@tangle-network/agent-runtime 0.128.0 → 0.131.0

package/dist/{protected-model-port-CXVfOUu_.js.map → protected-model-port-48ALLGxT.js.map}

@@ -1 +1 @@
-{"version":3,"file":"protected-model-port-CXVfOUu_.js","names":["isSha256Digest"],"sources":["../src/candidate-execution/exact-process-executor.ts","../src/candidate-execution/protected-model-port.ts"],"sourcesContent":["import { posix } from 'node:path'\nimport { isDeepStrictEqual } from 'node:util'\n\nimport type { TraceStore } from '@tangle-network/agent-eval'\nimport type { AgentCandidateTermination, Sha256Digest } from '@tangle-network/agent-interface'\nimport type {\n  AgentEnvironmentCapabilities,\n  AgentEnvironmentProvider,\n  AgentExactProcess,\n  AgentExactProcessEnvironment,\n  AgentExactProcessLaunch,\n  AgentExactProcessResources,\n  AgentExactProcessStatus,\n} from '@tangle-network/agent-interface/environment-provider'\n\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  immutableCandidateValue,\n  sha256Bytes,\n} from './digest'\nimport {\n  CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV,\n  CANDIDATE_KNOWLEDGE_ROOT_ENV,\n  candidateKnowledgeExecutionPaths,\n} from './knowledge'\nimport type {\n  AgentCandidateExecutorPort,\n  AgentCandidateExecutorRequest,\n  AgentCandidateExecutorStopRequest,\n} from './types'\n\nconst DEFAULT_PROVISION_TIMEOUT_MS = 120_000\nconst DEFAULT_RECOVERY_RETENTION_MS = 15 * 60_000\n\ninterface ExactProcessRunState {\n  environment: AgentExactProcessEnvironment\n  output?: Uint8Array\n  termination?: AgentCandidateTermination\n  runtimeTermination?: AgentCandidateTermination\n  trace?: {\n    runId: string\n    scenarioId: string\n    startedAt: number\n    deadlineAtMs: number\n    timeoutMs: number\n    tags: Record<string, string>\n    written: boolean\n  }\n}\n\nexport interface ExactProcessCandidateExecutorOptions {\n  provider: AgentEnvironmentProvider\n  resources: AgentExactProcessResources\n  provisionTimeoutMs?: number\n  recoveryRetentionMs?: number\n  providerOptions?: Record<string, unknown>\n}\n\n/** Adapt one neutral exact-process provider to Runtime's trusted candidate boundary. */\nexport function exactProcessProviderAsCandidateExecutor(\n  options: ExactProcessCandidateExecutorOptions,\n): AgentCandidateExecutorPort {\n  return new ExactProcessAgentCandidateExecutor(options)\n}\n\nclass ExactProcessAgentCandidateExecutor implements AgentCandidateExecutorPort {\n  private readonly states = new Map<string, ExactProcessRunState>()\n  private readonly exactProcess\n  private readonly resources: AgentExactProcessResources\n  private readonly provisionTimeoutMs: number\n  private readonly recoveryRetentionMs: number\n  private readonly providerOptions?: Record<string, unknown>\n  private capabilitiesPromise?: Promise<AgentEnvironmentCapabilities>\n\n  constructor(private readonly options: ExactProcessCandidateExecutorOptions) {\n    if (!options.provider.exactProcess) {\n      throw new Error(\n        `agent environment provider \"${options.provider.name}\" does not implement exact processes`,\n      )\n    }\n    this.exactProcess = options.provider.exactProcess\n    this.resources = exactResources(options.resources)\n    this.provisionTimeoutMs = positiveInteger(\n      options.provisionTimeoutMs ?? DEFAULT_PROVISION_TIMEOUT_MS,\n      'exact process provision timeout',\n    )\n    this.recoveryRetentionMs = positiveInteger(\n      options.recoveryRetentionMs ?? DEFAULT_RECOVERY_RETENTION_MS,\n      'exact process recovery retention',\n    )\n    this.providerOptions = options.providerOptions\n      ? immutableCandidateValue(options.providerOptions)\n      : undefined\n  }\n\n  async execute(\n    request: AgentCandidateExecutorRequest,\n    context: Parameters<AgentCandidateExecutorPort['execute']>[1],\n  ) {\n    assertSupportedRequest(request)\n    const outcome = request.benchmark.task.outcome\n    if (outcome.kind !== 'output') throw new Error('exact process executor requires an output task')\n    const network = request.executionPlan.value.material.model.access.network\n    const egress =\n      network.mode === 'disabled'\n        ? ({ mode: 'blocked' } as const)\n        : ({ mode: 'strict', allowDomains: [...network.domains] } as const)\n    await this.assertCapability(egress.mode)\n    context.signal.throwIfAborted()\n\n    const key = executionKey(request.executionId, request.executionPlan.value.digest)\n    if (this.states.has(key)) throw new Error('candidate execution environment is already active')\n    const image = exactImage(\n      request.executionPlan.value.material.container.image,\n      request.executionPlan.value.material.container.manifestDigest,\n    )\n    const maxLifetimeMs = environmentLifetimeMs(\n      request.hardLimits.timeoutMs,\n      this.recoveryRetentionMs,\n    )\n    const createMaterial = immutableCandidateValue({\n      kind: 'agent-candidate-exact-process-create',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlan.value.digest,\n      image,\n      egress,\n      maxLifetimeMs,\n      provisionTimeoutMs: this.provisionTimeoutMs,\n      resources: this.resources,\n      output: { mediaType: outcome.mediaType, maxBytes: outcome.maxBytes },\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    const createInputDigest = canonicalCandidateDigest(createMaterial)\n    const metadata = immutableCandidateValue({\n      kind: 'agent-candidate-execution',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlan.value.digest,\n      createInputDigest,\n      outputMediaType: outcome.mediaType,\n      outputMaxBytes: outcome.maxBytes,\n    })\n    const environment = await this.exactProcess.create({\n      image,\n      egress,\n      maxLifetimeMs,\n      provisionTimeoutMs: this.provisionTimeoutMs,\n      resources: this.resources,\n      metadata,\n      idempotencyKey: executionIdempotencyKey(\n        request.executionId,\n        request.executionPlan.value.digest,\n      ),\n      signal: context.signal,\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    try {\n      assertExecutionEnvironment(environment, metadata, this.options.provider.name)\n    } catch (error) {\n      try {\n        await environment.destroy()\n      } catch (cleanupError) {\n        throw new AggregateError(\n          [error, cleanupError],\n          'exact process validation and cleanup both failed',\n        )\n      }\n      throw error\n    }\n    const state: ExactProcessRunState = { environment }\n    this.states.set(key, state)\n\n    const existing = await environment.process.list()\n    if (existing.length !== 0) {\n      throw new Error('fresh candidate environment already contains a process')\n    }\n    await materializeRequest(environment, request, context.signal)\n    const launch = exactLaunch(request)\n    const startedAt = Date.now()\n    state.trace = {\n      runId: request.trace.runId,\n      scenarioId: request.benchmark.task.scenario.id,\n      startedAt,\n      deadlineAtMs: context.deadlineAtMs,\n      timeoutMs: request.hardLimits.timeoutMs,\n      tags: {\n        ...request.trace.tags,\n        environmentId: environment.id,\n        environmentProvider: environment.provider,\n      },\n      written: false,\n    }\n    const process = await environment.process.spawn(launch, { signal: context.signal })\n    const outputPromise = collectOutput(process, outcome.maxBytes)\n    void outputPromise.catch(() => undefined)\n    let cancellation: Promise<void> | undefined\n    let processExited = false\n    const cancel = () => {\n      if (!processExited) cancellation ??= stopProcess(process)\n    }\n    context.signal.addEventListener('abort', cancel, { once: true })\n    if (context.signal.aborted) cancel()\n    try {\n      const termination = await process.wait()\n      processExited = true\n      context.signal.removeEventListener('abort', cancel)\n      if (cancellation) await cancellation\n      const status = await process.status()\n      assertTerminalStatus(status, termination)\n      state.output = await awaitOutput(outputPromise, context.signal, context.deadlineAtMs)\n      state.termination = termination\n      await appendExactProcessTrace(state, context.traceStore, status)\n      return { executionId: request.executionId, termination }\n    } finally {\n      context.signal.removeEventListener('abort', cancel)\n    }\n  }\n\n  async stop(\n    request: AgentCandidateExecutorStopRequest,\n    context: Parameters<AgentCandidateExecutorPort['stop']>[1],\n  ): Promise<{ readonly stopped: true }> {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, true)\n    if (!environment) return { stopped: true }\n    let statuses = await environment.process.list()\n    if (statuses.length > 1) {\n      throw new Error('candidate exact process environment contains more than one process')\n    }\n    const status = statuses[0]\n    if (status?.running) {\n      const process = await environment.process.get(status.pid)\n      if (!process) throw new Error('candidate environment lost its running process handle')\n      await stopProcess(process)\n    }\n    context.signal.throwIfAborted()\n    statuses = await environment.process.list()\n    if (statuses.some((entry) => entry.running)) {\n      throw new Error('candidate exact process termination is not proven')\n    }\n    const finalStatus = statuses[0]\n    if (finalStatus) assertTerminalStatus(finalStatus)\n    const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest))\n    if (state) {\n      state.termination = finalStatus?.termination ?? state.termination\n      if (context.reason === 'timeout' && state.trace) {\n        state.runtimeTermination = {\n          kind: 'timeout',\n          timeoutMs: state.trace.timeoutMs,\n        }\n      }\n      await appendExactProcessTrace(state, context.traceStore, finalStatus)\n    }\n    return { stopped: true }\n  }\n\n  async capture(\n    request: AgentCandidateExecutorStopRequest,\n    context: Parameters<AgentCandidateExecutorPort['capture']>[1],\n  ) {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, false)\n    const statuses = await environment.process.list()\n    const status = statuses[0]\n    if (statuses.length !== 1 || !status || status.running) {\n      throw new Error('candidate environment must contain one stopped process before capture')\n    }\n    assertTerminalStatus(status)\n    const process = await environment.process.get(status.pid)\n    if (!process) throw new Error('candidate environment lost its captured process handle')\n    const currentStatus = await process.status()\n    assertTerminalStatus(currentStatus, status.termination)\n    const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest))\n    const output =\n      state?.output ??\n      (await awaitOutput(\n        collectOutput(process, outputSpec(environment).maxBytes),\n        context.signal,\n        Date.now() + this.provisionTimeoutMs,\n      ))\n    context.signal.throwIfAborted()\n    const evidence = canonicalCandidateBytes({\n      kind: 'agent-candidate-exact-process-capture',\n      provider: environment.provider,\n      environmentId: environment.id,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlanDigest,\n      createInputDigest: environment.metadata?.createInputDigest,\n      process: {\n        pid: status.pid,\n        exitCode: status.exitCode,\n        ...(status.exitSignal ? { exitSignal: status.exitSignal } : {}),\n        termination: status.termination,\n      },\n      ...(state?.runtimeTermination ? { runtimeTermination: state.runtimeTermination } : {}),\n      output: { sha256: sha256Bytes(output), byteLength: output.byteLength },\n    })\n    return {\n      taskOutcome: { kind: 'output' as const, bytes: output },\n      evidence,\n    }\n  }\n\n  async dispose(\n    request: AgentCandidateExecutorStopRequest,\n    context: { signal: AbortSignal },\n  ): Promise<{ readonly disposed: true }> {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, true)\n    if (!environment) return { disposed: true }\n    let destroyError: unknown\n    try {\n      await environment.destroy()\n    } catch (error) {\n      destroyError = error\n    }\n    const remaining = await this.exactProcess.get(environment.id)\n    if (remaining) {\n      throw new Error('exact process environment disposal is not proven', { cause: destroyError })\n    }\n    context.signal.throwIfAborted()\n    this.states.delete(executionKey(request.executionId, request.executionPlanDigest))\n    return { disposed: true }\n  }\n\n  private async assertCapability(mode?: 'blocked' | 'strict'): Promise<void> {\n    const pending =\n      this.capabilitiesPromise ?? Promise.resolve(this.options.provider.capabilities())\n    this.capabilitiesPromise = pending\n    let capabilities: AgentEnvironmentCapabilities\n    try {\n      capabilities = await pending\n    } catch (error) {\n      if (this.capabilitiesPromise === pending) this.capabilitiesPromise = undefined\n      throw error\n    }\n    const exact = capabilities.exactProcess\n    if (!exact) {\n      throw new Error(\n        `agent environment provider \"${this.options.provider.name}\" does not declare exact process support`,\n      )\n    }\n    if (mode && !exact.egress.includes(mode)) {\n      throw new Error(\n        `agent environment provider \"${this.options.provider.name}\" does not declare ${mode} exact egress`,\n      )\n    }\n  }\n\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: false,\n  ): Promise<AgentExactProcessEnvironment>\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: true,\n  ): Promise<AgentExactProcessEnvironment | undefined>\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: boolean,\n  ): Promise<AgentExactProcessEnvironment | undefined> {\n    const key = executionKey(request.executionId, request.executionPlanDigest)\n    const active = this.states.get(key)?.environment\n    if (active) return active\n    const metadata = {\n      kind: 'agent-candidate-execution',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlanDigest,\n    }\n    const listed = await this.exactProcess.list({\n      metadata,\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    const matches = listed.filter(\n      (environment) =>\n        environment.provider === this.options.provider.name &&\n        Object.entries(metadata).every(([name, value]) =>\n          isDeepStrictEqual(environment.metadata?.[name], value),\n        ),\n    )\n    if (matches.length > 1) {\n      throw new Error('multiple exact process environments match one candidate execution')\n    }\n    const environment = matches[0]\n    if (!environment) {\n      if (missingIsDeleted) return undefined\n      throw new Error('candidate exact process evidence is unavailable')\n    }\n    if (!isSha256Digest(environment.metadata?.createInputDigest)) {\n      throw new Error('candidate exact process create-input digest is unavailable')\n    }\n    this.states.set(key, { environment })\n    return environment\n  }\n}\n\nasync function appendExactProcessTrace(\n  state: ExactProcessRunState,\n  traceStore: TraceStore,\n  status?: AgentExactProcessStatus,\n): Promise<void> {\n  const trace = state.trace\n  if (!trace || trace.written) return\n  const endedAt = Math.max(trace.startedAt, Math.min(Date.now(), trace.deadlineAtMs))\n  const termination = state.runtimeTermination ?? state.termination ?? status?.termination\n  await traceStore.appendRun({\n    runId: trace.runId,\n    scenarioId: trace.scenarioId,\n    startedAt: trace.startedAt,\n    endedAt,\n    status: termination?.kind === 'exit' && termination.exitCode === 0 ? 'completed' : 'failed',\n    tags: trace.tags,\n  })\n  trace.written = true\n}\n\nfunction assertSupportedRequest(request: AgentCandidateExecutorRequest): void {\n  if (request.benchmark.task.outcome.kind !== 'output') {\n    throw new Error(\n      'exact process candidate executor does not support workspace outcomes; use Pier',\n    )\n  }\n  if (request.executionPlan.value.material.codeKind !== 'disabled' || request.inputs.candidate) {\n    throw new Error('exact process candidate executor does not support code workspaces; use Pier')\n  }\n  if (request.memory.mode !== 'disabled') {\n    throw new Error('exact process candidate executor does not support isolated memory')\n  }\n  const mediaType = request.benchmark.task.outcome.mediaType.toLowerCase()\n  if (\n    !(\n      mediaType.startsWith('text/') ||\n      mediaType === 'application/json' ||\n      mediaType.endsWith('+json')\n    )\n  ) {\n    throw new Error('exact process candidate executor supports only UTF-8 text and JSON outputs')\n  }\n  if (!posix.isAbsolute(request.launch.executable) && !request.launch.env.PATH?.trim()) {\n    throw new Error('exact process candidate executable must be absolute or declare a signed PATH')\n  }\n}\n\nasync function materializeRequest(\n  environment: AgentExactProcessEnvironment,\n  request: AgentCandidateExecutorRequest,\n  signal: AbortSignal,\n): Promise<void> {\n  const knowledgePaths = assertKnowledgeExecutionBinding(request)\n  for (const file of request.inputs.task.files) {\n    await environment.writeFile(beneath(request.roots.taskRoot, file.path), file.bytes, {\n      mode: file.mode,\n      signal,\n    })\n  }\n  const profileRoot =\n    request.executionPlan.value.material.profile.targetWorkspace === 'task'\n      ? request.roots.taskRoot\n      : request.roots.candidateRoot\n  if (!profileRoot) throw new Error('candidate profile targets a missing workspace')\n  for (const file of request.profileActivation.files) {\n    await environment.writeFile(\n      beneath(profileRoot, file.path),\n      Buffer.from(file.content, 'utf8'),\n      { mode: file.mode, signal },\n    )\n  }\n  if (request.knowledge && knowledgePaths) {\n    for (const file of request.knowledge.files) {\n      await environment.writeFile(beneath(knowledgePaths.root, file.path), file.bytes, {\n        mode: file.mode,\n        signal,\n      })\n    }\n    if (request.knowledge.retrievalConfig && knowledgePaths.retrievalConfig) {\n      await environment.writeFile(\n        knowledgePaths.retrievalConfig,\n        request.knowledge.retrievalConfig,\n        { mode: 0o644, signal },\n      )\n    }\n  }\n  if (request.instruction.delivery.kind === 'utf8-file') {\n    await environment.writeFile(request.instruction.delivery.path, request.instruction.bytes, {\n      mode: 0o644,\n      signal,\n    })\n  }\n}\n\nfunction assertKnowledgeExecutionBinding(\n  request: AgentCandidateExecutorRequest,\n): ReturnType<typeof candidateKnowledgeExecutionPaths> | undefined {\n  const knowledge = request.knowledge\n  if (!knowledge) {\n    if (\n      request.launch.env[CANDIDATE_KNOWLEDGE_ROOT_ENV] !== undefined ||\n      request.launch.env[CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV] !== undefined\n    ) {\n      throw new Error('candidate launch declares knowledge paths without verified knowledge')\n    }\n    return undefined\n  }\n  const paths = candidateKnowledgeExecutionPaths(\n    request.roots.taskRoot,\n    knowledge.retrievalConfig !== undefined,\n  )\n  if (\n    request.launch.env[CANDIDATE_KNOWLEDGE_ROOT_ENV] !== paths.root ||\n    request.launch.env[CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV] !== paths.retrievalConfig\n  ) {\n    throw new Error('candidate knowledge paths do not match the signed launch environment')\n  }\n  const reserved = [paths.root, paths.retrievalConfig].filter(\n    (value): value is string => value !== undefined,\n  )\n  const profileRoot =\n    request.executionPlan.value.material.profile.targetWorkspace === 'task'\n      ? request.roots.taskRoot\n      : request.roots.candidateRoot\n  const otherFiles = [\n    ...request.inputs.task.files.map((file) => beneath(request.roots.taskRoot, file.path)),\n    ...(profileRoot\n      ? request.profileActivation.files.map((file) => beneath(profileRoot, file.path))\n      : []),\n    ...(request.instruction.delivery.kind === 'utf8-file'\n      ? [request.instruction.delivery.path]\n      : []),\n  ]\n  if (\n    otherFiles.some((path) =>\n      reserved.some(\n        (reservedPath) =>\n          path === reservedPath ||\n          path.startsWith(`${reservedPath}/`) ||\n          reservedPath.startsWith(`${path}/`),\n      ),\n    )\n  ) {\n    throw new Error('candidate knowledge paths overlap other execution inputs')\n  }\n  return paths\n}\n\nfunction exactLaunch(request: AgentCandidateExecutorRequest): AgentExactProcessLaunch {\n  const instruction = new TextDecoder('utf-8', { fatal: true }).decode(request.instruction.bytes)\n  const base = {\n    executable: request.launch.executable,\n    args: request.launch.args,\n    cwd: request.launch.cwd,\n    env: request.launch.env,\n    timeoutMs: 0,\n  }\n  switch (request.instruction.delivery.kind) {\n    case 'argv-append':\n      return { ...base, args: [...base.args, instruction] }\n    case 'stdin-utf8':\n      return { ...base, stdin: instruction }\n    case 'utf8-file':\n      return base\n  }\n}\n\nasync function collectOutput(process: AgentExactProcess, maxBytes: number): Promise<Uint8Array> {\n  const chunks: Buffer[] = []\n  let byteLength = 0\n  for await (const chunk of process.stdout()) {\n    const bytes = Buffer.from(chunk, 'utf8')\n    byteLength += bytes.byteLength\n    if (byteLength > maxBytes) {\n      let stopError: unknown\n      try {\n        await stopProcess(process)\n      } catch (error) {\n        stopError = error\n      }\n      throw new Error(`candidate output exceeds its ${maxBytes}-byte maximum`, {\n        cause: stopError,\n      })\n    }\n    chunks.push(bytes)\n  }\n  return Uint8Array.from(Buffer.concat(chunks, byteLength))\n}\n\nasync function awaitOutput(\n  output: Promise<Uint8Array>,\n  signal: AbortSignal,\n  deadlineAtMs: number,\n): Promise<Uint8Array> {\n  signal.throwIfAborted()\n  const remainingMs = deadlineAtMs - Date.now()\n  if (remainingMs <= 0) throw new Error('candidate output deadline expired')\n  let timer: ReturnType<typeof setTimeout> | undefined\n  let onAbort: (() => void) | undefined\n  try {\n    return await Promise.race([\n      output,\n      new Promise<never>((_resolve, reject) => {\n        onAbort = () => reject(signal.reason ?? new Error('candidate output cancelled'))\n        signal.addEventListener('abort', onAbort, { once: true })\n        timer = setTimeout(\n          () => reject(new Error('candidate output deadline expired')),\n          remainingMs,\n        )\n      }),\n    ])\n  } finally {\n    if (onAbort) signal.removeEventListener('abort', onAbort)\n    if (timer) clearTimeout(timer)\n  }\n}\n\nasync function stopProcess(process: AgentExactProcess): Promise<void> {\n  const before = await process.status()\n  if (!before.running) return\n  try {\n    await process.kill()\n  } catch (error) {\n    if ((await process.status()).running) throw error\n  }\n  const termination = await process.wait()\n  assertTerminalStatus(await process.status(), termination)\n}\n\nfunction assertTerminalStatus(\n  status: AgentExactProcessStatus,\n  expected?: AgentCandidateTermination,\n): asserts status is AgentExactProcessStatus & { termination: AgentCandidateTermination } {\n  if (status.running || !status.termination) {\n    throw new Error('exact process returned no terminal reason after exit')\n  }\n  if (expected && !isDeepStrictEqual(status.termination, expected)) {\n    throw new Error('exact process wait and status returned different terminal reasons')\n  }\n}\n\nfunction assertExecutionEnvironment(\n  environment: AgentExactProcessEnvironment,\n  metadata: Record<string, unknown>,\n  providerName: string,\n): void {\n  if (!environment.id || environment.provider !== providerName) {\n    throw new Error('exact process provider returned the wrong environment identity')\n  }\n  if (\n    !Object.entries(metadata).every(([name, value]) =>\n      isDeepStrictEqual(environment.metadata?.[name], value),\n    )\n  ) {\n    throw new Error('exact process provider did not persist candidate execution metadata')\n  }\n}\n\nfunction outputSpec(environment: AgentExactProcessEnvironment): { maxBytes: number } {\n  const maxBytes = environment.metadata?.outputMaxBytes\n  if (!Number.isSafeInteger(maxBytes) || Number(maxBytes) < 1) {\n    throw new Error('candidate exact process output bound is unavailable')\n  }\n  return { maxBytes: Number(maxBytes) }\n}\n\nfunction executionKey(executionId: string, executionPlanDigest: Sha256Digest): string {\n  return `${executionId}\\0${executionPlanDigest}`\n}\n\nfunction executionIdempotencyKey(executionId: string, executionPlanDigest: Sha256Digest): string {\n  return `candidate-${canonicalCandidateDigest({\n    kind: 'agent-candidate-execution-identity',\n    executionId,\n    executionPlanDigest,\n  }).slice('sha256:'.length)}`\n}\n\nfunction exactImage(image: string, manifestDigest: Sha256Digest): string {\n  if (isSha256Digest(image)) {\n    if (image !== manifestDigest) {\n      throw new Error('candidate container image conflicts with its resolved manifest')\n    }\n    return image\n  }\n  const marker = image.lastIndexOf('@')\n  if (marker < 0) return `${image}@${manifestDigest}`\n  if (image.slice(marker + 1) !== manifestDigest) {\n    throw new Error('candidate container image conflicts with its resolved manifest')\n  }\n  return image\n}\n\nfunction environmentLifetimeMs(timeoutMs: number, retentionMs: number): number {\n  const total = positiveInteger(timeoutMs, 'candidate execution timeout') + retentionMs\n  if (!Number.isSafeInteger(total)) throw new Error('candidate environment lifetime is too large')\n  return Math.ceil(total / 1_000) * 1_000\n}\n\nfunction exactResources(resources: AgentExactProcessResources): AgentExactProcessResources {\n  if (!Number.isFinite(resources.cpu) || resources.cpu <= 0) {\n    throw new Error('exact process CPU must be positive and finite')\n  }\n  return Object.freeze({\n    cpu: resources.cpu,\n    memoryMb: positiveInteger(resources.memoryMb, 'exact process memory'),\n    diskMb: positiveInteger(resources.diskMb, 'exact process disk'),\n  })\n}\n\nfunction positiveInteger(value: number, label: string): number {\n  if (!Number.isSafeInteger(value) || value < 1)\n    throw new Error(`${label} must be a positive integer`)\n  return value\n}\n\nfunction beneath(root: string, relativePath: string): string {\n  if (posix.isAbsolute(relativePath)) throw new Error('candidate input path must be relative')\n  const path = posix.normalize(relativePath)\n  if (path === '..' || path.startsWith('../')) {\n    throw new Error('candidate input path escapes its execution root')\n  }\n  return posix.join(root, path)\n}\n\nfunction isSha256Digest(value: unknown): value is Sha256Digest {\n  return typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value)\n}\n","import type {\n  AgentCandidateModelAccessNetwork,\n  AgentCandidateResolvedModel,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateDigest, immutableCandidateValue } from './digest'\nimport { assertExactObjectKeys } from './exact-object'\nimport { sealAgentCandidateModelSettlement, usdToNanos } from './model-settlement'\nimport type {\n  AgentCandidateModelLimits,\n  AgentCandidateModelPort,\n  AgentCandidateProtectedModelActivation,\n  AgentCandidateProtectedModelReservation,\n  AgentCandidateProtectedModelSettlement,\n} from './types'\n\nexport type AgentCandidateModelGrantReserveInput = Parameters<\n  AgentCandidateModelPort['reserveGrant']\n>[0]\nexport type AgentCandidateModelGrantActivateInput = Parameters<\n  AgentCandidateModelPort['activateGrant']\n>[0]\nexport type AgentCandidateModelGrantSettleInput = Parameters<\n  AgentCandidateModelPort['settleGrant']\n>[0]\n\n/** Secret-free response from the service's reservation endpoint. */\nexport type AgentCandidateModelGrantReservation = AgentCandidateProtectedModelReservation\n\n/**\n * Narrow transport contract for a service that owns scoped model credentials\n * and the authoritative per-call usage ledger.\n *\n * An HTTP client can bind these methods to control-plane endpoints. Keeping\n * transport out of the runtime prevents parent credentials, endpoint paths,\n * and retry policy from becoming part of the portable candidate contract.\n */\nexport interface AgentCandidateModelGrantClient {\n  reserve(input: AgentCandidateModelGrantReserveInput): Promise<AgentCandidateModelGrantReservation>\n  activate(\n    input: AgentCandidateModelGrantActivateInput,\n  ): Promise<AgentCandidateProtectedModelActivation>\n  settle(\n    input: AgentCandidateModelGrantSettleInput,\n  ): Promise<AgentCandidateProtectedModelSettlement>\n}\n\nexport interface CreateProtectedAgentCandidateModelPortOptions {\n  client: AgentCandidateModelGrantClient\n  /** Catalog/snapshot resolution stays separate from credential issuance. */\n  resolveModel: AgentCandidateModelPort['resolve']\n  /** The only public DNS name candidate processes may reach for inference. */\n  gatewayDomain: string\n  /** Exact environment names the activation endpoint must return, no more or fewer. */\n  activationEnvNames: readonly string[]\n}\n\ninterface RememberedReservation {\n  requestDigest: Sha256Digest\n  responseDigest: Sha256Digest\n  executionId: string\n  preparationId: string\n  grantDigest: Sha256Digest\n  expiresAtMs: number\n  resolved: AgentCandidateResolvedModel\n  limits: AgentCandidateModelLimits\n  maxCostUsdNanos: number\n  activation: 'reserved' | 'activating' | 'activated'\n  settlementDigest?: Sha256Digest\n  settlementReason?: AgentCandidateModelGrantSettleInput['reason']\n}\n\ninterface RememberedSettlement {\n  settlementDigest: Sha256Digest\n  settlementReason: AgentCandidateModelGrantSettleInput['reason']\n  expiresAtMs: number\n}\n\nconst MAX_RECENT_SETTLEMENTS = 4_096\nconst RECOVERED_SETTLEMENT_RETENTION_MS = 15 * 60 * 1_000\n\n/**\n * Bind a protected model-grant service to the immutable candidate runtime.\n *\n * The service remains the authority for expiry, admission, revocation, and\n * metering. This adapter independently checks every response before allowing\n * it to cross into candidate execution or durable receipt finalization.\n */\nexport function createProtectedAgentCandidateModelPort(\n  options: CreateProtectedAgentCandidateModelPortOptions,\n): AgentCandidateModelPort {\n  const gatewayDomain = assertGatewayDomain(options.gatewayDomain)\n  const activationEnvNames = exactEnvironmentNames(options.activationEnvNames)\n  const reservations = new Map<string, RememberedReservation>()\n  const recentSettlements = new Map<string, RememberedSettlement>()\n\n  return {\n    resolve: async (input) => {\n      const request = immutableCandidateValue(input)\n      const resolved = validateResolvedModel(await options.resolveModel(request), request)\n      return immutableCandidateValue(resolved)\n    },\n\n    reserveGrant: async (input) => {\n      pruneExpiredState(reservations, recentSettlements, Date.now())\n      const request = immutableCandidateValue(input)\n      validateReserveInput(request)\n      const requestDigest = canonicalCandidateDigest(request)\n      const key = reservationKey(request.executionId, request.preparationId)\n      if (recentSettlements.has(key)) {\n        throw new Error('protected model reservation is already settled')\n      }\n      const previous = reservations.get(key)\n      if (previous && previous.requestDigest !== requestDigest) {\n        throw new Error('protected model reservation retry changed immutable input')\n      }\n\n      const reservation = validateReservation(\n        await options.client.reserve(request),\n        request,\n        gatewayDomain,\n      )\n      const responseDigest = canonicalCandidateDigest(reservation)\n      if (recentSettlements.has(key)) {\n        throw new Error('protected model reservation completed after the grant was settled')\n      }\n      const recorded = previous ?? reservations.get(key)\n      if (recorded && recorded.requestDigest !== requestDigest) {\n        throw new Error('protected model reservation retry changed immutable input')\n      }\n      if (recorded && recorded.responseDigest !== responseDigest) {\n        throw new Error('protected model reservation retry returned different evidence')\n      }\n      if (!recorded) {\n        reservations.set(key, {\n          requestDigest,\n          responseDigest,\n          executionId: request.executionId,\n          preparationId: request.preparationId,\n          grantDigest: reservation.digest,\n          expiresAtMs: request.expiresAtMs,\n          resolved: immutableCandidateValue(request.resolved),\n          limits: immutableCandidateValue(request.limits),\n          maxCostUsdNanos: usdToNanos(request.limits.maxCostUsd, 'reserved maxCostUsd'),\n          activation: 'reserved',\n        })\n      }\n      return reservation\n    },\n\n    activateGrant: async (input) => {\n      pruneExpiredState(reservations, recentSettlements, Date.now())\n      const request = immutableCandidateValue(input)\n      const key = reservationKey(request.executionId, request.preparationId)\n      if (recentSettlements.has(key)) throw new Error('protected model grant is already settled')\n      const state = reservations.get(key)\n      if (!state) throw new Error('protected model grant was not reserved by this port')\n      assertGrantIdentity(state, request)\n      if (state.settlementDigest) throw new Error('protected model grant is already settled')\n      if (state.activation !== 'reserved') {\n        throw new Error('protected model grant activation is single-use')\n      }\n      if (!Number.isSafeInteger(request.deadlineAtMs) || request.deadlineAtMs <= 0) {\n        throw new Error('protected model activation deadline must be a positive safe integer')\n      }\n      if (request.deadlineAtMs <= Date.now()) {\n        throw new Error('protected model activation deadline must be in the future')\n      }\n      if (request.deadlineAtMs > state.expiresAtMs) {\n        throw new Error('protected model activation deadline exceeds the reserved expiry')\n      }\n      state.activation = 'activating'\n      try {\n        const activation = validateActivation(\n          await options.client.activate(request),\n          state.limits.maxModelCalls === 0 ? [] : activationEnvNames,\n        )\n        if (recentSettlements.has(key) || reservations.get(key) !== state) {\n          throw new Error('protected model grant settled while activation was in flight')\n        }\n        state.activation = 'activated'\n        return activation\n      } catch (error) {\n        state.activation = 'reserved'\n        throw error\n      }\n    },\n\n    settleGrant: async (input) => {\n      const now = Date.now()\n      pruneExpiredState(reservations, recentSettlements, now)\n      const request = immutableCandidateValue(input)\n      const key = reservationKey(request.executionId, request.preparationId)\n      const state = reservations.get(key)\n      if (state) assertGrantIdentity(state, request)\n      const remembered = state ?? recentSettlements.get(key)\n      if (remembered?.settlementReason && remembered.settlementReason !== request.reason) {\n        throw new Error('protected model settlement retry changed the termination reason')\n      }\n\n      const sealed = sealAgentCandidateModelSettlement(await options.client.settle(request), {\n        preparationId: request.preparationId,\n        grantDigest: request.grantDigest,\n        model: request.resolved.model,\n      })\n      if (state) assertWithinReservedLimits(sealed.usage, state)\n\n      const settlementDigest = canonicalCandidateDigest(sealed.value)\n      if (remembered?.settlementDigest && remembered.settlementDigest !== settlementDigest) {\n        throw new Error('protected model settlement retry returned a different final ledger')\n      }\n      if (remembered?.settlementReason && remembered.settlementReason !== request.reason) {\n        throw new Error('protected model settlement retry changed the termination reason')\n      }\n      const expiresAtMs = state?.expiresAtMs ?? now + RECOVERED_SETTLEMENT_RETENTION_MS\n      if (state) {\n        state.settlementDigest = settlementDigest\n        state.settlementReason = request.reason\n      }\n      reservations.delete(key)\n      rememberSettlement(recentSettlements, key, {\n        settlementDigest,\n        settlementReason: request.reason,\n        expiresAtMs,\n      })\n      return sealed.value\n    },\n  }\n}\n\nfunction validateReserveInput(input: AgentCandidateModelGrantReserveInput): void {\n  if (!Number.isSafeInteger(input.expiresAtMs) || input.expiresAtMs <= 0) {\n    throw new Error('protected model reservation expiry must be a positive safe integer')\n  }\n  if (input.expiresAtMs <= Date.now()) {\n    throw new Error('protected model reservation expiry must be in the future')\n  }\n  for (const [name, value] of [\n    ['maxModelCalls', input.limits.maxModelCalls],\n    ['maxInputTokens', input.limits.maxInputTokens],\n    ['maxOutputTokens', input.limits.maxOutputTokens],\n  ] as const) {\n    if (!Number.isSafeInteger(value) || value < 0) {\n      throw new Error(`protected model reservation ${name} must be a nonnegative safe integer`)\n    }\n  }\n  usdToNanos(input.limits.maxCostUsd, 'reserved maxCostUsd')\n}\n\nfunction validateReservation(\n  value: unknown,\n  expected: AgentCandidateModelGrantReserveInput,\n  gatewayDomain: string,\n): AgentCandidateModelGrantReservation {\n  const source = exactRecord(\n    value,\n    ['preparationId', 'digest', 'expiresAtMs', 'enforcedLimits', 'network'],\n    'protected model reservation response',\n  )\n  if (source.preparationId !== expected.preparationId) {\n    throw new Error('protected model reservation response changed preparation identity')\n  }\n  if (!isSha256Digest(source.digest)) {\n    throw new Error('protected model reservation response has an invalid digest')\n  }\n  if (source.expiresAtMs !== expected.expiresAtMs) {\n    throw new Error('protected model reservation response changed expiry')\n  }\n  exactRecord(\n    source.enforcedLimits,\n    ['maxModelCalls', 'maxInputTokens', 'maxOutputTokens', 'maxCostUsd'],\n    'protected model reservation enforced limits',\n  )\n  if (\n    canonicalCandidateDigest(source.enforcedLimits) !== canonicalCandidateDigest(expected.limits)\n  ) {\n    throw new Error('protected model reservation response changed enforced limits')\n  }\n\n  const network = validateReservationNetwork(\n    source.network,\n    expected.limits.maxModelCalls,\n    gatewayDomain,\n  )\n  return immutableCandidateValue({\n    preparationId: source.preparationId,\n    digest: source.digest,\n    expiresAtMs: source.expiresAtMs,\n    enforcedLimits: source.enforcedLimits,\n    network,\n  }) as AgentCandidateModelGrantReservation\n}\n\nfunction validateReservationNetwork(\n  value: unknown,\n  maxModelCalls: number,\n  gatewayDomain: string,\n): AgentCandidateModelAccessNetwork {\n  if (maxModelCalls === 0) {\n    const source = exactRecord(value, ['mode'], 'protected model reservation network')\n    if (source.mode !== 'disabled') {\n      throw new Error('zero-call protected model reservation must disable gateway access')\n    }\n    return { mode: 'disabled' }\n  }\n\n  const source = exactRecord(value, ['mode', 'domains'], 'protected model reservation network')\n  if (source.mode !== 'gateway-only') {\n    throw new Error('protected model reservation must allow only its model gateway')\n  }\n  if (\n    !Array.isArray(source.domains) ||\n    source.domains.length !== 1 ||\n    source.domains[0] !== gatewayDomain\n  ) {\n    throw new Error('protected model reservation returned an unexpected gateway domain')\n  }\n  return { mode: 'gateway-only', domains: [gatewayDomain] }\n}\n\nfunction validateActivation(\n  value: unknown,\n  expectedNames: readonly string[],\n): AgentCandidateProtectedModelActivation {\n  const source = exactRecord(value, ['env'], 'protected model activation response')\n  const env = record(source.env, 'protected model activation environment')\n  const actualNames = Object.keys(env).sort()\n  if (\n    actualNames.length !== expectedNames.length ||\n    actualNames.some((name, index) => name !== expectedNames[index])\n  ) {\n    throw new Error('protected model activation returned unexpected environment names')\n  }\n  const detached: Record<string, string> = Object.create(null) as Record<string, string>\n  for (const name of expectedNames) {\n    const value = env[name]\n    if (typeof value !== 'string' || value.length < 8 || value.length > 65_536) {\n      throw new Error(`protected model activation ${name} must be a non-empty protected value`)\n    }\n    detached[name] = value\n  }\n  return Object.freeze({ env: Object.freeze(detached) })\n}\n\nfunction validateResolvedModel(\n  value: unknown,\n  expected: Parameters<AgentCandidateModelPort['resolve']>[0],\n): AgentCandidateResolvedModel {\n  const source = exactRecord(\n    value,\n    ['requested', 'provider', 'model', 'snapshot', 'reasoningEffort'],\n    'resolved candidate model',\n  )\n  if (source.requested !== expected.requested) {\n    throw new Error('model resolver changed the evaluator-owned request')\n  }\n  if (source.reasoningEffort !== expected.reasoningEffort) {\n    throw new Error('model resolver changed the evaluator-owned reasoning effort')\n  }\n  for (const name of ['requested', 'provider', 'model', 'snapshot'] as const) {\n    if (typeof source[name] !== 'string' || source[name].length === 0) {\n      throw new Error(`resolved candidate model ${name} must be non-empty`)\n    }\n  }\n  return source as unknown as AgentCandidateResolvedModel\n}\n\nfunction assertGrantIdentity(\n  expected: RememberedReservation,\n  actual: AgentCandidateModelGrantActivateInput | AgentCandidateModelGrantSettleInput,\n): void {\n  if (\n    actual.executionId !== expected.executionId ||\n    actual.preparationId !== expected.preparationId ||\n    actual.grantDigest !== expected.grantDigest ||\n    canonicalCandidateDigest(actual.resolved) !== canonicalCandidateDigest(expected.resolved)\n  ) {\n    throw new Error('protected model grant input does not match its immutable reservation')\n  }\n}\n\nfunction assertWithinReservedLimits(\n  usage: {\n    modelCalls: number\n    inputTokens: number\n    outputTokens: number\n    costUsdNanos: number\n  },\n  reservation: RememberedReservation,\n): void {\n  for (const [name, actual, limit] of [\n    ['model calls', usage.modelCalls, reservation.limits.maxModelCalls],\n    ['input tokens', usage.inputTokens, reservation.limits.maxInputTokens],\n    ['output tokens', usage.outputTokens, reservation.limits.maxOutputTokens],\n    ['cost USD nanos', usage.costUsdNanos, reservation.maxCostUsdNanos],\n  ] as const) {\n    if (actual > limit) {\n      throw new Error(`protected model settlement ${name} ${actual} exceeds reserved ${limit}`)\n    }\n  }\n}\n\nfunction exactEnvironmentNames(values: readonly string[]): readonly string[] {\n  if (values.length === 0) {\n    throw new Error('protected model activation environment names must not be empty')\n  }\n  const names = [...values].sort()\n  if (new Set(names).size !== names.length) {\n    throw new Error('protected model activation environment names must be unique')\n  }\n  for (const name of names) {\n    if (\n      !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) ||\n      ['__proto__', 'constructor', 'prototype'].includes(name)\n    ) {\n      throw new Error(`protected model activation environment name is invalid: ${name}`)\n    }\n  }\n  return Object.freeze(names)\n}\n\nfunction assertGatewayDomain(value: string): string {\n  if (\n    value.length > 253 ||\n    value !== value.toLowerCase() ||\n    value.endsWith('.') ||\n    value.includes(':') ||\n    value === 'localhost' ||\n    value.endsWith('.localhost') ||\n    value === 'metadata.google' ||\n    value === 'metadata.google.internal'\n  ) {\n    throw new Error('protected model gateway must be an exact lowercase public DNS name')\n  }\n  const labels = value.split('.')\n  if (\n    labels.length < 2 ||\n    !labels.every(\n      (label) =>\n        label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label),\n    ) ||\n    !/[a-z]/.test(labels.at(-1) ?? '')\n  ) {\n    throw new Error('protected model gateway must be an exact lowercase public DNS name')\n  }\n  return value\n}\n\nfunction reservationKey(executionId: string, preparationId: string): string {\n  return canonicalCandidateDigest({ executionId, preparationId })\n}\n\nfunction pruneExpiredState(\n  reservations: Map<string, RememberedReservation>,\n  settlements: Map<string, RememberedSettlement>,\n  now: number,\n): void {\n  for (const [key, value] of reservations) {\n    if (value.expiresAtMs <= now) reservations.delete(key)\n  }\n  for (const [key, value] of settlements) {\n    if (value.expiresAtMs <= now) settlements.delete(key)\n  }\n}\n\nfunction rememberSettlement(\n  settlements: Map<string, RememberedSettlement>,\n  key: string,\n  value: RememberedSettlement,\n): void {\n  settlements.delete(key)\n  settlements.set(key, value)\n  while (settlements.size > MAX_RECENT_SETTLEMENTS) {\n    const oldest = settlements.keys().next().value\n    if (oldest === undefined) return\n    settlements.delete(oldest)\n  }\n}\n\nfunction isSha256Digest(value: unknown): value is Sha256Digest {\n  return typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value)\n}\n\nfunction exactRecord(\n  value: unknown,\n  keys: readonly string[],\n  label: string,\n): Record<string, unknown> {\n  const source = record(value, label)\n  assertExactObjectKeys(source, keys, label)\n  return source\n}\n\nfunction record(value: unknown, label: string): Record<string, unknown> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`${label} must be an object`)\n  }\n  const prototype = Object.getPrototypeOf(value)\n  if (prototype !== Object.prototype && prototype !== null) {\n    throw new Error(`${label} must be a plain object`)\n  }\n  return value as Record<string, unknown>\n}\n"],"mappings":";;;;AAgCA,MAAM,+BAA+B;AACrC,MAAM,gCAAgC,KAAK;;AA2B3C,SAAgB,wCACd,SAC4B;CAC5B,OAAO,IAAI,mCAAmC,OAAO;AACvD;AAEA,IAAM,qCAAN,MAA+E;CAShD;CAR7B,yBAA0B,IAAI,IAAkC;CAChE;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAAgE;EAA/C,KAAA,UAAA;EAC3B,IAAI,CAAC,QAAQ,SAAS,cACpB,MAAM,IAAI,MACR,+BAA+B,QAAQ,SAAS,KAAK,qCACvD;EAEF,KAAK,eAAe,QAAQ,SAAS;EACrC,KAAK,YAAY,eAAe,QAAQ,SAAS;EACjD,KAAK,qBAAqB,gBACxB,QAAQ,sBAAsB,8BAC9B,iCACF;EACA,KAAK,sBAAsB,gBACzB,QAAQ,uBAAuB,+BAC/B,kCACF;EACA,KAAK,kBAAkB,QAAQ,kBAC3B,wBAAwB,QAAQ,eAAe,IAC/C,KAAA;CACN;CAEA,MAAM,QACJ,SACA,SACA;EACA,uBAAuB,OAAO;EAC9B,MAAM,UAAU,QAAQ,UAAU,KAAK;EACvC,IAAI,QAAQ,SAAS,UAAU,MAAM,IAAI,MAAM,gDAAgD;EAC/F,MAAM,UAAU,QAAQ,cAAc,MAAM,SAAS,MAAM,OAAO;EAClE,MAAM,SACJ,QAAQ,SAAS,aACZ,EAAE,MAAM,UAAU,IAClB;GAAE,MAAM;GAAU,cAAc,CAAC,GAAG,QAAQ,OAAO;EAAE;EAC5D,MAAM,KAAK,iBAAiB,OAAO,IAAI;EACvC,QAAQ,OAAO,eAAe;EAE9B,MAAM,MAAM,aAAa,QAAQ,aAAa,QAAQ,cAAc,MAAM,MAAM;EAChF,IAAI,KAAK,OAAO,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,mDAAmD;EAC7F,MAAM,QAAQ,WACZ,QAAQ,cAAc,MAAM,SAAS,UAAU,OAC/C,QAAQ,cAAc,MAAM,SAAS,UAAU,cACjD;EACA,MAAM,gBAAgB,sBACpB,QAAQ,WAAW,WACnB,KAAK,mBACP;EAcA,MAAM,oBAAoB,yBAbH,wBAAwB;GAC7C,MAAM;GACN,UAAU,KAAK,QAAQ,SAAS;GAChC,aAAa,QAAQ;GACrB,qBAAqB,QAAQ,cAAc,MAAM;GACjD;GACA;GACA;GACA,oBAAoB,KAAK;GACzB,WAAW,KAAK;GAChB,QAAQ;IAAE,WAAW,QAAQ;IAAW,UAAU,QAAQ;GAAS;GACnE,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;EAC1E,CACgE,CAAC;EACjE,MAAM,WAAW,wBAAwB;GACvC,MAAM;GACN,UAAU,KAAK,QAAQ,SAAS;GAChC,aAAa,QAAQ;GACrB,qBAAqB,QAAQ,cAAc,MAAM;GACjD;GACA,iBAAiB,QAAQ;GACzB,gBAAgB,QAAQ;EAC1B,CAAC;EACD,MAAM,cAAc,MAAM,KAAK,aAAa,OAAO;GACjD;GACA;GACA;GACA,oBAAoB,KAAK;GACzB,WAAW,KAAK;GAChB;GACA,gBAAgB,wBACd,QAAQ,aACR,QAAQ,cAAc,MAAM,MAC9B;GACA,QAAQ,QAAQ;GAChB,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;EAC1E,CAAC;EACD,IAAI;GACF,2BAA2B,aAAa,UAAU,KAAK,QAAQ,SAAS,IAAI;EAC9E,SAAS,OAAO;GACd,IAAI;IACF,MAAM,YAAY,QAAQ;GAC5B,SAAS,cAAc;IACrB,MAAM,IAAI,eACR,CAAC,OAAO,YAAY,GACpB,kDACF;GACF;GACA,MAAM;EACR;EACA,MAAM,QAA8B,EAAE,YAAY;EAClD,KAAK,OAAO,IAAI,KAAK,KAAK;EAG1B,KAAI,MADmB,YAAY,QAAQ,KAAK,EAAA,CACnC,WAAW,GACtB,MAAM,IAAI,MAAM,wDAAwD;EAE1E,MAAM,mBAAmB,aAAa,SAAS,QAAQ,MAAM;EAC7D,MAAM,SAAS,YAAY,OAAO;EAClC,MAAM,YAAY,KAAK,IAAI;EAC3B,MAAM,QAAQ;GACZ,OAAO,QAAQ,MAAM;GACrB,YAAY,QAAQ,UAAU,KAAK,SAAS;GAC5C;GACA,cAAc,QAAQ;GACtB,WAAW,QAAQ,WAAW;GAC9B,MAAM;IACJ,GAAG,QAAQ,MAAM;IACjB,eAAe,YAAY;IAC3B,qBAAqB,YAAY;GACnC;GACA,SAAS;EACX;EACA,MAAM,UAAU,MAAM,YAAY,QAAQ,MAAM,QAAQ,EAAE,QAAQ,QAAQ,OAAO,CAAC;EAClF,MAAM,gBAAgB,cAAc,SAAS,QAAQ,QAAQ;EAC7D,cAAmB,YAAY,KAAA,CAAS;EACxC,IAAI;EACJ,IAAI,gBAAgB;EACpB,MAAM,eAAe;GACnB,IAAI,CAAC,eAAe,iBAAiB,YAAY,OAAO;EAC1D;EACA,QAAQ,OAAO,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;EAC/D,IAAI,QAAQ,OAAO,SAAS,OAAO;EACnC,IAAI;GACF,MAAM,cAAc,MAAM,QAAQ,KAAK;GACvC,gBAAgB;GAChB,QAAQ,OAAO,oBAAoB,SAAS,MAAM;GAClD,IAAI,cAAc,MAAM;GACxB,MAAM,SAAS,MAAM,QAAQ,OAAO;GACpC,qBAAqB,QAAQ,WAAW;GACxC,MAAM,SAAS,MAAM,YAAY,eAAe,QAAQ,QAAQ,QAAQ,YAAY;GACpF,MAAM,cAAc;GACpB,MAAM,wBAAwB,OAAO,QAAQ,YAAY,MAAM;GAC/D,OAAO;IAAE,aAAa,QAAQ;IAAa;GAAY;EACzD,UAAU;GACR,QAAQ,OAAO,oBAAoB,SAAS,MAAM;EACpD;CACF;CAEA,MAAM,KACJ,SACA,SACqC;EACrC,MAAM,KAAK,iBAAiB;EAC5B,QAAQ,OAAO,eAAe;EAC9B,MAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,IAAI;EACpD,IAAI,CAAC,aAAa,OAAO,EAAE,SAAS,KAAK;EACzC,IAAI,WAAW,MAAM,YAAY,QAAQ,KAAK;EAC9C,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,MAAM,oEAAoE;EAEtF,MAAM,SAAS,SAAS;EACxB,IAAI,QAAQ,SAAS;GACnB,MAAM,UAAU,MAAM,YAAY,QAAQ,IAAI,OAAO,GAAG;GACxD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,uDAAuD;GACrF,MAAM,YAAY,OAAO;EAC3B;EACA,QAAQ,OAAO,eAAe;EAC9B,WAAW,MAAM,YAAY,QAAQ,KAAK;EAC1C,IAAI,SAAS,MAAM,UAAU,MAAM,OAAO,GACxC,MAAM,IAAI,MAAM,mDAAmD;EAErE,MAAM,cAAc,SAAS;EAC7B,IAAI,aAAa,qBAAqB,WAAW;EACjD,MAAM,QAAQ,KAAK,OAAO,IAAI,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;EAC5F,IAAI,OAAO;GACT,MAAM,cAAc,aAAa,eAAe,MAAM;GACtD,IAAI,QAAQ,WAAW,aAAa,MAAM,OACxC,MAAM,qBAAqB;IACzB,MAAM;IACN,WAAW,MAAM,MAAM;GACzB;GAEF,MAAM,wBAAwB,OAAO,QAAQ,YAAY,WAAW;EACtE;EACA,OAAO,EAAE,SAAS,KAAK;CACzB;CAEA,MAAM,QACJ,SACA,SACA;EACA,MAAM,KAAK,iBAAiB;EAC5B,QAAQ,OAAO,eAAe;EAC9B,MAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,KAAK;EACrD,MAAM,WAAW,MAAM,YAAY,QAAQ,KAAK;EAChD,MAAM,SAAS,SAAS;EACxB,IAAI,SAAS,WAAW,KAAK,CAAC,UAAU,OAAO,SAC7C,MAAM,IAAI,MAAM,uEAAuE;EAEzF,qBAAqB,MAAM;EAC3B,MAAM,UAAU,MAAM,YAAY,QAAQ,IAAI,OAAO,GAAG;EACxD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,wDAAwD;EAEtF,qBAAqB,MADO,QAAQ,OAAO,GACP,OAAO,WAAW;EACtD,MAAM,QAAQ,KAAK,OAAO,IAAI,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;EAC5F,MAAM,SACJ,OAAO,UACN,MAAM,YACL,cAAc,SAAS,WAAW,WAAW,CAAC,CAAC,QAAQ,GACvD,QAAQ,QACR,KAAK,IAAI,IAAI,KAAK,kBACpB;EACF,QAAQ,OAAO,eAAe;EAC9B,MAAM,WAAW,wBAAwB;GACvC,MAAM;GACN,UAAU,YAAY;GACtB,eAAe,YAAY;GAC3B,aAAa,QAAQ;GACrB,qBAAqB,QAAQ;GAC7B,mBAAmB,YAAY,UAAU;GACzC,SAAS;IACP,KAAK,OAAO;IACZ,UAAU,OAAO;IACjB,GAAI,OAAO,aAAa,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC;IAC7D,aAAa,OAAO;GACtB;GACA,GAAI,OAAO,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;GACpF,QAAQ;IAAE,QAAQ,YAAY,MAAM;IAAG,YAAY,OAAO;GAAW;EACvE,CAAC;EACD,OAAO;GACL,aAAa;IAAE,MAAM;IAAmB,OAAO;GAAO;GACtD;EACF;CACF;CAEA,MAAM,QACJ,SACA,SACsC;EACtC,MAAM,KAAK,iBAAiB;EAC5B,QAAQ,OAAO,eAAe;EAC9B,MAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,IAAI;EACpD,IAAI,CAAC,aAAa,OAAO,EAAE,UAAU,KAAK;EAC1C,IAAI;EACJ,IAAI;GACF,MAAM,YAAY,QAAQ;EAC5B,SAAS,OAAO;GACd,eAAe;EACjB;EAEA,IAAI,MADoB,KAAK,aAAa,IAAI,YAAY,EAAE,GAE1D,MAAM,IAAI,MAAM,oDAAoD,EAAE,OAAO,aAAa,CAAC;EAE7F,QAAQ,OAAO,eAAe;EAC9B,KAAK,OAAO,OAAO,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;EACjF,OAAO,EAAE,UAAU,KAAK;CAC1B;CAEA,MAAc,iBAAiB,MAA4C;EACzE,MAAM,UACJ,KAAK,uBAAuB,QAAQ,QAAQ,KAAK,QAAQ,SAAS,aAAa,CAAC;EAClF,KAAK,sBAAsB;EAC3B,IAAI;EACJ,IAAI;GACF,eAAe,MAAM;EACvB,SAAS,OAAO;GACd,IAAI,KAAK,wBAAwB,SAAS,KAAK,sBAAsB,KAAA;GACrE,MAAM;EACR;EACA,MAAM,QAAQ,aAAa;EAC3B,IAAI,CAAC,OACH,MAAM,IAAI,MACR,+BAA+B,KAAK,QAAQ,SAAS,KAAK,yCAC5D;EAEF,IAAI,QAAQ,CAAC,MAAM,OAAO,SAAS,IAAI,GACrC,MAAM,IAAI,MACR,+BAA+B,KAAK,QAAQ,SAAS,KAAK,qBAAqB,KAAK,cACtF;CAEJ;CAUA,MAAc,QACZ,SACA,kBACmD;EACnD,MAAM,MAAM,aAAa,QAAQ,aAAa,QAAQ,mBAAmB;EACzE,MAAM,SAAS,KAAK,OAAO,IAAI,GAAG,CAAC,EAAE;EACrC,IAAI,QAAQ,OAAO;EACnB,MAAM,WAAW;GACf,MAAM;GACN,UAAU,KAAK,QAAQ,SAAS;GAChC,aAAa,QAAQ;GACrB,qBAAqB,QAAQ;EAC/B;EAKA,MAAM,WAAU,MAJK,KAAK,aAAa,KAAK;GAC1C;GACA,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;EAC1E,CAAC,EAAA,CACsB,QACpB,gBACC,YAAY,aAAa,KAAK,QAAQ,SAAS,QAC/C,OAAO,QAAQ,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,WACrC,kBAAkB,YAAY,WAAW,OAAO,KAAK,CACvD,CACJ;EACA,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,MAAM,mEAAmE;EAErF,MAAM,cAAc,QAAQ;EAC5B,IAAI,CAAC,aAAa;GAChB,IAAI,kBAAkB,OAAO,KAAA;GAC7B,MAAM,IAAI,MAAM,iDAAiD;EACnE;EACA,IAAI,CAACA,iBAAe,YAAY,UAAU,iBAAiB,GACzD,MAAM,IAAI,MAAM,4DAA4D;EAE9E,KAAK,OAAO,IAAI,KAAK,EAAE,YAAY,CAAC;EACpC,OAAO;CACT;AACF;AAEA,eAAe,wBACb,OACA,YACA,QACe;CACf,MAAM,QAAQ,MAAM;CACpB,IAAI,CAAC,SAAS,MAAM,SAAS;CAC7B,MAAM,UAAU,KAAK,IAAI,MAAM,WAAW,KAAK,IAAI,KAAK,IAAI,GAAG,MAAM,YAAY,CAAC;CAClF,MAAM,cAAc,MAAM,sBAAsB,MAAM,eAAe,QAAQ;CAC7E,MAAM,WAAW,UAAU;EACzB,OAAO,MAAM;EACb,YAAY,MAAM;EAClB,WAAW,MAAM;EACjB;EACA,QAAQ,aAAa,SAAS,UAAU,YAAY,aAAa,IAAI,cAAc;EACnF,MAAM,MAAM;CACd,CAAC;CACD,MAAM,UAAU;AAClB;AAEA,SAAS,uBAAuB,SAA8C;CAC5E,IAAI,QAAQ,UAAU,KAAK,QAAQ,SAAS,UAC1C,MAAM,IAAI,MACR,gFACF;CAEF,IAAI,QAAQ,cAAc,MAAM,SAAS,aAAa,cAAc,QAAQ,OAAO,WACjF,MAAM,IAAI,MAAM,6EAA6E;CAE/F,IAAI,QAAQ,OAAO,SAAS,YAC1B,MAAM,IAAI,MAAM,mEAAmE;CAErF,MAAM,YAAY,QAAQ,UAAU,KAAK,QAAQ,UAAU,YAAY;CACvE,IACE,EACE,UAAU,WAAW,OAAO,KAC5B,cAAc,sBACd,UAAU,SAAS,OAAO,IAG5B,MAAM,IAAI,MAAM,4EAA4E;CAE9F,IAAI,CAAC,MAAM,WAAW,QAAQ,OAAO,UAAU,KAAK,CAAC,QAAQ,OAAO,IAAI,MAAM,KAAK,GACjF,MAAM,IAAI,MAAM,8EAA8E;AAElG;AAEA,eAAe,mBACb,aACA,SACA,QACe;CACf,MAAM,iBAAiB,gCAAgC,OAAO;CAC9D,KAAK,MAAM,QAAQ,QAAQ,OAAO,KAAK,OACrC,MAAM,YAAY,UAAU,QAAQ,QAAQ,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,OAAO;EAClF,MAAM,KAAK;EACX;CACF,CAAC;CAEH,MAAM,cACJ,QAAQ,cAAc,MAAM,SAAS,QAAQ,oBAAoB,SAC7D,QAAQ,MAAM,WACd,QAAQ,MAAM;CACpB,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,+CAA+C;CACjF,KAAK,MAAM,QAAQ,QAAQ,kBAAkB,OAC3C,MAAM,YAAY,UAChB,QAAQ,aAAa,KAAK,IAAI,GAC9B,OAAO,KAAK,KAAK,SAAS,MAAM,GAChC;EAAE,MAAM,KAAK;EAAM;CAAO,CAC5B;CAEF,IAAI,QAAQ,aAAa,gBAAgB;EACvC,KAAK,MAAM,QAAQ,QAAQ,UAAU,OACnC,MAAM,YAAY,UAAU,QAAQ,eAAe,MAAM,KAAK,IAAI,GAAG,KAAK,OAAO;GAC/E,MAAM,KAAK;GACX;EACF,CAAC;EAEH,IAAI,QAAQ,UAAU,mBAAmB,eAAe,iBACtD,MAAM,YAAY,UAChB,eAAe,iBACf,QAAQ,UAAU,iBAClB;GAAE,MAAM;GAAO;EAAO,CACxB;CAEJ;CACA,IAAI,QAAQ,YAAY,SAAS,SAAS,aACxC,MAAM,YAAY,UAAU,QAAQ,YAAY,SAAS,MAAM,QAAQ,YAAY,OAAO;EACxF,MAAM;EACN;CACF,CAAC;AAEL;AAEA,SAAS,gCACP,SACiE;CACjE,MAAM,YAAY,QAAQ;CAC1B,IAAI,CAAC,WAAW;EACd,IACE,QAAQ,OAAO,IAAA,uCAAsC,KAAA,KACrD,QAAQ,OAAO,IAAA,mDAAkD,KAAA,GAEjE,MAAM,IAAI,MAAM,sEAAsE;EAExF;CACF;CACA,MAAM,QAAQ,iCACZ,QAAQ,MAAM,UACd,UAAU,oBAAoB,KAAA,CAChC;CACA,IACE,QAAQ,OAAO,IAAA,uCAAsC,MAAM,QAC3D,QAAQ,OAAO,IAAA,mDAAkD,MAAM,iBAEvE,MAAM,IAAI,MAAM,sEAAsE;CAExF,MAAM,WAAW,CAAC,MAAM,MAAM,MAAM,eAAe,CAAC,CAAC,QAClD,UAA2B,UAAU,KAAA,CACxC;CACA,MAAM,cACJ,QAAQ,cAAc,MAAM,SAAS,QAAQ,oBAAoB,SAC7D,QAAQ,MAAM,WACd,QAAQ,MAAM;CAUpB,IACE;EATA,GAAG,QAAQ,OAAO,KAAK,MAAM,KAAK,SAAS,QAAQ,QAAQ,MAAM,UAAU,KAAK,IAAI,CAAC;EACrF,GAAI,cACA,QAAQ,kBAAkB,MAAM,KAAK,SAAS,QAAQ,aAAa,KAAK,IAAI,CAAC,IAC7E,CAAC;EACL,GAAI,QAAQ,YAAY,SAAS,SAAS,cACtC,CAAC,QAAQ,YAAY,SAAS,IAAI,IAClC,CAAC;CAGI,CAAC,CAAC,MAAM,SACf,SAAS,MACN,iBACC,SAAS,gBACT,KAAK,WAAW,GAAG,aAAa,EAAE,KAClC,aAAa,WAAW,GAAG,KAAK,EAAE,CACtC,CACF,GAEA,MAAM,IAAI,MAAM,0DAA0D;CAE5E,OAAO;AACT;AAEA,SAAS,YAAY,SAAiE;CACpF,MAAM,cAAc,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,QAAQ,YAAY,KAAK;CAC9F,MAAM,OAAO;EACX,YAAY,QAAQ,OAAO;EAC3B,MAAM,QAAQ,OAAO;EACrB,KAAK,QAAQ,OAAO;EACpB,KAAK,QAAQ,OAAO;EACpB,WAAW;CACb;CACA,QAAQ,QAAQ,YAAY,SAAS,MAArC;EACE,KAAK,eACH,OAAO;GAAE,GAAG;GAAM,MAAM,CAAC,GAAG,KAAK,MAAM,WAAW;EAAE;EACtD,KAAK,cACH,OAAO;GAAE,GAAG;GAAM,OAAO;EAAY;EACvC,KAAK,aACH,OAAO;CACX;AACF;AAEA,eAAe,cAAc,SAA4B,UAAuC;CAC9F,MAAM,SAAmB,CAAC;CAC1B,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ,OAAO,GAAG;EAC1C,MAAM,QAAQ,OAAO,KAAK,OAAO,MAAM;EACvC,cAAc,MAAM;EACpB,IAAI,aAAa,UAAU;GACzB,IAAI;GACJ,IAAI;IACF,MAAM,YAAY,OAAO;GAC3B,SAAS,OAAO;IACd,YAAY;GACd;GACA,MAAM,IAAI,MAAM,gCAAgC,SAAS,gBAAgB,EACvE,OAAO,UACT,CAAC;EACH;EACA,OAAO,KAAK,KAAK;CACnB;CACA,OAAO,WAAW,KAAK,OAAO,OAAO,QAAQ,UAAU,CAAC;AAC1D;AAEA,eAAe,YACb,QACA,QACA,cACqB;CACrB,OAAO,eAAe;CACtB,MAAM,cAAc,eAAe,KAAK,IAAI;CAC5C,IAAI,eAAe,GAAG,MAAM,IAAI,MAAM,mCAAmC;CACzE,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,QACA,IAAI,SAAgB,UAAU,WAAW;GACvC,gBAAgB,OAAO,OAAO,0BAAU,IAAI,MAAM,4BAA4B,CAAC;GAC/E,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;GACxD,QAAQ,iBACA,uBAAO,IAAI,MAAM,mCAAmC,CAAC,GAC3D,WACF;EACF,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,SAAS,OAAO,oBAAoB,SAAS,OAAO;EACxD,IAAI,OAAO,aAAa,KAAK;CAC/B;AACF;AAEA,eAAe,YAAY,SAA2C;CAEpE,IAAI,EAAC,MADgB,QAAQ,OAAO,EAAA,CACxB,SAAS;CACrB,IAAI;EACF,MAAM,QAAQ,KAAK;CACrB,SAAS,OAAO;EACd,KAAK,MAAM,QAAQ,OAAO,EAAA,CAAG,SAAS,MAAM;CAC9C;CACA,MAAM,cAAc,MAAM,QAAQ,KAAK;CACvC,qBAAqB,MAAM,QAAQ,OAAO,GAAG,WAAW;AAC1D;AAEA,SAAS,qBACP,QACA,UACwF;CACxF,IAAI,OAAO,WAAW,CAAC,OAAO,aAC5B,MAAM,IAAI,MAAM,sDAAsD;CAExE,IAAI,YAAY,CAAC,kBAAkB,OAAO,aAAa,QAAQ,GAC7D,MAAM,IAAI,MAAM,mEAAmE;AAEvF;AAEA,SAAS,2BACP,aACA,UACA,cACM;CACN,IAAI,CAAC,YAAY,MAAM,YAAY,aAAa,cAC9C,MAAM,IAAI,MAAM,gEAAgE;CAElF,IACE,CAAC,OAAO,QAAQ,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,WACtC,kBAAkB,YAAY,WAAW,OAAO,KAAK,CACvD,GAEA,MAAM,IAAI,MAAM,qEAAqE;AAEzF;AAEA,SAAS,WAAW,aAAiE;CACnF,MAAM,WAAW,YAAY,UAAU;CACvC,IAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,OAAO,QAAQ,IAAI,GACxD,MAAM,IAAI,MAAM,qDAAqD;CAEvE,OAAO,EAAE,UAAU,OAAO,QAAQ,EAAE;AACtC;AAEA,SAAS,aAAa,aAAqB,qBAA2C;CACpF,OAAO,GAAG,YAAY,IAAI;AAC5B;AAEA,SAAS,wBAAwB,aAAqB,qBAA2C;CAC/F,OAAO,aAAa,yBAAyB;EAC3C,MAAM;EACN;EACA;CACF,CAAC,CAAC,CAAC,MAAM,CAAgB;AAC3B;AAEA,SAAS,WAAW,OAAe,gBAAsC;CACvE,IAAIA,iBAAe,KAAK,GAAG;EACzB,IAAI,UAAU,gBACZ,MAAM,IAAI,MAAM,gEAAgE;EAElF,OAAO;CACT;CACA,MAAM,SAAS,MAAM,YAAY,GAAG;CACpC,IAAI,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG;CACnC,IAAI,MAAM,MAAM,SAAS,CAAC,MAAM,gBAC9B,MAAM,IAAI,MAAM,gEAAgE;CAElF,OAAO;AACT;AAEA,SAAS,sBAAsB,WAAmB,aAA6B;CAC7E,MAAM,QAAQ,gBAAgB,WAAW,6BAA6B,IAAI;CAC1E,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG,MAAM,IAAI,MAAM,6CAA6C;CAC/F,OAAO,KAAK,KAAK,QAAQ,GAAK,IAAI;AACpC;AAEA,SAAS,eAAe,WAAmE;CACzF,IAAI,CAAC,OAAO,SAAS,UAAU,GAAG,KAAK,UAAU,OAAO,GACtD,MAAM,IAAI,MAAM,+CAA+C;CAEjE,OAAO,OAAO,OAAO;EACnB,KAAK,UAAU;EACf,UAAU,gBAAgB,UAAU,UAAU,sBAAsB;EACpE,QAAQ,gBAAgB,UAAU,QAAQ,oBAAoB;CAChE,CAAC;AACH;AAEA,SAAS,gBAAgB,OAAe,OAAuB;CAC7D,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAC1C,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CACvD,OAAO;AACT;AAEA,SAAS,QAAQ,MAAc,cAA8B;CAC3D,IAAI,MAAM,WAAW,YAAY,GAAG,MAAM,IAAI,MAAM,uCAAuC;CAC3F,MAAM,OAAO,MAAM,UAAU,YAAY;CACzC,IAAI,SAAS,QAAQ,KAAK,WAAW,KAAK,GACxC,MAAM,IAAI,MAAM,iDAAiD;CAEnE,OAAO,MAAM,KAAK,MAAM,IAAI;AAC9B;AAEA,SAASA,iBAAe,OAAuC;CAC7D,OAAO,OAAO,UAAU,YAAY,wBAAwB,KAAK,KAAK;AACxE;;;AC1oBA,MAAM,yBAAyB;AAC/B,MAAM,oCAAoC,MAAU;;;;;;;;AASpD,SAAgB,uCACd,SACyB;CACzB,MAAM,gBAAgB,oBAAoB,QAAQ,aAAa;CAC/D,MAAM,qBAAqB,sBAAsB,QAAQ,kBAAkB;CAC3E,MAAM,+BAAe,IAAI,IAAmC;CAC5D,MAAM,oCAAoB,IAAI,IAAkC;CAEhE,OAAO;EACL,SAAS,OAAO,UAAU;GACxB,MAAM,UAAU,wBAAwB,KAAK;GAE7C,OAAO,wBADU,sBAAsB,MAAM,QAAQ,aAAa,OAAO,GAAG,OACtC,CAAC;EACzC;EAEA,cAAc,OAAO,UAAU;GAC7B,kBAAkB,cAAc,mBAAmB,KAAK,IAAI,CAAC;GAC7D,MAAM,UAAU,wBAAwB,KAAK;GAC7C,qBAAqB,OAAO;GAC5B,MAAM,gBAAgB,yBAAyB,OAAO;GACtD,MAAM,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;GACrE,IAAI,kBAAkB,IAAI,GAAG,GAC3B,MAAM,IAAI,MAAM,gDAAgD;GAElE,MAAM,WAAW,aAAa,IAAI,GAAG;GACrC,IAAI,YAAY,SAAS,kBAAkB,eACzC,MAAM,IAAI,MAAM,2DAA2D;GAG7E,MAAM,cAAc,oBAClB,MAAM,QAAQ,OAAO,QAAQ,OAAO,GACpC,SACA,aACF;GACA,MAAM,iBAAiB,yBAAyB,WAAW;GAC3D,IAAI,kBAAkB,IAAI,GAAG,GAC3B,MAAM,IAAI,MAAM,mEAAmE;GAErF,MAAM,WAAW,YAAY,aAAa,IAAI,GAAG;GACjD,IAAI,YAAY,SAAS,kBAAkB,eACzC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,IAAI,YAAY,SAAS,mBAAmB,gBAC1C,MAAM,IAAI,MAAM,+DAA+D;GAEjF,IAAI,CAAC,UACH,aAAa,IAAI,KAAK;IACpB;IACA;IACA,aAAa,QAAQ;IACrB,eAAe,QAAQ;IACvB,aAAa,YAAY;IACzB,aAAa,QAAQ;IACrB,UAAU,wBAAwB,QAAQ,QAAQ;IAClD,QAAQ,wBAAwB,QAAQ,MAAM;IAC9C,iBAAiB,WAAW,QAAQ,OAAO,YAAY,qBAAqB;IAC5E,YAAY;GACd,CAAC;GAEH,OAAO;EACT;EAEA,eAAe,OAAO,UAAU;GAC9B,kBAAkB,cAAc,mBAAmB,KAAK,IAAI,CAAC;GAC7D,MAAM,UAAU,wBAAwB,KAAK;GAC7C,MAAM,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;GACrE,IAAI,kBAAkB,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,0CAA0C;GAC1F,MAAM,QAAQ,aAAa,IAAI,GAAG;GAClC,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,qDAAqD;GACjF,oBAAoB,OAAO,OAAO;GAClC,IAAI,MAAM,kBAAkB,MAAM,IAAI,MAAM,0CAA0C;GACtF,IAAI,MAAM,eAAe,YACvB,MAAM,IAAI,MAAM,gDAAgD;GAElE,IAAI,CAAC,OAAO,cAAc,QAAQ,YAAY,KAAK,QAAQ,gBAAgB,GACzE,MAAM,IAAI,MAAM,qEAAqE;GAEvF,IAAI,QAAQ,gBAAgB,KAAK,IAAI,GACnC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,IAAI,QAAQ,eAAe,MAAM,aAC/B,MAAM,IAAI,MAAM,iEAAiE;GAEnF,MAAM,aAAa;GACnB,IAAI;IACF,MAAM,aAAa,mBACjB,MAAM,QAAQ,OAAO,SAAS,OAAO,GACrC,MAAM,OAAO,kBAAkB,IAAI,CAAC,IAAI,kBAC1C;IACA,IAAI,kBAAkB,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,MAAM,OAC1D,MAAM,IAAI,MAAM,8DAA8D;IAEhF,MAAM,aAAa;IACnB,OAAO;GACT,SAAS,OAAO;IACd,MAAM,aAAa;IACnB,MAAM;GACR;EACF;EAEA,aAAa,OAAO,UAAU;GAC5B,MAAM,MAAM,KAAK,IAAI;GACrB,kBAAkB,cAAc,mBAAmB,GAAG;GACtD,MAAM,UAAU,wBAAwB,KAAK;GAC7C,MAAM,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;GACrE,MAAM,QAAQ,aAAa,IAAI,GAAG;GAClC,IAAI,OAAO,oBAAoB,OAAO,OAAO;GAC7C,MAAM,aAAa,SAAS,kBAAkB,IAAI,GAAG;GACrD,IAAI,YAAY,oBAAoB,WAAW,qBAAqB,QAAQ,QAC1E,MAAM,IAAI,MAAM,iEAAiE;GAGnF,MAAM,SAAS,kCAAkC,MAAM,QAAQ,OAAO,OAAO,OAAO,GAAG;IACrF,eAAe,QAAQ;IACvB,aAAa,QAAQ;IACrB,OAAO,QAAQ,SAAS;GAC1B,CAAC;GACD,IAAI,OAAO,2BAA2B,OAAO,OAAO,KAAK;GAEzD,MAAM,mBAAmB,yBAAyB,OAAO,KAAK;GAC9D,IAAI,YAAY,oBAAoB,WAAW,qBAAqB,kBAClE,MAAM,IAAI,MAAM,oEAAoE;GAEtF,IAAI,YAAY,oBAAoB,WAAW,qBAAqB,QAAQ,QAC1E,MAAM,IAAI,MAAM,iEAAiE;GAEnF,MAAM,cAAc,OAAO,eAAe,MAAM;GAChD,IAAI,OAAO;IACT,MAAM,mBAAmB;IACzB,MAAM,mBAAmB,QAAQ;GACnC;GACA,aAAa,OAAO,GAAG;GACvB,mBAAmB,mBAAmB,KAAK;IACzC;IACA,kBAAkB,QAAQ;IAC1B;GACF,CAAC;GACD,OAAO,OAAO;EAChB;CACF;AACF;AAEA,SAAS,qBAAqB,OAAmD;CAC/E,IAAI,CAAC,OAAO,cAAc,MAAM,WAAW,KAAK,MAAM,eAAe,GACnE,MAAM,IAAI,MAAM,oEAAoE;CAEtF,IAAI,MAAM,eAAe,KAAK,IAAI,GAChC,MAAM,IAAI,MAAM,0DAA0D;CAE5E,KAAK,MAAM,CAAC,MAAM,UAAU;EAC1B,CAAC,iBAAiB,MAAM,OAAO,aAAa;EAC5C,CAAC,kBAAkB,MAAM,OAAO,cAAc;EAC9C,CAAC,mBAAmB,MAAM,OAAO,eAAe;CAClD,GACE,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAC1C,MAAM,IAAI,MAAM,+BAA+B,KAAK,oCAAoC;CAG5F,WAAW,MAAM,OAAO,YAAY,qBAAqB;AAC3D;AAEA,SAAS,oBACP,OACA,UACA,eACqC;CACrC,MAAM,SAAS,YACb,OACA;EAAC;EAAiB;EAAU;EAAe;EAAkB;CAAS,GACtE,sCACF;CACA,IAAI,OAAO,kBAAkB,SAAS,eACpC,MAAM,IAAI,MAAM,mEAAmE;CAErF,IAAI,CAAC,eAAe,OAAO,MAAM,GAC/B,MAAM,IAAI,MAAM,4DAA4D;CAE9E,IAAI,OAAO,gBAAgB,SAAS,aAClC,MAAM,IAAI,MAAM,qDAAqD;CAEvE,YACE,OAAO,gBACP;EAAC;EAAiB;EAAkB;EAAmB;CAAY,GACnE,6CACF;CACA,IACE,yBAAyB,OAAO,cAAc,MAAM,yBAAyB,SAAS,MAAM,GAE5F,MAAM,IAAI,MAAM,8DAA8D;CAGhF,MAAM,UAAU,2BACd,OAAO,SACP,SAAS,OAAO,eAChB,aACF;CACA,OAAO,wBAAwB;EAC7B,eAAe,OAAO;EACtB,QAAQ,OAAO;EACf,aAAa,OAAO;EACpB,gBAAgB,OAAO;EACvB;CACF,CAAC;AACH;AAEA,SAAS,2BACP,OACA,eACA,eACkC;CAClC,IAAI,kBAAkB,GAAG;EAEvB,IADe,YAAY,OAAO,CAAC,MAAM,GAAG,qCACnC,CAAC,CAAC,SAAS,YAClB,MAAM,IAAI,MAAM,mEAAmE;EAErF,OAAO,EAAE,MAAM,WAAW;CAC5B;CAEA,MAAM,SAAS,YAAY,OAAO,CAAC,QAAQ,SAAS,GAAG,qCAAqC;CAC5F,IAAI,OAAO,SAAS,gBAClB,MAAM,IAAI,MAAM,+DAA+D;CAEjF,IACE,CAAC,MAAM,QAAQ,OAAO,OAAO,KAC7B,OAAO,QAAQ,WAAW,KAC1B,OAAO,QAAQ,OAAO,eAEtB,MAAM,IAAI,MAAM,mEAAmE;CAErF,OAAO;EAAE,MAAM;EAAgB,SAAS,CAAC,aAAa;CAAE;AAC1D;AAEA,SAAS,mBACP,OACA,eACwC;CAExC,MAAM,MAAM,OADG,YAAY,OAAO,CAAC,KAAK,GAAG,qCACnB,CAAC,CAAC,KAAK,wCAAwC;CACvE,MAAM,cAAc,OAAO,KAAK,GAAG,CAAC,CAAC,KAAK;CAC1C,IACE,YAAY,WAAW,cAAc,UACrC,YAAY,MAAM,MAAM,UAAU,SAAS,cAAc,MAAM,GAE/D,MAAM,IAAI,MAAM,kEAAkE;CAEpF,MAAM,WAAmC,OAAO,OAAO,IAAI;CAC3D,KAAK,MAAM,QAAQ,eAAe;EAChC,MAAM,QAAQ,IAAI;EAClB,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,SAAS,OAClE,MAAM,IAAI,MAAM,8BAA8B,KAAK,qCAAqC;EAE1F,SAAS,QAAQ;CACnB;CACA,OAAO,OAAO,OAAO,EAAE,KAAK,OAAO,OAAO,QAAQ,EAAE,CAAC;AACvD;AAEA,SAAS,sBACP,OACA,UAC6B;CAC7B,MAAM,SAAS,YACb,OACA;EAAC;EAAa;EAAY;EAAS;EAAY;CAAiB,GAChE,0BACF;CACA,IAAI,OAAO,cAAc,SAAS,WAChC,MAAM,IAAI,MAAM,oDAAoD;CAEtE,IAAI,OAAO,oBAAoB,SAAS,iBACtC,MAAM,IAAI,MAAM,6DAA6D;CAE/E,KAAK,MAAM,QAAQ;EAAC;EAAa;EAAY;EAAS;CAAU,GAC9D,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,KAAK,CAAC,WAAW,GAC9D,MAAM,IAAI,MAAM,4BAA4B,KAAK,mBAAmB;CAGxE,OAAO;AACT;AAEA,SAAS,oBACP,UACA,QACM;CACN,IACE,OAAO,gBAAgB,SAAS,eAChC,OAAO,kBAAkB,SAAS,iBAClC,OAAO,gBAAgB,SAAS,eAChC,yBAAyB,OAAO,QAAQ,MAAM,yBAAyB,SAAS,QAAQ,GAExF,MAAM,IAAI,MAAM,sEAAsE;AAE1F;AAEA,SAAS,2BACP,OAMA,aACM;CACN,KAAK,MAAM,CAAC,MAAM,QAAQ,UAAU;EAClC;GAAC;GAAe,MAAM;GAAY,YAAY,OAAO;EAAa;EAClE;GAAC;GAAgB,MAAM;GAAa,YAAY,OAAO;EAAc;EACrE;GAAC;GAAiB,MAAM;GAAc,YAAY,OAAO;EAAe;EACxE;GAAC;GAAkB,MAAM;GAAc,YAAY;EAAe;CACpE,GACE,IAAI,SAAS,OACX,MAAM,IAAI,MAAM,8BAA8B,KAAK,GAAG,OAAO,oBAAoB,OAAO;AAG9F;AAEA,SAAS,sBAAsB,QAA8C;CAC3E,IAAI,OAAO,WAAW,GACpB,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK;CAC/B,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,SAAS,MAAM,QAChC,MAAM,IAAI,MAAM,6DAA6D;CAE/E,KAAK,MAAM,QAAQ,OACjB,IACE,CAAC,2BAA2B,KAAK,IAAI,KACrC;EAAC;EAAa;EAAe;CAAW,CAAC,CAAC,SAAS,IAAI,GAEvD,MAAM,IAAI,MAAM,2DAA2D,MAAM;CAGrF,OAAO,OAAO,OAAO,KAAK;AAC5B;AAEA,SAAS,oBAAoB,OAAuB;CAClD,IACE,MAAM,SAAS,OACf,UAAU,MAAM,YAAY,KAC5B,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,GAAG,KAClB,UAAU,eACV,MAAM,SAAS,YAAY,KAC3B,UAAU,qBACV,UAAU,4BAEV,MAAM,IAAI,MAAM,oEAAoE;CAEtF,MAAM,SAAS,MAAM,MAAM,GAAG;CAC9B,IACE,OAAO,SAAS,KAChB,CAAC,OAAO,OACL,UACC,MAAM,UAAU,KAAK,MAAM,UAAU,MAAM,oCAAoC,KAAK,KAAK,CAC7F,KACA,CAAC,QAAQ,KAAK,OAAO,GAAG,EAAE,KAAK,EAAE,GAEjC,MAAM,IAAI,MAAM,oEAAoE;CAEtF,OAAO;AACT;AAEA,SAAS,eAAe,aAAqB,eAA+B;CAC1E,OAAO,yBAAyB;EAAE;EAAa;CAAc,CAAC;AAChE;AAEA,SAAS,kBACP,cACA,aACA,KACM;CACN,KAAK,MAAM,CAAC,KAAK,UAAU,cACzB,IAAI,MAAM,eAAe,KAAK,aAAa,OAAO,GAAG;CAEvD,KAAK,MAAM,CAAC,KAAK,UAAU,aACzB,IAAI,MAAM,eAAe,KAAK,YAAY,OAAO,GAAG;AAExD;AAEA,SAAS,mBACP,aACA,KACA,OACM;CACN,YAAY,OAAO,GAAG;CACtB,YAAY,IAAI,KAAK,KAAK;CAC1B,OAAO,YAAY,OAAO,wBAAwB;EAChD,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;EACzC,IAAI,WAAW,KAAA,GAAW;EAC1B,YAAY,OAAO,MAAM;CAC3B;AACF;AAEA,SAAS,eAAe,OAAuC;CAC7D,OAAO,OAAO,UAAU,YAAY,wBAAwB,KAAK,KAAK;AACxE;AAEA,SAAS,YACP,OACA,MACA,OACyB;CACzB,MAAM,SAAS,OAAO,OAAO,KAAK;CAClC,sBAAsB,QAAQ,MAAM,KAAK;CACzC,OAAO;AACT;AAEA,SAAS,OAAO,OAAgB,OAAwC;CACtE,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CAE9C,MAAM,YAAY,OAAO,eAAe,KAAK;CAC7C,IAAI,cAAc,OAAO,aAAa,cAAc,MAClD,MAAM,IAAI,MAAM,GAAG,MAAM,wBAAwB;CAEnD,OAAO;AACT"}
+{"version":3,"file":"protected-model-port-48ALLGxT.js","names":["isSha256Digest"],"sources":["../src/candidate-execution/exact-process-executor.ts","../src/candidate-execution/protected-model-port.ts"],"sourcesContent":["import { posix } from 'node:path'\nimport { isDeepStrictEqual } from 'node:util'\n\nimport type { TraceStore } from '@tangle-network/agent-eval'\nimport type { AgentCandidateTermination, Sha256Digest } from '@tangle-network/agent-interface'\nimport type {\n  AgentEnvironmentCapabilities,\n  AgentEnvironmentProvider,\n  AgentExactProcess,\n  AgentExactProcessEnvironment,\n  AgentExactProcessLaunch,\n  AgentExactProcessResources,\n  AgentExactProcessStatus,\n} from '@tangle-network/agent-interface/environment-provider'\n\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  immutableCandidateValue,\n  sha256Bytes,\n} from './digest'\nimport {\n  CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV,\n  CANDIDATE_KNOWLEDGE_ROOT_ENV,\n  candidateKnowledgeExecutionPaths,\n} from './knowledge'\nimport type {\n  AgentCandidateExecutorPort,\n  AgentCandidateExecutorRequest,\n  AgentCandidateExecutorStopRequest,\n} from './types'\n\nconst DEFAULT_PROVISION_TIMEOUT_MS = 120_000\nconst DEFAULT_RECOVERY_RETENTION_MS = 15 * 60_000\n\ninterface ExactProcessRunState {\n  environment: AgentExactProcessEnvironment\n  output?: Uint8Array\n  termination?: AgentCandidateTermination\n  runtimeTermination?: AgentCandidateTermination\n  trace?: {\n    runId: string\n    scenarioId: string\n    startedAt: number\n    deadlineAtMs: number\n    timeoutMs: number\n    tags: Record<string, string>\n    written: boolean\n  }\n}\n\nexport interface ExactProcessCandidateExecutorOptions {\n  provider: AgentEnvironmentProvider\n  resources: AgentExactProcessResources\n  provisionTimeoutMs?: number\n  recoveryRetentionMs?: number\n  providerOptions?: Record<string, unknown>\n}\n\n/** Adapt one neutral exact-process provider to Runtime's trusted candidate boundary. */\nexport function exactProcessProviderAsCandidateExecutor(\n  options: ExactProcessCandidateExecutorOptions,\n): AgentCandidateExecutorPort {\n  return new ExactProcessAgentCandidateExecutor(options)\n}\n\nclass ExactProcessAgentCandidateExecutor implements AgentCandidateExecutorPort {\n  private readonly states = new Map<string, ExactProcessRunState>()\n  private readonly exactProcess\n  private readonly resources: AgentExactProcessResources\n  private readonly provisionTimeoutMs: number\n  private readonly recoveryRetentionMs: number\n  private readonly providerOptions?: Record<string, unknown>\n  private capabilitiesPromise?: Promise<AgentEnvironmentCapabilities>\n\n  constructor(private readonly options: ExactProcessCandidateExecutorOptions) {\n    if (!options.provider.exactProcess) {\n      throw new Error(\n        `agent environment provider \"${options.provider.name}\" does not implement exact processes`,\n      )\n    }\n    this.exactProcess = options.provider.exactProcess\n    this.resources = exactResources(options.resources)\n    this.provisionTimeoutMs = positiveInteger(\n      options.provisionTimeoutMs ?? DEFAULT_PROVISION_TIMEOUT_MS,\n      'exact process provision timeout',\n    )\n    this.recoveryRetentionMs = positiveInteger(\n      options.recoveryRetentionMs ?? DEFAULT_RECOVERY_RETENTION_MS,\n      'exact process recovery retention',\n    )\n    this.providerOptions = options.providerOptions\n      ? immutableCandidateValue(options.providerOptions)\n      : undefined\n  }\n\n  async execute(\n    request: AgentCandidateExecutorRequest,\n    context: Parameters<AgentCandidateExecutorPort['execute']>[1],\n  ) {\n    assertSupportedRequest(request)\n    const outcome = request.benchmark.task.outcome\n    if (outcome.kind !== 'output') throw new Error('exact process executor requires an output task')\n    const network = request.executionPlan.value.material.model.access.network\n    const egress =\n      network.mode === 'disabled'\n        ? ({ mode: 'blocked' } as const)\n        : ({ mode: 'strict', allowDomains: [...network.domains] } as const)\n    await this.assertCapability(egress.mode)\n    context.signal.throwIfAborted()\n\n    const key = executionKey(request.executionId, request.executionPlan.value.digest)\n    if (this.states.has(key)) throw new Error('candidate execution environment is already active')\n    const image = exactImage(\n      request.executionPlan.value.material.container.image,\n      request.executionPlan.value.material.container.manifestDigest,\n    )\n    const maxLifetimeMs = environmentLifetimeMs(\n      request.hardLimits.timeoutMs,\n      this.recoveryRetentionMs,\n    )\n    const createMaterial = immutableCandidateValue({\n      kind: 'agent-candidate-exact-process-create',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlan.value.digest,\n      image,\n      egress,\n      maxLifetimeMs,\n      provisionTimeoutMs: this.provisionTimeoutMs,\n      resources: this.resources,\n      output: { mediaType: outcome.mediaType, maxBytes: outcome.maxBytes },\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    const createInputDigest = canonicalCandidateDigest(createMaterial)\n    const metadata = immutableCandidateValue({\n      kind: 'agent-candidate-execution',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlan.value.digest,\n      createInputDigest,\n      outputMediaType: outcome.mediaType,\n      outputMaxBytes: outcome.maxBytes,\n    })\n    const environment = await this.exactProcess.create({\n      image,\n      egress,\n      maxLifetimeMs,\n      provisionTimeoutMs: this.provisionTimeoutMs,\n      resources: this.resources,\n      metadata,\n      idempotencyKey: executionIdempotencyKey(\n        request.executionId,\n        request.executionPlan.value.digest,\n      ),\n      signal: context.signal,\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    try {\n      assertExecutionEnvironment(environment, metadata, this.options.provider.name)\n    } catch (error) {\n      try {\n        await environment.destroy()\n      } catch (cleanupError) {\n        throw new AggregateError(\n          [error, cleanupError],\n          'exact process validation and cleanup both failed',\n        )\n      }\n      throw error\n    }\n    const state: ExactProcessRunState = { environment }\n    this.states.set(key, state)\n\n    const existing = await environment.process.list()\n    if (existing.length !== 0) {\n      throw new Error('fresh candidate environment already contains a process')\n    }\n    await materializeRequest(environment, request, context.signal)\n    const launch = exactLaunch(request)\n    const startedAt = Date.now()\n    state.trace = {\n      runId: request.trace.runId,\n      scenarioId: request.benchmark.task.scenario.id,\n      startedAt,\n      deadlineAtMs: context.deadlineAtMs,\n      timeoutMs: request.hardLimits.timeoutMs,\n      tags: {\n        ...request.trace.tags,\n        environmentId: environment.id,\n        environmentProvider: environment.provider,\n      },\n      written: false,\n    }\n    const process = await environment.process.spawn(launch, { signal: context.signal })\n    const outputPromise = collectOutput(process, outcome.maxBytes)\n    void outputPromise.catch(() => undefined)\n    let cancellation: Promise<void> | undefined\n    let processExited = false\n    const cancel = () => {\n      if (!processExited) cancellation ??= stopProcess(process)\n    }\n    context.signal.addEventListener('abort', cancel, { once: true })\n    if (context.signal.aborted) cancel()\n    try {\n      const termination = await process.wait()\n      processExited = true\n      context.signal.removeEventListener('abort', cancel)\n      if (cancellation) await cancellation\n      const status = await process.status()\n      assertTerminalStatus(status, termination)\n      state.output = await awaitOutput(outputPromise, context.signal, context.deadlineAtMs)\n      state.termination = termination\n      await appendExactProcessTrace(state, context.traceStore, status)\n      return { executionId: request.executionId, termination }\n    } finally {\n      context.signal.removeEventListener('abort', cancel)\n    }\n  }\n\n  async stop(\n    request: AgentCandidateExecutorStopRequest,\n    context: Parameters<AgentCandidateExecutorPort['stop']>[1],\n  ): Promise<{ readonly stopped: true }> {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, true)\n    if (!environment) return { stopped: true }\n    let statuses = await environment.process.list()\n    if (statuses.length > 1) {\n      throw new Error('candidate exact process environment contains more than one process')\n    }\n    const status = statuses[0]\n    if (status?.running) {\n      const process = await environment.process.get(status.pid)\n      if (!process) throw new Error('candidate environment lost its running process handle')\n      await stopProcess(process)\n    }\n    context.signal.throwIfAborted()\n    statuses = await environment.process.list()\n    if (statuses.some((entry) => entry.running)) {\n      throw new Error('candidate exact process termination is not proven')\n    }\n    const finalStatus = statuses[0]\n    if (finalStatus) assertTerminalStatus(finalStatus)\n    const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest))\n    if (state) {\n      state.termination = finalStatus?.termination ?? state.termination\n      if (context.reason === 'timeout' && state.trace) {\n        state.runtimeTermination = {\n          kind: 'timeout',\n          timeoutMs: state.trace.timeoutMs,\n        }\n      }\n      await appendExactProcessTrace(state, context.traceStore, finalStatus)\n    }\n    return { stopped: true }\n  }\n\n  async capture(\n    request: AgentCandidateExecutorStopRequest,\n    context: Parameters<AgentCandidateExecutorPort['capture']>[1],\n  ) {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, false)\n    const statuses = await environment.process.list()\n    const status = statuses[0]\n    if (statuses.length !== 1 || !status || status.running) {\n      throw new Error('candidate environment must contain one stopped process before capture')\n    }\n    assertTerminalStatus(status)\n    const process = await environment.process.get(status.pid)\n    if (!process) throw new Error('candidate environment lost its captured process handle')\n    const currentStatus = await process.status()\n    assertTerminalStatus(currentStatus, status.termination)\n    const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest))\n    const output =\n      state?.output ??\n      (await awaitOutput(\n        collectOutput(process, outputSpec(environment).maxBytes),\n        context.signal,\n        Date.now() + this.provisionTimeoutMs,\n      ))\n    context.signal.throwIfAborted()\n    const evidence = canonicalCandidateBytes({\n      kind: 'agent-candidate-exact-process-capture',\n      provider: environment.provider,\n      environmentId: environment.id,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlanDigest,\n      createInputDigest: environment.metadata?.createInputDigest,\n      process: {\n        pid: status.pid,\n        exitCode: status.exitCode,\n        ...(status.exitSignal ? { exitSignal: status.exitSignal } : {}),\n        termination: status.termination,\n      },\n      ...(state?.runtimeTermination ? { runtimeTermination: state.runtimeTermination } : {}),\n      output: { sha256: sha256Bytes(output), byteLength: output.byteLength },\n    })\n    return {\n      taskOutcome: { kind: 'output' as const, bytes: output },\n      evidence,\n    }\n  }\n\n  async dispose(\n    request: AgentCandidateExecutorStopRequest,\n    context: { signal: AbortSignal },\n  ): Promise<{ readonly disposed: true }> {\n    await this.assertCapability()\n    context.signal.throwIfAborted()\n    const environment = await this.resolve(request, true)\n    if (!environment) return { disposed: true }\n    let destroyError: unknown\n    try {\n      await environment.destroy()\n    } catch (error) {\n      destroyError = error\n    }\n    const remaining = await this.exactProcess.get(environment.id)\n    if (remaining) {\n      throw new Error('exact process environment disposal is not proven', { cause: destroyError })\n    }\n    context.signal.throwIfAborted()\n    this.states.delete(executionKey(request.executionId, request.executionPlanDigest))\n    return { disposed: true }\n  }\n\n  private async assertCapability(mode?: 'blocked' | 'strict'): Promise<void> {\n    const pending =\n      this.capabilitiesPromise ?? Promise.resolve(this.options.provider.capabilities())\n    this.capabilitiesPromise = pending\n    let capabilities: AgentEnvironmentCapabilities\n    try {\n      capabilities = await pending\n    } catch (error) {\n      if (this.capabilitiesPromise === pending) this.capabilitiesPromise = undefined\n      throw error\n    }\n    const exact = capabilities.exactProcess\n    if (!exact) {\n      throw new Error(\n        `agent environment provider \"${this.options.provider.name}\" does not declare exact process support`,\n      )\n    }\n    if (mode && !exact.egress.includes(mode)) {\n      throw new Error(\n        `agent environment provider \"${this.options.provider.name}\" does not declare ${mode} exact egress`,\n      )\n    }\n  }\n\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: false,\n  ): Promise<AgentExactProcessEnvironment>\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: true,\n  ): Promise<AgentExactProcessEnvironment | undefined>\n  private async resolve(\n    request: AgentCandidateExecutorStopRequest,\n    missingIsDeleted: boolean,\n  ): Promise<AgentExactProcessEnvironment | undefined> {\n    const key = executionKey(request.executionId, request.executionPlanDigest)\n    const active = this.states.get(key)?.environment\n    if (active) return active\n    const metadata = {\n      kind: 'agent-candidate-execution',\n      provider: this.options.provider.name,\n      executionId: request.executionId,\n      executionPlanDigest: request.executionPlanDigest,\n    }\n    const listed = await this.exactProcess.list({\n      metadata,\n      ...(this.providerOptions ? { providerOptions: this.providerOptions } : {}),\n    })\n    const matches = listed.filter(\n      (environment) =>\n        environment.provider === this.options.provider.name &&\n        Object.entries(metadata).every(([name, value]) =>\n          isDeepStrictEqual(environment.metadata?.[name], value),\n        ),\n    )\n    if (matches.length > 1) {\n      throw new Error('multiple exact process environments match one candidate execution')\n    }\n    const environment = matches[0]\n    if (!environment) {\n      if (missingIsDeleted) return undefined\n      throw new Error('candidate exact process evidence is unavailable')\n    }\n    if (!isSha256Digest(environment.metadata?.createInputDigest)) {\n      throw new Error('candidate exact process create-input digest is unavailable')\n    }\n    this.states.set(key, { environment })\n    return environment\n  }\n}\n\nasync function appendExactProcessTrace(\n  state: ExactProcessRunState,\n  traceStore: TraceStore,\n  status?: AgentExactProcessStatus,\n): Promise<void> {\n  const trace = state.trace\n  if (!trace || trace.written) return\n  const endedAt = Math.max(trace.startedAt, Math.min(Date.now(), trace.deadlineAtMs))\n  const termination = state.runtimeTermination ?? state.termination ?? status?.termination\n  await traceStore.appendRun({\n    runId: trace.runId,\n    scenarioId: trace.scenarioId,\n    startedAt: trace.startedAt,\n    endedAt,\n    status: termination?.kind === 'exit' && termination.exitCode === 0 ? 'completed' : 'failed',\n    tags: trace.tags,\n  })\n  trace.written = true\n}\n\nfunction assertSupportedRequest(request: AgentCandidateExecutorRequest): void {\n  if (request.benchmark.task.outcome.kind !== 'output') {\n    throw new Error(\n      'exact process candidate executor does not support workspace outcomes; use Pier',\n    )\n  }\n  if (request.executionPlan.value.material.codeKind !== 'disabled' || request.inputs.candidate) {\n    throw new Error('exact process candidate executor does not support code workspaces; use Pier')\n  }\n  if (request.memory.mode !== 'disabled') {\n    throw new Error('exact process candidate executor does not support isolated memory')\n  }\n  const mediaType = request.benchmark.task.outcome.mediaType.toLowerCase()\n  if (\n    !(\n      mediaType.startsWith('text/') ||\n      mediaType === 'application/json' ||\n      mediaType.endsWith('+json')\n    )\n  ) {\n    throw new Error('exact process candidate executor supports only UTF-8 text and JSON outputs')\n  }\n  if (!posix.isAbsolute(request.launch.executable) && !request.launch.env.PATH?.trim()) {\n    throw new Error('exact process candidate executable must be absolute or declare a signed PATH')\n  }\n}\n\nasync function materializeRequest(\n  environment: AgentExactProcessEnvironment,\n  request: AgentCandidateExecutorRequest,\n  signal: AbortSignal,\n): Promise<void> {\n  const knowledgePaths = assertKnowledgeExecutionBinding(request)\n  for (const file of request.inputs.task.files) {\n    await environment.writeFile(beneath(request.roots.taskRoot, file.path), file.bytes, {\n      mode: file.mode,\n      signal,\n    })\n  }\n  const profileRoot =\n    request.executionPlan.value.material.profile.targetWorkspace === 'task'\n      ? request.roots.taskRoot\n      : request.roots.candidateRoot\n  if (!profileRoot) throw new Error('candidate profile targets a missing workspace')\n  for (const file of request.profileActivation.files) {\n    await environment.writeFile(\n      beneath(profileRoot, file.path),\n      Buffer.from(file.content, 'utf8'),\n      { mode: file.mode, signal },\n    )\n  }\n  if (request.knowledge && knowledgePaths) {\n    for (const file of request.knowledge.files) {\n      await environment.writeFile(beneath(knowledgePaths.root, file.path), file.bytes, {\n        mode: file.mode,\n        signal,\n      })\n    }\n    if (request.knowledge.retrievalConfig && knowledgePaths.retrievalConfig) {\n      await environment.writeFile(\n        knowledgePaths.retrievalConfig,\n        request.knowledge.retrievalConfig,\n        { mode: 0o644, signal },\n      )\n    }\n  }\n  if (request.instruction.delivery.kind === 'utf8-file') {\n    await environment.writeFile(request.instruction.delivery.path, request.instruction.bytes, {\n      mode: 0o644,\n      signal,\n    })\n  }\n}\n\nfunction assertKnowledgeExecutionBinding(\n  request: AgentCandidateExecutorRequest,\n): ReturnType<typeof candidateKnowledgeExecutionPaths> | undefined {\n  const knowledge = request.knowledge\n  if (!knowledge) {\n    if (\n      request.launch.env[CANDIDATE_KNOWLEDGE_ROOT_ENV] !== undefined ||\n      request.launch.env[CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV] !== undefined\n    ) {\n      throw new Error('candidate launch declares knowledge paths without verified knowledge')\n    }\n    return undefined\n  }\n  const paths = candidateKnowledgeExecutionPaths(\n    request.roots.taskRoot,\n    knowledge.retrievalConfig !== undefined,\n  )\n  if (\n    request.launch.env[CANDIDATE_KNOWLEDGE_ROOT_ENV] !== paths.root ||\n    request.launch.env[CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV] !== paths.retrievalConfig\n  ) {\n    throw new Error('candidate knowledge paths do not match the signed launch environment')\n  }\n  const reserved = [paths.root, paths.retrievalConfig].filter(\n    (value): value is string => value !== undefined,\n  )\n  const profileRoot =\n    request.executionPlan.value.material.profile.targetWorkspace === 'task'\n      ? request.roots.taskRoot\n      : request.roots.candidateRoot\n  const otherFiles = [\n    ...request.inputs.task.files.map((file) => beneath(request.roots.taskRoot, file.path)),\n    ...(profileRoot\n      ? request.profileActivation.files.map((file) => beneath(profileRoot, file.path))\n      : []),\n    ...(request.instruction.delivery.kind === 'utf8-file'\n      ? [request.instruction.delivery.path]\n      : []),\n  ]\n  if (\n    otherFiles.some((path) =>\n      reserved.some(\n        (reservedPath) =>\n          path === reservedPath ||\n          path.startsWith(`${reservedPath}/`) ||\n          reservedPath.startsWith(`${path}/`),\n      ),\n    )\n  ) {\n    throw new Error('candidate knowledge paths overlap other execution inputs')\n  }\n  return paths\n}\n\nfunction exactLaunch(request: AgentCandidateExecutorRequest): AgentExactProcessLaunch {\n  const instruction = new TextDecoder('utf-8', { fatal: true }).decode(request.instruction.bytes)\n  const base = {\n    executable: request.launch.executable,\n    args: request.launch.args,\n    cwd: request.launch.cwd,\n    env: request.launch.env,\n    timeoutMs: 0,\n  }\n  switch (request.instruction.delivery.kind) {\n    case 'argv-append':\n      return { ...base, args: [...base.args, instruction] }\n    case 'stdin-utf8':\n      return { ...base, stdin: instruction }\n    case 'utf8-file':\n      return base\n  }\n}\n\nasync function collectOutput(process: AgentExactProcess, maxBytes: number): Promise<Uint8Array> {\n  const chunks: Buffer[] = []\n  let byteLength = 0\n  for await (const chunk of process.stdout()) {\n    const bytes = Buffer.from(chunk, 'utf8')\n    byteLength += bytes.byteLength\n    if (byteLength > maxBytes) {\n      let stopError: unknown\n      try {\n        await stopProcess(process)\n      } catch (error) {\n        stopError = error\n      }\n      throw new Error(`candidate output exceeds its ${maxBytes}-byte maximum`, {\n        cause: stopError,\n      })\n    }\n    chunks.push(bytes)\n  }\n  return Uint8Array.from(Buffer.concat(chunks, byteLength))\n}\n\nasync function awaitOutput(\n  output: Promise<Uint8Array>,\n  signal: AbortSignal,\n  deadlineAtMs: number,\n): Promise<Uint8Array> {\n  signal.throwIfAborted()\n  const remainingMs = deadlineAtMs - Date.now()\n  if (remainingMs <= 0) throw new Error('candidate output deadline expired')\n  let timer: ReturnType<typeof setTimeout> | undefined\n  let onAbort: (() => void) | undefined\n  try {\n    return await Promise.race([\n      output,\n      new Promise<never>((_resolve, reject) => {\n        onAbort = () => reject(signal.reason ?? new Error('candidate output cancelled'))\n        signal.addEventListener('abort', onAbort, { once: true })\n        timer = setTimeout(\n          () => reject(new Error('candidate output deadline expired')),\n          remainingMs,\n        )\n      }),\n    ])\n  } finally {\n    if (onAbort) signal.removeEventListener('abort', onAbort)\n    if (timer) clearTimeout(timer)\n  }\n}\n\nasync function stopProcess(process: AgentExactProcess): Promise<void> {\n  const before = await process.status()\n  if (!before.running) return\n  try {\n    await process.kill()\n  } catch (error) {\n    if ((await process.status()).running) throw error\n  }\n  const termination = await process.wait()\n  assertTerminalStatus(await process.status(), termination)\n}\n\nfunction assertTerminalStatus(\n  status: AgentExactProcessStatus,\n  expected?: AgentCandidateTermination,\n): asserts status is AgentExactProcessStatus & { termination: AgentCandidateTermination } {\n  if (status.running || !status.termination) {\n    throw new Error('exact process returned no terminal reason after exit')\n  }\n  if (expected && !isDeepStrictEqual(status.termination, expected)) {\n    throw new Error('exact process wait and status returned different terminal reasons')\n  }\n}\n\nfunction assertExecutionEnvironment(\n  environment: AgentExactProcessEnvironment,\n  metadata: Record<string, unknown>,\n  providerName: string,\n): void {\n  if (!environment.id || environment.provider !== providerName) {\n    throw new Error('exact process provider returned the wrong environment identity')\n  }\n  if (\n    !Object.entries(metadata).every(([name, value]) =>\n      isDeepStrictEqual(environment.metadata?.[name], value),\n    )\n  ) {\n    throw new Error('exact process provider did not persist candidate execution metadata')\n  }\n}\n\nfunction outputSpec(environment: AgentExactProcessEnvironment): { maxBytes: number } {\n  const maxBytes = environment.metadata?.outputMaxBytes\n  if (!Number.isSafeInteger(maxBytes) || Number(maxBytes) < 1) {\n    throw new Error('candidate exact process output bound is unavailable')\n  }\n  return { maxBytes: Number(maxBytes) }\n}\n\nfunction executionKey(executionId: string, executionPlanDigest: Sha256Digest): string {\n  return `${executionId}\\0${executionPlanDigest}`\n}\n\nfunction executionIdempotencyKey(executionId: string, executionPlanDigest: Sha256Digest): string {\n  return `candidate-${canonicalCandidateDigest({\n    kind: 'agent-candidate-execution-identity',\n    executionId,\n    executionPlanDigest,\n  }).slice('sha256:'.length)}`\n}\n\nfunction exactImage(image: string, manifestDigest: Sha256Digest): string {\n  if (isSha256Digest(image)) {\n    if (image !== manifestDigest) {\n      throw new Error('candidate container image conflicts with its resolved manifest')\n    }\n    return image\n  }\n  const marker = image.lastIndexOf('@')\n  if (marker < 0) return `${image}@${manifestDigest}`\n  if (image.slice(marker + 1) !== manifestDigest) {\n    throw new Error('candidate container image conflicts with its resolved manifest')\n  }\n  return image\n}\n\nfunction environmentLifetimeMs(timeoutMs: number, retentionMs: number): number {\n  const total = positiveInteger(timeoutMs, 'candidate execution timeout') + retentionMs\n  if (!Number.isSafeInteger(total)) throw new Error('candidate environment lifetime is too large')\n  return Math.ceil(total / 1_000) * 1_000\n}\n\nfunction exactResources(resources: AgentExactProcessResources): AgentExactProcessResources {\n  if (!Number.isFinite(resources.cpu) || resources.cpu <= 0) {\n    throw new Error('exact process CPU must be positive and finite')\n  }\n  return Object.freeze({\n    cpu: resources.cpu,\n    memoryMb: positiveInteger(resources.memoryMb, 'exact process memory'),\n    diskMb: positiveInteger(resources.diskMb, 'exact process disk'),\n  })\n}\n\nfunction positiveInteger(value: number, label: string): number {\n  if (!Number.isSafeInteger(value) || value < 1)\n    throw new Error(`${label} must be a positive integer`)\n  return value\n}\n\nfunction beneath(root: string, relativePath: string): string {\n  if (posix.isAbsolute(relativePath)) throw new Error('candidate input path must be relative')\n  const path = posix.normalize(relativePath)\n  if (path === '..' || path.startsWith('../')) {\n    throw new Error('candidate input path escapes its execution root')\n  }\n  return posix.join(root, path)\n}\n\nfunction isSha256Digest(value: unknown): value is Sha256Digest {\n  return typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value)\n}\n","import type {\n  AgentCandidateModelAccessNetwork,\n  AgentCandidateResolvedModel,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateDigest, immutableCandidateValue } from './digest'\nimport { assertExactObjectKeys } from './exact-object'\nimport { sealAgentCandidateModelSettlement, usdToNanos } from './model-settlement'\nimport type {\n  AgentCandidateModelLimits,\n  AgentCandidateModelPort,\n  AgentCandidateProtectedModelActivation,\n  AgentCandidateProtectedModelReservation,\n  AgentCandidateProtectedModelSettlement,\n} from './types'\n\nexport type AgentCandidateModelGrantReserveInput = Parameters<\n  AgentCandidateModelPort['reserveGrant']\n>[0]\nexport type AgentCandidateModelGrantActivateInput = Parameters<\n  AgentCandidateModelPort['activateGrant']\n>[0]\nexport type AgentCandidateModelGrantSettleInput = Parameters<\n  AgentCandidateModelPort['settleGrant']\n>[0]\n\n/** Secret-free response from the service's reservation endpoint. */\nexport type AgentCandidateModelGrantReservation = AgentCandidateProtectedModelReservation\n\n/**\n * Narrow transport contract for a service that owns scoped model credentials\n * and the authoritative per-call usage ledger.\n *\n * An HTTP client can bind these methods to control-plane endpoints. Keeping\n * transport out of the runtime prevents parent credentials, endpoint paths,\n * and retry policy from becoming part of the portable candidate contract.\n */\nexport interface AgentCandidateModelGrantClient {\n  reserve(input: AgentCandidateModelGrantReserveInput): Promise<AgentCandidateModelGrantReservation>\n  activate(\n    input: AgentCandidateModelGrantActivateInput,\n  ): Promise<AgentCandidateProtectedModelActivation>\n  settle(\n    input: AgentCandidateModelGrantSettleInput,\n  ): Promise<AgentCandidateProtectedModelSettlement>\n}\n\nexport interface CreateProtectedAgentCandidateModelPortOptions {\n  client: AgentCandidateModelGrantClient\n  /** Catalog/snapshot resolution stays separate from credential issuance. */\n  resolveModel: AgentCandidateModelPort['resolve']\n  /** The only public DNS name candidate processes may reach for inference. */\n  gatewayDomain: string\n  /** Exact environment names the activation endpoint must return, no more or fewer. */\n  activationEnvNames: readonly string[]\n}\n\ninterface RememberedReservation {\n  requestDigest: Sha256Digest\n  responseDigest: Sha256Digest\n  executionId: string\n  preparationId: string\n  grantDigest: Sha256Digest\n  expiresAtMs: number\n  resolved: AgentCandidateResolvedModel\n  limits: AgentCandidateModelLimits\n  maxCostUsdNanos: number\n  activation: 'reserved' | 'activating' | 'activated'\n  settlementDigest?: Sha256Digest\n  settlementReason?: AgentCandidateModelGrantSettleInput['reason']\n}\n\ninterface RememberedSettlement {\n  settlementDigest: Sha256Digest\n  settlementReason: AgentCandidateModelGrantSettleInput['reason']\n  expiresAtMs: number\n}\n\nconst MAX_RECENT_SETTLEMENTS = 4_096\nconst RECOVERED_SETTLEMENT_RETENTION_MS = 15 * 60 * 1_000\n\n/**\n * Bind a protected model-grant service to the immutable candidate runtime.\n *\n * The service remains the authority for expiry, admission, revocation, and\n * metering. This adapter independently checks every response before allowing\n * it to cross into candidate execution or durable receipt finalization.\n */\nexport function createProtectedAgentCandidateModelPort(\n  options: CreateProtectedAgentCandidateModelPortOptions,\n): AgentCandidateModelPort {\n  const gatewayDomain = assertGatewayDomain(options.gatewayDomain)\n  const activationEnvNames = exactEnvironmentNames(options.activationEnvNames)\n  const reservations = new Map<string, RememberedReservation>()\n  const recentSettlements = new Map<string, RememberedSettlement>()\n\n  return {\n    resolve: async (input) => {\n      const request = immutableCandidateValue(input)\n      const resolved = validateResolvedModel(await options.resolveModel(request), request)\n      return immutableCandidateValue(resolved)\n    },\n\n    reserveGrant: async (input) => {\n      pruneExpiredState(reservations, recentSettlements, Date.now())\n      const request = immutableCandidateValue(input)\n      validateReserveInput(request)\n      const requestDigest = canonicalCandidateDigest(request)\n      const key = reservationKey(request.executionId, request.preparationId)\n      if (recentSettlements.has(key)) {\n        throw new Error('protected model reservation is already settled')\n      }\n      const previous = reservations.get(key)\n      if (previous && previous.requestDigest !== requestDigest) {\n        throw new Error('protected model reservation retry changed immutable input')\n      }\n\n      const reservation = validateReservation(\n        await options.client.reserve(request),\n        request,\n        gatewayDomain,\n      )\n      const responseDigest = canonicalCandidateDigest(reservation)\n      if (recentSettlements.has(key)) {\n        throw new Error('protected model reservation completed after the grant was settled')\n      }\n      const recorded = previous ?? reservations.get(key)\n      if (recorded && recorded.requestDigest !== requestDigest) {\n        throw new Error('protected model reservation retry changed immutable input')\n      }\n      if (recorded && recorded.responseDigest !== responseDigest) {\n        throw new Error('protected model reservation retry returned different evidence')\n      }\n      if (!recorded) {\n        reservations.set(key, {\n          requestDigest,\n          responseDigest,\n          executionId: request.executionId,\n          preparationId: request.preparationId,\n          grantDigest: reservation.digest,\n          expiresAtMs: request.expiresAtMs,\n          resolved: immutableCandidateValue(request.resolved),\n          limits: immutableCandidateValue(request.limits),\n          maxCostUsdNanos: usdToNanos(request.limits.maxCostUsd, 'reserved maxCostUsd'),\n          activation: 'reserved',\n        })\n      }\n      return reservation\n    },\n\n    activateGrant: async (input) => {\n      pruneExpiredState(reservations, recentSettlements, Date.now())\n      const request = immutableCandidateValue(input)\n      const key = reservationKey(request.executionId, request.preparationId)\n      if (recentSettlements.has(key)) throw new Error('protected model grant is already settled')\n      const state = reservations.get(key)\n      if (!state) throw new Error('protected model grant was not reserved by this port')\n      assertGrantIdentity(state, request)\n      if (state.settlementDigest) throw new Error('protected model grant is already settled')\n      if (state.activation !== 'reserved') {\n        throw new Error('protected model grant activation is single-use')\n      }\n      if (!Number.isSafeInteger(request.deadlineAtMs) || request.deadlineAtMs <= 0) {\n        throw new Error('protected model activation deadline must be a positive safe integer')\n      }\n      if (request.deadlineAtMs <= Date.now()) {\n        throw new Error('protected model activation deadline must be in the future')\n      }\n      if (request.deadlineAtMs > state.expiresAtMs) {\n        throw new Error('protected model activation deadline exceeds the reserved expiry')\n      }\n      state.activation = 'activating'\n      try {\n        const activation = validateActivation(\n          await options.client.activate(request),\n          state.limits.maxModelCalls === 0 ? [] : activationEnvNames,\n        )\n        if (recentSettlements.has(key) || reservations.get(key) !== state) {\n          throw new Error('protected model grant settled while activation was in flight')\n        }\n        state.activation = 'activated'\n        return activation\n      } catch (error) {\n        state.activation = 'reserved'\n        throw error\n      }\n    },\n\n    settleGrant: async (input) => {\n      const now = Date.now()\n      pruneExpiredState(reservations, recentSettlements, now)\n      const request = immutableCandidateValue(input)\n      const key = reservationKey(request.executionId, request.preparationId)\n      const state = reservations.get(key)\n      if (state) assertGrantIdentity(state, request)\n      const remembered = state ?? recentSettlements.get(key)\n      if (remembered?.settlementReason && remembered.settlementReason !== request.reason) {\n        throw new Error('protected model settlement retry changed the termination reason')\n      }\n\n      const sealed = sealAgentCandidateModelSettlement(await options.client.settle(request), {\n        preparationId: request.preparationId,\n        grantDigest: request.grantDigest,\n        model: request.resolved.model,\n      })\n      if (state) assertWithinReservedLimits(sealed.usage, state)\n\n      const settlementDigest = canonicalCandidateDigest(sealed.value)\n      if (remembered?.settlementDigest && remembered.settlementDigest !== settlementDigest) {\n        throw new Error('protected model settlement retry returned a different final ledger')\n      }\n      if (remembered?.settlementReason && remembered.settlementReason !== request.reason) {\n        throw new Error('protected model settlement retry changed the termination reason')\n      }\n      const expiresAtMs = state?.expiresAtMs ?? now + RECOVERED_SETTLEMENT_RETENTION_MS\n      if (state) {\n        state.settlementDigest = settlementDigest\n        state.settlementReason = request.reason\n      }\n      reservations.delete(key)\n      rememberSettlement(recentSettlements, key, {\n        settlementDigest,\n        settlementReason: request.reason,\n        expiresAtMs,\n      })\n      return sealed.value\n    },\n  }\n}\n\nfunction validateReserveInput(input: AgentCandidateModelGrantReserveInput): void {\n  if (!Number.isSafeInteger(input.expiresAtMs) || input.expiresAtMs <= 0) {\n    throw new Error('protected model reservation expiry must be a positive safe integer')\n  }\n  if (input.expiresAtMs <= Date.now()) {\n    throw new Error('protected model reservation expiry must be in the future')\n  }\n  for (const [name, value] of [\n    ['maxModelCalls', input.limits.maxModelCalls],\n    ['maxInputTokens', input.limits.maxInputTokens],\n    ['maxOutputTokens', input.limits.maxOutputTokens],\n  ] as const) {\n    if (!Number.isSafeInteger(value) || value < 0) {\n      throw new Error(`protected model reservation ${name} must be a nonnegative safe integer`)\n    }\n  }\n  usdToNanos(input.limits.maxCostUsd, 'reserved maxCostUsd')\n}\n\nfunction validateReservation(\n  value: unknown,\n  expected: AgentCandidateModelGrantReserveInput,\n  gatewayDomain: string,\n): AgentCandidateModelGrantReservation {\n  const source = exactRecord(\n    value,\n    ['preparationId', 'digest', 'expiresAtMs', 'enforcedLimits', 'network'],\n    'protected model reservation response',\n  )\n  if (source.preparationId !== expected.preparationId) {\n    throw new Error('protected model reservation response changed preparation identity')\n  }\n  if (!isSha256Digest(source.digest)) {\n    throw new Error('protected model reservation response has an invalid digest')\n  }\n  if (source.expiresAtMs !== expected.expiresAtMs) {\n    throw new Error('protected model reservation response changed expiry')\n  }\n  exactRecord(\n    source.enforcedLimits,\n    ['maxModelCalls', 'maxInputTokens', 'maxOutputTokens', 'maxCostUsd'],\n    'protected model reservation enforced limits',\n  )\n  if (\n    canonicalCandidateDigest(source.enforcedLimits) !== canonicalCandidateDigest(expected.limits)\n  ) {\n    throw new Error('protected model reservation response changed enforced limits')\n  }\n\n  const network = validateReservationNetwork(\n    source.network,\n    expected.limits.maxModelCalls,\n    gatewayDomain,\n  )\n  return immutableCandidateValue({\n    preparationId: source.preparationId,\n    digest: source.digest,\n    expiresAtMs: source.expiresAtMs,\n    enforcedLimits: source.enforcedLimits,\n    network,\n  }) as AgentCandidateModelGrantReservation\n}\n\nfunction validateReservationNetwork(\n  value: unknown,\n  maxModelCalls: number,\n  gatewayDomain: string,\n): AgentCandidateModelAccessNetwork {\n  if (maxModelCalls === 0) {\n    const source = exactRecord(value, ['mode'], 'protected model reservation network')\n    if (source.mode !== 'disabled') {\n      throw new Error('zero-call protected model reservation must disable gateway access')\n    }\n    return { mode: 'disabled' }\n  }\n\n  const source = exactRecord(value, ['mode', 'domains'], 'protected model reservation network')\n  if (source.mode !== 'gateway-only') {\n    throw new Error('protected model reservation must allow only its model gateway')\n  }\n  if (\n    !Array.isArray(source.domains) ||\n    source.domains.length !== 1 ||\n    source.domains[0] !== gatewayDomain\n  ) {\n    throw new Error('protected model reservation returned an unexpected gateway domain')\n  }\n  return { mode: 'gateway-only', domains: [gatewayDomain] }\n}\n\nfunction validateActivation(\n  value: unknown,\n  expectedNames: readonly string[],\n): AgentCandidateProtectedModelActivation {\n  const source = exactRecord(value, ['env'], 'protected model activation response')\n  const env = record(source.env, 'protected model activation environment')\n  const actualNames = Object.keys(env).sort()\n  if (\n    actualNames.length !== expectedNames.length ||\n    actualNames.some((name, index) => name !== expectedNames[index])\n  ) {\n    throw new Error('protected model activation returned unexpected environment names')\n  }\n  const detached: Record<string, string> = Object.create(null) as Record<string, string>\n  for (const name of expectedNames) {\n    const value = env[name]\n    if (typeof value !== 'string' || value.length < 8 || value.length > 65_536) {\n      throw new Error(`protected model activation ${name} must be a non-empty protected value`)\n    }\n    detached[name] = value\n  }\n  return Object.freeze({ env: Object.freeze(detached) })\n}\n\nfunction validateResolvedModel(\n  value: unknown,\n  expected: Parameters<AgentCandidateModelPort['resolve']>[0],\n): AgentCandidateResolvedModel {\n  const source = exactRecord(\n    value,\n    ['requested', 'provider', 'model', 'snapshot', 'reasoningEffort'],\n    'resolved candidate model',\n  )\n  if (source.requested !== expected.requested) {\n    throw new Error('model resolver changed the evaluator-owned request')\n  }\n  if (source.reasoningEffort !== expected.reasoningEffort) {\n    throw new Error('model resolver changed the evaluator-owned reasoning effort')\n  }\n  for (const name of ['requested', 'provider', 'model', 'snapshot'] as const) {\n    if (typeof source[name] !== 'string' || source[name].length === 0) {\n      throw new Error(`resolved candidate model ${name} must be non-empty`)\n    }\n  }\n  return source as unknown as AgentCandidateResolvedModel\n}\n\nfunction assertGrantIdentity(\n  expected: RememberedReservation,\n  actual: AgentCandidateModelGrantActivateInput | AgentCandidateModelGrantSettleInput,\n): void {\n  if (\n    actual.executionId !== expected.executionId ||\n    actual.preparationId !== expected.preparationId ||\n    actual.grantDigest !== expected.grantDigest ||\n    canonicalCandidateDigest(actual.resolved) !== canonicalCandidateDigest(expected.resolved)\n  ) {\n    throw new Error('protected model grant input does not match its immutable reservation')\n  }\n}\n\nfunction assertWithinReservedLimits(\n  usage: {\n    modelCalls: number\n    inputTokens: number\n    outputTokens: number\n    costUsdNanos: number\n  },\n  reservation: RememberedReservation,\n): void {\n  for (const [name, actual, limit] of [\n    ['model calls', usage.modelCalls, reservation.limits.maxModelCalls],\n    ['input tokens', usage.inputTokens, reservation.limits.maxInputTokens],\n    ['output tokens', usage.outputTokens, reservation.limits.maxOutputTokens],\n    ['cost USD nanos', usage.costUsdNanos, reservation.maxCostUsdNanos],\n  ] as const) {\n    if (actual > limit) {\n      throw new Error(`protected model settlement ${name} ${actual} exceeds reserved ${limit}`)\n    }\n  }\n}\n\nfunction exactEnvironmentNames(values: readonly string[]): readonly string[] {\n  if (values.length === 0) {\n    throw new Error('protected model activation environment names must not be empty')\n  }\n  const names = [...values].sort()\n  if (new Set(names).size !== names.length) {\n    throw new Error('protected model activation environment names must be unique')\n  }\n  for (const name of names) {\n    if (\n      !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) ||\n      ['__proto__', 'constructor', 'prototype'].includes(name)\n    ) {\n      throw new Error(`protected model activation environment name is invalid: ${name}`)\n    }\n  }\n  return Object.freeze(names)\n}\n\nfunction assertGatewayDomain(value: string): string {\n  if (\n    value.length > 253 ||\n    value !== value.toLowerCase() ||\n    value.endsWith('.') ||\n    value.includes(':') ||\n    value === 'localhost' ||\n    value.endsWith('.localhost') ||\n    value === 'metadata.google' ||\n    value === 'metadata.google.internal'\n  ) {\n    throw new Error('protected model gateway must be an exact lowercase public DNS name')\n  }\n  const labels = value.split('.')\n  if (\n    labels.length < 2 ||\n    !labels.every(\n      (label) =>\n        label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label),\n    ) ||\n    !/[a-z]/.test(labels.at(-1) ?? '')\n  ) {\n    throw new Error('protected model gateway must be an exact lowercase public DNS name')\n  }\n  return value\n}\n\nfunction reservationKey(executionId: string, preparationId: string): string {\n  return canonicalCandidateDigest({ executionId, preparationId })\n}\n\nfunction pruneExpiredState(\n  reservations: Map<string, RememberedReservation>,\n  settlements: Map<string, RememberedSettlement>,\n  now: number,\n): void {\n  for (const [key, value] of reservations) {\n    if (value.expiresAtMs <= now) reservations.delete(key)\n  }\n  for (const [key, value] of settlements) {\n    if (value.expiresAtMs <= now) settlements.delete(key)\n  }\n}\n\nfunction rememberSettlement(\n  settlements: Map<string, RememberedSettlement>,\n  key: string,\n  value: RememberedSettlement,\n): void {\n  settlements.delete(key)\n  settlements.set(key, value)\n  while (settlements.size > MAX_RECENT_SETTLEMENTS) {\n    const oldest = settlements.keys().next().value\n    if (oldest === undefined) return\n    settlements.delete(oldest)\n  }\n}\n\nfunction isSha256Digest(value: unknown): value is Sha256Digest {\n  return typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value)\n}\n\nfunction exactRecord(\n  value: unknown,\n  keys: readonly string[],\n  label: string,\n): Record<string, unknown> {\n  const source = record(value, label)\n  assertExactObjectKeys(source, keys, label)\n  return source\n}\n\nfunction record(value: unknown, label: string): Record<string, unknown> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`${label} must be an object`)\n  }\n  const prototype = Object.getPrototypeOf(value)\n  if (prototype !== Object.prototype && prototype !== null) {\n    throw new Error(`${label} must be a plain object`)\n  }\n  return value as Record<string, unknown>\n}\n"],"mappings":";;;;AAgCA,MAAM,+BAA+B;AACrC,MAAM,gCAAgC,KAAK;;AA2B3C,SAAgB,wCACd,SAC4B;CAC5B,OAAO,IAAI,mCAAmC,OAAO;AACvD;AAEA,IAAM,qCAAN,MAA+E;CAShD;CAR7B,yBAA0B,IAAI,IAAkC;CAChE;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAAgE;EAA/C,KAAA,UAAA;EAC3B,IAAI,CAAC,QAAQ,SAAS,cACpB,MAAM,IAAI,MACR,+BAA+B,QAAQ,SAAS,KAAK,qCACvD;EAEF,KAAK,eAAe,QAAQ,SAAS;EACrC,KAAK,YAAY,eAAe,QAAQ,SAAS;EACjD,KAAK,qBAAqB,gBACxB,QAAQ,sBAAsB,8BAC9B,iCACF;EACA,KAAK,sBAAsB,gBACzB,QAAQ,uBAAuB,+BAC/B,kCACF;EACA,KAAK,kBAAkB,QAAQ,kBAC3B,wBAAwB,QAAQ,eAAe,IAC/C,KAAA;CACN;CAEA,MAAM,QACJ,SACA,SACA;EACA,uBAAuB,OAAO;EAC9B,MAAM,UAAU,QAAQ,UAAU,KAAK;EACvC,IAAI,QAAQ,SAAS,UAAU,MAAM,IAAI,MAAM,gDAAgD;EAC/F,MAAM,UAAU,QAAQ,cAAc,MAAM,SAAS,MAAM,OAAO;EAClE,MAAM,SACJ,QAAQ,SAAS,aACZ,EAAE,MAAM,UAAU,IAClB;GAAE,MAAM;GAAU,cAAc,CAAC,GAAG,QAAQ,OAAO;EAAE;EAC5D,MAAM,KAAK,iBAAiB,OAAO,IAAI;EACvC,QAAQ,OAAO,eAAe;EAE9B,MAAM,MAAM,aAAa,QAAQ,aAAa,QAAQ,cAAc,MAAM,MAAM;EAChF,IAAI,KAAK,OAAO,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,mDAAmD;EAC7F,MAAM,QAAQ,WACZ,QAAQ,cAAc,MAAM,SAAS,UAAU,OAC/C,QAAQ,cAAc,MAAM,SAAS,UAAU,cACjD;EACA,MAAM,gBAAgB,sBACpB,QAAQ,WAAW,WACnB,KAAK,mBACP;EAcA,MAAM,oBAAoB,yBAbH,wBAAwB;GAC7C,MAAM;GACN,UAAU,KAAK,QAAQ,SAAS;GAChC,aAAa,QAAQ;GACrB,qBAAqB,QAAQ,cAAc,MAAM;GACjD;GACA;GACA;GACA,oBAAoB,KAAK;GACzB,WAAW,KAAK;GAChB,QAAQ;IAAE,WAAW,QAAQ;IAAW,UAAU,QAAQ;GAAS;GACnE,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;EAC1E,CACgE,CAAC;EACjE,MAAM,WAAW,wBAAwB;GACvC,MAAM;GACN,UAAU,KAAK,QAAQ,SAAS;GAChC,aAAa,QAAQ;GACrB,qBAAqB,QAAQ,cAAc,MAAM;GACjD;GACA,iBAAiB,QAAQ;GACzB,gBAAgB,QAAQ;EAC1B,CAAC;EACD,MAAM,cAAc,MAAM,KAAK,aAAa,OAAO;GACjD;GACA;GACA;GACA,oBAAoB,KAAK;GACzB,WAAW,KAAK;GAChB;GACA,gBAAgB,wBACd,QAAQ,aACR,QAAQ,cAAc,MAAM,MAC9B;GACA,QAAQ,QAAQ;GAChB,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;EAC1E,CAAC;EACD,IAAI;GACF,2BAA2B,aAAa,UAAU,KAAK,QAAQ,SAAS,IAAI;EAC9E,SAAS,OAAO;GACd,IAAI;IACF,MAAM,YAAY,QAAQ;GAC5B,SAAS,cAAc;IACrB,MAAM,IAAI,eACR,CAAC,OAAO,YAAY,GACpB,kDACF;GACF;GACA,MAAM;EACR;EACA,MAAM,QAA8B,EAAE,YAAY;EAClD,KAAK,OAAO,IAAI,KAAK,KAAK;EAG1B,KAAI,MADmB,YAAY,QAAQ,KAAK,EAAA,CACnC,WAAW,GACtB,MAAM,IAAI,MAAM,wDAAwD;EAE1E,MAAM,mBAAmB,aAAa,SAAS,QAAQ,MAAM;EAC7D,MAAM,SAAS,YAAY,OAAO;EAClC,MAAM,YAAY,KAAK,IAAI;EAC3B,MAAM,QAAQ;GACZ,OAAO,QAAQ,MAAM;GACrB,YAAY,QAAQ,UAAU,KAAK,SAAS;GAC5C;GACA,cAAc,QAAQ;GACtB,WAAW,QAAQ,WAAW;GAC9B,MAAM;IACJ,GAAG,QAAQ,MAAM;IACjB,eAAe,YAAY;IAC3B,qBAAqB,YAAY;GACnC;GACA,SAAS;EACX;EACA,MAAM,UAAU,MAAM,YAAY,QAAQ,MAAM,QAAQ,EAAE,QAAQ,QAAQ,OAAO,CAAC;EAClF,MAAM,gBAAgB,cAAc,SAAS,QAAQ,QAAQ;EAC7D,cAAmB,YAAY,KAAA,CAAS;EACxC,IAAI;EACJ,IAAI,gBAAgB;EACpB,MAAM,eAAe;GACnB,IAAI,CAAC,eAAe,iBAAiB,YAAY,OAAO;EAC1D;EACA,QAAQ,OAAO,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;EAC/D,IAAI,QAAQ,OAAO,SAAS,OAAO;EACnC,IAAI;GACF,MAAM,cAAc,MAAM,QAAQ,KAAK;GACvC,gBAAgB;GAChB,QAAQ,OAAO,oBAAoB,SAAS,MAAM;GAClD,IAAI,cAAc,MAAM;GACxB,MAAM,SAAS,MAAM,QAAQ,OAAO;GACpC,qBAAqB,QAAQ,WAAW;GACxC,MAAM,SAAS,MAAM,YAAY,eAAe,QAAQ,QAAQ,QAAQ,YAAY;GACpF,MAAM,cAAc;GACpB,MAAM,wBAAwB,OAAO,QAAQ,YAAY,MAAM;GAC/D,OAAO;IAAE,aAAa,QAAQ;IAAa;GAAY;EACzD,UAAU;GACR,QAAQ,OAAO,oBAAoB,SAAS,MAAM;EACpD;CACF;CAEA,MAAM,KACJ,SACA,SACqC;EACrC,MAAM,KAAK,iBAAiB;EAC5B,QAAQ,OAAO,eAAe;EAC9B,MAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,IAAI;EACpD,IAAI,CAAC,aAAa,OAAO,EAAE,SAAS,KAAK;EACzC,IAAI,WAAW,MAAM,YAAY,QAAQ,KAAK;EAC9C,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,MAAM,oEAAoE;EAEtF,MAAM,SAAS,SAAS;EACxB,IAAI,QAAQ,SAAS;GACnB,MAAM,UAAU,MAAM,YAAY,QAAQ,IAAI,OAAO,GAAG;GACxD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,uDAAuD;GACrF,MAAM,YAAY,OAAO;EAC3B;EACA,QAAQ,OAAO,eAAe;EAC9B,WAAW,MAAM,YAAY,QAAQ,KAAK;EAC1C,IAAI,SAAS,MAAM,UAAU,MAAM,OAAO,GACxC,MAAM,IAAI,MAAM,mDAAmD;EAErE,MAAM,cAAc,SAAS;EAC7B,IAAI,aAAa,qBAAqB,WAAW;EACjD,MAAM,QAAQ,KAAK,OAAO,IAAI,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;EAC5F,IAAI,OAAO;GACT,MAAM,cAAc,aAAa,eAAe,MAAM;GACtD,IAAI,QAAQ,WAAW,aAAa,MAAM,OACxC,MAAM,qBAAqB;IACzB,MAAM;IACN,WAAW,MAAM,MAAM;GACzB;GAEF,MAAM,wBAAwB,OAAO,QAAQ,YAAY,WAAW;EACtE;EACA,OAAO,EAAE,SAAS,KAAK;CACzB;CAEA,MAAM,QACJ,SACA,SACA;EACA,MAAM,KAAK,iBAAiB;EAC5B,QAAQ,OAAO,eAAe;EAC9B,MAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,KAAK;EACrD,MAAM,WAAW,MAAM,YAAY,QAAQ,KAAK;EAChD,MAAM,SAAS,SAAS;EACxB,IAAI,SAAS,WAAW,KAAK,CAAC,UAAU,OAAO,SAC7C,MAAM,IAAI,MAAM,uEAAuE;EAEzF,qBAAqB,MAAM;EAC3B,MAAM,UAAU,MAAM,YAAY,QAAQ,IAAI,OAAO,GAAG;EACxD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,wDAAwD;EAEtF,qBAAqB,MADO,QAAQ,OAAO,GACP,OAAO,WAAW;EACtD,MAAM,QAAQ,KAAK,OAAO,IAAI,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;EAC5F,MAAM,SACJ,OAAO,UACN,MAAM,YACL,cAAc,SAAS,WAAW,WAAW,CAAC,CAAC,QAAQ,GACvD,QAAQ,QACR,KAAK,IAAI,IAAI,KAAK,kBACpB;EACF,QAAQ,OAAO,eAAe;EAC9B,MAAM,WAAW,wBAAwB;GACvC,MAAM;GACN,UAAU,YAAY;GACtB,eAAe,YAAY;GAC3B,aAAa,QAAQ;GACrB,qBAAqB,QAAQ;GAC7B,mBAAmB,YAAY,UAAU;GACzC,SAAS;IACP,KAAK,OAAO;IACZ,UAAU,OAAO;IACjB,GAAI,OAAO,aAAa,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC;IAC7D,aAAa,OAAO;GACtB;GACA,GAAI,OAAO,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;GACpF,QAAQ;IAAE,QAAQ,YAAY,MAAM;IAAG,YAAY,OAAO;GAAW;EACvE,CAAC;EACD,OAAO;GACL,aAAa;IAAE,MAAM;IAAmB,OAAO;GAAO;GACtD;EACF;CACF;CAEA,MAAM,QACJ,SACA,SACsC;EACtC,MAAM,KAAK,iBAAiB;EAC5B,QAAQ,OAAO,eAAe;EAC9B,MAAM,cAAc,MAAM,KAAK,QAAQ,SAAS,IAAI;EACpD,IAAI,CAAC,aAAa,OAAO,EAAE,UAAU,KAAK;EAC1C,IAAI;EACJ,IAAI;GACF,MAAM,YAAY,QAAQ;EAC5B,SAAS,OAAO;GACd,eAAe;EACjB;EAEA,IAAI,MADoB,KAAK,aAAa,IAAI,YAAY,EAAE,GAE1D,MAAM,IAAI,MAAM,oDAAoD,EAAE,OAAO,aAAa,CAAC;EAE7F,QAAQ,OAAO,eAAe;EAC9B,KAAK,OAAO,OAAO,aAAa,QAAQ,aAAa,QAAQ,mBAAmB,CAAC;EACjF,OAAO,EAAE,UAAU,KAAK;CAC1B;CAEA,MAAc,iBAAiB,MAA4C;EACzE,MAAM,UACJ,KAAK,uBAAuB,QAAQ,QAAQ,KAAK,QAAQ,SAAS,aAAa,CAAC;EAClF,KAAK,sBAAsB;EAC3B,IAAI;EACJ,IAAI;GACF,eAAe,MAAM;EACvB,SAAS,OAAO;GACd,IAAI,KAAK,wBAAwB,SAAS,KAAK,sBAAsB,KAAA;GACrE,MAAM;EACR;EACA,MAAM,QAAQ,aAAa;EAC3B,IAAI,CAAC,OACH,MAAM,IAAI,MACR,+BAA+B,KAAK,QAAQ,SAAS,KAAK,yCAC5D;EAEF,IAAI,QAAQ,CAAC,MAAM,OAAO,SAAS,IAAI,GACrC,MAAM,IAAI,MACR,+BAA+B,KAAK,QAAQ,SAAS,KAAK,qBAAqB,KAAK,cACtF;CAEJ;CAUA,MAAc,QACZ,SACA,kBACmD;EACnD,MAAM,MAAM,aAAa,QAAQ,aAAa,QAAQ,mBAAmB;EACzE,MAAM,SAAS,KAAK,OAAO,IAAI,GAAG,CAAC,EAAE;EACrC,IAAI,QAAQ,OAAO;EACnB,MAAM,WAAW;GACf,MAAM;GACN,UAAU,KAAK,QAAQ,SAAS;GAChC,aAAa,QAAQ;GACrB,qBAAqB,QAAQ;EAC/B;EAKA,MAAM,WAAU,MAJK,KAAK,aAAa,KAAK;GAC1C;GACA,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC;EAC1E,CAAC,EAAA,CACsB,QACpB,gBACC,YAAY,aAAa,KAAK,QAAQ,SAAS,QAC/C,OAAO,QAAQ,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,WACrC,kBAAkB,YAAY,WAAW,OAAO,KAAK,CACvD,CACJ;EACA,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,MAAM,mEAAmE;EAErF,MAAM,cAAc,QAAQ;EAC5B,IAAI,CAAC,aAAa;GAChB,IAAI,kBAAkB,OAAO,KAAA;GAC7B,MAAM,IAAI,MAAM,iDAAiD;EACnE;EACA,IAAI,CAACA,iBAAe,YAAY,UAAU,iBAAiB,GACzD,MAAM,IAAI,MAAM,4DAA4D;EAE9E,KAAK,OAAO,IAAI,KAAK,EAAE,YAAY,CAAC;EACpC,OAAO;CACT;AACF;AAEA,eAAe,wBACb,OACA,YACA,QACe;CACf,MAAM,QAAQ,MAAM;CACpB,IAAI,CAAC,SAAS,MAAM,SAAS;CAC7B,MAAM,UAAU,KAAK,IAAI,MAAM,WAAW,KAAK,IAAI,KAAK,IAAI,GAAG,MAAM,YAAY,CAAC;CAClF,MAAM,cAAc,MAAM,sBAAsB,MAAM,eAAe,QAAQ;CAC7E,MAAM,WAAW,UAAU;EACzB,OAAO,MAAM;EACb,YAAY,MAAM;EAClB,WAAW,MAAM;EACjB;EACA,QAAQ,aAAa,SAAS,UAAU,YAAY,aAAa,IAAI,cAAc;EACnF,MAAM,MAAM;CACd,CAAC;CACD,MAAM,UAAU;AAClB;AAEA,SAAS,uBAAuB,SAA8C;CAC5E,IAAI,QAAQ,UAAU,KAAK,QAAQ,SAAS,UAC1C,MAAM,IAAI,MACR,gFACF;CAEF,IAAI,QAAQ,cAAc,MAAM,SAAS,aAAa,cAAc,QAAQ,OAAO,WACjF,MAAM,IAAI,MAAM,6EAA6E;CAE/F,IAAI,QAAQ,OAAO,SAAS,YAC1B,MAAM,IAAI,MAAM,mEAAmE;CAErF,MAAM,YAAY,QAAQ,UAAU,KAAK,QAAQ,UAAU,YAAY;CACvE,IACE,EACE,UAAU,WAAW,OAAO,KAC5B,cAAc,sBACd,UAAU,SAAS,OAAO,IAG5B,MAAM,IAAI,MAAM,4EAA4E;CAE9F,IAAI,CAAC,MAAM,WAAW,QAAQ,OAAO,UAAU,KAAK,CAAC,QAAQ,OAAO,IAAI,MAAM,KAAK,GACjF,MAAM,IAAI,MAAM,8EAA8E;AAElG;AAEA,eAAe,mBACb,aACA,SACA,QACe;CACf,MAAM,iBAAiB,gCAAgC,OAAO;CAC9D,KAAK,MAAM,QAAQ,QAAQ,OAAO,KAAK,OACrC,MAAM,YAAY,UAAU,QAAQ,QAAQ,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,OAAO;EAClF,MAAM,KAAK;EACX;CACF,CAAC;CAEH,MAAM,cACJ,QAAQ,cAAc,MAAM,SAAS,QAAQ,oBAAoB,SAC7D,QAAQ,MAAM,WACd,QAAQ,MAAM;CACpB,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,+CAA+C;CACjF,KAAK,MAAM,QAAQ,QAAQ,kBAAkB,OAC3C,MAAM,YAAY,UAChB,QAAQ,aAAa,KAAK,IAAI,GAC9B,OAAO,KAAK,KAAK,SAAS,MAAM,GAChC;EAAE,MAAM,KAAK;EAAM;CAAO,CAC5B;CAEF,IAAI,QAAQ,aAAa,gBAAgB;EACvC,KAAK,MAAM,QAAQ,QAAQ,UAAU,OACnC,MAAM,YAAY,UAAU,QAAQ,eAAe,MAAM,KAAK,IAAI,GAAG,KAAK,OAAO;GAC/E,MAAM,KAAK;GACX;EACF,CAAC;EAEH,IAAI,QAAQ,UAAU,mBAAmB,eAAe,iBACtD,MAAM,YAAY,UAChB,eAAe,iBACf,QAAQ,UAAU,iBAClB;GAAE,MAAM;GAAO;EAAO,CACxB;CAEJ;CACA,IAAI,QAAQ,YAAY,SAAS,SAAS,aACxC,MAAM,YAAY,UAAU,QAAQ,YAAY,SAAS,MAAM,QAAQ,YAAY,OAAO;EACxF,MAAM;EACN;CACF,CAAC;AAEL;AAEA,SAAS,gCACP,SACiE;CACjE,MAAM,YAAY,QAAQ;CAC1B,IAAI,CAAC,WAAW;EACd,IACE,QAAQ,OAAO,IAAA,uCAAsC,KAAA,KACrD,QAAQ,OAAO,IAAA,mDAAkD,KAAA,GAEjE,MAAM,IAAI,MAAM,sEAAsE;EAExF;CACF;CACA,MAAM,QAAQ,iCACZ,QAAQ,MAAM,UACd,UAAU,oBAAoB,KAAA,CAChC;CACA,IACE,QAAQ,OAAO,IAAA,uCAAsC,MAAM,QAC3D,QAAQ,OAAO,IAAA,mDAAkD,MAAM,iBAEvE,MAAM,IAAI,MAAM,sEAAsE;CAExF,MAAM,WAAW,CAAC,MAAM,MAAM,MAAM,eAAe,CAAC,CAAC,QAClD,UAA2B,UAAU,KAAA,CACxC;CACA,MAAM,cACJ,QAAQ,cAAc,MAAM,SAAS,QAAQ,oBAAoB,SAC7D,QAAQ,MAAM,WACd,QAAQ,MAAM;CAUpB,IACE;EATA,GAAG,QAAQ,OAAO,KAAK,MAAM,KAAK,SAAS,QAAQ,QAAQ,MAAM,UAAU,KAAK,IAAI,CAAC;EACrF,GAAI,cACA,QAAQ,kBAAkB,MAAM,KAAK,SAAS,QAAQ,aAAa,KAAK,IAAI,CAAC,IAC7E,CAAC;EACL,GAAI,QAAQ,YAAY,SAAS,SAAS,cACtC,CAAC,QAAQ,YAAY,SAAS,IAAI,IAClC,CAAC;CAGI,CAAC,CAAC,MAAM,SACf,SAAS,MACN,iBACC,SAAS,gBACT,KAAK,WAAW,GAAG,aAAa,EAAE,KAClC,aAAa,WAAW,GAAG,KAAK,EAAE,CACtC,CACF,GAEA,MAAM,IAAI,MAAM,0DAA0D;CAE5E,OAAO;AACT;AAEA,SAAS,YAAY,SAAiE;CACpF,MAAM,cAAc,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,QAAQ,YAAY,KAAK;CAC9F,MAAM,OAAO;EACX,YAAY,QAAQ,OAAO;EAC3B,MAAM,QAAQ,OAAO;EACrB,KAAK,QAAQ,OAAO;EACpB,KAAK,QAAQ,OAAO;EACpB,WAAW;CACb;CACA,QAAQ,QAAQ,YAAY,SAAS,MAArC;EACE,KAAK,eACH,OAAO;GAAE,GAAG;GAAM,MAAM,CAAC,GAAG,KAAK,MAAM,WAAW;EAAE;EACtD,KAAK,cACH,OAAO;GAAE,GAAG;GAAM,OAAO;EAAY;EACvC,KAAK,aACH,OAAO;CACX;AACF;AAEA,eAAe,cAAc,SAA4B,UAAuC;CAC9F,MAAM,SAAmB,CAAC;CAC1B,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ,OAAO,GAAG;EAC1C,MAAM,QAAQ,OAAO,KAAK,OAAO,MAAM;EACvC,cAAc,MAAM;EACpB,IAAI,aAAa,UAAU;GACzB,IAAI;GACJ,IAAI;IACF,MAAM,YAAY,OAAO;GAC3B,SAAS,OAAO;IACd,YAAY;GACd;GACA,MAAM,IAAI,MAAM,gCAAgC,SAAS,gBAAgB,EACvE,OAAO,UACT,CAAC;EACH;EACA,OAAO,KAAK,KAAK;CACnB;CACA,OAAO,WAAW,KAAK,OAAO,OAAO,QAAQ,UAAU,CAAC;AAC1D;AAEA,eAAe,YACb,QACA,QACA,cACqB;CACrB,OAAO,eAAe;CACtB,MAAM,cAAc,eAAe,KAAK,IAAI;CAC5C,IAAI,eAAe,GAAG,MAAM,IAAI,MAAM,mCAAmC;CACzE,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,QACA,IAAI,SAAgB,UAAU,WAAW;GACvC,gBAAgB,OAAO,OAAO,0BAAU,IAAI,MAAM,4BAA4B,CAAC;GAC/E,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;GACxD,QAAQ,iBACA,uBAAO,IAAI,MAAM,mCAAmC,CAAC,GAC3D,WACF;EACF,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,SAAS,OAAO,oBAAoB,SAAS,OAAO;EACxD,IAAI,OAAO,aAAa,KAAK;CAC/B;AACF;AAEA,eAAe,YAAY,SAA2C;CAEpE,IAAI,EAAC,MADgB,QAAQ,OAAO,EAAA,CACxB,SAAS;CACrB,IAAI;EACF,MAAM,QAAQ,KAAK;CACrB,SAAS,OAAO;EACd,KAAK,MAAM,QAAQ,OAAO,EAAA,CAAG,SAAS,MAAM;CAC9C;CACA,MAAM,cAAc,MAAM,QAAQ,KAAK;CACvC,qBAAqB,MAAM,QAAQ,OAAO,GAAG,WAAW;AAC1D;AAEA,SAAS,qBACP,QACA,UACwF;CACxF,IAAI,OAAO,WAAW,CAAC,OAAO,aAC5B,MAAM,IAAI,MAAM,sDAAsD;CAExE,IAAI,YAAY,CAAC,kBAAkB,OAAO,aAAa,QAAQ,GAC7D,MAAM,IAAI,MAAM,mEAAmE;AAEvF;AAEA,SAAS,2BACP,aACA,UACA,cACM;CACN,IAAI,CAAC,YAAY,MAAM,YAAY,aAAa,cAC9C,MAAM,IAAI,MAAM,gEAAgE;CAElF,IACE,CAAC,OAAO,QAAQ,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,WACtC,kBAAkB,YAAY,WAAW,OAAO,KAAK,CACvD,GAEA,MAAM,IAAI,MAAM,qEAAqE;AAEzF;AAEA,SAAS,WAAW,aAAiE;CACnF,MAAM,WAAW,YAAY,UAAU;CACvC,IAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,OAAO,QAAQ,IAAI,GACxD,MAAM,IAAI,MAAM,qDAAqD;CAEvE,OAAO,EAAE,UAAU,OAAO,QAAQ,EAAE;AACtC;AAEA,SAAS,aAAa,aAAqB,qBAA2C;CACpF,OAAO,GAAG,YAAY,IAAI;AAC5B;AAEA,SAAS,wBAAwB,aAAqB,qBAA2C;CAC/F,OAAO,aAAa,yBAAyB;EAC3C,MAAM;EACN;EACA;CACF,CAAC,CAAC,CAAC,MAAM,CAAgB;AAC3B;AAEA,SAAS,WAAW,OAAe,gBAAsC;CACvE,IAAIA,iBAAe,KAAK,GAAG;EACzB,IAAI,UAAU,gBACZ,MAAM,IAAI,MAAM,gEAAgE;EAElF,OAAO;CACT;CACA,MAAM,SAAS,MAAM,YAAY,GAAG;CACpC,IAAI,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG;CACnC,IAAI,MAAM,MAAM,SAAS,CAAC,MAAM,gBAC9B,MAAM,IAAI,MAAM,gEAAgE;CAElF,OAAO;AACT;AAEA,SAAS,sBAAsB,WAAmB,aAA6B;CAC7E,MAAM,QAAQ,gBAAgB,WAAW,6BAA6B,IAAI;CAC1E,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG,MAAM,IAAI,MAAM,6CAA6C;CAC/F,OAAO,KAAK,KAAK,QAAQ,GAAK,IAAI;AACpC;AAEA,SAAS,eAAe,WAAmE;CACzF,IAAI,CAAC,OAAO,SAAS,UAAU,GAAG,KAAK,UAAU,OAAO,GACtD,MAAM,IAAI,MAAM,+CAA+C;CAEjE,OAAO,OAAO,OAAO;EACnB,KAAK,UAAU;EACf,UAAU,gBAAgB,UAAU,UAAU,sBAAsB;EACpE,QAAQ,gBAAgB,UAAU,QAAQ,oBAAoB;CAChE,CAAC;AACH;AAEA,SAAS,gBAAgB,OAAe,OAAuB;CAC7D,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAC1C,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CACvD,OAAO;AACT;AAEA,SAAS,QAAQ,MAAc,cAA8B;CAC3D,IAAI,MAAM,WAAW,YAAY,GAAG,MAAM,IAAI,MAAM,uCAAuC;CAC3F,MAAM,OAAO,MAAM,UAAU,YAAY;CACzC,IAAI,SAAS,QAAQ,KAAK,WAAW,KAAK,GACxC,MAAM,IAAI,MAAM,iDAAiD;CAEnE,OAAO,MAAM,KAAK,MAAM,IAAI;AAC9B;AAEA,SAASA,iBAAe,OAAuC;CAC7D,OAAO,OAAO,UAAU,YAAY,wBAAwB,KAAK,KAAK;AACxE;;;AC1oBA,MAAM,yBAAyB;AAC/B,MAAM,oCAAoC,MAAU;;;;;;;;AASpD,SAAgB,uCACd,SACyB;CACzB,MAAM,gBAAgB,oBAAoB,QAAQ,aAAa;CAC/D,MAAM,qBAAqB,sBAAsB,QAAQ,kBAAkB;CAC3E,MAAM,+BAAe,IAAI,IAAmC;CAC5D,MAAM,oCAAoB,IAAI,IAAkC;CAEhE,OAAO;EACL,SAAS,OAAO,UAAU;GACxB,MAAM,UAAU,wBAAwB,KAAK;GAE7C,OAAO,wBADU,sBAAsB,MAAM,QAAQ,aAAa,OAAO,GAAG,OACtC,CAAC;EACzC;EAEA,cAAc,OAAO,UAAU;GAC7B,kBAAkB,cAAc,mBAAmB,KAAK,IAAI,CAAC;GAC7D,MAAM,UAAU,wBAAwB,KAAK;GAC7C,qBAAqB,OAAO;GAC5B,MAAM,gBAAgB,yBAAyB,OAAO;GACtD,MAAM,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;GACrE,IAAI,kBAAkB,IAAI,GAAG,GAC3B,MAAM,IAAI,MAAM,gDAAgD;GAElE,MAAM,WAAW,aAAa,IAAI,GAAG;GACrC,IAAI,YAAY,SAAS,kBAAkB,eACzC,MAAM,IAAI,MAAM,2DAA2D;GAG7E,MAAM,cAAc,oBAClB,MAAM,QAAQ,OAAO,QAAQ,OAAO,GACpC,SACA,aACF;GACA,MAAM,iBAAiB,yBAAyB,WAAW;GAC3D,IAAI,kBAAkB,IAAI,GAAG,GAC3B,MAAM,IAAI,MAAM,mEAAmE;GAErF,MAAM,WAAW,YAAY,aAAa,IAAI,GAAG;GACjD,IAAI,YAAY,SAAS,kBAAkB,eACzC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,IAAI,YAAY,SAAS,mBAAmB,gBAC1C,MAAM,IAAI,MAAM,+DAA+D;GAEjF,IAAI,CAAC,UACH,aAAa,IAAI,KAAK;IACpB;IACA;IACA,aAAa,QAAQ;IACrB,eAAe,QAAQ;IACvB,aAAa,YAAY;IACzB,aAAa,QAAQ;IACrB,UAAU,wBAAwB,QAAQ,QAAQ;IAClD,QAAQ,wBAAwB,QAAQ,MAAM;IAC9C,iBAAiB,WAAW,QAAQ,OAAO,YAAY,qBAAqB;IAC5E,YAAY;GACd,CAAC;GAEH,OAAO;EACT;EAEA,eAAe,OAAO,UAAU;GAC9B,kBAAkB,cAAc,mBAAmB,KAAK,IAAI,CAAC;GAC7D,MAAM,UAAU,wBAAwB,KAAK;GAC7C,MAAM,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;GACrE,IAAI,kBAAkB,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,0CAA0C;GAC1F,MAAM,QAAQ,aAAa,IAAI,GAAG;GAClC,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,qDAAqD;GACjF,oBAAoB,OAAO,OAAO;GAClC,IAAI,MAAM,kBAAkB,MAAM,IAAI,MAAM,0CAA0C;GACtF,IAAI,MAAM,eAAe,YACvB,MAAM,IAAI,MAAM,gDAAgD;GAElE,IAAI,CAAC,OAAO,cAAc,QAAQ,YAAY,KAAK,QAAQ,gBAAgB,GACzE,MAAM,IAAI,MAAM,qEAAqE;GAEvF,IAAI,QAAQ,gBAAgB,KAAK,IAAI,GACnC,MAAM,IAAI,MAAM,2DAA2D;GAE7E,IAAI,QAAQ,eAAe,MAAM,aAC/B,MAAM,IAAI,MAAM,iEAAiE;GAEnF,MAAM,aAAa;GACnB,IAAI;IACF,MAAM,aAAa,mBACjB,MAAM,QAAQ,OAAO,SAAS,OAAO,GACrC,MAAM,OAAO,kBAAkB,IAAI,CAAC,IAAI,kBAC1C;IACA,IAAI,kBAAkB,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,MAAM,OAC1D,MAAM,IAAI,MAAM,8DAA8D;IAEhF,MAAM,aAAa;IACnB,OAAO;GACT,SAAS,OAAO;IACd,MAAM,aAAa;IACnB,MAAM;GACR;EACF;EAEA,aAAa,OAAO,UAAU;GAC5B,MAAM,MAAM,KAAK,IAAI;GACrB,kBAAkB,cAAc,mBAAmB,GAAG;GACtD,MAAM,UAAU,wBAAwB,KAAK;GAC7C,MAAM,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;GACrE,MAAM,QAAQ,aAAa,IAAI,GAAG;GAClC,IAAI,OAAO,oBAAoB,OAAO,OAAO;GAC7C,MAAM,aAAa,SAAS,kBAAkB,IAAI,GAAG;GACrD,IAAI,YAAY,oBAAoB,WAAW,qBAAqB,QAAQ,QAC1E,MAAM,IAAI,MAAM,iEAAiE;GAGnF,MAAM,SAAS,kCAAkC,MAAM,QAAQ,OAAO,OAAO,OAAO,GAAG;IACrF,eAAe,QAAQ;IACvB,aAAa,QAAQ;IACrB,OAAO,QAAQ,SAAS;GAC1B,CAAC;GACD,IAAI,OAAO,2BAA2B,OAAO,OAAO,KAAK;GAEzD,MAAM,mBAAmB,yBAAyB,OAAO,KAAK;GAC9D,IAAI,YAAY,oBAAoB,WAAW,qBAAqB,kBAClE,MAAM,IAAI,MAAM,oEAAoE;GAEtF,IAAI,YAAY,oBAAoB,WAAW,qBAAqB,QAAQ,QAC1E,MAAM,IAAI,MAAM,iEAAiE;GAEnF,MAAM,cAAc,OAAO,eAAe,MAAM;GAChD,IAAI,OAAO;IACT,MAAM,mBAAmB;IACzB,MAAM,mBAAmB,QAAQ;GACnC;GACA,aAAa,OAAO,GAAG;GACvB,mBAAmB,mBAAmB,KAAK;IACzC;IACA,kBAAkB,QAAQ;IAC1B;GACF,CAAC;GACD,OAAO,OAAO;EAChB;CACF;AACF;AAEA,SAAS,qBAAqB,OAAmD;CAC/E,IAAI,CAAC,OAAO,cAAc,MAAM,WAAW,KAAK,MAAM,eAAe,GACnE,MAAM,IAAI,MAAM,oEAAoE;CAEtF,IAAI,MAAM,eAAe,KAAK,IAAI,GAChC,MAAM,IAAI,MAAM,0DAA0D;CAE5E,KAAK,MAAM,CAAC,MAAM,UAAU;EAC1B,CAAC,iBAAiB,MAAM,OAAO,aAAa;EAC5C,CAAC,kBAAkB,MAAM,OAAO,cAAc;EAC9C,CAAC,mBAAmB,MAAM,OAAO,eAAe;CAClD,GACE,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAC1C,MAAM,IAAI,MAAM,+BAA+B,KAAK,oCAAoC;CAG5F,WAAW,MAAM,OAAO,YAAY,qBAAqB;AAC3D;AAEA,SAAS,oBACP,OACA,UACA,eACqC;CACrC,MAAM,SAAS,YACb,OACA;EAAC;EAAiB;EAAU;EAAe;EAAkB;CAAS,GACtE,sCACF;CACA,IAAI,OAAO,kBAAkB,SAAS,eACpC,MAAM,IAAI,MAAM,mEAAmE;CAErF,IAAI,CAAC,eAAe,OAAO,MAAM,GAC/B,MAAM,IAAI,MAAM,4DAA4D;CAE9E,IAAI,OAAO,gBAAgB,SAAS,aAClC,MAAM,IAAI,MAAM,qDAAqD;CAEvE,YACE,OAAO,gBACP;EAAC;EAAiB;EAAkB;EAAmB;CAAY,GACnE,6CACF;CACA,IACE,yBAAyB,OAAO,cAAc,MAAM,yBAAyB,SAAS,MAAM,GAE5F,MAAM,IAAI,MAAM,8DAA8D;CAGhF,MAAM,UAAU,2BACd,OAAO,SACP,SAAS,OAAO,eAChB,aACF;CACA,OAAO,wBAAwB;EAC7B,eAAe,OAAO;EACtB,QAAQ,OAAO;EACf,aAAa,OAAO;EACpB,gBAAgB,OAAO;EACvB;CACF,CAAC;AACH;AAEA,SAAS,2BACP,OACA,eACA,eACkC;CAClC,IAAI,kBAAkB,GAAG;EAEvB,IADe,YAAY,OAAO,CAAC,MAAM,GAAG,qCACnC,CAAC,CAAC,SAAS,YAClB,MAAM,IAAI,MAAM,mEAAmE;EAErF,OAAO,EAAE,MAAM,WAAW;CAC5B;CAEA,MAAM,SAAS,YAAY,OAAO,CAAC,QAAQ,SAAS,GAAG,qCAAqC;CAC5F,IAAI,OAAO,SAAS,gBAClB,MAAM,IAAI,MAAM,+DAA+D;CAEjF,IACE,CAAC,MAAM,QAAQ,OAAO,OAAO,KAC7B,OAAO,QAAQ,WAAW,KAC1B,OAAO,QAAQ,OAAO,eAEtB,MAAM,IAAI,MAAM,mEAAmE;CAErF,OAAO;EAAE,MAAM;EAAgB,SAAS,CAAC,aAAa;CAAE;AAC1D;AAEA,SAAS,mBACP,OACA,eACwC;CAExC,MAAM,MAAM,OADG,YAAY,OAAO,CAAC,KAAK,GAAG,qCACnB,CAAC,CAAC,KAAK,wCAAwC;CACvE,MAAM,cAAc,OAAO,KAAK,GAAG,CAAC,CAAC,KAAK;CAC1C,IACE,YAAY,WAAW,cAAc,UACrC,YAAY,MAAM,MAAM,UAAU,SAAS,cAAc,MAAM,GAE/D,MAAM,IAAI,MAAM,kEAAkE;CAEpF,MAAM,WAAmC,OAAO,OAAO,IAAI;CAC3D,KAAK,MAAM,QAAQ,eAAe;EAChC,MAAM,QAAQ,IAAI;EAClB,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,SAAS,OAClE,MAAM,IAAI,MAAM,8BAA8B,KAAK,qCAAqC;EAE1F,SAAS,QAAQ;CACnB;CACA,OAAO,OAAO,OAAO,EAAE,KAAK,OAAO,OAAO,QAAQ,EAAE,CAAC;AACvD;AAEA,SAAS,sBACP,OACA,UAC6B;CAC7B,MAAM,SAAS,YACb,OACA;EAAC;EAAa;EAAY;EAAS;EAAY;CAAiB,GAChE,0BACF;CACA,IAAI,OAAO,cAAc,SAAS,WAChC,MAAM,IAAI,MAAM,oDAAoD;CAEtE,IAAI,OAAO,oBAAoB,SAAS,iBACtC,MAAM,IAAI,MAAM,6DAA6D;CAE/E,KAAK,MAAM,QAAQ;EAAC;EAAa;EAAY;EAAS;CAAU,GAC9D,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,KAAK,CAAC,WAAW,GAC9D,MAAM,IAAI,MAAM,4BAA4B,KAAK,mBAAmB;CAGxE,OAAO;AACT;AAEA,SAAS,oBACP,UACA,QACM;CACN,IACE,OAAO,gBAAgB,SAAS,eAChC,OAAO,kBAAkB,SAAS,iBAClC,OAAO,gBAAgB,SAAS,eAChC,yBAAyB,OAAO,QAAQ,MAAM,yBAAyB,SAAS,QAAQ,GAExF,MAAM,IAAI,MAAM,sEAAsE;AAE1F;AAEA,SAAS,2BACP,OAMA,aACM;CACN,KAAK,MAAM,CAAC,MAAM,QAAQ,UAAU;EAClC;GAAC;GAAe,MAAM;GAAY,YAAY,OAAO;EAAa;EAClE;GAAC;GAAgB,MAAM;GAAa,YAAY,OAAO;EAAc;EACrE;GAAC;GAAiB,MAAM;GAAc,YAAY,OAAO;EAAe;EACxE;GAAC;GAAkB,MAAM;GAAc,YAAY;EAAe;CACpE,GACE,IAAI,SAAS,OACX,MAAM,IAAI,MAAM,8BAA8B,KAAK,GAAG,OAAO,oBAAoB,OAAO;AAG9F;AAEA,SAAS,sBAAsB,QAA8C;CAC3E,IAAI,OAAO,WAAW,GACpB,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK;CAC/B,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,SAAS,MAAM,QAChC,MAAM,IAAI,MAAM,6DAA6D;CAE/E,KAAK,MAAM,QAAQ,OACjB,IACE,CAAC,2BAA2B,KAAK,IAAI,KACrC;EAAC;EAAa;EAAe;CAAW,CAAC,CAAC,SAAS,IAAI,GAEvD,MAAM,IAAI,MAAM,2DAA2D,MAAM;CAGrF,OAAO,OAAO,OAAO,KAAK;AAC5B;AAEA,SAAS,oBAAoB,OAAuB;CAClD,IACE,MAAM,SAAS,OACf,UAAU,MAAM,YAAY,KAC5B,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,GAAG,KAClB,UAAU,eACV,MAAM,SAAS,YAAY,KAC3B,UAAU,qBACV,UAAU,4BAEV,MAAM,IAAI,MAAM,oEAAoE;CAEtF,MAAM,SAAS,MAAM,MAAM,GAAG;CAC9B,IACE,OAAO,SAAS,KAChB,CAAC,OAAO,OACL,UACC,MAAM,UAAU,KAAK,MAAM,UAAU,MAAM,oCAAoC,KAAK,KAAK,CAC7F,KACA,CAAC,QAAQ,KAAK,OAAO,GAAG,EAAE,KAAK,EAAE,GAEjC,MAAM,IAAI,MAAM,oEAAoE;CAEtF,OAAO;AACT;AAEA,SAAS,eAAe,aAAqB,eAA+B;CAC1E,OAAO,yBAAyB;EAAE;EAAa;CAAc,CAAC;AAChE;AAEA,SAAS,kBACP,cACA,aACA,KACM;CACN,KAAK,MAAM,CAAC,KAAK,UAAU,cACzB,IAAI,MAAM,eAAe,KAAK,aAAa,OAAO,GAAG;CAEvD,KAAK,MAAM,CAAC,KAAK,UAAU,aACzB,IAAI,MAAM,eAAe,KAAK,YAAY,OAAO,GAAG;AAExD;AAEA,SAAS,mBACP,aACA,KACA,OACM;CACN,YAAY,OAAO,GAAG;CACtB,YAAY,IAAI,KAAK,KAAK;CAC1B,OAAO,YAAY,OAAO,wBAAwB;EAChD,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;EACzC,IAAI,WAAW,KAAA,GAAW;EAC1B,YAAY,OAAO,MAAM;CAC3B;AACF;AAEA,SAAS,eAAe,OAAuC;CAC7D,OAAO,OAAO,UAAU,YAAY,wBAAwB,KAAK,KAAK;AACxE;AAEA,SAAS,YACP,OACA,MACA,OACyB;CACzB,MAAM,SAAS,OAAO,OAAO,KAAK;CAClC,sBAAsB,QAAQ,MAAM,KAAK;CACzC,OAAO;AACT;AAEA,SAAS,OAAO,OAAgB,OAAwC;CACtE,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CAE9C,MAAM,YAAY,OAAO,eAAe,KAAK;CAC7C,IAAI,cAAc,OAAO,aAAa,cAAc,MAClD,MAAM,IAAI,MAAM,GAAG,MAAM,wBAAwB;CAEnD,OAAO;AACT"}

package/dist/{redact-PQzmE1Jn.d.ts → redact-9_Gf-8m3.d.ts}

@@ -1,7 +1,8 @@
-import { f as runLocalHarness, o as LocalHarness, r as CodexTokenUsage, s as LocalHarnessResult, t as CodexExecutionEvidence } from "./local-harness-BIajef4A.js";
+import { a as ExecutorConfig } from "./runtime-D-QfLbSd.js";
+import { i as CollectedAgentTurn, r as AgentTurnUsage } from "./stream-agent-turn-C852AgMT.js";
 import { CostLedgerHandle, MaximumCharge, ProposalFinding } from "@tangle-network/agent-eval";
 import { CampaignScenarioIdentity, CompareOptimizationMethodsOptions, OptimizationMethod, OptimizationMethodComparison, WorktreeAdapter } from "@tangle-network/agent-eval/campaign";
-import { AgentProfile as AgentProfile$1, ReasoningEffort, Sha256Digest } from "@tangle-network/agent-interface";
+import { AgentProfile as AgentProfile$1, HarnessType as HarnessType$1, ReasoningEffort, Sha256Digest } from "@tangle-network/agent-interface";
 import { MutableSurface, Scenario as Scenario$1, SelfImproveBudget, SelfImproveOptions, SelfImproveResult } from "@tangle-network/agent-eval/contract";
 //#region src/improvement/improvement-driver.d.ts
 /** The byte-producing path that differs between the cheap
@@ -48,9 +49,6 @@ interface CandidateGenerator {
 }
 //#endregion
 //#region src/improvement/agentic-generator.d.ts
-/** Dedicated ephemeral root for generic author-profile files. Every declared
- * file must live below this root so cleanup cannot alter candidate-owned files. */
-declare const AGENTIC_PROFILE_RESOURCE_ROOT = ".agent-runtime-profile-resources";
 /** Outcome of verifying a candidate worktree. `feedback` (compiler errors,
  *  failing test output) is fed into the next shot when `ok` is false. */
 interface VerifyResult {
@@ -67,26 +65,20 @@ interface AgenticGeneratorShotReceipt {
   /** One-based shot number within this candidate. */
   readonly shot: number;
   readonly maxShots: number;
-  readonly harness: LocalHarness;
-  readonly model: string | null;
+  /** Exact profile identity admitted before the shot. */
+  readonly profileDigest: string;
+  readonly harness: HarnessType$1;
+  readonly provider: string;
+  readonly model: string;
   readonly reasoningEffort: ReasoningEffort | null;
   readonly promptSha256: `sha256:${string}`;
   readonly startedAt: string;
   readonly completedAt: string;
   readonly durationMs: number;
-  readonly exitCode: number | null;
-  readonly timedOut: boolean;
-  /** True when caller cancellation reached the author process; absent in older receipts. */
-  readonly aborted?: boolean;
-  readonly killedBySignal: NodeJS.Signals | null;
-  readonly stdoutBytes: number | null;
-  readonly stdoutSha256: `sha256:${string}` | null;
-  readonly stderrBytes: number | null;
-  readonly stderrSha256: `sha256:${string}` | null;
-  readonly usage: CodexTokenUsage | null;
-  /** Digest of the exact profile-file workspace plan applied for this shot. */
-  readonly profileWorkspacePlanDigest: string | null;
-  readonly profileWorkspaceFileCount: number;
+  readonly status: CollectedAgentTurn['status'] | null;
+  /** Runtime-normalized usage. Unknown token or dollar totals remain marked unknown. */
+  readonly usage: Readonly<AgentTurnUsage> | null;
+  readonly transportAttempts: number | null;
   /** Shared run-ledger call id for this exact shot. */
   readonly costCallId: string | null;
   /** Whether dollars came from the provider, the pricing table, or are unknown. */
@@ -94,23 +86,13 @@ interface AgenticGeneratorShotReceipt {
   readonly costUsd: number | null;
   /** True only for a provider-reported amount, never for a pricing estimate. */
   readonly costUsdKnown: boolean;
-  readonly evidence: CodexExecutionEvidence | null;
   readonly error: {
     readonly name: string;
     readonly message: string;
   } | null;
 }
-/** Frozen exact harness result for an author shot: full streams, process state,
- *  token usage, and execution-policy evidence.
- *  The `onShotCompleted` callback receives `null` when execution failed before
- *  the harness returned. */
-type AgenticGeneratorShotExecution = Readonly<Omit<LocalHarnessResult, 'usage' | 'evidence'> & {
-  readonly usage?: Readonly<CodexTokenUsage>;
-  readonly evidence?: Readonly<Omit<CodexExecutionEvidence, 'readDeniedPaths' | 'policy'>> & {
-    readonly readDeniedPaths: ReadonlyArray<string>;
-    readonly policy: Readonly<CodexExecutionEvidence['policy']>;
-  };
-}>;
+/** Runtime's exact terminal turn plus its complete normalized event stream. */
+type AgenticGeneratorShotExecution = Readonly<CollectedAgentTurn>;
 /** Worktree decision emitted before a completed shot is retried, accepted, or
  *  discarded. The callback runs while `worktreePath` is still available, so
  *  callers can persist the exact diff. */
@@ -135,50 +117,39 @@ type AgenticGeneratorShotDisposition = {
     readonly message: string;
   };
 };
+type AgenticGeneratorExecutorForWorktree = (worktreePath: string) => ExecutorConfig;
 interface AgenticGeneratorOptions {
-  /** Local coding harness to run in the worktree. Default `claude-code`. */
-  harness?: LocalHarness;
-  /** Author profile rendered through the canonical harness mapper. Required
-   *  for reproducible Codex so model and reasoning settings are explicit. */
-  profile?: AgentProfile$1;
-  /** Run Codex with isolated configuration, exact prompt evidence, and required
-   *  terminal token usage. Requires `harness: 'codex'` and `profile`. */
-  codexReproducible?: boolean;
-  /** Absolute paths reproducible Codex must not read. A function can derive
-   *  candidate-specific paths after the driver creates its worktree. */
-  codexReadDeniedPaths?: ReadonlyArray<string> | ((worktreePath: string) => ReadonlyArray<string>);
-  /** Awaited once for every attempted author shot, including process failures.
-   *  The second argument preserves the exact harness result, including stdout
-   *  and stderr, before worktree inspection or verification can reject the
-   *  shot. Throwing aborts the candidate so evidence persistence fails closed. */
+  /** Complete author identity. Harness, provider, model, prompt, tools, and resources all come from here. */
+  profile: AgentProfile$1;
+  /** Place the exact profile on compute that can edit this existing worktree.
+   * A Pi author normally returns `{ backend:'bridge', cwd: worktreePath, ...transport }`. */
+  executorForWorktree: AgenticGeneratorExecutorForWorktree;
+  /** Awaited once for every attempted author shot, including execution failures.
+   * The second argument is Runtime's exact terminal turn and event stream.
+   * Throwing aborts the candidate so evidence persistence fails closed. */
   onShotCompleted?: (receipt: AgenticGeneratorShotReceipt, execution: AgenticGeneratorShotExecution | null) => void | Promise<void>;
   /** Awaited after worktree inspection and before the shot is accepted,
    *  retried, or discarded. Throwing aborts the candidate. */
   onShotDisposition?: (receipt: AgenticGeneratorShotReceipt, disposition: AgenticGeneratorShotDisposition) => void | Promise<void>;
-  /** Optional hard upper bound passed to the run-wide CostLedger before each
-   *  author shot. This MUST be enforced by the provider or executor; a planning
-   *  estimate is not an admissible bound. Omit for an uncapped ledger. A capped
-   *  ledger rejects before model dispatch when this is absent. */
+  /** Optional hard upper bound passed to the run-wide CostLedger before each author shot. */
   maximumCharge?: MaximumCharge;
-  /** Per-shot wall-clock timeout (ms). Default = `runLocalHarness` default (5m). */
+  /** Per-shot wall-clock timeout. Omit for no Runtime-imposed deadline. */
   timeoutMs?: number;
-  /** Build the harness task prompt from proposal findings. */
-  buildPrompt?: (args: {
+  /** Build the task prompt from proposal findings. Required: Runtime invents no authoring policy. */
+  buildPrompt: (args: {
     findings: ReadonlyArray<ProposalFinding>;
   }) => string;
   /** Verify the worktree after each dirtying shot. When set, a candidate that
    *  fails verification is NOT returned — the failure feeds the next shot
    *  (verify-in-session), up to `maxShots`; a candidate that never verifies is
-   *  discarded (`applied:false`), never shipped. Omitted ⇒ legacy behavior:
-   *  the first dirty shot is the candidate. See `commandVerifier`. */
+   *  discarded (`applied:false`), never shipped. Omitted means the first dirty
+   *  shot is the candidate. See `commandVerifier`. */
   verify?: Verifier;
-  /** Test seam — inject the harness runner (defaults to `runLocalHarness`). */
-  runHarness?: typeof runLocalHarness;
   /** Test seam — inject the worktree-dirty check (defaults to `git status`). */
   isDirty?: (worktreePath: string) => boolean;
 }
-/** Full-agentic `CandidateGenerator` (the `shots=N, sandbox=on` setting): run a real coding harness inside the candidate worktree so the agent makes the change in place. */
-declare function agenticGenerator(opts?: AgenticGeneratorOptions): CandidateGenerator;
+/** Full-agentic `CandidateGenerator`: run an exact profiled author inside the existing candidate worktree. */
+declare function agenticGenerator(opts: AgenticGeneratorOptions): CandidateGenerator;
 /** Turn proposal findings into a concrete coder task —
  *  the senior scientific-method framing shared with the tool/MCP build prompts. */
 declare function defaultBuildPrompt(args: {
@@ -299,7 +270,7 @@ interface ImproveProfileComponents {
   /** Apply a complete winning component map to a detached profile. */
   apply(profile: ReadonlyAgentProfile, components: Readonly<Record<string, string>>): ReadonlyAgentProfile;
 }
-interface ImproveCodeOptions {
+interface ImproveCodeBaseOptions {
   /** Repo root candidate worktrees fork from. */
   repoRoot: string;
   /** Base ref candidates fork from. Default `main`. */
@@ -309,17 +280,35 @@ interface ImproveCodeOptions {
   /** Git-compatible adapter override, primarily for tests. Candidate advancement
    * still requires normal Git worktree and commit semantics. */
   worktree?: WorktreeAdapter;
-  /** Coding harness the agentic generator runs in each worktree. Default `claude-code`. */
-  harness?: LocalHarness;
+  /** Complete identity of the code author. No execution field may be filled from ambient defaults. */
+  profile: AgentProfile$1;
+}
+interface ImproveRuntimeCodeGeneratorOptions {
+  /** Place the exact author profile on compute that can edit the supplied worktree. */
+  executorForWorktree: AgenticGeneratorExecutorForWorktree;
+  /** Author the task from admitted findings. Required: Runtime invents no code-improvement prompt. */
+  buildPrompt: (args: {
+    findings: ReadonlyArray<ProposalFinding>;
+  }) => string;
   /** Verify a candidate worktree before it becomes a measurable surface; failures
    * feed the next shot (see `agenticGenerator.verify` / `commandVerifier`). */
   verify?: Verifier;
-  /** Per-shot wall-clock timeout for the harness (ms). */
+  /** Per-shot wall-clock timeout. Omit for no Runtime-imposed deadline. */
   timeoutMs?: number;
-  /** Byte-producer override, used for tests and custom candidate production.
-   * When set, `harness`, `verify`, and `timeoutMs` are unused. */
-  generator?: CandidateGenerator;
+  /** Optional provider-enforced maximum admitted by the run-wide cost ledger. */
+  maximumCharge?: MaximumCharge;
+  generator?: never;
+}
+interface ImproveCustomCodeGeneratorOptions {
+  /** Complete byte-producer replacement. Runtime still validates `profile` before creating worktrees. */
+  generator: CandidateGenerator;
+  executorForWorktree?: never;
+  buildPrompt?: never;
+  verify?: never;
+  timeoutMs?: never;
+  maximumCharge?: never;
 }
+type ImproveCodeOptions = ImproveCodeBaseOptions & (ImproveRuntimeCodeGeneratorOptions | ImproveCustomCodeGeneratorOptions);
 interface ImprovementProfileCandidate {
   /** Surface searched by this run. */
   surface: ImproveProfileSurface;
@@ -458,5 +447,5 @@ declare function defaultRedactor(value: unknown): unknown;
  */
 declare function resolveRedactor(redact: Redactor | false | undefined): Redactor;
 //#endregion
-export { DeepReadonly as A, commandVerifier as B, ImproveResult as C, ImprovementCandidate as D, ImproveSurface as E, AgenticGeneratorShotExecution as F, CandidateGenerator as H, AgenticGeneratorShotReceipt as I, Verifier as L, AGENTIC_PROFILE_RESOURCE_ROOT as M, AgenticGeneratorOptions as N, ImprovementCodeCandidate as O, AgenticGeneratorShotDisposition as P, VerifyResult as R, ImproveProfileSurface as S, ImproveSkillsOptions as T, defaultBuildPrompt as V, ImproveMethodSource as _, ImproveCandidateValidationInput as a, ImproveProfileAgent as b, ImproveCodeResult as c, ImproveLineage as d, ImproveMethodContext as f, ImproveMethodResult as g, ImproveMethodOptions as h, improve as i, ReadonlyAgentProfile as j, ImprovementProfileCandidate as k, ImproveCodeRunOptions as l, ImproveMethodLineage as m, defaultRedactor as n, ImproveCandidateValidator as o, ImproveMethodFactory as p, resolveRedactor as r, ImproveCodeOptions as s, Redactor as t, ImproveCost as u, ImproveOptimizationRunOptions as v, ImproveScenarioPartitions as w, ImproveProfileComponents as x, ImproveOptions as y, agenticGenerator as z };
-//# sourceMappingURL=redact-PQzmE1Jn.d.ts.map
+export { ImprovementCandidate as A, Verifier as B, ImproveProfileComponents as C, ImproveScenarioPartitions as D, ImproveRuntimeCodeGeneratorOptions as E, AgenticGeneratorExecutorForWorktree as F, CandidateGenerator as G, agenticGenerator as H, AgenticGeneratorOptions as I, AgenticGeneratorShotDisposition as L, ImprovementProfileCandidate as M, DeepReadonly as N, ImproveSkillsOptions as O, ReadonlyAgentProfile as P, AgenticGeneratorShotExecution as R, ImproveProfileAgent as S, ImproveResult as T, commandVerifier as U, VerifyResult as V, defaultBuildPrompt as W, ImproveMethodOptions as _, ImproveCandidateValidationInput as a, ImproveOptimizationRunOptions as b, ImproveCodeOptions as c, ImproveCost as d, ImproveCustomCodeGeneratorOptions as f, ImproveMethodLineage as g, ImproveMethodFactory as h, improve as i, ImprovementCodeCandidate as j, ImproveSurface as k, ImproveCodeResult as l, ImproveMethodContext as m, defaultRedactor as n, ImproveCandidateValidator as o, ImproveLineage as p, resolveRedactor as r, ImproveCodeBaseOptions as s, Redactor as t, ImproveCodeRunOptions as u, ImproveMethodResult as v, ImproveProfileSurface as w, ImproveOptions as x, ImproveMethodSource as y, AgenticGeneratorShotReceipt as z };
+//# sourceMappingURL=redact-9_Gf-8m3.d.ts.map