(e.allowed_commands),...Yh(e.rules,t),...Qh(e.tests),...ey(e),...ty(e)]}function qh(e){if(!Array.isArray(e))return[O(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ut.test(n)?[]:[O(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ut.test(n))return[];if(t.has(n))return[ce(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Yh(e,t){if(!Array.isArray(e))return[O(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!mt(n))return[O(["rules",r],"must be an object")];return t?Xh(n,["rules",r]):Zh(n,["rules",r])}),...pc(e)]}function Zh(e,t){return[...bc(e.name,t),...vc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ut.test(e.subcommand)?[]:[O([...t,"subcommand"],"must match command pattern")],...jr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Ec(e.reason,t),...Rc(e.intent,t)]}function Xh(e,t){return[...bc(e.name,t),...vc(e.command,t),...Ec(e.reason,t),...Rc(e.intent,t),...Jh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[O([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[O([...t,"block_args"],"not supported in rulebook_version 2")]]}function bc(e,t){if(typeof e!=="string")return[O([...t,"name"],"required string")];return It.test(e)?[]:[O([...t,"name"],"must match rule name pattern")]}function vc(e,t){return typeof e==="string"&&ut.test(e)?[]:[O([...t,"command"],"required string matching command pattern")]}function Ec(e,t){return typeof e==="string"&&e!==""&&e.length<=dt?[]:[O([...t,"reason"],Hh)]}function Rc(e,t){return e===void 0||Xi(e)?[]:[O([...t,"intent"],Yi)]}function Jh(e,t){if(!mt(e))return[O(t,"required object")];return[...jr(e.command_path,[...t,"command_path"],jh,!1),...e.any_args===void 0?[]:jr(e.any_args,[...t,"any_args"],yc,!0),...e.exclude_args===void 0?[]:jr(e.exclude_args,[...t,"exclude_args"],yc,!0)]}function jr(e,t,n,r){if(!Array.isArray(e))return[O(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[O([...t,s],"must be a non-empty string")];return i===""?[ce([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ce(t,n)]:[],...r&&new Set(e).size!==e.length?[ce(t,"must not contain duplicate values")]:[]]}function Qh(e){if(e===void 0)return[];if(!Array.isArray(e))return[O(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!mt(t))return[O(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[O(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[O(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[O(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ce(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function ey(e){if(!Array.isArray(e.tests))return[];let t=new Set(Cc(e));return[...new Set(e.tests.flatMap((n)=>mt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ce(["tests"],`blocked fixture references unknown rule "${n}"`))}function ty(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=mt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ce(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function mt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Tc(e,t){let n=sc(e,t),r=!1;try{r=Xl(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof se)return uy(n,f.message);throw f}let o=qi(n.userConfigTarget),i=r?{config:null,errors:[]}:qi(n.projectConfigTarget),s=Ac(n.userConfigPath,o.errors),a=Ac(n.projectConfigPath,i.errors),l=new Set,c=o.config?xc(o.config,Vr(n.userConfigPath),"user",n.userScope,l):Pc(),d=i.config?xc(i.config,Vr(n.projectConfigPath),"project",n.projectScope,l):Pc(),m=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[..._c(c.rules,m),..._c(d.rules,u)],transparent_wrappers:ly(o.config,i.config),rulebooks:[...c.rulebooks,...d.rulebooks],errors:[...s,...a,...c.errors,...d.errors],warnings:[...c.warnings,...d.warnings,...c.canValidateOverrides?wc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?cy(u,c.knownRuleIds,n.projectConfigPath):[],...d.canValidateOverrides?wc(u,d.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function xc(e,t,n,r=Tt(Vr(Vr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let d=ry(c,t,r);if(d.errors.length>0||!d.rulebook)return i.push(...d.errors),[];let m=d.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:ny(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((u)=>`${m.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),entries:a.map((c)=>({spec:c.rulebook.spec,name:c.rulebook.name,version:c.rulebook.version,ruleCount:c.rulebook.rules.length})),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function ny(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function ry(e,t,n){let r=oy(e),o=ac(t,r),i=sy(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${iy(e)}`]};let s=ay(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function oy(e){return zr(e)?Bi(e).name:e}function iy(e){return zr(e)?`run ${ic} to vendor ${e}`:"create that file or remove that source from the rules config"}function sy(e,t){try{return{content:Gr(Wn(t,e))}}catch(n){if(n instanceof se)return{error:n.message};throw n}}function ay(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Sc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function ly(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function _c(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function wc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function cy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Ac(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function uy(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Pc(){return{rules:[],rulebooks:[],entries:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as xy,readFileSync as _y}from"fs";var Ic=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Ji=new Set(Ic.map((e)=>e.id)),Kr=Ic,dy=new Map(Kr.map((e)=>[e.id,e.intent]));function S(e,t){return{id:e,reason:t,intent:dy.get(e)??"manual_only"}}var Qi=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],qr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},my=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],fy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],es=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...fy.flatMap((e)=>my.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Yr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],kc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],py=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ts=kc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ns=kc.flatMap((e)=>py.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),zn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},rs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),os=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],gy=[...Qi,qr,...es,...ts,...ns,zn,...rs,...os,...Yr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Zr=new Set(Yr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),hy=gy.map((e)=>e.id),is=new Set(hy);import{isAbsolute as ss,join as yy,normalize as Sy,sep as Xr}from"path";var Oc=process.platform==="win32",Cy=/[*?]/;function Bn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function as(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Bn(e.trim(),t);if(!ss(n))return"must be an absolute path or start with ~/";return $n(n,t)}function ls(e,t){let n=Mc(e,t);if(n===null)return"must be a non-empty path string";if(!ss(n))return null;if($n(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var by="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",vy="cannot cover the guard's own configuration";function Mc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Bn(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function cs(e,t){let n=Mc(e,t);if(n===null)return"must be a non-empty path string";if(Cy.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!ss(n))return null;if($n(n,t)!==null)return by;return Ey(n,t)?vy:null}function Ey(e,t){let n=Jr(e),r=Jr(yy(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Xr}`)}function $n(e,t){let n=Jr(e),r=Jr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Xr)?n:`${n}${Xr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Jr(e){let t=Sy(e);if(Oc)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(Oc?3:1)&&t.endsWith(Xr))t=t.slice(0,-1);return t}var Dc=30,us=1,ds=365;function Nc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Lc=new Set(Kr.filter((e)=>e.catastrophic).map((e)=>e.id));function T(e,t){if(!e)return null;if(Lc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function Q(e,t,n){if(Lc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Wc(e,t){return Object.freeze(Object.fromEntries(Kr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Fc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Wc(e,t)})}var Gc={standard:0,strict:1,paranoid:2};function $c(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:ms(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:ms(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:ms(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:Ry(e,t)}}function ms(e,t){return[...new Set([...e,...t??[]])]}function Ry(e,t){let n=t.safety?.level,r=Mr[e.safety.level];return[...n&&Gc[n]<Gc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...sn.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...zc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...zc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Zr.has(o))),...e.destructive_command_protection.enabled?Bc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Bc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function zc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Bc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var gs=new Set(["standard","strict","paranoid"]),Vc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Dc}};function Kc(e,t){let n=Ny(ln(e,t),e.home),r=to(Fn(t.cwd),e.home),o=Ay(r.parsed,e.home),i=Object.keys(o.policy).length>0?$c(n.gui??Vc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ps(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var wy="project policy audit settings are ignored; audit is user scope only";function Ay(e,t){if(!ve(e))return{policy:{},diagnostics:[]};let n=ve(e.safety)?e.safety:{},r=ve(e.workflow)?e.workflow:{},o=ve(e.destructive_command_protection)?e.destructive_command_protection:{},i=ve(e.secret_protection)?e.secret_protection:{},s={...gs.has(n.level)?{level:n.level}:{},...ve(n.overrides)?Uc({overrides:qc(n.overrides,sn,"safety.overrides",Dt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:eo(o.overrides,Ji,"destructive_command_protection.overrides",Dt)}:{},...o.allow_paths!==void 0?{allow_paths:dn(o.allow_paths,as,t,"destructive_command_protection.allow_paths",Dt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:eo(i.overrides,is,"secret_protection.overrides",Dt)}:{},...i.deny_paths!==void 0?{deny_paths:dn(i.deny_paths,ls,t,"secret_protection.deny_paths",Dt)}:{},...i.allow_paths!==void 0?{allow_paths:dn(i.allow_paths,cs,t,"secret_protection.allow_paths",Dt)}:{}};return{policy:Uc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[wy]}}function qc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(`${n}.${o}`,Yc);return[]}))}function Uc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Dt=()=>{return},Yc="not a boolean",Zc="not an object",Py=`not an integer between ${us} and ${ds}`,Ty=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Iy(e,t){let n=[];return{policy:Xc(e,t,(o,i)=>{n.push({path:o,reason:i})}),drops:n}}function ky(e,t){return Xc(e,t,Dt)}function Xc(e,t,n){if(!ve(e))return n("","not a JSON object"),Qr();if(e.version!==1)n("version","not 1");let r=un(e.safety,"safety",["level","overrides"],n),o=un(r.overrides,"safety.overrides",sn,n),i=un(e.workflow,"workflow",["worktree_mode"],n),s=un(e.destructive_command_protection,"destructive_command_protection",["enabled","overrides","allow_paths"],n),a=un(e.secret_protection,"secret_protection",["enabled","overrides","deny_paths","allow_paths"],n),l=un(e.audit,"audit",["retention_days"],n);return Jc(e,Ty,"",n),{version:1,safety:{level:Oy(r.level,n),overrides:qc(o,sn,"safety.overrides",n)},workflow:{worktree_mode:fs(i.worktree_mode,"workflow.worktree_mode",!1,n)},destructive_command_protection:{enabled:fs(s.enabled,"destructive_command_protection.enabled",!0,n),overrides:eo(s.overrides,Ji,"destructive_command_protection.overrides",n),allow_paths:dn(s.allow_paths,as,t,"destructive_command_protection.allow_paths",n)},secret_protection:{enabled:fs(a.enabled,"secret_protection.enabled",!0,n),overrides:eo(a.overrides,is,"secret_protection.overrides",n),deny_paths:dn(a.deny_paths,ls,t,"secret_protection.deny_paths",n),allow_paths:dn(a.allow_paths,cs,t,"secret_protection.allow_paths",n)},audit:{retention_days:My(l.retention_days,n)}}}function un(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(t,Zc),{};return Jc(e,n,t,r),e}function Jc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r(n===""?o:`${n}.${o}`,"unknown field")}function Oy(e,t){if(e===void 0)return"standard";if(gs.has(e))return e;return t("safety.level","not one of standard, strict, paranoid"),"standard"}function fs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(t,Yc);return n}function My(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=us&&e<=ds))t("audit.retention_days",Py);return Nc(e)}function eo(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(n,Zc),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r(`${n}.${o}`,"unknown rule id"),[];if(i==="on"||i==="off")return[[o,i]];return r(`${n}.${o}`,'not "on" or "off"'),[]}))}function dn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(r,"not an array"),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(`${r}[${s}]`,a),[]})}function ve(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Qr(){return structuredClone(Vc)}function to(e,t){if(!xy(e))return{exists:!1,policy:Qr(),errors:[]};try{let n=_y(e,"utf-8");if(!n.trim())return{exists:!0,policy:Qr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Iy(r,t);if(o.drops.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.drops.map((i)=>`${e}: ${Dy(i)}`),fallback:ve(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Qr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}function Dy(e){return e.path===""?e.reason:`${e.path}: ${e.reason}`}function Ny(e,t){let n=to(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ve(r))return{policy:jc(),errors:[]};let o=ky(r,t);return{policy:ps(o),gui:o,errors:[],levelPresent:Hc(r)}}if(n.parsed===void 0)return{policy:jc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ps(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Hc(n.parsed)}}function Hc(e){let t=ve(e)&&ve(e.safety)?e.safety:{};return gs.has(t.level)}function Qc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Zr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function jc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Qc({}),denyPaths:[],allowPaths:[]}}}function ps(e){return{safety:Ly(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Qc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function Ly(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function eu(e,t){let n=Tc(e,t),r=Kc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((d)=>d.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...zy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return By(o,Wy(n,r),s,r.policyScopes)}function Wy(e,t){let n=Gy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:$y(e.errors.length>0?Fy(e.errors):void 0,e.warnings.length>0?ys(e.warnings.join("; ")):void 0,n)}}function Fy(e){return`${ys(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Gy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function zy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function By(e,t,n=Object.freeze({}),r){let o=hs(structuredClone(e)),i=r?{policyScopes:hs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function hs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))hs(t);return Object.freeze(e)}function $y(...e){return ys(e.filter((t)=>!!t).join("; "))}function ys(e){return/[.!?]$/.test(e)?e:`${e}.`}function tu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Ss(t.fail_closed,e.strict,"strict"),paranoid_rm:Ss(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Ss(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Fc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Ai({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Ss(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Un(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Uy=/^[A-Za-z_][A-Za-z0-9_]*=/;function no(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Hn(e){let t=no(e.words[0],"time")?1:0,n=t===1&&no(e.words[t],"-p")?t+1:t,r=t===1&&no(e.words[n],"--")?n+1:n,o=no(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Uy.test(s.text));return i?.provenance==="literal"?i.text:void 0}function ro(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Hy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>pe(t)))})}function oo(e,t,n){e.push(n),t.reset()}function io(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Cs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function mn(e,t,n,r,o,i,s){return Cs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function pe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t,span:Object.freeze(t.span)}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Hy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:pe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function bs(e,t,n){if(t>=n||ru(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!ru(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=nu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=nu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,span:{start:t,end:s},ambiguous:i}}function vs(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=jy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?Vy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`,span:s.declarationSpan}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function nu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function ru(e){return/[\s;&|<>)]/u.test(e)||e==="`"}function jy(e,t,n){let r=t;while(r<n&&e[r]!==`
 `&&e[r]!=="\r")r++;let o=r>=n?n:e[r]==="\r"&&e[r+1]===`
-`?r+2:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function KP(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var Cb=new Set(["&&","||","|","|&"]);function Eb(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return Re({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`,span:n}],nodes:[]});let r=_s(e,0,e.length,t,{used:0,max:t.maxWords},0);return Re({kind:"program",dialect:"posix",source:e,span:n,status:Cs(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function _s(e,t,n,r,o,i,s){let a=[],c=[],l=gs(),u=[],d=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end},p=l.words.map((h)=>h.text);hs(a,l,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:c.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},m=t;while(m<n){let f=e[m];if(!f)break;if(s&&f===s)return d(),xb(a,c),{nodes:a,issues:c,next:m+1,closed:!0,limited:!1,pendingHeredocs:u};if(xs(f)){if(f===`
-`||f==="\r"){d();let C=f==="\r"&&e[m+1]===`
-`?m+2:m+1,P=a.at(-1);if(P?.kind!=="connector"||!Cb.has(P.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(m,C),span:Object.freeze({start:m,end:C})}));if(u.length>0){let L=tu(e,C,n,u.splice(0));c.push(...L.issues),m=L.next;continue}m=C;continue}m++;continue}if(f==="#"){while(m<n&&e[m]!==`
-`&&e[m]!=="\r")m++;continue}let p=l.start===-1?gA(e,m,n):void 0;if(p){if(ru(a,c,m),i>=r.maxDepth)return or(a,c,m,"depth-limit",r.maxDepth);if(!nu(o))return or(a,c,m,"word-limit",r.maxWords);let C=_s(e,p.braceIndex+1,n,r,o,i+1,"}"),P=C.next,L={start:p.braceIndex+1,end:C.closed?P-1:P},k=vb(e,L,C);if(a.push({kind:"function",name:p.name,span:{start:m,end:P},body:k}),c.push(...C.issues),C.pendingHeredocs.length>0||fo(C.nodes))c.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely",span:{start:m,end:P}});if(u.push(...C.pendingHeredocs),C.limited)return vs(a,c,C.next);if(!C.closed)c.push({code:"unclosed-function-body",message:"function body is not closed",span:{start:p.braceIndex,end:P}});m=P;continue}let h=Ss(e,m);if(h){if(d(),!Ob(a.at(-1)))c.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`,span:{start:m,end:m+h.length}});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:m,end:m+h.length})})),m+=h.length;continue}if(f===")"){d(),c.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis",span:{start:m,end:m+1}}),a.push({kind:"unknown",source:f,span:{start:m,end:m+1}}),m++;continue}if((f==="("||f==="{"&&rA(e,m,n))&&l.start===-1){if(ru(a,c,m),i>=r.maxDepth)return or(a,c,m,"depth-limit",r.maxDepth);let C=f==="("?")":"}",P=_s(e,m+1,n,r,o,i+1,C),L=P.next,k={start:m+1,end:P.closed?L-1:L},U=vb(e,k,P);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:m,end:L},body:U}),c.push(...P.issues),P.pendingHeredocs.length>0||fo(P.nodes))c.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely",span:{start:m,end:L}});if(u.push(...P.pendingHeredocs),P.limited)return vs(a,c,P.next);if(!P.closed)c.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`,span:{start:m,end:L}});m=L;continue}let y=(f==="<"||f===">")&&e[m+1]!=="("?QP(e,m):null;if(y){let C=l.words.at(-1),P=C&&C.span.end===m&&/^[0-9]+$/.test(C.raw)?Number(C.raw):void 0;if(P!==void 0)l.words.pop();let L=P===void 0?m:C?.span.start??m;l.start=l.start===-1?m:l.start;let k=m+y.length;while(k<n&&/[ \t]/.test(e[k]??""))k++;let U=e[k],ie=k>m+y.length&&U==="#",se=!U||xs(U)||!!Ss(e,k)||U===s||U===")"||ie||(U==="<"||U===">")&&e[k+1]!=="(",J=y==="<<"||y==="<<-"?eu(e,k,n):void 0,B=J?{word:rr(e,k,J.next,J.delimiter,"literal",J.quoted),nested:[],issues:[],next:J.next,limited:!1}:!se?ou(e,k,n,r,o,i):void 0;if(B){if(c.push(...B.issues),B.limited)return vs(a,c,B.next);if(!nu(o))return or(a,c,B.next,"word-limit",r.maxWords)}let R=B?.next??m+y.length,T={kind:"redirection",operator:y,span:{start:L,end:R},...P===void 0?{}:{fd:P},...B?{target:B.word}:{}};if(l.redirections.push(T),y==="<<"||y==="<<-")if(!J)c.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word",span:{start:m,end:m+y.length}});else{if(J.ambiguous||J.delimiter.length===0)c.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely",span:J.span});let V=l.nested;u.push({delimiter:J.delimiter,quotedDelimiter:J.quoted,stripTabs:y==="<<-",declarationSpan:{start:L,end:R},attach:(S)=>{if(T.heredoc=S,S.quotedDelimiter)return;V.push(...JP(e,S.bodySpan.start,S.bodySpan.end,r,o,i+1))}})}else if(!B)c.push({code:"missing-redirection-target",message:`redirection ${y} requires a target word`,span:{start:m,end:m+y.length}});if(B)l.nested.push(...B.nested);l.end=R,m=R;continue}if(l.start===-1)ru(a,c,m);let b=ou(e,m,n,r,o,i);if(c.push(...b.issues),b.limited)return vs(a,c,b.next);let E=sA(l.words)?dA(e,b.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(E?.limitCode)return or(a,c,b.next,E.limitCode,E.limitCode==="word-limit"?r.maxWords:E.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let A=E?.words??[b.word];for(let C of A){if(!nu(o))return or(a,c,b.next,"word-limit",r.maxWords);l.words.push(C)}l.start=l.start===-1?m:l.start,l.end=b.next,l.nested.push(...b.nested),m=b.next>m?b.next:m+1}return d(),xb(a,c),c.push(...hA(u)),{nodes:a,issues:c,next:m,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function vb(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:Cs(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function ou(e,t,n,r,o,i){let s="",a=t,c=!1,l="literal",u=[],d=[],m=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||xs(f)||(f===";"||f==="|"||f==="&")&&Ss(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){c=!0;let y=e.indexOf("'",a+1);if(y===-1||y>=n){s+=e.slice(a+1,n),d.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:a,end:n}}),a=n;break}s+=e.slice(a+1,y),a=y+1;continue}if(f==='"'){c=!0;let y=YP(e,a,n,r,o,i);if(s+=y.text,u.push(...y.nested),d.push(...y.issues),m||=y.limited,l=mo(l,y.provenance),a=y.next,m)break;continue}if(e.startsWith("$'",a)){c=!0;let y=eA(e,a+2,n);if(s+=y.text,d.push(...y.issues),!y.closed)d.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed",span:{start:a,end:n}});a=y.next;continue}if(f==="\\"){let y=e[a+1];if(!y){d.push({code:"trailing-escape",message:"escape has no following character",span:{start:a,end:a+1}}),a++;break}if(y===`
-`){a+=2;continue}s+=y,a+=2;continue}let h=f==="$"||f==="<"||f===">"||f==="`"?Es(e,a,n,r,o,i):null;if(h){let y=wb(h,u,d);if(m||=y.limited,l=mo(l,y.provenance),a=y.next,m)break;continue}if(f==="$"){let y=Ab(e,a,n,s,l);s=y.text,l=y.provenance,a=y.next;continue}if(f==="*"||f==="?"||f==="[")l=mo(l,"glob");s+=f,a++}return{word:rr(e,t,a,s,l,c,l==="literal"?void 0:nA(e,t,a)),nested:u,issues:d,next:a,limited:m}}function YP(e,t,n,r,o,i){let s="",a="literal",c=[],l=[],u=!1,d=t+1;while(d<n){let m=e[d];if(m==='"')return{text:s,provenance:a,nested:c,issues:l,next:d+1,limited:u};if(m==="\\"&&e[d+1]){let p=e[d+1]??"";if(p===`
-`){d+=2;continue}if(p==="\r"&&e[d+2]===`
-`){d+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,d+=2;continue}if(e.startsWith("$((",d)){let p=iu(e,d+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(d,h),p===-1)l.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:d,end:h}});d=h;continue}let f=Es(e,d,n,r,o,i);if(f){let p=wb(f,c,l);if(d=p.next,u||=p.limited,a=mo(a,p.provenance),u)return{text:s,provenance:a,nested:c,issues:l,next:d,limited:u};continue}if(m==="$"){let p=Ab(e,d,n,s,a);s=p.text,a=p.provenance,d=p.next;continue}s+=m??"",d++}return l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:t,end:n}}),{text:s,provenance:a,nested:c,issues:l,next:n,limited:u}}function Es(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,c=e.startsWith("<(",t)||e.startsWith(">(",t),l=e[t]==="`";if(!s&&!a&&!c&&!l)return null;let u=s?3:l?1:2,d=s?"))":l?"`":")",m=iu(e,t+u,n,d),f=m===-1?n:m,p=m===-1?n:m+d.length;if(i>=r.maxDepth)return{program:pA(e,t+u,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let E=[],A=[],C=!1,P=t+u;while(P<f){let L=Es(e,P,f,r,o,i+1);if(!L){P++;continue}if(E.push(...L.program.nodes),A.push(...L.program.issues),C||=L.program.status==="limited",P=L.next,C)break}if(m===-1)A.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:t,end:p}});return{program:Re({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:Cs(A,C),issues:A,nodes:E}),next:p,provenance:"arithmetic"}}let h=_s(e,t+u,f,r,o,i+1),y=m===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`,span:{start:t,end:p}}]:[],b=(l||c)&&fo(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions",span:{start:t,end:p}}]:[];return{program:Re({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:Cs([...h.issues,...y,...b],h.limited),issues:[...h.issues,...y,...b],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function JP(e,t,n,r,o,i){let s=[],a=t;while(a<n){let c=e[a];if(c==="\\"){a+=2;continue}let l=c==="$"||c==="`"?Es(e,a,n,r,o,i):null;if(!l){a++;continue}if(s.push(l.program),a=l.next,l.program.status==="limited")break}return s}function wb(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function iu(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++)if(e[a]==="\\")a++;else if(e[a]==="`")return a;return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let c=e[a];if((c===`
-`||c==="\r")&&s.length>0){let u=c==="\r"&&e[a+1]===`
-`?a+2:a+1,d=tu(e,u,n,s.splice(0));if(!d.terminated)return-1;a=d.next-1;continue}let l=Rb(e,a,t,n,i);if(l!==null){a=l;continue}if(!i.double&&e.startsWith("$((",a)){let u=XP(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&c==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",d=a+(u?3:2);while(d<n&&/[ \t]/.test(e[d]??""))d++;let m=eu(e,d,n);if(m){s.push({delimiter:m.delimiter,quotedDelimiter:m.quoted,stripTabs:u,declarationSpan:{start:a,end:m.next},attach:()=>{return}}),a=m.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(c==="("&&!i.double)o++;if(c===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function XP(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=Rb(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function Rb(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!yA(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function Ss(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function QP(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function xs(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function Pb(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function eA(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=tA(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`,span:{start:i,end:a.next}});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function tA(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return bs(e,t+1,n,16,2,t+1);if(r==="u")return bs(e,t+1,n,16,4,t+1);if(r==="U")return bs(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return bs(e,t,n,8,3,t+1);return{text:r,next:t+1}}function bs(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",c=t;while(c<n&&a.length<o&&s.test(e[c]??""))a+=e[c],c++;if(!a)return{text:e[i-1]??"",next:i};let l=Number.parseInt(a,r);return l>1114111||l>=55296&&l<=57343?{text:"\uFFFD",next:c,invalidCodePoint:l}:{text:String.fromCodePoint(l),next:c}}function Cs(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function Ab(e,t,n,r,o){let i=Pb(e,t,n);return{text:r+e.slice(t,i),provenance:mo(o,"variable"),next:i}}function nA(e,t,n){let r=ys(e),o=t,i=!1,s=!1,a=t;while(a<n){let c=e[a];if(c==="\\"&&!i){a+=2;continue}if(!s&&c==="'"){i=!i,a++;continue}if(!i&&c==='"'){s=!s,a++;continue}if(i){a++;continue}let l=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!l,d=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),m=c==="`";if(l||u||d||m){let f=l?3:m?1:2,p=l?"))":m?"`":")",h=iu(e,a+f,n,p),y=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,y,l?"arithmetic":"command-substitution"),a=y,o=y;continue}if(c==="$"){let f=Pb(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(c==="*"||c==="?"||c==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function mo(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function rA(e,t,n){return t+1>=n||xs(e[t+1]??"")||Ss(e,t+1)!==null}var oA=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),iA=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function sA(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=aA(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function aA(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return cA(e,t);if(n==="env")return lA(e,t);if(n==="sudo")return uA(e,t);return}function cA(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function lA(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(oA.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function uA(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(iA.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function kb(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=[e.raw],i=e.raw.length,s=0;while(!0){let c=o.findIndex((p)=>Sb(p));if(c===-1)break;if(++s>n)return{limited:!0};let l=o[c]??"",u=Sb(l);if(!u||u.kind==="range")return{limited:!0};let d=u.start+l.length-u.end,m=u.alternatives.reduce((p,h)=>p+d+h.length,0);if(i-l.length+m>r||o.length-1+u.alternatives.length>t)return{limited:!0};let f=Tb(l,u);o.splice(c,1,...f),i+=m-l.length}if(s===0)return;let a=o.map((c)=>fA(c,n));if(a.some((c)=>c===null))return{limited:!0};return{words:[...new Set(a.filter((c)=>c!==null&&c!==""))]}}function dA(e,t,n,r,o){if(t.provenance!=="literal"||t.quoted||t.raw!==t.text||!t.raw.includes("{"))return;let i=[t.text],s=t.text.length,a=0;while(!0){let l=i.findIndex((y)=>_b(y));if(l===-1)break;if(++a>r)return{limitCode:"depth-limit"};let u=i[l]??"",d=_b(u);if(!d)break;let m=d.start+u.length-d.end,f=d.alternatives.filter((y)=>m+y.length>0),p=f.reduce((y,b)=>y+m+b.length,0);if(s-u.length+p>o)return{limitCode:"brace-expansion-limit"};if(i.length-1+f.length>n)return{limitCode:"word-limit"};let h=Tb(u,{...d,alternatives:f});i.splice(l,1,...h),s+=p-u.length}let c=i.filter((l)=>l.length>0);if(a===0)return;return{words:c.map((l)=>rr(e,t.span.start,t.span.end,l,"literal",!1))}}function _b(e){let t=[],n;for(let r=0;r<e.length;r++){let o=e[r];if(o==="{"){t.push({start:r,commas:[]});continue}if(o===","&&t.length>0){t.at(-1)?.commas.push(r);continue}if(o!=="}"||t.length===0)continue;let i=t.pop();if(!i||i.commas.length===0)continue;if(!n||i.start<n.start)n={start:i.start,end:r+1,commas:i.commas}}if(!n)return;return{start:n.start,end:n.end,alternatives:Ib(e,n)}}function Sb(e){let t=[],n,r=null,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(o){o=!1;continue}if(s==="\\"&&r!=="'"){o=!0;continue}if(s===r){r=null;continue}if(r===null&&(s==="'"||s==='"')){r=s;continue}if(r!==null)continue;if(s==="{"){t.push({start:i,commas:[]});continue}if(s===","&&t.length>0){t.at(-1)?.commas.push(i);continue}if(s!=="}"||t.length===0)continue;let a=t.pop();if(!a)continue;let c=a.commas.length>0?{kind:"alternatives",start:a.start,end:i+1,commas:a.commas}:mA(e.slice(a.start+1,i))?{kind:"range",start:a.start,end:i+1}:void 0;if(c&&(!n||c.start<n.start))n=c}if(!n||n.kind==="range")return n;return{kind:n.kind,start:n.start,end:n.end,alternatives:Ib(e,n)}}function Tb(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function Ib(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function mA(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function fA(e,t){let n=`x${e}`,r=ou(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function pA(e,t,n,r){return Re({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit",span:{start:t,end:n}}],nodes:[]})}function or(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`,span:{start:n,end:n}}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function vs(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function nu(e){return e.used++,e.used<=e.max}function gA(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function fo(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>fo(n.nodes));return(t.kind==="group"||t.kind==="function")&&fo(t.body.nodes)})}function hA(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`,span:t.declarationSpan}))}function Ob(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function xb(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!Cb.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`,span:n.span})}function ru(e,t,n){if(!Ob(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector",span:{start:n,end:n+1}})}function yA(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var zb=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),bA=new Set(["gc","cat","type","cp","mv","rm"]),Nb=["-rec","-for","-path","-literalpath","-whatif"],vA=/^\$env:\w/i,_A=/^(?:\$\{?\w+\}?|~)\\./,ws={maxInputLength:131072,maxWords:16384,maxDepth:64};function Db(e){let t=e.toLowerCase().replaceAll("`","");if(![...zb].some((r)=>t.includes(r))&&!(t.includes("rm")&&Nb.some((r)=>t.includes(r)))&&!t.includes("<#")&&!SA(t))return!1;let n=RA(e);return n.invalidComment||n.commands.some(xA)}function SA(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function xA(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&zb.has(n))return!0;let r=e.slice(t+1);if(n&&bA.has(n)&&r.some(CA))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Nb.some((s)=>i.startsWith(s))})}function CA(e){return vA.test(e)||_A.test(e)}function Mb(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return Re({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`,span:n}],nodes:[]});let r=uu(e,0,e.length,t,0);return Re({kind:"program",dialect:"powershell",source:e,span:n,status:PA(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function uu(e,t,n,r,o,i=!1){let s=[],a=[],c=gs(),l=0,u=!1,d=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end};hs(s,c,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:c.words.map((p)=>p.text).join(" ")})},m=t;while(m<n){let f=e[m];if(!f)break;if(i&&f==="}")return d(),{nodes:s,issues:a,next:m+1,closed:!0,words:l,limited:u};let p=Wb(e,m,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return d(),{nodes:s,issues:a,next:p.next,closed:!1,words:l,limited:!0};m=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
-`){d();let b=f==="\r"&&e[m+1]===`
-`?m+2:m+1;s.push(su(e,m,b)),m=b;continue}m++;continue}let h=du(e,m);if(h){d(),s.push(su(e,m,m+h.length)),m+=h.length;continue}if(f==="{"){if(d(),o>=r.maxDepth)return a.push(Lb(m,r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:l,limited:!0};let b=uu(e,m+1,n,r,o+1,!0),E=b.closed?b.next-1:b.next,A=Re({kind:"program",dialect:"powershell",source:e.slice(m+1,E),span:{start:m+1,end:E},status:b.limited?"limited":b.issues.length>0?"partial":"complete",issues:b.issues,nodes:b.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:m,end:b.next}),body:A})),a.push(...b.issues),!b.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed",span:{start:m,end:b.next}});l+=b.words,u||=b.limited,m=b.next;continue}if(f==="}"){d(),s.push(su(e,m,m+1)),m++;continue}if(f===">"||f==="<"){c.start=c.start===-1?m:c.start;let b=e[m+1]===f?m+2:m+1,E=b;while(/[ \t]/.test(e[E]??""))E++;let A=E<n?au(e,E,n,r,o):void 0,C=A?.next??b;if(c.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(m,b),span:Object.freeze({start:m,end:C}),...A?{target:A.word}:{}})),A)a.push(...A.issues),c.nested.push(...A.nested),l+=A.words,u||=A.limited;c.end=C,m=C;continue}if(f===","){c.start=c.start===-1?m:c.start,c.words.push(Ql({text:",",raw:",",span:{start:m,end:m+1},provenance:"literal",quoted:!1})),c.end=++m;continue}let y=au(e,m,n,r,o);if(c.start=c.start===-1?m:c.start,c.end=y.next,c.words.push(y.word),a.push(...y.issues),c.nested.push(...y.nested),l+=1+y.words,u||=y.limited,l>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`,span:{start:m,end:y.next}}),d(),{nodes:s,issues:a,next:y.next,closed:!1,words:l,limited:!0};m=y.next>m?y.next:m+1}return d(),{nodes:s,issues:a,next:m,closed:!i,words:l,limited:u}}function au(e,t,n,r,o){let i="",s="literal",a=!1,c=[],l=[],u=0,d=!1,m=(p)=>{let h=EA(e,p,n,r,o);return i+=e.slice(p,h.next),l.push(h.program),c.push(...h.program.issues),u+=cu(h.program),d||=h.program.status==="limited",s="command-substitution",h.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||du(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[f+1];if(!h){c.push({code:"trailing-escape",message:"PowerShell escape has no following character",span:{start:f,end:f+1}}),f++;break}i+=h,f+=2;continue}if(e.startsWith("$(",f)){f=m(f);continue}if(p==="'"){a=!0,f++;let h=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){h=!0,f++;break}i+=e[f]??"",f++}if(!h)c.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:t,end:e.length}});continue}if(p==='"'){a=!0;let h=f++,y=!1;while(f<n){let b=e[f];if(b==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(b==='"'){y=!0,f++;break}if(e.startsWith("$(",f)){f=m(f);continue}if(b==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=b??"",f++}if(!y)c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:h,end:e.length}});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:rr(e,t,f,i,s,a,s==="literal"?void 0:wA(e,t,f)),next:f,issues:c,nested:l,words:u,limited:d}}function EA(e,t,n,r,o){let i=$b(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:Re({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Lb(t,r.maxDepth)],nodes:[]}),next:a};let c=uu(e,t+2,s,r,o+1),l=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed",span:{start:t,end:a}}]:[];return{program:Re({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:c.limited?"limited":c.issues.length+l.length>0?"partial":"complete",issues:[...c.issues,...l],nodes:c.nodes}),next:a}}function $b(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function cu(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=cu(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=cu(r)}}return t}function wA(e,t,n){let r=ys(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let c=$b(e,s+2,n),l=c===-1?n:c+1;r.push(o,s,"literal"),r.push(s,l,"command-substitution"),s=l,o=l;continue}if(a==="$"||a==="@"&&s===t){let c=s+1;if(e[c]==="{"){let l=e.indexOf("}",c+1);c=l===-1||l>=n?n:l+1}else while(c<n&&/[A-Za-z0-9_:?]/.test(e[c]??""))c++;r.push(o,s,"literal"),r.push(s,c,"variable"),s=c,o=c;continue}s++}return r.push(o,n,"literal"),r.parts}function Lb(e,t){return{code:"depth-limit",message:`command structure exceeds parser limit ${t}`,span:{start:e,end:e}}}function RA(e){let t=[],n=[],r=0,o=0,i=!1,s=()=>{if(n.length>0)t.push(n);n=[]};while(r<e.length&&r<131072&&o<16384){let a=e[r];if(a==="\r"||a===`
-`){s(),r+=a==="\r"&&e[r+1]===`
-`?2:1;continue}if(/\s/.test(a??"")){r++;continue}let c=Wb(e,r,Math.min(e.length,ws.maxInputLength),ws.maxDepth);if(c){i||=!!c.issue||c.limited,r=c.next;continue}let l=du(e,r);if(l){s(),r+=l.length;continue}if(a==="{"||a==="}"){s(),r++;continue}let u=au(e,r,Math.min(e.length,ws.maxInputLength),ws,0);if(u.word.text)n.push(u.word.text);for(let d of u.nested)t.push(...lu(d));o++,r=u.next>r?u.next:r+1}return s(),{commands:t,invalidComment:i}}function lu(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return lu(t.body);if(t.kind!=="command")return[];return[t.words.map((n)=>n.text),...t.nested.flatMap(lu)]})}function du(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function Wb(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`,span:{start:t,end:i+2}},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed",span:{start:t,end:n}},limited:!1}}function PA(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function su(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}var vn=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function rt(e,t="auto",n=vn){if(t==="powershell"||t==="auto"&&Db(e.slice(0,n.maxInputLength)))return Mb(e,n);return Eb(e,n)}function po(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var AA=/^[A-Za-z_][A-Za-z0-9_]*=/;function Rs(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Ps(e){let t=Rs(e.words[0],"time")?1:0,n=t===1&&Rs(e.words[t],"-p")?t+1:t,r=t===1&&Rs(e.words[n],"--")?n+1:n,o=Rs(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!AA.test(s.text));return i?.provenance==="literal"?i.text:void 0}function go(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function ir(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of kA(e))go(n,t);return t.inSingle||t.inDouble}function kA(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);go(s,n)}return t}var TA=new Set(["&&","||","|&","|","&",";"]),IA=new Set(["<<","<<<",">|"]),OA=/[*@#?$!_-]/,zA=/^\w+(?::\w+)*/,mu=Object.freeze([]),NA=Object.freeze([]),DA=256;function Ub(e,t){let n=t.status==="complete"?new Set(pu(t)):new Set,r=[...n].reduce((s,a)=>s.slice(0,a.start)+" ".repeat(a.end-a.start)+s.slice(a.end),e);if(ir(r))return As("unclosed-quote",r,mu);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=ho(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return As("structural-limit",r,mu);if(o.invalid)return As("invalid",r,mu);return As("complete",r,i,o.assignmentFallbacks)}function As(e,t,n,r=NA){return Object.freeze({status:e,source:t,entries:Object.freeze(n),assignmentFallbacks:Object.freeze(r)})}function ho(e,t){return e.nodes.flatMap((n,r)=>MA(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.entries])}function MA(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,entries:[ot(GA(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,entries:[ot(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,entries:[i?ks("{"):ot("("),...ho(e.body,a),...s?[i?ks("}"):ot(")")]:[]]}]}let o=jA(e,r.functions);if(o){if(r.depth>=vn.maxDepth||++r.flags.expansions>DA)return r.flags.limited=!0,[];return[{start:e.span.start,entries:[...Fb(e,r),ks(";"),...ho(o,{...r,depth:r.depth+1}),ks(";")]},...Gb(e,t,n,r)]}return[{start:e.span.start,entries:Fb(e,r)},...Gb(e,t,n,r)]}function Fb(e,t){return[...e.words.map((n)=>({start:n.span.start,entries:Vb(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,entries:$A(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.entries)}function $A(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Vb(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[gu(String(e.fd))],Object.freeze({kind:"redirection",operator:r,role:ZA(r),targetOrder:IA.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s}}),...s===void 0?o:o.slice(1)]}function Gb(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[gu(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[ot(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,entries:a}];return[{start:s.bodySpan.start,entries:[...Bb(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?LA(t,n,r):[]]}function LA(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,entries:Bb(n.source.slice(r.span.end,e.span.end),n)}]}function Bb(e,t){if(t.depth>=vn.maxDepth)return t.flags.limited=!0,[];let n=rt(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=ho(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Vb(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,c=()=>{if(a&&!r)o.push(ot("glob"));else if(s!==""||e.quoted&&o.length===0)o.push(gu(s));s="",a=!1};for(let l of e.parts){if(l.provenance!=="command-substitution"&&l.provenance!=="arithmetic"){for(let f of fu(l.raw,i,n.flags,n.powershell)){if(typeof f==="string"){c(),o.push(ot(f));continue}s+=f.text,a||=f.glob}continue}if(i.double){let f=n.source.slice(l.span.start,l.span.end);s+=fu(f,{single:!1,double:!0},n.flags,n.powershell).map((p)=>typeof p==="string"?p:p.text).join("");continue}let u=t.nested.find((f)=>f.span.start>=l.span.start&&f.span.end<=l.span.end),d=u?ho(u,n):[];if(l.raw.startsWith("`")){s+="${}",c(),o.push(...d);continue}if(l.raw.startsWith("<(")||l.raw.startsWith(">(")){c(),o.push(l.raw.startsWith("<(")?ot("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),...d,...l.raw.endsWith(")")?[ot(")")]:[]);continue}let m=l.raw.startsWith("$((")?2:1;s+="${}",c(),o.push(...Array.from({length:m},()=>ot("(")),...d,...l.raw.endsWith(")".repeat(m))?Array.from({length:m},()=>ot(")")):[])}return c(),o}function fu(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let c=e[a]??"";if(!t.single&&!t.double&&(c==="("||c===")")){o.push({text:i,glob:s},c),i="",s=!1,a++;continue}if(r&&c==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single){if(c==="'")t.single=!1;else i+=c;a++;continue}if(t.double){if(c==='"'){t.double=!1,a++;continue}if(!r&&c==="\\"){let l=e[a+1]??"";i+=['"',"\\","$"].includes(l)?l:`\\${l}`,a+=2;continue}if(c==="$"){let l=Zb(e,a,t,n,r);i+=l.text,a=l.next;continue}i+=c,a++;continue}if(c==="'"||c==='"'){t.single=c==="'",t.double=c==='"',a++;continue}if(!r&&c==="\\"){let l=e[a+1]??"";s||=l==="*"||l==="?",i+=l,a+=2;continue}if(c==="$"){let l=Zb(e,a,t,n,r);i+=l.text,a=l.next;continue}s||=c==="*"||c==="?",i+=c,a++}return[...o,{text:i,glob:s}]}function Zb(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=FA(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let c=e.slice(t,a+1);return WA(c,n,r,o),{text:c,next:a+1}}if(i!==void 0&&OA.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?zA:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function WA(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((l)=>s.startsWith(l));if(!a)return;let c=fu(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...c.flatMap((l)=>typeof l==="string"||!l.text?[]:[l.text]))}function FA(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;else if(e[r]==="}")n--;r++}return n===0?r-1:-1}function GA(e){return/^[\r\n]+$/.test(e)?";":e}function ot(e){return Object.freeze({kind:"operator",operator:e,boundary:TA.has(e)})}function ks(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function gu(e){return Object.freeze({kind:"word",text:e})}function ZA(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function pu(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return pu(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((s)=>pu(s)),o=e.nodes[n+1];if(o?.kind==="connector"&&(o.operator==="|"||o.operator==="|&")||!BA(t))return r;return[...r,...t.redirections.flatMap((s)=>s.heredoc?.quotedDelimiter?[s.heredoc.bodySpan]:[])]})}function jA(e,t){let n=Ps(e);return n===void 0?void 0:t.get(n)}function Ht(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function UA(e){if(Ht(e.words[0],"git"))return Ht(e.words[1],"commit");if(!Ht(e.words[0],"gh")||!Ht(e.words[2],"create"))return!1;return Ht(e.words[1],"pr")||Ht(e.words[1],"issue")}function BA(e){return(Ht(e.words[0],"cat")||Ht(e.words[0],"tee")||UA(e))&&!e.words.some(jb)&&!e.redirections.some((n)=>jb(n.target))}function jb(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}import{types as VA}from"util";var HA=new Set(["applypatch","patch"]),qA=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),KA=new Set(["grep","grepsearch","rg"]),YA=new Set(["find","findbyname","glob"]),JA=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),XA=new Set(["command","diff","input","patch","patchtext"]),Hb=new TextEncoder,QA=new TextDecoder,ek=/\s/,tk=64;class $t extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var yo=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Xb(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Is(e){return JA.has(Xb(e))}function vu(e){let t=Xb(e);if(HA.has(t))return"patch";if(KA.has(t))return"grep";if(YA.has(t))return"glob";if(qA.has(t))return"path";return"unknown"}function vo(e){if(!e||typeof e!=="object")return;rv(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)gt();return}if(t.get||t.set)gt();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function _u(e,t){return Qb(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Qb(e,t,n,r){let o=nv(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let c=Qb(a,t,n,r+1);return typeof a==="string"&&t.has(ev(s))?[a]:c});return n.ancestors.delete(o.object),i}function ev(e){return e.replace(/-/g,"_").toLowerCase()}function Su(e){return tv(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(rk)}function tv(e,t,n,r){let o=nv(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>tv(a,o.array?t:XA.has(ev(s)),n,r+1));return n.ancestors.delete(o.object),i}function nk(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>yo.maxDepth||t.nodes>yo.maxNodes)gt();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>yo.maxStringBytes||t.stringBytes>yo.maxAggregateStringBytes)gt()}function nv(e,t,n){if(nk(e,t,n),!e||typeof e!=="object")return null;let r=rv(e);if(t.ancestors.has(e))gt();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>yo.maxKeys)gt();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)gt();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function rv(e){if(VA.isProxy(e))gt();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)gt();return t}function gt(){throw new $t}function rk(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let c=0;c<n.length;c++){let l=n[c]??"";if(l==="*** Begin Patch"){r=!0,a();continue}if(l==="*** End Patch"){r=!1,a();continue}if(l.startsWith("@@")){let u=ok(l);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=l.startsWith(" ")||l.startsWith("-")?1:0,d=l.startsWith(" ")||l.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-d),i===0&&s===0)a();continue}if(l.startsWith("*** ")){a(),t.push(...hu(l));continue}if(o)continue;if(l.startsWith("diff --git ")){t.push(...hu(l));continue}if(l.startsWith("--- ")){let u=n[c+1]??"";if(!u.startsWith("+++ "))continue;t.push(...bu(Ts(l.slice(4),!0),Ts(u.slice(4),!0))),c++;continue}if(!r)t.push(...hu(l))}return t}function ok(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function hu(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Jb(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Jb(n[1]);if(e.startsWith("diff --git "))return ik(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Yb(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Yb(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return mk(i[1]);return[]}function ik(e){let t=sk(e);if(t.length===2&&t[0]&&t[1])return bu(t[0],t[1]);let n=ak(e);return n?bu(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function sk(e){let t=[],n=0;while(n<e.length&&t.length<2){while(_n(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!_n(e[n]))n++;t.push(e.slice(i,n));continue}let o=ov(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(_n(e[n]))n++;return n===e.length?t:[]}function ak(e){let t=0;while(t<e.length&&_n(e[t]))t++;let n=e.length;while(n>t&&_n(e[n-1]))n--;let r=0,o=t;while(o<n){if(!_n(e[o])){o++;continue}let i=o;while(o<n&&_n(e[o]))o++;if(i===t||o===n)continue;if(r++,r>tk)gt();if(ck(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function ck(e,t,n,r,o){if(yu(e,t,n,r,o))return!0;let i=qb(e,"/",t,n),s=qb(e,"/",r,o);if(i<=t||s<=r)return!1;if(yu(e,t,i,r,s))return!1;return yu(e,i+1,n,s+1,o)}function yu(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function qb(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function _n(e){return e!==void 0&&ek.test(e)}function ov(e,t,n){let r=[],o=t+1;while(o<e.length){let i=e[o]??"";if(i===n)return{value:QA.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Hb.encode(i)),o++;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Hb.encode(lk(s[0]??""))),o+=2}return null}function lk(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function uk(e){return bo(fk(e))}function bu(e,t){if(e==="/dev/null")return Kb(t);if(t==="/dev/null")return Kb(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(bo);let n=dk(e,t)??(e===t?iv(e):null);return[e,t,...n?[n]:[]].flatMap(bo)}function Kb(e){let t=iv(e);return[e,...t?[t]:[]].flatMap(bo)}function iv(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function dk(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Yb(e){return uk(Ts(e,!0))}function mk(e){return bo(Ts(e,!1))}function Ts(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=ov(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function fk(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function bo(e){return e===""||e==="/dev/null"?[]:[e]}function Jb(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}var sv=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),av=new Set([...sv,"glob"]),gk=new Set([...av,"pattern"]),hk=[],cv={parseCommand:rt,projectShellSyntax:Ub};class ht extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function _o(e,t={}){let n=yk({...cv,...t}),r=vo(e.input),o=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&r)o.push({usage:"input-candidate",source:r});if(e.route.kind==="command"&&"command"in e&&e.command)o.push({usage:"declared-command",source:e.command});let i=o.reduce((s,a)=>{let c=s.findIndex((d)=>d.source===a.source);if(c!==-1){let d=s[c];if(!d)return s;return s[c]={...d,usages:[...d.usages,a.usage]},s}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",u=n.getCommandProgram(a.source,l);return s.push({usages:[a.usage],source:a.source,program:u,shell:n.getShellSyntax(a.source,u)}),s},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:i,paths:bk(e),store:n}}function xe(e,t){return e.commands.find((n)=>n.usages.includes(t))}function yt(e){if(!e.includes("$"))return e;return Gi(e,Qe())}function yk(e={}){let t={...cv,...e},n=new Map,r=new Map,o=new WeakMap,i=(a,c)=>{let l=`${c}\x00${a}`,u=r.get(l);if(u)return u;let d=t.parseCommand(a,c);return r.set(l,d),d};return{getShellSyntax:(a,c)=>{if(c&&c.source!==a)throw TypeError("Shell syntax source does not match command program source.");let l=c??i(a,"posix");if(l.status==="limited"){let m=o.get(l);if(m)return m;let f={status:"structural-limit",source:a,entries:hk,assignmentFallbacks:[]};return o.set(l,f),f}let u=n.get(a);if(u)return u;let d=t.projectShellSyntax(a,l);return n.set(a,d),d},getCommandProgram:i}}function bk(e){let t=e.route.kind==="grep"?av:e.route.kind==="glob"?gk:sv;return[..._u(e.input,t),...e.route.kind==="patch"?Su(e.input):[]]}function Pe(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var vk=new Map([["bash",new Set(["O","o"])],["dash",new Set(["o"])],["ksh",new Set(["o"])],["sh",new Set(["o"])],["zsh",new Set(["o"])]]),_k=new Map([["zsh",new Set(["o"])]]),Sk=new Map([["bash",new Set(["--init-file","--rcfile"])]]);function lv(e,t){for(let n=0;n<t.length;n++){let r=t[n];if(r===void 0||r==="--"||r==="-"||r[0]!=="-"&&r[0]!=="+")return null;if(r.startsWith("--")){let s=Sk.get(e);if(Ck(r,s))continue;if(!s?.has(r))continue;if(t[n+1]===void 0)return null;n++;continue}let o=xk(e,r);if(o.commandSelected)return t[n+o.followingValues+1]??null;let i=t[n+1];if(e==="ksh"&&(r==="-o"||r==="+o")&&i!==void 0&&i[0]!=="-"&&i[0]!=="+")n++;n+=o.followingValues}return null}function xk(e,t){let n=vk.get(e),r=_k.get(e),o=!1,i=0;for(let s=1;s<t.length;s++){let a=t[s];if(a===void 0)break;if(t[0]==="-"&&a==="c")o=!0;if(e==="ksh"&&a==="o"){if(s+1<t.length){let c=t.slice(s+1);if(!o&&t[0]==="-"&&c==="c")continue;if(!o&&t[0]==="-"&&c[0]==="-"&&c.endsWith("c"))o=!0;break}if(o)i++;continue}if(!n?.has(a))continue;if(r?.has(a)&&s+1<t.length)break;i++}return{commandSelected:o,followingValues:i}}function Ck(e,t){return t!==void 0&&[...t].some((n)=>e.startsWith(`${n}=`))}var Pk=new Set(["-S","--suffix"]);function sr(e,t,n,r){if(e.status==="structural-limit")throw new ht;if(e.status!=="complete")return r.findMalformedTarget(e.source);let o={cwd:t,variables:new Map},i=[];for(let s of e.entries){if(s.kind==="operator"){if(!s.boundary)continue;let a=r.findSegmentTarget(i,o);if(a)return a;o=Ak(i,o,n,r.normalizeCwd),i=[];continue}if(s.kind==="redirection"){if(s.role==="file-write"&&s.target&&r.isRedirectionTarget(Le(s.target,o.variables),o))return s.target;continue}i.push(s.text)}return r.findSegmentTarget(i,o)}function Le(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:Le(i,t);return a?Le(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function So(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function dv(e,t,n){let r=n.environment.home,o=Gi(e.trim(),n.environment).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?uv(r,o.slice(2)):o,s=ze(i);return Rk(wk(s)?s:uv(t,s))}function ye(e,t,n){let r=dv(e,t,n);if(!r)return"";return X(r,n.environment.paths,n).replace(/\\/g,"/")}function mv(e,t,n,r){let o=dv(e,t,n);if(!o)return null;if(r(Ek(o)))return X(o,n.environment.paths,n).replace(/\\/g,"/");let i=Cy(o,n.environment.paths,n);return i===null?null:i.replace(/\\/g,"/")}function Os(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&Pk.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}function Ak(e,t,n,r){let o=So(e)?new Map([...t.variables,...kk(e,t.variables)]):t.variables,i=Bt([...e],n.environment),s=F(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;return{cwd:!s||s==="-"?t.cwd:r(Le(s,o),t.cwd,n),variables:o}}function kk(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],Le(o,t)]]:[]})}var Ke="Git metadata and hooks are protected. Ask the user before modifying them.";function hv(e,t=Cu([e.invocation.context.executionCwd,e.invocation.context.configCwd])){let n=Ot(Qe()),r=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Is(e.invocation.toolName))return null;let s=e.paths.find((a)=>Mk(a,r,t,n));return s?{target:s}:null}if(e.invocation.route.kind!=="command")return null;let o=xe(e,"input-candidate");if(!o)return null;let i=sr(o.shell,r,n,{findSegmentTarget:(s,a)=>Lk(s,a,t,n),isRedirectionTarget:(s,a)=>$k(s,a.cwd,t,n),findMalformedTarget:()=>null,normalizeCwd:ye});return i?{target:i}:null}function Cu(e,t=Ot(Qe())){let n=[...new Map(e.filter((r)=>typeof r==="string"&&r!=="").flatMap((r)=>{let o=ro(ye(r,r,t));return o?[[it(o),{dotGitPath:o,cwd:r}]]:[]})).values()].flatMap((r)=>Ok(r.dotGitPath,r.cwd,t));if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.map((r)=>r.entry))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFile?[r.markerFile]:[]))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Ok(e,t,n){try{let r=ye(e,t,n),o=Tk(e),i=o.isFile()?r:null,s=o.isFile()?Vl(e):null,a=(o.isDirectory()?[r]:[s?.gitDir,s?.commonDir]).flatMap((l)=>l?[it(ye(l,t,n))]:[]),c=[...new Set(o.isDirectory()?[it(e.replace(/\\/g,"/")),...a]:a)];return[{entry:it(r),markerFile:i?it(i):null,directories:c,hooksDirectories:[...new Set(c.flatMap((l)=>{let u=it(Ik(l,"hooks"));return[u,it(ye(u,t,n))]}))]}]}catch{return[]}}function Sn(e,t,n,r,o,i=!1){if(!n)return!1;let s=it(ye(e,t,o)),a=s.replace(/(\/\.?\*+)+$/,"");if(a!==s&&a!==""){if(xu(a,n))return!0;let c=i||s.slice(a.length).includes("/."),l=(u)=>c?zs(u,a):zk(u,a);if(n.markerFiles.some(l))return!0;return r&&fv(n).some(l)}if(xu(s,n))return!0;return r&&fv(n).some((c)=>zs(c,s))}function zk(e,t){let n=gv(t,e);if(n===""||n.startsWith("..")||pv(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function Nk(e,t,n,r){return Sn(e,t,n,!0,r)}function Dk(e,t,n,r){if(!n)return!1;return xu(it(ye(e,t,r)),n)}function Mk(e,t,n,r){if(!n)return!1;return yv(e,t,n,r,n.entries)}function $k(e,t,n,r){if(!n)return!1;return yv(e,t,n,r,n.markerFiles)}function yv(e,t,n,r,o){let i=it(ye(e,t,r));return o.includes(i)||vv(i,n)}function bv(e,t,n,r){if(!n)return!1;return n.hooksDirectories.some((o)=>e.some((i)=>zs(o,it(ye(i,t,r)))))}function xu(e,t){return t.entries.includes(e)||t.directories.includes(e)||vv(e,t)}function vv(e,t){return t.hooksDirectories.some((n)=>zs(e,n))}function fv(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function zs(e,t){let n=gv(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!pv(n)}function it(e){return process.platform==="win32"?e.toLowerCase():e}function Lk(e,t,n,r){if(So(e))return null;let o=Vt([...e],r.environment);if(F(o[0]??"").toLowerCase()!=="mv")return null;let i=Os(o.slice(1)),s=i.sources.find((a)=>Nk(Le(a,t.variables),t.cwd,n,r));if(s)return s;return i.destination&&Dk(Le(i.destination,t.variables),t.cwd,n,r)?i.destination:null}import{isAbsolute as Eu,join as Wk,normalize as Fk,sep as Ns}from"path";var _v=process.platform==="win32",Gk=/[*?]/;function xo(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Ms(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=xo(e.trim(),t);if(!Eu(n))return"must be an absolute path or start with ~/";return Co(n,t)}function $s(e,t){let n=Sv(e,t);if(n===null)return"must be a non-empty path string";if(!Eu(n))return null;if(Co(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Zk="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",jk="cannot cover the guard's own configuration";function Sv(e,t){if(typeof e!=="string"||e.trim()==="")return null;return xo(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Ls(e,t){let n=Sv(e,t);if(n===null)return"must be a non-empty path string";if(Gk.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!Eu(n))return null;if(Co(n,t)!==null)return Zk;return Uk(n,t)?jk:null}function Uk(e,t){let n=Ds(e),r=Ds(Wk(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Ns}`)}function Co(e,t){let n=Ds(e),r=Ds(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Ns)?n:`${n}${Ns}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Ds(e){let t=Fk(e);if(_v)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(_v?3:1)&&t.endsWith(Ns))t=t.slice(0,-1);return t}var Hk=process.platform==="win32",xv=64,qk=16384;function Eo(e){let t=kb(e,xv,xv,qk);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:Kk(e)}}function Kk(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>Yk(e.raw,n.span.start-e.span.start))}function Yk(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function xn(e){let t=e.environment.home,n=e.environment.paths,r=Ot(e.environment);return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:tT(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,pathCanonicalizationContext:r}}function st(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&rT(e))return{kind:"outside_anchored_cwd"};let o=!r&&Rv(e,t.posixShell);if(Zt(e))return{kind:"outside_anchored_cwd"};if(Au(e,r))return{kind:"root_or_home_target"};if(Jk(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Sn(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.pathCanonicalizationContext,!t.posixShell))return{kind:"git_metadata_target"};if(Xk(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(nT(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&aT(i,t.environment.home,t.environment.paths,t.pathCanonicalizationContext))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&cT(e,t.resolvedCwd??i,t.environment.paths,t.pathCanonicalizationContext))return{kind:"cwd_self_target"};if(lT(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.pathCanonicalizationContext))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function Ev(e,t,n={}){let{containmentTarget:r,...o}=n;if(st(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(eT(i))return!1;if(ub(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>uT(r??i,s,t.environment.paths,t.pathCanonicalizationContext))}function Au(e,t=!1){let n=e.trim(),r=Cv.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function Jk(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Pu(o)?o:t.resolvedCwd?ar(t.resolvedCwd,o):null;if(!i)return!1;let s=Ae(X(i,t.environment.paths,t.pathCanonicalizationContext));if(s===Vk(s).root)return!0;return s===Ae(X(t.environment.home,t.environment.paths,t.pathCanonicalizationContext))}catch{return!1}}function Ae(e){let t=Bk(e);if(Hk){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function Xk(e,t,n,r,o,i,s,a){let c=e.trim();if(wv(c))return!1;if(!r&&Xl(c,a))return!0;return(t||i&&s)&&n&&!o&&Qk(c,n)}function Qk(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Rv(e.slice(n.length+1),t)})}function eT(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Cv.normalize(`/${t[1]??""}`)==="/"}function wv(e){return e.split(/[\\/]+/).includes("..")}function tT(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=xo(o.trim(),t);if(!Pu(i))return[];try{let s=X(i,n,r);if(Co(s,X(t,n,r)))return[];return[Ae(s)]}catch{return[]}})}function nT(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(wv(r))return!1;let o=n?r:xo(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Pu(o)?o:i?ar(i,o):null;if(!s)return!1;try{let a=Ae(X(s,t.environment.paths,t.pathCanonicalizationContext));return t.allowRoots.some((c)=>a===c||a.startsWith(c.endsWith(Ru)?c:`${c}${Ru}`))}catch{return!1}}function rT(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Rv(e,t=!1){return e.includes("$")||e.includes("`")||oT(e)||t&&iT(e)}function oT(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function iT(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&sT(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function sT(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function aT(e,t,n,r){try{return Ae(X(e,n,r))===Ae(X(t,n,r))}catch{try{return Ae(e)===Ae(t)}catch{return!1}}}function cT(e,t,n,r){if(e==="."||e==="./"||e===".\\")return!0;try{return Ae(X(ar(t,e),n,r))===Ae(X(t,n,r))}catch{try{return Ae(ar(t,e))===Ae(t)}catch{return!1}}}function lT(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return wu(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return wu(ar(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return wu(ar(a,e),t,i,s)}catch{return!1}}function wu(e,t,n,r){try{return Pv(X(e,n,r),X(t,n,r))}catch{return!1}}function uT(e,t,n,r){if(!t)return!1;try{return Pv(X(t,n,r),X(e,n,r))}catch{return!0}}function Pv(e,t){let n=Ae(e),r=Ae(t);return n.startsWith(`${r}${Ru}`)||n===r}var dT=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Av="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",mT="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",kv="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Tv="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",fT="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",pT="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.";function Iv(e,t,n,r=xn({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return gT(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function gT(e,t,n,r){let o=e.filter((c)=>c.kind==="word"),i=yT(o),s=o[i];if(!s||!dT.has(RT(s.text)))return null;let a=hT(o.slice(i+1));if(a.whatIfProtected)return null;if(de(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",pT);for(let c of a.targets)if(!Zt(c.text)&&Au(Tu(c.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Tv);for(let c of a.targets)if(n.resolvedCwd&&Sn(Tu(c.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.pathCanonicalizationContext,!0))return v("powershell.remove-item-git-metadata",Ke);if(!a.recursive||!a.force)return null;if(de(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",kv);for(let c of a.targets){let l=PT(st(Tu(c.text),n),n,r);if(l)return l}return null}function hT(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let c=e[a];if(!c||c.kind!=="word")continue;if(bT(c))continue;if(s){t.push(ku(c)),i=i||c.dynamic;continue}if(c.text==="--"){s=!0;continue}let l=_T(c.text);if(!l){t.push(ku(c)),i=i||c.dynamic;continue}if(ST(l.name)){let u=l.value?vT(l.value,c):e[++a];if(u?.kind==="word")t.push(ku(u)),i=i||u.dynamic;else i=!0;continue}if(xT(l.name)){n=!0;continue}if(CT(l.name)){r=!0;continue}if(ET(l.name))o=wT(l.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function yT(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function ku(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function bT(e){return e.kind==="word"&&e.text===","}function Tu(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function vT(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function _T(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function ST(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function xT(e){return"recurse".startsWith(e)}function CT(e){return e.length>=2&&"force".startsWith(e)}function ET(e){return e==="wi"||"whatif".startsWith(e)}function wT(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function RT(e){return e.toLowerCase()}function PT(e,t,n){switch(e.kind){case"root_or_home_target":return v("powershell.remove-item-recursive-force-root-or-home",Tv);case"git_metadata_target":return v("powershell.remove-item-git-metadata",Ke);case"temp_target":return null;case"dynamic_target":if(!de(n,"powershell.remove-item-recursive-force-dynamic-target",t.strict))return null;return v("powershell.remove-item-recursive-force-dynamic-target",kv);case"home_cwd_target":return v("powershell.remove-item-recursive-force-home-cwd",fT);case"cwd_self_target":return v("powershell.remove-item-recursive-force-cwd-self",Av);case"within_anchored_cwd":if(!de(n,"powershell.remove-item-recursive-force-paranoid",t.paranoid))return null;return v("powershell.remove-item-recursive-force-paranoid",mT);case"outside_anchored_cwd":return v("powershell.remove-item-recursive-force-outside-cwd",Av)}}import{normalize as ea}from"path";var We=new Set(["awk","gawk","nawk","mawk"]),AT=new Set(["-e","--source"]),kT=new Set(["-F","-v","--assign","--field-separator"]),Ov=new Set(["-f","--file"]),TT=new Set(["print","printf","return"]),zv=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],IT="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Gs(e,t,n){let r=!1;for(let o of OT(e)){let i=zT(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",IT):null}function Ou(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&AT.has(a)){n=!0;let c=e[s+1];if(c!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:c});else i=!1;s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(kT.has(a)||Ov.has(a))){if(Ov.has(a)){r=!0;let c=e[s+1];if(c!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:c});else i=!1}else if(e[s+1]===void 0)i=!1;s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function Ro(e){return Ou(e).sources}function OT(e){return Ro(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function zT(e,t){Ne(t,e);let n=e.includes("system")?zu(e,t):null,r=NT(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function zu(e,t){Ne(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Fs(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Nv(e,i+1);continue}if(s==="/"&&Dv(e,i)){i=Mv(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,wo(e[a-1])||wo(e[i]))continue;let c=Ws(e,i);if(e[c]!=="(")continue;c=Ws(e,c+1);let l=e[c];if(l!=='"'&&l!=="'"){r=!0,o=!0;continue}let u=Fs(e,c,l);if(!u){r=!0,o=!0;continue}if(c=Ws(e,u.endIndex),r=!0,e[c]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=c+1}if(!r)return null;return{dynamic:o,commands:n}}function NT(e,t){Ne(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,c=null,l=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=Fs(e,i,u);if(f&&l===s)c={...f,startIndex:i};l=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=Nv(e,i+1),s=i,a=null,c=null,l=i;continue}if(u==="/"&&Dv(e,i)){let f=Mv(e,i+1);l=f??i+1,i=f??i+1;continue}if(`;
-{}`.includes(u)){i++,s=i,a=null,c=null,l=i;continue}if(a===null&&(Iu(e,i,"print")||Iu(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))l=i+1;i++;continue}let d=e[i+1]==="&"?i+2:i+1,m=Ws(e,d);if(Iu(e,m,"getline")){o=!0;let f=$T(s,c,l);if(f===null)r=!0;else n.push(f);l=d,i=d;continue}if(WT(s,a)){o=!0;let f=MT(e,m);if(!f){r=!0,l=d,i=d;continue}if(!DT(e,f.endIndex)){r=!0,l=f.endIndex,i=f.endIndex;continue}n.push(f.value),l=f.endIndex,i=f.endIndex;continue}l=d,i++}if(!o)return null;return{dynamic:r,commands:n}}function wo(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Ws(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function DT(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Fs(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=LT(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function MT(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Fs(e,t,n)}function $T(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function LT(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function Iu(e,t,n){return e.startsWith(n,t)&&!wo(e[t-1])&&!wo(e[t+n.length])}function WT(e,t){return t!==null&&t>=e}function Nv(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Dv(e,t){let n=FT(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(wo(e[r-1]))r--;return TT.has(e.slice(r,n+1))}function FT(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Mv(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var $v=new Set(["rm","find","xargs","parallel"]),GT=new Set(["sudo","env","command","builtin"]),ZT=new Set(["git","busybox",...$v,...me,...eb,...We]);function Zs(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(F(n)))return null;let r=F(n),o=e[1]==="--"?2:1,i=jT(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function jT(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;if(F(a)!==n&&UT(a,r))i.push(s);else if(ts.has(H(a)))break;if(o)break}return i}function UT(e,t){let n=F(e),r=H(e);return r==="git"||n==="busybox"||Cn(e)||$v.has(n)||t.transparentWrappers.includes(n)||me.has(r)||e==="$SHELL"||Me(r)||We.has(r)||t.rules.some((o)=>o.command===n)}function Cn(e){return GT.has(e.toLowerCase())}function Lv(e){let t=H(e);return ZT.has(t)||Me(t)}function at(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return js([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*js(e,t,n,r,o,i,s,a,c){let l=ps(e,t,n,i);for(let[f,p]of l.envAssignments)i.set(f,p),o.set(f,p);let{tokens:u,cwd:d}=l;if(l.envSplitValues){let f=fs(l.envSplitValues,u);if(!f)throw new De;Nu(a),yield*js(f,t,d,r,o,i,s,a,c);return}if(Cn(u[0]??""))throw new De;let m=Zs(u,s);if(m){for(let f of[m.childIndex,...m.alternativeChildIndices])Nu(a),yield*js(f===m.childIndex?m.tokens:[...u.slice(f)],t,d,r,new Map(o),new Map(i),s,a,!0);return}if(VT(u)){Nu(a),yield*js([...u.slice(1)],t,d,r,o,i,s,a,c);return}yield BT(u,d,r,o,i,c)}function BT(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:F(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function Nu(e){if(e.iterations>=Xn)throw new De;e.iterations++}function VT(e){return F(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function Du(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function ct(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||Mu(r,"recursive"))t=!0;else if(r==="-f"||Mu(r,"force"))n=!0;else if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Wv(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>Mu(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function Mu(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var HT="find -delete permanently removes files. Use -print first to preview.",qT="find -exec rm -rf is dangerous. Use explicit file list instead.",KT=new Set(["-exec","-execdir","-ok","-okdir"]),YT=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Us(e,t){let n=e.map(N),r=JT(e,n,t);if(r)return r;if(Vs(n,1)&&!QT(e,n,t)){let s=z(v("find.delete",HT),t.policy);if(s)return s}let o=t.derivedCommandWorkBudget??Qi(),i=0;while(i<n.length){let s=n[i],a=qt(s??"");if(a>0){i+=a+1;continue}if(!Lt(s)){i++;continue}et(o,n.length-i-1);let c=Po(n,i);i=c.nextIndex;let l=tI(c.tokens,t.environment);if(l){let f=z(l,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",d=t.analyzeTokens?t.analyzeTokens(c.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(c.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,m=d?.id.startsWith("custom.")?d:z(d,t.policy);if(m)return m}return null}function JT(e,t,n){if(!Vs(t,1)&&!$u(t,n.environment))return null;let o=Bs(e)??j(["."]),i=xn({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=Eo(s);for(let c of a.expandedTargets??[N(s)]){let l=st(c,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(l.kind==="root_or_home_target")return v("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(l.kind==="git_metadata_target")return v("find.delete-git-metadata",Ke)}}if(XT(t)&&i.resolvedCwd&&bv(o.map(N),i.resolvedCwd,i.protectedGitMetadata,i.pathCanonicalizationContext))return v("find.delete-git-metadata",Ke);return null}function $u(e,t){let n=0;while(n<e.length){if(!Lt(e[n])){n++;continue}let r=Po(e,n),o=Vt([...r.tokens],t),i=F(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function XT(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function QT(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Bs(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Jl(o,n.environment),s=n.trustedTmpdirValue??Mt(o,n.environment),a=n.allowTmpdirVar??!lo(o,n.environment),c=xn({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??pt(o,n.environment),trustedTmpdirValue:s});return r.every((l)=>{let u=Eo(l);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[N(l)]).every((d)=>Ev(d,c,{containmentTarget:eI(d,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function eI(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Bs(e){let t=(o)=>{let i=e[o];return i?N(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function tI(e,t){let n=Bt([...e],t);if(n.length===0)return null;let r=F(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=F(n[0]??"");if(r==="rm"&&ct(n))return v("find.exec-rm-recursive-force",qT);return null}function Po(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Vs(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Lt(r)){n=Po(e,n).nextIndex;continue}let o=qt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function qt(e){return YT.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Lt(e){return e!==void 0&&KT.has(e)}function Ao(e){let t=rt(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var nI=5,Lu="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function Ce(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Gv(e,t,n){let r=jv(e,t,n),o=rI(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<nI;a++){let{subcommand:c,rest:l}=lt(i),u=c?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let d=o.get(u),m=cI(d);if(m===null||m.length===0)return{blockedReason:Lu,expanded:!0,tokens:i};i=["git",...m,...l],s=!0}return{blockedReason:Lu,expanded:!0,tokens:i}}function Zv(e,t,n){return jv(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function lt(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?F(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(o.startsWith("-"))if(He.has(o))r+=2;else if(o.startsWith("-c")&&o.length>2)r++;else if(o.startsWith("-C")&&o.length>2)r++;else r++;else return{subcommand:o,rest:e.slice(r+1)}}return{subcommand:null,rest:[]}}function rI(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function jv(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?F(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=iI(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...oI(e,t,n)]}}function oI(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Wu(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Wu(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Fv(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Fv(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(He.has(i)){o+=2;continue}o++}return r}function iI(e,t){let n=sI(e,t),r=aI(e,t);return{blockedReason:n===null||r===null?Lu:null,entries:[...n??[],...r??[]]}}function sI(e,t){let n=Ve("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=Ao(n);if(!o)return null;for(let i of o){let s=Wu(i);if(!s)return null;r.push(s)}return r}function aI(e,t){let n=Ui(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Ve(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Ve(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Wu(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Fv(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Ve(e.slice(r+1),t,n)}}function cI(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return Ao(t)}var lI="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",uI="git checkout --force discards uncommitted changes. Use 'git stash' first.",dI="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",mI="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",fI="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",pI="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",gI="git switch --force discards uncommitted changes. Use 'git stash' first.",hI="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",yI="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",bI="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",vI="git reset --merge can lose uncommitted changes. Use 'git stash' first.",_I="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",SI="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",xI="git push --force destroys remote history. Use --force-with-lease for safer force push.",CI="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",EI="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",wI="git branch -D force-deletes without merge check. Use -d for safe delete.",RI="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",PI="git merge --abort discards merge conflict resolutions. Use 'git status' first.",AI="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",kI="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",TI="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",II="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",OI="git worktree remove --force can delete uncommitted changes. Remove --force flag.",Uv=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Bv=new Set(["--recurse-submodules","--track","-t"]),Fu=new Set(["-b","-B","-U"]),Gu=new Set(["-c","-C"]),zI=new Set(["--source","--conflict","--unified","--inter-hunk-context"]),NI=new Set(["-q","--quiet","--no-quiet","-f","--force","--no-force","-d","--detach","--no-detach","-m","--merge","--no-merge","-p","--patch","--no-patch","--guess","--no-guess","--overlay","--no-overlay","--ours","--theirs","--ignore-skip-worktree-bits","--no-ignore-skip-worktree-bits","--no-track","--overwrite-ignore","--no-overwrite-ignore","--ignore-other-worktrees","--no-ignore-other-worktrees","--progress","--no-progress","--pathspec-file-nul","--no-pathspec-file-nul","--no-recurse-submodules"]);function G(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var cr=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Hv(e){let{subcommand:t,rest:n}=lt(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return Kt(DI(n));case"switch":return Kt(MI(n));case"restore":return Kt(LI(n));case"reset":return FI(n);case"clean":return Kt(ZI(n));case"rm":return Kt(jI(n));case"push":return En(UI(n));case"branch":return En(HI(n));case"stash":return En(XI(n));case"worktree":return En(QI(n));case"rebase":return Kt(qI(n));case"merge":return Kt(KI(n));case"tag":return En(YI(n));case"reflog":return En(JI(n));default:return null}}function Kt(e){return e?{...e,localDiscard:!0}:null}function En(e){return e?{...e,localDiscard:!1}:null}function DI(e){let{index:t,before:n}=Ce(e),r=Pe(n,{shortOptsWithValue:Fu});if(n.some((i)=>G(i,"--force"))||r.has("-f"))return v("git.checkout-force",uI);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(G(i,"--pathspec-from-file"))return v("git.checkout-pathspec-from-file",mI)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return v("git.checkout-ref-path",dI);return v("git.checkout-double-dash",lI)}if($I(e).length>=2)return v("git.checkout-ambiguous",fI);return null}function MI(e){let{before:t}=Ce(e);if(t.some((r)=>G(r,"--discard-changes")))return v("git.switch-discard-changes",pI);let n=Pe(t,{shortOptsWithValue:Gu});if(t.some((r)=>G(r,"--force"))||n.has("-f"))return v("git.switch-force",gI);return null}function $I(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(r.startsWith("-"))if(Uv.has(r))n+=2;else if(r.startsWith("--")&&r.includes("="))n++;else if(Bv.has(r)){let o=e[n+1];if(o&&!o.startsWith("-")&&(r==="--recurse-submodules"||r==="--track"||r==="-t"))if((r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"]).includes(o))n+=2;else n++;else n++}else if(r.startsWith("--")&&!NI.has(r)&&!Uv.has(r)&&!Bv.has(r))n++;else n++;else t.push(r),n++}return t}function LI(e){let t=WI(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?v("git.restore-worktree",yI):v("git.restore-unstaged",hI)}function WI(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(zI.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let c=1;c<a.length;c++){let l=a.charAt(c);if(l==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(l==="S"){i();continue}if(l==="W"){i(!0);continue}if(l==="p"){n=!0;continue}if(l==="s"||l==="U"){if(c===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function FI(e){let t=null;for(let n of e){if(G(n,"--hard")){t=v("git.reset-hard",bI);break}if(G(n,"--merge")){t=v("git.reset-merge",vI);break}}if(!t)return null;return GI(e)?En(t):Kt(t)}function GI(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function ZI(e){for(let n of e)if(n==="-n"||G(n,"--dry-run"))return null;let t=Pe(e.filter((n)=>n!=="--"));if(e.some((n)=>G(n,"--force"))||t.has("-f"))return v("git.clean-force",_I);return null}function jI(e){let t=!1,n=!1,r=!1;for(let o of Ce(e).before){if(G(o,"--no-force")){t=!1;continue}if(G(o,"--force")){t=!0;continue}if(G(o,"--no-cached")){n=!1;continue}if(G(o,"--cached")){n=!0;continue}if(G(o,"--no-dry-run")){r=!1;continue}if(G(o,"--dry-run")){r=!0;continue}let i=Pe([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?v("git.rm-force",SI):null}function UI(e){let{before:t,after:n}=Ce(e),r=Pe(t);if(t.some((s)=>G(s,"--mirror")))return v("git.push-mirror",EI);if(t.some((s)=>G(s,"--force"))||r.has("-f")||Vv(t,n).some(BI))return v("git.push-force",xI);if(t.some((s)=>G(s,"--delete"))||r.has("-d")||Vv(t,n).some(VI))return v("git.push-delete",CI);return null}function Vv(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function BI(e){return e.startsWith("+")||e.includes(":+")}function VI(e){return e.length>1&&e.startsWith(":")}function HI(e){let{before:t}=Ce(e),n=Pe(t),r=n.has("-D")||n.has("-d")||t.some((i)=>G(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>G(i,"--force"));if(r&&o)return v("git.branch-force-delete",wI);return null}function qI(e){let{before:t}=Ce(e);return t.some((n)=>G(n,"--abort"))?v("git.rebase-abort",RI):null}function KI(e){let{before:t}=Ce(e);return t.some((n)=>G(n,"--abort"))?v("git.merge-abort",PI):null}function YI(e){let{before:t}=Ce(e);return Pe(t).has("-d")||t.some((r)=>G(r,"--delete"))?v("git.tag-delete",AI):null}function JI(e){return e[0]==="delete"?v("git.reflog-delete",kI):null}function XI(e){for(let t of e){if(t==="drop")return v("git.stash-drop",TI);if(t==="clear")return v("git.stash-clear",II)}return null}function QI(e){let{before:t}=Ce(e);if(!t.includes("remove"))return null;let r=Pe(t);if(t.some((o)=>G(o,"--force"))||r.has("-f"))return v("git.worktree-remove-force",OI);return null}import{execFileSync as eO}from"child_process";import{existsSync as ju,readFileSync as Uu}from"fs";import{dirname as tO,isAbsolute as Yv,join as Zu,resolve as Jv}from"path";var nO=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"];function Xv(e,t,n,r){let o=rO(e,t,n);if(o!==null)return o;let i=oO(t,n);if(i!==null)return i;if(Ry(n))return!0;return iO(r)}function rO(e,t,n){let r=null,o=1;while(o<e.length){let i=e[o];if(!i||i==="--")return r;if(!i.startsWith("-"))return r;if(i==="-c"){let s=qv(e[o+1]);if(s!==null)r=s;o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=qv(i.slice(2));if(s!==null)r=s;o++;continue}if(i==="--config-env"){let s=Kv(e[o+1],t,n);if(s!==null)r=s;o+=2;continue}if(i.startsWith("--config-env=")){let s=Kv(i.slice(13),t,n);if(s!==null)r=s;o++;continue}if(He.has(i))o+=2;else o++}return r}function oO(e,t){if(Ve("GIT_CONFIG_PARAMETERS",e,t)!==void 0)return!0;let n=Ui(e,t);if(n.state==="absent")return null;if(n.state==="invalid")return!0;let r=null;for(let o=0;o<n.count;o++){let i=Ve(`GIT_CONFIG_KEY_${o}`,e,t),s=Ve(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i?.trim()||s===void 0)return!0;let a=i.trim().toLowerCase();if(Bu(a))return!0;if(a!=="submodule.recurse")continue;r=ko(s)}return r}function iO(e,t=aO()){let n=sO(e);if(n===null||n)return!0;if(t===null)return!0;try{let r=eO(t,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:cO(process.env),stdio:["ignore","pipe","ignore"]}).trim();return ko(r)}catch(r){return!lO(r)}}function sO(e){let t=uO(e);if(t===null)return null;for(let n of t){if(!ju(n))continue;if(fO(n))return!0}return!1}function aO(){for(let e of nO)if(ju(e))return e;return null}function cO(e){let t={...e};for(let n of Object.keys(t))if(eo(n))delete t[n];return t}function lO(e){return typeof e==="object"&&e!==null&&"status"in e&&e.status===1}function uO(e){let t=ro(e);if(t===null)return null;let n=dO(t);if(n===null)return null;let r=mO(n);if(r===null)return null;return[Zu(r,"config"),Zu(n,"config.worktree")]}function dO(e){try{let n=Uu(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!n.startsWith("gitdir:"))return e;let r=n.slice(7).trim();if(r==="")return null;return Yv(r)?r:Jv(tO(e),r)}catch{return null}}function mO(e){let t=Zu(e,"commondir");if(!ju(t))return e;try{let n=Uu(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(n==="")return null;return Yv(n)?n:Jv(e,n)}catch{return null}}function fO(e){let t;try{t=Uu(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),c=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),l=a===-1?"true":i.slice(a+1).trim();if(pO(n)&&c==="path")return!0;if(n==="submodule"&&c==="recurse")r=ko(l)}return r}function pO(e){return e==="include"||e.startsWith("includeif ")}function qv(e){if(!e)return null;let t=e.indexOf("="),n=(t===-1?e:e.slice(0,t)).toLowerCase();if(Bu(n))return!0;if(n!=="submodule.recurse")return null;let r=t===-1?"true":e.slice(t+1).toLowerCase();return ko(r)}function ko(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Kv(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;let o=e.slice(0,r).toLowerCase();if(Bu(o))return!0;if(o!=="submodule.recurse")return null;let i=Ve(e.slice(r+1),t,n);return i===void 0||ko(i)}function Bu(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Qv(e,t,n){if(!t.localDiscard||!n.worktreeMode||Ty(n.env,n.envAssignments))return null;let r=Iy(e,n.cwd);if(!r.gitCwd||r.hasExplicitGitContext)return null;if(!Oy(r.gitCwd))return null;if(gO(e,n,r.gitCwd))return null;return{originalReason:t.reason,gitCwd:r.gitCwd}}function gO(e,t,n){let{subcommand:r,rest:o}=lt(e),i=r?.toLowerCase();if(t.dynamicArguments||hO(o)||Xv(e,t.env,t.envAssignments,n)||vO(o)||yO(i,o))return!0;return i==="clean"&&_O(o)>1}function hO(e){return e.some((t)=>/[$*?[]/.test(t))}function yO(e,t){if(e==="checkout"){let{before:n}=Ce(t),r=Pe(n,{shortOptsWithValue:Fu}),o=n.some((s)=>G(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=Ce(t),r=Pe(n,{shortOptsWithValue:Gu}),o=n.some((s)=>G(s,"--force"))||n.some((s)=>G(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||bO(s))||r.has("-C");return o&&i}return!1}function bO(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function vO(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function _O(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}var SO="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",xO=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function lr(e,t){return e_(e.map(N),t)}function e_(e,t,n){let r=Gv(e,t.env,t.envAssignments),o=r.blockedReason?z(v("git.alias-config",r.blockedReason),t.policy):null;if(o)return o;let i=r.tokens;if((wy(t.envAssignments)||Zv(e,t.env,t.envAssignments))&&CO(i))return v("git.ssh-env",SO);let s=Hv(i);if(!s)return null;if(r.expanded||r.blockedReason)return s;let a=Qv(e,s,t);if(!a)return s;return n?.(a),null}function t_(e,t){let n=null;return{match:e_(e.map(N),t,(o)=>{n=o}),relaxation:n}}function CO(e){let{subcommand:t,rest:n}=lt(e),r=t?.toLowerCase();if(!r)return!1;if(xO.has(r))return!0;if(r==="archive")return Ce(n).before.some((o)=>G(o,"--remote"));return r==="remote"&&EO(n)}function EO(e){return e.find((t)=>!wO(t))?.toLowerCase()==="update"}function wO(e){return e==="-v"||G(e,"--verbose")||G(e,"--no-verbose")}import{isAbsolute as _z}from"path";var n_="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",RO="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",PO="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",o_="rm -rf targeting root or home directory is extremely dangerous and always blocked.",AO="rm -rf in home directory is dangerous. Change to a project directory first.";function ur(e,t){let n=xn({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(N),o=ct(r),i=Wv(r),s=TO(e);for(let a of s){let c=Eo(a.word);if(o&&c.unsafeBraceExpansion){let l=z(r_({kind:"outside_anchored_cwd"},n,t.policy),t.policy);if(l)return l;continue}for(let l of c.expandedTargets??[a.text]){let u=ze(l),d={targetIsLiteral:c.expandedTargets!==void 0||c.targetIsLiteral,tmpdirWordSplittingProtected:c.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Sn(u,n.resolvedCwd,n.protectedGitMetadata,i,n.pathCanonicalizationContext))return v("rm.git-metadata",Ke);if(i&&!o){let m=st(u,n,d);if(m.kind==="root_or_home_target")return v("rm.recursive-force-root-or-home",o_);if(m.kind==="git_metadata_target")return v("rm.git-metadata",Ke);continue}if(!o)continue;for(let m of kO(u,n,d)){let f=r_(m,n,t.policy),p=z(f,t.policy);if(p)return p}}}return null}function kO(e,t,n){let r=st(e,t,n);if(r.kind==="cwd_self_target")return[r,st(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=st(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,st(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function TO(e){let t=[],n=!1;for(let r of e.slice(1)){let o=N(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}function r_(e,t,n){switch(e.kind){case"root_or_home_target":return v("rm.recursive-force-root-or-home",o_);case"git_metadata_target":return v("rm.git-metadata",Ke);case"temp_target":return null;case"dynamic_target":if(!de(n,"rm.recursive-force-dynamic-target",t.strict))return null;return v("rm.recursive-force-dynamic-target",PO);case"home_cwd_target":return v("rm.recursive-force-home-cwd",AO);case"cwd_self_target":return v("rm.recursive-force-cwd-self",n_);case"within_anchored_cwd":if(de(n,"rm.recursive-force-paranoid",t.paranoid))return v("rm.recursive-force-paranoid",RO);return null;case"outside_anchored_cwd":return v("rm.recursive-force-outside-cwd",n_)}}var IO={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},s_=new Set(["--init-file","--rcfile"]),OO=["--init-file","--rcfile"],zO=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function bt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return i_(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=i_(e,t,!1);if(r!==null)return r}}return null}function Ye(e){let t=F(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return vt(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function i_(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function a_(e){let t=F(e[0]??"").toLowerCase(),n=NO(e,t),r=zO.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function NO(e,t){let n=vt(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let c=e[a];if(c===void 0||c==="--"||c==="-"||c[0]!=="-"&&c[0]!=="+")break;if(c.startsWith("--")){if(t==="bash"&&s?OO.find((m)=>c===m):void 0){let m=e[a+1];o.push(m===void 0?{kind:"absent"}:{kind:"literal",value:m}),a++;continue}let d=c.split("=",1)[0]??c;if(t==="bash"&&s_.has(d)&&!c.includes("="))a++;continue}if(t==="bash")s=!1;let l=c_(t,c,e[a+1],"startup");if(l.interactive)i=c[0]==="-";a+=l.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}function c_(e,t,n,r){let o=!1,i=0,s=!1,a=!1,c=!1;for(let l=1;l<t.length;l++){let u=t[l];if(u===void 0)break;if(e==="ksh"&&u==="o"&&l+1<t.length){if(r==="argv"){let d=t.slice(l+1);if(t[0]==="-"&&(d==="c"||d[0]==="-"&&d.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&l+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&l+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")c=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!IO[e]?.includes(u))continue;if(l+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:c}}function vt(e){let t=F(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let c=n&&e[i+1]!==void 0?i+1:null;return{command:c===null?null:e[c]??null,commandIndex:c,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let c=s.split("=",1)[0]??s;if(t==="bash"&&s_.has(c)&&!s.includes("="))i++;continue}let a=c_(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}var Yt={kind:"none"},wn={kind:"dynamic"},DO=new Set(["<","<<","<<-","<<<","<&","<>"]),u_=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,MO=/^(?:[0-9]+|[@*])$/,$O=vn.maxWords,LO=vn.maxInputLength;function d_(e){if(!e||F(H(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`?r+2:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function Vy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var lu=new Set(["&&","||","|","|&"]);function cu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return pe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`,span:n}],nodes:[]});let r=lo(e,0,e.length,t,{used:0,max:t.maxWords},0);return pe({kind:"program",dialect:"posix",source:e,span:n,status:mo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function lo(e,t,n,r,o,i,s){let a=[],l=[],c=ro(),d=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((h)=>h.text);oo(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(s&&f===s)return m(),au(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:d};if(uo(f)){if(f===`
+`||f==="\r"){m();let b=f==="\r"&&e[u+1]===`
+`?u+2:u+1,w=a.at(-1);if(w?.kind!=="connector"||!lu.has(w.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(u,b),span:Object.freeze({start:u,end:b})}));if(d.length>0){let R=vs(e,b,n,d.splice(0));l.push(...R.issues),u=R.next;continue}u=b;continue}u++;continue}if(f==="#"){while(u<n&&e[u]!==`
+`&&e[u]!=="\r")u++;continue}let p=c.start===-1?mS(e,u,n):void 0;if(p){if(Rs(a,l,u),i>=r.maxDepth)return fn(a,l,u,"depth-limit",r.maxDepth);if(!Es(o))return fn(a,l,u,"word-limit",r.maxWords);let b=lo(e,p.braceIndex+1,n,r,o,i+1,"}"),w=b.next,R={start:p.braceIndex+1,end:b.closed?w-1:w},A=ou(e,R,b);if(a.push({kind:"function",name:p.name,span:{start:u,end:w},body:A}),l.push(...b.issues),b.pendingHeredocs.length>0||Vn(b.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely",span:{start:u,end:w}});if(d.push(...b.pendingHeredocs),b.limited)return ao(a,l,b.next);if(!b.closed)l.push({code:"unclosed-function-body",message:"function body is not closed",span:{start:p.braceIndex,end:w}});u=w;continue}let h=co(e,u);if(h){if(m(),!yu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`,span:{start:u,end:u+h.length}});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:u,end:u+h.length})})),u+=h.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis",span:{start:u,end:u+1}}),a.push({kind:"unknown",source:f,span:{start:u,end:u+1}}),u++;continue}if((f==="("||f==="{"&&eS(e,u,n))&&c.start===-1){if(Rs(a,l,u),i>=r.maxDepth)return fn(a,l,u,"depth-limit",r.maxDepth);let b=f==="("?")":"}",w=lo(e,u+1,n,r,o,i+1,b),R=w.next,A={start:u+1,end:w.closed?R-1:R},K=ou(e,A,w);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:u,end:R},body:K}),l.push(...w.issues),w.pendingHeredocs.length>0||Vn(w.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely",span:{start:u,end:R}});if(d.push(...w.pendingHeredocs),w.limited)return ao(a,l,w.next);if(!w.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`,span:{start:u,end:R}});u=R;continue}let g=(f==="<"||f===">")&&e[u+1]!=="("?Zy(e,u):null;if(g){let b=c.words.at(-1),w=b&&b.span.end===u&&/^[0-9]+$/.test(b.raw)?Number(b.raw):void 0;if(w!==void 0)c.words.pop();let R=w===void 0?u:b?.span.start??u;c.start=c.start===-1?u:c.start;let A=u+g.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let K=e[A],Y=A>u+g.length&&K==="#",te=!K||uo(K)||!!co(e,A)||K===s||K===")"||Y||(K==="<"||K===">")&&e[A+1]!=="(",X=g==="<<"||g==="<<-",z=X?bs(e,A,n):void 0,D=z?{word:mn(e,A,z.next,z.delimiter,"literal",z.quoted),nested:[],issues:[],next:z.next,limited:!1}:!te?xs(e,A,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return ao(a,l,D.next);if(!Es(o))return fn(a,l,D.next,"word-limit",r.maxWords)}let oe=D?.next??u+g.length,_e={kind:"redirection",operator:g,span:{start:R,end:oe},...w===void 0?{}:{fd:w},...D?{target:D.word}:{}};if(c.redirections.push(_e),X&&!z)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word",span:{start:u,end:u+g.length}});if(z){if(z.ambiguous||z.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely",span:z.span});let Ye=c.nested;d.push({delimiter:z.delimiter,quotedDelimiter:z.quoted,stripTabs:g==="<<-",declarationSpan:{start:R,end:oe},attach:(ke)=>{if(_e.heredoc=ke,ke.quotedDelimiter)return;Ye.push(...qy(e,ke.bodySpan.start,ke.bodySpan.end,r,o,i+1))}})}if(!X&&!D)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`,span:{start:u,end:u+g.length}});if(D)c.nested.push(...D.nested);c.end=oe,u=oe;continue}if(c.start===-1)Rs(a,l,u);let y=xs(e,u,n,r,o,i);if(l.push(...y.issues),y.limited)return ao(a,l,y.next);let v=rS(c.words)?lS(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return fn(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let b of E){if(!Es(o))return fn(a,l,y.next,"word-limit",r.maxWords);c.words.push(b)}c.start=c.start===-1?u:c.start,c.end=y.next,c.nested.push(...y.nested),u=y.next>u?y.next:u+1}return m(),au(a,l),l.push(...fS(d)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function ou(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:mo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function xs(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",d=[],m=[],u=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||uo(f)||(f===";"||f==="|"||f==="&")&&co(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:a,end:n}}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(f==='"'){l=!0;let g=Ky(e,a,n,r,o,i);if(s+=g.text,d.push(...g.nested),m.push(...g.issues),u||=g.limited,c=jn(c,g.provenance),a=g.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let g=Xy(e,a+2,n);if(s+=g.text,m.push(...g.issues),!g.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed",span:{start:a,end:n}});a=g.next;continue}if(f==="\\"){let g=e[a+1];if(!g){m.push({code:"trailing-escape",message:"escape has no following character",span:{start:a,end:a+1}}),a++;break}if(g===`
+`){a+=2;continue}s+=g,a+=2;continue}let h=f==="$"||f==="<"||f===">"||f==="`"?fo(e,a,n,r,o,i):null;if(h){let g=uu(h,d,m);if(u||=g.limited,c=jn(c,g.provenance),a=g.next,u)break;continue}if(f==="$"){let g=fu(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(f==="*"||f==="?"||f==="[")c=jn(c,"glob");s+=f,a++}return{word:mn(e,t,a,s,c,l,c==="literal"?void 0:Qy(e,t,a)),nested:d,issues:m,next:a,limited:u}}function Ky(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],d=!1,m=t+1;while(m<n){let u=e[m];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:d};if(u==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
+`){m+=2;continue}if(p==="\r"&&e[m+2]===`
+`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=_s(e,m+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(m,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:m,end:h}});m=h;continue}let f=fo(e,m,n,r,o,i);if(f){let p=uu(f,l,c);if(m=p.next,d||=p.limited,a=jn(a,p.provenance),d)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:d};continue}if(u==="$"){let p=fu(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=u??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:t,end:n}}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:d}}function fo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let d=s?3:c?1:2,m=s?"))":c?"`":")",u=_s(e,t+d,n,m),f=u===-1?n:u,p=u===-1?n:u+m.length;if(i>=r.maxDepth)return{program:dS(e,t+d,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],b=!1,w=t+d;while(w<f){let R=fo(e,w,f,r,o,i+1);if(!R){w++;continue}if(v.push(...R.program.nodes),E.push(...R.program.issues),b||=R.program.status==="limited",w=R.next,b)break}if(u===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:t,end:p}});return{program:pe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:mo(E,b),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=lo(e,t+d,f,r,o,i+1),g=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+d)} substitution is not closed`,span:{start:t,end:p}}]:[],y=(c||l)&&Vn(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions",span:{start:t,end:p}}]:[];return{program:pe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:mo([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function qy(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?fo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function uu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function _s(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`||l==="\r")&&s.length>0){let d=l==="\r"&&e[a+1]===`
+`?a+2:a+1,m=vs(e,d,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=du(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let d=Yy(e,a+3,n);if(d===-1)return-1;a=d+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let d=e[a+2]==="-",m=a+(d?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let u=bs(e,m,n);if(u){s.push({delimiter:u.delimiter,quotedDelimiter:u.quoted,stripTabs:d,declarationSpan:{start:a,end:u.next},attach:()=>{return}}),a=u.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Yy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=du(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function du(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!pS(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function co(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Zy(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function uo(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function mu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Xy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=Jy(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`,span:{start:i,end:a.next}});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function Jy(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return so(e,t+1,n,16,2,t+1);if(r==="u")return so(e,t+1,n,16,4,t+1);if(r==="U")return so(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return so(e,t,n,8,3,t+1);return{text:r,next:t+1}}function so(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function mo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function fu(e,t,n,r,o){let i=mu(e,t,n);return{text:r+e.slice(t,i),provenance:jn(o,"variable"),next:i}}function Qy(e,t,n){let r=io(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),d=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||d||m||u){let f=c?3:u?1:2,p=c?"))":u?"`":")",h=_s(e,a+f,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let f=mu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function jn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function eS(e,t,n){return t+1>=n||uo(e[t+1]??"")||co(e,t+1)!==null}var tS=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),nS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function rS(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=oS(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function oS(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return iS(e,t);if(n==="env")return sS(e,t);if(n==="sudo")return aS(e,t);return}function iS(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function sS(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(tS.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function aS(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(nS.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function pu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=[e.raw],i=e.raw.length,s=0;while(!0){let l=o.findIndex((p)=>su(p));if(l===-1)break;if(++s>n)return{limited:!0};let c=o[l]??"",d=su(c);if(!d||d.kind==="range")return{limited:!0};let m=d.start+c.length-d.end,u=d.alternatives.reduce((p,h)=>p+m+h.length,0);if(i-c.length+u>r||o.length-1+d.alternatives.length>t)return{limited:!0};let f=gu(c,d);o.splice(l,1,...f),i+=u-c.length}if(s===0)return;let a=o.map((l)=>uS(l,n));if(a.some((l)=>l===null))return{limited:!0};return{words:[...new Set(a.filter((l)=>l!==null&&l!==""))]}}function lS(e,t,n,r,o){if(t.provenance!=="literal"||t.quoted||t.raw!==t.text||!t.raw.includes("{"))return;let i=[t.text],s=t.text.length,a=0;while(!0){let c=i.findIndex((g)=>iu(g));if(c===-1)break;if(++a>r)return{limitCode:"depth-limit"};let d=i[c]??"",m=iu(d);if(!m)break;let u=m.start+d.length-m.end,f=m.alternatives.filter((g)=>u+g.length>0),p=f.reduce((g,y)=>g+u+y.length,0);if(s-d.length+p>o)return{limitCode:"brace-expansion-limit"};if(i.length-1+f.length>n)return{limitCode:"word-limit"};let h=gu(d,{...m,alternatives:f});i.splice(c,1,...h),s+=p-d.length}let l=i.filter((c)=>c.length>0);if(a===0)return;return{words:l.map((c)=>mn(e,t.span.start,t.span.end,c,"literal",!1))}}function iu(e){let t=[],n;for(let r=0;r<e.length;r++){let o=e[r];if(o==="{"){t.push({start:r,commas:[]});continue}if(o===","&&t.length>0){t.at(-1)?.commas.push(r);continue}if(o!=="}"||t.length===0)continue;let i=t.pop();if(!i||i.commas.length===0)continue;if(!n||i.start<n.start)n={start:i.start,end:r+1,commas:i.commas}}if(!n)return;return{start:n.start,end:n.end,alternatives:hu(e,n)}}function su(e){let t=[],n,r=null,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(o){o=!1;continue}if(s==="\\"&&r!=="'"){o=!0;continue}if(s===r){r=null;continue}if(r===null&&(s==="'"||s==='"')){r=s;continue}if(r!==null)continue;if(s==="{"){t.push({start:i,commas:[]});continue}if(s===","&&t.length>0){t.at(-1)?.commas.push(i);continue}if(s!=="}"||t.length===0)continue;let a=t.pop();if(!a)continue;let l=a.commas.length>0?{kind:"alternatives",start:a.start,end:i+1,commas:a.commas}:cS(e.slice(a.start+1,i))?{kind:"range",start:a.start,end:i+1}:void 0;if(l&&(!n||l.start<n.start))n=l}if(!n||n.kind==="range")return n;return{kind:n.kind,start:n.start,end:n.end,alternatives:hu(e,n)}}function gu(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function hu(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function cS(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function uS(e,t){let n=`x${e}`,r=xs(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function dS(e,t,n,r){return pe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit",span:{start:t,end:n}}],nodes:[]})}function fn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`,span:{start:n,end:n}}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function ao(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Es(e){return e.used++,e.used<=e.max}function mS(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Vn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Vn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Vn(t.body.nodes)})}function fS(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`,span:t.declarationSpan}))}function yu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function au(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!lu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`,span:n.span})}function Rs(e,t,n){if(!yu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector",span:{start:n,end:n+1}})}function pS(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var Su=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),gS=new Set(["gc","cat","type","cp","mv","rm"]),Cu=["-rec","-for","-path","-literalpath","-whatif"],hS=/^\$env:\w/i,yS=/^(?:\$\{?\w+\}?|~)\\./,po={maxInputLength:131072,maxWords:16384,maxDepth:64};function bu(e){let t=e.toLowerCase().replaceAll("`","");if(![...Su].some((r)=>t.includes(r))&&!(t.includes("rm")&&Cu.some((r)=>t.includes(r)))&&!t.includes("<#")&&!SS(t))return!1;let n=xS(e);if(n.posixHeredoc)return!1;return n.invalidComment||n.commands.some(CS)}function SS(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function CS(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&Su.has(n))return!0;let r=e.slice(t+1);if(n&&gS.has(n)&&r.some(bS))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Cu.some((s)=>i.startsWith(s))})}function bS(e){return hS.test(e)||yS.test(e)}function vu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return pe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`,span:n}],nodes:[]});let r=Is(e,0,e.length,t,0);return pe({kind:"program",dialect:"powershell",source:e,span:n,status:_S(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Is(e,t,n,r,o,i=!1){let s=[],a=[],l=ro(),c=0,d=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};oo(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:d};let p=xu(e,u,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};u=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
+`){m();let y=f==="\r"&&e[u+1]===`
+`?u+2:u+1;s.push(ws(e,u,y)),u=y;continue}u++;continue}let h=ks(e,u);if(h){m(),s.push(ws(e,u,u+h.length)),u+=h.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Ru(u,r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Is(e,u+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=pe({kind:"program",dialect:"powershell",source:e.slice(u+1,v),span:{start:u+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:u,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed",span:{start:u,end:y.next}});c+=y.words,d||=y.limited,u=y.next;continue}if(f==="}"){m(),s.push(ws(e,u,u+1)),u++;continue}if(f===">"||f==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===f?u+2:u+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?As(e,v,n,r,o):void 0,b=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(u,y),span:Object.freeze({start:u,end:b}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,d||=E.limited;l.end=b,u=b;continue}if(f===","){l.start=l.start===-1?u:l.start,l.words.push(Cs({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let g=As(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,d||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`,span:{start:u,end:g.next}}),m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};u=g.next>u?g.next:u+1}return m(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:d}}function As(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],d=0,m=!1,u=(p)=>{let h=vS(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),d+=Ps(h.program),m||=h.program.status==="limited",s="command-substitution",h.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||ks(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[f+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character",span:{start:f,end:f+1}}),f++;break}i+=h,f+=2;continue}if(e.startsWith("$(",f)){f=u(f);continue}if(p==="'"){a=!0,f++;let h=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){h=!0,f++;break}i+=e[f]??"",f++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:t,end:e.length}});continue}if(p==='"'){a=!0;let h=f++,g=!1;while(f<n){let y=e[f];if(y==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(y==='"'){g=!0,f++;break}if(e.startsWith("$(",f)){f=u(f);continue}if(y==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=y??"",f++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:h,end:e.length}});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:mn(e,t,f,i,s,a,s==="literal"?void 0:ES(e,t,f)),next:f,issues:l,nested:c,words:d,limited:m}}function vS(e,t,n,r,o){let i=Eu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:pe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Ru(t,r.maxDepth)],nodes:[]}),next:a};let l=Is(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed",span:{start:t,end:a}}]:[];return{program:pe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Eu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Ps(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Ps(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Ps(r)}}return t}function ES(e,t,n){let r=io(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Eu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=RS(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function RS(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Ru(e,t){return{code:"depth-limit",message:`command structure exceeds parser limit ${t}`,span:{start:e,end:e}}}function xS(e){let t=[],n=[],r=0,o=0,i=!1,s=!1,a=()=>{if(n.length>0)t.push(n);n=[]};while(r<e.length&&r<131072&&o<16384){let l=e[r];if(l==="\r"||l===`
+`){a(),r+=l==="\r"&&e[r+1]===`
+`?2:1;continue}if(/\s/.test(l??"")){r++;continue}let c=xu(e,r,Math.min(e.length,po.maxInputLength),po.maxDepth);if(c){i||=!!c.issue||c.limited,r=c.next;continue}let d=ks(e,r);if(d){a(),r+=d.length;continue}if(l==="{"||l==="}"){a(),r++;continue}s||=e.startsWith("<<",r);let m=As(e,r,Math.min(e.length,po.maxInputLength),po,0);if(m.word.text)n.push(m.word.text);for(let u of m.nested)t.push(...Ts(u));o++,r=m.next>r?m.next:r+1}return a(),{commands:t,invalidComment:i,posixHeredoc:s}}function Ts(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ts(t.body);if(t.kind!=="command")return[];return[t.words.map((n)=>n.text),...t.nested.flatMap(Ts)]})}function ks(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function xu(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`,span:{start:t,end:i+2}},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed",span:{start:t,end:n}},limited:!1}}function _S(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function ws(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}var Nt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function De(e,t="auto",n=Nt){if(t==="powershell"||t==="auto"&&bu(e.slice(0,n.maxInputLength)))return vu(e,n);return cu(e,n)}function _(e){return e.provenance==="command-substitution"?e.raw:e.text}function pn(e,t){return e==="posix"?t:q(t.map((n)=>n.text))}function go(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function q(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Os(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Z(e){return e.value.length}function Kn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ee(e,t){Kn(e,t)}function Lt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function j(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Ms(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function V(e,t,n){if(t+n.length>Z(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function Je(e,t,n){return!Lt(C(e,t-1))&&V(e,t,n)&&!Lt(C(e,t+n.length))}function Qe(e,t){return Lt(C(e,t-1))!==Lt(C(e,t))}function re(e){return e===`
+`||e===";"||e==="&"||e==="|"}function gn(e){return e==="|"||e===";"}function ho(e,t,n){let r=Os(e,n);if(t==="rm")return wS(r);if(t==="dd")return PS(r);return Iu(r,!0)}function yo(e,t,n){let r=Os(e,n);if(t==="rm")return TS(r);if(t==="reset-hard")return Pu(r,"--ha","rd");if(t==="reset-merge")return Pu(r,"--me","rge");if(t==="clean")return MS(r);if(t==="checkout")return NS(r);if(t==="push-force")return LS(r);if(t==="push-refspec")return WS(r);if(t==="push-delete")return FS(r);if(t==="branch")return GS(r);if(t==="tag")return $S(r);if(t==="restore")return US(r);return Iu(r,!1)}function wS(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Z(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(Je(e,i,"rm")&&j(l)&&l!==`
+`)t=!0,i++;continue}let a=AS(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Z(e)){if(o>=0){let l=_u(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(j(s)){if(o<0)continue;if(V(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=_u(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function AS(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(V(e,t,String.raw`\n`))return t+2;if(V(e,t,String.raw`\x0a`)||V(e,t,String.raw`\x0A`))return t+5;if(V(e,t,String.raw`\u000a`)||V(e,t,String.raw`\u000A`))return t+7;return V(e,t,String.raw`\012`)?t+4:-1}function _u(e,t,n){if(wu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(wu(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function wu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!V(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function PS(e){let t=!1;for(let n=0;n<Z(e);n++){if(re(C(e,n))){t=!1;continue}if(Je(e,n,"dd")){t=!0,n++;continue}if(!t||!Je(e,n,"of")||!V(e,n,"of=/dev/"))continue;let r=n+8;if(r<Z(e)&&!j(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function TS(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);){let i=C(e,o);if(o===Z(e)||re(i)){t=!1,n=!1,r=!1,o++;continue}let s=kS(e,o);if(s>=0){if(IS(e,s))return!0;let a=s,l=!1;while(j(C(e,a)))l||=C(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(V(e,o,"--")&&(o===0||j(C(e,o-1)))&&(!C(e,o+2)||j(C(e,o+2))||re(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=V(e,o,"--recursive")&&Qe(e,o+11)||Ds(e,o,"recursive"),r||=V(e,o,"--force")&&Qe(e,o+7)||Ds(e,o,"force"),n&&r)return!0;o++}return!1}function Ds(e,t,n){if(!V(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||j(o)||re(o))break;if(o!==n[r])return!1;r++}return r>0&&Qe(e,t+r+2)}function IS(e,t){let n=t,r=!1,o=!1;while(n<Z(e)){while(j(C(e,n)))n++;let i=n;while(n<Z(e)&&!j(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&V(e,i,"--"))return!1;let s=Au(e,i,"recursive"),a=Au(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=OS(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Au(e,t,n){return V(e,t,`--${n}`)&&Qe(e,t+n.length+2)||Ds(e,t,n)}function kS(e,t){if(t>0&&Lt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!j(C(e,n+1)))return-1;return n+1}function OS(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let d=C(e,c)??"",m=(d==="r"||d==="f")&&Qe(e,c+1);r||=d==="r",o||=d==="f",i||=d==="r"&&m,s||=d==="f"&&m,a||=(l==="r"&&d==="f"||l==="f"&&d==="r")&&m,l=d}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Pu(e,t,n){return Yn(e,"reset",gn,!0,(r)=>C(e,r)==="-"&&hn(e,r,t,n)?!0:r)}function MS(e){return Yn(e,"clean",gn,!0,(t)=>{if(C(e,t)!=="-")return t;if(hn(e,t,"--fo","rce"))return!0;let n=qn(e,t,gn);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function So(e,t,n){if(!Je(e,t,"git"))return null;let r=t+3;if(!j(C(e,r)))return{commandEnd:-1,next:r};while(j(C(e,r)))r++;while(r<Z(e)){if(re(C(e,r)))return{commandEnd:-1,next:r};let o=qn(e,r,re);if(Je(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&V(e,r,"--"),s=DS(e,r,o);r=o;while(j(C(e,r)))r++;if(i)return{commandEnd:Je(e,r,n)?r+n.length:-1,next:qn(e,r,re)};if(!s)continue;if(r>=Z(e)||re(C(e,r)))return{commandEnd:-1,next:r};r=qn(e,r,re);while(j(C(e,r)))r++}return{commandEnd:-1,next:r}}function DS(e,t,n){for(let r of le)if(n-t===r.length&&V(e,t,r))return!0;return!1}function NS(e){return Tu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function LS(e){return Yn(e,"push",gn,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!Lt(C(e,t+2))&&!V(e,t+2,"-with-lease"))return!0;let n=ku(e,t,"--fo","rce");if(n>=0&&!V(e,n,"-with-lease"))return!0;return t})}function WS(e){return Yn(e,"push",re,!1,(t)=>{if(j(C(e,t))&&C(e,t+1)==="+"&&t+2<Z(e)&&!re(C(e,t+2))&&!j(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function FS(e){return Yn(e,"push",re,!1,(t)=>{if(C(e,t)==="-"&&hn(e,t,"--de","lete"))return!0;if(j(C(e,t))&&C(e,t+1)===":"&&t+2<Z(e)&&!j(C(e,t+2))&&!re(C(e,t+2)))return!0;return t})}function GS(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);o++){if(o===Z(e)||re(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=So(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=qn(e,o,re),s=zS(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function zS(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(hn(e,i,"--de","lete"))r=!0;if(hn(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&BS(C(e,s))){let d=C(e,s);a||=d==="d"||d==="D",l||=d==="f",c||=d==="D",s++}if(!Qe(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function BS(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function $S(e){return Tu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Tu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Z(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(j(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=So(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&j(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(hn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Qe(e,r+1))return!0;if(gn(o))i.outerActive=!1}return!1}function Yn(e,t,n,r,o){let i=!1;for(let s=0;s<Z(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=So(e,s,t);if(c){i=c.commandEnd>=0&&(!r||j(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let d=s;d<=c;d++)if(n(C(e,d)))i=!1;s=c}if(l)i=!1}return!1}function US(e){let t=!1;for(let n=0;n<Z(e);n++){if(Ms(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=So(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(V(e,n+2,"staged")||V(e,n+2,"help")))t=!1}return t}function Iu(e,t){let n=!1;for(let r=0;r<Z(e);r++){let o=C(e,r),i=t?Ms(o):re(o);if(n&&j(o)&&C(e,r+1)==="-"&&Je(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Je(e,r,"find"))n=!0,r+=3}return!1}function qn(e,t,n){let r=t;while(r<Z(e)&&!j(C(e,r))&&!n(C(e,r)))r++;return r}function ku(e,t,n,r){if(!V(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return Qe(e,o)?o:-1}function hn(e,t,n,r){return ku(e,t,n,r)>=0}function et(e,t){Kn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ee(t,a);if((s.regex?.test(a)??!1)||s.scan&&yo(a,s.scan,t))return S("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var HS=/^[A-Za-z_][A-Za-z0-9_]*=/;function Mu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;Kn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Du(t.nodes,r,i)}function Du(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Du(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return jS(r,t,n)})}function jS(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!HS.test(o.text));return e.words.every((o,i)=>o===t||Ou(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Ou(o.target.raw,n.anchored,!0)))}function Ou(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as VS,resolve as Nu}from"path";function Zn(e,t,n,r){let o=VS(e)?Nu(e):t?Nu(t,e):void 0;if(!o)return;try{return B(o,n,r)}catch{return o}}function Lu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var yn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Xn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Ns=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),KS=new Set(["-p","--print"]),qS=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),YS=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),ZS=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),XS=new Map([["python",new Set(["m"])]]),JS=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),QS=new Set(["always","default","never"]),eC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),tC=/\\\r?\n/g,nC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Fu(e){return bo(e).code}function Co(e){return bo(e).sources}function Gu(e){return nC.get(Ws(e))??[]}function bo(e){let t=Ws(e[0]??"");if(!Ns.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&KS.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(oC(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(iC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=rC(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(JS.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&eC.has(s))||t==="python"&&!QS.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let u=s[m];if(u===void 0)break;if(XS.get(t)?.has(u)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if(qS.get(t)?.has(u)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&u==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(YS.get(t)?.has(u)){if(m+1===s.length)i++;break}if(ZS.get(t)?.has(u)&&m+1<s.length)break}if(l===void 0)continue;let d=c?i+1:i;if(n.push({tokenIndex:d,value:l}),r.push({tokenIndex:d,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((d)=>d.tokenIndex)),c=n.filter((d)=>d.kind!=="inline-code"||l.has(d.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((d)=>d.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function rC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ls(e,t){return Ws(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Ws(e){let t=I(e).toLowerCase();return $r.test(t)?"python":t}function oC(e,t){return Ns.get(e)?.has(t)??!1}function iC(e){return Ns.get(e)?.has("--eval")??!1}function Jn(e,t){let n=lC(e,t);if(!Wu(n,t))return!1;Ee(t,n);let r=aC(n);if(Wu(r,t))return!0;return Ee(t,r),sC.test(r)}var sC=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function aC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Wu(e,t){if(ho(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ee(t,e),r.test(e))return!0;if(ho(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ee(t,e),r.test(e))return!0;if(ho(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ee(t,e),n.some((o)=>yo(o,r))))}function lC(e,t){return Ee(t,e),e.replace(tC,"")}import{isAbsolute as ud,relative as dd}from"path";import{isAbsolute as Hu,parse as SC}from"path";import{dirname as cC,isAbsolute as uC,parse as dC,sep as mC}from"path";function ft(e,t,n){if(Ze(t))throw Error("Unsupported Windows namespace path");let r=uC(t)?dC(t).root:"",o=r||e;for(let i of pC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=cC(o);continue}let s=fC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function fC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${mC}${t}`}function pC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Fs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],gC=new Set(Fs),hC=1024,zu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),vo=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),yC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Eo(e){return gC.has(e)}function Gs(e){return Eo(e)||zu.has(e)||vo.has(e)||Mn(e)}function Ae(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Ro(e,t){let n=Ae("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=hC?{state:"valid",count:r}:{state:"invalid"}}function xo(e,t,n){let o=e.match(yC)?.[1];if(!o||!Gs(o))return null;let i=e.indexOf("=");return{name:o,value:`${Ae(o,t,n)??""}${e.slice(i+1)}`}}function Bu(e){return Uu(e,vo)}function $u(e){return Uu(e,zu)}function Uu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Vu=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!Vu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function _o(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(_(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Ku(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Wt(e,t,n,r){if(!Ku(Sn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<P.wrapperPeelIterations.cap;m++){let u=ju(i),f=_o(i);for(let[h,g]of f.envAssignments)s.set(h,g),a.set(h,g);if(i=f.words,i.length===0)break;while(i.length>0&&Sn(i).includes("=")&&!bC(i)){let h=vC(Sn(i),a,t.env)??xo(Sn(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=Sn(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=RC(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=wC(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=AC(i);if(p==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if(ju(i)===u)break}let d=_o(i);for(let[m,u]of d.envAssignments)s.set(m,u),a.set(m,u);return{words:d.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:CC(d.words,o)}}function CC(e,t){return e.some((n)=>!t.has(n))}function ju(e){return e.map(_).join(" ")}function Sn(e){let t=e[0];return t?_(t):""}function Le(e,t){let n=e[t];return n?_(n):void 0}function bC(e){return Vu.test(Sn(e))}function vC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var EC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function RC(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?Qn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Qn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Qn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(EC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var xC=new Set(["-i","-0","--null"]),_C=new Set(["-u","--unset","-C","--chdir","-P"]);function wC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(xC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Le(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let d=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(d){if(d.value!==void 0)i.push(d.value);return s=null,l(a+d.consumed)}if(_C.has(c)){if(c==="-C"||c==="--chdir"){let m=Le(e,a+1);s=m?Qn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Qn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(Le(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function Qn(e,t,n){if(t==="")return null;if(!e&&!Hu(t))return null;let r=Hu(t)?SC(t).root:n.realpath(e??"/");if(r===null)return null;try{return ft(r,t,n)}catch{return null}}function AC(e){if(Le(e,1)==="-v")return[...q(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var PC=/['"\\$`{}#]/;function wo(e,t){if(e.some((r)=>PC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function pt(e,t,n){return Ao(e,t,n).tokens}function TC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function gt(e,t,n,r=0){let o=Ao(e,t,n),i=(o.envSplitValues??[]).flatMap(TC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return gt(s,t,n,r+1)}function Ao(e,t,n,r){if(!Ku(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Wt(q(e),t,n,r);return{tokens:o.words.map(_),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Us=Symbol("adopt-as-operand"),IC=new Set(["env","sudo","command","builtin"]),kC=new Set(["&&","||","|&","|","&",";"]),OC=new Set(["<<","<<<",">|"]),MC=new Set(["|","|&"]),DC=/[*@#?$!_-]/,NC=/^\w+(?::\w+)*/,LC=Object.freeze([]),er=Object.freeze({kind:"scope",edge:"enter"}),tr=Object.freeze({kind:"scope",edge:"exit"}),WC=Object.freeze([]),FC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),nr=new Set(["bash","sh","zsh","dash","ksh"]),GC=256,Ju=new WeakMap;function Qu(e,t){let n=t.status==="complete"?new Set($s(t)):new Set,r=$C(e,n);if(Hr(r))return Po("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Ft(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Po("structural-limit",r,t);if(o.invalid)return Po("invalid",r,t);let s=Po("complete",r,t,o.assignmentFallbacks);return Ju.set(s,Object.freeze(i)),s}function Io(e,t,n,r,o){let i={cwd:t,variables:new Map,previous:null},s=[],a=new Set,l=null,c=[];for(let d of ed(e)){if(d.kind==="scope"){if(d.edge==="enter"){c.push({state:i,segment:[...s],shellWords:new Set(a),pipeProducer:l});continue}let m=o.segment(s,i,l,null,a);if(m)return m;let u=c.pop();if(u===void 0)throw Error("scope exit without a matching enter");i=u.state,s=u.segment,a=u.shellWords,l=u.pipeProducer;continue}if(d.kind==="operator"){if(!d.boundary)continue;let m=o.segment(s,i,l,d.operator,a);if(m)return m;i=zC(s,i,n,r),l=s.length>0&&MC.has(d.operator)?s:null,s=[],a=new Set;continue}if(d.kind==="redirection"){if(d.fd!==void 0)a.add(s.length-1);if(d.target===void 0)continue;let m=o.redirection({operator:d.operator,role:d.role,targetOrder:d.targetOrder,target:d.target,...d.body===void 0?{}:{body:d.body,consumer:d.consumer}},i);if(m===Us){a.add(s.length),s.push(o.word(d.target));continue}if(m)return m;continue}s.push(o.word(d.text))}return o.segment(s,i,l,null,a)}function ko(e){return ed(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function ge(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:ge(i,t);return a?ge(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function rr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function zC(e,t,n,r){let o=rr(e)?new Map([...t.variables,...BC(e,t.variables)]):t.variables,i=pt([...e],n),s=I(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ie(ge(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function BC(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],ge(o,t)]]:[]})}function ed(e){return Ju.get(e)??LC}function $C(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Po(e,t,n,r=WC){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Ft(e,t){return e.nodes.flatMap((n,r)=>UC(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function UC(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We(qC(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[To("{"),...Ft(e.body,a),...s?[To("}")]:[]]:[er,We("("),...Ft(e.body,a),...s?[We(")")]:[],tr]}]}let o=JC(e,r.functions);if(o){if(r.depth>=Nt.maxDepth||++r.flags.expansions>GC)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...qu(e,r),To(";"),...Ft(o,{...r,depth:r.depth+1}),To(";")]},...Yu(e,t,n,r)]}return[{start:e.span.start,events:qu(e,r)},...Yu(e,t,n,r)]}function qu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:nd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:HC(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function HC(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?nd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[Hs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:YC(r),targetOrder:OC.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:od(t)}:{}}),...s===void 0?o:o.slice(1)]}function Yu(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[Hs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...td(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?jC(t,n,r):[]]}function jC(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:td(n.source.slice(r.span.end,e.span.end),n)}]}function td(e,t){if(t.depth>=Nt.maxDepth)return t.flags.limited=!0,[];let n=De(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Ft(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function nd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?Hs(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of zs(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(We(f));continue}s+=f.text,a||=f.glob}continue}let d=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=zs(f,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=d?Ft(d,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(er,...p,tr);continue}let m=d?Ft(d,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(er,...m,tr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),er,...m,...c.raw.endsWith(")")?[We(")")]:[],tr);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>We("(")),...u===1?[er]:[],...m,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>We(")")):[],...u===1?[tr]:[])}return l(),o}function zs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Zu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Zu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Zu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=KC(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return VC(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&DC.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?NC:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function VC(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=zs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function KC(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function qC(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:kC.has(e)})}function To(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function Hs(e){return Object.freeze({kind:"word",text:e})}function YC(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function or(e){return FC.has(e)||/^python\d/.test(e)}var ZC=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function rd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=ZC.get(e)?.has(n)??!1;return rd(e,t.slice(r?2:1))}function Bs(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Bs(e.slice(1));if(!IC.has(t))return[...e];return Bs(rd(t,e.slice(1)))}function od(e){let t=Hn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Bs(n<0?[]:e.words.slice(n).map((r)=>r.text))}function XC(e){let t=od(e)[0];if(t===void 0)return!1;let n=I(t).toLowerCase();return or(n)&&!nr.has(n)}function $s(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return $s(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>$s(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(XC(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!eb(t))return r;return[...r,...o]})}function JC(e,t){let n=Hn(e);return n===void 0?void 0:t.get(n)}function ht(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function QC(e){if(ht(e.words[0],"git"))return ht(e.words[1],"commit");if(!ht(e.words[0],"gh")||!ht(e.words[2],"create"))return!1;return ht(e.words[1],"pr")||ht(e.words[1],"issue")}function eb(e){return(ht(e.words[0],"cat")||ht(e.words[0],"tee")||QC(e))&&!e.words.some(Xu)&&!e.redirections.some((n)=>Xu(n.target))}function Xu(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var id=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),sd=new Set([...id,"glob"]),tb=new Set([...sd,"pattern"]),ad={parseCommand:De,readGuardSyntax:Qu};class Fe extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function ir(e,t={}){let n=nb({...ad,...t}),r=Ln(e.input),o=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&r)o.push({usage:"input-candidate",source:r});if(e.route.kind==="command"&&"command"in e&&e.command)o.push({usage:"declared-command",source:e.command});let i=o.reduce((s,a)=>{let l=s.findIndex((m)=>m.source===a.source);if(l!==-1){let m=s[l];if(!m)return s;return s[l]={...m,usages:[...m.usages,a.usage]},s}let c=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",d=n.getCommandProgram(a.source,c);return s.push({usages:[a.usage],source:a.source,program:d,shell:n.getShellSyntax(a.source,d)}),s},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:i,paths:rb(e),store:n}}function ue(e,t){return e.commands.find((n)=>n.usages.includes(t))}function tt(e,t){if(!e.includes("$"))return e;return xi(e,t)}function nb(e={}){let t={...ad,...e},n=new Map,r=new Map,o=new WeakMap,i=(a,l)=>{let c=`${l}\x00${a}`,d=r.get(c);if(d)return d;let m=t.parseCommand(a,l);return r.set(c,m),m};return{getShellSyntax:(a,l)=>{if(l&&l.source!==a)throw TypeError("Shell syntax source does not match command program source.");let c=l??i(a,"posix");if(c.status==="limited"){let u=o.get(c);if(u)return u;let f={status:"structural-limit",source:a,program:c,assignmentFallbacks:[]};return o.set(c,f),f}let d=n.get(a);if(d)return d;let m=t.readGuardSyntax(a,c);return n.set(a,m),m},getCommandProgram:i}}function rb(e){let t=e.route.kind==="grep"?sd:e.route.kind==="glob"?tb:id;return[...Dl(e.input,t),...e.route.kind==="patch"?Wl(e.input):[]]}var ob=new Set(["-S","--suffix"]);function Cn(e,t,n,r,o){if(e.status==="structural-limit")throw new Fe;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Io(e,t,n,r,{word:(i)=>i,segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(ge(i.target,s.variables),s)?i.target:null})}function Oo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&ob.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function md(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Lr(e.invocation.toolName))return null;let a=e.paths.find((l)=>ld(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ue(e,"input-candidate");if(!i)return null;let s=Cn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>lb(a,l,t,n,r),isRedirectionTarget:(a,l)=>ld(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Gt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Do(ie(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(js(l,n))return!0;let c=s||a.slice(l.length).includes("/."),d=(m)=>c?Mo(m,l):ib(m,l);if(n.markerFiles.some(d))return!0;return r&&cd(n).some(d)}if(js(a,n))return!0;return r&&cd(n).some((c)=>Mo(c,a))}function ib(e,t){let n=dd(t,e);if(n===""||n.startsWith("..")||ud(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function sb(e,t,n,r,o){return Gt(e,t,n,!0,r,o)}function ab(e,t,n,r,o){if(!n)return!1;return js(Do(ie(e,t,r,o)),n)}function ld(e,t,n,r,o,i){let s=Do(ie(e,t,r,o));return i.includes(s)||pd(s,n)}function fd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Mo(i,Do(ie(s,t,r,o)))))}function js(e,t){return t.entries.includes(e)||t.directories.includes(e)||pd(e,t)}function pd(e,t){return t.hooksDirectories.some((n)=>Mo(e,n))}function cd(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Mo(e,t){let n=dd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!ud(n)}function Do(e){return process.platform==="win32"?e.toLowerCase():e}function lb(e,t,n,r,o){if(rr(e))return null;let i=gt([...e],r);if(I(i[0]??"").toLowerCase()!=="mv")return null;let s=Oo(i.slice(1)),a=s.sources.find((l)=>sb(ge(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&ab(ge(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Xs,normalize as yb,parse as Sb,posix as Rd,resolve as bn,sep as Zs}from"path";import{isAbsolute as cb,join as gd,normalize as Sd,parse as ub,sep as hd}from"path";var db=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],mb=` 	
+`;function sr(e,t){if(yt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Vs(e.get("TMPDIR")??"",t)}function zt(e,t){if(e.has("TMPDIR"))return Vs(e.get("TMPDIR")??"",t);let n=Ks(e,t);if(n===void 0)return!0;return Vs(n,t)}function Ks(e,t){return vd(e,t,"TMPDIR")}function Vs(e,t){if(!e)return!1;if(pb(e))return!1;return qs(e,t)}function yt(e,t){let n=vd(e,t,"IFS");return n!==void 0&&n!==""&&n!==mb}function qs(e,t){let n=No(e,t.paths);if(n===null)return!1;return bd(t).some((r)=>hb(n,r))}function Cd(e,t){let n=No(e,t.paths);if(n===null)return!1;return bd(t).some((r)=>Lo(r)===Lo(n))}var yd=new WeakMap;function bd(e){let t=yd.get(e);if(t)return t;let n=fb(e);return yd.set(e,n),n}function fb(e){let t=db.map((r)=>No(r,e.paths)??Sd(r)),n=No(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&gb(n))return[...t,n];return t}function pb(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function vd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function gb(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function No(e,t){try{let n=Sd(e);if(!cb(n))return n;let r=ub(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=gd(i,o[s]??"");if(t.entryKind(a)==="missing")return gd(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function hb(e,t){let n=Lo(e),r=Lo(t);if(n===r)return!0;let o=r.endsWith(hd)?r:`${r}${hd}`;return n.startsWith(o)}function Lo(e){return process.platform==="win32"?e.toLowerCase():e}var Cb=process.platform==="win32",Ed=64,bb=16384;function ar(e){let t=pu(e,Ed,Ed,bb);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:vb(e)}}function vb(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>Eb(e.raw,n.span.start-e.span.start))}function Eb(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Bt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Ce();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:Ab(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Ge(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&Tb(e))return{kind:"outside_anchored_cwd"};let o=!r&&wd(e,t.posixShell);if(Ze(e))return{kind:"outside_anchored_cwd"};if(Js(e,r))return{kind:"root_or_home_target"};if(Rb(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Gt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(xb(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(Pb(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&Mb(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&Db(e,t.resolvedCwd??i,t.environment.paths,t.budget))return{kind:"cwd_self_target"};if(Nb(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function xd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Ge(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(wb(i))return!1;if(Cd(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Lb(r??i,s,t.environment.paths,t.budget))}function Js(e,t=!1){let n=e.trim(),r=Rd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function Rb(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Xs(o)?o:t.resolvedCwd?bn(t.resolvedCwd,o):null;if(!i)return!1;let s=he(B(i,t.environment.paths,t.budget));if(s===Sb(s).root)return!0;return s===he(B(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=yb(e);if(Cb){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function xb(e,t,n,r,o,i,s,a){let l=e.trim();if(_d(l))return!1;if(!r&&qs(l,a))return!0;return(t||i&&s)&&n&&!o&&_b(l,n)}function _b(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!wd(e.slice(n.length+1),t)})}function wb(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Rd.normalize(`/${t[1]??""}`)==="/"}function _d(e){return e.split(/[\\/]+/).includes("..")}function Ab(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Bn(o.trim(),t);if(!Xs(i))return[];try{let s=B(i,n,r);if($n(s,B(t,n,r)))return[];return[he(s)]}catch{return[]}})}function Pb(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(_d(r))return!1;let o=n?r:Bn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Xs(o)?o:i?bn(i,o):null;if(!s)return!1;try{let a=he(B(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Zs)?l:`${l}${Zs}`))}catch{return!1}}function Tb(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function wd(e,t=!1){return e.includes("$")||e.includes("`")||Ib(e)||t&&kb(e)}function Ib(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function kb(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&Ob(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function Ob(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function Mb(e,t,n,r){try{return he(B(e,n,r))===he(B(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function Db(e,t,n,r){if(e==="."||e==="./"||e===".\\")return!0;try{return he(B(bn(t,e),n,r))===he(B(t,n,r))}catch{try{return he(bn(t,e))===he(t)}catch{return!1}}}function Nb(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Ys(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Ys(bn(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Ys(bn(a,e),t,i,s)}catch{return!1}}function Ys(e,t,n,r){try{return Ad(B(e,n,r),B(t,n,r))}catch{return!1}}function Lb(e,t,n,r){if(!t)return!1;try{return Ad(B(t,n,r),B(e,n,r))}catch{return!0}}function Ad(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${Zs}`)||n===r}var Wb=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Pd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Fb="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Td="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Id="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",Gb="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",zb="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.";function kd(e,t,n,r=Bt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return Bb(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function Bb(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=Ub(o),s=o[i];if(!s||!Wb.has(Jb(s.text)))return null;let a=$b(o.slice(i+1));if(a.whatIfProtected)return null;if(Q(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return S("powershell.remove-item-pipeline-dynamic-target",zb);for(let l of a.targets)if(!Ze(l.text)&&Js(ea(l.text)))return S(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Id);for(let l of a.targets)if(n.resolvedCwd&&Gt(ea(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return S("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(Q(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return S("powershell.remove-item-recursive-force-dynamic-target",Td);for(let l of a.targets){let c=Qb(Ge(ea(l.text),n),n,r);if(c)return c}return null}function $b(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(Hb(l))continue;if(s){t.push(Qs(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=Vb(l.text);if(!c){t.push(Qs(l)),i=i||l.dynamic;continue}if(Kb(c.name)){let d=c.value?jb(c.value,l):e[++a];if(d?.kind==="word"){t.push(Qs(d)),i=i||d.dynamic;continue}i=!0;continue}if(qb(c.name)){n=!0;continue}if(Yb(c.name)){r=!0;continue}if(Zb(c.name))o=Xb(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function Ub(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Qs(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function Hb(e){return e.kind==="word"&&e.text===","}function ea(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function jb(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function Vb(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function Kb(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function qb(e){return"recurse".startsWith(e)}function Yb(e){return e.length>=2&&"force".startsWith(e)}function Zb(e){return e==="wi"||"whatif".startsWith(e)}function Xb(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function Jb(e){return e.toLowerCase()}function Qb(e,t,n){switch(e.kind){case"root_or_home_target":return S("powershell.remove-item-recursive-force-root-or-home",Id);case"git_metadata_target":return S("powershell.remove-item-git-metadata",Te);case"temp_target":return null;case"dynamic_target":if(!Q(n,"powershell.remove-item-recursive-force-dynamic-target",t.strict))return null;return S("powershell.remove-item-recursive-force-dynamic-target",Td);case"home_cwd_target":return S("powershell.remove-item-recursive-force-home-cwd",Gb);case"cwd_self_target":return S("powershell.remove-item-recursive-force-cwd-self",Pd);case"within_anchored_cwd":if(!Q(n,"powershell.remove-item-recursive-force-paranoid",t.paranoid))return null;return S("powershell.remove-item-recursive-force-paranoid",Fb);case"outside_anchored_cwd":return S("powershell.remove-item-recursive-force-outside-cwd",Pd)}}var vn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Wo="Unsupported heredoc syntax",Od="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";import{normalize as ei}from"path";var ev=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),tv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),nv=new Set(["-o","--output","--query","--subscription"]),rv=new Set;function Md(e){if(e==="aws")return ev;if(e==="gcloud")return tv;if(e==="az")return nv;return rv}var ov=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),iv=new Set;function Dd(e){if(e==="git")return le;if(e==="docker")return ov;return iv}function ze(e,t){if(e.length===0||t.length===0)return null;let n=L(e[0]??""),r=fe(e);for(let o of t){if(!lv(n,o.command))continue;if(o.match){if(sv(n,e,o.match))return Nd(o);continue}if(!cv(n,e,o.subcommand))continue;if(dv(e,new Set(o.block_args),r))return Nd(o)}return null}function Nd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function sv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return av(r,n.command_path,Md(e))}function av(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function lv(e,t){return e===L(t)}function cv(e,t,n){if(!n)return!0;return Ld(t,1,n,Dd(e))}function Ld(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&uv(e,i,n,r))return!0;continue}return s===n}return!1}function uv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Ld(e,t+2,n,r)}function dv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var mv=new Set(["-e","--source"]),fv=new Set(["-F","-v","--assign","--field-separator"]),Wd=new Set(["-f","--file"]),pv=new Set(["print","printf","return"]),Fd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],gv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Gd(e,t,n){let r=!1;for(let o of hv(e)){let i=yv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?S("awk.system-dynamic",gv):null}function na(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&mv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(fv.has(a)||Wd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Wd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function cr(e){return na(e).sources}function hv(e){return cr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function yv(e,t){Ee(t,e);let n=e.includes("system")?ra(e,t):null,r=Sv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function ra(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Go(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=zd(e,i+1);continue}if(s==="/"&&Bd(e,i)){i=$d(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,lr(e[a-1])||lr(e[i]))continue;let l=Fo(e,i);if(e[l]!=="(")continue;l=Fo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=Go(e,l,c);if(!d){r=!0,o=!0;continue}if(l=Fo(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function Sv(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let f=Go(e,i,d);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(d==="#"){i=zd(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&Bd(e,i)){let f=$d(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+{}`.includes(d)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ta(e,i,"print")||ta(e,i,"printf")))a=i;if(d!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(d))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,u=Fo(e,m);if(ta(e,u,"getline")){o=!0;let f=vv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(Rv(s,a)){o=!0;let f=bv(e,u);if(!f){r=!0,c=m,i=m;continue}if(!Cv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function lr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Fo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function Cv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function Go(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=Ev(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function bv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Go(e,t,n)}function vv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function Ev(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ta(e,t,n){return e.startsWith(n,t)&&!lr(e[t-1])&&!lr(e[t+n.length])}function Rv(e,t){return t!==null&&t>=e}function zd(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Bd(e,t){let n=xv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(lr(e[r-1]))r--;return pv.has(e.slice(r,n+1))}function xv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function $d(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var _v=new Set(["sudo","env","command","builtin"]);function zo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(I(n)))return null;let r=I(n),o=e[1]==="--"?2:1,i=wv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function wv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=I(a)!==n&&Av(a,r);if(l)i.push(s);if(!l&&Ur.has(L(a)))break;if(o)break}return i}function Av(e,t){let n=I(e),r=L(e);return r==="git"||n==="busybox"||$t(e)||Ki.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function $t(e){return _v.has(e.toLowerCase())}function Be(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Bo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Bo(e,t,n,r,o,i,s,a,l){let c=Ao(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:d,cwd:m}=c;if(c.envSplitValues){let f=wo(c.envSplitValues,d);if(!f)throw new F("derivedCommandShape");oa(a),yield*Bo(f,t,m,r,o,i,s,a,l);return}if($t(d[0]??""))throw new F("wrapperPeelIterations");let u=zo(d,s);if(u){for(let f of[u.childIndex,...u.alternativeChildIndices])oa(a),yield*Bo(f===u.childIndex?u.tokens:[...d.slice(f)],t,m,r,new Map(o),new Map(i),s,a,!0);return}if(Tv(d)){oa(a),yield*Bo([...d.slice(1)],t,m,r,o,i,s,a,l);return}yield Pv(d,m,r,o,i,l)}function Pv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:I(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function oa(e){if(e.iterations>=P.wrapperPeelIterations.cap)throw new F("wrapperPeelIterations");e.iterations++}function Tv(e){return I(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ia(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function $e(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||sa(r,"recursive")){t=!0;continue}if(r==="-f"||sa(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Ud(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>sa(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function sa(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var Iv="find -delete permanently removes files. Use -print first to preview.",kv="find -exec rm -rf is dangerous. Use explicit file list instead.",Ov=new Set(["-exec","-execdir","-ok","-okdir"]),Mv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Hd(e,t){let n=e.map(_),r=Dv(e,n,t);if(r)return r;if(Uo(n,1)&&!Lv(e,n,t)){let s=T(S("find.delete",Iv),t.policy);if(s)return s}let o=t.budget??Ce(),i=0;while(i<n.length){let s=n[i],a=St(s??"");if(a>0){i+=a+1;continue}if(!nt(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=ur(n,i);i=l.nextIndex;let c=Fv(l.tokens,t.environment);if(c){let f=T(c,t.policy);if(f)return f}let d=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,d?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:d?void 0:t.cwd,envAssignments:t.envAssignments}):null,u=m?.id.startsWith("custom.")?m:T(m,t.policy);if(u)return u}return null}function Dv(e,t,n){if(!Uo(t,1)&&!aa(t,n.environment))return null;let o=$o(e)??q(["."]),i=Bt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=ar(s);for(let l of a.expandedTargets??[_(s)]){let c=Ge(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return S("find.delete-git-metadata",Te)}}if(Nv(t)&&i.resolvedCwd&&fd(o.map(_),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return S("find.delete-git-metadata",Te);return null}function aa(e,t){let n=0;while(n<e.length){if(!nt(e[n])){n++;continue}let r=ur(e,n),o=gt([...r.tokens],t),i=I(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function Nv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function Lv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=$o(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Ks(o,n.environment),s=n.trustedTmpdirValue??zt(o,n.environment),a=n.allowTmpdirVar??!sr(o,n.environment),l=Bt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??yt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let d=ar(c);if(d.unsafeBraceExpansion)return!1;return(d.expandedTargets??[_(c)]).every((m)=>xd(m,l,{containmentTarget:Wv(m,i),targetIsLiteral:d.expandedTargets!==void 0||d.targetIsLiteral,tmpdirWordSplittingProtected:d.tmpdirWordSplittingProtected}))})}function Wv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function $o(e){let t=(o)=>{let i=e[o];return i?_(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function Fv(e,t){let n=pt([...e],t);if(n.length===0)return null;let r=I(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=I(n[0]??"");if(r==="rm"&&$e(n))return S("find.exec-rm-recursive-force",kv);return null}function ur(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Uo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(nt(r)){n=ur(e,n).nextIndex;continue}let o=St(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function St(e){return Mv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function nt(e){return e!==void 0&&Ov.has(e)}function dr(e){let t=De(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Gv=5,la="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function de(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Vd(e,t,n){let r=qd(e,t,n),o=zv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Gv;a++){let{subcommand:l,rest:c}=Ue(i),d=l?.toLowerCase();if(!d||!o.has(d))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(d),u=jv(m);if(u===null||u.length===0)return{blockedReason:la,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:la,expanded:!0,tokens:i}}function Kd(e,t,n){return qd(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Ue(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?I(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=le.has(o)?2:1}return{subcommand:null,rest:[]}}function zv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function qd(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?I(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=$v(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Bv(e,t,n)]}}function Bv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=ca(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=ca(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=jd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=jd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(le.has(i)){o+=2;continue}o++}return r}function $v(e,t){let n=Uv(e,t),r=Hv(e,t);return{blockedReason:n===null||r===null?la:null,entries:[...n??[],...r??[]]}}function Uv(e,t){let n=Ae("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=dr(n);if(!o)return null;for(let i of o){let s=ca(i);if(!s)return null;r.push(s)}return r}function Hv(e,t){let n=Ro(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Ae(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Ae(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function ca(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function jd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Ae(e.slice(r+1),t,n)}}function jv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return dr(t)}var Vv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",Kv="git checkout --force discards uncommitted changes. Use 'git stash' first.",qv="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Yv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Zv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",Xv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Jv="git switch --force discards uncommitted changes. Use 'git stash' first.",Qv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",eE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",tE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",nE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",rE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",oE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",iE="git push --force destroys remote history. Use --force-with-lease for safer force push.",sE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",aE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",lE="git branch -D force-deletes without merge check. Use -d for safe delete.",cE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",uE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",dE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",mE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",fE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",pE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",gE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",hE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),yE=new Set(["--recurse-submodules","--track","-t"]),ua=new Set(["-b","-B","-U"]),da=new Set(["-c","-C"]),SE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var En=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Zd(e){let{subcommand:t,rest:n}=Ue(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return Ct(CE(n));case"switch":return Ct(bE(n));case"restore":return Ct(EE(n));case"reset":return xE(n);case"clean":return Ct(wE(n));case"rm":return Ct(AE(n));case"push":return Ut(PE(n));case"branch":return Ut(kE(n));case"stash":return Ut(LE(n));case"worktree":return Ut(WE(n));case"rebase":return Ct(OE(n));case"merge":return Ct(ME(n));case"tag":return Ut(DE(n));case"reflog":return Ut(NE(n));default:return null}}function Ct(e){return e?{...e,localDiscard:!0}:null}function Ut(e){return e?{...e,localDiscard:!1}:null}function CE(e){let{index:t,before:n}=de(e),r=fe(n,{shortOptsWithValue:ua});if(n.some((i)=>M(i,"--force"))||r.has("-f"))return S("git.checkout-force",Kv);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(M(i,"--pathspec-from-file"))return S("git.checkout-pathspec-from-file",Yv)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return S("git.checkout-ref-path",qv);return S("git.checkout-double-dash",Vv)}if(vE(e).length>=2)return S("git.checkout-ambiguous",Zv);return null}function bE(e){let{before:t}=de(e);if(t.some((r)=>M(r,"--discard-changes")))return S("git.switch-discard-changes",Xv);let n=fe(t,{shortOptsWithValue:da});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return S("git.switch-force",Jv);return null}function vE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(hE.has(r)){n+=2;continue}if(yE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function EE(e){let t=RE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?S("git.restore-worktree",eE):S("git.restore-unstaged",Qv)}function RE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(SE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function xE(e){let t=null;for(let n of e){if(M(n,"--hard")){t=S("git.reset-hard",tE);break}if(M(n,"--merge")){t=S("git.reset-merge",nE);break}}if(!t)return null;return _E(e)?Ut(t):Ct(t)}function _E(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function wE(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=fe(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return S("git.clean-force",rE);return null}function AE(e){let t=!1,n=!1,r=!1;for(let o of de(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=fe([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?S("git.rm-force",oE):null}function PE(e){let{before:t,after:n}=de(e),r=fe(t);if(t.some((s)=>M(s,"--mirror")))return S("git.push-mirror",aE);if(t.some((s)=>M(s,"--force"))||r.has("-f")||Yd(t,n).some(TE))return S("git.push-force",iE);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||Yd(t,n).some(IE))return S("git.push-delete",sE);return null}function Yd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function TE(e){return e.startsWith("+")||e.includes(":+")}function IE(e){return e.length>1&&e.startsWith(":")}function kE(e){let{before:t}=de(e),n=fe(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return S("git.branch-force-delete",lE);return null}function OE(e){let{before:t}=de(e);return t.some((n)=>M(n,"--abort"))?S("git.rebase-abort",cE):null}function ME(e){let{before:t}=de(e);return t.some((n)=>M(n,"--abort"))?S("git.merge-abort",uE):null}function DE(e){let{before:t}=de(e);return fe(t).has("-d")||t.some((r)=>M(r,"--delete"))?S("git.tag-delete",dE):null}function NE(e){return e[0]==="delete"?S("git.reflog-delete",mE):null}function LE(e){for(let t of e){if(t==="drop")return S("git.stash-drop",fE);if(t==="clear")return S("git.stash-clear",pE)}return null}function WE(e){let{before:t}=de(e);if(!t.includes("remove"))return null;let r=fe(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return S("git.worktree-remove-force",gE);return null}import{resolve as FE}from"path";function Jd(e,t){return Fs.some((n)=>t?.has(n)||e.has(n))}function Qd(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(FE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=Xd(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=Xd(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=le.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function Xd(e,t,n){try{let r=ft(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function nm(e,t,n){if(!t.localDiscard||!n.worktreeMode||Jd(n.environment.env,n.envAssignments))return null;let r=Qd(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(GE(e,n,o))return null;return{originalReason:t.reason,gitCwd:r.gitCwd}}function GE(e,t,n){let{subcommand:r,rest:o}=Ue(e),i=r?.toLowerCase();if(t.dynamicArguments||zE(o)||jE(e,t.environment.env,t.envAssignments,n)||UE(o)||BE(i,o))return!0;return i==="clean"&&HE(o)>1}function zE(e){return e.some((t)=>/[$*?[]/.test(t))}function BE(e,t){if(e==="checkout"){let{before:n}=de(t),r=fe(n,{shortOptsWithValue:ua}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=de(t),r=fe(n,{shortOptsWithValue:da}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||$E(s))||r.has("-C");return o&&i}return!1}function $E(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function UE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function HE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function jE(e,t,n,r){let o=VE(e,t,n);if(o!==null)return o;let i=KE(t,n);if(i!==null)return i;if($u(n))return!0;return r.recursiveSubmodules}function VE(e,t,n){let r=null,o=1;while(o<e.length){let i=e[o];if(!i||i==="--")return r;if(!i.startsWith("-"))return r;if(i==="-c"){let s=em(e[o+1]);if(s!==null)r=s;o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=em(i.slice(2));if(s!==null)r=s;o++;continue}if(i==="--config-env"){let s=tm(e[o+1],t,n);if(s!==null)r=s;o+=2;continue}if(i.startsWith("--config-env=")){let s=tm(i.slice(13),t,n);if(s!==null)r=s;o++;continue}o+=le.has(i)?2:1}return r}function KE(e,t){if(Ae("GIT_CONFIG_PARAMETERS",e,t)!==void 0)return!0;let n=Ro(e,t);if(n.state==="absent")return null;if(n.state==="invalid")return!0;let r=null;for(let o=0;o<n.count;o++){let i=Ae(`GIT_CONFIG_KEY_${o}`,e,t),s=Ae(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i?.trim()||s===void 0)return!0;let a=i.trim().toLowerCase();if(fa(a))return!0;if(a!=="submodule.recurse")continue;r=ma(s)}return r}function em(e){if(!e)return null;let t=e.indexOf("="),n=(t===-1?e:e.slice(0,t)).toLowerCase();if(fa(n))return!0;if(n!=="submodule.recurse")return null;let r=t===-1?"true":e.slice(t+1).toLowerCase();return ma(r)}function tm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;let o=e.slice(0,r).toLowerCase();if(fa(o))return!0;if(o!=="submodule.recurse")return null;let i=Ae(e.slice(r+1),t,n);return i===void 0||ma(i)}function ma(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function fa(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}var qE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",YE=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Ho(e,t){return rm(e.map(_),t)}function rm(e,t,n){let r=Vd(e,t.environment.env,t.envAssignments),o=r.blockedReason?T(S("git.alias-config",r.blockedReason),t.policy):null;if(o)return o;let i=r.tokens;if((Bu(t.envAssignments)||Kd(e,t.environment.env,t.envAssignments))&&ZE(i))return S("git.ssh-env",qE);let s=Zd(i);if(!s)return null;if(r.expanded||r.blockedReason)return s;let a=nm(e,s,t);if(!a)return s;return n?.(a),null}function om(e,t){let n=null;return{match:rm(e.map(_),t,(o)=>{n=o}),relaxation:n}}function ZE(e){let{subcommand:t,rest:n}=Ue(e),r=t?.toLowerCase();if(!r)return!1;if(YE.has(r))return!0;if(r==="archive")return de(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&XE(n)}function XE(e){return e.find((t)=>!JE(t))?.toLowerCase()==="update"}function JE(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as DR}from"path";function Re(e,t){e.charge("parallelChildAnalyses",t.childAnalyses??0),e.charge("parallelDerivedTokens",t.derivedTokens??0),e.charge("parallelDerivedBytes",t.derivedBytes??0),e.charge("parallelPlaceholderReplacements",t.placeholderReplacements??0)}var im="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",QE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",eR="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",am="rm -rf targeting root or home directory is extremely dangerous and always blocked.",tR="rm -rf in home directory is dangerous. Change to a project directory first.";function jo(e,t){let n=Bt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(_),o=$e(r),i=Ud(r),s=rR(e);for(let a of s){let l=ar(a.word);if(o&&l.unsafeBraceExpansion){let c=T(sm({kind:"outside_anchored_cwd"},n,t.policy),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let d=be(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Gt(d,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return S("rm.git-metadata",Te);if(i&&!o){let u=Ge(d,n,m);if(u.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home",am);if(u.kind==="git_metadata_target")return S("rm.git-metadata",Te);continue}if(!o)continue;for(let u of nR(d,n,m)){let f=sm(u,n,t.policy),p=T(f,t.policy);if(p)return p}}}return null}function nR(e,t,n){let r=Ge(e,t,n);if(r.kind==="cwd_self_target")return[r,Ge(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Ge(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Ge(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function rR(e){let t=[],n=!1;for(let r of e.slice(1)){let o=_(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}function sm(e,t,n){switch(e.kind){case"root_or_home_target":return S("rm.recursive-force-root-or-home",am);case"git_metadata_target":return S("rm.git-metadata",Te);case"temp_target":return null;case"dynamic_target":if(!Q(n,"rm.recursive-force-dynamic-target",t.strict))return null;return S("rm.recursive-force-dynamic-target",eR);case"home_cwd_target":return S("rm.recursive-force-home-cwd",tR);case"cwd_self_target":return S("rm.recursive-force-cwd-self",im);case"within_anchored_cwd":if(Q(n,"rm.recursive-force-paranoid",t.paranoid))return S("rm.recursive-force-paranoid",QE);return null;case"outside_anchored_cwd":return S("rm.recursive-force-outside-cwd",im)}}var oR={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},cm=new Set(["--init-file","--rcfile"]),iR=["--init-file","--rcfile"],sR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function rt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return lm(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=lm(e,t,!1);if(r!==null)return r}}return null}function ot(e){let t=I(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Ke(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function lm(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function um(e){let t=I(e[0]??"").toLowerCase(),n=aR(e,t),r=sR.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function aR(e,t){let n=Ke(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?iR.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&cm.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=dm(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}function dm(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let d=t[c];if(d===void 0)break;if(e==="ksh"&&d==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&d==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&d==="o"&&c+1<t.length)break;if(r==="startup"&&d==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&d==="c")s=!0;if(r==="argv"&&d==="n")l=t[0]==="-";if(r==="argv"&&d==="s")a=t[0]==="-";if(!oR[e]?.includes(d))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Ke(e){let t=I(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&cm.has(l)&&!s.includes("="))i++;continue}let a=dm(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}var bt={kind:"none"},Ht={kind:"dynamic"},lR=new Set(["<","<<","<<-","<<<","<&","<>"]),fm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,cR=/^(?:[0-9]+|[@*])$/,uR=Nt.maxWords,dR=Nt.maxInputLength;function pm(e){if(!e||I(L(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function dr(e){let t=To(e[1])==="--"?2:1;if(e.length<=t)return Yt;let n=e.slice(t);if(!n.every(qs))return wn;return{kind:"literal",source:n.map(N).join(" ")}}function m_(e){let t=To(e[1])==="--"?2:1,n=e[t],r=To(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Yt;if(!qs(n))return wn;return{kind:"literal",source:r}}function Hs(e,t){let n=FO(e);if(n===-1)return Yt;let r=GO(t);if(!r)return Yt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=jO(s,e,n,r.ifs);if(!a)return wn;if(i+=a.reduce((c,l)=>c+l.length+3,0),o.length+a.length>$O||i>LO)return wn;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(BO)].filter((s)=>s!==null).join(" ")}}function f_(e,t,n,r){if(!vt(e.map(N)).readsStdinAsCommands)return Yt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&DO.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Yt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return wn;return{kind:"literal",source:o.target.text}}if(!n)return Yt;return r===void 0?wn:{kind:"literal",source:r}}function _t(e){let t=vt(e.map(N)).scriptIndex;if(t===null)return Yt;let n=e[t],r=To(n);return Zi(n,r)?{kind:"literal",source:r}:wn}var WO=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Ku(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((c)=>c.provenance!=="literal"||c.parts.some((l)=>l.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||qe(s)!==null)return!1;let a=F(H(s));return!WO.has(a)&&!me.has(a)&&!Cn(a)}function FO(e){return vt(e.map(N)).commandIndex??-1}function GO(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(ZO);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function ZO(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function jO(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Vu(o):UO(o,r);if(e.parameter==="*"){let a=Vu(o);if(!a)return;let c=a.join(r[0]??"");return e.quoted?[c]:Hu(c,r)}let i=t[n+1+e.parameter];if(i&&!qs(i))return;let s=To(i);return e.quoted?[s]:Hu(s,r)}function Vu(e){return e.every(qs)?e.map(N):void 0}function UO(e,t){let n=Vu(e);if(!n)return;let r=n.map((o)=>Hu(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Hu(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Vo(e){let t=mr(e[1])==="--"?2:1;if(e.length<=t)return bt;let n=e.slice(t);if(!n.every(qo))return Ht;return{kind:"literal",source:n.map(_).join(" ")}}function gm(e){let t=mr(e[1])==="--"?2:1,n=e[t],r=mr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return bt;if(!qo(n))return Ht;return{kind:"literal",source:r}}function Ko(e,t){let n=fR(e);if(n===-1)return bt;let r=pR(t);if(!r)return bt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=hR(s,e,n,r.ifs);if(!a)return Ht;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>uR||i>dR)return Ht;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(SR)].filter((s)=>s!==null).join(" ")}}function hm(e,t,n,r){if(!Ke(e.map(_)).readsStdinAsCommands)return bt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&lR.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return bt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Ht;return{kind:"literal",source:o.target.text}}if(!n)return bt;return r===void 0?Ht:{kind:"literal",source:r}}function it(e){let t=Ke(e.map(_)).scriptIndex;if(t===null)return bt;let n=e[t],r=mr(n);return go(n,r)?{kind:"literal",source:r}:Ht}var mR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function ya(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=I(L(s));return!mR.has(a)&&!J.has(a)&&!$t(a)}function fR(e){return Ke(e.map(_)).commandIndex??-1}function pR(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(gR);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function gR(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function hR(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?pa(o):yR(o,r);if(e.parameter==="*"){let a=pa(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:ga(l,r)}let i=t[n+1+e.parameter];if(i&&!qo(i))return;let s=mr(i);return e.quoted?[s]:ga(s,r)}function pa(e){return e.every(qo)?e.map(_):void 0}function yR(e,t){let n=pa(e);if(!n)return;let r=n.map((o)=>ga(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function ga(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function qs(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(N(e)):e.provenance==="literal"}function To(e){return e?N(e):""}function BO(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Yu(e,t){return qu(rt(e,"posix"),t)}function mr(e){return Yu(e,new Set(Array.from(e.matchAll(u_)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function qu(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(qu(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>qu(o,n))||p_(r.words,n))return!0;YO(r,n)}return!1}function p_(e,t){let n=e.findIndex((s)=>qe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Io(r,t))return!0;let o=H(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return l_(e[s],t)}if(me.has(o)){let s=e.slice(n),a=vt(s.map((l)=>l.text)),c=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&c!==null&&l_(s[c],t)}let i=VO(e,n,t);if(i===null)return!1;if(i===-1)return!0;return p_(e.slice(i),t)}function VO(e,t,n){let r=H(e[t]?.text??"");if(r==="command")return HO(e,t+1);if(r==="exec")return qO(e,t+1);if(r==="env")return KO(e,t+1,n);return null}function HO(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function qO(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function KO(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Io(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Io(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(qe(i))continue;return r}return null}function YO(e,t){if(!e.words.every((n)=>qe(n.text)!==null))return;for(let n of e.words){let r=qe(n.text);if(!r)continue;if(Io(n,t))t.add(r.name)}}function Io(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(u_)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(MO.test(o)||t.has(o))}))}function l_(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Io(e,t))}var JO=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),XO=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),QO=new Set(["-o","--output","--query","--subscription"]),ez=new Set;function g_(e){if(e==="aws")return JO;if(e==="gcloud")return XO;if(e==="az")return QO;return ez}var tz=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),nz=new Set;function h_(e){if(e==="git")return He;if(e==="docker")return tz;return nz}function be(e,t){if(e.length===0||t.length===0)return null;let n=H(e[0]??""),r=Pe(e);for(let o of t){if(!iz(n,o.command))continue;if(o.match){if(rz(n,e,o.match))return y_(o);continue}if(!sz(n,e,o.subcommand))continue;if(cz(e,new Set(o.block_args),r))return y_(o)}return null}function y_(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function rz(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return oz(r,n.command_path,g_(e))}function oz(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function iz(e,t){return e===H(t)}function sz(e,t,n){if(!n)return!0;return b_(t,1,n,h_(e))}function b_(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&az(e,i,n,r))return!0;continue}return s===n}return!1}function az(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return b_(e,t+2,n,r)}function cz(e,t,n){for(let r of e)if(t.has(r))return!0;for(let r of n)if(t.has(r))return!0;return!1}function Jt(e,t,n={}){if(e.length===0)return null;let r=e[0];if(!r)return null;let o=H(r);if(o==="eval"){let i=dr(j(e));if(i.kind==="dynamic")return fr(n,t);if(i.kind==="literal"&&t.analyzeNested){let s=t.analyzeNested(i.source,{effectiveCwd:t.cwd,envAssignments:t.envAssignments});if(s)return s}return St(n,t)}if(me.has(o)){if(Ye(e))return null;let i=bt(e);if(i){if(n.dynamicSourceInput??n.dynamicInput){let c=fr(n,t);if(c)return c}if(mr(i)){let c=fr(n,t);if(c)return c}if(!t.analyzeNested)return null;let a=t.analyzeNested(i,{effectiveCwd:t.cwd,envAssignments:t.envAssignments});if(a)return a;return null}let s=_t(j(e));if(s.kind==="dynamic")return fr(n,t);if(s.kind==="literal"){if(n.dynamicSourceInput)return fr(n,t);return null}if(n.dynamicSourceInput??n.dynamicInput)return fr(n,t);return null}if(We.has(o))return z(Gs(e,(i)=>t.analyzeNested?t.analyzeNested(i,{effectiveCwd:t.cwd,envAssignments:t.envAssignments}):null),t.policy)??be(e,t.policy?.rules??[])??St(n,t);if(Me(o)){let i=rs(e);if(!i)return St(n,t);if(de(t.policy,"interpreter.one-liner-paranoid",!!t.paranoidInterpreters)){let a=z(v("interpreter.one-liner-paranoid",er),t.policy);if(a)return a}if(ss(o,i))return St(n,t);let s=t.analyzeNested?.(i,{effectiveCwd:t.cwd,envAssignments:t.envAssignments});if(s&&s.id!=="raw-text.dangerous-command"&&(s.reason!==Ut||ir(i)))return s;if(tr(i,t.scanWork))return z(v("interpreter.dangerous-command",yn),t.policy)??St(n,t);return St(n,t)}if(o==="rm"||o==="rmdir"){let i=o==="rm"&&(ct(e)||n.dynamicRmInput);return z(ur(j(e),{environment:t.environment,cwd:t.cwd,originalCwd:t.originalCwd,strict:t.strict,paranoid:t.paranoidRm,allowTmpdirVar:t.allowTmpdirVar,tmpdirWordSplittingUnsafe:pt(t.envAssignments,t.environment),trustedTmpdirValue:Mt(t.envAssignments,t.environment),protectedGitMetadata:t.protectedGitMetadata,policy:t.policy}),t.policy)??(i&&n.dynamicRmInput?St(n,t):null)??(i?lz(n,t):null)}if(o==="find")return Us(j(e),{...t,derivedCommandWorkBudget:t.derivedCommandWorkBudget,analyzeTokens:(i,s)=>Jt(i,{...t,cwd:s??void 0,derivedCommandWorkBudget:t.derivedCommandWorkBudget},n)})??be(e,t.policy?.rules??[])??St(n,t);if(o==="git")return z(lr(j(e),{env:t.environment.env,cwd:t.cwd,envAssignments:t.envAssignments,policy:t.policy,worktreeMode:n.dynamicInput?!1:t.worktreeMode}),t.policy)??be(e,t.policy?.rules??[])??St(n,t);return be(e,t.policy?.rules??[])??St(n,t)}function fr(e,t){return e.shellDynamicMatch?z(e.shellDynamicMatch,t.policy):null}function St(e,t){return e.dynamicSourceInput&&e.dynamicSourceMatch?z(e.dynamicSourceMatch,t.policy):null}function lz(e,t){return e.dynamicInput&&e.rmDynamicMatch?z(e.rmDynamicMatch,t.policy):null}var Ju="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Xu="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",uz="__CC_SAFETY_NET_XARGS_INPUT__",Ks="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Ys="rm",dz=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,mz=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,fz=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,pz=/^(?:[0-9]+|[@*])$/;function S_(e,t){let n=e.map(N),{childStart:r,replacementToken:o}=Rn(n),i=n.slice(r),s=v("xargs.shell-dynamic",Xu);if(hz(i,o,t)&&z(s,t.policy))return z(s,t.policy);for(let a of at(i,t)){let c=a.tokens,l=o!==null&&c[0]!==i[0]&&(c[0]?.includes(o)??!1)?z(s,t.policy):null;if(l)return l;let u=w_(c,o,a.wrapperEnvAssignments),d=a.head==="rm"&&o!==null&&C_(c,o),m=Jt(c,{...t,cwd:a.cwd,envAssignments:a.envAssignments},{dynamicInput:u,dynamicSourceInput:d||x_(c,a.head,o,a.wrapperEnvAssignments,u,t.scanWork,t.environment),dynamicRmInput:d,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:v("xargs.rm-recursive-force-dynamic",Ju)});if(m)return m;let f=gz(c,o,t.policy?.rules??[]);if(f)return f;if(a.head==="git"){let h=o===null?[...c,uz]:c,y=o!==null&&(c.some((E)=>E.includes(o))||Array.from(a.envAssignments.values()).some((E)=>E.includes(o))),b=Jt(h,{...t,cwd:a.cwd,envAssignments:a.envAssignments,worktreeMode:o===null||y?!1:t.worktreeMode});if(b)return b}let p=be(c,t.policy?.rules??[]);if(p)return p}return null}function gz(e,t,n){if(n.length===0)return null;if(t===null){for(let o of n){let i=be([...e,...o.subcommand?[o.subcommand]:[],...o.block_args],n);if(i)return i}return null}let r=new Set(n.flatMap((o)=>[o.subcommand,...o.block_args].flatMap((i)=>i?e.flatMap((s)=>Qu(s,t,i)):[])));for(let o of r){let i=be(e.map((s)=>s.replaceAll(t,o)),n);if(i)return i}return null}function Qu(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=e.slice(0,r),i=e.slice(r+t.length);return n.startsWith(o)&&n.endsWith(i)?[n.slice(o.length,n.length-i.length)]:[]}function x_(e,t,n,r,o,i,s){if(me.has(t)){if(Ye(e))return!1;if(n!==null&&yz(e,n))return!0;let a=bt(e);if(!a){let c=_t(j(e));if(c.kind==="literal")return n!==null&&c.source.includes(n);return c.kind==="none"&&o}if(n!==null&&a.includes(n))return!0;if(Dt(a,i))return!0;return bz(a,n,r)}if(Me(t))return v_(e,n,is,rb(t));if(We.has(t))return v_(e,n,Ou,zv);if(t==="eval"){let a=dr(j(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return vz(e,n,i,s);if(t==="git"){let a=lt(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&cr.has(a.subcommand.toLowerCase())&&E_(a.rest,n).some((c)=>c.includes(n))}return!1}function v_(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Ks]).sources.some((c)=>c.value===Ks);if(o.sources.some((c)=>c.value.includes(t)))return!0;let i=new Set(o.sources.map((c)=>`${c.tokenIndex}\x00${c.kind}\x00${c.value}`)),s=r.flatMap((c)=>[c.selector,...c.valueForm==="attached-only"||c.valueForm==="attached-or-separate"?[`${c.selector}${Ks}`]:[],...c.valueForm==="equals-or-separate"?[`${c.selector}=${Ks}`]:[]]),a=new Set(s.flatMap((c)=>e.flatMap((l)=>Qu(l,t,c))));return Array.from(a).some((c)=>n(e.map((l)=>l.replaceAll(t,c))).sources.some((l)=>!i.has(`${l.tokenIndex}\x00${l.kind}\x00${l.value}`)))}function hz(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(at(e,n),(i)=>i.head)),o=t===null?[...e,Ys]:e.map((i,s)=>s===0?i:i.replaceAll(t,Ys));return Array.from(at(o,n)).some((i)=>i.head===Ys&&!r.has(Ys))}function C_(e,t){return E_(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function E_(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function w_(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function yz(e,t){let n=vt(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return Qu(i,t,o).some((c)=>{let l=e.map((d,m)=>m===s?d.replaceAll(t,c):d),u=vt(l);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(n.commandIndex===null&&u.commandIndex!==null)return!0;if(n.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(l[u.commandIndex]??"").includes(c))return!0;return u.scriptIndex!==null&&(l[u.scriptIndex]??"").includes(c)})}))}function bz(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(dz))if(__(o,r))return!0;for(let o of e.matchAll(mz))for(let i of(o[1]??"").matchAll(fz))if(__(i,r))return!0;return Yu(e,r)}function __(e,t){let n=e[1]??e[2];return n!==void 0&&(pz.test(n)||t.has(n))}function vz(e,t,n,r){if(t===null)return!0;let o=!1,i=0;for(let s=1;s<e.length;s++){let a=e[s]??"";if(!o&&!a.startsWith("-")&&a!=="!"&&a!=="("){if(a.indexOf(t)===0)return!0;continue}if(o=!0,i>0){i--;continue}if(Lt(a)){let l=Po(e,s);s=l.nextIndex-1;for(let u of at(l.tokens,{environment:r,cwd:void 0})){let d=w_(u.tokens,t,u.wrapperEnvAssignments);if(u.head==="rm"&&C_(u.tokens,t)||x_(u.tokens,u.head,t,u.wrapperEnvAssignments,d,n,r))return!0}continue}let c=qt(a);if(c>0){if(i=c,a.includes(t))return!0;continue}if(a.includes(t))return!0}return!1}function Rn(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(o.startsWith("-")){if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}if(t.has(o))r+=2;else r++}else return{childStart:r,replacementToken:n}}return{childStart:e.length,replacementToken:n}}var zo="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",No="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Sz="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",xz="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Cz=/\{[^{}\s]*\}/,z_=/\{\}|\{-?\d+\}/g,Ez=["e","f","source","file","-e","-f","--source","--file"],wz=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Rz=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),Pz=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),R_=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Az=new Set(["--workdir","--wd"]),P_="__CC_SAFETY_NET_PARALLEL_SOURCE__",kz=new TextEncoder,td=q.maxDerivedBytes+4*q.maxPlaceholderReplacements;function ke(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function N_(e,t){return ke([...e],(n)=>Dt(n,t.scanWork))}function D_(e,t){let n=e.map(N);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=An(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=U_(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:c,unsupported:l,workdir:u,dryRun:d}=o;if(l){let p=An(t);if(p)return p;let h=N_(t.envAssignments?.values()??[],t);if(h)return h}if(c){let p=$z(t);if(p)return p}if(u!==void 0&&a){let p=An(t);if(p)return p}let m=Gz(u,t.cwd,t.environment.paths);if(m===null){let p=An(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:m===null||m===void 0||m===t.cwd?t:{...t,cwd:m};if(d){if([...at(i,f)].flatMap((h)=>[...h.envAssignments.values()]).some(id)){let h=An(t);if(h)return h}return null}if(i.length===0){if(s.some((y)=>y.length!==1)){let y=An(t);if(y)return y}let p=s.map((y)=>y[0]??"");$e(t.budget,nd(p));let h=F_(f.envAssignments,f.cwd,a);return ke(p,(y)=>t.analyzeNested(y,h))}return ke(at(i,f),(p)=>Tz(p,o,t,f))}function Tz(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,c=e.tokens,l={...r,cwd:e.cwd,envAssignments:e.envAssignments},u=[...e.envAssignments.values()];if(u.some(Z_)){let b=An(n);if(b)return b}let d=N_(u,n);if(d)return d;let m=u.some(ne),f=i||m,p=a&&f,h=F_(e.envAssignments,e.wrapperCwd,s||p);if(me.has(e.head)){let b=()=>{if(!i||o.length===0)return null;return $e(n.budget,Js(c,o,"generic")),ke(o,(C)=>Jt(c.map((P)=>Xt(P,C)),l))};if(Ye(c))return b();let E=bt(c);if(E){if(j_(E)){let k=Pn(n);if(k)return k;if(o.length===0)return null;return $e(n.budget,O_(E,o)),ke(o,(U)=>n.analyzeNested(Xt(E,U),h))}if(ne(E)){if(o.length>0)return $e(n.budget,O_(E,o)),ke(o,(ie)=>n.analyzeNested(Xt(E,ie),h));$e(n.budget,T_(E));let k=Ao(E);if(k?.[0]&&H(k[0])==="rm"&&ct(k)){let ie=k_(n);if(ie)return ie}let U=k?Jt(k,l,{dynamicInput:a,shellDynamicMatch:v("parallel.shell-dynamic",No),rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",zo)}):null;if(U)return U;return n.analyzeNested(E,h)}let C=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((k)=>Hs(j(k===void 0?c:i?c.map((U)=>Xt(U,k)):[...c,...k]),E)):[];if(C.some((k)=>k.kind==="dynamic")){let k=Pn(n);if(k)return k}let P=C.flatMap((k)=>k.kind==="literal"?[k.source]:[]);if(P.length>0)return $e(n.budget,nd(P)),ke(P,(k)=>n.analyzeNested(k,h));if($e(n.budget,T_(E)),mr(E)){let k=Pn(n);if(k)return k}let L=n.analyzeNested(E,h);if(L)return L;if(f)return Pn(n);return null}let A=_t(j(c));if(A.kind==="dynamic"||A.kind==="literal"&&ne(A.source))return Pn(n)??b();if(A.kind==="literal")return b();if(o.length>0){let C=Pn(n);if(C)return C;let P=b();if(P)return P;if(i)return null;let L=o.flatMap((k)=>k[0]===void 0?[]:[k[0]]);return $e(n.budget,nd(L)),ke(L,(k)=>n.analyzeNested(k,h))}if(f||a)return Pn(n)??b();return null}if(e.head==="rm"&&ct(c)){if(i&&o.length>0)return $e(n.budget,Js(c,o,"rm")),ke(o,(E)=>ed(c.map((A)=>rd(A,E)),e.cwd,r));if(o.length>0)return $e(n.budget,I_(c,o)),ke(o,(E)=>ed([...c,...E],e.cwd,r));let b=ed(c.flatMap((E,A)=>{if(A===0||!ne(E))return[E];return E.startsWith("-")?[rd(E,[""])]:[]}),e.cwd,r);if(b)return b;return k_(n)}$e(n.budget,i&&o.length>0?Js(c,o,"generic"):o.length>0?I_(c,o):W_(c));let y=o.length>0?o:[void 0];return ke(y,(b)=>{let E=b===void 0?c:i?c.map((se)=>Xt(se,b)):[...c,...b],A=v("parallel.shell-dynamic",No),C=a&&e.head==="find"?Mz(E,r):null,P=$_(E,a,n.policy?.rules??[],n.budget)??C?.customResult??null,L=H(e.head),k=a&&(L==="rm"&&od(E)||L==="xargs"&&L_(E)||C?.rmOptions===!0),U=a&&(k||C?.executedSource===!0||C===null&&M_(E,L)),ie=Jt(E,{...l,worktreeMode:s||a||f?!1:n.worktreeMode},{dynamicInput:a||f,dynamicRmInput:k,dynamicSourceInput:P!==null||U,shellDynamicMatch:A,dynamicSourceMatch:A,rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",zo)});if(U){let se=z(A,n.policy);if(se)return se}return ie??P??be(E,n.policy?.rules??[])})}function M_(e,t){if(ne(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(me.has(t))return zz(e);if(t==="git")return Iz(e);if(t==="find")return!0;if(We.has(t))return A_(e,Ez,Ro);if(Me(t))return A_(e,wz,os);return!1}function od(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(ne))return t===-1;return n.some((o)=>ne(o)&&(o.startsWith("-")||j_(o)))}function Iz(e){if(Oz(e))return!0;let t=lt(e);if(t.subcommand===null||ne(t.subcommand))return!0;if(!cr.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(ne))return n===-1;return r.some(ne)}function Oz(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(ne(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(ne(n))return!0;continue}if(ne(n))return!0}return!1}function zz(e){if(Ye(e))return!1;let t=bt(e);if(t!==null)return ne(t);let n=_t(j(e));if(n.kind==="literal")return ne(n.source);if(n.kind==="dynamic")return!0;return!e.some(ne)}function A_(e,t,n){let r=n(e);if(r.some((i)=>ne(i.value)))return!0;if(!e.some(ne))return n([...e,P_]).some((i)=>i.value===P_);let o=new Set(r.map((i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`));return t.some((i)=>n(e.map((s)=>Xt(s,[i]))).some((s)=>!o.has(`${s.tokenIndex}\x00${s.kind}\x00${s.value}`)))}function $_(e,t,n,r){if(!t||n.length===0)return null;let o=n.filter((s)=>H(s.command)===H(e[0]??""));if(o.length===0)return null;let i=e.some(ne);if($e(r,Nz(e,o,i)),!i)return ke(o,(s)=>be([...e,...s.subcommand?[s.subcommand]:[],...s.block_args],[s]));return ke(o,(s)=>{let a=new Set([s.subcommand,...s.block_args].flatMap((c)=>c?Dz(e,c):[]));return ke(a,(c)=>be(e.map((l)=>Xt(l,[c])),[s]))})}function Nz(e,t,n){let r=n?kn(Je(t.map((o)=>o.block_args.length+(o.subcommand?1:0)),q.maxChildAnalyses),2*Math.max(e.length,1),q.maxChildAnalyses):t.length;return{childAnalyses:r,derivedTokens:kn(r,e.length,q.maxDerivedTokens)}}function Dz(e,t){return e.flatMap((n)=>{let r=[...n.matchAll(/\{[^{}\s]*\}/g)];if(r.length!==1)return[];let o=r[0];if(!o||o.index===void 0)return[];let i=n.slice(0,o.index),s=n.slice(o.index+o[0].length);if(!t.startsWith(i)||!t.endsWith(s))return[t];let a=t.slice(i.length,t.length-s.length);return a!==t?[t,a]:[t]})}function Mz(e,t){let n={customResult:null,executedSource:!e.some(ne),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(ne))return;for(let a of at(i,t))n.executedSource||=M_(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&od(a.tokens)||a.head==="xargs"&&L_(a.tokens),n.customResult??=$_(a.tokens,!0,t.policy?.rules??[],t.budget)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=ne(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Lt(a)){i=[],n.executedSource||=ne(a);continue}let c=qt(a);if(c>0){o=c,n.executedSource||=ne(a);continue}n.executedSource||=ne(a)}return s(),n}function L_(e){let t=e.slice(Rn(e).childStart);return H(t[0]??"")==="rm"&&od(t)}function Xs(e,t){return(n)=>z(v(e,t),n.policy)}var Pn=Xs("parallel.shell-dynamic",No),$z=Xs("parallel.command-stream-dynamic",Sz),An=Xs("parallel.command-stream-dynamic",xz),k_=Xs("parallel.rm-recursive-force-dynamic",zo);function ed(e,t,n){return z(ur(j(e),{environment:n.environment,cwd:t,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:pt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Mt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function nd(e){return{childAnalyses:e.length,derivedTokens:e.length,derivedBytes:Do(e)}}function T_(e){return W_([e])}function W_(e){return{childAnalyses:1,derivedTokens:e.length,derivedBytes:Do(e)}}function I_(e,t){if(t.length>q.maxChildAnalyses)return{childAnalyses:t.length};return{childAnalyses:t.length,derivedTokens:Je(t.map((n)=>e.length+n.length),q.maxDerivedTokens),derivedBytes:Je([kn(Do(e),t.length,q.maxDerivedBytes),Je(t.map((n)=>Do(n)),q.maxDerivedBytes)],q.maxDerivedBytes)}}function O_(e,t){return Js([e],t,"generic")}function Js(e,t,n){if(t.length>q.maxChildAnalyses)return{childAnalyses:t.length};let r=kn(e.length,t.length,q.maxDerivedTokens);if(r>q.maxDerivedTokens)return{childAnalyses:t.length,derivedTokens:r};let o=Fz(e.map((c)=>Wz(c,n))),i=kn(o.occurrences,t.length,q.maxPlaceholderReplacements);if(i>q.maxPlaceholderReplacements)return{childAnalyses:t.length,derivedTokens:r,placeholderReplacements:i};if(Lz(o,t,i))return{childAnalyses:t.length,derivedTokens:r,derivedBytes:q.maxDerivedBytes+1,placeholderReplacements:i};let s=n==="generic"?Xt:rd,a=Je(t.map((c)=>Do(e.map((l)=>s(l,c)))),q.maxDerivedBytes);return{childAnalyses:t.length,derivedTokens:r,derivedBytes:a,placeholderReplacements:i}}function Lz(e,t,n){let r=q.maxDerivedBytes+4*n;return Je([kn(e.fixedBytes,t.length,r),kn(e.occurrences,Je(t.map((o)=>o.reduce((i,s)=>Math.max(i,Oo(s)),0)),r),r)],r)>r}function Wz(e,t){let n=t==="generic"?e.matchAll(/\{[^{}\s]*\}/g):e.matchAll(z_),r=0,o=0,i=0;for(let s of n){if(r>=q.maxPlaceholderReplacements)return{occurrences:q.maxPlaceholderReplacements+1,fixedBytes:0};o=Je([o,Oo(e.slice(i,s.index))],td),r++,i=s.index+s[0].length}return{occurrences:r,fixedBytes:r===0?Oo(e):Je([o,Oo(e.slice(i))],td)}}function Fz(e){return{occurrences:Je(e.map((t)=>t.occurrences),q.maxPlaceholderReplacements),fixedBytes:Je(e.map((t)=>t.fixedBytes),td)}}function Do(e,t=q.maxDerivedBytes){return Je(e.map(Oo),t)}function Oo(e){return kz.encode(e).byteLength}function Je(e,t){let n=0;for(let r of e){if(!Number.isSafeInteger(r)||r<0||r>t-n)return t+1;n+=r}return n}function kn(e,t,n){if(!Number.isSafeInteger(e)||!Number.isSafeInteger(t)||e<0||t<0||e!==0&&t>Math.floor(n/e))return n+1;return e*t}function F_(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function Xt(e,t){return e.replace(/\{[^{}\s]*\}/g,(n)=>G_(n,t))}function rd(e,t){return e.replace(z_,(n)=>G_(n,t))}function G_(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n),o=r>0?r-1:t.length+r;return t[o]??""}function ne(e){return Cz.test(e)}function Z_(e){if(id(e))return!0;for(let t of e.matchAll(/\{[^{}\s]*\}/g))if(!/^(?:\{\}|\{-?\d+\})$/.test(t[0]))return!0;return!1}function id(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function j_(e){return/^\{[^{}\s]*\}$/.test(e)}function U_(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,c,l=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let A=Du(e,t+1);n.push(...A.templateTokens),r=t+1,o=A.markerIndex;break}if(!p.startsWith("-")){let A=Du(e,t);n.push(...A.templateTokens),r=t,o=A.markerIndex;break}let h=e[t+1],y=p.indexOf("="),b=y===-1?p:p.slice(0,y),E=y===-1?void 0:p.slice(y+1);if(p==="--dry-run"){a=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){l||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){l=!0,t+=2;continue}if(b==="--replace"||p.startsWith("-i")&&p.length>2){let A=b==="--replace"?E:p.slice(2);l||=A!==""&&A!=="{}",t++;continue}if(p==="-a"||Pz.has(b)){l=!0,t+=E===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(b==="--env"){l=!0,t+=E===void 0?2:1;continue}if(R_.has(b)||p.startsWith("-S")&&p.length>2){i=!0,t+=R_.has(p)?2:1;continue}if(Az.has(b)){let A=E??h;if(A===void 0||A===":::"||A==="--"){l=!0,t++;continue}c=A,l||=E!==void 0&&A==="",t+=E===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&E!==void 0){t++;continue}if(Rz.has(p)){if(h===void 0||h===":::"||h==="--"){l=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}l||=n.some(a?id:Z_);let u=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let y=e[h];if(y===":::"){u.push(p),p=[];continue}if(y!==void 0)p.push(y)}u.push(p)}let d=Zz(u),m=n.some(ne),f=n.length===0&&o===-1;return{template:n,jobs:d,childStart:r,templateHasPlaceholder:m,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:l,workdir:c,dryRun:a}}function Gz(e,t,n){if(e===void 0)return;if(e==="..."||/[{}$`*?~[]/.test(e))return null;if(!t&&!_z(e))return null;try{return jt(t??e,e,n)}catch{return null}}function Zz(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let n of e){if(n.length===1){let o=n[0];if(o===void 0)return[];for(let i of t)i.push(o);continue}let r=[];for(let o of t)for(let i of n)if(r.push([...o,i]),r.length>q.maxChildAnalyses)return r;t=r}return t}function B_(e){return U_(e).childStart}var jz="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Qs="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function ad(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function sd(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function H_(e,t,n,r,o=!1,i){let a=(po(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&de(i,"shell.dynamic-executable",o)?v("shell.dynamic-executable",jz):null;return z(a,i)??q_(e,t,n,o,i)}function q_(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,c)=>ad(a)?[c]:[]);if(i.length===0)return null;let s=H(t[0]?.text??"");if(s==="git"){let a=Kn(e,t),c=Bz(a);if(de(o,"shell.dynamic-structure",r)&&i.some((d)=>d<=c))return z(v("shell.dynamic-structure",Qs),o);if(z(lr(a,{env:n.env}),o))return null;let l=t[c]?.text.toLowerCase(),u=a.findIndex((d,m)=>m>c&&N(d)==="--");if(de(o,"shell.dynamic-structure",r)&&l&&cr.has(l)&&i.some((d)=>d>c&&(u===-1||d<u)))return z(v("shell.dynamic-structure",Qs),o);return null}if(s==="find")return de(o,"shell.dynamic-structure",r)&&Vz(t)?z(v("shell.dynamic-structure",Qs),o):null;if(s==="rm"){let a=t.findIndex((l,u)=>u>0&&N(l)==="--"),c=ct(t.map(N));return de(o,"shell.dynamic-structure",r)&&i.some((l)=>(a===-1||l<a)&&(l<t.length-1||!c))?z(v("shell.dynamic-structure",Qs),o):null}if(s==="xargs")return V_(e,t.slice(Rn(t.map(N)).childStart),"xargs",n,r,o);if(s==="parallel")return V_(e,t.slice(B_(t.map(N))),"parallel",n,r,o);return null}function V_(e,t,n,r,o,i){if(t.length===0)return null;let s=Uz(t,r);if(po(e,s)){let c=z(v(`${n}.shell-dynamic`,n==="xargs"?Xu:No),i);if(c)return c}let a=q_(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((c)=>ad(c)&&sd(c)))return z(v(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ju:zo),i);return null}function Uz(e,t){let n=bn(e,t),r=n.rewritten?j(n.words.map(N)):n.words,o=r[0];return o&&N(o)==="busybox"?r.slice(1):r}function Bz(e){let t=1;while(t<e.length){let n=e[t],r=n?N(n):"";if(He.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function Vz(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=ad(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||sd(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||sd(s)))return!0;continue}if(t=!0,a)return!0;let c=qt(s.text);if(c>0){n=c;continue}if(Lt(s.text))o=!0,r=!0}return!1}function cd(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!Zi(t[n.tokenIndex],n.value)})}var Hz="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",qz="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",Kz="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function K_(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return v("dd.device-write",Hz);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return v("mkfs.device",qz);if(e==="shred"&&n.length>0)return v("shred.target",Kz);return null}var J_=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>ur(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:pt(e.envAssignments,e.options.environment),trustedTmpdirValue:Mt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy})},{heads:new Set(["git"]),analyze:(e)=>lr(e.words,ld(e))},{heads:new Set(["find"]),analyze:(e)=>Us(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:pt(e.envAssignments,e.options.environment),trustedTmpdirValue:Mt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,derivedCommandWorkBudget:e.options.derivedCommandWorkBudget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Tn(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>S_(e.words,{...Y_(e),analyzeNested:(t,n)=>Tn(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>D_(e.words,{...Y_(e),budget:e.options.parallelBudget,analyzeNested:(t,n)=>Tn(e.options.analyzeNested(t,n))})}];function Y_(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,derivedCommandWorkBudget:e.options.derivedCommandWorkBudget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy,scanWork:e.options.scanWork}}function Tn(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function ld(e){return{env:e.options.environment.env,cwd:e.cwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var tS="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function nS(e){return J_.find((t)=>t.heads.has(e))?.analyze}function Mo(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(S)=>S.map((w)=>o==="posix"?N(w):w.text),s=n.effectiveCwd===null,a=s?void 0:n.effectiveCwd??n.cwd,c=s?void 0:n.cwd,l=ms(e);if(l.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...l.envAssignments.keys()],output:i(l.words)});let u=bn(l.words,n.environment,a,new Map([...n.envAssignments??[],...l.envAssignments])),d=u.envSplitValues??[];if(d.length>0){let S=[...d,...i(u.words)].join(" "),w=Dt(S,n.scanWork);if(w)return r?.recordSegment({type:"dangerous-text",token:S,matched:!0,reason:w.reason}),xt(w);if(n.strict)return Fe(r);let O=fs(d,i(u.words));if(O){et(n.derivedCommandWorkBudget,O.length);let Z=n.analyzeNested(O.join(" "),{effectiveCwd:u.cwd===void 0?n.effectiveCwd:u.cwd,envAssignments:new Map([...n.envAssignments??[],...l.envAssignments,...u.envAssignments])});if(Z)return Z}}let m=u.rewritten?j(i(u.words)):Kn(o,u.words),f=i(m),p={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&l.words.length>m.length){let S=i(l.words);r.recordSegment({type:"leading-tokens-stripped",input:S,removed:S.slice(0,S.length-m.length),output:f})}let h=new Map([...n.envAssignments??[],...l.envAssignments,...u.envAssignments]),y=f[0];if(!y)return null;if(Cn(y))throw new De;let b=H(y),E=u.cwd===null?void 0:u.cwd??a,A=u.cwd===null?void 0:c,C=u.cwd===void 0?n.effectiveCwd:u.cwd,P=!lo(h,n.environment),L=H_(o,u.words,n.environment,t===0,n.strict,n.policy);if(L)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:L.reason}),xt(L);let k=Zs(f,n.policy);if(k){for(let S of[k.childIndex,...k.alternativeChildIndices]){X_(p.wrapperNormalizationBudget);let w=m.slice(S);r?.recordSegment({type:"transparent-wrapper",wrapper:k.wrapper,output:i(w)});let O=Mo(w,t,{...p,effectiveCwd:C,envAssignments:h});if(O)return O}return null}let U=b==="eval"?dr(m):b==="trap"?m_(m):void 0;if(U?.kind==="dynamic"&&(n.strict||!n.commandView||!Ku(n.commandView)))return Fe(r);if(U?.kind==="literal"){r?.recordSegment({type:"recurse",reason:b==="eval"?"shell-eval":"shell-trap",innerCommand:U.source,depth:t+1});let S=n.analyzeNested(U.source,{effectiveCwd:C,envAssignments:h,functionDefinitions:n.functionDefinitions});if(S)return S}if(oS(y,b)){if(Ye(f))return null;let S=Yz(f,h,C,n,r,t);if(S)return S;let w=bt(f);if(w){let jn=Hs(m,w);if(jn.kind==="dynamic")return Fe(r);let xl=jn.kind==="literal"?jn.source:w,Nh=Jz(xl);r?.recordSegment({type:"shell-wrapper",wrapper:b,innerCommand:Nh}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Nh,depth:t+1});let Dh=n.analyzeNested(xl,{effectiveCwd:C,envAssignments:h});if(Dh)return Dh;return mr(xl)?Fe(r):null}let O=_t(m);if(O.kind==="dynamic")return Fe(r);if(O.kind==="literal")return na(O.source,C,h,n,r,t);let Z=f_(m,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(Z.kind==="dynamic")return Fe(r);if(Z.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:Z.source,depth:t+1}),n.analyzeNested(Z.source,{effectiveCwd:C,envAssignments:h})}if(b==="source"||b==="."){let S=f[1]==="-p"?2:null;if(S!==null){let jn=n.commandView?m[S]:void 0;if(!jn)return null;if(jn.provenance!=="literal")return Fe(r)}let w=S===null?1:3,O=f[w]==="--"?w+1:w,Z=n.commandView?m[O]:void 0;if(!Z)return null;if(Z.provenance==="literal")return na(Z.text,C,h,n,r,t);if(n.strict||!n.commandView||!Ku(n.commandView))return Fe(r)}if(We.has(b)){if(n.strict&&cd(Ro(f),m))return Fe(r);let S=Gs(f,(O)=>Tn(n.analyzeNested(O,{effectiveCwd:C,envAssignments:h}))),w=z(S,n.policy);if(w)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:w.reason}),xt(w)}if(Me(b)){if(n.strict&&cd(os(f),m))return Fe(r);let S=rs(f);if(S){let w=de(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:b,codeArg:S,paranoidBlocked:w}),w){let Z=z(v("interpreter.one-liner-paranoid",er),n.policy);if(Z)return xt(Z)}if(ss(b,S))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:S,depth:t+1});let O=n.analyzeNested(S,{effectiveCwd:C,envAssignments:h});if(O&&O.ruleId!=="raw-text.dangerous-command"&&(O.reason!==Ut||ir(S)))return O;if(tr(S,n.scanWork)){let Z=z(v("interpreter.dangerous-command",yn),n.policy);if(Z)return r?.recordSegment({type:"dangerous-text",token:S,matched:!0,reason:yn}),xt(Z)}r=void 0}}if(b==="busybox"&&f.length>1)return X_(p.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:f[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:f.slice(1).join(" "),depth:t+1}),Mo(m.slice(1),t,{...p,effectiveCwd:C,envAssignments:h});let ie=z(K_(b,f),n.policy);if(ie)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:ie.reason}),xt(ie);let se=r===p.trace?p:{...p,trace:r},J={words:m,head:b,cwd:E,originalCwd:A,envAssignments:h,allowTmpdirVar:P,dynamicArguments:u.words.some((S)=>S.provenance==="command-substitution"),depth:t,effectiveCwd:C,options:se,analyzeChildTokens:(S,w)=>Tn(Mo(j(S),t+1,{...se,commandView:void 0,effectiveCwd:w,envAssignments:h}))??be(S,se.policy.rules)},B=nS(b);if(b==="rm"||b==="xargs"||b==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:h.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,isOverriddenToNonTemp:!P,allowTmpdirVar:P});let R=r&&b==="git"?t_(J.words,ld(J)):void 0,T=Q_(R?R.match:B?.(J)??null,n.policy);if(r)Xz(J,T,R?.relaxation??null);if(T)return xt(T);let V=B!==void 0;if(!V)if(!ts.has(b)){let S=r?[]:void 0;for(let w=1;w<f.length;w++){let O=f[w];if(!O)continue;S?.push(O);let Z=Q_(Qz(J,f,w),n.policy);if(Z)return r?.recordSegment({type:"fallback-scan",tokensScanned:S??[],embeddedCommandFound:H(O)}),xt(Z)}r?.recordSegment({type:"fallback-scan",tokensScanned:S??[]})}else r?.recordSegment({type:"fallback-scan",tokensScanned:[]});else r?.recordSegment({type:"fallback-scan",tokensScanned:[]});if(t===0||!V){let S=be(f,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!S,reason:S?.reason}),S)return xt(S)}else r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1});return null}function Yz(e,t,n,r,o,i){let s=a_(e);if(s.argvSource?.kind==="absent")return Fe(o);if(s.argvSourceApplies&&s.argvSource){let c=na(s.argvSource.value,n,t,r,o,i,!0);if(c)return c}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return na(a,n,t,r,o,i,!0)}function na(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return Fe(o);let a=co(e,t,r.environment.paths),c=a?r.literalHeredocFiles?.get(a):void 0;if(c===void 0)return s?Fe(o):null;return et(r.derivedCommandWorkBudget,1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:c,depth:i+1}),r.analyzeNested(c,{effectiveCwd:t,envAssignments:n})}function Jz(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function Xz(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function X_(e){if(e.iterations>=Xn)throw new De;e.iterations++}function xt(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function Fe(e){return e?.recordSegment({type:"error",message:tS}),xt(rS())}function rS(){return{id:"",reason:tS,intent:"stop_and_explain"}}function oS(e,t){return me.has(t)||e==="$SHELL"||e==="${SHELL}"||me.has(F(t))}function Qz(e,t,n){let r=at(t.slice(n),{environment:e.options.environment,cwd:e.cwd,envAssignments:e.envAssignments,policy:e.options.policy});for(let o of r){let i=eN(e,n,o);if(i)return i}return null}function eN(e,t,n){let r=n.tokens[0];if(!r)return null;let o=H(r);if(oS(r,o)){et(e.options.derivedCommandWorkBudget,e.words.length-t);let c=n.tokens;if(Ye(c))return null;let l=bt(c);if(!l){if(_t(j(c)).kind==="dynamic")return rS();return ta(e,n)}let u=e.options.analyzeNested(l,{effectiveCwd:n.wrapperCwd===void 0?e.effectiveCwd:n.wrapperCwd,envAssignments:n.envAssignments});return u?Tn(u):ta(e,n)}let i=nS(o);if(!i||o==="xargs"||o==="parallel"){if(n.wrappedByTransparent&&e.options.policy.rules.length>0)et(e.options.derivedCommandWorkBudget,e.words.length-t);return ta(e,n)}et(e.options.derivedCommandWorkBudget,e.words.length-t);let s=[o,...n.tokens.slice(1)],a={...e,words:j(s),head:o,cwd:n.cwd,originalCwd:n.wrapperCwd===null?void 0:e.originalCwd,envAssignments:n.envAssignments,allowTmpdirVar:!lo(n.envAssignments,e.options.environment),effectiveCwd:n.wrapperCwd===void 0?e.effectiveCwd:n.wrapperCwd,options:o==="git"?{...e.options,worktreeMode:!1}:e.options};return i(a)??ta(e,n)}function ta(e,t){return t.wrappedByTransparent?be(t.tokens,e.options.policy.rules):null}function Q_(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:z(e,t)}var tN=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,nN=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function rN(e,t){let n=aS(e,t);if(n.length===0)return!1;let r=n[sS(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return tN.test(e.join(" "))}function iS(e,t,n,r){if(e.dialect==="powershell"){let a=oN(e.words,r);if(a.kind==="none")return;if(!t||a.kind==="unknown")return null;return eS(cN(a.target),t,n.paths)}let o=e.words.map(N);if(!rN(o,n))return;if(!t)return null;let i=aS(o,n,t),s=sS(i);if(s===-1||i[s]!=="cd")return null;return eS(i[s+1],t,n.paths)}function eS(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return lN(jt(t,e,n),t,n)?t:null}catch{return null}}function oN(e,t){let n=iN(e[0])?1:0,r=e[n];if(!sN(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!nN.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return aN(e.slice(n+1),t)}function iN(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function sN(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function aN(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function cN(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function sS(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function aS(e,t,n){let r=uN(e);return Bt([...r],t,n)}function lN(e,t,n){let r=n.realpath(e),o=n.realpath(t);if(r===null||o===null)return ea(e)===ea(t);return ea(r)===ea(o)}function uN(e){let t=0;while(t<e.length){let n=e[t];if(n==="{"||n==="("||n==="$(")t++;else break}return e.slice(t)}var dd="TMPDIR",md="IFS",cS=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,lS=/^[A-Za-z_][A-Za-z0-9_]*$/,uS=new Set(["export","typeset","declare","readonly"]),dN=new Set(["builtin","command","time"]);function dS(e,t){return{env:e,effectiveEnvAssignments:hN(e,t),shellAssignments:new Map}}function mS(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments)}}function fd(e,t){let n=pS(e,t);n.assignments.filter((s)=>s.persists).forEach((s)=>{t.shellAssignments.set(s.name,s.value),pd(t,s)});let r=n.commandIndex;if(r!==-1&&uS.has(e[r]??""))e.filter((s)=>lS.test(s)&&ud(s)).forEach((s)=>{yN(t,s)});let o=r===-1?-1:gS(e,r);if(o===-1||e[o]!=="unset")return;let i=vN(e,o);if(i===null)return;e.slice(i).forEach((s)=>{bN(t,s)})}function fS(e,t){let n=pS(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function pS(e,t){let n=e.findIndex((s)=>!mN(s)),r=n!==-1&&uS.has(e[gS(e,n)]??""),o=gN(t);return{assignments:e.flatMap((s,a)=>{let c=fN(s,o,t.env);if(!c)return[];if(n!==-1&&a>n&&!r&&!Gl(c.name))return[];return o.set(c.name,c.value),[{...c,persists:n===-1||r}]}),commandIndex:n}}function gS(e,t){let n=t;while(dN.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function mN(e){return qe(e)!==null||cS.test(e)}function fN(e,t,n){return qe(e)??pN(e,t,n)}function pN(e,t,n){let r=Bi(e,n,t);if(r)return r;let o=e.match(cS)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function ud(e){return e===dd||e===md||Zl(e)}function gN(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function hN(e,t){let n=[...ji,dd,md].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function pd(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function yN(e,t){pd(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function bN(e,t){if(!ud(t)&&!lS.test(t))return;if(e.shellAssignments.set(t,""),!ud(t)||t===dd||t===md||eo(t)){pd(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function vN(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var _N="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",In="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.",SN=64;function vd(e,t,n,r){let o=n.derivedCommandWorkBudget===void 0,i=n.parallelBudget===void 0;try{return xN(e,t,{...n,derivedCommandWorkBudget:n.derivedCommandWorkBudget??Qi(),parallelBudget:n.parallelBudget??ib()},r)}catch(s){let a=s instanceof De&&o?Yy:s instanceof ls&&i?ob:void 0;if(!a)throw s;if(n.trace?.currentSegmentIndex!==void 0)n.trace.recordSegment({type:"error",message:a});else n.trace?.recordGlobal({type:"error",message:a});return{reason:a,segment:e,intent:"stop_and_explain"}}}function xN(e,t,n,r){if(t>=es)return n.trace?.recordSegment({type:"error",message:It}),{reason:It,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??rt(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:It}),{reason:It,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let l=o.issues.find((u)=>u.code.includes("heredoc"));if(l){if(!n.strict)return bd(e,n);let u=`Unsupported heredoc syntax: ${l.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return SS(e,n),{reason:Ut,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return SS(e,n),{reason:Ut,segment:e,intent:"stop_and_explain"};if(o.issues.some((l)=>l.code.includes("quote"))&&!n.analyzePartialProgram)return bd(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,c=dS(n.environment.env,n.envAssignments);return ia(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:c,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function ia(e,t,n,r,o){let i=[...o],s,a;for(let[c,l]of e.nodes.entries()){if(l.kind==="connector"){a=l.operator;continue}let u=e.nodes[c+1],d=u?.kind==="connector"?u.operator:void 0,m=CN(e,c,l,a,d),f=a==="&&"||a==="||",p=f?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,y=a==="||"?p?.success??[]:[],b=a==="&&"?p?.failure??[]:[],E=f||pr(d);if(l.kind==="function"){let ie=h.flatMap((J)=>{let B=$o(J);return B.functionDefinitions.set(l.name,l.body),gd(J,[B],m,d==="&",pr(d))}),se=hd(ie,[],y,b,a,d);i=se.states,s=se.conditionalStates,a=void 0;continue}if(l.kind==="group"){let ie=[],se=[];for(let B of h){let R=ia(l.body,t,n,r,[$o(B)]);if(R.result)return R;if(ie.push(...gd(B,R.states,m,d==="&",pr(d))),E)se.push(B,...m?R.states.map((T)=>ra(B,T)):R.states)}let J=hd(ie,se,y,b,a,d);i=J.states,s=J.conditionalStates,a=void 0;continue}if(l.kind!=="command")continue;let A=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),C=e.nodes[c-2],P=sa(a)&&C?.kind==="command"?d_(C)??wN(C):void 0,L=[],k=[];for(let ie of h){let se=RN(l,t,n,r,[$o(ie)]);if(se.result)return{result:se.result,states:i};let J=e.dialect==="powershell"?se.states:se.states.map((B)=>ra(ie,B));for(let B of J){let R=$o(B),T=kN(l,t,n.trace?{...n,trace:xS(n.trace,A)}:n,r,R,sa(a),P);if(T)return{result:T,states:i};let V=ZN(l,R.functionDefinitions);if(V)et(n.derivedCommandWorkBudget,aa(V));let S=V?t+1>=es?yd(l.displayText,n,[R]):ia(V,t+1,n,r,[R]):{result:null,states:[R]};if(S.result)return S;if(L.push(...gd(ie,S.states,m,d==="&",pr(d))),E)k.push(ie),k.push(...S.states.map((w)=>m?ra(ie,w):w))}}let U=hd(L,k,y,b,a,d);i=U.states,s=U.conditionalStates,a=void 0}return{result:null,states:i}}function CN(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(sa(r)||sa(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&EN(e,t)}function gd(e,t,n,r,o){let i=n?t.map((a)=>ra(e,a)):[...t],s=o?i.flatMap((a)=>Lo(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ra(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function EN(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(PN(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function sa(e){return e==="|"||e==="|&"}function wN(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function pr(e){return e==="&&"||e==="||"}function hd(e,t,n,r,o,i){let s={success:oa([...n,...e]),failure:oa([...r,...t])},a=pr(i)?s:void 0;return{states:pr(o)||a?oa([...s.success,...s.failure]):s.success,conditionalStates:a}}function xS(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function RN(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=AN(e);if(s){if(t+1>=es)return yd(s,n,o);let a=rt(s,"powershell");if(a.status==="limited")return yd(s,n,o);if(a.status!=="complete")return hS(i,n,r,o);et(n.derivedCommandWorkBudget,aa(a)),i.push({program:a,depth:t+1})}}return hS(i,n,r,o)}function PN(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function hS(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let c=ia(i.program,i.depth,t,n,[$o(a)]);if(c.result)return c;s.push(...c.states)}o=oa(s)}return{result:null,states:o}}function AN(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function aa(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+aa(o),0):n.kind==="group"||n.kind==="function"?aa(n.body):0),0)}function yd(e,t,n){return t.trace?.recordSegment({type:"error",message:It}),{result:{reason:It,segment:e,intent:"stop_and_explain"},states:[...n]}}function kN(e,t,n,r,o,i,s){let a=MN(e);if(a&&n.strict)return n.trace?.recordSegment({type:"error",message:a}),{reason:a,segment:e.source,intent:"stop_and_explain"};CS(e,o,"before-consumer",n.environment.paths);let c=Kn(e.dialect,e.words).map(N),l=e.displayText,u=fS(c,o.shellGitContextState);if(e.dialect==="powershell"){let f=z(Iv(e,i,UN(n,o.effectiveCwd)),n.policy);if(n.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!f,reason:f?.reason}),f)return jN(l,f)}if(c.length===1&&c[0]?.includes(" ")&&!po(e.dialect,e.words)){let f=z(Dt(c[0],n.scanWork),n.policy),p=f!==null&&!n.strict&&Hy(e,n.rootProgram,n.scanWork);if(f&&!p)return n.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!0,reason:f.reason}),{reason:f.reason,segment:l,ruleId:f.id,intent:f.intent};n.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!1});let h=yS(e,a,o,u,s,n);if(h)return h;return fd(c,o.shellGitContextState),null}let d=Mo(e.words,t,{...n,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:u,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(f,p)=>{let h=p&&Object.hasOwn(p,"effectiveCwd")?p.effectiveCwd:o.effectiveCwd,y=vd(f,t+1,{...n,derivedCommandWorkBudget:n.derivedCommandWorkBudget,effectiveCwd:h,envAssignments:p?.envAssignments??u,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:p?.functionDefinitions,worktreeMode:p?.worktreeMode??n.worktreeMode,trace:n.trace?xS(n.trace,n.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(d)return{...d,segment:l};let m=yS(e,a,o,u,s,n);if(m)return m;return fd(c,o.shellGitContextState),null}function yS(e,t,n,r,o,i){let s=$N(e,t,n,r??new Map,i);if(s)return s;return CS(e,n,"after-consumer",i.environment.paths),n.literalHeredocFiles.clear(),ON(e,t,n,i.environment.paths),FN(e,n,o,i.environment,i.trace),null}var TN=new Set([">>","<>"]);function CS(e,t,n,r){for(let i of e.redirections){if(!(n==="before-consumer"?IN(i):TN.has(i.operator)))continue;bS(i.target,t,r)}if(n!=="before-consumer"||!Ge(e.words[0],"tee"))return;let o=ES(e.words.slice(1));if(!o)return;for(let i of o.operands)bS(i,t,r)}function IN(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function bS(e,t,n){let r=e?.provenance==="literal"?co(e.text,t.effectiveCwd,n):void 0;if(!r)return;t.literalHeredocFiles.delete(r)}function ON(e,t,n,r){if(t)return;let o=e.redirections.find((i)=>i.operator==="<<"||i.operator==="<<-")?.heredoc;if(!o||!ca(o))return;for(let i of zN(e)){let s=co(i.text,n.effectiveCwd,r);if(!s||!Qy(s))continue;if(!n.literalHeredocFiles.has(s)&&n.literalHeredocFiles.size>=Xy)throw new De;n.literalHeredocFiles.set(s,o.body)}}function zN(e){let t=DN(e.redirections)?.target,n=vS(t)?[t]:[];if(Ge(e.words[0],"cat"))return NN(e.words)?n:[];if(!Ge(e.words[0],"tee"))return[];let r=ES(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(vS))return[];return[...r.operands,...n]}function NN(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function DN(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function ES(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&Ge(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function vS(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function Ge(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function ca(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function MN(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return In;let n=t[0];if(!n?.heredoc)return In;if(!ca(n.heredoc))return _N;if(n.fd!==void 0&&n.fd!==0)return In;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return In;let r=e.redirections.some((s)=>s!==n&&_S(s.target));if(Ge(e.words[0],"cat"))return r?In:void 0;if(Ge(e.words[0],"tee"))return r||e.words.slice(1).some(_S)?In:void 0;let o=e.words[0],i=e.words[1];if(Ge(o,"git")&&(Ge(i,"apply")||Ge(i,"commit")))return;if(Ge(o,"gh")&&(Ge(i,"pr")||Ge(i,"issue"))&&Ge(e.words[2],"create"))return;return In}function _S(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function $N(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-"),s=i.flatMap((l)=>l.heredoc?[l.heredoc.body]:[]);if(WN(e,i,n,r,o))return null;let a=LN(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let c=bd(s.length===i.length?s.join(`
-`):e.source,o);return c?{...c,segment:e.displayText}:null}function LN(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!ca(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!Me(o.text))return;if(!e.words.slice(1).every((l)=>l.provenance==="literal"&&l.text.startsWith("-")))return;let s=r.heredoc.body,a=de(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let l=z(v("interpreter.one-liner-paranoid",er),n.policy);if(l)return l}if(!tr(s,n.scanWork))return null;let c=z(v("interpreter.dangerous-command",yn),n.policy);if(!c)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:c.reason}),c}function WN(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!ca(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=bn(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(N),c=H(a[0]??"");if((s.envSplitValues?.length??0)>0||!me.has(c)&&!me.has(F(c)))return!1;return Ye(a)}function FN(e,t,n,r,o){let i=iS(e,t.effectiveCwd,r,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(N).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}function $o(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:mS(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function oa(e){let t=[];for(let n of e){if(!t.some((r)=>GN(r,n)))t.push(n);if(t.length>SN)throw new De}return t}function GN(e,t){return e.effectiveCwd===t.effectiveCwd&&Lo(e.literalHeredocFiles,t.literalHeredocFiles)&&Lo(e.functionDefinitions,t.functionDefinitions)&&Lo(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Lo(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)}function Lo(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function ZN(e,t){let n=Ps(e);return n===void 0?void 0:t.get(n)}function jN(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function UN(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy}}function bd(e,t){let n=z(Dt(e,t.scanWork),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function SS(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:Ut};if(t.trace?.currentSegmentIndex===void 0)t.trace?.recordGlobal(n);else t.trace.recordSegment(n)}var Wo=["fail_closed","paranoid_rm","paranoid_interpreters"],la={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var fe={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},ua=["standard","strict","paranoid"];function BN(e,t){if(!t)return e;return ua.indexOf(t)>ua.indexOf(e)?t:e}function VN(){let e=Ed(fe.level);if(e===void 0||e==="")return;if(ua.includes(e))return e;console.error(`CC Safety Net: ignored invalid ${fe.level.name}=${JSON.stringify(e.slice(0,40))}. Use ${ua.join(", ")}.`);return}function HN(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Sd(){return HN(Ed(fe.auditScope))==="all"}function xd(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Cd(e={}){let t=e.safety?.level??"standard",n=VN(),r=BN(t,n),o=la[r],i={failClosed:o.fail_closed,paranoidRm:o.paranoid_rm,paranoidInterpreters:o.paranoid_interpreters},s={failClosed:r===t?"preset":"environment",paranoidRm:r===t?"preset":"environment",paranoidInterpreters:r===t?"preset":"environment"},a={failClosed:[`policy safety.level=${t}`],paranoidRm:[`policy safety.level=${t}`],paranoidInterpreters:[`policy safety.level=${t}`]};if(r!==t)a.failClosed.push(`env ${fe.level.name}=${n}`),a.paranoidRm.push(`env ${fe.level.name}=${n}`),a.paranoidInterpreters.push(`env ${fe.level.name}=${n}`);if(e.safety?.overrides?.failClosed!==void 0)i.failClosed=e.safety.overrides.failClosed,s.failClosed="capability_override",a.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)i.paranoidRm=e.safety.overrides.paranoidRm,s.paranoidRm="capability_override",a.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)i.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,s.paranoidInterpreters="capability_override",a.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Qt(fe.strict))i.failClosed=!0,s.failClosed="environment",a.failClosed.push(`env ${fe.strict.name}`);if(Qt(fe.paranoid))i.paranoidRm=!0,i.paranoidInterpreters=!0,s.paranoidRm="environment",s.paranoidInterpreters="environment",a.paranoidRm.push(`env ${fe.paranoid.name}`),a.paranoidInterpreters.push(`env ${fe.paranoid.name}`);if(Qt(fe.paranoidRm))i.paranoidRm=!0,s.paranoidRm="environment",a.paranoidRm.push(`env ${fe.paranoidRm.name}`);if(Qt(fe.paranoidInterpreters))i.paranoidInterpreters=!0,s.paranoidInterpreters="environment",a.paranoidInterpreters.push(`env ${fe.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Qt(fe.worktree);return{strict:i.failClosed,paranoidRm:i.paranoidRm,paranoidInterpreters:i.paranoidInterpreters,worktreeMode:c,effectiveLevel:xd(i),capabilities:{fail_closed:{enabled:i.failClosed,source:s.failClosed,sources:a.failClosed},paranoid_rm:{enabled:i.paranoidRm,source:s.paranoidRm,sources:a.paranoidRm},paranoid_interpreters:{enabled:i.paranoidInterpreters,source:s.paranoidInterpreters,sources:a.paranoidInterpreters}}}}function Qt(e){let t=typeof e==="string"?_d(e):Ed(e);return t==="1"||t?.toLowerCase()==="true"}function _d(e){return Object.hasOwn(process.env,e)?process.env[e]:void 0}function Ed(e){let t=_d(e.name);if(t!==void 0)return t;if(e.legacyName)return _d(e.legacyName);return}function wS(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:wd(t.fail_closed,e.strict,"strict"),paranoid_rm:wd(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:wd(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:By(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:xd({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function wd(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function RS(e,t,n,r){let o=vd(e,0,{...t,...wS(t),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:[{kind:"command",command:e,segment:o.segment}]}}var qN=new Set(["src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js"]),Pd=new Set(["cc-safety-net","ccsn"]),KN=new Set(["bunx","npx","pnpx"]),YN=new Set(["pnpm","yarn"]),JN=new Set(["npm","pnpm","yarn"]),XN=new Set(["bun","node"]);function ma(e,t,n={}){if(Pd.has(e))return 0;if(KN.has(e)){if(n.broad)return Rd(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return da(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&JN.has(e)&&n.broad&&t[r]==="exec"){let o=Rd(t.slice(r+1));return o===null?null:r+1+o}if(YN.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&da(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Rd(t.slice(r+1));return o===null?null:r+1+o}if(XN.has(e)){let o=n.broad&&r!==-1?r:0;if(PS(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&PS(t[o+1]))return o+2}return null}function Rd(e){let t=e.findIndex((r)=>da(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!da(r))break;n++}return n}function da(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return Pd.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return Pd.has(e.slice(0,t))}function PS(e){let t=e?.replaceAll("\\","/");return[...qN].some((n)=>t===n||t?.endsWith(`/${n}`))}function gr(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}var AS="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function kS(e){let t=xe(e,"input-candidate");if(!t)return null;let n=Ot(Qe()),r=sr(t.shell,e.invocation.context.executionCwd,n,{findSegmentTarget:(o)=>eD(o,n.environment),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null,normalizeCwd:ye});return r?{target:r}:null}function eD(e,t){let n=Bt([...e],t),r=n.slice(1),o=ma(F(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as yl}from"path";import{chmodSync as jB,existsSync as aM,mkdirSync as UB,readFileSync as cM}from"fs";import{dirname as lM,join as uM}from"path";import{createRequire as q0}from"module";var dh={};ln(dh,{$brand:()=>pa,$input:()=>Ba,$output:()=>Ua,NEVER:()=>fa,TimePrecision:()=>mc,ZodAny:()=>wg,ZodArray:()=>kg,ZodBase64:()=>Kc,ZodBase64URL:()=>Yc,ZodBigInt:()=>qr,ZodBigIntFormat:()=>Qc,ZodBoolean:()=>Hr,ZodCIDRv4:()=>Hc,ZodCIDRv6:()=>qc,ZodCUID:()=>Fc,ZodCUID2:()=>Gc,ZodCatch:()=>Jg,ZodCodec:()=>al,ZodCustom:()=>_i,ZodCustomStringFormat:()=>Br,ZodDate:()=>gi,ZodDefault:()=>Bg,ZodDiscriminatedUnion:()=>Ig,ZodE164:()=>Jc,ZodEmail:()=>$c,ZodEmoji:()=>Lc,ZodEnum:()=>jr,ZodError:()=>lx,ZodExactOptional:()=>Zg,ZodFile:()=>Fg,ZodFirstPartyTypeKind:()=>cl,ZodFunction:()=>sh,ZodGUID:()=>ui,ZodIPv4:()=>Bc,ZodIPv6:()=>Vc,ZodISODate:()=>si,ZodISODateTime:()=>ii,ZodISODuration:()=>ci,ZodISOTime:()=>ai,ZodIntersection:()=>Og,ZodIssueCode:()=>EC,ZodJWT:()=>Xc,ZodKSUID:()=>Uc,ZodLazy:()=>rh,ZodLiteral:()=>Wg,ZodMAC:()=>bg,ZodMap:()=>$g,ZodNaN:()=>Qg,ZodNanoID:()=>Wc,ZodNever:()=>Pg,ZodNonOptional:()=>il,ZodNull:()=>Cg,ZodNullable:()=>Ug,ZodNumber:()=>Vr,ZodNumberFormat:()=>Fn,ZodObject:()=>yi,ZodOptional:()=>ol,ZodPipe:()=>sl,ZodPrefault:()=>Hg,ZodPromise:()=>ih,ZodReadonly:()=>eh,ZodRealError:()=>we,ZodRecord:()=>vi,ZodSet:()=>Lg,ZodString:()=>Ur,ZodStringFormat:()=>Y,ZodSuccess:()=>Yg,ZodSymbol:()=>Sg,ZodTemplateLiteral:()=>nh,ZodTransform:()=>Gg,ZodTuple:()=>Ng,ZodType:()=>M,ZodULID:()=>Zc,ZodURL:()=>pi,ZodUUID:()=>At,ZodUndefined:()=>xg,ZodUnion:()=>bi,ZodUnknown:()=>Rg,ZodVoid:()=>Ag,ZodXID:()=>jc,ZodXor:()=>Tg,_ZodString:()=>Mc,_default:()=>Vg,_function:()=>gC,any:()=>Hx,array:()=>hi,base64:()=>Tx,base64url:()=>Ix,bigint:()=>Zx,boolean:()=>_g,catch:()=>Xg,check:()=>hC,cidrv4:()=>Ax,cidrv6:()=>kx,clone:()=>ve,codec:()=>mC,coerce:()=>ll,config:()=>le,core:()=>Pt,cuid:()=>_x,cuid2:()=>Sx,custom:()=>yC,date:()=>Kx,decode:()=>Pc,decodeAsync:()=>kc,default:()=>j0,describe:()=>bC,discriminatedUnion:()=>tC,e164:()=>Ox,email:()=>ux,emoji:()=>bx,encode:()=>Rc,encodeAsync:()=>Ac,endsWith:()=>Ir,enum:()=>nl,exactOptional:()=>jg,file:()=>cC,flattenError:()=>vr,float32:()=>Lx,float64:()=>Wx,formatError:()=>_r,fromJSONSchema:()=>uh,function:()=>gC,getErrorMap:()=>RC,globalRegistry:()=>Oe,gt:()=>wt,gte:()=>Ee,guid:()=>dx,hash:()=>$x,hex:()=>Mx,hostname:()=>Dx,httpUrl:()=>yx,includes:()=>kr,instanceof:()=>_C,int:()=>Dc,int32:()=>Fx,int64:()=>jx,intersection:()=>zg,ipv4:()=>wx,ipv6:()=>Px,iso:()=>li,json:()=>xC,jwt:()=>zx,keyof:()=>Yx,ksuid:()=>Ex,lazy:()=>oh,length:()=>Ln,literal:()=>aC,locales:()=>ei,looseObject:()=>Qx,looseRecord:()=>rC,lowercase:()=>Pr,lt:()=>Et,lte:()=>Ue,mac:()=>Rx,map:()=>oC,maxLength:()=>$n,maxSize:()=>sn,meta:()=>vC,mime:()=>Or,minLength:()=>Ft,minSize:()=>Rt,multipleOf:()=>on,nan:()=>dC,nanoid:()=>vx,nativeEnum:()=>sC,negative:()=>pc,never:()=>el,nonnegative:()=>hc,nonoptional:()=>Kg,nonpositive:()=>gc,normalize:()=>zr,null:()=>Eg,nullable:()=>mi,nullish:()=>lC,number:()=>vg,object:()=>Jx,optional:()=>di,overwrite:()=>ut,parse:()=>xc,parseAsync:()=>Cc,partialRecord:()=>nC,pipe:()=>fi,positive:()=>fc,prefault:()=>qg,preprocess:()=>CC,prettifyError:()=>_a,promise:()=>pC,property:()=>yc,readonly:()=>th,record:()=>Mg,refine:()=>ah,regex:()=>Rr,regexes:()=>je,registry:()=>ti,safeDecode:()=>Ic,safeDecodeAsync:()=>zc,safeEncode:()=>Tc,safeEncodeAsync:()=>Oc,safeParse:()=>Ec,safeParseAsync:()=>wc,set:()=>iC,setErrorMap:()=>wC,size:()=>Mn,slugify:()=>$r,startsWith:()=>Tr,strictObject:()=>Xx,string:()=>Nc,stringFormat:()=>Nx,stringbool:()=>SC,success:()=>uC,superRefine:()=>ch,symbol:()=>Bx,templateLiteral:()=>fC,toJSONSchema:()=>oi,toLowerCase:()=>Dr,toUpperCase:()=>Mr,transform:()=>rl,treeifyError:()=>va,trim:()=>Nr,tuple:()=>Dg,uint32:()=>Gx,uint64:()=>Ux,ulid:()=>xx,undefined:()=>Vx,union:()=>tl,unknown:()=>Wn,uppercase:()=>Ar,url:()=>hx,util:()=>I,uuid:()=>mx,uuidv4:()=>fx,uuidv6:()=>px,uuidv7:()=>gx,void:()=>qx,xid:()=>Cx,xor:()=>eC,z:()=>ul});var ul={};ln(ul,{$brand:()=>pa,$input:()=>Ba,$output:()=>Ua,NEVER:()=>fa,TimePrecision:()=>mc,ZodAny:()=>wg,ZodArray:()=>kg,ZodBase64:()=>Kc,ZodBase64URL:()=>Yc,ZodBigInt:()=>qr,ZodBigIntFormat:()=>Qc,ZodBoolean:()=>Hr,ZodCIDRv4:()=>Hc,ZodCIDRv6:()=>qc,ZodCUID:()=>Fc,ZodCUID2:()=>Gc,ZodCatch:()=>Jg,ZodCodec:()=>al,ZodCustom:()=>_i,ZodCustomStringFormat:()=>Br,ZodDate:()=>gi,ZodDefault:()=>Bg,ZodDiscriminatedUnion:()=>Ig,ZodE164:()=>Jc,ZodEmail:()=>$c,ZodEmoji:()=>Lc,ZodEnum:()=>jr,ZodError:()=>lx,ZodExactOptional:()=>Zg,ZodFile:()=>Fg,ZodFirstPartyTypeKind:()=>cl,ZodFunction:()=>sh,ZodGUID:()=>ui,ZodIPv4:()=>Bc,ZodIPv6:()=>Vc,ZodISODate:()=>si,ZodISODateTime:()=>ii,ZodISODuration:()=>ci,ZodISOTime:()=>ai,ZodIntersection:()=>Og,ZodIssueCode:()=>EC,ZodJWT:()=>Xc,ZodKSUID:()=>Uc,ZodLazy:()=>rh,ZodLiteral:()=>Wg,ZodMAC:()=>bg,ZodMap:()=>$g,ZodNaN:()=>Qg,ZodNanoID:()=>Wc,ZodNever:()=>Pg,ZodNonOptional:()=>il,ZodNull:()=>Cg,ZodNullable:()=>Ug,ZodNumber:()=>Vr,ZodNumberFormat:()=>Fn,ZodObject:()=>yi,ZodOptional:()=>ol,ZodPipe:()=>sl,ZodPrefault:()=>Hg,ZodPromise:()=>ih,ZodReadonly:()=>eh,ZodRealError:()=>we,ZodRecord:()=>vi,ZodSet:()=>Lg,ZodString:()=>Ur,ZodStringFormat:()=>Y,ZodSuccess:()=>Yg,ZodSymbol:()=>Sg,ZodTemplateLiteral:()=>nh,ZodTransform:()=>Gg,ZodTuple:()=>Ng,ZodType:()=>M,ZodULID:()=>Zc,ZodURL:()=>pi,ZodUUID:()=>At,ZodUndefined:()=>xg,ZodUnion:()=>bi,ZodUnknown:()=>Rg,ZodVoid:()=>Ag,ZodXID:()=>jc,ZodXor:()=>Tg,_ZodString:()=>Mc,_default:()=>Vg,_function:()=>gC,any:()=>Hx,array:()=>hi,base64:()=>Tx,base64url:()=>Ix,bigint:()=>Zx,boolean:()=>_g,catch:()=>Xg,check:()=>hC,cidrv4:()=>Ax,cidrv6:()=>kx,clone:()=>ve,codec:()=>mC,coerce:()=>ll,config:()=>le,core:()=>Pt,cuid:()=>_x,cuid2:()=>Sx,custom:()=>yC,date:()=>Kx,decode:()=>Pc,decodeAsync:()=>kc,describe:()=>bC,discriminatedUnion:()=>tC,e164:()=>Ox,email:()=>ux,emoji:()=>bx,encode:()=>Rc,encodeAsync:()=>Ac,endsWith:()=>Ir,enum:()=>nl,exactOptional:()=>jg,file:()=>cC,flattenError:()=>vr,float32:()=>Lx,float64:()=>Wx,formatError:()=>_r,fromJSONSchema:()=>uh,function:()=>gC,getErrorMap:()=>RC,globalRegistry:()=>Oe,gt:()=>wt,gte:()=>Ee,guid:()=>dx,hash:()=>$x,hex:()=>Mx,hostname:()=>Dx,httpUrl:()=>yx,includes:()=>kr,instanceof:()=>_C,int:()=>Dc,int32:()=>Fx,int64:()=>jx,intersection:()=>zg,ipv4:()=>wx,ipv6:()=>Px,iso:()=>li,json:()=>xC,jwt:()=>zx,keyof:()=>Yx,ksuid:()=>Ex,lazy:()=>oh,length:()=>Ln,literal:()=>aC,locales:()=>ei,looseObject:()=>Qx,looseRecord:()=>rC,lowercase:()=>Pr,lt:()=>Et,lte:()=>Ue,mac:()=>Rx,map:()=>oC,maxLength:()=>$n,maxSize:()=>sn,meta:()=>vC,mime:()=>Or,minLength:()=>Ft,minSize:()=>Rt,multipleOf:()=>on,nan:()=>dC,nanoid:()=>vx,nativeEnum:()=>sC,negative:()=>pc,never:()=>el,nonnegative:()=>hc,nonoptional:()=>Kg,nonpositive:()=>gc,normalize:()=>zr,null:()=>Eg,nullable:()=>mi,nullish:()=>lC,number:()=>vg,object:()=>Jx,optional:()=>di,overwrite:()=>ut,parse:()=>xc,parseAsync:()=>Cc,partialRecord:()=>nC,pipe:()=>fi,positive:()=>fc,prefault:()=>qg,preprocess:()=>CC,prettifyError:()=>_a,promise:()=>pC,property:()=>yc,readonly:()=>th,record:()=>Mg,refine:()=>ah,regex:()=>Rr,regexes:()=>je,registry:()=>ti,safeDecode:()=>Ic,safeDecodeAsync:()=>zc,safeEncode:()=>Tc,safeEncodeAsync:()=>Oc,safeParse:()=>Ec,safeParseAsync:()=>wc,set:()=>iC,setErrorMap:()=>wC,size:()=>Mn,slugify:()=>$r,startsWith:()=>Tr,strictObject:()=>Xx,string:()=>Nc,stringFormat:()=>Nx,stringbool:()=>SC,success:()=>uC,superRefine:()=>ch,symbol:()=>Bx,templateLiteral:()=>fC,toJSONSchema:()=>oi,toLowerCase:()=>Dr,toUpperCase:()=>Mr,transform:()=>rl,treeifyError:()=>va,trim:()=>Nr,tuple:()=>Dg,uint32:()=>Gx,uint64:()=>Ux,ulid:()=>xx,undefined:()=>Vx,union:()=>tl,unknown:()=>Wn,uppercase:()=>Ar,url:()=>hx,util:()=>I,uuid:()=>mx,uuidv4:()=>fx,uuidv6:()=>px,uuidv7:()=>gx,void:()=>qx,xid:()=>Cx,xor:()=>eC});var Pt={};ln(Pt,{$ZodAny:()=>mf,$ZodArray:()=>yf,$ZodAsyncError:()=>Ct,$ZodBase64:()=>tf,$ZodBase64URL:()=>nf,$ZodBigInt:()=>Ga,$ZodBigIntFormat:()=>cf,$ZodBoolean:()=>Jo,$ZodCIDRv4:()=>Xm,$ZodCIDRv6:()=>Qm,$ZodCUID:()=>Fm,$ZodCUID2:()=>Gm,$ZodCatch:()=>Df,$ZodCheck:()=>Q,$ZodCheckBigIntFormat:()=>hm,$ZodCheckEndsWith:()=>Am,$ZodCheckGreaterThan:()=>za,$ZodCheckIncludes:()=>Rm,$ZodCheckLengthEquals:()=>xm,$ZodCheckLessThan:()=>Oa,$ZodCheckLowerCase:()=>Em,$ZodCheckMaxLength:()=>_m,$ZodCheckMaxSize:()=>ym,$ZodCheckMimeType:()=>Tm,$ZodCheckMinLength:()=>Sm,$ZodCheckMinSize:()=>bm,$ZodCheckMultipleOf:()=>pm,$ZodCheckNumberFormat:()=>gm,$ZodCheckOverwrite:()=>Im,$ZodCheckProperty:()=>km,$ZodCheckRegex:()=>Cm,$ZodCheckSizeEquals:()=>vm,$ZodCheckStartsWith:()=>Pm,$ZodCheckStringFormat:()=>wr,$ZodCheckUpperCase:()=>wm,$ZodCodec:()=>Qo,$ZodCustom:()=>jf,$ZodCustomStringFormat:()=>sf,$ZodDate:()=>hf,$ZodDefault:()=>If,$ZodDiscriminatedUnion:()=>_f,$ZodE164:()=>rf,$ZodEmail:()=>Mm,$ZodEmoji:()=>Lm,$ZodEncodeError:()=>On,$ZodEnum:()=>wf,$ZodError:()=>Ho,$ZodExactOptional:()=>kf,$ZodFile:()=>Pf,$ZodFunction:()=>Ff,$ZodGUID:()=>Nm,$ZodIPv4:()=>Km,$ZodIPv6:()=>Ym,$ZodISODate:()=>Vm,$ZodISODateTime:()=>Bm,$ZodISODuration:()=>qm,$ZodISOTime:()=>Hm,$ZodIntersection:()=>Sf,$ZodJWT:()=>of,$ZodKSUID:()=>Um,$ZodLazy:()=>Zf,$ZodLiteral:()=>Rf,$ZodMAC:()=>Jm,$ZodMap:()=>Cf,$ZodNaN:()=>Mf,$ZodNanoID:()=>Wm,$ZodNever:()=>pf,$ZodNonOptional:()=>zf,$ZodNull:()=>df,$ZodNullable:()=>Tf,$ZodNumber:()=>Fa,$ZodNumberFormat:()=>af,$ZodObject:()=>rx,$ZodObjectJIT:()=>bf,$ZodOptional:()=>ja,$ZodPipe:()=>$f,$ZodPrefault:()=>Of,$ZodPromise:()=>Gf,$ZodReadonly:()=>Lf,$ZodRealError:()=>Ie,$ZodRecord:()=>xf,$ZodRegistry:()=>Uf,$ZodSet:()=>Ef,$ZodString:()=>Dn,$ZodStringFormat:()=>K,$ZodSuccess:()=>Nf,$ZodSymbol:()=>lf,$ZodTemplateLiteral:()=>Wf,$ZodTransform:()=>Af,$ZodTuple:()=>Za,$ZodType:()=>D,$ZodULID:()=>Zm,$ZodURL:()=>$m,$ZodUUID:()=>Dm,$ZodUndefined:()=>uf,$ZodUnion:()=>Xo,$ZodUnknown:()=>ff,$ZodVoid:()=>gf,$ZodXID:()=>jm,$ZodXor:()=>vf,$brand:()=>pa,$constructor:()=>g,$input:()=>Ba,$output:()=>Ua,Doc:()=>Na,JSONSchema:()=>sx,JSONSchemaGenerator:()=>fg,NEVER:()=>fa,TimePrecision:()=>mc,_any:()=>pp,_array:()=>Sp,_base64:()=>cc,_base64url:()=>lc,_bigint:()=>ap,_boolean:()=>ip,_catch:()=>P0,_check:()=>ix,_cidrv4:()=>sc,_cidrv6:()=>ac,_coercedBigint:()=>cp,_coercedBoolean:()=>sp,_coercedDate:()=>vp,_coercedNumber:()=>Qf,_coercedString:()=>Vf,_cuid:()=>Qa,_cuid2:()=>ec,_custom:()=>Cp,_date:()=>bp,_decode:()=>Ea,_decodeAsync:()=>Ra,_default:()=>E0,_discriminatedUnion:()=>m0,_e164:()=>uc,_email:()=>Va,_emoji:()=>Ja,_encode:()=>Ca,_encodeAsync:()=>wa,_endsWith:()=>Ir,_enum:()=>b0,_file:()=>xp,_float32:()=>tp,_float64:()=>np,_gt:()=>wt,_gte:()=>Ee,_guid:()=>ni,_includes:()=>kr,_int:()=>ep,_int32:()=>rp,_int64:()=>lp,_intersection:()=>f0,_ipv4:()=>oc,_ipv6:()=>ic,_isoDate:()=>Kf,_isoDateTime:()=>qf,_isoDuration:()=>Jf,_isoTime:()=>Yf,_jwt:()=>dc,_ksuid:()=>rc,_lazy:()=>I0,_length:()=>Ln,_literal:()=>_0,_lowercase:()=>Pr,_lt:()=>Et,_lte:()=>Ue,_mac:()=>Hf,_map:()=>h0,_max:()=>Ue,_maxLength:()=>$n,_maxSize:()=>sn,_mime:()=>Or,_min:()=>Ee,_minLength:()=>Ft,_minSize:()=>Rt,_multipleOf:()=>on,_nan:()=>_p,_nanoid:()=>Xa,_nativeEnum:()=>v0,_negative:()=>pc,_never:()=>hp,_nonnegative:()=>hc,_nonoptional:()=>w0,_nonpositive:()=>gc,_normalize:()=>zr,_null:()=>fp,_nullable:()=>C0,_number:()=>Xf,_optional:()=>x0,_overwrite:()=>ut,_parse:()=>Sr,_parseAsync:()=>xr,_pipe:()=>A0,_positive:()=>fc,_promise:()=>O0,_property:()=>yc,_readonly:()=>k0,_record:()=>g0,_refine:()=>Ep,_regex:()=>Rr,_safeDecode:()=>Aa,_safeDecodeAsync:()=>Ta,_safeEncode:()=>Pa,_safeEncodeAsync:()=>ka,_safeParse:()=>Cr,_safeParseAsync:()=>Er,_set:()=>y0,_size:()=>Mn,_slugify:()=>$r,_startsWith:()=>Tr,_string:()=>Bf,_stringFormat:()=>Lr,_stringbool:()=>Ap,_success:()=>R0,_superRefine:()=>wp,_symbol:()=>dp,_templateLiteral:()=>T0,_toLowerCase:()=>Dr,_toUpperCase:()=>Mr,_transform:()=>S0,_trim:()=>Nr,_tuple:()=>p0,_uint32:()=>op,_uint64:()=>up,_ulid:()=>tc,_undefined:()=>mp,_union:()=>u0,_unknown:()=>gp,_uppercase:()=>Ar,_url:()=>ri,_uuid:()=>Ha,_uuidv4:()=>qa,_uuidv6:()=>Ka,_uuidv7:()=>Ya,_void:()=>yp,_xid:()=>nc,_xor:()=>d0,clone:()=>ve,config:()=>le,createStandardJSONSchemaMethod:()=>bc,createToJSONSchemaMethod:()=>kp,decode:()=>AD,decodeAsync:()=>TD,describe:()=>Rp,encode:()=>PD,encodeAsync:()=>kD,extractDefs:()=>Gr,finalize:()=>Zr,flattenError:()=>vr,formatError:()=>_r,globalConfig:()=>Fo,globalRegistry:()=>Oe,initializeContext:()=>Fr,isValidBase64:()=>ef,isValidBase64URL:()=>QS,isValidJWT:()=>ex,locales:()=>ei,meta:()=>Pp,parse:()=>Sa,parseAsync:()=>xa,prettifyError:()=>_a,process:()=>ee,regexes:()=>je,registry:()=>ti,safeDecode:()=>OD,safeDecodeAsync:()=>ND,safeEncode:()=>ID,safeEncodeAsync:()=>zD,safeParse:()=>Ld,safeParseAsync:()=>Wd,toDotPath:()=>DS,toJSONSchema:()=>oi,treeifyError:()=>va,util:()=>I,version:()=>Om});var fa=Object.freeze({status:"aborted"});function g(e,t,n){function r(a,c){if(!a._zod)Object.defineProperty(a,"_zod",{value:{def:c,constr:s,traits:new Set},enumerable:!1});if(a._zod.traits.has(e))return;a._zod.traits.add(e),t(a,c);let l=s.prototype,u=Object.keys(l);for(let d=0;d<u.length;d++){let m=u[d];if(!(m in a))a[m]=l[m].bind(a)}}let o=n?.Parent??Object;class i extends o{}Object.defineProperty(i,"name",{value:e});function s(a){var c;let l=n?.Parent?new i:this;r(l,a),(c=l._zod).deferred??(c.deferred=[]);for(let u of l._zod.deferred)u();return l}return Object.defineProperty(s,"init",{value:r}),Object.defineProperty(s,Symbol.hasInstance,{value:(a)=>{if(n?.Parent&&a instanceof n.Parent)return!0;return a?._zod?.traits?.has(e)}}),Object.defineProperty(s,"name",{value:e}),s}var pa=Symbol("zod_brand");class Ct extends Error{constructor(){super("Encountered Promise during synchronous parse. Use .parseAsync() instead.")}}class On extends Error{constructor(e){super(`Encountered unidirectional transform during encode: ${e}`);this.name="ZodEncodeError"}}var Fo={};function le(e){if(e)Object.assign(Fo,e);return Fo}var I={};ln(I,{BIGINT_FORMAT_RANGES:()=>Md,Class:()=>zS,NUMBER_FORMAT_RANGES:()=>Dd,aborted:()=>rn,allowsEval:()=>Id,assert:()=>iD,assertEqual:()=>tD,assertIs:()=>rD,assertNever:()=>oD,assertNotEqual:()=>nD,assignProp:()=>tn,base64ToUint8Array:()=>IS,base64urlToUint8Array:()=>xD,cached:()=>yr,captureStackTrace:()=>ya,cleanEnum:()=>SD,cleanRegex:()=>jo,clone:()=>ve,cloneDef:()=>aD,createTransparentProxy:()=>fD,defineLazy:()=>W,esc:()=>ha,escapeRegex:()=>Xe,extend:()=>hD,finalizeIssue:()=>Te,floatSafeRemainder:()=>kd,getElementAtPath:()=>cD,getEnumValues:()=>Zo,getLengthableOrigin:()=>Vo,getParsedType:()=>mD,getSizableOrigin:()=>Bo,hexToUint8Array:()=>ED,isObject:()=>zn,isPlainObject:()=>nn,issue:()=>br,joinValues:()=>ga,jsonStringifyReplacer:()=>hr,merge:()=>bD,mergeDefs:()=>Wt,normalizeParams:()=>_,nullish:()=>en,numKeys:()=>dD,objectClone:()=>sD,omit:()=>gD,optionalKeys:()=>Nd,parsedType:()=>$d,partial:()=>vD,pick:()=>pD,prefixIssues:()=>Ze,primitiveTypes:()=>zd,promiseAllObject:()=>lD,propertyKeyTypes:()=>Uo,randomString:()=>uD,required:()=>_D,safeExtend:()=>yD,shallowClone:()=>Od,slugify:()=>Td,stringifyPrimitive:()=>ba,uint8ArrayToBase64:()=>OS,uint8ArrayToBase64url:()=>CD,uint8ArrayToHex:()=>wD,unwrapMessage:()=>Go});function tD(e){return e}function nD(e){return e}function rD(e){}function oD(e){throw Error("Unexpected value in exhaustive check")}function iD(e){}function Zo(e){let t=Object.values(e).filter((r)=>typeof r==="number");return Object.entries(e).filter(([r,o])=>t.indexOf(+r)===-1).map(([r,o])=>o)}function ga(e,t="|"){return e.map((n)=>ba(n)).join(t)}function hr(e,t){if(typeof t==="bigint")return t.toString();return t}function yr(e){return{get value(){{let n=e();return Object.defineProperty(this,"value",{value:n}),n}throw Error("cached value already set")}}}function en(e){return e===null||e===void 0}function jo(e){let t=e.startsWith("^")?1:0,n=e.endsWith("$")?e.length-1:e.length;return e.slice(t,n)}function kd(e,t){let n=(e.toString().split(".")[1]||"").length,r=t.toString(),o=(r.split(".")[1]||"").length;if(o===0&&/\d?e-\d?/.test(r)){let c=r.match(/\d?e-(\d?)/);if(c?.[1])o=Number.parseInt(c[1])}let i=n>o?n:o,s=Number.parseInt(e.toFixed(i).replace(".","")),a=Number.parseInt(t.toFixed(i).replace(".",""));return s%a/10**i}var TS=Symbol("evaluating");function W(e,t,n){let r=void 0;Object.defineProperty(e,t,{get(){if(r===TS)return;if(r===void 0)r=TS,r=n();return r},set(o){Object.defineProperty(e,t,{value:o})},configurable:!0})}function sD(e){return Object.create(Object.getPrototypeOf(e),Object.getOwnPropertyDescriptors(e))}function tn(e,t,n){Object.defineProperty(e,t,{value:n,writable:!0,enumerable:!0,configurable:!0})}function Wt(...e){let t={};for(let n of e){let r=Object.getOwnPropertyDescriptors(n);Object.assign(t,r)}return Object.defineProperties({},t)}function aD(e){return Wt(e._zod.def)}function cD(e,t){if(!t)return e;return t.reduce((n,r)=>n?.[r],e)}function lD(e){let t=Object.keys(e),n=t.map((r)=>e[r]);return Promise.all(n).then((r)=>{let o={};for(let i=0;i<t.length;i++)o[t[i]]=r[i];return o})}function uD(e=10){let n="";for(let r=0;r<e;r++)n+="abcdefghijklmnopqrstuvwxyz"[Math.floor(Math.random()*26)];return n}function ha(e){return JSON.stringify(e)}function Td(e){return e.toLowerCase().trim().replace(/[^\w\s-]/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")}var ya="captureStackTrace"in Error?Error.captureStackTrace:(...e)=>{};function zn(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}var Id=yr(()=>{if(typeof navigator<"u"&&navigator?.userAgent?.includes("Cloudflare"))return!1;try{return new Function(""),!0}catch(e){return!1}});function nn(e){if(zn(e)===!1)return!1;let t=e.constructor;if(t===void 0)return!0;if(typeof t!=="function")return!0;let n=t.prototype;if(zn(n)===!1)return!1;if(Object.prototype.hasOwnProperty.call(n,"isPrototypeOf")===!1)return!1;return!0}function Od(e){if(nn(e))return{...e};if(Array.isArray(e))return[...e];return e}function dD(e){let t=0;for(let n in e)if(Object.prototype.hasOwnProperty.call(e,n))t++;return t}var mD=(e)=>{let t=typeof e;switch(t){case"undefined":return"undefined";case"string":return"string";case"number":return Number.isNaN(e)?"nan":"number";case"boolean":return"boolean";case"function":return"function";case"bigint":return"bigint";case"symbol":return"symbol";case"object":if(Array.isArray(e))return"array";if(e===null)return"null";if(e.then&&typeof e.then==="function"&&e.catch&&typeof e.catch==="function")return"promise";if(typeof Map<"u"&&e instanceof Map)return"map";if(typeof Set<"u"&&e instanceof Set)return"set";if(typeof Date<"u"&&e instanceof Date)return"date";if(typeof File<"u"&&e instanceof File)return"file";return"object";default:throw Error(`Unknown data type: ${t}`)}},Uo=new Set(["string","number","symbol"]),zd=new Set(["string","number","bigint","boolean","symbol","undefined"]);function Xe(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function ve(e,t,n){let r=new e._zod.constr(t??e._zod.def);if(!t||n?.parent)r._zod.parent=e;return r}function _(e){let t=e;if(!t)return{};if(typeof t==="string")return{error:()=>t};if(t?.message!==void 0){if(t?.error!==void 0)throw Error("Cannot specify both `message` and `error` params");t.error=t.message}if(delete t.message,typeof t.error==="string")return{...t,error:()=>t.error};return t}function fD(e){let t;return new Proxy({},{get(n,r,o){return t??(t=e()),Reflect.get(t,r,o)},set(n,r,o,i){return t??(t=e()),Reflect.set(t,r,o,i)},has(n,r){return t??(t=e()),Reflect.has(t,r)},deleteProperty(n,r){return t??(t=e()),Reflect.deleteProperty(t,r)},ownKeys(n){return t??(t=e()),Reflect.ownKeys(t)},getOwnPropertyDescriptor(n,r){return t??(t=e()),Reflect.getOwnPropertyDescriptor(t,r)},defineProperty(n,r,o){return t??(t=e()),Reflect.defineProperty(t,r,o)}})}function ba(e){if(typeof e==="bigint")return e.toString()+"n";if(typeof e==="string")return`"${e}"`;return`${e}`}function Nd(e){return Object.keys(e).filter((t)=>e[t]._zod.optin==="optional"&&e[t]._zod.optout==="optional")}var Dd={safeint:[Number.MIN_SAFE_INTEGER,Number.MAX_SAFE_INTEGER],int32:[-2147483648,2147483647],uint32:[0,4294967295],float32:[-340282346638528860000000000000000000000,340282346638528860000000000000000000000],float64:[-Number.MAX_VALUE,Number.MAX_VALUE]},Md={int64:[BigInt("-9223372036854775808"),BigInt("9223372036854775807")],uint64:[BigInt(0),BigInt("18446744073709551615")]};function pD(e,t){let n=e._zod.def,r=n.checks;if(r&&r.length>0)throw Error(".pick() cannot be used on object schemas containing refinements");let i=Wt(e._zod.def,{get shape(){let s={};for(let a in t){if(!(a in n.shape))throw Error(`Unrecognized key: "${a}"`);if(!t[a])continue;s[a]=n.shape[a]}return tn(this,"shape",s),s},checks:[]});return ve(e,i)}function gD(e,t){let n=e._zod.def,r=n.checks;if(r&&r.length>0)throw Error(".omit() cannot be used on object schemas containing refinements");let i=Wt(e._zod.def,{get shape(){let s={...e._zod.def.shape};for(let a in t){if(!(a in n.shape))throw Error(`Unrecognized key: "${a}"`);if(!t[a])continue;delete s[a]}return tn(this,"shape",s),s},checks:[]});return ve(e,i)}function hD(e,t){if(!nn(t))throw Error("Invalid input to extend: expected a plain object");let n=e._zod.def.checks;if(n&&n.length>0){let i=e._zod.def.shape;for(let s in t)if(Object.getOwnPropertyDescriptor(i,s)!==void 0)throw Error("Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.")}let o=Wt(e._zod.def,{get shape(){let i={...e._zod.def.shape,...t};return tn(this,"shape",i),i}});return ve(e,o)}function yD(e,t){if(!nn(t))throw Error("Invalid input to safeExtend: expected a plain object");let n=Wt(e._zod.def,{get shape(){let r={...e._zod.def.shape,...t};return tn(this,"shape",r),r}});return ve(e,n)}function bD(e,t){let n=Wt(e._zod.def,{get shape(){let r={...e._zod.def.shape,...t._zod.def.shape};return tn(this,"shape",r),r},get catchall(){return t._zod.def.catchall},checks:[]});return ve(e,n)}function vD(e,t,n){let o=t._zod.def.checks;if(o&&o.length>0)throw Error(".partial() cannot be used on object schemas containing refinements");let s=Wt(t._zod.def,{get shape(){let a=t._zod.def.shape,c={...a};if(n)for(let l in n){if(!(l in a))throw Error(`Unrecognized key: "${l}"`);if(!n[l])continue;c[l]=e?new e({type:"optional",innerType:a[l]}):a[l]}else for(let l in a)c[l]=e?new e({type:"optional",innerType:a[l]}):a[l];return tn(this,"shape",c),c},checks:[]});return ve(t,s)}function _D(e,t,n){let r=Wt(t._zod.def,{get shape(){let o=t._zod.def.shape,i={...o};if(n)for(let s in n){if(!(s in i))throw Error(`Unrecognized key: "${s}"`);if(!n[s])continue;i[s]=new e({type:"nonoptional",innerType:o[s]})}else for(let s in o)i[s]=new e({type:"nonoptional",innerType:o[s]});return tn(this,"shape",i),i}});return ve(t,r)}function rn(e,t=0){if(e.aborted===!0)return!0;for(let n=t;n<e.issues.length;n++)if(e.issues[n]?.continue!==!0)return!0;return!1}function Ze(e,t){return t.map((n)=>{var r;return(r=n).path??(r.path=[]),n.path.unshift(e),n})}function Go(e){return typeof e==="string"?e:e?.message}function Te(e,t,n){let r={...e,path:e.path??[]};if(!e.message){let o=Go(e.inst?._zod.def?.error?.(e))??Go(t?.error?.(e))??Go(n.customError?.(e))??Go(n.localeError?.(e))??"Invalid input";r.message=o}if(delete r.inst,delete r.continue,!t?.reportInput)delete r.input;return r}function Bo(e){if(e instanceof Set)return"set";if(e instanceof Map)return"map";if(e instanceof File)return"file";return"unknown"}function Vo(e){if(Array.isArray(e))return"array";if(typeof e==="string")return"string";return"unknown"}function $d(e){let t=typeof e;switch(t){case"number":return Number.isNaN(e)?"nan":"number";case"object":{if(e===null)return"null";if(Array.isArray(e))return"array";let n=e;if(n&&Object.getPrototypeOf(n)!==Object.prototype&&"constructor"in n&&n.constructor)return n.constructor.name}}return t}function br(...e){let[t,n,r]=e;if(typeof t==="string")return{message:t,code:"custom",input:n,inst:r};return{...t}}function SD(e){return Object.entries(e).filter(([t,n])=>Number.isNaN(Number.parseInt(t,10))).map((t)=>t[1])}function IS(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function OS(e){let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t)}function xD(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),n="=".repeat((4-t.length%4)%4);return IS(t+n)}function CD(e){return OS(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function ED(e){let t=e.replace(/^0x/,"");if(t.length%2!==0)throw Error("Invalid hex string length");let n=new Uint8Array(t.length/2);for(let r=0;r<t.length;r+=2)n[r/2]=Number.parseInt(t.slice(r,r+2),16);return n}function wD(e){return Array.from(e).map((t)=>t.toString(16).padStart(2,"0")).join("")}class zS{constructor(...e){}}var NS=(e,t)=>{e.name="$ZodError",Object.defineProperty(e,"_zod",{value:e._zod,enumerable:!1}),Object.defineProperty(e,"issues",{value:t,enumerable:!1}),e.message=JSON.stringify(t,hr,2),Object.defineProperty(e,"toString",{value:()=>e.message,enumerable:!1})},Ho=g("$ZodError",NS),Ie=g("$ZodError",NS,{Parent:Error});function vr(e,t=(n)=>n.message){let n={},r=[];for(let o of e.issues)if(o.path.length>0)n[o.path[0]]=n[o.path[0]]||[],n[o.path[0]].push(t(o));else r.push(t(o));return{formErrors:r,fieldErrors:n}}function _r(e,t=(n)=>n.message){let n={_errors:[]},r=(o)=>{for(let i of o.issues)if(i.code==="invalid_union"&&i.errors.length)i.errors.map((s)=>r({issues:s}));else if(i.code==="invalid_key")r({issues:i.issues});else if(i.code==="invalid_element")r({issues:i.issues});else if(i.path.length===0)n._errors.push(t(i));else{let s=n,a=0;while(a<i.path.length){let c=i.path[a];if(a!==i.path.length-1)s[c]=s[c]||{_errors:[]};else s[c]=s[c]||{_errors:[]},s[c]._errors.push(t(i));s=s[c],a++}}};return r(e),n}function va(e,t=(n)=>n.message){let n={errors:[]},r=(o,i=[])=>{var s,a;for(let c of o.issues)if(c.code==="invalid_union"&&c.errors.length)c.errors.map((l)=>r({issues:l},c.path));else if(c.code==="invalid_key")r({issues:c.issues},c.path);else if(c.code==="invalid_element")r({issues:c.issues},c.path);else{let l=[...i,...c.path];if(l.length===0){n.errors.push(t(c));continue}let u=n,d=0;while(d<l.length){let m=l[d],f=d===l.length-1;if(typeof m==="string")u.properties??(u.properties={}),(s=u.properties)[m]??(s[m]={errors:[]}),u=u.properties[m];else u.items??(u.items=[]),(a=u.items)[m]??(a[m]={errors:[]}),u=u.items[m];if(f)u.errors.push(t(c));d++}}};return r(e),n}function DS(e){let t=[],n=e.map((r)=>typeof r==="object"?r.key:r);for(let r of n)if(typeof r==="number")t.push(`[${r}]`);else if(typeof r==="symbol")t.push(`[${JSON.stringify(String(r))}]`);else if(/[^\w$]/.test(r))t.push(`[${JSON.stringify(r)}]`);else{if(t.length)t.push(".");t.push(r)}return t.join("")}function _a(e){let t=[],n=[...e.issues].sort((r,o)=>(r.path??[]).length-(o.path??[]).length);for(let r of n)if(t.push(`\u2716 ${r.message}`),r.path?.length)t.push(`  \u2192 at ${DS(r.path)}`);return t.join(`
-`)}var Sr=(e)=>(t,n,r,o)=>{let i=r?Object.assign(r,{async:!1}):{async:!1},s=t._zod.run({value:n,issues:[]},i);if(s instanceof Promise)throw new Ct;if(s.issues.length){let a=new(o?.Err??e)(s.issues.map((c)=>Te(c,i,le())));throw ya(a,o?.callee),a}return s.value},Sa=Sr(Ie),xr=(e)=>async(t,n,r,o)=>{let i=r?Object.assign(r,{async:!0}):{async:!0},s=t._zod.run({value:n,issues:[]},i);if(s instanceof Promise)s=await s;if(s.issues.length){let a=new(o?.Err??e)(s.issues.map((c)=>Te(c,i,le())));throw ya(a,o?.callee),a}return s.value},xa=xr(Ie),Cr=(e)=>(t,n,r)=>{let o=r?{...r,async:!1}:{async:!1},i=t._zod.run({value:n,issues:[]},o);if(i instanceof Promise)throw new Ct;return i.issues.length?{success:!1,error:new(e??Ho)(i.issues.map((s)=>Te(s,o,le())))}:{success:!0,data:i.value}},Ld=Cr(Ie),Er=(e)=>async(t,n,r)=>{let o=r?Object.assign(r,{async:!0}):{async:!0},i=t._zod.run({value:n,issues:[]},o);if(i instanceof Promise)i=await i;return i.issues.length?{success:!1,error:new e(i.issues.map((s)=>Te(s,o,le())))}:{success:!0,data:i.value}},Wd=Er(Ie),Ca=(e)=>(t,n,r)=>{let o=r?Object.assign(r,{direction:"backward"}):{direction:"backward"};return Sr(e)(t,n,o)},PD=Ca(Ie),Ea=(e)=>(t,n,r)=>Sr(e)(t,n,r),AD=Ea(Ie),wa=(e)=>async(t,n,r)=>{let o=r?Object.assign(r,{direction:"backward"}):{direction:"backward"};return xr(e)(t,n,o)},kD=wa(Ie),Ra=(e)=>async(t,n,r)=>xr(e)(t,n,r),TD=Ra(Ie),Pa=(e)=>(t,n,r)=>{let o=r?Object.assign(r,{direction:"backward"}):{direction:"backward"};return Cr(e)(t,n,o)},ID=Pa(Ie),Aa=(e)=>(t,n,r)=>Cr(e)(t,n,r),OD=Aa(Ie),ka=(e)=>async(t,n,r)=>{let o=r?Object.assign(r,{direction:"backward"}):{direction:"backward"};return Er(e)(t,n,o)},zD=ka(Ie),Ta=(e)=>async(t,n,r)=>Er(e)(t,n,r),ND=Ta(Ie);var je={};ln(je,{base64:()=>tm,base64url:()=>Ia,bigint:()=>am,boolean:()=>lm,browserEmail:()=>ZD,cidrv4:()=>Qd,cidrv6:()=>em,cuid:()=>Fd,cuid2:()=>Gd,date:()=>rm,datetime:()=>im,domain:()=>BD,duration:()=>Vd,e164:()=>nm,email:()=>qd,emoji:()=>Kd,extendedDuration:()=>DD,guid:()=>Hd,hex:()=>VD,hostname:()=>UD,html5Email:()=>WD,idnEmail:()=>GD,integer:()=>cm,ipv4:()=>Yd,ipv6:()=>Jd,ksuid:()=>Ud,lowercase:()=>mm,mac:()=>Xd,md5_base64:()=>qD,md5_base64url:()=>KD,md5_hex:()=>HD,nanoid:()=>Bd,null:()=>um,number:()=>qo,rfc5322Email:()=>FD,sha1_base64:()=>JD,sha1_base64url:()=>XD,sha1_hex:()=>YD,sha256_base64:()=>e0,sha256_base64url:()=>t0,sha256_hex:()=>QD,sha384_base64:()=>r0,sha384_base64url:()=>o0,sha384_hex:()=>n0,sha512_base64:()=>s0,sha512_base64url:()=>a0,sha512_hex:()=>i0,string:()=>sm,time:()=>om,ulid:()=>Zd,undefined:()=>dm,unicodeEmail:()=>MS,uppercase:()=>fm,uuid:()=>Nn,uuid4:()=>MD,uuid6:()=>$D,uuid7:()=>LD,xid:()=>jd});var Fd=/^[cC][^\s-]{8,}$/,Gd=/^[0-9a-z]+$/,Zd=/^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/,jd=/^[0-9a-vA-V]{20}$/,Ud=/^[A-Za-z0-9]{27}$/,Bd=/^[a-zA-Z0-9_-]{21}$/,Vd=/^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/,DD=/^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/,Hd=/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/,Nn=(e)=>{if(!e)return/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${e}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`)},MD=Nn(4),$D=Nn(6),LD=Nn(7),qd=/^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/,WD=/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/,FD=/^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/,MS=/^[^\s@"]{1,64}@[^\s@]{1,255}$/u,GD=MS,ZD=/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/,jD="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$";function Kd(){return new RegExp(jD,"u")}var Yd=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,Jd=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/,Xd=(e)=>{let t=Xe(e??":");return new RegExp(`^(?:[0-9A-F]{2}${t}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${t}){5}[0-9a-f]{2}$`)},Qd=/^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/,em=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,tm=/^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/,Ia=/^[A-Za-z0-9_-]*$/,UD=/^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/,BD=/^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/,nm=/^\+[1-9]\d{6,14}$/,$S="(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))",rm=new RegExp(`^${$S}$`);function LS(e){return typeof e.precision==="number"?e.precision===-1?"(?:[01]\\d|2[0-3]):[0-5]\\d":e.precision===0?"(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d":`(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d\\.\\d{${e.precision}}`:"(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?"}function om(e){return new RegExp(`^${LS(e)}$`)}function im(e){let t=LS({precision:e.precision}),n=["Z"];if(e.local)n.push("");if(e.offset)n.push("([+-](?:[01]\\d|2[0-3]):[0-5]\\d)");let r=`${t}(?:${n.join("|")})`;return new RegExp(`^${$S}T(?:${r})$`)}var sm=(e)=>{let t=e?`[\\s\\S]{${e?.minimum??0},${e?.maximum??""}}`:"[\\s\\S]*";return new RegExp(`^${t}$`)},am=/^-?\d+n?$/,cm=/^-?\d+$/,qo=/^-?\d+(?:\.\d+)?$/,lm=/^(?:true|false)$/i,um=/^null$/i;var dm=/^undefined$/i;var mm=/^[^A-Z]*$/,fm=/^[^a-z]*$/,VD=/^[0-9a-fA-F]*$/;function Ko(e,t){return new RegExp(`^[A-Za-z0-9+/]{${e}}${t}$`)}function Yo(e){return new RegExp(`^[A-Za-z0-9_-]{${e}}$`)}var HD=/^[0-9a-fA-F]{32}$/,qD=Ko(22,"=="),KD=Yo(22),YD=/^[0-9a-fA-F]{40}$/,JD=Ko(27,"="),XD=Yo(27),QD=/^[0-9a-fA-F]{64}$/,e0=Ko(43,"="),t0=Yo(43),n0=/^[0-9a-fA-F]{96}$/,r0=Ko(64,""),o0=Yo(64),i0=/^[0-9a-fA-F]{128}$/,s0=Ko(86,"=="),a0=Yo(86);var Q=g("$ZodCheck",(e,t)=>{var n;e._zod??(e._zod={}),e._zod.def=t,(n=e._zod).onattach??(n.onattach=[])}),FS={number:"number",bigint:"bigint",object:"date"},Oa=g("$ZodCheckLessThan",(e,t)=>{Q.init(e,t);let n=FS[typeof t.value];e._zod.onattach.push((r)=>{let o=r._zod.bag,i=(t.inclusive?o.maximum:o.exclusiveMaximum)??Number.POSITIVE_INFINITY;if(t.value<i)if(t.inclusive)o.maximum=t.value;else o.exclusiveMaximum=t.value}),e._zod.check=(r)=>{if(t.inclusive?r.value<=t.value:r.value<t.value)return;r.issues.push({origin:n,code:"too_big",maximum:typeof t.value==="object"?t.value.getTime():t.value,input:r.value,inclusive:t.inclusive,inst:e,continue:!t.abort})}}),za=g("$ZodCheckGreaterThan",(e,t)=>{Q.init(e,t);let n=FS[typeof t.value];e._zod.onattach.push((r)=>{let o=r._zod.bag,i=(t.inclusive?o.minimum:o.exclusiveMinimum)??Number.NEGATIVE_INFINITY;if(t.value>i)if(t.inclusive)o.minimum=t.value;else o.exclusiveMinimum=t.value}),e._zod.check=(r)=>{if(t.inclusive?r.value>=t.value:r.value>t.value)return;r.issues.push({origin:n,code:"too_small",minimum:typeof t.value==="object"?t.value.getTime():t.value,input:r.value,inclusive:t.inclusive,inst:e,continue:!t.abort})}}),pm=g("$ZodCheckMultipleOf",(e,t)=>{Q.init(e,t),e._zod.onattach.push((n)=>{var r;(r=n._zod.bag).multipleOf??(r.multipleOf=t.value)}),e._zod.check=(n)=>{if(typeof n.value!==typeof t.value)throw Error("Cannot mix number and bigint in multiple_of check.");if(typeof n.value==="bigint"?n.value%t.value===BigInt(0):kd(n.value,t.value)===0)return;n.issues.push({origin:typeof n.value,code:"not_multiple_of",divisor:t.value,input:n.value,inst:e,continue:!t.abort})}}),gm=g("$ZodCheckNumberFormat",(e,t)=>{Q.init(e,t),t.format=t.format||"float64";let n=t.format?.includes("int"),r=n?"int":"number",[o,i]=Dd[t.format];e._zod.onattach.push((s)=>{let a=s._zod.bag;if(a.format=t.format,a.minimum=o,a.maximum=i,n)a.pattern=cm}),e._zod.check=(s)=>{let a=s.value;if(n){if(!Number.isInteger(a)){s.issues.push({expected:r,format:t.format,code:"invalid_type",continue:!1,input:a,inst:e});return}if(!Number.isSafeInteger(a)){if(a>0)s.issues.push({input:a,code:"too_big",maximum:Number.MAX_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:e,origin:r,inclusive:!0,continue:!t.abort});else s.issues.push({input:a,code:"too_small",minimum:Number.MIN_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:e,origin:r,inclusive:!0,continue:!t.abort});return}}if(a<o)s.issues.push({origin:"number",input:a,code:"too_small",minimum:o,inclusive:!0,inst:e,continue:!t.abort});if(a>i)s.issues.push({origin:"number",input:a,code:"too_big",maximum:i,inclusive:!0,inst:e,continue:!t.abort})}}),hm=g("$ZodCheckBigIntFormat",(e,t)=>{Q.init(e,t);let[n,r]=Md[t.format];e._zod.onattach.push((o)=>{let i=o._zod.bag;i.format=t.format,i.minimum=n,i.maximum=r}),e._zod.check=(o)=>{let i=o.value;if(i<n)o.issues.push({origin:"bigint",input:i,code:"too_small",minimum:n,inclusive:!0,inst:e,continue:!t.abort});if(i>r)o.issues.push({origin:"bigint",input:i,code:"too_big",maximum:r,inclusive:!0,inst:e,continue:!t.abort})}}),ym=g("$ZodCheckMaxSize",(e,t)=>{var n;Q.init(e,t),(n=e._zod.def).when??(n.when=(r)=>{let o=r.value;return!en(o)&&o.size!==void 0}),e._zod.onattach.push((r)=>{let o=r._zod.bag.maximum??Number.POSITIVE_INFINITY;if(t.maximum<o)r._zod.bag.maximum=t.maximum}),e._zod.check=(r)=>{let o=r.value;if(o.size<=t.maximum)return;r.issues.push({origin:Bo(o),code:"too_big",maximum:t.maximum,inclusive:!0,input:o,inst:e,continue:!t.abort})}}),bm=g("$ZodCheckMinSize",(e,t)=>{var n;Q.init(e,t),(n=e._zod.def).when??(n.when=(r)=>{let o=r.value;return!en(o)&&o.size!==void 0}),e._zod.onattach.push((r)=>{let o=r._zod.bag.minimum??Number.NEGATIVE_INFINITY;if(t.minimum>o)r._zod.bag.minimum=t.minimum}),e._zod.check=(r)=>{let o=r.value;if(o.size>=t.minimum)return;r.issues.push({origin:Bo(o),code:"too_small",minimum:t.minimum,inclusive:!0,input:o,inst:e,continue:!t.abort})}}),vm=g("$ZodCheckSizeEquals",(e,t)=>{var n;Q.init(e,t),(n=e._zod.def).when??(n.when=(r)=>{let o=r.value;return!en(o)&&o.size!==void 0}),e._zod.onattach.push((r)=>{let o=r._zod.bag;o.minimum=t.size,o.maximum=t.size,o.size=t.size}),e._zod.check=(r)=>{let o=r.value,i=o.size;if(i===t.size)return;let s=i>t.size;r.issues.push({origin:Bo(o),...s?{code:"too_big",maximum:t.size}:{code:"too_small",minimum:t.size},inclusive:!0,exact:!0,input:r.value,inst:e,continue:!t.abort})}}),_m=g("$ZodCheckMaxLength",(e,t)=>{var n;Q.init(e,t),(n=e._zod.def).when??(n.when=(r)=>{let o=r.value;return!en(o)&&o.length!==void 0}),e._zod.onattach.push((r)=>{let o=r._zod.bag.maximum??Number.POSITIVE_INFINITY;if(t.maximum<o)r._zod.bag.maximum=t.maximum}),e._zod.check=(r)=>{let o=r.value;if(o.length<=t.maximum)return;let s=Vo(o);r.issues.push({origin:s,code:"too_big",maximum:t.maximum,inclusive:!0,input:o,inst:e,continue:!t.abort})}}),Sm=g("$ZodCheckMinLength",(e,t)=>{var n;Q.init(e,t),(n=e._zod.def).when??(n.when=(r)=>{let o=r.value;return!en(o)&&o.length!==void 0}),e._zod.onattach.push((r)=>{let o=r._zod.bag.minimum??Number.NEGATIVE_INFINITY;if(t.minimum>o)r._zod.bag.minimum=t.minimum}),e._zod.check=(r)=>{let o=r.value;if(o.length>=t.minimum)return;let s=Vo(o);r.issues.push({origin:s,code:"too_small",minimum:t.minimum,inclusive:!0,input:o,inst:e,continue:!t.abort})}}),xm=g("$ZodCheckLengthEquals",(e,t)=>{var n;Q.init(e,t),(n=e._zod.def).when??(n.when=(r)=>{let o=r.value;return!en(o)&&o.length!==void 0}),e._zod.onattach.push((r)=>{let o=r._zod.bag;o.minimum=t.length,o.maximum=t.length,o.length=t.length}),e._zod.check=(r)=>{let o=r.value,i=o.length;if(i===t.length)return;let s=Vo(o),a=i>t.length;r.issues.push({origin:s,...a?{code:"too_big",maximum:t.length}:{code:"too_small",minimum:t.length},inclusive:!0,exact:!0,input:r.value,inst:e,continue:!t.abort})}}),wr=g("$ZodCheckStringFormat",(e,t)=>{var n,r;if(Q.init(e,t),e._zod.onattach.push((o)=>{let i=o._zod.bag;if(i.format=t.format,t.pattern)i.patterns??(i.patterns=new Set),i.patterns.add(t.pattern)}),t.pattern)(n=e._zod).check??(n.check=(o)=>{if(t.pattern.lastIndex=0,t.pattern.test(o.value))return;o.issues.push({origin:"string",code:"invalid_format",format:t.format,input:o.value,...t.pattern?{pattern:t.pattern.toString()}:{},inst:e,continue:!t.abort})});else(r=e._zod).check??(r.check=()=>{})}),Cm=g("$ZodCheckRegex",(e,t)=>{wr.init(e,t),e._zod.check=(n)=>{if(t.pattern.lastIndex=0,t.pattern.test(n.value))return;n.issues.push({origin:"string",code:"invalid_format",format:"regex",input:n.value,pattern:t.pattern.toString(),inst:e,continue:!t.abort})}}),Em=g("$ZodCheckLowerCase",(e,t)=>{t.pattern??(t.pattern=mm),wr.init(e,t)}),wm=g("$ZodCheckUpperCase",(e,t)=>{t.pattern??(t.pattern=fm),wr.init(e,t)}),Rm=g("$ZodCheckIncludes",(e,t)=>{Q.init(e,t);let n=Xe(t.includes),r=new RegExp(typeof t.position==="number"?`^.{${t.position}}${n}`:n);t.pattern=r,e._zod.onattach.push((o)=>{let i=o._zod.bag;i.patterns??(i.patterns=new Set),i.patterns.add(r)}),e._zod.check=(o)=>{if(o.value.includes(t.includes,t.position))return;o.issues.push({origin:"string",code:"invalid_format",format:"includes",includes:t.includes,input:o.value,inst:e,continue:!t.abort})}}),Pm=g("$ZodCheckStartsWith",(e,t)=>{Q.init(e,t);let n=new RegExp(`^${Xe(t.prefix)}.*`);t.pattern??(t.pattern=n),e._zod.onattach.push((r)=>{let o=r._zod.bag;o.patterns??(o.patterns=new Set),o.patterns.add(n)}),e._zod.check=(r)=>{if(r.value.startsWith(t.prefix))return;r.issues.push({origin:"string",code:"invalid_format",format:"starts_with",prefix:t.prefix,input:r.value,inst:e,continue:!t.abort})}}),Am=g("$ZodCheckEndsWith",(e,t)=>{Q.init(e,t);let n=new RegExp(`.*${Xe(t.suffix)}$`);t.pattern??(t.pattern=n),e._zod.onattach.push((r)=>{let o=r._zod.bag;o.patterns??(o.patterns=new Set),o.patterns.add(n)}),e._zod.check=(r)=>{if(r.value.endsWith(t.suffix))return;r.issues.push({origin:"string",code:"invalid_format",format:"ends_with",suffix:t.suffix,input:r.value,inst:e,continue:!t.abort})}});function WS(e,t,n){if(e.issues.length)t.issues.push(...Ze(n,e.issues))}var km=g("$ZodCheckProperty",(e,t)=>{Q.init(e,t),e._zod.check=(n)=>{let r=t.schema._zod.run({value:n.value[t.property],issues:[]},{});if(r instanceof Promise)return r.then((o)=>WS(o,n,t.property));WS(r,n,t.property);return}}),Tm=g("$ZodCheckMimeType",(e,t)=>{Q.init(e,t);let n=new Set(t.mime);e._zod.onattach.push((r)=>{r._zod.bag.mime=t.mime}),e._zod.check=(r)=>{if(n.has(r.value.type))return;r.issues.push({code:"invalid_value",values:t.mime,input:r.value.type,inst:e,continue:!t.abort})}}),Im=g("$ZodCheckOverwrite",(e,t)=>{Q.init(e,t),e._zod.check=(n)=>{n.value=t.tx(n.value)}});class Na{constructor(e=[]){if(this.content=[],this.indent=0,this)this.args=e}indented(e){this.indent+=1,e(this),this.indent-=1}write(e){if(typeof e==="function"){e(this,{execution:"sync"}),e(this,{execution:"async"});return}let n=e.split(`
-`).filter((i)=>i),r=Math.min(...n.map((i)=>i.length-i.trimStart().length)),o=n.map((i)=>i.slice(r)).map((i)=>" ".repeat(this.indent*2)+i);for(let i of o)this.content.push(i)}compile(){let e=Function,t=this?.args,r=[...(this?.content??[""]).map((o)=>`  ${o}`)];return new e(...t,r.join(`
-`))}}var Om={major:4,minor:3,patch:5};var D=g("$ZodType",(e,t)=>{var n;e??(e={}),e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=Om;let r=[...e._zod.def.checks??[]];if(e._zod.traits.has("$ZodCheck"))r.unshift(e);for(let o of r)for(let i of o._zod.onattach)i(e);if(r.length===0)(n=e._zod).deferred??(n.deferred=[]),e._zod.deferred?.push(()=>{e._zod.run=e._zod.parse});else{let o=(s,a,c)=>{let l=rn(s),u;for(let d of a){if(d._zod.def.when){if(!d._zod.def.when(s))continue}else if(l)continue;let m=s.issues.length,f=d._zod.check(s);if(f instanceof Promise&&c?.async===!1)throw new Ct;if(u||f instanceof Promise)u=(u??Promise.resolve()).then(async()=>{if(await f,s.issues.length===m)return;if(!l)l=rn(s,m)});else{if(s.issues.length===m)continue;if(!l)l=rn(s,m)}}if(u)return u.then(()=>s);return s},i=(s,a,c)=>{if(rn(s))return s.aborted=!0,s;let l=o(a,r,c);if(l instanceof Promise){if(c.async===!1)throw new Ct;return l.then((u)=>e._zod.parse(u,c))}return e._zod.parse(l,c)};e._zod.run=(s,a)=>{if(a.skipChecks)return e._zod.parse(s,a);if(a.direction==="backward"){let l=e._zod.parse({value:s.value,issues:[]},{...a,skipChecks:!0});if(l instanceof Promise)return l.then((u)=>i(u,s,a));return i(l,s,a)}let c=e._zod.parse(s,a);if(c instanceof Promise){if(a.async===!1)throw new Ct;return c.then((l)=>o(l,r,a))}return o(c,r,a)}}W(e,"~standard",()=>({validate:(o)=>{try{let i=Ld(e,o);return i.success?{value:i.data}:{issues:i.error?.issues}}catch(i){return Wd(e,o).then((s)=>s.success?{value:s.data}:{issues:s.error?.issues})}},vendor:"zod",version:1}))}),Dn=g("$ZodString",(e,t)=>{D.init(e,t),e._zod.pattern=[...e?._zod.bag?.patterns??[]].pop()??sm(e._zod.bag),e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=String(n.value)}catch(o){}if(typeof n.value==="string")return n;return n.issues.push({expected:"string",code:"invalid_type",input:n.value,inst:e}),n}}),K=g("$ZodStringFormat",(e,t)=>{wr.init(e,t),Dn.init(e,t)}),Nm=g("$ZodGUID",(e,t)=>{t.pattern??(t.pattern=Hd),K.init(e,t)}),Dm=g("$ZodUUID",(e,t)=>{if(t.version){let r={v1:1,v2:2,v3:3,v4:4,v5:5,v6:6,v7:7,v8:8}[t.version];if(r===void 0)throw Error(`Invalid UUID version: "${t.version}"`);t.pattern??(t.pattern=Nn(r))}else t.pattern??(t.pattern=Nn());K.init(e,t)}),Mm=g("$ZodEmail",(e,t)=>{t.pattern??(t.pattern=qd),K.init(e,t)}),$m=g("$ZodURL",(e,t)=>{K.init(e,t),e._zod.check=(n)=>{try{let r=n.value.trim(),o=new URL(r);if(t.hostname){if(t.hostname.lastIndex=0,!t.hostname.test(o.hostname))n.issues.push({code:"invalid_format",format:"url",note:"Invalid hostname",pattern:t.hostname.source,input:n.value,inst:e,continue:!t.abort})}if(t.protocol){if(t.protocol.lastIndex=0,!t.protocol.test(o.protocol.endsWith(":")?o.protocol.slice(0,-1):o.protocol))n.issues.push({code:"invalid_format",format:"url",note:"Invalid protocol",pattern:t.protocol.source,input:n.value,inst:e,continue:!t.abort})}if(t.normalize)n.value=o.href;else n.value=r;return}catch(r){n.issues.push({code:"invalid_format",format:"url",input:n.value,inst:e,continue:!t.abort})}}}),Lm=g("$ZodEmoji",(e,t)=>{t.pattern??(t.pattern=Kd()),K.init(e,t)}),Wm=g("$ZodNanoID",(e,t)=>{t.pattern??(t.pattern=Bd),K.init(e,t)}),Fm=g("$ZodCUID",(e,t)=>{t.pattern??(t.pattern=Fd),K.init(e,t)}),Gm=g("$ZodCUID2",(e,t)=>{t.pattern??(t.pattern=Gd),K.init(e,t)}),Zm=g("$ZodULID",(e,t)=>{t.pattern??(t.pattern=Zd),K.init(e,t)}),jm=g("$ZodXID",(e,t)=>{t.pattern??(t.pattern=jd),K.init(e,t)}),Um=g("$ZodKSUID",(e,t)=>{t.pattern??(t.pattern=Ud),K.init(e,t)}),Bm=g("$ZodISODateTime",(e,t)=>{t.pattern??(t.pattern=im(t)),K.init(e,t)}),Vm=g("$ZodISODate",(e,t)=>{t.pattern??(t.pattern=rm),K.init(e,t)}),Hm=g("$ZodISOTime",(e,t)=>{t.pattern??(t.pattern=om(t)),K.init(e,t)}),qm=g("$ZodISODuration",(e,t)=>{t.pattern??(t.pattern=Vd),K.init(e,t)}),Km=g("$ZodIPv4",(e,t)=>{t.pattern??(t.pattern=Yd),K.init(e,t),e._zod.bag.format="ipv4"}),Ym=g("$ZodIPv6",(e,t)=>{t.pattern??(t.pattern=Jd),K.init(e,t),e._zod.bag.format="ipv6",e._zod.check=(n)=>{try{new URL(`http://[${n.value}]`)}catch{n.issues.push({code:"invalid_format",format:"ipv6",input:n.value,inst:e,continue:!t.abort})}}}),Jm=g("$ZodMAC",(e,t)=>{t.pattern??(t.pattern=Xd(t.delimiter)),K.init(e,t),e._zod.bag.format="mac"}),Xm=g("$ZodCIDRv4",(e,t)=>{t.pattern??(t.pattern=Qd),K.init(e,t)}),Qm=g("$ZodCIDRv6",(e,t)=>{t.pattern??(t.pattern=em),K.init(e,t),e._zod.check=(n)=>{let r=n.value.split("/");try{if(r.length!==2)throw Error();let[o,i]=r;if(!i)throw Error();let s=Number(i);if(`${s}`!==i)throw Error();if(s<0||s>128)throw Error();new URL(`http://[${o}]`)}catch{n.issues.push({code:"invalid_format",format:"cidrv6",input:n.value,inst:e,continue:!t.abort})}}});function ef(e){if(e==="")return!0;if(e.length%4!==0)return!1;try{return atob(e),!0}catch{return!1}}var tf=g("$ZodBase64",(e,t)=>{t.pattern??(t.pattern=tm),K.init(e,t),e._zod.bag.contentEncoding="base64",e._zod.check=(n)=>{if(ef(n.value))return;n.issues.push({code:"invalid_format",format:"base64",input:n.value,inst:e,continue:!t.abort})}});function QS(e){if(!Ia.test(e))return!1;let t=e.replace(/[-_]/g,(r)=>r==="-"?"+":"/"),n=t.padEnd(Math.ceil(t.length/4)*4,"=");return ef(n)}var nf=g("$ZodBase64URL",(e,t)=>{t.pattern??(t.pattern=Ia),K.init(e,t),e._zod.bag.contentEncoding="base64url",e._zod.check=(n)=>{if(QS(n.value))return;n.issues.push({code:"invalid_format",format:"base64url",input:n.value,inst:e,continue:!t.abort})}}),rf=g("$ZodE164",(e,t)=>{t.pattern??(t.pattern=nm),K.init(e,t)});function ex(e,t=null){try{let n=e.split(".");if(n.length!==3)return!1;let[r]=n;if(!r)return!1;let o=JSON.parse(atob(r));if("typ"in o&&o?.typ!=="JWT")return!1;if(!o.alg)return!1;if(t&&(!("alg"in o)||o.alg!==t))return!1;return!0}catch{return!1}}var of=g("$ZodJWT",(e,t)=>{K.init(e,t),e._zod.check=(n)=>{if(ex(n.value,t.alg))return;n.issues.push({code:"invalid_format",format:"jwt",input:n.value,inst:e,continue:!t.abort})}}),sf=g("$ZodCustomStringFormat",(e,t)=>{K.init(e,t),e._zod.check=(n)=>{if(t.fn(n.value))return;n.issues.push({code:"invalid_format",format:t.format,input:n.value,inst:e,continue:!t.abort})}}),Fa=g("$ZodNumber",(e,t)=>{D.init(e,t),e._zod.pattern=e._zod.bag.pattern??qo,e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=Number(n.value)}catch(s){}let o=n.value;if(typeof o==="number"&&!Number.isNaN(o)&&Number.isFinite(o))return n;let i=typeof o==="number"?Number.isNaN(o)?"NaN":!Number.isFinite(o)?"Infinity":void 0:void 0;return n.issues.push({expected:"number",code:"invalid_type",input:o,inst:e,...i?{received:i}:{}}),n}}),af=g("$ZodNumberFormat",(e,t)=>{gm.init(e,t),Fa.init(e,t)}),Jo=g("$ZodBoolean",(e,t)=>{D.init(e,t),e._zod.pattern=lm,e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=Boolean(n.value)}catch(i){}let o=n.value;if(typeof o==="boolean")return n;return n.issues.push({expected:"boolean",code:"invalid_type",input:o,inst:e}),n}}),Ga=g("$ZodBigInt",(e,t)=>{D.init(e,t),e._zod.pattern=am,e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=BigInt(n.value)}catch(o){}if(typeof n.value==="bigint")return n;return n.issues.push({expected:"bigint",code:"invalid_type",input:n.value,inst:e}),n}}),cf=g("$ZodBigIntFormat",(e,t)=>{hm.init(e,t),Ga.init(e,t)}),lf=g("$ZodSymbol",(e,t)=>{D.init(e,t),e._zod.parse=(n,r)=>{let o=n.value;if(typeof o==="symbol")return n;return n.issues.push({expected:"symbol",code:"invalid_type",input:o,inst:e}),n}}),uf=g("$ZodUndefined",(e,t)=>{D.init(e,t),e._zod.pattern=dm,e._zod.values=new Set([void 0]),e._zod.optin="optional",e._zod.optout="optional",e._zod.parse=(n,r)=>{let o=n.value;if(typeof o>"u")return n;return n.issues.push({expected:"undefined",code:"invalid_type",input:o,inst:e}),n}}),df=g("$ZodNull",(e,t)=>{D.init(e,t),e._zod.pattern=um,e._zod.values=new Set([null]),e._zod.parse=(n,r)=>{let o=n.value;if(o===null)return n;return n.issues.push({expected:"null",code:"invalid_type",input:o,inst:e}),n}}),mf=g("$ZodAny",(e,t)=>{D.init(e,t),e._zod.parse=(n)=>n}),ff=g("$ZodUnknown",(e,t)=>{D.init(e,t),e._zod.parse=(n)=>n}),pf=g("$ZodNever",(e,t)=>{D.init(e,t),e._zod.parse=(n,r)=>(n.issues.push({expected:"never",code:"invalid_type",input:n.value,inst:e}),n)}),gf=g("$ZodVoid",(e,t)=>{D.init(e,t),e._zod.parse=(n,r)=>{let o=n.value;if(typeof o>"u")return n;return n.issues.push({expected:"void",code:"invalid_type",input:o,inst:e}),n}}),hf=g("$ZodDate",(e,t)=>{D.init(e,t),e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=new Date(n.value)}catch(a){}let o=n.value,i=o instanceof Date;if(i&&!Number.isNaN(o.getTime()))return n;return n.issues.push({expected:"date",code:"invalid_type",input:o,...i?{received:"Invalid Date"}:{},inst:e}),n}});function ZS(e,t,n){if(e.issues.length)t.issues.push(...Ze(n,e.issues));t.value[n]=e.value}var yf=g("$ZodArray",(e,t)=>{D.init(e,t),e._zod.parse=(n,r)=>{let o=n.value;if(!Array.isArray(o))return n.issues.push({expected:"array",code:"invalid_type",input:o,inst:e}),n;n.value=Array(o.length);let i=[];for(let s=0;s<o.length;s++){let a=o[s],c=t.element._zod.run({value:a,issues:[]},r);if(c instanceof Promise)i.push(c.then((l)=>ZS(l,n,s)));else ZS(c,n,s)}if(i.length)return Promise.all(i).then(()=>n);return n}});function Wa(e,t,n,r,o){if(e.issues.length){if(o&&!(n in r))return;t.issues.push(...Ze(n,e.issues))}if(e.value===void 0){if(n in r)t.value[n]=void 0}else t.value[n]=e.value}function tx(e){let t=Object.keys(e.shape);for(let r of t)if(!e.shape?.[r]?._zod?.traits?.has("$ZodType"))throw Error(`Invalid element at key "${r}": expected a Zod schema`);let n=Nd(e.shape);return{...e,keys:t,keySet:new Set(t),numKeys:t.length,optionalKeys:new Set(n)}}function nx(e,t,n,r,o,i){let s=[],a=o.keySet,c=o.catchall._zod,l=c.def.type,u=c.optout==="optional";for(let d in t){if(a.has(d))continue;if(l==="never"){s.push(d);continue}let m=c.run({value:t[d],issues:[]},r);if(m instanceof Promise)e.push(m.then((f)=>Wa(f,n,d,t,u)));else Wa(m,n,d,t,u)}if(s.length)n.issues.push({code:"unrecognized_keys",keys:s,input:t,inst:i});if(!e.length)return n;return Promise.all(e).then(()=>n)}var rx=g("$ZodObject",(e,t)=>{if(D.init(e,t),!Object.getOwnPropertyDescriptor(t,"shape")?.get){let a=t.shape;Object.defineProperty(t,"shape",{get:()=>{let c={...a};return Object.defineProperty(t,"shape",{value:c}),c}})}let r=yr(()=>tx(t));W(e._zod,"propValues",()=>{let a=t.shape,c={};for(let l in a){let u=a[l]._zod;if(u.values){c[l]??(c[l]=new Set);for(let d of u.values)c[l].add(d)}}return c});let o=zn,i=t.catchall,s;e._zod.parse=(a,c)=>{s??(s=r.value);let l=a.value;if(!o(l))return a.issues.push({expected:"object",code:"invalid_type",input:l,inst:e}),a;a.value={};let u=[],d=s.shape;for(let m of s.keys){let f=d[m],p=f._zod.optout==="optional",h=f._zod.run({value:l[m],issues:[]},c);if(h instanceof Promise)u.push(h.then((y)=>Wa(y,a,m,l,p)));else Wa(h,a,m,l,p)}if(!i)return u.length?Promise.all(u).then(()=>a):a;return nx(u,l,a,c,r.value,e)}}),bf=g("$ZodObjectJIT",(e,t)=>{rx.init(e,t);let n=e._zod.parse,r=yr(()=>tx(t)),o=(m)=>{let f=new Na(["shape","payload","ctx"]),p=r.value,h=(A)=>{let C=ha(A);return`shape[${C}]._zod.run({ value: input[${C}], issues: [] }, ctx)`};f.write("const input = payload.value;");let y=Object.create(null),b=0;for(let A of p.keys)y[A]=`key_${b++}`;f.write("const newResult = {};");for(let A of p.keys){let C=y[A],P=ha(A),k=m[A]?._zod?.optout==="optional";if(f.write(`const ${C} = ${h(A)};`),k)f.write(`
-        if (${C}.issues.length) {
-          if (${P} in input) {
-            payload.issues = payload.issues.concat(${C}.issues.map(iss => ({
-              ...iss,
-              path: iss.path ? [${P}, ...iss.path] : [${P}]
-            })));
-          }
-        }
-        
-        if (${C}.value === undefined) {
-          if (${P} in input) {
-            newResult[${P}] = undefined;
-          }
-        } else {
-          newResult[${P}] = ${C}.value;
-        }
-        
-      `);else f.write(`
-        if (${C}.issues.length) {
-          payload.issues = payload.issues.concat(${C}.issues.map(iss => ({
-            ...iss,
-            path: iss.path ? [${P}, ...iss.path] : [${P}]
-          })));
-        }
-        
-        if (${C}.value === undefined) {
-          if (${P} in input) {
-            newResult[${P}] = undefined;
-          }
-        } else {
-          newResult[${P}] = ${C}.value;
-        }
-        
-      `)}f.write("payload.value = newResult;"),f.write("return payload;");let E=f.compile();return(A,C)=>E(m,A,C)},i,s=zn,a=!Fo.jitless,l=a&&Id.value,u=t.catchall,d;e._zod.parse=(m,f)=>{d??(d=r.value);let p=m.value;if(!s(p))return m.issues.push({expected:"object",code:"invalid_type",input:p,inst:e}),m;if(a&&l&&f?.async===!1&&f.jitless!==!0){if(!i)i=o(t.shape);if(m=i(m,f),!u)return m;return nx([],p,m,f,d,e)}return n(m,f)}});function jS(e,t,n,r){for(let i of e)if(i.issues.length===0)return t.value=i.value,t;let o=e.filter((i)=>!rn(i));if(o.length===1)return t.value=o[0].value,o[0];return t.issues.push({code:"invalid_union",input:t.value,inst:n,errors:e.map((i)=>i.issues.map((s)=>Te(s,r,le())))}),t}var Xo=g("$ZodUnion",(e,t)=>{D.init(e,t),W(e._zod,"optin",()=>t.options.some((o)=>o._zod.optin==="optional")?"optional":void 0),W(e._zod,"optout",()=>t.options.some((o)=>o._zod.optout==="optional")?"optional":void 0),W(e._zod,"values",()=>{if(t.options.every((o)=>o._zod.values))return new Set(t.options.flatMap((o)=>Array.from(o._zod.values)));return}),W(e._zod,"pattern",()=>{if(t.options.every((o)=>o._zod.pattern)){let o=t.options.map((i)=>i._zod.pattern);return new RegExp(`^(${o.map((i)=>jo(i.source)).join("|")})$`)}return});let n=t.options.length===1,r=t.options[0]._zod.run;e._zod.parse=(o,i)=>{if(n)return r(o,i);let s=!1,a=[];for(let c of t.options){let l=c._zod.run({value:o.value,issues:[]},i);if(l instanceof Promise)a.push(l),s=!0;else{if(l.issues.length===0)return l;a.push(l)}}if(!s)return jS(a,o,e,i);return Promise.all(a).then((c)=>jS(c,o,e,i))}});function US(e,t,n,r){let o=e.filter((i)=>i.issues.length===0);if(o.length===1)return t.value=o[0].value,t;if(o.length===0)t.issues.push({code:"invalid_union",input:t.value,inst:n,errors:e.map((i)=>i.issues.map((s)=>Te(s,r,le())))});else t.issues.push({code:"invalid_union",input:t.value,inst:n,errors:[],inclusive:!1});return t}var vf=g("$ZodXor",(e,t)=>{Xo.init(e,t),t.inclusive=!1;let n=t.options.length===1,r=t.options[0]._zod.run;e._zod.parse=(o,i)=>{if(n)return r(o,i);let s=!1,a=[];for(let c of t.options){let l=c._zod.run({value:o.value,issues:[]},i);if(l instanceof Promise)a.push(l),s=!0;else a.push(l)}if(!s)return US(a,o,e,i);return Promise.all(a).then((c)=>US(c,o,e,i))}}),_f=g("$ZodDiscriminatedUnion",(e,t)=>{t.inclusive=!1,Xo.init(e,t);let n=e._zod.parse;W(e._zod,"propValues",()=>{let o={};for(let i of t.options){let s=i._zod.propValues;if(!s||Object.keys(s).length===0)throw Error(`Invalid discriminated union option at index "${t.options.indexOf(i)}"`);for(let[a,c]of Object.entries(s)){if(!o[a])o[a]=new Set;for(let l of c)o[a].add(l)}}return o});let r=yr(()=>{let o=t.options,i=new Map;for(let s of o){let a=s._zod.propValues?.[t.discriminator];if(!a||a.size===0)throw Error(`Invalid discriminated union option at index "${t.options.indexOf(s)}"`);for(let c of a){if(i.has(c))throw Error(`Duplicate discriminator value "${String(c)}"`);i.set(c,s)}}return i});e._zod.parse=(o,i)=>{let s=o.value;if(!zn(s))return o.issues.push({code:"invalid_type",expected:"object",input:s,inst:e}),o;let a=r.value.get(s?.[t.discriminator]);if(a)return a._zod.run(o,i);if(t.unionFallback)return n(o,i);return o.issues.push({code:"invalid_union",errors:[],note:"No matching discriminator",discriminator:t.discriminator,input:s,path:[t.discriminator],inst:e}),o}}),Sf=g("$ZodIntersection",(e,t)=>{D.init(e,t),e._zod.parse=(n,r)=>{let o=n.value,i=t.left._zod.run({value:o,issues:[]},r),s=t.right._zod.run({value:o,issues:[]},r);if(i instanceof Promise||s instanceof Promise)return Promise.all([i,s]).then(([c,l])=>BS(n,c,l));return BS(n,i,s)}});function zm(e,t){if(e===t)return{valid:!0,data:e};if(e instanceof Date&&t instanceof Date&&+e===+t)return{valid:!0,data:e};if(nn(e)&&nn(t)){let n=Object.keys(t),r=Object.keys(e).filter((i)=>n.indexOf(i)!==-1),o={...e,...t};for(let i of r){let s=zm(e[i],t[i]);if(!s.valid)return{valid:!1,mergeErrorPath:[i,...s.mergeErrorPath]};o[i]=s.data}return{valid:!0,data:o}}if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return{valid:!1,mergeErrorPath:[]};let n=[];for(let r=0;r<e.length;r++){let o=e[r],i=t[r],s=zm(o,i);if(!s.valid)return{valid:!1,mergeErrorPath:[r,...s.mergeErrorPath]};n.push(s.data)}return{valid:!0,data:n}}return{valid:!1,mergeErrorPath:[]}}function BS(e,t,n){let r=new Map,o;for(let a of t.issues)if(a.code==="unrecognized_keys"){o??(o=a);for(let c of a.keys){if(!r.has(c))r.set(c,{});r.get(c).l=!0}}else e.issues.push(a);for(let a of n.issues)if(a.code==="unrecognized_keys")for(let c of a.keys){if(!r.has(c))r.set(c,{});r.get(c).r=!0}else e.issues.push(a);let i=[...r].filter(([,a])=>a.l&&a.r).map(([a])=>a);if(i.length&&o)e.issues.push({...o,keys:i});if(rn(e))return e;let s=zm(t.value,n.value);if(!s.valid)throw Error(`Unmergable intersection. Error path: ${JSON.stringify(s.mergeErrorPath)}`);return e.value=s.data,e}var Za=g("$ZodTuple",(e,t)=>{D.init(e,t);let n=t.items;e._zod.parse=(r,o)=>{let i=r.value;if(!Array.isArray(i))return r.issues.push({input:i,inst:e,expected:"tuple",code:"invalid_type"}),r;r.value=[];let s=[],a=[...n].reverse().findIndex((u)=>u._zod.optin!=="optional"),c=a===-1?0:n.length-a;if(!t.rest){let u=i.length>n.length,d=i.length<c-1;if(u||d)return r.issues.push({...u?{code:"too_big",maximum:n.length,inclusive:!0}:{code:"too_small",minimum:n.length},input:i,inst:e,origin:"array"}),r}let l=-1;for(let u of n){if(l++,l>=i.length){if(l>=c)continue}let d=u._zod.run({value:i[l],issues:[]},o);if(d instanceof Promise)s.push(d.then((m)=>Da(m,r,l)));else Da(d,r,l)}if(t.rest){let u=i.slice(n.length);for(let d of u){l++;let m=t.rest._zod.run({value:d,issues:[]},o);if(m instanceof Promise)s.push(m.then((f)=>Da(f,r,l)));else Da(m,r,l)}}if(s.length)return Promise.all(s).then(()=>r);return r}});function Da(e,t,n){if(e.issues.length)t.issues.push(...Ze(n,e.issues));t.value[n]=e.value}var xf=g("$ZodRecord",(e,t)=>{D.init(e,t),e._zod.parse=(n,r)=>{let o=n.value;if(!nn(o))return n.issues.push({expected:"record",code:"invalid_type",input:o,inst:e}),n;let i=[],s=t.keyType._zod.values;if(s){n.value={};let a=new Set;for(let l of s)if(typeof l==="string"||typeof l==="number"||typeof l==="symbol"){a.add(typeof l==="number"?l.toString():l);let u=t.valueType._zod.run({value:o[l],issues:[]},r);if(u instanceof Promise)i.push(u.then((d)=>{if(d.issues.length)n.issues.push(...Ze(l,d.issues));n.value[l]=d.value}));else{if(u.issues.length)n.issues.push(...Ze(l,u.issues));n.value[l]=u.value}}let c;for(let l in o)if(!a.has(l))c=c??[],c.push(l);if(c&&c.length>0)n.issues.push({code:"unrecognized_keys",input:o,inst:e,keys:c})}else{n.value={};for(let a of Reflect.ownKeys(o)){if(a==="__proto__")continue;let c=t.keyType._zod.run({value:a,issues:[]},r);if(c instanceof Promise)throw Error("Async schemas not supported in object keys currently");if(typeof a==="string"&&qo.test(a)&&c.issues.length&&c.issues.some((d)=>d.code==="invalid_type"&&d.expected==="number")){let d=t.keyType._zod.run({value:Number(a),issues:[]},r);if(d instanceof Promise)throw Error("Async schemas not supported in object keys currently");if(d.issues.length===0)c=d}if(c.issues.length){if(t.mode==="loose")n.value[a]=o[a];else n.issues.push({code:"invalid_key",origin:"record",issues:c.issues.map((d)=>Te(d,r,le())),input:a,path:[a],inst:e});continue}let u=t.valueType._zod.run({value:o[a],issues:[]},r);if(u instanceof Promise)i.push(u.then((d)=>{if(d.issues.length)n.issues.push(...Ze(a,d.issues));n.value[c.value]=d.value}));else{if(u.issues.length)n.issues.push(...Ze(a,u.issues));n.value[c.value]=u.value}}}if(i.length)return Promise.all(i).then(()=>n);return n}}),Cf=g("$ZodMap",(e,t)=>{D.init(e,t),e._zod.parse=(n,r)=>{let o=n.value;if(!(o instanceof Map))return n.issues.push({expected:"map",code:"invalid_type",input:o,inst:e}),n;let i=[];n.value=new Map;for(let[s,a]of o){let c=t.keyType._zod.run({value:s,issues:[]},r),l=t.valueType._zod.run({value:a,issues:[]},r);if(c instanceof Promise||l instanceof Promise)i.push(Promise.all([c,l]).then(([u,d])=>{VS(u,d,n,s,o,e,r)}));else VS(c,l,n,s,o,e,r)}if(i.length)return Promise.all(i).then(()=>n);return n}});function VS(e,t,n,r,o,i,s){if(e.issues.length)if(Uo.has(typeof r))n.issues.push(...Ze(r,e.issues));else n.issues.push({code:"invalid_key",origin:"map",input:o,inst:i,issues:e.issues.map((a)=>Te(a,s,le()))});if(t.issues.length)if(Uo.has(typeof r))n.issues.push(...Ze(r,t.issues));else n.issues.push({origin:"map",code:"invalid_element",input:o,inst:i,key:r,issues:t.issues.map((a)=>Te(a,s,le()))});n.value.set(e.value,t.value)}var Ef=g("$ZodSet",(e,t)=>{D.init(e,t),e._zod.parse=(n,r)=>{let o=n.value;if(!(o instanceof Set))return n.issues.push({input:o,inst:e,expected:"set",code:"invalid_type"}),n;let i=[];n.value=new Set;for(let s of o){let a=t.valueType._zod.run({value:s,issues:[]},r);if(a instanceof Promise)i.push(a.then((c)=>HS(c,n)));else HS(a,n)}if(i.length)return Promise.all(i).then(()=>n);return n}});function HS(e,t){if(e.issues.length)t.issues.push(...e.issues);t.value.add(e.value)}var wf=g("$ZodEnum",(e,t)=>{D.init(e,t);let n=Zo(t.entries),r=new Set(n);e._zod.values=r,e._zod.pattern=new RegExp(`^(${n.filter((o)=>Uo.has(typeof o)).map((o)=>typeof o==="string"?Xe(o):o.toString()).join("|")})$`),e._zod.parse=(o,i)=>{let s=o.value;if(r.has(s))return o;return o.issues.push({code:"invalid_value",values:n,input:s,inst:e}),o}}),Rf=g("$ZodLiteral",(e,t)=>{if(D.init(e,t),t.values.length===0)throw Error("Cannot create literal schema with no valid values");let n=new Set(t.values);e._zod.values=n,e._zod.pattern=new RegExp(`^(${t.values.map((r)=>typeof r==="string"?Xe(r):r?Xe(r.toString()):String(r)).join("|")})$`),e._zod.parse=(r,o)=>{let i=r.value;if(n.has(i))return r;return r.issues.push({code:"invalid_value",values:t.values,input:i,inst:e}),r}}),Pf=g("$ZodFile",(e,t)=>{D.init(e,t),e._zod.parse=(n,r)=>{let o=n.value;if(o instanceof File)return n;return n.issues.push({expected:"file",code:"invalid_type",input:o,inst:e}),n}}),Af=g("$ZodTransform",(e,t)=>{D.init(e,t),e._zod.parse=(n,r)=>{if(r.direction==="backward")throw new On(e.constructor.name);let o=t.transform(n.value,n);if(r.async)return(o instanceof Promise?o:Promise.resolve(o)).then((s)=>(n.value=s,n));if(o instanceof Promise)throw new Ct;return n.value=o,n}});function qS(e,t){if(e.issues.length&&t===void 0)return{issues:[],value:void 0};return e}var ja=g("$ZodOptional",(e,t)=>{D.init(e,t),e._zod.optin="optional",e._zod.optout="optional",W(e._zod,"values",()=>t.innerType._zod.values?new Set([...t.innerType._zod.values,void 0]):void 0),W(e._zod,"pattern",()=>{let n=t.innerType._zod.pattern;return n?new RegExp(`^(${jo(n.source)})?$`):void 0}),e._zod.parse=(n,r)=>{if(t.innerType._zod.optin==="optional"){let o=t.innerType._zod.run(n,r);if(o instanceof Promise)return o.then((i)=>qS(i,n.value));return qS(o,n.value)}if(n.value===void 0)return n;return t.innerType._zod.run(n,r)}}),kf=g("$ZodExactOptional",(e,t)=>{ja.init(e,t),W(e._zod,"values",()=>t.innerType._zod.values),W(e._zod,"pattern",()=>t.innerType._zod.pattern),e._zod.parse=(n,r)=>t.innerType._zod.run(n,r)}),Tf=g("$ZodNullable",(e,t)=>{D.init(e,t),W(e._zod,"optin",()=>t.innerType._zod.optin),W(e._zod,"optout",()=>t.innerType._zod.optout),W(e._zod,"pattern",()=>{let n=t.innerType._zod.pattern;return n?new RegExp(`^(${jo(n.source)}|null)$`):void 0}),W(e._zod,"values",()=>t.innerType._zod.values?new Set([...t.innerType._zod.values,null]):void 0),e._zod.parse=(n,r)=>{if(n.value===null)return n;return t.innerType._zod.run(n,r)}}),If=g("$ZodDefault",(e,t)=>{D.init(e,t),e._zod.optin="optional",W(e._zod,"values",()=>t.innerType._zod.values),e._zod.parse=(n,r)=>{if(r.direction==="backward")return t.innerType._zod.run(n,r);if(n.value===void 0)return n.value=t.defaultValue,n;let o=t.innerType._zod.run(n,r);if(o instanceof Promise)return o.then((i)=>KS(i,t));return KS(o,t)}});function KS(e,t){if(e.value===void 0)e.value=t.defaultValue;return e}var Of=g("$ZodPrefault",(e,t)=>{D.init(e,t),e._zod.optin="optional",W(e._zod,"values",()=>t.innerType._zod.values),e._zod.parse=(n,r)=>{if(r.direction==="backward")return t.innerType._zod.run(n,r);if(n.value===void 0)n.value=t.defaultValue;return t.innerType._zod.run(n,r)}}),zf=g("$ZodNonOptional",(e,t)=>{D.init(e,t),W(e._zod,"values",()=>{let n=t.innerType._zod.values;return n?new Set([...n].filter((r)=>r!==void 0)):void 0}),e._zod.parse=(n,r)=>{let o=t.innerType._zod.run(n,r);if(o instanceof Promise)return o.then((i)=>YS(i,e));return YS(o,e)}});function YS(e,t){if(!e.issues.length&&e.value===void 0)e.issues.push({code:"invalid_type",expected:"nonoptional",input:e.value,inst:t});return e}var Nf=g("$ZodSuccess",(e,t)=>{D.init(e,t),e._zod.parse=(n,r)=>{if(r.direction==="backward")throw new On("ZodSuccess");let o=t.innerType._zod.run(n,r);if(o instanceof Promise)return o.then((i)=>(n.value=i.issues.length===0,n));return n.value=o.issues.length===0,n}}),Df=g("$ZodCatch",(e,t)=>{D.init(e,t),W(e._zod,"optin",()=>t.innerType._zod.optin),W(e._zod,"optout",()=>t.innerType._zod.optout),W(e._zod,"values",()=>t.innerType._zod.values),e._zod.parse=(n,r)=>{if(r.direction==="backward")return t.innerType._zod.run(n,r);let o=t.innerType._zod.run(n,r);if(o instanceof Promise)return o.then((i)=>{if(n.value=i.value,i.issues.length)n.value=t.catchValue({...n,error:{issues:i.issues.map((s)=>Te(s,r,le()))},input:n.value}),n.issues=[];return n});if(n.value=o.value,o.issues.length)n.value=t.catchValue({...n,error:{issues:o.issues.map((i)=>Te(i,r,le()))},input:n.value}),n.issues=[];return n}}),Mf=g("$ZodNaN",(e,t)=>{D.init(e,t),e._zod.parse=(n,r)=>{if(typeof n.value!=="number"||!Number.isNaN(n.value))return n.issues.push({input:n.value,inst:e,expected:"nan",code:"invalid_type"}),n;return n}}),$f=g("$ZodPipe",(e,t)=>{D.init(e,t),W(e._zod,"values",()=>t.in._zod.values),W(e._zod,"optin",()=>t.in._zod.optin),W(e._zod,"optout",()=>t.out._zod.optout),W(e._zod,"propValues",()=>t.in._zod.propValues),e._zod.parse=(n,r)=>{if(r.direction==="backward"){let i=t.out._zod.run(n,r);if(i instanceof Promise)return i.then((s)=>Ma(s,t.in,r));return Ma(i,t.in,r)}let o=t.in._zod.run(n,r);if(o instanceof Promise)return o.then((i)=>Ma(i,t.out,r));return Ma(o,t.out,r)}});function Ma(e,t,n){if(e.issues.length)return e.aborted=!0,e;return t._zod.run({value:e.value,issues:e.issues},n)}var Qo=g("$ZodCodec",(e,t)=>{D.init(e,t),W(e._zod,"values",()=>t.in._zod.values),W(e._zod,"optin",()=>t.in._zod.optin),W(e._zod,"optout",()=>t.out._zod.optout),W(e._zod,"propValues",()=>t.in._zod.propValues),e._zod.parse=(n,r)=>{if((r.direction||"forward")==="forward"){let i=t.in._zod.run(n,r);if(i instanceof Promise)return i.then((s)=>$a(s,t,r));return $a(i,t,r)}else{let i=t.out._zod.run(n,r);if(i instanceof Promise)return i.then((s)=>$a(s,t,r));return $a(i,t,r)}}});function $a(e,t,n){if(e.issues.length)return e.aborted=!0,e;if((n.direction||"forward")==="forward"){let o=t.transform(e.value,e);if(o instanceof Promise)return o.then((i)=>La(e,i,t.out,n));return La(e,o,t.out,n)}else{let o=t.reverseTransform(e.value,e);if(o instanceof Promise)return o.then((i)=>La(e,i,t.in,n));return La(e,o,t.in,n)}}function La(e,t,n,r){if(e.issues.length)return e.aborted=!0,e;return n._zod.run({value:t,issues:e.issues},r)}var Lf=g("$ZodReadonly",(e,t)=>{D.init(e,t),W(e._zod,"propValues",()=>t.innerType._zod.propValues),W(e._zod,"values",()=>t.innerType._zod.values),W(e._zod,"optin",()=>t.innerType?._zod?.optin),W(e._zod,"optout",()=>t.innerType?._zod?.optout),e._zod.parse=(n,r)=>{if(r.direction==="backward")return t.innerType._zod.run(n,r);let o=t.innerType._zod.run(n,r);if(o instanceof Promise)return o.then(JS);return JS(o)}});function JS(e){return e.value=Object.freeze(e.value),e}var Wf=g("$ZodTemplateLiteral",(e,t)=>{D.init(e,t);let n=[];for(let r of t.parts)if(typeof r==="object"&&r!==null){if(!r._zod.pattern)throw Error(`Invalid template literal part, no pattern found: ${[...r._zod.traits].shift()}`);let o=r._zod.pattern instanceof RegExp?r._zod.pattern.source:r._zod.pattern;if(!o)throw Error(`Invalid template literal part: ${r._zod.traits}`);let i=o.startsWith("^")?1:0,s=o.endsWith("$")?o.length-1:o.length;n.push(o.slice(i,s))}else if(r===null||zd.has(typeof r))n.push(Xe(`${r}`));else throw Error(`Invalid template literal part: ${r}`);e._zod.pattern=new RegExp(`^${n.join("")}$`),e._zod.parse=(r,o)=>{if(typeof r.value!=="string")return r.issues.push({input:r.value,inst:e,expected:"string",code:"invalid_type"}),r;if(e._zod.pattern.lastIndex=0,!e._zod.pattern.test(r.value))return r.issues.push({input:r.value,inst:e,code:"invalid_format",format:t.format??"template_literal",pattern:e._zod.pattern.source}),r;return r}}),Ff=g("$ZodFunction",(e,t)=>(D.init(e,t),e._def=t,e._zod.def=t,e.implement=(n)=>{if(typeof n!=="function")throw Error("implement() must be called with a function");return function(...r){let o=e._def.input?Sa(e._def.input,r):r,i=Reflect.apply(n,this,o);if(e._def.output)return Sa(e._def.output,i);return i}},e.implementAsync=(n)=>{if(typeof n!=="function")throw Error("implementAsync() must be called with a function");return async function(...r){let o=e._def.input?await xa(e._def.input,r):r,i=await Reflect.apply(n,this,o);if(e._def.output)return await xa(e._def.output,i);return i}},e._zod.parse=(n,r)=>{if(typeof n.value!=="function")return n.issues.push({code:"invalid_type",expected:"function",input:n.value,inst:e}),n;if(e._def.output&&e._def.output._zod.def.type==="promise")n.value=e.implementAsync(n.value);else n.value=e.implement(n.value);return n},e.input=(...n)=>{let r=e.constructor;if(Array.isArray(n[0]))return new r({type:"function",input:new Za({type:"tuple",items:n[0],rest:n[1]}),output:e._def.output});return new r({type:"function",input:n[0],output:e._def.output})},e.output=(n)=>new e.constructor({type:"function",input:e._def.input,output:n}),e)),Gf=g("$ZodPromise",(e,t)=>{D.init(e,t),e._zod.parse=(n,r)=>Promise.resolve(n.value).then((o)=>t.innerType._zod.run({value:o,issues:[]},r))}),Zf=g("$ZodLazy",(e,t)=>{D.init(e,t),W(e._zod,"innerType",()=>t.getter()),W(e._zod,"pattern",()=>e._zod.innerType?._zod?.pattern),W(e._zod,"propValues",()=>e._zod.innerType?._zod?.propValues),W(e._zod,"optin",()=>e._zod.innerType?._zod?.optin??void 0),W(e._zod,"optout",()=>e._zod.innerType?._zod?.optout??void 0),e._zod.parse=(n,r)=>e._zod.innerType._zod.run(n,r)}),jf=g("$ZodCustom",(e,t)=>{Q.init(e,t),D.init(e,t),e._zod.parse=(n,r)=>n,e._zod.check=(n)=>{let r=n.value,o=t.fn(r);if(o instanceof Promise)return o.then((i)=>XS(i,n,r,e));XS(o,n,r,e);return}});function XS(e,t,n,r){if(!e){let o={code:"custom",input:n,inst:r,path:[...r._zod.def.path??[]],continue:!r._zod.def.abort};if(r._zod.def.params)o.params=r._zod.def.params;t.issues.push(br(o))}}var ei={};var ox,Ua=Symbol("ZodOutput"),Ba=Symbol("ZodInput");class Uf{constructor(){this._map=new WeakMap,this._idmap=new Map}add(e,...t){let n=t[0];if(this._map.set(e,n),n&&typeof n==="object"&&"id"in n)this._idmap.set(n.id,e);return this}clear(){return this._map=new WeakMap,this._idmap=new Map,this}remove(e){let t=this._map.get(e);if(t&&typeof t==="object"&&"id"in t)this._idmap.delete(t.id);return this._map.delete(e),this}get(e){let t=e._zod.parent;if(t){let n={...this.get(t)??{}};delete n.id;let r={...n,...this._map.get(e)};return Object.keys(r).length?r:void 0}return this._map.get(e)}has(e){return this._map.has(e)}}function ti(){return new Uf}(ox=globalThis).__zod_globalRegistry??(ox.__zod_globalRegistry=ti());var Oe=globalThis.__zod_globalRegistry;function Bf(e,t){return new e({type:"string",..._(t)})}function Vf(e,t){return new e({type:"string",coerce:!0,..._(t)})}function Va(e,t){return new e({type:"string",format:"email",check:"string_format",abort:!1,..._(t)})}function ni(e,t){return new e({type:"string",format:"guid",check:"string_format",abort:!1,..._(t)})}function Ha(e,t){return new e({type:"string",format:"uuid",check:"string_format",abort:!1,..._(t)})}function qa(e,t){return new e({type:"string",format:"uuid",check:"string_format",abort:!1,version:"v4",..._(t)})}function Ka(e,t){return new e({type:"string",format:"uuid",check:"string_format",abort:!1,version:"v6",..._(t)})}function Ya(e,t){return new e({type:"string",format:"uuid",check:"string_format",abort:!1,version:"v7",..._(t)})}function ri(e,t){return new e({type:"string",format:"url",check:"string_format",abort:!1,..._(t)})}function Ja(e,t){return new e({type:"string",format:"emoji",check:"string_format",abort:!1,..._(t)})}function Xa(e,t){return new e({type:"string",format:"nanoid",check:"string_format",abort:!1,..._(t)})}function Qa(e,t){return new e({type:"string",format:"cuid",check:"string_format",abort:!1,..._(t)})}function ec(e,t){return new e({type:"string",format:"cuid2",check:"string_format",abort:!1,..._(t)})}function tc(e,t){return new e({type:"string",format:"ulid",check:"string_format",abort:!1,..._(t)})}function nc(e,t){return new e({type:"string",format:"xid",check:"string_format",abort:!1,..._(t)})}function rc(e,t){return new e({type:"string",format:"ksuid",check:"string_format",abort:!1,..._(t)})}function oc(e,t){return new e({type:"string",format:"ipv4",check:"string_format",abort:!1,..._(t)})}function ic(e,t){return new e({type:"string",format:"ipv6",check:"string_format",abort:!1,..._(t)})}function Hf(e,t){return new e({type:"string",format:"mac",check:"string_format",abort:!1,..._(t)})}function sc(e,t){return new e({type:"string",format:"cidrv4",check:"string_format",abort:!1,..._(t)})}function ac(e,t){return new e({type:"string",format:"cidrv6",check:"string_format",abort:!1,..._(t)})}function cc(e,t){return new e({type:"string",format:"base64",check:"string_format",abort:!1,..._(t)})}function lc(e,t){return new e({type:"string",format:"base64url",check:"string_format",abort:!1,..._(t)})}function uc(e,t){return new e({type:"string",format:"e164",check:"string_format",abort:!1,..._(t)})}function dc(e,t){return new e({type:"string",format:"jwt",check:"string_format",abort:!1,..._(t)})}var mc={Any:null,Minute:-1,Second:0,Millisecond:3,Microsecond:6};function qf(e,t){return new e({type:"string",format:"datetime",check:"string_format",offset:!1,local:!1,precision:null,..._(t)})}function Kf(e,t){return new e({type:"string",format:"date",check:"string_format",..._(t)})}function Yf(e,t){return new e({type:"string",format:"time",check:"string_format",precision:null,..._(t)})}function Jf(e,t){return new e({type:"string",format:"duration",check:"string_format",..._(t)})}function Xf(e,t){return new e({type:"number",checks:[],..._(t)})}function Qf(e,t){return new e({type:"number",coerce:!0,checks:[],..._(t)})}function ep(e,t){return new e({type:"number",check:"number_format",abort:!1,format:"safeint",..._(t)})}function tp(e,t){return new e({type:"number",check:"number_format",abort:!1,format:"float32",..._(t)})}function np(e,t){return new e({type:"number",check:"number_format",abort:!1,format:"float64",..._(t)})}function rp(e,t){return new e({type:"number",check:"number_format",abort:!1,format:"int32",..._(t)})}function op(e,t){return new e({type:"number",check:"number_format",abort:!1,format:"uint32",..._(t)})}function ip(e,t){return new e({type:"boolean",..._(t)})}function sp(e,t){return new e({type:"boolean",coerce:!0,..._(t)})}function ap(e,t){return new e({type:"bigint",..._(t)})}function cp(e,t){return new e({type:"bigint",coerce:!0,..._(t)})}function lp(e,t){return new e({type:"bigint",check:"bigint_format",abort:!1,format:"int64",..._(t)})}function up(e,t){return new e({type:"bigint",check:"bigint_format",abort:!1,format:"uint64",..._(t)})}function dp(e,t){return new e({type:"symbol",..._(t)})}function mp(e,t){return new e({type:"undefined",..._(t)})}function fp(e,t){return new e({type:"null",..._(t)})}function pp(e){return new e({type:"any"})}function gp(e){return new e({type:"unknown"})}function hp(e,t){return new e({type:"never",..._(t)})}function yp(e,t){return new e({type:"void",..._(t)})}function bp(e,t){return new e({type:"date",..._(t)})}function vp(e,t){return new e({type:"date",coerce:!0,..._(t)})}function _p(e,t){return new e({type:"nan",..._(t)})}function Et(e,t){return new Oa({check:"less_than",..._(t),value:e,inclusive:!1})}function Ue(e,t){return new Oa({check:"less_than",..._(t),value:e,inclusive:!0})}function wt(e,t){return new za({check:"greater_than",..._(t),value:e,inclusive:!1})}function Ee(e,t){return new za({check:"greater_than",..._(t),value:e,inclusive:!0})}function fc(e){return wt(0,e)}function pc(e){return Et(0,e)}function gc(e){return Ue(0,e)}function hc(e){return Ee(0,e)}function on(e,t){return new pm({check:"multiple_of",..._(t),value:e})}function sn(e,t){return new ym({check:"max_size",..._(t),maximum:e})}function Rt(e,t){return new bm({check:"min_size",..._(t),minimum:e})}function Mn(e,t){return new vm({check:"size_equals",..._(t),size:e})}function $n(e,t){return new _m({check:"max_length",..._(t),maximum:e})}function Ft(e,t){return new Sm({check:"min_length",..._(t),minimum:e})}function Ln(e,t){return new xm({check:"length_equals",..._(t),length:e})}function Rr(e,t){return new Cm({check:"string_format",format:"regex",..._(t),pattern:e})}function Pr(e){return new Em({check:"string_format",format:"lowercase",..._(e)})}function Ar(e){return new wm({check:"string_format",format:"uppercase",..._(e)})}function kr(e,t){return new Rm({check:"string_format",format:"includes",..._(t),includes:e})}function Tr(e,t){return new Pm({check:"string_format",format:"starts_with",..._(t),prefix:e})}function Ir(e,t){return new Am({check:"string_format",format:"ends_with",..._(t),suffix:e})}function yc(e,t,n){return new km({check:"property",property:e,schema:t,..._(n)})}function Or(e,t){return new Tm({check:"mime_type",mime:e,..._(t)})}function ut(e){return new Im({check:"overwrite",tx:e})}function zr(e){return ut((t)=>t.normalize(e))}function Nr(){return ut((e)=>e.trim())}function Dr(){return ut((e)=>e.toLowerCase())}function Mr(){return ut((e)=>e.toUpperCase())}function $r(){return ut((e)=>Td(e))}function Sp(e,t,n){return new e({type:"array",element:t,..._(n)})}function u0(e,t,n){return new e({type:"union",options:t,..._(n)})}function d0(e,t,n){return new e({type:"union",options:t,inclusive:!1,..._(n)})}function m0(e,t,n,r){return new e({type:"union",options:n,discriminator:t,..._(r)})}function f0(e,t,n){return new e({type:"intersection",left:t,right:n})}function p0(e,t,n,r){let o=n instanceof D;return new e({type:"tuple",items:t,rest:o?n:null,..._(o?r:n)})}function g0(e,t,n,r){return new e({type:"record",keyType:t,valueType:n,..._(r)})}function h0(e,t,n,r){return new e({type:"map",keyType:t,valueType:n,..._(r)})}function y0(e,t,n){return new e({type:"set",valueType:t,..._(n)})}function b0(e,t,n){let r=Array.isArray(t)?Object.fromEntries(t.map((o)=>[o,o])):t;return new e({type:"enum",entries:r,..._(n)})}function v0(e,t,n){return new e({type:"enum",entries:t,..._(n)})}function _0(e,t,n){return new e({type:"literal",values:Array.isArray(t)?t:[t],..._(n)})}function xp(e,t){return new e({type:"file",..._(t)})}function S0(e,t){return new e({type:"transform",transform:t})}function x0(e,t){return new e({type:"optional",innerType:t})}function C0(e,t){return new e({type:"nullable",innerType:t})}function E0(e,t,n){return new e({type:"default",innerType:t,get defaultValue(){return typeof n==="function"?n():Od(n)}})}function w0(e,t,n){return new e({type:"nonoptional",innerType:t,..._(n)})}function R0(e,t){return new e({type:"success",innerType:t})}function P0(e,t,n){return new e({type:"catch",innerType:t,catchValue:typeof n==="function"?n:()=>n})}function A0(e,t,n){return new e({type:"pipe",in:t,out:n})}function k0(e,t){return new e({type:"readonly",innerType:t})}function T0(e,t,n){return new e({type:"template_literal",parts:t,..._(n)})}function I0(e,t){return new e({type:"lazy",getter:t})}function O0(e,t){return new e({type:"promise",innerType:t})}function Cp(e,t,n){let r=_(n);return r.abort??(r.abort=!0),new e({type:"custom",check:"custom",fn:t,...r})}function Ep(e,t,n){return new e({type:"custom",check:"custom",fn:t,..._(n)})}function wp(e){let t=ix((n)=>(n.addIssue=(r)=>{if(typeof r==="string")n.issues.push(br(r,n.value,t._zod.def));else{let o=r;if(o.fatal)o.continue=!1;o.code??(o.code="custom"),o.input??(o.input=n.value),o.inst??(o.inst=t),o.continue??(o.continue=!t._zod.def.abort),n.issues.push(br(o))}},e(n.value,n)));return t}function ix(e,t){let n=new Q({check:"custom",..._(t)});return n._zod.check=e,n}function Rp(e){let t=new Q({check:"describe"});return t._zod.onattach=[(n)=>{let r=Oe.get(n)??{};Oe.add(n,{...r,description:e})}],t._zod.check=()=>{},t}function Pp(e){let t=new Q({check:"meta"});return t._zod.onattach=[(n)=>{let r=Oe.get(n)??{};Oe.add(n,{...r,...e})}],t._zod.check=()=>{},t}function Ap(e,t){let n=_(t),r=n.truthy??["true","1","yes","on","y","enabled"],o=n.falsy??["false","0","no","off","n","disabled"];if(n.case!=="sensitive")r=r.map((f)=>typeof f==="string"?f.toLowerCase():f),o=o.map((f)=>typeof f==="string"?f.toLowerCase():f);let i=new Set(r),s=new Set(o),a=e.Codec??Qo,c=e.Boolean??Jo,u=new(e.String??Dn)({type:"string",error:n.error}),d=new c({type:"boolean",error:n.error}),m=new a({type:"pipe",in:u,out:d,transform:(f,p)=>{let h=f;if(n.case!=="sensitive")h=h.toLowerCase();if(i.has(h))return!0;else if(s.has(h))return!1;else return p.issues.push({code:"invalid_value",expected:"stringbool",values:[...i,...s],input:p.value,inst:m,continue:!1}),{}},reverseTransform:(f,p)=>{if(f===!0)return r[0]||"true";else return o[0]||"false"},error:n.error});return m}function Lr(e,t,n,r={}){let o=_(r),i={..._(r),check:"string_format",type:"string",format:t,fn:typeof n==="function"?n:(a)=>n.test(a),...o};if(n instanceof RegExp)i.pattern=n;return new e(i)}var Wr=()=>{throw Error("JSON Schema conversion is not bundled into this plugin artifact")},kp=()=>Wr,bc=()=>Wr,Fr=Wr,ee=Wr,Gr=Wr,Zr=Wr;var z0={guid:"uuid",url:"uri",datetime:"date-time",json_string:"json-string",regex:""},Tp=(e,t,n,r)=>{let o=n;o.type="string";let{minimum:i,maximum:s,format:a,patterns:c,contentEncoding:l}=e._zod.bag;if(typeof i==="number")o.minLength=i;if(typeof s==="number")o.maxLength=s;if(a){if(o.format=z0[a]??a,o.format==="")delete o.format;if(a==="time")delete o.format}if(l)o.contentEncoding=l;if(c&&c.size>0){let u=[...c];if(u.length===1)o.pattern=u[0].source;else if(u.length>1)o.allOf=[...u.map((d)=>({...t.target==="draft-07"||t.target==="draft-04"||t.target==="openapi-3.0"?{type:"string"}:{},pattern:d.source}))]}},Ip=(e,t,n,r)=>{let o=n,{minimum:i,maximum:s,format:a,multipleOf:c,exclusiveMaximum:l,exclusiveMinimum:u}=e._zod.bag;if(typeof a==="string"&&a.includes("int"))o.type="integer";else o.type="number";if(typeof u==="number")if(t.target==="draft-04"||t.target==="openapi-3.0")o.minimum=u,o.exclusiveMinimum=!0;else o.exclusiveMinimum=u;if(typeof i==="number"){if(o.minimum=i,typeof u==="number"&&t.target!=="draft-04")if(u>=i)delete o.minimum;else delete o.exclusiveMinimum}if(typeof l==="number")if(t.target==="draft-04"||t.target==="openapi-3.0")o.maximum=l,o.exclusiveMaximum=!0;else o.exclusiveMaximum=l;if(typeof s==="number"){if(o.maximum=s,typeof l==="number"&&t.target!=="draft-04")if(l<=s)delete o.maximum;else delete o.exclusiveMaximum}if(typeof c==="number")o.multipleOf=c},Op=(e,t,n,r)=>{n.type="boolean"},zp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("BigInt cannot be represented in JSON Schema")},Np=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Symbols cannot be represented in JSON Schema")},Dp=(e,t,n,r)=>{if(t.target==="openapi-3.0")n.type="string",n.nullable=!0,n.enum=[null];else n.type="null"},Mp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Undefined cannot be represented in JSON Schema")},$p=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Void cannot be represented in JSON Schema")},Lp=(e,t,n,r)=>{n.not={}},Wp=(e,t,n,r)=>{},Fp=(e,t,n,r)=>{},Gp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Date cannot be represented in JSON Schema")},Zp=(e,t,n,r)=>{let o=e._zod.def,i=Zo(o.entries);if(i.every((s)=>typeof s==="number"))n.type="number";if(i.every((s)=>typeof s==="string"))n.type="string";n.enum=i},jp=(e,t,n,r)=>{let o=e._zod.def,i=[];for(let s of o.values)if(s===void 0){if(t.unrepresentable==="throw")throw Error("Literal `undefined` cannot be represented in JSON Schema")}else if(typeof s==="bigint")if(t.unrepresentable==="throw")throw Error("BigInt literals cannot be represented in JSON Schema");else i.push(Number(s));else i.push(s);if(i.length===0);else if(i.length===1){let s=i[0];if(n.type=s===null?"null":typeof s,t.target==="draft-04"||t.target==="openapi-3.0")n.enum=[s];else n.const=s}else{if(i.every((s)=>typeof s==="number"))n.type="number";if(i.every((s)=>typeof s==="string"))n.type="string";if(i.every((s)=>typeof s==="boolean"))n.type="boolean";if(i.every((s)=>s===null))n.type="null";n.enum=i}},Up=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("NaN cannot be represented in JSON Schema")},Bp=(e,t,n,r)=>{let o=n,i=e._zod.pattern;if(!i)throw Error("Pattern not found in template literal");o.type="string",o.pattern=i.source},Vp=(e,t,n,r)=>{let o=n,i={type:"string",format:"binary",contentEncoding:"binary"},{minimum:s,maximum:a,mime:c}=e._zod.bag;if(s!==void 0)i.minLength=s;if(a!==void 0)i.maxLength=a;if(c)if(c.length===1)i.contentMediaType=c[0],Object.assign(o,i);else Object.assign(o,i),o.anyOf=c.map((l)=>({contentMediaType:l}));else Object.assign(o,i)},Hp=(e,t,n,r)=>{n.type="boolean"},qp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Custom types cannot be represented in JSON Schema")},Kp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Function types cannot be represented in JSON Schema")},Yp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Transforms cannot be represented in JSON Schema")},Jp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Map cannot be represented in JSON Schema")},Xp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Set cannot be represented in JSON Schema")},Qp=(e,t,n,r)=>{let o=n,i=e._zod.def,{minimum:s,maximum:a}=e._zod.bag;if(typeof s==="number")o.minItems=s;if(typeof a==="number")o.maxItems=a;o.type="array",o.items=ee(i.element,t,{...r,path:[...r.path,"items"]})},eg=(e,t,n,r)=>{let o=n,i=e._zod.def;o.type="object",o.properties={};let s=i.shape;for(let l in s)o.properties[l]=ee(s[l],t,{...r,path:[...r.path,"properties",l]});let a=new Set(Object.keys(s)),c=new Set([...a].filter((l)=>{let u=i.shape[l]._zod;if(t.io==="input")return u.optin===void 0;else return u.optout===void 0}));if(c.size>0)o.required=Array.from(c);if(i.catchall?._zod.def.type==="never")o.additionalProperties=!1;else if(!i.catchall){if(t.io==="output")o.additionalProperties=!1}else if(i.catchall)o.additionalProperties=ee(i.catchall,t,{...r,path:[...r.path,"additionalProperties"]})},_c=(e,t,n,r)=>{let o=e._zod.def,i=o.inclusive===!1,s=o.options.map((a,c)=>ee(a,t,{...r,path:[...r.path,i?"oneOf":"anyOf",c]}));if(i)n.oneOf=s;else n.anyOf=s},tg=(e,t,n,r)=>{let o=e._zod.def,i=ee(o.left,t,{...r,path:[...r.path,"allOf",0]}),s=ee(o.right,t,{...r,path:[...r.path,"allOf",1]}),a=(l)=>("allOf"in l)&&Object.keys(l).length===1,c=[...a(i)?i.allOf:[i],...a(s)?s.allOf:[s]];n.allOf=c},ng=(e,t,n,r)=>{let o=n,i=e._zod.def;o.type="array";let s=t.target==="draft-2020-12"?"prefixItems":"items",a=t.target==="draft-2020-12"?"items":t.target==="openapi-3.0"?"items":"additionalItems",c=i.items.map((m,f)=>ee(m,t,{...r,path:[...r.path,s,f]})),l=i.rest?ee(i.rest,t,{...r,path:[...r.path,a,...t.target==="openapi-3.0"?[i.items.length]:[]]}):null;if(t.target==="draft-2020-12"){if(o.prefixItems=c,l)o.items=l}else if(t.target==="openapi-3.0"){if(o.items={anyOf:c},l)o.items.anyOf.push(l);if(o.minItems=c.length,!l)o.maxItems=c.length}else if(o.items=c,l)o.additionalItems=l;let{minimum:u,maximum:d}=e._zod.bag;if(typeof u==="number")o.minItems=u;if(typeof d==="number")o.maxItems=d},rg=(e,t,n,r)=>{let o=n,i=e._zod.def;o.type="object";let s=i.keyType,c=s._zod.bag?.patterns;if(i.mode==="loose"&&c&&c.size>0){let u=ee(i.valueType,t,{...r,path:[...r.path,"patternProperties","*"]});o.patternProperties={};for(let d of c)o.patternProperties[d.source]=u}else{if(t.target==="draft-07"||t.target==="draft-2020-12")o.propertyNames=ee(i.keyType,t,{...r,path:[...r.path,"propertyNames"]});o.additionalProperties=ee(i.valueType,t,{...r,path:[...r.path,"additionalProperties"]})}let l=s._zod.values;if(l){let u=[...l].filter((d)=>typeof d==="string"||typeof d==="number");if(u.length>0)o.required=u}},og=(e,t,n,r)=>{let o=e._zod.def,i=ee(o.innerType,t,r),s=t.seen.get(e);if(t.target==="openapi-3.0")s.ref=o.innerType,n.nullable=!0;else n.anyOf=[i,{type:"null"}]},ig=(e,t,n,r)=>{let o=e._zod.def;ee(o.innerType,t,r);let i=t.seen.get(e);i.ref=o.innerType},sg=(e,t,n,r)=>{let o=e._zod.def;ee(o.innerType,t,r);let i=t.seen.get(e);i.ref=o.innerType,n.default=JSON.parse(JSON.stringify(o.defaultValue))},ag=(e,t,n,r)=>{let o=e._zod.def;ee(o.innerType,t,r);let i=t.seen.get(e);if(i.ref=o.innerType,t.io==="input")n._prefault=JSON.parse(JSON.stringify(o.defaultValue))},cg=(e,t,n,r)=>{let o=e._zod.def;ee(o.innerType,t,r);let i=t.seen.get(e);i.ref=o.innerType;let s;try{s=o.catchValue(void 0)}catch{throw Error("Dynamic catch values are not supported in JSON Schema")}n.default=s},lg=(e,t,n,r)=>{let o=e._zod.def,i=t.io==="input"?o.in._zod.def.type==="transform"?o.out:o.in:o.out;ee(i,t,r);let s=t.seen.get(e);s.ref=i},ug=(e,t,n,r)=>{let o=e._zod.def;ee(o.innerType,t,r);let i=t.seen.get(e);i.ref=o.innerType,n.readOnly=!0},dg=(e,t,n,r)=>{let o=e._zod.def;ee(o.innerType,t,r);let i=t.seen.get(e);i.ref=o.innerType},Sc=(e,t,n,r)=>{let o=e._zod.def;ee(o.innerType,t,r);let i=t.seen.get(e);i.ref=o.innerType},mg=(e,t,n,r)=>{let o=e._zod.innerType;ee(o,t,r);let i=t.seen.get(e);i.ref=o},vc={string:Tp,number:Ip,boolean:Op,bigint:zp,symbol:Np,null:Dp,undefined:Mp,void:$p,never:Lp,any:Wp,unknown:Fp,date:Gp,enum:Zp,literal:jp,nan:Up,template_literal:Bp,file:Vp,success:Hp,custom:qp,function:Kp,transform:Yp,map:Jp,set:Xp,array:Qp,object:eg,union:_c,intersection:tg,tuple:ng,record:rg,nullable:og,nonoptional:ig,default:sg,prefault:ag,catch:cg,pipe:lg,readonly:ug,promise:dg,optional:Sc,lazy:mg};function oi(e,t){if("_idmap"in e){let r=e,o=Fr({...t,processors:vc}),i={};for(let c of r._idmap.entries()){let[l,u]=c;ee(u,o)}let s={},a={registry:r,uri:t?.uri,defs:i};o.external=a;for(let c of r._idmap.entries()){let[l,u]=c;Gr(o,u),s[l]=Zr(o,u)}if(Object.keys(i).length>0){let c=o.target==="draft-2020-12"?"$defs":"definitions";s.__shared={[c]:i}}return{schemas:s}}let n=Fr({...t,processors:vc});return ee(e,n),Gr(n,e),Zr(n,e)}class fg{get metadataRegistry(){return this.ctx.metadataRegistry}get target(){return this.ctx.target}get unrepresentable(){return this.ctx.unrepresentable}get override(){return this.ctx.override}get io(){return this.ctx.io}get counter(){return this.ctx.counter}set counter(e){this.ctx.counter=e}get seen(){return this.ctx.seen}constructor(e){let t=e?.target??"draft-2020-12";if(t==="draft-4")t="draft-04";if(t==="draft-7")t="draft-07";this.ctx=Fr({processors:vc,target:t,...e?.metadata&&{metadata:e.metadata},...e?.unrepresentable&&{unrepresentable:e.unrepresentable},...e?.override&&{override:e.override},...e?.io&&{io:e.io}})}process(e,t={path:[],schemaPath:[]}){return ee(e,this.ctx,t)}emit(e,t){if(t){if(t.cycles)this.ctx.cycles=t.cycles;if(t.reused)this.ctx.reused=t.reused;if(t.external)this.ctx.external=t.external}Gr(this.ctx,e);let n=Zr(this.ctx,e),{"~standard":r,...o}=n;return o}}var sx={};var li={};ln(li,{ZodISODate:()=>si,ZodISODateTime:()=>ii,ZodISODuration:()=>ci,ZodISOTime:()=>ai,date:()=>gg,datetime:()=>pg,duration:()=>yg,time:()=>hg});var ii=g("ZodISODateTime",(e,t)=>{Bm.init(e,t),Y.init(e,t)});function pg(e){return qf(ii,e)}var si=g("ZodISODate",(e,t)=>{Vm.init(e,t),Y.init(e,t)});function gg(e){return Kf(si,e)}var ai=g("ZodISOTime",(e,t)=>{Hm.init(e,t),Y.init(e,t)});function hg(e){return Yf(ai,e)}var ci=g("ZodISODuration",(e,t)=>{qm.init(e,t),Y.init(e,t)});function yg(e){return Jf(ci,e)}var cx=(e,t)=>{Ho.init(e,t),e.name="ZodError",Object.defineProperties(e,{format:{value:(n)=>_r(e,n)},flatten:{value:(n)=>vr(e,n)},addIssue:{value:(n)=>{e.issues.push(n),e.message=JSON.stringify(e.issues,hr,2)}},addIssues:{value:(n)=>{e.issues.push(...n),e.message=JSON.stringify(e.issues,hr,2)}},isEmpty:{get(){return e.issues.length===0}}})},lx=g("ZodError",cx),we=g("ZodError",cx,{Parent:Error});var xc=Sr(we),Cc=xr(we),Ec=Cr(we),wc=Er(we),Rc=Ca(we),Pc=Ea(we),Ac=wa(we),kc=Ra(we),Tc=Pa(we),Ic=Aa(we),Oc=ka(we),zc=Ta(we);var M=g("ZodType",(e,t)=>(D.init(e,t),Object.assign(e["~standard"],{jsonSchema:{input:bc(e,"input"),output:bc(e,"output")}}),e.toJSONSchema=kp(e,{}),e.def=t,e.type=t.type,Object.defineProperty(e,"_def",{value:t}),e.check=(...n)=>e.clone(I.mergeDefs(t,{checks:[...t.checks??[],...n.map((r)=>typeof r==="function"?{_zod:{check:r,def:{check:"custom"},onattach:[]}}:r)]}),{parent:!0}),e.with=e.check,e.clone=(n,r)=>ve(e,n,r),e.brand=()=>e,e.register=(n,r)=>(n.add(e,r),e),e.parse=(n,r)=>xc(e,n,r,{callee:e.parse}),e.safeParse=(n,r)=>Ec(e,n,r),e.parseAsync=async(n,r)=>Cc(e,n,r,{callee:e.parseAsync}),e.safeParseAsync=async(n,r)=>wc(e,n,r),e.spa=e.safeParseAsync,e.encode=(n,r)=>Rc(e,n,r),e.decode=(n,r)=>Pc(e,n,r),e.encodeAsync=async(n,r)=>Ac(e,n,r),e.decodeAsync=async(n,r)=>kc(e,n,r),e.safeEncode=(n,r)=>Tc(e,n,r),e.safeDecode=(n,r)=>Ic(e,n,r),e.safeEncodeAsync=async(n,r)=>Oc(e,n,r),e.safeDecodeAsync=async(n,r)=>zc(e,n,r),e.refine=(n,r)=>e.check(ah(n,r)),e.superRefine=(n)=>e.check(ch(n)),e.overwrite=(n)=>e.check(ut(n)),e.optional=()=>di(e),e.exactOptional=()=>jg(e),e.nullable=()=>mi(e),e.nullish=()=>di(mi(e)),e.nonoptional=(n)=>Kg(e,n),e.array=()=>hi(e),e.or=(n)=>tl([e,n]),e.and=(n)=>zg(e,n),e.transform=(n)=>fi(e,rl(n)),e.default=(n)=>Vg(e,n),e.prefault=(n)=>qg(e,n),e.catch=(n)=>Xg(e,n),e.pipe=(n)=>fi(e,n),e.readonly=()=>th(e),e.describe=(n)=>{let r=e.clone();return Oe.add(r,{description:n}),r},Object.defineProperty(e,"description",{get(){return Oe.get(e)?.description},configurable:!0}),e.meta=(...n)=>{if(n.length===0)return Oe.get(e);let r=e.clone();return Oe.add(r,n[0]),r},e.isOptional=()=>e.safeParse(void 0).success,e.isNullable=()=>e.safeParse(null).success,e.apply=(n)=>n(e),e)),Mc=g("_ZodString",(e,t)=>{Dn.init(e,t),M.init(e,t),e._zod.processJSONSchema=(r,o,i)=>Tp(e,r,o,i);let n=e._zod.bag;e.format=n.format??null,e.minLength=n.minimum??null,e.maxLength=n.maximum??null,e.regex=(...r)=>e.check(Rr(...r)),e.includes=(...r)=>e.check(kr(...r)),e.startsWith=(...r)=>e.check(Tr(...r)),e.endsWith=(...r)=>e.check(Ir(...r)),e.min=(...r)=>e.check(Ft(...r)),e.max=(...r)=>e.check($n(...r)),e.length=(...r)=>e.check(Ln(...r)),e.nonempty=(...r)=>e.check(Ft(1,...r)),e.lowercase=(r)=>e.check(Pr(r)),e.uppercase=(r)=>e.check(Ar(r)),e.trim=()=>e.check(Nr()),e.normalize=(...r)=>e.check(zr(...r)),e.toLowerCase=()=>e.check(Dr()),e.toUpperCase=()=>e.check(Mr()),e.slugify=()=>e.check($r())}),Ur=g("ZodString",(e,t)=>{Dn.init(e,t),Mc.init(e,t),e.email=(n)=>e.check(Va($c,n)),e.url=(n)=>e.check(ri(pi,n)),e.jwt=(n)=>e.check(dc(Xc,n)),e.emoji=(n)=>e.check(Ja(Lc,n)),e.guid=(n)=>e.check(ni(ui,n)),e.uuid=(n)=>e.check(Ha(At,n)),e.uuidv4=(n)=>e.check(qa(At,n)),e.uuidv6=(n)=>e.check(Ka(At,n)),e.uuidv7=(n)=>e.check(Ya(At,n)),e.nanoid=(n)=>e.check(Xa(Wc,n)),e.guid=(n)=>e.check(ni(ui,n)),e.cuid=(n)=>e.check(Qa(Fc,n)),e.cuid2=(n)=>e.check(ec(Gc,n)),e.ulid=(n)=>e.check(tc(Zc,n)),e.base64=(n)=>e.check(cc(Kc,n)),e.base64url=(n)=>e.check(lc(Yc,n)),e.xid=(n)=>e.check(nc(jc,n)),e.ksuid=(n)=>e.check(rc(Uc,n)),e.ipv4=(n)=>e.check(oc(Bc,n)),e.ipv6=(n)=>e.check(ic(Vc,n)),e.cidrv4=(n)=>e.check(sc(Hc,n)),e.cidrv6=(n)=>e.check(ac(qc,n)),e.e164=(n)=>e.check(uc(Jc,n)),e.datetime=(n)=>e.check(pg(n)),e.date=(n)=>e.check(gg(n)),e.time=(n)=>e.check(hg(n)),e.duration=(n)=>e.check(yg(n))});function Nc(e){return Bf(Ur,e)}var Y=g("ZodStringFormat",(e,t)=>{K.init(e,t),Mc.init(e,t)}),$c=g("ZodEmail",(e,t)=>{Mm.init(e,t),Y.init(e,t)});function ux(e){return Va($c,e)}var ui=g("ZodGUID",(e,t)=>{Nm.init(e,t),Y.init(e,t)});function dx(e){return ni(ui,e)}var At=g("ZodUUID",(e,t)=>{Dm.init(e,t),Y.init(e,t)});function mx(e){return Ha(At,e)}function fx(e){return qa(At,e)}function px(e){return Ka(At,e)}function gx(e){return Ya(At,e)}var pi=g("ZodURL",(e,t)=>{$m.init(e,t),Y.init(e,t)});function hx(e){return ri(pi,e)}function yx(e){return ri(pi,{protocol:/^https?$/,hostname:je.domain,...I.normalizeParams(e)})}var Lc=g("ZodEmoji",(e,t)=>{Lm.init(e,t),Y.init(e,t)});function bx(e){return Ja(Lc,e)}var Wc=g("ZodNanoID",(e,t)=>{Wm.init(e,t),Y.init(e,t)});function vx(e){return Xa(Wc,e)}var Fc=g("ZodCUID",(e,t)=>{Fm.init(e,t),Y.init(e,t)});function _x(e){return Qa(Fc,e)}var Gc=g("ZodCUID2",(e,t)=>{Gm.init(e,t),Y.init(e,t)});function Sx(e){return ec(Gc,e)}var Zc=g("ZodULID",(e,t)=>{Zm.init(e,t),Y.init(e,t)});function xx(e){return tc(Zc,e)}var jc=g("ZodXID",(e,t)=>{jm.init(e,t),Y.init(e,t)});function Cx(e){return nc(jc,e)}var Uc=g("ZodKSUID",(e,t)=>{Um.init(e,t),Y.init(e,t)});function Ex(e){return rc(Uc,e)}var Bc=g("ZodIPv4",(e,t)=>{Km.init(e,t),Y.init(e,t)});function wx(e){return oc(Bc,e)}var bg=g("ZodMAC",(e,t)=>{Jm.init(e,t),Y.init(e,t)});function Rx(e){return Hf(bg,e)}var Vc=g("ZodIPv6",(e,t)=>{Ym.init(e,t),Y.init(e,t)});function Px(e){return ic(Vc,e)}var Hc=g("ZodCIDRv4",(e,t)=>{Xm.init(e,t),Y.init(e,t)});function Ax(e){return sc(Hc,e)}var qc=g("ZodCIDRv6",(e,t)=>{Qm.init(e,t),Y.init(e,t)});function kx(e){return ac(qc,e)}var Kc=g("ZodBase64",(e,t)=>{tf.init(e,t),Y.init(e,t)});function Tx(e){return cc(Kc,e)}var Yc=g("ZodBase64URL",(e,t)=>{nf.init(e,t),Y.init(e,t)});function Ix(e){return lc(Yc,e)}var Jc=g("ZodE164",(e,t)=>{rf.init(e,t),Y.init(e,t)});function Ox(e){return uc(Jc,e)}var Xc=g("ZodJWT",(e,t)=>{of.init(e,t),Y.init(e,t)});function zx(e){return dc(Xc,e)}var Br=g("ZodCustomStringFormat",(e,t)=>{sf.init(e,t),Y.init(e,t)});function Nx(e,t,n={}){return Lr(Br,e,t,n)}function Dx(e){return Lr(Br,"hostname",je.hostname,e)}function Mx(e){return Lr(Br,"hex",je.hex,e)}function $x(e,t){let n=t?.enc??"hex",r=`${e}_${n}`,o=je[r];if(!o)throw Error(`Unrecognized hash format: ${r}`);return Lr(Br,r,o,t)}var Vr=g("ZodNumber",(e,t)=>{Fa.init(e,t),M.init(e,t),e._zod.processJSONSchema=(r,o,i)=>Ip(e,r,o,i),e.gt=(r,o)=>e.check(wt(r,o)),e.gte=(r,o)=>e.check(Ee(r,o)),e.min=(r,o)=>e.check(Ee(r,o)),e.lt=(r,o)=>e.check(Et(r,o)),e.lte=(r,o)=>e.check(Ue(r,o)),e.max=(r,o)=>e.check(Ue(r,o)),e.int=(r)=>e.check(Dc(r)),e.safe=(r)=>e.check(Dc(r)),e.positive=(r)=>e.check(wt(0,r)),e.nonnegative=(r)=>e.check(Ee(0,r)),e.negative=(r)=>e.check(Et(0,r)),e.nonpositive=(r)=>e.check(Ue(0,r)),e.multipleOf=(r,o)=>e.check(on(r,o)),e.step=(r,o)=>e.check(on(r,o)),e.finite=()=>e;let n=e._zod.bag;e.minValue=Math.max(n.minimum??Number.NEGATIVE_INFINITY,n.exclusiveMinimum??Number.NEGATIVE_INFINITY)??null,e.maxValue=Math.min(n.maximum??Number.POSITIVE_INFINITY,n.exclusiveMaximum??Number.POSITIVE_INFINITY)??null,e.isInt=(n.format??"").includes("int")||Number.isSafeInteger(n.multipleOf??0.5),e.isFinite=!0,e.format=n.format??null});function vg(e){return Xf(Vr,e)}var Fn=g("ZodNumberFormat",(e,t)=>{af.init(e,t),Vr.init(e,t)});function Dc(e){return ep(Fn,e)}function Lx(e){return tp(Fn,e)}function Wx(e){return np(Fn,e)}function Fx(e){return rp(Fn,e)}function Gx(e){return op(Fn,e)}var Hr=g("ZodBoolean",(e,t)=>{Jo.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Op(e,n,r,o)});function _g(e){return ip(Hr,e)}var qr=g("ZodBigInt",(e,t)=>{Ga.init(e,t),M.init(e,t),e._zod.processJSONSchema=(r,o,i)=>zp(e,r,o,i),e.gte=(r,o)=>e.check(Ee(r,o)),e.min=(r,o)=>e.check(Ee(r,o)),e.gt=(r,o)=>e.check(wt(r,o)),e.gte=(r,o)=>e.check(Ee(r,o)),e.min=(r,o)=>e.check(Ee(r,o)),e.lt=(r,o)=>e.check(Et(r,o)),e.lte=(r,o)=>e.check(Ue(r,o)),e.max=(r,o)=>e.check(Ue(r,o)),e.positive=(r)=>e.check(wt(BigInt(0),r)),e.negative=(r)=>e.check(Et(BigInt(0),r)),e.nonpositive=(r)=>e.check(Ue(BigInt(0),r)),e.nonnegative=(r)=>e.check(Ee(BigInt(0),r)),e.multipleOf=(r,o)=>e.check(on(r,o));let n=e._zod.bag;e.minValue=n.minimum??null,e.maxValue=n.maximum??null,e.format=n.format??null});function Zx(e){return ap(qr,e)}var Qc=g("ZodBigIntFormat",(e,t)=>{cf.init(e,t),qr.init(e,t)});function jx(e){return lp(Qc,e)}function Ux(e){return up(Qc,e)}var Sg=g("ZodSymbol",(e,t)=>{lf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Np(e,n,r,o)});function Bx(e){return dp(Sg,e)}var xg=g("ZodUndefined",(e,t)=>{uf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Mp(e,n,r,o)});function Vx(e){return mp(xg,e)}var Cg=g("ZodNull",(e,t)=>{df.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Dp(e,n,r,o)});function Eg(e){return fp(Cg,e)}var wg=g("ZodAny",(e,t)=>{mf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Wp(e,n,r,o)});function Hx(){return pp(wg)}var Rg=g("ZodUnknown",(e,t)=>{ff.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Fp(e,n,r,o)});function Wn(){return gp(Rg)}var Pg=g("ZodNever",(e,t)=>{pf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Lp(e,n,r,o)});function el(e){return hp(Pg,e)}var Ag=g("ZodVoid",(e,t)=>{gf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>$p(e,n,r,o)});function qx(e){return yp(Ag,e)}var gi=g("ZodDate",(e,t)=>{hf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(r,o,i)=>Gp(e,r,o,i),e.min=(r,o)=>e.check(Ee(r,o)),e.max=(r,o)=>e.check(Ue(r,o));let n=e._zod.bag;e.minDate=n.minimum?new Date(n.minimum):null,e.maxDate=n.maximum?new Date(n.maximum):null});function Kx(e){return bp(gi,e)}var kg=g("ZodArray",(e,t)=>{yf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Qp(e,n,r,o),e.element=t.element,e.min=(n,r)=>e.check(Ft(n,r)),e.nonempty=(n)=>e.check(Ft(1,n)),e.max=(n,r)=>e.check($n(n,r)),e.length=(n,r)=>e.check(Ln(n,r)),e.unwrap=()=>e.element});function hi(e,t){return Sp(kg,e,t)}function Yx(e){let t=e._zod.def.shape;return nl(Object.keys(t))}var yi=g("ZodObject",(e,t)=>{bf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>eg(e,n,r,o),I.defineLazy(e,"shape",()=>t.shape),e.keyof=()=>nl(Object.keys(e._zod.def.shape)),e.catchall=(n)=>e.clone({...e._zod.def,catchall:n}),e.passthrough=()=>e.clone({...e._zod.def,catchall:Wn()}),e.loose=()=>e.clone({...e._zod.def,catchall:Wn()}),e.strict=()=>e.clone({...e._zod.def,catchall:el()}),e.strip=()=>e.clone({...e._zod.def,catchall:void 0}),e.extend=(n)=>I.extend(e,n),e.safeExtend=(n)=>I.safeExtend(e,n),e.merge=(n)=>I.merge(e,n),e.pick=(n)=>I.pick(e,n),e.omit=(n)=>I.omit(e,n),e.partial=(...n)=>I.partial(ol,e,n[0]),e.required=(...n)=>I.required(il,e,n[0])});function Jx(e,t){let n={type:"object",shape:e??{},...I.normalizeParams(t)};return new yi(n)}function Xx(e,t){return new yi({type:"object",shape:e,catchall:el(),...I.normalizeParams(t)})}function Qx(e,t){return new yi({type:"object",shape:e,catchall:Wn(),...I.normalizeParams(t)})}var bi=g("ZodUnion",(e,t)=>{Xo.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>_c(e,n,r,o),e.options=t.options});function tl(e,t){return new bi({type:"union",options:e,...I.normalizeParams(t)})}var Tg=g("ZodXor",(e,t)=>{bi.init(e,t),vf.init(e,t),e._zod.processJSONSchema=(n,r,o)=>_c(e,n,r,o),e.options=t.options});function eC(e,t){return new Tg({type:"union",options:e,inclusive:!1,...I.normalizeParams(t)})}var Ig=g("ZodDiscriminatedUnion",(e,t)=>{bi.init(e,t),_f.init(e,t)});function tC(e,t,n){return new Ig({type:"union",options:t,discriminator:e,...I.normalizeParams(n)})}var Og=g("ZodIntersection",(e,t)=>{Sf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>tg(e,n,r,o)});function zg(e,t){return new Og({type:"intersection",left:e,right:t})}var Ng=g("ZodTuple",(e,t)=>{Za.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>ng(e,n,r,o),e.rest=(n)=>e.clone({...e._zod.def,rest:n})});function Dg(e,t,n){let r=t instanceof D,o=r?n:t;return new Ng({type:"tuple",items:e,rest:r?t:null,...I.normalizeParams(o)})}var vi=g("ZodRecord",(e,t)=>{xf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>rg(e,n,r,o),e.keyType=t.keyType,e.valueType=t.valueType});function Mg(e,t,n){return new vi({type:"record",keyType:e,valueType:t,...I.normalizeParams(n)})}function nC(e,t,n){let r=ve(e);return r._zod.values=void 0,new vi({type:"record",keyType:r,valueType:t,...I.normalizeParams(n)})}function rC(e,t,n){return new vi({type:"record",keyType:e,valueType:t,mode:"loose",...I.normalizeParams(n)})}var $g=g("ZodMap",(e,t)=>{Cf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Jp(e,n,r,o),e.keyType=t.keyType,e.valueType=t.valueType,e.min=(...n)=>e.check(Rt(...n)),e.nonempty=(n)=>e.check(Rt(1,n)),e.max=(...n)=>e.check(sn(...n)),e.size=(...n)=>e.check(Mn(...n))});function oC(e,t,n){return new $g({type:"map",keyType:e,valueType:t,...I.normalizeParams(n)})}var Lg=g("ZodSet",(e,t)=>{Ef.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Xp(e,n,r,o),e.min=(...n)=>e.check(Rt(...n)),e.nonempty=(n)=>e.check(Rt(1,n)),e.max=(...n)=>e.check(sn(...n)),e.size=(...n)=>e.check(Mn(...n))});function iC(e,t){return new Lg({type:"set",valueType:e,...I.normalizeParams(t)})}var jr=g("ZodEnum",(e,t)=>{wf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(r,o,i)=>Zp(e,r,o,i),e.enum=t.entries,e.options=Object.values(t.entries);let n=new Set(Object.keys(t.entries));e.extract=(r,o)=>{let i={};for(let s of r)if(n.has(s))i[s]=t.entries[s];else throw Error(`Key ${s} not found in enum`);return new jr({...t,checks:[],...I.normalizeParams(o),entries:i})},e.exclude=(r,o)=>{let i={...t.entries};for(let s of r)if(n.has(s))delete i[s];else throw Error(`Key ${s} not found in enum`);return new jr({...t,checks:[],...I.normalizeParams(o),entries:i})}});function nl(e,t){let n=Array.isArray(e)?Object.fromEntries(e.map((r)=>[r,r])):e;return new jr({type:"enum",entries:n,...I.normalizeParams(t)})}function sC(e,t){return new jr({type:"enum",entries:e,...I.normalizeParams(t)})}var Wg=g("ZodLiteral",(e,t)=>{Rf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>jp(e,n,r,o),e.values=new Set(t.values),Object.defineProperty(e,"value",{get(){if(t.values.length>1)throw Error("This schema contains multiple valid literal values. Use `.values` instead.");return t.values[0]}})});function aC(e,t){return new Wg({type:"literal",values:Array.isArray(e)?e:[e],...I.normalizeParams(t)})}var Fg=g("ZodFile",(e,t)=>{Pf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Vp(e,n,r,o),e.min=(n,r)=>e.check(Rt(n,r)),e.max=(n,r)=>e.check(sn(n,r)),e.mime=(n,r)=>e.check(Or(Array.isArray(n)?n:[n],r))});function cC(e){return xp(Fg,e)}var Gg=g("ZodTransform",(e,t)=>{Af.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Yp(e,n,r,o),e._zod.parse=(n,r)=>{if(r.direction==="backward")throw new On(e.constructor.name);n.addIssue=(i)=>{if(typeof i==="string")n.issues.push(I.issue(i,n.value,t));else{let s=i;if(s.fatal)s.continue=!1;s.code??(s.code="custom"),s.input??(s.input=n.value),s.inst??(s.inst=e),n.issues.push(I.issue(s))}};let o=t.transform(n.value,n);if(o instanceof Promise)return o.then((i)=>(n.value=i,n));return n.value=o,n}});function rl(e){return new Gg({type:"transform",transform:e})}var ol=g("ZodOptional",(e,t)=>{ja.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Sc(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function di(e){return new ol({type:"optional",innerType:e})}var Zg=g("ZodExactOptional",(e,t)=>{kf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Sc(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function jg(e){return new Zg({type:"optional",innerType:e})}var Ug=g("ZodNullable",(e,t)=>{Tf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>og(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function mi(e){return new Ug({type:"nullable",innerType:e})}function lC(e){return di(mi(e))}var Bg=g("ZodDefault",(e,t)=>{If.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>sg(e,n,r,o),e.unwrap=()=>e._zod.def.innerType,e.removeDefault=e.unwrap});function Vg(e,t){return new Bg({type:"default",innerType:e,get defaultValue(){return typeof t==="function"?t():I.shallowClone(t)}})}var Hg=g("ZodPrefault",(e,t)=>{Of.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>ag(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function qg(e,t){return new Hg({type:"prefault",innerType:e,get defaultValue(){return typeof t==="function"?t():I.shallowClone(t)}})}var il=g("ZodNonOptional",(e,t)=>{zf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>ig(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function Kg(e,t){return new il({type:"nonoptional",innerType:e,...I.normalizeParams(t)})}var Yg=g("ZodSuccess",(e,t)=>{Nf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Hp(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function uC(e){return new Yg({type:"success",innerType:e})}var Jg=g("ZodCatch",(e,t)=>{Df.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>cg(e,n,r,o),e.unwrap=()=>e._zod.def.innerType,e.removeCatch=e.unwrap});function Xg(e,t){return new Jg({type:"catch",innerType:e,catchValue:typeof t==="function"?t:()=>t})}var Qg=g("ZodNaN",(e,t)=>{Mf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Up(e,n,r,o)});function dC(e){return _p(Qg,e)}var sl=g("ZodPipe",(e,t)=>{$f.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>lg(e,n,r,o),e.in=t.in,e.out=t.out});function fi(e,t){return new sl({type:"pipe",in:e,out:t})}var al=g("ZodCodec",(e,t)=>{sl.init(e,t),Qo.init(e,t)});function mC(e,t,n){return new al({type:"pipe",in:e,out:t,transform:n.decode,reverseTransform:n.encode})}var eh=g("ZodReadonly",(e,t)=>{Lf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>ug(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function th(e){return new eh({type:"readonly",innerType:e})}var nh=g("ZodTemplateLiteral",(e,t)=>{Wf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Bp(e,n,r,o)});function fC(e,t){return new nh({type:"template_literal",parts:e,...I.normalizeParams(t)})}var rh=g("ZodLazy",(e,t)=>{Zf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>mg(e,n,r,o),e.unwrap=()=>e._zod.def.getter()});function oh(e){return new rh({type:"lazy",getter:e})}var ih=g("ZodPromise",(e,t)=>{Gf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>dg(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function pC(e){return new ih({type:"promise",innerType:e})}var sh=g("ZodFunction",(e,t)=>{Ff.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Kp(e,n,r,o)});function gC(e){return new sh({type:"function",input:Array.isArray(e?.input)?Dg(e?.input):e?.input??hi(Wn()),output:e?.output??Wn()})}var _i=g("ZodCustom",(e,t)=>{jf.init(e,t),M.init(e,t),e._zod.processJSONSchema=(n,r,o)=>qp(e,n,r,o)});function hC(e){let t=new Q({check:"custom"});return t._zod.check=e,t}function yC(e,t){return Cp(_i,e??(()=>!0),t)}function ah(e,t={}){return Ep(_i,e,t)}function ch(e){return wp(e)}var bC=Rp,vC=Pp;function _C(e,t={}){let n=new _i({type:"custom",check:"custom",fn:(r)=>r instanceof e,abort:!0,...I.normalizeParams(t)});return n._zod.bag.Class=e,n._zod.check=(r)=>{if(!(r.value instanceof e))r.issues.push({code:"invalid_type",expected:e.name,input:r.value,inst:n,path:[...n._zod.def.path??[]]})},n}var SC=(...e)=>Ap({Codec:al,Boolean:Hr,String:Ur},...e);function xC(e){let t=oh(()=>tl([Nc(e),vg(),_g(),Eg(),hi(t),Mg(Nc(),t)]));return t}function CC(e,t){return fi(rl(e),t)}var EC={invalid_type:"invalid_type",too_big:"too_big",too_small:"too_small",invalid_format:"invalid_format",not_multiple_of:"not_multiple_of",unrecognized_keys:"unrecognized_keys",invalid_union:"invalid_union",invalid_key:"invalid_key",invalid_element:"invalid_element",invalid_value:"invalid_value",custom:"custom"};function wC(e){le({customError:e})}function RC(){return le().customError}var cl;(function(e){})(cl||(cl={}));var $0=()=>{let e={string:{unit:"characters",verb:"to have"},file:{unit:"bytes",verb:"to have"},array:{unit:"items",verb:"to have"},set:{unit:"items",verb:"to have"},map:{unit:"entries",verb:"to have"}};function t(o){return e[o]??null}let n={regex:"input",email:"email address",url:"URL",emoji:"emoji",uuid:"UUID",uuidv4:"UUIDv4",uuidv6:"UUIDv6",nanoid:"nanoid",guid:"GUID",cuid:"cuid",cuid2:"cuid2",ulid:"ULID",xid:"XID",ksuid:"KSUID",datetime:"ISO datetime",date:"ISO date",time:"ISO time",duration:"ISO duration",ipv4:"IPv4 address",ipv6:"IPv6 address",mac:"MAC address",cidrv4:"IPv4 range",cidrv6:"IPv6 range",base64:"base64-encoded string",base64url:"base64url-encoded string",json_string:"JSON string",e164:"E.164 number",jwt:"JWT",template_literal:"input"},r={nan:"NaN"};return(o)=>{switch(o.code){case"invalid_type":{let i=r[o.expected]??o.expected,s=$d(o.input),a=r[s]??s;return`Invalid input: expected ${i}, received ${a}`}case"invalid_value":if(o.values.length===1)return`Invalid input: expected ${ba(o.values[0])}`;return`Invalid option: expected one of ${ga(o.values,"|")}`;case"too_big":{let i=o.inclusive?"<=":"<",s=t(o.origin);if(s)return`Too big: expected ${o.origin??"value"} to have ${i}${o.maximum.toString()} ${s.unit??"elements"}`;return`Too big: expected ${o.origin??"value"} to be ${i}${o.maximum.toString()}`}case"too_small":{let i=o.inclusive?">=":">",s=t(o.origin);if(s)return`Too small: expected ${o.origin} to have ${i}${o.minimum.toString()} ${s.unit}`;return`Too small: expected ${o.origin} to be ${i}${o.minimum.toString()}`}case"invalid_format":{let i=o;if(i.format==="starts_with")return`Invalid string: must start with "${i.prefix}"`;if(i.format==="ends_with")return`Invalid string: must end with "${i.suffix}"`;if(i.format==="includes")return`Invalid string: must include "${i.includes}"`;if(i.format==="regex")return`Invalid string: must match pattern ${i.pattern}`;return`Invalid ${n[i.format]??o.format}`}case"not_multiple_of":return`Invalid number: must be a multiple of ${o.divisor}`;case"unrecognized_keys":return`Unrecognized key${o.keys.length>1?"s":""}: ${ga(o.keys,", ")}`;case"invalid_key":return`Invalid key in ${o.origin}`;case"invalid_union":return"Invalid input";case"invalid_element":return`Invalid value in ${o.origin}`;default:return"Invalid input"}}};function lh(){return{localeError:$0()}}var uh=()=>{throw Error("JSON Schema conversion is not bundled into this plugin artifact")};var ll={};ln(ll,{bigint:()=>G0,boolean:()=>F0,date:()=>Z0,number:()=>W0,string:()=>L0});function L0(e){return Vf(Ur,e)}function W0(e){return Qf(Vr,e)}function F0(e){return sp(Hr,e)}function G0(e){return cp(qr,e)}function Z0(e){return vp(gi,e)}le(lh());var j0=ul;var PC=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Si=64,AC="Rule config exceeds CC Safety Net's safe source limit.";var gB=Object.freeze({maxSources:64,concurrency:4,maxRequests:131,maxResponseBytes:67108864});var mh=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],dl={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},U0=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],B0=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],fh=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...B0.flatMap((e)=>U0.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var ml=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],kC=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],V0=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ph=kC.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),gh=kC.flatMap((e)=>V0.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),xi={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},hh=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),yh=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],TC=[...mh,dl,...fh,...ph,...gh,xi,...hh,...yh,...ml].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),fl=new Set(ml.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),H0=TC.map((e)=>e.id),Ci=new Set(H0);var kB=q0(import.meta.url),IC,K0=Array(Si+1).fill("over-limit"),OC=/^[^/]+\/[^/]+$/,pl=`must be an integer between ${Cl} and ${El}`,Y0=["version","rules","overrides","transparent_wrappers"],J0=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function zC(e){if(!dt(e)||!Array.isArray(e.rules)||e.rules.length<=Si)return e;return{$schema:e.$schema,version:e.version,rules:K0,overrides:e.overrides,transparent_wrappers:e.transparent_wrappers}}function X0(){let e=dh,t=(R)=>{let T=e.superRefine(R);return T._zod.def.when=()=>!0,T},n=e.enum(PC),r=e.union([e.literal("off"),e.looseObject({reason:e.string({error:"required non-empty string"}).min(1,"required non-empty string").max(Qn,`must be at most ${Qn} characters`).describe("Replacement block reason"),intent:n.optional()})],{error:'must be "off" or an object'}).describe("Disable a rule or replace its block reason and intent."),o=e.string({error:"must be a rulebook source string"}).min(1,"must be a non-empty rulebook source string"),i=e.string({error:"must be a command string"}).regex(hn,"must match command pattern").describe("Command name such as 'git', 'docker', or 'rtk'."),s=e.looseObject({$schema:e.unknown().optional().describe("JSON Schema reference for IDE support"),version:e.literal(1).describe("Schema version (must be 1)"),rules:e.array(o,{error:"must be an array of rulebook source strings"}).max(Si,AC).default([]).describe("Rulebook source strings such as project-rules or owner/repo#main/team-rules"),overrides:e.record(e.string().meta({pattern:OC.source}),r).default({}).describe("Rule overrides by id"),transparent_wrappers:e.array(i,{error:"must be an array of command strings"}).default([]).describe("Commands that transparently execute a visible protected child command")}),a=(R,T)=>{if(!dt(R))return;if(Array.isArray(R.rules)&&R.rules.length<=Si){let S=new Set;R.rules.forEach((w,O)=>{if(typeof w!=="string"||w==="")return;if(w.trim()===""){T.addIssue({code:"custom",message:"must be a non-empty rulebook source string",path:["rules",O]});return}let Z=qh(w);if(Z){T.addIssue({code:"custom",message:Z,path:["rules",O]});return}if(S.has(w)){T.addIssue({code:"custom",message:`duplicate rulebook source "${w}"`,path:["rules",O]});return}S.add(w)})}if(dt(R.overrides))for(let S of Object.keys(R.overrides)){if(OC.test(S))continue;T.addIssue({code:"custom",message:"must use <rulebook-name>/<rule-name>",path:["overrides",S]})}if(!Array.isArray(R.transparent_wrappers))return;let V=new Set;R.transparent_wrappers.forEach((S,w)=>{if(typeof S!=="string"||!hn.test(S))return;if(V.has(S)){T.addIssue({code:"custom",message:`duplicate command "${S}"`,path:["transparent_wrappers",w]});return}if(Lv(S)){T.addIssue({code:"custom",message:`reserved command "${S}" cannot be a wrapper`,path:["transparent_wrappers",w]});return}V.add(S)})},c=e.preprocess(zC,s.check(e.superRefine(a))),l=e.preprocess(zC,s.check(t(a))),u=e.strictObject({fail_closed:e.boolean().optional(),paranoid_rm:e.boolean().optional(),paranoid_interpreters:e.boolean().optional()}),d=(R,T)=>e.intersection(e.record(e.string().refine((V)=>R.has(V),{error:(V)=>`unknown ${T} rule id "${String(V.input)}"`}),e.unknown()),e.record(e.string(),e.enum(["on","off"]))),m=(R)=>e.array(e.string({error:"must be a non-empty path string"}),{error:"must be an array of paths"}).check(t((T,V)=>{if(!Array.isArray(T))return;let S=un();T.forEach((w,O)=>{if(typeof w!=="string")return;let Z=R(w,S);if(Z)V.addIssue({code:"custom",message:Z,path:[O]})})})),f=e.strictObject({version:e.literal(1),safety:e.strictObject({level:e.enum(["standard","strict","paranoid"]).optional(),overrides:u.optional()}).optional(),workflow:e.strictObject({worktree_mode:e.boolean().optional()}).optional(),destructive_command_protection:e.strictObject({enabled:e.boolean().optional(),overrides:d(ao,"destructive command").optional(),allow_paths:m(Ms).optional()}).optional(),secret_protection:e.strictObject({enabled:e.boolean().optional(),overrides:d(Ci,"secret protection").optional(),deny_paths:m($s).optional(),allow_paths:m(Ls).optional()}).optional(),audit:e.strictObject({retention_days:e.number({error:pl}).int(pl).min(Cl,pl).max(El,pl).optional().describe("Days of audit log history to keep before the sweep deletes it")}).optional()}),p=(R,T)=>{if(!Array.isArray(R))return;let V=new Set;R.forEach((S,w)=>{let O=dt(S)?S.name:void 0;if(typeof O!=="string")return;if(V.has(O.toLowerCase())){T.addIssue({code:"custom",message:`duplicate rule name "${O}"`,path:[w,"name"]});return}V.add(O.toLowerCase())})},h=(R)=>{let T=(w,O)=>R==="legacy"?w:O,V=T("must match pattern (letters, numbers, hyphens, underscores)","must match command pattern"),S=`required non-empty string up to ${Qn} characters`;return e.looseObject({name:e.string({error:"required string"}).regex(mn,T("must match pattern (letters, numbers, hyphens, underscores; max 64 chars)","must match rule name pattern")),command:e.string({error:T("required string","required string matching command pattern")}).regex(hn,T(V,"required string matching command pattern")),subcommand:e.string({error:T("must be a string if provided","must match command pattern")}).regex(hn,V).optional(),block_args:e.array(e.string({error:T("must be a string","must be a non-empty string")}).refine((w)=>w!=="",{error:T("must not be empty","must be a non-empty string")}),{error:T("required array","required non-empty array")}).refine((w)=>w.length>0,{error:T("must have at least one element","required non-empty array")}),reason:e.string({error:T("required string",S)}).refine((w)=>w!=="",{error:T("must not be empty",S)}).refine((w)=>w.length<=Qn,{error:T(`must be at most ${Qn} characters`,S)}),intent:n.optional()},{error:"must be an object"})},y=(R)=>e.array(h(R),{error:R==="legacy"?"must be an array":"required array"}).check(t(p)),b=e.looseObject({version:e.literal(1),rules:y("legacy").optional()}),E="required string matching rule name pattern",A=e.looseObject({command:e.string({error:"required non-empty string"}).refine((R)=>R.trim()!=="",{error:"required non-empty string"}),expect:e.enum(["blocked","allowed"]),rule:e.string({error:"must be a string if provided"}).optional()},{error:"must be an object"}).check(t((R,T)=>{if(!dt(R))return;if(R.expect!=="blocked"||typeof R.rule==="string")return;T.addIssue({code:"custom",message:"required string for blocked fixtures",path:["rule"]})})),C=(R,T)=>{if(!dt(R))return;let V=new Set(bh(R));if(Array.isArray(R.tests)){let w=new Set(R.tests.flatMap((O)=>dt(O)&&O.expect==="blocked"&&typeof O.rule==="string"?[O.rule]:[]));for(let O of w){if(V.has(O))continue;T.addIssue({code:"custom",message:`blocked fixture references unknown rule "${O}"`,path:["tests"]})}}if(!Array.isArray(R.allowed_commands)||!Array.isArray(R.rules))return;let S=new Set(R.allowed_commands.filter((w)=>typeof w==="string"));R.rules.forEach((w,O)=>{let Z=dt(w)?w.command:void 0;if(typeof Z!=="string"||S.has(Z))return;T.addIssue({code:"custom",message:`"${Z}" must be listed in allowed_commands`,path:["rules",O,"command"]})})},P=(R)=>e.looseObject({name:e.string({error:"required string matching rule name pattern"}).regex(mn,"required string matching rule name pattern"),version:e.string({error:"required non-empty string"}).refine((T)=>T!=="",{error:"required non-empty string"}),allowed_commands:e.array(e.string({error:"must match command pattern"}).regex(hn,"must match command pattern"),{error:"required array"}).check(t((T,V)=>{if(!Array.isArray(T))return;let S=new Set;T.forEach((w,O)=>{if(typeof w!=="string"||!hn.test(w))return;if(S.has(w)){V.addIssue({code:"custom",message:`duplicate command "${w}"`,path:[O]});return}S.add(w)})})),rules:R,tests:e.array(A,{error:"must be an array if provided"}).optional()}).check(t(C)),L=P(y("rulebook")),k=e.string({error:"must be a non-empty string"}).refine((R)=>R!=="",{error:"must be a non-empty string"}),U="must be a non-empty array of unique non-empty strings",ie="required non-empty array of non-empty strings",se=e.array(k,{error:"must be a non-empty array of unique non-empty strings"}).refine((R)=>R.length>0,{error:"must be a non-empty array of unique non-empty strings"}).refine((R)=>new Set(R).size===R.length,{error:"must not contain duplicate values"}),J=e.looseObject({command_path:e.array(k,{error:"required non-empty array of non-empty strings"}).refine((R)=>R.length>0,{error:"required non-empty array of non-empty strings"}),any_args:se.optional(),exclude_args:se.optional()},{error:"required object"}),B=P(e.array(h("rulebook").omit({subcommand:!0,block_args:!0}).extend({match:J,subcommand:e.never({error:"not supported in rulebook_version 2"}).optional(),block_args:e.never({error:"not supported in rulebook_version 2"}).optional()}),{error:"required array"}).check(t(p)));return{RulesConfigSchema:c,RulesConfigDiagnosticSchema:l,RuleOverrideSchema:r,UserPolicySchema:f,LegacyConfigSchema:b,RulebookSchema:L,RulebookV2Schema:B}}function Ei(){return IC??=X0(),IC}function NC(){return Ei().RulesConfigSchema}function Q0(){return Ei().UserPolicySchema}function DC(){return Ei().RulebookSchema}function MC(){return Ei().RulebookV2Schema}function bh(e){let t=dt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=dt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function $C(e){let t=Ei().RulesConfigDiagnosticSchema.safeParse(e);if(t.success)return{errors:[],sources:new Set(t.data.rules)};return{errors:gl(FC(t.error.issues,Y0)),sources:rM(e,t.error.issues)}}function LC(e){let t=Q0().safeParse(e);if(t.success)return[];return gl(FC(t.error.issues,J0)," ")}function gl(e,t=": ",n=" "){return[...new Set(e.flatMap((r)=>WC(r,t,n,[])))]}function WC(e,t,n,r){let o=[...r,...e.path],i=nM(o);if(e.code==="unrecognized_keys")return e.keys.map((s)=>`${i?`${i}.`:""}unknown field "${s}"`);if(e.code==="invalid_key")return e.issues.map((s)=>s.message);if(e.code==="invalid_union"){let s=e.errors.flat().filter((a)=>a.path.length>0);if(s.length>0)return s.flatMap((a)=>WC(a,t,n,o))}if(o.length===0)return[e.code==="invalid_type"?"Config must be an object":e.message];if(o.length===1&&(e.code==="too_big"||e.code==="too_small")&&e.origin==="array")return[e.message];return[`${i}${o.length===1?n:t}${eM(e)}`]}function eM(e){if(e.code==="invalid_value")return`must be ${tM(e.values)}`;if(e.code!=="invalid_type"||!e.message.startsWith("Invalid input:"))return e.message;if(e.expected==="object"||e.expected==="record")return"must be an object if provided";return e.expected==="boolean"?"must be a boolean":e.message}function tM(e){if(e.length>3)return`one of ${e.join(", ")}`;let t=e.map((n)=>typeof n==="string"?`"${n}"`:String(n));if(t.length<2)return`${t[0]}`;return`${t.slice(0,-1).join(", ")}${t.length>2?",":""} or ${t.at(-1)}`}function nM(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function FC(e,t){let n=e.map((i)=>i.path[1]),r=[...new Set(n.filter((i)=>typeof i==="string"))],o=(i,s)=>[i.path.length===0?-1:t.indexOf(String(i.path[0])),typeof s==="number"?s:r.indexOf(String(s)),i.code==="custom"?0:1];return e.map((i,s)=>({issue:i,rank:o(i,n[s])})).sort((i,s)=>i.rank[0]-s.rank[0]||i.rank[1]-s.rank[1]||i.rank[2]-s.rank[2]).map((i)=>i.issue)}function rM(e,t){let n=dt(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function dt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}var GC={standard:0,strict:1,paranoid:2};function UC(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:vh(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:vh(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:vh(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:oM(e,t)}}function vh(e,t){return[...new Set([...e,...t??[]])]}function oM(e,t){let n=t.safety?.level,r=la[e.safety.level];return[...n&&GC[n]<GC[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Wo.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...ZC(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...ZC(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!fl.has(o))),...e.destructive_command_protection.enabled?jC(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?jC(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function ZC(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function jC(e,t){return(t??[]).filter((n)=>!e.includes(n))}function iM(e){return $C(e)}function _h(e){try{let t=Mi(sM(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=iM(n);if(r.errors.length>0)return{config:null,errors:r.errors};let o=NC().parse(n);return{config:{version:1,rules:o.rules??[],overrides:o.overrides??{},transparent_wrappers:o.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof pe)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function sM(e){return typeof e==="string"?Gh(e):e}var xh=new Set(["standard","strict","paranoid"]),KC={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Oi}};function Ch(e){return uM(lM(Vn(e)),pn)}function YC(e={}){let t=pM(Ch(e)),n=Xr(e.cwd),r=tE(n),o=mM(r.parsed),i=Object.keys(o.policy).length>0?UC(t.gui??KC,o.policy):void 0,s=[...t.errors,...r.errors,...o.diagnostics],a=(t.fallback==="defaults"&&i?"salvaged":t.fallback)??(t.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),c=o.policy.safety?.level?"project":t.levelPresent?"user":"default";return{...i?Sh(i.policy):t.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:c,weakenings:i?.weakenings??[]}}:{}}}var dM="project policy audit settings are ignored; audit is user scope only";function mM(e){if(!ge(e))return{policy:{},diagnostics:[]};let t=ge(e.safety)?e.safety:{},n=ge(e.workflow)?e.workflow:{},r=ge(e.destructive_command_protection)?e.destructive_command_protection:{},o=ge(e.secret_protection)?e.secret_protection:{},i={...xh.has(t.level)?{level:t.level}:{},...ge(t.overrides)?BC({overrides:JC(t.overrides,Wo)}):{}},s={...typeof r.enabled==="boolean"?{enabled:r.enabled}:{},...r.overrides!==void 0?{overrides:hl(r.overrides,ao)}:{},...r.allow_paths!==void 0?{allow_paths:QC(r.allow_paths)}:{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:hl(o.overrides,Ci)}:{},...o.deny_paths!==void 0?{deny_paths:XC(o.deny_paths)}:{},...o.allow_paths!==void 0?{allow_paths:eE(o.allow_paths)}:{}};return{policy:BC({safety:i,workflow:typeof n.worktree_mode==="boolean"?{worktree_mode:n.worktree_mode}:{},destructive_command_protection:s,secret_protection:a}),diagnostics:e.audit===void 0?[]:[dM]}}function JC(e,t){return Object.fromEntries(t.flatMap((n)=>typeof e[n]==="boolean"?[[n,e[n]]]:[]))}function BC(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}function VC(e){if(!ge(e))return fM();let t=ge(e.safety)?e.safety:{},n=ge(t.overrides)?t.overrides:{},r=ge(e.workflow)?e.workflow:{},o=ge(e.destructive_command_protection)?e.destructive_command_protection:{},i=ge(e.secret_protection)?e.secret_protection:{};return{version:1,safety:{level:xh.has(t.level)?t.level:"standard",overrides:JC(n,Wo)},workflow:{worktree_mode:typeof r.worktree_mode==="boolean"?r.worktree_mode:!1},destructive_command_protection:{enabled:typeof o.enabled==="boolean"?o.enabled:!0,overrides:hl(o.overrides,ao),allow_paths:QC(o.allow_paths)},secret_protection:{enabled:typeof i.enabled==="boolean"?i.enabled:!0,overrides:hl(i.overrides,Ci),deny_paths:XC(i.deny_paths),allow_paths:eE(i.allow_paths)},audit:{retention_days:zi(ge(e.audit)?e.audit.retention_days:void 0)}}}function hl(e,t){if(!ge(e))return{};return Object.fromEntries(Object.entries(e).flatMap(([n,r])=>t.has(n)&&(r==="on"||r==="off")?[[n,r]]:[]))}function XC(e){if(!Array.isArray(e))return[];let t=un();return e.filter((n)=>$s(n,t)===null)}function QC(e){if(!Array.isArray(e))return[];let t=un();return e.filter((n)=>Ms(n,t)===null)}function eE(e){if(!Array.isArray(e))return[];let t=un();return e.filter((n)=>Ls(n,t)===null)}function ge(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function fM(){return structuredClone(KC)}function tE(e){if(!aM(e))return{exists:!1,errors:[]};try{let t=cM(e,"utf-8");if(!t.trim())return{exists:!0,errors:[`${e}: Config file is empty`],fallback:"defaults"};let n=JSON.parse(t),r=LC(n);if(r.length===0)return{exists:!0,parsed:n,errors:[]};return{exists:!0,parsed:n,errors:r.map((o)=>`${e}: ${o}`),fallback:ge(n)?"salvaged":"defaults"}}catch(t){let n=t instanceof Error?t.message:String(t);return{exists:!0,errors:[`${e}: ${t instanceof SyntaxError?"Invalid JSON":n}`],fallback:"defaults"}}}function pM(e){let t=tE(e);if(!t.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ge(r))return{policy:qC(),errors:[]};let o=VC(r);return{policy:Sh(o),gui:o,errors:[],levelPresent:HC(r)}}if(t.parsed===void 0)return{policy:qC(),errors:t.errors,...t.fallback?{fallback:t.fallback}:{}};let n=VC(t.parsed);return{policy:Sh(n),gui:n,errors:t.errors,...t.fallback?{fallback:t.fallback}:{},levelPresent:HC(t.parsed)}}function HC(e){let t=ge(e)&&ge(e.safety)?e.safety:{};return xh.has(t.level)}function nE(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...fl].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function qC(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:nE({}),denyPaths:[],allowPaths:[]}}}function Sh(e){return{safety:gM(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:nE(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function gM(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}var sE="This path contains the protected policy config and you must not modify or delete it.",hM=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function aE(e){let t=Ot(Qe()),n=xM(e.invocation.context,t);if(e.invocation.route.kind==="patch")return rE(e.paths,!1,e.invocation.context.executionCwd,n,t);let r=xe(e,"input-candidate");if(e.invocation.route.kind==="command")return r?oE(r.shell,e.invocation.context.executionCwd,n,t):null;if(e.invocation.route.kind==="unknown"&&r){let o=oE(r.shell,e.invocation.context.executionCwd,n,t);if(o)return o}return rE(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Is(e.invocation.toolName),e.invocation.context.executionCwd,n,t)}function rE(e,t,n,r,o){if(t)return null;let i=e.find((s)=>wi(s,n,r,o));return i?{target:i}:null}function oE(e,t,n,r){let o=sr(e,t,r,{findSegmentTarget:(i,s)=>yM(i,s,n,r)?.target??null,isRedirectionTarget:(i,s)=>wi(i,s.cwd,n,r),findMalformedTarget:(i)=>SM(i,t,n,r)?.target??null,normalizeCwd:ye});return o?{target:o}:null}function yM(e,t,n,r){if(So(e))return null;let o=r.environment,i=Vt([...e],o),s=F(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&bM(a)){let c=vM(a).find((l)=>iE(Le(l,t.variables),t.cwd,n,r));if(c)return{target:c}}if(s==="find"){if(Vs(i,1)||$u(i,o)){let l=(Bs(j(i))??j(["."])).find((u)=>{let d=Le(u.text,t.variables);return wi(d,t.cwd,n,r)||iE(d,t.cwd,n,r)})?.text;if(l)return{target:l}}}if(s==="mv"){let c=Os(a).sources.find((l)=>CM(Le(l,t.variables),t.cwd,n,r));if(c)return{target:c}}if(_M(e,o))return null;for(let c of[...e,...i])for(let l of cE(c))if(wi(Le(l,t.variables),t.cwd,n,r))return{target:l};return null}function bM(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function vM(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function _M(e,t){let n=Vt([...e],t);if(n.length===0)return!1;let r=F(n[0]??"").toLowerCase();if(!hM.has(r))return!1;if(r!=="sed")return!0;return!n.slice(1).some((o)=>o.startsWith("-i")||o==="--in-place"||o.startsWith("--in-place="))}function SM(e,t,n,r){for(let o of e.split(/\s+/))for(let i of cE(o))if(wi(i,t,n,r))return{target:i};return null}function cE(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function xM(e,t){let n=(s)=>Ri(ye(s,e.executionCwd,t)),r=n(Ch()),o=[n(Xr(e.executionCwd)),n(Xr(e.configCwd))],i=new Set(o.map((s)=>yl(s)));for(let s=yl(r);;s=yl(s))if(i.add(s),yl(s)===s)break;return{files:new Set([r,...o]),directoriesAndAncestors:i}}function wi(e,t,n,r){let o=mv(e,t,r,(i)=>Ri(i)===pn);return o!==null&&n.files.has(Ri(o))}function iE(e,t,n,r){return n.directoriesAndAncestors.has(Ri(ye(e,t,r)))}function CM(e,t,n,r){let o=Ri(ye(e,t,r));return n.files.has(o)||n.directoriesAndAncestors.has(o)}function Ri(e){return process.platform==="win32"?e.toLowerCase():e}import{homedir as Ph}from"os";import{isAbsolute as bl,posix as EM,resolve as _l,win32 as wM}from"path";import{fileURLToPath as RM}from"url";var _E="Access to a sensitive path is not allowed.",SE=new Set(["echo","printf"]),PM=new Set(["find"]),AM=new Set(["-exec","-execdir"]),kM=new Set([";","+"]),TM=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),IM=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),xE=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),OM=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),zM=new Set(["node","bun"]),NM=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),DM=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","popen","read","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),CE=new Set(["-c","-e","-r","-E","--eval","--exec"]),MM=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),$M=new Set(["grep","rg"]),lE="f",uE="file",LM="files",WM=new Set(["e","f"]),FM=new Set(["regexp","file"]),GM=new Set(["e","f","A","B","C","m"]),ZM=new Set(["regexp","file","after-context","before-context","context","max-count"]),jM=new Set(["|","|&"]),Eh="__CC_SAFETY_NET_PIPE_INPUT__",EE=new Set(["bash","sh","zsh","dash","ksh"]),UM=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function dE(e,t,n,r,o){let i=Qr();for(let s of e){if(z$(s,t,n?.denyPaths??[],r,i))return{target:s,ruleId:"secret.deny-path"};if(o&&!o.has(s))continue;let a=I$(s,t,n,i);if(a){if(!a.startsWith("secret.cli.")&&N$(s,t,n?.allowPaths??[],r,i))continue;return{target:s,ruleId:a}}}return null}function wE(e,t,n={}){let r=mE(e),o=dE(r,e.invocation.context.executionCwd,t,e.invocation.context.configCwd),i=o?.ruleId!=="secret.deny-path"&&n.strict===!1?mE(e,{refineJavaScriptInlineData:!0}):r,s=i.length===r.length?o:dE(r,e.invocation.context.executionCwd,t,e.invocation.context.configCwd,new Set(i));if(s?.ruleId!=="secret.deny-path"&&n.strict===!1&&BM(e))return null;return s}function BM(e){let t=xe(e,"input-candidate")??xe(e,"declared-command");if(!t)return!1;if(t.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let n=[];for(let s of t.shell.entries){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind!=="operator")n.push(yt(s.text))}let r=Kr(n);if(r.length===0)return!1;let o=Zn(r[0]??"").toLowerCase(),i=r.slice(1);if(e.invocation.route.kind==="unknown")return t.program.dialect==="powershell"&&(o==="ls"||o==="stat");if(o==="ls"||o==="stat")return!0;if(o==="test")return i.length===2&&(i[0]==="-e"||i[0]==="-f");if(o!=="find")return!1;return!i.some((s)=>TM.has(s))}function mE(e,t={}){if(e.invocation.route.kind==="command"){let r=xe(e,"input-candidate");return r?ki(r.shell,e.store,t,fE(r)):[]}if(e.invocation.route.kind!=="unknown")return[...e.paths];let n=xe(e,"input-candidate");return[...n?ki(n.shell,e.store,t,fE(n)):[],...e.paths]}function fE(e){return e.program.dialect==="powershell"}function ki(e,t,n,r=!1){if(e.status==="structural-limit")throw new ht;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let o=[...e.assignmentFallbacks,...f$(yt(e.source),t,n)],i=[],s=null;for(let a of e.entries){if(a.kind==="operator"){if(!a.boundary)continue;if(i.length>0){if(o.push(...vl(i,t,n)),s!==null)o.push(...pE(s,i,t,n));s=jM.has(a.operator)?i:null,i=[]}else s=null;continue}if(a.kind==="redirection"){let c=a.target?yt(hE(a.target,r)):void 0;if(c&&a.targetOrder==="legacy-segment")i.push(c);else if(c)o.push(c);continue}i.push(yt(hE(a.text,r)))}if(i.length>0){if(o.push(...vl(i,t,n)),s!==null)o.push(...pE(s,i,t,n))}return o}function vl(e,t,n){let r=e$(e),o=Kr(e);if(o.length===0)return r;let i=o[0]??"",s=Zn(i).toLowerCase(),a=o.slice(1),c=VM(i,s,a);if(c)return[...r,...c];if(SE.has(s))return r;if($M.has(s))return[...r,...S$(a)];if(PM.has(s))return[...r,...o$(a,t,n)];if(We.has(s))return[...r,...a.flatMap((l)=>wh("awk",l)),...a.flatMap((l)=>s$(l,t,n)),...a.flatMap(a$)];if(s==="curl")return[...r,...a.flatMap((l)=>wh(s,l)),...t$(a)];if(AE(s)){if(EE.has(s)){let l=lv(s,a);if(l!==null&&t.getShellSyntax(l).status==="structural-limit")throw new ht}return[...r,...i$(s,a,n)]}return[...r,...a.flatMap((l)=>wh(s,l))]}function VM(e,t,n){let r=ma(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let c=i[s+1];if(c&&!c.startsWith("--"))o.push(c);s++;continue}return o}return o}function pE(e,t,n,r){if(JM(t,n,r))return HM(e);let o=XM(t);if(o===null)return[];return qM(e).flatMap((i)=>EE.has(o)?ki(n.getShellSyntax(i),n,r):TE(i))}function HM(e){let t=Kr(e);if(t.length===0)return[];let n=Zn(t[0]??"").toLowerCase();if(!SE.has(n))return[];return t.slice(1)}function qM(e){let t=Kr(e);if(t.length===0)return[];let n=Zn(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return KM(r);return[]}function KM(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[RE(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>YM(t,r.slice(i*n,(i+1)*n)))}function YM(e,t){let n=0;return RE(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function RE(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function JM(e,t,n){let r=Kr(e);if(r.length===0||Zn(r[0]??"").toLowerCase()!=="xargs")return!1;let o=Rn(r),i=r.slice(o.childStart);if(i.length===0)return!1;if(o.replacementToken==="")return!1;let s=o.replacementToken,a=s===null?[...i,Eh]:i.map((c)=>c.split(s).join(Eh));return vl(a,t,n).some((c)=>c.includes(Eh))}function XM(e){let t=Kr(e);if(t.length===0)return null;let n=Zn(t[0]??"").toLowerCase();if(!AE(n))return null;return QM(n,t.slice(1))?n:null}function QM(e,t){let n=PE(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(CE.has(o)||kE(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(UM.get(n)?.has(o))r++;continue}return!1}return!0}function PE(e){return/^python\d/.test(e)?"python":e}function e$(e){let t=[];for(let n of e){if(zE(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var gE=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function hE(e,t){if(!t||!gE.test(e))return e;return`~${e.replace(gE,"").replace(/\\/g,"/")}`}function wh(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function t$(e){return e.flatMap((t,n)=>{let r=r$(t);if(r!==null)return yE(r.flag,r.value);let o=n$(e[n-1]);return o===null?[]:yE(o,t)})}function yE(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Rh(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Rh(t.slice(n+1))}return t.startsWith("@")?Rh(t.slice(1)):[]}function n$(e){if(e===void 0)return null;if(xE.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function r$(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return xE.has(r)?{flag:r,value:e.slice(n+1)}:null}function Rh(e){return e===""||e==="-"?[]:[e]}function o$(e,t,n){let r=e.findIndex((i)=>i.startsWith("-")||i==="("||i==="!"||i===";"),o=[...e.slice(0,r===-1?e.length:r)];for(let i=0;i<e.length;i++){if(!AM.has(e[i]??""))continue;let s=e.slice(i+1),a=s.findIndex((u)=>kM.has(u)),c=a===-1?s:s.slice(0,a),l=vl(c,t,n);if(o.push(...l.filter((u)=>u!=="{}")),!l.includes("{}"))continue;o.push(...e.slice(0,i).flatMap((u,d,m)=>{if(!IM.has(u))return[];let f=m[d+1];return f===void 0?[]:[f,f.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return o}function AE(e){return OM.has(e)||/^python\d/.test(e)}function i$(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o];if(i===void 0)break;if(CE.has(i)||kE(e,i)){let a=t[o+1];if(a!==void 0)r.push(...bE(e,a,n)),o++;continue}let s=/^--(?:eval|exec)=(.*)$/.exec(i);if(s!==null&&s[1]!==void 0){r.push(...bE(e,s[1],n));continue}if(!i.startsWith("-"))r.push(i)}return r}function kE(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return MM.get(t[t.length-1]??"")?.has(PE(e))??!1}function s$(e,t,n){if(!e.includes("system"))return[];return zu(e)?.commands.flatMap((r)=>ki(t.getShellSyntax(r),t,n))??[]}function a$(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function TE(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((r)=>r[2]).filter((r)=>r!==void 0&&r!==""),n=(e.match(/[\w./~@+-]*[./~][\w./~@+-]*/g)??[]).filter((r)=>r!=="process.versions.sqlite"||t.some((o)=>o.includes(r)));return[...t,...t.flatMap(IE),...n]}function bE(e,t,n){let r=TE(t);if(!n.refineJavaScriptInlineData||!zM.has(e)||r.length===0)return r;let o=c$(t);return o!==null&&!u$(o)?[]:r}function c$(e){let t=e.split("");for(let n=0;n<e.length;n++){let r=e[n];if(r!=="'"&&r!=='"'&&r!=="`")continue;if(r==="`"&&l$(e,n))return null;t[n]=" ";let o=!1;for(let i=n+1;i<e.length;i++){let s=e[i];if(t[i]=" ",s==="\\"){if(i++,i<e.length)t[i]=" ";continue}if(r==="`"&&s==="$"&&e[i+1]==="{")return null;if(r!=="`"&&(s===`
-`||s==="\r"))return null;if(s!==r)continue;n=i,o=!0;break}if(!o)return null}return t.join("")}function l$(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function u$(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(NM.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>DM.has(i)))continue;if(o.length>1)return!0;if(d$(e,r)===".")return!0;if(m$(e,r+n.length)==="(")return!0}return!1}function d$(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function m$(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function f$(e,t,n){return b$(e).flatMap((r)=>{let o=t.getShellSyntax(r);if(o.status==="invalid")return[];return[...ki(o,t,n),...p$(o)?g$(o):[]]})}function p$(e){let t=e.entries;for(let n=0;n<t.length;n++){let r=t[n];if(r?.kind!=="word"||Zn(yt(r.text)).toLowerCase()!=="base64")continue;for(let o=n+1;o<t.length;o++){let i=t[o];if(i?.kind==="operator")break;if(i?.kind!=="word")continue;let s=yt(i.text);if(s==="--decode"||!s.startsWith("--")&&s.startsWith("-")&&/[dD]/.test(s))return!0}}return!1}function g$(e){return e.entries.flatMap((t)=>t.kind==="word"?[yt(t.text)]:t.kind==="redirection"&&t.target?[yt(t.target)]:[]).flatMap(IE)}function IE(e){let t=y$(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||h$(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function h$(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function y$(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function b$(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(go(o,n))continue;if(OE(e,r,n)){let i=v$(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=_$(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function v$(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(go(i,n))continue;if(OE(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function _$(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function OE(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function S$(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let c=0;c<e.length;c++){let l=e[c];if(l===void 0)break;if(!i&&l==="--"){i=!0;continue}if(i){n.push(l);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(l);if(u!==null){let d=u[1]??"",m=u[2];if(d===LM)o=!0;if(FM.has(d))r=!0;if(m!==void 0){if(d===uE)t.push(m);continue}if(ZM.has(d)){let f=e[c+1];if(d===uE&&f!==void 0)t.push(f);c++}continue}if(l.startsWith("-")&&l.length>1){let d=l.slice(1),m="",f="";for(let p=0;p<d.length;p++){let h=d[p]??"";if(WM.has(h))r=!0;if(GM.has(h)){m=h,f=d.slice(p+1);break}}if(m!=="")if(f.length>0){if(m===lE)t.push(f)}else{let p=e[c+1];if(m===lE&&p!==void 0)t.push(p);c++}continue}n.push(l)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Kr(e){let t=e.findIndex((n)=>!zE(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function zE(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var x$=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),C$=".env.",E$=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),w$=[".env.example.",".env.sample."];function R$(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function P$(e){return e.length>0&&!/\s/.test(e)}function A$(e,t,n){try{let r=Ti(e,t,n);return r!==""&&Be.entryKind(r)!=="missing"}catch(r){if(r instanceof Se)throw r;return!1}}var k$=new Set(["node_modules","__pycache__"]),T$=[["vendor","bundle"],["vendor","cache"]];function I$(e,t,n,r){if(R$(e))return null;let o=kt(e,t,r);if(!o)return null;let i=oe(o.split("/").pop()??""),s=oe(o),a=()=>P$(i)||A$(e,t,r);if(E$.has(i)||w$.some((d)=>i.startsWith(d)))return null;let c=oe($$(e,t,r));for(let d of fh){let m=`~/${d.suffixParts.join("/")}`;if((vE(s,m)||vE(c,m))&&Gt(d.id,n))return d.id}let l=O$(o,t,n,r);if(l)return l;if(x$.has(i))return null;for(let d of mh)if(i===d.basename&&Gt(d.id,n))return d.id;if(i.startsWith(C$)&&Gt(dl.id,n)&&a())return dl.id;for(let d of ph)if(i.length>d.prefix.length&&i.startsWith(d.prefix)){let m=i.slice(d.prefix.length)[0];if((m==="-"||m==="_")&&Gt(d.id,n)&&a())return d.id}for(let d of gh)if(i.length>d.prefix.length&&i.startsWith(d.prefix)){if(i.slice(d.prefix.length)===d.suffix&&Gt(d.id,n))return d.id}if(D$(s))return null;if(!i.includes(".")&&xi.pattern.test(i)&&Gt(xi.id,n))return xi.id;let u=M$(i,n);if(u)return u;return null}function O$(e,t,n,r){return ml.find((o)=>{if(!Gt(o.id,n))return!1;switch(o.id){case"secret.cli.claude-code":return te(e,re(process.env.CLAUDE_CONFIG_DIR,"~/.claude",t,r),[".credentials.json"]);case"secret.cli.claude-code.config":{let i=oe(e).split("/");return te(e,re(process.env.CLAUDE_CONFIG_DIR,"~/.claude",t,r),["settings.json","settings.local.json"])||Ai(e,"~/.claude.json",t,r)||i.at(-1)==="settings.local.json"&&i.at(-2)===".claude"||i.at(-1)===".mcp.json"}case"secret.cli.antigravity":return te(e,kt("~/.gemini/config",t,r),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let i=re(process.env.CODEX_HOME,"~/.codex",t,r);return te(e,i,["auth.json",".credentials.json"])||Pi(e,i,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let i=re(process.env.CODEX_HOME,"~/.codex",t,r),s=oe(e).split("/").at(-1)??"";return te(e,i,["config.toml"])||s.endsWith(".config.toml")&&te(e,i,[s])}case"secret.cli.gemini":return te(e,_e(re(process.env.GEMINI_CLI_HOME,"~",t,r),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let i=oe(e).split("/"),s=process.env.ProgramData?[_e(re(process.env.ProgramData,"",t,r),"gemini-cli")]:[];return te(e,_e(re(process.env.GEMINI_CLI_HOME,"~",t,r),".gemini"),["settings.json","google_accounts.json"])||i.at(-1)==="settings.json"&&i.at(-2)===".gemini"||(process.env.GEMINI_CLI_SYSTEM_SETTINGS_PATH?.trim()?Ai(e,process.env.GEMINI_CLI_SYSTEM_SETTINGS_PATH,t,r):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...s].some((a)=>te(e,kt(a,t,r),["settings.json"]))}case"secret.cli.copilot-cli":{let i=re(process.env.COPILOT_HOME,"~/.copilot",t,r);return te(e,i,["config.json"])||Pi(e,i,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return te(e,re(process.env.COPILOT_HOME,"~/.copilot",t,r),["mcp-config.json"]);case"secret.cli.kimi-code":{let i=re(process.env.KIMI_CODE_HOME,"~/.kimi-code",t,r),s=re(process.env.KIMI_SHARE_DIR,"~/.kimi",t,r);return te(e,i,["server.token"])||Pi(e,i,["credentials"])||Pi(e,s,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let i=["config.toml","mcp.json"],s=oe(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".kimi-code"||te(e,re(process.env.KIMI_CODE_HOME,"~/.kimi-code",t,r),i)||te(e,re(process.env.KIMI_SHARE_DIR,"~/.kimi",t,r),[...i,"config.json","config.json.bak"])}case"secret.cli.opencode":{let i=_e(re(process.env.XDG_DATA_HOME,"~/.local/share",t,r),"opencode"),s=oe(e).split("/").at(-1)??"",a=process.env.OPENCODE_DB?.trim(),c=a&&a!==":memory:"?[a,`${a}-wal`,`${a}-shm`]:[];return te(e,i,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(s)&&te(e,i,[s])||c.some((l)=>Ai(e,l,t,r))}case"secret.cli.opencode.config":{let i=process.env.OPENCODE_CONFIG_DIR?re(process.env.OPENCODE_CONFIG_DIR,"~/.config/opencode",t,r):_e(re(process.env.XDG_CONFIG_HOME,"~/.config",t,r),"opencode"),s=process.env.ProgramData?[_e(re(process.env.ProgramData,"",t,r),"opencode")]:[],a=["opencode.json","opencode.jsonc"];return a.includes(oe(e).split("/").at(-1)??"")||te(e,i,a)||(process.env.OPENCODE_CONFIG?.trim()?Ai(e,process.env.OPENCODE_CONFIG,t,r):!1)||["/Library/Application Support/opencode","/etc/opencode",...s].some((c)=>te(e,kt(c,t,r),a))}case"secret.cli.pi":return te(e,re(process.env.PI_CODING_AGENT_DIR,"~/.pi/agent",t,r),["auth.json"]);case"secret.cli.pi.config":return te(e,re(process.env.PI_CODING_AGENT_DIR,"~/.pi/agent",t,r),["models.json"]);case"secret.cli.amp":{let i=kt("~",t,r);return[_e(re(process.env.XDG_DATA_HOME,"~/.local/share",t,r),"amp"),_e(i,".local","share","amp")].some((a)=>te(e,a,["secrets.json"]))||Pi(e,_e(i,".amp"),["oauth"])}case"secret.cli.amp.config":{let i=["settings.json","settings.jsonc"],s=[_e(re(process.env.XDG_CONFIG_HOME,"~/.config",t,r),"amp"),_e(kt("~",t,r),".config","amp")],a=oe(e).split("/");return s.some((c)=>te(e,c,i))||a.at(-2)===".amp"&&i.includes(a.at(-1)??"")||(process.env.AMP_SETTINGS_FILE?.trim()?Ai(e,process.env.AMP_SETTINGS_FILE,t,r):!1)}case"secret.cli.cursor":{let i=_e(re(process.env.XDG_CONFIG_HOME,"~/.config",t,r),"cursor"),s=_e(re(process.env.CURSOR_DATA_DIR,"~/.cursor",t,r),"projects");return te(e,kt("~/.cursor",t,r),["auth.json"])||te(e,i,["auth.json"])||oe(e).split("/").at(-1)==="mcp-auth.json"&&Gn(oe(e),oe(s))}case"secret.cli.cursor.config":{let i=oe(e).split("/");return i.at(-1)==="mcp.json"&&i.at(-2)===".cursor"}case"secret.cli.grok-build":return te(e,re(process.env.GROK_HOME,"~/.grok",t,r),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let i=oe(e).split("/");return i.at(-1)==="config.toml"&&i.at(-2)===".grok"||te(e,re(process.env.GROK_HOME,"~/.grok",t,r),["config.toml","managed_config.toml","requirements.toml"])||te(e,kt("/etc/grok",t,r),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}function re(e,t,n,r){return kt(e?.trim()?e:t,n,r)}function te(e,t,n){return n.some((r)=>NE(e,_e(t,r)))}function Pi(e,t,n){return n.some((r)=>Gn(oe(e),oe(_e(t,r))))}function Ai(e,t,n,r){return NE(e,kt(t,n,r))}function NE(e,t){return oe(e)===oe(t)}function _e(e,...t){return mt([e,...t].filter(Boolean).join("/"))}function z$(e,t,n,r,o){if(n.length===0)return!1;let i=oe(Ti(e,t,o));return n.some((s)=>Gn(i,oe(Ti(s,r,o))))}function N$(e,t,n,r,o){if(n.length===0)return!1;let i=oe(Ti(e,t,o));if(!i)return!1;let s=process.env.HOME??Ph(),a=s?mt(X(ze(s),Be,o)):"",c=oe(a),l=process.env.CC_SAFETY_NET_HOME,u=oe(l?mt(X(_l(ze(l)),Be,o)):a&&mt(X(`${a}/.cc-safety-net`,Be,o)));if(u&&Gn(i,u))return!1;return n.some((d)=>{let m=oe(Ti(d,r,o));if(!m)return!1;if(c&&(c===m||c.startsWith(m.endsWith("/")?m:`${m}/`)))return!1;return Gn(i,m)})}function D$(e){let t=e.split("/");return t.some((n)=>k$.has(n))||T$.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function M$(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of hh)if(r===o.extension&&Gt(o.id,t))return o.id;for(let o of yh)if(o.pattern.test(r)&&Gt(o.id,t))return o.id;return null}function oe(e){return e.toLowerCase()}function Gt(e,t){return!t?.disabledRules?.includes(e)}function kt(e,t,n){let{home:r,normalized:o}=Ah(e,n);if(!o)return"";if(!r)return o;let i=kh(o,r),s=bl(i)?i:mt(_l(t,i)),a=mt(X(s,Be,n));if(!Gn(a,r)){if(bl(i))return a;return a===s?o:a}let c=a.slice(r.length);return c?`~${c}`:"~"}function vE(e,t){return e===t||e.startsWith(`${t}/`)}function $$(e,t,n){let{home:r,normalized:o}=Ah(e,n);if(!o||!r)return"";let i=kh(o,r),s=EM.normalize(bl(i)?i:mt(_l(t,i))),a=mt(ze(process.env.HOME??Ph())),c=(d)=>process.platform==="win32"?d.toLowerCase():d,l=[r,a].find((d)=>d!==""&&Gn(c(s),c(d)));if(l===void 0)return"";let u=s.slice(l.length);return u?`~${u}`:"~"}function Ti(e,t,n){let{home:r,normalized:o}=Ah(e,n);if(!o)return"";let i=r?kh(o,r):o;return mt(X(bl(i)?i:_l(t,i),Be,n))}function Ah(e,t){let n=process.env.HOME??Ph(),r=n?mt(X(ze(n),Be,t)):"",o=mt(ze(L$(yt(e))));return{home:r,normalized:o}}function L$(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return RM(e)}catch{return e}}function kh(e,t){if(e==="~")return t;if(e.startsWith("~/"))return _e(t,e.slice(2));return e}function W$(e){if(process.platform==="win32")return!0;return wM.parse(e).root.length>1}function mt(e){let t=e.trim(),n=(W$(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Gn(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function Zn(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}import{dirname as Sl}from"path";var DE="Rulebook exceeds CC Safety Net's safe validation limits.",ME="Additional rulebook validation errors were omitted.",ft=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function $E(e){if(Th(e.allowed_commands,ft.maxAllowedCommands)||Th(e.rules,ft.maxRules)||Th(e.tests,ft.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=ft,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>ft.maxStringCodeUnits||i&&o.length>ft.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>ft.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let c of a)if(!r(c))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Th(e,t){return Array.isArray(e)&&e.length>t}function F$(e){if(!G$(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!$E(e))return{errors:[DE],ruleNames:new Set};let t=(e.rulebook_version===2?MC():DC()).safeParse(e),n=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...t.success?[]:gl(t.error.issues,": ",": ")];return{errors:n.length>ft.maxValidationErrors?[...n.slice(0,ft.maxValidationErrors),ME]:n,ruleNames:new Set(bh(e).map((r)=>r.toLowerCase()))}}function LE(e){let t=F$(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}function G$(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function UE(e={}){let t=Xh(e),n=!1;try{n=Zh(t.userConfigTarget,t.projectConfigTarget)}catch(m){if(m instanceof pe)return Y$(t,m.message);throw m}let r=_h(t.userConfigTarget),o=n?{config:null,errors:[]}:_h(t.projectConfigTarget),i=ZE(t.userConfigPath,r.errors),s=ZE(t.projectConfigPath,o.errors),a=new Set,c=r.config?WE(r.config,Sl(t.userConfigPath),"user",t.userScope,a):jE(),l=o.config?WE(o.config,Sl(t.projectConfigPath),"project",t.projectScope,a):jE(),u=r.config?.overrides??{},d=o.config?.overrides??{};return{rules:[...FE(c.rules,u),...FE(l.rules,d)],transparent_wrappers:q$(r.config,o.config),rulebooks:[...c.rulebooks,...l.rulebooks],errors:[...i,...s,...c.errors,...l.errors],warnings:[...c.warnings,...l.warnings,...c.canValidateOverrides?GE(u,c.knownRuleIds,t.userConfigPath):[],...c.canValidateOverrides?K$(d,c.knownRuleIds,t.projectConfigPath):[],...l.canValidateOverrides?GE(d,l.knownRuleIds,t.projectConfigPath):[]],userConfig:r.config??void 0,projectConfig:o.config??void 0,...t}}function WE(e,t,n,r=dn(Sl(Sl(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((l)=>{let u=j$(l,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let d=u.rulebook;if(o.has(d.name))return s.push(`duplicate active rulebook name "${d.name}" for ${l}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(d.name),[{rules:Z$(d),rulebook:{source:n,spec:l,name:d.name,version:d.version,rules:d.rules.map((m)=>`${d.name}/${m.name}`)}}]}),c=a.flatMap((l)=>l.rules);return{rules:c,rulebooks:a.map((l)=>l.rulebook),entries:a.map((l)=>({spec:l.rulebook.spec,name:l.rulebook.name,version:l.rulebook.version,ruleCount:l.rulebook.rules.length})),knownRuleIds:new Set(c.map((l)=>l.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Z$(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function j$(e,t,n){let r=U$(e),o=Qh(t,r),i=V$(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${B$(e)}`]};let s=H$(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function U$(e){return $i(e)?Al(e).name:e}function B$(e){return $i(e)?`run ${Jh} to vendor ${e}`:"create that file or remove that source from the rules config"}function V$(e,t){try{return{content:Mi(Jr(t,e))}}catch(n){if(n instanceof pe)return{error:n.message};throw n}}function H$(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:LE(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function q$(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function FE(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function GE(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function K$(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function ZE(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Y$(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function jE(){return{rules:[],rulebooks:[],entries:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}function BE(e={}){let t=UE(e),n=YC(e),r={rules:t.rules,transparentWrappers:t.transparent_wrappers,safety:n.safety,worktreeMode:n.worktreeMode,destructiveCommandProtectionEnabled:n.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:n.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:n.destructiveCommandAllowPaths,secretProtection:{enabled:n.secretProtection.enabled??!0,disabledRules:n.secretProtection.disabledRules??[],denyPaths:n.secretProtection.denyPaths,allowPaths:n.secretProtection.allowPaths??[]}},o={...t.userConfig?.overrides??{},...t.projectConfig?.overrides??{}},i=Object.freeze(Object.fromEntries(r.rules.map((s)=>{let a=t.rulebooks.find((l)=>l.rules.includes(s.name)),c=o[s.name];return[s.name,Object.freeze({id:s.name,...a?{rulebook:Object.freeze({name:a.name,version:a.version}),...e1(a.spec)?{source:a.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return t1(r,J$(t,n),i,n.policyScopes)}function J$(e,t){let n=Q$(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:n1(e.errors.length>0?X$(e.errors):void 0,e.warnings.length>0?Oh(e.warnings.join("; ")):void 0,n)}}function X$(e){return`${Oh(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Q$(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function e1(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function t1(e,t,n=Object.freeze({}),r){let o=Ih(structuredClone(e)),i=r?{policyScopes:Ih(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ih(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ih(t);return Object.freeze(e)}function n1(...e){return Oh(e.filter((t)=>!!t).join("; "))}function Oh(e){return/[.!?]$/.test(e)?e:`${e}.`}class cn extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var r1={findPolicyMutation:aE,findGitMetadataMutation:hv,resolveGitMetadata:Cu,loadPolicySnapshot:BE,findSensitiveTarget:wE,analyzeCommand:RS,getModes:Cd};function VE(e,t={}){let n={...r1,...t.dependencies},r=s1(e),o=Ii(e)?e.command:r,i=an("policy-protection",o,()=>_o(e,t.factParserDependencies)),s=xe(i,"input-candidate"),a=xe(i,"declared-command");if(Ii(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:It,intent:"stop_and_explain",evidence:[{kind:"command",command:e.command,segment:e.command}]}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:gy,intent:"stop_and_explain",evidence:[]}};let c=an("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd])),l=an("policy-protection",o,()=>n.findPolicyMutation(i));if(l){let E=o??l.target;return{stage:"policy-protection",decision:{kind:"deny",reason:sE,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:l.target}]}}}let u=an("policy-protection",o,()=>kS(i));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:AS,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:u.target}]}}}let d=an("policy-protection",o,()=>n.findGitMetadataMutation(i,c));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ke,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:d.target}]}}}let m=an("config-load",o,()=>n.loadPolicySnapshot({...t.policyOptions,cwd:e.context.configCwd})),f=m.policy,p=n.getModes(f),h={level:p.effectiveLevel,...o1(m)},y=f.secretProtection.enabled===!1?null:an("secret-protection",o,()=>n.findSensitiveTarget(i,f.secretProtection,{strict:Ii(e)||s?.program.dialect==="powershell"?p.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:_E,intent:"hard_stop",ruleId:y.ruleId,evidence:[{kind:"command",command:E,segment:y.target}]}}}if(!Ii(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...zh("command-validation",o),...h};let b=an("command-analysis",o,()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:Qe(),protectedGitMetadata:c,effectiveCapabilities:p.capabilities,strict:p.strict,paranoidRm:p.paranoidRm,paranoidInterpreters:p.paranoidInterpreters,worktreeMode:p.worktreeMode},i1(i),i.store));if(b)return{stage:"command-analysis",...h,decision:b};return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function o1(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function i1(e){return xe(e,"declared-command")?.program}function s1(e){try{return vo(e.input)}catch(t){let n=Ii(e)?e.command:void 0;throw new cn("policy-protection",zh("policy-protection",t instanceof $t?void 0:n,t),t)}}function an(e,t,n){try{return n()}catch(r){throw new cn(e,zh(e,r instanceof $t?void 0:t,r),r)}}function zh(e,t,n){let r=n instanceof Se||n instanceof ht;return{stage:e,decision:{kind:"deny",reason:r?hy:Wi,intent:"stop_and_explain",evidence:t?[{kind:"command",command:t,segment:t}]:[]}}}function Ii(e){return e.route.kind==="command"}function qE(e,t){try{let n=VE(e,t.guard);return HE(e,n,t),n}catch(n){if(!(n instanceof cn))throw n;throw HE(e,n.evaluation,t,!(n.cause instanceof $t),{stage:n.stage,errorCode:a1(n.cause)}),n}}function HE(e,t,n,r=!0,o){uy(ly(e,t,n.guard?.auditAllowed??!1,r,o),n.audit.getSessionId,{agent:n.audit.agent,shape:n.audit.shape,homeDir:n.audit.homeDir})}function a1(e){if(e instanceof Se)return"path-canonicalization-limit";if(e instanceof $t)return"tool-input-limit";if(e instanceof ht)return"structural-shell-syntax-limit";return"unexpected-error"}var YE=l1();function l1(e={}){return(t,n)=>u1(t,n,e)}function u1(e,t,n){let r=d1(e,t),o=()=>p1(e);if("malformed"in r)return dy(r.denial,o,{agent:"amp",toolName:r.denial.toolName,cwd:r.cwd}),JE(r.denial);try{let i=qE(r,{guard:{auditAllowed:Sd(),dependencies:n.guardDependencies},audit:{agent:"amp",getSessionId:o}});return KE(i,!0)}catch(i){if(!(i instanceof cn))throw i;if(Qt(fe.debug))console.error(`CC Safety Net debug: amp tool.call analysis failed: ${xy(i.cause)}`);return KE(i.evaluation,r.route.kind==="command")}}function d1(e,t){if(!e||typeof e!=="object")return Yr(null);let n=e;if(typeof n.tool!=="string"||n.tool.trim()==="")return Yr(null);if(!n.input||typeof n.input!=="object")return Yr(null,n.tool);let r=m1(t);if(!r)return Yr(null,n.tool);let o=f1(t,e);if(!o.ok)return Yr(r,n.tool);if(!o.command)return gr(n.tool,n.input,{kind:vu(n.tool)},{configCwd:r,executionCwd:r},null);if(typeof o.command.command!=="string"||o.command.command.trim()==="")return Yr(r,n.tool);let i=typeof o.command.dir==="string"?fy(o.command.dir,r):r;if(!i)return{malformed:!0,denial:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",command:o.command.command,segment:o.command.dir,toolName:n.tool},cwd:r};return gr(n.tool,n.input,{kind:"command",shell:"posix"},{configCwd:r,executionCwd:i},o.command.command)}function m1(e){let t=e.system.workspaceRoot;if(!t)return;try{let n=e.helpers.filePathFromURI(t);if(typeof n!=="string"||n.trim()==="")return;return Dl(".",[n])}catch{return}}function f1(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function p1(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function Yr(e,t){return{malformed:!0,denial:_y({toolName:t}),cwd:e}}function KE(e,t){let n=vy(e,{includeEvidence:t});return n?JE(n):{action:"allow"}}function JE(e){return{action:"reject-and-continue",message:Sy(e)}}function g1(e){e.on("tool.call",(t)=>YE(t,e))}export{g1 as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function qo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(_(e)):e.provenance==="literal"}function mr(e){return e?_(e):""}function SR(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Sa(e,t){return ha(De(e,"posix"),t)}function pr(e){return Sa(e,new Set(Array.from(e.matchAll(fm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function ha(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(ha(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>ha(o,n))||ym(r.words,n))return!0;RR(r,n)}return!1}function ym(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(fr(r,t))return!0;let o=L(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return mm(e[s],t)}if(J.has(o)){let s=e.slice(n),a=Ke(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&mm(s[l],t)}let i=CR(e,n,t);if(i===null)return!1;if(i===-1)return!0;return ym(e.slice(i),t)}function CR(e,t,n){let r=L(e[t]?.text??"");if(r==="command")return bR(e,t+1);if(r==="exec")return vR(e,t+1);if(r==="env")return ER(e,t+1,n);return null}function bR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function vR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function ER(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return fr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return fr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function RR(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(fr(n,t))t.add(r.name)}}function fr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(fm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(cR.test(o)||t.has(o))}))}function mm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||fr(e,t))}var Ca="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ba="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",xR="__CC_SAFETY_NET_XARGS_INPUT__",Yo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Zo="rm",_R=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,wR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,AR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,PR=/^(?:[0-9]+|[@*])$/;function vm(e,t){let n=e.map(_),{childStart:r,replacementToken:o}=jt(n),i=n.slice(r),s=S("xargs.shell-dynamic",ba);if(IR(i,o,t)&&T(s,t.policy))return T(s,t.policy);for(let a of Be(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?T(s,t.policy):null;if(c)return c;let d=_m(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&Rm(l,o),u=t.analyzeChild(l,{...Sm(a,t),dynamicInput:d,dynamicSourceInput:m||Em(l,a.head,o,a.wrapperEnvAssignments,d,t.scanWork,t.environment),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:S("xargs.rm-recursive-force-dynamic",Ca)});if(u)return u;let f=TR(l,o,t.policy?.rules??[]);if(f)return f;if(a.head==="git"){let h=o===null?[...l,xR]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...Sm(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=ze(l,t.policy?.rules??[]);if(p)return p}return null}function Sm(e,t){return{producer:"xargs",cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function TR(e,t,n){if(n.length===0)return null;if(t===null){for(let o of n){let i=ze([...e,...o.subcommand?[o.subcommand]:[],...o.block_args],n);if(i)return i}return null}let r=new Set(n.flatMap((o)=>[o.subcommand,...o.block_args].flatMap((i)=>i?e.flatMap((s)=>va(s,t,i)):[])));for(let o of r){let i=ze(e.map((s)=>s.replaceAll(t,o)),n);if(i)return i}return null}function va(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=e.slice(0,r),i=e.slice(r+t.length);return n.startsWith(o)&&n.endsWith(i)?[n.slice(o.length,n.length-i.length)]:[]}function Em(e,t,n,r,o,i,s){if(J.has(t)){if(ot(e))return!1;if(n!==null&&kR(e,n))return!0;let a=rt(e);if(!a){let l=it(q(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n))return!0;if(et(a,i))return!0;return OR(a,n,r)}if(Me(t))return Cm(e,n,bo,Gu(t));if(we.has(t))return Cm(e,n,na,Fd);if(t==="eval"){let a=Vo(q(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return MR(e,n,i,s);if(t==="git"){let a=Ue(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&En.has(a.subcommand.toLowerCase())&&xm(a.rest,n).some((l)=>l.includes(n))}return!1}function Cm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Yo]).sources.some((l)=>l.value===Yo);if(o.sources.some((l)=>l.value.includes(t)))return!0;let i=new Set(o.sources.map((l)=>`${l.tokenIndex}\x00${l.kind}\x00${l.value}`)),s=r.flatMap((l)=>[l.selector,...l.valueForm==="attached-only"||l.valueForm==="attached-or-separate"?[`${l.selector}${Yo}`]:[],...l.valueForm==="equals-or-separate"?[`${l.selector}=${Yo}`]:[]]),a=new Set(s.flatMap((l)=>e.flatMap((c)=>va(c,t,l))));return Array.from(a).some((l)=>n(e.map((c)=>c.replaceAll(t,l))).sources.some((c)=>!i.has(`${c.tokenIndex}\x00${c.kind}\x00${c.value}`)))}function IR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Be(e,n),(i)=>i.head)),o=t===null?[...e,Zo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Zo));return Array.from(Be(o,n)).some((i)=>i.head===Zo&&!r.has(Zo))}function Rm(e,t){return xm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function xm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function _m(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function kR(e,t){let n=Ke(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return va(i,t,o).some((l)=>{let c=e.map((m,u)=>u===s?m.replaceAll(t,l):m),d=Ke(c);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(n.commandIndex===null&&d.commandIndex!==null)return!0;if(n.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(c[d.commandIndex]??"").includes(l))return!0;return d.scriptIndex!==null&&(c[d.scriptIndex]??"").includes(l)})}))}function OR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(_R))if(bm(o,r))return!0;for(let o of e.matchAll(wR))for(let i of(o[1]??"").matchAll(AR))if(bm(i,r))return!0;return Sa(e,r)}function bm(e,t){let n=e[1]??e[2];return n!==void 0&&(PR.test(n)||t.has(n))}function MR(e,t,n,r){if(t===null)return!0;let o=!1,i=0;for(let s=1;s<e.length;s++){let a=e[s]??"";if(!o&&!a.startsWith("-")&&a!=="!"&&a!=="("){if(a.indexOf(t)===0)return!0;continue}if(o=!0,i>0){i--;continue}if(nt(a)){let c=ur(e,s);s=c.nextIndex-1;for(let d of Be(c.tokens,{environment:r,cwd:void 0})){let m=_m(d.tokens,t,d.wrapperEnvAssignments);if(d.head==="rm"&&Rm(d.tokens,t)||Em(d.tokens,d.head,t,d.wrapperEnvAssignments,m,n,r))return!0}continue}let l=St(a);if(l>0){if(i=l,a.includes(t))return!0;continue}if(a.includes(t))return!0}return!1}function jt(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var hr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",yr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",NR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",LR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",WR=/\{[^{}\s]*\}/,Mm=/\{\}|\{-?\d+\}/g,FR=["e","f","source","file","-e","-f","--source","--file"],GR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],zR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),BR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),wm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),$R=new Set(["--workdir","--wd"]),Am="__CC_SAFETY_NET_PARALLEL_SOURCE__",UR=new TextEncoder,xa=P.parallelDerivedBytes.cap+4*P.parallelPlaceholderReplacements.cap;function ye(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Dm(e,t){return ye([...e],(n)=>et(n,t.scanWork))}function Nm(e,t){let n=e.map(_);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=Kt(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Hm(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:d,dryRun:m}=o;if(c){let p=Kt(t);if(p)return p;let h=Dm(t.envAssignments?.values()??[],t);if(h)return h}if(l){let p=XR(t);if(p)return p}if(d!==void 0&&a){let p=Kt(t);if(p)return p}let u=tx(d,t.cwd,t.environment.paths);if(u===null){let p=Kt(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(m){if([...Be(i,f)].flatMap((h)=>[...h.envAssignments.values()]).some(Pa)){let h=Kt(t);if(h)return h}return null}if(i.length===0){if(s.some((g)=>g.length!==1)){let g=Kt(t);if(g)return g}let p=s.map((g)=>g[0]??"");Re(t.budget,_a(p));let h=zm(f.envAssignments,f.cwd,a);return ye(p,(g)=>t.analyzeNested(g,h))}return ye(Be(i,f),(p)=>HR(p,o,t,f))}function HR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some($m)){let g=Kt(n);if(g)return g}let d=Dm(c,n);if(d)return d;let m=c.some(G),u=i||m,f=a&&u,p=zm(e.envAssignments,e.wrapperCwd,s||f);if(J.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return Re(n.budget,Xo(l,o,"generic")),ye(o,(E)=>n.analyzeChild(l.map((b)=>vt(b,E)),Ea(e,r)))};if(ot(l))return g();let y=rt(l);if(y){if(Um(y)){let R=Vt(n);if(R)return R;if(o.length===0)return null;return Re(n.budget,Om(y,o)),ye(o,(A)=>n.analyzeNested(vt(y,A),p))}if(G(y)){if(o.length>0)return Re(n.budget,Om(y,o)),ye(o,(K)=>n.analyzeNested(vt(y,K),p));Re(n.budget,Im(y));let R=dr(y);if(R?.[0]&&L(R[0])==="rm"&&$e(R)){let K=Tm(n);if(K)return K}let A=R?n.analyzeChild(R,{...Ea(e,r),dynamicInput:a,shellDynamicMatch:S("parallel.shell-dynamic",yr),rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",hr)}):null;if(A)return A;return n.analyzeNested(y,p)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((R)=>Ko(q(R===void 0?l:i?l.map((A)=>vt(A,R)):[...l,...R]),y)):[];if(E.some((R)=>R.kind==="dynamic")){let R=Vt(n);if(R)return R}let b=E.flatMap((R)=>R.kind==="literal"?[R.source]:[]);if(b.length>0)return Re(n.budget,_a(b)),ye(b,(R)=>n.analyzeNested(R,p));if(Re(n.budget,Im(y)),pr(y)){let R=Vt(n);if(R)return R}let w=n.analyzeNested(y,p);if(w)return w;if(u)return Vt(n);return null}let v=it(q(l));if(v.kind==="dynamic"||v.kind==="literal"&&G(v.source))return Vt(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=Vt(n);if(E)return E;let b=g();if(b)return b;if(i)return null;let w=o.flatMap((R)=>R[0]===void 0?[]:[R[0]]);return Re(n.budget,_a(w)),ye(w,(R)=>n.analyzeNested(R,p))}if(u||a)return Vt(n)??g();return null}if(e.head==="rm"&&$e(l)){if(i&&o.length>0)return Re(n.budget,Xo(l,o,"rm")),ye(o,(y)=>Ra(l.map((v)=>wa(v,y)),e.cwd,r));if(o.length>0)return Re(n.budget,km(l,o)),ye(o,(y)=>Ra([...l,...y],e.cwd,r));let g=Ra(l.flatMap((y,v)=>{if(v===0||!G(y))return[y];return y.startsWith("-")?[wa(y,[""])]:[]}),e.cwd,r);if(g)return g;return Tm(n)}Re(n.budget,i&&o.length>0?Xo(l,o,"generic"):o.length>0?km(l,o):Gm(l));let h=o.length>0?o:[void 0];return ye(h,(g)=>{let y=g===void 0?l:i?l.map((Y)=>vt(Y,g)):[...l,...g],v=S("parallel.shell-dynamic",yr),E=a&&e.head==="find"?ZR(y,r):null,b=Wm(y,a,n.policy?.rules??[],n.budget)??E?.customResult??null,w=L(e.head),R=a&&(w==="rm"&&Aa(y)||w==="xargs"&&Fm(y)||E?.rmOptions===!0),A=a&&(R||E?.executedSource===!0||E===null&&Lm(y,w)),K=n.analyzeChild(y,{...Ea(e,r),worktreeMode:s||a||u?!1:n.worktreeMode,dynamicInput:a||u,dynamicRmInput:R,dynamicSourceInput:b!==null||A,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",hr)});if(A){let Y=T(v,n.policy);if(Y)return Y}return K??b??ze(y,n.policy?.rules??[])})}function Ea(e,t){return{producer:"parallel",cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Lm(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return KR(e);if(t==="git")return jR(e);if(t==="find")return!0;if(we.has(t))return Pm(e,FR,cr);if(Me(t))return Pm(e,GR,Co);return!1}function Aa(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||Um(o)))}function jR(e){if(VR(e))return!0;let t=Ue(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!En.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function VR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function KR(e){if(ot(e))return!1;let t=rt(e);if(t!==null)return G(t);let n=it(q(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function Pm(e,t,n){let r=n(e);if(r.some((i)=>G(i.value)))return!0;if(!e.some(G))return n([...e,Am]).some((i)=>i.value===Am);let o=new Set(r.map((i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`));return t.some((i)=>n(e.map((s)=>vt(s,[i]))).some((s)=>!o.has(`${s.tokenIndex}\x00${s.kind}\x00${s.value}`)))}function Wm(e,t,n,r){if(!t||n.length===0)return null;let o=n.filter((s)=>L(s.command)===L(e[0]??""));if(o.length===0)return null;let i=e.some(G);if(Re(r,qR(e,o,i)),!i)return ye(o,(s)=>ze([...e,...s.subcommand?[s.subcommand]:[],...s.block_args],[s]));return ye(o,(s)=>{let a=new Set([s.subcommand,...s.block_args].flatMap((l)=>l?YR(e,l):[]));return ye(a,(l)=>ze(e.map((c)=>vt(c,[l])),[s]))})}function qR(e,t,n){let r=n?qt(Ie(t.map((o)=>o.block_args.length+(o.subcommand?1:0)),P.parallelChildAnalyses.cap),2*Math.max(e.length,1),P.parallelChildAnalyses.cap):t.length;return{childAnalyses:r,derivedTokens:qt(r,e.length,P.parallelDerivedTokens.cap)}}function YR(e,t){return e.flatMap((n)=>{let r=[...n.matchAll(/\{[^{}\s]*\}/g)];if(r.length!==1)return[];let o=r[0];if(!o||o.index===void 0)return[];let i=n.slice(0,o.index),s=n.slice(o.index+o[0].length);if(!t.startsWith(i)||!t.endsWith(s))return[t];let a=t.slice(i.length,t.length-s.length);return a!==t?[t,a]:[t]})}function ZR(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of Be(i,t))n.executedSource||=Lm(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Aa(a.tokens)||a.head==="xargs"&&Fm(a.tokens),n.customResult??=Wm(a.tokens,!0,t.policy?.rules??[],t.budget)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(nt(a)){i=[],n.executedSource||=G(a);continue}let l=St(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function Fm(e){let t=e.slice(jt(e).childStart);return L(t[0]??"")==="rm"&&Aa(t)}function Jo(e,t){return(n)=>T(S(e,t),n.policy)}var Vt=Jo("parallel.shell-dynamic",yr),XR=Jo("parallel.command-stream-dynamic",NR),Kt=Jo("parallel.command-stream-dynamic",LR),Tm=Jo("parallel.rm-recursive-force-dynamic",hr);function Ra(e,t,n){return T(jo(q(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:yt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:zt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function _a(e){return{childAnalyses:e.length,derivedTokens:e.length,derivedBytes:Sr(e)}}function Im(e){return Gm([e])}function Gm(e){return{childAnalyses:1,derivedTokens:e.length,derivedBytes:Sr(e)}}function km(e,t){if(t.length>P.parallelChildAnalyses.cap)return{childAnalyses:t.length};return{childAnalyses:t.length,derivedTokens:Ie(t.map((n)=>e.length+n.length),P.parallelDerivedTokens.cap),derivedBytes:Ie([qt(Sr(e),t.length,P.parallelDerivedBytes.cap),Ie(t.map((n)=>Sr(n)),P.parallelDerivedBytes.cap)],P.parallelDerivedBytes.cap)}}function Om(e,t){return Xo([e],t,"generic")}function Xo(e,t,n){if(t.length>P.parallelChildAnalyses.cap)return{childAnalyses:t.length};let r=qt(e.length,t.length,P.parallelDerivedTokens.cap);if(r>P.parallelDerivedTokens.cap)return{childAnalyses:t.length,derivedTokens:r};let o=ex(e.map((l)=>QR(l,n))),i=qt(o.occurrences,t.length,P.parallelPlaceholderReplacements.cap);if(i>P.parallelPlaceholderReplacements.cap)return{childAnalyses:t.length,derivedTokens:r,placeholderReplacements:i};if(JR(o,t,i))return{childAnalyses:t.length,derivedTokens:r,derivedBytes:P.parallelDerivedBytes.cap+1,placeholderReplacements:i};let s=n==="generic"?vt:wa,a=Ie(t.map((l)=>Sr(e.map((c)=>s(c,l)))),P.parallelDerivedBytes.cap);return{childAnalyses:t.length,derivedTokens:r,derivedBytes:a,placeholderReplacements:i}}function JR(e,t,n){let r=P.parallelDerivedBytes.cap+4*n;return Ie([qt(e.fixedBytes,t.length,r),qt(e.occurrences,Ie(t.map((o)=>o.reduce((i,s)=>Math.max(i,gr(s)),0)),r),r)],r)>r}function QR(e,t){let n=t==="generic"?e.matchAll(/\{[^{}\s]*\}/g):e.matchAll(Mm),r=0,o=0,i=0;for(let s of n){if(r>=P.parallelPlaceholderReplacements.cap)return{occurrences:P.parallelPlaceholderReplacements.cap+1,fixedBytes:0};o=Ie([o,gr(e.slice(i,s.index))],xa),r++,i=s.index+s[0].length}return{occurrences:r,fixedBytes:r===0?gr(e):Ie([o,gr(e.slice(i))],xa)}}function ex(e){return{occurrences:Ie(e.map((t)=>t.occurrences),P.parallelPlaceholderReplacements.cap),fixedBytes:Ie(e.map((t)=>t.fixedBytes),xa)}}function Sr(e,t=P.parallelDerivedBytes.cap){return Ie(e.map(gr),t)}function gr(e){return UR.encode(e).byteLength}function Ie(e,t){let n=0;for(let r of e){if(!Number.isSafeInteger(r)||r<0||r>t-n)return t+1;n+=r}return n}function qt(e,t,n){if(!Number.isSafeInteger(e)||!Number.isSafeInteger(t)||e<0||t<0||e!==0&&t>Math.floor(n/e))return n+1;return e*t}function zm(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function vt(e,t){return e.replace(/\{[^{}\s]*\}/g,(n)=>Bm(n,t))}function wa(e,t){return e.replace(Mm,(n)=>Bm(n,t))}function Bm(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n),o=r>0?r-1:t.length+r;return t[o]??""}function G(e){return WR.test(e)}function $m(e){if(Pa(e))return!0;for(let t of e.matchAll(/\{[^{}\s]*\}/g))if(!/^(?:\{\}|\{-?\d+\})$/.test(t[0]))return!0;return!1}function Pa(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Um(e){return/^\{[^{}\s]*\}$/.test(e)}function Hm(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=ia(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=ia(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){a=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||BR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(wm.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=wm.has(p)?2:1;continue}if($R.has(y)){let E=v??h;if(E===void 0||E===":::"||E==="--"){c=!0,t++;continue}l=E,c||=v!==void 0&&E==="",t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(zR.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(a?Pa:$m);let d=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){d.push(p),p=[];continue}if(g!==void 0)p.push(g)}d.push(p)}let m=nx(d),u=n.some(G),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:u,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:l,dryRun:a}}function tx(e,t,n){if(e===void 0)return;if(e==="..."||/[{}$`*?~[]/.test(e))return null;if(!t&&!DR(e))return null;try{return ft(t??e,e,n)}catch{return null}}function nx(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let n of e){if(n.length===1){let o=n[0];if(o===void 0)return[];for(let i of t)i.push(o);continue}let r=[];for(let o of t)for(let i of n)if(r.push([...o,i]),r.length>P.parallelChildAnalyses.cap)return r;t=r}return t}function jm(e){return Hm(e).childStart}var rx="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Qo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ia(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Ta(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Km(e,t,n,r,o=!1,i){let a=(Un(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&Q(i,"shell.dynamic-executable",o)?S("shell.dynamic-executable",rx):null;return T(a,i)??qm(e,t,n,o,i)}function qm(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ia(a)?[l]:[]);if(i.length===0)return null;let s=L(t[0]?.text??"");if(s==="git"){let a=pn(e,t),l=ix(a);if(Q(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return T(S("shell.dynamic-structure",Qo),o);if(T(Ho(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),d=a.findIndex((m,u)=>u>l&&_(m)==="--");if(Q(o,"shell.dynamic-structure",r)&&c&&En.has(c)&&i.some((m)=>m>l&&(d===-1||m<d)))return T(S("shell.dynamic-structure",Qo),o);return null}if(s==="find")return Q(o,"shell.dynamic-structure",r)&&sx(t)?T(S("shell.dynamic-structure",Qo),o):null;if(s==="rm"){let a=t.findIndex((c,d)=>d>0&&_(c)==="--"),l=$e(t.map(_));return Q(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?T(S("shell.dynamic-structure",Qo),o):null}if(s==="xargs")return Vm(e,t.slice(jt(t.map(_)).childStart),"xargs",n,r,o);if(s==="parallel")return Vm(e,t.slice(jm(t.map(_))),"parallel",n,r,o);return null}function Vm(e,t,n,r,o,i){if(t.length===0)return null;let s=ox(t,r);if(Un(e,s)){let l=T(S(`${n}.shell-dynamic`,n==="xargs"?ba:yr),i);if(l)return l}let a=qm(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ia(l)&&Ta(l)))return T(S(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ca:hr),i);return null}function ox(e,t){let n=Wt(e,t),r=n.rewritten?q(n.words.map(_)):n.words,o=r[0];return o&&_(o)==="busybox"?r.slice(1):r}function ix(e){let t=1;while(t<e.length){let n=e[t],r=n?_(n):"";if(le.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function sx(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ia(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Ta(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Ta(s)))return!0;continue}if(t=!0,a)return!0;let l=St(s.text);if(l>0){n=l;continue}if(nt(s.text))o=!0,r=!0}return!1}function ka(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!go(t[n.tokenIndex],n.value)})}var ax="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",lx="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",cx="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Ym(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return S("dd.device-write",ax);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return S("mkfs.device",lx);if(e==="shred"&&n.length>0)return S("shred.target",cx);return null}var Xm=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>jo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:yt(e.envAssignments,e.options.environment),trustedTmpdirValue:zt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Ho(e.words,Oa(e))},{heads:new Set(["find"]),analyze:(e)=>Hd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:yt(e.envAssignments,e.options.environment),trustedTmpdirValue:zt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Yt(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>vm(e.words,{...Zm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Yt(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Nm(e.words,{...Zm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Yt(e.options.analyzeNested(t,n))})}];function Zm(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy,scanWork:e.options.scanWork}}function Yt(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Oa(e){return{environment:e.options.environment,cwd:e.cwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var tf="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function nf(e){return Xm.find((t)=>t.heads.has(e))?.analyze}function xn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((k)=>o==="posix"?_(k):k.text),s=n.child,a=s!==void 0&&s.producer!=="unknown-head",l=s?.producer==="unknown-head",c=n.effectiveCwd===null,d=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,u=_o(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let f=Wt(u.words,n.environment,d,new Map([...n.envAssignments??[],...u.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let x=[...p,...i(f.words)].join(" "),k=et(x,n.scanWork);if(k)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:k.reason}),me(k);if(n.strict)return Se(r);let N=wo(p,i(f.words));if(N){n.budget.charge("derivedTokens",N.length);let ne=n.analyzeNested(N.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments])});if(ne)return ne}}let h=f.rewritten?q(i(f.words)):pn(o,f.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>h.length){let x=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments]),E=g[0];if(!E)return null;if($t(E))throw new F("wrapperPeelIterations");let b=L(E),w=f.cwd===null?void 0:f.cwd??d,R=f.cwd===null?void 0:m,A=f.cwd===void 0?n.effectiveCwd:f.cwd,K=s?s.allowTmpdirVar:!sr(v,n.environment),Y=Km(o,f.words,n.environment,t===0,n.strict,n.policy);if(Y)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Y.reason}),me(Y);let te=zo(g,n.policy);if(te){for(let x of[te.childIndex,...te.alternativeChildIndices]){Jm(y.wrapperNormalizationBudget);let k=h.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:te.wrapper,output:i(k)});let N=xn(k,t,{...y,effectiveCwd:A,envAssignments:v});if(N)return N}return null}let X=l?void 0:b==="eval"?Vo(h):b==="trap"&&!a?gm(h):void 0;if(a&&s&&b==="eval"){if(X?.kind==="dynamic")return Rn(s,n.policy);if(X?.kind==="literal"){let x=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:v});if(x)return x}return _n(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!ya(n.commandView)))return Se(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:b==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let x=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:v,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?J.has(b):of(E,b)){if(ot(g))return null;if(a&&s){let x=rt(g);if(x){if(s.dynamicSourceInput??s.dynamicInput){let N=Rn(s,n.policy);if(N)return N}if(pr(x)){let N=Rn(s,n.policy);if(N)return N}return n.analyzeNested(x,{effectiveCwd:A,envAssignments:v})}let k=it(h);if(k.kind==="dynamic")return Rn(s,n.policy);if(k.kind==="literal")return s.dynamicSourceInput?Rn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?Rn(s,n.policy):null}if(l){let x=rt(g),k=x?n.analyzeNested(x,{effectiveCwd:A,envAssignments:v}):it(h).kind==="dynamic"?Se(r):null;if(k)return k}if(s===void 0){let x=fx(g,v,A,n,r,t);if(x)return x;let k=rt(g);if(k){let en=Ko(h,k);if(en.kind==="dynamic")return Se(r);let Si=en.kind==="literal"?en.source:k,cl=px(Si);r?.recordSegment({type:"shell-wrapper",wrapper:b,innerCommand:cl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:cl,depth:t+1});let ul=n.analyzeNested(Si,{effectiveCwd:A,envAssignments:v});if(ul)return ul;return pr(Si)?Se(r):null}let N=it(h);if(N.kind==="dynamic")return Se(r);if(N.kind==="literal")return ti(N.source,A,v,n,r,t);let ne=hm(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(ne.kind==="dynamic")return Se(r);if(ne.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:ne.source,depth:t+1}),n.analyzeNested(ne.source,{effectiveCwd:A,envAssignments:v})}}if(!s&&(b==="source"||b===".")){let x=g[1]==="-p"?2:null;if(x!==null){let en=n.commandView?h[x]:void 0;if(!en)return null;if(en.provenance!=="literal")return Se(r)}let k=x===null?1:3,N=g[k]==="--"?k+1:k,ne=n.commandView?h[N]:void 0;if(!ne)return null;if(ne.provenance==="literal")return ti(ne.text,A,v,n,r,t);if(n.strict||!n.commandView||!ya(n.commandView))return Se(r)}if(we.has(b)&&!l){if(!s&&n.strict&&ka(cr(g),h))return Se(r);let x=Gd(g,(N)=>Yt(n.analyzeNested(N,{effectiveCwd:A,envAssignments:v}))),k=T(x,n.policy);if(k)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:k.reason}),me(k)}if(Me(b)&&!l){if(!s&&n.strict&&ka(Co(g),h))return Se(r);let x=Fu(g);if(a&&s)return dx(b,x,A,v,n,s);if(x){let k=Q(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:b,codeArg:x,paranoidBlocked:k}),k){let ne=T(S("interpreter.one-liner-paranoid",Xn),n.policy);if(ne)return me(ne)}if(Ls(b,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let N=n.analyzeNested(x,{effectiveCwd:A,envAssignments:v});if(N&&!rf(N,x))return N;if(Jn(x,n.scanWork)){let ne=T(S("interpreter.dangerous-command",yn),n.policy);if(ne)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:yn}),me(ne)}r=void 0}}if(b==="busybox"&&g.length>1)return Jm(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),xn(h.slice(1),t,{...y,effectiveCwd:A,envAssignments:v});let D=s?null:T(Ym(b,g),n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:D.reason}),me(D);let oe=r===y.trace?y:{...y,trace:r},_e={words:h,head:b,cwd:w,originalCwd:R,envAssignments:v,allowTmpdirVar:K,dynamicArguments:f.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:oe,analyzeChildTokens:(x,k)=>a&&s?Ma(x,t,oe,{...s,cwd:k??void 0,effectiveCwd:k??void 0}):Yt(xn(q(x),t+1,{...oe,child:void 0,commandView:void 0,effectiveCwd:k,envAssignments:v}))??ze(x,oe.policy.rules),analyzeChild:(x,k)=>Ma(x,t,oe,k)},Ye=s&&(b==="xargs"||b==="parallel")?void 0:nf(b);if(b==="rm"||b==="xargs"||b==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,isOverriddenToNonTemp:!K,allowTmpdirVar:K});let ke=r&&b==="git"?om(_e.words,Oa(_e)):void 0,hi=Qm(ke?ke.match:Ye?.(_e)??null,n.policy);if(r)gx(_e,hi,ke?.relaxation??null);if(hi)return me(hi);if(a&&s&&(b==="rm"||b==="rmdir")){if(!(b==="rm"&&($e(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?_n(s,n.policy):null)??mx(s,n.policy)}let al=Ye!==void 0,ll=!s&&!al&&!Ur.has(b),yi=r&&ll?[]:void 0;if(ll)for(let x=1;x<g.length;x++){let k=g[x];if(!k)continue;yi?.push(k);let N=Qm(ux(g,x,t,oe,w,R,A,v),n.policy);if(N)return r?.recordSegment({type:"fallback-scan",tokensScanned:yi??[],embeddedCommandFound:L(k)}),me(N)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:yi??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&al)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let Ar=ze(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Ar,reason:Ar?.reason}),Ar)return me(Ar);return a&&s?_n(s,n.policy):null}function Ma(e,t,n,r){return Yt(xn(q(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function ux(e,t,n,r,o,i,s,a){for(let l of Be(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let d=L(c);if(of(c,d)||nf(d)!==void 0&&d!=="xargs"&&d!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=Ma(l.tokens,n,r,{producer:"unknown-head",cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!sr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function dx(e,t,n,r,o,i){if(!t)return _n(i,o.policy);if(Q(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=T(S("interpreter.one-liner-paranoid",Xn),o.policy);if(a)return me(a)}if(Ls(e,t))return _n(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!rf(s,t))return s;if(Jn(t,o.scanWork)){let a=T(S("interpreter.dangerous-command",yn),o.policy);if(a)return me(a)}return _n(i,o.policy)}function rf(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Wo)||e.reason===vn)&&!Hr(t)}function Rn(e,t){let n=e.shellDynamicMatch?T(e.shellDynamicMatch,t):null;return n?me(n):null}function _n(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?T(e.dynamicSourceMatch,t):null;return n?me(n):null}function mx(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?T(e.rmDynamicMatch,t):null;return n?me(n):null}function fx(e,t,n,r,o,i){let s=um(e);if(s.argvSource?.kind==="absent")return Se(o);if(s.argvSourceApplies&&s.argvSource){let l=ti(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ti(a,n,t,r,o,i,!0)}function ti(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return Se(o);let a=Zn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?Se(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function px(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function gx(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function Jm(e){if(e.iterations>=P.wrapperPeelIterations.cap)throw new F("wrapperPeelIterations");e.iterations++}function me(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function Se(e){return e?.recordSegment({type:"error",message:tf}),me(hx())}function hx(){return{id:"",reason:tf,intent:"stop_and_explain"}}function of(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(I(t))}function Qm(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:T(e,t)}var yx=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,Sx=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function Cx(e,t){let n=lf(e,t);if(n.length===0)return!1;let r=n[af(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return yx.test(e.join(" "))}function sf(e,t,n,r){if(e.dialect==="powershell"){let a=bx(e.words,r);if(a.kind==="none")return;if(!t||a.kind==="unknown")return null;return ef(xx(a.target),t,n.paths)}let o=e.words.map(_);if(!Cx(o,n))return;if(!t)return null;let i=lf(o,n,t),s=af(i);if(s===-1||i[s]!=="cd")return null;return ef(i[s+1],t,n.paths)}function ef(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return _x(ft(t,e,n),t,n)?t:null}catch{return null}}function bx(e,t){let n=vx(e[0])?1:0,r=e[n];if(!Ex(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!Sx.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return Rx(e.slice(n+1),t)}function vx(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function Ex(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function Rx(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function xx(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function af(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function lf(e,t,n){let r=wx(e);return pt([...r],t,n)}function _x(e,t,n){let r=n.realpath(e),o=n.realpath(t);if(r===null||o===null)return ei(e)===ei(t);return ei(r)===ei(o)}function wx(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var Na="TMPDIR",La="IFS",cf=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,uf=/^[A-Za-z_][A-Za-z0-9_]*$/,df=new Set(["export","typeset","declare","readonly"]),Ax=new Set(["builtin","command","time"]);function mf(e,t){return{env:e,effectiveEnvAssignments:Ox(e,t),shellAssignments:new Map}}function ff(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments)}}function Wa(e,t){let n=gf(e,t);n.assignments.filter((s)=>s.persists).forEach((s)=>{t.shellAssignments.set(s.name,s.value),Fa(t,s)});let r=n.commandIndex;if(r!==-1&&df.has(e[r]??""))e.filter((s)=>uf.test(s)&&Da(s)).forEach((s)=>{Mx(t,s)});let o=r===-1?-1:hf(e,r);if(o===-1||e[o]!=="unset")return;let i=Nx(e,o);if(i===null)return;e.slice(i).forEach((s)=>{Dx(t,s)})}function pf(e,t){let n=gf(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function gf(e,t){let n=e.findIndex((s)=>!Px(s)),r=n!==-1&&df.has(e[hf(e,n)]??""),o=kx(t);return{assignments:e.flatMap((s,a)=>{let l=Tx(s,o,t.env);if(!l)return[];if(n!==-1&&a>n&&!r&&!Eo(l.name))return[];return o.set(l.name,l.value),[{...l,persists:n===-1||r}]}),commandIndex:n}}function hf(e,t){let n=t;while(Ax.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function Px(e){return Pe(e)!==null||cf.test(e)}function Tx(e,t,n){return Pe(e)??Ix(e,t,n)}function Ix(e,t,n){let r=xo(e,n,t);if(r)return r;let o=e.match(cf)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Da(e){return e===Na||e===La||Gs(e)}function kx(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function Ox(e,t){let n=[...vo,Na,La].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Fa(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function Mx(e,t){Fa(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function Dx(e,t){if(!Da(t)&&!uf.test(t))return;if(e.shellAssignments.set(t,""),Eo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Da(t)||t===Na||t===La||Mn(t)){Fa(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function Nx(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var Lx="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Zt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Ua(e,t,n,r){if(t>=P.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:je}),{reason:je,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??De(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:je}),{reason:je,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((d)=>d.code.includes("heredoc"));if(c){if(!n.strict)return $a(e,n);let d=`${Wo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:d}),{reason:d,segment:e,intent:"stop_and_explain"}}return Ef(e,n),{reason:vn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Ef(e,n),{reason:vn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote"))&&!n.analyzePartialProgram)return $a(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=mf(n.environment.env,n.envAssignments);return oi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function oi(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let d=e.nodes[l+1],m=d?.kind==="connector"?d.operator:void 0,u=Wx(e,l,c,a,m),f=a==="&&"||a==="||",p=f?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=f||An(m);if(c.kind==="function"){let Y=h.flatMap((X)=>{let z=Cr(X);return z.functionDefinitions.set(c.name,c.body),Ga(X,[z],u,m==="&",An(m))}),te=za(Y,[],g,y,a,m);i=te.states,s=te.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Y=[],te=[];for(let z of h){let D=oi(c.body,t,n,r,[Cr(z)]);if(D.result)return D;if(Y.push(...Ga(z,D.states,u,m==="&",An(m))),v)te.push(z,...u?D.states.map((oe)=>ni(z,oe)):D.states)}let X=za(Y,te,g,y,a,m);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),b=e.nodes[l-2],w=ii(a)&&b?.kind==="command"?pm(b)??Gx(b):void 0,R=[],A=[];for(let Y of h){let te=zx(c,t,n,r,[Cr(Y)]);if(te.result)return{result:te.result,states:i};let X=e.dialect==="powershell"?te.states:te.states.map((z)=>ni(Y,z));for(let z of X){let D=Cr(z),oe=Ux(c,t,n.trace?{...n,trace:Rf(n.trace,E)}:n,r,D,ii(a),w);if(oe)return{result:oe,states:i};let _e=n_(c,D.functionDefinitions);if(_e)n.budget.charge("derivedTokens",si(_e));let Ye=_e?t+1>=P.recursionDepth.cap?Ba(c.displayText,n,[D]):oi(_e,t+1,n,r,[D]):{result:null,states:[D]};if(Ye.result)return Ye;if(R.push(...Ga(Y,Ye.states,u,m==="&",An(m))),v)A.push(Y),A.push(...Ye.states.map((ke)=>u?ni(Y,ke):ke))}}let K=za(R,A,g,y,a,m);i=K.states,s=K.conditionalStates,a=void 0}return{result:null,states:i}}function Wx(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ii(r)||ii(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&Fx(e,t)}function Ga(e,t,n,r,o){let i=n?t.map((a)=>ni(e,a)):[...t],s=o?i.flatMap((a)=>wn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ni(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function Fx(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(Bx(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ii(e){return e==="|"||e==="|&"}function Gx(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function An(e){return e==="&&"||e==="||"}function za(e,t,n,r,o,i){let s={success:ri([...n,...e]),failure:ri([...r,...t])},a=An(i)?s:void 0;return{states:An(o)||a?ri([...s.success,...s.failure]):s.success,conditionalStates:a}}function Rf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function zx(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=$x(e);if(s){if(t+1>=P.recursionDepth.cap)return Ba(s,n,o);let a=De(s,"powershell");if(a.status==="limited")return Ba(s,n,o);if(a.status!=="complete")return yf(i,n,r,o);n.budget.charge("derivedTokens",si(a)),i.push({program:a,depth:t+1})}}return yf(i,n,r,o)}function Bx(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function yf(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=oi(i.program,i.depth,t,n,[Cr(a)]);if(l.result)return l;s.push(...l.states)}o=ri(s)}return{result:null,states:o}}function $x(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function si(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+si(o),0):n.kind==="group"||n.kind==="function"?si(n.body):0),0)}function Ba(e,t,n){return t.trace?.recordSegment({type:"error",message:je}),{result:{reason:je,segment:e,intent:"stop_and_explain"},states:[...n]}}function Ux(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=Zx(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};xf(e,o,"before-consumer",a.environment.paths,a.budget);let c=pn(e.dialect,e.words).map(_),d=e.displayText,m=pf(c,o.shellGitContextState);if(e.dialect==="powershell"){let p=T(kd(e,i,o_(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!p,reason:p?.reason}),p)return r_(d,p)}if(c.length===1&&c[0]?.includes(" ")&&!Un(e.dialect,e.words)){let p=T(et(c[0],a.scanWork),a.policy),h=p!==null&&!a.strict&&Mu(e,a.rootProgram,a.scanWork);if(p&&!h)return a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!0,reason:p.reason}),{reason:p.reason,segment:d,ruleId:p.id,intent:p.intent};a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!1});let g=Sf(e,l,o,m,s,a);if(g)return g;return Wa(c,o.shellGitContextState),null}let u=xn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(p,h)=>{let g=h&&Object.hasOwn(h,"effectiveCwd")?h.effectiveCwd:o.effectiveCwd,y=Ua(p,t+1,{...a,effectiveCwd:g,envAssignments:h?.envAssignments??m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:h?.functionDefinitions,worktreeMode:h?.worktreeMode??a.worktreeMode,trace:a.trace?Rf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(u)return{...u,segment:d};let f=Sf(e,l,o,m,s,a);if(f)return f;return Wa(c,o.shellGitContextState),null}function Sf(e,t,n,r,o,i){let s=Xx(e,t,n,r??new Map,i);if(s)return s;return xf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),Vx(e,t,n,i.environment.paths,i.budget),e_(e,n,o,i.environment,i.trace),null}var Hx=new Set([">>","<>"]);function xf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?jx(s):Hx.has(s.operator)))continue;Cf(s.target,t,r,o)}if(n!=="before-consumer"||!xe(e.words[0],"tee"))return;let i=_f(e.words.slice(1));if(!i)return;for(let s of i.operands)Cf(s,t,r,o)}function jx(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Cf(e,t,n,r){let o=e?.provenance==="literal"?Zn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function Vx(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!ai(i))return;for(let s of Kx(e)){let a=Zn(s.text,n.effectiveCwd,r,o);if(!a||!Lu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=P.trackedHeredocFiles.cap)throw new F("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function Kx(e){let t=Yx(e.redirections)?.target,n=bf(t)?[t]:[];if(xe(e.words[0],"cat"))return qx(e.words)?n:[];if(!xe(e.words[0],"tee"))return[];let r=_f(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(bf))return[];return[...r.operands,...n]}function qx(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function Yx(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function _f(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&xe(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function bf(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function xe(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function ai(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function Zx(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return Zt;let n=t[0];if(!n?.heredoc)return Zt;if(!ai(n.heredoc))return Lx;if(n.fd!==void 0&&n.fd!==0)return Zt;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return Zt;let r=e.redirections.some((s)=>s!==n&&vf(s.target));if(xe(e.words[0],"cat"))return r?Zt:void 0;if(xe(e.words[0],"tee"))return r||e.words.slice(1).some(vf)?Zt:void 0;let o=e.words[0],i=e.words[1];if(xe(o,"git")&&(xe(i,"apply")||xe(i,"commit")))return;if(xe(o,"gh")&&(xe(i,"pr")||xe(i,"issue"))&&xe(e.words[2],"create"))return;return Zt}function vf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function Xx(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(Qx(e,i,n,r,o))return null;let a=Jx(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=$a(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function Jx(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!ai(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!Me(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=Q(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=T(S("interpreter.one-liner-paranoid",Xn),n.policy);if(c)return c}if(!Jn(s,n.scanWork))return null;let l=T(S("interpreter.dangerous-command",yn),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function Qx(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!ai(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Wt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(_),l=L(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(I(l)))return!1;return ot(a)}function e_(e,t,n,r,o){let i=sf(e,t.effectiveCwd,r,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(_).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}function Cr(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:ff(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ri(e){let t=[];for(let n of e){if(!t.some((r)=>t_(r,n)))t.push(n);if(t.length>P.controlFlowStates.cap)throw new F("controlFlowStates")}return t}function t_(e,t){return e.effectiveCwd===t.effectiveCwd&&wn(e.shellGitContextState.env,t.shellGitContextState.env)&&wn(e.literalHeredocFiles,t.literalHeredocFiles)&&wn(e.functionDefinitions,t.functionDefinitions)&&wn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&wn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)}function wn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function n_(e,t){let n=Hn(e);return n===void 0?void 0:t.get(n)}function r_(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function o_(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function $a(e,t){let n=T(et(e,t.scanWork),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Ef(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:vn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var i_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape","parallelChildAnalyses","parallelDerivedTokens","parallelDerivedBytes","parallelPlaceholderReplacements"]);function wf(e,t,n,r){let o=Ua(e,0,{...t,...tu(t),budget:t.budget??Ce(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:[{kind:"command",command:e,segment:o.segment}]}}function Af(e,t,n){try{return{decision:e()}}catch(r){let o=s_(r,t,n);if(!o)throw r;return o}}function s_(e,t,n){if(!(e instanceof F)||!i_.has(e.kind))return null;let r=P[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:[{kind:"command",command:t,segment:t}]},errorCode:r.errorCode}}var a_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),ja=new Set(["cc-safety-net","ccsn"]),l_=new Set(["bunx","npx","pnpx"]),c_=new Set(["pnpm","yarn"]),u_=new Set(["npm","pnpm","yarn"]),d_=new Set(["bun","node"]);function ci(e,t,n={}){if(ja.has(e))return 0;if(l_.has(e)){if(n.broad)return Ha(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return li(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&u_.has(e)&&n.broad&&t[r]==="exec"){let o=Ha(t.slice(r+1));return o===null?null:r+1+o}if(c_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&li(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ha(t.slice(r+1));return o===null?null:r+1+o}if(d_.has(e)){let o=n.broad&&r!==-1?r:0;if(Pf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Pf(t[o+1]))return o+2}return null}function Ha(e){let t=e.findIndex((r)=>li(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!li(r))break;n++}return n}function li(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return ja.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return ja.has(e.slice(0,t))}function Pf(e){let t=e?.replaceAll("\\","/");return[...a_].some((n)=>t===n||t?.endsWith(`/${n}`))}var Tf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function If(e,t,n){let r=ue(e,"input-candidate");if(!r)return null;let o=Cn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>m_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function m_(e,t){let n=pt([...e],t),r=n.slice(1),o=ci(I(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as ui}from"path";var Df="This path contains the protected policy config and you must not modify or delete it.",f_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Nf(e,t,n){let r=C_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return kf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ue(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Of(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Of(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return kf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Lr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function kf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>br(a,n,r,o,i));return s?{target:s}:null}function Of(e,t,n,r,o){let i=Cn(e,t,r,o,{findSegmentTarget:(s,a)=>p_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>br(s,a.cwd,n,r,o),findMalformedTarget:(s)=>S_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function p_(e,t,n,r,o){if(rr(e))return null;let i=gt([...e],r),s=I(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&g_(a)){let l=h_(a).find((c)=>Mf(ge(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Uo(i,1)||aa(i,r)){let c=($o(q(i))??q(["."])).find((d)=>{let m=ge(d.text,t.variables);return br(m,t.cwd,n,r,o)||Mf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Oo(a).sources.find((c)=>b_(ge(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(y_(e,r))return null;for(let l of[...e,...i])for(let c of Lf(l))if(br(ge(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function g_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function h_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function y_(e,t){let n=gt([...e],t);if(n.length===0)return!1;let r=I(n[0]??"").toLowerCase();if(!f_.has(r))return!1;if(r!=="sed")return!0;return!n.slice(1).some((o)=>o.startsWith("-i")||o==="--in-place"||o.startsWith("--in-place="))}function S_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Lf(i))if(br(s,t,n,r,o))return{target:s};return null}function Lf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function C_(e,t,n){let r=(a)=>vr(ie(a,e.executionCwd,t,n)),o=r(ln(t)),i=[r(Fn(e.executionCwd)),r(Fn(e.configCwd))],s=new Set(i.map((a)=>ui(a)));for(let a=ui(o);;a=ui(a))if(s.add(a),ui(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function br(e,t,n,r,o){let i=Sl(e,t,r,o,(s)=>vr(s)===Br);return i!==null&&n.files.has(vr(i))}function Mf(e,t,n,r,o){return n.directoriesAndAncestors.has(vr(ie(e,t,r,o)))}function b_(e,t,n,r,o){let i=vr(ie(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function vr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as di,posix as v_,resolve as fi,win32 as E_}from"path";import{fileURLToPath as R_}from"url";var Kf="Access to a sensitive path is not allowed.",qf=new Set(["echo","printf"]),x_=new Set(["find"]),__=new Set(["-exec","-execdir"]),w_=new Set([";","+"]),A_=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),P_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Yf=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),T_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),I_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Zf=new Set(["-c","-e","-r","-E","--eval","--exec"]),k_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),O_=new Set(["grep","rg"]),Wf=new Set(["jq","gojq","jaq"]),Ff="f",Gf="file",M_="files",D_=new Set(["e","f"]),N_=new Set(["regexp","file"]),L_=new Set(["e","f","A","B","C","m"]),W_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Va="__CC_SAFETY_NET_PIPE_INPUT__",qa=/[\w./~@+-]*[./~][\w./~@+-]*/g,F_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,G_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,z_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,B_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,$_=/\b(?:system|exec)\s*$/,U_=/\b(?:eval|exec)\s*\(/g,H_=/\b(?:eval|exec)\s*$/,j_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function zf(e,t,n,r,o,i){for(let s of e){let a=s.target;if($w(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=zw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&Uw(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Xf(e,t,n,r,o={}){let i=Bf(e,n,r),s=zf(i,t,e.invocation.context.configCwd,n,r),a=s?.ruleId!=="secret.deny-path"&&o.strict===!1?Bf(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:zf(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&V_(e,n))return null;return l}function V_(e,t){let n=ue(e,"input-candidate")??ue(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of ko(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(tt(a.text,t))}let o=Et(r);if(o.length===0)return!1;let i=lt(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>A_.has(a))}function Bf(e,t,n,r={}){let o=e.invocation.context.executionCwd;if(e.invocation.route.kind==="command"){let s=ue(e,"input-candidate");return s?Xt(s.shell,e.store,r,t,o,n,$f(s)):[]}if(e.invocation.route.kind!=="unknown")return e.paths.map((s)=>({target:s,cwd:o}));let i=ue(e,"input-candidate");return[...i?Xt(i.shell,e.store,r,t,o,n,$f(i)):[],...e.paths.map((s)=>({target:s,cwd:o}))]}function $f(e){return e.program.dialect==="powershell"}function Xt(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Fe;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...Ew(tt(e.source,r),t,n,r,o,i)],l=(c)=>tt(rw(c,s),r);return Io(e,o,r,i,{word:l,segment:(c,d,m,u,f)=>{if(c.length===0)return null;if(a.push(...pi(c,t,n,r,d.cwd,i,f)),m!==null)a.push(...q_(m,c,t,n,r,d.cwd,i));return null},redirection:(c,d)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Jf(c.consumer,[c.body],t,n,r,d.cwd,i,(m)=>Y_(c.consumer??[],m,t,n,r,d.cwd,i)));if(c.targetOrder==="legacy-segment")return Us;return a.push({target:l(c.target),cwd:d.cwd}),null}}),a}function Ya(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Fe;return s.status==="complete"?Xt(s,t,n,r,o,i):null}function pi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(Wf.has(lt(Et(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...pi(p,t,n,r,o,i)]}let l=nw(e).map(a),c=Et(e);if(c.length===0)return l;let d=c[0]??"",m=lt(d).toLowerCase(),u=c.slice(1),f=K_(d,m,u);if(f)return[...l,...f.map(a)];if(qf.has(m))return n.capturedOutput===!0?[...l,...Qf(e).map(a)]:l;if(m==="eval")return[...l,...Ya(u.join(" "),t,n,r,o,i)??u.map(a)];if(m==="export")return[...l,...u.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:at(m,p)).map(a)];if(m==="git")return[...l,...iw(u).map(a)];if(Wf.has(m))return[...l,...ow(u).map(a)];if(O_.has(m))return[...l,...Iw(u).map(a)];if(x_.has(m))return[...l,...cw(u,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...u.flatMap((p)=>at("awk",p)).map(a),...u.flatMap((p)=>dw(p,t,n,r,o,i)),...u.flatMap(mw).map(a)];if(m==="curl")return[...l,...u.flatMap((p)=>at(m,p)).map(a),...sw(u).map(a)];if(or(m)){let p=nr.has(m)?mc(m,u):null;if(p!==null){let h=t.getShellSyntax(p);if(h.status==="structural-limit")throw new Fe;if(h.status==="complete")return[...l,...Xt(h,t,n,r,o,i),...u.slice(u.indexOf(p)+1).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...uw(m,u,t,n,r,o,i)]}return[...l,...u.flatMap((p)=>at(m,p)).map(a)]}function K_(e,t,n){let r=ci(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function q_(e,t,n,r,o,i,s){if(Q_(t,n,r,o,i,s))return Qf(e).map((a)=>({target:a,cwd:i}));return Jf(t,Z_(e),n,r,o,i,s,()=>[])}function Y_(e,t,n,r,o,i,s){let a=Et(e);if(!or(lt(a[0]??"").toLowerCase()))return[];return Ya(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Jf(e,t,n,r,o,i,s,a){let l=ew(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>nr.has(l)?Xt(n.getShellSyntax(c),n,r,o,i,s):mi(l,c,n,r,o,i,s))}function Qf(e){let t=Et(e);if(t.length===0)return[];let n=lt(t[0]??"").toLowerCase();if(!qf.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Za(r.replaceAll("%%","%"))];return t.slice(1)}function Z_(e){let t=Et(e);if(t.length===0)return[];let n=lt(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return X_(r);return[]}function X_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Za(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>J_(t,r.slice(i*n,(i+1)*n)))}function J_(e,t){let n=0;return Za(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Za(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Q_(e,t,n,r,o,i){let s=Et(e);if(s.length===0||lt(s[0]??"").toLowerCase()!=="xargs")return!1;let a=jt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,Va]:l.map((m)=>m.split(c).join(Va));return pi(d,t,n,r,o,i).some((m)=>m.target.includes(Va))}function ew(e){let t=Et(e);if(t.length===0)return null;let n=lt(t[0]??"").toLowerCase();if(!or(n))return null;return tw(n,t.slice(1))?n:null}function tw(e,t){let n=Xa(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Zf.has(o)||ep(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(j_.get(n)?.has(o))r++;continue}return!1}return!0}function Xa(e){return/^python\d/.test(e)?"python":e}function nw(e){let t=[];for(let n of e){if(np(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Uf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function rw(e,t){if(!t||!Uf.test(e))return e;return`~${e.replace(Uf,"").replace(/\\/g,"/")}`}function at(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function ow(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>at("jq",i))}return e.flatMap((r,o)=>o===t?[]:at("jq",r))}function iw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>at("git",i))];if(t.push(...at("git",r)),!le.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:at("git",o)),n++}return t}function sw(e){return e.flatMap((t,n)=>{let r=lw(t);if(r!==null)return Hf(r.flag,r.value);let o=aw(e[n-1]);return o===null?[]:Hf(o,t)})}function Hf(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Ka(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Ka(t.slice(n+1))}return t.startsWith("@")?Ka(t.slice(1)):[]}function aw(e){if(e===void 0)return null;if(Yf.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function lw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Yf.has(r)?{flag:r,value:e.slice(n+1)}:null}function Ka(e){return e===""||e==="-"?[]:[e]}function cw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!__.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((f)=>w_.has(f)),m=d===-1?c:c.slice(0,d),u=pi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...u.filter((f)=>f!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,h)=>{if(!P_.has(f))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function uw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Zf.has(c)||ep(e,c)){let m=t[l+1];if(m!==void 0)a.push(...mi(e,m,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...mi(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function ep(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return k_.get(t[t.length-1]??"")?.has(Xa(e))??!1}function dw(e,t,n,r,o,i){if(!e.includes("system"))return[];return ra(e)?.commands.flatMap((s)=>Xt(t.getShellSyntax(s),t,n,r,o,i))??[]}function mw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function fw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((r)=>r[2]).filter((r)=>r!==void 0&&r!==""),n=(e.match(qa)??[]).filter((r)=>r!=="process.versions.sqlite"||t.some((o)=>o.includes(r)));return[...t,...t.flatMap(Ja),...n]}function mi(e,t,n,r,o,i,s){let a=(f)=>({target:f,cwd:i}),l=gw(t,pw(e));if(l===null)return fw(t).map(a);let c=l.masked.match(B_)!==null||l.literals.some((f)=>$_.test(l.masked.slice(0,f.start))),d=l.masked.match(U_)!==null||l.literals.some((f)=>H_.test(l.masked.slice(0,f.start))),m=r.refineInlineData===!0&&!nr.has(e),u=m&&!(Cw(l.masked)||c||d)?[]:l.literals;return[...u.map((f)=>f.text).filter((f)=>f!=="").map(a),...u.flatMap((f)=>Ja(f.text)).map(a),...m?[]:l.literals.flatMap((f)=>f.text.match(qa)??[]).filter((f)=>f!=="process.versions.sqlite").map(a),...c?l.literals.flatMap((f)=>Ya(f.text,n,r,o,i,s)??[a(f.text)]):[],...d?l.literals.flatMap((f)=>mi(e,f.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
+`:h),n,r,o,i,s)):[],...(l.masked.match(qa)??[]).filter((f)=>f!=="process.versions.sqlite").map(a)]}function pw(e){let t=Xa(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function gw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(G_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&Sw(e,o))return null;let a=t==="python"?hw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,d=yw(e,c,l);if(d===null)return null;let m=e.slice(c,d);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&z_.test(m))return null;r.push({start:c,text:m});for(let u=o;u<d+l.length;u++)n[u]=" ";o=d+l.length-1}return{masked:n.join(""),literals:r}}function hw(e,t){return F_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function yw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function Sw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function Cw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(T_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>I_.has(i)))continue;if(o.length>1)return!0;if(bw(e,r)===".")return!0;if(vw(e,r+n.length)==="(")return!0}return!1}function bw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function vw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function Ew(e,t,n,r,o,i){return Aw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Xt(a,t,{...n,capturedOutput:!0},r,o,i),...Rw(a,r)?xw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function Rw(e,t){let n=ko(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||lt(tt(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=tt(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function xw(e,t){return ko(e).flatMap((n)=>n.kind==="word"?[tt(n.text,t)]:n.kind==="redirection"&&n.target?[tt(n.target,t)]:[]).flatMap(Ja)}function Ja(e){let t=ww(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||_w(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function _w(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function ww(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function Aw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Gn(o,n))continue;if(tp(e,r,n)){let i=Pw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=Tw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function Pw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Gn(i,n))continue;if(tp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function Tw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function tp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function Iw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let m=d[1]??"",u=d[2];if(m===M_)o=!0;if(N_.has(m))r=!0;if(u!==void 0){if(m===Gf)t.push(u);continue}if(W_.has(m)){let f=e[l+1];if(m===Gf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),u="",f="";for(let h=0;h<m.length;h++){let g=m[h]??"";if(D_.has(g))r=!0;if(L_.has(g)){u=g,f=m.slice(h+1);break}}if(u==="")continue;if(f.length>0){if(u===Ff)t.push(f);continue}let p=e[l+1];if(u===Ff&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Et(e){let t=e.findIndex((n)=>!np(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function np(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var kw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Ow=".env.",Mw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),Dw=[".env.example.",".env.sample."];function Nw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Lw(e){return e.length>0&&!/\s/.test(e)}function Ww(e,t,n,r){try{let o=xr(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof F)throw o;return!1}}var Fw=new Set(["node_modules","__pycache__"]),Gw=[["vendor","bundle"],["vendor","cache"]];function zw(e,t,n,r,o){if(Nw(e))return null;let i=qe(e,t,r,o);if(!i)return null;let s=H(i.split("/").pop()??""),a=H(i),l=()=>Lw(s)||Ww(e,t,r,o);if(Mw.has(s)||Dw.some((u)=>s.startsWith(u)))return null;let c=H(Vw(e,t,r,o));for(let u of es){let f=`~/${u.suffixParts.join("/")}`;if((Vf(a,f)||Vf(c,f))&&st(u.id,n))return u.id}let d=Bw(i,t,n,r,o);if(d)return d;if(kw.has(s))return null;for(let u of Qi)if(s===u.basename&&st(u.id,n))return u.id;if(s.startsWith(Ow)&&st(qr.id,n)&&l())return qr.id;for(let u of ts)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let f=s.slice(u.prefix.length)[0];if((f==="-"||f==="_")&&st(u.id,n)&&l())return u.id}for(let u of ns)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&st(u.id,n))return u.id}if(Hw(a))return null;if(!s.includes(".")&&zn.pattern.test(s)&&st(zn.id,n))return zn.id;let m=jw(s,n);if(m)return m;return null}function Bw(e,t,n,r,o){return Yr.find((i)=>{if(!st(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,U(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=H(e).split("/");return W(e,U(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Rr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,qe("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=U(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Er(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=U(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=H(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ae(U(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=H(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ae(U(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ae(U(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Rr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,qe(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=U(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Er(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,U(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=U(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=U(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Er(e,s,["credentials"])||Er(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=H(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,U(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,U(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ae(U(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=H(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((d)=>Rr(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?U(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ae(U(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(H(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?Rr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>W(e,qe(d,t,r,o),l))}case"secret.cli.pi":return W(e,U(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,U(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=qe("~",t,r,o);return[ae(U(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ae(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Er(e,ae(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ae(qe("~",t,r,o),".config","amp")],l=H(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>W(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Rr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ae(U(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,qe("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||H(e).split("/").at(-1)==="mcp-auth.json"&&Jt(H(e),H(a))}case"secret.cli.cursor.config":{let s=H(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,U(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=H(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,U(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,qe("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var jf=new WeakMap;function U(e,t,n,r,o){let i=jf.get(o)??new Map;jf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=qe(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>rp(e,ae(t,r)))}function Er(e,t,n){return n.some((r)=>Jt(H(e),H(ae(t,r))))}function Rr(e,t,n,r,o){return rp(e,qe(t,n,r,o))}function rp(e,t){return H(e)===H(t)}function ae(e,...t){return He([e,...t].filter(Boolean).join("/"))}function $w(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(xr(e,t,o,i));return n.some((a)=>Jt(s,H(xr(a,r,o,i))))}function Uw(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(xr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?He(B(be(a),o.paths,i)):"",c=H(l),d=o.env.get("CC_SAFETY_NET_HOME"),m=H(d?He(B(fi(be(d)),o.paths,i)):l&&He(B(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Jt(s,m))return!1;return n.some((u)=>{let f=H(xr(u,r,o,i));if(!f)return!1;if(c&&(c===f||c.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return Jt(s,f)})}function Hw(e){let t=e.split("/");return t.some((n)=>Fw.has(n))||Gw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function jw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of rs)if(r===o.extension&&st(o.id,t))return o.id;for(let o of os)if(o.pattern.test(r)&&st(o.id,t))return o.id;return null}function H(e){return e.toLowerCase()}function st(e,t){return!t?.disabledRules?.includes(e)}function qe(e,t,n,r){let{home:o,normalized:i}=Qa(e,n,r);if(!i)return"";if(!o)return i;let s=el(i,o),a=di(s)?s:He(fi(t,s)),l=He(B(a,n.paths,r));if(!Jt(l,o)){if(di(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Vf(e,t){return e===t||e.startsWith(`${t}/`)}function Vw(e,t,n,r){let{home:o,normalized:i}=Qa(e,n,r);if(!i||!o)return"";let s=el(i,o),a=v_.normalize(di(s)?s:He(fi(t,s))),l=He(be(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&Jt(c(a),c(u)));if(d===void 0)return"";let m=a.slice(d.length);return m?`~${m}`:"~"}function xr(e,t,n,r){let{home:o,normalized:i}=Qa(e,n,r);if(!i)return"";let s=o?el(i,o):i;return He(B(di(s)?s:fi(t,s),n.paths,r))}function Qa(e,t,n){let r=t.env.get("HOME")??t.home,o=r?He(B(be(r),t.paths,n)):"",i=He(be(Kw(tt(e,t))));return{home:o,normalized:i}}function Kw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return R_(e)}catch{return e}}function el(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ae(t,e.slice(2));return e}function qw(e){if(process.platform==="win32")return!0;return E_.parse(e).root.length>1}function He(e){let t=e.trim(),n=(t.includes("\\")&&qw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function lt(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Qt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Yw={findPolicyMutation:Nf,findGitMetadataMutation:md,resolveGitMetadata:Zw,loadPolicySnapshot:eu,findSensitiveTarget:Xf,analyzeCommand:wf,getModes:Pi};function op(e,t){let n={...Yw,...t.dependencies},r=Qw(e),o=_r(e)?e.command:r,i=Rt("policy-protection",o,()=>ir(e,t.factParserDependencies)),s=ue(i,"input-candidate"),a=ue(i,"declared-command");if(_r(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:je,intent:"stop_and_explain",evidence:[{kind:"command",command:e.command,segment:e.command}]}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Od,intent:"stop_and_explain",evidence:[]}};let l=Ce(),c=Rt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),d=Rt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Df,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:d.target}]}}}let m=Rt("policy-protection",o,()=>If(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Tf,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:m.target}]}}}let u=Rt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:u.target}]}}}let f=Rt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...Xw(f)},y=p.secretProtection.enabled===!1?null:Rt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:_r(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:Kf,intent:"hard_stop",ruleId:y.ruleId,evidence:[{kind:"command",command:E,segment:y.target}]}}}if(!_r(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...tl("command-validation",o),...g};let v=Rt("command-analysis",o,()=>Af(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Jw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function Zw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Xw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Jw(e){return ue(e,"declared-command")?.program}function Qw(e){try{return Ln(e.input)}catch(t){let n=_r(e)?e.command:void 0;throw new Qt("policy-protection",tl("policy-protection",t instanceof Xe?void 0:n,t),t)}}function Rt(e,t,n){try{return n()}catch(r){throw new Qt(e,tl(e,r instanceof Xe?void 0:t,r),r)}}function tl(e,t,n){let r=n instanceof F||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?bi:In,intent:"stop_and_explain",evidence:t?[{kind:"command",command:t,segment:t}]:[]}}}function _r(e){return e.route.kind==="command"}import{appendFileSync as mA,mkdirSync as fA}from"fs";import{isAbsolute as pA,join as ol}from"path";import{lstatSync as sp,readdirSync as eA,readFileSync as tA,rmdirSync as nA,statSync as ap,unlinkSync as rA,utimesSync as oA,writeFileSync as iA}from"fs";import{join as wr}from"path";function ip(e,t={}){return to(ln(e,t),e.home).policy.audit.retention_days}var rl=86400000,sA=".last-prune",aA=/^\d{4}-\d{2}$/,lA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,lp=(e)=>Math.floor(e/rl);function up(e,t,n=()=>new Date){try{let r=n().getTime();if(!ap(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=wr(t,sA),i=ap(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&lp(i)===lp(r))return;let s=r-ip(e)*rl,a=new Date(r).toISOString().slice(0,7);for(let l of nl(t)){if(l.isDirectory()){cA(wr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))uA(wr(t,l.name),s)}iA(o,"",{mode:384}),oA(o,r/1000,r/1000)}catch{}}function cA(e,t,n){for(let r of nl(e)){if(!r.isDirectory()||!aA.test(r.name))continue;let o=wr(e,r.name);for(let i of nl(o)){if(!i.isFile())continue;let s=lA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+rl;if(!Number.isFinite(a)||a>=t)continue;dp(wr(o,i.name))}if(r.name!==n)cp(o)}cp(e)}function uA(e,t){try{let n=sp(e);if(n.mtimeMs>=t)return;let r=tA(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(dA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(sp(e).mtimeMs!==n.mtimeMs)return;dp(e)}catch{}}function dA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function nl(e){try{return eA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function dp(e){try{rA(e)}catch{}}function cp(e){try{nA(e)}catch{}}var gA="2.4.0",hA=1e4,yA=2000,SA=256,CA=32768;function bA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function vA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function il(e,t,n,r,o,i,s={}){let a=bA(t);if(!a)return;let l=RA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=gi(ct(n),s.failureStage?Number.POSITIVE_INFINITY:hA),m=gi(ct(r),yA),u=s.toolName?gi(ct(s.toolName),SA):void 0,f=i===null?void 0:gi(ct(i),CA),p=ol(l,vA(f?.value??null),c.slice(0,7));fA(p,{recursive:!0,mode:448});let h=ol(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Li)(),v:gA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:m.value,...d.truncated||m.truncated||u?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};mA(h,`${JSON.stringify(g)}
+`,{encoding:"utf-8",mode:384}),up(e,l,s.now)}catch{}}function gi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function EA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&pA(n)?n:null}function RA(e){let t=EA(e);return t?ol(t,".cc-safety-net","logs"):null}function fp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=mp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence.find((a)=>a.kind==="command"),s=i?.command??(r?mp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function mp(e){return"command"in e?e.command??"":""}function pp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;il(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function gp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;il(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function yp(e,t,n){try{let r=op(t,{environment:e,...n.guard});return hp(e,t,r,n),r}catch(r){if(!(r instanceof Qt))throw r;throw hp(e,t,r.evaluation,n,!(r.cause instanceof Xe),{stage:r.stage,errorCode:xA(r.cause)}),r}}function hp(e,t,n,r,o=!0,i){pp(e,fp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function xA(e){if(e instanceof F)return P[e.kind].errorCode;if(e instanceof Xe)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}var Cp=wA();function wA(e={}){return(t,n)=>{try{return AA(t,n,e)}catch(r){return console.error("CC Safety Net error:",r),sl(Tr())}}}function AA(e,t,n){let r=wl(),o=PA(e,t,r.paths),i=()=>kA(e);if("malformed"in o)return gp(r,o.denial,i,{agent:"amp",toolName:o.denial.toolName,cwd:o.cwd}),sl(o.denial);try{let s=yp(r,o,{guard:{auditAllowed:Al(r.env),dependencies:n.guardDependencies},audit:{agent:"amp",getSessionId:i}});return Sp(s,!0)}catch(s){if(!(s instanceof Qt))throw s;if(At(ee.debug,r.env))console.error(`CC Safety Net debug: amp tool.call analysis failed: ${fl(s.cause)}`);return Sp(s.evaluation,o.route.kind==="command")}}function PA(e,t,n){if(!e||typeof e!=="object")return Pn(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return Pn(null);if(!r.input||typeof r.input!=="object")return Pn(null,r.tool);let o=TA(t,n);if(!o)return Pn(null,r.tool);let i=IA(t,e);if(!i.ok)return Pn(o,r.tool);if(!i.command)return an(r.tool,r.input,{kind:Mi(r.tool)},{configCwd:o,executionCwd:o},null);if(typeof i.command.command!=="string"||i.command.command.trim()==="")return Pn(o,r.tool);let s=typeof i.command.dir==="string"?jl(i.command.dir,o,n):o;if(!s)return{malformed:!0,denial:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",command:i.command.command,segment:i.command.dir,toolName:r.tool},cwd:o};return an(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:o,executionCwd:s},i.command.command)}function TA(e,t){let n=e.system.workspaceRoot;if(!n)return;try{let r=e.helpers.filePathFromURI(n);if(typeof r!=="string"||r.trim()==="")return;return Hl(".",[r],t)}catch{return}}function IA(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function kA(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function Pn(e,t){return{malformed:!0,denial:Tr({toolName:t}),cwd:e}}function Sp(e,t){let n=dl(e,{includeEvidence:t});return n?sl(n):{action:"allow"}}function sl(e){return{action:"reject-and-continue",message:ml(e)}}function OA(e){e.on("tool.call",(t)=>Cp(t,e))}export{OA as default};