cc-safety-net 2.3.4 → 2.4.0

package/dist/amp/cc-safety-net/index.ts

@@ -1,100 +1,52 @@
 // cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp
-// version: 2.3.4
+// version: 2.4.0
 // @bun
-var cw=Object.defineProperty;var lw=(e)=>e;function uw(e,t){this[e]=lw.bind(null,t)}var un=(e,t)=>{for(var n in t)cw(e,n,{get:t[n],enumerable:!0,configurable:!0,set:uw.bind(t,n)})};import{randomBytes as iR}from"crypto";import{appendFileSync as sR,mkdirSync as aR}from"fs";import{homedir as cR,userInfo as lR}from"os";import{isAbsolute as uR,join as zl}from"path";var dw=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function It(e){let t=e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>");return mw(t)}function mw(e){let t=e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>");for(let n of dw)t=t.replace(n,"<redacted>");return t.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}import{lstatSync as ey,readdirSync as Vw,readFileSync as oy,rmdirSync as Hw,statSync as ty,unlinkSync as qw,utimesSync as Kw,writeFileSync as Yw}from"fs";import{dirname as Jw,join as Kn}from"path";var zi=30,wl=1,Rl=365;function Ni(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}import{homedir as Nw}from"os";import{dirname as Vn,isAbsolute as Dw,join as Hn,relative as Mw,resolve as pn,sep as $w}from"path";import{lstatSync as fw,realpathSync as pw}from"fs";import{homedir as gw,tmpdir as hw}from"os";var Be={realpath:(e)=>{try{return pw(e)}catch{return null}},entryKind:(e)=>{let t=fw(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"}};function Ne(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function dn(){return Ne(process.env.HOME||gw())}function Xe(){return{env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:dn(),tmpdir:hw(),paths:Be}}import{closeSync as yw,constants as Mh,fstatSync as bw,fsyncSync as E1,lstatSync as $h,mkdirSync as w1,openSync as vw,readdirSync as R1,readFileSync as _w,realpathSync as Di,renameSync as P1,rmdirSync as A1,statSync as Sw,unlinkSync as k1,writeFileSync as T1}from"fs";import{isAbsolute as Lh,join as Wh,normalize as xw,parse as Cw,relative as Pl,resolve as Al,sep as kl}from"path";var Ew=Symbol("PolicyFilesystemScope"),ww=Symbol("PolicyFilesystemTarget"),Rw=Mh.O_NOFOLLOW??0;class fe extends Error{constructor(e){super(`Unable to access ${e} filesystem safely.`);this.name="PolicyFilesystemError"}}function mn(e,t){return{[Ew]:!0,root:Al(e),label:t}}function Fh(e,t){let n=xw(t);if(t===""||Lh(t)||n===".."||n.startsWith(`..${kl}`))throw new fe(e.label);return{[ww]:!0,scope:e,relativePath:n,path:Wh(e.root,n)}}function Xr(e,t){let n=Pl(e.root,Al(t));return Fh(e,n)}function Gh(e,t="rules policy"){let n=Al(e),r=Cw(n).dir;return Fh(mn(r,t),Pl(r,n))}function $i(e){try{if(!Mi(e,!1).exists)return null;let n=vw(e.path,Mh.O_RDONLY|Rw);try{let r=bw(n);if(!r.isFile())throw new fe(e.scope.label);let o=_w(n,"utf-8"),i=$h(e.path);if(!i.isFile()||i.isSymbolicLink()||r.dev!==i.dev||r.ino!==i.ino)throw new fe(e.scope.label);return Mi(e,!1),o}finally{yw(n)}}catch(t){kw(e.scope.label,t)}}function Zh(e,t){if(e.path===t.path)return!0;try{if(!Mi(e,!1).exists||!Mi(t,!1).exists)return!1;return Di(e.path)===Di(t.path)}catch(n){if(n instanceof fe)throw n;throw new fe(e.scope.label)}}function Mi(e,t,n="file"){let r=Pw(e.scope);if(!r)return{exists:!1};let o=e.relativePath.split(kl);for(let i of o.keys()){let s=Wh(e.scope.root,...o.slice(0,i+1)),a=Uh(s);if(!a){if(i===o.length-1&&t)return{exists:!1};return{exists:!1}}if(a.isSymbolicLink())throw new fe(e.scope.label);if(i<o.length-1&&!a.isDirectory())throw new fe(e.scope.label);if(i===o.length-1&&(n==="file"?!a.isFile():!a.isDirectory()))throw new fe(e.scope.label);Aw(r,Di(s),e.scope.label)}return{exists:!0}}function Pw(e){if(!Uh(e.root))return null;if(!Sw(e.root).isDirectory())throw new fe(e.label);return Di(e.root)}function Aw(e,t,n){let r=Pl(e,t);if(r===".."||r.startsWith(`..${kl}`)||Lh(r))throw new fe(n)}function Uh(e){try{return $h(e)}catch(t){if(Tw(t)&&t.code==="ENOENT")return null;throw t}}function kw(e,t){if(t instanceof fe)throw t;throw new fe(e)}function Tw(e){return e instanceof Error&&"code"in e}var fn=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,jh="rulebook.json",Bh=".cc-safety-net/rules";var Vh=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Iw=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Ow=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),zw="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),z1=new RegExp(`^${Ow}/(${fn.source.slice(1,-1)})/${zw}$`);function Hh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function qh(e){if(Li(e))try{return Tl(e),null}catch(t){return t instanceof Error?t.message:String(t)}return fn.test(e)?null:`Local rulebook sources must be bare names matching ${fn}: ${e}`}function Tl(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Vh);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Iw.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!fn.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Hh(o),name:o}}function Li(e){return Vh.test(e)}var Kh="rule.json",gn="policy.json";var Yh=".cc-safety-net",Lw="rules",Ww="CC_SAFETY_NET_HOME",Jh="`cc-safety-net rule update`";function Fw(e){return pn(e??process.cwd(),Bh)}function Gw(e){return Hn(Fw(e),Kh)}function Qr(e){return Hn(pn(e??process.cwd()),Yh,gn)}function qn(e){return e?.userConfigDir??(e?.userConfigPath?Vn(e.userConfigPath):Hn(Zw(),Lw))}function Zw(){let e=process.env[Ww];return e?pn(Ne(e)):Hn(Nw(),Yh)}function Uw(e){return Hn(qn(e),Kh)}function Xh(e){let t=e.userConfigPath??Uw(e),n=e.projectConfigPath??Gw(e.cwd),r=jw(t,e),o=Bw(n,e);return{userConfigPath:t,projectConfigPath:n,userScope:r,projectScope:o,userConfigTarget:Xr(r,t),projectConfigTarget:Xr(o,n)}}function jw(e,t){let n=t.userConfigPath?Vn(Vn(pn(t.userConfigPath))):Vn(pn(t.userConfigDir??qn(t)));return mn(n,"user policy")}function Bw(e,t){let n=pn(t.cwd??process.cwd()),r=pn(e),o=Mw(n,r);if(o!==".."&&!o.startsWith(`..${$w}`)&&!Dw(o))return mn(n,"project policy");return mn(Vn(Vn(r)),"project policy")}function Qh(e,t){return Hn(e,t,jh)}var Ol=86400000,Xw=".last-prune",Qw=/^\d{4}-\d{2}$/,eR=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,ny=(e)=>Math.floor(e/Ol);function tR(e){try{let t=Kn(Jw(qn(e)),gn),n=JSON.parse(oy(t,"utf-8"));return Ni(n?.audit?.retention_days)}catch{return zi}}function iy(e,t=()=>new Date){try{let n=t().getTime();if(!ty(e,{throwIfNoEntry:!1})?.isDirectory())return;let r=Kn(e,Xw),o=ty(r,{throwIfNoEntry:!1})?.mtimeMs;if(o!==void 0&&ny(o)===ny(n))return;let i=n-tR()*Ol,s=new Date(n).toISOString().slice(0,7);for(let a of Il(e)){if(a.isDirectory()){nR(Kn(e,a.name),i,s);continue}if(a.isFile()&&a.name.endsWith(".jsonl"))rR(Kn(e,a.name),i)}Yw(r,"",{mode:384}),Kw(r,n/1000,n/1000)}catch{}}function nR(e,t,n){for(let r of Il(e)){if(!r.isDirectory()||!Qw.test(r.name))continue;let o=Kn(e,r.name);for(let i of Il(o)){if(!i.isFile())continue;let s=eR.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+Ol;if(!Number.isFinite(a)||a>=t)continue;sy(Kn(o,i.name))}if(r.name!==n)ry(o)}ry(e)}function rR(e,t){try{let n=ey(e);if(n.mtimeMs>=t)return;let r=oy(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(oR);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(ey(e).mtimeMs!==n.mtimeMs)return;sy(e)}catch{}}function oR(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Il(e){try{return Vw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function sy(e){try{qw(e)}catch{}}function ry(e){try{Hw(e)}catch{}}var dR="2.3.4",mR=1e4,fR=2000,pR=256,gR=32768;function hR(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function yR(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Nl(e,t,n,r,o,i={}){let s=hR(e);if(!s)return;let a=i.homeDir??ay();if(!a)return;let c=bR(a);if(!c)return;try{let l=(i.now??(()=>new Date))().toISOString(),u=Wi(It(t),i.failureStage?Number.POSITIVE_INFINITY:mR),d=Wi(It(n),fR),m=i.toolName?Wi(It(i.toolName),pR):void 0,f=o===null?void 0:Wi(It(o),gR),p=zl(c,yR(f?.value??null),l.slice(0,7));aR(p,{recursive:!0,mode:448});let h=zl(p,`${l.slice(0,10)}-${s}.jsonl`),y={ts:l,id:(i.createId??(()=>iR(8).toString("hex")))(),v:dR,sessionId:s,decision:i.decision??"deny",agent:i.agent,shape:i.shape,level:i.level,configFallback:i.configFallback,toolName:m?.value,command:u.value,segment:d.value,...u.truncated||d.truncated||m?.truncated||f?.truncated?{truncated:!0}:{},reason:r,ruleId:i.ruleId,intent:i.intent,failureStage:i.failureStage,errorCode:i.errorCode,cwd:f?.value??null};sR(h,`${JSON.stringify(y)}
-`,{encoding:"utf-8",mode:384}),iy(c,i.now)}catch{}}function Wi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function ay(e=process.env.CC_SAFETY_NET_AUDIT_HOME||process.env.HOME){let t=e||cR()||lR().homedir;return t&&uR(t)?t:null}function bR(e=ay()){return e?zl(e,".cc-safety-net","logs"):null}function ly(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=cy(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence.find((a)=>a.kind==="command"),s=i?.command??(r?cy(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function cy(e){return"command"in e?e.command??"":""}function uy(e,t,n){if(!e)return;let r;try{r=t()}catch{return}if(typeof r!=="string"||!r.trim())return;Nl(r,e.command,e.segment,e.reason,e.cwd,{homeDir:n.homeDir,decision:e.decision,agent:n.agent,shape:n.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function dy(e,t,n){let r;try{r=t()}catch{return}if(typeof r!=="string"||!r.trim())return;Nl(r,e.command??"",e.segment??e.command??"",e.reason,n.cwd??null,{homeDir:n.homeDir,decision:"deny",agent:n.agent,shape:n.shape,toolName:n.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}import{accessSync as aL,constants as cL,realpathSync as RR,statSync as PR}from"fs";import{isAbsolute as Ml,relative as AR,resolve as my,sep as kR}from"path";import{dirname as vR,isAbsolute as _R,parse as SR,sep as xR}from"path";function Zt(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ut(e,t,n){if(Zt(t))throw Error("Unsupported Windows namespace path");let r=_R(t)?ER(t):"",o=r||e;for(let i of wR(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=vR(o);continue}let s=CR(o,i),a=n.entryKind(s),c=a==="symlink"?n.realpath(s):s;if(a==="missing"||c===null)throw Error(`Cannot resolve path component: ${s}`);o=c}return o}function CR(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${xR}${t}`}function ER(e){return SR(e).root}function wR(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}function $l(e,t){if(Zt(e))return;let n=t.flatMap((o)=>Dl(o));if(!n[0])return;let r=Dl(Ml(e)?e:my(n[0],e))[0];if(!r)return;return n.some((o)=>py(r,o))?r:void 0}function fy(e,t){if(Zt(e))return;return Dl(Ml(e)?e:my(t,e))[0]}function Dl(e){try{let t=RR(e);return PR(t).isDirectory()?[t]:[]}catch{return[]}}function py(e,t){let n=AR(t,e);return n===""||n!==".."&&!n.startsWith(`..${kR}`)&&!Ml(n)}var jt="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Ot="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",gy="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.",hy="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Fi="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";function by(e){let{reason:t,command:n,segment:r,toolName:o}=e,i=e.maxLen??200,s=e.redact??((c)=>c),a=`BLOCKED by CC Safety Net
+var bi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",je="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",In="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Ci={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},bp={errorCode:"structural-shell-syntax-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},xt={errorCode:"tool-input-limit",reason:"CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user."},Tn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},Pr={errorCode:"structural-shell-syntax-limit",reason:"Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry."},P=Object.freeze({realpathAttempts:{cap:16384,...Ci},processedCandidateBytes:{cap:4194304,...Ci},pathEnvironmentExpansion:{cap:64,...Ci},structuralShellSyntax:bp,recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Tn},trackedHeredocFiles:{cap:64,...Tn},controlFlowStates:{cap:64,...Tn},wrapperPeelIterations:{cap:20,...Tn},derivedCommandShape:Tn,parallelChildAnalyses:{cap:1024,...Pr},parallelDerivedTokens:{cap:16384,...Pr},parallelDerivedBytes:{cap:1048576,...Pr},parallelPlaceholderReplacements:{cap:16384,...Pr},hookInputBytes:{cap:8388608,errorCode:"tool-input-limit",reason:"Failed to parse hook input JSON."},toolInputDepth:{cap:64,...xt},toolInputNodes:{cap:1e4,...xt},toolInputKeys:{cap:1e4,...xt},toolInputStringBytes:{cap:1048576,...xt},toolInputAggregateStringBytes:{cap:4194304,...xt},toolInputGitDiffCandidates:{cap:64,...xt},toolInputShape:xt});class F extends Error{kind;name="AnalysisLimit";constructor(e){super(P[e].reason);this.kind=e}}function Ce(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>P[t].cap)throw new F(t)}}}var vp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function ct(e){return Ep(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Ep(e){return vp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Rp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function xp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,Rp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-Reason: ${s(t)}`;if(e.ruleId)a+=`
-
-Rule: ${e.ruleId}`;if(o)a+=`
-
-Tool: ${o}`;if(n){let c=s(n);a+=`
-
-Command: ${yy(c,i)}`}if(r&&r!==n){let c=s(r);a+=`
-
-Segment: ${yy(c,i)}`}if(e.configWarning)a+=`
-
-Config warning: ${s(e.configWarning)}`;return a+=`
-
-${TR(e.intent??"manual_only")}`,a}function TR(e){switch(e){case"hard_stop":return"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.";case"use_alternative":return"Do not retry the blocked form. Continue the task using the safer alternative described above.";case"scope_down":return"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.";case"manual_only":return"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.";case"stop_and_explain":return"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."}}function yy(e,t){return e.length>t?`${e.slice(0,t)}...`:e}function vy(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence.find((r)=>r.kind==="command"):void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function _y(e={}){return{reason:Fi,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function Sy(e){return by({...e,redact:It})}function xy(e){return It(e instanceof Error?e.message:String(e))}import{basename as IR,dirname as OR,join as Ll}from"path";var Yn=Object.freeze({maxEnvironmentExpansionDepth:64,maxMissingSuffixComponents:256,maxRealpathAttempts:16384,maxProcessedCandidateBytes:4194304});class _e extends Error{name="PathCanonicalizationLimitError";constructor(){super("Path canonicalization work limit exceeded.")}}function eo(){return{realpathAttempts:0,processedCandidateBytes:0,resolvedPaths:new Map}}function zt(e){return{...eo(),environment:e}}var Gi=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Zi(e,t){return Wl(e,0,t)}function Wl(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Fl(e,o+2),a=zR(e,o,t);if(a===null){if(Gi.has(s))throw new _e;r+=e.slice(o);break}let c=e.slice(o,a+1);r+=NR(c,t,n),o=a+1;continue}let i=Fl(e,o+1);if(!i){r+="$",o++;continue}r+=Gl(i,n)??`$${i}`,o+=i.length+1}return r}function zR(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>Yn.maxEnvironmentExpansionDepth)throw new _e;o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function NR(e,t,n){let r=e.slice(2,-1),o=Fl(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Gl(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((l)=>i.startsWith(l));if(!s){if(Gi.has(o))throw new _e;return e}if(!Gi.has(o))return e;if(s.endsWith("="))throw new _e;let a=Gl(o,n),c=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!c)throw new _e;if(s.endsWith("-")||s.endsWith("?"))return c?a??"":Wl(i.slice(s.length),t+1,n);return c?Wl(i.slice(s.length),t+1,n):""}function Fl(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function J(e,t,n=eo()){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){if(n.realpathAttempts++,n.processedCandidateBytes+=Buffer.byteLength(i),n.realpathAttempts>Yn.maxRealpathAttempts||n.processedCandidateBytes>Yn.maxProcessedCandidateBytes)throw new _e;let s=t.realpath(i);if(s!==null){let c=o.length===0?s:Ll(s,...o.reverse());return n.resolvedPaths.set(e,c),c}let a=OR(i);if(a===i){let c=o.length===0?i:Ll(i,...o.reverse());return n.resolvedPaths.set(e,c),c}if(o.length>=Yn.maxMissingSuffixComponents){let c=Ll(i,...o.reverse());return n.resolvedPaths.set(e,c),c}o.push(IR(i)),i=a}}function Cy(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;if(n.realpathAttempts++,n.processedCandidateBytes+=Buffer.byteLength(e),n.realpathAttempts>Yn.maxRealpathAttempts||n.processedCandidateBytes>Yn.maxProcessedCandidateBytes)throw new _e;let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Gl(e,t){if(!Gi.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function z(e){return e.provenance==="command-substitution"?e.raw:e.text}function Jn(e,t){return e==="posix"?t:Z(t.map((n)=>n.text))}function Ui(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function Z(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}import{existsSync as Bl,lstatSync as $R,readFileSync as Hi,realpathSync as ro,statSync as no}from"fs";import{dirname as Vl,isAbsolute as Hl,join as qi,resolve as Ki}from"path";var Zl=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],DR=new Set(Zl);var Ey=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),ji=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),MR=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Ul(e){return DR.has(e)}function to(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function jl(e){return Ul(e)||Ey.has(e)||ji.has(e)||to(e)}function Ve(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Bi(e,t){let n=Ve("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=1024?{state:"valid",count:r}:{state:"invalid"}}function Vi(e,t,n){let o=e.match(MR)?.[1];if(!o||!jl(o))return null;let i=e.indexOf("=");return{name:o,value:`${Ve(o,t,n)??""}${e.slice(i+1)}`}}function wy(e){return Py(e,ji)}function Ry(e){return Py(e,Ey)}function Py(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Re=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]);function Ty(e,t){return Zl.some((n)=>t?.has(n)||e.has(n))}function Iy(e,t){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let n;try{n=ro(Ki(t))}catch{return{gitCwd:null,hasExplicitGitContext:!1}}if(!Ny(n))return{gitCwd:null,hasExplicitGitContext:!1};let r=!1,o=1;while(o<e.length){let i=e[o];if(!i)break;if(i==="--")break;if(!i.startsWith("-"))break;if(i==="-C"){let s=e[o+1];if(!s)return{gitCwd:null,hasExplicitGitContext:r};let a=ky(n,s);if(!a)return{gitCwd:null,hasExplicitGitContext:r};n=a,o+=2;continue}if(i.startsWith("-C")&&i.length>2){let s=ky(n,i.slice(2));if(!s)return{gitCwd:null,hasExplicitGitContext:r};n=s,o++;continue}if(i==="--git-dir"||i==="--work-tree"){r=!0,o+=2;continue}if(i.startsWith("--git-dir=")||i.startsWith("--work-tree=")){r=!0,o++;continue}if(Re.has(i))o+=2;else if(i.startsWith("-c")&&i.length>2)o++;else o++}return{gitCwd:n,hasExplicitGitContext:r}}function Oy(e){let t=JR(e);if(!t)return!1;try{let n=$R(t);if(n.isSymbolicLink()||!n.isFile())return!1;let r=ql(t);if(!r?.commonDir)return!1;if(!FR(r.gitDir,t))return!1;return GR(r.gitDir,Vl(t))}catch{return!1}}function ql(e){try{let t=LR(e);if(!t)return null;let n=ro(Hl(t)?t:Ki(Vl(e),t));if(!no(n).isDirectory())return null;return{gitDir:n,commonDir:WR(n)}}catch{return null}}function LR(e){let t=Hi(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function WR(e){try{let t=Hi(qi(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=ro(Hl(t)?t:Ki(e,t));return no(n).isDirectory()?n:null}catch{return null}}function FR(e,t){let n=ZR(e);return n===null?!1:zy(e,n,t)}function GR(e,t){let n=UR(e);return n===null?!0:zy(e,n,t)}function ZR(e){let t=qi(e,"gitdir");if(!Bl(t))return null;let n=Hi(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function UR(e){let t=qi(e,"config.worktree");return Bl(t)?qR(t):null}function zy(e,t,n){return BR(jR(e,t),n)}function jR(e,t){return Hl(t)?t:Ki(e,t)}function BR(e,t){try{return VR(e,t)}catch{return!1}}function VR(e,t){try{let n=no(e),r=no(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Ay(e)===Ay(t)}function Ay(e){return HR(ro.native(e))}function HR(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"");if(t=t.replace(/\\/g,"/"),t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return process.platform==="win32"?t.toLowerCase():t}function qR(e){let t=Hi(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=KR(s[1]??"")}return r}function KR(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return YR(t.slice(1,-1))}function YR(e){let t="";for(let n=0;n<e.length;n++){let r=e[n];if(r!=="\\"){t+=r;continue}let o=e[n+1];if(o===void 0){t+=r;continue}switch(o){case"\\":case'"':t+=o;break;case"n":t+=`
-`;break;case"t":t+="\t";break;case"b":t+="\b";break;default:t+=`\\${o}`;break}n++}return t}function ky(e,t){try{let n=Ut(e,t,Be);return Ny(n)?n:null}catch{return null}}function Ny(e){try{return no(e).isDirectory()}catch{return!1}}function JR(e){try{return oo(ro(e))}catch{return null}}function oo(e){let t=e;while(!0){let n=qi(t,".git");if(Bl(n))return n;let r=Vl(t);if(r===t)return null;t=r}}function Kl(e,t){return{value:e,work:t}}function x(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function le(e){return e.value.length}function io(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function De(e,t){io(e,t)}function hn(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function se(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Yl(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function ae(e,t,n){if(t+n.length>le(e))return!1;for(let r=0;r<n.length;r++)if(x(e,t+r)!==n[r])return!1;return!0}function Nt(e,t,n){return!hn(x(e,t-1))&&ae(e,t,n)&&!hn(x(e,t+n.length))}function Dt(e,t){return hn(x(e,t-1))!==hn(x(e,t))}function ge(e){return e===`
-`||e===";"||e==="&"||e==="|"}function Xn(e){return e==="|"||e===";"}function Yi(e,t,n){let r=Kl(e,n);if(t==="rm")return XR(r);if(t==="dd")return eP(r);return Fy(r,!0)}function Ji(e,t,n){let r=Kl(e,n);if(t==="rm")return tP(r);if(t==="reset-hard")return Ly(r,"--ha","rd");if(t==="reset-merge")return Ly(r,"--me","rge");if(t==="clean")return iP(r);if(t==="checkout")return aP(r);if(t==="push-force")return cP(r);if(t==="push-refspec")return lP(r);if(t==="push-delete")return uP(r);if(t==="branch")return dP(r);if(t==="tag")return pP(r);if(t==="restore")return gP(r);return Fy(r,!1)}function XR(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=le(e);i++){let s=x(e,i);if(!t){let c=x(e,i+2);if(Nt(e,i,"rm")&&se(c)&&c!==`
-`)t=!0,i++;continue}let a=QR(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===le(e)){if(o>=0){let c=Dy(e,o,i);n||=c.recursive,r||=c.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(se(s)){if(o>=0){if(ae(e,o,"--")&&i-o===2)t=!1,n=!1,r=!1;else{let c=Dy(e,o,i);if(n||=c.recursive,r||=c.force,n&&r)return!0}o=-1}continue}if(o<0)o=i}return!1}function QR(e,t){if(x(e,t)!=="\\"||x(e,t-1)==="\\")return-1;if(ae(e,t,String.raw`\n`))return t+2;if(ae(e,t,String.raw`\x0a`)||ae(e,t,String.raw`\x0A`))return t+5;if(ae(e,t,String.raw`\u000a`)||ae(e,t,String.raw`\u000A`))return t+7;return ae(e,t,String.raw`\012`)?t+4:-1}function Dy(e,t,n){if(My(e,t,n,"recursive"))return{recursive:!0,force:!1};if(My(e,t,n,"force"))return{recursive:!1,force:!0};if(x(e,t)!=="-"||x(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=x(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function My(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!ae(e,t,"--"))return!1;for(let i=0;i<o;i++)if(x(e,t+i+2)!==r[i])return!1;return!0}function eP(e){let t=!1;for(let n=0;n<le(e);n++){if(ge(x(e,n))){t=!1;continue}if(Nt(e,n,"dd")){t=!0,n++;continue}if(!t||!Nt(e,n,"of")||!ae(e,n,"of=/dev/"))continue;let r=n+8;if(r<le(e)&&!se(x(e,r))&&x(e,r)!=="'"&&x(e,r)!=='"')return!0}return!1}function tP(e){let t=!1,n=!1,r=!1;for(let o=0;o<=le(e);){let i=x(e,o);if(o===le(e)||ge(i)){t=!1,n=!1,r=!1,o++;continue}let s=rP(e,o);if(s>=0){if(nP(e,s))return!0;let a=s,c=!1;while(se(x(e,a)))c||=x(e,a)===`
-`,a++;if(c)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(ae(e,o,"--")&&(o===0||se(x(e,o-1)))&&(!x(e,o+2)||se(x(e,o+2))||ge(x(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=ae(e,o,"--recursive")&&Dt(e,o+11)||Jl(e,o,"recursive"),r||=ae(e,o,"--force")&&Dt(e,o+7)||Jl(e,o,"force"),n&&r)return!0;o++}return!1}function Jl(e,t,n){if(!ae(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=x(e,t+r+2);if(!o||se(o)||ge(o))break;if(o!==n[r])return!1;r++}return r>0&&Dt(e,t+r+2)}function nP(e,t){let n=t,r=!1,o=!1;while(n<le(e)){while(se(x(e,n)))n++;let i=n;while(n<le(e)&&!se(x(e,n)))n++;if(x(e,i)!=="-"||n-i===2&&ae(e,i,"--"))return!1;let s=$y(e,i,"recursive"),a=$y(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,x(e,i+1)==="-")continue;let c=oP(e,i,n);if(c.combined||r&&c.forceAtBoundary||o&&c.recursiveAtBoundary)return!0;r||=c.recursive,o||=c.force}return!1}function $y(e,t,n){return ae(e,t,`--${n}`)&&Dt(e,t+n.length+2)||Jl(e,t,n)}function rP(e,t){if(t>0&&hn(x(e,t-1)))return-1;let n=t;if(x(e,n)==="\\")n++;if(x(e,n)!=="r")return-1;if(n++,x(e,n)==="\\")n++;if(x(e,n)!=="m"||!se(x(e,n+1)))return-1;return n+1}function oP(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(x(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let c="";for(let l=t+1;l<n;l++){let u=x(e,l)??"",d=(u==="r"||u==="f")&&Dt(e,l+1);r||=u==="r",o||=u==="f",i||=u==="r"&&d,s||=u==="f"&&d,a||=(c==="r"&&u==="f"||c==="f"&&u==="r")&&d,c=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Ly(e,t,n){return ao(e,"reset",Xn,!0,(r)=>x(e,r)==="-"&&Qn(e,r,t,n)?!0:r)}function iP(e){return ao(e,"clean",Xn,!0,(t)=>{if(x(e,t)!=="-")return t;if(Qn(e,t,"--fo","rce"))return!0;let n=so(e,t,Xn);for(let r=t+1;r<n;r++)if(x(e,r)==="f")return!0;return n-1})}function Xi(e,t,n){if(!Nt(e,t,"git"))return null;let r=t+3;if(!se(x(e,r)))return{commandEnd:-1,next:r};while(se(x(e,r)))r++;while(r<le(e)){if(ge(x(e,r)))return{commandEnd:-1,next:r};let o=so(e,r,ge);if(Nt(e,r,n))return{commandEnd:r+n.length,next:o};if(x(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&ae(e,r,"--"),s=sP(e,r,o);r=o;while(se(x(e,r)))r++;if(i)return{commandEnd:Nt(e,r,n)?r+n.length:-1,next:so(e,r,ge)};if(!s)continue;if(r>=le(e)||ge(x(e,r)))return{commandEnd:-1,next:r};r=so(e,r,ge);while(se(x(e,r)))r++}return{commandEnd:-1,next:r}}function sP(e,t,n){for(let r of Re)if(n-t===r.length&&ae(e,t,r))return!0;return!1}function aP(e){return Wy(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function cP(e){return ao(e,"push",Xn,!0,(t)=>{if(x(e,t)!=="-")return t;if(x(e,t+1)==="f"&&!hn(x(e,t+2))&&!ae(e,t+2,"-with-lease"))return!0;let n=Gy(e,t,"--fo","rce");if(n>=0&&!ae(e,n,"-with-lease"))return!0;return t})}function lP(e){return ao(e,"push",ge,!1,(t)=>{if(se(x(e,t))&&x(e,t+1)==="+"&&t+2<le(e)&&!ge(x(e,t+2))&&!se(x(e,t+2)))return!0;if(x(e,t)===":"&&x(e,t+1)==="+")return!0;return t})}function uP(e){return ao(e,"push",ge,!1,(t)=>{if(x(e,t)==="-"&&Qn(e,t,"--de","lete"))return!0;if(se(x(e,t))&&x(e,t+1)===":"&&t+2<le(e)&&!se(x(e,t+2))&&!ge(x(e,t+2)))return!0;return t})}function dP(e){let t=!1,n=!1,r=!1;for(let o=0;o<=le(e);o++){if(o===le(e)||ge(x(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Xi(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||x(e,o)!=="-")continue;let i=so(e,o,ge),s=mP(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function mP(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(x(e,i)!=="-")continue;if(Qn(e,i,"--de","lete"))r=!0;if(Qn(e,i,"--fo","rce"))o=!0;if(x(e,i+1)==="-")continue;let s=i+1,a=!1,c=!1,l=!1;while(s<n&&fP(x(e,s))){let u=x(e,s);a||=u==="d"||u==="D",c||=u==="f",l||=u==="D",s++}if(!Dt(e,s))continue;r||=a,o||=c||l}return{deletion:r,force:o}}function fP(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function pP(e){return Wy(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Wy(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<le(e);r++){let o=x(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&x(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(se(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Xi(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&se(x(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(Qn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(x(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Dt(e,r+1))return!0;if(Xn(o))i.outerActive=!1}return!1}function ao(e,t,n,r,o){let i=!1;for(let s=0;s<le(e);s++){let a=x(e,s),c=n(a);if(!i&&!c){let l=Xi(e,s,t);if(l){i=l.commandEnd>=0&&(!r||se(x(e,l.commandEnd))),s=Math.max(s,(i?l.commandEnd:l.next)-1);continue}}if(i){let l=o(s);if(l===!0)return!0;for(let u=s;u<=l;u++)if(n(x(e,u)))i=!1;s=l}if(c)i=!1}return!1}function gP(e){let t=!1;for(let n=0;n<le(e);n++){if(Yl(x(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Xi(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&x(e,n)==="-"&&x(e,n+1)==="-"&&(ae(e,n+2,"staged")||ae(e,n+2,"help")))t=!1}return t}function Fy(e,t){let n=!1;for(let r=0;r<le(e);r++){let o=x(e,r),i=t?Yl(o):ge(o);if(n&&se(o)&&x(e,r+1)==="-"&&Nt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Nt(e,r,"find"))n=!0,r+=3}return!1}function so(e,t,n){let r=t;while(r<le(e)&&!se(x(e,r))&&!n(x(e,r)))r++;return r}function Gy(e,t,n,r){if(!ae(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&x(e,o)===r[i];i++)o++;return Dt(e,o)?o:-1}function Qn(e,t,n,r){return Gy(e,t,n,r)>=0}var Zy=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],co=new Set(Zy.map((e)=>e.id)),Qi=Zy,hP=new Map(Qi.map((e)=>[e.id,e.intent])),Uy=new Set(Qi.filter((e)=>e.catastrophic).map((e)=>e.id));function _(e,t){return{id:e,reason:t,intent:hP.get(e)??"manual_only"}}function O(e,t){if(!e)return null;if(Uy.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function ue(e,t,n){if(Uy.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function jy(e,t){return Object.freeze(Object.fromEntries(Qi.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function By(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:jy(e,t)})}function Mt(e,t){io(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)De(t,a);if((s.regex?.test(a)??!1)||s.scan&&Ji(a,s.scan,t))return _("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var yP=/^[A-Za-z_][A-Za-z0-9_]*=/;function Hy(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;io(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return qy(t.nodes,r,i)}function qy(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return qy(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return bP(r,t,n)})}function bP(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!yP.test(o.text));return e.words.every((o,i)=>o===t||Vy(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Vy(o.target.raw,n.anchored,!0)))}function Vy(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}var Ky=Object.freeze({maxDerivedTokens:16384}),Yy="Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry.";class Me extends Error{constructor(){super("Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry.");this.name="DerivedCommandWorkLimitError"}}function es(){return{derivedTokens:0}}function Qe(e,t){if(!Number.isSafeInteger(e.derivedTokens)||e.derivedTokens<0||e.derivedTokens>Ky.maxDerivedTokens||!Number.isSafeInteger(t)||t<0||t>Ky.maxDerivedTokens-e.derivedTokens)throw new Me;e.derivedTokens+=t}import{isAbsolute as vP,resolve as Jy}from"path";var Xy=64;function lo(e,t,n){let r=vP(e)?Jy(e):t?Jy(t,e):void 0;if(!r)return;try{return J(r,n)}catch{return r}}function Qy(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}function V(e){return W(e).toLowerCase()}function W(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}var ts=10,er=20,yn=/^[a-zA-Z][a-zA-Z0-9_-]*$/,tr=256,de=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),eb=new Set(["python","python3","python2","node","ruby","perl"]),tb=/^python(?:[23](?:\.\d+)*)?$/,ns=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var bn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",nr="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",rs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),_P=new Set(["-p","--print"]),SP=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),xP=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),CP=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),EP=new Map([["python",new Set(["m"])]]),wP=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),RP=new Set(["always","default","never"]),PP=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),AP=/\\\r?\n/g,kP=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function os(e){return ss(e).code}function is(e){return ss(e).sources}function rb(e){return kP.get(cs(e))??[]}function ss(e){let t=cs(e[0]??"");if(!rs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return et(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return et(t,n,r,o,i,s);if(t==="node"&&_P.has(s)){let d=e[i+1];if(d===void 0)return et(t,n,r,o);if(d.startsWith("-"))continue;n.push({tokenIndex:i+1,value:d}),r.push({tokenIndex:i+1,kind:"inline-code",value:d}),i++;continue}if(IP(t,s)){let d=e[i+1];if(d===void 0)return et(t,n,r,o);if(n.push({tokenIndex:i+1,value:d}),r.push({tokenIndex:i+1,kind:"inline-code",value:d}),t==="python")return et(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(OP(t)&&a){let d=a[1]??"";n.push({tokenIndex:i,value:d}),r.push({tokenIndex:i,kind:"inline-code",value:d});continue}if(t==="node"){let d=TP(s);if(d){if(d.attached){if(o&&=d.value!=="",d.value!=="")r.push({tokenIndex:i,kind:"module-file",value:d.value});continue}let m=e[i+1];if(m===void 0||m.startsWith("-"))return o=!1,et(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:m}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return et(t,n,r,o);if(wP.get(t)?.has(s)){let d=e[i+1];if(d===void 0||d.startsWith("-")&&!(t==="ruby"&&PP.has(s))||t==="python"&&!RP.has(d))return et(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let c,l=!1;for(let d=1;d<s.length;d++){let m=s[d];if(m===void 0)break;if(EP.get(t)?.has(m)){let f=s.slice(d+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return et(t,n,r,o)}if(SP.get(t)?.has(m)){c=s.slice(d+1)||e[i+1],l=d+1===s.length;break}if(t==="node"&&m==="r"){if(s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}else o=!1;break}if(t==="ruby"&&m==="r"){let f=s.slice(d+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(m==="M"||m==="m")){let f=s.slice(d+1);if(f)r.push({tokenIndex:i,kind:"module-file",value:f});else if(o=!1,d+1===s.length)i++;break}if(xP.get(t)?.has(m)){if(d+1===s.length)i++;break}if(CP.get(t)?.has(m)&&d+1<s.length)break}if(c===void 0)continue;let u=l?i+1:i;if(n.push({tokenIndex:u,value:c}),r.push({tokenIndex:u,kind:"inline-code",value:c}),t==="python")return et(t,n,r,o);if(l)i++}return et(t,n,r,o,void 0,void 0,!0)}function et(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,c=new Set(a.map((u)=>u.tokenIndex)),l=n.filter((u)=>u.kind!=="inline-code"||c.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)l.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
-`))||null,sources:r?l:[],optionsOpen:r&&s}}function TP(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function $e(e){return rs.has(cs(e))}function as(e,t){return cs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function cs(e){let t=W(e).toLowerCase();return tb.test(t)?"python":t}function IP(e,t){return rs.get(e)?.has(t)??!1}function OP(e){return rs.get(e)?.has("--eval")??!1}function rr(e,t){let n=DP(e,t);if(!nb(n,t))return!1;De(t,n);let r=NP(n);if(nb(r,t))return!0;return De(t,r),zP.test(r)}var zP=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function NP(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function nb(e,t){if(Yi(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(De(t,e),r.test(e))return!0;if(Yi(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(De(t,e),r.test(e))return!0;if(Yi(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(De(t,e),n.some((o)=>Ji(o,r))))}function DP(e,t){return De(t,e),e.replace(AP,"")}var H=Object.freeze({maxChildAnalyses:1024,maxDerivedTokens:16384,maxDerivedBytes:1048576,maxPlaceholderReplacements:16384}),ob="Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry.";class us extends Error{constructor(){super("Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry.");this.name="ParallelAnalysisLimitError"}}function ib(){return{childAnalyses:0,derivedTokens:0,derivedBytes:0,placeholderReplacements:0}}function Le(e,t){let n=t.childAnalyses??0,r=t.derivedTokens??0,o=t.derivedBytes??0,i=t.placeholderReplacements??0;if(ls(e.childAnalyses,n,H.maxChildAnalyses)||ls(e.derivedTokens,r,H.maxDerivedTokens)||ls(e.derivedBytes,o,H.maxDerivedBytes)||ls(e.placeholderReplacements,i,H.maxPlaceholderReplacements))throw new us;e.childAnalyses+=n,e.derivedTokens+=r,e.derivedBytes+=o,e.placeholderReplacements+=i}function ls(e,t,n){return!Number.isSafeInteger(e)||e<0||e>n||!Number.isSafeInteger(t)||t<0||t>n-e}import{isAbsolute as ku,normalize as tT,parse as nT,posix as Cv,resolve as lr,sep as Au}from"path";import{isAbsolute as MP,join as sb,normalize as lb,parse as $P,sep as ab}from"path";var LP=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],WP=` 	
-`;function uo(e,t){if(ft(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Xl(e.get("TMPDIR")??"",t)}function $t(e,t){if(e.has("TMPDIR"))return Xl(e.get("TMPDIR")??"",t);let n=Ql(e,t);if(n===void 0)return!0;return Xl(n,t)}function Ql(e,t){return mb(e,t,"TMPDIR")}function Xl(e,t){if(!e)return!1;if(GP(e))return!1;return eu(e,t)}function ft(e,t){let n=mb(e,t,"IFS");return n!==void 0&&n!==""&&n!==WP}function eu(e,t){let n=ds(e,t.paths);if(n===null)return!1;return db(t).some((r)=>UP(n,r))}function ub(e,t){let n=ds(e,t.paths);if(n===null)return!1;return db(t).some((r)=>ms(r)===ms(n))}var cb=new WeakMap;function db(e){let t=cb.get(e);if(t)return t;let n=FP(e);return cb.set(e,n),n}function FP(e){let t=LP.map((r)=>ds(r,e.paths)??lb(r)),n=ds(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&ZP(n))return[...t,n];return t}function GP(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function mb(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function ZP(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function ds(e,t){try{let n=lb(e);if(!MP(n))return n;let r=$P(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=sb(i,o[s]??"");if(t.entryKind(a)==="missing")return sb(a,...o.slice(s+1));let c=t.realpath(a);if(c===null)return null;i=c}return i}catch{return null}}function UP(e,t){let n=ms(e),r=ms(t);if(n===r)return!0;let o=r.endsWith(ab)?r:`${r}${ab}`;return n.startsWith(o)}function ms(e){return process.platform==="win32"?e.toLowerCase():e}import{statSync as Fk}from"fs";import{isAbsolute as pv,join as Gk,relative as gv}from"path";import{isAbsolute as fb,parse as jP}from"path";var gb=/^[A-Za-z_][A-Za-z0-9_]*=/;function He(e){if(!gb.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function fs(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=He(z(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function hb(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function vn(e,t,n,r){if(!hb(or(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),c=[],l=n;for(let d=0;d<er;d++){let m=pb(i),f=fs(i);for(let[h,y]of f.envAssignments)s.set(h,y),a.set(h,y);if(i=f.words,i.length===0)break;while(i.length>0&&or(i).includes("=")&&!VP(i)){let h=HP(or(i),a,t.env)??Vi(or(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=or(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=KP(i,t.paths,l);if(i=h.words,h.cwd!==void 0)l=h.cwd}if(p==="env"){let h=XP(i,l,a,t);if(c.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)l=h.cwd;for(let[y,v]of h.envAssignments)s.set(y,v),a.set(y,v)}if(p==="command")i=QP(i);if(p==="builtin")i=i.slice(tt(i,1)==="--"?2:1);if(pb(i)===m)break}let u=fs(i);for(let[d,m]of u.envAssignments)s.set(d,m),a.set(d,m);return{words:u.words,envAssignments:s,cwd:l,envSplitValues:c.length>0?c:void 0,rewritten:BP(u.words,o)}}function BP(e,t){return e.some((n)=>!t.has(n))}function pb(e){return e.map(z).join(" ")}function or(e){let t=e[0];return t?z(t):""}function tt(e,t){let n=e[t];return n?z(n):void 0}function VP(e){return gb.test(or(e))}function HP(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var qP=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function KP(e,t,n){let r=1,o=n;while(r<e.length){let i=tt(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=tt(e,r+1);o=s?mo(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=mo(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=mo(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(qP.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var YP=new Set(["-i","-0","--null"]),JP=new Set(["-u","--unset","-C","--chdir","-P"]);function XP(e,t,n,r){let o=new Map,i=[],s=t,a=1,c=(l)=>({words:e.slice(l),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let l=tt(e,a);if(!l)break;if(l==="--")return c(a+1);if(l==="-i"||l==="--ignore-environment"||l==="-"){o.clear();for(let d of n.keys())o.set(d,"");o.set("TMPDIR",""),a++;continue}if(YP.has(l)){a++;continue}if(l==="-u"||l==="--unset"){let d=tt(e,a+1);if(d!==void 0)o.set(d,"");a+=2;continue}if(l.startsWith("-u")&&l.length>2&&!l.startsWith("-u=")){o.set(l.slice(2),""),a++;continue}if(l.startsWith("--unset=")){o.set(l.slice(8),""),a++;continue}let u=l==="-S"||l==="--split-string"?{value:tt(e,a+1),consumed:2}:l.startsWith("-S")&&l.length>2?{value:l.slice(2),consumed:1}:l.startsWith("--split-string=")?{value:l.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,c(a+u.consumed)}if(JP.has(l)){if(l==="-C"||l==="--chdir"){let d=tt(e,a+1);s=d?mo(s,d,r.paths):null}a+=2;continue}if(l.startsWith("-u=")){a++;continue}if(l.startsWith("-C")&&l.length>2||l.startsWith("--chdir=")){let d=l.startsWith("--chdir=")?l.slice(8):l.startsWith("-C=")?l.slice(3):l.slice(2);s=mo(s,d,r.paths),a++;continue}if(l.startsWith("-P")){a++;continue}if(l.startsWith("-")){a++;continue}if(!He(l))break;while(a<e.length){let d=He(tt(e,a)??"");if(!d)break;o.set(d.name,d.value),a++}if(tt(e,a)==="--")a++;return c(a)}return c(a)}function mo(e,t,n){if(t==="")return null;if(!e&&!fb(t))return null;let r=fb(t)?jP(t).root:n.realpath(e??"/");if(r===null)return null;try{return Ut(r,t,n)}catch{return null}}function QP(e){if(tt(e,1)==="-v")return[...Z(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=tt(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var eA=/['"\\$`{}#]/;function ps(e,t){if(e.some((r)=>eA.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function Bt(e,t,n){return gs(e,t,n).tokens}function tA(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Vt(e,t,n,r=0){let o=gs(e,t,n),i=(o.envSplitValues??[]).flatMap(tA);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Vt(s,t,n,r+1)}function gs(e,t,n,r){if(!hb(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=vn(Z(e),t,n,r);return{tokens:o.words.map(z),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}import{basename as Nk,isAbsolute as Dk,normalize as Mk,resolve as uv}from"path";function hs(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function nA(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>Pe(t)))})}function ys(e,t,n){e.push(n),t.reset()}function rA(e,t,n,r,o){if(r<=n)return;e.push({raw:t.slice(n,r),span:{start:n,end:r},provenance:o})}function bs(e){let t=[];return{parts:t,push:(n,r,o)=>rA(t,e,n,r,o)}}function tu(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function ir(e,t,n,r,o,i,s){return tu({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function Pe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t,span:Object.freeze(t.span)}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return nA(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:Pe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function nu(e,t,n){if(t>=n||bb(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!bb(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let c=yb(e,s+1,n,"'");r+=c.text,i||=!c.closed,s=c.next;continue}if(a==='"'){o=!0;let c=yb(e,s+1,n,'"');r+=c.text,i||=!c.closed,s=c.next;continue}if(a==="\\"){o=!0;let c=e[s+1];if(!c||c===`
-`||c==="\r"){i=!0;break}r+=c,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,span:{start:t,end:s},ambiguous:i}}function ru(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,c=!1;while(i<n){let l=oA(e,i,n);if((s.stripTabs?l.text.replace(/^\t+/,""):l.text)===s.delimiter){s.attach({body:s.stripTabs?iA(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:l.contentEnd}}),i=l.next,c=!0;break}if(l.next<=i)break;i=l.next}if(c)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`,span:s.declarationSpan}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function yb(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function bb(e){return/[\s;&|<>)]/u.test(e)||e==="`"}function oA(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)}function dl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence.find((r)=>r.kind==="command"):void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function Tr(e={}){return{reason:In,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function ml(e){return xp({...e,redact:ct})}function fl(e){return ct(e instanceof Error?e.message:String(e))}import{lstatSync as cg,realpathSync as ug,statSync as dg}from"fs";import{homedir as mg,tmpdir as fg}from"os";import{statSync as sg}from"fs";import{join as ag}from"path";import{basename as hl,dirname as _p,isAbsolute as wp,join as Ap,normalize as Pp,resolve as pl}from"path";var Tp=256,Ir=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function be(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Ze(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function xi(e,t){return vi(e,0,t)}function vi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Ei(e,o+2),a=Ip(e,o,t);if(a===null){if(Ir.has(s))throw new F("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=kp(l,t,n),o=a+1;continue}let i=Ei(e,o+1);if(!i){r+="$",o++;continue}r+=Ri(i,n)??`$${i}`,o+=i.length+1}return r}function Ip(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>P.pathEnvironmentExpansion.cap)throw new F("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function kp(e,t,n){let r=e.slice(2,-1),o=Ei(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Ri(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Ir.has(o))throw new F("pathEnvironmentExpansion");return e}if(!Ir.has(o))return e;if(s.endsWith("="))throw new F("pathEnvironmentExpansion");let a=Ri(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new F("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":vi(i.slice(s.length),t+1,n);return l?vi(i.slice(s.length),t+1,n):""}function Ei(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Ri(e,t){if(!Ir.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function B(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){yl(n,i);let s=t.realpath(i);if(s!==null)return gl(n,e,s,o);let a=_p(i);if(a===i||o.length>=Tp)return gl(n,e,i,o);o.push(hl(i)),i=a}}function gl(e,t,n,r){let o=r.length===0?n:Ap(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Op(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;yl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function yl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ie(e,t,n,r){let o=Cl(e,t,n);if(!o)return"";return B(o,n.paths,r).replace(/\\/g,"/")}function Sl(e,t,n,r,o){let i=Cl(e,t,n);if(!i)return null;if(o(hl(i)))return B(i,n.paths,r).replace(/\\/g,"/");let s=Op(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Cl(e,t,n){let r=n.home,o=xi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?pl(r,o.slice(2)):o,s=be(i);return Pp(wp(s)?s:pl(t,s))}import{spawnSync as Mp}from"child_process";import{existsSync as nn,lstatSync as Dp,readFileSync as wt,realpathSync as tn,statSync as kn}from"fs";import{dirname as kr,isAbsolute as On,join as _t,resolve as rn}from"path";var Np=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Lp=5000;function vl(e,t=Qp(),n=Lp){let r=Wp(e);if(r===null||!Fp(r))return null;let o=Xp(r,t,n);return o===null?null:{recursiveSubmodules:o}}function Wp(e){try{let t=tn(rn(e));return kn(t).isDirectory()?t:null}catch{return null}}function Fp(e){let t=Zp(e);if(!t)return!1;try{let n=Dp(t);if(n.isSymbolicLink()||!n.isFile())return!1;let r=_i(t);if(!r?.commonDir)return!1;if(!Bp(r.gitDir,t))return!1;return $p(r.gitDir,kr(t))}catch{return!1}}function _i(e){try{let t=Gp(e);if(!t)return null;let n=tn(On(t)?t:rn(kr(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:zp(n)}}catch{return null}}function Gp(e){let t=wt(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function zp(e){try{let t=wt(_t(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=tn(On(t)?t:rn(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function Bp(e,t){let n=Up(e);return n===null?!1:El(e,n,t)}function $p(e,t){let n=Hp(e);return n===null?!0:El(e,n,t)}function Up(e){let t=_t(e,"gitdir");if(!nn(t))return null;let n=wt(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Hp(e){let t=_t(e,"config.worktree");return nn(t)?Vp(t):null}function El(e,t,n){try{return jp(On(t)?t:rn(e,t),n)}catch{return!1}}function jp(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return bl(tn.native(e))===bl(tn.native(t))}function bl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Vp(e){let t=wt(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Kp(s[1]??"")}return r}function Kp(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Yp(t.slice(1,-1))}var qp={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function Yp(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:qp[n]??t)}function Zp(e){try{return Or(tn(e))}catch{return null}}function Or(e){let t=e;while(!0){let n=_t(t,".git");if(nn(n))return n;let r=kr(t);if(r===t)return null;t=r}}function Xp(e,t,n){let r=Jp(e);if(r===null||r)return!0;if(t===null)return!0;let o=Mp(t,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:eg(process.env),stdio:["ignore","pipe","ignore"],timeout:n});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Rl(o.stdout.trim())}function Jp(e){let t=tg(e);if(t===null)return null;return t.filter((n)=>nn(n)).some((n)=>og(n))}function Qp(){return Np.find((e)=>nn(e))??null}function Mn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function eg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Mn(t)))}function tg(e){let t=Or(e);if(t===null)return null;let n=ng(t);if(n===null)return null;let r=rg(n);if(r===null)return null;return[_t(r,"config"),_t(n,"config.worktree")]}function ng(e){try{let n=wt(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!n.startsWith("gitdir:"))return e;let r=n.slice(7).trim();if(r==="")return null;return On(r)?r:rn(kr(e),r)}catch{return null}}function rg(e){let t=_t(e,"commondir");if(!nn(t))return e;try{let n=wt(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(n==="")return null;return On(n)?n:rn(e,n)}catch{return null}}function og(e){let t;try{t=wt(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(ig(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Rl(c)}return r}function ig(e){return e==="include"||e.startsWith("includeif ")}function Rl(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function xl(e,t){if(e==="")return null;let n=Ce(),r=Or(ie(e,e,t,n)),o=r?lg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function lg(e,t,n,r){try{let o=ie(e,t,n,r),i=sg(e),s=i.isFile()?o:null,a=i.isFile()?_i(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((d)=>d?[on(ie(d,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[on(e.replace(/\\/g,"/")),...l]:l)];return{entry:on(o),markerFile:s?on(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((d)=>{let m=on(ag(d,"hooks").replace(/\\/g,"/"));return[m,on(ie(m,t,n,r))]}))]}}catch{return null}}function on(e){return process.platform==="win32"?e.toLowerCase():e}var pg={realpath:(e)=>{try{return ug(e)}catch{return null}},entryKind:(e)=>{let t=cg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return dg(e).isDirectory()}catch{return!1}}};function wl(){return gg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:be(process.env.HOME||mg()),tmpdir:fg(),paths:pg})}function gg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>_l(n,i,()=>xl(i,o)),worktreeFacts:(i)=>_l(r,i,()=>vl(i)),...t};return o}function _l(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var sn=["fail_closed","paranoid_rm","paranoid_interpreters"],Mr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ee={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Dr=["standard","strict","paranoid"];function hg(e,t){if(!t)return e;return Dr.indexOf(t)>Dr.indexOf(e)?t:e}function yg(e){let t=Ti(ee.level,e);if(t===void 0||t==="")return;if(Dr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${ee.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Dr.join(", ")}.`);return}function Sg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Al(e){return Sg(Ti(ee.auditScope,e))==="all"}function Ai(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Pi(e={},t){let n=e.safety?.level??"standard",r=yg(t),o=hg(n,r),i=Mr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ee.level.name}=${r}`),l.paranoidRm.push(`env ${ee.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ee.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(At(ee.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ee.strict.name}`);if(At(ee.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ee.paranoid.name}`),l.paranoidInterpreters.push(`env ${ee.paranoid.name}`);if(At(ee.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ee.paranoidRm.name}`);if(At(ee.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ee.paranoidInterpreters.name}`);let c=!!e.worktreeMode||At(ee.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Ai(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function At(e,t){let n=typeof e==="string"?wi(e,t):Ti(e,t);return n==="1"||n?.toLowerCase()==="true"}function wi(e,t){return t.get(e)}function Ti(e,t){let n=wi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return wi(e.legacyName,t);return}import{types as Cg}from"util";var bg=new Set(["applypatch","patch"]),vg=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Eg=new Set(["grep","grepsearch","rg"]),Rg=new Set(["find","findbyname","glob"]),xg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),_g=new Set(["command","diff","input","patch","patchtext"]),Pl=new TextEncoder,wg=new TextDecoder,Ag=/\s/,Pg=64;class Xe extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Dn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Ml(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Lr(e){return xg.has(Ml(e))}function Mi(e){let t=Ml(e);if(bg.has(t))return"patch";if(Eg.has(t))return"grep";if(Rg.has(t))return"glob";if(vg.has(t))return"path";return"unknown"}function Ln(e){if(!e||typeof e!=="object")return;zl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ve();return}if(t.get||t.set)Ve();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Dl(e,t){return Nl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Nl(e,t,n,r){let o=Gl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Nl(a,t,n,r+1);return typeof a==="string"&&t.has(Ll(s))?[a]:l});return n.ancestors.delete(o.object),i}function Ll(e){return e.replace(/-/g,"_").toLowerCase()}function Wl(e){return Fl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Ig)}function Fl(e,t,n,r){let o=Gl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Fl(a,o.array?t:_g.has(Ll(s)),n,r+1));return n.ancestors.delete(o.object),i}function Tg(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Dn.maxDepth||t.nodes>Dn.maxNodes)Ve();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Dn.maxStringBytes||t.stringBytes>Dn.maxAggregateStringBytes)Ve()}function Gl(e,t,n){if(Tg(e,t,n),!e||typeof e!=="object")return null;let r=zl(e);if(t.ancestors.has(e))Ve();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Dn.maxKeys)Ve();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ve();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function zl(e){if(Cg.isProxy(e))Ve();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ve();return t}function Ve(){throw new Xe}function Ig(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let d=kg(c);if(o=!0,i=d?.oldLines??null,s=d?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let d=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-d),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ii(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ii(c));continue}if(c.startsWith("--- ")){let d=n[l+1]??"";if(!d.startsWith("+++ "))continue;t.push(...Oi(Nr(c.slice(4),!0),Nr(d.slice(4),!0))),l++;continue}if(!r)t.push(...Ii(c))}return t}function kg(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ii(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Ol(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Ol(n[1]);if(e.startsWith("diff --git "))return Og(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return kl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return kl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Gg(i[1]);return[]}function Og(e){let t=Mg(e);if(t.length===2&&t[0]&&t[1])return Oi(t[0],t[1]);let n=Dg(e);return n?Oi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Mg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Pt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Pt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Bl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Pt(e[n]))n++;return n===e.length?t:[]}function Dg(e){let t=0;while(t<e.length&&Pt(e[t]))t++;let n=e.length;while(n>t&&Pt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Pt(e[o])){o++;continue}let i=o;while(o<n&&Pt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Pg)Ve();if(Ng(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Ng(e,t,n,r,o){if(ki(e,t,n,r,o))return!0;let i=Tl(e,"/",t,n),s=Tl(e,"/",r,o);if(i<=t||s<=r)return!1;if(ki(e,t,i,r,s))return!1;return ki(e,i+1,n,s+1,o)}function ki(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Tl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Pt(e){return e!==void 0&&Ag.test(e)}function Bl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:wg.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Pl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Pl.encode(Lg(s[0]??""))),o+=2}return null}function Lg(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function Wg(e){return Nn(zg(e))}function Oi(e,t){if(e==="/dev/null")return Il(t);if(t==="/dev/null")return Il(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Nn);let n=Fg(e,t)??(e===t?$l(e):null);return[e,t,...n?[n]:[]].flatMap(Nn)}function Il(e){let t=$l(e);return[e,...t?[t]:[]].flatMap(Nn)}function $l(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Fg(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function kl(e){return Wg(Nr(e,!0))}function Gg(e){return Nn(Nr(e,!1))}function Nr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Bl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function zg(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Nn(e){return e===""||e==="/dev/null"?[]:[e]}function Ol(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Ni,relative as $g,resolve as Ul,sep as Ug}from"path";function Hl(e,t,n){if(Ze(e))return;let r=t.flatMap((i)=>Di(i,n));if(!r[0])return;let o=Di(Ni(e)?e:Ul(r[0],e),n)[0];if(!o)return;return r.some((i)=>Hg(o,i))?o:void 0}function jl(e,t,n){if(Ze(e))return;return Di(Ni(e)?e:Ul(t,e),n)[0]}function Di(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Hg(e,t){let n=$g(t,e);return n===""||n!==".."&&!n.startsWith(`..${Ug}`)&&!Ni(n)}function an(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{dirname as Vr}from"path";import{closeSync as Vg,constants as Vl,fstatSync as Kg,fsyncSync as pP,lstatSync as Wi,mkdirSync as gP,openSync as qg,readdirSync as hP,readFileSync as Yg,realpathSync as Wr,renameSync as yP,rmdirSync as SP,statSync as Zg,unlinkSync as CP,writeFileSync as bP}from"fs";import{isAbsolute as Kl,join as ql,normalize as Xg,parse as Jg,relative as Fi,resolve as Gi,sep as zi}from"path";function Li(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Qg=Symbol("PolicyFilesystemScope"),eh=Symbol("PolicyFilesystemTarget"),th=Vl.O_NOFOLLOW??0;class se extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function Tt(e,t){return{[Qg]:!0,root:Gi(e),label:t}}function Yl(e,t){let n=Xg(t);if(t===""||Kl(t)||n===".."||n.startsWith(`..${zi}`))throw new se(e.label);return{[eh]:!0,scope:e,relativePath:n,path:ql(e.root,n)}}function Wn(e,t){return Yl(e,Fi(e.root,Gi(t)))}function Zl(e,t="rules policy"){let n=Gi(e),r=Jg(n).dir;return Yl(Tt(r,t),Fi(r,n))}function Gr(e){return Jl(e.scope.label,()=>{if(!Fr(e))return null;let t=qg(e.path,Vl.O_RDONLY|th);return nh(t,()=>{let n=Kg(t);if(!n.isFile())throw new se(e.scope.label);let r=Yg(t,"utf-8"),o=Wi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new se(e.scope.label);return Fr(e),r})})}function Xl(e,t){if(e.path===t.path)return!0;return Jl(e.scope.label,()=>{if(!Fr(e)||!Fr(t))return!1;return Wr(e.path)===Wr(t.path)})}function Jl(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof se)throw r;throw new se(e)}}function nh(e,t){try{return t()}finally{Vg(e)}}function Fr(e,t="file"){let n=rh(e.scope);if(!n)return!1;let r=e.relativePath.split(zi);for(let o of r.keys()){let i=ql(e.scope.root,...r.slice(0,o+1)),s=Wi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new se(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new se(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new se(e.scope.label);oh(n,Wr(i),e.scope.label)}return!0}function rh(e){if(!Wi(e.root,{throwIfNoEntry:!1}))return null;if(!Zg(e.root).isDirectory())throw new se(e.label);return Wr(e.root)}function oh(e,t,n){let r=Fi(e,t);if(r===".."||r.startsWith(`..${zi}`)||Kl(r))throw new se(n)}import{dirname as kt,isAbsolute as ch,join as Mt,relative as uh,resolve as Ot,sep as dh}from"path";var It=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Ql="rulebook.json",ec=".cc-safety-net/rules";var tc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var ih=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,sh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),ah="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),xP=new RegExp(`^${sh}/(${It.source.slice(1,-1)})/${ah}$`);function lh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function nc(e){if(zr(e))try{return Bi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return It.test(e)?null:`Local rulebook sources must be bare names matching ${It}: ${e}`}function Bi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(tc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!ih.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!It.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:lh(o),name:o}}function zr(e){return tc.test(e)}var rc="rule.json",Br="policy.json",oc=".cc-safety-net",mh="rules",fh="CC_SAFETY_NET_HOME",ic="`cc-safety-net rule update`";function ph(e){return Ot(e,ec)}function gh(e){return Mt(ph(e),rc)}function Fn(e){return Mt(Ot(e),oc,Br)}function $i(e,t={}){return t.userConfigDir??(t.userConfigPath?kt(t.userConfigPath):Mt(hh(e),mh))}function hh(e){let t=e.env.get(fh);return t?Ot(be(t)):Mt(e.home,oc)}function yh(e,t={}){return Mt($i(e,t),rc)}function ln(e,t={}){return Mt(kt($i(e,t)),Br)}function sc(e,t){let n=t.userConfigPath??yh(e,t),r=t.projectConfigPath??gh(t.cwd),o=Sh(e,t),i=Ch(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Wn(o,n),projectConfigTarget:Wn(i,r)}}function Sh(e,t){let n=t.userConfigPath?kt(kt(Ot(t.userConfigPath))):kt(Ot(t.userConfigDir??$i(e,t)));return Tt(n,"user policy")}function Ch(e,t){let n=Ot(t),r=Ot(e),o=uh(n,r);if(o!==".."&&!o.startsWith(`..${dh}`)&&!ch(o))return Tt(n,"project policy");return Tt(kt(kt(r)),"project policy")}function ac(e,t){return Mt(e,t,Ql)}var le=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ut=/^[a-zA-Z][a-zA-Z0-9_-]*$/,dt=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),lc=new Set(["python","python3","python2","node","ruby","perl"]),$r=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Ur=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var cc="Rulebook exceeds CC Safety Net's safe validation limits.",uc="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function dc(e){if(Ui(e.allowed_commands,Oe.maxAllowedCommands)||Ui(e.rules,Oe.maxRules)||Ui(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Ui(e,t){return Array.isArray(e)&&e.length>t}var Hi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var ji=64,Vi="Rule config exceeds CC Safety Net's safe source limit.";function L(e){return I(e).toLowerCase()}function I(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function fe(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var bh=new Map([["bash",new Set(["O","o"])],["dash",new Set(["o"])],["ksh",new Set(["o"])],["sh",new Set(["o"])],["zsh",new Set(["o"])]]),vh=new Map([["zsh",new Set(["o"])]]),Eh=new Map([["bash",new Set(["--init-file","--rcfile"])]]);function mc(e,t){for(let n=0;n<t.length;n++){let r=t[n];if(r===void 0||r==="--"||r==="-"||r[0]!=="-"&&r[0]!=="+")return null;if(r.startsWith("--")){let s=Eh.get(e);if(xh(r,s))continue;if(!s?.has(r))continue;if(t[n+1]===void 0)return null;n++;continue}let o=Rh(e,r);if(o.commandSelected)return t[n+o.followingValues+1]??null;let i=t[n+1];if(e==="ksh"&&(r==="-o"||r==="+o")&&i!==void 0&&i[0]!=="-"&&i[0]!=="+")n++;n+=o.followingValues}return null}function Rh(e,t){let n=bh.get(e),r=vh.get(e),o=!1,i=0;for(let s=1;s<t.length;s++){let a=t[s];if(a===void 0)break;if(t[0]==="-"&&a==="c")o=!0;if(e==="ksh"&&a==="o"){if(s+1<t.length){let l=t.slice(s+1);if(!o&&t[0]==="-"&&l==="c")continue;if(!o&&t[0]==="-"&&l[0]==="-"&&l.endsWith("c"))o=!0;break}if(o)i++;continue}if(!n?.has(a))continue;if(r?.has(a)&&s+1<t.length)break;i++}return{commandSelected:o,followingValues:i}}function xh(e,t){return t!==void 0&&[...t].some((n)=>e.startsWith(`${n}=`))}function Gn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Hr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of _h(e))Gn(n,t);return t.inSingle||t.inDouble}function _h(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Gn(s,n)}return t}var Ki=new Set(["rm","find","xargs","parallel"]),wh=new Set(["git","busybox",...Ki,...J,...lc,...we]),Ah=new Set(["python","node","ruby","perl"]);function fc(e){let t=L(e);return wh.has(t)||Me(t)}function Me(e){return Ah.has(Ph(e))}function Ph(e){let t=I(e).toLowerCase();return $r.test(t)?"python":t}function qi(e){try{let t=Gr(Th(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Oh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof se)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Th(e){return typeof e==="string"?Zl(e):e}var O=(e,t)=>({path:e,message:t,kind:"typed"}),ce=(e,t)=>({path:e,message:t,kind:"custom"});function pc(e){let t=new Set;return e.flatMap((n,r)=>{let o=cn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ce(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Yi=`must be one of ${Hi.join(", ")}`,Ih=/^[^/]+\/[^/]+$/,kh=["version","rules","overrides","transparent_wrappers"];function Oh(e){let t=Mh(e);return{errors:Zi($h(t,kh,(n)=>n.kind==="custom"),": "," "),sources:Bh(e,t)}}function Mh(e){if(!cn(e))return[O([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>ji;return[...e.version===1?[]:[O(["version"],"must be 1")],...Dh(e.rules,t),...Wh(e.overrides),...Gh(e.transparent_wrappers),...t?[]:Lh(e.rules),...cn(e.overrides)?Object.keys(e.overrides).filter((n)=>!Ih.test(n)).map((n)=>ce(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...zh(e.transparent_wrappers)]}function Dh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[O(["rules"],"must be an array of rulebook source strings"),...gc(e,ji)?[O(["rules"],Vi)]:[]];if(t)return[{path:["rules"],message:Vi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[O(["rules",r],"must be a rulebook source string"),...Nh(n,1)?[O(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[O(["rules",r],"must be a non-empty rulebook source string")]:[]})}function gc(e,t){let n=hc(e);return n!==void 0&&!(n<=t)}function Nh(e,t){let n=hc(e);return n!==void 0&&!(n>=t)}function hc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Lh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ce(["rules",r],"must be a non-empty rulebook source string")];let o=nc(n);if(o)return[ce(["rules",r],o)];if(t.has(n))return[ce(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Wh(e){if(e===void 0)return[];if(!cn(e))return[O(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!cn(n))return[O(["overrides",t],'must be "off" or an object')];return[...Fh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||Xi(n.intent)?[]:[O(["overrides",t,"intent"],Yi)]]})}function Fh(e,t){if(typeof e!=="string")return[O(t,"required non-empty string"),...gc(e,dt)?[O(t,`must be at most ${dt} characters`)]:[]];if(e==="")return[O(t,"required non-empty string")];return e.length>dt?[O(t,`must be at most ${dt} characters`)]:[]}function Gh(e){if(e===void 0)return[];if(!Array.isArray(e))return[O(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[O(["transparent_wrappers",n],"must be a command string")];return ut.test(t)?[]:[O(["transparent_wrappers",n],"must match command pattern")]})}function zh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ut.test(n))return[];if(t.has(n))return[ce(["transparent_wrappers",r],`duplicate command "${n}"`)];if(fc(n))return[ce(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Bh(e,t){let n=cn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function $h(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function Zi(e,t,n){return[...new Set(e.map((r)=>{let o=Uh(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function Uh(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Xi(e){return Hi.includes(e)}function cn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Sc(e){let t=Vh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Hh=`required non-empty string up to ${dt} characters`,yc="must be a non-empty array of unique non-empty strings",jh="required non-empty array of non-empty strings";function Vh(e){if(!mt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!dc(e))return{errors:[cc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...Zi(Kh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),uc]:t,ruleNames:new Set(Cc(e).map((n)=>n.toLowerCase()))}}function Cc(e){let t=mt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=mt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Kh(e,t){return[...typeof e.name==="string"&&It.test(e.name)?[]:[O(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[O(["version"],"required non-empty string")],...qh(e.allowed_commands),...Yh(e.rules,t),...Qh(e.tests),...ey(e),...ty(e)]}function qh(e){if(!Array.isArray(e))return[O(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ut.test(n)?[]:[O(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ut.test(n))return[];if(t.has(n))return[ce(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Yh(e,t){if(!Array.isArray(e))return[O(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!mt(n))return[O(["rules",r],"must be an object")];return t?Xh(n,["rules",r]):Zh(n,["rules",r])}),...pc(e)]}function Zh(e,t){return[...bc(e.name,t),...vc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ut.test(e.subcommand)?[]:[O([...t,"subcommand"],"must match command pattern")],...jr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Ec(e.reason,t),...Rc(e.intent,t)]}function Xh(e,t){return[...bc(e.name,t),...vc(e.command,t),...Ec(e.reason,t),...Rc(e.intent,t),...Jh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[O([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[O([...t,"block_args"],"not supported in rulebook_version 2")]]}function bc(e,t){if(typeof e!=="string")return[O([...t,"name"],"required string")];return It.test(e)?[]:[O([...t,"name"],"must match rule name pattern")]}function vc(e,t){return typeof e==="string"&&ut.test(e)?[]:[O([...t,"command"],"required string matching command pattern")]}function Ec(e,t){return typeof e==="string"&&e!==""&&e.length<=dt?[]:[O([...t,"reason"],Hh)]}function Rc(e,t){return e===void 0||Xi(e)?[]:[O([...t,"intent"],Yi)]}function Jh(e,t){if(!mt(e))return[O(t,"required object")];return[...jr(e.command_path,[...t,"command_path"],jh,!1),...e.any_args===void 0?[]:jr(e.any_args,[...t,"any_args"],yc,!0),...e.exclude_args===void 0?[]:jr(e.exclude_args,[...t,"exclude_args"],yc,!0)]}function jr(e,t,n,r){if(!Array.isArray(e))return[O(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[O([...t,s],"must be a non-empty string")];return i===""?[ce([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ce(t,n)]:[],...r&&new Set(e).size!==e.length?[ce(t,"must not contain duplicate values")]:[]]}function Qh(e){if(e===void 0)return[];if(!Array.isArray(e))return[O(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!mt(t))return[O(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[O(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[O(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[O(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ce(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function ey(e){if(!Array.isArray(e.tests))return[];let t=new Set(Cc(e));return[...new Set(e.tests.flatMap((n)=>mt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ce(["tests"],`blocked fixture references unknown rule "${n}"`))}function ty(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=mt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ce(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function mt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Tc(e,t){let n=sc(e,t),r=!1;try{r=Xl(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof se)return uy(n,f.message);throw f}let o=qi(n.userConfigTarget),i=r?{config:null,errors:[]}:qi(n.projectConfigTarget),s=Ac(n.userConfigPath,o.errors),a=Ac(n.projectConfigPath,i.errors),l=new Set,c=o.config?xc(o.config,Vr(n.userConfigPath),"user",n.userScope,l):Pc(),d=i.config?xc(i.config,Vr(n.projectConfigPath),"project",n.projectScope,l):Pc(),m=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[..._c(c.rules,m),..._c(d.rules,u)],transparent_wrappers:ly(o.config,i.config),rulebooks:[...c.rulebooks,...d.rulebooks],errors:[...s,...a,...c.errors,...d.errors],warnings:[...c.warnings,...d.warnings,...c.canValidateOverrides?wc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?cy(u,c.knownRuleIds,n.projectConfigPath):[],...d.canValidateOverrides?wc(u,d.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function xc(e,t,n,r=Tt(Vr(Vr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let d=ry(c,t,r);if(d.errors.length>0||!d.rulebook)return i.push(...d.errors),[];let m=d.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:ny(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((u)=>`${m.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),entries:a.map((c)=>({spec:c.rulebook.spec,name:c.rulebook.name,version:c.rulebook.version,ruleCount:c.rulebook.rules.length})),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function ny(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function ry(e,t,n){let r=oy(e),o=ac(t,r),i=sy(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${iy(e)}`]};let s=ay(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function oy(e){return zr(e)?Bi(e).name:e}function iy(e){return zr(e)?`run ${ic} to vendor ${e}`:"create that file or remove that source from the rules config"}function sy(e,t){try{return{content:Gr(Wn(t,e))}}catch(n){if(n instanceof se)return{error:n.message};throw n}}function ay(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Sc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function ly(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function _c(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function wc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function cy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Ac(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function uy(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Pc(){return{rules:[],rulebooks:[],entries:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as xy,readFileSync as _y}from"fs";var Ic=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Ji=new Set(Ic.map((e)=>e.id)),Kr=Ic,dy=new Map(Kr.map((e)=>[e.id,e.intent]));function S(e,t){return{id:e,reason:t,intent:dy.get(e)??"manual_only"}}var Qi=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],qr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},my=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],fy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],es=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...fy.flatMap((e)=>my.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Yr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],kc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],py=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ts=kc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ns=kc.flatMap((e)=>py.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),zn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},rs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),os=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],gy=[...Qi,qr,...es,...ts,...ns,zn,...rs,...os,...Yr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Zr=new Set(Yr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),hy=gy.map((e)=>e.id),is=new Set(hy);import{isAbsolute as ss,join as yy,normalize as Sy,sep as Xr}from"path";var Oc=process.platform==="win32",Cy=/[*?]/;function Bn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function as(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Bn(e.trim(),t);if(!ss(n))return"must be an absolute path or start with ~/";return $n(n,t)}function ls(e,t){let n=Mc(e,t);if(n===null)return"must be a non-empty path string";if(!ss(n))return null;if($n(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var by="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",vy="cannot cover the guard's own configuration";function Mc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Bn(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function cs(e,t){let n=Mc(e,t);if(n===null)return"must be a non-empty path string";if(Cy.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!ss(n))return null;if($n(n,t)!==null)return by;return Ey(n,t)?vy:null}function Ey(e,t){let n=Jr(e),r=Jr(yy(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Xr}`)}function $n(e,t){let n=Jr(e),r=Jr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Xr)?n:`${n}${Xr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Jr(e){let t=Sy(e);if(Oc)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(Oc?3:1)&&t.endsWith(Xr))t=t.slice(0,-1);return t}var Dc=30,us=1,ds=365;function Nc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Lc=new Set(Kr.filter((e)=>e.catastrophic).map((e)=>e.id));function T(e,t){if(!e)return null;if(Lc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function Q(e,t,n){if(Lc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Wc(e,t){return Object.freeze(Object.fromEntries(Kr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Fc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Wc(e,t)})}var Gc={standard:0,strict:1,paranoid:2};function $c(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:ms(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:ms(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:ms(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:Ry(e,t)}}function ms(e,t){return[...new Set([...e,...t??[]])]}function Ry(e,t){let n=t.safety?.level,r=Mr[e.safety.level];return[...n&&Gc[n]<Gc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...sn.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...zc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...zc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Zr.has(o))),...e.destructive_command_protection.enabled?Bc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Bc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function zc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Bc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var gs=new Set(["standard","strict","paranoid"]),Vc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Dc}};function Kc(e,t){let n=Ny(ln(e,t),e.home),r=to(Fn(t.cwd),e.home),o=Ay(r.parsed,e.home),i=Object.keys(o.policy).length>0?$c(n.gui??Vc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ps(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var wy="project policy audit settings are ignored; audit is user scope only";function Ay(e,t){if(!ve(e))return{policy:{},diagnostics:[]};let n=ve(e.safety)?e.safety:{},r=ve(e.workflow)?e.workflow:{},o=ve(e.destructive_command_protection)?e.destructive_command_protection:{},i=ve(e.secret_protection)?e.secret_protection:{},s={...gs.has(n.level)?{level:n.level}:{},...ve(n.overrides)?Uc({overrides:qc(n.overrides,sn,"safety.overrides",Dt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:eo(o.overrides,Ji,"destructive_command_protection.overrides",Dt)}:{},...o.allow_paths!==void 0?{allow_paths:dn(o.allow_paths,as,t,"destructive_command_protection.allow_paths",Dt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:eo(i.overrides,is,"secret_protection.overrides",Dt)}:{},...i.deny_paths!==void 0?{deny_paths:dn(i.deny_paths,ls,t,"secret_protection.deny_paths",Dt)}:{},...i.allow_paths!==void 0?{allow_paths:dn(i.allow_paths,cs,t,"secret_protection.allow_paths",Dt)}:{}};return{policy:Uc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[wy]}}function qc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(`${n}.${o}`,Yc);return[]}))}function Uc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Dt=()=>{return},Yc="not a boolean",Zc="not an object",Py=`not an integer between ${us} and ${ds}`,Ty=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Iy(e,t){let n=[];return{policy:Xc(e,t,(o,i)=>{n.push({path:o,reason:i})}),drops:n}}function ky(e,t){return Xc(e,t,Dt)}function Xc(e,t,n){if(!ve(e))return n("","not a JSON object"),Qr();if(e.version!==1)n("version","not 1");let r=un(e.safety,"safety",["level","overrides"],n),o=un(r.overrides,"safety.overrides",sn,n),i=un(e.workflow,"workflow",["worktree_mode"],n),s=un(e.destructive_command_protection,"destructive_command_protection",["enabled","overrides","allow_paths"],n),a=un(e.secret_protection,"secret_protection",["enabled","overrides","deny_paths","allow_paths"],n),l=un(e.audit,"audit",["retention_days"],n);return Jc(e,Ty,"",n),{version:1,safety:{level:Oy(r.level,n),overrides:qc(o,sn,"safety.overrides",n)},workflow:{worktree_mode:fs(i.worktree_mode,"workflow.worktree_mode",!1,n)},destructive_command_protection:{enabled:fs(s.enabled,"destructive_command_protection.enabled",!0,n),overrides:eo(s.overrides,Ji,"destructive_command_protection.overrides",n),allow_paths:dn(s.allow_paths,as,t,"destructive_command_protection.allow_paths",n)},secret_protection:{enabled:fs(a.enabled,"secret_protection.enabled",!0,n),overrides:eo(a.overrides,is,"secret_protection.overrides",n),deny_paths:dn(a.deny_paths,ls,t,"secret_protection.deny_paths",n),allow_paths:dn(a.allow_paths,cs,t,"secret_protection.allow_paths",n)},audit:{retention_days:My(l.retention_days,n)}}}function un(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(t,Zc),{};return Jc(e,n,t,r),e}function Jc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r(n===""?o:`${n}.${o}`,"unknown field")}function Oy(e,t){if(e===void 0)return"standard";if(gs.has(e))return e;return t("safety.level","not one of standard, strict, paranoid"),"standard"}function fs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(t,Yc);return n}function My(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=us&&e<=ds))t("audit.retention_days",Py);return Nc(e)}function eo(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(n,Zc),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r(`${n}.${o}`,"unknown rule id"),[];if(i==="on"||i==="off")return[[o,i]];return r(`${n}.${o}`,'not "on" or "off"'),[]}))}function dn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(r,"not an array"),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(`${r}[${s}]`,a),[]})}function ve(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Qr(){return structuredClone(Vc)}function to(e,t){if(!xy(e))return{exists:!1,policy:Qr(),errors:[]};try{let n=_y(e,"utf-8");if(!n.trim())return{exists:!0,policy:Qr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Iy(r,t);if(o.drops.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.drops.map((i)=>`${e}: ${Dy(i)}`),fallback:ve(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Qr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}function Dy(e){return e.path===""?e.reason:`${e.path}: ${e.reason}`}function Ny(e,t){let n=to(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ve(r))return{policy:jc(),errors:[]};let o=ky(r,t);return{policy:ps(o),gui:o,errors:[],levelPresent:Hc(r)}}if(n.parsed===void 0)return{policy:jc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ps(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Hc(n.parsed)}}function Hc(e){let t=ve(e)&&ve(e.safety)?e.safety:{};return gs.has(t.level)}function Qc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Zr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function jc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Qc({}),denyPaths:[],allowPaths:[]}}}function ps(e){return{safety:Ly(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Qc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function Ly(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function eu(e,t){let n=Tc(e,t),r=Kc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((d)=>d.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...zy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return By(o,Wy(n,r),s,r.policyScopes)}function Wy(e,t){let n=Gy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:$y(e.errors.length>0?Fy(e.errors):void 0,e.warnings.length>0?ys(e.warnings.join("; ")):void 0,n)}}function Fy(e){return`${ys(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Gy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function zy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function By(e,t,n=Object.freeze({}),r){let o=hs(structuredClone(e)),i=r?{policyScopes:hs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function hs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))hs(t);return Object.freeze(e)}function $y(...e){return ys(e.filter((t)=>!!t).join("; "))}function ys(e){return/[.!?]$/.test(e)?e:`${e}.`}function tu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Ss(t.fail_closed,e.strict,"strict"),paranoid_rm:Ss(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Ss(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Fc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Ai({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Ss(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Un(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Uy=/^[A-Za-z_][A-Za-z0-9_]*=/;function no(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Hn(e){let t=no(e.words[0],"time")?1:0,n=t===1&&no(e.words[t],"-p")?t+1:t,r=t===1&&no(e.words[n],"--")?n+1:n,o=no(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Uy.test(s.text));return i?.provenance==="literal"?i.text:void 0}function ro(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Hy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>pe(t)))})}function oo(e,t,n){e.push(n),t.reset()}function io(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Cs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function mn(e,t,n,r,o,i,s){return Cs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function pe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t,span:Object.freeze(t.span)}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Hy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:pe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function bs(e,t,n){if(t>=n||ru(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!ru(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=nu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=nu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,span:{start:t,end:s},ambiguous:i}}function vs(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=jy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?Vy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`,span:s.declarationSpan}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function nu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function ru(e){return/[\s;&|<>)]/u.test(e)||e==="`"}function jy(e,t,n){let r=t;while(r<n&&e[r]!==`
 `&&e[r]!=="\r")r++;let o=r>=n?n:e[r]==="\r"&&e[r+1]===`
-`?r+2:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function iA(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var Cb=new Set(["&&","||","|","|&"]);function Eb(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return Pe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`,span:n}],nodes:[]});let r=Ss(e,0,e.length,t,{used:0,max:t.maxWords},0);return Pe({kind:"program",dialect:"posix",source:e,span:n,status:Es(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ss(e,t,n,r,o,i,s){let a=[],c=[],l=hs(),u=[],d=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end},p=l.words.map((h)=>h.text);ys(a,l,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:c.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},m=t;while(m<n){let f=e[m];if(!f)break;if(s&&f===s)return d(),xb(a,c),{nodes:a,issues:c,next:m+1,closed:!0,limited:!1,pendingHeredocs:u};if(Cs(f)){if(f===`
-`||f==="\r"){d();let C=f==="\r"&&e[m+1]===`
-`?m+2:m+1,P=a.at(-1);if(P?.kind!=="connector"||!Cb.has(P.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(m,C),span:Object.freeze({start:m,end:C})}));if(u.length>0){let L=ru(e,C,n,u.splice(0));c.push(...L.issues),m=L.next;continue}m=C;continue}m++;continue}if(f==="#"){while(m<n&&e[m]!==`
-`&&e[m]!=="\r")m++;continue}let p=l.start===-1?wA(e,m,n):void 0;if(p){if(iu(a,c,m),i>=r.maxDepth)return sr(a,c,m,"depth-limit",r.maxDepth);if(!ou(o))return sr(a,c,m,"word-limit",r.maxWords);let C=Ss(e,p.braceIndex+1,n,r,o,i+1,"}"),P=C.next,L={start:p.braceIndex+1,end:C.closed?P-1:P},k=vb(e,L,C);if(a.push({kind:"function",name:p.name,span:{start:m,end:P},body:k}),c.push(...C.issues),C.pendingHeredocs.length>0||po(C.nodes))c.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely",span:{start:m,end:P}});if(u.push(...C.pendingHeredocs),C.limited)return _s(a,c,C.next);if(!C.closed)c.push({code:"unclosed-function-body",message:"function body is not closed",span:{start:p.braceIndex,end:P}});m=P;continue}let h=xs(e,m);if(h){if(d(),!Ob(a.at(-1)))c.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`,span:{start:m,end:m+h.length}});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:m,end:m+h.length})})),m+=h.length;continue}if(f===")"){d(),c.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis",span:{start:m,end:m+1}}),a.push({kind:"unknown",source:f,span:{start:m,end:m+1}}),m++;continue}if((f==="("||f==="{"&&fA(e,m,n))&&l.start===-1){if(iu(a,c,m),i>=r.maxDepth)return sr(a,c,m,"depth-limit",r.maxDepth);let C=f==="("?")":"}",P=Ss(e,m+1,n,r,o,i+1,C),L=P.next,k={start:m+1,end:P.closed?L-1:L},U=vb(e,k,P);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:m,end:L},body:U}),c.push(...P.issues),P.pendingHeredocs.length>0||po(P.nodes))c.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely",span:{start:m,end:L}});if(u.push(...P.pendingHeredocs),P.limited)return _s(a,c,P.next);if(!P.closed)c.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`,span:{start:m,end:L}});m=L;continue}let y=(f==="<"||f===">")&&e[m+1]!=="("?lA(e,m):null;if(y){let C=l.words.at(-1),P=C&&C.span.end===m&&/^[0-9]+$/.test(C.raw)?Number(C.raw):void 0;if(P!==void 0)l.words.pop();let L=P===void 0?m:C?.span.start??m;l.start=l.start===-1?m:l.start;let k=m+y.length;while(k<n&&/[ \t]/.test(e[k]??""))k++;let U=e[k],oe=k>m+y.length&&U==="#",ie=!U||Cs(U)||!!xs(e,k)||U===s||U===")"||oe||(U==="<"||U===">")&&e[k+1]!=="(",Y=y==="<<"||y==="<<-"?nu(e,k,n):void 0,j=Y?{word:ir(e,k,Y.next,Y.delimiter,"literal",Y.quoted),nested:[],issues:[],next:Y.next,limited:!1}:!ie?su(e,k,n,r,o,i):void 0;if(j){if(c.push(...j.issues),j.limited)return _s(a,c,j.next);if(!ou(o))return sr(a,c,j.next,"word-limit",r.maxWords)}let R=j?.next??m+y.length,T={kind:"redirection",operator:y,span:{start:L,end:R},...P===void 0?{}:{fd:P},...j?{target:j.word}:{}};if(l.redirections.push(T),y==="<<"||y==="<<-")if(!Y)c.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word",span:{start:m,end:m+y.length}});else{if(Y.ambiguous||Y.delimiter.length===0)c.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely",span:Y.span});let B=l.nested;u.push({delimiter:Y.delimiter,quotedDelimiter:Y.quoted,stripTabs:y==="<<-",declarationSpan:{start:L,end:R},attach:(S)=>{if(T.heredoc=S,S.quotedDelimiter)return;B.push(...aA(e,S.bodySpan.start,S.bodySpan.end,r,o,i+1))}})}else if(!j)c.push({code:"missing-redirection-target",message:`redirection ${y} requires a target word`,span:{start:m,end:m+y.length}});if(j)l.nested.push(...j.nested);l.end=R,m=R;continue}if(l.start===-1)iu(a,c,m);let v=su(e,m,n,r,o,i);if(c.push(...v.issues),v.limited)return _s(a,c,v.next);let E=hA(l.words)?SA(e,v.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(E?.limitCode)return sr(a,c,v.next,E.limitCode,E.limitCode==="word-limit"?r.maxWords:E.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let A=E?.words??[v.word];for(let C of A){if(!ou(o))return sr(a,c,v.next,"word-limit",r.maxWords);l.words.push(C)}l.start=l.start===-1?m:l.start,l.end=v.next,l.nested.push(...v.nested),m=v.next>m?v.next:m+1}return d(),xb(a,c),c.push(...RA(u)),{nodes:a,issues:c,next:m,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function vb(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:Es(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function su(e,t,n,r,o,i){let s="",a=t,c=!1,l="literal",u=[],d=[],m=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||Cs(f)||(f===";"||f==="|"||f==="&")&&xs(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){c=!0;let y=e.indexOf("'",a+1);if(y===-1||y>=n){s+=e.slice(a+1,n),d.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:a,end:n}}),a=n;break}s+=e.slice(a+1,y),a=y+1;continue}if(f==='"'){c=!0;let y=sA(e,a,n,r,o,i);if(s+=y.text,u.push(...y.nested),d.push(...y.issues),m||=y.limited,l=fo(l,y.provenance),a=y.next,m)break;continue}if(e.startsWith("$'",a)){c=!0;let y=uA(e,a+2,n);if(s+=y.text,d.push(...y.issues),!y.closed)d.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed",span:{start:a,end:n}});a=y.next;continue}if(f==="\\"){let y=e[a+1];if(!y){d.push({code:"trailing-escape",message:"escape has no following character",span:{start:a,end:a+1}}),a++;break}if(y===`
-`){a+=2;continue}s+=y,a+=2;continue}let h=f==="$"||f==="<"||f===">"||f==="`"?ws(e,a,n,r,o,i):null;if(h){let y=wb(h,u,d);if(m||=y.limited,l=fo(l,y.provenance),a=y.next,m)break;continue}if(f==="$"){let y=Ab(e,a,n,s,l);s=y.text,l=y.provenance,a=y.next;continue}if(f==="*"||f==="?"||f==="[")l=fo(l,"glob");s+=f,a++}return{word:ir(e,t,a,s,l,c,l==="literal"?void 0:mA(e,t,a)),nested:u,issues:d,next:a,limited:m}}function sA(e,t,n,r,o,i){let s="",a="literal",c=[],l=[],u=!1,d=t+1;while(d<n){let m=e[d];if(m==='"')return{text:s,provenance:a,nested:c,issues:l,next:d+1,limited:u};if(m==="\\"&&e[d+1]){let p=e[d+1]??"";if(p===`
-`){d+=2;continue}if(p==="\r"&&e[d+2]===`
-`){d+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,d+=2;continue}if(e.startsWith("$((",d)){let p=au(e,d+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(d,h),p===-1)l.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:d,end:h}});d=h;continue}let f=ws(e,d,n,r,o,i);if(f){let p=wb(f,c,l);if(d=p.next,u||=p.limited,a=fo(a,p.provenance),u)return{text:s,provenance:a,nested:c,issues:l,next:d,limited:u};continue}if(m==="$"){let p=Ab(e,d,n,s,a);s=p.text,a=p.provenance,d=p.next;continue}s+=m??"",d++}return l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:t,end:n}}),{text:s,provenance:a,nested:c,issues:l,next:n,limited:u}}function ws(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,c=e.startsWith("<(",t)||e.startsWith(">(",t),l=e[t]==="`";if(!s&&!a&&!c&&!l)return null;let u=s?3:l?1:2,d=s?"))":l?"`":")",m=au(e,t+u,n,d),f=m===-1?n:m,p=m===-1?n:m+d.length;if(i>=r.maxDepth)return{program:EA(e,t+u,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let E=[],A=[],C=!1,P=t+u;while(P<f){let L=ws(e,P,f,r,o,i+1);if(!L){P++;continue}if(E.push(...L.program.nodes),A.push(...L.program.issues),C||=L.program.status==="limited",P=L.next,C)break}if(m===-1)A.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:t,end:p}});return{program:Pe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:Es(A,C),issues:A,nodes:E}),next:p,provenance:"arithmetic"}}let h=Ss(e,t+u,f,r,o,i+1),y=m===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`,span:{start:t,end:p}}]:[],v=(l||c)&&po(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions",span:{start:t,end:p}}]:[];return{program:Pe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:Es([...h.issues,...y,...v],h.limited),issues:[...h.issues,...y,...v],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function aA(e,t,n,r,o,i){let s=[],a=t;while(a<n){let c=e[a];if(c==="\\"){a+=2;continue}let l=c==="$"||c==="`"?ws(e,a,n,r,o,i):null;if(!l){a++;continue}if(s.push(l.program),a=l.next,l.program.status==="limited")break}return s}function wb(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function au(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++)if(e[a]==="\\")a++;else if(e[a]==="`")return a;return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let c=e[a];if((c===`
-`||c==="\r")&&s.length>0){let u=c==="\r"&&e[a+1]===`
-`?a+2:a+1,d=ru(e,u,n,s.splice(0));if(!d.terminated)return-1;a=d.next-1;continue}let l=Rb(e,a,t,n,i);if(l!==null){a=l;continue}if(!i.double&&e.startsWith("$((",a)){let u=cA(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&c==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",d=a+(u?3:2);while(d<n&&/[ \t]/.test(e[d]??""))d++;let m=nu(e,d,n);if(m){s.push({delimiter:m.delimiter,quotedDelimiter:m.quoted,stripTabs:u,declarationSpan:{start:a,end:m.next},attach:()=>{return}}),a=m.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(c==="("&&!i.double)o++;if(c===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function cA(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=Rb(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function Rb(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!PA(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function xs(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function lA(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function Cs(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function Pb(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function uA(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=dA(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`,span:{start:i,end:a.next}});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function dA(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return vs(e,t+1,n,16,2,t+1);if(r==="u")return vs(e,t+1,n,16,4,t+1);if(r==="U")return vs(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return vs(e,t,n,8,3,t+1);return{text:r,next:t+1}}function vs(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",c=t;while(c<n&&a.length<o&&s.test(e[c]??""))a+=e[c],c++;if(!a)return{text:e[i-1]??"",next:i};let l=Number.parseInt(a,r);return l>1114111||l>=55296&&l<=57343?{text:"\uFFFD",next:c,invalidCodePoint:l}:{text:String.fromCodePoint(l),next:c}}function Es(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function Ab(e,t,n,r,o){let i=Pb(e,t,n);return{text:r+e.slice(t,i),provenance:fo(o,"variable"),next:i}}function mA(e,t,n){let r=bs(e),o=t,i=!1,s=!1,a=t;while(a<n){let c=e[a];if(c==="\\"&&!i){a+=2;continue}if(!s&&c==="'"){i=!i,a++;continue}if(!i&&c==='"'){s=!s,a++;continue}if(i){a++;continue}let l=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!l,d=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),m=c==="`";if(l||u||d||m){let f=l?3:m?1:2,p=l?"))":m?"`":")",h=au(e,a+f,n,p),y=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,y,l?"arithmetic":"command-substitution"),a=y,o=y;continue}if(c==="$"){let f=Pb(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(c==="*"||c==="?"||c==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function fo(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function fA(e,t,n){return t+1>=n||Cs(e[t+1]??"")||xs(e,t+1)!==null}var pA=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),gA=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function hA(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=yA(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function yA(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return bA(e,t);if(n==="env")return vA(e,t);if(n==="sudo")return _A(e,t);return}function bA(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function vA(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(pA.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function _A(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(gA.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function kb(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=[e.raw],i=e.raw.length,s=0;while(!0){let c=o.findIndex((p)=>Sb(p));if(c===-1)break;if(++s>n)return{limited:!0};let l=o[c]??"",u=Sb(l);if(!u||u.kind==="range")return{limited:!0};let d=u.start+l.length-u.end,m=u.alternatives.reduce((p,h)=>p+d+h.length,0);if(i-l.length+m>r||o.length-1+u.alternatives.length>t)return{limited:!0};let f=Tb(l,u);o.splice(c,1,...f),i+=m-l.length}if(s===0)return;let a=o.map((c)=>CA(c,n));if(a.some((c)=>c===null))return{limited:!0};return{words:[...new Set(a.filter((c)=>c!==null&&c!==""))]}}function SA(e,t,n,r,o){if(t.provenance!=="literal"||t.quoted||t.raw!==t.text||!t.raw.includes("{"))return;let i=[t.text],s=t.text.length,a=0;while(!0){let l=i.findIndex((y)=>_b(y));if(l===-1)break;if(++a>r)return{limitCode:"depth-limit"};let u=i[l]??"",d=_b(u);if(!d)break;let m=d.start+u.length-d.end,f=d.alternatives.filter((y)=>m+y.length>0),p=f.reduce((y,v)=>y+m+v.length,0);if(s-u.length+p>o)return{limitCode:"brace-expansion-limit"};if(i.length-1+f.length>n)return{limitCode:"word-limit"};let h=Tb(u,{...d,alternatives:f});i.splice(l,1,...h),s+=p-u.length}let c=i.filter((l)=>l.length>0);if(a===0)return;return{words:c.map((l)=>ir(e,t.span.start,t.span.end,l,"literal",!1))}}function _b(e){let t=[],n;for(let r=0;r<e.length;r++){let o=e[r];if(o==="{"){t.push({start:r,commas:[]});continue}if(o===","&&t.length>0){t.at(-1)?.commas.push(r);continue}if(o!=="}"||t.length===0)continue;let i=t.pop();if(!i||i.commas.length===0)continue;if(!n||i.start<n.start)n={start:i.start,end:r+1,commas:i.commas}}if(!n)return;return{start:n.start,end:n.end,alternatives:Ib(e,n)}}function Sb(e){let t=[],n,r=null,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(o){o=!1;continue}if(s==="\\"&&r!=="'"){o=!0;continue}if(s===r){r=null;continue}if(r===null&&(s==="'"||s==='"')){r=s;continue}if(r!==null)continue;if(s==="{"){t.push({start:i,commas:[]});continue}if(s===","&&t.length>0){t.at(-1)?.commas.push(i);continue}if(s!=="}"||t.length===0)continue;let a=t.pop();if(!a)continue;let c=a.commas.length>0?{kind:"alternatives",start:a.start,end:i+1,commas:a.commas}:xA(e.slice(a.start+1,i))?{kind:"range",start:a.start,end:i+1}:void 0;if(c&&(!n||c.start<n.start))n=c}if(!n||n.kind==="range")return n;return{kind:n.kind,start:n.start,end:n.end,alternatives:Ib(e,n)}}function Tb(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function Ib(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function xA(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function CA(e,t){let n=`x${e}`,r=su(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function EA(e,t,n,r){return Pe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit",span:{start:t,end:n}}],nodes:[]})}function sr(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`,span:{start:n,end:n}}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function _s(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function ou(e){return e.used++,e.used<=e.max}function wA(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function po(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>po(n.nodes));return(t.kind==="group"||t.kind==="function")&&po(t.body.nodes)})}function RA(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`,span:t.declarationSpan}))}function Ob(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function xb(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!Cb.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`,span:n.span})}function iu(e,t,n){if(!Ob(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector",span:{start:n,end:n+1}})}function PA(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var zb=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),AA=new Set(["gc","cat","type","cp","mv","rm"]),Nb=["-rec","-for","-path","-literalpath","-whatif"],kA=/^\$env:\w/i,TA=/^(?:\$\{?\w+\}?|~)\\./,Rs={maxInputLength:131072,maxWords:16384,maxDepth:64};function Db(e){let t=e.toLowerCase().replaceAll("`","");if(![...zb].some((r)=>t.includes(r))&&!(t.includes("rm")&&Nb.some((r)=>t.includes(r)))&&!t.includes("<#")&&!IA(t))return!1;let n=MA(e);return n.invalidComment||n.commands.some(OA)}function IA(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function OA(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&zb.has(n))return!0;let r=e.slice(t+1);if(n&&AA.has(n)&&r.some(zA))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Nb.some((s)=>i.startsWith(s))})}function zA(e){return kA.test(e)||TA.test(e)}function Mb(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return Pe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`,span:n}],nodes:[]});let r=mu(e,0,e.length,t,0);return Pe({kind:"program",dialect:"powershell",source:e,span:n,status:$A(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function mu(e,t,n,r,o,i=!1){let s=[],a=[],c=hs(),l=0,u=!1,d=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end};ys(s,c,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:c.words.map((p)=>p.text).join(" ")})},m=t;while(m<n){let f=e[m];if(!f)break;if(i&&f==="}")return d(),{nodes:s,issues:a,next:m+1,closed:!0,words:l,limited:u};let p=Wb(e,m,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return d(),{nodes:s,issues:a,next:p.next,closed:!1,words:l,limited:!0};m=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
-`){d();let v=f==="\r"&&e[m+1]===`
-`?m+2:m+1;s.push(cu(e,m,v)),m=v;continue}m++;continue}let h=fu(e,m);if(h){d(),s.push(cu(e,m,m+h.length)),m+=h.length;continue}if(f==="{"){if(d(),o>=r.maxDepth)return a.push(Lb(m,r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:l,limited:!0};let v=mu(e,m+1,n,r,o+1,!0),E=v.closed?v.next-1:v.next,A=Pe({kind:"program",dialect:"powershell",source:e.slice(m+1,E),span:{start:m+1,end:E},status:v.limited?"limited":v.issues.length>0?"partial":"complete",issues:v.issues,nodes:v.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:m,end:v.next}),body:A})),a.push(...v.issues),!v.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed",span:{start:m,end:v.next}});l+=v.words,u||=v.limited,m=v.next;continue}if(f==="}"){d(),s.push(cu(e,m,m+1)),m++;continue}if(f===">"||f==="<"){c.start=c.start===-1?m:c.start;let v=e[m+1]===f?m+2:m+1,E=v;while(/[ \t]/.test(e[E]??""))E++;let A=E<n?lu(e,E,n,r,o):void 0,C=A?.next??v;if(c.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(m,v),span:Object.freeze({start:m,end:C}),...A?{target:A.word}:{}})),A)a.push(...A.issues),c.nested.push(...A.nested),l+=A.words,u||=A.limited;c.end=C,m=C;continue}if(f===","){c.start=c.start===-1?m:c.start,c.words.push(tu({text:",",raw:",",span:{start:m,end:m+1},provenance:"literal",quoted:!1})),c.end=++m;continue}let y=lu(e,m,n,r,o);if(c.start=c.start===-1?m:c.start,c.end=y.next,c.words.push(y.word),a.push(...y.issues),c.nested.push(...y.nested),l+=1+y.words,u||=y.limited,l>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`,span:{start:m,end:y.next}}),d(),{nodes:s,issues:a,next:y.next,closed:!1,words:l,limited:!0};m=y.next>m?y.next:m+1}return d(),{nodes:s,issues:a,next:m,closed:!i,words:l,limited:u}}function lu(e,t,n,r,o){let i="",s="literal",a=!1,c=[],l=[],u=0,d=!1,m=(p)=>{let h=NA(e,p,n,r,o);return i+=e.slice(p,h.next),l.push(h.program),c.push(...h.program.issues),u+=uu(h.program),d||=h.program.status==="limited",s="command-substitution",h.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||fu(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[f+1];if(!h){c.push({code:"trailing-escape",message:"PowerShell escape has no following character",span:{start:f,end:f+1}}),f++;break}i+=h,f+=2;continue}if(e.startsWith("$(",f)){f=m(f);continue}if(p==="'"){a=!0,f++;let h=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){h=!0,f++;break}i+=e[f]??"",f++}if(!h)c.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:t,end:e.length}});continue}if(p==='"'){a=!0;let h=f++,y=!1;while(f<n){let v=e[f];if(v==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(v==='"'){y=!0,f++;break}if(e.startsWith("$(",f)){f=m(f);continue}if(v==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=v??"",f++}if(!y)c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:h,end:e.length}});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:ir(e,t,f,i,s,a,s==="literal"?void 0:DA(e,t,f)),next:f,issues:c,nested:l,words:u,limited:d}}function NA(e,t,n,r,o){let i=$b(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:Pe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Lb(t,r.maxDepth)],nodes:[]}),next:a};let c=mu(e,t+2,s,r,o+1),l=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed",span:{start:t,end:a}}]:[];return{program:Pe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:c.limited?"limited":c.issues.length+l.length>0?"partial":"complete",issues:[...c.issues,...l],nodes:c.nodes}),next:a}}function $b(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function uu(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=uu(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=uu(r)}}return t}function DA(e,t,n){let r=bs(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let c=$b(e,s+2,n),l=c===-1?n:c+1;r.push(o,s,"literal"),r.push(s,l,"command-substitution"),s=l,o=l;continue}if(a==="$"||a==="@"&&s===t){let c=s+1;if(e[c]==="{"){let l=e.indexOf("}",c+1);c=l===-1||l>=n?n:l+1}else while(c<n&&/[A-Za-z0-9_:?]/.test(e[c]??""))c++;r.push(o,s,"literal"),r.push(s,c,"variable"),s=c,o=c;continue}s++}return r.push(o,n,"literal"),r.parts}function Lb(e,t){return{code:"depth-limit",message:`command structure exceeds parser limit ${t}`,span:{start:e,end:e}}}function MA(e){let t=[],n=[],r=0,o=0,i=!1,s=()=>{if(n.length>0)t.push(n);n=[]};while(r<e.length&&r<131072&&o<16384){let a=e[r];if(a==="\r"||a===`
-`){s(),r+=a==="\r"&&e[r+1]===`
-`?2:1;continue}if(/\s/.test(a??"")){r++;continue}let c=Wb(e,r,Math.min(e.length,Rs.maxInputLength),Rs.maxDepth);if(c){i||=!!c.issue||c.limited,r=c.next;continue}let l=fu(e,r);if(l){s(),r+=l.length;continue}if(a==="{"||a==="}"){s(),r++;continue}let u=lu(e,r,Math.min(e.length,Rs.maxInputLength),Rs,0);if(u.word.text)n.push(u.word.text);for(let d of u.nested)t.push(...du(d));o++,r=u.next>r?u.next:r+1}return s(),{commands:t,invalidComment:i}}function du(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return du(t.body);if(t.kind!=="command")return[];return[t.words.map((n)=>n.text),...t.nested.flatMap(du)]})}function fu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function Wb(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`,span:{start:t,end:i+2}},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed",span:{start:t,end:n}},limited:!1}}function $A(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function cu(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}var _n=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function nt(e,t="auto",n=_n){if(t==="powershell"||t==="auto"&&Db(e.slice(0,n.maxInputLength)))return Mb(e,n);return Eb(e,n)}function go(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var LA=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ps(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function As(e){let t=Ps(e.words[0],"time")?1:0,n=t===1&&Ps(e.words[t],"-p")?t+1:t,r=t===1&&Ps(e.words[n],"--")?n+1:n,o=Ps(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!LA.test(s.text));return i?.provenance==="literal"?i.text:void 0}function ho(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function ar(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of WA(e))ho(n,t);return t.inSingle||t.inDouble}function WA(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);ho(s,n)}return t}var FA=new Set(["&&","||","|&","|","&",";"]),GA=new Set(["<<","<<<",">|"]),ZA=/[*@#?$!_-]/,UA=/^\w+(?::\w+)*/,pu=Object.freeze([]),jA=Object.freeze([]),BA=256;function jb(e,t){let n=t.status==="complete"?new Set(hu(t)):new Set,r=[...n].reduce((s,a)=>s.slice(0,a.start)+" ".repeat(a.end-a.start)+s.slice(a.end),e);if(ar(r))return ks("unclosed-quote",r,pu);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=yo(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return ks("structural-limit",r,pu);if(o.invalid)return ks("invalid",r,pu);return ks("complete",r,i,o.assignmentFallbacks)}function ks(e,t,n,r=jA){return Object.freeze({status:e,source:t,entries:Object.freeze(n),assignmentFallbacks:Object.freeze(r)})}function yo(e,t){return e.nodes.flatMap((n,r)=>VA(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.entries])}function VA(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,entries:[rt(JA(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,entries:[rt(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,entries:[i?Ts("{"):rt("("),...yo(e.body,a),...s?[i?Ts("}"):rt(")")]:[]]}]}let o=QA(e,r.functions);if(o){if(r.depth>=_n.maxDepth||++r.flags.expansions>BA)return r.flags.limited=!0,[];return[{start:e.span.start,entries:[...Fb(e,r),Ts(";"),...yo(o,{...r,depth:r.depth+1}),Ts(";")]},...Gb(e,t,n,r)]}return[{start:e.span.start,entries:Fb(e,r)},...Gb(e,t,n,r)]}function Fb(e,t){return[...e.words.map((n)=>({start:n.span.start,entries:Vb(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,entries:HA(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.entries)}function HA(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Vb(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[yu(String(e.fd))],Object.freeze({kind:"redirection",operator:r,role:XA(r),targetOrder:GA.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s}}),...s===void 0?o:o.slice(1)]}function Gb(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[yu(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[rt(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,entries:a}];return[{start:s.bodySpan.start,entries:[...Bb(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?qA(t,n,r):[]]}function qA(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,entries:Bb(n.source.slice(r.span.end,e.span.end),n)}]}function Bb(e,t){if(t.depth>=_n.maxDepth)return t.flags.limited=!0,[];let n=nt(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=yo(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Vb(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,c=()=>{if(a&&!r)o.push(rt("glob"));else if(s!==""||e.quoted&&o.length===0)o.push(yu(s));s="",a=!1};for(let l of e.parts){if(l.provenance!=="command-substitution"&&l.provenance!=="arithmetic"){for(let f of gu(l.raw,i,n.flags,n.powershell)){if(typeof f==="string"){c(),o.push(rt(f));continue}s+=f.text,a||=f.glob}continue}if(i.double){let f=n.source.slice(l.span.start,l.span.end);s+=gu(f,{single:!1,double:!0},n.flags,n.powershell).map((p)=>typeof p==="string"?p:p.text).join("");continue}let u=t.nested.find((f)=>f.span.start>=l.span.start&&f.span.end<=l.span.end),d=u?yo(u,n):[];if(l.raw.startsWith("`")){s+="${}",c(),o.push(...d);continue}if(l.raw.startsWith("<(")||l.raw.startsWith(">(")){c(),o.push(l.raw.startsWith("<(")?rt("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),...d,...l.raw.endsWith(")")?[rt(")")]:[]);continue}let m=l.raw.startsWith("$((")?2:1;s+="${}",c(),o.push(...Array.from({length:m},()=>rt("(")),...d,...l.raw.endsWith(")".repeat(m))?Array.from({length:m},()=>rt(")")):[])}return c(),o}function gu(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let c=e[a]??"";if(!t.single&&!t.double&&(c==="("||c===")")){o.push({text:i,glob:s},c),i="",s=!1,a++;continue}if(r&&c==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single){if(c==="'")t.single=!1;else i+=c;a++;continue}if(t.double){if(c==='"'){t.double=!1,a++;continue}if(!r&&c==="\\"){let l=e[a+1]??"";i+=['"',"\\","$"].includes(l)?l:`\\${l}`,a+=2;continue}if(c==="$"){let l=Zb(e,a,t,n,r);i+=l.text,a=l.next;continue}i+=c,a++;continue}if(c==="'"||c==='"'){t.single=c==="'",t.double=c==='"',a++;continue}if(!r&&c==="\\"){let l=e[a+1]??"";s||=l==="*"||l==="?",i+=l,a+=2;continue}if(c==="$"){let l=Zb(e,a,t,n,r);i+=l.text,a=l.next;continue}s||=c==="*"||c==="?",i+=c,a++}return[...o,{text:i,glob:s}]}function Zb(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=YA(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let c=e.slice(t,a+1);return KA(c,n,r,o),{text:c,next:a+1}}if(i!==void 0&&ZA.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?UA:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function KA(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((l)=>s.startsWith(l));if(!a)return;let c=gu(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...c.flatMap((l)=>typeof l==="string"||!l.text?[]:[l.text]))}function YA(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;else if(e[r]==="}")n--;r++}return n===0?r-1:-1}function JA(e){return/^[\r\n]+$/.test(e)?";":e}function rt(e){return Object.freeze({kind:"operator",operator:e,boundary:FA.has(e)})}function Ts(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function yu(e){return Object.freeze({kind:"word",text:e})}function XA(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function hu(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return hu(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((s)=>hu(s)),o=e.nodes[n+1];if(o?.kind==="connector"&&(o.operator==="|"||o.operator==="|&")||!tk(t))return r;return[...r,...t.redirections.flatMap((s)=>s.heredoc?.quotedDelimiter?[s.heredoc.bodySpan]:[])]})}function QA(e,t){let n=As(e);return n===void 0?void 0:t.get(n)}function Ht(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function ek(e){if(Ht(e.words[0],"git"))return Ht(e.words[1],"commit");if(!Ht(e.words[0],"gh")||!Ht(e.words[2],"create"))return!1;return Ht(e.words[1],"pr")||Ht(e.words[1],"issue")}function tk(e){return(Ht(e.words[0],"cat")||Ht(e.words[0],"tee")||ek(e))&&!e.words.some(Ub)&&!e.redirections.some((n)=>Ub(n.target))}function Ub(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}import{types as nk}from"util";var rk=new Set(["applypatch","patch"]),ok=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),ik=new Set(["grep","grepsearch","rg"]),sk=new Set(["find","findbyname","glob"]),ak=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),ck=new Set(["command","diff","input","patch","patchtext"]),Hb=new TextEncoder,lk=new TextDecoder,uk=/\s/,dk=64;class Lt extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var bo=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Xb(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Os(e){return ak.has(Xb(e))}function Su(e){let t=Xb(e);if(rk.has(t))return"patch";if(ik.has(t))return"grep";if(sk.has(t))return"glob";if(ok.has(t))return"path";return"unknown"}function _o(e){if(!e||typeof e!=="object")return;rv(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)pt();return}if(t.get||t.set)pt();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function xu(e,t){return Qb(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Qb(e,t,n,r){let o=nv(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let c=Qb(a,t,n,r+1);return typeof a==="string"&&t.has(ev(s))?[a]:c});return n.ancestors.delete(o.object),i}function ev(e){return e.replace(/-/g,"_").toLowerCase()}function Cu(e){return tv(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(fk)}function tv(e,t,n,r){let o=nv(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>tv(a,o.array?t:ck.has(ev(s)),n,r+1));return n.ancestors.delete(o.object),i}function mk(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>bo.maxDepth||t.nodes>bo.maxNodes)pt();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>bo.maxStringBytes||t.stringBytes>bo.maxAggregateStringBytes)pt()}function nv(e,t,n){if(mk(e,t,n),!e||typeof e!=="object")return null;let r=rv(e);if(t.ancestors.has(e))pt();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>bo.maxKeys)pt();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)pt();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function rv(e){if(nk.isProxy(e))pt();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)pt();return t}function pt(){throw new Lt}function fk(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let c=0;c<n.length;c++){let l=n[c]??"";if(l==="*** Begin Patch"){r=!0,a();continue}if(l==="*** End Patch"){r=!1,a();continue}if(l.startsWith("@@")){let u=pk(l);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=l.startsWith(" ")||l.startsWith("-")?1:0,d=l.startsWith(" ")||l.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-d),i===0&&s===0)a();continue}if(l.startsWith("*** ")){a(),t.push(...bu(l));continue}if(o)continue;if(l.startsWith("diff --git ")){t.push(...bu(l));continue}if(l.startsWith("--- ")){let u=n[c+1]??"";if(!u.startsWith("+++ "))continue;t.push(..._u(Is(l.slice(4),!0),Is(u.slice(4),!0))),c++;continue}if(!r)t.push(...bu(l))}return t}function pk(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function bu(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Jb(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Jb(n[1]);if(e.startsWith("diff --git "))return gk(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Yb(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Yb(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return xk(i[1]);return[]}function gk(e){let t=hk(e);if(t.length===2&&t[0]&&t[1])return _u(t[0],t[1]);let n=yk(e);return n?_u(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function hk(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Sn(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Sn(e[n]))n++;t.push(e.slice(i,n));continue}let o=ov(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Sn(e[n]))n++;return n===e.length?t:[]}function yk(e){let t=0;while(t<e.length&&Sn(e[t]))t++;let n=e.length;while(n>t&&Sn(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Sn(e[o])){o++;continue}let i=o;while(o<n&&Sn(e[o]))o++;if(i===t||o===n)continue;if(r++,r>dk)pt();if(bk(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function bk(e,t,n,r,o){if(vu(e,t,n,r,o))return!0;let i=qb(e,"/",t,n),s=qb(e,"/",r,o);if(i<=t||s<=r)return!1;if(vu(e,t,i,r,s))return!1;return vu(e,i+1,n,s+1,o)}function vu(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function qb(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Sn(e){return e!==void 0&&uk.test(e)}function ov(e,t,n){let r=[],o=t+1;while(o<e.length){let i=e[o]??"";if(i===n)return{value:lk.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Hb.encode(i)),o++;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Hb.encode(vk(s[0]??""))),o+=2}return null}function vk(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function _k(e){return vo(Ck(e))}function _u(e,t){if(e==="/dev/null")return Kb(t);if(t==="/dev/null")return Kb(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(vo);let n=Sk(e,t)??(e===t?iv(e):null);return[e,t,...n?[n]:[]].flatMap(vo)}function Kb(e){let t=iv(e);return[e,...t?[t]:[]].flatMap(vo)}function iv(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Sk(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Yb(e){return _k(Is(e,!0))}function xk(e){return vo(Is(e,!1))}function Is(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=ov(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Ck(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function vo(e){return e===""||e==="/dev/null"?[]:[e]}function Jb(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}var sv=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),av=new Set([...sv,"glob"]),wk=new Set([...av,"pattern"]),Rk=[],cv={parseCommand:nt,projectShellSyntax:jb};class gt extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function So(e,t={}){let n=Pk({...cv,...t}),r=_o(e.input),o=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&r)o.push({usage:"input-candidate",source:r});if(e.route.kind==="command"&&"command"in e&&e.command)o.push({usage:"declared-command",source:e.command});let i=o.reduce((s,a)=>{let c=s.findIndex((d)=>d.source===a.source);if(c!==-1){let d=s[c];if(!d)return s;return s[c]={...d,usages:[...d.usages,a.usage]},s}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",u=n.getCommandProgram(a.source,l);return s.push({usages:[a.usage],source:a.source,program:u,shell:n.getShellSyntax(a.source,u)}),s},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:i,paths:Ak(e),store:n}}function Se(e,t){return e.commands.find((n)=>n.usages.includes(t))}function ht(e){if(!e.includes("$"))return e;return Zi(e,Xe())}function Pk(e={}){let t={...cv,...e},n=new Map,r=new Map,o=new WeakMap,i=(a,c)=>{let l=`${c}\x00${a}`,u=r.get(l);if(u)return u;let d=t.parseCommand(a,c);return r.set(l,d),d};return{getShellSyntax:(a,c)=>{if(c&&c.source!==a)throw TypeError("Shell syntax source does not match command program source.");let l=c??i(a,"posix");if(l.status==="limited"){let m=o.get(l);if(m)return m;let f={status:"structural-limit",source:a,entries:Rk,assignmentFallbacks:[]};return o.set(l,f),f}let u=n.get(a);if(u)return u;let d=t.projectShellSyntax(a,l);return n.set(a,d),d},getCommandProgram:i}}function Ak(e){let t=e.route.kind==="grep"?av:e.route.kind==="glob"?wk:sv;return[...xu(e.input,t),...e.route.kind==="patch"?Cu(e.input):[]]}function Ae(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var kk=new Map([["bash",new Set(["O","o"])],["dash",new Set(["o"])],["ksh",new Set(["o"])],["sh",new Set(["o"])],["zsh",new Set(["o"])]]),Tk=new Map([["zsh",new Set(["o"])]]),Ik=new Map([["bash",new Set(["--init-file","--rcfile"])]]);function lv(e,t){for(let n=0;n<t.length;n++){let r=t[n];if(r===void 0||r==="--"||r==="-"||r[0]!=="-"&&r[0]!=="+")return null;if(r.startsWith("--")){let s=Ik.get(e);if(zk(r,s))continue;if(!s?.has(r))continue;if(t[n+1]===void 0)return null;n++;continue}let o=Ok(e,r);if(o.commandSelected)return t[n+o.followingValues+1]??null;let i=t[n+1];if(e==="ksh"&&(r==="-o"||r==="+o")&&i!==void 0&&i[0]!=="-"&&i[0]!=="+")n++;n+=o.followingValues}return null}function Ok(e,t){let n=kk.get(e),r=Tk.get(e),o=!1,i=0;for(let s=1;s<t.length;s++){let a=t[s];if(a===void 0)break;if(t[0]==="-"&&a==="c")o=!0;if(e==="ksh"&&a==="o"){if(s+1<t.length){let c=t.slice(s+1);if(!o&&t[0]==="-"&&c==="c")continue;if(!o&&t[0]==="-"&&c[0]==="-"&&c.endsWith("c"))o=!0;break}if(o)i++;continue}if(!n?.has(a))continue;if(r?.has(a)&&s+1<t.length)break;i++}return{commandSelected:o,followingValues:i}}function zk(e,t){return t!==void 0&&[...t].some((n)=>e.startsWith(`${n}=`))}var $k=new Set(["-S","--suffix"]);function cr(e,t,n,r){if(e.status==="structural-limit")throw new gt;if(e.status!=="complete")return r.findMalformedTarget(e.source);let o={cwd:t,variables:new Map},i=[];for(let s of e.entries){if(s.kind==="operator"){if(!s.boundary)continue;let a=r.findSegmentTarget(i,o);if(a)return a;o=Lk(i,o,n,r.normalizeCwd),i=[];continue}if(s.kind==="redirection"){if(s.role==="file-write"&&s.target&&r.isRedirectionTarget(We(s.target,o.variables),o))return s.target;continue}i.push(s.text)}return r.findSegmentTarget(i,o)}function We(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:We(i,t);return a?We(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function xo(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function dv(e,t,n){let r=n.environment.home,o=Zi(e.trim(),n.environment).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?uv(r,o.slice(2)):o,s=Ne(i);return Mk(Dk(s)?s:uv(t,s))}function he(e,t,n){let r=dv(e,t,n);if(!r)return"";return J(r,n.environment.paths,n).replace(/\\/g,"/")}function mv(e,t,n,r){let o=dv(e,t,n);if(!o)return null;if(r(Nk(o)))return J(o,n.environment.paths,n).replace(/\\/g,"/");let i=Cy(o,n.environment.paths,n);return i===null?null:i.replace(/\\/g,"/")}function zs(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&$k.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}function Lk(e,t,n,r){let o=xo(e)?new Map([...t.variables,...Wk(e,t.variables)]):t.variables,i=Bt([...e],n.environment),s=W(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;return{cwd:!s||s==="-"?t.cwd:r(We(s,o),t.cwd,n),variables:o}}function Wk(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],We(o,t)]]:[]})}var qe="Git metadata and hooks are protected. Ask the user before modifying them.";function hv(e,t=wu([e.invocation.context.executionCwd,e.invocation.context.configCwd])){let n=zt(Xe()),r=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Os(e.invocation.toolName))return null;let s=e.paths.find((a)=>Vk(a,r,t,n));return s?{target:s}:null}if(e.invocation.route.kind!=="command")return null;let o=Se(e,"input-candidate");if(!o)return null;let i=cr(o.shell,r,n,{findSegmentTarget:(s,a)=>qk(s,a,t,n),isRedirectionTarget:(s,a)=>Hk(s,a.cwd,t,n),findMalformedTarget:()=>null,normalizeCwd:he});return i?{target:i}:null}function wu(e,t=zt(Xe())){let n=[...new Map(e.filter((r)=>typeof r==="string"&&r!=="").flatMap((r)=>{let o=oo(he(r,r,t));return o?[[ot(o),{dotGitPath:o,cwd:r}]]:[]})).values()].flatMap((r)=>Zk(r.dotGitPath,r.cwd,t));if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.map((r)=>r.entry))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFile?[r.markerFile]:[]))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Zk(e,t,n){try{let r=he(e,t,n),o=Fk(e),i=o.isFile()?r:null,s=o.isFile()?ql(e):null,a=(o.isDirectory()?[r]:[s?.gitDir,s?.commonDir]).flatMap((l)=>l?[ot(he(l,t,n))]:[]),c=[...new Set(o.isDirectory()?[ot(e.replace(/\\/g,"/")),...a]:a)];return[{entry:ot(r),markerFile:i?ot(i):null,directories:c,hooksDirectories:[...new Set(c.flatMap((l)=>{let u=ot(Gk(l,"hooks"));return[u,ot(he(u,t,n))]}))]}]}catch{return[]}}function xn(e,t,n,r,o,i=!1){if(!n)return!1;let s=ot(he(e,t,o)),a=s.replace(/(\/\.?\*+)+$/,"");if(a!==s&&a!==""){if(Eu(a,n))return!0;let c=i||s.slice(a.length).includes("/."),l=(u)=>c?Ns(u,a):Uk(u,a);if(n.markerFiles.some(l))return!0;return r&&fv(n).some(l)}if(Eu(s,n))return!0;return r&&fv(n).some((c)=>Ns(c,s))}function Uk(e,t){let n=gv(t,e);if(n===""||n.startsWith("..")||pv(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function jk(e,t,n,r){return xn(e,t,n,!0,r)}function Bk(e,t,n,r){if(!n)return!1;return Eu(ot(he(e,t,r)),n)}function Vk(e,t,n,r){if(!n)return!1;return yv(e,t,n,r,n.entries)}function Hk(e,t,n,r){if(!n)return!1;return yv(e,t,n,r,n.markerFiles)}function yv(e,t,n,r,o){let i=ot(he(e,t,r));return o.includes(i)||vv(i,n)}function bv(e,t,n,r){if(!n)return!1;return n.hooksDirectories.some((o)=>e.some((i)=>Ns(o,ot(he(i,t,r)))))}function Eu(e,t){return t.entries.includes(e)||t.directories.includes(e)||vv(e,t)}function vv(e,t){return t.hooksDirectories.some((n)=>Ns(e,n))}function fv(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Ns(e,t){let n=gv(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!pv(n)}function ot(e){return process.platform==="win32"?e.toLowerCase():e}function qk(e,t,n,r){if(xo(e))return null;let o=Vt([...e],r.environment);if(W(o[0]??"").toLowerCase()!=="mv")return null;let i=zs(o.slice(1)),s=i.sources.find((a)=>jk(We(a,t.variables),t.cwd,n,r));if(s)return s;return i.destination&&Bk(We(i.destination,t.variables),t.cwd,n,r)?i.destination:null}import{isAbsolute as Ru,join as Kk,normalize as Yk,sep as Ds}from"path";var _v=process.platform==="win32",Jk=/[*?]/;function Co(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function $s(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Co(e.trim(),t);if(!Ru(n))return"must be an absolute path or start with ~/";return Eo(n,t)}function Ls(e,t){let n=Sv(e,t);if(n===null)return"must be a non-empty path string";if(!Ru(n))return null;if(Eo(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Xk="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Qk="cannot cover the guard's own configuration";function Sv(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Co(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Ws(e,t){let n=Sv(e,t);if(n===null)return"must be a non-empty path string";if(Jk.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!Ru(n))return null;if(Eo(n,t)!==null)return Xk;return eT(n,t)?Qk:null}function eT(e,t){let n=Ms(e),r=Ms(Kk(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Ds}`)}function Eo(e,t){let n=Ms(e),r=Ms(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Ds)?n:`${n}${Ds}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Ms(e){let t=Yk(e);if(_v)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(_v?3:1)&&t.endsWith(Ds))t=t.slice(0,-1);return t}var rT=process.platform==="win32",xv=64,oT=16384;function wo(e){let t=kb(e,xv,xv,oT);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:iT(e)}}function iT(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>sT(e.raw,n.span.start-e.span.start))}function sT(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Cn(e){let t=e.environment.home,n=e.environment.paths,r=zt(e.environment);return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:dT(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,pathCanonicalizationContext:r}}function it(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&fT(e))return{kind:"outside_anchored_cwd"};let o=!r&&Rv(e,t.posixShell);if(Zt(e))return{kind:"outside_anchored_cwd"};if(Tu(e,r))return{kind:"root_or_home_target"};if(aT(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&xn(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.pathCanonicalizationContext,!t.posixShell))return{kind:"git_metadata_target"};if(cT(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(mT(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&yT(i,t.environment.home,t.environment.paths,t.pathCanonicalizationContext))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&bT(e,t.resolvedCwd??i,t.environment.paths,t.pathCanonicalizationContext))return{kind:"cwd_self_target"};if(vT(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.pathCanonicalizationContext))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function Ev(e,t,n={}){let{containmentTarget:r,...o}=n;if(it(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(uT(i))return!1;if(ub(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>_T(r??i,s,t.environment.paths,t.pathCanonicalizationContext))}function Tu(e,t=!1){let n=e.trim(),r=Cv.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function aT(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=ku(o)?o:t.resolvedCwd?lr(t.resolvedCwd,o):null;if(!i)return!1;let s=ke(J(i,t.environment.paths,t.pathCanonicalizationContext));if(s===nT(s).root)return!0;return s===ke(J(t.environment.home,t.environment.paths,t.pathCanonicalizationContext))}catch{return!1}}function ke(e){let t=tT(e);if(rT){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function cT(e,t,n,r,o,i,s,a){let c=e.trim();if(wv(c))return!1;if(!r&&eu(c,a))return!0;return(t||i&&s)&&n&&!o&&lT(c,n)}function lT(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Rv(e.slice(n.length+1),t)})}function uT(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Cv.normalize(`/${t[1]??""}`)==="/"}function wv(e){return e.split(/[\\/]+/).includes("..")}function dT(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Co(o.trim(),t);if(!ku(i))return[];try{let s=J(i,n,r);if(Eo(s,J(t,n,r)))return[];return[ke(s)]}catch{return[]}})}function mT(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(wv(r))return!1;let o=n?r:Co(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=ku(o)?o:i?lr(i,o):null;if(!s)return!1;try{let a=ke(J(s,t.environment.paths,t.pathCanonicalizationContext));return t.allowRoots.some((c)=>a===c||a.startsWith(c.endsWith(Au)?c:`${c}${Au}`))}catch{return!1}}function fT(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Rv(e,t=!1){return e.includes("$")||e.includes("`")||pT(e)||t&&gT(e)}function pT(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function gT(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&hT(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function hT(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function yT(e,t,n,r){try{return ke(J(e,n,r))===ke(J(t,n,r))}catch{try{return ke(e)===ke(t)}catch{return!1}}}function bT(e,t,n,r){if(e==="."||e==="./"||e===".\\")return!0;try{return ke(J(lr(t,e),n,r))===ke(J(t,n,r))}catch{try{return ke(lr(t,e))===ke(t)}catch{return!1}}}function vT(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Pu(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Pu(lr(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Pu(lr(a,e),t,i,s)}catch{return!1}}function Pu(e,t,n,r){try{return Pv(J(e,n,r),J(t,n,r))}catch{return!1}}function _T(e,t,n,r){if(!t)return!1;try{return Pv(J(t,n,r),J(e,n,r))}catch{return!0}}function Pv(e,t){let n=ke(e),r=ke(t);return n.startsWith(`${r}${Au}`)||n===r}var ST=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Av="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",xT="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",kv="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Tv="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",CT="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",ET="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.";function Iv(e,t,n,r=Cn({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return wT(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function wT(e,t,n,r){let o=e.filter((c)=>c.kind==="word"),i=PT(o),s=o[i];if(!s||!ST.has(MT(s.text)))return null;let a=RT(o.slice(i+1));if(a.whatIfProtected)return null;if(ue(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return _("powershell.remove-item-pipeline-dynamic-target",ET);for(let c of a.targets)if(!Zt(c.text)&&Tu(Ou(c.text)))return _(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Tv);for(let c of a.targets)if(n.resolvedCwd&&xn(Ou(c.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.pathCanonicalizationContext,!0))return _("powershell.remove-item-git-metadata",qe);if(!a.recursive||!a.force)return null;if(ue(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return _("powershell.remove-item-recursive-force-dynamic-target",kv);for(let c of a.targets){let l=$T(it(Ou(c.text),n),n,r);if(l)return l}return null}function RT(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let c=e[a];if(!c||c.kind!=="word")continue;if(AT(c))continue;if(s){t.push(Iu(c)),i=i||c.dynamic;continue}if(c.text==="--"){s=!0;continue}let l=TT(c.text);if(!l){t.push(Iu(c)),i=i||c.dynamic;continue}if(IT(l.name)){let u=l.value?kT(l.value,c):e[++a];if(u?.kind==="word")t.push(Iu(u)),i=i||u.dynamic;else i=!0;continue}if(OT(l.name)){n=!0;continue}if(zT(l.name)){r=!0;continue}if(NT(l.name))o=DT(l.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function PT(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Iu(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function AT(e){return e.kind==="word"&&e.text===","}function Ou(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function kT(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function TT(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function IT(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function OT(e){return"recurse".startsWith(e)}function zT(e){return e.length>=2&&"force".startsWith(e)}function NT(e){return e==="wi"||"whatif".startsWith(e)}function DT(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function MT(e){return e.toLowerCase()}function $T(e,t,n){switch(e.kind){case"root_or_home_target":return _("powershell.remove-item-recursive-force-root-or-home",Tv);case"git_metadata_target":return _("powershell.remove-item-git-metadata",qe);case"temp_target":return null;case"dynamic_target":if(!ue(n,"powershell.remove-item-recursive-force-dynamic-target",t.strict))return null;return _("powershell.remove-item-recursive-force-dynamic-target",kv);case"home_cwd_target":return _("powershell.remove-item-recursive-force-home-cwd",CT);case"cwd_self_target":return _("powershell.remove-item-recursive-force-cwd-self",Av);case"within_anchored_cwd":if(!ue(n,"powershell.remove-item-recursive-force-paranoid",t.paranoid))return null;return _("powershell.remove-item-recursive-force-paranoid",xT);case"outside_anchored_cwd":return _("powershell.remove-item-recursive-force-outside-cwd",Av)}}import{normalize as ta}from"path";var Fe=new Set(["awk","gawk","nawk","mawk"]),LT=new Set(["-e","--source"]),WT=new Set(["-F","-v","--assign","--field-separator"]),Ov=new Set(["-f","--file"]),FT=new Set(["print","printf","return"]),zv=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],GT="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Zs(e,t,n){let r=!1;for(let o of ZT(e)){let i=UT(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?_("awk.system-dynamic",GT):null}function Nu(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&LT.has(a)){n=!0;let c=e[s+1];if(c!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:c});else i=!1;s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(WT.has(a)||Ov.has(a))){if(Ov.has(a)){r=!0;let c=e[s+1];if(c!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:c});else i=!1}else if(e[s+1]===void 0)i=!1;s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function Po(e){return Nu(e).sources}function ZT(e){return Po(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function UT(e,t){De(t,e);let n=e.includes("system")?Du(e,t):null,r=jT(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Du(e,t){De(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Gs(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Nv(e,i+1);continue}if(s==="/"&&Dv(e,i)){i=Mv(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,Ro(e[a-1])||Ro(e[i]))continue;let c=Fs(e,i);if(e[c]!=="(")continue;c=Fs(e,c+1);let l=e[c];if(l!=='"'&&l!=="'"){r=!0,o=!0;continue}let u=Gs(e,c,l);if(!u){r=!0,o=!0;continue}if(c=Fs(e,u.endIndex),r=!0,e[c]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=c+1}if(!r)return null;return{dynamic:o,commands:n}}function jT(e,t){De(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,c=null,l=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=Gs(e,i,u);if(f&&l===s)c={...f,startIndex:i};l=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=Nv(e,i+1),s=i,a=null,c=null,l=i;continue}if(u==="/"&&Dv(e,i)){let f=Mv(e,i+1);l=f??i+1,i=f??i+1;continue}if(`;
-{}`.includes(u)){i++,s=i,a=null,c=null,l=i;continue}if(a===null&&(zu(e,i,"print")||zu(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))l=i+1;i++;continue}let d=e[i+1]==="&"?i+2:i+1,m=Fs(e,d);if(zu(e,m,"getline")){o=!0;let f=HT(s,c,l);if(f===null)r=!0;else n.push(f);l=d,i=d;continue}if(KT(s,a)){o=!0;let f=VT(e,m);if(!f){r=!0,l=d,i=d;continue}if(!BT(e,f.endIndex)){r=!0,l=f.endIndex,i=f.endIndex;continue}n.push(f.value),l=f.endIndex,i=f.endIndex;continue}l=d,i++}if(!o)return null;return{dynamic:r,commands:n}}function Ro(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Fs(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function BT(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Gs(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=qT(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function VT(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Gs(e,t,n)}function HT(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function qT(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function zu(e,t,n){return e.startsWith(n,t)&&!Ro(e[t-1])&&!Ro(e[t+n.length])}function KT(e,t){return t!==null&&t>=e}function Nv(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Dv(e,t){let n=YT(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(Ro(e[r-1]))r--;return FT.has(e.slice(r,n+1))}function YT(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Mv(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var $v=new Set(["rm","find","xargs","parallel"]),JT=new Set(["sudo","env","command","builtin"]),XT=new Set(["git","busybox",...$v,...de,...eb,...Fe]);function Us(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(W(n)))return null;let r=W(n),o=e[1]==="--"?2:1,i=QT(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function QT(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;if(W(a)!==n&&eI(a,r))i.push(s);else if(ns.has(V(a)))break;if(o)break}return i}function eI(e,t){let n=W(e),r=V(e);return r==="git"||n==="busybox"||En(e)||$v.has(n)||t.transparentWrappers.includes(n)||de.has(r)||e==="$SHELL"||$e(r)||Fe.has(r)||t.rules.some((o)=>o.command===n)}function En(e){return JT.has(e.toLowerCase())}function Lv(e){let t=V(e);return XT.has(t)||$e(t)}function st(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return js([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*js(e,t,n,r,o,i,s,a,c){let l=gs(e,t,n,i);for(let[f,p]of l.envAssignments)i.set(f,p),o.set(f,p);let{tokens:u,cwd:d}=l;if(l.envSplitValues){let f=ps(l.envSplitValues,u);if(!f)throw new Me;Mu(a),yield*js(f,t,d,r,o,i,s,a,c);return}if(En(u[0]??""))throw new Me;let m=Us(u,s);if(m){for(let f of[m.childIndex,...m.alternativeChildIndices])Mu(a),yield*js(f===m.childIndex?m.tokens:[...u.slice(f)],t,d,r,new Map(o),new Map(i),s,a,!0);return}if(nI(u)){Mu(a),yield*js([...u.slice(1)],t,d,r,o,i,s,a,c);return}yield tI(u,d,r,o,i,c)}function tI(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:W(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function Mu(e){if(e.iterations>=er)throw new Me;e.iterations++}function nI(e){return W(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function $u(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function at(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||Lu(r,"recursive"))t=!0;else if(r==="-f"||Lu(r,"force"))n=!0;else if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Wv(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>Lu(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function Lu(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var rI="find -delete permanently removes files. Use -print first to preview.",oI="find -exec rm -rf is dangerous. Use explicit file list instead.",iI=new Set(["-exec","-execdir","-ok","-okdir"]),sI=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Bs(e,t){let n=e.map(z),r=aI(e,n,t);if(r)return r;if(Hs(n,1)&&!lI(e,n,t)){let s=O(_("find.delete",rI),t.policy);if(s)return s}let o=t.derivedCommandWorkBudget??es(),i=0;while(i<n.length){let s=n[i],a=qt(s??"");if(a>0){i+=a+1;continue}if(!Wt(s)){i++;continue}Qe(o,n.length-i-1);let c=Ao(n,i);i=c.nextIndex;let l=dI(c.tokens,t.environment);if(l){let f=O(l,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",d=t.analyzeTokens?t.analyzeTokens(c.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(c.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,m=d?.id.startsWith("custom.")?d:O(d,t.policy);if(m)return m}return null}function aI(e,t,n){if(!Hs(t,1)&&!Wu(t,n.environment))return null;let o=Vs(e)??Z(["."]),i=Cn({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=wo(s);for(let c of a.expandedTargets??[z(s)]){let l=it(c,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(l.kind==="root_or_home_target")return _("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(l.kind==="git_metadata_target")return _("find.delete-git-metadata",qe)}}if(cI(t)&&i.resolvedCwd&&bv(o.map(z),i.resolvedCwd,i.protectedGitMetadata,i.pathCanonicalizationContext))return _("find.delete-git-metadata",qe);return null}function Wu(e,t){let n=0;while(n<e.length){if(!Wt(e[n])){n++;continue}let r=Ao(e,n),o=Vt([...r.tokens],t),i=W(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function cI(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function lI(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Vs(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Ql(o,n.environment),s=n.trustedTmpdirValue??$t(o,n.environment),a=n.allowTmpdirVar??!uo(o,n.environment),c=Cn({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??ft(o,n.environment),trustedTmpdirValue:s});return r.every((l)=>{let u=wo(l);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[z(l)]).every((d)=>Ev(d,c,{containmentTarget:uI(d,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function uI(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Vs(e){let t=(o)=>{let i=e[o];return i?z(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function dI(e,t){let n=Bt([...e],t);if(n.length===0)return null;let r=W(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=W(n[0]??"");if(r==="rm"&&at(n))return _("find.exec-rm-recursive-force",oI);return null}function Ao(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Hs(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Wt(r)){n=Ao(e,n).nextIndex;continue}let o=qt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function qt(e){return sI.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Wt(e){return e!==void 0&&iI.has(e)}function ko(e){let t=nt(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var mI=5,Fu="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function xe(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Gv(e,t,n){let r=Uv(e,t,n),o=fI(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<mI;a++){let{subcommand:c,rest:l}=ct(i),u=c?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let d=o.get(u),m=bI(d);if(m===null||m.length===0)return{blockedReason:Fu,expanded:!0,tokens:i};i=["git",...m,...l],s=!0}return{blockedReason:Fu,expanded:!0,tokens:i}}function Zv(e,t,n){return Uv(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function ct(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?W(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(o.startsWith("-"))if(Re.has(o))r+=2;else if(o.startsWith("-c")&&o.length>2)r++;else if(o.startsWith("-C")&&o.length>2)r++;else r++;else return{subcommand:o,rest:e.slice(r+1)}}return{subcommand:null,rest:[]}}function fI(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Uv(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?W(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=gI(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...pI(e,t,n)]}}function pI(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Gu(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Gu(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Fv(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Fv(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Re.has(i)){o+=2;continue}o++}return r}function gI(e,t){let n=hI(e,t),r=yI(e,t);return{blockedReason:n===null||r===null?Fu:null,entries:[...n??[],...r??[]]}}function hI(e,t){let n=Ve("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=ko(n);if(!o)return null;for(let i of o){let s=Gu(i);if(!s)return null;r.push(s)}return r}function yI(e,t){let n=Bi(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Ve(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Ve(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Gu(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Fv(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Ve(e.slice(r+1),t,n)}}function bI(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return ko(t)}var vI="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",_I="git checkout --force discards uncommitted changes. Use 'git stash' first.",SI="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",xI="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",CI="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",EI="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",wI="git switch --force discards uncommitted changes. Use 'git stash' first.",RI="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",PI="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",AI="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",kI="git reset --merge can lose uncommitted changes. Use 'git stash' first.",TI="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",II="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",OI="git push --force destroys remote history. Use --force-with-lease for safer force push.",zI="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",NI="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",DI="git branch -D force-deletes without merge check. Use -d for safe delete.",MI="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",$I="git merge --abort discards merge conflict resolutions. Use 'git status' first.",LI="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",WI="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",FI="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",GI="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",ZI="git worktree remove --force can delete uncommitted changes. Remove --force flag.",jv=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Bv=new Set(["--recurse-submodules","--track","-t"]),Zu=new Set(["-b","-B","-U"]),Uu=new Set(["-c","-C"]),UI=new Set(["--source","--conflict","--unified","--inter-hunk-context"]),jI=new Set(["-q","--quiet","--no-quiet","-f","--force","--no-force","-d","--detach","--no-detach","-m","--merge","--no-merge","-p","--patch","--no-patch","--guess","--no-guess","--overlay","--no-overlay","--ours","--theirs","--ignore-skip-worktree-bits","--no-ignore-skip-worktree-bits","--no-track","--overwrite-ignore","--no-overwrite-ignore","--ignore-other-worktrees","--no-ignore-other-worktrees","--progress","--no-progress","--pathspec-file-nul","--no-pathspec-file-nul","--no-recurse-submodules"]);function F(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var ur=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Hv(e){let{subcommand:t,rest:n}=ct(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return Kt(BI(n));case"switch":return Kt(VI(n));case"restore":return Kt(qI(n));case"reset":return YI(n);case"clean":return Kt(XI(n));case"rm":return Kt(QI(n));case"push":return wn(eO(n));case"branch":return wn(rO(n));case"stash":return wn(cO(n));case"worktree":return wn(lO(n));case"rebase":return Kt(oO(n));case"merge":return Kt(iO(n));case"tag":return wn(sO(n));case"reflog":return wn(aO(n));default:return null}}function Kt(e){return e?{...e,localDiscard:!0}:null}function wn(e){return e?{...e,localDiscard:!1}:null}function BI(e){let{index:t,before:n}=xe(e),r=Ae(n,{shortOptsWithValue:Zu});if(n.some((i)=>F(i,"--force"))||r.has("-f"))return _("git.checkout-force",_I);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(F(i,"--pathspec-from-file"))return _("git.checkout-pathspec-from-file",xI)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return _("git.checkout-ref-path",SI);return _("git.checkout-double-dash",vI)}if(HI(e).length>=2)return _("git.checkout-ambiguous",CI);return null}function VI(e){let{before:t}=xe(e);if(t.some((r)=>F(r,"--discard-changes")))return _("git.switch-discard-changes",EI);let n=Ae(t,{shortOptsWithValue:Uu});if(t.some((r)=>F(r,"--force"))||n.has("-f"))return _("git.switch-force",wI);return null}function HI(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(r.startsWith("-"))if(jv.has(r))n+=2;else if(r.startsWith("--")&&r.includes("="))n++;else if(Bv.has(r)){let o=e[n+1];if(o&&!o.startsWith("-")&&(r==="--recurse-submodules"||r==="--track"||r==="-t"))if((r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"]).includes(o))n+=2;else n++;else n++}else if(r.startsWith("--")&&!jI.has(r)&&!jv.has(r)&&!Bv.has(r))n++;else n++;else t.push(r),n++}return t}function qI(e){let t=KI(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?_("git.restore-worktree",PI):_("git.restore-unstaged",RI)}function KI(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(UI.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let c=1;c<a.length;c++){let l=a.charAt(c);if(l==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(l==="S"){i();continue}if(l==="W"){i(!0);continue}if(l==="p"){n=!0;continue}if(l==="s"||l==="U"){if(c===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function YI(e){let t=null;for(let n of e){if(F(n,"--hard")){t=_("git.reset-hard",AI);break}if(F(n,"--merge")){t=_("git.reset-merge",kI);break}}if(!t)return null;return JI(e)?wn(t):Kt(t)}function JI(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function XI(e){for(let n of e)if(n==="-n"||F(n,"--dry-run"))return null;let t=Ae(e.filter((n)=>n!=="--"));if(e.some((n)=>F(n,"--force"))||t.has("-f"))return _("git.clean-force",TI);return null}function QI(e){let t=!1,n=!1,r=!1;for(let o of xe(e).before){if(F(o,"--no-force")){t=!1;continue}if(F(o,"--force")){t=!0;continue}if(F(o,"--no-cached")){n=!1;continue}if(F(o,"--cached")){n=!0;continue}if(F(o,"--no-dry-run")){r=!1;continue}if(F(o,"--dry-run")){r=!0;continue}let i=Ae([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?_("git.rm-force",II):null}function eO(e){let{before:t,after:n}=xe(e),r=Ae(t);if(t.some((s)=>F(s,"--mirror")))return _("git.push-mirror",NI);if(t.some((s)=>F(s,"--force"))||r.has("-f")||Vv(t,n).some(tO))return _("git.push-force",OI);if(t.some((s)=>F(s,"--delete"))||r.has("-d")||Vv(t,n).some(nO))return _("git.push-delete",zI);return null}function Vv(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function tO(e){return e.startsWith("+")||e.includes(":+")}function nO(e){return e.length>1&&e.startsWith(":")}function rO(e){let{before:t}=xe(e),n=Ae(t),r=n.has("-D")||n.has("-d")||t.some((i)=>F(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>F(i,"--force"));if(r&&o)return _("git.branch-force-delete",DI);return null}function oO(e){let{before:t}=xe(e);return t.some((n)=>F(n,"--abort"))?_("git.rebase-abort",MI):null}function iO(e){let{before:t}=xe(e);return t.some((n)=>F(n,"--abort"))?_("git.merge-abort",$I):null}function sO(e){let{before:t}=xe(e);return Ae(t).has("-d")||t.some((r)=>F(r,"--delete"))?_("git.tag-delete",LI):null}function aO(e){return e[0]==="delete"?_("git.reflog-delete",WI):null}function cO(e){for(let t of e){if(t==="drop")return _("git.stash-drop",FI);if(t==="clear")return _("git.stash-clear",GI)}return null}function lO(e){let{before:t}=xe(e);if(!t.includes("remove"))return null;let r=Ae(t);if(t.some((o)=>F(o,"--force"))||r.has("-f"))return _("git.worktree-remove-force",ZI);return null}import{execFileSync as uO}from"child_process";import{existsSync as Bu,readFileSync as Vu}from"fs";import{dirname as dO,isAbsolute as Yv,join as ju,resolve as Jv}from"path";var mO=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"];function Xv(e,t,n,r){let o=fO(e,t,n);if(o!==null)return o;let i=pO(t,n);if(i!==null)return i;if(Ry(n))return!0;return gO(r)}function fO(e,t,n){let r=null,o=1;while(o<e.length){let i=e[o];if(!i||i==="--")return r;if(!i.startsWith("-"))return r;if(i==="-c"){let s=qv(e[o+1]);if(s!==null)r=s;o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=qv(i.slice(2));if(s!==null)r=s;o++;continue}if(i==="--config-env"){let s=Kv(e[o+1],t,n);if(s!==null)r=s;o+=2;continue}if(i.startsWith("--config-env=")){let s=Kv(i.slice(13),t,n);if(s!==null)r=s;o++;continue}if(Re.has(i))o+=2;else o++}return r}function pO(e,t){if(Ve("GIT_CONFIG_PARAMETERS",e,t)!==void 0)return!0;let n=Bi(e,t);if(n.state==="absent")return null;if(n.state==="invalid")return!0;let r=null;for(let o=0;o<n.count;o++){let i=Ve(`GIT_CONFIG_KEY_${o}`,e,t),s=Ve(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i?.trim()||s===void 0)return!0;let a=i.trim().toLowerCase();if(Hu(a))return!0;if(a!=="submodule.recurse")continue;r=To(s)}return r}function gO(e,t=yO()){let n=hO(e);if(n===null||n)return!0;if(t===null)return!0;try{let r=uO(t,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:bO(process.env),stdio:["ignore","pipe","ignore"]}).trim();return To(r)}catch(r){return!vO(r)}}function hO(e){let t=_O(e);if(t===null)return null;for(let n of t){if(!Bu(n))continue;if(CO(n))return!0}return!1}function yO(){for(let e of mO)if(Bu(e))return e;return null}function bO(e){let t={...e};for(let n of Object.keys(t))if(to(n))delete t[n];return t}function vO(e){return typeof e==="object"&&e!==null&&"status"in e&&e.status===1}function _O(e){let t=oo(e);if(t===null)return null;let n=SO(t);if(n===null)return null;let r=xO(n);if(r===null)return null;return[ju(r,"config"),ju(n,"config.worktree")]}function SO(e){try{let n=Vu(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!n.startsWith("gitdir:"))return e;let r=n.slice(7).trim();if(r==="")return null;return Yv(r)?r:Jv(dO(e),r)}catch{return null}}function xO(e){let t=ju(e,"commondir");if(!Bu(t))return e;try{let n=Vu(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(n==="")return null;return Yv(n)?n:Jv(e,n)}catch{return null}}function CO(e){let t;try{t=Vu(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),c=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),l=a===-1?"true":i.slice(a+1).trim();if(EO(n)&&c==="path")return!0;if(n==="submodule"&&c==="recurse")r=To(l)}return r}function EO(e){return e==="include"||e.startsWith("includeif ")}function qv(e){if(!e)return null;let t=e.indexOf("="),n=(t===-1?e:e.slice(0,t)).toLowerCase();if(Hu(n))return!0;if(n!=="submodule.recurse")return null;let r=t===-1?"true":e.slice(t+1).toLowerCase();return To(r)}function To(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Kv(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;let o=e.slice(0,r).toLowerCase();if(Hu(o))return!0;if(o!=="submodule.recurse")return null;let i=Ve(e.slice(r+1),t,n);return i===void 0||To(i)}function Hu(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Qv(e,t,n){if(!t.localDiscard||!n.worktreeMode||Ty(n.env,n.envAssignments))return null;let r=Iy(e,n.cwd);if(!r.gitCwd||r.hasExplicitGitContext)return null;if(!Oy(r.gitCwd))return null;if(wO(e,n,r.gitCwd))return null;return{originalReason:t.reason,gitCwd:r.gitCwd}}function wO(e,t,n){let{subcommand:r,rest:o}=ct(e),i=r?.toLowerCase();if(t.dynamicArguments||RO(o)||Xv(e,t.env,t.envAssignments,n)||kO(o)||PO(i,o))return!0;return i==="clean"&&TO(o)>1}function RO(e){return e.some((t)=>/[$*?[]/.test(t))}function PO(e,t){if(e==="checkout"){let{before:n}=xe(t),r=Ae(n,{shortOptsWithValue:Zu}),o=n.some((s)=>F(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=xe(t),r=Ae(n,{shortOptsWithValue:Uu}),o=n.some((s)=>F(s,"--force"))||n.some((s)=>F(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||AO(s))||r.has("-C");return o&&i}return!1}function AO(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function kO(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function TO(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}var IO="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",OO=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function dr(e,t){return e_(e.map(z),t)}function e_(e,t,n){let r=Gv(e,t.env,t.envAssignments),o=r.blockedReason?O(_("git.alias-config",r.blockedReason),t.policy):null;if(o)return o;let i=r.tokens;if((wy(t.envAssignments)||Zv(e,t.env,t.envAssignments))&&zO(i))return _("git.ssh-env",IO);let s=Hv(i);if(!s)return null;if(r.expanded||r.blockedReason)return s;let a=Qv(e,s,t);if(!a)return s;return n?.(a),null}function t_(e,t){let n=null;return{match:e_(e.map(z),t,(o)=>{n=o}),relaxation:n}}function zO(e){let{subcommand:t,rest:n}=ct(e),r=t?.toLowerCase();if(!r)return!1;if(OO.has(r))return!0;if(r==="archive")return xe(n).before.some((o)=>F(o,"--remote"));return r==="remote"&&NO(n)}function NO(e){return e.find((t)=>!DO(t))?.toLowerCase()==="update"}function DO(e){return e==="-v"||F(e,"--verbose")||F(e,"--no-verbose")}import{isAbsolute as Tz}from"path";var n_="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",MO="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",$O="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",o_="rm -rf targeting root or home directory is extremely dangerous and always blocked.",LO="rm -rf in home directory is dangerous. Change to a project directory first.";function mr(e,t){let n=Cn({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(z),o=at(r),i=Wv(r),s=FO(e);for(let a of s){let c=wo(a.word);if(o&&c.unsafeBraceExpansion){let l=O(r_({kind:"outside_anchored_cwd"},n,t.policy),t.policy);if(l)return l;continue}for(let l of c.expandedTargets??[a.text]){let u=Ne(l),d={targetIsLiteral:c.expandedTargets!==void 0||c.targetIsLiteral,tmpdirWordSplittingProtected:c.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&xn(u,n.resolvedCwd,n.protectedGitMetadata,i,n.pathCanonicalizationContext))return _("rm.git-metadata",qe);if(i&&!o){let m=it(u,n,d);if(m.kind==="root_or_home_target")return _("rm.recursive-force-root-or-home",o_);if(m.kind==="git_metadata_target")return _("rm.git-metadata",qe);continue}if(!o)continue;for(let m of WO(u,n,d)){let f=r_(m,n,t.policy),p=O(f,t.policy);if(p)return p}}}return null}function WO(e,t,n){let r=it(e,t,n);if(r.kind==="cwd_self_target")return[r,it(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=it(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,it(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function FO(e){let t=[],n=!1;for(let r of e.slice(1)){let o=z(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}function r_(e,t,n){switch(e.kind){case"root_or_home_target":return _("rm.recursive-force-root-or-home",o_);case"git_metadata_target":return _("rm.git-metadata",qe);case"temp_target":return null;case"dynamic_target":if(!ue(n,"rm.recursive-force-dynamic-target",t.strict))return null;return _("rm.recursive-force-dynamic-target",$O);case"home_cwd_target":return _("rm.recursive-force-home-cwd",LO);case"cwd_self_target":return _("rm.recursive-force-cwd-self",n_);case"within_anchored_cwd":if(ue(n,"rm.recursive-force-paranoid",t.paranoid))return _("rm.recursive-force-paranoid",MO);return null;case"outside_anchored_cwd":return _("rm.recursive-force-outside-cwd",n_)}}var GO={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},s_=new Set(["--init-file","--rcfile"]),ZO=["--init-file","--rcfile"],UO=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function yt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return i_(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=i_(e,t,!1);if(r!==null)return r}}return null}function Ke(e){let t=W(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return bt(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function i_(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function a_(e){let t=W(e[0]??"").toLowerCase(),n=jO(e,t),r=UO.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function jO(e,t){let n=bt(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let c=e[a];if(c===void 0||c==="--"||c==="-"||c[0]!=="-"&&c[0]!=="+")break;if(c.startsWith("--")){if(t==="bash"&&s?ZO.find((m)=>c===m):void 0){let m=e[a+1];o.push(m===void 0?{kind:"absent"}:{kind:"literal",value:m}),a++;continue}let d=c.split("=",1)[0]??c;if(t==="bash"&&s_.has(d)&&!c.includes("="))a++;continue}if(t==="bash")s=!1;let l=c_(t,c,e[a+1],"startup");if(l.interactive)i=c[0]==="-";a+=l.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}function c_(e,t,n,r){let o=!1,i=0,s=!1,a=!1,c=!1;for(let l=1;l<t.length;l++){let u=t[l];if(u===void 0)break;if(e==="ksh"&&u==="o"&&l+1<t.length){if(r==="argv"){let d=t.slice(l+1);if(t[0]==="-"&&(d==="c"||d[0]==="-"&&d.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&l+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&l+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")c=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!GO[e]?.includes(u))continue;if(l+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:c}}function bt(e){let t=W(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let c=n&&e[i+1]!==void 0?i+1:null;return{command:c===null?null:e[c]??null,commandIndex:c,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let c=s.split("=",1)[0]??s;if(t==="bash"&&s_.has(c)&&!s.includes("="))i++;continue}let a=c_(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}var Yt={kind:"none"},Rn={kind:"dynamic"},BO=new Set(["<","<<","<<-","<<<","<&","<>"]),u_=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,VO=/^(?:[0-9]+|[@*])$/,HO=_n.maxWords,qO=_n.maxInputLength;function d_(e){if(!e||W(V(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`?r+2:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function Vy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var lu=new Set(["&&","||","|","|&"]);function cu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return pe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`,span:n}],nodes:[]});let r=lo(e,0,e.length,t,{used:0,max:t.maxWords},0);return pe({kind:"program",dialect:"posix",source:e,span:n,status:mo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function lo(e,t,n,r,o,i,s){let a=[],l=[],c=ro(),d=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((h)=>h.text);oo(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(s&&f===s)return m(),au(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:d};if(uo(f)){if(f===`
+`||f==="\r"){m();let b=f==="\r"&&e[u+1]===`
+`?u+2:u+1,w=a.at(-1);if(w?.kind!=="connector"||!lu.has(w.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(u,b),span:Object.freeze({start:u,end:b})}));if(d.length>0){let R=vs(e,b,n,d.splice(0));l.push(...R.issues),u=R.next;continue}u=b;continue}u++;continue}if(f==="#"){while(u<n&&e[u]!==`
+`&&e[u]!=="\r")u++;continue}let p=c.start===-1?mS(e,u,n):void 0;if(p){if(Rs(a,l,u),i>=r.maxDepth)return fn(a,l,u,"depth-limit",r.maxDepth);if(!Es(o))return fn(a,l,u,"word-limit",r.maxWords);let b=lo(e,p.braceIndex+1,n,r,o,i+1,"}"),w=b.next,R={start:p.braceIndex+1,end:b.closed?w-1:w},A=ou(e,R,b);if(a.push({kind:"function",name:p.name,span:{start:u,end:w},body:A}),l.push(...b.issues),b.pendingHeredocs.length>0||Vn(b.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely",span:{start:u,end:w}});if(d.push(...b.pendingHeredocs),b.limited)return ao(a,l,b.next);if(!b.closed)l.push({code:"unclosed-function-body",message:"function body is not closed",span:{start:p.braceIndex,end:w}});u=w;continue}let h=co(e,u);if(h){if(m(),!yu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`,span:{start:u,end:u+h.length}});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:u,end:u+h.length})})),u+=h.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis",span:{start:u,end:u+1}}),a.push({kind:"unknown",source:f,span:{start:u,end:u+1}}),u++;continue}if((f==="("||f==="{"&&eS(e,u,n))&&c.start===-1){if(Rs(a,l,u),i>=r.maxDepth)return fn(a,l,u,"depth-limit",r.maxDepth);let b=f==="("?")":"}",w=lo(e,u+1,n,r,o,i+1,b),R=w.next,A={start:u+1,end:w.closed?R-1:R},K=ou(e,A,w);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:u,end:R},body:K}),l.push(...w.issues),w.pendingHeredocs.length>0||Vn(w.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely",span:{start:u,end:R}});if(d.push(...w.pendingHeredocs),w.limited)return ao(a,l,w.next);if(!w.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`,span:{start:u,end:R}});u=R;continue}let g=(f==="<"||f===">")&&e[u+1]!=="("?Zy(e,u):null;if(g){let b=c.words.at(-1),w=b&&b.span.end===u&&/^[0-9]+$/.test(b.raw)?Number(b.raw):void 0;if(w!==void 0)c.words.pop();let R=w===void 0?u:b?.span.start??u;c.start=c.start===-1?u:c.start;let A=u+g.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let K=e[A],Y=A>u+g.length&&K==="#",te=!K||uo(K)||!!co(e,A)||K===s||K===")"||Y||(K==="<"||K===">")&&e[A+1]!=="(",X=g==="<<"||g==="<<-",z=X?bs(e,A,n):void 0,D=z?{word:mn(e,A,z.next,z.delimiter,"literal",z.quoted),nested:[],issues:[],next:z.next,limited:!1}:!te?xs(e,A,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return ao(a,l,D.next);if(!Es(o))return fn(a,l,D.next,"word-limit",r.maxWords)}let oe=D?.next??u+g.length,_e={kind:"redirection",operator:g,span:{start:R,end:oe},...w===void 0?{}:{fd:w},...D?{target:D.word}:{}};if(c.redirections.push(_e),X&&!z)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word",span:{start:u,end:u+g.length}});if(z){if(z.ambiguous||z.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely",span:z.span});let Ye=c.nested;d.push({delimiter:z.delimiter,quotedDelimiter:z.quoted,stripTabs:g==="<<-",declarationSpan:{start:R,end:oe},attach:(ke)=>{if(_e.heredoc=ke,ke.quotedDelimiter)return;Ye.push(...qy(e,ke.bodySpan.start,ke.bodySpan.end,r,o,i+1))}})}if(!X&&!D)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`,span:{start:u,end:u+g.length}});if(D)c.nested.push(...D.nested);c.end=oe,u=oe;continue}if(c.start===-1)Rs(a,l,u);let y=xs(e,u,n,r,o,i);if(l.push(...y.issues),y.limited)return ao(a,l,y.next);let v=rS(c.words)?lS(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return fn(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let b of E){if(!Es(o))return fn(a,l,y.next,"word-limit",r.maxWords);c.words.push(b)}c.start=c.start===-1?u:c.start,c.end=y.next,c.nested.push(...y.nested),u=y.next>u?y.next:u+1}return m(),au(a,l),l.push(...fS(d)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function ou(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:mo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function xs(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",d=[],m=[],u=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||uo(f)||(f===";"||f==="|"||f==="&")&&co(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:a,end:n}}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(f==='"'){l=!0;let g=Ky(e,a,n,r,o,i);if(s+=g.text,d.push(...g.nested),m.push(...g.issues),u||=g.limited,c=jn(c,g.provenance),a=g.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let g=Xy(e,a+2,n);if(s+=g.text,m.push(...g.issues),!g.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed",span:{start:a,end:n}});a=g.next;continue}if(f==="\\"){let g=e[a+1];if(!g){m.push({code:"trailing-escape",message:"escape has no following character",span:{start:a,end:a+1}}),a++;break}if(g===`
+`){a+=2;continue}s+=g,a+=2;continue}let h=f==="$"||f==="<"||f===">"||f==="`"?fo(e,a,n,r,o,i):null;if(h){let g=uu(h,d,m);if(u||=g.limited,c=jn(c,g.provenance),a=g.next,u)break;continue}if(f==="$"){let g=fu(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(f==="*"||f==="?"||f==="[")c=jn(c,"glob");s+=f,a++}return{word:mn(e,t,a,s,c,l,c==="literal"?void 0:Qy(e,t,a)),nested:d,issues:m,next:a,limited:u}}function Ky(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],d=!1,m=t+1;while(m<n){let u=e[m];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:d};if(u==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
+`){m+=2;continue}if(p==="\r"&&e[m+2]===`
+`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=_s(e,m+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(m,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:m,end:h}});m=h;continue}let f=fo(e,m,n,r,o,i);if(f){let p=uu(f,l,c);if(m=p.next,d||=p.limited,a=jn(a,p.provenance),d)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:d};continue}if(u==="$"){let p=fu(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=u??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:t,end:n}}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:d}}function fo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let d=s?3:c?1:2,m=s?"))":c?"`":")",u=_s(e,t+d,n,m),f=u===-1?n:u,p=u===-1?n:u+m.length;if(i>=r.maxDepth)return{program:dS(e,t+d,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],b=!1,w=t+d;while(w<f){let R=fo(e,w,f,r,o,i+1);if(!R){w++;continue}if(v.push(...R.program.nodes),E.push(...R.program.issues),b||=R.program.status==="limited",w=R.next,b)break}if(u===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:t,end:p}});return{program:pe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:mo(E,b),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=lo(e,t+d,f,r,o,i+1),g=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+d)} substitution is not closed`,span:{start:t,end:p}}]:[],y=(c||l)&&Vn(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions",span:{start:t,end:p}}]:[];return{program:pe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:mo([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function qy(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?fo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function uu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function _s(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`||l==="\r")&&s.length>0){let d=l==="\r"&&e[a+1]===`
+`?a+2:a+1,m=vs(e,d,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=du(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let d=Yy(e,a+3,n);if(d===-1)return-1;a=d+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let d=e[a+2]==="-",m=a+(d?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let u=bs(e,m,n);if(u){s.push({delimiter:u.delimiter,quotedDelimiter:u.quoted,stripTabs:d,declarationSpan:{start:a,end:u.next},attach:()=>{return}}),a=u.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Yy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=du(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function du(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!pS(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function co(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Zy(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function uo(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function mu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Xy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=Jy(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`,span:{start:i,end:a.next}});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function Jy(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return so(e,t+1,n,16,2,t+1);if(r==="u")return so(e,t+1,n,16,4,t+1);if(r==="U")return so(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return so(e,t,n,8,3,t+1);return{text:r,next:t+1}}function so(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function mo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function fu(e,t,n,r,o){let i=mu(e,t,n);return{text:r+e.slice(t,i),provenance:jn(o,"variable"),next:i}}function Qy(e,t,n){let r=io(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),d=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||d||m||u){let f=c?3:u?1:2,p=c?"))":u?"`":")",h=_s(e,a+f,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let f=mu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function jn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function eS(e,t,n){return t+1>=n||uo(e[t+1]??"")||co(e,t+1)!==null}var tS=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),nS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function rS(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=oS(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function oS(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return iS(e,t);if(n==="env")return sS(e,t);if(n==="sudo")return aS(e,t);return}function iS(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function sS(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(tS.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function aS(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(nS.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function pu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=[e.raw],i=e.raw.length,s=0;while(!0){let l=o.findIndex((p)=>su(p));if(l===-1)break;if(++s>n)return{limited:!0};let c=o[l]??"",d=su(c);if(!d||d.kind==="range")return{limited:!0};let m=d.start+c.length-d.end,u=d.alternatives.reduce((p,h)=>p+m+h.length,0);if(i-c.length+u>r||o.length-1+d.alternatives.length>t)return{limited:!0};let f=gu(c,d);o.splice(l,1,...f),i+=u-c.length}if(s===0)return;let a=o.map((l)=>uS(l,n));if(a.some((l)=>l===null))return{limited:!0};return{words:[...new Set(a.filter((l)=>l!==null&&l!==""))]}}function lS(e,t,n,r,o){if(t.provenance!=="literal"||t.quoted||t.raw!==t.text||!t.raw.includes("{"))return;let i=[t.text],s=t.text.length,a=0;while(!0){let c=i.findIndex((g)=>iu(g));if(c===-1)break;if(++a>r)return{limitCode:"depth-limit"};let d=i[c]??"",m=iu(d);if(!m)break;let u=m.start+d.length-m.end,f=m.alternatives.filter((g)=>u+g.length>0),p=f.reduce((g,y)=>g+u+y.length,0);if(s-d.length+p>o)return{limitCode:"brace-expansion-limit"};if(i.length-1+f.length>n)return{limitCode:"word-limit"};let h=gu(d,{...m,alternatives:f});i.splice(c,1,...h),s+=p-d.length}let l=i.filter((c)=>c.length>0);if(a===0)return;return{words:l.map((c)=>mn(e,t.span.start,t.span.end,c,"literal",!1))}}function iu(e){let t=[],n;for(let r=0;r<e.length;r++){let o=e[r];if(o==="{"){t.push({start:r,commas:[]});continue}if(o===","&&t.length>0){t.at(-1)?.commas.push(r);continue}if(o!=="}"||t.length===0)continue;let i=t.pop();if(!i||i.commas.length===0)continue;if(!n||i.start<n.start)n={start:i.start,end:r+1,commas:i.commas}}if(!n)return;return{start:n.start,end:n.end,alternatives:hu(e,n)}}function su(e){let t=[],n,r=null,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(o){o=!1;continue}if(s==="\\"&&r!=="'"){o=!0;continue}if(s===r){r=null;continue}if(r===null&&(s==="'"||s==='"')){r=s;continue}if(r!==null)continue;if(s==="{"){t.push({start:i,commas:[]});continue}if(s===","&&t.length>0){t.at(-1)?.commas.push(i);continue}if(s!=="}"||t.length===0)continue;let a=t.pop();if(!a)continue;let l=a.commas.length>0?{kind:"alternatives",start:a.start,end:i+1,commas:a.commas}:cS(e.slice(a.start+1,i))?{kind:"range",start:a.start,end:i+1}:void 0;if(l&&(!n||l.start<n.start))n=l}if(!n||n.kind==="range")return n;return{kind:n.kind,start:n.start,end:n.end,alternatives:hu(e,n)}}function gu(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function hu(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function cS(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function uS(e,t){let n=`x${e}`,r=xs(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function dS(e,t,n,r){return pe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit",span:{start:t,end:n}}],nodes:[]})}function fn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`,span:{start:n,end:n}}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function ao(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Es(e){return e.used++,e.used<=e.max}function mS(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Vn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Vn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Vn(t.body.nodes)})}function fS(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`,span:t.declarationSpan}))}function yu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function au(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!lu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`,span:n.span})}function Rs(e,t,n){if(!yu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector",span:{start:n,end:n+1}})}function pS(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var Su=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),gS=new Set(["gc","cat","type","cp","mv","rm"]),Cu=["-rec","-for","-path","-literalpath","-whatif"],hS=/^\$env:\w/i,yS=/^(?:\$\{?\w+\}?|~)\\./,po={maxInputLength:131072,maxWords:16384,maxDepth:64};function bu(e){let t=e.toLowerCase().replaceAll("`","");if(![...Su].some((r)=>t.includes(r))&&!(t.includes("rm")&&Cu.some((r)=>t.includes(r)))&&!t.includes("<#")&&!SS(t))return!1;let n=xS(e);if(n.posixHeredoc)return!1;return n.invalidComment||n.commands.some(CS)}function SS(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function CS(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&Su.has(n))return!0;let r=e.slice(t+1);if(n&&gS.has(n)&&r.some(bS))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Cu.some((s)=>i.startsWith(s))})}function bS(e){return hS.test(e)||yS.test(e)}function vu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return pe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`,span:n}],nodes:[]});let r=Is(e,0,e.length,t,0);return pe({kind:"program",dialect:"powershell",source:e,span:n,status:_S(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Is(e,t,n,r,o,i=!1){let s=[],a=[],l=ro(),c=0,d=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};oo(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:d};let p=xu(e,u,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};u=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
+`){m();let y=f==="\r"&&e[u+1]===`
+`?u+2:u+1;s.push(ws(e,u,y)),u=y;continue}u++;continue}let h=ks(e,u);if(h){m(),s.push(ws(e,u,u+h.length)),u+=h.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Ru(u,r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Is(e,u+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=pe({kind:"program",dialect:"powershell",source:e.slice(u+1,v),span:{start:u+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:u,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed",span:{start:u,end:y.next}});c+=y.words,d||=y.limited,u=y.next;continue}if(f==="}"){m(),s.push(ws(e,u,u+1)),u++;continue}if(f===">"||f==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===f?u+2:u+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?As(e,v,n,r,o):void 0,b=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(u,y),span:Object.freeze({start:u,end:b}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,d||=E.limited;l.end=b,u=b;continue}if(f===","){l.start=l.start===-1?u:l.start,l.words.push(Cs({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let g=As(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,d||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`,span:{start:u,end:g.next}}),m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};u=g.next>u?g.next:u+1}return m(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:d}}function As(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],d=0,m=!1,u=(p)=>{let h=vS(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),d+=Ps(h.program),m||=h.program.status==="limited",s="command-substitution",h.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||ks(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[f+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character",span:{start:f,end:f+1}}),f++;break}i+=h,f+=2;continue}if(e.startsWith("$(",f)){f=u(f);continue}if(p==="'"){a=!0,f++;let h=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){h=!0,f++;break}i+=e[f]??"",f++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:t,end:e.length}});continue}if(p==='"'){a=!0;let h=f++,g=!1;while(f<n){let y=e[f];if(y==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(y==='"'){g=!0,f++;break}if(e.startsWith("$(",f)){f=u(f);continue}if(y==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=y??"",f++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:h,end:e.length}});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:mn(e,t,f,i,s,a,s==="literal"?void 0:ES(e,t,f)),next:f,issues:l,nested:c,words:d,limited:m}}function vS(e,t,n,r,o){let i=Eu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:pe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Ru(t,r.maxDepth)],nodes:[]}),next:a};let l=Is(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed",span:{start:t,end:a}}]:[];return{program:pe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Eu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Ps(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Ps(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Ps(r)}}return t}function ES(e,t,n){let r=io(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Eu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=RS(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function RS(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Ru(e,t){return{code:"depth-limit",message:`command structure exceeds parser limit ${t}`,span:{start:e,end:e}}}function xS(e){let t=[],n=[],r=0,o=0,i=!1,s=!1,a=()=>{if(n.length>0)t.push(n);n=[]};while(r<e.length&&r<131072&&o<16384){let l=e[r];if(l==="\r"||l===`
+`){a(),r+=l==="\r"&&e[r+1]===`
+`?2:1;continue}if(/\s/.test(l??"")){r++;continue}let c=xu(e,r,Math.min(e.length,po.maxInputLength),po.maxDepth);if(c){i||=!!c.issue||c.limited,r=c.next;continue}let d=ks(e,r);if(d){a(),r+=d.length;continue}if(l==="{"||l==="}"){a(),r++;continue}s||=e.startsWith("<<",r);let m=As(e,r,Math.min(e.length,po.maxInputLength),po,0);if(m.word.text)n.push(m.word.text);for(let u of m.nested)t.push(...Ts(u));o++,r=m.next>r?m.next:r+1}return a(),{commands:t,invalidComment:i,posixHeredoc:s}}function Ts(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ts(t.body);if(t.kind!=="command")return[];return[t.words.map((n)=>n.text),...t.nested.flatMap(Ts)]})}function ks(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function xu(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`,span:{start:t,end:i+2}},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed",span:{start:t,end:n}},limited:!1}}function _S(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function ws(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}var Nt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function De(e,t="auto",n=Nt){if(t==="powershell"||t==="auto"&&bu(e.slice(0,n.maxInputLength)))return vu(e,n);return cu(e,n)}function _(e){return e.provenance==="command-substitution"?e.raw:e.text}function pn(e,t){return e==="posix"?t:q(t.map((n)=>n.text))}function go(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function q(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Os(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Z(e){return e.value.length}function Kn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ee(e,t){Kn(e,t)}function Lt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function j(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Ms(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function V(e,t,n){if(t+n.length>Z(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function Je(e,t,n){return!Lt(C(e,t-1))&&V(e,t,n)&&!Lt(C(e,t+n.length))}function Qe(e,t){return Lt(C(e,t-1))!==Lt(C(e,t))}function re(e){return e===`
+`||e===";"||e==="&"||e==="|"}function gn(e){return e==="|"||e===";"}function ho(e,t,n){let r=Os(e,n);if(t==="rm")return wS(r);if(t==="dd")return PS(r);return Iu(r,!0)}function yo(e,t,n){let r=Os(e,n);if(t==="rm")return TS(r);if(t==="reset-hard")return Pu(r,"--ha","rd");if(t==="reset-merge")return Pu(r,"--me","rge");if(t==="clean")return MS(r);if(t==="checkout")return NS(r);if(t==="push-force")return LS(r);if(t==="push-refspec")return WS(r);if(t==="push-delete")return FS(r);if(t==="branch")return GS(r);if(t==="tag")return $S(r);if(t==="restore")return US(r);return Iu(r,!1)}function wS(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Z(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(Je(e,i,"rm")&&j(l)&&l!==`
+`)t=!0,i++;continue}let a=AS(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Z(e)){if(o>=0){let l=_u(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(j(s)){if(o<0)continue;if(V(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=_u(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function AS(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(V(e,t,String.raw`\n`))return t+2;if(V(e,t,String.raw`\x0a`)||V(e,t,String.raw`\x0A`))return t+5;if(V(e,t,String.raw`\u000a`)||V(e,t,String.raw`\u000A`))return t+7;return V(e,t,String.raw`\012`)?t+4:-1}function _u(e,t,n){if(wu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(wu(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function wu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!V(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function PS(e){let t=!1;for(let n=0;n<Z(e);n++){if(re(C(e,n))){t=!1;continue}if(Je(e,n,"dd")){t=!0,n++;continue}if(!t||!Je(e,n,"of")||!V(e,n,"of=/dev/"))continue;let r=n+8;if(r<Z(e)&&!j(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function TS(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);){let i=C(e,o);if(o===Z(e)||re(i)){t=!1,n=!1,r=!1,o++;continue}let s=kS(e,o);if(s>=0){if(IS(e,s))return!0;let a=s,l=!1;while(j(C(e,a)))l||=C(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(V(e,o,"--")&&(o===0||j(C(e,o-1)))&&(!C(e,o+2)||j(C(e,o+2))||re(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=V(e,o,"--recursive")&&Qe(e,o+11)||Ds(e,o,"recursive"),r||=V(e,o,"--force")&&Qe(e,o+7)||Ds(e,o,"force"),n&&r)return!0;o++}return!1}function Ds(e,t,n){if(!V(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||j(o)||re(o))break;if(o!==n[r])return!1;r++}return r>0&&Qe(e,t+r+2)}function IS(e,t){let n=t,r=!1,o=!1;while(n<Z(e)){while(j(C(e,n)))n++;let i=n;while(n<Z(e)&&!j(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&V(e,i,"--"))return!1;let s=Au(e,i,"recursive"),a=Au(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=OS(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Au(e,t,n){return V(e,t,`--${n}`)&&Qe(e,t+n.length+2)||Ds(e,t,n)}function kS(e,t){if(t>0&&Lt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!j(C(e,n+1)))return-1;return n+1}function OS(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let d=C(e,c)??"",m=(d==="r"||d==="f")&&Qe(e,c+1);r||=d==="r",o||=d==="f",i||=d==="r"&&m,s||=d==="f"&&m,a||=(l==="r"&&d==="f"||l==="f"&&d==="r")&&m,l=d}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Pu(e,t,n){return Yn(e,"reset",gn,!0,(r)=>C(e,r)==="-"&&hn(e,r,t,n)?!0:r)}function MS(e){return Yn(e,"clean",gn,!0,(t)=>{if(C(e,t)!=="-")return t;if(hn(e,t,"--fo","rce"))return!0;let n=qn(e,t,gn);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function So(e,t,n){if(!Je(e,t,"git"))return null;let r=t+3;if(!j(C(e,r)))return{commandEnd:-1,next:r};while(j(C(e,r)))r++;while(r<Z(e)){if(re(C(e,r)))return{commandEnd:-1,next:r};let o=qn(e,r,re);if(Je(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&V(e,r,"--"),s=DS(e,r,o);r=o;while(j(C(e,r)))r++;if(i)return{commandEnd:Je(e,r,n)?r+n.length:-1,next:qn(e,r,re)};if(!s)continue;if(r>=Z(e)||re(C(e,r)))return{commandEnd:-1,next:r};r=qn(e,r,re);while(j(C(e,r)))r++}return{commandEnd:-1,next:r}}function DS(e,t,n){for(let r of le)if(n-t===r.length&&V(e,t,r))return!0;return!1}function NS(e){return Tu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function LS(e){return Yn(e,"push",gn,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!Lt(C(e,t+2))&&!V(e,t+2,"-with-lease"))return!0;let n=ku(e,t,"--fo","rce");if(n>=0&&!V(e,n,"-with-lease"))return!0;return t})}function WS(e){return Yn(e,"push",re,!1,(t)=>{if(j(C(e,t))&&C(e,t+1)==="+"&&t+2<Z(e)&&!re(C(e,t+2))&&!j(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function FS(e){return Yn(e,"push",re,!1,(t)=>{if(C(e,t)==="-"&&hn(e,t,"--de","lete"))return!0;if(j(C(e,t))&&C(e,t+1)===":"&&t+2<Z(e)&&!j(C(e,t+2))&&!re(C(e,t+2)))return!0;return t})}function GS(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);o++){if(o===Z(e)||re(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=So(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=qn(e,o,re),s=zS(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function zS(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(hn(e,i,"--de","lete"))r=!0;if(hn(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&BS(C(e,s))){let d=C(e,s);a||=d==="d"||d==="D",l||=d==="f",c||=d==="D",s++}if(!Qe(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function BS(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function $S(e){return Tu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Tu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Z(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(j(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=So(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&j(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(hn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Qe(e,r+1))return!0;if(gn(o))i.outerActive=!1}return!1}function Yn(e,t,n,r,o){let i=!1;for(let s=0;s<Z(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=So(e,s,t);if(c){i=c.commandEnd>=0&&(!r||j(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let d=s;d<=c;d++)if(n(C(e,d)))i=!1;s=c}if(l)i=!1}return!1}function US(e){let t=!1;for(let n=0;n<Z(e);n++){if(Ms(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=So(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(V(e,n+2,"staged")||V(e,n+2,"help")))t=!1}return t}function Iu(e,t){let n=!1;for(let r=0;r<Z(e);r++){let o=C(e,r),i=t?Ms(o):re(o);if(n&&j(o)&&C(e,r+1)==="-"&&Je(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Je(e,r,"find"))n=!0,r+=3}return!1}function qn(e,t,n){let r=t;while(r<Z(e)&&!j(C(e,r))&&!n(C(e,r)))r++;return r}function ku(e,t,n,r){if(!V(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return Qe(e,o)?o:-1}function hn(e,t,n,r){return ku(e,t,n,r)>=0}function et(e,t){Kn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ee(t,a);if((s.regex?.test(a)??!1)||s.scan&&yo(a,s.scan,t))return S("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var HS=/^[A-Za-z_][A-Za-z0-9_]*=/;function Mu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;Kn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Du(t.nodes,r,i)}function Du(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Du(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return jS(r,t,n)})}function jS(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!HS.test(o.text));return e.words.every((o,i)=>o===t||Ou(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Ou(o.target.raw,n.anchored,!0)))}function Ou(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as VS,resolve as Nu}from"path";function Zn(e,t,n,r){let o=VS(e)?Nu(e):t?Nu(t,e):void 0;if(!o)return;try{return B(o,n,r)}catch{return o}}function Lu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var yn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Xn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Ns=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),KS=new Set(["-p","--print"]),qS=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),YS=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),ZS=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),XS=new Map([["python",new Set(["m"])]]),JS=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),QS=new Set(["always","default","never"]),eC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),tC=/\\\r?\n/g,nC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Fu(e){return bo(e).code}function Co(e){return bo(e).sources}function Gu(e){return nC.get(Ws(e))??[]}function bo(e){let t=Ws(e[0]??"");if(!Ns.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&KS.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(oC(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(iC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=rC(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(JS.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&eC.has(s))||t==="python"&&!QS.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let u=s[m];if(u===void 0)break;if(XS.get(t)?.has(u)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if(qS.get(t)?.has(u)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&u==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(YS.get(t)?.has(u)){if(m+1===s.length)i++;break}if(ZS.get(t)?.has(u)&&m+1<s.length)break}if(l===void 0)continue;let d=c?i+1:i;if(n.push({tokenIndex:d,value:l}),r.push({tokenIndex:d,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((d)=>d.tokenIndex)),c=n.filter((d)=>d.kind!=="inline-code"||l.has(d.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((d)=>d.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function rC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ls(e,t){return Ws(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Ws(e){let t=I(e).toLowerCase();return $r.test(t)?"python":t}function oC(e,t){return Ns.get(e)?.has(t)??!1}function iC(e){return Ns.get(e)?.has("--eval")??!1}function Jn(e,t){let n=lC(e,t);if(!Wu(n,t))return!1;Ee(t,n);let r=aC(n);if(Wu(r,t))return!0;return Ee(t,r),sC.test(r)}var sC=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function aC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Wu(e,t){if(ho(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ee(t,e),r.test(e))return!0;if(ho(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ee(t,e),r.test(e))return!0;if(ho(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ee(t,e),n.some((o)=>yo(o,r))))}function lC(e,t){return Ee(t,e),e.replace(tC,"")}import{isAbsolute as ud,relative as dd}from"path";import{isAbsolute as Hu,parse as SC}from"path";import{dirname as cC,isAbsolute as uC,parse as dC,sep as mC}from"path";function ft(e,t,n){if(Ze(t))throw Error("Unsupported Windows namespace path");let r=uC(t)?dC(t).root:"",o=r||e;for(let i of pC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=cC(o);continue}let s=fC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function fC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${mC}${t}`}function pC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Fs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],gC=new Set(Fs),hC=1024,zu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),vo=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),yC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Eo(e){return gC.has(e)}function Gs(e){return Eo(e)||zu.has(e)||vo.has(e)||Mn(e)}function Ae(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Ro(e,t){let n=Ae("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=hC?{state:"valid",count:r}:{state:"invalid"}}function xo(e,t,n){let o=e.match(yC)?.[1];if(!o||!Gs(o))return null;let i=e.indexOf("=");return{name:o,value:`${Ae(o,t,n)??""}${e.slice(i+1)}`}}function Bu(e){return Uu(e,vo)}function $u(e){return Uu(e,zu)}function Uu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Vu=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!Vu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function _o(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(_(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Ku(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Wt(e,t,n,r){if(!Ku(Sn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<P.wrapperPeelIterations.cap;m++){let u=ju(i),f=_o(i);for(let[h,g]of f.envAssignments)s.set(h,g),a.set(h,g);if(i=f.words,i.length===0)break;while(i.length>0&&Sn(i).includes("=")&&!bC(i)){let h=vC(Sn(i),a,t.env)??xo(Sn(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=Sn(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=RC(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=wC(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=AC(i);if(p==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if(ju(i)===u)break}let d=_o(i);for(let[m,u]of d.envAssignments)s.set(m,u),a.set(m,u);return{words:d.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:CC(d.words,o)}}function CC(e,t){return e.some((n)=>!t.has(n))}function ju(e){return e.map(_).join(" ")}function Sn(e){let t=e[0];return t?_(t):""}function Le(e,t){let n=e[t];return n?_(n):void 0}function bC(e){return Vu.test(Sn(e))}function vC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var EC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function RC(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?Qn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Qn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Qn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(EC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var xC=new Set(["-i","-0","--null"]),_C=new Set(["-u","--unset","-C","--chdir","-P"]);function wC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(xC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Le(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let d=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(d){if(d.value!==void 0)i.push(d.value);return s=null,l(a+d.consumed)}if(_C.has(c)){if(c==="-C"||c==="--chdir"){let m=Le(e,a+1);s=m?Qn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Qn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(Le(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function Qn(e,t,n){if(t==="")return null;if(!e&&!Hu(t))return null;let r=Hu(t)?SC(t).root:n.realpath(e??"/");if(r===null)return null;try{return ft(r,t,n)}catch{return null}}function AC(e){if(Le(e,1)==="-v")return[...q(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var PC=/['"\\$`{}#]/;function wo(e,t){if(e.some((r)=>PC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function pt(e,t,n){return Ao(e,t,n).tokens}function TC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function gt(e,t,n,r=0){let o=Ao(e,t,n),i=(o.envSplitValues??[]).flatMap(TC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return gt(s,t,n,r+1)}function Ao(e,t,n,r){if(!Ku(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Wt(q(e),t,n,r);return{tokens:o.words.map(_),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Us=Symbol("adopt-as-operand"),IC=new Set(["env","sudo","command","builtin"]),kC=new Set(["&&","||","|&","|","&",";"]),OC=new Set(["<<","<<<",">|"]),MC=new Set(["|","|&"]),DC=/[*@#?$!_-]/,NC=/^\w+(?::\w+)*/,LC=Object.freeze([]),er=Object.freeze({kind:"scope",edge:"enter"}),tr=Object.freeze({kind:"scope",edge:"exit"}),WC=Object.freeze([]),FC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),nr=new Set(["bash","sh","zsh","dash","ksh"]),GC=256,Ju=new WeakMap;function Qu(e,t){let n=t.status==="complete"?new Set($s(t)):new Set,r=$C(e,n);if(Hr(r))return Po("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Ft(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Po("structural-limit",r,t);if(o.invalid)return Po("invalid",r,t);let s=Po("complete",r,t,o.assignmentFallbacks);return Ju.set(s,Object.freeze(i)),s}function Io(e,t,n,r,o){let i={cwd:t,variables:new Map,previous:null},s=[],a=new Set,l=null,c=[];for(let d of ed(e)){if(d.kind==="scope"){if(d.edge==="enter"){c.push({state:i,segment:[...s],shellWords:new Set(a),pipeProducer:l});continue}let m=o.segment(s,i,l,null,a);if(m)return m;let u=c.pop();if(u===void 0)throw Error("scope exit without a matching enter");i=u.state,s=u.segment,a=u.shellWords,l=u.pipeProducer;continue}if(d.kind==="operator"){if(!d.boundary)continue;let m=o.segment(s,i,l,d.operator,a);if(m)return m;i=zC(s,i,n,r),l=s.length>0&&MC.has(d.operator)?s:null,s=[],a=new Set;continue}if(d.kind==="redirection"){if(d.fd!==void 0)a.add(s.length-1);if(d.target===void 0)continue;let m=o.redirection({operator:d.operator,role:d.role,targetOrder:d.targetOrder,target:d.target,...d.body===void 0?{}:{body:d.body,consumer:d.consumer}},i);if(m===Us){a.add(s.length),s.push(o.word(d.target));continue}if(m)return m;continue}s.push(o.word(d.text))}return o.segment(s,i,l,null,a)}function ko(e){return ed(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function ge(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:ge(i,t);return a?ge(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function rr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function zC(e,t,n,r){let o=rr(e)?new Map([...t.variables,...BC(e,t.variables)]):t.variables,i=pt([...e],n),s=I(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ie(ge(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function BC(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],ge(o,t)]]:[]})}function ed(e){return Ju.get(e)??LC}function $C(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Po(e,t,n,r=WC){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Ft(e,t){return e.nodes.flatMap((n,r)=>UC(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function UC(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We(qC(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[To("{"),...Ft(e.body,a),...s?[To("}")]:[]]:[er,We("("),...Ft(e.body,a),...s?[We(")")]:[],tr]}]}let o=JC(e,r.functions);if(o){if(r.depth>=Nt.maxDepth||++r.flags.expansions>GC)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...qu(e,r),To(";"),...Ft(o,{...r,depth:r.depth+1}),To(";")]},...Yu(e,t,n,r)]}return[{start:e.span.start,events:qu(e,r)},...Yu(e,t,n,r)]}function qu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:nd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:HC(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function HC(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?nd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[Hs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:YC(r),targetOrder:OC.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:od(t)}:{}}),...s===void 0?o:o.slice(1)]}function Yu(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[Hs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...td(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?jC(t,n,r):[]]}function jC(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:td(n.source.slice(r.span.end,e.span.end),n)}]}function td(e,t){if(t.depth>=Nt.maxDepth)return t.flags.limited=!0,[];let n=De(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Ft(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function nd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?Hs(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of zs(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(We(f));continue}s+=f.text,a||=f.glob}continue}let d=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=zs(f,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=d?Ft(d,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(er,...p,tr);continue}let m=d?Ft(d,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(er,...m,tr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),er,...m,...c.raw.endsWith(")")?[We(")")]:[],tr);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>We("(")),...u===1?[er]:[],...m,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>We(")")):[],...u===1?[tr]:[])}return l(),o}function zs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Zu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Zu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Zu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=KC(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return VC(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&DC.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?NC:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function VC(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=zs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function KC(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function qC(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:kC.has(e)})}function To(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function Hs(e){return Object.freeze({kind:"word",text:e})}function YC(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function or(e){return FC.has(e)||/^python\d/.test(e)}var ZC=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function rd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=ZC.get(e)?.has(n)??!1;return rd(e,t.slice(r?2:1))}function Bs(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Bs(e.slice(1));if(!IC.has(t))return[...e];return Bs(rd(t,e.slice(1)))}function od(e){let t=Hn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Bs(n<0?[]:e.words.slice(n).map((r)=>r.text))}function XC(e){let t=od(e)[0];if(t===void 0)return!1;let n=I(t).toLowerCase();return or(n)&&!nr.has(n)}function $s(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return $s(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>$s(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(XC(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!eb(t))return r;return[...r,...o]})}function JC(e,t){let n=Hn(e);return n===void 0?void 0:t.get(n)}function ht(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function QC(e){if(ht(e.words[0],"git"))return ht(e.words[1],"commit");if(!ht(e.words[0],"gh")||!ht(e.words[2],"create"))return!1;return ht(e.words[1],"pr")||ht(e.words[1],"issue")}function eb(e){return(ht(e.words[0],"cat")||ht(e.words[0],"tee")||QC(e))&&!e.words.some(Xu)&&!e.redirections.some((n)=>Xu(n.target))}function Xu(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var id=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),sd=new Set([...id,"glob"]),tb=new Set([...sd,"pattern"]),ad={parseCommand:De,readGuardSyntax:Qu};class Fe extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function ir(e,t={}){let n=nb({...ad,...t}),r=Ln(e.input),o=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&r)o.push({usage:"input-candidate",source:r});if(e.route.kind==="command"&&"command"in e&&e.command)o.push({usage:"declared-command",source:e.command});let i=o.reduce((s,a)=>{let l=s.findIndex((m)=>m.source===a.source);if(l!==-1){let m=s[l];if(!m)return s;return s[l]={...m,usages:[...m.usages,a.usage]},s}let c=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",d=n.getCommandProgram(a.source,c);return s.push({usages:[a.usage],source:a.source,program:d,shell:n.getShellSyntax(a.source,d)}),s},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:i,paths:rb(e),store:n}}function ue(e,t){return e.commands.find((n)=>n.usages.includes(t))}function tt(e,t){if(!e.includes("$"))return e;return xi(e,t)}function nb(e={}){let t={...ad,...e},n=new Map,r=new Map,o=new WeakMap,i=(a,l)=>{let c=`${l}\x00${a}`,d=r.get(c);if(d)return d;let m=t.parseCommand(a,l);return r.set(c,m),m};return{getShellSyntax:(a,l)=>{if(l&&l.source!==a)throw TypeError("Shell syntax source does not match command program source.");let c=l??i(a,"posix");if(c.status==="limited"){let u=o.get(c);if(u)return u;let f={status:"structural-limit",source:a,program:c,assignmentFallbacks:[]};return o.set(c,f),f}let d=n.get(a);if(d)return d;let m=t.readGuardSyntax(a,c);return n.set(a,m),m},getCommandProgram:i}}function rb(e){let t=e.route.kind==="grep"?sd:e.route.kind==="glob"?tb:id;return[...Dl(e.input,t),...e.route.kind==="patch"?Wl(e.input):[]]}var ob=new Set(["-S","--suffix"]);function Cn(e,t,n,r,o){if(e.status==="structural-limit")throw new Fe;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Io(e,t,n,r,{word:(i)=>i,segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(ge(i.target,s.variables),s)?i.target:null})}function Oo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&ob.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function md(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Lr(e.invocation.toolName))return null;let a=e.paths.find((l)=>ld(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ue(e,"input-candidate");if(!i)return null;let s=Cn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>lb(a,l,t,n,r),isRedirectionTarget:(a,l)=>ld(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Gt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Do(ie(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(js(l,n))return!0;let c=s||a.slice(l.length).includes("/."),d=(m)=>c?Mo(m,l):ib(m,l);if(n.markerFiles.some(d))return!0;return r&&cd(n).some(d)}if(js(a,n))return!0;return r&&cd(n).some((c)=>Mo(c,a))}function ib(e,t){let n=dd(t,e);if(n===""||n.startsWith("..")||ud(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function sb(e,t,n,r,o){return Gt(e,t,n,!0,r,o)}function ab(e,t,n,r,o){if(!n)return!1;return js(Do(ie(e,t,r,o)),n)}function ld(e,t,n,r,o,i){let s=Do(ie(e,t,r,o));return i.includes(s)||pd(s,n)}function fd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Mo(i,Do(ie(s,t,r,o)))))}function js(e,t){return t.entries.includes(e)||t.directories.includes(e)||pd(e,t)}function pd(e,t){return t.hooksDirectories.some((n)=>Mo(e,n))}function cd(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Mo(e,t){let n=dd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!ud(n)}function Do(e){return process.platform==="win32"?e.toLowerCase():e}function lb(e,t,n,r,o){if(rr(e))return null;let i=gt([...e],r);if(I(i[0]??"").toLowerCase()!=="mv")return null;let s=Oo(i.slice(1)),a=s.sources.find((l)=>sb(ge(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&ab(ge(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Xs,normalize as yb,parse as Sb,posix as Rd,resolve as bn,sep as Zs}from"path";import{isAbsolute as cb,join as gd,normalize as Sd,parse as ub,sep as hd}from"path";var db=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],mb=` 	
+`;function sr(e,t){if(yt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Vs(e.get("TMPDIR")??"",t)}function zt(e,t){if(e.has("TMPDIR"))return Vs(e.get("TMPDIR")??"",t);let n=Ks(e,t);if(n===void 0)return!0;return Vs(n,t)}function Ks(e,t){return vd(e,t,"TMPDIR")}function Vs(e,t){if(!e)return!1;if(pb(e))return!1;return qs(e,t)}function yt(e,t){let n=vd(e,t,"IFS");return n!==void 0&&n!==""&&n!==mb}function qs(e,t){let n=No(e,t.paths);if(n===null)return!1;return bd(t).some((r)=>hb(n,r))}function Cd(e,t){let n=No(e,t.paths);if(n===null)return!1;return bd(t).some((r)=>Lo(r)===Lo(n))}var yd=new WeakMap;function bd(e){let t=yd.get(e);if(t)return t;let n=fb(e);return yd.set(e,n),n}function fb(e){let t=db.map((r)=>No(r,e.paths)??Sd(r)),n=No(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&gb(n))return[...t,n];return t}function pb(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function vd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function gb(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function No(e,t){try{let n=Sd(e);if(!cb(n))return n;let r=ub(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=gd(i,o[s]??"");if(t.entryKind(a)==="missing")return gd(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function hb(e,t){let n=Lo(e),r=Lo(t);if(n===r)return!0;let o=r.endsWith(hd)?r:`${r}${hd}`;return n.startsWith(o)}function Lo(e){return process.platform==="win32"?e.toLowerCase():e}var Cb=process.platform==="win32",Ed=64,bb=16384;function ar(e){let t=pu(e,Ed,Ed,bb);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:vb(e)}}function vb(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>Eb(e.raw,n.span.start-e.span.start))}function Eb(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Bt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Ce();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:Ab(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Ge(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&Tb(e))return{kind:"outside_anchored_cwd"};let o=!r&&wd(e,t.posixShell);if(Ze(e))return{kind:"outside_anchored_cwd"};if(Js(e,r))return{kind:"root_or_home_target"};if(Rb(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Gt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(xb(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(Pb(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&Mb(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&Db(e,t.resolvedCwd??i,t.environment.paths,t.budget))return{kind:"cwd_self_target"};if(Nb(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function xd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Ge(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(wb(i))return!1;if(Cd(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Lb(r??i,s,t.environment.paths,t.budget))}function Js(e,t=!1){let n=e.trim(),r=Rd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function Rb(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Xs(o)?o:t.resolvedCwd?bn(t.resolvedCwd,o):null;if(!i)return!1;let s=he(B(i,t.environment.paths,t.budget));if(s===Sb(s).root)return!0;return s===he(B(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=yb(e);if(Cb){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function xb(e,t,n,r,o,i,s,a){let l=e.trim();if(_d(l))return!1;if(!r&&qs(l,a))return!0;return(t||i&&s)&&n&&!o&&_b(l,n)}function _b(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!wd(e.slice(n.length+1),t)})}function wb(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Rd.normalize(`/${t[1]??""}`)==="/"}function _d(e){return e.split(/[\\/]+/).includes("..")}function Ab(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Bn(o.trim(),t);if(!Xs(i))return[];try{let s=B(i,n,r);if($n(s,B(t,n,r)))return[];return[he(s)]}catch{return[]}})}function Pb(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(_d(r))return!1;let o=n?r:Bn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Xs(o)?o:i?bn(i,o):null;if(!s)return!1;try{let a=he(B(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Zs)?l:`${l}${Zs}`))}catch{return!1}}function Tb(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function wd(e,t=!1){return e.includes("$")||e.includes("`")||Ib(e)||t&&kb(e)}function Ib(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function kb(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&Ob(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function Ob(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function Mb(e,t,n,r){try{return he(B(e,n,r))===he(B(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function Db(e,t,n,r){if(e==="."||e==="./"||e===".\\")return!0;try{return he(B(bn(t,e),n,r))===he(B(t,n,r))}catch{try{return he(bn(t,e))===he(t)}catch{return!1}}}function Nb(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Ys(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Ys(bn(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Ys(bn(a,e),t,i,s)}catch{return!1}}function Ys(e,t,n,r){try{return Ad(B(e,n,r),B(t,n,r))}catch{return!1}}function Lb(e,t,n,r){if(!t)return!1;try{return Ad(B(t,n,r),B(e,n,r))}catch{return!0}}function Ad(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${Zs}`)||n===r}var Wb=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Pd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Fb="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Td="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Id="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",Gb="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",zb="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.";function kd(e,t,n,r=Bt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return Bb(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function Bb(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=Ub(o),s=o[i];if(!s||!Wb.has(Jb(s.text)))return null;let a=$b(o.slice(i+1));if(a.whatIfProtected)return null;if(Q(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return S("powershell.remove-item-pipeline-dynamic-target",zb);for(let l of a.targets)if(!Ze(l.text)&&Js(ea(l.text)))return S(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Id);for(let l of a.targets)if(n.resolvedCwd&&Gt(ea(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return S("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(Q(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return S("powershell.remove-item-recursive-force-dynamic-target",Td);for(let l of a.targets){let c=Qb(Ge(ea(l.text),n),n,r);if(c)return c}return null}function $b(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(Hb(l))continue;if(s){t.push(Qs(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=Vb(l.text);if(!c){t.push(Qs(l)),i=i||l.dynamic;continue}if(Kb(c.name)){let d=c.value?jb(c.value,l):e[++a];if(d?.kind==="word"){t.push(Qs(d)),i=i||d.dynamic;continue}i=!0;continue}if(qb(c.name)){n=!0;continue}if(Yb(c.name)){r=!0;continue}if(Zb(c.name))o=Xb(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function Ub(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Qs(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function Hb(e){return e.kind==="word"&&e.text===","}function ea(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function jb(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function Vb(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function Kb(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function qb(e){return"recurse".startsWith(e)}function Yb(e){return e.length>=2&&"force".startsWith(e)}function Zb(e){return e==="wi"||"whatif".startsWith(e)}function Xb(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function Jb(e){return e.toLowerCase()}function Qb(e,t,n){switch(e.kind){case"root_or_home_target":return S("powershell.remove-item-recursive-force-root-or-home",Id);case"git_metadata_target":return S("powershell.remove-item-git-metadata",Te);case"temp_target":return null;case"dynamic_target":if(!Q(n,"powershell.remove-item-recursive-force-dynamic-target",t.strict))return null;return S("powershell.remove-item-recursive-force-dynamic-target",Td);case"home_cwd_target":return S("powershell.remove-item-recursive-force-home-cwd",Gb);case"cwd_self_target":return S("powershell.remove-item-recursive-force-cwd-self",Pd);case"within_anchored_cwd":if(!Q(n,"powershell.remove-item-recursive-force-paranoid",t.paranoid))return null;return S("powershell.remove-item-recursive-force-paranoid",Fb);case"outside_anchored_cwd":return S("powershell.remove-item-recursive-force-outside-cwd",Pd)}}var vn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Wo="Unsupported heredoc syntax",Od="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";import{normalize as ei}from"path";var ev=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),tv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),nv=new Set(["-o","--output","--query","--subscription"]),rv=new Set;function Md(e){if(e==="aws")return ev;if(e==="gcloud")return tv;if(e==="az")return nv;return rv}var ov=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),iv=new Set;function Dd(e){if(e==="git")return le;if(e==="docker")return ov;return iv}function ze(e,t){if(e.length===0||t.length===0)return null;let n=L(e[0]??""),r=fe(e);for(let o of t){if(!lv(n,o.command))continue;if(o.match){if(sv(n,e,o.match))return Nd(o);continue}if(!cv(n,e,o.subcommand))continue;if(dv(e,new Set(o.block_args),r))return Nd(o)}return null}function Nd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function sv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return av(r,n.command_path,Md(e))}function av(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function lv(e,t){return e===L(t)}function cv(e,t,n){if(!n)return!0;return Ld(t,1,n,Dd(e))}function Ld(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&uv(e,i,n,r))return!0;continue}return s===n}return!1}function uv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Ld(e,t+2,n,r)}function dv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var mv=new Set(["-e","--source"]),fv=new Set(["-F","-v","--assign","--field-separator"]),Wd=new Set(["-f","--file"]),pv=new Set(["print","printf","return"]),Fd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],gv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Gd(e,t,n){let r=!1;for(let o of hv(e)){let i=yv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?S("awk.system-dynamic",gv):null}function na(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&mv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(fv.has(a)||Wd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Wd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function cr(e){return na(e).sources}function hv(e){return cr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function yv(e,t){Ee(t,e);let n=e.includes("system")?ra(e,t):null,r=Sv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function ra(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Go(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=zd(e,i+1);continue}if(s==="/"&&Bd(e,i)){i=$d(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,lr(e[a-1])||lr(e[i]))continue;let l=Fo(e,i);if(e[l]!=="(")continue;l=Fo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=Go(e,l,c);if(!d){r=!0,o=!0;continue}if(l=Fo(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function Sv(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let f=Go(e,i,d);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(d==="#"){i=zd(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&Bd(e,i)){let f=$d(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+{}`.includes(d)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ta(e,i,"print")||ta(e,i,"printf")))a=i;if(d!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(d))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,u=Fo(e,m);if(ta(e,u,"getline")){o=!0;let f=vv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(Rv(s,a)){o=!0;let f=bv(e,u);if(!f){r=!0,c=m,i=m;continue}if(!Cv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function lr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Fo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function Cv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function Go(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=Ev(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function bv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Go(e,t,n)}function vv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function Ev(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ta(e,t,n){return e.startsWith(n,t)&&!lr(e[t-1])&&!lr(e[t+n.length])}function Rv(e,t){return t!==null&&t>=e}function zd(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Bd(e,t){let n=xv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(lr(e[r-1]))r--;return pv.has(e.slice(r,n+1))}function xv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function $d(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var _v=new Set(["sudo","env","command","builtin"]);function zo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(I(n)))return null;let r=I(n),o=e[1]==="--"?2:1,i=wv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function wv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=I(a)!==n&&Av(a,r);if(l)i.push(s);if(!l&&Ur.has(L(a)))break;if(o)break}return i}function Av(e,t){let n=I(e),r=L(e);return r==="git"||n==="busybox"||$t(e)||Ki.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function $t(e){return _v.has(e.toLowerCase())}function Be(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Bo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Bo(e,t,n,r,o,i,s,a,l){let c=Ao(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:d,cwd:m}=c;if(c.envSplitValues){let f=wo(c.envSplitValues,d);if(!f)throw new F("derivedCommandShape");oa(a),yield*Bo(f,t,m,r,o,i,s,a,l);return}if($t(d[0]??""))throw new F("wrapperPeelIterations");let u=zo(d,s);if(u){for(let f of[u.childIndex,...u.alternativeChildIndices])oa(a),yield*Bo(f===u.childIndex?u.tokens:[...d.slice(f)],t,m,r,new Map(o),new Map(i),s,a,!0);return}if(Tv(d)){oa(a),yield*Bo([...d.slice(1)],t,m,r,o,i,s,a,l);return}yield Pv(d,m,r,o,i,l)}function Pv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:I(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function oa(e){if(e.iterations>=P.wrapperPeelIterations.cap)throw new F("wrapperPeelIterations");e.iterations++}function Tv(e){return I(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ia(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function $e(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||sa(r,"recursive")){t=!0;continue}if(r==="-f"||sa(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Ud(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>sa(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function sa(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var Iv="find -delete permanently removes files. Use -print first to preview.",kv="find -exec rm -rf is dangerous. Use explicit file list instead.",Ov=new Set(["-exec","-execdir","-ok","-okdir"]),Mv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Hd(e,t){let n=e.map(_),r=Dv(e,n,t);if(r)return r;if(Uo(n,1)&&!Lv(e,n,t)){let s=T(S("find.delete",Iv),t.policy);if(s)return s}let o=t.budget??Ce(),i=0;while(i<n.length){let s=n[i],a=St(s??"");if(a>0){i+=a+1;continue}if(!nt(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=ur(n,i);i=l.nextIndex;let c=Fv(l.tokens,t.environment);if(c){let f=T(c,t.policy);if(f)return f}let d=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,d?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:d?void 0:t.cwd,envAssignments:t.envAssignments}):null,u=m?.id.startsWith("custom.")?m:T(m,t.policy);if(u)return u}return null}function Dv(e,t,n){if(!Uo(t,1)&&!aa(t,n.environment))return null;let o=$o(e)??q(["."]),i=Bt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=ar(s);for(let l of a.expandedTargets??[_(s)]){let c=Ge(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return S("find.delete-git-metadata",Te)}}if(Nv(t)&&i.resolvedCwd&&fd(o.map(_),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return S("find.delete-git-metadata",Te);return null}function aa(e,t){let n=0;while(n<e.length){if(!nt(e[n])){n++;continue}let r=ur(e,n),o=gt([...r.tokens],t),i=I(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function Nv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function Lv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=$o(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Ks(o,n.environment),s=n.trustedTmpdirValue??zt(o,n.environment),a=n.allowTmpdirVar??!sr(o,n.environment),l=Bt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??yt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let d=ar(c);if(d.unsafeBraceExpansion)return!1;return(d.expandedTargets??[_(c)]).every((m)=>xd(m,l,{containmentTarget:Wv(m,i),targetIsLiteral:d.expandedTargets!==void 0||d.targetIsLiteral,tmpdirWordSplittingProtected:d.tmpdirWordSplittingProtected}))})}function Wv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function $o(e){let t=(o)=>{let i=e[o];return i?_(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function Fv(e,t){let n=pt([...e],t);if(n.length===0)return null;let r=I(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=I(n[0]??"");if(r==="rm"&&$e(n))return S("find.exec-rm-recursive-force",kv);return null}function ur(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Uo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(nt(r)){n=ur(e,n).nextIndex;continue}let o=St(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function St(e){return Mv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function nt(e){return e!==void 0&&Ov.has(e)}function dr(e){let t=De(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Gv=5,la="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function de(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Vd(e,t,n){let r=qd(e,t,n),o=zv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Gv;a++){let{subcommand:l,rest:c}=Ue(i),d=l?.toLowerCase();if(!d||!o.has(d))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(d),u=jv(m);if(u===null||u.length===0)return{blockedReason:la,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:la,expanded:!0,tokens:i}}function Kd(e,t,n){return qd(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Ue(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?I(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=le.has(o)?2:1}return{subcommand:null,rest:[]}}function zv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function qd(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?I(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=$v(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Bv(e,t,n)]}}function Bv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=ca(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=ca(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=jd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=jd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(le.has(i)){o+=2;continue}o++}return r}function $v(e,t){let n=Uv(e,t),r=Hv(e,t);return{blockedReason:n===null||r===null?la:null,entries:[...n??[],...r??[]]}}function Uv(e,t){let n=Ae("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=dr(n);if(!o)return null;for(let i of o){let s=ca(i);if(!s)return null;r.push(s)}return r}function Hv(e,t){let n=Ro(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Ae(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Ae(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function ca(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function jd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Ae(e.slice(r+1),t,n)}}function jv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return dr(t)}var Vv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",Kv="git checkout --force discards uncommitted changes. Use 'git stash' first.",qv="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Yv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Zv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",Xv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Jv="git switch --force discards uncommitted changes. Use 'git stash' first.",Qv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",eE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",tE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",nE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",rE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",oE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",iE="git push --force destroys remote history. Use --force-with-lease for safer force push.",sE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",aE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",lE="git branch -D force-deletes without merge check. Use -d for safe delete.",cE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",uE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",dE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",mE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",fE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",pE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",gE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",hE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),yE=new Set(["--recurse-submodules","--track","-t"]),ua=new Set(["-b","-B","-U"]),da=new Set(["-c","-C"]),SE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var En=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Zd(e){let{subcommand:t,rest:n}=Ue(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return Ct(CE(n));case"switch":return Ct(bE(n));case"restore":return Ct(EE(n));case"reset":return xE(n);case"clean":return Ct(wE(n));case"rm":return Ct(AE(n));case"push":return Ut(PE(n));case"branch":return Ut(kE(n));case"stash":return Ut(LE(n));case"worktree":return Ut(WE(n));case"rebase":return Ct(OE(n));case"merge":return Ct(ME(n));case"tag":return Ut(DE(n));case"reflog":return Ut(NE(n));default:return null}}function Ct(e){return e?{...e,localDiscard:!0}:null}function Ut(e){return e?{...e,localDiscard:!1}:null}function CE(e){let{index:t,before:n}=de(e),r=fe(n,{shortOptsWithValue:ua});if(n.some((i)=>M(i,"--force"))||r.has("-f"))return S("git.checkout-force",Kv);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(M(i,"--pathspec-from-file"))return S("git.checkout-pathspec-from-file",Yv)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return S("git.checkout-ref-path",qv);return S("git.checkout-double-dash",Vv)}if(vE(e).length>=2)return S("git.checkout-ambiguous",Zv);return null}function bE(e){let{before:t}=de(e);if(t.some((r)=>M(r,"--discard-changes")))return S("git.switch-discard-changes",Xv);let n=fe(t,{shortOptsWithValue:da});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return S("git.switch-force",Jv);return null}function vE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(hE.has(r)){n+=2;continue}if(yE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function EE(e){let t=RE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?S("git.restore-worktree",eE):S("git.restore-unstaged",Qv)}function RE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(SE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function xE(e){let t=null;for(let n of e){if(M(n,"--hard")){t=S("git.reset-hard",tE);break}if(M(n,"--merge")){t=S("git.reset-merge",nE);break}}if(!t)return null;return _E(e)?Ut(t):Ct(t)}function _E(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function wE(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=fe(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return S("git.clean-force",rE);return null}function AE(e){let t=!1,n=!1,r=!1;for(let o of de(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=fe([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?S("git.rm-force",oE):null}function PE(e){let{before:t,after:n}=de(e),r=fe(t);if(t.some((s)=>M(s,"--mirror")))return S("git.push-mirror",aE);if(t.some((s)=>M(s,"--force"))||r.has("-f")||Yd(t,n).some(TE))return S("git.push-force",iE);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||Yd(t,n).some(IE))return S("git.push-delete",sE);return null}function Yd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function TE(e){return e.startsWith("+")||e.includes(":+")}function IE(e){return e.length>1&&e.startsWith(":")}function kE(e){let{before:t}=de(e),n=fe(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return S("git.branch-force-delete",lE);return null}function OE(e){let{before:t}=de(e);return t.some((n)=>M(n,"--abort"))?S("git.rebase-abort",cE):null}function ME(e){let{before:t}=de(e);return t.some((n)=>M(n,"--abort"))?S("git.merge-abort",uE):null}function DE(e){let{before:t}=de(e);return fe(t).has("-d")||t.some((r)=>M(r,"--delete"))?S("git.tag-delete",dE):null}function NE(e){return e[0]==="delete"?S("git.reflog-delete",mE):null}function LE(e){for(let t of e){if(t==="drop")return S("git.stash-drop",fE);if(t==="clear")return S("git.stash-clear",pE)}return null}function WE(e){let{before:t}=de(e);if(!t.includes("remove"))return null;let r=fe(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return S("git.worktree-remove-force",gE);return null}import{resolve as FE}from"path";function Jd(e,t){return Fs.some((n)=>t?.has(n)||e.has(n))}function Qd(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(FE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=Xd(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=Xd(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=le.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function Xd(e,t,n){try{let r=ft(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function nm(e,t,n){if(!t.localDiscard||!n.worktreeMode||Jd(n.environment.env,n.envAssignments))return null;let r=Qd(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(GE(e,n,o))return null;return{originalReason:t.reason,gitCwd:r.gitCwd}}function GE(e,t,n){let{subcommand:r,rest:o}=Ue(e),i=r?.toLowerCase();if(t.dynamicArguments||zE(o)||jE(e,t.environment.env,t.envAssignments,n)||UE(o)||BE(i,o))return!0;return i==="clean"&&HE(o)>1}function zE(e){return e.some((t)=>/[$*?[]/.test(t))}function BE(e,t){if(e==="checkout"){let{before:n}=de(t),r=fe(n,{shortOptsWithValue:ua}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=de(t),r=fe(n,{shortOptsWithValue:da}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||$E(s))||r.has("-C");return o&&i}return!1}function $E(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function UE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function HE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function jE(e,t,n,r){let o=VE(e,t,n);if(o!==null)return o;let i=KE(t,n);if(i!==null)return i;if($u(n))return!0;return r.recursiveSubmodules}function VE(e,t,n){let r=null,o=1;while(o<e.length){let i=e[o];if(!i||i==="--")return r;if(!i.startsWith("-"))return r;if(i==="-c"){let s=em(e[o+1]);if(s!==null)r=s;o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=em(i.slice(2));if(s!==null)r=s;o++;continue}if(i==="--config-env"){let s=tm(e[o+1],t,n);if(s!==null)r=s;o+=2;continue}if(i.startsWith("--config-env=")){let s=tm(i.slice(13),t,n);if(s!==null)r=s;o++;continue}o+=le.has(i)?2:1}return r}function KE(e,t){if(Ae("GIT_CONFIG_PARAMETERS",e,t)!==void 0)return!0;let n=Ro(e,t);if(n.state==="absent")return null;if(n.state==="invalid")return!0;let r=null;for(let o=0;o<n.count;o++){let i=Ae(`GIT_CONFIG_KEY_${o}`,e,t),s=Ae(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i?.trim()||s===void 0)return!0;let a=i.trim().toLowerCase();if(fa(a))return!0;if(a!=="submodule.recurse")continue;r=ma(s)}return r}function em(e){if(!e)return null;let t=e.indexOf("="),n=(t===-1?e:e.slice(0,t)).toLowerCase();if(fa(n))return!0;if(n!=="submodule.recurse")return null;let r=t===-1?"true":e.slice(t+1).toLowerCase();return ma(r)}function tm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;let o=e.slice(0,r).toLowerCase();if(fa(o))return!0;if(o!=="submodule.recurse")return null;let i=Ae(e.slice(r+1),t,n);return i===void 0||ma(i)}function ma(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function fa(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}var qE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",YE=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Ho(e,t){return rm(e.map(_),t)}function rm(e,t,n){let r=Vd(e,t.environment.env,t.envAssignments),o=r.blockedReason?T(S("git.alias-config",r.blockedReason),t.policy):null;if(o)return o;let i=r.tokens;if((Bu(t.envAssignments)||Kd(e,t.environment.env,t.envAssignments))&&ZE(i))return S("git.ssh-env",qE);let s=Zd(i);if(!s)return null;if(r.expanded||r.blockedReason)return s;let a=nm(e,s,t);if(!a)return s;return n?.(a),null}function om(e,t){let n=null;return{match:rm(e.map(_),t,(o)=>{n=o}),relaxation:n}}function ZE(e){let{subcommand:t,rest:n}=Ue(e),r=t?.toLowerCase();if(!r)return!1;if(YE.has(r))return!0;if(r==="archive")return de(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&XE(n)}function XE(e){return e.find((t)=>!JE(t))?.toLowerCase()==="update"}function JE(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as DR}from"path";function Re(e,t){e.charge("parallelChildAnalyses",t.childAnalyses??0),e.charge("parallelDerivedTokens",t.derivedTokens??0),e.charge("parallelDerivedBytes",t.derivedBytes??0),e.charge("parallelPlaceholderReplacements",t.placeholderReplacements??0)}var im="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",QE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",eR="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",am="rm -rf targeting root or home directory is extremely dangerous and always blocked.",tR="rm -rf in home directory is dangerous. Change to a project directory first.";function jo(e,t){let n=Bt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(_),o=$e(r),i=Ud(r),s=rR(e);for(let a of s){let l=ar(a.word);if(o&&l.unsafeBraceExpansion){let c=T(sm({kind:"outside_anchored_cwd"},n,t.policy),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let d=be(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Gt(d,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return S("rm.git-metadata",Te);if(i&&!o){let u=Ge(d,n,m);if(u.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home",am);if(u.kind==="git_metadata_target")return S("rm.git-metadata",Te);continue}if(!o)continue;for(let u of nR(d,n,m)){let f=sm(u,n,t.policy),p=T(f,t.policy);if(p)return p}}}return null}function nR(e,t,n){let r=Ge(e,t,n);if(r.kind==="cwd_self_target")return[r,Ge(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Ge(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Ge(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function rR(e){let t=[],n=!1;for(let r of e.slice(1)){let o=_(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}function sm(e,t,n){switch(e.kind){case"root_or_home_target":return S("rm.recursive-force-root-or-home",am);case"git_metadata_target":return S("rm.git-metadata",Te);case"temp_target":return null;case"dynamic_target":if(!Q(n,"rm.recursive-force-dynamic-target",t.strict))return null;return S("rm.recursive-force-dynamic-target",eR);case"home_cwd_target":return S("rm.recursive-force-home-cwd",tR);case"cwd_self_target":return S("rm.recursive-force-cwd-self",im);case"within_anchored_cwd":if(Q(n,"rm.recursive-force-paranoid",t.paranoid))return S("rm.recursive-force-paranoid",QE);return null;case"outside_anchored_cwd":return S("rm.recursive-force-outside-cwd",im)}}var oR={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},cm=new Set(["--init-file","--rcfile"]),iR=["--init-file","--rcfile"],sR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function rt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return lm(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=lm(e,t,!1);if(r!==null)return r}}return null}function ot(e){let t=I(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Ke(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function lm(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function um(e){let t=I(e[0]??"").toLowerCase(),n=aR(e,t),r=sR.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function aR(e,t){let n=Ke(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?iR.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&cm.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=dm(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}function dm(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let d=t[c];if(d===void 0)break;if(e==="ksh"&&d==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&d==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&d==="o"&&c+1<t.length)break;if(r==="startup"&&d==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&d==="c")s=!0;if(r==="argv"&&d==="n")l=t[0]==="-";if(r==="argv"&&d==="s")a=t[0]==="-";if(!oR[e]?.includes(d))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Ke(e){let t=I(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&cm.has(l)&&!s.includes("="))i++;continue}let a=dm(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}var bt={kind:"none"},Ht={kind:"dynamic"},lR=new Set(["<","<<","<<-","<<<","<&","<>"]),fm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,cR=/^(?:[0-9]+|[@*])$/,uR=Nt.maxWords,dR=Nt.maxInputLength;function pm(e){if(!e||I(L(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function fr(e){let t=Io(e[1])==="--"?2:1;if(e.length<=t)return Yt;let n=e.slice(t);if(!n.every(Ks))return Rn;return{kind:"literal",source:n.map(z).join(" ")}}function m_(e){let t=Io(e[1])==="--"?2:1,n=e[t],r=Io(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Yt;if(!Ks(n))return Rn;return{kind:"literal",source:r}}function qs(e,t){let n=YO(e);if(n===-1)return Yt;let r=JO(t);if(!r)return Yt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=QO(s,e,n,r.ifs);if(!a)return Rn;if(i+=a.reduce((c,l)=>c+l.length+3,0),o.length+a.length>HO||i>qO)return Rn;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(tz)].filter((s)=>s!==null).join(" ")}}function f_(e,t,n,r){if(!bt(e.map(z)).readsStdinAsCommands)return Yt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&BO.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Yt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Rn;return{kind:"literal",source:o.target.text}}if(!n)return Yt;return r===void 0?Rn:{kind:"literal",source:r}}function vt(e){let t=bt(e.map(z)).scriptIndex;if(t===null)return Yt;let n=e[t],r=Io(n);return Ui(n,r)?{kind:"literal",source:r}:Rn}var KO=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Ju(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((c)=>c.provenance!=="literal"||c.parts.some((l)=>l.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||He(s)!==null)return!1;let a=W(V(s));return!KO.has(a)&&!de.has(a)&&!En(a)}function YO(e){return bt(e.map(z)).commandIndex??-1}function JO(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(XO);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function XO(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function QO(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?qu(o):ez(o,r);if(e.parameter==="*"){let a=qu(o);if(!a)return;let c=a.join(r[0]??"");return e.quoted?[c]:Ku(c,r)}let i=t[n+1+e.parameter];if(i&&!Ks(i))return;let s=Io(i);return e.quoted?[s]:Ku(s,r)}function qu(e){return e.every(Ks)?e.map(z):void 0}function ez(e,t){let n=qu(e);if(!n)return;let r=n.map((o)=>Ku(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Ku(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Vo(e){let t=mr(e[1])==="--"?2:1;if(e.length<=t)return bt;let n=e.slice(t);if(!n.every(qo))return Ht;return{kind:"literal",source:n.map(_).join(" ")}}function gm(e){let t=mr(e[1])==="--"?2:1,n=e[t],r=mr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return bt;if(!qo(n))return Ht;return{kind:"literal",source:r}}function Ko(e,t){let n=fR(e);if(n===-1)return bt;let r=pR(t);if(!r)return bt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=hR(s,e,n,r.ifs);if(!a)return Ht;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>uR||i>dR)return Ht;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(SR)].filter((s)=>s!==null).join(" ")}}function hm(e,t,n,r){if(!Ke(e.map(_)).readsStdinAsCommands)return bt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&lR.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return bt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Ht;return{kind:"literal",source:o.target.text}}if(!n)return bt;return r===void 0?Ht:{kind:"literal",source:r}}function it(e){let t=Ke(e.map(_)).scriptIndex;if(t===null)return bt;let n=e[t],r=mr(n);return go(n,r)?{kind:"literal",source:r}:Ht}var mR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function ya(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=I(L(s));return!mR.has(a)&&!J.has(a)&&!$t(a)}function fR(e){return Ke(e.map(_)).commandIndex??-1}function pR(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(gR);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function gR(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function hR(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?pa(o):yR(o,r);if(e.parameter==="*"){let a=pa(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:ga(l,r)}let i=t[n+1+e.parameter];if(i&&!qo(i))return;let s=mr(i);return e.quoted?[s]:ga(s,r)}function pa(e){return e.every(qo)?e.map(_):void 0}function yR(e,t){let n=pa(e);if(!n)return;let r=n.map((o)=>ga(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function ga(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Ks(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(z(e)):e.provenance==="literal"}function Io(e){return e?z(e):""}function tz(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Xu(e,t){return Yu(nt(e,"posix"),t)}function pr(e){return Xu(e,new Set(Array.from(e.matchAll(u_)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Yu(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Yu(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Yu(o,n))||p_(r.words,n))return!0;sz(r,n)}return!1}function p_(e,t){let n=e.findIndex((s)=>He(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Oo(r,t))return!0;let o=V(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return l_(e[s],t)}if(de.has(o)){let s=e.slice(n),a=bt(s.map((l)=>l.text)),c=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&c!==null&&l_(s[c],t)}let i=nz(e,n,t);if(i===null)return!1;if(i===-1)return!0;return p_(e.slice(i),t)}function nz(e,t,n){let r=V(e[t]?.text??"");if(r==="command")return rz(e,t+1);if(r==="exec")return oz(e,t+1);if(r==="env")return iz(e,t+1,n);return null}function rz(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function oz(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function iz(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Oo(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Oo(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(He(i))continue;return r}return null}function sz(e,t){if(!e.words.every((n)=>He(n.text)!==null))return;for(let n of e.words){let r=He(n.text);if(!r)continue;if(Oo(n,t))t.add(r.name)}}function Oo(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(u_)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(VO.test(o)||t.has(o))}))}function l_(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Oo(e,t))}var az=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),cz=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),lz=new Set(["-o","--output","--query","--subscription"]),uz=new Set;function g_(e){if(e==="aws")return az;if(e==="gcloud")return cz;if(e==="az")return lz;return uz}var dz=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),mz=new Set;function h_(e){if(e==="git")return Re;if(e==="docker")return dz;return mz}function ye(e,t){if(e.length===0||t.length===0)return null;let n=V(e[0]??""),r=Ae(e);for(let o of t){if(!gz(n,o.command))continue;if(o.match){if(fz(n,e,o.match))return y_(o);continue}if(!hz(n,e,o.subcommand))continue;if(bz(e,new Set(o.block_args),r))return y_(o)}return null}function y_(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function fz(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return pz(r,n.command_path,g_(e))}function pz(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function gz(e,t){return e===V(t)}function hz(e,t,n){if(!n)return!0;return b_(t,1,n,h_(e))}function b_(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&yz(e,i,n,r))return!0;continue}return s===n}return!1}function yz(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return b_(e,t+2,n,r)}function bz(e,t,n){for(let r of e)if(t.has(r))return!0;for(let r of n)if(t.has(r))return!0;return!1}function Jt(e,t,n={}){if(e.length===0)return null;let r=e[0];if(!r)return null;let o=V(r);if(o==="eval"){let i=fr(Z(e));if(i.kind==="dynamic")return gr(n,t);if(i.kind==="literal"&&t.analyzeNested){let s=t.analyzeNested(i.source,{effectiveCwd:t.cwd,envAssignments:t.envAssignments});if(s)return s}return _t(n,t)}if(de.has(o)){if(Ke(e))return null;let i=yt(e);if(i){if(n.dynamicSourceInput??n.dynamicInput){let c=gr(n,t);if(c)return c}if(pr(i)){let c=gr(n,t);if(c)return c}if(!t.analyzeNested)return null;let a=t.analyzeNested(i,{effectiveCwd:t.cwd,envAssignments:t.envAssignments});if(a)return a;return null}let s=vt(Z(e));if(s.kind==="dynamic")return gr(n,t);if(s.kind==="literal"){if(n.dynamicSourceInput)return gr(n,t);return null}if(n.dynamicSourceInput??n.dynamicInput)return gr(n,t);return null}if(Fe.has(o))return O(Zs(e,(i)=>t.analyzeNested?t.analyzeNested(i,{effectiveCwd:t.cwd,envAssignments:t.envAssignments}):null),t.policy)??ye(e,t.policy?.rules??[])??_t(n,t);if($e(o)){let i=os(e);if(!i)return _t(n,t);if(ue(t.policy,"interpreter.one-liner-paranoid",!!t.paranoidInterpreters)){let a=O(_("interpreter.one-liner-paranoid",nr),t.policy);if(a)return a}if(as(o,i))return _t(n,t);let s=t.analyzeNested?.(i,{effectiveCwd:t.cwd,envAssignments:t.envAssignments});if(s&&s.id!=="raw-text.dangerous-command"&&(s.reason!==jt||ar(i)))return s;if(rr(i,t.scanWork))return O(_("interpreter.dangerous-command",bn),t.policy)??_t(n,t);return _t(n,t)}if(o==="rm"||o==="rmdir"){let i=o==="rm"&&(at(e)||n.dynamicRmInput);return O(mr(Z(e),{environment:t.environment,cwd:t.cwd,originalCwd:t.originalCwd,strict:t.strict,paranoid:t.paranoidRm,allowTmpdirVar:t.allowTmpdirVar,tmpdirWordSplittingUnsafe:ft(t.envAssignments,t.environment),trustedTmpdirValue:$t(t.envAssignments,t.environment),protectedGitMetadata:t.protectedGitMetadata,policy:t.policy}),t.policy)??(i&&n.dynamicRmInput?_t(n,t):null)??(i?vz(n,t):null)}if(o==="find")return Bs(Z(e),{...t,derivedCommandWorkBudget:t.derivedCommandWorkBudget,analyzeTokens:(i,s)=>Jt(i,{...t,cwd:s??void 0,derivedCommandWorkBudget:t.derivedCommandWorkBudget},n)})??ye(e,t.policy?.rules??[])??_t(n,t);if(o==="git")return O(dr(Z(e),{env:t.environment.env,cwd:t.cwd,envAssignments:t.envAssignments,policy:t.policy,worktreeMode:n.dynamicInput?!1:t.worktreeMode}),t.policy)??ye(e,t.policy?.rules??[])??_t(n,t);return ye(e,t.policy?.rules??[])??_t(n,t)}function gr(e,t){return e.shellDynamicMatch?O(e.shellDynamicMatch,t.policy):null}function _t(e,t){return e.dynamicSourceInput&&e.dynamicSourceMatch?O(e.dynamicSourceMatch,t.policy):null}function vz(e,t){return e.dynamicInput&&e.rmDynamicMatch?O(e.rmDynamicMatch,t.policy):null}var Qu="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ed="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",_z="__CC_SAFETY_NET_XARGS_INPUT__",Ys="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Js="rm",Sz=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,xz=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Cz=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Ez=/^(?:[0-9]+|[@*])$/;function S_(e,t){let n=e.map(z),{childStart:r,replacementToken:o}=Pn(n),i=n.slice(r),s=_("xargs.shell-dynamic",ed);if(Rz(i,o,t)&&O(s,t.policy))return O(s,t.policy);for(let a of st(i,t)){let c=a.tokens,l=o!==null&&c[0]!==i[0]&&(c[0]?.includes(o)??!1)?O(s,t.policy):null;if(l)return l;let u=w_(c,o,a.wrapperEnvAssignments),d=a.head==="rm"&&o!==null&&C_(c,o),m=Jt(c,{...t,cwd:a.cwd,envAssignments:a.envAssignments},{dynamicInput:u,dynamicSourceInput:d||x_(c,a.head,o,a.wrapperEnvAssignments,u,t.scanWork,t.environment),dynamicRmInput:d,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:_("xargs.rm-recursive-force-dynamic",Qu)});if(m)return m;let f=wz(c,o,t.policy?.rules??[]);if(f)return f;if(a.head==="git"){let h=o===null?[...c,_z]:c,y=o!==null&&(c.some((E)=>E.includes(o))||Array.from(a.envAssignments.values()).some((E)=>E.includes(o))),v=Jt(h,{...t,cwd:a.cwd,envAssignments:a.envAssignments,worktreeMode:o===null||y?!1:t.worktreeMode});if(v)return v}let p=ye(c,t.policy?.rules??[]);if(p)return p}return null}function wz(e,t,n){if(n.length===0)return null;if(t===null){for(let o of n){let i=ye([...e,...o.subcommand?[o.subcommand]:[],...o.block_args],n);if(i)return i}return null}let r=new Set(n.flatMap((o)=>[o.subcommand,...o.block_args].flatMap((i)=>i?e.flatMap((s)=>td(s,t,i)):[])));for(let o of r){let i=ye(e.map((s)=>s.replaceAll(t,o)),n);if(i)return i}return null}function td(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=e.slice(0,r),i=e.slice(r+t.length);return n.startsWith(o)&&n.endsWith(i)?[n.slice(o.length,n.length-i.length)]:[]}function x_(e,t,n,r,o,i,s){if(de.has(t)){if(Ke(e))return!1;if(n!==null&&Pz(e,n))return!0;let a=yt(e);if(!a){let c=vt(Z(e));if(c.kind==="literal")return n!==null&&c.source.includes(n);return c.kind==="none"&&o}if(n!==null&&a.includes(n))return!0;if(Mt(a,i))return!0;return Az(a,n,r)}if($e(t))return v_(e,n,ss,rb(t));if(Fe.has(t))return v_(e,n,Nu,zv);if(t==="eval"){let a=fr(Z(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return kz(e,n,i,s);if(t==="git"){let a=ct(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&ur.has(a.subcommand.toLowerCase())&&E_(a.rest,n).some((c)=>c.includes(n))}return!1}function v_(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Ys]).sources.some((c)=>c.value===Ys);if(o.sources.some((c)=>c.value.includes(t)))return!0;let i=new Set(o.sources.map((c)=>`${c.tokenIndex}\x00${c.kind}\x00${c.value}`)),s=r.flatMap((c)=>[c.selector,...c.valueForm==="attached-only"||c.valueForm==="attached-or-separate"?[`${c.selector}${Ys}`]:[],...c.valueForm==="equals-or-separate"?[`${c.selector}=${Ys}`]:[]]),a=new Set(s.flatMap((c)=>e.flatMap((l)=>td(l,t,c))));return Array.from(a).some((c)=>n(e.map((l)=>l.replaceAll(t,c))).sources.some((l)=>!i.has(`${l.tokenIndex}\x00${l.kind}\x00${l.value}`)))}function Rz(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(st(e,n),(i)=>i.head)),o=t===null?[...e,Js]:e.map((i,s)=>s===0?i:i.replaceAll(t,Js));return Array.from(st(o,n)).some((i)=>i.head===Js&&!r.has(Js))}function C_(e,t){return E_(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function E_(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function w_(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function Pz(e,t){let n=bt(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return td(i,t,o).some((c)=>{let l=e.map((d,m)=>m===s?d.replaceAll(t,c):d),u=bt(l);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(n.commandIndex===null&&u.commandIndex!==null)return!0;if(n.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(l[u.commandIndex]??"").includes(c))return!0;return u.scriptIndex!==null&&(l[u.scriptIndex]??"").includes(c)})}))}function Az(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Sz))if(__(o,r))return!0;for(let o of e.matchAll(xz))for(let i of(o[1]??"").matchAll(Cz))if(__(i,r))return!0;return Xu(e,r)}function __(e,t){let n=e[1]??e[2];return n!==void 0&&(Ez.test(n)||t.has(n))}function kz(e,t,n,r){if(t===null)return!0;let o=!1,i=0;for(let s=1;s<e.length;s++){let a=e[s]??"";if(!o&&!a.startsWith("-")&&a!=="!"&&a!=="("){if(a.indexOf(t)===0)return!0;continue}if(o=!0,i>0){i--;continue}if(Wt(a)){let l=Ao(e,s);s=l.nextIndex-1;for(let u of st(l.tokens,{environment:r,cwd:void 0})){let d=w_(u.tokens,t,u.wrapperEnvAssignments);if(u.head==="rm"&&C_(u.tokens,t)||x_(u.tokens,u.head,t,u.wrapperEnvAssignments,d,n,r))return!0}continue}let c=qt(a);if(c>0){if(i=c,a.includes(t))return!0;continue}if(a.includes(t))return!0}return!1}function Pn(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(o.startsWith("-")){if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}if(t.has(o))r+=2;else r++}else return{childStart:r,replacementToken:n}}return{childStart:e.length,replacementToken:n}}var No="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Do="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Iz="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",Oz="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",zz=/\{[^{}\s]*\}/,z_=/\{\}|\{-?\d+\}/g,Nz=["e","f","source","file","-e","-f","--source","--file"],Dz=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Mz=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),$z=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),R_=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Lz=new Set(["--workdir","--wd"]),P_="__CC_SAFETY_NET_PARALLEL_SOURCE__",Wz=new TextEncoder,rd=H.maxDerivedBytes+4*H.maxPlaceholderReplacements;function Te(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function N_(e,t){return Te([...e],(n)=>Mt(n,t.scanWork))}function D_(e,t){let n=e.map(z);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=kn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=j_(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:c,unsupported:l,workdir:u,dryRun:d}=o;if(l){let p=kn(t);if(p)return p;let h=N_(t.envAssignments?.values()??[],t);if(h)return h}if(c){let p=Hz(t);if(p)return p}if(u!==void 0&&a){let p=kn(t);if(p)return p}let m=Jz(u,t.cwd,t.environment.paths);if(m===null){let p=kn(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:m===null||m===void 0||m===t.cwd?t:{...t,cwd:m};if(d){if([...st(i,f)].flatMap((h)=>[...h.envAssignments.values()]).some(ad)){let h=kn(t);if(h)return h}return null}if(i.length===0){if(s.some((y)=>y.length!==1)){let y=kn(t);if(y)return y}let p=s.map((y)=>y[0]??"");Le(t.budget,od(p));let h=F_(f.envAssignments,f.cwd,a);return Te(p,(y)=>t.analyzeNested(y,h))}return Te(st(i,f),(p)=>Fz(p,o,t,f))}function Fz(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,c=e.tokens,l={...r,cwd:e.cwd,envAssignments:e.envAssignments},u=[...e.envAssignments.values()];if(u.some(Z_)){let v=kn(n);if(v)return v}let d=N_(u,n);if(d)return d;let m=u.some(te),f=i||m,p=a&&f,h=F_(e.envAssignments,e.wrapperCwd,s||p);if(de.has(e.head)){let v=()=>{if(!i||o.length===0)return null;return Le(n.budget,Xs(c,o,"generic")),Te(o,(C)=>Jt(c.map((P)=>Xt(P,C)),l))};if(Ke(c))return v();let E=yt(c);if(E){if(U_(E)){let k=An(n);if(k)return k;if(o.length===0)return null;return Le(n.budget,O_(E,o)),Te(o,(U)=>n.analyzeNested(Xt(E,U),h))}if(te(E)){if(o.length>0)return Le(n.budget,O_(E,o)),Te(o,(oe)=>n.analyzeNested(Xt(E,oe),h));Le(n.budget,T_(E));let k=ko(E);if(k?.[0]&&V(k[0])==="rm"&&at(k)){let oe=k_(n);if(oe)return oe}let U=k?Jt(k,l,{dynamicInput:a,shellDynamicMatch:_("parallel.shell-dynamic",Do),rmDynamicMatch:_("parallel.rm-recursive-force-dynamic",No)}):null;if(U)return U;return n.analyzeNested(E,h)}let C=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((k)=>qs(Z(k===void 0?c:i?c.map((U)=>Xt(U,k)):[...c,...k]),E)):[];if(C.some((k)=>k.kind==="dynamic")){let k=An(n);if(k)return k}let P=C.flatMap((k)=>k.kind==="literal"?[k.source]:[]);if(P.length>0)return Le(n.budget,od(P)),Te(P,(k)=>n.analyzeNested(k,h));if(Le(n.budget,T_(E)),pr(E)){let k=An(n);if(k)return k}let L=n.analyzeNested(E,h);if(L)return L;if(f)return An(n);return null}let A=vt(Z(c));if(A.kind==="dynamic"||A.kind==="literal"&&te(A.source))return An(n)??v();if(A.kind==="literal")return v();if(o.length>0){let C=An(n);if(C)return C;let P=v();if(P)return P;if(i)return null;let L=o.flatMap((k)=>k[0]===void 0?[]:[k[0]]);return Le(n.budget,od(L)),Te(L,(k)=>n.analyzeNested(k,h))}if(f||a)return An(n)??v();return null}if(e.head==="rm"&&at(c)){if(i&&o.length>0)return Le(n.budget,Xs(c,o,"rm")),Te(o,(E)=>nd(c.map((A)=>id(A,E)),e.cwd,r));if(o.length>0)return Le(n.budget,I_(c,o)),Te(o,(E)=>nd([...c,...E],e.cwd,r));let v=nd(c.flatMap((E,A)=>{if(A===0||!te(E))return[E];return E.startsWith("-")?[id(E,[""])]:[]}),e.cwd,r);if(v)return v;return k_(n)}Le(n.budget,i&&o.length>0?Xs(c,o,"generic"):o.length>0?I_(c,o):W_(c));let y=o.length>0?o:[void 0];return Te(y,(v)=>{let E=v===void 0?c:i?c.map((ie)=>Xt(ie,v)):[...c,...v],A=_("parallel.shell-dynamic",Do),C=a&&e.head==="find"?Vz(E,r):null,P=$_(E,a,n.policy?.rules??[],n.budget)??C?.customResult??null,L=V(e.head),k=a&&(L==="rm"&&sd(E)||L==="xargs"&&L_(E)||C?.rmOptions===!0),U=a&&(k||C?.executedSource===!0||C===null&&M_(E,L)),oe=Jt(E,{...l,worktreeMode:s||a||f?!1:n.worktreeMode},{dynamicInput:a||f,dynamicRmInput:k,dynamicSourceInput:P!==null||U,shellDynamicMatch:A,dynamicSourceMatch:A,rmDynamicMatch:_("parallel.rm-recursive-force-dynamic",No)});if(U){let ie=O(A,n.policy);if(ie)return ie}return oe??P??ye(E,n.policy?.rules??[])})}function M_(e,t){if(te(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(de.has(t))return Uz(e);if(t==="git")return Gz(e);if(t==="find")return!0;if(Fe.has(t))return A_(e,Nz,Po);if($e(t))return A_(e,Dz,is);return!1}function sd(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(te))return t===-1;return n.some((o)=>te(o)&&(o.startsWith("-")||U_(o)))}function Gz(e){if(Zz(e))return!0;let t=ct(e);if(t.subcommand===null||te(t.subcommand))return!0;if(!ur.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(te))return n===-1;return r.some(te)}function Zz(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(te(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(te(n))return!0;continue}if(te(n))return!0}return!1}function Uz(e){if(Ke(e))return!1;let t=yt(e);if(t!==null)return te(t);let n=vt(Z(e));if(n.kind==="literal")return te(n.source);if(n.kind==="dynamic")return!0;return!e.some(te)}function A_(e,t,n){let r=n(e);if(r.some((i)=>te(i.value)))return!0;if(!e.some(te))return n([...e,P_]).some((i)=>i.value===P_);let o=new Set(r.map((i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`));return t.some((i)=>n(e.map((s)=>Xt(s,[i]))).some((s)=>!o.has(`${s.tokenIndex}\x00${s.kind}\x00${s.value}`)))}function $_(e,t,n,r){if(!t||n.length===0)return null;let o=n.filter((s)=>V(s.command)===V(e[0]??""));if(o.length===0)return null;let i=e.some(te);if(Le(r,jz(e,o,i)),!i)return Te(o,(s)=>ye([...e,...s.subcommand?[s.subcommand]:[],...s.block_args],[s]));return Te(o,(s)=>{let a=new Set([s.subcommand,...s.block_args].flatMap((c)=>c?Bz(e,c):[]));return Te(a,(c)=>ye(e.map((l)=>Xt(l,[c])),[s]))})}function jz(e,t,n){let r=n?Tn(Ye(t.map((o)=>o.block_args.length+(o.subcommand?1:0)),H.maxChildAnalyses),2*Math.max(e.length,1),H.maxChildAnalyses):t.length;return{childAnalyses:r,derivedTokens:Tn(r,e.length,H.maxDerivedTokens)}}function Bz(e,t){return e.flatMap((n)=>{let r=[...n.matchAll(/\{[^{}\s]*\}/g)];if(r.length!==1)return[];let o=r[0];if(!o||o.index===void 0)return[];let i=n.slice(0,o.index),s=n.slice(o.index+o[0].length);if(!t.startsWith(i)||!t.endsWith(s))return[t];let a=t.slice(i.length,t.length-s.length);return a!==t?[t,a]:[t]})}function Vz(e,t){let n={customResult:null,executedSource:!e.some(te),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(te))return;for(let a of st(i,t))n.executedSource||=M_(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&sd(a.tokens)||a.head==="xargs"&&L_(a.tokens),n.customResult??=$_(a.tokens,!0,t.policy?.rules??[],t.budget)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=te(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Wt(a)){i=[],n.executedSource||=te(a);continue}let c=qt(a);if(c>0){o=c,n.executedSource||=te(a);continue}n.executedSource||=te(a)}return s(),n}function L_(e){let t=e.slice(Pn(e).childStart);return V(t[0]??"")==="rm"&&sd(t)}function Qs(e,t){return(n)=>O(_(e,t),n.policy)}var An=Qs("parallel.shell-dynamic",Do),Hz=Qs("parallel.command-stream-dynamic",Iz),kn=Qs("parallel.command-stream-dynamic",Oz),k_=Qs("parallel.rm-recursive-force-dynamic",No);function nd(e,t,n){return O(mr(Z(e),{environment:n.environment,cwd:t,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:ft(n.envAssignments??new Map,n.environment),trustedTmpdirValue:$t(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function od(e){return{childAnalyses:e.length,derivedTokens:e.length,derivedBytes:Mo(e)}}function T_(e){return W_([e])}function W_(e){return{childAnalyses:1,derivedTokens:e.length,derivedBytes:Mo(e)}}function I_(e,t){if(t.length>H.maxChildAnalyses)return{childAnalyses:t.length};return{childAnalyses:t.length,derivedTokens:Ye(t.map((n)=>e.length+n.length),H.maxDerivedTokens),derivedBytes:Ye([Tn(Mo(e),t.length,H.maxDerivedBytes),Ye(t.map((n)=>Mo(n)),H.maxDerivedBytes)],H.maxDerivedBytes)}}function O_(e,t){return Xs([e],t,"generic")}function Xs(e,t,n){if(t.length>H.maxChildAnalyses)return{childAnalyses:t.length};let r=Tn(e.length,t.length,H.maxDerivedTokens);if(r>H.maxDerivedTokens)return{childAnalyses:t.length,derivedTokens:r};let o=Yz(e.map((c)=>Kz(c,n))),i=Tn(o.occurrences,t.length,H.maxPlaceholderReplacements);if(i>H.maxPlaceholderReplacements)return{childAnalyses:t.length,derivedTokens:r,placeholderReplacements:i};if(qz(o,t,i))return{childAnalyses:t.length,derivedTokens:r,derivedBytes:H.maxDerivedBytes+1,placeholderReplacements:i};let s=n==="generic"?Xt:id,a=Ye(t.map((c)=>Mo(e.map((l)=>s(l,c)))),H.maxDerivedBytes);return{childAnalyses:t.length,derivedTokens:r,derivedBytes:a,placeholderReplacements:i}}function qz(e,t,n){let r=H.maxDerivedBytes+4*n;return Ye([Tn(e.fixedBytes,t.length,r),Tn(e.occurrences,Ye(t.map((o)=>o.reduce((i,s)=>Math.max(i,zo(s)),0)),r),r)],r)>r}function Kz(e,t){let n=t==="generic"?e.matchAll(/\{[^{}\s]*\}/g):e.matchAll(z_),r=0,o=0,i=0;for(let s of n){if(r>=H.maxPlaceholderReplacements)return{occurrences:H.maxPlaceholderReplacements+1,fixedBytes:0};o=Ye([o,zo(e.slice(i,s.index))],rd),r++,i=s.index+s[0].length}return{occurrences:r,fixedBytes:r===0?zo(e):Ye([o,zo(e.slice(i))],rd)}}function Yz(e){return{occurrences:Ye(e.map((t)=>t.occurrences),H.maxPlaceholderReplacements),fixedBytes:Ye(e.map((t)=>t.fixedBytes),rd)}}function Mo(e,t=H.maxDerivedBytes){return Ye(e.map(zo),t)}function zo(e){return Wz.encode(e).byteLength}function Ye(e,t){let n=0;for(let r of e){if(!Number.isSafeInteger(r)||r<0||r>t-n)return t+1;n+=r}return n}function Tn(e,t,n){if(!Number.isSafeInteger(e)||!Number.isSafeInteger(t)||e<0||t<0||e!==0&&t>Math.floor(n/e))return n+1;return e*t}function F_(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function Xt(e,t){return e.replace(/\{[^{}\s]*\}/g,(n)=>G_(n,t))}function id(e,t){return e.replace(z_,(n)=>G_(n,t))}function G_(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n),o=r>0?r-1:t.length+r;return t[o]??""}function te(e){return zz.test(e)}function Z_(e){if(ad(e))return!0;for(let t of e.matchAll(/\{[^{}\s]*\}/g))if(!/^(?:\{\}|\{-?\d+\})$/.test(t[0]))return!0;return!1}function ad(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function U_(e){return/^\{[^{}\s]*\}$/.test(e)}function j_(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,c,l=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let A=$u(e,t+1);n.push(...A.templateTokens),r=t+1,o=A.markerIndex;break}if(!p.startsWith("-")){let A=$u(e,t);n.push(...A.templateTokens),r=t,o=A.markerIndex;break}let h=e[t+1],y=p.indexOf("="),v=y===-1?p:p.slice(0,y),E=y===-1?void 0:p.slice(y+1);if(p==="--dry-run"){a=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){l||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){l=!0,t+=2;continue}if(v==="--replace"||p.startsWith("-i")&&p.length>2){let A=v==="--replace"?E:p.slice(2);l||=A!==""&&A!=="{}",t++;continue}if(p==="-a"||$z.has(v)){l=!0,t+=E===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(v==="--env"){l=!0,t+=E===void 0?2:1;continue}if(R_.has(v)||p.startsWith("-S")&&p.length>2){i=!0,t+=R_.has(p)?2:1;continue}if(Lz.has(v)){let A=E??h;if(A===void 0||A===":::"||A==="--"){l=!0,t++;continue}c=A,l||=E!==void 0&&A==="",t+=E===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&E!==void 0){t++;continue}if(Mz.has(p)){if(h===void 0||h===":::"||h==="--"){l=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}l||=n.some(a?ad:Z_);let u=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let y=e[h];if(y===":::"){u.push(p),p=[];continue}if(y!==void 0)p.push(y)}u.push(p)}let d=Xz(u),m=n.some(te),f=n.length===0&&o===-1;return{template:n,jobs:d,childStart:r,templateHasPlaceholder:m,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:l,workdir:c,dryRun:a}}function Jz(e,t,n){if(e===void 0)return;if(e==="..."||/[{}$`*?~[]/.test(e))return null;if(!t&&!Tz(e))return null;try{return Ut(t??e,e,n)}catch{return null}}function Xz(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let n of e){if(n.length===1){let o=n[0];if(o===void 0)return[];for(let i of t)i.push(o);continue}let r=[];for(let o of t)for(let i of n)if(r.push([...o,i]),r.length>H.maxChildAnalyses)return r;t=r}return t}function B_(e){return j_(e).childStart}var Qz="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",ea="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function ld(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function cd(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function H_(e,t,n,r,o=!1,i){let a=(go(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&ue(i,"shell.dynamic-executable",o)?_("shell.dynamic-executable",Qz):null;return O(a,i)??q_(e,t,n,o,i)}function q_(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,c)=>ld(a)?[c]:[]);if(i.length===0)return null;let s=V(t[0]?.text??"");if(s==="git"){let a=Jn(e,t),c=tN(a);if(ue(o,"shell.dynamic-structure",r)&&i.some((d)=>d<=c))return O(_("shell.dynamic-structure",ea),o);if(O(dr(a,{env:n.env}),o))return null;let l=t[c]?.text.toLowerCase(),u=a.findIndex((d,m)=>m>c&&z(d)==="--");if(ue(o,"shell.dynamic-structure",r)&&l&&ur.has(l)&&i.some((d)=>d>c&&(u===-1||d<u)))return O(_("shell.dynamic-structure",ea),o);return null}if(s==="find")return ue(o,"shell.dynamic-structure",r)&&nN(t)?O(_("shell.dynamic-structure",ea),o):null;if(s==="rm"){let a=t.findIndex((l,u)=>u>0&&z(l)==="--"),c=at(t.map(z));return ue(o,"shell.dynamic-structure",r)&&i.some((l)=>(a===-1||l<a)&&(l<t.length-1||!c))?O(_("shell.dynamic-structure",ea),o):null}if(s==="xargs")return V_(e,t.slice(Pn(t.map(z)).childStart),"xargs",n,r,o);if(s==="parallel")return V_(e,t.slice(B_(t.map(z))),"parallel",n,r,o);return null}function V_(e,t,n,r,o,i){if(t.length===0)return null;let s=eN(t,r);if(go(e,s)){let c=O(_(`${n}.shell-dynamic`,n==="xargs"?ed:Do),i);if(c)return c}let a=q_(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((c)=>ld(c)&&cd(c)))return O(_(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Qu:No),i);return null}function eN(e,t){let n=vn(e,t),r=n.rewritten?Z(n.words.map(z)):n.words,o=r[0];return o&&z(o)==="busybox"?r.slice(1):r}function tN(e){let t=1;while(t<e.length){let n=e[t],r=n?z(n):"";if(Re.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function nN(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=ld(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||cd(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||cd(s)))return!0;continue}if(t=!0,a)return!0;let c=qt(s.text);if(c>0){n=c;continue}if(Wt(s.text))o=!0,r=!0}return!1}function ud(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!Ui(t[n.tokenIndex],n.value)})}var rN="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",oN="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",iN="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function K_(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return _("dd.device-write",rN);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return _("mkfs.device",oN);if(e==="shred"&&n.length>0)return _("shred.target",iN);return null}var J_=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>mr(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:ft(e.envAssignments,e.options.environment),trustedTmpdirValue:$t(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy})},{heads:new Set(["git"]),analyze:(e)=>dr(e.words,dd(e))},{heads:new Set(["find"]),analyze:(e)=>Bs(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:ft(e.envAssignments,e.options.environment),trustedTmpdirValue:$t(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,derivedCommandWorkBudget:e.options.derivedCommandWorkBudget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>In(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>S_(e.words,{...Y_(e),analyzeNested:(t,n)=>In(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>D_(e.words,{...Y_(e),budget:e.options.parallelBudget,analyzeNested:(t,n)=>In(e.options.analyzeNested(t,n))})}];function Y_(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,derivedCommandWorkBudget:e.options.derivedCommandWorkBudget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy,scanWork:e.options.scanWork}}function In(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function dd(e){return{env:e.options.environment.env,cwd:e.cwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var tS="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function nS(e){return J_.find((t)=>t.heads.has(e))?.analyze}function $o(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(S)=>S.map((w)=>o==="posix"?z(w):w.text),s=n.effectiveCwd===null,a=s?void 0:n.effectiveCwd??n.cwd,c=s?void 0:n.cwd,l=fs(e);if(l.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...l.envAssignments.keys()],output:i(l.words)});let u=vn(l.words,n.environment,a,new Map([...n.envAssignments??[],...l.envAssignments])),d=u.envSplitValues??[];if(d.length>0){let S=[...d,...i(u.words)].join(" "),w=Mt(S,n.scanWork);if(w)return r?.recordSegment({type:"dangerous-text",token:S,matched:!0,reason:w.reason}),St(w);if(n.strict)return Ge(r);let I=ps(d,i(u.words));if(I){Qe(n.derivedCommandWorkBudget,I.length);let G=n.analyzeNested(I.join(" "),{effectiveCwd:u.cwd===void 0?n.effectiveCwd:u.cwd,envAssignments:new Map([...n.envAssignments??[],...l.envAssignments,...u.envAssignments])});if(G)return G}}let m=u.rewritten?Z(i(u.words)):Jn(o,u.words),f=i(m),p={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&l.words.length>m.length){let S=i(l.words);r.recordSegment({type:"leading-tokens-stripped",input:S,removed:S.slice(0,S.length-m.length),output:f})}let h=new Map([...n.envAssignments??[],...l.envAssignments,...u.envAssignments]),y=f[0];if(!y)return null;if(En(y))throw new Me;let v=V(y),E=u.cwd===null?void 0:u.cwd??a,A=u.cwd===null?void 0:c,C=u.cwd===void 0?n.effectiveCwd:u.cwd,P=!uo(h,n.environment),L=H_(o,u.words,n.environment,t===0,n.strict,n.policy);if(L)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:L.reason}),St(L);let k=Us(f,n.policy);if(k){for(let S of[k.childIndex,...k.alternativeChildIndices]){X_(p.wrapperNormalizationBudget);let w=m.slice(S);r?.recordSegment({type:"transparent-wrapper",wrapper:k.wrapper,output:i(w)});let I=$o(w,t,{...p,effectiveCwd:C,envAssignments:h});if(I)return I}return null}let U=v==="eval"?fr(m):v==="trap"?m_(m):void 0;if(U?.kind==="dynamic"&&(n.strict||!n.commandView||!Ju(n.commandView)))return Ge(r);if(U?.kind==="literal"){r?.recordSegment({type:"recurse",reason:v==="eval"?"shell-eval":"shell-trap",innerCommand:U.source,depth:t+1});let S=n.analyzeNested(U.source,{effectiveCwd:C,envAssignments:h,functionDefinitions:n.functionDefinitions});if(S)return S}if(oS(y,v)){if(Ke(f))return null;let S=sN(f,h,C,n,r,t);if(S)return S;let w=yt(f);if(w){let Bn=qs(m,w);if(Bn.kind==="dynamic")return Ge(r);let El=Bn.kind==="literal"?Bn.source:w,Nh=aN(El);r?.recordSegment({type:"shell-wrapper",wrapper:v,innerCommand:Nh}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Nh,depth:t+1});let Dh=n.analyzeNested(El,{effectiveCwd:C,envAssignments:h});if(Dh)return Dh;return pr(El)?Ge(r):null}let I=vt(m);if(I.kind==="dynamic")return Ge(r);if(I.kind==="literal")return ra(I.source,C,h,n,r,t);let G=f_(m,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(G.kind==="dynamic")return Ge(r);if(G.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:G.source,depth:t+1}),n.analyzeNested(G.source,{effectiveCwd:C,envAssignments:h})}if(v==="source"||v==="."){let S=f[1]==="-p"?2:null;if(S!==null){let Bn=n.commandView?m[S]:void 0;if(!Bn)return null;if(Bn.provenance!=="literal")return Ge(r)}let w=S===null?1:3,I=f[w]==="--"?w+1:w,G=n.commandView?m[I]:void 0;if(!G)return null;if(G.provenance==="literal")return ra(G.text,C,h,n,r,t);if(n.strict||!n.commandView||!Ju(n.commandView))return Ge(r)}if(Fe.has(v)){if(n.strict&&ud(Po(f),m))return Ge(r);let S=Zs(f,(I)=>In(n.analyzeNested(I,{effectiveCwd:C,envAssignments:h}))),w=O(S,n.policy);if(w)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:w.reason}),St(w)}if($e(v)){if(n.strict&&ud(is(f),m))return Ge(r);let S=os(f);if(S){let w=ue(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:v,codeArg:S,paranoidBlocked:w}),w){let G=O(_("interpreter.one-liner-paranoid",nr),n.policy);if(G)return St(G)}if(as(v,S))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:S,depth:t+1});let I=n.analyzeNested(S,{effectiveCwd:C,envAssignments:h});if(I&&I.ruleId!=="raw-text.dangerous-command"&&(I.reason!==jt||ar(S)))return I;if(rr(S,n.scanWork)){let G=O(_("interpreter.dangerous-command",bn),n.policy);if(G)return r?.recordSegment({type:"dangerous-text",token:S,matched:!0,reason:bn}),St(G)}r=void 0}}if(v==="busybox"&&f.length>1)return X_(p.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:f[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:f.slice(1).join(" "),depth:t+1}),$o(m.slice(1),t,{...p,effectiveCwd:C,envAssignments:h});let oe=O(K_(v,f),n.policy);if(oe)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:oe.reason}),St(oe);let ie=r===p.trace?p:{...p,trace:r},Y={words:m,head:v,cwd:E,originalCwd:A,envAssignments:h,allowTmpdirVar:P,dynamicArguments:u.words.some((S)=>S.provenance==="command-substitution"),depth:t,effectiveCwd:C,options:ie,analyzeChildTokens:(S,w)=>In($o(Z(S),t+1,{...ie,commandView:void 0,effectiveCwd:w,envAssignments:h}))??ye(S,ie.policy.rules)},j=nS(v);if(v==="rm"||v==="xargs"||v==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:h.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,isOverriddenToNonTemp:!P,allowTmpdirVar:P});let R=r&&v==="git"?t_(Y.words,dd(Y)):void 0,T=Q_(R?R.match:j?.(Y)??null,n.policy);if(r)cN(Y,T,R?.relaxation??null);if(T)return St(T);let B=j!==void 0;if(!B)if(!ns.has(v)){let S=r?[]:void 0;for(let w=1;w<f.length;w++){let I=f[w];if(!I)continue;S?.push(I);let G=Q_(lN(Y,f,w),n.policy);if(G)return r?.recordSegment({type:"fallback-scan",tokensScanned:S??[],embeddedCommandFound:V(I)}),St(G)}r?.recordSegment({type:"fallback-scan",tokensScanned:S??[]})}else r?.recordSegment({type:"fallback-scan",tokensScanned:[]});else r?.recordSegment({type:"fallback-scan",tokensScanned:[]});if(t===0||!B){let S=ye(f,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!S,reason:S?.reason}),S)return St(S)}else r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1});return null}function sN(e,t,n,r,o,i){let s=a_(e);if(s.argvSource?.kind==="absent")return Ge(o);if(s.argvSourceApplies&&s.argvSource){let c=ra(s.argvSource.value,n,t,r,o,i,!0);if(c)return c}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ra(a,n,t,r,o,i,!0)}function ra(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return Ge(o);let a=lo(e,t,r.environment.paths),c=a?r.literalHeredocFiles?.get(a):void 0;if(c===void 0)return s?Ge(o):null;return Qe(r.derivedCommandWorkBudget,1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:c,depth:i+1}),r.analyzeNested(c,{effectiveCwd:t,envAssignments:n})}function aN(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function cN(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function X_(e){if(e.iterations>=er)throw new Me;e.iterations++}function St(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function Ge(e){return e?.recordSegment({type:"error",message:tS}),St(rS())}function rS(){return{id:"",reason:tS,intent:"stop_and_explain"}}function oS(e,t){return de.has(t)||e==="$SHELL"||e==="${SHELL}"||de.has(W(t))}function lN(e,t,n){let r=st(t.slice(n),{environment:e.options.environment,cwd:e.cwd,envAssignments:e.envAssignments,policy:e.options.policy});for(let o of r){let i=uN(e,n,o);if(i)return i}return null}function uN(e,t,n){let r=n.tokens[0];if(!r)return null;let o=V(r);if(oS(r,o)){Qe(e.options.derivedCommandWorkBudget,e.words.length-t);let c=n.tokens;if(Ke(c))return null;let l=yt(c);if(!l){if(vt(Z(c)).kind==="dynamic")return rS();return na(e,n)}let u=e.options.analyzeNested(l,{effectiveCwd:n.wrapperCwd===void 0?e.effectiveCwd:n.wrapperCwd,envAssignments:n.envAssignments});return u?In(u):na(e,n)}let i=nS(o);if(!i||o==="xargs"||o==="parallel"){if(n.wrappedByTransparent&&e.options.policy.rules.length>0)Qe(e.options.derivedCommandWorkBudget,e.words.length-t);return na(e,n)}Qe(e.options.derivedCommandWorkBudget,e.words.length-t);let s=[o,...n.tokens.slice(1)],a={...e,words:Z(s),head:o,cwd:n.cwd,originalCwd:n.wrapperCwd===null?void 0:e.originalCwd,envAssignments:n.envAssignments,allowTmpdirVar:!uo(n.envAssignments,e.options.environment),effectiveCwd:n.wrapperCwd===void 0?e.effectiveCwd:n.wrapperCwd,options:o==="git"?{...e.options,worktreeMode:!1}:e.options};return i(a)??na(e,n)}function na(e,t){return t.wrappedByTransparent?ye(t.tokens,e.options.policy.rules):null}function Q_(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:O(e,t)}var dN=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,mN=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function fN(e,t){let n=aS(e,t);if(n.length===0)return!1;let r=n[sS(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return dN.test(e.join(" "))}function iS(e,t,n,r){if(e.dialect==="powershell"){let a=pN(e.words,r);if(a.kind==="none")return;if(!t||a.kind==="unknown")return null;return eS(bN(a.target),t,n.paths)}let o=e.words.map(z);if(!fN(o,n))return;if(!t)return null;let i=aS(o,n,t),s=sS(i);if(s===-1||i[s]!=="cd")return null;return eS(i[s+1],t,n.paths)}function eS(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return vN(Ut(t,e,n),t,n)?t:null}catch{return null}}function pN(e,t){let n=gN(e[0])?1:0,r=e[n];if(!hN(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!mN.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return yN(e.slice(n+1),t)}function gN(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function hN(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function yN(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function bN(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function sS(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function aS(e,t,n){let r=_N(e);return Bt([...r],t,n)}function vN(e,t,n){let r=n.realpath(e),o=n.realpath(t);if(r===null||o===null)return ta(e)===ta(t);return ta(r)===ta(o)}function _N(e){let t=0;while(t<e.length){let n=e[t];if(n==="{"||n==="("||n==="$(")t++;else break}return e.slice(t)}var fd="TMPDIR",pd="IFS",cS=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,lS=/^[A-Za-z_][A-Za-z0-9_]*$/,uS=new Set(["export","typeset","declare","readonly"]),SN=new Set(["builtin","command","time"]);function dS(e,t){return{env:e,effectiveEnvAssignments:RN(e,t),shellAssignments:new Map}}function mS(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments)}}function gd(e,t){let n=pS(e,t);n.assignments.filter((s)=>s.persists).forEach((s)=>{t.shellAssignments.set(s.name,s.value),hd(t,s)});let r=n.commandIndex;if(r!==-1&&uS.has(e[r]??""))e.filter((s)=>lS.test(s)&&md(s)).forEach((s)=>{PN(t,s)});let o=r===-1?-1:gS(e,r);if(o===-1||e[o]!=="unset")return;let i=kN(e,o);if(i===null)return;e.slice(i).forEach((s)=>{AN(t,s)})}function fS(e,t){let n=pS(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function pS(e,t){let n=e.findIndex((s)=>!xN(s)),r=n!==-1&&uS.has(e[gS(e,n)]??""),o=wN(t);return{assignments:e.flatMap((s,a)=>{let c=CN(s,o,t.env);if(!c)return[];if(n!==-1&&a>n&&!r&&!Ul(c.name))return[];return o.set(c.name,c.value),[{...c,persists:n===-1||r}]}),commandIndex:n}}function gS(e,t){let n=t;while(SN.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function xN(e){return He(e)!==null||cS.test(e)}function CN(e,t,n){return He(e)??EN(e,t,n)}function EN(e,t,n){let r=Vi(e,n,t);if(r)return r;let o=e.match(cS)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function md(e){return e===fd||e===pd||jl(e)}function wN(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function RN(e,t){let n=[...ji,fd,pd].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function hd(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function PN(e,t){hd(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function AN(e,t){if(!md(t)&&!lS.test(t))return;if(e.shellAssignments.set(t,""),!md(t)||t===fd||t===pd||to(t)){hd(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function kN(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var TN="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",On="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.",IN=64;function Sd(e,t,n,r){let o=n.derivedCommandWorkBudget===void 0,i=n.parallelBudget===void 0;try{return ON(e,t,{...n,derivedCommandWorkBudget:n.derivedCommandWorkBudget??es(),parallelBudget:n.parallelBudget??ib()},r)}catch(s){let a=s instanceof Me&&o?Yy:s instanceof us&&i?ob:void 0;if(!a)throw s;if(n.trace?.currentSegmentIndex!==void 0)n.trace.recordSegment({type:"error",message:a});else n.trace?.recordGlobal({type:"error",message:a});return{reason:a,segment:e,intent:"stop_and_explain"}}}function ON(e,t,n,r){if(t>=ts)return n.trace?.recordSegment({type:"error",message:Ot}),{reason:Ot,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??nt(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:Ot}),{reason:Ot,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let l=o.issues.find((u)=>u.code.includes("heredoc"));if(l){if(!n.strict)return _d(e,n);let u=`Unsupported heredoc syntax: ${l.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return SS(e,n),{reason:jt,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return SS(e,n),{reason:jt,segment:e,intent:"stop_and_explain"};if(o.issues.some((l)=>l.code.includes("quote"))&&!n.analyzePartialProgram)return _d(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,c=dS(n.environment.env,n.envAssignments);return sa(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:c,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function sa(e,t,n,r,o){let i=[...o],s,a;for(let[c,l]of e.nodes.entries()){if(l.kind==="connector"){a=l.operator;continue}let u=e.nodes[c+1],d=u?.kind==="connector"?u.operator:void 0,m=zN(e,c,l,a,d),f=a==="&&"||a==="||",p=f?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,y=a==="||"?p?.success??[]:[],v=a==="&&"?p?.failure??[]:[],E=f||hr(d);if(l.kind==="function"){let oe=h.flatMap((Y)=>{let j=Lo(Y);return j.functionDefinitions.set(l.name,l.body),yd(Y,[j],m,d==="&",hr(d))}),ie=bd(oe,[],y,v,a,d);i=ie.states,s=ie.conditionalStates,a=void 0;continue}if(l.kind==="group"){let oe=[],ie=[];for(let j of h){let R=sa(l.body,t,n,r,[Lo(j)]);if(R.result)return R;if(oe.push(...yd(j,R.states,m,d==="&",hr(d))),E)ie.push(j,...m?R.states.map((T)=>oa(j,T)):R.states)}let Y=bd(oe,ie,y,v,a,d);i=Y.states,s=Y.conditionalStates,a=void 0;continue}if(l.kind!=="command")continue;let A=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),C=e.nodes[c-2],P=aa(a)&&C?.kind==="command"?d_(C)??DN(C):void 0,L=[],k=[];for(let oe of h){let ie=MN(l,t,n,r,[Lo(oe)]);if(ie.result)return{result:ie.result,states:i};let Y=e.dialect==="powershell"?ie.states:ie.states.map((j)=>oa(oe,j));for(let j of Y){let R=Lo(j),T=WN(l,t,n.trace?{...n,trace:xS(n.trace,A)}:n,r,R,aa(a),P);if(T)return{result:T,states:i};let B=XN(l,R.functionDefinitions);if(B)Qe(n.derivedCommandWorkBudget,ca(B));let S=B?t+1>=ts?vd(l.displayText,n,[R]):sa(B,t+1,n,r,[R]):{result:null,states:[R]};if(S.result)return S;if(L.push(...yd(oe,S.states,m,d==="&",hr(d))),E)k.push(oe),k.push(...S.states.map((w)=>m?oa(oe,w):w))}}let U=bd(L,k,y,v,a,d);i=U.states,s=U.conditionalStates,a=void 0}return{result:null,states:i}}function zN(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(aa(r)||aa(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&NN(e,t)}function yd(e,t,n,r,o){let i=n?t.map((a)=>oa(e,a)):[...t],s=o?i.flatMap((a)=>Wo(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function oa(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function NN(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if($N(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function aa(e){return e==="|"||e==="|&"}function DN(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function hr(e){return e==="&&"||e==="||"}function bd(e,t,n,r,o,i){let s={success:ia([...n,...e]),failure:ia([...r,...t])},a=hr(i)?s:void 0;return{states:hr(o)||a?ia([...s.success,...s.failure]):s.success,conditionalStates:a}}function xS(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function MN(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=LN(e);if(s){if(t+1>=ts)return vd(s,n,o);let a=nt(s,"powershell");if(a.status==="limited")return vd(s,n,o);if(a.status!=="complete")return hS(i,n,r,o);Qe(n.derivedCommandWorkBudget,ca(a)),i.push({program:a,depth:t+1})}}return hS(i,n,r,o)}function $N(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function hS(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let c=sa(i.program,i.depth,t,n,[Lo(a)]);if(c.result)return c;s.push(...c.states)}o=ia(s)}return{result:null,states:o}}function LN(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function ca(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+ca(o),0):n.kind==="group"||n.kind==="function"?ca(n.body):0),0)}function vd(e,t,n){return t.trace?.recordSegment({type:"error",message:Ot}),{result:{reason:Ot,segment:e,intent:"stop_and_explain"},states:[...n]}}function WN(e,t,n,r,o,i,s){let a=VN(e);if(a&&n.strict)return n.trace?.recordSegment({type:"error",message:a}),{reason:a,segment:e.source,intent:"stop_and_explain"};CS(e,o,"before-consumer",n.environment.paths);let c=Jn(e.dialect,e.words).map(z),l=e.displayText,u=fS(c,o.shellGitContextState);if(e.dialect==="powershell"){let f=O(Iv(e,i,eD(n,o.effectiveCwd)),n.policy);if(n.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!f,reason:f?.reason}),f)return QN(l,f)}if(c.length===1&&c[0]?.includes(" ")&&!go(e.dialect,e.words)){let f=O(Mt(c[0],n.scanWork),n.policy),p=f!==null&&!n.strict&&Hy(e,n.rootProgram,n.scanWork);if(f&&!p)return n.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!0,reason:f.reason}),{reason:f.reason,segment:l,ruleId:f.id,intent:f.intent};n.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!1});let h=yS(e,a,o,u,s,n);if(h)return h;return gd(c,o.shellGitContextState),null}let d=$o(e.words,t,{...n,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:u,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(f,p)=>{let h=p&&Object.hasOwn(p,"effectiveCwd")?p.effectiveCwd:o.effectiveCwd,y=Sd(f,t+1,{...n,derivedCommandWorkBudget:n.derivedCommandWorkBudget,effectiveCwd:h,envAssignments:p?.envAssignments??u,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:p?.functionDefinitions,worktreeMode:p?.worktreeMode??n.worktreeMode,trace:n.trace?xS(n.trace,n.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(d)return{...d,segment:l};let m=yS(e,a,o,u,s,n);if(m)return m;return gd(c,o.shellGitContextState),null}function yS(e,t,n,r,o,i){let s=HN(e,t,n,r??new Map,i);if(s)return s;return CS(e,n,"after-consumer",i.environment.paths),n.literalHeredocFiles.clear(),ZN(e,t,n,i.environment.paths),YN(e,n,o,i.environment,i.trace),null}var FN=new Set([">>","<>"]);function CS(e,t,n,r){for(let i of e.redirections){if(!(n==="before-consumer"?GN(i):FN.has(i.operator)))continue;bS(i.target,t,r)}if(n!=="before-consumer"||!Ze(e.words[0],"tee"))return;let o=ES(e.words.slice(1));if(!o)return;for(let i of o.operands)bS(i,t,r)}function GN(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function bS(e,t,n){let r=e?.provenance==="literal"?lo(e.text,t.effectiveCwd,n):void 0;if(!r)return;t.literalHeredocFiles.delete(r)}function ZN(e,t,n,r){if(t)return;let o=e.redirections.find((i)=>i.operator==="<<"||i.operator==="<<-")?.heredoc;if(!o||!la(o))return;for(let i of UN(e)){let s=lo(i.text,n.effectiveCwd,r);if(!s||!Qy(s))continue;if(!n.literalHeredocFiles.has(s)&&n.literalHeredocFiles.size>=Xy)throw new Me;n.literalHeredocFiles.set(s,o.body)}}function UN(e){let t=BN(e.redirections)?.target,n=vS(t)?[t]:[];if(Ze(e.words[0],"cat"))return jN(e.words)?n:[];if(!Ze(e.words[0],"tee"))return[];let r=ES(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(vS))return[];return[...r.operands,...n]}function jN(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function BN(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function ES(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&Ze(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function vS(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function Ze(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function la(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function VN(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return On;let n=t[0];if(!n?.heredoc)return On;if(!la(n.heredoc))return TN;if(n.fd!==void 0&&n.fd!==0)return On;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return On;let r=e.redirections.some((s)=>s!==n&&_S(s.target));if(Ze(e.words[0],"cat"))return r?On:void 0;if(Ze(e.words[0],"tee"))return r||e.words.slice(1).some(_S)?On:void 0;let o=e.words[0],i=e.words[1];if(Ze(o,"git")&&(Ze(i,"apply")||Ze(i,"commit")))return;if(Ze(o,"gh")&&(Ze(i,"pr")||Ze(i,"issue"))&&Ze(e.words[2],"create"))return;return On}function _S(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function HN(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-"),s=i.flatMap((l)=>l.heredoc?[l.heredoc.body]:[]);if(KN(e,i,n,r,o))return null;let a=qN(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let c=_d(s.length===i.length?s.join(`
-`):e.source,o);return c?{...c,segment:e.displayText}:null}function qN(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!la(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!$e(o.text))return;if(!e.words.slice(1).every((l)=>l.provenance==="literal"&&l.text.startsWith("-")))return;let s=r.heredoc.body,a=ue(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let l=O(_("interpreter.one-liner-paranoid",nr),n.policy);if(l)return l}if(!rr(s,n.scanWork))return null;let c=O(_("interpreter.dangerous-command",bn),n.policy);if(!c)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:c.reason}),c}function KN(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!la(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=vn(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(z),c=V(a[0]??"");if((s.envSplitValues?.length??0)>0||!de.has(c)&&!de.has(W(c)))return!1;return Ke(a)}function YN(e,t,n,r,o){let i=iS(e,t.effectiveCwd,r,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(z).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}function Lo(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:mS(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ia(e){let t=[];for(let n of e){if(!t.some((r)=>JN(r,n)))t.push(n);if(t.length>IN)throw new Me}return t}function JN(e,t){return e.effectiveCwd===t.effectiveCwd&&Wo(e.literalHeredocFiles,t.literalHeredocFiles)&&Wo(e.functionDefinitions,t.functionDefinitions)&&Wo(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Wo(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)}function Wo(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function XN(e,t){let n=As(e);return n===void 0?void 0:t.get(n)}function QN(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function eD(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy}}function _d(e,t){let n=O(Mt(e,t.scanWork),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function SS(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:jt};if(t.trace?.currentSegmentIndex===void 0)t.trace?.recordGlobal(n);else t.trace.recordSegment(n)}var Fo=["fail_closed","paranoid_rm","paranoid_interpreters"],ua={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var me={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},da=["standard","strict","paranoid"];function tD(e,t){if(!t)return e;return da.indexOf(t)>da.indexOf(e)?t:e}function nD(){let e=Rd(me.level);if(e===void 0||e==="")return;if(da.includes(e))return e;console.error(`CC Safety Net: ignored invalid ${me.level.name}=${JSON.stringify(e.slice(0,40))}. Use ${da.join(", ")}.`);return}function rD(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Cd(){return rD(Rd(me.auditScope))==="all"}function Ed(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function wd(e={}){let t=e.safety?.level??"standard",n=nD(),r=tD(t,n),o=ua[r],i={failClosed:o.fail_closed,paranoidRm:o.paranoid_rm,paranoidInterpreters:o.paranoid_interpreters},s={failClosed:r===t?"preset":"environment",paranoidRm:r===t?"preset":"environment",paranoidInterpreters:r===t?"preset":"environment"},a={failClosed:[`policy safety.level=${t}`],paranoidRm:[`policy safety.level=${t}`],paranoidInterpreters:[`policy safety.level=${t}`]};if(r!==t)a.failClosed.push(`env ${me.level.name}=${n}`),a.paranoidRm.push(`env ${me.level.name}=${n}`),a.paranoidInterpreters.push(`env ${me.level.name}=${n}`);if(e.safety?.overrides?.failClosed!==void 0)i.failClosed=e.safety.overrides.failClosed,s.failClosed="capability_override",a.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)i.paranoidRm=e.safety.overrides.paranoidRm,s.paranoidRm="capability_override",a.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)i.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,s.paranoidInterpreters="capability_override",a.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Qt(me.strict))i.failClosed=!0,s.failClosed="environment",a.failClosed.push(`env ${me.strict.name}`);if(Qt(me.paranoid))i.paranoidRm=!0,i.paranoidInterpreters=!0,s.paranoidRm="environment",s.paranoidInterpreters="environment",a.paranoidRm.push(`env ${me.paranoid.name}`),a.paranoidInterpreters.push(`env ${me.paranoid.name}`);if(Qt(me.paranoidRm))i.paranoidRm=!0,s.paranoidRm="environment",a.paranoidRm.push(`env ${me.paranoidRm.name}`);if(Qt(me.paranoidInterpreters))i.paranoidInterpreters=!0,s.paranoidInterpreters="environment",a.paranoidInterpreters.push(`env ${me.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Qt(me.worktree);return{strict:i.failClosed,paranoidRm:i.paranoidRm,paranoidInterpreters:i.paranoidInterpreters,worktreeMode:c,effectiveLevel:Ed(i),capabilities:{fail_closed:{enabled:i.failClosed,source:s.failClosed,sources:a.failClosed},paranoid_rm:{enabled:i.paranoidRm,source:s.paranoidRm,sources:a.paranoidRm},paranoid_interpreters:{enabled:i.paranoidInterpreters,source:s.paranoidInterpreters,sources:a.paranoidInterpreters}}}}function Qt(e){let t=typeof e==="string"?xd(e):Rd(e);return t==="1"||t?.toLowerCase()==="true"}function xd(e){return Object.hasOwn(process.env,e)?process.env[e]:void 0}function Rd(e){let t=xd(e.name);if(t!==void 0)return t;if(e.legacyName)return xd(e.legacyName);return}function wS(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Pd(t.fail_closed,e.strict,"strict"),paranoid_rm:Pd(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Pd(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:By(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Ed({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Pd(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function RS(e,t,n,r){let o=Sd(e,0,{...t,...wS(t),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:[{kind:"command",command:e,segment:o.segment}]}}var oD=new Set(["src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js"]),kd=new Set(["cc-safety-net","ccsn"]),iD=new Set(["bunx","npx","pnpx"]),sD=new Set(["pnpm","yarn"]),aD=new Set(["npm","pnpm","yarn"]),cD=new Set(["bun","node"]);function fa(e,t,n={}){if(kd.has(e))return 0;if(iD.has(e)){if(n.broad)return Ad(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return ma(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&aD.has(e)&&n.broad&&t[r]==="exec"){let o=Ad(t.slice(r+1));return o===null?null:r+1+o}if(sD.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&ma(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ad(t.slice(r+1));return o===null?null:r+1+o}if(cD.has(e)){let o=n.broad&&r!==-1?r:0;if(PS(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&PS(t[o+1]))return o+2}return null}function Ad(e){let t=e.findIndex((r)=>ma(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!ma(r))break;n++}return n}function ma(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return kd.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return kd.has(e.slice(0,t))}function PS(e){let t=e?.replaceAll("\\","/");return[...oD].some((n)=>t===n||t?.endsWith(`/${n}`))}function yr(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}var AS="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function kS(e){let t=Se(e,"input-candidate");if(!t)return null;let n=zt(Xe()),r=cr(t.shell,e.invocation.context.executionCwd,n,{findSegmentTarget:(o)=>uD(o,n.environment),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null,normalizeCwd:he});return r?{target:r}:null}function uD(e,t){let n=Bt([...e],t),r=n.slice(1),o=fa(W(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as vl}from"path";import{chmodSync as jB,existsSync as aM,mkdirSync as BB,readFileSync as cM}from"fs";import{dirname as lM,join as uM}from"path";import{createRequire as q0}from"module";var mh={};un(mh,{$brand:()=>ga,$input:()=>Ha,$output:()=>Va,NEVER:()=>pa,TimePrecision:()=>pc,ZodAny:()=>Rg,ZodArray:()=>Tg,ZodBase64:()=>Jc,ZodBase64URL:()=>Xc,ZodBigInt:()=>Kr,ZodBigIntFormat:()=>tl,ZodBoolean:()=>qr,ZodCIDRv4:()=>Kc,ZodCIDRv6:()=>Yc,ZodCUID:()=>Zc,ZodCUID2:()=>Uc,ZodCatch:()=>Xg,ZodCodec:()=>ll,ZodCustom:()=>Si,ZodCustomStringFormat:()=>Vr,ZodDate:()=>hi,ZodDefault:()=>Vg,ZodDiscriminatedUnion:()=>Og,ZodE164:()=>Qc,ZodEmail:()=>Wc,ZodEmoji:()=>Fc,ZodEnum:()=>jr,ZodError:()=>vx,ZodExactOptional:()=>Ug,ZodFile:()=>Gg,ZodFirstPartyTypeKind:()=>ul,ZodFunction:()=>ah,ZodGUID:()=>di,ZodIPv4:()=>Hc,ZodIPv6:()=>qc,ZodISODate:()=>ai,ZodISODateTime:()=>si,ZodISODuration:()=>li,ZodISOTime:()=>ci,ZodIntersection:()=>zg,ZodIssueCode:()=>NC,ZodJWT:()=>el,ZodKSUID:()=>Vc,ZodLazy:()=>oh,ZodLiteral:()=>Fg,ZodMAC:()=>vg,ZodMap:()=>Lg,ZodNaN:()=>eh,ZodNanoID:()=>Gc,ZodNever:()=>Ag,ZodNonOptional:()=>al,ZodNull:()=>Eg,ZodNullable:()=>Bg,ZodNumber:()=>Hr,ZodNumberFormat:()=>Gn,ZodObject:()=>bi,ZodOptional:()=>sl,ZodPipe:()=>cl,ZodPrefault:()=>qg,ZodPromise:()=>sh,ZodReadonly:()=>th,ZodRealError:()=>we,ZodRecord:()=>_i,ZodSet:()=>Wg,ZodString:()=>Br,ZodStringFormat:()=>K,ZodSuccess:()=>Jg,ZodSymbol:()=>xg,ZodTemplateLiteral:()=>rh,ZodTransform:()=>Zg,ZodTuple:()=>Dg,ZodType:()=>D,ZodULID:()=>jc,ZodURL:()=>gi,ZodUUID:()=>kt,ZodUndefined:()=>Cg,ZodUnion:()=>vi,ZodUnknown:()=>Pg,ZodVoid:()=>kg,ZodXID:()=>Bc,ZodXor:()=>Ig,_ZodString:()=>Lc,_default:()=>Hg,_function:()=>wC,any:()=>rC,array:()=>yi,base64:()=>Fx,base64url:()=>Gx,bigint:()=>Xx,boolean:()=>Sg,catch:()=>Qg,check:()=>RC,cidrv4:()=>Lx,cidrv6:()=>Wx,clone:()=>be,codec:()=>xC,coerce:()=>dl,config:()=>ce,core:()=>At,cuid:()=>Tx,cuid2:()=>Ix,custom:()=>PC,date:()=>iC,decode:()=>kc,decodeAsync:()=>Ic,default:()=>U0,describe:()=>AC,discriminatedUnion:()=>dC,e164:()=>Zx,email:()=>_x,emoji:()=>Ax,encode:()=>Ac,encodeAsync:()=>Tc,endsWith:()=>Or,enum:()=>ol,exactOptional:()=>jg,file:()=>bC,flattenError:()=>_r,float32:()=>qx,float64:()=>Kx,formatError:()=>Sr,fromJSONSchema:()=>dh,function:()=>wC,getErrorMap:()=>MC,globalRegistry:()=>ze,gt:()=>Rt,gte:()=>Ee,guid:()=>Sx,hash:()=>Hx,hex:()=>Vx,hostname:()=>Bx,httpUrl:()=>Px,includes:()=>Tr,instanceof:()=>TC,int:()=>$c,int32:()=>Yx,int64:()=>Qx,intersection:()=>Ng,ipv4:()=>Dx,ipv6:()=>$x,iso:()=>ui,json:()=>OC,jwt:()=>Ux,keyof:()=>sC,ksuid:()=>Nx,lazy:()=>ih,length:()=>Wn,literal:()=>yC,locales:()=>ti,looseObject:()=>lC,looseRecord:()=>fC,lowercase:()=>Ar,lt:()=>wt,lte:()=>je,mac:()=>Mx,map:()=>pC,maxLength:()=>Ln,maxSize:()=>an,meta:()=>kC,mime:()=>zr,minLength:()=>Ft,minSize:()=>Pt,multipleOf:()=>sn,nan:()=>SC,nanoid:()=>kx,nativeEnum:()=>hC,negative:()=>hc,never:()=>nl,nonnegative:()=>bc,nonoptional:()=>Yg,nonpositive:()=>yc,normalize:()=>Nr,null:()=>wg,nullable:()=>fi,nullish:()=>vC,number:()=>_g,object:()=>aC,optional:()=>mi,overwrite:()=>lt,parse:()=>Ec,parseAsync:()=>wc,partialRecord:()=>mC,pipe:()=>pi,positive:()=>gc,prefault:()=>Kg,preprocess:()=>zC,prettifyError:()=>Sa,promise:()=>EC,property:()=>vc,readonly:()=>nh,record:()=>$g,refine:()=>ch,regex:()=>Pr,regexes:()=>Et,registry:()=>ni,safeDecode:()=>zc,safeDecodeAsync:()=>Dc,safeEncode:()=>Oc,safeEncodeAsync:()=>Nc,safeParse:()=>Rc,safeParseAsync:()=>Pc,set:()=>gC,setErrorMap:()=>DC,size:()=>$n,slugify:()=>Lr,startsWith:()=>Ir,strictObject:()=>cC,string:()=>Mc,stringFormat:()=>jx,stringbool:()=>IC,success:()=>_C,superRefine:()=>lh,symbol:()=>tC,templateLiteral:()=>CC,toJSONSchema:()=>ii,toLowerCase:()=>Mr,toUpperCase:()=>$r,transform:()=>il,treeifyError:()=>_a,trim:()=>Dr,tuple:()=>Mg,uint32:()=>Jx,uint64:()=>eC,ulid:()=>Ox,undefined:()=>nC,union:()=>rl,unknown:()=>Fn,uppercase:()=>kr,url:()=>Rx,util:()=>Ce,uuid:()=>xx,uuidv4:()=>Cx,uuidv6:()=>Ex,uuidv7:()=>wx,void:()=>oC,xid:()=>zx,xor:()=>uC,z:()=>ml});var ml={};un(ml,{$brand:()=>ga,$input:()=>Ha,$output:()=>Va,NEVER:()=>pa,TimePrecision:()=>pc,ZodAny:()=>Rg,ZodArray:()=>Tg,ZodBase64:()=>Jc,ZodBase64URL:()=>Xc,ZodBigInt:()=>Kr,ZodBigIntFormat:()=>tl,ZodBoolean:()=>qr,ZodCIDRv4:()=>Kc,ZodCIDRv6:()=>Yc,ZodCUID:()=>Zc,ZodCUID2:()=>Uc,ZodCatch:()=>Xg,ZodCodec:()=>ll,ZodCustom:()=>Si,ZodCustomStringFormat:()=>Vr,ZodDate:()=>hi,ZodDefault:()=>Vg,ZodDiscriminatedUnion:()=>Og,ZodE164:()=>Qc,ZodEmail:()=>Wc,ZodEmoji:()=>Fc,ZodEnum:()=>jr,ZodError:()=>vx,ZodExactOptional:()=>Ug,ZodFile:()=>Gg,ZodFirstPartyTypeKind:()=>ul,ZodFunction:()=>ah,ZodGUID:()=>di,ZodIPv4:()=>Hc,ZodIPv6:()=>qc,ZodISODate:()=>ai,ZodISODateTime:()=>si,ZodISODuration:()=>li,ZodISOTime:()=>ci,ZodIntersection:()=>zg,ZodIssueCode:()=>NC,ZodJWT:()=>el,ZodKSUID:()=>Vc,ZodLazy:()=>oh,ZodLiteral:()=>Fg,ZodMAC:()=>vg,ZodMap:()=>Lg,ZodNaN:()=>eh,ZodNanoID:()=>Gc,ZodNever:()=>Ag,ZodNonOptional:()=>al,ZodNull:()=>Eg,ZodNullable:()=>Bg,ZodNumber:()=>Hr,ZodNumberFormat:()=>Gn,ZodObject:()=>bi,ZodOptional:()=>sl,ZodPipe:()=>cl,ZodPrefault:()=>qg,ZodPromise:()=>sh,ZodReadonly:()=>th,ZodRealError:()=>we,ZodRecord:()=>_i,ZodSet:()=>Wg,ZodString:()=>Br,ZodStringFormat:()=>K,ZodSuccess:()=>Jg,ZodSymbol:()=>xg,ZodTemplateLiteral:()=>rh,ZodTransform:()=>Zg,ZodTuple:()=>Dg,ZodType:()=>D,ZodULID:()=>jc,ZodURL:()=>gi,ZodUUID:()=>kt,ZodUndefined:()=>Cg,ZodUnion:()=>vi,ZodUnknown:()=>Pg,ZodVoid:()=>kg,ZodXID:()=>Bc,ZodXor:()=>Ig,_ZodString:()=>Lc,_default:()=>Hg,_function:()=>wC,any:()=>rC,array:()=>yi,base64:()=>Fx,base64url:()=>Gx,bigint:()=>Xx,boolean:()=>Sg,catch:()=>Qg,check:()=>RC,cidrv4:()=>Lx,cidrv6:()=>Wx,clone:()=>be,codec:()=>xC,coerce:()=>dl,config:()=>ce,core:()=>At,cuid:()=>Tx,cuid2:()=>Ix,custom:()=>PC,date:()=>iC,decode:()=>kc,decodeAsync:()=>Ic,describe:()=>AC,discriminatedUnion:()=>dC,e164:()=>Zx,email:()=>_x,emoji:()=>Ax,encode:()=>Ac,encodeAsync:()=>Tc,endsWith:()=>Or,enum:()=>ol,exactOptional:()=>jg,file:()=>bC,flattenError:()=>_r,float32:()=>qx,float64:()=>Kx,formatError:()=>Sr,fromJSONSchema:()=>dh,function:()=>wC,getErrorMap:()=>MC,globalRegistry:()=>ze,gt:()=>Rt,gte:()=>Ee,guid:()=>Sx,hash:()=>Hx,hex:()=>Vx,hostname:()=>Bx,httpUrl:()=>Px,includes:()=>Tr,instanceof:()=>TC,int:()=>$c,int32:()=>Yx,int64:()=>Qx,intersection:()=>Ng,ipv4:()=>Dx,ipv6:()=>$x,iso:()=>ui,json:()=>OC,jwt:()=>Ux,keyof:()=>sC,ksuid:()=>Nx,lazy:()=>ih,length:()=>Wn,literal:()=>yC,locales:()=>ti,looseObject:()=>lC,looseRecord:()=>fC,lowercase:()=>Ar,lt:()=>wt,lte:()=>je,mac:()=>Mx,map:()=>pC,maxLength:()=>Ln,maxSize:()=>an,meta:()=>kC,mime:()=>zr,minLength:()=>Ft,minSize:()=>Pt,multipleOf:()=>sn,nan:()=>SC,nanoid:()=>kx,nativeEnum:()=>hC,negative:()=>hc,never:()=>nl,nonnegative:()=>bc,nonoptional:()=>Yg,nonpositive:()=>yc,normalize:()=>Nr,null:()=>wg,nullable:()=>fi,nullish:()=>vC,number:()=>_g,object:()=>aC,optional:()=>mi,overwrite:()=>lt,parse:()=>Ec,parseAsync:()=>wc,partialRecord:()=>mC,pipe:()=>pi,positive:()=>gc,prefault:()=>Kg,preprocess:()=>zC,prettifyError:()=>Sa,promise:()=>EC,property:()=>vc,readonly:()=>nh,record:()=>$g,refine:()=>ch,regex:()=>Pr,regexes:()=>Et,registry:()=>ni,safeDecode:()=>zc,safeDecodeAsync:()=>Dc,safeEncode:()=>Oc,safeEncodeAsync:()=>Nc,safeParse:()=>Rc,safeParseAsync:()=>Pc,set:()=>gC,setErrorMap:()=>DC,size:()=>$n,slugify:()=>Lr,startsWith:()=>Ir,strictObject:()=>cC,string:()=>Mc,stringFormat:()=>jx,stringbool:()=>IC,success:()=>_C,superRefine:()=>lh,symbol:()=>tC,templateLiteral:()=>CC,toJSONSchema:()=>ii,toLowerCase:()=>Mr,toUpperCase:()=>$r,transform:()=>il,treeifyError:()=>_a,trim:()=>Dr,tuple:()=>Mg,uint32:()=>Jx,uint64:()=>eC,ulid:()=>Ox,undefined:()=>nC,union:()=>rl,unknown:()=>Fn,uppercase:()=>kr,url:()=>Rx,util:()=>Ce,uuid:()=>xx,uuidv4:()=>Cx,uuidv6:()=>Ex,uuidv7:()=>wx,void:()=>oC,xid:()=>zx,xor:()=>uC});var At={};un(At,{$ZodAny:()=>ff,$ZodArray:()=>bf,$ZodAsyncError:()=>xt,$ZodBase64:()=>nf,$ZodBase64URL:()=>rf,$ZodBigInt:()=>Ua,$ZodBigIntFormat:()=>lf,$ZodBoolean:()=>Xo,$ZodCIDRv4:()=>Qm,$ZodCIDRv6:()=>ef,$ZodCUID:()=>Gm,$ZodCUID2:()=>Zm,$ZodCatch:()=>Mf,$ZodCheck:()=>X,$ZodCheckBigIntFormat:()=>ym,$ZodCheckEndsWith:()=>km,$ZodCheckGreaterThan:()=>Da,$ZodCheckIncludes:()=>Pm,$ZodCheckLengthEquals:()=>Cm,$ZodCheckLessThan:()=>Na,$ZodCheckLowerCase:()=>wm,$ZodCheckMaxLength:()=>Sm,$ZodCheckMaxSize:()=>bm,$ZodCheckMimeType:()=>Im,$ZodCheckMinLength:()=>xm,$ZodCheckMinSize:()=>vm,$ZodCheckMultipleOf:()=>gm,$ZodCheckNumberFormat:()=>hm,$ZodCheckOverwrite:()=>Om,$ZodCheckProperty:()=>Tm,$ZodCheckRegex:()=>Em,$ZodCheckSizeEquals:()=>_m,$ZodCheckStartsWith:()=>Am,$ZodCheckStringFormat:()=>Rr,$ZodCheckUpperCase:()=>Rm,$ZodCodec:()=>ei,$ZodCustom:()=>jf,$ZodCustomStringFormat:()=>af,$ZodDate:()=>yf,$ZodDefault:()=>Of,$ZodDiscriminatedUnion:()=>Sf,$ZodE164:()=>of,$ZodEmail:()=>$m,$ZodEmoji:()=>Wm,$ZodEncodeError:()=>zn,$ZodEnum:()=>Rf,$ZodError:()=>Ko,$ZodExactOptional:()=>Tf,$ZodFile:()=>Af,$ZodFunction:()=>Gf,$ZodGUID:()=>Dm,$ZodIPv4:()=>Ym,$ZodIPv6:()=>Jm,$ZodISODate:()=>Hm,$ZodISODateTime:()=>Vm,$ZodISODuration:()=>Km,$ZodISOTime:()=>qm,$ZodIntersection:()=>xf,$ZodJWT:()=>sf,$ZodKSUID:()=>Bm,$ZodLazy:()=>Uf,$ZodLiteral:()=>Pf,$ZodMAC:()=>Xm,$ZodMap:()=>Ef,$ZodNaN:()=>$f,$ZodNanoID:()=>Fm,$ZodNever:()=>gf,$ZodNonOptional:()=>Nf,$ZodNull:()=>mf,$ZodNullable:()=>If,$ZodNumber:()=>Za,$ZodNumberFormat:()=>cf,$ZodObject:()=>fx,$ZodObjectJIT:()=>vf,$ZodOptional:()=>Ba,$ZodPipe:()=>Lf,$ZodPrefault:()=>zf,$ZodPromise:()=>Zf,$ZodReadonly:()=>Wf,$ZodRealError:()=>Oe,$ZodRecord:()=>Cf,$ZodRegistry:()=>Bf,$ZodSet:()=>wf,$ZodString:()=>Mn,$ZodStringFormat:()=>q,$ZodSuccess:()=>Df,$ZodSymbol:()=>uf,$ZodTemplateLiteral:()=>Ff,$ZodTransform:()=>kf,$ZodTuple:()=>ja,$ZodType:()=>N,$ZodULID:()=>Um,$ZodURL:()=>Lm,$ZodUUID:()=>Mm,$ZodUndefined:()=>df,$ZodUnion:()=>Qo,$ZodUnknown:()=>pf,$ZodVoid:()=>hf,$ZodXID:()=>jm,$ZodXor:()=>_f,$brand:()=>ga,$constructor:()=>g,$input:()=>Ha,$output:()=>Va,Doc:()=>Ma,JSONSchema:()=>hx,JSONSchemaGenerator:()=>pg,NEVER:()=>pa,TimePrecision:()=>pc,_any:()=>gp,_array:()=>xp,_base64:()=>uc,_base64url:()=>dc,_bigint:()=>cp,_boolean:()=>sp,_catch:()=>P0,_check:()=>gx,_cidrv4:()=>cc,_cidrv6:()=>lc,_coercedBigint:()=>lp,_coercedBoolean:()=>ap,_coercedDate:()=>_p,_coercedNumber:()=>ep,_coercedString:()=>Hf,_cuid:()=>tc,_cuid2:()=>nc,_custom:()=>Ep,_date:()=>vp,_decode:()=>wa,_decodeAsync:()=>Pa,_default:()=>E0,_discriminatedUnion:()=>m0,_e164:()=>mc,_email:()=>qa,_emoji:()=>Qa,_encode:()=>Ea,_encodeAsync:()=>Ra,_endsWith:()=>Or,_enum:()=>b0,_file:()=>Cp,_float32:()=>np,_float64:()=>rp,_gt:()=>Rt,_gte:()=>Ee,_guid:()=>ri,_includes:()=>Tr,_int:()=>tp,_int32:()=>op,_int64:()=>up,_intersection:()=>f0,_ipv4:()=>sc,_ipv6:()=>ac,_isoDate:()=>Yf,_isoDateTime:()=>Kf,_isoDuration:()=>Xf,_isoTime:()=>Jf,_jwt:()=>fc,_ksuid:()=>ic,_lazy:()=>I0,_length:()=>Wn,_literal:()=>_0,_lowercase:()=>Ar,_lt:()=>wt,_lte:()=>je,_mac:()=>qf,_map:()=>h0,_max:()=>je,_maxLength:()=>Ln,_maxSize:()=>an,_mime:()=>zr,_min:()=>Ee,_minLength:()=>Ft,_minSize:()=>Pt,_multipleOf:()=>sn,_nan:()=>Sp,_nanoid:()=>ec,_nativeEnum:()=>v0,_negative:()=>hc,_never:()=>yp,_nonnegative:()=>bc,_nonoptional:()=>w0,_nonpositive:()=>yc,_normalize:()=>Nr,_null:()=>pp,_nullable:()=>C0,_number:()=>Qf,_optional:()=>x0,_overwrite:()=>lt,_parse:()=>xr,_parseAsync:()=>Cr,_pipe:()=>A0,_positive:()=>gc,_promise:()=>O0,_property:()=>vc,_readonly:()=>k0,_record:()=>g0,_refine:()=>wp,_regex:()=>Pr,_safeDecode:()=>ka,_safeDecodeAsync:()=>Ia,_safeEncode:()=>Aa,_safeEncodeAsync:()=>Ta,_safeParse:()=>Er,_safeParseAsync:()=>wr,_set:()=>y0,_size:()=>$n,_slugify:()=>Lr,_startsWith:()=>Ir,_string:()=>Vf,_stringFormat:()=>Wr,_stringbool:()=>kp,_success:()=>R0,_superRefine:()=>Rp,_symbol:()=>mp,_templateLiteral:()=>T0,_toLowerCase:()=>Mr,_toUpperCase:()=>$r,_transform:()=>S0,_trim:()=>Dr,_tuple:()=>p0,_uint32:()=>ip,_uint64:()=>dp,_ulid:()=>rc,_undefined:()=>fp,_union:()=>u0,_unknown:()=>hp,_uppercase:()=>kr,_url:()=>oi,_uuid:()=>Ka,_uuidv4:()=>Ya,_uuidv6:()=>Ja,_uuidv7:()=>Xa,_void:()=>bp,_xid:()=>oc,_xor:()=>d0,clone:()=>be,config:()=>ce,createStandardJSONSchemaMethod:()=>_c,createToJSONSchemaMethod:()=>Tp,decode:()=>ID,decodeAsync:()=>zD,describe:()=>Pp,encode:()=>TD,encodeAsync:()=>OD,extractDefs:()=>Zr,finalize:()=>Ur,flattenError:()=>_r,formatError:()=>Sr,globalConfig:()=>Go,globalRegistry:()=>ze,initializeContext:()=>Gr,isValidBase64:()=>tf,isValidBase64URL:()=>lx,isValidJWT:()=>ux,locales:()=>ti,meta:()=>Ap,parse:()=>xa,parseAsync:()=>Ca,prettifyError:()=>Sa,process:()=>Q,regexes:()=>Et,registry:()=>ni,safeDecode:()=>DD,safeDecodeAsync:()=>$D,safeEncode:()=>ND,safeEncodeAsync:()=>MD,safeParse:()=>Wd,safeParseAsync:()=>Fd,toDotPath:()=>ZS,toJSONSchema:()=>ii,treeifyError:()=>_a,util:()=>Ce,version:()=>zm});var pa=Object.freeze({status:"aborted"});function g(e,t,n){function r(a,c){if(!a._zod)Object.defineProperty(a,"_zod",{value:{def:c,constr:s,traits:new Set},enumerable:!1});if(a._zod.traits.has(e))return;a._zod.traits.add(e),t(a,c);let l=s.prototype,u=Object.keys(l);for(let d=0;d<u.length;d++){let m=u[d];if(!(m in a))a[m]=l[m].bind(a)}}let o=n?.Parent??Object;class i extends o{}Object.defineProperty(i,"name",{value:e});function s(a){var c;let l=n?.Parent?new i:this;r(l,a),(c=l._zod).deferred??(c.deferred=[]);for(let u of l._zod.deferred)u();return l}return Object.defineProperty(s,"init",{value:r}),Object.defineProperty(s,Symbol.hasInstance,{value:(a)=>{if(n?.Parent&&a instanceof n.Parent)return!0;return a?._zod?.traits?.has(e)}}),Object.defineProperty(s,"name",{value:e}),s}var ga=Symbol("zod_brand");class xt extends Error{constructor(){super("Encountered Promise during synchronous parse. Use .parseAsync() instead.")}}class zn extends Error{constructor(e){super(`Encountered unidirectional transform during encode: ${e}`);this.name="ZodEncodeError"}}var Go={};function ce(e){if(e)Object.assign(Go,e);return Go}var Ce={};un(Ce,{BIGINT_FORMAT_RANGES:()=>$d,Class:()=>FS,NUMBER_FORMAT_RANGES:()=>Md,aborted:()=>rn,allowsEval:()=>zd,assert:()=>gD,assertEqual:()=>dD,assertIs:()=>fD,assertNever:()=>pD,assertNotEqual:()=>mD,assignProp:()=>tn,base64ToUint8Array:()=>LS,base64urlToUint8Array:()=>wD,cached:()=>vr,captureStackTrace:()=>ba,cleanEnum:()=>ED,cleanRegex:()=>jo,clone:()=>be,cloneDef:()=>yD,createTransparentProxy:()=>CD,defineLazy:()=>M,esc:()=>ya,escapeRegex:()=>Je,extend:()=>zS,finalizeIssue:()=>Ie,floatSafeRemainder:()=>Id,getElementAtPath:()=>bD,getEnumValues:()=>Uo,getLengthableOrigin:()=>qo,getParsedType:()=>xD,getSizableOrigin:()=>Ho,hexToUint8Array:()=>PD,isObject:()=>Nn,isPlainObject:()=>nn,issue:()=>on,joinValues:()=>ha,jsonStringifyReplacer:()=>br,merge:()=>DS,mergeDefs:()=>Ct,normalizeParams:()=>b,nullish:()=>en,numKeys:()=>SD,objectClone:()=>hD,omit:()=>OS,optionalKeys:()=>Dd,parsedType:()=>Ld,partial:()=>MS,pick:()=>IS,prefixIssues:()=>Ue,primitiveTypes:()=>Nd,promiseAllObject:()=>vD,propertyKeyTypes:()=>Vo,randomString:()=>_D,required:()=>$S,safeExtend:()=>NS,shallowClone:()=>Bo,slugify:()=>Od,stringifyPrimitive:()=>va,uint8ArrayToBase64:()=>WS,uint8ArrayToBase64url:()=>RD,uint8ArrayToHex:()=>AD,unwrapMessage:()=>Zo});function dD(e){return e}function mD(e){return e}function fD(e){}function pD(e){throw Error("Unexpected value in exhaustive check")}function gD(e){}function Uo(e){let t=Object.values(e).filter((r)=>typeof r==="number");return Object.entries(e).filter(([r,o])=>t.indexOf(+r)===-1).map(([r,o])=>o)}function ha(e,t="|"){return e.map((n)=>va(n)).join(t)}function br(e,t){if(typeof t==="bigint")return t.toString();return t}function vr(e){return{get value(){{let n=e();return Object.defineProperty(this,"value",{value:n}),n}throw Error("cached value already set")}}}function en(e){return e===null||e===void 0}function jo(e){let t=e.startsWith("^")?1:0,n=e.endsWith("$")?e.length-1:e.length;return e.slice(t,n)}function Id(e,t){let n=(e.toString().split(".")[1]||"").length,r=t.toString(),o=(r.split(".")[1]||"").length;if(o===0&&/\d?e-\d?/.test(r)){let c=r.match(/\d?e-(\d?)/);if(c?.[1])o=Number.parseInt(c[1])}let i=n>o?n:o,s=Number.parseInt(e.toFixed(i).replace(".","")),a=Number.parseInt(t.toFixed(i).replace(".",""));return s%a/10**i}var TS=Symbol("evaluating");function M(e,t,n){let r=void 0;Object.defineProperty(e,t,{get(){if(r===TS)return;if(r===void 0)r=TS,r=n();return r},set(o){Object.defineProperty(e,t,{value:o})},configurable:!0})}function hD(e){return Object.create(Object.getPrototypeOf(e),Object.getOwnPropertyDescriptors(e))}function tn(e,t,n){Object.defineProperty(e,t,{value:n,writable:!0,enumerable:!0,configurable:!0})}function Ct(...e){let t={};for(let n of e){let r=Object.getOwnPropertyDescriptors(n);Object.assign(t,r)}return Object.defineProperties({},t)}function yD(e){return Ct(e._zod.def)}function bD(e,t){if(!t)return e;return t.reduce((n,r)=>n?.[r],e)}function vD(e){let t=Object.keys(e),n=t.map((r)=>e[r]);return Promise.all(n).then((r)=>{let o={};for(let i=0;i<t.length;i++)o[t[i]]=r[i];return o})}function _D(e=10){let n="";for(let r=0;r<e;r++)n+="abcdefghijklmnopqrstuvwxyz"[Math.floor(Math.random()*26)];return n}function ya(e){return JSON.stringify(e)}function Od(e){return e.toLowerCase().trim().replace(/[^\w\s-]/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")}var ba="captureStackTrace"in Error?Error.captureStackTrace:(...e)=>{};function Nn(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}var zd=vr(()=>{if(typeof navigator<"u"&&navigator?.userAgent?.includes("Cloudflare"))return!1;try{return new Function(""),!0}catch(e){return!1}});function nn(e){if(Nn(e)===!1)return!1;let t=e.constructor;if(t===void 0)return!0;if(typeof t!=="function")return!0;let n=t.prototype;if(Nn(n)===!1)return!1;if(Object.prototype.hasOwnProperty.call(n,"isPrototypeOf")===!1)return!1;return!0}function Bo(e){if(nn(e))return{...e};if(Array.isArray(e))return[...e];return e}function SD(e){let t=0;for(let n in e)if(Object.prototype.hasOwnProperty.call(e,n))t++;return t}var xD=(e)=>{let t=typeof e;switch(t){case"undefined":return"undefined";case"string":return"string";case"number":return Number.isNaN(e)?"nan":"number";case"boolean":return"boolean";case"function":return"function";case"bigint":return"bigint";case"symbol":return"symbol";case"object":if(Array.isArray(e))return"array";if(e===null)return"null";if(e.then&&typeof e.then==="function"&&e.catch&&typeof e.catch==="function")return"promise";if(typeof Map<"u"&&e instanceof Map)return"map";if(typeof Set<"u"&&e instanceof Set)return"set";if(typeof Date<"u"&&e instanceof Date)return"date";if(typeof File<"u"&&e instanceof File)return"file";return"object";default:throw Error(`Unknown data type: ${t}`)}},Vo=new Set(["string","number","symbol"]),Nd=new Set(["string","number","bigint","boolean","symbol","undefined"]);function Je(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function be(e,t,n){let r=new e._zod.constr(t??e._zod.def);if(!t||n?.parent)r._zod.parent=e;return r}function b(e){let t=e;if(!t)return{};if(typeof t==="string")return{error:()=>t};if(t?.message!==void 0){if(t?.error!==void 0)throw Error("Cannot specify both `message` and `error` params");t.error=t.message}if(delete t.message,typeof t.error==="string")return{...t,error:()=>t.error};return t}function CD(e){let t;return new Proxy({},{get(n,r,o){return t??(t=e()),Reflect.get(t,r,o)},set(n,r,o,i){return t??(t=e()),Reflect.set(t,r,o,i)},has(n,r){return t??(t=e()),Reflect.has(t,r)},deleteProperty(n,r){return t??(t=e()),Reflect.deleteProperty(t,r)},ownKeys(n){return t??(t=e()),Reflect.ownKeys(t)},getOwnPropertyDescriptor(n,r){return t??(t=e()),Reflect.getOwnPropertyDescriptor(t,r)},defineProperty(n,r,o){return t??(t=e()),Reflect.defineProperty(t,r,o)}})}function va(e){if(typeof e==="bigint")return e.toString()+"n";if(typeof e==="string")return`"${e}"`;return`${e}`}function Dd(e){return Object.keys(e).filter((t)=>e[t]._zod.optin==="optional"&&e[t]._zod.optout==="optional")}var Md={safeint:[Number.MIN_SAFE_INTEGER,Number.MAX_SAFE_INTEGER],int32:[-2147483648,2147483647],uint32:[0,4294967295],float32:[-340282346638528860000000000000000000000,340282346638528860000000000000000000000],float64:[-Number.MAX_VALUE,Number.MAX_VALUE]},$d={int64:[BigInt("-9223372036854775808"),BigInt("9223372036854775807")],uint64:[BigInt(0),BigInt("18446744073709551615")]};function IS(e,t){let n=e._zod.def,r=n.checks;if(r&&r.length>0)throw Error(".pick() cannot be used on object schemas containing refinements");let i=Ct(e._zod.def,{get shape(){let s={};for(let a in t){if(!(a in n.shape))throw Error(`Unrecognized key: "${a}"`);if(!t[a])continue;s[a]=n.shape[a]}return tn(this,"shape",s),s},checks:[]});return be(e,i)}function OS(e,t){let n=e._zod.def,r=n.checks;if(r&&r.length>0)throw Error(".omit() cannot be used on object schemas containing refinements");let i=Ct(e._zod.def,{get shape(){let s={...e._zod.def.shape};for(let a in t){if(!(a in n.shape))throw Error(`Unrecognized key: "${a}"`);if(!t[a])continue;delete s[a]}return tn(this,"shape",s),s},checks:[]});return be(e,i)}function zS(e,t){if(!nn(t))throw Error("Invalid input to extend: expected a plain object");let n=e._zod.def.checks;if(n&&n.length>0){let i=e._zod.def.shape;for(let s in t)if(Object.getOwnPropertyDescriptor(i,s)!==void 0)throw Error("Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.")}let o=Ct(e._zod.def,{get shape(){let i={...e._zod.def.shape,...t};return tn(this,"shape",i),i}});return be(e,o)}function NS(e,t){if(!nn(t))throw Error("Invalid input to safeExtend: expected a plain object");let n=Ct(e._zod.def,{get shape(){let r={...e._zod.def.shape,...t};return tn(this,"shape",r),r}});return be(e,n)}function DS(e,t){let n=Ct(e._zod.def,{get shape(){let r={...e._zod.def.shape,...t._zod.def.shape};return tn(this,"shape",r),r},get catchall(){return t._zod.def.catchall},checks:[]});return be(e,n)}function MS(e,t,n){let o=t._zod.def.checks;if(o&&o.length>0)throw Error(".partial() cannot be used on object schemas containing refinements");let s=Ct(t._zod.def,{get shape(){let a=t._zod.def.shape,c={...a};if(n)for(let l in n){if(!(l in a))throw Error(`Unrecognized key: "${l}"`);if(!n[l])continue;c[l]=e?new e({type:"optional",innerType:a[l]}):a[l]}else for(let l in a)c[l]=e?new e({type:"optional",innerType:a[l]}):a[l];return tn(this,"shape",c),c},checks:[]});return be(t,s)}function $S(e,t,n){let r=Ct(t._zod.def,{get shape(){let o=t._zod.def.shape,i={...o};if(n)for(let s in n){if(!(s in i))throw Error(`Unrecognized key: "${s}"`);if(!n[s])continue;i[s]=new e({type:"nonoptional",innerType:o[s]})}else for(let s in o)i[s]=new e({type:"nonoptional",innerType:o[s]});return tn(this,"shape",i),i}});return be(t,r)}function rn(e,t=0){if(e.aborted===!0)return!0;for(let n=t;n<e.issues.length;n++)if(e.issues[n]?.continue!==!0)return!0;return!1}function Ue(e,t){return t.map((n)=>{var r;return(r=n).path??(r.path=[]),n.path.unshift(e),n})}function Zo(e){return typeof e==="string"?e:e?.message}function Ie(e,t,n){let r={...e,path:e.path??[]};if(!e.message){let o=Zo(e.inst?._zod.def?.error?.(e))??Zo(t?.error?.(e))??Zo(n.customError?.(e))??Zo(n.localeError?.(e))??"Invalid input";r.message=o}if(delete r.inst,delete r.continue,!t?.reportInput)delete r.input;return r}function Ho(e){if(e instanceof Set)return"set";if(e instanceof Map)return"map";if(e instanceof File)return"file";return"unknown"}function qo(e){if(Array.isArray(e))return"array";if(typeof e==="string")return"string";return"unknown"}function Ld(e){let t=typeof e;switch(t){case"number":return Number.isNaN(e)?"nan":"number";case"object":{if(e===null)return"null";if(Array.isArray(e))return"array";let n=e;if(n&&Object.getPrototypeOf(n)!==Object.prototype&&"constructor"in n&&n.constructor)return n.constructor.name}}return t}function on(...e){let[t,n,r]=e;if(typeof t==="string")return{message:t,code:"custom",input:n,inst:r};return{...t}}function ED(e){return Object.entries(e).filter(([t,n])=>Number.isNaN(Number.parseInt(t,10))).map((t)=>t[1])}function LS(e){let t=atob(e),n=new Uint8Array(t.length);for(let r=0;r<t.length;r++)n[r]=t.charCodeAt(r);return n}function WS(e){let t="";for(let n=0;n<e.length;n++)t+=String.fromCharCode(e[n]);return btoa(t)}function wD(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),n="=".repeat((4-t.length%4)%4);return LS(t+n)}function RD(e){return WS(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function PD(e){let t=e.replace(/^0x/,"");if(t.length%2!==0)throw Error("Invalid hex string length");let n=new Uint8Array(t.length/2);for(let r=0;r<t.length;r+=2)n[r/2]=Number.parseInt(t.slice(r,r+2),16);return n}function AD(e){return Array.from(e).map((t)=>t.toString(16).padStart(2,"0")).join("")}class FS{constructor(...e){}}var GS=(e,t)=>{e.name="$ZodError",Object.defineProperty(e,"_zod",{value:e._zod,enumerable:!1}),Object.defineProperty(e,"issues",{value:t,enumerable:!1}),e.message=JSON.stringify(t,br,2),Object.defineProperty(e,"toString",{value:()=>e.message,enumerable:!1})},Ko=g("$ZodError",GS),Oe=g("$ZodError",GS,{Parent:Error});function _r(e,t=(n)=>n.message){let n={},r=[];for(let o of e.issues)if(o.path.length>0)n[o.path[0]]=n[o.path[0]]||[],n[o.path[0]].push(t(o));else r.push(t(o));return{formErrors:r,fieldErrors:n}}function Sr(e,t=(n)=>n.message){let n={_errors:[]},r=(o)=>{for(let i of o.issues)if(i.code==="invalid_union"&&i.errors.length)i.errors.map((s)=>r({issues:s}));else if(i.code==="invalid_key")r({issues:i.issues});else if(i.code==="invalid_element")r({issues:i.issues});else if(i.path.length===0)n._errors.push(t(i));else{let s=n,a=0;while(a<i.path.length){let c=i.path[a];if(a!==i.path.length-1)s[c]=s[c]||{_errors:[]};else s[c]=s[c]||{_errors:[]},s[c]._errors.push(t(i));s=s[c],a++}}};return r(e),n}function _a(e,t=(n)=>n.message){let n={errors:[]},r=(o,i=[])=>{var s,a;for(let c of o.issues)if(c.code==="invalid_union"&&c.errors.length)c.errors.map((l)=>r({issues:l},c.path));else if(c.code==="invalid_key")r({issues:c.issues},c.path);else if(c.code==="invalid_element")r({issues:c.issues},c.path);else{let l=[...i,...c.path];if(l.length===0){n.errors.push(t(c));continue}let u=n,d=0;while(d<l.length){let m=l[d],f=d===l.length-1;if(typeof m==="string")u.properties??(u.properties={}),(s=u.properties)[m]??(s[m]={errors:[]}),u=u.properties[m];else u.items??(u.items=[]),(a=u.items)[m]??(a[m]={errors:[]}),u=u.items[m];if(f)u.errors.push(t(c));d++}}};return r(e),n}function ZS(e){let t=[],n=e.map((r)=>typeof r==="object"?r.key:r);for(let r of n)if(typeof r==="number")t.push(`[${r}]`);else if(typeof r==="symbol")t.push(`[${JSON.stringify(String(r))}]`);else if(/[^\w$]/.test(r))t.push(`[${JSON.stringify(r)}]`);else{if(t.length)t.push(".");t.push(r)}return t.join("")}function Sa(e){let t=[],n=[...e.issues].sort((r,o)=>(r.path??[]).length-(o.path??[]).length);for(let r of n)if(t.push(`\u2716 ${r.message}`),r.path?.length)t.push(`  \u2192 at ${ZS(r.path)}`);return t.join(`
-`)}var xr=(e)=>(t,n,r,o)=>{let i=r?Object.assign(r,{async:!1}):{async:!1},s=t._zod.run({value:n,issues:[]},i);if(s instanceof Promise)throw new xt;if(s.issues.length){let a=new(o?.Err??e)(s.issues.map((c)=>Ie(c,i,ce())));throw ba(a,o?.callee),a}return s.value},xa=xr(Oe),Cr=(e)=>async(t,n,r,o)=>{let i=r?Object.assign(r,{async:!0}):{async:!0},s=t._zod.run({value:n,issues:[]},i);if(s instanceof Promise)s=await s;if(s.issues.length){let a=new(o?.Err??e)(s.issues.map((c)=>Ie(c,i,ce())));throw ba(a,o?.callee),a}return s.value},Ca=Cr(Oe),Er=(e)=>(t,n,r)=>{let o=r?{...r,async:!1}:{async:!1},i=t._zod.run({value:n,issues:[]},o);if(i instanceof Promise)throw new xt;return i.issues.length?{success:!1,error:new(e??Ko)(i.issues.map((s)=>Ie(s,o,ce())))}:{success:!0,data:i.value}},Wd=Er(Oe),wr=(e)=>async(t,n,r)=>{let o=r?Object.assign(r,{async:!0}):{async:!0},i=t._zod.run({value:n,issues:[]},o);if(i instanceof Promise)i=await i;return i.issues.length?{success:!1,error:new e(i.issues.map((s)=>Ie(s,o,ce())))}:{success:!0,data:i.value}},Fd=wr(Oe),Ea=(e)=>(t,n,r)=>{let o=r?Object.assign(r,{direction:"backward"}):{direction:"backward"};return xr(e)(t,n,o)},TD=Ea(Oe),wa=(e)=>(t,n,r)=>xr(e)(t,n,r),ID=wa(Oe),Ra=(e)=>async(t,n,r)=>{let o=r?Object.assign(r,{direction:"backward"}):{direction:"backward"};return Cr(e)(t,n,o)},OD=Ra(Oe),Pa=(e)=>async(t,n,r)=>Cr(e)(t,n,r),zD=Pa(Oe),Aa=(e)=>(t,n,r)=>{let o=r?Object.assign(r,{direction:"backward"}):{direction:"backward"};return Er(e)(t,n,o)},ND=Aa(Oe),ka=(e)=>(t,n,r)=>Er(e)(t,n,r),DD=ka(Oe),Ta=(e)=>async(t,n,r)=>{let o=r?Object.assign(r,{direction:"backward"}):{direction:"backward"};return wr(e)(t,n,o)},MD=Ta(Oe),Ia=(e)=>async(t,n,r)=>wr(e)(t,n,r),$D=Ia(Oe);var Et={};un(Et,{base64:()=>nm,base64url:()=>Oa,bigint:()=>cm,boolean:()=>um,browserEmail:()=>BD,cidrv4:()=>em,cidrv6:()=>tm,cuid:()=>Gd,cuid2:()=>Zd,date:()=>om,datetime:()=>sm,domain:()=>BS,duration:()=>Hd,e164:()=>rm,email:()=>Kd,emoji:()=>Yd,extendedDuration:()=>LD,guid:()=>qd,hex:()=>qS,hostname:()=>jS,html5Email:()=>ZD,idnEmail:()=>jD,integer:()=>lm,ipv4:()=>Jd,ipv6:()=>Xd,ksuid:()=>Bd,lowercase:()=>fm,mac:()=>Qd,md5_base64:()=>qD,md5_base64url:()=>KD,md5_hex:()=>HD,nanoid:()=>Vd,null:()=>dm,number:()=>za,rfc5322Email:()=>UD,sha1_base64:()=>JD,sha1_base64url:()=>XD,sha1_hex:()=>YD,sha256_base64:()=>e0,sha256_base64url:()=>t0,sha256_hex:()=>QD,sha384_base64:()=>r0,sha384_base64url:()=>o0,sha384_hex:()=>n0,sha512_base64:()=>s0,sha512_base64url:()=>a0,sha512_hex:()=>i0,string:()=>am,time:()=>im,ulid:()=>Ud,undefined:()=>mm,unicodeEmail:()=>US,uppercase:()=>pm,uuid:()=>Dn,uuid4:()=>WD,uuid6:()=>FD,uuid7:()=>GD,xid:()=>jd});var Gd=/^[cC][^\s-]{8,}$/,Zd=/^[0-9a-z]+$/,Ud=/^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/,jd=/^[0-9a-vA-V]{20}$/,Bd=/^[A-Za-z0-9]{27}$/,Vd=/^[a-zA-Z0-9_-]{21}$/,Hd=/^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/,LD=/^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/,qd=/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/,Dn=(e)=>{if(!e)return/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${e}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`)},WD=Dn(4),FD=Dn(6),GD=Dn(7),Kd=/^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/,ZD=/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/,UD=/^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/,US=/^[^\s@"]{1,64}@[^\s@]{1,255}$/u,jD=US,BD=/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/,VD="^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$";function Yd(){return new RegExp(VD,"u")}var Jd=/^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/,Xd=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/,Qd=(e)=>{let t=Je(e??":");return new RegExp(`^(?:[0-9A-F]{2}${t}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${t}){5}[0-9a-f]{2}$`)},em=/^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/,tm=/^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/,nm=/^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/,Oa=/^[A-Za-z0-9_-]*$/,jS=/^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/,BS=/^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/,rm=/^\+[1-9]\d{6,14}$/,VS="(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))",om=new RegExp(`^${VS}$`);function HS(e){return typeof e.precision==="number"?e.precision===-1?"(?:[01]\\d|2[0-3]):[0-5]\\d":e.precision===0?"(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d":`(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d\\.\\d{${e.precision}}`:"(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?"}function im(e){return new RegExp(`^${HS(e)}$`)}function sm(e){let t=HS({precision:e.precision}),n=["Z"];if(e.local)n.push("");if(e.offset)n.push("([+-](?:[01]\\d|2[0-3]):[0-5]\\d)");let r=`${t}(?:${n.join("|")})`;return new RegExp(`^${VS}T(?:${r})$`)}var am=(e)=>{let t=e?`[\\s\\S]{${e?.minimum??0},${e?.maximum??""}}`:"[\\s\\S]*";return new RegExp(`^${t}$`)},cm=/^-?\d+n?$/,lm=/^-?\d+$/,za=/^-?\d+(?:\.\d+)?$/,um=/^(?:true|false)$/i,dm=/^null$/i;var mm=/^undefined$/i;var fm=/^[^A-Z]*$/,pm=/^[^a-z]*$/,qS=/^[0-9a-fA-F]*$/;function Yo(e,t){return new RegExp(`^[A-Za-z0-9+/]{${e}}${t}$`)}function Jo(e){return new RegExp(`^[A-Za-z0-9_-]{${e}}$`)}var HD=/^[0-9a-fA-F]{32}$/,qD=Yo(22,"=="),KD=Jo(22),YD=/^[0-9a-fA-F]{40}$/,JD=Yo(27,"="),XD=Jo(27),QD=/^[0-9a-fA-F]{64}$/,e0=Yo(43,"="),t0=Jo(43),n0=/^[0-9a-fA-F]{96}$/,r0=Yo(64,""),o0=Jo(64),i0=/^[0-9a-fA-F]{128}$/,s0=Yo(86,"=="),a0=Jo(86);var X=g("$ZodCheck",(e,t)=>{var n;e._zod??(e._zod={}),e._zod.def=t,(n=e._zod).onattach??(n.onattach=[])}),YS={number:"number",bigint:"bigint",object:"date"},Na=g("$ZodCheckLessThan",(e,t)=>{X.init(e,t);let n=YS[typeof t.value];e._zod.onattach.push((r)=>{let o=r._zod.bag,i=(t.inclusive?o.maximum:o.exclusiveMaximum)??Number.POSITIVE_INFINITY;if(t.value<i)if(t.inclusive)o.maximum=t.value;else o.exclusiveMaximum=t.value}),e._zod.check=(r)=>{if(t.inclusive?r.value<=t.value:r.value<t.value)return;r.issues.push({origin:n,code:"too_big",maximum:typeof t.value==="object"?t.value.getTime():t.value,input:r.value,inclusive:t.inclusive,inst:e,continue:!t.abort})}}),Da=g("$ZodCheckGreaterThan",(e,t)=>{X.init(e,t);let n=YS[typeof t.value];e._zod.onattach.push((r)=>{let o=r._zod.bag,i=(t.inclusive?o.minimum:o.exclusiveMinimum)??Number.NEGATIVE_INFINITY;if(t.value>i)if(t.inclusive)o.minimum=t.value;else o.exclusiveMinimum=t.value}),e._zod.check=(r)=>{if(t.inclusive?r.value>=t.value:r.value>t.value)return;r.issues.push({origin:n,code:"too_small",minimum:typeof t.value==="object"?t.value.getTime():t.value,input:r.value,inclusive:t.inclusive,inst:e,continue:!t.abort})}}),gm=g("$ZodCheckMultipleOf",(e,t)=>{X.init(e,t),e._zod.onattach.push((n)=>{var r;(r=n._zod.bag).multipleOf??(r.multipleOf=t.value)}),e._zod.check=(n)=>{if(typeof n.value!==typeof t.value)throw Error("Cannot mix number and bigint in multiple_of check.");if(typeof n.value==="bigint"?n.value%t.value===BigInt(0):Id(n.value,t.value)===0)return;n.issues.push({origin:typeof n.value,code:"not_multiple_of",divisor:t.value,input:n.value,inst:e,continue:!t.abort})}}),hm=g("$ZodCheckNumberFormat",(e,t)=>{X.init(e,t),t.format=t.format||"float64";let n=t.format?.includes("int"),r=n?"int":"number",[o,i]=Md[t.format];e._zod.onattach.push((s)=>{let a=s._zod.bag;if(a.format=t.format,a.minimum=o,a.maximum=i,n)a.pattern=lm}),e._zod.check=(s)=>{let a=s.value;if(n){if(!Number.isInteger(a)){s.issues.push({expected:r,format:t.format,code:"invalid_type",continue:!1,input:a,inst:e});return}if(!Number.isSafeInteger(a)){if(a>0)s.issues.push({input:a,code:"too_big",maximum:Number.MAX_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:e,origin:r,inclusive:!0,continue:!t.abort});else s.issues.push({input:a,code:"too_small",minimum:Number.MIN_SAFE_INTEGER,note:"Integers must be within the safe integer range.",inst:e,origin:r,inclusive:!0,continue:!t.abort});return}}if(a<o)s.issues.push({origin:"number",input:a,code:"too_small",minimum:o,inclusive:!0,inst:e,continue:!t.abort});if(a>i)s.issues.push({origin:"number",input:a,code:"too_big",maximum:i,inclusive:!0,inst:e,continue:!t.abort})}}),ym=g("$ZodCheckBigIntFormat",(e,t)=>{X.init(e,t);let[n,r]=$d[t.format];e._zod.onattach.push((o)=>{let i=o._zod.bag;i.format=t.format,i.minimum=n,i.maximum=r}),e._zod.check=(o)=>{let i=o.value;if(i<n)o.issues.push({origin:"bigint",input:i,code:"too_small",minimum:n,inclusive:!0,inst:e,continue:!t.abort});if(i>r)o.issues.push({origin:"bigint",input:i,code:"too_big",maximum:r,inclusive:!0,inst:e,continue:!t.abort})}}),bm=g("$ZodCheckMaxSize",(e,t)=>{var n;X.init(e,t),(n=e._zod.def).when??(n.when=(r)=>{let o=r.value;return!en(o)&&o.size!==void 0}),e._zod.onattach.push((r)=>{let o=r._zod.bag.maximum??Number.POSITIVE_INFINITY;if(t.maximum<o)r._zod.bag.maximum=t.maximum}),e._zod.check=(r)=>{let o=r.value;if(o.size<=t.maximum)return;r.issues.push({origin:Ho(o),code:"too_big",maximum:t.maximum,inclusive:!0,input:o,inst:e,continue:!t.abort})}}),vm=g("$ZodCheckMinSize",(e,t)=>{var n;X.init(e,t),(n=e._zod.def).when??(n.when=(r)=>{let o=r.value;return!en(o)&&o.size!==void 0}),e._zod.onattach.push((r)=>{let o=r._zod.bag.minimum??Number.NEGATIVE_INFINITY;if(t.minimum>o)r._zod.bag.minimum=t.minimum}),e._zod.check=(r)=>{let o=r.value;if(o.size>=t.minimum)return;r.issues.push({origin:Ho(o),code:"too_small",minimum:t.minimum,inclusive:!0,input:o,inst:e,continue:!t.abort})}}),_m=g("$ZodCheckSizeEquals",(e,t)=>{var n;X.init(e,t),(n=e._zod.def).when??(n.when=(r)=>{let o=r.value;return!en(o)&&o.size!==void 0}),e._zod.onattach.push((r)=>{let o=r._zod.bag;o.minimum=t.size,o.maximum=t.size,o.size=t.size}),e._zod.check=(r)=>{let o=r.value,i=o.size;if(i===t.size)return;let s=i>t.size;r.issues.push({origin:Ho(o),...s?{code:"too_big",maximum:t.size}:{code:"too_small",minimum:t.size},inclusive:!0,exact:!0,input:r.value,inst:e,continue:!t.abort})}}),Sm=g("$ZodCheckMaxLength",(e,t)=>{var n;X.init(e,t),(n=e._zod.def).when??(n.when=(r)=>{let o=r.value;return!en(o)&&o.length!==void 0}),e._zod.onattach.push((r)=>{let o=r._zod.bag.maximum??Number.POSITIVE_INFINITY;if(t.maximum<o)r._zod.bag.maximum=t.maximum}),e._zod.check=(r)=>{let o=r.value;if(o.length<=t.maximum)return;let s=qo(o);r.issues.push({origin:s,code:"too_big",maximum:t.maximum,inclusive:!0,input:o,inst:e,continue:!t.abort})}}),xm=g("$ZodCheckMinLength",(e,t)=>{var n;X.init(e,t),(n=e._zod.def).when??(n.when=(r)=>{let o=r.value;return!en(o)&&o.length!==void 0}),e._zod.onattach.push((r)=>{let o=r._zod.bag.minimum??Number.NEGATIVE_INFINITY;if(t.minimum>o)r._zod.bag.minimum=t.minimum}),e._zod.check=(r)=>{let o=r.value;if(o.length>=t.minimum)return;let s=qo(o);r.issues.push({origin:s,code:"too_small",minimum:t.minimum,inclusive:!0,input:o,inst:e,continue:!t.abort})}}),Cm=g("$ZodCheckLengthEquals",(e,t)=>{var n;X.init(e,t),(n=e._zod.def).when??(n.when=(r)=>{let o=r.value;return!en(o)&&o.length!==void 0}),e._zod.onattach.push((r)=>{let o=r._zod.bag;o.minimum=t.length,o.maximum=t.length,o.length=t.length}),e._zod.check=(r)=>{let o=r.value,i=o.length;if(i===t.length)return;let s=qo(o),a=i>t.length;r.issues.push({origin:s,...a?{code:"too_big",maximum:t.length}:{code:"too_small",minimum:t.length},inclusive:!0,exact:!0,input:r.value,inst:e,continue:!t.abort})}}),Rr=g("$ZodCheckStringFormat",(e,t)=>{var n,r;if(X.init(e,t),e._zod.onattach.push((o)=>{let i=o._zod.bag;if(i.format=t.format,t.pattern)i.patterns??(i.patterns=new Set),i.patterns.add(t.pattern)}),t.pattern)(n=e._zod).check??(n.check=(o)=>{if(t.pattern.lastIndex=0,t.pattern.test(o.value))return;o.issues.push({origin:"string",code:"invalid_format",format:t.format,input:o.value,...t.pattern?{pattern:t.pattern.toString()}:{},inst:e,continue:!t.abort})});else(r=e._zod).check??(r.check=()=>{})}),Em=g("$ZodCheckRegex",(e,t)=>{Rr.init(e,t),e._zod.check=(n)=>{if(t.pattern.lastIndex=0,t.pattern.test(n.value))return;n.issues.push({origin:"string",code:"invalid_format",format:"regex",input:n.value,pattern:t.pattern.toString(),inst:e,continue:!t.abort})}}),wm=g("$ZodCheckLowerCase",(e,t)=>{t.pattern??(t.pattern=fm),Rr.init(e,t)}),Rm=g("$ZodCheckUpperCase",(e,t)=>{t.pattern??(t.pattern=pm),Rr.init(e,t)}),Pm=g("$ZodCheckIncludes",(e,t)=>{X.init(e,t);let n=Je(t.includes),r=new RegExp(typeof t.position==="number"?`^.{${t.position}}${n}`:n);t.pattern=r,e._zod.onattach.push((o)=>{let i=o._zod.bag;i.patterns??(i.patterns=new Set),i.patterns.add(r)}),e._zod.check=(o)=>{if(o.value.includes(t.includes,t.position))return;o.issues.push({origin:"string",code:"invalid_format",format:"includes",includes:t.includes,input:o.value,inst:e,continue:!t.abort})}}),Am=g("$ZodCheckStartsWith",(e,t)=>{X.init(e,t);let n=new RegExp(`^${Je(t.prefix)}.*`);t.pattern??(t.pattern=n),e._zod.onattach.push((r)=>{let o=r._zod.bag;o.patterns??(o.patterns=new Set),o.patterns.add(n)}),e._zod.check=(r)=>{if(r.value.startsWith(t.prefix))return;r.issues.push({origin:"string",code:"invalid_format",format:"starts_with",prefix:t.prefix,input:r.value,inst:e,continue:!t.abort})}}),km=g("$ZodCheckEndsWith",(e,t)=>{X.init(e,t);let n=new RegExp(`.*${Je(t.suffix)}$`);t.pattern??(t.pattern=n),e._zod.onattach.push((r)=>{let o=r._zod.bag;o.patterns??(o.patterns=new Set),o.patterns.add(n)}),e._zod.check=(r)=>{if(r.value.endsWith(t.suffix))return;r.issues.push({origin:"string",code:"invalid_format",format:"ends_with",suffix:t.suffix,input:r.value,inst:e,continue:!t.abort})}});function KS(e,t,n){if(e.issues.length)t.issues.push(...Ue(n,e.issues))}var Tm=g("$ZodCheckProperty",(e,t)=>{X.init(e,t),e._zod.check=(n)=>{let r=t.schema._zod.run({value:n.value[t.property],issues:[]},{});if(r instanceof Promise)return r.then((o)=>KS(o,n,t.property));KS(r,n,t.property);return}}),Im=g("$ZodCheckMimeType",(e,t)=>{X.init(e,t);let n=new Set(t.mime);e._zod.onattach.push((r)=>{r._zod.bag.mime=t.mime}),e._zod.check=(r)=>{if(n.has(r.value.type))return;r.issues.push({code:"invalid_value",values:t.mime,input:r.value.type,inst:e,continue:!t.abort})}}),Om=g("$ZodCheckOverwrite",(e,t)=>{X.init(e,t),e._zod.check=(n)=>{n.value=t.tx(n.value)}});class Ma{constructor(e=[]){if(this.content=[],this.indent=0,this)this.args=e}indented(e){this.indent+=1,e(this),this.indent-=1}write(e){if(typeof e==="function"){e(this,{execution:"sync"}),e(this,{execution:"async"});return}let n=e.split(`
-`).filter((i)=>i),r=Math.min(...n.map((i)=>i.length-i.trimStart().length)),o=n.map((i)=>i.slice(r)).map((i)=>" ".repeat(this.indent*2)+i);for(let i of o)this.content.push(i)}compile(){let e=Function,t=this?.args,r=[...(this?.content??[""]).map((o)=>`  ${o}`)];return new e(...t,r.join(`
-`))}}var zm={major:4,minor:3,patch:5};var N=g("$ZodType",(e,t)=>{var n;e??(e={}),e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=zm;let r=[...e._zod.def.checks??[]];if(e._zod.traits.has("$ZodCheck"))r.unshift(e);for(let o of r)for(let i of o._zod.onattach)i(e);if(r.length===0)(n=e._zod).deferred??(n.deferred=[]),e._zod.deferred?.push(()=>{e._zod.run=e._zod.parse});else{let o=(s,a,c)=>{let l=rn(s),u;for(let d of a){if(d._zod.def.when){if(!d._zod.def.when(s))continue}else if(l)continue;let m=s.issues.length,f=d._zod.check(s);if(f instanceof Promise&&c?.async===!1)throw new xt;if(u||f instanceof Promise)u=(u??Promise.resolve()).then(async()=>{if(await f,s.issues.length===m)return;if(!l)l=rn(s,m)});else{if(s.issues.length===m)continue;if(!l)l=rn(s,m)}}if(u)return u.then(()=>s);return s},i=(s,a,c)=>{if(rn(s))return s.aborted=!0,s;let l=o(a,r,c);if(l instanceof Promise){if(c.async===!1)throw new xt;return l.then((u)=>e._zod.parse(u,c))}return e._zod.parse(l,c)};e._zod.run=(s,a)=>{if(a.skipChecks)return e._zod.parse(s,a);if(a.direction==="backward"){let l=e._zod.parse({value:s.value,issues:[]},{...a,skipChecks:!0});if(l instanceof Promise)return l.then((u)=>i(u,s,a));return i(l,s,a)}let c=e._zod.parse(s,a);if(c instanceof Promise){if(a.async===!1)throw new xt;return c.then((l)=>o(l,r,a))}return o(c,r,a)}}M(e,"~standard",()=>({validate:(o)=>{try{let i=Wd(e,o);return i.success?{value:i.data}:{issues:i.error?.issues}}catch(i){return Fd(e,o).then((s)=>s.success?{value:s.data}:{issues:s.error?.issues})}},vendor:"zod",version:1}))}),Mn=g("$ZodString",(e,t)=>{N.init(e,t),e._zod.pattern=[...e?._zod.bag?.patterns??[]].pop()??am(e._zod.bag),e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=String(n.value)}catch(o){}if(typeof n.value==="string")return n;return n.issues.push({expected:"string",code:"invalid_type",input:n.value,inst:e}),n}}),q=g("$ZodStringFormat",(e,t)=>{Rr.init(e,t),Mn.init(e,t)}),Dm=g("$ZodGUID",(e,t)=>{t.pattern??(t.pattern=qd),q.init(e,t)}),Mm=g("$ZodUUID",(e,t)=>{if(t.version){let r={v1:1,v2:2,v3:3,v4:4,v5:5,v6:6,v7:7,v8:8}[t.version];if(r===void 0)throw Error(`Invalid UUID version: "${t.version}"`);t.pattern??(t.pattern=Dn(r))}else t.pattern??(t.pattern=Dn());q.init(e,t)}),$m=g("$ZodEmail",(e,t)=>{t.pattern??(t.pattern=Kd),q.init(e,t)}),Lm=g("$ZodURL",(e,t)=>{q.init(e,t),e._zod.check=(n)=>{try{let r=n.value.trim(),o=new URL(r);if(t.hostname){if(t.hostname.lastIndex=0,!t.hostname.test(o.hostname))n.issues.push({code:"invalid_format",format:"url",note:"Invalid hostname",pattern:t.hostname.source,input:n.value,inst:e,continue:!t.abort})}if(t.protocol){if(t.protocol.lastIndex=0,!t.protocol.test(o.protocol.endsWith(":")?o.protocol.slice(0,-1):o.protocol))n.issues.push({code:"invalid_format",format:"url",note:"Invalid protocol",pattern:t.protocol.source,input:n.value,inst:e,continue:!t.abort})}if(t.normalize)n.value=o.href;else n.value=r;return}catch(r){n.issues.push({code:"invalid_format",format:"url",input:n.value,inst:e,continue:!t.abort})}}}),Wm=g("$ZodEmoji",(e,t)=>{t.pattern??(t.pattern=Yd()),q.init(e,t)}),Fm=g("$ZodNanoID",(e,t)=>{t.pattern??(t.pattern=Vd),q.init(e,t)}),Gm=g("$ZodCUID",(e,t)=>{t.pattern??(t.pattern=Gd),q.init(e,t)}),Zm=g("$ZodCUID2",(e,t)=>{t.pattern??(t.pattern=Zd),q.init(e,t)}),Um=g("$ZodULID",(e,t)=>{t.pattern??(t.pattern=Ud),q.init(e,t)}),jm=g("$ZodXID",(e,t)=>{t.pattern??(t.pattern=jd),q.init(e,t)}),Bm=g("$ZodKSUID",(e,t)=>{t.pattern??(t.pattern=Bd),q.init(e,t)}),Vm=g("$ZodISODateTime",(e,t)=>{t.pattern??(t.pattern=sm(t)),q.init(e,t)}),Hm=g("$ZodISODate",(e,t)=>{t.pattern??(t.pattern=om),q.init(e,t)}),qm=g("$ZodISOTime",(e,t)=>{t.pattern??(t.pattern=im(t)),q.init(e,t)}),Km=g("$ZodISODuration",(e,t)=>{t.pattern??(t.pattern=Hd),q.init(e,t)}),Ym=g("$ZodIPv4",(e,t)=>{t.pattern??(t.pattern=Jd),q.init(e,t),e._zod.bag.format="ipv4"}),Jm=g("$ZodIPv6",(e,t)=>{t.pattern??(t.pattern=Xd),q.init(e,t),e._zod.bag.format="ipv6",e._zod.check=(n)=>{try{new URL(`http://[${n.value}]`)}catch{n.issues.push({code:"invalid_format",format:"ipv6",input:n.value,inst:e,continue:!t.abort})}}}),Xm=g("$ZodMAC",(e,t)=>{t.pattern??(t.pattern=Qd(t.delimiter)),q.init(e,t),e._zod.bag.format="mac"}),Qm=g("$ZodCIDRv4",(e,t)=>{t.pattern??(t.pattern=em),q.init(e,t)}),ef=g("$ZodCIDRv6",(e,t)=>{t.pattern??(t.pattern=tm),q.init(e,t),e._zod.check=(n)=>{let r=n.value.split("/");try{if(r.length!==2)throw Error();let[o,i]=r;if(!i)throw Error();let s=Number(i);if(`${s}`!==i)throw Error();if(s<0||s>128)throw Error();new URL(`http://[${o}]`)}catch{n.issues.push({code:"invalid_format",format:"cidrv6",input:n.value,inst:e,continue:!t.abort})}}});function tf(e){if(e==="")return!0;if(e.length%4!==0)return!1;try{return atob(e),!0}catch{return!1}}var nf=g("$ZodBase64",(e,t)=>{t.pattern??(t.pattern=nm),q.init(e,t),e._zod.bag.contentEncoding="base64",e._zod.check=(n)=>{if(tf(n.value))return;n.issues.push({code:"invalid_format",format:"base64",input:n.value,inst:e,continue:!t.abort})}});function lx(e){if(!Oa.test(e))return!1;let t=e.replace(/[-_]/g,(r)=>r==="-"?"+":"/"),n=t.padEnd(Math.ceil(t.length/4)*4,"=");return tf(n)}var rf=g("$ZodBase64URL",(e,t)=>{t.pattern??(t.pattern=Oa),q.init(e,t),e._zod.bag.contentEncoding="base64url",e._zod.check=(n)=>{if(lx(n.value))return;n.issues.push({code:"invalid_format",format:"base64url",input:n.value,inst:e,continue:!t.abort})}}),of=g("$ZodE164",(e,t)=>{t.pattern??(t.pattern=rm),q.init(e,t)});function ux(e,t=null){try{let n=e.split(".");if(n.length!==3)return!1;let[r]=n;if(!r)return!1;let o=JSON.parse(atob(r));if("typ"in o&&o?.typ!=="JWT")return!1;if(!o.alg)return!1;if(t&&(!("alg"in o)||o.alg!==t))return!1;return!0}catch{return!1}}var sf=g("$ZodJWT",(e,t)=>{q.init(e,t),e._zod.check=(n)=>{if(ux(n.value,t.alg))return;n.issues.push({code:"invalid_format",format:"jwt",input:n.value,inst:e,continue:!t.abort})}}),af=g("$ZodCustomStringFormat",(e,t)=>{q.init(e,t),e._zod.check=(n)=>{if(t.fn(n.value))return;n.issues.push({code:"invalid_format",format:t.format,input:n.value,inst:e,continue:!t.abort})}}),Za=g("$ZodNumber",(e,t)=>{N.init(e,t),e._zod.pattern=e._zod.bag.pattern??za,e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=Number(n.value)}catch(s){}let o=n.value;if(typeof o==="number"&&!Number.isNaN(o)&&Number.isFinite(o))return n;let i=typeof o==="number"?Number.isNaN(o)?"NaN":!Number.isFinite(o)?"Infinity":void 0:void 0;return n.issues.push({expected:"number",code:"invalid_type",input:o,inst:e,...i?{received:i}:{}}),n}}),cf=g("$ZodNumberFormat",(e,t)=>{hm.init(e,t),Za.init(e,t)}),Xo=g("$ZodBoolean",(e,t)=>{N.init(e,t),e._zod.pattern=um,e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=Boolean(n.value)}catch(i){}let o=n.value;if(typeof o==="boolean")return n;return n.issues.push({expected:"boolean",code:"invalid_type",input:o,inst:e}),n}}),Ua=g("$ZodBigInt",(e,t)=>{N.init(e,t),e._zod.pattern=cm,e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=BigInt(n.value)}catch(o){}if(typeof n.value==="bigint")return n;return n.issues.push({expected:"bigint",code:"invalid_type",input:n.value,inst:e}),n}}),lf=g("$ZodBigIntFormat",(e,t)=>{ym.init(e,t),Ua.init(e,t)}),uf=g("$ZodSymbol",(e,t)=>{N.init(e,t),e._zod.parse=(n,r)=>{let o=n.value;if(typeof o==="symbol")return n;return n.issues.push({expected:"symbol",code:"invalid_type",input:o,inst:e}),n}}),df=g("$ZodUndefined",(e,t)=>{N.init(e,t),e._zod.pattern=mm,e._zod.values=new Set([void 0]),e._zod.optin="optional",e._zod.optout="optional",e._zod.parse=(n,r)=>{let o=n.value;if(typeof o>"u")return n;return n.issues.push({expected:"undefined",code:"invalid_type",input:o,inst:e}),n}}),mf=g("$ZodNull",(e,t)=>{N.init(e,t),e._zod.pattern=dm,e._zod.values=new Set([null]),e._zod.parse=(n,r)=>{let o=n.value;if(o===null)return n;return n.issues.push({expected:"null",code:"invalid_type",input:o,inst:e}),n}}),ff=g("$ZodAny",(e,t)=>{N.init(e,t),e._zod.parse=(n)=>n}),pf=g("$ZodUnknown",(e,t)=>{N.init(e,t),e._zod.parse=(n)=>n}),gf=g("$ZodNever",(e,t)=>{N.init(e,t),e._zod.parse=(n,r)=>(n.issues.push({expected:"never",code:"invalid_type",input:n.value,inst:e}),n)}),hf=g("$ZodVoid",(e,t)=>{N.init(e,t),e._zod.parse=(n,r)=>{let o=n.value;if(typeof o>"u")return n;return n.issues.push({expected:"void",code:"invalid_type",input:o,inst:e}),n}}),yf=g("$ZodDate",(e,t)=>{N.init(e,t),e._zod.parse=(n,r)=>{if(t.coerce)try{n.value=new Date(n.value)}catch(a){}let o=n.value,i=o instanceof Date;if(i&&!Number.isNaN(o.getTime()))return n;return n.issues.push({expected:"date",code:"invalid_type",input:o,...i?{received:"Invalid Date"}:{},inst:e}),n}});function XS(e,t,n){if(e.issues.length)t.issues.push(...Ue(n,e.issues));t.value[n]=e.value}var bf=g("$ZodArray",(e,t)=>{N.init(e,t),e._zod.parse=(n,r)=>{let o=n.value;if(!Array.isArray(o))return n.issues.push({expected:"array",code:"invalid_type",input:o,inst:e}),n;n.value=Array(o.length);let i=[];for(let s=0;s<o.length;s++){let a=o[s],c=t.element._zod.run({value:a,issues:[]},r);if(c instanceof Promise)i.push(c.then((l)=>XS(l,n,s)));else XS(c,n,s)}if(i.length)return Promise.all(i).then(()=>n);return n}});function Ga(e,t,n,r,o){if(e.issues.length){if(o&&!(n in r))return;t.issues.push(...Ue(n,e.issues))}if(e.value===void 0){if(n in r)t.value[n]=void 0}else t.value[n]=e.value}function dx(e){let t=Object.keys(e.shape);for(let r of t)if(!e.shape?.[r]?._zod?.traits?.has("$ZodType"))throw Error(`Invalid element at key "${r}": expected a Zod schema`);let n=Dd(e.shape);return{...e,keys:t,keySet:new Set(t),numKeys:t.length,optionalKeys:new Set(n)}}function mx(e,t,n,r,o,i){let s=[],a=o.keySet,c=o.catchall._zod,l=c.def.type,u=c.optout==="optional";for(let d in t){if(a.has(d))continue;if(l==="never"){s.push(d);continue}let m=c.run({value:t[d],issues:[]},r);if(m instanceof Promise)e.push(m.then((f)=>Ga(f,n,d,t,u)));else Ga(m,n,d,t,u)}if(s.length)n.issues.push({code:"unrecognized_keys",keys:s,input:t,inst:i});if(!e.length)return n;return Promise.all(e).then(()=>n)}var fx=g("$ZodObject",(e,t)=>{if(N.init(e,t),!Object.getOwnPropertyDescriptor(t,"shape")?.get){let a=t.shape;Object.defineProperty(t,"shape",{get:()=>{let c={...a};return Object.defineProperty(t,"shape",{value:c}),c}})}let r=vr(()=>dx(t));M(e._zod,"propValues",()=>{let a=t.shape,c={};for(let l in a){let u=a[l]._zod;if(u.values){c[l]??(c[l]=new Set);for(let d of u.values)c[l].add(d)}}return c});let o=Nn,i=t.catchall,s;e._zod.parse=(a,c)=>{s??(s=r.value);let l=a.value;if(!o(l))return a.issues.push({expected:"object",code:"invalid_type",input:l,inst:e}),a;a.value={};let u=[],d=s.shape;for(let m of s.keys){let f=d[m],p=f._zod.optout==="optional",h=f._zod.run({value:l[m],issues:[]},c);if(h instanceof Promise)u.push(h.then((y)=>Ga(y,a,m,l,p)));else Ga(h,a,m,l,p)}if(!i)return u.length?Promise.all(u).then(()=>a):a;return mx(u,l,a,c,r.value,e)}}),vf=g("$ZodObjectJIT",(e,t)=>{fx.init(e,t);let n=e._zod.parse,r=vr(()=>dx(t)),o=(m)=>{let f=new Ma(["shape","payload","ctx"]),p=r.value,h=(A)=>{let C=ya(A);return`shape[${C}]._zod.run({ value: input[${C}], issues: [] }, ctx)`};f.write("const input = payload.value;");let y=Object.create(null),v=0;for(let A of p.keys)y[A]=`key_${v++}`;f.write("const newResult = {};");for(let A of p.keys){let C=y[A],P=ya(A),k=m[A]?._zod?.optout==="optional";if(f.write(`const ${C} = ${h(A)};`),k)f.write(`
-        if (${C}.issues.length) {
-          if (${P} in input) {
-            payload.issues = payload.issues.concat(${C}.issues.map(iss => ({
-              ...iss,
-              path: iss.path ? [${P}, ...iss.path] : [${P}]
-            })));
-          }
-        }
-        
-        if (${C}.value === undefined) {
-          if (${P} in input) {
-            newResult[${P}] = undefined;
-          }
-        } else {
-          newResult[${P}] = ${C}.value;
-        }
-        
-      `);else f.write(`
-        if (${C}.issues.length) {
-          payload.issues = payload.issues.concat(${C}.issues.map(iss => ({
-            ...iss,
-            path: iss.path ? [${P}, ...iss.path] : [${P}]
-          })));
-        }
-        
-        if (${C}.value === undefined) {
-          if (${P} in input) {
-            newResult[${P}] = undefined;
-          }
-        } else {
-          newResult[${P}] = ${C}.value;
-        }
-        
-      `)}f.write("payload.value = newResult;"),f.write("return payload;");let E=f.compile();return(A,C)=>E(m,A,C)},i,s=Nn,a=!Go.jitless,l=a&&zd.value,u=t.catchall,d;e._zod.parse=(m,f)=>{d??(d=r.value);let p=m.value;if(!s(p))return m.issues.push({expected:"object",code:"invalid_type",input:p,inst:e}),m;if(a&&l&&f?.async===!1&&f.jitless!==!0){if(!i)i=o(t.shape);if(m=i(m,f),!u)return m;return mx([],p,m,f,d,e)}return n(m,f)}});function QS(e,t,n,r){for(let i of e)if(i.issues.length===0)return t.value=i.value,t;let o=e.filter((i)=>!rn(i));if(o.length===1)return t.value=o[0].value,o[0];return t.issues.push({code:"invalid_union",input:t.value,inst:n,errors:e.map((i)=>i.issues.map((s)=>Ie(s,r,ce())))}),t}var Qo=g("$ZodUnion",(e,t)=>{N.init(e,t),M(e._zod,"optin",()=>t.options.some((o)=>o._zod.optin==="optional")?"optional":void 0),M(e._zod,"optout",()=>t.options.some((o)=>o._zod.optout==="optional")?"optional":void 0),M(e._zod,"values",()=>{if(t.options.every((o)=>o._zod.values))return new Set(t.options.flatMap((o)=>Array.from(o._zod.values)));return}),M(e._zod,"pattern",()=>{if(t.options.every((o)=>o._zod.pattern)){let o=t.options.map((i)=>i._zod.pattern);return new RegExp(`^(${o.map((i)=>jo(i.source)).join("|")})$`)}return});let n=t.options.length===1,r=t.options[0]._zod.run;e._zod.parse=(o,i)=>{if(n)return r(o,i);let s=!1,a=[];for(let c of t.options){let l=c._zod.run({value:o.value,issues:[]},i);if(l instanceof Promise)a.push(l),s=!0;else{if(l.issues.length===0)return l;a.push(l)}}if(!s)return QS(a,o,e,i);return Promise.all(a).then((c)=>QS(c,o,e,i))}});function ex(e,t,n,r){let o=e.filter((i)=>i.issues.length===0);if(o.length===1)return t.value=o[0].value,t;if(o.length===0)t.issues.push({code:"invalid_union",input:t.value,inst:n,errors:e.map((i)=>i.issues.map((s)=>Ie(s,r,ce())))});else t.issues.push({code:"invalid_union",input:t.value,inst:n,errors:[],inclusive:!1});return t}var _f=g("$ZodXor",(e,t)=>{Qo.init(e,t),t.inclusive=!1;let n=t.options.length===1,r=t.options[0]._zod.run;e._zod.parse=(o,i)=>{if(n)return r(o,i);let s=!1,a=[];for(let c of t.options){let l=c._zod.run({value:o.value,issues:[]},i);if(l instanceof Promise)a.push(l),s=!0;else a.push(l)}if(!s)return ex(a,o,e,i);return Promise.all(a).then((c)=>ex(c,o,e,i))}}),Sf=g("$ZodDiscriminatedUnion",(e,t)=>{t.inclusive=!1,Qo.init(e,t);let n=e._zod.parse;M(e._zod,"propValues",()=>{let o={};for(let i of t.options){let s=i._zod.propValues;if(!s||Object.keys(s).length===0)throw Error(`Invalid discriminated union option at index "${t.options.indexOf(i)}"`);for(let[a,c]of Object.entries(s)){if(!o[a])o[a]=new Set;for(let l of c)o[a].add(l)}}return o});let r=vr(()=>{let o=t.options,i=new Map;for(let s of o){let a=s._zod.propValues?.[t.discriminator];if(!a||a.size===0)throw Error(`Invalid discriminated union option at index "${t.options.indexOf(s)}"`);for(let c of a){if(i.has(c))throw Error(`Duplicate discriminator value "${String(c)}"`);i.set(c,s)}}return i});e._zod.parse=(o,i)=>{let s=o.value;if(!Nn(s))return o.issues.push({code:"invalid_type",expected:"object",input:s,inst:e}),o;let a=r.value.get(s?.[t.discriminator]);if(a)return a._zod.run(o,i);if(t.unionFallback)return n(o,i);return o.issues.push({code:"invalid_union",errors:[],note:"No matching discriminator",discriminator:t.discriminator,input:s,path:[t.discriminator],inst:e}),o}}),xf=g("$ZodIntersection",(e,t)=>{N.init(e,t),e._zod.parse=(n,r)=>{let o=n.value,i=t.left._zod.run({value:o,issues:[]},r),s=t.right._zod.run({value:o,issues:[]},r);if(i instanceof Promise||s instanceof Promise)return Promise.all([i,s]).then(([c,l])=>tx(n,c,l));return tx(n,i,s)}});function Nm(e,t){if(e===t)return{valid:!0,data:e};if(e instanceof Date&&t instanceof Date&&+e===+t)return{valid:!0,data:e};if(nn(e)&&nn(t)){let n=Object.keys(t),r=Object.keys(e).filter((i)=>n.indexOf(i)!==-1),o={...e,...t};for(let i of r){let s=Nm(e[i],t[i]);if(!s.valid)return{valid:!1,mergeErrorPath:[i,...s.mergeErrorPath]};o[i]=s.data}return{valid:!0,data:o}}if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return{valid:!1,mergeErrorPath:[]};let n=[];for(let r=0;r<e.length;r++){let o=e[r],i=t[r],s=Nm(o,i);if(!s.valid)return{valid:!1,mergeErrorPath:[r,...s.mergeErrorPath]};n.push(s.data)}return{valid:!0,data:n}}return{valid:!1,mergeErrorPath:[]}}function tx(e,t,n){let r=new Map,o;for(let a of t.issues)if(a.code==="unrecognized_keys"){o??(o=a);for(let c of a.keys){if(!r.has(c))r.set(c,{});r.get(c).l=!0}}else e.issues.push(a);for(let a of n.issues)if(a.code==="unrecognized_keys")for(let c of a.keys){if(!r.has(c))r.set(c,{});r.get(c).r=!0}else e.issues.push(a);let i=[...r].filter(([,a])=>a.l&&a.r).map(([a])=>a);if(i.length&&o)e.issues.push({...o,keys:i});if(rn(e))return e;let s=Nm(t.value,n.value);if(!s.valid)throw Error(`Unmergable intersection. Error path: ${JSON.stringify(s.mergeErrorPath)}`);return e.value=s.data,e}var ja=g("$ZodTuple",(e,t)=>{N.init(e,t);let n=t.items;e._zod.parse=(r,o)=>{let i=r.value;if(!Array.isArray(i))return r.issues.push({input:i,inst:e,expected:"tuple",code:"invalid_type"}),r;r.value=[];let s=[],a=[...n].reverse().findIndex((u)=>u._zod.optin!=="optional"),c=a===-1?0:n.length-a;if(!t.rest){let u=i.length>n.length,d=i.length<c-1;if(u||d)return r.issues.push({...u?{code:"too_big",maximum:n.length,inclusive:!0}:{code:"too_small",minimum:n.length},input:i,inst:e,origin:"array"}),r}let l=-1;for(let u of n){if(l++,l>=i.length){if(l>=c)continue}let d=u._zod.run({value:i[l],issues:[]},o);if(d instanceof Promise)s.push(d.then((m)=>$a(m,r,l)));else $a(d,r,l)}if(t.rest){let u=i.slice(n.length);for(let d of u){l++;let m=t.rest._zod.run({value:d,issues:[]},o);if(m instanceof Promise)s.push(m.then((f)=>$a(f,r,l)));else $a(m,r,l)}}if(s.length)return Promise.all(s).then(()=>r);return r}});function $a(e,t,n){if(e.issues.length)t.issues.push(...Ue(n,e.issues));t.value[n]=e.value}var Cf=g("$ZodRecord",(e,t)=>{N.init(e,t),e._zod.parse=(n,r)=>{let o=n.value;if(!nn(o))return n.issues.push({expected:"record",code:"invalid_type",input:o,inst:e}),n;let i=[],s=t.keyType._zod.values;if(s){n.value={};let a=new Set;for(let l of s)if(typeof l==="string"||typeof l==="number"||typeof l==="symbol"){a.add(typeof l==="number"?l.toString():l);let u=t.valueType._zod.run({value:o[l],issues:[]},r);if(u instanceof Promise)i.push(u.then((d)=>{if(d.issues.length)n.issues.push(...Ue(l,d.issues));n.value[l]=d.value}));else{if(u.issues.length)n.issues.push(...Ue(l,u.issues));n.value[l]=u.value}}let c;for(let l in o)if(!a.has(l))c=c??[],c.push(l);if(c&&c.length>0)n.issues.push({code:"unrecognized_keys",input:o,inst:e,keys:c})}else{n.value={};for(let a of Reflect.ownKeys(o)){if(a==="__proto__")continue;let c=t.keyType._zod.run({value:a,issues:[]},r);if(c instanceof Promise)throw Error("Async schemas not supported in object keys currently");if(typeof a==="string"&&za.test(a)&&c.issues.length&&c.issues.some((d)=>d.code==="invalid_type"&&d.expected==="number")){let d=t.keyType._zod.run({value:Number(a),issues:[]},r);if(d instanceof Promise)throw Error("Async schemas not supported in object keys currently");if(d.issues.length===0)c=d}if(c.issues.length){if(t.mode==="loose")n.value[a]=o[a];else n.issues.push({code:"invalid_key",origin:"record",issues:c.issues.map((d)=>Ie(d,r,ce())),input:a,path:[a],inst:e});continue}let u=t.valueType._zod.run({value:o[a],issues:[]},r);if(u instanceof Promise)i.push(u.then((d)=>{if(d.issues.length)n.issues.push(...Ue(a,d.issues));n.value[c.value]=d.value}));else{if(u.issues.length)n.issues.push(...Ue(a,u.issues));n.value[c.value]=u.value}}}if(i.length)return Promise.all(i).then(()=>n);return n}}),Ef=g("$ZodMap",(e,t)=>{N.init(e,t),e._zod.parse=(n,r)=>{let o=n.value;if(!(o instanceof Map))return n.issues.push({expected:"map",code:"invalid_type",input:o,inst:e}),n;let i=[];n.value=new Map;for(let[s,a]of o){let c=t.keyType._zod.run({value:s,issues:[]},r),l=t.valueType._zod.run({value:a,issues:[]},r);if(c instanceof Promise||l instanceof Promise)i.push(Promise.all([c,l]).then(([u,d])=>{nx(u,d,n,s,o,e,r)}));else nx(c,l,n,s,o,e,r)}if(i.length)return Promise.all(i).then(()=>n);return n}});function nx(e,t,n,r,o,i,s){if(e.issues.length)if(Vo.has(typeof r))n.issues.push(...Ue(r,e.issues));else n.issues.push({code:"invalid_key",origin:"map",input:o,inst:i,issues:e.issues.map((a)=>Ie(a,s,ce()))});if(t.issues.length)if(Vo.has(typeof r))n.issues.push(...Ue(r,t.issues));else n.issues.push({origin:"map",code:"invalid_element",input:o,inst:i,key:r,issues:t.issues.map((a)=>Ie(a,s,ce()))});n.value.set(e.value,t.value)}var wf=g("$ZodSet",(e,t)=>{N.init(e,t),e._zod.parse=(n,r)=>{let o=n.value;if(!(o instanceof Set))return n.issues.push({input:o,inst:e,expected:"set",code:"invalid_type"}),n;let i=[];n.value=new Set;for(let s of o){let a=t.valueType._zod.run({value:s,issues:[]},r);if(a instanceof Promise)i.push(a.then((c)=>rx(c,n)));else rx(a,n)}if(i.length)return Promise.all(i).then(()=>n);return n}});function rx(e,t){if(e.issues.length)t.issues.push(...e.issues);t.value.add(e.value)}var Rf=g("$ZodEnum",(e,t)=>{N.init(e,t);let n=Uo(t.entries),r=new Set(n);e._zod.values=r,e._zod.pattern=new RegExp(`^(${n.filter((o)=>Vo.has(typeof o)).map((o)=>typeof o==="string"?Je(o):o.toString()).join("|")})$`),e._zod.parse=(o,i)=>{let s=o.value;if(r.has(s))return o;return o.issues.push({code:"invalid_value",values:n,input:s,inst:e}),o}}),Pf=g("$ZodLiteral",(e,t)=>{if(N.init(e,t),t.values.length===0)throw Error("Cannot create literal schema with no valid values");let n=new Set(t.values);e._zod.values=n,e._zod.pattern=new RegExp(`^(${t.values.map((r)=>typeof r==="string"?Je(r):r?Je(r.toString()):String(r)).join("|")})$`),e._zod.parse=(r,o)=>{let i=r.value;if(n.has(i))return r;return r.issues.push({code:"invalid_value",values:t.values,input:i,inst:e}),r}}),Af=g("$ZodFile",(e,t)=>{N.init(e,t),e._zod.parse=(n,r)=>{let o=n.value;if(o instanceof File)return n;return n.issues.push({expected:"file",code:"invalid_type",input:o,inst:e}),n}}),kf=g("$ZodTransform",(e,t)=>{N.init(e,t),e._zod.parse=(n,r)=>{if(r.direction==="backward")throw new zn(e.constructor.name);let o=t.transform(n.value,n);if(r.async)return(o instanceof Promise?o:Promise.resolve(o)).then((s)=>(n.value=s,n));if(o instanceof Promise)throw new xt;return n.value=o,n}});function ox(e,t){if(e.issues.length&&t===void 0)return{issues:[],value:void 0};return e}var Ba=g("$ZodOptional",(e,t)=>{N.init(e,t),e._zod.optin="optional",e._zod.optout="optional",M(e._zod,"values",()=>t.innerType._zod.values?new Set([...t.innerType._zod.values,void 0]):void 0),M(e._zod,"pattern",()=>{let n=t.innerType._zod.pattern;return n?new RegExp(`^(${jo(n.source)})?$`):void 0}),e._zod.parse=(n,r)=>{if(t.innerType._zod.optin==="optional"){let o=t.innerType._zod.run(n,r);if(o instanceof Promise)return o.then((i)=>ox(i,n.value));return ox(o,n.value)}if(n.value===void 0)return n;return t.innerType._zod.run(n,r)}}),Tf=g("$ZodExactOptional",(e,t)=>{Ba.init(e,t),M(e._zod,"values",()=>t.innerType._zod.values),M(e._zod,"pattern",()=>t.innerType._zod.pattern),e._zod.parse=(n,r)=>t.innerType._zod.run(n,r)}),If=g("$ZodNullable",(e,t)=>{N.init(e,t),M(e._zod,"optin",()=>t.innerType._zod.optin),M(e._zod,"optout",()=>t.innerType._zod.optout),M(e._zod,"pattern",()=>{let n=t.innerType._zod.pattern;return n?new RegExp(`^(${jo(n.source)}|null)$`):void 0}),M(e._zod,"values",()=>t.innerType._zod.values?new Set([...t.innerType._zod.values,null]):void 0),e._zod.parse=(n,r)=>{if(n.value===null)return n;return t.innerType._zod.run(n,r)}}),Of=g("$ZodDefault",(e,t)=>{N.init(e,t),e._zod.optin="optional",M(e._zod,"values",()=>t.innerType._zod.values),e._zod.parse=(n,r)=>{if(r.direction==="backward")return t.innerType._zod.run(n,r);if(n.value===void 0)return n.value=t.defaultValue,n;let o=t.innerType._zod.run(n,r);if(o instanceof Promise)return o.then((i)=>ix(i,t));return ix(o,t)}});function ix(e,t){if(e.value===void 0)e.value=t.defaultValue;return e}var zf=g("$ZodPrefault",(e,t)=>{N.init(e,t),e._zod.optin="optional",M(e._zod,"values",()=>t.innerType._zod.values),e._zod.parse=(n,r)=>{if(r.direction==="backward")return t.innerType._zod.run(n,r);if(n.value===void 0)n.value=t.defaultValue;return t.innerType._zod.run(n,r)}}),Nf=g("$ZodNonOptional",(e,t)=>{N.init(e,t),M(e._zod,"values",()=>{let n=t.innerType._zod.values;return n?new Set([...n].filter((r)=>r!==void 0)):void 0}),e._zod.parse=(n,r)=>{let o=t.innerType._zod.run(n,r);if(o instanceof Promise)return o.then((i)=>sx(i,e));return sx(o,e)}});function sx(e,t){if(!e.issues.length&&e.value===void 0)e.issues.push({code:"invalid_type",expected:"nonoptional",input:e.value,inst:t});return e}var Df=g("$ZodSuccess",(e,t)=>{N.init(e,t),e._zod.parse=(n,r)=>{if(r.direction==="backward")throw new zn("ZodSuccess");let o=t.innerType._zod.run(n,r);if(o instanceof Promise)return o.then((i)=>(n.value=i.issues.length===0,n));return n.value=o.issues.length===0,n}}),Mf=g("$ZodCatch",(e,t)=>{N.init(e,t),M(e._zod,"optin",()=>t.innerType._zod.optin),M(e._zod,"optout",()=>t.innerType._zod.optout),M(e._zod,"values",()=>t.innerType._zod.values),e._zod.parse=(n,r)=>{if(r.direction==="backward")return t.innerType._zod.run(n,r);let o=t.innerType._zod.run(n,r);if(o instanceof Promise)return o.then((i)=>{if(n.value=i.value,i.issues.length)n.value=t.catchValue({...n,error:{issues:i.issues.map((s)=>Ie(s,r,ce()))},input:n.value}),n.issues=[];return n});if(n.value=o.value,o.issues.length)n.value=t.catchValue({...n,error:{issues:o.issues.map((i)=>Ie(i,r,ce()))},input:n.value}),n.issues=[];return n}}),$f=g("$ZodNaN",(e,t)=>{N.init(e,t),e._zod.parse=(n,r)=>{if(typeof n.value!=="number"||!Number.isNaN(n.value))return n.issues.push({input:n.value,inst:e,expected:"nan",code:"invalid_type"}),n;return n}}),Lf=g("$ZodPipe",(e,t)=>{N.init(e,t),M(e._zod,"values",()=>t.in._zod.values),M(e._zod,"optin",()=>t.in._zod.optin),M(e._zod,"optout",()=>t.out._zod.optout),M(e._zod,"propValues",()=>t.in._zod.propValues),e._zod.parse=(n,r)=>{if(r.direction==="backward"){let i=t.out._zod.run(n,r);if(i instanceof Promise)return i.then((s)=>La(s,t.in,r));return La(i,t.in,r)}let o=t.in._zod.run(n,r);if(o instanceof Promise)return o.then((i)=>La(i,t.out,r));return La(o,t.out,r)}});function La(e,t,n){if(e.issues.length)return e.aborted=!0,e;return t._zod.run({value:e.value,issues:e.issues},n)}var ei=g("$ZodCodec",(e,t)=>{N.init(e,t),M(e._zod,"values",()=>t.in._zod.values),M(e._zod,"optin",()=>t.in._zod.optin),M(e._zod,"optout",()=>t.out._zod.optout),M(e._zod,"propValues",()=>t.in._zod.propValues),e._zod.parse=(n,r)=>{if((r.direction||"forward")==="forward"){let i=t.in._zod.run(n,r);if(i instanceof Promise)return i.then((s)=>Wa(s,t,r));return Wa(i,t,r)}else{let i=t.out._zod.run(n,r);if(i instanceof Promise)return i.then((s)=>Wa(s,t,r));return Wa(i,t,r)}}});function Wa(e,t,n){if(e.issues.length)return e.aborted=!0,e;if((n.direction||"forward")==="forward"){let o=t.transform(e.value,e);if(o instanceof Promise)return o.then((i)=>Fa(e,i,t.out,n));return Fa(e,o,t.out,n)}else{let o=t.reverseTransform(e.value,e);if(o instanceof Promise)return o.then((i)=>Fa(e,i,t.in,n));return Fa(e,o,t.in,n)}}function Fa(e,t,n,r){if(e.issues.length)return e.aborted=!0,e;return n._zod.run({value:t,issues:e.issues},r)}var Wf=g("$ZodReadonly",(e,t)=>{N.init(e,t),M(e._zod,"propValues",()=>t.innerType._zod.propValues),M(e._zod,"values",()=>t.innerType._zod.values),M(e._zod,"optin",()=>t.innerType?._zod?.optin),M(e._zod,"optout",()=>t.innerType?._zod?.optout),e._zod.parse=(n,r)=>{if(r.direction==="backward")return t.innerType._zod.run(n,r);let o=t.innerType._zod.run(n,r);if(o instanceof Promise)return o.then(ax);return ax(o)}});function ax(e){return e.value=Object.freeze(e.value),e}var Ff=g("$ZodTemplateLiteral",(e,t)=>{N.init(e,t);let n=[];for(let r of t.parts)if(typeof r==="object"&&r!==null){if(!r._zod.pattern)throw Error(`Invalid template literal part, no pattern found: ${[...r._zod.traits].shift()}`);let o=r._zod.pattern instanceof RegExp?r._zod.pattern.source:r._zod.pattern;if(!o)throw Error(`Invalid template literal part: ${r._zod.traits}`);let i=o.startsWith("^")?1:0,s=o.endsWith("$")?o.length-1:o.length;n.push(o.slice(i,s))}else if(r===null||Nd.has(typeof r))n.push(Je(`${r}`));else throw Error(`Invalid template literal part: ${r}`);e._zod.pattern=new RegExp(`^${n.join("")}$`),e._zod.parse=(r,o)=>{if(typeof r.value!=="string")return r.issues.push({input:r.value,inst:e,expected:"string",code:"invalid_type"}),r;if(e._zod.pattern.lastIndex=0,!e._zod.pattern.test(r.value))return r.issues.push({input:r.value,inst:e,code:"invalid_format",format:t.format??"template_literal",pattern:e._zod.pattern.source}),r;return r}}),Gf=g("$ZodFunction",(e,t)=>(N.init(e,t),e._def=t,e._zod.def=t,e.implement=(n)=>{if(typeof n!=="function")throw Error("implement() must be called with a function");return function(...r){let o=e._def.input?xa(e._def.input,r):r,i=Reflect.apply(n,this,o);if(e._def.output)return xa(e._def.output,i);return i}},e.implementAsync=(n)=>{if(typeof n!=="function")throw Error("implementAsync() must be called with a function");return async function(...r){let o=e._def.input?await Ca(e._def.input,r):r,i=await Reflect.apply(n,this,o);if(e._def.output)return await Ca(e._def.output,i);return i}},e._zod.parse=(n,r)=>{if(typeof n.value!=="function")return n.issues.push({code:"invalid_type",expected:"function",input:n.value,inst:e}),n;if(e._def.output&&e._def.output._zod.def.type==="promise")n.value=e.implementAsync(n.value);else n.value=e.implement(n.value);return n},e.input=(...n)=>{let r=e.constructor;if(Array.isArray(n[0]))return new r({type:"function",input:new ja({type:"tuple",items:n[0],rest:n[1]}),output:e._def.output});return new r({type:"function",input:n[0],output:e._def.output})},e.output=(n)=>new e.constructor({type:"function",input:e._def.input,output:n}),e)),Zf=g("$ZodPromise",(e,t)=>{N.init(e,t),e._zod.parse=(n,r)=>Promise.resolve(n.value).then((o)=>t.innerType._zod.run({value:o,issues:[]},r))}),Uf=g("$ZodLazy",(e,t)=>{N.init(e,t),M(e._zod,"innerType",()=>t.getter()),M(e._zod,"pattern",()=>e._zod.innerType?._zod?.pattern),M(e._zod,"propValues",()=>e._zod.innerType?._zod?.propValues),M(e._zod,"optin",()=>e._zod.innerType?._zod?.optin??void 0),M(e._zod,"optout",()=>e._zod.innerType?._zod?.optout??void 0),e._zod.parse=(n,r)=>e._zod.innerType._zod.run(n,r)}),jf=g("$ZodCustom",(e,t)=>{X.init(e,t),N.init(e,t),e._zod.parse=(n,r)=>n,e._zod.check=(n)=>{let r=n.value,o=t.fn(r);if(o instanceof Promise)return o.then((i)=>cx(i,n,r,e));cx(o,n,r,e);return}});function cx(e,t,n,r){if(!e){let o={code:"custom",input:n,inst:r,path:[...r._zod.def.path??[]],continue:!r._zod.def.abort};if(r._zod.def.params)o.params=r._zod.def.params;t.issues.push(on(o))}}var ti={};var px,Va=Symbol("ZodOutput"),Ha=Symbol("ZodInput");class Bf{constructor(){this._map=new WeakMap,this._idmap=new Map}add(e,...t){let n=t[0];if(this._map.set(e,n),n&&typeof n==="object"&&"id"in n)this._idmap.set(n.id,e);return this}clear(){return this._map=new WeakMap,this._idmap=new Map,this}remove(e){let t=this._map.get(e);if(t&&typeof t==="object"&&"id"in t)this._idmap.delete(t.id);return this._map.delete(e),this}get(e){let t=e._zod.parent;if(t){let n={...this.get(t)??{}};delete n.id;let r={...n,...this._map.get(e)};return Object.keys(r).length?r:void 0}return this._map.get(e)}has(e){return this._map.has(e)}}function ni(){return new Bf}(px=globalThis).__zod_globalRegistry??(px.__zod_globalRegistry=ni());var ze=globalThis.__zod_globalRegistry;function Vf(e,t){return new e({type:"string",...b(t)})}function Hf(e,t){return new e({type:"string",coerce:!0,...b(t)})}function qa(e,t){return new e({type:"string",format:"email",check:"string_format",abort:!1,...b(t)})}function ri(e,t){return new e({type:"string",format:"guid",check:"string_format",abort:!1,...b(t)})}function Ka(e,t){return new e({type:"string",format:"uuid",check:"string_format",abort:!1,...b(t)})}function Ya(e,t){return new e({type:"string",format:"uuid",check:"string_format",abort:!1,version:"v4",...b(t)})}function Ja(e,t){return new e({type:"string",format:"uuid",check:"string_format",abort:!1,version:"v6",...b(t)})}function Xa(e,t){return new e({type:"string",format:"uuid",check:"string_format",abort:!1,version:"v7",...b(t)})}function oi(e,t){return new e({type:"string",format:"url",check:"string_format",abort:!1,...b(t)})}function Qa(e,t){return new e({type:"string",format:"emoji",check:"string_format",abort:!1,...b(t)})}function ec(e,t){return new e({type:"string",format:"nanoid",check:"string_format",abort:!1,...b(t)})}function tc(e,t){return new e({type:"string",format:"cuid",check:"string_format",abort:!1,...b(t)})}function nc(e,t){return new e({type:"string",format:"cuid2",check:"string_format",abort:!1,...b(t)})}function rc(e,t){return new e({type:"string",format:"ulid",check:"string_format",abort:!1,...b(t)})}function oc(e,t){return new e({type:"string",format:"xid",check:"string_format",abort:!1,...b(t)})}function ic(e,t){return new e({type:"string",format:"ksuid",check:"string_format",abort:!1,...b(t)})}function sc(e,t){return new e({type:"string",format:"ipv4",check:"string_format",abort:!1,...b(t)})}function ac(e,t){return new e({type:"string",format:"ipv6",check:"string_format",abort:!1,...b(t)})}function qf(e,t){return new e({type:"string",format:"mac",check:"string_format",abort:!1,...b(t)})}function cc(e,t){return new e({type:"string",format:"cidrv4",check:"string_format",abort:!1,...b(t)})}function lc(e,t){return new e({type:"string",format:"cidrv6",check:"string_format",abort:!1,...b(t)})}function uc(e,t){return new e({type:"string",format:"base64",check:"string_format",abort:!1,...b(t)})}function dc(e,t){return new e({type:"string",format:"base64url",check:"string_format",abort:!1,...b(t)})}function mc(e,t){return new e({type:"string",format:"e164",check:"string_format",abort:!1,...b(t)})}function fc(e,t){return new e({type:"string",format:"jwt",check:"string_format",abort:!1,...b(t)})}var pc={Any:null,Minute:-1,Second:0,Millisecond:3,Microsecond:6};function Kf(e,t){return new e({type:"string",format:"datetime",check:"string_format",offset:!1,local:!1,precision:null,...b(t)})}function Yf(e,t){return new e({type:"string",format:"date",check:"string_format",...b(t)})}function Jf(e,t){return new e({type:"string",format:"time",check:"string_format",precision:null,...b(t)})}function Xf(e,t){return new e({type:"string",format:"duration",check:"string_format",...b(t)})}function Qf(e,t){return new e({type:"number",checks:[],...b(t)})}function ep(e,t){return new e({type:"number",coerce:!0,checks:[],...b(t)})}function tp(e,t){return new e({type:"number",check:"number_format",abort:!1,format:"safeint",...b(t)})}function np(e,t){return new e({type:"number",check:"number_format",abort:!1,format:"float32",...b(t)})}function rp(e,t){return new e({type:"number",check:"number_format",abort:!1,format:"float64",...b(t)})}function op(e,t){return new e({type:"number",check:"number_format",abort:!1,format:"int32",...b(t)})}function ip(e,t){return new e({type:"number",check:"number_format",abort:!1,format:"uint32",...b(t)})}function sp(e,t){return new e({type:"boolean",...b(t)})}function ap(e,t){return new e({type:"boolean",coerce:!0,...b(t)})}function cp(e,t){return new e({type:"bigint",...b(t)})}function lp(e,t){return new e({type:"bigint",coerce:!0,...b(t)})}function up(e,t){return new e({type:"bigint",check:"bigint_format",abort:!1,format:"int64",...b(t)})}function dp(e,t){return new e({type:"bigint",check:"bigint_format",abort:!1,format:"uint64",...b(t)})}function mp(e,t){return new e({type:"symbol",...b(t)})}function fp(e,t){return new e({type:"undefined",...b(t)})}function pp(e,t){return new e({type:"null",...b(t)})}function gp(e){return new e({type:"any"})}function hp(e){return new e({type:"unknown"})}function yp(e,t){return new e({type:"never",...b(t)})}function bp(e,t){return new e({type:"void",...b(t)})}function vp(e,t){return new e({type:"date",...b(t)})}function _p(e,t){return new e({type:"date",coerce:!0,...b(t)})}function Sp(e,t){return new e({type:"nan",...b(t)})}function wt(e,t){return new Na({check:"less_than",...b(t),value:e,inclusive:!1})}function je(e,t){return new Na({check:"less_than",...b(t),value:e,inclusive:!0})}function Rt(e,t){return new Da({check:"greater_than",...b(t),value:e,inclusive:!1})}function Ee(e,t){return new Da({check:"greater_than",...b(t),value:e,inclusive:!0})}function gc(e){return Rt(0,e)}function hc(e){return wt(0,e)}function yc(e){return je(0,e)}function bc(e){return Ee(0,e)}function sn(e,t){return new gm({check:"multiple_of",...b(t),value:e})}function an(e,t){return new bm({check:"max_size",...b(t),maximum:e})}function Pt(e,t){return new vm({check:"min_size",...b(t),minimum:e})}function $n(e,t){return new _m({check:"size_equals",...b(t),size:e})}function Ln(e,t){return new Sm({check:"max_length",...b(t),maximum:e})}function Ft(e,t){return new xm({check:"min_length",...b(t),minimum:e})}function Wn(e,t){return new Cm({check:"length_equals",...b(t),length:e})}function Pr(e,t){return new Em({check:"string_format",format:"regex",...b(t),pattern:e})}function Ar(e){return new wm({check:"string_format",format:"lowercase",...b(e)})}function kr(e){return new Rm({check:"string_format",format:"uppercase",...b(e)})}function Tr(e,t){return new Pm({check:"string_format",format:"includes",...b(t),includes:e})}function Ir(e,t){return new Am({check:"string_format",format:"starts_with",...b(t),prefix:e})}function Or(e,t){return new km({check:"string_format",format:"ends_with",...b(t),suffix:e})}function vc(e,t,n){return new Tm({check:"property",property:e,schema:t,...b(n)})}function zr(e,t){return new Im({check:"mime_type",mime:e,...b(t)})}function lt(e){return new Om({check:"overwrite",tx:e})}function Nr(e){return lt((t)=>t.normalize(e))}function Dr(){return lt((e)=>e.trim())}function Mr(){return lt((e)=>e.toLowerCase())}function $r(){return lt((e)=>e.toUpperCase())}function Lr(){return lt((e)=>Od(e))}function xp(e,t,n){return new e({type:"array",element:t,...b(n)})}function u0(e,t,n){return new e({type:"union",options:t,...b(n)})}function d0(e,t,n){return new e({type:"union",options:t,inclusive:!1,...b(n)})}function m0(e,t,n,r){return new e({type:"union",options:n,discriminator:t,...b(r)})}function f0(e,t,n){return new e({type:"intersection",left:t,right:n})}function p0(e,t,n,r){let o=n instanceof N;return new e({type:"tuple",items:t,rest:o?n:null,...b(o?r:n)})}function g0(e,t,n,r){return new e({type:"record",keyType:t,valueType:n,...b(r)})}function h0(e,t,n,r){return new e({type:"map",keyType:t,valueType:n,...b(r)})}function y0(e,t,n){return new e({type:"set",valueType:t,...b(n)})}function b0(e,t,n){let r=Array.isArray(t)?Object.fromEntries(t.map((o)=>[o,o])):t;return new e({type:"enum",entries:r,...b(n)})}function v0(e,t,n){return new e({type:"enum",entries:t,...b(n)})}function _0(e,t,n){return new e({type:"literal",values:Array.isArray(t)?t:[t],...b(n)})}function Cp(e,t){return new e({type:"file",...b(t)})}function S0(e,t){return new e({type:"transform",transform:t})}function x0(e,t){return new e({type:"optional",innerType:t})}function C0(e,t){return new e({type:"nullable",innerType:t})}function E0(e,t,n){return new e({type:"default",innerType:t,get defaultValue(){return typeof n==="function"?n():Bo(n)}})}function w0(e,t,n){return new e({type:"nonoptional",innerType:t,...b(n)})}function R0(e,t){return new e({type:"success",innerType:t})}function P0(e,t,n){return new e({type:"catch",innerType:t,catchValue:typeof n==="function"?n:()=>n})}function A0(e,t,n){return new e({type:"pipe",in:t,out:n})}function k0(e,t){return new e({type:"readonly",innerType:t})}function T0(e,t,n){return new e({type:"template_literal",parts:t,...b(n)})}function I0(e,t){return new e({type:"lazy",getter:t})}function O0(e,t){return new e({type:"promise",innerType:t})}function Ep(e,t,n){let r=b(n);return r.abort??(r.abort=!0),new e({type:"custom",check:"custom",fn:t,...r})}function wp(e,t,n){return new e({type:"custom",check:"custom",fn:t,...b(n)})}function Rp(e){let t=gx((n)=>(n.addIssue=(r)=>{if(typeof r==="string")n.issues.push(on(r,n.value,t._zod.def));else{let o=r;if(o.fatal)o.continue=!1;o.code??(o.code="custom"),o.input??(o.input=n.value),o.inst??(o.inst=t),o.continue??(o.continue=!t._zod.def.abort),n.issues.push(on(o))}},e(n.value,n)));return t}function gx(e,t){let n=new X({check:"custom",...b(t)});return n._zod.check=e,n}function Pp(e){let t=new X({check:"describe"});return t._zod.onattach=[(n)=>{let r=ze.get(n)??{};ze.add(n,{...r,description:e})}],t._zod.check=()=>{},t}function Ap(e){let t=new X({check:"meta"});return t._zod.onattach=[(n)=>{let r=ze.get(n)??{};ze.add(n,{...r,...e})}],t._zod.check=()=>{},t}function kp(e,t){let n=b(t),r=n.truthy??["true","1","yes","on","y","enabled"],o=n.falsy??["false","0","no","off","n","disabled"];if(n.case!=="sensitive")r=r.map((f)=>typeof f==="string"?f.toLowerCase():f),o=o.map((f)=>typeof f==="string"?f.toLowerCase():f);let i=new Set(r),s=new Set(o),a=e.Codec??ei,c=e.Boolean??Xo,u=new(e.String??Mn)({type:"string",error:n.error}),d=new c({type:"boolean",error:n.error}),m=new a({type:"pipe",in:u,out:d,transform:(f,p)=>{let h=f;if(n.case!=="sensitive")h=h.toLowerCase();if(i.has(h))return!0;else if(s.has(h))return!1;else return p.issues.push({code:"invalid_value",expected:"stringbool",values:[...i,...s],input:p.value,inst:m,continue:!1}),{}},reverseTransform:(f,p)=>{if(f===!0)return r[0]||"true";else return o[0]||"false"},error:n.error});return m}function Wr(e,t,n,r={}){let o=b(r),i={...b(r),check:"string_format",type:"string",format:t,fn:typeof n==="function"?n:(a)=>n.test(a),...o};if(n instanceof RegExp)i.pattern=n;return new e(i)}var Fr=()=>{throw Error("JSON Schema conversion is not bundled into this plugin artifact")},Tp=()=>Fr,_c=()=>Fr,Gr=Fr,Q=Fr,Zr=Fr,Ur=Fr;var z0={guid:"uuid",url:"uri",datetime:"date-time",json_string:"json-string",regex:""},Ip=(e,t,n,r)=>{let o=n;o.type="string";let{minimum:i,maximum:s,format:a,patterns:c,contentEncoding:l}=e._zod.bag;if(typeof i==="number")o.minLength=i;if(typeof s==="number")o.maxLength=s;if(a){if(o.format=z0[a]??a,o.format==="")delete o.format;if(a==="time")delete o.format}if(l)o.contentEncoding=l;if(c&&c.size>0){let u=[...c];if(u.length===1)o.pattern=u[0].source;else if(u.length>1)o.allOf=[...u.map((d)=>({...t.target==="draft-07"||t.target==="draft-04"||t.target==="openapi-3.0"?{type:"string"}:{},pattern:d.source}))]}},Op=(e,t,n,r)=>{let o=n,{minimum:i,maximum:s,format:a,multipleOf:c,exclusiveMaximum:l,exclusiveMinimum:u}=e._zod.bag;if(typeof a==="string"&&a.includes("int"))o.type="integer";else o.type="number";if(typeof u==="number")if(t.target==="draft-04"||t.target==="openapi-3.0")o.minimum=u,o.exclusiveMinimum=!0;else o.exclusiveMinimum=u;if(typeof i==="number"){if(o.minimum=i,typeof u==="number"&&t.target!=="draft-04")if(u>=i)delete o.minimum;else delete o.exclusiveMinimum}if(typeof l==="number")if(t.target==="draft-04"||t.target==="openapi-3.0")o.maximum=l,o.exclusiveMaximum=!0;else o.exclusiveMaximum=l;if(typeof s==="number"){if(o.maximum=s,typeof l==="number"&&t.target!=="draft-04")if(l<=s)delete o.maximum;else delete o.exclusiveMaximum}if(typeof c==="number")o.multipleOf=c},zp=(e,t,n,r)=>{n.type="boolean"},Np=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("BigInt cannot be represented in JSON Schema")},Dp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Symbols cannot be represented in JSON Schema")},Mp=(e,t,n,r)=>{if(t.target==="openapi-3.0")n.type="string",n.nullable=!0,n.enum=[null];else n.type="null"},$p=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Undefined cannot be represented in JSON Schema")},Lp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Void cannot be represented in JSON Schema")},Wp=(e,t,n,r)=>{n.not={}},Fp=(e,t,n,r)=>{},Gp=(e,t,n,r)=>{},Zp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Date cannot be represented in JSON Schema")},Up=(e,t,n,r)=>{let o=e._zod.def,i=Uo(o.entries);if(i.every((s)=>typeof s==="number"))n.type="number";if(i.every((s)=>typeof s==="string"))n.type="string";n.enum=i},jp=(e,t,n,r)=>{let o=e._zod.def,i=[];for(let s of o.values)if(s===void 0){if(t.unrepresentable==="throw")throw Error("Literal `undefined` cannot be represented in JSON Schema")}else if(typeof s==="bigint")if(t.unrepresentable==="throw")throw Error("BigInt literals cannot be represented in JSON Schema");else i.push(Number(s));else i.push(s);if(i.length===0);else if(i.length===1){let s=i[0];if(n.type=s===null?"null":typeof s,t.target==="draft-04"||t.target==="openapi-3.0")n.enum=[s];else n.const=s}else{if(i.every((s)=>typeof s==="number"))n.type="number";if(i.every((s)=>typeof s==="string"))n.type="string";if(i.every((s)=>typeof s==="boolean"))n.type="boolean";if(i.every((s)=>s===null))n.type="null";n.enum=i}},Bp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("NaN cannot be represented in JSON Schema")},Vp=(e,t,n,r)=>{let o=n,i=e._zod.pattern;if(!i)throw Error("Pattern not found in template literal");o.type="string",o.pattern=i.source},Hp=(e,t,n,r)=>{let o=n,i={type:"string",format:"binary",contentEncoding:"binary"},{minimum:s,maximum:a,mime:c}=e._zod.bag;if(s!==void 0)i.minLength=s;if(a!==void 0)i.maxLength=a;if(c)if(c.length===1)i.contentMediaType=c[0],Object.assign(o,i);else Object.assign(o,i),o.anyOf=c.map((l)=>({contentMediaType:l}));else Object.assign(o,i)},qp=(e,t,n,r)=>{n.type="boolean"},Kp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Custom types cannot be represented in JSON Schema")},Yp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Function types cannot be represented in JSON Schema")},Jp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Transforms cannot be represented in JSON Schema")},Xp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Map cannot be represented in JSON Schema")},Qp=(e,t,n,r)=>{if(t.unrepresentable==="throw")throw Error("Set cannot be represented in JSON Schema")},eg=(e,t,n,r)=>{let o=n,i=e._zod.def,{minimum:s,maximum:a}=e._zod.bag;if(typeof s==="number")o.minItems=s;if(typeof a==="number")o.maxItems=a;o.type="array",o.items=Q(i.element,t,{...r,path:[...r.path,"items"]})},tg=(e,t,n,r)=>{let o=n,i=e._zod.def;o.type="object",o.properties={};let s=i.shape;for(let l in s)o.properties[l]=Q(s[l],t,{...r,path:[...r.path,"properties",l]});let a=new Set(Object.keys(s)),c=new Set([...a].filter((l)=>{let u=i.shape[l]._zod;if(t.io==="input")return u.optin===void 0;else return u.optout===void 0}));if(c.size>0)o.required=Array.from(c);if(i.catchall?._zod.def.type==="never")o.additionalProperties=!1;else if(!i.catchall){if(t.io==="output")o.additionalProperties=!1}else if(i.catchall)o.additionalProperties=Q(i.catchall,t,{...r,path:[...r.path,"additionalProperties"]})},xc=(e,t,n,r)=>{let o=e._zod.def,i=o.inclusive===!1,s=o.options.map((a,c)=>Q(a,t,{...r,path:[...r.path,i?"oneOf":"anyOf",c]}));if(i)n.oneOf=s;else n.anyOf=s},ng=(e,t,n,r)=>{let o=e._zod.def,i=Q(o.left,t,{...r,path:[...r.path,"allOf",0]}),s=Q(o.right,t,{...r,path:[...r.path,"allOf",1]}),a=(l)=>("allOf"in l)&&Object.keys(l).length===1,c=[...a(i)?i.allOf:[i],...a(s)?s.allOf:[s]];n.allOf=c},rg=(e,t,n,r)=>{let o=n,i=e._zod.def;o.type="array";let s=t.target==="draft-2020-12"?"prefixItems":"items",a=t.target==="draft-2020-12"?"items":t.target==="openapi-3.0"?"items":"additionalItems",c=i.items.map((m,f)=>Q(m,t,{...r,path:[...r.path,s,f]})),l=i.rest?Q(i.rest,t,{...r,path:[...r.path,a,...t.target==="openapi-3.0"?[i.items.length]:[]]}):null;if(t.target==="draft-2020-12"){if(o.prefixItems=c,l)o.items=l}else if(t.target==="openapi-3.0"){if(o.items={anyOf:c},l)o.items.anyOf.push(l);if(o.minItems=c.length,!l)o.maxItems=c.length}else if(o.items=c,l)o.additionalItems=l;let{minimum:u,maximum:d}=e._zod.bag;if(typeof u==="number")o.minItems=u;if(typeof d==="number")o.maxItems=d},og=(e,t,n,r)=>{let o=n,i=e._zod.def;o.type="object";let s=i.keyType,c=s._zod.bag?.patterns;if(i.mode==="loose"&&c&&c.size>0){let u=Q(i.valueType,t,{...r,path:[...r.path,"patternProperties","*"]});o.patternProperties={};for(let d of c)o.patternProperties[d.source]=u}else{if(t.target==="draft-07"||t.target==="draft-2020-12")o.propertyNames=Q(i.keyType,t,{...r,path:[...r.path,"propertyNames"]});o.additionalProperties=Q(i.valueType,t,{...r,path:[...r.path,"additionalProperties"]})}let l=s._zod.values;if(l){let u=[...l].filter((d)=>typeof d==="string"||typeof d==="number");if(u.length>0)o.required=u}},ig=(e,t,n,r)=>{let o=e._zod.def,i=Q(o.innerType,t,r),s=t.seen.get(e);if(t.target==="openapi-3.0")s.ref=o.innerType,n.nullable=!0;else n.anyOf=[i,{type:"null"}]},sg=(e,t,n,r)=>{let o=e._zod.def;Q(o.innerType,t,r);let i=t.seen.get(e);i.ref=o.innerType},ag=(e,t,n,r)=>{let o=e._zod.def;Q(o.innerType,t,r);let i=t.seen.get(e);i.ref=o.innerType,n.default=JSON.parse(JSON.stringify(o.defaultValue))},cg=(e,t,n,r)=>{let o=e._zod.def;Q(o.innerType,t,r);let i=t.seen.get(e);if(i.ref=o.innerType,t.io==="input")n._prefault=JSON.parse(JSON.stringify(o.defaultValue))},lg=(e,t,n,r)=>{let o=e._zod.def;Q(o.innerType,t,r);let i=t.seen.get(e);i.ref=o.innerType;let s;try{s=o.catchValue(void 0)}catch{throw Error("Dynamic catch values are not supported in JSON Schema")}n.default=s},ug=(e,t,n,r)=>{let o=e._zod.def,i=t.io==="input"?o.in._zod.def.type==="transform"?o.out:o.in:o.out;Q(i,t,r);let s=t.seen.get(e);s.ref=i},dg=(e,t,n,r)=>{let o=e._zod.def;Q(o.innerType,t,r);let i=t.seen.get(e);i.ref=o.innerType,n.readOnly=!0},mg=(e,t,n,r)=>{let o=e._zod.def;Q(o.innerType,t,r);let i=t.seen.get(e);i.ref=o.innerType},Cc=(e,t,n,r)=>{let o=e._zod.def;Q(o.innerType,t,r);let i=t.seen.get(e);i.ref=o.innerType},fg=(e,t,n,r)=>{let o=e._zod.innerType;Q(o,t,r);let i=t.seen.get(e);i.ref=o},Sc={string:Ip,number:Op,boolean:zp,bigint:Np,symbol:Dp,null:Mp,undefined:$p,void:Lp,never:Wp,any:Fp,unknown:Gp,date:Zp,enum:Up,literal:jp,nan:Bp,template_literal:Vp,file:Hp,success:qp,custom:Kp,function:Yp,transform:Jp,map:Xp,set:Qp,array:eg,object:tg,union:xc,intersection:ng,tuple:rg,record:og,nullable:ig,nonoptional:sg,default:ag,prefault:cg,catch:lg,pipe:ug,readonly:dg,promise:mg,optional:Cc,lazy:fg};function ii(e,t){if("_idmap"in e){let r=e,o=Gr({...t,processors:Sc}),i={};for(let c of r._idmap.entries()){let[l,u]=c;Q(u,o)}let s={},a={registry:r,uri:t?.uri,defs:i};o.external=a;for(let c of r._idmap.entries()){let[l,u]=c;Zr(o,u),s[l]=Ur(o,u)}if(Object.keys(i).length>0){let c=o.target==="draft-2020-12"?"$defs":"definitions";s.__shared={[c]:i}}return{schemas:s}}let n=Gr({...t,processors:Sc});return Q(e,n),Zr(n,e),Ur(n,e)}class pg{get metadataRegistry(){return this.ctx.metadataRegistry}get target(){return this.ctx.target}get unrepresentable(){return this.ctx.unrepresentable}get override(){return this.ctx.override}get io(){return this.ctx.io}get counter(){return this.ctx.counter}set counter(e){this.ctx.counter=e}get seen(){return this.ctx.seen}constructor(e){let t=e?.target??"draft-2020-12";if(t==="draft-4")t="draft-04";if(t==="draft-7")t="draft-07";this.ctx=Gr({processors:Sc,target:t,...e?.metadata&&{metadata:e.metadata},...e?.unrepresentable&&{unrepresentable:e.unrepresentable},...e?.override&&{override:e.override},...e?.io&&{io:e.io}})}process(e,t={path:[],schemaPath:[]}){return Q(e,this.ctx,t)}emit(e,t){if(t){if(t.cycles)this.ctx.cycles=t.cycles;if(t.reused)this.ctx.reused=t.reused;if(t.external)this.ctx.external=t.external}Zr(this.ctx,e);let n=Ur(this.ctx,e),{"~standard":r,...o}=n;return o}}var hx={};var ui={};un(ui,{ZodISODate:()=>ai,ZodISODateTime:()=>si,ZodISODuration:()=>li,ZodISOTime:()=>ci,date:()=>hg,datetime:()=>gg,duration:()=>bg,time:()=>yg});var si=g("ZodISODateTime",(e,t)=>{Vm.init(e,t),K.init(e,t)});function gg(e){return Kf(si,e)}var ai=g("ZodISODate",(e,t)=>{Hm.init(e,t),K.init(e,t)});function hg(e){return Yf(ai,e)}var ci=g("ZodISOTime",(e,t)=>{qm.init(e,t),K.init(e,t)});function yg(e){return Jf(ci,e)}var li=g("ZodISODuration",(e,t)=>{Km.init(e,t),K.init(e,t)});function bg(e){return Xf(li,e)}var bx=(e,t)=>{Ko.init(e,t),e.name="ZodError",Object.defineProperties(e,{format:{value:(n)=>Sr(e,n)},flatten:{value:(n)=>_r(e,n)},addIssue:{value:(n)=>{e.issues.push(n),e.message=JSON.stringify(e.issues,br,2)}},addIssues:{value:(n)=>{e.issues.push(...n),e.message=JSON.stringify(e.issues,br,2)}},isEmpty:{get(){return e.issues.length===0}}})},vx=g("ZodError",bx),we=g("ZodError",bx,{Parent:Error});var Ec=xr(we),wc=Cr(we),Rc=Er(we),Pc=wr(we),Ac=Ea(we),kc=wa(we),Tc=Ra(we),Ic=Pa(we),Oc=Aa(we),zc=ka(we),Nc=Ta(we),Dc=Ia(we);var D=g("ZodType",(e,t)=>(N.init(e,t),Object.assign(e["~standard"],{jsonSchema:{input:_c(e,"input"),output:_c(e,"output")}}),e.toJSONSchema=Tp(e,{}),e.def=t,e.type=t.type,Object.defineProperty(e,"_def",{value:t}),e.check=(...n)=>e.clone(Ct(t,{checks:[...t.checks??[],...n.map((r)=>typeof r==="function"?{_zod:{check:r,def:{check:"custom"},onattach:[]}}:r)]}),{parent:!0}),e.with=e.check,e.clone=(n,r)=>be(e,n,r),e.brand=()=>e,e.register=(n,r)=>(n.add(e,r),e),e.parse=(n,r)=>Ec(e,n,r,{callee:e.parse}),e.safeParse=(n,r)=>Rc(e,n,r),e.parseAsync=async(n,r)=>wc(e,n,r,{callee:e.parseAsync}),e.safeParseAsync=async(n,r)=>Pc(e,n,r),e.spa=e.safeParseAsync,e.encode=(n,r)=>Ac(e,n,r),e.decode=(n,r)=>kc(e,n,r),e.encodeAsync=async(n,r)=>Tc(e,n,r),e.decodeAsync=async(n,r)=>Ic(e,n,r),e.safeEncode=(n,r)=>Oc(e,n,r),e.safeDecode=(n,r)=>zc(e,n,r),e.safeEncodeAsync=async(n,r)=>Nc(e,n,r),e.safeDecodeAsync=async(n,r)=>Dc(e,n,r),e.refine=(n,r)=>e.check(ch(n,r)),e.superRefine=(n)=>e.check(lh(n)),e.overwrite=(n)=>e.check(lt(n)),e.optional=()=>mi(e),e.exactOptional=()=>jg(e),e.nullable=()=>fi(e),e.nullish=()=>mi(fi(e)),e.nonoptional=(n)=>Yg(e,n),e.array=()=>yi(e),e.or=(n)=>rl([e,n]),e.and=(n)=>Ng(e,n),e.transform=(n)=>pi(e,il(n)),e.default=(n)=>Hg(e,n),e.prefault=(n)=>Kg(e,n),e.catch=(n)=>Qg(e,n),e.pipe=(n)=>pi(e,n),e.readonly=()=>nh(e),e.describe=(n)=>{let r=e.clone();return ze.add(r,{description:n}),r},Object.defineProperty(e,"description",{get(){return ze.get(e)?.description},configurable:!0}),e.meta=(...n)=>{if(n.length===0)return ze.get(e);let r=e.clone();return ze.add(r,n[0]),r},e.isOptional=()=>e.safeParse(void 0).success,e.isNullable=()=>e.safeParse(null).success,e.apply=(n)=>n(e),e)),Lc=g("_ZodString",(e,t)=>{Mn.init(e,t),D.init(e,t),e._zod.processJSONSchema=(r,o,i)=>Ip(e,r,o,i);let n=e._zod.bag;e.format=n.format??null,e.minLength=n.minimum??null,e.maxLength=n.maximum??null,e.regex=(...r)=>e.check(Pr(...r)),e.includes=(...r)=>e.check(Tr(...r)),e.startsWith=(...r)=>e.check(Ir(...r)),e.endsWith=(...r)=>e.check(Or(...r)),e.min=(...r)=>e.check(Ft(...r)),e.max=(...r)=>e.check(Ln(...r)),e.length=(...r)=>e.check(Wn(...r)),e.nonempty=(...r)=>e.check(Ft(1,...r)),e.lowercase=(r)=>e.check(Ar(r)),e.uppercase=(r)=>e.check(kr(r)),e.trim=()=>e.check(Dr()),e.normalize=(...r)=>e.check(Nr(...r)),e.toLowerCase=()=>e.check(Mr()),e.toUpperCase=()=>e.check($r()),e.slugify=()=>e.check(Lr())}),Br=g("ZodString",(e,t)=>{Mn.init(e,t),Lc.init(e,t),e.email=(n)=>e.check(qa(Wc,n)),e.url=(n)=>e.check(oi(gi,n)),e.jwt=(n)=>e.check(fc(el,n)),e.emoji=(n)=>e.check(Qa(Fc,n)),e.guid=(n)=>e.check(ri(di,n)),e.uuid=(n)=>e.check(Ka(kt,n)),e.uuidv4=(n)=>e.check(Ya(kt,n)),e.uuidv6=(n)=>e.check(Ja(kt,n)),e.uuidv7=(n)=>e.check(Xa(kt,n)),e.nanoid=(n)=>e.check(ec(Gc,n)),e.guid=(n)=>e.check(ri(di,n)),e.cuid=(n)=>e.check(tc(Zc,n)),e.cuid2=(n)=>e.check(nc(Uc,n)),e.ulid=(n)=>e.check(rc(jc,n)),e.base64=(n)=>e.check(uc(Jc,n)),e.base64url=(n)=>e.check(dc(Xc,n)),e.xid=(n)=>e.check(oc(Bc,n)),e.ksuid=(n)=>e.check(ic(Vc,n)),e.ipv4=(n)=>e.check(sc(Hc,n)),e.ipv6=(n)=>e.check(ac(qc,n)),e.cidrv4=(n)=>e.check(cc(Kc,n)),e.cidrv6=(n)=>e.check(lc(Yc,n)),e.e164=(n)=>e.check(mc(Qc,n)),e.datetime=(n)=>e.check(gg(n)),e.date=(n)=>e.check(hg(n)),e.time=(n)=>e.check(yg(n)),e.duration=(n)=>e.check(bg(n))});function Mc(e){return Vf(Br,e)}var K=g("ZodStringFormat",(e,t)=>{q.init(e,t),Lc.init(e,t)}),Wc=g("ZodEmail",(e,t)=>{$m.init(e,t),K.init(e,t)});function _x(e){return qa(Wc,e)}var di=g("ZodGUID",(e,t)=>{Dm.init(e,t),K.init(e,t)});function Sx(e){return ri(di,e)}var kt=g("ZodUUID",(e,t)=>{Mm.init(e,t),K.init(e,t)});function xx(e){return Ka(kt,e)}function Cx(e){return Ya(kt,e)}function Ex(e){return Ja(kt,e)}function wx(e){return Xa(kt,e)}var gi=g("ZodURL",(e,t)=>{Lm.init(e,t),K.init(e,t)});function Rx(e){return oi(gi,e)}function Px(e){return oi(gi,{protocol:/^https?$/,hostname:BS,...b(e)})}var Fc=g("ZodEmoji",(e,t)=>{Wm.init(e,t),K.init(e,t)});function Ax(e){return Qa(Fc,e)}var Gc=g("ZodNanoID",(e,t)=>{Fm.init(e,t),K.init(e,t)});function kx(e){return ec(Gc,e)}var Zc=g("ZodCUID",(e,t)=>{Gm.init(e,t),K.init(e,t)});function Tx(e){return tc(Zc,e)}var Uc=g("ZodCUID2",(e,t)=>{Zm.init(e,t),K.init(e,t)});function Ix(e){return nc(Uc,e)}var jc=g("ZodULID",(e,t)=>{Um.init(e,t),K.init(e,t)});function Ox(e){return rc(jc,e)}var Bc=g("ZodXID",(e,t)=>{jm.init(e,t),K.init(e,t)});function zx(e){return oc(Bc,e)}var Vc=g("ZodKSUID",(e,t)=>{Bm.init(e,t),K.init(e,t)});function Nx(e){return ic(Vc,e)}var Hc=g("ZodIPv4",(e,t)=>{Ym.init(e,t),K.init(e,t)});function Dx(e){return sc(Hc,e)}var vg=g("ZodMAC",(e,t)=>{Xm.init(e,t),K.init(e,t)});function Mx(e){return qf(vg,e)}var qc=g("ZodIPv6",(e,t)=>{Jm.init(e,t),K.init(e,t)});function $x(e){return ac(qc,e)}var Kc=g("ZodCIDRv4",(e,t)=>{Qm.init(e,t),K.init(e,t)});function Lx(e){return cc(Kc,e)}var Yc=g("ZodCIDRv6",(e,t)=>{ef.init(e,t),K.init(e,t)});function Wx(e){return lc(Yc,e)}var Jc=g("ZodBase64",(e,t)=>{nf.init(e,t),K.init(e,t)});function Fx(e){return uc(Jc,e)}var Xc=g("ZodBase64URL",(e,t)=>{rf.init(e,t),K.init(e,t)});function Gx(e){return dc(Xc,e)}var Qc=g("ZodE164",(e,t)=>{of.init(e,t),K.init(e,t)});function Zx(e){return mc(Qc,e)}var el=g("ZodJWT",(e,t)=>{sf.init(e,t),K.init(e,t)});function Ux(e){return fc(el,e)}var Vr=g("ZodCustomStringFormat",(e,t)=>{af.init(e,t),K.init(e,t)});function jx(e,t,n={}){return Wr(Vr,e,t,n)}function Bx(e){return Wr(Vr,"hostname",jS,e)}function Vx(e){return Wr(Vr,"hex",qS,e)}function Hx(e,t){let n=t?.enc??"hex",r=`${e}_${n}`,o=Et[r];if(!o)throw Error(`Unrecognized hash format: ${r}`);return Wr(Vr,r,o,t)}var Hr=g("ZodNumber",(e,t)=>{Za.init(e,t),D.init(e,t),e._zod.processJSONSchema=(r,o,i)=>Op(e,r,o,i),e.gt=(r,o)=>e.check(Rt(r,o)),e.gte=(r,o)=>e.check(Ee(r,o)),e.min=(r,o)=>e.check(Ee(r,o)),e.lt=(r,o)=>e.check(wt(r,o)),e.lte=(r,o)=>e.check(je(r,o)),e.max=(r,o)=>e.check(je(r,o)),e.int=(r)=>e.check($c(r)),e.safe=(r)=>e.check($c(r)),e.positive=(r)=>e.check(Rt(0,r)),e.nonnegative=(r)=>e.check(Ee(0,r)),e.negative=(r)=>e.check(wt(0,r)),e.nonpositive=(r)=>e.check(je(0,r)),e.multipleOf=(r,o)=>e.check(sn(r,o)),e.step=(r,o)=>e.check(sn(r,o)),e.finite=()=>e;let n=e._zod.bag;e.minValue=Math.max(n.minimum??Number.NEGATIVE_INFINITY,n.exclusiveMinimum??Number.NEGATIVE_INFINITY)??null,e.maxValue=Math.min(n.maximum??Number.POSITIVE_INFINITY,n.exclusiveMaximum??Number.POSITIVE_INFINITY)??null,e.isInt=(n.format??"").includes("int")||Number.isSafeInteger(n.multipleOf??0.5),e.isFinite=!0,e.format=n.format??null});function _g(e){return Qf(Hr,e)}var Gn=g("ZodNumberFormat",(e,t)=>{cf.init(e,t),Hr.init(e,t)});function $c(e){return tp(Gn,e)}function qx(e){return np(Gn,e)}function Kx(e){return rp(Gn,e)}function Yx(e){return op(Gn,e)}function Jx(e){return ip(Gn,e)}var qr=g("ZodBoolean",(e,t)=>{Xo.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>zp(e,n,r,o)});function Sg(e){return sp(qr,e)}var Kr=g("ZodBigInt",(e,t)=>{Ua.init(e,t),D.init(e,t),e._zod.processJSONSchema=(r,o,i)=>Np(e,r,o,i),e.gte=(r,o)=>e.check(Ee(r,o)),e.min=(r,o)=>e.check(Ee(r,o)),e.gt=(r,o)=>e.check(Rt(r,o)),e.gte=(r,o)=>e.check(Ee(r,o)),e.min=(r,o)=>e.check(Ee(r,o)),e.lt=(r,o)=>e.check(wt(r,o)),e.lte=(r,o)=>e.check(je(r,o)),e.max=(r,o)=>e.check(je(r,o)),e.positive=(r)=>e.check(Rt(BigInt(0),r)),e.negative=(r)=>e.check(wt(BigInt(0),r)),e.nonpositive=(r)=>e.check(je(BigInt(0),r)),e.nonnegative=(r)=>e.check(Ee(BigInt(0),r)),e.multipleOf=(r,o)=>e.check(sn(r,o));let n=e._zod.bag;e.minValue=n.minimum??null,e.maxValue=n.maximum??null,e.format=n.format??null});function Xx(e){return cp(Kr,e)}var tl=g("ZodBigIntFormat",(e,t)=>{lf.init(e,t),Kr.init(e,t)});function Qx(e){return up(tl,e)}function eC(e){return dp(tl,e)}var xg=g("ZodSymbol",(e,t)=>{uf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Dp(e,n,r,o)});function tC(e){return mp(xg,e)}var Cg=g("ZodUndefined",(e,t)=>{df.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>$p(e,n,r,o)});function nC(e){return fp(Cg,e)}var Eg=g("ZodNull",(e,t)=>{mf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Mp(e,n,r,o)});function wg(e){return pp(Eg,e)}var Rg=g("ZodAny",(e,t)=>{ff.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Fp(e,n,r,o)});function rC(){return gp(Rg)}var Pg=g("ZodUnknown",(e,t)=>{pf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Gp(e,n,r,o)});function Fn(){return hp(Pg)}var Ag=g("ZodNever",(e,t)=>{gf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Wp(e,n,r,o)});function nl(e){return yp(Ag,e)}var kg=g("ZodVoid",(e,t)=>{hf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Lp(e,n,r,o)});function oC(e){return bp(kg,e)}var hi=g("ZodDate",(e,t)=>{yf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(r,o,i)=>Zp(e,r,o,i),e.min=(r,o)=>e.check(Ee(r,o)),e.max=(r,o)=>e.check(je(r,o));let n=e._zod.bag;e.minDate=n.minimum?new Date(n.minimum):null,e.maxDate=n.maximum?new Date(n.maximum):null});function iC(e){return vp(hi,e)}var Tg=g("ZodArray",(e,t)=>{bf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>eg(e,n,r,o),e.element=t.element,e.min=(n,r)=>e.check(Ft(n,r)),e.nonempty=(n)=>e.check(Ft(1,n)),e.max=(n,r)=>e.check(Ln(n,r)),e.length=(n,r)=>e.check(Wn(n,r)),e.unwrap=()=>e.element});function yi(e,t){return xp(Tg,e,t)}function sC(e){let t=e._zod.def.shape;return ol(Object.keys(t))}var bi=g("ZodObject",(e,t)=>{vf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>tg(e,n,r,o),M(e,"shape",()=>t.shape),e.keyof=()=>ol(Object.keys(e._zod.def.shape)),e.catchall=(n)=>e.clone({...e._zod.def,catchall:n}),e.passthrough=()=>e.clone({...e._zod.def,catchall:Fn()}),e.loose=()=>e.clone({...e._zod.def,catchall:Fn()}),e.strict=()=>e.clone({...e._zod.def,catchall:nl()}),e.strip=()=>e.clone({...e._zod.def,catchall:void 0}),e.extend=(n)=>zS(e,n),e.safeExtend=(n)=>NS(e,n),e.merge=(n)=>DS(e,n),e.pick=(n)=>IS(e,n),e.omit=(n)=>OS(e,n),e.partial=(...n)=>MS(sl,e,n[0]),e.required=(...n)=>$S(al,e,n[0])});function aC(e,t){let n={type:"object",shape:e??{},...b(t)};return new bi(n)}function cC(e,t){return new bi({type:"object",shape:e,catchall:nl(),...b(t)})}function lC(e,t){return new bi({type:"object",shape:e,catchall:Fn(),...b(t)})}var vi=g("ZodUnion",(e,t)=>{Qo.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>xc(e,n,r,o),e.options=t.options});function rl(e,t){return new vi({type:"union",options:e,...b(t)})}var Ig=g("ZodXor",(e,t)=>{vi.init(e,t),_f.init(e,t),e._zod.processJSONSchema=(n,r,o)=>xc(e,n,r,o),e.options=t.options});function uC(e,t){return new Ig({type:"union",options:e,inclusive:!1,...b(t)})}var Og=g("ZodDiscriminatedUnion",(e,t)=>{vi.init(e,t),Sf.init(e,t)});function dC(e,t,n){return new Og({type:"union",options:t,discriminator:e,...b(n)})}var zg=g("ZodIntersection",(e,t)=>{xf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>ng(e,n,r,o)});function Ng(e,t){return new zg({type:"intersection",left:e,right:t})}var Dg=g("ZodTuple",(e,t)=>{ja.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>rg(e,n,r,o),e.rest=(n)=>e.clone({...e._zod.def,rest:n})});function Mg(e,t,n){let r=t instanceof N,o=r?n:t;return new Dg({type:"tuple",items:e,rest:r?t:null,...b(o)})}var _i=g("ZodRecord",(e,t)=>{Cf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>og(e,n,r,o),e.keyType=t.keyType,e.valueType=t.valueType});function $g(e,t,n){return new _i({type:"record",keyType:e,valueType:t,...b(n)})}function mC(e,t,n){let r=be(e);return r._zod.values=void 0,new _i({type:"record",keyType:r,valueType:t,...b(n)})}function fC(e,t,n){return new _i({type:"record",keyType:e,valueType:t,mode:"loose",...b(n)})}var Lg=g("ZodMap",(e,t)=>{Ef.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Xp(e,n,r,o),e.keyType=t.keyType,e.valueType=t.valueType,e.min=(...n)=>e.check(Pt(...n)),e.nonempty=(n)=>e.check(Pt(1,n)),e.max=(...n)=>e.check(an(...n)),e.size=(...n)=>e.check($n(...n))});function pC(e,t,n){return new Lg({type:"map",keyType:e,valueType:t,...b(n)})}var Wg=g("ZodSet",(e,t)=>{wf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Qp(e,n,r,o),e.min=(...n)=>e.check(Pt(...n)),e.nonempty=(n)=>e.check(Pt(1,n)),e.max=(...n)=>e.check(an(...n)),e.size=(...n)=>e.check($n(...n))});function gC(e,t){return new Wg({type:"set",valueType:e,...b(t)})}var jr=g("ZodEnum",(e,t)=>{Rf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(r,o,i)=>Up(e,r,o,i),e.enum=t.entries,e.options=Object.values(t.entries);let n=new Set(Object.keys(t.entries));e.extract=(r,o)=>{let i={};for(let s of r)if(n.has(s))i[s]=t.entries[s];else throw Error(`Key ${s} not found in enum`);return new jr({...t,checks:[],...b(o),entries:i})},e.exclude=(r,o)=>{let i={...t.entries};for(let s of r)if(n.has(s))delete i[s];else throw Error(`Key ${s} not found in enum`);return new jr({...t,checks:[],...b(o),entries:i})}});function ol(e,t){let n=Array.isArray(e)?Object.fromEntries(e.map((r)=>[r,r])):e;return new jr({type:"enum",entries:n,...b(t)})}function hC(e,t){return new jr({type:"enum",entries:e,...b(t)})}var Fg=g("ZodLiteral",(e,t)=>{Pf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>jp(e,n,r,o),e.values=new Set(t.values),Object.defineProperty(e,"value",{get(){if(t.values.length>1)throw Error("This schema contains multiple valid literal values. Use `.values` instead.");return t.values[0]}})});function yC(e,t){return new Fg({type:"literal",values:Array.isArray(e)?e:[e],...b(t)})}var Gg=g("ZodFile",(e,t)=>{Af.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Hp(e,n,r,o),e.min=(n,r)=>e.check(Pt(n,r)),e.max=(n,r)=>e.check(an(n,r)),e.mime=(n,r)=>e.check(zr(Array.isArray(n)?n:[n],r))});function bC(e){return Cp(Gg,e)}var Zg=g("ZodTransform",(e,t)=>{kf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Jp(e,n,r,o),e._zod.parse=(n,r)=>{if(r.direction==="backward")throw new zn(e.constructor.name);n.addIssue=(i)=>{if(typeof i==="string")n.issues.push(on(i,n.value,t));else{let s=i;if(s.fatal)s.continue=!1;s.code??(s.code="custom"),s.input??(s.input=n.value),s.inst??(s.inst=e),n.issues.push(on(s))}};let o=t.transform(n.value,n);if(o instanceof Promise)return o.then((i)=>(n.value=i,n));return n.value=o,n}});function il(e){return new Zg({type:"transform",transform:e})}var sl=g("ZodOptional",(e,t)=>{Ba.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Cc(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function mi(e){return new sl({type:"optional",innerType:e})}var Ug=g("ZodExactOptional",(e,t)=>{Tf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Cc(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function jg(e){return new Ug({type:"optional",innerType:e})}var Bg=g("ZodNullable",(e,t)=>{If.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>ig(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function fi(e){return new Bg({type:"nullable",innerType:e})}function vC(e){return mi(fi(e))}var Vg=g("ZodDefault",(e,t)=>{Of.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>ag(e,n,r,o),e.unwrap=()=>e._zod.def.innerType,e.removeDefault=e.unwrap});function Hg(e,t){return new Vg({type:"default",innerType:e,get defaultValue(){return typeof t==="function"?t():Bo(t)}})}var qg=g("ZodPrefault",(e,t)=>{zf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>cg(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function Kg(e,t){return new qg({type:"prefault",innerType:e,get defaultValue(){return typeof t==="function"?t():Bo(t)}})}var al=g("ZodNonOptional",(e,t)=>{Nf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>sg(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function Yg(e,t){return new al({type:"nonoptional",innerType:e,...b(t)})}var Jg=g("ZodSuccess",(e,t)=>{Df.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>qp(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function _C(e){return new Jg({type:"success",innerType:e})}var Xg=g("ZodCatch",(e,t)=>{Mf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>lg(e,n,r,o),e.unwrap=()=>e._zod.def.innerType,e.removeCatch=e.unwrap});function Qg(e,t){return new Xg({type:"catch",innerType:e,catchValue:typeof t==="function"?t:()=>t})}var eh=g("ZodNaN",(e,t)=>{$f.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Bp(e,n,r,o)});function SC(e){return Sp(eh,e)}var cl=g("ZodPipe",(e,t)=>{Lf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>ug(e,n,r,o),e.in=t.in,e.out=t.out});function pi(e,t){return new cl({type:"pipe",in:e,out:t})}var ll=g("ZodCodec",(e,t)=>{cl.init(e,t),ei.init(e,t)});function xC(e,t,n){return new ll({type:"pipe",in:e,out:t,transform:n.decode,reverseTransform:n.encode})}var th=g("ZodReadonly",(e,t)=>{Wf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>dg(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function nh(e){return new th({type:"readonly",innerType:e})}var rh=g("ZodTemplateLiteral",(e,t)=>{Ff.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Vp(e,n,r,o)});function CC(e,t){return new rh({type:"template_literal",parts:e,...b(t)})}var oh=g("ZodLazy",(e,t)=>{Uf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>fg(e,n,r,o),e.unwrap=()=>e._zod.def.getter()});function ih(e){return new oh({type:"lazy",getter:e})}var sh=g("ZodPromise",(e,t)=>{Zf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>mg(e,n,r,o),e.unwrap=()=>e._zod.def.innerType});function EC(e){return new sh({type:"promise",innerType:e})}var ah=g("ZodFunction",(e,t)=>{Gf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Yp(e,n,r,o)});function wC(e){return new ah({type:"function",input:Array.isArray(e?.input)?Mg(e?.input):e?.input??yi(Fn()),output:e?.output??Fn()})}var Si=g("ZodCustom",(e,t)=>{jf.init(e,t),D.init(e,t),e._zod.processJSONSchema=(n,r,o)=>Kp(e,n,r,o)});function RC(e){let t=new X({check:"custom"});return t._zod.check=e,t}function PC(e,t){return Ep(Si,e??(()=>!0),t)}function ch(e,t={}){return wp(Si,e,t)}function lh(e){return Rp(e)}var AC=Pp,kC=Ap;function TC(e,t={}){let n=new Si({type:"custom",check:"custom",fn:(r)=>r instanceof e,abort:!0,...b(t)});return n._zod.bag.Class=e,n._zod.check=(r)=>{if(!(r.value instanceof e))r.issues.push({code:"invalid_type",expected:e.name,input:r.value,inst:n,path:[...n._zod.def.path??[]]})},n}var IC=(...e)=>kp({Codec:ll,Boolean:qr,String:Br},...e);function OC(e){let t=ih(()=>rl([Mc(e),_g(),Sg(),wg(),yi(t),$g(Mc(),t)]));return t}function zC(e,t){return pi(il(e),t)}var NC={invalid_type:"invalid_type",too_big:"too_big",too_small:"too_small",invalid_format:"invalid_format",not_multiple_of:"not_multiple_of",unrecognized_keys:"unrecognized_keys",invalid_union:"invalid_union",invalid_key:"invalid_key",invalid_element:"invalid_element",invalid_value:"invalid_value",custom:"custom"};function DC(e){ce({customError:e})}function MC(){return ce().customError}var ul;(function(e){})(ul||(ul={}));var $0=()=>{let e={string:{unit:"characters",verb:"to have"},file:{unit:"bytes",verb:"to have"},array:{unit:"items",verb:"to have"},set:{unit:"items",verb:"to have"},map:{unit:"entries",verb:"to have"}};function t(o){return e[o]??null}let n={regex:"input",email:"email address",url:"URL",emoji:"emoji",uuid:"UUID",uuidv4:"UUIDv4",uuidv6:"UUIDv6",nanoid:"nanoid",guid:"GUID",cuid:"cuid",cuid2:"cuid2",ulid:"ULID",xid:"XID",ksuid:"KSUID",datetime:"ISO datetime",date:"ISO date",time:"ISO time",duration:"ISO duration",ipv4:"IPv4 address",ipv6:"IPv6 address",mac:"MAC address",cidrv4:"IPv4 range",cidrv6:"IPv6 range",base64:"base64-encoded string",base64url:"base64url-encoded string",json_string:"JSON string",e164:"E.164 number",jwt:"JWT",template_literal:"input"},r={nan:"NaN"};return(o)=>{switch(o.code){case"invalid_type":{let i=r[o.expected]??o.expected,s=Ld(o.input),a=r[s]??s;return`Invalid input: expected ${i}, received ${a}`}case"invalid_value":if(o.values.length===1)return`Invalid input: expected ${va(o.values[0])}`;return`Invalid option: expected one of ${ha(o.values,"|")}`;case"too_big":{let i=o.inclusive?"<=":"<",s=t(o.origin);if(s)return`Too big: expected ${o.origin??"value"} to have ${i}${o.maximum.toString()} ${s.unit??"elements"}`;return`Too big: expected ${o.origin??"value"} to be ${i}${o.maximum.toString()}`}case"too_small":{let i=o.inclusive?">=":">",s=t(o.origin);if(s)return`Too small: expected ${o.origin} to have ${i}${o.minimum.toString()} ${s.unit}`;return`Too small: expected ${o.origin} to be ${i}${o.minimum.toString()}`}case"invalid_format":{let i=o;if(i.format==="starts_with")return`Invalid string: must start with "${i.prefix}"`;if(i.format==="ends_with")return`Invalid string: must end with "${i.suffix}"`;if(i.format==="includes")return`Invalid string: must include "${i.includes}"`;if(i.format==="regex")return`Invalid string: must match pattern ${i.pattern}`;return`Invalid ${n[i.format]??o.format}`}case"not_multiple_of":return`Invalid number: must be a multiple of ${o.divisor}`;case"unrecognized_keys":return`Unrecognized key${o.keys.length>1?"s":""}: ${ha(o.keys,", ")}`;case"invalid_key":return`Invalid key in ${o.origin}`;case"invalid_union":return"Invalid input";case"invalid_element":return`Invalid value in ${o.origin}`;default:return"Invalid input"}}};function uh(){return{localeError:$0()}}var dh=()=>{throw Error("JSON Schema conversion is not bundled into this plugin artifact")};var dl={};un(dl,{bigint:()=>G0,boolean:()=>F0,date:()=>Z0,number:()=>W0,string:()=>L0});function L0(e){return Hf(Br,e)}function W0(e){return ep(Hr,e)}function F0(e){return ap(qr,e)}function G0(e){return lp(Kr,e)}function Z0(e){return _p(hi,e)}ce(uh());var U0=ml;var $C=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var xi=64,LC="Rule config exceeds CC Safety Net's safe source limit.";var hB=Object.freeze({maxSources:64,concurrency:4,maxRequests:131,maxResponseBytes:67108864});var fh=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],fl={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},j0=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],B0=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ph=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...B0.flatMap((e)=>j0.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var pl=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],WC=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],V0=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],gh=WC.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),hh=WC.flatMap((e)=>V0.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Ci={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},yh=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),bh=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],FC=[...fh,fl,...ph,...gh,...hh,Ci,...yh,...bh,...pl].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),gl=new Set(pl.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),H0=FC.map((e)=>e.id),Ei=new Set(H0);var TB=q0(import.meta.url),GC,K0=Array(xi+1).fill("over-limit"),ZC=/^[^/]+\/[^/]+$/,hl=`must be an integer between ${wl} and ${Rl}`,Y0=["version","rules","overrides","transparent_wrappers"],J0=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function UC(e){if(!ut(e)||!Array.isArray(e.rules)||e.rules.length<=xi)return e;return{$schema:e.$schema,version:e.version,rules:K0,overrides:e.overrides,transparent_wrappers:e.transparent_wrappers}}function X0(){let e=mh,t=(R)=>{let T=e.superRefine(R);return T._zod.def.when=()=>!0,T},n=e.enum($C),r=e.union([e.literal("off"),e.looseObject({reason:e.string({error:"required non-empty string"}).min(1,"required non-empty string").max(tr,`must be at most ${tr} characters`).describe("Replacement block reason"),intent:n.optional()})],{error:'must be "off" or an object'}).describe("Disable a rule or replace its block reason and intent."),o=e.string({error:"must be a rulebook source string"}).min(1,"must be a non-empty rulebook source string"),i=e.string({error:"must be a command string"}).regex(yn,"must match command pattern").describe("Command name such as 'git', 'docker', or 'rtk'."),s=e.looseObject({$schema:e.unknown().optional().describe("JSON Schema reference for IDE support"),version:e.literal(1).describe("Schema version (must be 1)"),rules:e.array(o,{error:"must be an array of rulebook source strings"}).max(xi,LC).default([]).describe("Rulebook source strings such as project-rules or owner/repo#main/team-rules"),overrides:e.record(e.string().meta({pattern:ZC.source}),r).default({}).describe("Rule overrides by id"),transparent_wrappers:e.array(i,{error:"must be an array of command strings"}).default([]).describe("Commands that transparently execute a visible protected child command")}),a=(R,T)=>{if(!ut(R))return;if(Array.isArray(R.rules)&&R.rules.length<=xi){let S=new Set;R.rules.forEach((w,I)=>{if(typeof w!=="string"||w==="")return;if(w.trim()===""){T.addIssue({code:"custom",message:"must be a non-empty rulebook source string",path:["rules",I]});return}let G=qh(w);if(G){T.addIssue({code:"custom",message:G,path:["rules",I]});return}if(S.has(w)){T.addIssue({code:"custom",message:`duplicate rulebook source "${w}"`,path:["rules",I]});return}S.add(w)})}if(ut(R.overrides))for(let S of Object.keys(R.overrides)){if(ZC.test(S))continue;T.addIssue({code:"custom",message:"must use <rulebook-name>/<rule-name>",path:["overrides",S]})}if(!Array.isArray(R.transparent_wrappers))return;let B=new Set;R.transparent_wrappers.forEach((S,w)=>{if(typeof S!=="string"||!yn.test(S))return;if(B.has(S)){T.addIssue({code:"custom",message:`duplicate command "${S}"`,path:["transparent_wrappers",w]});return}if(Lv(S)){T.addIssue({code:"custom",message:`reserved command "${S}" cannot be a wrapper`,path:["transparent_wrappers",w]});return}B.add(S)})},c=e.preprocess(UC,s.check(e.superRefine(a))),l=e.preprocess(UC,s.check(t(a))),u=e.strictObject({fail_closed:e.boolean().optional(),paranoid_rm:e.boolean().optional(),paranoid_interpreters:e.boolean().optional()}),d=(R,T)=>e.intersection(e.record(e.string().refine((B)=>R.has(B),{error:(B)=>`unknown ${T} rule id "${String(B.input)}"`}),e.unknown()),e.record(e.string(),e.enum(["on","off"]))),m=(R)=>e.array(e.string({error:"must be a non-empty path string"}),{error:"must be an array of paths"}).check(t((T,B)=>{if(!Array.isArray(T))return;let S=dn();T.forEach((w,I)=>{if(typeof w!=="string")return;let G=R(w,S);if(G)B.addIssue({code:"custom",message:G,path:[I]})})})),f=e.strictObject({version:e.literal(1),safety:e.strictObject({level:e.enum(["standard","strict","paranoid"]).optional(),overrides:u.optional()}).optional(),workflow:e.strictObject({worktree_mode:e.boolean().optional()}).optional(),destructive_command_protection:e.strictObject({enabled:e.boolean().optional(),overrides:d(co,"destructive command").optional(),allow_paths:m($s).optional()}).optional(),secret_protection:e.strictObject({enabled:e.boolean().optional(),overrides:d(Ei,"secret protection").optional(),deny_paths:m(Ls).optional(),allow_paths:m(Ws).optional()}).optional(),audit:e.strictObject({retention_days:e.number({error:hl}).int(hl).min(wl,hl).max(Rl,hl).optional().describe("Days of audit log history to keep before the sweep deletes it")}).optional()}),p=(R,T)=>{if(!Array.isArray(R))return;let B=new Set;R.forEach((S,w)=>{let I=ut(S)?S.name:void 0;if(typeof I!=="string")return;if(B.has(I.toLowerCase())){T.addIssue({code:"custom",message:`duplicate rule name "${I}"`,path:[w,"name"]});return}B.add(I.toLowerCase())})},h=(R)=>{let T=(w,I)=>R==="legacy"?w:I,B=T("must match pattern (letters, numbers, hyphens, underscores)","must match command pattern"),S=`required non-empty string up to ${tr} characters`;return e.looseObject({name:e.string({error:"required string"}).regex(fn,T("must match pattern (letters, numbers, hyphens, underscores; max 64 chars)","must match rule name pattern")),command:e.string({error:T("required string","required string matching command pattern")}).regex(yn,T(B,"required string matching command pattern")),subcommand:e.string({error:T("must be a string if provided","must match command pattern")}).regex(yn,B).optional(),block_args:e.array(e.string({error:T("must be a string","must be a non-empty string")}).refine((w)=>w!=="",{error:T("must not be empty","must be a non-empty string")}),{error:T("required array","required non-empty array")}).refine((w)=>w.length>0,{error:T("must have at least one element","required non-empty array")}),reason:e.string({error:T("required string",S)}).refine((w)=>w!=="",{error:T("must not be empty",S)}).refine((w)=>w.length<=tr,{error:T(`must be at most ${tr} characters`,S)}),intent:n.optional()},{error:"must be an object"})},y=(R)=>e.array(h(R),{error:R==="legacy"?"must be an array":"required array"}).check(t(p)),v=e.looseObject({version:e.literal(1),rules:y("legacy").optional()}),E="required string matching rule name pattern",A=e.looseObject({command:e.string({error:"required non-empty string"}).refine((R)=>R.trim()!=="",{error:"required non-empty string"}),expect:e.enum(["blocked","allowed"]),rule:e.string({error:"must be a string if provided"}).optional()},{error:"must be an object"}).check(t((R,T)=>{if(!ut(R))return;if(R.expect!=="blocked"||typeof R.rule==="string")return;T.addIssue({code:"custom",message:"required string for blocked fixtures",path:["rule"]})})),C=(R,T)=>{if(!ut(R))return;let B=new Set(vh(R));if(Array.isArray(R.tests)){let w=new Set(R.tests.flatMap((I)=>ut(I)&&I.expect==="blocked"&&typeof I.rule==="string"?[I.rule]:[]));for(let I of w){if(B.has(I))continue;T.addIssue({code:"custom",message:`blocked fixture references unknown rule "${I}"`,path:["tests"]})}}if(!Array.isArray(R.allowed_commands)||!Array.isArray(R.rules))return;let S=new Set(R.allowed_commands.filter((w)=>typeof w==="string"));R.rules.forEach((w,I)=>{let G=ut(w)?w.command:void 0;if(typeof G!=="string"||S.has(G))return;T.addIssue({code:"custom",message:`"${G}" must be listed in allowed_commands`,path:["rules",I,"command"]})})},P=(R)=>e.looseObject({name:e.string({error:"required string matching rule name pattern"}).regex(fn,"required string matching rule name pattern"),version:e.string({error:"required non-empty string"}).refine((T)=>T!=="",{error:"required non-empty string"}),allowed_commands:e.array(e.string({error:"must match command pattern"}).regex(yn,"must match command pattern"),{error:"required array"}).check(t((T,B)=>{if(!Array.isArray(T))return;let S=new Set;T.forEach((w,I)=>{if(typeof w!=="string"||!yn.test(w))return;if(S.has(w)){B.addIssue({code:"custom",message:`duplicate command "${w}"`,path:[I]});return}S.add(w)})})),rules:R,tests:e.array(A,{error:"must be an array if provided"}).optional()}).check(t(C)),L=P(y("rulebook")),k=e.string({error:"must be a non-empty string"}).refine((R)=>R!=="",{error:"must be a non-empty string"}),U="must be a non-empty array of unique non-empty strings",oe="required non-empty array of non-empty strings",ie=e.array(k,{error:"must be a non-empty array of unique non-empty strings"}).refine((R)=>R.length>0,{error:"must be a non-empty array of unique non-empty strings"}).refine((R)=>new Set(R).size===R.length,{error:"must not contain duplicate values"}),Y=e.looseObject({command_path:e.array(k,{error:"required non-empty array of non-empty strings"}).refine((R)=>R.length>0,{error:"required non-empty array of non-empty strings"}),any_args:ie.optional(),exclude_args:ie.optional()},{error:"required object"}),j=P(e.array(h("rulebook").omit({subcommand:!0,block_args:!0}).extend({match:Y,subcommand:e.never({error:"not supported in rulebook_version 2"}).optional(),block_args:e.never({error:"not supported in rulebook_version 2"}).optional()}),{error:"required array"}).check(t(p)));return{RulesConfigSchema:c,RulesConfigDiagnosticSchema:l,RuleOverrideSchema:r,UserPolicySchema:f,LegacyConfigSchema:v,RulebookSchema:L,RulebookV2Schema:j}}function wi(){return GC??=X0(),GC}function jC(){return wi().RulesConfigSchema}function Q0(){return wi().UserPolicySchema}function BC(){return wi().RulebookSchema}function VC(){return wi().RulebookV2Schema}function vh(e){let t=ut(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=ut(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function HC(e){let t=wi().RulesConfigDiagnosticSchema.safeParse(e);if(t.success)return{errors:[],sources:new Set(t.data.rules)};return{errors:yl(YC(t.error.issues,Y0)),sources:rM(e,t.error.issues)}}function qC(e){let t=Q0().safeParse(e);if(t.success)return[];return yl(YC(t.error.issues,J0)," ")}function yl(e,t=": ",n=" "){return[...new Set(e.flatMap((r)=>KC(r,t,n,[])))]}function KC(e,t,n,r){let o=[...r,...e.path],i=nM(o);if(e.code==="unrecognized_keys")return e.keys.map((s)=>`${i?`${i}.`:""}unknown field "${s}"`);if(e.code==="invalid_key")return e.issues.map((s)=>s.message);if(e.code==="invalid_union"){let s=e.errors.flat().filter((a)=>a.path.length>0);if(s.length>0)return s.flatMap((a)=>KC(a,t,n,o))}if(o.length===0)return[e.code==="invalid_type"?"Config must be an object":e.message];if(o.length===1&&(e.code==="too_big"||e.code==="too_small")&&e.origin==="array")return[e.message];return[`${i}${o.length===1?n:t}${eM(e)}`]}function eM(e){if(e.code==="invalid_value")return`must be ${tM(e.values)}`;if(e.code!=="invalid_type"||!e.message.startsWith("Invalid input:"))return e.message;if(e.expected==="object"||e.expected==="record")return"must be an object if provided";return e.expected==="boolean"?"must be a boolean":e.message}function tM(e){if(e.length>3)return`one of ${e.join(", ")}`;let t=e.map((n)=>typeof n==="string"?`"${n}"`:String(n));if(t.length<2)return`${t[0]}`;return`${t.slice(0,-1).join(", ")}${t.length>2?",":""} or ${t.at(-1)}`}function nM(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function YC(e,t){let n=e.map((i)=>i.path[1]),r=[...new Set(n.filter((i)=>typeof i==="string"))],o=(i,s)=>[i.path.length===0?-1:t.indexOf(String(i.path[0])),typeof s==="number"?s:r.indexOf(String(s)),i.code==="custom"?0:1];return e.map((i,s)=>({issue:i,rank:o(i,n[s])})).sort((i,s)=>i.rank[0]-s.rank[0]||i.rank[1]-s.rank[1]||i.rank[2]-s.rank[2]).map((i)=>i.issue)}function rM(e,t){let n=ut(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function ut(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}var JC={standard:0,strict:1,paranoid:2};function eE(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:_h(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:_h(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:_h(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:oM(e,t)}}function _h(e,t){return[...new Set([...e,...t??[]])]}function oM(e,t){let n=t.safety?.level,r=ua[e.safety.level];return[...n&&JC[n]<JC[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Fo.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...XC(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...XC(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!gl.has(o))),...e.destructive_command_protection.enabled?QC(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?QC(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function XC(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function QC(e,t){return(t??[]).filter((n)=>!e.includes(n))}function iM(e){return HC(e)}function Sh(e){try{let t=$i(sM(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=iM(n);if(r.errors.length>0)return{config:null,errors:r.errors};let o=jC().parse(n);return{config:{version:1,rules:o.rules??[],overrides:o.overrides??{},transparent_wrappers:o.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof fe)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function sM(e){return typeof e==="string"?Gh(e):e}var Ch=new Set(["standard","strict","paranoid"]),iE={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:zi}};function Eh(e){return uM(lM(qn(e)),gn)}function sE(e={}){let t=pM(Eh(e)),n=Qr(e.cwd),r=dE(n),o=mM(r.parsed),i=Object.keys(o.policy).length>0?eE(t.gui??iE,o.policy):void 0,s=[...t.errors,...r.errors,...o.diagnostics],a=(t.fallback==="defaults"&&i?"salvaged":t.fallback)??(t.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),c=o.policy.safety?.level?"project":t.levelPresent?"user":"default";return{...i?xh(i.policy):t.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:c,weakenings:i?.weakenings??[]}}:{}}}var dM="project policy audit settings are ignored; audit is user scope only";function mM(e){if(!pe(e))return{policy:{},diagnostics:[]};let t=pe(e.safety)?e.safety:{},n=pe(e.workflow)?e.workflow:{},r=pe(e.destructive_command_protection)?e.destructive_command_protection:{},o=pe(e.secret_protection)?e.secret_protection:{},i={...Ch.has(t.level)?{level:t.level}:{},...pe(t.overrides)?tE({overrides:aE(t.overrides,Fo)}):{}},s={...typeof r.enabled==="boolean"?{enabled:r.enabled}:{},...r.overrides!==void 0?{overrides:bl(r.overrides,co)}:{},...r.allow_paths!==void 0?{allow_paths:lE(r.allow_paths)}:{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:bl(o.overrides,Ei)}:{},...o.deny_paths!==void 0?{deny_paths:cE(o.deny_paths)}:{},...o.allow_paths!==void 0?{allow_paths:uE(o.allow_paths)}:{}};return{policy:tE({safety:i,workflow:typeof n.worktree_mode==="boolean"?{worktree_mode:n.worktree_mode}:{},destructive_command_protection:s,secret_protection:a}),diagnostics:e.audit===void 0?[]:[dM]}}function aE(e,t){return Object.fromEntries(t.flatMap((n)=>typeof e[n]==="boolean"?[[n,e[n]]]:[]))}function tE(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}function nE(e){if(!pe(e))return fM();let t=pe(e.safety)?e.safety:{},n=pe(t.overrides)?t.overrides:{},r=pe(e.workflow)?e.workflow:{},o=pe(e.destructive_command_protection)?e.destructive_command_protection:{},i=pe(e.secret_protection)?e.secret_protection:{};return{version:1,safety:{level:Ch.has(t.level)?t.level:"standard",overrides:aE(n,Fo)},workflow:{worktree_mode:typeof r.worktree_mode==="boolean"?r.worktree_mode:!1},destructive_command_protection:{enabled:typeof o.enabled==="boolean"?o.enabled:!0,overrides:bl(o.overrides,co),allow_paths:lE(o.allow_paths)},secret_protection:{enabled:typeof i.enabled==="boolean"?i.enabled:!0,overrides:bl(i.overrides,Ei),deny_paths:cE(i.deny_paths),allow_paths:uE(i.allow_paths)},audit:{retention_days:Ni(pe(e.audit)?e.audit.retention_days:void 0)}}}function bl(e,t){if(!pe(e))return{};return Object.fromEntries(Object.entries(e).flatMap(([n,r])=>t.has(n)&&(r==="on"||r==="off")?[[n,r]]:[]))}function cE(e){if(!Array.isArray(e))return[];let t=dn();return e.filter((n)=>Ls(n,t)===null)}function lE(e){if(!Array.isArray(e))return[];let t=dn();return e.filter((n)=>$s(n,t)===null)}function uE(e){if(!Array.isArray(e))return[];let t=dn();return e.filter((n)=>Ws(n,t)===null)}function pe(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function fM(){return structuredClone(iE)}function dE(e){if(!aM(e))return{exists:!1,errors:[]};try{let t=cM(e,"utf-8");if(!t.trim())return{exists:!0,errors:[`${e}: Config file is empty`],fallback:"defaults"};let n=JSON.parse(t),r=qC(n);if(r.length===0)return{exists:!0,parsed:n,errors:[]};return{exists:!0,parsed:n,errors:r.map((o)=>`${e}: ${o}`),fallback:pe(n)?"salvaged":"defaults"}}catch(t){let n=t instanceof Error?t.message:String(t);return{exists:!0,errors:[`${e}: ${t instanceof SyntaxError?"Invalid JSON":n}`],fallback:"defaults"}}}function pM(e){let t=dE(e);if(!t.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!pe(r))return{policy:oE(),errors:[]};let o=nE(r);return{policy:xh(o),gui:o,errors:[],levelPresent:rE(r)}}if(t.parsed===void 0)return{policy:oE(),errors:t.errors,...t.fallback?{fallback:t.fallback}:{}};let n=nE(t.parsed);return{policy:xh(n),gui:n,errors:t.errors,...t.fallback?{fallback:t.fallback}:{},levelPresent:rE(t.parsed)}}function rE(e){let t=pe(e)&&pe(e.safety)?e.safety:{};return Ch.has(t.level)}function mE(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...gl].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function oE(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:mE({}),denyPaths:[],allowPaths:[]}}}function xh(e){return{safety:gM(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:mE(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function gM(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}var hE="This path contains the protected policy config and you must not modify or delete it.",hM=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function yE(e){let t=zt(Xe()),n=xM(e.invocation.context,t);if(e.invocation.route.kind==="patch")return fE(e.paths,!1,e.invocation.context.executionCwd,n,t);let r=Se(e,"input-candidate");if(e.invocation.route.kind==="command")return r?pE(r.shell,e.invocation.context.executionCwd,n,t):null;if(e.invocation.route.kind==="unknown"&&r){let o=pE(r.shell,e.invocation.context.executionCwd,n,t);if(o)return o}return fE(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Os(e.invocation.toolName),e.invocation.context.executionCwd,n,t)}function fE(e,t,n,r,o){if(t)return null;let i=e.find((s)=>Ri(s,n,r,o));return i?{target:i}:null}function pE(e,t,n,r){let o=cr(e,t,r,{findSegmentTarget:(i,s)=>yM(i,s,n,r)?.target??null,isRedirectionTarget:(i,s)=>Ri(i,s.cwd,n,r),findMalformedTarget:(i)=>SM(i,t,n,r)?.target??null,normalizeCwd:he});return o?{target:o}:null}function yM(e,t,n,r){if(xo(e))return null;let o=r.environment,i=Vt([...e],o),s=W(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&bM(a)){let c=vM(a).find((l)=>gE(We(l,t.variables),t.cwd,n,r));if(c)return{target:c}}if(s==="find"){if(Hs(i,1)||Wu(i,o)){let l=(Vs(Z(i))??Z(["."])).find((u)=>{let d=We(u.text,t.variables);return Ri(d,t.cwd,n,r)||gE(d,t.cwd,n,r)})?.text;if(l)return{target:l}}}if(s==="mv"){let c=zs(a).sources.find((l)=>CM(We(l,t.variables),t.cwd,n,r));if(c)return{target:c}}if(_M(e,o))return null;for(let c of[...e,...i])for(let l of bE(c))if(Ri(We(l,t.variables),t.cwd,n,r))return{target:l};return null}function bM(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function vM(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function _M(e,t){let n=Vt([...e],t);if(n.length===0)return!1;let r=W(n[0]??"").toLowerCase();if(!hM.has(r))return!1;if(r!=="sed")return!0;return!n.slice(1).some((o)=>o.startsWith("-i")||o==="--in-place"||o.startsWith("--in-place="))}function SM(e,t,n,r){for(let o of e.split(/\s+/))for(let i of bE(o))if(Ri(i,t,n,r))return{target:i};return null}function bE(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function xM(e,t){let n=(s)=>Pi(he(s,e.executionCwd,t)),r=n(Eh()),o=[n(Qr(e.executionCwd)),n(Qr(e.configCwd))],i=new Set(o.map((s)=>vl(s)));for(let s=vl(r);;s=vl(s))if(i.add(s),vl(s)===s)break;return{files:new Set([r,...o]),directoriesAndAncestors:i}}function Ri(e,t,n,r){let o=mv(e,t,r,(i)=>Pi(i)===gn);return o!==null&&n.files.has(Pi(o))}function gE(e,t,n,r){return n.directoriesAndAncestors.has(Pi(he(e,t,r)))}function CM(e,t,n,r){let o=Pi(he(e,t,r));return n.files.has(o)||n.directoriesAndAncestors.has(o)}function Pi(e){return process.platform==="win32"?e.toLowerCase():e}import{homedir as Ph}from"os";import{isAbsolute as _l,posix as EM,resolve as xl,win32 as wM}from"path";import{fileURLToPath as RM}from"url";var TE="Access to a sensitive path is not allowed.",IE=new Set(["echo","printf"]),PM=new Set(["find"]),AM=new Set(["-exec","-execdir"]),kM=new Set([";","+"]),TM=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),IM=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),OE=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),OM=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),zM=new Set(["node","bun"]),NM=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),DM=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","popen","read","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),zE=new Set(["-c","-e","-r","-E","--eval","--exec"]),MM=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),$M=new Set(["grep","rg"]),vE="f",_E="file",LM="files",WM=new Set(["e","f"]),FM=new Set(["regexp","file"]),GM=new Set(["e","f","A","B","C","m"]),ZM=new Set(["regexp","file","after-context","before-context","context","max-count"]),UM=new Set(["|","|&"]),wh="__CC_SAFETY_NET_PIPE_INPUT__",NE=new Set(["bash","sh","zsh","dash","ksh"]),jM=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function SE(e,t,n,r,o){let i=eo();for(let s of e){if(N$(s,t,n?.denyPaths??[],r,i))return{target:s,ruleId:"secret.deny-path"};if(o&&!o.has(s))continue;let a=O$(s,t,n,i);if(a){if(!a.startsWith("secret.cli.")&&D$(s,t,n?.allowPaths??[],r,i))continue;return{target:s,ruleId:a}}}return null}function DE(e,t,n={}){let r=xE(e),o=SE(r,e.invocation.context.executionCwd,t,e.invocation.context.configCwd),i=o?.ruleId!=="secret.deny-path"&&n.strict===!1?xE(e,{refineJavaScriptInlineData:!0}):r,s=i.length===r.length?o:SE(r,e.invocation.context.executionCwd,t,e.invocation.context.configCwd,new Set(i));if(s?.ruleId!=="secret.deny-path"&&n.strict===!1&&BM(e))return null;return s}function BM(e){let t=Se(e,"input-candidate")??Se(e,"declared-command");if(!t)return!1;if(t.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let n=[];for(let s of t.shell.entries){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind!=="operator")n.push(ht(s.text))}let r=Yr(n);if(r.length===0)return!1;let o=jn(r[0]??"").toLowerCase(),i=r.slice(1);if(e.invocation.route.kind==="unknown")return t.program.dialect==="powershell"&&(o==="ls"||o==="stat");if(o==="ls"||o==="stat")return!0;if(o==="test")return i.length===2&&(i[0]==="-e"||i[0]==="-f");if(o!=="find")return!1;return!i.some((s)=>TM.has(s))}function xE(e,t={}){if(e.invocation.route.kind==="command"){let r=Se(e,"input-candidate");return r?Ti(r.shell,e.store,t,CE(r)):[]}if(e.invocation.route.kind!=="unknown")return[...e.paths];let n=Se(e,"input-candidate");return[...n?Ti(n.shell,e.store,t,CE(n)):[],...e.paths]}function CE(e){return e.program.dialect==="powershell"}function Ti(e,t,n,r=!1){if(e.status==="structural-limit")throw new gt;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let o=[...e.assignmentFallbacks,...p$(ht(e.source),t,n)],i=[],s=null;for(let a of e.entries){if(a.kind==="operator"){if(!a.boundary)continue;if(i.length>0){if(o.push(...Sl(i,t,n)),s!==null)o.push(...EE(s,i,t,n));s=UM.has(a.operator)?i:null,i=[]}else s=null;continue}if(a.kind==="redirection"){let c=a.target?ht(RE(a.target,r)):void 0;if(c&&a.targetOrder==="legacy-segment")i.push(c);else if(c)o.push(c);continue}i.push(ht(RE(a.text,r)))}if(i.length>0){if(o.push(...Sl(i,t,n)),s!==null)o.push(...EE(s,i,t,n))}return o}function Sl(e,t,n){let r=e$(e),o=Yr(e);if(o.length===0)return r;let i=o[0]??"",s=jn(i).toLowerCase(),a=o.slice(1),c=VM(i,s,a);if(c)return[...r,...c];if(IE.has(s))return r;if(s==="export")return[...r,...a.flatMap((l)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(l)?[l.slice(l.indexOf("=")+1)]:Zn(s,l))];if(s==="git")return[...r,...t$(a)];if($M.has(s))return[...r,...x$(a)];if(PM.has(s))return[...r,...i$(a,t,n)];if(Fe.has(s))return[...r,...a.flatMap((l)=>Zn("awk",l)),...a.flatMap((l)=>a$(l,t,n)),...a.flatMap(c$)];if(s==="curl")return[...r,...a.flatMap((l)=>Zn(s,l)),...n$(a)];if(LE(s)){if(NE.has(s)){let l=lv(s,a);if(l!==null&&t.getShellSyntax(l).status==="structural-limit")throw new gt}return[...r,...s$(s,a,n)]}return[...r,...a.flatMap((l)=>Zn(s,l))]}function VM(e,t,n){let r=fa(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let c=i[s+1];if(c&&!c.startsWith("--"))o.push(c);s++;continue}return o}return o}function EE(e,t,n,r){if(JM(t,n,r))return HM(e);let o=XM(t);if(o===null)return[];return qM(e).flatMap((i)=>NE.has(o)?Ti(n.getShellSyntax(i),n,r):FE(i))}function HM(e){let t=Yr(e);if(t.length===0)return[];let n=jn(t[0]??"").toLowerCase();if(!IE.has(n))return[];return t.slice(1)}function qM(e){let t=Yr(e);if(t.length===0)return[];let n=jn(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return KM(r);return[]}function KM(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[ME(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>YM(t,r.slice(i*n,(i+1)*n)))}function YM(e,t){let n=0;return ME(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function ME(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function JM(e,t,n){let r=Yr(e);if(r.length===0||jn(r[0]??"").toLowerCase()!=="xargs")return!1;let o=Pn(r),i=r.slice(o.childStart);if(i.length===0)return!1;if(o.replacementToken==="")return!1;let s=o.replacementToken,a=s===null?[...i,wh]:i.map((c)=>c.split(s).join(wh));return Sl(a,t,n).some((c)=>c.includes(wh))}function XM(e){let t=Yr(e);if(t.length===0)return null;let n=jn(t[0]??"").toLowerCase();if(!LE(n))return null;return QM(n,t.slice(1))?n:null}function QM(e,t){let n=$E(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(zE.has(o)||WE(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(jM.get(n)?.has(o))r++;continue}return!1}return!0}function $E(e){return/^python\d/.test(e)?"python":e}function e$(e){let t=[];for(let n of e){if(UE(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var wE=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function RE(e,t){if(!t||!wE.test(e))return e;return`~${e.replace(wE,"").replace(/\\/g,"/")}`}function Zn(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function t$(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>Zn("git",i))];if(t.push(...Zn("git",r)),!Re.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Zn("git",o)),n++}return t}function n$(e){return e.flatMap((t,n)=>{let r=o$(t);if(r!==null)return PE(r.flag,r.value);let o=r$(e[n-1]);return o===null?[]:PE(o,t)})}function PE(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Rh(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Rh(t.slice(n+1))}return t.startsWith("@")?Rh(t.slice(1)):[]}function r$(e){if(e===void 0)return null;if(OE.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function o$(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return OE.has(r)?{flag:r,value:e.slice(n+1)}:null}function Rh(e){return e===""||e==="-"?[]:[e]}function i$(e,t,n){let r=e.findIndex((i)=>i.startsWith("-")||i==="("||i==="!"||i===";"),o=[...e.slice(0,r===-1?e.length:r)];for(let i=0;i<e.length;i++){if(!AM.has(e[i]??""))continue;let s=e.slice(i+1),a=s.findIndex((u)=>kM.has(u)),c=a===-1?s:s.slice(0,a),l=Sl(c,t,n);if(o.push(...l.filter((u)=>u!=="{}")),!l.includes("{}"))continue;o.push(...e.slice(0,i).flatMap((u,d,m)=>{if(!IM.has(u))return[];let f=m[d+1];return f===void 0?[]:[f,f.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return o}function LE(e){return OM.has(e)||/^python\d/.test(e)}function s$(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o];if(i===void 0)break;if(zE.has(i)||WE(e,i)){let a=t[o+1];if(a!==void 0)r.push(...AE(e,a,n)),o++;continue}let s=/^--(?:eval|exec)=(.*)$/.exec(i);if(s!==null&&s[1]!==void 0){r.push(...AE(e,s[1],n));continue}if(!i.startsWith("-"))r.push(i)}return r}function WE(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return MM.get(t[t.length-1]??"")?.has($E(e))??!1}function a$(e,t,n){if(!e.includes("system"))return[];return Du(e)?.commands.flatMap((r)=>Ti(t.getShellSyntax(r),t,n))??[]}function c$(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function FE(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((r)=>r[2]).filter((r)=>r!==void 0&&r!==""),n=(e.match(/[\w./~@+-]*[./~][\w./~@+-]*/g)??[]).filter((r)=>r!=="process.versions.sqlite"||t.some((o)=>o.includes(r)));return[...t,...t.flatMap(GE),...n]}function AE(e,t,n){let r=FE(t);if(!n.refineJavaScriptInlineData||!zM.has(e)||r.length===0)return r;let o=l$(t);return o!==null&&!d$(o)?[]:r}function l$(e){let t=e.split("");for(let n=0;n<e.length;n++){let r=e[n];if(r!=="'"&&r!=='"'&&r!=="`")continue;if(r==="`"&&u$(e,n))return null;t[n]=" ";let o=!1;for(let i=n+1;i<e.length;i++){let s=e[i];if(t[i]=" ",s==="\\"){if(i++,i<e.length)t[i]=" ";continue}if(r==="`"&&s==="$"&&e[i+1]==="{")return null;if(r!=="`"&&(s===`
-`||s==="\r"))return null;if(s!==r)continue;n=i,o=!0;break}if(!o)return null}return t.join("")}function u$(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function d$(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(NM.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>DM.has(i)))continue;if(o.length>1)return!0;if(m$(e,r)===".")return!0;if(f$(e,r+n.length)==="(")return!0}return!1}function m$(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function f$(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function p$(e,t,n){return v$(e).flatMap((r)=>{let o=t.getShellSyntax(r);if(o.status==="invalid")return[];return[...Ti(o,t,n),...g$(o)?h$(o):[]]})}function g$(e){let t=e.entries;for(let n=0;n<t.length;n++){let r=t[n];if(r?.kind!=="word"||jn(ht(r.text)).toLowerCase()!=="base64")continue;for(let o=n+1;o<t.length;o++){let i=t[o];if(i?.kind==="operator")break;if(i?.kind!=="word")continue;let s=ht(i.text);if(s==="--decode"||!s.startsWith("--")&&s.startsWith("-")&&/[dD]/.test(s))return!0}}return!1}function h$(e){return e.entries.flatMap((t)=>t.kind==="word"?[ht(t.text)]:t.kind==="redirection"&&t.target?[ht(t.target)]:[]).flatMap(GE)}function GE(e){let t=b$(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||y$(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function y$(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function b$(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function v$(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(ho(o,n))continue;if(ZE(e,r,n)){let i=_$(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=S$(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function _$(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(ho(i,n))continue;if(ZE(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function S$(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function ZE(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function x$(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let c=0;c<e.length;c++){let l=e[c];if(l===void 0)break;if(!i&&l==="--"){i=!0;continue}if(i){n.push(l);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(l);if(u!==null){let d=u[1]??"",m=u[2];if(d===LM)o=!0;if(FM.has(d))r=!0;if(m!==void 0){if(d===_E)t.push(m);continue}if(ZM.has(d)){let f=e[c+1];if(d===_E&&f!==void 0)t.push(f);c++}continue}if(l.startsWith("-")&&l.length>1){let d=l.slice(1),m="",f="";for(let p=0;p<d.length;p++){let h=d[p]??"";if(WM.has(h))r=!0;if(GM.has(h)){m=h,f=d.slice(p+1);break}}if(m!=="")if(f.length>0){if(m===vE)t.push(f)}else{let p=e[c+1];if(m===vE&&p!==void 0)t.push(p);c++}continue}n.push(l)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Yr(e){let t=e.findIndex((n)=>!UE(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function UE(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var C$=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),E$=".env.",w$=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),R$=[".env.example.",".env.sample."];function P$(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function A$(e){return e.length>0&&!/\s/.test(e)}function k$(e,t,n){try{let r=Ii(e,t,n);return r!==""&&Be.entryKind(r)!=="missing"}catch(r){if(r instanceof _e)throw r;return!1}}var T$=new Set(["node_modules","__pycache__"]),I$=[["vendor","bundle"],["vendor","cache"]];function O$(e,t,n,r){if(P$(e))return null;let o=Tt(e,t,r);if(!o)return null;let i=re(o.split("/").pop()??""),s=re(o),a=()=>A$(i)||k$(e,t,r);if(w$.has(i)||R$.some((d)=>i.startsWith(d)))return null;let c=re(L$(e,t,r));for(let d of ph){let m=`~/${d.suffixParts.join("/")}`;if((kE(s,m)||kE(c,m))&&Gt(d.id,n))return d.id}let l=z$(o,t,n,r);if(l)return l;if(C$.has(i))return null;for(let d of fh)if(i===d.basename&&Gt(d.id,n))return d.id;if(i.startsWith(E$)&&Gt(fl.id,n)&&a())return fl.id;for(let d of gh)if(i.length>d.prefix.length&&i.startsWith(d.prefix)){let m=i.slice(d.prefix.length)[0];if((m==="-"||m==="_")&&Gt(d.id,n)&&a())return d.id}for(let d of hh)if(i.length>d.prefix.length&&i.startsWith(d.prefix)){if(i.slice(d.prefix.length)===d.suffix&&Gt(d.id,n))return d.id}if(M$(s))return null;if(!i.includes(".")&&Ci.pattern.test(i)&&Gt(Ci.id,n))return Ci.id;let u=$$(i,n);if(u)return u;return null}function z$(e,t,n,r){return pl.find((o)=>{if(!Gt(o.id,n))return!1;switch(o.id){case"secret.cli.claude-code":return ee(e,ne(process.env.CLAUDE_CONFIG_DIR,"~/.claude",t,r),[".credentials.json"]);case"secret.cli.claude-code.config":{let i=re(e).split("/");return ee(e,ne(process.env.CLAUDE_CONFIG_DIR,"~/.claude",t,r),["settings.json","settings.local.json"])||ki(e,"~/.claude.json",t,r)||i.at(-1)==="settings.local.json"&&i.at(-2)===".claude"||i.at(-1)===".mcp.json"}case"secret.cli.antigravity":return ee(e,Tt("~/.gemini/config",t,r),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let i=ne(process.env.CODEX_HOME,"~/.codex",t,r);return ee(e,i,["auth.json",".credentials.json"])||Ai(e,i,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let i=ne(process.env.CODEX_HOME,"~/.codex",t,r),s=re(e).split("/").at(-1)??"";return ee(e,i,["config.toml"])||s.endsWith(".config.toml")&&ee(e,i,[s])}case"secret.cli.gemini":return ee(e,ve(ne(process.env.GEMINI_CLI_HOME,"~",t,r),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let i=re(e).split("/"),s=process.env.ProgramData?[ve(ne(process.env.ProgramData,"",t,r),"gemini-cli")]:[];return ee(e,ve(ne(process.env.GEMINI_CLI_HOME,"~",t,r),".gemini"),["settings.json","google_accounts.json"])||i.at(-1)==="settings.json"&&i.at(-2)===".gemini"||(process.env.GEMINI_CLI_SYSTEM_SETTINGS_PATH?.trim()?ki(e,process.env.GEMINI_CLI_SYSTEM_SETTINGS_PATH,t,r):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...s].some((a)=>ee(e,Tt(a,t,r),["settings.json"]))}case"secret.cli.copilot-cli":{let i=ne(process.env.COPILOT_HOME,"~/.copilot",t,r);return ee(e,i,["config.json"])||Ai(e,i,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return ee(e,ne(process.env.COPILOT_HOME,"~/.copilot",t,r),["mcp-config.json"]);case"secret.cli.kimi-code":{let i=ne(process.env.KIMI_CODE_HOME,"~/.kimi-code",t,r),s=ne(process.env.KIMI_SHARE_DIR,"~/.kimi",t,r);return ee(e,i,["server.token"])||Ai(e,i,["credentials"])||Ai(e,s,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let i=["config.toml","mcp.json"],s=re(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".kimi-code"||ee(e,ne(process.env.KIMI_CODE_HOME,"~/.kimi-code",t,r),i)||ee(e,ne(process.env.KIMI_SHARE_DIR,"~/.kimi",t,r),[...i,"config.json","config.json.bak"])}case"secret.cli.opencode":{let i=ve(ne(process.env.XDG_DATA_HOME,"~/.local/share",t,r),"opencode"),s=re(e).split("/").at(-1)??"",a=process.env.OPENCODE_DB?.trim(),c=a&&a!==":memory:"?[a,`${a}-wal`,`${a}-shm`]:[];return ee(e,i,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(s)&&ee(e,i,[s])||c.some((l)=>ki(e,l,t,r))}case"secret.cli.opencode.config":{let i=process.env.OPENCODE_CONFIG_DIR?ne(process.env.OPENCODE_CONFIG_DIR,"~/.config/opencode",t,r):ve(ne(process.env.XDG_CONFIG_HOME,"~/.config",t,r),"opencode"),s=process.env.ProgramData?[ve(ne(process.env.ProgramData,"",t,r),"opencode")]:[],a=["opencode.json","opencode.jsonc"];return a.includes(re(e).split("/").at(-1)??"")||ee(e,i,a)||(process.env.OPENCODE_CONFIG?.trim()?ki(e,process.env.OPENCODE_CONFIG,t,r):!1)||["/Library/Application Support/opencode","/etc/opencode",...s].some((c)=>ee(e,Tt(c,t,r),a))}case"secret.cli.pi":return ee(e,ne(process.env.PI_CODING_AGENT_DIR,"~/.pi/agent",t,r),["auth.json"]);case"secret.cli.pi.config":return ee(e,ne(process.env.PI_CODING_AGENT_DIR,"~/.pi/agent",t,r),["models.json"]);case"secret.cli.amp":{let i=Tt("~",t,r);return[ve(ne(process.env.XDG_DATA_HOME,"~/.local/share",t,r),"amp"),ve(i,".local","share","amp")].some((a)=>ee(e,a,["secrets.json"]))||Ai(e,ve(i,".amp"),["oauth"])}case"secret.cli.amp.config":{let i=["settings.json","settings.jsonc"],s=[ve(ne(process.env.XDG_CONFIG_HOME,"~/.config",t,r),"amp"),ve(Tt("~",t,r),".config","amp")],a=re(e).split("/");return s.some((c)=>ee(e,c,i))||a.at(-2)===".amp"&&i.includes(a.at(-1)??"")||(process.env.AMP_SETTINGS_FILE?.trim()?ki(e,process.env.AMP_SETTINGS_FILE,t,r):!1)}case"secret.cli.cursor":{let i=ve(ne(process.env.XDG_CONFIG_HOME,"~/.config",t,r),"cursor"),s=ve(ne(process.env.CURSOR_DATA_DIR,"~/.cursor",t,r),"projects");return ee(e,Tt("~/.cursor",t,r),["auth.json"])||ee(e,i,["auth.json"])||re(e).split("/").at(-1)==="mcp-auth.json"&&Un(re(e),re(s))}case"secret.cli.cursor.config":{let i=re(e).split("/");return i.at(-1)==="mcp.json"&&i.at(-2)===".cursor"}case"secret.cli.grok-build":return ee(e,ne(process.env.GROK_HOME,"~/.grok",t,r),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let i=re(e).split("/");return i.at(-1)==="config.toml"&&i.at(-2)===".grok"||ee(e,ne(process.env.GROK_HOME,"~/.grok",t,r),["config.toml","managed_config.toml","requirements.toml"])||ee(e,Tt("/etc/grok",t,r),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}function ne(e,t,n,r){return Tt(e?.trim()?e:t,n,r)}function ee(e,t,n){return n.some((r)=>jE(e,ve(t,r)))}function Ai(e,t,n){return n.some((r)=>Un(re(e),re(ve(t,r))))}function ki(e,t,n,r){return jE(e,Tt(t,n,r))}function jE(e,t){return re(e)===re(t)}function ve(e,...t){return dt([e,...t].filter(Boolean).join("/"))}function N$(e,t,n,r,o){if(n.length===0)return!1;let i=re(Ii(e,t,o));return n.some((s)=>Un(i,re(Ii(s,r,o))))}function D$(e,t,n,r,o){if(n.length===0)return!1;let i=re(Ii(e,t,o));if(!i)return!1;let s=process.env.HOME??Ph(),a=s?dt(J(Ne(s),Be,o)):"",c=re(a),l=process.env.CC_SAFETY_NET_HOME,u=re(l?dt(J(xl(Ne(l)),Be,o)):a&&dt(J(`${a}/.cc-safety-net`,Be,o)));if(u&&Un(i,u))return!1;return n.some((d)=>{let m=re(Ii(d,r,o));if(!m)return!1;if(c&&(c===m||c.startsWith(m.endsWith("/")?m:`${m}/`)))return!1;return Un(i,m)})}function M$(e){let t=e.split("/");return t.some((n)=>T$.has(n))||I$.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function $$(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of yh)if(r===o.extension&&Gt(o.id,t))return o.id;for(let o of bh)if(o.pattern.test(r)&&Gt(o.id,t))return o.id;return null}function re(e){return e.toLowerCase()}function Gt(e,t){return!t?.disabledRules?.includes(e)}function Tt(e,t,n){let{home:r,normalized:o}=Ah(e,n);if(!o)return"";if(!r)return o;let i=kh(o,r),s=_l(i)?i:dt(xl(t,i)),a=dt(J(s,Be,n));if(!Un(a,r)){if(_l(i))return a;return a===s?o:a}let c=a.slice(r.length);return c?`~${c}`:"~"}function kE(e,t){return e===t||e.startsWith(`${t}/`)}function L$(e,t,n){let{home:r,normalized:o}=Ah(e,n);if(!o||!r)return"";let i=kh(o,r),s=EM.normalize(_l(i)?i:dt(xl(t,i))),a=dt(Ne(process.env.HOME??Ph())),c=(d)=>process.platform==="win32"?d.toLowerCase():d,l=[r,a].find((d)=>d!==""&&Un(c(s),c(d)));if(l===void 0)return"";let u=s.slice(l.length);return u?`~${u}`:"~"}function Ii(e,t,n){let{home:r,normalized:o}=Ah(e,n);if(!o)return"";let i=r?kh(o,r):o;return dt(J(_l(i)?i:xl(t,i),Be,n))}function Ah(e,t){let n=process.env.HOME??Ph(),r=n?dt(J(Ne(n),Be,t)):"",o=dt(Ne(W$(ht(e))));return{home:r,normalized:o}}function W$(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return RM(e)}catch{return e}}function kh(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ve(t,e.slice(2));return e}function F$(e){if(process.platform==="win32")return!0;return wM.parse(e).root.length>1}function dt(e){let t=e.trim(),n=(F$(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Un(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function jn(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}import{dirname as Cl}from"path";var BE="Rulebook exceeds CC Safety Net's safe validation limits.",VE="Additional rulebook validation errors were omitted.",mt=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function HE(e){if(Th(e.allowed_commands,mt.maxAllowedCommands)||Th(e.rules,mt.maxRules)||Th(e.tests,mt.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=mt,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>mt.maxStringCodeUnits||i&&o.length>mt.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>mt.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let c of a)if(!r(c))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Th(e,t){return Array.isArray(e)&&e.length>t}function G$(e){if(!Z$(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!HE(e))return{errors:[BE],ruleNames:new Set};let t=(e.rulebook_version===2?VC():BC()).safeParse(e),n=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...t.success?[]:yl(t.error.issues,": ",": ")];return{errors:n.length>mt.maxValidationErrors?[...n.slice(0,mt.maxValidationErrors),VE]:n,ruleNames:new Set(vh(e).map((r)=>r.toLowerCase()))}}function qE(e){let t=G$(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}function Z$(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function ew(e={}){let t=Xh(e),n=!1;try{n=Zh(t.userConfigTarget,t.projectConfigTarget)}catch(m){if(m instanceof fe)return J$(t,m.message);throw m}let r=Sh(t.userConfigTarget),o=n?{config:null,errors:[]}:Sh(t.projectConfigTarget),i=XE(t.userConfigPath,r.errors),s=XE(t.projectConfigPath,o.errors),a=new Set,c=r.config?KE(r.config,Cl(t.userConfigPath),"user",t.userScope,a):QE(),l=o.config?KE(o.config,Cl(t.projectConfigPath),"project",t.projectScope,a):QE(),u=r.config?.overrides??{},d=o.config?.overrides??{};return{rules:[...YE(c.rules,u),...YE(l.rules,d)],transparent_wrappers:K$(r.config,o.config),rulebooks:[...c.rulebooks,...l.rulebooks],errors:[...i,...s,...c.errors,...l.errors],warnings:[...c.warnings,...l.warnings,...c.canValidateOverrides?JE(u,c.knownRuleIds,t.userConfigPath):[],...c.canValidateOverrides?Y$(d,c.knownRuleIds,t.projectConfigPath):[],...l.canValidateOverrides?JE(d,l.knownRuleIds,t.projectConfigPath):[]],userConfig:r.config??void 0,projectConfig:o.config??void 0,...t}}function KE(e,t,n,r=mn(Cl(Cl(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((l)=>{let u=j$(l,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let d=u.rulebook;if(o.has(d.name))return s.push(`duplicate active rulebook name "${d.name}" for ${l}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(d.name),[{rules:U$(d),rulebook:{source:n,spec:l,name:d.name,version:d.version,rules:d.rules.map((m)=>`${d.name}/${m.name}`)}}]}),c=a.flatMap((l)=>l.rules);return{rules:c,rulebooks:a.map((l)=>l.rulebook),entries:a.map((l)=>({spec:l.rulebook.spec,name:l.rulebook.name,version:l.rulebook.version,ruleCount:l.rulebook.rules.length})),knownRuleIds:new Set(c.map((l)=>l.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function U$(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function j$(e,t,n){let r=B$(e),o=Qh(t,r),i=H$(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${V$(e)}`]};let s=q$(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function B$(e){return Li(e)?Tl(e).name:e}function V$(e){return Li(e)?`run ${Jh} to vendor ${e}`:"create that file or remove that source from the rules config"}function H$(e,t){try{return{content:$i(Xr(t,e))}}catch(n){if(n instanceof fe)return{error:n.message};throw n}}function q$(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:qE(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function K$(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function YE(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function JE(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Y$(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function XE(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function J$(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function QE(){return{rules:[],rulebooks:[],entries:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}function tw(e={}){let t=ew(e),n=sE(e),r={rules:t.rules,transparentWrappers:t.transparent_wrappers,safety:n.safety,worktreeMode:n.worktreeMode,destructiveCommandProtectionEnabled:n.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:n.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:n.destructiveCommandAllowPaths,secretProtection:{enabled:n.secretProtection.enabled??!0,disabledRules:n.secretProtection.disabledRules??[],denyPaths:n.secretProtection.denyPaths,allowPaths:n.secretProtection.allowPaths??[]}},o={...t.userConfig?.overrides??{},...t.projectConfig?.overrides??{}},i=Object.freeze(Object.fromEntries(r.rules.map((s)=>{let a=t.rulebooks.find((l)=>l.rules.includes(s.name)),c=o[s.name];return[s.name,Object.freeze({id:s.name,...a?{rulebook:Object.freeze({name:a.name,version:a.version}),...t1(a.spec)?{source:a.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return n1(r,X$(t,n),i,n.policyScopes)}function X$(e,t){let n=e1(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:r1(e.errors.length>0?Q$(e.errors):void 0,e.warnings.length>0?Oh(e.warnings.join("; ")):void 0,n)}}function Q$(e){return`${Oh(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function e1(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function t1(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function n1(e,t,n=Object.freeze({}),r){let o=Ih(structuredClone(e)),i=r?{policyScopes:Ih(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ih(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ih(t);return Object.freeze(e)}function r1(...e){return Oh(e.filter((t)=>!!t).join("; "))}function Oh(e){return/[.!?]$/.test(e)?e:`${e}.`}class ln extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var o1={findPolicyMutation:yE,findGitMetadataMutation:hv,resolveGitMetadata:wu,loadPolicySnapshot:tw,findSensitiveTarget:DE,analyzeCommand:RS,getModes:wd};function nw(e,t={}){let n={...o1,...t.dependencies},r=a1(e),o=Oi(e)?e.command:r,i=cn("policy-protection",o,()=>So(e,t.factParserDependencies)),s=Se(i,"input-candidate"),a=Se(i,"declared-command");if(Oi(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Ot,intent:"stop_and_explain",evidence:[{kind:"command",command:e.command,segment:e.command}]}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:gy,intent:"stop_and_explain",evidence:[]}};let c=cn("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd])),l=cn("policy-protection",o,()=>n.findPolicyMutation(i));if(l){let E=o??l.target;return{stage:"policy-protection",decision:{kind:"deny",reason:hE,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:l.target}]}}}let u=cn("policy-protection",o,()=>kS(i));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:AS,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:u.target}]}}}let d=cn("policy-protection",o,()=>n.findGitMetadataMutation(i,c));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:qe,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:d.target}]}}}let m=cn("config-load",o,()=>n.loadPolicySnapshot({...t.policyOptions,cwd:e.context.configCwd})),f=m.policy,p=n.getModes(f),h={level:p.effectiveLevel,...i1(m)},y=f.secretProtection.enabled===!1?null:cn("secret-protection",o,()=>n.findSensitiveTarget(i,f.secretProtection,{strict:Oi(e)||s?.program.dialect==="powershell"?p.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:TE,intent:"hard_stop",ruleId:y.ruleId,evidence:[{kind:"command",command:E,segment:y.target}]}}}if(!Oi(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...zh("command-validation",o),...h};let v=cn("command-analysis",o,()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:Xe(),protectedGitMetadata:c,effectiveCapabilities:p.capabilities,strict:p.strict,paranoidRm:p.paranoidRm,paranoidInterpreters:p.paranoidInterpreters,worktreeMode:p.worktreeMode},s1(i),i.store));if(v)return{stage:"command-analysis",...h,decision:v};return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function i1(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function s1(e){return Se(e,"declared-command")?.program}function a1(e){try{return _o(e.input)}catch(t){let n=Oi(e)?e.command:void 0;throw new ln("policy-protection",zh("policy-protection",t instanceof Lt?void 0:n,t),t)}}function cn(e,t,n){try{return n()}catch(r){throw new ln(e,zh(e,r instanceof Lt?void 0:t,r),r)}}function zh(e,t,n){let r=n instanceof _e||n instanceof gt;return{stage:e,decision:{kind:"deny",reason:r?hy:Fi,intent:"stop_and_explain",evidence:t?[{kind:"command",command:t,segment:t}]:[]}}}function Oi(e){return e.route.kind==="command"}function ow(e,t){try{let n=nw(e,t.guard);return rw(e,n,t),n}catch(n){if(!(n instanceof ln))throw n;throw rw(e,n.evaluation,t,!(n.cause instanceof Lt),{stage:n.stage,errorCode:c1(n.cause)}),n}}function rw(e,t,n,r=!0,o){uy(ly(e,t,n.guard?.auditAllowed??!1,r,o),n.audit.getSessionId,{agent:n.audit.agent,shape:n.audit.shape,homeDir:n.audit.homeDir})}function c1(e){if(e instanceof _e)return"path-canonicalization-limit";if(e instanceof Lt)return"tool-input-limit";if(e instanceof gt)return"structural-shell-syntax-limit";return"unexpected-error"}var sw=u1();function u1(e={}){return(t,n)=>d1(t,n,e)}function d1(e,t,n){let r=m1(e,t),o=()=>g1(e);if("malformed"in r)return dy(r.denial,o,{agent:"amp",toolName:r.denial.toolName,cwd:r.cwd}),aw(r.denial);try{let i=ow(r,{guard:{auditAllowed:Cd(),dependencies:n.guardDependencies},audit:{agent:"amp",getSessionId:o}});return iw(i,!0)}catch(i){if(!(i instanceof ln))throw i;if(Qt(me.debug))console.error(`CC Safety Net debug: amp tool.call analysis failed: ${xy(i.cause)}`);return iw(i.evaluation,r.route.kind==="command")}}function m1(e,t){if(!e||typeof e!=="object")return Jr(null);let n=e;if(typeof n.tool!=="string"||n.tool.trim()==="")return Jr(null);if(!n.input||typeof n.input!=="object")return Jr(null,n.tool);let r=f1(t);if(!r)return Jr(null,n.tool);let o=p1(t,e);if(!o.ok)return Jr(r,n.tool);if(!o.command)return yr(n.tool,n.input,{kind:Su(n.tool)},{configCwd:r,executionCwd:r},null);if(typeof o.command.command!=="string"||o.command.command.trim()==="")return Jr(r,n.tool);let i=typeof o.command.dir==="string"?fy(o.command.dir,r):r;if(!i)return{malformed:!0,denial:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",command:o.command.command,segment:o.command.dir,toolName:n.tool},cwd:r};return yr(n.tool,n.input,{kind:"command",shell:"posix"},{configCwd:r,executionCwd:i},o.command.command)}function f1(e){let t=e.system.workspaceRoot;if(!t)return;try{let n=e.helpers.filePathFromURI(t);if(typeof n!=="string"||n.trim()==="")return;return $l(".",[n])}catch{return}}function p1(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function g1(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function Jr(e,t){return{malformed:!0,denial:_y({toolName:t}),cwd:e}}function iw(e,t){let n=vy(e,{includeEvidence:t});return n?aw(n):{action:"allow"}}function aw(e){return{action:"reject-and-continue",message:Sy(e)}}function h1(e){e.on("tool.call",(t)=>sw(t,e))}export{h1 as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function qo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(_(e)):e.provenance==="literal"}function mr(e){return e?_(e):""}function SR(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Sa(e,t){return ha(De(e,"posix"),t)}function pr(e){return Sa(e,new Set(Array.from(e.matchAll(fm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function ha(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(ha(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>ha(o,n))||ym(r.words,n))return!0;RR(r,n)}return!1}function ym(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(fr(r,t))return!0;let o=L(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return mm(e[s],t)}if(J.has(o)){let s=e.slice(n),a=Ke(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&mm(s[l],t)}let i=CR(e,n,t);if(i===null)return!1;if(i===-1)return!0;return ym(e.slice(i),t)}function CR(e,t,n){let r=L(e[t]?.text??"");if(r==="command")return bR(e,t+1);if(r==="exec")return vR(e,t+1);if(r==="env")return ER(e,t+1,n);return null}function bR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function vR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function ER(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return fr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return fr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function RR(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(fr(n,t))t.add(r.name)}}function fr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(fm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(cR.test(o)||t.has(o))}))}function mm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||fr(e,t))}var Ca="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ba="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",xR="__CC_SAFETY_NET_XARGS_INPUT__",Yo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Zo="rm",_R=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,wR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,AR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,PR=/^(?:[0-9]+|[@*])$/;function vm(e,t){let n=e.map(_),{childStart:r,replacementToken:o}=jt(n),i=n.slice(r),s=S("xargs.shell-dynamic",ba);if(IR(i,o,t)&&T(s,t.policy))return T(s,t.policy);for(let a of Be(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?T(s,t.policy):null;if(c)return c;let d=_m(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&Rm(l,o),u=t.analyzeChild(l,{...Sm(a,t),dynamicInput:d,dynamicSourceInput:m||Em(l,a.head,o,a.wrapperEnvAssignments,d,t.scanWork,t.environment),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:S("xargs.rm-recursive-force-dynamic",Ca)});if(u)return u;let f=TR(l,o,t.policy?.rules??[]);if(f)return f;if(a.head==="git"){let h=o===null?[...l,xR]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...Sm(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=ze(l,t.policy?.rules??[]);if(p)return p}return null}function Sm(e,t){return{producer:"xargs",cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function TR(e,t,n){if(n.length===0)return null;if(t===null){for(let o of n){let i=ze([...e,...o.subcommand?[o.subcommand]:[],...o.block_args],n);if(i)return i}return null}let r=new Set(n.flatMap((o)=>[o.subcommand,...o.block_args].flatMap((i)=>i?e.flatMap((s)=>va(s,t,i)):[])));for(let o of r){let i=ze(e.map((s)=>s.replaceAll(t,o)),n);if(i)return i}return null}function va(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=e.slice(0,r),i=e.slice(r+t.length);return n.startsWith(o)&&n.endsWith(i)?[n.slice(o.length,n.length-i.length)]:[]}function Em(e,t,n,r,o,i,s){if(J.has(t)){if(ot(e))return!1;if(n!==null&&kR(e,n))return!0;let a=rt(e);if(!a){let l=it(q(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n))return!0;if(et(a,i))return!0;return OR(a,n,r)}if(Me(t))return Cm(e,n,bo,Gu(t));if(we.has(t))return Cm(e,n,na,Fd);if(t==="eval"){let a=Vo(q(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return MR(e,n,i,s);if(t==="git"){let a=Ue(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&En.has(a.subcommand.toLowerCase())&&xm(a.rest,n).some((l)=>l.includes(n))}return!1}function Cm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Yo]).sources.some((l)=>l.value===Yo);if(o.sources.some((l)=>l.value.includes(t)))return!0;let i=new Set(o.sources.map((l)=>`${l.tokenIndex}\x00${l.kind}\x00${l.value}`)),s=r.flatMap((l)=>[l.selector,...l.valueForm==="attached-only"||l.valueForm==="attached-or-separate"?[`${l.selector}${Yo}`]:[],...l.valueForm==="equals-or-separate"?[`${l.selector}=${Yo}`]:[]]),a=new Set(s.flatMap((l)=>e.flatMap((c)=>va(c,t,l))));return Array.from(a).some((l)=>n(e.map((c)=>c.replaceAll(t,l))).sources.some((c)=>!i.has(`${c.tokenIndex}\x00${c.kind}\x00${c.value}`)))}function IR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Be(e,n),(i)=>i.head)),o=t===null?[...e,Zo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Zo));return Array.from(Be(o,n)).some((i)=>i.head===Zo&&!r.has(Zo))}function Rm(e,t){return xm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function xm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function _m(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function kR(e,t){let n=Ke(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return va(i,t,o).some((l)=>{let c=e.map((m,u)=>u===s?m.replaceAll(t,l):m),d=Ke(c);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(n.commandIndex===null&&d.commandIndex!==null)return!0;if(n.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(c[d.commandIndex]??"").includes(l))return!0;return d.scriptIndex!==null&&(c[d.scriptIndex]??"").includes(l)})}))}function OR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(_R))if(bm(o,r))return!0;for(let o of e.matchAll(wR))for(let i of(o[1]??"").matchAll(AR))if(bm(i,r))return!0;return Sa(e,r)}function bm(e,t){let n=e[1]??e[2];return n!==void 0&&(PR.test(n)||t.has(n))}function MR(e,t,n,r){if(t===null)return!0;let o=!1,i=0;for(let s=1;s<e.length;s++){let a=e[s]??"";if(!o&&!a.startsWith("-")&&a!=="!"&&a!=="("){if(a.indexOf(t)===0)return!0;continue}if(o=!0,i>0){i--;continue}if(nt(a)){let c=ur(e,s);s=c.nextIndex-1;for(let d of Be(c.tokens,{environment:r,cwd:void 0})){let m=_m(d.tokens,t,d.wrapperEnvAssignments);if(d.head==="rm"&&Rm(d.tokens,t)||Em(d.tokens,d.head,t,d.wrapperEnvAssignments,m,n,r))return!0}continue}let l=St(a);if(l>0){if(i=l,a.includes(t))return!0;continue}if(a.includes(t))return!0}return!1}function jt(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var hr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",yr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",NR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",LR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",WR=/\{[^{}\s]*\}/,Mm=/\{\}|\{-?\d+\}/g,FR=["e","f","source","file","-e","-f","--source","--file"],GR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],zR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),BR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),wm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),$R=new Set(["--workdir","--wd"]),Am="__CC_SAFETY_NET_PARALLEL_SOURCE__",UR=new TextEncoder,xa=P.parallelDerivedBytes.cap+4*P.parallelPlaceholderReplacements.cap;function ye(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Dm(e,t){return ye([...e],(n)=>et(n,t.scanWork))}function Nm(e,t){let n=e.map(_);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=Kt(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Hm(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:d,dryRun:m}=o;if(c){let p=Kt(t);if(p)return p;let h=Dm(t.envAssignments?.values()??[],t);if(h)return h}if(l){let p=XR(t);if(p)return p}if(d!==void 0&&a){let p=Kt(t);if(p)return p}let u=tx(d,t.cwd,t.environment.paths);if(u===null){let p=Kt(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(m){if([...Be(i,f)].flatMap((h)=>[...h.envAssignments.values()]).some(Pa)){let h=Kt(t);if(h)return h}return null}if(i.length===0){if(s.some((g)=>g.length!==1)){let g=Kt(t);if(g)return g}let p=s.map((g)=>g[0]??"");Re(t.budget,_a(p));let h=zm(f.envAssignments,f.cwd,a);return ye(p,(g)=>t.analyzeNested(g,h))}return ye(Be(i,f),(p)=>HR(p,o,t,f))}function HR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some($m)){let g=Kt(n);if(g)return g}let d=Dm(c,n);if(d)return d;let m=c.some(G),u=i||m,f=a&&u,p=zm(e.envAssignments,e.wrapperCwd,s||f);if(J.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return Re(n.budget,Xo(l,o,"generic")),ye(o,(E)=>n.analyzeChild(l.map((b)=>vt(b,E)),Ea(e,r)))};if(ot(l))return g();let y=rt(l);if(y){if(Um(y)){let R=Vt(n);if(R)return R;if(o.length===0)return null;return Re(n.budget,Om(y,o)),ye(o,(A)=>n.analyzeNested(vt(y,A),p))}if(G(y)){if(o.length>0)return Re(n.budget,Om(y,o)),ye(o,(K)=>n.analyzeNested(vt(y,K),p));Re(n.budget,Im(y));let R=dr(y);if(R?.[0]&&L(R[0])==="rm"&&$e(R)){let K=Tm(n);if(K)return K}let A=R?n.analyzeChild(R,{...Ea(e,r),dynamicInput:a,shellDynamicMatch:S("parallel.shell-dynamic",yr),rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",hr)}):null;if(A)return A;return n.analyzeNested(y,p)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((R)=>Ko(q(R===void 0?l:i?l.map((A)=>vt(A,R)):[...l,...R]),y)):[];if(E.some((R)=>R.kind==="dynamic")){let R=Vt(n);if(R)return R}let b=E.flatMap((R)=>R.kind==="literal"?[R.source]:[]);if(b.length>0)return Re(n.budget,_a(b)),ye(b,(R)=>n.analyzeNested(R,p));if(Re(n.budget,Im(y)),pr(y)){let R=Vt(n);if(R)return R}let w=n.analyzeNested(y,p);if(w)return w;if(u)return Vt(n);return null}let v=it(q(l));if(v.kind==="dynamic"||v.kind==="literal"&&G(v.source))return Vt(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=Vt(n);if(E)return E;let b=g();if(b)return b;if(i)return null;let w=o.flatMap((R)=>R[0]===void 0?[]:[R[0]]);return Re(n.budget,_a(w)),ye(w,(R)=>n.analyzeNested(R,p))}if(u||a)return Vt(n)??g();return null}if(e.head==="rm"&&$e(l)){if(i&&o.length>0)return Re(n.budget,Xo(l,o,"rm")),ye(o,(y)=>Ra(l.map((v)=>wa(v,y)),e.cwd,r));if(o.length>0)return Re(n.budget,km(l,o)),ye(o,(y)=>Ra([...l,...y],e.cwd,r));let g=Ra(l.flatMap((y,v)=>{if(v===0||!G(y))return[y];return y.startsWith("-")?[wa(y,[""])]:[]}),e.cwd,r);if(g)return g;return Tm(n)}Re(n.budget,i&&o.length>0?Xo(l,o,"generic"):o.length>0?km(l,o):Gm(l));let h=o.length>0?o:[void 0];return ye(h,(g)=>{let y=g===void 0?l:i?l.map((Y)=>vt(Y,g)):[...l,...g],v=S("parallel.shell-dynamic",yr),E=a&&e.head==="find"?ZR(y,r):null,b=Wm(y,a,n.policy?.rules??[],n.budget)??E?.customResult??null,w=L(e.head),R=a&&(w==="rm"&&Aa(y)||w==="xargs"&&Fm(y)||E?.rmOptions===!0),A=a&&(R||E?.executedSource===!0||E===null&&Lm(y,w)),K=n.analyzeChild(y,{...Ea(e,r),worktreeMode:s||a||u?!1:n.worktreeMode,dynamicInput:a||u,dynamicRmInput:R,dynamicSourceInput:b!==null||A,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",hr)});if(A){let Y=T(v,n.policy);if(Y)return Y}return K??b??ze(y,n.policy?.rules??[])})}function Ea(e,t){return{producer:"parallel",cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Lm(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return KR(e);if(t==="git")return jR(e);if(t==="find")return!0;if(we.has(t))return Pm(e,FR,cr);if(Me(t))return Pm(e,GR,Co);return!1}function Aa(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||Um(o)))}function jR(e){if(VR(e))return!0;let t=Ue(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!En.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function VR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function KR(e){if(ot(e))return!1;let t=rt(e);if(t!==null)return G(t);let n=it(q(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function Pm(e,t,n){let r=n(e);if(r.some((i)=>G(i.value)))return!0;if(!e.some(G))return n([...e,Am]).some((i)=>i.value===Am);let o=new Set(r.map((i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`));return t.some((i)=>n(e.map((s)=>vt(s,[i]))).some((s)=>!o.has(`${s.tokenIndex}\x00${s.kind}\x00${s.value}`)))}function Wm(e,t,n,r){if(!t||n.length===0)return null;let o=n.filter((s)=>L(s.command)===L(e[0]??""));if(o.length===0)return null;let i=e.some(G);if(Re(r,qR(e,o,i)),!i)return ye(o,(s)=>ze([...e,...s.subcommand?[s.subcommand]:[],...s.block_args],[s]));return ye(o,(s)=>{let a=new Set([s.subcommand,...s.block_args].flatMap((l)=>l?YR(e,l):[]));return ye(a,(l)=>ze(e.map((c)=>vt(c,[l])),[s]))})}function qR(e,t,n){let r=n?qt(Ie(t.map((o)=>o.block_args.length+(o.subcommand?1:0)),P.parallelChildAnalyses.cap),2*Math.max(e.length,1),P.parallelChildAnalyses.cap):t.length;return{childAnalyses:r,derivedTokens:qt(r,e.length,P.parallelDerivedTokens.cap)}}function YR(e,t){return e.flatMap((n)=>{let r=[...n.matchAll(/\{[^{}\s]*\}/g)];if(r.length!==1)return[];let o=r[0];if(!o||o.index===void 0)return[];let i=n.slice(0,o.index),s=n.slice(o.index+o[0].length);if(!t.startsWith(i)||!t.endsWith(s))return[t];let a=t.slice(i.length,t.length-s.length);return a!==t?[t,a]:[t]})}function ZR(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of Be(i,t))n.executedSource||=Lm(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Aa(a.tokens)||a.head==="xargs"&&Fm(a.tokens),n.customResult??=Wm(a.tokens,!0,t.policy?.rules??[],t.budget)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(nt(a)){i=[],n.executedSource||=G(a);continue}let l=St(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function Fm(e){let t=e.slice(jt(e).childStart);return L(t[0]??"")==="rm"&&Aa(t)}function Jo(e,t){return(n)=>T(S(e,t),n.policy)}var Vt=Jo("parallel.shell-dynamic",yr),XR=Jo("parallel.command-stream-dynamic",NR),Kt=Jo("parallel.command-stream-dynamic",LR),Tm=Jo("parallel.rm-recursive-force-dynamic",hr);function Ra(e,t,n){return T(jo(q(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:yt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:zt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function _a(e){return{childAnalyses:e.length,derivedTokens:e.length,derivedBytes:Sr(e)}}function Im(e){return Gm([e])}function Gm(e){return{childAnalyses:1,derivedTokens:e.length,derivedBytes:Sr(e)}}function km(e,t){if(t.length>P.parallelChildAnalyses.cap)return{childAnalyses:t.length};return{childAnalyses:t.length,derivedTokens:Ie(t.map((n)=>e.length+n.length),P.parallelDerivedTokens.cap),derivedBytes:Ie([qt(Sr(e),t.length,P.parallelDerivedBytes.cap),Ie(t.map((n)=>Sr(n)),P.parallelDerivedBytes.cap)],P.parallelDerivedBytes.cap)}}function Om(e,t){return Xo([e],t,"generic")}function Xo(e,t,n){if(t.length>P.parallelChildAnalyses.cap)return{childAnalyses:t.length};let r=qt(e.length,t.length,P.parallelDerivedTokens.cap);if(r>P.parallelDerivedTokens.cap)return{childAnalyses:t.length,derivedTokens:r};let o=ex(e.map((l)=>QR(l,n))),i=qt(o.occurrences,t.length,P.parallelPlaceholderReplacements.cap);if(i>P.parallelPlaceholderReplacements.cap)return{childAnalyses:t.length,derivedTokens:r,placeholderReplacements:i};if(JR(o,t,i))return{childAnalyses:t.length,derivedTokens:r,derivedBytes:P.parallelDerivedBytes.cap+1,placeholderReplacements:i};let s=n==="generic"?vt:wa,a=Ie(t.map((l)=>Sr(e.map((c)=>s(c,l)))),P.parallelDerivedBytes.cap);return{childAnalyses:t.length,derivedTokens:r,derivedBytes:a,placeholderReplacements:i}}function JR(e,t,n){let r=P.parallelDerivedBytes.cap+4*n;return Ie([qt(e.fixedBytes,t.length,r),qt(e.occurrences,Ie(t.map((o)=>o.reduce((i,s)=>Math.max(i,gr(s)),0)),r),r)],r)>r}function QR(e,t){let n=t==="generic"?e.matchAll(/\{[^{}\s]*\}/g):e.matchAll(Mm),r=0,o=0,i=0;for(let s of n){if(r>=P.parallelPlaceholderReplacements.cap)return{occurrences:P.parallelPlaceholderReplacements.cap+1,fixedBytes:0};o=Ie([o,gr(e.slice(i,s.index))],xa),r++,i=s.index+s[0].length}return{occurrences:r,fixedBytes:r===0?gr(e):Ie([o,gr(e.slice(i))],xa)}}function ex(e){return{occurrences:Ie(e.map((t)=>t.occurrences),P.parallelPlaceholderReplacements.cap),fixedBytes:Ie(e.map((t)=>t.fixedBytes),xa)}}function Sr(e,t=P.parallelDerivedBytes.cap){return Ie(e.map(gr),t)}function gr(e){return UR.encode(e).byteLength}function Ie(e,t){let n=0;for(let r of e){if(!Number.isSafeInteger(r)||r<0||r>t-n)return t+1;n+=r}return n}function qt(e,t,n){if(!Number.isSafeInteger(e)||!Number.isSafeInteger(t)||e<0||t<0||e!==0&&t>Math.floor(n/e))return n+1;return e*t}function zm(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function vt(e,t){return e.replace(/\{[^{}\s]*\}/g,(n)=>Bm(n,t))}function wa(e,t){return e.replace(Mm,(n)=>Bm(n,t))}function Bm(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n),o=r>0?r-1:t.length+r;return t[o]??""}function G(e){return WR.test(e)}function $m(e){if(Pa(e))return!0;for(let t of e.matchAll(/\{[^{}\s]*\}/g))if(!/^(?:\{\}|\{-?\d+\})$/.test(t[0]))return!0;return!1}function Pa(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Um(e){return/^\{[^{}\s]*\}$/.test(e)}function Hm(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=ia(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=ia(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){a=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||BR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(wm.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=wm.has(p)?2:1;continue}if($R.has(y)){let E=v??h;if(E===void 0||E===":::"||E==="--"){c=!0,t++;continue}l=E,c||=v!==void 0&&E==="",t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(zR.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(a?Pa:$m);let d=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){d.push(p),p=[];continue}if(g!==void 0)p.push(g)}d.push(p)}let m=nx(d),u=n.some(G),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:u,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:l,dryRun:a}}function tx(e,t,n){if(e===void 0)return;if(e==="..."||/[{}$`*?~[]/.test(e))return null;if(!t&&!DR(e))return null;try{return ft(t??e,e,n)}catch{return null}}function nx(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let n of e){if(n.length===1){let o=n[0];if(o===void 0)return[];for(let i of t)i.push(o);continue}let r=[];for(let o of t)for(let i of n)if(r.push([...o,i]),r.length>P.parallelChildAnalyses.cap)return r;t=r}return t}function jm(e){return Hm(e).childStart}var rx="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Qo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ia(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Ta(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Km(e,t,n,r,o=!1,i){let a=(Un(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&Q(i,"shell.dynamic-executable",o)?S("shell.dynamic-executable",rx):null;return T(a,i)??qm(e,t,n,o,i)}function qm(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ia(a)?[l]:[]);if(i.length===0)return null;let s=L(t[0]?.text??"");if(s==="git"){let a=pn(e,t),l=ix(a);if(Q(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return T(S("shell.dynamic-structure",Qo),o);if(T(Ho(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),d=a.findIndex((m,u)=>u>l&&_(m)==="--");if(Q(o,"shell.dynamic-structure",r)&&c&&En.has(c)&&i.some((m)=>m>l&&(d===-1||m<d)))return T(S("shell.dynamic-structure",Qo),o);return null}if(s==="find")return Q(o,"shell.dynamic-structure",r)&&sx(t)?T(S("shell.dynamic-structure",Qo),o):null;if(s==="rm"){let a=t.findIndex((c,d)=>d>0&&_(c)==="--"),l=$e(t.map(_));return Q(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?T(S("shell.dynamic-structure",Qo),o):null}if(s==="xargs")return Vm(e,t.slice(jt(t.map(_)).childStart),"xargs",n,r,o);if(s==="parallel")return Vm(e,t.slice(jm(t.map(_))),"parallel",n,r,o);return null}function Vm(e,t,n,r,o,i){if(t.length===0)return null;let s=ox(t,r);if(Un(e,s)){let l=T(S(`${n}.shell-dynamic`,n==="xargs"?ba:yr),i);if(l)return l}let a=qm(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ia(l)&&Ta(l)))return T(S(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ca:hr),i);return null}function ox(e,t){let n=Wt(e,t),r=n.rewritten?q(n.words.map(_)):n.words,o=r[0];return o&&_(o)==="busybox"?r.slice(1):r}function ix(e){let t=1;while(t<e.length){let n=e[t],r=n?_(n):"";if(le.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function sx(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ia(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Ta(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Ta(s)))return!0;continue}if(t=!0,a)return!0;let l=St(s.text);if(l>0){n=l;continue}if(nt(s.text))o=!0,r=!0}return!1}function ka(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!go(t[n.tokenIndex],n.value)})}var ax="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",lx="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",cx="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Ym(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return S("dd.device-write",ax);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return S("mkfs.device",lx);if(e==="shred"&&n.length>0)return S("shred.target",cx);return null}var Xm=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>jo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:yt(e.envAssignments,e.options.environment),trustedTmpdirValue:zt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Ho(e.words,Oa(e))},{heads:new Set(["find"]),analyze:(e)=>Hd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:yt(e.envAssignments,e.options.environment),trustedTmpdirValue:zt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Yt(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>vm(e.words,{...Zm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Yt(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Nm(e.words,{...Zm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Yt(e.options.analyzeNested(t,n))})}];function Zm(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy,scanWork:e.options.scanWork}}function Yt(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Oa(e){return{environment:e.options.environment,cwd:e.cwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var tf="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function nf(e){return Xm.find((t)=>t.heads.has(e))?.analyze}function xn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((k)=>o==="posix"?_(k):k.text),s=n.child,a=s!==void 0&&s.producer!=="unknown-head",l=s?.producer==="unknown-head",c=n.effectiveCwd===null,d=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,u=_o(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let f=Wt(u.words,n.environment,d,new Map([...n.envAssignments??[],...u.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let x=[...p,...i(f.words)].join(" "),k=et(x,n.scanWork);if(k)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:k.reason}),me(k);if(n.strict)return Se(r);let N=wo(p,i(f.words));if(N){n.budget.charge("derivedTokens",N.length);let ne=n.analyzeNested(N.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments])});if(ne)return ne}}let h=f.rewritten?q(i(f.words)):pn(o,f.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>h.length){let x=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments]),E=g[0];if(!E)return null;if($t(E))throw new F("wrapperPeelIterations");let b=L(E),w=f.cwd===null?void 0:f.cwd??d,R=f.cwd===null?void 0:m,A=f.cwd===void 0?n.effectiveCwd:f.cwd,K=s?s.allowTmpdirVar:!sr(v,n.environment),Y=Km(o,f.words,n.environment,t===0,n.strict,n.policy);if(Y)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Y.reason}),me(Y);let te=zo(g,n.policy);if(te){for(let x of[te.childIndex,...te.alternativeChildIndices]){Jm(y.wrapperNormalizationBudget);let k=h.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:te.wrapper,output:i(k)});let N=xn(k,t,{...y,effectiveCwd:A,envAssignments:v});if(N)return N}return null}let X=l?void 0:b==="eval"?Vo(h):b==="trap"&&!a?gm(h):void 0;if(a&&s&&b==="eval"){if(X?.kind==="dynamic")return Rn(s,n.policy);if(X?.kind==="literal"){let x=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:v});if(x)return x}return _n(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!ya(n.commandView)))return Se(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:b==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let x=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:v,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?J.has(b):of(E,b)){if(ot(g))return null;if(a&&s){let x=rt(g);if(x){if(s.dynamicSourceInput??s.dynamicInput){let N=Rn(s,n.policy);if(N)return N}if(pr(x)){let N=Rn(s,n.policy);if(N)return N}return n.analyzeNested(x,{effectiveCwd:A,envAssignments:v})}let k=it(h);if(k.kind==="dynamic")return Rn(s,n.policy);if(k.kind==="literal")return s.dynamicSourceInput?Rn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?Rn(s,n.policy):null}if(l){let x=rt(g),k=x?n.analyzeNested(x,{effectiveCwd:A,envAssignments:v}):it(h).kind==="dynamic"?Se(r):null;if(k)return k}if(s===void 0){let x=fx(g,v,A,n,r,t);if(x)return x;let k=rt(g);if(k){let en=Ko(h,k);if(en.kind==="dynamic")return Se(r);let Si=en.kind==="literal"?en.source:k,cl=px(Si);r?.recordSegment({type:"shell-wrapper",wrapper:b,innerCommand:cl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:cl,depth:t+1});let ul=n.analyzeNested(Si,{effectiveCwd:A,envAssignments:v});if(ul)return ul;return pr(Si)?Se(r):null}let N=it(h);if(N.kind==="dynamic")return Se(r);if(N.kind==="literal")return ti(N.source,A,v,n,r,t);let ne=hm(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(ne.kind==="dynamic")return Se(r);if(ne.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:ne.source,depth:t+1}),n.analyzeNested(ne.source,{effectiveCwd:A,envAssignments:v})}}if(!s&&(b==="source"||b===".")){let x=g[1]==="-p"?2:null;if(x!==null){let en=n.commandView?h[x]:void 0;if(!en)return null;if(en.provenance!=="literal")return Se(r)}let k=x===null?1:3,N=g[k]==="--"?k+1:k,ne=n.commandView?h[N]:void 0;if(!ne)return null;if(ne.provenance==="literal")return ti(ne.text,A,v,n,r,t);if(n.strict||!n.commandView||!ya(n.commandView))return Se(r)}if(we.has(b)&&!l){if(!s&&n.strict&&ka(cr(g),h))return Se(r);let x=Gd(g,(N)=>Yt(n.analyzeNested(N,{effectiveCwd:A,envAssignments:v}))),k=T(x,n.policy);if(k)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:k.reason}),me(k)}if(Me(b)&&!l){if(!s&&n.strict&&ka(Co(g),h))return Se(r);let x=Fu(g);if(a&&s)return dx(b,x,A,v,n,s);if(x){let k=Q(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:b,codeArg:x,paranoidBlocked:k}),k){let ne=T(S("interpreter.one-liner-paranoid",Xn),n.policy);if(ne)return me(ne)}if(Ls(b,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let N=n.analyzeNested(x,{effectiveCwd:A,envAssignments:v});if(N&&!rf(N,x))return N;if(Jn(x,n.scanWork)){let ne=T(S("interpreter.dangerous-command",yn),n.policy);if(ne)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:yn}),me(ne)}r=void 0}}if(b==="busybox"&&g.length>1)return Jm(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),xn(h.slice(1),t,{...y,effectiveCwd:A,envAssignments:v});let D=s?null:T(Ym(b,g),n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:D.reason}),me(D);let oe=r===y.trace?y:{...y,trace:r},_e={words:h,head:b,cwd:w,originalCwd:R,envAssignments:v,allowTmpdirVar:K,dynamicArguments:f.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:oe,analyzeChildTokens:(x,k)=>a&&s?Ma(x,t,oe,{...s,cwd:k??void 0,effectiveCwd:k??void 0}):Yt(xn(q(x),t+1,{...oe,child:void 0,commandView:void 0,effectiveCwd:k,envAssignments:v}))??ze(x,oe.policy.rules),analyzeChild:(x,k)=>Ma(x,t,oe,k)},Ye=s&&(b==="xargs"||b==="parallel")?void 0:nf(b);if(b==="rm"||b==="xargs"||b==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,isOverriddenToNonTemp:!K,allowTmpdirVar:K});let ke=r&&b==="git"?om(_e.words,Oa(_e)):void 0,hi=Qm(ke?ke.match:Ye?.(_e)??null,n.policy);if(r)gx(_e,hi,ke?.relaxation??null);if(hi)return me(hi);if(a&&s&&(b==="rm"||b==="rmdir")){if(!(b==="rm"&&($e(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?_n(s,n.policy):null)??mx(s,n.policy)}let al=Ye!==void 0,ll=!s&&!al&&!Ur.has(b),yi=r&&ll?[]:void 0;if(ll)for(let x=1;x<g.length;x++){let k=g[x];if(!k)continue;yi?.push(k);let N=Qm(ux(g,x,t,oe,w,R,A,v),n.policy);if(N)return r?.recordSegment({type:"fallback-scan",tokensScanned:yi??[],embeddedCommandFound:L(k)}),me(N)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:yi??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&al)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let Ar=ze(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Ar,reason:Ar?.reason}),Ar)return me(Ar);return a&&s?_n(s,n.policy):null}function Ma(e,t,n,r){return Yt(xn(q(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function ux(e,t,n,r,o,i,s,a){for(let l of Be(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let d=L(c);if(of(c,d)||nf(d)!==void 0&&d!=="xargs"&&d!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=Ma(l.tokens,n,r,{producer:"unknown-head",cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!sr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function dx(e,t,n,r,o,i){if(!t)return _n(i,o.policy);if(Q(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=T(S("interpreter.one-liner-paranoid",Xn),o.policy);if(a)return me(a)}if(Ls(e,t))return _n(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!rf(s,t))return s;if(Jn(t,o.scanWork)){let a=T(S("interpreter.dangerous-command",yn),o.policy);if(a)return me(a)}return _n(i,o.policy)}function rf(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Wo)||e.reason===vn)&&!Hr(t)}function Rn(e,t){let n=e.shellDynamicMatch?T(e.shellDynamicMatch,t):null;return n?me(n):null}function _n(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?T(e.dynamicSourceMatch,t):null;return n?me(n):null}function mx(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?T(e.rmDynamicMatch,t):null;return n?me(n):null}function fx(e,t,n,r,o,i){let s=um(e);if(s.argvSource?.kind==="absent")return Se(o);if(s.argvSourceApplies&&s.argvSource){let l=ti(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ti(a,n,t,r,o,i,!0)}function ti(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return Se(o);let a=Zn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?Se(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function px(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function gx(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function Jm(e){if(e.iterations>=P.wrapperPeelIterations.cap)throw new F("wrapperPeelIterations");e.iterations++}function me(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function Se(e){return e?.recordSegment({type:"error",message:tf}),me(hx())}function hx(){return{id:"",reason:tf,intent:"stop_and_explain"}}function of(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(I(t))}function Qm(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:T(e,t)}var yx=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,Sx=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function Cx(e,t){let n=lf(e,t);if(n.length===0)return!1;let r=n[af(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return yx.test(e.join(" "))}function sf(e,t,n,r){if(e.dialect==="powershell"){let a=bx(e.words,r);if(a.kind==="none")return;if(!t||a.kind==="unknown")return null;return ef(xx(a.target),t,n.paths)}let o=e.words.map(_);if(!Cx(o,n))return;if(!t)return null;let i=lf(o,n,t),s=af(i);if(s===-1||i[s]!=="cd")return null;return ef(i[s+1],t,n.paths)}function ef(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return _x(ft(t,e,n),t,n)?t:null}catch{return null}}function bx(e,t){let n=vx(e[0])?1:0,r=e[n];if(!Ex(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!Sx.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return Rx(e.slice(n+1),t)}function vx(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function Ex(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function Rx(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function xx(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function af(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function lf(e,t,n){let r=wx(e);return pt([...r],t,n)}function _x(e,t,n){let r=n.realpath(e),o=n.realpath(t);if(r===null||o===null)return ei(e)===ei(t);return ei(r)===ei(o)}function wx(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var Na="TMPDIR",La="IFS",cf=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,uf=/^[A-Za-z_][A-Za-z0-9_]*$/,df=new Set(["export","typeset","declare","readonly"]),Ax=new Set(["builtin","command","time"]);function mf(e,t){return{env:e,effectiveEnvAssignments:Ox(e,t),shellAssignments:new Map}}function ff(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments)}}function Wa(e,t){let n=gf(e,t);n.assignments.filter((s)=>s.persists).forEach((s)=>{t.shellAssignments.set(s.name,s.value),Fa(t,s)});let r=n.commandIndex;if(r!==-1&&df.has(e[r]??""))e.filter((s)=>uf.test(s)&&Da(s)).forEach((s)=>{Mx(t,s)});let o=r===-1?-1:hf(e,r);if(o===-1||e[o]!=="unset")return;let i=Nx(e,o);if(i===null)return;e.slice(i).forEach((s)=>{Dx(t,s)})}function pf(e,t){let n=gf(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function gf(e,t){let n=e.findIndex((s)=>!Px(s)),r=n!==-1&&df.has(e[hf(e,n)]??""),o=kx(t);return{assignments:e.flatMap((s,a)=>{let l=Tx(s,o,t.env);if(!l)return[];if(n!==-1&&a>n&&!r&&!Eo(l.name))return[];return o.set(l.name,l.value),[{...l,persists:n===-1||r}]}),commandIndex:n}}function hf(e,t){let n=t;while(Ax.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function Px(e){return Pe(e)!==null||cf.test(e)}function Tx(e,t,n){return Pe(e)??Ix(e,t,n)}function Ix(e,t,n){let r=xo(e,n,t);if(r)return r;let o=e.match(cf)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Da(e){return e===Na||e===La||Gs(e)}function kx(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function Ox(e,t){let n=[...vo,Na,La].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Fa(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function Mx(e,t){Fa(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function Dx(e,t){if(!Da(t)&&!uf.test(t))return;if(e.shellAssignments.set(t,""),Eo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Da(t)||t===Na||t===La||Mn(t)){Fa(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function Nx(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var Lx="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Zt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Ua(e,t,n,r){if(t>=P.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:je}),{reason:je,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??De(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:je}),{reason:je,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((d)=>d.code.includes("heredoc"));if(c){if(!n.strict)return $a(e,n);let d=`${Wo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:d}),{reason:d,segment:e,intent:"stop_and_explain"}}return Ef(e,n),{reason:vn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Ef(e,n),{reason:vn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote"))&&!n.analyzePartialProgram)return $a(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=mf(n.environment.env,n.envAssignments);return oi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function oi(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let d=e.nodes[l+1],m=d?.kind==="connector"?d.operator:void 0,u=Wx(e,l,c,a,m),f=a==="&&"||a==="||",p=f?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=f||An(m);if(c.kind==="function"){let Y=h.flatMap((X)=>{let z=Cr(X);return z.functionDefinitions.set(c.name,c.body),Ga(X,[z],u,m==="&",An(m))}),te=za(Y,[],g,y,a,m);i=te.states,s=te.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Y=[],te=[];for(let z of h){let D=oi(c.body,t,n,r,[Cr(z)]);if(D.result)return D;if(Y.push(...Ga(z,D.states,u,m==="&",An(m))),v)te.push(z,...u?D.states.map((oe)=>ni(z,oe)):D.states)}let X=za(Y,te,g,y,a,m);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),b=e.nodes[l-2],w=ii(a)&&b?.kind==="command"?pm(b)??Gx(b):void 0,R=[],A=[];for(let Y of h){let te=zx(c,t,n,r,[Cr(Y)]);if(te.result)return{result:te.result,states:i};let X=e.dialect==="powershell"?te.states:te.states.map((z)=>ni(Y,z));for(let z of X){let D=Cr(z),oe=Ux(c,t,n.trace?{...n,trace:Rf(n.trace,E)}:n,r,D,ii(a),w);if(oe)return{result:oe,states:i};let _e=n_(c,D.functionDefinitions);if(_e)n.budget.charge("derivedTokens",si(_e));let Ye=_e?t+1>=P.recursionDepth.cap?Ba(c.displayText,n,[D]):oi(_e,t+1,n,r,[D]):{result:null,states:[D]};if(Ye.result)return Ye;if(R.push(...Ga(Y,Ye.states,u,m==="&",An(m))),v)A.push(Y),A.push(...Ye.states.map((ke)=>u?ni(Y,ke):ke))}}let K=za(R,A,g,y,a,m);i=K.states,s=K.conditionalStates,a=void 0}return{result:null,states:i}}function Wx(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ii(r)||ii(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&Fx(e,t)}function Ga(e,t,n,r,o){let i=n?t.map((a)=>ni(e,a)):[...t],s=o?i.flatMap((a)=>wn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ni(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function Fx(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(Bx(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ii(e){return e==="|"||e==="|&"}function Gx(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function An(e){return e==="&&"||e==="||"}function za(e,t,n,r,o,i){let s={success:ri([...n,...e]),failure:ri([...r,...t])},a=An(i)?s:void 0;return{states:An(o)||a?ri([...s.success,...s.failure]):s.success,conditionalStates:a}}function Rf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function zx(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=$x(e);if(s){if(t+1>=P.recursionDepth.cap)return Ba(s,n,o);let a=De(s,"powershell");if(a.status==="limited")return Ba(s,n,o);if(a.status!=="complete")return yf(i,n,r,o);n.budget.charge("derivedTokens",si(a)),i.push({program:a,depth:t+1})}}return yf(i,n,r,o)}function Bx(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function yf(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=oi(i.program,i.depth,t,n,[Cr(a)]);if(l.result)return l;s.push(...l.states)}o=ri(s)}return{result:null,states:o}}function $x(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function si(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+si(o),0):n.kind==="group"||n.kind==="function"?si(n.body):0),0)}function Ba(e,t,n){return t.trace?.recordSegment({type:"error",message:je}),{result:{reason:je,segment:e,intent:"stop_and_explain"},states:[...n]}}function Ux(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=Zx(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};xf(e,o,"before-consumer",a.environment.paths,a.budget);let c=pn(e.dialect,e.words).map(_),d=e.displayText,m=pf(c,o.shellGitContextState);if(e.dialect==="powershell"){let p=T(kd(e,i,o_(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!p,reason:p?.reason}),p)return r_(d,p)}if(c.length===1&&c[0]?.includes(" ")&&!Un(e.dialect,e.words)){let p=T(et(c[0],a.scanWork),a.policy),h=p!==null&&!a.strict&&Mu(e,a.rootProgram,a.scanWork);if(p&&!h)return a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!0,reason:p.reason}),{reason:p.reason,segment:d,ruleId:p.id,intent:p.intent};a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!1});let g=Sf(e,l,o,m,s,a);if(g)return g;return Wa(c,o.shellGitContextState),null}let u=xn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(p,h)=>{let g=h&&Object.hasOwn(h,"effectiveCwd")?h.effectiveCwd:o.effectiveCwd,y=Ua(p,t+1,{...a,effectiveCwd:g,envAssignments:h?.envAssignments??m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:h?.functionDefinitions,worktreeMode:h?.worktreeMode??a.worktreeMode,trace:a.trace?Rf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(u)return{...u,segment:d};let f=Sf(e,l,o,m,s,a);if(f)return f;return Wa(c,o.shellGitContextState),null}function Sf(e,t,n,r,o,i){let s=Xx(e,t,n,r??new Map,i);if(s)return s;return xf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),Vx(e,t,n,i.environment.paths,i.budget),e_(e,n,o,i.environment,i.trace),null}var Hx=new Set([">>","<>"]);function xf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?jx(s):Hx.has(s.operator)))continue;Cf(s.target,t,r,o)}if(n!=="before-consumer"||!xe(e.words[0],"tee"))return;let i=_f(e.words.slice(1));if(!i)return;for(let s of i.operands)Cf(s,t,r,o)}function jx(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Cf(e,t,n,r){let o=e?.provenance==="literal"?Zn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function Vx(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!ai(i))return;for(let s of Kx(e)){let a=Zn(s.text,n.effectiveCwd,r,o);if(!a||!Lu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=P.trackedHeredocFiles.cap)throw new F("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function Kx(e){let t=Yx(e.redirections)?.target,n=bf(t)?[t]:[];if(xe(e.words[0],"cat"))return qx(e.words)?n:[];if(!xe(e.words[0],"tee"))return[];let r=_f(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(bf))return[];return[...r.operands,...n]}function qx(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function Yx(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function _f(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&xe(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function bf(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function xe(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function ai(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function Zx(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return Zt;let n=t[0];if(!n?.heredoc)return Zt;if(!ai(n.heredoc))return Lx;if(n.fd!==void 0&&n.fd!==0)return Zt;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return Zt;let r=e.redirections.some((s)=>s!==n&&vf(s.target));if(xe(e.words[0],"cat"))return r?Zt:void 0;if(xe(e.words[0],"tee"))return r||e.words.slice(1).some(vf)?Zt:void 0;let o=e.words[0],i=e.words[1];if(xe(o,"git")&&(xe(i,"apply")||xe(i,"commit")))return;if(xe(o,"gh")&&(xe(i,"pr")||xe(i,"issue"))&&xe(e.words[2],"create"))return;return Zt}function vf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function Xx(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(Qx(e,i,n,r,o))return null;let a=Jx(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=$a(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function Jx(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!ai(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!Me(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=Q(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=T(S("interpreter.one-liner-paranoid",Xn),n.policy);if(c)return c}if(!Jn(s,n.scanWork))return null;let l=T(S("interpreter.dangerous-command",yn),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function Qx(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!ai(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Wt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(_),l=L(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(I(l)))return!1;return ot(a)}function e_(e,t,n,r,o){let i=sf(e,t.effectiveCwd,r,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(_).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}function Cr(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:ff(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ri(e){let t=[];for(let n of e){if(!t.some((r)=>t_(r,n)))t.push(n);if(t.length>P.controlFlowStates.cap)throw new F("controlFlowStates")}return t}function t_(e,t){return e.effectiveCwd===t.effectiveCwd&&wn(e.shellGitContextState.env,t.shellGitContextState.env)&&wn(e.literalHeredocFiles,t.literalHeredocFiles)&&wn(e.functionDefinitions,t.functionDefinitions)&&wn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&wn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)}function wn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function n_(e,t){let n=Hn(e);return n===void 0?void 0:t.get(n)}function r_(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function o_(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function $a(e,t){let n=T(et(e,t.scanWork),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Ef(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:vn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var i_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape","parallelChildAnalyses","parallelDerivedTokens","parallelDerivedBytes","parallelPlaceholderReplacements"]);function wf(e,t,n,r){let o=Ua(e,0,{...t,...tu(t),budget:t.budget??Ce(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:[{kind:"command",command:e,segment:o.segment}]}}function Af(e,t,n){try{return{decision:e()}}catch(r){let o=s_(r,t,n);if(!o)throw r;return o}}function s_(e,t,n){if(!(e instanceof F)||!i_.has(e.kind))return null;let r=P[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:[{kind:"command",command:t,segment:t}]},errorCode:r.errorCode}}var a_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),ja=new Set(["cc-safety-net","ccsn"]),l_=new Set(["bunx","npx","pnpx"]),c_=new Set(["pnpm","yarn"]),u_=new Set(["npm","pnpm","yarn"]),d_=new Set(["bun","node"]);function ci(e,t,n={}){if(ja.has(e))return 0;if(l_.has(e)){if(n.broad)return Ha(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return li(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&u_.has(e)&&n.broad&&t[r]==="exec"){let o=Ha(t.slice(r+1));return o===null?null:r+1+o}if(c_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&li(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ha(t.slice(r+1));return o===null?null:r+1+o}if(d_.has(e)){let o=n.broad&&r!==-1?r:0;if(Pf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Pf(t[o+1]))return o+2}return null}function Ha(e){let t=e.findIndex((r)=>li(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!li(r))break;n++}return n}function li(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return ja.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return ja.has(e.slice(0,t))}function Pf(e){let t=e?.replaceAll("\\","/");return[...a_].some((n)=>t===n||t?.endsWith(`/${n}`))}var Tf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function If(e,t,n){let r=ue(e,"input-candidate");if(!r)return null;let o=Cn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>m_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function m_(e,t){let n=pt([...e],t),r=n.slice(1),o=ci(I(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as ui}from"path";var Df="This path contains the protected policy config and you must not modify or delete it.",f_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Nf(e,t,n){let r=C_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return kf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ue(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Of(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Of(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return kf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Lr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function kf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>br(a,n,r,o,i));return s?{target:s}:null}function Of(e,t,n,r,o){let i=Cn(e,t,r,o,{findSegmentTarget:(s,a)=>p_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>br(s,a.cwd,n,r,o),findMalformedTarget:(s)=>S_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function p_(e,t,n,r,o){if(rr(e))return null;let i=gt([...e],r),s=I(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&g_(a)){let l=h_(a).find((c)=>Mf(ge(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Uo(i,1)||aa(i,r)){let c=($o(q(i))??q(["."])).find((d)=>{let m=ge(d.text,t.variables);return br(m,t.cwd,n,r,o)||Mf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Oo(a).sources.find((c)=>b_(ge(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(y_(e,r))return null;for(let l of[...e,...i])for(let c of Lf(l))if(br(ge(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function g_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function h_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function y_(e,t){let n=gt([...e],t);if(n.length===0)return!1;let r=I(n[0]??"").toLowerCase();if(!f_.has(r))return!1;if(r!=="sed")return!0;return!n.slice(1).some((o)=>o.startsWith("-i")||o==="--in-place"||o.startsWith("--in-place="))}function S_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Lf(i))if(br(s,t,n,r,o))return{target:s};return null}function Lf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function C_(e,t,n){let r=(a)=>vr(ie(a,e.executionCwd,t,n)),o=r(ln(t)),i=[r(Fn(e.executionCwd)),r(Fn(e.configCwd))],s=new Set(i.map((a)=>ui(a)));for(let a=ui(o);;a=ui(a))if(s.add(a),ui(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function br(e,t,n,r,o){let i=Sl(e,t,r,o,(s)=>vr(s)===Br);return i!==null&&n.files.has(vr(i))}function Mf(e,t,n,r,o){return n.directoriesAndAncestors.has(vr(ie(e,t,r,o)))}function b_(e,t,n,r,o){let i=vr(ie(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function vr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as di,posix as v_,resolve as fi,win32 as E_}from"path";import{fileURLToPath as R_}from"url";var Kf="Access to a sensitive path is not allowed.",qf=new Set(["echo","printf"]),x_=new Set(["find"]),__=new Set(["-exec","-execdir"]),w_=new Set([";","+"]),A_=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),P_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Yf=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),T_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),I_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Zf=new Set(["-c","-e","-r","-E","--eval","--exec"]),k_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),O_=new Set(["grep","rg"]),Wf=new Set(["jq","gojq","jaq"]),Ff="f",Gf="file",M_="files",D_=new Set(["e","f"]),N_=new Set(["regexp","file"]),L_=new Set(["e","f","A","B","C","m"]),W_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Va="__CC_SAFETY_NET_PIPE_INPUT__",qa=/[\w./~@+-]*[./~][\w./~@+-]*/g,F_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,G_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,z_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,B_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,$_=/\b(?:system|exec)\s*$/,U_=/\b(?:eval|exec)\s*\(/g,H_=/\b(?:eval|exec)\s*$/,j_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function zf(e,t,n,r,o,i){for(let s of e){let a=s.target;if($w(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=zw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&Uw(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Xf(e,t,n,r,o={}){let i=Bf(e,n,r),s=zf(i,t,e.invocation.context.configCwd,n,r),a=s?.ruleId!=="secret.deny-path"&&o.strict===!1?Bf(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:zf(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&V_(e,n))return null;return l}function V_(e,t){let n=ue(e,"input-candidate")??ue(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of ko(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(tt(a.text,t))}let o=Et(r);if(o.length===0)return!1;let i=lt(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>A_.has(a))}function Bf(e,t,n,r={}){let o=e.invocation.context.executionCwd;if(e.invocation.route.kind==="command"){let s=ue(e,"input-candidate");return s?Xt(s.shell,e.store,r,t,o,n,$f(s)):[]}if(e.invocation.route.kind!=="unknown")return e.paths.map((s)=>({target:s,cwd:o}));let i=ue(e,"input-candidate");return[...i?Xt(i.shell,e.store,r,t,o,n,$f(i)):[],...e.paths.map((s)=>({target:s,cwd:o}))]}function $f(e){return e.program.dialect==="powershell"}function Xt(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Fe;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...Ew(tt(e.source,r),t,n,r,o,i)],l=(c)=>tt(rw(c,s),r);return Io(e,o,r,i,{word:l,segment:(c,d,m,u,f)=>{if(c.length===0)return null;if(a.push(...pi(c,t,n,r,d.cwd,i,f)),m!==null)a.push(...q_(m,c,t,n,r,d.cwd,i));return null},redirection:(c,d)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Jf(c.consumer,[c.body],t,n,r,d.cwd,i,(m)=>Y_(c.consumer??[],m,t,n,r,d.cwd,i)));if(c.targetOrder==="legacy-segment")return Us;return a.push({target:l(c.target),cwd:d.cwd}),null}}),a}function Ya(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Fe;return s.status==="complete"?Xt(s,t,n,r,o,i):null}function pi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(Wf.has(lt(Et(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...pi(p,t,n,r,o,i)]}let l=nw(e).map(a),c=Et(e);if(c.length===0)return l;let d=c[0]??"",m=lt(d).toLowerCase(),u=c.slice(1),f=K_(d,m,u);if(f)return[...l,...f.map(a)];if(qf.has(m))return n.capturedOutput===!0?[...l,...Qf(e).map(a)]:l;if(m==="eval")return[...l,...Ya(u.join(" "),t,n,r,o,i)??u.map(a)];if(m==="export")return[...l,...u.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:at(m,p)).map(a)];if(m==="git")return[...l,...iw(u).map(a)];if(Wf.has(m))return[...l,...ow(u).map(a)];if(O_.has(m))return[...l,...Iw(u).map(a)];if(x_.has(m))return[...l,...cw(u,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...u.flatMap((p)=>at("awk",p)).map(a),...u.flatMap((p)=>dw(p,t,n,r,o,i)),...u.flatMap(mw).map(a)];if(m==="curl")return[...l,...u.flatMap((p)=>at(m,p)).map(a),...sw(u).map(a)];if(or(m)){let p=nr.has(m)?mc(m,u):null;if(p!==null){let h=t.getShellSyntax(p);if(h.status==="structural-limit")throw new Fe;if(h.status==="complete")return[...l,...Xt(h,t,n,r,o,i),...u.slice(u.indexOf(p)+1).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...uw(m,u,t,n,r,o,i)]}return[...l,...u.flatMap((p)=>at(m,p)).map(a)]}function K_(e,t,n){let r=ci(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function q_(e,t,n,r,o,i,s){if(Q_(t,n,r,o,i,s))return Qf(e).map((a)=>({target:a,cwd:i}));return Jf(t,Z_(e),n,r,o,i,s,()=>[])}function Y_(e,t,n,r,o,i,s){let a=Et(e);if(!or(lt(a[0]??"").toLowerCase()))return[];return Ya(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Jf(e,t,n,r,o,i,s,a){let l=ew(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>nr.has(l)?Xt(n.getShellSyntax(c),n,r,o,i,s):mi(l,c,n,r,o,i,s))}function Qf(e){let t=Et(e);if(t.length===0)return[];let n=lt(t[0]??"").toLowerCase();if(!qf.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Za(r.replaceAll("%%","%"))];return t.slice(1)}function Z_(e){let t=Et(e);if(t.length===0)return[];let n=lt(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return X_(r);return[]}function X_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Za(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>J_(t,r.slice(i*n,(i+1)*n)))}function J_(e,t){let n=0;return Za(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Za(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Q_(e,t,n,r,o,i){let s=Et(e);if(s.length===0||lt(s[0]??"").toLowerCase()!=="xargs")return!1;let a=jt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,Va]:l.map((m)=>m.split(c).join(Va));return pi(d,t,n,r,o,i).some((m)=>m.target.includes(Va))}function ew(e){let t=Et(e);if(t.length===0)return null;let n=lt(t[0]??"").toLowerCase();if(!or(n))return null;return tw(n,t.slice(1))?n:null}function tw(e,t){let n=Xa(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Zf.has(o)||ep(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(j_.get(n)?.has(o))r++;continue}return!1}return!0}function Xa(e){return/^python\d/.test(e)?"python":e}function nw(e){let t=[];for(let n of e){if(np(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Uf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function rw(e,t){if(!t||!Uf.test(e))return e;return`~${e.replace(Uf,"").replace(/\\/g,"/")}`}function at(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function ow(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>at("jq",i))}return e.flatMap((r,o)=>o===t?[]:at("jq",r))}function iw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>at("git",i))];if(t.push(...at("git",r)),!le.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:at("git",o)),n++}return t}function sw(e){return e.flatMap((t,n)=>{let r=lw(t);if(r!==null)return Hf(r.flag,r.value);let o=aw(e[n-1]);return o===null?[]:Hf(o,t)})}function Hf(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Ka(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Ka(t.slice(n+1))}return t.startsWith("@")?Ka(t.slice(1)):[]}function aw(e){if(e===void 0)return null;if(Yf.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function lw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Yf.has(r)?{flag:r,value:e.slice(n+1)}:null}function Ka(e){return e===""||e==="-"?[]:[e]}function cw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!__.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((f)=>w_.has(f)),m=d===-1?c:c.slice(0,d),u=pi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...u.filter((f)=>f!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,h)=>{if(!P_.has(f))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function uw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Zf.has(c)||ep(e,c)){let m=t[l+1];if(m!==void 0)a.push(...mi(e,m,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...mi(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function ep(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return k_.get(t[t.length-1]??"")?.has(Xa(e))??!1}function dw(e,t,n,r,o,i){if(!e.includes("system"))return[];return ra(e)?.commands.flatMap((s)=>Xt(t.getShellSyntax(s),t,n,r,o,i))??[]}function mw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function fw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((r)=>r[2]).filter((r)=>r!==void 0&&r!==""),n=(e.match(qa)??[]).filter((r)=>r!=="process.versions.sqlite"||t.some((o)=>o.includes(r)));return[...t,...t.flatMap(Ja),...n]}function mi(e,t,n,r,o,i,s){let a=(f)=>({target:f,cwd:i}),l=gw(t,pw(e));if(l===null)return fw(t).map(a);let c=l.masked.match(B_)!==null||l.literals.some((f)=>$_.test(l.masked.slice(0,f.start))),d=l.masked.match(U_)!==null||l.literals.some((f)=>H_.test(l.masked.slice(0,f.start))),m=r.refineInlineData===!0&&!nr.has(e),u=m&&!(Cw(l.masked)||c||d)?[]:l.literals;return[...u.map((f)=>f.text).filter((f)=>f!=="").map(a),...u.flatMap((f)=>Ja(f.text)).map(a),...m?[]:l.literals.flatMap((f)=>f.text.match(qa)??[]).filter((f)=>f!=="process.versions.sqlite").map(a),...c?l.literals.flatMap((f)=>Ya(f.text,n,r,o,i,s)??[a(f.text)]):[],...d?l.literals.flatMap((f)=>mi(e,f.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
+`:h),n,r,o,i,s)):[],...(l.masked.match(qa)??[]).filter((f)=>f!=="process.versions.sqlite").map(a)]}function pw(e){let t=Xa(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function gw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(G_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&Sw(e,o))return null;let a=t==="python"?hw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,d=yw(e,c,l);if(d===null)return null;let m=e.slice(c,d);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&z_.test(m))return null;r.push({start:c,text:m});for(let u=o;u<d+l.length;u++)n[u]=" ";o=d+l.length-1}return{masked:n.join(""),literals:r}}function hw(e,t){return F_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function yw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function Sw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function Cw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(T_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>I_.has(i)))continue;if(o.length>1)return!0;if(bw(e,r)===".")return!0;if(vw(e,r+n.length)==="(")return!0}return!1}function bw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function vw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function Ew(e,t,n,r,o,i){return Aw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Xt(a,t,{...n,capturedOutput:!0},r,o,i),...Rw(a,r)?xw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function Rw(e,t){let n=ko(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||lt(tt(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=tt(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function xw(e,t){return ko(e).flatMap((n)=>n.kind==="word"?[tt(n.text,t)]:n.kind==="redirection"&&n.target?[tt(n.target,t)]:[]).flatMap(Ja)}function Ja(e){let t=ww(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||_w(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function _w(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function ww(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function Aw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Gn(o,n))continue;if(tp(e,r,n)){let i=Pw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=Tw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function Pw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Gn(i,n))continue;if(tp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function Tw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function tp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function Iw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let m=d[1]??"",u=d[2];if(m===M_)o=!0;if(N_.has(m))r=!0;if(u!==void 0){if(m===Gf)t.push(u);continue}if(W_.has(m)){let f=e[l+1];if(m===Gf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),u="",f="";for(let h=0;h<m.length;h++){let g=m[h]??"";if(D_.has(g))r=!0;if(L_.has(g)){u=g,f=m.slice(h+1);break}}if(u==="")continue;if(f.length>0){if(u===Ff)t.push(f);continue}let p=e[l+1];if(u===Ff&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Et(e){let t=e.findIndex((n)=>!np(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function np(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var kw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Ow=".env.",Mw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),Dw=[".env.example.",".env.sample."];function Nw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Lw(e){return e.length>0&&!/\s/.test(e)}function Ww(e,t,n,r){try{let o=xr(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof F)throw o;return!1}}var Fw=new Set(["node_modules","__pycache__"]),Gw=[["vendor","bundle"],["vendor","cache"]];function zw(e,t,n,r,o){if(Nw(e))return null;let i=qe(e,t,r,o);if(!i)return null;let s=H(i.split("/").pop()??""),a=H(i),l=()=>Lw(s)||Ww(e,t,r,o);if(Mw.has(s)||Dw.some((u)=>s.startsWith(u)))return null;let c=H(Vw(e,t,r,o));for(let u of es){let f=`~/${u.suffixParts.join("/")}`;if((Vf(a,f)||Vf(c,f))&&st(u.id,n))return u.id}let d=Bw(i,t,n,r,o);if(d)return d;if(kw.has(s))return null;for(let u of Qi)if(s===u.basename&&st(u.id,n))return u.id;if(s.startsWith(Ow)&&st(qr.id,n)&&l())return qr.id;for(let u of ts)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let f=s.slice(u.prefix.length)[0];if((f==="-"||f==="_")&&st(u.id,n)&&l())return u.id}for(let u of ns)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&st(u.id,n))return u.id}if(Hw(a))return null;if(!s.includes(".")&&zn.pattern.test(s)&&st(zn.id,n))return zn.id;let m=jw(s,n);if(m)return m;return null}function Bw(e,t,n,r,o){return Yr.find((i)=>{if(!st(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,U(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=H(e).split("/");return W(e,U(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Rr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,qe("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=U(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Er(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=U(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=H(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ae(U(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=H(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ae(U(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ae(U(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Rr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,qe(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=U(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Er(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,U(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=U(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=U(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Er(e,s,["credentials"])||Er(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=H(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,U(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,U(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ae(U(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=H(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((d)=>Rr(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?U(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ae(U(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(H(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?Rr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>W(e,qe(d,t,r,o),l))}case"secret.cli.pi":return W(e,U(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,U(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=qe("~",t,r,o);return[ae(U(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ae(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Er(e,ae(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ae(qe("~",t,r,o),".config","amp")],l=H(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>W(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Rr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ae(U(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,qe("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||H(e).split("/").at(-1)==="mcp-auth.json"&&Jt(H(e),H(a))}case"secret.cli.cursor.config":{let s=H(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,U(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=H(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,U(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,qe("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var jf=new WeakMap;function U(e,t,n,r,o){let i=jf.get(o)??new Map;jf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=qe(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>rp(e,ae(t,r)))}function Er(e,t,n){return n.some((r)=>Jt(H(e),H(ae(t,r))))}function Rr(e,t,n,r,o){return rp(e,qe(t,n,r,o))}function rp(e,t){return H(e)===H(t)}function ae(e,...t){return He([e,...t].filter(Boolean).join("/"))}function $w(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(xr(e,t,o,i));return n.some((a)=>Jt(s,H(xr(a,r,o,i))))}function Uw(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(xr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?He(B(be(a),o.paths,i)):"",c=H(l),d=o.env.get("CC_SAFETY_NET_HOME"),m=H(d?He(B(fi(be(d)),o.paths,i)):l&&He(B(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Jt(s,m))return!1;return n.some((u)=>{let f=H(xr(u,r,o,i));if(!f)return!1;if(c&&(c===f||c.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return Jt(s,f)})}function Hw(e){let t=e.split("/");return t.some((n)=>Fw.has(n))||Gw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function jw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of rs)if(r===o.extension&&st(o.id,t))return o.id;for(let o of os)if(o.pattern.test(r)&&st(o.id,t))return o.id;return null}function H(e){return e.toLowerCase()}function st(e,t){return!t?.disabledRules?.includes(e)}function qe(e,t,n,r){let{home:o,normalized:i}=Qa(e,n,r);if(!i)return"";if(!o)return i;let s=el(i,o),a=di(s)?s:He(fi(t,s)),l=He(B(a,n.paths,r));if(!Jt(l,o)){if(di(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Vf(e,t){return e===t||e.startsWith(`${t}/`)}function Vw(e,t,n,r){let{home:o,normalized:i}=Qa(e,n,r);if(!i||!o)return"";let s=el(i,o),a=v_.normalize(di(s)?s:He(fi(t,s))),l=He(be(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&Jt(c(a),c(u)));if(d===void 0)return"";let m=a.slice(d.length);return m?`~${m}`:"~"}function xr(e,t,n,r){let{home:o,normalized:i}=Qa(e,n,r);if(!i)return"";let s=o?el(i,o):i;return He(B(di(s)?s:fi(t,s),n.paths,r))}function Qa(e,t,n){let r=t.env.get("HOME")??t.home,o=r?He(B(be(r),t.paths,n)):"",i=He(be(Kw(tt(e,t))));return{home:o,normalized:i}}function Kw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return R_(e)}catch{return e}}function el(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ae(t,e.slice(2));return e}function qw(e){if(process.platform==="win32")return!0;return E_.parse(e).root.length>1}function He(e){let t=e.trim(),n=(t.includes("\\")&&qw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function lt(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Qt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Yw={findPolicyMutation:Nf,findGitMetadataMutation:md,resolveGitMetadata:Zw,loadPolicySnapshot:eu,findSensitiveTarget:Xf,analyzeCommand:wf,getModes:Pi};function op(e,t){let n={...Yw,...t.dependencies},r=Qw(e),o=_r(e)?e.command:r,i=Rt("policy-protection",o,()=>ir(e,t.factParserDependencies)),s=ue(i,"input-candidate"),a=ue(i,"declared-command");if(_r(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:je,intent:"stop_and_explain",evidence:[{kind:"command",command:e.command,segment:e.command}]}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Od,intent:"stop_and_explain",evidence:[]}};let l=Ce(),c=Rt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),d=Rt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Df,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:d.target}]}}}let m=Rt("policy-protection",o,()=>If(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Tf,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:m.target}]}}}let u=Rt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:u.target}]}}}let f=Rt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...Xw(f)},y=p.secretProtection.enabled===!1?null:Rt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:_r(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:Kf,intent:"hard_stop",ruleId:y.ruleId,evidence:[{kind:"command",command:E,segment:y.target}]}}}if(!_r(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...tl("command-validation",o),...g};let v=Rt("command-analysis",o,()=>Af(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Jw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function Zw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Xw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Jw(e){return ue(e,"declared-command")?.program}function Qw(e){try{return Ln(e.input)}catch(t){let n=_r(e)?e.command:void 0;throw new Qt("policy-protection",tl("policy-protection",t instanceof Xe?void 0:n,t),t)}}function Rt(e,t,n){try{return n()}catch(r){throw new Qt(e,tl(e,r instanceof Xe?void 0:t,r),r)}}function tl(e,t,n){let r=n instanceof F||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?bi:In,intent:"stop_and_explain",evidence:t?[{kind:"command",command:t,segment:t}]:[]}}}function _r(e){return e.route.kind==="command"}import{appendFileSync as mA,mkdirSync as fA}from"fs";import{isAbsolute as pA,join as ol}from"path";import{lstatSync as sp,readdirSync as eA,readFileSync as tA,rmdirSync as nA,statSync as ap,unlinkSync as rA,utimesSync as oA,writeFileSync as iA}from"fs";import{join as wr}from"path";function ip(e,t={}){return to(ln(e,t),e.home).policy.audit.retention_days}var rl=86400000,sA=".last-prune",aA=/^\d{4}-\d{2}$/,lA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,lp=(e)=>Math.floor(e/rl);function up(e,t,n=()=>new Date){try{let r=n().getTime();if(!ap(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=wr(t,sA),i=ap(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&lp(i)===lp(r))return;let s=r-ip(e)*rl,a=new Date(r).toISOString().slice(0,7);for(let l of nl(t)){if(l.isDirectory()){cA(wr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))uA(wr(t,l.name),s)}iA(o,"",{mode:384}),oA(o,r/1000,r/1000)}catch{}}function cA(e,t,n){for(let r of nl(e)){if(!r.isDirectory()||!aA.test(r.name))continue;let o=wr(e,r.name);for(let i of nl(o)){if(!i.isFile())continue;let s=lA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+rl;if(!Number.isFinite(a)||a>=t)continue;dp(wr(o,i.name))}if(r.name!==n)cp(o)}cp(e)}function uA(e,t){try{let n=sp(e);if(n.mtimeMs>=t)return;let r=tA(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(dA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(sp(e).mtimeMs!==n.mtimeMs)return;dp(e)}catch{}}function dA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function nl(e){try{return eA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function dp(e){try{rA(e)}catch{}}function cp(e){try{nA(e)}catch{}}var gA="2.4.0",hA=1e4,yA=2000,SA=256,CA=32768;function bA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function vA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function il(e,t,n,r,o,i,s={}){let a=bA(t);if(!a)return;let l=RA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=gi(ct(n),s.failureStage?Number.POSITIVE_INFINITY:hA),m=gi(ct(r),yA),u=s.toolName?gi(ct(s.toolName),SA):void 0,f=i===null?void 0:gi(ct(i),CA),p=ol(l,vA(f?.value??null),c.slice(0,7));fA(p,{recursive:!0,mode:448});let h=ol(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Li)(),v:gA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:m.value,...d.truncated||m.truncated||u?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};mA(h,`${JSON.stringify(g)}
+`,{encoding:"utf-8",mode:384}),up(e,l,s.now)}catch{}}function gi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function EA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&pA(n)?n:null}function RA(e){let t=EA(e);return t?ol(t,".cc-safety-net","logs"):null}function fp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=mp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence.find((a)=>a.kind==="command"),s=i?.command??(r?mp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function mp(e){return"command"in e?e.command??"":""}function pp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;il(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function gp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;il(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function yp(e,t,n){try{let r=op(t,{environment:e,...n.guard});return hp(e,t,r,n),r}catch(r){if(!(r instanceof Qt))throw r;throw hp(e,t,r.evaluation,n,!(r.cause instanceof Xe),{stage:r.stage,errorCode:xA(r.cause)}),r}}function hp(e,t,n,r,o=!0,i){pp(e,fp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function xA(e){if(e instanceof F)return P[e.kind].errorCode;if(e instanceof Xe)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}var Cp=wA();function wA(e={}){return(t,n)=>{try{return AA(t,n,e)}catch(r){return console.error("CC Safety Net error:",r),sl(Tr())}}}function AA(e,t,n){let r=wl(),o=PA(e,t,r.paths),i=()=>kA(e);if("malformed"in o)return gp(r,o.denial,i,{agent:"amp",toolName:o.denial.toolName,cwd:o.cwd}),sl(o.denial);try{let s=yp(r,o,{guard:{auditAllowed:Al(r.env),dependencies:n.guardDependencies},audit:{agent:"amp",getSessionId:i}});return Sp(s,!0)}catch(s){if(!(s instanceof Qt))throw s;if(At(ee.debug,r.env))console.error(`CC Safety Net debug: amp tool.call analysis failed: ${fl(s.cause)}`);return Sp(s.evaluation,o.route.kind==="command")}}function PA(e,t,n){if(!e||typeof e!=="object")return Pn(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return Pn(null);if(!r.input||typeof r.input!=="object")return Pn(null,r.tool);let o=TA(t,n);if(!o)return Pn(null,r.tool);let i=IA(t,e);if(!i.ok)return Pn(o,r.tool);if(!i.command)return an(r.tool,r.input,{kind:Mi(r.tool)},{configCwd:o,executionCwd:o},null);if(typeof i.command.command!=="string"||i.command.command.trim()==="")return Pn(o,r.tool);let s=typeof i.command.dir==="string"?jl(i.command.dir,o,n):o;if(!s)return{malformed:!0,denial:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",command:i.command.command,segment:i.command.dir,toolName:r.tool},cwd:o};return an(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:o,executionCwd:s},i.command.command)}function TA(e,t){let n=e.system.workspaceRoot;if(!n)return;try{let r=e.helpers.filePathFromURI(n);if(typeof r!=="string"||r.trim()==="")return;return Hl(".",[r],t)}catch{return}}function IA(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function kA(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function Pn(e,t){return{malformed:!0,denial:Tr({toolName:t}),cwd:e}}function Sp(e,t){let n=dl(e,{includeEvidence:t});return n?sl(n):{action:"allow"}}function sl(e){return{action:"reject-and-continue",message:ml(e)}}function OA(e){e.on("tool.call",(t)=>Cp(t,e))}export{OA as default};