oficina-opencode 2.0.0 → 2.1.0

package/dist/core/sandbox.js

@@ -0,0 +1,546 @@
+/**
+ * Sandbox: resolución y validación de rutas.
+ *
+ * ## Por qué existe
+ *
+ * El guard de scope comparaba strings:
+ *
+ *     const relative = path.relative(projectRoot, absolute)
+ *     if (!matchesScope(relative, mayTouch)) throw ...
+ *
+ * Eso tiene tres agujeros, y los tres son reales:
+ *
+ * 1. **Symlinks.** `src/link.ts` -> `../../etc/secrets.ts`. El path relativo
+ *    es `src/link.ts`, que matchea `src/**`. El guard autoriza. La
+ *    escritura ocurre afuera. Verificar el path **después** de resolver los
+ *    symlinks es la diferencia entre "está en el scope" y "termina en el
+ *    scope".
+ *
+ * 2. **`..` con `mayTouch: ["**"]`.** `**` matcheaba cualquier string,
+ *    incluido `../../etc/passwd`. El `**` tiene que significar "todo el
+ *    proyecto", nunca "todo el filesystem".
+ *
+ * 3. **Paths absolutos.** `/etc/passwd` o `C:\Windows\...` tienen un
+ *    relativo que empieza en `..`, y con `**` pasaban.
+ *
+ * ## La regla
+ *
+ * Ninguna ruta se autoriza por comparación de strings. Se resuelve primero
+ * (absoluta → normalizada → symlinks resueltos → realpath) y recién ahí se
+ * decide. Y la decisión es **fail-closed**: ante cualquier duda, se deniega.
+ *
+ * ## Qué NO promete
+ *
+ * Un sandbox a nivel de aplicación no puede⬇️ contener un `bash` que el modelo
+ * redacta con un interpreter embebido. Eso sí se cubre, pero con otra
+ * técnica: se analiza el comando antes de ejecutarlo y se instalan
+ * *tripwires* después. Ver `analyzeShellCommand` y el modulo de deteccion.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+/* ────────────────────────────────────────────────────────────────────────────
+ * Glob a regex
+ * ──────────────────────────────────────────────────────────────────────────── */
+/**
+ * Glob mínimo a regex. Soporta `*`, `**` y `?`.
+ *
+ * El orden de los reemplazos importa: el `?` se convierte ANTES de insertar
+ * los patrones de `**`, porque el grupo insertado contiene un `?` literal
+ * que, si se convierte después, se rompe y deja de matchear.
+ */
+export function globToRegex(glob) {
+    const escaped = glob
+        .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+        // `?` primero: los patrones insertados después contienen `?` literal.
+        .replace(/\?/g, ".")
+        .replace(/\*\*\//g, "\u0000")
+        .replace(/\*\*/g, "\u0001")
+        .replace(/\*/g, "[^/]*")
+        .replace(/\u0000/g, "(?:.*/)?")
+        .replace(/\u0001/g, ".*");
+    return new RegExp(`^${escaped}$`);
+}
+/** Normaliza un glob: sin `./` inicial, sin `/` inicial, con `/` como separador. */
+export function normalizeGlob(glob) {
+    return glob.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+/, "");
+}
+/**
+ * ¿El path cae dentro de alguno de los globs?
+ *
+ * Ojo con `**`: matchea todo lo que se le pase. Por eso `checkScope` nunca
+ * llama a esta función antes de verificar la contención en el proyecto.
+ */
+export function matchesScope(relativePath, globs) {
+    const normalized = relativePath.replace(/\\/g, "/").replace(/^\.\//, "");
+    return globs.some((glob) => {
+        if (glob === "**" || glob === "***")
+            return true;
+        const g = normalizeGlob(glob);
+        if (g === "**")
+            return true;
+        return globToRegex(g).test(normalized);
+    });
+}
+/* ────────────────────────────────────────────────────────────────────────────
+ * Contención
+ * ──────────────────────────────────────────────────────────────────────────── */
+const IS_WINDOWS = process.platform === "win32";
+/** Normaliza para comparar: en Windows las rutas son case-insensitive. */
+function comparable(p) {
+    const resolved = path.resolve(p);
+    return IS_WINDOWS ? resolved.toLowerCase() : resolved;
+}
+/**
+ * ¿`target` está dentro de `root`?
+ *
+ * La comparación es sobre paths ya resueltos, y el separador final se exige
+ * explícitamente: `/proj-evil` NO está dentro de `/proj`.
+ */
+export function isInsideRoot(root, target) {
+    const r = comparable(root);
+    const t = comparable(target);
+    if (t === r)
+        return true;
+    return t.startsWith(r.endsWith(path.sep) ? r : r + path.sep);
+}
+/** Relativo con `/` como separador. */
+export function toPosix(p) {
+    return p.replace(/\\/g, "/");
+}
+/**
+ * `realpath` del ancestro existente mas profundo, con la cola re-enganchada.
+ *
+ * `fs.realpath` falla si el archivo no existe todavia. Pero un archivo nuevo
+ * en un directorio symlinkeado tiene un padre real distinto: hay que
+ * resolver el padre y re-enganchar el nombre.
+ */
+async function realpathBestEffort(target) {
+    let current = path.resolve(target);
+    const tail = [];
+    for (;;) {
+        try {
+            const real = await fs.realpath(current);
+            const resolved = tail.length > 0 ? path.join(real, ...tail) : real;
+            return { resolved, exists: tail.length === 0 };
+        }
+        catch {
+            const parent = path.dirname(current);
+            if (parent === current) {
+                // Llegamos a la raiz del sistema y no existe: devolvemos el target.
+                return { resolved: path.resolve(target), exists: false };
+            }
+            tail.unshift(path.basename(current));
+            current = parent;
+        }
+    }
+}
+/**
+ * Recorre los componentes del camino buscando symlinks.
+ *
+ * Un symlink que apunta fuera del root es un escape, se detecte o no el
+ * archivo final.
+ */
+async function findSymlinks(root, absolute) {
+    const symlinks = [];
+    let escapes = false;
+    if (!isInsideRoot(root, absolute)) {
+        return { symlinks, escapes: true };
+    }
+    const rel = path.relative(path.resolve(root), absolute);
+    const parts = rel.split(path.sep).filter((p) => p.length > 0);
+    let current = path.resolve(root);
+    for (const part of parts) {
+        current = path.join(current, part);
+        let stat;
+        try {
+            stat = await fs.lstat(current);
+        }
+        catch {
+            // El componente no existe todavia: no hay symlink que seguir.
+            continue;
+        }
+        if (!stat.isSymbolicLink())
+            continue;
+        symlinks.push(current);
+        let target;
+        try {
+            target = await fs.realpath(current);
+        }
+        catch {
+            // Symlink roto: no se puede resolver. Se trata como escapatorio
+            // conservador, porque un link roto puede apuntar a cualquier lado
+            // en cuanto exista el destino.
+            escapes = true;
+            continue;
+        }
+        if (!isInsideRoot(root, target))
+            escapes = true;
+    }
+    return { symlinks, escapes };
+}
+/**
+ * Resuelve un path contra el root, deshaciendo symlinks.
+ *
+ * Devuelve toda la información que `checkScope` necesita para decidir, y
+ * no decide: la decision vive en un solo lugar.
+ */
+export async function resolveTarget(root, rawPath) {
+    const projectRoot = path.resolve(root);
+    const absolute = path.resolve(projectRoot, rawPath);
+    const { resolved, exists } = await realpathBestEffort(absolute);
+    const { symlinks, escapes } = await findSymlinks(projectRoot, absolute);
+    const insideLexically = isInsideRoot(projectRoot, absolute);
+    const insidePhysically = insideLexically && !escapes && isInsideRoot(projectRoot, resolved);
+    return {
+        absolute,
+        resolved,
+        relative: toPosix(path.relative(projectRoot, resolved)),
+        lexicalRelative: toPosix(path.relative(projectRoot, absolute)),
+        symlinks,
+        exists,
+        insideLexically,
+        insidePhysically,
+    };
+}
+/* ────────────────────────────────────────────────────────────────────────────
+ * Archivos sensibles
+ * ──────────────────────────────────────────────────────────────────────────── */
+/**
+ * Archivos que NUNCA se pueden escribir, pase lo que pase.
+ *
+ * No son negociables por el scope de la card: un `mayTouch: ["**"]` no
+ * habilita a tocar el `.npmrc` de alguien ni una clave privada.
+ */
+export const SENSITIVE_PATTERNS = [
+    "**/.env",
+    "**/.env.*",
+    "**/.npmrc",
+    "**/.netrc",
+    "**/.git/**",
+    "**/.git-credentials",
+    "**/.htpasswd",
+    "**/*.pem",
+    "**/*.key",
+    "**/*.p12",
+    "**/*.pfx",
+    "**/*.crt",
+    "**/id_rsa*",
+    "**/id_ed25519*",
+    "**/id_ecdsa*",
+    "**/.ssh/**",
+    "**/.aws/**",
+    "**/.gnupg/**",
+    "**/.config/gcloud/**",
+    "**/.kube/**",
+    "**/credentials.json",
+    "**/service-account*.json",
+    "**/.docker/config.json",
+    "**/.opencode/opencode.json",
+];
+/**
+ * Excepciones: archivos que matchean un patrón sensible pero son inocuos.
+ *
+ * `.env.example` es un template sin secretos; bloquearlo obliga a los
+ * agentes a hacer un rodeo por el `.env` real.
+ */
+export const SENSITIVE_EXCEPTIONS = [
+    "**/.env.example",
+    "**/.env.sample",
+    "**/.env.template",
+    "**/*.key.example",
+    "**/credentials.example.json",
+];
+/** ¿El path relativo cae en un patrón sensible y no es una excepción? */
+export function isSensitive(relativePath) {
+    const normalized = normalizeGlob(relativePath);
+    if (SENSITIVE_EXCEPTIONS.some((ex) => matchesScope(normalized, [ex])))
+        return false;
+    return SENSITIVE_PATTERNS.some((pattern) => matchesScope(normalized, [pattern]));
+}
+/**
+ * Rutas que la propia oficina usa como canal de entrega.
+ *
+ * El agente tiene que poder escribir `handoff.md`, `evidence.md`,
+ * `review.md` y `gates.md`: son la evidencia de su trabajo. El scope de la
+ * card es `src/**`, asi que sin esta excepcion el agente no podria
+ * entregar nunca.
+ *
+ * OJO: solo los directorios de entrega. `state.json`, `roster.json`, el bus
+ * y los leases son del motor — que un agente pueda escribir ahi seria
+ * falsear la verdad de la corrida.
+ */
+export const OFFICE_WRITABLE = [
+    ".oficina/artifacts/**",
+    ".oficina/fichas/**",
+];
+/**
+ * Decide si un path puede escribirse.
+ *
+ * El orden de las comprobaciones es intencionado: primero lo que invalida
+ * la ruta, después lo que la vuelve peligrosa, y recién al final si entra
+ * en el scope permitido. Así el error que recibe el modelo dice la verdad
+ * mas específica posible.
+ */
+export async function checkScope(root, rawPath, policy, options = {}) {
+    const projectRoot = path.resolve(root);
+    if (typeof rawPath !== "string" || rawPath.length === 0) {
+        return deny("invalid", "Ruta vacía.", projectRoot, "");
+    }
+    if (rawPath.includes("\0")) {
+        return deny("invalid", "La ruta contiene un byte NUL.", projectRoot, "");
+    }
+    const target = await resolveTarget(projectRoot, rawPath);
+    // 1. Fuera del proyecto (por `..` o por path absoluto).
+    if (!target.insideLexically) {
+        return {
+            ...deny("outside-project", `\`${rawPath}\` resuelve fuera del proyecto (\`${target.absolute}\`). ` +
+                `La oficina solo escribe dentro de \`${projectRoot}\`.`, projectRoot, target.relative),
+            resolved: target.resolved,
+            symlinks: target.symlinks,
+        };
+    }
+    // 2. Escape por symlink: el path lexical esta adentro, el real no.
+    if (!target.insidePhysically) {
+        const detalle = target.symlinks.length > 0
+            ? `El camino atraviesa el symlink \`${toPosix(target.symlinks[0])}\` que apunta afuera del proyecto.`
+            : "El camino resuelve a una ubicación fuera del proyecto.";
+        return {
+            ...deny("symlink-escape", `\`${rawPath}\` escapa del proyecto por symlink. ${detalle} ` +
+                `Resuelve a \`${target.resolved}\`, que está fuera de \`${projectRoot}\`.`, projectRoot, target.relative),
+            resolved: target.resolved,
+            symlinks: target.symlinks,
+        };
+    }
+    // 3. Archivos sensibles: no se pueden habilitar con el scope.
+    if (!options.ignoreSensitive && isSensitive(target.relative)) {
+        return {
+            ...deny("sensitive", `\`${target.relative}\` es un archivo sensible (credenciales, claves o configuración de git). ` +
+                `La oficina nunca escribe esos archivos, pase lo que pase el scope. ` +
+                `Si de verdad hace falta, pedile al usuario que lo haga él.`, projectRoot, target.relative),
+            resolved: target.resolved,
+            symlinks: target.symlinks,
+        };
+    }
+    // 4. Forbidden de la card.
+    if (matchesScope(target.relative, policy.forbidden)) {
+        return {
+            ...deny("forbidden", `\`${target.relative}\` está en el scope forbidden de la card. ` +
+                `Forbidden: ${policy.forbidden.join(", ")}. No lo toques. ` +
+                `Si realmente hace falta, pedí que se amplíe el scope.`, projectRoot, target.relative),
+            resolved: target.resolved,
+            symlinks: target.symlinks,
+        };
+    }
+    // 5. Canal de entrega de la oficina: siempre escribible.
+    const officeWritable = options.officeWritable ?? OFFICE_WRITABLE;
+    if (matchesScope(target.relative, [...officeWritable])) {
+        return {
+            allowed: true,
+            kind: "allowed",
+            reason: "ok",
+            resolved: target.resolved,
+            relative: target.relative,
+            symlinks: target.symlinks,
+        };
+    }
+    // 6. mayTouch.
+    if (!matchesScope(target.relative, policy.mayTouch)) {
+        return {
+            ...deny("out-of-scope", `\`${target.relative}\` está fuera del scope de la card. ` +
+                `Podés tocar: ${policy.mayTouch.join(", ")}. ` +
+                `Si el archivo es necesario, pedí por el bus que se amplíe el scope, ` +
+                `o pedí ayuda a un peer que lo cubra.`, projectRoot, target.relative),
+            resolved: target.resolved,
+            symlinks: target.symlinks,
+        };
+    }
+    return {
+        allowed: true,
+        kind: "allowed",
+        reason: "ok",
+        resolved: target.resolved,
+        relative: target.relative,
+        symlinks: target.symlinks,
+    };
+}
+function deny(kind, reason, _root, relative) {
+    return {
+        allowed: false,
+        kind,
+        reason,
+        resolved: "",
+        relative,
+        symlinks: [],
+    };
+}
+/** Quita comillas y comillas invertidas de un token de shell. */
+function unquote(token) {
+    const t = token.trim();
+    if ((t.startsWith('"') && t.endsWith('"') && t.length >= 2) ||
+        (t.startsWith("'") && t.endsWith("'") && t.length >= 2)) {
+        return t.slice(1, -1);
+    }
+    return t;
+}
+/** El ultimo token no-vacio de una lista de argumentos. */
+function lastToken(args) {
+    const list = Array.isArray(args) ? args : args.split(/\s+/);
+    for (let i = list.length - 1; i >= 0; i -= 1) {
+        const t = (list[i] ?? "").trim();
+        if (!t)
+            continue;
+        if (t.startsWith("-"))
+            continue;
+        return unquote(t);
+    }
+    return undefined;
+}
+/** Todos los tokens no-opcion de una lista de argumentos. */
+function plainTokens(args) {
+    const list = Array.isArray(args) ? args : args.split(/\s+/);
+    return list
+        .filter((t) => t.trim().length > 0 && !t.trim().startsWith("-"))
+        .map(unquote);
+}
+/**
+ * Extrae los paths que un comando de shell puede escribir.
+ *
+ * ## Por qué no es un parser de shell
+ *
+ * Un parser completo de shell (con here-docs, substituciones, funciones,
+ * `eval`, interpreters embebidos) es un proyecto entero y sigue siendo
+ * evadible. Lo que hace falta aca es otra cosa: **no dejar pasar en
+ * silencio** una escritura que no entendimos.
+ *
+ * Por eso la funcion devuelve tambien los targets `uncertain`: cuando
+ * vemos una escritura pero no sabemos a donde apunta, el comando no se
+ * autoriza a ciegas — se deja pasar con el tripwire armed, y el
+ * tripwire es el que detecta la escribir fuera del scope despues.
+ */
+export function analyzeShellCommand(command) {
+    const out = [];
+    if (typeof command !== "string" || command.trim().length === 0)
+        return out;
+    const add = (target, op, uncertain = false) => {
+        if (target === undefined) {
+            out.push({ target: "", op, uncertain: true });
+            return;
+        }
+        const clean = unquote(target).trim();
+        if (!clean || clean === "-" || clean === "&1")
+            return;
+        out.push({ target: clean, op, uncertain: false });
+    };
+    // Redirecciones: > >> 2> &> |>
+    const redirect = /(?:^|[^0-9>|&])(?:\d*>>?|&>>?|\|>)\s*("[^"]*"|'[^']*'|[^\s;|&>]+)/g;
+    for (const m of command.matchAll(redirect)) {
+        add(m[1], "redirect");
+    }
+    // tee
+    for (const m of command.matchAll(/\btee\b((?:\s+-{1,2}\S+)*)\s+("[^"]*"|'[^']*'|[^\s;|&]+)/g)) {
+        add(m[2], "tee");
+    }
+    // cp / mv / install -> destino = ultimo argumento
+    for (const m of command.matchAll(/\b(cp|mv|install)\s+((?:[^\s;|&]|\s)+?)(?:\s*[;|&]|$)/g)) {
+        const args = plainTokens(m[2] ?? "");
+        if (args.length === 0) {
+            add(undefined, m[1] ?? "cp", true);
+            continue;
+        }
+        // `cp -r a b c` -> el destino es `c`; `cp a b` -> `b`.
+        const dest = args.length >= 2 ? args[args.length - 1] : args[0];
+        add(dest, m[1] ?? "cp");
+    }
+    // rm -> todos los argumentos son blancos
+    for (const m of command.matchAll(/\brm\s+((?:[^\s;|&]|\s)+?)(?:\s*[;|&]|$)/g)) {
+        const args = plainTokens(m[1] ?? "");
+        if (args.length === 0)
+            add(undefined, "rm", true);
+        else
+            for (const a of args)
+                add(a, "rm");
+    }
+    // mkdir / touch / truncate / mktemp
+    for (const m of command.matchAll(/\b(mkdir|touch|truncate)\s+((?:[^\s;|&]|\s)+?)(?:\s*[;|&]|$)/g)) {
+        const args = plainTokens(m[2] ?? "");
+        if (args.length === 0)
+            add(undefined, m[1] ?? "mkdir", true);
+        else
+            for (const a of args)
+                add(a, m[1] ?? "mkdir");
+    }
+    // sed -i
+    for (const m of command.matchAll(/\bsed\s+((?:[^\s;|&]|\s)+?)(?:\s*[;|&]|$)/g)) {
+        const raw = m[1] ?? "";
+        if (!/(^|\s)-[a-zA-Z]*i/.test(raw))
+            continue;
+        const args = plainTokens(raw.replace(/(^|\s)-[a-zA-Z]*i(\S*)/, " "));
+        const target = lastToken(args);
+        add(target, "sed -i");
+    }
+    // dd of=
+    for (const m of command.matchAll(/\bdd\b[^\n;|&]*?\bof=("[^"]*"|'[^']*'|\S+)/g)) {
+        add(m[1], "dd");
+    }
+    // curl -o / wget -O
+    for (const m of command.matchAll(/\b(curl|wget)\b[^\n;|&]*?\s-[oO]\s*("[^"]*"|'[^']*'|\S+)/g)) {
+        add(m[2], m[1] ?? "curl");
+    }
+    // git checkout / restore / clean
+    for (const m of command.matchAll(/\bgit\s+(?:checkout|restore|clean)\b([^\n;|&]*)/g)) {
+        const rest = (m[1] ?? "").trim();
+        const afterDash = /--\s+(.+)$/.exec(rest);
+        if (afterDash) {
+            for (const p of plainTokens(afterDash[1] ?? ""))
+                add(p, "git");
+            continue;
+        }
+        const args = plainTokens(rest);
+        if (args.length === 0) {
+            add(undefined, "git", true);
+            continue;
+        }
+        for (const p of args)
+            add(p, "git");
+    }
+    // chmod / chown
+    for (const m of command.matchAll(/\b(chmod|chown)\s+((?:[^\s;|&]|\s)+?)(?:\s*[;|&]|$)/g)) {
+        const target = lastToken(plainTokens(m[2] ?? ""));
+        add(target, m[1] ?? "chmod");
+    }
+    // Interpreters embebidos: python -c / node -e / ruby -e / perl -e.
+    // OJO: el flag es `-c` en python y `-e` en node/ruby/perl. Un regex con
+    // `-e?` matcheaba el guion suelto y nunca llegaba al codigo.
+    const INTERPRETER = /\b(python3?|node|ruby|perl)\b\s+(?:-[ec]\s+|--eval\s+)?("[^"]*"|'[^']*')/g;
+    for (const m of command.matchAll(INTERPRETER)) {
+        const code = unquote(m[2] ?? "");
+        const literales = [...code.matchAll(/["']([^"']{2,})["']/g)].map((x) => x[1] ?? "");
+        const paths = literales.filter((s) => s.includes("/") || /\.[A-Za-z0-9]{1,6}$/.test(s));
+        if (paths.length === 0) {
+            add(undefined, `${m[1] ?? "python"} -c`, true);
+            continue;
+        }
+        for (const p of paths)
+            add(p, `${m[1] ?? "python"} -c`);
+    }
+    // Heredoc a un interpreter: el codigo entra por stdin, no se puede ver.
+    for (const m of command.matchAll(/\b(python3?|node|ruby|perl)\b\s*<<-?\s*['"]?\w+['"]?/g)) {
+        add(undefined, `${m[1] ?? "python"} heredoc`, true);
+    }
+    // Escrituras que no sabemos interpretar: el verbo esta pero no el target.
+    if (/\b(python3?|node|ruby|perl)\b\s+(?:-[ec]\s+|--eval\s+|<<)/.test(command)) {
+        const yaCubierto = out.some((c) => c.op.includes("-c") || c.op.includes("heredoc"));
+        if (!yaCubierto)
+            out.push({ target: "", op: "interpreter", uncertain: true });
+    }
+    // Deduplicar por (op, target).
+    const seen = new Set();
+    return out.filter((c) => {
+        const key = `${c.op}::${c.target}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/core/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/core/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B;;kFAEkF;AAElF;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,OAAO,GAAG,IAAI;SACjB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,sEAAsE;SACrE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC;SAC5B,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC;SAC1B,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC;SAC9B,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC3B,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAA;AACnC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB,EAAE,KAAe;IAChE,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACxE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACzB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAA;QAChD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC3B,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;kFAEkF;AAElF,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAE/C,0EAA0E;AAC1E,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAChC,OAAO,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc;IACvD,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC1B,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5B,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;AAC9D,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AAC9B,CAAC;AAyBD;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAAC,MAAc;IAC9C,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAClC,MAAM,IAAI,GAAa,EAAE,CAAA;IAEzB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACpC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,oEAAoE;gBACpE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;YAC1D,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;YACpC,OAAO,GAAG,MAAM,CAAA;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,QAAgB;IAEhB,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,IAAI,OAAO,GAAG,KAAK,CAAA;IAEnB,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACpC,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAA;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAE7D,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAClC,IAAI,IAA0C,CAAA;QAC9C,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;YAC9D,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;YAAE,SAAQ;QAEpC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACtB,IAAI,MAAc,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;YAChE,kEAAkE;YAClE,+BAA+B;YAC/B,OAAO,GAAG,IAAI,CAAA;YACd,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,OAAO,GAAG,IAAI,CAAA;IACjD,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAEnD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAC/D,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAEvE,MAAM,eAAe,GAAG,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAC3D,MAAM,gBAAgB,GAAG,eAAe,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAE3F,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACvD,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9D,QAAQ;QACR,MAAM;QACN,eAAe;QACf,gBAAgB;KACjB,CAAA;AACH,CAAC;AAED;;kFAEkF;AAElF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,SAAS;IACT,WAAW;IACX,WAAW;IACX,WAAW;IACX,YAAY;IACZ,qBAAqB;IACrB,cAAc;IACd,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,sBAAsB;IACtB,aAAa;IACb,qBAAqB;IACrB,0BAA0B;IAC1B,wBAAwB;IACxB,4BAA4B;CAC7B,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,kBAAkB;IAClB,6BAA6B;CAC9B,CAAA;AAED,yEAAyE;AACzE,MAAM,UAAU,WAAW,CAAC,YAAoB;IAC9C,MAAM,UAAU,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;IAC9C,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACnF,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AAClF,CAAC;AAiCD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,uBAAuB;IACvB,oBAAoB;CACrB,CAAA;AASD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,OAAe,EACf,MAAmB,EACnB,UAA6B,EAAE;IAE/B,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAEtC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,SAAS,EAAE,+BAA+B,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAExD,wDAAwD;IACxD,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QAC5B,OAAO;YACL,GAAG,IAAI,CACL,iBAAiB,EACjB,KAAK,OAAO,qCAAqC,MAAM,CAAC,QAAQ,OAAO;gBACrE,uCAAuC,WAAW,KAAK,EACzD,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB;YACD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAA;IACH,CAAC;IAED,mEAAmE;IACnE,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7B,MAAM,OAAO,GACX,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACxB,CAAC,CAAC,oCAAoC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,oCAAoC;YACtG,CAAC,CAAC,wDAAwD,CAAA;QAC9D,OAAO;YACL,GAAG,IAAI,CACL,gBAAgB,EAChB,KAAK,OAAO,uCAAuC,OAAO,GAAG;gBAC3D,gBAAgB,MAAM,CAAC,QAAQ,2BAA2B,WAAW,KAAK,EAC5E,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB;YACD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAA;IACH,CAAC;IAED,8DAA8D;IAC9D,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO;YACL,GAAG,IAAI,CACL,WAAW,EACX,KAAK,MAAM,CAAC,QAAQ,2EAA2E;gBAC7F,qEAAqE;gBACrE,4DAA4D,EAC9D,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB;YACD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAA;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,GAAG,IAAI,CACL,WAAW,EACX,KAAK,MAAM,CAAC,QAAQ,4CAA4C;gBAC9D,cAAc,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB;gBAC3D,uDAAuD,EACzD,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB;YACD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAA;IACH,CAAC;IAED,yDAAyD;IACzD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,eAAe,CAAA;IAChE,IAAI,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAA;IACH,CAAC;IAED,eAAe;IACf,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,GAAG,IAAI,CACL,cAAc,EACd,KAAK,MAAM,CAAC,QAAQ,sCAAsC;gBACxD,gBAAgB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC9C,sEAAsE;gBACtE,sCAAsC,EACxC,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB;YACD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAA;AACH,CAAC;AAED,SAAS,IAAI,CACX,IAAsB,EACtB,MAAc,EACd,KAAa,EACb,QAAgB;IAEhB,OAAO;QACL,OAAO,EAAE,KAAK;QACd,IAAI;QACJ,MAAM;QACN,QAAQ,EAAE,EAAE;QACZ,QAAQ;QACR,QAAQ,EAAE,EAAE;KACb,CAAA;AACH,CAAC;AAmBD,iEAAiE;AACjE,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IACtB,IACE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EACvD,CAAC;QACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,2DAA2D;AAC3D,SAAS,SAAS,CAAC,IAAuB;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC3D,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAChC,IAAI,CAAC,CAAC;YAAE,SAAQ;QAChB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC/B,OAAO,OAAO,CAAC,CAAC,CAAC,CAAA;IACnB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,6DAA6D;AAC7D,SAAS,WAAW,CAAC,IAAuB;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC3D,OAAO,IAAI;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAC/D,GAAG,CAAC,OAAO,CAAC,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,GAAG,GAAqB,EAAE,CAAA;IAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAA;IAE1E,MAAM,GAAG,GAAG,CAAC,MAA0B,EAAE,EAAU,EAAE,SAAS,GAAG,KAAK,EAAE,EAAE;QACxE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7C,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;QACpC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI;YAAE,OAAM;QACrD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;IACnD,CAAC,CAAA;IAED,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,oEAAoE,CAAA;IACrF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IACvB,CAAC;IAED,MAAM;IACN,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,2DAA2D,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAClB,CAAC;IAED,kDAAkD;IAClD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,wDAAwD,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC,CAAA;YAClC,SAAQ;QACV,CAAC;QACD,uDAAuD;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/D,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAA;IACzB,CAAC;IAED,yCAAyC;IACzC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,2CAA2C,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;;YAC5C,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACzC,CAAC;IAED,oCAAoC;IACpC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,+DAA+D,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,IAAI,CAAC,CAAA;;YACvD,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAA;IACpD,CAAC;IAED,SAAS;IACT,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,4CAA4C,CAAC,EAAE,CAAC;QAC/E,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACtB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,CAAA;QACpE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAC9B,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvB,CAAC;IAED,SAAS;IACT,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,6CAA6C,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACjB,CAAC;IAED,oBAAoB;IACpB,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,2DAA2D,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAA;IAC3B,CAAC;IAED,iCAAiC;IACjC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,kDAAkD,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAChC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;YAC9D,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;YAC3B,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IAED,gBAAgB;IAChB,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,sDAAsD,CAAC,EAAE,CAAC;QACzF,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QACjD,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAA;IAC9B,CAAC;IAED,mEAAmE;IACnE,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,WAAW,GAAG,2EAA2E,CAAA;IAC/F,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAChC,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACnF,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACvF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAA;YAC9C,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAA;IACzD,CAAC;IAED,wEAAwE;IACxE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,uDAAuD,CAAC,EAAE,CAAC;QAC1F,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,UAAU,EAAE,IAAI,CAAC,CAAA;IACrD,CAAC;IAED,0EAA0E;IAC1E,IAAI,2DAA2D,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;QACnF,IAAI,CAAC,UAAU;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED,+BAA+B;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,CAAA;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/core/state.d.ts

@@ -40,6 +40,13 @@ export interface InvariantContext {
     limits: Limits;
     /** Veredicto de los gates de la card, si se corrieron. */
     gatesPassed?: boolean;
+    /**
+     * Veredicto de la verificación por requisitos.
+     *
+     * `undefined` significa "no se evaluó" (por ejemplo, en un flujo que no
+     * toca el cierre). `false` significa "se evaluó y le faltan requisitos".
+     */
+    evidenceComplete?: boolean;
 }
 /**
  * Verifica los invariantes duros.

package/dist/core/state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/core/state.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACzE,OAAO,EAAkB,KAAK,MAAM,EAAE,MAAM,YAAY,CAAA;AAGxD,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,SAAS,EAAE,CAWpE,CAAA;AAED,sCAAsC;AACtC,eAAO,MAAM,oBAAoB,EAAE,SAAS,SAAS,EAAa,CAAA;AAElE,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB,EAAE,SAAS,SAAS,EAA6B,CAAA;AAElF,qBAAa,sBAAuB,SAAQ,KAAK;IAE7C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM;gBAFV,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM;CAKtB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAE9C,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM;CAK1B;AAED,qCAAqC;AACrC,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,SAAS,EACb,KAAK,GAAE,OAAO,CAAC,IAAI,CAAM,GACxB,IAAI,CAUN;AAMD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,KAAK,EAAE,WAAW,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI,CA8D5D;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAuB,GAAG,WAAW,GAAG,SAAS,CAiFnG;AAED,8BAA8B;AAC9B,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,MAAuB,GAAG,WAAW,CA0BxG;AAED,kCAAkC;AAClC,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,SAAS,EAAE,CAQnE,CAAA;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAExE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,GAAG,IAAI,CAMrE;AAMD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,CA2CjE;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAGzD;AAED,oCAAoC;AACpC,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,EAAE,CAExD"}
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/core/state.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACzE,OAAO,EAAkB,KAAK,MAAM,EAAE,MAAM,YAAY,CAAA;AAGxD,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,SAAS,EAAE,CAWpE,CAAA;AAED,sCAAsC;AACtC,eAAO,MAAM,oBAAoB,EAAE,SAAS,SAAS,EAAa,CAAA;AAElE,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB,EAAE,SAAS,SAAS,EAA6B,CAAA;AAElF,qBAAa,sBAAuB,SAAQ,KAAK;IAE7C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM;gBAFV,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM;CAKtB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAE9C,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM;CAK1B;AAED,qCAAqC;AACrC,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,SAAS,EACb,KAAK,GAAE,OAAO,CAAC,IAAI,CAAM,GACxB,IAAI,CAUN;AAMD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,KAAK,EAAE,WAAW,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI,CA8E5D;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAuB,GAAG,WAAW,GAAG,SAAS,CAkFnG;AAED,8BAA8B;AAC9B,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,MAAuB,GAAG,WAAW,CA2BxG;AAED,kCAAkC;AAClC,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,SAAS,EAAE,CAQnE,CAAA;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAExE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,GAAG,IAAI,CAMrE;AAMD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,CA2CjE;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAGzD;AAED,oCAAoC;AACpC,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,EAAE,CAExD"}

package/dist/core/state.js

@@ -77,7 +77,7 @@ export function transitionCard(state, cardId, to, patch = {}) {
  * y "el modelo no puede romperlo".
  */
 export function assertInvariants(ctx) {
-    const { card, state, limits, gatesPassed } = ctx;
+    const { card, state, limits, gatesPassed, evidenceComplete } = ctx;
     if (card) {
         // Invariante duro: el revisor nunca es el owner.
         if (limits.reviewerNeqOwner && card.owner && card.reviewer && card.owner === card.reviewer) {
@@ -89,6 +89,18 @@ export function assertInvariants(ctx) {
                 throw new InvariantViolationError("gate-required-before-done", `${card.id}: marcada DONE sin gates en PASS`);
             }
         }
+        // Invariante duro: sin evidencia de los requisitos obligatorios no hay
+        // DONE.
+        //
+        // Los gates dicen que el codigo esta sano. No dicen que el objetivo del
+        // usuario este cumplido. Un proyecto puede compilar, pasar todos sus
+        // tests y tener la autenticacion mal porque ningun test contemplaba ese
+        // escenario. Por eso los dos veredictos son obligatorios.
+        if (limits.evidenceRequiredBeforeDone && card.state === "done") {
+            if (evidenceComplete !== true) {
+                throw new InvariantViolationError("evidence-required-before-done", `${card.id}: marcada DONE sin evidencia de todos los requisitos obligatorios`);
+            }
+        }
         // Invariante duro: una card no puede reventar el presupuesto de reviews.
         if (card.rejections > limits.maxReviewRejections) {
             throw new InvariantViolationError("max-review-rejections", `${card.id}: ${card.rejections} rechazos exceden el máximo ${limits.maxReviewRejections}`);
@@ -175,6 +187,7 @@ export function migrateState(raw, limits = DEFAULT_LIMITS) {
         createdAt: input.createdAt ?? input.created ?? new Date().toISOString(),
         updatedAt: input.updatedAt ?? input.updated ?? new Date().toISOString(),
         status: (input.status ?? "planning"),
+        halt: input.halt ?? null,
         cards,
         order,
         budget: {
@@ -225,6 +238,7 @@ export function createRun(objective, runId, limits = DEFAULT_LIMITS) {
         iteration: 0,
         pendingGates: [],
         sessions: {},
+        halt: null,
     };
 }
 /** Transiciones de la corrida. */