@robota-sdk/agent-cli 3.0.0-beta.8 → 3.0.0-beta.82

package/dist/node/node-hHzxDyjn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-hHzxDyjn.js","names":["m","o","l","i","_","h","p","f","v","g","r","d","s","b","z","y","PROTECTED_DIRECTORY_NAMES","PROTECTED_FILE_NAMES","splitCommandSegments","resolvePlatformShell","zodToJsonSchema","ValidationError","FunctionTool","createBoundedOutput","subprocessTraceEnvironment","isPathInside","ToolExecutionError","fetchWithEgressPolicy","TOOL_SEARCH_TOOL_NAME"],"sources":["../../../agent-process/dist/node/index.js","../../../agent-core/dist/node/node.js","../../../agent-tools/dist/node/index.js"],"sourcesContent":["import{spawnSync as e}from\"node:child_process\";const t=2e3,n=process.platform===`win32`;function r(e){return e.exitCode!==null||e.signalCode!==null}function i(e,t,r){if(r&&!n&&typeof e.pid==`number`)try{process.kill(-e.pid,t);return}catch{}try{e.kill(t)}catch{}}function a(t,r){if(n&&typeof t.pid==`number`){e(`taskkill`,[`/pid`,String(t.pid),`/T`,`/F`],{stdio:`ignore`});return}i(t,`SIGKILL`,r)}async function o(e,t={}){let n=t.graceMs??2e3,o=t.signal??`SIGTERM`,s=t.processGroup??!1;if(!r(e)){if(typeof e.pid!=`number`)throw Error(`[agent-process] killProcessTree called with an unspawned child (no pid)`);if(t.preKill){try{await t.preKill()}catch{}if(r(e))return}return new Promise(t=>{let c,l=()=>{c&&clearTimeout(c),t()};if(e.once(`exit`,l),r(e)){e.removeListener(`exit`,l),t();return}i(e,o,s),c=setTimeout(()=>{r(e)||a(e,s)},n),c.unref?.()})}}export{t as DEFAULT_KILL_GRACE_MS,o as killProcessTree};\n//# sourceMappingURL=index.js.map","import{t as e}from\"./command-executor-DV-H2oD6.js\";import{t}from\"./http-executor-cWzI2svn.js\";import{accessSync as n,chmodSync as r,constants as i,mkdirSync as a,realpathSync as o,renameSync as s,rmSync as c,statSync as l,unlinkSync as u,writeFileSync as d}from\"node:fs\";import{basename as f,dirname as p,isAbsolute as m,join as h,relative as g,resolve as _,sep as v}from\"node:path\";import{lookup as y}from\"node:dns/promises\";import{isIP as b}from\"node:net\";function x(e){if(typeof e!=`string`)throw TypeError(`executionRoot must be a string`);if(e.trim().length===0)throw TypeError(`executionRoot must be a non-empty string`);if(!m(e))throw TypeError(`executionRoot must be an absolute path`);let t;try{t=o(e)}catch{throw TypeError(`executionRoot must name an existing accessible directory`)}if(!l(t).isDirectory())throw TypeError(`executionRoot must name a directory`);try{n(t,i.R_OK|i.X_OK)}catch{throw TypeError(`executionRoot directory must be readable and traversable`)}return t}function S(e){let t=[],n=_(e);for(;;)try{return h(o(n),...t)}catch{let r=p(n);if(r===n)return _(e);t.unshift(f(n)),n=r}}function C(e,t){let n=S(e),r=S(t);return r===n||r.startsWith(n+v)}const w=384,T=448;var E=class extends Error{constructor(e){super(e),this.name=`OwnerOnlyModeError`}};function D(e=process.platform){return e===`win32`?`windows-acl`:`posix-mode`}function O(e,t){let n=g(e,t);if(n.startsWith(`..`)||m(n))throw new E(`withinRoot ${e} is not an ancestor of ${t}, so this call cannot own the path between them.`);let r=n.split(v).filter(e=>e.length>0),i=[e],a=e;for(let e of r)a=h(a,e),i.push(a);return i}function k(e,t,n={}){if(D()!==`posix-mode`)return;let r=(n.readMode??(e=>l(e).mode&4095))(e);if(r&63)throw new E(`${t} ${e} is mode 0${r.toString(8)} after being set owner-only; group or other permissions survived, so its contents are readable by another account.`)}function A(e,t={}){let n=t.makeDirectory??((e,t)=>{a(e,{recursive:!0,mode:t})}),i=t.setMode??((e,t)=>r(e,t));n(e,448);let o=t.withinRoot===void 0?[e]:O(t.withinRoot,e);for(let e of o)D()===`posix-mode`&&i(e,448),k(e,`directory`,t)}function j(e,t){A(p(e));let n=`${e}.${process.pid}.tmp`;c(n,{force:!0}),d(n,t,{encoding:`utf8`,mode:384,flag:`wx`});try{k(n,`file`),s(n,e)}catch(e){try{u(n)}catch{}throw e}k(e,`file`)}function M(e){if(D()!==`posix-mode`)return;let t;try{t=l(e).mode&4095}catch{return}t&63&&(r(e,384),k(e,`file`))}function N(e){let t=b(e);return t===4?P(e.split(`.`).map(Number)):t!==6||F(e)}function P(e){let[t=0,n=0,r=0]=e;return t===0||t===10||t===127||t===100&&n>=64&&n<=127||t===169&&n===254||t===172&&n>=16&&n<=31||t===192&&n===0&&r===0||t===192&&n===168||t===198&&(n===18||n===19)||t>=224}function F(e){let t=L(e);if(t===void 0)return!0;let[n=0,r=0,i=0,a=0,o=0,s=0,c=0,l=0]=t;return n===0&&r===0&&i===0&&a===0&&o===0&&s===65535||n===100&&r===65435&&i===0&&a===0&&o===0&&s===0?P([c>>8,c&255,l>>8,l&255]):n===0&&r===0&&i===0&&a===0&&o===0&&s===0||(n&65024)==64512||(n&65472)==65152||(n&65472)==65216||(n&65280)==65280}function I(e){let t=e.lastIndexOf(`:`),n=e.slice(t+1);if(!n.includes(`.`))return e;if(t<0||b(n)!==4)return;let[r=0,i=0,a=0,o=0]=n.split(`.`).map(Number),s=(r<<8|i).toString(16),c=(a<<8|o).toString(16);return`${e.slice(0,t+1)}${s}:${c}`}function L(e){let t=I(e.split(`%`)[0]??e);if(t===void 0)return;let n=t.split(`::`);if(n.length>2)return;let r=e=>e.length===0?[]:e.split(`:`).map(e=>Number.parseInt(e,16)),i=r(n[0]??``),a=n.length===2?r(n[1]??``):[],o=8-i.length-a.length;if(o<0||n.length===1&&o!==0)return;let s=[...i,...Array(o).fill(0),...a];return s.some(e=>Number.isNaN(e)||e<0||e>65535)?void 0:s}const R=3e4,z=5e6,B=new Set([301,302,303,307,308]),V=new Set([`localhost`,`metadata`,`metadata.google.internal`,`metadata.goog`,`instance-data`,`instance-data.ec2.internal`]),H=async e=>(await y(e,{all:!0,verbatim:!0})).map(e=>e.address);async function U(e,t={},n=H){let r=e.href;if(e.protocol!==`http:`&&e.protocol!==`https:`)return{reason:`unsupported_scheme`,url:r,message:`Only http(s) URLs may be fetched.`};if(t.allowPrivateAddresses===!0)return;let i=e.hostname.replace(/^\\[|\\]$/g,``).toLowerCase();if(t.allowedHosts?.includes(i))return;if(V.has(i)||i.endsWith(`.localhost`))return{reason:`metadata_host`,url:r,message:`Destination \"${i}\" is a loopback or cloud-metadata host and is not reachable from tools.`};let a=b(i)?[i]:await W(i,n);if(a===void 0||a.length===0)return{reason:`unresolvable`,url:r,message:`Destination \"${i}\" did not resolve.`};let o=a.find(N);if(o!==void 0)return{reason:`private_destination`,url:r,message:`Destination \"${i}\" resolves to ${o}, a private, loopback or link-local address, and is not reachable from tools.`}}async function W(e,t){try{return await t(e)}catch{return}}async function G(e,t={},n={},r={}){let i=r.fetch??((e,t)=>globalThis.fetch(e,t)),a=r.lookup??H,o=t.maxResponseBytes??z,s=n.maxRedirects??5,c=AbortSignal.timeout(t.timeoutMs??R),l=t.signal?AbortSignal.any([c,t.signal]):c,u=new URL(e),d={...t.headers??{}};for(let e=0;;e+=1){let t=await U(u,n,a);if(t!==void 0)return{ok:!1,rejection:t};let r=await i(u.href,{headers:d,signal:l,redirect:`manual`});if(!B.has(r.status))return J(r,u.href,o,l);let c=r.headers.get(`location`);if(c===null)return{ok:!1,rejection:{reason:`redirect_without_location`,url:u.href,message:`HTTP ${r.status} without a Location header.`}};if(e>=s)return{ok:!1,rejection:{reason:`redirect_limit`,url:u.href,message:`More than ${s} redirects.`}};let f=new URL(c,u);f.origin!==u.origin&&(d=q(d)),u=f}}async function K(e,t,n={},r={}){let i=r.fetch??((e,t)=>globalThis.fetch(e,t)),a=t.maxResponseBytes??z,o=AbortSignal.timeout(t.timeoutMs??R),s=t.signal?AbortSignal.any([o,t.signal]):o,c=new URL(e),l=await U(c,n,r.lookup??H);if(l!==void 0)return{ok:!1,rejection:l};let u=await i(c.href,{method:`POST`,headers:{...t.headers??{}},body:t.body,signal:s,redirect:`manual`});return u.status>=300&&u.status<400?(await u.body?.cancel().catch(()=>void 0),{ok:!1,rejection:{reason:`redirect_refused`,url:c.href,message:`HTTP ${u.status}: a POST is never redirected.`}}):J(u,c.href,a,s)}function q(e){let t={};for(let[n,r]of Object.entries(e))n.toLowerCase()===`user-agent`&&(t[n]=r);return t}async function J(e,t,n,r){let i=e=>({ok:!1,rejection:{reason:`response_too_large`,url:t,message:`Response exceeds ${n} bytes (${e} seen).`}}),a=Number(e.headers.get(`content-length`));if(Number.isFinite(a)&&a>n)return await e.body?.cancel(),i(a);let o=[],s=0;if(!e.body&&typeof e.arrayBuffer==`function`){let t=new Uint8Array(await e.arrayBuffer());if(t.byteLength>n)return i(t.byteLength);o.push(t),s=t.byteLength}else if(e.body){let t=e.body.getReader();for(;;){r.throwIfAborted();let{done:e,value:a}=await t.read();if(e)break;if(s+=a.byteLength,s>n)return await t.cancel(),i(s);o.push(a)}}let c=new Uint8Array(s),l=0;for(let e of o)c.set(e,l),l+=e.byteLength;return{ok:!0,status:e.status,statusText:e.statusText,headers:e.headers,body:c,finalUrl:t}}export{V as BLOCKED_HOSTNAMES,e as CommandExecutor,t as HttpExecutor,T as OWNER_ONLY_DIRECTORY_MODE,w as OWNER_ONLY_FILE_MODE,E as OwnerOnlyModeError,S as canonicalizePath,A as ensureOwnerOnlyDirectory,G as fetchWithEgressPolicy,C as isPathInside,N as isPrivateAddress,D as ownerOnlyGuarantee,K as postWithEgressPolicy,U as rejectDestination,x as resolveTrustedExecutionRoot,M as tightenExistingFile,j as writeOwnerOnlyFile};\n//# sourceMappingURL=node.js.map","import { chmod, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from \"node:fs/promises\";\nimport { basename, dirname, isAbsolute, join, posix, resolve } from \"node:path\";\nimport { spawn, spawnSync } from \"node:child_process\";\nimport { randomBytes, randomUUID } from \"node:crypto\";\nimport { chmodSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from \"node:fs\";\nimport { homedir, tmpdir } from \"node:os\";\nimport { FunctionTool, PROTECTED_DIRECTORY_NAMES, PROTECTED_FILE_NAMES, TOOL_SEARCH_TOOL_NAME, ToolExecutionError, ValidationError, createBoundedOutput, registerToolPermissionProfile, resolvePlatformShell, splitCommandSegments, subprocessTraceEnvironment, zodToJsonSchema } from \"@robota-sdk/agent-core\";\nimport { z } from \"zod\";\nimport { killProcessTree } from \"@robota-sdk/agent-process\";\nimport { fetchWithEgressPolicy, isPathInside } from \"@robota-sdk/agent-core/node\";\nimport fg from \"fast-glob\";\nimport pLimit from \"p-limit\";\nimport { EventEmitter } from \"node:events\";\nimport { Worker } from \"node:worker_threads\";\n//#region src/sandbox/e2b-sandbox-client.ts\nvar E2BSandboxClient = class {\n\tsandbox;\n\tconnectSandbox;\n\tcreateSandboxFromSnapshot;\n\tconstructor(options) {\n\t\tthis.sandbox = options.sandbox;\n\t\tthis.connectSandbox = options.connectSandbox;\n\t\tthis.createSandboxFromSnapshot = options.createSandboxFromSnapshot;\n\t}\n\tasync run(command, options) {\n\t\tconst result = await this.sandbox.commands.run(command, {\n\t\t\tbackground: false,\n\t\t\ttimeoutMs: options?.timeoutMs,\n\t\t\tcwd: options?.workingDirectory\n\t\t});\n\t\treturn {\n\t\t\tstdout: result.stdout ?? \"\",\n\t\t\tstderr: result.stderr ?? \"\",\n\t\t\texitCode: result.exitCode ?? result.exit_code ?? 0\n\t\t};\n\t}\n\tasync readFile(path) {\n\t\tconst content = await this.sandbox.files.read(path);\n\t\treturn typeof content === \"string\" ? content : Buffer.from(content).toString(\"utf8\");\n\t}\n\tasync writeFile(path, content) {\n\t\tawait this.sandbox.files.write(path, content);\n\t}\n\tasync snapshot() {\n\t\tif (this.sandbox.createSnapshot) {\n\t\t\tconst snapshot = await this.sandbox.createSnapshot();\n\t\t\tconst snapshotId = snapshot.snapshotId ?? snapshot.id;\n\t\t\tif (!snapshotId) throw new Error(\"E2B createSnapshot() did not return a snapshot id.\");\n\t\t\treturn snapshotId;\n\t\t}\n\t\tconst sandboxId = this.sandbox.sandboxId;\n\t\tif (!sandboxId) throw new Error(\"E2B sandboxId is required to create a resumable sandbox snapshot.\");\n\t\tif (!this.sandbox.pause) throw new Error(\"E2B sandbox adapter does not expose pause().\");\n\t\tawait this.sandbox.pause();\n\t\treturn sandboxId;\n\t}\n\tasync restore(snapshotId) {\n\t\tif (this.createSandboxFromSnapshot) {\n\t\t\tthis.sandbox = await this.createSandboxFromSnapshot(snapshotId);\n\t\t\treturn;\n\t\t}\n\t\tif (this.connectSandbox) {\n\t\t\tthis.sandbox = await this.connectSandbox(snapshotId);\n\t\t\treturn;\n\t\t}\n\t\tif (this.sandbox.sandboxId === snapshotId && this.sandbox.connect) {\n\t\t\tthis.sandbox = await this.sandbox.connect();\n\t\t\treturn;\n\t\t}\n\t\tthrow new Error(\"E2B sandbox restore requires connectSandbox(snapshotId) or sandbox.connect().\");\n\t}\n};\n//#endregion\n//#region src/sandbox/in-memory-sandbox-client.ts\nvar InMemorySandboxClient = class {\n\tfiles = /* @__PURE__ */ new Map();\n\tsnapshots = /* @__PURE__ */ new Map();\n\trunHandler;\n\tsnapshotSequence = 0;\n\tconstructor(options = {}) {\n\t\tfor (const [path, content] of Object.entries(options.files ?? {})) this.files.set(path, content);\n\t\tthis.runHandler = options.runHandler;\n\t}\n\tasync run(command, options) {\n\t\tif (this.runHandler) return this.runHandler(command, options, this.files);\n\t\treturn {\n\t\t\tstdout: \"\",\n\t\t\tstderr: \"\",\n\t\t\texitCode: 0\n\t\t};\n\t}\n\tasync readFile(path) {\n\t\tconst content = this.files.get(path);\n\t\tif (content === void 0) throw new Error(`Sandbox file not found: ${path}`);\n\t\treturn content;\n\t}\n\tasync writeFile(path, content) {\n\t\tthis.files.set(path, content);\n\t}\n\tasync snapshot() {\n\t\tconst snapshotId = `snapshot-${++this.snapshotSequence}`;\n\t\tthis.snapshots.set(snapshotId, new Map(this.files));\n\t\treturn snapshotId;\n\t}\n\tasync restore(snapshotId) {\n\t\tconst snapshot = this.snapshots.get(snapshotId);\n\t\tif (!snapshot) throw new Error(`Sandbox snapshot not found: ${snapshotId}`);\n\t\tthis.files.clear();\n\t\tfor (const [path, content] of snapshot.entries()) this.files.set(path, content);\n\t}\n\tgetFile(path) {\n\t\treturn this.files.get(path);\n\t}\n};\n//#endregion\n//#region src/sandbox/containment.ts\nfunction describeExecutionContainment(client) {\n\tif (client === void 0) return \"host\";\n\treturn `sandbox-${client.filesystem ?? \"separate\"}`;\n}\n/** Whether file tools must read and write through the sandbox rather than the host filesystem. */\nfunction routesFilesThroughSandbox(client) {\n\treturn describeExecutionContainment(client) === \"sandbox-separate\";\n}\n//#endregion\n//#region src/sandbox/manifest-enforceability.ts\n/**\n* Refuse a manifest whose security-bearing fields the built-in applicator cannot enforce.\n*\n* Emptiness is what is checked, not presence: `environment: {}` and `permissions: {}` request\n* nothing, so refusing them would fail a caller that asked for no controls at all. `permissions`\n* counts as empty when neither list has an entry — `{ read: [] }` is a declared-but-empty policy,\n* not a policy.\n*/\nfunction refuseUnenforceableManifestControls(manifest) {\n\tconst unenforceable = [];\n\tif (manifest.environment && Object.keys(manifest.environment).length > 0) unenforceable.push(\"environment\");\n\tconst permissions = manifest.permissions;\n\tconst requestsSomething = (value) => Array.isArray(value) ? value.length > 0 : value !== void 0;\n\tif (permissions && Object.values(permissions).some(requestsSomething)) unenforceable.push(\"permissions\");\n\tif (unenforceable.length === 0) return;\n\tthrow new Error(`workspace manifest requests ${unenforceable.join(\" and \")}, which this sandbox client cannot enforce. The built-in applicator applies entries only. Supply a sandbox client that implements applyManifest and honours these fields, or remove them from the manifest — they were previously accepted and silently ignored, which reported a sandbox policy that was never applied (issue #2027).`);\n}\n//#endregion\n//#region src/sandbox/workspace-manifest.ts\nconst DEFAULT_TARGET_ROOT = \"/workspace\";\nconst WINDOWS_ABSOLUTE_PATH_PATTERN = /^[A-Za-z]:[\\\\/]/;\nconst SHELL_QUOTE_PATTERN = /'/g;\nasync function applyWorkspaceManifest(sandboxClient, manifest, options = {}) {\n\tif (sandboxClient.applyManifest) return sandboxClient.applyManifest(manifest, options);\n\trefuseUnenforceableManifestControls(manifest);\n\tconst targetRoot = normalizeSandboxRoot(options.targetRoot ?? DEFAULT_TARGET_ROOT);\n\tconst appliedEntries = [];\n\tfor (const [rawPath, entry] of Object.entries(manifest.entries)) {\n\t\tconst path = validateWorkspaceManifestPath(rawPath);\n\t\tconst targetPath = joinSandboxPath(targetRoot, path);\n\t\tappliedEntries.push(await applyManifestEntry(sandboxClient, path, targetPath, targetRoot, entry, options));\n\t}\n\treturn { entries: appliedEntries };\n}\nfunction validateWorkspaceManifestPath(path) {\n\tif (path.length === 0) throw new Error(\"workspace manifest path must not be empty\");\n\tif (path.includes(\"\\0\")) throw new Error(\"workspace manifest path must not contain NUL bytes\");\n\tif (path.startsWith(\"/\") || path.startsWith(\"\\\\\") || WINDOWS_ABSOLUTE_PATH_PATTERN.test(path)) throw new Error(\"workspace manifest path must be workspace-relative\");\n\tconst parts = path.replace(/\\\\/g, \"/\").split(\"/\").filter(Boolean);\n\tif (parts.length === 0) throw new Error(\"workspace manifest path must not resolve to the workspace root\");\n\tif (parts.some((part) => part === \"..\")) throw new Error(\"workspace manifest path cannot contain traversal segments\");\n\tconst normalizedParts = parts.filter((part) => part !== \".\");\n\tif (normalizedParts.length === 0) throw new Error(\"workspace manifest path must not resolve to the workspace root\");\n\treturn normalizedParts.join(\"/\");\n}\nasync function applyManifestEntry(sandboxClient, path, targetPath, targetRoot, entry, options) {\n\tswitch (entry.type) {\n\t\tcase \"file\":\n\t\t\tawait writeSandboxFile(sandboxClient, targetPath, targetRoot, entry.content);\n\t\t\treturn createAppliedEntry(path, entry.type);\n\t\tcase \"dir\":\n\t\t\tawait createSandboxDirectory(sandboxClient, targetPath);\n\t\t\treturn createAppliedEntry(path, entry.type);\n\t\tcase \"localFile\":\n\t\t\tawait copyLocalFile(sandboxClient, entry.src, targetPath, targetRoot, options);\n\t\t\treturn createAppliedEntry(path, entry.type);\n\t\tcase \"localDir\":\n\t\t\tawait copyLocalDirectory(sandboxClient, entry.src, targetPath, options);\n\t\t\treturn createAppliedEntry(path, entry.type);\n\t\tcase \"gitRepo\":\n\t\t\tawait cloneGitRepository(sandboxClient, entry, targetPath);\n\t\t\treturn createAppliedEntry(path, entry.type);\n\t\tcase \"s3Mount\":\n\t\tcase \"gcsMount\":\n\t\tcase \"r2Mount\":\n\t\tcase \"azureBlobMount\": return {\n\t\t\tpath,\n\t\t\ttype: entry.type,\n\t\t\tstatus: \"unsupported\",\n\t\t\tmessage: `${entry.type} requires a provider-specific sandbox adapter.`\n\t\t};\n\t\tdefault: return assertUnreachable(entry);\n\t}\n}\nfunction createAppliedEntry(path, type) {\n\treturn {\n\t\tpath,\n\t\ttype,\n\t\tstatus: \"applied\"\n\t};\n}\nasync function copyLocalFile(sandboxClient, source, targetPath, targetRoot, options) {\n\tawait writeSandboxFile(sandboxClient, targetPath, targetRoot, await readFile(resolveHostSourcePath(source, options.hostRoot), \"utf8\"));\n}\nasync function copyLocalDirectory(sandboxClient, source, targetPath, options) {\n\tawait copyLocalDirectoryRecursive(sandboxClient, resolveHostSourcePath(source, options.hostRoot), targetPath);\n}\nasync function copyLocalDirectoryRecursive(sandboxClient, sourcePath, targetPath) {\n\tawait createSandboxDirectory(sandboxClient, targetPath);\n\tconst entries = await readdir(sourcePath, { withFileTypes: true });\n\tfor (const entry of entries) {\n\t\tconst childSourcePath = join(sourcePath, entry.name);\n\t\tconst childTargetPath = joinSandboxPath(targetPath, entry.name);\n\t\tif (entry.isDirectory()) {\n\t\t\tawait copyLocalDirectoryRecursive(sandboxClient, childSourcePath, childTargetPath);\n\t\t\tcontinue;\n\t\t}\n\t\tif (entry.isFile()) {\n\t\t\tconst content = await readFile(childSourcePath, \"utf8\");\n\t\t\tawait sandboxClient.writeFile(childTargetPath, content);\n\t\t}\n\t}\n}\nasync function cloneGitRepository(sandboxClient, entry, targetPath) {\n\tawait runSandboxCommand(sandboxClient, `git clone${entry.shallow === false ? \"\" : \" --depth 1\"}${entry.ref ? ` --branch ${quoteShellArg(entry.ref)}` : \"\"} ${quoteShellArg(entry.url)} ${quoteShellArg(targetPath)}`);\n}\nasync function writeSandboxFile(sandboxClient, targetPath, targetRoot, content) {\n\tconst parentPath = posix.dirname(targetPath);\n\tif (parentPath !== targetRoot) await createSandboxDirectory(sandboxClient, parentPath);\n\tawait sandboxClient.writeFile(targetPath, content);\n}\nasync function createSandboxDirectory(sandboxClient, targetPath) {\n\tawait runSandboxCommand(sandboxClient, `mkdir -p ${quoteShellArg(targetPath)}`);\n}\nasync function runSandboxCommand(sandboxClient, command) {\n\tconst result = await sandboxClient.run(command);\n\tif (result.exitCode !== 0) throw new Error(`workspace manifest command failed: ${command}\\n${result.stderr ?? result.stdout}`);\n}\nfunction resolveHostSourcePath(source, hostRoot) {\n\treturn isAbsolute(source) ? resolve(source) : resolve(hostRoot ?? process.cwd(), source);\n}\n/**\n* Remove every trailing `/`, by index scan.\n*\n* Not `replace(/\\/+$/, '')`: that run has no start anchor, so the engine retries it from every offset inside the\n* run and each retry re-scans to the end — 3.0 s on a 100 K run (`js/polynomial-redos`, SEC-003). The backslash\n* conversion in {@link normalizeSandboxRoot} manufactures such a run from a Windows-style path.\n*/\nfunction trimTrailingSlashes(value) {\n\tlet end = value.length;\n\twhile (end > 0 && value[end - 1] === \"/\") end -= 1;\n\treturn value.slice(0, end);\n}\nfunction normalizeSandboxRoot(root) {\n\tconst normalized = trimTrailingSlashes(root.replace(/\\\\/g, \"/\"));\n\tif (!normalized.startsWith(\"/\")) throw new Error(\"workspace manifest targetRoot must be an absolute sandbox path\");\n\treturn normalized.length === 0 ? \"/\" : normalized;\n}\nfunction joinSandboxPath(root, path) {\n\tconst normalizedRoot = normalizeSandboxRoot(root);\n\tif (normalizedRoot === \"/\") return `/${path}`;\n\treturn `${normalizedRoot}/${path}`;\n}\nfunction quoteShellArg(value) {\n\treturn `'${value.replace(SHELL_QUOTE_PATTERN, \"'\\\\''\")}'`;\n}\nfunction assertUnreachable(value) {\n\tthrow new Error(`unsupported workspace manifest entry: ${JSON.stringify(value)}`);\n}\n//#endregion\n//#region src/sandbox/os-sandbox-policy.ts\n/**\n* What an OS-level sandbox lets a command touch, written once per backend (issue #3082).\n*\n* The same policy becomes bubblewrap arguments on Linux and a Seatbelt profile on macOS:\n* - the whole filesystem is readable except the `denyRead` paths;\n* - writes are allowed only inside the workspace, the temporary directories and `allowWrite`;\n* - inside the workspace, the files that configure git, the agent, MCP servers and shells stay\n*   read-only, so a confined command cannot change what the next session trusts;\n* - the network is either reachable or not. There is no per-domain allowlist: that needs a proxy\n*   process the OS cannot enforce, and a boundary here is only worth what the OS enforces.\n*/\n/** An isolated worktree's files are ordinary workspace files. */\nconst WRITABLE_INSIDE_PROTECTED = [\".robota/worktrees\", \".claude/worktrees\"];\nfunction join$1(root, relative) {\n\tlet end = root.length;\n\twhile (end > 0 && root[end - 1] === \"/\") end -= 1;\n\treturn `${root.slice(0, end)}/${relative}`;\n}\n/**\n* Workspace entries a confined command must not write, relative to the root. `.git` is read-only\n* as a whole: the files that make git run something (config, hooks, `commondir`, per-worktree\n* config) are too many and too easy to add to for a list inside it to stay complete, so git\n* commands that write run unconfined, through the ordinary permission path.\n*/\nfunction protectedWorkspaceEntries() {\n\treturn [...PROTECTED_DIRECTORY_NAMES, ...PROTECTED_FILE_NAMES];\n}\n/** The `bwrap` argument vector that runs `command args` under the policy. */\nfunction bubblewrapArguments(input) {\n\tconst { policy } = input;\n\tconst args = [\n\t\t\"--ro-bind\",\n\t\t\"/\",\n\t\t\"/\",\n\t\t\"--dev\",\n\t\t\"/dev\",\n\t\t\"--proc\",\n\t\t\"/proc\"\n\t];\n\tfor (const path of [\n\t\tpolicy.root,\n\t\t...policy.tempDirectories,\n\t\t...policy.allowWrite\n\t]) args.push(\"--bind-try\", path, path);\n\tfor (const entry of protectedWorkspaceEntries()) {\n\t\tconst path = join$1(policy.root, entry);\n\t\tif (input.exists(path)) args.push(\"--ro-bind\", path, path);\n\t}\n\tfor (const entry of WRITABLE_INSIDE_PROTECTED) {\n\t\tconst path = join$1(policy.root, entry);\n\t\tif (!input.exists(path)) continue;\n\t\targs.push(\"--bind\", path, path);\n\t\tfor (const name of input.listDirectory(path)) {\n\t\t\tconst gitFile = join$1(path, `${name}/.git`);\n\t\t\tif (input.exists(gitFile)) args.push(\"--ro-bind\", gitFile, gitFile);\n\t\t}\n\t}\n\tfor (const hidden of policy.denyRead) {\n\t\tif (!input.exists(hidden.path)) continue;\n\t\tif (hidden.directory) args.push(\"--tmpfs\", hidden.path);\n\t\telse args.push(\"--ro-bind\", \"/dev/null\", hidden.path);\n\t}\n\tif (!policy.network) {\n\t\tif (input.seccompDescriptor === void 0) throw new Error(\"A sandbox without network needs the Unix-socket seccomp filter.\");\n\t\targs.push(\"--unshare-net\", \"--seccomp\", String(input.seccompDescriptor));\n\t}\n\targs.push(\"--unshare-pid\", \"--die-with-parent\", \"--new-session\", \"--chdir\", input.cwd);\n\targs.push(\"--\", input.command);\n\treturn [...args, ...input.args];\n}\nfunction regexEscape(path) {\n\treturn path.replace(/[\\\\^$.*+?()[\\]{}|\"]/g, (char) => `\\\\${char}`);\n}\nfunction quote(path) {\n\treturn `\"${path.replace(/\\\\/g, \"\\\\\\\\\").replace(/\"/g, \"\\\\\\\"\")}\"`;\n}\n/**\n* The Seatbelt profile for `sandbox-exec -p`. Later rules win, so the order below is the policy:\n* deny writes, allow the writable places, deny the protected entries again, reopen worktrees.\n*/\nfunction seatbeltProfile(policy) {\n\tconst writable = [\n\t\tpolicy.root,\n\t\t...policy.tempDirectories,\n\t\t...policy.allowWrite\n\t].map((path) => `(subpath ${quote(path)})`).join(\" \");\n\tconst protectedEntries = protectedWorkspaceEntries().map((entry) => {\n\t\tconst path = join$1(policy.root, entry);\n\t\treturn PROTECTED_FILE_NAMES.includes(entry) ? `(literal ${quote(path)})` : `(subpath ${quote(path)})`;\n\t});\n\tconst worktrees = WRITABLE_INSIDE_PROTECTED.map((entry) => `(subpath ${quote(join$1(policy.root, entry))})`);\n\tconst pinned = [`(literal ${quote(join$1(policy.root, \".git\"))})`, ...WRITABLE_INSIDE_PROTECTED.map((entry) => `(regex #\"^${regexEscape(join$1(policy.root, entry))}/[^/]+/\\\\.git$\")`)];\n\tconst lines = [\n\t\t\"(version 1)\",\n\t\t\"(allow default)\",\n\t\t\"(deny file-write*)\",\n\t\t`(allow file-write* ${writable} (literal \"/dev/null\") (regex #\"^/dev/tty\") (regex #\"^/dev/fd/\"))`,\n\t\t`(deny file-write* ${protectedEntries.join(\" \")})`,\n\t\t`(allow file-write* ${worktrees.join(\" \")})`,\n\t\t`(deny file-write* ${pinned.join(\" \")})`\n\t];\n\tif (policy.denyRead.length > 0) {\n\t\tconst hidden = policy.denyRead.map((entry) => entry.directory ? `(subpath ${quote(entry.path)})` : `(literal ${quote(entry.path)})`);\n\t\tlines.push(`(deny file-read* ${hidden.join(\" \")})`);\n\t}\n\tif (!policy.network) lines.push(\"(deny network*)\");\n\treturn lines.join(\"\\n\");\n}\n//#endregion\n//#region src/sandbox/os-sandbox-seccomp.ts\n/**\n* The seccomp filter bubblewrap loads when a confined command has no network (issue #3082).\n*\n* `--unshare-net` removes every network interface, but a Unix socket is a file: a daemon listening\n* on one outside the sandbox (a container engine, the session bus, an ssh agent) is still reachable\n* through the read-only filesystem, and is a way to run anything on the host. The filter refuses\n* creating an `AF_UNIX` socket, and refuses `io_uring_setup`, which could create one without the\n* `socket` system call. A system call from another ABI (x32, 32-bit compat) is refused whole, since\n* its numbers differ and the checks below would not see it. macOS's Seatbelt `(deny network*)`\n* already covers Unix sockets.\n*/\nconst BPF_LD_W_ABS = 32;\nconst BPF_JMP_JEQ_K = 21;\nconst BPF_JMP_JSET_K = 69;\nconst BPF_RET_K = 6;\nconst SECCOMP_RET_ALLOW = 2147418112;\nconst SECCOMP_RET_ERRNO = 327680;\nconst EPERM = 1;\nconst EAFNOSUPPORT = 97;\nconst AF_UNIX = 1;\nconst X32_SYSCALL_BIT = 1073741824;\n/** `struct seccomp_data` offsets. */\nconst OFFSET_NR = 0;\nconst OFFSET_ARCH = 4;\nconst OFFSET_ARG0_LOW = 16;\nconst ARCHITECTURES = {\n\tx64: {\n\t\taudit: 3221225534,\n\t\tsocket: 41,\n\t\tioUringSetup: 425\n\t},\n\tarm64: {\n\t\taudit: 3221225655,\n\t\tsocket: 198,\n\t\tioUringSetup: 425\n\t}\n};\nfunction instruction(code, jt, jf, k) {\n\treturn [\n\t\tcode,\n\t\tjt,\n\t\tjf,\n\t\tk\n\t];\n}\n/**\n* The filter as bytes `bwrap --seccomp` reads, or `undefined` for a processor architecture it has\n* no system call numbers for — the caller then refuses to confine rather than confine with a gap.\n*/\nfunction unixSocketSeccompFilter(arch = process.arch) {\n\tconst target = ARCHITECTURES[arch];\n\tif (target === void 0) return void 0;\n\tconst errno = (code) => SECCOMP_RET_ERRNO | code;\n\tconst program = [\n\t\tinstruction(BPF_LD_W_ABS, 0, 0, OFFSET_ARCH),\n\t\tinstruction(BPF_JMP_JEQ_K, 1, 0, target.audit),\n\t\tinstruction(BPF_RET_K, 0, 0, errno(EPERM)),\n\t\tinstruction(BPF_LD_W_ABS, 0, 0, OFFSET_NR),\n\t\tinstruction(BPF_JMP_JSET_K, 0, 1, X32_SYSCALL_BIT),\n\t\tinstruction(BPF_RET_K, 0, 0, errno(EPERM)),\n\t\tinstruction(BPF_JMP_JEQ_K, 0, 1, target.ioUringSetup),\n\t\tinstruction(BPF_RET_K, 0, 0, errno(EPERM)),\n\t\tinstruction(BPF_JMP_JEQ_K, 0, 3, target.socket),\n\t\tinstruction(BPF_LD_W_ABS, 0, 0, OFFSET_ARG0_LOW),\n\t\tinstruction(BPF_JMP_JEQ_K, 0, 1, AF_UNIX),\n\t\tinstruction(BPF_RET_K, 0, 0, errno(EAFNOSUPPORT)),\n\t\tinstruction(BPF_RET_K, 0, 0, SECCOMP_RET_ALLOW)\n\t];\n\tconst bytes = new Uint8Array(program.length * 8);\n\tconst view = new DataView(bytes.buffer);\n\tprogram.forEach(([code, jt, jf, k], index) => {\n\t\tview.setUint16(index * 8, code, true);\n\t\tview.setUint8(index * 8 + 2, jt);\n\t\tview.setUint8(index * 8 + 3, jf);\n\t\tview.setUint32(index * 8 + 4, k >>> 0, true);\n\t});\n\treturn bytes;\n}\n//#endregion\n//#region src/sandbox/os-sandbox-client.ts\n/**\n* OS-level confinement of shell commands over the host filesystem (issue #3082): bubblewrap on\n* Linux and WSL2, Seatbelt (`sandbox-exec`) on macOS. Other platforms have no backend; the client\n* reports that instead of pretending.\n*\n* It is a `shared` sandbox client: file tools stay on the host under the path guard, and the shell\n* tool starts the wrapped invocation itself. Settings are live — `/sandbox` changes them for the\n* next command without rebuilding the session.\n*/\nconst DEFAULT_OS_SANDBOX_SETTINGS = Object.freeze({\n\tenabled: false,\n\tautoAllowBashIfSandboxed: true,\n\texcludedCommands: [],\n\tallowWrite: [],\n\tdenyRead: [],\n\tnetwork: false\n});\nconst SEATBELT_EXECUTABLE = \"/usr/bin/sandbox-exec\";\nfunction defaultProbe(command, args) {\n\tconst result = spawnSync(command, [...args], {\n\t\ttimeout: 5e3,\n\t\tencoding: \"utf8\"\n\t});\n\tif (result.error !== void 0) return {\n\t\tok: false,\n\t\tdetail: result.error.message\n\t};\n\tconst detail = (result.stderr ?? \"\").trim().split(\"\\n\")[0];\n\treturn result.status === 0 ? { ok: true } : {\n\t\tok: false,\n\t\t...detail ? { detail } : {}\n\t};\n}\n/** Find the platform's backend and check it can actually start a sandbox here. */\nfunction detectOsSandbox(options = {}) {\n\tconst platform = options.platform ?? process.platform;\n\tconst probe = options.probe ?? defaultProbe;\n\tif (platform === \"linux\") {\n\t\tif (unixSocketSeccompFilter(options.arch ?? process.arch) === void 0) return {\n\t\t\tbackend: \"bubblewrap\",\n\t\t\tmissing: [`a seccomp filter for ${options.arch ?? process.arch} (x64 and arm64 are supported)`]\n\t\t};\n\t\tconst check = probe(\"bwrap\", [\n\t\t\t\"--ro-bind\",\n\t\t\t\"/\",\n\t\t\t\"/\",\n\t\t\t\"--dev\",\n\t\t\t\"/dev\",\n\t\t\t\"--unshare-pid\",\n\t\t\t\"true\"\n\t\t]);\n\t\tif (check.ok) return {\n\t\t\tbackend: \"bubblewrap\",\n\t\t\texecutable: \"bwrap\",\n\t\t\tmissing: []\n\t\t};\n\t\treturn {\n\t\t\tbackend: \"bubblewrap\",\n\t\t\tmissing: [check.detail?.includes(\"ENOENT\") ? \"bubblewrap (install the `bubblewrap` package)\" : `bubblewrap cannot create a sandbox here${check.detail ? `: ${check.detail}` : \"\"}`]\n\t\t};\n\t}\n\tif (platform === \"darwin\") {\n\t\tconst check = probe(SEATBELT_EXECUTABLE, [\n\t\t\t\"-p\",\n\t\t\t\"(version 1)(allow default)\",\n\t\t\t\"/usr/bin/true\"\n\t\t]);\n\t\tif (check.ok) return {\n\t\t\tbackend: \"seatbelt\",\n\t\t\texecutable: SEATBELT_EXECUTABLE,\n\t\t\tmissing: []\n\t\t};\n\t\treturn {\n\t\t\tbackend: \"seatbelt\",\n\t\t\tmissing: [`sandbox-exec cannot run${check.detail ? `: ${check.detail}` : \"\"}`]\n\t\t};\n\t}\n\treturn {\n\t\tmissing: [],\n\t\tunsupportedPlatform: platform\n\t};\n}\nfunction realPathOrSelf(path) {\n\ttry {\n\t\treturn realpathSync(path);\n\t} catch {\n\t\treturn path;\n\t}\n}\nfunction isDirectory(path) {\n\ttry {\n\t\treturn statSync(path).isDirectory();\n\t} catch {\n\t\treturn false;\n\t}\n}\n/** Give the owner read, write and search permission throughout an entry, never following links. */\nfunction grantOwnerAccess(path) {\n\tconst stat = lstatSync(path);\n\tif (stat.isSymbolicLink()) return;\n\tchmodSync(path, stat.mode | 448);\n\tif (!stat.isDirectory()) return;\n\tfor (const name of readdirSync(path)) grantOwnerAccess(`${path}/${name}`);\n}\nfunction isSymbolicLink(path) {\n\ttry {\n\t\treturn lstatSync(path).isSymbolicLink();\n\t} catch {\n\t\treturn false;\n\t}\n}\n/** The program a shell line starts first — what `excludedCommands` names. */\nfunction firstProgram(shellCommand) {\n\treturn shellCommand.trim().split(/\\s+/)[0];\n}\nvar OsSandboxClient = class {\n\tfilesystem = \"shared\";\n\troot;\n\tavailability;\n\thomeDirectory;\n\tcurrent;\n\tinFlight = 0;\n\tbaseline = [];\n\t/** Entries a clean-up could not restore, with the state they must return to. */\n\tunresolved = /* @__PURE__ */ new Map();\n\tconstructor(options) {\n\t\tthis.root = realPathOrSelf(options.root);\n\t\tthis.availability = options.availability;\n\t\tthis.homeDirectory = options.homeDirectory ?? homedir();\n\t\tthis.current = {\n\t\t\t...DEFAULT_OS_SANDBOX_SETTINGS,\n\t\t\t...options.settings\n\t\t};\n\t}\n\tstatus() {\n\t\treturn {\n\t\t\tsettings: this.current,\n\t\t\tavailability: this.availability,\n\t\t\tactive: this.current.enabled && this.availability.executable !== void 0\n\t\t};\n\t}\n\t/** Change the settings for the next command. */\n\tconfigure(settings) {\n\t\tthis.current = {\n\t\t\t...this.current,\n\t\t\t...settings\n\t\t};\n\t}\n\t/** Whether `shellCommand` would run confined. */\n\tconfines(shellCommand) {\n\t\tif (!this.status().active) return false;\n\t\tif (splitCommandSegments(shellCommand).length !== 1) return true;\n\t\tconst program = firstProgram(shellCommand);\n\t\treturn program === void 0 || !this.current.excludedCommands.includes(program);\n\t}\n\tautoApproves(shellCommand) {\n\t\tif (!this.current.autoAllowBashIfSandboxed || !this.confines(shellCommand)) return false;\n\t\tif (this.unresolved.size > 0) return false;\n\t\treturn !this.protectedEntryStates().some((state) => state.kind === \"symlink\" && !this.resolvesOutsideWritableWorkspace(state.path));\n\t}\n\twrapCommand(invocation, shellCommand) {\n\t\tif (!this.confines(shellCommand)) return invocation;\n\t\tconst policy = this.policy();\n\t\tconst executable = this.availability.executable;\n\t\tif (this.availability.backend === \"seatbelt\") return {\n\t\t\tcommand: executable,\n\t\t\targs: [\n\t\t\t\t\"-p\",\n\t\t\t\tseatbeltProfile(policy),\n\t\t\t\tinvocation.command,\n\t\t\t\t...invocation.args\n\t\t\t],\n\t\t\tcwd: invocation.cwd\n\t\t};\n\t\tconst filter = policy.network ? void 0 : unixSocketSeccompFilter();\n\t\tif (!this.protectedEntryStates().some((state) => state.path.endsWith(\"/.robota\") && state.kind === \"symlink\")) mkdirSync(`${this.root}/.robota`, { recursive: true });\n\t\tconst args = bubblewrapArguments({\n\t\t\tpolicy,\n\t\t\texists: (path) => existsSync(path) && !isSymbolicLink(path),\n\t\t\tlistDirectory: (path) => readdirSync(path),\n\t\t\tcwd: invocation.cwd,\n\t\t\tcommand: invocation.command,\n\t\t\targs: invocation.args,\n\t\t\t...filter !== void 0 ? { seccompDescriptor: 3 } : {}\n\t\t});\n\t\tif (this.inFlight === 0) this.baseline = this.protectedEntryStates().map((state) => this.unresolved.get(state.path) ?? state);\n\t\tthis.inFlight += 1;\n\t\tlet finished = false;\n\t\treturn {\n\t\t\tcommand: executable,\n\t\t\targs,\n\t\t\tcwd: invocation.cwd,\n\t\t\t...filter !== void 0 ? { inputDescriptors: [filter] } : {},\n\t\t\tafterExit: () => {\n\t\t\t\tif (finished) return void 0;\n\t\t\t\tfinished = true;\n\t\t\t\tthis.inFlight -= 1;\n\t\t\t\treturn this.restoreProtectedEntries(this.baseline);\n\t\t\t}\n\t\t};\n\t}\n\t/**\n\t* How each protected entry stands before a command: bubblewrap can mount an existing entry\n\t* read-only, but not one that does not exist yet, and a symlink it mounts through to its target\n\t* while the link itself stays replaceable. Read with `lstat`, so a dangling link is not \"missing\".\n\t*/\n\tprotectedEntryStates() {\n\t\treturn protectedWorkspaceEntries().map((entry) => {\n\t\t\tconst path = `${this.root}/${entry}`;\n\t\t\ttry {\n\t\t\t\treturn lstatSync(path).isSymbolicLink() ? {\n\t\t\t\t\tpath,\n\t\t\t\t\tkind: \"symlink\",\n\t\t\t\t\ttarget: readlinkSync(path)\n\t\t\t\t} : {\n\t\t\t\t\tpath,\n\t\t\t\t\tkind: \"present\"\n\t\t\t\t};\n\t\t\t} catch {\n\t\t\t\treturn {\n\t\t\t\t\tpath,\n\t\t\t\t\tkind: \"missing\"\n\t\t\t\t};\n\t\t\t}\n\t\t});\n\t}\n\t/**\n\t* Undo what the command did to protected entries it could reach: one it created where none\n\t* existed is moved into `.robota/sandbox-quarantine`, and a symlink it replaced is restored. Moved,\n\t* not deleted, so nothing the host wrote meanwhile is lost.\n\t*/\n\t/** Whether a path's real location is under the read-only mounts: not the workspace, temp or `allowWrite`. */\n\tresolvesOutsideWritableWorkspace(path) {\n\t\tlet real;\n\t\ttry {\n\t\t\treal = realpathSync(path);\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t\tconst policy = this.policy();\n\t\treturn ![\n\t\t\tpolicy.root,\n\t\t\t...policy.tempDirectories,\n\t\t\t...policy.allowWrite\n\t\t].some((area) => real === area || real.startsWith(`${area}/`));\n\t}\n\t/**\n\t* Never throws: this runs as the command's process closes, and an exception there would take the\n\t* host down and leave the entry in place. The quarantine is outside the workspace, under the\n\t* user's `~/.robota`, where the command cannot reach it; what cannot be moved there is removed.\n\t*/\n\trestoreProtectedEntries(before) {\n\t\tconst quarantine = `${this.quarantineRoot(before)}/${Date.now()}-${randomUUID()}`;\n\t\tconst notes = [];\n\t\tfor (const state of before) {\n\t\t\tif (state.kind === \"present\") continue;\n\t\t\ttry {\n\t\t\t\tconst now = this.protectedEntryStates().find((entry) => entry.path === state.path);\n\t\t\t\tif (state.kind === \"missing\" && now.kind === \"missing\") {\n\t\t\t\t\tthis.unresolved.delete(state.path);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tif (state.kind === \"symlink\" && now.kind === \"symlink\" && now.target === state.target) {\n\t\t\t\t\tthis.unresolved.delete(state.path);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tif (now.kind !== \"missing\") notes.push(this.setAside(state.path, quarantine));\n\t\t\t\tif (state.kind === \"symlink\") symlinkSync(state.target, state.path);\n\t\t\t\tthis.unresolved.delete(state.path);\n\t\t\t} catch (error) {\n\t\t\t\tthis.unresolved.set(state.path, state);\n\t\t\t\tnotes.push(`could not restore ${state.path} (${error instanceof Error ? error.message : String(error)}); commands will ask until it is removed`);\n\t\t\t}\n\t\t}\n\t\tif (notes.length === 0) return void 0;\n\t\treturn `[sandbox] A confined command may not create or replace git, agent, MCP or shell configuration: ${notes.join(\"; \")}.`;\n\t}\n\t/**\n\t* Where set-aside entries go: the workspace's own `.robota`, when it was a real directory before\n\t* the command — then it was mounted read-only, so the command could not reach it, and a rename\n\t* within one filesystem needs no permission inside the entry. Otherwise the user's `~/.robota`.\n\t* Decided from the baseline: what is there now may be the command's own replacement.\n\t*/\n\tquarantineRoot(before) {\n\t\tconst robota = `${this.root}/.robota`;\n\t\treturn before.some((state) => state.path === robota && state.kind === \"present\") ? `${robota}/sandbox-quarantine` : `${this.homeDirectory}/.robota/sandbox-quarantine`;\n\t}\n\tsetAside(path, quarantine) {\n\t\tconst destination = `${quarantine}/${basename(path)}`;\n\t\tmkdirSync(quarantine, { recursive: true });\n\t\ttry {\n\t\t\trenameSync(path, destination);\n\t\t} catch (error) {\n\t\t\tif (this.inFlight > 0) throw error;\n\t\t\tgrantOwnerAccess(path);\n\t\t\tif (error.code === \"EXDEV\") {\n\t\t\t\tcpSync(path, destination, {\n\t\t\t\t\trecursive: true,\n\t\t\t\t\tverbatimSymlinks: true\n\t\t\t\t});\n\t\t\t\trmSync(path, {\n\t\t\t\t\trecursive: true,\n\t\t\t\t\tforce: true\n\t\t\t\t});\n\t\t\t} else renameSync(path, destination);\n\t\t}\n\t\treturn `moved ${path} to ${destination}`;\n\t}\n\t/** The policy for the current settings, with every path made absolute and real. */\n\tpolicy() {\n\t\tconst absolute = (path) => {\n\t\t\tconst expanded = path === \"~\" || path.startsWith(\"~/\") ? `${this.homeDirectory}${path.slice(1)}` : path;\n\t\t\treturn realPathOrSelf(isAbsolute(expanded) ? expanded : resolve(this.root, expanded));\n\t\t};\n\t\tconst temp = [...new Set([tmpdir(), \"/tmp\"].filter(existsSync).map(realPathOrSelf))];\n\t\treturn {\n\t\t\troot: this.root,\n\t\t\ttempDirectories: temp,\n\t\t\tallowWrite: this.current.allowWrite.map(absolute),\n\t\t\tdenyRead: this.current.denyRead.map((path) => {\n\t\t\t\tconst resolved = absolute(path);\n\t\t\t\treturn {\n\t\t\t\t\tpath: resolved,\n\t\t\t\t\tdirectory: isDirectory(resolved)\n\t\t\t\t};\n\t\t\t}),\n\t\t\tnetwork: this.current.network\n\t\t};\n\t}\n\trun(command, options = {}) {\n\t\tconst shell = resolvePlatformShell();\n\t\tconst cwd = options.workingDirectory ?? this.root;\n\t\tconst invocation = this.wrapCommand({\n\t\t\tcommand: shell.command,\n\t\t\targs: shell.commandArgs(command),\n\t\t\tcwd\n\t\t}, command);\n\t\treturn new Promise((resolveRun, reject) => {\n\t\t\tconst extra = invocation.inputDescriptors ?? [];\n\t\t\tlet child;\n\t\t\ttry {\n\t\t\t\tchild = spawn(invocation.command, [...invocation.args], {\n\t\t\t\t\tcwd: invocation.cwd,\n\t\t\t\t\tstdio: [\n\t\t\t\t\t\t\"ignore\",\n\t\t\t\t\t\t\"pipe\",\n\t\t\t\t\t\t\"pipe\",\n\t\t\t\t\t\t...extra.map(() => \"pipe\")\n\t\t\t\t\t],\n\t\t\t\t\t...options.timeoutMs !== void 0 ? { timeout: options.timeoutMs } : {}\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tinvocation.afterExit?.();\n\t\t\t\treject(error instanceof Error ? error : new Error(String(error)));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\textra.forEach((data, index) => {\n\t\t\t\tconst stream = child.stdio[index + 3];\n\t\t\t\tstream?.on(\"error\", () => void 0);\n\t\t\t\tstream?.end(Buffer.from(data));\n\t\t\t});\n\t\t\tlet stdout = \"\";\n\t\t\tlet stderr = \"\";\n\t\t\tchild.stdout?.on(\"data\", (chunk) => stdout += chunk.toString());\n\t\t\tchild.stderr?.on(\"data\", (chunk) => stderr += chunk.toString());\n\t\t\tchild.on(\"error\", (error) => {\n\t\t\t\tinvocation.afterExit?.();\n\t\t\t\treject(error);\n\t\t\t});\n\t\t\tchild.on(\"close\", (code) => {\n\t\t\t\tconst note = invocation.afterExit?.();\n\t\t\t\tresolveRun({\n\t\t\t\t\tstdout: note === void 0 ? stdout : `${stdout}\\n${note}`,\n\t\t\t\t\t...stderr ? { stderr } : {},\n\t\t\t\t\texitCode: code ?? 1\n\t\t\t\t});\n\t\t\t});\n\t\t});\n\t}\n\treadFile(path) {\n\t\treturn Promise.resolve(readFileSync(path, \"utf8\"));\n\t}\n\twriteFile(path, content) {\n\t\twriteFileSync(path, content, \"utf8\");\n\t\treturn Promise.resolve();\n\t}\n};\n//#endregion\n//#region src/retrieval/repo-map-index.ts\n/** Persisted-schema version — bump when `IRepoMapIndex`'s serialized shape changes incompatibly. */\nconst REPO_MAP_INDEX_VERSION = 1;\n/** Parse one corpus file into an index entry. */\nfunction parseEntry(parser, file) {\n\tconst parsed = parser.parse(file.path, file.content);\n\treturn {\n\t\tpath: file.path,\n\t\tdefinitions: parsed.definitions,\n\t\treferences: parsed.references\n\t};\n}\n/** Parse the whole corpus once into a serializable repo-map index. */\nfunction buildRepoMapIndex(options) {\n\treturn {\n\t\tversion: 1,\n\t\tentries: options.corpus.map((file) => parseEntry(options.parser, file))\n\t};\n}\n/**\n* Apply corpus changes to a built index INCREMENTALLY (SELFHOST-003 P3): re-parse only the `upserted`\n* files and drop `removed` paths, reusing every unchanged entry. Returns a new index (the input is not\n* mutated). A file present in both `removed` and `upserted` is upserted (re-parse wins); a path repeated\n* within `upserted` is de-duplicated last-wins, so the result always has one entry per path — matching a\n* full rebuild (entry order does not affect ranking). Unchanged entries are REUSED BY REFERENCE; index\n* entries are treated as immutable, so callers must not mutate an entry in place.\n*/\nfunction updateRepoMapIndex(index, changes, parser) {\n\tconst upsertedByPath = new Map((changes.upserted ?? []).map((file) => [file.path, file]));\n\tconst touched = /* @__PURE__ */ new Set([...changes.removed ?? [], ...upsertedByPath.keys()]);\n\tconst kept = index.entries.filter((entry) => !touched.has(entry.path));\n\tconst upserted = [...upsertedByPath.values()].map((file) => parseEntry(parser, file));\n\treturn {\n\t\tversion: index.version,\n\t\tentries: [...kept, ...upserted]\n\t};\n}\n/** Serialize a built index to a neutral JSON string for persistence by the surface. */\nfunction serializeRepoMapIndex(index) {\n\treturn JSON.stringify(index);\n}\n/**\n* Restore a built index from its serialized form. Throws on malformed JSON or an unsupported\n* `version` — a stale/incompatible persisted index must be rebuilt, never silently mis-ranked.\n*/\nfunction deserializeRepoMapIndex(serialized) {\n\tconst parsed = JSON.parse(serialized);\n\tif (parsed.version !== 1) throw new Error(`Unsupported repo-map index version ${String(parsed.version)} (expected 1); rebuild the index.`);\n\tif (!Array.isArray(parsed.entries)) throw new Error(\"Malformed repo-map index: missing `entries`.\");\n\tfor (const entry of parsed.entries) if (typeof entry?.path !== \"string\" || !Array.isArray(entry?.definitions) || !Array.isArray(entry?.references)) throw new Error(\"Malformed repo-map index: a corrupt entry — rebuild the index.\");\n\treturn {\n\t\tversion: parsed.version,\n\t\tentries: parsed.entries\n\t};\n}\n//#endregion\n//#region src/retrieval/repo-map-adapter.ts\n/**\n* SELFHOST-003: neutral repo-map ranking adapter — mirrors `InMemorySandboxClient`.\n*\n* Ranks a corpus of source files by graph centrality relative to the active files / mentioned\n* identifiers, within a token budget. It is a NEUTRAL mechanism: it works on ANY repo given a corpus\n* and an injected source parser — it carries no repo paths and no domain content. The heavy parser is\n* injected as the duck-typed `IRetrievalSourceParser` (like `E2BSandboxClient` duck-types the E2B SDK),\n* and the corpus is supplied from the surface.\n*\n* P2 (index build + persistence): the corpus is parsed ONCE into an `IRepoMapIndex` at construction\n* (or supplied prebuilt/persisted via `{ index }`), so `retrieve()` ranks without re-parsing.\n*\n* Ranking model (aider repo-map style): a definition's score is the weighted number of references to it\n* across the corpus, references FROM an active file weighted higher (personalization), plus a boost for\n* a directly-mentioned identifier. Entries are emitted most-relevant-first, truncated to the budget.\n*/\n/** References from an active file weigh more (personalization toward the current focus). */\nconst ACTIVE_FILE_WEIGHT = 3;\n/** A directly-mentioned identifier is a strong relevance signal. */\nconst MENTION_BOOST = 5;\n/**\n* Estimate the token cost of one repo-map entry (neutral chars/4 heuristic). Uses the same rendering\n* shape the tool prints (`file:line  kind name`) so the budgeted estimate matches the emitted output.\n*/\nfunction estimateTokens(symbol) {\n\tconst line = `${symbol.file}:${symbol.line}  ${symbol.kind} ${symbol.name}`;\n\treturn Math.max(1, Math.ceil(line.length / 4));\n}\nconst symbolKey = (s) => `${s.file}::${s.name}::${s.line}`;\nvar RepoMapRetrievalAdapter = class {\n\tindex;\n\tconstructor(options) {\n\t\tif (options.index) this.index = options.index;\n\t\telse if (options.parser && options.corpus) this.index = buildRepoMapIndex({\n\t\t\tparser: options.parser,\n\t\t\tcorpus: options.corpus\n\t\t});\n\t\telse throw new Error(\"RepoMapRetrievalAdapter requires either { index } or { parser, corpus }.\");\n\t}\n\tasync retrieve(request) {\n\t\treturn selectWithinBudget(rankSymbols(this.index.entries.map((entry) => ({\n\t\t\tfile: entry.path,\n\t\t\tparsed: {\n\t\t\t\tdefinitions: entry.definitions,\n\t\t\t\treferences: entry.references\n\t\t\t}\n\t\t})), request), request.tokenBudget);\n\t}\n};\n/** Index every definition in the corpus by its name (a name may be defined in several files). */\nfunction indexDefinitions(parsed) {\n\tconst defsByName = /* @__PURE__ */ new Map();\n\tfor (const { parsed: file } of parsed) for (const def of file.definitions) {\n\t\tconst list = defsByName.get(def.name) ?? [];\n\t\tlist.push(def);\n\t\tdefsByName.set(def.name, list);\n\t}\n\treturn defsByName;\n}\n/** Score each definition by weighted reference count + personalization + mention boost. */\nfunction rankSymbols(parsed, request) {\n\tconst activeFiles = new Set(request.activeFiles ?? []);\n\tconst mentioned = new Set(request.mentionedIdentifiers ?? []);\n\tconst defsByName = indexDefinitions(parsed);\n\tconst scoreByKey = /* @__PURE__ */ new Map();\n\tconst bump = (s, delta) => {\n\t\tscoreByKey.set(symbolKey(s), (scoreByKey.get(symbolKey(s)) ?? 0) + delta);\n\t};\n\tfor (const { file, parsed: source } of parsed) {\n\t\tconst weight = activeFiles.has(file) ? ACTIVE_FILE_WEIGHT : 1;\n\t\tfor (const ref of source.references) for (const def of defsByName.get(ref) ?? []) if (def.file !== file) bump(def, weight);\n\t}\n\tfor (const name of mentioned) for (const def of defsByName.get(name) ?? []) bump(def, MENTION_BOOST);\n\tconst ranked = [];\n\tfor (const defs of defsByName.values()) for (const def of defs) ranked.push({\n\t\t...def,\n\t\tscore: scoreByKey.get(symbolKey(def)) ?? 0,\n\t\ttokens: estimateTokens(def)\n\t});\n\tranked.sort((a, b) => b.score - a.score || a.file.localeCompare(b.file) || a.line - b.line || a.name.localeCompare(b.name));\n\treturn ranked;\n}\n/** Take the most-relevant-first prefix whose cumulative tokens fit the budget. */\nfunction selectWithinBudget(ranked, tokenBudget) {\n\tconst symbols = [];\n\tlet totalTokens = 0;\n\tfor (const entry of ranked) {\n\t\tif (totalTokens + entry.tokens > tokenBudget) break;\n\t\tsymbols.push(entry);\n\t\ttotalTokens += entry.tokens;\n\t}\n\treturn {\n\t\tsymbols,\n\t\ttotalTokens\n\t};\n}\n//#endregion\n//#region src/implementations/function-tool.ts\n/**\n* Helper function to create a function tool from a simple function\n*/\nfunction createFunctionTool(name, description, parameters, fn) {\n\treturn new FunctionTool({\n\t\tname,\n\t\tdescription,\n\t\tparameters\n\t}, fn);\n}\n/**\n* Helper function to create a function tool from Zod schema\n*/\nfunction createZodFunctionTool(name, description, zodSchema, fn, residency = {}) {\n\tconst schema = {\n\t\tname,\n\t\tdescription,\n\t\tparameters: zodToJsonSchema(zodSchema),\n\t\t...residency.deferLoading !== void 0 && { deferLoading: residency.deferLoading }\n\t};\n\tconst wrappedFn = async (parameters, context) => {\n\t\tconst parseResult = zodSchema.safeParse(parameters);\n\t\tif (!parseResult.success) throw new ValidationError(`Zod validation failed: ${parseResult.error}`);\n\t\tconst result = await fn(parseResult.data, context);\n\t\treturn typeof result === \"string\" ? result : JSON.stringify(result);\n\t};\n\treturn new FunctionTool(schema, wrappedFn);\n}\n//#endregion\n//#region src/tool-permission-profiles.ts\n/**\n* What the permission system is told about the tools THIS package defines. CORE-030.\n*\n* The classification used to live in `@robota-sdk/agent-core`'s `permission-mode.ts`, as a matrix\n* keyed on a closed union of product tool names — a vendor-neutral foundation holding a product's\n* tool inventory, two layers below the code that defines it, with nothing coupling the two lists.\n* They drifted: `CodebaseRetrieval` is defined here and the matrix had never heard of it, so a\n* read-only retrieval prompted on every call and was refused outright in plan mode.\n*\n* A tool's own package declares what it does. The foundation decides what each MODE does about that\n* kind of action, and neither restates the other's half.\n*\n* `packages/agent-tools/src/__tests__/tool-permission-profiles.test.ts` asserts that every tool this\n* package produces appears here, so adding a tool without classifying it fails rather than silently\n* inheriting the prompt-on-every-call fallback.\n*/\n/**\n* Every tool this package defines, and what the permission system needs to know about it.\n*\n* `argument.key` is which argument a pattern like `Read(/src/**)` is matched against, and\n* `argument.kind` how (CORE-049: a URL is parsed, a path is segment-wise, a command is a glob). A tool without\n* one cannot be narrowed by an argument pattern at all — the gate treats such a pattern as\n* unevaluable and prompts rather than proceeding, which is why the ones that CAN be narrowed say so.\n*/\nconst AGENT_TOOL_PERMISSION_PROFILES = {\n\tRead: {\n\t\targument: {\n\t\t\tkey: \"filePath\",\n\t\t\tkind: \"path\"\n\t\t},\n\t\triskClass: \"inspect\"\n\t},\n\tGlob: {\n\t\targument: {\n\t\t\tkey: \"pattern\",\n\t\t\tkind: \"text\"\n\t\t},\n\t\triskClass: \"inspect\"\n\t},\n\tGrep: {\n\t\targument: {\n\t\t\tkey: \"pattern\",\n\t\t\tkind: \"text\"\n\t\t},\n\t\triskClass: \"inspect\"\n\t},\n\tWebFetch: {\n\t\targument: {\n\t\t\tkey: \"url\",\n\t\t\tkind: \"url\"\n\t\t},\n\t\triskClass: \"inspect\"\n\t},\n\tWebSearch: {\n\t\targument: {\n\t\t\tkey: \"query\",\n\t\t\tkind: \"text\"\n\t\t},\n\t\triskClass: \"inspect\"\n\t},\n\tCodebaseRetrieval: { riskClass: \"inspect\" },\n\tAskUserQuestion: { riskClass: \"inspect\" },\n\tToolSearch: {\n\t\targument: {\n\t\t\tkey: \"query\",\n\t\t\tkind: \"text\"\n\t\t},\n\t\triskClass: \"inspect\"\n\t},\n\tComputerView: { riskClass: \"inspect\" },\n\tWrite: {\n\t\targument: {\n\t\t\tkey: \"filePath\",\n\t\t\tkind: \"path\"\n\t\t},\n\t\triskClass: \"modify\"\n\t},\n\tEdit: {\n\t\targument: {\n\t\t\tkey: \"filePath\",\n\t\t\tkind: \"path\"\n\t\t},\n\t\triskClass: \"modify\"\n\t},\n\tShell: {\n\t\targument: {\n\t\t\tkey: \"command\",\n\t\t\tkind: \"command\"\n\t\t},\n\t\triskClass: \"execute\",\n\t\taliases: [\"Bash\"]\n\t},\n\tBash: {\n\t\targument: {\n\t\t\tkey: \"command\",\n\t\t\tkind: \"command\"\n\t\t},\n\t\triskClass: \"execute\",\n\t\taliases: [\"Shell\"]\n\t},\n\tComputer: { riskClass: \"execute\" }\n};\n/**\n* Tell the permission system about every tool this package defines. Idempotent.\n*\n* Not exported: the one caller is the line below. A registration a consumer could choose to skip is\n* a registration that might not happen, which is the state this change exists to leave behind.\n*/\nfunction registerAgentToolPermissionProfiles() {\n\tfor (const [toolName, profile] of Object.entries(AGENT_TOOL_PERMISSION_PROFILES)) registerToolPermissionProfile(toolName, profile);\n}\nregisterAgentToolPermissionProfiles();\n//#endregion\n//#region src/retrieval/retrieval-tool.ts\n/**\n* SELFHOST-003: the `CodebaseRetrieval` tool — mirrors the `create*Tool(options)` pattern.\n*\n* Composes over the injected `IRetrievalAdapter` (via `IRetrievalToolOptions`). It carries NO corpus and\n* NO domain content itself — the adapter (built from a surface-supplied parser + corpus) does the\n* ranking. With no adapter the tool reports unavailability (it is added to the default set only when an\n* adapter is present — see `createDefaultTools`).\n*/\n/** Default token budget when the caller does not specify one. */\nconst DEFAULT_TOKEN_BUDGET = 1e3;\nconst RetrievalSchema = z.object({\n\tactiveFiles: z.array(z.string()).optional().describe(\"Repo-relative files currently in focus; the map is ranked toward what they reference.\"),\n\tmentionedIdentifiers: z.array(z.string()).optional().describe(\"Symbol names to bias the map toward (e.g. identifiers named in the task).\"),\n\ttokenBudget: z.number().int().positive().optional().describe(`Maximum tokens for the returned map (default ${DEFAULT_TOKEN_BUDGET}).`)\n});\n/** Render the ranked symbols as a compact, deterministic repo map. */\nfunction formatRepoMap(symbols) {\n\treturn symbols.map((symbol) => `${symbol.file}:${symbol.line}  ${symbol.kind} ${symbol.name}`).join(\"\\n\");\n}\nasync function retrievalTool(args, options = {}) {\n\tif (!options.adapter) return \"Codebase retrieval is not available in this session.\";\n\tconst result = await options.adapter.retrieve({\n\t\t...args.activeFiles ? { activeFiles: args.activeFiles } : {},\n\t\t...args.mentionedIdentifiers ? { mentionedIdentifiers: args.mentionedIdentifiers } : {},\n\t\ttokenBudget: args.tokenBudget ?? DEFAULT_TOKEN_BUDGET\n\t});\n\tif (result.symbols.length === 0) return \"No relevant symbols found within the token budget.\";\n\treturn `Most relevant symbols (~${result.totalTokens} tokens):\\n${formatRepoMap(result.symbols)}`;\n}\nfunction createRetrievalTool(options = {}) {\n\treturn createZodFunctionTool(\"CodebaseRetrieval\", \"Retrieve the most relevant slice of the codebase (a ranked repo map of symbols) for the current task, within a token budget. Provide the files you are focused on and/or identifiers named in the task; returns the highest-centrality definitions first.\", RetrievalSchema, async (params) => retrievalTool(params, options));\n}\n//#endregion\n//#region src/computer-use/computer-tool.ts\n/**\n* SELFHOST-010: the `ComputerView` (perceive) + `Computer` (act) tools — mirror the `create*Tool(options)`\n* pattern, split along the permission boundary.\n*\n* `createComputerTool({ driver })` registers BOTH tool names over one injected `IComputerDriver`. The split\n* is purely the permission-bearing boundary (the repo's own `Read`(auto)-vs-`Shell`(approve) precedent):\n* - `ComputerView` calls `driver.screenshot()` — a perceive with no action argument (gated `auto` like `Read`).\n* - `Computer` takes a single typed mutating `action`, executes it via `driver.act()`, and returns the\n*   resulting screenshot so the model re-perceives (gated `approve`/`deny` like `Shell`).\n*\n* The typed action union stays WHOLE in the driver contract (`./types.ts`); this file only maps the\n* tool-boundary argument onto it. With no driver the tools report unavailability — they are added to the\n* default set ONLY when a driver is present (adapter-gated; there is NO host fallback — see\n* `createDefaultTools`).\n*/\nconst UNAVAILABLE_MESSAGE = \"Computer use is not available in this session (no driver injected).\";\nconst MouseButtonSchema = z.enum([\n\t\"left\",\n\t\"right\",\n\t\"middle\"\n]);\nconst PointSchema = z.object({\n\tx: z.number(),\n\ty: z.number()\n});\n/**\n* The `Computer` action argument. A flat object (not a discriminated union) so it converts to JSON schema\n* — `type` selects the action and the remaining fields are validated per type in {@link buildAction}. The\n* strongly-typed discriminated union lives in the driver contract (`TComputerAction`).\n*/\nconst ActionSchema = z.object({\n\ttype: z.enum([\n\t\t\"click\",\n\t\t\"double_click\",\n\t\t\"type\",\n\t\t\"keypress\",\n\t\t\"scroll\",\n\t\t\"drag\",\n\t\t\"wait\",\n\t\t\"takeover\"\n\t]).describe(\"Which action to perform.\"),\n\tx: z.number().optional().describe(\"X coordinate (click/double_click/scroll).\"),\n\ty: z.number().optional().describe(\"Y coordinate (click/double_click/scroll).\"),\n\tbutton: MouseButtonSchema.optional().describe(\"Mouse button (click/double_click/drag).\"),\n\ttext: z.string().optional().describe(\"Text to type (type).\"),\n\tkeys: z.array(z.string()).optional().describe(\"Keys to press as a chord (keypress).\"),\n\tdeltaX: z.number().optional().describe(\"Horizontal wheel delta (scroll).\"),\n\tdeltaY: z.number().optional().describe(\"Vertical wheel delta (scroll).\"),\n\tpath: z.array(PointSchema).optional().describe(\"Points to drag through (drag).\"),\n\tms: z.number().optional().describe(\"Milliseconds to wait (wait).\"),\n\treason: z.string().optional().describe(\"Human-readable reason surfaced to the user (takeover).\")\n});\nconst ComputerSchema = z.object({ action: ActionSchema.describe(\"The single mutating action to perform.\") });\nconst ComputerViewSchema = z.object({});\n/** Raised when the tool-boundary action argument is missing fields the action type requires. */\nvar InvalidComputerActionError = class extends Error {};\nfunction requireNumber(value, field, type) {\n\tif (typeof value !== \"number\") throw new InvalidComputerActionError(`Action '${type}' requires numeric '${field}'.`);\n\treturn value;\n}\n/** Map the flat tool-boundary argument onto the strongly-typed driver action union. */\nfunction buildAction(args) {\n\tconst button = args.button;\n\tswitch (args.type) {\n\t\tcase \"click\": return {\n\t\t\ttype: \"click\",\n\t\t\tx: requireNumber(args.x, \"x\", \"click\"),\n\t\t\ty: requireNumber(args.y, \"y\", \"click\"),\n\t\t\t...button ? { button } : {}\n\t\t};\n\t\tcase \"double_click\": return {\n\t\t\ttype: \"double_click\",\n\t\t\tx: requireNumber(args.x, \"x\", \"double_click\"),\n\t\t\ty: requireNumber(args.y, \"y\", \"double_click\"),\n\t\t\t...button ? { button } : {}\n\t\t};\n\t\tcase \"type\":\n\t\t\tif (typeof args.text !== \"string\") throw new InvalidComputerActionError(\"Action 'type' requires 'text'.\");\n\t\t\treturn {\n\t\t\t\ttype: \"type\",\n\t\t\t\ttext: args.text\n\t\t\t};\n\t\tcase \"keypress\":\n\t\t\tif (!args.keys || args.keys.length === 0) throw new InvalidComputerActionError(\"Action 'keypress' requires non-empty 'keys'.\");\n\t\t\treturn {\n\t\t\t\ttype: \"keypress\",\n\t\t\t\tkeys: args.keys\n\t\t\t};\n\t\tcase \"scroll\": return {\n\t\t\ttype: \"scroll\",\n\t\t\tx: requireNumber(args.x, \"x\", \"scroll\"),\n\t\t\ty: requireNumber(args.y, \"y\", \"scroll\"),\n\t\t\tdeltaX: requireNumber(args.deltaX, \"deltaX\", \"scroll\"),\n\t\t\tdeltaY: requireNumber(args.deltaY, \"deltaY\", \"scroll\")\n\t\t};\n\t\tcase \"drag\":\n\t\t\tif (!args.path || args.path.length < 2) throw new InvalidComputerActionError(\"Action 'drag' requires a 'path' of at least two points.\");\n\t\t\treturn {\n\t\t\t\ttype: \"drag\",\n\t\t\t\tpath: args.path,\n\t\t\t\t...button ? { button } : {}\n\t\t\t};\n\t\tcase \"wait\": return {\n\t\t\ttype: \"wait\",\n\t\t\t...typeof args.ms === \"number\" ? { ms: args.ms } : {}\n\t\t};\n\t\tcase \"takeover\": return {\n\t\t\ttype: \"takeover\",\n\t\t\t...args.reason ? { reason: args.reason } : {}\n\t\t};\n\t\tdefault: {\n\t\t\tconst exhaustive = args.type;\n\t\t\tthrow new InvalidComputerActionError(`Unknown action type: ${String(exhaustive)}`);\n\t\t}\n\t}\n}\n/** `ComputerView` — perceive the current surface (returns a screenshot). Gated `auto` like `Read`. */\nasync function perceive(options) {\n\tif (!options.driver) return JSON.stringify({\n\t\tsuccess: false,\n\t\terror: UNAVAILABLE_MESSAGE\n\t});\n\tconst screenshot = await options.driver.screenshot();\n\treturn JSON.stringify(screenshot ? {\n\t\tsuccess: true,\n\t\tscreenshot\n\t} : {\n\t\tsuccess: true,\n\t\ttakeover: true\n\t});\n}\n/** `Computer` — execute one typed mutating action and return the resulting screenshot. Gated like `Shell`. */\nasync function act(args, options) {\n\tif (!options.driver) return JSON.stringify({\n\t\tsuccess: false,\n\t\terror: UNAVAILABLE_MESSAGE\n\t});\n\tlet action;\n\ttry {\n\t\taction = buildAction(args.action);\n\t} catch (err) {\n\t\treturn JSON.stringify({\n\t\t\tsuccess: false,\n\t\t\terror: err instanceof Error ? err.message : String(err)\n\t\t});\n\t}\n\tconst outcome = await options.driver.act(action);\n\tconst result = {\n\t\tsuccess: true,\n\t\t...outcome.screenshot ? { screenshot: outcome.screenshot } : {},\n\t\t...outcome.takeover ? { takeover: true } : {}\n\t};\n\treturn JSON.stringify(result);\n}\n/** Build the `ComputerView` perceive tool over the injected driver. */\nfunction createComputerViewTool(options = {}) {\n\treturn createZodFunctionTool(\"ComputerView\", \"Perceive the computer/browser surface: capture and return a screenshot of the current screen so you can reason about what to do next. Read-only — it never changes anything.\", ComputerViewSchema, async () => perceive(options));\n}\n/** Build the `Computer` act tool over the injected driver. */\nfunction createComputerActTool(options = {}) {\n\treturn createZodFunctionTool(\"Computer\", \"Perform one mutating action on the computer/browser surface (click, double_click, type, keypress, scroll, drag, wait, or takeover) and return the resulting screenshot. Use `takeover` to hand control to the human for sensitive input (credentials/payment); perception is paused during a takeover.\", ComputerSchema, async (params) => act(params, options));\n}\n/**\n* Create BOTH computer-use tools — `ComputerView` (perceive) and `Computer` (act) — over one injected\n* driver. Mirrors `create*Tool(options)`; returns the pair so the assembly layer can spread them into the\n* default set adapter-gated (see `createDefaultTools`).\n*/\nfunction createComputerTool(options = {}) {\n\treturn [createComputerViewTool(options), createComputerActTool(options)];\n}\n//#endregion\n//#region src/computer-use/page-computer-driver.ts\nconst DEFAULT_MEDIA_TYPE = \"image/png\";\nconst DEFAULT_WAIT_MS = 500;\n/** Encode raw screenshot bytes to base64 (accepts the page's `Uint8Array` or an already-encoded string). */\nfunction encodeScreenshot(bytes) {\n\tif (typeof bytes === \"string\") return bytes;\n\treturn Buffer.from(bytes).toString(\"base64\");\n}\nvar PageComputerDriver = class {\n\tpage;\n\tmediaType;\n\tdefaultWaitMs;\n\tsuspended = false;\n\tconstructor(options) {\n\t\tthis.page = options.page;\n\t\tthis.mediaType = options.mediaType ?? DEFAULT_MEDIA_TYPE;\n\t\tthis.defaultWaitMs = options.defaultWaitMs ?? DEFAULT_WAIT_MS;\n\t}\n\tasync capture() {\n\t\tconst type = this.mediaType === \"image/jpeg\" ? \"jpeg\" : \"png\";\n\t\treturn {\n\t\t\tdata: encodeScreenshot(await this.page.screenshot({ type })),\n\t\t\tmediaType: this.mediaType\n\t\t};\n\t}\n\tasync wait(ms) {\n\t\tif (this.page.waitForTimeout) {\n\t\t\tawait this.page.waitForTimeout(ms);\n\t\t\treturn;\n\t\t}\n\t\tawait new Promise((resolve) => setTimeout(resolve, ms));\n\t}\n\tasync screenshot() {\n\t\tif (this.suspended) return;\n\t\treturn this.capture();\n\t}\n\tasync act(action) {\n\t\tif (action.type === \"takeover\") {\n\t\t\tawait this.beginTakeover(action.reason);\n\t\t\treturn { takeover: true };\n\t\t}\n\t\tif (this.suspended) return { takeover: true };\n\t\tconst { mouse, keyboard } = this.page;\n\t\tswitch (action.type) {\n\t\t\tcase \"click\":\n\t\t\t\tawait mouse.click(action.x, action.y, action.button ? { button: action.button } : void 0);\n\t\t\t\tbreak;\n\t\t\tcase \"double_click\":\n\t\t\t\tawait mouse.click(action.x, action.y, {\n\t\t\t\t\tclickCount: 2,\n\t\t\t\t\t...action.button ? { button: action.button } : {}\n\t\t\t\t});\n\t\t\t\tbreak;\n\t\t\tcase \"type\":\n\t\t\t\tawait keyboard.type(action.text);\n\t\t\t\tbreak;\n\t\t\tcase \"keypress\":\n\t\t\t\tawait keyboard.press(action.keys.join(\"+\"));\n\t\t\t\tbreak;\n\t\t\tcase \"scroll\":\n\t\t\t\tawait mouse.move(action.x, action.y);\n\t\t\t\tawait mouse.wheel(action.deltaX, action.deltaY);\n\t\t\t\tbreak;\n\t\t\tcase \"drag\":\n\t\t\t\tawait this.performDrag(action);\n\t\t\t\tbreak;\n\t\t\tcase \"wait\":\n\t\t\t\tawait this.wait(action.ms ?? this.defaultWaitMs);\n\t\t\t\tbreak;\n\t\t}\n\t\treturn { screenshot: await this.capture() };\n\t}\n\t/** Move the pointer along a multi-point path with the button held (mouse down → moves → up). */\n\tasync performDrag(action) {\n\t\tif (action.path.length < 2) throw new Error(\"computer drag requires a path of at least 2 points (start + end)\");\n\t\tconst { mouse } = this.page;\n\t\tconst [first, ...rest] = action.path;\n\t\tconst button = action.button ? { button: action.button } : void 0;\n\t\tawait mouse.move(first.x, first.y);\n\t\tawait mouse.down(button);\n\t\tfor (const point of rest) await mouse.move(point.x, point.y);\n\t\tawait mouse.up(button);\n\t}\n\tasync beginTakeover(_reason) {\n\t\tthis.suspended = true;\n\t}\n\tasync endTakeover() {\n\t\tthis.suspended = false;\n\t}\n};\n//#endregion\n//#region src/builtins/shell-tool-description.ts\n/**\n* Dedicated-tool routing hints, keyed by the sibling tool's registered name. A hint is only\n* emitted when that sibling is actually part of the registered tool set (NEUT-002) — the\n* description must not route the model to tools that do not exist in a given assembly.\n*/\nconst SIBLING_ROUTING_HINTS = [\n\t{\n\t\ttoolName: \"Glob\",\n\t\thint: \" - File search: Use Glob (NOT find or ls)\"\n\t},\n\t{\n\t\ttoolName: \"Grep\",\n\t\thint: \" - Content search: Use Grep (NOT grep or rg)\"\n\t},\n\t{\n\t\ttoolName: \"Read\",\n\t\thint: \" - Read files: Use Read (NOT cat/head/tail)\"\n\t},\n\t{\n\t\ttoolName: \"Edit\",\n\t\thint: \" - Edit files: Use Edit (NOT sed/awk)\"\n\t}\n];\n/**\n* Build the OS-aware tool description so the model writes syntax the host shell can run.\n* When `availableTools` is provided, sibling routing hints are restricted to tools in that set;\n* when omitted, the full default hint set is included (default assembly registers all siblings).\n*/\nfunction buildShellToolDescription(shell, availableTools) {\n\tconst hints = availableTools ? SIBLING_ROUTING_HINTS.filter((entry) => availableTools.includes(entry.toolName)) : SIBLING_ROUTING_HINTS;\n\tconst routingBlock = hints.length > 0 ? [`IMPORTANT: Avoid using this tool to run \\`find\\`, \\`grep\\`, \\`cat\\`, \\`head\\`, \\`tail\\`, \\`sed\\`, \\`awk\\`, or \\`echo\\` commands. Instead, use the appropriate dedicated tool:`, ...hints.map((entry) => entry.hint)] : [];\n\treturn [\n\t\t`Executes a command in the host shell and returns its output.`,\n\t\t``,\n\t\t`Active shell: ${shell.label}. ${shell.syntaxHint}`,\n\t\t``,\n\t\t`Each command runs in a fresh shell in workingDirectory (default: the configured working directory); no shell state carries over between calls.`,\n\t\t``,\n\t\t...routingBlock\n\t].join(\"\\n\");\n}\n//#endregion\n//#region src/builtins/shell-tool.ts\n/**\n* ShellTool — execute a host shell command via child_process.spawn (TERM-008).\n*\n* Cross-platform: the shell is resolved per OS through `resolvePlatformShell()` (POSIX `sh`/`bash`,\n* Windows PowerShell). The tool name is `Shell` and its description is built dynamically from the\n* resolved shell so the model is told the active shell/OS and writes the right syntax.\n*\n* Returns an IToolInvocationResult JSON string. A non-zero exit is returned as success:true with\n* exitCode set (the command ran, it just exited non-zero — the LLM decides what to do with that).\n*\n* ## SEC-007 — why `workingDirectory` is NOT path-contained (a deliberate decision, not an omission)\n*\n* `Read`/`Write`/`Edit` are contained by `checkPathWithinCwd`, and SEC-007 extended that to `Glob`\n* and `Grep`. This tool is deliberately excluded, and the reason is what the tool IS: it runs an\n* arbitrary command in a shell. A guard on `cwd` is undone by the first `cd ..` — or by an absolute\n* path in the command itself — so it would constrain nothing an attacker-controlled command cannot\n* trivially step around, while LOOKING like a boundary in the code and in review.\n*\n* That appearance is the actual hazard. SEC-006's R9 lesson was \"'the guard is still there' is not a\n* verdict\": a check that reads as containment but is not one is worse than no check, because the next\n* reviewer stops asking. The real boundary for this tool is the permission layer (every invocation is\n* permission-gated at call time) and the sandbox seam below — which is why SEC-006 already recorded\n* `js/indirect-command-line-injection` at the spawn site as a false positive on those same grounds.\n*\n* What the containment root DOES do here: it supplies the DEFAULT working directory. Binding a tool\n* to a session root and then silently running its commands in `process.cwd()` was a real defect — an\n* assembly that scoped its file tools to a workspace still ran `Shell` wherever the host process\n* happened to be started.\n*/\n/** POSIX children are spawned detached so a process-group kill reaps grandchildren (CORE-023). */\nconst SPAWN_DETACHED = process.platform !== \"win32\";\nconst DEFAULT_TIMEOUT_MS$2 = 12e4;\n/** ARCH-056: most bytes retained per stream while the child runs (head); the rest is dropped. */\nconst MAX_CAPTURED_OUTPUT_BYTES = 2e6;\nconst ShellSchema = z.object({\n\tcommand: z.string().describe(\"The shell command to execute\"),\n\ttimeout: z.number().optional().describe(\"Optional timeout in milliseconds (max 600000). Default is 120000 (2 minutes)\"),\n\tworkingDirectory: z.string().optional().describe(\"Working directory for the command. Defaults to the current working directory\")\n});\n/** Run a shell command through the sandbox client, surfacing failures as a structured result. */\nasync function runInSandbox(command, timeout, workingDirectory, options) {\n\ttry {\n\t\tconst sandboxResult = await options.sandboxClient.run(command, {\n\t\t\ttimeoutMs: timeout,\n\t\t\tworkingDirectory\n\t\t});\n\t\tconst result = {\n\t\t\tsuccess: true,\n\t\t\toutput: sandboxResult.stderr ? `${sandboxResult.stdout}\\nstderr:\\n${sandboxResult.stderr}` : sandboxResult.stdout,\n\t\t\texitCode: sandboxResult.exitCode\n\t\t};\n\t\treturn JSON.stringify(result);\n\t} catch (err) {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: err instanceof Error ? err.message : String(err)\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n}\n/**\n* Run a shell command and return stdout + stderr.\n* Resolves with the IToolInvocationResult JSON string.\n*/\nasync function runShell(args, options, shell, signal, traceEnv) {\n\tconst { command, timeout: rawTimeout = DEFAULT_TIMEOUT_MS$2, workingDirectory } = args;\n\tconst timeout = Math.min(rawTimeout, 6e5);\n\tconst effectiveCwd = workingDirectory ?? options.cwd;\n\tif (effectiveCwd === void 0) return JSON.stringify({\n\t\tsuccess: false,\n\t\toutput: \"\",\n\t\terror: \"Shell tool has no working directory: it was constructed without a `cwd` (ARCH-010). This is an assembly bug — the tool would otherwise run in whatever directory the host process was started in.\"\n\t});\n\tif (options.sandboxClient && options.sandboxClient.wrapCommand === void 0) return runInSandbox(command, timeout, workingDirectory ?? options.cwd, options);\n\tconst hostInvocation = {\n\t\tcommand: shell.command,\n\t\targs: shell.commandArgs(command),\n\t\tcwd: effectiveCwd\n\t};\n\tconst invocation = options.sandboxClient?.wrapCommand?.(hostInvocation, command) ?? hostInvocation;\n\tlet released = false;\n\tconst release = () => {\n\t\tif (released) return void 0;\n\t\treleased = true;\n\t\ttry {\n\t\t\treturn invocation.afterExit?.();\n\t\t} catch (error) {\n\t\t\treturn `[sandbox] clean-up failed: ${error instanceof Error ? error.message : String(error)}`;\n\t\t}\n\t};\n\tif (signal?.aborted) {\n\t\trelease();\n\t\treturn JSON.stringify({\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: \"Aborted before start\"\n\t\t});\n\t}\n\treturn new Promise((resolve) => {\n\t\tconst stdoutOutput = createBoundedOutput({ maxBytes: MAX_CAPTURED_OUTPUT_BYTES });\n\t\tconst stderrOutput = createBoundedOutput({ maxBytes: MAX_CAPTURED_OUTPUT_BYTES });\n\t\tlet timedOut = false;\n\t\tlet settled = false;\n\t\tlet child;\n\t\ttry {\n\t\t\tchild = spawn(invocation.command, [...invocation.args], {\n\t\t\t\tcwd: invocation.cwd,\n\t\t\t\tenv: traceEnv === void 0 ? process.env : subprocessTraceEnvironment(process.env, traceEnv),\n\t\t\t\tstdio: [\n\t\t\t\t\t\"pipe\",\n\t\t\t\t\t\"pipe\",\n\t\t\t\t\t\"pipe\",\n\t\t\t\t\t...(invocation.inputDescriptors ?? []).map(() => \"pipe\")\n\t\t\t\t],\n\t\t\t\tdetached: SPAWN_DETACHED\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tconst note = release();\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tresolve(JSON.stringify({\n\t\t\t\tsuccess: false,\n\t\t\t\toutput: note ?? \"\",\n\t\t\t\terror: message\n\t\t\t}));\n\t\t\treturn;\n\t\t}\n\t\t(invocation.inputDescriptors ?? []).forEach((data, index) => {\n\t\t\tconst stream = child.stdio[index + 3];\n\t\t\tstream?.on(\"error\", () => void 0);\n\t\t\tstream?.end(Buffer.from(data));\n\t\t});\n\t\tchild.stdin?.end();\n\t\tchild.stdout?.on(\"data\", (chunk) => {\n\t\t\tstdoutOutput.append(chunk);\n\t\t});\n\t\tchild.stderr?.on(\"data\", (chunk) => {\n\t\t\tstderrOutput.append(chunk);\n\t\t});\n\t\tconst timer = setTimeout(() => {\n\t\t\ttimedOut = true;\n\t\t\tkillProcessTree(child, { processGroup: SPAWN_DETACHED });\n\t\t\tsettle({\n\t\t\t\tsuccess: false,\n\t\t\t\toutput: stdoutOutput.toString(),\n\t\t\t\terror: `Command timed out after ${timeout}ms`\n\t\t\t});\n\t\t}, timeout);\n\t\tfunction settle(result) {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timer);\n\t\t\tsignal?.removeEventListener(\"abort\", onAbort);\n\t\t\tresolve(JSON.stringify(result));\n\t\t}\n\t\tfunction onAbort() {\n\t\t\tkillProcessTree(child, { processGroup: SPAWN_DETACHED });\n\t\t\tsettle({\n\t\t\t\tsuccess: false,\n\t\t\t\toutput: stdoutOutput.toString(),\n\t\t\t\terror: \"Aborted\"\n\t\t\t});\n\t\t}\n\t\tsignal?.addEventListener(\"abort\", onAbort, { once: true });\n\t\tchild.on(\"error\", (err) => {\n\t\t\tif (child.pid === void 0) release();\n\t\t\tsettle({\n\t\t\t\tsuccess: false,\n\t\t\t\toutput: \"\",\n\t\t\t\terror: err.message\n\t\t\t});\n\t\t});\n\t\tchild.on(\"close\", (code) => {\n\t\t\tconst note = release();\n\t\t\tif (timedOut) {\n\t\t\t\tsettle({\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\toutput: stdoutOutput.toString(),\n\t\t\t\t\terror: `Command timed out after ${timeout}ms`,\n\t\t\t\t\texitCode: code ?? void 0\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst stdout = stdoutOutput.toString();\n\t\t\tconst stderr = stderrOutput.toString();\n\t\t\tconst exitCode = code ?? 0;\n\t\t\tconst combined = stderr ? `${stdout}\\nstderr:\\n${stderr}` : stdout;\n\t\t\tsettle({\n\t\t\t\tsuccess: true,\n\t\t\t\toutput: note === void 0 ? combined : `${combined}\\n${note}`,\n\t\t\t\texitCode\n\t\t\t});\n\t\t});\n\t});\n}\n/**\n* Build a host-shell command tool under a given registered name. Both `Shell` and the\n* model-familiar `Bash` are registered as aliases of this one OS-aware implementation\n* (TERM-008): the shell is resolved per OS and the description names the active shell so the\n* model writes the right syntax regardless of which alias it calls.\n*/\nfunction createHostShellTool(name, options) {\n\tconst shell = resolvePlatformShell({ executable: options.shellExecutable });\n\treturn createZodFunctionTool(name, options.description ?? buildShellToolDescription(shell, options.availableTools), ShellSchema, async (params, context) => {\n\t\treturn runShell(params, options, shell, context?.signal, context?.shellTraceEnv);\n\t});\n}\n/**\n* Create a `Shell` tool instance — register with the Robota agent tools registry.\n* The description is resolved at creation time for the host's active shell.\n*/\nfunction createShellTool(options) {\n\treturn createHostShellTool(\"Shell\", options);\n}\n/**\n* Create a `Bash` tool instance — the model-familiar alias of the same OS-aware shell tool.\n*/\nfunction createBashTool(options) {\n\treturn createHostShellTool(\"Bash\", options);\n}\n//#endregion\n//#region src/builtins/path-guard.ts\n/**\n* Returns a JSON-serialized IToolInvocationResult error when filePath is outside cwd, or when NO\n* containment root is configured. Returns undefined only when the path is inside a configured root.\n*\n* This sentence used to end \"or cwd is not set\" — the fail-open default ARCH-010 removed. It sat\n* directly above the two functions that implement the distinction, which is the worst place for a\n* comment to say the opposite of the code.\n*\n* SEC-006: containment is decided on the CANONICAL (symlink-resolved) paths, via the shared\n* `isPathInside` SSOT in agent-core. A purely lexical `resolve()` + `startsWith` comparison let\n* `<cwd>/link/secret` through when `link -> /etc`, because `resolve` does not consult the filesystem\n* and so cannot see a symlink — while the subsequent `readFile`/`writeFile` followed the link out of\n* the sandbox. For `Write`/`Edit` that meant creating files anywhere the process could reach, and\n* since symlinks are ordinary committed git content, pointing the agent at an untrusted clone was\n* enough to arm it.\n*\n* The same defect existed in the CLI's monitor asset server; both now share one implementation,\n* because two containment checks that can disagree are their own defect.\n*/\n/**\n* Whether a host path is inside the tool's containment root — the single predicate every builtin\n* asks, whatever it does with the answer.\n*\n* `checkPathWithinCwd` turns a `false` into the tool-result error a tool RETURNS; the enumerating\n* tools (`Glob`, `Grep`) instead SKIP the entry mid-walk and must not fabricate an error per file.\n* Both ask this one question, which asks agent-core's `isPathInside` SSOT — so there is no second\n* containment rule that could disagree with the first (SEC-006's stated defect, SEC-007 keeping it\n* true as the guard's reach widens).\n*\n* `cwd === undefined` means no containment root is configured, and the answer is NO — ARCH-010.\n*\n* This used to return `true` there: with no root, everything was inside it. A guard whose default is\n* \"allow\" is not a guard, it is a guard that has to be remembered, and the architecture audit found\n* three independent layers that had forgotten. `pack-coding` had already written the consequence into\n* its own source — \"file tools constructed with no options carry a DISARMED working-directory guard:\n* their `Read` will happily return `/etc/hostname`\" — and the child-process subagent worker called\n* `createDefaultTools()` with no argument, so a subagent got exactly that. Measured, not inferred:\n* before this change a rootless `Read` of `/etc/hostname` returned the file.\n*\n* Refusing instead means a construction site that forgets the root fails loudly on its first file\n* access rather than silently running unconfined. The root is also required by the tool factories now,\n* so reaching this branch at all is an assembly bug — which is why the error says so specifically\n* rather than reporting an ordinary out-of-root path.\n*/\nfunction isWithinCwd(filePath, cwd) {\n\tif (cwd === void 0) return false;\n\treturn isPathInside(cwd, filePath);\n}\n/**\n* Where a RELATIVE host path the model supplied is anchored: the containment root, never\n* `process.cwd()` (issue #2429). `Read`/`Write`/`Edit` declare `filePath` absolute, but nothing\n* makes the model comply, and `isPathInside` canonicalises a relative candidate against the PROCESS\n* directory — so a relative path was confined to one root and judged against another. Same rule as\n* `resolveSearchRoot` for the enumerating tools. With no root there is nothing to anchor to; the path\n* is returned as written and `checkPathWithinCwd` refuses it (ARCH-010).\n*/\nfunction resolveHostPath(filePath, cwd) {\n\tif (cwd === void 0) return filePath;\n\treturn resolve(cwd, filePath);\n}\nfunction checkPathWithinCwd(filePath, cwd) {\n\tif (cwd === void 0) {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: `Access denied: \"${filePath}\" cannot be checked because no containment root is configured for this tool. This is an assembly bug, not a path problem — the tool was constructed without a \\`cwd\\`, so it has no boundary to enforce (ARCH-010).`\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n\tif (!isWithinCwd(filePath, cwd)) {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: `Access denied: \"${filePath}\" is outside the working directory`\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n}\n/**\n* Resolve an LLM-supplied search root for an ENUMERATING tool, and refuse one that escapes (SEC-007).\n*\n* A relative `requested` anchors to the CONTAINMENT ROOT, not to `process.cwd()`: anchoring them to\n* two different directories is how a \"contained\" search silently starts somewhere else. `error`\n* carries the tool-result JSON to return, or is `undefined` when the root is allowed.\n*\n* With no root there is nothing to anchor to, so this refuses rather than reaching for the process\n* directory (ARCH-010). The previous `cwd ?? process.cwd()` was that reach: harmless once the guard\n* below refuses anyway, but it read as a supported fallback, which is the pattern being removed.\n*/\nfunction resolveSearchRoot(requested, cwd) {\n\tif (cwd === void 0) return {\n\t\troot: \"\",\n\t\terror: checkPathWithinCwd(requested ?? \"\", void 0)\n\t};\n\tconst root = requested ? resolve(cwd, requested) : cwd;\n\treturn {\n\t\troot,\n\t\terror: checkPathWithinCwd(root, cwd)\n\t};\n}\n//#endregion\n//#region src/builtins/read-tool.ts\n/**\n* ReadTool — read a file and return its contents with line numbers (cat -n style).\n*\n* Supports offset/limit for partial reads. Detects binary files and refuses to\n* return their raw bytes. Default limit is 2000 lines.\n*/\nconst DEFAULT_READ_DESCRIPTION = \"Reads a file from the local filesystem.\\n\\nBy default, reads up to 2000 lines from the beginning of the file. You can optionally specify offset and limit for partial reads.\\n\\nResults are returned using cat -n format, with line numbers starting at 1.\\n\\nThe filePath parameter must be an absolute path, not a relative path.\";\nconst DEFAULT_LIMIT$1 = 2e3;\nconst MAX_READ_BYTES = 4 * 1024 * 1024;\nconst READ_CHUNK_BYTES$2 = 64 * 1024;\n/** A budget refusal is a hard failure so a workflow cannot treat it as file content. */\nvar ReadByteLimitError = class extends ToolExecutionError {\n\tboundary;\n\tconstructor(boundary) {\n\t\tsuper(`Read ${boundary} exceeds its UTF-8 byte limit`, \"Read\");\n\t\tthis.boundary = boundary;\n\t}\n};\n/** Abort is a hard failure; the workflow must not accept a partial read. */\nvar ReadCancelledError = class extends ToolExecutionError {\n\tconstructor() {\n\t\tsuper(\"Read cancelled\", \"Read\");\n\t}\n};\nconst ReadSchema = z.object({\n\tfilePath: z.string().describe(\"The absolute path to the file to read\"),\n\toffset: z.number().optional().describe(\"The line number to start reading from (1-based). Only provide if the file is too large to read at once\"),\n\tlimit: z.number().optional().describe(`The number of lines to read (default: ${DEFAULT_LIMIT$1}). Only provide if the file is too large to read at once`)\n});\n/**\n* Heuristic binary detection: scan the first 8 KB for null bytes.\n*/\nfunction isBinary(buffer) {\n\tconst checkLength = Math.min(buffer.length, 8192);\n\tfor (let i = 0; i < checkLength; i++) if (buffer[i] === 0) return true;\n\treturn false;\n}\n/**\n* Format lines with 1-based line numbers in cat -n style.\n* Pads line number to the width of the highest line number.\n*/\nfunction formatWithLineNumbers(lines, startLine) {\n\tconst lastLineNum = startLine + lines.length - 1;\n\tconst width = String(lastLineNum).length;\n\treturn lines.map((line, idx) => {\n\t\treturn `${String(startLine + idx).padStart(width, \" \")}\\t${line}`;\n\t}).join(\"\\n\");\n}\nfunction formatReadResult(filePath, content, startLine, limit) {\n\tconst selectedLines = [];\n\tlet selectedMinimumBytes = 0;\n\tlet totalLines = 0;\n\tlet lineStart = 0;\n\tconst selectedStart = Math.trunc(startLine - 1);\n\tconst selectedEnd = Math.trunc(startLine - 1 + limit);\n\twhile (lineStart < content.length) {\n\t\tconst newline = content.indexOf(\"\\n\", lineStart);\n\t\tconst lineEnd = newline === -1 ? content.length : newline;\n\t\ttotalLines++;\n\t\tif (totalLines > selectedStart && totalLines <= selectedEnd) {\n\t\t\tconst line = content.slice(lineStart, lineEnd);\n\t\t\tselectedMinimumBytes += Buffer.byteLength(line, \"utf8\") + String(startLine + selectedLines.length).length + 1;\n\t\t\tif (selectedMinimumBytes > MAX_READ_BYTES) throw new ReadByteLimitError(\"output\");\n\t\t\tselectedLines.push(line);\n\t\t}\n\t\tif (newline === -1) break;\n\t\tlineStart = newline + 1;\n\t}\n\tconst returnedLines = selectedLines.length;\n\tconst header = returnedLines < totalLines ? `[File: ${filePath} (lines ${startLine}-${startLine + returnedLines - 1} of ${totalLines})]\\n` : `[File: ${filePath} (${totalLines} lines)]\\n`;\n\tconst width = String(startLine + returnedLines - 1).length;\n\tlet outputBytes = Buffer.byteLength(header, \"utf8\") + Math.max(0, returnedLines - 1);\n\tfor (const line of selectedLines) outputBytes += width + 1 + Buffer.byteLength(line, \"utf8\");\n\tif (outputBytes > MAX_READ_BYTES) throw new ReadByteLimitError(\"output\");\n\tconst result = {\n\t\tsuccess: true,\n\t\toutput: header + formatWithLineNumbers(selectedLines, startLine)\n\t};\n\treturn JSON.stringify(result);\n}\nasync function readFileTool(args, options) {\n\tif (options.signal?.aborted) throw new ReadCancelledError();\n\tconst { offset, limit = DEFAULT_LIMIT$1 } = args;\n\tconst filePath = options.sandboxClient ? args.filePath : resolveHostPath(args.filePath, options.cwd);\n\tconst startLine = offset !== void 0 && offset > 0 ? offset : 1;\n\tif (options.sandboxClient) try {\n\t\tconst content = await options.sandboxClient.readFile(filePath);\n\t\tif (options.signal?.aborted) throw new ReadCancelledError();\n\t\tif (Buffer.byteLength(content, \"utf8\") > MAX_READ_BYTES) throw new ReadByteLimitError(\"input\");\n\t\treturn formatReadResult(filePath, content, startLine, limit);\n\t} catch (err) {\n\t\tif (err instanceof ReadByteLimitError || err instanceof ReadCancelledError) throw err;\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: err instanceof Error ? err.message : String(err)\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n\tconst pathError = checkPathWithinCwd(filePath, options.cwd);\n\tif (pathError !== void 0) return pathError;\n\tlet fileStats;\n\ttry {\n\t\tfileStats = await stat(filePath);\n\t} catch (err) {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: `File not found: ${filePath}`\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n\tif (!fileStats.isFile()) {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: `Path is not a file: ${filePath}`\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n\tlet buffer = Buffer.alloc(0);\n\tlet binaryFile = false;\n\ttry {\n\t\tconst handle = await open(filePath, \"r\");\n\t\ttry {\n\t\t\tconst chunks = [];\n\t\t\tconst chunk = Buffer.allocUnsafe(READ_CHUNK_BYTES$2);\n\t\t\tlet bytes = 0;\n\t\t\tlet binaryCheckedBytes = 0;\n\t\t\twhile (bytes <= MAX_READ_BYTES) {\n\t\t\t\tif (options.signal?.aborted) throw new ReadCancelledError();\n\t\t\t\tconst { bytesRead } = await handle.read(chunk, 0, Math.min(chunk.length, 4194305 - bytes), null);\n\t\t\t\tif (bytesRead === 0) break;\n\t\t\t\tconst binaryCheckLength = Math.min(bytesRead, 8192 - binaryCheckedBytes);\n\t\t\t\tif (binaryCheckLength > 0 && isBinary(chunk.subarray(0, binaryCheckLength))) {\n\t\t\t\t\tbinaryFile = true;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tbinaryCheckedBytes += binaryCheckLength;\n\t\t\t\tbytes += bytesRead;\n\t\t\t\tif (bytes > MAX_READ_BYTES) throw new ReadByteLimitError(\"input\");\n\t\t\t\tchunks.push(Buffer.from(chunk.subarray(0, bytesRead)));\n\t\t\t}\n\t\t\tif (!binaryFile) buffer = Buffer.concat(chunks, bytes);\n\t\t} finally {\n\t\t\tawait handle.close();\n\t\t}\n\t} catch (err) {\n\t\tif (err instanceof ReadByteLimitError || err instanceof ReadCancelledError) throw err;\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: err instanceof Error ? err.message : String(err)\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n\tif (options.signal?.aborted) throw new ReadCancelledError();\n\tif (binaryFile) {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: `Binary file not supported: ${filePath}`\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n\treturn formatReadResult(filePath, buffer.toString(\"utf8\"), startLine, limit);\n}\n/**\n* Create a ReadTool instance — register with Robota agent tools registry.\n*/\nfunction createReadTool(options) {\n\treturn createZodFunctionTool(\"Read\", options.description ?? DEFAULT_READ_DESCRIPTION, ReadSchema, async (params) => {\n\t\treturn readFileTool(params, options);\n\t});\n}\n//#endregion\n//#region src/builtins/atomic-file-write.ts\nconst TEMP_RANDOM_BYTES = 6;\nconst PRESERVED_MODE_BITS = 4095;\nconst MISSING_FILE_ERROR_CODE = \"ENOENT\";\n/**\n* NEUT-009: this marker used to carry the consumer's product name, so a neutral tool library wrote\n* that name onto every temporary file it created — inherited by any other product built on it. The\n* marker now says what the file IS, which is all it was ever for.\n*\n* The product name is not quoted here either: the ratchet counts prose, deliberately, because a\n* library whose comments teach the product's layout is coupled to it just as firmly.\n*/\nconst TEMP_MARKER = \".atomic-tmp-\";\nfunction createTempFilePath(filePath) {\n\tconst dir = dirname(filePath);\n\tconst name = basename(filePath);\n\tconst suffix = randomBytes(TEMP_RANDOM_BYTES).toString(\"hex\");\n\treturn join(dir, `.${name}${TEMP_MARKER}${process.pid}-${Date.now()}-${suffix}`);\n}\nasync function readExistingMode(filePath) {\n\ttry {\n\t\treturn (await stat(filePath)).mode & PRESERVED_MODE_BITS;\n\t} catch (error) {\n\t\tif (error instanceof Error && hasErrorCode(error, MISSING_FILE_ERROR_CODE)) return void 0;\n\t\tthrow error;\n\t}\n}\nfunction hasErrorCode(error, code) {\n\treturn \"code\" in error && error.code === code;\n}\nasync function atomicWriteUtf8File(filePath, content) {\n\tawait mkdir(dirname(filePath), { recursive: true });\n\tconst existingMode = await readExistingMode(filePath);\n\tconst tempFilePath = createTempFilePath(filePath);\n\ttry {\n\t\tawait writeFile(tempFilePath, content, \"utf8\");\n\t\tif (existingMode !== void 0) await chmod(tempFilePath, existingMode);\n\t\tawait rename(tempFilePath, filePath);\n\t} catch (error) {\n\t\tawait rm(tempFilePath, { force: true }).catch(() => void 0);\n\t\tthrow error;\n\t}\n}\n//#endregion\n//#region src/builtins/write-tool.ts\n/**\n* WriteTool — write content to a file, auto-creating parent directories.\n*/\nconst DEFAULT_WRITE_DESCRIPTION = \"Writes a file to the local filesystem. This will overwrite an existing file if one exists.\\n\\nPrefer the Edit tool for modifying existing files — it only sends the changed text. Use this tool to create new files or for complete rewrites.\\n\\nParent directories are created automatically when missing.\";\nconst WriteSchema = z.object({\n\tfilePath: z.string().describe(\"The absolute path to the file to write\"),\n\tcontent: z.string().describe(\"The content to write to the file\")\n});\nasync function writeFileTool(args, options) {\n\tconst { content } = args;\n\tconst filePath = options.sandboxClient ? args.filePath : resolveHostPath(args.filePath, options.cwd);\n\tif (!options.sandboxClient) {\n\t\tconst pathError = checkPathWithinCwd(filePath, options.cwd);\n\t\tif (pathError !== void 0) return pathError;\n\t}\n\ttry {\n\t\tif (options.sandboxClient) await options.sandboxClient.writeFile(filePath, content);\n\t\telse await atomicWriteUtf8File(filePath, content);\n\t\tconst result = {\n\t\t\tsuccess: true,\n\t\t\toutput: `Written ${Buffer.byteLength(content, \"utf8\")} bytes to ${filePath}`\n\t\t};\n\t\treturn JSON.stringify(result);\n\t} catch (err) {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: err instanceof Error ? err.message : String(err)\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n}\n/**\n* Create a WriteTool instance — register with Robota agent tools registry.\n*/\nfunction createWriteTool(options) {\n\treturn createZodFunctionTool(\"Write\", options.description ?? DEFAULT_WRITE_DESCRIPTION, WriteSchema, async (params) => {\n\t\treturn writeFileTool(params, options);\n\t});\n}\n//#endregion\n//#region src/builtins/edit-tool.ts\n/**\n* EditTool — perform string-replace edits on a file.\n*\n* By default, requires the oldString to appear exactly once in the file\n* (ensuring surgical edits). Pass replaceAll:true to replace all occurrences.\n*/\nconst DEFAULT_EDIT_DESCRIPTION = \"Performs exact string replacements in files.\\n\\noldString must exactly match the file's current content, including whitespace and indentation — reading the file first (e.g. with a file-read tool) is the reliable way to copy exact text.\\n\\nThe edit will FAIL if oldString is not unique in the file. Either provide more surrounding context to make it unique, or set replaceAll to change every instance.\";\nconst EditSchema = z.object({\n\tfilePath: z.string().describe(\"The absolute path to the file to modify\"),\n\toldString: z.string().describe(\"The text to replace (must be an exact match of existing content)\"),\n\tnewString: z.string().describe(\"The text to replace it with (must be different from oldString)\"),\n\treplaceAll: z.boolean().optional().describe(\"Replace all occurrences of oldString (default: false). Useful for renaming variables\")\n});\nconst MAX_EDIT_FILE_BYTES = 4 * 1024 * 1024;\nconst READ_CHUNK_BYTES$1 = 64 * 1024;\n/** Marks a refusal that must not surface a partial or crashed read to the caller. */\nvar EditByteLimitError = class extends Error {\n\tboundary;\n\tconstructor(boundary) {\n\t\tsuper(`Edit ${boundary} exceeds its ${MAX_EDIT_FILE_BYTES}-byte limit`);\n\t\tthis.boundary = boundary;\n\t}\n};\n/**\n* Read a file as UTF-8 while rejecting as soon as more than `maxBytes` bytes have arrived —\n* before the whole content is materialized. Reading actual bytes off the stream (rather than\n* trusting stat() size) also catches a file that grows after being stat'd, or has no stable\n* size at all (a named pipe).\n*/\nasync function readBoundedUtf8File(filePath, maxBytes) {\n\tconst stream = createReadStream(filePath, { highWaterMark: READ_CHUNK_BYTES$1 });\n\tconst chunks = [];\n\tlet bytes = 0;\n\ttry {\n\t\tfor await (const chunk of stream) {\n\t\t\tconst buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);\n\t\t\tbytes += buffer.length;\n\t\t\tif (bytes > maxBytes) throw new EditByteLimitError(\"input\");\n\t\t\tchunks.push(buffer);\n\t\t}\n\t} finally {\n\t\tstream.destroy();\n\t}\n\treturn Buffer.concat(chunks, bytes).toString(\"utf8\");\n}\nasync function editFileTool(args, options) {\n\tconst { oldString, newString, replaceAll = false } = args;\n\tconst filePath = options.sandboxClient ? args.filePath : resolveHostPath(args.filePath, options.cwd);\n\tif (!options.sandboxClient) {\n\t\tconst pathError = checkPathWithinCwd(filePath, options.cwd);\n\t\tif (pathError !== void 0) return pathError;\n\t}\n\tlet content;\n\ttry {\n\t\tif (options.sandboxClient) {\n\t\t\tcontent = await options.sandboxClient.readFile(filePath);\n\t\t\tif (Buffer.byteLength(content, \"utf8\") > MAX_EDIT_FILE_BYTES) throw new EditByteLimitError(\"input\");\n\t\t} else content = await readBoundedUtf8File(filePath, MAX_EDIT_FILE_BYTES);\n\t} catch (err) {\n\t\tif (err instanceof EditByteLimitError) {\n\t\t\tconst result = {\n\t\t\t\tsuccess: false,\n\t\t\t\toutput: \"\",\n\t\t\t\terror: `${err.message}: ${filePath}`\n\t\t\t};\n\t\t\treturn JSON.stringify(result);\n\t\t}\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: `File not found: ${filePath}`\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n\tif (!content.includes(oldString)) {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: `oldString not found in file: ${filePath}`\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n\tlet parts = [];\n\tif (replaceAll) parts = content.split(oldString);\n\telse if (content.indexOf(oldString) !== content.lastIndexOf(oldString)) {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: `oldString is not unique in file (found ${content.split(oldString).length - 1} occurrences). Provide more context to make it unique, or use replaceAll:true.`\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n\tconst count = replaceAll ? parts.length - 1 : 1;\n\tconst oldBytes = Buffer.byteLength(oldString, \"utf8\");\n\tconst newBytes = Buffer.byteLength(newString, \"utf8\");\n\tif (Buffer.byteLength(content, \"utf8\") - count * oldBytes + count * newBytes > MAX_EDIT_FILE_BYTES) {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: `Edit output exceeds its ${MAX_EDIT_FILE_BYTES}-byte limit: ${filePath}`\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n\tconst updated = replaceAll ? parts.join(newString) : content.slice(0, content.indexOf(oldString)) + newString + content.slice(content.indexOf(oldString) + oldString.length);\n\ttry {\n\t\tif (options.sandboxClient) await options.sandboxClient.writeFile(filePath, updated);\n\t\telse await atomicWriteUtf8File(filePath, updated);\n\t} catch (err) {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: err instanceof Error ? err.message : String(err)\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n\tconst matchIdx = content.indexOf(oldString);\n\tconst startLine = matchIdx >= 0 ? content.substring(0, matchIdx).split(\"\\n\").length : 1;\n\tconst result = {\n\t\tsuccess: true,\n\t\toutput: `Replaced ${count} occurrence(s) in ${filePath}`,\n\t\tstartLine\n\t};\n\treturn JSON.stringify(result);\n}\n/**\n* Create an EditTool instance — register with Robota agent tools registry.\n*/\nfunction createEditTool(options) {\n\treturn createZodFunctionTool(\"Edit\", options.description ?? DEFAULT_EDIT_DESCRIPTION, EditSchema, async (params) => {\n\t\treturn editFileTool(params, options);\n\t});\n}\n//#endregion\n//#region src/builtins/glob-tool.ts\n/**\n* GlobTool — fast file pattern search using fast-glob.\n*\n* Excludes node_modules and .git by default.\n* Results are sorted by modification time (most recently modified first) among the candidates\n* enumerated before any candidate ceiling was hit (see DEFAULT_MAX_GLOB_CANDIDATES) — ordering is\n* not guaranteed across the full match set when the search tree is larger than that ceiling.\n*\n* SEC-007: when a containment root is configured the enumeration is confined to it. Listing the\n* filesystem is a disclosure in its own right — a sandbox that stops the model reading a file but\n* lets it map everything around that file is not a sandbox.\n*/\nconst DEFAULT_MAX_RESULTS = 1e3;\n/**\n* Ceiling on how many raw glob matches are pulled off `fast-glob`'s match STREAM before enumeration\n* stops, independent of `limit`/`DEFAULT_MAX_RESULTS`.\n*\n* `fg(pattern)` (the promise form) materializes every match into memory and only then stats and\n* slices to `limit` — a pattern like `**\\/*` under a huge tree allocates and stats the whole match\n* set no matter how small `limit` is. Streaming lets the walk stop as soon as this many CANDIDATES\n* have been seen, so memory and stat fan-out scale with this ceiling, not with the tree.\n*/\nconst DEFAULT_MAX_GLOB_CANDIDATES = 5e4;\nconst GlobSchema = z.object({\n\tpattern: z.string().describe(\"The glob pattern to match files against (e.g. \\\"**/*.ts\\\", \\\"src/**/*.tsx\\\")\"),\n\tpath: z.string().optional().describe(\"The directory to search in. Defaults to the current working directory. Must be a valid directory path if provided\"),\n\tlimit: z.number().optional().describe(\"Maximum number of results to return (default: 1000). Use a smaller limit to save context space\")\n});\n/** Cap on concurrent `stat` calls during the mtime sort, so a large match set cannot storm the FS. */\nconst STAT_CONCURRENCY_LIMIT = 100;\n/**\n* Drop every match whose CANONICAL path escapes the containment root, then stat the survivors for the\n* mtime sort, newest first.\n*\n* Containment is decided per RESULT as well as per root (SEC-007): a `..` in the pattern, or an\n* absolute pattern, produces a match the search root never vouched for. Decided canonically through\n* the shared guard — a symlink named `escape` is a plain segment, so no amount of segment validation\n* would catch it.\n*/\nasync function containedMatchesByMtime(matches, cwd, containmentRoot) {\n\tconst limit = pLimit(STAT_CONCURRENCY_LIMIT);\n\treturn (await Promise.all(matches.map((p) => limit(async () => {\n\t\tconst absPath = resolve(cwd, p);\n\t\tif (!isWithinCwd(absPath, containmentRoot)) return void 0;\n\t\ttry {\n\t\t\treturn {\n\t\t\t\tpath: p,\n\t\t\t\tmtime: (await stat(absPath)).mtimeMs\n\t\t\t};\n\t\t} catch {\n\t\t\treturn {\n\t\t\t\tpath: p,\n\t\t\t\tmtime: 0\n\t\t\t};\n\t\t}\n\t})))).filter((entry) => entry !== void 0).sort((a, b) => b.mtime - a.mtime);\n}\n/**\n* Pull matches off `fast-glob`'s streaming API one at a time, stopping at `maxCandidates` instead of\n* materializing the whole match set (see {@link DEFAULT_MAX_GLOB_CANDIDATES}). Exported for tests that\n* need a smaller ceiling than the real default.\n*/\nasync function collectGlobMatches(pattern, options, maxCandidates) {\n\tconst matches = [];\n\tlet truncated = false;\n\tconst stream = fg.stream(pattern, options);\n\tfor await (const entry of stream) {\n\t\tif (matches.length >= maxCandidates) {\n\t\t\ttruncated = true;\n\t\t\tbreak;\n\t\t}\n\t\tmatches.push(entry);\n\t}\n\treturn {\n\t\tmatches,\n\t\ttruncated\n\t};\n}\n/**\n* Exported (rather than module-private) so tests can drive it with a `maxCandidates` far smaller than\n* {@link DEFAULT_MAX_GLOB_CANDIDATES} — the real default is too large to exercise cheaply — without\n* adding any test-only knob to the public `createGlobTool` factory or its schema.\n*/\nasync function globFileTool(args, options, maxCandidates = DEFAULT_MAX_GLOB_CANDIDATES) {\n\tconst { pattern, path: basePath } = args;\n\tconst containmentRoot = options.cwd;\n\tconst { root: cwd, error: rootError } = resolveSearchRoot(basePath, containmentRoot);\n\tif (rootError) return rootError;\n\tlet candidates;\n\ttry {\n\t\tcandidates = await collectGlobMatches(pattern, {\n\t\t\tcwd,\n\t\t\tignore: [\"**/node_modules/**\", \"**/.git/**\"],\n\t\t\tdot: true,\n\t\t\tabsolute: false,\n\t\t\tfollowSymbolicLinks: false\n\t\t}, maxCandidates);\n\t} catch (err) {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: err instanceof Error ? err.message : String(err)\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n\tconst { matches, truncated: candidatesTruncated } = candidates;\n\tconst withMtime = await containedMatchesByMtime(matches, cwd, containmentRoot);\n\tconst maxResults = args.limit ?? DEFAULT_MAX_RESULTS;\n\tconst totalMatches = withMtime.length;\n\tconst truncated = totalMatches > maxResults;\n\tconst sorted = (truncated ? withMtime.slice(0, maxResults) : withMtime).map((f) => f.path);\n\tlet output = sorted.length > 0 ? sorted.join(\"\\n\") : \"(no matches)\";\n\tif (truncated) output += `\\n\\n[Showing ${maxResults} of ${totalMatches} matches. Use limit parameter to see more.]`;\n\tif (candidatesTruncated) output += `\\n\\n[Candidate search stopped early; the search tree has more matches than this tool scans in one call. Results are ordered among the scanned candidates only — narrow the pattern or path to see the rest.]`;\n\treturn JSON.stringify({\n\t\tsuccess: true,\n\t\toutput\n\t});\n}\nconst DEFAULT_GLOB_DESCRIPTION = \"Fast file pattern matching tool that works with any codebase size.\\n\\nSupports glob patterns like '**/*.js' or 'src/**/*.ts'. Returns matching file paths sorted by modification time.\\n\\nUse this tool when you need to find files by name patterns.\\n\\nDefault limit is 1000 results. Use the limit parameter if you need fewer results to save context space.\";\n/**\n* Create a GlobTool instance — register with Robota agent tools registry.\n*/\nfunction createGlobTool(options) {\n\treturn createZodFunctionTool(\"Glob\", options.description ?? DEFAULT_GLOB_DESCRIPTION, GlobSchema, async (params) => {\n\t\treturn globFileTool(params, options);\n\t});\n}\n//#endregion\n//#region src/builtins/grep-search.ts\n/**\n* The `Grep` tool's search internals — file enumeration and per-file matching.\n*\n* Split out of `grep-tool.ts` (SEC-007) when adding containment pushed that file past the\n* anti-monolith limit. The split is by responsibility, not by line count: this module is HOW the\n* search is performed, while `grep-tool.ts` is the tool SURFACE — schema, model-facing description,\n* factory, and the result envelope. Neither half needs to know the other's concerns.\n*/\n/** Convert a simple glob to a RegExp for file name filtering. */\nfunction globToRegex(glob) {\n\tconst escaped = glob.replace(/[.+^${}()|[\\]\\\\]/g, \"\\\\$&\").replace(/\\*\\*/g, \".+\").replace(/\\*/g, \"[^/]*\");\n\treturn new RegExp(`^${escaped}$`);\n}\n/** Check if a file name matches an optional glob filter. */\nfunction matchesGlob(filename, glob) {\n\tif (glob === void 0) return true;\n\treturn globToRegex(glob).test(filename);\n}\n/**\n* Ceiling on how many directory entries `collectFiles` will `stat` before it stops walking.\n*\n* Without a cap, enumeration and stat fan-out scale with the whole tree under the search root,\n* not with any result limit — a directory with millions of files makes every `Grep` call walk and\n* stat millions of entries before `headLimit` ever gets a chance to truncate the OUTPUT. This bounds\n* the WALK itself.\n*/\nconst DEFAULT_MAX_COLLECTED_FILES = 5e4;\n/**\n* Gather files under a directory recursively, excluding node_modules/.git, stopping once `maxFiles`\n* entries have been visited.\n*\n* `containmentRoot` (SEC-007) drops any entry whose CANONICAL path escapes the root, before it is\n* descended into or read. `stat` follows symlinks, so without this a link inside the root pointing\n* out of it made the whole target tree readable — including, for a symlinked FILE, its contents.\n*/\nasync function collectFiles(dirPath, glob, containmentRoot, maxFiles = DEFAULT_MAX_COLLECTED_FILES) {\n\tconst results = [];\n\tlet visited = 0;\n\tlet truncated = false;\n\tasync function walk(current) {\n\t\tif (truncated) return;\n\t\tlet entryNames;\n\t\ttry {\n\t\t\tentryNames = await readdir(current);\n\t\t} catch {\n\t\t\treturn;\n\t\t}\n\t\tfor (const name of entryNames) {\n\t\t\tif (truncated) return;\n\t\t\tif (name === \"node_modules\" || name === \".git\") continue;\n\t\t\tconst fullPath = join(current, name);\n\t\t\tif (!isWithinCwd(fullPath, containmentRoot)) continue;\n\t\t\tif (visited >= maxFiles) {\n\t\t\t\ttruncated = true;\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tvisited++;\n\t\t\tlet fileStat;\n\t\t\ttry {\n\t\t\t\tfileStat = await stat(fullPath);\n\t\t\t} catch {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (fileStat.isDirectory()) await walk(fullPath);\n\t\t\telse if (fileStat.isFile()) {\n\t\t\t\tif (matchesGlob(name, glob)) results.push(fullPath);\n\t\t\t}\n\t\t}\n\t}\n\tawait walk(dirPath);\n\treturn {\n\t\tfiles: results,\n\t\ttruncated\n\t};\n}\n/** Search a single file for lines matching the regex. */\nfunction searchFile(content, filePath, regex, contextLines, outputMode, maxOutputBytes) {\n\tconst lines = content.split(\"\\n\");\n\tconst matchingIndices = [];\n\tfor (let i = 0; i < lines.length; i++) if (regex.test(lines[i])) matchingIndices.push(i);\n\tif (matchingIndices.length === 0) return [];\n\tif (outputMode === \"files_with_matches\") return [filePath];\n\tif (outputMode === \"count\") return [`${filePath}:${matchingIndices.length}`];\n\tconst includedIndices = /* @__PURE__ */ new Set();\n\tfor (const idx of matchingIndices) for (let c = Math.max(0, idx - contextLines); c <= Math.min(lines.length - 1, idx + contextLines); c++) includedIndices.add(c);\n\tconst outputLines = [];\n\tlet outputBytes = 0;\n\tconst sortedIndices = Array.from(includedIndices).sort((a, b) => a - b);\n\tlet prevIdx;\n\tlet matchingCursor = 0;\n\tfor (const idx of sortedIndices) {\n\t\tif (prevIdx !== void 0 && idx > prevIdx + 1) outputLines.push(\"--\");\n\t\tconst lineNum = idx + 1;\n\t\twhile (matchingIndices[matchingCursor] < idx) matchingCursor++;\n\t\tconst row = `${filePath}:${lineNum}${matchingIndices[matchingCursor] === idx ? \":\" : \"-\"}${lines[idx]}`;\n\t\toutputBytes += Buffer.byteLength(row, \"utf8\") + 1;\n\t\tif (maxOutputBytes !== void 0 && outputBytes > maxOutputBytes) throw new Error(\"byte limit\");\n\t\toutputLines.push(row);\n\t\tprevIdx = idx;\n\t}\n\treturn outputLines;\n}\n//#endregion\n//#region src/builtins/isolated-grep-search.ts\nconst BOOTSTRAP = `\nconst { parentPort } = require('node:worker_threads');\nconst searchFile = ${searchFile.toString()};\nlet outputBytes = 0;\nparentPort.on('message', (request) => {\n  try {\n    const regex = new RegExp(request.pattern);\n    const matches = searchFile(request.content, request.filePath, regex, request.contextLines, request.outputMode, 4 * 1024 * 1024);\n    let bytes = 0;\n    for (const match of matches) { bytes += Buffer.byteLength(match, 'utf8') + 1; if (outputBytes + bytes > 4 * 1024 * 1024) throw new Error('byte limit'); }\n    outputBytes += bytes;\n    parentPort.postMessage({ id: request.id, matches });\n  } catch (error) { parentPort.postMessage({ id: request.id, error: error?.message === 'byte limit' ? 'Grep search exceeded its byte limit' : 'Invalid grep regex execution' }); }\n});\n`;\nvar GrepProcessWorker = class extends EventEmitter {\n\tchild = spawn(process.execPath, [\"-e\", `\nconst searchFile = ${searchFile.toString()};\nconst readline = require('node:readline');\nlet outputBytes = 0;\nreadline.createInterface({ input: process.stdin }).on('line', line => {\n  const request = JSON.parse(line);\n  try {\n    const regex = new RegExp(request.pattern);\n    const matches = searchFile(request.content, request.filePath, regex, request.contextLines, request.outputMode, 4 * 1024 * 1024);\n    let bytes = 0;\n    for (const match of matches) { bytes += Buffer.byteLength(match, 'utf8') + 1; if (outputBytes + bytes > 4 * 1024 * 1024) throw new Error('byte limit'); }\n    outputBytes += bytes;\n    process.stdout.write(JSON.stringify({ id: request.id, matches }) + String.fromCharCode(10));\n  } catch (error) { process.stdout.write(JSON.stringify({ id: request.id, error: error?.message === 'byte limit' ? 'Grep search exceeded its byte limit' : 'Invalid grep regex execution' }) + String.fromCharCode(10)); }\n});\n`], {\n\t\tenv: {\n\t\t\tBUN_BE_BUN: \"1\",\n\t\t\t...process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}\n\t\t},\n\t\tcwd: tmpdir(),\n\t\tstdio: \"pipe\"\n\t});\n\tclosed;\n\tconstructor() {\n\t\tsuper();\n\t\tlet pending = \"\";\n\t\tthis.child.stdout.setEncoding(\"utf8\");\n\t\tthis.child.stdout.on(\"data\", (chunk) => {\n\t\t\tpending += chunk;\n\t\t\tif (Buffer.byteLength(pending, \"utf8\") > 25166848) {\n\t\t\t\tthis.emit(\"error\");\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tlet newline;\n\t\t\twhile ((newline = pending.indexOf(\"\\n\")) >= 0) {\n\t\t\t\tconst line = pending.slice(0, newline);\n\t\t\t\tpending = pending.slice(newline + 1);\n\t\t\t\ttry {\n\t\t\t\t\tthis.emit(\"message\", JSON.parse(line));\n\t\t\t\t} catch {\n\t\t\t\t\tthis.emit(\"error\");\n\t\t\t\t}\n\t\t\t}\n\t\t});\n\t\tthis.child.stderr.resume();\n\t\tthis.child.on(\"error\", () => this.emit(\"error\"));\n\t\tthis.child.stdin.on(\"error\", () => this.emit(\"error\"));\n\t\tthis.closed = new Promise((resolve) => {\n\t\t\tthis.child.once(\"close\", () => {\n\t\t\t\tthis.emit(\"exit\");\n\t\t\t\tresolve();\n\t\t\t});\n\t\t});\n\t}\n\tpostMessage(request) {\n\t\tthis.child.stdin.write(JSON.stringify(request) + \"\\n\");\n\t}\n\tasync terminate() {\n\t\tif (this.child.exitCode === null && this.child.signalCode === null) this.child.kill(\"SIGKILL\");\n\t\tawait this.closed;\n\t}\n};\n/** One worker per grep invocation; a deadline or abort terminates it before the failure is exposed. */\nvar IsolatedGrepSearch = class {\n\tpattern;\n\tsignal;\n\tworker = process.versions.bun ? new GrepProcessWorker() : new Worker(BOOTSTRAP, {\n\t\teval: true,\n\t\texecArgv: [],\n\t\tresourceLimits: {\n\t\t\tmaxOldGenerationSizeMb: 128,\n\t\t\tmaxYoungGenerationSizeMb: 32\n\t\t}\n\t});\n\tpending = /* @__PURE__ */ new Map();\n\tnextId = 0;\n\tstopped = false;\n\ttermination;\n\ttimer;\n\tabort = () => {\n\t\tthis.stop(/* @__PURE__ */ new Error(\"Grep search cancelled\"));\n\t};\n\tconstructor(pattern, signal) {\n\t\tthis.pattern = pattern;\n\t\tthis.signal = signal;\n\t\tthis.worker.on(\"message\", (message) => {\n\t\t\tconst pending = this.pending.get(message.id);\n\t\t\tif (!pending || this.stopped) return;\n\t\t\tthis.pending.delete(message.id);\n\t\t\tif (Array.isArray(message.matches) && message.matches.every((m) => typeof m === \"string\")) pending.resolve(message.matches);\n\t\t\telse pending.reject(new Error(message.error ?? \"Invalid grep worker response\"));\n\t\t});\n\t\tthis.worker.on(\"error\", () => {\n\t\t\tthis.stop(/* @__PURE__ */ new Error(\"Grep search worker failed\"));\n\t\t});\n\t\tthis.worker.once(\"exit\", () => {\n\t\t\tthis.stop(/* @__PURE__ */ new Error(\"Grep search worker exited\"));\n\t\t});\n\t\tthis.timer = setTimeout(() => {\n\t\t\tthis.stop(/* @__PURE__ */ new Error(\"Grep search timed out\"));\n\t\t}, 2e3);\n\t\tsignal?.addEventListener(\"abort\", this.abort, { once: true });\n\t\tif (signal?.aborted) this.abort();\n\t}\n\tsearch(content, filePath, contextLines, outputMode) {\n\t\tif (this.stopped) return Promise.reject(/* @__PURE__ */ new Error(this.signal?.aborted ? \"Grep search cancelled\" : \"Grep search timed out\"));\n\t\tconst id = this.nextId++;\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tthis.pending.set(id, {\n\t\t\t\tresolve,\n\t\t\t\treject\n\t\t\t});\n\t\t\ttry {\n\t\t\t\tthis.worker.postMessage({\n\t\t\t\t\tid,\n\t\t\t\t\tcontent,\n\t\t\t\t\tfilePath,\n\t\t\t\t\tpattern: this.pattern,\n\t\t\t\t\tcontextLines,\n\t\t\t\t\toutputMode\n\t\t\t\t});\n\t\t\t} catch {\n\t\t\t\tthis.stop(/* @__PURE__ */ new Error(\"Grep search worker failed\"));\n\t\t\t}\n\t\t});\n\t}\n\tasync stop(error) {\n\t\tif (this.termination) return this.termination;\n\t\tthis.stopped = true;\n\t\tclearTimeout(this.timer);\n\t\tthis.signal?.removeEventListener(\"abort\", this.abort);\n\t\tthis.termination = (async () => {\n\t\t\ttry {\n\t\t\t\tawait this.worker.terminate();\n\t\t\t} catch {}\n\t\t\tfor (const pending of this.pending.values()) pending.reject(error ?? /* @__PURE__ */ new Error(\"Grep search stopped\"));\n\t\t\tthis.pending.clear();\n\t\t})();\n\t\treturn this.termination;\n\t}\n};\n//#endregion\n//#region src/builtins/grep-tool.ts\n/**\n* GrepTool — recursive regex content search.\n*\n* Supports three output modes:\n* - files_with_matches (default): return only file paths that contain a match\n* - content: return matching lines with optional context lines\n* - count: return per-file match counts as \"path:count\" rows\n*\n* headLimit caps the number of result lines; excess is truncated with a marker.\n*\n* SEC-007: when a containment root is configured the search is confined to it. Grep is the most\n* disclosing of the file tools — `content` mode returns the matching LINES — so it must be contained\n* at least as strictly as `Read`, which it could otherwise stand in for.\n*/\nconst GrepSchema = z.object({\n\tpattern: z.string().describe(\"The regular expression pattern to search for in file contents\"),\n\tpath: z.string().optional().describe(\"File or directory to search in. Defaults to the current working directory\"),\n\tglob: z.string().optional().describe(\"Glob pattern to filter files (e.g. \\\"*.ts\\\", \\\"*.{ts,tsx}\\\"). Only files matching this pattern will be searched\"),\n\tcontextLines: z.number().optional().describe(\"Number of context lines to show before and after each match. Only applies when outputMode is \\\"content\\\". Default: 0\"),\n\toutputMode: z.enum([\n\t\t\"files_with_matches\",\n\t\t\"content\",\n\t\t\"count\"\n\t]).optional().describe(\"Output mode: \\\"files_with_matches\\\" shows only file paths (default), \\\"content\\\" shows matching lines with context, \\\"count\\\" shows per-file match counts\"),\n\theadLimit: z.number().int().positive().optional().describe(\"Maximum number of result lines (file paths, content lines, or count rows) to return. Excess results are truncated with a marker line\")\n});\n/** The matcher consumes one file at a time; keep only a few reads outstanding. */\nconst READ_CONCURRENCY_LIMIT = 8;\nconst MAX_GREP_FILE_BYTES = 4 * 1024 * 1024;\nconst READ_CHUNK_BYTES = 64 * 1024;\n/** A grep isolation failure is a hard tool failure, distinct from ordinary no-match/invalid-input results. */\nvar GrepIsolationError = class extends ToolExecutionError {\n\treason;\n\tconstructor(reason) {\n\t\tsuper(`Grep search ${reason === \"timeout\" ? \"timed out\" : reason === \"cancelled\" ? \"cancelled\" : reason === \"limit\" ? \"exceeded its byte limit\" : \"worker failed\"}`, \"Grep\");\n\t\tthis.reason = reason;\n\t}\n};\nasync function grepFileTool(args, options) {\n\tconst { pattern, path: searchPath, glob, contextLines = 0, outputMode = \"files_with_matches\", headLimit } = args;\n\tconst containmentRoot = options.cwd;\n\tconst { root: targetPath, error: rootError } = resolveSearchRoot(searchPath, containmentRoot);\n\tif (rootError) return rootError;\n\ttry {\n\t\tnew RegExp(pattern);\n\t} catch (err) {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: `Invalid regex pattern: ${pattern}`\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n\tlet targetStat;\n\ttry {\n\t\ttargetStat = await stat(targetPath);\n\t} catch {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: `Path not found: ${targetPath}`\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n\tlet files;\n\tlet filesTruncated = false;\n\tif (targetStat.isFile()) files = [targetPath];\n\telse {\n\t\tconst collected = await collectFiles(targetPath, glob, containmentRoot);\n\t\tfiles = collected.files;\n\t\tfilesTruncated = collected.truncated;\n\t}\n\tconst search = new IsolatedGrepSearch(pattern, options.signal);\n\tconst readAbort = new AbortController();\n\tconst abortReads = () => readAbort.abort();\n\toptions.signal?.addEventListener(\"abort\", abortReads, { once: true });\n\tif (options.signal?.aborted) abortReads();\n\tlet perFileMatches;\n\ttry {\n\t\tif (readAbort.signal.aborted) throw new GrepIsolationError(\"cancelled\");\n\t\tconst orderedMatches = new Array(files.length);\n\t\tlet nextFile = 0;\n\t\tlet failure;\n\t\tconst readAndSearch = async (filePath) => {\n\t\t\tlet content;\n\t\t\ttry {\n\t\t\t\tif ((await stat(filePath)).size > MAX_GREP_FILE_BYTES) throw new GrepIsolationError(\"limit\");\n\t\t\t\tconst stream = createReadStream(filePath, {\n\t\t\t\t\thighWaterMark: READ_CHUNK_BYTES,\n\t\t\t\t\tsignal: readAbort.signal\n\t\t\t\t});\n\t\t\t\tconst chunks = [];\n\t\t\t\tlet bytes = 0;\n\t\t\t\ttry {\n\t\t\t\t\tfor await (const chunk of stream) {\n\t\t\t\t\t\tif (readAbort.signal.aborted) throw new GrepIsolationError(\"cancelled\");\n\t\t\t\t\t\tconst buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);\n\t\t\t\t\t\tbytes += buffer.length;\n\t\t\t\t\t\tif (bytes > MAX_GREP_FILE_BYTES) throw new GrepIsolationError(\"limit\");\n\t\t\t\t\t\tchunks.push(buffer);\n\t\t\t\t\t}\n\t\t\t\t} finally {\n\t\t\t\t\tstream.destroy();\n\t\t\t\t}\n\t\t\t\tconst buffer = Buffer.concat(chunks, bytes);\n\t\t\t\tconst checkLen = Math.min(buffer.length, 8192);\n\t\t\t\tlet hasBinary = false;\n\t\t\t\tfor (let i = 0; i < checkLen; i++) if (buffer[i] === 0) {\n\t\t\t\t\thasBinary = true;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tif (hasBinary) return [];\n\t\t\t\tcontent = buffer.toString(\"utf8\");\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof GrepIsolationError) throw error;\n\t\t\t\tif (readAbort.signal.aborted) throw new GrepIsolationError(\"cancelled\");\n\t\t\t\treturn [];\n\t\t\t}\n\t\t\treturn search.search(content, filePath, contextLines, outputMode);\n\t\t};\n\t\tconst worker = async () => {\n\t\t\twhile (failure === void 0 && nextFile < files.length) {\n\t\t\t\tconst index = nextFile++;\n\t\t\t\ttry {\n\t\t\t\t\torderedMatches[index] = await readAndSearch(files[index]);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (failure === void 0) {\n\t\t\t\t\t\tfailure = error;\n\t\t\t\t\t\treadAbort.abort();\n\t\t\t\t\t\tsearch.stop(error instanceof Error ? error : /* @__PURE__ */ new Error(\"Grep search failed\"));\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t};\n\t\tawait Promise.all(Array.from({ length: Math.min(READ_CONCURRENCY_LIMIT, files.length) }, worker));\n\t\tif (failure !== void 0) throw failure;\n\t\tperFileMatches = orderedMatches;\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : \"\";\n\t\tthrow error instanceof GrepIsolationError ? error : new GrepIsolationError(message.includes(\"timed out\") ? \"timeout\" : message.includes(\"cancelled\") ? \"cancelled\" : message.includes(\"byte limit\") ? \"limit\" : \"failed\");\n\t} finally {\n\t\toptions.signal?.removeEventListener(\"abort\", abortReads);\n\t\tawait search.stop();\n\t}\n\tlet outputBytes = 0;\n\tfor (const matches of perFileMatches) for (const match of matches) {\n\t\toutputBytes += Buffer.byteLength(match, \"utf8\") + 1;\n\t\tif (outputBytes > 4 * 1024 * 1024) throw new GrepIsolationError(\"limit\");\n\t}\n\tlet outputLines = perFileMatches.flat();\n\tif (headLimit !== void 0 && outputLines.length > headLimit) {\n\t\tconst truncatedCount = outputLines.length - headLimit;\n\t\toutputLines = [...outputLines.slice(0, headLimit), `(+${truncatedCount} more results truncated by headLimit)`];\n\t}\n\tif (filesTruncated) outputLines = [...outputLines, `[File enumeration stopped early; the search tree has more files than this tool scans in one call. Results may be incomplete — narrow the path or glob.]`];\n\tconst result = {\n\t\tsuccess: true,\n\t\toutput: outputLines.length > 0 ? outputLines.join(\"\\n\") : \"(no matches)\"\n\t};\n\treturn JSON.stringify(result);\n}\n/** The registered name of the shell tool this package's default assembly ships (NEUT-002). */\nconst DEFAULT_SHELL_TOOL_NAME = \"Shell\";\n/** Build the default description, referencing the actually-registered shell tool by name. */\nfunction buildGrepDescription(shellToolName) {\n\treturn `A powerful search tool built on regex matching.\\n\\nSupports full regex syntax (e.g., 'log.*Error', 'function\\\\\\\\s+\\\\\\\\w+'). Filter files with glob parameter (e.g., '*.js', '**/*.tsx').\\n\\nOutput modes: 'content' shows matching lines with context, 'files_with_matches' shows only file paths (default), 'count' shows per-file match counts.\\n\\nPrefer this tool over running grep or rg through the ${shellToolName} tool — it returns structured results directly.\\n\\nUse headLimit to control result size and save context space.`;\n}\n/**\n* Create a GrepTool instance — register with Robota agent tools registry.\n*/\nfunction createGrepTool(options) {\n\treturn createZodFunctionTool(\"Grep\", options.description ?? buildGrepDescription(options.shellToolName ?? DEFAULT_SHELL_TOOL_NAME), GrepSchema, async (params) => {\n\t\treturn grepFileTool(params, options);\n\t});\n}\n//#endregion\n//#region src/builtins/web-fetch-tool.ts\n/**\n* WebFetchTool — fetch a URL and return its content as text.\n*\n* HTML is stripped to plain text for readability. Fetches through the shared egress boundary\n* (`fetchWithEgressPolicy`, #2026): loopback / private / link-local / metadata destinations are\n* refused, redirects are re-validated, and the response is capped while streaming.\n*/\nconst DEFAULT_TIMEOUT_MS$1 = 3e4;\nconst MAX_RESPONSE_BYTES = 5e6;\nconst WebFetchSchema = z.object({\n\turl: z.string().describe(\"The URL to fetch\"),\n\theaders: z.record(z.string()).optional().describe(\"Optional HTTP headers as key-value pairs\")\n});\n/**\n* Remove every `<tag>…</tag>` element — the linear equivalent of `replace(/<tag[\\s\\S]*?<\\/tag>/gi, '')`.\n*\n* The regex form is quadratic: every `<tag` with no closing tag after it rescans to end of input, and the scan\n* then restarts at the next one. `htmlToText`'s input is a **response body from an arbitrary URL**, capped only\n* at {@link MAX_RESPONSE_BYTES} (5 MB) — 5 MB of `<script` would have taken minutes. Because the closing tag is\n* searched forward, its absence at one opener means no later opener can have one either, so the scan stops.\n*\n* Case folding is `[A-Z]`-only, not `toLowerCase()`: `toLowerCase()` can change a string's LENGTH (U+0130\n* lowercases to two code units), which would desynchronise the indices from the original text.\n*/\nfunction stripElement(html, tag) {\n\tconst openTag = `<${tag}`;\n\tconst closeTag = `</${tag}>`;\n\tconst haystack = html.replace(/[A-Z]/g, (c) => c.toLowerCase());\n\tconst parts = [];\n\tlet cursor = 0;\n\tfor (;;) {\n\t\tconst open = haystack.indexOf(openTag, cursor);\n\t\tif (open < 0) break;\n\t\tconst close = haystack.indexOf(closeTag, open + openTag.length);\n\t\tif (close < 0) break;\n\t\tparts.push(html.slice(cursor, open));\n\t\tcursor = close + closeTag.length;\n\t}\n\tparts.push(html.slice(cursor));\n\treturn parts.join(\"\");\n}\n/**\n* Replace every `<…>` tag with a space — the linear equivalent of `replace(/<[^>]+>/g, ' ')`.\n*\n* Same defect, same input: `[^>]+` cannot cross a `>`, so a `<` with no `>` after it consumed the rest of the\n* document and then backtracked over it, once per `<`. A page of 200 K `<` characters took 12.6 s; the 5 MB the\n* fetch allows would have taken hours. `close === open + 1` reproduces the regex's `+` (a tag body must be at\n* least one character), so a literal `<>` is left in the text exactly as before.\n*/\nfunction stripTags(html) {\n\tconst parts = [];\n\tlet cursor = 0;\n\tfor (;;) {\n\t\tconst open = html.indexOf(\"<\", cursor);\n\t\tif (open < 0) break;\n\t\tconst close = html.indexOf(\">\", open + 1);\n\t\tif (close < 0) break;\n\t\tif (close === open + 1) {\n\t\t\tparts.push(html.slice(cursor, open + 1));\n\t\t\tcursor = open + 1;\n\t\t\tcontinue;\n\t\t}\n\t\tparts.push(html.slice(cursor, open), \" \");\n\t\tcursor = close + 1;\n\t}\n\tparts.push(html.slice(cursor));\n\treturn parts.join(\"\");\n}\n/**\n* The character entities {@link htmlToText} decodes, and the single alternation that matches them.\n*\n* SEC-004 (`js/double-escaping`): decoding these by CHAINED `.replace()` calls with `&amp;` first\n* decodes twice. `&amp;lt;` — how a page encodes the literal text `&lt;` so a browser DISPLAYS it —\n* became `&lt;` after the `&amp;` pass and then `<` after the `&lt;` pass, so a page reading\n* `&amp;lt;script&amp;gt;` came back out of a tag-stripping converter as `<script>`. One pass over\n* one alternation decodes each entity exactly once and never rescans its own output, so the decoder\n* is the inverse of the encoder for every input rather than only for singly-encoded ones.\n*/\nconst HTML_ENTITIES = {\n\t\"&amp;\": \"&\",\n\t\"&lt;\": \"<\",\n\t\"&gt;\": \">\",\n\t\"&quot;\": \"\\\"\",\n\t\"&#39;\": \"'\",\n\t\"&nbsp;\": \" \"\n};\nconst HTML_ENTITY_PATTERN = /&(?:amp|lt|gt|quot|nbsp|#39);/g;\n/** Strip HTML tags and decode common entities to produce readable text. */\nfunction htmlToText(html) {\n\treturn stripTags(stripElement(stripElement(html, \"script\"), \"style\")).replace(HTML_ENTITY_PATTERN, (entity) => HTML_ENTITIES[entity]).replace(/\\s+/g, \" \").trim();\n}\nfunction classifyFetchError(err) {\n\tif (!(err instanceof Error)) return String(err);\n\tif (err.name === \"AbortError\") return `Request timed out after ${DEFAULT_TIMEOUT_MS$1 / 1e3}s. The server did not respond in time.`;\n\tconst code = err.code;\n\tif (code === \"ENOTFOUND\" || code === \"EAI_AGAIN\") return `Network error: DNS resolution failed for this host. The URL may be incorrect or the host does not exist. Do not retry with the same URL.`;\n\tif (code === \"ECONNREFUSED\") return `Network error: Connection refused. The server is not accepting connections at this address. Do not retry with the same URL.`;\n\tif (code === \"ECONNRESET\") return `Network error: Connection was reset by the server. The server may be temporarily unavailable.`;\n\tif (code === \"ETIMEDOUT\") return `Network error: Connection timed out. The server is not reachable within the expected time.`;\n\tif (code === \"CERT_HAS_EXPIRED\" || code === \"UNABLE_TO_VERIFY_LEAF_SIGNATURE\") return `Network error: SSL certificate error (${code}). The server's certificate is invalid. Do not retry with the same URL.`;\n\treturn `Network error: ${err.message} Check that the URL is correct and the server is reachable.`;\n}\nasync function runWebFetch(args, egress, signal) {\n\tconst { url, headers } = args;\n\ttry {\n\t\tnew URL(url);\n\t} catch {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: `Invalid URL: \"${url}\". Fix the URL format before retrying.`\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n\ttry {\n\t\tconst response = await fetchWithEgressPolicy(url, {\n\t\t\theaders: {\n\t\t\t\t\"User-Agent\": \"Robota-CLI/3.0\",\n\t\t\t\t...headers ?? {}\n\t\t\t},\n\t\t\tsignal,\n\t\t\ttimeoutMs: DEFAULT_TIMEOUT_MS$1,\n\t\t\tmaxResponseBytes: MAX_RESPONSE_BYTES\n\t\t}, egress.policy, egress.deps);\n\t\tif (!response.ok) {\n\t\t\tconst { rejection } = response;\n\t\t\tconst result = {\n\t\t\t\tsuccess: false,\n\t\t\t\toutput: \"\",\n\t\t\t\terror: rejection.reason === \"response_too_large\" ? `Response too large (max ${MAX_RESPONSE_BYTES} bytes). Consider fetching a more specific URL or a paginated endpoint.` : `Blocked by egress policy: ${rejection.message} Do not retry with the same URL.`\n\t\t\t};\n\t\t\treturn JSON.stringify(result);\n\t\t}\n\t\tif (response.status < 200 || response.status >= 300) {\n\t\t\tconst retryHint = response.status >= 500 ? \" The server is temporarily unavailable — retrying may help.\" : \" Do not retry with the same URL.\";\n\t\t\tconst result = {\n\t\t\t\tsuccess: false,\n\t\t\t\toutput: \"\",\n\t\t\t\terror: `HTTP ${response.status} ${response.statusText}.${retryHint}`\n\t\t\t};\n\t\t\treturn JSON.stringify(result);\n\t\t}\n\t\tconst contentType = response.headers.get(\"content-type\") ?? \"\";\n\t\tlet text = new TextDecoder().decode(response.body);\n\t\tif (contentType.includes(\"html\")) text = htmlToText(text);\n\t\treturn JSON.stringify({\n\t\t\tsuccess: true,\n\t\t\toutput: text\n\t\t});\n\t} catch (err) {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: classifyFetchError(err)\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n}\nconst DEFAULT_WEB_FETCH_DESCRIPTION = \"Fetch a URL and return its content as text. HTML pages are converted to plain text.\";\n/**\n* Create a WebFetchTool instance — register with Robota agent tools registry.\n*/\nfunction createWebFetchTool(options = {}) {\n\tconst egress = options.egress ?? {};\n\treturn createZodFunctionTool(\"WebFetch\", options.description ?? DEFAULT_WEB_FETCH_DESCRIPTION, WebFetchSchema, async (params, context) => runWebFetch(params, egress, context?.signal));\n}\n/**\n* WebFetchTool instance — register with Robota agent tools registry.\n*/\nconst webFetchTool = createWebFetchTool();\n//#endregion\n//#region src/builtins/brave-search-provider.ts\nconst BRAVE_SEARCH_ENDPOINT = \"https://api.search.brave.com/res/v1/web/search\";\n/** Brave caps `count` at 20 per request. */\nconst BRAVE_MAX_COUNT = 20;\n/**\n* Create the Brave Search provider. Throws from `search()` when `BRAVE_API_KEY` is not set or\n* the API responds with an error — the tool layer surfaces the message as a structured result.\n*/\nfunction createBraveSearchProvider() {\n\treturn { async search({ query, limit }, signal) {\n\t\tconst apiKey = process.env[\"BRAVE_API_KEY\"];\n\t\tif (!apiKey) throw new Error(\"Web search requires BRAVE_API_KEY environment variable for the default Brave Search provider, or inject a custom search provider at the composition root.\");\n\t\tconst params = new URLSearchParams({\n\t\t\tq: query,\n\t\t\tcount: String(Math.min(limit, BRAVE_MAX_COUNT))\n\t\t});\n\t\tconst response = await fetch(`${BRAVE_SEARCH_ENDPOINT}?${params}`, {\n\t\t\theaders: {\n\t\t\t\tAccept: \"application/json\",\n\t\t\t\t\"Accept-Encoding\": \"gzip\",\n\t\t\t\t\"X-Subscription-Token\": apiKey\n\t\t\t},\n\t\t\t...signal ? { signal } : {}\n\t\t});\n\t\tif (!response.ok) throw new Error(`Brave Search API error: HTTP ${response.status} ${response.statusText}`);\n\t\treturn ((await response.json()).web?.results ?? []).map((r) => ({\n\t\t\ttitle: r.title,\n\t\t\turl: r.url,\n\t\t\tsnippet: r.description\n\t\t}));\n\t} };\n}\n//#endregion\n//#region src/builtins/web-search-tool.ts\n/**\n* WebSearchTool — search the web and return results.\n*\n* Vendor-free tool layer (NEUT-008): composes over the duck-typed `IWebSearchProvider` port.\n* The default provider is the vendor-specific default adapter wired at creation time; a custom\n* provider is injected via `createWebSearchTool({ provider })`. Provider failures (missing\n* configuration, HTTP/network errors) are thrown by the provider and surfaced here as\n* structured error results.\n*/\nconst DEFAULT_LIMIT = 10;\nconst DEFAULT_TIMEOUT_MS = 15e3;\nconst DEFAULT_WEB_SEARCH_DESCRIPTION = \"Search the web and return results with title, URL, and snippet.\";\nconst WebSearchSchema = z.object({\n\tquery: z.string().describe(\"The search query\"),\n\tlimit: z.number().optional().describe(`Maximum number of results to return (default: ${DEFAULT_LIMIT})`)\n});\nasync function runWebSearch(args, provider, signal) {\n\tconst { query, limit = DEFAULT_LIMIT } = args;\n\ttry {\n\t\tconst controller = new AbortController();\n\t\tconst timeout = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT_MS);\n\t\tconst searchSignal = signal ? AbortSignal.any([controller.signal, signal]) : controller.signal;\n\t\ttry {\n\t\t\tconst results = await provider.search({\n\t\t\t\tquery,\n\t\t\t\tlimit\n\t\t\t}, searchSignal);\n\t\t\tconst result = {\n\t\t\t\tsuccess: true,\n\t\t\t\toutput: JSON.stringify(results, null, 2)\n\t\t\t};\n\t\t\treturn JSON.stringify(result);\n\t\t} finally {\n\t\t\tclearTimeout(timeout);\n\t\t}\n\t} catch (err) {\n\t\tconst result = {\n\t\t\tsuccess: false,\n\t\t\toutput: \"\",\n\t\t\terror: err instanceof Error ? err.message : String(err)\n\t\t};\n\t\treturn JSON.stringify(result);\n\t}\n}\n/**\n* Create a WebSearchTool instance — register with Robota agent tools registry.\n*/\nfunction createWebSearchTool(options = {}) {\n\tconst provider = options.provider ?? createBraveSearchProvider();\n\treturn createZodFunctionTool(\"WebSearch\", options.description ?? DEFAULT_WEB_SEARCH_DESCRIPTION, WebSearchSchema, async (params, context) => runWebSearch(params, provider, context?.signal));\n}\n/**\n* WebSearchTool instance — register with Robota agent tools registry.\n*/\nconst webSearchTool = createWebSearchTool();\n//#endregion\n//#region src/builtins/ask-user-question-tool.ts\n/**\n* AskUserQuestionTool — let the model ask the user structured questions mid-turn (CMD-005).\n*\n* Built on the CMD-004 ask seam: each question maps onto the `IActionRequest` SSOT and is issued\n* through the injected `IToolExecutionContext.ask` port; the attached environment renders it (Ink\n* dialog, web modal, programmatic pre-answer) and the answers return as the tool result.\n*\n* Contract points (spec CMD-005):\n* - 1–4 questions per call, asked sequentially (the channel's ask queue renders one at a time).\n* - Cancellation is data, not an exception: a dismissed question yields `{ cancelled: true }` and the\n*   remaining unasked questions of the same call are marked cancelled too (no per-item re-prompt).\n* - No `context.ask` (headless/automation): returns `{ unavailable: true, reason }` — never a silent\n*   guess, never a thrown error, so the model can continue autonomously.\n*/\nconst MAX_QUESTIONS = 4;\nconst QuestionSchema = z.object({\n\tquestion: z.string().min(1).describe(\"The complete question to ask the user.\"),\n\theader: z.string().optional().describe(\"Very short topic label for the question (e.g. \\\"Auth method\\\").\"),\n\toptions: z.array(z.union([z.string().min(1).describe(\"Display text of this choice.\"), z.object({\n\t\tlabel: z.string().min(1).describe(\"Display text of this choice.\"),\n\t\tdescription: z.string().optional().describe(\"What choosing this option means.\")\n\t})])).optional().describe(\"Predefined choices (strings or {label, description}). Omit for pure free text.\"),\n\tmultiSelect: z.boolean().optional().describe(\"Allow selecting multiple options (default: single select).\"),\n\tallowFreeText: z.boolean().optional().describe(\"Allow a typed custom answer besides the options (default: true).\")\n});\nconst AskUserQuestionSchema = z.object({ questions: z.array(QuestionSchema).min(1).max(MAX_QUESTIONS).describe(`Questions to ask the user (1-${MAX_QUESTIONS}), rendered one at a time.`) });\nconst ASK_USER_QUESTION_DESCRIPTION = [\n\t\"Ask the user one or more structured questions and wait for their answers.\",\n\t\"\",\n\t\"Use this when you are blocked on a decision only the user can make — ambiguous requirements,\",\n\t\"mutually exclusive approaches, or choices with real trade-offs. Do not use it for decisions with\",\n\t\"a conventional default or facts you can verify yourself.\",\n\t\"\",\n\t`Provide 1-${MAX_QUESTIONS} questions. Each question offers predefined options and/or free text:`,\n\t\" - options + default: user picks one option (or types a custom answer unless allowFreeText: false)\",\n\t\" - multiSelect: true: user may pick several options\",\n\t\" - no options: pure free-text entry\",\n\t\"\",\n\t\"The result is a JSON array with one entry per question: the selected option labels in `values`\",\n\t\"and/or the typed answer in `text`, or `cancelled: true` if the user dismissed the question.\",\n\t\"If no interactive user is attached (headless run), the result is `{ unavailable: true }` —\",\n\t\"continue autonomously with your best judgment and say what you assumed.\"\n].join(\"\\n\");\nfunction toActionRequest(question) {\n\tconst options = (question.options ?? []).map((option) => typeof option === \"string\" ? { label: option } : option);\n\tconst multi = question.multiSelect === true && options.length > 1;\n\treturn {\n\t\tid: `ask_${randomUUID()}`,\n\t\ttitle: question.question,\n\t\t...question.header !== void 0 ? { description: question.header } : {},\n\t\t...options.length > 0 ? { options: options.map((o) => ({\n\t\t\tvalue: o.label,\n\t\t\tlabel: o.label,\n\t\t\t...o.description !== void 0 ? { description: o.description } : {}\n\t\t})) } : {},\n\t\tminSelect: options.length > 0 ? 1 : 0,\n\t\tmaxSelect: multi ? options.length : 1,\n\t\tallowFreeText: question.allowFreeText !== false || options.length === 0\n\t};\n}\nasync function askQuestions(args, ask) {\n\tconst answers = [];\n\tlet dismissed = false;\n\tfor (const question of args.questions) {\n\t\tif (dismissed) {\n\t\t\tanswers.push({\n\t\t\t\tquestion: question.question,\n\t\t\t\tcancelled: true\n\t\t\t});\n\t\t\tcontinue;\n\t\t}\n\t\tconst response = await ask(toActionRequest(question));\n\t\tif (response.type === \"cancelled\") {\n\t\t\tdismissed = true;\n\t\t\tanswers.push({\n\t\t\t\tquestion: question.question,\n\t\t\t\tcancelled: true\n\t\t\t});\n\t\t\tcontinue;\n\t\t}\n\t\tanswers.push({\n\t\t\tquestion: question.question,\n\t\t\tvalues: [...response.values],\n\t\t\t...response.text !== void 0 ? { text: response.text } : {}\n\t\t});\n\t}\n\treturn { answers };\n}\n/**\n* Create an `AskUserQuestion` tool instance — register with the Robota agent tools registry.\n*/\nfunction createAskUserQuestionTool(options = {}) {\n\treturn createZodFunctionTool(\"AskUserQuestion\", options.description ?? ASK_USER_QUESTION_DESCRIPTION, AskUserQuestionSchema, async (params, context) => {\n\t\tconst args = params;\n\t\tconst ask = context?.ask;\n\t\tconst output = ask ? await askQuestions(args, ask) : {\n\t\t\tunavailable: true,\n\t\t\treason: \"no interactive user attached\"\n\t\t};\n\t\tconst result = {\n\t\t\tsuccess: true,\n\t\t\toutput: JSON.stringify(output)\n\t\t};\n\t\treturn JSON.stringify(result);\n\t});\n}\n/** `AskUserQuestion` tool instance — register with the Robota agent tools registry. */\nconst askUserQuestionTool = createAskUserQuestionTool();\n//#endregion\n//#region src/builtins/tool-search-matching.ts\n/** Both vendors default a tool search to five results; so does this one. */\nconst DEFAULT_TOOL_SEARCH_LIMIT = 5;\n/**\n* Where a query matched, lowest first — the primary sort key.\n*\n* A tool whose NAME the query names is a better answer than one that merely mentions it in a\n* parameter description, and saying so is what makes \"the top five\" meaningful once a catalog is\n* large enough for the limit to bite.\n*/\nconst RANK_EXACT_NAME = 0;\nconst RANK_NAME = 1;\nconst RANK_DESCRIPTION = 2;\nconst RANK_PARAMETER = 3;\n/** Not a match at all — filtered out rather than ranked last. */\nconst RANK_NONE = Number.POSITIVE_INFINITY;\n/** Every parameter name and description in a schema, including nested nodes. */\nfunction collectParameterText(node, into) {\n\tif (node.description !== void 0) into.push(node.description);\n\tfor (const [name, child] of Object.entries(node.properties ?? {})) {\n\t\tinto.push(name);\n\t\tcollectParameterText(child, into);\n\t}\n\tif (node.items !== void 0) collectParameterText(node.items, into);\n\tfor (const branch of node.anyOf ?? []) collectParameterText(branch, into);\n}\nfunction rankMatch(schema, query) {\n\tconst name = schema.name.toLowerCase();\n\tif (name === query) return RANK_EXACT_NAME;\n\tif (name.includes(query)) return RANK_NAME;\n\tif (schema.description.toLowerCase().includes(query)) return RANK_DESCRIPTION;\n\tconst parameterText = [];\n\tcollectParameterText(schema.parameters, parameterText);\n\tif (parameterText.some((text) => text.toLowerCase().includes(query))) return RANK_PARAMETER;\n\treturn RANK_NONE;\n}\n/**\n* The tools a query selects, best match first and capped at `limit`.\n*\n* Ordering is total and deterministic: rank first, then name, so two tools that matched the same way\n* never trade places between calls. An empty query string matches nothing rather than everything —\n* \"search for nothing\" is a question with an empty answer, not a request for the whole catalog.\n*/\nfunction matchDeferredTools(schemas, query, limit) {\n\tconst needle = query.trim().toLowerCase();\n\tif (needle.length === 0) return [];\n\treturn schemas.map((schema) => ({\n\t\tschema,\n\t\trank: rankMatch(schema, needle)\n\t})).filter((entry) => entry.rank !== RANK_NONE).sort((a, b) => a.rank - b.rank || (a.schema.name < b.schema.name ? -1 : 1)).slice(0, limit).map((entry) => entry.schema);\n}\n//#endregion\n//#region src/builtins/tool-search-tool.ts\n/**\n* ToolSearch — the model-facing half of client-side tool deferral (CLI-1990 § Solution 4).\n*\n* A tool that declares `deferLoading` is withheld from the request entirely while the tool-search\n* policy is engaged, so the model never sees its schema. This tool is how the model gets it back:\n* it searches the withheld catalog by query, or loads an exact list by name, and the runtime marks\n* the matches loaded — so the NEXT round's `tools` array carries their full definitions and they\n* stay callable for the rest of the session.\n*\n* Deliberately an ordinary function tool rather than a vendor block. Anthropic and OpenAI each ship\n* a server-side tool search, but neither reduces the request payload (the API needs every definition\n* to run the search), Gemini has no equivalent at all, and both vendors document a client-executed\n* search as the portable form. One shape therefore runs everywhere and saves both wire bytes and\n* context tokens.\n*\n* Two results are NOT errors, and the distinction is the contract:\n* - a query that matches nothing returns `{ loaded: [], unavailableSources: [] }` — a normal empty\n*   answer, mirroring the vendor's own empty `tool_references` array;\n* - an unknown entry in `names` throws, naming the entry, and loads nothing — asking for a tool that\n*   does not exist is a mistake to correct, not an empty search.\n*\n* `unavailableSources` is present and empty from day one. MCP-003 (the connection and capability\n* supervisor) fills it with servers that failed or need auth, so a model told \"nothing matched\" can\n* tell that apart from \"the server holding it is down\" — without a contract change here.\n*/\n/**\n* The registered name — agent-core's own constant, re-exported under this package's name so the\n* execution layer's unknown-tool remedy and this tool can never name two different things.\n*/\nconst TOOL_SEARCH_NAME = TOOL_SEARCH_TOOL_NAME;\nconst ToolSearchSchema = z.object({\n\tquery: z.string().optional().describe(\"Text matched case-insensitively against each withheld tool's name, description, and its parameters' names and descriptions. An exact tool name is a valid query.\"),\n\tnames: z.array(z.string().min(1)).optional().describe(\"Exact tool names to load, skipping the search. An unknown name is an error naming it.\"),\n\tlimit: z.number().int().positive().optional().describe(`Maximum tools to load from a query match (default 5).`)\n});\nconst TOOL_SEARCH_DESCRIPTION = [\n\t\"Load tools whose definitions are withheld from your tool list, so you can call them.\",\n\t\"\",\n\t\"Some tools are deferred: they exist and are callable, but their schemas are not sent to you until\",\n\t\"you load them here. If a capability you need is not in your tool list, search for it before\",\n\t\"concluding it is unavailable — and if a tool call fails as \\\"deferred and not yet loaded\\\", load it\",\n\t\"with this tool and call it again.\",\n\t\"\",\n\t\" - query: what you are trying to do (e.g. \\\"read a spreadsheet\\\", \\\"postgres\\\"). Matched against tool\",\n\t\"   names, descriptions, and parameter names and descriptions. An exact tool name works too.\",\n\t` - names: load exactly these tools, skipping the search. Unknown names are an error.`,\n\t` - limit: how many matches to load (default 5).`,\n\t\"\",\n\t\"The result lists what is now loaded; those tools appear in your tool list from your next turn and\",\n\t\"stay available. A query that matches nothing returns an empty list — that is a normal answer, not\",\n\t\"a failure. `unavailableSources` names any tool source that could not be consulted.\"\n].join(\"\\n\");\n/**\n* The catalog the runtime injects, or a thrown wiring error.\n*\n* Its absence is not a runtime condition to degrade around: `ToolExecutionService` attaches this\n* port to every tool call it issues, so a missing one means this tool was invoked outside the\n* execution loop. Guessing an empty catalog there would report \"nothing matched\" for a search that\n* was never actually run.\n*/\nfunction requireCatalog(context) {\n\tconst catalog = context?.deferredTools;\n\tif (!catalog) throw new Error(`${TOOL_SEARCH_NAME} requires the deferred-tool catalog, which the execution runtime injects; it was not present, so this tool was called outside the agent execution loop.`);\n\treturn catalog;\n}\n/** Which schemas this call loads: the exact `names`, else the query's ranked matches. */\nfunction selectTools(args, catalog) {\n\tif (args.names !== void 0) return catalog.loadDeferredTools(args.names);\n\tif (args.query === void 0) throw new Error(`${TOOL_SEARCH_NAME} needs either \"query\" to search for tools or \"names\" to load exact ones.`);\n\tconst matches = matchDeferredTools(catalog.listDeferredTools(), args.query, args.limit ?? 5);\n\treturn catalog.loadDeferredTools(matches.map((schema) => schema.name));\n}\n/**\n* Create a `ToolSearch` tool instance — register it RESIDENT with the agent's tool registry.\n*\n* It must never itself be deferred: a search tool the model cannot see is a catalog with no way in,\n* which is the state the vendor's own \"at least one tool must stay resident\" invariant forbids.\n*/\nfunction createToolSearchTool(options = {}) {\n\treturn createZodFunctionTool(TOOL_SEARCH_NAME, options.description ?? TOOL_SEARCH_DESCRIPTION, ToolSearchSchema, async (params, context) => {\n\t\tconst output = {\n\t\t\tloaded: selectTools(params, requireCatalog(context)).map(({ name, description }) => ({\n\t\t\t\tname,\n\t\t\t\tdescription\n\t\t\t})),\n\t\t\tunavailableSources: []\n\t\t};\n\t\tconst result = {\n\t\t\tsuccess: true,\n\t\t\toutput: JSON.stringify(output)\n\t\t};\n\t\treturn JSON.stringify(result);\n\t});\n}\n/** `ToolSearch` tool instance — register with the Robota agent tools registry. */\nconst toolSearchTool = createToolSearchTool();\n//#endregion\nexport { DEFAULT_OS_SANDBOX_SETTINGS, DEFAULT_TOOL_SEARCH_LIMIT, E2BSandboxClient, GrepIsolationError, InMemorySandboxClient, OsSandboxClient, PageComputerDriver, REPO_MAP_INDEX_VERSION, ReadByteLimitError, ReadCancelledError, RepoMapRetrievalAdapter, TOOL_SEARCH_NAME, applyWorkspaceManifest, askUserQuestionTool, bubblewrapArguments, buildRepoMapIndex, createAskUserQuestionTool, createBashTool, createBraveSearchProvider, createComputerActTool, createComputerTool, createComputerViewTool, createEditTool, createFunctionTool, createGlobTool, createGrepTool, createReadTool, createRetrievalTool, createShellTool, createToolSearchTool, createWebFetchTool, createWebSearchTool, createWriteTool, createZodFunctionTool, describeExecutionContainment, deserializeRepoMapIndex, detectOsSandbox, matchDeferredTools, protectedWorkspaceEntries, routesFilesThroughSandbox, seatbeltProfile, serializeRepoMapIndex, toolSearchTool, updateRepoMapIndex, validateWorkspaceManifestPath, webFetchTool, webSearchTool };\n\n//# sourceMappingURL=index.js.map"],"mappings":"8uCAA+C,MAAM,GAAE,IAAI,GAAE,QAAQ,WAAW,QAAQ,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE,WAAW,MAAM,EAAE,aAAa,IAAI,CAAC,SAAS,GAAE,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,IAAG,OAAO,EAAE,KAAK,SAAS,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,GAAE,EAAE,EAAE,CAAC,GAAG,IAAG,OAAO,EAAE,KAAK,SAAS,CAAC,GAAE,WAAW,CAAC,OAAO,OAAO,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,QAAQ,CAAC,EAAE,MAAM,CAAC,GAAE,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,IAAI,EAAE,EAAE,QAAQ,UAAU,EAAE,EAAE,cAAc,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,KAAK,SAAS,MAAM,MAAM,yEAAyE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,OAAO,IAAI,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,eAAe,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAE,EAAE,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,CAAC,GAAG,GAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CCAtY,SAAS,GAAE,EAAE,CAAC,GAAG,OAAO,GAAG,SAAS,MAAM,UAAU,gCAAgC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,SAAS,EAAE,MAAM,UAAU,0CAA0C,EAAE,GAAG,CAACA,EAAE,CAAC,EAAE,MAAM,UAAU,wCAAwC,EAAE,IAAI,EAAE,GAAG,CAAC,EAAEC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,UAAU,0DAA0D,CAAC,CAAC,GAAG,CAACC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,UAAU,qCAAqC,EAAE,GAAG,CAAC,GAAE,EAAEC,GAAE,KAAKA,GAAE,IAAI,CAAC,MAAM,CAAC,MAAM,UAAU,0DAA0D,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,GAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAEC,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,OAAOC,EAAEJ,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAEK,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,OAAOF,EAAE,CAAC,EAAE,EAAE,QAAQG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAE,CAAC,EAAE,EAAE,GAAE,CAAC,EAAE,OAAO,IAAI,GAAG,EAAE,WAAW,EAAEC,EAAC,CAAC,CAAmB,IAAI,GAAE,cAAc,KAAK,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK,oBAAoB,CAAC,EAAE,SAAS,EAAE,EAAE,QAAQ,SAAS,CAAC,OAAO,IAAI,QAAQ,cAAc,YAAY,CAAC,SAAS,GAAE,EAAE,EAAE,CAAC,IAAI,EAAEC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,IAAI,GAAGT,EAAE,CAAC,EAAE,MAAM,IAAI,GAAE,cAAc,EAAE,yBAAyB,EAAE,iDAAiD,EAAE,IAAI,EAAE,EAAE,MAAMQ,EAAC,CAAC,CAAC,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,EAAEH,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,aAAa,OAAO,IAAI,GAAG,EAAE,WAAW,GAAGH,EAAE,CAAC,CAAC,CAAC,KAAK,MAAA,CAAO,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,GAAE,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,mHAAmH,CAAC,CAAC,SAAS,GAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAIQ,GAAE,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,aAAa,IAAK,GAAE,CAAC,CAAC,EAAE,GAAE,EAAE,WAAW,CAAC,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,IAAI,cAAc,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,GAAE,EAAE,EAAE,CAAC,GAAEJ,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,MAAM,GAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAEK,GAAE,EAAE,EAAE,CAAC,SAAS,OAAO,KAAK,IAAI,KAAK,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAEC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,GAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,SAAS,GAAE,EAAE,CAAC,GAAG,EAAE,IAAI,aAAa,OAAO,IAAI,EAAE,GAAG,CAAC,EAAEV,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,KAAKQ,GAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,SAAS,GAAE,EAAE,CAAC,IAAI,EAAEG,GAAE,CAAC,EAAE,OAAO,IAAI,EAAE,GAAE,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,IAAI,GAAG,GAAE,CAAC,CAAC,CAAC,SAAS,GAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,GAAG,IAAI,GAAG,IAAI,IAAI,KAAK,IAAI,GAAG,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,IAAI,MAAM,IAAI,IAAI,IAAI,KAAK,GAAG,GAAG,CAAC,SAAS,GAAE,EAAE,CAAC,IAAI,EAAE,GAAE,CAAC,EAAE,GAAG,IAAI,IAAK,GAAE,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,OAAO,IAAI,KAAK,IAAI,OAAO,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,GAAE,CAAC,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,EAAE,QAAQ,QAAQ,EAAE,QAAQ,KAAK,CAAC,SAAS,GAAE,EAAE,CAAC,IAAI,EAAE,EAAE,YAAY,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAGA,GAAE,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,EAAE,GAAG,GAAG,EAAE,EAAA,CAAG,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,EAAA,CAAG,SAAS,EAAE,EAAE,MAAM,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,SAAS,GAAE,EAAE,CAAC,IAAI,EAAE,GAAE,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,IAAK,GAAE,OAAO,IAAI,EAAE,EAAE,MAAM,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,OAAO,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,GAAG,EAAE,SAAS,GAAG,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAK,GAAE,CAAC,CAAC,MAAM,GAAE,IAAIC,GAAE,IAAI,GAAE,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,EAAE,GAAE,IAAI,IAAI,CAAC,YAAY,WAAW,2BAA2B,gBAAgB,gBAAgB,4BAA4B,CAAC,EAAE,EAAE,KAAM,KAAI,MAAMC,GAAE,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAA,CAAG,IAAI,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,GAAG,EAAE,WAAW,SAAS,EAAE,WAAW,SAAS,MAAM,CAAC,OAAO,qBAAqB,IAAI,EAAE,QAAQ,mCAAmC,EAAE,GAAG,EAAE,wBAAwB,CAAC,EAAE,OAAO,IAAI,EAAE,EAAE,SAAS,QAAQ,WAAW,EAAE,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,cAAc,SAAS,CAAC,EAAE,OAAO,GAAG,GAAE,IAAI,CAAC,GAAG,EAAE,SAAS,YAAY,EAAE,MAAM,CAAC,OAAO,gBAAgB,IAAI,EAAE,QAAQ,gBAAgB,EAAE,wEAAwE,EAAE,IAAI,EAAEF,GAAE,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,GAAE,EAAE,CAAC,EAAE,GAAG,IAAI,IAAK,IAAG,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,eAAe,IAAI,EAAE,QAAQ,gBAAgB,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAC,EAAE,GAAG,IAAI,IAAK,GAAE,MAAM,CAAC,OAAO,sBAAsB,IAAI,EAAE,QAAQ,gBAAgB,EAAE,gBAAgB,EAAE,8EAA8E,CAAC,CAAC,eAAe,GAAE,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,GAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,WAAW,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,kBAAkBC,GAAE,EAAE,EAAE,cAAc,EAAE,EAAE,YAAY,QAAQ,EAAE,WAAW,EAAC,EAAE,EAAE,EAAE,OAAO,YAAY,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,IAAI,IAAK,GAAE,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,QAAQ,CAAC,EAAE,GAAG,CAAC,GAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,IAAI,UAAU,EAAE,GAAG,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,OAAO,4BAA4B,IAAI,EAAE,KAAK,QAAQ,QAAQ,EAAE,OAAO,4BAA4B,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,OAAO,iBAAiB,IAAI,EAAE,KAAK,QAAQ,aAAa,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,eAAe,GAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,WAAW,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,kBAAkBA,GAAE,EAAE,YAAY,QAAQ,EAAE,WAAW,EAAC,EAAE,EAAE,EAAE,OAAO,YAAY,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,GAAG,IAAI,IAAK,GAAE,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,OAAO,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,OAAO,EAAE,SAAS,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,KAAK,EAAE,OAAO,KAAK,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,UAAU,IAAK,EAAC,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,OAAO,mBAAmB,IAAI,EAAE,KAAK,QAAQ,QAAQ,EAAE,OAAO,8BAA8B,CAAC,GAAG,GAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,GAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,QAAQ,CAAC,EAAE,EAAE,YAAY,IAAI,eAAe,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC,eAAe,GAAE,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,OAAO,qBAAqB,IAAI,EAAE,QAAQ,oBAAoB,EAAE,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,IAAI,gBAAgB,CAAC,EAAE,GAAG,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,MAAM,EAAE,MAAM,OAAO,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,OAAO,EAAE,aAAa,WAAW,CAAC,IAAI,EAAE,IAAI,WAAW,MAAM,EAAE,YAAY,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,UAAU,MAAM,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,UAAU,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,WAAW,EAAE,EAAE,OAAO,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,WAAW,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,WAAW,EAAE,WAAW,QAAQ,EAAE,QAAQ,KAAK,EAAE,SAAS,CAAC,CAAC,CCoHtwN,SAAS,GAA6B,EAAQ,CAE7C,OADI,IAAW,IAAK,GAAU,OACvB,WAAW,EAAO,YAAc,YACxC,CAEA,SAAS,GAA0B,EAAQ,CAC1C,OAAO,GAA6B,CAAM,IAAM,kBACjD,CAWA,SAAS,GAAoC,EAAU,CACtD,IAAM,EAAgB,CAAC,EACnB,EAAS,aAAe,OAAO,KAAK,EAAS,WAAW,CAAC,CAAC,OAAS,GAAG,EAAc,KAAK,aAAa,EAC1G,IAAM,EAAc,EAAS,YAE7B,GAAI,GAAe,OAAO,OAAO,CAAW,CAAC,CAAC,KADnB,GAAU,MAAM,QAAQ,CAAK,EAAI,EAAM,OAAS,EAAI,IAAU,IAAK,EAC1B,GAAG,EAAc,KAAK,aAAa,EACnG,EAAc,SAAW,EAC7B,MAAU,MAAM,+BAA+B,EAAc,KAAK,OAAO,EAAE,uUAAuU,CACnZ,CAGA,MACM,GAAgC,kBAChC,GAAsB,KAC5B,eAAe,GAAuB,EAAe,EAAU,EAAU,CAAC,EAAG,CAC5E,GAAI,EAAc,cAAe,OAAO,EAAc,cAAc,EAAU,CAAO,EACrF,GAAoC,CAAQ,EAC5C,IAAM,EAAa,GAAqB,EAAQ,YAAc,YAAmB,EAC3E,EAAiB,CAAC,EACxB,IAAK,GAAM,CAAC,EAAS,KAAU,OAAO,QAAQ,EAAS,OAAO,EAAG,CAChE,IAAM,EAAO,GAA8B,CAAO,EAC5C,EAAa,GAAgB,EAAY,CAAI,EACnD,EAAe,KAAK,MAAM,GAAmB,EAAe,EAAM,EAAY,EAAY,EAAO,CAAO,CAAC,CAC1G,CACA,MAAO,CAAE,QAAS,CAAe,CAClC,CACA,SAAS,GAA8B,EAAM,CAC5C,GAAI,EAAK,SAAW,EAAG,MAAU,MAAM,2CAA2C,EAClF,GAAI,EAAK,SAAS,IAAI,EAAG,MAAU,MAAM,oDAAoD,EAC7F,GAAI,EAAK,WAAW,GAAG,GAAK,EAAK,WAAW,IAAI,GAAK,GAA8B,KAAK,CAAI,EAAG,MAAU,MAAM,oDAAoD,EACnK,IAAM,EAAQ,EAAK,QAAQ,MAAO,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,EAChE,GAAI,EAAM,SAAW,EAAG,MAAU,MAAM,gEAAgE,EACxG,GAAI,EAAM,KAAM,GAAS,IAAS,IAAI,EAAG,MAAU,MAAM,2DAA2D,EACpH,IAAM,EAAkB,EAAM,OAAQ,GAAS,IAAS,GAAG,EAC3D,GAAI,EAAgB,SAAW,EAAG,MAAU,MAAM,gEAAgE,EAClH,OAAO,EAAgB,KAAK,GAAG,CAChC,CACA,eAAe,GAAmB,EAAe,EAAM,EAAY,EAAY,EAAO,EAAS,CAC9F,OAAQ,EAAM,KAAd,CACC,IAAK,OAEJ,OADA,MAAM,GAAiB,EAAe,EAAY,EAAY,EAAM,OAAO,EACpE,EAAmB,EAAM,EAAM,IAAI,EAC3C,IAAK,MAEJ,OADA,MAAM,EAAuB,EAAe,CAAU,EAC/C,EAAmB,EAAM,EAAM,IAAI,EAC3C,IAAK,YAEJ,OADA,MAAM,GAAc,EAAe,EAAM,IAAK,EAAY,EAAY,CAAO,EACtE,EAAmB,EAAM,EAAM,IAAI,EAC3C,IAAK,WAEJ,OADA,MAAM,GAAmB,EAAe,EAAM,IAAK,EAAY,CAAO,EAC/D,EAAmB,EAAM,EAAM,IAAI,EAC3C,IAAK,UAEJ,OADA,MAAM,GAAmB,EAAe,EAAO,CAAU,EAClD,EAAmB,EAAM,EAAM,IAAI,EAC3C,IAAK,UACL,IAAK,WACL,IAAK,UACL,IAAK,iBAAkB,MAAO,CAC7B,OACA,KAAM,EAAM,KACZ,OAAQ,cACR,QAAS,GAAG,EAAM,KAAK,+CACxB,EACA,QAAS,OAAO,GAAkB,CAAK,CACxC,CACD,CACA,SAAS,EAAmB,EAAM,EAAM,CACvC,MAAO,CACN,OACA,OACA,OAAQ,SACT,CACD,CACA,eAAe,GAAc,EAAe,EAAQ,EAAY,EAAY,EAAS,CACpF,MAAM,GAAiB,EAAe,EAAY,EAAY,MAAM,GAAS,GAAsB,EAAQ,EAAQ,QAAQ,EAAG,MAAM,CAAC,CACtI,CACA,eAAe,GAAmB,EAAe,EAAQ,EAAY,EAAS,CAC7E,MAAM,GAA4B,EAAe,GAAsB,EAAQ,EAAQ,QAAQ,EAAG,CAAU,CAC7G,CACA,eAAe,GAA4B,EAAe,EAAY,EAAY,CACjF,MAAM,EAAuB,EAAe,CAAU,EACtD,IAAM,EAAU,MAAM,GAAQ,EAAY,CAAE,cAAe,EAAK,CAAC,EACjE,IAAK,IAAM,KAAS,EAAS,CAC5B,IAAM,EAAkB,EAAK,EAAY,EAAM,IAAI,EAC7C,EAAkB,GAAgB,EAAY,EAAM,IAAI,EAC9D,GAAI,EAAM,YAAY,EAAG,CACxB,MAAM,GAA4B,EAAe,EAAiB,CAAe,EACjF,QACD,CACA,GAAI,EAAM,OAAO,EAAG,CACnB,IAAM,EAAU,MAAM,GAAS,EAAiB,MAAM,EACtD,MAAM,EAAc,UAAU,EAAiB,CAAO,CACvD,CACD,CACD,CACA,eAAe,GAAmB,EAAe,EAAO,EAAY,CACnE,MAAM,GAAkB,EAAe,YAAY,EAAM,UAAY,GAAQ,GAAK,eAAe,EAAM,IAAM,aAAa,EAAc,EAAM,GAAG,IAAM,GAAG,GAAG,EAAc,EAAM,GAAG,EAAE,GAAG,EAAc,CAAU,GAAG,CACrN,CACA,eAAe,GAAiB,EAAe,EAAY,EAAY,EAAS,CAC/E,IAAM,EAAa,EAAM,QAAQ,CAAU,EACvC,IAAe,GAAY,MAAM,EAAuB,EAAe,CAAU,EACrF,MAAM,EAAc,UAAU,EAAY,CAAO,CAClD,CACA,eAAe,EAAuB,EAAe,EAAY,CAChE,MAAM,GAAkB,EAAe,YAAY,EAAc,CAAU,GAAG,CAC/E,CACA,eAAe,GAAkB,EAAe,EAAS,CACxD,IAAM,EAAS,MAAM,EAAc,IAAI,CAAO,EAC9C,GAAI,EAAO,WAAa,EAAG,MAAU,MAAM,sCAAsC,EAAQ,IAAI,EAAO,QAAU,EAAO,QAAQ,CAC9H,CACA,SAAS,GAAsB,EAAQ,EAAU,CAChD,OAAO,EAAW,CAAM,EAAI,EAAQ,CAAM,EAAI,EAAQ,GAAY,QAAQ,IAAI,EAAG,CAAM,CACxF,CAQA,SAAS,GAAoB,EAAO,CACnC,IAAI,EAAM,EAAM,OAChB,KAAO,EAAM,GAAK,EAAM,EAAM,KAAO,KAAK,IAC1C,OAAO,EAAM,MAAM,EAAG,CAAG,CAC1B,CACA,SAAS,GAAqB,EAAM,CACnC,IAAM,EAAa,GAAoB,EAAK,QAAQ,MAAO,GAAG,CAAC,EAC/D,GAAI,CAAC,EAAW,WAAW,GAAG,EAAG,MAAU,MAAM,gEAAgE,EACjH,OAAO,EAAW,SAAW,EAAI,IAAM,CACxC,CACA,SAAS,GAAgB,EAAM,EAAM,CACpC,IAAM,EAAiB,GAAqB,CAAI,EAEhD,OADI,IAAmB,IAAY,IAAI,IAChC,GAAG,EAAe,GAAG,GAC7B,CACA,SAAS,EAAc,EAAO,CAC7B,MAAO,IAAI,EAAM,QAAQ,GAAqB,OAAO,EAAE,EACxD,CACA,SAAS,GAAkB,EAAO,CACjC,MAAU,MAAM,yCAAyC,KAAK,UAAU,CAAK,GAAG,CACjF,CAeA,MAAM,GAA4B,CAAC,oBAAqB,mBAAmB,EAC3E,SAAS,EAAO,EAAM,EAAU,CAC/B,IAAI,EAAM,EAAK,OACf,KAAO,EAAM,GAAK,EAAK,EAAM,KAAO,KAAK,IACzC,MAAO,GAAG,EAAK,MAAM,EAAG,CAAG,EAAE,GAAG,GACjC,CAOA,SAAS,IAA4B,CACpC,MAAO,CAAC,GAAGE,EAA2B,GAAGC,CAAoB,CAC9D,CAEA,SAAS,GAAoB,EAAO,CACnC,GAAM,CAAE,UAAW,EACb,EAAO,CACZ,YACA,IACA,IACA,QACA,OACA,SACA,OACD,EACA,IAAK,IAAM,IAAQ,CAClB,EAAO,KACP,GAAG,EAAO,gBACV,GAAG,EAAO,UACX,EAAG,EAAK,KAAK,aAAc,EAAM,CAAI,EACrC,IAAK,IAAM,KAAS,GAA0B,EAAG,CAChD,IAAM,EAAO,EAAO,EAAO,KAAM,CAAK,EAClC,EAAM,OAAO,CAAI,GAAG,EAAK,KAAK,YAAa,EAAM,CAAI,CAC1D,CACA,IAAK,IAAM,KAAS,GAA2B,CAC9C,IAAM,EAAO,EAAO,EAAO,KAAM,CAAK,EACjC,KAAM,OAAO,CAAI,EACtB,GAAK,KAAK,SAAU,EAAM,CAAI,EAC9B,IAAK,IAAM,KAAQ,EAAM,cAAc,CAAI,EAAG,CAC7C,IAAM,EAAU,EAAO,EAAM,GAAG,EAAK,MAAM,EACvC,EAAM,OAAO,CAAO,GAAG,EAAK,KAAK,YAAa,EAAS,CAAO,CACnE,CAJ8B,CAK/B,CACA,IAAK,IAAM,KAAU,EAAO,SACtB,EAAM,OAAO,EAAO,IAAI,IACzB,EAAO,UAAW,EAAK,KAAK,UAAW,EAAO,IAAI,EACjD,EAAK,KAAK,YAAa,YAAa,EAAO,IAAI,GAErD,GAAI,CAAC,EAAO,QAAS,CACpB,GAAI,EAAM,oBAAsB,IAAK,GAAG,MAAU,MAAM,iEAAiE,EACzH,EAAK,KAAK,gBAAiB,YAAa,OAAO,EAAM,iBAAiB,CAAC,CACxE,CAGA,OAFA,EAAK,KAAK,gBAAiB,oBAAqB,gBAAiB,UAAW,EAAM,GAAG,EACrF,EAAK,KAAK,KAAM,EAAM,OAAO,EACtB,CAAC,GAAG,EAAM,GAAG,EAAM,IAAI,CAC/B,CACA,SAAS,GAAY,EAAM,CAC1B,OAAO,EAAK,QAAQ,uBAAyB,GAAS,KAAK,GAAM,CAClE,CACA,SAAS,EAAM,EAAM,CACpB,MAAO,IAAI,EAAK,QAAQ,MAAO,MAAM,CAAC,CAAC,QAAQ,KAAM,KAAM,EAAE,EAC9D,CAKA,SAAS,GAAgB,EAAQ,CAChC,IAAM,EAAW,CAChB,EAAO,KACP,GAAG,EAAO,gBACV,GAAG,EAAO,UACX,CAAC,CAAC,IAAK,GAAS,YAAY,EAAM,CAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,EAC9C,EAAmB,GAA0B,CAAC,CAAC,IAAK,GAAU,CACnE,IAAM,EAAO,EAAO,EAAO,KAAM,CAAK,EACtC,OAAOA,EAAqB,SAAS,CAAK,EAAI,YAAY,EAAM,CAAI,EAAE,GAAK,YAAY,EAAM,CAAI,EAAE,EACpG,CAAC,EACK,EAAY,GAA0B,IAAK,GAAU,YAAY,EAAM,EAAO,EAAO,KAAM,CAAK,CAAC,EAAE,EAAE,EACrG,EAAS,CAAC,YAAY,EAAM,EAAO,EAAO,KAAM,MAAM,CAAC,EAAE,GAAI,GAAG,GAA0B,IAAK,GAAU,aAAa,GAAY,EAAO,EAAO,KAAM,CAAK,CAAC,EAAE,iBAAiB,CAAC,EAChL,EAAQ,CACb,cACA,kBACA,qBACA,sBAAsB,EAAS,mEAC/B,qBAAqB,EAAiB,KAAK,GAAG,EAAE,GAChD,sBAAsB,EAAU,KAAK,GAAG,EAAE,GAC1C,qBAAqB,EAAO,KAAK,GAAG,EAAE,EACvC,EACA,GAAI,EAAO,SAAS,OAAS,EAAG,CAC/B,IAAM,EAAS,EAAO,SAAS,IAAK,GAAU,EAAM,UAAY,YAAY,EAAM,EAAM,IAAI,EAAE,GAAK,YAAY,EAAM,EAAM,IAAI,EAAE,EAAE,EACnI,EAAM,KAAK,oBAAoB,EAAO,KAAK,GAAG,EAAE,EAAE,CACnD,CAEA,OADK,EAAO,SAAS,EAAM,KAAK,iBAAiB,EAC1C,EAAM,KAAK;CAAI,CACvB,CAcA,MAcM,GAAgB,CACrB,IAAK,CACJ,MAAO,WACP,OAAQ,GACR,aAAc,GACf,EACA,MAAO,CACN,MAAO,WACP,OAAQ,IACR,aAAc,GACf,CACD,EACA,SAAS,EAAY,EAAM,EAAI,EAAI,EAAG,CACrC,MAAO,CACN,EACA,EACA,EACA,CACD,CACD,CAKA,SAAS,GAAwB,EAAO,QAAQ,KAAM,CACrD,IAAM,EAAS,GAAc,GAC7B,GAAI,IAAW,IAAK,GAAG,OACvB,IAAM,EAAS,GAAS,OAAoB,EACtC,EAAU,CACf,EAAY,GAAc,EAAG,EAAG,CAAW,EAC3C,EAAY,GAAe,EAAG,EAAG,EAAO,KAAK,EAC7C,EAAY,EAAW,EAAG,EAAG,EAAM,CAAK,CAAC,EACzC,EAAY,GAAc,EAAG,EAAG,CAAS,EACzC,EAAY,GAAgB,EAAG,EAAG,UAAe,EACjD,EAAY,EAAW,EAAG,EAAG,EAAM,CAAK,CAAC,EACzC,EAAY,GAAe,EAAG,EAAG,EAAO,YAAY,EACpD,EAAY,EAAW,EAAG,EAAG,EAAM,CAAK,CAAC,EACzC,EAAY,GAAe,EAAG,EAAG,EAAO,MAAM,EAC9C,EAAY,GAAc,EAAG,EAAG,EAAe,EAC/C,EAAY,GAAe,EAAG,EAAG,CAAO,EACxC,EAAY,EAAW,EAAG,EAAG,EAAM,EAAY,CAAC,EAChD,EAAY,EAAW,EAAG,EAAG,UAAiB,CAC/C,EACM,EAAQ,IAAI,WAAW,EAAQ,OAAS,CAAC,EACzC,EAAO,IAAI,SAAS,EAAM,MAAM,EAOtC,OANA,EAAQ,SAAS,CAAC,EAAM,EAAI,EAAI,GAAI,IAAU,CAC7C,EAAK,UAAU,EAAQ,EAAG,EAAM,EAAI,EACpC,EAAK,SAAS,EAAQ,EAAI,EAAG,CAAE,EAC/B,EAAK,SAAS,EAAQ,EAAI,EAAG,CAAE,EAC/B,EAAK,UAAU,EAAQ,EAAI,EAAG,IAAM,EAAG,EAAI,CAC5C,CAAC,EACM,CACR,CAYA,MAAM,GAA8B,OAAO,OAAO,CACjD,QAAS,GACT,yBAA0B,GAC1B,iBAAkB,CAAC,EACnB,WAAY,CAAC,EACb,SAAU,CAAC,EACX,QAAS,EACV,CAAC,EACK,GAAsB,wBAC5B,SAAS,GAAa,EAAS,EAAM,CACpC,IAAM,EAAS,GAAU,EAAS,CAAC,GAAG,CAAI,EAAG,CAC5C,QAAS,IACT,SAAU,MACX,CAAC,EACD,GAAI,EAAO,QAAU,IAAK,GAAG,MAAO,CACnC,GAAI,GACJ,OAAQ,EAAO,MAAM,OACtB,EACA,IAAM,GAAU,EAAO,QAAU,GAAA,CAAI,KAAK,CAAC,CAAC,MAAM;CAAI,CAAC,CAAC,GACxD,OAAO,EAAO,SAAW,EAAI,CAAE,GAAI,EAAK,EAAI,CAC3C,GAAI,GACJ,GAAG,EAAS,CAAE,QAAO,EAAI,CAAC,CAC3B,CACD,CAEA,SAAS,GAAgB,EAAU,CAAC,EAAG,CACtC,IAAM,EAAW,EAAQ,UAAY,QAAQ,SACvC,EAAQ,EAAQ,OAAS,GAC/B,GAAI,IAAa,QAAS,CACzB,GAAI,GAAwB,EAAQ,MAAQ,QAAQ,IAAI,IAAM,IAAK,GAAG,MAAO,CAC5E,QAAS,aACT,QAAS,CAAC,wBAAwB,EAAQ,MAAQ,QAAQ,KAAK,+BAA+B,CAC/F,EACA,IAAM,EAAQ,EAAM,QAAS,CAC5B,YACA,IACA,IACA,QACA,OACA,gBACA,MACD,CAAC,EAMD,OALI,EAAM,GAAW,CACpB,QAAS,aACT,WAAY,QACZ,QAAS,CAAC,CACX,EACO,CACN,QAAS,aACT,QAAS,CAAC,EAAM,QAAQ,SAAS,QAAQ,EAAI,gDAAkD,0CAA0C,EAAM,OAAS,KAAK,EAAM,SAAW,IAAI,CACnL,CACD,CACA,GAAI,IAAa,SAAU,CAC1B,IAAM,EAAQ,EAAM,GAAqB,CACxC,KACA,6BACA,eACD,CAAC,EAMD,OALI,EAAM,GAAW,CACpB,QAAS,WACT,WAAY,GACZ,QAAS,CAAC,CACX,EACO,CACN,QAAS,WACT,QAAS,CAAC,0BAA0B,EAAM,OAAS,KAAK,EAAM,SAAW,IAAI,CAC9E,CACD,CACA,MAAO,CACN,QAAS,CAAC,EACV,oBAAqB,CACtB,CACD,CACA,SAAS,EAAe,EAAM,CAC7B,GAAI,CACH,OAAO,EAAa,CAAI,CACzB,MAAQ,CACP,OAAO,CACR,CACD,CACA,SAAS,GAAY,EAAM,CAC1B,GAAI,CACH,OAAO,EAAS,CAAI,CAAC,CAAC,YAAY,CACnC,MAAQ,CACP,MAAO,EACR,CACD,CAEA,SAAS,GAAiB,EAAM,CAC/B,IAAM,EAAO,GAAU,CAAI,EACvB,MAAK,eAAe,IACxB,GAAU,EAAM,EAAK,KAAO,GAAG,EAC1B,EAAK,YAAY,GACtB,IAAK,IAAM,KAAQ,GAAY,CAAI,EAAG,GAAiB,GAAG,EAAK,GAAG,GAAM,CACzE,CACA,SAAS,GAAe,EAAM,CAC7B,GAAI,CACH,OAAO,GAAU,CAAI,CAAC,CAAC,eAAe,CACvC,MAAQ,CACP,MAAO,EACR,CACD,CAEA,SAAS,GAAa,EAAc,CACnC,OAAO,EAAa,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EACzC,CACA,IAAI,GAAkB,KAAM,CAC3B,WAAa,SACb,KACA,aACA,cACA,QACA,SAAW,EACX,SAAW,CAAC,EAEZ,WAA6B,IAAI,IACjC,YAAY,EAAS,CACpB,KAAK,KAAO,EAAe,EAAQ,IAAI,EACvC,KAAK,aAAe,EAAQ,aAC5B,KAAK,cAAgB,EAAQ,eAAiB,GAAQ,EACtD,KAAK,QAAU,CACd,GAAG,GACH,GAAG,EAAQ,QACZ,CACD,CACA,QAAS,CACR,MAAO,CACN,SAAU,KAAK,QACf,aAAc,KAAK,aACnB,OAAQ,KAAK,QAAQ,SAAW,KAAK,aAAa,aAAe,IAAK,EACvE,CACD,CAEA,UAAU,EAAU,CACnB,KAAK,QAAU,CACd,GAAG,KAAK,QACR,GAAG,CACJ,CACD,CAEA,SAAS,EAAc,CACtB,GAAI,CAAC,KAAK,OAAO,CAAC,CAAC,OAAQ,MAAO,GAClC,GAAIC,EAAqB,CAAY,CAAC,CAAC,SAAW,EAAG,MAAO,GAC5D,IAAM,EAAU,GAAa,CAAY,EACzC,OAAO,IAAY,IAAK,IAAK,CAAC,KAAK,QAAQ,iBAAiB,SAAS,CAAO,CAC7E,CACA,aAAa,EAAc,CAG1B,MAFI,CAAC,KAAK,QAAQ,0BAA4B,CAAC,KAAK,SAAS,CAAY,GACrE,KAAK,WAAW,KAAO,EAAU,GAC9B,CAAC,KAAK,qBAAqB,CAAC,CAAC,KAAM,GAAU,EAAM,OAAS,WAAa,CAAC,KAAK,iCAAiC,EAAM,IAAI,CAAC,CACnI,CACA,YAAY,EAAY,EAAc,CACrC,GAAI,CAAC,KAAK,SAAS,CAAY,EAAG,OAAO,EACzC,IAAM,EAAS,KAAK,OAAO,EACrB,EAAa,KAAK,aAAa,WACrC,GAAI,KAAK,aAAa,UAAY,WAAY,MAAO,CACpD,QAAS,EACT,KAAM,CACL,KACA,GAAgB,CAAM,EACtB,EAAW,QACX,GAAG,EAAW,IACf,EACA,IAAK,EAAW,GACjB,EACA,IAAM,EAAS,EAAO,QAAU,IAAK,GAAI,GAAwB,EAC5D,KAAK,qBAAqB,CAAC,CAAC,KAAM,GAAU,EAAM,KAAK,SAAS,UAAU,GAAK,EAAM,OAAS,SAAS,GAAG,EAAU,GAAG,KAAK,KAAK,UAAW,CAAE,UAAW,EAAK,CAAC,EACpK,IAAM,EAAO,GAAoB,CAChC,SACA,OAAS,GAAS,GAAW,CAAI,GAAK,CAAC,GAAe,CAAI,EAC1D,cAAgB,GAAS,GAAY,CAAI,EACzC,IAAK,EAAW,IAChB,QAAS,EAAW,QACpB,KAAM,EAAW,KACjB,GAAG,IAAW,IAAK,GAA+B,CAAC,EAA5B,CAAE,kBAAmB,CAAE,CAC/C,CAAC,EACG,KAAK,WAAa,IAAG,KAAK,SAAW,KAAK,qBAAqB,CAAC,CAAC,IAAK,GAAU,KAAK,WAAW,IAAI,EAAM,IAAI,GAAK,CAAK,GAC5H,KAAK,UAAY,EACjB,IAAI,EAAW,GACf,MAAO,CACN,QAAS,EACT,OACA,IAAK,EAAW,IAChB,GAAG,IAAW,IAAK,GAAqC,CAAC,EAAlC,CAAE,iBAAkB,CAAC,CAAM,CAAE,EACpD,cAAiB,CACZ,MAGJ,MAFA,GAAW,GACX,OAAK,SACE,KAAK,wBAAwB,KAAK,QAAQ,CAClD,CACD,CACD,CAMA,sBAAuB,CACtB,OAAO,GAA0B,CAAC,CAAC,IAAK,GAAU,CACjD,IAAM,EAAO,GAAG,KAAK,KAAK,GAAG,IAC7B,GAAI,CACH,OAAO,GAAU,CAAI,CAAC,CAAC,eAAe,EAAI,CACzC,OACA,KAAM,UACN,OAAQ,GAAa,CAAI,CAC1B,EAAI,CACH,OACA,KAAM,SACP,CACD,MAAQ,CACP,MAAO,CACN,OACA,KAAM,SACP,CACD,CACD,CAAC,CACF,CAOA,iCAAiC,EAAM,CACtC,IAAI,EACJ,GAAI,CACH,EAAO,EAAa,CAAI,CACzB,MAAQ,CACP,MAAO,EACR,CACA,IAAM,EAAS,KAAK,OAAO,EAC3B,MAAO,CAAC,CACP,EAAO,KACP,GAAG,EAAO,gBACV,GAAG,EAAO,UACX,CAAC,CAAC,KAAM,GAAS,IAAS,GAAQ,EAAK,WAAW,GAAG,EAAK,EAAE,CAAC,CAC9D,CAMA,wBAAwB,EAAQ,CAC/B,IAAM,EAAa,GAAG,KAAK,eAAe,CAAM,EAAE,GAAG,KAAK,IAAI,EAAE,GAAG,EAAW,IACxE,EAAQ,CAAC,EACf,IAAK,IAAM,KAAS,EACf,KAAM,OAAS,UACnB,GAAI,CACH,IAAM,EAAM,KAAK,qBAAqB,CAAC,CAAC,KAAM,GAAU,EAAM,OAAS,EAAM,IAAI,EACjF,GAAI,EAAM,OAAS,WAAa,EAAI,OAAS,UAAW,CACvD,KAAK,WAAW,OAAO,EAAM,IAAI,EACjC,QACD,CACA,GAAI,EAAM,OAAS,WAAa,EAAI,OAAS,WAAa,EAAI,SAAW,EAAM,OAAQ,CACtF,KAAK,WAAW,OAAO,EAAM,IAAI,EACjC,QACD,CACI,EAAI,OAAS,WAAW,EAAM,KAAK,KAAK,SAAS,EAAM,KAAM,CAAU,CAAC,EACxE,EAAM,OAAS,WAAW,GAAY,EAAM,OAAQ,EAAM,IAAI,EAClE,KAAK,WAAW,OAAO,EAAM,IAAI,CAClC,OAAS,EAAO,CACf,KAAK,WAAW,IAAI,EAAM,KAAM,CAAK,EACrC,EAAM,KAAK,qBAAqB,EAAM,KAAK,IAAI,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EAAE,yCAAyC,CAChJ,CAEG,KAAM,SAAW,EACrB,MAAO,kGAAkG,EAAM,KAAK,IAAI,EAAE,EAC3H,CAOA,eAAe,EAAQ,CACtB,IAAM,EAAS,GAAG,KAAK,KAAK,UAC5B,OAAO,EAAO,KAAM,GAAU,EAAM,OAAS,GAAU,EAAM,OAAS,SAAS,EAAI,GAAG,EAAO,qBAAuB,GAAG,KAAK,cAAc,4BAC3I,CACA,SAAS,EAAM,EAAY,CAC1B,IAAM,EAAc,GAAG,EAAW,GAAG,EAAS,CAAI,IAClD,EAAU,EAAY,CAAE,UAAW,EAAK,CAAC,EACzC,GAAI,CACH,EAAW,EAAM,CAAW,CAC7B,OAAS,EAAO,CACf,GAAI,KAAK,SAAW,EAAG,MAAM,EAC7B,GAAiB,CAAI,EACjB,EAAM,OAAS,SAClB,GAAO,EAAM,EAAa,CACzB,UAAW,GACX,iBAAkB,EACnB,CAAC,EACD,GAAO,EAAM,CACZ,UAAW,GACX,MAAO,EACR,CAAC,GACK,EAAW,EAAM,CAAW,CACpC,CACA,MAAO,SAAS,EAAK,MAAM,GAC5B,CAEA,QAAS,CACR,IAAM,EAAY,GAAS,CAC1B,IAAM,EAAW,IAAS,KAAO,EAAK,WAAW,IAAI,EAAI,GAAG,KAAK,gBAAgB,EAAK,MAAM,CAAC,IAAM,EACnG,OAAO,EAAe,EAAW,CAAQ,EAAI,EAAW,EAAQ,KAAK,KAAM,CAAQ,CAAC,CACrF,EACM,EAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAO,EAAG,MAAM,CAAC,CAAC,OAAO,EAAU,CAAC,CAAC,IAAI,CAAc,CAAC,CAAC,EACnF,MAAO,CACN,KAAM,KAAK,KACX,gBAAiB,EACjB,WAAY,KAAK,QAAQ,WAAW,IAAI,CAAQ,EAChD,SAAU,KAAK,QAAQ,SAAS,IAAK,GAAS,CAC7C,IAAM,EAAW,EAAS,CAAI,EAC9B,MAAO,CACN,KAAM,EACN,UAAW,GAAY,CAAQ,CAChC,CACD,CAAC,EACD,QAAS,KAAK,QAAQ,OACvB,CACD,CACA,IAAI,EAAS,EAAU,CAAC,EAAG,CAC1B,IAAM,EAAQC,EAAqB,EAC7B,EAAM,EAAQ,kBAAoB,KAAK,KACvC,EAAa,KAAK,YAAY,CACnC,QAAS,EAAM,QACf,KAAM,EAAM,YAAY,CAAO,EAC/B,KACD,EAAG,CAAO,EACV,OAAO,IAAI,SAAS,EAAY,IAAW,CAC1C,IAAM,EAAQ,EAAW,kBAAoB,CAAC,EAC1C,EACJ,GAAI,CACH,EAAQ,EAAM,EAAW,QAAS,CAAC,GAAG,EAAW,IAAI,EAAG,CACvD,IAAK,EAAW,IAChB,MAAO,CACN,SACA,OACA,OACA,GAAG,EAAM,QAAU,MAAM,CAC1B,EACA,GAAG,EAAQ,YAAc,IAAK,GAAqC,CAAC,EAAlC,CAAE,QAAS,EAAQ,SAAU,CAChE,CAAC,CACF,OAAS,EAAO,CACf,EAAW,YAAY,EACvB,EAAO,aAAiB,MAAQ,EAAY,MAAM,OAAO,CAAK,CAAC,CAAC,EAChE,MACD,CACA,EAAM,SAAS,EAAM,IAAU,CAC9B,IAAM,EAAS,EAAM,MAAM,EAAQ,GACnC,GAAQ,GAAG,YAAe,IAAK,EAAC,EAChC,GAAQ,IAAI,OAAO,KAAK,CAAI,CAAC,CAC9B,CAAC,EACD,IAAI,EAAS,GACT,EAAS,GACb,EAAM,QAAQ,GAAG,OAAS,GAAU,GAAU,EAAM,SAAS,CAAC,EAC9D,EAAM,QAAQ,GAAG,OAAS,GAAU,GAAU,EAAM,SAAS,CAAC,EAC9D,EAAM,GAAG,QAAU,GAAU,CAC5B,EAAW,YAAY,EACvB,EAAO,CAAK,CACb,CAAC,EACD,EAAM,GAAG,QAAU,GAAS,CAC3B,IAAM,EAAO,EAAW,YAAY,EACpC,EAAW,CACV,OAAQ,IAAS,IAAK,GAAI,EAAS,GAAG,EAAO,IAAI,IACjD,GAAG,EAAS,CAAE,QAAO,EAAI,CAAC,EAC1B,SAAU,GAAQ,CACnB,CAAC,CACF,CAAC,CACF,CAAC,CACF,CACA,SAAS,EAAM,CACd,OAAO,QAAQ,QAAQ,GAAa,EAAM,MAAM,CAAC,CAClD,CACA,UAAU,EAAM,EAAS,CAExB,OADA,GAAc,EAAM,EAAS,MAAM,EAC5B,QAAQ,QAAQ,CACxB,CACD,EA0KA,SAAS,EAAsB,EAAM,EAAa,EAAW,EAAI,EAAY,CAAC,EAAG,CAahF,OAAO,IAAIG,EAAa,CAXvB,OACA,cACA,WAAYF,EAAgB,CAAS,EACrC,GAAG,EAAU,eAAiB,IAAK,IAAK,CAAE,aAAc,EAAU,YAAa,CAQxD,EAAQ,MANP,EAAY,IAAY,CAChD,IAAM,EAAc,EAAU,UAAU,CAAU,EAClD,GAAI,CAAC,EAAY,QAAS,MAAM,IAAIC,EAAgB,0BAA0B,EAAY,OAAO,EACjG,IAAM,EAAS,MAAM,EAAG,EAAY,KAAM,CAAO,EACjD,OAAO,OAAO,GAAW,SAAW,EAAS,KAAK,UAAU,CAAM,CACnE,CACyC,CAC1C,CA2BA,MAAM,GAAiC,CACtC,KAAM,CACL,SAAU,CACT,IAAK,WACL,KAAM,MACP,EACA,UAAW,SACZ,EACA,KAAM,CACL,SAAU,CACT,IAAK,UACL,KAAM,MACP,EACA,UAAW,SACZ,EACA,KAAM,CACL,SAAU,CACT,IAAK,UACL,KAAM,MACP,EACA,UAAW,SACZ,EACA,SAAU,CACT,SAAU,CACT,IAAK,MACL,KAAM,KACP,EACA,UAAW,SACZ,EACA,UAAW,CACV,SAAU,CACT,IAAK,QACL,KAAM,MACP,EACA,UAAW,SACZ,EACA,kBAAmB,CAAE,UAAW,SAAU,EAC1C,gBAAiB,CAAE,UAAW,SAAU,EACxC,WAAY,CACX,SAAU,CACT,IAAK,QACL,KAAM,MACP,EACA,UAAW,SACZ,EACA,aAAc,CAAE,UAAW,SAAU,EACrC,MAAO,CACN,SAAU,CACT,IAAK,WACL,KAAM,MACP,EACA,UAAW,QACZ,EACA,KAAM,CACL,SAAU,CACT,IAAK,WACL,KAAM,MACP,EACA,UAAW,QACZ,EACA,MAAO,CACN,SAAU,CACT,IAAK,UACL,KAAM,SACP,EACA,UAAW,UACX,QAAS,CAAC,MAAM,CACjB,EACA,KAAM,CACL,SAAU,CACT,IAAK,UACL,KAAM,SACP,EACA,UAAW,UACX,QAAS,CAAC,OAAO,CAClB,EACA,SAAU,CAAE,UAAW,SAAU,CAClC,EAOA,SAAS,IAAsC,CAC9C,IAAK,GAAM,CAAC,EAAU,KAAY,OAAO,QAAQ,EAA8B,EAAG,EAA8B,EAAU,CAAO,CAClI,CACA,GAAoC,EAYpC,MAAM,GAAuB,IACvB,GAAkB,EAAE,OAAO,CAChC,YAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,uFAAuF,EAC5I,qBAAsB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,2EAA2E,EACzI,YAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,gDAAgD,GAAqB,GAAG,CACtI,CAAC,EAED,SAAS,GAAc,EAAS,CAC/B,OAAO,EAAQ,IAAK,GAAW,GAAG,EAAO,KAAK,GAAG,EAAO,KAAK,IAAI,EAAO,KAAK,GAAG,EAAO,MAAM,CAAC,CAAC,KAAK;CAAI,CACzG,CACA,eAAe,GAAc,EAAM,EAAU,CAAC,EAAG,CAChD,GAAI,CAAC,EAAQ,QAAS,MAAO,uDAC7B,IAAM,EAAS,MAAM,EAAQ,QAAQ,SAAS,CAC7C,GAAG,EAAK,YAAc,CAAE,YAAa,EAAK,WAAY,EAAI,CAAC,EAC3D,GAAG,EAAK,qBAAuB,CAAE,qBAAsB,EAAK,oBAAqB,EAAI,CAAC,EACtF,YAAa,EAAK,aAAe,EAClC,CAAC,EAED,OADI,EAAO,QAAQ,SAAW,EAAU,qDACjC,2BAA2B,EAAO,YAAY,aAAa,GAAc,EAAO,OAAO,GAC/F,CACA,SAAS,GAAoB,EAAU,CAAC,EAAG,CAC1C,OAAO,EAAsB,oBAAqB,4PAA6P,GAAiB,KAAO,IAAW,GAAc,EAAQ,CAAO,CAAC,CACjX,CAkBA,MAAM,GAAsB,sEACtB,GAAoB,EAAE,KAAK,CAChC,OACA,QACA,QACD,CAAC,EACK,GAAc,EAAE,OAAO,CAC5B,EAAG,EAAE,OAAO,EACZ,EAAG,EAAE,OAAO,CACb,CAAC,EAMK,GAAe,EAAE,OAAO,CAC7B,KAAM,EAAE,KAAK,CACZ,QACA,eACA,OACA,WACA,SACA,OACA,OACA,UACD,CAAC,CAAC,CAAC,SAAS,0BAA0B,EACtC,EAAG,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,2CAA2C,EAC7E,EAAG,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,2CAA2C,EAC7E,OAAQ,GAAkB,SAAS,CAAC,CAAC,SAAS,yCAAyC,EACvF,KAAM,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,sBAAsB,EAC3D,KAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,sCAAsC,EACpF,OAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,kCAAkC,EACzE,OAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,gCAAgC,EACvE,KAAM,EAAE,MAAM,EAAW,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,gCAAgC,EAC/E,GAAI,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,8BAA8B,EACjE,OAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,wDAAwD,CAChG,CAAC,EACK,GAAiB,EAAE,OAAO,CAAE,OAAQ,GAAa,SAAS,wCAAwC,CAAE,CAAC,EACrG,GAAqB,EAAE,OAAO,CAAC,CAAC,EAEtC,IAAI,EAA6B,cAAc,KAAM,CAAC,EACtD,SAAS,EAAc,EAAO,EAAO,EAAM,CAC1C,GAAI,OAAO,GAAU,SAAU,MAAM,IAAI,EAA2B,WAAW,EAAK,sBAAsB,EAAM,GAAG,EACnH,OAAO,CACR,CAEA,SAAS,GAAY,EAAM,CAC1B,IAAM,EAAS,EAAK,OACpB,OAAQ,EAAK,KAAb,CACC,IAAK,QAAS,MAAO,CACpB,KAAM,QACN,EAAG,EAAc,EAAK,EAAG,IAAK,OAAO,EACrC,EAAG,EAAc,EAAK,EAAG,IAAK,OAAO,EACrC,GAAG,EAAS,CAAE,QAAO,EAAI,CAAC,CAC3B,EACA,IAAK,eAAgB,MAAO,CAC3B,KAAM,eACN,EAAG,EAAc,EAAK,EAAG,IAAK,cAAc,EAC5C,EAAG,EAAc,EAAK,EAAG,IAAK,cAAc,EAC5C,GAAG,EAAS,CAAE,QAAO,EAAI,CAAC,CAC3B,EACA,IAAK,OACJ,GAAI,OAAO,EAAK,MAAS,SAAU,MAAM,IAAI,EAA2B,gCAAgC,EACxG,MAAO,CACN,KAAM,OACN,KAAM,EAAK,IACZ,EACD,IAAK,WACJ,GAAI,CAAC,EAAK,MAAQ,EAAK,KAAK,SAAW,EAAG,MAAM,IAAI,EAA2B,8CAA8C,EAC7H,MAAO,CACN,KAAM,WACN,KAAM,EAAK,IACZ,EACD,IAAK,SAAU,MAAO,CACrB,KAAM,SACN,EAAG,EAAc,EAAK,EAAG,IAAK,QAAQ,EACtC,EAAG,EAAc,EAAK,EAAG,IAAK,QAAQ,EACtC,OAAQ,EAAc,EAAK,OAAQ,SAAU,QAAQ,EACrD,OAAQ,EAAc,EAAK,OAAQ,SAAU,QAAQ,CACtD,EACA,IAAK,OACJ,GAAI,CAAC,EAAK,MAAQ,EAAK,KAAK,OAAS,EAAG,MAAM,IAAI,EAA2B,yDAAyD,EACtI,MAAO,CACN,KAAM,OACN,KAAM,EAAK,KACX,GAAG,EAAS,CAAE,QAAO,EAAI,CAAC,CAC3B,EACD,IAAK,OAAQ,MAAO,CACnB,KAAM,OACN,GAAG,OAAO,EAAK,IAAO,SAAW,CAAE,GAAI,EAAK,EAAG,EAAI,CAAC,CACrD,EACA,IAAK,WAAY,MAAO,CACvB,KAAM,WACN,GAAG,EAAK,OAAS,CAAE,OAAQ,EAAK,MAAO,EAAI,CAAC,CAC7C,EACA,QAAS,CACR,IAAM,EAAa,EAAK,KACxB,MAAM,IAAI,EAA2B,wBAAwB,OAAO,CAAU,GAAG,CAClF,CACD,CACD,CAEA,eAAe,GAAS,EAAS,CAChC,GAAI,CAAC,EAAQ,OAAQ,OAAO,KAAK,UAAU,CAC1C,QAAS,GACT,MAAO,EACR,CAAC,EACD,IAAM,EAAa,MAAM,EAAQ,OAAO,WAAW,EACnD,OAAO,KAAK,UAAU,EAAa,CAClC,QAAS,GACT,YACD,EAAI,CACH,QAAS,GACT,SAAU,EACX,CAAC,CACF,CAEA,eAAe,GAAI,EAAM,EAAS,CACjC,GAAI,CAAC,EAAQ,OAAQ,OAAO,KAAK,UAAU,CAC1C,QAAS,GACT,MAAO,EACR,CAAC,EACD,IAAI,EACJ,GAAI,CACH,EAAS,GAAY,EAAK,MAAM,CACjC,OAAS,EAAK,CACb,OAAO,KAAK,UAAU,CACrB,QAAS,GACT,MAAO,aAAe,MAAQ,EAAI,QAAU,OAAO,CAAG,CACvD,CAAC,CACF,CACA,IAAM,EAAU,MAAM,EAAQ,OAAO,IAAI,CAAM,EACzC,EAAS,CACd,QAAS,GACT,GAAG,EAAQ,WAAa,CAAE,WAAY,EAAQ,UAAW,EAAI,CAAC,EAC9D,GAAG,EAAQ,SAAW,CAAE,SAAU,EAAK,EAAI,CAAC,CAC7C,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CAEA,SAAS,GAAuB,EAAU,CAAC,EAAG,CAC7C,OAAO,EAAsB,eAAgB,+KAAgL,GAAoB,SAAY,GAAS,CAAO,CAAC,CAC/Q,CAEA,SAAS,GAAsB,EAAU,CAAC,EAAG,CAC5C,OAAO,EAAsB,WAAY,ySAA0S,GAAgB,KAAO,IAAW,GAAI,EAAQ,CAAO,CAAC,CAC1Y,CAMA,SAAS,GAAmB,EAAU,CAAC,EAAG,CACzC,MAAO,CAAC,GAAuB,CAAO,EAAG,GAAsB,CAAO,CAAC,CACxE,CAmGA,MAAM,GAAwB,CAC7B,CACC,SAAU,OACV,KAAM,2CACP,EACA,CACC,SAAU,OACV,KAAM,8CACP,EACA,CACC,SAAU,OACV,KAAM,6CACP,EACA,CACC,SAAU,OACV,KAAM,uCACP,CACD,EAMA,SAAS,GAA0B,EAAO,EAAgB,CACzD,IAAM,EAAQ,EAAiB,GAAsB,OAAQ,GAAU,EAAe,SAAS,EAAM,QAAQ,CAAC,EAAI,GAC5G,EAAe,EAAM,OAAS,EAAI,CAAC,gKAAiL,GAAG,EAAM,IAAK,GAAU,EAAM,IAAI,CAAC,EAAI,CAAC,EAClQ,MAAO,CACN,+DACA,GACA,iBAAiB,EAAM,MAAM,IAAI,EAAM,aACvC,GACA,iJACA,GACA,GAAG,CACJ,CAAC,CAAC,KAAK;CAAI,CACZ,CAiCA,MAAM,EAAiB,QAAQ,WAAa,QAGtC,GAA4B,IAC5B,GAAc,EAAE,OAAO,CAC5B,QAAS,EAAE,OAAO,CAAC,CAAC,SAAS,8BAA8B,EAC3D,QAAS,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,8EAA8E,EACtH,iBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,8EAA8E,CAChI,CAAC,EAED,eAAe,GAAa,EAAS,EAAS,EAAkB,EAAS,CACxE,GAAI,CACH,IAAM,EAAgB,MAAM,EAAQ,cAAc,IAAI,EAAS,CAC9D,UAAW,EACX,kBACD,CAAC,EACK,EAAS,CACd,QAAS,GACT,OAAQ,EAAc,OAAS,GAAG,EAAc,OAAO,aAAa,EAAc,SAAW,EAAc,OAC3G,SAAU,EAAc,QACzB,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,OAAS,EAAK,CACb,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,aAAe,MAAQ,EAAI,QAAU,OAAO,CAAG,CACvD,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACD,CAKA,eAAe,GAAS,EAAM,EAAS,EAAO,EAAQ,EAAU,CAC/D,GAAM,CAAE,UAAS,QAAS,EAAa,KAAsB,oBAAqB,EAC5E,EAAU,KAAK,IAAI,EAAY,GAAG,EAClC,EAAe,GAAoB,EAAQ,IACjD,GAAI,IAAiB,IAAK,GAAG,OAAO,KAAK,UAAU,CAClD,QAAS,GACT,OAAQ,GACR,MAAO,mMACR,CAAC,EACD,GAAI,EAAQ,eAAiB,EAAQ,cAAc,cAAgB,IAAK,GAAG,OAAO,GAAa,EAAS,EAAS,GAAoB,EAAQ,IAAK,CAAO,EACzJ,IAAM,EAAiB,CACtB,QAAS,EAAM,QACf,KAAM,EAAM,YAAY,CAAO,EAC/B,IAAK,CACN,EACM,EAAa,EAAQ,eAAe,cAAc,EAAgB,CAAO,GAAK,EAChF,EAAW,GACT,MAAgB,CACjB,MACJ,GAAW,GACX,GAAI,CACH,OAAO,EAAW,YAAY,CAC/B,OAAS,EAAO,CACf,MAAO,8BAA8B,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,GAC3F,CALW,CAMZ,EASA,OARI,GAAQ,SACX,EAAQ,EACD,KAAK,UAAU,CACrB,QAAS,GACT,OAAQ,GACR,MAAO,sBACR,CAAC,GAEK,IAAI,QAAS,GAAY,CAC/B,IAAM,EAAeE,EAAoB,CAAE,SAAU,EAA0B,CAAC,EAC1E,EAAeA,EAAoB,CAAE,SAAU,EAA0B,CAAC,EAC5E,EAAW,GACX,EAAU,GACV,EACJ,GAAI,CACH,EAAQ,EAAM,EAAW,QAAS,CAAC,GAAG,EAAW,IAAI,EAAG,CACvD,IAAK,EAAW,IAChB,IAAK,IAAa,IAAK,GAAI,QAAQ,IAAMC,EAA2B,QAAQ,IAAK,CAAQ,EACzF,MAAO,CACN,OACA,OACA,OACA,IAAI,EAAW,kBAAoB,CAAC,EAAA,CAAG,QAAU,MAAM,CACxD,EACA,SAAU,CACX,CAAC,CACF,OAAS,EAAO,CACf,IAAM,EAAO,EAAQ,EACf,EAAU,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EACrE,EAAQ,KAAK,UAAU,CACtB,QAAS,GACT,OAAQ,GAAQ,GAChB,MAAO,CACR,CAAC,CAAC,EACF,MACD,EACC,EAAW,kBAAoB,CAAC,EAAA,CAAG,SAAS,EAAM,IAAU,CAC5D,IAAM,EAAS,EAAM,MAAM,EAAQ,GACnC,GAAQ,GAAG,YAAe,IAAK,EAAC,EAChC,GAAQ,IAAI,OAAO,KAAK,CAAI,CAAC,CAC9B,CAAC,EACD,EAAM,OAAO,IAAI,EACjB,EAAM,QAAQ,GAAG,OAAS,GAAU,CACnC,EAAa,OAAO,CAAK,CAC1B,CAAC,EACD,EAAM,QAAQ,GAAG,OAAS,GAAU,CACnC,EAAa,OAAO,CAAK,CAC1B,CAAC,EACD,IAAM,EAAQ,eAAiB,CAC9B,EAAW,GACX,EAAgB,EAAO,CAAE,aAAc,CAAe,CAAC,EACvD,EAAO,CACN,QAAS,GACT,OAAQ,EAAa,SAAS,EAC9B,MAAO,2BAA2B,EAAQ,GAC3C,CAAC,CACF,EAAG,CAAO,EACV,SAAS,EAAO,EAAQ,CACnB,IACJ,EAAU,GACV,aAAa,CAAK,EAClB,GAAQ,oBAAoB,QAAS,CAAO,EAC5C,EAAQ,KAAK,UAAU,CAAM,CAAC,EAC/B,CACA,SAAS,GAAU,CAClB,EAAgB,EAAO,CAAE,aAAc,CAAe,CAAC,EACvD,EAAO,CACN,QAAS,GACT,OAAQ,EAAa,SAAS,EAC9B,MAAO,SACR,CAAC,CACF,CACA,GAAQ,iBAAiB,QAAS,EAAS,CAAE,KAAM,EAAK,CAAC,EACzD,EAAM,GAAG,QAAU,GAAQ,CACtB,EAAM,MAAQ,IAAK,IAAG,EAAQ,EAClC,EAAO,CACN,QAAS,GACT,OAAQ,GACR,MAAO,EAAI,OACZ,CAAC,CACF,CAAC,EACD,EAAM,GAAG,QAAU,GAAS,CAC3B,IAAM,EAAO,EAAQ,EACrB,GAAI,EAAU,CACb,EAAO,CACN,QAAS,GACT,OAAQ,EAAa,SAAS,EAC9B,MAAO,2BAA2B,EAAQ,IAC1C,SAAU,GAAQ,IAAK,EACxB,CAAC,EACD,MACD,CACA,IAAM,EAAS,EAAa,SAAS,EAC/B,EAAS,EAAa,SAAS,EAC/B,EAAW,GAAQ,EACnB,EAAW,EAAS,GAAG,EAAO,aAAa,IAAW,EAC5D,EAAO,CACN,QAAS,GACT,OAAQ,IAAS,IAAK,GAAI,EAAW,GAAG,EAAS,IAAI,IACrD,UACD,CAAC,CACF,CAAC,CACF,CAAC,CACF,CAOA,SAAS,GAAoB,EAAM,EAAS,CAC3C,IAAM,EAAQL,EAAqB,CAAE,WAAY,EAAQ,eAAgB,CAAC,EAC1E,OAAO,EAAsB,EAAM,EAAQ,aAAe,GAA0B,EAAO,EAAQ,cAAc,EAAG,GAAa,MAAO,EAAQ,IACxI,GAAS,EAAQ,EAAS,EAAO,GAAS,OAAQ,GAAS,aAAa,CAC/E,CACF,CAKA,SAAS,GAAgB,EAAS,CACjC,OAAO,GAAoB,QAAS,CAAO,CAC5C,CAIA,SAAS,GAAe,EAAS,CAChC,OAAO,GAAoB,OAAQ,CAAO,CAC3C,CA+CA,SAAS,EAAY,EAAU,EAAK,CAEnC,OADI,IAAQ,IAAK,IACVM,GAAa,EAAK,CAAQ,CAClC,CASA,SAAS,EAAgB,EAAU,EAAK,CAEvC,OADI,IAAQ,IAAK,GAAU,EACpB,EAAQ,EAAK,CAAQ,CAC7B,CACA,SAAS,EAAmB,EAAU,EAAK,CAC1C,GAAI,IAAQ,IAAK,GAAG,CACnB,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,mBAAmB,EAAS,oNACpC,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,GAAI,CAAC,EAAY,EAAU,CAAG,EAAG,CAChC,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,mBAAmB,EAAS,mCACpC,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACD,CAYA,SAAS,GAAkB,EAAW,EAAK,CAC1C,GAAI,IAAQ,IAAK,GAAG,MAAO,CAC1B,KAAM,GACN,MAAO,EAAmB,GAAa,GAAI,IAAK,EAAC,CAClD,EACA,IAAM,EAAO,EAAY,EAAQ,EAAK,CAAS,EAAI,EACnD,MAAO,CACN,OACA,MAAO,EAAmB,EAAM,CAAG,CACpC,CACD,CASA,MACM,GAAkB,IAClB,EAAiB,EAAI,KAAO,KAGlC,IAAI,EAAqB,cAAcC,CAAmB,CACzD,SACA,YAAY,EAAU,CACrB,MAAM,QAAQ,EAAS,+BAAgC,MAAM,EAC7D,KAAK,SAAW,CACjB,CACD,EAEI,EAAqB,cAAcA,CAAmB,CACzD,aAAc,CACb,MAAM,iBAAkB,MAAM,CAC/B,CACD,EACA,MAAM,GAAa,EAAE,OAAO,CAC3B,SAAU,EAAE,OAAO,CAAC,CAAC,SAAS,uCAAuC,EACrE,OAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,wGAAwG,EAC/I,MAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,yCAAyC,GAAgB,yDAAyD,CACzJ,CAAC,EAID,SAAS,GAAS,EAAQ,CACzB,IAAM,EAAc,KAAK,IAAI,EAAO,OAAQ,IAAI,EAChD,IAAK,IAAI,EAAI,EAAG,EAAI,EAAa,IAAK,GAAI,EAAO,KAAO,EAAG,MAAO,GAClE,MAAO,EACR,CAKA,SAAS,GAAsB,EAAO,EAAW,CAChD,IAAM,EAAc,EAAY,EAAM,OAAS,EACzC,EAAQ,OAAO,CAAW,CAAC,CAAC,OAClC,OAAO,EAAM,KAAK,EAAM,IAChB,GAAG,OAAO,EAAY,CAAG,CAAC,CAAC,SAAS,EAAO,GAAG,EAAE,IAAI,GAC3D,CAAC,CAAC,KAAK;CAAI,CACb,CACA,SAAS,GAAiB,EAAU,EAAS,EAAW,EAAO,CAC9D,IAAM,EAAgB,CAAC,EACnB,EAAuB,EACvB,EAAa,EACb,EAAY,EACV,EAAgB,KAAK,MAAM,EAAY,CAAC,EACxC,EAAc,KAAK,MAAM,EAAY,EAAI,CAAK,EACpD,KAAO,EAAY,EAAQ,QAAQ,CAClC,IAAM,EAAU,EAAQ,QAAQ;EAAM,CAAS,EACzC,EAAU,IAAY,GAAK,EAAQ,OAAS,EAElD,GADA,IACI,EAAa,GAAiB,GAAc,EAAa,CAC5D,IAAM,EAAO,EAAQ,MAAM,EAAW,CAAO,EAE7C,GADA,GAAwB,OAAO,WAAW,EAAM,MAAM,EAAI,OAAO,EAAY,EAAc,MAAM,CAAC,CAAC,OAAS,EACxG,EAAuB,EAAgB,MAAM,IAAI,EAAmB,QAAQ,EAChF,EAAc,KAAK,CAAI,CACxB,CACA,GAAI,IAAY,GAAI,MACpB,EAAY,EAAU,CACvB,CACA,IAAM,EAAgB,EAAc,OAC9B,EAAS,EAAgB,EAAa,UAAU,EAAS,UAAU,EAAU,GAAG,EAAY,EAAgB,EAAE,MAAM,EAAW,MAAQ,UAAU,EAAS,IAAI,EAAW,YACzK,EAAQ,OAAO,EAAY,EAAgB,CAAC,CAAC,CAAC,OAChD,EAAc,OAAO,WAAW,EAAQ,MAAM,EAAI,KAAK,IAAI,EAAG,EAAgB,CAAC,EACnF,IAAK,IAAM,KAAQ,EAAe,GAAe,EAAQ,EAAI,OAAO,WAAW,EAAM,MAAM,EAC3F,GAAI,EAAc,EAAgB,MAAM,IAAI,EAAmB,QAAQ,EACvE,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,EAAS,GAAsB,EAAe,CAAS,CAChE,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,eAAe,GAAa,EAAM,EAAS,CAC1C,GAAI,EAAQ,QAAQ,QAAS,MAAM,IAAI,EACvC,GAAM,CAAE,SAAQ,QAAQ,IAAoB,EACtC,EAAW,EAAQ,cAAgB,EAAK,SAAW,EAAgB,EAAK,SAAU,EAAQ,GAAG,EAC7F,EAAY,IAAW,IAAK,IAAK,EAAS,EAAI,EAAS,EAC7D,GAAI,EAAQ,cAAe,GAAI,CAC9B,IAAM,EAAU,MAAM,EAAQ,cAAc,SAAS,CAAQ,EAC7D,GAAI,EAAQ,QAAQ,QAAS,MAAM,IAAI,EACvC,GAAI,OAAO,WAAW,EAAS,MAAM,EAAI,EAAgB,MAAM,IAAI,EAAmB,OAAO,EAC7F,OAAO,GAAiB,EAAU,EAAS,EAAW,CAAK,CAC5D,OAAS,EAAK,CACb,GAAI,aAAe,GAAsB,aAAe,EAAoB,MAAM,EAClF,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,aAAe,MAAQ,EAAI,QAAU,OAAO,CAAG,CACvD,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,IAAM,EAAY,EAAmB,EAAU,EAAQ,GAAG,EAC1D,GAAI,IAAc,IAAK,GAAG,OAAO,EACjC,IAAI,EACJ,GAAI,CACH,EAAY,MAAM,EAAK,CAAQ,CAChC,MAAc,CACb,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,mBAAmB,GAC3B,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,GAAI,CAAC,EAAU,OAAO,EAAG,CACxB,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,uBAAuB,GAC/B,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,IAAI,EAAS,OAAO,MAAM,CAAC,EACvB,EAAa,GACjB,GAAI,CACH,IAAM,EAAS,MAAM,GAAK,EAAU,GAAG,EACvC,GAAI,CACH,IAAM,EAAS,CAAC,EACV,EAAQ,OAAO,YAAY,KAAkB,EAC/C,EAAQ,EACR,EAAqB,EACzB,KAAO,GAAS,GAAgB,CAC/B,GAAI,EAAQ,QAAQ,QAAS,MAAM,IAAI,EACvC,GAAM,CAAE,aAAc,MAAM,EAAO,KAAK,EAAO,EAAG,KAAK,IAAI,EAAM,OAAQ,QAAU,CAAK,EAAG,IAAI,EAC/F,GAAI,IAAc,EAAG,MACrB,IAAM,EAAoB,KAAK,IAAI,EAAW,KAAO,CAAkB,EACvE,GAAI,EAAoB,GAAK,GAAS,EAAM,SAAS,EAAG,CAAiB,CAAC,EAAG,CAC5E,EAAa,GACb,KACD,CAGA,GAFA,GAAsB,EACtB,GAAS,EACL,EAAQ,EAAgB,MAAM,IAAI,EAAmB,OAAO,EAChE,EAAO,KAAK,OAAO,KAAK,EAAM,SAAS,EAAG,CAAS,CAAC,CAAC,CACtD,CACK,IAAY,EAAS,OAAO,OAAO,EAAQ,CAAK,EACtD,QAAU,CACT,MAAM,EAAO,MAAM,CACpB,CACD,OAAS,EAAK,CACb,GAAI,aAAe,GAAsB,aAAe,EAAoB,MAAM,EAClF,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,aAAe,MAAQ,EAAI,QAAU,OAAO,CAAG,CACvD,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,GAAI,EAAQ,QAAQ,QAAS,MAAM,IAAI,EACvC,GAAI,EAAY,CACf,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,8BAA8B,GACtC,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,OAAO,GAAiB,EAAU,EAAO,SAAS,MAAM,EAAG,EAAW,CAAK,CAC5E,CAIA,SAAS,GAAe,EAAS,CAChC,OAAO,EAAsB,OAAQ,EAAQ,aAAe;;;;;;uEAA0B,GAAY,KAAO,IACjG,GAAa,EAAQ,CAAO,CACnC,CACF,CAeA,SAAS,GAAmB,EAAU,CACrC,IAAM,EAAM,EAAQ,CAAQ,EACtB,EAAO,EAAS,CAAQ,EACxB,EAAS,EAAY,CAAiB,CAAC,CAAC,SAAS,KAAK,EAC5D,OAAO,EAAK,EAAK,IAAI,gBAAqB,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,GAAG,GAAQ,CAChF,CACA,eAAe,GAAiB,EAAU,CACzC,GAAI,CACH,OAAQ,MAAM,EAAK,CAAQ,EAAA,CAAG,KAAO,IACtC,OAAS,EAAO,CACf,GAAI,aAAiB,OAAS,GAAa,EAAO,QAAuB,EAAG,OAC5E,MAAM,CACP,CACD,CACA,SAAS,GAAa,EAAO,EAAM,CAClC,MAAO,SAAU,GAAS,EAAM,OAAS,CAC1C,CACA,eAAe,GAAoB,EAAU,EAAS,CACrD,MAAM,GAAM,EAAQ,CAAQ,EAAG,CAAE,UAAW,EAAK,CAAC,EAClD,IAAM,EAAe,MAAM,GAAiB,CAAQ,EAC9C,EAAe,GAAmB,CAAQ,EAChD,GAAI,CACH,MAAM,GAAU,EAAc,EAAS,MAAM,EACzC,IAAiB,IAAK,IAAG,MAAM,GAAM,EAAc,CAAY,EACnE,MAAM,GAAO,EAAc,CAAQ,CACpC,OAAS,EAAO,CAEf,MADA,MAAM,GAAG,EAAc,CAAE,MAAO,EAAK,CAAC,CAAC,CAAC,UAAY,IAAK,EAAC,EACpD,CACP,CACD,CAMA,MACM,GAAc,EAAE,OAAO,CAC5B,SAAU,EAAE,OAAO,CAAC,CAAC,SAAS,wCAAwC,EACtE,QAAS,EAAE,OAAO,CAAC,CAAC,SAAS,kCAAkC,CAChE,CAAC,EACD,eAAe,GAAc,EAAM,EAAS,CAC3C,GAAM,CAAE,WAAY,EACd,EAAW,EAAQ,cAAgB,EAAK,SAAW,EAAgB,EAAK,SAAU,EAAQ,GAAG,EACnG,GAAI,CAAC,EAAQ,cAAe,CAC3B,IAAM,EAAY,EAAmB,EAAU,EAAQ,GAAG,EAC1D,GAAI,IAAc,IAAK,GAAG,OAAO,CAClC,CACA,GAAI,CACC,EAAQ,cAAe,MAAM,EAAQ,cAAc,UAAU,EAAU,CAAO,EAC7E,MAAM,GAAoB,EAAU,CAAO,EAChD,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,WAAW,OAAO,WAAW,EAAS,MAAM,EAAE,YAAY,GACnE,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,OAAS,EAAK,CACb,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,aAAe,MAAQ,EAAI,QAAU,OAAO,CAAG,CACvD,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACD,CAIA,SAAS,GAAgB,EAAS,CACjC,OAAO,EAAsB,QAAS,EAAQ,aAAe;;;;4DAA2B,GAAa,KAAO,IACpG,GAAc,EAAQ,CAAO,CACpC,CACF,CASA,MACM,GAAa,EAAE,OAAO,CAC3B,SAAU,EAAE,OAAO,CAAC,CAAC,SAAS,yCAAyC,EACvE,UAAW,EAAE,OAAO,CAAC,CAAC,SAAS,kEAAkE,EACjG,UAAW,EAAE,OAAO,CAAC,CAAC,SAAS,gEAAgE,EAC/F,WAAY,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,sFAAsF,CACnI,CAAC,EACK,EAAsB,EAAI,KAAO,KAGvC,IAAI,GAAqB,cAAc,KAAM,CAC5C,SACA,YAAY,EAAU,CACrB,MAAM,QAAQ,EAAS,eAAe,EAAoB,YAAY,EACtE,KAAK,SAAW,CACjB,CACD,EAOA,eAAe,GAAoB,EAAU,EAAU,CACtD,IAAM,EAAS,GAAiB,EAAU,CAAE,cAAe,KAAmB,CAAC,EACzE,EAAS,CAAC,EACZ,EAAQ,EACZ,GAAI,CACH,UAAW,IAAM,KAAS,EAAQ,CACjC,IAAM,EAAS,OAAO,SAAS,CAAK,EAAI,EAAQ,OAAO,KAAK,CAAK,EAEjE,GADA,GAAS,EAAO,OACZ,EAAQ,EAAU,MAAM,IAAI,GAAmB,OAAO,EAC1D,EAAO,KAAK,CAAM,CACnB,CACD,QAAU,CACT,EAAO,QAAQ,CAChB,CACA,OAAO,OAAO,OAAO,EAAQ,CAAK,CAAC,CAAC,SAAS,MAAM,CACpD,CACA,eAAe,GAAa,EAAM,EAAS,CAC1C,GAAM,CAAE,YAAW,YAAW,aAAa,IAAU,EAC/C,EAAW,EAAQ,cAAgB,EAAK,SAAW,EAAgB,EAAK,SAAU,EAAQ,GAAG,EACnG,GAAI,CAAC,EAAQ,cAAe,CAC3B,IAAM,EAAY,EAAmB,EAAU,EAAQ,GAAG,EAC1D,GAAI,IAAc,IAAK,GAAG,OAAO,CAClC,CACA,IAAI,EACJ,GAAI,CACH,GAAI,EAAQ,cAEX,IADA,EAAU,MAAM,EAAQ,cAAc,SAAS,CAAQ,EACnD,OAAO,WAAW,EAAS,MAAM,EAAI,EAAqB,MAAM,IAAI,GAAmB,OAAO,CAAA,KAC5F,GAAU,MAAM,GAAoB,EAAU,CAAmB,CACzE,OAAS,EAAK,CACb,GAAI,aAAe,GAAoB,CACtC,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,GAAG,EAAI,QAAQ,IAAI,GAC3B,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,mBAAmB,GAC3B,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,GAAI,CAAC,EAAQ,SAAS,CAAS,EAAG,CACjC,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,gCAAgC,GACxC,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,IAAI,EAAQ,CAAC,EACb,GAAI,EAAY,EAAQ,EAAQ,MAAM,CAAS,OAC1C,GAAI,EAAQ,QAAQ,CAAS,IAAM,EAAQ,YAAY,CAAS,EAAG,CACvE,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,0CAA0C,EAAQ,MAAM,CAAS,CAAC,CAAC,OAAS,EAAE,+EACtF,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,IAAM,EAAQ,EAAa,EAAM,OAAS,EAAI,EACxC,EAAW,OAAO,WAAW,EAAW,MAAM,EAC9C,EAAW,OAAO,WAAW,EAAW,MAAM,EACpD,GAAI,OAAO,WAAW,EAAS,MAAM,EAAI,EAAQ,EAAW,EAAQ,EAAW,EAAqB,CACnG,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,2BAA2B,EAAoB,eAAe,GACtE,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,IAAM,EAAU,EAAa,EAAM,KAAK,CAAS,EAAI,EAAQ,MAAM,EAAG,EAAQ,QAAQ,CAAS,CAAC,EAAI,EAAY,EAAQ,MAAM,EAAQ,QAAQ,CAAS,EAAI,EAAU,MAAM,EAC3K,GAAI,CACC,EAAQ,cAAe,MAAM,EAAQ,cAAc,UAAU,EAAU,CAAO,EAC7E,MAAM,GAAoB,EAAU,CAAO,CACjD,OAAS,EAAK,CACb,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,aAAe,MAAQ,EAAI,QAAU,OAAO,CAAG,CACvD,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,IAAM,EAAW,EAAQ,QAAQ,CAAS,EACpC,EAAY,GAAY,EAAI,EAAQ,UAAU,EAAG,CAAQ,CAAC,CAAC,MAAM;CAAI,CAAC,CAAC,OAAS,EAChF,EAAS,CACd,QAAS,GACT,OAAQ,YAAY,EAAM,oBAAoB,IAC9C,WACD,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CAIA,SAAS,GAAe,EAAS,CAChC,OAAO,EAAsB,OAAQ,EAAQ,aAAe;;;;mKAA0B,GAAY,KAAO,IACjG,GAAa,EAAQ,CAAO,CACnC,CACF,CAeA,MAWM,GAAa,EAAE,OAAO,CAC3B,QAAS,EAAE,OAAO,CAAC,CAAC,SAAS,0EAA8E,EAC3G,KAAM,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,mHAAmH,EACxJ,MAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,gGAAgG,CACvI,CAAC,EAYD,eAAe,GAAwB,EAAS,EAAK,EAAiB,CACrE,IAAM,EAAQ,GAAO,GAAsB,EAC3C,OAAQ,MAAM,QAAQ,IAAI,EAAQ,IAAK,GAAM,EAAM,SAAY,CAC9D,IAAM,EAAU,EAAQ,EAAK,CAAC,EACzB,KAAY,EAAS,CAAe,EACzC,GAAI,CACH,MAAO,CACN,KAAM,EACN,OAAQ,MAAM,EAAK,CAAO,EAAA,CAAG,OAC9B,CACD,MAAQ,CACP,MAAO,CACN,KAAM,EACN,MAAO,CACR,CACD,CACD,CAAC,CAAC,CAAC,EAAA,CAAG,OAAQ,GAAU,IAAU,IAAK,EAAC,CAAC,CAAC,MAAM,EAAG,IAAM,EAAE,MAAQ,EAAE,KAAK,CAC3E,CAMA,eAAe,GAAmB,EAAS,EAAS,EAAe,CAClE,IAAM,EAAU,CAAC,EACb,EAAY,GACV,EAAS,GAAG,OAAO,EAAS,CAAO,EACzC,UAAW,IAAM,KAAS,EAAQ,CACjC,GAAI,EAAQ,QAAU,EAAe,CACpC,EAAY,GACZ,KACD,CACA,EAAQ,KAAK,CAAK,CACnB,CACA,MAAO,CACN,UACA,WACD,CACD,CAMA,eAAe,GAAa,EAAM,EAAS,EAAgB,IAA6B,CACvF,GAAM,CAAE,UAAS,KAAM,GAAa,EAC9B,EAAkB,EAAQ,IAC1B,CAAE,KAAM,EAAK,MAAO,GAAc,GAAkB,EAAU,CAAe,EACnF,GAAI,EAAW,OAAO,EACtB,IAAI,EACJ,GAAI,CACH,EAAa,MAAM,GAAmB,EAAS,CAC9C,MACA,OAAQ,CAAC,qBAAsB,YAAY,EAC3C,IAAK,GACL,SAAU,GACV,oBAAqB,EACtB,EAAG,CAAa,CACjB,OAAS,EAAK,CACb,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,aAAe,MAAQ,EAAI,QAAU,OAAO,CAAG,CACvD,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,GAAM,CAAE,UAAS,UAAW,GAAwB,EAC9C,EAAY,MAAM,GAAwB,EAAS,EAAK,CAAe,EACvE,EAAa,EAAK,OAAS,IAC3B,EAAe,EAAU,OACzB,EAAY,EAAe,EAC3B,GAAU,EAAY,EAAU,MAAM,EAAG,CAAU,EAAI,EAAA,CAAW,IAAK,GAAM,EAAE,IAAI,EACrF,EAAS,EAAO,OAAS,EAAI,EAAO,KAAK;CAAI,EAAI,eAGrD,OAFI,IAAW,GAAU,gBAAgB,EAAW,MAAM,EAAa,8CACnE,IAAqB,GAAU;;2MAC5B,KAAK,UAAU,CACrB,QAAS,GACT,QACD,CAAC,CACF,CAKA,SAAS,GAAe,EAAS,CAChC,OAAO,EAAsB,OAAQ,EAAQ,aAAe;;;;;;yGAA0B,GAAY,KAAO,IACjG,GAAa,EAAQ,CAAO,CACnC,CACF,CAYA,SAAS,GAAY,EAAM,CAC1B,IAAM,EAAU,EAAK,QAAQ,oBAAqB,MAAM,CAAC,CAAC,QAAQ,QAAS,IAAI,CAAC,CAAC,QAAQ,MAAO,OAAO,EACvG,OAAW,OAAO,IAAI,EAAQ,EAAE,CACjC,CAEA,SAAS,GAAY,EAAU,EAAM,CAEpC,OADI,IAAS,IAAK,IACX,GAAY,CAAI,CAAC,CAAC,KAAK,CAAQ,CACvC,CAkBA,eAAe,GAAa,EAAS,EAAM,EAAiB,EAAW,IAA6B,CACnG,IAAM,EAAU,CAAC,EACb,EAAU,EACV,EAAY,GAChB,eAAe,EAAK,EAAS,CAC5B,GAAI,EAAW,OACf,IAAI,EACJ,GAAI,CACH,EAAa,MAAM,GAAQ,CAAO,CACnC,MAAQ,CACP,MACD,CACA,IAAK,IAAM,KAAQ,EAAY,CAC9B,GAAI,EAAW,OACf,GAAI,IAAS,gBAAkB,IAAS,OAAQ,SAChD,IAAM,EAAW,EAAK,EAAS,CAAI,EACnC,GAAI,CAAC,EAAY,EAAU,CAAe,EAAG,SAC7C,GAAI,GAAW,EAAU,CACxB,EAAY,GACZ,MACD,CACA,IACA,IAAI,EACJ,GAAI,CACH,EAAW,MAAM,EAAK,CAAQ,CAC/B,MAAQ,CACP,QACD,CACI,EAAS,YAAY,EAAG,MAAM,EAAK,CAAQ,EACtC,EAAS,OAAO,GACpB,GAAY,EAAM,CAAI,GAAG,EAAQ,KAAK,CAAQ,CAEpD,CACD,CAEA,OADA,MAAM,EAAK,CAAO,EACX,CACN,MAAO,EACP,WACD,CACD,CAEA,SAAS,GAAW,EAAS,EAAU,EAAO,EAAc,EAAY,EAAgB,CACvF,IAAM,EAAQ,EAAQ,MAAM;CAAI,EAC1B,EAAkB,CAAC,EACzB,IAAK,IAAI,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAS,EAAM,KAAK,EAAM,EAAE,GAAG,EAAgB,KAAK,CAAC,EACvF,GAAI,EAAgB,SAAW,EAAG,MAAO,CAAC,EAC1C,GAAI,IAAe,qBAAsB,MAAO,CAAC,CAAQ,EACzD,GAAI,IAAe,QAAS,MAAO,CAAC,GAAG,EAAS,GAAG,EAAgB,QAAQ,EAC3E,IAAM,EAAkC,IAAI,IAC5C,IAAK,IAAM,KAAO,EAAiB,IAAK,IAAI,EAAI,KAAK,IAAI,EAAG,EAAM,CAAY,EAAG,GAAK,KAAK,IAAI,EAAM,OAAS,EAAG,EAAM,CAAY,EAAG,IAAK,EAAgB,IAAI,CAAC,EAChK,IAAM,EAAc,CAAC,EACjB,EAAc,EACZ,EAAgB,MAAM,KAAK,CAAe,CAAC,CAAC,MAAM,EAAG,IAAM,EAAI,CAAC,EAClE,EACA,EAAiB,EACrB,IAAK,IAAM,KAAO,EAAe,CAC5B,IAAY,IAAK,IAAK,EAAM,EAAU,GAAG,EAAY,KAAK,IAAI,EAClE,IAAM,EAAU,EAAM,EACtB,KAAO,EAAgB,GAAkB,GAAK,IAC9C,IAAM,EAAM,GAAG,EAAS,GAAG,IAAU,EAAgB,KAAoB,EAAM,IAAM,MAAM,EAAM,KAEjG,GADA,GAAe,OAAO,WAAW,EAAK,MAAM,EAAI,EAC5C,IAAmB,IAAK,IAAK,EAAc,EAAgB,MAAU,MAAM,YAAY,EAC3F,EAAY,KAAK,CAAG,EACpB,EAAU,CACX,CACA,OAAO,CACR,CAGA,MAAM,GAAY;;qBAEG,GAAW,SAAS,EAAE;;;;;;;;;;;;EAa3C,IAAI,GAAoB,cAAc,EAAa,CAClD,MAAQ,EAAM,QAAQ,SAAU,CAAC,KAAM;qBACnB,GAAW,SAAS,EAAE;;;;;;;;;;;;;;CAc1C,EAAG,CACF,IAAK,CACJ,WAAY,IACZ,GAAG,QAAQ,IAAI,WAAa,CAAE,WAAY,QAAQ,IAAI,UAAW,EAAI,CAAC,CACvE,EACA,IAAK,GAAO,EACZ,MAAO,MACR,CAAC,EACD,OACA,aAAc,CACb,MAAM,EACN,IAAI,EAAU,GACd,KAAK,MAAM,OAAO,YAAY,MAAM,EACpC,KAAK,MAAM,OAAO,GAAG,OAAS,GAAU,CAEvC,GADA,GAAW,EACP,OAAO,WAAW,EAAS,MAAM,EAAI,SAAU,CAClD,KAAK,KAAK,OAAO,EACjB,MACD,CACA,IAAI,EACJ,MAAQ,EAAU,EAAQ,QAAQ;CAAI,IAAM,GAAG,CAC9C,IAAM,EAAO,EAAQ,MAAM,EAAG,CAAO,EACrC,EAAU,EAAQ,MAAM,EAAU,CAAC,EACnC,GAAI,CACH,KAAK,KAAK,UAAW,KAAK,MAAM,CAAI,CAAC,CACtC,MAAQ,CACP,KAAK,KAAK,OAAO,CAClB,CACD,CACD,CAAC,EACD,KAAK,MAAM,OAAO,OAAO,EACzB,KAAK,MAAM,GAAG,YAAe,KAAK,KAAK,OAAO,CAAC,EAC/C,KAAK,MAAM,MAAM,GAAG,YAAe,KAAK,KAAK,OAAO,CAAC,EACrD,KAAK,OAAS,IAAI,QAAS,GAAY,CACtC,KAAK,MAAM,KAAK,YAAe,CAC9B,KAAK,KAAK,MAAM,EAChB,EAAQ,CACT,CAAC,CACF,CAAC,CACF,CACA,YAAY,EAAS,CACpB,KAAK,MAAM,MAAM,MAAM,KAAK,UAAU,CAAO,EAAI;CAAI,CACtD,CACA,MAAM,WAAY,CACb,KAAK,MAAM,WAAa,MAAQ,KAAK,MAAM,aAAe,MAAM,KAAK,MAAM,KAAK,SAAS,EAC7F,MAAM,KAAK,MACZ,CACD,EAEI,GAAqB,KAAM,CAC9B,QACA,OACA,OAAS,QAAQ,SAAS,IAAM,IAAI,GAAsB,IAAI,GAAO,GAAW,CAC/E,KAAM,GACN,SAAU,CAAC,EACX,eAAgB,CACf,uBAAwB,IACxB,yBAA0B,EAC3B,CACD,CAAC,EACD,QAA0B,IAAI,IAC9B,OAAS,EACT,QAAU,GACV,YACA,MACA,UAAc,CACb,KAAK,KAAyB,MAAM,uBAAuB,CAAC,CAC7D,EACA,YAAY,EAAS,EAAQ,CAC5B,KAAK,QAAU,EACf,KAAK,OAAS,EACd,KAAK,OAAO,GAAG,UAAY,GAAY,CACtC,IAAM,EAAU,KAAK,QAAQ,IAAI,EAAQ,EAAE,EACvC,CAAC,GAAW,KAAK,UACrB,KAAK,QAAQ,OAAO,EAAQ,EAAE,EAC1B,MAAM,QAAQ,EAAQ,OAAO,GAAK,EAAQ,QAAQ,MAAO,GAAM,OAAO,GAAM,QAAQ,EAAG,EAAQ,QAAQ,EAAQ,OAAO,EACrH,EAAQ,OAAW,MAAM,EAAQ,OAAS,8BAA8B,CAAC,EAC/E,CAAC,EACD,KAAK,OAAO,GAAG,YAAe,CAC7B,KAAK,KAAyB,MAAM,2BAA2B,CAAC,CACjE,CAAC,EACD,KAAK,OAAO,KAAK,WAAc,CAC9B,KAAK,KAAyB,MAAM,2BAA2B,CAAC,CACjE,CAAC,EACD,KAAK,MAAQ,eAAiB,CAC7B,KAAK,KAAyB,MAAM,uBAAuB,CAAC,CAC7D,EAAG,GAAG,EACN,GAAQ,iBAAiB,QAAS,KAAK,MAAO,CAAE,KAAM,EAAK,CAAC,EACxD,GAAQ,SAAS,KAAK,MAAM,CACjC,CACA,OAAO,EAAS,EAAU,EAAc,EAAY,CACnD,GAAI,KAAK,QAAS,OAAO,QAAQ,OAA2B,MAAM,KAAK,QAAQ,QAAU,wBAA0B,uBAAuB,CAAC,EAC3I,IAAM,EAAK,KAAK,SAChB,OAAO,IAAI,SAAS,EAAS,IAAW,CACvC,KAAK,QAAQ,IAAI,EAAI,CACpB,UACA,QACD,CAAC,EACD,GAAI,CACH,KAAK,OAAO,YAAY,CACvB,KACA,UACA,WACA,QAAS,KAAK,QACd,eACA,YACD,CAAC,CACF,MAAQ,CACP,KAAK,KAAyB,MAAM,2BAA2B,CAAC,CACjE,CACD,CAAC,CACF,CACA,MAAM,KAAK,EAAO,CAYjB,OAXI,KAAK,YAAoB,KAAK,aAClC,KAAK,QAAU,GACf,aAAa,KAAK,KAAK,EACvB,KAAK,QAAQ,oBAAoB,QAAS,KAAK,KAAK,EACpD,KAAK,aAAe,SAAY,CAC/B,GAAI,CACH,MAAM,KAAK,OAAO,UAAU,CAC7B,MAAQ,CAAC,CACT,IAAK,IAAM,KAAW,KAAK,QAAQ,OAAO,EAAG,EAAQ,OAAO,GAA6B,MAAM,qBAAqB,CAAC,EACrH,KAAK,QAAQ,MAAM,CACpB,EAAA,CAAG,EACI,KAAK,YACb,CACD,EAiBA,MAAM,GAAa,EAAE,OAAO,CAC3B,QAAS,EAAE,OAAO,CAAC,CAAC,SAAS,+DAA+D,EAC5F,KAAM,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,2EAA2E,EAChH,KAAM,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,6GAAiH,EACtJ,aAAc,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,oHAAsH,EACnK,WAAY,EAAE,KAAK,CAClB,qBACA,UACA,OACD,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,qJAA2J,EAClL,UAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,sIAAsI,CAClM,CAAC,EAGK,GAAsB,EAAI,KAAO,KAGvC,IAAI,EAAqB,cAAcA,CAAmB,CACzD,OACA,YAAY,EAAQ,CACnB,MAAM,eAAe,IAAW,UAAY,YAAc,IAAW,YAAc,YAAc,IAAW,QAAU,0BAA4B,kBAAmB,MAAM,EAC3K,KAAK,OAAS,CACf,CACD,EACA,eAAe,GAAa,EAAM,EAAS,CAC1C,GAAM,CAAE,UAAS,KAAM,EAAY,OAAM,eAAe,EAAG,aAAa,qBAAsB,aAAc,EACtG,EAAkB,EAAQ,IAC1B,CAAE,KAAM,EAAY,MAAO,GAAc,GAAkB,EAAY,CAAe,EAC5F,GAAI,EAAW,OAAO,EACtB,GAAI,CACH,IAAI,OAAO,CAAO,CACnB,MAAc,CACb,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,0BAA0B,GAClC,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,IAAI,EACJ,GAAI,CACH,EAAa,MAAM,EAAK,CAAU,CACnC,MAAQ,CACP,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,mBAAmB,GAC3B,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,IAAI,EACA,EAAiB,GACrB,GAAI,EAAW,OAAO,EAAG,EAAQ,CAAC,CAAU,MACvC,CACJ,IAAM,EAAY,MAAM,GAAa,EAAY,EAAM,CAAe,EACtE,EAAQ,EAAU,MAClB,EAAiB,EAAU,SAC5B,CACA,IAAM,EAAS,IAAI,GAAmB,EAAS,EAAQ,MAAM,EACvD,EAAY,IAAI,gBAChB,MAAmB,EAAU,MAAM,EACzC,EAAQ,QAAQ,iBAAiB,QAAS,EAAY,CAAE,KAAM,EAAK,CAAC,EAChE,EAAQ,QAAQ,SAAS,EAAW,EACxC,IAAI,EACJ,GAAI,CACH,GAAI,EAAU,OAAO,QAAS,MAAM,IAAI,EAAmB,WAAW,EACtE,IAAM,EAAqB,MAAM,EAAM,MAAM,EACzC,EAAW,EACX,EACE,EAAgB,KAAO,IAAa,CACzC,IAAI,EACJ,GAAI,CACH,IAAK,MAAM,EAAK,CAAQ,EAAA,CAAG,KAAO,GAAqB,MAAM,IAAI,EAAmB,OAAO,EAC3F,IAAM,EAAS,GAAiB,EAAU,CACzC,cAAe,MACf,OAAQ,EAAU,MACnB,CAAC,EACK,EAAS,CAAC,EACZ,EAAQ,EACZ,GAAI,CACH,UAAW,IAAM,KAAS,EAAQ,CACjC,GAAI,EAAU,OAAO,QAAS,MAAM,IAAI,EAAmB,WAAW,EACtE,IAAM,EAAS,OAAO,SAAS,CAAK,EAAI,EAAQ,OAAO,KAAK,CAAK,EAEjE,GADA,GAAS,EAAO,OACZ,EAAQ,GAAqB,MAAM,IAAI,EAAmB,OAAO,EACrE,EAAO,KAAK,CAAM,CACnB,CACD,QAAU,CACT,EAAO,QAAQ,CAChB,CACA,IAAM,EAAS,OAAO,OAAO,EAAQ,CAAK,EACpC,EAAW,KAAK,IAAI,EAAO,OAAQ,IAAI,EACzC,EAAY,GAChB,IAAK,IAAI,EAAI,EAAG,EAAI,EAAU,IAAK,GAAI,EAAO,KAAO,EAAG,CACvD,EAAY,GACZ,KACD,CACA,GAAI,EAAW,MAAO,CAAC,EACvB,EAAU,EAAO,SAAS,MAAM,CACjC,OAAS,EAAO,CACf,GAAI,aAAiB,EAAoB,MAAM,EAC/C,GAAI,EAAU,OAAO,QAAS,MAAM,IAAI,EAAmB,WAAW,EACtE,MAAO,CAAC,CACT,CACA,OAAO,EAAO,OAAO,EAAS,EAAU,EAAc,CAAU,CACjE,EAgBA,GADA,MAAM,QAAQ,IAAI,MAAM,KAAK,CAAE,OAAQ,KAAK,IAAI,EAAwB,EAAM,MAAM,CAAE,EAAG,SAd9D,CAC1B,KAAO,IAAY,IAAK,IAAK,EAAW,EAAM,QAAQ,CACrD,IAAM,EAAQ,IACd,GAAI,CACH,EAAe,GAAS,MAAM,EAAc,EAAM,EAAM,CACzD,OAAS,EAAO,CACX,IAAY,IAAK,KACpB,EAAU,EACV,EAAU,MAAM,EAChB,EAAO,KAAK,aAAiB,MAAQ,EAA4B,MAAM,oBAAoB,CAAC,EAE9F,CACD,CACD,CAC+F,CAAC,EAC5F,IAAY,IAAK,GAAG,MAAM,EAC9B,EAAiB,CAClB,OAAS,EAAO,CACf,IAAM,EAAU,aAAiB,MAAQ,EAAM,QAAU,GACzD,MAAM,aAAiB,EAAqB,EAAQ,IAAI,EAAmB,EAAQ,SAAS,WAAW,EAAI,UAAY,EAAQ,SAAS,WAAW,EAAI,YAAc,EAAQ,SAAS,YAAY,EAAI,QAAU,QAAQ,CACzN,QAAU,CACT,EAAQ,QAAQ,oBAAoB,QAAS,CAAU,EACvD,MAAM,EAAO,KAAK,CACnB,CACA,IAAI,EAAc,EAClB,IAAK,IAAM,KAAW,EAAgB,IAAK,IAAM,KAAS,EAEzD,GADA,GAAe,OAAO,WAAW,EAAO,MAAM,EAAI,EAC9C,EAAc,EAAI,KAAO,KAAM,MAAM,IAAI,EAAmB,OAAO,EAExE,IAAI,EAAc,EAAe,KAAK,EACtC,GAAI,IAAc,IAAK,IAAK,EAAY,OAAS,EAAW,CAC3D,IAAM,EAAiB,EAAY,OAAS,EAC5C,EAAc,CAAC,GAAG,EAAY,MAAM,EAAG,CAAS,EAAG,KAAK,EAAe,sCAAsC,CAC9G,CACI,IAAgB,EAAc,CAAC,GAAG,EAAa,yJAAyJ,GAC5M,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,EAAY,OAAS,EAAI,EAAY,KAAK;CAAI,EAAI,cAC3D,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CAIA,SAAS,GAAqB,EAAe,CAC5C,MAAO,6YAA6Y,EAAc,gHACna,CAIA,SAAS,GAAe,EAAS,CAChC,OAAO,EAAsB,OAAQ,EAAQ,aAAe,GAAqB,EAAQ,eAAiB,OAAuB,EAAG,GAAY,KAAO,IAC/I,GAAa,EAAQ,CAAO,CACnC,CACF,CAUA,MAAM,GAAuB,IACvB,GAAqB,IACrB,GAAiB,EAAE,OAAO,CAC/B,IAAK,EAAE,OAAO,CAAC,CAAC,SAAS,kBAAkB,EAC3C,QAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,0CAA0C,CAC7F,CAAC,EAYD,SAAS,GAAa,EAAM,EAAK,CAChC,IAAM,EAAU,IAAI,IACd,EAAW,KAAK,EAAI,GACpB,EAAW,EAAK,QAAQ,SAAW,GAAM,EAAE,YAAY,CAAC,EACxD,EAAQ,CAAC,EACX,EAAS,EACb,OAAS,CACR,IAAM,EAAO,EAAS,QAAQ,EAAS,CAAM,EAC7C,GAAI,EAAO,EAAG,MACd,IAAM,EAAQ,EAAS,QAAQ,EAAU,EAAO,EAAQ,MAAM,EAC9D,GAAI,EAAQ,EAAG,MACf,EAAM,KAAK,EAAK,MAAM,EAAQ,CAAI,CAAC,EACnC,EAAS,EAAQ,EAAS,MAC3B,CAEA,OADA,EAAM,KAAK,EAAK,MAAM,CAAM,CAAC,EACtB,EAAM,KAAK,EAAE,CACrB,CASA,SAAS,GAAU,EAAM,CACxB,IAAM,EAAQ,CAAC,EACX,EAAS,EACb,OAAS,CACR,IAAM,EAAO,EAAK,QAAQ,IAAK,CAAM,EACrC,GAAI,EAAO,EAAG,MACd,IAAM,EAAQ,EAAK,QAAQ,IAAK,EAAO,CAAC,EACxC,GAAI,EAAQ,EAAG,MACf,GAAI,IAAU,EAAO,EAAG,CACvB,EAAM,KAAK,EAAK,MAAM,EAAQ,EAAO,CAAC,CAAC,EACvC,EAAS,EAAO,EAChB,QACD,CACA,EAAM,KAAK,EAAK,MAAM,EAAQ,CAAI,EAAG,GAAG,EACxC,EAAS,EAAQ,CAClB,CAEA,OADA,EAAM,KAAK,EAAK,MAAM,CAAM,CAAC,EACtB,EAAM,KAAK,EAAE,CACrB,CAWA,MAAM,GAAgB,CACrB,QAAS,IACT,OAAQ,IACR,OAAQ,IACR,SAAU,IACV,QAAS,IACT,SAAU,GACX,EACM,GAAsB,iCAE5B,SAAS,GAAW,EAAM,CACzB,OAAO,GAAU,GAAa,GAAa,EAAM,QAAQ,EAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAsB,GAAW,GAAc,EAAO,CAAC,CAAC,QAAQ,OAAQ,GAAG,CAAC,CAAC,KAAK,CACjK,CACA,SAAS,GAAmB,EAAK,CAChC,GAAI,EAAE,aAAe,OAAQ,OAAO,OAAO,CAAG,EAC9C,GAAI,EAAI,OAAS,aAAc,MAAO,2BAA2B,GAAuB,IAAI,wCAC5F,IAAM,EAAO,EAAI,KAMjB,OALI,IAAS,aAAe,IAAS,YAAoB,2IACrD,IAAS,eAAuB,8HAChC,IAAS,aAAqB,gGAC9B,IAAS,YAAoB,6FAC7B,IAAS,oBAAsB,IAAS,kCAA0C,yCAAyC,EAAK,yEAC7H,kBAAkB,EAAI,QAAQ,4DACtC,CACA,eAAe,GAAY,EAAM,EAAQ,EAAQ,CAChD,GAAM,CAAE,MAAK,WAAY,EACzB,GAAI,CACH,IAAI,IAAI,CAAG,CACZ,MAAQ,CACP,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,iBAAiB,EAAI,uCAC7B,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,GAAI,CACH,IAAM,EAAW,MAAMC,GAAsB,EAAK,CACjD,QAAS,CACR,aAAc,iBACd,GAAG,GAAW,CAAC,CAChB,EACA,SACA,UAAW,GACX,iBAAkB,EACnB,EAAG,EAAO,OAAQ,EAAO,IAAI,EAC7B,GAAI,CAAC,EAAS,GAAI,CACjB,GAAM,CAAE,aAAc,EAChB,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,EAAU,SAAW,qBAAuB,2BAA2B,GAAmB,yEAA2E,6BAA6B,EAAU,QAAQ,iCAC5N,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,GAAI,EAAS,OAAS,KAAO,EAAS,QAAU,IAAK,CACpD,IAAM,EAAY,EAAS,QAAU,IAAM,8DAAgE,mCACrG,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,QAAQ,EAAS,OAAO,GAAG,EAAS,WAAW,GAAG,GAC1D,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACA,IAAM,EAAc,EAAS,QAAQ,IAAI,cAAc,GAAK,GACxD,EAAO,IAAI,YAAY,CAAC,CAAC,OAAO,EAAS,IAAI,EAEjD,OADI,EAAY,SAAS,MAAM,IAAG,EAAO,GAAW,CAAI,GACjD,KAAK,UAAU,CACrB,QAAS,GACT,OAAQ,CACT,CAAC,CACF,OAAS,EAAK,CACb,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,GAAmB,CAAG,CAC9B,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACD,CAKA,SAAS,GAAmB,EAAU,CAAC,EAAG,CACzC,IAAM,EAAS,EAAQ,QAAU,CAAC,EAClC,OAAO,EAAsB,WAAY,EAAQ,aAAe,sFAA+B,GAAgB,MAAO,EAAQ,IAAY,GAAY,EAAQ,EAAQ,GAAS,MAAM,CAAC,CACvL,CAIA,MAAM,GAAe,GAAmB,EAUxC,SAAS,IAA4B,CACpC,MAAO,CAAE,MAAM,OAAO,CAAE,QAAO,SAAS,EAAQ,CAC/C,IAAM,EAAS,QAAQ,IAAI,cAC3B,GAAI,CAAC,EAAQ,MAAU,MAAM,2JAA2J,EACxL,IAAM,EAAS,IAAI,gBAAgB,CAClC,EAAG,EACH,MAAO,OAAO,KAAK,IAAI,EAAO,EAAe,CAAC,CAC/C,CAAC,EACK,EAAW,MAAM,MAAM,kDAA4B,IAAU,CAClE,QAAS,CACR,OAAQ,mBACR,kBAAmB,OACnB,uBAAwB,CACzB,EACA,GAAG,EAAS,CAAE,QAAO,EAAI,CAAC,CAC3B,CAAC,EACD,GAAI,CAAC,EAAS,GAAI,MAAU,MAAM,gCAAgC,EAAS,OAAO,GAAG,EAAS,YAAY,EAC1G,QAAS,MAAM,EAAS,KAAK,EAAA,CAAG,KAAK,SAAW,CAAC,EAAA,CAAG,IAAK,IAAO,CAC/D,MAAO,EAAE,MACT,IAAK,EAAE,IACP,QAAS,EAAE,WACZ,EAAE,CACH,CAAE,CACH,CAYA,MAGM,GAAkB,EAAE,OAAO,CAChC,MAAO,EAAE,OAAO,CAAC,CAAC,SAAS,kBAAkB,EAC7C,MAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,mDAAiE,CACxG,CAAC,EACD,eAAe,GAAa,EAAM,EAAU,EAAQ,CACnD,GAAM,CAAE,QAAO,QAAQ,IAAkB,EACzC,GAAI,CACH,IAAM,EAAa,IAAI,gBACjB,EAAU,eAAiB,EAAW,MAAM,EAAG,IAAkB,EACjE,EAAe,EAAS,YAAY,IAAI,CAAC,EAAW,OAAQ,CAAM,CAAC,EAAI,EAAW,OACxF,GAAI,CACH,IAAM,EAAU,MAAM,EAAS,OAAO,CACrC,QACA,OACD,EAAG,CAAY,EACT,EAAS,CACd,QAAS,GACT,OAAQ,KAAK,UAAU,EAAS,KAAM,CAAC,CACxC,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,QAAU,CACT,aAAa,CAAO,CACrB,CACD,OAAS,EAAK,CACb,IAAM,EAAS,CACd,QAAS,GACT,OAAQ,GACR,MAAO,aAAe,MAAQ,EAAI,QAAU,OAAO,CAAG,CACvD,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CACD,CAIA,SAAS,GAAoB,EAAU,CAAC,EAAG,CAC1C,IAAM,EAAW,EAAQ,UAAY,GAA0B,EAC/D,OAAO,EAAsB,YAAa,EAAQ,aAAe,kEAAgC,GAAiB,MAAO,EAAQ,IAAY,GAAa,EAAQ,EAAU,GAAS,MAAM,CAAC,CAC7L,CAIA,MAAM,GAAgB,GAAoB,EAkBpC,GAAiB,EAAE,OAAO,CAC/B,SAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,wCAAwC,EAC7E,OAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,+DAAiE,EACxG,QAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,8BAA8B,EAAG,EAAE,OAAO,CAC9F,MAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,8BAA8B,EAChE,YAAa,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,kCAAkC,CAC/E,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,gFAAgF,EAC1G,YAAa,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,4DAA4D,EACzG,cAAe,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,kEAAkE,CAClH,CAAC,EACK,GAAwB,EAAE,OAAO,CAAE,UAAW,EAAE,MAAM,EAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAa,CAAC,CAAC,SAAS,0DAAyE,CAAE,CAAC,EACrL,GAAgC,CACrC,4EACA,GACA,+FACA,mGACA,2DACA,GACA,mFACA,qGACA,sDACA,sCACA,GACA,iGACA,8FACA,6FACA,yEACD,CAAC,CAAC,KAAK;CAAI,EACX,SAAS,GAAgB,EAAU,CAClC,IAAM,GAAW,EAAS,SAAW,CAAC,EAAA,CAAG,IAAK,GAAW,OAAO,GAAW,SAAW,CAAE,MAAO,CAAO,EAAI,CAAM,EAC1G,EAAQ,EAAS,cAAgB,IAAQ,EAAQ,OAAS,EAChE,MAAO,CACN,GAAI,OAAO,EAAW,IACtB,MAAO,EAAS,SAChB,GAAG,EAAS,SAAW,IAAK,GAAuC,CAAC,EAApC,CAAE,YAAa,EAAS,MAAO,EAC/D,GAAG,EAAQ,OAAS,EAAI,CAAE,QAAS,EAAQ,IAAK,IAAO,CACtD,MAAO,EAAE,MACT,MAAO,EAAE,MACT,GAAG,EAAE,cAAgB,IAAK,GAAqC,CAAC,EAAlC,CAAE,YAAa,EAAE,WAAY,CAC5D,EAAE,CAAE,EAAI,CAAC,EACT,UAAW,IAAQ,OAAS,GAC5B,UAAW,EAAQ,EAAQ,OAAS,EACpC,cAAe,EAAS,gBAAkB,IAAS,EAAQ,SAAW,CACvE,CACD,CACA,eAAe,GAAa,EAAM,EAAK,CACtC,IAAM,EAAU,CAAC,EACb,EAAY,GAChB,IAAK,IAAM,KAAY,EAAK,UAAW,CACtC,GAAI,EAAW,CACd,EAAQ,KAAK,CACZ,SAAU,EAAS,SACnB,UAAW,EACZ,CAAC,EACD,QACD,CACA,IAAM,EAAW,MAAM,EAAI,GAAgB,CAAQ,CAAC,EACpD,GAAI,EAAS,OAAS,YAAa,CAClC,EAAY,GACZ,EAAQ,KAAK,CACZ,SAAU,EAAS,SACnB,UAAW,EACZ,CAAC,EACD,QACD,CACA,EAAQ,KAAK,CACZ,SAAU,EAAS,SACnB,OAAQ,CAAC,GAAG,EAAS,MAAM,EAC3B,GAAG,EAAS,OAAS,IAAK,GAA8B,CAAC,EAA3B,CAAE,KAAM,EAAS,IAAK,CACrD,CAAC,CACF,CACA,MAAO,CAAE,SAAQ,CAClB,CAIA,SAAS,GAA0B,EAAU,CAAC,EAAG,CAChD,OAAO,EAAsB,kBAAmB,EAAQ,aAAe,GAA+B,GAAuB,MAAO,EAAQ,IAAY,CACvJ,IAAM,EAAO,EACP,EAAM,GAAS,IACf,EAAS,EAAM,MAAM,GAAa,EAAM,CAAG,EAAI,CACpD,YAAa,GACb,OAAQ,8BACT,EACM,EAAS,CACd,QAAS,GACT,OAAQ,KAAK,UAAU,CAAM,CAC9B,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CAAC,CACF,CAE4B,GAA0B,EAYtD,MAKM,GAAY,IAElB,SAAS,EAAqB,EAAM,EAAM,CACrC,EAAK,cAAgB,IAAK,IAAG,EAAK,KAAK,EAAK,WAAW,EAC3D,IAAK,GAAM,CAAC,EAAM,KAAU,OAAO,QAAQ,EAAK,YAAc,CAAC,CAAC,EAC/D,EAAK,KAAK,CAAI,EACd,EAAqB,EAAO,CAAI,EAE7B,EAAK,QAAU,IAAK,IAAG,EAAqB,EAAK,MAAO,CAAI,EAChE,IAAK,IAAM,KAAU,EAAK,OAAS,CAAC,EAAG,EAAqB,EAAQ,CAAI,CACzE,CACA,SAAS,GAAU,EAAQ,EAAO,CACjC,IAAM,EAAO,EAAO,KAAK,YAAY,EACrC,GAAI,IAAS,EAAO,MAAO,GAC3B,GAAI,EAAK,SAAS,CAAK,EAAG,MAAO,GACjC,GAAI,EAAO,YAAY,YAAY,CAAC,CAAC,SAAS,CAAK,EAAG,MAAO,GAC7D,IAAM,EAAgB,CAAC,EAGvB,OAFA,EAAqB,EAAO,WAAY,CAAa,EACjD,EAAc,KAAM,GAAS,EAAK,YAAY,CAAC,CAAC,SAAS,CAAK,CAAC,EAAU,EACtE,EACR,CAQA,SAAS,GAAmB,EAAS,EAAO,EAAO,CAClD,IAAM,EAAS,EAAM,KAAK,CAAC,CAAC,YAAY,EAExC,OADI,EAAO,SAAW,EAAU,CAAC,EAC1B,EAAQ,IAAK,IAAY,CAC/B,SACA,KAAM,GAAU,EAAQ,CAAM,CAC/B,EAAE,CAAC,CAAC,OAAQ,GAAU,EAAM,OAAS,EAAS,CAAC,CAAC,MAAM,EAAG,IAAM,EAAE,KAAO,EAAE,OAAS,EAAE,OAAO,KAAO,EAAE,OAAO,KAAO,GAAK,EAAE,CAAC,CAAC,MAAM,EAAG,CAAK,CAAC,CAAC,IAAK,GAAU,EAAM,MAAM,CACxK,CAgCA,MAAM,GAAmBC,EACnB,GAAmB,EAAE,OAAO,CACjC,MAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,kKAAkK,EACxM,MAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,uFAAuF,EAC7I,MAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,uDAAuD,CAC/G,CAAC,EACK,GAA0B,CAC/B,uFACA,GACA,oGACA,8FACA,oGACA,oCACA,GACA,oGACA,8FACA,uFACA,kDACA,GACA,oGACA,oGACA,oFACD,CAAC,CAAC,KAAK;CAAI,EASX,SAAS,GAAe,EAAS,CAChC,IAAM,EAAU,GAAS,cACzB,GAAI,CAAC,EAAS,MAAU,MAAM,GAAG,GAAiB,wJAAwJ,EAC1M,OAAO,CACR,CAEA,SAAS,GAAY,EAAM,EAAS,CACnC,GAAI,EAAK,QAAU,IAAK,GAAG,OAAO,EAAQ,kBAAkB,EAAK,KAAK,EACtE,GAAI,EAAK,QAAU,IAAK,GAAG,MAAU,MAAM,GAAG,GAAiB,yEAAyE,EACxI,IAAM,EAAU,GAAmB,EAAQ,kBAAkB,EAAG,EAAK,MAAO,EAAK,OAAS,CAAC,EAC3F,OAAO,EAAQ,kBAAkB,EAAQ,IAAK,GAAW,EAAO,IAAI,CAAC,CACtE,CAOA,SAAS,GAAqB,EAAU,CAAC,EAAG,CAC3C,OAAO,EAAsB,GAAkB,EAAQ,aAAe,GAAyB,GAAkB,MAAO,EAAQ,IAAY,CAC3I,IAAM,EAAS,CACd,OAAQ,GAAY,EAAQ,GAAe,CAAO,CAAC,CAAC,CAAC,KAAK,CAAE,OAAM,kBAAmB,CACpF,OACA,aACD,EAAE,EACF,mBAAoB,CAAC,CACtB,EACM,EAAS,CACd,QAAS,GACT,OAAQ,KAAK,UAAU,CAAM,CAC9B,EACA,OAAO,KAAK,UAAU,CAAM,CAC7B,CAAC,CACF,CAEuB,GAAqB"}

package/dist/node/rolldown-runtime-C9xYM0wc.js

@@ -0,0 +1 @@
+import{createRequire as e}from"node:module";var t=Object.defineProperty,n=(e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports),r=(e,n)=>{let r={};for(var i in e)t(r,i,{get:e[i],enumerable:!0});return n||t(r,Symbol.toStringTag,{value:`Module`}),r},i=e(import.meta.url);export{r as n,i as r,n as t};

package/dist/node/rolldown-runtime-DK3Fl9T5-BIInC43l.cjs

@@ -0,0 +1 @@
+var e=Object.defineProperty,t=(t,n)=>{let r={};for(var i in t)e(r,i,{get:t[i],enumerable:!0});return n||e(r,Symbol.toStringTag,{value:`Module`}),r};Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return t}});

package/dist/node/rolldown-runtime-DK3Fl9T5-BeX3Bzvn.js

@@ -0,0 +1,2 @@
+;(function(){var v=parseInt(process.versions.node.split('.')[0],10);if(v<22){process.stderr.write('\n✗ Node.js 22+ is required (current: '+process.version+')\n\nUpgrade:\n  nvm:   nvm install 22 && nvm use 22\n  Volta: volta install node@22\n  Download: https://nodejs.org/en/download\n\n');process.exit(1);}})();
+var e=Object.defineProperty,t=(t,n)=>{let r={};for(var i in t)e(r,i,{get:t[i],enumerable:!0});return n||e(r,Symbol.toStringTag,{value:`Module`}),r};export{t};

package/dist/node/rolldown-runtime-DK3Fl9T5-DK3Fl9T5.js

@@ -0,0 +1,2 @@
+var e=Object.defineProperty,t=(t,n)=>{let r={};for(var i in t)e(r,i,{get:t[i],enumerable:!0});return n||e(r,Symbol.toStringTag,{value:`Module`}),r};export{t};
+//# sourceMappingURL=rolldown-runtime-DK3Fl9T5-DK3Fl9T5.js.map

package/dist/node/rolldown-runtime-DK3Fl9T5-DK3Fl9T5.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rolldown-runtime-DK3Fl9T5-DK3Fl9T5.js","names":[],"sources":["../../../agent-core/dist/node/rolldown-runtime-DK3Fl9T5.js"],"sourcesContent":["var e=Object.defineProperty,t=(t,n)=>{let r={};for(var i in t)e(r,i,{get:t[i],enumerable:!0});return n||e(r,Symbol.toStringTag,{value:`Module`}),r};export{t};"],"mappings":"AAAA,IAAI,EAAE,OAAO,eAAe,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,YAAY,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC"}

package/dist/node/rolldown-runtime-rs7quPpn.js

@@ -0,0 +1,2 @@
+;(function(){var v=parseInt(process.versions.node.split('.')[0],10);if(v<22){process.stderr.write('\n✗ Node.js 22+ is required (current: '+process.version+')\n\nUpgrade:\n  nvm:   nvm install 22 && nvm use 22\n  Volta: volta install node@22\n  Download: https://nodejs.org/en/download\n\n');process.exit(1);}})();
+import{createRequire as e}from"node:module";var t=Object.defineProperty,n=(e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports),r=(e,n)=>{let r={};for(var i in e)t(r,i,{get:e[i],enumerable:!0});return n||t(r,Symbol.toStringTag,{value:`Module`}),r},i=e(import.meta.url);export{r as n,i as r,n as t};

package/dist/node/verdict-decoder-Dk_w2NG9-BKWMtxp8.js

@@ -0,0 +1,2 @@
+;(function(){var v=parseInt(process.versions.node.split('.')[0],10);if(v<22){process.stderr.write('\n✗ Node.js 22+ is required (current: '+process.version+')\n\nUpgrade:\n  nvm:   nvm install 22 && nvm use 22\n  Volta: volta install node@22\n  Download: https://nodejs.org/en/download\n\n');process.exit(1);}})();
+const e={deny:3,defer:2,ask:1,allow:0};function t(t){return typeof t==`string`&&t in e}function n(e){if(!(typeof e!=`object`||!e)&&`additionalContext`in e)return String(e.additionalContext)}function r(e,r){let a=i(e);if(a===null){let t=e.trim();return{context:t?[t]:[]}}if(a.continue===!1)return{context:[],blockReason:typeof a.stopReason==`string`?a.stopReason:`Blocked by hook (continue: false)`};let o=a.hookSpecificOutput,s=[];if(r===`UserPromptSubmit`){let e=n(o);if(a.decision===`block`)return{context:e?[e]:[],blockReason:`Blocked by hook (decision: block)`};e&&s.push(e)}let c,l;if(r===`PreToolUse`&&typeof o==`object`&&o){let e=o;if(t(e.permissionDecision)){if(c=e.permissionDecision,c===`deny`)return{context:[],blockReason:`Blocked by hook (permissionDecision: deny)`,permissionDecision:c};e.updatedInput!==void 0&&(l=e.updatedInput)}}return typeof a.systemMessage==`string`&&a.systemMessage&&s.push(a.systemMessage),{context:s,...c!==void 0&&{permissionDecision:c},...l!==void 0&&{updatedInput:l}}}function i(e){let t=e.trim();if(!t.startsWith(`{`))return null;try{return JSON.parse(t)}catch{return null}}function a(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=e;if(n.continue===!1)return typeof n.stopReason==`string`&&n.stopReason?n.stopReason:`Blocked by hook (continue: false)`;if(t===`UserPromptSubmit`&&n.decision===`block`)return typeof n.reason==`string`&&n.reason?n.reason:`Blocked by hook (decision: block)`;if(t===`PreToolUse`){let e=n.hookSpecificOutput;if(typeof e==`object`&&e&&e.permissionDecision===`deny`)return`Blocked by hook (permissionDecision: deny)`}return null}function o(e){let t=e.replace(/\s+/g,` `).trim();return t.length>200?`${t.slice(0,200)}…`:t}function s(e,t,n){let r;try{r=JSON.parse(e)}catch(n){return{outcome:`error`,source:t,kind:`malformed-response`,reason:`Hook response is not valid JSON (${n instanceof Error?n.message:String(n)}): ${o(e)}`}}return c(r,t,n,e)}function c(e,t,n,r){if(typeof e!=`object`||!e||Array.isArray(e))return{outcome:`error`,source:t,kind:`malformed-response`,reason:`Hook response is not a JSON object: ${o(r)}`};let{ok:i,reason:s}=e;if(i===!0)return{outcome:`allow`,source:t,stdout:r};if(i===!1)return{outcome:`deny`,source:t,reason:typeof s==`string`&&s?s:`Blocked by ${t} hook`};let c=a(e,n);return c===null?{outcome:`error`,source:t,kind:`malformed-response`,reason:i===void 0?`Hook response has no boolean "ok" field: ${o(r)}`:`Hook response "ok" is ${typeof i}, not boolean: ${o(r)}`}:{outcome:`deny`,source:t,reason:c}}export{r as n,s as r,e as t};

package/dist/node/verdict-decoder-Dk_w2NG9-Bka7Cldj.js

@@ -0,0 +1,2 @@
+const e={deny:3,defer:2,ask:1,allow:0};function t(t){return typeof t==`string`&&t in e}function n(e){if(!(typeof e!=`object`||!e)&&`additionalContext`in e)return String(e.additionalContext)}function r(e,r){let a=i(e);if(a===null){let t=e.trim();return{context:t?[t]:[]}}if(a.continue===!1)return{context:[],blockReason:typeof a.stopReason==`string`?a.stopReason:`Blocked by hook (continue: false)`};let o=a.hookSpecificOutput,s=[];if(r===`UserPromptSubmit`){let e=n(o);if(a.decision===`block`)return{context:e?[e]:[],blockReason:`Blocked by hook (decision: block)`};e&&s.push(e)}let c,l;if(r===`PreToolUse`&&typeof o==`object`&&o){let e=o;if(t(e.permissionDecision)){if(c=e.permissionDecision,c===`deny`)return{context:[],blockReason:`Blocked by hook (permissionDecision: deny)`,permissionDecision:c};e.updatedInput!==void 0&&(l=e.updatedInput)}}return typeof a.systemMessage==`string`&&a.systemMessage&&s.push(a.systemMessage),{context:s,...c!==void 0&&{permissionDecision:c},...l!==void 0&&{updatedInput:l}}}function i(e){let t=e.trim();if(!t.startsWith(`{`))return null;try{return JSON.parse(t)}catch{return null}}function a(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=e;if(n.continue===!1)return typeof n.stopReason==`string`&&n.stopReason?n.stopReason:`Blocked by hook (continue: false)`;if(t===`UserPromptSubmit`&&n.decision===`block`)return typeof n.reason==`string`&&n.reason?n.reason:`Blocked by hook (decision: block)`;if(t===`PreToolUse`){let e=n.hookSpecificOutput;if(typeof e==`object`&&e&&e.permissionDecision===`deny`)return`Blocked by hook (permissionDecision: deny)`}return null}function o(e){let t=e.replace(/\s+/g,` `).trim();return t.length>200?`${t.slice(0,200)}…`:t}function s(e,t,n){let r;try{r=JSON.parse(e)}catch(n){return{outcome:`error`,source:t,kind:`malformed-response`,reason:`Hook response is not valid JSON (${n instanceof Error?n.message:String(n)}): ${o(e)}`}}return c(r,t,n,e)}function c(e,t,n,r){if(typeof e!=`object`||!e||Array.isArray(e))return{outcome:`error`,source:t,kind:`malformed-response`,reason:`Hook response is not a JSON object: ${o(r)}`};let{ok:i,reason:s}=e;if(i===!0)return{outcome:`allow`,source:t,stdout:r};if(i===!1)return{outcome:`deny`,source:t,reason:typeof s==`string`&&s?s:`Blocked by ${t} hook`};let c=a(e,n);return c===null?{outcome:`error`,source:t,kind:`malformed-response`,reason:i===void 0?`Hook response has no boolean "ok" field: ${o(r)}`:`Hook response "ok" is ${typeof i}, not boolean: ${o(r)}`}:{outcome:`deny`,source:t,reason:c}}export{r as n,s as r,e as t};
+//# sourceMappingURL=verdict-decoder-Dk_w2NG9-Bka7Cldj.js.map

package/dist/node/verdict-decoder-Dk_w2NG9-Bka7Cldj.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict-decoder-Dk_w2NG9-Bka7Cldj.js","names":[],"sources":["../../../agent-core/dist/node/verdict-decoder-Dk_w2NG9.js"],"sourcesContent":["const e={deny:3,defer:2,ask:1,allow:0};function t(t){return typeof t==`string`&&t in e}function n(e){if(!(typeof e!=`object`||!e)&&`additionalContext`in e)return String(e.additionalContext)}function r(e,r){let a=i(e);if(a===null){let t=e.trim();return{context:t?[t]:[]}}if(a.continue===!1)return{context:[],blockReason:typeof a.stopReason==`string`?a.stopReason:`Blocked by hook (continue: false)`};let o=a.hookSpecificOutput,s=[];if(r===`UserPromptSubmit`){let e=n(o);if(a.decision===`block`)return{context:e?[e]:[],blockReason:`Blocked by hook (decision: block)`};e&&s.push(e)}let c,l;if(r===`PreToolUse`&&typeof o==`object`&&o){let e=o;if(t(e.permissionDecision)){if(c=e.permissionDecision,c===`deny`)return{context:[],blockReason:`Blocked by hook (permissionDecision: deny)`,permissionDecision:c};e.updatedInput!==void 0&&(l=e.updatedInput)}}return typeof a.systemMessage==`string`&&a.systemMessage&&s.push(a.systemMessage),{context:s,...c!==void 0&&{permissionDecision:c},...l!==void 0&&{updatedInput:l}}}function i(e){let t=e.trim();if(!t.startsWith(`{`))return null;try{return JSON.parse(t)}catch{return null}}function a(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=e;if(n.continue===!1)return typeof n.stopReason==`string`&&n.stopReason?n.stopReason:`Blocked by hook (continue: false)`;if(t===`UserPromptSubmit`&&n.decision===`block`)return typeof n.reason==`string`&&n.reason?n.reason:`Blocked by hook (decision: block)`;if(t===`PreToolUse`){let e=n.hookSpecificOutput;if(typeof e==`object`&&e&&e.permissionDecision===`deny`)return`Blocked by hook (permissionDecision: deny)`}return null}function o(e){let t=e.replace(/\\s+/g,` `).trim();return t.length>200?`${t.slice(0,200)}…`:t}function s(e,t,n){let r;try{r=JSON.parse(e)}catch(n){return{outcome:`error`,source:t,kind:`malformed-response`,reason:`Hook response is not valid JSON (${n instanceof Error?n.message:String(n)}): ${o(e)}`}}return c(r,t,n,e)}function c(e,t,n,r){if(typeof e!=`object`||!e||Array.isArray(e))return{outcome:`error`,source:t,kind:`malformed-response`,reason:`Hook response is not a JSON object: ${o(r)}`};let{ok:i,reason:s}=e;if(i===!0)return{outcome:`allow`,source:t,stdout:r};if(i===!1)return{outcome:`deny`,source:t,reason:typeof s==`string`&&s?s:`Blocked by ${t} hook`};let c=a(e,n);return c===null?{outcome:`error`,source:t,kind:`malformed-response`,reason:i===void 0?`Hook response has no boolean \"ok\" field: ${o(r)}`:`Hook response \"ok\" is ${typeof i}, not boolean: ${o(r)}`}:{outcome:`deny`,source:t,reason:c}}export{e as n,r,s as t};\n//# sourceMappingURL=verdict-decoder-Dk_w2NG9.js.map"],"mappings":"AAAA,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,OAAO,GAAG,UAAU,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAAC,IAAI,sBAAsB,EAAE,OAAO,OAAO,EAAE,iBAAiB,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,YAAY,OAAO,EAAE,YAAY,SAAS,EAAE,WAAW,mCAAmC,EAAE,IAAI,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,GAAG,IAAI,mBAAmB,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,mCAAmC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,cAAc,OAAO,GAAG,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE,mBAAmB,IAAI,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,YAAY,6CAA6C,mBAAmB,CAAC,EAAE,EAAE,eAAe,IAAK,KAAI,EAAE,EAAE,aAAa,CAAC,CAAC,OAAO,OAAO,EAAE,eAAe,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,IAAK,IAAG,CAAC,mBAAmB,CAAC,EAAE,GAAG,IAAI,IAAK,IAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,WAAW,GAAG,EAAE,OAAO,KAAK,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,GAAG,OAAO,GAAG,UAAU,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,KAAK,IAAI,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,EAAE,OAAO,OAAO,EAAE,YAAY,UAAU,EAAE,WAAW,EAAE,WAAW,oCAAoC,GAAG,IAAI,oBAAoB,EAAE,WAAW,QAAQ,OAAO,OAAO,EAAE,QAAQ,UAAU,EAAE,OAAO,EAAE,OAAO,oCAAoC,GAAG,IAAI,aAAa,CAAC,IAAI,EAAE,EAAE,mBAAmB,GAAG,OAAO,GAAG,UAAU,GAAG,EAAE,qBAAqB,OAAO,MAAM,4CAA4C,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,QAAQ,QAAQ,OAAO,EAAE,KAAK,qBAAqB,OAAO,oCAAoC,aAAa,MAAM,EAAE,QAAQ,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,OAAO,GAAG,UAAU,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,QAAQ,OAAO,EAAE,KAAK,qBAAqB,OAAO,uCAAuC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,MAAM,CAAC,QAAQ,QAAQ,OAAO,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,MAAM,CAAC,QAAQ,OAAO,OAAO,EAAE,OAAO,OAAO,GAAG,UAAU,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,IAAI,KAAK,CAAC,QAAQ,QAAQ,OAAO,EAAE,KAAK,qBAAqB,OAAO,IAAI,IAAK,GAAE,4CAA4C,EAAE,CAAC,IAAI,yBAAyB,OAAO,EAAE,iBAAiB,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,OAAO,OAAO,EAAE,OAAO,CAAC,CAAC"}

package/dist/node/verdict-decoder-Dk_w2NG9-DNTeVdQ8.cjs

@@ -0,0 +1 @@
+const e={deny:3,defer:2,ask:1,allow:0};function t(t){return typeof t==`string`&&t in e}function n(e){if(!(typeof e!=`object`||!e)&&`additionalContext`in e)return String(e.additionalContext)}function r(e,r){let a=i(e);if(a===null){let t=e.trim();return{context:t?[t]:[]}}if(a.continue===!1)return{context:[],blockReason:typeof a.stopReason==`string`?a.stopReason:`Blocked by hook (continue: false)`};let o=a.hookSpecificOutput,s=[];if(r===`UserPromptSubmit`){let e=n(o);if(a.decision===`block`)return{context:e?[e]:[],blockReason:`Blocked by hook (decision: block)`};e&&s.push(e)}let c,l;if(r===`PreToolUse`&&typeof o==`object`&&o){let e=o;if(t(e.permissionDecision)){if(c=e.permissionDecision,c===`deny`)return{context:[],blockReason:`Blocked by hook (permissionDecision: deny)`,permissionDecision:c};e.updatedInput!==void 0&&(l=e.updatedInput)}}return typeof a.systemMessage==`string`&&a.systemMessage&&s.push(a.systemMessage),{context:s,...c!==void 0&&{permissionDecision:c},...l!==void 0&&{updatedInput:l}}}function i(e){let t=e.trim();if(!t.startsWith(`{`))return null;try{return JSON.parse(t)}catch{return null}}function a(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=e;if(n.continue===!1)return typeof n.stopReason==`string`&&n.stopReason?n.stopReason:`Blocked by hook (continue: false)`;if(t===`UserPromptSubmit`&&n.decision===`block`)return typeof n.reason==`string`&&n.reason?n.reason:`Blocked by hook (decision: block)`;if(t===`PreToolUse`){let e=n.hookSpecificOutput;if(typeof e==`object`&&e&&e.permissionDecision===`deny`)return`Blocked by hook (permissionDecision: deny)`}return null}function o(e){let t=e.replace(/\s+/g,` `).trim();return t.length>200?`${t.slice(0,200)}…`:t}function s(e,t,n){let r;try{r=JSON.parse(e)}catch(n){return{outcome:`error`,source:t,kind:`malformed-response`,reason:`Hook response is not valid JSON (${n instanceof Error?n.message:String(n)}): ${o(e)}`}}return c(r,t,n,e)}function c(e,t,n,r){if(typeof e!=`object`||!e||Array.isArray(e))return{outcome:`error`,source:t,kind:`malformed-response`,reason:`Hook response is not a JSON object: ${o(r)}`};let{ok:i,reason:s}=e;if(i===!0)return{outcome:`allow`,source:t,stdout:r};if(i===!1)return{outcome:`deny`,source:t,reason:typeof s==`string`&&s?s:`Blocked by ${t} hook`};let c=a(e,n);return c===null?{outcome:`error`,source:t,kind:`malformed-response`,reason:i===void 0?`Hook response has no boolean "ok" field: ${o(r)}`:`Hook response "ok" is ${typeof i}, not boolean: ${o(r)}`}:{outcome:`deny`,source:t,reason:c}}Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return r}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return s}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return e}});