@prestyj/cli 5.13.0 → 5.16.0

package/dist/core/verification-gate.js

@@ -1,5 +1,7 @@
-/** Follow-ups per run before the gate escalates to "state what went unverified". */
+/** Follow-ups per run. After this the gate is silent for the rest of the run. */
 export const MAX_VERIFICATION_INJECTIONS = 1;
+/** Tamper-disclosure demands per run. Same reasoning as above: one is enough. */
+export const MAX_TAMPER_INJECTIONS = 1;
 /** Words that may precede the real command without changing its shape. */
 const SHELL_WRAPPERS = new Set([
     "env",
@@ -47,6 +49,10 @@ const RUNNERS = new Set([
     "mypy",
     "pylint",
 ]);
+/** Shells whose `-c <script>` operand is itself a command to classify. */
+const SHELL_INTERPRETERS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+/** Nested `sh -c` unwraps allowed before the classifier gives up. */
+const MAX_SHELL_DEPTH = 3;
 /** A non-flag word after the runner that makes the command a verification. */
 const VERIFY_KEYWORDS = [
     "test",
@@ -76,14 +82,105 @@ function isVerifyWord(word) {
     // Exact keyword, or a script name built on one (npm run test:unit).
     return VERIFY_KEYWORDS.some((keyword) => word === keyword || word.startsWith(`${keyword}:`));
 }
+/**
+ * Split a command on shell control operators (`&&`, `||`, `;`, `|`, newline),
+ * ignoring operators inside quotes, and strip subshell/group punctuation from
+ * each piece. `cd pkg && npm test` must classify on its `npm test` half — the
+ * whole-string read saw `cd` as the runner and left the gate owed forever.
+ */
+function splitCommandSegments(command) {
+    const segments = [];
+    let current = "";
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const char = command[i];
+        if (quote) {
+            current += char;
+            if (char === "\\" && quote === '"')
+                current += command[++i] ?? "";
+            else if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            quote = char;
+            current += char;
+            continue;
+        }
+        if (char === "\\") {
+            current += char + (command[++i] ?? "");
+            continue;
+        }
+        // Bare `&` is deliberately not an operator: it would split `2>&1`.
+        const operator = ["&&", "||", ";", "|", "\n"].find((op) => command.startsWith(op, i));
+        if (operator) {
+            segments.push(current);
+            current = "";
+            i += operator.length - 1;
+            continue;
+        }
+        current += char;
+    }
+    segments.push(current);
+    return segments
+        .map((segment) => segment
+        .trim()
+        .replace(/^[({!\s]+/, "")
+        .replace(/[)}\s]+$/, ""))
+        .filter((segment) => segment.length > 0);
+}
+/** Split a segment into words, honouring quotes and dropping the quote marks. */
+function tokenize(segment) {
+    const words = [];
+    let current = "";
+    let quote = null;
+    let started = false;
+    for (let i = 0; i < segment.length; i++) {
+        const char = segment[i];
+        if (quote) {
+            if (char === "\\" && quote === '"')
+                current += segment[++i] ?? "";
+            else if (char === quote)
+                quote = null;
+            else
+                current += char;
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            quote = char;
+            started = true;
+            continue;
+        }
+        if (/\s/.test(char)) {
+            if (started || current.length > 0)
+                words.push(current);
+            current = "";
+            started = false;
+            continue;
+        }
+        if (char === "\\") {
+            current += segment[++i] ?? "";
+            continue;
+        }
+        current += char;
+    }
+    if (started || current.length > 0)
+        words.push(current);
+    return words;
+}
 /**
  * True when the command looks like a test/typecheck/lint/build invocation:
- * wrappers stripped, a known runner leading, and a verification keyword among
- * its operands. Deliberately strict — `grep test x`, `git commit -m test` and
- * `./run_tests.sh` all read as NOT verification.
+ * compound segments considered independently, wrappers stripped, a known runner
+ * leading, and a verification keyword among its operands. Deliberately strict —
+ * `grep test x`, `git commit -m test` and `./run_tests.sh` all read as NOT
+ * verification.
  */
 export function isVerificationCommand(command) {
-    const words = command.trim().split(/\s+/);
+    return splitCommandSegments(command).some((segment) => isVerificationSegment(segment, 0));
+}
+/** Classify one operator-free segment. `depth` bounds `sh -c` unwrapping. */
+function isVerificationSegment(segment, depth) {
+    const words = tokenize(segment);
     let i = 0;
     while (i < words.length) {
         const word = words[i];
@@ -99,6 +196,16 @@ export function isVerificationCommand(command) {
         break;
     }
     const runner = words[i] ?? "";
+    // `sh -c "cd pkg && npm test"` — classify the script the shell will run.
+    if (SHELL_INTERPRETERS.has(runner)) {
+        if (depth >= MAX_SHELL_DEPTH)
+            return false;
+        const flagIndex = words.indexOf("-c", i + 1);
+        const script = flagIndex === -1 ? undefined : words[flagIndex + 1];
+        if (!script)
+            return false;
+        return splitCommandSegments(script).some((inner) => isVerificationSegment(inner, depth + 1));
+    }
     if (!RUNNERS.has(runner))
         return false;
     if (isVerifyWord(runner))
@@ -114,25 +221,125 @@ const CODE_EXT_RE = /\.(?:[cm]?[jt]sx?|py|rb|go|rs|java|kt|kts|swift|c|h|cpp|cc|
 export function isCodeFilePath(filePath) {
     return CODE_EXT_RE.test(filePath);
 }
-export function buildVerificationFollowUpMessage(files) {
+/**
+ * Files that define what a check ASSERTS rather than what it tests: test files
+ * and test directories, test-runner configs, and the type/lint configs whose
+ * strictness the checks inherit. Editing one of these can turn a failing check
+ * green without touching the behaviour under test.
+ *
+ * Deliberately matched on path shape only. Both error directions are cheap: a
+ * miss leaves today's behavior, a false positive costs one disclosure sentence.
+ */
+export function isCheckOwnFile(filePath) {
+    const normalized = filePath.replace(/\\/g, "/");
+    const base = normalized.slice(normalized.lastIndexOf("/") + 1);
+    // A test/spec file, by suffix (foo.test.ts, foo_test.go, test_foo.py).
+    if (/\.(?:test|spec)\.[cm]?[jt]sx?$/.test(base))
+        return true;
+    if (/_test\.(?:go|py|rb|rs)$/.test(base) || /^test_.+\.py$/.test(base))
+        return true;
+    if (/(?:^|\.)spec\.[cm]?[jt]sx?$/.test(base))
+        return true;
+    // Anything under a tests directory.
+    if (/(?:^|\/)(?:tests?|__tests__|spec|specs|e2e|testdata|fixtures)\//.test(normalized)) {
+        return true;
+    }
+    // Test-runner and check configuration.
+    if (/^(?:vitest|jest|playwright|cypress|karma|mocha|ava|nightwatch|wdio)\.config\.[cm]?[jt]s$/.test(base)) {
+        return true;
+    }
+    if (/^(?:jest|vitest|mocha|ava|nyc|c8)\.(?:config|setup)\./.test(base))
+        return true;
+    // Type / lint configuration whose strictness the checks inherit.
+    if (/^tsconfig(?:\.[\w-]+)?\.json$/.test(base))
+        return true;
+    if (/^(?:\.eslintrc(?:\.[\w-]+)?|eslint\.config\.[cm]?[jt]s)$/.test(base))
+        return true;
+    if (/^(?:biome|\.golangci|\.rubocop|phpstan|psalm)\.(?:jsonc?|ya?ml|neon|xml|toml)$/.test(base)) {
+        return true;
+    }
+    if (/^(?:pyproject\.toml|setup\.cfg|tox\.ini|pytest\.ini|mypy\.ini|\.flake8)$/.test(base)) {
+        return true;
+    }
+    if (/^conftest\.py$/.test(base))
+        return true;
+    return false;
+}
+/**
+ * Markers that silence or skip a check rather than satisfy it. Matched only
+ * against text the model ADDED, so pre-existing suppressions in a file never
+ * trip the gate.
+ *
+ * Deliberately limited to unambiguous intent (an explicit suppression pragma, a
+ * skipped or narrowed test). Judgement calls that are ordinary in real test code
+ * — `as any`, a loosened assertion — are NOT matched: at one extra model turn
+ * per false positive, a noisy signal costs more than the rare miss.
+ */
+const SUPPRESSION_MARKERS = [
+    { re: /@ts-(?:ignore|expect-error|nocheck)\b/, what: "TypeScript error suppression" },
+    { re: /eslint-disable(?:-next-line|-line)?\b/, what: "ESLint rule suppression" },
+    { re: /#\s*type:\s*ignore\b/, what: "mypy type-ignore" },
+    { re: /#\s*noqa\b/, what: "flake8/ruff noqa" },
+    { re: /#\s*(?:pylint|mypy|ruff):\s*disable\b/, what: "Python linter suppression" },
+    { re: /#\[allow\(/, what: "Rust allow attribute" },
+    { re: /\/\/\s*nolint\b/, what: "Go nolint directive" },
+    { re: /@SuppressWarnings\b/, what: "Java warning suppression" },
+    {
+        re: /\b(?:it|test|describe|context)\s*\.\s*(?:skip|todo)\s*\(/,
+        what: "skipped test",
+    },
+    { re: /\b(?:xit|xdescribe|xtest)\s*\(/, what: "skipped test" },
+    {
+        re: /\b(?:it|test|describe|context)\s*\.\s*only\s*\(/,
+        what: "test run narrowed to .only",
+    },
+    { re: /@pytest\.mark\.(?:skip|xfail)\b/, what: "skipped pytest case" },
+    { re: /\bt\.Skip\s*\(/, what: "skipped Go test" },
+    { re: /#\[ignore\]/, what: "ignored Rust test" },
+];
+/** The `+` lines of a unified diff, with the marker stripped. */
+export function extractAddedLines(diff) {
+    return diff
+        .split("\n")
+        .filter((line) => line.startsWith("+") && !line.startsWith("+++"))
+        .map((line) => line.slice(1))
+        .join("\n");
+}
+/** Suppression/skip markers present in newly added text, de-duplicated. */
+export function detectCheckWeakening(addedText) {
+    const found = new Set();
+    for (const { re, what } of SUPPRESSION_MARKERS) {
+        if (re.test(addedText))
+            found.add(what);
+    }
+    return [...found];
+}
+export function buildTamperDisclosureMessage(suspects) {
     return {
         role: "user",
         provenance: { source: "runtime", kind: "completion_gate", visibility: "hidden" },
-        content: "Verification gate: you changed code in this run, but no test, typecheck, lint or build " +
-            "command has completed since the last edit:\n" +
-            files.map((filePath) => `- ${filePath}`).join("\n") +
-            "\nRun the project's verification now (its test command, or the closest equivalent) and " +
-            "address any failures. Do not describe the change as tested or working without having run it.",
+        content: "Verification gate: a check passed in this run, but this run also changed what the " +
+            "checks themselves assert:\n" +
+            suspects.map(({ filePath, reason }) => `- ${filePath} — ${reason}`).join("\n") +
+            "\nA check that was itself edited does not prove the code works. If these edits were " +
+            "legitimate (a new test, a test corrected against agreed behaviour, a suppression the " +
+            "user asked for), say so plainly in your final response and state why the fix stands " +
+            "without them. If instead the check was weakened, skipped, narrowed or silenced to get " +
+            "a green result, revert that now and fix the underlying code. This is the only time you " +
+            "will be asked — do not describe the change as verified without addressing this.",
     };
 }
-export function buildVerificationEscalationMessage(files) {
+export function buildVerificationFollowUpMessage(files) {
     return {
         role: "user",
         provenance: { source: "runtime", kind: "completion_gate", visibility: "hidden" },
-        content: `Verification is still outstanding after ${MAX_VERIFICATION_INJECTIONS} attempt(s); ` +
-            "the gate will not prompt again. Give your final response now and state plainly which of " +
-            "these changes went unverified and why, so the user can check them:\n" +
-            files.map((filePath) => `- ${filePath}`).join("\n"),
+        content: "Verification gate: you changed code in this run, but no test, typecheck, lint or build " +
+            "command has completed since the last edit:\n" +
+            files.map((filePath) => `- ${filePath}`).join("\n") +
+            "\nRun the project's verification now (its test command, or the closest equivalent) and " +
+            "address any failures. Do not describe the change as tested or working without having run it. " +
+            "This is the only time you will be asked: if you cannot run it, say plainly in your final " +
+            "response which of these changes went unverified and why, so the user can check them.",
     };
 }
 /**
@@ -146,11 +353,35 @@ export class VerificationGate {
     lastMutationSeq = 0;
     lastVerificationSeq = 0;
     injections = 0;
+    tamperInjections = 0;
     /** Code files mutated since the last verification — the gate's file list. */
     mutatedFiles = new Set();
-    recordMutation(filePath) {
+    /**
+     * Mutations that changed what a check asserts. Keyed by path so repeated edits
+     * to one file disclose once. Deliberately NOT cleared by recordVerification():
+     * the whole point is that the passing check cannot clear the suspicion that it
+     * was the thing edited.
+     */
+    suspects = new Map();
+    /**
+     * @param addedText Text the model ADDED in this mutation (the `+` lines of a
+     * diff, or a written file's full content). Scanned for suppression and skip
+     * markers; omit it and only the path check applies.
+     */
+    recordMutation(filePath, addedText) {
         this.lastMutationSeq = ++this.seq;
         this.mutatedFiles.add(filePath);
+        const reasons = [];
+        if (isCheckOwnFile(filePath))
+            reasons.push("edits a test or check configuration");
+        if (addedText)
+            reasons.push(...detectCheckWeakening(addedText).map((what) => `adds ${what}`));
+        if (reasons.length === 0)
+            return;
+        // Keep the fullest reason seen for this file rather than the newest.
+        const existing = this.suspects.get(filePath);
+        const merged = [...new Set([...(existing?.split("; ") ?? []), ...reasons])].join("; ");
+        this.suspects.set(filePath, merged);
     }
     recordVerification() {
         this.lastVerificationSeq = ++this.seq;
@@ -159,30 +390,57 @@ export class VerificationGate {
     isOwed() {
         return this.lastMutationSeq > this.lastVerificationSeq;
     }
+    /**
+     * True when a check passed after the run altered what the checks assert —
+     * the false-green shape. Requires a verification to have completed: with none,
+     * the standard gate already demands one, and demanding disclosure of an
+     * unproven fix on top of it is noise.
+     */
+    isTamperOwed() {
+        return this.suspects.size > 0 && this.lastVerificationSeq > 0;
+    }
+    /** Suspect mutations recorded this run, sorted for stable output. */
+    tamperSuspects() {
+        return [...this.suspects]
+            .map(([filePath, reason]) => ({ filePath, reason }))
+            .sort((a, b) => a.filePath.localeCompare(b.filePath));
+    }
+    /**
+     * Would a stop right now inject? Lets the session arm clients BEFORE the
+     * candidate final answer streams, so the draft the injection replaces is held
+     * rather than painted and then superseded.
+     */
+    willInject() {
+        return ((this.isOwed() && this.injections < MAX_VERIFICATION_INJECTIONS) ||
+            (this.isTamperOwed() && this.tamperInjections < MAX_TAMPER_INJECTIONS));
+    }
     /**
      * The blocking message for the pre-stop hook, or null when nothing is owed
-     * or the injection budget is spent. First the demand (budget 1), then one
-     * terminal escalation requiring an honest unverified statement, then silent.
+     * or the single injection is spent. Still-owed on a later stop is deliberately
+     * silent: the demand already told the model to disclose what went unverified,
+     * and one more injection only costs the user another restated final answer.
      */
     followUp() {
-        if (!this.isOwed())
-            return null;
-        if (this.injections >= MAX_VERIFICATION_INJECTIONS + 1)
-            return null;
-        this.injections += 1;
-        const files = [...this.mutatedFiles].sort();
-        return [
-            this.injections > MAX_VERIFICATION_INJECTIONS
-                ? buildVerificationEscalationMessage(files)
-                : buildVerificationFollowUpMessage(files),
-        ];
+        // "Nothing proved this" outranks "the proof may be rigged": with no check
+        // run at all there is not yet a false green to disclose.
+        if (this.isOwed() && this.injections < MAX_VERIFICATION_INJECTIONS) {
+            this.injections += 1;
+            return [buildVerificationFollowUpMessage([...this.mutatedFiles].sort())];
+        }
+        if (this.isTamperOwed() && this.tamperInjections < MAX_TAMPER_INJECTIONS) {
+            this.tamperInjections += 1;
+            return [buildTamperDisclosureMessage(this.tamperSuspects())];
+        }
+        return null;
     }
     reset() {
         this.seq = 0;
         this.lastMutationSeq = 0;
         this.lastVerificationSeq = 0;
         this.injections = 0;
+        this.tamperInjections = 0;
         this.mutatedFiles.clear();
+        this.suspects.clear();
     }
 }
 //# sourceMappingURL=verification-gate.js.map

package/dist/core/verification-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"verification-gate.js","sourceRoot":"","sources":["../../src/core/verification-gate.ts"],"names":[],"mappings":"AAkBA,oFAAoF;AACpF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C,0EAA0E;AAC1E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,KAAK;IACL,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;CACP,CAAC,CAAC;AAEH;gFACgF;AAChF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;IACtB,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,IAAI;IACJ,MAAM;IACN,QAAQ;IACR,SAAS;IACT,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,KAAK;IACL,OAAO;IACP,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,eAAe,GAAG;IACtB,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,KAAK;IACL,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,KAAK;IACL,OAAO;IACP,OAAO;IACP,SAAS;IACT,QAAQ;CACT,CAAC;AAEF,SAAS,YAAY,CAAC,IAAY;IAChC,oEAAoE;IACpE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,kEAAkE;QAClE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM;IACR,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,sCAAsC;IAC7E,OAAO,KAAK;SACT,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;SACZ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACvC,IAAI,CAAC,YAAY,CAAC,CAAC;AACxB,CAAC;AAED,kEAAkE;AAClE,MAAM,WAAW,GACf,6IAA6I,CAAC;AAEhJ,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAAwB;IACvE,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE;QAChF,OAAO,EACL,yFAAyF;YACzF,8CAA8C;YAC9C,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACnD,yFAAyF;YACzF,8FAA8F;KACjG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,KAAwB;IACzE,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE;QAChF,OAAO,EACL,2CAA2C,2BAA2B,eAAe;YACrF,0FAA0F;YAC1F,sEAAsE;YACtE,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IACnB,GAAG,GAAG,CAAC,CAAC;IACR,eAAe,GAAG,CAAC,CAAC;IACpB,mBAAmB,GAAG,CAAC,CAAC;IACxB,UAAU,GAAG,CAAC,CAAC;IACvB,6EAA6E;IACrE,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,cAAc,CAAC,QAAgB;QAC7B,IAAI,CAAC,eAAe,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QAClC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,kBAAkB;QAChB,IAAI,CAAC,mBAAmB,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QACtC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,mBAAmB,CAAC;IACzD,CAAC;IAED;;;;OAIG;IACH,QAAQ;QACN,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,IAAI,CAAC,UAAU,IAAI,2BAA2B,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,OAAO;YACL,IAAI,CAAC,UAAU,GAAG,2BAA2B;gBAC3C,CAAC,CAAC,kCAAkC,CAAC,KAAK,CAAC;gBAC3C,CAAC,CAAC,gCAAgC,CAAC,KAAK,CAAC;SAC5C,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QACb,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF"}
+{"version":3,"file":"verification-gate.js","sourceRoot":"","sources":["../../src/core/verification-gate.ts"],"names":[],"mappings":"AAmCA,iFAAiF;AACjF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C,iFAAiF;AACjF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC,0EAA0E;AAC1E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,KAAK;IACL,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;CACP,CAAC,CAAC;AAEH;gFACgF;AAChF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;IACtB,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,IAAI;IACJ,MAAM;IACN,QAAQ;IACR,SAAS;IACT,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,KAAK;IACL,OAAO;IACP,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAEzE,qEAAqE;AACrE,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,8EAA8E;AAC9E,MAAM,eAAe,GAAG;IACtB,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,KAAK;IACL,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,KAAK;IACL,OAAO;IACP,OAAO;IACP,SAAS;IACT,QAAQ;CACT,CAAC;AAEF,SAAS,YAAY,CAAC,IAAY;IAChC,oEAAoE;IACpE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC3C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QACzB,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,IAAI,IAAI,CAAC;YAChB,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;gBAAE,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;iBAC7D,IAAI,IAAI,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,IAAI,IAAI,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACvC,SAAS;QACX,CAAC;QACD,mEAAmE;QACnE,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,OAAO,IAAI,IAAI,CAAC;IAClB,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACf,OAAO;SACJ,IAAI,EAAE;SACN,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACxB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAC3B;SACA,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,iFAAiF;AACjF,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QACzB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;gBAAE,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;iBAC7D,IAAI,IAAI,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;;gBACjC,OAAO,IAAI,IAAI,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,OAAO,IAAI,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,6EAA6E;AAC7E,SAAS,qBAAqB,CAAC,OAAe,EAAE,KAAa;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,kEAAkE;QAClE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM;IACR,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,yEAAyE;IACzE,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,IAAI,KAAK,IAAI,eAAe;YAAE,OAAO,KAAK,CAAC;QAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,sCAAsC;IAC7E,OAAO,KAAK;SACT,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;SACZ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACvC,IAAI,CAAC,YAAY,CAAC,CAAC;AACxB,CAAC;AAED,kEAAkE;AAClE,MAAM,WAAW,GACf,6IAA6I,CAAC;AAEhJ,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,uEAAuE;IACvE,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,IAAI,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,oCAAoC;IACpC,IAAI,iEAAiE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,uCAAuC;IACvC,IACE,0FAA0F,CAAC,IAAI,CAC7F,IAAI,CACL,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,iEAAiE;IACjE,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvF,IAAI,gFAAgF,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,0EAA0E,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAgD;IACvE,EAAE,EAAE,EAAE,uCAAuC,EAAE,IAAI,EAAE,8BAA8B,EAAE;IACrF,EAAE,EAAE,EAAE,uCAAuC,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAChF,EAAE,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACxD,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAC9C,EAAE,EAAE,EAAE,uCAAuC,EAAE,IAAI,EAAE,2BAA2B,EAAE;IAClF,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAClD,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACtD,EAAE,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,0BAA0B,EAAE;IAC/D;QACE,EAAE,EAAE,0DAA0D;QAC9D,IAAI,EAAE,cAAc;KACrB;IACD,EAAE,EAAE,EAAE,gCAAgC,EAAE,IAAI,EAAE,cAAc,EAAE;IAC9D;QACE,EAAE,EAAE,iDAAiD;QACrD,IAAI,EAAE,4BAA4B;KACnC;IACD,EAAE,EAAE,EAAE,iCAAiC,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACtE,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACjD,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,mBAAmB,EAAE;CACjD,CAAC;AAEF,iEAAiE;AACjE,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;SACjE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC5B,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,mBAAmB,EAAE,CAAC;QAC/C,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAQD,MAAM,UAAU,4BAA4B,CAAC,QAAoC;IAC/E,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE;QAChF,OAAO,EACL,oFAAoF;YACpF,6BAA6B;YAC7B,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,KAAK,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9E,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,wFAAwF;YACxF,yFAAyF;YACzF,iFAAiF;KACpF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAAwB;IACvE,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE;QAChF,OAAO,EACL,yFAAyF;YACzF,8CAA8C;YAC9C,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACnD,yFAAyF;YACzF,+FAA+F;YAC/F,2FAA2F;YAC3F,sFAAsF;KACzF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IACnB,GAAG,GAAG,CAAC,CAAC;IACR,eAAe,GAAG,CAAC,CAAC;IACpB,mBAAmB,GAAG,CAAC,CAAC;IACxB,UAAU,GAAG,CAAC,CAAC;IACf,gBAAgB,GAAG,CAAC,CAAC;IAC7B,6EAA6E;IACrE,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC;;;;;OAKG;IACK,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7C;;;;OAIG;IACH,cAAc,CAAC,QAAgB,EAAE,SAAkB;QACjD,IAAI,CAAC,eAAe,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QAClC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEhC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,cAAc,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAClF,IAAI,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,qEAAqE;QACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,kBAAkB;QAChB,IAAI,CAAC,mBAAmB,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QACtC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,mBAAmB,CAAC;IACzD,CAAC;IAED;;;;;OAKG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,qEAAqE;IACrE,cAAc;QACZ,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;aACtB,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;aACnD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,OAAO,CACL,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,GAAG,2BAA2B,CAAC;YAChE,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,gBAAgB,GAAG,qBAAqB,CAAC,CACvE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,QAAQ;QACN,0EAA0E;QAC1E,yDAAyD;QACzD,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,GAAG,2BAA2B,EAAE,CAAC;YACnE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;YACrB,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,gBAAgB,GAAG,qBAAqB,EAAE,CAAC;YACzE,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QACb,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/core/workspace-guard.d.ts

@@ -24,6 +24,12 @@ export interface WriteGuardResult {
  * Decide whether a resolved write/edit target path is allowed.
  * Allowed by default: under `cwd`, under the OS temp dir, and under the
  * agent's own state dir (~/.ezcoder) — sessions/plans/settings must keep working.
+ *
+ * Both sides are compared AFTER symlink resolution (see {@link realResolve}):
+ * the target, so a link inside the workspace cannot point out of it, and the
+ * roots, because the OS aliases its own (macOS `/tmp` → `/private/tmp`, and
+ * `/var/folders` under it) and comparing a resolved target against an
+ * unresolved root would deny every legitimate temp-dir write.
  */
 export declare function resolveWriteGuard(cwd: string, resolvedPath: string, settings?: WriteGuardSettings): WriteGuardResult;
 /**

package/dist/core/workspace-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-guard.d.ts","sourceRoot":"","sources":["../../src/core/workspace-guard.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,kBAAkB;IACjC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAQD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,kBAAkB,GAC5B,gBAAgB,CAsBlB;AAiCD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2CjF"}
+{"version":3,"file":"workspace-guard.d.ts","sourceRoot":"","sources":["../../src/core/workspace-guard.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,kBAAkB;IACjC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA+CD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,kBAAkB,GAC5B,gBAAgB,CA0BlB;AAiCD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2CjF"}

package/dist/core/workspace-guard.js

@@ -1,3 +1,4 @@
+import { realpathSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { getAppPaths } from "../config.js";
@@ -6,30 +7,80 @@ function isWithin(root, target) {
     const relative = path.relative(root, target);
     return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
 }
+/**
+ * Resolve a path through symlinks, tolerating one that does not exist yet.
+ *
+ * `path.resolve` is pure string arithmetic: it collapses `..` but knows nothing
+ * about links, so `<repo>/link/x` stays textually "inside the repo" even when
+ * `link` points at the home directory. A repo we clone or open is untrusted
+ * content, and a committed symlink is a normal thing for it to carry — so a
+ * textual containment check hands any such repo a write primitive anywhere the
+ * user can write (`~/.ssh/authorized_keys`, `~/.zshrc`), with no prompt.
+ *
+ * Writes usually target a file that does not exist yet, so `realpathSync` on
+ * the full path would throw. Walk up to the nearest ancestor that DOES exist,
+ * resolve that, then re-attach the remaining segments: the existing part is
+ * where a planted link would have to live, and the non-existent tail cannot be
+ * pointing anywhere yet.
+ *
+ * simplification: this is a check-then-write, so a link swapped in between the
+ * two would still win (TOCTOU). Closing that needs the write itself to be
+ * link-safe (`O_NOFOLLOW`), which Node does not expose on `writeFile`. The
+ * planted-symlink case this blocks does not require the race; the racing one
+ * needs code already executing locally.
+ */
+function realResolve(target) {
+    let current = path.resolve(target);
+    const trailing = [];
+    for (;;) {
+        try {
+            return path.resolve(realpathSync(current), ...trailing);
+        }
+        catch {
+            const parent = path.dirname(current);
+            // Hit the filesystem root without finding anything that exists: there is
+            // no link on this path to resolve, so the textual form is already final.
+            if (parent === current)
+                return path.resolve(target);
+            trailing.unshift(path.basename(current));
+            current = parent;
+        }
+    }
+}
 /**
  * Decide whether a resolved write/edit target path is allowed.
  * Allowed by default: under `cwd`, under the OS temp dir, and under the
  * agent's own state dir (~/.ezcoder) — sessions/plans/settings must keep working.
+ *
+ * Both sides are compared AFTER symlink resolution (see {@link realResolve}):
+ * the target, so a link inside the workspace cannot point out of it, and the
+ * roots, because the OS aliases its own (macOS `/tmp` → `/private/tmp`, and
+ * `/var/folders` under it) and comparing a resolved target against an
+ * unresolved root would deny every legitimate temp-dir write.
  */
 export function resolveWriteGuard(cwd, resolvedPath, settings) {
     if (settings?.allowOutsideWorkspaceWrites)
         return { allowed: true };
-    const target = path.resolve(resolvedPath);
-    const extraRoots = (settings?.additionalRoots ?? []).map((root) => path.resolve(root));
+    const target = realResolve(resolvedPath);
+    const extraRoots = (settings?.additionalRoots ?? []).map((root) => realResolve(root));
     const allowedRoots = [
-        path.resolve(cwd),
+        realResolve(cwd),
         ...extraRoots,
-        path.resolve(os.tmpdir()),
-        path.resolve(getAppPaths().agentDir),
+        realResolve(os.tmpdir()),
+        realResolve(getAppPaths().agentDir),
     ];
     for (const root of allowedRoots) {
         if (isWithin(root, target))
             return { allowed: true };
     }
-    const workspaceRoots = [path.resolve(cwd), ...extraRoots].join(", ");
+    const workspaceRoots = [realResolve(cwd), ...extraRoots].join(", ");
+    // Name the redirection when there is one: "foo/link/x is outside the
+    // workspace" reads like a bug when the path visibly starts at the workspace.
+    const literal = path.resolve(resolvedPath);
+    const via = literal === target ? "" : ` (${literal} resolves there through a symlink)`;
     return {
         allowed: false,
-        reason: `Blocked: ${target} is outside the workspace (${workspaceRoots}). ` +
+        reason: `Blocked: ${target} is outside the workspace (${workspaceRoots})${via}. ` +
             "Writing outside the workspace requires user approval — ask the user to confirm, " +
             "or have them enable the allowOutsideWorkspaceWrites setting.",
     };

package/dist/core/workspace-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-guard.js","sourceRoot":"","sources":["../../src/core/workspace-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AA2B3C,2DAA2D;AAC3D,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,YAAoB,EACpB,QAA6B;IAE7B,IAAI,QAAQ,EAAE,2BAA2B;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEpE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,YAAY,GAAG;QACnB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACjB,GAAG,UAAU;QACb,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EACJ,YAAY,MAAM,8BAA8B,cAAc,KAAK;YACnE,kFAAkF;YAClF,8DAA8D;KACjE,CAAC;AACJ,CAAC;AAED,8DAA8D;AAE9D,uEAAuE;AACvE,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IACE,OAAO,CAAC,MAAM,IAAI,CAAC;QACnB,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EACrD,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;+DAC+D;AAC/D,SAAS,2BAA2B,CAAC,SAAiB,EAAE,GAAW;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChG,oDAAoD;IACpD,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,8DAA8D;IAC9D,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,GAAW;IAChE,MAAM,WAAW,GACf,2EAA2E;QAC3E,gFAAgF;QAChF,iBAAiB,CAAC;IAEpB,yCAAyC;IACzC,MAAM,OAAO,GAAG,+DAA+D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9F,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxF,MAAM,KAAK,GAAG,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,2BAA2B,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC7C,OAAO,8CAA8C,OAAO,CAAC,MAAM,CAAC,KAAK,WAAW,EAAE,CAAC;gBACzF,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,MAAM,OAAO,GAAG,oDAAoD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnF,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,2BAA2B,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC7C,OAAO,yCAAyC,OAAO,CAAC,MAAM,CAAC,KAAK,WAAW,EAAE,CAAC;YACpF,CAAC;QACH,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,IACE,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC;QAC1C,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5B,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EACpC,CAAC;QACD,OAAO,wEAAwE,WAAW,EAAE,CAAC;IAC/F,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"workspace-guard.js","sourceRoot":"","sources":["../../src/core/workspace-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AA2B3C,2DAA2D;AAC3D,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrC,yEAAyE;YACzE,yEAAyE;YACzE,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpD,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACzC,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,YAAoB,EACpB,QAA6B;IAE7B,IAAI,QAAQ,EAAE,2BAA2B;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEpE,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACtF,MAAM,YAAY,GAAG;QACnB,WAAW,CAAC,GAAG,CAAC;QAChB,GAAG,UAAU;QACb,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;QACxB,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;KACpC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,qEAAqE;IACrE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,oCAAoC,CAAC;IACvF,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EACJ,YAAY,MAAM,8BAA8B,cAAc,IAAI,GAAG,IAAI;YACzE,kFAAkF;YAClF,8DAA8D;KACjE,CAAC;AACJ,CAAC;AAED,8DAA8D;AAE9D,uEAAuE;AACvE,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IACE,OAAO,CAAC,MAAM,IAAI,CAAC;QACnB,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EACrD,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;+DAC+D;AAC/D,SAAS,2BAA2B,CAAC,SAAiB,EAAE,GAAW;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChG,oDAAoD;IACpD,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,8DAA8D;IAC9D,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,GAAW;IAChE,MAAM,WAAW,GACf,2EAA2E;QAC3E,gFAAgF;QAChF,iBAAiB,CAAC;IAEpB,yCAAyC;IACzC,MAAM,OAAO,GAAG,+DAA+D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9F,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxF,MAAM,KAAK,GAAG,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,2BAA2B,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC7C,OAAO,8CAA8C,OAAO,CAAC,MAAM,CAAC,KAAK,WAAW,EAAE,CAAC;gBACzF,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,MAAM,OAAO,GAAG,oDAAoD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnF,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,2BAA2B,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC7C,OAAO,yCAAyC,OAAO,CAAC,MAAM,CAAC,KAAK,WAAW,EAAE,CAAC;YACpF,CAAC;QACH,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,IACE,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC;QAC1C,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5B,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EACpC,CAAC;QACD,OAAO,wEAAwE,WAAW,EAAE,CAAC;IAC/F,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}