@tangle-network/agent-eval 0.163.2 → 0.171.0

package/CHANGELOG.md

@@ -4,6 +4,133 @@ All notable changes to `@tangle-network/agent-eval` and its sibling `agent-eval-
 
 ---
 
+## [0.171.0] — 2026-08-31
+
+### Changed
+
+- Compile and publish the exported `AgentProfile` contract against `@tangle-network/agent-interface` 2.
+  This keeps Eval, Runtime, and consumers on one canonical profile type.
+- Refresh direct dependencies to their latest approved versions.
+- Pin Zod 4.5.4 through a version-scoped release-age exception for this compatibility cohort.
+- Set Node.js 20.19.0 as the minimum version required by the dependency graph.
+- Pin the four dependency manifests with digest `43f2e94849ab4d777ac8c0c358c6c4f0687129c322c0565fb5cc8583922a433d`.
+
+---
+
+## [0.170.0] — 2026-08-21
+
+### Added
+
+- `pnpm check:collation-ordering`, wired into `verify:package`. It reports a `localeCompare` comparator inside a function that also canonicalizes or hashes — the shape that let eleven orderings decide a digest from the host's collation rather than from the value. The rule is narrow on purpose: ordering a table a human reads is not this gate's business, and a Markdown renderer that sorts rows does not canonicalize, so it is not reported. An allowlist entry matching nothing fails the gate, so a stale waiver cannot hide a new one.
+- `scripts/source-scan.mjs` holds the reading primitives both source gates share — walking `src/`, naming a function by its binding, locating an offset, visiting a tree. A second gate with its own copies would have re-created the duplication these releases removed, and sharing them means the naming fix in 0.168.1 reaches both gates rather than one.
+
+---
+
+## [0.169.0] — 2026-08-21
+
+### Fixed
+
+- Eleven orderings that reach a digest, a stable serialization, or a stored identity no longer read the host's collation. RFC 8785 canonicalizes an array **by position**, so a `localeCompare` sort in front of `canonicalString` or `hashCanonical` let the machine decide the digest bytes: the ids `Accuracy, brevity, Clarity` order as `Accuracy,brevity,Clarity` under an en-US collation and as `Accuracy,Clarity,brevity` by code unit, and the two produce different digests for the same data. `compareCodeUnits` in `src/ledger-core/canonical.ts` is now the one comparator for an ordering whose result is hashed.
+  - Three of the ten carried a docstring asserting an invariant the code did not hold: `hashScenarios` ("independent of insertion order" — it was not independent of collation), `Dataset.toJsonl` ("deterministic byte-for-byte"), and `serializeFeedbackTrajectoriesJsonl` ("two exports of equal stores are byte-equal"). `testSuiteDigest`'s "two suites with the same digest are the same suite" was in the same position.
+  - Digest and serialization sites: `src/dataset.ts` (`hashScenarios`, `toJsonl`), `src/feedback-trajectory.ts` (`serializeFeedbackTrajectoriesJsonl`), `src/trace-repair/test-oracle.ts` (`testSuiteDigest`), `src/campaign/provenance.ts` (`costReceiptsDigest`, `campaignMeasurementDigest` cells), `src/analyst/benchmark-summary.ts` (finding signature), `src/analyst/benchmark-verification-artifacts.ts` (artifact order, which reaches a verification span id), `src/rl/verified-findings-dataset.ts` (dataset rows), `src/campaign/run-campaign.ts` (the campaign's retained cell order).
+  - Ordering-only sites fixed for the same reason, since each decides which records a caller sees: `src/campaign/labeled-store/fs-adapter.ts` (which records a `slice(0, count)` returns) and `src/analyst/benchmark-public-data.ts` (which rows a seeded public-benchmark sample selects).
+  - No retention window is added, and that is a per-site finding rather than an assumption: nothing in this package stores one of these values and later recomputes it from source data to compare. `verifyLoopProvenanceRecord` re-hashes the record's stored fields, and `assertCampaignSplitIdentity` recomputes a split digest whose builder never sorted. The values move once, like `rubricVersion` in 0.167.0, rather than needing the dual-verify `surfaceHash` required.
+  - A comparator for a report a human reads is left alone; `renderSurfaceDiff` and the Markdown renderers keep `localeCompare`.
+
+---
+
+## [0.168.1] — 2026-08-21
+
+### Fixed
+
+- `scripts/check-canonical-json.mjs` no longer names a function after the function it is passed to. An arrow in argument position sits behind the text `helper(`, and the name fallback read that as its name; the fabricated name then entered the module's sorter set, so every caller of the REAL function of that name read as sorting. A gate that reports a file and line whose function contains no sort teaches the next reader that it lies, which is how a useful check gets switched off.
+- Names now come from a binding only — a declaration id, a `const`/`let`/`var` binding, or an object-property key — and a function with no binding is reported as `(anonymous)` and located by its line. Only a bound function can be called by name, so only a bound one is registered as a sorting helper.
+
+---
+
+## [0.168.0] — 2026-08-21
+
+### Fixed
+
+- A component surface's stored identity no longer depends on the host's collation. `componentSurfaceIdentityMaterial` ordered component names with `localeCompare`, which reads the runtime's default collation rather than the value, and that material feeds `surfaceContentHash` and `surfaceHash` — identities that are **written down** and later recomputed and compared. Three sites do exactly that (`src/campaign/provenance.ts:351`, `src/campaign/presets/run-optimization.ts:658` and `:693`), each of them a fail-closed refusal, so under a different ICU build or locale a legitimate resume or parent selection could be rejected as a surface that does not match its own identity. The material now comes from `canonicalString`, which orders keys by UTF-16 code unit (RFC 8785) — a property of the value alone.
+- `surfaceHashMatches(surface, storedHash)` is the verify path for the retention window. A stored loop key is 16 hex characters with no room for a scheme tag, so unlike an `agent-profile-cell` id it cannot name the scheme that minted it; the matcher tries the current material and then the retired one, which gives the same property — a key minted by an earlier release still matches its own surface, and an edited surface matches neither. The retired builder is private and reachable only from that matcher; nothing mints from it. The three comparison sites now use the matcher instead of `!==`.
+- Every stored component-surface identity moves, not only one whose names sort differently under a collation: RFC 8785 also orders the two top-level keys, so `components` now precedes `schema`. Prompt and code surfaces are unaffected — neither builds material from an ordered key list.
+
+---
+
+## [0.167.1] — 2026-08-21
+
+### Changed
+
+- `waitForActiveHandlers` and `sendJsonIfOpen` had three byte-identical private copies each, one per local HTTP server (`src/analyst/trace-tool-callback.ts`, `src/campaign/external-optimizer-callback.ts`, `src/campaign/external-optimizer-model-proxy.ts`). Both now live in `src/campaign/external-optimizer-http.ts`, the module all three already imported `closeServer`, `listenLocal`, and `sendJson` from. The drain loop re-reads the handler set on every pass because a running handler can register another; a copy that awaited one snapshot would let the caller close the server with work outstanding. No behavior change and no export change: the helpers are internal to that module's consumers.
+
+---
+
+## [0.167.0] — 2026-08-21
+
+### Changed
+
+- `rubricVersion` is now `<name>@sha256-rfc8785:<hex>` and comes from `hashCanonical`, this package's only canonical-JSON encoder. It was a 32-bit djb2 hash over a private `stableStringify` — the twelfth canonical-JSON encoder in the tree, and the only one whose key order came from `localeCompare`. `localeCompare` orders by the runtime's collation rather than by the value, so a rubric whose dimension ids differ only in case (`Accuracy`, `brevity`) could serialize in a different order under a different collation and produce a different tag for the same rubric. RFC 8785 orders by UTF-16 code unit, which depends on the value alone.
+  - The scheme is named inside the value. A consumer holding a tag from an earlier release reads a different scheme and can tell "this package changed how it hashes" from "the rubric changed"; with a bare hex string the two are indistinguishable. Tags minted before this release (`anti-slop@a4f2b8c1`) are not comparable with these, and nothing in this package verifies a stored tag — `rubricVersion` is compared for equality, never recomputed against a record — so no legacy encoder is retained.
+  - `WIRE_VERSION` is `1.1.0`. The request and response shapes are unchanged, so the major stays `1` and every client that checks the major (`clients/python/src/agent_eval_rpc/client.py:139`) keeps working; the minor moves because a response value changed meaning.
+  - The Python client carries `rubricVersion` as an opaque `str` and never computes or parses it, so it needs no change beyond the version lockstep.
+- `RUBRIC_VERSION_SCHEME` is exported from `/wire` for a caller that wants to compare a tag's scheme without parsing the string.
+
+---
+
+## [0.166.1] — 2026-08-21
+
+### Changed
+
+- The seven FNV-1a loops in this package each say what they hash and why they are frozen. They look interchangeable and are not: one hashes IEEE-754 bytes rather than a string (`src/statistics/internal.ts`), one masks each code unit to a byte and the rest do not (`src/partition-held-out.ts`), one is deliberately left signed so subtracting two results is a valid comparator (`src/analyst/benchmark.ts`), and one runs two accumulators with different offsets to make a 64-bit-wide id (`src/eval-campaign.ts`). Unifying them would move held-out splits, cell keys, replay seeds, and published bootstrap intervals that were already decided under the current values, so each now carries the one line that stops the next reader from "fixing" it. No behavior change.
+
+---
+
+## [0.165.0] — 2026-08-21
+
+### Added
+
+- `@tangle-network/agent-eval/adapters/http` is published. `httpDispatch` (coordinator side) and `runDispatchServer` (worker side) have existed in `src/adapters/http.ts` with a test, a two-process runnable example under `examples/distributed-driver/`, and a design document since 0.130.x, but no `exports` entry — so every `import` line in `docs/distributed-driver.md` threw `ERR_PACKAGE_PATH_NOT_EXPORTED` against an installed copy, and the example could only be run from a checkout. The document's status note and the three "not currently published" fence comments are removed because they are no longer true.
+
+---
+
+## [0.164.2] — 2026-08-21
+
+### Changed
+
+- Three vocabularies that were declared twice now derive from one array each. No member changes, no reordering, and no public export changes; the schemas that validate them are generated from the same declaration they validate against, so the two halves cannot drift apart.
+  - `AnalystComparisonMetric` was a hand-written 18-member union, `METRICS` repeated the same 18 members as an array, `LOWER_IS_BETTER` repeated 8 of them as a set, and `src/analyst/benchmark-command-validation.ts` repeated all 18 again as a `z.enum` over the persisted artifact. A metric added to the union but missed in that enum would have been rejected at artifact validation with no compile error. One `ANALYST_COMPARISON_METRIC_DIRECTION` table now carries every metric and its direction; the type, the reporting order, the artifact schema, and `analystComparisonMetricDirection` all derive from it.
+  - `FailureClass` was a 35-member union followed by `FAILURE_CLASSES`, a `readonly FailureClass[]` repeating the same 35 members. The array could silently omit a member the type declared. `FAILURE_CLASSES` is now the `as const` owner and the type derives from it.
+  - `AnalystSeverity` was a union in `src/analyst/types.ts` and `ANALYST_SEVERITIES` was a private copy in `src/analyst/finding-signature.ts` feeding the finding schema's `z.enum`. `ANALYST_SEVERITIES` now lives beside the type it defines.
+
+---
+
+## [0.164.1] — 2026-08-21
+
+### Changed
+
+- The analyst-benchmark pin is authored by the tool that checks it. `pnpm analyst:pin` (`--write`) rewrites `ANALYST_BENCHMARK_IMPLEMENTATION_FILES` from the import graph and both live digests from the sources; it refuses a `--source-root` and never writes `ANALYST_BENCHMARK_EVIDENCE_IMPLEMENTATION_SHA256` or `ANALYST_BENCHMARK_EVIDENCE_DEPENDENCY_LOCK_SHA256`, which state facts about already-published evidence. Every check the gate made still runs unchanged in every other mode.
+- `src/analyst/benchmark-implementation.test.ts` no longer keeps a second hand-copied copy of the 108-entry source manifest. `assertCompleteSourceManifest` in the checker already proves the manifest equals the import graph on every `pnpm build` and `pnpm verify:package`; the test's `EXPECTED_FILES` restated the constant it imported, so adding one source file meant editing the same list in two places. The two tests that prove the gate actually fails — a mutated bound source, and a transitive source missing from the manifest — are unchanged and now read the constant.
+
+---
+
+## [0.164.0] — 2026-08-21
+
+### Removed
+
+- `createVerifierAdapter`, `createRunCriticAdapter`, and `createJudgeAdapter` from `/analyst`, with their `VerifierAdapterOpts`, `RunCriticAdapterOpts`, and `JudgeAdapterOpts`. Every channel was silent: no import or mention across the 31 repositories the census sweeps on their default branches, no hit in a GitHub code search across the organisation outside this repository's own source and changelog, nothing in the published `dist/` of `@tangle-network/agent-runtime@0.153.1`, `@tangle-network/agent-knowledge@10.6.0`, or `@tangle-network/braid@0.2.0`, and no test, example, doc, or in-repository caller. `createSemanticConceptJudgeAdapter` is the remaining adapter and is unchanged.
+
+### Added
+
+- `docs/code-agent-intake.md`. The per-harness intake functions — `fromCodexSession`, `fromClaudeCodeSession`, `fromOpenCodeSession`, `fromKimiCodeSession`, `fromPiSession` — plus `parseCodeAgentJsonl`, `parseCodeAgentJsonlFile`, `streamCodeAgentJsonlFile`, `observeCodeAgentSession`, `parseAgentTrace`, and `partitionRunsByAuthoringModel` had no Markdown front door, which is the only reason the census read them as unused. The document states the three steps, names the fields on `CodeAgentSessionDiagnostic` and `CodeAgentSessionMetrics` that a caller must read before aggregating, and says which path to use above V8's string ceiling. Linked from the README documentation index.
+
+### Fixed
+
+- `pnpm api:census` counted `scripts/` and `benchmarks/` as no evidence at all. Neither directory was walked, so a symbol whose only caller is a maintenance script read as a deletion candidate — including `renderEvidenceIndex`, which `pnpm evidence:check` calls inside `pnpm verify:package`. Acting on that row would have failed the release gate. Both directories are now walked and count as in-package production callers, and `SOURCE_FILE` accepts `.mjs`/`.cjs`/`.js` so a `.mjs` script is read at all. Eleven symbols moved from `none` to `production` on this pass.
+- `docs/public-api.md` now records the four rules that decided the `none` review, so the next reader inherits the judgment rather than repeating the sweep. Totals moved from 903/211/238 (production/planned/none) to 926/205/220.
+
+---
+
 ## [0.163.2] — 2026-08-21
 
 ### Fixed

package/README.md

@@ -153,6 +153,7 @@ and [DSPy](./docs/campaign-proposers.md#use-official-dspy-optimizers).
 | `@tangle-network/agent-eval/benchmarks` | Benchmark adapters and retrieval metrics. |
 | `@tangle-network/agent-eval/rl` | Export rewards, preferences, and training rows. |
 | `@tangle-network/agent-eval/wire` | HTTP and RPC schemas for other languages. |
+| `@tangle-network/agent-eval/adapters/http` | Run campaign cells on remote workers over HTTP. |
 
 Use the root import for common primitives.
 Use a subpath when you want an explicit capability boundary.
@@ -169,6 +170,7 @@ Use a subpath when you want an explicit capability boundary.
 | How do I register an experiment as a sealed object? | [`docs/experiment.md`](./docs/experiment.md) |
 | How is something certified without an answer key? | [`docs/verification-strategies.md`](./docs/verification-strategies.md) |
 | Where does every verifier land its result? | [`docs/verdicts.md`](./docs/verdicts.md) |
+| How do I turn a coding-agent session log into runs? | [`docs/code-agent-intake.md`](./docs/code-agent-intake.md) |
 | How do I score a string from another language? | [`docs/wire-protocol.md`](./docs/wire-protocol.md) |
 
 The [example index](./examples/README.md) lists every runnable example.

package/dist/adapters/http.d.ts

@@ -0,0 +1,108 @@
+import { R as Scenario, d as DispatchContext, f as DispatchFn } from "../types-JHMOqZI4.js";
+import "../index-fNXZMCzX.js";
+//#region src/adapters/http.d.ts
+interface HttpDispatchOptions<TScenario extends Scenario, _TArtifact> {
+  /** Static endpoint URL. Mutually exclusive with `resolveUrl`. */
+  url?: string;
+  /**
+   * Dynamic per-cell URL resolver. Receives the scenario + the substrate
+   * placement key (from `RunCampaignOptions.cellPlacement`) and returns the
+   * worker URL to invoke. Mutually exclusive with `url`.
+   */
+  resolveUrl?: (input: {
+    scenario: TScenario;
+    placement?: string;
+    cellId: string;
+  }) => string;
+  /** Bearer token or static auth string set as `Authorization`. */
+  auth?: string | (() => string | Promise<string>);
+  /** Extra headers merged into every request. */
+  headers?: Record<string, string>;
+  /** Per-call timeout in ms. Default 5 minutes. */
+  timeoutMs?: number;
+  /** How many idempotent retries on 5xx / network errors. Default 2. */
+  retries?: number;
+  /** Optional fetch override (auth wrappers, custom agent, mocks). */
+  fetchImpl?: typeof fetch;
+}
+interface HttpDispatchRequestBody<TScenario extends Scenario> {
+  scenario: TScenario;
+  cellId: string;
+  runAttemptId: string;
+  rep: number;
+  generation?: number;
+  seed: number;
+  placement?: string;
+  cycleId?: string;
+}
+interface HttpDispatchResponseBody<TArtifact> {
+  artifact: TArtifact;
+}
+/**
+ * Wrap a remote HTTP endpoint as a `Dispatch`. The remote side should run
+ * `runDispatchServer` (or any service that speaks the same wire shape).
+ *
+ * Cancellation: the substrate's per-cell `AbortSignal` is forwarded; the
+ * server's `runDispatchServer` translates the resulting `AbortError` into
+ * a 499 (client-closed) so the client doesn't retry.
+ */
+declare function httpDispatch<TScenario extends Scenario, TArtifact>(opts: HttpDispatchOptions<TScenario, TArtifact>): DispatchFn<TScenario, TArtifact>;
+interface RunDispatchServerOptions<TScenario extends Scenario, TArtifact> {
+  /** The Dispatch this server exposes — what runs when a request lands. */
+  dispatch: DispatchFn<TScenario, TArtifact>;
+  /** TCP port to bind. */
+  port: number;
+  /** Optional bind host; defaults to 0.0.0.0. */
+  host?: string;
+  /** Required for any non-test deployment: the bearer token clients must
+   *  send. The substrate refuses to start without auth unless `auth: false`
+   *  is set explicitly (intended ONLY for closed-network/internal testing). */
+  auth: string | false;
+  /** Path the server listens on. Default `/dispatch`. */
+  path?: string;
+  /**
+   * Per-request handler that wraps `dispatch` with whatever context the
+   * worker side needs to construct a `DispatchContext` — typically the
+   * trace writer, artifact writer, and cost meter. The substrate provides
+   * synthetic-but-typed defaults if not supplied; production deployments
+   * should wire real ones (e.g. ship traces to your OTel collector).
+   */
+  contextFactory?: (req: HttpDispatchRequestBody<TScenario>, signal: AbortSignal) => Promise<DispatchContext>;
+  /** Optional max payload size for the request body (bytes). Default 10 MB. */
+  maxBodyBytes?: number;
+  /** Hook for observability — called on every successful or failed turn. */
+  onRequest?: (event: {
+    cellId: string;
+    durationMs: number;
+    success: boolean;
+    error?: unknown;
+  }) => void;
+}
+interface DispatchServerHandle {
+  /** The actual bound port (useful when `port: 0` requests an ephemeral port). */
+  port: number;
+  /** Stop accepting new connections and drain existing ones. */
+  close: () => Promise<void>;
+}
+/**
+ * Start an HTTP server exposing a local `Dispatch` over the wire. Pair with
+ * `httpDispatch` on the driver side.
+ *
+ * Wire shape:
+ *
+ *   POST /dispatch
+ *   Authorization: Bearer <token>
+ *   Body: HttpDispatchRequestBody
+ *   200 OK: HttpDispatchResponseBody
+ *   401: missing/invalid auth
+ *   408: per-request timeout exceeded
+ *   499: client aborted before completion
+ *   500: dispatch threw
+ *
+ * The server is `node:http`-based to keep the runtime dependency surface
+ * minimal — works in plain Node, sandbox, or any container.
+ */
+declare function runDispatchServer<TScenario extends Scenario, TArtifact>(opts: RunDispatchServerOptions<TScenario, TArtifact>): Promise<DispatchServerHandle>;
+//#endregion
+export { DispatchServerHandle, HttpDispatchOptions, HttpDispatchRequestBody, HttpDispatchResponseBody, RunDispatchServerOptions, httpDispatch, runDispatchServer };
+//# sourceMappingURL=http.d.ts.map

package/dist/adapters/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","names":[],"sources":["../../src/adapters/http.ts"],"mappings":";;;UA0CiB,oBAAoB,kBAAkB,UAAU;;EAE/D;;;;;;EAMA,cAAc;IAAS,UAAU;IAAW;IAAoB;;;EAEhE,gCAAgC;;EAEhC,UAAU;;EAEV;;EAEA;;EAEA,mBAAmB;;UAGJ,wBAAwB,kBAAkB;EACzD,UAAU;EACV;EACA;EACA;EACA;EACA;EACA;EACA;;UAGe,yBAAyB;EACxC,UAAU;;;;;;;;;;iBAiBI,aAAa,kBAAkB,UAAU,WACvD,MAAM,oBAAoB,WAAW,aACpC,WAAS,WAAW;UAqFN,yBAAyB,kBAAkB,UAAU;;EAEpE,UAAU,WAAS,WAAW;;EAE9B;;EAEA;;;;EAIA;;EAEA;;;;;;;;EAQA,kBACE,KAAK,wBAAwB,YAC7B,QAAQ,gBACL,QAAQ;;EAEb;;EAEA,aAAa;IACX;IACA;IACA;IACA;;;UAIa;;EAEf;;EAEA,aAAa;;;;;;;;;;;;;;;;;;;;iBAqBO,kBAAkB,kBAAkB,UAAU,WAClE,MAAM,yBAAyB,WAAW,aACzC,QAAQ"}

package/dist/adapters/http.js

@@ -0,0 +1,208 @@
+//#region src/adapters/http.ts
+function resolveAuth(auth) {
+	if (!auth) return Promise.resolve(null);
+	if (typeof auth === "string") return Promise.resolve(auth);
+	return Promise.resolve(auth());
+}
+/**
+* Wrap a remote HTTP endpoint as a `Dispatch`. The remote side should run
+* `runDispatchServer` (or any service that speaks the same wire shape).
+*
+* Cancellation: the substrate's per-cell `AbortSignal` is forwarded; the
+* server's `runDispatchServer` translates the resulting `AbortError` into
+* a 499 (client-closed) so the client doesn't retry.
+*/
+function httpDispatch(opts) {
+	if (!opts.url && !opts.resolveUrl) throw new Error("httpDispatch: pass exactly one of `url` or `resolveUrl`.");
+	if (opts.url && opts.resolveUrl) throw new Error("httpDispatch: pass exactly one of `url` or `resolveUrl`, not both.");
+	const timeoutMs = opts.timeoutMs ?? 300 * 1e3;
+	const maxRetries = opts.retries ?? 2;
+	const f = opts.fetchImpl ?? ((...args) => fetch(...args));
+	return async (scenario, ctx) => {
+		const url = opts.url ?? opts.resolveUrl({
+			scenario,
+			placement: ctx.placement,
+			cellId: ctx.cellId
+		});
+		const authValue = await resolveAuth(opts.auth);
+		const body = {
+			scenario,
+			cellId: ctx.cellId,
+			runAttemptId: ctx.runAttemptId,
+			rep: ctx.rep,
+			generation: ctx.generation,
+			seed: ctx.seed,
+			placement: ctx.placement,
+			cycleId: ctx.cycleId
+		};
+		let lastError;
+		for (let attempt = 0; attempt <= maxRetries; attempt++) {
+			const ourTimeout = AbortSignal.timeout(timeoutMs);
+			const combinedSignal = AbortSignal.any([ctx.signal, ourTimeout]);
+			try {
+				const res = await f(url, {
+					method: "POST",
+					headers: {
+						"Content-Type": "application/json",
+						...authValue ? { Authorization: authValue.startsWith("Bearer ") ? authValue : `Bearer ${authValue}` } : {},
+						...opts.headers
+					},
+					body: JSON.stringify(body),
+					signal: combinedSignal
+				});
+				if (!res.ok) {
+					if (!(res.status >= 500 || res.status === 408 || res.status === 429) || attempt === maxRetries) {
+						const text = await res.text().catch(() => "");
+						throw new Error(`httpDispatch ${url} failed (${res.status}): ${text.slice(0, 500)}`);
+					}
+					await sleep(2 ** attempt * 200 + Math.random() * 200);
+					continue;
+				}
+				return (await res.json()).artifact;
+			} catch (err) {
+				if (ctx.signal.aborted) throw err;
+				lastError = err;
+				if (attempt === maxRetries) throw err;
+				await sleep(2 ** attempt * 200 + Math.random() * 200);
+			}
+		}
+		throw lastError ?? /* @__PURE__ */ new Error("httpDispatch exhausted retries");
+	};
+}
+function sleep(ms) {
+	return new Promise((resolve) => {
+		const t = setTimeout(resolve, ms);
+		if (typeof t.unref === "function") t.unref();
+	});
+}
+/**
+* Start an HTTP server exposing a local `Dispatch` over the wire. Pair with
+* `httpDispatch` on the driver side.
+*
+* Wire shape:
+*
+*   POST /dispatch
+*   Authorization: Bearer <token>
+*   Body: HttpDispatchRequestBody
+*   200 OK: HttpDispatchResponseBody
+*   401: missing/invalid auth
+*   408: per-request timeout exceeded
+*   499: client aborted before completion
+*   500: dispatch threw
+*
+* The server is `node:http`-based to keep the runtime dependency surface
+* minimal — works in plain Node, sandbox, or any container.
+*/
+async function runDispatchServer(opts) {
+	if (opts.auth === void 0) throw new Error("runDispatchServer: 'auth' is required (pass a bearer-token string, or `auth: false` explicitly for a closed-network test deployment).");
+	const path = opts.path ?? "/dispatch";
+	const maxBytes = opts.maxBodyBytes ?? 10 * 1024 * 1024;
+	const expectedAuth = typeof opts.auth === "string" ? `Bearer ${opts.auth.replace(/^Bearer\s+/, "")}` : null;
+	const { createServer } = await import("node:http");
+	const server = createServer(async (req, res) => {
+		const start = Date.now();
+		let cellId = "unknown";
+		let success = false;
+		let errCaught;
+		try {
+			if (req.method !== "POST" || req.url?.split("?")[0] !== path) {
+				res.statusCode = 404;
+				res.end("not found");
+				return;
+			}
+			if (expectedAuth) {
+				if (req.headers.authorization !== expectedAuth) {
+					res.statusCode = 401;
+					res.end("unauthorized");
+					return;
+				}
+			}
+			const chunks = [];
+			let totalBytes = 0;
+			const aborter = new AbortController();
+			res.on("close", () => {
+				if (!res.writableEnded) aborter.abort();
+			});
+			for await (const chunk of req) {
+				const buf = chunk;
+				totalBytes += buf.length;
+				if (totalBytes > maxBytes) {
+					res.statusCode = 413;
+					res.end("payload too large");
+					return;
+				}
+				chunks.push(buf);
+			}
+			const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+			if (typeof body.runAttemptId !== "string" || body.runAttemptId.trim().length === 0) throw new Error("runDispatchServer: request runAttemptId is required");
+			cellId = body.cellId;
+			const ctx = opts.contextFactory ? await opts.contextFactory(body, aborter.signal) : {
+				cellId: body.cellId,
+				runAttemptId: body.runAttemptId,
+				rep: body.rep,
+				generation: body.generation,
+				seed: body.seed,
+				signal: aborter.signal,
+				placement: body.placement,
+				cycleId: body.cycleId,
+				trace: NOOP_TRACE,
+				artifacts: NOOP_ARTIFACTS,
+				cost: NOOP_COST
+			};
+			if (ctx.runAttemptId !== body.runAttemptId) throw new Error("runDispatchServer: contextFactory must preserve request runAttemptId");
+			const responseBody = { artifact: await opts.dispatch(body.scenario, ctx) };
+			res.statusCode = 200;
+			res.setHeader("content-type", "application/json");
+			res.end(JSON.stringify(responseBody));
+			success = true;
+		} catch (err) {
+			errCaught = err;
+			if (err?.name === "AbortError") {
+				res.statusCode = 499;
+				res.end("client aborted");
+				return;
+			}
+			res.statusCode = 500;
+			res.setHeader("content-type", "application/json");
+			res.end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }));
+		} finally {
+			opts.onRequest?.({
+				cellId,
+				durationMs: Date.now() - start,
+				success,
+				error: errCaught
+			});
+		}
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(opts.port, opts.host ?? "0.0.0.0", () => resolve());
+	});
+	const addr = server.address();
+	return {
+		port: typeof addr === "object" && addr ? addr.port : opts.port,
+		close: () => new Promise((resolve, reject) => {
+			server.close((err) => err ? reject(err) : resolve());
+		})
+	};
+}
+const NOOP_TRACE = { span: () => ({
+	end: () => {},
+	setAttribute: () => {},
+	setStatus: () => {},
+	recordException: () => {},
+	addEvent: () => {}
+}) };
+const NOOP_ARTIFACTS = {
+	write: async () => void 0,
+	read: async () => void 0,
+	list: async () => []
+};
+const NOOP_COST = {
+	record: () => {},
+	total: () => 0
+};
+//#endregion
+export { httpDispatch, runDispatchServer };
+
+//# sourceMappingURL=http.js.map

package/dist/adapters/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","names":[],"sources":["../../src/adapters/http.ts"],"sourcesContent":["/**\n * # `@tangle-network/agent-eval/adapters/http` — distributed Dispatch over HTTP.\n *\n * Decouples coordinator and worker. The coordinator (running\n * `runImprovementLoop` or `runCampaign`) can live anywhere — your VPC, a dev\n * laptop, a cron VM. The workers (running the actual agent) can live anywhere else — different\n * regions, different clouds, different boxes — as long as they speak HTTP.\n *\n * Both sides:\n *\n *   - **`httpDispatch({ url | resolveUrl, ... })`** — client. Returns a\n *     `Dispatch` that POSTs `{ scenario, ctx }` to a worker URL and parses\n *     the artifact back. AbortSignal-aware, retries on idempotent errors,\n *     bounded timeout per call.\n *   - **`runDispatchServer({ dispatch, port, ... })`** — server. Wraps your\n *     local `Dispatch` as an HTTP endpoint. Handles auth, JSON parsing,\n *     error mapping, and cancellation when the client aborts.\n *\n * # Topology examples\n *\n * **Single-worker:** coordinator on box A, worker on box B. Set\n * `httpDispatch({ url: 'https://box-b/dispatch' })`.\n *\n * **Multi-region:** N workers across regions. Use `httpDispatch({ resolveUrl })`\n * with a function that picks the URL per cell from `ctx.placement`. Combined\n * with `cellPlacement` on `RunCampaignOptions`, the substrate fans cells\n * across geographies in parallel.\n *\n * **Coordinator-as-a-service:** coordinator runs as a long-lived process or service\n * (holds optimization state across generations); workers are stateless\n * HTTP services that can scale horizontally per cell.\n */\n\nimport type { Dispatch, DispatchContext, Scenario } from '../contract'\n\n// ── Client ───────────────────────────────────────────────────────────\n\n// eslint-disable-next-line @typescript-eslint/no-unused-vars -- TArtifact is unused\n//  in this options interface but kept as a parameter so callers can write\n//  `HttpDispatchOptions<MyScenario, MyArtifact>` symmetrically with\n//  `Dispatch<MyScenario, MyArtifact>`. Marking it unused at the position\n//  where it bites.\nexport interface HttpDispatchOptions<TScenario extends Scenario, _TArtifact> {\n  /** Static endpoint URL. Mutually exclusive with `resolveUrl`. */\n  url?: string\n  /**\n   * Dynamic per-cell URL resolver. Receives the scenario + the substrate\n   * placement key (from `RunCampaignOptions.cellPlacement`) and returns the\n   * worker URL to invoke. Mutually exclusive with `url`.\n   */\n  resolveUrl?: (input: { scenario: TScenario; placement?: string; cellId: string }) => string\n  /** Bearer token or static auth string set as `Authorization`. */\n  auth?: string | (() => string | Promise<string>)\n  /** Extra headers merged into every request. */\n  headers?: Record<string, string>\n  /** Per-call timeout in ms. Default 5 minutes. */\n  timeoutMs?: number\n  /** How many idempotent retries on 5xx / network errors. Default 2. */\n  retries?: number\n  /** Optional fetch override (auth wrappers, custom agent, mocks). */\n  fetchImpl?: typeof fetch\n}\n\nexport interface HttpDispatchRequestBody<TScenario extends Scenario> {\n  scenario: TScenario\n  cellId: string\n  runAttemptId: string\n  rep: number\n  generation?: number\n  seed: number\n  placement?: string\n  cycleId?: string\n}\n\nexport interface HttpDispatchResponseBody<TArtifact> {\n  artifact: TArtifact\n}\n\nfunction resolveAuth(auth: HttpDispatchOptions<Scenario, unknown>['auth']): Promise<string | null> {\n  if (!auth) return Promise.resolve(null)\n  if (typeof auth === 'string') return Promise.resolve(auth)\n  return Promise.resolve(auth())\n}\n\n/**\n * Wrap a remote HTTP endpoint as a `Dispatch`. The remote side should run\n * `runDispatchServer` (or any service that speaks the same wire shape).\n *\n * Cancellation: the substrate's per-cell `AbortSignal` is forwarded; the\n * server's `runDispatchServer` translates the resulting `AbortError` into\n * a 499 (client-closed) so the client doesn't retry.\n */\nexport function httpDispatch<TScenario extends Scenario, TArtifact>(\n  opts: HttpDispatchOptions<TScenario, TArtifact>,\n): Dispatch<TScenario, TArtifact> {\n  if (!opts.url && !opts.resolveUrl) {\n    throw new Error('httpDispatch: pass exactly one of `url` or `resolveUrl`.')\n  }\n  if (opts.url && opts.resolveUrl) {\n    throw new Error('httpDispatch: pass exactly one of `url` or `resolveUrl`, not both.')\n  }\n  const timeoutMs = opts.timeoutMs ?? 5 * 60 * 1000\n  const maxRetries = opts.retries ?? 2\n  const f: typeof fetch = opts.fetchImpl ?? ((...args) => fetch(...args))\n\n  return async (scenario, ctx) => {\n    const url =\n      opts.url ?? opts.resolveUrl!({ scenario, placement: ctx.placement, cellId: ctx.cellId })\n    const authValue = await resolveAuth(opts.auth)\n    const body: HttpDispatchRequestBody<TScenario> = {\n      scenario,\n      cellId: ctx.cellId,\n      runAttemptId: ctx.runAttemptId,\n      rep: ctx.rep,\n      generation: ctx.generation,\n      seed: ctx.seed,\n      placement: ctx.placement,\n      cycleId: ctx.cycleId,\n    }\n\n    let lastError: unknown\n    for (let attempt = 0; attempt <= maxRetries; attempt++) {\n      // Compose the request signal: caller's signal OR our timeout.\n      const ourTimeout = AbortSignal.timeout(timeoutMs)\n      const combinedSignal = AbortSignal.any([ctx.signal, ourTimeout])\n      try {\n        const res = await f(url, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            ...(authValue\n              ? {\n                  Authorization: authValue.startsWith('Bearer ')\n                    ? authValue\n                    : `Bearer ${authValue}`,\n                }\n              : {}),\n            ...opts.headers,\n          },\n          body: JSON.stringify(body),\n          signal: combinedSignal,\n        })\n        if (!res.ok) {\n          // 4xx is non-retryable (caller error, auth, bad scenario shape).\n          // 5xx / 408 / 429 / 502 / 503 / 504 are retryable.\n          const retryable = res.status >= 500 || res.status === 408 || res.status === 429\n          if (!retryable || attempt === maxRetries) {\n            const text = await res.text().catch(() => '')\n            throw new Error(`httpDispatch ${url} failed (${res.status}): ${text.slice(0, 500)}`)\n          }\n          // exponential backoff with jitter\n          await sleep(2 ** attempt * 200 + Math.random() * 200)\n          continue\n        }\n        const parsed = (await res.json()) as HttpDispatchResponseBody<TArtifact>\n        return parsed.artifact\n      } catch (err) {\n        // Caller-driven abort is terminal — never retry.\n        if (ctx.signal.aborted) throw err\n        lastError = err\n        if (attempt === maxRetries) throw err\n        await sleep(2 ** attempt * 200 + Math.random() * 200)\n      }\n    }\n    throw lastError ?? new Error('httpDispatch exhausted retries')\n  }\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => {\n    const t = setTimeout(resolve, ms)\n    // Don't keep node process alive purely for backoff sleeps.\n    if (typeof (t as { unref?: () => void }).unref === 'function')\n      (t as { unref: () => void }).unref()\n  })\n}\n\n// ── Server ───────────────────────────────────────────────────────────\n\nexport interface RunDispatchServerOptions<TScenario extends Scenario, TArtifact> {\n  /** The Dispatch this server exposes — what runs when a request lands. */\n  dispatch: Dispatch<TScenario, TArtifact>\n  /** TCP port to bind. */\n  port: number\n  /** Optional bind host; defaults to 0.0.0.0. */\n  host?: string\n  /** Required for any non-test deployment: the bearer token clients must\n   *  send. The substrate refuses to start without auth unless `auth: false`\n   *  is set explicitly (intended ONLY for closed-network/internal testing). */\n  auth: string | false\n  /** Path the server listens on. Default `/dispatch`. */\n  path?: string\n  /**\n   * Per-request handler that wraps `dispatch` with whatever context the\n   * worker side needs to construct a `DispatchContext` — typically the\n   * trace writer, artifact writer, and cost meter. The substrate provides\n   * synthetic-but-typed defaults if not supplied; production deployments\n   * should wire real ones (e.g. ship traces to your OTel collector).\n   */\n  contextFactory?: (\n    req: HttpDispatchRequestBody<TScenario>,\n    signal: AbortSignal,\n  ) => Promise<DispatchContext>\n  /** Optional max payload size for the request body (bytes). Default 10 MB. */\n  maxBodyBytes?: number\n  /** Hook for observability — called on every successful or failed turn. */\n  onRequest?: (event: {\n    cellId: string\n    durationMs: number\n    success: boolean\n    error?: unknown\n  }) => void\n}\n\nexport interface DispatchServerHandle {\n  /** The actual bound port (useful when `port: 0` requests an ephemeral port). */\n  port: number\n  /** Stop accepting new connections and drain existing ones. */\n  close: () => Promise<void>\n}\n\n/**\n * Start an HTTP server exposing a local `Dispatch` over the wire. Pair with\n * `httpDispatch` on the driver side.\n *\n * Wire shape:\n *\n *   POST /dispatch\n *   Authorization: Bearer <token>\n *   Body: HttpDispatchRequestBody\n *   200 OK: HttpDispatchResponseBody\n *   401: missing/invalid auth\n *   408: per-request timeout exceeded\n *   499: client aborted before completion\n *   500: dispatch threw\n *\n * The server is `node:http`-based to keep the runtime dependency surface\n * minimal — works in plain Node, sandbox, or any container.\n */\nexport async function runDispatchServer<TScenario extends Scenario, TArtifact>(\n  opts: RunDispatchServerOptions<TScenario, TArtifact>,\n): Promise<DispatchServerHandle> {\n  if (opts.auth === undefined) {\n    throw new Error(\n      \"runDispatchServer: 'auth' is required (pass a bearer-token string, or `auth: false` explicitly for a closed-network test deployment).\",\n    )\n  }\n  const path = opts.path ?? '/dispatch'\n  const maxBytes = opts.maxBodyBytes ?? 10 * 1024 * 1024\n  const expectedAuth =\n    typeof opts.auth === 'string' ? `Bearer ${opts.auth.replace(/^Bearer\\s+/, '')}` : null\n\n  // Lazy-import node:http so the file is usable from non-Node bundlers\n  // that import the client side only (e.g. an edge driver shipping\n  // httpDispatch alone). Server side is opt-in by calling this function.\n  const { createServer } = await import('node:http')\n\n  const server = createServer(async (req, res) => {\n    const start = Date.now()\n    let cellId = 'unknown'\n    let success = false\n    let errCaught: unknown\n\n    try {\n      if (req.method !== 'POST' || req.url?.split('?')[0] !== path) {\n        res.statusCode = 404\n        res.end('not found')\n        return\n      }\n      if (expectedAuth) {\n        const got = req.headers.authorization\n        if (got !== expectedAuth) {\n          res.statusCode = 401\n          res.end('unauthorized')\n          return\n        }\n      }\n\n      // Read body up to maxBytes\n      const chunks: Buffer[] = []\n      let totalBytes = 0\n      const aborter = new AbortController()\n      // The request stream's 'close' fires when the BODY completes, so it\n      // cannot signal disconnection. The response stream's 'close' fires\n      // once per exchange: with `writableEnded` still false it means the\n      // client went away before the dispatch answered.\n      res.on('close', () => {\n        if (!res.writableEnded) aborter.abort()\n      })\n\n      for await (const chunk of req) {\n        const buf = chunk as Buffer\n        totalBytes += buf.length\n        if (totalBytes > maxBytes) {\n          res.statusCode = 413\n          res.end('payload too large')\n          return\n        }\n        chunks.push(buf)\n      }\n\n      const body = JSON.parse(\n        Buffer.concat(chunks).toString('utf8'),\n      ) as HttpDispatchRequestBody<TScenario>\n      if (typeof body.runAttemptId !== 'string' || body.runAttemptId.trim().length === 0) {\n        throw new Error('runDispatchServer: request runAttemptId is required')\n      }\n      cellId = body.cellId\n\n      const ctx: DispatchContext = opts.contextFactory\n        ? await opts.contextFactory(body, aborter.signal)\n        : {\n            cellId: body.cellId,\n            runAttemptId: body.runAttemptId,\n            rep: body.rep,\n            generation: body.generation,\n            seed: body.seed,\n            signal: aborter.signal,\n            placement: body.placement,\n            cycleId: body.cycleId,\n            trace: NOOP_TRACE,\n            artifacts: NOOP_ARTIFACTS,\n            cost: NOOP_COST,\n          }\n      if (ctx.runAttemptId !== body.runAttemptId) {\n        throw new Error('runDispatchServer: contextFactory must preserve request runAttemptId')\n      }\n\n      const artifact = await opts.dispatch(body.scenario, ctx)\n      const responseBody: HttpDispatchResponseBody<TArtifact> = { artifact }\n\n      res.statusCode = 200\n      res.setHeader('content-type', 'application/json')\n      res.end(JSON.stringify(responseBody))\n      success = true\n    } catch (err) {\n      errCaught = err\n      // Client-cancelled — they don't care about the result.\n      if ((err as Error)?.name === 'AbortError') {\n        res.statusCode = 499\n        res.end('client aborted')\n        return\n      }\n      res.statusCode = 500\n      res.setHeader('content-type', 'application/json')\n      res.end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }))\n    } finally {\n      opts.onRequest?.({\n        cellId,\n        durationMs: Date.now() - start,\n        success,\n        error: errCaught,\n      })\n    }\n  })\n\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject)\n    server.listen(opts.port, opts.host ?? '0.0.0.0', () => resolve())\n  })\n\n  const addr = server.address()\n  const boundPort = typeof addr === 'object' && addr ? addr.port : opts.port\n\n  return {\n    port: boundPort,\n    close: () =>\n      new Promise<void>((resolve, reject) => {\n        server.close((err) => (err ? reject(err) : resolve()))\n      }),\n  }\n}\n\n// ── No-op default ctx machinery (worker can replace via contextFactory) ──\n\nconst NOOP_TRACE = {\n  span: () => ({\n    end: () => {},\n    setAttribute: () => {},\n    setStatus: () => {},\n    recordException: () => {},\n    addEvent: () => {},\n  }),\n} as unknown as DispatchContext['trace']\n\nconst NOOP_ARTIFACTS = {\n  write: async () => undefined,\n  read: async () => undefined,\n  list: async () => [],\n} as unknown as DispatchContext['artifacts']\n\nconst NOOP_COST = {\n  record: () => {},\n  total: () => 0,\n} as unknown as DispatchContext['cost']\n"],"mappings":";AA8EA,SAAS,YAAY,MAA8E;CACjG,IAAI,CAAC,MAAM,OAAO,QAAQ,QAAQ,IAAI;CACtC,IAAI,OAAO,SAAS,UAAU,OAAO,QAAQ,QAAQ,IAAI;CACzD,OAAO,QAAQ,QAAQ,KAAK,CAAC;AAC/B;;;;;;;;;AAUA,SAAgB,aACd,MACgC;CAChC,IAAI,CAAC,KAAK,OAAO,CAAC,KAAK,YACrB,MAAM,IAAI,MAAM,0DAA0D;CAE5E,IAAI,KAAK,OAAO,KAAK,YACnB,MAAM,IAAI,MAAM,oEAAoE;CAEtF,MAAM,YAAY,KAAK,aAAa,MAAS;CAC7C,MAAM,aAAa,KAAK,WAAW;CACnC,MAAM,IAAkB,KAAK,eAAe,GAAG,SAAS,MAAM,GAAG,IAAI;CAErE,OAAO,OAAO,UAAU,QAAQ;EAC9B,MAAM,MACJ,KAAK,OAAO,KAAK,WAAY;GAAE;GAAU,WAAW,IAAI;GAAW,QAAQ,IAAI;EAAO,CAAC;EACzF,MAAM,YAAY,MAAM,YAAY,KAAK,IAAI;EAC7C,MAAM,OAA2C;GAC/C;GACA,QAAQ,IAAI;GACZ,cAAc,IAAI;GAClB,KAAK,IAAI;GACT,YAAY,IAAI;GAChB,MAAM,IAAI;GACV,WAAW,IAAI;GACf,SAAS,IAAI;EACf;EAEA,IAAI;EACJ,KAAK,IAAI,UAAU,GAAG,WAAW,YAAY,WAAW;GAEtD,MAAM,aAAa,YAAY,QAAQ,SAAS;GAChD,MAAM,iBAAiB,YAAY,IAAI,CAAC,IAAI,QAAQ,UAAU,CAAC;GAC/D,IAAI;IACF,MAAM,MAAM,MAAM,EAAE,KAAK;KACvB,QAAQ;KACR,SAAS;MACP,gBAAgB;MAChB,GAAI,YACA,EACE,eAAe,UAAU,WAAW,SAAS,IACzC,YACA,UAAU,YAChB,IACA,CAAC;MACL,GAAG,KAAK;KACV;KACA,MAAM,KAAK,UAAU,IAAI;KACzB,QAAQ;IACV,CAAC;IACD,IAAI,CAAC,IAAI,IAAI;KAIX,IAAI,EADc,IAAI,UAAU,OAAO,IAAI,WAAW,OAAO,IAAI,WAAW,QAC1D,YAAY,YAAY;MACxC,MAAM,OAAO,MAAM,IAAI,KAAK,CAAC,CAAC,YAAY,EAAE;MAC5C,MAAM,IAAI,MAAM,gBAAgB,IAAI,WAAW,IAAI,OAAO,KAAK,KAAK,MAAM,GAAG,GAAG,GAAG;KACrF;KAEA,MAAM,MAAM,KAAK,UAAU,MAAM,KAAK,OAAO,IAAI,GAAG;KACpD;IACF;IAEA,QAAO,MADe,IAAI,KAAK,EAAA,CACjB;GAChB,SAAS,KAAK;IAEZ,IAAI,IAAI,OAAO,SAAS,MAAM;IAC9B,YAAY;IACZ,IAAI,YAAY,YAAY,MAAM;IAClC,MAAM,MAAM,KAAK,UAAU,MAAM,KAAK,OAAO,IAAI,GAAG;GACtD;EACF;EACA,MAAM,6BAAa,IAAI,MAAM,gCAAgC;CAC/D;AACF;AAEA,SAAS,MAAM,IAA2B;CACxC,OAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,IAAI,WAAW,SAAS,EAAE;EAEhC,IAAI,OAAQ,EAA6B,UAAU,YACjD,EAA6B,MAAM;CACvC,CAAC;AACH;;;;;;;;;;;;;;;;;;;AAgEA,eAAsB,kBACpB,MAC+B;CAC/B,IAAI,KAAK,SAAS,KAAA,GAChB,MAAM,IAAI,MACR,uIACF;CAEF,MAAM,OAAO,KAAK,QAAQ;CAC1B,MAAM,WAAW,KAAK,gBAAgB,KAAK,OAAO;CAClD,MAAM,eACJ,OAAO,KAAK,SAAS,WAAW,UAAU,KAAK,KAAK,QAAQ,cAAc,EAAE,MAAM;CAKpF,MAAM,EAAE,iBAAiB,MAAM,OAAO;CAEtC,MAAM,SAAS,aAAa,OAAO,KAAK,QAAQ;EAC9C,MAAM,QAAQ,KAAK,IAAI;EACvB,IAAI,SAAS;EACb,IAAI,UAAU;EACd,IAAI;EAEJ,IAAI;GACF,IAAI,IAAI,WAAW,UAAU,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC,OAAO,MAAM;IAC5D,IAAI,aAAa;IACjB,IAAI,IAAI,WAAW;IACnB;GACF;GACA,IAAI,cACU;QAAA,IAAI,QAAQ,kBACZ,cAAc;KACxB,IAAI,aAAa;KACjB,IAAI,IAAI,cAAc;KACtB;IACF;;GAIF,MAAM,SAAmB,CAAC;GAC1B,IAAI,aAAa;GACjB,MAAM,UAAU,IAAI,gBAAgB;GAKpC,IAAI,GAAG,eAAe;IACpB,IAAI,CAAC,IAAI,eAAe,QAAQ,MAAM;GACxC,CAAC;GAED,WAAW,MAAM,SAAS,KAAK;IAC7B,MAAM,MAAM;IACZ,cAAc,IAAI;IAClB,IAAI,aAAa,UAAU;KACzB,IAAI,aAAa;KACjB,IAAI,IAAI,mBAAmB;KAC3B;IACF;IACA,OAAO,KAAK,GAAG;GACjB;GAEA,MAAM,OAAO,KAAK,MAChB,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM,CACvC;GACA,IAAI,OAAO,KAAK,iBAAiB,YAAY,KAAK,aAAa,KAAK,CAAC,CAAC,WAAW,GAC/E,MAAM,IAAI,MAAM,qDAAqD;GAEvE,SAAS,KAAK;GAEd,MAAM,MAAuB,KAAK,iBAC9B,MAAM,KAAK,eAAe,MAAM,QAAQ,MAAM,IAC9C;IACE,QAAQ,KAAK;IACb,cAAc,KAAK;IACnB,KAAK,KAAK;IACV,YAAY,KAAK;IACjB,MAAM,KAAK;IACX,QAAQ,QAAQ;IAChB,WAAW,KAAK;IAChB,SAAS,KAAK;IACd,OAAO;IACP,WAAW;IACX,MAAM;GACR;GACJ,IAAI,IAAI,iBAAiB,KAAK,cAC5B,MAAM,IAAI,MAAM,sEAAsE;GAIxF,MAAM,eAAoD,EAAE,UAAA,MADrC,KAAK,SAAS,KAAK,UAAU,GAAG,EACc;GAErE,IAAI,aAAa;GACjB,IAAI,UAAU,gBAAgB,kBAAkB;GAChD,IAAI,IAAI,KAAK,UAAU,YAAY,CAAC;GACpC,UAAU;EACZ,SAAS,KAAK;GACZ,YAAY;GAEZ,IAAK,KAAe,SAAS,cAAc;IACzC,IAAI,aAAa;IACjB,IAAI,IAAI,gBAAgB;IACxB;GACF;GACA,IAAI,aAAa;GACjB,IAAI,UAAU,gBAAgB,kBAAkB;GAChD,IAAI,IAAI,KAAK,UAAU,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,CAAC,CAAC;EACrF,UAAU;GACR,KAAK,YAAY;IACf;IACA,YAAY,KAAK,IAAI,IAAI;IACzB;IACA,OAAO;GACT,CAAC;EACH;CACF,CAAC;CAED,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,OAAO,KAAK,SAAS,MAAM;EAC3B,OAAO,OAAO,KAAK,MAAM,KAAK,QAAQ,iBAAiB,QAAQ,CAAC;CAClE,CAAC;CAED,MAAM,OAAO,OAAO,QAAQ;CAG5B,OAAO;EACL,MAHgB,OAAO,SAAS,YAAY,OAAO,KAAK,OAAO,KAAK;EAIpE,aACE,IAAI,SAAe,SAAS,WAAW;GACrC,OAAO,OAAO,QAAS,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAE;EACvD,CAAC;CACL;AACF;AAIA,MAAM,aAAa,EACjB,aAAa;CACX,WAAW,CAAC;CACZ,oBAAoB,CAAC;CACrB,iBAAiB,CAAC;CAClB,uBAAuB,CAAC;CACxB,gBAAgB,CAAC;AACnB,GACF;AAEA,MAAM,iBAAiB;CACrB,OAAO,YAAY,KAAA;CACnB,MAAM,YAAY,KAAA;CAClB,MAAM,YAAY,CAAC;AACrB;AAEA,MAAM,YAAY;CAChB,cAAc,CAAC;CACf,aAAa;AACf"}