plugin-scanner 2.0.1091__tar.gz → 2.0.1093__tar.gz

{plugin_scanner-2.0.1091 → plugin_scanner-2.0.1093}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1091
+Version: 2.0.1093
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Documentation, https://github.com/hashgraph-online/hol-guard/tree/main/docs/guard

{plugin_scanner-2.0.1091 → plugin_scanner-2.0.1093}/docs/guard/architecture.md

@@ -51,3 +51,4 @@ Cisco AIBOM stays out of Guard runtime policy in this phase. If it returns later
 - [Command extension threat model](command-extension-threat-model.md)
 - [Package command extension coverage](command-package-extension-coverage.md)
 - [Infrastructure command extension coverage](command-domain-extension-coverage.md)
+- [Cloud command extension coverage](command-cloud-extension-coverage.md)

plugin_scanner-2.0.1093/docs/guard/command-cloud-extension-coverage.md

@@ -0,0 +1,23 @@
+# Cloud Command Extension Coverage
+
+Guard evaluates cloud CLI operations from the canonical parsed command model. Rules match executable and subcommand structure, remain independent of shell text examples, and feed the existing policy, approval, memory, receipt, and sync pipeline.
+
+## Extensions
+
+| Extension | Reviewed operations | Safe counterparts |
+| --- | --- | --- |
+| `command.cloud.aws` | EC2 instance termination, RDS instance or cluster deletion, EKS cluster deletion | Help, request skeleton generation, EC2 permission-only dry run, describe operations |
+| `command.cloud.gcp` | Compute Engine instance deletion, including alpha, beta, and preview tracks; Cloud SQL instance deletion, including alpha and beta tracks | Help and describe operations |
+| `command.cloud.azure` | Virtual machine deletion | Help and show operations |
+
+Global account, project, subscription, profile, region, output, and query options are normalized wherever the CLI accepts them. Reordered operation flags do not change the result. Native Windows launcher suffixes are recognized.
+
+## References
+
+- [AWS EC2 terminate-instances](https://docs.aws.amazon.com/cli/latest/reference/ec2/terminate-instances.html)
+- [AWS RDS delete-db-instance](https://docs.aws.amazon.com/cli/latest/reference/rds/delete-db-instance.html)
+- [AWS RDS delete-db-cluster](https://docs.aws.amazon.com/cli/latest/reference/rds/delete-db-cluster.html)
+- [AWS EKS delete-cluster](https://docs.aws.amazon.com/cli/latest/reference/eks/delete-cluster.html)
+- [Google Cloud compute instances delete](https://cloud.google.com/sdk/gcloud/reference/compute/instances/delete)
+- [Google Cloud SQL instances delete](https://cloud.google.com/sdk/gcloud/reference/sql/instances/delete)
+- [Azure vm delete](https://learn.microsoft.com/cli/azure/vm#az-vm-delete)

{plugin_scanner-2.0.1091 → plugin_scanner-2.0.1093}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1091"
+version = "2.0.1093"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1091 → plugin_scanner-2.0.1093}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1091"
+version = "2.0.1093"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.0.1093/src/codex_plugin_scanner/guard/runtime/command_builtin_extension_catalog.py

@@ -0,0 +1,16 @@
+"""Directly enforced built-in command extension constructor values."""
+
+from __future__ import annotations
+
+from .command_cloud_extensions import CLOUD_COMMAND_EXTENSION_SPECS, CLOUD_COMMAND_RULES
+from .command_domain_extensions import DOMAIN_COMMAND_EXTENSION_SPECS, DOMAIN_COMMAND_RULES
+from .command_extension_specs import CommandExtensionValues, command_extension_values
+
+_DIRECT_EXTENSION_CATALOGS = (
+    (DOMAIN_COMMAND_EXTENSION_SPECS, DOMAIN_COMMAND_RULES),
+    (CLOUD_COMMAND_EXTENSION_SPECS, CLOUD_COMMAND_RULES),
+)
+
+DIRECT_COMMAND_EXTENSION_VALUES: tuple[CommandExtensionValues, ...] = tuple(
+    command_extension_values(spec, rules) for specs, rules in _DIRECT_EXTENSION_CATALOGS for spec in specs
+)

{plugin_scanner-2.0.1091 → plugin_scanner-2.0.1093}/src/codex_plugin_scanner/guard/runtime/command_builtin_rules.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from .command_cloud_extensions import CLOUD_COMMAND_RULES
 from .command_domain_extensions import DOMAIN_COMMAND_RULES
 from .command_rules import (
     AnyMatcher,
@@ -36,6 +37,9 @@ COMMAND_ACTION_RISK_CLASSES: dict[str, tuple[str, ...]] = {
     "windows destructive command": ("destructive_shell",),
     "kubernetes destructive command": ("destructive_shell", "network_egress"),
     "infrastructure destructive command": ("destructive_shell", "network_egress"),
+    "aws destructive command": ("destructive_shell", "network_egress"),
+    "google cloud destructive command": ("destructive_shell", "network_egress"),
+    "azure destructive command": ("destructive_shell", "network_egress"),
 }
 _GIT_GLOBAL_OPTIONS_WITH_VALUES = frozenset(
     {"-c", "-C", "--config-env", "--exec-path", "--git-dir", "--namespace", "--super-prefix", "--work-tree"}
@@ -326,6 +330,7 @@ BUILT_IN_COMMAND_RULES = (
         ),
     ),
     *DOMAIN_COMMAND_RULES,
+    *CLOUD_COMMAND_RULES,
 )
 
 _RULES_BY_EXTENSION: dict[str, tuple[CommandSafetyRule, ...]] = {}

plugin_scanner-2.0.1093/src/codex_plugin_scanner/guard/runtime/command_cloud_extensions.py

@@ -0,0 +1,265 @@
+"""Structured rules and metadata for cloud provider command extensions."""
+
+from __future__ import annotations
+
+from .command_extension_matchers import executable_matcher, safe_flag_variant
+from .command_extension_specs import CommandExtensionSpec
+from .command_rules import AnyMatcher, CommandSafetyRule, CommandSafeVariant
+
+_AWS_GLOBAL_OPTIONS = frozenset(
+    {
+        "--ca-bundle",
+        "--cli-connect-timeout",
+        "--cli-binary-format",
+        "--cli-read-timeout",
+        "--color",
+        "--endpoint-url",
+        "--output",
+        "--profile",
+        "--query",
+        "--region",
+    }
+)
+_AWS_GLOBAL_FLAGS = frozenset(
+    {
+        "--cli-auto-prompt",
+        "--debug",
+        "--no-cli-auto-prompt",
+        "--no-cli-pager",
+        "--no-color",
+        "--no-paginate",
+        "--no-sign-request",
+        "--no-verify-ssl",
+    }
+)
+_GCLOUD_GLOBAL_OPTIONS = frozenset(
+    {
+        "--access-token-file",
+        "--account",
+        "--billing-project",
+        "--configuration",
+        "--flags-file",
+        "--format",
+        "--impersonate-service-account",
+        "--project",
+        "--trace-token",
+        "--verbosity",
+    }
+)
+_GCLOUD_GLOBAL_FLAGS = frozenset(
+    {
+        "--help",
+        "--log-http",
+        "--no-log-http",
+        "--quiet",
+        "-q",
+        "--user-output-enabled",
+        "--no-user-output-enabled",
+    }
+)
+_AZURE_GLOBAL_OPTIONS = frozenset({"--output", "-o", "--query", "--subscription"})
+_AZURE_GLOBAL_FLAGS = frozenset({"--debug", "--only-show-errors", "--verbose"})
+_AWS_RESOURCE_DELETE = AnyMatcher(
+    matchers=(
+        executable_matcher(
+            "aws",
+            "ec2",
+            "terminate-instances",
+            global_options_with_values=_AWS_GLOBAL_OPTIONS,
+            global_flags=_AWS_GLOBAL_FLAGS,
+        ),
+        executable_matcher(
+            "aws",
+            "rds",
+            "delete-db-instance",
+            global_options_with_values=_AWS_GLOBAL_OPTIONS,
+            global_flags=_AWS_GLOBAL_FLAGS,
+        ),
+        executable_matcher(
+            "aws",
+            "rds",
+            "delete-db-cluster",
+            global_options_with_values=_AWS_GLOBAL_OPTIONS,
+            global_flags=_AWS_GLOBAL_FLAGS,
+        ),
+        executable_matcher(
+            "aws",
+            "eks",
+            "delete-cluster",
+            global_options_with_values=_AWS_GLOBAL_OPTIONS,
+            global_flags=_AWS_GLOBAL_FLAGS,
+        ),
+    )
+)
+_AWS_EC2_TERMINATE = AnyMatcher(
+    matchers=(
+        executable_matcher(
+            "aws",
+            "ec2",
+            "terminate-instances",
+            global_options_with_values=_AWS_GLOBAL_OPTIONS,
+            global_flags=_AWS_GLOBAL_FLAGS,
+        ),
+    )
+)
+_GCLOUD_RESOURCE_DELETE = AnyMatcher(
+    matchers=(
+        *(
+            executable_matcher(
+                "gcloud",
+                *track,
+                *operation,
+                global_options_with_values=_GCLOUD_GLOBAL_OPTIONS,
+                global_flags=_GCLOUD_GLOBAL_FLAGS,
+            )
+            for track in ((), ("alpha",), ("beta",), ("preview",))
+            for operation in (("compute", "instances", "delete"),)
+        ),
+        *(
+            executable_matcher(
+                "gcloud",
+                *track,
+                "sql",
+                "instances",
+                "delete",
+                global_options_with_values=_GCLOUD_GLOBAL_OPTIONS,
+                global_flags=_GCLOUD_GLOBAL_FLAGS,
+            )
+            for track in ((), ("alpha",), ("beta",))
+        ),
+    )
+)
+_AZURE_RESOURCE_DELETE = AnyMatcher(
+    matchers=(
+        executable_matcher(
+            "az",
+            "vm",
+            "delete",
+            global_options_with_values=_AZURE_GLOBAL_OPTIONS,
+            global_flags=_AZURE_GLOBAL_FLAGS,
+        ),
+    )
+)
+
+
+def _cloud_delete_rule(
+    *,
+    rule_id: str,
+    title: str,
+    description: str,
+    matcher: AnyMatcher,
+    action_class: str,
+    safer_alternative: str,
+    safe_variants: tuple[CommandSafeVariant, ...],
+) -> CommandSafetyRule:
+    return CommandSafetyRule(
+        rule_id=rule_id,
+        title=title,
+        description=description,
+        severity="critical",
+        risk_classes=("destructive_shell", "network_egress"),
+        action_classes=(action_class,),
+        safer_alternatives=(safer_alternative,),
+        matcher=matcher,
+        safe_variants=safe_variants,
+    )
+
+
+CLOUD_COMMAND_RULES = (
+    _cloud_delete_rule(
+        rule_id="command.cloud.aws.resource-deletion",
+        title="AWS resource deletion",
+        description="Identifies termination or deletion of compute, database, and cluster resources through AWS CLI.",
+        matcher=_AWS_RESOURCE_DELETE,
+        action_class="AWS destructive command",
+        safer_alternative="Describe the exact resources and confirm the active account and region before deletion.",
+        safe_variants=(
+            safe_flag_variant(_AWS_RESOURCE_DELETE, variant_id="help", title="AWS command help", flag="--help"),
+            safe_flag_variant(
+                _AWS_RESOURCE_DELETE,
+                variant_id="generate-cli-skeleton",
+                title="AWS request skeleton",
+                flag="--generate-cli-skeleton",
+            ),
+            safe_flag_variant(
+                _AWS_EC2_TERMINATE,
+                variant_id="dry-run",
+                title="EC2 termination permission check",
+                flag="--dry-run",
+            ),
+        ),
+    ),
+    _cloud_delete_rule(
+        rule_id="command.cloud.gcp.resource-deletion",
+        title="Google Cloud resource deletion",
+        description="Identifies deletion of compute and database resources through Google Cloud CLI.",
+        matcher=_GCLOUD_RESOURCE_DELETE,
+        action_class="Google Cloud destructive command",
+        safer_alternative="Describe the exact resources and confirm the active project and location before deletion.",
+        safe_variants=(
+            safe_flag_variant(
+                _GCLOUD_RESOURCE_DELETE,
+                variant_id="help",
+                title="Google Cloud command help",
+                flag="--help",
+            ),
+        ),
+    ),
+    _cloud_delete_rule(
+        rule_id="command.cloud.azure.resource-deletion",
+        title="Azure resource deletion",
+        description="Identifies deletion of virtual machines through Azure CLI.",
+        matcher=_AZURE_RESOURCE_DELETE,
+        action_class="Azure destructive command",
+        safer_alternative=(
+            "Show the exact resource and confirm the active subscription and resource group before deletion."
+        ),
+        safe_variants=(
+            safe_flag_variant(
+                _AZURE_RESOURCE_DELETE,
+                variant_id="help",
+                title="Azure command help",
+                flag="--help",
+            ),
+        ),
+    ),
+)
+
+
+CLOUD_COMMAND_EXTENSION_SPECS = (
+    CommandExtensionSpec(
+        extension_id="command.cloud.aws",
+        name="AWS command protection",
+        description="Reviews AWS CLI operations that permanently delete compute, database, or cluster resources.",
+        action_classes=("AWS destructive command",),
+        risk_classes=("destructive_shell", "network_egress"),
+        safer_alternatives=("Inspect resource state, account, region, and recovery options before deletion.",),
+        reference_urls=(
+            "https://docs.aws.amazon.com/cli/latest/reference/ec2/terminate-instances.html",
+            "https://docs.aws.amazon.com/cli/latest/reference/rds/delete-db-instance.html",
+            "https://docs.aws.amazon.com/cli/latest/reference/rds/delete-db-cluster.html",
+            "https://docs.aws.amazon.com/cli/latest/reference/eks/delete-cluster.html",
+        ),
+    ),
+    CommandExtensionSpec(
+        extension_id="command.cloud.gcp",
+        name="Google Cloud command protection",
+        description="Reviews Google Cloud CLI operations that permanently delete compute or database resources.",
+        action_classes=("Google Cloud destructive command",),
+        risk_classes=("destructive_shell", "network_egress"),
+        safer_alternatives=("Inspect resource state, project, location, and recovery options before deletion.",),
+        reference_urls=(
+            "https://cloud.google.com/sdk/gcloud/reference/compute/instances/delete",
+            "https://cloud.google.com/sdk/gcloud/reference/sql/instances/delete",
+        ),
+    ),
+    CommandExtensionSpec(
+        extension_id="command.cloud.azure",
+        name="Azure command protection",
+        description="Reviews Azure CLI operations that permanently delete virtual machines.",
+        action_classes=("Azure destructive command",),
+        risk_classes=("destructive_shell", "network_egress"),
+        safer_alternatives=("Inspect resource state, subscription, resource group, and attached resources first.",),
+        reference_urls=("https://learn.microsoft.com/cli/azure/vm#az-vm-delete",),
+    ),
+)

{plugin_scanner-2.0.1091 → plugin_scanner-2.0.1093}/src/codex_plugin_scanner/guard/runtime/command_domain_extensions.py

@@ -2,9 +2,7 @@
 
 from __future__ import annotations
 
-from dataclasses import dataclass
-from typing import TypedDict
-
+from .command_extension_specs import CommandExtensionSpec
 from .command_rules import (
     AnyMatcher,
     CommandRuleSeverity,
@@ -13,34 +11,6 @@ from .command_rules import (
     ExecutableMatcher,
 )
 
-
-@dataclass(frozen=True, slots=True)
-class DomainCommandExtensionSpec:
-    """Static metadata for a directly enforced command domain."""
-
-    extension_id: str
-    name: str
-    description: str
-    action_classes: tuple[str, ...]
-    risk_classes: tuple[str, ...]
-    safer_alternatives: tuple[str, ...]
-    reference_urls: tuple[str, ...]
-
-
-class DomainCommandExtensionValues(TypedDict):
-    """Constructor values for one domain command extension."""
-
-    extension_id: str
-    version: str
-    name: str
-    description: str
-    action_classes: tuple[str, ...]
-    risk_classes: tuple[str, ...]
-    safer_alternatives: tuple[str, ...]
-    rules: tuple[CommandSafetyRule, ...]
-    reference_urls: tuple[str, ...]
-
-
 _DOCKER_GLOBAL_OPTIONS = frozenset({"--config", "--context", "--host", "-h", "--log-level"})
 _KUBECTL_GLOBAL_OPTIONS = frozenset(
     {"--as", "--as-group", "--cluster", "--context", "--kubeconfig", "--namespace", "-n", "--server", "--user"}
@@ -368,7 +338,7 @@ DOMAIN_COMMAND_RULES = (
 
 
 DOMAIN_COMMAND_EXTENSION_SPECS = (
-    DomainCommandExtensionSpec(
+    CommandExtensionSpec(
         extension_id="command.kubernetes-operations",
         name="Kubernetes operation protection",
         description="Reviews cluster operations that delete resources, evict workloads, or remove releases.",
@@ -384,7 +354,7 @@ DOMAIN_COMMAND_EXTENSION_SPECS = (
             "https://helm.sh/docs/helm/helm_uninstall/",
         ),
     ),
-    DomainCommandExtensionSpec(
+    CommandExtensionSpec(
         extension_id="command.infrastructure-as-code",
         name="Infrastructure-as-code protection",
         description="Reviews infrastructure teardown through Terraform, OpenTofu, and Pulumi.",
@@ -401,20 +371,3 @@ DOMAIN_COMMAND_EXTENSION_SPECS = (
         ),
     ),
 )
-
-
-def domain_command_extension_values(spec: DomainCommandExtensionSpec) -> DomainCommandExtensionValues:
-    """Return typed registry constructor values for one domain spec."""
-
-    rules = tuple(rule for rule in DOMAIN_COMMAND_RULES if rule.rule_id.startswith(f"{spec.extension_id}."))
-    return {
-        "extension_id": spec.extension_id,
-        "version": "1.0.0",
-        "name": spec.name,
-        "description": spec.description,
-        "action_classes": spec.action_classes,
-        "risk_classes": spec.risk_classes,
-        "safer_alternatives": spec.safer_alternatives,
-        "rules": rules,
-        "reference_urls": spec.reference_urls,
-    }

plugin_scanner-2.0.1093/src/codex_plugin_scanner/guard/runtime/command_extension_matchers.py

@@ -0,0 +1,66 @@
+"""Reusable structured matcher builders for command extensions."""
+
+from __future__ import annotations
+
+from .command_rules import AnyMatcher, CommandSafeVariant, ExecutableMatcher
+
+_EMPTY_STRING_SET: frozenset[str] = frozenset()
+
+
+def executable_matcher(
+    executable: str,
+    *subcommands: str,
+    required_flags: frozenset[str] = _EMPTY_STRING_SET,
+    global_options_with_values: frozenset[str] = _EMPTY_STRING_SET,
+    global_flags: frozenset[str] = _EMPTY_STRING_SET,
+) -> ExecutableMatcher:
+    """Build a portable executable matcher with structured global options."""
+
+    return ExecutableMatcher(
+        executables=frozenset({executable, f"{executable}.cmd", f"{executable}.exe"}),
+        subcommands=subcommands,
+        required_flags=required_flags,
+        interspersed_options_with_values=global_options_with_values,
+        interspersed_flags=global_flags,
+    )
+
+
+def with_required_flag(matcher: AnyMatcher, flag: str) -> AnyMatcher:
+    """Clone executable children while adding one required flag."""
+
+    if not all(isinstance(child, ExecutableMatcher) for child in matcher.matchers):
+        raise ValueError("Safe variants require executable matcher children")
+    return AnyMatcher(
+        matchers=tuple(
+            ExecutableMatcher(
+                executables=child.executables,
+                subcommands=child.subcommands,
+                required_flags=child.required_flags | {flag},
+                forbidden_flags=child.forbidden_flags,
+                allow_leading_options=child.allow_leading_options,
+                leading_options_with_values=child.leading_options_with_values,
+                interspersed_options_with_values=child.interspersed_options_with_values,
+                interspersed_flags=child.interspersed_flags,
+                options_with_values=child.options_with_values,
+                required_flags_in_all_arguments=True,
+            )
+            for child in matcher.matchers
+            if isinstance(child, ExecutableMatcher)
+        )
+    )
+
+
+def safe_flag_variant(
+    matcher: AnyMatcher,
+    *,
+    variant_id: str,
+    title: str,
+    flag: str,
+) -> CommandSafeVariant:
+    """Build a safe variant requiring one documented side-effect-free flag."""
+
+    return CommandSafeVariant(
+        variant_id=variant_id,
+        title=title,
+        matcher=with_required_flag(matcher, flag),
+    )

plugin_scanner-2.0.1093/src/codex_plugin_scanner/guard/runtime/command_extension_specs.py

@@ -0,0 +1,55 @@
+"""Shared metadata contracts for built-in command extension catalogs."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import TypedDict
+
+from .command_rules import CommandSafetyRule
+
+
+@dataclass(frozen=True, slots=True)
+class CommandExtensionSpec:
+    """Static metadata for a directly enforced command domain."""
+
+    extension_id: str
+    name: str
+    description: str
+    action_classes: tuple[str, ...]
+    risk_classes: tuple[str, ...]
+    safer_alternatives: tuple[str, ...]
+    reference_urls: tuple[str, ...]
+
+
+class CommandExtensionValues(TypedDict):
+    """Constructor values for one built-in command extension."""
+
+    extension_id: str
+    version: str
+    name: str
+    description: str
+    action_classes: tuple[str, ...]
+    risk_classes: tuple[str, ...]
+    safer_alternatives: tuple[str, ...]
+    rules: tuple[CommandSafetyRule, ...]
+    reference_urls: tuple[str, ...]
+
+
+def command_extension_values(
+    spec: CommandExtensionSpec,
+    rules: tuple[CommandSafetyRule, ...],
+) -> CommandExtensionValues:
+    """Return typed registry constructor values for one extension spec."""
+
+    extension_rules = tuple(rule for rule in rules if rule.rule_id.startswith(f"{spec.extension_id}."))
+    return {
+        "extension_id": spec.extension_id,
+        "version": "1.0.0",
+        "name": spec.name,
+        "description": spec.description,
+        "action_classes": spec.action_classes,
+        "risk_classes": spec.risk_classes,
+        "safer_alternatives": spec.safer_alternatives,
+        "rules": extension_rules,
+        "reference_urls": spec.reference_urls,
+    }

{plugin_scanner-2.0.1091 → plugin_scanner-2.0.1093}/src/codex_plugin_scanner/guard/runtime/command_extensions.py

@@ -7,8 +7,8 @@ from dataclasses import dataclass
 from pathlib import PurePosixPath
 from typing import Literal, final
 
+from .command_builtin_extension_catalog import DIRECT_COMMAND_EXTENSION_VALUES
 from .command_builtin_rules import COMMAND_ACTION_RISK_CLASSES, rules_for_extension
-from .command_domain_extensions import DOMAIN_COMMAND_EXTENSION_SPECS, domain_command_extension_values
 from .command_model import CanonicalCommand
 from .command_package_extensions import PACKAGE_COMMAND_EXTENSION_SPECS, PackageCommandExtensionSpec
 from .command_rules import CommandSafetyRule, MatcherEvidence, matcher_index_hints
@@ -486,7 +486,7 @@ _BUILT_IN_EXTENSIONS = (
         ),
         rules=rules_for_extension("command.shell-mutations"),
     ),
-    *(CommandSafetyExtension(**domain_command_extension_values(spec)) for spec in DOMAIN_COMMAND_EXTENSION_SPECS),
+    *(CommandSafetyExtension(**values) for values in DIRECT_COMMAND_EXTENSION_VALUES),
     *(_package_command_extension(spec) for spec in PACKAGE_COMMAND_EXTENSION_SPECS),
 )