@tangle-network/agent-runtime 0.107.4 → 0.108.0

package/dist/primeintellect/index.d.ts

@@ -1,5 +1,5 @@
 import { i as AgentExecutionBackend, r as AgentBackendInput } from "../types-C9j4qg6l.js";
-import { Nt as createOpenAICompatibleBackend } from "../index-D6MwUzvB.js";
+import { xt as createOpenAICompatibleBackend } from "../index-DQp3BPeC.js";
 import { RunRecord } from "@tangle-network/agent-eval";
 //#region src/primeintellect/types.d.ts
 type PrimeIntellectSplit = 'train' | 'eval';

package/dist/{protected-model-port-ZUwVuftA.js → protected-model-port-uthtDNqu.js}

@@ -1,4 +1,4 @@
-import { W as assertExactObjectKeys, l as candidateKnowledgeExecutionPaths, lt as sha256Bytes, m as usdToNanos, nt as canonicalCandidateBytes, p as sealAgentCandidateModelSettlement, rt as canonicalCandidateDigest, st as immutableCandidateValue } from "./prepare-_WTTffkz.js";
+import { W as assertExactObjectKeys, l as candidateKnowledgeExecutionPaths, lt as sha256Bytes, m as usdToNanos, nt as canonicalCandidateBytes, p as sealAgentCandidateModelSettlement, rt as canonicalCandidateDigest, st as immutableCandidateValue } from "./prepare-Pr19X93k.js";
 import { posix } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 //#region src/candidate-execution/exact-process-executor.ts
@@ -719,4 +719,4 @@ function record(value, label) {
 //#endregion
 export { exactProcessProviderAsCandidateExecutor as n, createProtectedAgentCandidateModelPort as t };
 
-//# sourceMappingURL=protected-model-port-ZUwVuftA.js.map
+//# sourceMappingURL=protected-model-port-uthtDNqu.js.map

package/dist/{protected-model-port-ZUwVuftA.js.map → protected-model-port-uthtDNqu.js.map}

@@ -1 +1 @@
-{"version":3,"file":"protected-model-port-ZUwVuftA.js","names":["isSha256Digest"],"sources":["../src/candidate-execution/exact-process-executor.ts","../src/candidate-execution/protected-model-port.ts"],"sourcesContent":["import { posix } from 'node:path'\nimport { isDeepStrictEqual } from 'node:util'\n\nimport type { TraceStore } from '@tangle-network/agent-eval'\nimport type { AgentCandidateTermination, Sha256Digest } from '@tangle-network/agent-interface'\nimport type {\n  AgentEnvironmentCapabilities,\n  AgentEnvironmentProvider,\n  AgentExactProcess,\n  AgentExactProcessEnvironment,\n  AgentExactProcessLaunch,\n  AgentExactProcessResources,\n  AgentExactProcessStatus,\n} from '@tangle-network/agent-interface/environment-provider'\n\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  immutableCandidateValue,\n  sha256Bytes,\n} from './digest'\nimport {\n  CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV,\n  CANDIDATE_KNOWLEDGE_ROOT_ENV,\n  candidateKnowledgeExecutionPaths,\n} from './knowledge'\nimport type {\n  AgentCandidateExecutorPort,\n  AgentCandidateExecutorRequest,\n  AgentCandidateExecutorStopRequest,\n} from './types'\n\nconst DEFAULT_PROVISION_TIMEOUT_MS = 120_000\nconst DEFAULT_RECOVERY_RETENTION_MS = 15 * 60_000\n\ninterface ExactProcessRunState {\n  environment: AgentExactProcessEnvironment\n  output?: Uint8Array\n  termination?: AgentCandidateTermination\n  runtimeTermination?: AgentCandidateTermination\n  trace?: {\n    runId: string\n    scenarioId: string\n    startedAt: number\n    deadlineAtMs: number\n    timeoutMs: number\n    tags: Record<string, string>\n    written: boolean\n  }\n}\n\nexport interface ExactProcessCandidateExecutorOptions {\n  provider: AgentEnvironmentProvider\n  resources: AgentExactProcessResources\n  provisionTimeoutMs?: number\n  recoveryRetentionMs?: number\n  providerOptions?: Record<string, unknown>\n}\n\n/** Adapt one neutral exact-process provider to Runtime's trusted candidate boundary. */\nexport function exactProcessProviderAsCandidateExecutor(\n  options: ExactProcessCandidateExecutorOptions,\n): AgentCandidateExecutorPort {\n  return new ExactProcessAgentCandidateExecutor(options)\n}\n\nclass ExactProcessAgentCandidateExecutor implements AgentCandidateExecutorPort {\n  private readonly states = new Map<string, ExactProcessRunState>()\n  private readonly exactProcess\n  private readonly resources: AgentExactProcessResources\n  private readonly provisionTimeoutMs: number\n  private readonly recoveryRetentionMs: number\n  private readonly providerOptions?: Record<string, unknown>\n  private capabilitiesPromise?: Promise<AgentEnvironmentCapabilities>\n\n  constructor(private readonly options: ExactProcessCandidateExecutorOptions) {\n    if (!options.provider.exactProcess) {\n      throw new Error(\n        `agent environment provider \"${options.provider.name}\" does not implement exact processes`,\n      )\n    }\n    this.exactProcess = options.provider.exactProcess\n    this.resources = exactResources(options.resources)\n    this.provisionTimeoutMs = positiveInteger(\n      options.provisionTimeoutMs ?? DEFAULT_PROVISION_TIMEOUT_MS,\n      'exact process provision timeout',\n    )\n    this.recoveryRetentionMs = positiveInteger(\n      options.recoveryRetentionMs ?? DEFAULT_RECOVERY_RETENTION_MS,\n      'exact process recovery retention',\n    )\n    this.providerOptions = options.providerOptions\n      ? immutableCandidateValue(options.providerOptions)\n      : undefined\n  }\n\n  async execute(\n    request: AgentCandidateExecutorRequest,\n    context: Parameters<AgentCandidateExecutorPort['execute']>[1],\n  ) {\n    assertSupportedRequest(request)\n    const outcome = request.benchmark.task.outcome\n    if (outcome.kind !== 'output') throw new Error('exact process executor requires an output task')\n    const network = request.executionPlan.value.material.model.access.network\n    const egress =\n      network.mode === 'disabled'\n        ? ({ mode: 'blocked' } as const)\n        : ({ mode: 'strict', allowDomains: [...network.domains] } as const)\n    await this.assertCapability(egress.mode)\n    context.signal.throwIfAborted()\n\n    const key = executionKey(request.executionId, request.executionPlan.value.digest)\n    if (this.states.has(key)) throw new Error('candidate execution environment is already active')\n    const image = exactImage(\n      request.executionPlan.value.material.container.image,\n      request.executionPlan.value.material.container.manifestDigest,\n    )\n    const maxLifetimeMs = environmentLifetimeMs(\n      request.hardLimits.timeoutMs,\n      this.recoveryRetentionMs,\n    )\n    const createMaterial = immutableCandidateValue({\n      kind: 'agent-candidate-exact-process-create',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlan.value.digest,\n      image,\n      egress,\n      maxLifetimeMs,\n      provisionTimeoutMs: this.provisionTimeoutMs,\n      resources: this.resources,\n      output: { mediaType: outcome.mediaType, maxBytes: outcome.maxBytes },\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    const createInputDigest = canonicalCandidateDigest(createMaterial)\n    const metadata = immutableCandidateValue({\n      kind: 'agent-candidate-execution',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlan.value.digest,\n      createInputDigest,\n      outputMediaType: outcome.mediaType,\n      outputMaxBytes: outcome.maxBytes,\n    })\n    const environment = await this.exactProcess.create({\n      image,\n      egress,\n      maxLifetimeMs,\n      provisionTimeoutMs: this.provisionTimeoutMs,\n      resources: this.resources,\n      metadata,\n      idempotencyKey: executionIdempotencyKey(\n        request.executionId,\n        request.executionPlan.value.digest,\n      ),\n      signal: context.signal,\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    try {\n      assertExecutionEnvironment(environment, metadata, this.options.provider.name)\n    } catch (error) {\n      try {\n        await environment.destroy()\n      } catch (cleanupError) {\n        throw new AggregateError(\n          [error, cleanupError],\n          'exact process validation and cleanup both failed',\n        )\n      }\n      throw error\n    }\n    const state: ExactProcessRunState = { environment }\n    this.states.set(key, state)\n\n    const existing = await environment.process.list()\n    if (existing.length !== 0) {\n      throw new Error('fresh candidate environment already contains a process')\n    }\n    await materializeRequest(environment, request, context.signal)\n    const launch = exactLaunch(request)\n    const startedAt = Date.now()\n    state.trace = {\n      runId: request.trace.runId,\n      scenarioId: request.benchmark.task.scenario.id,\n      startedAt,\n      deadlineAtMs: context.deadlineAtMs,\n      timeoutMs: request.hardLimits.timeoutMs,\n      tags: {\n        ...request.trace.tags,\n        environmentId: environment.id,\n        environmentProvider: environment.provider,\n      },\n      written: false,\n    }\n    const process = await environment.process.spawn(launch, { signal: context.signal })\n    const outputPromise = collectOutput(process, outcome.maxBytes)\n    void outputPromise.catch(() => undefined)\n    let cancellation: Promise<void> | undefined\n    let processExited = false\n    const cancel = () => {\n      if (!processExited) cancellation ??= stopProcess(process)\n    }\n    context.signal.addEventListener('abort', cancel, { once: true })\n    if (context.signal.aborted) cancel()\n    try {\n      const termination = await process.wait()\n      processExited = true\n      context.signal.removeEventListener('abort', cancel)\n      if (cancellation) await cancellation\n      const status = await process.status()\n      assertTerminalStatus(status, termination)\n      state.output = await awaitOutput(outputPromise, context.signal, context.deadlineAtMs)\n      state.termination = termination\n      await appendExactProcessTrace(state, context.traceStore, status)\n      return { executionId: request.executionId, termination }\n    } finally {\n      context.signal.removeEventListener('abort', cancel)\n    }\n  }\n\n  async stop(\n    request: AgentCandidateExecutorStopRequest,\n    context: Parameters<AgentCandidateExecutorPort['stop']>[1],\n  ): Promise<{ readonly stopped: true }> {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, true)\n    if (!environment) return { stopped: true }\n    let statuses = await environment.process.list()\n    if (statuses.length > 1) {\n      throw new Error('candidate exact process environment contains more than one process')\n    }\n    const status = statuses[0]\n    if (status?.running) {\n      const process = await environment.process.get(status.pid)\n      if (!process) throw new Error('candidate environment lost its running process handle')\n      await stopProcess(process)\n    }\n    context.signal.throwIfAborted()\n    statuses = await environment.process.list()\n    if (statuses.some((entry) => entry.running)) {\n      throw new Error('candidate exact process termination is not proven')\n    }\n    const finalStatus = statuses[0]\n    if (finalStatus) assertTerminalStatus(finalStatus)\n    const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest))\n    if (state) {\n      state.termination = finalStatus?.termination ?? state.termination\n      if (context.reason === 'timeout' && state.trace) {\n        state.runtimeTermination = {\n          kind: 'timeout',\n          timeoutMs: state.trace.timeoutMs,\n        }\n      }\n      await appendExactProcessTrace(state, context.traceStore, finalStatus)\n    }\n    return { stopped: true }\n  }\n\n  async capture(\n    request: AgentCandidateExecutorStopRequest,\n    context: Parameters<AgentCandidateExecutorPort['capture']>[1],\n  ) {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, false)\n    const statuses = await environment.process.list()\n    const status = statuses[0]\n    if (statuses.length !== 1 || !status || status.running) {\n      throw new Error('candidate environment must contain one stopped process before capture')\n    }\n    assertTerminalStatus(status)\n    const process = await environment.process.get(status.pid)\n    if (!process) throw new Error('candidate environment lost its captured process handle')\n    const currentStatus = await process.status()\n    assertTerminalStatus(currentStatus, status.termination)\n    const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest))\n    const output =\n      state?.output ??\n      (await awaitOutput(\n        collectOutput(process, outputSpec(environment).maxBytes),\n        context.signal,\n        Date.now() + this.provisionTimeoutMs,\n      ))\n    context.signal.throwIfAborted()\n    const evidence = canonicalCandidateBytes({\n      kind: 'agent-candidate-exact-process-capture',\n      provider: environment.provider,\n      environmentId: environment.id,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlanDigest,\n      createInputDigest: environment.metadata?.createInputDigest,\n      process: {\n        pid: status.pid,\n        exitCode: status.exitCode,\n        ...(status.exitSignal ? { exitSignal: status.exitSignal } : {}),\n        termination: status.termination,\n      },\n      ...(state?.runtimeTermination ? { runtimeTermination: state.runtimeTermination } : {}),\n      output: { sha256: sha256Bytes(output), byteLength: output.byteLength },\n    })\n    return {\n      taskOutcome: { kind: 'output' as const, bytes: output },\n      evidence,\n    }\n  }\n\n  async dispose(\n    request: AgentCandidateExecutorStopRequest,\n    context: { signal: AbortSignal },\n  ): Promise<{ readonly disposed: true }> {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, true)\n    if (!environment) return { disposed: true }\n    let destroyError: unknown\n    try {\n      await environment.destroy()\n    } catch (error) {\n      destroyError = error\n    }\n    const remaining = await this.exactProcess.get(environment.id)\n    if (remaining) {\n      throw new Error('exact process environment disposal is not proven', { cause: destroyError })\n    }\n    context.signal.throwIfAborted()\n    this.states.delete(executionKey(request.executionId, request.executionPlanDigest))\n    return { disposed: true }\n  }\n\n  private async assertCapability(mode?: 'blocked' | 'strict'): Promise<void> {\n    const pending =\n      this.capabilitiesPromise ?? Promise.resolve(this.options.provider.capabilities())\n    this.capabilitiesPromise = pending\n    let capabilities: AgentEnvironmentCapabilities\n    try {\n      capabilities = await pending\n    } catch (error) {\n      if (this.capabilitiesPromise === pending) this.capabilitiesPromise = undefined\n      throw error\n    }\n    const exact = capabilities.exactProcess\n    if (!exact) {\n      throw new Error(\n        `agent environment provider \"${this.options.provider.name}\" does not declare exact process support`,\n      )\n    }\n    if (mode && !exact.egress.includes(mode)) {\n      throw new Error(\n        `agent environment provider \"${this.options.provider.name}\" does not declare ${mode} exact egress`,\n      )\n    }\n  }\n\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: false,\n  ): Promise<AgentExactProcessEnvironment>\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: true,\n  ): Promise<AgentExactProcessEnvironment | undefined>\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: boolean,\n  ): Promise<AgentExactProcessEnvironment | undefined> {\n    const key = executionKey(request.executionId, request.executionPlanDigest)\n    const active = this.states.get(key)?.environment\n    if (active) return active\n    const metadata = {\n      kind: 'agent-candidate-execution',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlanDigest,\n    }\n    const listed = await this.exactProcess.list({\n      metadata,\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    const matches = listed.filter(\n      (environment) =>\n        environment.provider === this.options.provider.name &&\n        Object.entries(metadata).every(([name, value]) =>\n          isDeepStrictEqual(environment.metadata?.[name], value),\n        ),\n    )\n    if (matches.length > 1) {\n      throw new Error('multiple exact process environments match one candidate execution')\n    }\n    const environment = matches[0]\n    if (!environment) {\n      if (missingIsDeleted) return undefined\n      throw new Error('candidate exact process evidence is unavailable')\n    }\n    if (!isSha256Digest(environment.metadata?.createInputDigest)) {\n      throw new Error('candidate exact process create-input digest is unavailable')\n    }\n    this.states.set(key, { environment })\n    return environment\n  }\n}\n\nasync function appendExactProcessTrace(\n  state: ExactProcessRunState,\n  traceStore: TraceStore,\n  status?: AgentExactProcessStatus,\n): Promise<void> {\n  const trace = state.trace\n  if (!trace || trace.written) return\n  const endedAt = Math.max(trace.startedAt, Math.min(Date.now(), trace.deadlineAtMs))\n  const termination = state.runtimeTermination ?? state.termination ?? status?.termination\n  await traceStore.appendRun({\n    runId: trace.runId,\n    scenarioId: trace.scenarioId,\n    startedAt: trace.startedAt,\n    endedAt,\n    status: termination?.kind === 'exit' && termination.exitCode === 0 ? 'completed' : 'failed',\n    tags: trace.tags,\n  })\n  trace.written = true\n}\n\nfunction assertSupportedRequest(request: AgentCandidateExecutorRequest): void {\n  if (request.benchmark.task.outcome.kind !== 'output') {\n    throw new Error(\n      'exact process candidate executor does not support workspace outcomes; use Pier',\n    )\n  }\n  if (request.executionPlan.value.material.codeKind !== 'disabled' || request.inputs.candidate) {\n    throw new Error('exact process candidate executor does not support code workspaces; use Pier')\n  }\n  if (request.memory.mode !== 'disabled') {\n    throw new Error('exact process candidate executor does not support isolated memory')\n  }\n  const mediaType = request.benchmark.task.outcome.mediaType.toLowerCase()\n  if (\n    !(\n      mediaType.startsWith('text/') ||\n      mediaType === 'application/json' ||\n      mediaType.endsWith('+json')\n    )\n  ) {\n    throw new Error('exact process candidate executor supports only UTF-8 text and JSON outputs')\n  }\n  if (!posix.isAbsolute(request.launch.executable) && !request.launch.env.PATH?.trim()) {\n    throw new Error('exact process candidate executable must be absolute or declare a signed PATH')\n  }\n}\n\nasync function materializeRequest(\n  environment: AgentExactProcessEnvironment,\n  request: AgentCandidateExecutorRequest,\n  signal: AbortSignal,\n): Promise<void> {\n  const knowledgePaths = assertKnowledgeExecutionBinding(request)\n  for (const file of request.inputs.task.files) {\n    await environment.writeFile(beneath(request.roots.taskRoot, file.path), file.bytes, {\n      mode: file.mode,\n      signal,\n    })\n  }\n  const profileRoot =\n    request.executionPlan.value.material.profile.targetWorkspace === 'task'\n      ? request.roots.taskRoot\n      : request.roots.candidateRoot\n  if (!profileRoot) throw new Error('candidate profile targets a missing workspace')\n  for (const file of request.profileActivation.files) {\n    await environment.writeFile(\n      beneath(profileRoot, file.path),\n      Buffer.from(file.content, 'utf8'),\n      { mode: file.mode, signal },\n    )\n  }\n  if (request.knowledge && knowledgePaths) {\n    for (const file of request.knowledge.files) {\n      await environment.writeFile(beneath(knowledgePaths.root, file.path), file.bytes, {\n        mode: file.mode,\n        signal,\n      })\n    }\n    if (request.knowledge.retrievalConfig && knowledgePaths.retrievalConfig) {\n      await environment.writeFile(\n        knowledgePaths.retrievalConfig,\n        request.knowledge.retrievalConfig,\n        { mode: 0o644, signal },\n      )\n    }\n  }\n  if (request.instruction.delivery.kind === 'utf8-file') {\n    await environment.writeFile(request.instruction.delivery.path, request.instruction.bytes, {\n      mode: 0o644,\n      signal,\n    })\n  }\n}\n\nfunction assertKnowledgeExecutionBinding(\n  request: AgentCandidateExecutorRequest,\n): ReturnType<typeof candidateKnowledgeExecutionPaths> | undefined {\n  const knowledge = request.knowledge\n  if (!knowledge) {\n    if (\n      request.launch.env[CANDIDATE_KNOWLEDGE_ROOT_ENV] !== undefined ||\n      request.launch.env[CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV] !== undefined\n    ) {\n      throw new Error('candidate launch declares knowledge paths without verified knowledge')\n    }\n    return undefined\n  }\n  const paths = candidateKnowledgeExecutionPaths(\n    request.roots.taskRoot,\n    knowledge.retrievalConfig !== undefined,\n  )\n  if (\n    request.launch.env[CANDIDATE_KNOWLEDGE_ROOT_ENV] !== paths.root ||\n    request.launch.env[CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV] !== paths.retrievalConfig\n  ) {\n    throw new Error('candidate knowledge paths do not match the signed launch environment')\n  }\n  const reserved = [paths.root, paths.retrievalConfig].filter(\n    (value): value is string => value !== undefined,\n  )\n  const profileRoot =\n    request.executionPlan.value.material.profile.targetWorkspace === 'task'\n      ? request.roots.taskRoot\n      : request.roots.candidateRoot\n  const otherFiles = [\n    ...request.inputs.task.files.map((file) => beneath(request.roots.taskRoot, file.path)),\n    ...(profileRoot\n      ? request.profileActivation.files.map((file) => beneath(profileRoot, file.path))\n      : []),\n    ...(request.instruction.delivery.kind === 'utf8-file'\n      ? [request.instruction.delivery.path]\n      : []),\n  ]\n  if (\n    otherFiles.some((path) =>\n      reserved.some(\n        (reservedPath) =>\n          path === reservedPath ||\n          path.startsWith(`${reservedPath}/`) ||\n          reservedPath.startsWith(`${path}/`),\n      ),\n    )\n  ) {\n    throw new Error('candidate knowledge paths overlap other execution inputs')\n  }\n  return paths\n}\n\nfunction exactLaunch(request: AgentCandidateExecutorRequest): AgentExactProcessLaunch {\n  const instruction = new TextDecoder('utf-8', { fatal: true }).decode(request.instruction.bytes)\n  const base = {\n    executable: request.launch.executable,\n    args: request.launch.args,\n    cwd: request.launch.cwd,\n    env: request.launch.env,\n    timeoutMs: 0,\n  }\n  switch (request.instruction.delivery.kind) {\n    case 'argv-append':\n      return { ...base, args: [...base.args, instruction] }\n    case 'stdin-utf8':\n      return { ...base, stdin: instruction }\n    case 'utf8-file':\n      return base\n  }\n}\n\nasync function collectOutput(process: AgentExactProcess, maxBytes: number): Promise<Uint8Array> {\n  const chunks: Buffer[] = []\n  let byteLength = 0\n  for await (const chunk of process.stdout()) {\n    const bytes = Buffer.from(chunk, 'utf8')\n    byteLength += bytes.byteLength\n    if (byteLength > maxBytes) {\n      let stopError: unknown\n      try {\n        await stopProcess(process)\n      } catch (error) {\n        stopError = error\n      }\n      throw new Error(`candidate output exceeds its ${maxBytes}-byte maximum`, {\n        cause: stopError,\n      })\n    }\n    chunks.push(bytes)\n  }\n  return Uint8Array.from(Buffer.concat(chunks, byteLength))\n}\n\nasync function awaitOutput(\n  output: Promise<Uint8Array>,\n  signal: AbortSignal,\n  deadlineAtMs: number,\n): Promise<Uint8Array> {\n  signal.throwIfAborted()\n  const remainingMs = deadlineAtMs - Date.now()\n  if (remainingMs <= 0) throw new Error('candidate output deadline expired')\n  let timer: ReturnType<typeof setTimeout> | undefined\n  let onAbort: (() => void) | undefined\n  try {\n    return await Promise.race([\n      output,\n      new Promise<never>((_resolve, reject) => {\n        onAbort = () => reject(signal.reason ?? new Error('candidate output cancelled'))\n        signal.addEventListener('abort', onAbort, { once: true })\n        timer = setTimeout(\n          () => reject(new Error('candidate output deadline expired')),\n          remainingMs,\n        )\n      }),\n    ])\n  } finally {\n    if (onAbort) signal.removeEventListener('abort', onAbort)\n    if (timer) clearTimeout(timer)\n  }\n}\n\nasync function stopProcess(process: AgentExactProcess): Promise<void> {\n  const before = await process.status()\n  if (!before.running) return\n  try {\n    await process.kill()\n  } catch (error) {\n    if ((await process.status()).running) throw error\n  }\n  const termination = await process.wait()\n  assertTerminalStatus(await process.status(), termination)\n}\n\nfunction assertTerminalStatus(\n  status: AgentExactProcessStatus,\n  expected?: AgentCandidateTermination,\n): asserts status is AgentExactProcessStatus & { termination: AgentCandidateTermination } {\n  if (status.running || !status.termination) {\n    throw new Error('exact process returned no terminal reason after exit')\n  }\n  if (expected && !isDeepStrictEqual(status.termination, expected)) {\n    throw new Error('exact process wait and status returned different terminal reasons')\n  }\n}\n\nfunction assertExecutionEnvironment(\n  environment: AgentExactProcessEnvironment,\n  metadata: Record<string, unknown>,\n  providerName: string,\n): void {\n  if (!environment.id || environment.provider !== providerName) {\n    throw new Error('exact process provider returned the wrong environment identity')\n  }\n  if (\n    !Object.entries(metadata).every(([name, value]) =>\n      isDeepStrictEqual(environment.metadata?.[name], value),\n    )\n  ) {\n    throw new Error('exact process provider did not persist candidate execution metadata')\n  }\n}\n\nfunction outputSpec(environment: AgentExactProcessEnvironment): { maxBytes: number } {\n  const maxBytes = environment.metadata?.outputMaxBytes\n  if (!Number.isSafeInteger(maxBytes) || Number(maxBytes) < 1) {\n    throw new Error('candidate exact process output bound is unavailable')\n  }\n  return { maxBytes: Number(maxBytes) }\n}\n\nfunction executionKey(executionId: string, executionPlanDigest: Sha256Digest): string {\n  return `${executionId}\\0${executionPlanDigest}`\n}\n\nfunction executionIdempotencyKey(executionId: string, executionPlanDigest: Sha256Digest): string {\n  return `candidate-${canonicalCandidateDigest({\n    kind: 'agent-candidate-execution-identity',\n    executionId,\n    executionPlanDigest,\n  }).slice('sha256:'.length)}`\n}\n\nfunction exactImage(image: string, manifestDigest: Sha256Digest): string {\n  if (isSha256Digest(image)) {\n    if (image !== manifestDigest) {\n      throw new Error('candidate container image conflicts with its resolved manifest')\n    }\n    return image\n  }\n  const marker = image.lastIndexOf('@')\n  if (marker < 0) return `${image}@${manifestDigest}`\n  if (image.slice(marker + 1) !== manifestDigest) {\n    throw new Error('candidate container image conflicts with its resolved manifest')\n  }\n  return image\n}\n\nfunction environmentLifetimeMs(timeoutMs: number, retentionMs: number): number {\n  const total = positiveInteger(timeoutMs, 'candidate execution timeout') + retentionMs\n  if (!Number.isSafeInteger(total)) throw new Error('candidate environment lifetime is too large')\n  return Math.ceil(total / 1_000) * 1_000\n}\n\nfunction exactResources(resources: AgentExactProcessResources): AgentExactProcessResources {\n  if (!Number.isFinite(resources.cpu) || resources.cpu <= 0) {\n    throw new Error('exact process CPU must be positive and finite')\n  }\n  return Object.freeze({\n    cpu: resources.cpu,\n    memoryMb: positiveInteger(resources.memoryMb, 'exact process memory'),\n    diskMb: positiveInteger(resources.diskMb, 'exact process disk'),\n  })\n}\n\nfunction positiveInteger(value: number, label: string): number {\n  if (!Number.isSafeInteger(value) || value < 1)\n    throw new Error(`${label} must be a positive integer`)\n  return value\n}\n\nfunction beneath(root: string, relativePath: string): string {\n  if (posix.isAbsolute(relativePath)) throw new Error('candidate input path must be relative')\n  const path = posix.normalize(relativePath)\n  if (path === '..' || path.startsWith('../')) {\n    throw new Error('candidate input path escapes its execution root')\n  }\n  return posix.join(root, path)\n}\n\nfunction isSha256Digest(value: unknown): value is Sha256Digest {\n  return typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value)\n}\n","import type {\n  AgentCandidateModelAccessNetwork,\n  AgentCandidateResolvedModel,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateDigest, immutableCandidateValue } from './digest'\nimport { assertExactObjectKeys } from './exact-object'\nimport { sealAgentCandidateModelSettlement, usdToNanos } from './model-settlement'\nimport type {\n  AgentCandidateModelLimits,\n  AgentCandidateModelPort,\n  AgentCandidateProtectedModelActivation,\n  AgentCandidateProtectedModelReservation,\n  AgentCandidateProtectedModelSettlement,\n} from './types'\n\nexport type AgentCandidateModelGrantReserveInput = Parameters<\n  AgentCandidateModelPort['reserveGrant']\n>[0]\nexport type AgentCandidateModelGrantActivateInput = Parameters<\n  AgentCandidateModelPort['activateGrant']\n>[0]\nexport type AgentCandidateModelGrantSettleInput = Parameters<\n  AgentCandidateModelPort['settleGrant']\n>[0]\n\n/** Secret-free response from the service's reservation endpoint. */\nexport type AgentCandidateModelGrantReservation = AgentCandidateProtectedModelReservation\n\n/**\n * Narrow transport contract for a service that owns scoped model credentials\n * and the authoritative per-call usage ledger.\n *\n * An HTTP client can bind these methods to control-plane endpoints. Keeping\n * transport out of the runtime prevents parent credentials, endpoint paths,\n * and retry policy from becoming part of the portable candidate contract.\n */\nexport interface AgentCandidateModelGrantClient {\n  reserve(input: AgentCandidateModelGrantReserveInput): Promise<AgentCandidateModelGrantReservation>\n  activate(\n    input: AgentCandidateModelGrantActivateInput,\n  ): Promise<AgentCandidateProtectedModelActivation>\n  settle(\n    input: AgentCandidateModelGrantSettleInput,\n  ): Promise<AgentCandidateProtectedModelSettlement>\n}\n\nexport interface CreateProtectedAgentCandidateModelPortOptions {\n  client: AgentCandidateModelGrantClient\n  /** Catalog/snapshot resolution stays separate from credential issuance. */\n  resolveModel: AgentCandidateModelPort['resolve']\n  /** The only public DNS name candidate processes may reach for inference. */\n  gatewayDomain: string\n  /** Exact environment names the activation endpoint must return, no more or fewer. */\n  activationEnvNames: readonly string[]\n}\n\ninterface RememberedReservation {\n  requestDigest: Sha256Digest\n  responseDigest: Sha256Digest\n  executionId: string\n  preparationId: string\n  grantDigest: Sha256Digest\n  expiresAtMs: number\n  resolved: AgentCandidateResolvedModel\n  limits: AgentCandidateModelLimits\n  maxCostUsdNanos: number\n  activation: 'reserved' | 'activating' | 'activated'\n  settlementDigest?: Sha256Digest\n  settlementReason?: AgentCandidateModelGrantSettleInput['reason']\n}\n\ninterface RememberedSettlement {\n  settlementDigest: Sha256Digest\n  settlementReason: AgentCandidateModelGrantSettleInput['reason']\n  expiresAtMs: number\n}\n\nconst MAX_RECENT_SETTLEMENTS = 4_096\nconst RECOVERED_SETTLEMENT_RETENTION_MS = 15 * 60 * 1_000\n\n/**\n * Bind a protected model-grant service to the immutable candidate runtime.\n *\n * The service remains the authority for expiry, admission, revocation, and\n * metering. This adapter independently checks every response before allowing\n * it to cross into candidate execution or durable receipt finalization.\n */\nexport function createProtectedAgentCandidateModelPort(\n  options: CreateProtectedAgentCandidateModelPortOptions,\n): AgentCandidateModelPort {\n  const gatewayDomain = assertGatewayDomain(options.gatewayDomain)\n  const activationEnvNames = exactEnvironmentNames(options.activationEnvNames)\n  const reservations = new Map<string, RememberedReservation>()\n  const recentSettlements = new Map<string, RememberedSettlement>()\n\n  return {\n    resolve: async (input) => {\n      const request = immutableCandidateValue(input)\n      const resolved = validateResolvedModel(await options.resolveModel(request), request)\n      return immutableCandidateValue(resolved)\n    },\n\n    reserveGrant: async (input) => {\n      pruneExpiredState(reservations, recentSettlements, Date.now())\n      const request = immutableCandidateValue(input)\n      validateReserveInput(request)\n      const requestDigest = canonicalCandidateDigest(request)\n      const key = reservationKey(request.executionId, request.preparationId)\n      if (recentSettlements.has(key)) {\n        throw new Error('protected model reservation is already settled')\n      }\n      const previous = reservations.get(key)\n      if (previous && previous.requestDigest !== requestDigest) {\n        throw new Error('protected model reservation retry changed immutable input')\n      }\n\n      const reservation = validateReservation(\n        await options.client.reserve(request),\n        request,\n        gatewayDomain,\n      )\n      const responseDigest = canonicalCandidateDigest(reservation)\n      if (recentSettlements.has(key)) {\n        throw new Error('protected model reservation completed after the grant was settled')\n      }\n      const recorded = previous ?? reservations.get(key)\n      if (recorded && recorded.requestDigest !== requestDigest) {\n        throw new Error('protected model reservation retry changed immutable input')\n      }\n      if (recorded && recorded.responseDigest !== responseDigest) {\n        throw new Error('protected model reservation retry returned different evidence')\n      }\n      if (!recorded) {\n        reservations.set(key, {\n          requestDigest,\n          responseDigest,\n          executionId: request.executionId,\n          preparationId: request.preparationId,\n          grantDigest: reservation.digest,\n          expiresAtMs: request.expiresAtMs,\n          resolved: immutableCandidateValue(request.resolved),\n          limits: immutableCandidateValue(request.limits),\n          maxCostUsdNanos: usdToNanos(request.limits.maxCostUsd, 'reserved maxCostUsd'),\n          activation: 'reserved',\n        })\n      }\n      return reservation\n    },\n\n    activateGrant: async (input) => {\n      pruneExpiredState(reservations, recentSettlements, Date.now())\n      const request = immutableCandidateValue(input)\n      const key = reservationKey(request.executionId, request.preparationId)\n      if (recentSettlements.has(key)) throw new Error('protected model grant is already settled')\n      const state = reservations.get(key)\n      if (!state) throw new Error('protected model grant was not reserved by this port')\n      assertGrantIdentity(state, request)\n      if (state.settlementDigest) throw new Error('protected model grant is already settled')\n      if (state.activation !== 'reserved') {\n        throw new Error('protected model grant activation is single-use')\n      }\n      if (!Number.isSafeInteger(request.deadlineAtMs) || request.deadlineAtMs <= 0) {\n        throw new Error('protected model activation deadline must be a positive safe integer')\n      }\n      if (request.deadlineAtMs <= Date.now()) {\n        throw new Error('protected model activation deadline must be in the future')\n      }\n      if (request.deadlineAtMs > state.expiresAtMs) {\n        throw new Error('protected model activation deadline exceeds the reserved expiry')\n      }\n      state.activation = 'activating'\n      try {\n        const activation = validateActivation(\n          await options.client.activate(request),\n          state.limits.maxModelCalls === 0 ? [] : activationEnvNames,\n        )\n        if (recentSettlements.has(key) || reservations.get(key) !== state) {\n          throw new Error('protected model grant settled while activation was in flight')\n        }\n        state.activation = 'activated'\n        return activation\n      } catch (error) {\n        state.activation = 'reserved'\n        throw error\n      }\n    },\n\n    settleGrant: async (input) => {\n      const now = Date.now()\n      pruneExpiredState(reservations, recentSettlements, now)\n      const request = immutableCandidateValue(input)\n      const key = reservationKey(request.executionId, request.preparationId)\n      const state = reservations.get(key)\n      if (state) assertGrantIdentity(state, request)\n      const remembered = state ?? recentSettlements.get(key)\n      if (remembered?.settlementReason && remembered.settlementReason !== request.reason) {\n        throw new Error('protected model settlement retry changed the termination reason')\n      }\n\n      const sealed = sealAgentCandidateModelSettlement(await options.client.settle(request), {\n        preparationId: request.preparationId,\n        grantDigest: request.grantDigest,\n        model: request.resolved.model,\n      })\n      if (state) assertWithinReservedLimits(sealed.usage, state)\n\n      const settlementDigest = canonicalCandidateDigest(sealed.value)\n      if (remembered?.settlementDigest && remembered.settlementDigest !== settlementDigest) {\n        throw new Error('protected model settlement retry returned a different final ledger')\n      }\n      if (remembered?.settlementReason && remembered.settlementReason !== request.reason) {\n        throw new Error('protected model settlement retry changed the termination reason')\n      }\n      const expiresAtMs = state?.expiresAtMs ?? now + RECOVERED_SETTLEMENT_RETENTION_MS\n      if (state) {\n        state.settlementDigest = settlementDigest\n        state.settlementReason = request.reason\n      }\n      reservations.delete(key)\n      rememberSettlement(recentSettlements, key, {\n        settlementDigest,\n        settlementReason: request.reason,\n        expiresAtMs,\n      })\n      return sealed.value\n    },\n  }\n}\n\nfunction validateReserveInput(input: AgentCandidateModelGrantReserveInput): void {\n  if (!Number.isSafeInteger(input.expiresAtMs) || input.expiresAtMs <= 0) {\n    throw new Error('protected model reservation expiry must be a positive safe integer')\n  }\n  if (input.expiresAtMs <= Date.now()) {\n    throw new Error('protected model reservation expiry must be in the future')\n  }\n  for (const [name, value] of [\n    ['maxModelCalls', input.limits.maxModelCalls],\n    ['maxInputTokens', input.limits.maxInputTokens],\n    ['maxOutputTokens', input.limits.maxOutputTokens],\n  ] as const) {\n    if (!Number.isSafeInteger(value) || value < 0) {\n      throw new Error(`protected model reservation ${name} must be a nonnegative safe integer`)\n    }\n  }\n  usdToNanos(input.limits.maxCostUsd, 'reserved maxCostUsd')\n}\n\nfunction validateReservation(\n  value: unknown,\n  expected: AgentCandidateModelGrantReserveInput,\n  gatewayDomain: string,\n): AgentCandidateModelGrantReservation {\n  const source = exactRecord(\n    value,\n    ['preparationId', 'digest', 'expiresAtMs', 'enforcedLimits', 'network'],\n    'protected model reservation response',\n  )\n  if (source.preparationId !== expected.preparationId) {\n    throw new Error('protected model reservation response changed preparation identity')\n  }\n  if (!isSha256Digest(source.digest)) {\n    throw new Error('protected model reservation response has an invalid digest')\n  }\n  if (source.expiresAtMs !== expected.expiresAtMs) {\n    throw new Error('protected model reservation response changed expiry')\n  }\n  exactRecord(\n    source.enforcedLimits,\n    ['maxModelCalls', 'maxInputTokens', 'maxOutputTokens', 'maxCostUsd'],\n    'protected model reservation enforced limits',\n  )\n  if (\n    canonicalCandidateDigest(source.enforcedLimits) !== canonicalCandidateDigest(expected.limits)\n  ) {\n    throw new Error('protected model reservation response changed enforced limits')\n  }\n\n  const network = validateReservationNetwork(\n    source.network,\n    expected.limits.maxModelCalls,\n    gatewayDomain,\n  )\n  return immutableCandidateValue({\n    preparationId: source.preparationId,\n    digest: source.digest,\n    expiresAtMs: source.expiresAtMs,\n    enforcedLimits: source.enforcedLimits,\n    network,\n  }) as AgentCandidateModelGrantReservation\n}\n\nfunction validateReservationNetwork(\n  value: unknown,\n  maxModelCalls: number,\n  gatewayDomain: string,\n): AgentCandidateModelAccessNetwork {\n  if (maxModelCalls === 0) {\n    const source = exactRecord(value, ['mode'], 'protected model reservation network')\n    if (source.mode !== 'disabled') {\n      throw new Error('zero-call protected model reservation must disable gateway access')\n    }\n    return { mode: 'disabled' }\n  }\n\n  const source = exactRecord(value, ['mode', 'domains'], 'protected model reservation network')\n  if (source.mode !== 'gateway-only') {\n    throw new Error('protected model reservation must allow only its model gateway')\n  }\n  if (\n    !Array.isArray(source.domains) ||\n    source.domains.length !== 1 ||\n    source.domains[0] !== gatewayDomain\n  ) {\n    throw new Error('protected model reservation returned an unexpected gateway domain')\n  }\n  return { mode: 'gateway-only', domains: [gatewayDomain] }\n}\n\nfunction validateActivation(\n  value: unknown,\n  expectedNames: readonly string[],\n): AgentCandidateProtectedModelActivation {\n  const source = exactRecord(value, ['env'], 'protected model activation response')\n  const env = record(source.env, 'protected model activation environment')\n  const actualNames = Object.keys(env).sort()\n  if (\n    actualNames.length !== expectedNames.length ||\n    actualNames.some((name, index) => name !== expectedNames[index])\n  ) {\n    throw new Error('protected model activation returned unexpected environment names')\n  }\n  const detached: Record<string, string> = Object.create(null) as Record<string, string>\n  for (const name of expectedNames) {\n    const value = env[name]\n    if (typeof value !== 'string' || value.length < 8 || value.length > 65_536) {\n      throw new Error(`protected model activation ${name} must be a non-empty protected value`)\n    }\n    detached[name] = value\n  }\n  return Object.freeze({ env: Object.freeze(detached) })\n}\n\nfunction validateResolvedModel(\n  value: unknown,\n  expected: Parameters<AgentCandidateModelPort['resolve']>[0],\n): AgentCandidateResolvedModel {\n  const source = exactRecord(\n    value,\n    ['requested', 'provider', 'model', 'snapshot', 'reasoningEffort'],\n    'resolved candidate model',\n  )\n  if (source.requested !== expected.requested) {\n    throw new Error('model resolver changed the evaluator-owned request')\n  }\n  if (source.reasoningEffort !== expected.reasoningEffort) {\n    throw new Error('model resolver changed the evaluator-owned reasoning effort')\n  }\n  for (const name of ['requested', 'provider', 'model', 'snapshot'] as const) {\n    if (typeof source[name] !== 'string' || source[name].length === 0) {\n      throw new Error(`resolved candidate model ${name} must be non-empty`)\n    }\n  }\n  return source as unknown as AgentCandidateResolvedModel\n}\n\nfunction assertGrantIdentity(\n  expected: RememberedReservation,\n  actual: AgentCandidateModelGrantActivateInput | AgentCandidateModelGrantSettleInput,\n): void {\n  if (\n    actual.executionId !== expected.executionId ||\n    actual.preparationId !== expected.preparationId ||\n    actual.grantDigest !== expected.grantDigest ||\n    canonicalCandidateDigest(actual.resolved) !== canonicalCandidateDigest(expected.resolved)\n  ) {\n    throw new Error('protected model grant input does not match its immutable reservation')\n  }\n}\n\nfunction assertWithinReservedLimits(\n  usage: {\n    modelCalls: number\n    inputTokens: number\n    outputTokens: number\n    costUsdNanos: number\n  },\n  reservation: RememberedReservation,\n): void {\n  for (const [name, actual, limit] of [\n    ['model calls', usage.modelCalls, reservation.limits.maxModelCalls],\n    ['input tokens', usage.inputTokens, reservation.limits.maxInputTokens],\n    ['output tokens', usage.outputTokens, reservation.limits.maxOutputTokens],\n    ['cost USD nanos', usage.costUsdNanos, reservation.maxCostUsdNanos],\n  ] as const) {\n    if (actual > limit) {\n      throw new Error(`protected model settlement ${name} ${actual} exceeds reserved ${limit}`)\n    }\n  }\n}\n\nfunction exactEnvironmentNames(values: readonly string[]): readonly string[] {\n  if (values.length === 0) {\n    throw new Error('protected model activation environment names must not be empty')\n  }\n  const names = [...values].sort()\n  if (new Set(names).size !== names.length) {\n    throw new Error('protected model activation environment names must be unique')\n  }\n  for (const name of names) {\n    if (\n      !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) ||\n      ['__proto__', 'constructor', 'prototype'].includes(name)\n    ) {\n      throw new Error(`protected model activation environment name is invalid: ${name}`)\n    }\n  }\n  return Object.freeze(names)\n}\n\nfunction assertGatewayDomain(value: string): string {\n  if (\n    value.length > 253 ||\n    value !== value.toLowerCase() ||\n    value.endsWith('.') ||\n    value.includes(':') ||\n    value === 'localhost' ||\n    value.endsWith('.localhost') ||\n    value === 'metadata.google' ||\n    value === 'metadata.google.internal'\n  ) {\n    throw new Error('protected model gateway must be an exact lowercase public DNS name')\n  }\n  const labels = value.split('.')\n  if (\n    labels.length < 2 ||\n    !labels.every(\n      (label) =>\n        label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label),\n    ) ||\n    !/[a-z]/.test(labels.at(-1) ?? '')\n  ) {\n    throw new Error('protected model gateway must be an exact lowercase public DNS name')\n  }\n  return value\n}\n\nfunction reservationKey(executionId: string, preparationId: string): string {\n  return canonicalCandidateDigest({ executionId, preparationId })\n}\n\nfunction pruneExpiredState(\n  reservations: Map<string, RememberedReservation>,\n  settlements: Map<string, RememberedSettlement>,\n  now: number,\n): void {\n  for (const [key, value] of reservations) {\n    if (value.expiresAtMs <= now) reservations.delete(key)\n  }\n  for (const [key, value] of settlements) {\n    if (value.expiresAtMs <= now) settlements.delete(key)\n  }\n}\n\nfunction rememberSettlement(\n  settlements: Map<string, RememberedSettlement>,\n  key: string,\n  value: RememberedSettlement,\n): void {\n  settlements.delete(key)\n  settlements.set(key, value)\n  while (settlements.size > MAX_RECENT_SETTLEMENTS) {\n    const oldest = settlements.keys().next().value\n    if (oldest === undefined) return\n    settlements.delete(oldest)\n  }\n}\n\nfunction isSha256Digest(value: unknown): value is Sha256Digest {\n  return typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value)\n}\n\nfunction exactRecord(\n  value: unknown,\n  keys: readonly string[],\n  label: string,\n): Record<string, unknown> {\n  const source = record(value, label)\n  assertExactObjectKeys(source, keys, label)\n  return source\n}\n\nfunction record(value: unknown, label: string): Record<string, unknown> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`${label} must be an object`)\n  }\n  const prototype = Object.getPrototypeOf(value)\n  if (prototype !== Object.prototype && prototype !== null) {\n    throw new Error(`${label} must be a plain object`)\n  }\n  return value as Record<string, unknown>\n}\n"],"mappings":";;;;AAgCA,MAAM,+BAA+B;AACrC,MAAM,gCAAgC,KAAK;;AA2B3C,SAAgB,wCACd,SAC4B;CAC5B,OAAO,IAAI,mCAAmC,OAAO;AACvD;AAEA,IAAM,qCAAN,MAA+E;CAShD;CAR7B,yBAA0B,IAAI,IAAkC;CAChE;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAAgE;EAA/C,KAAA,UAAA;EAC3B,IAAI,CAAC,QAAQ,SAAS,cACpB,MAAM,IAAI,MACR,+BAA+B,QAAQ,SAAS,KAAK,qCACvD;EAEF,KAAK,eAAe,QAAQ,SAAS;EACrC,KAAK,YAAY,eAAe,QAAQ,SAAS;EACjD,KAAK,qBAAqB,gBACxB,QAAQ,sBAAsB,8BAC9B,iCACF;EACA,KAAK,sBAAsB,gBACzB,QAAQ,uBAAuB,+BAC/B,kCACF;EACA,KAAK,kBAAkB,QAAQ,kBAC3B,wBAAwB,QAAQ,eAAe,IAC/C,KAAA;CACN;CAEA,MAAM,QACJ,SACA,SACA;EACA,uBAAuB,OAAO;EAC9B,MAAM,UAAU,QAAQ,UAAU,KAAK;EACvC,IAAI,QAAQ,SAAS,UAAU,MAAM,IAAI,MAAM,gDAAgD;EAC/F,MAAM,UAAU,QAAQ,cAAc,MAAM,SAAS,MAAM,OAAO;EAClE,MAAM,SACJ,QAAQ,SAAS,aACZ,EAAE,MAAM,UAAU,IAClB;GAAE,MAAM;GAAU,cAAc,CAAC,GAAG,QAAQ,OAAO;EAAE;EAC5D,MAAM,KAAK,iBAAiB,OAAO,IAAI;EACvC,QAAQ,OAAO,eAAe;EAE9B,MAAM,MAAM,aAAa,QAAQ,aAAa,QAAQ,cAAc,MAAM,MAAM;EAChF,IAAI,KAAK,OAAO,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,mDAAmD;EAC7F,MAAM,QAAQ,WACZ,QAAQ,cAAc,MAAM,SAAS,UAAU,OAC/C,QAAQ,cAAc,MAAM,SAAS,UAAU,cACjD;EACA,MAAM,gBAAgB,sBACpB,QAAQ,WAAW,WACnB,KAAK,mBACP;EAcA,MAAM,oBAAoB,yBAbH,wBAAwB;GAC7C,MAAM;GACN,UAAU,KAAK,QAAQ,SAAS;GAChC,aAAa,QAAQ;GACrB,qBAAqB,QAAQ,cAAc,MAAM;GACjD;GACA;GACA;GACA,oBAAoB,KAAK;GACzB,WAAW,KAAK;GAChB,QAAQ;IAAE,WAAW,QAAQ;IAAW,UAAU,QAAQ;GAAS;GACnE,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;EAC1E,CACgE,CAAC;EACjE,MAAM,WAAW,wBAAwB;GACvC,MAAM;GACN,UAAU,KAAK,QAAQ,SAAS;GAChC,aAAa,QAAQ;GACrB,qBAAqB,QAAQ,cAAc,MAAM;GACjD;GACA,iBAAiB,QAAQ;GACzB,gBAAgB,QAAQ;EAC1B,CAAC;EACD,MAAM,cAAc,MAAM,KAAK,aAAa,OAAO;GACjD;GACA;GACA;GACA,oBAAoB,KAAK;GACzB,WAAW,KAAK;GAChB;GACA,gBAAgB,wBACd,QAAQ,aACR,QAAQ,cAAc,MAAM,MAC9B;GACA,QAAQ,QAAQ;GAChB,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;EAC1E,CAAC;EACD,IAAI;GACF,2BAA2B,aAAa,UAAU,KAAK,QAAQ,SAAS,IAAI;EAC9E,SAAS,OAAO;GACd,IAAI;IACF,MAAM,YAAY,QAAQ;GAC5B,SAAS,cAAc;IACrB,MAAM,IAAI,eACR,CAAC,OAAO,YAAY,GACpB,kDACF;GACF;GACA,MAAM;EACR;EACA,MAAM,QAA8B,EAAE,YAAY;EAClD,KAAK,OAAO,IAAI,KAAK,KAAK;EAG1B,KAAI,MADmB,YAAY,QAAQ,KAAK,EAAA,CACnC,WAAW,GACtB,MAAM,IAAI,MAAM,wDAAwD;EAE1E,MAAM,mBAAmB,aAAa,SAAS,QAAQ,MAAM;EAC7D,MAAM,SAAS,YAAY,OAAO;EAClC,MAAM,YAAY,KAAK,IAAI;EAC3B,MAAM,QAAQ;GACZ,OAAO,QAAQ,MAAM;GACrB,YAAY,QAAQ,UAAU,KAAK,SAAS;GAC5C;GACA,cAAc,QAAQ;GACtB,WAAW,QAAQ,WAAW;GAC9B,MAAM;IACJ,GAAG,QAAQ,MAAM;IACjB,eAAe,YAAY;IAC3B,qBAAqB,YAAY;GACnC;GACA,SAAS;EACX;EACA,MAAM,UAAU,MAAM,YAAY,QAAQ,MAAM,QAAQ,EAAE,QAAQ,QAAQ,OAAO,CAAC;EAClF,MAAM,gBAAgB,cAAc,SAAS,QAAQ,QAAQ;EAC7D,cAAmB,YAAY,KAAA,CAAS;EACxC,IAAI;EACJ,IAAI,gBAAgB;EACpB,MAAM,eAAe;GACnB,IAAI,CAAC,eAAe,iBAAiB,YAAY,OAAO;EAC1D;EACA,QAAQ,OAAO,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;EAC/D,IAAI,QAAQ,OAAO,SAAS,OAAO;EACnC,IAAI;GACF,MAAM,cAAc,MAAM,QAAQ,KAAK;GACvC,gBAAgB;GAChB,QAAQ,OAAO,oBAAoB,SAAS,MAAM;GAClD,IAAI,cAAc,MAAM;GACxB,MAAM,SAAS,MAAM,QAAQ,OAAO;GACpC,qBAAqB,QAAQ,WAAW;GACxC,MAAM,SAAS,MAAM,YAAY,eAAe,QAAQ,QAAQ,QAAQ,YAAY;GACpF,MAAM,cAAc;GACpB,MAAM,wBAAwB,OAAO,QAAQ,YAAY,MAAM;GAC/D,OAAO;IAAE,aAAa,QAAQ;IAAa;GAAY;EACzD,UAAU;GACR,QAAQ,OAAO,oBAAoB,SAAS,MAAM;EACpD;CACF;CAEA,MAAM,KACJ,SACA,SACqC;EACrC,MAAM,KAAK,iBAAiB;EAC5B,QAAQ,OAAO,eAAe;EAC9B,MAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,IAAI;EACpD,IAAI,CAAC,aAAa,OAAO,EAAE,SAAS,KAAK;EACzC,IAAI,WAAW,MAAM,YAAY,QAAQ,KAAK;EAC9C,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,MAAM,oEAAoE;EAEtF,MAAM,SAAS,SAAS;EACxB,IAAI,QAAQ,SAAS;GACnB,MAAM,UAAU,MAAM,YAAY,QAAQ,IAAI,OAAO,GAAG;GACxD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,uDAAuD;GACrF,MAAM,YAAY,OAAO;EAC3B;EACA,QAAQ,OAAO,eAAe;EAC9B,WAAW,MAAM,YAAY,QAAQ,KAAK;EAC1C,IAAI,SAAS,MAAM,UAAU,MAAM,OAAO,GACxC,MAAM,IAAI,MAAM,mDAAmD;EAErE,MAAM,cAAc,SAAS;EAC7B,IAAI,aAAa,qBAAqB,WAAW;EACjD,MAAM,QAAQ,KAAK,OAAO,IAAI,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;EAC5F,IAAI,OAAO;GACT,MAAM,cAAc,aAAa,eAAe,MAAM;GACtD,IAAI,QAAQ,WAAW,aAAa,MAAM,OACxC,MAAM,qBAAqB;IACzB,MAAM;IACN,WAAW,MAAM,MAAM;GACzB;GAEF,MAAM,wBAAwB,OAAO,QAAQ,YAAY,WAAW;EACtE;EACA,OAAO,EAAE,SAAS,KAAK;CACzB;CAEA,MAAM,QACJ,SACA,SACA;EACA,MAAM,KAAK,iBAAiB;EAC5B,QAAQ,OAAO,eAAe;EAC9B,MAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,KAAK;EACrD,MAAM,WAAW,MAAM,YAAY,QAAQ,KAAK;EAChD,MAAM,SAAS,SAAS;EACxB,IAAI,SAAS,WAAW,KAAK,CAAC,UAAU,OAAO,SAC7C,MAAM,IAAI,MAAM,uEAAuE;EAEzF,qBAAqB,MAAM;EAC3B,MAAM,UAAU,MAAM,YAAY,QAAQ,IAAI,OAAO,GAAG;EACxD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,wDAAwD;EAEtF,qBAAqB,MADO,QAAQ,OAAO,GACP,OAAO,WAAW;EACtD,MAAM,QAAQ,KAAK,OAAO,IAAI,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;EAC5F,MAAM,SACJ,OAAO,UACN,MAAM,YACL,cAAc,SAAS,WAAW,WAAW,CAAC,CAAC,QAAQ,GACvD,QAAQ,QACR,KAAK,IAAI,IAAI,KAAK,kBACpB;EACF,QAAQ,OAAO,eAAe;EAC9B,MAAM,WAAW,wBAAwB;GACvC,MAAM;GACN,UAAU,YAAY;GACtB,eAAe,YAAY;GAC3B,aAAa,QAAQ;GACrB,qBAAqB,QAAQ;GAC7B,mBAAmB,YAAY,UAAU;GACzC,SAAS;IACP,KAAK,OAAO;IACZ,UAAU,OAAO;IACjB,GAAI,OAAO,aAAa,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC;IAC7D,aAAa,OAAO;GACtB;GACA,GAAI,OAAO,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;GACpF,QAAQ;IAAE,QAAQ,YAAY,MAAM;IAAG,YAAY,OAAO;GAAW;EACvE,CAAC;EACD,OAAO;GACL,aAAa;IAAE,MAAM;IAAmB,OAAO;GAAO;GACtD;EACF;CACF;CAEA,MAAM,QACJ,SACA,SACsC;EACtC,MAAM,KAAK,iBAAiB;EAC5B,QAAQ,OAAO,eAAe;EAC9B,MAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,IAAI;EACpD,IAAI,CAAC,aAAa,OAAO,EAAE,UAAU,KAAK;EAC1C,IAAI;EACJ,IAAI;GACF,MAAM,YAAY,QAAQ;EAC5B,SAAS,OAAO;GACd,eAAe;EACjB;EAEA,IAAI,MADoB,KAAK,aAAa,IAAI,YAAY,EAAE,GAE1D,MAAM,IAAI,MAAM,oDAAoD,EAAE,OAAO,aAAa,CAAC;EAE7F,QAAQ,OAAO,eAAe;EAC9B,KAAK,OAAO,OAAO,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;EACjF,OAAO,EAAE,UAAU,KAAK;CAC1B;CAEA,MAAc,iBAAiB,MAA4C;EACzE,MAAM,UACJ,KAAK,uBAAuB,QAAQ,QAAQ,KAAK,QAAQ,SAAS,aAAa,CAAC;EAClF,KAAK,sBAAsB;EAC3B,IAAI;EACJ,IAAI;GACF,eAAe,MAAM;EACvB,SAAS,OAAO;GACd,IAAI,KAAK,wBAAwB,SAAS,KAAK,sBAAsB,KAAA;GACrE,MAAM;EACR;EACA,MAAM,QAAQ,aAAa;EAC3B,IAAI,CAAC,OACH,MAAM,IAAI,MACR,+BAA+B,KAAK,QAAQ,SAAS,KAAK,yCAC5D;EAEF,IAAI,QAAQ,CAAC,MAAM,OAAO,SAAS,IAAI,GACrC,MAAM,IAAI,MACR,+BAA+B,KAAK,QAAQ,SAAS,KAAK,qBAAqB,KAAK,cACtF;CAEJ;CAUA,MAAc,QACZ,SACA,kBACmD;EACnD,MAAM,MAAM,aAAa,QAAQ,aAAa,QAAQ,mBAAmB;EACzE,MAAM,SAAS,KAAK,OAAO,IAAI,GAAG,CAAC,EAAE;EACrC,IAAI,QAAQ,OAAO;EACnB,MAAM,WAAW;GACf,MAAM;GACN,UAAU,KAAK,QAAQ,SAAS;GAChC,aAAa,QAAQ;GACrB,qBAAqB,QAAQ;EAC/B;EAKA,MAAM,WAAU,MAJK,KAAK,aAAa,KAAK;GAC1C;GACA,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;EAC1E,CAAC,EAAA,CACsB,QACpB,gBACC,YAAY,aAAa,KAAK,QAAQ,SAAS,QAC/C,OAAO,QAAQ,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,WACrC,kBAAkB,YAAY,WAAW,OAAO,KAAK,CACvD,CACJ;EACA,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,MAAM,mEAAmE;EAErF,MAAM,cAAc,QAAQ;EAC5B,IAAI,CAAC,aAAa;GAChB,IAAI,kBAAkB,OAAO,KAAA;GAC7B,MAAM,IAAI,MAAM,iDAAiD;EACnE;EACA,IAAI,CAACA,iBAAe,YAAY,UAAU,iBAAiB,GACzD,MAAM,IAAI,MAAM,4DAA4D;EAE9E,KAAK,OAAO,IAAI,KAAK,EAAE,YAAY,CAAC;EACpC,OAAO;CACT;AACF;AAEA,eAAe,wBACb,OACA,YACA,QACe;CACf,MAAM,QAAQ,MAAM;CACpB,IAAI,CAAC,SAAS,MAAM,SAAS;CAC7B,MAAM,UAAU,KAAK,IAAI,MAAM,WAAW,KAAK,IAAI,KAAK,IAAI,GAAG,MAAM,YAAY,CAAC;CAClF,MAAM,cAAc,MAAM,sBAAsB,MAAM,eAAe,QAAQ;CAC7E,MAAM,WAAW,UAAU;EACzB,OAAO,MAAM;EACb,YAAY,MAAM;EAClB,WAAW,MAAM;EACjB;EACA,QAAQ,aAAa,SAAS,UAAU,YAAY,aAAa,IAAI,cAAc;EACnF,MAAM,MAAM;CACd,CAAC;CACD,MAAM,UAAU;AAClB;AAEA,SAAS,uBAAuB,SAA8C;CAC5E,IAAI,QAAQ,UAAU,KAAK,QAAQ,SAAS,UAC1C,MAAM,IAAI,MACR,gFACF;CAEF,IAAI,QAAQ,cAAc,MAAM,SAAS,aAAa,cAAc,QAAQ,OAAO,WACjF,MAAM,IAAI,MAAM,6EAA6E;CAE/F,IAAI,QAAQ,OAAO,SAAS,YAC1B,MAAM,IAAI,MAAM,mEAAmE;CAErF,MAAM,YAAY,QAAQ,UAAU,KAAK,QAAQ,UAAU,YAAY;CACvE,IACE,EACE,UAAU,WAAW,OAAO,KAC5B,cAAc,sBACd,UAAU,SAAS,OAAO,IAG5B,MAAM,IAAI,MAAM,4EAA4E;CAE9F,IAAI,CAAC,MAAM,WAAW,QAAQ,OAAO,UAAU,KAAK,CAAC,QAAQ,OAAO,IAAI,MAAM,KAAK,GACjF,MAAM,IAAI,MAAM,8EAA8E;AAElG;AAEA,eAAe,mBACb,aACA,SACA,QACe;CACf,MAAM,iBAAiB,gCAAgC,OAAO;CAC9D,KAAK,MAAM,QAAQ,QAAQ,OAAO,KAAK,OACrC,MAAM,YAAY,UAAU,QAAQ,QAAQ,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,OAAO;EAClF,MAAM,KAAK;EACX;CACF,CAAC;CAEH,MAAM,cACJ,QAAQ,cAAc,MAAM,SAAS,QAAQ,oBAAoB,SAC7D,QAAQ,MAAM,WACd,QAAQ,MAAM;CACpB,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,+CAA+C;CACjF,KAAK,MAAM,QAAQ,QAAQ,kBAAkB,OAC3C,MAAM,YAAY,UAChB,QAAQ,aAAa,KAAK,IAAI,GAC9B,OAAO,KAAK,KAAK,SAAS,MAAM,GAChC;EAAE,MAAM,KAAK;EAAM;CAAO,CAC5B;CAEF,IAAI,QAAQ,aAAa,gBAAgB;EACvC,KAAK,MAAM,QAAQ,QAAQ,UAAU,OACnC,MAAM,YAAY,UAAU,QAAQ,eAAe,MAAM,KAAK,IAAI,GAAG,KAAK,OAAO;GAC/E,MAAM,KAAK;GACX;EACF,CAAC;EAEH,IAAI,QAAQ,UAAU,mBAAmB,eAAe,iBACtD,MAAM,YAAY,UAChB,eAAe,iBACf,QAAQ,UAAU,iBAClB;GAAE,MAAM;GAAO;EAAO,CACxB;CAEJ;CACA,IAAI,QAAQ,YAAY,SAAS,SAAS,aACxC,MAAM,YAAY,UAAU,QAAQ,YAAY,SAAS,MAAM,QAAQ,YAAY,OAAO;EACxF,MAAM;EACN;CACF,CAAC;AAEL;AAEA,SAAS,gCACP,SACiE;CACjE,MAAM,YAAY,QAAQ;CAC1B,IAAI,CAAC,WAAW;EACd,IACE,QAAQ,OAAO,IAAA,uCAAsC,KAAA,KACrD,QAAQ,OAAO,IAAA,mDAAkD,KAAA,GAEjE,MAAM,IAAI,MAAM,sEAAsE;EAExF;CACF;CACA,MAAM,QAAQ,iCACZ,QAAQ,MAAM,UACd,UAAU,oBAAoB,KAAA,CAChC;CACA,IACE,QAAQ,OAAO,IAAA,uCAAsC,MAAM,QAC3D,QAAQ,OAAO,IAAA,mDAAkD,MAAM,iBAEvE,MAAM,IAAI,MAAM,sEAAsE;CAExF,MAAM,WAAW,CAAC,MAAM,MAAM,MAAM,eAAe,CAAC,CAAC,QAClD,UAA2B,UAAU,KAAA,CACxC;CACA,MAAM,cACJ,QAAQ,cAAc,MAAM,SAAS,QAAQ,oBAAoB,SAC7D,QAAQ,MAAM,WACd,QAAQ,MAAM;CAUpB,IACE;EATA,GAAG,QAAQ,OAAO,KAAK,MAAM,KAAK,SAAS,QAAQ,QAAQ,MAAM,UAAU,KAAK,IAAI,CAAC;EACrF,GAAI,cACA,QAAQ,kBAAkB,MAAM,KAAK,SAAS,QAAQ,aAAa,KAAK,IAAI,CAAC,IAC7E,CAAC;EACL,GAAI,QAAQ,YAAY,SAAS,SAAS,cACtC,CAAC,QAAQ,YAAY,SAAS,IAAI,IAClC,CAAC;CAGI,CAAC,CAAC,MAAM,SACf,SAAS,MACN,iBACC,SAAS,gBACT,KAAK,WAAW,GAAG,aAAa,EAAE,KAClC,aAAa,WAAW,GAAG,KAAK,EAAE,CACtC,CACF,GAEA,MAAM,IAAI,MAAM,0DAA0D;CAE5E,OAAO;AACT;AAEA,SAAS,YAAY,SAAiE;CACpF,MAAM,cAAc,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,QAAQ,YAAY,KAAK;CAC9F,MAAM,OAAO;EACX,YAAY,QAAQ,OAAO;EAC3B,MAAM,QAAQ,OAAO;EACrB,KAAK,QAAQ,OAAO;EACpB,KAAK,QAAQ,OAAO;EACpB,WAAW;CACb;CACA,QAAQ,QAAQ,YAAY,SAAS,MAArC;EACE,KAAK,eACH,OAAO;GAAE,GAAG;GAAM,MAAM,CAAC,GAAG,KAAK,MAAM,WAAW;EAAE;EACtD,KAAK,cACH,OAAO;GAAE,GAAG;GAAM,OAAO;EAAY;EACvC,KAAK,aACH,OAAO;CACX;AACF;AAEA,eAAe,cAAc,SAA4B,UAAuC;CAC9F,MAAM,SAAmB,CAAC;CAC1B,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ,OAAO,GAAG;EAC1C,MAAM,QAAQ,OAAO,KAAK,OAAO,MAAM;EACvC,cAAc,MAAM;EACpB,IAAI,aAAa,UAAU;GACzB,IAAI;GACJ,IAAI;IACF,MAAM,YAAY,OAAO;GAC3B,SAAS,OAAO;IACd,YAAY;GACd;GACA,MAAM,IAAI,MAAM,gCAAgC,SAAS,gBAAgB,EACvE,OAAO,UACT,CAAC;EACH;EACA,OAAO,KAAK,KAAK;CACnB;CACA,OAAO,WAAW,KAAK,OAAO,OAAO,QAAQ,UAAU,CAAC;AAC1D;AAEA,eAAe,YACb,QACA,QACA,cACqB;CACrB,OAAO,eAAe;CACtB,MAAM,cAAc,eAAe,KAAK,IAAI;CAC5C,IAAI,eAAe,GAAG,MAAM,IAAI,MAAM,mCAAmC;CACzE,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,QACA,IAAI,SAAgB,UAAU,WAAW;GACvC,gBAAgB,OAAO,OAAO,0BAAU,IAAI,MAAM,4BAA4B,CAAC;GAC/E,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;GACxD,QAAQ,iBACA,uBAAO,IAAI,MAAM,mCAAmC,CAAC,GAC3D,WACF;EACF,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,SAAS,OAAO,oBAAoB,SAAS,OAAO;EACxD,IAAI,OAAO,aAAa,KAAK;CAC/B;AACF;AAEA,eAAe,YAAY,SAA2C;CAEpE,IAAI,EAAC,MADgB,QAAQ,OAAO,EAAA,CACxB,SAAS;CACrB,IAAI;EACF,MAAM,QAAQ,KAAK;CACrB,SAAS,OAAO;EACd,KAAK,MAAM,QAAQ,OAAO,EAAA,CAAG,SAAS,MAAM;CAC9C;CACA,MAAM,cAAc,MAAM,QAAQ,KAAK;CACvC,qBAAqB,MAAM,QAAQ,OAAO,GAAG,WAAW;AAC1D;AAEA,SAAS,qBACP,QACA,UACwF;CACxF,IAAI,OAAO,WAAW,CAAC,OAAO,aAC5B,MAAM,IAAI,MAAM,sDAAsD;CAExE,IAAI,YAAY,CAAC,kBAAkB,OAAO,aAAa,QAAQ,GAC7D,MAAM,IAAI,MAAM,mEAAmE;AAEvF;AAEA,SAAS,2BACP,aACA,UACA,cACM;CACN,IAAI,CAAC,YAAY,MAAM,YAAY,aAAa,cAC9C,MAAM,IAAI,MAAM,gEAAgE;CAElF,IACE,CAAC,OAAO,QAAQ,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,WACtC,kBAAkB,YAAY,WAAW,OAAO,KAAK,CACvD,GAEA,MAAM,IAAI,MAAM,qEAAqE;AAEzF;AAEA,SAAS,WAAW,aAAiE;CACnF,MAAM,WAAW,YAAY,UAAU;CACvC,IAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,OAAO,QAAQ,IAAI,GACxD,MAAM,IAAI,MAAM,qDAAqD;CAEvE,OAAO,EAAE,UAAU,OAAO,QAAQ,EAAE;AACtC;AAEA,SAAS,aAAa,aAAqB,qBAA2C;CACpF,OAAO,GAAG,YAAY,IAAI;AAC5B;AAEA,SAAS,wBAAwB,aAAqB,qBAA2C;CAC/F,OAAO,aAAa,yBAAyB;EAC3C,MAAM;EACN;EACA;CACF,CAAC,CAAC,CAAC,MAAM,CAAgB;AAC3B;AAEA,SAAS,WAAW,OAAe,gBAAsC;CACvE,IAAIA,iBAAe,KAAK,GAAG;EACzB,IAAI,UAAU,gBACZ,MAAM,IAAI,MAAM,gEAAgE;EAElF,OAAO;CACT;CACA,MAAM,SAAS,MAAM,YAAY,GAAG;CACpC,IAAI,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG;CACnC,IAAI,MAAM,MAAM,SAAS,CAAC,MAAM,gBAC9B,MAAM,IAAI,MAAM,gEAAgE;CAElF,OAAO;AACT;AAEA,SAAS,sBAAsB,WAAmB,aAA6B;CAC7E,MAAM,QAAQ,gBAAgB,WAAW,6BAA6B,IAAI;CAC1E,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG,MAAM,IAAI,MAAM,6CAA6C;CAC/F,OAAO,KAAK,KAAK,QAAQ,GAAK,IAAI;AACpC;AAEA,SAAS,eAAe,WAAmE;CACzF,IAAI,CAAC,OAAO,SAAS,UAAU,GAAG,KAAK,UAAU,OAAO,GACtD,MAAM,IAAI,MAAM,+CAA+C;CAEjE,OAAO,OAAO,OAAO;EACnB,KAAK,UAAU;EACf,UAAU,gBAAgB,UAAU,UAAU,sBAAsB;EACpE,QAAQ,gBAAgB,UAAU,QAAQ,oBAAoB;CAChE,CAAC;AACH;AAEA,SAAS,gBAAgB,OAAe,OAAuB;CAC7D,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAC1C,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CACvD,OAAO;AACT;AAEA,SAAS,QAAQ,MAAc,cAA8B;CAC3D,IAAI,MAAM,WAAW,YAAY,GAAG,MAAM,IAAI,MAAM,uCAAuC;CAC3F,MAAM,OAAO,MAAM,UAAU,YAAY;CACzC,IAAI,SAAS,QAAQ,KAAK,WAAW,KAAK,GACxC,MAAM,IAAI,MAAM,iDAAiD;CAEnE,OAAO,MAAM,KAAK,MAAM,IAAI;AAC9B;AAEA,SAASA,iBAAe,OAAuC;CAC7D,OAAO,OAAO,UAAU,YAAY,wBAAwB,KAAK,KAAK;AACxE;;;AC1oBA,MAAM,yBAAyB;AAC/B,MAAM,oCAAoC,MAAU;;;;;;;;AASpD,SAAgB,uCACd,SACyB;CACzB,MAAM,gBAAgB,oBAAoB,QAAQ,aAAa;CAC/D,MAAM,qBAAqB,sBAAsB,QAAQ,kBAAkB;CAC3E,MAAM,+BAAe,IAAI,IAAmC;CAC5D,MAAM,oCAAoB,IAAI,IAAkC;CAEhE,OAAO;EACL,SAAS,OAAO,UAAU;GACxB,MAAM,UAAU,wBAAwB,KAAK;GAE7C,OAAO,wBADU,sBAAsB,MAAM,QAAQ,aAAa,OAAO,GAAG,OACtC,CAAC;EACzC;EAEA,cAAc,OAAO,UAAU;GAC7B,kBAAkB,cAAc,mBAAmB,KAAK,IAAI,CAAC;GAC7D,MAAM,UAAU,wBAAwB,KAAK;GAC7C,qBAAqB,OAAO;GAC5B,MAAM,gBAAgB,yBAAyB,OAAO;GACtD,MAAM,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;GACrE,IAAI,kBAAkB,IAAI,GAAG,GAC3B,MAAM,IAAI,MAAM,gDAAgD;GAElE,MAAM,WAAW,aAAa,IAAI,GAAG;GACrC,IAAI,YAAY,SAAS,kBAAkB,eACzC,MAAM,IAAI,MAAM,2DAA2D;GAG7E,MAAM,cAAc,oBAClB,MAAM,QAAQ,OAAO,QAAQ,OAAO,GACpC,SACA,aACF;GACA,MAAM,iBAAiB,yBAAyB,WAAW;GAC3D,IAAI,kBAAkB,IAAI,GAAG,GAC3B,MAAM,IAAI,MAAM,mEAAmE;GAErF,MAAM,WAAW,YAAY,aAAa,IAAI,GAAG;GACjD,IAAI,YAAY,SAAS,kBAAkB,eACzC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,IAAI,YAAY,SAAS,mBAAmB,gBAC1C,MAAM,IAAI,MAAM,+DAA+D;GAEjF,IAAI,CAAC,UACH,aAAa,IAAI,KAAK;IACpB;IACA;IACA,aAAa,QAAQ;IACrB,eAAe,QAAQ;IACvB,aAAa,YAAY;IACzB,aAAa,QAAQ;IACrB,UAAU,wBAAwB,QAAQ,QAAQ;IAClD,QAAQ,wBAAwB,QAAQ,MAAM;IAC9C,iBAAiB,WAAW,QAAQ,OAAO,YAAY,qBAAqB;IAC5E,YAAY;GACd,CAAC;GAEH,OAAO;EACT;EAEA,eAAe,OAAO,UAAU;GAC9B,kBAAkB,cAAc,mBAAmB,KAAK,IAAI,CAAC;GAC7D,MAAM,UAAU,wBAAwB,KAAK;GAC7C,MAAM,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;GACrE,IAAI,kBAAkB,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,0CAA0C;GAC1F,MAAM,QAAQ,aAAa,IAAI,GAAG;GAClC,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,qDAAqD;GACjF,oBAAoB,OAAO,OAAO;GAClC,IAAI,MAAM,kBAAkB,MAAM,IAAI,MAAM,0CAA0C;GACtF,IAAI,MAAM,eAAe,YACvB,MAAM,IAAI,MAAM,gDAAgD;GAElE,IAAI,CAAC,OAAO,cAAc,QAAQ,YAAY,KAAK,QAAQ,gBAAgB,GACzE,MAAM,IAAI,MAAM,qEAAqE;GAEvF,IAAI,QAAQ,gBAAgB,KAAK,IAAI,GACnC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,IAAI,QAAQ,eAAe,MAAM,aAC/B,MAAM,IAAI,MAAM,iEAAiE;GAEnF,MAAM,aAAa;GACnB,IAAI;IACF,MAAM,aAAa,mBACjB,MAAM,QAAQ,OAAO,SAAS,OAAO,GACrC,MAAM,OAAO,kBAAkB,IAAI,CAAC,IAAI,kBAC1C;IACA,IAAI,kBAAkB,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,MAAM,OAC1D,MAAM,IAAI,MAAM,8DAA8D;IAEhF,MAAM,aAAa;IACnB,OAAO;GACT,SAAS,OAAO;IACd,MAAM,aAAa;IACnB,MAAM;GACR;EACF;EAEA,aAAa,OAAO,UAAU;GAC5B,MAAM,MAAM,KAAK,IAAI;GACrB,kBAAkB,cAAc,mBAAmB,GAAG;GACtD,MAAM,UAAU,wBAAwB,KAAK;GAC7C,MAAM,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;GACrE,MAAM,QAAQ,aAAa,IAAI,GAAG;GAClC,IAAI,OAAO,oBAAoB,OAAO,OAAO;GAC7C,MAAM,aAAa,SAAS,kBAAkB,IAAI,GAAG;GACrD,IAAI,YAAY,oBAAoB,WAAW,qBAAqB,QAAQ,QAC1E,MAAM,IAAI,MAAM,iEAAiE;GAGnF,MAAM,SAAS,kCAAkC,MAAM,QAAQ,OAAO,OAAO,OAAO,GAAG;IACrF,eAAe,QAAQ;IACvB,aAAa,QAAQ;IACrB,OAAO,QAAQ,SAAS;GAC1B,CAAC;GACD,IAAI,OAAO,2BAA2B,OAAO,OAAO,KAAK;GAEzD,MAAM,mBAAmB,yBAAyB,OAAO,KAAK;GAC9D,IAAI,YAAY,oBAAoB,WAAW,qBAAqB,kBAClE,MAAM,IAAI,MAAM,oEAAoE;GAEtF,IAAI,YAAY,oBAAoB,WAAW,qBAAqB,QAAQ,QAC1E,MAAM,IAAI,MAAM,iEAAiE;GAEnF,MAAM,cAAc,OAAO,eAAe,MAAM;GAChD,IAAI,OAAO;IACT,MAAM,mBAAmB;IACzB,MAAM,mBAAmB,QAAQ;GACnC;GACA,aAAa,OAAO,GAAG;GACvB,mBAAmB,mBAAmB,KAAK;IACzC;IACA,kBAAkB,QAAQ;IAC1B;GACF,CAAC;GACD,OAAO,OAAO;EAChB;CACF;AACF;AAEA,SAAS,qBAAqB,OAAmD;CAC/E,IAAI,CAAC,OAAO,cAAc,MAAM,WAAW,KAAK,MAAM,eAAe,GACnE,MAAM,IAAI,MAAM,oEAAoE;CAEtF,IAAI,MAAM,eAAe,KAAK,IAAI,GAChC,MAAM,IAAI,MAAM,0DAA0D;CAE5E,KAAK,MAAM,CAAC,MAAM,UAAU;EAC1B,CAAC,iBAAiB,MAAM,OAAO,aAAa;EAC5C,CAAC,kBAAkB,MAAM,OAAO,cAAc;EAC9C,CAAC,mBAAmB,MAAM,OAAO,eAAe;CAClD,GACE,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAC1C,MAAM,IAAI,MAAM,+BAA+B,KAAK,oCAAoC;CAG5F,WAAW,MAAM,OAAO,YAAY,qBAAqB;AAC3D;AAEA,SAAS,oBACP,OACA,UACA,eACqC;CACrC,MAAM,SAAS,YACb,OACA;EAAC;EAAiB;EAAU;EAAe;EAAkB;CAAS,GACtE,sCACF;CACA,IAAI,OAAO,kBAAkB,SAAS,eACpC,MAAM,IAAI,MAAM,mEAAmE;CAErF,IAAI,CAAC,eAAe,OAAO,MAAM,GAC/B,MAAM,IAAI,MAAM,4DAA4D;CAE9E,IAAI,OAAO,gBAAgB,SAAS,aAClC,MAAM,IAAI,MAAM,qDAAqD;CAEvE,YACE,OAAO,gBACP;EAAC;EAAiB;EAAkB;EAAmB;CAAY,GACnE,6CACF;CACA,IACE,yBAAyB,OAAO,cAAc,MAAM,yBAAyB,SAAS,MAAM,GAE5F,MAAM,IAAI,MAAM,8DAA8D;CAGhF,MAAM,UAAU,2BACd,OAAO,SACP,SAAS,OAAO,eAChB,aACF;CACA,OAAO,wBAAwB;EAC7B,eAAe,OAAO;EACtB,QAAQ,OAAO;EACf,aAAa,OAAO;EACpB,gBAAgB,OAAO;EACvB;CACF,CAAC;AACH;AAEA,SAAS,2BACP,OACA,eACA,eACkC;CAClC,IAAI,kBAAkB,GAAG;EAEvB,IADe,YAAY,OAAO,CAAC,MAAM,GAAG,qCACnC,CAAC,CAAC,SAAS,YAClB,MAAM,IAAI,MAAM,mEAAmE;EAErF,OAAO,EAAE,MAAM,WAAW;CAC5B;CAEA,MAAM,SAAS,YAAY,OAAO,CAAC,QAAQ,SAAS,GAAG,qCAAqC;CAC5F,IAAI,OAAO,SAAS,gBAClB,MAAM,IAAI,MAAM,+DAA+D;CAEjF,IACE,CAAC,MAAM,QAAQ,OAAO,OAAO,KAC7B,OAAO,QAAQ,WAAW,KAC1B,OAAO,QAAQ,OAAO,eAEtB,MAAM,IAAI,MAAM,mEAAmE;CAErF,OAAO;EAAE,MAAM;EAAgB,SAAS,CAAC,aAAa;CAAE;AAC1D;AAEA,SAAS,mBACP,OACA,eACwC;CAExC,MAAM,MAAM,OADG,YAAY,OAAO,CAAC,KAAK,GAAG,qCACnB,CAAC,CAAC,KAAK,wCAAwC;CACvE,MAAM,cAAc,OAAO,KAAK,GAAG,CAAC,CAAC,KAAK;CAC1C,IACE,YAAY,WAAW,cAAc,UACrC,YAAY,MAAM,MAAM,UAAU,SAAS,cAAc,MAAM,GAE/D,MAAM,IAAI,MAAM,kEAAkE;CAEpF,MAAM,WAAmC,OAAO,OAAO,IAAI;CAC3D,KAAK,MAAM,QAAQ,eAAe;EAChC,MAAM,QAAQ,IAAI;EAClB,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,SAAS,OAClE,MAAM,IAAI,MAAM,8BAA8B,KAAK,qCAAqC;EAE1F,SAAS,QAAQ;CACnB;CACA,OAAO,OAAO,OAAO,EAAE,KAAK,OAAO,OAAO,QAAQ,EAAE,CAAC;AACvD;AAEA,SAAS,sBACP,OACA,UAC6B;CAC7B,MAAM,SAAS,YACb,OACA;EAAC;EAAa;EAAY;EAAS;EAAY;CAAiB,GAChE,0BACF;CACA,IAAI,OAAO,cAAc,SAAS,WAChC,MAAM,IAAI,MAAM,oDAAoD;CAEtE,IAAI,OAAO,oBAAoB,SAAS,iBACtC,MAAM,IAAI,MAAM,6DAA6D;CAE/E,KAAK,MAAM,QAAQ;EAAC;EAAa;EAAY;EAAS;CAAU,GAC9D,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,KAAK,CAAC,WAAW,GAC9D,MAAM,IAAI,MAAM,4BAA4B,KAAK,mBAAmB;CAGxE,OAAO;AACT;AAEA,SAAS,oBACP,UACA,QACM;CACN,IACE,OAAO,gBAAgB,SAAS,eAChC,OAAO,kBAAkB,SAAS,iBAClC,OAAO,gBAAgB,SAAS,eAChC,yBAAyB,OAAO,QAAQ,MAAM,yBAAyB,SAAS,QAAQ,GAExF,MAAM,IAAI,MAAM,sEAAsE;AAE1F;AAEA,SAAS,2BACP,OAMA,aACM;CACN,KAAK,MAAM,CAAC,MAAM,QAAQ,UAAU;EAClC;GAAC;GAAe,MAAM;GAAY,YAAY,OAAO;EAAa;EAClE;GAAC;GAAgB,MAAM;GAAa,YAAY,OAAO;EAAc;EACrE;GAAC;GAAiB,MAAM;GAAc,YAAY,OAAO;EAAe;EACxE;GAAC;GAAkB,MAAM;GAAc,YAAY;EAAe;CACpE,GACE,IAAI,SAAS,OACX,MAAM,IAAI,MAAM,8BAA8B,KAAK,GAAG,OAAO,oBAAoB,OAAO;AAG9F;AAEA,SAAS,sBAAsB,QAA8C;CAC3E,IAAI,OAAO,WAAW,GACpB,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK;CAC/B,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,SAAS,MAAM,QAChC,MAAM,IAAI,MAAM,6DAA6D;CAE/E,KAAK,MAAM,QAAQ,OACjB,IACE,CAAC,2BAA2B,KAAK,IAAI,KACrC;EAAC;EAAa;EAAe;CAAW,CAAC,CAAC,SAAS,IAAI,GAEvD,MAAM,IAAI,MAAM,2DAA2D,MAAM;CAGrF,OAAO,OAAO,OAAO,KAAK;AAC5B;AAEA,SAAS,oBAAoB,OAAuB;CAClD,IACE,MAAM,SAAS,OACf,UAAU,MAAM,YAAY,KAC5B,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,GAAG,KAClB,UAAU,eACV,MAAM,SAAS,YAAY,KAC3B,UAAU,qBACV,UAAU,4BAEV,MAAM,IAAI,MAAM,oEAAoE;CAEtF,MAAM,SAAS,MAAM,MAAM,GAAG;CAC9B,IACE,OAAO,SAAS,KAChB,CAAC,OAAO,OACL,UACC,MAAM,UAAU,KAAK,MAAM,UAAU,MAAM,oCAAoC,KAAK,KAAK,CAC7F,KACA,CAAC,QAAQ,KAAK,OAAO,GAAG,EAAE,KAAK,EAAE,GAEjC,MAAM,IAAI,MAAM,oEAAoE;CAEtF,OAAO;AACT;AAEA,SAAS,eAAe,aAAqB,eAA+B;CAC1E,OAAO,yBAAyB;EAAE;EAAa;CAAc,CAAC;AAChE;AAEA,SAAS,kBACP,cACA,aACA,KACM;CACN,KAAK,MAAM,CAAC,KAAK,UAAU,cACzB,IAAI,MAAM,eAAe,KAAK,aAAa,OAAO,GAAG;CAEvD,KAAK,MAAM,CAAC,KAAK,UAAU,aACzB,IAAI,MAAM,eAAe,KAAK,YAAY,OAAO,GAAG;AAExD;AAEA,SAAS,mBACP,aACA,KACA,OACM;CACN,YAAY,OAAO,GAAG;CACtB,YAAY,IAAI,KAAK,KAAK;CAC1B,OAAO,YAAY,OAAO,wBAAwB;EAChD,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;EACzC,IAAI,WAAW,KAAA,GAAW;EAC1B,YAAY,OAAO,MAAM;CAC3B;AACF;AAEA,SAAS,eAAe,OAAuC;CAC7D,OAAO,OAAO,UAAU,YAAY,wBAAwB,KAAK,KAAK;AACxE;AAEA,SAAS,YACP,OACA,MACA,OACyB;CACzB,MAAM,SAAS,OAAO,OAAO,KAAK;CAClC,sBAAsB,QAAQ,MAAM,KAAK;CACzC,OAAO;AACT;AAEA,SAAS,OAAO,OAAgB,OAAwC;CACtE,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CAE9C,MAAM,YAAY,OAAO,eAAe,KAAK;CAC7C,IAAI,cAAc,OAAO,aAAa,cAAc,MAClD,MAAM,IAAI,MAAM,GAAG,MAAM,wBAAwB;CAEnD,OAAO;AACT"}
+{"version":3,"file":"protected-model-port-uthtDNqu.js","names":["isSha256Digest"],"sources":["../src/candidate-execution/exact-process-executor.ts","../src/candidate-execution/protected-model-port.ts"],"sourcesContent":["import { posix } from 'node:path'\nimport { isDeepStrictEqual } from 'node:util'\n\nimport type { TraceStore } from '@tangle-network/agent-eval'\nimport type { AgentCandidateTermination, Sha256Digest } from '@tangle-network/agent-interface'\nimport type {\n  AgentEnvironmentCapabilities,\n  AgentEnvironmentProvider,\n  AgentExactProcess,\n  AgentExactProcessEnvironment,\n  AgentExactProcessLaunch,\n  AgentExactProcessResources,\n  AgentExactProcessStatus,\n} from '@tangle-network/agent-interface/environment-provider'\n\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  immutableCandidateValue,\n  sha256Bytes,\n} from './digest'\nimport {\n  CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV,\n  CANDIDATE_KNOWLEDGE_ROOT_ENV,\n  candidateKnowledgeExecutionPaths,\n} from './knowledge'\nimport type {\n  AgentCandidateExecutorPort,\n  AgentCandidateExecutorRequest,\n  AgentCandidateExecutorStopRequest,\n} from './types'\n\nconst DEFAULT_PROVISION_TIMEOUT_MS = 120_000\nconst DEFAULT_RECOVERY_RETENTION_MS = 15 * 60_000\n\ninterface ExactProcessRunState {\n  environment: AgentExactProcessEnvironment\n  output?: Uint8Array\n  termination?: AgentCandidateTermination\n  runtimeTermination?: AgentCandidateTermination\n  trace?: {\n    runId: string\n    scenarioId: string\n    startedAt: number\n    deadlineAtMs: number\n    timeoutMs: number\n    tags: Record<string, string>\n    written: boolean\n  }\n}\n\nexport interface ExactProcessCandidateExecutorOptions {\n  provider: AgentEnvironmentProvider\n  resources: AgentExactProcessResources\n  provisionTimeoutMs?: number\n  recoveryRetentionMs?: number\n  providerOptions?: Record<string, unknown>\n}\n\n/** Adapt one neutral exact-process provider to Runtime's trusted candidate boundary. */\nexport function exactProcessProviderAsCandidateExecutor(\n  options: ExactProcessCandidateExecutorOptions,\n): AgentCandidateExecutorPort {\n  return new ExactProcessAgentCandidateExecutor(options)\n}\n\nclass ExactProcessAgentCandidateExecutor implements AgentCandidateExecutorPort {\n  private readonly states = new Map<string, ExactProcessRunState>()\n  private readonly exactProcess\n  private readonly resources: AgentExactProcessResources\n  private readonly provisionTimeoutMs: number\n  private readonly recoveryRetentionMs: number\n  private readonly providerOptions?: Record<string, unknown>\n  private capabilitiesPromise?: Promise<AgentEnvironmentCapabilities>\n\n  constructor(private readonly options: ExactProcessCandidateExecutorOptions) {\n    if (!options.provider.exactProcess) {\n      throw new Error(\n        `agent environment provider \"${options.provider.name}\" does not implement exact processes`,\n      )\n    }\n    this.exactProcess = options.provider.exactProcess\n    this.resources = exactResources(options.resources)\n    this.provisionTimeoutMs = positiveInteger(\n      options.provisionTimeoutMs ?? DEFAULT_PROVISION_TIMEOUT_MS,\n      'exact process provision timeout',\n    )\n    this.recoveryRetentionMs = positiveInteger(\n      options.recoveryRetentionMs ?? DEFAULT_RECOVERY_RETENTION_MS,\n      'exact process recovery retention',\n    )\n    this.providerOptions = options.providerOptions\n      ? immutableCandidateValue(options.providerOptions)\n      : undefined\n  }\n\n  async execute(\n    request: AgentCandidateExecutorRequest,\n    context: Parameters<AgentCandidateExecutorPort['execute']>[1],\n  ) {\n    assertSupportedRequest(request)\n    const outcome = request.benchmark.task.outcome\n    if (outcome.kind !== 'output') throw new Error('exact process executor requires an output task')\n    const network = request.executionPlan.value.material.model.access.network\n    const egress =\n      network.mode === 'disabled'\n        ? ({ mode: 'blocked' } as const)\n        : ({ mode: 'strict', allowDomains: [...network.domains] } as const)\n    await this.assertCapability(egress.mode)\n    context.signal.throwIfAborted()\n\n    const key = executionKey(request.executionId, request.executionPlan.value.digest)\n    if (this.states.has(key)) throw new Error('candidate execution environment is already active')\n    const image = exactImage(\n      request.executionPlan.value.material.container.image,\n      request.executionPlan.value.material.container.manifestDigest,\n    )\n    const maxLifetimeMs = environmentLifetimeMs(\n      request.hardLimits.timeoutMs,\n      this.recoveryRetentionMs,\n    )\n    const createMaterial = immutableCandidateValue({\n      kind: 'agent-candidate-exact-process-create',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlan.value.digest,\n      image,\n      egress,\n      maxLifetimeMs,\n      provisionTimeoutMs: this.provisionTimeoutMs,\n      resources: this.resources,\n      output: { mediaType: outcome.mediaType, maxBytes: outcome.maxBytes },\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    const createInputDigest = canonicalCandidateDigest(createMaterial)\n    const metadata = immutableCandidateValue({\n      kind: 'agent-candidate-execution',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlan.value.digest,\n      createInputDigest,\n      outputMediaType: outcome.mediaType,\n      outputMaxBytes: outcome.maxBytes,\n    })\n    const environment = await this.exactProcess.create({\n      image,\n      egress,\n      maxLifetimeMs,\n      provisionTimeoutMs: this.provisionTimeoutMs,\n      resources: this.resources,\n      metadata,\n      idempotencyKey: executionIdempotencyKey(\n        request.executionId,\n        request.executionPlan.value.digest,\n      ),\n      signal: context.signal,\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    try {\n      assertExecutionEnvironment(environment, metadata, this.options.provider.name)\n    } catch (error) {\n      try {\n        await environment.destroy()\n      } catch (cleanupError) {\n        throw new AggregateError(\n          [error, cleanupError],\n          'exact process validation and cleanup both failed',\n        )\n      }\n      throw error\n    }\n    const state: ExactProcessRunState = { environment }\n    this.states.set(key, state)\n\n    const existing = await environment.process.list()\n    if (existing.length !== 0) {\n      throw new Error('fresh candidate environment already contains a process')\n    }\n    await materializeRequest(environment, request, context.signal)\n    const launch = exactLaunch(request)\n    const startedAt = Date.now()\n    state.trace = {\n      runId: request.trace.runId,\n      scenarioId: request.benchmark.task.scenario.id,\n      startedAt,\n      deadlineAtMs: context.deadlineAtMs,\n      timeoutMs: request.hardLimits.timeoutMs,\n      tags: {\n        ...request.trace.tags,\n        environmentId: environment.id,\n        environmentProvider: environment.provider,\n      },\n      written: false,\n    }\n    const process = await environment.process.spawn(launch, { signal: context.signal })\n    const outputPromise = collectOutput(process, outcome.maxBytes)\n    void outputPromise.catch(() => undefined)\n    let cancellation: Promise<void> | undefined\n    let processExited = false\n    const cancel = () => {\n      if (!processExited) cancellation ??= stopProcess(process)\n    }\n    context.signal.addEventListener('abort', cancel, { once: true })\n    if (context.signal.aborted) cancel()\n    try {\n      const termination = await process.wait()\n      processExited = true\n      context.signal.removeEventListener('abort', cancel)\n      if (cancellation) await cancellation\n      const status = await process.status()\n      assertTerminalStatus(status, termination)\n      state.output = await awaitOutput(outputPromise, context.signal, context.deadlineAtMs)\n      state.termination = termination\n      await appendExactProcessTrace(state, context.traceStore, status)\n      return { executionId: request.executionId, termination }\n    } finally {\n      context.signal.removeEventListener('abort', cancel)\n    }\n  }\n\n  async stop(\n    request: AgentCandidateExecutorStopRequest,\n    context: Parameters<AgentCandidateExecutorPort['stop']>[1],\n  ): Promise<{ readonly stopped: true }> {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, true)\n    if (!environment) return { stopped: true }\n    let statuses = await environment.process.list()\n    if (statuses.length > 1) {\n      throw new Error('candidate exact process environment contains more than one process')\n    }\n    const status = statuses[0]\n    if (status?.running) {\n      const process = await environment.process.get(status.pid)\n      if (!process) throw new Error('candidate environment lost its running process handle')\n      await stopProcess(process)\n    }\n    context.signal.throwIfAborted()\n    statuses = await environment.process.list()\n    if (statuses.some((entry) => entry.running)) {\n      throw new Error('candidate exact process termination is not proven')\n    }\n    const finalStatus = statuses[0]\n    if (finalStatus) assertTerminalStatus(finalStatus)\n    const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest))\n    if (state) {\n      state.termination = finalStatus?.termination ?? state.termination\n      if (context.reason === 'timeout' && state.trace) {\n        state.runtimeTermination = {\n          kind: 'timeout',\n          timeoutMs: state.trace.timeoutMs,\n        }\n      }\n      await appendExactProcessTrace(state, context.traceStore, finalStatus)\n    }\n    return { stopped: true }\n  }\n\n  async capture(\n    request: AgentCandidateExecutorStopRequest,\n    context: Parameters<AgentCandidateExecutorPort['capture']>[1],\n  ) {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, false)\n    const statuses = await environment.process.list()\n    const status = statuses[0]\n    if (statuses.length !== 1 || !status || status.running) {\n      throw new Error('candidate environment must contain one stopped process before capture')\n    }\n    assertTerminalStatus(status)\n    const process = await environment.process.get(status.pid)\n    if (!process) throw new Error('candidate environment lost its captured process handle')\n    const currentStatus = await process.status()\n    assertTerminalStatus(currentStatus, status.termination)\n    const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest))\n    const output =\n      state?.output ??\n      (await awaitOutput(\n        collectOutput(process, outputSpec(environment).maxBytes),\n        context.signal,\n        Date.now() + this.provisionTimeoutMs,\n      ))\n    context.signal.throwIfAborted()\n    const evidence = canonicalCandidateBytes({\n      kind: 'agent-candidate-exact-process-capture',\n      provider: environment.provider,\n      environmentId: environment.id,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlanDigest,\n      createInputDigest: environment.metadata?.createInputDigest,\n      process: {\n        pid: status.pid,\n        exitCode: status.exitCode,\n        ...(status.exitSignal ? { exitSignal: status.exitSignal } : {}),\n        termination: status.termination,\n      },\n      ...(state?.runtimeTermination ? { runtimeTermination: state.runtimeTermination } : {}),\n      output: { sha256: sha256Bytes(output), byteLength: output.byteLength },\n    })\n    return {\n      taskOutcome: { kind: 'output' as const, bytes: output },\n      evidence,\n    }\n  }\n\n  async dispose(\n    request: AgentCandidateExecutorStopRequest,\n    context: { signal: AbortSignal },\n  ): Promise<{ readonly disposed: true }> {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, true)\n    if (!environment) return { disposed: true }\n    let destroyError: unknown\n    try {\n      await environment.destroy()\n    } catch (error) {\n      destroyError = error\n    }\n    const remaining = await this.exactProcess.get(environment.id)\n    if (remaining) {\n      throw new Error('exact process environment disposal is not proven', { cause: destroyError })\n    }\n    context.signal.throwIfAborted()\n    this.states.delete(executionKey(request.executionId, request.executionPlanDigest))\n    return { disposed: true }\n  }\n\n  private async assertCapability(mode?: 'blocked' | 'strict'): Promise<void> {\n    const pending =\n      this.capabilitiesPromise ?? Promise.resolve(this.options.provider.capabilities())\n    this.capabilitiesPromise = pending\n    let capabilities: AgentEnvironmentCapabilities\n    try {\n      capabilities = await pending\n    } catch (error) {\n      if (this.capabilitiesPromise === pending) this.capabilitiesPromise = undefined\n      throw error\n    }\n    const exact = capabilities.exactProcess\n    if (!exact) {\n      throw new Error(\n        `agent environment provider \"${this.options.provider.name}\" does not declare exact process support`,\n      )\n    }\n    if (mode && !exact.egress.includes(mode)) {\n      throw new Error(\n        `agent environment provider \"${this.options.provider.name}\" does not declare ${mode} exact egress`,\n      )\n    }\n  }\n\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: false,\n  ): Promise<AgentExactProcessEnvironment>\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: true,\n  ): Promise<AgentExactProcessEnvironment | undefined>\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: boolean,\n  ): Promise<AgentExactProcessEnvironment | undefined> {\n    const key = executionKey(request.executionId, request.executionPlanDigest)\n    const active = this.states.get(key)?.environment\n    if (active) return active\n    const metadata = {\n      kind: 'agent-candidate-execution',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlanDigest,\n    }\n    const listed = await this.exactProcess.list({\n      metadata,\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    const matches = listed.filter(\n      (environment) =>\n        environment.provider === this.options.provider.name &&\n        Object.entries(metadata).every(([name, value]) =>\n          isDeepStrictEqual(environment.metadata?.[name], value),\n        ),\n    )\n    if (matches.length > 1) {\n      throw new Error('multiple exact process environments match one candidate execution')\n    }\n    const environment = matches[0]\n    if (!environment) {\n      if (missingIsDeleted) return undefined\n      throw new Error('candidate exact process evidence is unavailable')\n    }\n    if (!isSha256Digest(environment.metadata?.createInputDigest)) {\n      throw new Error('candidate exact process create-input digest is unavailable')\n    }\n    this.states.set(key, { environment })\n    return environment\n  }\n}\n\nasync function appendExactProcessTrace(\n  state: ExactProcessRunState,\n  traceStore: TraceStore,\n  status?: AgentExactProcessStatus,\n): Promise<void> {\n  const trace = state.trace\n  if (!trace || trace.written) return\n  const endedAt = Math.max(trace.startedAt, Math.min(Date.now(), trace.deadlineAtMs))\n  const termination = state.runtimeTermination ?? state.termination ?? status?.termination\n  await traceStore.appendRun({\n    runId: trace.runId,\n    scenarioId: trace.scenarioId,\n    startedAt: trace.startedAt,\n    endedAt,\n    status: termination?.kind === 'exit' && termination.exitCode === 0 ? 'completed' : 'failed',\n    tags: trace.tags,\n  })\n  trace.written = true\n}\n\nfunction assertSupportedRequest(request: AgentCandidateExecutorRequest): void {\n  if (request.benchmark.task.outcome.kind !== 'output') {\n    throw new Error(\n      'exact process candidate executor does not support workspace outcomes; use Pier',\n    )\n  }\n  if (request.executionPlan.value.material.codeKind !== 'disabled' || request.inputs.candidate) {\n    throw new Error('exact process candidate executor does not support code workspaces; use Pier')\n  }\n  if (request.memory.mode !== 'disabled') {\n    throw new Error('exact process candidate executor does not support isolated memory')\n  }\n  const mediaType = request.benchmark.task.outcome.mediaType.toLowerCase()\n  if (\n    !(\n      mediaType.startsWith('text/') ||\n      mediaType === 'application/json' ||\n      mediaType.endsWith('+json')\n    )\n  ) {\n    throw new Error('exact process candidate executor supports only UTF-8 text and JSON outputs')\n  }\n  if (!posix.isAbsolute(request.launch.executable) && !request.launch.env.PATH?.trim()) {\n    throw new Error('exact process candidate executable must be absolute or declare a signed PATH')\n  }\n}\n\nasync function materializeRequest(\n  environment: AgentExactProcessEnvironment,\n  request: AgentCandidateExecutorRequest,\n  signal: AbortSignal,\n): Promise<void> {\n  const knowledgePaths = assertKnowledgeExecutionBinding(request)\n  for (const file of request.inputs.task.files) {\n    await environment.writeFile(beneath(request.roots.taskRoot, file.path), file.bytes, {\n      mode: file.mode,\n      signal,\n    })\n  }\n  const profileRoot =\n    request.executionPlan.value.material.profile.targetWorkspace === 'task'\n      ? request.roots.taskRoot\n      : request.roots.candidateRoot\n  if (!profileRoot) throw new Error('candidate profile targets a missing workspace')\n  for (const file of request.profileActivation.files) {\n    await environment.writeFile(\n      beneath(profileRoot, file.path),\n      Buffer.from(file.content, 'utf8'),\n      { mode: file.mode, signal },\n    )\n  }\n  if (request.knowledge && knowledgePaths) {\n    for (const file of request.knowledge.files) {\n      await environment.writeFile(beneath(knowledgePaths.root, file.path), file.bytes, {\n        mode: file.mode,\n        signal,\n      })\n    }\n    if (request.knowledge.retrievalConfig && knowledgePaths.retrievalConfig) {\n      await environment.writeFile(\n        knowledgePaths.retrievalConfig,\n        request.knowledge.retrievalConfig,\n        { mode: 0o644, signal },\n      )\n    }\n  }\n  if (request.instruction.delivery.kind === 'utf8-file') {\n    await environment.writeFile(request.instruction.delivery.path, request.instruction.bytes, {\n      mode: 0o644,\n      signal,\n    })\n  }\n}\n\nfunction assertKnowledgeExecutionBinding(\n  request: AgentCandidateExecutorRequest,\n): ReturnType<typeof candidateKnowledgeExecutionPaths> | undefined {\n  const knowledge = request.knowledge\n  if (!knowledge) {\n    if (\n      request.launch.env[CANDIDATE_KNOWLEDGE_ROOT_ENV] !== undefined ||\n      request.launch.env[CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV] !== undefined\n    ) {\n      throw new Error('candidate launch declares knowledge paths without verified knowledge')\n    }\n    return undefined\n  }\n  const paths = candidateKnowledgeExecutionPaths(\n    request.roots.taskRoot,\n    knowledge.retrievalConfig !== undefined,\n  )\n  if (\n    request.launch.env[CANDIDATE_KNOWLEDGE_ROOT_ENV] !== paths.root ||\n    request.launch.env[CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV] !== paths.retrievalConfig\n  ) {\n    throw new Error('candidate knowledge paths do not match the signed launch environment')\n  }\n  const reserved = [paths.root, paths.retrievalConfig].filter(\n    (value): value is string => value !== undefined,\n  )\n  const profileRoot =\n    request.executionPlan.value.material.profile.targetWorkspace === 'task'\n      ? request.roots.taskRoot\n      : request.roots.candidateRoot\n  const otherFiles = [\n    ...request.inputs.task.files.map((file) => beneath(request.roots.taskRoot, file.path)),\n    ...(profileRoot\n      ? request.profileActivation.files.map((file) => beneath(profileRoot, file.path))\n      : []),\n    ...(request.instruction.delivery.kind === 'utf8-file'\n      ? [request.instruction.delivery.path]\n      : []),\n  ]\n  if (\n    otherFiles.some((path) =>\n      reserved.some(\n        (reservedPath) =>\n          path === reservedPath ||\n          path.startsWith(`${reservedPath}/`) ||\n          reservedPath.startsWith(`${path}/`),\n      ),\n    )\n  ) {\n    throw new Error('candidate knowledge paths overlap other execution inputs')\n  }\n  return paths\n}\n\nfunction exactLaunch(request: AgentCandidateExecutorRequest): AgentExactProcessLaunch {\n  const instruction = new TextDecoder('utf-8', { fatal: true }).decode(request.instruction.bytes)\n  const base = {\n    executable: request.launch.executable,\n    args: request.launch.args,\n    cwd: request.launch.cwd,\n    env: request.launch.env,\n    timeoutMs: 0,\n  }\n  switch (request.instruction.delivery.kind) {\n    case 'argv-append':\n      return { ...base, args: [...base.args, instruction] }\n    case 'stdin-utf8':\n      return { ...base, stdin: instruction }\n    case 'utf8-file':\n      return base\n  }\n}\n\nasync function collectOutput(process: AgentExactProcess, maxBytes: number): Promise<Uint8Array> {\n  const chunks: Buffer[] = []\n  let byteLength = 0\n  for await (const chunk of process.stdout()) {\n    const bytes = Buffer.from(chunk, 'utf8')\n    byteLength += bytes.byteLength\n    if (byteLength > maxBytes) {\n      let stopError: unknown\n      try {\n        await stopProcess(process)\n      } catch (error) {\n        stopError = error\n      }\n      throw new Error(`candidate output exceeds its ${maxBytes}-byte maximum`, {\n        cause: stopError,\n      })\n    }\n    chunks.push(bytes)\n  }\n  return Uint8Array.from(Buffer.concat(chunks, byteLength))\n}\n\nasync function awaitOutput(\n  output: Promise<Uint8Array>,\n  signal: AbortSignal,\n  deadlineAtMs: number,\n): Promise<Uint8Array> {\n  signal.throwIfAborted()\n  const remainingMs = deadlineAtMs - Date.now()\n  if (remainingMs <= 0) throw new Error('candidate output deadline expired')\n  let timer: ReturnType<typeof setTimeout> | undefined\n  let onAbort: (() => void) | undefined\n  try {\n    return await Promise.race([\n      output,\n      new Promise<never>((_resolve, reject) => {\n        onAbort = () => reject(signal.reason ?? new Error('candidate output cancelled'))\n        signal.addEventListener('abort', onAbort, { once: true })\n        timer = setTimeout(\n          () => reject(new Error('candidate output deadline expired')),\n          remainingMs,\n        )\n      }),\n    ])\n  } finally {\n    if (onAbort) signal.removeEventListener('abort', onAbort)\n    if (timer) clearTimeout(timer)\n  }\n}\n\nasync function stopProcess(process: AgentExactProcess): Promise<void> {\n  const before = await process.status()\n  if (!before.running) return\n  try {\n    await process.kill()\n  } catch (error) {\n    if ((await process.status()).running) throw error\n  }\n  const termination = await process.wait()\n  assertTerminalStatus(await process.status(), termination)\n}\n\nfunction assertTerminalStatus(\n  status: AgentExactProcessStatus,\n  expected?: AgentCandidateTermination,\n): asserts status is AgentExactProcessStatus & { termination: AgentCandidateTermination } {\n  if (status.running || !status.termination) {\n    throw new Error('exact process returned no terminal reason after exit')\n  }\n  if (expected && !isDeepStrictEqual(status.termination, expected)) {\n    throw new Error('exact process wait and status returned different terminal reasons')\n  }\n}\n\nfunction assertExecutionEnvironment(\n  environment: AgentExactProcessEnvironment,\n  metadata: Record<string, unknown>,\n  providerName: string,\n): void {\n  if (!environment.id || environment.provider !== providerName) {\n    throw new Error('exact process provider returned the wrong environment identity')\n  }\n  if (\n    !Object.entries(metadata).every(([name, value]) =>\n      isDeepStrictEqual(environment.metadata?.[name], value),\n    )\n  ) {\n    throw new Error('exact process provider did not persist candidate execution metadata')\n  }\n}\n\nfunction outputSpec(environment: AgentExactProcessEnvironment): { maxBytes: number } {\n  const maxBytes = environment.metadata?.outputMaxBytes\n  if (!Number.isSafeInteger(maxBytes) || Number(maxBytes) < 1) {\n    throw new Error('candidate exact process output bound is unavailable')\n  }\n  return { maxBytes: Number(maxBytes) }\n}\n\nfunction executionKey(executionId: string, executionPlanDigest: Sha256Digest): string {\n  return `${executionId}\\0${executionPlanDigest}`\n}\n\nfunction executionIdempotencyKey(executionId: string, executionPlanDigest: Sha256Digest): string {\n  return `candidate-${canonicalCandidateDigest({\n    kind: 'agent-candidate-execution-identity',\n    executionId,\n    executionPlanDigest,\n  }).slice('sha256:'.length)}`\n}\n\nfunction exactImage(image: string, manifestDigest: Sha256Digest): string {\n  if (isSha256Digest(image)) {\n    if (image !== manifestDigest) {\n      throw new Error('candidate container image conflicts with its resolved manifest')\n    }\n    return image\n  }\n  const marker = image.lastIndexOf('@')\n  if (marker < 0) return `${image}@${manifestDigest}`\n  if (image.slice(marker + 1) !== manifestDigest) {\n    throw new Error('candidate container image conflicts with its resolved manifest')\n  }\n  return image\n}\n\nfunction environmentLifetimeMs(timeoutMs: number, retentionMs: number): number {\n  const total = positiveInteger(timeoutMs, 'candidate execution timeout') + retentionMs\n  if (!Number.isSafeInteger(total)) throw new Error('candidate environment lifetime is too large')\n  return Math.ceil(total / 1_000) * 1_000\n}\n\nfunction exactResources(resources: AgentExactProcessResources): AgentExactProcessResources {\n  if (!Number.isFinite(resources.cpu) || resources.cpu <= 0) {\n    throw new Error('exact process CPU must be positive and finite')\n  }\n  return Object.freeze({\n    cpu: resources.cpu,\n    memoryMb: positiveInteger(resources.memoryMb, 'exact process memory'),\n    diskMb: positiveInteger(resources.diskMb, 'exact process disk'),\n  })\n}\n\nfunction positiveInteger(value: number, label: string): number {\n  if (!Number.isSafeInteger(value) || value < 1)\n    throw new Error(`${label} must be a positive integer`)\n  return value\n}\n\nfunction beneath(root: string, relativePath: string): string {\n  if (posix.isAbsolute(relativePath)) throw new Error('candidate input path must be relative')\n  const path = posix.normalize(relativePath)\n  if (path === '..' || path.startsWith('../')) {\n    throw new Error('candidate input path escapes its execution root')\n  }\n  return posix.join(root, path)\n}\n\nfunction isSha256Digest(value: unknown): value is Sha256Digest {\n  return typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value)\n}\n","import type {\n  AgentCandidateModelAccessNetwork,\n  AgentCandidateResolvedModel,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateDigest, immutableCandidateValue } from './digest'\nimport { assertExactObjectKeys } from './exact-object'\nimport { sealAgentCandidateModelSettlement, usdToNanos } from './model-settlement'\nimport type {\n  AgentCandidateModelLimits,\n  AgentCandidateModelPort,\n  AgentCandidateProtectedModelActivation,\n  AgentCandidateProtectedModelReservation,\n  AgentCandidateProtectedModelSettlement,\n} from './types'\n\nexport type AgentCandidateModelGrantReserveInput = Parameters<\n  AgentCandidateModelPort['reserveGrant']\n>[0]\nexport type AgentCandidateModelGrantActivateInput = Parameters<\n  AgentCandidateModelPort['activateGrant']\n>[0]\nexport type AgentCandidateModelGrantSettleInput = Parameters<\n  AgentCandidateModelPort['settleGrant']\n>[0]\n\n/** Secret-free response from the service's reservation endpoint. */\nexport type AgentCandidateModelGrantReservation = AgentCandidateProtectedModelReservation\n\n/**\n * Narrow transport contract for a service that owns scoped model credentials\n * and the authoritative per-call usage ledger.\n *\n * An HTTP client can bind these methods to control-plane endpoints. Keeping\n * transport out of the runtime prevents parent credentials, endpoint paths,\n * and retry policy from becoming part of the portable candidate contract.\n */\nexport interface AgentCandidateModelGrantClient {\n  reserve(input: AgentCandidateModelGrantReserveInput): Promise<AgentCandidateModelGrantReservation>\n  activate(\n    input: AgentCandidateModelGrantActivateInput,\n  ): Promise<AgentCandidateProtectedModelActivation>\n  settle(\n    input: AgentCandidateModelGrantSettleInput,\n  ): Promise<AgentCandidateProtectedModelSettlement>\n}\n\nexport interface CreateProtectedAgentCandidateModelPortOptions {\n  client: AgentCandidateModelGrantClient\n  /** Catalog/snapshot resolution stays separate from credential issuance. */\n  resolveModel: AgentCandidateModelPort['resolve']\n  /** The only public DNS name candidate processes may reach for inference. */\n  gatewayDomain: string\n  /** Exact environment names the activation endpoint must return, no more or fewer. */\n  activationEnvNames: readonly string[]\n}\n\ninterface RememberedReservation {\n  requestDigest: Sha256Digest\n  responseDigest: Sha256Digest\n  executionId: string\n  preparationId: string\n  grantDigest: Sha256Digest\n  expiresAtMs: number\n  resolved: AgentCandidateResolvedModel\n  limits: AgentCandidateModelLimits\n  maxCostUsdNanos: number\n  activation: 'reserved' | 'activating' | 'activated'\n  settlementDigest?: Sha256Digest\n  settlementReason?: AgentCandidateModelGrantSettleInput['reason']\n}\n\ninterface RememberedSettlement {\n  settlementDigest: Sha256Digest\n  settlementReason: AgentCandidateModelGrantSettleInput['reason']\n  expiresAtMs: number\n}\n\nconst MAX_RECENT_SETTLEMENTS = 4_096\nconst RECOVERED_SETTLEMENT_RETENTION_MS = 15 * 60 * 1_000\n\n/**\n * Bind a protected model-grant service to the immutable candidate runtime.\n *\n * The service remains the authority for expiry, admission, revocation, and\n * metering. This adapter independently checks every response before allowing\n * it to cross into candidate execution or durable receipt finalization.\n */\nexport function createProtectedAgentCandidateModelPort(\n  options: CreateProtectedAgentCandidateModelPortOptions,\n): AgentCandidateModelPort {\n  const gatewayDomain = assertGatewayDomain(options.gatewayDomain)\n  const activationEnvNames = exactEnvironmentNames(options.activationEnvNames)\n  const reservations = new Map<string, RememberedReservation>()\n  const recentSettlements = new Map<string, RememberedSettlement>()\n\n  return {\n    resolve: async (input) => {\n      const request = immutableCandidateValue(input)\n      const resolved = validateResolvedModel(await options.resolveModel(request), request)\n      return immutableCandidateValue(resolved)\n    },\n\n    reserveGrant: async (input) => {\n      pruneExpiredState(reservations, recentSettlements, Date.now())\n      const request = immutableCandidateValue(input)\n      validateReserveInput(request)\n      const requestDigest = canonicalCandidateDigest(request)\n      const key = reservationKey(request.executionId, request.preparationId)\n      if (recentSettlements.has(key)) {\n        throw new Error('protected model reservation is already settled')\n      }\n      const previous = reservations.get(key)\n      if (previous && previous.requestDigest !== requestDigest) {\n        throw new Error('protected model reservation retry changed immutable input')\n      }\n\n      const reservation = validateReservation(\n        await options.client.reserve(request),\n        request,\n        gatewayDomain,\n      )\n      const responseDigest = canonicalCandidateDigest(reservation)\n      if (recentSettlements.has(key)) {\n        throw new Error('protected model reservation completed after the grant was settled')\n      }\n      const recorded = previous ?? reservations.get(key)\n      if (recorded && recorded.requestDigest !== requestDigest) {\n        throw new Error('protected model reservation retry changed immutable input')\n      }\n      if (recorded && recorded.responseDigest !== responseDigest) {\n        throw new Error('protected model reservation retry returned different evidence')\n      }\n      if (!recorded) {\n        reservations.set(key, {\n          requestDigest,\n          responseDigest,\n          executionId: request.executionId,\n          preparationId: request.preparationId,\n          grantDigest: reservation.digest,\n          expiresAtMs: request.expiresAtMs,\n          resolved: immutableCandidateValue(request.resolved),\n          limits: immutableCandidateValue(request.limits),\n          maxCostUsdNanos: usdToNanos(request.limits.maxCostUsd, 'reserved maxCostUsd'),\n          activation: 'reserved',\n        })\n      }\n      return reservation\n    },\n\n    activateGrant: async (input) => {\n      pruneExpiredState(reservations, recentSettlements, Date.now())\n      const request = immutableCandidateValue(input)\n      const key = reservationKey(request.executionId, request.preparationId)\n      if (recentSettlements.has(key)) throw new Error('protected model grant is already settled')\n      const state = reservations.get(key)\n      if (!state) throw new Error('protected model grant was not reserved by this port')\n      assertGrantIdentity(state, request)\n      if (state.settlementDigest) throw new Error('protected model grant is already settled')\n      if (state.activation !== 'reserved') {\n        throw new Error('protected model grant activation is single-use')\n      }\n      if (!Number.isSafeInteger(request.deadlineAtMs) || request.deadlineAtMs <= 0) {\n        throw new Error('protected model activation deadline must be a positive safe integer')\n      }\n      if (request.deadlineAtMs <= Date.now()) {\n        throw new Error('protected model activation deadline must be in the future')\n      }\n      if (request.deadlineAtMs > state.expiresAtMs) {\n        throw new Error('protected model activation deadline exceeds the reserved expiry')\n      }\n      state.activation = 'activating'\n      try {\n        const activation = validateActivation(\n          await options.client.activate(request),\n          state.limits.maxModelCalls === 0 ? [] : activationEnvNames,\n        )\n        if (recentSettlements.has(key) || reservations.get(key) !== state) {\n          throw new Error('protected model grant settled while activation was in flight')\n        }\n        state.activation = 'activated'\n        return activation\n      } catch (error) {\n        state.activation = 'reserved'\n        throw error\n      }\n    },\n\n    settleGrant: async (input) => {\n      const now = Date.now()\n      pruneExpiredState(reservations, recentSettlements, now)\n      const request = immutableCandidateValue(input)\n      const key = reservationKey(request.executionId, request.preparationId)\n      const state = reservations.get(key)\n      if (state) assertGrantIdentity(state, request)\n      const remembered = state ?? recentSettlements.get(key)\n      if (remembered?.settlementReason && remembered.settlementReason !== request.reason) {\n        throw new Error('protected model settlement retry changed the termination reason')\n      }\n\n      const sealed = sealAgentCandidateModelSettlement(await options.client.settle(request), {\n        preparationId: request.preparationId,\n        grantDigest: request.grantDigest,\n        model: request.resolved.model,\n      })\n      if (state) assertWithinReservedLimits(sealed.usage, state)\n\n      const settlementDigest = canonicalCandidateDigest(sealed.value)\n      if (remembered?.settlementDigest && remembered.settlementDigest !== settlementDigest) {\n        throw new Error('protected model settlement retry returned a different final ledger')\n      }\n      if (remembered?.settlementReason && remembered.settlementReason !== request.reason) {\n        throw new Error('protected model settlement retry changed the termination reason')\n      }\n      const expiresAtMs = state?.expiresAtMs ?? now + RECOVERED_SETTLEMENT_RETENTION_MS\n      if (state) {\n        state.settlementDigest = settlementDigest\n        state.settlementReason = request.reason\n      }\n      reservations.delete(key)\n      rememberSettlement(recentSettlements, key, {\n        settlementDigest,\n        settlementReason: request.reason,\n        expiresAtMs,\n      })\n      return sealed.value\n    },\n  }\n}\n\nfunction validateReserveInput(input: AgentCandidateModelGrantReserveInput): void {\n  if (!Number.isSafeInteger(input.expiresAtMs) || input.expiresAtMs <= 0) {\n    throw new Error('protected model reservation expiry must be a positive safe integer')\n  }\n  if (input.expiresAtMs <= Date.now()) {\n    throw new Error('protected model reservation expiry must be in the future')\n  }\n  for (const [name, value] of [\n    ['maxModelCalls', input.limits.maxModelCalls],\n    ['maxInputTokens', input.limits.maxInputTokens],\n    ['maxOutputTokens', input.limits.maxOutputTokens],\n  ] as const) {\n    if (!Number.isSafeInteger(value) || value < 0) {\n      throw new Error(`protected model reservation ${name} must be a nonnegative safe integer`)\n    }\n  }\n  usdToNanos(input.limits.maxCostUsd, 'reserved maxCostUsd')\n}\n\nfunction validateReservation(\n  value: unknown,\n  expected: AgentCandidateModelGrantReserveInput,\n  gatewayDomain: string,\n): AgentCandidateModelGrantReservation {\n  const source = exactRecord(\n    value,\n    ['preparationId', 'digest', 'expiresAtMs', 'enforcedLimits', 'network'],\n    'protected model reservation response',\n  )\n  if (source.preparationId !== expected.preparationId) {\n    throw new Error('protected model reservation response changed preparation identity')\n  }\n  if (!isSha256Digest(source.digest)) {\n    throw new Error('protected model reservation response has an invalid digest')\n  }\n  if (source.expiresAtMs !== expected.expiresAtMs) {\n    throw new Error('protected model reservation response changed expiry')\n  }\n  exactRecord(\n    source.enforcedLimits,\n    ['maxModelCalls', 'maxInputTokens', 'maxOutputTokens', 'maxCostUsd'],\n    'protected model reservation enforced limits',\n  )\n  if (\n    canonicalCandidateDigest(source.enforcedLimits) !== canonicalCandidateDigest(expected.limits)\n  ) {\n    throw new Error('protected model reservation response changed enforced limits')\n  }\n\n  const network = validateReservationNetwork(\n    source.network,\n    expected.limits.maxModelCalls,\n    gatewayDomain,\n  )\n  return immutableCandidateValue({\n    preparationId: source.preparationId,\n    digest: source.digest,\n    expiresAtMs: source.expiresAtMs,\n    enforcedLimits: source.enforcedLimits,\n    network,\n  }) as AgentCandidateModelGrantReservation\n}\n\nfunction validateReservationNetwork(\n  value: unknown,\n  maxModelCalls: number,\n  gatewayDomain: string,\n): AgentCandidateModelAccessNetwork {\n  if (maxModelCalls === 0) {\n    const source = exactRecord(value, ['mode'], 'protected model reservation network')\n    if (source.mode !== 'disabled') {\n      throw new Error('zero-call protected model reservation must disable gateway access')\n    }\n    return { mode: 'disabled' }\n  }\n\n  const source = exactRecord(value, ['mode', 'domains'], 'protected model reservation network')\n  if (source.mode !== 'gateway-only') {\n    throw new Error('protected model reservation must allow only its model gateway')\n  }\n  if (\n    !Array.isArray(source.domains) ||\n    source.domains.length !== 1 ||\n    source.domains[0] !== gatewayDomain\n  ) {\n    throw new Error('protected model reservation returned an unexpected gateway domain')\n  }\n  return { mode: 'gateway-only', domains: [gatewayDomain] }\n}\n\nfunction validateActivation(\n  value: unknown,\n  expectedNames: readonly string[],\n): AgentCandidateProtectedModelActivation {\n  const source = exactRecord(value, ['env'], 'protected model activation response')\n  const env = record(source.env, 'protected model activation environment')\n  const actualNames = Object.keys(env).sort()\n  if (\n    actualNames.length !== expectedNames.length ||\n    actualNames.some((name, index) => name !== expectedNames[index])\n  ) {\n    throw new Error('protected model activation returned unexpected environment names')\n  }\n  const detached: Record<string, string> = Object.create(null) as Record<string, string>\n  for (const name of expectedNames) {\n    const value = env[name]\n    if (typeof value !== 'string' || value.length < 8 || value.length > 65_536) {\n      throw new Error(`protected model activation ${name} must be a non-empty protected value`)\n    }\n    detached[name] = value\n  }\n  return Object.freeze({ env: Object.freeze(detached) })\n}\n\nfunction validateResolvedModel(\n  value: unknown,\n  expected: Parameters<AgentCandidateModelPort['resolve']>[0],\n): AgentCandidateResolvedModel {\n  const source = exactRecord(\n    value,\n    ['requested', 'provider', 'model', 'snapshot', 'reasoningEffort'],\n    'resolved candidate model',\n  )\n  if (source.requested !== expected.requested) {\n    throw new Error('model resolver changed the evaluator-owned request')\n  }\n  if (source.reasoningEffort !== expected.reasoningEffort) {\n    throw new Error('model resolver changed the evaluator-owned reasoning effort')\n  }\n  for (const name of ['requested', 'provider', 'model', 'snapshot'] as const) {\n    if (typeof source[name] !== 'string' || source[name].length === 0) {\n      throw new Error(`resolved candidate model ${name} must be non-empty`)\n    }\n  }\n  return source as unknown as AgentCandidateResolvedModel\n}\n\nfunction assertGrantIdentity(\n  expected: RememberedReservation,\n  actual: AgentCandidateModelGrantActivateInput | AgentCandidateModelGrantSettleInput,\n): void {\n  if (\n    actual.executionId !== expected.executionId ||\n    actual.preparationId !== expected.preparationId ||\n    actual.grantDigest !== expected.grantDigest ||\n    canonicalCandidateDigest(actual.resolved) !== canonicalCandidateDigest(expected.resolved)\n  ) {\n    throw new Error('protected model grant input does not match its immutable reservation')\n  }\n}\n\nfunction assertWithinReservedLimits(\n  usage: {\n    modelCalls: number\n    inputTokens: number\n    outputTokens: number\n    costUsdNanos: number\n  },\n  reservation: RememberedReservation,\n): void {\n  for (const [name, actual, limit] of [\n    ['model calls', usage.modelCalls, reservation.limits.maxModelCalls],\n    ['input tokens', usage.inputTokens, reservation.limits.maxInputTokens],\n    ['output tokens', usage.outputTokens, reservation.limits.maxOutputTokens],\n    ['cost USD nanos', usage.costUsdNanos, reservation.maxCostUsdNanos],\n  ] as const) {\n    if (actual > limit) {\n      throw new Error(`protected model settlement ${name} ${actual} exceeds reserved ${limit}`)\n    }\n  }\n}\n\nfunction exactEnvironmentNames(values: readonly string[]): readonly string[] {\n  if (values.length === 0) {\n    throw new Error('protected model activation environment names must not be empty')\n  }\n  const names = [...values].sort()\n  if (new Set(names).size !== names.length) {\n    throw new Error('protected model activation environment names must be unique')\n  }\n  for (const name of names) {\n    if (\n      !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) ||\n      ['__proto__', 'constructor', 'prototype'].includes(name)\n    ) {\n      throw new Error(`protected model activation environment name is invalid: ${name}`)\n    }\n  }\n  return Object.freeze(names)\n}\n\nfunction assertGatewayDomain(value: string): string {\n  if (\n    value.length > 253 ||\n    value !== value.toLowerCase() ||\n    value.endsWith('.') ||\n    value.includes(':') ||\n    value === 'localhost' ||\n    value.endsWith('.localhost') ||\n    value === 'metadata.google' ||\n    value === 'metadata.google.internal'\n  ) {\n    throw new Error('protected model gateway must be an exact lowercase public DNS name')\n  }\n  const labels = value.split('.')\n  if (\n    labels.length < 2 ||\n    !labels.every(\n      (label) =>\n        label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label),\n    ) ||\n    !/[a-z]/.test(labels.at(-1) ?? '')\n  ) {\n    throw new Error('protected model gateway must be an exact lowercase public DNS name')\n  }\n  return value\n}\n\nfunction reservationKey(executionId: string, preparationId: string): string {\n  return canonicalCandidateDigest({ executionId, preparationId })\n}\n\nfunction pruneExpiredState(\n  reservations: Map<string, RememberedReservation>,\n  settlements: Map<string, RememberedSettlement>,\n  now: number,\n): void {\n  for (const [key, value] of reservations) {\n    if (value.expiresAtMs <= now) reservations.delete(key)\n  }\n  for (const [key, value] of settlements) {\n    if (value.expiresAtMs <= now) settlements.delete(key)\n  }\n}\n\nfunction rememberSettlement(\n  settlements: Map<string, RememberedSettlement>,\n  key: string,\n  value: RememberedSettlement,\n): void {\n  settlements.delete(key)\n  settlements.set(key, value)\n  while (settlements.size > MAX_RECENT_SETTLEMENTS) {\n    const oldest = settlements.keys().next().value\n    if (oldest === undefined) return\n    settlements.delete(oldest)\n  }\n}\n\nfunction isSha256Digest(value: unknown): value is Sha256Digest {\n  return typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value)\n}\n\nfunction exactRecord(\n  value: unknown,\n  keys: readonly string[],\n  label: string,\n): Record<string, unknown> {\n  const source = record(value, label)\n  assertExactObjectKeys(source, keys, label)\n  return source\n}\n\nfunction record(value: unknown, label: string): Record<string, unknown> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`${label} must be an object`)\n  }\n  const prototype = Object.getPrototypeOf(value)\n  if (prototype !== Object.prototype && prototype !== null) {\n    throw new Error(`${label} must be a plain object`)\n  }\n  return value as Record<string, unknown>\n}\n"],"mappings":";;;;AAgCA,MAAM,+BAA+B;AACrC,MAAM,gCAAgC,KAAK;;AA2B3C,SAAgB,wCACd,SAC4B;CAC5B,OAAO,IAAI,mCAAmC,OAAO;AACvD;AAEA,IAAM,qCAAN,MAA+E;CAShD;CAR7B,yBAA0B,IAAI,IAAkC;CAChE;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAAgE;EAA/C,KAAA,UAAA;EAC3B,IAAI,CAAC,QAAQ,SAAS,cACpB,MAAM,IAAI,MACR,+BAA+B,QAAQ,SAAS,KAAK,qCACvD;EAEF,KAAK,eAAe,QAAQ,SAAS;EACrC,KAAK,YAAY,eAAe,QAAQ,SAAS;EACjD,KAAK,qBAAqB,gBACxB,QAAQ,sBAAsB,8BAC9B,iCACF;EACA,KAAK,sBAAsB,gBACzB,QAAQ,uBAAuB,+BAC/B,kCACF;EACA,KAAK,kBAAkB,QAAQ,kBAC3B,wBAAwB,QAAQ,eAAe,IAC/C,KAAA;CACN;CAEA,MAAM,QACJ,SACA,SACA;EACA,uBAAuB,OAAO;EAC9B,MAAM,UAAU,QAAQ,UAAU,KAAK;EACvC,IAAI,QAAQ,SAAS,UAAU,MAAM,IAAI,MAAM,gDAAgD;EAC/F,MAAM,UAAU,QAAQ,cAAc,MAAM,SAAS,MAAM,OAAO;EAClE,MAAM,SACJ,QAAQ,SAAS,aACZ,EAAE,MAAM,UAAU,IAClB;GAAE,MAAM;GAAU,cAAc,CAAC,GAAG,QAAQ,OAAO;EAAE;EAC5D,MAAM,KAAK,iBAAiB,OAAO,IAAI;EACvC,QAAQ,OAAO,eAAe;EAE9B,MAAM,MAAM,aAAa,QAAQ,aAAa,QAAQ,cAAc,MAAM,MAAM;EAChF,IAAI,KAAK,OAAO,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,mDAAmD;EAC7F,MAAM,QAAQ,WACZ,QAAQ,cAAc,MAAM,SAAS,UAAU,OAC/C,QAAQ,cAAc,MAAM,SAAS,UAAU,cACjD;EACA,MAAM,gBAAgB,sBACpB,QAAQ,WAAW,WACnB,KAAK,mBACP;EAcA,MAAM,oBAAoB,yBAbH,wBAAwB;GAC7C,MAAM;GACN,UAAU,KAAK,QAAQ,SAAS;GAChC,aAAa,QAAQ;GACrB,qBAAqB,QAAQ,cAAc,MAAM;GACjD;GACA;GACA;GACA,oBAAoB,KAAK;GACzB,WAAW,KAAK;GAChB,QAAQ;IAAE,WAAW,QAAQ;IAAW,UAAU,QAAQ;GAAS;GACnE,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;EAC1E,CACgE,CAAC;EACjE,MAAM,WAAW,wBAAwB;GACvC,MAAM;GACN,UAAU,KAAK,QAAQ,SAAS;GAChC,aAAa,QAAQ;GACrB,qBAAqB,QAAQ,cAAc,MAAM;GACjD;GACA,iBAAiB,QAAQ;GACzB,gBAAgB,QAAQ;EAC1B,CAAC;EACD,MAAM,cAAc,MAAM,KAAK,aAAa,OAAO;GACjD;GACA;GACA;GACA,oBAAoB,KAAK;GACzB,WAAW,KAAK;GAChB;GACA,gBAAgB,wBACd,QAAQ,aACR,QAAQ,cAAc,MAAM,MAC9B;GACA,QAAQ,QAAQ;GAChB,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;EAC1E,CAAC;EACD,IAAI;GACF,2BAA2B,aAAa,UAAU,KAAK,QAAQ,SAAS,IAAI;EAC9E,SAAS,OAAO;GACd,IAAI;IACF,MAAM,YAAY,QAAQ;GAC5B,SAAS,cAAc;IACrB,MAAM,IAAI,eACR,CAAC,OAAO,YAAY,GACpB,kDACF;GACF;GACA,MAAM;EACR;EACA,MAAM,QAA8B,EAAE,YAAY;EAClD,KAAK,OAAO,IAAI,KAAK,KAAK;EAG1B,KAAI,MADmB,YAAY,QAAQ,KAAK,EAAA,CACnC,WAAW,GACtB,MAAM,IAAI,MAAM,wDAAwD;EAE1E,MAAM,mBAAmB,aAAa,SAAS,QAAQ,MAAM;EAC7D,MAAM,SAAS,YAAY,OAAO;EAClC,MAAM,YAAY,KAAK,IAAI;EAC3B,MAAM,QAAQ;GACZ,OAAO,QAAQ,MAAM;GACrB,YAAY,QAAQ,UAAU,KAAK,SAAS;GAC5C;GACA,cAAc,QAAQ;GACtB,WAAW,QAAQ,WAAW;GAC9B,MAAM;IACJ,GAAG,QAAQ,MAAM;IACjB,eAAe,YAAY;IAC3B,qBAAqB,YAAY;GACnC;GACA,SAAS;EACX;EACA,MAAM,UAAU,MAAM,YAAY,QAAQ,MAAM,QAAQ,EAAE,QAAQ,QAAQ,OAAO,CAAC;EAClF,MAAM,gBAAgB,cAAc,SAAS,QAAQ,QAAQ;EAC7D,cAAmB,YAAY,KAAA,CAAS;EACxC,IAAI;EACJ,IAAI,gBAAgB;EACpB,MAAM,eAAe;GACnB,IAAI,CAAC,eAAe,iBAAiB,YAAY,OAAO;EAC1D;EACA,QAAQ,OAAO,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;EAC/D,IAAI,QAAQ,OAAO,SAAS,OAAO;EACnC,IAAI;GACF,MAAM,cAAc,MAAM,QAAQ,KAAK;GACvC,gBAAgB;GAChB,QAAQ,OAAO,oBAAoB,SAAS,MAAM;GAClD,IAAI,cAAc,MAAM;GACxB,MAAM,SAAS,MAAM,QAAQ,OAAO;GACpC,qBAAqB,QAAQ,WAAW;GACxC,MAAM,SAAS,MAAM,YAAY,eAAe,QAAQ,QAAQ,QAAQ,YAAY;GACpF,MAAM,cAAc;GACpB,MAAM,wBAAwB,OAAO,QAAQ,YAAY,MAAM;GAC/D,OAAO;IAAE,aAAa,QAAQ;IAAa;GAAY;EACzD,UAAU;GACR,QAAQ,OAAO,oBAAoB,SAAS,MAAM;EACpD;CACF;CAEA,MAAM,KACJ,SACA,SACqC;EACrC,MAAM,KAAK,iBAAiB;EAC5B,QAAQ,OAAO,eAAe;EAC9B,MAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,IAAI;EACpD,IAAI,CAAC,aAAa,OAAO,EAAE,SAAS,KAAK;EACzC,IAAI,WAAW,MAAM,YAAY,QAAQ,KAAK;EAC9C,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,MAAM,oEAAoE;EAEtF,MAAM,SAAS,SAAS;EACxB,IAAI,QAAQ,SAAS;GACnB,MAAM,UAAU,MAAM,YAAY,QAAQ,IAAI,OAAO,GAAG;GACxD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,uDAAuD;GACrF,MAAM,YAAY,OAAO;EAC3B;EACA,QAAQ,OAAO,eAAe;EAC9B,WAAW,MAAM,YAAY,QAAQ,KAAK;EAC1C,IAAI,SAAS,MAAM,UAAU,MAAM,OAAO,GACxC,MAAM,IAAI,MAAM,mDAAmD;EAErE,MAAM,cAAc,SAAS;EAC7B,IAAI,aAAa,qBAAqB,WAAW;EACjD,MAAM,QAAQ,KAAK,OAAO,IAAI,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;EAC5F,IAAI,OAAO;GACT,MAAM,cAAc,aAAa,eAAe,MAAM;GACtD,IAAI,QAAQ,WAAW,aAAa,MAAM,OACxC,MAAM,qBAAqB;IACzB,MAAM;IACN,WAAW,MAAM,MAAM;GACzB;GAEF,MAAM,wBAAwB,OAAO,QAAQ,YAAY,WAAW;EACtE;EACA,OAAO,EAAE,SAAS,KAAK;CACzB;CAEA,MAAM,QACJ,SACA,SACA;EACA,MAAM,KAAK,iBAAiB;EAC5B,QAAQ,OAAO,eAAe;EAC9B,MAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,KAAK;EACrD,MAAM,WAAW,MAAM,YAAY,QAAQ,KAAK;EAChD,MAAM,SAAS,SAAS;EACxB,IAAI,SAAS,WAAW,KAAK,CAAC,UAAU,OAAO,SAC7C,MAAM,IAAI,MAAM,uEAAuE;EAEzF,qBAAqB,MAAM;EAC3B,MAAM,UAAU,MAAM,YAAY,QAAQ,IAAI,OAAO,GAAG;EACxD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,wDAAwD;EAEtF,qBAAqB,MADO,QAAQ,OAAO,GACP,OAAO,WAAW;EACtD,MAAM,QAAQ,KAAK,OAAO,IAAI,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;EAC5F,MAAM,SACJ,OAAO,UACN,MAAM,YACL,cAAc,SAAS,WAAW,WAAW,CAAC,CAAC,QAAQ,GACvD,QAAQ,QACR,KAAK,IAAI,IAAI,KAAK,kBACpB;EACF,QAAQ,OAAO,eAAe;EAC9B,MAAM,WAAW,wBAAwB;GACvC,MAAM;GACN,UAAU,YAAY;GACtB,eAAe,YAAY;GAC3B,aAAa,QAAQ;GACrB,qBAAqB,QAAQ;GAC7B,mBAAmB,YAAY,UAAU;GACzC,SAAS;IACP,KAAK,OAAO;IACZ,UAAU,OAAO;IACjB,GAAI,OAAO,aAAa,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC;IAC7D,aAAa,OAAO;GACtB;GACA,GAAI,OAAO,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;GACpF,QAAQ;IAAE,QAAQ,YAAY,MAAM;IAAG,YAAY,OAAO;GAAW;EACvE,CAAC;EACD,OAAO;GACL,aAAa;IAAE,MAAM;IAAmB,OAAO;GAAO;GACtD;EACF;CACF;CAEA,MAAM,QACJ,SACA,SACsC;EACtC,MAAM,KAAK,iBAAiB;EAC5B,QAAQ,OAAO,eAAe;EAC9B,MAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,IAAI;EACpD,IAAI,CAAC,aAAa,OAAO,EAAE,UAAU,KAAK;EAC1C,IAAI;EACJ,IAAI;GACF,MAAM,YAAY,QAAQ;EAC5B,SAAS,OAAO;GACd,eAAe;EACjB;EAEA,IAAI,MADoB,KAAK,aAAa,IAAI,YAAY,EAAE,GAE1D,MAAM,IAAI,MAAM,oDAAoD,EAAE,OAAO,aAAa,CAAC;EAE7F,QAAQ,OAAO,eAAe;EAC9B,KAAK,OAAO,OAAO,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;EACjF,OAAO,EAAE,UAAU,KAAK;CAC1B;CAEA,MAAc,iBAAiB,MAA4C;EACzE,MAAM,UACJ,KAAK,uBAAuB,QAAQ,QAAQ,KAAK,QAAQ,SAAS,aAAa,CAAC;EAClF,KAAK,sBAAsB;EAC3B,IAAI;EACJ,IAAI;GACF,eAAe,MAAM;EACvB,SAAS,OAAO;GACd,IAAI,KAAK,wBAAwB,SAAS,KAAK,sBAAsB,KAAA;GACrE,MAAM;EACR;EACA,MAAM,QAAQ,aAAa;EAC3B,IAAI,CAAC,OACH,MAAM,IAAI,MACR,+BAA+B,KAAK,QAAQ,SAAS,KAAK,yCAC5D;EAEF,IAAI,QAAQ,CAAC,MAAM,OAAO,SAAS,IAAI,GACrC,MAAM,IAAI,MACR,+BAA+B,KAAK,QAAQ,SAAS,KAAK,qBAAqB,KAAK,cACtF;CAEJ;CAUA,MAAc,QACZ,SACA,kBACmD;EACnD,MAAM,MAAM,aAAa,QAAQ,aAAa,QAAQ,mBAAmB;EACzE,MAAM,SAAS,KAAK,OAAO,IAAI,GAAG,CAAC,EAAE;EACrC,IAAI,QAAQ,OAAO;EACnB,MAAM,WAAW;GACf,MAAM;GACN,UAAU,KAAK,QAAQ,SAAS;GAChC,aAAa,QAAQ;GACrB,qBAAqB,QAAQ;EAC/B;EAKA,MAAM,WAAU,MAJK,KAAK,aAAa,KAAK;GAC1C;GACA,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;EAC1E,CAAC,EAAA,CACsB,QACpB,gBACC,YAAY,aAAa,KAAK,QAAQ,SAAS,QAC/C,OAAO,QAAQ,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,WACrC,kBAAkB,YAAY,WAAW,OAAO,KAAK,CACvD,CACJ;EACA,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,MAAM,mEAAmE;EAErF,MAAM,cAAc,QAAQ;EAC5B,IAAI,CAAC,aAAa;GAChB,IAAI,kBAAkB,OAAO,KAAA;GAC7B,MAAM,IAAI,MAAM,iDAAiD;EACnE;EACA,IAAI,CAACA,iBAAe,YAAY,UAAU,iBAAiB,GACzD,MAAM,IAAI,MAAM,4DAA4D;EAE9E,KAAK,OAAO,IAAI,KAAK,EAAE,YAAY,CAAC;EACpC,OAAO;CACT;AACF;AAEA,eAAe,wBACb,OACA,YACA,QACe;CACf,MAAM,QAAQ,MAAM;CACpB,IAAI,CAAC,SAAS,MAAM,SAAS;CAC7B,MAAM,UAAU,KAAK,IAAI,MAAM,WAAW,KAAK,IAAI,KAAK,IAAI,GAAG,MAAM,YAAY,CAAC;CAClF,MAAM,cAAc,MAAM,sBAAsB,MAAM,eAAe,QAAQ;CAC7E,MAAM,WAAW,UAAU;EACzB,OAAO,MAAM;EACb,YAAY,MAAM;EAClB,WAAW,MAAM;EACjB;EACA,QAAQ,aAAa,SAAS,UAAU,YAAY,aAAa,IAAI,cAAc;EACnF,MAAM,MAAM;CACd,CAAC;CACD,MAAM,UAAU;AAClB;AAEA,SAAS,uBAAuB,SAA8C;CAC5E,IAAI,QAAQ,UAAU,KAAK,QAAQ,SAAS,UAC1C,MAAM,IAAI,MACR,gFACF;CAEF,IAAI,QAAQ,cAAc,MAAM,SAAS,aAAa,cAAc,QAAQ,OAAO,WACjF,MAAM,IAAI,MAAM,6EAA6E;CAE/F,IAAI,QAAQ,OAAO,SAAS,YAC1B,MAAM,IAAI,MAAM,mEAAmE;CAErF,MAAM,YAAY,QAAQ,UAAU,KAAK,QAAQ,UAAU,YAAY;CACvE,IACE,EACE,UAAU,WAAW,OAAO,KAC5B,cAAc,sBACd,UAAU,SAAS,OAAO,IAG5B,MAAM,IAAI,MAAM,4EAA4E;CAE9F,IAAI,CAAC,MAAM,WAAW,QAAQ,OAAO,UAAU,KAAK,CAAC,QAAQ,OAAO,IAAI,MAAM,KAAK,GACjF,MAAM,IAAI,MAAM,8EAA8E;AAElG;AAEA,eAAe,mBACb,aACA,SACA,QACe;CACf,MAAM,iBAAiB,gCAAgC,OAAO;CAC9D,KAAK,MAAM,QAAQ,QAAQ,OAAO,KAAK,OACrC,MAAM,YAAY,UAAU,QAAQ,QAAQ,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,OAAO;EAClF,MAAM,KAAK;EACX;CACF,CAAC;CAEH,MAAM,cACJ,QAAQ,cAAc,MAAM,SAAS,QAAQ,oBAAoB,SAC7D,QAAQ,MAAM,WACd,QAAQ,MAAM;CACpB,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,+CAA+C;CACjF,KAAK,MAAM,QAAQ,QAAQ,kBAAkB,OAC3C,MAAM,YAAY,UAChB,QAAQ,aAAa,KAAK,IAAI,GAC9B,OAAO,KAAK,KAAK,SAAS,MAAM,GAChC;EAAE,MAAM,KAAK;EAAM;CAAO,CAC5B;CAEF,IAAI,QAAQ,aAAa,gBAAgB;EACvC,KAAK,MAAM,QAAQ,QAAQ,UAAU,OACnC,MAAM,YAAY,UAAU,QAAQ,eAAe,MAAM,KAAK,IAAI,GAAG,KAAK,OAAO;GAC/E,MAAM,KAAK;GACX;EACF,CAAC;EAEH,IAAI,QAAQ,UAAU,mBAAmB,eAAe,iBACtD,MAAM,YAAY,UAChB,eAAe,iBACf,QAAQ,UAAU,iBAClB;GAAE,MAAM;GAAO;EAAO,CACxB;CAEJ;CACA,IAAI,QAAQ,YAAY,SAAS,SAAS,aACxC,MAAM,YAAY,UAAU,QAAQ,YAAY,SAAS,MAAM,QAAQ,YAAY,OAAO;EACxF,MAAM;EACN;CACF,CAAC;AAEL;AAEA,SAAS,gCACP,SACiE;CACjE,MAAM,YAAY,QAAQ;CAC1B,IAAI,CAAC,WAAW;EACd,IACE,QAAQ,OAAO,IAAA,uCAAsC,KAAA,KACrD,QAAQ,OAAO,IAAA,mDAAkD,KAAA,GAEjE,MAAM,IAAI,MAAM,sEAAsE;EAExF;CACF;CACA,MAAM,QAAQ,iCACZ,QAAQ,MAAM,UACd,UAAU,oBAAoB,KAAA,CAChC;CACA,IACE,QAAQ,OAAO,IAAA,uCAAsC,MAAM,QAC3D,QAAQ,OAAO,IAAA,mDAAkD,MAAM,iBAEvE,MAAM,IAAI,MAAM,sEAAsE;CAExF,MAAM,WAAW,CAAC,MAAM,MAAM,MAAM,eAAe,CAAC,CAAC,QAClD,UAA2B,UAAU,KAAA,CACxC;CACA,MAAM,cACJ,QAAQ,cAAc,MAAM,SAAS,QAAQ,oBAAoB,SAC7D,QAAQ,MAAM,WACd,QAAQ,MAAM;CAUpB,IACE;EATA,GAAG,QAAQ,OAAO,KAAK,MAAM,KAAK,SAAS,QAAQ,QAAQ,MAAM,UAAU,KAAK,IAAI,CAAC;EACrF,GAAI,cACA,QAAQ,kBAAkB,MAAM,KAAK,SAAS,QAAQ,aAAa,KAAK,IAAI,CAAC,IAC7E,CAAC;EACL,GAAI,QAAQ,YAAY,SAAS,SAAS,cACtC,CAAC,QAAQ,YAAY,SAAS,IAAI,IAClC,CAAC;CAGI,CAAC,CAAC,MAAM,SACf,SAAS,MACN,iBACC,SAAS,gBACT,KAAK,WAAW,GAAG,aAAa,EAAE,KAClC,aAAa,WAAW,GAAG,KAAK,EAAE,CACtC,CACF,GAEA,MAAM,IAAI,MAAM,0DAA0D;CAE5E,OAAO;AACT;AAEA,SAAS,YAAY,SAAiE;CACpF,MAAM,cAAc,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,QAAQ,YAAY,KAAK;CAC9F,MAAM,OAAO;EACX,YAAY,QAAQ,OAAO;EAC3B,MAAM,QAAQ,OAAO;EACrB,KAAK,QAAQ,OAAO;EACpB,KAAK,QAAQ,OAAO;EACpB,WAAW;CACb;CACA,QAAQ,QAAQ,YAAY,SAAS,MAArC;EACE,KAAK,eACH,OAAO;GAAE,GAAG;GAAM,MAAM,CAAC,GAAG,KAAK,MAAM,WAAW;EAAE;EACtD,KAAK,cACH,OAAO;GAAE,GAAG;GAAM,OAAO;EAAY;EACvC,KAAK,aACH,OAAO;CACX;AACF;AAEA,eAAe,cAAc,SAA4B,UAAuC;CAC9F,MAAM,SAAmB,CAAC;CAC1B,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ,OAAO,GAAG;EAC1C,MAAM,QAAQ,OAAO,KAAK,OAAO,MAAM;EACvC,cAAc,MAAM;EACpB,IAAI,aAAa,UAAU;GACzB,IAAI;GACJ,IAAI;IACF,MAAM,YAAY,OAAO;GAC3B,SAAS,OAAO;IACd,YAAY;GACd;GACA,MAAM,IAAI,MAAM,gCAAgC,SAAS,gBAAgB,EACvE,OAAO,UACT,CAAC;EACH;EACA,OAAO,KAAK,KAAK;CACnB;CACA,OAAO,WAAW,KAAK,OAAO,OAAO,QAAQ,UAAU,CAAC;AAC1D;AAEA,eAAe,YACb,QACA,QACA,cACqB;CACrB,OAAO,eAAe;CACtB,MAAM,cAAc,eAAe,KAAK,IAAI;CAC5C,IAAI,eAAe,GAAG,MAAM,IAAI,MAAM,mCAAmC;CACzE,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,QACA,IAAI,SAAgB,UAAU,WAAW;GACvC,gBAAgB,OAAO,OAAO,0BAAU,IAAI,MAAM,4BAA4B,CAAC;GAC/E,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;GACxD,QAAQ,iBACA,uBAAO,IAAI,MAAM,mCAAmC,CAAC,GAC3D,WACF;EACF,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,SAAS,OAAO,oBAAoB,SAAS,OAAO;EACxD,IAAI,OAAO,aAAa,KAAK;CAC/B;AACF;AAEA,eAAe,YAAY,SAA2C;CAEpE,IAAI,EAAC,MADgB,QAAQ,OAAO,EAAA,CACxB,SAAS;CACrB,IAAI;EACF,MAAM,QAAQ,KAAK;CACrB,SAAS,OAAO;EACd,KAAK,MAAM,QAAQ,OAAO,EAAA,CAAG,SAAS,MAAM;CAC9C;CACA,MAAM,cAAc,MAAM,QAAQ,KAAK;CACvC,qBAAqB,MAAM,QAAQ,OAAO,GAAG,WAAW;AAC1D;AAEA,SAAS,qBACP,QACA,UACwF;CACxF,IAAI,OAAO,WAAW,CAAC,OAAO,aAC5B,MAAM,IAAI,MAAM,sDAAsD;CAExE,IAAI,YAAY,CAAC,kBAAkB,OAAO,aAAa,QAAQ,GAC7D,MAAM,IAAI,MAAM,mEAAmE;AAEvF;AAEA,SAAS,2BACP,aACA,UACA,cACM;CACN,IAAI,CAAC,YAAY,MAAM,YAAY,aAAa,cAC9C,MAAM,IAAI,MAAM,gEAAgE;CAElF,IACE,CAAC,OAAO,QAAQ,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,WACtC,kBAAkB,YAAY,WAAW,OAAO,KAAK,CACvD,GAEA,MAAM,IAAI,MAAM,qEAAqE;AAEzF;AAEA,SAAS,WAAW,aAAiE;CACnF,MAAM,WAAW,YAAY,UAAU;CACvC,IAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,OAAO,QAAQ,IAAI,GACxD,MAAM,IAAI,MAAM,qDAAqD;CAEvE,OAAO,EAAE,UAAU,OAAO,QAAQ,EAAE;AACtC;AAEA,SAAS,aAAa,aAAqB,qBAA2C;CACpF,OAAO,GAAG,YAAY,IAAI;AAC5B;AAEA,SAAS,wBAAwB,aAAqB,qBAA2C;CAC/F,OAAO,aAAa,yBAAyB;EAC3C,MAAM;EACN;EACA;CACF,CAAC,CAAC,CAAC,MAAM,CAAgB;AAC3B;AAEA,SAAS,WAAW,OAAe,gBAAsC;CACvE,IAAIA,iBAAe,KAAK,GAAG;EACzB,IAAI,UAAU,gBACZ,MAAM,IAAI,MAAM,gEAAgE;EAElF,OAAO;CACT;CACA,MAAM,SAAS,MAAM,YAAY,GAAG;CACpC,IAAI,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG;CACnC,IAAI,MAAM,MAAM,SAAS,CAAC,MAAM,gBAC9B,MAAM,IAAI,MAAM,gEAAgE;CAElF,OAAO;AACT;AAEA,SAAS,sBAAsB,WAAmB,aAA6B;CAC7E,MAAM,QAAQ,gBAAgB,WAAW,6BAA6B,IAAI;CAC1E,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG,MAAM,IAAI,MAAM,6CAA6C;CAC/F,OAAO,KAAK,KAAK,QAAQ,GAAK,IAAI;AACpC;AAEA,SAAS,eAAe,WAAmE;CACzF,IAAI,CAAC,OAAO,SAAS,UAAU,GAAG,KAAK,UAAU,OAAO,GACtD,MAAM,IAAI,MAAM,+CAA+C;CAEjE,OAAO,OAAO,OAAO;EACnB,KAAK,UAAU;EACf,UAAU,gBAAgB,UAAU,UAAU,sBAAsB;EACpE,QAAQ,gBAAgB,UAAU,QAAQ,oBAAoB;CAChE,CAAC;AACH;AAEA,SAAS,gBAAgB,OAAe,OAAuB;CAC7D,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAC1C,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CACvD,OAAO;AACT;AAEA,SAAS,QAAQ,MAAc,cAA8B;CAC3D,IAAI,MAAM,WAAW,YAAY,GAAG,MAAM,IAAI,MAAM,uCAAuC;CAC3F,MAAM,OAAO,MAAM,UAAU,YAAY;CACzC,IAAI,SAAS,QAAQ,KAAK,WAAW,KAAK,GACxC,MAAM,IAAI,MAAM,iDAAiD;CAEnE,OAAO,MAAM,KAAK,MAAM,IAAI;AAC9B;AAEA,SAASA,iBAAe,OAAuC;CAC7D,OAAO,OAAO,UAAU,YAAY,wBAAwB,KAAK,KAAK;AACxE;;;AC1oBA,MAAM,yBAAyB;AAC/B,MAAM,oCAAoC,MAAU;;;;;;;;AASpD,SAAgB,uCACd,SACyB;CACzB,MAAM,gBAAgB,oBAAoB,QAAQ,aAAa;CAC/D,MAAM,qBAAqB,sBAAsB,QAAQ,kBAAkB;CAC3E,MAAM,+BAAe,IAAI,IAAmC;CAC5D,MAAM,oCAAoB,IAAI,IAAkC;CAEhE,OAAO;EACL,SAAS,OAAO,UAAU;GACxB,MAAM,UAAU,wBAAwB,KAAK;GAE7C,OAAO,wBADU,sBAAsB,MAAM,QAAQ,aAAa,OAAO,GAAG,OACtC,CAAC;EACzC;EAEA,cAAc,OAAO,UAAU;GAC7B,kBAAkB,cAAc,mBAAmB,KAAK,IAAI,CAAC;GAC7D,MAAM,UAAU,wBAAwB,KAAK;GAC7C,qBAAqB,OAAO;GAC5B,MAAM,gBAAgB,yBAAyB,OAAO;GACtD,MAAM,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;GACrE,IAAI,kBAAkB,IAAI,GAAG,GAC3B,MAAM,IAAI,MAAM,gDAAgD;GAElE,MAAM,WAAW,aAAa,IAAI,GAAG;GACrC,IAAI,YAAY,SAAS,kBAAkB,eACzC,MAAM,IAAI,MAAM,2DAA2D;GAG7E,MAAM,cAAc,oBAClB,MAAM,QAAQ,OAAO,QAAQ,OAAO,GACpC,SACA,aACF;GACA,MAAM,iBAAiB,yBAAyB,WAAW;GAC3D,IAAI,kBAAkB,IAAI,GAAG,GAC3B,MAAM,IAAI,MAAM,mEAAmE;GAErF,MAAM,WAAW,YAAY,aAAa,IAAI,GAAG;GACjD,IAAI,YAAY,SAAS,kBAAkB,eACzC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,IAAI,YAAY,SAAS,mBAAmB,gBAC1C,MAAM,IAAI,MAAM,+DAA+D;GAEjF,IAAI,CAAC,UACH,aAAa,IAAI,KAAK;IACpB;IACA;IACA,aAAa,QAAQ;IACrB,eAAe,QAAQ;IACvB,aAAa,YAAY;IACzB,aAAa,QAAQ;IACrB,UAAU,wBAAwB,QAAQ,QAAQ;IAClD,QAAQ,wBAAwB,QAAQ,MAAM;IAC9C,iBAAiB,WAAW,QAAQ,OAAO,YAAY,qBAAqB;IAC5E,YAAY;GACd,CAAC;GAEH,OAAO;EACT;EAEA,eAAe,OAAO,UAAU;GAC9B,kBAAkB,cAAc,mBAAmB,KAAK,IAAI,CAAC;GAC7D,MAAM,UAAU,wBAAwB,KAAK;GAC7C,MAAM,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;GACrE,IAAI,kBAAkB,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,0CAA0C;GAC1F,MAAM,QAAQ,aAAa,IAAI,GAAG;GAClC,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,qDAAqD;GACjF,oBAAoB,OAAO,OAAO;GAClC,IAAI,MAAM,kBAAkB,MAAM,IAAI,MAAM,0CAA0C;GACtF,IAAI,MAAM,eAAe,YACvB,MAAM,IAAI,MAAM,gDAAgD;GAElE,IAAI,CAAC,OAAO,cAAc,QAAQ,YAAY,KAAK,QAAQ,gBAAgB,GACzE,MAAM,IAAI,MAAM,qEAAqE;GAEvF,IAAI,QAAQ,gBAAgB,KAAK,IAAI,GACnC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,IAAI,QAAQ,eAAe,MAAM,aAC/B,MAAM,IAAI,MAAM,iEAAiE;GAEnF,MAAM,aAAa;GACnB,IAAI;IACF,MAAM,aAAa,mBACjB,MAAM,QAAQ,OAAO,SAAS,OAAO,GACrC,MAAM,OAAO,kBAAkB,IAAI,CAAC,IAAI,kBAC1C;IACA,IAAI,kBAAkB,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,MAAM,OAC1D,MAAM,IAAI,MAAM,8DAA8D;IAEhF,MAAM,aAAa;IACnB,OAAO;GACT,SAAS,OAAO;IACd,MAAM,aAAa;IACnB,MAAM;GACR;EACF;EAEA,aAAa,OAAO,UAAU;GAC5B,MAAM,MAAM,KAAK,IAAI;GACrB,kBAAkB,cAAc,mBAAmB,GAAG;GACtD,MAAM,UAAU,wBAAwB,KAAK;GAC7C,MAAM,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;GACrE,MAAM,QAAQ,aAAa,IAAI,GAAG;GAClC,IAAI,OAAO,oBAAoB,OAAO,OAAO;GAC7C,MAAM,aAAa,SAAS,kBAAkB,IAAI,GAAG;GACrD,IAAI,YAAY,oBAAoB,WAAW,qBAAqB,QAAQ,QAC1E,MAAM,IAAI,MAAM,iEAAiE;GAGnF,MAAM,SAAS,kCAAkC,MAAM,QAAQ,OAAO,OAAO,OAAO,GAAG;IACrF,eAAe,QAAQ;IACvB,aAAa,QAAQ;IACrB,OAAO,QAAQ,SAAS;GAC1B,CAAC;GACD,IAAI,OAAO,2BAA2B,OAAO,OAAO,KAAK;GAEzD,MAAM,mBAAmB,yBAAyB,OAAO,KAAK;GAC9D,IAAI,YAAY,oBAAoB,WAAW,qBAAqB,kBAClE,MAAM,IAAI,MAAM,oEAAoE;GAEtF,IAAI,YAAY,oBAAoB,WAAW,qBAAqB,QAAQ,QAC1E,MAAM,IAAI,MAAM,iEAAiE;GAEnF,MAAM,cAAc,OAAO,eAAe,MAAM;GAChD,IAAI,OAAO;IACT,MAAM,mBAAmB;IACzB,MAAM,mBAAmB,QAAQ;GACnC;GACA,aAAa,OAAO,GAAG;GACvB,mBAAmB,mBAAmB,KAAK;IACzC;IACA,kBAAkB,QAAQ;IAC1B;GACF,CAAC;GACD,OAAO,OAAO;EAChB;CACF;AACF;AAEA,SAAS,qBAAqB,OAAmD;CAC/E,IAAI,CAAC,OAAO,cAAc,MAAM,WAAW,KAAK,MAAM,eAAe,GACnE,MAAM,IAAI,MAAM,oEAAoE;CAEtF,IAAI,MAAM,eAAe,KAAK,IAAI,GAChC,MAAM,IAAI,MAAM,0DAA0D;CAE5E,KAAK,MAAM,CAAC,MAAM,UAAU;EAC1B,CAAC,iBAAiB,MAAM,OAAO,aAAa;EAC5C,CAAC,kBAAkB,MAAM,OAAO,cAAc;EAC9C,CAAC,mBAAmB,MAAM,OAAO,eAAe;CAClD,GACE,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAC1C,MAAM,IAAI,MAAM,+BAA+B,KAAK,oCAAoC;CAG5F,WAAW,MAAM,OAAO,YAAY,qBAAqB;AAC3D;AAEA,SAAS,oBACP,OACA,UACA,eACqC;CACrC,MAAM,SAAS,YACb,OACA;EAAC;EAAiB;EAAU;EAAe;EAAkB;CAAS,GACtE,sCACF;CACA,IAAI,OAAO,kBAAkB,SAAS,eACpC,MAAM,IAAI,MAAM,mEAAmE;CAErF,IAAI,CAAC,eAAe,OAAO,MAAM,GAC/B,MAAM,IAAI,MAAM,4DAA4D;CAE9E,IAAI,OAAO,gBAAgB,SAAS,aAClC,MAAM,IAAI,MAAM,qDAAqD;CAEvE,YACE,OAAO,gBACP;EAAC;EAAiB;EAAkB;EAAmB;CAAY,GACnE,6CACF;CACA,IACE,yBAAyB,OAAO,cAAc,MAAM,yBAAyB,SAAS,MAAM,GAE5F,MAAM,IAAI,MAAM,8DAA8D;CAGhF,MAAM,UAAU,2BACd,OAAO,SACP,SAAS,OAAO,eAChB,aACF;CACA,OAAO,wBAAwB;EAC7B,eAAe,OAAO;EACtB,QAAQ,OAAO;EACf,aAAa,OAAO;EACpB,gBAAgB,OAAO;EACvB;CACF,CAAC;AACH;AAEA,SAAS,2BACP,OACA,eACA,eACkC;CAClC,IAAI,kBAAkB,GAAG;EAEvB,IADe,YAAY,OAAO,CAAC,MAAM,GAAG,qCACnC,CAAC,CAAC,SAAS,YAClB,MAAM,IAAI,MAAM,mEAAmE;EAErF,OAAO,EAAE,MAAM,WAAW;CAC5B;CAEA,MAAM,SAAS,YAAY,OAAO,CAAC,QAAQ,SAAS,GAAG,qCAAqC;CAC5F,IAAI,OAAO,SAAS,gBAClB,MAAM,IAAI,MAAM,+DAA+D;CAEjF,IACE,CAAC,MAAM,QAAQ,OAAO,OAAO,KAC7B,OAAO,QAAQ,WAAW,KAC1B,OAAO,QAAQ,OAAO,eAEtB,MAAM,IAAI,MAAM,mEAAmE;CAErF,OAAO;EAAE,MAAM;EAAgB,SAAS,CAAC,aAAa;CAAE;AAC1D;AAEA,SAAS,mBACP,OACA,eACwC;CAExC,MAAM,MAAM,OADG,YAAY,OAAO,CAAC,KAAK,GAAG,qCACnB,CAAC,CAAC,KAAK,wCAAwC;CACvE,MAAM,cAAc,OAAO,KAAK,GAAG,CAAC,CAAC,KAAK;CAC1C,IACE,YAAY,WAAW,cAAc,UACrC,YAAY,MAAM,MAAM,UAAU,SAAS,cAAc,MAAM,GAE/D,MAAM,IAAI,MAAM,kEAAkE;CAEpF,MAAM,WAAmC,OAAO,OAAO,IAAI;CAC3D,KAAK,MAAM,QAAQ,eAAe;EAChC,MAAM,QAAQ,IAAI;EAClB,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,SAAS,OAClE,MAAM,IAAI,MAAM,8BAA8B,KAAK,qCAAqC;EAE1F,SAAS,QAAQ;CACnB;CACA,OAAO,OAAO,OAAO,EAAE,KAAK,OAAO,OAAO,QAAQ,EAAE,CAAC;AACvD;AAEA,SAAS,sBACP,OACA,UAC6B;CAC7B,MAAM,SAAS,YACb,OACA;EAAC;EAAa;EAAY;EAAS;EAAY;CAAiB,GAChE,0BACF;CACA,IAAI,OAAO,cAAc,SAAS,WAChC,MAAM,IAAI,MAAM,oDAAoD;CAEtE,IAAI,OAAO,oBAAoB,SAAS,iBACtC,MAAM,IAAI,MAAM,6DAA6D;CAE/E,KAAK,MAAM,QAAQ;EAAC;EAAa;EAAY;EAAS;CAAU,GAC9D,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,KAAK,CAAC,WAAW,GAC9D,MAAM,IAAI,MAAM,4BAA4B,KAAK,mBAAmB;CAGxE,OAAO;AACT;AAEA,SAAS,oBACP,UACA,QACM;CACN,IACE,OAAO,gBAAgB,SAAS,eAChC,OAAO,kBAAkB,SAAS,iBAClC,OAAO,gBAAgB,SAAS,eAChC,yBAAyB,OAAO,QAAQ,MAAM,yBAAyB,SAAS,QAAQ,GAExF,MAAM,IAAI,MAAM,sEAAsE;AAE1F;AAEA,SAAS,2BACP,OAMA,aACM;CACN,KAAK,MAAM,CAAC,MAAM,QAAQ,UAAU;EAClC;GAAC;GAAe,MAAM;GAAY,YAAY,OAAO;EAAa;EAClE;GAAC;GAAgB,MAAM;GAAa,YAAY,OAAO;EAAc;EACrE;GAAC;GAAiB,MAAM;GAAc,YAAY,OAAO;EAAe;EACxE;GAAC;GAAkB,MAAM;GAAc,YAAY;EAAe;CACpE,GACE,IAAI,SAAS,OACX,MAAM,IAAI,MAAM,8BAA8B,KAAK,GAAG,OAAO,oBAAoB,OAAO;AAG9F;AAEA,SAAS,sBAAsB,QAA8C;CAC3E,IAAI,OAAO,WAAW,GACpB,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK;CAC/B,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,SAAS,MAAM,QAChC,MAAM,IAAI,MAAM,6DAA6D;CAE/E,KAAK,MAAM,QAAQ,OACjB,IACE,CAAC,2BAA2B,KAAK,IAAI,KACrC;EAAC;EAAa;EAAe;CAAW,CAAC,CAAC,SAAS,IAAI,GAEvD,MAAM,IAAI,MAAM,2DAA2D,MAAM;CAGrF,OAAO,OAAO,OAAO,KAAK;AAC5B;AAEA,SAAS,oBAAoB,OAAuB;CAClD,IACE,MAAM,SAAS,OACf,UAAU,MAAM,YAAY,KAC5B,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,GAAG,KAClB,UAAU,eACV,MAAM,SAAS,YAAY,KAC3B,UAAU,qBACV,UAAU,4BAEV,MAAM,IAAI,MAAM,oEAAoE;CAEtF,MAAM,SAAS,MAAM,MAAM,GAAG;CAC9B,IACE,OAAO,SAAS,KAChB,CAAC,OAAO,OACL,UACC,MAAM,UAAU,KAAK,MAAM,UAAU,MAAM,oCAAoC,KAAK,KAAK,CAC7F,KACA,CAAC,QAAQ,KAAK,OAAO,GAAG,EAAE,KAAK,EAAE,GAEjC,MAAM,IAAI,MAAM,oEAAoE;CAEtF,OAAO;AACT;AAEA,SAAS,eAAe,aAAqB,eAA+B;CAC1E,OAAO,yBAAyB;EAAE;EAAa;CAAc,CAAC;AAChE;AAEA,SAAS,kBACP,cACA,aACA,KACM;CACN,KAAK,MAAM,CAAC,KAAK,UAAU,cACzB,IAAI,MAAM,eAAe,KAAK,aAAa,OAAO,GAAG;CAEvD,KAAK,MAAM,CAAC,KAAK,UAAU,aACzB,IAAI,MAAM,eAAe,KAAK,YAAY,OAAO,GAAG;AAExD;AAEA,SAAS,mBACP,aACA,KACA,OACM;CACN,YAAY,OAAO,GAAG;CACtB,YAAY,IAAI,KAAK,KAAK;CAC1B,OAAO,YAAY,OAAO,wBAAwB;EAChD,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;EACzC,IAAI,WAAW,KAAA,GAAW;EAC1B,YAAY,OAAO,MAAM;CAC3B;AACF;AAEA,SAAS,eAAe,OAAuC;CAC7D,OAAO,OAAO,UAAU,YAAY,wBAAwB,KAAK,KAAK;AACxE;AAEA,SAAS,YACP,OACA,MACA,OACyB;CACzB,MAAM,SAAS,OAAO,OAAO,KAAK;CAClC,sBAAsB,QAAQ,MAAM,KAAK;CACzC,OAAO;AACT;AAEA,SAAS,OAAO,OAAgB,OAAwC;CACtE,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CAE9C,MAAM,YAAY,OAAO,eAAe,KAAK;CAC7C,IAAI,cAAc,OAAO,aAAa,cAAc,MAClD,MAAM,IAAI,MAAM,GAAG,MAAM,wBAAwB;CAEnD,OAAO;AACT"}

package/dist/{redact-C5xOm8cu.d.ts → redact-BkasKlyd.d.ts}

@@ -1,22 +1,19 @@
 import { a as LocalHarnessResult, c as runLocalHarness, i as LocalHarness, r as CodexTokenUsage, t as CodexExecutionEvidence } from "./local-harness-Dh8PJ0ot.js";
-import { AnalystFinding, CostLedgerHandle, MaximumCharge } from "@tangle-network/agent-eval";
-import { CampaignScenarioIdentity, CompareOptimizationMethodsOptions, LabeledScenarioStore, OptimizationMethod, OptimizationMethodComparison, WorktreeAdapter } from "@tangle-network/agent-eval/campaign";
+import { CostLedgerHandle, MaximumCharge, ProposalFinding } from "@tangle-network/agent-eval";
+import { CampaignScenarioIdentity, CompareOptimizationMethodsOptions, OptimizationMethod, OptimizationMethodComparison, WorktreeAdapter } from "@tangle-network/agent-eval/campaign";
 import { AgentProfile as AgentProfile$1, ReasoningEffort, Sha256Digest } from "@tangle-network/agent-interface";
 import { MutableSurface, Scenario as Scenario$1, SelfImproveBudget, SelfImproveOptions, SelfImproveResult } from "@tangle-network/agent-eval/contract";
 //#region src/improvement/improvement-driver.d.ts
-/** The byte-producing seam — the ONE thing that differs between the cheap
+/** The byte-producing path that differs between the cheap
  *  reflective path and the full agentic path. A generator makes (uncommitted)
  *  changes inside `worktreePath`; the driver commits them via the worktree
  *  adapter's `finalize`. */
 interface CandidateGenerator {
   kind: string;
-  /** Whether this generator can produce a candidate from an EMPTY findings set
-   *  and no phase-2 report — i.e. it draws its change signal from the repo and
-   *  the raw-trace filesystem context on disk, not only from pre-summarized
-   *  findings. An agentic coder (`agenticGenerator`) sets this: the seed repo +
-   *  raw traces ARE the signal, so it must still run the full `populationSize`
-   *  when the distiller yielded nothing (this is the meta-harness contract — the
-   *  agent diagnoses from the raw traces itself). A patch-applier
+  /** Whether this generator can produce a candidate from an empty findings set
+   *  because it draws its change signal from the repo and raw traces on disk.
+   *  An agentic coder (`agenticGenerator`) sets this so it still runs the full
+   *  `populationSize` when the distiller yielded nothing. A patch-applier
    *  (`reflectiveGenerator`) leaves it unset — with no findings there is no
    *  patch to draft, so the driver short-circuits rather than spin up worktrees
    *  for a guaranteed no-op. Default `false`. */
@@ -24,12 +21,8 @@ interface CandidateGenerator {
   generate(args: {
     /** The candidate worktree — a clean checkout of the current incumbent. */
     worktreePath: string;
-    /** Phase-2 research report (analyst findings + diff), opaque. */
-    report: unknown;
-    /** Findings resolved from the report or the loop context. */
-    findings: AnalystFinding[];
-    /** Handle to all captured data, to ground the change. */
-    dataset?: LabeledScenarioStore;
+    /** Search or production findings explicitly admitted for proposal use. */
+    findings: ReadonlyArray<ProposalFinding>;
     /** DEPTH: max iterations the generator may take (agentic uses this; the
      *  reflective generator ignores it). */
     maxShots: number;
@@ -169,11 +162,9 @@ interface AgenticGeneratorOptions {
   maximumCharge?: MaximumCharge;
   /** Per-shot wall-clock timeout (ms). Default = `runLocalHarness` default (5m). */
   timeoutMs?: number;
-  /** Build the harness task prompt from the report + findings. Override for
-   *  domain phrasing; the default turns findings into a concrete coder task. */
+  /** Build the harness task prompt from proposal findings. */
   buildPrompt?: (args: {
-    report: unknown;
-    findings: AnalystFinding[];
+    findings: ReadonlyArray<ProposalFinding>;
   }) => string;
   /** Verify the worktree after each dirtying shot. When set, a candidate that
    *  fails verification is NOT returned — the failure feeds the next shot
@@ -188,11 +179,10 @@ interface AgenticGeneratorOptions {
 }
 /** Full-agentic `CandidateGenerator` (the `shots=N, sandbox=on` setting): run a real coding harness inside the candidate worktree so the agent makes the change in place. */
 declare function agenticGenerator(opts?: AgenticGeneratorOptions): CandidateGenerator;
-/** Turn the analyst's findings (+ optional report) into a concrete coder task —
+/** Turn proposal findings into a concrete coder task —
  *  the senior scientific-method framing shared with the tool/MCP build prompts. */
 declare function defaultBuildPrompt(args: {
-  report: unknown;
-  findings: AnalystFinding[];
+  findings: ReadonlyArray<ProposalFinding>;
 }): string;
 /** A `Verifier` that runs a command in the worktree: exit 0 ⇒ ok, any other
  *  exit ⇒ failed with stdout+stderr as feedback. The common case — verify by
@@ -227,7 +217,7 @@ interface ImproveMethodContext {
   /** Structured value represented by `baselineSurface`, before serialization. */
   readonly baselineValue: unknown;
   /** Findings produced before this search, if any. */
-  readonly findings: readonly unknown[];
+  readonly findings: ReadonlyArray<ProposalFinding>;
 }
 /** Build a complete method after trace findings are available. */
 type ImproveMethodFactory<TScenario extends Scenario$1, TArtifact> = (context: ImproveMethodContext) => OptimizationMethod<TScenario, TArtifact>;
@@ -260,7 +250,7 @@ type ImproveMethodOptions<TScenario extends Scenario$1, TArtifact> = Omit<Compar
   /** Reject a materialized profile before it reaches the agent callback. */
   validateCandidate?: ImproveCandidateValidator;
   /** Trace or analyst findings available to a method factory. */
-  findings?: readonly unknown[];
+  findings?: ReadonlyArray<ProposalFinding>;
   /** Select the exact inline skill document for `surface: 'skills'`. */
   skills?: ImproveSkillsOptions;
   /**
@@ -279,7 +269,7 @@ type ImproveCodeRunOptions<TScenario extends Scenario$1, TArtifact> = Omit<SelfI
   /** Local code-search budget. Method-only selection controls do not apply. */
   budget?: Omit<SelfImproveBudget, 'selectionFraction'>;
   /** Findings supplied to Runtime's code candidate driver. */
-  findings?: readonly unknown[];
+  findings?: ReadonlyArray<ProposalFinding>;
   /** Gate mode. `'holdout'` (default) runs the held-out promotion gate;
    * `'none'` is a baseline-only run (`budget.generations = 0`). */
   gate?: 'holdout' | 'none';
@@ -469,4 +459,4 @@ declare function defaultRedactor(value: unknown): unknown;
 declare function resolveRedactor(redact: Redactor | false | undefined): Redactor;
 //#endregion
 export { DeepReadonly as A, commandVerifier as B, ImproveResult as C, ImprovementCandidate as D, ImproveSurface as E, AgenticGeneratorShotExecution as F, CandidateGenerator as H, AgenticGeneratorShotReceipt as I, Verifier as L, AGENTIC_PROFILE_RESOURCE_ROOT as M, AgenticGeneratorOptions as N, ImprovementCodeCandidate as O, AgenticGeneratorShotDisposition as P, VerifyResult as R, ImproveProfileSurface as S, ImproveSkillsOptions as T, defaultBuildPrompt as V, ImproveMethodSource as _, ImproveCandidateValidationInput as a, ImproveProfileAgent as b, ImproveCodeResult as c, ImproveLineage as d, ImproveMethodContext as f, ImproveMethodResult as g, ImproveMethodOptions as h, improve as i, ReadonlyAgentProfile as j, ImprovementProfileCandidate as k, ImproveCodeRunOptions as l, ImproveMethodLineage as m, defaultRedactor as n, ImproveCandidateValidator as o, ImproveMethodFactory as p, resolveRedactor as r, ImproveCodeOptions as s, Redactor as t, ImproveCost as u, ImproveOptimizationRunOptions as v, ImproveScenarioPartitions as w, ImproveProfileComponents as x, ImproveOptions as y, agenticGenerator as z };
-//# sourceMappingURL=redact-C5xOm8cu.d.ts.map
+//# sourceMappingURL=redact-BkasKlyd.d.ts.map

package/dist/{runtime-5zM5XxLr.js → runtime-CDekUROm.js}

@@ -3,11 +3,11 @@ import { i as normalizeBackendStreamEvent, o as newRuntimeSession, s as nowIso }
 import { a as randomSuffix, c as stringifySafe, f as zeroTokenUsage, r as isAbortError, s as sleep, t as addTokenUsage } from "./util-MVgdwuIS.js";
 import { i as InMemorySpawnJournal, r as InMemoryResultBlobStore } from "./spawn-journal-CwPvKUTa.js";
 import { i as redactProtectedValue, r as redactProtectedReason } from "./protected-redaction--F3v1oo8.js";
-import { S as routerChatWithUsage, b as routerBrain, i as withDriverExecutor, o as settledToIteration, t as createSupervisor, w as runBrainLoop, y as notifyRuntimeHookEvent } from "./supervisor-DTKhF-RV.js";
-import { C as observe, O as strategyAuthorMethod, b as sample, v as refine, x as sampleThenRefine, y as runAgentic } from "./structural-rollout-IXUEplky.js";
+import { D as routerChatWithUsage, T as routerBrain, d as settledToIteration, k as runBrainLoop, l as withDriverExecutor, t as createSupervisor, w as notifyRuntimeHookEvent } from "./supervisor-B2LzaWRb.js";
+import { C as observe, O as strategyAuthorMethod, b as sample, v as refine, x as sampleThenRefine, y as runAgentic } from "./structural-rollout-BC81Otmc.js";
 import { a as notifySandboxEventObserver, i as mapSandboxToolEvent, r as mapSandboxEvent, t as createSandboxToolPartState } from "./sandbox-events-DeI5xX8P.js";
-import { Bt as runAgentRounds, Dt as createExecutorRegistry, Et as createExecutor, Ht as createSandboxLineage, Kt as gateOnDeliverable, Ot as createWorktreeCliExecutor, Ut as probeSandboxCapabilities, bt as rollingDispatch, t as supervise, zt as defaultSelectWinner } from "./supervise-BiRutHS9.js";
-import { CODING_HARNESSES, InMemoryTraceStore, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, expandProfileAxes, harnessAxisOf, makeFinding as makeFinding$1, pairedBootstrap, pairedTTest, paretoFrontier, scoreKnowledgeReadiness, wilson } from "@tangle-network/agent-eval";
+import { Bt as runAgentRounds, Dt as createExecutorRegistry, Et as createExecutor, Ht as createSandboxLineage, Ot as createWorktreeCliExecutor, Ut as probeSandboxCapabilities, bt as rollingDispatch, qt as gateOnDeliverable, t as supervise, zt as defaultSelectWinner } from "./supervise-JfKPwIlO.js";
+import { CODING_HARNESSES, InMemoryTraceStore, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, expandProfileAxes, harnessAxisOf, makeFinding as makeFinding$1, pairedBootstrap, paretoFrontier, scoreKnowledgeReadiness, wilcoxonSignedRank, wilson } from "@tangle-network/agent-eval";
 import { heldoutSignificance, runProfileMatrix } from "@tangle-network/agent-eval/campaign";
 import { canonicalCandidateDigest, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -724,7 +724,7 @@ function pairwiseSignificance(records, opts = {}) {
 			seed: 7,
 			statistic: "median"
 		});
-		const p = pairedTTest(aScores, bScores).p;
+		const test = wilcoxonSignedRank(aScores, bScores, { seed: 7 });
 		raw.push({
 			a: labelOf(ka),
 			b: labelOf(kb),
@@ -732,12 +732,16 @@ function pairwiseSignificance(records, opts = {}) {
 			delta: boot.median,
 			ciLow: boot.low,
 			ciHigh: boot.high,
-			p
+			nonZeroPairs: test.nNonZero,
+			testMethod: test.method,
+			pFloor: test.pFloor,
+			p: test.p
 		});
 	}
-	const { significant } = benjaminiHochberg(raw.map((r) => r.p), opts.fdr ?? .05);
+	const { qValues, significant } = benjaminiHochberg(raw.map((result) => result.p), opts.fdr ?? .05);
 	return raw.map((r, i) => ({
 		...r,
+		q: qValues[i] ?? 1,
 		significant: (significant[i] ?? false) && r.pairs >= minPairs
 	}));
 }
@@ -780,15 +784,18 @@ function renderLeaderboardMarkdown(report) {
 function renderPairwiseMarkdown(verdicts, title = "Pairwise significance (paired, BH-corrected)") {
 	const lines = [`## ${title}`, ""];
 	if (verdicts.length === 0) return lines.concat("_no comparable pairs_").join("\n");
-	lines.push("| A vs B | Δ(b−a) median | 95% CI | pairs | p | verdict |");
-	lines.push("|---|--:|--:|--:|--:|---|");
+	lines.push("| A vs B | Δ(b−a) median | 95% CI | pairs | changed | test | p | p floor | q | verdict |");
+	lines.push("|---|--:|--:|--:|--:|---|--:|--:|--:|---|");
 	for (const v of verdicts) {
-		const verdict = v.significant ? `**${v.delta >= 0 ? v.b : v.a} wins**` : "ns";
-		lines.push(`| ${v.a} vs ${v.b} | ${v.delta >= 0 ? "+" : ""}${pct(v.delta)} | [${pct(v.ciLow)}, ${pct(v.ciHigh)}] | ${v.pairs} | ${v.p.toFixed(3)} | ${verdict} |`);
+		const verdict = v.nonZeroPairs === 0 ? "tie" : v.significant ? `**${v.delta >= 0 ? v.b : v.a} wins**` : "ns";
+		lines.push(`| ${v.a} vs ${v.b} | ${v.delta >= 0 ? "+" : ""}${pct(v.delta)} | [${pct(v.ciLow)}, ${pct(v.ciHigh)}] | ${v.pairs} | ${v.nonZeroPairs} | ${v.testMethod} | ${formatProbability(v.p)} | ${formatProbability(v.pFloor)} | ${formatProbability(v.q)} | ${verdict} |`);
 	}
-	lines.push("", "> `ns` = not significant after Benjamini–Hochberg (or below the paired-count floor).");
+	lines.push("", "> `changed` excludes exact ties. `p` is the raw two-sided signed-rank probability; `q` is Benjamini-Hochberg adjusted. `ns` means q did not clear the target or the pair count was below the configured minimum.");
 	return lines.join("\n");
 }
+function formatProbability(value) {
+	return value > 0 && value < .001 ? value.toExponential(2) : value.toFixed(3);
+}
 function esc(s) {
 	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
@@ -5405,4 +5412,4 @@ function tail(s) {
 //#endregion
 export { defineLeaderboard as $, trajectoryReport as A, flatWidenGate as B, strategyAuthorContract as C, sanitizeMcpToolSchema as Ct, runBenchmark as D, secretEnvOfMcpServer as Dt, printBenchmarkReport as E, resolveSecretEnv as Et, registerShape as F, verify as G, panel as H, FileCorpus as I, buildSteerContext as J, widen as K, InMemoryCorpus as L, runPersonified as M, builtinShapes as N, promotionGate as O, createShapeRegistry as P, harvestCorpus as Q, renderCorpusToInstructions as R, authorStrategy as S, createMcpEnvironment as St, openSandboxRun as T, mcpSecretEnvMetadataKey as Tt, pipeline as U, loopUntil as V, selectValidWinner as W, registryScopeAnalyst as X, createScopeAnalyst as Y, inProcessSandboxClient as Z, discriminatingMeans as _, auditIntent as _t, localShell as a, loopCampaignDispatch as at, selectChampion as b, connectStdioMcp as bt, createVerifierEnvironment as c, deterministicCompletion as ct, worktreeFanout as d, leaderboard as dt, dumbDriver as et, analyzeTrace as f, pairwiseSignificance as ft, streamAgentTurn as g, renderPairwiseMarkdown as gt, collectAgentTurn as h, renderLeaderboardSvg as ht, jjWorkspace as i, inlineSandboxClient as it, definePersona as j, equalKOnCost as k, failuresAnalyst as l, sentinelCompletion as lt, runCoderChecks as m, renderLeaderboardMarkdown as mt, makeFinding$1 as n, resolveSandboxClient as nt, runInWorkspace as o, loopDispatch as ot, patchDelivered as p, renderLeaderboardHtml as pt, assertTraceDerivedFindings as q, gitWorkspace as r, localSandboxClient as rt, createWaterfallCollector as s, completionAuthorizes as st, computeFindingId$1 as t, naiveDriver as tt, superviseSurface as u, stopSentinel as ut, pickChampion as v, defaultAuditorInstruction as vt, SandboxRunAbortError as w, envKeyProvider as wt, assertStrategyContract as x, materializeLocalMcp as xt, runStrategyEvolution as y, McpSpawnFault as yt, fanout as z };
 
-//# sourceMappingURL=runtime-5zM5XxLr.js.map
+//# sourceMappingURL=runtime-CDekUROm.js.map