@tangle-network/agent-eval 0.161.1 → 0.170.0

package/dist/{ledger-core-BOzlRygb.js.map → ledger-core-PIfjCbKn.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ledger-core-BOzlRygb.js","names":[],"sources":["../src/ledger-core/atomic-file-lock.ts","../src/concurrency.ts","../src/ledger-core/journal-file.ts","../src/ledger-core/trusted-head.ts","../src/ledger-core/journal.ts"],"sourcesContent":["/** Crash-safe filesystem lock shared by campaign persistence and run exclusion. */\n\nimport { randomUUID } from 'node:crypto'\nimport {\n  closeSync,\n  constants,\n  existsSync,\n  fsyncSync,\n  linkSync,\n  openSync,\n  readFileSync,\n  renameSync,\n  unlinkSync,\n  writeFileSync,\n} from 'node:fs'\nimport { hostname } from 'node:os'\n\nexport interface AtomicFileLockOwner {\n  readonly pid: number\n  readonly host: string\n  readonly nonce: string\n}\n\nexport interface AtomicFileLock {\n  readonly owner: AtomicFileLockOwner\n  release(): void\n}\n\nexport type AtomicFileLockUnavailable =\n  | { readonly acquired: false; readonly reason: 'held'; readonly holder: AtomicFileLockOwner }\n  | { readonly acquired: false; readonly reason: 'recovery' }\n\nexport type AtomicFileLockAcquisition =\n  | { readonly acquired: true; readonly lock: AtomicFileLock }\n  | AtomicFileLockUnavailable\n\nexport interface AtomicFileLockOptions {\n  readonly lockPath: string\n  readonly pid?: number\n}\n\nexport class AtomicFileLockError extends Error {\n  override readonly name = 'AtomicFileLockError'\n}\n\ntype OwnerState =\n  | { readonly state: 'missing' }\n  | { readonly state: 'stale'; readonly owner: AtomicFileLockOwner }\n  | { readonly state: 'held'; readonly owner: AtomicFileLockOwner }\n\n/** Report whether another lock path prevents acquisition without modifying it. */\nexport function probeAtomicFileLock(\n  options: AtomicFileLockOptions,\n): AtomicFileLockUnavailable | null {\n  if (existsSync(recoveryPath(options.lockPath))) return { acquired: false, reason: 'recovery' }\n  const state = ownerState(options.lockPath)\n  if (state.state === 'held') {\n    return { acquired: false, reason: 'held', holder: state.owner }\n  }\n  return null\n}\n\n/**\n * Try to acquire a complete, uniquely-owned lock inode.\n *\n * A hard link publishes fully-written owner metadata atomically. Stale-owner\n * removal is serialized so one reclaimer cannot delete a new owner's lock.\n */\nexport function tryAcquireAtomicFileLock(\n  options: AtomicFileLockOptions,\n): AtomicFileLockAcquisition {\n  const pid = options.pid ?? process.pid\n  if (!Number.isSafeInteger(pid) || pid <= 0) {\n    throw new AtomicFileLockError('atomic file lock pid must be a positive integer')\n  }\n  const owner: AtomicFileLockOwner = { pid, host: hostname(), nonce: randomUUID() }\n  for (let attempt = 0; attempt < 8; attempt += 1) {\n    if (existsSync(recoveryPath(options.lockPath))) {\n      const recovery = tryAcquireRecoveryLease(options.lockPath, owner, attempt)\n      if (!recovery) return { acquired: false, reason: 'recovery' }\n      try {\n        return recoverLock(options.lockPath, owner, attempt)\n      } finally {\n        recovery.release()\n      }\n    }\n    if (tryLinkOwner(options.lockPath, owner, `acquire.${attempt}`)) {\n      return acquired(options.lockPath, owner)\n    }\n\n    const holder = ownerState(options.lockPath)\n    if (holder.state === 'missing') continue\n    if (holder.state === 'held') {\n      return { acquired: false, reason: 'held', holder: holder.owner }\n    }\n\n    const recovery = tryAcquireRecoveryLease(options.lockPath, owner, attempt)\n    if (!recovery) return { acquired: false, reason: 'recovery' }\n    try {\n      return recoverLock(options.lockPath, owner, attempt)\n    } finally {\n      recovery.release()\n    }\n  }\n\n  throw new AtomicFileLockError(`could not acquire atomic file lock ${options.lockPath}`)\n}\n\ninterface RecoveryLease {\n  release(): void\n}\n\nfunction tryAcquireRecoveryLease(\n  lockPath: string,\n  owner: AtomicFileLockOwner,\n  attempt: number,\n): RecoveryLease | null {\n  let leasePath = recoveryPath(lockPath)\n  const staleOwners: Array<{ path: string; owner: AtomicFileLockOwner }> = []\n\n  for (let depth = 0; depth < 64; depth += 1) {\n    const state = ownerState(leasePath)\n    if (state.state === 'missing') {\n      if (!tryLinkOwner(leasePath, owner, `reclaim.${attempt}.${depth}`)) continue\n      return {\n        release: () => {\n          for (const stale of staleOwners) releaseOwnedPath(stale.path, stale.owner)\n          releaseOwnedPath(leasePath, owner)\n        },\n      }\n    }\n    if (state.state === 'held') return null\n    staleOwners.push({ path: leasePath, owner: state.owner })\n    leasePath = `${leasePath}.next.${state.owner.nonce}`\n  }\n\n  throw new AtomicFileLockError(`atomic file lock recovery chain is too deep (${lockPath})`)\n}\n\nfunction recoverLock(\n  lockPath: string,\n  owner: AtomicFileLockOwner,\n  attempt: number,\n): AtomicFileLockAcquisition {\n  const current = ownerState(lockPath)\n  if (current.state === 'held') {\n    return { acquired: false, reason: 'held', holder: current.owner }\n  }\n  if (current.state === 'stale') {\n    const tombstone = `${lockPath}.stale.${owner.nonce}.${attempt}`\n    try {\n      renameSync(lockPath, tombstone)\n      unlinkSync(tombstone)\n    } catch (error) {\n      if (!isMissing(error)) throw error\n    }\n  }\n  if (tryLinkOwner(lockPath, owner, `recovered.${attempt}`)) {\n    return acquired(lockPath, owner)\n  }\n  const holder = ownerState(lockPath)\n  if (holder.state === 'held') {\n    return { acquired: false, reason: 'held', holder: holder.owner }\n  }\n  return { acquired: false, reason: 'recovery' }\n}\n\nfunction acquired(lockPath: string, owner: AtomicFileLockOwner): AtomicFileLockAcquisition {\n  return {\n    acquired: true,\n    lock: {\n      owner,\n      release: () => releaseOwnedPath(lockPath, owner),\n    },\n  }\n}\n\nfunction tryLinkOwner(lockPath: string, owner: AtomicFileLockOwner, suffix: string): boolean {\n  const ownerPath = `${lockPath}.${owner.pid}.${owner.nonce}.${suffix}.owner`\n  const descriptor = openSync(\n    ownerPath,\n    constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY,\n    0o600,\n  )\n  try {\n    writeFileSync(descriptor, `${canonicalOwner(owner)}\\n`, 'utf8')\n    fsyncSync(descriptor)\n  } catch (error) {\n    closeSync(descriptor)\n    unlinkIfExists(ownerPath)\n    throw error\n  }\n  closeSync(descriptor)\n\n  try {\n    linkSync(ownerPath, lockPath)\n    return true\n  } catch (error) {\n    if (!isAlreadyExists(error)) throw error\n    return false\n  } finally {\n    unlinkIfExists(ownerPath)\n  }\n}\n\nfunction ownerState(lockPath: string): OwnerState {\n  const owner = readOwner(lockPath)\n  if (!owner) return { state: 'missing' }\n  if (owner.host !== hostname()) return { state: 'held', owner }\n  try {\n    process.kill(owner.pid, 0)\n    return { state: 'held', owner }\n  } catch (error) {\n    if (isNoSuchProcess(error)) return { state: 'stale', owner }\n    return { state: 'held', owner }\n  }\n}\n\nfunction readOwner(lockPath: string): AtomicFileLockOwner | undefined {\n  let contents: string\n  try {\n    contents = readFileSync(lockPath, 'utf8').trim()\n  } catch (error) {\n    if (isMissing(error)) return undefined\n    throw error\n  }\n\n  let value: unknown\n  try {\n    value = JSON.parse(contents)\n  } catch (error) {\n    throw invalidOwner(lockPath, error)\n  }\n  if (!isOwner(value)) throw invalidOwner(lockPath)\n  return value\n}\n\nfunction isOwner(value: unknown): value is AtomicFileLockOwner {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false\n  const record = value as Record<string, unknown>\n  return (\n    Object.keys(record).length === 3 &&\n    Number.isSafeInteger(record.pid) &&\n    Number(record.pid) > 0 &&\n    typeof record.host === 'string' &&\n    record.host.trim().length > 0 &&\n    typeof record.nonce === 'string' &&\n    record.nonce.trim().length > 0\n  )\n}\n\nfunction invalidOwner(lockPath: string, cause?: unknown): AtomicFileLockError {\n  const error = new AtomicFileLockError(\n    `atomic file lock has an invalid owner (${lockPath}); refusing unsafe recovery`,\n  )\n  if (cause !== undefined) Object.defineProperty(error, 'cause', { value: cause })\n  return error\n}\n\nfunction releaseOwnedPath(lockPath: string, owner: AtomicFileLockOwner): void {\n  const current = readOwner(lockPath)\n  if (!current) return\n  if (canonicalOwner(current) !== canonicalOwner(owner)) {\n    throw new AtomicFileLockError(`atomic file lock owner changed before release (${lockPath})`)\n  }\n  try {\n    unlinkSync(lockPath)\n  } catch (error) {\n    if (!isMissing(error)) throw error\n  }\n}\n\nfunction canonicalOwner(owner: AtomicFileLockOwner): string {\n  return JSON.stringify({ host: owner.host, nonce: owner.nonce, pid: owner.pid })\n}\n\nfunction recoveryPath(lockPath: string): string {\n  return `${lockPath}.reclaim`\n}\n\nfunction isAlreadyExists(error: unknown): boolean {\n  return error instanceof Error && 'code' in error && error.code === 'EEXIST'\n}\n\nfunction isMissing(error: unknown): boolean {\n  return error instanceof Error && 'code' in error && error.code === 'ENOENT'\n}\n\nfunction isNoSuchProcess(error: unknown): boolean {\n  return error instanceof Error && 'code' in error && error.code === 'ESRCH'\n}\n\nfunction unlinkIfExists(path: string): void {\n  try {\n    unlinkSync(path)\n  } catch (error) {\n    if (!isMissing(error)) throw error\n  }\n}\n","/**\n * concurrency — small primitives the evolution loop needs.\n *\n * `Mutex` is a zero-dep async lock with FIFO fairness. The evolution loop\n * uses it to serialise checkout/build/commit sequences inside a single\n * pool slot, and to gate concurrent JSONL writers (see\n * `lockedJsonlReferenceReplayStore`).\n *\n * Deliberately minimal — no priority queue, no timeouts. If you need\n * those, swap to `async-mutex` at the call site.\n */\n\nexport class Mutex {\n  private locked = false\n  private readonly waiters: Array<() => void> = []\n\n  async acquire(): Promise<() => void> {\n    if (!this.locked) {\n      this.locked = true\n      return () => this.release()\n    }\n    return new Promise<() => void>((resolve) => {\n      this.waiters.push(() => {\n        resolve(() => this.release())\n      })\n    })\n  }\n\n  private release(): void {\n    const next = this.waiters.shift()\n    if (next) {\n      next()\n    } else {\n      this.locked = false\n    }\n  }\n\n  async runExclusive<T>(fn: () => Promise<T> | T): Promise<T> {\n    const release = await this.acquire()\n    try {\n      return await fn()\n    } finally {\n      release()\n    }\n  }\n\n  /** True iff someone holds the lock right now. Diagnostics only. */\n  get isLocked(): boolean {\n    return this.locked\n  }\n\n  /** Pending waiter count. Diagnostics only. */\n  get pending(): number {\n    return this.waiters.length\n  }\n}\n\nexport interface MapConcurrentRangeOptions<R> {\n  count: number\n  maxConcurrency: number\n  label: string\n  signal?: AbortSignal\n  map(index: number, signal: AbortSignal): Promise<R>\n}\n\n/** Map an integer range with bounded work, cancellation, and first-error cleanup. */\nexport async function mapConcurrentRange<R>(options: MapConcurrentRangeOptions<R>): Promise<R[]> {\n  if (!Number.isSafeInteger(options.count) || options.count < 0) {\n    throw new Error(`${options.label} count must be a non-negative integer`)\n  }\n  if (!Number.isSafeInteger(options.maxConcurrency) || options.maxConcurrency < 1) {\n    throw new Error(`${options.label} maxConcurrency must be a positive integer`)\n  }\n\n  const controller = new AbortController()\n  const abortFromCaller = () => controller.abort(options.signal?.reason)\n  if (options.signal?.aborted) abortFromCaller()\n  else options.signal?.addEventListener('abort', abortFromCaller, { once: true })\n\n  const results = new Array<R>(options.count)\n  let nextIndex = 0\n  let failed = false\n  let firstFailure: unknown\n  const workers = Array.from(\n    { length: Math.min(options.maxConcurrency, options.count) },\n    async () => {\n      while (!controller.signal.aborted) {\n        const index = nextIndex\n        nextIndex += 1\n        if (index >= options.count) return\n        try {\n          results[index] = await options.map(index, controller.signal)\n        } catch (error) {\n          if (!failed) {\n            failed = true\n            firstFailure = error\n            controller.abort(error)\n          }\n          return\n        }\n      }\n    },\n  )\n\n  try {\n    await Promise.all(workers)\n    if (options.signal?.aborted) throw abortError(options.signal, options.label)\n    if (failed) throw firstFailure\n    if (controller.signal.aborted) throw abortError(controller.signal, options.label)\n    return results\n  } finally {\n    options.signal?.removeEventListener('abort', abortFromCaller)\n  }\n}\n\n/**\n * Map independent work with a fixed worker count while preserving input order.\n * After the first rejection, no new items start; already-running work is allowed\n * to settle before the returned promise rejects. Partial results are discarded.\n */\nexport async function mapConcurrent<T, R>(\n  items: readonly T[],\n  concurrency: number,\n  map: (item: T, index: number, signal: AbortSignal) => Promise<R>,\n  signal?: AbortSignal,\n): Promise<R[]> {\n  return mapConcurrentRange({\n    count: items.length,\n    maxConcurrency: concurrency,\n    label: 'mapConcurrent',\n    signal,\n    map(index, signal) {\n      return map(items[index]!, index, signal)\n    },\n  })\n}\n\nfunction abortError(signal: AbortSignal, label: string): Error {\n  return signal.reason instanceof Error ? signal.reason : new Error(`${label} aborted`)\n}\n","/** Filesystem durability and cross-process exclusion for append-only journal files. */\n\nimport {\n  closeSync,\n  constants,\n  fstatSync,\n  fsyncSync,\n  mkdirSync,\n  openSync,\n  readSync,\n  renameSync,\n  rmSync,\n  writeSync,\n} from 'node:fs'\nimport { dirname } from 'node:path'\nimport { AtomicFileLockError, tryAcquireAtomicFileLock } from './atomic-file-lock'\n\n/** How a journal binding reports file-layer faults in its own error taxonomy. */\nexport interface LedgerFileContext {\n  /** Noun used in error messages, e.g. 'search ledger'. */\n  subject: string\n  integrityError(message: string, options?: { cause?: unknown }): Error\n}\n\n/** Append one already-serialized line; the write is fsynced (file and directory)\n * before returning so an acknowledged append survives a crash. */\nexport function appendLedgerLine(path: string, line: string, context: LedgerFileContext): void {\n  mkdirSync(dirname(path), { recursive: true })\n  recoverTornFinalWrite(path, context)\n  const fd = openSync(path, constants.O_CREAT | constants.O_WRONLY | constants.O_APPEND, 0o600)\n  try {\n    writeAll(fd, Buffer.from(line, 'utf8'), context)\n    fsyncSync(fd)\n  } finally {\n    closeSync(fd)\n  }\n  fsyncDirectory(dirname(path))\n}\n\nfunction recoverTornFinalWrite(path: string, context: LedgerFileContext): void {\n  let fd: number\n  try {\n    fd = openSync(path, constants.O_RDWR)\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return\n    throw context.integrityError(`${context.subject} ${path} could not be opened for recovery`, {\n      cause: error,\n    })\n  }\n\n  try {\n    const size = fstatSync(fd).size\n    if (size === 0 || readByte(fd, size - 1) === 0x0a) return\n    const tailStart = findFinalLineStart(fd, size)\n    const replacement = Buffer.alloc(size - tailStart, 0x20)\n    replacement[replacement.length - 1] = 0x0a\n    writeAllAt(fd, replacement, tailStart, context)\n    fsyncSync(fd)\n  } catch (error) {\n    throw context.integrityError(\n      `${context.subject} ${path} has an unrecoverable final journal write`,\n      { cause: error },\n    )\n  } finally {\n    closeSync(fd)\n  }\n}\n\n/** Replace a small sidecar file whole: write a temporary sibling, fsync it,\n * then rename over the target. A reader therefore sees the previous contents\n * or the new ones, never a partial file. */\nexport function writeLedgerFileAtomically(\n  path: string,\n  contents: string,\n  context: LedgerFileContext,\n): void {\n  const directory = dirname(path)\n  mkdirSync(directory, { recursive: true })\n  const temporaryPath = `${path}.tmp`\n  const fd = openSync(\n    temporaryPath,\n    constants.O_CREAT | constants.O_WRONLY | constants.O_TRUNC,\n    0o600,\n  )\n  try {\n    writeAll(fd, Buffer.from(contents, 'utf8'), context)\n    fsyncSync(fd)\n  } finally {\n    closeSync(fd)\n  }\n  renameSync(temporaryPath, path)\n  fsyncDirectory(directory)\n}\n\n/** Remove whatever occupies a sidecar path and fsync its directory, so the\n * removal is as durable as the write that created it. False when the path was\n * already empty. Recursive because a sidecar path holding a directory is one of\n * the states this has to be able to clear, not one it can refuse. */\nexport function removeLedgerFile(path: string, context: LedgerFileContext): boolean {\n  try {\n    rmSync(path, { recursive: true })\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false\n    throw context.integrityError(`${context.subject} ${path} could not be removed`, {\n      cause: error,\n    })\n  }\n  fsyncDirectory(dirname(path))\n  return true\n}\n\nexport function withLedgerFileLock<T>(path: string, context: LedgerFileContext, run: () => T): T {\n  const result = tryWithLedgerFileLock(path, context, run)\n  if (!result.acquired) {\n    throw context.integrityError(`${context.subject} lock is held (${path})`)\n  }\n  return result.value\n}\n\nexport type FileLockResult<T> = { acquired: true; value: T } | { acquired: false }\n\nexport function tryWithLedgerFileLock<T>(\n  path: string,\n  context: LedgerFileContext,\n  run: () => T,\n): FileLockResult<T> {\n  mkdirSync(dirname(path), { recursive: true })\n  const lockPath = `${path}.lock`\n  try {\n    const acquisition = tryAcquireAtomicFileLock({ lockPath })\n    if (!acquisition.acquired) return { acquired: false }\n    try {\n      return { acquired: true, value: run() }\n    } finally {\n      acquisition.lock.release()\n    }\n  } catch (error) {\n    if (error instanceof AtomicFileLockError) {\n      throw context.integrityError(error.message, { cause: error })\n    }\n    throw error\n  }\n}\n\nfunction writeAll(fd: number, bytes: Buffer, context: LedgerFileContext): void {\n  let offset = 0\n  while (offset < bytes.byteLength) {\n    const written = writeSync(fd, bytes, offset, bytes.byteLength - offset)\n    if (written <= 0) throw context.integrityError('filesystem wrote zero bytes')\n    offset += written\n  }\n}\n\nfunction writeAllAt(fd: number, bytes: Buffer, position: number, context: LedgerFileContext): void {\n  let offset = 0\n  while (offset < bytes.byteLength) {\n    const written = writeSync(fd, bytes, offset, bytes.byteLength - offset, position + offset)\n    if (written <= 0) throw context.integrityError('filesystem wrote zero bytes')\n    offset += written\n  }\n}\n\nfunction findFinalLineStart(fd: number, size: number): number {\n  const chunk = Buffer.alloc(Math.min(4_096, size))\n  let cursor = size\n  while (cursor > 0) {\n    const length = Math.min(chunk.byteLength, cursor)\n    cursor -= length\n    const read = readSync(fd, chunk, 0, length, cursor)\n    for (let index = read - 1; index >= 0; index -= 1) {\n      if (chunk[index] === 0x0a) return cursor + index + 1\n    }\n  }\n  return 0\n}\n\nfunction readByte(fd: number, position: number): number {\n  const byte = Buffer.allocUnsafe(1)\n  const read = readSync(fd, byte, 0, 1, position)\n  return read === 1 ? byte[0]! : -1\n}\n\nfunction fsyncDirectory(path: string): void {\n  const fd = openSync(path, constants.O_RDONLY)\n  try {\n    fsyncSync(fd)\n  } finally {\n    closeSync(fd)\n  }\n}\n","/**\n * Trusted head — the pin that makes deletion detectable.\n *\n * ## What the chain binds\n *\n * Every entry hashes the journal header, its sequence, the previous entry's\n * hash, and its event, so editing, reordering, or removing an entry in the\n * middle of a journal invalidates every hash after it. What a hash chain\n * cannot bind is its own length. Dropping entries off the END leaves a shorter\n * journal that is internally perfect, and rebuilding a journal from sequence 0\n * with recomputed hashes produces a different, equally perfect chain. For an\n * audit log of candidate registrations and promotion decisions that is the\n * difference between a record of a search that happened and a record of one\n * that did not.\n *\n * ## What the pin binds\n *\n * `<journal>.head` holds `{sequence, entryHash}` for one entry a writer\n * actually appended, in a file separate from the journal it attests. Each\n * entry hash commits to the entire prefix before it, so checking that the\n * entry at exactly `sequence` still carries `entryHash` proves two things at\n * once: the journal is at least `sequence + 1` entries long, and those entries\n * are byte-for-byte the ones the writer saw. A journal that merely grew past\n * the pin still verifies; a truncated, rolled-back, or wholesale-rewritten one\n * cannot.\n *\n * ## What the pin does NOT defend against\n *\n * The pin is a second file, not a signature. A writer with access to BOTH the\n * journal and its pin can rewrite both consistently, and the result verifies.\n * Pinning raises the cost of undetected tampering from one file to two and\n * nothing more; defending against a writer who holds both requires an anchor\n * outside this store entirely — a signed head, or a digest published to an\n * append-only service the tamperer does not control.\n *\n * Deleting the pin file downgrades a pinned journal to an unpinned one, which\n * cannot be distinguished from a journal written before pinning existed. That\n * is what `requireTrustedHead` is for: a journal opened under it refuses to\n * read at all once a non-empty journal has no pin.\n *\n * ## Abandoning a pin\n *\n * A pin outlives the journal it attests: deleting or rebuilding the journal\n * leaves a pin naming history the file no longer carries, and every read is\n * refused because that is precisely the deletion the pin exists to catch. The\n * refusal names the pin file, and `clearTrustedHeadFile` is the explicit way to\n * discard it — the same downgrade a writer with filesystem access could already\n * perform with `rm`, made reachable through the API so it is a decision in the\n * code rather than an undocumented manual step. It returns the guarantee it\n * gave up and writes no record of its own; a caller that needs the discard on\n * the record has to write one.\n */\n\nimport { readFileSync } from 'node:fs'\nimport { canonicalString, LEDGER_HASH_PATTERN, type LedgerHash } from './canonical'\nimport { type LedgerFileContext, removeLedgerFile, writeLedgerFileAtomically } from './journal-file'\n\n/** A `(sequence, entryHash)` pair a writer pinned outside the journal. */\nexport interface LedgerTrustedHead {\n  sequence: number\n  entryHash: LedgerHash\n}\n\n/** Minimum entry shape the anchor check needs. */\nexport interface LedgerAnchoredEntry {\n  sequence: number\n  entryHash: LedgerHash\n}\n\n/** Sibling pin file for a journal — deliberately NOT the journal, so rewriting\n * the log is not enough to rewrite the trust recorded about it. */\nexport function trustedHeadPathFor(journalPath: string): string {\n  return `${journalPath}.head`\n}\n\nconst TRUSTED_HEAD_RECOVERY =\n  ' Restore the file, or discard the pin it held with clearTrustedHead().'\n\n/** The pin, or null when this journal has never been pinned. A pin that exists\n * but does not parse is corruption or tamper of the trust record itself and\n * fails loudly: reporting it as \"no pin\" would silently downgrade what the\n * journal can prove. */\nexport function readTrustedHeadFile(\n  path: string,\n  context: LedgerFileContext,\n): LedgerTrustedHead | null {\n  let text: string\n  try {\n    text = readFileSync(path, 'utf8')\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null\n    throw context.integrityError(\n      `${context.subject} trusted head ${path} could not be read.${TRUSTED_HEAD_RECOVERY}`,\n      { cause: error },\n    )\n  }\n  let raw: unknown\n  try {\n    raw = JSON.parse(text)\n  } catch (error) {\n    throw context.integrityError(\n      `${context.subject} trusted head ${path} is not valid JSON.${TRUSTED_HEAD_RECOVERY}`,\n      { cause: error },\n    )\n  }\n  if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {\n    throw context.integrityError(\n      `${context.subject} trusted head ${path} is not an object.${TRUSTED_HEAD_RECOVERY}`,\n    )\n  }\n  const record = raw as Record<string, unknown>\n  const keys = Object.keys(record).sort()\n  if (keys.length !== 2 || keys[0] !== 'entryHash' || keys[1] !== 'sequence') {\n    throw context.integrityError(\n      `${context.subject} trusted head ${path} has keys [${keys.join(', ')}], expected [entryHash, sequence].${TRUSTED_HEAD_RECOVERY}`,\n    )\n  }\n  const { sequence, entryHash } = record\n  if (typeof sequence !== 'number' || !Number.isSafeInteger(sequence) || sequence < 0) {\n    throw context.integrityError(\n      `${context.subject} trusted head ${path} sequence is not a non-negative integer.${TRUSTED_HEAD_RECOVERY}`,\n    )\n  }\n  if (typeof entryHash !== 'string' || !LEDGER_HASH_PATTERN.test(entryHash)) {\n    throw context.integrityError(\n      `${context.subject} trusted head ${path} entryHash is not a sha256 digest.${TRUSTED_HEAD_RECOVERY}`,\n    )\n  }\n  return { sequence, entryHash: entryHash as LedgerHash }\n}\n\n/** Publish a pin by write-then-rename, so a crash leaves either the previous\n * pin or the new one and never a torn file that would lock a journal out of\n * its own trust record.\n *\n * Not re-exported from the package's public surface. It takes no lock, checks no\n * chain, and enforces no monotonicity, so a public form would be the one call\n * able to move a pin BACKWARD onto a journal it never read — which is the\n * truncation the pin exists to refuse. `FileLedgerJournal.pinTrustedHead` is\n * the public writer: locked, chain-verified, forward-only. */\nexport function writeTrustedHeadFile(\n  path: string,\n  head: LedgerTrustedHead,\n  context: LedgerFileContext,\n): void {\n  try {\n    writeLedgerFileAtomically(path, `${canonicalString(head)}\\n`, context)\n  } catch (error) {\n    throw context.integrityError(`${context.subject} trusted head ${path} could not be written`, {\n      cause: error,\n    })\n  }\n}\n\n/** Outcome of discarding a pin: the guarantee that was given up. `unreadable`\n * carries why the discarded pin could not be named — corruption, a permission\n * fault, a wrong file type — so a caller recording the decision never has to\n * treat \"no pin was there\" and \"the pin could not be read\" as one state.\n * `cleanupError` reports a stale atomic-write sibling that remains after the\n * actual pin was cleared. */\nexport type LedgerTrustedHeadRemoval =\n  | { removed: true; head: LedgerTrustedHead; cleanupError?: string }\n  | { removed: true; head: null; unreadable: string; cleanupError?: string }\n  | { removed: false; cleanupError?: string }\n\n/** Discard a journal's pin, reporting what was discarded. The journal file is\n * untouched and reads as unpinned afterwards, so the next pinning append opens\n * a new pin at the entry it writes. This gives up the deletion guarantee for\n * every entry the pin covered; it is the recovery for a pin whose journal was\n * deliberately deleted or rebuilt, and the only way past a pin file that can no\n * longer be read at all. */\nexport function clearTrustedHeadFile(\n  path: string,\n  context: LedgerFileContext,\n): LedgerTrustedHeadRemoval {\n  let head: LedgerTrustedHead | null = null\n  let unreadable = ''\n  try {\n    head = readTrustedHeadFile(path, context)\n  } catch (error) {\n    // A pin nobody can read is precisely what clearing has to get past, so the\n    // fault is reported on a removal that still happens rather than raised —\n    // but it is reported, never flattened into \"there was no pin\".\n    unreadable = error instanceof Error ? error.message : String(error)\n  }\n  const removed = removeLedgerFile(path, context)\n  let cleanupError: string | undefined\n  try {\n    // Cleanup cannot block the requested trust-state change. Report a stale\n    // atomic-write sibling so the caller can repair it before the next write.\n    removeLedgerFile(`${path}.tmp`, context)\n  } catch (error) {\n    cleanupError = error instanceof Error ? error.message : String(error)\n  }\n  const cleanup = cleanupError === undefined ? {} : { cleanupError }\n  if (!removed) return { removed: false, ...cleanup }\n  if (head === null) return { removed: true, head: null, unreadable, ...cleanup }\n  return { removed: true, head, ...cleanup }\n}\n\n/** How a journal is named when a trusted-head check refuses it. */\nexport interface LedgerTrustedHeadSubject {\n  /** The journal in error messages, e.g. `search ledger /runs/a/ledger.jsonl`. */\n  subject: string\n  /** The sibling pin file, named in every refusal so the operator can see which\n   * of the two files carries the claim being enforced. */\n  trustedHeadPath: string\n}\n\n/** The entry at exactly `head.sequence` must still carry `head.entryHash`.\n * Entries must already have passed chain verification, which is what makes\n * index and sequence interchangeable here. */\nexport function verifyEntriesAgainstTrustedHead(\n  entries: readonly LedgerAnchoredEntry[],\n  head: LedgerTrustedHead,\n  context: LedgerFileContext,\n  naming: LedgerTrustedHeadSubject,\n): void {\n  // A caller passing the bare subject string an untyped build would accept\n  // destructures into two undefineds, which would corrupt the text of a\n  // security refusal rather than fail. Refuse instead.\n  if (typeof naming !== 'object' || naming === null) {\n    throw new TypeError(\n      'verifyEntriesAgainstTrustedHead expects { subject, trustedHeadPath } as its fourth argument',\n    )\n  }\n  const { subject, trustedHeadPath } = naming\n  const pinned = entries[head.sequence]\n  if (pinned === undefined) {\n    throw context.integrityError(\n      `${subject} trusted head ${trustedHeadPath} pins sequence ${head.sequence} (${head.entryHash}) but the journal has ${entries.length} entries — pinned history is missing (truncation, rollback, or rewrite). Restore the journal, or abandon the pinned history on purpose with clearTrustedHead().`,\n    )\n  }\n  if (pinned.sequence !== head.sequence) {\n    throw context.integrityError(\n      `${subject} entry at index ${head.sequence} carries sequence ${pinned.sequence}; the chain was not verified before the trusted head ${trustedHeadPath}`,\n    )\n  }\n  if (pinned.entryHash !== head.entryHash) {\n    throw context.integrityError(\n      `${subject} entry at pinned sequence ${head.sequence} carries ${pinned.entryHash} but the trusted head ${trustedHeadPath} recorded ${head.entryHash} — the journal was rewritten. Restore the journal, or abandon the pinned history on purpose with clearTrustedHead().`,\n    )\n  }\n}\n","/**\n * Generic durable append-only journal with a SHA-256 hash chain.\n *\n * The file format is canonical JSONL: every row is the canonical JSON encoding\n * (RFC 8785, object keys sorted recursively) of one entry, and every entry\n * hashes the previous entry's hash so the log is tamper-evident. Appends are\n * serialized in-process per path and across processes via a lock file, fsynced\n * before acknowledgement, and idempotent by `eventId`. A malformed,\n * non-canonical, truncated, reordered, or conflicting log fails loudly; a bad\n * row is never skipped.\n *\n * A hash chain binds each entry to its predecessor, which cannot prove that no\n * entry was removed from the end: a valid shorter prefix is still a valid\n * chain. `pinHead` records the appended entry in a sibling `<journal>.head`\n * file and every read re-verifies the journal against a pin that is present,\n * so truncation and wholesale rewrite are refused. `trusted-head.ts` carries\n * the full threat model, including what a pin does not defend against.\n *\n * Domain vocabulary lives entirely in the consumer's codec: entry schema\n * validation, the constant header fields stamped into every entry, the error\n * taxonomy, and the state machine replayed over verified entries.\n */\n\nimport { existsSync, readFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\nimport { Mutex } from '../concurrency'\nimport { canonicalString, hashCanonical, type LedgerHash } from './canonical'\nimport { appendLedgerLine, type LedgerFileContext, withLedgerFileLock } from './journal-file'\nimport {\n  clearTrustedHeadFile,\n  type LedgerTrustedHead,\n  type LedgerTrustedHeadRemoval,\n  readTrustedHeadFile,\n  trustedHeadPathFor,\n  verifyEntriesAgainstTrustedHead,\n  writeTrustedHeadFile,\n} from './trusted-head'\n\n/** Minimum shape of a journal event: the idempotency key. */\nexport interface LedgerEventBase {\n  eventId: string\n}\n\n/** Chain envelope every entry carries in addition to the journal's constant\n * header fields. `entryHash` covers the header, sequence, previous hash, and\n * event, so any rewrite of history invalidates every later entry. */\nexport interface LedgerChainFields<Event extends LedgerEventBase> {\n  sequence: number\n  previousHash: LedgerHash | null\n  event: Event\n  entryHash: LedgerHash\n}\n\nexport type LedgerEntryOf<Header extends object, Event extends LedgerEventBase> = Header &\n  LedgerChainFields<Event>\n\nexport interface LedgerLineContext {\n  path: string\n  line: number\n}\n\n/** Domain state machine replayed over chain-verified entries in order.\n * `apply` throws (via the codec's error taxonomy) on an invalid transition;\n * `finish` builds the consumer's projection once every entry was applied. */\nexport interface LedgerProjector<Entry, Projection> {\n  apply(entry: Entry, index: number): void\n  finish(entries: Entry[]): Projection\n}\n\nexport interface LedgerJournalCodec<\n  Header extends object,\n  Event extends LedgerEventBase,\n  Projection,\n> extends LedgerFileContext {\n  /** Constant fields stamped into every entry and covered by its hash. */\n  header: Header\n  conflictError(message: string): Error\n  /** Validate one parsed JSON row into a typed entry. Must reject malformed\n   * rows and non-canonical event encodings with the binding's own errors;\n   * the journal itself verifies the stored bytes and the hash chain. */\n  parseEntry(raw: unknown, context: LedgerLineContext): LedgerEntryOf<Header, Event>\n  /** Reject an entry whose constant header fields do not match this journal. */\n  checkEntryHeader(entry: LedgerEntryOf<Header, Event>, index: number): void\n  createProjector(): LedgerProjector<LedgerEntryOf<Header, Event>, Projection>\n}\n\nexport interface LedgerReplayResult<Entry, Projection> {\n  entries: Entry[]\n  projection: Projection\n}\n\nexport interface LedgerAppendResult<Entry, Projection> {\n  entry: Entry\n  /** False when the exact event was already durably present. */\n  appended: boolean\n  projection: Projection\n}\n\nexport interface LedgerAppendOptions {\n  /** Record the appended entry as this journal's trusted head, so a later read\n   * can prove nothing was deleted from the end.\n   *\n   * On the idempotent path — the event is already durable — the pin moves up to\n   * that entry only when the entry is ahead of it, along a chain this call has\n   * just verified. So a pin write that failed after its row was fsynced is\n   * repaired by the retry that idempotency already asks the caller for, and the\n   * pin still only ever moves forward over history it has checked.\n   *\n   * A strict journal whose first pin write failed still refuses the retry\n   * because it cannot distinguish that failure from a deleted pin. Recover it\n   * explicitly with `pinTrustedHead()`; silently adopting the current file\n   * would defeat `requireTrustedHead`. */\n  pinHead?: boolean\n}\n\nexport interface FileLedgerJournalOptions {\n  /** Refuse to read a non-empty journal that has no trusted head.\n   *\n   * Off by default because journals written before pinning have no pin and\n   * must keep opening. Turn it on for a journal this process pins: without it,\n   * deleting the sibling pin file silently downgrades the journal back to a\n   * chain that cannot detect deletion. */\n  requireTrustedHead?: boolean\n}\n\n// One async mutex per resolved journal path so concurrent appends from a single\n// process queue up instead of failing on the held cross-process lock file.\nconst journalMutexes = new Map<string, Mutex>()\n\nfunction mutexFor(path: string): Mutex {\n  const existing = journalMutexes.get(path)\n  if (existing) return existing\n  const mutex = new Mutex()\n  journalMutexes.set(path, mutex)\n  return mutex\n}\n\n/** Durable filesystem journal. Construction performs no I/O; `append` and\n * `replay` validate the complete existing file under the locks. */\nexport class FileLedgerJournal<Header extends object, Event extends LedgerEventBase, Projection> {\n  readonly path: string\n  /** Sibling file holding this journal's trusted head. */\n  readonly trustedHeadPath: string\n  private readonly codec: LedgerJournalCodec<Header, Event, Projection>\n  private readonly mutex: Mutex\n  private readonly requireTrustedHead: boolean\n\n  constructor(\n    path: string,\n    codec: LedgerJournalCodec<Header, Event, Projection>,\n    options: FileLedgerJournalOptions = {},\n  ) {\n    this.path = resolve(path)\n    this.trustedHeadPath = trustedHeadPathFor(this.path)\n    this.codec = codec\n    this.mutex = mutexFor(this.path)\n    this.requireTrustedHead = options.requireTrustedHead === true\n  }\n\n  async replay(): Promise<LedgerReplayResult<LedgerEntryOf<Header, Event>, Projection>> {\n    return this.mutex.runExclusive(() =>\n      withLedgerFileLock(this.path, this.codec, () => this.replayLocked()),\n    )\n  }\n\n  async append(\n    event: Event,\n    options: LedgerAppendOptions = {},\n  ): Promise<LedgerAppendResult<LedgerEntryOf<Header, Event>, Projection>> {\n    return this.mutex.runExclusive(() =>\n      withLedgerFileLock(this.path, this.codec, () => {\n        const before = this.replayLocked()\n        const existing = before.entries.find((entry) => entry.event.eventId === event.eventId)\n        if (existing) {\n          if (canonicalString(existing.event) !== canonicalString(event)) {\n            throw this.codec.conflictError(\n              `eventId ${event.eventId} already exists with different content`,\n            )\n          }\n          if (options.pinHead === true) this.pinAcknowledged(existing, before.entries)\n          return { entry: existing, appended: false, projection: before.projection }\n        }\n\n        const material = {\n          ...this.codec.header,\n          sequence: before.entries.length,\n          previousHash: before.entries.at(-1)?.entryHash ?? null,\n          event,\n        }\n        const entry = { ...material, entryHash: hashCanonical(material) }\n\n        // Apply the state transition before spending an append: an entry the\n        // projector rejects must never reach the durable file.\n        const projection = this.project([...before.entries, entry])\n        appendLedgerLine(this.path, `${canonicalString(entry)}\\n`, this.codec)\n        if (options.pinHead === true) {\n          // Journal first, pin second: a crash or a failed pin write between\n          // them leaves the pin one entry behind, which still verifies and is\n          // repaired by the next pinning append, including the idempotent\n          // retry of this same event. The reverse order would leave a pin\n          // naming an entry the journal does not carry, locking the journal\n          // out of its own history.\n          writeTrustedHeadFile(\n            this.trustedHeadPath,\n            { sequence: entry.sequence, entryHash: entry.entryHash },\n            this.codec,\n          )\n        }\n        return { entry, appended: true, projection }\n      }),\n    )\n  }\n\n  /** The pinned head, or null when this journal has never been pinned. */\n  async trustedHead(): Promise<LedgerTrustedHead | null> {\n    return this.mutex.runExclusive(() =>\n      withLedgerFileLock(this.path, this.codec, () =>\n        readTrustedHeadFile(this.trustedHeadPath, this.codec),\n      ),\n    )\n  }\n\n  /** Pin the current verified head. The chain and any existing pin are checked\n   * first, so the pin only ever moves forward along a journal that still\n   * carries the history it already recorded. */\n  async pinTrustedHead(): Promise<LedgerTrustedHead> {\n    return this.mutex.runExclusive(() =>\n      withLedgerFileLock(this.path, this.codec, () => {\n        const entries = this.readEntries()\n        this.project(entries)\n        // `requireTrustedHead` is deliberately not applied here: pinning is how\n        // a journal that lacks a pin acquires one.\n        this.verifyTrustedHead(entries, false)\n        const last = entries.at(-1)\n        if (last === undefined) {\n          throw this.codec.integrityError(\n            `${this.codec.subject} ${this.path} is empty; there is no head to pin`,\n          )\n        }\n        const head: LedgerTrustedHead = { sequence: last.sequence, entryHash: last.entryHash }\n        writeTrustedHeadFile(this.trustedHeadPath, head, this.codec)\n        return head\n      }),\n    )\n  }\n\n  /** Discard this journal's pin, reporting what was discarded. The journal file\n   * is untouched and reads as unpinned afterwards, so the next pinning append\n   * opens a new pin at the entry it writes. It is the way out of a pin whose\n   * journal was deliberately deleted or rebuilt — every read of such a path is\n   * refused, correctly, because a pin naming history the file no longer carries\n   * is indistinguishable from a deletion. Clearing removes the deletion\n   * guarantee for every entry the pin covered. */\n  async clearTrustedHead(): Promise<LedgerTrustedHeadRemoval> {\n    return this.mutex.runExclusive(() =>\n      withLedgerFileLock(this.path, this.codec, () =>\n        clearTrustedHeadFile(this.trustedHeadPath, this.codec),\n      ),\n    )\n  }\n\n  /** Move the pin up to an entry this caller just acknowledged on the\n   * idempotent path, when a pin write that failed after its row was already\n   * fsynced left the pin behind. The move is safe because it is forward-only\n   * along a chain `replayLocked` has just verified: every entry up to this one\n   * is bound to it by hash, so the pin can only ever come to name more history\n   * than it did, never different history.\n   *\n   * With no pin at all this only pins the journal's current head. An entry in\n   * the middle would publish a pin that reads as protection while leaving every\n   * later entry silently truncatable, which is a worse state to hand an auditor\n   * than the honest absence of a pin; `pinTrustedHead()` is the way to pin an\n   * unpinned journal on purpose. */\n  private pinAcknowledged(\n    entry: LedgerEntryOf<Header, Event>,\n    entries: LedgerEntryOf<Header, Event>[],\n  ): void {\n    const pinned = readTrustedHeadFile(this.trustedHeadPath, this.codec)\n    if (pinned === null) {\n      if (entry.sequence !== entries.length - 1) return\n    } else if (pinned.sequence >= entry.sequence) {\n      return\n    }\n    writeTrustedHeadFile(\n      this.trustedHeadPath,\n      { sequence: entry.sequence, entryHash: entry.entryHash },\n      this.codec,\n    )\n  }\n\n  private replayLocked(): LedgerReplayResult<LedgerEntryOf<Header, Event>, Projection> {\n    const entries = this.readEntries()\n    const projection = this.project(entries)\n    // The anchor is meaningful only over a chain that already verified, so it\n    // is checked last — and on every read path, so a violated pin is refused\n    // before an append can extend the journal over it.\n    this.verifyTrustedHead(entries, this.requireTrustedHead)\n    return { entries, projection }\n  }\n\n  private verifyTrustedHead(entries: LedgerEntryOf<Header, Event>[], requirePin: boolean): void {\n    const pinned = readTrustedHeadFile(this.trustedHeadPath, this.codec)\n    if (pinned === null) {\n      if (requirePin && entries.length > 0) {\n        throw this.codec.integrityError(\n          `${this.codec.subject} ${this.path} has ${entries.length} entries but no trusted head at ${this.trustedHeadPath} — without its pin the journal cannot prove nothing was deleted. Restore the pin file, or adopt the current head with pinTrustedHead().`,\n        )\n      }\n      return\n    }\n    verifyEntriesAgainstTrustedHead(entries, pinned, this.codec, {\n      subject: `${this.codec.subject} ${this.path}`,\n      trustedHeadPath: this.trustedHeadPath,\n    })\n  }\n\n  private readEntries(): LedgerEntryOf<Header, Event>[] {\n    if (!existsSync(this.path)) return []\n    const text = readFileSync(this.path, 'utf8')\n    if (text.length === 0) return []\n    if (!text.endsWith('\\n')) {\n      throw this.codec.integrityError(\n        `${this.codec.subject} ${this.path} has a truncated final record (missing newline)`,\n      )\n    }\n\n    const lines = text.slice(0, -1).split('\\n')\n    const entries: LedgerEntryOf<Header, Event>[] = []\n    for (let index = 0; index < lines.length; index += 1) {\n      const line = lines[index]!\n      if (line.length === 0) {\n        throw this.codec.integrityError(\n          `${this.codec.subject} ${this.path} has a blank row at line ${index + 1}`,\n        )\n      }\n      let raw: unknown\n      try {\n        raw = JSON.parse(line)\n      } catch (error) {\n        throw this.codec.integrityError(\n          `${this.codec.subject} ${this.path} has invalid JSON at line ${index + 1}`,\n          { cause: error },\n        )\n      }\n      const entry = this.codec.parseEntry(raw, { path: this.path, line: index + 1 })\n      let canonical: string\n      try {\n        canonical = canonicalString(entry)\n      } catch (error) {\n        throw this.codec.integrityError(\n          `${this.codec.subject} ${this.path} has a row with no canonical JSON form at line ${index + 1}`,\n          { cause: error },\n        )\n      }\n      if (line !== canonical) {\n        throw this.codec.integrityError(\n          `${this.codec.subject} ${this.path} has non-canonical bytes at line ${index + 1}`,\n        )\n      }\n      entries.push(entry)\n    }\n    return entries\n  }\n\n  private project(entries: LedgerEntryOf<Header, Event>[]): Projection {\n    const projector = this.codec.createProjector()\n    const eventIds = new Set<string>()\n    let expectedPrevious: LedgerHash | null = null\n    for (let index = 0; index < entries.length; index += 1) {\n      const entry = entries[index]!\n      this.codec.checkEntryHeader(entry, index)\n      if (entry.sequence !== index) {\n        throw this.codec.integrityError(\n          `entry ${entry.event.eventId} has sequence ${entry.sequence}, expected ${index}`,\n        )\n      }\n      if (entry.previousHash !== expectedPrevious) {\n        throw this.codec.integrityError(\n          `entry ${entry.event.eventId} does not extend the previous hash`,\n        )\n      }\n      const { entryHash: _entryHash, ...material } = entry\n      const expectedHash = hashCanonical(material)\n      if (entry.entryHash !== expectedHash) {\n        throw this.codec.integrityError(\n          `entry ${entry.event.eventId} hash mismatch: expected ${expectedHash}, got ${entry.entryHash}`,\n        )\n      }\n      expectedPrevious = entry.entryHash\n      if (eventIds.has(entry.event.eventId)) {\n        throw this.codec.integrityError(\n          `duplicate eventId ${entry.event.eventId} in durable ledger`,\n        )\n      }\n      eventIds.add(entry.event.eventId)\n      projector.apply(entry, index)\n    }\n    return projector.finish(entries)\n  }\n}\n"],"mappings":";;;;;;;AAyCA,IAAa,sBAAb,cAAyC,MAAM;CAC7C,OAAyB;AAC3B;;AAQA,SAAgB,oBACd,SACkC;CAClC,IAAI,WAAW,aAAa,QAAQ,QAAQ,CAAC,GAAG,OAAO;EAAE,UAAU;EAAO,QAAQ;CAAW;CAC7F,MAAM,QAAQ,WAAW,QAAQ,QAAQ;CACzC,IAAI,MAAM,UAAU,QAClB,OAAO;EAAE,UAAU;EAAO,QAAQ;EAAQ,QAAQ,MAAM;CAAM;CAEhE,OAAO;AACT;;;;;;;AAQA,SAAgB,yBACd,SAC2B;CAC3B,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,IAAI,CAAC,OAAO,cAAc,GAAG,KAAK,OAAO,GACvC,MAAM,IAAI,oBAAoB,iDAAiD;CAEjF,MAAM,QAA6B;EAAE;EAAK,MAAM,SAAS;EAAG,OAAO,WAAW;CAAE;CAChF,KAAK,IAAI,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;EAC/C,IAAI,WAAW,aAAa,QAAQ,QAAQ,CAAC,GAAG;GAC9C,MAAM,WAAW,wBAAwB,QAAQ,UAAU,OAAO,OAAO;GACzE,IAAI,CAAC,UAAU,OAAO;IAAE,UAAU;IAAO,QAAQ;GAAW;GAC5D,IAAI;IACF,OAAO,YAAY,QAAQ,UAAU,OAAO,OAAO;GACrD,UAAU;IACR,SAAS,QAAQ;GACnB;EACF;EACA,IAAI,aAAa,QAAQ,UAAU,OAAO,WAAW,SAAS,GAC5D,OAAO,SAAS,QAAQ,UAAU,KAAK;EAGzC,MAAM,SAAS,WAAW,QAAQ,QAAQ;EAC1C,IAAI,OAAO,UAAU,WAAW;EAChC,IAAI,OAAO,UAAU,QACnB,OAAO;GAAE,UAAU;GAAO,QAAQ;GAAQ,QAAQ,OAAO;EAAM;EAGjE,MAAM,WAAW,wBAAwB,QAAQ,UAAU,OAAO,OAAO;EACzE,IAAI,CAAC,UAAU,OAAO;GAAE,UAAU;GAAO,QAAQ;EAAW;EAC5D,IAAI;GACF,OAAO,YAAY,QAAQ,UAAU,OAAO,OAAO;EACrD,UAAU;GACR,SAAS,QAAQ;EACnB;CACF;CAEA,MAAM,IAAI,oBAAoB,sCAAsC,QAAQ,UAAU;AACxF;AAMA,SAAS,wBACP,UACA,OACA,SACsB;CACtB,IAAI,YAAY,aAAa,QAAQ;CACrC,MAAM,cAAmE,CAAC;CAE1E,KAAK,IAAI,QAAQ,GAAG,QAAQ,IAAI,SAAS,GAAG;EAC1C,MAAM,QAAQ,WAAW,SAAS;EAClC,IAAI,MAAM,UAAU,WAAW;GAC7B,IAAI,CAAC,aAAa,WAAW,OAAO,WAAW,QAAQ,GAAG,OAAO,GAAG;GACpE,OAAO,EACL,eAAe;IACb,KAAK,MAAM,SAAS,aAAa,iBAAiB,MAAM,MAAM,MAAM,KAAK;IACzE,iBAAiB,WAAW,KAAK;GACnC,EACF;EACF;EACA,IAAI,MAAM,UAAU,QAAQ,OAAO;EACnC,YAAY,KAAK;GAAE,MAAM;GAAW,OAAO,MAAM;EAAM,CAAC;EACxD,YAAY,GAAG,UAAU,QAAQ,MAAM,MAAM;CAC/C;CAEA,MAAM,IAAI,oBAAoB,gDAAgD,SAAS,EAAE;AAC3F;AAEA,SAAS,YACP,UACA,OACA,SAC2B;CAC3B,MAAM,UAAU,WAAW,QAAQ;CACnC,IAAI,QAAQ,UAAU,QACpB,OAAO;EAAE,UAAU;EAAO,QAAQ;EAAQ,QAAQ,QAAQ;CAAM;CAElE,IAAI,QAAQ,UAAU,SAAS;EAC7B,MAAM,YAAY,GAAG,SAAS,SAAS,MAAM,MAAM,GAAG;EACtD,IAAI;GACF,WAAW,UAAU,SAAS;GAC9B,WAAW,SAAS;EACtB,SAAS,OAAO;GACd,IAAI,CAAC,UAAU,KAAK,GAAG,MAAM;EAC/B;CACF;CACA,IAAI,aAAa,UAAU,OAAO,aAAa,SAAS,GACtD,OAAO,SAAS,UAAU,KAAK;CAEjC,MAAM,SAAS,WAAW,QAAQ;CAClC,IAAI,OAAO,UAAU,QACnB,OAAO;EAAE,UAAU;EAAO,QAAQ;EAAQ,QAAQ,OAAO;CAAM;CAEjE,OAAO;EAAE,UAAU;EAAO,QAAQ;CAAW;AAC/C;AAEA,SAAS,SAAS,UAAkB,OAAuD;CACzF,OAAO;EACL,UAAU;EACV,MAAM;GACJ;GACA,eAAe,iBAAiB,UAAU,KAAK;EACjD;CACF;AACF;AAEA,SAAS,aAAa,UAAkB,OAA4B,QAAyB;CAC3F,MAAM,YAAY,GAAG,SAAS,GAAG,MAAM,IAAI,GAAG,MAAM,MAAM,GAAG,OAAO;CACpE,MAAM,aAAa,SACjB,WACA,UAAU,UAAU,UAAU,SAAS,UAAU,UACjD,GACF;CACA,IAAI;EACF,cAAc,YAAY,GAAG,eAAe,KAAK,EAAE,KAAK,MAAM;EAC9D,UAAU,UAAU;CACtB,SAAS,OAAO;EACd,UAAU,UAAU;EACpB,eAAe,SAAS;EACxB,MAAM;CACR;CACA,UAAU,UAAU;CAEpB,IAAI;EACF,SAAS,WAAW,QAAQ;EAC5B,OAAO;CACT,SAAS,OAAO;EACd,IAAI,CAAC,gBAAgB,KAAK,GAAG,MAAM;EACnC,OAAO;CACT,UAAU;EACR,eAAe,SAAS;CAC1B;AACF;AAEA,SAAS,WAAW,UAA8B;CAChD,MAAM,QAAQ,UAAU,QAAQ;CAChC,IAAI,CAAC,OAAO,OAAO,EAAE,OAAO,UAAU;CACtC,IAAI,MAAM,SAAS,SAAS,GAAG,OAAO;EAAE,OAAO;EAAQ;CAAM;CAC7D,IAAI;EACF,QAAQ,KAAK,MAAM,KAAK,CAAC;EACzB,OAAO;GAAE,OAAO;GAAQ;EAAM;CAChC,SAAS,OAAO;EACd,IAAI,gBAAgB,KAAK,GAAG,OAAO;GAAE,OAAO;GAAS;EAAM;EAC3D,OAAO;GAAE,OAAO;GAAQ;EAAM;CAChC;AACF;AAEA,SAAS,UAAU,UAAmD;CACpE,IAAI;CACJ,IAAI;EACF,WAAW,aAAa,UAAU,MAAM,CAAC,CAAC,KAAK;CACjD,SAAS,OAAO;EACd,IAAI,UAAU,KAAK,GAAG,OAAO,KAAA;EAC7B,MAAM;CACR;CAEA,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,QAAQ;CAC7B,SAAS,OAAO;EACd,MAAM,aAAa,UAAU,KAAK;CACpC;CACA,IAAI,CAAC,QAAQ,KAAK,GAAG,MAAM,aAAa,QAAQ;CAChD,OAAO;AACT;AAEA,SAAS,QAAQ,OAA8C;CAC7D,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO;CAChF,MAAM,SAAS;CACf,OACE,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,KAC/B,OAAO,cAAc,OAAO,GAAG,KAC/B,OAAO,OAAO,GAAG,IAAI,KACrB,OAAO,OAAO,SAAS,YACvB,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,KAC5B,OAAO,OAAO,UAAU,YACxB,OAAO,MAAM,KAAK,CAAC,CAAC,SAAS;AAEjC;AAEA,SAAS,aAAa,UAAkB,OAAsC;CAC5E,MAAM,QAAQ,IAAI,oBAChB,0CAA0C,SAAS,4BACrD;CACA,IAAI,UAAU,KAAA,GAAW,OAAO,eAAe,OAAO,SAAS,EAAE,OAAO,MAAM,CAAC;CAC/E,OAAO;AACT;AAEA,SAAS,iBAAiB,UAAkB,OAAkC;CAC5E,MAAM,UAAU,UAAU,QAAQ;CAClC,IAAI,CAAC,SAAS;CACd,IAAI,eAAe,OAAO,MAAM,eAAe,KAAK,GAClD,MAAM,IAAI,oBAAoB,kDAAkD,SAAS,EAAE;CAE7F,IAAI;EACF,WAAW,QAAQ;CACrB,SAAS,OAAO;EACd,IAAI,CAAC,UAAU,KAAK,GAAG,MAAM;CAC/B;AACF;AAEA,SAAS,eAAe,OAAoC;CAC1D,OAAO,KAAK,UAAU;EAAE,MAAM,MAAM;EAAM,OAAO,MAAM;EAAO,KAAK,MAAM;CAAI,CAAC;AAChF;AAEA,SAAS,aAAa,UAA0B;CAC9C,OAAO,GAAG,SAAS;AACrB;AAEA,SAAS,gBAAgB,OAAyB;CAChD,OAAO,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS;AACrE;AAEA,SAAS,UAAU,OAAyB;CAC1C,OAAO,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS;AACrE;AAEA,SAAS,gBAAgB,OAAyB;CAChD,OAAO,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS;AACrE;AAEA,SAAS,eAAe,MAAoB;CAC1C,IAAI;EACF,WAAW,IAAI;CACjB,SAAS,OAAO;EACd,IAAI,CAAC,UAAU,KAAK,GAAG,MAAM;CAC/B;AACF;;;;;;;;;;;;;;AC9RA,IAAa,QAAb,MAAmB;CACjB,SAAiB;CACjB,UAA8C,CAAC;CAE/C,MAAM,UAA+B;EACnC,IAAI,CAAC,KAAK,QAAQ;GAChB,KAAK,SAAS;GACd,aAAa,KAAK,QAAQ;EAC5B;EACA,OAAO,IAAI,SAAqB,YAAY;GAC1C,KAAK,QAAQ,WAAW;IACtB,cAAc,KAAK,QAAQ,CAAC;GAC9B,CAAC;EACH,CAAC;CACH;CAEA,UAAwB;EACtB,MAAM,OAAO,KAAK,QAAQ,MAAM;EAChC,IAAI,MACF,KAAK;OAEL,KAAK,SAAS;CAElB;CAEA,MAAM,aAAgB,IAAsC;EAC1D,MAAM,UAAU,MAAM,KAAK,QAAQ;EACnC,IAAI;GACF,OAAO,MAAM,GAAG;EAClB,UAAU;GACR,QAAQ;EACV;CACF;;CAGA,IAAI,WAAoB;EACtB,OAAO,KAAK;CACd;;CAGA,IAAI,UAAkB;EACpB,OAAO,KAAK,QAAQ;CACtB;AACF;;AAWA,eAAsB,mBAAsB,SAAqD;CAC/F,IAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,KAAK,QAAQ,QAAQ,GAC1D,MAAM,IAAI,MAAM,GAAG,QAAQ,MAAM,sCAAsC;CAEzE,IAAI,CAAC,OAAO,cAAc,QAAQ,cAAc,KAAK,QAAQ,iBAAiB,GAC5E,MAAM,IAAI,MAAM,GAAG,QAAQ,MAAM,2CAA2C;CAG9E,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,wBAAwB,WAAW,MAAM,QAAQ,QAAQ,MAAM;CACrE,IAAI,QAAQ,QAAQ,SAAS,gBAAgB;MACxC,QAAQ,QAAQ,iBAAiB,SAAS,iBAAiB,EAAE,MAAM,KAAK,CAAC;CAE9E,MAAM,UAAU,IAAI,MAAS,QAAQ,KAAK;CAC1C,IAAI,YAAY;CAChB,IAAI,SAAS;CACb,IAAI;CACJ,MAAM,UAAU,MAAM,KACpB,EAAE,QAAQ,KAAK,IAAI,QAAQ,gBAAgB,QAAQ,KAAK,EAAE,GAC1D,YAAY;EACV,OAAO,CAAC,WAAW,OAAO,SAAS;GACjC,MAAM,QAAQ;GACd,aAAa;GACb,IAAI,SAAS,QAAQ,OAAO;GAC5B,IAAI;IACF,QAAQ,SAAS,MAAM,QAAQ,IAAI,OAAO,WAAW,MAAM;GAC7D,SAAS,OAAO;IACd,IAAI,CAAC,QAAQ;KACX,SAAS;KACT,eAAe;KACf,WAAW,MAAM,KAAK;IACxB;IACA;GACF;EACF;CACF,CACF;CAEA,IAAI;EACF,MAAM,QAAQ,IAAI,OAAO;EACzB,IAAI,QAAQ,QAAQ,SAAS,MAAM,WAAW,QAAQ,QAAQ,QAAQ,KAAK;EAC3E,IAAI,QAAQ,MAAM;EAClB,IAAI,WAAW,OAAO,SAAS,MAAM,WAAW,WAAW,QAAQ,QAAQ,KAAK;EAChF,OAAO;CACT,UAAU;EACR,QAAQ,QAAQ,oBAAoB,SAAS,eAAe;CAC9D;AACF;;;;;;AAOA,eAAsB,cACpB,OACA,aACA,KACA,QACc;CACd,OAAO,mBAAmB;EACxB,OAAO,MAAM;EACb,gBAAgB;EAChB,OAAO;EACP;EACA,IAAI,OAAO,QAAQ;GACjB,OAAO,IAAI,MAAM,QAAS,OAAO,MAAM;EACzC;CACF,CAAC;AACH;AAEA,SAAS,WAAW,QAAqB,OAAsB;CAC7D,OAAO,OAAO,kBAAkB,QAAQ,OAAO,yBAAS,IAAI,MAAM,GAAG,MAAM,SAAS;AACtF;;;;;;ACjHA,SAAgB,iBAAiB,MAAc,MAAc,SAAkC;CAC7F,UAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CAC5C,sBAAsB,MAAM,OAAO;CACnC,MAAM,KAAK,SAAS,MAAM,UAAU,UAAU,UAAU,WAAW,UAAU,UAAU,GAAK;CAC5F,IAAI;EACF,SAAS,IAAI,OAAO,KAAK,MAAM,MAAM,GAAG,OAAO;EAC/C,UAAU,EAAE;CACd,UAAU;EACR,UAAU,EAAE;CACd;CACA,eAAe,QAAQ,IAAI,CAAC;AAC9B;AAEA,SAAS,sBAAsB,MAAc,SAAkC;CAC7E,IAAI;CACJ,IAAI;EACF,KAAK,SAAS,MAAM,UAAU,MAAM;CACtC,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAAU;EACxD,MAAM,QAAQ,eAAe,GAAG,QAAQ,QAAQ,GAAG,KAAK,oCAAoC,EAC1F,OAAO,MACT,CAAC;CACH;CAEA,IAAI;EACF,MAAM,OAAO,UAAU,EAAE,CAAC,CAAC;EAC3B,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,IAAM;EACnD,MAAM,YAAY,mBAAmB,IAAI,IAAI;EAC7C,MAAM,cAAc,OAAO,MAAM,OAAO,WAAW,EAAI;EACvD,YAAY,YAAY,SAAS,KAAK;EACtC,WAAW,IAAI,aAAa,WAAW,OAAO;EAC9C,UAAU,EAAE;CACd,SAAS,OAAO;EACd,MAAM,QAAQ,eACZ,GAAG,QAAQ,QAAQ,GAAG,KAAK,4CAC3B,EAAE,OAAO,MAAM,CACjB;CACF,UAAU;EACR,UAAU,EAAE;CACd;AACF;;;;AAKA,SAAgB,0BACd,MACA,UACA,SACM;CACN,MAAM,YAAY,QAAQ,IAAI;CAC9B,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;CACxC,MAAM,gBAAgB,GAAG,KAAK;CAC9B,MAAM,KAAK,SACT,eACA,UAAU,UAAU,UAAU,WAAW,UAAU,SACnD,GACF;CACA,IAAI;EACF,SAAS,IAAI,OAAO,KAAK,UAAU,MAAM,GAAG,OAAO;EACnD,UAAU,EAAE;CACd,UAAU;EACR,UAAU,EAAE;CACd;CACA,WAAW,eAAe,IAAI;CAC9B,eAAe,SAAS;AAC1B;;;;;AAMA,SAAgB,iBAAiB,MAAc,SAAqC;CAClF,IAAI;EACF,OAAO,MAAM,EAAE,WAAW,KAAK,CAAC;CAClC,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAAU,OAAO;EAC/D,MAAM,QAAQ,eAAe,GAAG,QAAQ,QAAQ,GAAG,KAAK,wBAAwB,EAC9E,OAAO,MACT,CAAC;CACH;CACA,eAAe,QAAQ,IAAI,CAAC;CAC5B,OAAO;AACT;AAEA,SAAgB,mBAAsB,MAAc,SAA4B,KAAiB;CAC/F,MAAM,SAAS,sBAAsB,MAAM,SAAS,GAAG;CACvD,IAAI,CAAC,OAAO,UACV,MAAM,QAAQ,eAAe,GAAG,QAAQ,QAAQ,iBAAiB,KAAK,EAAE;CAE1E,OAAO,OAAO;AAChB;AAIA,SAAgB,sBACd,MACA,SACA,KACmB;CACnB,UAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CAC5C,MAAM,WAAW,GAAG,KAAK;CACzB,IAAI;EACF,MAAM,cAAc,yBAAyB,EAAE,SAAS,CAAC;EACzD,IAAI,CAAC,YAAY,UAAU,OAAO,EAAE,UAAU,MAAM;EACpD,IAAI;GACF,OAAO;IAAE,UAAU;IAAM,OAAO,IAAI;GAAE;EACxC,UAAU;GACR,YAAY,KAAK,QAAQ;EAC3B;CACF,SAAS,OAAO;EACd,IAAI,iBAAiB,qBACnB,MAAM,QAAQ,eAAe,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;EAE9D,MAAM;CACR;AACF;AAEA,SAAS,SAAS,IAAY,OAAe,SAAkC;CAC7E,IAAI,SAAS;CACb,OAAO,SAAS,MAAM,YAAY;EAChC,MAAM,UAAU,UAAU,IAAI,OAAO,QAAQ,MAAM,aAAa,MAAM;EACtE,IAAI,WAAW,GAAG,MAAM,QAAQ,eAAe,6BAA6B;EAC5E,UAAU;CACZ;AACF;AAEA,SAAS,WAAW,IAAY,OAAe,UAAkB,SAAkC;CACjG,IAAI,SAAS;CACb,OAAO,SAAS,MAAM,YAAY;EAChC,MAAM,UAAU,UAAU,IAAI,OAAO,QAAQ,MAAM,aAAa,QAAQ,WAAW,MAAM;EACzF,IAAI,WAAW,GAAG,MAAM,QAAQ,eAAe,6BAA6B;EAC5E,UAAU;CACZ;AACF;AAEA,SAAS,mBAAmB,IAAY,MAAsB;CAC5D,MAAM,QAAQ,OAAO,MAAM,KAAK,IAAI,MAAO,IAAI,CAAC;CAChD,IAAI,SAAS;CACb,OAAO,SAAS,GAAG;EACjB,MAAM,SAAS,KAAK,IAAI,MAAM,YAAY,MAAM;EAChD,UAAU;EACV,MAAM,OAAO,SAAS,IAAI,OAAO,GAAG,QAAQ,MAAM;EAClD,KAAK,IAAI,QAAQ,OAAO,GAAG,SAAS,GAAG,SAAS,GAC9C,IAAI,MAAM,WAAW,IAAM,OAAO,SAAS,QAAQ;CAEvD;CACA,OAAO;AACT;AAEA,SAAS,SAAS,IAAY,UAA0B;CACtD,MAAM,OAAO,OAAO,YAAY,CAAC;CAEjC,OADa,SAAS,IAAI,MAAM,GAAG,GAAG,QAC5B,MAAM,IAAI,KAAK,KAAM;AACjC;AAEA,SAAS,eAAe,MAAoB;CAC1C,MAAM,KAAK,SAAS,MAAM,UAAU,QAAQ;CAC5C,IAAI;EACF,UAAU,EAAE;CACd,UAAU;EACR,UAAU,EAAE;CACd;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACtHA,SAAgB,mBAAmB,aAA6B;CAC9D,OAAO,GAAG,YAAY;AACxB;AAEA,MAAM,wBACJ;;;;;AAMF,SAAgB,oBACd,MACA,SAC0B;CAC1B,IAAI;CACJ,IAAI;EACF,OAAO,aAAa,MAAM,MAAM;CAClC,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAAU,OAAO;EAC/D,MAAM,QAAQ,eACZ,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,qBAAqB,yBAC7D,EAAE,OAAO,MAAM,CACjB;CACF;CACA,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,MAAM,IAAI;CACvB,SAAS,OAAO;EACd,MAAM,QAAQ,eACZ,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,qBAAqB,yBAC7D,EAAE,OAAO,MAAM,CACjB;CACF;CACA,IAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,MAAM,QAAQ,GAAG,GAC9D,MAAM,QAAQ,eACZ,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,oBAAoB,uBAC9D;CAEF,MAAM,SAAS;CACf,MAAM,OAAO,OAAO,KAAK,MAAM,CAAC,CAAC,KAAK;CACtC,IAAI,KAAK,WAAW,KAAK,KAAK,OAAO,eAAe,KAAK,OAAO,YAC9D,MAAM,QAAQ,eACZ,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,aAAa,KAAK,KAAK,IAAI,EAAE,oCAAoC,uBAC3G;CAEF,MAAM,EAAE,UAAU,cAAc;CAChC,IAAI,OAAO,aAAa,YAAY,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,GAChF,MAAM,QAAQ,eACZ,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,0CAA0C,uBACpF;CAEF,IAAI,OAAO,cAAc,YAAY,CAAC,oBAAoB,KAAK,SAAS,GACtE,MAAM,QAAQ,eACZ,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,oCAAoC,uBAC9E;CAEF,OAAO;EAAE;EAAqB;CAAwB;AACxD;;;;;;;;;;AAWA,SAAgB,qBACd,MACA,MACA,SACM;CACN,IAAI;EACF,0BAA0B,MAAM,GAAG,gBAAgB,IAAI,EAAE,KAAK,OAAO;CACvE,SAAS,OAAO;EACd,MAAM,QAAQ,eAAe,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,wBAAwB,EAC3F,OAAO,MACT,CAAC;CACH;AACF;;;;;;;AAmBA,SAAgB,qBACd,MACA,SAC0B;CAC1B,IAAI,OAAiC;CACrC,IAAI,aAAa;CACjB,IAAI;EACF,OAAO,oBAAoB,MAAM,OAAO;CAC1C,SAAS,OAAO;EAId,aAAa,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CACpE;CACA,MAAM,UAAU,iBAAiB,MAAM,OAAO;CAC9C,IAAI;CACJ,IAAI;EAGF,iBAAiB,GAAG,KAAK,OAAO,OAAO;CACzC,SAAS,OAAO;EACd,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CACtE;CACA,MAAM,UAAU,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;CACjE,IAAI,CAAC,SAAS,OAAO;EAAE,SAAS;EAAO,GAAG;CAAQ;CAClD,IAAI,SAAS,MAAM,OAAO;EAAE,SAAS;EAAM,MAAM;EAAM;EAAY,GAAG;CAAQ;CAC9E,OAAO;EAAE,SAAS;EAAM;EAAM,GAAG;CAAQ;AAC3C;;;;AAcA,SAAgB,gCACd,SACA,MACA,SACA,QACM;CAIN,IAAI,OAAO,WAAW,YAAY,WAAW,MAC3C,MAAM,IAAI,UACR,6FACF;CAEF,MAAM,EAAE,SAAS,oBAAoB;CACrC,MAAM,SAAS,QAAQ,KAAK;CAC5B,IAAI,WAAW,KAAA,GACb,MAAM,QAAQ,eACZ,GAAG,QAAQ,gBAAgB,gBAAgB,iBAAiB,KAAK,SAAS,IAAI,KAAK,UAAU,wBAAwB,QAAQ,OAAO,gKACtI;CAEF,IAAI,OAAO,aAAa,KAAK,UAC3B,MAAM,QAAQ,eACZ,GAAG,QAAQ,kBAAkB,KAAK,SAAS,oBAAoB,OAAO,SAAS,uDAAuD,iBACxI;CAEF,IAAI,OAAO,cAAc,KAAK,WAC5B,MAAM,QAAQ,eACZ,GAAG,QAAQ,4BAA4B,KAAK,SAAS,WAAW,OAAO,UAAU,wBAAwB,gBAAgB,YAAY,KAAK,UAAU,qHACtJ;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;ACpHA,MAAM,iCAAiB,IAAI,IAAmB;AAE9C,SAAS,SAAS,MAAqB;CACrC,MAAM,WAAW,eAAe,IAAI,IAAI;CACxC,IAAI,UAAU,OAAO;CACrB,MAAM,QAAQ,IAAI,MAAM;CACxB,eAAe,IAAI,MAAM,KAAK;CAC9B,OAAO;AACT;;;AAIA,IAAa,oBAAb,MAAiG;CAC/F;;CAEA;CACA;CACA;CACA;CAEA,YACE,MACA,OACA,UAAoC,CAAC,GACrC;EACA,KAAK,OAAO,QAAQ,IAAI;EACxB,KAAK,kBAAkB,mBAAmB,KAAK,IAAI;EACnD,KAAK,QAAQ;EACb,KAAK,QAAQ,SAAS,KAAK,IAAI;EAC/B,KAAK,qBAAqB,QAAQ,uBAAuB;CAC3D;CAEA,MAAM,SAAgF;EACpF,OAAO,KAAK,MAAM,mBAChB,mBAAmB,KAAK,MAAM,KAAK,aAAa,KAAK,aAAa,CAAC,CACrE;CACF;CAEA,MAAM,OACJ,OACA,UAA+B,CAAC,GACuC;EACvE,OAAO,KAAK,MAAM,mBAChB,mBAAmB,KAAK,MAAM,KAAK,aAAa;GAC9C,MAAM,SAAS,KAAK,aAAa;GACjC,MAAM,WAAW,OAAO,QAAQ,MAAM,UAAU,MAAM,MAAM,YAAY,MAAM,OAAO;GACrF,IAAI,UAAU;IACZ,IAAI,gBAAgB,SAAS,KAAK,MAAM,gBAAgB,KAAK,GAC3D,MAAM,KAAK,MAAM,cACf,WAAW,MAAM,QAAQ,uCAC3B;IAEF,IAAI,QAAQ,YAAY,MAAM,KAAK,gBAAgB,UAAU,OAAO,OAAO;IAC3E,OAAO;KAAE,OAAO;KAAU,UAAU;KAAO,YAAY,OAAO;IAAW;GAC3E;GAEA,MAAM,WAAW;IACf,GAAG,KAAK,MAAM;IACd,UAAU,OAAO,QAAQ;IACzB,cAAc,OAAO,QAAQ,GAAG,EAAE,CAAC,EAAE,aAAa;IAClD;GACF;GACA,MAAM,QAAQ;IAAE,GAAG;IAAU,WAAW,cAAc,QAAQ;GAAE;GAIhE,MAAM,aAAa,KAAK,QAAQ,CAAC,GAAG,OAAO,SAAS,KAAK,CAAC;GAC1D,iBAAiB,KAAK,MAAM,GAAG,gBAAgB,KAAK,EAAE,KAAK,KAAK,KAAK;GACrE,IAAI,QAAQ,YAAY,MAOtB,qBACE,KAAK,iBACL;IAAE,UAAU,MAAM;IAAU,WAAW,MAAM;GAAU,GACvD,KAAK,KACP;GAEF,OAAO;IAAE;IAAO,UAAU;IAAM;GAAW;EAC7C,CAAC,CACH;CACF;;CAGA,MAAM,cAAiD;EACrD,OAAO,KAAK,MAAM,mBAChB,mBAAmB,KAAK,MAAM,KAAK,aACjC,oBAAoB,KAAK,iBAAiB,KAAK,KAAK,CACtD,CACF;CACF;;;;CAKA,MAAM,iBAA6C;EACjD,OAAO,KAAK,MAAM,mBAChB,mBAAmB,KAAK,MAAM,KAAK,aAAa;GAC9C,MAAM,UAAU,KAAK,YAAY;GACjC,KAAK,QAAQ,OAAO;GAGpB,KAAK,kBAAkB,SAAS,KAAK;GACrC,MAAM,OAAO,QAAQ,GAAG,EAAE;GAC1B,IAAI,SAAS,KAAA,GACX,MAAM,KAAK,MAAM,eACf,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK,KAAK,mCACrC;GAEF,MAAM,OAA0B;IAAE,UAAU,KAAK;IAAU,WAAW,KAAK;GAAU;GACrF,qBAAqB,KAAK,iBAAiB,MAAM,KAAK,KAAK;GAC3D,OAAO;EACT,CAAC,CACH;CACF;;;;;;;;CASA,MAAM,mBAAsD;EAC1D,OAAO,KAAK,MAAM,mBAChB,mBAAmB,KAAK,MAAM,KAAK,aACjC,qBAAqB,KAAK,iBAAiB,KAAK,KAAK,CACvD,CACF;CACF;;;;;;;;;;;;;CAcA,gBACE,OACA,SACM;EACN,MAAM,SAAS,oBAAoB,KAAK,iBAAiB,KAAK,KAAK;EACnE,IAAI,WAAW,MACT;OAAA,MAAM,aAAa,QAAQ,SAAS,GAAG;EAAA,OACtC,IAAI,OAAO,YAAY,MAAM,UAClC;EAEF,qBACE,KAAK,iBACL;GAAE,UAAU,MAAM;GAAU,WAAW,MAAM;EAAU,GACvD,KAAK,KACP;CACF;CAEA,eAAqF;EACnF,MAAM,UAAU,KAAK,YAAY;EACjC,MAAM,aAAa,KAAK,QAAQ,OAAO;EAIvC,KAAK,kBAAkB,SAAS,KAAK,kBAAkB;EACvD,OAAO;GAAE;GAAS;EAAW;CAC/B;CAEA,kBAA0B,SAAyC,YAA2B;EAC5F,MAAM,SAAS,oBAAoB,KAAK,iBAAiB,KAAK,KAAK;EACnE,IAAI,WAAW,MAAM;GACnB,IAAI,cAAc,QAAQ,SAAS,GACjC,MAAM,KAAK,MAAM,eACf,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK,KAAK,OAAO,QAAQ,OAAO,kCAAkC,KAAK,gBAAgB,wIAClH;GAEF;EACF;EACA,gCAAgC,SAAS,QAAQ,KAAK,OAAO;GAC3D,SAAS,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK;GACvC,iBAAiB,KAAK;EACxB,CAAC;CACH;CAEA,cAAsD;EACpD,IAAI,CAAC,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC;EACpC,MAAM,OAAO,aAAa,KAAK,MAAM,MAAM;EAC3C,IAAI,KAAK,WAAW,GAAG,OAAO,CAAC;EAC/B,IAAI,CAAC,KAAK,SAAS,IAAI,GACrB,MAAM,KAAK,MAAM,eACf,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK,KAAK,gDACrC;EAGF,MAAM,QAAQ,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,IAAI;EAC1C,MAAM,UAA0C,CAAC;EACjD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;GACpD,MAAM,OAAO,MAAM;GACnB,IAAI,KAAK,WAAW,GAClB,MAAM,KAAK,MAAM,eACf,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK,KAAK,2BAA2B,QAAQ,GACxE;GAEF,IAAI;GACJ,IAAI;IACF,MAAM,KAAK,MAAM,IAAI;GACvB,SAAS,OAAO;IACd,MAAM,KAAK,MAAM,eACf,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK,KAAK,4BAA4B,QAAQ,KACvE,EAAE,OAAO,MAAM,CACjB;GACF;GACA,MAAM,QAAQ,KAAK,MAAM,WAAW,KAAK;IAAE,MAAM,KAAK;IAAM,MAAM,QAAQ;GAAE,CAAC;GAC7E,IAAI;GACJ,IAAI;IACF,YAAY,gBAAgB,KAAK;GACnC,SAAS,OAAO;IACd,MAAM,KAAK,MAAM,eACf,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK,KAAK,iDAAiD,QAAQ,KAC5F,EAAE,OAAO,MAAM,CACjB;GACF;GACA,IAAI,SAAS,WACX,MAAM,KAAK,MAAM,eACf,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK,KAAK,mCAAmC,QAAQ,GAChF;GAEF,QAAQ,KAAK,KAAK;EACpB;EACA,OAAO;CACT;CAEA,QAAgB,SAAqD;EACnE,MAAM,YAAY,KAAK,MAAM,gBAAgB;EAC7C,MAAM,2BAAW,IAAI,IAAY;EACjC,IAAI,mBAAsC;EAC1C,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,GAAG;GACtD,MAAM,QAAQ,QAAQ;GACtB,KAAK,MAAM,iBAAiB,OAAO,KAAK;GACxC,IAAI,MAAM,aAAa,OACrB,MAAM,KAAK,MAAM,eACf,SAAS,MAAM,MAAM,QAAQ,gBAAgB,MAAM,SAAS,aAAa,OAC3E;GAEF,IAAI,MAAM,iBAAiB,kBACzB,MAAM,KAAK,MAAM,eACf,SAAS,MAAM,MAAM,QAAQ,mCAC/B;GAEF,MAAM,EAAE,WAAW,YAAY,GAAG,aAAa;GAC/C,MAAM,eAAe,cAAc,QAAQ;GAC3C,IAAI,MAAM,cAAc,cACtB,MAAM,KAAK,MAAM,eACf,SAAS,MAAM,MAAM,QAAQ,2BAA2B,aAAa,QAAQ,MAAM,WACrF;GAEF,mBAAmB,MAAM;GACzB,IAAI,SAAS,IAAI,MAAM,MAAM,OAAO,GAClC,MAAM,KAAK,MAAM,eACf,qBAAqB,MAAM,MAAM,QAAQ,mBAC3C;GAEF,SAAS,IAAI,MAAM,MAAM,OAAO;GAChC,UAAU,MAAM,OAAO,KAAK;EAC9B;EACA,OAAO,UAAU,OAAO,OAAO;CACjC;AACF"}
+{"version":3,"file":"ledger-core-PIfjCbKn.js","names":[],"sources":["../src/ledger-core/atomic-file-lock.ts","../src/concurrency.ts","../src/ledger-core/journal-file.ts","../src/ledger-core/trusted-head.ts","../src/ledger-core/journal.ts"],"sourcesContent":["/** Crash-safe filesystem lock shared by campaign persistence and run exclusion. */\n\nimport { randomUUID } from 'node:crypto'\nimport {\n  closeSync,\n  constants,\n  existsSync,\n  fsyncSync,\n  linkSync,\n  openSync,\n  readFileSync,\n  renameSync,\n  unlinkSync,\n  writeFileSync,\n} from 'node:fs'\nimport { hostname } from 'node:os'\n\nexport interface AtomicFileLockOwner {\n  readonly pid: number\n  readonly host: string\n  readonly nonce: string\n}\n\nexport interface AtomicFileLock {\n  readonly owner: AtomicFileLockOwner\n  release(): void\n}\n\nexport type AtomicFileLockUnavailable =\n  | { readonly acquired: false; readonly reason: 'held'; readonly holder: AtomicFileLockOwner }\n  | { readonly acquired: false; readonly reason: 'recovery' }\n\nexport type AtomicFileLockAcquisition =\n  | { readonly acquired: true; readonly lock: AtomicFileLock }\n  | AtomicFileLockUnavailable\n\nexport interface AtomicFileLockOptions {\n  readonly lockPath: string\n  readonly pid?: number\n}\n\nexport class AtomicFileLockError extends Error {\n  override readonly name = 'AtomicFileLockError'\n}\n\ntype OwnerState =\n  | { readonly state: 'missing' }\n  | { readonly state: 'stale'; readonly owner: AtomicFileLockOwner }\n  | { readonly state: 'held'; readonly owner: AtomicFileLockOwner }\n\n/** Report whether another lock path prevents acquisition without modifying it. */\nexport function probeAtomicFileLock(\n  options: AtomicFileLockOptions,\n): AtomicFileLockUnavailable | null {\n  if (existsSync(recoveryPath(options.lockPath))) return { acquired: false, reason: 'recovery' }\n  const state = ownerState(options.lockPath)\n  if (state.state === 'held') {\n    return { acquired: false, reason: 'held', holder: state.owner }\n  }\n  return null\n}\n\n/**\n * Try to acquire a complete, uniquely-owned lock inode.\n *\n * A hard link publishes fully-written owner metadata atomically. Stale-owner\n * removal is serialized so one reclaimer cannot delete a new owner's lock.\n */\nexport function tryAcquireAtomicFileLock(\n  options: AtomicFileLockOptions,\n): AtomicFileLockAcquisition {\n  const pid = options.pid ?? process.pid\n  if (!Number.isSafeInteger(pid) || pid <= 0) {\n    throw new AtomicFileLockError('atomic file lock pid must be a positive integer')\n  }\n  const owner: AtomicFileLockOwner = { pid, host: hostname(), nonce: randomUUID() }\n  for (let attempt = 0; attempt < 8; attempt += 1) {\n    if (existsSync(recoveryPath(options.lockPath))) {\n      const recovery = tryAcquireRecoveryLease(options.lockPath, owner, attempt)\n      if (!recovery) return { acquired: false, reason: 'recovery' }\n      try {\n        return recoverLock(options.lockPath, owner, attempt)\n      } finally {\n        recovery.release()\n      }\n    }\n    if (tryLinkOwner(options.lockPath, owner, `acquire.${attempt}`)) {\n      return acquired(options.lockPath, owner)\n    }\n\n    const holder = ownerState(options.lockPath)\n    if (holder.state === 'missing') continue\n    if (holder.state === 'held') {\n      return { acquired: false, reason: 'held', holder: holder.owner }\n    }\n\n    const recovery = tryAcquireRecoveryLease(options.lockPath, owner, attempt)\n    if (!recovery) return { acquired: false, reason: 'recovery' }\n    try {\n      return recoverLock(options.lockPath, owner, attempt)\n    } finally {\n      recovery.release()\n    }\n  }\n\n  throw new AtomicFileLockError(`could not acquire atomic file lock ${options.lockPath}`)\n}\n\ninterface RecoveryLease {\n  release(): void\n}\n\nfunction tryAcquireRecoveryLease(\n  lockPath: string,\n  owner: AtomicFileLockOwner,\n  attempt: number,\n): RecoveryLease | null {\n  let leasePath = recoveryPath(lockPath)\n  const staleOwners: Array<{ path: string; owner: AtomicFileLockOwner }> = []\n\n  for (let depth = 0; depth < 64; depth += 1) {\n    const state = ownerState(leasePath)\n    if (state.state === 'missing') {\n      if (!tryLinkOwner(leasePath, owner, `reclaim.${attempt}.${depth}`)) continue\n      return {\n        release: () => {\n          for (const stale of staleOwners) releaseOwnedPath(stale.path, stale.owner)\n          releaseOwnedPath(leasePath, owner)\n        },\n      }\n    }\n    if (state.state === 'held') return null\n    staleOwners.push({ path: leasePath, owner: state.owner })\n    leasePath = `${leasePath}.next.${state.owner.nonce}`\n  }\n\n  throw new AtomicFileLockError(`atomic file lock recovery chain is too deep (${lockPath})`)\n}\n\nfunction recoverLock(\n  lockPath: string,\n  owner: AtomicFileLockOwner,\n  attempt: number,\n): AtomicFileLockAcquisition {\n  const current = ownerState(lockPath)\n  if (current.state === 'held') {\n    return { acquired: false, reason: 'held', holder: current.owner }\n  }\n  if (current.state === 'stale') {\n    const tombstone = `${lockPath}.stale.${owner.nonce}.${attempt}`\n    try {\n      renameSync(lockPath, tombstone)\n      unlinkSync(tombstone)\n    } catch (error) {\n      if (!isMissing(error)) throw error\n    }\n  }\n  if (tryLinkOwner(lockPath, owner, `recovered.${attempt}`)) {\n    return acquired(lockPath, owner)\n  }\n  const holder = ownerState(lockPath)\n  if (holder.state === 'held') {\n    return { acquired: false, reason: 'held', holder: holder.owner }\n  }\n  return { acquired: false, reason: 'recovery' }\n}\n\nfunction acquired(lockPath: string, owner: AtomicFileLockOwner): AtomicFileLockAcquisition {\n  return {\n    acquired: true,\n    lock: {\n      owner,\n      release: () => releaseOwnedPath(lockPath, owner),\n    },\n  }\n}\n\nfunction tryLinkOwner(lockPath: string, owner: AtomicFileLockOwner, suffix: string): boolean {\n  const ownerPath = `${lockPath}.${owner.pid}.${owner.nonce}.${suffix}.owner`\n  const descriptor = openSync(\n    ownerPath,\n    constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY,\n    0o600,\n  )\n  try {\n    writeFileSync(descriptor, `${canonicalOwner(owner)}\\n`, 'utf8')\n    fsyncSync(descriptor)\n  } catch (error) {\n    closeSync(descriptor)\n    unlinkIfExists(ownerPath)\n    throw error\n  }\n  closeSync(descriptor)\n\n  try {\n    linkSync(ownerPath, lockPath)\n    return true\n  } catch (error) {\n    if (!isAlreadyExists(error)) throw error\n    return false\n  } finally {\n    unlinkIfExists(ownerPath)\n  }\n}\n\nfunction ownerState(lockPath: string): OwnerState {\n  const owner = readOwner(lockPath)\n  if (!owner) return { state: 'missing' }\n  if (owner.host !== hostname()) return { state: 'held', owner }\n  try {\n    process.kill(owner.pid, 0)\n    return { state: 'held', owner }\n  } catch (error) {\n    if (isNoSuchProcess(error)) return { state: 'stale', owner }\n    return { state: 'held', owner }\n  }\n}\n\nfunction readOwner(lockPath: string): AtomicFileLockOwner | undefined {\n  let contents: string\n  try {\n    contents = readFileSync(lockPath, 'utf8').trim()\n  } catch (error) {\n    if (isMissing(error)) return undefined\n    throw error\n  }\n\n  let value: unknown\n  try {\n    value = JSON.parse(contents)\n  } catch (error) {\n    throw invalidOwner(lockPath, error)\n  }\n  if (!isOwner(value)) throw invalidOwner(lockPath)\n  return value\n}\n\nfunction isOwner(value: unknown): value is AtomicFileLockOwner {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false\n  const record = value as Record<string, unknown>\n  return (\n    Object.keys(record).length === 3 &&\n    Number.isSafeInteger(record.pid) &&\n    Number(record.pid) > 0 &&\n    typeof record.host === 'string' &&\n    record.host.trim().length > 0 &&\n    typeof record.nonce === 'string' &&\n    record.nonce.trim().length > 0\n  )\n}\n\nfunction invalidOwner(lockPath: string, cause?: unknown): AtomicFileLockError {\n  const error = new AtomicFileLockError(\n    `atomic file lock has an invalid owner (${lockPath}); refusing unsafe recovery`,\n  )\n  if (cause !== undefined) Object.defineProperty(error, 'cause', { value: cause })\n  return error\n}\n\nfunction releaseOwnedPath(lockPath: string, owner: AtomicFileLockOwner): void {\n  const current = readOwner(lockPath)\n  if (!current) return\n  if (canonicalOwner(current) !== canonicalOwner(owner)) {\n    throw new AtomicFileLockError(`atomic file lock owner changed before release (${lockPath})`)\n  }\n  try {\n    unlinkSync(lockPath)\n  } catch (error) {\n    if (!isMissing(error)) throw error\n  }\n}\n\nfunction canonicalOwner(owner: AtomicFileLockOwner): string {\n  return JSON.stringify({ host: owner.host, nonce: owner.nonce, pid: owner.pid })\n}\n\nfunction recoveryPath(lockPath: string): string {\n  return `${lockPath}.reclaim`\n}\n\nfunction isAlreadyExists(error: unknown): boolean {\n  return error instanceof Error && 'code' in error && error.code === 'EEXIST'\n}\n\nfunction isMissing(error: unknown): boolean {\n  return error instanceof Error && 'code' in error && error.code === 'ENOENT'\n}\n\nfunction isNoSuchProcess(error: unknown): boolean {\n  return error instanceof Error && 'code' in error && error.code === 'ESRCH'\n}\n\nfunction unlinkIfExists(path: string): void {\n  try {\n    unlinkSync(path)\n  } catch (error) {\n    if (!isMissing(error)) throw error\n  }\n}\n","/**\n * concurrency — small primitives the evolution loop needs.\n *\n * `Mutex` is a zero-dep async lock with FIFO fairness. The evolution loop\n * uses it to serialise checkout/build/commit sequences inside a single\n * pool slot, and to gate concurrent JSONL writers (see\n * `lockedJsonlReferenceReplayStore`).\n *\n * Deliberately minimal — no priority queue, no timeouts. If you need\n * those, swap to `async-mutex` at the call site.\n */\n\nexport class Mutex {\n  private locked = false\n  private readonly waiters: Array<() => void> = []\n\n  async acquire(): Promise<() => void> {\n    if (!this.locked) {\n      this.locked = true\n      return () => this.release()\n    }\n    return new Promise<() => void>((resolve) => {\n      this.waiters.push(() => {\n        resolve(() => this.release())\n      })\n    })\n  }\n\n  private release(): void {\n    const next = this.waiters.shift()\n    if (next) {\n      next()\n    } else {\n      this.locked = false\n    }\n  }\n\n  async runExclusive<T>(fn: () => Promise<T> | T): Promise<T> {\n    const release = await this.acquire()\n    try {\n      return await fn()\n    } finally {\n      release()\n    }\n  }\n\n  /** True iff someone holds the lock right now. Diagnostics only. */\n  get isLocked(): boolean {\n    return this.locked\n  }\n\n  /** Pending waiter count. Diagnostics only. */\n  get pending(): number {\n    return this.waiters.length\n  }\n}\n\nexport interface MapConcurrentRangeOptions<R> {\n  count: number\n  maxConcurrency: number\n  label: string\n  signal?: AbortSignal\n  map(index: number, signal: AbortSignal): Promise<R>\n}\n\n/** Map an integer range with bounded work, cancellation, and first-error cleanup. */\nexport async function mapConcurrentRange<R>(options: MapConcurrentRangeOptions<R>): Promise<R[]> {\n  if (!Number.isSafeInteger(options.count) || options.count < 0) {\n    throw new Error(`${options.label} count must be a non-negative integer`)\n  }\n  if (!Number.isSafeInteger(options.maxConcurrency) || options.maxConcurrency < 1) {\n    throw new Error(`${options.label} maxConcurrency must be a positive integer`)\n  }\n\n  const controller = new AbortController()\n  const abortFromCaller = () => controller.abort(options.signal?.reason)\n  if (options.signal?.aborted) abortFromCaller()\n  else options.signal?.addEventListener('abort', abortFromCaller, { once: true })\n\n  const results = new Array<R>(options.count)\n  let nextIndex = 0\n  let failed = false\n  let firstFailure: unknown\n  const workers = Array.from(\n    { length: Math.min(options.maxConcurrency, options.count) },\n    async () => {\n      while (!controller.signal.aborted) {\n        const index = nextIndex\n        nextIndex += 1\n        if (index >= options.count) return\n        try {\n          results[index] = await options.map(index, controller.signal)\n        } catch (error) {\n          if (!failed) {\n            failed = true\n            firstFailure = error\n            controller.abort(error)\n          }\n          return\n        }\n      }\n    },\n  )\n\n  try {\n    await Promise.all(workers)\n    if (options.signal?.aborted) throw abortError(options.signal, options.label)\n    if (failed) throw firstFailure\n    if (controller.signal.aborted) throw abortError(controller.signal, options.label)\n    return results\n  } finally {\n    options.signal?.removeEventListener('abort', abortFromCaller)\n  }\n}\n\n/**\n * Map independent work with a fixed worker count while preserving input order.\n * After the first rejection, no new items start; already-running work is allowed\n * to settle before the returned promise rejects. Partial results are discarded.\n */\nexport async function mapConcurrent<T, R>(\n  items: readonly T[],\n  concurrency: number,\n  map: (item: T, index: number, signal: AbortSignal) => Promise<R>,\n  signal?: AbortSignal,\n): Promise<R[]> {\n  return mapConcurrentRange({\n    count: items.length,\n    maxConcurrency: concurrency,\n    label: 'mapConcurrent',\n    signal,\n    map(index, signal) {\n      return map(items[index]!, index, signal)\n    },\n  })\n}\n\nfunction abortError(signal: AbortSignal, label: string): Error {\n  return signal.reason instanceof Error ? signal.reason : new Error(`${label} aborted`)\n}\n","/** Filesystem durability and cross-process exclusion for append-only journal files. */\n\nimport {\n  closeSync,\n  constants,\n  fstatSync,\n  fsyncSync,\n  mkdirSync,\n  openSync,\n  readSync,\n  renameSync,\n  rmSync,\n  writeSync,\n} from 'node:fs'\nimport { dirname } from 'node:path'\nimport { AtomicFileLockError, tryAcquireAtomicFileLock } from './atomic-file-lock'\n\n/** How a journal binding reports file-layer faults in its own error taxonomy. */\nexport interface LedgerFileContext {\n  /** Noun used in error messages, e.g. 'search ledger'. */\n  subject: string\n  integrityError(message: string, options?: { cause?: unknown }): Error\n}\n\n/** Append one already-serialized line; the write is fsynced (file and directory)\n * before returning so an acknowledged append survives a crash. */\nexport function appendLedgerLine(path: string, line: string, context: LedgerFileContext): void {\n  mkdirSync(dirname(path), { recursive: true })\n  recoverTornFinalWrite(path, context)\n  const fd = openSync(path, constants.O_CREAT | constants.O_WRONLY | constants.O_APPEND, 0o600)\n  try {\n    writeAll(fd, Buffer.from(line, 'utf8'), context)\n    fsyncSync(fd)\n  } finally {\n    closeSync(fd)\n  }\n  fsyncDirectory(dirname(path))\n}\n\nfunction recoverTornFinalWrite(path: string, context: LedgerFileContext): void {\n  let fd: number\n  try {\n    fd = openSync(path, constants.O_RDWR)\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return\n    throw context.integrityError(`${context.subject} ${path} could not be opened for recovery`, {\n      cause: error,\n    })\n  }\n\n  try {\n    const size = fstatSync(fd).size\n    if (size === 0 || readByte(fd, size - 1) === 0x0a) return\n    const tailStart = findFinalLineStart(fd, size)\n    const replacement = Buffer.alloc(size - tailStart, 0x20)\n    replacement[replacement.length - 1] = 0x0a\n    writeAllAt(fd, replacement, tailStart, context)\n    fsyncSync(fd)\n  } catch (error) {\n    throw context.integrityError(\n      `${context.subject} ${path} has an unrecoverable final journal write`,\n      { cause: error },\n    )\n  } finally {\n    closeSync(fd)\n  }\n}\n\n/** Replace a small sidecar file whole: write a temporary sibling, fsync it,\n * then rename over the target. A reader therefore sees the previous contents\n * or the new ones, never a partial file. */\nexport function writeLedgerFileAtomically(\n  path: string,\n  contents: string,\n  context: LedgerFileContext,\n): void {\n  const directory = dirname(path)\n  mkdirSync(directory, { recursive: true })\n  const temporaryPath = `${path}.tmp`\n  const fd = openSync(\n    temporaryPath,\n    constants.O_CREAT | constants.O_WRONLY | constants.O_TRUNC,\n    0o600,\n  )\n  try {\n    writeAll(fd, Buffer.from(contents, 'utf8'), context)\n    fsyncSync(fd)\n  } finally {\n    closeSync(fd)\n  }\n  renameSync(temporaryPath, path)\n  fsyncDirectory(directory)\n}\n\n/** Remove whatever occupies a sidecar path and fsync its directory, so the\n * removal is as durable as the write that created it. False when the path was\n * already empty. Recursive because a sidecar path holding a directory is one of\n * the states this has to be able to clear, not one it can refuse. */\nexport function removeLedgerFile(path: string, context: LedgerFileContext): boolean {\n  try {\n    rmSync(path, { recursive: true })\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false\n    throw context.integrityError(`${context.subject} ${path} could not be removed`, {\n      cause: error,\n    })\n  }\n  fsyncDirectory(dirname(path))\n  return true\n}\n\nexport function withLedgerFileLock<T>(path: string, context: LedgerFileContext, run: () => T): T {\n  const result = tryWithLedgerFileLock(path, context, run)\n  if (!result.acquired) {\n    throw context.integrityError(`${context.subject} lock is held (${path})`)\n  }\n  return result.value\n}\n\nexport type FileLockResult<T> = { acquired: true; value: T } | { acquired: false }\n\nexport function tryWithLedgerFileLock<T>(\n  path: string,\n  context: LedgerFileContext,\n  run: () => T,\n): FileLockResult<T> {\n  mkdirSync(dirname(path), { recursive: true })\n  const lockPath = `${path}.lock`\n  try {\n    const acquisition = tryAcquireAtomicFileLock({ lockPath })\n    if (!acquisition.acquired) return { acquired: false }\n    try {\n      return { acquired: true, value: run() }\n    } finally {\n      acquisition.lock.release()\n    }\n  } catch (error) {\n    if (error instanceof AtomicFileLockError) {\n      throw context.integrityError(error.message, { cause: error })\n    }\n    throw error\n  }\n}\n\nfunction writeAll(fd: number, bytes: Buffer, context: LedgerFileContext): void {\n  let offset = 0\n  while (offset < bytes.byteLength) {\n    const written = writeSync(fd, bytes, offset, bytes.byteLength - offset)\n    if (written <= 0) throw context.integrityError('filesystem wrote zero bytes')\n    offset += written\n  }\n}\n\nfunction writeAllAt(fd: number, bytes: Buffer, position: number, context: LedgerFileContext): void {\n  let offset = 0\n  while (offset < bytes.byteLength) {\n    const written = writeSync(fd, bytes, offset, bytes.byteLength - offset, position + offset)\n    if (written <= 0) throw context.integrityError('filesystem wrote zero bytes')\n    offset += written\n  }\n}\n\nfunction findFinalLineStart(fd: number, size: number): number {\n  const chunk = Buffer.alloc(Math.min(4_096, size))\n  let cursor = size\n  while (cursor > 0) {\n    const length = Math.min(chunk.byteLength, cursor)\n    cursor -= length\n    const read = readSync(fd, chunk, 0, length, cursor)\n    for (let index = read - 1; index >= 0; index -= 1) {\n      if (chunk[index] === 0x0a) return cursor + index + 1\n    }\n  }\n  return 0\n}\n\nfunction readByte(fd: number, position: number): number {\n  const byte = Buffer.allocUnsafe(1)\n  const read = readSync(fd, byte, 0, 1, position)\n  return read === 1 ? byte[0]! : -1\n}\n\nfunction fsyncDirectory(path: string): void {\n  const fd = openSync(path, constants.O_RDONLY)\n  try {\n    fsyncSync(fd)\n  } finally {\n    closeSync(fd)\n  }\n}\n","/**\n * Trusted head — the pin that makes deletion detectable.\n *\n * ## What the chain binds\n *\n * Every entry hashes the journal header, its sequence, the previous entry's\n * hash, and its event, so editing, reordering, or removing an entry in the\n * middle of a journal invalidates every hash after it. What a hash chain\n * cannot bind is its own length. Dropping entries off the END leaves a shorter\n * journal that is internally perfect, and rebuilding a journal from sequence 0\n * with recomputed hashes produces a different, equally perfect chain. For an\n * audit log of candidate registrations and promotion decisions that is the\n * difference between a record of a search that happened and a record of one\n * that did not.\n *\n * ## What the pin binds\n *\n * `<journal>.head` holds `{sequence, entryHash}` for one entry a writer\n * actually appended, in a file separate from the journal it attests. Each\n * entry hash commits to the entire prefix before it, so checking that the\n * entry at exactly `sequence` still carries `entryHash` proves two things at\n * once: the journal is at least `sequence + 1` entries long, and those entries\n * are byte-for-byte the ones the writer saw. A journal that merely grew past\n * the pin still verifies; a truncated, rolled-back, or wholesale-rewritten one\n * cannot.\n *\n * ## What the pin does NOT defend against\n *\n * The pin is a second file, not a signature. A writer with access to BOTH the\n * journal and its pin can rewrite both consistently, and the result verifies.\n * Pinning raises the cost of undetected tampering from one file to two and\n * nothing more; defending against a writer who holds both requires an anchor\n * outside this store entirely — a signed head, or a digest published to an\n * append-only service the tamperer does not control.\n *\n * Deleting the pin file downgrades a pinned journal to an unpinned one, which\n * cannot be distinguished from a journal written before pinning existed. That\n * is what `requireTrustedHead` is for: a journal opened under it refuses to\n * read at all once a non-empty journal has no pin.\n *\n * ## Abandoning a pin\n *\n * A pin outlives the journal it attests: deleting or rebuilding the journal\n * leaves a pin naming history the file no longer carries, and every read is\n * refused because that is precisely the deletion the pin exists to catch. The\n * refusal names the pin file, and `clearTrustedHeadFile` is the explicit way to\n * discard it — the same downgrade a writer with filesystem access could already\n * perform with `rm`, made reachable through the API so it is a decision in the\n * code rather than an undocumented manual step. It returns the guarantee it\n * gave up and writes no record of its own; a caller that needs the discard on\n * the record has to write one.\n */\n\nimport { readFileSync } from 'node:fs'\nimport { canonicalString, LEDGER_HASH_PATTERN, type LedgerHash } from './canonical'\nimport { type LedgerFileContext, removeLedgerFile, writeLedgerFileAtomically } from './journal-file'\n\n/** A `(sequence, entryHash)` pair a writer pinned outside the journal. */\nexport interface LedgerTrustedHead {\n  sequence: number\n  entryHash: LedgerHash\n}\n\n/** Minimum entry shape the anchor check needs. */\nexport interface LedgerAnchoredEntry {\n  sequence: number\n  entryHash: LedgerHash\n}\n\n/** Sibling pin file for a journal — deliberately NOT the journal, so rewriting\n * the log is not enough to rewrite the trust recorded about it. */\nexport function trustedHeadPathFor(journalPath: string): string {\n  return `${journalPath}.head`\n}\n\nconst TRUSTED_HEAD_RECOVERY =\n  ' Restore the file, or discard the pin it held with clearTrustedHead().'\n\n/** The pin, or null when this journal has never been pinned. A pin that exists\n * but does not parse is corruption or tamper of the trust record itself and\n * fails loudly: reporting it as \"no pin\" would silently downgrade what the\n * journal can prove. */\nexport function readTrustedHeadFile(\n  path: string,\n  context: LedgerFileContext,\n): LedgerTrustedHead | null {\n  let text: string\n  try {\n    text = readFileSync(path, 'utf8')\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null\n    throw context.integrityError(\n      `${context.subject} trusted head ${path} could not be read.${TRUSTED_HEAD_RECOVERY}`,\n      { cause: error },\n    )\n  }\n  let raw: unknown\n  try {\n    raw = JSON.parse(text)\n  } catch (error) {\n    throw context.integrityError(\n      `${context.subject} trusted head ${path} is not valid JSON.${TRUSTED_HEAD_RECOVERY}`,\n      { cause: error },\n    )\n  }\n  if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {\n    throw context.integrityError(\n      `${context.subject} trusted head ${path} is not an object.${TRUSTED_HEAD_RECOVERY}`,\n    )\n  }\n  const record = raw as Record<string, unknown>\n  const keys = Object.keys(record).sort()\n  if (keys.length !== 2 || keys[0] !== 'entryHash' || keys[1] !== 'sequence') {\n    throw context.integrityError(\n      `${context.subject} trusted head ${path} has keys [${keys.join(', ')}], expected [entryHash, sequence].${TRUSTED_HEAD_RECOVERY}`,\n    )\n  }\n  const { sequence, entryHash } = record\n  if (typeof sequence !== 'number' || !Number.isSafeInteger(sequence) || sequence < 0) {\n    throw context.integrityError(\n      `${context.subject} trusted head ${path} sequence is not a non-negative integer.${TRUSTED_HEAD_RECOVERY}`,\n    )\n  }\n  if (typeof entryHash !== 'string' || !LEDGER_HASH_PATTERN.test(entryHash)) {\n    throw context.integrityError(\n      `${context.subject} trusted head ${path} entryHash is not a sha256 digest.${TRUSTED_HEAD_RECOVERY}`,\n    )\n  }\n  return { sequence, entryHash: entryHash as LedgerHash }\n}\n\n/** Publish a pin by write-then-rename, so a crash leaves either the previous\n * pin or the new one and never a torn file that would lock a journal out of\n * its own trust record.\n *\n * Not re-exported from the package's public surface. It takes no lock, checks no\n * chain, and enforces no monotonicity, so a public form would be the one call\n * able to move a pin BACKWARD onto a journal it never read — which is the\n * truncation the pin exists to refuse. `FileLedgerJournal.pinTrustedHead` is\n * the public writer: locked, chain-verified, forward-only. */\nexport function writeTrustedHeadFile(\n  path: string,\n  head: LedgerTrustedHead,\n  context: LedgerFileContext,\n): void {\n  try {\n    writeLedgerFileAtomically(path, `${canonicalString(head)}\\n`, context)\n  } catch (error) {\n    throw context.integrityError(`${context.subject} trusted head ${path} could not be written`, {\n      cause: error,\n    })\n  }\n}\n\n/** Outcome of discarding a pin: the guarantee that was given up. `unreadable`\n * carries why the discarded pin could not be named — corruption, a permission\n * fault, a wrong file type — so a caller recording the decision never has to\n * treat \"no pin was there\" and \"the pin could not be read\" as one state.\n * `cleanupError` reports a stale atomic-write sibling that remains after the\n * actual pin was cleared. */\nexport type LedgerTrustedHeadRemoval =\n  | { removed: true; head: LedgerTrustedHead; cleanupError?: string }\n  | { removed: true; head: null; unreadable: string; cleanupError?: string }\n  | { removed: false; cleanupError?: string }\n\n/** Discard a journal's pin, reporting what was discarded. The journal file is\n * untouched and reads as unpinned afterwards, so the next pinning append opens\n * a new pin at the entry it writes. This gives up the deletion guarantee for\n * every entry the pin covered; it is the recovery for a pin whose journal was\n * deliberately deleted or rebuilt, and the only way past a pin file that can no\n * longer be read at all. */\nexport function clearTrustedHeadFile(\n  path: string,\n  context: LedgerFileContext,\n): LedgerTrustedHeadRemoval {\n  let head: LedgerTrustedHead | null = null\n  let unreadable = ''\n  try {\n    head = readTrustedHeadFile(path, context)\n  } catch (error) {\n    // A pin nobody can read is precisely what clearing has to get past, so the\n    // fault is reported on a removal that still happens rather than raised —\n    // but it is reported, never flattened into \"there was no pin\".\n    unreadable = error instanceof Error ? error.message : String(error)\n  }\n  const removed = removeLedgerFile(path, context)\n  let cleanupError: string | undefined\n  try {\n    // Cleanup cannot block the requested trust-state change. Report a stale\n    // atomic-write sibling so the caller can repair it before the next write.\n    removeLedgerFile(`${path}.tmp`, context)\n  } catch (error) {\n    cleanupError = error instanceof Error ? error.message : String(error)\n  }\n  const cleanup = cleanupError === undefined ? {} : { cleanupError }\n  if (!removed) return { removed: false, ...cleanup }\n  if (head === null) return { removed: true, head: null, unreadable, ...cleanup }\n  return { removed: true, head, ...cleanup }\n}\n\n/** How a journal is named when a trusted-head check refuses it. */\nexport interface LedgerTrustedHeadSubject {\n  /** The journal in error messages, e.g. `search ledger /runs/a/ledger.jsonl`. */\n  subject: string\n  /** The sibling pin file, named in every refusal so the operator can see which\n   * of the two files carries the claim being enforced. */\n  trustedHeadPath: string\n}\n\n/** The entry at exactly `head.sequence` must still carry `head.entryHash`.\n * Entries must already have passed chain verification, which is what makes\n * index and sequence interchangeable here. */\nexport function verifyEntriesAgainstTrustedHead(\n  entries: readonly LedgerAnchoredEntry[],\n  head: LedgerTrustedHead,\n  context: LedgerFileContext,\n  naming: LedgerTrustedHeadSubject,\n): void {\n  // A caller passing the bare subject string an untyped build would accept\n  // destructures into two undefineds, which would corrupt the text of a\n  // security refusal rather than fail. Refuse instead.\n  if (typeof naming !== 'object' || naming === null) {\n    throw new TypeError(\n      'verifyEntriesAgainstTrustedHead expects { subject, trustedHeadPath } as its fourth argument',\n    )\n  }\n  const { subject, trustedHeadPath } = naming\n  const pinned = entries[head.sequence]\n  if (pinned === undefined) {\n    throw context.integrityError(\n      `${subject} trusted head ${trustedHeadPath} pins sequence ${head.sequence} (${head.entryHash}) but the journal has ${entries.length} entries — pinned history is missing (truncation, rollback, or rewrite). Restore the journal, or abandon the pinned history on purpose with clearTrustedHead().`,\n    )\n  }\n  if (pinned.sequence !== head.sequence) {\n    throw context.integrityError(\n      `${subject} entry at index ${head.sequence} carries sequence ${pinned.sequence}; the chain was not verified before the trusted head ${trustedHeadPath}`,\n    )\n  }\n  if (pinned.entryHash !== head.entryHash) {\n    throw context.integrityError(\n      `${subject} entry at pinned sequence ${head.sequence} carries ${pinned.entryHash} but the trusted head ${trustedHeadPath} recorded ${head.entryHash} — the journal was rewritten. Restore the journal, or abandon the pinned history on purpose with clearTrustedHead().`,\n    )\n  }\n}\n","/**\n * Generic durable append-only journal with a SHA-256 hash chain.\n *\n * The file format is canonical JSONL: every row is the canonical JSON encoding\n * (RFC 8785, object keys sorted recursively) of one entry, and every entry\n * hashes the previous entry's hash so the log is tamper-evident. Appends are\n * serialized in-process per path and across processes via a lock file, fsynced\n * before acknowledgement, and idempotent by `eventId`. A malformed,\n * non-canonical, truncated, reordered, or conflicting log fails loudly; a bad\n * row is never skipped.\n *\n * A hash chain binds each entry to its predecessor, which cannot prove that no\n * entry was removed from the end: a valid shorter prefix is still a valid\n * chain. `pinHead` records the appended entry in a sibling `<journal>.head`\n * file and every read re-verifies the journal against a pin that is present,\n * so truncation and wholesale rewrite are refused. `trusted-head.ts` carries\n * the full threat model, including what a pin does not defend against.\n *\n * Domain vocabulary lives entirely in the consumer's codec: entry schema\n * validation, the constant header fields stamped into every entry, the error\n * taxonomy, and the state machine replayed over verified entries.\n */\n\nimport { existsSync, readFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\nimport { Mutex } from '../concurrency'\nimport { canonicalString, hashCanonical, type LedgerHash } from './canonical'\nimport { appendLedgerLine, type LedgerFileContext, withLedgerFileLock } from './journal-file'\nimport {\n  clearTrustedHeadFile,\n  type LedgerTrustedHead,\n  type LedgerTrustedHeadRemoval,\n  readTrustedHeadFile,\n  trustedHeadPathFor,\n  verifyEntriesAgainstTrustedHead,\n  writeTrustedHeadFile,\n} from './trusted-head'\n\n/** Minimum shape of a journal event: the idempotency key. */\nexport interface LedgerEventBase {\n  eventId: string\n}\n\n/** Chain envelope every entry carries in addition to the journal's constant\n * header fields. `entryHash` covers the header, sequence, previous hash, and\n * event, so any rewrite of history invalidates every later entry. */\nexport interface LedgerChainFields<Event extends LedgerEventBase> {\n  sequence: number\n  previousHash: LedgerHash | null\n  event: Event\n  entryHash: LedgerHash\n}\n\nexport type LedgerEntryOf<Header extends object, Event extends LedgerEventBase> = Header &\n  LedgerChainFields<Event>\n\nexport interface LedgerLineContext {\n  path: string\n  line: number\n}\n\n/** Domain state machine replayed over chain-verified entries in order.\n * `apply` throws (via the codec's error taxonomy) on an invalid transition;\n * `finish` builds the consumer's projection once every entry was applied. */\nexport interface LedgerProjector<Entry, Projection> {\n  apply(entry: Entry, index: number): void\n  finish(entries: Entry[]): Projection\n}\n\nexport interface LedgerJournalCodec<\n  Header extends object,\n  Event extends LedgerEventBase,\n  Projection,\n> extends LedgerFileContext {\n  /** Constant fields stamped into every entry and covered by its hash. */\n  header: Header\n  conflictError(message: string): Error\n  /** Validate one parsed JSON row into a typed entry. Must reject malformed\n   * rows and non-canonical event encodings with the binding's own errors;\n   * the journal itself verifies the stored bytes and the hash chain. */\n  parseEntry(raw: unknown, context: LedgerLineContext): LedgerEntryOf<Header, Event>\n  /** Reject an entry whose constant header fields do not match this journal. */\n  checkEntryHeader(entry: LedgerEntryOf<Header, Event>, index: number): void\n  createProjector(): LedgerProjector<LedgerEntryOf<Header, Event>, Projection>\n}\n\nexport interface LedgerReplayResult<Entry, Projection> {\n  entries: Entry[]\n  projection: Projection\n}\n\nexport interface LedgerAppendResult<Entry, Projection> {\n  entry: Entry\n  /** False when the exact event was already durably present. */\n  appended: boolean\n  projection: Projection\n}\n\nexport interface LedgerAppendOptions {\n  /** Record the appended entry as this journal's trusted head, so a later read\n   * can prove nothing was deleted from the end.\n   *\n   * On the idempotent path — the event is already durable — the pin moves up to\n   * that entry only when the entry is ahead of it, along a chain this call has\n   * just verified. So a pin write that failed after its row was fsynced is\n   * repaired by the retry that idempotency already asks the caller for, and the\n   * pin still only ever moves forward over history it has checked.\n   *\n   * A strict journal whose first pin write failed still refuses the retry\n   * because it cannot distinguish that failure from a deleted pin. Recover it\n   * explicitly with `pinTrustedHead()`; silently adopting the current file\n   * would defeat `requireTrustedHead`. */\n  pinHead?: boolean\n}\n\nexport interface FileLedgerJournalOptions {\n  /** Refuse to read a non-empty journal that has no trusted head.\n   *\n   * Off by default because journals written before pinning have no pin and\n   * must keep opening. Turn it on for a journal this process pins: without it,\n   * deleting the sibling pin file silently downgrades the journal back to a\n   * chain that cannot detect deletion. */\n  requireTrustedHead?: boolean\n}\n\n// One async mutex per resolved journal path so concurrent appends from a single\n// process queue up instead of failing on the held cross-process lock file.\nconst journalMutexes = new Map<string, Mutex>()\n\nfunction mutexFor(path: string): Mutex {\n  const existing = journalMutexes.get(path)\n  if (existing) return existing\n  const mutex = new Mutex()\n  journalMutexes.set(path, mutex)\n  return mutex\n}\n\n/** Durable filesystem journal. Construction performs no I/O; `append` and\n * `replay` validate the complete existing file under the locks. */\nexport class FileLedgerJournal<Header extends object, Event extends LedgerEventBase, Projection> {\n  readonly path: string\n  /** Sibling file holding this journal's trusted head. */\n  readonly trustedHeadPath: string\n  private readonly codec: LedgerJournalCodec<Header, Event, Projection>\n  private readonly mutex: Mutex\n  private readonly requireTrustedHead: boolean\n\n  constructor(\n    path: string,\n    codec: LedgerJournalCodec<Header, Event, Projection>,\n    options: FileLedgerJournalOptions = {},\n  ) {\n    this.path = resolve(path)\n    this.trustedHeadPath = trustedHeadPathFor(this.path)\n    this.codec = codec\n    this.mutex = mutexFor(this.path)\n    this.requireTrustedHead = options.requireTrustedHead === true\n  }\n\n  async replay(): Promise<LedgerReplayResult<LedgerEntryOf<Header, Event>, Projection>> {\n    return this.mutex.runExclusive(() =>\n      withLedgerFileLock(this.path, this.codec, () => this.replayLocked()),\n    )\n  }\n\n  async append(\n    event: Event,\n    options: LedgerAppendOptions = {},\n  ): Promise<LedgerAppendResult<LedgerEntryOf<Header, Event>, Projection>> {\n    return this.mutex.runExclusive(() =>\n      withLedgerFileLock(this.path, this.codec, () => {\n        const before = this.replayLocked()\n        const existing = before.entries.find((entry) => entry.event.eventId === event.eventId)\n        if (existing) {\n          if (canonicalString(existing.event) !== canonicalString(event)) {\n            throw this.codec.conflictError(\n              `eventId ${event.eventId} already exists with different content`,\n            )\n          }\n          if (options.pinHead === true) this.pinAcknowledged(existing, before.entries)\n          return { entry: existing, appended: false, projection: before.projection }\n        }\n\n        const material = {\n          ...this.codec.header,\n          sequence: before.entries.length,\n          previousHash: before.entries.at(-1)?.entryHash ?? null,\n          event,\n        }\n        const entry = { ...material, entryHash: hashCanonical(material) }\n\n        // Apply the state transition before spending an append: an entry the\n        // projector rejects must never reach the durable file.\n        const projection = this.project([...before.entries, entry])\n        appendLedgerLine(this.path, `${canonicalString(entry)}\\n`, this.codec)\n        if (options.pinHead === true) {\n          // Journal first, pin second: a crash or a failed pin write between\n          // them leaves the pin one entry behind, which still verifies and is\n          // repaired by the next pinning append, including the idempotent\n          // retry of this same event. The reverse order would leave a pin\n          // naming an entry the journal does not carry, locking the journal\n          // out of its own history.\n          writeTrustedHeadFile(\n            this.trustedHeadPath,\n            { sequence: entry.sequence, entryHash: entry.entryHash },\n            this.codec,\n          )\n        }\n        return { entry, appended: true, projection }\n      }),\n    )\n  }\n\n  /** The pinned head, or null when this journal has never been pinned. */\n  async trustedHead(): Promise<LedgerTrustedHead | null> {\n    return this.mutex.runExclusive(() =>\n      withLedgerFileLock(this.path, this.codec, () =>\n        readTrustedHeadFile(this.trustedHeadPath, this.codec),\n      ),\n    )\n  }\n\n  /** Pin the current verified head. The chain and any existing pin are checked\n   * first, so the pin only ever moves forward along a journal that still\n   * carries the history it already recorded. */\n  async pinTrustedHead(): Promise<LedgerTrustedHead> {\n    return this.mutex.runExclusive(() =>\n      withLedgerFileLock(this.path, this.codec, () => {\n        const entries = this.readEntries()\n        this.project(entries)\n        // `requireTrustedHead` is deliberately not applied here: pinning is how\n        // a journal that lacks a pin acquires one.\n        this.verifyTrustedHead(entries, false)\n        const last = entries.at(-1)\n        if (last === undefined) {\n          throw this.codec.integrityError(\n            `${this.codec.subject} ${this.path} is empty; there is no head to pin`,\n          )\n        }\n        const head: LedgerTrustedHead = { sequence: last.sequence, entryHash: last.entryHash }\n        writeTrustedHeadFile(this.trustedHeadPath, head, this.codec)\n        return head\n      }),\n    )\n  }\n\n  /** Discard this journal's pin, reporting what was discarded. The journal file\n   * is untouched and reads as unpinned afterwards, so the next pinning append\n   * opens a new pin at the entry it writes. It is the way out of a pin whose\n   * journal was deliberately deleted or rebuilt — every read of such a path is\n   * refused, correctly, because a pin naming history the file no longer carries\n   * is indistinguishable from a deletion. Clearing removes the deletion\n   * guarantee for every entry the pin covered. */\n  async clearTrustedHead(): Promise<LedgerTrustedHeadRemoval> {\n    return this.mutex.runExclusive(() =>\n      withLedgerFileLock(this.path, this.codec, () =>\n        clearTrustedHeadFile(this.trustedHeadPath, this.codec),\n      ),\n    )\n  }\n\n  /** Move the pin up to an entry this caller just acknowledged on the\n   * idempotent path, when a pin write that failed after its row was already\n   * fsynced left the pin behind. The move is safe because it is forward-only\n   * along a chain `replayLocked` has just verified: every entry up to this one\n   * is bound to it by hash, so the pin can only ever come to name more history\n   * than it did, never different history.\n   *\n   * With no pin at all this only pins the journal's current head. An entry in\n   * the middle would publish a pin that reads as protection while leaving every\n   * later entry silently truncatable, which is a worse state to hand an auditor\n   * than the honest absence of a pin; `pinTrustedHead()` is the way to pin an\n   * unpinned journal on purpose. */\n  private pinAcknowledged(\n    entry: LedgerEntryOf<Header, Event>,\n    entries: LedgerEntryOf<Header, Event>[],\n  ): void {\n    const pinned = readTrustedHeadFile(this.trustedHeadPath, this.codec)\n    if (pinned === null) {\n      if (entry.sequence !== entries.length - 1) return\n    } else if (pinned.sequence >= entry.sequence) {\n      return\n    }\n    writeTrustedHeadFile(\n      this.trustedHeadPath,\n      { sequence: entry.sequence, entryHash: entry.entryHash },\n      this.codec,\n    )\n  }\n\n  private replayLocked(): LedgerReplayResult<LedgerEntryOf<Header, Event>, Projection> {\n    const entries = this.readEntries()\n    const projection = this.project(entries)\n    // The anchor is meaningful only over a chain that already verified, so it\n    // is checked last — and on every read path, so a violated pin is refused\n    // before an append can extend the journal over it.\n    this.verifyTrustedHead(entries, this.requireTrustedHead)\n    return { entries, projection }\n  }\n\n  private verifyTrustedHead(entries: LedgerEntryOf<Header, Event>[], requirePin: boolean): void {\n    const pinned = readTrustedHeadFile(this.trustedHeadPath, this.codec)\n    if (pinned === null) {\n      if (requirePin && entries.length > 0) {\n        throw this.codec.integrityError(\n          `${this.codec.subject} ${this.path} has ${entries.length} entries but no trusted head at ${this.trustedHeadPath} — without its pin the journal cannot prove nothing was deleted. Restore the pin file, or adopt the current head with pinTrustedHead().`,\n        )\n      }\n      return\n    }\n    verifyEntriesAgainstTrustedHead(entries, pinned, this.codec, {\n      subject: `${this.codec.subject} ${this.path}`,\n      trustedHeadPath: this.trustedHeadPath,\n    })\n  }\n\n  private readEntries(): LedgerEntryOf<Header, Event>[] {\n    if (!existsSync(this.path)) return []\n    const text = readFileSync(this.path, 'utf8')\n    if (text.length === 0) return []\n    if (!text.endsWith('\\n')) {\n      throw this.codec.integrityError(\n        `${this.codec.subject} ${this.path} has a truncated final record (missing newline)`,\n      )\n    }\n\n    const lines = text.slice(0, -1).split('\\n')\n    const entries: LedgerEntryOf<Header, Event>[] = []\n    for (let index = 0; index < lines.length; index += 1) {\n      const line = lines[index]!\n      if (line.length === 0) {\n        throw this.codec.integrityError(\n          `${this.codec.subject} ${this.path} has a blank row at line ${index + 1}`,\n        )\n      }\n      let raw: unknown\n      try {\n        raw = JSON.parse(line)\n      } catch (error) {\n        throw this.codec.integrityError(\n          `${this.codec.subject} ${this.path} has invalid JSON at line ${index + 1}`,\n          { cause: error },\n        )\n      }\n      const entry = this.codec.parseEntry(raw, { path: this.path, line: index + 1 })\n      let canonical: string\n      try {\n        canonical = canonicalString(entry)\n      } catch (error) {\n        throw this.codec.integrityError(\n          `${this.codec.subject} ${this.path} has a row with no canonical JSON form at line ${index + 1}`,\n          { cause: error },\n        )\n      }\n      if (line !== canonical) {\n        throw this.codec.integrityError(\n          `${this.codec.subject} ${this.path} has non-canonical bytes at line ${index + 1}`,\n        )\n      }\n      entries.push(entry)\n    }\n    return entries\n  }\n\n  private project(entries: LedgerEntryOf<Header, Event>[]): Projection {\n    const projector = this.codec.createProjector()\n    const eventIds = new Set<string>()\n    let expectedPrevious: LedgerHash | null = null\n    for (let index = 0; index < entries.length; index += 1) {\n      const entry = entries[index]!\n      this.codec.checkEntryHeader(entry, index)\n      if (entry.sequence !== index) {\n        throw this.codec.integrityError(\n          `entry ${entry.event.eventId} has sequence ${entry.sequence}, expected ${index}`,\n        )\n      }\n      if (entry.previousHash !== expectedPrevious) {\n        throw this.codec.integrityError(\n          `entry ${entry.event.eventId} does not extend the previous hash`,\n        )\n      }\n      const { entryHash: _entryHash, ...material } = entry\n      const expectedHash = hashCanonical(material)\n      if (entry.entryHash !== expectedHash) {\n        throw this.codec.integrityError(\n          `entry ${entry.event.eventId} hash mismatch: expected ${expectedHash}, got ${entry.entryHash}`,\n        )\n      }\n      expectedPrevious = entry.entryHash\n      if (eventIds.has(entry.event.eventId)) {\n        throw this.codec.integrityError(\n          `duplicate eventId ${entry.event.eventId} in durable ledger`,\n        )\n      }\n      eventIds.add(entry.event.eventId)\n      projector.apply(entry, index)\n    }\n    return projector.finish(entries)\n  }\n}\n"],"mappings":";;;;;;;AAyCA,IAAa,sBAAb,cAAyC,MAAM;CAC7C,OAAyB;AAC3B;;AAQA,SAAgB,oBACd,SACkC;CAClC,IAAI,WAAW,aAAa,QAAQ,QAAQ,CAAC,GAAG,OAAO;EAAE,UAAU;EAAO,QAAQ;CAAW;CAC7F,MAAM,QAAQ,WAAW,QAAQ,QAAQ;CACzC,IAAI,MAAM,UAAU,QAClB,OAAO;EAAE,UAAU;EAAO,QAAQ;EAAQ,QAAQ,MAAM;CAAM;CAEhE,OAAO;AACT;;;;;;;AAQA,SAAgB,yBACd,SAC2B;CAC3B,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,IAAI,CAAC,OAAO,cAAc,GAAG,KAAK,OAAO,GACvC,MAAM,IAAI,oBAAoB,iDAAiD;CAEjF,MAAM,QAA6B;EAAE;EAAK,MAAM,SAAS;EAAG,OAAO,WAAW;CAAE;CAChF,KAAK,IAAI,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;EAC/C,IAAI,WAAW,aAAa,QAAQ,QAAQ,CAAC,GAAG;GAC9C,MAAM,WAAW,wBAAwB,QAAQ,UAAU,OAAO,OAAO;GACzE,IAAI,CAAC,UAAU,OAAO;IAAE,UAAU;IAAO,QAAQ;GAAW;GAC5D,IAAI;IACF,OAAO,YAAY,QAAQ,UAAU,OAAO,OAAO;GACrD,UAAU;IACR,SAAS,QAAQ;GACnB;EACF;EACA,IAAI,aAAa,QAAQ,UAAU,OAAO,WAAW,SAAS,GAC5D,OAAO,SAAS,QAAQ,UAAU,KAAK;EAGzC,MAAM,SAAS,WAAW,QAAQ,QAAQ;EAC1C,IAAI,OAAO,UAAU,WAAW;EAChC,IAAI,OAAO,UAAU,QACnB,OAAO;GAAE,UAAU;GAAO,QAAQ;GAAQ,QAAQ,OAAO;EAAM;EAGjE,MAAM,WAAW,wBAAwB,QAAQ,UAAU,OAAO,OAAO;EACzE,IAAI,CAAC,UAAU,OAAO;GAAE,UAAU;GAAO,QAAQ;EAAW;EAC5D,IAAI;GACF,OAAO,YAAY,QAAQ,UAAU,OAAO,OAAO;EACrD,UAAU;GACR,SAAS,QAAQ;EACnB;CACF;CAEA,MAAM,IAAI,oBAAoB,sCAAsC,QAAQ,UAAU;AACxF;AAMA,SAAS,wBACP,UACA,OACA,SACsB;CACtB,IAAI,YAAY,aAAa,QAAQ;CACrC,MAAM,cAAmE,CAAC;CAE1E,KAAK,IAAI,QAAQ,GAAG,QAAQ,IAAI,SAAS,GAAG;EAC1C,MAAM,QAAQ,WAAW,SAAS;EAClC,IAAI,MAAM,UAAU,WAAW;GAC7B,IAAI,CAAC,aAAa,WAAW,OAAO,WAAW,QAAQ,GAAG,OAAO,GAAG;GACpE,OAAO,EACL,eAAe;IACb,KAAK,MAAM,SAAS,aAAa,iBAAiB,MAAM,MAAM,MAAM,KAAK;IACzE,iBAAiB,WAAW,KAAK;GACnC,EACF;EACF;EACA,IAAI,MAAM,UAAU,QAAQ,OAAO;EACnC,YAAY,KAAK;GAAE,MAAM;GAAW,OAAO,MAAM;EAAM,CAAC;EACxD,YAAY,GAAG,UAAU,QAAQ,MAAM,MAAM;CAC/C;CAEA,MAAM,IAAI,oBAAoB,gDAAgD,SAAS,EAAE;AAC3F;AAEA,SAAS,YACP,UACA,OACA,SAC2B;CAC3B,MAAM,UAAU,WAAW,QAAQ;CACnC,IAAI,QAAQ,UAAU,QACpB,OAAO;EAAE,UAAU;EAAO,QAAQ;EAAQ,QAAQ,QAAQ;CAAM;CAElE,IAAI,QAAQ,UAAU,SAAS;EAC7B,MAAM,YAAY,GAAG,SAAS,SAAS,MAAM,MAAM,GAAG;EACtD,IAAI;GACF,WAAW,UAAU,SAAS;GAC9B,WAAW,SAAS;EACtB,SAAS,OAAO;GACd,IAAI,CAAC,UAAU,KAAK,GAAG,MAAM;EAC/B;CACF;CACA,IAAI,aAAa,UAAU,OAAO,aAAa,SAAS,GACtD,OAAO,SAAS,UAAU,KAAK;CAEjC,MAAM,SAAS,WAAW,QAAQ;CAClC,IAAI,OAAO,UAAU,QACnB,OAAO;EAAE,UAAU;EAAO,QAAQ;EAAQ,QAAQ,OAAO;CAAM;CAEjE,OAAO;EAAE,UAAU;EAAO,QAAQ;CAAW;AAC/C;AAEA,SAAS,SAAS,UAAkB,OAAuD;CACzF,OAAO;EACL,UAAU;EACV,MAAM;GACJ;GACA,eAAe,iBAAiB,UAAU,KAAK;EACjD;CACF;AACF;AAEA,SAAS,aAAa,UAAkB,OAA4B,QAAyB;CAC3F,MAAM,YAAY,GAAG,SAAS,GAAG,MAAM,IAAI,GAAG,MAAM,MAAM,GAAG,OAAO;CACpE,MAAM,aAAa,SACjB,WACA,UAAU,UAAU,UAAU,SAAS,UAAU,UACjD,GACF;CACA,IAAI;EACF,cAAc,YAAY,GAAG,eAAe,KAAK,EAAE,KAAK,MAAM;EAC9D,UAAU,UAAU;CACtB,SAAS,OAAO;EACd,UAAU,UAAU;EACpB,eAAe,SAAS;EACxB,MAAM;CACR;CACA,UAAU,UAAU;CAEpB,IAAI;EACF,SAAS,WAAW,QAAQ;EAC5B,OAAO;CACT,SAAS,OAAO;EACd,IAAI,CAAC,gBAAgB,KAAK,GAAG,MAAM;EACnC,OAAO;CACT,UAAU;EACR,eAAe,SAAS;CAC1B;AACF;AAEA,SAAS,WAAW,UAA8B;CAChD,MAAM,QAAQ,UAAU,QAAQ;CAChC,IAAI,CAAC,OAAO,OAAO,EAAE,OAAO,UAAU;CACtC,IAAI,MAAM,SAAS,SAAS,GAAG,OAAO;EAAE,OAAO;EAAQ;CAAM;CAC7D,IAAI;EACF,QAAQ,KAAK,MAAM,KAAK,CAAC;EACzB,OAAO;GAAE,OAAO;GAAQ;EAAM;CAChC,SAAS,OAAO;EACd,IAAI,gBAAgB,KAAK,GAAG,OAAO;GAAE,OAAO;GAAS;EAAM;EAC3D,OAAO;GAAE,OAAO;GAAQ;EAAM;CAChC;AACF;AAEA,SAAS,UAAU,UAAmD;CACpE,IAAI;CACJ,IAAI;EACF,WAAW,aAAa,UAAU,MAAM,CAAC,CAAC,KAAK;CACjD,SAAS,OAAO;EACd,IAAI,UAAU,KAAK,GAAG,OAAO,KAAA;EAC7B,MAAM;CACR;CAEA,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,QAAQ;CAC7B,SAAS,OAAO;EACd,MAAM,aAAa,UAAU,KAAK;CACpC;CACA,IAAI,CAAC,QAAQ,KAAK,GAAG,MAAM,aAAa,QAAQ;CAChD,OAAO;AACT;AAEA,SAAS,QAAQ,OAA8C;CAC7D,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO;CAChF,MAAM,SAAS;CACf,OACE,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,KAC/B,OAAO,cAAc,OAAO,GAAG,KAC/B,OAAO,OAAO,GAAG,IAAI,KACrB,OAAO,OAAO,SAAS,YACvB,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,KAC5B,OAAO,OAAO,UAAU,YACxB,OAAO,MAAM,KAAK,CAAC,CAAC,SAAS;AAEjC;AAEA,SAAS,aAAa,UAAkB,OAAsC;CAC5E,MAAM,QAAQ,IAAI,oBAChB,0CAA0C,SAAS,4BACrD;CACA,IAAI,UAAU,KAAA,GAAW,OAAO,eAAe,OAAO,SAAS,EAAE,OAAO,MAAM,CAAC;CAC/E,OAAO;AACT;AAEA,SAAS,iBAAiB,UAAkB,OAAkC;CAC5E,MAAM,UAAU,UAAU,QAAQ;CAClC,IAAI,CAAC,SAAS;CACd,IAAI,eAAe,OAAO,MAAM,eAAe,KAAK,GAClD,MAAM,IAAI,oBAAoB,kDAAkD,SAAS,EAAE;CAE7F,IAAI;EACF,WAAW,QAAQ;CACrB,SAAS,OAAO;EACd,IAAI,CAAC,UAAU,KAAK,GAAG,MAAM;CAC/B;AACF;AAEA,SAAS,eAAe,OAAoC;CAC1D,OAAO,KAAK,UAAU;EAAE,MAAM,MAAM;EAAM,OAAO,MAAM;EAAO,KAAK,MAAM;CAAI,CAAC;AAChF;AAEA,SAAS,aAAa,UAA0B;CAC9C,OAAO,GAAG,SAAS;AACrB;AAEA,SAAS,gBAAgB,OAAyB;CAChD,OAAO,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS;AACrE;AAEA,SAAS,UAAU,OAAyB;CAC1C,OAAO,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS;AACrE;AAEA,SAAS,gBAAgB,OAAyB;CAChD,OAAO,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS;AACrE;AAEA,SAAS,eAAe,MAAoB;CAC1C,IAAI;EACF,WAAW,IAAI;CACjB,SAAS,OAAO;EACd,IAAI,CAAC,UAAU,KAAK,GAAG,MAAM;CAC/B;AACF;;;;;;;;;;;;;;AC9RA,IAAa,QAAb,MAAmB;CACjB,SAAiB;CACjB,UAA8C,CAAC;CAE/C,MAAM,UAA+B;EACnC,IAAI,CAAC,KAAK,QAAQ;GAChB,KAAK,SAAS;GACd,aAAa,KAAK,QAAQ;EAC5B;EACA,OAAO,IAAI,SAAqB,YAAY;GAC1C,KAAK,QAAQ,WAAW;IACtB,cAAc,KAAK,QAAQ,CAAC;GAC9B,CAAC;EACH,CAAC;CACH;CAEA,UAAwB;EACtB,MAAM,OAAO,KAAK,QAAQ,MAAM;EAChC,IAAI,MACF,KAAK;OAEL,KAAK,SAAS;CAElB;CAEA,MAAM,aAAgB,IAAsC;EAC1D,MAAM,UAAU,MAAM,KAAK,QAAQ;EACnC,IAAI;GACF,OAAO,MAAM,GAAG;EAClB,UAAU;GACR,QAAQ;EACV;CACF;;CAGA,IAAI,WAAoB;EACtB,OAAO,KAAK;CACd;;CAGA,IAAI,UAAkB;EACpB,OAAO,KAAK,QAAQ;CACtB;AACF;;AAWA,eAAsB,mBAAsB,SAAqD;CAC/F,IAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,KAAK,QAAQ,QAAQ,GAC1D,MAAM,IAAI,MAAM,GAAG,QAAQ,MAAM,sCAAsC;CAEzE,IAAI,CAAC,OAAO,cAAc,QAAQ,cAAc,KAAK,QAAQ,iBAAiB,GAC5E,MAAM,IAAI,MAAM,GAAG,QAAQ,MAAM,2CAA2C;CAG9E,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,wBAAwB,WAAW,MAAM,QAAQ,QAAQ,MAAM;CACrE,IAAI,QAAQ,QAAQ,SAAS,gBAAgB;MACxC,QAAQ,QAAQ,iBAAiB,SAAS,iBAAiB,EAAE,MAAM,KAAK,CAAC;CAE9E,MAAM,UAAU,IAAI,MAAS,QAAQ,KAAK;CAC1C,IAAI,YAAY;CAChB,IAAI,SAAS;CACb,IAAI;CACJ,MAAM,UAAU,MAAM,KACpB,EAAE,QAAQ,KAAK,IAAI,QAAQ,gBAAgB,QAAQ,KAAK,EAAE,GAC1D,YAAY;EACV,OAAO,CAAC,WAAW,OAAO,SAAS;GACjC,MAAM,QAAQ;GACd,aAAa;GACb,IAAI,SAAS,QAAQ,OAAO;GAC5B,IAAI;IACF,QAAQ,SAAS,MAAM,QAAQ,IAAI,OAAO,WAAW,MAAM;GAC7D,SAAS,OAAO;IACd,IAAI,CAAC,QAAQ;KACX,SAAS;KACT,eAAe;KACf,WAAW,MAAM,KAAK;IACxB;IACA;GACF;EACF;CACF,CACF;CAEA,IAAI;EACF,MAAM,QAAQ,IAAI,OAAO;EACzB,IAAI,QAAQ,QAAQ,SAAS,MAAM,WAAW,QAAQ,QAAQ,QAAQ,KAAK;EAC3E,IAAI,QAAQ,MAAM;EAClB,IAAI,WAAW,OAAO,SAAS,MAAM,WAAW,WAAW,QAAQ,QAAQ,KAAK;EAChF,OAAO;CACT,UAAU;EACR,QAAQ,QAAQ,oBAAoB,SAAS,eAAe;CAC9D;AACF;;;;;;AAOA,eAAsB,cACpB,OACA,aACA,KACA,QACc;CACd,OAAO,mBAAmB;EACxB,OAAO,MAAM;EACb,gBAAgB;EAChB,OAAO;EACP;EACA,IAAI,OAAO,QAAQ;GACjB,OAAO,IAAI,MAAM,QAAS,OAAO,MAAM;EACzC;CACF,CAAC;AACH;AAEA,SAAS,WAAW,QAAqB,OAAsB;CAC7D,OAAO,OAAO,kBAAkB,QAAQ,OAAO,yBAAS,IAAI,MAAM,GAAG,MAAM,SAAS;AACtF;;;;;;ACjHA,SAAgB,iBAAiB,MAAc,MAAc,SAAkC;CAC7F,UAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CAC5C,sBAAsB,MAAM,OAAO;CACnC,MAAM,KAAK,SAAS,MAAM,UAAU,UAAU,UAAU,WAAW,UAAU,UAAU,GAAK;CAC5F,IAAI;EACF,SAAS,IAAI,OAAO,KAAK,MAAM,MAAM,GAAG,OAAO;EAC/C,UAAU,EAAE;CACd,UAAU;EACR,UAAU,EAAE;CACd;CACA,eAAe,QAAQ,IAAI,CAAC;AAC9B;AAEA,SAAS,sBAAsB,MAAc,SAAkC;CAC7E,IAAI;CACJ,IAAI;EACF,KAAK,SAAS,MAAM,UAAU,MAAM;CACtC,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAAU;EACxD,MAAM,QAAQ,eAAe,GAAG,QAAQ,QAAQ,GAAG,KAAK,oCAAoC,EAC1F,OAAO,MACT,CAAC;CACH;CAEA,IAAI;EACF,MAAM,OAAO,UAAU,EAAE,CAAC,CAAC;EAC3B,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,IAAM;EACnD,MAAM,YAAY,mBAAmB,IAAI,IAAI;EAC7C,MAAM,cAAc,OAAO,MAAM,OAAO,WAAW,EAAI;EACvD,YAAY,YAAY,SAAS,KAAK;EACtC,WAAW,IAAI,aAAa,WAAW,OAAO;EAC9C,UAAU,EAAE;CACd,SAAS,OAAO;EACd,MAAM,QAAQ,eACZ,GAAG,QAAQ,QAAQ,GAAG,KAAK,4CAC3B,EAAE,OAAO,MAAM,CACjB;CACF,UAAU;EACR,UAAU,EAAE;CACd;AACF;;;;AAKA,SAAgB,0BACd,MACA,UACA,SACM;CACN,MAAM,YAAY,QAAQ,IAAI;CAC9B,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;CACxC,MAAM,gBAAgB,GAAG,KAAK;CAC9B,MAAM,KAAK,SACT,eACA,UAAU,UAAU,UAAU,WAAW,UAAU,SACnD,GACF;CACA,IAAI;EACF,SAAS,IAAI,OAAO,KAAK,UAAU,MAAM,GAAG,OAAO;EACnD,UAAU,EAAE;CACd,UAAU;EACR,UAAU,EAAE;CACd;CACA,WAAW,eAAe,IAAI;CAC9B,eAAe,SAAS;AAC1B;;;;;AAMA,SAAgB,iBAAiB,MAAc,SAAqC;CAClF,IAAI;EACF,OAAO,MAAM,EAAE,WAAW,KAAK,CAAC;CAClC,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAAU,OAAO;EAC/D,MAAM,QAAQ,eAAe,GAAG,QAAQ,QAAQ,GAAG,KAAK,wBAAwB,EAC9E,OAAO,MACT,CAAC;CACH;CACA,eAAe,QAAQ,IAAI,CAAC;CAC5B,OAAO;AACT;AAEA,SAAgB,mBAAsB,MAAc,SAA4B,KAAiB;CAC/F,MAAM,SAAS,sBAAsB,MAAM,SAAS,GAAG;CACvD,IAAI,CAAC,OAAO,UACV,MAAM,QAAQ,eAAe,GAAG,QAAQ,QAAQ,iBAAiB,KAAK,EAAE;CAE1E,OAAO,OAAO;AAChB;AAIA,SAAgB,sBACd,MACA,SACA,KACmB;CACnB,UAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CAC5C,MAAM,WAAW,GAAG,KAAK;CACzB,IAAI;EACF,MAAM,cAAc,yBAAyB,EAAE,SAAS,CAAC;EACzD,IAAI,CAAC,YAAY,UAAU,OAAO,EAAE,UAAU,MAAM;EACpD,IAAI;GACF,OAAO;IAAE,UAAU;IAAM,OAAO,IAAI;GAAE;EACxC,UAAU;GACR,YAAY,KAAK,QAAQ;EAC3B;CACF,SAAS,OAAO;EACd,IAAI,iBAAiB,qBACnB,MAAM,QAAQ,eAAe,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;EAE9D,MAAM;CACR;AACF;AAEA,SAAS,SAAS,IAAY,OAAe,SAAkC;CAC7E,IAAI,SAAS;CACb,OAAO,SAAS,MAAM,YAAY;EAChC,MAAM,UAAU,UAAU,IAAI,OAAO,QAAQ,MAAM,aAAa,MAAM;EACtE,IAAI,WAAW,GAAG,MAAM,QAAQ,eAAe,6BAA6B;EAC5E,UAAU;CACZ;AACF;AAEA,SAAS,WAAW,IAAY,OAAe,UAAkB,SAAkC;CACjG,IAAI,SAAS;CACb,OAAO,SAAS,MAAM,YAAY;EAChC,MAAM,UAAU,UAAU,IAAI,OAAO,QAAQ,MAAM,aAAa,QAAQ,WAAW,MAAM;EACzF,IAAI,WAAW,GAAG,MAAM,QAAQ,eAAe,6BAA6B;EAC5E,UAAU;CACZ;AACF;AAEA,SAAS,mBAAmB,IAAY,MAAsB;CAC5D,MAAM,QAAQ,OAAO,MAAM,KAAK,IAAI,MAAO,IAAI,CAAC;CAChD,IAAI,SAAS;CACb,OAAO,SAAS,GAAG;EACjB,MAAM,SAAS,KAAK,IAAI,MAAM,YAAY,MAAM;EAChD,UAAU;EACV,MAAM,OAAO,SAAS,IAAI,OAAO,GAAG,QAAQ,MAAM;EAClD,KAAK,IAAI,QAAQ,OAAO,GAAG,SAAS,GAAG,SAAS,GAC9C,IAAI,MAAM,WAAW,IAAM,OAAO,SAAS,QAAQ;CAEvD;CACA,OAAO;AACT;AAEA,SAAS,SAAS,IAAY,UAA0B;CACtD,MAAM,OAAO,OAAO,YAAY,CAAC;CAEjC,OADa,SAAS,IAAI,MAAM,GAAG,GAAG,QAC5B,MAAM,IAAI,KAAK,KAAM;AACjC;AAEA,SAAS,eAAe,MAAoB;CAC1C,MAAM,KAAK,SAAS,MAAM,UAAU,QAAQ;CAC5C,IAAI;EACF,UAAU,EAAE;CACd,UAAU;EACR,UAAU,EAAE;CACd;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACtHA,SAAgB,mBAAmB,aAA6B;CAC9D,OAAO,GAAG,YAAY;AACxB;AAEA,MAAM,wBACJ;;;;;AAMF,SAAgB,oBACd,MACA,SAC0B;CAC1B,IAAI;CACJ,IAAI;EACF,OAAO,aAAa,MAAM,MAAM;CAClC,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAAU,OAAO;EAC/D,MAAM,QAAQ,eACZ,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,qBAAqB,yBAC7D,EAAE,OAAO,MAAM,CACjB;CACF;CACA,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,MAAM,IAAI;CACvB,SAAS,OAAO;EACd,MAAM,QAAQ,eACZ,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,qBAAqB,yBAC7D,EAAE,OAAO,MAAM,CACjB;CACF;CACA,IAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,MAAM,QAAQ,GAAG,GAC9D,MAAM,QAAQ,eACZ,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,oBAAoB,uBAC9D;CAEF,MAAM,SAAS;CACf,MAAM,OAAO,OAAO,KAAK,MAAM,CAAC,CAAC,KAAK;CACtC,IAAI,KAAK,WAAW,KAAK,KAAK,OAAO,eAAe,KAAK,OAAO,YAC9D,MAAM,QAAQ,eACZ,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,aAAa,KAAK,KAAK,IAAI,EAAE,oCAAoC,uBAC3G;CAEF,MAAM,EAAE,UAAU,cAAc;CAChC,IAAI,OAAO,aAAa,YAAY,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,GAChF,MAAM,QAAQ,eACZ,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,0CAA0C,uBACpF;CAEF,IAAI,OAAO,cAAc,YAAY,CAAC,oBAAoB,KAAK,SAAS,GACtE,MAAM,QAAQ,eACZ,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,oCAAoC,uBAC9E;CAEF,OAAO;EAAE;EAAqB;CAAwB;AACxD;;;;;;;;;;AAWA,SAAgB,qBACd,MACA,MACA,SACM;CACN,IAAI;EACF,0BAA0B,MAAM,GAAG,gBAAgB,IAAI,EAAE,KAAK,OAAO;CACvE,SAAS,OAAO;EACd,MAAM,QAAQ,eAAe,GAAG,QAAQ,QAAQ,gBAAgB,KAAK,wBAAwB,EAC3F,OAAO,MACT,CAAC;CACH;AACF;;;;;;;AAmBA,SAAgB,qBACd,MACA,SAC0B;CAC1B,IAAI,OAAiC;CACrC,IAAI,aAAa;CACjB,IAAI;EACF,OAAO,oBAAoB,MAAM,OAAO;CAC1C,SAAS,OAAO;EAId,aAAa,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CACpE;CACA,MAAM,UAAU,iBAAiB,MAAM,OAAO;CAC9C,IAAI;CACJ,IAAI;EAGF,iBAAiB,GAAG,KAAK,OAAO,OAAO;CACzC,SAAS,OAAO;EACd,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CACtE;CACA,MAAM,UAAU,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;CACjE,IAAI,CAAC,SAAS,OAAO;EAAE,SAAS;EAAO,GAAG;CAAQ;CAClD,IAAI,SAAS,MAAM,OAAO;EAAE,SAAS;EAAM,MAAM;EAAM;EAAY,GAAG;CAAQ;CAC9E,OAAO;EAAE,SAAS;EAAM;EAAM,GAAG;CAAQ;AAC3C;;;;AAcA,SAAgB,gCACd,SACA,MACA,SACA,QACM;CAIN,IAAI,OAAO,WAAW,YAAY,WAAW,MAC3C,MAAM,IAAI,UACR,6FACF;CAEF,MAAM,EAAE,SAAS,oBAAoB;CACrC,MAAM,SAAS,QAAQ,KAAK;CAC5B,IAAI,WAAW,KAAA,GACb,MAAM,QAAQ,eACZ,GAAG,QAAQ,gBAAgB,gBAAgB,iBAAiB,KAAK,SAAS,IAAI,KAAK,UAAU,wBAAwB,QAAQ,OAAO,gKACtI;CAEF,IAAI,OAAO,aAAa,KAAK,UAC3B,MAAM,QAAQ,eACZ,GAAG,QAAQ,kBAAkB,KAAK,SAAS,oBAAoB,OAAO,SAAS,uDAAuD,iBACxI;CAEF,IAAI,OAAO,cAAc,KAAK,WAC5B,MAAM,QAAQ,eACZ,GAAG,QAAQ,4BAA4B,KAAK,SAAS,WAAW,OAAO,UAAU,wBAAwB,gBAAgB,YAAY,KAAK,UAAU,qHACtJ;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;ACpHA,MAAM,iCAAiB,IAAI,IAAmB;AAE9C,SAAS,SAAS,MAAqB;CACrC,MAAM,WAAW,eAAe,IAAI,IAAI;CACxC,IAAI,UAAU,OAAO;CACrB,MAAM,QAAQ,IAAI,MAAM;CACxB,eAAe,IAAI,MAAM,KAAK;CAC9B,OAAO;AACT;;;AAIA,IAAa,oBAAb,MAAiG;CAC/F;;CAEA;CACA;CACA;CACA;CAEA,YACE,MACA,OACA,UAAoC,CAAC,GACrC;EACA,KAAK,OAAO,QAAQ,IAAI;EACxB,KAAK,kBAAkB,mBAAmB,KAAK,IAAI;EACnD,KAAK,QAAQ;EACb,KAAK,QAAQ,SAAS,KAAK,IAAI;EAC/B,KAAK,qBAAqB,QAAQ,uBAAuB;CAC3D;CAEA,MAAM,SAAgF;EACpF,OAAO,KAAK,MAAM,mBAChB,mBAAmB,KAAK,MAAM,KAAK,aAAa,KAAK,aAAa,CAAC,CACrE;CACF;CAEA,MAAM,OACJ,OACA,UAA+B,CAAC,GACuC;EACvE,OAAO,KAAK,MAAM,mBAChB,mBAAmB,KAAK,MAAM,KAAK,aAAa;GAC9C,MAAM,SAAS,KAAK,aAAa;GACjC,MAAM,WAAW,OAAO,QAAQ,MAAM,UAAU,MAAM,MAAM,YAAY,MAAM,OAAO;GACrF,IAAI,UAAU;IACZ,IAAI,gBAAgB,SAAS,KAAK,MAAM,gBAAgB,KAAK,GAC3D,MAAM,KAAK,MAAM,cACf,WAAW,MAAM,QAAQ,uCAC3B;IAEF,IAAI,QAAQ,YAAY,MAAM,KAAK,gBAAgB,UAAU,OAAO,OAAO;IAC3E,OAAO;KAAE,OAAO;KAAU,UAAU;KAAO,YAAY,OAAO;IAAW;GAC3E;GAEA,MAAM,WAAW;IACf,GAAG,KAAK,MAAM;IACd,UAAU,OAAO,QAAQ;IACzB,cAAc,OAAO,QAAQ,GAAG,EAAE,CAAC,EAAE,aAAa;IAClD;GACF;GACA,MAAM,QAAQ;IAAE,GAAG;IAAU,WAAW,cAAc,QAAQ;GAAE;GAIhE,MAAM,aAAa,KAAK,QAAQ,CAAC,GAAG,OAAO,SAAS,KAAK,CAAC;GAC1D,iBAAiB,KAAK,MAAM,GAAG,gBAAgB,KAAK,EAAE,KAAK,KAAK,KAAK;GACrE,IAAI,QAAQ,YAAY,MAOtB,qBACE,KAAK,iBACL;IAAE,UAAU,MAAM;IAAU,WAAW,MAAM;GAAU,GACvD,KAAK,KACP;GAEF,OAAO;IAAE;IAAO,UAAU;IAAM;GAAW;EAC7C,CAAC,CACH;CACF;;CAGA,MAAM,cAAiD;EACrD,OAAO,KAAK,MAAM,mBAChB,mBAAmB,KAAK,MAAM,KAAK,aACjC,oBAAoB,KAAK,iBAAiB,KAAK,KAAK,CACtD,CACF;CACF;;;;CAKA,MAAM,iBAA6C;EACjD,OAAO,KAAK,MAAM,mBAChB,mBAAmB,KAAK,MAAM,KAAK,aAAa;GAC9C,MAAM,UAAU,KAAK,YAAY;GACjC,KAAK,QAAQ,OAAO;GAGpB,KAAK,kBAAkB,SAAS,KAAK;GACrC,MAAM,OAAO,QAAQ,GAAG,EAAE;GAC1B,IAAI,SAAS,KAAA,GACX,MAAM,KAAK,MAAM,eACf,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK,KAAK,mCACrC;GAEF,MAAM,OAA0B;IAAE,UAAU,KAAK;IAAU,WAAW,KAAK;GAAU;GACrF,qBAAqB,KAAK,iBAAiB,MAAM,KAAK,KAAK;GAC3D,OAAO;EACT,CAAC,CACH;CACF;;;;;;;;CASA,MAAM,mBAAsD;EAC1D,OAAO,KAAK,MAAM,mBAChB,mBAAmB,KAAK,MAAM,KAAK,aACjC,qBAAqB,KAAK,iBAAiB,KAAK,KAAK,CACvD,CACF;CACF;;;;;;;;;;;;;CAcA,gBACE,OACA,SACM;EACN,MAAM,SAAS,oBAAoB,KAAK,iBAAiB,KAAK,KAAK;EACnE,IAAI,WAAW,MACT;OAAA,MAAM,aAAa,QAAQ,SAAS,GAAG;EAAA,OACtC,IAAI,OAAO,YAAY,MAAM,UAClC;EAEF,qBACE,KAAK,iBACL;GAAE,UAAU,MAAM;GAAU,WAAW,MAAM;EAAU,GACvD,KAAK,KACP;CACF;CAEA,eAAqF;EACnF,MAAM,UAAU,KAAK,YAAY;EACjC,MAAM,aAAa,KAAK,QAAQ,OAAO;EAIvC,KAAK,kBAAkB,SAAS,KAAK,kBAAkB;EACvD,OAAO;GAAE;GAAS;EAAW;CAC/B;CAEA,kBAA0B,SAAyC,YAA2B;EAC5F,MAAM,SAAS,oBAAoB,KAAK,iBAAiB,KAAK,KAAK;EACnE,IAAI,WAAW,MAAM;GACnB,IAAI,cAAc,QAAQ,SAAS,GACjC,MAAM,KAAK,MAAM,eACf,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK,KAAK,OAAO,QAAQ,OAAO,kCAAkC,KAAK,gBAAgB,wIAClH;GAEF;EACF;EACA,gCAAgC,SAAS,QAAQ,KAAK,OAAO;GAC3D,SAAS,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK;GACvC,iBAAiB,KAAK;EACxB,CAAC;CACH;CAEA,cAAsD;EACpD,IAAI,CAAC,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC;EACpC,MAAM,OAAO,aAAa,KAAK,MAAM,MAAM;EAC3C,IAAI,KAAK,WAAW,GAAG,OAAO,CAAC;EAC/B,IAAI,CAAC,KAAK,SAAS,IAAI,GACrB,MAAM,KAAK,MAAM,eACf,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK,KAAK,gDACrC;EAGF,MAAM,QAAQ,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,IAAI;EAC1C,MAAM,UAA0C,CAAC;EACjD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;GACpD,MAAM,OAAO,MAAM;GACnB,IAAI,KAAK,WAAW,GAClB,MAAM,KAAK,MAAM,eACf,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK,KAAK,2BAA2B,QAAQ,GACxE;GAEF,IAAI;GACJ,IAAI;IACF,MAAM,KAAK,MAAM,IAAI;GACvB,SAAS,OAAO;IACd,MAAM,KAAK,MAAM,eACf,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK,KAAK,4BAA4B,QAAQ,KACvE,EAAE,OAAO,MAAM,CACjB;GACF;GACA,MAAM,QAAQ,KAAK,MAAM,WAAW,KAAK;IAAE,MAAM,KAAK;IAAM,MAAM,QAAQ;GAAE,CAAC;GAC7E,IAAI;GACJ,IAAI;IACF,YAAY,gBAAgB,KAAK;GACnC,SAAS,OAAO;IACd,MAAM,KAAK,MAAM,eACf,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK,KAAK,iDAAiD,QAAQ,KAC5F,EAAE,OAAO,MAAM,CACjB;GACF;GACA,IAAI,SAAS,WACX,MAAM,KAAK,MAAM,eACf,GAAG,KAAK,MAAM,QAAQ,GAAG,KAAK,KAAK,mCAAmC,QAAQ,GAChF;GAEF,QAAQ,KAAK,KAAK;EACpB;EACA,OAAO;CACT;CAEA,QAAgB,SAAqD;EACnE,MAAM,YAAY,KAAK,MAAM,gBAAgB;EAC7C,MAAM,2BAAW,IAAI,IAAY;EACjC,IAAI,mBAAsC;EAC1C,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,GAAG;GACtD,MAAM,QAAQ,QAAQ;GACtB,KAAK,MAAM,iBAAiB,OAAO,KAAK;GACxC,IAAI,MAAM,aAAa,OACrB,MAAM,KAAK,MAAM,eACf,SAAS,MAAM,MAAM,QAAQ,gBAAgB,MAAM,SAAS,aAAa,OAC3E;GAEF,IAAI,MAAM,iBAAiB,kBACzB,MAAM,KAAK,MAAM,eACf,SAAS,MAAM,MAAM,QAAQ,mCAC/B;GAEF,MAAM,EAAE,WAAW,YAAY,GAAG,aAAa;GAC/C,MAAM,eAAe,cAAc,QAAQ;GAC3C,IAAI,MAAM,cAAc,cACtB,MAAM,KAAK,MAAM,eACf,SAAS,MAAM,MAAM,QAAQ,2BAA2B,aAAa,QAAQ,MAAM,WACrF;GAEF,mBAAmB,MAAM;GACzB,IAAI,SAAS,IAAI,MAAM,MAAM,OAAO,GAClC,MAAM,KAAK,MAAM,eACf,qBAAqB,MAAM,MAAM,QAAQ,mBAC3C;GAEF,SAAS,IAAI,MAAM,MAAM,OAAO;GAChC,UAAU,MAAM,OAAO,KAAK;EAC9B;EACA,OAAO,UAAU,OAAO,OAAO;CACjC;AACF"}

package/dist/{llm-client-hgDieDNN.js → llm-client-BFMRpmqb.js}

@@ -1,5 +1,6 @@
 import { t as AgentEvalError } from "./errors-Dngq5h35.js";
 import { c as costForTokenPricing } from "./cost-ledger-B1qx30B4.js";
+import { t as newRecordId } from "./record-id-DUgsK5qp.js";
 import { a as providerFromBaseUrl, i as defaultProviderRedactor } from "./raw-provider-sink-BQd7mzyT.js";
 //#region src/judge-families.ts
 /** Explicit `provider/...` prefix → family (models.dev / OpenRouter style). */
@@ -692,7 +693,7 @@ async function callLlm(req, opts = {}) {
 		const requestBody = buildBody(effectiveRequest, opts.jsonSchemaTransport === "json-object", opts.thinking);
 		let attemptErrorRecorded = false;
 		if (sink) await recordRaw(sink, redactor, {
-			eventId: cryptoEventId(),
+			eventId: newRecordId(),
 			runId: traceContext?.runId,
 			spanId: traceContext?.spanId,
 			provider,
@@ -719,7 +720,7 @@ async function callLlm(req, opts = {}) {
 				const body = await res.text();
 				if (sink) {
 					await recordRaw(sink, redactor, {
-						eventId: cryptoEventId(),
+						eventId: newRecordId(),
 						runId: traceContext?.runId,
 						spanId: traceContext?.spanId,
 						provider,
@@ -761,7 +762,7 @@ async function callLlm(req, opts = {}) {
 			} catch (parseErr) {
 				if (sink) {
 					await recordRaw(sink, redactor, {
-						eventId: cryptoEventId(),
+						eventId: newRecordId(),
 						runId: traceContext?.runId,
 						spanId: traceContext?.spanId,
 						provider,
@@ -783,7 +784,7 @@ async function callLlm(req, opts = {}) {
 				throw parseErr;
 			}
 			if (sink) await recordRaw(sink, redactor, {
-				eventId: cryptoEventId(),
+				eventId: newRecordId(),
 				runId: traceContext?.runId,
 				spanId: traceContext?.spanId,
 				provider,
@@ -844,7 +845,7 @@ async function callLlm(req, opts = {}) {
 			lastErr = err;
 			if (callerSignal?.aborted) {
 				if (sink && !attemptErrorRecorded) await recordRaw(sink, redactor, {
-					eventId: cryptoEventId(),
+					eventId: newRecordId(),
 					runId: traceContext?.runId,
 					spanId: traceContext?.spanId,
 					provider,
@@ -861,7 +862,7 @@ async function callLlm(req, opts = {}) {
 				throw err;
 			}
 			if (sink && !attemptErrorRecorded) await recordRaw(sink, redactor, {
-				eventId: cryptoEventId(),
+				eventId: newRecordId(),
 				runId: traceContext?.runId,
 				spanId: traceContext?.spanId,
 				provider,
@@ -896,10 +897,6 @@ function headersToObject(h) {
 	});
 	return out;
 }
-function cryptoEventId() {
-	if (typeof globalThis.crypto?.randomUUID === "function") return globalThis.crypto.randomUUID();
-	return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
-}
 /**
 * Structured-output call. Returns parsed JSON plus the raw result envelope.
 * Degrades `jsonSchema` → `jsonMode` on a 400 that names the schema param —
@@ -976,4 +973,4 @@ var LlmClient = class {
 //#endregion
 export { judgeFamily as S, assertServedModels as _, callLlmJson as a, CrossFamilyError as b, extractJsonPayload as c, stripFencedJson as d, ModelSubstitutionError as f, assertServedModelPolicy as g, assertServedModel as h, backoffMs as i, isTransientLlmError as l, assertCrossFamilyServed as m, LlmClient as n, costReceiptFromLlm as o, ServedCrossFamilyError as p, LlmResponseError as r, costReceiptFromLlmError as s, LlmCallError as t, maximumChargeForLlmRequest as u, checkServedModel as v, assertCrossFamily as x, servedModelAcceptable as y };
 
-//# sourceMappingURL=llm-client-hgDieDNN.js.map
+//# sourceMappingURL=llm-client-BFMRpmqb.js.map

package/dist/llm-client-BFMRpmqb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-client-BFMRpmqb.js","names":[],"sources":["../src/judge-families.ts","../src/integrity/served-model.ts","../src/llm-client.ts"],"sourcesContent":["/**\n * Judge model-family classification + cross-family enforcement.\n *\n * A judge ensemble built entirely from one provider family shares that\n * family's blind spots and self-preference — its \"agreement\" is correlated\n * bias, not independent signal. `assertCrossFamily` makes the consumer prove\n * the ensemble spans ≥2 families; `judgeFamily` is the single regex map that\n * replaces the per-consumer copies (tax/legal/creative/gtm each ship one).\n */\n\n/** Provider family a model belongs to. `unknown` when no rule matches. */\nexport type JudgeFamily =\n  | 'anthropic'\n  | 'openai'\n  | 'google'\n  | 'meta'\n  | 'mistral'\n  | 'deepseek'\n  | 'xai'\n  | 'qwen'\n  | 'cohere'\n  | 'amazon'\n  | 'moonshot'\n  | 'zhipu'\n  | 'unknown'\n\n/** Explicit `provider/...` prefix → family (models.dev / OpenRouter style). */\nconst PROVIDER_PREFIX: Record<string, JudgeFamily> = {\n  anthropic: 'anthropic',\n  openai: 'openai',\n  'azure-openai': 'openai',\n  google: 'google',\n  'google-vertex': 'google',\n  meta: 'meta',\n  'meta-llama': 'meta',\n  mistral: 'mistral',\n  mistralai: 'mistral',\n  deepseek: 'deepseek',\n  xai: 'xai',\n  qwen: 'qwen',\n  alibaba: 'qwen',\n  cohere: 'cohere',\n  amazon: 'amazon',\n  bedrock: 'amazon',\n  moonshot: 'moonshot',\n  moonshotai: 'moonshot',\n  kimi: 'moonshot',\n  'kimi-code': 'moonshot',\n  zhipu: 'zhipu',\n  zhipuai: 'zhipu',\n  zai: 'zhipu',\n  'z-ai': 'zhipu',\n  glm: 'zhipu',\n}\n\n/** Fallback model-name patterns when there's no recognised provider prefix. */\nconst NAME_PATTERNS: Array<[RegExp, JudgeFamily]> = [\n  [/claude/i, 'anthropic'],\n  [/\\b(gpt|davinci|babbage)\\b|^o[134]\\b|[-/]o[134]\\b|gpt-/i, 'openai'],\n  [/gemini|palm|gemma|bison/i, 'google'],\n  [/llama/i, 'meta'],\n  [/mi(s|x)tral|codestral|magistral/i, 'mistral'],\n  [/deepseek/i, 'deepseek'],\n  [/grok/i, 'xai'],\n  [/qwen/i, 'qwen'],\n  [/command-?(r|a)?/i, 'cohere'],\n  [/\\b(nova|titan)\\b/i, 'amazon'],\n  [/\\bkimi\\b|moonshot/i, 'moonshot'],\n  [/\\bglm\\b|zhipu|\\bz-?ai\\b/i, 'zhipu'],\n]\n\n/**\n * Classify a model id into its provider family. Strips a `@snapshot` suffix\n * and prefers an explicit `provider/...` prefix; otherwise matches the model\n * name. Returns `unknown` when nothing matches (callers decide whether that's\n * acceptable — `assertCrossFamily` counts it as its own family).\n */\nexport function judgeFamily(modelId: string): JudgeFamily {\n  const id = modelId.trim().split('@')[0]!.toLowerCase()\n  const slash = id.indexOf('/')\n  if (slash > 0) {\n    const prefix = id.slice(0, slash)\n    const mapped = PROVIDER_PREFIX[prefix]\n    if (mapped) return mapped\n  }\n  for (const [pattern, family] of NAME_PATTERNS) {\n    if (pattern.test(id)) return family\n  }\n  return 'unknown'\n}\n\nexport interface AssertCrossFamilyOptions {\n  /** Minimum number of distinct families the ensemble must span. Default 2. */\n  minFamilies?: number\n  /** When false (default), `unknown`-family models do NOT count toward the\n   *  family total — an ensemble of all-unclassifiable models is not provably\n   *  cross-family. Set true to count `unknown` as one shared family. */\n  allowUnknown?: boolean\n}\n\nexport class CrossFamilyError extends Error {\n  constructor(\n    message: string,\n    public readonly families: JudgeFamily[],\n    public readonly models: string[],\n  ) {\n    super(message)\n    this.name = 'CrossFamilyError'\n  }\n}\n\n/**\n * Throw unless the judge models span at least `minFamilies` distinct provider\n * families. Pass the model ids backing your judge ensemble. Fail-loud by\n * design — a correlated single-family ensemble silently inflates agreement.\n *\n * Scope: this reads the ids you REQUEST. It proves the panel was configured\n * across families; it cannot prove the panel RAN across families, because a\n * routing gateway may answer several different ids from one provider. Where\n * the diversity claim is load-bearing (a published leaderboard, a\n * certification, a non-self-judging exclusion), assert on the ids the\n * provider echoed instead: `assertCrossFamilyServed` in\n * ./integrity/served-model.\n */\nexport function assertCrossFamily(\n  models: string[],\n  opts: AssertCrossFamilyOptions = {},\n): JudgeFamily[] {\n  const minFamilies = opts.minFamilies ?? 2\n  const families = new Set<JudgeFamily>()\n  for (const m of models) {\n    const f = judgeFamily(m)\n    if (f === 'unknown' && !opts.allowUnknown) continue\n    families.add(f)\n  }\n  const list = [...families].sort()\n  if (list.length < minFamilies) {\n    throw new CrossFamilyError(\n      `judge ensemble spans ${list.length} provider famil${list.length === 1 ? 'y' : 'ies'} ` +\n        `(${list.join(', ') || 'none'}) but ${minFamilies} required — a single-family ensemble ` +\n        'is correlated bias, not independent signal',\n      list,\n      models,\n    )\n  }\n  return list\n}\n","/**\n * Served-model identity: prove the model that ANSWERED is the model that was\n * REQUESTED.\n *\n * A routing gateway can accept `model: \"gpt-4.1-mini\"` and answer from a\n * different model entirely. Every guard that reasons about the requested id —\n * cross-family judge diversity, per-model leaderboard rows, non-self-judging\n * exclusions, cost attribution — then passes while measuring something else.\n * The requested id is an intent; only the id echoed on the response is\n * evidence.\n *\n * `checkServedModel` classifies one requested/served pair; `assertServedModel`\n * and `assertServedModels` are the fail-loud gates; `assertCrossFamilyServed`\n * is the family-diversity rule computed over SERVED ids (the requested-id\n * version lives in ../judge-families and cannot see substitution).\n *\n * Aliasing is tolerated, substitution is not: `openai/gpt-4.1-mini` and\n * `gpt-4.1-mini` are the same request expressed two ways, so a response\n * echoing either satisfies the other. A response echoing `gemini-2.5-flash-lite`\n * does not.\n */\n\nimport { AgentEvalError } from '../errors'\nimport { type JudgeFamily, judgeFamily } from '../judge-families'\n\n/**\n * Output-token budget a liveness probe must grant a model.\n *\n * Identity is only readable off a response the provider actually produced. A\n * reasoning model spends budget on hidden reasoning tokens before it emits a\n * single visible one, so a cap of a few tokens makes a HEALTHY deepseek/glm\n * model fail with `reasoning_budget_exhausted` — it names no model, its\n * identity reads as `unreported`, and a preflight scores it DEAD. 64 clears\n * that floor. Every probe in this package reads this constant, so two probes\n * cannot reach two different answers about the same router.\n *\n * Cost: a probe spends at most `PROBE_MAX_TOKENS` output tokens per model,\n * plus whatever reasoning tokens a reasoning model bills — roughly 400 output\n * tokens for a six-model preflight. That is fractions of a cent, and far\n * cheaper than a campaign that runs on a model nobody proved was alive.\n */\nexport const PROBE_MAX_TOKENS = 64\n\n/** How a served id relates to the id that was requested. */\nexport type ServedModelVerdict =\n  /** Byte-identical after normalisation — the requested model answered. */\n  | 'exact'\n  /** Same model, different spelling (provider prefix, snapshot, tier suffix). */\n  | 'alias'\n  /** A different model of the SAME provider family answered. */\n  | 'substituted-within-family'\n  /** A different provider's model answered. */\n  | 'substituted-cross-family'\n  /** The response carried no model id — identity is unproven either way. */\n  | 'unreported'\n\nexport interface ServedModelCheck {\n  /** The id the caller asked for. */\n  requested: string\n  /** The id echoed on the response; `null` when the response omitted it. */\n  served: string | null\n  requestedFamily: JudgeFamily\n  /** `null` when `served` is null. */\n  servedFamily: JudgeFamily | null\n  verdict: ServedModelVerdict\n  /** True for every verdict except `exact` and `alias`. */\n  substituted: boolean\n}\n\n/**\n * Reduce a model id to its comparable core: lowercase, no surrounding space,\n * no `provider/` prefix, no `@snapshot` / `:batch` / `:free` tier suffix, no\n * trailing build date, and `.`/`_` folded to `-` so one version is spelled one\n * way.\n *\n * Dropping the build date is what makes snapshot resolution legible as the\n * non-event it is: a router answering `gpt-4o-mini` with\n * `gpt-4o-mini-2024-07-18` pinned a floating alias to a reproducible build —\n * the same model, which is the behaviour we want. Only routing decoration is\n * stripped; version digits are load-bearing, so `deepseek-v3.2` and\n * `deepseek-v4-flash` stay distinct, and comparison is EXACT equality rather\n * than a prefix test (a prefix rule would accept `gpt-5` → `gpt-5-mini`, a\n * silent downgrade wearing the right vendor name).\n */\nexport function normalizeModelId(modelId: string): string {\n  let id = modelId.trim().toLowerCase()\n  const at = id.indexOf('@')\n  if (at > 0) id = id.slice(0, at)\n  const colon = id.indexOf(':')\n  if (colon > 0) id = id.slice(0, colon)\n  const slash = id.lastIndexOf('/')\n  if (slash >= 0) id = id.slice(slash + 1)\n  return id\n    .replace(/-\\d{4}-\\d{2}-\\d{2}$/, '')\n    .replace(/-\\d{8}$/, '')\n    .replace(/[._]/g, '-')\n    .replace(/-+$/, '')\n    .trim()\n}\n\n/**\n * Classify one requested/served pair. Pure — no I/O — so it is safe inside\n * response handlers, reducers, and CI gates.\n *\n * `served` is the id echoed by the provider (OpenAI-compatible bodies put it\n * at `model`). `null`/`undefined` means the body omitted it; that is\n * `unreported`, NOT a pass — a provider that does not name what answered has\n * not proven identity, and a transport that drops the field must not read as\n * agreement.\n */\nexport function checkServedModel(\n  requested: string,\n  served: string | null | undefined,\n): ServedModelCheck {\n  const requestedFamily = judgeFamily(requested)\n  if (served === null || served === undefined || served.trim() === '') {\n    return {\n      requested,\n      served: null,\n      requestedFamily,\n      servedFamily: null,\n      verdict: 'unreported',\n      substituted: true,\n    }\n  }\n  const servedFamily = judgeFamily(served)\n  if (requested.trim().toLowerCase() === served.trim().toLowerCase()) {\n    return {\n      requested,\n      served,\n      requestedFamily,\n      servedFamily,\n      verdict: 'exact',\n      substituted: false,\n    }\n  }\n  if (normalizeModelId(requested) === normalizeModelId(served)) {\n    return {\n      requested,\n      served,\n      requestedFamily,\n      servedFamily,\n      verdict: 'alias',\n      substituted: false,\n    }\n  }\n  return {\n    requested,\n    served,\n    requestedFamily,\n    servedFamily,\n    verdict:\n      requestedFamily === servedFamily ? 'substituted-within-family' : 'substituted-cross-family',\n    substituted: true,\n  }\n}\n\nexport class ModelSubstitutionError extends AgentEvalError {\n  constructor(\n    message: string,\n    public readonly checks: ReadonlyArray<ServedModelCheck>,\n  ) {\n    super('model_substitution', message)\n    this.name = 'ModelSubstitutionError'\n  }\n}\n\n/**\n * Consumer-facing name for the substitution policy a metered surface applies.\n * `'exact'` rejects every substitution. `'allow-within-family'` accepts a\n * different model of the same provider family; it keeps family-level claims\n * valid and forfeits per-model claims. Maps to\n * `AssertServedModelOptions.allowWithinFamily`.\n */\nexport type ServedModelPolicy = 'exact' | 'allow-within-family'\n\nexport function assertServedModelPolicy(\n  value: unknown,\n  label: string,\n): asserts value is ServedModelPolicy | undefined {\n  if (value !== undefined && value !== 'exact' && value !== 'allow-within-family') {\n    throw new Error(`${label} must be 'exact' or 'allow-within-family'`)\n  }\n}\n\nexport interface AssertServedModelOptions {\n  /**\n   * Accept a different model of the same provider family (e.g. requested\n   * `deepseek-v3.2`, served `deepseek-v4-flash`). Default false. Setting this\n   * keeps family-level claims valid and forfeits per-model claims.\n   */\n  allowWithinFamily?: boolean\n  /**\n   * Accept a response that carried no model id. Default false — an\n   * unidentified response cannot support a per-model or per-family claim.\n   */\n  allowUnreported?: boolean\n  /** Prefixed to the thrown message, e.g. the judge or campaign cell name. */\n  context?: string\n}\n\n/**\n * The one place the accept/reject policy lives, so a caller that reports\n * substitution (a preflight table, a run record) and a caller that throws on it\n * can never drift apart. A cross-family substitution is never acceptable.\n */\nexport function servedModelAcceptable(\n  check: ServedModelCheck,\n  opts: AssertServedModelOptions = {},\n): boolean {\n  switch (check.verdict) {\n    case 'exact':\n    case 'alias':\n      return true\n    case 'unreported':\n      return opts.allowUnreported === true\n    case 'substituted-within-family':\n      return opts.allowWithinFamily === true\n    default:\n      return false\n  }\n}\n\nfunction describe(check: ServedModelCheck): string {\n  if (check.verdict === 'unreported')\n    return `${check.requested}: response carried no model id (identity unproven)`\n  return (\n    `${check.requested} (${check.requestedFamily}) → served ${check.served} ` +\n    `(${check.servedFamily}) [${check.verdict}]`\n  )\n}\n\n/**\n * Throw `ModelSubstitutionError` unless the served id is the requested model.\n * Returns the check on success so callers can record the served id alongside\n * the result.\n */\nexport function assertServedModel(\n  requested: string,\n  served: string | null | undefined,\n  opts: AssertServedModelOptions = {},\n): ServedModelCheck {\n  const check = checkServedModel(requested, served)\n  if (servedModelAcceptable(check, opts)) return check\n  const prefix = opts.context ? `${opts.context}: ` : ''\n  throw new ModelSubstitutionError(\n    `${prefix}model substitution — ${describe(check)}. The measurement is of the SERVED model, ` +\n      'not the requested one; any per-model or per-family claim from this call is invalid.',\n    [check],\n  )\n}\n\n/**\n * Batch form: check every pair and throw naming EVERY substitution, so one\n * failure does not hide the rest. Returns all checks on success.\n */\nexport function assertServedModels(\n  pairs: ReadonlyArray<{ requested: string; served: string | null | undefined }>,\n  opts: AssertServedModelOptions = {},\n): ServedModelCheck[] {\n  const checks = pairs.map((p) => checkServedModel(p.requested, p.served))\n  const bad = checks.filter((c) => !servedModelAcceptable(c, opts))\n  if (bad.length > 0) {\n    const prefix = opts.context ? `${opts.context}: ` : ''\n    throw new ModelSubstitutionError(\n      `${prefix}${bad.length}/${checks.length} call(s) were answered by a different model than ` +\n        `requested — ${bad.map(describe).join('; ')}. Per-model and per-family claims from this ` +\n        'run are invalid until the ids are re-measured.',\n      checks,\n    )\n  }\n  return checks\n}\n\nexport interface AssertCrossFamilyServedOptions extends AssertServedModelOptions {\n  /** Minimum distinct SERVED families required. Default 2. */\n  minFamilies?: number\n  /** Count `unknown`-family served ids toward the total. Default false. */\n  allowUnknown?: boolean\n}\n\nexport class ServedCrossFamilyError extends AgentEvalError {\n  constructor(\n    message: string,\n    public readonly families: JudgeFamily[],\n    public readonly checks: ReadonlyArray<ServedModelCheck>,\n  ) {\n    super('model_substitution', message)\n    this.name = 'ServedCrossFamilyError'\n  }\n}\n\n/**\n * Family-diversity rule over the models that actually ANSWERED.\n *\n * `assertCrossFamily` (../judge-families) reads the requested ids and so\n * cannot see a gateway that answers three \"different\" requests from one\n * provider. This one asserts no substitution first, then counts families from\n * the served ids — a panel that collapsed to one family under the hood fails\n * here even though its request list looked diverse.\n */\nexport function assertCrossFamilyServed(\n  pairs: ReadonlyArray<{ requested: string; served: string | null | undefined }>,\n  opts: AssertCrossFamilyServedOptions = {},\n): JudgeFamily[] {\n  const checks = assertServedModels(pairs, opts)\n  const families = new Set<JudgeFamily>()\n  for (const check of checks) {\n    const family = check.servedFamily\n    if (family === null) continue\n    if (family === 'unknown' && !opts.allowUnknown) continue\n    families.add(family)\n  }\n  const list = [...families].sort()\n  const minFamilies = opts.minFamilies ?? 2\n  if (list.length < minFamilies) {\n    const prefix = opts.context ? `${opts.context}: ` : ''\n    throw new ServedCrossFamilyError(\n      `${prefix}the models that ANSWERED span ${list.length} provider famil` +\n        `${list.length === 1 ? 'y' : 'ies'} (${list.join(', ') || 'none'}) but ${minFamilies} ` +\n        `required — served ids: ${checks.map((c) => c.served ?? 'unreported').join(', ')}`,\n      list,\n      checks,\n    )\n  }\n  return list\n}\n","/**\n * INTERNAL OpenAI-compatible client. NOT part of the published surface.\n *\n * agent-eval executes no paid model on behalf of a consumer: `createChatClient`\n * binds a caller-supplied transport, and this module is not reachable through\n * any export subpath. Two in-repo callers hold it:\n *   - the `agent-eval` binary (`src/cli-config.ts`), a deployed server whose\n *     caller is a JSON-RPC client in another language and which therefore\n *     configures its own endpoint from its own environment;\n *   - the loopback optimizer proxy path (`src/analyst/benchmark-public-model.ts`,\n *     `src/analyst/dspy-rlm-engine.ts`), which targets `http://127.0.0.1:<port>/v1`\n *     with an ephemeral token and executes nothing itself.\n *\n * The canonical request/result TYPES it defines ARE public — they are the\n * contract every caller-owned transport speaks.\n *\n * OpenAI-compatible `/v1/chat/completions` client with:\n *   - Exponential-backoff retry on 429 + 5xx gateway errors (502/503/504).\n *   - Retry on transient network errors (fetch failed, AbortError, ECONNRESET).\n *   - One retry at temperature 1 when a model explicitly requires it.\n *   - Graceful json_schema → json_object degrade on 400 with schema-reject body.\n *   - Fenced-JSON stripping (```json ... ```) for models that wrap structured output.\n *   - Configurable base URL + api key / bearer, works with LiteLLM proxies, OpenAI\n *     directly, cli-bridge subscriptions, and any router that speaks the spec.\n *\n * Usage:\n *   const { value, result } = await callLlmJson<MyType>(\n *     { model: 'gpt-4o', messages: [...], jsonSchema: { name: 'x', schema: {...} } },\n *     { baseUrl: process.env.AGENT_EVAL_LLM_BASE_URL, apiKey: process.env.AGENT_EVAL_LLM_API_KEY },\n *   )\n *\n */\n\nimport {\n  type CostReceiptInput,\n  type CustomTokenPricing,\n  costForTokenPricing,\n  type MaximumCharge,\n} from './cost-ledger'\nimport { AgentEvalError } from './errors'\nimport {\n  type AssertServedModelOptions,\n  assertServedModel as assertServedModelIdentity,\n} from './integrity/served-model'\nimport { newRecordId } from './record-id'\nimport {\n  defaultProviderRedactor,\n  type ProviderRedactor,\n  providerFromBaseUrl,\n  type RawProviderEvent,\n  type RawProviderSink,\n} from './trace/raw-provider-sink'\n\n// ─── Types ──────────────────────────────────────────────────────────────\n\nexport interface LlmMessage {\n  role: 'system' | 'user' | 'assistant' | 'tool'\n  /**\n   * Either a plain text content string OR a multimodal content array\n   * (text + image_url parts) for vision-capable models.\n   */\n  content:\n    | string\n    | Array<\n        | { type: 'text'; text: string }\n        | { type: 'image_url'; image_url: { url: string; detail?: 'auto' | 'low' | 'high' } }\n      >\n  /** Tool invocations made by an `assistant` message earlier in the turn. */\n  toolCalls?: LlmToolCall[]\n  /** The invocation a `tool` message answers. Required when role is `tool`. */\n  toolCallId?: string\n}\n\nexport type LlmThinkingMode = 'enabled' | 'disabled'\n\n/** Canonical function-tool definition offered to the model. */\nexport interface LlmToolDefinition {\n  type: 'function'\n  function: {\n    name: string\n    description?: string\n    parameters: Record<string, unknown>\n  }\n}\n\n/** Canonical tool-choice policy; meaningful only when `tools` is present. */\nexport type LlmToolChoice =\n  | 'auto'\n  | 'none'\n  | 'required'\n  | { type: 'function'; function: { name: string } }\n\n/** One tool invocation on a response or an assistant history message. */\nexport interface LlmToolCall {\n  id: string\n  name: string\n  /** JSON-encoded arguments, exactly as the provider produced them. */\n  argumentsJson: string\n}\n\nexport interface LlmCallRequest {\n  model: string\n  messages: LlmMessage[]\n  /** Optional JSON-mode response format (response_format: json_object). */\n  jsonMode?: boolean\n  /** Optional structured output via JSON Schema. Falls back to json_object on 400. */\n  jsonSchema?: { name: string; schema: Record<string, unknown> }\n  /** Function tools offered to the model for this call. */\n  tools?: LlmToolDefinition[]\n  /** Tool-choice policy for `tools`. */\n  toolChoice?: LlmToolChoice\n  temperature?: number\n  maxTokens?: number\n  /** Ask the provider for the log-probability of each sampled token and its\n   *  `topLogprobs` most likely alternatives. Sends `logprobs: true` with\n   *  `top_logprobs`. A provider that ignores the field returns\n   *  `LlmCallResult.logprobs === null`; nothing is inferred from its absence. */\n  logprobs?: { topLogprobs: number }\n  /** OpenAI-compatible reasoning mode. Omitted when the provider default should apply. */\n  thinking?: LlmThinkingMode\n  /** Per-call timeout, default 300s. */\n  timeoutMs?: number\n}\n\n/** Conservative priced bound for the exact text request sent to a provider.\n * Returns undefined when output or multimodal input is not bounded, causing a\n * capped CostLedger to reject the call before execution. Pass\n * `customTokenPricing` when package pricing does not cover the model or endpoint. */\nexport interface LlmChargeBounds {\n  /** Total provider attempts the transport may make for this call. Default 3. */\n  maximumAttempts?: number\n  /** The transport sends JSON mode instead of a response schema. */\n  jsonSchemaTransport?: 'native' | 'json-object'\n  /** Default provider reasoning mode the transport applies. */\n  thinking?: LlmThinkingMode\n  /** Token rates used when the provider omits cost or package pricing does not cover the model. */\n  customTokenPricing?: CustomTokenPricing\n}\n\nexport function maximumChargeForLlmRequest(\n  request: Pick<\n    LlmCallRequest,\n    'model' | 'messages' | 'jsonSchema' | 'tools' | 'toolChoice' | 'maxTokens' | 'thinking'\n  >,\n  options: LlmChargeBounds = {},\n): MaximumCharge | undefined {\n  if (request.maxTokens === undefined) return undefined\n  if (!Number.isInteger(request.maxTokens) || request.maxTokens <= 0) {\n    throw new RangeError(`maximumChargeForLlmRequest: maxTokens must be a positive integer`)\n  }\n  if (\n    request.messages.some(\n      (message) =>\n        Array.isArray(message.content) && message.content.some((part) => part.type === 'image_url'),\n    )\n  ) {\n    return undefined\n  }\n\n  const attempts = resolveMaximumAttempts(options.maximumAttempts)\n  const forceJsonObject = options.jsonSchemaTransport === 'json-object'\n  // A byte-level tokenizer cannot emit more input tokens than request bytes.\n  // Pricing the complete body also covers role/schema framing omitted from content-only estimates.\n  const requestBytes = new TextEncoder().encode(\n    JSON.stringify(buildBody(request, forceJsonObject, options.thinking)),\n  ).byteLength\n  // A rejected response schema can trigger one JSON-mode batch with the same output limit.\n  const batches = request.jsonSchema && !forceJsonObject ? 2 : 1\n  const usage = {\n    inputTokens: requestBytes * attempts * batches,\n    outputTokens: request.maxTokens * attempts * batches,\n  }\n  return options.customTokenPricing\n    ? { customTokenPricing: options.customTokenPricing, ...usage }\n    : { model: request.model, ...usage }\n}\n\nexport interface LlmUsage {\n  promptTokens: number\n  completionTokens: number\n  totalTokens: number\n  /** False when the provider omitted or malformed prompt/completion usage. */\n  captured?: boolean\n  /** Reasoning-token subset of completionTokens, when reported. */\n  reasoningTokens?: number\n  /** Proxies populate this when prompt caching is on. */\n  cachedPromptTokens?: number\n}\n\n/** One sampled token with its own log probability and the alternatives the\n *  provider ranked at that position. */\nexport interface LlmTokenLogprob {\n  token: string\n  logprob: number\n  top: ReadonlyArray<{ token: string; logprob: number }>\n}\n\nexport interface LlmCallResult {\n  /** The text content of the first choice. Empty string if none. */\n  content: string\n  /** Tool invocations from the first choice, when the model called tools. */\n  toolCalls?: LlmToolCall[]\n  usage: LlmUsage\n  /**\n   * Cost in USD. Uses the provider's reported cost when present, otherwise\n   * caller-supplied token pricing. `null` when neither is available.\n   */\n  costUsd: number | null\n  /**\n   * Model id used for attribution (cost, pricing, log lines). The response's\n   * echoed id when the provider sent one, else the requested id.\n   *\n   * NOT evidence of which model answered — read `servedModel` for that. A\n   * provider that omits `model` makes this equal to the request, which is\n   * exactly the case an identity check must be able to distinguish.\n   */\n  model: string\n  /**\n   * The model id the provider echoed on the response, verbatim; `null` when\n   * the body carried none. This is the only field that can witness a gateway\n   * substituting a different model for the one requested — compare it with\n   * `assertServedModel` / `checkServedModel` (src/integrity/served-model.ts).\n   *\n   * Optional so hand-built results (mock/custom transports) still typecheck,\n   * but omitting it is not a pass: the identity checks read `undefined` as\n   * `unreported` and reject it by default. A transport that knows which model\n   * answered should say so.\n   */\n  servedModel?: string | null\n  /** Wall-clock duration of the HTTP call (last attempt, if retried). */\n  durationMs: number\n  /**\n   * `finish_reason` echoed from the first choice (`stop`, `length`,\n   * `content_filter`, `tool_calls`, ...). `null` when the provider omits it.\n   * Exposed so a free-form `callLlm` caller CAN detect a truncated answer\n   * (`length`) instead of treating a cut-off completion as complete. Note:\n   * `callLlm` does not itself reject on it — acting on this signal is the\n   * caller's responsibility (in-repo free-form drivers do not yet enforce it).\n   */\n  finishReason?: string | null\n  /**\n   * True when `content.trim()` is empty. An empty completion is a silent zero\n   * for free-form `callLlm` callers; this flag is the signal a caller can\n   * inspect to fail loud rather than proceed on an empty string. `callLlm`\n   * surfaces it but does not throw on it.\n   */\n  contentEmpty?: boolean\n  /**\n   * Per-token log probabilities for the first choice, in emission order, when\n   * the request asked for them and the provider returned\n   * `choices[0].logprobs.content`. `null` when the provider returned none, so a\n   * caller can tell \"not requested or not supported\" from \"requested and\n   * empty\". Absent when the request did not ask for logprobs.\n   */\n  logprobs?: ReadonlyArray<LlmTokenLogprob> | null\n  /** Raw response body. */\n  raw: Record<string, unknown>\n}\n\nexport type LlmCallMetadata = Pick<LlmCallResult, 'usage' | 'costUsd' | 'model' | 'durationMs'>\n\n/** Convert a provider result into the canonical paid-call receipt input.\n * The receipt is JSON-clean: absent optional fields are omitted, never carried\n * as explicit-undefined keys. Receipts cross JSON boundaries (the external\n * optimizer's loopback proxy validates them with `assertJsonValue`), where an\n * explicit-undefined value is rejected as non-serializable. */\nexport function costReceiptFromLlm(\n  result: LlmCallResult,\n  customTokenPricing?: CustomTokenPricing,\n): CostReceiptInput {\n  const cachedTokens = result.usage.cachedPromptTokens ?? 0\n  const inputTokens = Math.max(0, result.usage.promptTokens - cachedTokens)\n  const providerCostUsd = providerReportedCost(result.raw)\n  return {\n    model: result.model,\n    inputTokens,\n    outputTokens: result.usage.completionTokens,\n    ...(result.usage.reasoningTokens === undefined\n      ? {}\n      : { reasoningTokens: result.usage.reasoningTokens }),\n    ...(cachedTokens > 0 ? { cachedTokens } : {}),\n    ...(providerCostUsd === undefined\n      ? customTokenPricing && result.usage.captured !== false\n        ? { customTokenPricing }\n        : result.costUsd === null\n          ? {}\n          : { estimatedCostUsd: result.costUsd }\n      : { actualCostUsd: providerCostUsd }),\n    usageUnknown: result.usage.captured === false,\n  }\n}\n\nfunction providerReportedCost(raw: Record<string, unknown>): number | undefined {\n  const value = raw._response_cost ?? raw.cost_usd\n  return typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : undefined\n}\n\n/** Structured-response failures retain their completed provider receipt. */\nexport function costReceiptFromLlmError(\n  error: Error,\n  customTokenPricing?: CustomTokenPricing,\n): CostReceiptInput | undefined {\n  return error instanceof LlmResponseError\n    ? costReceiptFromLlm(error.result, customTokenPricing)\n    : undefined\n}\n\nexport class LlmCallError extends AgentEvalError {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly body: string,\n    public readonly model: string,\n  ) {\n    super('judge', message)\n  }\n}\n\n/** A provider response completed and incurred measurable usage, but its content\n *  could not satisfy the caller's response contract. The response envelope is\n *  retained so accounting can commit the receipt before the error propagates. */\nexport class LlmResponseError extends AgentEvalError {\n  constructor(\n    message: string,\n    public readonly result: LlmCallResult,\n    options?: { cause?: unknown },\n  ) {\n    super('judge', message, options)\n  }\n}\n\nexport interface LlmClientOptions extends LlmChargeBounds {\n  /** Base URL (without trailing slash), ending at the `/v1` prefix. Required: there is no default endpoint. */\n  baseUrl?: string\n  /** Bearer token — either `apiKey` or `bearer` populates `Authorization: Bearer ...`. */\n  apiKey?: string\n  bearer?: string\n  /** Override for the `Authorization` header (e.g. `X-Auth: ...`). Takes precedence over apiKey/bearer. */\n  authHeader?: { name: string; value: string }\n  /** Stable provider idempotency key, reused across retries of this logical call. */\n  idempotencyKey?: string\n  /** Default timeout in ms. Per-call can override. */\n  defaultTimeoutMs?: number\n  /**\n   * Caller-supplied abort signal — e.g. a campaign-wide cancel. Linked to\n   * each attempt's per-attempt timeout controller, so aborting it cancels\n   * the in-flight fetch. A caller abort is FATAL: it is not retried even\n   * though an AbortError otherwise matches the transient patterns.\n   */\n  signal?: AbortSignal\n  /**\n   * Cross-attempt wall-clock budget in ms, measured from the first attempt.\n   * Before launching each attempt the loop checks the remaining budget and\n   * stops retrying once it is exhausted, rather than waiting the full\n   * per-attempt timeout on every retry. Bounds total time independent of\n   * total attempts × `timeoutMs`.\n   */\n  deadlineMs?: number\n  /**\n   * JSON payload parsing policy. `extract` accepts fenced or prose-prefixed JSON.\n   * `exact` requires the complete response content to be one JSON value.\n   * Default: `extract`.\n   */\n  jsonPayloadMode?: 'extract' | 'exact'\n  /** Fetch implementation — defaults to global `fetch`. Override for custom transport (e.g. tests). */\n  fetch?: typeof fetch\n  /**\n   * Optional raw HTTP capture sink. When provided, every request, response,\n   * and error (across all retry attempts) is recorded to the sink, with auth\n   * headers and credential-shaped body fields redacted by default. This is\n   * the layer-1 forensics primitive: structured `LlmSpan`s record intent,\n   * raw events record what actually crossed the wire.\n   */\n  rawSink?: RawProviderSink\n  /**\n   * Logical provider id attached to raw events. When omitted, derived from\n   * `baseUrl` via `providerFromBaseUrl`.\n   */\n  provider?: string\n  /** Trace context attached to raw events; populated by emitter-aware callers. */\n  traceContext?: { runId?: string; spanId?: string }\n  /** Override the redaction strategy for this call. Defaults to `defaultProviderRedactor`. */\n  redactor?: ProviderRedactor\n  /**\n   * Reject a response whose echoed model is not the model that was requested.\n   * A routing gateway can accept one id and answer from another, which\n   * silently invalidates every per-model and per-family claim downstream.\n   * `true` uses the strict default (aliases pass, substitutions and\n   * unidentified responses throw `ModelSubstitutionError`); pass an options\n   * object to relax a specific case. Off by default — turning it on for a\n   * measurement run is the point.\n   */\n  assertServedModel?: boolean | AssertServedModelOptions\n}\n\n// ─── Internals ──────────────────────────────────────────────────────────\n\n// Flagship / reasoning models routinely take several minutes on large prompts (a\n// reflection over many failures, a long tool transcript). A tight cap aborts a\n// legitimately-slow but healthy call — and because every retry attempt re-uses\n// the same window, such a model aborts on ALL attempts and the loop throws. The\n// default is generous enough to let those complete, bounded enough that a truly\n// hung call still fails over after retries, and tunable per deployment via\n// TANGLE_LLM_TIMEOUT_MS. Per-call `req.timeoutMs` / `opts.defaultTimeoutMs`\n// still win for callers that know their model's latency.\nconst DEFAULT_TIMEOUT_MS = Number(process.env.TANGLE_LLM_TIMEOUT_MS) || 300_000\nconst DEFAULT_MAXIMUM_ATTEMPTS =\n  process.env.TANGLE_LLM_MAXIMUM_ATTEMPTS === undefined\n    ? 3\n    : Number(process.env.TANGLE_LLM_MAXIMUM_ATTEMPTS)\n\nfunction resolveMaximumAttempts(configured: number | undefined): number {\n  const attempts = configured ?? DEFAULT_MAXIMUM_ATTEMPTS\n  if (!Number.isInteger(attempts) || attempts <= 0) {\n    throw new RangeError('LLM maximum attempts must be a positive integer')\n  }\n  return attempts\n}\n\nfunction providerTokenCount(value: unknown): number | undefined {\n  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : undefined\n}\n\n// 522/524: Cloudflare edge timeouts (origin connect/respond) — transient\n// exactly like 504. Router deployments serve through Cloudflare, so a long\n// non-streaming call can draw these from the edge, not the origin.\nconst RETRYABLE_STATUS = new Set([429, 502, 503, 504, 522, 524])\n\n/**\n * Transient transport/network error signatures, matched against an error's\n * name, message, and `code`. Covers fetch/undici network failures, aborts\n * and timeouts, and — critically — HTTP/2 transport faults a keep-alive\n * connection raises mid-response: `terminated`, `NGHTTP2_INTERNAL_ERROR`,\n * `UND_ERR_*`, `other side closed`. Those last ones carry no clean HTTP\n * status; unrecognised, they escape the retry loop and surface as an\n * uncaught rejection.\n */\nconst TRANSIENT_ERROR_PATTERNS: readonly RegExp[] = [\n  /AbortError/i,\n  /TimeoutError/i,\n  /this operation was aborted/i,\n  /fetch failed/i,\n  /ECONNRESET/i,\n  /ETIMEDOUT/i,\n  /EAI_AGAIN/i,\n  /socket hang up/i,\n  /stream.*ended.*unexpectedly/i,\n  /terminated/i,\n  /other side closed/i,\n  /NGHTTP2/i,\n  /UND_ERR/i,\n]\n\n/**\n * True when an error is a transient transport/network fault worth retrying,\n * as opposed to a deterministic failure (4xx schema reject, JSON parse) that\n * a retry cannot fix. Inspects `LlmCallError.status`, then the error's\n * name/message/code, then recurses into `error.cause` — undici nests the\n * real socket fault one or more levels under `.cause`.\n *\n * This is the retry classifier for the package: `callLlm` and\n * `withJudgeRetry` both route through it, so connection failures are treated\n * consistently across transports.\n */\nexport function isTransientLlmError(err: unknown): boolean {\n  return classifyTransient(err, 0)\n}\n\nfunction classifyTransient(err: unknown, depth: number): boolean {\n  if (err instanceof LlmCallError) return RETRYABLE_STATUS.has(err.status)\n  if (!(err instanceof Error)) return false\n  // Foreign transport errors can carry a numeric HTTP status without being an\n  // LlmCallError. A retryable status is decisive.\n  const status = (err as { status?: unknown }).status\n  if (typeof status === 'number' && RETRYABLE_STATUS.has(status)) return true\n  const code = (err as { code?: unknown }).code\n  const haystack = `${err.name}\\n${err.message}\\n${typeof code === 'string' ? code : ''}`\n  if (TRANSIENT_ERROR_PATTERNS.some((p) => p.test(haystack))) return true\n  const cause = (err as { cause?: unknown }).cause\n  if (depth < 4 && cause instanceof Error && cause !== err) {\n    return classifyTransient(cause, depth + 1)\n  }\n  return false\n}\n\nfunction parseRetryAfter(headers: Headers): number | null {\n  const h = headers.get('retry-after')\n  if (!h) return null\n  const asNumber = Number(h)\n  if (Number.isFinite(asNumber) && asNumber > 0) return asNumber * 1000\n  const asDate = Date.parse(h)\n  if (Number.isFinite(asDate)) return Math.max(0, asDate - Date.now())\n  return null\n}\n\n/** Exponential backoff: 500ms, 1s, 2s, 4s, ... capped at 16s. Attempt is 0-indexed. */\nexport function backoffMs(attempt: number): number {\n  return Math.min(500 * 2 ** attempt, 16_000)\n}\n\nfunction buildHeaders(opts: LlmClientOptions): Record<string, string> {\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    Accept: 'application/json',\n  }\n  if (opts.authHeader) {\n    headers[opts.authHeader.name] = opts.authHeader.value\n  } else if (opts.bearer || opts.apiKey) {\n    headers.Authorization = `Bearer ${opts.bearer ?? opts.apiKey}`\n  }\n  if (opts.idempotencyKey) headers['Idempotency-Key'] = opts.idempotencyKey\n  return headers\n}\n\nfunction isSchemaRejection(status: number, body: string): boolean {\n  if (status !== 400) return false\n  const lower = body.toLowerCase()\n  return (\n    lower.includes('response_format') ||\n    lower.includes('json_schema') ||\n    lower.includes('is unavailable') ||\n    lower.includes('not supported')\n  )\n}\n\nfunction isTemperatureOneRejection(status: number, body: string): boolean {\n  if (status !== 400 || !/temperature/i.test(body)) return false\n  return (\n    /temperature[^.\\n]{0,120}\\b(?:only|must|should|required|requires?)\\b[^.\\n]{0,40}\\b1(?:\\.0+)?\\b/i.test(\n      body,\n    ) || /\\bonly\\s+1(?:\\.0+)?\\s+is\\s+allowed\\b[^.\\n]{0,120}\\btemperature\\b/i.test(body)\n  )\n}\n\nfunction buildBody(\n  req: LlmCallRequest,\n  forceJsonObject: boolean,\n  defaultThinking?: LlmThinkingMode,\n): Record<string, unknown> {\n  const body: Record<string, unknown> = {\n    model: req.model,\n    messages: req.messages.map(encodeWireMessage),\n    temperature: req.temperature ?? 0,\n  }\n  if (req.maxTokens != null) {\n    if (usesMaxCompletionTokens(req.model)) body.max_completion_tokens = req.maxTokens\n    else body.max_tokens = req.maxTokens\n  }\n  if (req.logprobs !== undefined) {\n    body.logprobs = true\n    body.top_logprobs = req.logprobs.topLogprobs\n  }\n  if (req.tools !== undefined) body.tools = req.tools\n  if (req.toolChoice !== undefined) body.tool_choice = req.toolChoice\n  const thinking = req.thinking ?? defaultThinking\n  if (thinking !== undefined) {\n    body.thinking = { type: thinking }\n  }\n\n  if (req.jsonSchema && !forceJsonObject) {\n    body.response_format = {\n      type: 'json_schema',\n      json_schema: { name: req.jsonSchema.name, schema: req.jsonSchema.schema, strict: true },\n    }\n  } else if (req.jsonMode || req.jsonSchema) {\n    body.response_format = { type: 'json_object' }\n  }\n\n  return body\n}\n\nfunction usesMaxCompletionTokens(model: string): boolean {\n  return /^gpt-5(?:[.-]|$)/i.test(model)\n}\n\n/** Encode one canonical message as its OpenAI chat-completions wire shape. */\nfunction encodeWireMessage(message: LlmMessage): Record<string, unknown> {\n  if (message.role === 'tool') {\n    return { role: 'tool', tool_call_id: message.toolCallId, content: message.content }\n  }\n  if (message.toolCalls === undefined) {\n    return { role: message.role, content: message.content }\n  }\n  return {\n    role: message.role,\n    content: message.content,\n    tool_calls: message.toolCalls.map((call) => ({\n      id: call.id,\n      type: 'function',\n      function: { name: call.name, arguments: call.argumentsJson },\n    })),\n  }\n}\n\n/**\n * Parse `choices[0].logprobs.content` into the canonical per-token shape.\n * `null` when the provider returned nothing for a request that asked: a\n * provider that ignores `logprobs` is a fact the caller must be able to read,\n * not an error. A malformed entry is a contract violation and throws.\n */\nfunction parseWireLogprobs(value: unknown, model: string): ReadonlyArray<LlmTokenLogprob> | null {\n  if (value === undefined || value === null) return null\n  if (!Array.isArray(value)) {\n    throw new Error(`LLM response logprobs.content must be an array (model=${model})`)\n  }\n  return value.map((entry, index) => {\n    const record = entry as { token?: unknown; logprob?: unknown; top_logprobs?: unknown } | null\n    if (\n      !record ||\n      typeof record !== 'object' ||\n      typeof record.token !== 'string' ||\n      typeof record.logprob !== 'number' ||\n      !Number.isFinite(record.logprob)\n    ) {\n      throw new Error(\n        `LLM response logprobs.content[${index}] is not a token with a finite logprob (model=${model})`,\n      )\n    }\n    const top = record.top_logprobs\n    if (top !== undefined && top !== null && !Array.isArray(top)) {\n      throw new Error(\n        `LLM response logprobs.content[${index}].top_logprobs must be an array (model=${model})`,\n      )\n    }\n    return {\n      token: record.token,\n      logprob: record.logprob,\n      top: (Array.isArray(top) ? top : []).map((alternative, position) => {\n        const candidate = alternative as { token?: unknown; logprob?: unknown } | null\n        if (\n          !candidate ||\n          typeof candidate !== 'object' ||\n          typeof candidate.token !== 'string' ||\n          typeof candidate.logprob !== 'number' ||\n          !Number.isFinite(candidate.logprob)\n        ) {\n          throw new Error(\n            `LLM response logprobs.content[${index}].top_logprobs[${position}] is not a token with a finite logprob (model=${model})`,\n          )\n        }\n        return { token: candidate.token, logprob: candidate.logprob }\n      }),\n    }\n  })\n}\n\n/** Parse provider tool_calls into the canonical shape. A malformed entry is a\n * provider-contract violation and throws rather than degrading silently. */\nfunction parseWireToolCalls(value: unknown, model: string): LlmToolCall[] | undefined {\n  if (value === undefined || value === null) return undefined\n  if (!Array.isArray(value)) {\n    throw new Error(`LLM response tool_calls must be an array (model=${model})`)\n  }\n  if (value.length === 0) return undefined\n  return value.map((entry, index) => {\n    const record = entry as {\n      id?: unknown\n      type?: unknown\n      function?: { name?: unknown; arguments?: unknown } | null\n    } | null\n    const fn = record && typeof record === 'object' ? record.function : undefined\n    if (\n      !record ||\n      typeof record !== 'object' ||\n      typeof record.id !== 'string' ||\n      record.id.length === 0 ||\n      (record.type !== undefined && record.type !== 'function') ||\n      !fn ||\n      typeof fn !== 'object' ||\n      typeof fn.name !== 'string' ||\n      fn.name.length === 0 ||\n      typeof fn.arguments !== 'string'\n    ) {\n      throw new Error(\n        `LLM response tool_calls[${index}] is not a function call with string arguments (model=${model})`,\n      )\n    }\n    return { id: record.id, name: fn.name, argumentsJson: fn.arguments }\n  })\n}\n\nasync function sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms))\n}\n\n/**\n * Combine the per-attempt timeout signal with an optional caller signal into\n * one signal the fetch listens on. Prefers the native `AbortSignal.any`; falls\n * back to manual wiring on runtimes that predate it. The caller signal is also\n * propagated to the timeout controller so aborting it cancels the in-flight\n * fetch immediately.\n */\nfunction linkSignals(timeoutController: AbortController, caller?: AbortSignal): AbortSignal {\n  if (!caller) return timeoutController.signal\n  if (typeof (AbortSignal as { any?: unknown }).any === 'function') {\n    return AbortSignal.any([timeoutController.signal, caller])\n  }\n  if (caller.aborted) {\n    timeoutController.abort()\n  } else {\n    caller.addEventListener('abort', () => timeoutController.abort(), { once: true })\n  }\n  return timeoutController.signal\n}\n\n/** True once the cross-attempt wall-clock budget (if any) is exhausted. */\nfunction deadlineExceeded(start: number, deadlineMs: number | undefined): boolean {\n  return deadlineMs != null && Date.now() - start >= deadlineMs\n}\n\n// ─── Public API ─────────────────────────────────────────────────────────\n\n/**\n * Strip a ```json / ``` code fence if the model emitted one.\n * Idempotent for naked JSON. Some models (claude-code via router, certain\n * deepseek models) wrap output even under json_object.\n */\nexport function stripFencedJson(raw: string): string {\n  const trimmed = raw.trim()\n  const m = trimmed.match(/^```(?:json)?\\s*\\n?([\\s\\S]*?)\\n?```\\s*$/)\n  return m ? m[1]!.trim() : trimmed\n}\n\nexport function extractJsonPayload(raw: string): string {\n  const stripped = stripFencedJson(raw)\n  try {\n    JSON.parse(stripped)\n    return stripped\n  } catch {\n    // A response that declares a JSON root must parse as that complete root.\n    // Scanning onward could turn a truncated object into one of its valid nested\n    // arrays or objects and silently change the response schema.\n    if (stripped.startsWith('{') || stripped.startsWith('[')) return stripped\n  }\n\n  // Only prose-leading responses may contain a recoverable JSON payload.\n  const starts = [...stripped.matchAll(/[[{]/g)]\n    .map((match) => match.index)\n    .filter((index) => index != null)\n  for (const start of starts) {\n    const candidate = extractBalancedJson(stripped, start)\n    if (!candidate) continue\n    try {\n      JSON.parse(candidate)\n      return candidate\n    } catch {\n      // Keep scanning; earlier braces may belong to prose.\n    }\n  }\n\n  return stripped\n}\n\nfunction extractBalancedJson(input: string, start: number): string | null {\n  const opener = input[start]\n  const closer = opener === '{' ? '}' : opener === '[' ? ']' : null\n  if (!closer) return null\n\n  const stack: string[] = [closer]\n  let isInString = false\n  let isEscaped = false\n\n  for (let i = start + 1; i < input.length; i++) {\n    const char = input[i]!\n    if (isEscaped) {\n      isEscaped = false\n      continue\n    }\n    if (char === '\\\\') {\n      isEscaped = isInString\n      continue\n    }\n    if (char === '\"') {\n      isInString = !isInString\n      continue\n    }\n    if (isInString) continue\n\n    if (char === '{') stack.push('}')\n    else if (char === '[') stack.push(']')\n    else if (char === stack[stack.length - 1]) {\n      stack.pop()\n      if (stack.length === 0) return input.slice(start, i + 1)\n    }\n  }\n\n  return null\n}\n\n/**\n * Low-level call. Returns raw content + usage + cost. Retries on transient\n * failures; does NOT degrade schema here — callers that want graceful\n * degrade use `callLlmJson`.\n */\nexport async function callLlm(\n  req: LlmCallRequest,\n  opts: LlmClientOptions = {},\n): Promise<LlmCallResult> {\n  // No default endpoint. This client is internal to the `agent-eval` binary\n  // and the loopback optimizer proxy; both name their endpoint explicitly, and\n  // a fallback would let a misconfigured caller bill an unintended provider.\n  if (!opts.baseUrl) throw new Error('callLlm: opts.baseUrl is required')\n  const baseUrl = opts.baseUrl.replace(/\\/+$/, '')\n  const url = `${baseUrl}/chat/completions`\n  const endpoint = '/chat/completions'\n  const timeoutMs = req.timeoutMs ?? opts.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS\n  const maximumAttempts = resolveMaximumAttempts(opts.maximumAttempts)\n  const fetchFn = opts.fetch ?? globalThis.fetch\n  const headers = buildHeaders(opts)\n  const provider = opts.provider ?? providerFromBaseUrl(baseUrl)\n  const sink = opts.rawSink\n  const redactor = opts.redactor ?? defaultProviderRedactor\n  const traceContext = opts.traceContext\n  const callerSignal = opts.signal\n  const deadlineMs = opts.deadlineMs\n  const deadlineStart = Date.now()\n  if (opts.customTokenPricing) {\n    costForTokenPricing(opts.customTokenPricing, { inputTokens: 0, outputTokens: 0 })\n  }\n\n  let lastErr: unknown\n  let effectiveRequest = req\n  for (let attempt = 0; attempt < maximumAttempts; attempt++) {\n    // A caller cancel is fatal — never retried. Checking before each attempt\n    // means an already-aborted signal short-circuits without firing fetch.\n    if (callerSignal?.aborted) {\n      throw new DOMException('callLlm aborted by caller signal', 'AbortError')\n    }\n    // Stop retrying once the cross-attempt budget is spent rather than burning\n    // a full per-attempt timeout on each remaining retry.\n    if (attempt > 0 && deadlineExceeded(deadlineStart, deadlineMs)) {\n      throw lastErr instanceof Error ? lastErr : new Error(String(lastErr))\n    }\n    const controller = new AbortController()\n    const attemptSignal = linkSignals(controller, callerSignal)\n    const timeoutHandle = setTimeout(() => controller.abort(), timeoutMs)\n    const started = Date.now()\n    const requestBody = buildBody(\n      effectiveRequest,\n      opts.jsonSchemaTransport === 'json-object',\n      opts.thinking,\n    )\n    let attemptErrorRecorded = false\n    if (sink) {\n      await recordRaw(sink, redactor, {\n        eventId: newRecordId(),\n        runId: traceContext?.runId,\n        spanId: traceContext?.spanId,\n        provider,\n        model: req.model,\n        endpoint,\n        baseUrl,\n        attemptIndex: attempt,\n        direction: 'request',\n        timestamp: started,\n        requestHeaders: headers,\n        requestBody,\n        redactedFields: [],\n      })\n    }\n\n    try {\n      const res = await fetchFn(url, {\n        method: 'POST',\n        headers,\n        body: JSON.stringify(requestBody),\n        signal: attemptSignal,\n      })\n      clearTimeout(timeoutHandle)\n      const responseHeaders = sink ? headersToObject(res.headers) : undefined\n\n      if (!res.ok) {\n        const body = await res.text()\n        if (sink) {\n          await recordRaw(sink, redactor, {\n            eventId: newRecordId(),\n            runId: traceContext?.runId,\n            spanId: traceContext?.spanId,\n            provider,\n            model: req.model,\n            endpoint,\n            baseUrl,\n            attemptIndex: attempt,\n            direction: 'error',\n            timestamp: Date.now(),\n            durationMs: Date.now() - started,\n            statusCode: res.status,\n            responseHeaders,\n            responseBody: body,\n            errorMessage: `HTTP ${res.status}`,\n            redactedFields: [],\n          })\n          attemptErrorRecorded = true\n        }\n        const err = new LlmCallError(\n          `LLM call failed with HTTP ${res.status}`,\n          res.status,\n          body,\n          req.model,\n        )\n        if (\n          isTemperatureOneRejection(res.status, body) &&\n          effectiveRequest.temperature !== 1 &&\n          attempt < maximumAttempts - 1 &&\n          !deadlineExceeded(deadlineStart, deadlineMs)\n        ) {\n          lastErr = err\n          effectiveRequest = { ...effectiveRequest, temperature: 1 }\n          continue\n        }\n        if (\n          RETRYABLE_STATUS.has(res.status) &&\n          attempt < maximumAttempts - 1 &&\n          !deadlineExceeded(deadlineStart, deadlineMs)\n        ) {\n          lastErr = err\n          const retryAfter = parseRetryAfter(res.headers)\n          await sleep(retryAfter ?? backoffMs(attempt))\n          continue\n        }\n        throw err\n      }\n\n      const text = await res.text()\n      let json: Record<string, unknown>\n      try {\n        json = JSON.parse(text) as Record<string, unknown>\n      } catch (parseErr) {\n        if (sink) {\n          await recordRaw(sink, redactor, {\n            eventId: newRecordId(),\n            runId: traceContext?.runId,\n            spanId: traceContext?.spanId,\n            provider,\n            model: req.model,\n            endpoint,\n            baseUrl,\n            attemptIndex: attempt,\n            direction: 'error',\n            timestamp: Date.now(),\n            durationMs: Date.now() - started,\n            statusCode: res.status,\n            responseHeaders,\n            responseBody: text,\n            errorMessage: `non-JSON response: ${parseErr instanceof Error ? parseErr.message : String(parseErr)}`,\n            redactedFields: [],\n          })\n          attemptErrorRecorded = true\n        }\n        throw parseErr\n      }\n      if (sink) {\n        await recordRaw(sink, redactor, {\n          eventId: newRecordId(),\n          runId: traceContext?.runId,\n          spanId: traceContext?.spanId,\n          provider,\n          model: req.model,\n          endpoint,\n          baseUrl,\n          attemptIndex: attempt,\n          direction: 'response',\n          timestamp: Date.now(),\n          durationMs: Date.now() - started,\n          statusCode: res.status,\n          responseHeaders,\n          responseBody: json,\n          redactedFields: [],\n        })\n      }\n      const choice = (\n        json.choices as\n          | Array<{\n              message?: { content?: string | null; tool_calls?: unknown }\n              finish_reason?: string | null\n              logprobs?: { content?: unknown } | null\n            }>\n          | undefined\n      )?.[0]\n      const toolCalls = parseWireToolCalls(choice?.message?.tool_calls, req.model)\n      const usageRaw =\n        json.usage && typeof json.usage === 'object' && !Array.isArray(json.usage)\n          ? (json.usage as Record<string, unknown>)\n          : undefined\n      const promptTokens = providerTokenCount(usageRaw?.prompt_tokens)\n      const completionTokens = providerTokenCount(usageRaw?.completion_tokens)\n      const totalTokens = providerTokenCount(usageRaw?.total_tokens)\n      const completionDetails =\n        usageRaw?.completion_tokens_details &&\n        typeof usageRaw.completion_tokens_details === 'object' &&\n        !Array.isArray(usageRaw.completion_tokens_details)\n          ? (usageRaw.completion_tokens_details as Record<string, unknown>)\n          : undefined\n      const reasoningRaw = completionDetails?.reasoning_tokens\n      const reasoningTokens =\n        reasoningRaw === undefined ? undefined : providerTokenCount(reasoningRaw)\n      const cachedRaw =\n        usageRaw?.prompt_tokens_details &&\n        typeof usageRaw.prompt_tokens_details === 'object' &&\n        !Array.isArray(usageRaw.prompt_tokens_details)\n          ? (usageRaw.prompt_tokens_details as Record<string, unknown>).cached_tokens\n          : undefined\n      const cachedPromptTokens = cachedRaw === undefined ? undefined : providerTokenCount(cachedRaw)\n      const usageCaptured =\n        promptTokens !== undefined &&\n        completionTokens !== undefined &&\n        (reasoningRaw === undefined ||\n          (reasoningTokens !== undefined && reasoningTokens <= completionTokens)) &&\n        (cachedRaw === undefined ||\n          (cachedPromptTokens !== undefined && cachedPromptTokens <= promptTokens)) &&\n        (totalTokens === undefined || totalTokens === promptTokens + completionTokens)\n      const costFromProxy = (json._response_cost ?? json.cost_usd) as number | undefined\n      const content = choice?.message?.content ?? ''\n\n      const configuredCost =\n        typeof costFromProxy !== 'number' && usageCaptured && opts.customTokenPricing\n          ? costForTokenPricing(opts.customTokenPricing, {\n              inputTokens: promptTokens! - (cachedPromptTokens ?? 0),\n              ...(cachedPromptTokens ? { cachedTokens: cachedPromptTokens } : {}),\n              outputTokens: completionTokens!,\n            })\n          : undefined\n\n      // The echoed id, kept separate from the attribution id: a provider that\n      // omits it must read as \"unproven\", never as \"the model I asked for\".\n      const servedModel =\n        typeof json.model === 'string' && json.model.trim() !== '' ? json.model : null\n      if (opts.assertServedModel) {\n        assertServedModelIdentity(\n          req.model,\n          servedModel,\n          opts.assertServedModel === true ? {} : opts.assertServedModel,\n        )\n      }\n\n      return {\n        content,\n        ...(toolCalls === undefined ? {} : { toolCalls }),\n        ...(req.logprobs === undefined\n          ? {}\n          : { logprobs: parseWireLogprobs(choice?.logprobs?.content, req.model) }),\n        finishReason: choice?.finish_reason ?? null,\n        contentEmpty: content.trim().length === 0,\n        usage: {\n          promptTokens: promptTokens ?? 0,\n          completionTokens: completionTokens ?? 0,\n          totalTokens: totalTokens ?? (promptTokens ?? 0) + (completionTokens ?? 0),\n          captured: usageCaptured,\n          reasoningTokens,\n          cachedPromptTokens,\n        },\n        costUsd: typeof costFromProxy === 'number' ? costFromProxy : (configuredCost ?? null),\n        model: servedModel ?? req.model,\n        servedModel,\n        durationMs: Date.now() - started,\n        raw: json,\n      }\n    } catch (err) {\n      clearTimeout(timeoutHandle)\n      lastErr = err\n      // A caller cancel is fatal even though an AbortError matches the\n      // transient patterns — a cancelled call must surface immediately, not\n      // be retried against the same dead intent.\n      if (callerSignal?.aborted) {\n        if (sink && !attemptErrorRecorded) {\n          await recordRaw(sink, redactor, {\n            eventId: newRecordId(),\n            runId: traceContext?.runId,\n            spanId: traceContext?.spanId,\n            provider,\n            model: req.model,\n            endpoint,\n            baseUrl,\n            attemptIndex: attempt,\n            direction: 'error',\n            timestamp: Date.now(),\n            durationMs: Date.now() - started,\n            errorMessage: err instanceof Error ? err.message : String(err),\n            redactedFields: [],\n          })\n        }\n        throw err\n      }\n      if (sink && !attemptErrorRecorded) {\n        // Record only if neither the !res.ok branch nor the JSON.parse catch\n        // already produced an error event for this attempt. Covers network\n        // failures, timeouts, and aborts.\n        await recordRaw(sink, redactor, {\n          eventId: newRecordId(),\n          runId: traceContext?.runId,\n          spanId: traceContext?.spanId,\n          provider,\n          model: req.model,\n          endpoint,\n          baseUrl,\n          attemptIndex: attempt,\n          direction: 'error',\n          timestamp: Date.now(),\n          durationMs: Date.now() - started,\n          errorMessage: err instanceof Error ? err.message : String(err),\n          redactedFields: [],\n        })\n      }\n      if (\n        attempt < maximumAttempts - 1 &&\n        isTransientLlmError(err) &&\n        !deadlineExceeded(deadlineStart, deadlineMs)\n      ) {\n        await sleep(backoffMs(attempt))\n        continue\n      }\n      throw err\n    }\n  }\n  throw lastErr instanceof Error ? lastErr : new Error(String(lastErr))\n}\n\nasync function recordRaw(\n  sink: RawProviderSink,\n  redactor: ProviderRedactor,\n  event: RawProviderEvent,\n): Promise<void> {\n  // Errors from sinks must not crash the LLM call. Forensic capture is\n  // best-effort; the structured trace is the system of record.\n  try {\n    await sink.record(redactor(event))\n  } catch {\n    // Intentionally swallowed.\n  }\n}\n\nfunction headersToObject(h: Headers): Record<string, string> {\n  const out: Record<string, string> = {}\n  h.forEach((value, key) => {\n    out[key] = value\n  })\n  return out\n}\n\n/**\n * Structured-output call. Returns parsed JSON plus the raw result envelope.\n * Degrades `jsonSchema` → `jsonMode` on a 400 that names the schema param —\n * critical for deepseek-v3/v4, kimi-k2.6, and other models that don't accept\n * the `response_format.json_schema` shape but DO accept `json_object`.\n */\nexport async function callLlmJson<T = unknown>(\n  req: LlmCallRequest,\n  opts: LlmClientOptions = {},\n): Promise<{ value: T; result: LlmCallResult }> {\n  const result = await callLlmStructured(req, opts)\n  const value = parseJsonResult<T>(result, opts.jsonPayloadMode ?? 'extract')\n  return { value, result }\n}\n\n/** Shared schema-to-JSON-mode fallback that preserves the raw result. */\nasync function callLlmStructured(\n  req: LlmCallRequest,\n  opts: LlmClientOptions = {},\n): Promise<LlmCallResult> {\n  try {\n    return await callLlm({ ...req, jsonMode: req.jsonMode ?? !req.jsonSchema }, opts)\n  } catch (err) {\n    if (\n      opts.jsonSchemaTransport !== 'json-object' &&\n      err instanceof LlmCallError &&\n      isSchemaRejection(err.status, err.body) &&\n      req.jsonSchema\n    ) {\n      const degradedReq: LlmCallRequest = { ...req, jsonMode: true, jsonSchema: undefined }\n      return await callLlm(degradedReq, opts)\n    }\n    throw err\n  }\n}\n\nfunction parseJsonResult<T>(\n  result: LlmCallResult,\n  jsonPayloadMode: NonNullable<LlmClientOptions['jsonPayloadMode']>,\n): T {\n  try {\n    if (result.finishReason === 'length') {\n      throw new Error(\n        `LLM returned truncated JSON content (model=${result.model}, finishReason=length)`,\n      )\n    }\n    return parseJsonSafely<T>(result.content, result.model, jsonPayloadMode)\n  } catch (error) {\n    if (error instanceof LlmResponseError) throw error\n    const cause = error instanceof Error ? error : new Error(String(error))\n    throw new LlmResponseError(cause.message, result, { cause })\n  }\n}\n\nfunction parseJsonSafely<T>(\n  content: string,\n  model: string,\n  jsonPayloadMode: NonNullable<LlmClientOptions['jsonPayloadMode']>,\n): T {\n  const payload = jsonPayloadMode === 'exact' ? content : extractJsonPayload(content)\n  try {\n    return JSON.parse(payload) as T\n  } catch {\n    throw new Error(`LLM returned non-JSON content (model=${model})`)\n  }\n}\n\n/**\n * Stateful client — construct once with defaults, call many times.\n * Thin wrapper around the free functions; exists for callers that want\n * to inject a single configured instance into multiple primitives.\n */\nexport class LlmClient {\n  readonly maximumAttempts: number\n  private readonly opts: LlmClientOptions\n\n  constructor(opts: LlmClientOptions = {}) {\n    this.opts = opts\n    this.maximumAttempts = resolveMaximumAttempts(opts.maximumAttempts)\n  }\n\n  call(req: LlmCallRequest, per?: LlmClientOptions): Promise<LlmCallResult> {\n    const options = { ...this.opts, ...per }\n    return req.jsonSchema ? callLlmStructured(req, options) : callLlm(req, options)\n  }\n\n  callJson<T = unknown>(\n    req: LlmCallRequest,\n    per?: LlmClientOptions,\n  ): Promise<{ value: T; result: LlmCallResult }> {\n    return callLlmJson<T>(req, { ...this.opts, ...per })\n  }\n}\n"],"mappings":";;;;;;AA2BA,MAAM,kBAA+C;CACnD,WAAW;CACX,QAAQ;CACR,gBAAgB;CAChB,QAAQ;CACR,iBAAiB;CACjB,MAAM;CACN,cAAc;CACd,SAAS;CACT,WAAW;CACX,UAAU;CACV,KAAK;CACL,MAAM;CACN,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,UAAU;CACV,YAAY;CACZ,MAAM;CACN,aAAa;CACb,OAAO;CACP,SAAS;CACT,KAAK;CACL,QAAQ;CACR,KAAK;AACP;;AAGA,MAAM,gBAA8C;CAClD,CAAC,WAAW,WAAW;CACvB,CAAC,0DAA0D,QAAQ;CACnE,CAAC,4BAA4B,QAAQ;CACrC,CAAC,UAAU,MAAM;CACjB,CAAC,oCAAoC,SAAS;CAC9C,CAAC,aAAa,UAAU;CACxB,CAAC,SAAS,KAAK;CACf,CAAC,SAAS,MAAM;CAChB,CAAC,oBAAoB,QAAQ;CAC7B,CAAC,qBAAqB,QAAQ;CAC9B,CAAC,sBAAsB,UAAU;CACjC,CAAC,4BAA4B,OAAO;AACtC;;;;;;;AAQA,SAAgB,YAAY,SAA8B;CACxD,MAAM,KAAK,QAAQ,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAE,YAAY;CACrD,MAAM,QAAQ,GAAG,QAAQ,GAAG;CAC5B,IAAI,QAAQ,GAAG;EACb,MAAM,SAAS,GAAG,MAAM,GAAG,KAAK;EAChC,MAAM,SAAS,gBAAgB;EAC/B,IAAI,QAAQ,OAAO;CACrB;CACA,KAAK,MAAM,CAAC,SAAS,WAAW,eAC9B,IAAI,QAAQ,KAAK,EAAE,GAAG,OAAO;CAE/B,OAAO;AACT;AAWA,IAAa,mBAAb,cAAsC,MAAM;CAGxB;CACA;CAHlB,YACE,SACA,UACA,QACA;EACA,MAAM,OAAO;EAHG,KAAA,WAAA;EACA,KAAA,SAAA;EAGhB,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;;AAeA,SAAgB,kBACd,QACA,OAAiC,CAAC,GACnB;CACf,MAAM,cAAc,KAAK,eAAe;CACxC,MAAM,2BAAW,IAAI,IAAiB;CACtC,KAAK,MAAM,KAAK,QAAQ;EACtB,MAAM,IAAI,YAAY,CAAC;EACvB,IAAI,MAAM,aAAa,CAAC,KAAK,cAAc;EAC3C,SAAS,IAAI,CAAC;CAChB;CACA,MAAM,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK;CAChC,IAAI,KAAK,SAAS,aAChB,MAAM,IAAI,iBACR,wBAAwB,KAAK,OAAO,iBAAiB,KAAK,WAAW,IAAI,MAAM,MAAM,IAC/E,KAAK,KAAK,IAAI,KAAK,OAAO,QAAQ,YAAY,kFAEpD,MACA,MACF;CAEF,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC9DA,SAAgB,iBAAiB,SAAyB;CACxD,IAAI,KAAK,QAAQ,KAAK,CAAC,CAAC,YAAY;CACpC,MAAM,KAAK,GAAG,QAAQ,GAAG;CACzB,IAAI,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,EAAE;CAC/B,MAAM,QAAQ,GAAG,QAAQ,GAAG;CAC5B,IAAI,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK;CACrC,MAAM,QAAQ,GAAG,YAAY,GAAG;CAChC,IAAI,SAAS,GAAG,KAAK,GAAG,MAAM,QAAQ,CAAC;CACvC,OAAO,GACJ,QAAQ,uBAAuB,EAAE,CAAC,CAClC,QAAQ,WAAW,EAAE,CAAC,CACtB,QAAQ,SAAS,GAAG,CAAC,CACrB,QAAQ,OAAO,EAAE,CAAC,CAClB,KAAK;AACV;;;;;;;;;;;AAYA,SAAgB,iBACd,WACA,QACkB;CAClB,MAAM,kBAAkB,YAAY,SAAS;CAC7C,IAAI,WAAW,QAAQ,WAAW,KAAA,KAAa,OAAO,KAAK,MAAM,IAC/D,OAAO;EACL;EACA,QAAQ;EACR;EACA,cAAc;EACd,SAAS;EACT,aAAa;CACf;CAEF,MAAM,eAAe,YAAY,MAAM;CACvC,IAAI,UAAU,KAAK,CAAC,CAAC,YAAY,MAAM,OAAO,KAAK,CAAC,CAAC,YAAY,GAC/D,OAAO;EACL;EACA;EACA;EACA;EACA,SAAS;EACT,aAAa;CACf;CAEF,IAAI,iBAAiB,SAAS,MAAM,iBAAiB,MAAM,GACzD,OAAO;EACL;EACA;EACA;EACA;EACA,SAAS;EACT,aAAa;CACf;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA,SACE,oBAAoB,eAAe,8BAA8B;EACnE,aAAa;CACf;AACF;AAEA,IAAa,yBAAb,cAA4C,eAAe;CAGvC;CAFlB,YACE,SACA,QACA;EACA,MAAM,sBAAsB,OAAO;EAFnB,KAAA,SAAA;EAGhB,KAAK,OAAO;CACd;AACF;AAWA,SAAgB,wBACd,OACA,OACgD;CAChD,IAAI,UAAU,KAAA,KAAa,UAAU,WAAW,UAAU,uBACxD,MAAM,IAAI,MAAM,GAAG,MAAM,0CAA0C;AAEvE;;;;;;AAuBA,SAAgB,sBACd,OACA,OAAiC,CAAC,GACzB;CACT,QAAQ,MAAM,SAAd;EACE,KAAK;EACL,KAAK,SACH,OAAO;EACT,KAAK,cACH,OAAO,KAAK,oBAAoB;EAClC,KAAK,6BACH,OAAO,KAAK,sBAAsB;EACpC,SACE,OAAO;CACX;AACF;AAEA,SAAS,SAAS,OAAiC;CACjD,IAAI,MAAM,YAAY,cACpB,OAAO,GAAG,MAAM,UAAU;CAC5B,OACE,GAAG,MAAM,UAAU,IAAI,MAAM,gBAAgB,aAAa,MAAM,OAAO,IACnE,MAAM,aAAa,KAAK,MAAM,QAAQ;AAE9C;;;;;;AAOA,SAAgB,kBACd,WACA,QACA,OAAiC,CAAC,GAChB;CAClB,MAAM,QAAQ,iBAAiB,WAAW,MAAM;CAChD,IAAI,sBAAsB,OAAO,IAAI,GAAG,OAAO;CAE/C,MAAM,IAAI,uBACR,GAFa,KAAK,UAAU,GAAG,KAAK,QAAQ,MAAM,GAExC,uBAAuB,SAAS,KAAK,EAAE,gIAEjD,CAAC,KAAK,CACR;AACF;;;;;AAMA,SAAgB,mBACd,OACA,OAAiC,CAAC,GACd;CACpB,MAAM,SAAS,MAAM,KAAK,MAAM,iBAAiB,EAAE,WAAW,EAAE,MAAM,CAAC;CACvE,MAAM,MAAM,OAAO,QAAQ,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC;CAChE,IAAI,IAAI,SAAS,GAEf,MAAM,IAAI,uBACR,GAFa,KAAK,UAAU,GAAG,KAAK,QAAQ,MAAM,KAEtC,IAAI,OAAO,GAAG,OAAO,OAAO,+DACvB,IAAI,IAAI,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,6FAE9C,MACF;CAEF,OAAO;AACT;AASA,IAAa,yBAAb,cAA4C,eAAe;CAGvC;CACA;CAHlB,YACE,SACA,UACA,QACA;EACA,MAAM,sBAAsB,OAAO;EAHnB,KAAA,WAAA;EACA,KAAA,SAAA;EAGhB,KAAK,OAAO;CACd;AACF;;;;;;;;;;AAWA,SAAgB,wBACd,OACA,OAAuC,CAAC,GACzB;CACf,MAAM,SAAS,mBAAmB,OAAO,IAAI;CAC7C,MAAM,2BAAW,IAAI,IAAiB;CACtC,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,SAAS,MAAM;EACrB,IAAI,WAAW,MAAM;EACrB,IAAI,WAAW,aAAa,CAAC,KAAK,cAAc;EAChD,SAAS,IAAI,MAAM;CACrB;CACA,MAAM,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK;CAChC,MAAM,cAAc,KAAK,eAAe;CACxC,IAAI,KAAK,SAAS,aAEhB,MAAM,IAAI,uBACR,GAFa,KAAK,UAAU,GAAG,KAAK,QAAQ,MAAM,GAExC,gCAAgC,KAAK,OAAO,iBACjD,KAAK,WAAW,IAAI,MAAM,MAAM,IAAI,KAAK,KAAK,IAAI,KAAK,OAAO,QAAQ,YAAY,0BAC3D,OAAO,KAAK,MAAM,EAAE,UAAU,YAAY,CAAC,CAAC,KAAK,IAAI,KACjF,MACA,MACF;CAEF,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC3LA,SAAgB,2BACd,SAIA,UAA2B,CAAC,GACD;CAC3B,IAAI,QAAQ,cAAc,KAAA,GAAW,OAAO,KAAA;CAC5C,IAAI,CAAC,OAAO,UAAU,QAAQ,SAAS,KAAK,QAAQ,aAAa,GAC/D,MAAM,IAAI,WAAW,kEAAkE;CAEzF,IACE,QAAQ,SAAS,MACd,YACC,MAAM,QAAQ,QAAQ,OAAO,KAAK,QAAQ,QAAQ,MAAM,SAAS,KAAK,SAAS,WAAW,CAC9F,GAEA;CAGF,MAAM,WAAW,uBAAuB,QAAQ,eAAe;CAC/D,MAAM,kBAAkB,QAAQ,wBAAwB;CAGxD,MAAM,eAAe,IAAI,YAAY,CAAC,CAAC,OACrC,KAAK,UAAU,UAAU,SAAS,iBAAiB,QAAQ,QAAQ,CAAC,CACtE,CAAC,CAAC;CAEF,MAAM,UAAU,QAAQ,cAAc,CAAC,kBAAkB,IAAI;CAC7D,MAAM,QAAQ;EACZ,aAAa,eAAe,WAAW;EACvC,cAAc,QAAQ,YAAY,WAAW;CAC/C;CACA,OAAO,QAAQ,qBACX;EAAE,oBAAoB,QAAQ;EAAoB,GAAG;CAAM,IAC3D;EAAE,OAAO,QAAQ;EAAO,GAAG;CAAM;AACvC;;;;;;AA2FA,SAAgB,mBACd,QACA,oBACkB;CAClB,MAAM,eAAe,OAAO,MAAM,sBAAsB;CACxD,MAAM,cAAc,KAAK,IAAI,GAAG,OAAO,MAAM,eAAe,YAAY;CACxE,MAAM,kBAAkB,qBAAqB,OAAO,GAAG;CACvD,OAAO;EACL,OAAO,OAAO;EACd;EACA,cAAc,OAAO,MAAM;EAC3B,GAAI,OAAO,MAAM,oBAAoB,KAAA,IACjC,CAAC,IACD,EAAE,iBAAiB,OAAO,MAAM,gBAAgB;EACpD,GAAI,eAAe,IAAI,EAAE,aAAa,IAAI,CAAC;EAC3C,GAAI,oBAAoB,KAAA,IACpB,sBAAsB,OAAO,MAAM,aAAa,QAC9C,EAAE,mBAAmB,IACrB,OAAO,YAAY,OACjB,CAAC,IACD,EAAE,kBAAkB,OAAO,QAAQ,IACvC,EAAE,eAAe,gBAAgB;EACrC,cAAc,OAAO,MAAM,aAAa;CAC1C;AACF;AAEA,SAAS,qBAAqB,KAAkD;CAC9E,MAAM,QAAQ,IAAI,kBAAkB,IAAI;CACxC,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAA;AACrF;;AAGA,SAAgB,wBACd,OACA,oBAC8B;CAC9B,OAAO,iBAAiB,mBACpB,mBAAmB,MAAM,QAAQ,kBAAkB,IACnD,KAAA;AACN;AAEA,IAAa,eAAb,cAAkC,eAAe;CAG7B;CACA;CACA;CAJlB,YACE,SACA,QACA,MACA,OACA;EACA,MAAM,SAAS,OAAO;EAJN,KAAA,SAAA;EACA,KAAA,OAAA;EACA,KAAA,QAAA;CAGlB;AACF;;;;AAKA,IAAa,mBAAb,cAAsC,eAAe;CAGjC;CAFlB,YACE,SACA,QACA,SACA;EACA,MAAM,SAAS,SAAS,OAAO;EAHf,KAAA,SAAA;CAIlB;AACF;AA4EA,MAAM,qBAAqB,OAAO,QAAQ,IAAI,qBAAqB,KAAK;AACxE,MAAM,2BACJ,QAAQ,IAAI,gCAAgC,KAAA,IACxC,IACA,OAAO,QAAQ,IAAI,2BAA2B;AAEpD,SAAS,uBAAuB,YAAwC;CACtE,MAAM,WAAW,cAAc;CAC/B,IAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,YAAY,GAC7C,MAAM,IAAI,WAAW,iDAAiD;CAExE,OAAO;AACT;AAEA,SAAS,mBAAmB,OAAoC;CAC9D,OAAO,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAA;AAC1F;AAKA,MAAM,mCAAmB,IAAI,IAAI;CAAC;CAAK;CAAK;CAAK;CAAK;CAAK;AAAG,CAAC;;;;;;;;;;AAW/D,MAAM,2BAA8C;CAClD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;;;;;AAaA,SAAgB,oBAAoB,KAAuB;CACzD,OAAO,kBAAkB,KAAK,CAAC;AACjC;AAEA,SAAS,kBAAkB,KAAc,OAAwB;CAC/D,IAAI,eAAe,cAAc,OAAO,iBAAiB,IAAI,IAAI,MAAM;CACvE,IAAI,EAAE,eAAe,QAAQ,OAAO;CAGpC,MAAM,SAAU,IAA6B;CAC7C,IAAI,OAAO,WAAW,YAAY,iBAAiB,IAAI,MAAM,GAAG,OAAO;CACvE,MAAM,OAAQ,IAA2B;CACzC,MAAM,WAAW,GAAG,IAAI,KAAK,IAAI,IAAI,QAAQ,IAAI,OAAO,SAAS,WAAW,OAAO;CACnF,IAAI,yBAAyB,MAAM,MAAM,EAAE,KAAK,QAAQ,CAAC,GAAG,OAAO;CACnE,MAAM,QAAS,IAA4B;CAC3C,IAAI,QAAQ,KAAK,iBAAiB,SAAS,UAAU,KACnD,OAAO,kBAAkB,OAAO,QAAQ,CAAC;CAE3C,OAAO;AACT;AAEA,SAAS,gBAAgB,SAAiC;CACxD,MAAM,IAAI,QAAQ,IAAI,aAAa;CACnC,IAAI,CAAC,GAAG,OAAO;CACf,MAAM,WAAW,OAAO,CAAC;CACzB,IAAI,OAAO,SAAS,QAAQ,KAAK,WAAW,GAAG,OAAO,WAAW;CACjE,MAAM,SAAS,KAAK,MAAM,CAAC;CAC3B,IAAI,OAAO,SAAS,MAAM,GAAG,OAAO,KAAK,IAAI,GAAG,SAAS,KAAK,IAAI,CAAC;CACnE,OAAO;AACT;;AAGA,SAAgB,UAAU,SAAyB;CACjD,OAAO,KAAK,IAAI,MAAM,KAAK,SAAS,IAAM;AAC5C;AAEA,SAAS,aAAa,MAAgD;CACpE,MAAM,UAAkC;EACtC,gBAAgB;EAChB,QAAQ;CACV;CACA,IAAI,KAAK,YACP,QAAQ,KAAK,WAAW,QAAQ,KAAK,WAAW;MAC3C,IAAI,KAAK,UAAU,KAAK,QAC7B,QAAQ,gBAAgB,UAAU,KAAK,UAAU,KAAK;CAExD,IAAI,KAAK,gBAAgB,QAAQ,qBAAqB,KAAK;CAC3D,OAAO;AACT;AAEA,SAAS,kBAAkB,QAAgB,MAAuB;CAChE,IAAI,WAAW,KAAK,OAAO;CAC3B,MAAM,QAAQ,KAAK,YAAY;CAC/B,OACE,MAAM,SAAS,iBAAiB,KAChC,MAAM,SAAS,aAAa,KAC5B,MAAM,SAAS,gBAAgB,KAC/B,MAAM,SAAS,eAAe;AAElC;AAEA,SAAS,0BAA0B,QAAgB,MAAuB;CACxE,IAAI,WAAW,OAAO,CAAC,eAAe,KAAK,IAAI,GAAG,OAAO;CACzD,OACE,iGAAiG,KAC/F,IACF,KAAK,oEAAoE,KAAK,IAAI;AAEtF;AAEA,SAAS,UACP,KACA,iBACA,iBACyB;CACzB,MAAM,OAAgC;EACpC,OAAO,IAAI;EACX,UAAU,IAAI,SAAS,IAAI,iBAAiB;EAC5C,aAAa,IAAI,eAAe;CAClC;CACA,IAAI,IAAI,aAAa,MACnB,IAAI,wBAAwB,IAAI,KAAK,GAAG,KAAK,wBAAwB,IAAI;MACpE,KAAK,aAAa,IAAI;CAE7B,IAAI,IAAI,aAAa,KAAA,GAAW;EAC9B,KAAK,WAAW;EAChB,KAAK,eAAe,IAAI,SAAS;CACnC;CACA,IAAI,IAAI,UAAU,KAAA,GAAW,KAAK,QAAQ,IAAI;CAC9C,IAAI,IAAI,eAAe,KAAA,GAAW,KAAK,cAAc,IAAI;CACzD,MAAM,WAAW,IAAI,YAAY;CACjC,IAAI,aAAa,KAAA,GACf,KAAK,WAAW,EAAE,MAAM,SAAS;CAGnC,IAAI,IAAI,cAAc,CAAC,iBACrB,KAAK,kBAAkB;EACrB,MAAM;EACN,aAAa;GAAE,MAAM,IAAI,WAAW;GAAM,QAAQ,IAAI,WAAW;GAAQ,QAAQ;EAAK;CACxF;MACK,IAAI,IAAI,YAAY,IAAI,YAC7B,KAAK,kBAAkB,EAAE,MAAM,cAAc;CAG/C,OAAO;AACT;AAEA,SAAS,wBAAwB,OAAwB;CACvD,OAAO,oBAAoB,KAAK,KAAK;AACvC;;AAGA,SAAS,kBAAkB,SAA8C;CACvE,IAAI,QAAQ,SAAS,QACnB,OAAO;EAAE,MAAM;EAAQ,cAAc,QAAQ;EAAY,SAAS,QAAQ;CAAQ;CAEpF,IAAI,QAAQ,cAAc,KAAA,GACxB,OAAO;EAAE,MAAM,QAAQ;EAAM,SAAS,QAAQ;CAAQ;CAExD,OAAO;EACL,MAAM,QAAQ;EACd,SAAS,QAAQ;EACjB,YAAY,QAAQ,UAAU,KAAK,UAAU;GAC3C,IAAI,KAAK;GACT,MAAM;GACN,UAAU;IAAE,MAAM,KAAK;IAAM,WAAW,KAAK;GAAc;EAC7D,EAAE;CACJ;AACF;;;;;;;AAQA,SAAS,kBAAkB,OAAgB,OAAsD;CAC/F,IAAI,UAAU,KAAA,KAAa,UAAU,MAAM,OAAO;CAClD,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,MAAM,yDAAyD,MAAM,EAAE;CAEnF,OAAO,MAAM,KAAK,OAAO,UAAU;EACjC,MAAM,SAAS;EACf,IACE,CAAC,UACD,OAAO,WAAW,YAClB,OAAO,OAAO,UAAU,YACxB,OAAO,OAAO,YAAY,YAC1B,CAAC,OAAO,SAAS,OAAO,OAAO,GAE/B,MAAM,IAAI,MACR,iCAAiC,MAAM,gDAAgD,MAAM,EAC/F;EAEF,MAAM,MAAM,OAAO;EACnB,IAAI,QAAQ,KAAA,KAAa,QAAQ,QAAQ,CAAC,MAAM,QAAQ,GAAG,GACzD,MAAM,IAAI,MACR,iCAAiC,MAAM,yCAAyC,MAAM,EACxF;EAEF,OAAO;GACL,OAAO,OAAO;GACd,SAAS,OAAO;GAChB,MAAM,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,EAAA,CAAG,KAAK,aAAa,aAAa;IAClE,MAAM,YAAY;IAClB,IACE,CAAC,aACD,OAAO,cAAc,YACrB,OAAO,UAAU,UAAU,YAC3B,OAAO,UAAU,YAAY,YAC7B,CAAC,OAAO,SAAS,UAAU,OAAO,GAElC,MAAM,IAAI,MACR,iCAAiC,MAAM,iBAAiB,SAAS,gDAAgD,MAAM,EACzH;IAEF,OAAO;KAAE,OAAO,UAAU;KAAO,SAAS,UAAU;IAAQ;GAC9D,CAAC;EACH;CACF,CAAC;AACH;;;AAIA,SAAS,mBAAmB,OAAgB,OAA0C;CACpF,IAAI,UAAU,KAAA,KAAa,UAAU,MAAM,OAAO,KAAA;CAClD,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,MAAM,mDAAmD,MAAM,EAAE;CAE7E,IAAI,MAAM,WAAW,GAAG,OAAO,KAAA;CAC/B,OAAO,MAAM,KAAK,OAAO,UAAU;EACjC,MAAM,SAAS;EAKf,MAAM,KAAK,UAAU,OAAO,WAAW,WAAW,OAAO,WAAW,KAAA;EACpE,IACE,CAAC,UACD,OAAO,WAAW,YAClB,OAAO,OAAO,OAAO,YACrB,OAAO,GAAG,WAAW,KACpB,OAAO,SAAS,KAAA,KAAa,OAAO,SAAS,cAC9C,CAAC,MACD,OAAO,OAAO,YACd,OAAO,GAAG,SAAS,YACnB,GAAG,KAAK,WAAW,KACnB,OAAO,GAAG,cAAc,UAExB,MAAM,IAAI,MACR,2BAA2B,MAAM,wDAAwD,MAAM,EACjG;EAEF,OAAO;GAAE,IAAI,OAAO;GAAI,MAAM,GAAG;GAAM,eAAe,GAAG;EAAU;CACrE,CAAC;AACH;AAEA,eAAe,MAAM,IAA2B;CAC9C,OAAO,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;;;;;;;;AASA,SAAS,YAAY,mBAAoC,QAAmC;CAC1F,IAAI,CAAC,QAAQ,OAAO,kBAAkB;CACtC,IAAI,OAAQ,YAAkC,QAAQ,YACpD,OAAO,YAAY,IAAI,CAAC,kBAAkB,QAAQ,MAAM,CAAC;CAE3D,IAAI,OAAO,SACT,kBAAkB,MAAM;MAExB,OAAO,iBAAiB,eAAe,kBAAkB,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;CAElF,OAAO,kBAAkB;AAC3B;;AAGA,SAAS,iBAAiB,OAAe,YAAyC;CAChF,OAAO,cAAc,QAAQ,KAAK,IAAI,IAAI,SAAS;AACrD;;;;;;AASA,SAAgB,gBAAgB,KAAqB;CACnD,MAAM,UAAU,IAAI,KAAK;CACzB,MAAM,IAAI,QAAQ,MAAM,yCAAyC;CACjE,OAAO,IAAI,EAAE,EAAE,CAAE,KAAK,IAAI;AAC5B;AAEA,SAAgB,mBAAmB,KAAqB;CACtD,MAAM,WAAW,gBAAgB,GAAG;CACpC,IAAI;EACF,KAAK,MAAM,QAAQ;EACnB,OAAO;CACT,QAAQ;EAIN,IAAI,SAAS,WAAW,GAAG,KAAK,SAAS,WAAW,GAAG,GAAG,OAAO;CACnE;CAGA,MAAM,SAAS,CAAC,GAAG,SAAS,SAAS,OAAO,CAAC,CAAC,CAC3C,KAAK,UAAU,MAAM,KAAK,CAAC,CAC3B,QAAQ,UAAU,SAAS,IAAI;CAClC,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,YAAY,oBAAoB,UAAU,KAAK;EACrD,IAAI,CAAC,WAAW;EAChB,IAAI;GACF,KAAK,MAAM,SAAS;GACpB,OAAO;EACT,QAAQ,CAER;CACF;CAEA,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAe,OAA8B;CACxE,MAAM,SAAS,MAAM;CACrB,MAAM,SAAS,WAAW,MAAM,MAAM,WAAW,MAAM,MAAM;CAC7D,IAAI,CAAC,QAAQ,OAAO;CAEpB,MAAM,QAAkB,CAAC,MAAM;CAC/B,IAAI,aAAa;CACjB,IAAI,YAAY;CAEhB,KAAK,IAAI,IAAI,QAAQ,GAAG,IAAI,MAAM,QAAQ,KAAK;EAC7C,MAAM,OAAO,MAAM;EACnB,IAAI,WAAW;GACb,YAAY;GACZ;EACF;EACA,IAAI,SAAS,MAAM;GACjB,YAAY;GACZ;EACF;EACA,IAAI,SAAS,MAAK;GAChB,aAAa,CAAC;GACd;EACF;EACA,IAAI,YAAY;EAEhB,IAAI,SAAS,KAAK,MAAM,KAAK,GAAG;OAC3B,IAAI,SAAS,KAAK,MAAM,KAAK,GAAG;OAChC,IAAI,SAAS,MAAM,MAAM,SAAS,IAAI;GACzC,MAAM,IAAI;GACV,IAAI,MAAM,WAAW,GAAG,OAAO,MAAM,MAAM,OAAO,IAAI,CAAC;EACzD;CACF;CAEA,OAAO;AACT;;;;;;AAOA,eAAsB,QACpB,KACA,OAAyB,CAAC,GACF;CAIxB,IAAI,CAAC,KAAK,SAAS,MAAM,IAAI,MAAM,mCAAmC;CACtE,MAAM,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;CAC/C,MAAM,MAAM,GAAG,QAAQ;CACvB,MAAM,WAAW;CACjB,MAAM,YAAY,IAAI,aAAa,KAAK,oBAAoB;CAC5D,MAAM,kBAAkB,uBAAuB,KAAK,eAAe;CACnE,MAAM,UAAU,KAAK,SAAS,WAAW;CACzC,MAAM,UAAU,aAAa,IAAI;CACjC,MAAM,WAAW,KAAK,YAAY,oBAAoB,OAAO;CAC7D,MAAM,OAAO,KAAK;CAClB,MAAM,WAAW,KAAK,YAAY;CAClC,MAAM,eAAe,KAAK;CAC1B,MAAM,eAAe,KAAK;CAC1B,MAAM,aAAa,KAAK;CACxB,MAAM,gBAAgB,KAAK,IAAI;CAC/B,IAAI,KAAK,oBACP,oBAAoB,KAAK,oBAAoB;EAAE,aAAa;EAAG,cAAc;CAAE,CAAC;CAGlF,IAAI;CACJ,IAAI,mBAAmB;CACvB,KAAK,IAAI,UAAU,GAAG,UAAU,iBAAiB,WAAW;EAG1D,IAAI,cAAc,SAChB,MAAM,IAAI,aAAa,oCAAoC,YAAY;EAIzE,IAAI,UAAU,KAAK,iBAAiB,eAAe,UAAU,GAC3D,MAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,OAAO,OAAO,CAAC;EAEtE,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,gBAAgB,YAAY,YAAY,YAAY;EAC1D,MAAM,gBAAgB,iBAAiB,WAAW,MAAM,GAAG,SAAS;EACpE,MAAM,UAAU,KAAK,IAAI;EACzB,MAAM,cAAc,UAClB,kBACA,KAAK,wBAAwB,eAC7B,KAAK,QACP;EACA,IAAI,uBAAuB;EAC3B,IAAI,MACF,MAAM,UAAU,MAAM,UAAU;GAC9B,SAAS,YAAY;GACrB,OAAO,cAAc;GACrB,QAAQ,cAAc;GACtB;GACA,OAAO,IAAI;GACX;GACA;GACA,cAAc;GACd,WAAW;GACX,WAAW;GACX,gBAAgB;GAChB;GACA,gBAAgB,CAAC;EACnB,CAAC;EAGH,IAAI;GACF,MAAM,MAAM,MAAM,QAAQ,KAAK;IAC7B,QAAQ;IACR;IACA,MAAM,KAAK,UAAU,WAAW;IAChC,QAAQ;GACV,CAAC;GACD,aAAa,aAAa;GAC1B,MAAM,kBAAkB,OAAO,gBAAgB,IAAI,OAAO,IAAI,KAAA;GAE9D,IAAI,CAAC,IAAI,IAAI;IACX,MAAM,OAAO,MAAM,IAAI,KAAK;IAC5B,IAAI,MAAM;KACR,MAAM,UAAU,MAAM,UAAU;MAC9B,SAAS,YAAY;MACrB,OAAO,cAAc;MACrB,QAAQ,cAAc;MACtB;MACA,OAAO,IAAI;MACX;MACA;MACA,cAAc;MACd,WAAW;MACX,WAAW,KAAK,IAAI;MACpB,YAAY,KAAK,IAAI,IAAI;MACzB,YAAY,IAAI;MAChB;MACA,cAAc;MACd,cAAc,QAAQ,IAAI;MAC1B,gBAAgB,CAAC;KACnB,CAAC;KACD,uBAAuB;IACzB;IACA,MAAM,MAAM,IAAI,aACd,6BAA6B,IAAI,UACjC,IAAI,QACJ,MACA,IAAI,KACN;IACA,IACE,0BAA0B,IAAI,QAAQ,IAAI,KAC1C,iBAAiB,gBAAgB,KACjC,UAAU,kBAAkB,KAC5B,CAAC,iBAAiB,eAAe,UAAU,GAC3C;KACA,UAAU;KACV,mBAAmB;MAAE,GAAG;MAAkB,aAAa;KAAE;KACzD;IACF;IACA,IACE,iBAAiB,IAAI,IAAI,MAAM,KAC/B,UAAU,kBAAkB,KAC5B,CAAC,iBAAiB,eAAe,UAAU,GAC3C;KACA,UAAU;KAEV,MAAM,MADa,gBAAgB,IAAI,OAClB,KAAK,UAAU,OAAO,CAAC;KAC5C;IACF;IACA,MAAM;GACR;GAEA,MAAM,OAAO,MAAM,IAAI,KAAK;GAC5B,IAAI;GACJ,IAAI;IACF,OAAO,KAAK,MAAM,IAAI;GACxB,SAAS,UAAU;IACjB,IAAI,MAAM;KACR,MAAM,UAAU,MAAM,UAAU;MAC9B,SAAS,YAAY;MACrB,OAAO,cAAc;MACrB,QAAQ,cAAc;MACtB;MACA,OAAO,IAAI;MACX;MACA;MACA,cAAc;MACd,WAAW;MACX,WAAW,KAAK,IAAI;MACpB,YAAY,KAAK,IAAI,IAAI;MACzB,YAAY,IAAI;MAChB;MACA,cAAc;MACd,cAAc,sBAAsB,oBAAoB,QAAQ,SAAS,UAAU,OAAO,QAAQ;MAClG,gBAAgB,CAAC;KACnB,CAAC;KACD,uBAAuB;IACzB;IACA,MAAM;GACR;GACA,IAAI,MACF,MAAM,UAAU,MAAM,UAAU;IAC9B,SAAS,YAAY;IACrB,OAAO,cAAc;IACrB,QAAQ,cAAc;IACtB;IACA,OAAO,IAAI;IACX;IACA;IACA,cAAc;IACd,WAAW;IACX,WAAW,KAAK,IAAI;IACpB,YAAY,KAAK,IAAI,IAAI;IACzB,YAAY,IAAI;IAChB;IACA,cAAc;IACd,gBAAgB,CAAC;GACnB,CAAC;GAEH,MAAM,SACJ,KAAK,UAOH;GACJ,MAAM,YAAY,mBAAmB,QAAQ,SAAS,YAAY,IAAI,KAAK;GAC3E,MAAM,WACJ,KAAK,SAAS,OAAO,KAAK,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,IACpE,KAAK,QACN,KAAA;GACN,MAAM,eAAe,mBAAmB,UAAU,aAAa;GAC/D,MAAM,mBAAmB,mBAAmB,UAAU,iBAAiB;GACvE,MAAM,cAAc,mBAAmB,UAAU,YAAY;GAO7D,MAAM,gBALJ,UAAU,6BACV,OAAO,SAAS,8BAA8B,YAC9C,CAAC,MAAM,QAAQ,SAAS,yBAAyB,IAC5C,SAAS,4BACV,KAAA,EAAA,EACkC;GACxC,MAAM,kBACJ,iBAAiB,KAAA,IAAY,KAAA,IAAY,mBAAmB,YAAY;GAC1E,MAAM,YACJ,UAAU,yBACV,OAAO,SAAS,0BAA0B,YAC1C,CAAC,MAAM,QAAQ,SAAS,qBAAqB,IACxC,SAAS,sBAAkD,gBAC5D,KAAA;GACN,MAAM,qBAAqB,cAAc,KAAA,IAAY,KAAA,IAAY,mBAAmB,SAAS;GAC7F,MAAM,gBACJ,iBAAiB,KAAA,KACjB,qBAAqB,KAAA,MACpB,iBAAiB,KAAA,KACf,oBAAoB,KAAA,KAAa,mBAAmB,sBACtD,cAAc,KAAA,KACZ,uBAAuB,KAAA,KAAa,sBAAsB,kBAC5D,gBAAgB,KAAA,KAAa,gBAAgB,eAAe;GAC/D,MAAM,gBAAiB,KAAK,kBAAkB,KAAK;GACnD,MAAM,UAAU,QAAQ,SAAS,WAAW;GAE5C,MAAM,iBACJ,OAAO,kBAAkB,YAAY,iBAAiB,KAAK,qBACvD,oBAAoB,KAAK,oBAAoB;IAC3C,aAAa,gBAAiB,sBAAsB;IACpD,GAAI,qBAAqB,EAAE,cAAc,mBAAmB,IAAI,CAAC;IACjE,cAAc;GAChB,CAAC,IACD,KAAA;GAIN,MAAM,cACJ,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,MAAM,KAAK,KAAK,QAAQ;GAC5E,IAAI,KAAK,mBACP,kBACE,IAAI,OACJ,aACA,KAAK,sBAAsB,OAAO,CAAC,IAAI,KAAK,iBAC9C;GAGF,OAAO;IACL;IACA,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;IAC/C,GAAI,IAAI,aAAa,KAAA,IACjB,CAAC,IACD,EAAE,UAAU,kBAAkB,QAAQ,UAAU,SAAS,IAAI,KAAK,EAAE;IACxE,cAAc,QAAQ,iBAAiB;IACvC,cAAc,QAAQ,KAAK,CAAC,CAAC,WAAW;IACxC,OAAO;KACL,cAAc,gBAAgB;KAC9B,kBAAkB,oBAAoB;KACtC,aAAa,gBAAgB,gBAAgB,MAAM,oBAAoB;KACvE,UAAU;KACV;KACA;IACF;IACA,SAAS,OAAO,kBAAkB,WAAW,gBAAiB,kBAAkB;IAChF,OAAO,eAAe,IAAI;IAC1B;IACA,YAAY,KAAK,IAAI,IAAI;IACzB,KAAK;GACP;EACF,SAAS,KAAK;GACZ,aAAa,aAAa;GAC1B,UAAU;GAIV,IAAI,cAAc,SAAS;IACzB,IAAI,QAAQ,CAAC,sBACX,MAAM,UAAU,MAAM,UAAU;KAC9B,SAAS,YAAY;KACrB,OAAO,cAAc;KACrB,QAAQ,cAAc;KACtB;KACA,OAAO,IAAI;KACX;KACA;KACA,cAAc;KACd,WAAW;KACX,WAAW,KAAK,IAAI;KACpB,YAAY,KAAK,IAAI,IAAI;KACzB,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;KAC7D,gBAAgB,CAAC;IACnB,CAAC;IAEH,MAAM;GACR;GACA,IAAI,QAAQ,CAAC,sBAIX,MAAM,UAAU,MAAM,UAAU;IAC9B,SAAS,YAAY;IACrB,OAAO,cAAc;IACrB,QAAQ,cAAc;IACtB;IACA,OAAO,IAAI;IACX;IACA;IACA,cAAc;IACd,WAAW;IACX,WAAW,KAAK,IAAI;IACpB,YAAY,KAAK,IAAI,IAAI;IACzB,cAAc,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;IAC7D,gBAAgB,CAAC;GACnB,CAAC;GAEH,IACE,UAAU,kBAAkB,KAC5B,oBAAoB,GAAG,KACvB,CAAC,iBAAiB,eAAe,UAAU,GAC3C;IACA,MAAM,MAAM,UAAU,OAAO,CAAC;IAC9B;GACF;GACA,MAAM;EACR;CACF;CACA,MAAM,mBAAmB,QAAQ,UAAU,IAAI,MAAM,OAAO,OAAO,CAAC;AACtE;AAEA,eAAe,UACb,MACA,UACA,OACe;CAGf,IAAI;EACF,MAAM,KAAK,OAAO,SAAS,KAAK,CAAC;CACnC,QAAQ,CAER;AACF;AAEA,SAAS,gBAAgB,GAAoC;CAC3D,MAAM,MAA8B,CAAC;CACrC,EAAE,SAAS,OAAO,QAAQ;EACxB,IAAI,OAAO;CACb,CAAC;CACD,OAAO;AACT;;;;;;;AAQA,eAAsB,YACpB,KACA,OAAyB,CAAC,GACoB;CAC9C,MAAM,SAAS,MAAM,kBAAkB,KAAK,IAAI;CAEhD,OAAO;EAAE,OADK,gBAAmB,QAAQ,KAAK,mBAAmB,SACpD;EAAG;CAAO;AACzB;;AAGA,eAAe,kBACb,KACA,OAAyB,CAAC,GACF;CACxB,IAAI;EACF,OAAO,MAAM,QAAQ;GAAE,GAAG;GAAK,UAAU,IAAI,YAAY,CAAC,IAAI;EAAW,GAAG,IAAI;CAClF,SAAS,KAAK;EACZ,IACE,KAAK,wBAAwB,iBAC7B,eAAe,gBACf,kBAAkB,IAAI,QAAQ,IAAI,IAAI,KACtC,IAAI,YAGJ,OAAO,MAAM,QAAQ;GADiB,GAAG;GAAK,UAAU;GAAM,YAAY,KAAA;EAC3C,GAAG,IAAI;EAExC,MAAM;CACR;AACF;AAEA,SAAS,gBACP,QACA,iBACG;CACH,IAAI;EACF,IAAI,OAAO,iBAAiB,UAC1B,MAAM,IAAI,MACR,8CAA8C,OAAO,MAAM,uBAC7D;EAEF,OAAO,gBAAmB,OAAO,SAAS,OAAO,OAAO,eAAe;CACzE,SAAS,OAAO;EACd,IAAI,iBAAiB,kBAAkB,MAAM;EAC7C,MAAM,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;EACtE,MAAM,IAAI,iBAAiB,MAAM,SAAS,QAAQ,EAAE,MAAM,CAAC;CAC7D;AACF;AAEA,SAAS,gBACP,SACA,OACA,iBACG;CACH,MAAM,UAAU,oBAAoB,UAAU,UAAU,mBAAmB,OAAO;CAClF,IAAI;EACF,OAAO,KAAK,MAAM,OAAO;CAC3B,QAAQ;EACN,MAAM,IAAI,MAAM,wCAAwC,MAAM,EAAE;CAClE;AACF;;;;;;AAOA,IAAa,YAAb,MAAuB;CACrB;CACA;CAEA,YAAY,OAAyB,CAAC,GAAG;EACvC,KAAK,OAAO;EACZ,KAAK,kBAAkB,uBAAuB,KAAK,eAAe;CACpE;CAEA,KAAK,KAAqB,KAAgD;EACxE,MAAM,UAAU;GAAE,GAAG,KAAK;GAAM,GAAG;EAAI;EACvC,OAAO,IAAI,aAAa,kBAAkB,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO;CAChF;CAEA,SACE,KACA,KAC8C;EAC9C,OAAO,YAAe,KAAK;GAAE,GAAG,KAAK;GAAM,GAAG;EAAI,CAAC;CACrD;AACF"}