@tangle-network/agent-runtime 0.138.1 → 0.140.0

package/dist/testing.d.ts

@@ -1,5 +1,5 @@
-import { Cn as DriverAgentOptions, Gt as RunGraphTestOptions, So as supervisorAgentWithTestBrain, Yt as runGraphWithTestBrain, po as SupervisorAgentTestDeps, ro as superviseWithTestBrain, to as SuperviseTestOptions, wn as driverAgent } from "./index-BOgzou1U.js";
-import { at as ToolLoopCallContext, ot as ToolLoopChat } from "./runtime-DhPCNvuH.js";
+import { Cn as DriverAgentOptions, Gt as RunGraphTestOptions, Po as supervisorAgentWithTestBrain, To as SupervisorAgentTestDeps, Yt as runGraphWithTestBrain, ho as superviseWithTestBrain, po as SuperviseTestOptions, wn as driverAgent } from "./index-COnuT0h7.js";
+import { at as ToolLoopCallContext, ot as ToolLoopChat } from "./runtime-CVNWEw16.js";
 import { AgentImprovementProposal, AgentProfile, AgentProfileImprovementMeasuredComparison, SandboxSizePreset } from "@tangle-network/agent-interface";
 //#region src/testing/index.d.ts
 /** A proposal produced by Runtime's opaque profile-improvement path. */

package/dist/testing.js

@@ -1,12 +1,12 @@
-import { $ as parseExactAgentProfile, K as applyExactAgentProfileDiff, rt as canonicalCandidateDigest$1, st as immutableCandidateValue } from "./prepare-CYqGSYza.js";
-import { f as verifyAgentImprovementProposal } from "./improvement-cycle-hIOGxDtV.js";
-import { c as supervisorAgentWithTestBrain, dt as driverAgent, r as superviseWithTestBrain } from "./supervise-CUJRmx3s.js";
-import { i as runGraphWithTestBrain } from "./graph-DxU92LTL.js";
+import { $ as parseExactAgentProfile, K as applyExactAgentProfileDiff, rt as canonicalCandidateDigest$1, st as immutableCandidateValue } from "./prepare-DK1qnk7-.js";
+import { f as verifyAgentImprovementProposal } from "./improvement-cycle-D6rhMJR0.js";
+import { c as supervisorAgentWithTestBrain, dt as driverAgent, r as superviseWithTestBrain } from "./supervise-Cx1QY_hj.js";
+import { i as runGraphWithTestBrain } from "./graph-BbMjq7-x.js";
 import { SANDBOX_SIZE_PRESET_NAMES } from "@tangle-network/agent-interface";
 //#region src/testing/fixtures/agent-improvement-proposal.json
 var agent_improvement_proposal_default = {
 	changedSurfaces: ["prompt"],
-	digest: "sha256:96aa602a3f9d198264af652f5bba5cd51fb54519aaae91c28894eef2b6e694e5",
+	digest: "sha256:4bf3e675e8862056f6f348c60228a75e9569b64041738f93dc35d17fd5fecd15",
 	evaluation: {
 		"decision": {
 			"contributingChecks": [
@@ -4577,7 +4577,7 @@ var agent_improvement_proposal_default = {
 		],
 		"metadata": {
 			"fixture": "agent-improvement-proposal",
-			"runtimeVersion": "0.138.1"
+			"runtimeVersion": "0.140.0"
 		},
 		"objectives": [
 			{
@@ -4688,8 +4688,8 @@ var agent_improvement_proposal_default = {
 			"baselineContentHash": "sha256:5c21ee53e513fc604cb09754e21c392b24a424da0ef37dbf8f1ee4a8a0b08f09",
 			"candidateContentHash": "sha256:60fcbb1c728194bd51d7d19cb732d1c3f1881dce7e0a6266b41c8b98cfd65693",
 			"kind": "agent-eval-loop",
-			"recordDigest": "sha256:5b1be97ac62edbe65f899224398159b1fbfc9a768d25a5d79044de6e53f76600",
-			"runId": "agent-runtime-0.138.1-proposal-fixture",
+			"recordDigest": "sha256:74084a3450b84ff752aa829eb85cb02460a12950ea030a73996449e5aecf048e",
+			"runId": "agent-runtime-0.140.0-proposal-fixture",
 			"schema": "agent-candidate-experiment"
 		}
 	},
@@ -4712,13 +4712,13 @@ var agent_improvement_proposal_default = {
 	}],
 	kind: "agent-improvement-proposal",
 	proposedAt: "2026-07-10T01:00:00.000Z",
-	runId: "agent-runtime-0.138.1-proposal-fixture"
+	runId: "agent-runtime-0.140.0-proposal-fixture"
 };
 //#endregion
 //#region src/testing/fixtures/agent-profile-improvement-proposal.json
 var agent_profile_improvement_proposal_default = {
 	changedSurfaces: ["prompt", "skills"],
-	digest: "sha256:f98a80755978d5cfbca957967b1a97f29af8a974bf920746fda8b3deddf38304",
+	digest: "sha256:e406db83e3a7e2c4bedeb0ba3ead467d312abe132f979f16ba9deb4537ddd58f",
 	evaluation: {
 		"decision": {
 			"contributingChecks": [
@@ -6352,7 +6352,7 @@ var agent_profile_improvement_proposal_default = {
 		],
 		"metadata": {
 			"fixture": "agent-profile-improvement-proposal",
-			"runtimeVersion": "0.138.1"
+			"runtimeVersion": "0.140.0"
 		},
 		"objectives": [
 			{
@@ -6463,7 +6463,7 @@ var agent_profile_improvement_proposal_default = {
 			"baselineContentHash": "sha256:21c495a37c418c10bde64fbaa188beddeed31f1f051ea60a6a6582a9ee0db704",
 			"candidateContentHash": "sha256:103f77bc8481601eef1ad5fe6ba84a40dffabc3a44f421f8c8559121edab84e9",
 			"kind": "agent-eval-loop",
-			"recordDigest": "sha256:16e8733160306657bd773d677c478519634bb4360f0573484e6c5e85e4dcc6d4",
+			"recordDigest": "sha256:6facdaee084e14e4beb044d0fc5a109f60b71cdd3e845721f7da721adbf096c4",
 			"runId": "profile-improvement-1",
 			"schema": "agent-profile-improvement-experiment"
 		}

package/dist/{tool-server-Dh-NcbHr.js → tool-server-DEmLr9YY.js}

@@ -1,4 +1,4 @@
-import { f as ValidationError } from "./errors-CVIDr7GQ.js";
+import { m as ValidationError } from "./errors-CDZ8XsVj.js";
 import { createInterface } from "node:readline";
 //#region src/mcp/tool-server.ts
 /**
@@ -151,4 +151,4 @@ function writeResponse(output, response) {
 //#endregion
 export { createStdioToolServer as t };
 
-//# sourceMappingURL=tool-server-Dh-NcbHr.js.map
+//# sourceMappingURL=tool-server-DEmLr9YY.js.map

package/dist/{tool-server-Dh-NcbHr.js.map → tool-server-DEmLr9YY.js.map}

@@ -1 +1 @@
-{"version":3,"file":"tool-server-Dh-NcbHr.js","names":[],"sources":["../src/mcp/tool-server.ts"],"sourcesContent":["/**\n * `createStdioToolServer` — the generic newline-delimited JSON-RPC 2.0 MCP\n * server core: `initialize` / `notifications/initialized` / `tools/list` /\n * `tools/call` over a stdio-shaped transport, protocol 2024-11-05.\n *\n * Extracted from `createMcpServer` (server.ts) so every in-repo MCP server —\n * the delegation server, the memory server — serves the ONE wire protocol the\n * same-host client (`connectStdioMcp`, runtime/stdio-mcp-client.ts) speaks.\n * A second hand-rolled serve loop could drift from what the client expects;\n * this core makes that impossible by construction.\n *\n * @experimental\n */\n\nimport { createInterface, type Interface as ReadlineInterface } from 'node:readline'\nimport { ValidationError } from '../errors'\nimport type { JsonRpcMessage, JsonRpcResponse, McpToolDescriptor, McpTransport } from './protocol'\n\nexport type { JsonRpcMessage, JsonRpcResponse, McpToolDescriptor, McpTransport } from './protocol'\n\nconst PROTOCOL_VERSION = '2024-11-05'\n\n/** @experimental */\nexport interface StdioToolServerOptions {\n  /** Server display name surfaced via `initialize`. */\n  serverName: string\n  /** Server version surfaced via `initialize`. */\n  serverVersion: string\n  /** The tools to serve. Duplicate names throw — a silent shadow would hide a tool. */\n  tools: readonly McpToolDescriptor[]\n}\n\n/** @experimental */\nexport interface StdioToolServer {\n  /** Tools currently registered, keyed by name. */\n  readonly tools: ReadonlyMap<string, McpToolDescriptor>\n  /** Handle a single parsed JSON-RPC message. Returns the response object (or `null` for notifications). */\n  handle(message: JsonRpcMessage): Promise<JsonRpcResponse | null>\n  /** Drive the server on a stdio-shaped transport until `stop()` is called. */\n  serve(transport?: McpTransport): Promise<void>\n  /** Stop a `serve` call. Subsequent requests are rejected. */\n  stop(): void\n}\n\n/** Build the generic stdio JSON-RPC tool server. */\nexport function createStdioToolServer(options: StdioToolServerOptions): StdioToolServer {\n  const tools = new Map<string, McpToolDescriptor>()\n  for (const tool of options.tools) {\n    if (tools.has(tool.name)) {\n      throw new ValidationError(`createStdioToolServer: duplicate tool name \"${tool.name}\"`)\n    }\n    tools.set(tool.name, tool)\n  }\n\n  let stopped = false\n  let activeReadline: ReadlineInterface | undefined\n\n  async function handle(message: JsonRpcMessage): Promise<JsonRpcResponse | null> {\n    if (stopped) {\n      return rpcError(message.id ?? null, -32099, 'server stopped')\n    }\n    if (message.method === 'initialize') {\n      return rpcResult(message.id ?? null, {\n        protocolVersion: PROTOCOL_VERSION,\n        capabilities: { tools: {} },\n        serverInfo: { name: options.serverName, version: options.serverVersion },\n      })\n    }\n    if (message.method === 'notifications/initialized') {\n      // MCP clients send this after the handshake; it has no id and expects\n      // no response.\n      return null\n    }\n    if (message.method === 'tools/list') {\n      return rpcResult(message.id ?? null, {\n        tools: [...tools.values()].map((tool) => ({\n          name: tool.name,\n          description: tool.description,\n          inputSchema: tool.inputSchema,\n        })),\n      })\n    }\n    if (message.method === 'tools/call') {\n      const params = (message.params ?? {}) as { name?: unknown; arguments?: unknown }\n      const name = typeof params.name === 'string' ? params.name : ''\n      const tool = tools.get(name)\n      if (!tool) {\n        return rpcError(message.id ?? null, -32601, `unknown tool: ${name}`)\n      }\n      try {\n        const output = await tool.handler(params.arguments ?? {})\n        return rpcResult(message.id ?? null, toolCallResult(output))\n      } catch (err) {\n        const reason = err instanceof Error ? err.message : String(err)\n        const code = err instanceof TypeError || err instanceof RangeError ? -32602 : -32000\n        return rpcError(message.id ?? null, code, reason)\n      }\n    }\n    if (message.id === undefined || message.id === null) return null\n    return rpcError(message.id, -32601, `unknown method: ${message.method}`)\n  }\n\n  async function serve(transport?: McpTransport): Promise<void> {\n    const input = transport?.input ?? process.stdin\n    const output = transport?.output ?? process.stdout\n    const rl = createInterface({ input, crlfDelay: Number.POSITIVE_INFINITY })\n    activeReadline = rl\n    return new Promise<void>((resolve, reject) => {\n      rl.on('line', (line) => {\n        const trimmed = line.trim()\n        if (!trimmed) return\n        let parsed: JsonRpcMessage | undefined\n        try {\n          parsed = JSON.parse(trimmed) as JsonRpcMessage\n        } catch (err) {\n          writeResponse(output, rpcError(null, -32700, `parse error: ${(err as Error).message}`))\n          return\n        }\n        if (parsed?.jsonrpc !== '2.0' || typeof parsed.method !== 'string') {\n          writeResponse(output, rpcError(parsed?.id ?? null, -32600, 'invalid request'))\n          return\n        }\n        void handle(parsed).then((response) => {\n          if (response) writeResponse(output, response)\n        })\n      })\n      rl.on('close', () => resolve())\n      rl.on('error', (err) => reject(err))\n      if (stopped) {\n        rl.close()\n        resolve()\n      }\n    })\n  }\n\n  function stop(): void {\n    stopped = true\n    activeReadline?.close()\n    activeReadline = undefined\n  }\n\n  return { tools, handle, serve, stop }\n}\n\nfunction toolCallResult(output: unknown): {\n  content: [{ type: 'text'; text: string }]\n  structuredContent?: Record<string, unknown>\n  isError: false\n} {\n  let json: string | undefined\n  try {\n    json = JSON.stringify(output)\n  } catch (err) {\n    const reason = err instanceof Error ? `: ${err.message}` : ''\n    throw new TypeError(`MCP tool result must be JSON-serializable${reason}`, { cause: err })\n  }\n  if (json === undefined) {\n    throw new TypeError('MCP tool result must be JSON-serializable')\n  }\n\n  const serialized = JSON.parse(json) as unknown\n  // Preserve string content verbatim. MCP clients pass this text directly to the calling agent.\n  const result: {\n    content: [{ type: 'text'; text: string }]\n    structuredContent?: Record<string, unknown>\n    isError: false\n  } = {\n    content: [{ type: 'text', text: typeof serialized === 'string' ? serialized : json }],\n    isError: false,\n  }\n  if (serialized !== null && typeof serialized === 'object' && !Array.isArray(serialized)) {\n    result.structuredContent = serialized as Record<string, unknown>\n  }\n  return result\n}\n\nfunction rpcResult(id: number | string | null, result: unknown): JsonRpcResponse {\n  return { jsonrpc: '2.0', id, result }\n}\n\nfunction rpcError(\n  id: number | string | null,\n  code: number,\n  message: string,\n  data?: unknown,\n): JsonRpcResponse {\n  return {\n    jsonrpc: '2.0',\n    id,\n    error: data === undefined ? { code, message } : { code, message, data },\n  }\n}\n\nfunction writeResponse(output: NodeJS.WritableStream, response: JsonRpcResponse): void {\n  output.write(`${JSON.stringify(response)}\\n`)\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,MAAM,mBAAmB;;AAyBzB,SAAgB,sBAAsB,SAAkD;CACtF,MAAM,wBAAQ,IAAI,IAA+B;CACjD,KAAK,MAAM,QAAQ,QAAQ,OAAO;EAChC,IAAI,MAAM,IAAI,KAAK,IAAI,GACrB,MAAM,IAAI,gBAAgB,+CAA+C,KAAK,KAAK,EAAE;EAEvF,MAAM,IAAI,KAAK,MAAM,IAAI;CAC3B;CAEA,IAAI,UAAU;CACd,IAAI;CAEJ,eAAe,OAAO,SAA0D;EAC9E,IAAI,SACF,OAAO,SAAS,QAAQ,MAAM,MAAM,QAAQ,gBAAgB;EAE9D,IAAI,QAAQ,WAAW,cACrB,OAAO,UAAU,QAAQ,MAAM,MAAM;GACnC,iBAAiB;GACjB,cAAc,EAAE,OAAO,CAAC,EAAE;GAC1B,YAAY;IAAE,MAAM,QAAQ;IAAY,SAAS,QAAQ;GAAc;EACzE,CAAC;EAEH,IAAI,QAAQ,WAAW,6BAGrB,OAAO;EAET,IAAI,QAAQ,WAAW,cACrB,OAAO,UAAU,QAAQ,MAAM,MAAM,EACnC,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,UAAU;GACxC,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,aAAa,KAAK;EACpB,EAAE,EACJ,CAAC;EAEH,IAAI,QAAQ,WAAW,cAAc;GACnC,MAAM,SAAU,QAAQ,UAAU,CAAC;GACnC,MAAM,OAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;GAC7D,MAAM,OAAO,MAAM,IAAI,IAAI;GAC3B,IAAI,CAAC,MACH,OAAO,SAAS,QAAQ,MAAM,MAAM,QAAQ,iBAAiB,MAAM;GAErE,IAAI;IACF,MAAM,SAAS,MAAM,KAAK,QAAQ,OAAO,aAAa,CAAC,CAAC;IACxD,OAAO,UAAU,QAAQ,MAAM,MAAM,eAAe,MAAM,CAAC;GAC7D,SAAS,KAAK;IACZ,MAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;IAC9D,MAAM,OAAO,eAAe,aAAa,eAAe,aAAa,SAAS;IAC9E,OAAO,SAAS,QAAQ,MAAM,MAAM,MAAM,MAAM;GAClD;EACF;EACA,IAAI,QAAQ,OAAO,KAAA,KAAa,QAAQ,OAAO,MAAM,OAAO;EAC5D,OAAO,SAAS,QAAQ,IAAI,QAAQ,mBAAmB,QAAQ,QAAQ;CACzE;CAEA,eAAe,MAAM,WAAyC;EAC5D,MAAM,QAAQ,WAAW,SAAS,QAAQ;EAC1C,MAAM,SAAS,WAAW,UAAU,QAAQ;EAC5C,MAAM,KAAK,gBAAgB;GAAE;GAAO,WAAW,OAAO;EAAkB,CAAC;EACzE,iBAAiB;EACjB,OAAO,IAAI,SAAe,SAAS,WAAW;GAC5C,GAAG,GAAG,SAAS,SAAS;IACtB,MAAM,UAAU,KAAK,KAAK;IAC1B,IAAI,CAAC,SAAS;IACd,IAAI;IACJ,IAAI;KACF,SAAS,KAAK,MAAM,OAAO;IAC7B,SAAS,KAAK;KACZ,cAAc,QAAQ,SAAS,MAAM,QAAQ,gBAAiB,IAAc,SAAS,CAAC;KACtF;IACF;IACA,IAAI,QAAQ,YAAY,SAAS,OAAO,OAAO,WAAW,UAAU;KAClE,cAAc,QAAQ,SAAS,QAAQ,MAAM,MAAM,QAAQ,iBAAiB,CAAC;KAC7E;IACF;IACA,OAAY,MAAM,CAAC,CAAC,MAAM,aAAa;KACrC,IAAI,UAAU,cAAc,QAAQ,QAAQ;IAC9C,CAAC;GACH,CAAC;GACD,GAAG,GAAG,eAAe,QAAQ,CAAC;GAC9B,GAAG,GAAG,UAAU,QAAQ,OAAO,GAAG,CAAC;GACnC,IAAI,SAAS;IACX,GAAG,MAAM;IACT,QAAQ;GACV;EACF,CAAC;CACH;CAEA,SAAS,OAAa;EACpB,UAAU;EACV,gBAAgB,MAAM;EACtB,iBAAiB,KAAA;CACnB;CAEA,OAAO;EAAE;EAAO;EAAQ;EAAO;CAAK;AACtC;AAEA,SAAS,eAAe,QAItB;CACA,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,UAAU,MAAM;CAC9B,SAAS,KAAK;EACZ,MAAM,SAAS,eAAe,QAAQ,KAAK,IAAI,YAAY;EAC3D,MAAM,IAAI,UAAU,4CAA4C,UAAU,EAAE,OAAO,IAAI,CAAC;CAC1F;CACA,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,UAAU,2CAA2C;CAGjE,MAAM,aAAa,KAAK,MAAM,IAAI;CAElC,MAAM,SAIF;EACF,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,OAAO,eAAe,WAAW,aAAa;EAAK,CAAC;EACpF,SAAS;CACX;CACA,IAAI,eAAe,QAAQ,OAAO,eAAe,YAAY,CAAC,MAAM,QAAQ,UAAU,GACpF,OAAO,oBAAoB;CAE7B,OAAO;AACT;AAEA,SAAS,UAAU,IAA4B,QAAkC;CAC/E,OAAO;EAAE,SAAS;EAAO;EAAI;CAAO;AACtC;AAEA,SAAS,SACP,IACA,MACA,SACA,MACiB;CACjB,OAAO;EACL,SAAS;EACT;EACA,OAAO,SAAS,KAAA,IAAY;GAAE;GAAM;EAAQ,IAAI;GAAE;GAAM;GAAS;EAAK;CACxE;AACF;AAEA,SAAS,cAAc,QAA+B,UAAiC;CACrF,OAAO,MAAM,GAAG,KAAK,UAAU,QAAQ,EAAE,GAAG;AAC9C"}
+{"version":3,"file":"tool-server-DEmLr9YY.js","names":[],"sources":["../src/mcp/tool-server.ts"],"sourcesContent":["/**\n * `createStdioToolServer` — the generic newline-delimited JSON-RPC 2.0 MCP\n * server core: `initialize` / `notifications/initialized` / `tools/list` /\n * `tools/call` over a stdio-shaped transport, protocol 2024-11-05.\n *\n * Extracted from `createMcpServer` (server.ts) so every in-repo MCP server —\n * the delegation server, the memory server — serves the ONE wire protocol the\n * same-host client (`connectStdioMcp`, runtime/stdio-mcp-client.ts) speaks.\n * A second hand-rolled serve loop could drift from what the client expects;\n * this core makes that impossible by construction.\n *\n * @experimental\n */\n\nimport { createInterface, type Interface as ReadlineInterface } from 'node:readline'\nimport { ValidationError } from '../errors'\nimport type { JsonRpcMessage, JsonRpcResponse, McpToolDescriptor, McpTransport } from './protocol'\n\nexport type { JsonRpcMessage, JsonRpcResponse, McpToolDescriptor, McpTransport } from './protocol'\n\nconst PROTOCOL_VERSION = '2024-11-05'\n\n/** @experimental */\nexport interface StdioToolServerOptions {\n  /** Server display name surfaced via `initialize`. */\n  serverName: string\n  /** Server version surfaced via `initialize`. */\n  serverVersion: string\n  /** The tools to serve. Duplicate names throw — a silent shadow would hide a tool. */\n  tools: readonly McpToolDescriptor[]\n}\n\n/** @experimental */\nexport interface StdioToolServer {\n  /** Tools currently registered, keyed by name. */\n  readonly tools: ReadonlyMap<string, McpToolDescriptor>\n  /** Handle a single parsed JSON-RPC message. Returns the response object (or `null` for notifications). */\n  handle(message: JsonRpcMessage): Promise<JsonRpcResponse | null>\n  /** Drive the server on a stdio-shaped transport until `stop()` is called. */\n  serve(transport?: McpTransport): Promise<void>\n  /** Stop a `serve` call. Subsequent requests are rejected. */\n  stop(): void\n}\n\n/** Build the generic stdio JSON-RPC tool server. */\nexport function createStdioToolServer(options: StdioToolServerOptions): StdioToolServer {\n  const tools = new Map<string, McpToolDescriptor>()\n  for (const tool of options.tools) {\n    if (tools.has(tool.name)) {\n      throw new ValidationError(`createStdioToolServer: duplicate tool name \"${tool.name}\"`)\n    }\n    tools.set(tool.name, tool)\n  }\n\n  let stopped = false\n  let activeReadline: ReadlineInterface | undefined\n\n  async function handle(message: JsonRpcMessage): Promise<JsonRpcResponse | null> {\n    if (stopped) {\n      return rpcError(message.id ?? null, -32099, 'server stopped')\n    }\n    if (message.method === 'initialize') {\n      return rpcResult(message.id ?? null, {\n        protocolVersion: PROTOCOL_VERSION,\n        capabilities: { tools: {} },\n        serverInfo: { name: options.serverName, version: options.serverVersion },\n      })\n    }\n    if (message.method === 'notifications/initialized') {\n      // MCP clients send this after the handshake; it has no id and expects\n      // no response.\n      return null\n    }\n    if (message.method === 'tools/list') {\n      return rpcResult(message.id ?? null, {\n        tools: [...tools.values()].map((tool) => ({\n          name: tool.name,\n          description: tool.description,\n          inputSchema: tool.inputSchema,\n        })),\n      })\n    }\n    if (message.method === 'tools/call') {\n      const params = (message.params ?? {}) as { name?: unknown; arguments?: unknown }\n      const name = typeof params.name === 'string' ? params.name : ''\n      const tool = tools.get(name)\n      if (!tool) {\n        return rpcError(message.id ?? null, -32601, `unknown tool: ${name}`)\n      }\n      try {\n        const output = await tool.handler(params.arguments ?? {})\n        return rpcResult(message.id ?? null, toolCallResult(output))\n      } catch (err) {\n        const reason = err instanceof Error ? err.message : String(err)\n        const code = err instanceof TypeError || err instanceof RangeError ? -32602 : -32000\n        return rpcError(message.id ?? null, code, reason)\n      }\n    }\n    if (message.id === undefined || message.id === null) return null\n    return rpcError(message.id, -32601, `unknown method: ${message.method}`)\n  }\n\n  async function serve(transport?: McpTransport): Promise<void> {\n    const input = transport?.input ?? process.stdin\n    const output = transport?.output ?? process.stdout\n    const rl = createInterface({ input, crlfDelay: Number.POSITIVE_INFINITY })\n    activeReadline = rl\n    return new Promise<void>((resolve, reject) => {\n      rl.on('line', (line) => {\n        const trimmed = line.trim()\n        if (!trimmed) return\n        let parsed: JsonRpcMessage | undefined\n        try {\n          parsed = JSON.parse(trimmed) as JsonRpcMessage\n        } catch (err) {\n          writeResponse(output, rpcError(null, -32700, `parse error: ${(err as Error).message}`))\n          return\n        }\n        if (parsed?.jsonrpc !== '2.0' || typeof parsed.method !== 'string') {\n          writeResponse(output, rpcError(parsed?.id ?? null, -32600, 'invalid request'))\n          return\n        }\n        void handle(parsed).then((response) => {\n          if (response) writeResponse(output, response)\n        })\n      })\n      rl.on('close', () => resolve())\n      rl.on('error', (err) => reject(err))\n      if (stopped) {\n        rl.close()\n        resolve()\n      }\n    })\n  }\n\n  function stop(): void {\n    stopped = true\n    activeReadline?.close()\n    activeReadline = undefined\n  }\n\n  return { tools, handle, serve, stop }\n}\n\nfunction toolCallResult(output: unknown): {\n  content: [{ type: 'text'; text: string }]\n  structuredContent?: Record<string, unknown>\n  isError: false\n} {\n  let json: string | undefined\n  try {\n    json = JSON.stringify(output)\n  } catch (err) {\n    const reason = err instanceof Error ? `: ${err.message}` : ''\n    throw new TypeError(`MCP tool result must be JSON-serializable${reason}`, { cause: err })\n  }\n  if (json === undefined) {\n    throw new TypeError('MCP tool result must be JSON-serializable')\n  }\n\n  const serialized = JSON.parse(json) as unknown\n  // Preserve string content verbatim. MCP clients pass this text directly to the calling agent.\n  const result: {\n    content: [{ type: 'text'; text: string }]\n    structuredContent?: Record<string, unknown>\n    isError: false\n  } = {\n    content: [{ type: 'text', text: typeof serialized === 'string' ? serialized : json }],\n    isError: false,\n  }\n  if (serialized !== null && typeof serialized === 'object' && !Array.isArray(serialized)) {\n    result.structuredContent = serialized as Record<string, unknown>\n  }\n  return result\n}\n\nfunction rpcResult(id: number | string | null, result: unknown): JsonRpcResponse {\n  return { jsonrpc: '2.0', id, result }\n}\n\nfunction rpcError(\n  id: number | string | null,\n  code: number,\n  message: string,\n  data?: unknown,\n): JsonRpcResponse {\n  return {\n    jsonrpc: '2.0',\n    id,\n    error: data === undefined ? { code, message } : { code, message, data },\n  }\n}\n\nfunction writeResponse(output: NodeJS.WritableStream, response: JsonRpcResponse): void {\n  output.write(`${JSON.stringify(response)}\\n`)\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,MAAM,mBAAmB;;AAyBzB,SAAgB,sBAAsB,SAAkD;CACtF,MAAM,wBAAQ,IAAI,IAA+B;CACjD,KAAK,MAAM,QAAQ,QAAQ,OAAO;EAChC,IAAI,MAAM,IAAI,KAAK,IAAI,GACrB,MAAM,IAAI,gBAAgB,+CAA+C,KAAK,KAAK,EAAE;EAEvF,MAAM,IAAI,KAAK,MAAM,IAAI;CAC3B;CAEA,IAAI,UAAU;CACd,IAAI;CAEJ,eAAe,OAAO,SAA0D;EAC9E,IAAI,SACF,OAAO,SAAS,QAAQ,MAAM,MAAM,QAAQ,gBAAgB;EAE9D,IAAI,QAAQ,WAAW,cACrB,OAAO,UAAU,QAAQ,MAAM,MAAM;GACnC,iBAAiB;GACjB,cAAc,EAAE,OAAO,CAAC,EAAE;GAC1B,YAAY;IAAE,MAAM,QAAQ;IAAY,SAAS,QAAQ;GAAc;EACzE,CAAC;EAEH,IAAI,QAAQ,WAAW,6BAGrB,OAAO;EAET,IAAI,QAAQ,WAAW,cACrB,OAAO,UAAU,QAAQ,MAAM,MAAM,EACnC,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,UAAU;GACxC,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,aAAa,KAAK;EACpB,EAAE,EACJ,CAAC;EAEH,IAAI,QAAQ,WAAW,cAAc;GACnC,MAAM,SAAU,QAAQ,UAAU,CAAC;GACnC,MAAM,OAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;GAC7D,MAAM,OAAO,MAAM,IAAI,IAAI;GAC3B,IAAI,CAAC,MACH,OAAO,SAAS,QAAQ,MAAM,MAAM,QAAQ,iBAAiB,MAAM;GAErE,IAAI;IACF,MAAM,SAAS,MAAM,KAAK,QAAQ,OAAO,aAAa,CAAC,CAAC;IACxD,OAAO,UAAU,QAAQ,MAAM,MAAM,eAAe,MAAM,CAAC;GAC7D,SAAS,KAAK;IACZ,MAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;IAC9D,MAAM,OAAO,eAAe,aAAa,eAAe,aAAa,SAAS;IAC9E,OAAO,SAAS,QAAQ,MAAM,MAAM,MAAM,MAAM;GAClD;EACF;EACA,IAAI,QAAQ,OAAO,KAAA,KAAa,QAAQ,OAAO,MAAM,OAAO;EAC5D,OAAO,SAAS,QAAQ,IAAI,QAAQ,mBAAmB,QAAQ,QAAQ;CACzE;CAEA,eAAe,MAAM,WAAyC;EAC5D,MAAM,QAAQ,WAAW,SAAS,QAAQ;EAC1C,MAAM,SAAS,WAAW,UAAU,QAAQ;EAC5C,MAAM,KAAK,gBAAgB;GAAE;GAAO,WAAW,OAAO;EAAkB,CAAC;EACzE,iBAAiB;EACjB,OAAO,IAAI,SAAe,SAAS,WAAW;GAC5C,GAAG,GAAG,SAAS,SAAS;IACtB,MAAM,UAAU,KAAK,KAAK;IAC1B,IAAI,CAAC,SAAS;IACd,IAAI;IACJ,IAAI;KACF,SAAS,KAAK,MAAM,OAAO;IAC7B,SAAS,KAAK;KACZ,cAAc,QAAQ,SAAS,MAAM,QAAQ,gBAAiB,IAAc,SAAS,CAAC;KACtF;IACF;IACA,IAAI,QAAQ,YAAY,SAAS,OAAO,OAAO,WAAW,UAAU;KAClE,cAAc,QAAQ,SAAS,QAAQ,MAAM,MAAM,QAAQ,iBAAiB,CAAC;KAC7E;IACF;IACA,OAAY,MAAM,CAAC,CAAC,MAAM,aAAa;KACrC,IAAI,UAAU,cAAc,QAAQ,QAAQ;IAC9C,CAAC;GACH,CAAC;GACD,GAAG,GAAG,eAAe,QAAQ,CAAC;GAC9B,GAAG,GAAG,UAAU,QAAQ,OAAO,GAAG,CAAC;GACnC,IAAI,SAAS;IACX,GAAG,MAAM;IACT,QAAQ;GACV;EACF,CAAC;CACH;CAEA,SAAS,OAAa;EACpB,UAAU;EACV,gBAAgB,MAAM;EACtB,iBAAiB,KAAA;CACnB;CAEA,OAAO;EAAE;EAAO;EAAQ;EAAO;CAAK;AACtC;AAEA,SAAS,eAAe,QAItB;CACA,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,UAAU,MAAM;CAC9B,SAAS,KAAK;EACZ,MAAM,SAAS,eAAe,QAAQ,KAAK,IAAI,YAAY;EAC3D,MAAM,IAAI,UAAU,4CAA4C,UAAU,EAAE,OAAO,IAAI,CAAC;CAC1F;CACA,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,UAAU,2CAA2C;CAGjE,MAAM,aAAa,KAAK,MAAM,IAAI;CAElC,MAAM,SAIF;EACF,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,OAAO,eAAe,WAAW,aAAa;EAAK,CAAC;EACpF,SAAS;CACX;CACA,IAAI,eAAe,QAAQ,OAAO,eAAe,YAAY,CAAC,MAAM,QAAQ,UAAU,GACpF,OAAO,oBAAoB;CAE7B,OAAO;AACT;AAEA,SAAS,UAAU,IAA4B,QAAkC;CAC/E,OAAO;EAAE,SAAS;EAAO;EAAI;CAAO;AACtC;AAEA,SAAS,SACP,IACA,MACA,SACA,MACiB;CACjB,OAAO;EACL,SAAS;EACT;EACA,OAAO,SAAS,KAAA,IAAY;GAAE;GAAM;EAAQ,IAAI;GAAE;GAAM;GAAS;EAAK;CACxE;AACF;AAEA,SAAS,cAAc,QAA+B,UAAiC;CACrF,OAAO,MAAM,GAAG,KAAK,UAAU,QAAQ,EAAE,GAAG;AAC9C"}

package/dist/{types-CxU37Uzr.d.ts → types-19ZOddS3.d.ts}

@@ -1,5 +1,5 @@
-import { BenchmarkEvaluation, TraceStore } from "@tangle-network/agent-eval";
 import { AgentCandidateArtifactRef, AgentCandidateAttemptPolicy, AgentCandidateBenchmarkGraderIdentity, AgentCandidateBenchmarkSuite, AgentCandidateBenchmarkTask, AgentCandidateBundle, AgentCandidateCapturedArtifact, AgentCandidateContainer, AgentCandidateEffectiveMemory, AgentCandidateExecutionLimits, AgentCandidateExecutionPlanEvidence, AgentCandidateFixedSpend, AgentCandidateGitHubRepository, AgentCandidateInstructionDelivery, AgentCandidateKnowledgeRef, AgentCandidateMaterializationReceipt, AgentCandidateModelAccessNetwork, AgentCandidateModelSettlementCall, AgentCandidateOciPlatform, AgentCandidateProfileActivation, AgentCandidateProfilePlanEvidence, AgentCandidateResolvedModel, AgentCandidateRunCell, AgentCandidateRunReceipt, AgentCandidateTaskOutcomeEvidence, AgentCandidateTaskOutcomeMaterial, AgentCandidateTaskOutputSpec, AgentCandidateTermination, AgentCandidateWorkspaceManifestMaterial, AgentCandidateWorkspaceSnapshotEvidence, Sha256Digest } from "@tangle-network/agent-interface";
+import { BenchmarkEvaluation, TraceStore } from "@tangle-network/agent-eval";
 //#region src/candidate-execution/types.d.ts
 declare const verifiedCandidateBrand: unique symbol;
 declare const preparedCandidateBrand: unique symbol;
@@ -498,4 +498,4 @@ declare const CANDIDATE_TRACE_ENV: {
 };
 //#endregion
 export { AgentCandidateWorkspacePort as A, ResolvedAgentCandidateContainer as B, AgentCandidateProtectedModelSettlement as C, AgentCandidateRunFinalization as D, AgentCandidateRepositoryPort as E, PreparedAgentCandidateExecution as F, VerifiedAgentCandidateTaskOutcome as H, PreparedAgentCandidateInstruction as I, PreparedAgentCandidateKnowledge as L, CANDIDATE_TRACE_TAGS as M, CanonicalCandidateDocument as N, AgentCandidateTaskExecution as O, PersistedTaskOutcomeEvidence as P, PreparedAgentCandidateLaunch as R, AgentCandidateProtectedModelReservation as S, AgentCandidateProtectedRunCapture as T, VerifiedAgentCandidate as V, AgentCandidateModelLimits as _, AgentCandidateExecutionPorts as a, AgentCandidateOutputPurpose as b, AgentCandidateExecutorPort as c, AgentCandidateExecutorStopRequest as d, AgentCandidateExecutorTaskOutcomeCapture as f, AgentCandidateMemoryResetResult as g, AgentCandidateMemoryPort as h, AgentCandidateContainerPort as i, CANDIDATE_TRACE_ENV as j, AgentCandidateVerificationPorts as k, AgentCandidateExecutorProfileFile as l, AgentCandidateExecutorWorkspaceInput as m, AgentCandidateBenchmarkGraderIdentity as n, AgentCandidateExecutorFinalCapture as o, AgentCandidateExecutorWorkspaceFile as p, AgentCandidateBenchmarkGraderPort as r, AgentCandidateExecutorMemoryCapture as s, AgentCandidateArtifactPort as t, AgentCandidateExecutorRequest as u, AgentCandidateModelPort as v, AgentCandidateProtectedModelSettlementCall as w, AgentCandidateProtectedModelActivation as x, AgentCandidateOutputArtifactPort as y, PreparedAgentCandidateTrace as z };
-//# sourceMappingURL=types-CxU37Uzr.d.ts.map
+//# sourceMappingURL=types-19ZOddS3.d.ts.map

package/dist/{types-BBwGSiAj.d.ts → types-C244Huc9.d.ts}

@@ -1,7 +1,7 @@
 import { l as RuntimeHooks } from "./runtime-hooks-sbRpjStq.js";
+import { AgentProfile, InputPart, RequestedInteractions, StreamEvent } from "@tangle-network/agent-interface";
 import { ControlBudget, ControlDecision, ControlEvalResult, ControlRunResult, ControlStep, DataAcquisitionPlan, DefaultVerdict, KnowledgeReadinessReport, KnowledgeRequirement, RunRecord, TraceStore, UserQuestion } from "@tangle-network/agent-eval";
-import { AgentProfile as AgentProfile$1 } from "@tangle-network/agent-interface";
-import { CreateSandboxOptions, SandboxEvent, SandboxInstance } from "@tangle-network/sandbox";
+import { CreateRequestOptions, CreateSandboxOptions, SandboxEvent, SandboxInstance } from "@tangle-network/sandbox";
 //#region src/types.d.ts
 /** @stable */
 interface AgentTaskSpec {
@@ -219,8 +219,14 @@ type OpenAIChatResponseFormat = {
   type: 'json_schema';
   json_schema: Record<string, unknown>;
 };
+/** Agent Interface events that do not belong to Runtime's task vocabulary. */
+type RuntimeCanonicalStreamEvent = StreamEvent & {
+  task?: AgentTaskSpec;
+  session?: RuntimeSession;
+  timestamp?: string;
+};
 /** @stable */
-type RuntimeStreamEvent = {
+type RuntimeStreamEvent = RuntimeCanonicalStreamEvent | {
   type: 'task_start';
   task: AgentTaskSpec;
   timestamp: string;
@@ -419,6 +425,9 @@ interface AgentBackendInput {
     role: string;
     content: string;
   }>;
+  parts?: InputPart[];
+  interactions?: RequestedInteractions;
+  providerOptions?: Record<string, unknown>;
   inputs?: Record<string, unknown>;
 }
 /** @stable */
@@ -658,7 +667,7 @@ interface Validator<Output, Verdict = DefaultVerdict> {
  */
 interface AgentRunSpec<Task> {
   /** Sandbox SDK profile — what kind of agent runs the task. */
-  profile: AgentProfile$1;
+  profile: AgentProfile;
   /** Task → prompt formatter. Pure and deterministic. */
   taskToPrompt: (task: Task) => string;
   /**
@@ -917,7 +926,7 @@ interface LoopResult<Task, Output, Decision> {
  * @stable
  */
 interface SandboxClient {
-  create(options?: CreateSandboxOptions): Promise<SandboxInstance>;
+  create(options?: CreateSandboxOptions, requestOptions?: CreateRequestOptions): Promise<SandboxInstance>;
   describePlacement?(box: SandboxInstance): LoopSandboxPlacement;
   /**
    * Optional legacy CRIU capability probe. When present and it resolves
@@ -1217,5 +1226,5 @@ interface ExecCtx {
   parentSpanId?: string;
 }
 //#endregion
-export { OpenAIChatToolChoice as $, RuntimeRunCompleteInput as A, AgentBackendInput as B, MountRecorder as C, SelectionReceipt as D, SandboxClient as E, RuntimeRunRow as F, AgentTaskContext as G, AgentKnowledgeProvider as H, RuntimeRunStatus as I, AgentTaskStatus as J, AgentTaskRunResult as K, startRuntimeRun as L, RuntimeRunHandle as M, RuntimeRunOptions as N, ValidationCtx as O, RuntimeRunPersistenceAdapter as P, OpenAIChatTool as Q, AgentAdapter as R, MountManifestEntry as S, RunProvenance as T, AgentRuntimeEvent as U, AgentExecutionBackend as V, AgentRuntimeEventSink as W, KnowledgeReadinessDecision as X, BackendErrorDetail as Y, OpenAIChatResponseFormat as Z, LoopTeardownFailedPayload as _, Iteration as a, LoopTraceEvent as b, LoopIterationDispatchPayload as c, LoopLineageOptions as d, RunAgentTaskOptions as et, LoopPlanDescription as f, LoopStartedPayload as g, LoopSandboxPlacement as h, ExecCtx as i, RuntimeStreamEvent as it, RuntimeRunCost as j, Validator as k, LoopIterationEndedPayload as l, LoopResult as m, DefaultVerdict as n, RuntimeSession as nt, LoopDecisionPayload as o, LoopPlanPayload as p, AgentTaskSpec as q, Driver as r, RuntimeSessionStore as rt, LoopEndedPayload as s, AgentRunSpec as t, RunAgentTaskStreamOptions as tt, LoopIterationStartedPayload as u, LoopTokenUsage as v, OutputAdapter as w, LoopWinner as x, LoopTraceEmitter as y, AgentBackendContext as z };
-//# sourceMappingURL=types-BBwGSiAj.d.ts.map
+export { OpenAIChatToolChoice as $, RuntimeRunCompleteInput as A, AgentBackendInput as B, MountRecorder as C, SelectionReceipt as D, SandboxClient as E, RuntimeRunRow as F, AgentTaskContext as G, AgentKnowledgeProvider as H, RuntimeRunStatus as I, AgentTaskStatus as J, AgentTaskRunResult as K, startRuntimeRun as L, RuntimeRunHandle as M, RuntimeRunOptions as N, ValidationCtx as O, RuntimeRunPersistenceAdapter as P, OpenAIChatTool as Q, AgentAdapter as R, MountManifestEntry as S, RunProvenance as T, AgentRuntimeEvent as U, AgentExecutionBackend as V, AgentRuntimeEventSink as W, KnowledgeReadinessDecision as X, BackendErrorDetail as Y, OpenAIChatResponseFormat as Z, LoopTeardownFailedPayload as _, Iteration as a, RuntimeStreamEvent as at, LoopTraceEvent as b, LoopIterationDispatchPayload as c, LoopLineageOptions as d, RunAgentTaskOptions as et, LoopPlanDescription as f, LoopStartedPayload as g, LoopSandboxPlacement as h, ExecCtx as i, RuntimeSessionStore as it, RuntimeRunCost as j, Validator as k, LoopIterationEndedPayload as l, LoopResult as m, DefaultVerdict as n, RuntimeCanonicalStreamEvent as nt, LoopDecisionPayload as o, LoopPlanPayload as p, AgentTaskSpec as q, Driver as r, RuntimeSession as rt, LoopEndedPayload as s, AgentRunSpec as t, RunAgentTaskStreamOptions as tt, LoopIterationStartedPayload as u, LoopTokenUsage as v, OutputAdapter as w, LoopWinner as x, LoopTraceEmitter as y, AgentBackendContext as z };
+//# sourceMappingURL=types-C244Huc9.d.ts.map

package/dist/{types-BCkweg3w.d.ts → types-D4arYjUl.d.ts}

@@ -1,7 +1,7 @@
-import { J as AgentTaskStatus, U as AgentRuntimeEvent, it as RuntimeStreamEvent, v as LoopTokenUsage, y as LoopTraceEmitter } from "./types-BBwGSiAj.js";
+import { J as AgentTaskStatus, U as AgentRuntimeEvent, at as RuntimeStreamEvent, v as LoopTokenUsage, y as LoopTraceEmitter } from "./types-C244Huc9.js";
 import { l as RuntimeHooks } from "./runtime-hooks-sbRpjStq.js";
+import { AgentProfile, Sha256Digest } from "@tangle-network/agent-interface";
 import { ControlEvalResult, DefaultVerdict, KnowledgeReadinessReport, KnowledgeRequirement, ToolSpan } from "@tangle-network/agent-eval";
-import { AgentProfile as AgentProfile$1, Sha256Digest } from "@tangle-network/agent-interface";
 import { BackendType } from "@tangle-network/sandbox";
 //#region src/runtime/supervise/progress.d.ts
 /** How long a worker may produce no metered activity before a `progress()` read calls it stalled.
@@ -942,7 +942,7 @@ type Runtime = 'router' | 'inline' | 'sandbox' | 'cli' | (string & {});
  * Fail loud on an unresolvable spec (no executor and an unknown harness).
  */
 interface AgentSpec {
-  readonly profile: AgentProfile$1;
+  readonly profile: AgentProfile;
   /** `null` selects router/inline; a `BackendType` selects the sandboxed harness. */
   readonly harness: BackendType | null;
   /** Trusted candidate/campaign attribution supplied by the caller. Profile/task digests are
@@ -984,7 +984,7 @@ interface MaterializedExecutionIdentity {
  */
 interface ExecutorMaterialization {
   /** Complete profile after trusted runtime-owned attachments or backend overlays were applied. */
-  readonly effectiveProfile: AgentProfile$1;
+  readonly effectiveProfile: AgentProfile;
   /** Concrete backend or harness selected for this run. */
   readonly backend: string;
   /** Exact selected model, or an explicit unknown reason. */
@@ -1056,7 +1056,7 @@ type RootMaterialization = {
   readonly runtime: Runtime;
   readonly declaration: 'deferred';
   /** Exact admitted profile used to validate the stable effective identity at publication. */
-  readonly authoredProfile: AgentProfile$1;
+  readonly authoredProfile: AgentProfile;
 };
 /** Kernel-owned context for the concrete supervised node a factory is constructing. */
 interface ExecutorNodeContext {
@@ -1933,4 +1933,4 @@ interface WidenGate<Out> {
 }
 //#endregion
 export { WaitOpts as $, WaitSpec as $t, ResumedWork as A, exportEvalRuns as At, SpawnOpts as B, RuntimeTelemetryOptions as Bt, NodeStatus as C, OtelSpan as Ct, Restart as D, buildRuntimeEventOtelSpans as Dt, ProviderModelExecutionEvidence as E, buildLoopSpanNodes as Et, Runtime as F, toOtelAttributes as Ft, SpendGap as G, sanitizeAgentRuntimeEvent as Gt, SpawnRejection as H, SanitizedKnowledgeRequirement as Ht, Scope as I, RuntimeEventCollector as It, Supervisor as J, PendingWait as Jt, SteerableRootHandle as K, sanitizeKnowledgeReadinessReport as Kt, Settled as L, RuntimeStreamEventCollector as Lt, RootMaterialization as M, loopEventToOtelSpan as Mt, RootProviderModelEvidence as N, padSpanId as Nt, ResultBlobStore as O, createOpenInferenceFileExporter as Ot, RootSignal as P, padTraceId as Pt, UsageEvent as Q, WaitRejection as Qt, SpawnEvent as R, RuntimeStreamEventSink as Rt, NodeSnapshot as S, OtelExporter as St, ProviderModelAttemptEvidence as T, buildLoopOtelSpans as Tt, Spend as U, createRuntimeEventCollector as Ut, SpawnPrior as V, SanitizedKnowledgeReadinessReport as Vt, SpendChannel as W, createRuntimeStreamEventCollector as Wt, TreeView as X, WaitProbe as Xt, SupervisorOpts as Y, WaitOutcome as Yt, UnknownMaterializationReason as Z, WaitProbeRegistry as Zt, MaterializedExecutionIdentity as _, ScopeProgressInput as _n, EvalRunsExportResult as _t, DefaultVerdict as a, waitUntil as an, readWorkerTraceContext as at, NodeExecutionIdentity as b, readWorkerProgress as bn, OtelAttribute as bt, ExecutorAccounting as c, ToolStepInput as cn, workerTraceSeamKey as ct, ExecutorFactory as d, decodeToolPart as dn, mergeTraceEnv as dt, createWaitProbes as en, WidenGate as et, ExecutorMaterialization as f, sandboxSessionTraceSource as fn, readTraceContextFromEnv as ft, Handle as g, ExecutorProgress as gn, EvalRunsExportConfig as gt, ExecutorResult as h, DEFAULT_STALL_AFTER_MS as hn, EvalRunGeneration as ht, Budget as i, validateWaitSpec as in, WorkerTraceSeamCarrier as it, RootHandle as j, generateSpanId as jt, ResumedKeyState as k, createOtelExporter as kt, ExecutorContext as l, TraceSource as ln, TraceContext as lt, ExecutorRegistry as m, ActivityNote as mn, EvalRunEvent as mt, AgentExecutionRef as n, pollFor as nn, WorkerTraceUnavailableReason as nt, ExecutionBindingReceipt as o, SessionMessageLike as on, workerTraceEnv as ot, ExecutorNodeContext as p, ActivityLog as pn, traceContextToEnv as pt, SupervisedResult as q, sanitizeRuntimeStreamEvent as qt, AgentSpec as r, timerAt as rn, WorkerTraceResolver as rt, Executor as s, SessionTraceBox as sn, workerTraceHeaders as st, Agent as t, isWaitOutcome as tn, WorkerTraceEvidence as tt, ExecutorExecutionBinding as u, createPushTraceSource as un, createPropagatingTraceEmitter as ut, MaterializedModelIdentity as v, WorkerProgress as vn, INTELLIGENCE_WIRE_VERSION as vt, ProfileMaterializationReceipt as w, RuntimeEventOtelOptions as wt, NodeId as x, OtelExportConfig as xt, NoWinnerError as y, createActivityLog as yn, LoopSpanNode as yt, SpawnJournal as z, RuntimeStreamEventSummary as zt };
-//# sourceMappingURL=types-BCkweg3w.d.ts.map
+//# sourceMappingURL=types-D4arYjUl.d.ts.map

package/dist/{workspace-archive-C7AvjSVb.js → workspace-archive-HYlsPhfm.js}

@@ -1,4 +1,4 @@
-import { A as verifyMaterializedWorkspace, C as assertNoGitIndirection, D as captureMaterializedWorkspace, E as candidateWorkspaceManifest, T as runCandidateGit, a as persistCandidateOutputArtifact, at as deepFreezeCandidate, ct as omitTopLevelDigest, k as verifyBytes, lt as sha256Bytes, nt as canonicalCandidateBytes, ot as embeddedCandidateArtifact, rt as canonicalCandidateDigest$1, st as immutableCandidateValue, w as readCandidateGitTreeFiles } from "./prepare-CYqGSYza.js";
+import { A as verifyMaterializedWorkspace, C as assertNoGitIndirection, D as captureMaterializedWorkspace, E as candidateWorkspaceManifest, T as runCandidateGit, a as persistCandidateOutputArtifact, at as deepFreezeCandidate, ct as omitTopLevelDigest, k as verifyBytes, lt as sha256Bytes, nt as canonicalCandidateBytes, ot as embeddedCandidateArtifact, rt as canonicalCandidateDigest$1, st as immutableCandidateValue, w as readCandidateGitTreeFiles } from "./prepare-DK1qnk7-.js";
 import { agentCandidateBundleSchema } from "@tangle-network/agent-interface";
 import { randomUUID } from "node:crypto";
 import { dirname, isAbsolute, join, resolve, sep, win32 } from "node:path";
@@ -572,4 +572,4 @@ const typedArrayByteLengthGetter = requireTypedArrayGetter("byteLength");
 //#endregion
 export { sealAgentCandidateBundle as i, captureAgentCandidateWorkspaceFiles as n, createAgentCandidateWorkspacePort as r, captureAgentCandidateWorkspace as t };
 
-//# sourceMappingURL=workspace-archive-C7AvjSVb.js.map
+//# sourceMappingURL=workspace-archive-HYlsPhfm.js.map

package/dist/{workspace-archive-C7AvjSVb.js.map → workspace-archive-HYlsPhfm.js.map}

@@ -1 +1 @@
-{"version":3,"file":"workspace-archive-C7AvjSVb.js","names":["canonicalCandidateDigest","canonicalCandidateDigest","fsConstants"],"sources":["../src/candidate-execution/bundle.ts","../src/candidate-execution/workspace-archive.ts"],"sourcesContent":["import type { AgentCandidateBundle } from '@tangle-network/agent-interface'\nimport { agentCandidateBundleSchema } from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateDigest, immutableCandidateValue, omitTopLevelDigest } from './digest'\n\n/** Exact candidate wire shape before the runtime computes its canonical digest. */\nexport type AgentCandidateBundleInput = Omit<AgentCandidateBundle, 'digest'>\n\n/** Validate and content-address a candidate bundle before it crosses an approval boundary. */\nexport function sealAgentCandidateBundle(input: AgentCandidateBundleInput): AgentCandidateBundle {\n  const digest = canonicalCandidateDigest(input)\n  const parsed = agentCandidateBundleSchema.parse({ ...input, digest })\n  const parsedDigest = canonicalCandidateDigest(omitTopLevelDigest(parsed))\n  if (parsedDigest !== digest) {\n    throw new Error('candidate bundle changed while validating its canonical wire shape')\n  }\n  return immutableCandidateValue(parsed)\n}\n","import { randomUUID } from 'node:crypto'\nimport { constants as fsConstants } from 'node:fs'\nimport {\n  lstat,\n  mkdir,\n  mkdtemp,\n  open,\n  readdir,\n  readFile,\n  realpath,\n  rename,\n  rm,\n  writeFile,\n} from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { dirname, isAbsolute, join, resolve, sep, win32 } from 'node:path'\nimport { isAnyArrayBuffer, isSharedArrayBuffer } from 'node:util/types'\n\nimport type {\n  AgentCandidateCapturedArtifact,\n  AgentCandidateWorkspaceSnapshotEvidence,\n} from '@tangle-network/agent-interface'\nimport { type Entry, extract, type Pack, pack } from 'tar-stream'\n\nimport {\n  candidateWorkspaceManifest,\n  captureMaterializedWorkspace,\n  verifyBytes,\n  verifyMaterializedWorkspace,\n} from './artifacts'\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  deepFreezeCandidate,\n  embeddedCandidateArtifact,\n  sha256Bytes,\n} from './digest'\nimport {\n  assertNoGitIndirection,\n  readCandidateGitTreeFiles,\n  runCandidateGit,\n} from './git-materialize'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport type {\n  AgentCandidateExecutorWorkspaceFile,\n  AgentCandidateOutputArtifactPort,\n  AgentCandidateWorkspacePort,\n} from './types'\n\nconst archiveKind = 'agent-candidate-workspace-archive' as const\nconst workspaceEntryPrefix = 'workspace/'\nconst repositoryMetadataEntry = 'metadata/repository.json'\nconst repositoryBundleEntry = 'metadata/repository.bundle'\nconst fixedTarTime = new Date(0)\n\nexport interface AgentCandidateWorkspaceArchiveLimits {\n  maxArchiveBytes: number\n  maxEmbeddedArtifactBytes: number\n  maxFiles: number\n  maxFileBytes: number\n  maxTotalFileBytes: number\n  maxPathBytes: number\n  maxRepositoryBundleBytes: number\n}\n\nconst defaultLimits: AgentCandidateWorkspaceArchiveLimits = Object.freeze({\n  maxArchiveBytes: 512 * 1024 * 1024,\n  maxEmbeddedArtifactBytes: 1024 * 1024,\n  maxFiles: 50_000,\n  maxFileBytes: 128 * 1024 * 1024,\n  maxTotalFileBytes: 256 * 1024 * 1024,\n  maxPathBytes: 4_096,\n  maxRepositoryBundleBytes: 128 * 1024 * 1024,\n})\n\ninterface WorkspaceArchiveRepository {\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n    bytes: Uint8Array\n  }\n}\n\ninterface WorkspaceArchiveRepositoryMetadata {\n  kind: typeof archiveKind\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n  }\n}\n\ninterface DecodedWorkspaceArchive {\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository?: WorkspaceArchiveRepository\n}\n\nexport interface CaptureAgentCandidateWorkspaceOptions {\n  /** Include Git HEAD so task preparation can prove its exact commit and tree. */\n  includeRepository?: boolean\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n  /** Use the evaluator-owned artifact store when manifest or archive bytes should not be embedded. */\n  artifactPersistence?: {\n    executionId: string\n    outputArtifacts: AgentCandidateOutputArtifactPort\n    signal?: AbortSignal\n  }\n}\n\nexport interface CreateAgentCandidateWorkspacePortOptions {\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n}\n\nexport interface CapturedAgentCandidateWorkspace {\n  readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  /** Caller-owned bytes accepted by createAgentCandidateWorkspacePort. */\n  readonly archive: Uint8Array\n}\n\n/** Capture one exact regular-file workspace for immutable candidate execution. */\nexport async function captureAgentCandidateWorkspace(\n  rootInput: string,\n  options: CaptureAgentCandidateWorkspaceOptions = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const root = resolve(rootInput)\n  const limits = workspaceLimits(options.limits)\n  const captured = options.includeRepository\n    ? await captureRepository(root, limits)\n    : await captureMaterializedWorkspace(root, {\n        limits: {\n          maxFiles: limits.maxFiles,\n          maxFileBytes: limits.maxFileBytes,\n          maxTotalFileBytes: limits.maxTotalFileBytes,\n        },\n      })\n  assertWorkspaceFilesWithinLimits(captured.files, limits)\n  const repository = 'repository' in captured ? captured.repository : undefined\n  return captureWorkspaceFiles(captured.files, repository, limits, options.artifactPersistence)\n}\n\n/** Capture detached files returned by a remote executor into the standard archive. */\nexport async function captureAgentCandidateWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  options: Omit<CaptureAgentCandidateWorkspaceOptions, 'includeRepository'> = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const limits = workspaceLimits(options.limits)\n  return captureWorkspaceFiles(\n    normalizeWorkspaceFiles(input, limits),\n    undefined,\n    limits,\n    options.artifactPersistence,\n  )\n}\n\nasync function captureWorkspaceFiles(\n  files: readonly AgentCandidateExecutorWorkspaceFile[],\n  repository: WorkspaceArchiveRepository | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n  artifactPersistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<CapturedAgentCandidateWorkspace> {\n  const material = candidateWorkspaceManifest(files)\n  const manifest = canonicalCandidateBytes(material)\n  const archive = await encodeWorkspaceArchive(files, repository, limits.maxArchiveBytes)\n  if (\n    !artifactPersistence &&\n    (manifest.byteLength > limits.maxEmbeddedArtifactBytes ||\n      archive.byteLength > limits.maxEmbeddedArtifactBytes)\n  ) {\n    throw new Error(\n      'candidate workspace artifacts exceed maxEmbeddedArtifactBytes; artifactPersistence is required',\n    )\n  }\n  const manifestArtifact = await captureWorkspaceArtifact('manifest', manifest, artifactPersistence)\n  const archiveArtifact = await captureWorkspaceArtifact('archive', archive, artifactPersistence)\n  const snapshot = deepFreezeCandidate({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: canonicalCandidateDigest(material),\n    material,\n    manifest: manifestArtifact,\n    archive: archiveArtifact,\n  } satisfies AgentCandidateWorkspaceSnapshotEvidence)\n  return Object.freeze({ snapshot, archive })\n}\n\nasync function captureWorkspaceArtifact(\n  kind: 'manifest' | 'archive',\n  bytes: Uint8Array,\n  persistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<AgentCandidateCapturedArtifact> {\n  if (!persistence) return embeddedCandidateArtifact(bytes)\n  if (!persistence.executionId.trim()) {\n    throw new Error('candidate workspace artifact persistence requires an executionId')\n  }\n  return persistCandidateOutputArtifact(persistence.outputArtifacts, {\n    executionId: persistence.executionId,\n    purpose: kind === 'manifest' ? 'candidate-workspace-manifest' : 'candidate-workspace-archive',\n    bytes,\n    ...(persistence.signal ? { signal: persistence.signal } : {}),\n  })\n}\n\n/** Create the standard bounded materializer for candidate execution ports. */\nexport function createAgentCandidateWorkspacePort(\n  options: CreateAgentCandidateWorkspacePortOptions = {},\n): AgentCandidateWorkspacePort {\n  const limits = workspaceLimits(options.limits)\n  const port: AgentCandidateWorkspacePort = {\n    materialize: async ({ role, snapshot, archive, destination }) => {\n      await materializeAgentCandidateWorkspace({\n        role,\n        snapshot,\n        archive,\n        destination,\n        limits,\n      })\n    },\n  }\n  return Object.freeze(port)\n}\n\nasync function materializeAgentCandidateWorkspace(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  destination: string\n  limits: AgentCandidateWorkspaceArchiveLimits\n}): Promise<void> {\n  verifyBytes(\n    input.archive,\n    input.snapshot.archive.sha256,\n    input.snapshot.archive.byteLength,\n    'candidate workspace archive',\n  )\n  const decoded = await parseWorkspaceArchive(input.archive, input.limits)\n  if (decoded.repository && input.role !== 'task') {\n    throw new Error('only task workspaces may carry a Git repository')\n  }\n  assertArchiveMatchesSnapshot(decoded.files, input.snapshot)\n  const destination = resolve(input.destination)\n  await prepareEmptyDestination(destination)\n  const staging = await mkdtemp(`${destination}.materializing-`)\n  try {\n    await writeWorkspaceFiles(staging, decoded.files)\n    if (decoded.repository) {\n      await materializeRepository(decoded.repository, staging)\n    }\n    await verifyMaterializedWorkspace(staging, input.snapshot.material, {\n      ignoredProtectedRootEntries: decoded.repository ? ['.git'] : [],\n    })\n    await rename(staging, destination)\n  } catch (error) {\n    await rm(staging, { recursive: true, force: true })\n    await rm(destination, { recursive: true, force: true })\n    throw error\n  }\n}\n\nasync function captureRepository(\n  root: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<{\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository: WorkspaceArchiveRepository\n}> {\n  const stats = await lstat(root)\n  if (!stats.isDirectory() || stats.isSymbolicLink() || (await realpath(root)) !== root) {\n    throw new Error('candidate repository root must be a real directory')\n  }\n  const topLevel = (await runCandidateGit(root, ['rev-parse', '--show-toplevel'])).stdout\n    .toString('utf8')\n    .trim()\n  if (resolve(topLevel) !== root) {\n    throw new Error('candidate repository capture must start at the Git worktree root')\n  }\n  const gitDir = resolve(\n    (await runCandidateGit(root, ['rev-parse', '--absolute-git-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(gitDir)) !== gitDir || gitDir.includes(':')) {\n    throw new Error('candidate repository Git object store has an unsupported path')\n  }\n  await assertNoGitIndirection(root, gitDir, 'candidate repository')\n  const headCommit = (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout\n    .toString('utf8')\n    .trim()\n  const headTree = (await runCandidateGit(root, ['rev-parse', 'HEAD^{tree}'])).stdout\n    .toString('utf8')\n    .trim()\n  assertGitObjectId(headCommit, 'HEAD')\n  assertGitObjectId(headTree, 'HEAD tree')\n  if (headCommit.length !== headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  const files = await readCandidateGitTreeFiles(root, headTree, {}, limits)\n  assertWorkspaceFilesWithinLimits(files, limits)\n  const reachableBytesText = (\n    await runCandidateGit(root, ['rev-list', '--disk-usage', '--objects', 'HEAD'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  const reachableBytes = Number(reachableBytesText)\n  if (!Number.isSafeInteger(reachableBytes) || reachableBytes < 0) {\n    throw new Error('candidate repository reachable size is invalid')\n  }\n  if (reachableBytes > limits.maxRepositoryBundleBytes) {\n    throw new Error('candidate repository exceeds maxRepositoryBundleBytes')\n  }\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    await runCandidateGit(root, ['bundle', 'create', bundlePath, 'HEAD'])\n    const bundle = Uint8Array.from(await readFile(bundlePath))\n    if (bundle.byteLength > limits.maxRepositoryBundleBytes) {\n      throw new Error('candidate repository bundle exceeds maxRepositoryBundleBytes')\n    }\n    return {\n      files,\n      repository: {\n        headCommit,\n        headTree,\n        bundle: {\n          sha256: sha256Bytes(bundle),\n          byteLength: bundle.byteLength,\n          bytes: bundle,\n        },\n      },\n    }\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nasync function encodeWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  maxArchiveBytes: number,\n): Promise<Uint8Array> {\n  const archive = pack()\n  const output = collectStream(archive, maxArchiveBytes, 'candidate workspace archive')\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    return await output\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await output.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function verifyCanonicalWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  expected: Uint8Array,\n  maxArchiveBytes: number,\n): Promise<void> {\n  const archive = pack()\n  const comparison = streamEqualsBytes(\n    archive,\n    expected,\n    maxArchiveBytes,\n    'candidate workspace archive',\n  )\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    if (!(await comparison)) throw new Error('candidate workspace tar is not canonical')\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await comparison.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function writeWorkspaceArchiveEntries(\n  archive: Pack,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n): Promise<void> {\n  for (const file of files) {\n    await writeTarEntry(archive, `${workspaceEntryPrefix}${file.path}`, file.mode, file.bytes)\n  }\n  if (!repository) return\n  const metadata = canonicalCandidateBytes({\n    kind: archiveKind,\n    headCommit: repository.headCommit,\n    headTree: repository.headTree,\n    bundle: {\n      sha256: repository.bundle.sha256,\n      byteLength: repository.bundle.byteLength,\n    },\n  } satisfies WorkspaceArchiveRepositoryMetadata)\n  await writeTarEntry(archive, repositoryMetadataEntry, 0o600, metadata)\n  await writeTarEntry(archive, repositoryBundleEntry, 0o600, repository.bundle.bytes)\n}\n\nasync function parseWorkspaceArchive(\n  bytes: Uint8Array,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<DecodedWorkspaceArchive> {\n  if (bytes.byteLength > limits.maxArchiveBytes) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n  }\n  const parser = extract()\n  const files: DecodedWorkspaceArchive['files'] = []\n  const observedEntryNames = new Set<string>()\n  const observedPaths = new Set<string>()\n  let totalBytes = 0\n  let retainedEntryBytes = 0\n  let previousPath: string | undefined\n  let repositoryMetadata: WorkspaceArchiveRepositoryMetadata | undefined\n  let repositoryBundle: Uint8Array | undefined\n  const decoded = (async () => {\n    for await (const entry of parser) {\n      const name = entry.header.name\n      if (\n        entry.header.type !== 'file' ||\n        typeof name !== 'string' ||\n        observedEntryNames.has(name)\n      ) {\n        throw new Error('candidate workspace tar contains an invalid entry')\n      }\n      observedEntryNames.add(name)\n      if (name.startsWith(workspaceEntryPrefix)) {\n        if (files.length >= limits.maxFiles) {\n          throw new Error('candidate workspace archive has an invalid file count')\n        }\n        const path = safeArchivePath(name.slice(workspaceEntryPrefix.length), limits.maxPathBytes)\n        if (!isWorkspaceFileMode(entry.header.mode)) {\n          throw new Error(`candidate workspace archive has an unsupported mode: ${path}`)\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const fileBytes = await readTarEntry(entry, limits.maxFileBytes, `workspace file ${path}`)\n        retainedEntryBytes += fileBytes.byteLength\n        assertWorkspacePathOrder(\n          path,\n          previousPath,\n          observedPaths,\n          'candidate workspace archive paths must be unique and sorted',\n        )\n        previousPath = path\n        if (fileBytes.byteLength > limits.maxTotalFileBytes - totalBytes) {\n          throw new Error('candidate workspace archive exceeds maxTotalFileBytes')\n        }\n        totalBytes += fileBytes.byteLength\n        files.push({ path, mode: entry.header.mode, bytes: fileBytes })\n      } else if (name === repositoryMetadataEntry) {\n        if (entry.header.mode !== 0o600 || repositoryMetadata) {\n          throw new Error('candidate workspace archive repository metadata is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const metadataBytes = await readTarEntry(\n          entry,\n          limits.maxPathBytes,\n          'candidate repository metadata',\n        )\n        retainedEntryBytes += metadataBytes.byteLength\n        repositoryMetadata = parseRepositoryMetadata(metadataBytes, limits.maxRepositoryBundleBytes)\n      } else if (name === repositoryBundleEntry) {\n        if (entry.header.mode !== 0o600 || repositoryBundle) {\n          throw new Error('candidate workspace archive repository bundle is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        repositoryBundle = await readTarEntry(\n          entry,\n          limits.maxRepositoryBundleBytes,\n          'candidate Git bundle',\n        )\n        retainedEntryBytes += repositoryBundle.byteLength\n      } else {\n        throw new Error(`candidate workspace tar contains an unsupported entry: ${name}`)\n      }\n    }\n    if (Boolean(repositoryMetadata) !== Boolean(repositoryBundle)) {\n      throw new Error('candidate workspace archive repository evidence is incomplete')\n    }\n    const repository =\n      repositoryMetadata && repositoryBundle\n        ? repositoryFromTar(repositoryMetadata, repositoryBundle)\n        : undefined\n    return { files, ...(repository ? { repository } : {}) }\n  })()\n  parser.end(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength))\n  const result = await decoded\n  await verifyCanonicalWorkspaceArchive(\n    result.files,\n    result.repository,\n    bytes,\n    limits.maxArchiveBytes,\n  )\n  return result\n}\n\nfunction assertRetainedArchiveSize(\n  archiveBytes: number,\n  retainedEntryBytes: number,\n  entryBytes: number | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (\n    !Number.isSafeInteger(entryBytes) ||\n    entryBytes === undefined ||\n    entryBytes < 0 ||\n    entryBytes > limits.maxArchiveBytes - archiveBytes - retainedEntryBytes\n  ) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes while decoding')\n  }\n}\n\nfunction parseRepositoryMetadata(\n  bytes: Uint8Array,\n  maxBundleBytes: number,\n): WorkspaceArchiveRepositoryMetadata {\n  let value: unknown\n  try {\n    value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes))\n  } catch (error) {\n    throw new Error('candidate workspace archive repository metadata is invalid', { cause: error })\n  }\n  if (\n    !isRecord(value) ||\n    Object.keys(value).sort().join(',') !== 'bundle,headCommit,headTree,kind' ||\n    value.kind !== archiveKind ||\n    typeof value.headCommit !== 'string' ||\n    typeof value.headTree !== 'string' ||\n    !isRecord(value.bundle) ||\n    Object.keys(value.bundle).sort().join(',') !== 'byteLength,sha256' ||\n    typeof value.bundle.sha256 !== 'string' ||\n    !/^sha256:[a-f0-9]{64}$/.test(value.bundle.sha256) ||\n    !Number.isSafeInteger(value.bundle.byteLength) ||\n    (value.bundle.byteLength as number) <= 0 ||\n    (value.bundle.byteLength as number) > maxBundleBytes\n  ) {\n    throw new Error('candidate workspace archive repository is invalid')\n  }\n  if (!Buffer.from(canonicalCandidateBytes(value)).equals(Buffer.from(bytes))) {\n    throw new Error('candidate workspace archive repository metadata is not canonical')\n  }\n  assertGitObjectId(value.headCommit, 'repository HEAD')\n  assertGitObjectId(value.headTree, 'repository HEAD tree')\n  if (value.headCommit.length !== value.headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  return {\n    kind: archiveKind,\n    headCommit: value.headCommit,\n    headTree: value.headTree,\n    bundle: {\n      sha256: value.bundle.sha256 as `sha256:${string}`,\n      byteLength: value.bundle.byteLength as number,\n    },\n  }\n}\n\nfunction repositoryFromTar(\n  metadata: WorkspaceArchiveRepositoryMetadata,\n  bundle: Uint8Array,\n): WorkspaceArchiveRepository {\n  verifyBytes(bundle, metadata.bundle.sha256, metadata.bundle.byteLength, 'candidate Git bundle')\n  return {\n    headCommit: metadata.headCommit,\n    headTree: metadata.headTree,\n    bundle: { ...metadata.bundle, bytes: bundle },\n  }\n}\n\nasync function writeTarEntry(\n  archive: Pack,\n  name: string,\n  mode: number,\n  bytes: Uint8Array,\n): Promise<void> {\n  await new Promise<void>((resolveEntry, rejectEntry) => {\n    archive.entry(\n      {\n        name,\n        mode,\n        uid: 0,\n        gid: 0,\n        size: bytes.byteLength,\n        mtime: fixedTarTime,\n        type: 'file',\n        uname: '',\n        gname: '',\n      },\n      Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength),\n      (error) => (error ? rejectEntry(error) : resolveEntry()),\n    )\n  })\n}\n\nasync function readTarEntry(entry: Entry, maxBytes: number, label: string): Promise<Uint8Array> {\n  const size = entry.header.size\n  if (!Number.isSafeInteger(size) || size === undefined || size < 0 || size > maxBytes) {\n    throw new Error(`${label} has an invalid tar size`)\n  }\n  const bytes = await collectStream(entry, maxBytes, label)\n  if (bytes.byteLength !== size) throw new Error(`${label} differs from its tar size`)\n  return bytes\n}\n\nasync function collectStream(\n  stream: AsyncIterable<Uint8Array>,\n  maxBytes: number,\n  label: string,\n): Promise<Uint8Array> {\n  const chunks: Buffer[] = []\n  let totalBytes = 0\n  for await (const chunk of stream) {\n    if (chunk.byteLength > maxBytes - totalBytes) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)\n    chunks.push(bytes)\n    totalBytes += bytes.byteLength\n  }\n  return Buffer.concat(chunks, totalBytes)\n}\n\nasync function streamEqualsBytes(\n  stream: AsyncIterable<Uint8Array>,\n  expected: Uint8Array,\n  maxBytes: number,\n  label: string,\n): Promise<boolean> {\n  const expectedBuffer = Buffer.from(expected.buffer, expected.byteOffset, expected.byteLength)\n  let equal = true\n  let offset = 0\n  for await (const chunk of stream) {\n    if (chunk.byteLength > maxBytes - offset) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const observed = Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength)\n    if (\n      offset + observed.byteLength > expectedBuffer.byteLength ||\n      !observed.equals(expectedBuffer.subarray(offset, offset + observed.byteLength))\n    ) {\n      equal = false\n    }\n    offset += observed.byteLength\n  }\n  return equal && offset === expectedBuffer.byteLength\n}\n\nasync function prepareEmptyDestination(destination: string): Promise<void> {\n  await mkdir(destination, { recursive: true, mode: 0o700 })\n  const stats = await lstat(destination)\n  if (\n    !stats.isDirectory() ||\n    stats.isSymbolicLink() ||\n    (await realpath(destination)) !== destination\n  ) {\n    throw new Error('candidate workspace destination must be a real directory')\n  }\n  if ((await readdir(destination)).length > 0) {\n    throw new Error('candidate workspace destination must be empty')\n  }\n}\n\nasync function writeWorkspaceFiles(\n  destination: string,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n): Promise<void> {\n  for (const file of files) {\n    const path = workspacePath(destination, file.path)\n    await mkdir(dirname(path), { recursive: true, mode: 0o700 })\n    const descriptor = await open(\n      path,\n      fsConstants.O_WRONLY |\n        fsConstants.O_CREAT |\n        fsConstants.O_EXCL |\n        (typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0),\n      0o600,\n    )\n    try {\n      await descriptor.writeFile(file.bytes)\n      const stats = await descriptor.stat()\n      if (!stats.isFile() || stats.nlink !== 1) {\n        throw new Error(`candidate workspace file identity changed while writing: ${file.path}`)\n      }\n      await descriptor.chmod(file.mode)\n    } finally {\n      await descriptor.close()\n    }\n  }\n}\n\nasync function materializeRepository(\n  repository: WorkspaceArchiveRepository,\n  destination: string,\n): Promise<void> {\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    await writeFile(bundlePath, repository.bundle.bytes, { flag: 'wx', mode: 0o600 })\n    await runCandidateGit(destination, [\n      'init',\n      '--quiet',\n      '--initial-branch=candidate',\n      `--object-format=${repository.headCommit.length === 64 ? 'sha256' : 'sha1'}`,\n    ])\n    await runCandidateGit(destination, ['bundle', 'verify', bundlePath])\n    await runCandidateGit(destination, ['bundle', 'unbundle', bundlePath])\n    const objectType = (\n      await runCandidateGit(destination, ['cat-file', '-t', repository.headCommit])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (objectType !== 'commit') throw new Error('candidate repository HEAD is not a commit')\n    const observedTree = (\n      await runCandidateGit(destination, ['rev-parse', `${repository.headCommit}^{tree}`])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (observedTree !== repository.headTree) {\n      throw new Error('candidate repository bundle HEAD tree changed')\n    }\n    await runCandidateGit(destination, ['update-ref', '--no-deref', 'HEAD', repository.headCommit])\n    await runCandidateGit(destination, ['read-tree', repository.headTree])\n    const status = (\n      await runCandidateGit(destination, ['status', '--porcelain=v1', '--untracked-files=all'])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (status) throw new Error('candidate repository files do not exactly match HEAD')\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nfunction assertArchiveMatchesSnapshot(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n): void {\n  const material = candidateWorkspaceManifest(files)\n  const materialBytes = canonicalCandidateBytes(material)\n  verifyBytes(\n    materialBytes,\n    snapshot.manifest.sha256,\n    snapshot.manifest.byteLength,\n    'candidate workspace manifest',\n  )\n  if (\n    canonicalCandidateDigest(material) !== snapshot.digest ||\n    !Buffer.from(materialBytes).equals(Buffer.from(canonicalCandidateBytes(snapshot.material)))\n  ) {\n    throw new Error('candidate workspace archive does not match its snapshot manifest')\n  }\n}\n\nfunction assertWorkspaceFilesWithinLimits(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (files.length > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  let previousPath: string | undefined\n  const observedPaths = new Set<string>()\n  for (const file of files) {\n    const path = safeArchivePath(file.path, limits.maxPathBytes)\n    assertWorkspacePathOrder(\n      path,\n      previousPath,\n      observedPaths,\n      'candidate workspace paths must be unique and sorted',\n    )\n    previousPath = path\n    if (!isWorkspaceFileMode(file.mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    if (file.bytes.byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    totalBytes += file.bytes.byteLength\n    if (totalBytes > limits.maxTotalFileBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n  }\n}\n\nfunction normalizeWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): AgentCandidateExecutorWorkspaceFile[] {\n  if (!Array.isArray(input)) {\n    throw new Error('candidate workspace files must be an array')\n  }\n  const fileCount = input.length\n  if (fileCount > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  const files: AgentCandidateExecutorWorkspaceFile[] = []\n  for (let index = 0; index < fileCount; index++) {\n    const inputFile = input[index]\n    if (!isRecord(inputFile) || Object.keys(inputFile).sort().join(',') !== 'bytes,mode,path') {\n      throw new Error(`candidate workspace file ${index} is invalid`)\n    }\n    const descriptors = Object.getOwnPropertyDescriptors(inputFile)\n    if (\n      !('value' in (descriptors.path ?? {})) ||\n      !('value' in (descriptors.mode ?? {})) ||\n      !('value' in (descriptors.bytes ?? {}))\n    ) {\n      throw new Error(`candidate workspace file ${index} must use fixed values`)\n    }\n    const path = safeArchivePath(descriptors.path?.value, limits.maxPathBytes)\n    const mode = descriptors.mode?.value\n    const inputBytes = descriptors.bytes?.value\n    if (!isWorkspaceFileMode(mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    const view = inspectWorkspaceBytes(inputBytes, path)\n    if (view.byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    if (view.byteLength > limits.maxTotalFileBytes - totalBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n    if (view.byteLength > Math.max(0, limits.maxArchiveBytes - 1024)) {\n      throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n    }\n    totalBytes += view.byteLength\n    files.push({ path, mode, bytes: detachWorkspaceBytes(view) })\n  }\n  files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))\n  assertWorkspaceFilesWithinLimits(files, limits)\n  return files\n}\n\nfunction isWorkspaceFileMode(value: unknown): value is number {\n  return Number.isSafeInteger(value) && (value as number) >= 0 && (value as number) <= 0o777\n}\n\nfunction workspaceLimits(\n  overrides: Partial<AgentCandidateWorkspaceArchiveLimits> | undefined,\n): AgentCandidateWorkspaceArchiveLimits {\n  const limits = { ...defaultLimits, ...overrides }\n  for (const [name, value] of Object.entries(limits)) {\n    if (!Number.isSafeInteger(value) || value <= 0) {\n      throw new Error(`candidate workspace ${name} must be a positive safe integer`)\n    }\n  }\n  return Object.freeze(limits)\n}\n\nfunction safeArchivePath(value: unknown, maxPathBytes: number): string {\n  if (\n    typeof value !== 'string' ||\n    !value ||\n    !isWellFormedUnicode(value) ||\n    Buffer.byteLength(value, 'utf8') > maxPathBytes ||\n    isAbsolute(value) ||\n    win32.isAbsolute(value) ||\n    value.includes('\\\\') ||\n    value.includes('\\0') ||\n    hasControlCharacter(value) ||\n    value.split('/').some((part) => !part || part === '.' || part === '..') ||\n    ['.git', '.sidecar'].includes(value.split('/')[0]?.toLowerCase() ?? '')\n  ) {\n    throw new Error(`candidate workspace archive contains an unsafe path: ${String(value)}`)\n  }\n  return value\n}\n\nfunction assertWorkspacePathOrder(\n  path: string,\n  previousPath: string | undefined,\n  observedPaths: Set<string>,\n  errorMessage: string,\n): void {\n  if (previousPath !== undefined && previousPath >= path) throw new Error(errorMessage)\n  for (let slash = path.indexOf('/'); slash !== -1; slash = path.indexOf('/', slash + 1)) {\n    if (observedPaths.has(path.slice(0, slash))) throw new Error(errorMessage)\n  }\n  observedPaths.add(path)\n}\n\nfunction inspectWorkspaceBytes(\n  input: unknown,\n  path: string,\n): { buffer: ArrayBuffer; byteOffset: number; byteLength: number } {\n  let buffer: ArrayBufferLike\n  let byteOffset: number\n  let byteLength: number\n  try {\n    buffer = typedArrayBufferGetter.call(input as Uint8Array) as ArrayBufferLike\n    byteOffset = typedArrayByteOffsetGetter.call(input as Uint8Array) as number\n    byteLength = typedArrayByteLengthGetter.call(input as Uint8Array) as number\n  } catch {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  if (isSharedArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file uses shared bytes: ${path}`)\n  }\n  if (!isAnyArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  return { buffer, byteOffset, byteLength }\n}\n\nfunction detachWorkspaceBytes(input: {\n  buffer: ArrayBuffer\n  byteOffset: number\n  byteLength: number\n}): Uint8Array {\n  const { buffer, byteOffset, byteLength } = input\n  const copy = new Uint8Array(byteLength)\n  Uint8Array.prototype.set.call(copy, new Uint8Array(buffer, byteOffset, byteLength))\n  return copy\n}\n\nfunction isWellFormedUnicode(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1)\n      if (!(next >= 0xdc00 && next <= 0xdfff)) return false\n      index++\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      return false\n    }\n  }\n  return true\n}\n\nfunction workspacePath(root: string, relativePath: string): string {\n  const path = resolve(root, relativePath)\n  if (!path.startsWith(`${root}${sep}`)) {\n    throw new Error(`candidate workspace archive path escapes its destination: ${relativePath}`)\n  }\n  return path\n}\n\nfunction assertGitObjectId(value: string, label: string): void {\n  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value)) {\n    throw new Error(`candidate repository ${label} is not a Git object id`)\n  }\n}\n\nfunction hasControlCharacter(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code < 0x20 || code === 0x7f) return true\n  }\n  return false\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\ntype TypedArrayGetter = (this: Uint8Array) => unknown\n\nfunction requireTypedArrayGetter(name: 'buffer' | 'byteOffset' | 'byteLength'): TypedArrayGetter {\n  const typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype) as object\n  const getter = Object.getOwnPropertyDescriptor(typedArrayPrototype, name)?.get\n  if (!getter) throw new Error(`typed array intrinsic ${name} accessor is unavailable`)\n  return getter\n}\n\nconst typedArrayBufferGetter = requireTypedArrayGetter('buffer')\nconst typedArrayByteOffsetGetter = requireTypedArrayGetter('byteOffset')\nconst typedArrayByteLengthGetter = requireTypedArrayGetter('byteLength')\n"],"mappings":";;;;;;;;;;;AASA,SAAgB,yBAAyB,OAAwD;CAC/F,MAAM,SAASA,2BAAyB,KAAK;CAC7C,MAAM,SAAS,2BAA2B,MAAM;EAAE,GAAG;EAAO;CAAO,CAAC;CAEpE,IADqBA,2BAAyB,mBAAmB,MAAM,CACxD,MAAM,QACnB,MAAM,IAAI,MAAM,oEAAoE;CAEtF,OAAO,wBAAwB,MAAM;AACvC;;;ACgCA,MAAM,cAAc;AACpB,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;AAChC,MAAM,wBAAwB;AAC9B,MAAM,+BAAe,IAAI,KAAK,CAAC;AAY/B,MAAM,gBAAsD,OAAO,OAAO;CACxE,iBAAiB,MAAM,OAAO;CAC9B,0BAA0B,OAAO;CACjC,UAAU;CACV,cAAc,MAAM,OAAO;CAC3B,mBAAmB,MAAM,OAAO;CAChC,cAAc;CACd,0BAA0B,MAAM,OAAO;AACzC,CAAC;;AAkDD,eAAsB,+BACpB,WACA,UAAiD,CAAC,GACR;CAC1C,MAAM,OAAO,QAAQ,SAAS;CAC9B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,MAAM,WAAW,QAAQ,oBACrB,MAAM,kBAAkB,MAAM,MAAM,IACpC,MAAM,6BAA6B,MAAM,EACvC,QAAQ;EACN,UAAU,OAAO;EACjB,cAAc,OAAO;EACrB,mBAAmB,OAAO;CAC5B,EACF,CAAC;CACL,iCAAiC,SAAS,OAAO,MAAM;CACvD,MAAM,aAAa,gBAAgB,WAAW,SAAS,aAAa,KAAA;CACpE,OAAO,sBAAsB,SAAS,OAAO,YAAY,QAAQ,QAAQ,mBAAmB;AAC9F;;AAGA,eAAsB,oCACpB,OACA,UAA4E,CAAC,GACnC;CAC1C,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,OAAO,sBACL,wBAAwB,OAAO,MAAM,GACrC,KAAA,GACA,QACA,QAAQ,mBACV;AACF;AAEA,eAAe,sBACb,OACA,YACA,QACA,qBAC0C;CAC1C,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,WAAW,wBAAwB,QAAQ;CACjD,MAAM,UAAU,MAAM,uBAAuB,OAAO,YAAY,OAAO,eAAe;CACtF,IACE,CAAC,wBACA,SAAS,aAAa,OAAO,4BAC5B,QAAQ,aAAa,OAAO,2BAE9B,MAAM,IAAI,MACR,gGACF;CAEF,MAAM,mBAAmB,MAAM,yBAAyB,YAAY,UAAU,mBAAmB;CACjG,MAAM,kBAAkB,MAAM,yBAAyB,WAAW,SAAS,mBAAmB;CAC9F,MAAM,WAAW,oBAAoB;EACnC,MAAM;EACN,QAAQC,2BAAyB,QAAQ;EACzC;EACA,UAAU;EACV,SAAS;CACX,CAAmD;CACnD,OAAO,OAAO,OAAO;EAAE;EAAU;CAAQ,CAAC;AAC5C;AAEA,eAAe,yBACb,MACA,OACA,aACyC;CACzC,IAAI,CAAC,aAAa,OAAO,0BAA0B,KAAK;CACxD,IAAI,CAAC,YAAY,YAAY,KAAK,GAChC,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO,+BAA+B,YAAY,iBAAiB;EACjE,aAAa,YAAY;EACzB,SAAS,SAAS,aAAa,iCAAiC;EAChE;EACA,GAAI,YAAY,SAAS,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;CAC7D,CAAC;AACH;;AAGA,SAAgB,kCACd,UAAoD,CAAC,GACxB;CAC7B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAY7C,OAAO,OAAO,OAAO,EAVnB,aAAa,OAAO,EAAE,MAAM,UAAU,SAAS,kBAAkB;EAC/D,MAAM,mCAAmC;GACvC;GACA;GACA;GACA;GACA;EACF,CAAC;CACH,EAEsB,CAAC;AAC3B;AAEA,eAAe,mCAAmC,OAMhC;CAChB,YACE,MAAM,SACN,MAAM,SAAS,QAAQ,QACvB,MAAM,SAAS,QAAQ,YACvB,6BACF;CACA,MAAM,UAAU,MAAM,sBAAsB,MAAM,SAAS,MAAM,MAAM;CACvE,IAAI,QAAQ,cAAc,MAAM,SAAS,QACvC,MAAM,IAAI,MAAM,iDAAiD;CAEnE,6BAA6B,QAAQ,OAAO,MAAM,QAAQ;CAC1D,MAAM,cAAc,QAAQ,MAAM,WAAW;CAC7C,MAAM,wBAAwB,WAAW;CACzC,MAAM,UAAU,MAAM,QAAQ,GAAG,YAAY,gBAAgB;CAC7D,IAAI;EACF,MAAM,oBAAoB,SAAS,QAAQ,KAAK;EAChD,IAAI,QAAQ,YACV,MAAM,sBAAsB,QAAQ,YAAY,OAAO;EAEzD,MAAM,4BAA4B,SAAS,MAAM,SAAS,UAAU,EAClE,6BAA6B,QAAQ,aAAa,CAAC,MAAM,IAAI,CAAC,EAChE,CAAC;EACD,MAAM,OAAO,SAAS,WAAW;CACnC,SAAS,OAAO;EACd,MAAM,GAAG,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAClD,MAAM,GAAG,aAAa;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACtD,MAAM;CACR;AACF;AAEA,eAAe,kBACb,MACA,QAIC;CACD,MAAM,QAAQ,MAAM,MAAM,IAAI;CAC9B,IAAI,CAAC,MAAM,YAAY,KAAK,MAAM,eAAe,KAAM,MAAM,SAAS,IAAI,MAAO,MAC/E,MAAM,IAAI,MAAM,oDAAoD;CAKtE,IAAI,SAHc,MAAM,gBAAgB,MAAM,CAAC,aAAa,iBAAiB,CAAC,EAAA,CAAG,OAC9E,SAAS,MAAM,CAAC,CAChB,KACgB,CAAC,MAAM,MACxB,MAAM,IAAI,MAAM,kEAAkE;CAEpF,MAAM,SAAS,SACZ,MAAM,gBAAgB,MAAM,CAAC,aAAa,oBAAoB,CAAC,EAAA,CAAG,OAChE,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,MAAM,MAAO,UAAU,OAAO,SAAS,GAAG,GAC5D,MAAM,IAAI,MAAM,+DAA+D;CAEjF,MAAM,uBAAuB,MAAM,QAAQ,sBAAsB;CACjE,MAAM,cAAc,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OACrE,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,YAAY,MAAM,gBAAgB,MAAM,CAAC,aAAa,aAAa,CAAC,EAAA,CAAG,OAC1E,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,kBAAkB,YAAY,MAAM;CACpC,kBAAkB,UAAU,WAAW;CACvC,IAAI,WAAW,WAAW,SAAS,QACjC,MAAM,IAAI,MAAM,iEAAiE;CAEnF,MAAM,QAAQ,MAAM,0BAA0B,MAAM,UAAU,CAAC,GAAG,MAAM;CACxE,iCAAiC,OAAO,MAAM;CAC9C,MAAM,sBACJ,MAAM,gBAAgB,MAAM;EAAC;EAAY;EAAgB;EAAa;CAAM,CAAC,EAAA,CAC7E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,iBAAiB,OAAO,kBAAkB;CAChD,IAAI,CAAC,OAAO,cAAc,cAAc,KAAK,iBAAiB,GAC5D,MAAM,IAAI,MAAM,gDAAgD;CAElE,IAAI,iBAAiB,OAAO,0BAC1B,MAAM,IAAI,MAAM,uDAAuD;CAEzE,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,MAAM,gBAAgB,MAAM;GAAC;GAAU;GAAU;GAAY;EAAM,CAAC;EACpE,MAAM,SAAS,WAAW,KAAK,MAAM,SAAS,UAAU,CAAC;EACzD,IAAI,OAAO,aAAa,OAAO,0BAC7B,MAAM,IAAI,MAAM,8DAA8D;EAEhF,OAAO;GACL;GACA,YAAY;IACV;IACA;IACA,QAAQ;KACN,QAAQ,YAAY,MAAM;KAC1B,YAAY,OAAO;KACnB,OAAO;IACT;GACF;EACF;CACF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAe,uBACb,OACA,YACA,iBACqB;CACrB,MAAM,UAAU,KAAK;CACrB,MAAM,SAAS,cAAc,SAAS,iBAAiB,6BAA6B;CACpF,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,OAAO,MAAM;CACf,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,OAAO,YAAY,KAAA,CAAS;EAClC,MAAM;CACR;AACF;AAEA,eAAe,gCACb,OACA,YACA,UACA,iBACe;CACf,MAAM,UAAU,KAAK;CACrB,MAAM,aAAa,kBACjB,SACA,UACA,iBACA,6BACF;CACA,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,IAAI,CAAE,MAAM,YAAa,MAAM,IAAI,MAAM,0CAA0C;CACrF,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,WAAW,YAAY,KAAA,CAAS;EACtC,MAAM;CACR;AACF;AAEA,eAAe,6BACb,SACA,OACA,YACe;CACf,KAAK,MAAM,QAAQ,OACjB,MAAM,cAAc,SAAS,GAAG,uBAAuB,KAAK,QAAQ,KAAK,MAAM,KAAK,KAAK;CAE3F,IAAI,CAAC,YAAY;CACjB,MAAM,WAAW,wBAAwB;EACvC,MAAM;EACN,YAAY,WAAW;EACvB,UAAU,WAAW;EACrB,QAAQ;GACN,QAAQ,WAAW,OAAO;GAC1B,YAAY,WAAW,OAAO;EAChC;CACF,CAA8C;CAC9C,MAAM,cAAc,SAAS,yBAAyB,KAAO,QAAQ;CACrE,MAAM,cAAc,SAAS,uBAAuB,KAAO,WAAW,OAAO,KAAK;AACpF;AAEA,eAAe,sBACb,OACA,QACkC;CAClC,IAAI,MAAM,aAAa,OAAO,iBAC5B,MAAM,IAAI,MAAM,qDAAqD;CAEvE,MAAM,SAAS,QAAQ;CACvB,MAAM,QAA0C,CAAC;CACjD,MAAM,qCAAqB,IAAI,IAAY;CAC3C,MAAM,gCAAgB,IAAI,IAAY;CACtC,IAAI,aAAa;CACjB,IAAI,qBAAqB;CACzB,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,WAAW,YAAY;EAC3B,WAAW,MAAM,SAAS,QAAQ;GAChC,MAAM,OAAO,MAAM,OAAO;GAC1B,IACE,MAAM,OAAO,SAAS,UACtB,OAAO,SAAS,YAChB,mBAAmB,IAAI,IAAI,GAE3B,MAAM,IAAI,MAAM,mDAAmD;GAErE,mBAAmB,IAAI,IAAI;GAC3B,IAAI,KAAK,WAAW,oBAAoB,GAAG;IACzC,IAAI,MAAM,UAAU,OAAO,UACzB,MAAM,IAAI,MAAM,uDAAuD;IAEzE,MAAM,OAAO,gBAAgB,KAAK,MAAM,EAA2B,GAAG,OAAO,YAAY;IACzF,IAAI,CAAC,oBAAoB,MAAM,OAAO,IAAI,GACxC,MAAM,IAAI,MAAM,wDAAwD,MAAM;IAEhF,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,YAAY,MAAM,aAAa,OAAO,OAAO,cAAc,kBAAkB,MAAM;IACzF,sBAAsB,UAAU;IAChC,yBACE,MACA,cACA,eACA,6DACF;IACA,eAAe;IACf,IAAI,UAAU,aAAa,OAAO,oBAAoB,YACpD,MAAM,IAAI,MAAM,uDAAuD;IAEzE,cAAc,UAAU;IACxB,MAAM,KAAK;KAAE;KAAM,MAAM,MAAM,OAAO;KAAM,OAAO;IAAU,CAAC;GAChE,OAAO,IAAI,SAAS,yBAAyB;IAC3C,IAAI,MAAM,OAAO,SAAS,OAAS,oBACjC,MAAM,IAAI,MAAM,4DAA4D;IAE9E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,gBAAgB,MAAM,aAC1B,OACA,OAAO,cACP,+BACF;IACA,sBAAsB,cAAc;IACpC,qBAAqB,wBAAwB,eAAe,OAAO,wBAAwB;GAC7F,OAAO,IAAI,SAAS,uBAAuB;IACzC,IAAI,MAAM,OAAO,SAAS,OAAS,kBACjC,MAAM,IAAI,MAAM,0DAA0D;IAE5E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,mBAAmB,MAAM,aACvB,OACA,OAAO,0BACP,sBACF;IACA,sBAAsB,iBAAiB;GACzC,OACE,MAAM,IAAI,MAAM,0DAA0D,MAAM;EAEpF;EACA,IAAI,QAAQ,kBAAkB,MAAM,QAAQ,gBAAgB,GAC1D,MAAM,IAAI,MAAM,+DAA+D;EAEjF,MAAM,aACJ,sBAAsB,mBAClB,kBAAkB,oBAAoB,gBAAgB,IACtD,KAAA;EACN,OAAO;GAAE;GAAO,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EAAG;CACxD,EAAA,CAAG;CACH,OAAO,IAAI,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,CAAC;CACxE,MAAM,SAAS,MAAM;CACrB,MAAM,gCACJ,OAAO,OACP,OAAO,YACP,OACA,OAAO,eACT;CACA,OAAO;AACT;AAEA,SAAS,0BACP,cACA,oBACA,YACA,QACM;CACN,IACE,CAAC,OAAO,cAAc,UAAU,KAChC,eAAe,KAAA,KACf,aAAa,KACb,aAAa,OAAO,kBAAkB,eAAe,oBAErD,MAAM,IAAI,MAAM,oEAAoE;AAExF;AAEA,SAAS,wBACP,OACA,gBACoC;CACpC,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC5E,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,8DAA8D,EAAE,OAAO,MAAM,CAAC;CAChG;CACA,IACE,CAAC,SAAS,KAAK,KACf,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,qCACxC,MAAM,SAAS,eACf,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,aAAa,YAC1B,CAAC,SAAS,MAAM,MAAM,KACtB,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,uBAC/C,OAAO,MAAM,OAAO,WAAW,YAC/B,CAAC,wBAAwB,KAAK,MAAM,OAAO,MAAM,KACjD,CAAC,OAAO,cAAc,MAAM,OAAO,UAAU,KAC5C,MAAM,OAAO,cAAyB,KACtC,MAAM,OAAO,aAAwB,gBAEtC,MAAM,IAAI,MAAM,mDAAmD;CAErE,IAAI,CAAC,OAAO,KAAK,wBAAwB,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,KAAK,KAAK,CAAC,GACxE,MAAM,IAAI,MAAM,kEAAkE;CAEpF,kBAAkB,MAAM,YAAY,iBAAiB;CACrD,kBAAkB,MAAM,UAAU,sBAAsB;CACxD,IAAI,MAAM,WAAW,WAAW,MAAM,SAAS,QAC7C,MAAM,IAAI,MAAM,iEAAiE;CAEnF,OAAO;EACL,MAAM;EACN,YAAY,MAAM;EAClB,UAAU,MAAM;EAChB,QAAQ;GACN,QAAQ,MAAM,OAAO;GACrB,YAAY,MAAM,OAAO;EAC3B;CACF;AACF;AAEA,SAAS,kBACP,UACA,QAC4B;CAC5B,YAAY,QAAQ,SAAS,OAAO,QAAQ,SAAS,OAAO,YAAY,sBAAsB;CAC9F,OAAO;EACL,YAAY,SAAS;EACrB,UAAU,SAAS;EACnB,QAAQ;GAAE,GAAG,SAAS;GAAQ,OAAO;EAAO;CAC9C;AACF;AAEA,eAAe,cACb,SACA,MACA,MACA,OACe;CACf,MAAM,IAAI,SAAe,cAAc,gBAAgB;EACrD,QAAQ,MACN;GACE;GACA;GACA,KAAK;GACL,KAAK;GACL,MAAM,MAAM;GACZ,OAAO;GACP,MAAM;GACN,OAAO;GACP,OAAO;EACT,GACA,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,IAC3D,UAAW,QAAQ,YAAY,KAAK,IAAI,aAAa,CACxD;CACF,CAAC;AACH;AAEA,eAAe,aAAa,OAAc,UAAkB,OAAoC;CAC9F,MAAM,OAAO,MAAM,OAAO;CAC1B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,SAAS,KAAA,KAAa,OAAO,KAAK,OAAO,UAC1E,MAAM,IAAI,MAAM,GAAG,MAAM,yBAAyB;CAEpD,MAAM,QAAQ,MAAM,cAAc,OAAO,UAAU,KAAK;CACxD,IAAI,MAAM,eAAe,MAAM,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CACnF,OAAO;AACT;AAEA,eAAe,cACb,QACA,UACA,OACqB;CACrB,MAAM,SAAmB,CAAC;CAC1B,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,MAAM,aAAa,WAAW,YAAY;GAC5C,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,QAAQ,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;EAChE,OAAO,KAAK,KAAK;EACjB,cAAc,MAAM;CACtB;CACA,OAAO,OAAO,OAAO,QAAQ,UAAU;AACzC;AAEA,eAAe,kBACb,QACA,UACA,UACA,OACkB;CAClB,MAAM,iBAAiB,OAAO,KAAK,SAAS,QAAQ,SAAS,YAAY,SAAS,UAAU;CAC5F,IAAI,QAAQ;CACZ,IAAI,SAAS;CACb,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,MAAM,aAAa,WAAW,QAAQ;GACxC,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,WAAW,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU;EAC7E,IACE,SAAS,SAAS,aAAa,eAAe,cAC9C,CAAC,SAAS,OAAO,eAAe,SAAS,QAAQ,SAAS,SAAS,UAAU,CAAC,GAE9E,QAAQ;EAEV,UAAU,SAAS;CACrB;CACA,OAAO,SAAS,WAAW,eAAe;AAC5C;AAEA,eAAe,wBAAwB,aAAoC;CACzE,MAAM,MAAM,aAAa;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACzD,MAAM,QAAQ,MAAM,MAAM,WAAW;CACrC,IACE,CAAC,MAAM,YAAY,KACnB,MAAM,eAAe,KACpB,MAAM,SAAS,WAAW,MAAO,aAElC,MAAM,IAAI,MAAM,0DAA0D;CAE5E,KAAK,MAAM,QAAQ,WAAW,EAAA,CAAG,SAAS,GACxC,MAAM,IAAI,MAAM,+CAA+C;AAEnE;AAEA,eAAe,oBACb,aACA,OACe;CACf,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,cAAc,aAAa,KAAK,IAAI;EACjD,MAAM,MAAM,QAAQ,IAAI,GAAG;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC3D,MAAM,aAAa,MAAM,KACvB,MACAC,UAAY,WACVA,UAAY,UACZA,UAAY,UACX,OAAOA,UAAY,eAAe,WAAWA,UAAY,aAAa,IACzE,GACF;EACA,IAAI;GACF,MAAM,WAAW,UAAU,KAAK,KAAK;GACrC,MAAM,QAAQ,MAAM,WAAW,KAAK;GACpC,IAAI,CAAC,MAAM,OAAO,KAAK,MAAM,UAAU,GACrC,MAAM,IAAI,MAAM,4DAA4D,KAAK,MAAM;GAEzF,MAAM,WAAW,MAAM,KAAK,IAAI;EAClC,UAAU;GACR,MAAM,WAAW,MAAM;EACzB;CACF;AACF;AAEA,eAAe,sBACb,YACA,aACe;CACf,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,MAAM,UAAU,YAAY,WAAW,OAAO,OAAO;GAAE,MAAM;GAAM,MAAM;EAAM,CAAC;EAChF,MAAM,gBAAgB,aAAa;GACjC;GACA;GACA;GACA,mBAAmB,WAAW,WAAW,WAAW,KAAK,WAAW;EACtE,CAAC;EACD,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAU;EAAU,CAAC;EACnE,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAY;EAAU,CAAC;EAMrE,KAJE,MAAM,gBAAgB,aAAa;GAAC;GAAY;GAAM,WAAW;EAAU,CAAC,EAAA,CAC5E,OACC,SAAS,MAAM,CAAC,CAChB,KACU,MAAM,UAAU,MAAM,IAAI,MAAM,2CAA2C;EAMxF,KAJE,MAAM,gBAAgB,aAAa,CAAC,aAAa,GAAG,WAAW,WAAW,QAAQ,CAAC,EAAA,CACnF,OACC,SAAS,MAAM,CAAC,CAChB,KACY,MAAM,WAAW,UAC9B,MAAM,IAAI,MAAM,+CAA+C;EAEjE,MAAM,gBAAgB,aAAa;GAAC;GAAc;GAAc;GAAQ,WAAW;EAAU,CAAC;EAC9F,MAAM,gBAAgB,aAAa,CAAC,aAAa,WAAW,QAAQ,CAAC;EAMrE,KAJE,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAkB;EAAuB,CAAC,EAAA,CACxF,OACC,SAAS,MAAM,CAAC,CAChB,KACM,GAAG,MAAM,IAAI,MAAM,sDAAsD;CACpF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,SAAS,6BACP,OACA,UACM;CACN,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,gBAAgB,wBAAwB,QAAQ;CACtD,YACE,eACA,SAAS,SAAS,QAClB,SAAS,SAAS,YAClB,8BACF;CACA,IACED,2BAAyB,QAAQ,MAAM,SAAS,UAChD,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,OAAO,OAAO,KAAK,wBAAwB,SAAS,QAAQ,CAAC,CAAC,GAE1F,MAAM,IAAI,MAAM,kEAAkE;AAEtF;AAEA,SAAS,iCACP,OACA,QACM;CACN,IAAI,MAAM,SAAS,OAAO,UACxB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,IAAI;CACJ,MAAM,gCAAgB,IAAI,IAAY;CACtC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,gBAAgB,KAAK,MAAM,OAAO,YAAY;EAC3D,yBACE,MACA,cACA,eACA,qDACF;EACA,eAAe;EACf,IAAI,CAAC,oBAAoB,KAAK,IAAI,GAChC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,KAAK,MAAM,aAAa,OAAO,cACjC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,cAAc,KAAK,MAAM;EACzB,IAAI,aAAa,OAAO,mBACtB,MAAM,IAAI,MAAM,+CAA+C;CAEnE;AACF;AAEA,SAAS,wBACP,OACA,QACuC;CACvC,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,MAAM,4CAA4C;CAE9D,MAAM,YAAY,MAAM;CACxB,IAAI,YAAY,OAAO,UACrB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,MAAM,QAA+C,CAAC;CACtD,KAAK,IAAI,QAAQ,GAAG,QAAQ,WAAW,SAAS;EAC9C,MAAM,YAAY,MAAM;EACxB,IAAI,CAAC,SAAS,SAAS,KAAK,OAAO,KAAK,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,mBACtE,MAAM,IAAI,MAAM,4BAA4B,MAAM,YAAY;EAEhE,MAAM,cAAc,OAAO,0BAA0B,SAAS;EAC9D,IACE,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,SAAS,CAAC,KAEpC,MAAM,IAAI,MAAM,4BAA4B,MAAM,uBAAuB;EAE3E,MAAM,OAAO,gBAAgB,YAAY,MAAM,OAAO,OAAO,YAAY;EACzE,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,aAAa,YAAY,OAAO;EACtC,IAAI,CAAC,oBAAoB,IAAI,GAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,MAAM,OAAO,sBAAsB,YAAY,IAAI;EACnD,IAAI,KAAK,aAAa,OAAO,cAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,KAAK,aAAa,OAAO,oBAAoB,YAC/C,MAAM,IAAI,MAAM,+CAA+C;EAEjE,IAAI,KAAK,aAAa,KAAK,IAAI,GAAG,OAAO,kBAAkB,IAAI,GAC7D,MAAM,IAAI,MAAM,qDAAqD;EAEvE,cAAc,KAAK;EACnB,MAAM,KAAK;GAAE;GAAM;GAAM,OAAO,qBAAqB,IAAI;EAAE,CAAC;CAC9D;CACA,MAAM,MAAM,MAAM,UAAW,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,CAAE;CAC1F,iCAAiC,OAAO,MAAM;CAC9C,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAiC;CAC5D,OAAO,OAAO,cAAc,KAAK,KAAM,SAAoB,KAAM,SAAoB;AACvF;AAEA,SAAS,gBACP,WACsC;CACtC,MAAM,SAAS;EAAE,GAAG;EAAe,GAAG;CAAU;CAChD,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAC/C,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAC3C,MAAM,IAAI,MAAM,uBAAuB,KAAK,iCAAiC;CAGjF,OAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAS,gBAAgB,OAAgB,cAA8B;CACrE,IACE,OAAO,UAAU,YACjB,CAAC,SACD,CAAC,oBAAoB,KAAK,KAC1B,OAAO,WAAW,OAAO,MAAM,IAAI,gBACnC,WAAW,KAAK,KAChB,MAAM,WAAW,KAAK,KACtB,MAAM,SAAS,IAAI,KACnB,MAAM,SAAS,IAAI,KACnB,oBAAoB,KAAK,KACzB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,KACtE,CAAC,QAAQ,UAAU,CAAC,CAAC,SAAS,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,YAAY,KAAK,EAAE,GAEtE,MAAM,IAAI,MAAM,wDAAwD,OAAO,KAAK,GAAG;CAEzF,OAAO;AACT;AAEA,SAAS,yBACP,MACA,cACA,eACA,cACM;CACN,IAAI,iBAAiB,KAAA,KAAa,gBAAgB,MAAM,MAAM,IAAI,MAAM,YAAY;CACpF,KAAK,IAAI,QAAQ,KAAK,QAAQ,GAAG,GAAG,UAAU,IAAI,QAAQ,KAAK,QAAQ,KAAK,QAAQ,CAAC,GACnF,IAAI,cAAc,IAAI,KAAK,MAAM,GAAG,KAAK,CAAC,GAAG,MAAM,IAAI,MAAM,YAAY;CAE3E,cAAc,IAAI,IAAI;AACxB;AAEA,SAAS,sBACP,OACA,MACiE;CACjE,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,SAAS,uBAAuB,KAAK,KAAmB;EACxD,aAAa,2BAA2B,KAAK,KAAmB;EAChE,aAAa,2BAA2B,KAAK,KAAmB;CAClE,QAAQ;EACN,MAAM,IAAI,MAAM,+CAA+C,MAAM;CACvE;CACA,IAAI,oBAAoB,MAAM,GAC5B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,IAAI,CAAC,iBAAiB,MAAM,GAC1B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,OAAO;EAAE;EAAQ;EAAY;CAAW;AAC1C;AAEA,SAAS,qBAAqB,OAIf;CACb,MAAM,EAAE,QAAQ,YAAY,eAAe;CAC3C,MAAM,OAAO,IAAI,WAAW,UAAU;CACtC,WAAW,UAAU,IAAI,KAAK,MAAM,IAAI,WAAW,QAAQ,YAAY,UAAU,CAAC;CAClF,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,QAAQ,SAAU,QAAQ,OAAQ;GACpC,MAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;GACvC,IAAI,EAAE,QAAQ,SAAU,QAAQ,QAAS,OAAO;GAChD;EACF,OAAO,IAAI,QAAQ,SAAU,QAAQ,OACnC,OAAO;CAEX;CACA,OAAO;AACT;AAEA,SAAS,cAAc,MAAc,cAA8B;CACjE,MAAM,OAAO,QAAQ,MAAM,YAAY;CACvC,IAAI,CAAC,KAAK,WAAW,GAAG,OAAO,KAAK,GAClC,MAAM,IAAI,MAAM,6DAA6D,cAAc;CAE7F,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAe,OAAqB;CAC7D,IAAI,CAAC,kCAAkC,KAAK,KAAK,GAC/C,MAAM,IAAI,MAAM,wBAAwB,MAAM,wBAAwB;AAE1E;AAEA,SAAS,oBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,OAAO,MAAQ,SAAS,KAAM,OAAO;CAC3C;CACA,OAAO;AACT;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAIA,SAAS,wBAAwB,MAAgE;CAC/F,MAAM,sBAAsB,OAAO,eAAe,WAAW,SAAS;CACtE,MAAM,SAAS,OAAO,yBAAyB,qBAAqB,IAAI,CAAC,EAAE;CAC3E,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,yBAAyB,KAAK,yBAAyB;CACpF,OAAO;AACT;AAEA,MAAM,yBAAyB,wBAAwB,QAAQ;AAC/D,MAAM,6BAA6B,wBAAwB,YAAY;AACvE,MAAM,6BAA6B,wBAAwB,YAAY"}
+{"version":3,"file":"workspace-archive-HYlsPhfm.js","names":["canonicalCandidateDigest","canonicalCandidateDigest","fsConstants"],"sources":["../src/candidate-execution/bundle.ts","../src/candidate-execution/workspace-archive.ts"],"sourcesContent":["import type { AgentCandidateBundle } from '@tangle-network/agent-interface'\nimport { agentCandidateBundleSchema } from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateDigest, immutableCandidateValue, omitTopLevelDigest } from './digest'\n\n/** Exact candidate wire shape before the runtime computes its canonical digest. */\nexport type AgentCandidateBundleInput = Omit<AgentCandidateBundle, 'digest'>\n\n/** Validate and content-address a candidate bundle before it crosses an approval boundary. */\nexport function sealAgentCandidateBundle(input: AgentCandidateBundleInput): AgentCandidateBundle {\n  const digest = canonicalCandidateDigest(input)\n  const parsed = agentCandidateBundleSchema.parse({ ...input, digest })\n  const parsedDigest = canonicalCandidateDigest(omitTopLevelDigest(parsed))\n  if (parsedDigest !== digest) {\n    throw new Error('candidate bundle changed while validating its canonical wire shape')\n  }\n  return immutableCandidateValue(parsed)\n}\n","import { randomUUID } from 'node:crypto'\nimport { constants as fsConstants } from 'node:fs'\nimport {\n  lstat,\n  mkdir,\n  mkdtemp,\n  open,\n  readdir,\n  readFile,\n  realpath,\n  rename,\n  rm,\n  writeFile,\n} from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { dirname, isAbsolute, join, resolve, sep, win32 } from 'node:path'\nimport { isAnyArrayBuffer, isSharedArrayBuffer } from 'node:util/types'\n\nimport type {\n  AgentCandidateCapturedArtifact,\n  AgentCandidateWorkspaceSnapshotEvidence,\n} from '@tangle-network/agent-interface'\nimport { type Entry, extract, type Pack, pack } from 'tar-stream'\n\nimport {\n  candidateWorkspaceManifest,\n  captureMaterializedWorkspace,\n  verifyBytes,\n  verifyMaterializedWorkspace,\n} from './artifacts'\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  deepFreezeCandidate,\n  embeddedCandidateArtifact,\n  sha256Bytes,\n} from './digest'\nimport {\n  assertNoGitIndirection,\n  readCandidateGitTreeFiles,\n  runCandidateGit,\n} from './git-materialize'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport type {\n  AgentCandidateExecutorWorkspaceFile,\n  AgentCandidateOutputArtifactPort,\n  AgentCandidateWorkspacePort,\n} from './types'\n\nconst archiveKind = 'agent-candidate-workspace-archive' as const\nconst workspaceEntryPrefix = 'workspace/'\nconst repositoryMetadataEntry = 'metadata/repository.json'\nconst repositoryBundleEntry = 'metadata/repository.bundle'\nconst fixedTarTime = new Date(0)\n\nexport interface AgentCandidateWorkspaceArchiveLimits {\n  maxArchiveBytes: number\n  maxEmbeddedArtifactBytes: number\n  maxFiles: number\n  maxFileBytes: number\n  maxTotalFileBytes: number\n  maxPathBytes: number\n  maxRepositoryBundleBytes: number\n}\n\nconst defaultLimits: AgentCandidateWorkspaceArchiveLimits = Object.freeze({\n  maxArchiveBytes: 512 * 1024 * 1024,\n  maxEmbeddedArtifactBytes: 1024 * 1024,\n  maxFiles: 50_000,\n  maxFileBytes: 128 * 1024 * 1024,\n  maxTotalFileBytes: 256 * 1024 * 1024,\n  maxPathBytes: 4_096,\n  maxRepositoryBundleBytes: 128 * 1024 * 1024,\n})\n\ninterface WorkspaceArchiveRepository {\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n    bytes: Uint8Array\n  }\n}\n\ninterface WorkspaceArchiveRepositoryMetadata {\n  kind: typeof archiveKind\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n  }\n}\n\ninterface DecodedWorkspaceArchive {\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository?: WorkspaceArchiveRepository\n}\n\nexport interface CaptureAgentCandidateWorkspaceOptions {\n  /** Include Git HEAD so task preparation can prove its exact commit and tree. */\n  includeRepository?: boolean\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n  /** Use the evaluator-owned artifact store when manifest or archive bytes should not be embedded. */\n  artifactPersistence?: {\n    executionId: string\n    outputArtifacts: AgentCandidateOutputArtifactPort\n    signal?: AbortSignal\n  }\n}\n\nexport interface CreateAgentCandidateWorkspacePortOptions {\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n}\n\nexport interface CapturedAgentCandidateWorkspace {\n  readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  /** Caller-owned bytes accepted by createAgentCandidateWorkspacePort. */\n  readonly archive: Uint8Array\n}\n\n/** Capture one exact regular-file workspace for immutable candidate execution. */\nexport async function captureAgentCandidateWorkspace(\n  rootInput: string,\n  options: CaptureAgentCandidateWorkspaceOptions = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const root = resolve(rootInput)\n  const limits = workspaceLimits(options.limits)\n  const captured = options.includeRepository\n    ? await captureRepository(root, limits)\n    : await captureMaterializedWorkspace(root, {\n        limits: {\n          maxFiles: limits.maxFiles,\n          maxFileBytes: limits.maxFileBytes,\n          maxTotalFileBytes: limits.maxTotalFileBytes,\n        },\n      })\n  assertWorkspaceFilesWithinLimits(captured.files, limits)\n  const repository = 'repository' in captured ? captured.repository : undefined\n  return captureWorkspaceFiles(captured.files, repository, limits, options.artifactPersistence)\n}\n\n/** Capture detached files returned by a remote executor into the standard archive. */\nexport async function captureAgentCandidateWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  options: Omit<CaptureAgentCandidateWorkspaceOptions, 'includeRepository'> = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const limits = workspaceLimits(options.limits)\n  return captureWorkspaceFiles(\n    normalizeWorkspaceFiles(input, limits),\n    undefined,\n    limits,\n    options.artifactPersistence,\n  )\n}\n\nasync function captureWorkspaceFiles(\n  files: readonly AgentCandidateExecutorWorkspaceFile[],\n  repository: WorkspaceArchiveRepository | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n  artifactPersistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<CapturedAgentCandidateWorkspace> {\n  const material = candidateWorkspaceManifest(files)\n  const manifest = canonicalCandidateBytes(material)\n  const archive = await encodeWorkspaceArchive(files, repository, limits.maxArchiveBytes)\n  if (\n    !artifactPersistence &&\n    (manifest.byteLength > limits.maxEmbeddedArtifactBytes ||\n      archive.byteLength > limits.maxEmbeddedArtifactBytes)\n  ) {\n    throw new Error(\n      'candidate workspace artifacts exceed maxEmbeddedArtifactBytes; artifactPersistence is required',\n    )\n  }\n  const manifestArtifact = await captureWorkspaceArtifact('manifest', manifest, artifactPersistence)\n  const archiveArtifact = await captureWorkspaceArtifact('archive', archive, artifactPersistence)\n  const snapshot = deepFreezeCandidate({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: canonicalCandidateDigest(material),\n    material,\n    manifest: manifestArtifact,\n    archive: archiveArtifact,\n  } satisfies AgentCandidateWorkspaceSnapshotEvidence)\n  return Object.freeze({ snapshot, archive })\n}\n\nasync function captureWorkspaceArtifact(\n  kind: 'manifest' | 'archive',\n  bytes: Uint8Array,\n  persistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<AgentCandidateCapturedArtifact> {\n  if (!persistence) return embeddedCandidateArtifact(bytes)\n  if (!persistence.executionId.trim()) {\n    throw new Error('candidate workspace artifact persistence requires an executionId')\n  }\n  return persistCandidateOutputArtifact(persistence.outputArtifacts, {\n    executionId: persistence.executionId,\n    purpose: kind === 'manifest' ? 'candidate-workspace-manifest' : 'candidate-workspace-archive',\n    bytes,\n    ...(persistence.signal ? { signal: persistence.signal } : {}),\n  })\n}\n\n/** Create the standard bounded materializer for candidate execution ports. */\nexport function createAgentCandidateWorkspacePort(\n  options: CreateAgentCandidateWorkspacePortOptions = {},\n): AgentCandidateWorkspacePort {\n  const limits = workspaceLimits(options.limits)\n  const port: AgentCandidateWorkspacePort = {\n    materialize: async ({ role, snapshot, archive, destination }) => {\n      await materializeAgentCandidateWorkspace({\n        role,\n        snapshot,\n        archive,\n        destination,\n        limits,\n      })\n    },\n  }\n  return Object.freeze(port)\n}\n\nasync function materializeAgentCandidateWorkspace(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  destination: string\n  limits: AgentCandidateWorkspaceArchiveLimits\n}): Promise<void> {\n  verifyBytes(\n    input.archive,\n    input.snapshot.archive.sha256,\n    input.snapshot.archive.byteLength,\n    'candidate workspace archive',\n  )\n  const decoded = await parseWorkspaceArchive(input.archive, input.limits)\n  if (decoded.repository && input.role !== 'task') {\n    throw new Error('only task workspaces may carry a Git repository')\n  }\n  assertArchiveMatchesSnapshot(decoded.files, input.snapshot)\n  const destination = resolve(input.destination)\n  await prepareEmptyDestination(destination)\n  const staging = await mkdtemp(`${destination}.materializing-`)\n  try {\n    await writeWorkspaceFiles(staging, decoded.files)\n    if (decoded.repository) {\n      await materializeRepository(decoded.repository, staging)\n    }\n    await verifyMaterializedWorkspace(staging, input.snapshot.material, {\n      ignoredProtectedRootEntries: decoded.repository ? ['.git'] : [],\n    })\n    await rename(staging, destination)\n  } catch (error) {\n    await rm(staging, { recursive: true, force: true })\n    await rm(destination, { recursive: true, force: true })\n    throw error\n  }\n}\n\nasync function captureRepository(\n  root: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<{\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository: WorkspaceArchiveRepository\n}> {\n  const stats = await lstat(root)\n  if (!stats.isDirectory() || stats.isSymbolicLink() || (await realpath(root)) !== root) {\n    throw new Error('candidate repository root must be a real directory')\n  }\n  const topLevel = (await runCandidateGit(root, ['rev-parse', '--show-toplevel'])).stdout\n    .toString('utf8')\n    .trim()\n  if (resolve(topLevel) !== root) {\n    throw new Error('candidate repository capture must start at the Git worktree root')\n  }\n  const gitDir = resolve(\n    (await runCandidateGit(root, ['rev-parse', '--absolute-git-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(gitDir)) !== gitDir || gitDir.includes(':')) {\n    throw new Error('candidate repository Git object store has an unsupported path')\n  }\n  await assertNoGitIndirection(root, gitDir, 'candidate repository')\n  const headCommit = (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout\n    .toString('utf8')\n    .trim()\n  const headTree = (await runCandidateGit(root, ['rev-parse', 'HEAD^{tree}'])).stdout\n    .toString('utf8')\n    .trim()\n  assertGitObjectId(headCommit, 'HEAD')\n  assertGitObjectId(headTree, 'HEAD tree')\n  if (headCommit.length !== headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  const files = await readCandidateGitTreeFiles(root, headTree, {}, limits)\n  assertWorkspaceFilesWithinLimits(files, limits)\n  const reachableBytesText = (\n    await runCandidateGit(root, ['rev-list', '--disk-usage', '--objects', 'HEAD'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  const reachableBytes = Number(reachableBytesText)\n  if (!Number.isSafeInteger(reachableBytes) || reachableBytes < 0) {\n    throw new Error('candidate repository reachable size is invalid')\n  }\n  if (reachableBytes > limits.maxRepositoryBundleBytes) {\n    throw new Error('candidate repository exceeds maxRepositoryBundleBytes')\n  }\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    await runCandidateGit(root, ['bundle', 'create', bundlePath, 'HEAD'])\n    const bundle = Uint8Array.from(await readFile(bundlePath))\n    if (bundle.byteLength > limits.maxRepositoryBundleBytes) {\n      throw new Error('candidate repository bundle exceeds maxRepositoryBundleBytes')\n    }\n    return {\n      files,\n      repository: {\n        headCommit,\n        headTree,\n        bundle: {\n          sha256: sha256Bytes(bundle),\n          byteLength: bundle.byteLength,\n          bytes: bundle,\n        },\n      },\n    }\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nasync function encodeWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  maxArchiveBytes: number,\n): Promise<Uint8Array> {\n  const archive = pack()\n  const output = collectStream(archive, maxArchiveBytes, 'candidate workspace archive')\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    return await output\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await output.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function verifyCanonicalWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  expected: Uint8Array,\n  maxArchiveBytes: number,\n): Promise<void> {\n  const archive = pack()\n  const comparison = streamEqualsBytes(\n    archive,\n    expected,\n    maxArchiveBytes,\n    'candidate workspace archive',\n  )\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    if (!(await comparison)) throw new Error('candidate workspace tar is not canonical')\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await comparison.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function writeWorkspaceArchiveEntries(\n  archive: Pack,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n): Promise<void> {\n  for (const file of files) {\n    await writeTarEntry(archive, `${workspaceEntryPrefix}${file.path}`, file.mode, file.bytes)\n  }\n  if (!repository) return\n  const metadata = canonicalCandidateBytes({\n    kind: archiveKind,\n    headCommit: repository.headCommit,\n    headTree: repository.headTree,\n    bundle: {\n      sha256: repository.bundle.sha256,\n      byteLength: repository.bundle.byteLength,\n    },\n  } satisfies WorkspaceArchiveRepositoryMetadata)\n  await writeTarEntry(archive, repositoryMetadataEntry, 0o600, metadata)\n  await writeTarEntry(archive, repositoryBundleEntry, 0o600, repository.bundle.bytes)\n}\n\nasync function parseWorkspaceArchive(\n  bytes: Uint8Array,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<DecodedWorkspaceArchive> {\n  if (bytes.byteLength > limits.maxArchiveBytes) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n  }\n  const parser = extract()\n  const files: DecodedWorkspaceArchive['files'] = []\n  const observedEntryNames = new Set<string>()\n  const observedPaths = new Set<string>()\n  let totalBytes = 0\n  let retainedEntryBytes = 0\n  let previousPath: string | undefined\n  let repositoryMetadata: WorkspaceArchiveRepositoryMetadata | undefined\n  let repositoryBundle: Uint8Array | undefined\n  const decoded = (async () => {\n    for await (const entry of parser) {\n      const name = entry.header.name\n      if (\n        entry.header.type !== 'file' ||\n        typeof name !== 'string' ||\n        observedEntryNames.has(name)\n      ) {\n        throw new Error('candidate workspace tar contains an invalid entry')\n      }\n      observedEntryNames.add(name)\n      if (name.startsWith(workspaceEntryPrefix)) {\n        if (files.length >= limits.maxFiles) {\n          throw new Error('candidate workspace archive has an invalid file count')\n        }\n        const path = safeArchivePath(name.slice(workspaceEntryPrefix.length), limits.maxPathBytes)\n        if (!isWorkspaceFileMode(entry.header.mode)) {\n          throw new Error(`candidate workspace archive has an unsupported mode: ${path}`)\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const fileBytes = await readTarEntry(entry, limits.maxFileBytes, `workspace file ${path}`)\n        retainedEntryBytes += fileBytes.byteLength\n        assertWorkspacePathOrder(\n          path,\n          previousPath,\n          observedPaths,\n          'candidate workspace archive paths must be unique and sorted',\n        )\n        previousPath = path\n        if (fileBytes.byteLength > limits.maxTotalFileBytes - totalBytes) {\n          throw new Error('candidate workspace archive exceeds maxTotalFileBytes')\n        }\n        totalBytes += fileBytes.byteLength\n        files.push({ path, mode: entry.header.mode, bytes: fileBytes })\n      } else if (name === repositoryMetadataEntry) {\n        if (entry.header.mode !== 0o600 || repositoryMetadata) {\n          throw new Error('candidate workspace archive repository metadata is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const metadataBytes = await readTarEntry(\n          entry,\n          limits.maxPathBytes,\n          'candidate repository metadata',\n        )\n        retainedEntryBytes += metadataBytes.byteLength\n        repositoryMetadata = parseRepositoryMetadata(metadataBytes, limits.maxRepositoryBundleBytes)\n      } else if (name === repositoryBundleEntry) {\n        if (entry.header.mode !== 0o600 || repositoryBundle) {\n          throw new Error('candidate workspace archive repository bundle is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        repositoryBundle = await readTarEntry(\n          entry,\n          limits.maxRepositoryBundleBytes,\n          'candidate Git bundle',\n        )\n        retainedEntryBytes += repositoryBundle.byteLength\n      } else {\n        throw new Error(`candidate workspace tar contains an unsupported entry: ${name}`)\n      }\n    }\n    if (Boolean(repositoryMetadata) !== Boolean(repositoryBundle)) {\n      throw new Error('candidate workspace archive repository evidence is incomplete')\n    }\n    const repository =\n      repositoryMetadata && repositoryBundle\n        ? repositoryFromTar(repositoryMetadata, repositoryBundle)\n        : undefined\n    return { files, ...(repository ? { repository } : {}) }\n  })()\n  parser.end(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength))\n  const result = await decoded\n  await verifyCanonicalWorkspaceArchive(\n    result.files,\n    result.repository,\n    bytes,\n    limits.maxArchiveBytes,\n  )\n  return result\n}\n\nfunction assertRetainedArchiveSize(\n  archiveBytes: number,\n  retainedEntryBytes: number,\n  entryBytes: number | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (\n    !Number.isSafeInteger(entryBytes) ||\n    entryBytes === undefined ||\n    entryBytes < 0 ||\n    entryBytes > limits.maxArchiveBytes - archiveBytes - retainedEntryBytes\n  ) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes while decoding')\n  }\n}\n\nfunction parseRepositoryMetadata(\n  bytes: Uint8Array,\n  maxBundleBytes: number,\n): WorkspaceArchiveRepositoryMetadata {\n  let value: unknown\n  try {\n    value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes))\n  } catch (error) {\n    throw new Error('candidate workspace archive repository metadata is invalid', { cause: error })\n  }\n  if (\n    !isRecord(value) ||\n    Object.keys(value).sort().join(',') !== 'bundle,headCommit,headTree,kind' ||\n    value.kind !== archiveKind ||\n    typeof value.headCommit !== 'string' ||\n    typeof value.headTree !== 'string' ||\n    !isRecord(value.bundle) ||\n    Object.keys(value.bundle).sort().join(',') !== 'byteLength,sha256' ||\n    typeof value.bundle.sha256 !== 'string' ||\n    !/^sha256:[a-f0-9]{64}$/.test(value.bundle.sha256) ||\n    !Number.isSafeInteger(value.bundle.byteLength) ||\n    (value.bundle.byteLength as number) <= 0 ||\n    (value.bundle.byteLength as number) > maxBundleBytes\n  ) {\n    throw new Error('candidate workspace archive repository is invalid')\n  }\n  if (!Buffer.from(canonicalCandidateBytes(value)).equals(Buffer.from(bytes))) {\n    throw new Error('candidate workspace archive repository metadata is not canonical')\n  }\n  assertGitObjectId(value.headCommit, 'repository HEAD')\n  assertGitObjectId(value.headTree, 'repository HEAD tree')\n  if (value.headCommit.length !== value.headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  return {\n    kind: archiveKind,\n    headCommit: value.headCommit,\n    headTree: value.headTree,\n    bundle: {\n      sha256: value.bundle.sha256 as `sha256:${string}`,\n      byteLength: value.bundle.byteLength as number,\n    },\n  }\n}\n\nfunction repositoryFromTar(\n  metadata: WorkspaceArchiveRepositoryMetadata,\n  bundle: Uint8Array,\n): WorkspaceArchiveRepository {\n  verifyBytes(bundle, metadata.bundle.sha256, metadata.bundle.byteLength, 'candidate Git bundle')\n  return {\n    headCommit: metadata.headCommit,\n    headTree: metadata.headTree,\n    bundle: { ...metadata.bundle, bytes: bundle },\n  }\n}\n\nasync function writeTarEntry(\n  archive: Pack,\n  name: string,\n  mode: number,\n  bytes: Uint8Array,\n): Promise<void> {\n  await new Promise<void>((resolveEntry, rejectEntry) => {\n    archive.entry(\n      {\n        name,\n        mode,\n        uid: 0,\n        gid: 0,\n        size: bytes.byteLength,\n        mtime: fixedTarTime,\n        type: 'file',\n        uname: '',\n        gname: '',\n      },\n      Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength),\n      (error) => (error ? rejectEntry(error) : resolveEntry()),\n    )\n  })\n}\n\nasync function readTarEntry(entry: Entry, maxBytes: number, label: string): Promise<Uint8Array> {\n  const size = entry.header.size\n  if (!Number.isSafeInteger(size) || size === undefined || size < 0 || size > maxBytes) {\n    throw new Error(`${label} has an invalid tar size`)\n  }\n  const bytes = await collectStream(entry, maxBytes, label)\n  if (bytes.byteLength !== size) throw new Error(`${label} differs from its tar size`)\n  return bytes\n}\n\nasync function collectStream(\n  stream: AsyncIterable<Uint8Array>,\n  maxBytes: number,\n  label: string,\n): Promise<Uint8Array> {\n  const chunks: Buffer[] = []\n  let totalBytes = 0\n  for await (const chunk of stream) {\n    if (chunk.byteLength > maxBytes - totalBytes) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)\n    chunks.push(bytes)\n    totalBytes += bytes.byteLength\n  }\n  return Buffer.concat(chunks, totalBytes)\n}\n\nasync function streamEqualsBytes(\n  stream: AsyncIterable<Uint8Array>,\n  expected: Uint8Array,\n  maxBytes: number,\n  label: string,\n): Promise<boolean> {\n  const expectedBuffer = Buffer.from(expected.buffer, expected.byteOffset, expected.byteLength)\n  let equal = true\n  let offset = 0\n  for await (const chunk of stream) {\n    if (chunk.byteLength > maxBytes - offset) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const observed = Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength)\n    if (\n      offset + observed.byteLength > expectedBuffer.byteLength ||\n      !observed.equals(expectedBuffer.subarray(offset, offset + observed.byteLength))\n    ) {\n      equal = false\n    }\n    offset += observed.byteLength\n  }\n  return equal && offset === expectedBuffer.byteLength\n}\n\nasync function prepareEmptyDestination(destination: string): Promise<void> {\n  await mkdir(destination, { recursive: true, mode: 0o700 })\n  const stats = await lstat(destination)\n  if (\n    !stats.isDirectory() ||\n    stats.isSymbolicLink() ||\n    (await realpath(destination)) !== destination\n  ) {\n    throw new Error('candidate workspace destination must be a real directory')\n  }\n  if ((await readdir(destination)).length > 0) {\n    throw new Error('candidate workspace destination must be empty')\n  }\n}\n\nasync function writeWorkspaceFiles(\n  destination: string,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n): Promise<void> {\n  for (const file of files) {\n    const path = workspacePath(destination, file.path)\n    await mkdir(dirname(path), { recursive: true, mode: 0o700 })\n    const descriptor = await open(\n      path,\n      fsConstants.O_WRONLY |\n        fsConstants.O_CREAT |\n        fsConstants.O_EXCL |\n        (typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0),\n      0o600,\n    )\n    try {\n      await descriptor.writeFile(file.bytes)\n      const stats = await descriptor.stat()\n      if (!stats.isFile() || stats.nlink !== 1) {\n        throw new Error(`candidate workspace file identity changed while writing: ${file.path}`)\n      }\n      await descriptor.chmod(file.mode)\n    } finally {\n      await descriptor.close()\n    }\n  }\n}\n\nasync function materializeRepository(\n  repository: WorkspaceArchiveRepository,\n  destination: string,\n): Promise<void> {\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    await writeFile(bundlePath, repository.bundle.bytes, { flag: 'wx', mode: 0o600 })\n    await runCandidateGit(destination, [\n      'init',\n      '--quiet',\n      '--initial-branch=candidate',\n      `--object-format=${repository.headCommit.length === 64 ? 'sha256' : 'sha1'}`,\n    ])\n    await runCandidateGit(destination, ['bundle', 'verify', bundlePath])\n    await runCandidateGit(destination, ['bundle', 'unbundle', bundlePath])\n    const objectType = (\n      await runCandidateGit(destination, ['cat-file', '-t', repository.headCommit])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (objectType !== 'commit') throw new Error('candidate repository HEAD is not a commit')\n    const observedTree = (\n      await runCandidateGit(destination, ['rev-parse', `${repository.headCommit}^{tree}`])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (observedTree !== repository.headTree) {\n      throw new Error('candidate repository bundle HEAD tree changed')\n    }\n    await runCandidateGit(destination, ['update-ref', '--no-deref', 'HEAD', repository.headCommit])\n    await runCandidateGit(destination, ['read-tree', repository.headTree])\n    const status = (\n      await runCandidateGit(destination, ['status', '--porcelain=v1', '--untracked-files=all'])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (status) throw new Error('candidate repository files do not exactly match HEAD')\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nfunction assertArchiveMatchesSnapshot(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n): void {\n  const material = candidateWorkspaceManifest(files)\n  const materialBytes = canonicalCandidateBytes(material)\n  verifyBytes(\n    materialBytes,\n    snapshot.manifest.sha256,\n    snapshot.manifest.byteLength,\n    'candidate workspace manifest',\n  )\n  if (\n    canonicalCandidateDigest(material) !== snapshot.digest ||\n    !Buffer.from(materialBytes).equals(Buffer.from(canonicalCandidateBytes(snapshot.material)))\n  ) {\n    throw new Error('candidate workspace archive does not match its snapshot manifest')\n  }\n}\n\nfunction assertWorkspaceFilesWithinLimits(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (files.length > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  let previousPath: string | undefined\n  const observedPaths = new Set<string>()\n  for (const file of files) {\n    const path = safeArchivePath(file.path, limits.maxPathBytes)\n    assertWorkspacePathOrder(\n      path,\n      previousPath,\n      observedPaths,\n      'candidate workspace paths must be unique and sorted',\n    )\n    previousPath = path\n    if (!isWorkspaceFileMode(file.mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    if (file.bytes.byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    totalBytes += file.bytes.byteLength\n    if (totalBytes > limits.maxTotalFileBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n  }\n}\n\nfunction normalizeWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): AgentCandidateExecutorWorkspaceFile[] {\n  if (!Array.isArray(input)) {\n    throw new Error('candidate workspace files must be an array')\n  }\n  const fileCount = input.length\n  if (fileCount > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  const files: AgentCandidateExecutorWorkspaceFile[] = []\n  for (let index = 0; index < fileCount; index++) {\n    const inputFile = input[index]\n    if (!isRecord(inputFile) || Object.keys(inputFile).sort().join(',') !== 'bytes,mode,path') {\n      throw new Error(`candidate workspace file ${index} is invalid`)\n    }\n    const descriptors = Object.getOwnPropertyDescriptors(inputFile)\n    if (\n      !('value' in (descriptors.path ?? {})) ||\n      !('value' in (descriptors.mode ?? {})) ||\n      !('value' in (descriptors.bytes ?? {}))\n    ) {\n      throw new Error(`candidate workspace file ${index} must use fixed values`)\n    }\n    const path = safeArchivePath(descriptors.path?.value, limits.maxPathBytes)\n    const mode = descriptors.mode?.value\n    const inputBytes = descriptors.bytes?.value\n    if (!isWorkspaceFileMode(mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    const view = inspectWorkspaceBytes(inputBytes, path)\n    if (view.byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    if (view.byteLength > limits.maxTotalFileBytes - totalBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n    if (view.byteLength > Math.max(0, limits.maxArchiveBytes - 1024)) {\n      throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n    }\n    totalBytes += view.byteLength\n    files.push({ path, mode, bytes: detachWorkspaceBytes(view) })\n  }\n  files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))\n  assertWorkspaceFilesWithinLimits(files, limits)\n  return files\n}\n\nfunction isWorkspaceFileMode(value: unknown): value is number {\n  return Number.isSafeInteger(value) && (value as number) >= 0 && (value as number) <= 0o777\n}\n\nfunction workspaceLimits(\n  overrides: Partial<AgentCandidateWorkspaceArchiveLimits> | undefined,\n): AgentCandidateWorkspaceArchiveLimits {\n  const limits = { ...defaultLimits, ...overrides }\n  for (const [name, value] of Object.entries(limits)) {\n    if (!Number.isSafeInteger(value) || value <= 0) {\n      throw new Error(`candidate workspace ${name} must be a positive safe integer`)\n    }\n  }\n  return Object.freeze(limits)\n}\n\nfunction safeArchivePath(value: unknown, maxPathBytes: number): string {\n  if (\n    typeof value !== 'string' ||\n    !value ||\n    !isWellFormedUnicode(value) ||\n    Buffer.byteLength(value, 'utf8') > maxPathBytes ||\n    isAbsolute(value) ||\n    win32.isAbsolute(value) ||\n    value.includes('\\\\') ||\n    value.includes('\\0') ||\n    hasControlCharacter(value) ||\n    value.split('/').some((part) => !part || part === '.' || part === '..') ||\n    ['.git', '.sidecar'].includes(value.split('/')[0]?.toLowerCase() ?? '')\n  ) {\n    throw new Error(`candidate workspace archive contains an unsafe path: ${String(value)}`)\n  }\n  return value\n}\n\nfunction assertWorkspacePathOrder(\n  path: string,\n  previousPath: string | undefined,\n  observedPaths: Set<string>,\n  errorMessage: string,\n): void {\n  if (previousPath !== undefined && previousPath >= path) throw new Error(errorMessage)\n  for (let slash = path.indexOf('/'); slash !== -1; slash = path.indexOf('/', slash + 1)) {\n    if (observedPaths.has(path.slice(0, slash))) throw new Error(errorMessage)\n  }\n  observedPaths.add(path)\n}\n\nfunction inspectWorkspaceBytes(\n  input: unknown,\n  path: string,\n): { buffer: ArrayBuffer; byteOffset: number; byteLength: number } {\n  let buffer: ArrayBufferLike\n  let byteOffset: number\n  let byteLength: number\n  try {\n    buffer = typedArrayBufferGetter.call(input as Uint8Array) as ArrayBufferLike\n    byteOffset = typedArrayByteOffsetGetter.call(input as Uint8Array) as number\n    byteLength = typedArrayByteLengthGetter.call(input as Uint8Array) as number\n  } catch {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  if (isSharedArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file uses shared bytes: ${path}`)\n  }\n  if (!isAnyArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  return { buffer, byteOffset, byteLength }\n}\n\nfunction detachWorkspaceBytes(input: {\n  buffer: ArrayBuffer\n  byteOffset: number\n  byteLength: number\n}): Uint8Array {\n  const { buffer, byteOffset, byteLength } = input\n  const copy = new Uint8Array(byteLength)\n  Uint8Array.prototype.set.call(copy, new Uint8Array(buffer, byteOffset, byteLength))\n  return copy\n}\n\nfunction isWellFormedUnicode(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1)\n      if (!(next >= 0xdc00 && next <= 0xdfff)) return false\n      index++\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      return false\n    }\n  }\n  return true\n}\n\nfunction workspacePath(root: string, relativePath: string): string {\n  const path = resolve(root, relativePath)\n  if (!path.startsWith(`${root}${sep}`)) {\n    throw new Error(`candidate workspace archive path escapes its destination: ${relativePath}`)\n  }\n  return path\n}\n\nfunction assertGitObjectId(value: string, label: string): void {\n  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value)) {\n    throw new Error(`candidate repository ${label} is not a Git object id`)\n  }\n}\n\nfunction hasControlCharacter(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code < 0x20 || code === 0x7f) return true\n  }\n  return false\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\ntype TypedArrayGetter = (this: Uint8Array) => unknown\n\nfunction requireTypedArrayGetter(name: 'buffer' | 'byteOffset' | 'byteLength'): TypedArrayGetter {\n  const typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype) as object\n  const getter = Object.getOwnPropertyDescriptor(typedArrayPrototype, name)?.get\n  if (!getter) throw new Error(`typed array intrinsic ${name} accessor is unavailable`)\n  return getter\n}\n\nconst typedArrayBufferGetter = requireTypedArrayGetter('buffer')\nconst typedArrayByteOffsetGetter = requireTypedArrayGetter('byteOffset')\nconst typedArrayByteLengthGetter = requireTypedArrayGetter('byteLength')\n"],"mappings":";;;;;;;;;;;AASA,SAAgB,yBAAyB,OAAwD;CAC/F,MAAM,SAASA,2BAAyB,KAAK;CAC7C,MAAM,SAAS,2BAA2B,MAAM;EAAE,GAAG;EAAO;CAAO,CAAC;CAEpE,IADqBA,2BAAyB,mBAAmB,MAAM,CACxD,MAAM,QACnB,MAAM,IAAI,MAAM,oEAAoE;CAEtF,OAAO,wBAAwB,MAAM;AACvC;;;ACgCA,MAAM,cAAc;AACpB,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;AAChC,MAAM,wBAAwB;AAC9B,MAAM,+BAAe,IAAI,KAAK,CAAC;AAY/B,MAAM,gBAAsD,OAAO,OAAO;CACxE,iBAAiB,MAAM,OAAO;CAC9B,0BAA0B,OAAO;CACjC,UAAU;CACV,cAAc,MAAM,OAAO;CAC3B,mBAAmB,MAAM,OAAO;CAChC,cAAc;CACd,0BAA0B,MAAM,OAAO;AACzC,CAAC;;AAkDD,eAAsB,+BACpB,WACA,UAAiD,CAAC,GACR;CAC1C,MAAM,OAAO,QAAQ,SAAS;CAC9B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,MAAM,WAAW,QAAQ,oBACrB,MAAM,kBAAkB,MAAM,MAAM,IACpC,MAAM,6BAA6B,MAAM,EACvC,QAAQ;EACN,UAAU,OAAO;EACjB,cAAc,OAAO;EACrB,mBAAmB,OAAO;CAC5B,EACF,CAAC;CACL,iCAAiC,SAAS,OAAO,MAAM;CACvD,MAAM,aAAa,gBAAgB,WAAW,SAAS,aAAa,KAAA;CACpE,OAAO,sBAAsB,SAAS,OAAO,YAAY,QAAQ,QAAQ,mBAAmB;AAC9F;;AAGA,eAAsB,oCACpB,OACA,UAA4E,CAAC,GACnC;CAC1C,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,OAAO,sBACL,wBAAwB,OAAO,MAAM,GACrC,KAAA,GACA,QACA,QAAQ,mBACV;AACF;AAEA,eAAe,sBACb,OACA,YACA,QACA,qBAC0C;CAC1C,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,WAAW,wBAAwB,QAAQ;CACjD,MAAM,UAAU,MAAM,uBAAuB,OAAO,YAAY,OAAO,eAAe;CACtF,IACE,CAAC,wBACA,SAAS,aAAa,OAAO,4BAC5B,QAAQ,aAAa,OAAO,2BAE9B,MAAM,IAAI,MACR,gGACF;CAEF,MAAM,mBAAmB,MAAM,yBAAyB,YAAY,UAAU,mBAAmB;CACjG,MAAM,kBAAkB,MAAM,yBAAyB,WAAW,SAAS,mBAAmB;CAC9F,MAAM,WAAW,oBAAoB;EACnC,MAAM;EACN,QAAQC,2BAAyB,QAAQ;EACzC;EACA,UAAU;EACV,SAAS;CACX,CAAmD;CACnD,OAAO,OAAO,OAAO;EAAE;EAAU;CAAQ,CAAC;AAC5C;AAEA,eAAe,yBACb,MACA,OACA,aACyC;CACzC,IAAI,CAAC,aAAa,OAAO,0BAA0B,KAAK;CACxD,IAAI,CAAC,YAAY,YAAY,KAAK,GAChC,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO,+BAA+B,YAAY,iBAAiB;EACjE,aAAa,YAAY;EACzB,SAAS,SAAS,aAAa,iCAAiC;EAChE;EACA,GAAI,YAAY,SAAS,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;CAC7D,CAAC;AACH;;AAGA,SAAgB,kCACd,UAAoD,CAAC,GACxB;CAC7B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAY7C,OAAO,OAAO,OAAO,EAVnB,aAAa,OAAO,EAAE,MAAM,UAAU,SAAS,kBAAkB;EAC/D,MAAM,mCAAmC;GACvC;GACA;GACA;GACA;GACA;EACF,CAAC;CACH,EAEsB,CAAC;AAC3B;AAEA,eAAe,mCAAmC,OAMhC;CAChB,YACE,MAAM,SACN,MAAM,SAAS,QAAQ,QACvB,MAAM,SAAS,QAAQ,YACvB,6BACF;CACA,MAAM,UAAU,MAAM,sBAAsB,MAAM,SAAS,MAAM,MAAM;CACvE,IAAI,QAAQ,cAAc,MAAM,SAAS,QACvC,MAAM,IAAI,MAAM,iDAAiD;CAEnE,6BAA6B,QAAQ,OAAO,MAAM,QAAQ;CAC1D,MAAM,cAAc,QAAQ,MAAM,WAAW;CAC7C,MAAM,wBAAwB,WAAW;CACzC,MAAM,UAAU,MAAM,QAAQ,GAAG,YAAY,gBAAgB;CAC7D,IAAI;EACF,MAAM,oBAAoB,SAAS,QAAQ,KAAK;EAChD,IAAI,QAAQ,YACV,MAAM,sBAAsB,QAAQ,YAAY,OAAO;EAEzD,MAAM,4BAA4B,SAAS,MAAM,SAAS,UAAU,EAClE,6BAA6B,QAAQ,aAAa,CAAC,MAAM,IAAI,CAAC,EAChE,CAAC;EACD,MAAM,OAAO,SAAS,WAAW;CACnC,SAAS,OAAO;EACd,MAAM,GAAG,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAClD,MAAM,GAAG,aAAa;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACtD,MAAM;CACR;AACF;AAEA,eAAe,kBACb,MACA,QAIC;CACD,MAAM,QAAQ,MAAM,MAAM,IAAI;CAC9B,IAAI,CAAC,MAAM,YAAY,KAAK,MAAM,eAAe,KAAM,MAAM,SAAS,IAAI,MAAO,MAC/E,MAAM,IAAI,MAAM,oDAAoD;CAKtE,IAAI,SAHc,MAAM,gBAAgB,MAAM,CAAC,aAAa,iBAAiB,CAAC,EAAA,CAAG,OAC9E,SAAS,MAAM,CAAC,CAChB,KACgB,CAAC,MAAM,MACxB,MAAM,IAAI,MAAM,kEAAkE;CAEpF,MAAM,SAAS,SACZ,MAAM,gBAAgB,MAAM,CAAC,aAAa,oBAAoB,CAAC,EAAA,CAAG,OAChE,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,MAAM,MAAO,UAAU,OAAO,SAAS,GAAG,GAC5D,MAAM,IAAI,MAAM,+DAA+D;CAEjF,MAAM,uBAAuB,MAAM,QAAQ,sBAAsB;CACjE,MAAM,cAAc,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OACrE,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,YAAY,MAAM,gBAAgB,MAAM,CAAC,aAAa,aAAa,CAAC,EAAA,CAAG,OAC1E,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,kBAAkB,YAAY,MAAM;CACpC,kBAAkB,UAAU,WAAW;CACvC,IAAI,WAAW,WAAW,SAAS,QACjC,MAAM,IAAI,MAAM,iEAAiE;CAEnF,MAAM,QAAQ,MAAM,0BAA0B,MAAM,UAAU,CAAC,GAAG,MAAM;CACxE,iCAAiC,OAAO,MAAM;CAC9C,MAAM,sBACJ,MAAM,gBAAgB,MAAM;EAAC;EAAY;EAAgB;EAAa;CAAM,CAAC,EAAA,CAC7E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,iBAAiB,OAAO,kBAAkB;CAChD,IAAI,CAAC,OAAO,cAAc,cAAc,KAAK,iBAAiB,GAC5D,MAAM,IAAI,MAAM,gDAAgD;CAElE,IAAI,iBAAiB,OAAO,0BAC1B,MAAM,IAAI,MAAM,uDAAuD;CAEzE,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,MAAM,gBAAgB,MAAM;GAAC;GAAU;GAAU;GAAY;EAAM,CAAC;EACpE,MAAM,SAAS,WAAW,KAAK,MAAM,SAAS,UAAU,CAAC;EACzD,IAAI,OAAO,aAAa,OAAO,0BAC7B,MAAM,IAAI,MAAM,8DAA8D;EAEhF,OAAO;GACL;GACA,YAAY;IACV;IACA;IACA,QAAQ;KACN,QAAQ,YAAY,MAAM;KAC1B,YAAY,OAAO;KACnB,OAAO;IACT;GACF;EACF;CACF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAe,uBACb,OACA,YACA,iBACqB;CACrB,MAAM,UAAU,KAAK;CACrB,MAAM,SAAS,cAAc,SAAS,iBAAiB,6BAA6B;CACpF,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,OAAO,MAAM;CACf,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,OAAO,YAAY,KAAA,CAAS;EAClC,MAAM;CACR;AACF;AAEA,eAAe,gCACb,OACA,YACA,UACA,iBACe;CACf,MAAM,UAAU,KAAK;CACrB,MAAM,aAAa,kBACjB,SACA,UACA,iBACA,6BACF;CACA,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,IAAI,CAAE,MAAM,YAAa,MAAM,IAAI,MAAM,0CAA0C;CACrF,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,WAAW,YAAY,KAAA,CAAS;EACtC,MAAM;CACR;AACF;AAEA,eAAe,6BACb,SACA,OACA,YACe;CACf,KAAK,MAAM,QAAQ,OACjB,MAAM,cAAc,SAAS,GAAG,uBAAuB,KAAK,QAAQ,KAAK,MAAM,KAAK,KAAK;CAE3F,IAAI,CAAC,YAAY;CACjB,MAAM,WAAW,wBAAwB;EACvC,MAAM;EACN,YAAY,WAAW;EACvB,UAAU,WAAW;EACrB,QAAQ;GACN,QAAQ,WAAW,OAAO;GAC1B,YAAY,WAAW,OAAO;EAChC;CACF,CAA8C;CAC9C,MAAM,cAAc,SAAS,yBAAyB,KAAO,QAAQ;CACrE,MAAM,cAAc,SAAS,uBAAuB,KAAO,WAAW,OAAO,KAAK;AACpF;AAEA,eAAe,sBACb,OACA,QACkC;CAClC,IAAI,MAAM,aAAa,OAAO,iBAC5B,MAAM,IAAI,MAAM,qDAAqD;CAEvE,MAAM,SAAS,QAAQ;CACvB,MAAM,QAA0C,CAAC;CACjD,MAAM,qCAAqB,IAAI,IAAY;CAC3C,MAAM,gCAAgB,IAAI,IAAY;CACtC,IAAI,aAAa;CACjB,IAAI,qBAAqB;CACzB,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,WAAW,YAAY;EAC3B,WAAW,MAAM,SAAS,QAAQ;GAChC,MAAM,OAAO,MAAM,OAAO;GAC1B,IACE,MAAM,OAAO,SAAS,UACtB,OAAO,SAAS,YAChB,mBAAmB,IAAI,IAAI,GAE3B,MAAM,IAAI,MAAM,mDAAmD;GAErE,mBAAmB,IAAI,IAAI;GAC3B,IAAI,KAAK,WAAW,oBAAoB,GAAG;IACzC,IAAI,MAAM,UAAU,OAAO,UACzB,MAAM,IAAI,MAAM,uDAAuD;IAEzE,MAAM,OAAO,gBAAgB,KAAK,MAAM,EAA2B,GAAG,OAAO,YAAY;IACzF,IAAI,CAAC,oBAAoB,MAAM,OAAO,IAAI,GACxC,MAAM,IAAI,MAAM,wDAAwD,MAAM;IAEhF,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,YAAY,MAAM,aAAa,OAAO,OAAO,cAAc,kBAAkB,MAAM;IACzF,sBAAsB,UAAU;IAChC,yBACE,MACA,cACA,eACA,6DACF;IACA,eAAe;IACf,IAAI,UAAU,aAAa,OAAO,oBAAoB,YACpD,MAAM,IAAI,MAAM,uDAAuD;IAEzE,cAAc,UAAU;IACxB,MAAM,KAAK;KAAE;KAAM,MAAM,MAAM,OAAO;KAAM,OAAO;IAAU,CAAC;GAChE,OAAO,IAAI,SAAS,yBAAyB;IAC3C,IAAI,MAAM,OAAO,SAAS,OAAS,oBACjC,MAAM,IAAI,MAAM,4DAA4D;IAE9E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,gBAAgB,MAAM,aAC1B,OACA,OAAO,cACP,+BACF;IACA,sBAAsB,cAAc;IACpC,qBAAqB,wBAAwB,eAAe,OAAO,wBAAwB;GAC7F,OAAO,IAAI,SAAS,uBAAuB;IACzC,IAAI,MAAM,OAAO,SAAS,OAAS,kBACjC,MAAM,IAAI,MAAM,0DAA0D;IAE5E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,mBAAmB,MAAM,aACvB,OACA,OAAO,0BACP,sBACF;IACA,sBAAsB,iBAAiB;GACzC,OACE,MAAM,IAAI,MAAM,0DAA0D,MAAM;EAEpF;EACA,IAAI,QAAQ,kBAAkB,MAAM,QAAQ,gBAAgB,GAC1D,MAAM,IAAI,MAAM,+DAA+D;EAEjF,MAAM,aACJ,sBAAsB,mBAClB,kBAAkB,oBAAoB,gBAAgB,IACtD,KAAA;EACN,OAAO;GAAE;GAAO,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EAAG;CACxD,EAAA,CAAG;CACH,OAAO,IAAI,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,CAAC;CACxE,MAAM,SAAS,MAAM;CACrB,MAAM,gCACJ,OAAO,OACP,OAAO,YACP,OACA,OAAO,eACT;CACA,OAAO;AACT;AAEA,SAAS,0BACP,cACA,oBACA,YACA,QACM;CACN,IACE,CAAC,OAAO,cAAc,UAAU,KAChC,eAAe,KAAA,KACf,aAAa,KACb,aAAa,OAAO,kBAAkB,eAAe,oBAErD,MAAM,IAAI,MAAM,oEAAoE;AAExF;AAEA,SAAS,wBACP,OACA,gBACoC;CACpC,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC5E,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,8DAA8D,EAAE,OAAO,MAAM,CAAC;CAChG;CACA,IACE,CAAC,SAAS,KAAK,KACf,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,qCACxC,MAAM,SAAS,eACf,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,aAAa,YAC1B,CAAC,SAAS,MAAM,MAAM,KACtB,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,uBAC/C,OAAO,MAAM,OAAO,WAAW,YAC/B,CAAC,wBAAwB,KAAK,MAAM,OAAO,MAAM,KACjD,CAAC,OAAO,cAAc,MAAM,OAAO,UAAU,KAC5C,MAAM,OAAO,cAAyB,KACtC,MAAM,OAAO,aAAwB,gBAEtC,MAAM,IAAI,MAAM,mDAAmD;CAErE,IAAI,CAAC,OAAO,KAAK,wBAAwB,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,KAAK,KAAK,CAAC,GACxE,MAAM,IAAI,MAAM,kEAAkE;CAEpF,kBAAkB,MAAM,YAAY,iBAAiB;CACrD,kBAAkB,MAAM,UAAU,sBAAsB;CACxD,IAAI,MAAM,WAAW,WAAW,MAAM,SAAS,QAC7C,MAAM,IAAI,MAAM,iEAAiE;CAEnF,OAAO;EACL,MAAM;EACN,YAAY,MAAM;EAClB,UAAU,MAAM;EAChB,QAAQ;GACN,QAAQ,MAAM,OAAO;GACrB,YAAY,MAAM,OAAO;EAC3B;CACF;AACF;AAEA,SAAS,kBACP,UACA,QAC4B;CAC5B,YAAY,QAAQ,SAAS,OAAO,QAAQ,SAAS,OAAO,YAAY,sBAAsB;CAC9F,OAAO;EACL,YAAY,SAAS;EACrB,UAAU,SAAS;EACnB,QAAQ;GAAE,GAAG,SAAS;GAAQ,OAAO;EAAO;CAC9C;AACF;AAEA,eAAe,cACb,SACA,MACA,MACA,OACe;CACf,MAAM,IAAI,SAAe,cAAc,gBAAgB;EACrD,QAAQ,MACN;GACE;GACA;GACA,KAAK;GACL,KAAK;GACL,MAAM,MAAM;GACZ,OAAO;GACP,MAAM;GACN,OAAO;GACP,OAAO;EACT,GACA,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,IAC3D,UAAW,QAAQ,YAAY,KAAK,IAAI,aAAa,CACxD;CACF,CAAC;AACH;AAEA,eAAe,aAAa,OAAc,UAAkB,OAAoC;CAC9F,MAAM,OAAO,MAAM,OAAO;CAC1B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,SAAS,KAAA,KAAa,OAAO,KAAK,OAAO,UAC1E,MAAM,IAAI,MAAM,GAAG,MAAM,yBAAyB;CAEpD,MAAM,QAAQ,MAAM,cAAc,OAAO,UAAU,KAAK;CACxD,IAAI,MAAM,eAAe,MAAM,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CACnF,OAAO;AACT;AAEA,eAAe,cACb,QACA,UACA,OACqB;CACrB,MAAM,SAAmB,CAAC;CAC1B,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,MAAM,aAAa,WAAW,YAAY;GAC5C,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,QAAQ,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;EAChE,OAAO,KAAK,KAAK;EACjB,cAAc,MAAM;CACtB;CACA,OAAO,OAAO,OAAO,QAAQ,UAAU;AACzC;AAEA,eAAe,kBACb,QACA,UACA,UACA,OACkB;CAClB,MAAM,iBAAiB,OAAO,KAAK,SAAS,QAAQ,SAAS,YAAY,SAAS,UAAU;CAC5F,IAAI,QAAQ;CACZ,IAAI,SAAS;CACb,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,MAAM,aAAa,WAAW,QAAQ;GACxC,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,WAAW,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU;EAC7E,IACE,SAAS,SAAS,aAAa,eAAe,cAC9C,CAAC,SAAS,OAAO,eAAe,SAAS,QAAQ,SAAS,SAAS,UAAU,CAAC,GAE9E,QAAQ;EAEV,UAAU,SAAS;CACrB;CACA,OAAO,SAAS,WAAW,eAAe;AAC5C;AAEA,eAAe,wBAAwB,aAAoC;CACzE,MAAM,MAAM,aAAa;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACzD,MAAM,QAAQ,MAAM,MAAM,WAAW;CACrC,IACE,CAAC,MAAM,YAAY,KACnB,MAAM,eAAe,KACpB,MAAM,SAAS,WAAW,MAAO,aAElC,MAAM,IAAI,MAAM,0DAA0D;CAE5E,KAAK,MAAM,QAAQ,WAAW,EAAA,CAAG,SAAS,GACxC,MAAM,IAAI,MAAM,+CAA+C;AAEnE;AAEA,eAAe,oBACb,aACA,OACe;CACf,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,cAAc,aAAa,KAAK,IAAI;EACjD,MAAM,MAAM,QAAQ,IAAI,GAAG;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC3D,MAAM,aAAa,MAAM,KACvB,MACAC,UAAY,WACVA,UAAY,UACZA,UAAY,UACX,OAAOA,UAAY,eAAe,WAAWA,UAAY,aAAa,IACzE,GACF;EACA,IAAI;GACF,MAAM,WAAW,UAAU,KAAK,KAAK;GACrC,MAAM,QAAQ,MAAM,WAAW,KAAK;GACpC,IAAI,CAAC,MAAM,OAAO,KAAK,MAAM,UAAU,GACrC,MAAM,IAAI,MAAM,4DAA4D,KAAK,MAAM;GAEzF,MAAM,WAAW,MAAM,KAAK,IAAI;EAClC,UAAU;GACR,MAAM,WAAW,MAAM;EACzB;CACF;AACF;AAEA,eAAe,sBACb,YACA,aACe;CACf,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,MAAM,UAAU,YAAY,WAAW,OAAO,OAAO;GAAE,MAAM;GAAM,MAAM;EAAM,CAAC;EAChF,MAAM,gBAAgB,aAAa;GACjC;GACA;GACA;GACA,mBAAmB,WAAW,WAAW,WAAW,KAAK,WAAW;EACtE,CAAC;EACD,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAU;EAAU,CAAC;EACnE,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAY;EAAU,CAAC;EAMrE,KAJE,MAAM,gBAAgB,aAAa;GAAC;GAAY;GAAM,WAAW;EAAU,CAAC,EAAA,CAC5E,OACC,SAAS,MAAM,CAAC,CAChB,KACU,MAAM,UAAU,MAAM,IAAI,MAAM,2CAA2C;EAMxF,KAJE,MAAM,gBAAgB,aAAa,CAAC,aAAa,GAAG,WAAW,WAAW,QAAQ,CAAC,EAAA,CACnF,OACC,SAAS,MAAM,CAAC,CAChB,KACY,MAAM,WAAW,UAC9B,MAAM,IAAI,MAAM,+CAA+C;EAEjE,MAAM,gBAAgB,aAAa;GAAC;GAAc;GAAc;GAAQ,WAAW;EAAU,CAAC;EAC9F,MAAM,gBAAgB,aAAa,CAAC,aAAa,WAAW,QAAQ,CAAC;EAMrE,KAJE,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAkB;EAAuB,CAAC,EAAA,CACxF,OACC,SAAS,MAAM,CAAC,CAChB,KACM,GAAG,MAAM,IAAI,MAAM,sDAAsD;CACpF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,SAAS,6BACP,OACA,UACM;CACN,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,gBAAgB,wBAAwB,QAAQ;CACtD,YACE,eACA,SAAS,SAAS,QAClB,SAAS,SAAS,YAClB,8BACF;CACA,IACED,2BAAyB,QAAQ,MAAM,SAAS,UAChD,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,OAAO,OAAO,KAAK,wBAAwB,SAAS,QAAQ,CAAC,CAAC,GAE1F,MAAM,IAAI,MAAM,kEAAkE;AAEtF;AAEA,SAAS,iCACP,OACA,QACM;CACN,IAAI,MAAM,SAAS,OAAO,UACxB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,IAAI;CACJ,MAAM,gCAAgB,IAAI,IAAY;CACtC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,gBAAgB,KAAK,MAAM,OAAO,YAAY;EAC3D,yBACE,MACA,cACA,eACA,qDACF;EACA,eAAe;EACf,IAAI,CAAC,oBAAoB,KAAK,IAAI,GAChC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,KAAK,MAAM,aAAa,OAAO,cACjC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,cAAc,KAAK,MAAM;EACzB,IAAI,aAAa,OAAO,mBACtB,MAAM,IAAI,MAAM,+CAA+C;CAEnE;AACF;AAEA,SAAS,wBACP,OACA,QACuC;CACvC,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,MAAM,4CAA4C;CAE9D,MAAM,YAAY,MAAM;CACxB,IAAI,YAAY,OAAO,UACrB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,MAAM,QAA+C,CAAC;CACtD,KAAK,IAAI,QAAQ,GAAG,QAAQ,WAAW,SAAS;EAC9C,MAAM,YAAY,MAAM;EACxB,IAAI,CAAC,SAAS,SAAS,KAAK,OAAO,KAAK,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,mBACtE,MAAM,IAAI,MAAM,4BAA4B,MAAM,YAAY;EAEhE,MAAM,cAAc,OAAO,0BAA0B,SAAS;EAC9D,IACE,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,SAAS,CAAC,KAEpC,MAAM,IAAI,MAAM,4BAA4B,MAAM,uBAAuB;EAE3E,MAAM,OAAO,gBAAgB,YAAY,MAAM,OAAO,OAAO,YAAY;EACzE,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,aAAa,YAAY,OAAO;EACtC,IAAI,CAAC,oBAAoB,IAAI,GAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,MAAM,OAAO,sBAAsB,YAAY,IAAI;EACnD,IAAI,KAAK,aAAa,OAAO,cAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,KAAK,aAAa,OAAO,oBAAoB,YAC/C,MAAM,IAAI,MAAM,+CAA+C;EAEjE,IAAI,KAAK,aAAa,KAAK,IAAI,GAAG,OAAO,kBAAkB,IAAI,GAC7D,MAAM,IAAI,MAAM,qDAAqD;EAEvE,cAAc,KAAK;EACnB,MAAM,KAAK;GAAE;GAAM;GAAM,OAAO,qBAAqB,IAAI;EAAE,CAAC;CAC9D;CACA,MAAM,MAAM,MAAM,UAAW,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,CAAE;CAC1F,iCAAiC,OAAO,MAAM;CAC9C,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAiC;CAC5D,OAAO,OAAO,cAAc,KAAK,KAAM,SAAoB,KAAM,SAAoB;AACvF;AAEA,SAAS,gBACP,WACsC;CACtC,MAAM,SAAS;EAAE,GAAG;EAAe,GAAG;CAAU;CAChD,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAC/C,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAC3C,MAAM,IAAI,MAAM,uBAAuB,KAAK,iCAAiC;CAGjF,OAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAS,gBAAgB,OAAgB,cAA8B;CACrE,IACE,OAAO,UAAU,YACjB,CAAC,SACD,CAAC,oBAAoB,KAAK,KAC1B,OAAO,WAAW,OAAO,MAAM,IAAI,gBACnC,WAAW,KAAK,KAChB,MAAM,WAAW,KAAK,KACtB,MAAM,SAAS,IAAI,KACnB,MAAM,SAAS,IAAI,KACnB,oBAAoB,KAAK,KACzB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,KACtE,CAAC,QAAQ,UAAU,CAAC,CAAC,SAAS,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,YAAY,KAAK,EAAE,GAEtE,MAAM,IAAI,MAAM,wDAAwD,OAAO,KAAK,GAAG;CAEzF,OAAO;AACT;AAEA,SAAS,yBACP,MACA,cACA,eACA,cACM;CACN,IAAI,iBAAiB,KAAA,KAAa,gBAAgB,MAAM,MAAM,IAAI,MAAM,YAAY;CACpF,KAAK,IAAI,QAAQ,KAAK,QAAQ,GAAG,GAAG,UAAU,IAAI,QAAQ,KAAK,QAAQ,KAAK,QAAQ,CAAC,GACnF,IAAI,cAAc,IAAI,KAAK,MAAM,GAAG,KAAK,CAAC,GAAG,MAAM,IAAI,MAAM,YAAY;CAE3E,cAAc,IAAI,IAAI;AACxB;AAEA,SAAS,sBACP,OACA,MACiE;CACjE,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,SAAS,uBAAuB,KAAK,KAAmB;EACxD,aAAa,2BAA2B,KAAK,KAAmB;EAChE,aAAa,2BAA2B,KAAK,KAAmB;CAClE,QAAQ;EACN,MAAM,IAAI,MAAM,+CAA+C,MAAM;CACvE;CACA,IAAI,oBAAoB,MAAM,GAC5B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,IAAI,CAAC,iBAAiB,MAAM,GAC1B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,OAAO;EAAE;EAAQ;EAAY;CAAW;AAC1C;AAEA,SAAS,qBAAqB,OAIf;CACb,MAAM,EAAE,QAAQ,YAAY,eAAe;CAC3C,MAAM,OAAO,IAAI,WAAW,UAAU;CACtC,WAAW,UAAU,IAAI,KAAK,MAAM,IAAI,WAAW,QAAQ,YAAY,UAAU,CAAC;CAClF,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,QAAQ,SAAU,QAAQ,OAAQ;GACpC,MAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;GACvC,IAAI,EAAE,QAAQ,SAAU,QAAQ,QAAS,OAAO;GAChD;EACF,OAAO,IAAI,QAAQ,SAAU,QAAQ,OACnC,OAAO;CAEX;CACA,OAAO;AACT;AAEA,SAAS,cAAc,MAAc,cAA8B;CACjE,MAAM,OAAO,QAAQ,MAAM,YAAY;CACvC,IAAI,CAAC,KAAK,WAAW,GAAG,OAAO,KAAK,GAClC,MAAM,IAAI,MAAM,6DAA6D,cAAc;CAE7F,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAe,OAAqB;CAC7D,IAAI,CAAC,kCAAkC,KAAK,KAAK,GAC/C,MAAM,IAAI,MAAM,wBAAwB,MAAM,wBAAwB;AAE1E;AAEA,SAAS,oBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,OAAO,MAAQ,SAAS,KAAM,OAAO;CAC3C;CACA,OAAO;AACT;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAIA,SAAS,wBAAwB,MAAgE;CAC/F,MAAM,sBAAsB,OAAO,eAAe,WAAW,SAAS;CACtE,MAAM,SAAS,OAAO,yBAAyB,qBAAqB,IAAI,CAAC,EAAE;CAC3E,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,yBAAyB,KAAK,yBAAyB;CACpF,OAAO;AACT;AAEA,MAAM,yBAAyB,wBAAwB,QAAQ;AAC/D,MAAM,6BAA6B,wBAAwB,YAAY;AACvE,MAAM,6BAA6B,wBAAwB,YAAY"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-runtime",
-  "version": "0.138.1",
+  "version": "0.140.0",
   "description": "Shared task-lifecycle skeleton for agents: a recursive loop kernel for chat turns, one-shot tasks, and multi-attempt loops, with trace capture and eval-gated self-improvement. Domain behavior lives in adapters; scoring and ship-gates in @tangle-network/agent-eval.",
   "homepage": "https://github.com/tangle-network/agent-runtime#readme",
   "repository": {
@@ -118,9 +118,9 @@
     "@arethetypeswrong/cli": "0.18.5",
     "@modelcontextprotocol/sdk": "1.30.0",
     "@biomejs/biome": "^2.5.5",
-    "@tangle-network/agent-eval": "0.146.0",
-    "@tangle-network/agent-interface": "1.0.0",
-    "@tangle-network/sandbox": "0.27.1",
+    "@tangle-network/agent-eval": ">=0.147.0 <0.148.0",
+    "@tangle-network/agent-interface": "^1.0.0",
+    "@tangle-network/sandbox": ">=0.27.1 <0.28.0",
     "@types/node": "26.1.1",
     "@types/tar-stream": "3.1.4",
     "miniflare": "4.20260722.0",
@@ -139,7 +139,7 @@
   },
   "license": "MIT",
   "peerDependencies": {
-    "@tangle-network/agent-eval": ">=0.146.0 <0.147.0",
+    "@tangle-network/agent-eval": ">=0.147.0 <0.148.0",
     "@tangle-network/agent-interface": "^1.0.0",
     "@tangle-network/sandbox": ">=0.27.1 <0.28.0"
   },
@@ -149,9 +149,9 @@
     }
   },
   "dependencies": {
-    "@tangle-network/agent-core": "0.9.4",
-    "@tangle-network/agent-knowledge": "8.0.6",
-    "@tangle-network/agent-profile-materialize": "0.16.0",
+    "@tangle-network/agent-core": ">=0.9.4 <0.10.0",
+    "@tangle-network/agent-knowledge": "^8.0.8",
+    "@tangle-network/agent-profile-materialize": ">=0.16.0 <0.17.0",
     "@tangle-network/agent-trace-contract": "^1.0.2",
     "tar-stream": "3.2.0"
   },