@tangle-network/agent-runtime 0.102.2 → 0.103.0

package/dist/{worktree-fanout-DsIR4d6w.d.ts → worktree-fanout-DiiJWjJO.d.ts}

@@ -1,9 +1,9 @@
 import { AgentProfile } from '@tangle-network/agent-interface';
 import { AnalystFinding, DefaultVerdict } from '@tangle-network/agent-eval';
-import { N as NodeId, d as Settled, e as Spend, f as AgentSpec, S as Scope, g as SpawnJournal, a as ResultBlobStore, h as ExecutorRegistry, B as Budget, A as Agent, i as RootHandle, b as SupervisedResult, c as Executor } from './types-D870JlH0.js';
-import { I as Iteration, R as RuntimeHooks } from './types-CLat4bT9.js';
+import { N as NodeId, a as Settled, g as Spend, h as AgentSpec, S as Scope, c as SpawnJournal, b as ResultBlobStore, i as ExecutorRegistry, B as Budget, A as Agent, j as RootHandle, e as SupervisedResult, f as Executor } from './types-lZTE_LBd.js';
+import { I as Iteration, R as RuntimeHooks } from './types-DK11_O4L.js';
 import { BackendType } from '@tangle-network/sandbox';
-import { W as WorktreeHarnessResult, G as GitRunner, a as WorktreeCheckRunner, D as DeliverableSpec } from './completion-gate-C6dhVN-N.js';
+import { W as WorktreeHarnessResult, G as GitRunner, a as WorktreeCheckRunner, D as DeliverableSpec } from './completion-gate-DLINnrkM.js';
 import { L as LocalHarness, r as runLocalHarness } from './local-harness-CtK9dSny.js';
 
 /**
@@ -114,6 +114,17 @@ interface FanoutOptions<Item, D> {
      * synthesis child IS the selection); supplying both is a config error.
      */
     selectWinner?: FanoutWinnerSelector<D>;
+    /**
+     * Cap on how many item children run AT ONCE. When set, the fanout dispatches through
+     * `rollingDispatch`: it fills `width` slots and admits the next item the moment one settles,
+     * instead of opening every item in a single round. Same items, same selection, same conserved
+     * pool — only the simultaneity changes.
+     *
+     * Unset (the default) keeps the single-round batch behavior every existing caller has. Set it
+     * when the items outnumber the live capacity a host can actually afford, so the pool is not
+     * spent opening children that then queue behind a real fence.
+     */
+    width?: number;
 }
 /** A winner-selection strategy: argmax/sort over the gathered child iterations (each output is the
  *  child's `Outcome<D>`), returning the chosen iteration or `undefined` when none qualifies. */
@@ -451,8 +462,9 @@ interface TrajectoryNode {
     readonly children: ReadonlyArray<NodeId>;
     readonly label: string;
     readonly runtime: string;
-    /** Terminal status the journal recorded for this node. */
-    readonly status: 'done' | 'failed' | 'cancelled' | 'pending';
+    /** Terminal status the journal recorded for this node. `'waiting'` is a wait-state node that was
+     *  armed and never woken — the journal's record of a run that died mid-wait. */
+    readonly status: 'done' | 'failed' | 'cancelled' | 'pending' | 'waiting';
     /** This node's OWN conserved spend (from its `settled` event). */
     readonly ownSpend: Spend;
     /** This node's spend PLUS every descendant's — the rolled-up subtree cost. The cost a parent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-runtime",
-  "version": "0.102.2",
+  "version": "0.103.0",
   "description": "Shared task-lifecycle skeleton for agents: a recursive loop kernel for chat turns, one-shot tasks, and multi-attempt loops, with trace capture and eval-gated self-improvement. Domain behavior lives in adapters; scoring and ship-gates in @tangle-network/agent-eval.",
   "homepage": "https://github.com/tangle-network/agent-runtime#readme",
   "repository": {
@@ -110,9 +110,10 @@
     "typecheck:examples": "tsc --noEmit -p tsconfig.examples.json",
     "generate:testing-fixture": "tsx scripts/generate-agent-improvement-proposal-fixture.ts",
     "check:testing-fixture": "tsx scripts/generate-agent-improvement-proposal-fixture.ts --check",
+    "check:skills": "node scripts/check-skills.mjs",
     "verify:bench": "pnpm build && pnpm --filter @tangle-network/agent-bench run typecheck:public && pnpm --filter @tangle-network/agent-bench test && pnpm --filter @tangle-network/agent-bench run verify:package:local-runtime",
     "verify:bench:published": "pnpm build && pnpm --filter @tangle-network/agent-bench run typecheck:public && pnpm --filter @tangle-network/agent-bench test && pnpm --filter @tangle-network/agent-bench run verify:package",
-    "verify:package": "pnpm run check:testing-fixture && node scripts/verify-package-exports.mjs",
+    "verify:package": "pnpm run check:testing-fixture && pnpm run check:skills && node scripts/verify-package-exports.mjs",
     "verify:primeintellect": "pnpm build && node scripts/verify-primeintellect-v1.mjs",
     "verify:primeintellect:live": "pnpm build && node scripts/verify-primeintellect-live.mjs",
     "docs:api": "pnpm run build && typedoc && node scripts/gen-primitive-catalog.mjs",

package/skills/build-with-agent-runtime/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: build-with-agent-runtime
-description: Use before adding an agent loop, benchmark, optimizer, trace wrapper, or candidate activation path. Find and compose the existing Runtime, Eval, Knowledge, and Interface primitives.
+description: Choose and compose current runtime, eval, knowledge, and interface APIs before adding wrappers.
 ---
 
 # Build with agent-runtime
@@ -62,10 +62,11 @@ It performs these steps in order:
 
 1. Analyze completed traces.
 2. Search for a candidate on development tasks.
-3. Freeze the baseline and winner into one exact experiment.
-4. Reject the experiment if its candidate differs from the search winner.
-5. Run baseline and candidate on the same held-back tasks.
-6. Produce findings, confidence intervals, quality, cost, latency, and a decision.
+3. Build the frozen baseline, candidate, and held-back work.
+4. Return only baseline, candidate, held-back tasks, and policy; Runtime adds the optimizer ancestry and seals the final experiment.
+5. Reject the experiment if its candidate differs from the search winner.
+6. Run baseline and candidate on the same held-back tasks.
+7. Produce findings, confidence intervals, quality, cost, latency, and a decision.
 
 After a person or tenant policy approves the proposal, call `createAgentImprovementActivation(...)` with target identities, funding owner, authority, intent, and expiry.
 Runtime derives the expected current digests from the measured experiment.
@@ -122,5 +123,6 @@ The product must not recreate candidate hashing, paired comparison, confidence i
 
 ## Then consider
 
+- Use `build-with-agent-knowledge` when agents should improve retrieval, memory, or a knowledge base.
 - Use `critical-audit` when the change introduces or alters a public contract.
 - Use `verify` before publishing or adopting the package in a product.

package/skills/generate-eval/SKILL.md

@@ -1,60 +1,53 @@
 ---
 name: generate-eval
-description: Author ONE execution-certifiable, search-discriminating eval task for a given target (library@version, repo, or release-notes URL). The runtime certifies — your job is to produce a candidate that survives both gates.
+description: Create one pinned fresh-API coding case that passes execution and defeats a no-search baseline.
 ---
 
-# generate-eval — author a certifiable eval task
+# Generate Eval
 
-You are authoring a benchmark task that measures whether web search helps a
-coding agent get a **current API detail exactly right**. Your candidate is
-admitted only if an independent certifier confirms BOTH gates:
-
-1. **Grounding** — your reference solution executes and passes in a clean
-   workspace against the real pinned target (the library is the oracle, not
-   your memory).
-2. **Discrimination** — a strong model WITHOUT search fails your oracle (a
-   task models already know measures nothing).
+Use this for one benchmark case that measures whether current official documentation helps a coding agent use an exact API correctly.
+Do not use it for general coding quality or subjective output.
 
 ## Inputs
 
-- `TARGET` — a library + version (`hono@4.6`), a repo, or a release-notes URL.
-- `OUT` — the file path where you write exactly one candidate JSON object.
-
-## Procedure
-
-1. **Find the discriminating detail.** Use web search on the target's release
-   notes / changelog / current docs. Pick ONE precise, recent-or-niche detail:
-   an exact method name, option key, config field, or flag — ideally one where
-   the *plausible wrong guess* is specific (e.g. models guess `maxRetries`
-   where the real key is `limit`). Record the primary-doc URL.
-2. **Author the task** as JSON with `schemaVersion: 1` and fields:
-   - `id` (kebab-case), `domain`, `prompt` — ask for the exact identifiers and
-     a minimal runnable usage; the answer must be gradable from its TEXT.
-   - `needsFreshDocs` — the specific fact + the wrong guess models make.
-   - `oracle` — `containsAll`: distinctive exact identifiers a correct answer
-     must contain (specific enough that a wrong answer can't contain them by
-     accident); `notContains`: the plausible wrong/deprecated forms; optional
-     `regex` for structure. No generic words.
-   - `searchQuery`, `expectedUrlIncludes`, `sourceUrl` — retrieval provenance.
-   - `setup` — commands that provision a CLEAN workspace and PIN the target
-     (`npm init -y`, `npm i hono@4.6.3` / `pip install pkg==x.y`). The
-     certifier replays these from scratch.
-   - `reference` — `files` (minimal code exercising the detail against the
-     real installed target) + `cmd` (exits 0 only when the API is used
-     correctly) + `stdoutContains` (print a value derived from the real API
-     call, so an empty no-op can't pass).
-3. **Self-check before emitting** (you have a shell — use it):
-   - Run `setup` + `reference.cmd` yourself; fix until they pass.
-   - Write the correct answer to your own prompt; confirm every
-     `containsAll` string appears in it and none of `notContains` does.
-   - Write the *plausible wrong* answer; confirm the oracle FAILS it.
-4. **Emit** exactly one JSON object to `OUT`. No prose around it.
-
-## Hard rules
-
-- **Never mock or stub the target.** The reference must import and exercise
-  the real installed library. A mocked reference is a void candidate.
-- Expect repair feedback: the certifier returns gate diagnostics (compile
-  errors, oracle misses). Iterating is normal — fix and re-emit.
-- One candidate per invocation. Quality over quantity: a rejected candidate
-  costs a full certification cycle.
+- `TARGET`: a pinned package version, repository commit, or release.
+- `OUT`: the path for one candidate JSON object.
+
+Read `bench/src/generate-eval/schema.ts` and `bench/src/generate-eval/certify.ts` before authoring the candidate.
+Those files define the current format and checks.
+
+## Build One Case
+
+1. Read the target's official documentation, release notes, types, and installed implementation.
+2. Find one recent or niche identifier, option, behavior, or migration that a capable model could plausibly get wrong without search.
+3. Pin the target exactly and record the primary source URL.
+4. Write a realistic prompt that requires the detail but does not reveal it.
+5. Add a minimal reference workspace that imports and exercises the real target.
+6. Make the reference command fail on a no-op, deprecated form, or plausible wrong guess.
+7. Add exact positive and negative answer checks only where text matching cannot be satisfied accidentally.
+
+Never mock the target or use the candidate answer as the source of truth.
+Prefer executable behavior over identifier matching.
+
+## Calibrate
+
+Run all of these before writing `OUT`:
+
+1. Fresh setup plus the reference command passes in a clean workspace.
+2. The correct answer passes the answer checks.
+3. A plausible wrong answer fails.
+4. A strong no-search baseline fails for the intended API mistake rather than setup, network, or scoring failure.
+5. A search-enabled pilot can find the official source and solve the case.
+
+Reject a case that both baselines solve, neither baseline can solve, depends on an unavailable package, leaks the answer through setup, or grades generic words.
+
+## Output
+
+Write exactly one schema-valid candidate to `OUT`.
+Include the pinned target, source, clean setup, reference files and command, expected output, answer checks, and the observed calibration results required by the current schema.
+
+## Then consider
+
+- `calibrate-before-measure` before running a larger search comparison.
+- `eval-engineering` when the target is a production agent capability rather than fresh API recall.
+- `verify` before publishing a generated task set.

package/skills/loop-writer/SKILL.md

@@ -1,171 +1,103 @@
 ---
 name: loop-writer
-description: Author clean recursive agent loops on @tangle-network/agent-runtime. Use for Scope/supervisor orchestration, runLoop, Pi/sandbox drivers, fanout, trace analysts, verifiers/judges, question escalation, live messages, and self-improving loop recipes.
+description: Write a custom control policy only when current runtime composition APIs cannot express it.
 ---
 
-# loop-writer
+# Loop Writer
 
-Design the smallest loop that can honestly solve the objective. The blessed
-surface is the substrate: `fanout`/`pipeline` for fixed shapes, `runLoop` for
-round-synchronous sandbox loops, and `Scope`/Supervisor for recursive
-driver/worker trees. Do not create a second loop grammar.
+Use this only for a control policy that the shipped high-level APIs cannot express.
+Read `docs/canonical-api.md`, current exports, the implementation, and the nearest test before writing code.
+Do not copy signatures from this skill.
 
-## Mental Model
+## Choose The Existing Path First
 
-```txt
-user -> Pi/root driver -> supervisor -> sandbox driver -> worker -> leaf harness
-```
+| Need | Existing path |
+|---|---|
+| One product chat turn | `handleChatTurn(...)` |
+| One task or bounded multi-turn task | `runAgentTask(...)` or `runAgentTaskStream(...)` |
+| Two or more actors taking turns | `defineConversation(...)` and `runConversation(...)` |
+| A driver coordinating workers | `supervise(...)` or `superviseSurface(...)` |
+| Parallel or fixed composition | `fanout(...)`, `pipeline(...)`, `panel(...)`, `verify(...)`, or `loopUntil(...)` |
+| Parallel repository workers with isolated branches | `worktreeFanout(...)` |
+| Repeated work in a graded tool environment | `runAgentic(...)` |
+| Equal-budget comparison over that environment | `runBenchmark(...)` |
+| Low-level round policy with custom planning and stopping | `runLoop(...)` |
 
-Each level may spawn below, wait below, analyze below, steer below, and escalate
-questions upward. The substrate owns budget, trace, abort, journal, and replay.
-The driver owns strategy.
+If an existing row fits, use it and stop.
+Do not create another wrapper solely to rename inputs or results.
 
-## Pick The Primitive
+## Custom Loop Contract
 
-| Objective | Use |
-|---|---|
-| Try N attempts, pick best | `fanout` (or the `sample` strategy) |
-| Ordered stages | `pipeline` |
-| Improve until executable check passes | `loopUntil` + verifier |
-| Review from several lenses | `panel` |
-| Simulated user/product eval | `defineConversation` + `runConversation` |
-| Dynamic topology / drivers of drivers | `Scope` or sandbox driver + `createCoordinationTools` |
-| Run N coding workers on isolated worktrees, gate each, pick best patch | `worktreeFanout` |
-| Mutate a shared repo | git branch/clone loop with typed merge outcomes (`gitWorkspace` seam) |
-
-If a fixed combinator solves it, do not use a dynamic driver.
-
-## Minimal Sandbox Loop
-
-```ts
-// runLoop takes a caller-supplied Driver directly (plan() → Task[]; decide() → terminal).
-// `[task]` → refine, N copies → fanout, `[]` → stop. Keep it this small or use a Strategy.
-const refineDriver: Driver<Task, Out, 'done' | 'fail'> = {
-  name: 'refine',
-  plan: async (task, history) => (history.at(-1)?.verdict?.valid ? [] : [task]),
-  decide: (history) => (history.at(-1)?.verdict?.valid ? 'done' : 'fail'),
-}
-
-const trace: unknown[] = []
-const result = await runLoop({
-  driver: refineDriver,
-  agentRun: agentRunSpec,
-  output,
-  validator: executableGate,
-  task,
-  ctx: {
-    sandboxClient,
-    traceEmitter: { emit: async (event) => trace.push(event) },
-  },
-})
-
-const observation = await observe(
-  {
-    task: String(task),
-    output: JSON.stringify(result.winner?.output ?? result.decision),
-    trace,
-    outcome: result.winner ? 'passed' : 'failed',
-    runId,
-  },
-  { chat, model, corpus },
-)
-```
+A custom loop has five explicit parts:
 
-## Minimal Recursive Driver
-
-```ts
-const driver: Agent<Task, Output> = {
-  name: 'secure-build-driver',
-  async act(task, scope) {
-    const spawned = scope.spawn(workerAgent, task, { budget: perWorker, label: 'worker-a' })
-    if (!spawned.ok) throw new Error(spawned.reason)
-
-    const settled = await scope.next()
-    const observation = await observe(
-      {
-        task: String(task),
-        output: JSON.stringify(settled),
-        trace: [settled, scope.view],
-        outcome: settled?.kind === 'done' ? 'passed' : 'failed',
-        runId,
-      },
-      { chat, model, corpus },
-    )
-
-    const steer = observation.findings[0]?.recommended_action
-    if (!steer) return synthesize(settled, observation)
-
-    const correction = scope.spawn(workerAgent, { task, prior: settled }, {
-      budget: perWorker,
-      label: 'worker-corrected',
-    })
-    if (!correction.ok) throw new Error(correction.reason)
-    if (!scope.send(correction.handle.id, { steer })) throw new Error('steer delivery failed')
-
-    const fixed = await scope.next()
-    return synthesize(fixed, observation)
-  },
-}
-
-const result = await createSupervisor<Task, Output>().run(driver, task, supervisorOpts)
+```text
+task -> plan work -> execute attempts -> check outcomes -> continue or stop
 ```
 
-When the driver lives in a sandbox, expose the same verbs through
-`createCoordinationTools`: `spawn_agent`, `await_event`, `observe_agent`,
-`steer_agent`, `list_questions`, `answer_question`, `ask_parent`, `stop`, and
-optional analyst tools (`list_analysts`, `run_analyst`).
+Keep ownership separate:
 
-## Role Boundaries
+- The driver chooses work and termination from task plus prior outcomes.
+- Executors run attempts and return observed artifacts.
+- Objective checks determine whether an artifact is usable.
+- Trace emission records plans, attempts, tool effects, checks, spend, and decisions.
+- The caller owns policy, budgets, credentials, persistence, and side-effect authority.
 
-- **Verifier**: executable shippability gate; controls accept/reject.
-- **Judge**: held-out score only; never steers the current run.
-- **Analyst**: trace-derived diagnosis over worker, pairwise, subtree, or full
-  loop traces; may emit findings, questions, messages, or blockers.
-- **Driver/reviewer**: consumes evidence and chooses continue, steer, spawn,
-  answer, escalate, or stop.
+The driver must not mutate product state while planning.
+An LLM score must not override failed builds, tests, missing evidence, denied permissions, or service errors.
 
-## Questions And Steering
+## Required States
 
-Questions are blockers, not prose hidden in output. A child asks its parent; the
-parent answers when it has evidence, defers when safe, or escalates to Pi/user
-when answering would invent requirements. `failClosed` loops must not stop clean
-with unresolved `blocks-run` questions.
+Model every terminal and resumable state explicitly:
 
-Steer sparingly: only when an analyst finds a concrete mistake, a loop is
-duplicating work, a parent/Pi answers a blocker, or a verifier reveals a specific
-fix a running worker can still use. Delivery is through `Scope.send` or
-`steer_agent`; failed delivery means spawn a fresh corrected attempt.
+- succeeded with the accepted artifact;
+- exhausted by rounds, tokens, money, time, or concurrency;
+- cancelled by the caller;
+- blocked on a question or permission;
+- failed before an attempt;
+- failed during execution or checking;
+- interrupted with enough durable state to resume safely.
 
-## Workspace Loops
+Use stable run, attempt, task, and parent IDs.
+Persist the accepted artifact, every attempted artifact identity, spend, and final reason.
+Resume from durable facts, not an in-memory counter or summary alone.
 
-Git is the durable workspace seam:
+## Steering And Questions
 
-- one branch/clone per worker
-- `gitWorkspace({ ref })` when host and sandbox need the same clone/commit/push contract
-- explicit commit per worker
-- typed merge result: `merged | conflict | stale-base | rejected | verifier-failed`
-- resume derives completion from git state, not only a side journal
-- conflicts become blockers/questions, not silent overwrite
+Steering is a typed input to a running or replacement attempt.
+Record who sent it, why, which evidence motivated it, whether delivery succeeded, and which attempt consumed it.
 
-Proof command (real sandbox, real observe→steer join):
+Questions are explicit events.
+Route them to the responsible parent or user, preserve unanswered blockers, and fail closed when a required answer is unavailable.
+Do not bury a permission request in free-form worker output.
 
-```bash
-TANGLE_API_KEY=... pnpm exec tsx bench/src/cloud-loop.mts
-```
+## Parallel And Recursive Work
+
+Give parallel workers isolated state unless shared mutation is the point of the task.
+For repository changes, use one worktree per worker and explicit merge outcomes.
+For external writes, use idempotency keys and product-owned transactions.
+
+Recursive supervisors use the same budget, cancellation, trace, question, and completion contracts at every depth.
+Do not grant a child more authority than its parent.
+
+## Tests
+
+Cover:
+
+- success on the first and later rounds;
+- invalid output followed by a corrected attempt;
+- every budget limit;
+- abort propagation to in-flight work;
+- service and check failures remaining distinct from agent failure;
+- unresolved blocking questions;
+- interrupted run recovery without duplicate side effects;
+- deterministic replay of decisions from saved outcomes where supported.
+
+## Completion
+
+The change is complete when the public entrypoint is smaller than the policy it replaces, all states above are observable, a real task exercises the custom behavior, and package typecheck, tests, build, docs, and package verification pass.
+
+## Then consider
 
-It proves `openSandboxRun -> observe -> steer -> corrective worker` over a live
-sandbox. The old `observe-steer-workspace-loop.mts` used mock executors and is
-deleted — the live proof is the only valid one.
-
-## Final Check
-
-- Does every meaningful product land in result blobs, journals, commits,
-  conversation journals, or trace events?
-- Are verifier, judge, analyst, and driver roles separated?
-- Can blocking questions move up the chain?
-- Can Pi/parent steer without bypassing verification?
-- Is workspace mutation transactional if workers edit shared code?
-- Can existing trace/journal views isolate agents, pairs, subtrees, and the full
-  run?
-- Is the loop small enough that an agent can author it without inventing hidden
-  runtime behavior?
+- `critical-audit` when the loop changes a public contract or authority boundary.
+- `eval-engineering` when the loop's stopping condition needs a new evaluation case.
+- `verify` before publishing the package.

package/skills/supervise/SKILL.md

@@ -1,24 +1,43 @@
 ---
 name: supervise
-description: Decompose a task into sub-tasks, author a worker AgentProfile for each, drive and verify the workers, and settle only when a deployable check passes. Carrying this skill is what makes an agent a supervisor.
+description: Drive worker agents with explicit profiles, corrections, budgets, and checked delivery.
 ---
 
 # Supervise
 
-You are a supervisor. You do NOT do the work yourself — you design and drive specialist worker agents.
+Use this policy only when the running agent has the coordination tools, including `spawn_agent` and `await_event`.
+The supervisor plans and checks work; workers produce the artifacts.
 
-## Loop
+## Run The Work
 
-1. **Decompose** the task into the smallest set of sub-tasks a single focused worker can each deliver.
-2. **Author** a worker per sub-task by calling `spawn_agent` with a complete `profile`:
-   - `name` — a short id.
-   - `skills` — the skill files the worker should carry (by name), OR `systemPrompt` — rich, specific instructions for this sub-task.
-   - `model` — the model best suited to this sub-task (optional).
-   Write the instructions a power user would write — never a one-liner. **Never spawn a worker with an empty profile.** The quality of the worker is the quality of the profile you author.
-3. **Await** each worker with `await_event`. Its result reports `valid: true` only if the worker's deployable check passed.
-4. **On failure**, author a *new* worker whose profile names the specific failure and how to fix it — never blindly retry the same profile.
-5. **Stop** (reply with no tool call) once the work is delivered. Only a delivered (`valid: true`) worker counts; you cannot declare done yourself.
+1. Split the job into independent deliverables with observable completion checks.
+2. Call `spawn_agent` with a focused task and a complete worker profile.
+3. Assign each worker only the tools, context, authority, and budget it needs.
+4. Use `await_event` to collect questions, findings, progress, and settlements.
+5. Answer blocking questions or steer the responsible worker with specific evidence.
+6. When work fails, change the task, profile, evidence, or approach before spawning a replacement.
+7. Accept only a settlement whose declared check passed and whose artifact can be inspected.
+8. Stop when every required deliverable is accepted or a named limit or blocker is reached.
 
-## Authoring sub-supervisors
+A worker profile names its role, task, relevant skills or system instructions, model constraints, tools, budget, expected artifact, and completion check.
+Do not spawn empty profiles or blind retries.
 
-If a sub-task is itself too large for one worker, author it as a **sub-supervisor**: give its profile a `skills` list that includes `supervise`. It will decompose and drive its own workers one level deeper. This is not a special call — it is the same `spawn_agent`, just a profile that carries this skill.
+## Parallel And Recursive Work
+
+Run independent workers concurrently when their state and side effects are isolated.
+Use one worktree per repository-writing worker.
+Give external writes stable idempotency keys.
+
+A worker may itself supervise only when its profile includes this policy and the runtime grants coordination tools.
+Child workers inherit stricter authority and budget limits than their parent.
+
+## Completion
+
+Report worker IDs, assignments, accepted artifacts, failed or cancelled work, spend, unresolved questions, and the exact checks run.
+The supervisor cannot turn an unchecked worker claim into completion.
+
+## Then consider
+
+- `build-with-agent-runtime` when this policy should become a reusable product integration.
+- `eval-engineering` when worker acceptance needs a new executable case.
+- `verify` after the accepted artifacts are assembled.

package/dist/chunk-377GOJHJ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/candidate-execution/exact-process-executor.ts"],"sourcesContent":["import { posix } from 'node:path'\nimport { isDeepStrictEqual } from 'node:util'\n\nimport type { TraceStore } from '@tangle-network/agent-eval'\nimport type { AgentCandidateTermination, Sha256Digest } from '@tangle-network/agent-interface'\nimport type {\n  AgentEnvironmentCapabilities,\n  AgentEnvironmentProvider,\n  AgentExactProcess,\n  AgentExactProcessEnvironment,\n  AgentExactProcessLaunch,\n  AgentExactProcessResources,\n  AgentExactProcessStatus,\n} from '@tangle-network/agent-interface/environment-provider'\n\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  immutableCandidateValue,\n  sha256Bytes,\n} from './digest'\nimport {\n  CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV,\n  CANDIDATE_KNOWLEDGE_ROOT_ENV,\n  candidateKnowledgeExecutionPaths,\n} from './knowledge'\nimport type {\n  AgentCandidateExecutorPort,\n  AgentCandidateExecutorRequest,\n  AgentCandidateExecutorStopRequest,\n} from './types'\n\nconst DEFAULT_PROVISION_TIMEOUT_MS = 120_000\nconst DEFAULT_RECOVERY_RETENTION_MS = 15 * 60_000\n\ninterface ExactProcessRunState {\n  environment: AgentExactProcessEnvironment\n  output?: Uint8Array\n  termination?: AgentCandidateTermination\n  runtimeTermination?: AgentCandidateTermination\n  trace?: {\n    runId: string\n    scenarioId: string\n    startedAt: number\n    deadlineAtMs: number\n    timeoutMs: number\n    tags: Record<string, string>\n    written: boolean\n  }\n}\n\nexport interface ExactProcessCandidateExecutorOptions {\n  provider: AgentEnvironmentProvider\n  resources: AgentExactProcessResources\n  provisionTimeoutMs?: number\n  recoveryRetentionMs?: number\n  providerOptions?: Record<string, unknown>\n}\n\n/** Adapt one neutral exact-process provider to Runtime's trusted candidate boundary. */\nexport function exactProcessProviderAsCandidateExecutor(\n  options: ExactProcessCandidateExecutorOptions,\n): AgentCandidateExecutorPort {\n  return new ExactProcessAgentCandidateExecutor(options)\n}\n\nclass ExactProcessAgentCandidateExecutor implements AgentCandidateExecutorPort {\n  private readonly states = new Map<string, ExactProcessRunState>()\n  private readonly exactProcess\n  private readonly resources: AgentExactProcessResources\n  private readonly provisionTimeoutMs: number\n  private readonly recoveryRetentionMs: number\n  private readonly providerOptions?: Record<string, unknown>\n  private capabilitiesPromise?: Promise<AgentEnvironmentCapabilities>\n\n  constructor(private readonly options: ExactProcessCandidateExecutorOptions) {\n    if (!options.provider.exactProcess) {\n      throw new Error(\n        `agent environment provider \"${options.provider.name}\" does not implement exact processes`,\n      )\n    }\n    this.exactProcess = options.provider.exactProcess\n    this.resources = exactResources(options.resources)\n    this.provisionTimeoutMs = positiveInteger(\n      options.provisionTimeoutMs ?? DEFAULT_PROVISION_TIMEOUT_MS,\n      'exact process provision timeout',\n    )\n    this.recoveryRetentionMs = positiveInteger(\n      options.recoveryRetentionMs ?? DEFAULT_RECOVERY_RETENTION_MS,\n      'exact process recovery retention',\n    )\n    this.providerOptions = options.providerOptions\n      ? immutableCandidateValue(options.providerOptions)\n      : undefined\n  }\n\n  async execute(\n    request: AgentCandidateExecutorRequest,\n    context: Parameters<AgentCandidateExecutorPort['execute']>[1],\n  ) {\n    assertSupportedRequest(request)\n    const outcome = request.benchmark.task.outcome\n    if (outcome.kind !== 'output') throw new Error('exact process executor requires an output task')\n    const network = request.executionPlan.value.material.model.access.network\n    const egress =\n      network.mode === 'disabled'\n        ? ({ mode: 'blocked' } as const)\n        : ({ mode: 'strict', allowDomains: [...network.domains] } as const)\n    await this.assertCapability(egress.mode)\n    context.signal.throwIfAborted()\n\n    const key = executionKey(request.executionId, request.executionPlan.value.digest)\n    if (this.states.has(key)) throw new Error('candidate execution environment is already active')\n    const image = exactImage(\n      request.executionPlan.value.material.container.image,\n      request.executionPlan.value.material.container.manifestDigest,\n    )\n    const maxLifetimeMs = environmentLifetimeMs(\n      request.hardLimits.timeoutMs,\n      this.recoveryRetentionMs,\n    )\n    const createMaterial = immutableCandidateValue({\n      kind: 'agent-candidate-exact-process-create',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlan.value.digest,\n      image,\n      egress,\n      maxLifetimeMs,\n      provisionTimeoutMs: this.provisionTimeoutMs,\n      resources: this.resources,\n      output: { mediaType: outcome.mediaType, maxBytes: outcome.maxBytes },\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    const createInputDigest = canonicalCandidateDigest(createMaterial)\n    const metadata = immutableCandidateValue({\n      kind: 'agent-candidate-execution',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlan.value.digest,\n      createInputDigest,\n      outputMediaType: outcome.mediaType,\n      outputMaxBytes: outcome.maxBytes,\n    })\n    const environment = await this.exactProcess.create({\n      image,\n      egress,\n      maxLifetimeMs,\n      provisionTimeoutMs: this.provisionTimeoutMs,\n      resources: this.resources,\n      metadata,\n      idempotencyKey: executionIdempotencyKey(\n        request.executionId,\n        request.executionPlan.value.digest,\n      ),\n      signal: context.signal,\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    try {\n      assertExecutionEnvironment(environment, metadata, this.options.provider.name)\n    } catch (error) {\n      try {\n        await environment.destroy()\n      } catch (cleanupError) {\n        throw new AggregateError(\n          [error, cleanupError],\n          'exact process validation and cleanup both failed',\n        )\n      }\n      throw error\n    }\n    const state: ExactProcessRunState = { environment }\n    this.states.set(key, state)\n\n    const existing = await environment.process.list()\n    if (existing.length !== 0) {\n      throw new Error('fresh candidate environment already contains a process')\n    }\n    await materializeRequest(environment, request, context.signal)\n    const launch = exactLaunch(request)\n    const startedAt = Date.now()\n    state.trace = {\n      runId: request.trace.runId,\n      scenarioId: request.benchmark.task.scenario.id,\n      startedAt,\n      deadlineAtMs: context.deadlineAtMs,\n      timeoutMs: request.hardLimits.timeoutMs,\n      tags: {\n        ...request.trace.tags,\n        environmentId: environment.id,\n        environmentProvider: environment.provider,\n      },\n      written: false,\n    }\n    const process = await environment.process.spawn(launch, { signal: context.signal })\n    const outputPromise = collectOutput(process, outcome.maxBytes)\n    void outputPromise.catch(() => undefined)\n    let cancellation: Promise<void> | undefined\n    let processExited = false\n    const cancel = () => {\n      if (!processExited) cancellation ??= stopProcess(process)\n    }\n    context.signal.addEventListener('abort', cancel, { once: true })\n    if (context.signal.aborted) cancel()\n    try {\n      const termination = await process.wait()\n      processExited = true\n      context.signal.removeEventListener('abort', cancel)\n      if (cancellation) await cancellation\n      const status = await process.status()\n      assertTerminalStatus(status, termination)\n      state.output = await awaitOutput(outputPromise, context.signal, context.deadlineAtMs)\n      state.termination = termination\n      await appendExactProcessTrace(state, context.traceStore, status)\n      return { executionId: request.executionId, termination }\n    } finally {\n      context.signal.removeEventListener('abort', cancel)\n    }\n  }\n\n  async stop(\n    request: AgentCandidateExecutorStopRequest,\n    context: Parameters<AgentCandidateExecutorPort['stop']>[1],\n  ): Promise<{ readonly stopped: true }> {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, true)\n    if (!environment) return { stopped: true }\n    let statuses = await environment.process.list()\n    if (statuses.length > 1) {\n      throw new Error('candidate exact process environment contains more than one process')\n    }\n    const status = statuses[0]\n    if (status?.running) {\n      const process = await environment.process.get(status.pid)\n      if (!process) throw new Error('candidate environment lost its running process handle')\n      await stopProcess(process)\n    }\n    context.signal.throwIfAborted()\n    statuses = await environment.process.list()\n    if (statuses.some((entry) => entry.running)) {\n      throw new Error('candidate exact process termination is not proven')\n    }\n    const finalStatus = statuses[0]\n    if (finalStatus) assertTerminalStatus(finalStatus)\n    const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest))\n    if (state) {\n      state.termination = finalStatus?.termination ?? state.termination\n      if (context.reason === 'timeout' && state.trace) {\n        state.runtimeTermination = {\n          kind: 'timeout',\n          timeoutMs: state.trace.timeoutMs,\n        }\n      }\n      await appendExactProcessTrace(state, context.traceStore, finalStatus)\n    }\n    return { stopped: true }\n  }\n\n  async capture(\n    request: AgentCandidateExecutorStopRequest,\n    context: Parameters<AgentCandidateExecutorPort['capture']>[1],\n  ) {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, false)\n    const statuses = await environment.process.list()\n    const status = statuses[0]\n    if (statuses.length !== 1 || !status || status.running) {\n      throw new Error('candidate environment must contain one stopped process before capture')\n    }\n    assertTerminalStatus(status)\n    const process = await environment.process.get(status.pid)\n    if (!process) throw new Error('candidate environment lost its captured process handle')\n    const currentStatus = await process.status()\n    assertTerminalStatus(currentStatus, status.termination)\n    const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest))\n    const output =\n      state?.output ??\n      (await awaitOutput(\n        collectOutput(process, outputSpec(environment).maxBytes),\n        context.signal,\n        Date.now() + this.provisionTimeoutMs,\n      ))\n    context.signal.throwIfAborted()\n    const evidence = canonicalCandidateBytes({\n      kind: 'agent-candidate-exact-process-capture',\n      provider: environment.provider,\n      environmentId: environment.id,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlanDigest,\n      createInputDigest: environment.metadata?.createInputDigest,\n      process: {\n        pid: status.pid,\n        exitCode: status.exitCode,\n        ...(status.exitSignal ? { exitSignal: status.exitSignal } : {}),\n        termination: status.termination,\n      },\n      ...(state?.runtimeTermination ? { runtimeTermination: state.runtimeTermination } : {}),\n      output: { sha256: sha256Bytes(output), byteLength: output.byteLength },\n    })\n    return {\n      taskOutcome: { kind: 'output' as const, bytes: output },\n      evidence,\n    }\n  }\n\n  async dispose(\n    request: AgentCandidateExecutorStopRequest,\n    context: { signal: AbortSignal },\n  ): Promise<{ readonly disposed: true }> {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, true)\n    if (!environment) return { disposed: true }\n    let destroyError: unknown\n    try {\n      await environment.destroy()\n    } catch (error) {\n      destroyError = error\n    }\n    const remaining = await this.exactProcess.get(environment.id)\n    if (remaining) {\n      throw new Error('exact process environment disposal is not proven', { cause: destroyError })\n    }\n    context.signal.throwIfAborted()\n    this.states.delete(executionKey(request.executionId, request.executionPlanDigest))\n    return { disposed: true }\n  }\n\n  private async assertCapability(mode?: 'blocked' | 'strict'): Promise<void> {\n    const pending =\n      this.capabilitiesPromise ?? Promise.resolve(this.options.provider.capabilities())\n    this.capabilitiesPromise = pending\n    let capabilities: AgentEnvironmentCapabilities\n    try {\n      capabilities = await pending\n    } catch (error) {\n      if (this.capabilitiesPromise === pending) this.capabilitiesPromise = undefined\n      throw error\n    }\n    const exact = capabilities.exactProcess\n    if (!exact) {\n      throw new Error(\n        `agent environment provider \"${this.options.provider.name}\" does not declare exact process support`,\n      )\n    }\n    if (mode && !exact.egress.includes(mode)) {\n      throw new Error(\n        `agent environment provider \"${this.options.provider.name}\" does not declare ${mode} exact egress`,\n      )\n    }\n  }\n\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: false,\n  ): Promise<AgentExactProcessEnvironment>\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: true,\n  ): Promise<AgentExactProcessEnvironment | undefined>\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: boolean,\n  ): Promise<AgentExactProcessEnvironment | undefined> {\n    const key = executionKey(request.executionId, request.executionPlanDigest)\n    const active = this.states.get(key)?.environment\n    if (active) return active\n    const metadata = {\n      kind: 'agent-candidate-execution',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlanDigest,\n    }\n    const listed = await this.exactProcess.list({\n      metadata,\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    const matches = listed.filter(\n      (environment) =>\n        environment.provider === this.options.provider.name &&\n        Object.entries(metadata).every(([name, value]) =>\n          isDeepStrictEqual(environment.metadata?.[name], value),\n        ),\n    )\n    if (matches.length > 1) {\n      throw new Error('multiple exact process environments match one candidate execution')\n    }\n    const environment = matches[0]\n    if (!environment) {\n      if (missingIsDeleted) return undefined\n      throw new Error('candidate exact process evidence is unavailable')\n    }\n    if (!isSha256Digest(environment.metadata?.createInputDigest)) {\n      throw new Error('candidate exact process create-input digest is unavailable')\n    }\n    this.states.set(key, { environment })\n    return environment\n  }\n}\n\nasync function appendExactProcessTrace(\n  state: ExactProcessRunState,\n  traceStore: TraceStore,\n  status?: AgentExactProcessStatus,\n): Promise<void> {\n  const trace = state.trace\n  if (!trace || trace.written) return\n  const endedAt = Math.max(trace.startedAt, Math.min(Date.now(), trace.deadlineAtMs))\n  const termination = state.runtimeTermination ?? state.termination ?? status?.termination\n  await traceStore.appendRun({\n    runId: trace.runId,\n    scenarioId: trace.scenarioId,\n    startedAt: trace.startedAt,\n    endedAt,\n    status: termination?.kind === 'exit' && termination.exitCode === 0 ? 'completed' : 'failed',\n    tags: trace.tags,\n  })\n  trace.written = true\n}\n\nfunction assertSupportedRequest(request: AgentCandidateExecutorRequest): void {\n  if (request.benchmark.task.outcome.kind !== 'output') {\n    throw new Error(\n      'exact process candidate executor does not support workspace outcomes; use Pier',\n    )\n  }\n  if (request.executionPlan.value.material.codeKind !== 'disabled' || request.inputs.candidate) {\n    throw new Error('exact process candidate executor does not support code workspaces; use Pier')\n  }\n  if (request.memory.mode !== 'disabled') {\n    throw new Error('exact process candidate executor does not support isolated memory')\n  }\n  const mediaType = request.benchmark.task.outcome.mediaType.toLowerCase()\n  if (\n    !(\n      mediaType.startsWith('text/') ||\n      mediaType === 'application/json' ||\n      mediaType.endsWith('+json')\n    )\n  ) {\n    throw new Error('exact process candidate executor supports only UTF-8 text and JSON outputs')\n  }\n  if (!posix.isAbsolute(request.launch.executable) && !request.launch.env.PATH?.trim()) {\n    throw new Error('exact process candidate executable must be absolute or declare a signed PATH')\n  }\n}\n\nasync function materializeRequest(\n  environment: AgentExactProcessEnvironment,\n  request: AgentCandidateExecutorRequest,\n  signal: AbortSignal,\n): Promise<void> {\n  const knowledgePaths = assertKnowledgeExecutionBinding(request)\n  for (const file of request.inputs.task.files) {\n    await environment.writeFile(beneath(request.roots.taskRoot, file.path), file.bytes, {\n      mode: file.mode,\n      signal,\n    })\n  }\n  const profileRoot =\n    request.executionPlan.value.material.profile.targetWorkspace === 'task'\n      ? request.roots.taskRoot\n      : request.roots.candidateRoot\n  if (!profileRoot) throw new Error('candidate profile targets a missing workspace')\n  for (const file of request.profileActivation.files) {\n    await environment.writeFile(\n      beneath(profileRoot, file.path),\n      Buffer.from(file.content, 'utf8'),\n      { mode: file.mode, signal },\n    )\n  }\n  if (request.knowledge && knowledgePaths) {\n    for (const file of request.knowledge.files) {\n      await environment.writeFile(beneath(knowledgePaths.root, file.path), file.bytes, {\n        mode: file.mode,\n        signal,\n      })\n    }\n    if (request.knowledge.retrievalConfig && knowledgePaths.retrievalConfig) {\n      await environment.writeFile(\n        knowledgePaths.retrievalConfig,\n        request.knowledge.retrievalConfig,\n        { mode: 0o644, signal },\n      )\n    }\n  }\n  if (request.instruction.delivery.kind === 'utf8-file') {\n    await environment.writeFile(request.instruction.delivery.path, request.instruction.bytes, {\n      mode: 0o644,\n      signal,\n    })\n  }\n}\n\nfunction assertKnowledgeExecutionBinding(\n  request: AgentCandidateExecutorRequest,\n): ReturnType<typeof candidateKnowledgeExecutionPaths> | undefined {\n  const knowledge = request.knowledge\n  if (!knowledge) {\n    if (\n      request.launch.env[CANDIDATE_KNOWLEDGE_ROOT_ENV] !== undefined ||\n      request.launch.env[CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV] !== undefined\n    ) {\n      throw new Error('candidate launch declares knowledge paths without verified knowledge')\n    }\n    return undefined\n  }\n  const paths = candidateKnowledgeExecutionPaths(\n    request.roots.taskRoot,\n    knowledge.retrievalConfig !== undefined,\n  )\n  if (\n    request.launch.env[CANDIDATE_KNOWLEDGE_ROOT_ENV] !== paths.root ||\n    request.launch.env[CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV] !== paths.retrievalConfig\n  ) {\n    throw new Error('candidate knowledge paths do not match the signed launch environment')\n  }\n  const reserved = [paths.root, paths.retrievalConfig].filter(\n    (value): value is string => value !== undefined,\n  )\n  const profileRoot =\n    request.executionPlan.value.material.profile.targetWorkspace === 'task'\n      ? request.roots.taskRoot\n      : request.roots.candidateRoot\n  const otherFiles = [\n    ...request.inputs.task.files.map((file) => beneath(request.roots.taskRoot, file.path)),\n    ...(profileRoot\n      ? request.profileActivation.files.map((file) => beneath(profileRoot, file.path))\n      : []),\n    ...(request.instruction.delivery.kind === 'utf8-file'\n      ? [request.instruction.delivery.path]\n      : []),\n  ]\n  if (\n    otherFiles.some((path) =>\n      reserved.some(\n        (reservedPath) =>\n          path === reservedPath ||\n          path.startsWith(`${reservedPath}/`) ||\n          reservedPath.startsWith(`${path}/`),\n      ),\n    )\n  ) {\n    throw new Error('candidate knowledge paths overlap other execution inputs')\n  }\n  return paths\n}\n\nfunction exactLaunch(request: AgentCandidateExecutorRequest): AgentExactProcessLaunch {\n  const instruction = new TextDecoder('utf-8', { fatal: true }).decode(request.instruction.bytes)\n  const base = {\n    executable: request.launch.executable,\n    args: request.launch.args,\n    cwd: request.launch.cwd,\n    env: request.launch.env,\n    timeoutMs: 0,\n  }\n  switch (request.instruction.delivery.kind) {\n    case 'argv-append':\n      return { ...base, args: [...base.args, instruction] }\n    case 'stdin-utf8':\n      return { ...base, stdin: instruction }\n    case 'utf8-file':\n      return base\n  }\n}\n\nasync function collectOutput(process: AgentExactProcess, maxBytes: number): Promise<Uint8Array> {\n  const chunks: Buffer[] = []\n  let byteLength = 0\n  for await (const chunk of process.stdout()) {\n    const bytes = Buffer.from(chunk, 'utf8')\n    byteLength += bytes.byteLength\n    if (byteLength > maxBytes) {\n      let stopError: unknown\n      try {\n        await stopProcess(process)\n      } catch (error) {\n        stopError = error\n      }\n      throw new Error(`candidate output exceeds its ${maxBytes}-byte maximum`, {\n        cause: stopError,\n      })\n    }\n    chunks.push(bytes)\n  }\n  return Uint8Array.from(Buffer.concat(chunks, byteLength))\n}\n\nasync function awaitOutput(\n  output: Promise<Uint8Array>,\n  signal: AbortSignal,\n  deadlineAtMs: number,\n): Promise<Uint8Array> {\n  signal.throwIfAborted()\n  const remainingMs = deadlineAtMs - Date.now()\n  if (remainingMs <= 0) throw new Error('candidate output deadline expired')\n  let timer: ReturnType<typeof setTimeout> | undefined\n  let onAbort: (() => void) | undefined\n  try {\n    return await Promise.race([\n      output,\n      new Promise<never>((_resolve, reject) => {\n        onAbort = () => reject(signal.reason ?? new Error('candidate output cancelled'))\n        signal.addEventListener('abort', onAbort, { once: true })\n        timer = setTimeout(\n          () => reject(new Error('candidate output deadline expired')),\n          remainingMs,\n        )\n      }),\n    ])\n  } finally {\n    if (onAbort) signal.removeEventListener('abort', onAbort)\n    if (timer) clearTimeout(timer)\n  }\n}\n\nasync function stopProcess(process: AgentExactProcess): Promise<void> {\n  const before = await process.status()\n  if (!before.running) return\n  try {\n    await process.kill()\n  } catch (error) {\n    if ((await process.status()).running) throw error\n  }\n  const termination = await process.wait()\n  assertTerminalStatus(await process.status(), termination)\n}\n\nfunction assertTerminalStatus(\n  status: AgentExactProcessStatus,\n  expected?: AgentCandidateTermination,\n): asserts status is AgentExactProcessStatus & { termination: AgentCandidateTermination } {\n  if (status.running || !status.termination) {\n    throw new Error('exact process returned no terminal reason after exit')\n  }\n  if (expected && !isDeepStrictEqual(status.termination, expected)) {\n    throw new Error('exact process wait and status returned different terminal reasons')\n  }\n}\n\nfunction assertExecutionEnvironment(\n  environment: AgentExactProcessEnvironment,\n  metadata: Record<string, unknown>,\n  providerName: string,\n): void {\n  if (!environment.id || environment.provider !== providerName) {\n    throw new Error('exact process provider returned the wrong environment identity')\n  }\n  if (\n    !Object.entries(metadata).every(([name, value]) =>\n      isDeepStrictEqual(environment.metadata?.[name], value),\n    )\n  ) {\n    throw new Error('exact process provider did not persist candidate execution metadata')\n  }\n}\n\nfunction outputSpec(environment: AgentExactProcessEnvironment): { maxBytes: number } {\n  const maxBytes = environment.metadata?.outputMaxBytes\n  if (!Number.isSafeInteger(maxBytes) || Number(maxBytes) < 1) {\n    throw new Error('candidate exact process output bound is unavailable')\n  }\n  return { maxBytes: Number(maxBytes) }\n}\n\nfunction executionKey(executionId: string, executionPlanDigest: Sha256Digest): string {\n  return `${executionId}\\0${executionPlanDigest}`\n}\n\nfunction executionIdempotencyKey(executionId: string, executionPlanDigest: Sha256Digest): string {\n  return `candidate-${canonicalCandidateDigest({\n    kind: 'agent-candidate-execution-identity',\n    executionId,\n    executionPlanDigest,\n  }).slice('sha256:'.length)}`\n}\n\nfunction exactImage(image: string, manifestDigest: Sha256Digest): string {\n  if (isSha256Digest(image)) {\n    if (image !== manifestDigest) {\n      throw new Error('candidate container image conflicts with its resolved manifest')\n    }\n    return image\n  }\n  const marker = image.lastIndexOf('@')\n  if (marker < 0) return `${image}@${manifestDigest}`\n  if (image.slice(marker + 1) !== manifestDigest) {\n    throw new Error('candidate container image conflicts with its resolved manifest')\n  }\n  return image\n}\n\nfunction environmentLifetimeMs(timeoutMs: number, retentionMs: number): number {\n  const total = positiveInteger(timeoutMs, 'candidate execution timeout') + retentionMs\n  if (!Number.isSafeInteger(total)) throw new Error('candidate environment lifetime is too large')\n  return Math.ceil(total / 1_000) * 1_000\n}\n\nfunction exactResources(resources: AgentExactProcessResources): AgentExactProcessResources {\n  if (!Number.isFinite(resources.cpu) || resources.cpu <= 0) {\n    throw new Error('exact process CPU must be positive and finite')\n  }\n  return Object.freeze({\n    cpu: resources.cpu,\n    memoryMb: positiveInteger(resources.memoryMb, 'exact process memory'),\n    diskMb: positiveInteger(resources.diskMb, 'exact process disk'),\n  })\n}\n\nfunction positiveInteger(value: number, label: string): number {\n  if (!Number.isSafeInteger(value) || value < 1)\n    throw new Error(`${label} must be a positive integer`)\n  return value\n}\n\nfunction beneath(root: string, relativePath: string): string {\n  if (posix.isAbsolute(relativePath)) throw new Error('candidate input path must be relative')\n  const path = posix.normalize(relativePath)\n  if (path === '..' || path.startsWith('../')) {\n    throw new Error('candidate input path escapes its execution root')\n  }\n  return posix.join(root, path)\n}\n\nfunction isSha256Digest(value: unknown): value is Sha256Digest {\n  return typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value)\n}\n"],"mappings":";;;;;;;;;;;AAAA,SAAS,aAAa;AACtB,SAAS,yBAAyB;AA+BlC,IAAM,+BAA+B;AACrC,IAAM,gCAAgC,KAAK;AA2BpC,SAAS,wCACd,SAC4B;AAC5B,SAAO,IAAI,mCAAmC,OAAO;AACvD;AAEA,IAAM,qCAAN,MAA+E;AAAA,EAS7E,YAA6B,SAA+C;AAA/C;AAC3B,QAAI,CAAC,QAAQ,SAAS,cAAc;AAClC,YAAM,IAAI;AAAA,QACR,+BAA+B,QAAQ,SAAS,IAAI;AAAA,MACtD;AAAA,IACF;AACA,SAAK,eAAe,QAAQ,SAAS;AACrC,SAAK,YAAY,eAAe,QAAQ,SAAS;AACjD,SAAK,qBAAqB;AAAA,MACxB,QAAQ,sBAAsB;AAAA,MAC9B;AAAA,IACF;AACA,SAAK,sBAAsB;AAAA,MACzB,QAAQ,uBAAuB;AAAA,MAC/B;AAAA,IACF;AACA,SAAK,kBAAkB,QAAQ,kBAC3B,wBAAwB,QAAQ,eAAe,IAC/C;AAAA,EACN;AAAA,EAnB6B;AAAA,EARZ,SAAS,oBAAI,IAAkC;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAuBR,MAAM,QACJ,SACA,SACA;AACA,2BAAuB,OAAO;AAC9B,UAAM,UAAU,QAAQ,UAAU,KAAK;AACvC,QAAI,QAAQ,SAAS,SAAU,OAAM,IAAI,MAAM,gDAAgD;AAC/F,UAAM,UAAU,QAAQ,cAAc,MAAM,SAAS,MAAM,OAAO;AAClE,UAAM,SACJ,QAAQ,SAAS,aACZ,EAAE,MAAM,UAAU,IAClB,EAAE,MAAM,UAAU,cAAc,CAAC,GAAG,QAAQ,OAAO,EAAE;AAC5D,UAAM,KAAK,iBAAiB,OAAO,IAAI;AACvC,YAAQ,OAAO,eAAe;AAE9B,UAAM,MAAM,aAAa,QAAQ,aAAa,QAAQ,cAAc,MAAM,MAAM;AAChF,QAAI,KAAK,OAAO,IAAI,GAAG,EAAG,OAAM,IAAI,MAAM,mDAAmD;AAC7F,UAAM,QAAQ;AAAA,MACZ,QAAQ,cAAc,MAAM,SAAS,UAAU;AAAA,MAC/C,QAAQ,cAAc,MAAM,SAAS,UAAU;AAAA,IACjD;AACA,UAAM,gBAAgB;AAAA,MACpB,QAAQ,WAAW;AAAA,MACnB,KAAK;AAAA,IACP;AACA,UAAM,iBAAiB,wBAAwB;AAAA,MAC7C,MAAM;AAAA,MACN,UAAU,KAAK,QAAQ,SAAS;AAAA,MAChC,aAAa,QAAQ;AAAA,MACrB,qBAAqB,QAAQ,cAAc,MAAM;AAAA,MACjD;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB,KAAK;AAAA,MACzB,WAAW,KAAK;AAAA,MAChB,QAAQ,EAAE,WAAW,QAAQ,WAAW,UAAU,QAAQ,SAAS;AAAA,MACnE,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;AAAA,IAC1E,CAAC;AACD,UAAM,oBAAoB,yBAAyB,cAAc;AACjE,UAAM,WAAW,wBAAwB;AAAA,MACvC,MAAM;AAAA,MACN,UAAU,KAAK,QAAQ,SAAS;AAAA,MAChC,aAAa,QAAQ;AAAA,MACrB,qBAAqB,QAAQ,cAAc,MAAM;AAAA,MACjD;AAAA,MACA,iBAAiB,QAAQ;AAAA,MACzB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,UAAM,cAAc,MAAM,KAAK,aAAa,OAAO;AAAA,MACjD;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB,KAAK;AAAA,MACzB,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,gBAAgB;AAAA,QACd,QAAQ;AAAA,QACR,QAAQ,cAAc,MAAM;AAAA,MAC9B;AAAA,MACA,QAAQ,QAAQ;AAAA,MAChB,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;AAAA,IAC1E,CAAC;AACD,QAAI;AACF,iCAA2B,aAAa,UAAU,KAAK,QAAQ,SAAS,IAAI;AAAA,IAC9E,SAAS,OAAO;AACd,UAAI;AACF,cAAM,YAAY,QAAQ;AAAA,MAC5B,SAAS,cAAc;AACrB,cAAM,IAAI;AAAA,UACR,CAAC,OAAO,YAAY;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AACA,UAAM,QAA8B,EAAE,YAAY;AAClD,SAAK,OAAO,IAAI,KAAK,KAAK;AAE1B,UAAM,WAAW,MAAM,YAAY,QAAQ,KAAK;AAChD,QAAI,SAAS,WAAW,GAAG;AACzB,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AACA,UAAM,mBAAmB,aAAa,SAAS,QAAQ,MAAM;AAC7D,UAAM,SAAS,YAAY,OAAO;AAClC,UAAM,YAAY,KAAK,IAAI;AAC3B,UAAM,QAAQ;AAAA,MACZ,OAAO,QAAQ,MAAM;AAAA,MACrB,YAAY,QAAQ,UAAU,KAAK,SAAS;AAAA,MAC5C;AAAA,MACA,cAAc,QAAQ;AAAA,MACtB,WAAW,QAAQ,WAAW;AAAA,MAC9B,MAAM;AAAA,QACJ,GAAG,QAAQ,MAAM;AAAA,QACjB,eAAe,YAAY;AAAA,QAC3B,qBAAqB,YAAY;AAAA,MACnC;AAAA,MACA,SAAS;AAAA,IACX;AACA,UAAM,UAAU,MAAM,YAAY,QAAQ,MAAM,QAAQ,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAClF,UAAM,gBAAgB,cAAc,SAAS,QAAQ,QAAQ;AAC7D,SAAK,cAAc,MAAM,MAAM,MAAS;AACxC,QAAI;AACJ,QAAI,gBAAgB;AACpB,UAAM,SAAS,MAAM;AACnB,UAAI,CAAC,cAAe,kBAAiB,YAAY,OAAO;AAAA,IAC1D;AACA,YAAQ,OAAO,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/D,QAAI,QAAQ,OAAO,QAAS,QAAO;AACnC,QAAI;AACF,YAAM,cAAc,MAAM,QAAQ,KAAK;AACvC,sBAAgB;AAChB,cAAQ,OAAO,oBAAoB,SAAS,MAAM;AAClD,UAAI,aAAc,OAAM;AACxB,YAAM,SAAS,MAAM,QAAQ,OAAO;AACpC,2BAAqB,QAAQ,WAAW;AACxC,YAAM,SAAS,MAAM,YAAY,eAAe,QAAQ,QAAQ,QAAQ,YAAY;AACpF,YAAM,cAAc;AACpB,YAAM,wBAAwB,OAAO,QAAQ,YAAY,MAAM;AAC/D,aAAO,EAAE,aAAa,QAAQ,aAAa,YAAY;AAAA,IACzD,UAAE;AACA,cAAQ,OAAO,oBAAoB,SAAS,MAAM;AAAA,IACpD;AAAA,EACF;AAAA,EAEA,MAAM,KACJ,SACA,SACqC;AACrC,UAAM,KAAK,iBAAiB;AAC5B,YAAQ,OAAO,eAAe;AAC9B,UAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,IAAI;AACpD,QAAI,CAAC,YAAa,QAAO,EAAE,SAAS,KAAK;AACzC,QAAI,WAAW,MAAM,YAAY,QAAQ,KAAK;AAC9C,QAAI,SAAS,SAAS,GAAG;AACvB,YAAM,IAAI,MAAM,oEAAoE;AAAA,IACtF;AACA,UAAM,SAAS,SAAS,CAAC;AACzB,QAAI,QAAQ,SAAS;AACnB,YAAM,UAAU,MAAM,YAAY,QAAQ,IAAI,OAAO,GAAG;AACxD,UAAI,CAAC,QAAS,OAAM,IAAI,MAAM,uDAAuD;AACrF,YAAM,YAAY,OAAO;AAAA,IAC3B;AACA,YAAQ,OAAO,eAAe;AAC9B,eAAW,MAAM,YAAY,QAAQ,KAAK;AAC1C,QAAI,SAAS,KAAK,CAAC,UAAU,MAAM,OAAO,GAAG;AAC3C,YAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AACA,UAAM,cAAc,SAAS,CAAC;AAC9B,QAAI,YAAa,sBAAqB,WAAW;AACjD,UAAM,QAAQ,KAAK,OAAO,IAAI,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;AAC5F,QAAI,OAAO;AACT,YAAM,cAAc,aAAa,eAAe,MAAM;AACtD,UAAI,QAAQ,WAAW,aAAa,MAAM,OAAO;AAC/C,cAAM,qBAAqB;AAAA,UACzB,MAAM;AAAA,UACN,WAAW,MAAM,MAAM;AAAA,QACzB;AAAA,MACF;AACA,YAAM,wBAAwB,OAAO,QAAQ,YAAY,WAAW;AAAA,IACtE;AACA,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AAAA,EAEA,MAAM,QACJ,SACA,SACA;AACA,UAAM,KAAK,iBAAiB;AAC5B,YAAQ,OAAO,eAAe;AAC9B,UAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,KAAK;AACrD,UAAM,WAAW,MAAM,YAAY,QAAQ,KAAK;AAChD,UAAM,SAAS,SAAS,CAAC;AACzB,QAAI,SAAS,WAAW,KAAK,CAAC,UAAU,OAAO,SAAS;AACtD,YAAM,IAAI,MAAM,uEAAuE;AAAA,IACzF;AACA,yBAAqB,MAAM;AAC3B,UAAM,UAAU,MAAM,YAAY,QAAQ,IAAI,OAAO,GAAG;AACxD,QAAI,CAAC,QAAS,OAAM,IAAI,MAAM,wDAAwD;AACtF,UAAM,gBAAgB,MAAM,QAAQ,OAAO;AAC3C,yBAAqB,eAAe,OAAO,WAAW;AACtD,UAAM,QAAQ,KAAK,OAAO,IAAI,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;AAC5F,UAAM,SACJ,OAAO,UACN,MAAM;AAAA,MACL,cAAc,SAAS,WAAW,WAAW,EAAE,QAAQ;AAAA,MACvD,QAAQ;AAAA,MACR,KAAK,IAAI,IAAI,KAAK;AAAA,IACpB;AACF,YAAQ,OAAO,eAAe;AAC9B,UAAM,WAAW,wBAAwB;AAAA,MACvC,MAAM;AAAA,MACN,UAAU,YAAY;AAAA,MACtB,eAAe,YAAY;AAAA,MAC3B,aAAa,QAAQ;AAAA,MACrB,qBAAqB,QAAQ;AAAA,MAC7B,mBAAmB,YAAY,UAAU;AAAA,MACzC,SAAS;AAAA,QACP,KAAK,OAAO;AAAA,QACZ,UAAU,OAAO;AAAA,QACjB,GAAI,OAAO,aAAa,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC;AAAA,QAC7D,aAAa,OAAO;AAAA,MACtB;AAAA,MACA,GAAI,OAAO,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;AAAA,MACpF,QAAQ,EAAE,QAAQ,YAAY,MAAM,GAAG,YAAY,OAAO,WAAW;AAAA,IACvE,CAAC;AACD,WAAO;AAAA,MACL,aAAa,EAAE,MAAM,UAAmB,OAAO,OAAO;AAAA,MACtD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QACJ,SACA,SACsC;AACtC,UAAM,KAAK,iBAAiB;AAC5B,YAAQ,OAAO,eAAe;AAC9B,UAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,IAAI;AACpD,QAAI,CAAC,YAAa,QAAO,EAAE,UAAU,KAAK;AAC1C,QAAI;AACJ,QAAI;AACF,YAAM,YAAY,QAAQ;AAAA,IAC5B,SAAS,OAAO;AACd,qBAAe;AAAA,IACjB;AACA,UAAM,YAAY,MAAM,KAAK,aAAa,IAAI,YAAY,EAAE;AAC5D,QAAI,WAAW;AACb,YAAM,IAAI,MAAM,oDAAoD,EAAE,OAAO,aAAa,CAAC;AAAA,IAC7F;AACA,YAAQ,OAAO,eAAe;AAC9B,SAAK,OAAO,OAAO,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;AACjF,WAAO,EAAE,UAAU,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAc,iBAAiB,MAA4C;AACzE,UAAM,UACJ,KAAK,uBAAuB,QAAQ,QAAQ,KAAK,QAAQ,SAAS,aAAa,CAAC;AAClF,SAAK,sBAAsB;AAC3B,QAAI;AACJ,QAAI;AACF,qBAAe,MAAM;AAAA,IACvB,SAAS,OAAO;AACd,UAAI,KAAK,wBAAwB,QAAS,MAAK,sBAAsB;AACrE,YAAM;AAAA,IACR;AACA,UAAM,QAAQ,aAAa;AAC3B,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,QAAQ,SAAS,IAAI;AAAA,MAC3D;AAAA,IACF;AACA,QAAI,QAAQ,CAAC,MAAM,OAAO,SAAS,IAAI,GAAG;AACxC,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,QAAQ,SAAS,IAAI,sBAAsB,IAAI;AAAA,MACrF;AAAA,IACF;AAAA,EACF;AAAA,EAUA,MAAc,QACZ,SACA,kBACmD;AACnD,UAAM,MAAM,aAAa,QAAQ,aAAa,QAAQ,mBAAmB;AACzE,UAAM,SAAS,KAAK,OAAO,IAAI,GAAG,GAAG;AACrC,QAAI,OAAQ,QAAO;AACnB,UAAM,WAAW;AAAA,MACf,MAAM;AAAA,MACN,UAAU,KAAK,QAAQ,SAAS;AAAA,MAChC,aAAa,QAAQ;AAAA,MACrB,qBAAqB,QAAQ;AAAA,IAC/B;AACA,UAAM,SAAS,MAAM,KAAK,aAAa,KAAK;AAAA,MAC1C;AAAA,MACA,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;AAAA,IAC1E,CAAC;AACD,UAAM,UAAU,OAAO;AAAA,MACrB,CAACA,iBACCA,aAAY,aAAa,KAAK,QAAQ,SAAS,QAC/C,OAAO,QAAQ,QAAQ,EAAE;AAAA,QAAM,CAAC,CAAC,MAAM,KAAK,MAC1C,kBAAkBA,aAAY,WAAW,IAAI,GAAG,KAAK;AAAA,MACvD;AAAA,IACJ;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI,MAAM,mEAAmE;AAAA,IACrF;AACA,UAAM,cAAc,QAAQ,CAAC;AAC7B,QAAI,CAAC,aAAa;AAChB,UAAI,iBAAkB,QAAO;AAC7B,YAAM,IAAI,MAAM,iDAAiD;AAAA,IACnE;AACA,QAAI,CAAC,eAAe,YAAY,UAAU,iBAAiB,GAAG;AAC5D,YAAM,IAAI,MAAM,4DAA4D;AAAA,IAC9E;AACA,SAAK,OAAO,IAAI,KAAK,EAAE,YAAY,CAAC;AACpC,WAAO;AAAA,EACT;AACF;AAEA,eAAe,wBACb,OACA,YACA,QACe;AACf,QAAM,QAAQ,MAAM;AACpB,MAAI,CAAC,SAAS,MAAM,QAAS;AAC7B,QAAM,UAAU,KAAK,IAAI,MAAM,WAAW,KAAK,IAAI,KAAK,IAAI,GAAG,MAAM,YAAY,CAAC;AAClF,QAAM,cAAc,MAAM,sBAAsB,MAAM,eAAe,QAAQ;AAC7E,QAAM,WAAW,UAAU;AAAA,IACzB,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB;AAAA,IACA,QAAQ,aAAa,SAAS,UAAU,YAAY,aAAa,IAAI,cAAc;AAAA,IACnF,MAAM,MAAM;AAAA,EACd,CAAC;AACD,QAAM,UAAU;AAClB;AAEA,SAAS,uBAAuB,SAA8C;AAC5E,MAAI,QAAQ,UAAU,KAAK,QAAQ,SAAS,UAAU;AACpD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,cAAc,MAAM,SAAS,aAAa,cAAc,QAAQ,OAAO,WAAW;AAC5F,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AACA,MAAI,QAAQ,OAAO,SAAS,YAAY;AACtC,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,QAAM,YAAY,QAAQ,UAAU,KAAK,QAAQ,UAAU,YAAY;AACvE,MACE,EACE,UAAU,WAAW,OAAO,KAC5B,cAAc,sBACd,UAAU,SAAS,OAAO,IAE5B;AACA,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,MAAI,CAAC,MAAM,WAAW,QAAQ,OAAO,UAAU,KAAK,CAAC,QAAQ,OAAO,IAAI,MAAM,KAAK,GAAG;AACpF,UAAM,IAAI,MAAM,8EAA8E;AAAA,EAChG;AACF;AAEA,eAAe,mBACb,aACA,SACA,QACe;AACf,QAAM,iBAAiB,gCAAgC,OAAO;AAC9D,aAAW,QAAQ,QAAQ,OAAO,KAAK,OAAO;AAC5C,UAAM,YAAY,UAAU,QAAQ,QAAQ,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,OAAO;AAAA,MAClF,MAAM,KAAK;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,cACJ,QAAQ,cAAc,MAAM,SAAS,QAAQ,oBAAoB,SAC7D,QAAQ,MAAM,WACd,QAAQ,MAAM;AACpB,MAAI,CAAC,YAAa,OAAM,IAAI,MAAM,+CAA+C;AACjF,aAAW,QAAQ,QAAQ,kBAAkB,OAAO;AAClD,UAAM,YAAY;AAAA,MAChB,QAAQ,aAAa,KAAK,IAAI;AAAA,MAC9B,OAAO,KAAK,KAAK,SAAS,MAAM;AAAA,MAChC,EAAE,MAAM,KAAK,MAAM,OAAO;AAAA,IAC5B;AAAA,EACF;AACA,MAAI,QAAQ,aAAa,gBAAgB;AACvC,eAAW,QAAQ,QAAQ,UAAU,OAAO;AAC1C,YAAM,YAAY,UAAU,QAAQ,eAAe,MAAM,KAAK,IAAI,GAAG,KAAK,OAAO;AAAA,QAC/E,MAAM,KAAK;AAAA,QACX;AAAA,MACF,CAAC;AAAA,IACH;AACA,QAAI,QAAQ,UAAU,mBAAmB,eAAe,iBAAiB;AACvE,YAAM,YAAY;AAAA,QAChB,eAAe;AAAA,QACf,QAAQ,UAAU;AAAA,QAClB,EAAE,MAAM,KAAO,OAAO;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,YAAY,SAAS,SAAS,aAAa;AACrD,UAAM,YAAY,UAAU,QAAQ,YAAY,SAAS,MAAM,QAAQ,YAAY,OAAO;AAAA,MACxF,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,SAAS,gCACP,SACiE;AACjE,QAAM,YAAY,QAAQ;AAC1B,MAAI,CAAC,WAAW;AACd,QACE,QAAQ,OAAO,IAAI,4BAA4B,MAAM,UACrD,QAAQ,OAAO,IAAI,wCAAwC,MAAM,QACjE;AACA,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AACA,WAAO;AAAA,EACT;AACA,QAAM,QAAQ;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,UAAU,oBAAoB;AAAA,EAChC;AACA,MACE,QAAQ,OAAO,IAAI,4BAA4B,MAAM,MAAM,QAC3D,QAAQ,OAAO,IAAI,wCAAwC,MAAM,MAAM,iBACvE;AACA,UAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AACA,QAAM,WAAW,CAAC,MAAM,MAAM,MAAM,eAAe,EAAE;AAAA,IACnD,CAAC,UAA2B,UAAU;AAAA,EACxC;AACA,QAAM,cACJ,QAAQ,cAAc,MAAM,SAAS,QAAQ,oBAAoB,SAC7D,QAAQ,MAAM,WACd,QAAQ,MAAM;AACpB,QAAM,aAAa;AAAA,IACjB,GAAG,QAAQ,OAAO,KAAK,MAAM,IAAI,CAAC,SAAS,QAAQ,QAAQ,MAAM,UAAU,KAAK,IAAI,CAAC;AAAA,IACrF,GAAI,cACA,QAAQ,kBAAkB,MAAM,IAAI,CAAC,SAAS,QAAQ,aAAa,KAAK,IAAI,CAAC,IAC7E,CAAC;AAAA,IACL,GAAI,QAAQ,YAAY,SAAS,SAAS,cACtC,CAAC,QAAQ,YAAY,SAAS,IAAI,IAClC,CAAC;AAAA,EACP;AACA,MACE,WAAW;AAAA,IAAK,CAAC,SACf,SAAS;AAAA,MACP,CAAC,iBACC,SAAS,gBACT,KAAK,WAAW,GAAG,YAAY,GAAG,KAClC,aAAa,WAAW,GAAG,IAAI,GAAG;AAAA,IACtC;AAAA,EACF,GACA;AACA,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,YAAY,SAAiE;AACpF,QAAM,cAAc,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,QAAQ,YAAY,KAAK;AAC9F,QAAM,OAAO;AAAA,IACX,YAAY,QAAQ,OAAO;AAAA,IAC3B,MAAM,QAAQ,OAAO;AAAA,IACrB,KAAK,QAAQ,OAAO;AAAA,IACpB,KAAK,QAAQ,OAAO;AAAA,IACpB,WAAW;AAAA,EACb;AACA,UAAQ,QAAQ,YAAY,SAAS,MAAM;AAAA,IACzC,KAAK;AACH,aAAO,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,KAAK,MAAM,WAAW,EAAE;AAAA,IACtD,KAAK;AACH,aAAO,EAAE,GAAG,MAAM,OAAO,YAAY;AAAA,IACvC,KAAK;AACH,aAAO;AAAA,EACX;AACF;AAEA,eAAe,cAAc,SAA4B,UAAuC;AAC9F,QAAM,SAAmB,CAAC;AAC1B,MAAI,aAAa;AACjB,mBAAiB,SAAS,QAAQ,OAAO,GAAG;AAC1C,UAAM,QAAQ,OAAO,KAAK,OAAO,MAAM;AACvC,kBAAc,MAAM;AACpB,QAAI,aAAa,UAAU;AACzB,UAAI;AACJ,UAAI;AACF,cAAM,YAAY,OAAO;AAAA,MAC3B,SAAS,OAAO;AACd,oBAAY;AAAA,MACd;AACA,YAAM,IAAI,MAAM,gCAAgC,QAAQ,iBAAiB;AAAA,QACvE,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,SAAO,WAAW,KAAK,OAAO,OAAO,QAAQ,UAAU,CAAC;AAC1D;AAEA,eAAe,YACb,QACA,QACA,cACqB;AACrB,SAAO,eAAe;AACtB,QAAM,cAAc,eAAe,KAAK,IAAI;AAC5C,MAAI,eAAe,EAAG,OAAM,IAAI,MAAM,mCAAmC;AACzE,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,MACxB;AAAA,MACA,IAAI,QAAe,CAAC,UAAU,WAAW;AACvC,kBAAU,MAAM,OAAO,OAAO,UAAU,IAAI,MAAM,4BAA4B,CAAC;AAC/E,eAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,gBAAQ;AAAA,UACN,MAAM,OAAO,IAAI,MAAM,mCAAmC,CAAC;AAAA,UAC3D;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,QAAI,QAAS,QAAO,oBAAoB,SAAS,OAAO;AACxD,QAAI,MAAO,cAAa,KAAK;AAAA,EAC/B;AACF;AAEA,eAAe,YAAY,SAA2C;AACpE,QAAM,SAAS,MAAM,QAAQ,OAAO;AACpC,MAAI,CAAC,OAAO,QAAS;AACrB,MAAI;AACF,UAAM,QAAQ,KAAK;AAAA,EACrB,SAAS,OAAO;AACd,SAAK,MAAM,QAAQ,OAAO,GAAG,QAAS,OAAM;AAAA,EAC9C;AACA,QAAM,cAAc,MAAM,QAAQ,KAAK;AACvC,uBAAqB,MAAM,QAAQ,OAAO,GAAG,WAAW;AAC1D;AAEA,SAAS,qBACP,QACA,UACwF;AACxF,MAAI,OAAO,WAAW,CAAC,OAAO,aAAa;AACzC,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,MAAI,YAAY,CAAC,kBAAkB,OAAO,aAAa,QAAQ,GAAG;AAChE,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACF;AAEA,SAAS,2BACP,aACA,UACA,cACM;AACN,MAAI,CAAC,YAAY,MAAM,YAAY,aAAa,cAAc;AAC5D,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,MACE,CAAC,OAAO,QAAQ,QAAQ,EAAE;AAAA,IAAM,CAAC,CAAC,MAAM,KAAK,MAC3C,kBAAkB,YAAY,WAAW,IAAI,GAAG,KAAK;AAAA,EACvD,GACA;AACA,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACF;AAEA,SAAS,WAAW,aAAiE;AACnF,QAAM,WAAW,YAAY,UAAU;AACvC,MAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC3D,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,SAAO,EAAE,UAAU,OAAO,QAAQ,EAAE;AACtC;AAEA,SAAS,aAAa,aAAqB,qBAA2C;AACpF,SAAO,GAAG,WAAW,KAAK,mBAAmB;AAC/C;AAEA,SAAS,wBAAwB,aAAqB,qBAA2C;AAC/F,SAAO,aAAa,yBAAyB;AAAA,IAC3C,MAAM;AAAA,IACN;AAAA,IACA;AAAA,EACF,CAAC,EAAE,MAAM,UAAU,MAAM,CAAC;AAC5B;AAEA,SAAS,WAAW,OAAe,gBAAsC;AACvE,MAAI,eAAe,KAAK,GAAG;AACzB,QAAI,UAAU,gBAAgB;AAC5B,YAAM,IAAI,MAAM,gEAAgE;AAAA,IAClF;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,MAAM,YAAY,GAAG;AACpC,MAAI,SAAS,EAAG,QAAO,GAAG,KAAK,IAAI,cAAc;AACjD,MAAI,MAAM,MAAM,SAAS,CAAC,MAAM,gBAAgB;AAC9C,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,WAAmB,aAA6B;AAC7E,QAAM,QAAQ,gBAAgB,WAAW,6BAA6B,IAAI;AAC1E,MAAI,CAAC,OAAO,cAAc,KAAK,EAAG,OAAM,IAAI,MAAM,6CAA6C;AAC/F,SAAO,KAAK,KAAK,QAAQ,GAAK,IAAI;AACpC;AAEA,SAAS,eAAe,WAAmE;AACzF,MAAI,CAAC,OAAO,SAAS,UAAU,GAAG,KAAK,UAAU,OAAO,GAAG;AACzD,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,SAAO,OAAO,OAAO;AAAA,IACnB,KAAK,UAAU;AAAA,IACf,UAAU,gBAAgB,UAAU,UAAU,sBAAsB;AAAA,IACpE,QAAQ,gBAAgB,UAAU,QAAQ,oBAAoB;AAAA,EAChE,CAAC;AACH;AAEA,SAAS,gBAAgB,OAAe,OAAuB;AAC7D,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ;AAC1C,UAAM,IAAI,MAAM,GAAG,KAAK,6BAA6B;AACvD,SAAO;AACT;AAEA,SAAS,QAAQ,MAAc,cAA8B;AAC3D,MAAI,MAAM,WAAW,YAAY,EAAG,OAAM,IAAI,MAAM,uCAAuC;AAC3F,QAAM,OAAO,MAAM,UAAU,YAAY;AACzC,MAAI,SAAS,QAAQ,KAAK,WAAW,KAAK,GAAG;AAC3C,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO,MAAM,KAAK,MAAM,IAAI;AAC9B;AAEA,SAAS,eAAe,OAAuC;AAC7D,SAAO,OAAO,UAAU,YAAY,wBAAwB,KAAK,KAAK;AACxE;","names":["environment"]}