runspec-node 0.32.0 → 0.33.0

package/dist/become.d.ts

@@ -0,0 +1,36 @@
+/**
+ * become.ts — run_as resolution and the enforce_run_as identity check.
+ *
+ * Mirrors the Python `runspec.become` module for the SPEC "Remote Execution"
+ * semantics. Node does not build escalation commands (no `runspec serve`
+ * sudo wrapping), so only the pieces the `enforce_run_as` gate needs are
+ * ported: resolving a `run_as` spec to a concrete username for a host, and
+ * comparing the resolved user to the current process's effective user.
+ *
+ * See spec/SPEC.md → "Remote Execution".
+ */
+/**
+ * Resolve a `run_as` spec to a concrete username for `hostname`.
+ *
+ * Forms (see SPEC): simple string, `$ENV_VAR`, or a table with `hosts` (exact
+ * match) / `patterns` (full-match regex, first wins, insertion order) /
+ * `default`. Returns `''` for "no privilege escalation".
+ */
+export declare function resolveRunAs(spec: unknown, hostname: string): string;
+/**
+ * Check that the current process is running as `runAsUser`.
+ *
+ * Returns `null` when the identity matches *or* the check cannot be performed —
+ * an empty target (no escalation intended, so no identity to assert) or a
+ * platform with no POSIX uid model (Windows, where `process.geteuid` is
+ * undefined). Returns a human-readable detail string describing the mismatch
+ * otherwise.
+ *
+ * The target is resolved to a uid (a numeric string is taken as a uid directly,
+ * otherwise it is looked up with `id`) and compared to the effective uid, so
+ * account aliases that share a uid are treated as equal. An executor escalates
+ * *before* the process starts, so under one the effective user already matches
+ * and this passes silently; it only fires on the direct/import path.
+ */
+export declare function verifyRunAsIdentity(runAsUser: string): string | null;
+//# sourceMappingURL=become.d.ts.map

package/dist/become.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"become.d.ts","sourceRoot":"","sources":["../src/become.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA4BpE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkCpE"}

package/dist/become.js

@@ -0,0 +1,103 @@
+"use strict";
+/**
+ * become.ts — run_as resolution and the enforce_run_as identity check.
+ *
+ * Mirrors the Python `runspec.become` module for the SPEC "Remote Execution"
+ * semantics. Node does not build escalation commands (no `runspec serve`
+ * sudo wrapping), so only the pieces the `enforce_run_as` gate needs are
+ * ported: resolving a `run_as` spec to a concrete username for a host, and
+ * comparing the resolved user to the current process's effective user.
+ *
+ * See spec/SPEC.md → "Remote Execution".
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveRunAs = resolveRunAs;
+exports.verifyRunAsIdentity = verifyRunAsIdentity;
+const child_process_1 = require("child_process");
+/**
+ * Resolve a `run_as` spec to a concrete username for `hostname`.
+ *
+ * Forms (see SPEC): simple string, `$ENV_VAR`, or a table with `hosts` (exact
+ * match) / `patterns` (full-match regex, first wins, insertion order) /
+ * `default`. Returns `''` for "no privilege escalation".
+ */
+function resolveRunAs(spec, hostname) {
+    if (spec === null || spec === undefined)
+        return '';
+    if (typeof spec === 'string') {
+        if (spec.startsWith('$'))
+            return process.env[spec.slice(1)] ?? '';
+        return spec;
+    }
+    if (typeof spec === 'object') {
+        const s = spec;
+        const hosts = s['hosts'] ?? {};
+        if (hostname in hosts)
+            return String(hosts[hostname]);
+        const patterns = s['patterns'] ?? {};
+        for (const [pattern, user] of Object.entries(patterns)) {
+            try {
+                // Anchor both ends for re.fullmatch() semantics.
+                if (new RegExp(`^(?:${pattern})$`).test(hostname))
+                    return String(user);
+            }
+            catch {
+                // Invalid regex — skip it (serve validates patterns up front).
+            }
+        }
+        return String(s['default'] ?? '');
+    }
+    return '';
+}
+/**
+ * Check that the current process is running as `runAsUser`.
+ *
+ * Returns `null` when the identity matches *or* the check cannot be performed —
+ * an empty target (no escalation intended, so no identity to assert) or a
+ * platform with no POSIX uid model (Windows, where `process.geteuid` is
+ * undefined). Returns a human-readable detail string describing the mismatch
+ * otherwise.
+ *
+ * The target is resolved to a uid (a numeric string is taken as a uid directly,
+ * otherwise it is looked up with `id`) and compared to the effective uid, so
+ * account aliases that share a uid are treated as equal. An executor escalates
+ * *before* the process starts, so under one the effective user already matches
+ * and this passes silently; it only fires on the direct/import path.
+ */
+function verifyRunAsIdentity(runAsUser) {
+    if (!runAsUser)
+        return null;
+    const geteuid = process.geteuid;
+    if (!geteuid)
+        return null; // no POSIX uid model (Windows) — nothing to compare
+    const currentUid = geteuid.call(process);
+    let targetUid;
+    try {
+        if (/^\d+$/.test(runAsUser)) {
+            targetUid = parseInt(runAsUser, 10);
+            // Confirm the uid maps to a real account; throws if it does not.
+            (0, child_process_1.execFileSync)('id', ['-un', String(targetUid)], { stdio: ['ignore', 'ignore', 'ignore'] });
+        }
+        else {
+            const out = (0, child_process_1.execFileSync)('id', ['-u', runAsUser], { stdio: ['ignore', 'pipe', 'ignore'] });
+            targetUid = parseInt(out.toString().trim(), 10);
+        }
+    }
+    catch {
+        return `run_as user '${runAsUser}' does not exist on this host`;
+    }
+    if (currentUid === targetUid)
+        return null;
+    let currentName = String(currentUid);
+    try {
+        currentName =
+            (0, child_process_1.execFileSync)('id', ['-un', String(currentUid)], { stdio: ['ignore', 'pipe', 'ignore'] })
+                .toString()
+                .trim() || String(currentUid);
+    }
+    catch {
+        // Keep the numeric uid as the name.
+    }
+    return `the current process runs as '${currentName}' (uid ${currentUid}), not '${runAsUser}' (uid ${targetUid})`;
+}
+//# sourceMappingURL=become.js.map

package/dist/become.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"become.js","sourceRoot":"","sources":["../src/become.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAWH,oCA4BC;AAiBD,kDAkCC;AAxFD,iDAA6C;AAE7C;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,IAAa,EAAE,QAAgB;IAC1D,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEnD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,IAA+B,CAAC;QAE1C,MAAM,KAAK,GAAI,CAAC,CAAC,OAAO,CAA6B,IAAI,EAAE,CAAC;QAC5D,IAAI,QAAQ,IAAI,KAAK;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEtD,MAAM,QAAQ,GAAI,CAAC,CAAC,UAAU,CAA6B,IAAI,EAAE,CAAC;QAClE,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,iDAAiD;gBACjD,IAAI,IAAI,MAAM,CAAC,OAAO,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;YACzE,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;YACjE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,mBAAmB,CAAC,SAAiB;IACnD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,oDAAoD;IAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,SAAS,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACpC,iEAAiE;YACjE,IAAA,4BAAY,EAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3F,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,gBAAgB,SAAS,+BAA+B,CAAC;IAClE,CAAC;IAED,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAE1C,IAAI,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,WAAW;YACT,IAAA,4BAAY,EAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;iBACrF,QAAQ,EAAE;iBACV,IAAI,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IAED,OAAO,gCAAgC,WAAW,UAAU,UAAU,WAAW,SAAS,UAAU,SAAS,GAAG,CAAC;AACnH,CAAC"}

package/dist/errors.d.ts

@@ -13,6 +13,8 @@ export declare class GroupViolation extends RunSpecError {
 }
 export declare class AutonomyViolation extends RunSpecError {
 }
+export declare class RunAsMismatch extends RunSpecError {
+}
 export declare function formatMissingRequired(name: string, spec: Record<string, unknown>): string;
 export declare function formatInvalidChoice(value: string, options: string[], name: string): string;
 export declare function formatOutOfRange(value: number, range: [number, number], name: string): string;
@@ -26,5 +28,6 @@ export declare function formatGroupExclusive(groupName: string, provided: string
 export declare function formatGroupInclusive(groupName: string, missing: string[]): string;
 export declare function formatGroupAtLeastOne(groupName: string, args: string[]): string;
 export declare function formatGroupExactlyOne(groupName: string, args: string[], provided: string[]): string;
+export declare function formatRunAsMismatch(runnableName: string, detail: string): string;
 export declare function formatDeprecated(name: string, message: string): string;
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,kBAAmB,SAAQ,YAAY;CAAG;AACvD,qBAAa,aAAc,SAAQ,YAAY;CAAG;AAClD,qBAAa,UAAW,SAAQ,YAAY;CAAG;AAC/C,qBAAa,UAAW,SAAQ,YAAY;CAAG;AAC/C,qBAAa,cAAe,SAAQ,YAAY;CAAG;AACnD,qBAAa,iBAAkB,SAAQ,YAAY;CAAG;AAEtD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAQzF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAS1F;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAM7F;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMzF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMrF;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMpF;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,GACzC,MAAM,CAUR;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,MAAM,CAM9F;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAQ1E;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAMlF;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAMjF;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAK/E;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAYnG;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,kBAAmB,SAAQ,YAAY;CAAG;AACvD,qBAAa,aAAc,SAAQ,YAAY;CAAG;AAClD,qBAAa,UAAW,SAAQ,YAAY;CAAG;AAC/C,qBAAa,UAAW,SAAQ,YAAY;CAAG;AAC/C,qBAAa,cAAe,SAAQ,YAAY;CAAG;AACnD,qBAAa,iBAAkB,SAAQ,YAAY;CAAG;AACtD,qBAAa,aAAc,SAAQ,YAAY;CAAG;AAElD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAQzF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAS1F;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAM7F;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMzF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMrF;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMpF;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,GACzC,MAAM,CAUR;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,MAAM,CAM9F;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAQ1E;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAMlF;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAMjF;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAK/E;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAYnG;AAED,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAOhF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtE"}

package/dist/errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AutonomyViolation = exports.GroupViolation = exports.UnknownArg = exports.OutOfRange = exports.InvalidChoice = exports.MissingRequiredArg = exports.RunSpecError = void 0;
+exports.RunAsMismatch = exports.AutonomyViolation = exports.GroupViolation = exports.UnknownArg = exports.OutOfRange = exports.InvalidChoice = exports.MissingRequiredArg = exports.RunSpecError = void 0;
 exports.formatMissingRequired = formatMissingRequired;
 exports.formatInvalidChoice = formatInvalidChoice;
 exports.formatOutOfRange = formatOutOfRange;
@@ -14,6 +14,7 @@ exports.formatGroupExclusive = formatGroupExclusive;
 exports.formatGroupInclusive = formatGroupInclusive;
 exports.formatGroupAtLeastOne = formatGroupAtLeastOne;
 exports.formatGroupExactlyOne = formatGroupExactlyOne;
+exports.formatRunAsMismatch = formatRunAsMismatch;
 exports.formatDeprecated = formatDeprecated;
 class RunSpecError extends Error {
     constructor(message) {
@@ -40,6 +41,9 @@ exports.GroupViolation = GroupViolation;
 class AutonomyViolation extends RunSpecError {
 }
 exports.AutonomyViolation = AutonomyViolation;
+class RunAsMismatch extends RunSpecError {
+}
+exports.RunAsMismatch = RunAsMismatch;
 function formatMissingRequired(name, spec) {
     const lines = [
         `✗  Missing required argument: --${name}`,
@@ -151,6 +155,14 @@ function formatGroupExactlyOne(groupName, args, provided) {
         `   Provide exactly one of: ${args.map((a) => `--${a}`).join(', ')}`,
     ].join('\n');
 }
+function formatRunAsMismatch(runnableName, detail) {
+    return [
+        `✗  Refusing to run '${runnableName}': ${detail}.`,
+        `   This runnable declares a run_as user it must execute as.`,
+        '   Re-run under the intended account (e.g. `sudo -u <user> ...`, `runspec serve`,',
+        '   or `runspec jump`), or relax the check with enforce_run_as = "warn" (or "off").',
+    ].join('\n');
+}
 function formatDeprecated(name, message) {
     return `⚠  --${name} is deprecated: ${message}`;
 }

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";;;AAcA,sDAQC;AAED,kDASC;AAED,4CAMC;AAED,oDAMC;AAED,wCAMC;AAED,sCAMC;AAED,gDAcC;AAED,oDAMC;AAED,4CAQC;AAED,oDAMC;AAED,oDAMC;AAED,sDAKC;AAED,sDAYC;AAED,4CAEC;AA5ID,MAAa,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AALD,oCAKC;AAED,MAAa,kBAAmB,SAAQ,YAAY;CAAG;AAAvD,gDAAuD;AACvD,MAAa,aAAc,SAAQ,YAAY;CAAG;AAAlD,sCAAkD;AAClD,MAAa,UAAW,SAAQ,YAAY;CAAG;AAA/C,gCAA+C;AAC/C,MAAa,UAAW,SAAQ,YAAY;CAAG;AAA/C,gCAA+C;AAC/C,MAAa,cAAe,SAAQ,YAAY;CAAG;AAAnD,wCAAmD;AACnD,MAAa,iBAAkB,SAAQ,YAAY;CAAG;AAAtD,8CAAsD;AAEtD,SAAgB,qBAAqB,CAAC,IAAY,EAAE,IAA6B;IAC/E,MAAM,KAAK,GAAG;QACZ,mCAAmC,IAAI,EAAE;QACzC,YAAY,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE;KACpC,CAAC;IACF,IAAI,IAAI,CAAC,aAAa,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,oCAAoC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,mBAAmB,CAAC,KAAa,EAAE,OAAiB,EAAE,IAAY;IAChF,MAAM,KAAK,GAAG;QACZ,0BAA0B,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QAC1D,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC3C,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;KACnC,CAAC;IACF,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAa,EAAE,KAAuB,EAAE,IAAY;IACnF,OAAO;QACL,+BAA+B,IAAI,KAAK,KAAK,EAAE;QAC/C,wBAAwB,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE;QAClD,WAAW,KAAK,EAAE;KACnB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,oBAAoB,CAAC,KAAa,EAAE,OAAe,EAAE,IAAY;IAC/E,OAAO;QACL,0BAA0B,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QAC1D,yCAAyC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QAClE,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;KACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,cAAc,CAAC,KAAa,EAAE,SAAiB,EAAE,IAAY;IAC3E,OAAO;QACL,4BAA4B,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QAC5D,yBAAyB,SAAS,aAAa,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;QAC3E,WAAW,KAAK,CAAC,MAAM,EAAE;KAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,aAAa,CAAC,KAAa,EAAE,SAAiB,EAAE,IAAY;IAC1E,OAAO;QACL,2BAA2B,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QAC3D,wBAAwB,SAAS,aAAa,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;QAC1E,WAAW,KAAK,CAAC,MAAM,EAAE;KAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,kBAAkB,CAChC,IAAY,EACZ,KAAa,EACb,QAA0C;IAE1C,MAAM,MAAM,GAAG,KAAK,IAAI,KAAK,QAAQ,CAAC,MAAM,OAAO,KAAK,6BAA6B,CAAC;IACtF,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,MAAM;aAClB,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,GAAG,IAAI,CAAC;aAC7B,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,aAAa,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,MAAM,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,SAAgB,oBAAoB,CAAC,YAAoB,EAAE,iBAA2B;IACpF,OAAO;QACL,OAAO,YAAY,uBAAuB;QAC1C,0BAA0B,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxD,aAAa,YAAY,iCAAiC;KAC3D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,gBAAgB,CAAC,IAAY,EAAE,SAAmB;IAChE,MAAM,KAAK,GAAG;QACZ,0BAA0B,IAAI,EAAE;QAChC,uBAAuB,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KAC/E,CAAC;IACF,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,oBAAoB,CAAC,SAAiB,EAAE,QAAkB;IACxE,OAAO;QACL,sCAAsC,SAAS,GAAG;QAClD,QAAQ,QAAQ,CAAC,CAAC,CAAC,UAAU,QAAQ,CAAC,CAAC,CAAC,0BAA0B;QAClE,4BAA4B;KAC7B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,oBAAoB,CAAC,SAAiB,EAAE,OAAiB;IACvE,OAAO;QACL,iCAAiC,SAAS,GAAG;QAC7C,qDAAqD;QACrD,oBAAoB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;KACjE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,qBAAqB,CAAC,SAAiB,EAAE,IAAc;IACrE,OAAO;QACL,aAAa,SAAS,kCAAkC;QACxD,+BAA+B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACtE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,qBAAqB,CAAC,SAAiB,EAAE,IAAc,EAAE,QAAkB;IACzF,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO;YACL,aAAa,SAAS,iCAAiC;YACvD,8BAA8B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO;QACL,aAAa,SAAS,iCAAiC;QACvD,UAAU,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxE,8BAA8B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACrE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,gBAAgB,CAAC,IAAY,EAAE,OAAe;IAC5D,OAAO,QAAQ,IAAI,mBAAmB,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,UAAoB;IAClD,IAAI,IAAwB,CAAC;IAC7B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,KAAK,GAAG,SAAS,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACtC,SAAS,GAAG,KAAK,CAAC;YAClB,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,CAAS,EAAE,CAAS;IAC1C,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC3B,SAAS,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";;;AAeA,sDAQC;AAED,kDASC;AAED,4CAMC;AAED,oDAMC;AAED,wCAMC;AAED,sCAMC;AAED,gDAcC;AAED,oDAMC;AAED,4CAQC;AAED,oDAMC;AAED,oDAMC;AAED,sDAKC;AAED,sDAYC;AAED,kDAOC;AAED,4CAEC;AAtJD,MAAa,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AALD,oCAKC;AAED,MAAa,kBAAmB,SAAQ,YAAY;CAAG;AAAvD,gDAAuD;AACvD,MAAa,aAAc,SAAQ,YAAY;CAAG;AAAlD,sCAAkD;AAClD,MAAa,UAAW,SAAQ,YAAY;CAAG;AAA/C,gCAA+C;AAC/C,MAAa,UAAW,SAAQ,YAAY;CAAG;AAA/C,gCAA+C;AAC/C,MAAa,cAAe,SAAQ,YAAY;CAAG;AAAnD,wCAAmD;AACnD,MAAa,iBAAkB,SAAQ,YAAY;CAAG;AAAtD,8CAAsD;AACtD,MAAa,aAAc,SAAQ,YAAY;CAAG;AAAlD,sCAAkD;AAElD,SAAgB,qBAAqB,CAAC,IAAY,EAAE,IAA6B;IAC/E,MAAM,KAAK,GAAG;QACZ,mCAAmC,IAAI,EAAE;QACzC,YAAY,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE;KACpC,CAAC;IACF,IAAI,IAAI,CAAC,aAAa,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,oCAAoC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,mBAAmB,CAAC,KAAa,EAAE,OAAiB,EAAE,IAAY;IAChF,MAAM,KAAK,GAAG;QACZ,0BAA0B,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QAC1D,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC3C,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;KACnC,CAAC;IACF,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAa,EAAE,KAAuB,EAAE,IAAY;IACnF,OAAO;QACL,+BAA+B,IAAI,KAAK,KAAK,EAAE;QAC/C,wBAAwB,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE;QAClD,WAAW,KAAK,EAAE;KACnB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,oBAAoB,CAAC,KAAa,EAAE,OAAe,EAAE,IAAY;IAC/E,OAAO;QACL,0BAA0B,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QAC1D,yCAAyC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QAClE,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;KACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,cAAc,CAAC,KAAa,EAAE,SAAiB,EAAE,IAAY;IAC3E,OAAO;QACL,4BAA4B,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QAC5D,yBAAyB,SAAS,aAAa,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;QAC3E,WAAW,KAAK,CAAC,MAAM,EAAE;KAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,aAAa,CAAC,KAAa,EAAE,SAAiB,EAAE,IAAY;IAC1E,OAAO;QACL,2BAA2B,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QAC3D,wBAAwB,SAAS,aAAa,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;QAC1E,WAAW,KAAK,CAAC,MAAM,EAAE;KAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,kBAAkB,CAChC,IAAY,EACZ,KAAa,EACb,QAA0C;IAE1C,MAAM,MAAM,GAAG,KAAK,IAAI,KAAK,QAAQ,CAAC,MAAM,OAAO,KAAK,6BAA6B,CAAC;IACtF,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,MAAM;aAClB,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,GAAG,IAAI,CAAC;aAC7B,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,aAAa,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,MAAM,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,SAAgB,oBAAoB,CAAC,YAAoB,EAAE,iBAA2B;IACpF,OAAO;QACL,OAAO,YAAY,uBAAuB;QAC1C,0BAA0B,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxD,aAAa,YAAY,iCAAiC;KAC3D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,gBAAgB,CAAC,IAAY,EAAE,SAAmB;IAChE,MAAM,KAAK,GAAG;QACZ,0BAA0B,IAAI,EAAE;QAChC,uBAAuB,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KAC/E,CAAC;IACF,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,oBAAoB,CAAC,SAAiB,EAAE,QAAkB;IACxE,OAAO;QACL,sCAAsC,SAAS,GAAG;QAClD,QAAQ,QAAQ,CAAC,CAAC,CAAC,UAAU,QAAQ,CAAC,CAAC,CAAC,0BAA0B;QAClE,4BAA4B;KAC7B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,oBAAoB,CAAC,SAAiB,EAAE,OAAiB;IACvE,OAAO;QACL,iCAAiC,SAAS,GAAG;QAC7C,qDAAqD;QACrD,oBAAoB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;KACjE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,qBAAqB,CAAC,SAAiB,EAAE,IAAc;IACrE,OAAO;QACL,aAAa,SAAS,kCAAkC;QACxD,+BAA+B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACtE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,qBAAqB,CAAC,SAAiB,EAAE,IAAc,EAAE,QAAkB;IACzF,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO;YACL,aAAa,SAAS,iCAAiC;YACvD,8BAA8B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO;QACL,aAAa,SAAS,iCAAiC;QACvD,UAAU,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxE,8BAA8B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACrE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,mBAAmB,CAAC,YAAoB,EAAE,MAAc;IACtE,OAAO;QACL,uBAAuB,YAAY,MAAM,MAAM,GAAG;QAClD,6DAA6D;QAC7D,mFAAmF;QACnF,oFAAoF;KACrF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,gBAAgB,CAAC,IAAY,EAAE,OAAe;IAC5D,OAAO,QAAQ,IAAI,mBAAmB,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,UAAoB;IAClD,IAAI,IAAwB,CAAC;IAC7B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,KAAK,GAAG,SAAS,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACtC,SAAS,GAAG,KAAK,CAAC;YAClB,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,CAAS,EAAE,CAAS;IAC1C,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC3B,SAAS,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { parse, loadSpec } from './parser';
 export { registerType, listTypes } from './types';
 export { tsTypeOf } from './inference';
-export { RunSpecError, MissingRequiredArg, InvalidChoice, OutOfRange, UnknownArg, GroupViolation, AutonomyViolation } from './errors';
+export { RunSpecError, MissingRequiredArg, InvalidChoice, OutOfRange, UnknownArg, GroupViolation, AutonomyViolation, RunAsMismatch } from './errors';
 export { findConfig } from './finder';
 export { loadRaw } from './loader';
 export { getLogger } from './logging_setup';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACtI,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACrJ,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getLogger = exports.loadRaw = exports.findConfig = exports.AutonomyViolation = exports.GroupViolation = exports.UnknownArg = exports.OutOfRange = exports.InvalidChoice = exports.MissingRequiredArg = exports.RunSpecError = exports.tsTypeOf = exports.listTypes = exports.registerType = exports.loadSpec = exports.parse = void 0;
+exports.getLogger = exports.loadRaw = exports.findConfig = exports.RunAsMismatch = exports.AutonomyViolation = exports.GroupViolation = exports.UnknownArg = exports.OutOfRange = exports.InvalidChoice = exports.MissingRequiredArg = exports.RunSpecError = exports.tsTypeOf = exports.listTypes = exports.registerType = exports.loadSpec = exports.parse = void 0;
 var parser_1 = require("./parser");
 Object.defineProperty(exports, "parse", { enumerable: true, get: function () { return parser_1.parse; } });
 Object.defineProperty(exports, "loadSpec", { enumerable: true, get: function () { return parser_1.loadSpec; } });
@@ -17,6 +17,7 @@ Object.defineProperty(exports, "OutOfRange", { enumerable: true, get: function (
 Object.defineProperty(exports, "UnknownArg", { enumerable: true, get: function () { return errors_1.UnknownArg; } });
 Object.defineProperty(exports, "GroupViolation", { enumerable: true, get: function () { return errors_1.GroupViolation; } });
 Object.defineProperty(exports, "AutonomyViolation", { enumerable: true, get: function () { return errors_1.AutonomyViolation; } });
+Object.defineProperty(exports, "RunAsMismatch", { enumerable: true, get: function () { return errors_1.RunAsMismatch; } });
 var finder_1 = require("./finder");
 Object.defineProperty(exports, "findConfig", { enumerable: true, get: function () { return finder_1.findConfig; } });
 var loader_1 = require("./loader");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,mCAA2C;AAAlC,+FAAA,KAAK,OAAA;AAAE,kGAAA,QAAQ,OAAA;AACxB,iCAAkD;AAAzC,qGAAA,YAAY,OAAA;AAAE,kGAAA,SAAS,OAAA;AAChC,yCAAuC;AAA9B,qGAAA,QAAQ,OAAA;AACjB,mCAAsI;AAA7H,sGAAA,YAAY,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,oGAAA,UAAU,OAAA;AAAE,oGAAA,UAAU,OAAA;AAAE,wGAAA,cAAc,OAAA;AAAE,2GAAA,iBAAiB,OAAA;AACnH,mCAAsC;AAA7B,oGAAA,UAAU,OAAA;AACnB,mCAAmC;AAA1B,iGAAA,OAAO,OAAA;AAChB,iDAA4C;AAAnC,0GAAA,SAAS,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,mCAA2C;AAAlC,+FAAA,KAAK,OAAA;AAAE,kGAAA,QAAQ,OAAA;AACxB,iCAAkD;AAAzC,qGAAA,YAAY,OAAA;AAAE,kGAAA,SAAS,OAAA;AAChC,yCAAuC;AAA9B,qGAAA,QAAQ,OAAA;AACjB,mCAAqJ;AAA5I,sGAAA,YAAY,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,oGAAA,UAAU,OAAA;AAAE,oGAAA,UAAU,OAAA;AAAE,wGAAA,cAAc,OAAA;AAAE,2GAAA,iBAAiB,OAAA;AAAE,uGAAA,aAAa,OAAA;AAClI,mCAAsC;AAA7B,oGAAA,UAAU,OAAA;AACnB,mCAAmC;AAA1B,iGAAA,OAAO,OAAA;AAChB,iDAA4C;AAAnC,0GAAA,SAAS,OAAA"}

package/dist/loader.js

@@ -53,6 +53,7 @@ function loadRaw(configPath) {
 function normaliseConfig(raw) {
     return {
         autonomyDefault: raw['autonomy-default'] ?? 'confirm',
+        enforceRunAs: raw['enforce_run_as'] ?? 'error',
         lang: raw['lang'],
         version: String(raw['version'] ?? '1'),
         logging: normaliseLogging(raw['logging']),
@@ -97,6 +98,8 @@ function normaliseScript(name, raw) {
         autonomyReason: raw['autonomy-reason'],
         output: raw['output'],
         discoverable: raw['discoverable'],
+        runAs: raw['run_as'],
+        enforceRunAs: raw['enforce_run_as'],
         requireCommand: raw['require-command'] ?? false,
         args: normaliseArgs((raw['args'] ?? {})),
         groups: normaliseGroups((raw['groups'] ?? {})),

package/dist/loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"loader.js","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,0BAeC;AAnBD,uCAAyB;AACzB,yCAA+C;AAG/C,SAAgB,OAAO,CAAC,UAAkB;IACxC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAA,iBAAS,EAAC,OAAO,CAA4B,CAAC;IAE1D,MAAM,YAAY,GAA4C,EAAE,CAAC;IACjE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7F,YAAY,CAAC,GAAG,CAAC,GAAG,KAAgC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QACzE,SAAS,EAAE,kBAAkB,CAAC,YAAY,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B;IACnD,OAAO;QACL,eAAe,EAAG,GAAG,CAAC,kBAAkB,CAAwB,IAAI,SAAS;QAC7E,IAAI,EAAE,GAAG,CAAC,MAAM,CAAuB;QACvC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC;QACtC,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAwC,CAAC;KACjF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAwC;IAChE,wEAAwE;IACxE,2EAA2E;IAC3E,qEAAqE;IACrE,0EAA0E;IAC1E,+BAA+B;IAC/B,EAAE;IACF,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAChF,+EAA+E;IAC/E,4EAA4E;IAC5E,gFAAgF;IAChF,6EAA6E;IAC7E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,2EAA2E;IAC3E,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAC;IAC/C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACtE,cAAc,EAAE,GAAG,CAAC,iBAAiB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;QAC9F,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA4C;IACtE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,GAA4B;IACjE,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,GAAG,CAAC,aAAa,CAAuB;QACrD,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAuB;QAC/C,cAAc,EAAE,GAAG,CAAC,iBAAiB,CAAuB;QAC5D,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAuB;QAC3C,YAAY,EAAE,GAAG,CAAC,cAAc,CAAmC;QACnE,cAAc,EAAG,GAAG,CAAC,iBAAiB,CAAyB,IAAI,KAAK;QACxE,IAAI,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAA4B,CAAC;QACnE,MAAM,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QACzE,QAAQ,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAA4C,CAAC;KAChG,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B;IACjD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,KAAgC,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,GAA4B;IAC9D,OAAO;QACL,IAAI;QACJ,IAAI,EAAG,GAAG,CAAC,MAAM,CAAwB,IAAI,SAAS;QACtD,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAwB;QAChD,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC;QACvB,WAAW,EAAE,GAAG,CAAC,aAAa,CAAuB;QACrD,OAAO,EAAE,GAAG,CAAC,SAAS,CAAyB;QAC/C,KAAK,EAAE,GAAG,CAAC,OAAO,CAAiC;QACnD,OAAO,EAAE,GAAG,CAAC,SAAS,CAAuB;QAC7C,SAAS,EAAE,GAAG,CAAC,YAAY,CAAuB;QAClD,SAAS,EAAE,GAAG,CAAC,YAAY,CAAuB;QAClD,QAAQ,EAAG,GAAG,CAAC,UAAU,CAAyB,IAAI,KAAK;QAC3D,SAAS,EAAE,GAAG,CAAC,WAAW,CAAuB;QACjD,KAAK,EAAE,GAAG,CAAC,OAAO,CAAuB;QACzC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAuB;QAC/C,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,UAAU,EAAE,GAAG,CAAC,YAAY,CAAuB;QACnD,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAuB;QAC/C,YAAY,EAAE,GAAG,CAAC,cAAc,CAAmC;QACnE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAuB;QACnC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAuB;QACvC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAwC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B;IACnD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,OAAO;YACL,IAAI;YACJ;gBACE,IAAI;gBACJ,IAAI,EAAG,CAAC,CAAC,MAAM,CAAc,IAAI,EAAE;gBACnC,SAAS,EAAG,CAAC,CAAC,WAAW,CAAyB,IAAI,KAAK;gBAC3D,SAAS,EAAG,CAAC,CAAC,WAAW,CAAyB,IAAI,KAAK;gBAC3D,UAAU,EAAG,CAAC,CAAC,cAAc,CAAyB,IAAI,KAAK;gBAC/D,UAAU,EAAG,CAAC,CAAC,aAAa,CAAyB,IAAI,KAAK;gBAC9D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAuB;gBACxC,QAAQ,EAAG,CAAC,CAAC,UAAU,CAA0B,IAAI,EAAE;aACpC;SACtB,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,GAA4C;IACrE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5G,CAAC"}
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,0BAeC;AAnBD,uCAAyB;AACzB,yCAA+C;AAG/C,SAAgB,OAAO,CAAC,UAAkB;IACxC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAA,iBAAS,EAAC,OAAO,CAA4B,CAAC;IAE1D,MAAM,YAAY,GAA4C,EAAE,CAAC;IACjE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7F,YAAY,CAAC,GAAG,CAAC,GAAG,KAAgC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QACzE,SAAS,EAAE,kBAAkB,CAAC,YAAY,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B;IACnD,OAAO;QACL,eAAe,EAAG,GAAG,CAAC,kBAAkB,CAAwB,IAAI,SAAS;QAC7E,YAAY,EAAG,GAAG,CAAC,gBAAgB,CAAwB,IAAI,OAAO;QACtE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAuB;QACvC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC;QACtC,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAwC,CAAC;KACjF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAwC;IAChE,wEAAwE;IACxE,2EAA2E;IAC3E,qEAAqE;IACrE,0EAA0E;IAC1E,+BAA+B;IAC/B,EAAE;IACF,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAChF,+EAA+E;IAC/E,4EAA4E;IAC5E,gFAAgF;IAChF,6EAA6E;IAC7E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,2EAA2E;IAC3E,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAC;IAC/C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACtE,cAAc,EAAE,GAAG,CAAC,iBAAiB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;QAC9F,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA4C;IACtE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,GAA4B;IACjE,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,GAAG,CAAC,aAAa,CAAuB;QACrD,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAuB;QAC/C,cAAc,EAAE,GAAG,CAAC,iBAAiB,CAAuB;QAC5D,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAuB;QAC3C,YAAY,EAAE,GAAG,CAAC,cAAc,CAAmC;QACnE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC;QACpB,YAAY,EAAE,GAAG,CAAC,gBAAgB,CAAuB;QACzD,cAAc,EAAG,GAAG,CAAC,iBAAiB,CAAyB,IAAI,KAAK;QACxE,IAAI,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAA4B,CAAC;QACnE,MAAM,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QACzE,QAAQ,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAA4C,CAAC;KAChG,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B;IACjD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,KAAgC,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,GAA4B;IAC9D,OAAO;QACL,IAAI;QACJ,IAAI,EAAG,GAAG,CAAC,MAAM,CAAwB,IAAI,SAAS;QACtD,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAwB;QAChD,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC;QACvB,WAAW,EAAE,GAAG,CAAC,aAAa,CAAuB;QACrD,OAAO,EAAE,GAAG,CAAC,SAAS,CAAyB;QAC/C,KAAK,EAAE,GAAG,CAAC,OAAO,CAAiC;QACnD,OAAO,EAAE,GAAG,CAAC,SAAS,CAAuB;QAC7C,SAAS,EAAE,GAAG,CAAC,YAAY,CAAuB;QAClD,SAAS,EAAE,GAAG,CAAC,YAAY,CAAuB;QAClD,QAAQ,EAAG,GAAG,CAAC,UAAU,CAAyB,IAAI,KAAK;QAC3D,SAAS,EAAE,GAAG,CAAC,WAAW,CAAuB;QACjD,KAAK,EAAE,GAAG,CAAC,OAAO,CAAuB;QACzC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAuB;QAC/C,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,UAAU,EAAE,GAAG,CAAC,YAAY,CAAuB;QACnD,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAuB;QAC/C,YAAY,EAAE,GAAG,CAAC,cAAc,CAAmC;QACnE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAuB;QACnC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAuB;QACvC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAwC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B;IACnD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,OAAO;YACL,IAAI;YACJ;gBACE,IAAI;gBACJ,IAAI,EAAG,CAAC,CAAC,MAAM,CAAc,IAAI,EAAE;gBACnC,SAAS,EAAG,CAAC,CAAC,WAAW,CAAyB,IAAI,KAAK;gBAC3D,SAAS,EAAG,CAAC,CAAC,WAAW,CAAyB,IAAI,KAAK;gBAC3D,UAAU,EAAG,CAAC,CAAC,cAAc,CAAyB,IAAI,KAAK;gBAC/D,UAAU,EAAG,CAAC,CAAC,aAAa,CAAyB,IAAI,KAAK;gBAC9D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAuB;gBACxC,QAAQ,EAAG,CAAC,CAAC,UAAU,CAA0B,IAAI,EAAE;aACpC;SACtB,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,GAA4C;IACrE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5G,CAAC"}

package/dist/models.d.ts

@@ -14,6 +14,8 @@ export interface LoggingConfig {
 }
 export interface RawConfig {
     autonomyDefault: string;
+    /** Default enforce_run_as for runnables that don't declare one. */
+    enforceRunAs: string;
     lang?: string;
     version: string;
     logging?: LoggingConfig;
@@ -59,6 +61,13 @@ export interface ScriptSpec {
     output?: string;
     serve?: boolean | string[];
     discoverable?: boolean | string[];
+    /** The OS user the runnable must run as. String, $ENV ref, or a per-host /
+     *  pattern table. Consumed by an executor for escalation; on the direct path
+     *  it is the identity asserted by `enforceRunAs`. */
+    runAs?: unknown;
+    /** Reaction when the process is not running as the resolved `runAs` user on
+     *  the direct/import path: 'error' (default), 'warn', or 'off'. */
+    enforceRunAs?: string;
     requireCommand?: boolean;
     args: Record<string, ArgSpec>;
     groups: Record<string, GroupSpec>;

package/dist/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb;+EAC2E;IAC3E,OAAO,EAAE,OAAO,CAAC;IACjB;;kFAE8E;IAC9E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;2EACuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAIlB,YAAY,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAClC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,UAAU,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb;+EAC2E;IAC3E,OAAO,EAAE,OAAO,CAAC;IACjB;;kFAE8E;IAC9E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;2EACuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAIlB,YAAY,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAClC;;yDAEqD;IACrD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;uEACmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,UAAU,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC"}

package/dist/parser.d.ts

@@ -8,6 +8,8 @@ export interface ParseOptions {
     _enforceRequiredCommand?: boolean;
     /** Internal: prompt for missing required password args. loadSpec sets false. */
     _promptSecrets?: boolean;
+    /** Internal: verify the run_as identity (enforce_run_as). loadSpec sets false. */
+    _checkRunAs?: boolean;
 }
 export declare function parse(opts?: ParseOptions): ParsedArgs;
 export declare function loadSpec(opts?: ParseOptions): ParsedArgs;

package/dist/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAW,MAAM,UAAU,CAAC;AAEhE,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gFAAgF;IAChF,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,KAAK,CAAC,IAAI,GAAE,YAAiB,GAAG,UAAU,CA6IzD;AAED,wBAAgB,QAAQ,CAAC,IAAI,GAAE,YAAiB,GAAG,UAAU,CAG5D;AAwOD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,GAAE,MAAM,EAAO,GAAG,IAAI,CAwE5F"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAW,MAAM,UAAU,CAAC;AAEhE,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gFAAgF;IAChF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,KAAK,CAAC,IAAI,GAAE,YAAiB,GAAG,UAAU,CAiKzD;AAED,wBAAgB,QAAQ,CAAC,IAAI,GAAE,YAAiB,GAAG,UAAU,CAK5D;AAwOD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,GAAE,MAAM,EAAO,GAAG,IAAI,CAwE5F"}

package/dist/parser.js

@@ -37,6 +37,7 @@ exports.parse = parse;
 exports.loadSpec = loadSpec;
 exports.printHelp = printHelp;
 const path = __importStar(require("path"));
+const os = __importStar(require("os"));
 const fs = __importStar(require("fs"));
 const child_process_1 = require("child_process");
 const finder_1 = require("./finder");
@@ -44,10 +45,11 @@ const loader_1 = require("./loader");
 const inference_1 = require("./inference");
 const types_1 = require("./types");
 const validator_1 = require("./validator");
+const become_1 = require("./become");
 const errors_1 = require("./errors");
 const logging_setup_1 = require("./logging_setup");
 function parse(opts = {}) {
-    const { scriptName, argv: argvOverride, cwd, configPath: configPathOverride, _enforceRequiredCommand = true, _promptSecrets = true } = opts;
+    const { scriptName, argv: argvOverride, cwd, configPath: configPathOverride, _enforceRequiredCommand = true, _promptSecrets = true, _checkRunAs = true } = opts;
     const { configPath } = configPathOverride ? { configPath: configPathOverride } : (0, finder_1.findConfig)(cwd);
     const raw = (0, loader_1.loadRaw)(configPath);
     const config = raw.config;
@@ -109,6 +111,26 @@ function parse(opts = {}) {
         printHelp(name, activeScript, commandPath);
         process.exit(0);
     }
+    // Verify run_as identity on the direct/import execution path. run_as is
+    // consumed by an executor (sudo escalation) *before* the process starts, so
+    // under one the effective user already matches and this passes silently; on
+    // the direct path nothing escalates, so this catches running as the wrong
+    // user. run_as/enforce_run_as are runnable-level, so they are read from the
+    // root spec (not the merged subcommand leaf). Runs after --help so
+    // `<name> --help` is always readable; skipped by loadSpec (introspection).
+    if (_checkRunAs) {
+        const rootSpec = raw.runnables[name];
+        const detail = (0, become_1.verifyRunAsIdentity)((0, become_1.resolveRunAs)(rootSpec.runAs, os.hostname()));
+        if (detail) {
+            const level = rootSpec.enforceRunAs ?? config.enforceRunAs ?? 'error';
+            if (level === 'warn') {
+                process.stderr.write(`⚠  ${name}: ${detail}. (enforce_run_as = "warn" — continuing)\n`);
+            }
+            else if (level !== 'off') {
+                throw new errors_1.RunAsMismatch((0, errors_1.formatRunAsMismatch)(name, detail));
+            }
+        }
+    }
     // Enforce require-command on the resolved leaf: if the deepest matched node
     // still requires a command and has commands, none was chosen at that level.
     // Checking the leaf (not commandPath.length) enforces at every nesting depth.
@@ -167,7 +189,9 @@ function parse(opts = {}) {
 }
 function loadSpec(opts = {}) {
     // Secret prompting is disabled — introspection must never block on a prompt.
-    return parse({ ...opts, argv: [], _enforceRequiredCommand: false, _promptSecrets: false });
+    // The run_as identity check is likewise skipped: emitting schemas and listing
+    // runnables must never depend on who is running them.
+    return parse({ ...opts, argv: [], _enforceRequiredCommand: false, _promptSecrets: false, _checkRunAs: false });
 }
 function inferFromArgv() {
     const argv1 = process.argv[1] ?? '';

package/dist/parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"parser.js","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,sBA6IC;AAED,4BAGC;AAwOD,8BAwEC;AAzdD,2CAA6B;AAC7B,uCAAyB;AACzB,iDAAyC;AACzC,qCAAsC;AACtC,qCAAmC;AACnC,2CAA6D;AAC7D,mCAAiC;AACjC,2CAA0E;AAC1E,qCAA8D;AAC9D,mDAAyE;AAczE,SAAgB,KAAK,CAAC,OAAqB,EAAE;IAC3C,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,uBAAuB,GAAG,IAAI,EAAE,cAAc,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAE5I,MAAM,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC;IACjG,MAAM,GAAG,GAAG,IAAA,gBAAO,EAAC,UAAU,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAE1B,sEAAsE;IACtE,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxD,IAAA,oCAAoB,EAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,IAAI,aAAa,EAAE,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,qBAAY,CAAC,+DAA+D,CAAC,CAAC;IACnG,IAAI,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,qBAAY,CAAC,sEAAsE,CAAC,CAAC;IAEtH,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QACpE,MAAM,IAAI,qBAAY,CAAC,gBAAgB,IAAI,+BAA+B,SAAS,gBAAgB,UAAU,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,IAAI,SAAS,GAAG,IAAA,uBAAW,EAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAEzE,6DAA6D;IAC7D,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,SAAS,GAAG;YACV,GAAG,SAAS;YACZ,IAAI,EAAE;gBACJ,GAAG,SAAS,CAAC,IAAI;gBACjB,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,KAAK;oBACf,WAAW,EAAE,8CAA8C;oBAC3D,QAAQ,EAAE,KAAK;iBAChB;aACF;SACF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,GAAG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,YAAY,GAAG,SAAS,CAAC;IAC7B,IAAI,WAAW,GAAa,EAAE,CAAC;IAE/B,8EAA8E;IAC9E,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,IAAI,EAAE,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAAE,MAAM;QAChE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,sDAAsD;IACtD,IACE,uBAAuB;QACvB,YAAY,CAAC,cAAc;QAC3B,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EACnD,CAAC;QACD,MAAM,IAAI,qBAAY,CACpB,IAAA,6BAAoB,EAAC,CAAC,IAAI,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,GAAG,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5D,YAAY,GAAG,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IACrE,YAAY,GAAG,aAAa,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAEpE,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,kDAAkD;IAClD,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACrG,IAAI,cAAc,EAAE,CAAC;QACnB,YAAY,GAAG,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACpF,CAAC;IAED,IAAA,yBAAa,EAAC,IAAA,wBAAY,EAAC,YAAY,EAAE,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,IAAA,yBAAa,EAAC,IAAA,0BAAc,EAAC,YAAY,EAAE,YAAY,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IAEvE,MAAM,aAAa,GAAG,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE1E,MAAM,QAAQ,GAAG,IAAA,6BAAiB,EAChC,YAAY,CAAC,QAAQ,IAAI,MAAM,CAAC,eAAe,EAC/C,YAAY,EACZ,YAAY,CAAC,IAAI,IAAI,EAAE,CACxB,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAEhG,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO;QAC1B,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;QAC1C,CAAC,CAAC,KAAK,CAAC;IAEV,IAAI,CAAC;QACH,IAAA,gCAAgB,EAAC;YACf,MAAM,EAAE,MAAM,CAAC,OAAO;YACtB,YAAY,EAAE,IAAI;YAClB,UAAU;YACV,KAAK;YACL,QAAQ;YACR,KAAK;YACL,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,qBAAY,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO;QACL,GAAG,aAAa;QAChB,iBAAiB,EAAE,KAAK;QACxB,kBAAkB,EAAE,IAAI;QACxB,wBAAwB,EAAE,WAAW;QACrC,oBAAoB,EAAE,QAAQ;QAC9B,kBAAkB,EAAE,UAAU;QAC9B,gBAAgB,EAAE,YAAY;QAC9B,IAAI,eAAe,KAAK,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1G,IAAI,oBAAoB,KAAK,OAAO,WAAW,CAAC,CAAC,CAAC;QAClD,IAAI,cAAc,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;KAC5C,CAAC;AAClB,CAAC;AAED,SAAgB,QAAQ,CAAC,OAAqB,EAAE;IAC9C,6EAA6E;IAC7E,OAAO,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;AAChE,CAAC;AAED,SAAS,SAAS,CAAC,IAAc,EAAE,QAAiC;IAClE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAC5B,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAC9C,CAAC;IAED,6FAA6F;IAC7F,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC;SAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;SAC7D,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEzG,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC;IAC9C,CAAC;IAED,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAEtB,sDAAsD;QACtD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,WAAW,KAAK,SAAS;gBAAE,MAAM,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACvE,MAAM;QACR,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC1D,IAAK,IAAgB,CAAC,IAAI,KAAK,UAAU;oBAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC;gBACrE,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACxD,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;YAEnC,IAAI,OAAO,KAAK,UAAU;gBAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAEtD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;gBACpB,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;gBACjC,MAAM,MAAM,GAAsB,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBACzE,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBACvD,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;gBACpB,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,eAAe,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC;YACtE,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,GAAG,KAAK,CAAC;YAChD,eAAe,EAAE,CAAC;QACpB,CAAC;QAED,CAAC,EAAE,CAAC;IACN,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB,EAAE,KAAc,EAAE,IAAa;IAClE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAE,OAAqB,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAE,OAAqB,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,6EAA6E;AAC7E,kFAAkF;AAClF,sDAAsD;AACtD,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,0BAA0B,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IAC/D,MAAM,IAAI,qBAAY,CACpB,QAAQ,IAAI,4DAA4D;QACtE,kCAAkC,OAAO,wBAAwB;QACjE,qDAAqD,CACxD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,6BAA6B;AAC7B,SAAS,eAAe,CACtB,MAA+B,EAC/B,QAAiC,EACjC,KAAc;IAEd,IAAI,KAAK,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5F,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAClE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC7B,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,IAAI,CAAC;YACH,IAAA,wBAAQ,EAAC,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,SAAS,CAAC;YACR,IAAI,CAAS,CAAC;YACd,IAAI,CAAC;gBACH,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAC7D,MAAM;YACR,CAAC;YACD,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM;YACnB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,KAAK,IAAI;gBAAE,MAAM,CAAC,KAAK;YAC5B,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS,CAAC,KAAK;YAC/B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,IAAA,wBAAQ,EAAC,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,MAA+B,EAAE,QAAiC,EAAE,YAAoB;IACxG,MAAM,cAAc,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAClE,sDAAsD;QACtD,MAAM,OAAO,GAAG,WAAW,cAAc,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;YACvB,SAAS;QACX,CAAC;QACD,sCAAsC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;gBACtB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAA+B,EAAE,QAAiC;IACvF,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACjH,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAA+B,EAAE,QAAiC;IACtF,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,cAAM,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,qBAAY,CAAC,MAAO,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,SAAS,CAAC,IAAY,EAAE,MAAkB,EAAE,cAAwB,EAAE;IACpF,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IAEvC,mFAAmF;IACnF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,OAAO;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC;SAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAE1F,qEAAqE;IACrE,MAAM,QAAQ,GAAG,CAAC,IAAyB,EAAU,EAAE,CACrD,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;IAE3E,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,UAAU,GAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;aAClD,IAAI,IAAI,CAAC,QAAQ;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;YAChE,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,cAAc,EAAE,CAAC;QAC7C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;QACjC,UAAU,CAAC,IAAI,CAAC,QAAQ,OAAO,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,UAAU,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAE/D,mBAAmB;IACnB,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5B,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,OAAO,OAAO,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;gBACxC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;iBACrC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACrG,IAAI,IAAI,CAAC,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACrC,IAAI,IAAI,CAAC,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC,CAAC;;gBAChF,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,cAAc;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,UAAU,QAAQ,mDAAmD,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,sBAiKC;AAED,4BAKC;AAwOD,8BAwEC;AAnfD,2CAA6B;AAC7B,uCAAyB;AACzB,uCAAyB;AACzB,iDAAyC;AACzC,qCAAsC;AACtC,qCAAmC;AACnC,2CAA6D;AAC7D,mCAAiC;AACjC,2CAA0E;AAC1E,qCAA6D;AAC7D,qCAAkG;AAClG,mDAAyE;AAgBzE,SAAgB,KAAK,CAAC,OAAqB,EAAE;IAC3C,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,uBAAuB,GAAG,IAAI,EAAE,cAAc,GAAG,IAAI,EAAE,WAAW,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAEhK,MAAM,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC;IACjG,MAAM,GAAG,GAAG,IAAA,gBAAO,EAAC,UAAU,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAE1B,sEAAsE;IACtE,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxD,IAAA,oCAAoB,EAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,IAAI,aAAa,EAAE,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,qBAAY,CAAC,+DAA+D,CAAC,CAAC;IACnG,IAAI,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,qBAAY,CAAC,sEAAsE,CAAC,CAAC;IAEtH,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QACpE,MAAM,IAAI,qBAAY,CAAC,gBAAgB,IAAI,+BAA+B,SAAS,gBAAgB,UAAU,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,IAAI,SAAS,GAAG,IAAA,uBAAW,EAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAEzE,6DAA6D;IAC7D,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,SAAS,GAAG;YACV,GAAG,SAAS;YACZ,IAAI,EAAE;gBACJ,GAAG,SAAS,CAAC,IAAI;gBACjB,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,KAAK;oBACf,WAAW,EAAE,8CAA8C;oBAC3D,QAAQ,EAAE,KAAK;iBAChB;aACF;SACF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,GAAG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,YAAY,GAAG,SAAS,CAAC;IAC7B,IAAI,WAAW,GAAa,EAAE,CAAC;IAE/B,8EAA8E;IAC9E,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,IAAI,EAAE,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAAE,MAAM;QAChE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,mEAAmE;IACnE,2EAA2E;IAC3E,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAA,4BAAmB,EAAC,IAAA,qBAAY,EAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAChF,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC;YACtE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,MAAM,4CAA4C,CAAC,CAAC;YAC1F,CAAC;iBAAM,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC3B,MAAM,IAAI,sBAAa,CAAC,IAAA,4BAAmB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,sDAAsD;IACtD,IACE,uBAAuB;QACvB,YAAY,CAAC,cAAc;QAC3B,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EACnD,CAAC;QACD,MAAM,IAAI,qBAAY,CACpB,IAAA,6BAAoB,EAAC,CAAC,IAAI,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,GAAG,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5D,YAAY,GAAG,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IACrE,YAAY,GAAG,aAAa,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAEpE,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,kDAAkD;IAClD,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACrG,IAAI,cAAc,EAAE,CAAC;QACnB,YAAY,GAAG,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACpF,CAAC;IAED,IAAA,yBAAa,EAAC,IAAA,wBAAY,EAAC,YAAY,EAAE,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,IAAA,yBAAa,EAAC,IAAA,0BAAc,EAAC,YAAY,EAAE,YAAY,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IAEvE,MAAM,aAAa,GAAG,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE1E,MAAM,QAAQ,GAAG,IAAA,6BAAiB,EAChC,YAAY,CAAC,QAAQ,IAAI,MAAM,CAAC,eAAe,EAC/C,YAAY,EACZ,YAAY,CAAC,IAAI,IAAI,EAAE,CACxB,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAEhG,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO;QAC1B,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;QAC1C,CAAC,CAAC,KAAK,CAAC;IAEV,IAAI,CAAC;QACH,IAAA,gCAAgB,EAAC;YACf,MAAM,EAAE,MAAM,CAAC,OAAO;YACtB,YAAY,EAAE,IAAI;YAClB,UAAU;YACV,KAAK;YACL,QAAQ;YACR,KAAK;YACL,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,qBAAY,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO;QACL,GAAG,aAAa;QAChB,iBAAiB,EAAE,KAAK;QACxB,kBAAkB,EAAE,IAAI;QACxB,wBAAwB,EAAE,WAAW;QACrC,oBAAoB,EAAE,QAAQ;QAC9B,kBAAkB,EAAE,UAAU;QAC9B,gBAAgB,EAAE,YAAY;QAC9B,IAAI,eAAe,KAAK,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1G,IAAI,oBAAoB,KAAK,OAAO,WAAW,CAAC,CAAC,CAAC;QAClD,IAAI,cAAc,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;KAC5C,CAAC;AAClB,CAAC;AAED,SAAgB,QAAQ,CAAC,OAAqB,EAAE;IAC9C,6EAA6E;IAC7E,8EAA8E;IAC9E,sDAAsD;IACtD,OAAO,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;AACjH,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;AAChE,CAAC;AAED,SAAS,SAAS,CAAC,IAAc,EAAE,QAAiC;IAClE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAC5B,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAC9C,CAAC;IAED,6FAA6F;IAC7F,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC;SAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;SAC7D,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEzG,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC;IAC9C,CAAC;IAED,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAEtB,sDAAsD;QACtD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,WAAW,KAAK,SAAS;gBAAE,MAAM,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACvE,MAAM;QACR,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC1D,IAAK,IAAgB,CAAC,IAAI,KAAK,UAAU;oBAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC;gBACrE,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACxD,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;YAEnC,IAAI,OAAO,KAAK,UAAU;gBAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAEtD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;gBACpB,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;gBACjC,MAAM,MAAM,GAAsB,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBACzE,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBACvD,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;gBACpB,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,eAAe,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC;YACtE,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,GAAG,KAAK,CAAC;YAChD,eAAe,EAAE,CAAC;QACpB,CAAC;QAED,CAAC,EAAE,CAAC;IACN,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB,EAAE,KAAc,EAAE,IAAa;IAClE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAE,OAAqB,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAE,OAAqB,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,6EAA6E;AAC7E,kFAAkF;AAClF,sDAAsD;AACtD,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,0BAA0B,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IAC/D,MAAM,IAAI,qBAAY,CACpB,QAAQ,IAAI,4DAA4D;QACtE,kCAAkC,OAAO,wBAAwB;QACjE,qDAAqD,CACxD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,6BAA6B;AAC7B,SAAS,eAAe,CACtB,MAA+B,EAC/B,QAAiC,EACjC,KAAc;IAEd,IAAI,KAAK,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5F,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAClE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC7B,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,IAAI,CAAC;YACH,IAAA,wBAAQ,EAAC,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,SAAS,CAAC;YACR,IAAI,CAAS,CAAC;YACd,IAAI,CAAC;gBACH,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAC7D,MAAM;YACR,CAAC;YACD,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM;YACnB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,KAAK,IAAI;gBAAE,MAAM,CAAC,KAAK;YAC5B,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS,CAAC,KAAK;YAC/B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,IAAA,wBAAQ,EAAC,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,MAA+B,EAAE,QAAiC,EAAE,YAAoB;IACxG,MAAM,cAAc,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAClE,sDAAsD;QACtD,MAAM,OAAO,GAAG,WAAW,cAAc,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;YACvB,SAAS;QACX,CAAC;QACD,sCAAsC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;gBACtB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAA+B,EAAE,QAAiC;IACvF,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACjH,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAA+B,EAAE,QAAiC;IACtF,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,cAAM,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,qBAAY,CAAC,MAAO,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,SAAS,CAAC,IAAY,EAAE,MAAkB,EAAE,cAAwB,EAAE;IACpF,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IAEvC,mFAAmF;IACnF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,OAAO;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC;SAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAE1F,qEAAqE;IACrE,MAAM,QAAQ,GAAG,CAAC,IAAyB,EAAU,EAAE,CACrD,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;IAE3E,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,UAAU,GAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;aAClD,IAAI,IAAI,CAAC,QAAQ;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;YAChE,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,cAAc,EAAE,CAAC;QAC7C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;QACjC,UAAU,CAAC,IAAI,CAAC,QAAQ,OAAO,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,UAAU,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAE/D,mBAAmB;IACnB,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5B,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,OAAO,OAAO,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;gBACxC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;iBACrC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACrG,IAAI,IAAI,CAAC,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACrC,IAAI,IAAI,CAAC,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC,CAAC;;gBAChF,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,cAAc;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,UAAU,QAAQ,mDAAmD,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;AAC9D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runspec-node",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "Node/TypeScript language pack for runspec",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/become.ts

@@ -0,0 +1,101 @@
+/**
+ * become.ts — run_as resolution and the enforce_run_as identity check.
+ *
+ * Mirrors the Python `runspec.become` module for the SPEC "Remote Execution"
+ * semantics. Node does not build escalation commands (no `runspec serve`
+ * sudo wrapping), so only the pieces the `enforce_run_as` gate needs are
+ * ported: resolving a `run_as` spec to a concrete username for a host, and
+ * comparing the resolved user to the current process's effective user.
+ *
+ * See spec/SPEC.md → "Remote Execution".
+ */
+
+import { execFileSync } from 'child_process';
+
+/**
+ * Resolve a `run_as` spec to a concrete username for `hostname`.
+ *
+ * Forms (see SPEC): simple string, `$ENV_VAR`, or a table with `hosts` (exact
+ * match) / `patterns` (full-match regex, first wins, insertion order) /
+ * `default`. Returns `''` for "no privilege escalation".
+ */
+export function resolveRunAs(spec: unknown, hostname: string): string {
+  if (spec === null || spec === undefined) return '';
+
+  if (typeof spec === 'string') {
+    if (spec.startsWith('$')) return process.env[spec.slice(1)] ?? '';
+    return spec;
+  }
+
+  if (typeof spec === 'object') {
+    const s = spec as Record<string, unknown>;
+
+    const hosts = (s['hosts'] as Record<string, unknown>) ?? {};
+    if (hostname in hosts) return String(hosts[hostname]);
+
+    const patterns = (s['patterns'] as Record<string, unknown>) ?? {};
+    for (const [pattern, user] of Object.entries(patterns)) {
+      try {
+        // Anchor both ends for re.fullmatch() semantics.
+        if (new RegExp(`^(?:${pattern})$`).test(hostname)) return String(user);
+      } catch {
+        // Invalid regex — skip it (serve validates patterns up front).
+      }
+    }
+
+    return String(s['default'] ?? '');
+  }
+
+  return '';
+}
+
+/**
+ * Check that the current process is running as `runAsUser`.
+ *
+ * Returns `null` when the identity matches *or* the check cannot be performed —
+ * an empty target (no escalation intended, so no identity to assert) or a
+ * platform with no POSIX uid model (Windows, where `process.geteuid` is
+ * undefined). Returns a human-readable detail string describing the mismatch
+ * otherwise.
+ *
+ * The target is resolved to a uid (a numeric string is taken as a uid directly,
+ * otherwise it is looked up with `id`) and compared to the effective uid, so
+ * account aliases that share a uid are treated as equal. An executor escalates
+ * *before* the process starts, so under one the effective user already matches
+ * and this passes silently; it only fires on the direct/import path.
+ */
+export function verifyRunAsIdentity(runAsUser: string): string | null {
+  if (!runAsUser) return null;
+
+  const geteuid = process.geteuid;
+  if (!geteuid) return null; // no POSIX uid model (Windows) — nothing to compare
+  const currentUid = geteuid.call(process);
+
+  let targetUid: number;
+  try {
+    if (/^\d+$/.test(runAsUser)) {
+      targetUid = parseInt(runAsUser, 10);
+      // Confirm the uid maps to a real account; throws if it does not.
+      execFileSync('id', ['-un', String(targetUid)], { stdio: ['ignore', 'ignore', 'ignore'] });
+    } else {
+      const out = execFileSync('id', ['-u', runAsUser], { stdio: ['ignore', 'pipe', 'ignore'] });
+      targetUid = parseInt(out.toString().trim(), 10);
+    }
+  } catch {
+    return `run_as user '${runAsUser}' does not exist on this host`;
+  }
+
+  if (currentUid === targetUid) return null;
+
+  let currentName = String(currentUid);
+  try {
+    currentName =
+      execFileSync('id', ['-un', String(currentUid)], { stdio: ['ignore', 'pipe', 'ignore'] })
+        .toString()
+        .trim() || String(currentUid);
+  } catch {
+    // Keep the numeric uid as the name.
+  }
+
+  return `the current process runs as '${currentName}' (uid ${currentUid}), not '${runAsUser}' (uid ${targetUid})`;
+}

package/src/errors.ts

@@ -11,6 +11,7 @@ export class OutOfRange extends RunSpecError {}
 export class UnknownArg extends RunSpecError {}
 export class GroupViolation extends RunSpecError {}
 export class AutonomyViolation extends RunSpecError {}
+export class RunAsMismatch extends RunSpecError {}
 
 export function formatMissingRequired(name: string, spec: Record<string, unknown>): string {
   const lines = [
@@ -136,6 +137,15 @@ export function formatGroupExactlyOne(groupName: string, args: string[], provide
   ].join('\n');
 }
 
+export function formatRunAsMismatch(runnableName: string, detail: string): string {
+  return [
+    `✗  Refusing to run '${runnableName}': ${detail}.`,
+    `   This runnable declares a run_as user it must execute as.`,
+    '   Re-run under the intended account (e.g. `sudo -u <user> ...`, `runspec serve`,',
+    '   or `runspec jump`), or relax the check with enforce_run_as = "warn" (or "off").',
+  ].join('\n');
+}
+
 export function formatDeprecated(name: string, message: string): string {
   return `⚠  --${name} is deprecated: ${message}`;
 }

package/src/index.ts

@@ -1,7 +1,7 @@
 export { parse, loadSpec } from './parser';
 export { registerType, listTypes } from './types';
 export { tsTypeOf } from './inference';
-export { RunSpecError, MissingRequiredArg, InvalidChoice, OutOfRange, UnknownArg, GroupViolation, AutonomyViolation } from './errors';
+export { RunSpecError, MissingRequiredArg, InvalidChoice, OutOfRange, UnknownArg, GroupViolation, AutonomyViolation, RunAsMismatch } from './errors';
 export { findConfig } from './finder';
 export { loadRaw } from './loader';
 export { getLogger } from './logging_setup';

package/src/loader.ts

@@ -22,6 +22,7 @@ export function loadRaw(configPath: string): RawSpec {
 function normaliseConfig(raw: Record<string, unknown>): RawConfig {
   return {
     autonomyDefault: (raw['autonomy-default'] as string | undefined) ?? 'confirm',
+    enforceRunAs: (raw['enforce_run_as'] as string | undefined) ?? 'error',
     lang: raw['lang'] as string | undefined,
     version: String(raw['version'] ?? '1'),
     logging: normaliseLogging(raw['logging'] as Record<string, unknown> | undefined),
@@ -68,6 +69,8 @@ function normaliseScript(name: string, raw: Record<string, unknown>): ScriptSpec
     autonomyReason: raw['autonomy-reason'] as string | undefined,
     output: raw['output'] as string | undefined,
     discoverable: raw['discoverable'] as boolean | string[] | undefined,
+    runAs: raw['run_as'],
+    enforceRunAs: raw['enforce_run_as'] as string | undefined,
     requireCommand: (raw['require-command'] as boolean | undefined) ?? false,
     args: normaliseArgs((raw['args'] ?? {}) as Record<string, unknown>),
     groups: normaliseGroups((raw['groups'] ?? {}) as Record<string, unknown>),

package/src/models.ts

@@ -15,6 +15,8 @@ export interface LoggingConfig {
 
 export interface RawConfig {
   autonomyDefault: string;
+  /** Default enforce_run_as for runnables that don't declare one. */
+  enforceRunAs: string;
   lang?: string;
   version: string;
   logging?: LoggingConfig;
@@ -66,6 +68,13 @@ export interface ScriptSpec {
   output?: string;
   serve?: boolean | string[];
   discoverable?: boolean | string[];
+  /** The OS user the runnable must run as. String, $ENV ref, or a per-host /
+   *  pattern table. Consumed by an executor for escalation; on the direct path
+   *  it is the identity asserted by `enforceRunAs`. */
+  runAs?: unknown;
+  /** Reaction when the process is not running as the resolved `runAs` user on
+   *  the direct/import path: 'error' (default), 'warn', or 'off'. */
+  enforceRunAs?: string;
   requireCommand?: boolean;
   args: Record<string, ArgSpec>;
   groups: Record<string, GroupSpec>;

package/src/parser.ts

@@ -1,4 +1,5 @@
 import * as path from 'path';
+import * as os from 'os';
 import * as fs from 'fs';
 import { execSync } from 'child_process';
 import { findConfig } from './finder';
@@ -6,7 +7,8 @@ import { loadRaw } from './loader';
 import { inferScript, effectiveAutonomy } from './inference';
 import { coerce } from './types';
 import { validateArgs, validateGroups, raiseIfErrors } from './validator';
-import { RunSpecError, formatMissingCommand } from './errors';
+import { resolveRunAs, verifyRunAsIdentity } from './become';
+import { RunSpecError, RunAsMismatch, formatMissingCommand, formatRunAsMismatch } from './errors';
 import { configureLogging, installExceptionHook } from './logging_setup';
 import type { ParsedArgs, ScriptSpec, ArgSpec } from './models';
 
@@ -19,10 +21,12 @@ export interface ParseOptions {
   _enforceRequiredCommand?: boolean;
   /** Internal: prompt for missing required password args. loadSpec sets false. */
   _promptSecrets?: boolean;
+  /** Internal: verify the run_as identity (enforce_run_as). loadSpec sets false. */
+  _checkRunAs?: boolean;
 }
 
 export function parse(opts: ParseOptions = {}): ParsedArgs {
-  const { scriptName, argv: argvOverride, cwd, configPath: configPathOverride, _enforceRequiredCommand = true, _promptSecrets = true } = opts;
+  const { scriptName, argv: argvOverride, cwd, configPath: configPathOverride, _enforceRequiredCommand = true, _promptSecrets = true, _checkRunAs = true } = opts;
 
   const { configPath } = configPathOverride ? { configPath: configPathOverride } : findConfig(cwd);
   const raw = loadRaw(configPath);
@@ -91,6 +95,26 @@ export function parse(opts: ParseOptions = {}): ParsedArgs {
     process.exit(0);
   }
 
+  // Verify run_as identity on the direct/import execution path. run_as is
+  // consumed by an executor (sudo escalation) *before* the process starts, so
+  // under one the effective user already matches and this passes silently; on
+  // the direct path nothing escalates, so this catches running as the wrong
+  // user. run_as/enforce_run_as are runnable-level, so they are read from the
+  // root spec (not the merged subcommand leaf). Runs after --help so
+  // `<name> --help` is always readable; skipped by loadSpec (introspection).
+  if (_checkRunAs) {
+    const rootSpec = raw.runnables[name];
+    const detail = verifyRunAsIdentity(resolveRunAs(rootSpec.runAs, os.hostname()));
+    if (detail) {
+      const level = rootSpec.enforceRunAs ?? config.enforceRunAs ?? 'error';
+      if (level === 'warn') {
+        process.stderr.write(`⚠  ${name}: ${detail}. (enforce_run_as = "warn" — continuing)\n`);
+      } else if (level !== 'off') {
+        throw new RunAsMismatch(formatRunAsMismatch(name, detail));
+      }
+    }
+  }
+
   // Enforce require-command on the resolved leaf: if the deepest matched node
   // still requires a command and has commands, none was chosen at that level.
   // Checking the leaf (not commandPath.length) enforces at every nesting depth.
@@ -166,7 +190,9 @@ export function parse(opts: ParseOptions = {}): ParsedArgs {
 
 export function loadSpec(opts: ParseOptions = {}): ParsedArgs {
   // Secret prompting is disabled — introspection must never block on a prompt.
-  return parse({ ...opts, argv: [], _enforceRequiredCommand: false, _promptSecrets: false });
+  // The run_as identity check is likewise skipped: emitting schemas and listing
+  // runnables must never depend on who is running them.
+  return parse({ ...opts, argv: [], _enforceRequiredCommand: false, _promptSecrets: false, _checkRunAs: false });
 }
 
 function inferFromArgv(): string {

package/tests/test_run_as_enforce.test.ts

@@ -0,0 +1,170 @@
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { parse, loadSpec } from '../src/parser';
+import { resolveRunAs, verifyRunAsIdentity } from '../src/become';
+
+function makeTmpConfig(toml: string): string {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'runspec-run-as-test-'));
+  const configPath = path.join(dir, 'runspec.toml');
+  fs.writeFileSync(configPath, toml);
+  return configPath;
+}
+
+// POSIX-only: the uid comparison needs process.geteuid + `id`.
+const posixIt = process.geteuid ? test : test.skip;
+
+// ── resolveRunAs ──────────────────────────────────────────────────────────────
+
+describe('resolveRunAs', () => {
+  test('null/undefined/empty → no escalation', () => {
+    expect(resolveRunAs(undefined, 'host1')).toBe('');
+    expect(resolveRunAs(null, 'host1')).toBe('');
+    expect(resolveRunAs('', 'host1')).toBe('');
+  });
+
+  test('simple string', () => {
+    expect(resolveRunAs('oracle', 'anything')).toBe('oracle');
+  });
+
+  test('$ENV reference', () => {
+    process.env['ORACLE_RUN_AS'] = 'orasvc';
+    expect(resolveRunAs('$ORACLE_RUN_AS', 'h')).toBe('orasvc');
+    delete process.env['ORACLE_RUN_AS'];
+    expect(resolveRunAs('$ORACLE_RUN_AS', 'h')).toBe('');
+  });
+
+  test('per-host exact match, then default', () => {
+    const spec = { default: 'oracle', hosts: { 'box-01': 'dba', 'box-02': '' } };
+    expect(resolveRunAs(spec, 'box-01')).toBe('dba');
+    expect(resolveRunAs(spec, 'box-02')).toBe(''); // explicit no-escalation
+    expect(resolveRunAs(spec, 'other')).toBe('oracle');
+  });
+
+  test('patterns, full-match, first wins', () => {
+    const spec = { default: 'oracle', patterns: { '[lg]pexp[0-9]*': 'orasvc', 'prod[0-9]*': 'produser' } };
+    expect(resolveRunAs(spec, 'lpexp01')).toBe('orasvc');
+    expect(resolveRunAs(spec, 'prod7')).toBe('produser');
+    expect(resolveRunAs(spec, 'lpexp')).toBe('orasvc');
+    expect(resolveRunAs(spec, 'xlpexp01')).toBe('oracle'); // not a full match
+  });
+});
+
+// ── verifyRunAsIdentity ───────────────────────────────────────────────────────
+
+describe('verifyRunAsIdentity', () => {
+  test('empty target is a no-op', () => {
+    expect(verifyRunAsIdentity('')).toBeNull();
+  });
+
+  posixIt('current uid (by number) matches', () => {
+    expect(verifyRunAsIdentity(String(process.geteuid!()))).toBeNull();
+  });
+
+  posixIt('nonexistent user is reported', () => {
+    const detail = verifyRunAsIdentity('nope-user-xyz');
+    expect(detail).toContain('does not exist');
+  });
+
+  posixIt('uid mismatch is reported', () => {
+    const realUid = process.geteuid!();
+    const spy = jest.spyOn(process, 'geteuid').mockReturnValue(999999);
+    try {
+      const detail = verifyRunAsIdentity(String(realUid));
+      expect(detail).toContain('999999');
+      expect(detail).toContain(`uid ${realUid}`);
+    } finally {
+      spy.mockRestore();
+    }
+  });
+
+  test('no POSIX uid model (Windows) is a no-op', () => {
+    const orig = process.geteuid;
+    (process as { geteuid?: () => number }).geteuid = undefined;
+    try {
+      expect(verifyRunAsIdentity('root')).toBeNull();
+    } finally {
+      (process as { geteuid?: () => number }).geteuid = orig;
+    }
+  });
+});
+
+// ── enforce_run_as wired into the parser ──────────────────────────────────────
+
+function body(opts: { enforce?: string; configEnforce?: string } = {}): string {
+  return [
+    '[config]',
+    opts.configEnforce ?? '',
+    '',
+    '[tool]',
+    'description = "x"',
+    'run_as = "nope-user-xyz"',
+    opts.enforce ?? '',
+    '',
+  ].join('\n');
+}
+
+function doParse(opts: { enforce?: string; configEnforce?: string } = {}) {
+  return parse({ scriptName: 'tool', argv: [], configPath: makeTmpConfig(body(opts)) });
+}
+
+describe('enforce_run_as gate', () => {
+  posixIt('error is the default', () => {
+    expect(() => doParse()).toThrow(/Refusing to run 'tool'/);
+  });
+
+  posixIt('explicit error throws', () => {
+    expect(() => doParse({ enforce: 'enforce_run_as = "error"' })).toThrow(/Refusing to run/);
+  });
+
+  posixIt('warn continues and writes stderr', () => {
+    const spy = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+    try {
+      const args = doParse({ enforce: 'enforce_run_as = "warn"' });
+      expect(args.__runspec_script__).toBe('tool');
+      const written = spy.mock.calls.map((c) => String(c[0])).join('');
+      expect(written).toContain('⚠');
+      expect(written).toContain('nope-user-xyz');
+    } finally {
+      spy.mockRestore();
+    }
+  });
+
+  posixIt('off is silent', () => {
+    const spy = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+    try {
+      const args = doParse({ enforce: 'enforce_run_as = "off"' });
+      expect(args.__runspec_script__).toBe('tool');
+      expect(spy.mock.calls.length).toBe(0);
+    } finally {
+      spy.mockRestore();
+    }
+  });
+
+  posixIt('config default applies when runnable omits enforce_run_as', () => {
+    const spy = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+    try {
+      doParse({ configEnforce: 'enforce_run_as = "warn"' });
+      const written = spy.mock.calls.map((c) => String(c[0])).join('');
+      expect(written).toContain('⚠');
+    } finally {
+      spy.mockRestore();
+    }
+  });
+
+  posixIt('runnable value overrides a permissive config default', () => {
+    expect(() =>
+      doParse({ enforce: 'enforce_run_as = "error"', configEnforce: 'enforce_run_as = "off"' }),
+    ).toThrow(/Refusing to run/);
+  });
+
+  test('no run_as means no check', () => {
+    const args = parse({ scriptName: 'tool', argv: [], configPath: makeTmpConfig('[tool]\ndescription = "x"\n') });
+    expect(args.__runspec_script__).toBe('tool');
+  });
+
+  posixIt('loadSpec skips the check', () => {
+    const args = loadSpec({ scriptName: 'tool', configPath: makeTmpConfig(body({ enforce: 'enforce_run_as = "error"' })) });
+    expect(args.__runspec_script__).toBe('tool');
+  });
+});