prae-cli 0.10.0 → 0.10.2

package/lib/src-CZYvvEn5.js

@@ -0,0 +1,1691 @@
+//#region ../kernel/src/command.ts
+/** Wrappers whose first operand is the program, and their options that take a value. */
+const WRAPPERS = new Map(Object.entries({
+	sudo: [
+		"-u",
+		"-g",
+		"-p",
+		"-h",
+		"-C",
+		"-r",
+		"-t",
+		"-U",
+		"-D",
+		"-T",
+		"-R"
+	],
+	doas: ["-u", "-C"],
+	env: [
+		"-u",
+		"-C",
+		"-P",
+		"--unset",
+		"--chdir"
+	],
+	command: [],
+	builtin: [],
+	exec: ["-a"],
+	nohup: [],
+	time: ["-f", "-o"],
+	nice: ["-n"],
+	timeout: [
+		"-s",
+		"-k",
+		"--signal",
+		"--kill-after"
+	],
+	setsid: [],
+	stdbuf: [
+		"-i",
+		"-o",
+		"-e"
+	],
+	xargs: [
+		"-I",
+		"-n",
+		"-P",
+		"-L",
+		"-s",
+		"-d",
+		"-E",
+		"-a",
+		"--arg-file"
+	]
+}).map(([name, options]) => [name, new Set(options)]));
+const SHELLS = new Set([
+	"sh",
+	"bash",
+	"zsh",
+	"dash",
+	"ksh",
+	"mksh",
+	"ash"
+]);
+/** Words that open or continue a compound command, not a program. */
+const RESERVED = new Set([
+	"!",
+	"if",
+	"then",
+	"elif",
+	"else",
+	"fi",
+	"while",
+	"until",
+	"do",
+	"done"
+]);
+const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*\+?=/;
+/** Scripts inside scripts (`bash -c`, `eval`, backticks, here-documents). */
+const MAX_DEPTH = 8;
+/** Brackets inside one script. */
+const MAX_NESTING = 64;
+/** A part of the line that cannot be read with confidence. */
+var Undecomposable = class extends Error {};
+const basename = (word) => (word.split("/").pop() ?? word).toLowerCase();
+const isBlank = (c) => c === " " || c === "	" || c === "\r";
+const isSpecial = (c) => /^[0-9@*#?$!-]$/.test(c);
+const expands = (w) => /[*?]|\[.*\]|\{.*(,|\.\.).*\}/.test(w.bare);
+/**
+* Read one script into `out`. `expansionsOnly` reads it as the body of an
+* unquoted here-document: text, in which only substitutions run.
+*/
+function read(src, out, depth, expansionsOnly = false) {
+	if (depth > MAX_DEPTH) throw new Undecomposable(`scripts nested more than ${MAX_DEPTH} deep`);
+	let at = 0;
+	let nesting = 0;
+	/** Commands here read their standard input from a pipe. */
+	let piped = false;
+	const pending = [];
+	const ch = (k = 0) => src[at + k] ?? "";
+	const ahead = (s) => src.startsWith(s, at);
+	const ends = (k) => {
+		const c = ch(k);
+		return c === "" || isBlank(c) || c === "\n" || ";&|()<>".includes(c);
+	};
+	const deeper = () => {
+		nesting += 1;
+		if (nesting > MAX_NESTING) throw new Undecomposable(`brackets nested more than ${MAX_NESTING} deep`);
+	};
+	const fresh = () => ({
+		text: "",
+		literal: true,
+		quoted: false,
+		bare: ""
+	});
+	/** A script inside this one: its unreadable parts are recorded, not fatal. */
+	const nested = (text, onlyExpansions = false) => {
+		try {
+			read(text, out, depth + 1, onlyExpansions);
+		} catch (error) {
+			if (!(error instanceof Undecomposable)) throw error;
+			out.undecomposable.push(error.message);
+		}
+	};
+	function blanks() {
+		for (;;) {
+			const c = ch();
+			if (isBlank(c)) at += 1;
+			else if (c === "\\" && ch(1) === "\n") at += 2;
+			else if (c === "#") while (at < src.length && ch() !== "\n") at += 1;
+			else return;
+		}
+	}
+	/** One unquoted newline, then the here-document bodies it starts. */
+	function newline() {
+		at += 1;
+		for (let doc = pending.shift(); doc; doc = pending.shift()) body(doc);
+	}
+	function body(doc) {
+		let text = "";
+		while (at < src.length) {
+			const stop = src.indexOf("\n", at);
+			const end = stop === -1 ? src.length : stop;
+			const line = src.slice(at, end);
+			at = Math.min(end + 1, src.length);
+			if ((doc.strip ? line.replace(/^\t+/, "") : line) === doc.delim) break;
+			text += `${line}\n`;
+		}
+		if (doc.feed.shell !== void 0) if (!doc.quoted && /[$`\\]/.test(text)) out.undecomposable.push(`a here-document with expansions is run by ${doc.feed.shell}`);
+		else nested(text);
+		else if (!doc.quoted) nested(text, true);
+	}
+	function list$1(end) {
+		for (;;) {
+			blanks();
+			const c = ch();
+			if (c === "") {
+				if (end === void 0) return;
+				throw new Undecomposable(end === ")" ? "an unclosed `(`" : "an unclosed `{`");
+			}
+			if (c === "\n") newline();
+			else if (c === ";") {
+				if (ch(1) === ";") throw new Undecomposable("`;;` outside a case statement");
+				at += 1;
+			} else if (c === "&" && ch(1) !== ">") at += ch(1) === "&" ? 2 : 1;
+			else if (c === "|" && ch(1) === "|") at += 2;
+			else if (c === "|") throw new Undecomposable("a pipe with nothing before it");
+			else if (c === ")") {
+				if (end !== ")") throw new Undecomposable("an unbalanced `)`");
+				at += 1;
+				return;
+			} else if (end === "}" && c === "}" && ends(1)) {
+				at += 1;
+				return;
+			} else pipeline();
+		}
+	}
+	function pipeline() {
+		const names = [];
+		for (let position = 0;; position += 1) {
+			names.push(...command(position > 0 || piped));
+			blanks();
+			if (ch() !== "|" || ch(1) === "|") break;
+			at += ch(1) === "&" ? 2 : 1;
+			for (blanks(); ch() === "\n"; blanks()) newline();
+		}
+		if (names.length > 0) out.pipelines.push(names.join("|"));
+	}
+	function command(fromPipe) {
+		blanks();
+		if (ahead("((") && arithmetic()) {
+			trailing();
+			return [];
+		}
+		if (ch() === "(") {
+			at += 1;
+			return compound(")", fromPipe);
+		}
+		if (ch() === "{" && (isBlank(ch(1)) || ch(1) === "\n")) {
+			at += 1;
+			return compound("}", fromPipe);
+		}
+		return simple(fromPipe);
+	}
+	function compound(end, fromPipe) {
+		deeper();
+		const before = out.segments.length;
+		const outer = piped;
+		piped = fromPipe;
+		list$1(end);
+		piped = outer;
+		nesting -= 1;
+		trailing();
+		return out.segments.slice(before).map((s) => s.name);
+	}
+	/** Redirections after a compound command; anything else is not shell. */
+	function trailing() {
+		blanks();
+		while (redirection() !== void 0) blanks();
+		if (!ends(0) && ch() !== "}") throw new Undecomposable("a word after a compound command");
+	}
+	function simple(fromPipe) {
+		const mark = out.segments.length;
+		const words = [];
+		const redirects = [];
+		const feed = {};
+		let runsNothing = false;
+		let conditional = false;
+		for (;;) {
+			blanks();
+			const c = ch();
+			if (conditional) {
+				if (c === "") throw new Undecomposable("an unclosed `[[`");
+				if (c === "\n") {
+					newline();
+					continue;
+				}
+				if (ahead("]]") && ends(2)) {
+					at += 2;
+					conditional = false;
+					continue;
+				}
+				const op = /^(&&|\|\||[()<>!])/.exec(src.slice(at, at + 2));
+				if (op !== null) {
+					at += op[0].length;
+					continue;
+				}
+			}
+			if (c === "" || c === "\n" || c === ";" || c === ")" || c === "|") break;
+			if (c === "&" && ch(1) !== ">") break;
+			if (c === "(") {
+				if (ahead("((")) {
+					if (arithmetic()) continue;
+					throw new Undecomposable("an unexpected `(`");
+				}
+				if (words.length === 1) {
+					at += 1;
+					blanks();
+					if (ch() === ")") {
+						at += 1;
+						for (blanks(); ch() === "\n"; blanks()) newline();
+						return command(fromPipe);
+					}
+				}
+				throw new Undecomposable("an unexpected `(`");
+			}
+			const redirected = redirection(feed);
+			if (redirected !== void 0) {
+				redirects.push(...redirected);
+				continue;
+			}
+			const w = word();
+			if (w === void 0) throw new Undecomposable("an unexpected character");
+			if (words.length === 0 && w.literal && !w.quoted) {
+				if (RESERVED.has(w.text)) return command(fromPipe);
+				if (w.text === "case" || w.text === "coproc") throw new Undecomposable(`a \`${w.text}\` statement`);
+				if (w.text === "function") {
+					blanks();
+					word();
+					blanks();
+					if (ahead("()")) at += 2;
+					for (blanks(); ch() === "\n"; blanks()) newline();
+					return command(fromPipe);
+				}
+				if (w.text === "for" || w.text === "select") runsNothing = true;
+				if (w.text === "[[") {
+					runsNothing = true;
+					conditional = true;
+				}
+			}
+			words.push(w);
+		}
+		if (runsNothing || words.length === 0) return [];
+		const name = resolve(words, redirects, [], false, mark, feed, fromPipe);
+		return name === void 0 ? [] : [name];
+	}
+	/** A redirection at `at`: the operator and its target, as tokens. */
+	function redirection(feed) {
+		if ((ch() === "<" || ch() === ">") && ch(1) === "(") return void 0;
+		const m = /^(\d*)(<<<|<<-|<<|<>|<&|>>|>\||>&|&>>|&>|<|>)/.exec(src.slice(at, at + 12));
+		if (m === null) return void 0;
+		at += m[0].length;
+		blanks();
+		const target = word();
+		if (target === void 0) throw new Undecomposable("a redirection with no target");
+		const op = m[2];
+		if (op === "<<" || op === "<<-") pending.push({
+			delim: target.text,
+			strip: op === "<<-",
+			quoted: target.quoted,
+			feed: feed ?? {}
+		});
+		else if (op === "<<<" && feed !== void 0) feed.herestring = target;
+		if (op === ">&" || op === "<&") return [`${m[0]}${target.text}`];
+		return [m[0], target.text];
+	}
+	/** One word at `at`, quotes and expansions read; undefined at an operator. */
+	function word() {
+		const w = fresh();
+		const start = at;
+		for (;;) {
+			const c = ch();
+			if (c === "" || isBlank(c) || c === "\n" || ";&|()".includes(c)) break;
+			if (c === "<" || c === ">") {
+				if (ch(1) !== "(") break;
+				const from = at;
+				at += 2;
+				substitution();
+				w.text += src.slice(from, at);
+				w.literal = false;
+			} else if (c === "\\") {
+				if (ch(1) !== "\n") {
+					w.text += ch(1);
+					w.quoted = true;
+				}
+				at += 2;
+			} else if (c === "'") {
+				const end = src.indexOf("'", at + 1);
+				if (end === -1) throw new Undecomposable("an unbalanced single quote");
+				w.text += src.slice(at + 1, end);
+				w.quoted = true;
+				at = end + 1;
+			} else if (c === "$" && ch(1) === "'") ansi(w);
+			else if (c === "$" && ch(1) === "\"") {
+				at += 1;
+				double(w, true);
+			} else if (c === "\"") double(w, true);
+			else if (c === "`") backtick(w, false);
+			else if (c === "$") dollar(w);
+			else {
+				w.text += c;
+				w.bare += c;
+				at += 1;
+			}
+		}
+		return at === start ? void 0 : w;
+	}
+	/** `"…"` (or, unclosed, a here-document body): only `$` and backticks are live. */
+	function double(w, closed) {
+		w.quoted = true;
+		if (closed) at += 1;
+		for (;;) {
+			const c = ch();
+			if (c === "") {
+				if (closed) throw new Undecomposable("an unbalanced double quote");
+				return;
+			}
+			if (c === "\"" && closed) {
+				at += 1;
+				return;
+			}
+			const n = ch(1);
+			if (c === "\\" && n !== "" && (n === "\n" || "$`\"\\".includes(n))) {
+				if (n !== "\n") w.text += n;
+				at += 2;
+			} else if (c === "`") backtick(w, closed);
+			else if (c === "$") dollar(w);
+			else {
+				w.text += c;
+				at += 1;
+			}
+		}
+	}
+	/** `$'…'`: escapes can spell anything, so one with escapes is not a literal. */
+	function ansi(w) {
+		let k = at + 2;
+		for (;;) {
+			const c = src[k];
+			if (c === void 0) throw new Undecomposable("an unbalanced `$'` quote");
+			if (c === "'") break;
+			if (c === "\\") {
+				w.literal = false;
+				w.text += c + (src[k + 1] ?? "");
+				k += 2;
+			} else {
+				w.text += c;
+				k += 1;
+			}
+		}
+		w.quoted = true;
+		at = k + 1;
+	}
+	/** `$(…)`, `$((…))`, `${…}`, `$NAME`; a lone `$` is a dollar sign. */
+	function dollar(w) {
+		const from = at;
+		if (ahead("$(")) {
+			if (!(ahead("$((") && arithmetic())) {
+				at += 2;
+				substitution();
+			}
+		} else if (ahead("${")) {
+			at += 2;
+			parameter();
+		} else if (/[A-Za-z_]/.test(ch(1))) {
+			at += 1;
+			while (/[A-Za-z0-9_]/.test(ch())) at += 1;
+		} else if (isSpecial(ch(1))) at += 2;
+		else {
+			w.text += "$";
+			w.bare += "$";
+			at += 1;
+			return;
+		}
+		w.text += src.slice(from, at);
+		w.literal = false;
+	}
+	/** After `$(`, `<(` or `>(`: a list up to its `)`, with its own stdin. */
+	function substitution() {
+		deeper();
+		const outer = piped;
+		piped = false;
+		list$1(")");
+		piped = outer;
+		nesting -= 1;
+	}
+	/** After `${`: up to the matching `}`; a default value can run a command. */
+	function parameter() {
+		deeper();
+		const sink = fresh();
+		for (;;) {
+			const c = ch();
+			if (c === "") throw new Undecomposable("an unclosed `${`");
+			if (c === "}") break;
+			if (c === "\\") at += 2;
+			else if (c === "'") {
+				const end = src.indexOf("'", at + 1);
+				if (end === -1) throw new Undecomposable("an unbalanced single quote");
+				at = end + 1;
+			} else if (c === "\"") double(sink, true);
+			else if (c === "`") backtick(sink, false);
+			else if (c === "$") dollar(sink);
+			else at += 1;
+		}
+		at += 1;
+		nesting -= 1;
+	}
+	/**
+	* Where `((…))` / `$((…))` at `at` ends, if bash reads it as arithmetic:
+	* only when the `)` matching the second `(` is followed at once by `)`.
+	* Otherwise bash reads `(` `(` — nested subshells, or `$(` and a subshell —
+	* and `((rm -rf /) )` runs rm. Quotes and backticks are skipped whole;
+	* anything unclosed is not arithmetic, so it is read the stricter way.
+	*/
+	function arithmeticEnd() {
+		let depth$1 = 1;
+		for (let k = at + (ch() === "$" ? 3 : 2); k < src.length; k += 1) {
+			const c = src[k];
+			if (c === "\\") k += 1;
+			else if (c === "'" || c === "\"" || c === "`") {
+				let end = k + 1;
+				while (end < src.length && src[end] !== c) {
+					if (src[end] === "\\" && c !== "'") end += 1;
+					end += 1;
+				}
+				if (end >= src.length) return void 0;
+				k = end;
+			} else if (c === "(") depth$1 += 1;
+			else if (c === ")") {
+				depth$1 -= 1;
+				if (depth$1 === 0) return src[k + 1] === ")" ? k + 2 : void 0;
+			}
+		}
+	}
+	/**
+	* `((…))` or `$((…))` read as arithmetic, in which a substitution still
+	* runs; false, and nothing read, when bash would not read it so.
+	*/
+	function arithmetic() {
+		const end = arithmeticEnd();
+		if (end === void 0) return false;
+		deeper();
+		at += ch() === "$" ? 3 : 2;
+		const sink = fresh();
+		while (at < end) {
+			const c = ch();
+			if (c === "$") dollar(sink);
+			else if (c === "`") backtick(sink, false);
+			else at += 1;
+		}
+		if (at !== end) throw new Undecomposable("an ambiguous `((`");
+		nesting -= 1;
+		return true;
+	}
+	/** `` `…` ``: its text, unescaped, is a script of its own. */
+	function backtick(w, inDouble) {
+		let inner = "";
+		let k = at + 1;
+		for (;;) {
+			const c = src[k];
+			if (c === void 0) throw new Undecomposable("an unbalanced backtick");
+			if (c === "`") break;
+			const n = src[k + 1] ?? "";
+			const escaped = "`$\\".includes(n) || inDouble && n === "\"";
+			if (c === "\\" && n !== "" && escaped) {
+				inner += n;
+				k += 2;
+			} else {
+				inner += c;
+				k += 1;
+			}
+		}
+		w.text += src.slice(at, k + 1);
+		w.literal = false;
+		at = k + 1;
+		nested(inner);
+	}
+	/**
+	* Words to the program they run, inserted at `insertAt` so a command comes
+	* before the substitutions in its words; then whatever that program runs in
+	* turn (`bash -c`, `eval`, `find -exec`).
+	*/
+	function resolve(words, redirects, seen, open, insertAt, feed, fromPipe = false) {
+		const wrappers = [...seen];
+		let openEnded = open;
+		let replace;
+		let k = 0;
+		while (k < words.length) {
+			const w = words[k];
+			if (ASSIGNMENT.test(w.text)) {
+				k += 1;
+				continue;
+			}
+			if (!w.literal || expands(w)) break;
+			const base = basename(w.text);
+			const options = WRAPPERS.get(base);
+			if (options === void 0) break;
+			wrappers.push(base);
+			if (base === "xargs") openEnded = true;
+			k += 1;
+			while (k < words.length) {
+				const option = words[k].text;
+				if (option === "--") {
+					k += 1;
+					break;
+				}
+				if (!option.startsWith("-")) break;
+				if (base === "env" && /^(-S|--split-string)/.test(option)) {
+					out.undecomposable.push("`env -S` splits a string into a command");
+					return insert(insertAt, {
+						name: base,
+						tokens: [],
+						wrappers
+					});
+				}
+				if (base === "xargs" && option.startsWith("-I")) replace = option.length > 2 ? option.slice(2) : words[k + 1]?.text;
+				k += options.has(option) ? 2 : 1;
+			}
+			if (base === "timeout") k += 1;
+		}
+		const program = words[k];
+		const rest = words.slice(k + 1);
+		const tokens = [...rest.map((w) => w.text), ...redirects];
+		const last = wrappers.at(-1);
+		if (program === void 0) return last === void 0 || wrappers.length === seen.length ? void 0 : insert(insertAt, {
+			name: last,
+			tokens: [...redirects],
+			wrappers
+		});
+		if (!program.literal || expands(program) || openEnded && (program.text.includes("{}") || replace !== void 0 && replace !== "" && program.text.includes(replace))) {
+			out.undecomposable.push("the program word is only known at run time");
+			if (last !== void 0) insert(insertAt, {
+				name: last,
+				tokens: [program.text, ...tokens],
+				wrappers
+			});
+			return;
+		}
+		const name = basename(program.text);
+		insert(insertAt, {
+			name,
+			tokens,
+			wrappers,
+			...openEnded ? { openEnded: true } : {}
+		});
+		if (SHELLS.has(name)) shell(name, rest, feed, fromPipe);
+		else if (name === "eval") if (rest.every((w) => w.literal)) nested(rest.map((w) => w.text).join(" "));
+		else out.undecomposable.push("`eval` of a string that is not a literal");
+		else if (name === "source" || name === ".") {
+			if (rest[0] !== void 0 && !rest[0].literal) out.undecomposable.push(`\`${name}\` of a file only known at run time`);
+		} else if (name === "find") for (let i = 0; i < rest.length; i += 1) {
+			const flag = rest[i].text;
+			if (![
+				"-exec",
+				"-execdir",
+				"-ok",
+				"-okdir"
+			].includes(flag)) continue;
+			let end = i + 1;
+			while (end < rest.length && !/^[;+]$/.test(rest[end].text)) end += 1;
+			resolve(rest.slice(i + 1, end), [], [...wrappers, "find"], true, out.segments.length);
+			i = end;
+		}
+		return name;
+	}
+	function insert(where, segment) {
+		out.segments.splice(where, 0, segment);
+		return segment.name;
+	}
+	/** What a shell program runs: a `-c` string, a script file, or its stdin. */
+	function shell(name, args, feed, fromPipe) {
+		let inline = false;
+		let stdin = false;
+		let k = 0;
+		while (k < args.length) {
+			const option = args[k].text;
+			if (option === "--" || option === "-") {
+				k += 1;
+				break;
+			}
+			if (option === "--rcfile" || option === "--init-file") k += 2;
+			else if (option.startsWith("--")) k += 1;
+			else if (/^[-+][A-Za-z]+$/.test(option)) {
+				if (option.startsWith("-") && option.includes("c")) inline = true;
+				if (option.includes("s")) stdin = true;
+				k += option.includes("o") ? 2 : 1;
+			} else break;
+		}
+		const operand = args[k];
+		if (inline) {
+			if (operand === void 0) return;
+			if (operand.literal) nested(operand.text);
+			else out.undecomposable.push(`\`${name} -c\` runs a string that is not a literal`);
+			return;
+		}
+		if (operand !== void 0 && !stdin) {
+			if (!operand.literal) out.undecomposable.push(`\`${name}\` runs a script only known at run time`);
+			return;
+		}
+		if (fromPipe) out.undecomposable.push(`\`${name}\` runs commands read from a pipe`);
+		if (feed === void 0) return;
+		feed.shell = `\`${name}\``;
+		const string = feed.herestring;
+		if (string === void 0) return;
+		if (string.literal) nested(string.text);
+		else out.undecomposable.push(`a here-string with expansions is run by \`${name}\``);
+	}
+	if (expansionsOnly) double(fresh(), false);
+	else list$1(void 0);
+}
+/** Read a command line into every command it would run, and what could not be read. */
+function decompose(command) {
+	const out = {
+		segments: [],
+		pipelines: [],
+		undecomposable: []
+	};
+	try {
+		read(command, out, 0);
+	} catch (error) {
+		out.undecomposable.push(error instanceof Undecomposable ? error.message : "the line could not be read");
+	}
+	return out;
+}
+/** Every simple command a line would run, in the order read. */
+function segments(command) {
+	return [...decompose(command).segments];
+}
+/** `git*` matches `git`, `github`; bare strings match exactly. */
+function matches$1(pattern, value) {
+	if (pattern.endsWith("*")) return value.startsWith(pattern.slice(0, -1));
+	return value === pattern;
+}
+/**
+* A glob with `*` anywhere, for pipeline signatures: `curl*|*sh` is the
+* shape of download-and-execute however the two ends are spelled.
+*/
+function globMatches(pattern, value) {
+	const source = pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+	return (/* @__PURE__ */ new RegExp(`^${source}$`)).test(value);
+}
+/**
+* Every wanted token holds in a segment: a plain pattern must match some
+* token, a `!pattern` must match none. `["-rf", "!--dry-run"]` is a real
+* force-delete, not a rehearsal of one.
+*/
+function tokensHold(wanted, tokens) {
+	return wanted.every((pattern) => pattern.startsWith("!") ? !tokens.some((token) => matches$1(pattern.slice(1), token)) : tokens.some((token) => matches$1(pattern, token)));
+}
+const list = (v) => v === void 0 ? [] : typeof v === "string" ? [v] : v;
+/**
+* Every present field holds on what was read. With `open`, a segment whose
+* arguments arrive at run time (`xargs`, `find -exec`) satisfies any token
+* condition, because those arguments could.
+*/
+function holds(match, read$1, open) {
+	const parts = read$1.segments;
+	if (parts.length === 0) return false;
+	const names = list(match.name);
+	const args = list(match.token);
+	const anyArgs = list(match.anyToken);
+	const pipes = list(match.pipedTo);
+	const shapes = list(match.pipeline);
+	const argsHold = (segment) => open && segment.openEnded === true || tokensHold(args, segment.tokens) && (anyArgs.length === 0 || anyArgs.some((wanted) => segment.tokens.some((token) => matches$1(wanted, token))));
+	if (names.length > 0) {
+		const hit = parts.filter((segment) => names.some((pattern) => matches$1(pattern, segment.name) || segment.wrappers.some((wrapper) => matches$1(pattern, wrapper))));
+		if (hit.length === 0) return false;
+		if ((args.length > 0 || anyArgs.length > 0) && !hit.some(argsHold)) return false;
+	} else if (args.length > 0 || anyArgs.length > 0) {
+		if (!parts.some(argsHold)) return false;
+	}
+	if (pipes.length > 0) {
+		if (!parts.slice(1).some((segment) => pipes.some((pattern) => matches$1(pattern, segment.name)))) return false;
+	}
+	if (shapes.length > 0) {
+		const signatures = [parts.map((segment) => segment.name).join("|"), ...read$1.pipelines];
+		if (!shapes.some((pattern) => signatures.some((signature) => globMatches(pattern, signature)))) return false;
+	}
+	return true;
+}
+/**
+* Judge one command line against one matcher, on what could be read. Every
+* present field must hold.
+*/
+function commandMatches(match, command) {
+	return holds(match, typeof command === "string" ? decompose(command) : command, false);
+}
+/**
+* Why a matcher that did not hold on what was read might still hold on what
+* runs: part of the line could not be read, or a matched program takes
+* arguments only known at run time. Undefined when there is no such reason.
+* A `deny` or `ask` rule matches on it, conservatively (`evaluate.ts`).
+*/
+function commandUnread(match, command) {
+	const read$1 = typeof command === "string" ? decompose(command) : command;
+	if (read$1.undecomposable.length > 0) return [...new Set(read$1.undecomposable)].join("; ");
+	if (!holds(match, read$1, true)) return void 0;
+	const open = read$1.segments.find((s) => s.openEnded === true);
+	const from = open?.wrappers.includes("xargs") ? "xargs" : "find -exec";
+	return `the arguments \`${open?.name ?? "?"}\` gets from ${from} are only known at run time`;
+}
+
+//#endregion
+//#region ../kernel/src/path.ts
+/**
+* Path normalization and glob containment, with no filesystem access.
+*
+* The contract, stated here because getting it wrong is how path policies
+* become theatre: **this module compares strings.** It resolves `.` and `..`
+* lexically so that `./src/../../etc/passwd` cannot pose as a workspace path,
+* but it cannot see a symlink. A link inside an allowed directory pointing out
+* of it will pass every check here.
+*
+* That is not a gap to paper over in the matcher — it is a gap the caller
+* closes by resolving before it asks. `dsh-overlay-check` learned this the
+* hard way during the plugin-store gate review: lexical containment accepted a
+* symlink escape cleanly, and the fix was to resolve both the path and its
+* nearest existing ancestor before deciding. Adapters that can touch the
+* filesystem must resolve first and pass the resolved path in.
+*/
+/** Split a path into segments, resolving `.` and `..` lexically. */
+function normalize(path) {
+	const absolute = path.startsWith("/");
+	const out = [];
+	let escaped = false;
+	for (const raw of path.split(/[/\\]+/)) {
+		if (raw === "" || raw === ".") continue;
+		if (raw === "..") {
+			if (out.length > 0) out.pop();
+			else escaped = true;
+			continue;
+		}
+		out.push(raw);
+	}
+	return {
+		segments: out,
+		absolute,
+		escaped
+	};
+}
+/** Turn one glob segment into an anchored regular expression. */
+function segmentPattern(segment) {
+	const body = segment.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
+	return /* @__PURE__ */ new RegExp(`^${body}$`);
+}
+/**
+* Wildcard segment matching, where `**` spans zero or more segments.
+*
+* Two-pointer with backtracking rather than a recursive walk: the pattern
+* comes from a policy pack and the path from a tool call, and a catastrophic
+* backtrack in the hot path of every call would be a denial of service handed
+* to whoever writes the pack.
+*/
+function matchSegments(path, pattern) {
+	let i = 0;
+	let j = 0;
+	let starPattern = -1;
+	let starPath = 0;
+	while (i < path.length) {
+		const segment = j < pattern.length ? pattern[j] : void 0;
+		const here = path[i];
+		if (segment === "**") {
+			starPattern = j;
+			starPath = i;
+			j += 1;
+			continue;
+		}
+		if (segment !== void 0 && here !== void 0 && segmentPattern(segment).test(here)) {
+			i += 1;
+			j += 1;
+			continue;
+		}
+		if (starPattern >= 0) {
+			starPath += 1;
+			i = starPath;
+			j = starPattern + 1;
+			continue;
+		}
+		return false;
+	}
+	while (j < pattern.length && pattern[j] === "**") j += 1;
+	return j === pattern.length;
+}
+/**
+* Is `path` contained by `glob`?
+*
+* A glob naming a directory contains everything under it: `./src` and
+* `./src/**` both match `src/app/main.ts`. Writing the shorter form is the
+* common intent, and treating it as "this exact directory entry only" is a
+* trap that silently grants the whole subtree past the rule.
+*/
+function within(path, glob) {
+	const target = normalize(path);
+	if (target.escaped) return false;
+	const trimmed = glob.trim();
+	if (!(trimmed === "**" || trimmed.startsWith("**/")) && target.absolute !== trimmed.startsWith("/")) return false;
+	const pattern = normalize(glob);
+	if (matchSegments(target.segments, pattern.segments)) return true;
+	return matchSegments(target.segments, [...pattern.segments, "**"]);
+}
+/** Is `path` inside any of these globs? */
+function withinAny(path, globs) {
+	return globs.some((glob) => within(path, glob));
+}
+/**
+* An absolute path under `cwd`, rewritten as the workspace-relative path a
+* pack's `./` globs speak about; anything else comes back as written.
+*
+* A model is free to name a workspace file by its absolute path — the first
+* real agent run through the gate did exactly that for its first three
+* reads — and a scope rule written as `outside: ["./src/**"]` must decide
+* that file by where it is, not by how it was spelled. The anchoring in
+* {@link within} is right to keep `/etc/hosts` out of `./**`; this is the
+* other half, applied by an adapter that knows the session's directory.
+* A path that climbs out of `cwd` with `..` stays absolute, so it stays
+* outside.
+*/
+function relativeTo(path, cwd) {
+	const target = normalize(path);
+	const base = normalize(cwd);
+	if (!target.absolute || !base.absolute || target.escaped) return path;
+	if (base.segments.length > target.segments.length) return path;
+	if (!base.segments.every((s, i) => s === target.segments[i])) return path;
+	const rest = target.segments.slice(base.segments.length);
+	return rest.length === 0 ? "." : `./${rest.join("/")}`;
+}
+/**
+* The host of a URL, or undefined when it is not a URL we can read.
+*
+* Unparseable input returns undefined, and callers treat that as "no host" —
+* which for a `notIn` rule means the rule matches. Failing toward the rule is
+* the only safe direction: a string we cannot parse is exactly the shape an
+* evasion attempt takes.
+*/
+function hostOf(url) {
+	try {
+		return new URL(url).hostname.toLowerCase();
+	} catch {
+		return;
+	}
+}
+/**
+* Host list membership, where a leading dot means "this domain or below".
+*
+* `example.com` matches only that host. `.example.com` also matches
+* `api.example.com`, and deliberately still matches `example.com` itself —
+* an operator writing the suffix form means the organisation, not a rule that
+* covers every subdomain except the one they first thought of.
+*/
+function hostIn(host, list$1) {
+	return list$1.some((entry) => {
+		const want = entry.toLowerCase();
+		if (want.startsWith(".")) return host === want.slice(1) || host.endsWith(want);
+		return host === want;
+	});
+}
+/**
+* Argument names that conventionally carry a filesystem path, in the order
+* they are tried when a path rule names none.
+*
+* A path rule used to default to the single argument spelled `path`. DeepSeek
+* Harness's own `read`, `write` and `edit` tools pass `file_path`, so every
+* shipped path rule without an explicit `arg` — including the baseline's
+* "deny read ./.env" — matched nothing on the very harness it was written
+* for, while the ledger dutifully recorded every allowed read. A rule that
+* silently never fires is the worst way for policy to be wrong; defaulting
+* to the conventional set is the same call the dsh adapter already made for
+* path resolution, now made once, here, for matching too.
+*/
+const PATH_ARGS = [
+	"path",
+	"file_path",
+	"filePath",
+	"target",
+	"directory",
+	"cwd",
+	"file",
+	"dest",
+	"destination",
+	"source"
+];
+/** The first conventional path argument present, as a string, or undefined. */
+function pathArgOf(args, explicit) {
+	if (explicit !== void 0) {
+		const v = args[explicit];
+		return typeof v === "string" ? v : void 0;
+	}
+	for (const key of PATH_ARGS) {
+		const v = args[key];
+		if (typeof v === "string") return v;
+	}
+}
+
+//#endregion
+//#region ../kernel/src/rule.ts
+/**
+* Strength ordering, used when several rules match one call.
+*
+* Higher wins. This is the property that makes a pack safe to extend: adding a
+* rule can raise the strength of a decision and never lower it, so an operator
+* appending to a pack can never accidentally widen what an agent may do.
+*/
+const STRENGTH = {
+	allow: 0,
+	warn: 1,
+	correct: 2,
+	ask: 3,
+	deny: 4
+};
+
+//#endregion
+//#region ../kernel/src/evaluate.ts
+function listed(value, want) {
+	if (want === void 0) return true;
+	if (value === void 0) return false;
+	return typeof want === "string" ? value === want : want.includes(value);
+}
+function argMatches(match, args) {
+	const has = Object.hasOwn(args, match.name);
+	if (match.present !== void 0 && match.present !== has) return false;
+	if (!has) return match.above === void 0 && match.below === void 0 && match.equals === void 0 && match.oneOf === void 0;
+	const value = args[match.name];
+	if (match.above !== void 0) {
+		if (typeof value !== "number" || !(value > match.above)) return false;
+	}
+	if (match.below !== void 0) {
+		if (typeof value !== "number" || !(value < match.below)) return false;
+	}
+	if (match.equals !== void 0 && value !== match.equals) return false;
+	if (match.oneOf !== void 0) {
+		if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") return false;
+		if (!match.oneOf.includes(value)) return false;
+	}
+	return true;
+}
+/**
+* Whether a rule's matcher holds on a call: `false`, or a hit — carrying a
+* note when the hit is conservative. `strict` rules (deny, ask) match a shell
+* line they cannot fully read, because what was not read could be what they
+* refuse; the note says what that was. Weaker rules never match on a guess.
+*/
+function matches(when, facts, strict, shell) {
+	let note;
+	if (!listed(facts.tool, when.tool)) return false;
+	if (!listed(facts.capability, when.capability)) return false;
+	if (!listed(facts.plugin, when.plugin)) return false;
+	if (!listed(facts.agent, when.agent)) return false;
+	if (when.command !== void 0) {
+		const line = shell();
+		if (line === void 0) return false;
+		if (!commandMatches(when.command, line)) {
+			note = strict ? commandUnread(when.command, line) : void 0;
+			if (note === void 0) return false;
+		}
+	}
+	if (when.path !== void 0) {
+		const raw = pathArgOf(facts.args, when.path.arg);
+		if (typeof raw !== "string") return false;
+		if (when.path.inside !== void 0 && !withinAny(raw, when.path.inside)) return false;
+		if (when.path.outside !== void 0 && withinAny(raw, when.path.outside)) return false;
+	}
+	if (when.host !== void 0) {
+		const raw = facts.args[when.host.arg ?? "url"];
+		if (typeof raw !== "string") return false;
+		const host = hostOf(raw);
+		if (host === void 0) {
+			if (when.host.notIn === void 0) return false;
+			return note === void 0 ? {} : { note };
+		}
+		if (when.host.in !== void 0 && !hostIn(host, when.host.in)) return false;
+		if (when.host.notIn !== void 0 && hostIn(host, when.host.notIn)) return false;
+	}
+	if (when.arg !== void 0) {
+		for (const one of when.arg) if (!argMatches(one, facts.args)) return false;
+	}
+	if (when.count !== void 0) {
+		const key = facts.capability;
+		if (key === void 0) return false;
+		if (!((facts.counts?.[key] ?? 0) > when.count.above)) return false;
+	}
+	if (when.secrets !== void 0) {
+		const floor = when.secrets.minConfidence ?? 0;
+		const wanted = when.secrets.types;
+		if ((facts.secrets ?? []).filter((finding) => finding.confidence >= floor && (wanted === void 0 || wanted.includes(finding.type))).length < (when.secrets.atLeast ?? 1)) return false;
+	}
+	return note === void 0 ? {} : { note };
+}
+function step(rule, effect) {
+	return {
+		rule: rule.id,
+		...rule.title === void 0 ? {} : { title: rule.title },
+		effect: effect.kind,
+		because: effect.because
+	};
+}
+/**
+* Decide one call against one pack.
+*
+* Every matching rule lands in the trace; the strongest effect decides. Ties
+* go to the first rule in pack order, so a pack reads top-down the way its
+* author wrote it.
+*
+* `correct` is the effect the rest of this ecosystem does not have. A rival
+* guardrail can allow a call or refuse it; a rule here can also rewrite an
+* argument and let it through, recording what it changed. Refusing is not
+* always the safe option — an agent denied mid-task retries, and the retry is
+* rarely safer than the clamp would have been.
+*/
+function evaluate(pack, facts) {
+	const hits = [];
+	let line = null;
+	const shell = () => {
+		if (line === null) {
+			const raw = facts.args.command ?? facts.args.cmd ?? facts.args.script;
+			line = typeof raw === "string" ? decompose(raw) : void 0;
+		}
+		return line;
+	};
+	for (const rule of pack.rules) {
+		const strict = rule.effect.kind === "deny" || rule.effect.kind === "ask";
+		const hit = matches(rule.when, facts, strict, shell);
+		if (hit === false) continue;
+		hits.push({
+			rule,
+			effect: hit.note === void 0 ? rule.effect : {
+				...rule.effect,
+				because: `${rule.effect.because} (could not decompose: ${hit.note})`
+			}
+		});
+	}
+	if (hits.length === 0) return {
+		kind: "allow",
+		trace: [],
+		evaluated: pack.rules.length
+	};
+	hits.sort((a, b) => STRENGTH[b.effect.kind] - STRENGTH[a.effect.kind]);
+	const trace = hits.map((hit) => step(hit.rule, hit.effect));
+	const evaluated = pack.rules.length;
+	const strongest = hits[0];
+	if (strongest === void 0) return {
+		kind: "allow",
+		trace: [],
+		evaluated
+	};
+	const winner = strongest.effect.kind;
+	if (winner === "deny" || winner === "ask") return {
+		kind: winner,
+		rule: strongest.rule.id,
+		reason: strongest.effect.because,
+		trace,
+		evaluated
+	};
+	if (winner === "correct") {
+		const args = { ...facts.args };
+		for (const hit of hits) if (hit.effect.kind === "correct") Object.assign(args, hit.effect.set);
+		return {
+			kind: "correct",
+			rule: strongest.rule.id,
+			reason: strongest.effect.because,
+			args,
+			trace,
+			evaluated
+		};
+	}
+	const allowed = hits.find((hit) => hit.effect.kind === "allow");
+	if (allowed !== void 0) return {
+		kind: "allow",
+		rule: allowed.rule.id,
+		reason: allowed.effect.because,
+		trace,
+		evaluated
+	};
+	return {
+		kind: "allow",
+		trace,
+		evaluated
+	};
+}
+
+//#endregion
+//#region ../kernel/src/frameworks.ts
+const FRAMEWORKS = {
+	"owasp-llm-top-10-2026": {
+		name: "OWASP Top 10 for LLM Applications — 2026",
+		short: "OWASP LLM 2026",
+		controls: {
+			LLM01: {
+				name: "Prompt Injection",
+				summary: "Instructions in a prompt or in retrieved content alter what the model does."
+			},
+			LLM02: {
+				name: "Sensitive Information Disclosure",
+				summary: "Credentials, personal data or proprietary content reach the model or its output."
+			},
+			LLM03: {
+				name: "Excessive Agency",
+				summary: "The model can take actions, or holds permissions, beyond what its task needs."
+			},
+			LLM04: {
+				name: "Supply Chain",
+				summary: "A compromised model, dataset, plugin or dependency enters the application."
+			},
+			LLM05: {
+				name: "Data and Model Poisoning",
+				summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
+			},
+			LLM06: {
+				name: "Unbounded Consumption",
+				summary: "The application permits resource use without a limit, exhausting budget or service."
+			},
+			LLM07: {
+				name: "Misinformation",
+				summary: "The model produces false or misleading content that is acted on as if true."
+			},
+			LLM08: {
+				name: "Hidden Context Exposure",
+				summary: "System prompts, hidden instructions or internal context are revealed."
+			},
+			LLM09: {
+				name: "Vector and Embedding Weaknesses",
+				summary: "Retrieval stores are manipulated or leak across tenants and permissions."
+			},
+			LLM10: {
+				name: "Improper Output Handling",
+				summary: "Model output is passed to downstream systems without validation."
+			}
+		}
+	},
+	"owasp-agentic-top-10-2026": {
+		name: "OWASP Top 10 for Agentic Applications — 2026",
+		short: "OWASP Agentic 2026",
+		controls: {
+			ASI01: {
+				name: "Agent Goal Hijack",
+				summary: "Untrusted input redirects what the agent is trying to do, turning its objectives against its owner."
+			},
+			ASI02: {
+				name: "Tool Misuse and Exploitation",
+				summary: "A legitimate tool the agent already holds is turned to an attacker's ends."
+			},
+			ASI03: {
+				name: "Identity and Privilege Abuse",
+				summary: "The agent's own authority, credentials or delegated access is inherited or escalated."
+			},
+			ASI04: {
+				name: "Agentic Supply Chain",
+				summary: "A poisoned tool, model, plugin, skill or dependency is trusted before the agent runs."
+			},
+			ASI05: {
+				name: "Unexpected Code Execution",
+				summary: "The agent's output reaches something that runs it: a shell, an interpreter, a parser."
+			},
+			ASI06: {
+				name: "Memory and Context Poisoning",
+				summary: "Corrupted memory or retrieved context persists across sessions and steers future reasoning."
+			},
+			ASI07: {
+				name: "Insecure Inter-Agent Communication",
+				summary: "One agent trusts another's messages by default, so a compromised agent can steer its peers."
+			},
+			ASI08: {
+				name: "Cascading Failures",
+				summary: "A single fault propagates across agents, tools and workflows into system-wide impact."
+			},
+			ASI09: {
+				name: "Human-Agent Trust Exploitation",
+				summary: "Persuasive or misleading agent output moves a person to an unsafe action or approval."
+			},
+			ASI10: {
+				name: "Rogue Agents",
+				summary: "A compromised, misaligned or drifting agent keeps operating in unintended ways."
+			}
+		}
+	}
+};
+/**
+* Every framework control a rule cites, resolved to names.
+*
+* A pack that parsed cites only ids the registry knows, so the lookups here
+* cannot miss; the fallbacks exist for a `Rule` built by hand in code.
+*/
+function cite(rule) {
+	const out = [];
+	for (const [framework, controls] of Object.entries(rule.frameworks ?? {})) {
+		const known = FRAMEWORKS[framework];
+		for (const control of controls) out.push({
+			framework,
+			frameworkName: known?.name ?? framework,
+			frameworkShort: known?.short ?? framework,
+			control,
+			controlName: known?.controls[control]?.name ?? control
+		});
+	}
+	return out;
+}
+
+//#endregion
+//#region ../kernel/src/pack.ts
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var Check = class {
+	errors = [];
+	fail(path, message) {
+		this.errors.push({
+			path,
+			message
+		});
+	}
+	/** Reject any key the shape does not define. */
+	keys(path, value, allowed) {
+		for (const key of Object.keys(value)) if (!allowed.includes(key)) this.fail(`${path}.${key}`, `unknown field \`${key}\`; expected one of ${allowed.map((k) => `\`${k}\``).join(", ")}`);
+	}
+	text(path, value) {
+		if (typeof value !== "string" || value.trim() === "") {
+			this.fail(path, "expected a non-empty string");
+			return;
+		}
+		return value;
+	}
+	/** A field that accepts one name or a list of them. */
+	names(path, value) {
+		if (typeof value === "string") return value;
+		if (Array.isArray(value)) {
+			const out = [];
+			value.forEach((entry, index) => {
+				const one = this.text(`${path}[${index}]`, entry);
+				if (one !== void 0) out.push(one);
+			});
+			return out;
+		}
+		this.fail(path, "expected a string or an array of strings");
+	}
+	globs(path, value) {
+		if (!Array.isArray(value)) {
+			this.fail(path, "expected an array of path globs");
+			return;
+		}
+		const out = [];
+		value.forEach((entry, index) => {
+			const one = this.text(`${path}[${index}]`, entry);
+			if (one !== void 0) out.push(one);
+		});
+		return out;
+	}
+	number(path, value) {
+		if (typeof value !== "number" || !Number.isFinite(value)) {
+			this.fail(path, "expected a finite number");
+			return;
+		}
+		return value;
+	}
+};
+function readCommandMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"name",
+		"token",
+		"anyToken",
+		"pipedTo",
+		"pipeline"
+	]);
+	if (value.name === void 0 && value.token === void 0 && value.anyToken === void 0 && value.pipedTo === void 0 && value.pipeline === void 0) check.fail(path, "expected `name`, `token`, `anyToken`, `pipedTo` or `pipeline`; a command matcher with none matches nothing");
+	const out = {};
+	if (value.token !== void 0) {
+		const tokens = check.names(`${path}.token`, value.token);
+		if (tokens !== void 0) out.token = tokens;
+	}
+	if (value.name !== void 0) {
+		const names = check.names(`${path}.name`, value.name);
+		if (names !== void 0) out.name = names;
+	}
+	if (value.anyToken !== void 0) {
+		const tokens = check.names(`${path}.anyToken`, value.anyToken);
+		if (tokens !== void 0) out.anyToken = tokens;
+	}
+	if (value.pipedTo !== void 0) {
+		const pipes = check.names(`${path}.pipedTo`, value.pipedTo);
+		if (pipes !== void 0) out.pipedTo = pipes;
+	}
+	if (value.pipeline !== void 0) {
+		const shapes = check.names(`${path}.pipeline`, value.pipeline);
+		if (shapes !== void 0) out.pipeline = shapes;
+	}
+	return out;
+}
+function readPathMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"arg",
+		"outside",
+		"inside"
+	]);
+	if (value.outside === void 0 && value.inside === void 0) check.fail(path, "expected `inside` or `outside`; a path matcher with neither matches nothing");
+	const out = {};
+	if (value.arg !== void 0) {
+		const arg = check.text(`${path}.arg`, value.arg);
+		if (arg !== void 0) out.arg = arg;
+	}
+	if (value.outside !== void 0) {
+		const globs = check.globs(`${path}.outside`, value.outside);
+		if (globs !== void 0) out.outside = globs;
+	}
+	if (value.inside !== void 0) {
+		const globs = check.globs(`${path}.inside`, value.inside);
+		if (globs !== void 0) out.inside = globs;
+	}
+	return out;
+}
+function readHostMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"arg",
+		"in",
+		"notIn"
+	]);
+	if (value.in === void 0 && value.notIn === void 0) check.fail(path, "expected `in` or `notIn`; a host matcher with neither matches nothing");
+	const out = {};
+	if (value.arg !== void 0) {
+		const arg = check.text(`${path}.arg`, value.arg);
+		if (arg !== void 0) out.arg = arg;
+	}
+	if (value.in !== void 0) {
+		const list$1 = check.globs(`${path}.in`, value.in);
+		if (list$1 !== void 0) out.in = list$1;
+	}
+	if (value.notIn !== void 0) {
+		const list$1 = check.globs(`${path}.notIn`, value.notIn);
+		if (list$1 !== void 0) out.notIn = list$1;
+	}
+	return out;
+}
+function readArgMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"name",
+		"above",
+		"below",
+		"equals",
+		"oneOf",
+		"present"
+	]);
+	const name = check.text(`${path}.name`, value.name);
+	if (name === void 0) return void 0;
+	const out = { name };
+	if (value.above !== void 0) {
+		const n = check.number(`${path}.above`, value.above);
+		if (n !== void 0) out.above = n;
+	}
+	if (value.below !== void 0) {
+		const n = check.number(`${path}.below`, value.below);
+		if (n !== void 0) out.below = n;
+	}
+	if (value.equals !== void 0) out.equals = value.equals;
+	if (value.oneOf !== void 0) if (!Array.isArray(value.oneOf)) check.fail(`${path}.oneOf`, "expected an array");
+	else out.oneOf = value.oneOf;
+	if (value.present !== void 0) if (typeof value.present !== "boolean") check.fail(`${path}.present`, "expected a boolean");
+	else out.present = value.present;
+	return out;
+}
+function readSecretsMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"types",
+		"minConfidence",
+		"atLeast"
+	]);
+	const out = {};
+	if (value.types !== void 0) {
+		const types = check.globs(`${path}.types`, value.types);
+		if (types !== void 0) out.types = types;
+	}
+	if (value.minConfidence !== void 0) {
+		const n = check.number(`${path}.minConfidence`, value.minConfidence);
+		if (n !== void 0) if (n < 0 || n > 1) check.fail(`${path}.minConfidence`, "expected a number between 0 and 1");
+		else out.minConfidence = n;
+	}
+	if (value.atLeast !== void 0) {
+		const n = check.number(`${path}.atLeast`, value.atLeast);
+		if (n !== void 0) if (!Number.isInteger(n) || n < 1) check.fail(`${path}.atLeast`, "expected an integer of at least 1");
+		else out.atLeast = n;
+	}
+	return out;
+}
+function readMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return {};
+	}
+	check.keys(path, value, [
+		"tool",
+		"capability",
+		"plugin",
+		"agent",
+		"command",
+		"path",
+		"host",
+		"arg",
+		"count",
+		"secrets"
+	]);
+	const out = {};
+	for (const key of [
+		"tool",
+		"capability",
+		"plugin",
+		"agent"
+	]) if (value[key] !== void 0) {
+		const names = check.names(`${path}.${key}`, value[key]);
+		if (names !== void 0) out[key] = names;
+	}
+	if (value.command !== void 0) {
+		const match = readCommandMatch(check, `${path}.command`, value.command);
+		if (match !== void 0) out.command = match;
+	}
+	if (value.path !== void 0) {
+		const match = readPathMatch(check, `${path}.path`, value.path);
+		if (match !== void 0) out.path = match;
+	}
+	if (value.host !== void 0) {
+		const match = readHostMatch(check, `${path}.host`, value.host);
+		if (match !== void 0) out.host = match;
+	}
+	if (value.arg !== void 0) if (!Array.isArray(value.arg)) check.fail(`${path}.arg`, "expected an array of argument matchers");
+	else {
+		const list$1 = [];
+		value.arg.forEach((entry, index) => {
+			const one = readArgMatch(check, `${path}.arg[${index}]`, entry);
+			if (one !== void 0) list$1.push(one);
+		});
+		out.arg = list$1;
+	}
+	if (value.count !== void 0) if (!isObject(value.count)) check.fail(`${path}.count`, "expected an object");
+	else {
+		check.keys(`${path}.count`, value.count, ["above"]);
+		const above = check.number(`${path}.count.above`, value.count.above);
+		if (above !== void 0) out.count = { above };
+	}
+	if (value.secrets !== void 0) {
+		const match = readSecretsMatch(check, `${path}.secrets`, value.secrets);
+		if (match !== void 0) out.secrets = match;
+	}
+	return out;
+}
+function readEffect(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	const kind = value.kind === "hold" ? "ask" : value.kind;
+	if (kind !== "deny" && kind !== "ask" && kind !== "correct" && kind !== "warn" && kind !== "allow") {
+		check.fail(`${path}.kind`, "expected `allow`, `deny`, `hold` (or `ask`), `correct`, or `warn`");
+		return;
+	}
+	check.keys(path, value, kind === "correct" ? [
+		"kind",
+		"set",
+		"because"
+	] : ["kind", "because"]);
+	const because = check.text(`${path}.because`, value.because);
+	if (because === void 0) return void 0;
+	if (kind === "correct") {
+		if (!isObject(value.set) || Object.keys(value.set).length === 0) {
+			check.fail(`${path}.set`, "expected a non-empty object of arguments to set");
+			return;
+		}
+		return {
+			kind,
+			set: value.set,
+			because
+		};
+	}
+	return {
+		kind,
+		because
+	};
+}
+function readRule(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"id",
+		"title",
+		"description",
+		"when",
+		"effect",
+		"frameworks"
+	]);
+	const id = check.text(`${path}.id`, value.id);
+	const effect = readEffect(check, `${path}.effect`, value.effect);
+	if (value.when === void 0) check.fail(`${path}.when`, "expected an object");
+	const when = readMatch(check, `${path}.when`, value.when ?? {});
+	if (id === void 0 || effect === void 0) return void 0;
+	const rule = {
+		id,
+		when,
+		effect
+	};
+	if (value.title !== void 0) {
+		const title = check.text(`${path}.title`, value.title);
+		if (title !== void 0) rule.title = title;
+	}
+	if (value.description !== void 0) {
+		const description = check.text(`${path}.description`, value.description);
+		if (description !== void 0) rule.description = description;
+	}
+	if (value.frameworks !== void 0) {
+		const frameworks = readFrameworks(check, `${path}.frameworks`, value.frameworks);
+		if (frameworks !== void 0) rule.frameworks = frameworks;
+	}
+	return rule;
+}
+/**
+* A citation names a framework edition and controls the registry knows. A
+* typo here would be a rule that claims a mapping no view can render, so it
+* is a pack error rather than an ignored key — the same line the rest of the
+* parser takes.
+*/
+function readFrameworks(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object keyed by framework id");
+		return;
+	}
+	const out = {};
+	for (const [framework, controls] of Object.entries(value)) {
+		const known = FRAMEWORKS[framework];
+		if (known === void 0) {
+			check.fail(`${path}.${framework}`, `unknown framework; expected one of ${Object.keys(FRAMEWORKS).map((k) => `\`${k}\``).join(", ")}`);
+			continue;
+		}
+		if (!Array.isArray(controls) || !controls.every((c) => typeof c === "string")) {
+			check.fail(`${path}.${framework}`, "expected an array of control ids");
+			continue;
+		}
+		const ids = controls;
+		for (const control of ids) if (known.controls[control] === void 0) check.fail(`${path}.${framework}`, `unknown control \`${control}\` in ${known.name}`);
+		if (ids.length > 0) out[framework] = [...new Set(ids)];
+	}
+	return out;
+}
+/** Parse and validate a pack. Never throws; every problem lands in `errors`. */
+function parsePack(source) {
+	let raw;
+	try {
+		raw = JSON.parse(source);
+	} catch (error) {
+		return {
+			ok: false,
+			errors: [{
+				path: "",
+				message: `invalid JSON: ${error instanceof Error ? error.message : String(error)}`
+			}]
+		};
+	}
+	const check = new Check();
+	if (!isObject(raw)) return {
+		ok: false,
+		errors: [{
+			path: "",
+			message: "expected an object"
+		}]
+	};
+	check.keys("", raw, [
+		"prae",
+		"pack",
+		"version",
+		"description",
+		"owner",
+		"expires_at",
+		"baseline",
+		"rules"
+	]);
+	if (raw.prae !== "0.1") check.fail(".prae", "expected `\"0.1\"`; this is the only pack version this build reads");
+	const name = check.text(".pack", raw.pack);
+	const version = check.text(".version", raw.version);
+	const description = raw.description === void 0 ? void 0 : check.text(".description", raw.description);
+	const owner = raw.owner === void 0 ? void 0 : check.text(".owner", raw.owner);
+	const expires = raw.expires_at === void 0 ? void 0 : check.text(".expires_at", raw.expires_at);
+	if (expires !== void 0 && (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/.test(expires) || !Number.isFinite(Date.parse(expires)))) check.fail(".expires_at", "expected an ISO 8601 time with a zone, e.g. 2026-10-05T12:00:00Z");
+	let baseline;
+	if (raw.baseline !== void 0) if (!isObject(raw.baseline)) check.fail(".baseline", "expected an object");
+	else {
+		check.keys(".baseline", raw.baseline, ["capabilities"]);
+		const caps = check.globs(".baseline.capabilities", raw.baseline.capabilities);
+		if (caps !== void 0) baseline = { capabilities: caps };
+	}
+	const rules = [];
+	if (!Array.isArray(raw.rules)) check.fail(".rules", "expected an array");
+	else {
+		const seen = /* @__PURE__ */ new Set();
+		raw.rules.forEach((entry, index) => {
+			const rule = readRule(check, `rules[${index}]`, entry);
+			if (rule === void 0) return;
+			if (seen.has(rule.id)) {
+				check.fail(`rules[${index}].id`, `duplicate rule id \`${rule.id}\``);
+				return;
+			}
+			seen.add(rule.id);
+			rules.push(rule);
+		});
+	}
+	if (check.errors.length > 0) return {
+		ok: false,
+		errors: check.errors
+	};
+	if (name === void 0 || version === void 0) return {
+		ok: false,
+		errors: check.errors
+	};
+	return {
+		ok: true,
+		pack: {
+			prae: "0.1",
+			pack: name,
+			version,
+			...description === void 0 ? {} : { description },
+			...owner === void 0 ? {} : { owner },
+			...expires === void 0 ? {} : { expires_at: expires },
+			...baseline === void 0 ? {} : { baseline },
+			rules
+		}
+	};
+}
+
+//#endregion
+export { PATH_ARGS as a, withinAny as c, evaluate as i, segments as l, FRAMEWORKS as n, hostOf as o, cite as r, relativeTo as s, parsePack as t };