@tangle-network/agent-runtime 0.133.8 → 0.134.2

package/dist/errors-DRoXIc7E.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors-DRoXIc7E.js","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/**\n *\n * Error taxonomy for `@tangle-network/agent-runtime`.\n *\n * Public contract: every error this package throws as part of its consumer-\n * facing API either extends `AgentEvalError` (re-exported here for ergonomic\n * `instanceof` checks at the runtime boundary) or extends one of the\n * runtime-specific subclasses below.\n *\n * Internal invariant guards (`throw new Error('this should never happen')`)\n * remain plain `Error` — they are programmer-mistake assertions, not\n * consumer-catchable contract failures.\n *\n * Subclassing strategy: where a runtime-specific failure maps cleanly to an\n * agent-eval code (validation, config, not_found), we re-use the agent-eval\n * subclass. Runtime-only failure modes (session resume against the wrong\n * backend, backend transport errors) get fresh subclasses that still carry an\n * `AgentEvalErrorCode` so cross-package handlers can pattern-match without\n * importing the runtime.\n *\n * @stable\n */\n\nimport { AgentEvalError } from '@tangle-network/agent-eval'\nimport type { RetainedRunAdmission } from './runtime/retained-run-types'\n\nexport {\n  AgentEvalError,\n  type AgentEvalErrorCode,\n  ConfigError,\n  JudgeError,\n  NotFoundError,\n  ValidationError,\n} from '@tangle-network/agent-eval'\n\n/**\n *\n * Caller asked to resume a session against a backend whose `kind` does not\n * match the session's recorded backend. This is a routing bug — the same\n * session id was reused across two different backend implementations — and\n * is not retryable without picking the right backend.\n *\n * @stable\n */\nexport class SessionMismatchError extends AgentEvalError {\n  readonly sessionBackend: string\n  readonly requestedBackend: string\n\n  constructor(sessionBackend: string, requestedBackend: string, options?: { cause?: unknown }) {\n    super(\n      'validation',\n      `Cannot resume ${sessionBackend} session with ${requestedBackend} backend`,\n      options,\n    )\n    this.sessionBackend = sessionBackend\n    this.requestedBackend = requestedBackend\n  }\n}\n\n/**\n *\n * A backend transport call (HTTP, gRPC, sidecar IPC) failed with a non-success\n * status. Distinct from `JudgeError` (which is structural / unrecoverable)\n * because backend failures are sometimes retryable and consumers may want to\n * branch on the upstream status code.\n *\n * @stable\n */\nexport class BackendTransportError extends AgentEvalError {\n  readonly backend: string\n  readonly status?: number\n  /**\n   * Truncated upstream response body (≤2 KiB) when available. Diagnostic\n   * only — surfaces in `backend_error.error.body` and `final.error.body`\n   * so operators can see \"free_tier_limit\", \"invalid_api_key\", etc. without\n   * cracking the log line open.\n   */\n  readonly body?: string\n\n  constructor(\n    backend: string,\n    message: string,\n    options?: { cause?: unknown; status?: number; body?: string },\n  ) {\n    super('config', message, options)\n    this.backend = backend\n    this.status = options?.status\n    this.body = options?.body\n  }\n}\n\n/**\n *\n * A runtime-run lifecycle method was called in an order the state machine does\n * not allow: `persist()` before `complete()`, `complete()` twice, etc.\n *\n * @stable\n */\nexport class RuntimeRunStateError extends AgentEvalError {\n  constructor(message: string, options?: { cause?: unknown }) {\n    super('validation', message, options)\n  }\n}\n\n/**\n *\n * The dynamic-loop planner returned an unusable topology move — the LLM emitted\n * no parseable envelope, an unknown `kind`, or a structurally-invalid move\n * (e.g. a fanout with zero tasks). This is a structural failure of the\n * agent-authored topology, not a config mistake: the planner ran but its output\n * cannot drive the kernel. Carries `validation` so cross-package handlers can\n * pattern-match without importing the runtime. Fail loud — never substitute a\n * default move, or the loop silently runs a topology nobody chose.\n *\n * @stable\n */\nexport class PlannerError extends AgentEvalError {\n  constructor(message: string, options?: { cause?: unknown }) {\n    super('validation', message, options)\n  }\n}\n\n/**\n * The analyst loop could not read or run over a round's trace — e.g. an empty round\n * (no iterations to analyze) or a malformed trace projection. Fail loud: a silent empty\n * store would mask a broken capture path and the driver would steer on nothing.\n */\nexport class AnalystError extends AgentEvalError {\n  constructor(message: string, options?: { cause?: unknown }) {\n    super('validation', message, options)\n  }\n}\n\n/**\n *\n * The caller's `onAdmission` durability hook rejected, so a retained run's\n * admission record is not durable while provider work may already be live.\n * Distinct from a provider failure: the provider call succeeded, and the\n * environment is intentionally kept so `recoverRetainedRun` (or a provider\n * metadata lookup) can rebuild or disprove the run. Carries `capture_integrity`\n * because the durable record a later recovery requires was not written.\n *\n * @stable\n */\nexport class RetainedRunAdmissionError extends AgentEvalError {\n  readonly phase: RetainedRunAdmission['phase']\n  /** The exact record the hook failed to persist, for direct recovery. */\n  readonly admission: RetainedRunAdmission\n\n  constructor(admission: RetainedRunAdmission, options?: { cause?: unknown }) {\n    super(\n      'capture_integrity',\n      `retained run admission (${admission.phase}) was not persisted; the environment is kept for recovery`,\n      options,\n    )\n    this.phase = admission.phase\n    this.admission = admission\n  }\n}\n\n/**\n *\n * A retained dispatch answered with coordinates that do not bind to the\n * identity the runtime requested, or failed exact verification. The\n * environment-phase admission is already durable at this point, so its\n * coordinates plus the provider reference carried here are the manual\n * recovery path. The environment is intentionally kept. Carries\n * `backend_integrity` because the provider violated its dispatch contract.\n *\n * @stable\n */\nexport class RetainedRunDispatchBindingError extends AgentEvalError {\n  /** The coordinates the runtime sent with the dispatch. */\n  readonly requested: {\n    readonly provider: string\n    readonly environmentId: string\n    readonly sessionId: string\n    readonly executionId: string\n  }\n  /** The loose reference the provider actually returned, for triage. */\n  readonly returned: {\n    readonly id?: string\n    readonly provider?: string\n    readonly controlRef?: unknown\n  }\n\n  constructor(\n    requested: RetainedRunDispatchBindingError['requested'],\n    returned: RetainedRunDispatchBindingError['returned'],\n    options?: { cause?: unknown },\n  ) {\n    super(\n      'backend_integrity',\n      'retained dispatch did not bind to the requested identity; the durable environment admission and the returned reference on this error are the recovery path',\n      options,\n    )\n    this.requested = requested\n    this.returned = returned\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,IAAa,uBAAb,cAA0C,eAAe;CACvD;CACA;CAEA,YAAY,gBAAwB,kBAA0B,SAA+B;EAC3F,MACE,cACA,iBAAiB,eAAe,gBAAgB,iBAAiB,WACjE,OACF;EACA,KAAK,iBAAiB;EACtB,KAAK,mBAAmB;CAC1B;AACF;;;;;;;;;;AAWA,IAAa,wBAAb,cAA2C,eAAe;CACxD;CACA;;;;;;;CAOA;CAEA,YACE,SACA,SACA,SACA;EACA,MAAM,UAAU,SAAS,OAAO;EAChC,KAAK,UAAU;EACf,KAAK,SAAS,SAAS;EACvB,KAAK,OAAO,SAAS;CACvB;AACF;;;;;;;;AASA,IAAa,uBAAb,cAA0C,eAAe;CACvD,YAAY,SAAiB,SAA+B;EAC1D,MAAM,cAAc,SAAS,OAAO;CACtC;AACF;;;;;;;;;;;;;AAcA,IAAa,eAAb,cAAkC,eAAe;CAC/C,YAAY,SAAiB,SAA+B;EAC1D,MAAM,cAAc,SAAS,OAAO;CACtC;AACF;;;;;;AAOA,IAAa,eAAb,cAAkC,eAAe;CAC/C,YAAY,SAAiB,SAA+B;EAC1D,MAAM,cAAc,SAAS,OAAO;CACtC;AACF;;;;;;;;;;;;AAaA,IAAa,4BAAb,cAA+C,eAAe;CAC5D;;CAEA;CAEA,YAAY,WAAiC,SAA+B;EAC1E,MACE,qBACA,2BAA2B,UAAU,MAAM,4DAC3C,OACF;EACA,KAAK,QAAQ,UAAU;EACvB,KAAK,YAAY;CACnB;AACF;;;;;;;;;;;;AAaA,IAAa,kCAAb,cAAqD,eAAe;;CAElE;;CAOA;CAMA,YACE,WACA,UACA,SACA;EACA,MACE,qBACA,8JACA,OACF;EACA,KAAK,YAAY;EACjB,KAAK,WAAW;CAClB;AACF"}

package/dist/materialization-D2bdTfkK.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"materialization-D2bdTfkK.js","names":[],"sources":["../src/runtime/supervise/executable-spec.ts","../src/runtime/supervise/materialization.ts"],"sourcesContent":["import { type AgentProfile, agentProfileSchema } from '@tangle-network/agent-interface'\nimport { assertExecutableAgentProfile } from './model-policy'\nimport { detachedSnapshot } from './snapshot'\nimport type { AgentSpec } from './types'\n\n/**\n * Parse one untrusted profile into the exact immutable value execution may consume.\n *\n * Snapshotting before schema parsing reads caller-owned fields once. Snapshotting the parsed\n * result prevents downstream custom code from changing any identity or authority field.\n */\nexport function executableAgentProfileSnapshot(raw: unknown, context: string): AgentProfile {\n  const input = detachedSnapshot(raw, `${context}: AgentProfile input`)\n  const profile = agentProfileSchema.parse(input)\n  assertExecutableAgentProfile(profile, context)\n  return detachedSnapshot(profile, `${context}: parsed AgentProfile`)\n}\n\n/** Snapshot an executable spec while retaining trusted callbacks by reference. */\nexport function executableAgentSpecSnapshot(raw: AgentSpec, context: string): AgentSpec {\n  const {\n    profile: rawProfile,\n    harness,\n    execution: rawExecution,\n    ...runtimeExtensions\n  } = raw as AgentSpec & Readonly<Record<string, unknown>>\n  const profile = executableAgentProfileSnapshot(rawProfile, context)\n  const execution =\n    rawExecution === undefined\n      ? undefined\n      : detachedSnapshot(rawExecution, `${context}: execution attribution`)\n  return Object.freeze({\n    ...runtimeExtensions,\n    profile,\n    harness,\n    ...(execution === undefined ? {} : { execution }),\n  }) as AgentSpec\n}\n","import { randomUUID } from 'node:crypto'\nimport {\n  agentProfileSchema,\n  canonicalAgentProfileDigest,\n  canonicalCandidateDigest,\n  type Sha256Digest,\n} from '@tangle-network/agent-interface'\nimport { ValidationError } from '../../errors'\nimport { detachedSnapshot } from './snapshot'\nimport type {\n  ExecutionBindingReceipt,\n  Executor,\n  ExecutorExecutionBinding,\n  ExecutorMaterialization,\n  ProfileMaterializationReceipt,\n  ProviderModelAttemptEvidence,\n  ProviderModelExecutionEvidence,\n  Runtime,\n  UnknownMaterializationReason,\n} from './types'\n\ntype RuntimeOwnedExecutorMaterialization =\n  | {\n      readonly kind: 'known'\n      readonly declaration: ExecutorMaterialization\n      readonly binding?: ExecutorExecutionBinding\n    }\n  | {\n      /** A Runtime-owned external executor whose exact launch is known, but whose remote\n       * materializer has not yet returned its terminal acknowledgement. This private state lets\n       * Runtime validate the planned authority before execution without presenting it as proof\n       * that the remote process actually used that plan. */\n      readonly kind: 'pending'\n      readonly runtime: Runtime\n      readonly declaration: ExecutorMaterialization\n      readonly binding: ExecutorExecutionBinding\n    }\n  | { readonly kind: 'deferred'; readonly runtime: Runtime }\n\ninterface RuntimeOwnedExecutorMaterializationRef {\n  current: RuntimeOwnedExecutorMaterialization\n}\n\nconst runtimeOwnedExecutorMaterializations = new WeakMap<\n  object,\n  RuntimeOwnedExecutorMaterializationRef\n>()\nconst runtimeOwnedScopeOwners = new WeakMap<object, Runtime>()\nconst runtimeOwnedExecutorProviderEvidenceState = new WeakMap<\n  object,\n  { readonly attempts: Array<{ readonly observations: string[]; identityConflict?: boolean }> }\n>()\nconst runtimeOwnedDriveHarnessProviderEvidenceState = new WeakMap<\n  object,\n  ProviderModelExecutionEvidence\n>()\n\ninterface KnownReceiptInput {\n  readonly authoredProfileDigest: Sha256Digest\n  readonly runtime: Runtime\n  readonly declaration: ExecutorMaterialization\n}\n\ninterface UnknownReceiptInput {\n  readonly authoredProfileDigest?: Sha256Digest\n  readonly runtime: Runtime\n  readonly reason: UnknownMaterializationReason\n}\n\nconst declarationKeys = new Set([\n  'effectiveProfile',\n  'backend',\n  'model',\n  'execution',\n  'materializer',\n  'plan',\n  'platformAttachments',\n])\n\n/**\n * Bind a declaration to a runtime-owned executor without putting an attestable method on the\n * public Executor interface. This module is not a package export: arbitrary caller executors stay\n * unknown even if they add a lookalike `materialization()` property.\n */\nexport function attestRuntimeOwnedExecutor<Out>(\n  executor: Executor<Out>,\n  declaration: ExecutorMaterialization,\n  binding?: ExecutorExecutionBinding,\n): Executor<Out> {\n  runtimeOwnedExecutorMaterializations.set(executor as object, {\n    current: Object.freeze({\n      kind: 'known',\n      declaration: detachedSnapshot(declaration, 'runtime-owned executor materialization'),\n      ...(binding === undefined\n        ? {}\n        : {\n            binding: detachedSnapshot(binding, 'runtime-owned executor execution binding'),\n          }),\n    }),\n  })\n  ensureProviderEvidenceState(executor)\n  return executor\n}\n\n/** Brand an external Runtime executor whose exact remote materialization is provable only after\n * its terminal protocol acknowledgement. The declaration is a planned authority check, never a\n * known receipt; callers must finalize this same object after validating the acknowledgement. */\nexport function attestRuntimeOwnedPendingExecutor<Out>(\n  executor: Executor<Out>,\n  runtime: Runtime,\n  declaration: ExecutorMaterialization,\n  binding: ExecutorExecutionBinding,\n): Executor<Out> {\n  runtimeOwnedExecutorMaterializations.set(executor as object, {\n    current: Object.freeze({\n      kind: 'pending',\n      runtime,\n      declaration: detachedSnapshot(declaration, 'pending executor materialization'),\n      binding: detachedSnapshot(binding, 'pending executor execution binding'),\n    }),\n  })\n  return executor\n}\n\n/** Replace a private pending brand with terminally acknowledged evidence. A caller-owned executor\n * cannot enter this path because only this module can create the pending WeakMap entry. */\nexport function finalizeRuntimeOwnedPendingExecutor<Out>(\n  executor: Executor<Out>,\n  declaration: ExecutorMaterialization,\n  binding: ExecutorExecutionBinding,\n): Executor<Out> {\n  const ref = runtimeOwnedExecutorMaterializations.get(executor as object)\n  if (ref?.current.kind !== 'pending' || ref.current.runtime !== executor.runtime) {\n    throw new ValidationError(\n      'executor materialization: terminal acknowledgement has no matching Runtime-owned pending executor',\n    )\n  }\n  ref.current = Object.freeze({\n    kind: 'known',\n    declaration: detachedSnapshot(declaration, 'runtime-owned executor materialization'),\n    binding: detachedSnapshot(binding, 'runtime-owned executor execution binding'),\n  })\n  return executor\n}\n\n/** Mark a runtime-owned orchestration executor whose exact leaf declaration is published through\n * its private nested Scope before the first backend inference. Arbitrary executors cannot opt in. */\nexport function attestRuntimeOwnedDeferredExecutor<Out>(\n  executor: Executor<Out>,\n  runtime: Runtime,\n): Executor<Out> {\n  runtimeOwnedExecutorMaterializations.set(executor as object, {\n    current: Object.freeze({ kind: 'deferred', runtime }),\n  })\n  return executor\n}\n\n/** Preserve the runtime-owned attestation when a trusted wrapper changes result semantics only. */\nexport function inheritRuntimeOwnedExecutorAttestation<In, Out>(\n  source: Executor<In>,\n  wrapper: Executor<Out>,\n): Executor<Out> {\n  const ref = runtimeOwnedExecutorMaterializations.get(source as object)\n  if (ref !== undefined) {\n    runtimeOwnedExecutorMaterializations.set(wrapper as object, ref)\n  }\n  const providerState = ensureProviderEvidenceState(source)\n  runtimeOwnedExecutorProviderEvidenceState.set(wrapper as object, providerState)\n  return wrapper\n}\n\nfunction ensureProviderEvidenceState<Out>(executor: Executor<Out>): {\n  readonly attempts: Array<{ readonly observations: string[]; identityConflict?: boolean }>\n} {\n  const existing = runtimeOwnedExecutorProviderEvidenceState.get(executor as object)\n  if (existing !== undefined) return existing\n  const state = { attempts: [] }\n  runtimeOwnedExecutorProviderEvidenceState.set(executor as object, state)\n  return state\n}\n\n/** Read a declaration only when Runtime itself branded this exact executor object. */\nexport function runtimeOwnedExecutorMaterialization<Out>(\n  executor: Executor<Out>,\n): ExecutorMaterialization | undefined {\n  const attestation = runtimeOwnedExecutorMaterializations.get(executor as object)?.current\n  return attestation?.kind === 'known' ? attestation.declaration : undefined\n}\n\n/** Read one attempt binding only from the private brand on this exact executor object. */\nexport function runtimeOwnedExecutorExecutionBinding<Out>(\n  executor: Executor<Out>,\n): ExecutorExecutionBinding | undefined {\n  const attestation = runtimeOwnedExecutorMaterializations.get(executor as object)?.current\n  return attestation?.kind === 'known' ? attestation.binding : undefined\n}\n\n/** Read a planned external declaration only for Runtime's private pending brand. This is useful for\n * pre-execution authority checks, but must never be turned into a known durable receipt. */\nexport function runtimeOwnedPendingExecutorMaterialization<Out>(executor: Executor<Out>):\n  | {\n      readonly runtime: Runtime\n      readonly declaration: ExecutorMaterialization\n      readonly binding: ExecutorExecutionBinding\n    }\n  | undefined {\n  const attestation = runtimeOwnedExecutorMaterializations.get(executor as object)?.current\n  return attestation?.kind === 'pending'\n    ? {\n        runtime: attestation.runtime,\n        declaration: attestation.declaration,\n        binding: attestation.binding,\n      }\n    : undefined\n}\n\n/** Read the expected leaf runtime only for a privately branded deferred orchestration executor. */\nexport function runtimeOwnedDeferredExecutorRuntime<Out>(\n  executor: Executor<Out>,\n): Runtime | undefined {\n  const attestation = runtimeOwnedExecutorMaterializations.get(executor as object)?.current\n  return attestation?.kind === 'deferred' ? attestation.runtime : undefined\n}\n\n/** Propagate trust from a built-in driver adapter to the Agent and recursive executor it owns. */\nexport function attestRuntimeOwnedScopeOwner<T extends object>(owner: T, runtime: Runtime): T {\n  runtimeOwnedScopeOwners.set(owner, runtime)\n  return owner\n}\n\n/** Return a built-in scope owner's expected concrete leaf runtime; caller-owned functions/Agents\n * deliberately have no entry even if they add lookalike fields. */\nexport function runtimeOwnedScopeOwnerRuntime(owner: object): Runtime | undefined {\n  return runtimeOwnedScopeOwners.get(owner)\n}\n\n/** Mark one provider inference attempt on a Runtime-owned executor. */\nexport function recordRuntimeOwnedProviderAttemptStart<Out>(executor: Executor<Out>): void {\n  const state = ensureProviderEvidenceState(executor)\n  state.attempts.push({ observations: [] })\n}\n\n/** Record a trusted served model on the current provider attempt. */\nexport function recordRuntimeOwnedProviderModel<Out>(executor: Executor<Out>, model: string): void {\n  const state = runtimeOwnedExecutorProviderEvidenceState.get(executor as object)\n  const attempt = state?.attempts.at(-1)\n  if (attempt === undefined) {\n    throw new ValidationError('provider model observation arrived before an attempt started')\n  }\n  if (attempt.observations.at(-1) !== model) attempt.observations.push(model)\n}\n\n/** Convert process-local provider observations into a frozen, replayable evidence value. */\nexport function runtimeOwnedExecutorProviderEvidence<Out>(\n  executor: Executor<Out>,\n): ProviderModelExecutionEvidence | undefined {\n  const state = runtimeOwnedExecutorProviderEvidenceState.get(executor as object)\n  if (state === undefined || state.attempts.length === 0) return undefined\n  const attempts: ReadonlyArray<ProviderModelAttemptEvidence> = Object.freeze(\n    state.attempts.map((attempt) =>\n      Object.freeze({\n        observations: Object.freeze([...attempt.observations]),\n        ...(attempt.identityConflict ? { identityConflict: true } : {}),\n      }),\n    ),\n  )\n  const models = Object.freeze([...new Set(attempts.flatMap((attempt) => attempt.observations))])\n  const missing = attempts.some((attempt) => attempt.observations.length === 0)\n  const conflict = attempts.some((attempt) => attempt.identityConflict === true)\n  return Object.freeze(\n    missing || conflict\n      ? {\n          status: 'unknown' as const,\n          attempts,\n          models,\n          reason: conflict\n            ? ('provider-model-conflict' as const)\n            : ('provider-model-missing' as const),\n        }\n      : { status: 'known' as const, attempts, models },\n  )\n}\n\n/** Mark the current provider attempt unusable after conflicting served identity metadata. */\nexport function recordRuntimeOwnedProviderIdentityConflict<Out>(executor: Executor<Out>): void {\n  const state = ensureProviderEvidenceState(executor)\n  const attempt = state.attempts.at(-1)\n  if (attempt === undefined) {\n    throw new ValidationError('provider identity conflict arrived before an attempt started')\n  }\n  attempt.identityConflict = true\n}\n\n/** Attach one executor's provider evidence to a Runtime-owned root drive for final projection. */\nexport function recordRuntimeOwnedDriveHarnessProviderEvidence(\n  owner: object,\n  evidence: ProviderModelExecutionEvidence | undefined,\n): void {\n  if (evidence === undefined) return\n  const prior = runtimeOwnedDriveHarnessProviderEvidenceState.get(owner)\n  if (prior === undefined) {\n    runtimeOwnedDriveHarnessProviderEvidenceState.set(owner, evidence)\n    return\n  }\n  const attempts = Object.freeze([...prior.attempts, ...evidence.attempts])\n  const models = Object.freeze([...new Set([...prior.models, ...evidence.models])])\n  const missing = attempts.some((attempt) => attempt.observations.length === 0)\n  const conflict = attempts.some((attempt) => attempt.identityConflict === true)\n  runtimeOwnedDriveHarnessProviderEvidenceState.set(\n    owner,\n    Object.freeze(\n      missing || conflict\n        ? {\n            status: 'unknown' as const,\n            attempts,\n            models,\n            reason: conflict\n              ? ('provider-model-conflict' as const)\n              : ('provider-model-missing' as const),\n          }\n        : { status: 'known' as const, attempts, models },\n    ),\n  )\n}\n\n/** Read provider evidence recorded by a Runtime-owned root drive. */\nexport function runtimeOwnedDriveHarnessProviderEvidence(\n  owner: object,\n): ProviderModelExecutionEvidence | undefined {\n  return runtimeOwnedDriveHarnessProviderEvidenceState.get(owner)\n}\n\n/** Build one kernel-owned known receipt from a data-only executor declaration. */\nexport function knownMaterializationReceipt(\n  input: KnownReceiptInput,\n): ProfileMaterializationReceipt {\n  const declaration = detachedSnapshot(input.declaration, 'executor materialization')\n  assertExactDeclaration(declaration)\n  const effectiveProfile = agentProfileSchema.safeParse(declaration.effectiveProfile)\n  if (!effectiveProfile.success) {\n    throw new ValidationError('executor materialization: effectiveProfile must be an AgentProfile')\n  }\n  assertNonEmpty(declaration.backend, 'backend')\n  assertNonEmpty(declaration.materializer, 'materializer')\n  assertNonEmpty(declaration.execution?.kind, 'execution.kind')\n  assertNonEmpty(declaration.execution?.id, 'execution.id')\n  assertModel(declaration.model)\n\n  let effectiveProfileDigest: Sha256Digest\n  let materializationPlanDigest: Sha256Digest\n  let platformAttachmentsDigest: Sha256Digest | undefined\n  try {\n    effectiveProfileDigest = canonicalAgentProfileDigest(effectiveProfile.data)\n    materializationPlanDigest = canonicalCandidateDigest(jsonWireSnapshot(declaration.plan))\n    platformAttachmentsDigest =\n      declaration.platformAttachments === undefined\n        ? undefined\n        : canonicalCandidateDigest(jsonWireSnapshot(declaration.platformAttachments))\n  } catch (error) {\n    throw new ValidationError(\n      'executor materialization: profile, plan, and attachments must be finite RFC 8785 JSON',\n      { cause: error },\n    )\n  }\n\n  return Object.freeze({\n    status: 'known' as const,\n    authoredProfileDigest: input.authoredProfileDigest,\n    effectiveProfileDigest,\n    materializationPlanDigest,\n    ...(platformAttachmentsDigest === undefined ? {} : { platformAttachmentsDigest }),\n    runtime: input.runtime,\n    backend: declaration.backend,\n    model: declaration.model,\n    execution: declaration.execution,\n    materializer: declaration.materializer,\n  })\n}\n\n/** Build an explicit unknown receipt without fabricating any executor-owned identity. */\nexport function unknownMaterializationReceipt(\n  input: UnknownReceiptInput,\n): ProfileMaterializationReceipt {\n  return Object.freeze({\n    status: 'unknown' as const,\n    ...(input.authoredProfileDigest === undefined\n      ? {}\n      : { authoredProfileDigest: input.authoredProfileDigest }),\n    runtime: input.runtime,\n    reason: input.reason,\n  })\n}\n\n/** Mint a process-unique attempt id before executor construction. */\nexport function newExecutionAttemptId(nodeId: string): string {\n  return `${nodeId}:attempt:${randomUUID()}`\n}\n\n/** Build the immutable safe receipt for a full, transient execution binding. */\nexport function knownExecutionBindingReceipt(\n  materialization: ProfileMaterializationReceipt,\n  bindingInput: ExecutorExecutionBinding,\n): ExecutionBindingReceipt {\n  const binding = detachedSnapshot(bindingInput, 'executor execution binding')\n  assertNonEmpty(binding.attemptId, 'binding.attemptId')\n  assertSafeDescriptor(binding.descriptor)\n  let materializationReceiptDigest: Sha256Digest\n  let bindingDigest: Sha256Digest\n  try {\n    materializationReceiptDigest = canonicalCandidateDigest(materialization)\n    // Bind the exact JSON document a backend receives. Optional AgentProfile fields are represented\n    // as `undefined` in memory but omitted by JSON transport; normalize that one distinction while\n    // rejecting every non-finite/non-data value instead of silently coercing it.\n    bindingDigest = canonicalCandidateDigest(jsonWireSnapshot(binding.binding))\n  } catch (error) {\n    throw new ValidationError('executor binding must be finite RFC 8785 JSON', { cause: error })\n  }\n  return Object.freeze({\n    status: 'known' as const,\n    attemptId: binding.attemptId,\n    materializationReceiptDigest,\n    bindingDigest,\n    descriptor: binding.descriptor,\n  })\n}\n\n/** Preserve an attempt boundary even when its caller-owned transport cannot be attested. */\nexport function unknownExecutionBindingReceipt(\n  materialization: ProfileMaterializationReceipt,\n  attemptId: string,\n  reason: UnknownMaterializationReason,\n): ExecutionBindingReceipt {\n  assertNonEmpty(attemptId, 'binding.attemptId')\n  return Object.freeze({\n    status: 'unknown' as const,\n    attemptId,\n    materializationReceiptDigest: canonicalCandidateDigest(materialization),\n    reason,\n  })\n}\n\n/** Derive an authored-profile digest without turning non-canonical input into a fake identity. */\nexport function authoredProfileDigest(profile: unknown): Sha256Digest | undefined {\n  try {\n    return canonicalAgentProfileDigest(agentProfileSchema.parse(profile))\n  } catch {\n    return undefined\n  }\n}\n\nfunction assertExactDeclaration(value: ExecutorMaterialization): void {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n    throw new ValidationError('executor materialization: declaration must be an object')\n  }\n  const unknown = Object.keys(value).filter((key) => !declarationKeys.has(key))\n  if (unknown.length > 0) {\n    throw new ValidationError(\n      `executor materialization: unknown declaration fields: ${unknown.sort().join(', ')}`,\n    )\n  }\n  if (!Object.hasOwn(value, 'plan')) {\n    throw new ValidationError('executor materialization: plan is required')\n  }\n}\n\nfunction assertModel(model: ExecutorMaterialization['model']): void {\n  if (typeof model !== 'object' || model === null || Array.isArray(model)) {\n    throw new ValidationError('executor materialization: model must be a known/unknown identity')\n  }\n  const keys = Object.keys(model).sort()\n  if (model.status === 'known') {\n    if (keys.join(',') !== 'id,status') {\n      throw new ValidationError('executor materialization: known model accepts only status and id')\n    }\n    assertNonEmpty(model.id, 'model.id')\n    return\n  }\n  if (model.status === 'unknown') {\n    if (keys.join(',') !== 'reason,status') {\n      throw new ValidationError(\n        'executor materialization: unknown model accepts only status and reason',\n      )\n    }\n    assertNonEmpty(model.reason, 'model.reason')\n    return\n  }\n  throw new ValidationError('executor materialization: model.status must be known or unknown')\n}\n\nfunction assertNonEmpty(value: unknown, field: string): asserts value is string {\n  if (typeof value !== 'string' || value.trim().length === 0) {\n    throw new ValidationError(`executor materialization: ${field} must be a non-empty string`)\n  }\n}\n\nfunction assertSafeDescriptor(descriptor: ExecutorExecutionBinding['descriptor']): void {\n  if (typeof descriptor !== 'object' || descriptor === null || Array.isArray(descriptor)) {\n    throw new ValidationError('executor binding: descriptor must be an object')\n  }\n  for (const [key, value] of Object.entries(descriptor)) {\n    if (/(url|uri|token|key|secret|bearer|credential|authorization)/i.test(key)) {\n      throw new ValidationError(`executor binding: unsafe descriptor key ${JSON.stringify(key)}`)\n    }\n    if (\n      value !== null &&\n      typeof value !== 'string' &&\n      typeof value !== 'number' &&\n      typeof value !== 'boolean'\n    ) {\n      throw new ValidationError(\n        `executor binding: descriptor ${JSON.stringify(key)} must be scalar`,\n      )\n    }\n    if (typeof value === 'string' && (value.includes('://') || value.includes('@'))) {\n      throw new ValidationError(\n        `executor binding: descriptor ${JSON.stringify(key)} contains transport or credential text`,\n      )\n    }\n  }\n}\n\nfunction jsonWireSnapshot(value: unknown, path = '$'): unknown {\n  if (value === null || typeof value === 'string' || typeof value === 'boolean') return value\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) {\n      throw new ValidationError(`executor binding: ${path} must be finite`)\n    }\n    return value\n  }\n  if (Array.isArray(value)) {\n    return value.map((item, index) => {\n      if (item === undefined) {\n        throw new ValidationError(`executor binding: ${path}[${index}] cannot be undefined`)\n      }\n      return jsonWireSnapshot(item, `${path}[${index}]`)\n    })\n  }\n  if (typeof value !== 'object' || value === null) {\n    throw new ValidationError(`executor binding: ${path} must be JSON data`)\n  }\n  const prototype = Object.getPrototypeOf(value)\n  if (prototype !== Object.prototype && prototype !== null) {\n    throw new ValidationError(`executor binding: ${path} must be a plain object`)\n  }\n  const out: Record<string, unknown> = {}\n  for (const [key, item] of Object.entries(value as Record<string, unknown>)) {\n    if (item === undefined) continue\n    out[key] = jsonWireSnapshot(item, `${path}.${key}`)\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;;;;AAWA,SAAgB,+BAA+B,KAAc,SAA+B;CAC1F,MAAM,QAAQ,iBAAiB,KAAK,GAAG,QAAQ,qBAAqB;CACpE,MAAM,UAAU,mBAAmB,MAAM,KAAK;CAC9C,6BAA6B,SAAS,OAAO;CAC7C,OAAO,iBAAiB,SAAS,GAAG,QAAQ,sBAAsB;AACpE;;AAGA,SAAgB,4BAA4B,KAAgB,SAA4B;CACtF,MAAM,EACJ,SAAS,YACT,SACA,WAAW,cACX,GAAG,sBACD;CACJ,MAAM,UAAU,+BAA+B,YAAY,OAAO;CAClE,MAAM,YACJ,iBAAiB,KAAA,IACb,KAAA,IACA,iBAAiB,cAAc,GAAG,QAAQ,wBAAwB;CACxE,OAAO,OAAO,OAAO;EACnB,GAAG;EACH;EACA;EACA,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;CACjD,CAAC;AACH;;;ACMA,MAAM,uDAAuC,IAAI,QAG/C;AACF,MAAM,0CAA0B,IAAI,QAAyB;AAC7D,MAAM,4DAA4C,IAAI,QAGpD;AACF,MAAM,gEAAgD,IAAI,QAGxD;AAcF,MAAM,kCAAkB,IAAI,IAAI;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,2BACd,UACA,aACA,SACe;CACf,qCAAqC,IAAI,UAAoB,EAC3D,SAAS,OAAO,OAAO;EACrB,MAAM;EACN,aAAa,iBAAiB,aAAa,wCAAwC;EACnF,GAAI,YAAY,KAAA,IACZ,CAAC,IACD,EACE,SAAS,iBAAiB,SAAS,0CAA0C,EAC/E;CACN,CAAC,EACH,CAAC;CACD,4BAA4B,QAAQ;CACpC,OAAO;AACT;;;;AAKA,SAAgB,kCACd,UACA,SACA,aACA,SACe;CACf,qCAAqC,IAAI,UAAoB,EAC3D,SAAS,OAAO,OAAO;EACrB,MAAM;EACN;EACA,aAAa,iBAAiB,aAAa,kCAAkC;EAC7E,SAAS,iBAAiB,SAAS,oCAAoC;CACzE,CAAC,EACH,CAAC;CACD,OAAO;AACT;;;AAIA,SAAgB,oCACd,UACA,aACA,SACe;CACf,MAAM,MAAM,qCAAqC,IAAI,QAAkB;CACvE,IAAI,KAAK,QAAQ,SAAS,aAAa,IAAI,QAAQ,YAAY,SAAS,SACtE,MAAM,IAAI,gBACR,mGACF;CAEF,IAAI,UAAU,OAAO,OAAO;EAC1B,MAAM;EACN,aAAa,iBAAiB,aAAa,wCAAwC;EACnF,SAAS,iBAAiB,SAAS,0CAA0C;CAC/E,CAAC;CACD,OAAO;AACT;;;AAIA,SAAgB,mCACd,UACA,SACe;CACf,qCAAqC,IAAI,UAAoB,EAC3D,SAAS,OAAO,OAAO;EAAE,MAAM;EAAY;CAAQ,CAAC,EACtD,CAAC;CACD,OAAO;AACT;;AAGA,SAAgB,uCACd,QACA,SACe;CACf,MAAM,MAAM,qCAAqC,IAAI,MAAgB;CACrE,IAAI,QAAQ,KAAA,GACV,qCAAqC,IAAI,SAAmB,GAAG;CAEjE,MAAM,gBAAgB,4BAA4B,MAAM;CACxD,0CAA0C,IAAI,SAAmB,aAAa;CAC9E,OAAO;AACT;AAEA,SAAS,4BAAiC,UAExC;CACA,MAAM,WAAW,0CAA0C,IAAI,QAAkB;CACjF,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,MAAM,QAAQ,EAAE,UAAU,CAAC,EAAE;CAC7B,0CAA0C,IAAI,UAAoB,KAAK;CACvE,OAAO;AACT;;AAGA,SAAgB,oCACd,UACqC;CACrC,MAAM,cAAc,qCAAqC,IAAI,QAAkB,CAAC,EAAE;CAClF,OAAO,aAAa,SAAS,UAAU,YAAY,cAAc,KAAA;AACnE;;AAGA,SAAgB,qCACd,UACsC;CACtC,MAAM,cAAc,qCAAqC,IAAI,QAAkB,CAAC,EAAE;CAClF,OAAO,aAAa,SAAS,UAAU,YAAY,UAAU,KAAA;AAC/D;;;AAIA,SAAgB,2CAAgD,UAMlD;CACZ,MAAM,cAAc,qCAAqC,IAAI,QAAkB,CAAC,EAAE;CAClF,OAAO,aAAa,SAAS,YACzB;EACE,SAAS,YAAY;EACrB,aAAa,YAAY;EACzB,SAAS,YAAY;CACvB,IACA,KAAA;AACN;;AAGA,SAAgB,oCACd,UACqB;CACrB,MAAM,cAAc,qCAAqC,IAAI,QAAkB,CAAC,EAAE;CAClF,OAAO,aAAa,SAAS,aAAa,YAAY,UAAU,KAAA;AAClE;;AAGA,SAAgB,6BAA+C,OAAU,SAAqB;CAC5F,wBAAwB,IAAI,OAAO,OAAO;CAC1C,OAAO;AACT;;;AAIA,SAAgB,8BAA8B,OAAoC;CAChF,OAAO,wBAAwB,IAAI,KAAK;AAC1C;;AAGA,SAAgB,uCAA4C,UAA+B;CAEzF,4BAD0C,QACtC,CAAC,CAAC,SAAS,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC;AAC1C;;AAGA,SAAgB,gCAAqC,UAAyB,OAAqB;CAEjG,MAAM,UADQ,0CAA0C,IAAI,QACxC,CAAC,EAAE,SAAS,GAAG,EAAE;CACrC,IAAI,YAAY,KAAA,GACd,MAAM,IAAI,gBAAgB,8DAA8D;CAE1F,IAAI,QAAQ,aAAa,GAAG,EAAE,MAAM,OAAO,QAAQ,aAAa,KAAK,KAAK;AAC5E;;AAGA,SAAgB,qCACd,UAC4C;CAC5C,MAAM,QAAQ,0CAA0C,IAAI,QAAkB;CAC9E,IAAI,UAAU,KAAA,KAAa,MAAM,SAAS,WAAW,GAAG,OAAO,KAAA;CAC/D,MAAM,WAAwD,OAAO,OACnE,MAAM,SAAS,KAAK,YAClB,OAAO,OAAO;EACZ,cAAc,OAAO,OAAO,CAAC,GAAG,QAAQ,YAAY,CAAC;EACrD,GAAI,QAAQ,mBAAmB,EAAE,kBAAkB,KAAK,IAAI,CAAC;CAC/D,CAAC,CACH,CACF;CACA,MAAM,SAAS,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,SAAS,SAAS,YAAY,QAAQ,YAAY,CAAC,CAAC,CAAC;CAC9F,MAAM,UAAU,SAAS,MAAM,YAAY,QAAQ,aAAa,WAAW,CAAC;CAC5E,MAAM,WAAW,SAAS,MAAM,YAAY,QAAQ,qBAAqB,IAAI;CAC7E,OAAO,OAAO,OACZ,WAAW,WACP;EACE,QAAQ;EACR;EACA;EACA,QAAQ,WACH,4BACA;CACP,IACA;EAAE,QAAQ;EAAkB;EAAU;CAAO,CACnD;AACF;;AAGA,SAAgB,2CAAgD,UAA+B;CAE7F,MAAM,UADQ,4BAA4B,QACtB,CAAC,CAAC,SAAS,GAAG,EAAE;CACpC,IAAI,YAAY,KAAA,GACd,MAAM,IAAI,gBAAgB,8DAA8D;CAE1F,QAAQ,mBAAmB;AAC7B;;AAGA,SAAgB,+CACd,OACA,UACM;CACN,IAAI,aAAa,KAAA,GAAW;CAC5B,MAAM,QAAQ,8CAA8C,IAAI,KAAK;CACrE,IAAI,UAAU,KAAA,GAAW;EACvB,8CAA8C,IAAI,OAAO,QAAQ;EACjE;CACF;CACA,MAAM,WAAW,OAAO,OAAO,CAAC,GAAG,MAAM,UAAU,GAAG,SAAS,QAAQ,CAAC;CACxE,MAAM,SAAS,OAAO,OAAO,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,MAAM,QAAQ,GAAG,SAAS,MAAM,CAAC,CAAC,CAAC;CAChF,MAAM,UAAU,SAAS,MAAM,YAAY,QAAQ,aAAa,WAAW,CAAC;CAC5E,MAAM,WAAW,SAAS,MAAM,YAAY,QAAQ,qBAAqB,IAAI;CAC7E,8CAA8C,IAC5C,OACA,OAAO,OACL,WAAW,WACP;EACE,QAAQ;EACR;EACA;EACA,QAAQ,WACH,4BACA;CACP,IACA;EAAE,QAAQ;EAAkB;EAAU;CAAO,CACnD,CACF;AACF;;AAGA,SAAgB,yCACd,OAC4C;CAC5C,OAAO,8CAA8C,IAAI,KAAK;AAChE;;AAGA,SAAgB,4BACd,OAC+B;CAC/B,MAAM,cAAc,iBAAiB,MAAM,aAAa,0BAA0B;CAClF,uBAAuB,WAAW;CAClC,MAAM,mBAAmB,mBAAmB,UAAU,YAAY,gBAAgB;CAClF,IAAI,CAAC,iBAAiB,SACpB,MAAM,IAAI,gBAAgB,oEAAoE;CAEhG,eAAe,YAAY,SAAS,SAAS;CAC7C,eAAe,YAAY,cAAc,cAAc;CACvD,eAAe,YAAY,WAAW,MAAM,gBAAgB;CAC5D,eAAe,YAAY,WAAW,IAAI,cAAc;CACxD,YAAY,YAAY,KAAK;CAE7B,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,yBAAyB,4BAA4B,iBAAiB,IAAI;EAC1E,4BAA4B,yBAAyB,iBAAiB,YAAY,IAAI,CAAC;EACvF,4BACE,YAAY,wBAAwB,KAAA,IAChC,KAAA,IACA,yBAAyB,iBAAiB,YAAY,mBAAmB,CAAC;CAClF,SAAS,OAAO;EACd,MAAM,IAAI,gBACR,yFACA,EAAE,OAAO,MAAM,CACjB;CACF;CAEA,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR,uBAAuB,MAAM;EAC7B;EACA;EACA,GAAI,8BAA8B,KAAA,IAAY,CAAC,IAAI,EAAE,0BAA0B;EAC/E,SAAS,MAAM;EACf,SAAS,YAAY;EACrB,OAAO,YAAY;EACnB,WAAW,YAAY;EACvB,cAAc,YAAY;CAC5B,CAAC;AACH;;AAGA,SAAgB,8BACd,OAC+B;CAC/B,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR,GAAI,MAAM,0BAA0B,KAAA,IAChC,CAAC,IACD,EAAE,uBAAuB,MAAM,sBAAsB;EACzD,SAAS,MAAM;EACf,QAAQ,MAAM;CAChB,CAAC;AACH;;AAGA,SAAgB,sBAAsB,QAAwB;CAC5D,OAAO,GAAG,OAAO,WAAW,WAAW;AACzC;;AAGA,SAAgB,6BACd,iBACA,cACyB;CACzB,MAAM,UAAU,iBAAiB,cAAc,4BAA4B;CAC3E,eAAe,QAAQ,WAAW,mBAAmB;CACrD,qBAAqB,QAAQ,UAAU;CACvC,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,+BAA+B,yBAAyB,eAAe;EAIvE,gBAAgB,yBAAyB,iBAAiB,QAAQ,OAAO,CAAC;CAC5E,SAAS,OAAO;EACd,MAAM,IAAI,gBAAgB,iDAAiD,EAAE,OAAO,MAAM,CAAC;CAC7F;CACA,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR,WAAW,QAAQ;EACnB;EACA;EACA,YAAY,QAAQ;CACtB,CAAC;AACH;;AAGA,SAAgB,+BACd,iBACA,WACA,QACyB;CACzB,eAAe,WAAW,mBAAmB;CAC7C,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR;EACA,8BAA8B,yBAAyB,eAAe;EACtE;CACF,CAAC;AACH;;AAGA,SAAgB,sBAAsB,SAA4C;CAChF,IAAI;EACF,OAAO,4BAA4B,mBAAmB,MAAM,OAAO,CAAC;CACtE,QAAQ;EACN;CACF;AACF;AAEA,SAAS,uBAAuB,OAAsC;CACpE,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,gBAAgB,yDAAyD;CAErF,MAAM,UAAU,OAAO,KAAK,KAAK,CAAC,CAAC,QAAQ,QAAQ,CAAC,gBAAgB,IAAI,GAAG,CAAC;CAC5E,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,gBACR,yDAAyD,QAAQ,KAAK,CAAC,CAAC,KAAK,IAAI,GACnF;CAEF,IAAI,CAAC,OAAO,OAAO,OAAO,MAAM,GAC9B,MAAM,IAAI,gBAAgB,4CAA4C;AAE1E;AAEA,SAAS,YAAY,OAA+C;CAClE,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,gBAAgB,kEAAkE;CAE9F,MAAM,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK;CACrC,IAAI,MAAM,WAAW,SAAS;EAC5B,IAAI,KAAK,KAAK,GAAG,MAAM,aACrB,MAAM,IAAI,gBAAgB,kEAAkE;EAE9F,eAAe,MAAM,IAAI,UAAU;EACnC;CACF;CACA,IAAI,MAAM,WAAW,WAAW;EAC9B,IAAI,KAAK,KAAK,GAAG,MAAM,iBACrB,MAAM,IAAI,gBACR,wEACF;EAEF,eAAe,MAAM,QAAQ,cAAc;EAC3C;CACF;CACA,MAAM,IAAI,gBAAgB,iEAAiE;AAC7F;AAEA,SAAS,eAAe,OAAgB,OAAwC;CAC9E,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,WAAW,GACvD,MAAM,IAAI,gBAAgB,6BAA6B,MAAM,4BAA4B;AAE7F;AAEA,SAAS,qBAAqB,YAA0D;CACtF,IAAI,OAAO,eAAe,YAAY,eAAe,QAAQ,MAAM,QAAQ,UAAU,GACnF,MAAM,IAAI,gBAAgB,gDAAgD;CAE5E,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,GAAG;EACrD,IAAI,8DAA8D,KAAK,GAAG,GACxE,MAAM,IAAI,gBAAgB,2CAA2C,KAAK,UAAU,GAAG,GAAG;EAE5F,IACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU,WAEjB,MAAM,IAAI,gBACR,gCAAgC,KAAK,UAAU,GAAG,EAAE,gBACtD;EAEF,IAAI,OAAO,UAAU,aAAa,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,GAAG,IAC3E,MAAM,IAAI,gBACR,gCAAgC,KAAK,UAAU,GAAG,EAAE,uCACtD;CAEJ;AACF;AAEA,SAAS,iBAAiB,OAAgB,OAAO,KAAc;CAC7D,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,OAAO;CACtF,IAAI,OAAO,UAAU,UAAU;EAC7B,IAAI,CAAC,OAAO,SAAS,KAAK,GACxB,MAAM,IAAI,gBAAgB,qBAAqB,KAAK,gBAAgB;EAEtE,OAAO;CACT;CACA,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,MAAM,UAAU;EAChC,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,gBAAgB,qBAAqB,KAAK,GAAG,MAAM,sBAAsB;EAErF,OAAO,iBAAiB,MAAM,GAAG,KAAK,GAAG,MAAM,EAAE;CACnD,CAAC;CAEH,IAAI,OAAO,UAAU,YAAY,UAAU,MACzC,MAAM,IAAI,gBAAgB,qBAAqB,KAAK,mBAAmB;CAEzE,MAAM,YAAY,OAAO,eAAe,KAAK;CAC7C,IAAI,cAAc,OAAO,aAAa,cAAc,MAClD,MAAM,IAAI,gBAAgB,qBAAqB,KAAK,wBAAwB;CAE9E,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,KAAgC,GAAG;EAC1E,IAAI,SAAS,KAAA,GAAW;EACxB,IAAI,OAAO,iBAAiB,MAAM,GAAG,KAAK,GAAG,KAAK;CACpD;CACA,OAAO;AACT"}