@tangle-network/agent-runtime 0.116.0 → 0.117.0

package/dist/{workspace-archive-DXzJq7WP.js.map → workspace-archive-CqPIijFA.js.map}

@@ -1 +1 @@
-{"version":3,"file":"workspace-archive-DXzJq7WP.js","names":["canonicalCandidateDigest","canonicalCandidateDigest","fsConstants"],"sources":["../src/candidate-execution/bundle.ts","../src/candidate-execution/workspace-archive.ts"],"sourcesContent":["import type { AgentCandidateBundle } from '@tangle-network/agent-interface'\nimport { agentCandidateBundleSchema } from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateDigest, immutableCandidateValue, omitTopLevelDigest } from './digest'\n\n/** Exact candidate wire shape before the runtime computes its canonical digest. */\nexport type AgentCandidateBundleInput = Omit<AgentCandidateBundle, 'digest'>\n\n/** Validate and content-address a candidate bundle before it crosses an approval boundary. */\nexport function sealAgentCandidateBundle(input: AgentCandidateBundleInput): AgentCandidateBundle {\n  const digest = canonicalCandidateDigest(input)\n  const parsed = agentCandidateBundleSchema.parse({ ...input, digest })\n  const parsedDigest = canonicalCandidateDigest(omitTopLevelDigest(parsed))\n  if (parsedDigest !== digest) {\n    throw new Error('candidate bundle changed while validating its canonical wire shape')\n  }\n  return immutableCandidateValue(parsed)\n}\n","import { randomUUID } from 'node:crypto'\nimport { constants as fsConstants } from 'node:fs'\nimport {\n  lstat,\n  mkdir,\n  mkdtemp,\n  open,\n  readdir,\n  readFile,\n  realpath,\n  rename,\n  rm,\n  writeFile,\n} from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { dirname, isAbsolute, join, resolve, sep, win32 } from 'node:path'\nimport { isAnyArrayBuffer, isSharedArrayBuffer } from 'node:util/types'\n\nimport type {\n  AgentCandidateCapturedArtifact,\n  AgentCandidateWorkspaceSnapshotEvidence,\n} from '@tangle-network/agent-interface'\nimport { type Entry, extract, type Pack, pack } from 'tar-stream'\n\nimport {\n  candidateWorkspaceManifest,\n  captureMaterializedWorkspace,\n  verifyBytes,\n  verifyMaterializedWorkspace,\n} from './artifacts'\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  deepFreezeCandidate,\n  embeddedCandidateArtifact,\n  sha256Bytes,\n} from './digest'\nimport {\n  assertNoGitIndirection,\n  readCandidateGitTreeFiles,\n  runCandidateGit,\n} from './git-materialize'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport type {\n  AgentCandidateExecutorWorkspaceFile,\n  AgentCandidateOutputArtifactPort,\n  AgentCandidateWorkspacePort,\n} from './types'\n\nconst archiveKind = 'agent-candidate-workspace-archive' as const\nconst workspaceEntryPrefix = 'workspace/'\nconst repositoryMetadataEntry = 'metadata/repository.json'\nconst repositoryBundleEntry = 'metadata/repository.bundle'\nconst fixedTarTime = new Date(0)\n\nexport interface AgentCandidateWorkspaceArchiveLimits {\n  maxArchiveBytes: number\n  maxEmbeddedArtifactBytes: number\n  maxFiles: number\n  maxFileBytes: number\n  maxTotalFileBytes: number\n  maxPathBytes: number\n  maxRepositoryBundleBytes: number\n}\n\nconst defaultLimits: AgentCandidateWorkspaceArchiveLimits = Object.freeze({\n  maxArchiveBytes: 512 * 1024 * 1024,\n  maxEmbeddedArtifactBytes: 1024 * 1024,\n  maxFiles: 50_000,\n  maxFileBytes: 128 * 1024 * 1024,\n  maxTotalFileBytes: 256 * 1024 * 1024,\n  maxPathBytes: 4_096,\n  maxRepositoryBundleBytes: 128 * 1024 * 1024,\n})\n\ninterface WorkspaceArchiveRepository {\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n    bytes: Uint8Array\n  }\n}\n\ninterface WorkspaceArchiveRepositoryMetadata {\n  kind: typeof archiveKind\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n  }\n}\n\ninterface DecodedWorkspaceArchive {\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository?: WorkspaceArchiveRepository\n}\n\nexport interface CaptureAgentCandidateWorkspaceOptions {\n  /** Include Git HEAD so task preparation can prove its exact commit and tree. */\n  includeRepository?: boolean\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n  /** Use the evaluator-owned artifact store when manifest or archive bytes should not be embedded. */\n  artifactPersistence?: {\n    executionId: string\n    outputArtifacts: AgentCandidateOutputArtifactPort\n    signal?: AbortSignal\n  }\n}\n\nexport interface CreateAgentCandidateWorkspacePortOptions {\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n}\n\nexport interface CapturedAgentCandidateWorkspace {\n  readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  /** Caller-owned bytes accepted by createAgentCandidateWorkspacePort. */\n  readonly archive: Uint8Array\n}\n\n/** Capture one exact regular-file workspace for immutable candidate execution. */\nexport async function captureAgentCandidateWorkspace(\n  rootInput: string,\n  options: CaptureAgentCandidateWorkspaceOptions = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const root = resolve(rootInput)\n  const limits = workspaceLimits(options.limits)\n  const captured = options.includeRepository\n    ? await captureRepository(root, limits)\n    : await captureMaterializedWorkspace(root, {\n        limits: {\n          maxFiles: limits.maxFiles,\n          maxFileBytes: limits.maxFileBytes,\n          maxTotalFileBytes: limits.maxTotalFileBytes,\n        },\n      })\n  assertWorkspaceFilesWithinLimits(captured.files, limits)\n  const repository = 'repository' in captured ? captured.repository : undefined\n  return captureWorkspaceFiles(captured.files, repository, limits, options.artifactPersistence)\n}\n\n/** Capture detached files returned by a remote executor into the standard archive. */\nexport async function captureAgentCandidateWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  options: Omit<CaptureAgentCandidateWorkspaceOptions, 'includeRepository'> = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const limits = workspaceLimits(options.limits)\n  return captureWorkspaceFiles(\n    normalizeWorkspaceFiles(input, limits),\n    undefined,\n    limits,\n    options.artifactPersistence,\n  )\n}\n\nasync function captureWorkspaceFiles(\n  files: readonly AgentCandidateExecutorWorkspaceFile[],\n  repository: WorkspaceArchiveRepository | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n  artifactPersistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<CapturedAgentCandidateWorkspace> {\n  const material = candidateWorkspaceManifest(files)\n  const manifest = canonicalCandidateBytes(material)\n  const archive = await encodeWorkspaceArchive(files, repository, limits.maxArchiveBytes)\n  if (\n    !artifactPersistence &&\n    (manifest.byteLength > limits.maxEmbeddedArtifactBytes ||\n      archive.byteLength > limits.maxEmbeddedArtifactBytes)\n  ) {\n    throw new Error(\n      'candidate workspace artifacts exceed maxEmbeddedArtifactBytes; artifactPersistence is required',\n    )\n  }\n  const manifestArtifact = await captureWorkspaceArtifact('manifest', manifest, artifactPersistence)\n  const archiveArtifact = await captureWorkspaceArtifact('archive', archive, artifactPersistence)\n  const snapshot = deepFreezeCandidate({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: canonicalCandidateDigest(material),\n    material,\n    manifest: manifestArtifact,\n    archive: archiveArtifact,\n  } satisfies AgentCandidateWorkspaceSnapshotEvidence)\n  return Object.freeze({ snapshot, archive })\n}\n\nasync function captureWorkspaceArtifact(\n  kind: 'manifest' | 'archive',\n  bytes: Uint8Array,\n  persistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<AgentCandidateCapturedArtifact> {\n  if (!persistence) return embeddedCandidateArtifact(bytes)\n  if (!persistence.executionId.trim()) {\n    throw new Error('candidate workspace artifact persistence requires an executionId')\n  }\n  return persistCandidateOutputArtifact(persistence.outputArtifacts, {\n    executionId: persistence.executionId,\n    purpose: kind === 'manifest' ? 'candidate-workspace-manifest' : 'candidate-workspace-archive',\n    bytes,\n    ...(persistence.signal ? { signal: persistence.signal } : {}),\n  })\n}\n\n/** Create the standard bounded materializer for candidate execution ports. */\nexport function createAgentCandidateWorkspacePort(\n  options: CreateAgentCandidateWorkspacePortOptions = {},\n): AgentCandidateWorkspacePort {\n  const limits = workspaceLimits(options.limits)\n  const port: AgentCandidateWorkspacePort = {\n    materialize: async ({ role, snapshot, archive, destination }) => {\n      await materializeAgentCandidateWorkspace({\n        role,\n        snapshot,\n        archive,\n        destination,\n        limits,\n      })\n    },\n  }\n  return Object.freeze(port)\n}\n\nasync function materializeAgentCandidateWorkspace(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  destination: string\n  limits: AgentCandidateWorkspaceArchiveLimits\n}): Promise<void> {\n  verifyBytes(\n    input.archive,\n    input.snapshot.archive.sha256,\n    input.snapshot.archive.byteLength,\n    'candidate workspace archive',\n  )\n  const decoded = await parseWorkspaceArchive(input.archive, input.limits)\n  if (decoded.repository && input.role !== 'task') {\n    throw new Error('only task workspaces may carry a Git repository')\n  }\n  assertArchiveMatchesSnapshot(decoded.files, input.snapshot)\n  const destination = resolve(input.destination)\n  await prepareEmptyDestination(destination)\n  const staging = await mkdtemp(`${destination}.materializing-`)\n  try {\n    await writeWorkspaceFiles(staging, decoded.files)\n    if (decoded.repository) {\n      await materializeRepository(decoded.repository, staging)\n    }\n    await verifyMaterializedWorkspace(staging, input.snapshot.material, {\n      ignoredProtectedRootEntries: decoded.repository ? ['.git'] : [],\n    })\n    await rename(staging, destination)\n  } catch (error) {\n    await rm(staging, { recursive: true, force: true })\n    await rm(destination, { recursive: true, force: true })\n    throw error\n  }\n}\n\nasync function captureRepository(\n  root: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<{\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository: WorkspaceArchiveRepository\n}> {\n  const stats = await lstat(root)\n  if (!stats.isDirectory() || stats.isSymbolicLink() || (await realpath(root)) !== root) {\n    throw new Error('candidate repository root must be a real directory')\n  }\n  const topLevel = (await runCandidateGit(root, ['rev-parse', '--show-toplevel'])).stdout\n    .toString('utf8')\n    .trim()\n  if (resolve(topLevel) !== root) {\n    throw new Error('candidate repository capture must start at the Git worktree root')\n  }\n  const gitDir = resolve(\n    (await runCandidateGit(root, ['rev-parse', '--absolute-git-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(gitDir)) !== gitDir || gitDir.includes(':')) {\n    throw new Error('candidate repository Git object store has an unsupported path')\n  }\n  await assertNoGitIndirection(root, gitDir, 'candidate repository')\n  const headCommit = (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout\n    .toString('utf8')\n    .trim()\n  const headTree = (await runCandidateGit(root, ['rev-parse', 'HEAD^{tree}'])).stdout\n    .toString('utf8')\n    .trim()\n  assertGitObjectId(headCommit, 'HEAD')\n  assertGitObjectId(headTree, 'HEAD tree')\n  if (headCommit.length !== headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  const files = await readCandidateGitTreeFiles(root, headTree, {}, limits)\n  assertWorkspaceFilesWithinLimits(files, limits)\n  const reachableBytesText = (\n    await runCandidateGit(root, ['rev-list', '--disk-usage', '--objects', 'HEAD'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  const reachableBytes = Number(reachableBytesText)\n  if (!Number.isSafeInteger(reachableBytes) || reachableBytes < 0) {\n    throw new Error('candidate repository reachable size is invalid')\n  }\n  if (reachableBytes > limits.maxRepositoryBundleBytes) {\n    throw new Error('candidate repository exceeds maxRepositoryBundleBytes')\n  }\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    await runCandidateGit(root, ['bundle', 'create', bundlePath, 'HEAD'])\n    const bundle = Uint8Array.from(await readFile(bundlePath))\n    if (bundle.byteLength > limits.maxRepositoryBundleBytes) {\n      throw new Error('candidate repository bundle exceeds maxRepositoryBundleBytes')\n    }\n    return {\n      files,\n      repository: {\n        headCommit,\n        headTree,\n        bundle: {\n          sha256: sha256Bytes(bundle),\n          byteLength: bundle.byteLength,\n          bytes: bundle,\n        },\n      },\n    }\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nasync function encodeWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  maxArchiveBytes: number,\n): Promise<Uint8Array> {\n  const archive = pack()\n  const output = collectStream(archive, maxArchiveBytes, 'candidate workspace archive')\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    return await output\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await output.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function verifyCanonicalWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  expected: Uint8Array,\n  maxArchiveBytes: number,\n): Promise<void> {\n  const archive = pack()\n  const comparison = streamEqualsBytes(\n    archive,\n    expected,\n    maxArchiveBytes,\n    'candidate workspace archive',\n  )\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    if (!(await comparison)) throw new Error('candidate workspace tar is not canonical')\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await comparison.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function writeWorkspaceArchiveEntries(\n  archive: Pack,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n): Promise<void> {\n  for (const file of files) {\n    await writeTarEntry(archive, `${workspaceEntryPrefix}${file.path}`, file.mode, file.bytes)\n  }\n  if (!repository) return\n  const metadata = canonicalCandidateBytes({\n    kind: archiveKind,\n    headCommit: repository.headCommit,\n    headTree: repository.headTree,\n    bundle: {\n      sha256: repository.bundle.sha256,\n      byteLength: repository.bundle.byteLength,\n    },\n  } satisfies WorkspaceArchiveRepositoryMetadata)\n  await writeTarEntry(archive, repositoryMetadataEntry, 0o600, metadata)\n  await writeTarEntry(archive, repositoryBundleEntry, 0o600, repository.bundle.bytes)\n}\n\nasync function parseWorkspaceArchive(\n  bytes: Uint8Array,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<DecodedWorkspaceArchive> {\n  if (bytes.byteLength > limits.maxArchiveBytes) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n  }\n  const parser = extract()\n  const files: DecodedWorkspaceArchive['files'] = []\n  const observedEntryNames = new Set<string>()\n  const observedPaths = new Set<string>()\n  let totalBytes = 0\n  let retainedEntryBytes = 0\n  let previousPath: string | undefined\n  let repositoryMetadata: WorkspaceArchiveRepositoryMetadata | undefined\n  let repositoryBundle: Uint8Array | undefined\n  const decoded = (async () => {\n    for await (const entry of parser) {\n      const name = entry.header.name\n      if (\n        entry.header.type !== 'file' ||\n        typeof name !== 'string' ||\n        observedEntryNames.has(name)\n      ) {\n        throw new Error('candidate workspace tar contains an invalid entry')\n      }\n      observedEntryNames.add(name)\n      if (name.startsWith(workspaceEntryPrefix)) {\n        if (files.length >= limits.maxFiles) {\n          throw new Error('candidate workspace archive has an invalid file count')\n        }\n        const path = safeArchivePath(name.slice(workspaceEntryPrefix.length), limits.maxPathBytes)\n        if (!isWorkspaceFileMode(entry.header.mode)) {\n          throw new Error(`candidate workspace archive has an unsupported mode: ${path}`)\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const fileBytes = await readTarEntry(entry, limits.maxFileBytes, `workspace file ${path}`)\n        retainedEntryBytes += fileBytes.byteLength\n        assertWorkspacePathOrder(\n          path,\n          previousPath,\n          observedPaths,\n          'candidate workspace archive paths must be unique and sorted',\n        )\n        previousPath = path\n        if (fileBytes.byteLength > limits.maxTotalFileBytes - totalBytes) {\n          throw new Error('candidate workspace archive exceeds maxTotalFileBytes')\n        }\n        totalBytes += fileBytes.byteLength\n        files.push({ path, mode: entry.header.mode, bytes: fileBytes })\n      } else if (name === repositoryMetadataEntry) {\n        if (entry.header.mode !== 0o600 || repositoryMetadata) {\n          throw new Error('candidate workspace archive repository metadata is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const metadataBytes = await readTarEntry(\n          entry,\n          limits.maxPathBytes,\n          'candidate repository metadata',\n        )\n        retainedEntryBytes += metadataBytes.byteLength\n        repositoryMetadata = parseRepositoryMetadata(metadataBytes, limits.maxRepositoryBundleBytes)\n      } else if (name === repositoryBundleEntry) {\n        if (entry.header.mode !== 0o600 || repositoryBundle) {\n          throw new Error('candidate workspace archive repository bundle is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        repositoryBundle = await readTarEntry(\n          entry,\n          limits.maxRepositoryBundleBytes,\n          'candidate Git bundle',\n        )\n        retainedEntryBytes += repositoryBundle.byteLength\n      } else {\n        throw new Error(`candidate workspace tar contains an unsupported entry: ${name}`)\n      }\n    }\n    if (Boolean(repositoryMetadata) !== Boolean(repositoryBundle)) {\n      throw new Error('candidate workspace archive repository evidence is incomplete')\n    }\n    const repository =\n      repositoryMetadata && repositoryBundle\n        ? repositoryFromTar(repositoryMetadata, repositoryBundle)\n        : undefined\n    return { files, ...(repository ? { repository } : {}) }\n  })()\n  parser.end(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength))\n  const result = await decoded\n  await verifyCanonicalWorkspaceArchive(\n    result.files,\n    result.repository,\n    bytes,\n    limits.maxArchiveBytes,\n  )\n  return result\n}\n\nfunction assertRetainedArchiveSize(\n  archiveBytes: number,\n  retainedEntryBytes: number,\n  entryBytes: number | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (\n    !Number.isSafeInteger(entryBytes) ||\n    entryBytes === undefined ||\n    entryBytes < 0 ||\n    entryBytes > limits.maxArchiveBytes - archiveBytes - retainedEntryBytes\n  ) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes while decoding')\n  }\n}\n\nfunction parseRepositoryMetadata(\n  bytes: Uint8Array,\n  maxBundleBytes: number,\n): WorkspaceArchiveRepositoryMetadata {\n  let value: unknown\n  try {\n    value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes))\n  } catch (error) {\n    throw new Error('candidate workspace archive repository metadata is invalid', { cause: error })\n  }\n  if (\n    !isRecord(value) ||\n    Object.keys(value).sort().join(',') !== 'bundle,headCommit,headTree,kind' ||\n    value.kind !== archiveKind ||\n    typeof value.headCommit !== 'string' ||\n    typeof value.headTree !== 'string' ||\n    !isRecord(value.bundle) ||\n    Object.keys(value.bundle).sort().join(',') !== 'byteLength,sha256' ||\n    typeof value.bundle.sha256 !== 'string' ||\n    !/^sha256:[a-f0-9]{64}$/.test(value.bundle.sha256) ||\n    !Number.isSafeInteger(value.bundle.byteLength) ||\n    (value.bundle.byteLength as number) <= 0 ||\n    (value.bundle.byteLength as number) > maxBundleBytes\n  ) {\n    throw new Error('candidate workspace archive repository is invalid')\n  }\n  if (!Buffer.from(canonicalCandidateBytes(value)).equals(Buffer.from(bytes))) {\n    throw new Error('candidate workspace archive repository metadata is not canonical')\n  }\n  assertGitObjectId(value.headCommit, 'repository HEAD')\n  assertGitObjectId(value.headTree, 'repository HEAD tree')\n  if (value.headCommit.length !== value.headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  return {\n    kind: archiveKind,\n    headCommit: value.headCommit,\n    headTree: value.headTree,\n    bundle: {\n      sha256: value.bundle.sha256 as `sha256:${string}`,\n      byteLength: value.bundle.byteLength as number,\n    },\n  }\n}\n\nfunction repositoryFromTar(\n  metadata: WorkspaceArchiveRepositoryMetadata,\n  bundle: Uint8Array,\n): WorkspaceArchiveRepository {\n  verifyBytes(bundle, metadata.bundle.sha256, metadata.bundle.byteLength, 'candidate Git bundle')\n  return {\n    headCommit: metadata.headCommit,\n    headTree: metadata.headTree,\n    bundle: { ...metadata.bundle, bytes: bundle },\n  }\n}\n\nasync function writeTarEntry(\n  archive: Pack,\n  name: string,\n  mode: number,\n  bytes: Uint8Array,\n): Promise<void> {\n  await new Promise<void>((resolveEntry, rejectEntry) => {\n    archive.entry(\n      {\n        name,\n        mode,\n        uid: 0,\n        gid: 0,\n        size: bytes.byteLength,\n        mtime: fixedTarTime,\n        type: 'file',\n        uname: '',\n        gname: '',\n      },\n      Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength),\n      (error) => (error ? rejectEntry(error) : resolveEntry()),\n    )\n  })\n}\n\nasync function readTarEntry(entry: Entry, maxBytes: number, label: string): Promise<Uint8Array> {\n  const size = entry.header.size\n  if (!Number.isSafeInteger(size) || size === undefined || size < 0 || size > maxBytes) {\n    throw new Error(`${label} has an invalid tar size`)\n  }\n  const bytes = await collectStream(entry, maxBytes, label)\n  if (bytes.byteLength !== size) throw new Error(`${label} differs from its tar size`)\n  return bytes\n}\n\nasync function collectStream(\n  stream: AsyncIterable<Uint8Array>,\n  maxBytes: number,\n  label: string,\n): Promise<Uint8Array> {\n  const chunks: Buffer[] = []\n  let totalBytes = 0\n  for await (const chunk of stream) {\n    if (chunk.byteLength > maxBytes - totalBytes) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)\n    chunks.push(bytes)\n    totalBytes += bytes.byteLength\n  }\n  return Buffer.concat(chunks, totalBytes)\n}\n\nasync function streamEqualsBytes(\n  stream: AsyncIterable<Uint8Array>,\n  expected: Uint8Array,\n  maxBytes: number,\n  label: string,\n): Promise<boolean> {\n  const expectedBuffer = Buffer.from(expected.buffer, expected.byteOffset, expected.byteLength)\n  let equal = true\n  let offset = 0\n  for await (const chunk of stream) {\n    if (chunk.byteLength > maxBytes - offset) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const observed = Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength)\n    if (\n      offset + observed.byteLength > expectedBuffer.byteLength ||\n      !observed.equals(expectedBuffer.subarray(offset, offset + observed.byteLength))\n    ) {\n      equal = false\n    }\n    offset += observed.byteLength\n  }\n  return equal && offset === expectedBuffer.byteLength\n}\n\nasync function prepareEmptyDestination(destination: string): Promise<void> {\n  await mkdir(destination, { recursive: true, mode: 0o700 })\n  const stats = await lstat(destination)\n  if (\n    !stats.isDirectory() ||\n    stats.isSymbolicLink() ||\n    (await realpath(destination)) !== destination\n  ) {\n    throw new Error('candidate workspace destination must be a real directory')\n  }\n  if ((await readdir(destination)).length > 0) {\n    throw new Error('candidate workspace destination must be empty')\n  }\n}\n\nasync function writeWorkspaceFiles(\n  destination: string,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n): Promise<void> {\n  for (const file of files) {\n    const path = workspacePath(destination, file.path)\n    await mkdir(dirname(path), { recursive: true, mode: 0o700 })\n    const descriptor = await open(\n      path,\n      fsConstants.O_WRONLY |\n        fsConstants.O_CREAT |\n        fsConstants.O_EXCL |\n        (typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0),\n      0o600,\n    )\n    try {\n      await descriptor.writeFile(file.bytes)\n      const stats = await descriptor.stat()\n      if (!stats.isFile() || stats.nlink !== 1) {\n        throw new Error(`candidate workspace file identity changed while writing: ${file.path}`)\n      }\n      await descriptor.chmod(file.mode)\n    } finally {\n      await descriptor.close()\n    }\n  }\n}\n\nasync function materializeRepository(\n  repository: WorkspaceArchiveRepository,\n  destination: string,\n): Promise<void> {\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    await writeFile(bundlePath, repository.bundle.bytes, { flag: 'wx', mode: 0o600 })\n    await runCandidateGit(destination, [\n      'init',\n      '--quiet',\n      '--initial-branch=candidate',\n      `--object-format=${repository.headCommit.length === 64 ? 'sha256' : 'sha1'}`,\n    ])\n    await runCandidateGit(destination, ['bundle', 'verify', bundlePath])\n    await runCandidateGit(destination, ['bundle', 'unbundle', bundlePath])\n    const objectType = (\n      await runCandidateGit(destination, ['cat-file', '-t', repository.headCommit])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (objectType !== 'commit') throw new Error('candidate repository HEAD is not a commit')\n    const observedTree = (\n      await runCandidateGit(destination, ['rev-parse', `${repository.headCommit}^{tree}`])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (observedTree !== repository.headTree) {\n      throw new Error('candidate repository bundle HEAD tree changed')\n    }\n    await runCandidateGit(destination, ['update-ref', '--no-deref', 'HEAD', repository.headCommit])\n    await runCandidateGit(destination, ['read-tree', repository.headTree])\n    const status = (\n      await runCandidateGit(destination, ['status', '--porcelain=v1', '--untracked-files=all'])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (status) throw new Error('candidate repository files do not exactly match HEAD')\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nfunction assertArchiveMatchesSnapshot(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n): void {\n  const material = candidateWorkspaceManifest(files)\n  const materialBytes = canonicalCandidateBytes(material)\n  verifyBytes(\n    materialBytes,\n    snapshot.manifest.sha256,\n    snapshot.manifest.byteLength,\n    'candidate workspace manifest',\n  )\n  if (\n    canonicalCandidateDigest(material) !== snapshot.digest ||\n    !Buffer.from(materialBytes).equals(Buffer.from(canonicalCandidateBytes(snapshot.material)))\n  ) {\n    throw new Error('candidate workspace archive does not match its snapshot manifest')\n  }\n}\n\nfunction assertWorkspaceFilesWithinLimits(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (files.length > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  let previousPath: string | undefined\n  const observedPaths = new Set<string>()\n  for (const file of files) {\n    const path = safeArchivePath(file.path, limits.maxPathBytes)\n    assertWorkspacePathOrder(\n      path,\n      previousPath,\n      observedPaths,\n      'candidate workspace paths must be unique and sorted',\n    )\n    previousPath = path\n    if (!isWorkspaceFileMode(file.mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    if (file.bytes.byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    totalBytes += file.bytes.byteLength\n    if (totalBytes > limits.maxTotalFileBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n  }\n}\n\nfunction normalizeWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): AgentCandidateExecutorWorkspaceFile[] {\n  if (!Array.isArray(input)) {\n    throw new Error('candidate workspace files must be an array')\n  }\n  const fileCount = input.length\n  if (fileCount > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  const files: AgentCandidateExecutorWorkspaceFile[] = []\n  for (let index = 0; index < fileCount; index++) {\n    const inputFile = input[index]\n    if (!isRecord(inputFile) || Object.keys(inputFile).sort().join(',') !== 'bytes,mode,path') {\n      throw new Error(`candidate workspace file ${index} is invalid`)\n    }\n    const descriptors = Object.getOwnPropertyDescriptors(inputFile)\n    if (\n      !('value' in (descriptors.path ?? {})) ||\n      !('value' in (descriptors.mode ?? {})) ||\n      !('value' in (descriptors.bytes ?? {}))\n    ) {\n      throw new Error(`candidate workspace file ${index} must use fixed values`)\n    }\n    const path = safeArchivePath(descriptors.path?.value, limits.maxPathBytes)\n    const mode = descriptors.mode?.value\n    const inputBytes = descriptors.bytes?.value\n    if (!isWorkspaceFileMode(mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    const view = inspectWorkspaceBytes(inputBytes, path)\n    if (view.byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    if (view.byteLength > limits.maxTotalFileBytes - totalBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n    if (view.byteLength > Math.max(0, limits.maxArchiveBytes - 1024)) {\n      throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n    }\n    totalBytes += view.byteLength\n    files.push({ path, mode, bytes: detachWorkspaceBytes(view) })\n  }\n  files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))\n  assertWorkspaceFilesWithinLimits(files, limits)\n  return files\n}\n\nfunction isWorkspaceFileMode(value: unknown): value is number {\n  return Number.isSafeInteger(value) && (value as number) >= 0 && (value as number) <= 0o777\n}\n\nfunction workspaceLimits(\n  overrides: Partial<AgentCandidateWorkspaceArchiveLimits> | undefined,\n): AgentCandidateWorkspaceArchiveLimits {\n  const limits = { ...defaultLimits, ...overrides }\n  for (const [name, value] of Object.entries(limits)) {\n    if (!Number.isSafeInteger(value) || value <= 0) {\n      throw new Error(`candidate workspace ${name} must be a positive safe integer`)\n    }\n  }\n  return Object.freeze(limits)\n}\n\nfunction safeArchivePath(value: unknown, maxPathBytes: number): string {\n  if (\n    typeof value !== 'string' ||\n    !value ||\n    !isWellFormedUnicode(value) ||\n    Buffer.byteLength(value, 'utf8') > maxPathBytes ||\n    isAbsolute(value) ||\n    win32.isAbsolute(value) ||\n    value.includes('\\\\') ||\n    value.includes('\\0') ||\n    hasControlCharacter(value) ||\n    value.split('/').some((part) => !part || part === '.' || part === '..') ||\n    ['.git', '.sidecar'].includes(value.split('/')[0]?.toLowerCase() ?? '')\n  ) {\n    throw new Error(`candidate workspace archive contains an unsafe path: ${String(value)}`)\n  }\n  return value\n}\n\nfunction assertWorkspacePathOrder(\n  path: string,\n  previousPath: string | undefined,\n  observedPaths: Set<string>,\n  errorMessage: string,\n): void {\n  if (previousPath !== undefined && previousPath >= path) throw new Error(errorMessage)\n  for (let slash = path.indexOf('/'); slash !== -1; slash = path.indexOf('/', slash + 1)) {\n    if (observedPaths.has(path.slice(0, slash))) throw new Error(errorMessage)\n  }\n  observedPaths.add(path)\n}\n\nfunction inspectWorkspaceBytes(\n  input: unknown,\n  path: string,\n): { buffer: ArrayBuffer; byteOffset: number; byteLength: number } {\n  let buffer: ArrayBufferLike\n  let byteOffset: number\n  let byteLength: number\n  try {\n    buffer = typedArrayBufferGetter.call(input as Uint8Array) as ArrayBufferLike\n    byteOffset = typedArrayByteOffsetGetter.call(input as Uint8Array) as number\n    byteLength = typedArrayByteLengthGetter.call(input as Uint8Array) as number\n  } catch {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  if (isSharedArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file uses shared bytes: ${path}`)\n  }\n  if (!isAnyArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  return { buffer, byteOffset, byteLength }\n}\n\nfunction detachWorkspaceBytes(input: {\n  buffer: ArrayBuffer\n  byteOffset: number\n  byteLength: number\n}): Uint8Array {\n  const { buffer, byteOffset, byteLength } = input\n  const copy = new Uint8Array(byteLength)\n  Uint8Array.prototype.set.call(copy, new Uint8Array(buffer, byteOffset, byteLength))\n  return copy\n}\n\nfunction isWellFormedUnicode(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1)\n      if (!(next >= 0xdc00 && next <= 0xdfff)) return false\n      index++\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      return false\n    }\n  }\n  return true\n}\n\nfunction workspacePath(root: string, relativePath: string): string {\n  const path = resolve(root, relativePath)\n  if (!path.startsWith(`${root}${sep}`)) {\n    throw new Error(`candidate workspace archive path escapes its destination: ${relativePath}`)\n  }\n  return path\n}\n\nfunction assertGitObjectId(value: string, label: string): void {\n  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value)) {\n    throw new Error(`candidate repository ${label} is not a Git object id`)\n  }\n}\n\nfunction hasControlCharacter(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code < 0x20 || code === 0x7f) return true\n  }\n  return false\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\ntype TypedArrayGetter = (this: Uint8Array) => unknown\n\nfunction requireTypedArrayGetter(name: 'buffer' | 'byteOffset' | 'byteLength'): TypedArrayGetter {\n  const typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype) as object\n  const getter = Object.getOwnPropertyDescriptor(typedArrayPrototype, name)?.get\n  if (!getter) throw new Error(`typed array intrinsic ${name} accessor is unavailable`)\n  return getter\n}\n\nconst typedArrayBufferGetter = requireTypedArrayGetter('buffer')\nconst typedArrayByteOffsetGetter = requireTypedArrayGetter('byteOffset')\nconst typedArrayByteLengthGetter = requireTypedArrayGetter('byteLength')\n"],"mappings":";;;;;;;;;;;AASA,SAAgB,yBAAyB,OAAwD;CAC/F,MAAM,SAASA,2BAAyB,KAAK;CAC7C,MAAM,SAAS,2BAA2B,MAAM;EAAE,GAAG;EAAO;CAAO,CAAC;CAEpE,IADqBA,2BAAyB,mBAAmB,MAAM,CACxD,MAAM,QACnB,MAAM,IAAI,MAAM,oEAAoE;CAEtF,OAAO,wBAAwB,MAAM;AACvC;;;ACgCA,MAAM,cAAc;AACpB,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;AAChC,MAAM,wBAAwB;AAC9B,MAAM,+BAAe,IAAI,KAAK,CAAC;AAY/B,MAAM,gBAAsD,OAAO,OAAO;CACxE,iBAAiB,MAAM,OAAO;CAC9B,0BAA0B,OAAO;CACjC,UAAU;CACV,cAAc,MAAM,OAAO;CAC3B,mBAAmB,MAAM,OAAO;CAChC,cAAc;CACd,0BAA0B,MAAM,OAAO;AACzC,CAAC;;AAkDD,eAAsB,+BACpB,WACA,UAAiD,CAAC,GACR;CAC1C,MAAM,OAAO,QAAQ,SAAS;CAC9B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,MAAM,WAAW,QAAQ,oBACrB,MAAM,kBAAkB,MAAM,MAAM,IACpC,MAAM,6BAA6B,MAAM,EACvC,QAAQ;EACN,UAAU,OAAO;EACjB,cAAc,OAAO;EACrB,mBAAmB,OAAO;CAC5B,EACF,CAAC;CACL,iCAAiC,SAAS,OAAO,MAAM;CACvD,MAAM,aAAa,gBAAgB,WAAW,SAAS,aAAa,KAAA;CACpE,OAAO,sBAAsB,SAAS,OAAO,YAAY,QAAQ,QAAQ,mBAAmB;AAC9F;;AAGA,eAAsB,oCACpB,OACA,UAA4E,CAAC,GACnC;CAC1C,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,OAAO,sBACL,wBAAwB,OAAO,MAAM,GACrC,KAAA,GACA,QACA,QAAQ,mBACV;AACF;AAEA,eAAe,sBACb,OACA,YACA,QACA,qBAC0C;CAC1C,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,WAAW,wBAAwB,QAAQ;CACjD,MAAM,UAAU,MAAM,uBAAuB,OAAO,YAAY,OAAO,eAAe;CACtF,IACE,CAAC,wBACA,SAAS,aAAa,OAAO,4BAC5B,QAAQ,aAAa,OAAO,2BAE9B,MAAM,IAAI,MACR,gGACF;CAEF,MAAM,mBAAmB,MAAM,yBAAyB,YAAY,UAAU,mBAAmB;CACjG,MAAM,kBAAkB,MAAM,yBAAyB,WAAW,SAAS,mBAAmB;CAC9F,MAAM,WAAW,oBAAoB;EACnC,MAAM;EACN,QAAQC,2BAAyB,QAAQ;EACzC;EACA,UAAU;EACV,SAAS;CACX,CAAmD;CACnD,OAAO,OAAO,OAAO;EAAE;EAAU;CAAQ,CAAC;AAC5C;AAEA,eAAe,yBACb,MACA,OACA,aACyC;CACzC,IAAI,CAAC,aAAa,OAAO,0BAA0B,KAAK;CACxD,IAAI,CAAC,YAAY,YAAY,KAAK,GAChC,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO,+BAA+B,YAAY,iBAAiB;EACjE,aAAa,YAAY;EACzB,SAAS,SAAS,aAAa,iCAAiC;EAChE;EACA,GAAI,YAAY,SAAS,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;CAC7D,CAAC;AACH;;AAGA,SAAgB,kCACd,UAAoD,CAAC,GACxB;CAC7B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAY7C,OAAO,OAAO,OAAO,EAVnB,aAAa,OAAO,EAAE,MAAM,UAAU,SAAS,kBAAkB;EAC/D,MAAM,mCAAmC;GACvC;GACA;GACA;GACA;GACA;EACF,CAAC;CACH,EAEsB,CAAC;AAC3B;AAEA,eAAe,mCAAmC,OAMhC;CAChB,YACE,MAAM,SACN,MAAM,SAAS,QAAQ,QACvB,MAAM,SAAS,QAAQ,YACvB,6BACF;CACA,MAAM,UAAU,MAAM,sBAAsB,MAAM,SAAS,MAAM,MAAM;CACvE,IAAI,QAAQ,cAAc,MAAM,SAAS,QACvC,MAAM,IAAI,MAAM,iDAAiD;CAEnE,6BAA6B,QAAQ,OAAO,MAAM,QAAQ;CAC1D,MAAM,cAAc,QAAQ,MAAM,WAAW;CAC7C,MAAM,wBAAwB,WAAW;CACzC,MAAM,UAAU,MAAM,QAAQ,GAAG,YAAY,gBAAgB;CAC7D,IAAI;EACF,MAAM,oBAAoB,SAAS,QAAQ,KAAK;EAChD,IAAI,QAAQ,YACV,MAAM,sBAAsB,QAAQ,YAAY,OAAO;EAEzD,MAAM,4BAA4B,SAAS,MAAM,SAAS,UAAU,EAClE,6BAA6B,QAAQ,aAAa,CAAC,MAAM,IAAI,CAAC,EAChE,CAAC;EACD,MAAM,OAAO,SAAS,WAAW;CACnC,SAAS,OAAO;EACd,MAAM,GAAG,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAClD,MAAM,GAAG,aAAa;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACtD,MAAM;CACR;AACF;AAEA,eAAe,kBACb,MACA,QAIC;CACD,MAAM,QAAQ,MAAM,MAAM,IAAI;CAC9B,IAAI,CAAC,MAAM,YAAY,KAAK,MAAM,eAAe,KAAM,MAAM,SAAS,IAAI,MAAO,MAC/E,MAAM,IAAI,MAAM,oDAAoD;CAKtE,IAAI,SAHc,MAAM,gBAAgB,MAAM,CAAC,aAAa,iBAAiB,CAAC,EAAA,CAAG,OAC9E,SAAS,MAAM,CAAC,CAChB,KACgB,CAAC,MAAM,MACxB,MAAM,IAAI,MAAM,kEAAkE;CAEpF,MAAM,SAAS,SACZ,MAAM,gBAAgB,MAAM,CAAC,aAAa,oBAAoB,CAAC,EAAA,CAAG,OAChE,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,MAAM,MAAO,UAAU,OAAO,SAAS,GAAG,GAC5D,MAAM,IAAI,MAAM,+DAA+D;CAEjF,MAAM,uBAAuB,MAAM,QAAQ,sBAAsB;CACjE,MAAM,cAAc,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OACrE,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,YAAY,MAAM,gBAAgB,MAAM,CAAC,aAAa,aAAa,CAAC,EAAA,CAAG,OAC1E,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,kBAAkB,YAAY,MAAM;CACpC,kBAAkB,UAAU,WAAW;CACvC,IAAI,WAAW,WAAW,SAAS,QACjC,MAAM,IAAI,MAAM,iEAAiE;CAEnF,MAAM,QAAQ,MAAM,0BAA0B,MAAM,UAAU,CAAC,GAAG,MAAM;CACxE,iCAAiC,OAAO,MAAM;CAC9C,MAAM,sBACJ,MAAM,gBAAgB,MAAM;EAAC;EAAY;EAAgB;EAAa;CAAM,CAAC,EAAA,CAC7E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,iBAAiB,OAAO,kBAAkB;CAChD,IAAI,CAAC,OAAO,cAAc,cAAc,KAAK,iBAAiB,GAC5D,MAAM,IAAI,MAAM,gDAAgD;CAElE,IAAI,iBAAiB,OAAO,0BAC1B,MAAM,IAAI,MAAM,uDAAuD;CAEzE,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,MAAM,gBAAgB,MAAM;GAAC;GAAU;GAAU;GAAY;EAAM,CAAC;EACpE,MAAM,SAAS,WAAW,KAAK,MAAM,SAAS,UAAU,CAAC;EACzD,IAAI,OAAO,aAAa,OAAO,0BAC7B,MAAM,IAAI,MAAM,8DAA8D;EAEhF,OAAO;GACL;GACA,YAAY;IACV;IACA;IACA,QAAQ;KACN,QAAQ,YAAY,MAAM;KAC1B,YAAY,OAAO;KACnB,OAAO;IACT;GACF;EACF;CACF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAe,uBACb,OACA,YACA,iBACqB;CACrB,MAAM,UAAU,KAAK;CACrB,MAAM,SAAS,cAAc,SAAS,iBAAiB,6BAA6B;CACpF,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,OAAO,MAAM;CACf,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,OAAO,YAAY,KAAA,CAAS;EAClC,MAAM;CACR;AACF;AAEA,eAAe,gCACb,OACA,YACA,UACA,iBACe;CACf,MAAM,UAAU,KAAK;CACrB,MAAM,aAAa,kBACjB,SACA,UACA,iBACA,6BACF;CACA,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,IAAI,CAAE,MAAM,YAAa,MAAM,IAAI,MAAM,0CAA0C;CACrF,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,WAAW,YAAY,KAAA,CAAS;EACtC,MAAM;CACR;AACF;AAEA,eAAe,6BACb,SACA,OACA,YACe;CACf,KAAK,MAAM,QAAQ,OACjB,MAAM,cAAc,SAAS,GAAG,uBAAuB,KAAK,QAAQ,KAAK,MAAM,KAAK,KAAK;CAE3F,IAAI,CAAC,YAAY;CACjB,MAAM,WAAW,wBAAwB;EACvC,MAAM;EACN,YAAY,WAAW;EACvB,UAAU,WAAW;EACrB,QAAQ;GACN,QAAQ,WAAW,OAAO;GAC1B,YAAY,WAAW,OAAO;EAChC;CACF,CAA8C;CAC9C,MAAM,cAAc,SAAS,yBAAyB,KAAO,QAAQ;CACrE,MAAM,cAAc,SAAS,uBAAuB,KAAO,WAAW,OAAO,KAAK;AACpF;AAEA,eAAe,sBACb,OACA,QACkC;CAClC,IAAI,MAAM,aAAa,OAAO,iBAC5B,MAAM,IAAI,MAAM,qDAAqD;CAEvE,MAAM,SAAS,QAAQ;CACvB,MAAM,QAA0C,CAAC;CACjD,MAAM,qCAAqB,IAAI,IAAY;CAC3C,MAAM,gCAAgB,IAAI,IAAY;CACtC,IAAI,aAAa;CACjB,IAAI,qBAAqB;CACzB,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,WAAW,YAAY;EAC3B,WAAW,MAAM,SAAS,QAAQ;GAChC,MAAM,OAAO,MAAM,OAAO;GAC1B,IACE,MAAM,OAAO,SAAS,UACtB,OAAO,SAAS,YAChB,mBAAmB,IAAI,IAAI,GAE3B,MAAM,IAAI,MAAM,mDAAmD;GAErE,mBAAmB,IAAI,IAAI;GAC3B,IAAI,KAAK,WAAW,oBAAoB,GAAG;IACzC,IAAI,MAAM,UAAU,OAAO,UACzB,MAAM,IAAI,MAAM,uDAAuD;IAEzE,MAAM,OAAO,gBAAgB,KAAK,MAAM,EAA2B,GAAG,OAAO,YAAY;IACzF,IAAI,CAAC,oBAAoB,MAAM,OAAO,IAAI,GACxC,MAAM,IAAI,MAAM,wDAAwD,MAAM;IAEhF,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,YAAY,MAAM,aAAa,OAAO,OAAO,cAAc,kBAAkB,MAAM;IACzF,sBAAsB,UAAU;IAChC,yBACE,MACA,cACA,eACA,6DACF;IACA,eAAe;IACf,IAAI,UAAU,aAAa,OAAO,oBAAoB,YACpD,MAAM,IAAI,MAAM,uDAAuD;IAEzE,cAAc,UAAU;IACxB,MAAM,KAAK;KAAE;KAAM,MAAM,MAAM,OAAO;KAAM,OAAO;IAAU,CAAC;GAChE,OAAO,IAAI,SAAS,yBAAyB;IAC3C,IAAI,MAAM,OAAO,SAAS,OAAS,oBACjC,MAAM,IAAI,MAAM,4DAA4D;IAE9E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,gBAAgB,MAAM,aAC1B,OACA,OAAO,cACP,+BACF;IACA,sBAAsB,cAAc;IACpC,qBAAqB,wBAAwB,eAAe,OAAO,wBAAwB;GAC7F,OAAO,IAAI,SAAS,uBAAuB;IACzC,IAAI,MAAM,OAAO,SAAS,OAAS,kBACjC,MAAM,IAAI,MAAM,0DAA0D;IAE5E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,mBAAmB,MAAM,aACvB,OACA,OAAO,0BACP,sBACF;IACA,sBAAsB,iBAAiB;GACzC,OACE,MAAM,IAAI,MAAM,0DAA0D,MAAM;EAEpF;EACA,IAAI,QAAQ,kBAAkB,MAAM,QAAQ,gBAAgB,GAC1D,MAAM,IAAI,MAAM,+DAA+D;EAEjF,MAAM,aACJ,sBAAsB,mBAClB,kBAAkB,oBAAoB,gBAAgB,IACtD,KAAA;EACN,OAAO;GAAE;GAAO,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EAAG;CACxD,EAAA,CAAG;CACH,OAAO,IAAI,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,CAAC;CACxE,MAAM,SAAS,MAAM;CACrB,MAAM,gCACJ,OAAO,OACP,OAAO,YACP,OACA,OAAO,eACT;CACA,OAAO;AACT;AAEA,SAAS,0BACP,cACA,oBACA,YACA,QACM;CACN,IACE,CAAC,OAAO,cAAc,UAAU,KAChC,eAAe,KAAA,KACf,aAAa,KACb,aAAa,OAAO,kBAAkB,eAAe,oBAErD,MAAM,IAAI,MAAM,oEAAoE;AAExF;AAEA,SAAS,wBACP,OACA,gBACoC;CACpC,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC5E,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,8DAA8D,EAAE,OAAO,MAAM,CAAC;CAChG;CACA,IACE,CAAC,SAAS,KAAK,KACf,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,qCACxC,MAAM,SAAS,eACf,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,aAAa,YAC1B,CAAC,SAAS,MAAM,MAAM,KACtB,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,uBAC/C,OAAO,MAAM,OAAO,WAAW,YAC/B,CAAC,wBAAwB,KAAK,MAAM,OAAO,MAAM,KACjD,CAAC,OAAO,cAAc,MAAM,OAAO,UAAU,KAC5C,MAAM,OAAO,cAAyB,KACtC,MAAM,OAAO,aAAwB,gBAEtC,MAAM,IAAI,MAAM,mDAAmD;CAErE,IAAI,CAAC,OAAO,KAAK,wBAAwB,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,KAAK,KAAK,CAAC,GACxE,MAAM,IAAI,MAAM,kEAAkE;CAEpF,kBAAkB,MAAM,YAAY,iBAAiB;CACrD,kBAAkB,MAAM,UAAU,sBAAsB;CACxD,IAAI,MAAM,WAAW,WAAW,MAAM,SAAS,QAC7C,MAAM,IAAI,MAAM,iEAAiE;CAEnF,OAAO;EACL,MAAM;EACN,YAAY,MAAM;EAClB,UAAU,MAAM;EAChB,QAAQ;GACN,QAAQ,MAAM,OAAO;GACrB,YAAY,MAAM,OAAO;EAC3B;CACF;AACF;AAEA,SAAS,kBACP,UACA,QAC4B;CAC5B,YAAY,QAAQ,SAAS,OAAO,QAAQ,SAAS,OAAO,YAAY,sBAAsB;CAC9F,OAAO;EACL,YAAY,SAAS;EACrB,UAAU,SAAS;EACnB,QAAQ;GAAE,GAAG,SAAS;GAAQ,OAAO;EAAO;CAC9C;AACF;AAEA,eAAe,cACb,SACA,MACA,MACA,OACe;CACf,MAAM,IAAI,SAAe,cAAc,gBAAgB;EACrD,QAAQ,MACN;GACE;GACA;GACA,KAAK;GACL,KAAK;GACL,MAAM,MAAM;GACZ,OAAO;GACP,MAAM;GACN,OAAO;GACP,OAAO;EACT,GACA,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,IAC3D,UAAW,QAAQ,YAAY,KAAK,IAAI,aAAa,CACxD;CACF,CAAC;AACH;AAEA,eAAe,aAAa,OAAc,UAAkB,OAAoC;CAC9F,MAAM,OAAO,MAAM,OAAO;CAC1B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,SAAS,KAAA,KAAa,OAAO,KAAK,OAAO,UAC1E,MAAM,IAAI,MAAM,GAAG,MAAM,yBAAyB;CAEpD,MAAM,QAAQ,MAAM,cAAc,OAAO,UAAU,KAAK;CACxD,IAAI,MAAM,eAAe,MAAM,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CACnF,OAAO;AACT;AAEA,eAAe,cACb,QACA,UACA,OACqB;CACrB,MAAM,SAAmB,CAAC;CAC1B,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,MAAM,aAAa,WAAW,YAAY;GAC5C,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,QAAQ,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;EAChE,OAAO,KAAK,KAAK;EACjB,cAAc,MAAM;CACtB;CACA,OAAO,OAAO,OAAO,QAAQ,UAAU;AACzC;AAEA,eAAe,kBACb,QACA,UACA,UACA,OACkB;CAClB,MAAM,iBAAiB,OAAO,KAAK,SAAS,QAAQ,SAAS,YAAY,SAAS,UAAU;CAC5F,IAAI,QAAQ;CACZ,IAAI,SAAS;CACb,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,MAAM,aAAa,WAAW,QAAQ;GACxC,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,WAAW,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU;EAC7E,IACE,SAAS,SAAS,aAAa,eAAe,cAC9C,CAAC,SAAS,OAAO,eAAe,SAAS,QAAQ,SAAS,SAAS,UAAU,CAAC,GAE9E,QAAQ;EAEV,UAAU,SAAS;CACrB;CACA,OAAO,SAAS,WAAW,eAAe;AAC5C;AAEA,eAAe,wBAAwB,aAAoC;CACzE,MAAM,MAAM,aAAa;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACzD,MAAM,QAAQ,MAAM,MAAM,WAAW;CACrC,IACE,CAAC,MAAM,YAAY,KACnB,MAAM,eAAe,KACpB,MAAM,SAAS,WAAW,MAAO,aAElC,MAAM,IAAI,MAAM,0DAA0D;CAE5E,KAAK,MAAM,QAAQ,WAAW,EAAA,CAAG,SAAS,GACxC,MAAM,IAAI,MAAM,+CAA+C;AAEnE;AAEA,eAAe,oBACb,aACA,OACe;CACf,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,cAAc,aAAa,KAAK,IAAI;EACjD,MAAM,MAAM,QAAQ,IAAI,GAAG;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC3D,MAAM,aAAa,MAAM,KACvB,MACAC,UAAY,WACVA,UAAY,UACZA,UAAY,UACX,OAAOA,UAAY,eAAe,WAAWA,UAAY,aAAa,IACzE,GACF;EACA,IAAI;GACF,MAAM,WAAW,UAAU,KAAK,KAAK;GACrC,MAAM,QAAQ,MAAM,WAAW,KAAK;GACpC,IAAI,CAAC,MAAM,OAAO,KAAK,MAAM,UAAU,GACrC,MAAM,IAAI,MAAM,4DAA4D,KAAK,MAAM;GAEzF,MAAM,WAAW,MAAM,KAAK,IAAI;EAClC,UAAU;GACR,MAAM,WAAW,MAAM;EACzB;CACF;AACF;AAEA,eAAe,sBACb,YACA,aACe;CACf,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,MAAM,UAAU,YAAY,WAAW,OAAO,OAAO;GAAE,MAAM;GAAM,MAAM;EAAM,CAAC;EAChF,MAAM,gBAAgB,aAAa;GACjC;GACA;GACA;GACA,mBAAmB,WAAW,WAAW,WAAW,KAAK,WAAW;EACtE,CAAC;EACD,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAU;EAAU,CAAC;EACnE,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAY;EAAU,CAAC;EAMrE,KAJE,MAAM,gBAAgB,aAAa;GAAC;GAAY;GAAM,WAAW;EAAU,CAAC,EAAA,CAC5E,OACC,SAAS,MAAM,CAAC,CAChB,KACU,MAAM,UAAU,MAAM,IAAI,MAAM,2CAA2C;EAMxF,KAJE,MAAM,gBAAgB,aAAa,CAAC,aAAa,GAAG,WAAW,WAAW,QAAQ,CAAC,EAAA,CACnF,OACC,SAAS,MAAM,CAAC,CAChB,KACY,MAAM,WAAW,UAC9B,MAAM,IAAI,MAAM,+CAA+C;EAEjE,MAAM,gBAAgB,aAAa;GAAC;GAAc;GAAc;GAAQ,WAAW;EAAU,CAAC;EAC9F,MAAM,gBAAgB,aAAa,CAAC,aAAa,WAAW,QAAQ,CAAC;EAMrE,KAJE,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAkB;EAAuB,CAAC,EAAA,CACxF,OACC,SAAS,MAAM,CAAC,CAChB,KACM,GAAG,MAAM,IAAI,MAAM,sDAAsD;CACpF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,SAAS,6BACP,OACA,UACM;CACN,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,gBAAgB,wBAAwB,QAAQ;CACtD,YACE,eACA,SAAS,SAAS,QAClB,SAAS,SAAS,YAClB,8BACF;CACA,IACED,2BAAyB,QAAQ,MAAM,SAAS,UAChD,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,OAAO,OAAO,KAAK,wBAAwB,SAAS,QAAQ,CAAC,CAAC,GAE1F,MAAM,IAAI,MAAM,kEAAkE;AAEtF;AAEA,SAAS,iCACP,OACA,QACM;CACN,IAAI,MAAM,SAAS,OAAO,UACxB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,IAAI;CACJ,MAAM,gCAAgB,IAAI,IAAY;CACtC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,gBAAgB,KAAK,MAAM,OAAO,YAAY;EAC3D,yBACE,MACA,cACA,eACA,qDACF;EACA,eAAe;EACf,IAAI,CAAC,oBAAoB,KAAK,IAAI,GAChC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,KAAK,MAAM,aAAa,OAAO,cACjC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,cAAc,KAAK,MAAM;EACzB,IAAI,aAAa,OAAO,mBACtB,MAAM,IAAI,MAAM,+CAA+C;CAEnE;AACF;AAEA,SAAS,wBACP,OACA,QACuC;CACvC,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,MAAM,4CAA4C;CAE9D,MAAM,YAAY,MAAM;CACxB,IAAI,YAAY,OAAO,UACrB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,MAAM,QAA+C,CAAC;CACtD,KAAK,IAAI,QAAQ,GAAG,QAAQ,WAAW,SAAS;EAC9C,MAAM,YAAY,MAAM;EACxB,IAAI,CAAC,SAAS,SAAS,KAAK,OAAO,KAAK,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,mBACtE,MAAM,IAAI,MAAM,4BAA4B,MAAM,YAAY;EAEhE,MAAM,cAAc,OAAO,0BAA0B,SAAS;EAC9D,IACE,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,SAAS,CAAC,KAEpC,MAAM,IAAI,MAAM,4BAA4B,MAAM,uBAAuB;EAE3E,MAAM,OAAO,gBAAgB,YAAY,MAAM,OAAO,OAAO,YAAY;EACzE,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,aAAa,YAAY,OAAO;EACtC,IAAI,CAAC,oBAAoB,IAAI,GAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,MAAM,OAAO,sBAAsB,YAAY,IAAI;EACnD,IAAI,KAAK,aAAa,OAAO,cAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,KAAK,aAAa,OAAO,oBAAoB,YAC/C,MAAM,IAAI,MAAM,+CAA+C;EAEjE,IAAI,KAAK,aAAa,KAAK,IAAI,GAAG,OAAO,kBAAkB,IAAI,GAC7D,MAAM,IAAI,MAAM,qDAAqD;EAEvE,cAAc,KAAK;EACnB,MAAM,KAAK;GAAE;GAAM;GAAM,OAAO,qBAAqB,IAAI;EAAE,CAAC;CAC9D;CACA,MAAM,MAAM,MAAM,UAAW,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,CAAE;CAC1F,iCAAiC,OAAO,MAAM;CAC9C,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAiC;CAC5D,OAAO,OAAO,cAAc,KAAK,KAAM,SAAoB,KAAM,SAAoB;AACvF;AAEA,SAAS,gBACP,WACsC;CACtC,MAAM,SAAS;EAAE,GAAG;EAAe,GAAG;CAAU;CAChD,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAC/C,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAC3C,MAAM,IAAI,MAAM,uBAAuB,KAAK,iCAAiC;CAGjF,OAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAS,gBAAgB,OAAgB,cAA8B;CACrE,IACE,OAAO,UAAU,YACjB,CAAC,SACD,CAAC,oBAAoB,KAAK,KAC1B,OAAO,WAAW,OAAO,MAAM,IAAI,gBACnC,WAAW,KAAK,KAChB,MAAM,WAAW,KAAK,KACtB,MAAM,SAAS,IAAI,KACnB,MAAM,SAAS,IAAI,KACnB,oBAAoB,KAAK,KACzB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,KACtE,CAAC,QAAQ,UAAU,CAAC,CAAC,SAAS,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,YAAY,KAAK,EAAE,GAEtE,MAAM,IAAI,MAAM,wDAAwD,OAAO,KAAK,GAAG;CAEzF,OAAO;AACT;AAEA,SAAS,yBACP,MACA,cACA,eACA,cACM;CACN,IAAI,iBAAiB,KAAA,KAAa,gBAAgB,MAAM,MAAM,IAAI,MAAM,YAAY;CACpF,KAAK,IAAI,QAAQ,KAAK,QAAQ,GAAG,GAAG,UAAU,IAAI,QAAQ,KAAK,QAAQ,KAAK,QAAQ,CAAC,GACnF,IAAI,cAAc,IAAI,KAAK,MAAM,GAAG,KAAK,CAAC,GAAG,MAAM,IAAI,MAAM,YAAY;CAE3E,cAAc,IAAI,IAAI;AACxB;AAEA,SAAS,sBACP,OACA,MACiE;CACjE,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,SAAS,uBAAuB,KAAK,KAAmB;EACxD,aAAa,2BAA2B,KAAK,KAAmB;EAChE,aAAa,2BAA2B,KAAK,KAAmB;CAClE,QAAQ;EACN,MAAM,IAAI,MAAM,+CAA+C,MAAM;CACvE;CACA,IAAI,oBAAoB,MAAM,GAC5B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,IAAI,CAAC,iBAAiB,MAAM,GAC1B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,OAAO;EAAE;EAAQ;EAAY;CAAW;AAC1C;AAEA,SAAS,qBAAqB,OAIf;CACb,MAAM,EAAE,QAAQ,YAAY,eAAe;CAC3C,MAAM,OAAO,IAAI,WAAW,UAAU;CACtC,WAAW,UAAU,IAAI,KAAK,MAAM,IAAI,WAAW,QAAQ,YAAY,UAAU,CAAC;CAClF,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,QAAQ,SAAU,QAAQ,OAAQ;GACpC,MAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;GACvC,IAAI,EAAE,QAAQ,SAAU,QAAQ,QAAS,OAAO;GAChD;EACF,OAAO,IAAI,QAAQ,SAAU,QAAQ,OACnC,OAAO;CAEX;CACA,OAAO;AACT;AAEA,SAAS,cAAc,MAAc,cAA8B;CACjE,MAAM,OAAO,QAAQ,MAAM,YAAY;CACvC,IAAI,CAAC,KAAK,WAAW,GAAG,OAAO,KAAK,GAClC,MAAM,IAAI,MAAM,6DAA6D,cAAc;CAE7F,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAe,OAAqB;CAC7D,IAAI,CAAC,kCAAkC,KAAK,KAAK,GAC/C,MAAM,IAAI,MAAM,wBAAwB,MAAM,wBAAwB;AAE1E;AAEA,SAAS,oBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,OAAO,MAAQ,SAAS,KAAM,OAAO;CAC3C;CACA,OAAO;AACT;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAIA,SAAS,wBAAwB,MAAgE;CAC/F,MAAM,sBAAsB,OAAO,eAAe,WAAW,SAAS;CACtE,MAAM,SAAS,OAAO,yBAAyB,qBAAqB,IAAI,CAAC,EAAE;CAC3E,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,yBAAyB,KAAK,yBAAyB;CACpF,OAAO;AACT;AAEA,MAAM,yBAAyB,wBAAwB,QAAQ;AAC/D,MAAM,6BAA6B,wBAAwB,YAAY;AACvE,MAAM,6BAA6B,wBAAwB,YAAY"}
+{"version":3,"file":"workspace-archive-CqPIijFA.js","names":["canonicalCandidateDigest","canonicalCandidateDigest","fsConstants"],"sources":["../src/candidate-execution/bundle.ts","../src/candidate-execution/workspace-archive.ts"],"sourcesContent":["import type { AgentCandidateBundle } from '@tangle-network/agent-interface'\nimport { agentCandidateBundleSchema } from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateDigest, immutableCandidateValue, omitTopLevelDigest } from './digest'\n\n/** Exact candidate wire shape before the runtime computes its canonical digest. */\nexport type AgentCandidateBundleInput = Omit<AgentCandidateBundle, 'digest'>\n\n/** Validate and content-address a candidate bundle before it crosses an approval boundary. */\nexport function sealAgentCandidateBundle(input: AgentCandidateBundleInput): AgentCandidateBundle {\n  const digest = canonicalCandidateDigest(input)\n  const parsed = agentCandidateBundleSchema.parse({ ...input, digest })\n  const parsedDigest = canonicalCandidateDigest(omitTopLevelDigest(parsed))\n  if (parsedDigest !== digest) {\n    throw new Error('candidate bundle changed while validating its canonical wire shape')\n  }\n  return immutableCandidateValue(parsed)\n}\n","import { randomUUID } from 'node:crypto'\nimport { constants as fsConstants } from 'node:fs'\nimport {\n  lstat,\n  mkdir,\n  mkdtemp,\n  open,\n  readdir,\n  readFile,\n  realpath,\n  rename,\n  rm,\n  writeFile,\n} from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { dirname, isAbsolute, join, resolve, sep, win32 } from 'node:path'\nimport { isAnyArrayBuffer, isSharedArrayBuffer } from 'node:util/types'\n\nimport type {\n  AgentCandidateCapturedArtifact,\n  AgentCandidateWorkspaceSnapshotEvidence,\n} from '@tangle-network/agent-interface'\nimport { type Entry, extract, type Pack, pack } from 'tar-stream'\n\nimport {\n  candidateWorkspaceManifest,\n  captureMaterializedWorkspace,\n  verifyBytes,\n  verifyMaterializedWorkspace,\n} from './artifacts'\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  deepFreezeCandidate,\n  embeddedCandidateArtifact,\n  sha256Bytes,\n} from './digest'\nimport {\n  assertNoGitIndirection,\n  readCandidateGitTreeFiles,\n  runCandidateGit,\n} from './git-materialize'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport type {\n  AgentCandidateExecutorWorkspaceFile,\n  AgentCandidateOutputArtifactPort,\n  AgentCandidateWorkspacePort,\n} from './types'\n\nconst archiveKind = 'agent-candidate-workspace-archive' as const\nconst workspaceEntryPrefix = 'workspace/'\nconst repositoryMetadataEntry = 'metadata/repository.json'\nconst repositoryBundleEntry = 'metadata/repository.bundle'\nconst fixedTarTime = new Date(0)\n\nexport interface AgentCandidateWorkspaceArchiveLimits {\n  maxArchiveBytes: number\n  maxEmbeddedArtifactBytes: number\n  maxFiles: number\n  maxFileBytes: number\n  maxTotalFileBytes: number\n  maxPathBytes: number\n  maxRepositoryBundleBytes: number\n}\n\nconst defaultLimits: AgentCandidateWorkspaceArchiveLimits = Object.freeze({\n  maxArchiveBytes: 512 * 1024 * 1024,\n  maxEmbeddedArtifactBytes: 1024 * 1024,\n  maxFiles: 50_000,\n  maxFileBytes: 128 * 1024 * 1024,\n  maxTotalFileBytes: 256 * 1024 * 1024,\n  maxPathBytes: 4_096,\n  maxRepositoryBundleBytes: 128 * 1024 * 1024,\n})\n\ninterface WorkspaceArchiveRepository {\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n    bytes: Uint8Array\n  }\n}\n\ninterface WorkspaceArchiveRepositoryMetadata {\n  kind: typeof archiveKind\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n  }\n}\n\ninterface DecodedWorkspaceArchive {\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository?: WorkspaceArchiveRepository\n}\n\nexport interface CaptureAgentCandidateWorkspaceOptions {\n  /** Include Git HEAD so task preparation can prove its exact commit and tree. */\n  includeRepository?: boolean\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n  /** Use the evaluator-owned artifact store when manifest or archive bytes should not be embedded. */\n  artifactPersistence?: {\n    executionId: string\n    outputArtifacts: AgentCandidateOutputArtifactPort\n    signal?: AbortSignal\n  }\n}\n\nexport interface CreateAgentCandidateWorkspacePortOptions {\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n}\n\nexport interface CapturedAgentCandidateWorkspace {\n  readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  /** Caller-owned bytes accepted by createAgentCandidateWorkspacePort. */\n  readonly archive: Uint8Array\n}\n\n/** Capture one exact regular-file workspace for immutable candidate execution. */\nexport async function captureAgentCandidateWorkspace(\n  rootInput: string,\n  options: CaptureAgentCandidateWorkspaceOptions = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const root = resolve(rootInput)\n  const limits = workspaceLimits(options.limits)\n  const captured = options.includeRepository\n    ? await captureRepository(root, limits)\n    : await captureMaterializedWorkspace(root, {\n        limits: {\n          maxFiles: limits.maxFiles,\n          maxFileBytes: limits.maxFileBytes,\n          maxTotalFileBytes: limits.maxTotalFileBytes,\n        },\n      })\n  assertWorkspaceFilesWithinLimits(captured.files, limits)\n  const repository = 'repository' in captured ? captured.repository : undefined\n  return captureWorkspaceFiles(captured.files, repository, limits, options.artifactPersistence)\n}\n\n/** Capture detached files returned by a remote executor into the standard archive. */\nexport async function captureAgentCandidateWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  options: Omit<CaptureAgentCandidateWorkspaceOptions, 'includeRepository'> = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const limits = workspaceLimits(options.limits)\n  return captureWorkspaceFiles(\n    normalizeWorkspaceFiles(input, limits),\n    undefined,\n    limits,\n    options.artifactPersistence,\n  )\n}\n\nasync function captureWorkspaceFiles(\n  files: readonly AgentCandidateExecutorWorkspaceFile[],\n  repository: WorkspaceArchiveRepository | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n  artifactPersistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<CapturedAgentCandidateWorkspace> {\n  const material = candidateWorkspaceManifest(files)\n  const manifest = canonicalCandidateBytes(material)\n  const archive = await encodeWorkspaceArchive(files, repository, limits.maxArchiveBytes)\n  if (\n    !artifactPersistence &&\n    (manifest.byteLength > limits.maxEmbeddedArtifactBytes ||\n      archive.byteLength > limits.maxEmbeddedArtifactBytes)\n  ) {\n    throw new Error(\n      'candidate workspace artifacts exceed maxEmbeddedArtifactBytes; artifactPersistence is required',\n    )\n  }\n  const manifestArtifact = await captureWorkspaceArtifact('manifest', manifest, artifactPersistence)\n  const archiveArtifact = await captureWorkspaceArtifact('archive', archive, artifactPersistence)\n  const snapshot = deepFreezeCandidate({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: canonicalCandidateDigest(material),\n    material,\n    manifest: manifestArtifact,\n    archive: archiveArtifact,\n  } satisfies AgentCandidateWorkspaceSnapshotEvidence)\n  return Object.freeze({ snapshot, archive })\n}\n\nasync function captureWorkspaceArtifact(\n  kind: 'manifest' | 'archive',\n  bytes: Uint8Array,\n  persistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<AgentCandidateCapturedArtifact> {\n  if (!persistence) return embeddedCandidateArtifact(bytes)\n  if (!persistence.executionId.trim()) {\n    throw new Error('candidate workspace artifact persistence requires an executionId')\n  }\n  return persistCandidateOutputArtifact(persistence.outputArtifacts, {\n    executionId: persistence.executionId,\n    purpose: kind === 'manifest' ? 'candidate-workspace-manifest' : 'candidate-workspace-archive',\n    bytes,\n    ...(persistence.signal ? { signal: persistence.signal } : {}),\n  })\n}\n\n/** Create the standard bounded materializer for candidate execution ports. */\nexport function createAgentCandidateWorkspacePort(\n  options: CreateAgentCandidateWorkspacePortOptions = {},\n): AgentCandidateWorkspacePort {\n  const limits = workspaceLimits(options.limits)\n  const port: AgentCandidateWorkspacePort = {\n    materialize: async ({ role, snapshot, archive, destination }) => {\n      await materializeAgentCandidateWorkspace({\n        role,\n        snapshot,\n        archive,\n        destination,\n        limits,\n      })\n    },\n  }\n  return Object.freeze(port)\n}\n\nasync function materializeAgentCandidateWorkspace(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  destination: string\n  limits: AgentCandidateWorkspaceArchiveLimits\n}): Promise<void> {\n  verifyBytes(\n    input.archive,\n    input.snapshot.archive.sha256,\n    input.snapshot.archive.byteLength,\n    'candidate workspace archive',\n  )\n  const decoded = await parseWorkspaceArchive(input.archive, input.limits)\n  if (decoded.repository && input.role !== 'task') {\n    throw new Error('only task workspaces may carry a Git repository')\n  }\n  assertArchiveMatchesSnapshot(decoded.files, input.snapshot)\n  const destination = resolve(input.destination)\n  await prepareEmptyDestination(destination)\n  const staging = await mkdtemp(`${destination}.materializing-`)\n  try {\n    await writeWorkspaceFiles(staging, decoded.files)\n    if (decoded.repository) {\n      await materializeRepository(decoded.repository, staging)\n    }\n    await verifyMaterializedWorkspace(staging, input.snapshot.material, {\n      ignoredProtectedRootEntries: decoded.repository ? ['.git'] : [],\n    })\n    await rename(staging, destination)\n  } catch (error) {\n    await rm(staging, { recursive: true, force: true })\n    await rm(destination, { recursive: true, force: true })\n    throw error\n  }\n}\n\nasync function captureRepository(\n  root: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<{\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository: WorkspaceArchiveRepository\n}> {\n  const stats = await lstat(root)\n  if (!stats.isDirectory() || stats.isSymbolicLink() || (await realpath(root)) !== root) {\n    throw new Error('candidate repository root must be a real directory')\n  }\n  const topLevel = (await runCandidateGit(root, ['rev-parse', '--show-toplevel'])).stdout\n    .toString('utf8')\n    .trim()\n  if (resolve(topLevel) !== root) {\n    throw new Error('candidate repository capture must start at the Git worktree root')\n  }\n  const gitDir = resolve(\n    (await runCandidateGit(root, ['rev-parse', '--absolute-git-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(gitDir)) !== gitDir || gitDir.includes(':')) {\n    throw new Error('candidate repository Git object store has an unsupported path')\n  }\n  await assertNoGitIndirection(root, gitDir, 'candidate repository')\n  const headCommit = (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout\n    .toString('utf8')\n    .trim()\n  const headTree = (await runCandidateGit(root, ['rev-parse', 'HEAD^{tree}'])).stdout\n    .toString('utf8')\n    .trim()\n  assertGitObjectId(headCommit, 'HEAD')\n  assertGitObjectId(headTree, 'HEAD tree')\n  if (headCommit.length !== headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  const files = await readCandidateGitTreeFiles(root, headTree, {}, limits)\n  assertWorkspaceFilesWithinLimits(files, limits)\n  const reachableBytesText = (\n    await runCandidateGit(root, ['rev-list', '--disk-usage', '--objects', 'HEAD'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  const reachableBytes = Number(reachableBytesText)\n  if (!Number.isSafeInteger(reachableBytes) || reachableBytes < 0) {\n    throw new Error('candidate repository reachable size is invalid')\n  }\n  if (reachableBytes > limits.maxRepositoryBundleBytes) {\n    throw new Error('candidate repository exceeds maxRepositoryBundleBytes')\n  }\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    await runCandidateGit(root, ['bundle', 'create', bundlePath, 'HEAD'])\n    const bundle = Uint8Array.from(await readFile(bundlePath))\n    if (bundle.byteLength > limits.maxRepositoryBundleBytes) {\n      throw new Error('candidate repository bundle exceeds maxRepositoryBundleBytes')\n    }\n    return {\n      files,\n      repository: {\n        headCommit,\n        headTree,\n        bundle: {\n          sha256: sha256Bytes(bundle),\n          byteLength: bundle.byteLength,\n          bytes: bundle,\n        },\n      },\n    }\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nasync function encodeWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  maxArchiveBytes: number,\n): Promise<Uint8Array> {\n  const archive = pack()\n  const output = collectStream(archive, maxArchiveBytes, 'candidate workspace archive')\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    return await output\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await output.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function verifyCanonicalWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  expected: Uint8Array,\n  maxArchiveBytes: number,\n): Promise<void> {\n  const archive = pack()\n  const comparison = streamEqualsBytes(\n    archive,\n    expected,\n    maxArchiveBytes,\n    'candidate workspace archive',\n  )\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    if (!(await comparison)) throw new Error('candidate workspace tar is not canonical')\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await comparison.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function writeWorkspaceArchiveEntries(\n  archive: Pack,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n): Promise<void> {\n  for (const file of files) {\n    await writeTarEntry(archive, `${workspaceEntryPrefix}${file.path}`, file.mode, file.bytes)\n  }\n  if (!repository) return\n  const metadata = canonicalCandidateBytes({\n    kind: archiveKind,\n    headCommit: repository.headCommit,\n    headTree: repository.headTree,\n    bundle: {\n      sha256: repository.bundle.sha256,\n      byteLength: repository.bundle.byteLength,\n    },\n  } satisfies WorkspaceArchiveRepositoryMetadata)\n  await writeTarEntry(archive, repositoryMetadataEntry, 0o600, metadata)\n  await writeTarEntry(archive, repositoryBundleEntry, 0o600, repository.bundle.bytes)\n}\n\nasync function parseWorkspaceArchive(\n  bytes: Uint8Array,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<DecodedWorkspaceArchive> {\n  if (bytes.byteLength > limits.maxArchiveBytes) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n  }\n  const parser = extract()\n  const files: DecodedWorkspaceArchive['files'] = []\n  const observedEntryNames = new Set<string>()\n  const observedPaths = new Set<string>()\n  let totalBytes = 0\n  let retainedEntryBytes = 0\n  let previousPath: string | undefined\n  let repositoryMetadata: WorkspaceArchiveRepositoryMetadata | undefined\n  let repositoryBundle: Uint8Array | undefined\n  const decoded = (async () => {\n    for await (const entry of parser) {\n      const name = entry.header.name\n      if (\n        entry.header.type !== 'file' ||\n        typeof name !== 'string' ||\n        observedEntryNames.has(name)\n      ) {\n        throw new Error('candidate workspace tar contains an invalid entry')\n      }\n      observedEntryNames.add(name)\n      if (name.startsWith(workspaceEntryPrefix)) {\n        if (files.length >= limits.maxFiles) {\n          throw new Error('candidate workspace archive has an invalid file count')\n        }\n        const path = safeArchivePath(name.slice(workspaceEntryPrefix.length), limits.maxPathBytes)\n        if (!isWorkspaceFileMode(entry.header.mode)) {\n          throw new Error(`candidate workspace archive has an unsupported mode: ${path}`)\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const fileBytes = await readTarEntry(entry, limits.maxFileBytes, `workspace file ${path}`)\n        retainedEntryBytes += fileBytes.byteLength\n        assertWorkspacePathOrder(\n          path,\n          previousPath,\n          observedPaths,\n          'candidate workspace archive paths must be unique and sorted',\n        )\n        previousPath = path\n        if (fileBytes.byteLength > limits.maxTotalFileBytes - totalBytes) {\n          throw new Error('candidate workspace archive exceeds maxTotalFileBytes')\n        }\n        totalBytes += fileBytes.byteLength\n        files.push({ path, mode: entry.header.mode, bytes: fileBytes })\n      } else if (name === repositoryMetadataEntry) {\n        if (entry.header.mode !== 0o600 || repositoryMetadata) {\n          throw new Error('candidate workspace archive repository metadata is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const metadataBytes = await readTarEntry(\n          entry,\n          limits.maxPathBytes,\n          'candidate repository metadata',\n        )\n        retainedEntryBytes += metadataBytes.byteLength\n        repositoryMetadata = parseRepositoryMetadata(metadataBytes, limits.maxRepositoryBundleBytes)\n      } else if (name === repositoryBundleEntry) {\n        if (entry.header.mode !== 0o600 || repositoryBundle) {\n          throw new Error('candidate workspace archive repository bundle is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        repositoryBundle = await readTarEntry(\n          entry,\n          limits.maxRepositoryBundleBytes,\n          'candidate Git bundle',\n        )\n        retainedEntryBytes += repositoryBundle.byteLength\n      } else {\n        throw new Error(`candidate workspace tar contains an unsupported entry: ${name}`)\n      }\n    }\n    if (Boolean(repositoryMetadata) !== Boolean(repositoryBundle)) {\n      throw new Error('candidate workspace archive repository evidence is incomplete')\n    }\n    const repository =\n      repositoryMetadata && repositoryBundle\n        ? repositoryFromTar(repositoryMetadata, repositoryBundle)\n        : undefined\n    return { files, ...(repository ? { repository } : {}) }\n  })()\n  parser.end(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength))\n  const result = await decoded\n  await verifyCanonicalWorkspaceArchive(\n    result.files,\n    result.repository,\n    bytes,\n    limits.maxArchiveBytes,\n  )\n  return result\n}\n\nfunction assertRetainedArchiveSize(\n  archiveBytes: number,\n  retainedEntryBytes: number,\n  entryBytes: number | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (\n    !Number.isSafeInteger(entryBytes) ||\n    entryBytes === undefined ||\n    entryBytes < 0 ||\n    entryBytes > limits.maxArchiveBytes - archiveBytes - retainedEntryBytes\n  ) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes while decoding')\n  }\n}\n\nfunction parseRepositoryMetadata(\n  bytes: Uint8Array,\n  maxBundleBytes: number,\n): WorkspaceArchiveRepositoryMetadata {\n  let value: unknown\n  try {\n    value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes))\n  } catch (error) {\n    throw new Error('candidate workspace archive repository metadata is invalid', { cause: error })\n  }\n  if (\n    !isRecord(value) ||\n    Object.keys(value).sort().join(',') !== 'bundle,headCommit,headTree,kind' ||\n    value.kind !== archiveKind ||\n    typeof value.headCommit !== 'string' ||\n    typeof value.headTree !== 'string' ||\n    !isRecord(value.bundle) ||\n    Object.keys(value.bundle).sort().join(',') !== 'byteLength,sha256' ||\n    typeof value.bundle.sha256 !== 'string' ||\n    !/^sha256:[a-f0-9]{64}$/.test(value.bundle.sha256) ||\n    !Number.isSafeInteger(value.bundle.byteLength) ||\n    (value.bundle.byteLength as number) <= 0 ||\n    (value.bundle.byteLength as number) > maxBundleBytes\n  ) {\n    throw new Error('candidate workspace archive repository is invalid')\n  }\n  if (!Buffer.from(canonicalCandidateBytes(value)).equals(Buffer.from(bytes))) {\n    throw new Error('candidate workspace archive repository metadata is not canonical')\n  }\n  assertGitObjectId(value.headCommit, 'repository HEAD')\n  assertGitObjectId(value.headTree, 'repository HEAD tree')\n  if (value.headCommit.length !== value.headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  return {\n    kind: archiveKind,\n    headCommit: value.headCommit,\n    headTree: value.headTree,\n    bundle: {\n      sha256: value.bundle.sha256 as `sha256:${string}`,\n      byteLength: value.bundle.byteLength as number,\n    },\n  }\n}\n\nfunction repositoryFromTar(\n  metadata: WorkspaceArchiveRepositoryMetadata,\n  bundle: Uint8Array,\n): WorkspaceArchiveRepository {\n  verifyBytes(bundle, metadata.bundle.sha256, metadata.bundle.byteLength, 'candidate Git bundle')\n  return {\n    headCommit: metadata.headCommit,\n    headTree: metadata.headTree,\n    bundle: { ...metadata.bundle, bytes: bundle },\n  }\n}\n\nasync function writeTarEntry(\n  archive: Pack,\n  name: string,\n  mode: number,\n  bytes: Uint8Array,\n): Promise<void> {\n  await new Promise<void>((resolveEntry, rejectEntry) => {\n    archive.entry(\n      {\n        name,\n        mode,\n        uid: 0,\n        gid: 0,\n        size: bytes.byteLength,\n        mtime: fixedTarTime,\n        type: 'file',\n        uname: '',\n        gname: '',\n      },\n      Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength),\n      (error) => (error ? rejectEntry(error) : resolveEntry()),\n    )\n  })\n}\n\nasync function readTarEntry(entry: Entry, maxBytes: number, label: string): Promise<Uint8Array> {\n  const size = entry.header.size\n  if (!Number.isSafeInteger(size) || size === undefined || size < 0 || size > maxBytes) {\n    throw new Error(`${label} has an invalid tar size`)\n  }\n  const bytes = await collectStream(entry, maxBytes, label)\n  if (bytes.byteLength !== size) throw new Error(`${label} differs from its tar size`)\n  return bytes\n}\n\nasync function collectStream(\n  stream: AsyncIterable<Uint8Array>,\n  maxBytes: number,\n  label: string,\n): Promise<Uint8Array> {\n  const chunks: Buffer[] = []\n  let totalBytes = 0\n  for await (const chunk of stream) {\n    if (chunk.byteLength > maxBytes - totalBytes) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)\n    chunks.push(bytes)\n    totalBytes += bytes.byteLength\n  }\n  return Buffer.concat(chunks, totalBytes)\n}\n\nasync function streamEqualsBytes(\n  stream: AsyncIterable<Uint8Array>,\n  expected: Uint8Array,\n  maxBytes: number,\n  label: string,\n): Promise<boolean> {\n  const expectedBuffer = Buffer.from(expected.buffer, expected.byteOffset, expected.byteLength)\n  let equal = true\n  let offset = 0\n  for await (const chunk of stream) {\n    if (chunk.byteLength > maxBytes - offset) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const observed = Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength)\n    if (\n      offset + observed.byteLength > expectedBuffer.byteLength ||\n      !observed.equals(expectedBuffer.subarray(offset, offset + observed.byteLength))\n    ) {\n      equal = false\n    }\n    offset += observed.byteLength\n  }\n  return equal && offset === expectedBuffer.byteLength\n}\n\nasync function prepareEmptyDestination(destination: string): Promise<void> {\n  await mkdir(destination, { recursive: true, mode: 0o700 })\n  const stats = await lstat(destination)\n  if (\n    !stats.isDirectory() ||\n    stats.isSymbolicLink() ||\n    (await realpath(destination)) !== destination\n  ) {\n    throw new Error('candidate workspace destination must be a real directory')\n  }\n  if ((await readdir(destination)).length > 0) {\n    throw new Error('candidate workspace destination must be empty')\n  }\n}\n\nasync function writeWorkspaceFiles(\n  destination: string,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n): Promise<void> {\n  for (const file of files) {\n    const path = workspacePath(destination, file.path)\n    await mkdir(dirname(path), { recursive: true, mode: 0o700 })\n    const descriptor = await open(\n      path,\n      fsConstants.O_WRONLY |\n        fsConstants.O_CREAT |\n        fsConstants.O_EXCL |\n        (typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0),\n      0o600,\n    )\n    try {\n      await descriptor.writeFile(file.bytes)\n      const stats = await descriptor.stat()\n      if (!stats.isFile() || stats.nlink !== 1) {\n        throw new Error(`candidate workspace file identity changed while writing: ${file.path}`)\n      }\n      await descriptor.chmod(file.mode)\n    } finally {\n      await descriptor.close()\n    }\n  }\n}\n\nasync function materializeRepository(\n  repository: WorkspaceArchiveRepository,\n  destination: string,\n): Promise<void> {\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    await writeFile(bundlePath, repository.bundle.bytes, { flag: 'wx', mode: 0o600 })\n    await runCandidateGit(destination, [\n      'init',\n      '--quiet',\n      '--initial-branch=candidate',\n      `--object-format=${repository.headCommit.length === 64 ? 'sha256' : 'sha1'}`,\n    ])\n    await runCandidateGit(destination, ['bundle', 'verify', bundlePath])\n    await runCandidateGit(destination, ['bundle', 'unbundle', bundlePath])\n    const objectType = (\n      await runCandidateGit(destination, ['cat-file', '-t', repository.headCommit])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (objectType !== 'commit') throw new Error('candidate repository HEAD is not a commit')\n    const observedTree = (\n      await runCandidateGit(destination, ['rev-parse', `${repository.headCommit}^{tree}`])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (observedTree !== repository.headTree) {\n      throw new Error('candidate repository bundle HEAD tree changed')\n    }\n    await runCandidateGit(destination, ['update-ref', '--no-deref', 'HEAD', repository.headCommit])\n    await runCandidateGit(destination, ['read-tree', repository.headTree])\n    const status = (\n      await runCandidateGit(destination, ['status', '--porcelain=v1', '--untracked-files=all'])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (status) throw new Error('candidate repository files do not exactly match HEAD')\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nfunction assertArchiveMatchesSnapshot(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n): void {\n  const material = candidateWorkspaceManifest(files)\n  const materialBytes = canonicalCandidateBytes(material)\n  verifyBytes(\n    materialBytes,\n    snapshot.manifest.sha256,\n    snapshot.manifest.byteLength,\n    'candidate workspace manifest',\n  )\n  if (\n    canonicalCandidateDigest(material) !== snapshot.digest ||\n    !Buffer.from(materialBytes).equals(Buffer.from(canonicalCandidateBytes(snapshot.material)))\n  ) {\n    throw new Error('candidate workspace archive does not match its snapshot manifest')\n  }\n}\n\nfunction assertWorkspaceFilesWithinLimits(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (files.length > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  let previousPath: string | undefined\n  const observedPaths = new Set<string>()\n  for (const file of files) {\n    const path = safeArchivePath(file.path, limits.maxPathBytes)\n    assertWorkspacePathOrder(\n      path,\n      previousPath,\n      observedPaths,\n      'candidate workspace paths must be unique and sorted',\n    )\n    previousPath = path\n    if (!isWorkspaceFileMode(file.mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    if (file.bytes.byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    totalBytes += file.bytes.byteLength\n    if (totalBytes > limits.maxTotalFileBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n  }\n}\n\nfunction normalizeWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): AgentCandidateExecutorWorkspaceFile[] {\n  if (!Array.isArray(input)) {\n    throw new Error('candidate workspace files must be an array')\n  }\n  const fileCount = input.length\n  if (fileCount > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  const files: AgentCandidateExecutorWorkspaceFile[] = []\n  for (let index = 0; index < fileCount; index++) {\n    const inputFile = input[index]\n    if (!isRecord(inputFile) || Object.keys(inputFile).sort().join(',') !== 'bytes,mode,path') {\n      throw new Error(`candidate workspace file ${index} is invalid`)\n    }\n    const descriptors = Object.getOwnPropertyDescriptors(inputFile)\n    if (\n      !('value' in (descriptors.path ?? {})) ||\n      !('value' in (descriptors.mode ?? {})) ||\n      !('value' in (descriptors.bytes ?? {}))\n    ) {\n      throw new Error(`candidate workspace file ${index} must use fixed values`)\n    }\n    const path = safeArchivePath(descriptors.path?.value, limits.maxPathBytes)\n    const mode = descriptors.mode?.value\n    const inputBytes = descriptors.bytes?.value\n    if (!isWorkspaceFileMode(mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    const view = inspectWorkspaceBytes(inputBytes, path)\n    if (view.byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    if (view.byteLength > limits.maxTotalFileBytes - totalBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n    if (view.byteLength > Math.max(0, limits.maxArchiveBytes - 1024)) {\n      throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n    }\n    totalBytes += view.byteLength\n    files.push({ path, mode, bytes: detachWorkspaceBytes(view) })\n  }\n  files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))\n  assertWorkspaceFilesWithinLimits(files, limits)\n  return files\n}\n\nfunction isWorkspaceFileMode(value: unknown): value is number {\n  return Number.isSafeInteger(value) && (value as number) >= 0 && (value as number) <= 0o777\n}\n\nfunction workspaceLimits(\n  overrides: Partial<AgentCandidateWorkspaceArchiveLimits> | undefined,\n): AgentCandidateWorkspaceArchiveLimits {\n  const limits = { ...defaultLimits, ...overrides }\n  for (const [name, value] of Object.entries(limits)) {\n    if (!Number.isSafeInteger(value) || value <= 0) {\n      throw new Error(`candidate workspace ${name} must be a positive safe integer`)\n    }\n  }\n  return Object.freeze(limits)\n}\n\nfunction safeArchivePath(value: unknown, maxPathBytes: number): string {\n  if (\n    typeof value !== 'string' ||\n    !value ||\n    !isWellFormedUnicode(value) ||\n    Buffer.byteLength(value, 'utf8') > maxPathBytes ||\n    isAbsolute(value) ||\n    win32.isAbsolute(value) ||\n    value.includes('\\\\') ||\n    value.includes('\\0') ||\n    hasControlCharacter(value) ||\n    value.split('/').some((part) => !part || part === '.' || part === '..') ||\n    ['.git', '.sidecar'].includes(value.split('/')[0]?.toLowerCase() ?? '')\n  ) {\n    throw new Error(`candidate workspace archive contains an unsafe path: ${String(value)}`)\n  }\n  return value\n}\n\nfunction assertWorkspacePathOrder(\n  path: string,\n  previousPath: string | undefined,\n  observedPaths: Set<string>,\n  errorMessage: string,\n): void {\n  if (previousPath !== undefined && previousPath >= path) throw new Error(errorMessage)\n  for (let slash = path.indexOf('/'); slash !== -1; slash = path.indexOf('/', slash + 1)) {\n    if (observedPaths.has(path.slice(0, slash))) throw new Error(errorMessage)\n  }\n  observedPaths.add(path)\n}\n\nfunction inspectWorkspaceBytes(\n  input: unknown,\n  path: string,\n): { buffer: ArrayBuffer; byteOffset: number; byteLength: number } {\n  let buffer: ArrayBufferLike\n  let byteOffset: number\n  let byteLength: number\n  try {\n    buffer = typedArrayBufferGetter.call(input as Uint8Array) as ArrayBufferLike\n    byteOffset = typedArrayByteOffsetGetter.call(input as Uint8Array) as number\n    byteLength = typedArrayByteLengthGetter.call(input as Uint8Array) as number\n  } catch {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  if (isSharedArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file uses shared bytes: ${path}`)\n  }\n  if (!isAnyArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  return { buffer, byteOffset, byteLength }\n}\n\nfunction detachWorkspaceBytes(input: {\n  buffer: ArrayBuffer\n  byteOffset: number\n  byteLength: number\n}): Uint8Array {\n  const { buffer, byteOffset, byteLength } = input\n  const copy = new Uint8Array(byteLength)\n  Uint8Array.prototype.set.call(copy, new Uint8Array(buffer, byteOffset, byteLength))\n  return copy\n}\n\nfunction isWellFormedUnicode(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1)\n      if (!(next >= 0xdc00 && next <= 0xdfff)) return false\n      index++\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      return false\n    }\n  }\n  return true\n}\n\nfunction workspacePath(root: string, relativePath: string): string {\n  const path = resolve(root, relativePath)\n  if (!path.startsWith(`${root}${sep}`)) {\n    throw new Error(`candidate workspace archive path escapes its destination: ${relativePath}`)\n  }\n  return path\n}\n\nfunction assertGitObjectId(value: string, label: string): void {\n  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value)) {\n    throw new Error(`candidate repository ${label} is not a Git object id`)\n  }\n}\n\nfunction hasControlCharacter(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code < 0x20 || code === 0x7f) return true\n  }\n  return false\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\ntype TypedArrayGetter = (this: Uint8Array) => unknown\n\nfunction requireTypedArrayGetter(name: 'buffer' | 'byteOffset' | 'byteLength'): TypedArrayGetter {\n  const typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype) as object\n  const getter = Object.getOwnPropertyDescriptor(typedArrayPrototype, name)?.get\n  if (!getter) throw new Error(`typed array intrinsic ${name} accessor is unavailable`)\n  return getter\n}\n\nconst typedArrayBufferGetter = requireTypedArrayGetter('buffer')\nconst typedArrayByteOffsetGetter = requireTypedArrayGetter('byteOffset')\nconst typedArrayByteLengthGetter = requireTypedArrayGetter('byteLength')\n"],"mappings":";;;;;;;;;;;AASA,SAAgB,yBAAyB,OAAwD;CAC/F,MAAM,SAASA,2BAAyB,KAAK;CAC7C,MAAM,SAAS,2BAA2B,MAAM;EAAE,GAAG;EAAO;CAAO,CAAC;CAEpE,IADqBA,2BAAyB,mBAAmB,MAAM,CACxD,MAAM,QACnB,MAAM,IAAI,MAAM,oEAAoE;CAEtF,OAAO,wBAAwB,MAAM;AACvC;;;ACgCA,MAAM,cAAc;AACpB,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;AAChC,MAAM,wBAAwB;AAC9B,MAAM,+BAAe,IAAI,KAAK,CAAC;AAY/B,MAAM,gBAAsD,OAAO,OAAO;CACxE,iBAAiB,MAAM,OAAO;CAC9B,0BAA0B,OAAO;CACjC,UAAU;CACV,cAAc,MAAM,OAAO;CAC3B,mBAAmB,MAAM,OAAO;CAChC,cAAc;CACd,0BAA0B,MAAM,OAAO;AACzC,CAAC;;AAkDD,eAAsB,+BACpB,WACA,UAAiD,CAAC,GACR;CAC1C,MAAM,OAAO,QAAQ,SAAS;CAC9B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,MAAM,WAAW,QAAQ,oBACrB,MAAM,kBAAkB,MAAM,MAAM,IACpC,MAAM,6BAA6B,MAAM,EACvC,QAAQ;EACN,UAAU,OAAO;EACjB,cAAc,OAAO;EACrB,mBAAmB,OAAO;CAC5B,EACF,CAAC;CACL,iCAAiC,SAAS,OAAO,MAAM;CACvD,MAAM,aAAa,gBAAgB,WAAW,SAAS,aAAa,KAAA;CACpE,OAAO,sBAAsB,SAAS,OAAO,YAAY,QAAQ,QAAQ,mBAAmB;AAC9F;;AAGA,eAAsB,oCACpB,OACA,UAA4E,CAAC,GACnC;CAC1C,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,OAAO,sBACL,wBAAwB,OAAO,MAAM,GACrC,KAAA,GACA,QACA,QAAQ,mBACV;AACF;AAEA,eAAe,sBACb,OACA,YACA,QACA,qBAC0C;CAC1C,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,WAAW,wBAAwB,QAAQ;CACjD,MAAM,UAAU,MAAM,uBAAuB,OAAO,YAAY,OAAO,eAAe;CACtF,IACE,CAAC,wBACA,SAAS,aAAa,OAAO,4BAC5B,QAAQ,aAAa,OAAO,2BAE9B,MAAM,IAAI,MACR,gGACF;CAEF,MAAM,mBAAmB,MAAM,yBAAyB,YAAY,UAAU,mBAAmB;CACjG,MAAM,kBAAkB,MAAM,yBAAyB,WAAW,SAAS,mBAAmB;CAC9F,MAAM,WAAW,oBAAoB;EACnC,MAAM;EACN,QAAQC,2BAAyB,QAAQ;EACzC;EACA,UAAU;EACV,SAAS;CACX,CAAmD;CACnD,OAAO,OAAO,OAAO;EAAE;EAAU;CAAQ,CAAC;AAC5C;AAEA,eAAe,yBACb,MACA,OACA,aACyC;CACzC,IAAI,CAAC,aAAa,OAAO,0BAA0B,KAAK;CACxD,IAAI,CAAC,YAAY,YAAY,KAAK,GAChC,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO,+BAA+B,YAAY,iBAAiB;EACjE,aAAa,YAAY;EACzB,SAAS,SAAS,aAAa,iCAAiC;EAChE;EACA,GAAI,YAAY,SAAS,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;CAC7D,CAAC;AACH;;AAGA,SAAgB,kCACd,UAAoD,CAAC,GACxB;CAC7B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAY7C,OAAO,OAAO,OAAO,EAVnB,aAAa,OAAO,EAAE,MAAM,UAAU,SAAS,kBAAkB;EAC/D,MAAM,mCAAmC;GACvC;GACA;GACA;GACA;GACA;EACF,CAAC;CACH,EAEsB,CAAC;AAC3B;AAEA,eAAe,mCAAmC,OAMhC;CAChB,YACE,MAAM,SACN,MAAM,SAAS,QAAQ,QACvB,MAAM,SAAS,QAAQ,YACvB,6BACF;CACA,MAAM,UAAU,MAAM,sBAAsB,MAAM,SAAS,MAAM,MAAM;CACvE,IAAI,QAAQ,cAAc,MAAM,SAAS,QACvC,MAAM,IAAI,MAAM,iDAAiD;CAEnE,6BAA6B,QAAQ,OAAO,MAAM,QAAQ;CAC1D,MAAM,cAAc,QAAQ,MAAM,WAAW;CAC7C,MAAM,wBAAwB,WAAW;CACzC,MAAM,UAAU,MAAM,QAAQ,GAAG,YAAY,gBAAgB;CAC7D,IAAI;EACF,MAAM,oBAAoB,SAAS,QAAQ,KAAK;EAChD,IAAI,QAAQ,YACV,MAAM,sBAAsB,QAAQ,YAAY,OAAO;EAEzD,MAAM,4BAA4B,SAAS,MAAM,SAAS,UAAU,EAClE,6BAA6B,QAAQ,aAAa,CAAC,MAAM,IAAI,CAAC,EAChE,CAAC;EACD,MAAM,OAAO,SAAS,WAAW;CACnC,SAAS,OAAO;EACd,MAAM,GAAG,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAClD,MAAM,GAAG,aAAa;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACtD,MAAM;CACR;AACF;AAEA,eAAe,kBACb,MACA,QAIC;CACD,MAAM,QAAQ,MAAM,MAAM,IAAI;CAC9B,IAAI,CAAC,MAAM,YAAY,KAAK,MAAM,eAAe,KAAM,MAAM,SAAS,IAAI,MAAO,MAC/E,MAAM,IAAI,MAAM,oDAAoD;CAKtE,IAAI,SAHc,MAAM,gBAAgB,MAAM,CAAC,aAAa,iBAAiB,CAAC,EAAA,CAAG,OAC9E,SAAS,MAAM,CAAC,CAChB,KACgB,CAAC,MAAM,MACxB,MAAM,IAAI,MAAM,kEAAkE;CAEpF,MAAM,SAAS,SACZ,MAAM,gBAAgB,MAAM,CAAC,aAAa,oBAAoB,CAAC,EAAA,CAAG,OAChE,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,MAAM,MAAO,UAAU,OAAO,SAAS,GAAG,GAC5D,MAAM,IAAI,MAAM,+DAA+D;CAEjF,MAAM,uBAAuB,MAAM,QAAQ,sBAAsB;CACjE,MAAM,cAAc,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OACrE,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,YAAY,MAAM,gBAAgB,MAAM,CAAC,aAAa,aAAa,CAAC,EAAA,CAAG,OAC1E,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,kBAAkB,YAAY,MAAM;CACpC,kBAAkB,UAAU,WAAW;CACvC,IAAI,WAAW,WAAW,SAAS,QACjC,MAAM,IAAI,MAAM,iEAAiE;CAEnF,MAAM,QAAQ,MAAM,0BAA0B,MAAM,UAAU,CAAC,GAAG,MAAM;CACxE,iCAAiC,OAAO,MAAM;CAC9C,MAAM,sBACJ,MAAM,gBAAgB,MAAM;EAAC;EAAY;EAAgB;EAAa;CAAM,CAAC,EAAA,CAC7E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,iBAAiB,OAAO,kBAAkB;CAChD,IAAI,CAAC,OAAO,cAAc,cAAc,KAAK,iBAAiB,GAC5D,MAAM,IAAI,MAAM,gDAAgD;CAElE,IAAI,iBAAiB,OAAO,0BAC1B,MAAM,IAAI,MAAM,uDAAuD;CAEzE,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,MAAM,gBAAgB,MAAM;GAAC;GAAU;GAAU;GAAY;EAAM,CAAC;EACpE,MAAM,SAAS,WAAW,KAAK,MAAM,SAAS,UAAU,CAAC;EACzD,IAAI,OAAO,aAAa,OAAO,0BAC7B,MAAM,IAAI,MAAM,8DAA8D;EAEhF,OAAO;GACL;GACA,YAAY;IACV;IACA;IACA,QAAQ;KACN,QAAQ,YAAY,MAAM;KAC1B,YAAY,OAAO;KACnB,OAAO;IACT;GACF;EACF;CACF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAe,uBACb,OACA,YACA,iBACqB;CACrB,MAAM,UAAU,KAAK;CACrB,MAAM,SAAS,cAAc,SAAS,iBAAiB,6BAA6B;CACpF,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,OAAO,MAAM;CACf,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,OAAO,YAAY,KAAA,CAAS;EAClC,MAAM;CACR;AACF;AAEA,eAAe,gCACb,OACA,YACA,UACA,iBACe;CACf,MAAM,UAAU,KAAK;CACrB,MAAM,aAAa,kBACjB,SACA,UACA,iBACA,6BACF;CACA,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,IAAI,CAAE,MAAM,YAAa,MAAM,IAAI,MAAM,0CAA0C;CACrF,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,WAAW,YAAY,KAAA,CAAS;EACtC,MAAM;CACR;AACF;AAEA,eAAe,6BACb,SACA,OACA,YACe;CACf,KAAK,MAAM,QAAQ,OACjB,MAAM,cAAc,SAAS,GAAG,uBAAuB,KAAK,QAAQ,KAAK,MAAM,KAAK,KAAK;CAE3F,IAAI,CAAC,YAAY;CACjB,MAAM,WAAW,wBAAwB;EACvC,MAAM;EACN,YAAY,WAAW;EACvB,UAAU,WAAW;EACrB,QAAQ;GACN,QAAQ,WAAW,OAAO;GAC1B,YAAY,WAAW,OAAO;EAChC;CACF,CAA8C;CAC9C,MAAM,cAAc,SAAS,yBAAyB,KAAO,QAAQ;CACrE,MAAM,cAAc,SAAS,uBAAuB,KAAO,WAAW,OAAO,KAAK;AACpF;AAEA,eAAe,sBACb,OACA,QACkC;CAClC,IAAI,MAAM,aAAa,OAAO,iBAC5B,MAAM,IAAI,MAAM,qDAAqD;CAEvE,MAAM,SAAS,QAAQ;CACvB,MAAM,QAA0C,CAAC;CACjD,MAAM,qCAAqB,IAAI,IAAY;CAC3C,MAAM,gCAAgB,IAAI,IAAY;CACtC,IAAI,aAAa;CACjB,IAAI,qBAAqB;CACzB,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,WAAW,YAAY;EAC3B,WAAW,MAAM,SAAS,QAAQ;GAChC,MAAM,OAAO,MAAM,OAAO;GAC1B,IACE,MAAM,OAAO,SAAS,UACtB,OAAO,SAAS,YAChB,mBAAmB,IAAI,IAAI,GAE3B,MAAM,IAAI,MAAM,mDAAmD;GAErE,mBAAmB,IAAI,IAAI;GAC3B,IAAI,KAAK,WAAW,oBAAoB,GAAG;IACzC,IAAI,MAAM,UAAU,OAAO,UACzB,MAAM,IAAI,MAAM,uDAAuD;IAEzE,MAAM,OAAO,gBAAgB,KAAK,MAAM,EAA2B,GAAG,OAAO,YAAY;IACzF,IAAI,CAAC,oBAAoB,MAAM,OAAO,IAAI,GACxC,MAAM,IAAI,MAAM,wDAAwD,MAAM;IAEhF,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,YAAY,MAAM,aAAa,OAAO,OAAO,cAAc,kBAAkB,MAAM;IACzF,sBAAsB,UAAU;IAChC,yBACE,MACA,cACA,eACA,6DACF;IACA,eAAe;IACf,IAAI,UAAU,aAAa,OAAO,oBAAoB,YACpD,MAAM,IAAI,MAAM,uDAAuD;IAEzE,cAAc,UAAU;IACxB,MAAM,KAAK;KAAE;KAAM,MAAM,MAAM,OAAO;KAAM,OAAO;IAAU,CAAC;GAChE,OAAO,IAAI,SAAS,yBAAyB;IAC3C,IAAI,MAAM,OAAO,SAAS,OAAS,oBACjC,MAAM,IAAI,MAAM,4DAA4D;IAE9E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,gBAAgB,MAAM,aAC1B,OACA,OAAO,cACP,+BACF;IACA,sBAAsB,cAAc;IACpC,qBAAqB,wBAAwB,eAAe,OAAO,wBAAwB;GAC7F,OAAO,IAAI,SAAS,uBAAuB;IACzC,IAAI,MAAM,OAAO,SAAS,OAAS,kBACjC,MAAM,IAAI,MAAM,0DAA0D;IAE5E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,mBAAmB,MAAM,aACvB,OACA,OAAO,0BACP,sBACF;IACA,sBAAsB,iBAAiB;GACzC,OACE,MAAM,IAAI,MAAM,0DAA0D,MAAM;EAEpF;EACA,IAAI,QAAQ,kBAAkB,MAAM,QAAQ,gBAAgB,GAC1D,MAAM,IAAI,MAAM,+DAA+D;EAEjF,MAAM,aACJ,sBAAsB,mBAClB,kBAAkB,oBAAoB,gBAAgB,IACtD,KAAA;EACN,OAAO;GAAE;GAAO,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EAAG;CACxD,EAAA,CAAG;CACH,OAAO,IAAI,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,CAAC;CACxE,MAAM,SAAS,MAAM;CACrB,MAAM,gCACJ,OAAO,OACP,OAAO,YACP,OACA,OAAO,eACT;CACA,OAAO;AACT;AAEA,SAAS,0BACP,cACA,oBACA,YACA,QACM;CACN,IACE,CAAC,OAAO,cAAc,UAAU,KAChC,eAAe,KAAA,KACf,aAAa,KACb,aAAa,OAAO,kBAAkB,eAAe,oBAErD,MAAM,IAAI,MAAM,oEAAoE;AAExF;AAEA,SAAS,wBACP,OACA,gBACoC;CACpC,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC5E,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,8DAA8D,EAAE,OAAO,MAAM,CAAC;CAChG;CACA,IACE,CAAC,SAAS,KAAK,KACf,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,qCACxC,MAAM,SAAS,eACf,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,aAAa,YAC1B,CAAC,SAAS,MAAM,MAAM,KACtB,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,uBAC/C,OAAO,MAAM,OAAO,WAAW,YAC/B,CAAC,wBAAwB,KAAK,MAAM,OAAO,MAAM,KACjD,CAAC,OAAO,cAAc,MAAM,OAAO,UAAU,KAC5C,MAAM,OAAO,cAAyB,KACtC,MAAM,OAAO,aAAwB,gBAEtC,MAAM,IAAI,MAAM,mDAAmD;CAErE,IAAI,CAAC,OAAO,KAAK,wBAAwB,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,KAAK,KAAK,CAAC,GACxE,MAAM,IAAI,MAAM,kEAAkE;CAEpF,kBAAkB,MAAM,YAAY,iBAAiB;CACrD,kBAAkB,MAAM,UAAU,sBAAsB;CACxD,IAAI,MAAM,WAAW,WAAW,MAAM,SAAS,QAC7C,MAAM,IAAI,MAAM,iEAAiE;CAEnF,OAAO;EACL,MAAM;EACN,YAAY,MAAM;EAClB,UAAU,MAAM;EAChB,QAAQ;GACN,QAAQ,MAAM,OAAO;GACrB,YAAY,MAAM,OAAO;EAC3B;CACF;AACF;AAEA,SAAS,kBACP,UACA,QAC4B;CAC5B,YAAY,QAAQ,SAAS,OAAO,QAAQ,SAAS,OAAO,YAAY,sBAAsB;CAC9F,OAAO;EACL,YAAY,SAAS;EACrB,UAAU,SAAS;EACnB,QAAQ;GAAE,GAAG,SAAS;GAAQ,OAAO;EAAO;CAC9C;AACF;AAEA,eAAe,cACb,SACA,MACA,MACA,OACe;CACf,MAAM,IAAI,SAAe,cAAc,gBAAgB;EACrD,QAAQ,MACN;GACE;GACA;GACA,KAAK;GACL,KAAK;GACL,MAAM,MAAM;GACZ,OAAO;GACP,MAAM;GACN,OAAO;GACP,OAAO;EACT,GACA,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,IAC3D,UAAW,QAAQ,YAAY,KAAK,IAAI,aAAa,CACxD;CACF,CAAC;AACH;AAEA,eAAe,aAAa,OAAc,UAAkB,OAAoC;CAC9F,MAAM,OAAO,MAAM,OAAO;CAC1B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,SAAS,KAAA,KAAa,OAAO,KAAK,OAAO,UAC1E,MAAM,IAAI,MAAM,GAAG,MAAM,yBAAyB;CAEpD,MAAM,QAAQ,MAAM,cAAc,OAAO,UAAU,KAAK;CACxD,IAAI,MAAM,eAAe,MAAM,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CACnF,OAAO;AACT;AAEA,eAAe,cACb,QACA,UACA,OACqB;CACrB,MAAM,SAAmB,CAAC;CAC1B,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,MAAM,aAAa,WAAW,YAAY;GAC5C,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,QAAQ,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;EAChE,OAAO,KAAK,KAAK;EACjB,cAAc,MAAM;CACtB;CACA,OAAO,OAAO,OAAO,QAAQ,UAAU;AACzC;AAEA,eAAe,kBACb,QACA,UACA,UACA,OACkB;CAClB,MAAM,iBAAiB,OAAO,KAAK,SAAS,QAAQ,SAAS,YAAY,SAAS,UAAU;CAC5F,IAAI,QAAQ;CACZ,IAAI,SAAS;CACb,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,MAAM,aAAa,WAAW,QAAQ;GACxC,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,WAAW,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU;EAC7E,IACE,SAAS,SAAS,aAAa,eAAe,cAC9C,CAAC,SAAS,OAAO,eAAe,SAAS,QAAQ,SAAS,SAAS,UAAU,CAAC,GAE9E,QAAQ;EAEV,UAAU,SAAS;CACrB;CACA,OAAO,SAAS,WAAW,eAAe;AAC5C;AAEA,eAAe,wBAAwB,aAAoC;CACzE,MAAM,MAAM,aAAa;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACzD,MAAM,QAAQ,MAAM,MAAM,WAAW;CACrC,IACE,CAAC,MAAM,YAAY,KACnB,MAAM,eAAe,KACpB,MAAM,SAAS,WAAW,MAAO,aAElC,MAAM,IAAI,MAAM,0DAA0D;CAE5E,KAAK,MAAM,QAAQ,WAAW,EAAA,CAAG,SAAS,GACxC,MAAM,IAAI,MAAM,+CAA+C;AAEnE;AAEA,eAAe,oBACb,aACA,OACe;CACf,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,cAAc,aAAa,KAAK,IAAI;EACjD,MAAM,MAAM,QAAQ,IAAI,GAAG;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC3D,MAAM,aAAa,MAAM,KACvB,MACAC,UAAY,WACVA,UAAY,UACZA,UAAY,UACX,OAAOA,UAAY,eAAe,WAAWA,UAAY,aAAa,IACzE,GACF;EACA,IAAI;GACF,MAAM,WAAW,UAAU,KAAK,KAAK;GACrC,MAAM,QAAQ,MAAM,WAAW,KAAK;GACpC,IAAI,CAAC,MAAM,OAAO,KAAK,MAAM,UAAU,GACrC,MAAM,IAAI,MAAM,4DAA4D,KAAK,MAAM;GAEzF,MAAM,WAAW,MAAM,KAAK,IAAI;EAClC,UAAU;GACR,MAAM,WAAW,MAAM;EACzB;CACF;AACF;AAEA,eAAe,sBACb,YACA,aACe;CACf,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,MAAM,UAAU,YAAY,WAAW,OAAO,OAAO;GAAE,MAAM;GAAM,MAAM;EAAM,CAAC;EAChF,MAAM,gBAAgB,aAAa;GACjC;GACA;GACA;GACA,mBAAmB,WAAW,WAAW,WAAW,KAAK,WAAW;EACtE,CAAC;EACD,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAU;EAAU,CAAC;EACnE,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAY;EAAU,CAAC;EAMrE,KAJE,MAAM,gBAAgB,aAAa;GAAC;GAAY;GAAM,WAAW;EAAU,CAAC,EAAA,CAC5E,OACC,SAAS,MAAM,CAAC,CAChB,KACU,MAAM,UAAU,MAAM,IAAI,MAAM,2CAA2C;EAMxF,KAJE,MAAM,gBAAgB,aAAa,CAAC,aAAa,GAAG,WAAW,WAAW,QAAQ,CAAC,EAAA,CACnF,OACC,SAAS,MAAM,CAAC,CAChB,KACY,MAAM,WAAW,UAC9B,MAAM,IAAI,MAAM,+CAA+C;EAEjE,MAAM,gBAAgB,aAAa;GAAC;GAAc;GAAc;GAAQ,WAAW;EAAU,CAAC;EAC9F,MAAM,gBAAgB,aAAa,CAAC,aAAa,WAAW,QAAQ,CAAC;EAMrE,KAJE,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAkB;EAAuB,CAAC,EAAA,CACxF,OACC,SAAS,MAAM,CAAC,CAChB,KACM,GAAG,MAAM,IAAI,MAAM,sDAAsD;CACpF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,SAAS,6BACP,OACA,UACM;CACN,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,gBAAgB,wBAAwB,QAAQ;CACtD,YACE,eACA,SAAS,SAAS,QAClB,SAAS,SAAS,YAClB,8BACF;CACA,IACED,2BAAyB,QAAQ,MAAM,SAAS,UAChD,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,OAAO,OAAO,KAAK,wBAAwB,SAAS,QAAQ,CAAC,CAAC,GAE1F,MAAM,IAAI,MAAM,kEAAkE;AAEtF;AAEA,SAAS,iCACP,OACA,QACM;CACN,IAAI,MAAM,SAAS,OAAO,UACxB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,IAAI;CACJ,MAAM,gCAAgB,IAAI,IAAY;CACtC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,gBAAgB,KAAK,MAAM,OAAO,YAAY;EAC3D,yBACE,MACA,cACA,eACA,qDACF;EACA,eAAe;EACf,IAAI,CAAC,oBAAoB,KAAK,IAAI,GAChC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,KAAK,MAAM,aAAa,OAAO,cACjC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,cAAc,KAAK,MAAM;EACzB,IAAI,aAAa,OAAO,mBACtB,MAAM,IAAI,MAAM,+CAA+C;CAEnE;AACF;AAEA,SAAS,wBACP,OACA,QACuC;CACvC,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,MAAM,4CAA4C;CAE9D,MAAM,YAAY,MAAM;CACxB,IAAI,YAAY,OAAO,UACrB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,MAAM,QAA+C,CAAC;CACtD,KAAK,IAAI,QAAQ,GAAG,QAAQ,WAAW,SAAS;EAC9C,MAAM,YAAY,MAAM;EACxB,IAAI,CAAC,SAAS,SAAS,KAAK,OAAO,KAAK,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,mBACtE,MAAM,IAAI,MAAM,4BAA4B,MAAM,YAAY;EAEhE,MAAM,cAAc,OAAO,0BAA0B,SAAS;EAC9D,IACE,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,SAAS,CAAC,KAEpC,MAAM,IAAI,MAAM,4BAA4B,MAAM,uBAAuB;EAE3E,MAAM,OAAO,gBAAgB,YAAY,MAAM,OAAO,OAAO,YAAY;EACzE,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,aAAa,YAAY,OAAO;EACtC,IAAI,CAAC,oBAAoB,IAAI,GAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,MAAM,OAAO,sBAAsB,YAAY,IAAI;EACnD,IAAI,KAAK,aAAa,OAAO,cAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,KAAK,aAAa,OAAO,oBAAoB,YAC/C,MAAM,IAAI,MAAM,+CAA+C;EAEjE,IAAI,KAAK,aAAa,KAAK,IAAI,GAAG,OAAO,kBAAkB,IAAI,GAC7D,MAAM,IAAI,MAAM,qDAAqD;EAEvE,cAAc,KAAK;EACnB,MAAM,KAAK;GAAE;GAAM;GAAM,OAAO,qBAAqB,IAAI;EAAE,CAAC;CAC9D;CACA,MAAM,MAAM,MAAM,UAAW,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,CAAE;CAC1F,iCAAiC,OAAO,MAAM;CAC9C,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAiC;CAC5D,OAAO,OAAO,cAAc,KAAK,KAAM,SAAoB,KAAM,SAAoB;AACvF;AAEA,SAAS,gBACP,WACsC;CACtC,MAAM,SAAS;EAAE,GAAG;EAAe,GAAG;CAAU;CAChD,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAC/C,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAC3C,MAAM,IAAI,MAAM,uBAAuB,KAAK,iCAAiC;CAGjF,OAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAS,gBAAgB,OAAgB,cAA8B;CACrE,IACE,OAAO,UAAU,YACjB,CAAC,SACD,CAAC,oBAAoB,KAAK,KAC1B,OAAO,WAAW,OAAO,MAAM,IAAI,gBACnC,WAAW,KAAK,KAChB,MAAM,WAAW,KAAK,KACtB,MAAM,SAAS,IAAI,KACnB,MAAM,SAAS,IAAI,KACnB,oBAAoB,KAAK,KACzB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,KACtE,CAAC,QAAQ,UAAU,CAAC,CAAC,SAAS,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,YAAY,KAAK,EAAE,GAEtE,MAAM,IAAI,MAAM,wDAAwD,OAAO,KAAK,GAAG;CAEzF,OAAO;AACT;AAEA,SAAS,yBACP,MACA,cACA,eACA,cACM;CACN,IAAI,iBAAiB,KAAA,KAAa,gBAAgB,MAAM,MAAM,IAAI,MAAM,YAAY;CACpF,KAAK,IAAI,QAAQ,KAAK,QAAQ,GAAG,GAAG,UAAU,IAAI,QAAQ,KAAK,QAAQ,KAAK,QAAQ,CAAC,GACnF,IAAI,cAAc,IAAI,KAAK,MAAM,GAAG,KAAK,CAAC,GAAG,MAAM,IAAI,MAAM,YAAY;CAE3E,cAAc,IAAI,IAAI;AACxB;AAEA,SAAS,sBACP,OACA,MACiE;CACjE,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,SAAS,uBAAuB,KAAK,KAAmB;EACxD,aAAa,2BAA2B,KAAK,KAAmB;EAChE,aAAa,2BAA2B,KAAK,KAAmB;CAClE,QAAQ;EACN,MAAM,IAAI,MAAM,+CAA+C,MAAM;CACvE;CACA,IAAI,oBAAoB,MAAM,GAC5B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,IAAI,CAAC,iBAAiB,MAAM,GAC1B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,OAAO;EAAE;EAAQ;EAAY;CAAW;AAC1C;AAEA,SAAS,qBAAqB,OAIf;CACb,MAAM,EAAE,QAAQ,YAAY,eAAe;CAC3C,MAAM,OAAO,IAAI,WAAW,UAAU;CACtC,WAAW,UAAU,IAAI,KAAK,MAAM,IAAI,WAAW,QAAQ,YAAY,UAAU,CAAC;CAClF,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,QAAQ,SAAU,QAAQ,OAAQ;GACpC,MAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;GACvC,IAAI,EAAE,QAAQ,SAAU,QAAQ,QAAS,OAAO;GAChD;EACF,OAAO,IAAI,QAAQ,SAAU,QAAQ,OACnC,OAAO;CAEX;CACA,OAAO;AACT;AAEA,SAAS,cAAc,MAAc,cAA8B;CACjE,MAAM,OAAO,QAAQ,MAAM,YAAY;CACvC,IAAI,CAAC,KAAK,WAAW,GAAG,OAAO,KAAK,GAClC,MAAM,IAAI,MAAM,6DAA6D,cAAc;CAE7F,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAe,OAAqB;CAC7D,IAAI,CAAC,kCAAkC,KAAK,KAAK,GAC/C,MAAM,IAAI,MAAM,wBAAwB,MAAM,wBAAwB;AAE1E;AAEA,SAAS,oBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,OAAO,MAAQ,SAAS,KAAM,OAAO;CAC3C;CACA,OAAO;AACT;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAIA,SAAS,wBAAwB,MAAgE;CAC/F,MAAM,sBAAsB,OAAO,eAAe,WAAW,SAAS;CACtE,MAAM,SAAS,OAAO,yBAAyB,qBAAqB,IAAI,CAAC,EAAE;CAC3E,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,yBAAyB,KAAK,yBAAyB;CACpF,OAAO;AACT;AAEA,MAAM,yBAAyB,wBAAwB,QAAQ;AAC/D,MAAM,6BAA6B,wBAAwB,YAAY;AACvE,MAAM,6BAA6B,wBAAwB,YAAY"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-runtime",
-  "version": "0.116.0",
+  "version": "0.117.0",
   "description": "Shared task-lifecycle skeleton for agents: a recursive loop kernel for chat turns, one-shot tasks, and multi-attempt loops, with trace capture and eval-gated self-improvement. Domain behavior lives in adapters; scoring and ship-gates in @tangle-network/agent-eval.",
   "homepage": "https://github.com/tangle-network/agent-runtime#readme",
   "repository": {

package/dist/environment-provider-CCaEhA-l.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"environment-provider-CCaEhA-l.js","names":[],"sources":["../src/runtime/sandbox-backend.ts","../src/runtime/tangle-sandbox-exact-process-provider.ts","../src/runtime/environment-provider.ts"],"sourcesContent":["/**\n *\n * Backend-options assembly shared by the loop kernel's `createSandboxForSpec`\n * and the sandbox planner's box creation, so the worker box and the planner box\n * boot identically. Builds the options only — the acquire path (cold-start\n * recovery) lives in the kernel, the planner calls `client.create` directly.\n *\n * @experimental\n */\n\nimport type { AgentProfile, HarnessType } from '@tangle-network/agent-interface'\nimport type { CreateSandboxOptions } from '@tangle-network/sandbox'\n\ntype BackendType = NonNullable<CreateSandboxOptions['backend']>['type']\ntype BackendOverride = NonNullable<CreateSandboxOptions['backend']>\n\n/** The AgentProfile type as @tangle-network/sandbox declares it — compiled\n *  against agent-interface 0.36, not this package's 0.40. */\nexport type SandboxAgentProfile = NonNullable<BackendOverride['profile']>\n\n/**\n * Version-skew boundary: sandbox 0.15.2 types profiles against interface 0.36\n * (MCP `args`/`env`/`headers` as plain strings), while this runtime is on 0.40\n * (`AgentProfileConfigValue` objects). No published sandbox release is typed\n * against 0.40 yet, and the profile crosses this boundary as data — the values\n * are forwarded, not reinterpreted — so the only conversion is the nominal type\n * hop. This is the ONE sanctioned cast for that skew; remove both adapters when\n * sandbox releases against interface 0.40.\n */\nexport function profileAsSandboxProfile(profile: AgentProfile): SandboxAgentProfile {\n  return profile as unknown as SandboxAgentProfile\n}\n\n/** Reverse hop of the same skew boundary — see `profileAsSandboxProfile`. */\nexport function sandboxProfileAsProfile(profile: SandboxAgentProfile): AgentProfile {\n  return profile as unknown as AgentProfile\n}\n\n/**\n * Harnesses the sandbox accepts as a `backend.type`. `gemini` is a\n * `HarnessType` with no sandbox backend, so it is absent here and a profile\n * declaring it cannot run through this path.\n *\n * The double `satisfies` pins both directions: an entry the sandbox drops stops\n * compiling, and an entry that is not a harness stops compiling.\n */\nconst harnessBackends = [\n  'claude-code',\n  'nanoclaw',\n  'codex',\n  'opencode',\n  'kimi-code',\n  'pi',\n  'hermes',\n  'openclaw',\n  'amp',\n  'factory-droids',\n  'acp',\n  'cli-base',\n] as const satisfies readonly HarnessType[] satisfies readonly BackendType[]\n\nfunction harnessAsBackendType(harness: HarnessType): BackendType | undefined {\n  return (harnessBackends as readonly string[]).includes(harness)\n    ? (harness as BackendType)\n    : undefined\n}\n\n/**\n * Resolve the backend `type`: an explicit override wins, then the profile's\n * `metadata.backendType` hint, then the profile's declared `harness`, else the\n * SDK's profile-driven default (`'opencode'` on the platform side).\n *\n * A declared `harness` the sandbox cannot run throws rather than falling\n * through: silently running a `gemini` profile on opencode returns a result\n * that means something other than it appears to, which is worse than no result.\n */\nfunction resolveBackendType(\n  profile: AgentProfile,\n  override: Partial<BackendOverride> | undefined,\n): BackendType {\n  if (override?.type) return override.type\n  const explicit = profile.metadata?.backendType\n  if (typeof explicit === 'string') return explicit as BackendType\n  const declared = profile.harness\n  if (declared !== undefined) {\n    const backend = harnessAsBackendType(declared)\n    if (backend === undefined) {\n      throw new Error(\n        `buildBackendOptions: profile declares harness \"${declared}\", which the sandbox has no backend for. ` +\n          `Runnable harnesses: ${harnessBackends.join(', ')}. ` +\n          'Set metadata.backendType to run it on a different backend deliberately.',\n      )\n    }\n    return backend\n  }\n  return 'opencode' as BackendType\n}\n\n/**\n * Build `CreateSandboxOptions` for `profile`, merging `overrides` and setting\n * `backend.profile`. `model`/`server` from an override backend pass through.\n */\nexport function buildBackendOptions(\n  profile: AgentProfile,\n  overrides: Partial<CreateSandboxOptions> | undefined,\n): CreateSandboxOptions {\n  const base = overrides ?? {}\n  const overrideBackend = base.backend\n  return {\n    ...base,\n    backend: {\n      type: resolveBackendType(profile, overrideBackend),\n      profile: profileAsSandboxProfile(profile),\n      ...(overrideBackend?.model ? { model: overrideBackend.model } : {}),\n      ...(overrideBackend?.server ? { server: overrideBackend.server } : {}),\n    },\n  }\n}\n","import { isDeepStrictEqual } from 'node:util'\n\nimport type { AgentCandidateTermination } from '@tangle-network/agent-interface'\nimport type {\n  AgentEnvironmentCapabilities,\n  AgentEnvironmentProvider,\n  AgentExactProcess,\n  AgentExactProcessEnvironment,\n  AgentExactProcessEnvironmentQuery,\n  AgentExactProcessProvider,\n  AgentExactProcessStatus,\n  CreateAgentExactProcessEnvironmentInput,\n} from '@tangle-network/agent-interface/environment-provider'\nimport type {\n  Process,\n  ProcessStatus,\n  Sandbox,\n  SandboxInstance,\n  SandboxResources,\n} from '@tangle-network/sandbox'\n\nexport type SandboxControlClient = Pick<Sandbox, 'create' | 'get' | 'list'>\n\ntype ExactSandboxEgressPolicy =\n  | { mode: 'blocked' }\n  | { mode: 'strict'; allowDomains: string[]; includeImplicitDomains: false }\n\nexport interface CreateTangleSandboxExactProcessProviderOptions {\n  name?: string\n}\n\nconst exactProcessProviderMarker = 'agent-runtime.exact-process-provider'\nconst exactProcessEgressMarker = 'agent-runtime.exact-process-egress'\n\n/**\n * Adapt Tangle Sandbox's managed control runtime to Runtime's exact-process provider.\n *\n * The adapter deliberately exposes no ordinary agent environment: an exact experiment\n * must start a fresh Sandbox with no managed agent and launch its declared argv directly.\n */\nexport function createTangleSandboxExactProcessProvider(\n  client: SandboxControlClient,\n  options: CreateTangleSandboxExactProcessProviderOptions = {},\n): AgentEnvironmentProvider {\n  const name = options.name ?? 'tangle-sandbox-exact-process'\n  if (!name.trim()) throw new Error('Tangle Sandbox exact-process provider name must not be empty')\n\n  const exactProcess: AgentExactProcessProvider = {\n    async create(input: CreateAgentExactProcessEnvironmentInput) {\n      throwIfAborted(input.signal)\n      assertNoProviderOptions(input.providerOptions)\n      const egressPolicy = sandboxEgressPolicy(input.egress)\n      const metadata = exactMetadata(input.metadata, name, egressPolicy)\n      const sandbox = await client.create(\n        {\n          environment: requiredText(input.image, 'exact-process image'),\n          agent: false,\n          bare: false,\n          ephemeral: true,\n          egressPolicy,\n          resources: sandboxResources(input),\n          maxLifetimeSeconds: sandboxLifetimeSeconds(input.maxLifetimeMs),\n          metadata,\n          idempotencyKey: requiredText(input.idempotencyKey, 'exact-process idempotency key'),\n        },\n        {\n          ...(input.provisionTimeoutMs === undefined\n            ? {}\n            : { timeoutMs: positiveInteger(input.provisionTimeoutMs, 'provision timeout') }),\n          ...(input.signal === undefined ? {} : { signal: input.signal }),\n        },\n      )\n      try {\n        throwIfAborted(input.signal)\n        assertExactSandboxMetadata(sandbox, metadata)\n        await assertExactSandboxEgress(sandbox, egressPolicy)\n      } catch (error) {\n        await discardInvalidSandbox(sandbox, error)\n      }\n      return sandboxAsExactProcessEnvironment(sandbox, name)\n    },\n    async get(id: string) {\n      const sandbox = await client.get(id)\n      if (!sandbox || !isExactSandbox(sandbox, name)) return null\n      await assertExactSandboxEgress(sandbox, egressFromMetadata(sandbox.metadata))\n      return sandboxAsExactProcessEnvironment(sandbox, name)\n    },\n    async list(query?: AgentExactProcessEnvironmentQuery) {\n      assertNoProviderOptions(query?.providerOptions)\n      const sandboxes = await client.list()\n      return Promise.all(\n        sandboxes\n          .filter((sandbox) => isExactSandbox(sandbox, name))\n          .filter((sandbox) => metadataMatches(sandbox.metadata, query?.metadata))\n          .map(async (sandbox) => {\n            await assertExactSandboxEgress(sandbox, egressFromMetadata(sandbox.metadata))\n            return sandboxAsExactProcessEnvironment(sandbox, name)\n          }),\n      )\n    },\n  }\n\n  return {\n    name,\n    exactProcess,\n    capabilities: exactProcessOnlyCapabilities,\n    async create() {\n      throw new Error(`agent environment provider \"${name}\" supports exactProcess.create() only`)\n    },\n  }\n}\n\nfunction sandboxAsExactProcessEnvironment(\n  sandbox: SandboxInstance,\n  provider: string,\n): AgentExactProcessEnvironment {\n  return {\n    id: requiredText(sandbox.id, 'Sandbox id'),\n    provider,\n    ...(sandbox.metadata ? { metadata: sandbox.metadata } : {}),\n    process: {\n      async list(): Promise<AgentExactProcessStatus[]> {\n        return (await sandbox.process.list()).map((status) => exactProcessStatus(status))\n      },\n      async get(pid: number): Promise<AgentExactProcess | null> {\n        const process = await sandbox.process.get(pid)\n        return process ? sandboxProcessAsExactProcess(process) : null\n      },\n      async spawn(input, options): Promise<AgentExactProcess> {\n        const process = await afterAbortCheck(options?.signal, () =>\n          sandbox.process.spawnExact(input.executable, [...input.args], {\n            cwd: input.cwd,\n            env: { ...input.env },\n            inheritEnv: false,\n            ...(input.stdin === undefined ? {} : { stdin: input.stdin }),\n            timeoutMs: input.timeoutMs,\n          }),\n        )\n        return sandboxProcessAsExactProcess(process)\n      },\n    },\n    async writeFile(path, bytes, options): Promise<void> {\n      if (sandbox.fs.supportsWriteMode !== true) {\n        throw new Error('Tangle Sandbox does not declare exact file-mode support')\n      }\n      await afterAbortCheck(options.signal, () =>\n        sandbox.fs.write(path, Buffer.from(bytes).toString('base64'), {\n          encoding: 'base64',\n          mode: fileMode(options.mode),\n        }),\n      )\n    },\n    async readFile(path, options): Promise<Uint8Array> {\n      const maxBytes = nonnegativeInteger(options.maxBytes, 'exact-process file read maximum')\n      const initialSize = nonnegativeInteger(\n        (await afterAbortCheck(options.signal, () => sandbox.fs.stat(path))).size,\n        `Tangle Sandbox file size for \"${path}\"`,\n      )\n      if (initialSize > maxBytes) {\n        throw new Error(\n          `Tangle Sandbox file \"${path}\" exceeds the ${maxBytes}-byte exact read maximum`,\n        )\n      }\n      const result = await afterAbortCheck(options.signal, () =>\n        sandbox.fs.readBatch([path], { encoding: 'base64' }),\n      )\n      const failure = result.errors.find((entry) => entry.path === path)\n      if (failure) {\n        throw new Error(`Tangle Sandbox failed to read \"${path}\": ${failure.error}`)\n      }\n      const files = result.files.filter((entry) => entry.path === path)\n      if (files.length !== 1) {\n        throw new Error(`Tangle Sandbox returned ${files.length} files for exact read \"${path}\"`)\n      }\n      const file = files[0]!\n      if (file.encoding !== 'base64') {\n        throw new Error(`Tangle Sandbox returned non-binary content for exact read \"${path}\"`)\n      }\n      const size = nonnegativeInteger(file.size, `Tangle Sandbox file size for \"${path}\"`)\n      if (size !== initialSize) {\n        throw new Error(`Tangle Sandbox file \"${path}\" changed during exact read`)\n      }\n      if (size > maxBytes) {\n        throw new Error(\n          `Tangle Sandbox file \"${path}\" exceeds the ${maxBytes}-byte exact read maximum`,\n        )\n      }\n      const bytes = Buffer.from(file.content, 'base64')\n      if (bytes.byteLength !== size || bytes.toString('base64') !== file.content) {\n        throw new Error(\n          `Tangle Sandbox returned an invalid binary payload for exact read \"${path}\"`,\n        )\n      }\n      return Uint8Array.from(bytes)\n    },\n    async destroy(): Promise<void> {\n      await sandbox.delete()\n    },\n  }\n}\n\nfunction sandboxProcessAsExactProcess(process: Process): AgentExactProcess {\n  const pid = positiveInteger(process.pid, 'Tangle Sandbox process pid')\n  return {\n    pid,\n    async status(): Promise<AgentExactProcessStatus> {\n      return exactProcessStatus(await process.status(), pid)\n    },\n    async wait(): Promise<AgentCandidateTermination> {\n      const waitExitCode = await process.wait()\n      if (!Number.isSafeInteger(waitExitCode)) {\n        throw new Error('Tangle Sandbox process wait returned an invalid exit code')\n      }\n      const status = exactProcessStatus(await process.status(), pid)\n      if (status.running || !status.termination) {\n        throw new Error('Tangle Sandbox process wait returned before terminal status')\n      }\n      if (status.termination.kind === 'exit' && status.termination.exitCode !== waitExitCode) {\n        throw new Error('Tangle Sandbox process wait and status disagree on exit code')\n      }\n      return status.termination\n    },\n    async kill(): Promise<void> {\n      await process.kill('SIGKILL', { tree: true })\n    },\n    async *stdout(): AsyncIterable<string> {\n      yield* process.stdout()\n    },\n    async *stderr(): AsyncIterable<string> {\n      yield* process.stderr()\n    },\n  }\n}\n\nfunction exactProcessStatus(status: ProcessStatus, expectedPid?: number): AgentExactProcessStatus {\n  const pid = positiveInteger(status.pid, 'Tangle Sandbox process pid')\n  if (expectedPid !== undefined && pid !== expectedPid) {\n    throw new Error('Tangle Sandbox process status changed process identity')\n  }\n  if (typeof status.running !== 'boolean') {\n    throw new Error('Tangle Sandbox process status is missing running state')\n  }\n  if (!Number.isSafeInteger(status.exitCode)) {\n    throw new Error('Tangle Sandbox process status is missing an integer exit code')\n  }\n  const exitSignal = optionalText(status.exitSignal, 'Tangle Sandbox process exit signal')\n  if (status.running) {\n    if (status.exitCode !== -1) {\n      throw new Error('Tangle Sandbox running process must report exit code -1')\n    }\n    if (exitSignal) {\n      throw new Error('Tangle Sandbox running process must not report an exit signal')\n    }\n    return {\n      pid,\n      running: true,\n      exitCode: -1,\n    }\n  }\n  const termination = exitSignal\n    ? ({ kind: 'signal', signal: exitSignal } as const)\n    : status.exitCode >= 0\n      ? ({ kind: 'exit', exitCode: status.exitCode } as const)\n      : undefined\n  if (!termination) {\n    throw new Error('Tangle Sandbox stopped process has no terminal reason')\n  }\n  return {\n    pid,\n    running: false,\n    exitCode: status.exitCode,\n    ...(exitSignal ? { exitSignal } : {}),\n    termination,\n  }\n}\n\nfunction exactMetadata(\n  metadata: Record<string, unknown>,\n  provider: string,\n  egressPolicy: ExactSandboxEgressPolicy,\n): Record<string, unknown> {\n  for (const marker of [exactProcessProviderMarker, exactProcessEgressMarker]) {\n    if (Object.hasOwn(metadata, marker)) {\n      throw new Error(`exact-process metadata must not set \"${marker}\"`)\n    }\n  }\n  return {\n    ...metadata,\n    [exactProcessProviderMarker]: provider,\n    [exactProcessEgressMarker]: serializeEgressPolicy(egressPolicy),\n  }\n}\n\nfunction isExactSandbox(sandbox: SandboxInstance, provider: string): boolean {\n  return sandbox.metadata?.[exactProcessProviderMarker] === provider\n}\n\nfunction metadataMatches(\n  metadata: Record<string, unknown> | undefined,\n  expected: Record<string, unknown> | undefined,\n): boolean {\n  return (\n    expected === undefined ||\n    Object.entries(expected).every(([key, value]) => isDeepStrictEqual(metadata?.[key], value))\n  )\n}\n\nfunction assertExactSandboxMetadata(\n  sandbox: SandboxInstance,\n  expected: Record<string, unknown>,\n): void {\n  if (!metadataMatches(sandbox.metadata, expected)) {\n    throw new Error('Tangle Sandbox did not persist exact-process metadata')\n  }\n}\n\nfunction egressFromMetadata(\n  metadata: Record<string, unknown> | undefined,\n): ExactSandboxEgressPolicy {\n  const encoded = metadata?.[exactProcessEgressMarker]\n  if (typeof encoded !== 'string') {\n    throw new Error('Tangle Sandbox exact-process environment is missing egress metadata')\n  }\n  try {\n    const parsed: unknown = JSON.parse(encoded)\n    if (!parsed || typeof parsed !== 'object') throw new Error('expected egress object')\n    const policy = parsed as {\n      mode?: unknown\n      allowDomains?: unknown\n      includeImplicitDomains?: unknown\n    }\n    if (policy.mode === 'blocked' && policy.allowDomains === undefined) return { mode: 'blocked' }\n    if (\n      policy.mode === 'strict' &&\n      policy.includeImplicitDomains === false &&\n      Array.isArray(policy.allowDomains) &&\n      policy.allowDomains.every((domain): domain is string => typeof domain === 'string')\n    ) {\n      const allowDomains = sortedDomains(policy.allowDomains)\n      if (new Set(allowDomains).size === allowDomains.length) {\n        return { mode: 'strict', allowDomains, includeImplicitDomains: false }\n      }\n    }\n  } catch {\n    throw new Error('Tangle Sandbox exact-process environment has invalid egress metadata')\n  }\n  throw new Error('Tangle Sandbox exact-process environment has invalid egress metadata')\n}\n\nasync function assertExactSandboxEgress(\n  sandbox: SandboxInstance,\n  expected: ExactSandboxEgressPolicy,\n): Promise<void> {\n  const actual = (await sandbox.egress.get()).policy\n  if (actual.mode !== expected.mode) {\n    throw new Error(\n      `Tangle Sandbox egress mismatch: expected ${expected.mode}, received ${actual.mode}`,\n    )\n  }\n  if (expected.mode === 'blocked') {\n    const allowDomains = (actual as { allowDomains?: unknown }).allowDomains\n    if (\n      actual.mode === 'blocked' &&\n      (allowDomains === undefined || (Array.isArray(allowDomains) && allowDomains.length === 0))\n    ) {\n      return\n    }\n    throw new Error('Tangle Sandbox blocked egress retained an allowlist')\n  }\n  if (actual.mode !== 'strict') {\n    throw new Error('Tangle Sandbox did not return strict egress policy')\n  }\n  const expectedDomains = sortedDomains(expected.allowDomains)\n  const actualDomains = sortedDomains(actual.allowDomains ?? [])\n  if (!isDeepStrictEqual(actualDomains, expectedDomains)) {\n    throw new Error('Tangle Sandbox strict egress differs from the exact allowlist')\n  }\n  if (actual.includeImplicitDomains !== false) {\n    throw new Error('Tangle Sandbox strict egress retained implicit domains')\n  }\n}\n\nfunction sandboxEgressPolicy(\n  input: CreateAgentExactProcessEnvironmentInput['egress'],\n): ExactSandboxEgressPolicy {\n  if (input.mode === 'blocked') return { mode: 'blocked' }\n  const allowDomains = input.allowDomains.map((domain) =>\n    requiredText(domain, 'strict egress domain'),\n  )\n  if (new Set(allowDomains).size !== allowDomains.length) {\n    throw new Error('strict egress domains must not contain duplicates')\n  }\n  return { mode: 'strict', allowDomains, includeImplicitDomains: false }\n}\n\nfunction serializeEgressPolicy(policy: ExactSandboxEgressPolicy): string {\n  return JSON.stringify(\n    policy.mode === 'blocked'\n      ? { mode: 'blocked' }\n      : {\n          mode: 'strict',\n          allowDomains: sortedDomains(policy.allowDomains),\n          includeImplicitDomains: false,\n        },\n  )\n}\n\nfunction sandboxResources(input: CreateAgentExactProcessEnvironmentInput): SandboxResources {\n  const cpuCores = positiveNumber(input.resources.cpu, 'exact-process cpu')\n  const memoryMB = positiveInteger(input.resources.memoryMb, 'exact-process memory')\n  const diskMb = positiveInteger(input.resources.diskMb, 'exact-process disk')\n  if (diskMb % 1024 !== 0) {\n    throw new Error('Tangle Sandbox exact-process disk must be a whole GiB')\n  }\n  return { cpuCores, memoryMB, diskGB: diskMb / 1024 }\n}\n\nfunction sandboxLifetimeSeconds(maxLifetimeMs: number): number {\n  const milliseconds = positiveInteger(maxLifetimeMs, 'exact-process maximum lifetime')\n  if (milliseconds % 1_000 !== 0) {\n    throw new Error(\n      'Tangle Sandbox exact-process maximum lifetime must be a whole number of seconds',\n    )\n  }\n  return milliseconds / 1_000\n}\n\nfunction fileMode(value: number): number {\n  const mode = nonnegativeInteger(value, 'exact-process file mode')\n  if (mode > 0o7777) throw new Error('exact-process file mode exceeds POSIX mode bits')\n  return mode\n}\n\nfunction assertNoProviderOptions(providerOptions: Record<string, unknown> | undefined): void {\n  if (providerOptions && Object.keys(providerOptions).length > 0) {\n    throw new Error('Tangle Sandbox exact-process provider does not accept providerOptions')\n  }\n}\n\nfunction exactProcessOnlyCapabilities(): AgentEnvironmentCapabilities {\n  return {\n    profile: {\n      namedProfiles: false,\n      systemPrompt: false,\n      instructions: false,\n      tools: false,\n      permissions: false,\n      mcp: false,\n      subagents: false,\n      resources: {\n        files: false,\n        instructions: false,\n        tools: false,\n        skills: false,\n        agents: false,\n        commands: false,\n      },\n      hooks: false,\n      modes: false,\n      runtimeUpdate: false,\n      validation: false,\n    },\n    streaming: { live: false, replay: false, detach: false, turnIdempotency: false },\n    sessions: { continue: false, list: false, messages: false },\n    workspace: {\n      read: false,\n      write: false,\n      exec: false,\n      git: false,\n      upload: false,\n      download: false,\n    },\n    branching: { checkpoint: false, fork: false },\n    placement: false,\n    usage: false,\n    confidential: false,\n    exactProcess: { egress: ['blocked', 'strict'] },\n  }\n}\n\nasync function discardInvalidSandbox(sandbox: SandboxInstance, cause: unknown): Promise<never> {\n  try {\n    await sandbox.delete()\n  } catch (destroyError) {\n    throw new AggregateError(\n      [cause, destroyError],\n      'Tangle Sandbox exact-process creation failed and cleanup failed',\n    )\n  }\n  throw cause\n}\n\nfunction sortedDomains(domains: readonly string[]): string[] {\n  return [...domains].sort((left, right) => left.localeCompare(right))\n}\n\nfunction requiredText(value: string, label: string): string {\n  if (typeof value !== 'string' || !value.trim())\n    throw new Error(`${label} must be a non-empty string`)\n  return value\n}\n\nfunction optionalText(value: string | undefined, label: string): string | undefined {\n  if (value === undefined) return undefined\n  return requiredText(value, label)\n}\n\nfunction positiveNumber(value: number, label: string): number {\n  if (!Number.isFinite(value) || value <= 0) throw new Error(`${label} must be positive`)\n  return value\n}\n\nfunction positiveInteger(value: number, label: string): number {\n  if (!Number.isSafeInteger(value) || value < 1)\n    throw new Error(`${label} must be a positive integer`)\n  return value\n}\n\nfunction nonnegativeInteger(value: number, label: string): number {\n  if (!Number.isSafeInteger(value) || value < 0)\n    throw new Error(`${label} must be a non-negative integer`)\n  return value\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  signal?.throwIfAborted()\n}\n\nasync function afterAbortCheck<T>(\n  signal: AbortSignal | undefined,\n  operation: () => Promise<T>,\n): Promise<T> {\n  throwIfAborted(signal)\n  const result = await operation()\n  throwIfAborted(signal)\n  return result\n}\n","import type {\n  AgentProfile,\n  AgentProfileValidationResult,\n  InputPart,\n  TokenUsage,\n} from '@tangle-network/agent-interface'\nimport type {\n  AgentEnvironment,\n  AgentEnvironmentCapabilities,\n  AgentEnvironmentEvent,\n  AgentEnvironmentProvider,\n  AgentEnvironmentQuery,\n  AgentEnvironmentStatus,\n  AgentEnvironmentSummary,\n  AgentProfileRef,\n  AgentSession,\n  AgentSessionRef,\n  AgentSessionStatus,\n  AgentTurnInput,\n  AgentTurnResult,\n  CheckpointRef,\n  CheckpointRequest,\n  CreateAgentEnvironmentInput,\n  ExecRequest,\n  ExecResult,\n  ForkRequest,\n  PlacementInfo,\n  ResourceRequest,\n} from '@tangle-network/agent-interface/environment-provider'\nimport type {\n  BackendType,\n  CreateSandboxOptions,\n  PromptInputPart,\n  PromptOptions,\n  PromptResult,\n  SandboxEvent,\n  ExecResult as SandboxExecResult,\n  SandboxInstance,\n} from '@tangle-network/sandbox'\nimport { profileAsSandboxProfile, sandboxProfileAsProfile } from './sandbox-backend'\nimport type {\n  Executor,\n  ExecutorContext,\n  ExecutorFactory,\n  ExecutorResult,\n  Runtime,\n  Spend,\n  UsageEvent,\n} from './supervise/types'\nimport type { LoopSandboxPlacement, SandboxClient } from './types'\nimport { zeroTokenUsage } from './util'\n\n// Keep this file loadable from the lean `./environment-provider` export without agent-eval installed.\nclass ValidationError extends Error {\n  constructor(message: string, options?: { cause?: unknown }) {\n    super(message, options)\n    this.name = 'ValidationError'\n  }\n}\n\nexport type {\n  AgentEnvironment,\n  AgentEnvironmentCapabilities,\n  AgentEnvironmentEvent,\n  AgentEnvironmentProvider,\n  AgentEnvironmentQuery,\n  AgentEnvironmentStatus,\n  AgentEnvironmentSummary,\n  AgentProfileRef,\n  AgentSession,\n  AgentSessionRef,\n  AgentSessionStatus,\n  AgentTurnInput,\n  AgentTurnResult,\n  CheckpointRef,\n  CheckpointRequest,\n  CreateAgentEnvironmentInput,\n  ExecRequest,\n  ExecResult,\n  ForkRequest,\n  PlacementInfo,\n  ResourceRequest,\n  WorkspaceRequest,\n} from '@tangle-network/agent-interface/environment-provider'\n\nexport {\n  type CreateTangleSandboxExactProcessProviderOptions,\n  createTangleSandboxExactProcessProvider,\n} from './tangle-sandbox-exact-process-provider'\n\n/** Provider object or registry name accepted by runtime provider adapters.\n * @experimental */\nexport type AgentEnvironmentProviderRef = AgentEnvironmentProvider | string\n\n/** In-memory registry for named `AgentEnvironmentProvider` instances.\n * @experimental */\nexport interface AgentEnvironmentProviderRegistry {\n  register(provider: AgentEnvironmentProvider, options?: { replace?: boolean }): void\n  has(name: string): boolean\n  get(name: string): AgentEnvironmentProvider | undefined\n  require(name: string): AgentEnvironmentProvider\n  names(): string[]\n  providers(): AgentEnvironmentProvider[]\n  capabilities(name: string): Promise<AgentEnvironmentCapabilities>\n}\n\n/** Create a registry that resolves provider names to concrete provider instances.\n * @experimental */\nexport function createAgentEnvironmentProviderRegistry(\n  providers: Iterable<AgentEnvironmentProvider> = [],\n): AgentEnvironmentProviderRegistry {\n  const entries = new Map<string, AgentEnvironmentProvider>()\n\n  const registry: AgentEnvironmentProviderRegistry = {\n    register(provider, options = {}): void {\n      if (!provider.name) {\n        throw new ValidationError('agent environment provider registry: provider.name required')\n      }\n      if (!options.replace && entries.has(provider.name)) {\n        throw new ValidationError(\n          `agent environment provider registry: provider \"${provider.name}\" already registered`,\n        )\n      }\n      entries.set(provider.name, provider)\n    },\n    has(name): boolean {\n      return entries.has(name)\n    },\n    get(name): AgentEnvironmentProvider | undefined {\n      return entries.get(name)\n    },\n    require(name): AgentEnvironmentProvider {\n      const provider = entries.get(name)\n      if (!provider) {\n        const available = Array.from(entries.keys()).sort()\n        const suffix = available.length > 0 ? `; available: ${available.join(', ')}` : ''\n        throw new ValidationError(\n          `agent environment provider registry: provider \"${name}\" is not registered${suffix}`,\n        )\n      }\n      return provider\n    },\n    names(): string[] {\n      return Array.from(entries.keys()).sort()\n    },\n    providers(): AgentEnvironmentProvider[] {\n      return registry.names().map((name) => registry.require(name))\n    },\n    async capabilities(name): Promise<AgentEnvironmentCapabilities> {\n      return registry.require(name).capabilities()\n    },\n  }\n\n  for (const provider of providers) registry.register(provider)\n  return registry\n}\n\n/** Resolve a provider instance or registry name, failing loudly when a name is unknown.\n * @experimental */\nexport function resolveAgentEnvironmentProvider(\n  provider: AgentEnvironmentProviderRef,\n  registry?: AgentEnvironmentProviderRegistry,\n): AgentEnvironmentProvider {\n  if (typeof provider !== 'string') return provider\n  if (!registry) {\n    throw new ValidationError(\n      `agent environment provider \"${provider}\" requires an AgentEnvironmentProviderRegistry`,\n    )\n  }\n  return registry.require(provider)\n}\n\n/** Options for exposing an `AgentEnvironmentProvider` through the legacy sandbox client port.\n * @experimental */\nexport interface ProviderAsSandboxClientOptions {\n  defaults?: Partial<CreateAgentEnvironmentInput>\n  requireTerminalEvent?: boolean\n  mapCreateOptions?: (\n    options: CreateSandboxOptions | undefined,\n  ) => Partial<CreateAgentEnvironmentInput>\n}\n\n/** Adapt a neutral environment provider to the `SandboxClient` interface used by existing loop paths.\n * @experimental */\nexport function providerAsSandboxClient(\n  provider: AgentEnvironmentProvider,\n  options: ProviderAsSandboxClientOptions = {},\n): SandboxClient {\n  return {\n    async create(createOptions?: CreateSandboxOptions): Promise<SandboxInstance> {\n      const mapped = {\n        ...(options.defaults ?? {}),\n        ...createInputFromSandboxOptions(createOptions),\n        ...(options.mapCreateOptions?.(createOptions) ?? {}),\n      }\n      if (mapped.profile === undefined) {\n        throw new ValidationError(\n          `providerAsSandboxClient(${provider.name}): profile required in defaults or CreateSandboxOptions.backend.profile`,\n        )\n      }\n      const environment = await provider.create(mapped as CreateAgentEnvironmentInput)\n      return environmentAsSandboxInstance(environment, {\n        requireTerminalEvent: options.requireTerminalEvent ?? true,\n      })\n    },\n  }\n}\n\n/** Options for wrapping the current Tangle sandbox client as an environment provider.\n * @experimental */\nexport interface SandboxClientProviderOptions {\n  name?: string\n  defaultBackend?: BackendType\n  capabilities?:\n    | AgentEnvironmentCapabilities\n    | (() => AgentEnvironmentCapabilities | Promise<AgentEnvironmentCapabilities>)\n  validateProfile?: (\n    profile: AgentProfileRef,\n  ) => AgentProfileValidationResult | Promise<AgentProfileValidationResult>\n  /** Resolve a named profile before calling Sandbox, which accepts inline profiles only. */\n  resolveProfile?: (profileId: string) => AgentProfile | Promise<AgentProfile>\n  mapCreateInput?: (input: CreateAgentEnvironmentInput) => CreateSandboxOptions\n}\n\n/** Adapt a `SandboxClient` into the shared `AgentEnvironmentProvider` contract.\n * @experimental */\nexport function sandboxClientAsProvider(\n  client: SandboxClient,\n  options: SandboxClientProviderOptions = {},\n): AgentEnvironmentProvider {\n  const providerName = options.name ?? 'tangle-sandbox'\n  return {\n    name: providerName,\n    capabilities: async () => {\n      if (options.capabilities) {\n        return typeof options.capabilities === 'function'\n          ? options.capabilities()\n          : options.capabilities\n      }\n      return defaultTangleSandboxCapabilities({\n        namedProfiles: options.resolveProfile !== undefined,\n      })\n    },\n    ...(options.validateProfile ? { validateProfile: options.validateProfile } : {}),\n    async create(input: CreateAgentEnvironmentInput): Promise<AgentEnvironment> {\n      const createOptions =\n        options.mapCreateInput?.(input) ??\n        (await sandboxOptionsFromCreateInput(\n          input,\n          options.defaultBackend ?? 'opencode',\n          options.resolveProfile,\n        ))\n      const box = await client.create(createOptions)\n      return sandboxInstanceAsEnvironment(box, providerName, client)\n    },\n    ...(hasGet(client)\n      ? {\n          async get(id: string): Promise<AgentEnvironment | null> {\n            const box = await client.get(id)\n            return box ? sandboxInstanceAsEnvironment(box, providerName, client) : null\n          },\n        }\n      : {}),\n    ...(hasList(client)\n      ? {\n          async list(query?: AgentEnvironmentQuery): Promise<AgentEnvironmentSummary[]> {\n            const boxes = await client.list(query?.providerOptions)\n            return boxes.map((box) => ({\n              id: String(box.id),\n              provider: providerName,\n              name: typeof box.name === 'string' ? box.name : undefined,\n              status: statusFromUnknown(readBoxStatus(box)),\n              metadata: readBoxMetadata(box),\n            }))\n          },\n        }\n      : {}),\n  }\n}\n\n/** Options for running a provider as a supervise-mode executor.\n * @experimental */\nexport interface ProviderExecutorOptions {\n  defaults?: Partial<CreateAgentEnvironmentInput>\n  runtime?: Runtime\n  destroyOnSettle?: boolean\n  requireTerminalEvent?: boolean\n  taskToTurn?: (task: unknown, specProfile: AgentProfile) => AgentTurnInput\n}\n\n/** Adapt an environment provider into an `ExecutorFactory` for `createExecutor`.\n * @experimental */\nexport function providerAsExecutor(\n  provider: AgentEnvironmentProvider,\n  options: ProviderExecutorOptions = {},\n): ExecutorFactory<unknown> {\n  return (spec, ctx) => createProviderExecutor(provider, spec.profile, ctx, options)\n}\n\nfunction createProviderExecutor(\n  provider: AgentEnvironmentProvider,\n  profile: AgentProfile,\n  ctx: ExecutorContext,\n  options: ProviderExecutorOptions,\n): Executor<unknown> {\n  const controller = new AbortController()\n  const abortIfSignalled = () => {\n    if (ctx.signal.aborted) controller.abort()\n  }\n  abortIfSignalled()\n  if (!ctx.signal.aborted) ctx.signal.addEventListener('abort', abortIfSignalled, { once: true })\n\n  let environment: AgentEnvironment | undefined\n  let artifact: ExecutorResult<unknown> | undefined\n\n  return {\n    runtime: options.runtime ?? (provider.name as Runtime),\n    execute(task, signal): AsyncIterable<UsageEvent> {\n      return streamProviderExecutor({\n        provider,\n        profile,\n        task,\n        signal,\n        controller,\n        options,\n        onEnvironment: (env) => {\n          environment = env\n        },\n        onArtifact: (next) => {\n          artifact = next\n        },\n      })\n    },\n    async teardown(_grace): Promise<{ destroyed: boolean }> {\n      controller.abort()\n      await environment?.destroy?.()\n      return { destroyed: true }\n    },\n    resultArtifact(): ExecutorResult<unknown> {\n      if (!artifact) {\n        throw new ValidationError(\n          `providerAsExecutor(${provider.name}): resultArtifact() read before stream drained`,\n        )\n      }\n      return artifact\n    },\n  }\n}\n\ninterface StreamProviderExecutorArgs {\n  provider: AgentEnvironmentProvider\n  profile: AgentProfile\n  task: unknown\n  signal: AbortSignal\n  controller: AbortController\n  options: ProviderExecutorOptions\n  onEnvironment: (environment: AgentEnvironment) => void\n  onArtifact: (artifact: ExecutorResult<unknown>) => void\n}\n\nasync function* streamProviderExecutor(\n  args: StreamProviderExecutorArgs,\n): AsyncIterable<UsageEvent> {\n  const started = Date.now()\n  const linked = mergeAbortSignals(args.signal, args.controller.signal)\n  const environment = await args.provider.create({\n    ...(args.options.defaults ?? {}),\n    profile: args.profile,\n    signal: linked,\n  })\n  args.onEnvironment(environment)\n\n  const turn =\n    args.options.taskToTurn?.(args.task, args.profile) ?? taskToTurnInput(args.task, linked)\n  const events: AgentEnvironmentEvent[] = []\n  const tokens = zeroTokenUsage()\n  let usd = 0\n  let text = ''\n  let terminal = false\n  try {\n    for await (const event of environment.stream({ ...turn, signal: linked })) {\n      events.push(event)\n      text += textFromEnvironmentEvent(event)\n      const usage = usageFromEnvironmentEvent(event)\n      if (usage.input || usage.output) {\n        tokens.input += usage.input\n        tokens.output += usage.output\n        yield { kind: 'tokens', input: usage.input, output: usage.output }\n      }\n      if (usage.usd) {\n        usd += usage.usd\n        yield { kind: 'cost', usd: usage.usd }\n      }\n      if (isTerminalEnvironmentEvent(event)) terminal = true\n    }\n    if ((args.options.requireTerminalEvent ?? true) && !terminal) {\n      throw new ValidationError(\n        `providerAsExecutor(${args.provider.name}): stream ended without a terminal result/done/status event`,\n      )\n    }\n    yield { kind: 'iteration' }\n    const result = resultFromEvents(events, text)\n    const spent: Spend = {\n      iterations: 1,\n      tokens,\n      usd,\n      ms: Date.now() - started,\n    }\n    args.onArtifact({\n      outRef: contentRef(`provider:${args.provider.name}`, result),\n      out: result,\n      spent,\n    })\n  } finally {\n    if (args.options.destroyOnSettle ?? true) await environment.destroy?.()\n  }\n}\n\nfunction createInputFromSandboxOptions(\n  options: CreateSandboxOptions | undefined,\n): Partial<CreateAgentEnvironmentInput> {\n  const profile = options?.backend?.profile\n  const backend = options?.backend?.type\n  return {\n    // sandboxProfileAsProfile: sandbox 0.15.2 types this profile against\n    // interface 0.36; it crosses as data (see sandbox-backend.ts).\n    ...(profile !== undefined ? { profile: sandboxProfileAsProfile(profile) } : {}),\n    ...(backend ? { backend } : {}),\n    workspace: {\n      ...(options?.environment ? { environment: options.environment } : {}),\n      ...(options?.git?.url ? { repoUrl: options.git.url } : {}),\n      ...(options?.git?.ref ? { gitRef: options.git.ref } : {}),\n    },\n    ...(options?.resources ? { resources: options.resources as ResourceRequest } : {}),\n    ...(options?.env ? { env: options.env } : {}),\n    ...(options?.secrets ? { secrets: options.secrets } : {}),\n    ...(options?.metadata ? { metadata: options.metadata } : {}),\n    ...(options?.name ? { name: options.name } : {}),\n    ...(options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : {}),\n    providerOptions: { sandboxCreateOptions: options ?? {} },\n  }\n}\n\nasync function sandboxOptionsFromCreateInput(\n  input: CreateAgentEnvironmentInput,\n  defaultBackend: BackendType,\n  resolveProfile?: SandboxClientProviderOptions['resolveProfile'],\n): Promise<CreateSandboxOptions> {\n  const backendType = (input.backend ?? defaultBackend) as BackendType\n  const workspace = input.workspace ?? {}\n  const environment = sandboxEnvironmentFromWorkspace(workspace)\n  const providerOptions = input.providerOptions?.sandboxCreateOptions\n  const base =\n    providerOptions && typeof providerOptions === 'object'\n      ? ({ ...(providerOptions as CreateSandboxOptions) } as CreateSandboxOptions)\n      : ({} satisfies CreateSandboxOptions)\n  assertSandboxSecretNames(input.secrets)\n  assertSandboxSecretNames((base as { secrets?: unknown }).secrets)\n  const profile = await sandboxProfileFromReference(input.profile, resolveProfile)\n  const { profile: _baseProfile, ...baseBackend } = base.backend ?? {}\n  return {\n    ...base,\n    ...(environment ? { environment } : {}),\n    ...(workspace.repoUrl ? { git: { url: workspace.repoUrl, ref: workspace.gitRef } } : {}),\n    ...(input.resources ? { resources: input.resources as CreateSandboxOptions['resources'] } : {}),\n    ...(input.env ? { env: input.env } : {}),\n    ...(Array.isArray(input.secrets) ? { secrets: input.secrets } : {}),\n    ...(input.metadata ? { metadata: input.metadata } : {}),\n    ...(input.name ? { name: input.name } : {}),\n    ...(input.idempotencyKey ? { idempotencyKey: input.idempotencyKey } : {}),\n    backend: {\n      ...baseBackend,\n      type: backendType,\n      // profileAsSandboxProfile: reverse hop of the interface 0.36/0.40 skew\n      // (see sandbox-backend.ts); the profile crosses as data.\n      profile: profileAsSandboxProfile(profile),\n    },\n  }\n}\n\nfunction assertSandboxSecretNames(secrets: unknown): asserts secrets is string[] | undefined {\n  if (\n    secrets !== undefined &&\n    (!Array.isArray(secrets) ||\n      secrets.some((secret) => typeof secret !== 'string' || secret.trim().length === 0))\n  ) {\n    throw new ValidationError(\n      'Tangle Sandbox secret names must be non-empty strings; secret values are unsupported',\n    )\n  }\n}\n\nfunction sandboxEnvironmentFromWorkspace(\n  workspace: NonNullable<CreateAgentEnvironmentInput['workspace']>,\n): string | undefined {\n  if (\n    workspace.environment !== undefined &&\n    workspace.image !== undefined &&\n    workspace.environment !== workspace.image\n  ) {\n    throw new ValidationError(\n      'Tangle Sandbox accepts one environment value; workspace.environment and workspace.image must match',\n    )\n  }\n  return workspace.environment ?? workspace.image\n}\n\nasync function sandboxProfileFromReference(\n  profile: AgentProfileRef,\n  resolveProfile: SandboxClientProviderOptions['resolveProfile'],\n): Promise<AgentProfile> {\n  if (typeof profile !== 'string') return profile\n  if (!resolveProfile) {\n    throw new ValidationError(\n      `Tangle Sandbox requires an inline AgentProfile; named profile \"${profile}\" needs SandboxClientProviderOptions.resolveProfile`,\n    )\n  }\n  return resolveProfile(profile)\n}\n\nfunction environmentAsSandboxInstance(\n  environment: AgentEnvironment,\n  options: { requireTerminalEvent: boolean },\n): SandboxInstance {\n  const box = {\n    id: environment.id,\n    name: environment.name,\n    status: 'running',\n    async refresh(): Promise<void> {\n      await environment.refresh?.()\n    },\n    async *streamPrompt(\n      message: string | PromptInputPart[],\n      promptOptions?: PromptOptions,\n    ): AsyncGenerator<SandboxEvent> {\n      let terminal = false\n      const input = turnInputFromPrompt(message, promptOptions)\n      for await (const event of environment.stream(input)) {\n        if (isTerminalEnvironmentEvent(event)) terminal = true\n        const usageEvent = usageSandboxEvent(event)\n        if (usageEvent) yield usageEvent\n        yield sandboxEventFromEnvironmentEvent(event)\n      }\n      if (options.requireTerminalEvent && !terminal) {\n        throw new ValidationError(\n          `providerAsSandboxClient(${environment.provider}): stream ended without a terminal result/done/status event`,\n        )\n      }\n    },\n    async prompt(\n      message: string | PromptInputPart[],\n      promptOptions?: PromptOptions,\n    ): Promise<PromptResult> {\n      const events: AgentEnvironmentEvent[] = []\n      let text = ''\n      let usage: TokenUsage | undefined\n      let terminal = false\n      for await (const event of environment.stream(turnInputFromPrompt(message, promptOptions))) {\n        events.push(event)\n        if (isTerminalEnvironmentEvent(event)) terminal = true\n        text += textFromEnvironmentEvent(event)\n        usage = mergeTokenUsage(usage, event.usage)\n      }\n      if (options.requireTerminalEvent && !terminal) {\n        throw new ValidationError(\n          `providerAsSandboxClient(${environment.provider}): prompt ended without a terminal result/done/status event`,\n        )\n      }\n      return {\n        response: resultFromEvents(events, text).content,\n        success: true,\n        status: 'success',\n        durationMs: 0,\n        ...(usage ? { usage } : {}),\n      }\n    },\n    ...(environment.dispatch && environment.session\n      ? {\n          async dispatchPrompt(message: string | PromptInputPart[], promptOptions?: PromptOptions) {\n            const session = await environment.dispatch?.(\n              turnInputFromPrompt(message, promptOptions),\n            )\n            if (!session)\n              throw new ValidationError('providerAsSandboxClient: dispatch returned no session')\n            return sandboxDispatchResultFromSessionRef(session)\n          },\n        }\n      : {}),\n    ...(environment.session\n      ? {\n          session(id: string) {\n            return sandboxSessionFromAgentSession(environment.session?.(id))\n          },\n        }\n      : {}),\n    ...(environment.read ? { read: environment.read.bind(environment) } : {}),\n    ...(environment.write ? { write: environment.write.bind(environment) } : {}),\n    ...(environment.exec\n      ? {\n          exec: environment.exec.bind(environment),\n        }\n      : {}),\n    ...(environment.checkpoint\n      ? {\n          async checkpoint(checkpointOptions?: CheckpointRequest) {\n            const checkpoint = await environment.checkpoint?.(checkpointOptions)\n            return { checkpointId: checkpoint?.id, id: checkpoint?.id }\n          },\n        }\n      : {}),\n    ...(environment.fork\n      ? {\n          async fork(checkpointId: string, forkOptions?: ForkRequest) {\n            const forked = await environment.fork?.({ id: checkpointId }, forkOptions)\n            if (!forked)\n              throw new ValidationError('providerAsSandboxClient: fork returned no environment')\n            return environmentAsSandboxInstance(forked, options)\n          },\n        }\n      : {}),\n    async delete(): Promise<void> {\n      await environment.destroy?.()\n    },\n  }\n  return box as unknown as SandboxInstance\n}\n\nfunction sandboxInstanceAsEnvironment(\n  box: SandboxInstance,\n  providerName: string,\n  client: SandboxClient,\n): AgentEnvironment {\n  const environment: AgentEnvironment = {\n    id: String(box.id),\n    provider: providerName,\n    ...(typeof box.name === 'string' ? { name: box.name } : {}),\n    async status(): Promise<AgentEnvironmentStatus> {\n      await maybeRefresh(box)\n      return statusFromUnknown(readBoxStatus(box))\n    },\n    async *stream(input: AgentTurnInput): AsyncIterable<AgentEnvironmentEvent> {\n      for await (const event of box.streamPrompt(\n        promptFromTurnInput(input),\n        promptOptionsFromTurnInput(input),\n      )) {\n        yield environmentEventFromSandboxEvent(event)\n      }\n    },\n    ...(hasDispatchPrompt(box)\n      ? {\n          async dispatch(input: AgentTurnInput): Promise<AgentSessionRef> {\n            const dispatched = await box.dispatchPrompt(\n              promptFromTurnInput(input),\n              promptOptionsFromTurnInput(input),\n            )\n            return sessionRefFromSandboxDispatch(dispatched, providerName)\n          },\n        }\n      : {}),\n    ...(hasSession(box)\n      ? {\n          session(id: string): AgentSession {\n            return sandboxSessionAsAgentSession(box.session(id))\n          },\n        }\n      : {}),\n    ...(hasRead(box) ? { read: box.read.bind(box) } : {}),\n    ...(hasWrite(box) ? { write: box.write.bind(box) } : {}),\n    ...(hasExec(box)\n      ? {\n          async exec(command: string, options?: ExecRequest): Promise<ExecResult> {\n            return execResultFromSandboxExecResult(await box.exec(command, options as never))\n          },\n        }\n      : {}),\n    async checkpoint(options?: CheckpointRequest): Promise<CheckpointRef> {\n      const result = await box.snapshot({\n        ...(options?.name ? { tags: [options.name] } : {}),\n      })\n      return {\n        id: result.snapshotId,\n        provider: providerName,\n        ...(options?.metadata ? { metadata: options.metadata } : {}),\n      }\n    },\n    async fork(checkpoint: CheckpointRef, options?: ForkRequest): Promise<AgentEnvironment> {\n      const forked = await client.create({\n        fromSnapshot: checkpoint.id,\n        fromSandboxId: String(box.id),\n        ...(options?.name ? { name: options.name } : {}),\n        ...(options?.metadata ? { metadata: options.metadata } : {}),\n      })\n      return sandboxInstanceAsEnvironment(forked, providerName, client)\n    },\n    async placement(): Promise<PlacementInfo> {\n      return placementInfoFromLoopPlacement(client.describePlacement?.(box), box)\n    },\n    async refresh(): Promise<void> {\n      await maybeRefresh(box)\n    },\n    async destroy(): Promise<void> {\n      await destroyBox(box)\n    },\n  }\n  return environment\n}\n\nfunction sandboxSessionAsAgentSession(session: SandboxSessionLike): AgentSession {\n  return {\n    id: session.id,\n    async status(): Promise<AgentSessionStatus | null> {\n      const status = await session.status()\n      if (!status) return null\n      return sessionStatusFromUnknown((status as { status?: unknown }).status)\n    },\n    async *events(options?: {\n      since?: string\n      signal?: AbortSignal\n    }): AsyncIterable<AgentEnvironmentEvent> {\n      for await (const event of session.events(options))\n        yield environmentEventFromSandboxEvent(event)\n    },\n    async result(): Promise<AgentTurnResult> {\n      return agentTurnResultFromPromptResult(await session.result())\n    },\n    async prompt(input: AgentTurnInput): Promise<AgentTurnResult> {\n      return agentTurnResultFromPromptResult(\n        await session.prompt(promptFromTurnInput(input), promptOptionsFromTurnInput(input)),\n      )\n    },\n    cancel(): Promise<void> {\n      return session.interrupt().then(() => undefined)\n    },\n  }\n}\n\nfunction sandboxSessionFromAgentSession(session: AgentSession | undefined): SandboxSessionLike {\n  if (!session) throw new ValidationError('providerAsSandboxClient: session is unavailable')\n  return {\n    id: session.id,\n    async status() {\n      const status = await session.status()\n      if (!status) return null\n      return {\n        id: session.id,\n        status: sandboxSessionStatusFromAgentSessionStatus(status),\n      }\n    },\n    async *events(options?: {\n      since?: string\n      signal?: AbortSignal\n    }): AsyncGenerator<SandboxEvent> {\n      for await (const event of session.events(options))\n        yield sandboxEventFromEnvironmentEvent(event)\n    },\n    async result(): Promise<PromptResult> {\n      return promptResultFromAgentTurnResult(await session.result())\n    },\n    async prompt(\n      message: string | PromptInputPart[],\n      options?: PromptOptions,\n    ): Promise<PromptResult> {\n      return promptResultFromAgentTurnResult(\n        await session.prompt(turnInputFromPrompt(message, options)),\n      )\n    },\n    async interrupt() {\n      await session.cancel()\n      return { cancelled: true }\n    },\n  }\n}\n\nfunction sandboxSessionStatusFromAgentSessionStatus(\n  status: AgentSessionStatus,\n): 'queued' | 'running' | 'completed' | 'failed' | 'cancelled' {\n  switch (status) {\n    case 'pending':\n    case 'provisioning':\n      return 'queued'\n    case 'running':\n      return 'running'\n    case 'completed':\n      return 'completed'\n    case 'cancelled':\n      return 'cancelled'\n    // Sandbox has no neutral stopped state; do not report completion without success proof.\n    case 'stopped':\n    case 'failed':\n    case 'expired':\n    case 'unknown':\n      return 'failed'\n  }\n}\n\nfunction promptResultFromAgentTurnResult(result: AgentTurnResult): PromptResult {\n  return {\n    response: result.text,\n    success: result.success,\n    status: result.success ? 'success' : 'failed',\n    durationMs: 0,\n    ...(result.error ? { error: result.error } : {}),\n    ...(result.usage\n      ? {\n          usage: {\n            inputTokens: result.usage.inputTokens,\n            outputTokens: result.usage.outputTokens,\n          },\n          ...(result.usage.cost === undefined ? {} : { costUsd: result.usage.cost }),\n        }\n      : {}),\n  }\n}\n\nfunction environmentEventFromSandboxEvent(event: SandboxEvent): AgentEnvironmentEvent {\n  const data =\n    event.data && typeof event.data === 'object'\n      ? (event.data as Record<string, unknown>)\n      : ({} as Record<string, unknown>)\n  return {\n    type: String(event.type),\n    data,\n    ...(event.id ? { id: event.id } : {}),\n    usage: tokenUsageFromData(data),\n    providerEvent: event,\n  }\n}\n\nfunction sandboxEventFromEnvironmentEvent(event: AgentEnvironmentEvent): SandboxEvent {\n  return {\n    type: event.type,\n    data: {\n      ...event.data,\n      ...(event.usage ? { usage: tokenUsageData(event.usage) } : {}),\n    },\n    ...(event.id ? { id: event.id } : {}),\n  }\n}\n\nfunction usageSandboxEvent(event: AgentEnvironmentEvent): SandboxEvent | undefined {\n  if (!event.usage || isUsageType(event.type)) return undefined\n  const usage = tokenUsageData(event.usage)\n  if (\n    usage.inputTokens === undefined &&\n    usage.outputTokens === undefined &&\n    usage.totalCostUsd === undefined\n  ) {\n    return undefined\n  }\n  return { type: 'llm_call', data: usage }\n}\n\nfunction tokenUsageData(usage: TokenUsage): Record<string, number | undefined> {\n  return {\n    inputTokens: usage.inputTokens,\n    outputTokens: usage.outputTokens,\n    totalCostUsd: usage.cost,\n  }\n}\n\nfunction turnInputFromPrompt(\n  message: string | PromptInputPart[],\n  options?: PromptOptions,\n): AgentTurnInput {\n  return {\n    ...(typeof message === 'string' ? { prompt: message } : { parts: message }),\n    ...(options?.sessionId ? { sessionId: options.sessionId } : {}),\n    ...(options?.model ? { model: options.model } : {}),\n    ...(options?.timeoutMs ? { timeoutMs: options.timeoutMs } : {}),\n    ...(options?.executionId ? { executionId: options.executionId } : {}),\n    ...(options?.lastEventId ? { lastEventId: options.lastEventId } : {}),\n    ...(options?.turnId ? { turnId: options.turnId } : {}),\n    ...(options?.detach !== undefined ? { detach: options.detach } : {}),\n    ...(options?.context ? { context: options.context } : {}),\n    ...(options?.signal ? { signal: options.signal } : {}),\n    ...(options?.backend ? { providerOptions: { backend: options.backend } } : {}),\n  }\n}\n\nfunction promptFromTurnInput(input: AgentTurnInput): string | PromptInputPart[] {\n  if (input.parts) return input.parts.map(promptPartFromInputPart)\n  return input.prompt ?? ''\n}\n\nfunction promptPartFromInputPart(part: InputPart): PromptInputPart {\n  if (part.type === 'text' || part.type === 'image') return part\n  if (part.content !== undefined || part.path !== undefined) {\n    throw new ValidationError(\n      'Tangle Sandbox file prompt parts require a URL; inline content and local paths are not representable',\n    )\n  }\n  if (!part.filename || !part.url) {\n    throw new ValidationError('Tangle Sandbox file prompt parts require both filename and URL')\n  }\n  return {\n    type: 'file',\n    filename: part.filename,\n    ...(part.mediaType ? { mediaType: part.mediaType } : {}),\n    url: part.url,\n  }\n}\n\nfunction promptOptionsFromTurnInput(input: AgentTurnInput): PromptOptions {\n  return {\n    ...(input.sessionId ? { sessionId: input.sessionId } : {}),\n    ...(input.model ? { model: input.model } : {}),\n    ...(input.timeoutMs ? { timeoutMs: input.timeoutMs } : {}),\n    ...(input.context ? { context: input.context } : {}),\n    ...(input.signal ? { signal: input.signal } : {}),\n    ...(input.executionId ? { executionId: input.executionId } : {}),\n    ...(input.lastEventId ? { lastEventId: input.lastEventId } : {}),\n    ...(input.turnId ? { turnId: input.turnId } : {}),\n    ...(input.detach !== undefined ? { detach: input.detach } : {}),\n  }\n}\n\nfunction taskToTurnInput(task: unknown, signal: AbortSignal): AgentTurnInput {\n  return { prompt: taskToPrompt(task), signal }\n}\n\nfunction taskToPrompt(task: unknown): string {\n  if (typeof task === 'string') return task\n  if (task && typeof task === 'object') {\n    const record = task as Record<string, unknown>\n    for (const key of ['prompt', 'content', 'task', 'message']) {\n      if (typeof record[key] === 'string') return record[key]\n    }\n  }\n  return JSON.stringify(task)\n}\n\nfunction resultFromEvents(\n  events: AgentEnvironmentEvent[],\n  fallbackText: string,\n): { content: string; events: AgentEnvironmentEvent[] } {\n  for (let i = events.length - 1; i >= 0; i -= 1) {\n    const event = events[i]\n    const text = event ? resultTextFromData(event.data) : undefined\n    if (text !== undefined) return { content: text, events }\n  }\n  return { content: fallbackText, events }\n}\n\nfunction textFromEnvironmentEvent(event: AgentEnvironmentEvent): string {\n  if (\n    typeof event.normalized === 'object' &&\n    event.normalized &&\n    event.normalized.type === 'message.part.updated'\n  ) {\n    return typeof event.normalized.delta === 'string' ? event.normalized.delta : ''\n  }\n  const data = event.data\n  for (const key of ['delta', 'chunk', 'content', 'text']) {\n    if (typeof data[key] === 'string' && !isTerminalEnvironmentEvent(event)) return data[key]\n  }\n  return ''\n}\n\nfunction resultTextFromData(data: Record<string, unknown>): string | undefined {\n  for (const key of ['finalText', 'text', 'response', 'resultSummary', 'content']) {\n    if (typeof data[key] === 'string') return data[key]\n  }\n  return undefined\n}\n\nfunction isTerminalEnvironmentEvent(event: AgentEnvironmentEvent): boolean {\n  if (event.type === 'result' || event.type === 'done' || event.type === 'final') return true\n  if (event.type.endsWith('.completed') || event.type.endsWith('.failed')) return true\n  if (event.type === 'status') {\n    const status = event.data.status\n    return status === 'completed' || status === 'failed' || status === 'cancelled'\n  }\n  return false\n}\n\nfunction isUsageType(type: string): boolean {\n  return type === 'llm_call' || type === 'usage' || type === 'cost.usage'\n}\n\nfunction usageFromEnvironmentEvent(event: AgentEnvironmentEvent): {\n  input: number\n  output: number\n  usd: number\n} {\n  const usage = event.usage ?? tokenUsageFromData(event.data)\n  return {\n    input: finiteNumber(usage?.inputTokens) ?? 0,\n    output: finiteNumber(usage?.outputTokens) ?? 0,\n    usd:\n      finiteNumber(usage?.cost) ??\n      finiteNumber(event.data.costUsd) ??\n      finiteNumber(event.data.totalCostUsd) ??\n      0,\n  }\n}\n\nfunction tokenUsageFromData(data: Record<string, unknown>): TokenUsage | undefined {\n  const usageRecord =\n    data.usage && typeof data.usage === 'object'\n      ? (data.usage as Record<string, unknown>)\n      : data.tokenUsage && typeof data.tokenUsage === 'object'\n        ? (data.tokenUsage as Record<string, unknown>)\n        : data\n  const inputTokens =\n    finiteNumber(usageRecord.inputTokens) ??\n    finiteNumber(usageRecord.tokensIn) ??\n    finiteNumber(usageRecord.prompt_tokens)\n  const outputTokens =\n    finiteNumber(usageRecord.outputTokens) ??\n    finiteNumber(usageRecord.tokensOut) ??\n    finiteNumber(usageRecord.completion_tokens)\n  const cost =\n    finiteNumber(usageRecord.cost) ??\n    finiteNumber(usageRecord.costUsd) ??\n    finiteNumber(usageRecord.totalCostUsd) ??\n    finiteNumber(data.costUsd) ??\n    finiteNumber(data.totalCostUsd)\n  if (inputTokens === undefined && outputTokens === undefined && cost === undefined)\n    return undefined\n  return {\n    inputTokens: inputTokens ?? 0,\n    outputTokens: outputTokens ?? 0,\n    ...(cost !== undefined ? { cost } : {}),\n  }\n}\n\nfunction mergeTokenUsage(\n  left: TokenUsage | undefined,\n  right: TokenUsage | undefined,\n): TokenUsage | undefined {\n  if (!left) return right\n  if (!right) return left\n  return {\n    inputTokens: left.inputTokens + right.inputTokens,\n    outputTokens: left.outputTokens + right.outputTokens,\n    ...(left.cost !== undefined || right.cost !== undefined\n      ? { cost: (left.cost ?? 0) + (right.cost ?? 0) }\n      : {}),\n  }\n}\n\nfunction finiteNumber(value: unknown): number | undefined {\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined\n}\n\nfunction agentTurnResultFromPromptResult(result: PromptResult): AgentTurnResult {\n  const record = result as unknown as Record<string, unknown>\n  const text =\n    typeof record.response === 'string'\n      ? record.response\n      : typeof record.text === 'string'\n        ? record.text\n        : typeof record.finalText === 'string'\n          ? record.finalText\n          : ''\n  const success = typeof record.success === 'boolean' ? record.success : true\n  return {\n    text,\n    success,\n    ...(typeof record.error === 'string' ? { error: record.error } : {}),\n    usage: tokenUsageFromData(record),\n  }\n}\n\nfunction sandboxDispatchResultFromSessionRef(session: AgentSessionRef): Record<string, unknown> {\n  const hasStatus = session.metadata && Object.hasOwn(session.metadata, 'status')\n  const status = hasStatus ? sessionStatusFromUnknown(session.metadata?.status) : 'running'\n  return {\n    sessionId: session.id,\n    status,\n    alreadyExisted: session.metadata?.alreadyExisted === true,\n  }\n}\n\nfunction sessionRefFromSandboxDispatch(dispatched: unknown, providerName: string): AgentSessionRef {\n  const record =\n    dispatched && typeof dispatched === 'object'\n      ? (dispatched as Record<string, unknown>)\n      : undefined\n  const id = record?.sessionId ?? record?.id\n  if (typeof id !== 'string' || id.length === 0) {\n    throw new ValidationError('sandboxClientAsProvider: dispatch returned no session id')\n  }\n  if (!record) {\n    throw new ValidationError('sandboxClientAsProvider: dispatch returned no session record')\n  }\n  return {\n    id,\n    provider: providerName,\n    metadata: {\n      ...(record.status ? { status: record.status } : {}),\n      ...(record.alreadyExisted !== undefined ? { alreadyExisted: record.alreadyExisted } : {}),\n    },\n  }\n}\n\nfunction execResultFromSandboxExecResult(result: SandboxExecResult): ExecResult {\n  const record = result as unknown as Record<string, unknown>\n  const exitCode = finiteNumber(record.exitCode) ?? finiteNumber(record.code)\n  if (exitCode === undefined) {\n    throw new ValidationError('sandboxClientAsProvider: exec returned no exit code')\n  }\n  return {\n    exitCode,\n    stdout: typeof record.stdout === 'string' ? record.stdout : '',\n    stderr: typeof record.stderr === 'string' ? record.stderr : '',\n  }\n}\n\nfunction statusFromUnknown(status: unknown): AgentEnvironmentStatus {\n  if (status === 'pending' || status === 'provisioning' || status === 'running') return status\n  if (status === 'stopped' || status === 'failed' || status === 'expired') return status\n  if (status === 'completed') return 'stopped'\n  if (status === 'cancelled') return 'stopped'\n  return 'unknown'\n}\n\nfunction sessionStatusFromUnknown(status: unknown): AgentSessionStatus | null {\n  if (status === 'completed' || status === 'cancelled') return status\n  return statusFromUnknown(status)\n}\n\nfunction readBoxStatus(box: SandboxInstance): unknown {\n  return (box as unknown as { status?: unknown }).status\n}\n\nfunction readBoxMetadata(box: SandboxInstance): Record<string, unknown> | undefined {\n  const metadata = (box as unknown as { metadata?: unknown }).metadata\n  return metadata && typeof metadata === 'object'\n    ? (metadata as Record<string, unknown>)\n    : undefined\n}\n\nasync function maybeRefresh(box: SandboxInstance): Promise<void> {\n  const refresh = (box as unknown as { refresh?: () => Promise<void> }).refresh\n  if (typeof refresh === 'function') await refresh.call(box)\n}\n\nasync function destroyBox(box: SandboxInstance): Promise<void> {\n  const deleteBox = (box as unknown as { delete?: () => Promise<void> }).delete\n  if (typeof deleteBox === 'function') await deleteBox.call(box)\n}\n\nfunction placementInfoFromLoopPlacement(\n  placement: LoopSandboxPlacement | undefined,\n  box: SandboxInstance,\n): PlacementInfo {\n  if (!placement) return { kind: 'sandbox', sandboxId: String(box.id) }\n  return {\n    kind: placement.kind === 'fleet' ? 'fleet' : 'sandbox',\n    ...(placement.sandboxId ? { sandboxId: placement.sandboxId } : { sandboxId: String(box.id) }),\n    ...(placement.fleetId ? { fleetId: placement.fleetId } : {}),\n    ...(placement.machineId ? { machineId: placement.machineId } : {}),\n  }\n}\n\nfunction defaultTangleSandboxCapabilities(options: {\n  namedProfiles: boolean\n}): AgentEnvironmentCapabilities {\n  return {\n    profile: {\n      namedProfiles: options.namedProfiles,\n      systemPrompt: true,\n      instructions: true,\n      tools: true,\n      permissions: true,\n      mcp: true,\n      subagents: true,\n      resources: {\n        files: true,\n        instructions: true,\n        tools: true,\n        skills: true,\n        agents: true,\n        commands: true,\n      },\n      hooks: true,\n      modes: true,\n      runtimeUpdate: true,\n      validation: true,\n    },\n    streaming: { live: true, replay: true, detach: true, turnIdempotency: true },\n    sessions: { continue: true, list: true, messages: true },\n    workspace: { read: true, write: true, exec: true, git: true, upload: true, download: true },\n    branching: { checkpoint: true, fork: true },\n    placement: true,\n    usage: true,\n    confidential: true,\n  }\n}\n\nfunction mergeAbortSignals(a: AbortSignal, b: AbortSignal): AbortSignal {\n  const controller = new AbortController()\n  const abort = () => controller.abort()\n  if (a.aborted || b.aborted) controller.abort()\n  else {\n    a.addEventListener('abort', abort, { once: true })\n    b.addEventListener('abort', abort, { once: true })\n  }\n  return controller.signal\n}\n\nfunction contentRef(prefix: string, value: unknown): string {\n  let str: string\n  try {\n    str = JSON.stringify(value) ?? String(value)\n  } catch {\n    str = String(value)\n  }\n  let hash = 0x811c9dc5\n  for (let i = 0; i < str.length; i += 1) {\n    hash ^= str.charCodeAt(i)\n    hash = Math.imul(hash, 0x01000193)\n  }\n  return `${prefix}:${(hash >>> 0).toString(16).padStart(8, '0')}`\n}\n\nfunction hasGet(\n  client: SandboxClient,\n): client is SandboxClient & { get(id: string): Promise<SandboxInstance | null> } {\n  return typeof (client as { get?: unknown }).get === 'function'\n}\n\nfunction hasList(\n  client: SandboxClient,\n): client is SandboxClient & { list(options?: unknown): Promise<SandboxInstance[]> } {\n  return typeof (client as { list?: unknown }).list === 'function'\n}\n\nfunction hasDispatchPrompt(box: SandboxInstance): box is SandboxInstance & {\n  dispatchPrompt(message: string | PromptInputPart[], options?: PromptOptions): Promise<unknown>\n} {\n  return typeof (box as { dispatchPrompt?: unknown }).dispatchPrompt === 'function'\n}\n\nfunction hasSession(\n  box: SandboxInstance,\n): box is SandboxInstance & { session(id: string): SandboxSessionLike } {\n  return typeof (box as { session?: unknown }).session === 'function'\n}\n\nfunction hasRead(box: SandboxInstance): box is SandboxInstance & {\n  read(path: string, options?: { sessionId?: string }): Promise<string>\n} {\n  return typeof (box as { read?: unknown }).read === 'function'\n}\n\nfunction hasWrite(\n  box: SandboxInstance,\n): box is SandboxInstance & { write(path: string, content: string): Promise<void> } {\n  return typeof (box as { write?: unknown }).write === 'function'\n}\n\nfunction hasExec(box: SandboxInstance): box is SandboxInstance & {\n  exec(command: string, options?: unknown): Promise<SandboxExecResult>\n} {\n  return typeof (box as { exec?: unknown }).exec === 'function'\n}\n\ninterface SandboxSessionLike {\n  readonly id: string\n  status(): Promise<unknown | null>\n  events(options?: { since?: string; signal?: AbortSignal }): AsyncIterable<SandboxEvent>\n  result(): Promise<PromptResult>\n  prompt(message: string | PromptInputPart[], options?: PromptOptions): Promise<PromptResult>\n  interrupt(): Promise<unknown>\n}\n"],"mappings":";;;;;;;;;;;;AA6BA,SAAgB,wBAAwB,SAA4C;CAClF,OAAO;AACT;;AAGA,SAAgB,wBAAwB,SAA4C;CAClF,OAAO;AACT;;;;;;;;;AAUA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAS,qBAAqB,SAA+C;CAC3E,OAAQ,gBAAsC,SAAS,OAAO,IACzD,UACD,KAAA;AACN;;;;;;;;;;AAWA,SAAS,mBACP,SACA,UACa;CACb,IAAI,UAAU,MAAM,OAAO,SAAS;CACpC,MAAM,WAAW,QAAQ,UAAU;CACnC,IAAI,OAAO,aAAa,UAAU,OAAO;CACzC,MAAM,WAAW,QAAQ;CACzB,IAAI,aAAa,KAAA,GAAW;EAC1B,MAAM,UAAU,qBAAqB,QAAQ;EAC7C,IAAI,YAAY,KAAA,GACd,MAAM,IAAI,MACR,kDAAkD,SAAS,+DAClC,gBAAgB,KAAK,IAAI,EAAE,0EAEtD;EAEF,OAAO;CACT;CACA,OAAO;AACT;;;;;AAMA,SAAgB,oBACd,SACA,WACsB;CACtB,MAAM,OAAO,aAAa,CAAC;CAC3B,MAAM,kBAAkB,KAAK;CAC7B,OAAO;EACL,GAAG;EACH,SAAS;GACP,MAAM,mBAAmB,SAAS,eAAe;GACjD,SAAS,wBAAwB,OAAO;GACxC,GAAI,iBAAiB,QAAQ,EAAE,OAAO,gBAAgB,MAAM,IAAI,CAAC;GACjE,GAAI,iBAAiB,SAAS,EAAE,QAAQ,gBAAgB,OAAO,IAAI,CAAC;EACtE;CACF;AACF;;;ACtFA,MAAM,6BAA6B;AACnC,MAAM,2BAA2B;;;;;;;AAQjC,SAAgB,wCACd,QACA,UAA0D,CAAC,GACjC;CAC1B,MAAM,OAAO,QAAQ,QAAQ;CAC7B,IAAI,CAAC,KAAK,KAAK,GAAG,MAAM,IAAI,MAAM,8DAA8D;CAyDhG,OAAO;EACL;EACA,cAAA;GAxDA,MAAM,OAAO,OAAgD;IAC3D,eAAe,MAAM,MAAM;IAC3B,wBAAwB,MAAM,eAAe;IAC7C,MAAM,eAAe,oBAAoB,MAAM,MAAM;IACrD,MAAM,WAAW,cAAc,MAAM,UAAU,MAAM,YAAY;IACjE,MAAM,UAAU,MAAM,OAAO,OAC3B;KACE,aAAa,aAAa,MAAM,OAAO,qBAAqB;KAC5D,OAAO;KACP,MAAM;KACN,WAAW;KACX;KACA,WAAW,iBAAiB,KAAK;KACjC,oBAAoB,uBAAuB,MAAM,aAAa;KAC9D;KACA,gBAAgB,aAAa,MAAM,gBAAgB,+BAA+B;IACpF,GACA;KACE,GAAI,MAAM,uBAAuB,KAAA,IAC7B,CAAC,IACD,EAAE,WAAW,gBAAgB,MAAM,oBAAoB,mBAAmB,EAAE;KAChF,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;IAC/D,CACF;IACA,IAAI;KACF,eAAe,MAAM,MAAM;KAC3B,2BAA2B,SAAS,QAAQ;KAC5C,MAAM,yBAAyB,SAAS,YAAY;IACtD,SAAS,OAAO;KACd,MAAM,sBAAsB,SAAS,KAAK;IAC5C;IACA,OAAO,iCAAiC,SAAS,IAAI;GACvD;GACA,MAAM,IAAI,IAAY;IACpB,MAAM,UAAU,MAAM,OAAO,IAAI,EAAE;IACnC,IAAI,CAAC,WAAW,CAAC,eAAe,SAAS,IAAI,GAAG,OAAO;IACvD,MAAM,yBAAyB,SAAS,mBAAmB,QAAQ,QAAQ,CAAC;IAC5E,OAAO,iCAAiC,SAAS,IAAI;GACvD;GACA,MAAM,KAAK,OAA2C;IACpD,wBAAwB,OAAO,eAAe;IAC9C,MAAM,YAAY,MAAM,OAAO,KAAK;IACpC,OAAO,QAAQ,IACb,UACG,QAAQ,YAAY,eAAe,SAAS,IAAI,CAAC,CAAC,CAClD,QAAQ,YAAY,gBAAgB,QAAQ,UAAU,OAAO,QAAQ,CAAC,CAAC,CACvE,IAAI,OAAO,YAAY;KACtB,MAAM,yBAAyB,SAAS,mBAAmB,QAAQ,QAAQ,CAAC;KAC5E,OAAO,iCAAiC,SAAS,IAAI;IACvD,CAAC,CACL;GACF;EAKW;EACX,cAAc;EACd,MAAM,SAAS;GACb,MAAM,IAAI,MAAM,+BAA+B,KAAK,sCAAsC;EAC5F;CACF;AACF;AAEA,SAAS,iCACP,SACA,UAC8B;CAC9B,OAAO;EACL,IAAI,aAAa,QAAQ,IAAI,YAAY;EACzC;EACA,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;EACzD,SAAS;GACP,MAAM,OAA2C;IAC/C,QAAQ,MAAM,QAAQ,QAAQ,KAAK,EAAA,CAAG,KAAK,WAAW,mBAAmB,MAAM,CAAC;GAClF;GACA,MAAM,IAAI,KAAgD;IACxD,MAAM,UAAU,MAAM,QAAQ,QAAQ,IAAI,GAAG;IAC7C,OAAO,UAAU,6BAA6B,OAAO,IAAI;GAC3D;GACA,MAAM,MAAM,OAAO,SAAqC;IAUtD,OAAO,6BAA6B,MATd,gBAAgB,SAAS,cAC7C,QAAQ,QAAQ,WAAW,MAAM,YAAY,CAAC,GAAG,MAAM,IAAI,GAAG;KAC5D,KAAK,MAAM;KACX,KAAK,EAAE,GAAG,MAAM,IAAI;KACpB,YAAY;KACZ,GAAI,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;KAC1D,WAAW,MAAM;IACnB,CAAC,CACH,CAC2C;GAC7C;EACF;EACA,MAAM,UAAU,MAAM,OAAO,SAAwB;GACnD,IAAI,QAAQ,GAAG,sBAAsB,MACnC,MAAM,IAAI,MAAM,yDAAyD;GAE3E,MAAM,gBAAgB,QAAQ,cAC5B,QAAQ,GAAG,MAAM,MAAM,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ,GAAG;IAC5D,UAAU;IACV,MAAM,SAAS,QAAQ,IAAI;GAC7B,CAAC,CACH;EACF;EACA,MAAM,SAAS,MAAM,SAA8B;GACjD,MAAM,WAAW,mBAAmB,QAAQ,UAAU,iCAAiC;GACvF,MAAM,cAAc,oBACjB,MAAM,gBAAgB,QAAQ,cAAc,QAAQ,GAAG,KAAK,IAAI,CAAC,EAAA,CAAG,MACrE,iCAAiC,KAAK,EACxC;GACA,IAAI,cAAc,UAChB,MAAM,IAAI,MACR,wBAAwB,KAAK,gBAAgB,SAAS,yBACxD;GAEF,MAAM,SAAS,MAAM,gBAAgB,QAAQ,cAC3C,QAAQ,GAAG,UAAU,CAAC,IAAI,GAAG,EAAE,UAAU,SAAS,CAAC,CACrD;GACA,MAAM,UAAU,OAAO,OAAO,MAAM,UAAU,MAAM,SAAS,IAAI;GACjE,IAAI,SACF,MAAM,IAAI,MAAM,kCAAkC,KAAK,KAAK,QAAQ,OAAO;GAE7E,MAAM,QAAQ,OAAO,MAAM,QAAQ,UAAU,MAAM,SAAS,IAAI;GAChE,IAAI,MAAM,WAAW,GACnB,MAAM,IAAI,MAAM,2BAA2B,MAAM,OAAO,yBAAyB,KAAK,EAAE;GAE1F,MAAM,OAAO,MAAM;GACnB,IAAI,KAAK,aAAa,UACpB,MAAM,IAAI,MAAM,8DAA8D,KAAK,EAAE;GAEvF,MAAM,OAAO,mBAAmB,KAAK,MAAM,iCAAiC,KAAK,EAAE;GACnF,IAAI,SAAS,aACX,MAAM,IAAI,MAAM,wBAAwB,KAAK,4BAA4B;GAE3E,IAAI,OAAO,UACT,MAAM,IAAI,MACR,wBAAwB,KAAK,gBAAgB,SAAS,yBACxD;GAEF,MAAM,QAAQ,OAAO,KAAK,KAAK,SAAS,QAAQ;GAChD,IAAI,MAAM,eAAe,QAAQ,MAAM,SAAS,QAAQ,MAAM,KAAK,SACjE,MAAM,IAAI,MACR,qEAAqE,KAAK,EAC5E;GAEF,OAAO,WAAW,KAAK,KAAK;EAC9B;EACA,MAAM,UAAyB;GAC7B,MAAM,QAAQ,OAAO;EACvB;CACF;AACF;AAEA,SAAS,6BAA6B,SAAqC;CACzE,MAAM,MAAM,gBAAgB,QAAQ,KAAK,4BAA4B;CACrE,OAAO;EACL;EACA,MAAM,SAA2C;GAC/C,OAAO,mBAAmB,MAAM,QAAQ,OAAO,GAAG,GAAG;EACvD;EACA,MAAM,OAA2C;GAC/C,MAAM,eAAe,MAAM,QAAQ,KAAK;GACxC,IAAI,CAAC,OAAO,cAAc,YAAY,GACpC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,MAAM,SAAS,mBAAmB,MAAM,QAAQ,OAAO,GAAG,GAAG;GAC7D,IAAI,OAAO,WAAW,CAAC,OAAO,aAC5B,MAAM,IAAI,MAAM,6DAA6D;GAE/E,IAAI,OAAO,YAAY,SAAS,UAAU,OAAO,YAAY,aAAa,cACxE,MAAM,IAAI,MAAM,8DAA8D;GAEhF,OAAO,OAAO;EAChB;EACA,MAAM,OAAsB;GAC1B,MAAM,QAAQ,KAAK,WAAW,EAAE,MAAM,KAAK,CAAC;EAC9C;EACA,OAAO,SAAgC;GACrC,OAAO,QAAQ,OAAO;EACxB;EACA,OAAO,SAAgC;GACrC,OAAO,QAAQ,OAAO;EACxB;CACF;AACF;AAEA,SAAS,mBAAmB,QAAuB,aAA+C;CAChG,MAAM,MAAM,gBAAgB,OAAO,KAAK,4BAA4B;CACpE,IAAI,gBAAgB,KAAA,KAAa,QAAQ,aACvC,MAAM,IAAI,MAAM,wDAAwD;CAE1E,IAAI,OAAO,OAAO,YAAY,WAC5B,MAAM,IAAI,MAAM,wDAAwD;CAE1E,IAAI,CAAC,OAAO,cAAc,OAAO,QAAQ,GACvC,MAAM,IAAI,MAAM,+DAA+D;CAEjF,MAAM,aAAa,aAAa,OAAO,YAAY,oCAAoC;CACvF,IAAI,OAAO,SAAS;EAClB,IAAI,OAAO,aAAa,IACtB,MAAM,IAAI,MAAM,yDAAyD;EAE3E,IAAI,YACF,MAAM,IAAI,MAAM,+DAA+D;EAEjF,OAAO;GACL;GACA,SAAS;GACT,UAAU;EACZ;CACF;CACA,MAAM,cAAc,aACf;EAAE,MAAM;EAAU,QAAQ;CAAW,IACtC,OAAO,YAAY,IAChB;EAAE,MAAM;EAAQ,UAAU,OAAO;CAAS,IAC3C,KAAA;CACN,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,uDAAuD;CAEzE,OAAO;EACL;EACA,SAAS;EACT,UAAU,OAAO;EACjB,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACnC;CACF;AACF;AAEA,SAAS,cACP,UACA,UACA,cACyB;CACzB,KAAK,MAAM,UAAU,CAAC,4BAA4B,wBAAwB,GACxE,IAAI,OAAO,OAAO,UAAU,MAAM,GAChC,MAAM,IAAI,MAAM,wCAAwC,OAAO,EAAE;CAGrE,OAAO;EACL,GAAG;GACF,6BAA6B;GAC7B,2BAA2B,sBAAsB,YAAY;CAChE;AACF;AAEA,SAAS,eAAe,SAA0B,UAA2B;CAC3E,OAAO,QAAQ,WAAW,gCAAgC;AAC5D;AAEA,SAAS,gBACP,UACA,UACS;CACT,OACE,aAAa,KAAA,KACb,OAAO,QAAQ,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,WAAW,kBAAkB,WAAW,MAAM,KAAK,CAAC;AAE9F;AAEA,SAAS,2BACP,SACA,UACM;CACN,IAAI,CAAC,gBAAgB,QAAQ,UAAU,QAAQ,GAC7C,MAAM,IAAI,MAAM,uDAAuD;AAE3E;AAEA,SAAS,mBACP,UAC0B;CAC1B,MAAM,UAAU,WAAW;CAC3B,IAAI,OAAO,YAAY,UACrB,MAAM,IAAI,MAAM,qEAAqE;CAEvF,IAAI;EACF,MAAM,SAAkB,KAAK,MAAM,OAAO;EAC1C,IAAI,CAAC,UAAU,OAAO,WAAW,UAAU,MAAM,IAAI,MAAM,wBAAwB;EACnF,MAAM,SAAS;EAKf,IAAI,OAAO,SAAS,aAAa,OAAO,iBAAiB,KAAA,GAAW,OAAO,EAAE,MAAM,UAAU;EAC7F,IACE,OAAO,SAAS,YAChB,OAAO,2BAA2B,SAClC,MAAM,QAAQ,OAAO,YAAY,KACjC,OAAO,aAAa,OAAO,WAA6B,OAAO,WAAW,QAAQ,GAClF;GACA,MAAM,eAAe,cAAc,OAAO,YAAY;GACtD,IAAI,IAAI,IAAI,YAAY,CAAC,CAAC,SAAS,aAAa,QAC9C,OAAO;IAAE,MAAM;IAAU;IAAc,wBAAwB;GAAM;EAEzE;CACF,QAAQ;EACN,MAAM,IAAI,MAAM,sEAAsE;CACxF;CACA,MAAM,IAAI,MAAM,sEAAsE;AACxF;AAEA,eAAe,yBACb,SACA,UACe;CACf,MAAM,UAAU,MAAM,QAAQ,OAAO,IAAI,EAAA,CAAG;CAC5C,IAAI,OAAO,SAAS,SAAS,MAC3B,MAAM,IAAI,MACR,4CAA4C,SAAS,KAAK,aAAa,OAAO,MAChF;CAEF,IAAI,SAAS,SAAS,WAAW;EAC/B,MAAM,eAAgB,OAAsC;EAC5D,IACE,OAAO,SAAS,cACf,iBAAiB,KAAA,KAAc,MAAM,QAAQ,YAAY,KAAK,aAAa,WAAW,IAEvF;EAEF,MAAM,IAAI,MAAM,qDAAqD;CACvE;CACA,IAAI,OAAO,SAAS,UAClB,MAAM,IAAI,MAAM,oDAAoD;CAEtE,MAAM,kBAAkB,cAAc,SAAS,YAAY;CAE3D,IAAI,CAAC,kBADiB,cAAc,OAAO,gBAAgB,CAAC,CACzB,GAAG,eAAe,GACnD,MAAM,IAAI,MAAM,+DAA+D;CAEjF,IAAI,OAAO,2BAA2B,OACpC,MAAM,IAAI,MAAM,wDAAwD;AAE5E;AAEA,SAAS,oBACP,OAC0B;CAC1B,IAAI,MAAM,SAAS,WAAW,OAAO,EAAE,MAAM,UAAU;CACvD,MAAM,eAAe,MAAM,aAAa,KAAK,WAC3C,aAAa,QAAQ,sBAAsB,CAC7C;CACA,IAAI,IAAI,IAAI,YAAY,CAAC,CAAC,SAAS,aAAa,QAC9C,MAAM,IAAI,MAAM,mDAAmD;CAErE,OAAO;EAAE,MAAM;EAAU;EAAc,wBAAwB;CAAM;AACvE;AAEA,SAAS,sBAAsB,QAA0C;CACvE,OAAO,KAAK,UACV,OAAO,SAAS,YACZ,EAAE,MAAM,UAAU,IAClB;EACE,MAAM;EACN,cAAc,cAAc,OAAO,YAAY;EAC/C,wBAAwB;CAC1B,CACN;AACF;AAEA,SAAS,iBAAiB,OAAkE;CAC1F,MAAM,WAAW,eAAe,MAAM,UAAU,KAAK,mBAAmB;CACxE,MAAM,WAAW,gBAAgB,MAAM,UAAU,UAAU,sBAAsB;CACjF,MAAM,SAAS,gBAAgB,MAAM,UAAU,QAAQ,oBAAoB;CAC3E,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,MAAM,uDAAuD;CAEzE,OAAO;EAAE;EAAU;EAAU,QAAQ,SAAS;CAAK;AACrD;AAEA,SAAS,uBAAuB,eAA+B;CAC7D,MAAM,eAAe,gBAAgB,eAAe,gCAAgC;CACpF,IAAI,eAAe,QAAU,GAC3B,MAAM,IAAI,MACR,iFACF;CAEF,OAAO,eAAe;AACxB;AAEA,SAAS,SAAS,OAAuB;CACvC,MAAM,OAAO,mBAAmB,OAAO,yBAAyB;CAChE,IAAI,OAAO,MAAQ,MAAM,IAAI,MAAM,iDAAiD;CACpF,OAAO;AACT;AAEA,SAAS,wBAAwB,iBAA4D;CAC3F,IAAI,mBAAmB,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,GAC3D,MAAM,IAAI,MAAM,uEAAuE;AAE3F;AAEA,SAAS,+BAA6D;CACpE,OAAO;EACL,SAAS;GACP,eAAe;GACf,cAAc;GACd,cAAc;GACd,OAAO;GACP,aAAa;GACb,KAAK;GACL,WAAW;GACX,WAAW;IACT,OAAO;IACP,cAAc;IACd,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,UAAU;GACZ;GACA,OAAO;GACP,OAAO;GACP,eAAe;GACf,YAAY;EACd;EACA,WAAW;GAAE,MAAM;GAAO,QAAQ;GAAO,QAAQ;GAAO,iBAAiB;EAAM;EAC/E,UAAU;GAAE,UAAU;GAAO,MAAM;GAAO,UAAU;EAAM;EAC1D,WAAW;GACT,MAAM;GACN,OAAO;GACP,MAAM;GACN,KAAK;GACL,QAAQ;GACR,UAAU;EACZ;EACA,WAAW;GAAE,YAAY;GAAO,MAAM;EAAM;EAC5C,WAAW;EACX,OAAO;EACP,cAAc;EACd,cAAc,EAAE,QAAQ,CAAC,WAAW,QAAQ,EAAE;CAChD;AACF;AAEA,eAAe,sBAAsB,SAA0B,OAAgC;CAC7F,IAAI;EACF,MAAM,QAAQ,OAAO;CACvB,SAAS,cAAc;EACrB,MAAM,IAAI,eACR,CAAC,OAAO,YAAY,GACpB,iEACF;CACF;CACA,MAAM;AACR;AAEA,SAAS,cAAc,SAAsC;CAC3D,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AACrE;AAEA,SAAS,aAAa,OAAe,OAAuB;CAC1D,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,GAC3C,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CACvD,OAAO;AACT;AAEA,SAAS,aAAa,OAA2B,OAAmC;CAClF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,OAAO,aAAa,OAAO,KAAK;AAClC;AAEA,SAAS,eAAe,OAAe,OAAuB;CAC5D,IAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,kBAAkB;CACtF,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAe,OAAuB;CAC7D,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAC1C,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CACvD,OAAO;AACT;AAEA,SAAS,mBAAmB,OAAe,OAAuB;CAChE,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAC1C,MAAM,IAAI,MAAM,GAAG,MAAM,gCAAgC;CAC3D,OAAO;AACT;AAEA,SAAS,eAAe,QAAuC;CAC7D,QAAQ,eAAe;AACzB;AAEA,eAAe,gBACb,QACA,WACY;CACZ,eAAe,MAAM;CACrB,MAAM,SAAS,MAAM,UAAU;CAC/B,eAAe,MAAM;CACrB,OAAO;AACT;;;ACneA,IAAM,kBAAN,cAA8B,MAAM;CAClC,YAAY,SAAiB,SAA+B;EAC1D,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;;AAkDA,SAAgB,uCACd,YAAgD,CAAC,GACf;CAClC,MAAM,0BAAU,IAAI,IAAsC;CAE1D,MAAM,WAA6C;EACjD,SAAS,UAAU,UAAU,CAAC,GAAS;GACrC,IAAI,CAAC,SAAS,MACZ,MAAM,IAAI,gBAAgB,6DAA6D;GAEzF,IAAI,CAAC,QAAQ,WAAW,QAAQ,IAAI,SAAS,IAAI,GAC/C,MAAM,IAAI,gBACR,kDAAkD,SAAS,KAAK,qBAClE;GAEF,QAAQ,IAAI,SAAS,MAAM,QAAQ;EACrC;EACA,IAAI,MAAe;GACjB,OAAO,QAAQ,IAAI,IAAI;EACzB;EACA,IAAI,MAA4C;GAC9C,OAAO,QAAQ,IAAI,IAAI;EACzB;EACA,QAAQ,MAAgC;GACtC,MAAM,WAAW,QAAQ,IAAI,IAAI;GACjC,IAAI,CAAC,UAAU;IACb,MAAM,YAAY,MAAM,KAAK,QAAQ,KAAK,CAAC,CAAC,CAAC,KAAK;IAElD,MAAM,IAAI,gBACR,kDAAkD,KAAK,qBAF1C,UAAU,SAAS,IAAI,gBAAgB,UAAU,KAAK,IAAI,MAAM,IAG/E;GACF;GACA,OAAO;EACT;EACA,QAAkB;GAChB,OAAO,MAAM,KAAK,QAAQ,KAAK,CAAC,CAAC,CAAC,KAAK;EACzC;EACA,YAAwC;GACtC,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK,SAAS,SAAS,QAAQ,IAAI,CAAC;EAC9D;EACA,MAAM,aAAa,MAA6C;GAC9D,OAAO,SAAS,QAAQ,IAAI,CAAC,CAAC,aAAa;EAC7C;CACF;CAEA,KAAK,MAAM,YAAY,WAAW,SAAS,SAAS,QAAQ;CAC5D,OAAO;AACT;;;AAIA,SAAgB,gCACd,UACA,UAC0B;CAC1B,IAAI,OAAO,aAAa,UAAU,OAAO;CACzC,IAAI,CAAC,UACH,MAAM,IAAI,gBACR,+BAA+B,SAAS,+CAC1C;CAEF,OAAO,SAAS,QAAQ,QAAQ;AAClC;;;AAcA,SAAgB,wBACd,UACA,UAA0C,CAAC,GAC5B;CACf,OAAO,EACL,MAAM,OAAO,eAAgE;EAC3E,MAAM,SAAS;GACb,GAAI,QAAQ,YAAY,CAAC;GACzB,GAAG,8BAA8B,aAAa;GAC9C,GAAI,QAAQ,mBAAmB,aAAa,KAAK,CAAC;EACpD;EACA,IAAI,OAAO,YAAY,KAAA,GACrB,MAAM,IAAI,gBACR,2BAA2B,SAAS,KAAK,wEAC3C;EAGF,OAAO,6BAA6B,MADV,SAAS,OAAO,MAAqC,GAC9B,EAC/C,sBAAsB,QAAQ,wBAAwB,KACxD,CAAC;CACH,EACF;AACF;;;AAoBA,SAAgB,wBACd,QACA,UAAwC,CAAC,GACf;CAC1B,MAAM,eAAe,QAAQ,QAAQ;CACrC,OAAO;EACL,MAAM;EACN,cAAc,YAAY;GACxB,IAAI,QAAQ,cACV,OAAO,OAAO,QAAQ,iBAAiB,aACnC,QAAQ,aAAa,IACrB,QAAQ;GAEd,OAAO,iCAAiC,EACtC,eAAe,QAAQ,mBAAmB,KAAA,EAC5C,CAAC;EACH;EACA,GAAI,QAAQ,kBAAkB,EAAE,iBAAiB,QAAQ,gBAAgB,IAAI,CAAC;EAC9E,MAAM,OAAO,OAA+D;GAC1E,MAAM,gBACJ,QAAQ,iBAAiB,KAAK,KAC7B,MAAM,8BACL,OACA,QAAQ,kBAAkB,YAC1B,QAAQ,cACV;GAEF,OAAO,6BAA6B,MADlB,OAAO,OAAO,aAAa,GACJ,cAAc,MAAM;EAC/D;EACA,GAAI,OAAO,MAAM,IACb,EACE,MAAM,IAAI,IAA8C;GACtD,MAAM,MAAM,MAAM,OAAO,IAAI,EAAE;GAC/B,OAAO,MAAM,6BAA6B,KAAK,cAAc,MAAM,IAAI;EACzE,EACF,IACA,CAAC;EACL,GAAI,QAAQ,MAAM,IACd,EACE,MAAM,KAAK,OAAmE;GAE5E,QAAO,MADa,OAAO,KAAK,OAAO,eAAe,EAAA,CACzC,KAAK,SAAS;IACzB,IAAI,OAAO,IAAI,EAAE;IACjB,UAAU;IACV,MAAM,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,KAAA;IAChD,QAAQ,kBAAkB,cAAc,GAAG,CAAC;IAC5C,UAAU,gBAAgB,GAAG;GAC/B,EAAE;EACJ,EACF,IACA,CAAC;CACP;AACF;;;AAcA,SAAgB,mBACd,UACA,UAAmC,CAAC,GACV;CAC1B,QAAQ,MAAM,QAAQ,uBAAuB,UAAU,KAAK,SAAS,KAAK,OAAO;AACnF;AAEA,SAAS,uBACP,UACA,SACA,KACA,SACmB;CACnB,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,yBAAyB;EAC7B,IAAI,IAAI,OAAO,SAAS,WAAW,MAAM;CAC3C;CACA,iBAAiB;CACjB,IAAI,CAAC,IAAI,OAAO,SAAS,IAAI,OAAO,iBAAiB,SAAS,kBAAkB,EAAE,MAAM,KAAK,CAAC;CAE9F,IAAI;CACJ,IAAI;CAEJ,OAAO;EACL,SAAS,QAAQ,WAAY,SAAS;EACtC,QAAQ,MAAM,QAAmC;GAC/C,OAAO,uBAAuB;IAC5B;IACA;IACA;IACA;IACA;IACA;IACA,gBAAgB,QAAQ;KACtB,cAAc;IAChB;IACA,aAAa,SAAS;KACpB,WAAW;IACb;GACF,CAAC;EACH;EACA,MAAM,SAAS,QAAyC;GACtD,WAAW,MAAM;GACjB,MAAM,aAAa,UAAU;GAC7B,OAAO,EAAE,WAAW,KAAK;EAC3B;EACA,iBAA0C;GACxC,IAAI,CAAC,UACH,MAAM,IAAI,gBACR,sBAAsB,SAAS,KAAK,+CACtC;GAEF,OAAO;EACT;CACF;AACF;AAaA,gBAAgB,uBACd,MAC2B;CAC3B,MAAM,UAAU,KAAK,IAAI;CACzB,MAAM,SAAS,kBAAkB,KAAK,QAAQ,KAAK,WAAW,MAAM;CACpE,MAAM,cAAc,MAAM,KAAK,SAAS,OAAO;EAC7C,GAAI,KAAK,QAAQ,YAAY,CAAC;EAC9B,SAAS,KAAK;EACd,QAAQ;CACV,CAAC;CACD,KAAK,cAAc,WAAW;CAE9B,MAAM,OACJ,KAAK,QAAQ,aAAa,KAAK,MAAM,KAAK,OAAO,KAAK,gBAAgB,KAAK,MAAM,MAAM;CACzF,MAAM,SAAkC,CAAC;CACzC,MAAM,SAAS,eAAe;CAC9B,IAAI,MAAM;CACV,IAAI,OAAO;CACX,IAAI,WAAW;CACf,IAAI;EACF,WAAW,MAAM,SAAS,YAAY,OAAO;GAAE,GAAG;GAAM,QAAQ;EAAO,CAAC,GAAG;GACzE,OAAO,KAAK,KAAK;GACjB,QAAQ,yBAAyB,KAAK;GACtC,MAAM,QAAQ,0BAA0B,KAAK;GAC7C,IAAI,MAAM,SAAS,MAAM,QAAQ;IAC/B,OAAO,SAAS,MAAM;IACtB,OAAO,UAAU,MAAM;IACvB,MAAM;KAAE,MAAM;KAAU,OAAO,MAAM;KAAO,QAAQ,MAAM;IAAO;GACnE;GACA,IAAI,MAAM,KAAK;IACb,OAAO,MAAM;IACb,MAAM;KAAE,MAAM;KAAQ,KAAK,MAAM;IAAI;GACvC;GACA,IAAI,2BAA2B,KAAK,GAAG,WAAW;EACpD;EACA,KAAK,KAAK,QAAQ,wBAAwB,SAAS,CAAC,UAClD,MAAM,IAAI,gBACR,sBAAsB,KAAK,SAAS,KAAK,4DAC3C;EAEF,MAAM,EAAE,MAAM,YAAY;EAC1B,MAAM,SAAS,iBAAiB,QAAQ,IAAI;EAC5C,MAAM,QAAe;GACnB,YAAY;GACZ;GACA;GACA,IAAI,KAAK,IAAI,IAAI;EACnB;EACA,KAAK,WAAW;GACd,QAAQ,WAAW,YAAY,KAAK,SAAS,QAAQ,MAAM;GAC3D,KAAK;GACL;EACF,CAAC;CACH,UAAU;EACR,IAAI,KAAK,QAAQ,mBAAmB,MAAM,MAAM,YAAY,UAAU;CACxE;AACF;AAEA,SAAS,8BACP,SACsC;CACtC,MAAM,UAAU,SAAS,SAAS;CAClC,MAAM,UAAU,SAAS,SAAS;CAClC,OAAO;EAGL,GAAI,YAAY,KAAA,IAAY,EAAE,SAAS,wBAAwB,OAAO,EAAE,IAAI,CAAC;EAC7E,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAC7B,WAAW;GACT,GAAI,SAAS,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;GACnE,GAAI,SAAS,KAAK,MAAM,EAAE,SAAS,QAAQ,IAAI,IAAI,IAAI,CAAC;GACxD,GAAI,SAAS,KAAK,MAAM,EAAE,QAAQ,QAAQ,IAAI,IAAI,IAAI,CAAC;EACzD;EACA,GAAI,SAAS,YAAY,EAAE,WAAW,QAAQ,UAA6B,IAAI,CAAC;EAChF,GAAI,SAAS,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC3C,GAAI,SAAS,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;EACvD,GAAI,SAAS,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;EAC1D,GAAI,SAAS,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;EAC9C,GAAI,SAAS,iBAAiB,EAAE,gBAAgB,QAAQ,eAAe,IAAI,CAAC;EAC5E,iBAAiB,EAAE,sBAAsB,WAAW,CAAC,EAAE;CACzD;AACF;AAEA,eAAe,8BACb,OACA,gBACA,gBAC+B;CAC/B,MAAM,cAAe,MAAM,WAAW;CACtC,MAAM,YAAY,MAAM,aAAa,CAAC;CACtC,MAAM,cAAc,gCAAgC,SAAS;CAC7D,MAAM,kBAAkB,MAAM,iBAAiB;CAC/C,MAAM,OACJ,mBAAmB,OAAO,oBAAoB,WACzC,EAAE,GAAI,gBAAyC,IAC/C,CAAC;CACR,yBAAyB,MAAM,OAAO;CACtC,yBAA0B,KAA+B,OAAO;CAChE,MAAM,UAAU,MAAM,4BAA4B,MAAM,SAAS,cAAc;CAC/E,MAAM,EAAE,SAAS,cAAc,GAAG,gBAAgB,KAAK,WAAW,CAAC;CACnE,OAAO;EACL,GAAG;EACH,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;EACrC,GAAI,UAAU,UAAU,EAAE,KAAK;GAAE,KAAK,UAAU;GAAS,KAAK,UAAU;EAAO,EAAE,IAAI,CAAC;EACtF,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAA+C,IAAI,CAAC;EAC7F,GAAI,MAAM,MAAM,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC;EACtC,GAAI,MAAM,QAAQ,MAAM,OAAO,IAAI,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;EACjE,GAAI,MAAM,WAAW,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;EACrD,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;EACzC,GAAI,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;EACvE,SAAS;GACP,GAAG;GACH,MAAM;GAGN,SAAS,wBAAwB,OAAO;EAC1C;CACF;AACF;AAEA,SAAS,yBAAyB,SAA2D;CAC3F,IACE,YAAY,KAAA,MACX,CAAC,MAAM,QAAQ,OAAO,KACrB,QAAQ,MAAM,WAAW,OAAO,WAAW,YAAY,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,IAEnF,MAAM,IAAI,gBACR,sFACF;AAEJ;AAEA,SAAS,gCACP,WACoB;CACpB,IACE,UAAU,gBAAgB,KAAA,KAC1B,UAAU,UAAU,KAAA,KACpB,UAAU,gBAAgB,UAAU,OAEpC,MAAM,IAAI,gBACR,oGACF;CAEF,OAAO,UAAU,eAAe,UAAU;AAC5C;AAEA,eAAe,4BACb,SACA,gBACuB;CACvB,IAAI,OAAO,YAAY,UAAU,OAAO;CACxC,IAAI,CAAC,gBACH,MAAM,IAAI,gBACR,kEAAkE,QAAQ,oDAC5E;CAEF,OAAO,eAAe,OAAO;AAC/B;AAEA,SAAS,6BACP,aACA,SACiB;CAqGjB,OAAO;EAnGL,IAAI,YAAY;EAChB,MAAM,YAAY;EAClB,QAAQ;EACR,MAAM,UAAyB;GAC7B,MAAM,YAAY,UAAU;EAC9B;EACA,OAAO,aACL,SACA,eAC8B;GAC9B,IAAI,WAAW;GACf,MAAM,QAAQ,oBAAoB,SAAS,aAAa;GACxD,WAAW,MAAM,SAAS,YAAY,OAAO,KAAK,GAAG;IACnD,IAAI,2BAA2B,KAAK,GAAG,WAAW;IAClD,MAAM,aAAa,kBAAkB,KAAK;IAC1C,IAAI,YAAY,MAAM;IACtB,MAAM,iCAAiC,KAAK;GAC9C;GACA,IAAI,QAAQ,wBAAwB,CAAC,UACnC,MAAM,IAAI,gBACR,2BAA2B,YAAY,SAAS,4DAClD;EAEJ;EACA,MAAM,OACJ,SACA,eACuB;GACvB,MAAM,SAAkC,CAAC;GACzC,IAAI,OAAO;GACX,IAAI;GACJ,IAAI,WAAW;GACf,WAAW,MAAM,SAAS,YAAY,OAAO,oBAAoB,SAAS,aAAa,CAAC,GAAG;IACzF,OAAO,KAAK,KAAK;IACjB,IAAI,2BAA2B,KAAK,GAAG,WAAW;IAClD,QAAQ,yBAAyB,KAAK;IACtC,QAAQ,gBAAgB,OAAO,MAAM,KAAK;GAC5C;GACA,IAAI,QAAQ,wBAAwB,CAAC,UACnC,MAAM,IAAI,gBACR,2BAA2B,YAAY,SAAS,4DAClD;GAEF,OAAO;IACL,UAAU,iBAAiB,QAAQ,IAAI,CAAC,CAAC;IACzC,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;GAC3B;EACF;EACA,GAAI,YAAY,YAAY,YAAY,UACpC,EACE,MAAM,eAAe,SAAqC,eAA+B;GACvF,MAAM,UAAU,MAAM,YAAY,WAChC,oBAAoB,SAAS,aAAa,CAC5C;GACA,IAAI,CAAC,SACH,MAAM,IAAI,gBAAgB,uDAAuD;GACnF,OAAO,oCAAoC,OAAO;EACpD,EACF,IACA,CAAC;EACL,GAAI,YAAY,UACZ,EACE,QAAQ,IAAY;GAClB,OAAO,+BAA+B,YAAY,UAAU,EAAE,CAAC;EACjE,EACF,IACA,CAAC;EACL,GAAI,YAAY,OAAO,EAAE,MAAM,YAAY,KAAK,KAAK,WAAW,EAAE,IAAI,CAAC;EACvE,GAAI,YAAY,QAAQ,EAAE,OAAO,YAAY,MAAM,KAAK,WAAW,EAAE,IAAI,CAAC;EAC1E,GAAI,YAAY,OACZ,EACE,MAAM,YAAY,KAAK,KAAK,WAAW,EACzC,IACA,CAAC;EACL,GAAI,YAAY,aACZ,EACE,MAAM,WAAW,mBAAuC;GACtD,MAAM,aAAa,MAAM,YAAY,aAAa,iBAAiB;GACnE,OAAO;IAAE,cAAc,YAAY;IAAI,IAAI,YAAY;GAAG;EAC5D,EACF,IACA,CAAC;EACL,GAAI,YAAY,OACZ,EACE,MAAM,KAAK,cAAsB,aAA2B;GAC1D,MAAM,SAAS,MAAM,YAAY,OAAO,EAAE,IAAI,aAAa,GAAG,WAAW;GACzE,IAAI,CAAC,QACH,MAAM,IAAI,gBAAgB,uDAAuD;GACnF,OAAO,6BAA6B,QAAQ,OAAO;EACrD,EACF,IACA,CAAC;EACL,MAAM,SAAwB;GAC5B,MAAM,YAAY,UAAU;EAC9B;CAEO;AACX;AAEA,SAAS,6BACP,KACA,cACA,QACkB;CAyElB,OAAO;EAvEL,IAAI,OAAO,IAAI,EAAE;EACjB,UAAU;EACV,GAAI,OAAO,IAAI,SAAS,WAAW,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;EACzD,MAAM,SAA0C;GAC9C,MAAM,aAAa,GAAG;GACtB,OAAO,kBAAkB,cAAc,GAAG,CAAC;EAC7C;EACA,OAAO,OAAO,OAA6D;GACzE,WAAW,MAAM,SAAS,IAAI,aAC5B,oBAAoB,KAAK,GACzB,2BAA2B,KAAK,CAClC,GACE,MAAM,iCAAiC,KAAK;EAEhD;EACA,GAAI,kBAAkB,GAAG,IACrB,EACE,MAAM,SAAS,OAAiD;GAK9D,OAAO,8BAA8B,MAJZ,IAAI,eAC3B,oBAAoB,KAAK,GACzB,2BAA2B,KAAK,CAClC,GACiD,YAAY;EAC/D,EACF,IACA,CAAC;EACL,GAAI,WAAW,GAAG,IACd,EACE,QAAQ,IAA0B;GAChC,OAAO,6BAA6B,IAAI,QAAQ,EAAE,CAAC;EACrD,EACF,IACA,CAAC;EACL,GAAI,QAAQ,GAAG,IAAI,EAAE,MAAM,IAAI,KAAK,KAAK,GAAG,EAAE,IAAI,CAAC;EACnD,GAAI,SAAS,GAAG,IAAI,EAAE,OAAO,IAAI,MAAM,KAAK,GAAG,EAAE,IAAI,CAAC;EACtD,GAAI,QAAQ,GAAG,IACX,EACE,MAAM,KAAK,SAAiB,SAA4C;GACtE,OAAO,gCAAgC,MAAM,IAAI,KAAK,SAAS,OAAgB,CAAC;EAClF,EACF,IACA,CAAC;EACL,MAAM,WAAW,SAAqD;GAIpE,OAAO;IACL,KAAI,MAJe,IAAI,SAAS,EAChC,GAAI,SAAS,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,IAAI,CAAC,EAClD,CAAC,EAAA,CAEY;IACX,UAAU;IACV,GAAI,SAAS,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;GAC5D;EACF;EACA,MAAM,KAAK,YAA2B,SAAkD;GAOtF,OAAO,6BAA6B,MANf,OAAO,OAAO;IACjC,cAAc,WAAW;IACzB,eAAe,OAAO,IAAI,EAAE;IAC5B,GAAI,SAAS,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;IAC9C,GAAI,SAAS,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;GAC5D,CAAC,GAC2C,cAAc,MAAM;EAClE;EACA,MAAM,YAAoC;GACxC,OAAO,+BAA+B,OAAO,oBAAoB,GAAG,GAAG,GAAG;EAC5E;EACA,MAAM,UAAyB;GAC7B,MAAM,aAAa,GAAG;EACxB;EACA,MAAM,UAAyB;GAC7B,MAAM,WAAW,GAAG;EACtB;CAEe;AACnB;AAEA,SAAS,6BAA6B,SAA2C;CAC/E,OAAO;EACL,IAAI,QAAQ;EACZ,MAAM,SAA6C;GACjD,MAAM,SAAS,MAAM,QAAQ,OAAO;GACpC,IAAI,CAAC,QAAQ,OAAO;GACpB,OAAO,yBAA0B,OAAgC,MAAM;EACzE;EACA,OAAO,OAAO,SAG2B;GACvC,WAAW,MAAM,SAAS,QAAQ,OAAO,OAAO,GAC9C,MAAM,iCAAiC,KAAK;EAChD;EACA,MAAM,SAAmC;GACvC,OAAO,gCAAgC,MAAM,QAAQ,OAAO,CAAC;EAC/D;EACA,MAAM,OAAO,OAAiD;GAC5D,OAAO,gCACL,MAAM,QAAQ,OAAO,oBAAoB,KAAK,GAAG,2BAA2B,KAAK,CAAC,CACpF;EACF;EACA,SAAwB;GACtB,OAAO,QAAQ,UAAU,CAAC,CAAC,WAAW,KAAA,CAAS;EACjD;CACF;AACF;AAEA,SAAS,+BAA+B,SAAuD;CAC7F,IAAI,CAAC,SAAS,MAAM,IAAI,gBAAgB,iDAAiD;CACzF,OAAO;EACL,IAAI,QAAQ;EACZ,MAAM,SAAS;GACb,MAAM,SAAS,MAAM,QAAQ,OAAO;GACpC,IAAI,CAAC,QAAQ,OAAO;GACpB,OAAO;IACL,IAAI,QAAQ;IACZ,QAAQ,2CAA2C,MAAM;GAC3D;EACF;EACA,OAAO,OAAO,SAGmB;GAC/B,WAAW,MAAM,SAAS,QAAQ,OAAO,OAAO,GAC9C,MAAM,iCAAiC,KAAK;EAChD;EACA,MAAM,SAAgC;GACpC,OAAO,gCAAgC,MAAM,QAAQ,OAAO,CAAC;EAC/D;EACA,MAAM,OACJ,SACA,SACuB;GACvB,OAAO,gCACL,MAAM,QAAQ,OAAO,oBAAoB,SAAS,OAAO,CAAC,CAC5D;EACF;EACA,MAAM,YAAY;GAChB,MAAM,QAAQ,OAAO;GACrB,OAAO,EAAE,WAAW,KAAK;EAC3B;CACF;AACF;AAEA,SAAS,2CACP,QAC6D;CAC7D,QAAQ,QAAR;EACE,KAAK;EACL,KAAK,gBACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,KAAK,aACH,OAAO;EACT,KAAK,aACH,OAAO;EAET,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,WACH,OAAO;CACX;AACF;AAEA,SAAS,gCAAgC,QAAuC;CAC9E,OAAO;EACL,UAAU,OAAO;EACjB,SAAS,OAAO;EAChB,QAAQ,OAAO,UAAU,YAAY;EACrC,YAAY;EACZ,GAAI,OAAO,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;EAC9C,GAAI,OAAO,QACP;GACE,OAAO;IACL,aAAa,OAAO,MAAM;IAC1B,cAAc,OAAO,MAAM;GAC7B;GACA,GAAI,OAAO,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,MAAM,KAAK;EAC1E,IACA,CAAC;CACP;AACF;AAEA,SAAS,iCAAiC,OAA4C;CACpF,MAAM,OACJ,MAAM,QAAQ,OAAO,MAAM,SAAS,WAC/B,MAAM,OACN,CAAC;CACR,OAAO;EACL,MAAM,OAAO,MAAM,IAAI;EACvB;EACA,GAAI,MAAM,KAAK,EAAE,IAAI,MAAM,GAAG,IAAI,CAAC;EACnC,OAAO,mBAAmB,IAAI;EAC9B,eAAe;CACjB;AACF;AAEA,SAAS,iCAAiC,OAA4C;CACpF,OAAO;EACL,MAAM,MAAM;EACZ,MAAM;GACJ,GAAG,MAAM;GACT,GAAI,MAAM,QAAQ,EAAE,OAAO,eAAe,MAAM,KAAK,EAAE,IAAI,CAAC;EAC9D;EACA,GAAI,MAAM,KAAK,EAAE,IAAI,MAAM,GAAG,IAAI,CAAC;CACrC;AACF;AAEA,SAAS,kBAAkB,OAAwD;CACjF,IAAI,CAAC,MAAM,SAAS,YAAY,MAAM,IAAI,GAAG,OAAO,KAAA;CACpD,MAAM,QAAQ,eAAe,MAAM,KAAK;CACxC,IACE,MAAM,gBAAgB,KAAA,KACtB,MAAM,iBAAiB,KAAA,KACvB,MAAM,iBAAiB,KAAA,GAEvB;CAEF,OAAO;EAAE,MAAM;EAAY,MAAM;CAAM;AACzC;AAEA,SAAS,eAAe,OAAuD;CAC7E,OAAO;EACL,aAAa,MAAM;EACnB,cAAc,MAAM;EACpB,cAAc,MAAM;CACtB;AACF;AAEA,SAAS,oBACP,SACA,SACgB;CAChB,OAAO;EACL,GAAI,OAAO,YAAY,WAAW,EAAE,QAAQ,QAAQ,IAAI,EAAE,OAAO,QAAQ;EACzE,GAAI,SAAS,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;EAC7D,GAAI,SAAS,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EACjD,GAAI,SAAS,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;EAC7D,GAAI,SAAS,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;EACnE,GAAI,SAAS,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;EACnE,GAAI,SAAS,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACpD,GAAI,SAAS,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EAClE,GAAI,SAAS,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;EACvD,GAAI,SAAS,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACpD,GAAI,SAAS,UAAU,EAAE,iBAAiB,EAAE,SAAS,QAAQ,QAAQ,EAAE,IAAI,CAAC;CAC9E;AACF;AAEA,SAAS,oBAAoB,OAAmD;CAC9E,IAAI,MAAM,OAAO,OAAO,MAAM,MAAM,IAAI,uBAAuB;CAC/D,OAAO,MAAM,UAAU;AACzB;AAEA,SAAS,wBAAwB,MAAkC;CACjE,IAAI,KAAK,SAAS,UAAU,KAAK,SAAS,SAAS,OAAO;CAC1D,IAAI,KAAK,YAAY,KAAA,KAAa,KAAK,SAAS,KAAA,GAC9C,MAAM,IAAI,gBACR,sGACF;CAEF,IAAI,CAAC,KAAK,YAAY,CAAC,KAAK,KAC1B,MAAM,IAAI,gBAAgB,gEAAgE;CAE5F,OAAO;EACL,MAAM;EACN,UAAU,KAAK;EACf,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;EACtD,KAAK,KAAK;CACZ;AACF;AAEA,SAAS,2BAA2B,OAAsC;CACxE,OAAO;EACL,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;EACxD,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EAC5C,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;EACxD,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;EAClD,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EAC/C,GAAI,MAAM,cAAc,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;EAC9D,GAAI,MAAM,cAAc,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;EAC9D,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EAC/C,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;CAC/D;AACF;AAEA,SAAS,gBAAgB,MAAe,QAAqC;CAC3E,OAAO;EAAE,QAAQ,aAAa,IAAI;EAAG;CAAO;AAC9C;AAEA,SAAS,aAAa,MAAuB;CAC3C,IAAI,OAAO,SAAS,UAAU,OAAO;CACrC,IAAI,QAAQ,OAAO,SAAS,UAAU;EACpC,MAAM,SAAS;EACf,KAAK,MAAM,OAAO;GAAC;GAAU;GAAW;GAAQ;EAAS,GACvD,IAAI,OAAO,OAAO,SAAS,UAAU,OAAO,OAAO;CAEvD;CACA,OAAO,KAAK,UAAU,IAAI;AAC5B;AAEA,SAAS,iBACP,QACA,cACsD;CACtD,KAAK,IAAI,IAAI,OAAO,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG;EAC9C,MAAM,QAAQ,OAAO;EACrB,MAAM,OAAO,QAAQ,mBAAmB,MAAM,IAAI,IAAI,KAAA;EACtD,IAAI,SAAS,KAAA,GAAW,OAAO;GAAE,SAAS;GAAM;EAAO;CACzD;CACA,OAAO;EAAE,SAAS;EAAc;CAAO;AACzC;AAEA,SAAS,yBAAyB,OAAsC;CACtE,IACE,OAAO,MAAM,eAAe,YAC5B,MAAM,cACN,MAAM,WAAW,SAAS,wBAE1B,OAAO,OAAO,MAAM,WAAW,UAAU,WAAW,MAAM,WAAW,QAAQ;CAE/E,MAAM,OAAO,MAAM;CACnB,KAAK,MAAM,OAAO;EAAC;EAAS;EAAS;EAAW;CAAM,GACpD,IAAI,OAAO,KAAK,SAAS,YAAY,CAAC,2BAA2B,KAAK,GAAG,OAAO,KAAK;CAEvF,OAAO;AACT;AAEA,SAAS,mBAAmB,MAAmD;CAC7E,KAAK,MAAM,OAAO;EAAC;EAAa;EAAQ;EAAY;EAAiB;CAAS,GAC5E,IAAI,OAAO,KAAK,SAAS,UAAU,OAAO,KAAK;AAGnD;AAEA,SAAS,2BAA2B,OAAuC;CACzE,IAAI,MAAM,SAAS,YAAY,MAAM,SAAS,UAAU,MAAM,SAAS,SAAS,OAAO;CACvF,IAAI,MAAM,KAAK,SAAS,YAAY,KAAK,MAAM,KAAK,SAAS,SAAS,GAAG,OAAO;CAChF,IAAI,MAAM,SAAS,UAAU;EAC3B,MAAM,SAAS,MAAM,KAAK;EAC1B,OAAO,WAAW,eAAe,WAAW,YAAY,WAAW;CACrE;CACA,OAAO;AACT;AAEA,SAAS,YAAY,MAAuB;CAC1C,OAAO,SAAS,cAAc,SAAS,WAAW,SAAS;AAC7D;AAEA,SAAS,0BAA0B,OAIjC;CACA,MAAM,QAAQ,MAAM,SAAS,mBAAmB,MAAM,IAAI;CAC1D,OAAO;EACL,OAAO,aAAa,OAAO,WAAW,KAAK;EAC3C,QAAQ,aAAa,OAAO,YAAY,KAAK;EAC7C,KACE,aAAa,OAAO,IAAI,KACxB,aAAa,MAAM,KAAK,OAAO,KAC/B,aAAa,MAAM,KAAK,YAAY,KACpC;CACJ;AACF;AAEA,SAAS,mBAAmB,MAAuD;CACjF,MAAM,cACJ,KAAK,SAAS,OAAO,KAAK,UAAU,WAC/B,KAAK,QACN,KAAK,cAAc,OAAO,KAAK,eAAe,WAC3C,KAAK,aACN;CACR,MAAM,cACJ,aAAa,YAAY,WAAW,KACpC,aAAa,YAAY,QAAQ,KACjC,aAAa,YAAY,aAAa;CACxC,MAAM,eACJ,aAAa,YAAY,YAAY,KACrC,aAAa,YAAY,SAAS,KAClC,aAAa,YAAY,iBAAiB;CAC5C,MAAM,OACJ,aAAa,YAAY,IAAI,KAC7B,aAAa,YAAY,OAAO,KAChC,aAAa,YAAY,YAAY,KACrC,aAAa,KAAK,OAAO,KACzB,aAAa,KAAK,YAAY;CAChC,IAAI,gBAAgB,KAAA,KAAa,iBAAiB,KAAA,KAAa,SAAS,KAAA,GACtE,OAAO,KAAA;CACT,OAAO;EACL,aAAa,eAAe;EAC5B,cAAc,gBAAgB;EAC9B,GAAI,SAAS,KAAA,IAAY,EAAE,KAAK,IAAI,CAAC;CACvC;AACF;AAEA,SAAS,gBACP,MACA,OACwB;CACxB,IAAI,CAAC,MAAM,OAAO;CAClB,IAAI,CAAC,OAAO,OAAO;CACnB,OAAO;EACL,aAAa,KAAK,cAAc,MAAM;EACtC,cAAc,KAAK,eAAe,MAAM;EACxC,GAAI,KAAK,SAAS,KAAA,KAAa,MAAM,SAAS,KAAA,IAC1C,EAAE,OAAO,KAAK,QAAQ,MAAM,MAAM,QAAQ,GAAG,IAC7C,CAAC;CACP;AACF;AAEA,SAAS,aAAa,OAAoC;CACxD,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ,KAAA;AACvE;AAEA,SAAS,gCAAgC,QAAuC;CAC9E,MAAM,SAAS;CAUf,OAAO;EACL,MATA,OAAO,OAAO,aAAa,WACvB,OAAO,WACP,OAAO,OAAO,SAAS,WACrB,OAAO,OACP,OAAO,OAAO,cAAc,WAC1B,OAAO,YACP;EAIR,SAHc,OAAO,OAAO,YAAY,YAAY,OAAO,UAAU;EAIrE,GAAI,OAAO,OAAO,UAAU,WAAW,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;EAClE,OAAO,mBAAmB,MAAM;CAClC;AACF;AAEA,SAAS,oCAAoC,SAAmD;CAE9F,MAAM,SADY,QAAQ,YAAY,OAAO,OAAO,QAAQ,UAAU,QAAQ,IACnD,yBAAyB,QAAQ,UAAU,MAAM,IAAI;CAChF,OAAO;EACL,WAAW,QAAQ;EACnB;EACA,gBAAgB,QAAQ,UAAU,mBAAmB;CACvD;AACF;AAEA,SAAS,8BAA8B,YAAqB,cAAuC;CACjG,MAAM,SACJ,cAAc,OAAO,eAAe,WAC/B,aACD,KAAA;CACN,MAAM,KAAK,QAAQ,aAAa,QAAQ;CACxC,IAAI,OAAO,OAAO,YAAY,GAAG,WAAW,GAC1C,MAAM,IAAI,gBAAgB,0DAA0D;CAEtF,IAAI,CAAC,QACH,MAAM,IAAI,gBAAgB,8DAA8D;CAE1F,OAAO;EACL;EACA,UAAU;EACV,UAAU;GACR,GAAI,OAAO,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;GACjD,GAAI,OAAO,mBAAmB,KAAA,IAAY,EAAE,gBAAgB,OAAO,eAAe,IAAI,CAAC;EACzF;CACF;AACF;AAEA,SAAS,gCAAgC,QAAuC;CAC9E,MAAM,SAAS;CACf,MAAM,WAAW,aAAa,OAAO,QAAQ,KAAK,aAAa,OAAO,IAAI;CAC1E,IAAI,aAAa,KAAA,GACf,MAAM,IAAI,gBAAgB,qDAAqD;CAEjF,OAAO;EACL;EACA,QAAQ,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;EAC5D,QAAQ,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;CAC9D;AACF;AAEA,SAAS,kBAAkB,QAAyC;CAClE,IAAI,WAAW,aAAa,WAAW,kBAAkB,WAAW,WAAW,OAAO;CACtF,IAAI,WAAW,aAAa,WAAW,YAAY,WAAW,WAAW,OAAO;CAChF,IAAI,WAAW,aAAa,OAAO;CACnC,IAAI,WAAW,aAAa,OAAO;CACnC,OAAO;AACT;AAEA,SAAS,yBAAyB,QAA4C;CAC5E,IAAI,WAAW,eAAe,WAAW,aAAa,OAAO;CAC7D,OAAO,kBAAkB,MAAM;AACjC;AAEA,SAAS,cAAc,KAA+B;CACpD,OAAQ,IAAwC;AAClD;AAEA,SAAS,gBAAgB,KAA2D;CAClF,MAAM,WAAY,IAA0C;CAC5D,OAAO,YAAY,OAAO,aAAa,WAClC,WACD,KAAA;AACN;AAEA,eAAe,aAAa,KAAqC;CAC/D,MAAM,UAAW,IAAqD;CACtE,IAAI,OAAO,YAAY,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC3D;AAEA,eAAe,WAAW,KAAqC;CAC7D,MAAM,YAAa,IAAoD;CACvE,IAAI,OAAO,cAAc,YAAY,MAAM,UAAU,KAAK,GAAG;AAC/D;AAEA,SAAS,+BACP,WACA,KACe;CACf,IAAI,CAAC,WAAW,OAAO;EAAE,MAAM;EAAW,WAAW,OAAO,IAAI,EAAE;CAAE;CACpE,OAAO;EACL,MAAM,UAAU,SAAS,UAAU,UAAU;EAC7C,GAAI,UAAU,YAAY,EAAE,WAAW,UAAU,UAAU,IAAI,EAAE,WAAW,OAAO,IAAI,EAAE,EAAE;EAC3F,GAAI,UAAU,UAAU,EAAE,SAAS,UAAU,QAAQ,IAAI,CAAC;EAC1D,GAAI,UAAU,YAAY,EAAE,WAAW,UAAU,UAAU,IAAI,CAAC;CAClE;AACF;AAEA,SAAS,iCAAiC,SAET;CAC/B,OAAO;EACL,SAAS;GACP,eAAe,QAAQ;GACvB,cAAc;GACd,cAAc;GACd,OAAO;GACP,aAAa;GACb,KAAK;GACL,WAAW;GACX,WAAW;IACT,OAAO;IACP,cAAc;IACd,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,UAAU;GACZ;GACA,OAAO;GACP,OAAO;GACP,eAAe;GACf,YAAY;EACd;EACA,WAAW;GAAE,MAAM;GAAM,QAAQ;GAAM,QAAQ;GAAM,iBAAiB;EAAK;EAC3E,UAAU;GAAE,UAAU;GAAM,MAAM;GAAM,UAAU;EAAK;EACvD,WAAW;GAAE,MAAM;GAAM,OAAO;GAAM,MAAM;GAAM,KAAK;GAAM,QAAQ;GAAM,UAAU;EAAK;EAC1F,WAAW;GAAE,YAAY;GAAM,MAAM;EAAK;EAC1C,WAAW;EACX,OAAO;EACP,cAAc;CAChB;AACF;AAEA,SAAS,kBAAkB,GAAgB,GAA6B;CACtE,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,cAAc,WAAW,MAAM;CACrC,IAAI,EAAE,WAAW,EAAE,SAAS,WAAW,MAAM;MACxC;EACH,EAAE,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;EACjD,EAAE,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CACnD;CACA,OAAO,WAAW;AACpB;AAEA,SAAS,WAAW,QAAgB,OAAwB;CAC1D,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,UAAU,KAAK,KAAK,OAAO,KAAK;CAC7C,QAAQ;EACN,MAAM,OAAO,KAAK;CACpB;CACA,IAAI,OAAO;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,GAAG;EACtC,QAAQ,IAAI,WAAW,CAAC;EACxB,OAAO,KAAK,KAAK,MAAM,QAAU;CACnC;CACA,OAAO,GAAG,OAAO,IAAI,SAAS,EAAA,CAAG,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;AAC/D;AAEA,SAAS,OACP,QACgF;CAChF,OAAO,OAAQ,OAA6B,QAAQ;AACtD;AAEA,SAAS,QACP,QACmF;CACnF,OAAO,OAAQ,OAA8B,SAAS;AACxD;AAEA,SAAS,kBAAkB,KAEzB;CACA,OAAO,OAAQ,IAAqC,mBAAmB;AACzE;AAEA,SAAS,WACP,KACsE;CACtE,OAAO,OAAQ,IAA8B,YAAY;AAC3D;AAEA,SAAS,QAAQ,KAEf;CACA,OAAO,OAAQ,IAA2B,SAAS;AACrD;AAEA,SAAS,SACP,KACkF;CAClF,OAAO,OAAQ,IAA4B,UAAU;AACvD;AAEA,SAAS,QAAQ,KAEf;CACA,OAAO,OAAQ,IAA2B,SAAS;AACrD"}