@tangle-network/agent-runtime 0.101.1 → 0.102.0

package/dist/chunk-SPCD4IQQ.js

@@ -0,0 +1,578 @@
+import {
+  CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV,
+  CANDIDATE_KNOWLEDGE_ROOT_ENV,
+  candidateKnowledgeExecutionPaths,
+  canonicalCandidateBytes,
+  canonicalCandidateDigest,
+  immutableCandidateValue,
+  sha256Bytes
+} from "./chunk-TGDHHHH4.js";
+
+// src/candidate-execution/exact-process-executor.ts
+import { posix } from "path";
+import { isDeepStrictEqual } from "util";
+var DEFAULT_PROVISION_TIMEOUT_MS = 12e4;
+var DEFAULT_RECOVERY_RETENTION_MS = 15 * 6e4;
+function exactProcessProviderAsCandidateExecutor(options) {
+  return new ExactProcessAgentCandidateExecutor(options);
+}
+var ExactProcessAgentCandidateExecutor = class {
+  constructor(options) {
+    this.options = options;
+    if (!options.provider.exactProcess) {
+      throw new Error(
+        `agent environment provider "${options.provider.name}" does not implement exact processes`
+      );
+    }
+    this.exactProcess = options.provider.exactProcess;
+    this.resources = exactResources(options.resources);
+    this.provisionTimeoutMs = positiveInteger(
+      options.provisionTimeoutMs ?? DEFAULT_PROVISION_TIMEOUT_MS,
+      "exact process provision timeout"
+    );
+    this.recoveryRetentionMs = positiveInteger(
+      options.recoveryRetentionMs ?? DEFAULT_RECOVERY_RETENTION_MS,
+      "exact process recovery retention"
+    );
+    this.providerOptions = options.providerOptions ? immutableCandidateValue(options.providerOptions) : void 0;
+  }
+  options;
+  states = /* @__PURE__ */ new Map();
+  exactProcess;
+  resources;
+  provisionTimeoutMs;
+  recoveryRetentionMs;
+  providerOptions;
+  capabilitiesPromise;
+  async execute(request, context) {
+    assertSupportedRequest(request);
+    const outcome = request.benchmark.task.outcome;
+    if (outcome.kind !== "output") throw new Error("exact process executor requires an output task");
+    const network = request.executionPlan.value.material.model.access.network;
+    const egress = network.mode === "disabled" ? { mode: "blocked" } : { mode: "strict", allowDomains: [...network.domains] };
+    await this.assertCapability(egress.mode);
+    context.signal.throwIfAborted();
+    const key = executionKey(request.executionId, request.executionPlan.value.digest);
+    if (this.states.has(key)) throw new Error("candidate execution environment is already active");
+    const image = exactImage(
+      request.executionPlan.value.material.container.image,
+      request.executionPlan.value.material.container.manifestDigest
+    );
+    const maxLifetimeMs = environmentLifetimeMs(
+      request.hardLimits.timeoutMs,
+      this.recoveryRetentionMs
+    );
+    const createMaterial = immutableCandidateValue({
+      kind: "agent-candidate-exact-process-create",
+      provider: this.options.provider.name,
+      executionId: request.executionId,
+      executionPlanDigest: request.executionPlan.value.digest,
+      image,
+      egress,
+      maxLifetimeMs,
+      provisionTimeoutMs: this.provisionTimeoutMs,
+      resources: this.resources,
+      output: { mediaType: outcome.mediaType, maxBytes: outcome.maxBytes },
+      ...this.providerOptions ? { providerOptions: this.providerOptions } : {}
+    });
+    const createInputDigest = canonicalCandidateDigest(createMaterial);
+    const metadata = immutableCandidateValue({
+      kind: "agent-candidate-execution",
+      provider: this.options.provider.name,
+      executionId: request.executionId,
+      executionPlanDigest: request.executionPlan.value.digest,
+      createInputDigest,
+      outputMediaType: outcome.mediaType,
+      outputMaxBytes: outcome.maxBytes
+    });
+    const environment = await this.exactProcess.create({
+      image,
+      egress,
+      maxLifetimeMs,
+      provisionTimeoutMs: this.provisionTimeoutMs,
+      resources: this.resources,
+      metadata,
+      idempotencyKey: executionIdempotencyKey(
+        request.executionId,
+        request.executionPlan.value.digest
+      ),
+      signal: context.signal,
+      ...this.providerOptions ? { providerOptions: this.providerOptions } : {}
+    });
+    try {
+      assertExecutionEnvironment(environment, metadata, this.options.provider.name);
+    } catch (error) {
+      try {
+        await environment.destroy();
+      } catch (cleanupError) {
+        throw new AggregateError(
+          [error, cleanupError],
+          "exact process validation and cleanup both failed"
+        );
+      }
+      throw error;
+    }
+    const state = { environment };
+    this.states.set(key, state);
+    const existing = await environment.process.list();
+    if (existing.length !== 0) {
+      throw new Error("fresh candidate environment already contains a process");
+    }
+    await materializeRequest(environment, request, context.signal);
+    const launch = exactLaunch(request);
+    const startedAt = Date.now();
+    state.trace = {
+      runId: request.trace.runId,
+      scenarioId: request.benchmark.task.scenario.id,
+      startedAt,
+      deadlineAtMs: context.deadlineAtMs,
+      timeoutMs: request.hardLimits.timeoutMs,
+      tags: {
+        ...request.trace.tags,
+        environmentId: environment.id,
+        environmentProvider: environment.provider
+      },
+      written: false
+    };
+    const process = await environment.process.spawn(launch, { signal: context.signal });
+    const outputPromise = collectOutput(process, outcome.maxBytes);
+    void outputPromise.catch(() => void 0);
+    let cancellation;
+    let processExited = false;
+    const cancel = () => {
+      if (!processExited) cancellation ??= stopProcess(process);
+    };
+    context.signal.addEventListener("abort", cancel, { once: true });
+    if (context.signal.aborted) cancel();
+    try {
+      const termination = await process.wait();
+      processExited = true;
+      context.signal.removeEventListener("abort", cancel);
+      if (cancellation) await cancellation;
+      const status = await process.status();
+      assertTerminalStatus(status, termination);
+      state.output = await awaitOutput(outputPromise, context.signal, context.deadlineAtMs);
+      state.termination = termination;
+      await appendExactProcessTrace(state, context.traceStore, status);
+      return { executionId: request.executionId, termination };
+    } finally {
+      context.signal.removeEventListener("abort", cancel);
+    }
+  }
+  async stop(request, context) {
+    await this.assertCapability();
+    context.signal.throwIfAborted();
+    const environment = await this.resolve(request, true);
+    if (!environment) return { stopped: true };
+    let statuses = await environment.process.list();
+    if (statuses.length > 1) {
+      throw new Error("candidate exact process environment contains more than one process");
+    }
+    const status = statuses[0];
+    if (status?.running) {
+      const process = await environment.process.get(status.pid);
+      if (!process) throw new Error("candidate environment lost its running process handle");
+      await stopProcess(process);
+    }
+    context.signal.throwIfAborted();
+    statuses = await environment.process.list();
+    if (statuses.some((entry) => entry.running)) {
+      throw new Error("candidate exact process termination is not proven");
+    }
+    const finalStatus = statuses[0];
+    if (finalStatus) assertTerminalStatus(finalStatus);
+    const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest));
+    if (state) {
+      state.termination = finalStatus?.termination ?? state.termination;
+      if (context.reason === "timeout" && state.trace) {
+        state.runtimeTermination = {
+          kind: "timeout",
+          timeoutMs: state.trace.timeoutMs
+        };
+      }
+      await appendExactProcessTrace(state, context.traceStore, finalStatus);
+    }
+    return { stopped: true };
+  }
+  async capture(request, context) {
+    await this.assertCapability();
+    context.signal.throwIfAborted();
+    const environment = await this.resolve(request, false);
+    const statuses = await environment.process.list();
+    const status = statuses[0];
+    if (statuses.length !== 1 || !status || status.running) {
+      throw new Error("candidate environment must contain one stopped process before capture");
+    }
+    assertTerminalStatus(status);
+    const process = await environment.process.get(status.pid);
+    if (!process) throw new Error("candidate environment lost its captured process handle");
+    const currentStatus = await process.status();
+    assertTerminalStatus(currentStatus, status.termination);
+    const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest));
+    const output = state?.output ?? await awaitOutput(
+      collectOutput(process, outputSpec(environment).maxBytes),
+      context.signal,
+      Date.now() + this.provisionTimeoutMs
+    );
+    context.signal.throwIfAborted();
+    const evidence = canonicalCandidateBytes({
+      kind: "agent-candidate-exact-process-capture",
+      provider: environment.provider,
+      environmentId: environment.id,
+      executionId: request.executionId,
+      executionPlanDigest: request.executionPlanDigest,
+      createInputDigest: environment.metadata?.createInputDigest,
+      process: {
+        pid: status.pid,
+        exitCode: status.exitCode,
+        ...status.exitSignal ? { exitSignal: status.exitSignal } : {},
+        termination: status.termination
+      },
+      ...state?.runtimeTermination ? { runtimeTermination: state.runtimeTermination } : {},
+      output: { sha256: sha256Bytes(output), byteLength: output.byteLength }
+    });
+    return {
+      taskOutcome: { kind: "output", bytes: output },
+      evidence
+    };
+  }
+  async dispose(request, context) {
+    await this.assertCapability();
+    context.signal.throwIfAborted();
+    const environment = await this.resolve(request, true);
+    if (!environment) return { disposed: true };
+    let destroyError;
+    try {
+      await environment.destroy();
+    } catch (error) {
+      destroyError = error;
+    }
+    const remaining = await this.exactProcess.get(environment.id);
+    if (remaining) {
+      throw new Error("exact process environment disposal is not proven", { cause: destroyError });
+    }
+    context.signal.throwIfAborted();
+    this.states.delete(executionKey(request.executionId, request.executionPlanDigest));
+    return { disposed: true };
+  }
+  async assertCapability(mode) {
+    const pending = this.capabilitiesPromise ?? Promise.resolve(this.options.provider.capabilities());
+    this.capabilitiesPromise = pending;
+    let capabilities;
+    try {
+      capabilities = await pending;
+    } catch (error) {
+      if (this.capabilitiesPromise === pending) this.capabilitiesPromise = void 0;
+      throw error;
+    }
+    const exact = capabilities.exactProcess;
+    if (!exact) {
+      throw new Error(
+        `agent environment provider "${this.options.provider.name}" does not declare exact process support`
+      );
+    }
+    if (mode && !exact.egress.includes(mode)) {
+      throw new Error(
+        `agent environment provider "${this.options.provider.name}" does not declare ${mode} exact egress`
+      );
+    }
+  }
+  async resolve(request, missingIsDeleted) {
+    const key = executionKey(request.executionId, request.executionPlanDigest);
+    const active = this.states.get(key)?.environment;
+    if (active) return active;
+    const metadata = {
+      kind: "agent-candidate-execution",
+      provider: this.options.provider.name,
+      executionId: request.executionId,
+      executionPlanDigest: request.executionPlanDigest
+    };
+    const listed = await this.exactProcess.list({
+      metadata,
+      ...this.providerOptions ? { providerOptions: this.providerOptions } : {}
+    });
+    const matches = listed.filter(
+      (environment2) => environment2.provider === this.options.provider.name && Object.entries(metadata).every(
+        ([name, value]) => isDeepStrictEqual(environment2.metadata?.[name], value)
+      )
+    );
+    if (matches.length > 1) {
+      throw new Error("multiple exact process environments match one candidate execution");
+    }
+    const environment = matches[0];
+    if (!environment) {
+      if (missingIsDeleted) return void 0;
+      throw new Error("candidate exact process evidence is unavailable");
+    }
+    if (!isSha256Digest(environment.metadata?.createInputDigest)) {
+      throw new Error("candidate exact process create-input digest is unavailable");
+    }
+    this.states.set(key, { environment });
+    return environment;
+  }
+};
+async function appendExactProcessTrace(state, traceStore, status) {
+  const trace = state.trace;
+  if (!trace || trace.written) return;
+  const endedAt = Math.max(trace.startedAt, Math.min(Date.now(), trace.deadlineAtMs));
+  const termination = state.runtimeTermination ?? state.termination ?? status?.termination;
+  await traceStore.appendRun({
+    runId: trace.runId,
+    scenarioId: trace.scenarioId,
+    startedAt: trace.startedAt,
+    endedAt,
+    status: termination?.kind === "exit" && termination.exitCode === 0 ? "completed" : "failed",
+    tags: trace.tags
+  });
+  trace.written = true;
+}
+function assertSupportedRequest(request) {
+  if (request.benchmark.task.outcome.kind !== "output") {
+    throw new Error(
+      "exact process candidate executor does not support workspace outcomes; use Pier"
+    );
+  }
+  if (request.executionPlan.value.material.codeKind !== "disabled" || request.inputs.candidate) {
+    throw new Error("exact process candidate executor does not support code workspaces; use Pier");
+  }
+  if (request.memory.mode !== "disabled") {
+    throw new Error("exact process candidate executor does not support isolated memory");
+  }
+  const mediaType = request.benchmark.task.outcome.mediaType.toLowerCase();
+  if (!(mediaType.startsWith("text/") || mediaType === "application/json" || mediaType.endsWith("+json"))) {
+    throw new Error("exact process candidate executor supports only UTF-8 text and JSON outputs");
+  }
+  if (!posix.isAbsolute(request.launch.executable) && !request.launch.env.PATH?.trim()) {
+    throw new Error("exact process candidate executable must be absolute or declare a signed PATH");
+  }
+}
+async function materializeRequest(environment, request, signal) {
+  const knowledgePaths = assertKnowledgeExecutionBinding(request);
+  for (const file of request.inputs.task.files) {
+    await environment.writeFile(beneath(request.roots.taskRoot, file.path), file.bytes, {
+      mode: file.mode,
+      signal
+    });
+  }
+  const profileRoot = request.executionPlan.value.material.profile.targetWorkspace === "task" ? request.roots.taskRoot : request.roots.candidateRoot;
+  if (!profileRoot) throw new Error("candidate profile targets a missing workspace");
+  for (const file of request.profileActivation.files) {
+    await environment.writeFile(
+      beneath(profileRoot, file.path),
+      Buffer.from(file.content, "utf8"),
+      { mode: file.mode, signal }
+    );
+  }
+  if (request.knowledge && knowledgePaths) {
+    for (const file of request.knowledge.files) {
+      await environment.writeFile(beneath(knowledgePaths.root, file.path), file.bytes, {
+        mode: file.mode,
+        signal
+      });
+    }
+    if (request.knowledge.retrievalConfig && knowledgePaths.retrievalConfig) {
+      await environment.writeFile(
+        knowledgePaths.retrievalConfig,
+        request.knowledge.retrievalConfig,
+        { mode: 420, signal }
+      );
+    }
+  }
+  if (request.instruction.delivery.kind === "utf8-file") {
+    await environment.writeFile(request.instruction.delivery.path, request.instruction.bytes, {
+      mode: 420,
+      signal
+    });
+  }
+}
+function assertKnowledgeExecutionBinding(request) {
+  const knowledge = request.knowledge;
+  if (!knowledge) {
+    if (request.launch.env[CANDIDATE_KNOWLEDGE_ROOT_ENV] !== void 0 || request.launch.env[CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV] !== void 0) {
+      throw new Error("candidate launch declares knowledge paths without verified knowledge");
+    }
+    return void 0;
+  }
+  const paths = candidateKnowledgeExecutionPaths(
+    request.roots.taskRoot,
+    knowledge.retrievalConfig !== void 0
+  );
+  if (request.launch.env[CANDIDATE_KNOWLEDGE_ROOT_ENV] !== paths.root || request.launch.env[CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV] !== paths.retrievalConfig) {
+    throw new Error("candidate knowledge paths do not match the signed launch environment");
+  }
+  const reserved = [paths.root, paths.retrievalConfig].filter(
+    (value) => value !== void 0
+  );
+  const profileRoot = request.executionPlan.value.material.profile.targetWorkspace === "task" ? request.roots.taskRoot : request.roots.candidateRoot;
+  const otherFiles = [
+    ...request.inputs.task.files.map((file) => beneath(request.roots.taskRoot, file.path)),
+    ...profileRoot ? request.profileActivation.files.map((file) => beneath(profileRoot, file.path)) : [],
+    ...request.instruction.delivery.kind === "utf8-file" ? [request.instruction.delivery.path] : []
+  ];
+  if (otherFiles.some(
+    (path) => reserved.some(
+      (reservedPath) => path === reservedPath || path.startsWith(`${reservedPath}/`) || reservedPath.startsWith(`${path}/`)
+    )
+  )) {
+    throw new Error("candidate knowledge paths overlap other execution inputs");
+  }
+  return paths;
+}
+function exactLaunch(request) {
+  const instruction = new TextDecoder("utf-8", { fatal: true }).decode(request.instruction.bytes);
+  const base = {
+    executable: request.launch.executable,
+    args: request.launch.args,
+    cwd: request.launch.cwd,
+    env: request.launch.env,
+    timeoutMs: 0
+  };
+  switch (request.instruction.delivery.kind) {
+    case "argv-append":
+      return { ...base, args: [...base.args, instruction] };
+    case "stdin-utf8":
+      return { ...base, stdin: instruction };
+    case "utf8-file":
+      return base;
+  }
+}
+async function collectOutput(process, maxBytes) {
+  const chunks = [];
+  let byteLength = 0;
+  for await (const chunk of process.stdout()) {
+    const bytes = Buffer.from(chunk, "utf8");
+    byteLength += bytes.byteLength;
+    if (byteLength > maxBytes) {
+      let stopError;
+      try {
+        await stopProcess(process);
+      } catch (error) {
+        stopError = error;
+      }
+      throw new Error(`candidate output exceeds its ${maxBytes}-byte maximum`, {
+        cause: stopError
+      });
+    }
+    chunks.push(bytes);
+  }
+  return Uint8Array.from(Buffer.concat(chunks, byteLength));
+}
+async function awaitOutput(output, signal, deadlineAtMs) {
+  signal.throwIfAborted();
+  const remainingMs = deadlineAtMs - Date.now();
+  if (remainingMs <= 0) throw new Error("candidate output deadline expired");
+  let timer;
+  let onAbort;
+  try {
+    return await Promise.race([
+      output,
+      new Promise((_resolve, reject) => {
+        onAbort = () => reject(signal.reason ?? new Error("candidate output cancelled"));
+        signal.addEventListener("abort", onAbort, { once: true });
+        timer = setTimeout(
+          () => reject(new Error("candidate output deadline expired")),
+          remainingMs
+        );
+      })
+    ]);
+  } finally {
+    if (onAbort) signal.removeEventListener("abort", onAbort);
+    if (timer) clearTimeout(timer);
+  }
+}
+async function stopProcess(process) {
+  const before = await process.status();
+  if (!before.running) return;
+  try {
+    await process.kill();
+  } catch (error) {
+    if ((await process.status()).running) throw error;
+  }
+  const termination = await process.wait();
+  assertTerminalStatus(await process.status(), termination);
+}
+function assertTerminalStatus(status, expected) {
+  if (status.running || !status.termination) {
+    throw new Error("exact process returned no terminal reason after exit");
+  }
+  if (expected && !isDeepStrictEqual(status.termination, expected)) {
+    throw new Error("exact process wait and status returned different terminal reasons");
+  }
+}
+function assertExecutionEnvironment(environment, metadata, providerName) {
+  if (!environment.id || environment.provider !== providerName) {
+    throw new Error("exact process provider returned the wrong environment identity");
+  }
+  if (!Object.entries(metadata).every(
+    ([name, value]) => isDeepStrictEqual(environment.metadata?.[name], value)
+  )) {
+    throw new Error("exact process provider did not persist candidate execution metadata");
+  }
+}
+function outputSpec(environment) {
+  const maxBytes = environment.metadata?.outputMaxBytes;
+  if (!Number.isSafeInteger(maxBytes) || Number(maxBytes) < 1) {
+    throw new Error("candidate exact process output bound is unavailable");
+  }
+  return { maxBytes: Number(maxBytes) };
+}
+function executionKey(executionId, executionPlanDigest) {
+  return `${executionId}\0${executionPlanDigest}`;
+}
+function executionIdempotencyKey(executionId, executionPlanDigest) {
+  return `candidate-${canonicalCandidateDigest({
+    kind: "agent-candidate-execution-identity",
+    executionId,
+    executionPlanDigest
+  }).slice("sha256:".length)}`;
+}
+function exactImage(image, manifestDigest) {
+  if (isSha256Digest(image)) {
+    if (image !== manifestDigest) {
+      throw new Error("candidate container image conflicts with its resolved manifest");
+    }
+    return image;
+  }
+  const marker = image.lastIndexOf("@");
+  if (marker < 0) return `${image}@${manifestDigest}`;
+  if (image.slice(marker + 1) !== manifestDigest) {
+    throw new Error("candidate container image conflicts with its resolved manifest");
+  }
+  return image;
+}
+function environmentLifetimeMs(timeoutMs, retentionMs) {
+  const total = positiveInteger(timeoutMs, "candidate execution timeout") + retentionMs;
+  if (!Number.isSafeInteger(total)) throw new Error("candidate environment lifetime is too large");
+  return Math.ceil(total / 1e3) * 1e3;
+}
+function exactResources(resources) {
+  if (!Number.isFinite(resources.cpu) || resources.cpu <= 0) {
+    throw new Error("exact process CPU must be positive and finite");
+  }
+  return Object.freeze({
+    cpu: resources.cpu,
+    memoryMb: positiveInteger(resources.memoryMb, "exact process memory"),
+    diskMb: positiveInteger(resources.diskMb, "exact process disk")
+  });
+}
+function positiveInteger(value, label) {
+  if (!Number.isSafeInteger(value) || value < 1)
+    throw new Error(`${label} must be a positive integer`);
+  return value;
+}
+function beneath(root, relativePath) {
+  if (posix.isAbsolute(relativePath)) throw new Error("candidate input path must be relative");
+  const path = posix.normalize(relativePath);
+  if (path === ".." || path.startsWith("../")) {
+    throw new Error("candidate input path escapes its execution root");
+  }
+  return posix.join(root, path);
+}
+function isSha256Digest(value) {
+  return typeof value === "string" && /^sha256:[a-f0-9]{64}$/.test(value);
+}
+
+export {
+  exactProcessProviderAsCandidateExecutor
+};
+//# sourceMappingURL=chunk-SPCD4IQQ.js.map

package/dist/chunk-SPCD4IQQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/candidate-execution/exact-process-executor.ts"],"sourcesContent":["import { posix } from 'node:path'\nimport { isDeepStrictEqual } from 'node:util'\n\nimport type { TraceStore } from '@tangle-network/agent-eval'\nimport type { AgentCandidateTermination, Sha256Digest } from '@tangle-network/agent-interface'\nimport type {\n  AgentEnvironmentCapabilities,\n  AgentEnvironmentProvider,\n  AgentExactProcess,\n  AgentExactProcessEnvironment,\n  AgentExactProcessLaunch,\n  AgentExactProcessResources,\n  AgentExactProcessStatus,\n} from '@tangle-network/agent-interface/environment-provider'\n\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  immutableCandidateValue,\n  sha256Bytes,\n} from './digest'\nimport {\n  CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV,\n  CANDIDATE_KNOWLEDGE_ROOT_ENV,\n  candidateKnowledgeExecutionPaths,\n} from './knowledge'\nimport type {\n  AgentCandidateExecutorPort,\n  AgentCandidateExecutorRequest,\n  AgentCandidateExecutorStopRequest,\n} from './types'\n\nconst DEFAULT_PROVISION_TIMEOUT_MS = 120_000\nconst DEFAULT_RECOVERY_RETENTION_MS = 15 * 60_000\n\ninterface ExactProcessRunState {\n  environment: AgentExactProcessEnvironment\n  output?: Uint8Array\n  termination?: AgentCandidateTermination\n  runtimeTermination?: AgentCandidateTermination\n  trace?: {\n    runId: string\n    scenarioId: string\n    startedAt: number\n    deadlineAtMs: number\n    timeoutMs: number\n    tags: Record<string, string>\n    written: boolean\n  }\n}\n\nexport interface ExactProcessCandidateExecutorOptions {\n  provider: AgentEnvironmentProvider\n  resources: AgentExactProcessResources\n  provisionTimeoutMs?: number\n  recoveryRetentionMs?: number\n  providerOptions?: Record<string, unknown>\n}\n\n/** Adapt one neutral exact-process provider to Runtime's trusted candidate boundary. */\nexport function exactProcessProviderAsCandidateExecutor(\n  options: ExactProcessCandidateExecutorOptions,\n): AgentCandidateExecutorPort {\n  return new ExactProcessAgentCandidateExecutor(options)\n}\n\nclass ExactProcessAgentCandidateExecutor implements AgentCandidateExecutorPort {\n  private readonly states = new Map<string, ExactProcessRunState>()\n  private readonly exactProcess\n  private readonly resources: AgentExactProcessResources\n  private readonly provisionTimeoutMs: number\n  private readonly recoveryRetentionMs: number\n  private readonly providerOptions?: Record<string, unknown>\n  private capabilitiesPromise?: Promise<AgentEnvironmentCapabilities>\n\n  constructor(private readonly options: ExactProcessCandidateExecutorOptions) {\n    if (!options.provider.exactProcess) {\n      throw new Error(\n        `agent environment provider \"${options.provider.name}\" does not implement exact processes`,\n      )\n    }\n    this.exactProcess = options.provider.exactProcess\n    this.resources = exactResources(options.resources)\n    this.provisionTimeoutMs = positiveInteger(\n      options.provisionTimeoutMs ?? DEFAULT_PROVISION_TIMEOUT_MS,\n      'exact process provision timeout',\n    )\n    this.recoveryRetentionMs = positiveInteger(\n      options.recoveryRetentionMs ?? DEFAULT_RECOVERY_RETENTION_MS,\n      'exact process recovery retention',\n    )\n    this.providerOptions = options.providerOptions\n      ? immutableCandidateValue(options.providerOptions)\n      : undefined\n  }\n\n  async execute(\n    request: AgentCandidateExecutorRequest,\n    context: Parameters<AgentCandidateExecutorPort['execute']>[1],\n  ) {\n    assertSupportedRequest(request)\n    const outcome = request.benchmark.task.outcome\n    if (outcome.kind !== 'output') throw new Error('exact process executor requires an output task')\n    const network = request.executionPlan.value.material.model.access.network\n    const egress =\n      network.mode === 'disabled'\n        ? ({ mode: 'blocked' } as const)\n        : ({ mode: 'strict', allowDomains: [...network.domains] } as const)\n    await this.assertCapability(egress.mode)\n    context.signal.throwIfAborted()\n\n    const key = executionKey(request.executionId, request.executionPlan.value.digest)\n    if (this.states.has(key)) throw new Error('candidate execution environment is already active')\n    const image = exactImage(\n      request.executionPlan.value.material.container.image,\n      request.executionPlan.value.material.container.manifestDigest,\n    )\n    const maxLifetimeMs = environmentLifetimeMs(\n      request.hardLimits.timeoutMs,\n      this.recoveryRetentionMs,\n    )\n    const createMaterial = immutableCandidateValue({\n      kind: 'agent-candidate-exact-process-create',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlan.value.digest,\n      image,\n      egress,\n      maxLifetimeMs,\n      provisionTimeoutMs: this.provisionTimeoutMs,\n      resources: this.resources,\n      output: { mediaType: outcome.mediaType, maxBytes: outcome.maxBytes },\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    const createInputDigest = canonicalCandidateDigest(createMaterial)\n    const metadata = immutableCandidateValue({\n      kind: 'agent-candidate-execution',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlan.value.digest,\n      createInputDigest,\n      outputMediaType: outcome.mediaType,\n      outputMaxBytes: outcome.maxBytes,\n    })\n    const environment = await this.exactProcess.create({\n      image,\n      egress,\n      maxLifetimeMs,\n      provisionTimeoutMs: this.provisionTimeoutMs,\n      resources: this.resources,\n      metadata,\n      idempotencyKey: executionIdempotencyKey(\n        request.executionId,\n        request.executionPlan.value.digest,\n      ),\n      signal: context.signal,\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    try {\n      assertExecutionEnvironment(environment, metadata, this.options.provider.name)\n    } catch (error) {\n      try {\n        await environment.destroy()\n      } catch (cleanupError) {\n        throw new AggregateError(\n          [error, cleanupError],\n          'exact process validation and cleanup both failed',\n        )\n      }\n      throw error\n    }\n    const state: ExactProcessRunState = { environment }\n    this.states.set(key, state)\n\n    const existing = await environment.process.list()\n    if (existing.length !== 0) {\n      throw new Error('fresh candidate environment already contains a process')\n    }\n    await materializeRequest(environment, request, context.signal)\n    const launch = exactLaunch(request)\n    const startedAt = Date.now()\n    state.trace = {\n      runId: request.trace.runId,\n      scenarioId: request.benchmark.task.scenario.id,\n      startedAt,\n      deadlineAtMs: context.deadlineAtMs,\n      timeoutMs: request.hardLimits.timeoutMs,\n      tags: {\n        ...request.trace.tags,\n        environmentId: environment.id,\n        environmentProvider: environment.provider,\n      },\n      written: false,\n    }\n    const process = await environment.process.spawn(launch, { signal: context.signal })\n    const outputPromise = collectOutput(process, outcome.maxBytes)\n    void outputPromise.catch(() => undefined)\n    let cancellation: Promise<void> | undefined\n    let processExited = false\n    const cancel = () => {\n      if (!processExited) cancellation ??= stopProcess(process)\n    }\n    context.signal.addEventListener('abort', cancel, { once: true })\n    if (context.signal.aborted) cancel()\n    try {\n      const termination = await process.wait()\n      processExited = true\n      context.signal.removeEventListener('abort', cancel)\n      if (cancellation) await cancellation\n      const status = await process.status()\n      assertTerminalStatus(status, termination)\n      state.output = await awaitOutput(outputPromise, context.signal, context.deadlineAtMs)\n      state.termination = termination\n      await appendExactProcessTrace(state, context.traceStore, status)\n      return { executionId: request.executionId, termination }\n    } finally {\n      context.signal.removeEventListener('abort', cancel)\n    }\n  }\n\n  async stop(\n    request: AgentCandidateExecutorStopRequest,\n    context: Parameters<AgentCandidateExecutorPort['stop']>[1],\n  ): Promise<{ readonly stopped: true }> {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, true)\n    if (!environment) return { stopped: true }\n    let statuses = await environment.process.list()\n    if (statuses.length > 1) {\n      throw new Error('candidate exact process environment contains more than one process')\n    }\n    const status = statuses[0]\n    if (status?.running) {\n      const process = await environment.process.get(status.pid)\n      if (!process) throw new Error('candidate environment lost its running process handle')\n      await stopProcess(process)\n    }\n    context.signal.throwIfAborted()\n    statuses = await environment.process.list()\n    if (statuses.some((entry) => entry.running)) {\n      throw new Error('candidate exact process termination is not proven')\n    }\n    const finalStatus = statuses[0]\n    if (finalStatus) assertTerminalStatus(finalStatus)\n    const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest))\n    if (state) {\n      state.termination = finalStatus?.termination ?? state.termination\n      if (context.reason === 'timeout' && state.trace) {\n        state.runtimeTermination = {\n          kind: 'timeout',\n          timeoutMs: state.trace.timeoutMs,\n        }\n      }\n      await appendExactProcessTrace(state, context.traceStore, finalStatus)\n    }\n    return { stopped: true }\n  }\n\n  async capture(\n    request: AgentCandidateExecutorStopRequest,\n    context: Parameters<AgentCandidateExecutorPort['capture']>[1],\n  ) {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, false)\n    const statuses = await environment.process.list()\n    const status = statuses[0]\n    if (statuses.length !== 1 || !status || status.running) {\n      throw new Error('candidate environment must contain one stopped process before capture')\n    }\n    assertTerminalStatus(status)\n    const process = await environment.process.get(status.pid)\n    if (!process) throw new Error('candidate environment lost its captured process handle')\n    const currentStatus = await process.status()\n    assertTerminalStatus(currentStatus, status.termination)\n    const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest))\n    const output =\n      state?.output ??\n      (await awaitOutput(\n        collectOutput(process, outputSpec(environment).maxBytes),\n        context.signal,\n        Date.now() + this.provisionTimeoutMs,\n      ))\n    context.signal.throwIfAborted()\n    const evidence = canonicalCandidateBytes({\n      kind: 'agent-candidate-exact-process-capture',\n      provider: environment.provider,\n      environmentId: environment.id,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlanDigest,\n      createInputDigest: environment.metadata?.createInputDigest,\n      process: {\n        pid: status.pid,\n        exitCode: status.exitCode,\n        ...(status.exitSignal ? { exitSignal: status.exitSignal } : {}),\n        termination: status.termination,\n      },\n      ...(state?.runtimeTermination ? { runtimeTermination: state.runtimeTermination } : {}),\n      output: { sha256: sha256Bytes(output), byteLength: output.byteLength },\n    })\n    return {\n      taskOutcome: { kind: 'output' as const, bytes: output },\n      evidence,\n    }\n  }\n\n  async dispose(\n    request: AgentCandidateExecutorStopRequest,\n    context: { signal: AbortSignal },\n  ): Promise<{ readonly disposed: true }> {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, true)\n    if (!environment) return { disposed: true }\n    let destroyError: unknown\n    try {\n      await environment.destroy()\n    } catch (error) {\n      destroyError = error\n    }\n    const remaining = await this.exactProcess.get(environment.id)\n    if (remaining) {\n      throw new Error('exact process environment disposal is not proven', { cause: destroyError })\n    }\n    context.signal.throwIfAborted()\n    this.states.delete(executionKey(request.executionId, request.executionPlanDigest))\n    return { disposed: true }\n  }\n\n  private async assertCapability(mode?: 'blocked' | 'strict'): Promise<void> {\n    const pending =\n      this.capabilitiesPromise ?? Promise.resolve(this.options.provider.capabilities())\n    this.capabilitiesPromise = pending\n    let capabilities: AgentEnvironmentCapabilities\n    try {\n      capabilities = await pending\n    } catch (error) {\n      if (this.capabilitiesPromise === pending) this.capabilitiesPromise = undefined\n      throw error\n    }\n    const exact = capabilities.exactProcess\n    if (!exact) {\n      throw new Error(\n        `agent environment provider \"${this.options.provider.name}\" does not declare exact process support`,\n      )\n    }\n    if (mode && !exact.egress.includes(mode)) {\n      throw new Error(\n        `agent environment provider \"${this.options.provider.name}\" does not declare ${mode} exact egress`,\n      )\n    }\n  }\n\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: false,\n  ): Promise<AgentExactProcessEnvironment>\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: true,\n  ): Promise<AgentExactProcessEnvironment | undefined>\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: boolean,\n  ): Promise<AgentExactProcessEnvironment | undefined> {\n    const key = executionKey(request.executionId, request.executionPlanDigest)\n    const active = this.states.get(key)?.environment\n    if (active) return active\n    const metadata = {\n      kind: 'agent-candidate-execution',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlanDigest,\n    }\n    const listed = await this.exactProcess.list({\n      metadata,\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    const matches = listed.filter(\n      (environment) =>\n        environment.provider === this.options.provider.name &&\n        Object.entries(metadata).every(([name, value]) =>\n          isDeepStrictEqual(environment.metadata?.[name], value),\n        ),\n    )\n    if (matches.length > 1) {\n      throw new Error('multiple exact process environments match one candidate execution')\n    }\n    const environment = matches[0]\n    if (!environment) {\n      if (missingIsDeleted) return undefined\n      throw new Error('candidate exact process evidence is unavailable')\n    }\n    if (!isSha256Digest(environment.metadata?.createInputDigest)) {\n      throw new Error('candidate exact process create-input digest is unavailable')\n    }\n    this.states.set(key, { environment })\n    return environment\n  }\n}\n\nasync function appendExactProcessTrace(\n  state: ExactProcessRunState,\n  traceStore: TraceStore,\n  status?: AgentExactProcessStatus,\n): Promise<void> {\n  const trace = state.trace\n  if (!trace || trace.written) return\n  const endedAt = Math.max(trace.startedAt, Math.min(Date.now(), trace.deadlineAtMs))\n  const termination = state.runtimeTermination ?? state.termination ?? status?.termination\n  await traceStore.appendRun({\n    runId: trace.runId,\n    scenarioId: trace.scenarioId,\n    startedAt: trace.startedAt,\n    endedAt,\n    status: termination?.kind === 'exit' && termination.exitCode === 0 ? 'completed' : 'failed',\n    tags: trace.tags,\n  })\n  trace.written = true\n}\n\nfunction assertSupportedRequest(request: AgentCandidateExecutorRequest): void {\n  if (request.benchmark.task.outcome.kind !== 'output') {\n    throw new Error(\n      'exact process candidate executor does not support workspace outcomes; use Pier',\n    )\n  }\n  if (request.executionPlan.value.material.codeKind !== 'disabled' || request.inputs.candidate) {\n    throw new Error('exact process candidate executor does not support code workspaces; use Pier')\n  }\n  if (request.memory.mode !== 'disabled') {\n    throw new Error('exact process candidate executor does not support isolated memory')\n  }\n  const mediaType = request.benchmark.task.outcome.mediaType.toLowerCase()\n  if (\n    !(\n      mediaType.startsWith('text/') ||\n      mediaType === 'application/json' ||\n      mediaType.endsWith('+json')\n    )\n  ) {\n    throw new Error('exact process candidate executor supports only UTF-8 text and JSON outputs')\n  }\n  if (!posix.isAbsolute(request.launch.executable) && !request.launch.env.PATH?.trim()) {\n    throw new Error('exact process candidate executable must be absolute or declare a signed PATH')\n  }\n}\n\nasync function materializeRequest(\n  environment: AgentExactProcessEnvironment,\n  request: AgentCandidateExecutorRequest,\n  signal: AbortSignal,\n): Promise<void> {\n  const knowledgePaths = assertKnowledgeExecutionBinding(request)\n  for (const file of request.inputs.task.files) {\n    await environment.writeFile(beneath(request.roots.taskRoot, file.path), file.bytes, {\n      mode: file.mode,\n      signal,\n    })\n  }\n  const profileRoot =\n    request.executionPlan.value.material.profile.targetWorkspace === 'task'\n      ? request.roots.taskRoot\n      : request.roots.candidateRoot\n  if (!profileRoot) throw new Error('candidate profile targets a missing workspace')\n  for (const file of request.profileActivation.files) {\n    await environment.writeFile(\n      beneath(profileRoot, file.path),\n      Buffer.from(file.content, 'utf8'),\n      { mode: file.mode, signal },\n    )\n  }\n  if (request.knowledge && knowledgePaths) {\n    for (const file of request.knowledge.files) {\n      await environment.writeFile(beneath(knowledgePaths.root, file.path), file.bytes, {\n        mode: file.mode,\n        signal,\n      })\n    }\n    if (request.knowledge.retrievalConfig && knowledgePaths.retrievalConfig) {\n      await environment.writeFile(\n        knowledgePaths.retrievalConfig,\n        request.knowledge.retrievalConfig,\n        { mode: 0o644, signal },\n      )\n    }\n  }\n  if (request.instruction.delivery.kind === 'utf8-file') {\n    await environment.writeFile(request.instruction.delivery.path, request.instruction.bytes, {\n      mode: 0o644,\n      signal,\n    })\n  }\n}\n\nfunction assertKnowledgeExecutionBinding(\n  request: AgentCandidateExecutorRequest,\n): ReturnType<typeof candidateKnowledgeExecutionPaths> | undefined {\n  const knowledge = request.knowledge\n  if (!knowledge) {\n    if (\n      request.launch.env[CANDIDATE_KNOWLEDGE_ROOT_ENV] !== undefined ||\n      request.launch.env[CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV] !== undefined\n    ) {\n      throw new Error('candidate launch declares knowledge paths without verified knowledge')\n    }\n    return undefined\n  }\n  const paths = candidateKnowledgeExecutionPaths(\n    request.roots.taskRoot,\n    knowledge.retrievalConfig !== undefined,\n  )\n  if (\n    request.launch.env[CANDIDATE_KNOWLEDGE_ROOT_ENV] !== paths.root ||\n    request.launch.env[CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV] !== paths.retrievalConfig\n  ) {\n    throw new Error('candidate knowledge paths do not match the signed launch environment')\n  }\n  const reserved = [paths.root, paths.retrievalConfig].filter(\n    (value): value is string => value !== undefined,\n  )\n  const profileRoot =\n    request.executionPlan.value.material.profile.targetWorkspace === 'task'\n      ? request.roots.taskRoot\n      : request.roots.candidateRoot\n  const otherFiles = [\n    ...request.inputs.task.files.map((file) => beneath(request.roots.taskRoot, file.path)),\n    ...(profileRoot\n      ? request.profileActivation.files.map((file) => beneath(profileRoot, file.path))\n      : []),\n    ...(request.instruction.delivery.kind === 'utf8-file'\n      ? [request.instruction.delivery.path]\n      : []),\n  ]\n  if (\n    otherFiles.some((path) =>\n      reserved.some(\n        (reservedPath) =>\n          path === reservedPath ||\n          path.startsWith(`${reservedPath}/`) ||\n          reservedPath.startsWith(`${path}/`),\n      ),\n    )\n  ) {\n    throw new Error('candidate knowledge paths overlap other execution inputs')\n  }\n  return paths\n}\n\nfunction exactLaunch(request: AgentCandidateExecutorRequest): AgentExactProcessLaunch {\n  const instruction = new TextDecoder('utf-8', { fatal: true }).decode(request.instruction.bytes)\n  const base = {\n    executable: request.launch.executable,\n    args: request.launch.args,\n    cwd: request.launch.cwd,\n    env: request.launch.env,\n    timeoutMs: 0,\n  }\n  switch (request.instruction.delivery.kind) {\n    case 'argv-append':\n      return { ...base, args: [...base.args, instruction] }\n    case 'stdin-utf8':\n      return { ...base, stdin: instruction }\n    case 'utf8-file':\n      return base\n  }\n}\n\nasync function collectOutput(process: AgentExactProcess, maxBytes: number): Promise<Uint8Array> {\n  const chunks: Buffer[] = []\n  let byteLength = 0\n  for await (const chunk of process.stdout()) {\n    const bytes = Buffer.from(chunk, 'utf8')\n    byteLength += bytes.byteLength\n    if (byteLength > maxBytes) {\n      let stopError: unknown\n      try {\n        await stopProcess(process)\n      } catch (error) {\n        stopError = error\n      }\n      throw new Error(`candidate output exceeds its ${maxBytes}-byte maximum`, {\n        cause: stopError,\n      })\n    }\n    chunks.push(bytes)\n  }\n  return Uint8Array.from(Buffer.concat(chunks, byteLength))\n}\n\nasync function awaitOutput(\n  output: Promise<Uint8Array>,\n  signal: AbortSignal,\n  deadlineAtMs: number,\n): Promise<Uint8Array> {\n  signal.throwIfAborted()\n  const remainingMs = deadlineAtMs - Date.now()\n  if (remainingMs <= 0) throw new Error('candidate output deadline expired')\n  let timer: ReturnType<typeof setTimeout> | undefined\n  let onAbort: (() => void) | undefined\n  try {\n    return await Promise.race([\n      output,\n      new Promise<never>((_resolve, reject) => {\n        onAbort = () => reject(signal.reason ?? new Error('candidate output cancelled'))\n        signal.addEventListener('abort', onAbort, { once: true })\n        timer = setTimeout(\n          () => reject(new Error('candidate output deadline expired')),\n          remainingMs,\n        )\n      }),\n    ])\n  } finally {\n    if (onAbort) signal.removeEventListener('abort', onAbort)\n    if (timer) clearTimeout(timer)\n  }\n}\n\nasync function stopProcess(process: AgentExactProcess): Promise<void> {\n  const before = await process.status()\n  if (!before.running) return\n  try {\n    await process.kill()\n  } catch (error) {\n    if ((await process.status()).running) throw error\n  }\n  const termination = await process.wait()\n  assertTerminalStatus(await process.status(), termination)\n}\n\nfunction assertTerminalStatus(\n  status: AgentExactProcessStatus,\n  expected?: AgentCandidateTermination,\n): asserts status is AgentExactProcessStatus & { termination: AgentCandidateTermination } {\n  if (status.running || !status.termination) {\n    throw new Error('exact process returned no terminal reason after exit')\n  }\n  if (expected && !isDeepStrictEqual(status.termination, expected)) {\n    throw new Error('exact process wait and status returned different terminal reasons')\n  }\n}\n\nfunction assertExecutionEnvironment(\n  environment: AgentExactProcessEnvironment,\n  metadata: Record<string, unknown>,\n  providerName: string,\n): void {\n  if (!environment.id || environment.provider !== providerName) {\n    throw new Error('exact process provider returned the wrong environment identity')\n  }\n  if (\n    !Object.entries(metadata).every(([name, value]) =>\n      isDeepStrictEqual(environment.metadata?.[name], value),\n    )\n  ) {\n    throw new Error('exact process provider did not persist candidate execution metadata')\n  }\n}\n\nfunction outputSpec(environment: AgentExactProcessEnvironment): { maxBytes: number } {\n  const maxBytes = environment.metadata?.outputMaxBytes\n  if (!Number.isSafeInteger(maxBytes) || Number(maxBytes) < 1) {\n    throw new Error('candidate exact process output bound is unavailable')\n  }\n  return { maxBytes: Number(maxBytes) }\n}\n\nfunction executionKey(executionId: string, executionPlanDigest: Sha256Digest): string {\n  return `${executionId}\\0${executionPlanDigest}`\n}\n\nfunction executionIdempotencyKey(executionId: string, executionPlanDigest: Sha256Digest): string {\n  return `candidate-${canonicalCandidateDigest({\n    kind: 'agent-candidate-execution-identity',\n    executionId,\n    executionPlanDigest,\n  }).slice('sha256:'.length)}`\n}\n\nfunction exactImage(image: string, manifestDigest: Sha256Digest): string {\n  if (isSha256Digest(image)) {\n    if (image !== manifestDigest) {\n      throw new Error('candidate container image conflicts with its resolved manifest')\n    }\n    return image\n  }\n  const marker = image.lastIndexOf('@')\n  if (marker < 0) return `${image}@${manifestDigest}`\n  if (image.slice(marker + 1) !== manifestDigest) {\n    throw new Error('candidate container image conflicts with its resolved manifest')\n  }\n  return image\n}\n\nfunction environmentLifetimeMs(timeoutMs: number, retentionMs: number): number {\n  const total = positiveInteger(timeoutMs, 'candidate execution timeout') + retentionMs\n  if (!Number.isSafeInteger(total)) throw new Error('candidate environment lifetime is too large')\n  return Math.ceil(total / 1_000) * 1_000\n}\n\nfunction exactResources(resources: AgentExactProcessResources): AgentExactProcessResources {\n  if (!Number.isFinite(resources.cpu) || resources.cpu <= 0) {\n    throw new Error('exact process CPU must be positive and finite')\n  }\n  return Object.freeze({\n    cpu: resources.cpu,\n    memoryMb: positiveInteger(resources.memoryMb, 'exact process memory'),\n    diskMb: positiveInteger(resources.diskMb, 'exact process disk'),\n  })\n}\n\nfunction positiveInteger(value: number, label: string): number {\n  if (!Number.isSafeInteger(value) || value < 1)\n    throw new Error(`${label} must be a positive integer`)\n  return value\n}\n\nfunction beneath(root: string, relativePath: string): string {\n  if (posix.isAbsolute(relativePath)) throw new Error('candidate input path must be relative')\n  const path = posix.normalize(relativePath)\n  if (path === '..' || path.startsWith('../')) {\n    throw new Error('candidate input path escapes its execution root')\n  }\n  return posix.join(root, path)\n}\n\nfunction isSha256Digest(value: unknown): value is Sha256Digest {\n  return typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value)\n}\n"],"mappings":";;;;;;;;;;;AAAA,SAAS,aAAa;AACtB,SAAS,yBAAyB;AA+BlC,IAAM,+BAA+B;AACrC,IAAM,gCAAgC,KAAK;AA2BpC,SAAS,wCACd,SAC4B;AAC5B,SAAO,IAAI,mCAAmC,OAAO;AACvD;AAEA,IAAM,qCAAN,MAA+E;AAAA,EAS7E,YAA6B,SAA+C;AAA/C;AAC3B,QAAI,CAAC,QAAQ,SAAS,cAAc;AAClC,YAAM,IAAI;AAAA,QACR,+BAA+B,QAAQ,SAAS,IAAI;AAAA,MACtD;AAAA,IACF;AACA,SAAK,eAAe,QAAQ,SAAS;AACrC,SAAK,YAAY,eAAe,QAAQ,SAAS;AACjD,SAAK,qBAAqB;AAAA,MACxB,QAAQ,sBAAsB;AAAA,MAC9B;AAAA,IACF;AACA,SAAK,sBAAsB;AAAA,MACzB,QAAQ,uBAAuB;AAAA,MAC/B;AAAA,IACF;AACA,SAAK,kBAAkB,QAAQ,kBAC3B,wBAAwB,QAAQ,eAAe,IAC/C;AAAA,EACN;AAAA,EAnB6B;AAAA,EARZ,SAAS,oBAAI,IAAkC;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAuBR,MAAM,QACJ,SACA,SACA;AACA,2BAAuB,OAAO;AAC9B,UAAM,UAAU,QAAQ,UAAU,KAAK;AACvC,QAAI,QAAQ,SAAS,SAAU,OAAM,IAAI,MAAM,gDAAgD;AAC/F,UAAM,UAAU,QAAQ,cAAc,MAAM,SAAS,MAAM,OAAO;AAClE,UAAM,SACJ,QAAQ,SAAS,aACZ,EAAE,MAAM,UAAU,IAClB,EAAE,MAAM,UAAU,cAAc,CAAC,GAAG,QAAQ,OAAO,EAAE;AAC5D,UAAM,KAAK,iBAAiB,OAAO,IAAI;AACvC,YAAQ,OAAO,eAAe;AAE9B,UAAM,MAAM,aAAa,QAAQ,aAAa,QAAQ,cAAc,MAAM,MAAM;AAChF,QAAI,KAAK,OAAO,IAAI,GAAG,EAAG,OAAM,IAAI,MAAM,mDAAmD;AAC7F,UAAM,QAAQ;AAAA,MACZ,QAAQ,cAAc,MAAM,SAAS,UAAU;AAAA,MAC/C,QAAQ,cAAc,MAAM,SAAS,UAAU;AAAA,IACjD;AACA,UAAM,gBAAgB;AAAA,MACpB,QAAQ,WAAW;AAAA,MACnB,KAAK;AAAA,IACP;AACA,UAAM,iBAAiB,wBAAwB;AAAA,MAC7C,MAAM;AAAA,MACN,UAAU,KAAK,QAAQ,SAAS;AAAA,MAChC,aAAa,QAAQ;AAAA,MACrB,qBAAqB,QAAQ,cAAc,MAAM;AAAA,MACjD;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB,KAAK;AAAA,MACzB,WAAW,KAAK;AAAA,MAChB,QAAQ,EAAE,WAAW,QAAQ,WAAW,UAAU,QAAQ,SAAS;AAAA,MACnE,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;AAAA,IAC1E,CAAC;AACD,UAAM,oBAAoB,yBAAyB,cAAc;AACjE,UAAM,WAAW,wBAAwB;AAAA,MACvC,MAAM;AAAA,MACN,UAAU,KAAK,QAAQ,SAAS;AAAA,MAChC,aAAa,QAAQ;AAAA,MACrB,qBAAqB,QAAQ,cAAc,MAAM;AAAA,MACjD;AAAA,MACA,iBAAiB,QAAQ;AAAA,MACzB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,UAAM,cAAc,MAAM,KAAK,aAAa,OAAO;AAAA,MACjD;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB,KAAK;AAAA,MACzB,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,gBAAgB;AAAA,QACd,QAAQ;AAAA,QACR,QAAQ,cAAc,MAAM;AAAA,MAC9B;AAAA,MACA,QAAQ,QAAQ;AAAA,MAChB,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;AAAA,IAC1E,CAAC;AACD,QAAI;AACF,iCAA2B,aAAa,UAAU,KAAK,QAAQ,SAAS,IAAI;AAAA,IAC9E,SAAS,OAAO;AACd,UAAI;AACF,cAAM,YAAY,QAAQ;AAAA,MAC5B,SAAS,cAAc;AACrB,cAAM,IAAI;AAAA,UACR,CAAC,OAAO,YAAY;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AACA,UAAM,QAA8B,EAAE,YAAY;AAClD,SAAK,OAAO,IAAI,KAAK,KAAK;AAE1B,UAAM,WAAW,MAAM,YAAY,QAAQ,KAAK;AAChD,QAAI,SAAS,WAAW,GAAG;AACzB,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AACA,UAAM,mBAAmB,aAAa,SAAS,QAAQ,MAAM;AAC7D,UAAM,SAAS,YAAY,OAAO;AAClC,UAAM,YAAY,KAAK,IAAI;AAC3B,UAAM,QAAQ;AAAA,MACZ,OAAO,QAAQ,MAAM;AAAA,MACrB,YAAY,QAAQ,UAAU,KAAK,SAAS;AAAA,MAC5C;AAAA,MACA,cAAc,QAAQ;AAAA,MACtB,WAAW,QAAQ,WAAW;AAAA,MAC9B,MAAM;AAAA,QACJ,GAAG,QAAQ,MAAM;AAAA,QACjB,eAAe,YAAY;AAAA,QAC3B,qBAAqB,YAAY;AAAA,MACnC;AAAA,MACA,SAAS;AAAA,IACX;AACA,UAAM,UAAU,MAAM,YAAY,QAAQ,MAAM,QAAQ,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAClF,UAAM,gBAAgB,cAAc,SAAS,QAAQ,QAAQ;AAC7D,SAAK,cAAc,MAAM,MAAM,MAAS;AACxC,QAAI;AACJ,QAAI,gBAAgB;AACpB,UAAM,SAAS,MAAM;AACnB,UAAI,CAAC,cAAe,kBAAiB,YAAY,OAAO;AAAA,IAC1D;AACA,YAAQ,OAAO,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/D,QAAI,QAAQ,OAAO,QAAS,QAAO;AACnC,QAAI;AACF,YAAM,cAAc,MAAM,QAAQ,KAAK;AACvC,sBAAgB;AAChB,cAAQ,OAAO,oBAAoB,SAAS,MAAM;AAClD,UAAI,aAAc,OAAM;AACxB,YAAM,SAAS,MAAM,QAAQ,OAAO;AACpC,2BAAqB,QAAQ,WAAW;AACxC,YAAM,SAAS,MAAM,YAAY,eAAe,QAAQ,QAAQ,QAAQ,YAAY;AACpF,YAAM,cAAc;AACpB,YAAM,wBAAwB,OAAO,QAAQ,YAAY,MAAM;AAC/D,aAAO,EAAE,aAAa,QAAQ,aAAa,YAAY;AAAA,IACzD,UAAE;AACA,cAAQ,OAAO,oBAAoB,SAAS,MAAM;AAAA,IACpD;AAAA,EACF;AAAA,EAEA,MAAM,KACJ,SACA,SACqC;AACrC,UAAM,KAAK,iBAAiB;AAC5B,YAAQ,OAAO,eAAe;AAC9B,UAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,IAAI;AACpD,QAAI,CAAC,YAAa,QAAO,EAAE,SAAS,KAAK;AACzC,QAAI,WAAW,MAAM,YAAY,QAAQ,KAAK;AAC9C,QAAI,SAAS,SAAS,GAAG;AACvB,YAAM,IAAI,MAAM,oEAAoE;AAAA,IACtF;AACA,UAAM,SAAS,SAAS,CAAC;AACzB,QAAI,QAAQ,SAAS;AACnB,YAAM,UAAU,MAAM,YAAY,QAAQ,IAAI,OAAO,GAAG;AACxD,UAAI,CAAC,QAAS,OAAM,IAAI,MAAM,uDAAuD;AACrF,YAAM,YAAY,OAAO;AAAA,IAC3B;AACA,YAAQ,OAAO,eAAe;AAC9B,eAAW,MAAM,YAAY,QAAQ,KAAK;AAC1C,QAAI,SAAS,KAAK,CAAC,UAAU,MAAM,OAAO,GAAG;AAC3C,YAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AACA,UAAM,cAAc,SAAS,CAAC;AAC9B,QAAI,YAAa,sBAAqB,WAAW;AACjD,UAAM,QAAQ,KAAK,OAAO,IAAI,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;AAC5F,QAAI,OAAO;AACT,YAAM,cAAc,aAAa,eAAe,MAAM;AACtD,UAAI,QAAQ,WAAW,aAAa,MAAM,OAAO;AAC/C,cAAM,qBAAqB;AAAA,UACzB,MAAM;AAAA,UACN,WAAW,MAAM,MAAM;AAAA,QACzB;AAAA,MACF;AACA,YAAM,wBAAwB,OAAO,QAAQ,YAAY,WAAW;AAAA,IACtE;AACA,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AAAA,EAEA,MAAM,QACJ,SACA,SACA;AACA,UAAM,KAAK,iBAAiB;AAC5B,YAAQ,OAAO,eAAe;AAC9B,UAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,KAAK;AACrD,UAAM,WAAW,MAAM,YAAY,QAAQ,KAAK;AAChD,UAAM,SAAS,SAAS,CAAC;AACzB,QAAI,SAAS,WAAW,KAAK,CAAC,UAAU,OAAO,SAAS;AACtD,YAAM,IAAI,MAAM,uEAAuE;AAAA,IACzF;AACA,yBAAqB,MAAM;AAC3B,UAAM,UAAU,MAAM,YAAY,QAAQ,IAAI,OAAO,GAAG;AACxD,QAAI,CAAC,QAAS,OAAM,IAAI,MAAM,wDAAwD;AACtF,UAAM,gBAAgB,MAAM,QAAQ,OAAO;AAC3C,yBAAqB,eAAe,OAAO,WAAW;AACtD,UAAM,QAAQ,KAAK,OAAO,IAAI,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;AAC5F,UAAM,SACJ,OAAO,UACN,MAAM;AAAA,MACL,cAAc,SAAS,WAAW,WAAW,EAAE,QAAQ;AAAA,MACvD,QAAQ;AAAA,MACR,KAAK,IAAI,IAAI,KAAK;AAAA,IACpB;AACF,YAAQ,OAAO,eAAe;AAC9B,UAAM,WAAW,wBAAwB;AAAA,MACvC,MAAM;AAAA,MACN,UAAU,YAAY;AAAA,MACtB,eAAe,YAAY;AAAA,MAC3B,aAAa,QAAQ;AAAA,MACrB,qBAAqB,QAAQ;AAAA,MAC7B,mBAAmB,YAAY,UAAU;AAAA,MACzC,SAAS;AAAA,QACP,KAAK,OAAO;AAAA,QACZ,UAAU,OAAO;AAAA,QACjB,GAAI,OAAO,aAAa,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC;AAAA,QAC7D,aAAa,OAAO;AAAA,MACtB;AAAA,MACA,GAAI,OAAO,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,MACpF,QAAQ,EAAE,QAAQ,YAAY,MAAM,GAAG,YAAY,OAAO,WAAW;AAAA,IACvE,CAAC;AACD,WAAO;AAAA,MACL,aAAa,EAAE,MAAM,UAAmB,OAAO,OAAO;AAAA,MACtD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QACJ,SACA,SACsC;AACtC,UAAM,KAAK,iBAAiB;AAC5B,YAAQ,OAAO,eAAe;AAC9B,UAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,IAAI;AACpD,QAAI,CAAC,YAAa,QAAO,EAAE,UAAU,KAAK;AAC1C,QAAI;AACJ,QAAI;AACF,YAAM,YAAY,QAAQ;AAAA,IAC5B,SAAS,OAAO;AACd,qBAAe;AAAA,IACjB;AACA,UAAM,YAAY,MAAM,KAAK,aAAa,IAAI,YAAY,EAAE;AAC5D,QAAI,WAAW;AACb,YAAM,IAAI,MAAM,oDAAoD,EAAE,OAAO,aAAa,CAAC;AAAA,IAC7F;AACA,YAAQ,OAAO,eAAe;AAC9B,SAAK,OAAO,OAAO,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;AACjF,WAAO,EAAE,UAAU,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAc,iBAAiB,MAA4C;AACzE,UAAM,UACJ,KAAK,uBAAuB,QAAQ,QAAQ,KAAK,QAAQ,SAAS,aAAa,CAAC;AAClF,SAAK,sBAAsB;AAC3B,QAAI;AACJ,QAAI;AACF,qBAAe,MAAM;AAAA,IACvB,SAAS,OAAO;AACd,UAAI,KAAK,wBAAwB,QAAS,MAAK,sBAAsB;AACrE,YAAM;AAAA,IACR;AACA,UAAM,QAAQ,aAAa;AAC3B,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,QAAQ,SAAS,IAAI;AAAA,MAC3D;AAAA,IACF;AACA,QAAI,QAAQ,CAAC,MAAM,OAAO,SAAS,IAAI,GAAG;AACxC,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,QAAQ,SAAS,IAAI,sBAAsB,IAAI;AAAA,MACrF;AAAA,IACF;AAAA,EACF;AAAA,EAUA,MAAc,QACZ,SACA,kBACmD;AACnD,UAAM,MAAM,aAAa,QAAQ,aAAa,QAAQ,mBAAmB;AACzE,UAAM,SAAS,KAAK,OAAO,IAAI,GAAG,GAAG;AACrC,QAAI,OAAQ,QAAO;AACnB,UAAM,WAAW;AAAA,MACf,MAAM;AAAA,MACN,UAAU,KAAK,QAAQ,SAAS;AAAA,MAChC,aAAa,QAAQ;AAAA,MACrB,qBAAqB,QAAQ;AAAA,IAC/B;AACA,UAAM,SAAS,MAAM,KAAK,aAAa,KAAK;AAAA,MAC1C;AAAA,MACA,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;AAAA,IAC1E,CAAC;AACD,UAAM,UAAU,OAAO;AAAA,MACrB,CAACA,iBACCA,aAAY,aAAa,KAAK,QAAQ,SAAS,QAC/C,OAAO,QAAQ,QAAQ,EAAE;AAAA,QAAM,CAAC,CAAC,MAAM,KAAK,MAC1C,kBAAkBA,aAAY,WAAW,IAAI,GAAG,KAAK;AAAA,MACvD;AAAA,IACJ;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI,MAAM,mEAAmE;AAAA,IACrF;AACA,UAAM,cAAc,QAAQ,CAAC;AAC7B,QAAI,CAAC,aAAa;AAChB,UAAI,iBAAkB,QAAO;AAC7B,YAAM,IAAI,MAAM,iDAAiD;AAAA,IACnE;AACA,QAAI,CAAC,eAAe,YAAY,UAAU,iBAAiB,GAAG;AAC5D,YAAM,IAAI,MAAM,4DAA4D;AAAA,IAC9E;AACA,SAAK,OAAO,IAAI,KAAK,EAAE,YAAY,CAAC;AACpC,WAAO;AAAA,EACT;AACF;AAEA,eAAe,wBACb,OACA,YACA,QACe;AACf,QAAM,QAAQ,MAAM;AACpB,MAAI,CAAC,SAAS,MAAM,QAAS;AAC7B,QAAM,UAAU,KAAK,IAAI,MAAM,WAAW,KAAK,IAAI,KAAK,IAAI,GAAG,MAAM,YAAY,CAAC;AAClF,QAAM,cAAc,MAAM,sBAAsB,MAAM,eAAe,QAAQ;AAC7E,QAAM,WAAW,UAAU;AAAA,IACzB,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB;AAAA,IACA,QAAQ,aAAa,SAAS,UAAU,YAAY,aAAa,IAAI,cAAc;AAAA,IACnF,MAAM,MAAM;AAAA,EACd,CAAC;AACD,QAAM,UAAU;AAClB;AAEA,SAAS,uBAAuB,SAA8C;AAC5E,MAAI,QAAQ,UAAU,KAAK,QAAQ,SAAS,UAAU;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,cAAc,MAAM,SAAS,aAAa,cAAc,QAAQ,OAAO,WAAW;AAC5F,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AACA,MAAI,QAAQ,OAAO,SAAS,YAAY;AACtC,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,QAAM,YAAY,QAAQ,UAAU,KAAK,QAAQ,UAAU,YAAY;AACvE,MACE,EACE,UAAU,WAAW,OAAO,KAC5B,cAAc,sBACd,UAAU,SAAS,OAAO,IAE5B;AACA,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,MAAI,CAAC,MAAM,WAAW,QAAQ,OAAO,UAAU,KAAK,CAAC,QAAQ,OAAO,IAAI,MAAM,KAAK,GAAG;AACpF,UAAM,IAAI,MAAM,8EAA8E;AAAA,EAChG;AACF;AAEA,eAAe,mBACb,aACA,SACA,QACe;AACf,QAAM,iBAAiB,gCAAgC,OAAO;AAC9D,aAAW,QAAQ,QAAQ,OAAO,KAAK,OAAO;AAC5C,UAAM,YAAY,UAAU,QAAQ,QAAQ,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,OAAO;AAAA,MAClF,MAAM,KAAK;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,cACJ,QAAQ,cAAc,MAAM,SAAS,QAAQ,oBAAoB,SAC7D,QAAQ,MAAM,WACd,QAAQ,MAAM;AACpB,MAAI,CAAC,YAAa,OAAM,IAAI,MAAM,+CAA+C;AACjF,aAAW,QAAQ,QAAQ,kBAAkB,OAAO;AAClD,UAAM,YAAY;AAAA,MAChB,QAAQ,aAAa,KAAK,IAAI;AAAA,MAC9B,OAAO,KAAK,KAAK,SAAS,MAAM;AAAA,MAChC,EAAE,MAAM,KAAK,MAAM,OAAO;AAAA,IAC5B;AAAA,EACF;AACA,MAAI,QAAQ,aAAa,gBAAgB;AACvC,eAAW,QAAQ,QAAQ,UAAU,OAAO;AAC1C,YAAM,YAAY,UAAU,QAAQ,eAAe,MAAM,KAAK,IAAI,GAAG,KAAK,OAAO;AAAA,QAC/E,MAAM,KAAK;AAAA,QACX;AAAA,MACF,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,UAAU,mBAAmB,eAAe,iBAAiB;AACvE,YAAM,YAAY;AAAA,QAChB,eAAe;AAAA,QACf,QAAQ,UAAU;AAAA,QAClB,EAAE,MAAM,KAAO,OAAO;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,YAAY,SAAS,SAAS,aAAa;AACrD,UAAM,YAAY,UAAU,QAAQ,YAAY,SAAS,MAAM,QAAQ,YAAY,OAAO;AAAA,MACxF,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,SAAS,gCACP,SACiE;AACjE,QAAM,YAAY,QAAQ;AAC1B,MAAI,CAAC,WAAW;AACd,QACE,QAAQ,OAAO,IAAI,4BAA4B,MAAM,UACrD,QAAQ,OAAO,IAAI,wCAAwC,MAAM,QACjE;AACA,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AACA,WAAO;AAAA,EACT;AACA,QAAM,QAAQ;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,UAAU,oBAAoB;AAAA,EAChC;AACA,MACE,QAAQ,OAAO,IAAI,4BAA4B,MAAM,MAAM,QAC3D,QAAQ,OAAO,IAAI,wCAAwC,MAAM,MAAM,iBACvE;AACA,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,QAAM,WAAW,CAAC,MAAM,MAAM,MAAM,eAAe,EAAE;AAAA,IACnD,CAAC,UAA2B,UAAU;AAAA,EACxC;AACA,QAAM,cACJ,QAAQ,cAAc,MAAM,SAAS,QAAQ,oBAAoB,SAC7D,QAAQ,MAAM,WACd,QAAQ,MAAM;AACpB,QAAM,aAAa;AAAA,IACjB,GAAG,QAAQ,OAAO,KAAK,MAAM,IAAI,CAAC,SAAS,QAAQ,QAAQ,MAAM,UAAU,KAAK,IAAI,CAAC;AAAA,IACrF,GAAI,cACA,QAAQ,kBAAkB,MAAM,IAAI,CAAC,SAAS,QAAQ,aAAa,KAAK,IAAI,CAAC,IAC7E,CAAC;AAAA,IACL,GAAI,QAAQ,YAAY,SAAS,SAAS,cACtC,CAAC,QAAQ,YAAY,SAAS,IAAI,IAClC,CAAC;AAAA,EACP;AACA,MACE,WAAW;AAAA,IAAK,CAAC,SACf,SAAS;AAAA,MACP,CAAC,iBACC,SAAS,gBACT,KAAK,WAAW,GAAG,YAAY,GAAG,KAClC,aAAa,WAAW,GAAG,IAAI,GAAG;AAAA,IACtC;AAAA,EACF,GACA;AACA,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,YAAY,SAAiE;AACpF,QAAM,cAAc,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,QAAQ,YAAY,KAAK;AAC9F,QAAM,OAAO;AAAA,IACX,YAAY,QAAQ,OAAO;AAAA,IAC3B,MAAM,QAAQ,OAAO;AAAA,IACrB,KAAK,QAAQ,OAAO;AAAA,IACpB,KAAK,QAAQ,OAAO;AAAA,IACpB,WAAW;AAAA,EACb;AACA,UAAQ,QAAQ,YAAY,SAAS,MAAM;AAAA,IACzC,KAAK;AACH,aAAO,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,KAAK,MAAM,WAAW,EAAE;AAAA,IACtD,KAAK;AACH,aAAO,EAAE,GAAG,MAAM,OAAO,YAAY;AAAA,IACvC,KAAK;AACH,aAAO;AAAA,EACX;AACF;AAEA,eAAe,cAAc,SAA4B,UAAuC;AAC9F,QAAM,SAAmB,CAAC;AAC1B,MAAI,aAAa;AACjB,mBAAiB,SAAS,QAAQ,OAAO,GAAG;AAC1C,UAAM,QAAQ,OAAO,KAAK,OAAO,MAAM;AACvC,kBAAc,MAAM;AACpB,QAAI,aAAa,UAAU;AACzB,UAAI;AACJ,UAAI;AACF,cAAM,YAAY,OAAO;AAAA,MAC3B,SAAS,OAAO;AACd,oBAAY;AAAA,MACd;AACA,YAAM,IAAI,MAAM,gCAAgC,QAAQ,iBAAiB;AAAA,QACvE,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,SAAO,WAAW,KAAK,OAAO,OAAO,QAAQ,UAAU,CAAC;AAC1D;AAEA,eAAe,YACb,QACA,QACA,cACqB;AACrB,SAAO,eAAe;AACtB,QAAM,cAAc,eAAe,KAAK,IAAI;AAC5C,MAAI,eAAe,EAAG,OAAM,IAAI,MAAM,mCAAmC;AACzE,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,MACxB;AAAA,MACA,IAAI,QAAe,CAAC,UAAU,WAAW;AACvC,kBAAU,MAAM,OAAO,OAAO,UAAU,IAAI,MAAM,4BAA4B,CAAC;AAC/E,eAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,gBAAQ;AAAA,UACN,MAAM,OAAO,IAAI,MAAM,mCAAmC,CAAC;AAAA,UAC3D;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,QAAI,QAAS,QAAO,oBAAoB,SAAS,OAAO;AACxD,QAAI,MAAO,cAAa,KAAK;AAAA,EAC/B;AACF;AAEA,eAAe,YAAY,SAA2C;AACpE,QAAM,SAAS,MAAM,QAAQ,OAAO;AACpC,MAAI,CAAC,OAAO,QAAS;AACrB,MAAI;AACF,UAAM,QAAQ,KAAK;AAAA,EACrB,SAAS,OAAO;AACd,SAAK,MAAM,QAAQ,OAAO,GAAG,QAAS,OAAM;AAAA,EAC9C;AACA,QAAM,cAAc,MAAM,QAAQ,KAAK;AACvC,uBAAqB,MAAM,QAAQ,OAAO,GAAG,WAAW;AAC1D;AAEA,SAAS,qBACP,QACA,UACwF;AACxF,MAAI,OAAO,WAAW,CAAC,OAAO,aAAa;AACzC,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,MAAI,YAAY,CAAC,kBAAkB,OAAO,aAAa,QAAQ,GAAG;AAChE,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACF;AAEA,SAAS,2BACP,aACA,UACA,cACM;AACN,MAAI,CAAC,YAAY,MAAM,YAAY,aAAa,cAAc;AAC5D,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,MACE,CAAC,OAAO,QAAQ,QAAQ,EAAE;AAAA,IAAM,CAAC,CAAC,MAAM,KAAK,MAC3C,kBAAkB,YAAY,WAAW,IAAI,GAAG,KAAK;AAAA,EACvD,GACA;AACA,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACF;AAEA,SAAS,WAAW,aAAiE;AACnF,QAAM,WAAW,YAAY,UAAU;AACvC,MAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC3D,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,SAAO,EAAE,UAAU,OAAO,QAAQ,EAAE;AACtC;AAEA,SAAS,aAAa,aAAqB,qBAA2C;AACpF,SAAO,GAAG,WAAW,KAAK,mBAAmB;AAC/C;AAEA,SAAS,wBAAwB,aAAqB,qBAA2C;AAC/F,SAAO,aAAa,yBAAyB;AAAA,IAC3C,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF,CAAC,EAAE,MAAM,UAAU,MAAM,CAAC;AAC5B;AAEA,SAAS,WAAW,OAAe,gBAAsC;AACvE,MAAI,eAAe,KAAK,GAAG;AACzB,QAAI,UAAU,gBAAgB;AAC5B,YAAM,IAAI,MAAM,gEAAgE;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,MAAM,YAAY,GAAG;AACpC,MAAI,SAAS,EAAG,QAAO,GAAG,KAAK,IAAI,cAAc;AACjD,MAAI,MAAM,MAAM,SAAS,CAAC,MAAM,gBAAgB;AAC9C,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,WAAmB,aAA6B;AAC7E,QAAM,QAAQ,gBAAgB,WAAW,6BAA6B,IAAI;AAC1E,MAAI,CAAC,OAAO,cAAc,KAAK,EAAG,OAAM,IAAI,MAAM,6CAA6C;AAC/F,SAAO,KAAK,KAAK,QAAQ,GAAK,IAAI;AACpC;AAEA,SAAS,eAAe,WAAmE;AACzF,MAAI,CAAC,OAAO,SAAS,UAAU,GAAG,KAAK,UAAU,OAAO,GAAG;AACzD,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,SAAO,OAAO,OAAO;AAAA,IACnB,KAAK,UAAU;AAAA,IACf,UAAU,gBAAgB,UAAU,UAAU,sBAAsB;AAAA,IACpE,QAAQ,gBAAgB,UAAU,QAAQ,oBAAoB;AAAA,EAChE,CAAC;AACH;AAEA,SAAS,gBAAgB,OAAe,OAAuB;AAC7D,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ;AAC1C,UAAM,IAAI,MAAM,GAAG,KAAK,6BAA6B;AACvD,SAAO;AACT;AAEA,SAAS,QAAQ,MAAc,cAA8B;AAC3D,MAAI,MAAM,WAAW,YAAY,EAAG,OAAM,IAAI,MAAM,uCAAuC;AAC3F,QAAM,OAAO,MAAM,UAAU,YAAY;AACzC,MAAI,SAAS,QAAQ,KAAK,WAAW,KAAK,GAAG;AAC3C,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO,MAAM,KAAK,MAAM,IAAI;AAC9B;AAEA,SAAS,eAAe,OAAuC;AAC7D,SAAO,OAAO,UAAU,YAAY,wBAAwB,KAAK,KAAK;AACxE;","names":["environment"]}