@tangle-network/agent-runtime 0.140.0 → 0.141.1

package/dist/{prepare-DK1qnk7-.js.map → prepare-D3n7cA39.js.map}

@@ -1 +1 @@
-{"version":3,"file":"prepare-DK1qnk7-.js","names":["canonicalCandidateDigest","publicValue","canonicalCandidateDigest","SHA256_PATTERN","canonicalCandidateDigest","requireString","requireNumber","requireObject","assertExecutionId","assertSha256Digest","assertCount","fsConstants","hasControlCharacter","canonicalCandidateDigest","modelLimits","canonicalCandidateDigest","canonicalCandidateDigest","canonicalCandidateDigest","canonicalCandidateDigest","errorMessage","canonicalCandidateDigest","resolveHostPath"],"sources":["../src/candidate-execution/digest.ts","../src/candidate-execution/system-prompt.ts","../src/candidate-execution/profile.ts","../src/candidate-execution/exact-object.ts","../src/candidate-execution/claim-file-formats.ts","../src/candidate-execution/claim-terminal.ts","../src/candidate-execution/cleanup.ts","../src/candidate-execution/execution-window.ts","../src/candidate-execution/artifacts.ts","../src/candidate-execution/git-materialize.ts","../src/candidate-execution/types.ts","../src/candidate-execution/prepared-state.ts","../src/candidate-execution/claim-plan.ts","../src/candidate-execution/claim.ts","../src/candidate-execution/model-settlement.ts","../src/candidate-execution/verify.ts","../src/candidate-execution/knowledge.ts","../src/candidate-execution/executor-capture.ts","../src/candidate-execution/output-artifacts.ts","../src/candidate-execution/finalize.ts","../src/candidate-execution/benchmark-grader.ts","../src/candidate-execution/executor-capture-evidence.ts","../src/candidate-execution/outcome-evidence.ts","../src/candidate-execution/protected-trace-store.ts","../src/candidate-execution/execute.ts","../src/candidate-execution/prepare.ts"],"sourcesContent":["import { createHash } from 'node:crypto'\nimport { canonicalJson } from '@tangle-network/agent-eval'\nimport type { AgentCandidateEmbeddedArtifact, Sha256Digest } from '@tangle-network/agent-interface'\n\nimport { contentAddress } from '../durable/spawn-journal'\nimport type { CanonicalCandidateDocument } from './types'\n\nexport function sha256Bytes(bytes: Uint8Array): Sha256Digest {\n  return `sha256:${createHash('sha256').update(bytes).digest('hex')}`\n}\n\nexport function canonicalCandidateBytes(value: unknown): Uint8Array {\n  return Buffer.from(canonicalJson(value), 'utf8')\n}\n\nexport function canonicalCandidateDigest(value: unknown): Sha256Digest {\n  return contentAddress(value) as Sha256Digest\n}\n\n/** Returns a detached, deeply frozen JSON value with canonical number normalization. */\nexport function immutableCandidateValue<T>(value: T): T {\n  return deepFreezeCandidate(\n    JSON.parse(Buffer.from(canonicalCandidateBytes(value)).toString('utf8')) as T,\n  )\n}\n\nexport function canonicalCandidateDocument<T extends { digest: Sha256Digest }>(\n  valueWithoutDigest: Omit<T, 'digest'>,\n): CanonicalCandidateDocument<T> {\n  const bytes = canonicalCandidateBytes(valueWithoutDigest)\n  const digest = canonicalCandidateDigest(valueWithoutDigest)\n  if (sha256Bytes(bytes) !== digest) {\n    throw new Error('canonical candidate serializers disagree on document digest')\n  }\n  const storedBytes = Uint8Array.from(bytes)\n  const value = immutableCandidateValue({ ...valueWithoutDigest, digest }) as T\n  return Object.freeze({\n    value,\n    get bytes(): Uint8Array {\n      return Uint8Array.from(storedBytes)\n    },\n    digest,\n  })\n}\n\nexport function verifyCanonicalCandidateDocument<T extends { digest: Sha256Digest }>(\n  value: T,\n  label: string,\n): T {\n  if (canonicalCandidateDigest(omitTopLevelDigest(value)) !== value.digest) {\n    throw new Error(`${label} digest does not match`)\n  }\n  return immutableCandidateValue(value)\n}\n\nexport function embeddedCandidateArtifact(bytes: Uint8Array): AgentCandidateEmbeddedArtifact {\n  return {\n    encoding: 'base64',\n    content: Buffer.from(bytes).toString('base64'),\n    sha256: sha256Bytes(bytes),\n    byteLength: bytes.byteLength,\n  }\n}\n\nexport function omitTopLevelDigest<T extends { digest: Sha256Digest }>(\n  value: T,\n): Omit<T, 'digest'> {\n  const { digest: _digest, ...rest } = value\n  return rest\n}\n\nexport function deepFreezeCandidate<T>(value: T, seen = new Set<object>()): T {\n  if (\n    value === null ||\n    typeof value !== 'object' ||\n    ArrayBuffer.isView(value) ||\n    seen.has(value as object)\n  ) {\n    return value\n  }\n  seen.add(value as object)\n  for (const child of Object.values(value as Record<string, unknown>)) {\n    deepFreezeCandidate(child, seen)\n  }\n  return Object.freeze(value)\n}\n","import { posix } from 'node:path'\n\nimport type {\n  AgentCandidateConfigValue,\n  AgentCandidateLaunch,\n} from '@tangle-network/agent-interface'\nimport type {\n  AgentCandidateWorkspacePlan,\n  HarnessId,\n} from '@tangle-network/agent-profile-materialize'\n\nconst SYSTEM_PROMPT_FILE = '.tangle/system-prompt.md'\nconst APPEND_SYSTEM_PROMPT_FILE = '.tangle/append-system-prompt.md'\n\n/**\n * One row describes the native process control for each prompt intent this adapter owns.\n * A row with no executor projection means the shared materializer already lowered the intent into\n * the signed workspace plan; this adapter still proves that the launch reaches the native binary.\n */\ninterface HarnessSystemPrompt {\n  /** The native binary the launch must run for this projection to be provable. */\n  readonly executable: string\n  /** Apply a replacement prompt to the harness's own control. */\n  readonly project: (\n    plan: AgentCandidateWorkspacePlan,\n    systemPrompt: string,\n    systemPromptFilePath: string,\n  ) => AgentCandidateWorkspacePlan\n  /** Apply an addition without replacing the harness's own prompt. */\n  readonly projectAppend?: (\n    plan: AgentCandidateWorkspacePlan,\n    appendSystemPrompt: string,\n    appendSystemPromptFilePath: string,\n  ) => AgentCandidateWorkspacePlan\n  /** The materializer already projected replacement text into native plan files and flags. */\n  readonly retainsProjectedSystemPrompt?: boolean\n  /** Does caller argv already set a replacement control this projection would shadow? */\n  readonly conflictsWithArgs: (values: readonly string[]) => boolean\n  /** Does caller argv already set an additive control this projection would shadow? */\n  readonly conflictsWithAppendArgs: (values: readonly string[]) => boolean\n}\n\nconst SYSTEM_PROMPT_FLAGS = ['--system-prompt', '--system-prompt-file'] as const\nconst APPEND_SYSTEM_PROMPT_FLAGS = [\n  '--append-system-prompt',\n  '--append-system-prompt-file',\n] as const\n\nfunction argsSetSystemPromptFlag(values: readonly string[]): boolean {\n  return values.some((value) =>\n    SYSTEM_PROMPT_FLAGS.some((flag) => value === flag || value.startsWith(`${flag}=`)),\n  )\n}\n\nfunction argsSetAppendSystemPromptFlag(values: readonly string[]): boolean {\n  return values.some((value) =>\n    APPEND_SYSTEM_PROMPT_FLAGS.some((flag) => value === flag || value.startsWith(`${flag}=`)),\n  )\n}\n\n/** Codex keys that can replace or contaminate the materializer's sealed instructions file. */\nconst CODEX_INSTRUCTION_KEYS = ['model_instructions_file', 'developer_instructions'] as const\n\nfunction argsSetCodexInstructionOverride(values: readonly string[]): boolean {\n  for (let index = 0; index < values.length; index++) {\n    const value = values[index]!\n    const config =\n      value === '-c' || value === '--config'\n        ? values[index + 1]\n        : value.startsWith('--config=')\n          ? value.slice('--config='.length)\n          : undefined\n    if (\n      config !== undefined &&\n      CODEX_INSTRUCTION_KEYS.some((key) => config.trimStart().startsWith(`${key}=`))\n    ) {\n      return true\n    }\n  }\n  return false\n}\n\nconst HARNESS_SYSTEM_PROMPTS = {\n  'claude-code': {\n    executable: 'claude',\n    project: (plan, systemPrompt, path) =>\n      appendFlags(\n        addPromptFile(plan, SYSTEM_PROMPT_FILE, systemPrompt),\n        '--system-prompt-file',\n        path,\n      ),\n    projectAppend: (plan, appendSystemPrompt, path) =>\n      appendFlags(\n        addPromptFile(plan, APPEND_SYSTEM_PROMPT_FILE, appendSystemPrompt),\n        '--append-system-prompt-file',\n        path,\n      ),\n    conflictsWithArgs: argsSetSystemPromptFlag,\n    conflictsWithAppendArgs: argsSetAppendSystemPromptFlag,\n  },\n  /** OpenCode's bound primary agent is already selected by the materializer's --agent flag. */\n  opencode: {\n    executable: 'opencode',\n    project: (plan) => plan,\n    retainsProjectedSystemPrompt: true,\n    conflictsWithArgs: (values) =>\n      values.some((value) => value === '--agent' || value.startsWith('--agent=')),\n    conflictsWithAppendArgs: argsSetAppendSystemPromptFlag,\n  },\n  pi: {\n    executable: 'pi',\n    project: (plan, systemPrompt, path) =>\n      appendFlags(addPromptFile(plan, SYSTEM_PROMPT_FILE, systemPrompt), '--system-prompt', path),\n    projectAppend: (plan, appendSystemPrompt, path) =>\n      appendFlags(\n        addPromptFile(plan, APPEND_SYSTEM_PROMPT_FILE, appendSystemPrompt),\n        '--append-system-prompt',\n        path,\n      ),\n    conflictsWithArgs: argsSetSystemPromptFlag,\n    conflictsWithAppendArgs: argsSetAppendSystemPromptFlag,\n  },\n  prime: {\n    executable: 'prime-agent',\n    project: (plan, systemPrompt, path) =>\n      appendFlags(addPromptFile(plan, SYSTEM_PROMPT_FILE, systemPrompt), '--system-prompt', path),\n    projectAppend: (plan, appendSystemPrompt, path) =>\n      appendFlags(\n        addPromptFile(plan, APPEND_SYSTEM_PROMPT_FILE, appendSystemPrompt),\n        '--append-system-prompt',\n        path,\n      ),\n    conflictsWithArgs: argsSetSystemPromptFlag,\n    conflictsWithAppendArgs: argsSetAppendSystemPromptFlag,\n  },\n  /** Gemini's file and env lowering is materializer-owned; this row supplies the launch proof. */\n  gemini: {\n    executable: 'gemini',\n    project: (plan) => plan,\n    conflictsWithArgs: argsSetSystemPromptFlag,\n    conflictsWithAppendArgs: argsSetAppendSystemPromptFlag,\n  },\n} as const satisfies Partial<Record<HarnessId, HarnessSystemPrompt>>\n\ninterface MaterializedPromptDelivery {\n  readonly executable: string\n  readonly delivered: (plan: AgentCandidateWorkspacePlan) => boolean\n  readonly conflictsWithArgs: (values: readonly string[]) => boolean\n}\n\n/**\n * These controls are lowered by agent-profile-materialize into files plus launch inputs. The\n * candidate adapter does not own the spawn, so it must reject an arbitrary entrypoint even when\n * the plan has the right bytes: only the native binary can make those inputs effective.\n */\nconst MATERIALIZED_PROMPT_DELIVERIES = {\n  codex: {\n    executable: 'codex',\n    delivered: (plan) =>\n      plan.files.some((file) => file.relPath === '.codex/system-prompt.md') &&\n      plan.flags.some((flag) => flag.value === 'model_instructions_file=.codex/system-prompt.md'),\n    conflictsWithArgs: argsSetCodexInstructionOverride,\n  },\n  gemini: {\n    executable: 'gemini',\n    delivered: (plan) =>\n      plan.files.some((file) => file.relPath === '.gemini/system.md') &&\n      plan.env.GEMINI_SYSTEM_MD?.value === '1',\n    conflictsWithArgs: argsSetSystemPromptFlag,\n  },\n} as const satisfies Partial<Record<HarnessId, MaterializedPromptDelivery>>\n\n/** Project both prompt intents onto their distinct native process controls. */\nexport function projectCandidatePromptIntents(\n  plan: AgentCandidateWorkspacePlan,\n  launch: AgentCandidateLaunch,\n  systemPromptFilePath: string,\n  requestedSystemPrompt: string | undefined = plan.systemPrompt?.value,\n  requestedAppendSystemPrompt: string | undefined = plan.appendSystemPrompt?.value,\n): AgentCandidateWorkspacePlan {\n  const systemPrompt = plan.systemPrompt\n  const appendSystemPrompt = plan.appendSystemPrompt\n  const delivery = MATERIALIZED_PROMPT_DELIVERIES[\n    plan.harness as keyof typeof MATERIALIZED_PROMPT_DELIVERIES\n  ] as MaterializedPromptDelivery | undefined\n\n  if (systemPrompt === undefined && delivery?.delivered(plan)) {\n    assertProvableNativeLaunch(plan.harness, delivery.executable, launch, 'replacement')\n    assertNoShadowingArgs(plan.harness, delivery.conflictsWithArgs, launch, 'replacement')\n    if (requestedSystemPrompt === undefined) return plan\n    return plan\n  }\n\n  if (requestedSystemPrompt === undefined && requestedAppendSystemPrompt === undefined) {\n    return plan\n  }\n\n  const projection = HARNESS_SYSTEM_PROMPTS[plan.harness as keyof typeof HARNESS_SYSTEM_PROMPTS] as\n    | HarnessSystemPrompt\n    | undefined\n  if (!projection) {\n    throw new Error(`candidate system prompt has no native launch projection for ${plan.harness}`)\n  }\n\n  const requestedReplacement = requestedSystemPrompt !== undefined\n  if (requestedReplacement && systemPrompt === undefined) {\n    throw new Error(\n      `profile materializer did not deliver the candidate system prompt for ${plan.harness}`,\n    )\n  }\n  if (systemPrompt !== undefined && requestedSystemPrompt === undefined) {\n    throw new Error(\n      `profile materializer added an unexpected candidate system prompt for ${plan.harness}`,\n    )\n  }\n  if (systemPrompt !== undefined && systemPrompt.value !== requestedSystemPrompt) {\n    throw new Error('profile materializer changed the candidate system prompt')\n  }\n  if (\n    appendSystemPrompt !== undefined &&\n    appendSystemPrompt.value !== requestedAppendSystemPrompt\n  ) {\n    throw new Error('profile materializer changed the candidate append system prompt')\n  }\n\n  const intent = requestedReplacement ? 'replacement' : 'addition'\n  assertProvableNativeLaunch(plan.harness, projection.executable, launch, intent)\n  const launchArgs = (launch.args ?? []).map((value) => value.value)\n  if (requestedReplacement && projection.conflictsWithArgs(launchArgs)) {\n    throw new Error(\n      `${plan.harness} launch arguments conflict with the candidate profile system prompt`,\n    )\n  }\n  if (requestedAppendSystemPrompt !== undefined && projection.conflictsWithAppendArgs(launchArgs)) {\n    throw new Error(\n      `${plan.harness} launch arguments conflict with the candidate profile append system prompt`,\n    )\n  }\n\n  let projected = plan\n  if (systemPrompt !== undefined) {\n    projected = projection.project(\n      projection.retainsProjectedSystemPrompt\n        ? projected\n        : omitPromptIntent(projected, 'systemPrompt'),\n      systemPrompt.value,\n      systemPromptFilePath,\n    )\n  }\n  if (appendSystemPrompt !== undefined) {\n    if (!projection.projectAppend) {\n      throw new Error(\n        `candidate append system prompt has no native launch projection for ${plan.harness}`,\n      )\n    }\n    projected = projection.projectAppend(\n      omitPromptIntent(projected, 'appendSystemPrompt'),\n      appendSystemPrompt.value,\n      posix.join(posix.dirname(systemPromptFilePath), 'append-system-prompt.md'),\n    )\n  }\n  // The source-profile digest binds authored values. Remove executor handoff fields only after\n  // converting them into native controls; materializer-owned controls remain visible in the plan.\n  return projected\n}\n\nfunction assertProvableNativeLaunch(\n  harness: string,\n  expectedExecutable: string,\n  launch: AgentCandidateLaunch,\n  intent: 'replacement' | 'addition',\n): asserts launch is AgentCandidateLaunch & { kind: 'container-command' } {\n  if (launch.kind !== 'container-command') {\n    throw new Error(`candidate-entrypoint launch cannot prove ${harness} system-prompt ${intent}`)\n  }\n  if (\n    launch.executable !== expectedExecutable &&\n    !(\n      posix.isAbsolute(launch.executable) &&\n      posix.basename(launch.executable) === expectedExecutable\n    )\n  ) {\n    throw new Error(\n      `${harness} system-prompt ${intent} requires the native ${expectedExecutable} executable`,\n    )\n  }\n}\n\nfunction assertNoShadowingArgs(\n  harness: string,\n  conflictsWithArgs: (values: readonly string[]) => boolean,\n  launch: Extract<AgentCandidateLaunch, { kind: 'container-command' }>,\n  intent: 'replacement' | 'addition',\n): void {\n  if (conflictsWithArgs((launch.args ?? []).map((value) => value.value))) {\n    throw new Error(\n      `${harness} launch arguments conflict with the candidate profile ${intent === 'replacement' ? 'system' : 'append system'} prompt`,\n    )\n  }\n}\n\nfunction omitPromptIntent(\n  plan: AgentCandidateWorkspacePlan,\n  intent: 'systemPrompt' | 'appendSystemPrompt',\n): AgentCandidateWorkspacePlan {\n  const projected = { ...plan }\n  delete projected[intent]\n  return projected\n}\n\nfunction appendFlags(\n  plan: AgentCandidateWorkspacePlan,\n  ...values: string[]\n): AgentCandidateWorkspacePlan {\n  return {\n    ...plan,\n    flags: [...plan.flags, ...values.map(publicValue)],\n  }\n}\n\nfunction publicValue(value: string): AgentCandidateConfigValue {\n  return { kind: 'public', value }\n}\n\nfunction addPromptFile(\n  plan: AgentCandidateWorkspacePlan,\n  relPath: string,\n  prompt: string,\n): AgentCandidateWorkspacePlan {\n  // Candidate argv rejects control characters. Native prompt-file loading preserves multiline\n  // bytes without weakening the shared process schema.\n  if (plan.files.some((file) => file.relPath === relPath)) {\n    throw new Error(`candidate profile conflicts with reserved ${relPath}`)\n  }\n  return {\n    ...plan,\n    files: [\n      ...plan.files,\n      {\n        relPath,\n        content: prompt,\n        source: 'generated',\n      },\n    ],\n  }\n}\n","import { posix } from 'node:path'\n\nimport type {\n  AgentCandidateConfigValue,\n  AgentCandidateLaunch,\n  AgentCandidateProfile,\n  AgentCandidateProfileActivation,\n  AgentCandidateProfilePlanEvidence,\n  AgentCandidateResourceRef,\n  AgentProfile,\n  AgentProfileConfigValue,\n  AgentProfileDiff,\n  AgentProfileMcpServer,\n  AgentProfileResourceRef,\n  HarnessType,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\nimport {\n  agentCandidateProfileActivationSchema,\n  agentCandidateProfileSchema,\n  agentProfileDiffSchema,\n  agentProfileSchema,\n  applyAgentProfileDiff,\n} from '@tangle-network/agent-interface'\nimport type {\n  AgentCandidateWorkspacePlan,\n  HarnessId,\n} from '@tangle-network/agent-profile-materialize'\nimport {\n  isMaterializerHarness,\n  materializeCandidateProfile,\n} from '@tangle-network/agent-profile-materialize'\n\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  canonicalCandidateDocument,\n  embeddedCandidateArtifact,\n  immutableCandidateValue,\n  omitTopLevelDigest,\n  sha256Bytes,\n} from './digest'\nimport { projectCandidatePromptIntents } from './system-prompt'\n\nexport function candidateMaterializerHarness(harness: HarnessType): HarnessId {\n  if (!isMaterializerHarness(harness)) {\n    throw new Error(\n      `sealed candidate profile materialization is unsupported for harness ${harness}`,\n    )\n  }\n  return harness\n}\n\n/** Runtime applies the materializer's launch flags to the candidate process. */\nexport const CANDIDATE_PROFILE_MATERIALIZER_BINDS = ['systemPrompt'] as const\n\ninterface MaterializeAgentCandidateProfilePlanOptions {\n  profile: AgentCandidateProfile\n  harness: HarnessType\n  launch: AgentCandidateLaunch\n  workspace: 'task' | 'candidate'\n  workspaces: {\n    taskRoot: string\n    candidateRoot?: string\n  }\n  resolvedResources?: ReadonlyMap<Sha256Digest, string>\n}\n\n/** Derive the exact native profile plan used by preparation and later evidence checks. */\nexport function materializeAgentCandidateProfilePlan(\n  options: MaterializeAgentCandidateProfilePlanOptions,\n): AgentCandidateWorkspacePlan {\n  const root =\n    options.workspace === 'task' ? options.workspaces.taskRoot : options.workspaces.candidateRoot\n  if (!root) throw new Error('candidate profile target is missing its execution workspace root')\n  const plan = materializeCandidateProfile(\n    options.profile,\n    candidateMaterializerHarness(options.harness),\n    {\n      binds: CANDIDATE_PROFILE_MATERIALIZER_BINDS,\n      resolvedResources: options.resolvedResources,\n    },\n  )\n  return projectCandidatePromptIntents(\n    plan,\n    options.launch,\n    posix.join(root, '.tangle/system-prompt.md'),\n    options.profile.prompt?.systemPrompt,\n    options.profile.prompt?.appendSystemPrompt,\n  )\n}\n\n/** Bind exact native profile text to the canonical plan captured during preparation. */\nexport function createAgentCandidateProfileActivation(\n  plan: AgentCandidateWorkspacePlan,\n  profilePlan: AgentCandidateProfilePlanEvidence,\n): AgentCandidateProfileActivation {\n  const sourceByPath = new Map(plan.files.map((file) => [file.relPath, file]))\n  if (sourceByPath.size !== plan.files.length) {\n    throw new Error('candidate profile activation contains duplicate native file paths')\n  }\n  const files = profilePlan.material.files.map((expected) => {\n    const source = sourceByPath.get(expected.relPath)\n    if (!source) {\n      throw new Error(`candidate profile activation is missing ${expected.relPath}`)\n    }\n    const mode = source.mode ?? 0o644\n    if (!Number.isSafeInteger(mode) || mode < 0 || mode > 0o777) {\n      throw new Error(`candidate profile activation has invalid mode for ${expected.relPath}`)\n    }\n    return { path: expected.relPath, mode, content: source.content }\n  })\n  if (files.length !== plan.files.length) {\n    throw new Error('candidate profile activation contains unplanned native files')\n  }\n  return parseAgentCandidateProfileActivation(\n    canonicalCandidateDocument<AgentCandidateProfileActivation>({\n      kind: 'agent-candidate-profile-activation',\n      profilePlan,\n      files,\n    }).value,\n    profilePlan.digest,\n  )\n}\n\n/** Parse and check every native file hash plus both canonical document digests. */\nexport function parseAgentCandidateProfileActivation(\n  input: unknown,\n  expectedProfilePlanDigest?: AgentCandidateProfilePlanEvidence['digest'],\n): AgentCandidateProfileActivation {\n  const activation = agentCandidateProfileActivationSchema.parse(input)\n  const planBytes = canonicalCandidateBytes(activation.profilePlan.material)\n  const profilePlanArtifact = activation.profilePlan.artifact\n  if (\n    sha256Bytes(planBytes) !== activation.profilePlan.digest ||\n    profilePlanArtifact.sha256 !== activation.profilePlan.digest ||\n    profilePlanArtifact.byteLength !== planBytes.byteLength ||\n    ('content' in profilePlanArtifact &&\n      !Buffer.from(profilePlanArtifact.content, 'base64').equals(Buffer.from(planBytes))) ||\n    (expectedProfilePlanDigest !== undefined &&\n      activation.profilePlan.digest !== expectedProfilePlanDigest)\n  ) {\n    throw new Error('candidate profile activation has an invalid canonical profile plan')\n  }\n  if (canonicalCandidateDigest(omitTopLevelDigest(activation)) !== activation.digest) {\n    throw new Error('candidate profile activation digest does not match')\n  }\n  return immutableCandidateValue(activation)\n}\n\nconst CANDIDATE_PROFILE_DIRECT_FIELDS = [\n  'name',\n  'description',\n  'version',\n  'tags',\n  'prompt',\n  'harness',\n  'permissions',\n  'tools',\n  'confidential',\n] as const\n\n/** Convert only behavior-preserving generic profile fields into the closed candidate contract. */\nexport function freezeGenericAgentCandidateProfile(input: AgentProfile): AgentCandidateProfile {\n  const profile = parseExactAgentProfile(input, 'profile')\n  return candidateProfileFromGenericProfile(profile)\n}\n\n/**\n * Keep every generic-profile-to-candidate conversion in one place.\n * Callers use this both when sealing a new bundle and when proving a measured\n * profile is exactly the profile in an existing candidate.\n */\nfunction candidateProfileFromGenericProfile(profile: AgentProfile): AgentCandidateProfile {\n  if (profile.connections !== undefined) unsupportedProfileField('connections')\n  if (profile.metadata !== undefined) unsupportedProfileField('metadata')\n  if (profile.extensions !== undefined) unsupportedProfileField('extensions')\n  if (profile.model?.metadata !== undefined) unsupportedProfileField('model.metadata')\n\n  const candidate: Record<string, unknown> = {}\n  copyDirectProfileFields(candidate, profile as Record<string, unknown>)\n  if (profile.model) {\n    const { metadata: _metadata, ...model } = profile.model\n    candidate.model = model\n  }\n  if (profile.mcp) candidate.mcp = freezeMcpServers(profile.mcp)\n  if (profile.subagents) {\n    candidate.subagents = Object.fromEntries(\n      Object.entries(profile.subagents).map(([name, subagent]) => {\n        if (subagent.metadata !== undefined) unsupportedProfileField(`subagents.${name}.metadata`)\n        const { metadata: _metadata, ...value } = subagent\n        return [name, value]\n      }),\n    )\n  }\n  if (profile.resources) candidate.resources = freezeResources(profile.resources)\n  if (profile.hooks && Object.values(profile.hooks).some((commands) => commands.length > 0)) {\n    throw new Error(\n      'generic AgentProfile hooks cannot be safely tokenized; use a candidate-profile source with executable/args',\n    )\n  }\n  if (profile.hooks) candidate.hooks = profile.hooks\n  if (profile.modes) {\n    candidate.modes = Object.fromEntries(\n      Object.entries(profile.modes).map(([name, mode]) => {\n        if (mode.metadata !== undefined) unsupportedProfileField(`modes.${name}.metadata`)\n        const { metadata: _metadata, ...value } = mode\n        return [name, value]\n      }),\n    )\n  }\n  const parsed = parseExactCandidateProfile(candidate)\n  return parsed\n}\n\n/** Prove the measured generic profile and sealed candidate profile describe the same behavior. */\nexport function assertCandidateProfileBinding(\n  measuredInput: unknown,\n  bundled: AgentCandidateProfile,\n): void {\n  const measured = parseExactAgentProfile(measuredInput, 'measured agent profile')\n  const expected = candidateProfileFromGenericProfile(measured)\n  if (canonicalCandidateDigest(expected) !== canonicalCandidateDigest(bundled)) {\n    throw new Error('measured agent profile does not match sealed candidate profile')\n  }\n}\n\n/** Parse a complete profile without silently discarding unsupported fields. */\nexport function parseExactAgentProfile(input: unknown, label: string): AgentProfile {\n  let parsed: AgentProfile\n  try {\n    parsed = agentProfileSchema.parse(input) as AgentProfile\n  } catch (cause) {\n    throw new Error(`${label} contains unsupported or non-canonical fields`, { cause })\n  }\n  assertCanonicalParse(input, parsed, label)\n  return parsed\n}\n\n/** Parse a profile diff without silently discarding unsupported fields. */\nexport function parseExactAgentProfileDiff(input: unknown, label: string): AgentProfileDiff {\n  let parsed: AgentProfileDiff\n  try {\n    parsed = agentProfileDiffSchema.parse(input) as AgentProfileDiff\n  } catch (cause) {\n    throw new Error(`${label} contains unsupported or non-canonical fields`, { cause })\n  }\n  assertCanonicalParse(input, parsed, label)\n  return parsed\n}\n\n/** Apply one exact diff and reject any value that cannot be preserved canonically. */\nexport function applyExactAgentProfileDiff(\n  baseInput: unknown,\n  diffInput: unknown,\n  label: string,\n): AgentProfile {\n  const base = parseExactAgentProfile(baseInput, `${label} base profile`)\n  const diff = parseExactAgentProfileDiff(diffInput, `${label} diff`)\n  const applied = omitUndefinedObjectFields(applyAgentProfileDiff(base, diff), label)\n  return parseExactAgentProfile(applied, `${label} result`)\n}\n\n/** Parse a candidate profile without silently discarding unsupported or non-canonical fields. */\nexport function parseExactCandidateProfile(input: unknown): AgentCandidateProfile {\n  const parsed = agentCandidateProfileSchema.parse(input)\n  assertCanonicalParse(input, parsed, 'candidate profile')\n  return parsed\n}\n\n/** Reject profile fields whose behavioral effect is not yet proven by candidate executors. */\nexport function assertCandidateProfileExecutionSupport(profile: AgentCandidateProfile): void {\n  const fields = ['tools', 'permissions', 'modes', 'confidential'] as const\n  const unsupported = fields.filter((field) => hasEntries(profile[field]))\n  if (unsupported.length > 0) {\n    throw new Error(\n      `candidate execution cannot prove in-session effects for non-empty AgentProfile fields: ${unsupported.join(', ')}`,\n    )\n  }\n}\n\n/** Convert the candidate profile contract into the portable interface profile it represents. */\nexport function agentCandidateProfileAsAgentProfile(\n  candidate: AgentCandidateProfile,\n): AgentProfile {\n  const output: Record<string, unknown> = {}\n  copyDirectProfileFields(output, candidate as unknown as Record<string, unknown>)\n  if (candidate.model) output.model = { ...candidate.model }\n  if (candidate.mcp) {\n    output.mcp = Object.fromEntries(\n      Object.entries(candidate.mcp).map(([name, server]) => [\n        name,\n        {\n          ...server,\n          // Candidate config values ({kind:'public', value}) are already valid\n          // AgentProfileConfigValue entries under interface >=0.40 — clone them\n          // rather than unwrapping to plain strings, which the 0.40 profile\n          // schema rejects.\n          ...(server.args ? { args: server.args.map((value) => ({ ...value })) } : {}),\n          ...(server.env ? { env: cloneRecord(server.env) } : {}),\n        },\n      ]),\n    )\n  }\n  if (candidate.subagents) output.subagents = cloneRecord(candidate.subagents)\n  if (candidate.modes) output.modes = cloneRecord(candidate.modes)\n  if (candidate.hooks) {\n    output.hooks = Object.fromEntries(\n      Object.entries(candidate.hooks).map(([event, hooks]) => [\n        event,\n        hooks.map(({ executable, args, env, ...hook }) => ({\n          ...hook,\n          command: [executable, ...(args ?? []).map(publicValue)].map(shellQuote).join(' '),\n          // Hook env stays in config-value form: the 0.40 profile hook contract\n          // types env as Record<string, AgentProfileConfigValue>.\n          ...(env ? { env: cloneRecord(env) } : {}),\n        })),\n      ]),\n    )\n  }\n  if (candidate.resources) {\n    if (candidate.resources.failOnError !== true) {\n      throw new Error('sealed candidate profile contains fields unsupported by generic profiles')\n    }\n    output.resources = {\n      failOnError: true,\n      ...(candidate.resources.files\n        ? {\n            files: candidate.resources.files.map((file) => ({\n              ...file,\n              resource: publicResource(file.resource),\n            })),\n          }\n        : {}),\n      ...(candidate.resources.tools\n        ? { tools: candidate.resources.tools.map(publicResource) }\n        : {}),\n      ...(candidate.resources.skills\n        ? { skills: candidate.resources.skills.map(publicResource) }\n        : {}),\n      ...(candidate.resources.agents\n        ? { agents: candidate.resources.agents.map(publicResource) }\n        : {}),\n      ...(candidate.resources.commands\n        ? { commands: candidate.resources.commands.map(publicResource) }\n        : {}),\n      ...(candidate.resources.instructions !== undefined\n        ? {\n            instructions:\n              typeof candidate.resources.instructions === 'string'\n                ? candidate.resources.instructions\n                : publicResource(candidate.resources.instructions),\n          }\n        : {}),\n    }\n  }\n  return output as AgentProfile\n}\n\n/** Recursively remove undefined object fields while refusing undefined array entries. */\nexport function omitUndefinedObjectFields(value: unknown, path: string): unknown {\n  if (Array.isArray(value)) {\n    return value.map((entry, index) => {\n      if (entry === undefined) {\n        throw new Error(`${path} produced an undefined array entry at ${index}`)\n      }\n      return omitUndefinedObjectFields(entry, `${path}[${index}]`)\n    })\n  }\n  if (value === null || typeof value !== 'object') return value\n  return Object.fromEntries(\n    Object.entries(value as Record<string, unknown>)\n      .filter(([, entry]) => entry !== undefined)\n      .map(([key, entry]) => [key, omitUndefinedObjectFields(entry, `${path}.${key}`)]),\n  )\n}\n\nfunction freezeMcpServers(servers: Record<string, AgentProfileMcpServer>): Record<string, unknown> {\n  return Object.fromEntries(\n    Object.entries(servers).map(([name, server]) => {\n      if (server.transport !== undefined && server.transport !== 'stdio') {\n        unsupportedProfileField(`mcp.${name}.transport=${server.transport}`)\n      }\n      if (server.url !== undefined) unsupportedProfileField(`mcp.${name}.url`)\n      if (server.headers !== undefined) unsupportedProfileField(`mcp.${name}.headers`)\n      if (server.metadata !== undefined) unsupportedProfileField(`mcp.${name}.metadata`)\n      return [\n        name,\n        {\n          ...(server.transport ? { transport: server.transport } : {}),\n          ...(server.command ? { command: server.command } : {}),\n          ...(server.args\n            ? {\n                args: server.args.map((value, index) =>\n                  candidatePublicValue(value, `mcp.${name}.args[${index}]`),\n                ),\n              }\n            : {}),\n          ...(server.env ? { env: mapCandidatePublicValues(server.env, `mcp.${name}.env`) } : {}),\n          ...(server.cwd ? { cwd: server.cwd } : {}),\n          ...(server.enabled === undefined ? {} : { enabled: server.enabled }),\n        },\n      ]\n    }),\n  )\n}\n\nfunction freezeResources(resources: NonNullable<AgentProfile['resources']>): unknown {\n  if (resources.failOnError !== true) {\n    throw new Error('candidate profile resources require failOnError: true')\n  }\n  return {\n    failOnError: true,\n    ...(resources.files\n      ? {\n          files: resources.files.map((file) => ({\n            ...file,\n            resource: freezeResource(file.resource),\n          })),\n        }\n      : {}),\n    ...(resources.tools ? { tools: resources.tools.map(freezeResource) } : {}),\n    ...(resources.skills ? { skills: resources.skills.map(freezeResource) } : {}),\n    ...(resources.agents ? { agents: resources.agents.map(freezeResource) } : {}),\n    ...(resources.commands ? { commands: resources.commands.map(freezeResource) } : {}),\n    ...(resources.instructions === undefined\n      ? {}\n      : {\n          instructions:\n            typeof resources.instructions === 'string'\n              ? resources.instructions\n              : freezeResource(resources.instructions),\n        }),\n  }\n}\n\nfunction freezeResource(resource: AgentProfileResourceRef): AgentCandidateResourceRef {\n  if (resource.kind === 'github') {\n    throw new Error(\n      'generic GitHub profile resources do not carry byte identity; use a candidate-profile source with a pinned commit, digest, and byte length',\n    )\n  }\n  const bytes = Buffer.from(resource.content, 'utf8')\n  return {\n    ...resource,\n    sha256: embeddedCandidateArtifact(bytes).sha256,\n    byteLength: bytes.byteLength,\n  }\n}\n\nfunction copyDirectProfileFields(\n  target: Record<string, unknown>,\n  source: Record<string, unknown>,\n): void {\n  for (const key of CANDIDATE_PROFILE_DIRECT_FIELDS) {\n    if (source[key] !== undefined) target[key] = source[key]\n  }\n}\n\nfunction assertCanonicalParse(input: unknown, parsed: unknown, label: string): void {\n  if (!Buffer.from(canonicalCandidateBytes(input)).equals(canonicalCandidateBytes(parsed))) {\n    throw new Error(`${label} contains unsupported or non-canonical fields`)\n  }\n}\n\nfunction publicResource(resource: AgentCandidateResourceRef): unknown {\n  if (resource.kind === 'inline') {\n    return { kind: 'inline', name: resource.name, content: resource.content }\n  }\n  return {\n    kind: 'github',\n    repository: `${resource.repository.owner}/${resource.repository.repo}`,\n    path: resource.path,\n    ref: resource.commit,\n    ...(resource.name ? { name: resource.name } : {}),\n  }\n}\n\n/** Freeze one profile config value into the candidate's PUBLIC-only config\n *  shape. A secret-ref has no candidate representation (AgentCandidateConfigValue\n *  is public-only), so it is rejected, never silently dropped or unwrapped. */\nfunction candidatePublicValue(\n  value: AgentProfileConfigValue,\n  path: string,\n): { kind: 'public'; value: string } {\n  if (value.kind !== 'public') unsupportedProfileField(`${path} (secret-ref '${value.key}')`)\n  return { kind: 'public', value: value.value }\n}\n\nfunction mapCandidatePublicValues(\n  values: Record<string, AgentProfileConfigValue>,\n  pathPrefix: string,\n): Record<string, { kind: 'public'; value: string }> {\n  return Object.fromEntries(\n    Object.entries(values).map(([name, value]) => [\n      name,\n      candidatePublicValue(value, `${pathPrefix}.${name}`),\n    ]),\n  )\n}\n\nfunction publicValue(value: AgentCandidateConfigValue): string {\n  return value.value\n}\n\nfunction cloneRecord<T>(values: Record<string, T>): Record<string, T> {\n  return Object.fromEntries(\n    Object.entries(values).map(([key, value]) => [key, { ...value }]),\n  ) as Record<string, T>\n}\n\nfunction hasEntries(value: unknown): boolean {\n  return value !== undefined && value !== null && typeof value === 'object'\n    ? Object.keys(value).length > 0\n    : false\n}\n\nfunction shellQuote(value: string): string {\n  return /^[A-Za-z0-9_./:@%+=,-]+$/.test(value) ? value : `'${value.replaceAll(\"'\", `'\"'\"'`)}'`\n}\n\nfunction unsupportedProfileField(path: string): never {\n  throw new Error(\n    `generic AgentProfile field ${path} is not representable in a sealed candidate profile`,\n  )\n}\n","/** Reject unknown fields while requiring every declared non-optional field. */\nexport function assertExactObjectKeys(\n  value: unknown,\n  required: readonly string[],\n  label: string,\n  optional: readonly string[] = [],\n): void {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`${label} must be an object`)\n  }\n  const allowed = new Set([...required, ...optional])\n  if (allowed.size !== required.length + optional.length) {\n    throw new Error(`${label} exact-key contract contains duplicate fields`)\n  }\n  for (const key of Object.keys(value)) {\n    if (!allowed.has(key)) throw new Error(`${label} contains unknown field ${key}`)\n  }\n  for (const key of required) {\n    if (!(key in value)) throw new Error(`${label} is missing field ${key}`)\n  }\n}\n","import {\n  type AgentCandidateArtifactRef,\n  agentCandidateArtifactRefSchema,\n  type Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport type { AgentCandidateExecutionClaim, AgentCandidateExecutionTerminalRecord } from './claim'\nimport { immutableCandidateValue } from './digest'\nimport { assertExactObjectKeys } from './exact-object'\n\nexport interface AgentCandidatePreparationEvidence {\n  readonly executionPlan: AgentCandidateArtifactRef\n  readonly materializationReceipt: AgentCandidateArtifactRef\n}\n\nexport function sealCandidatePreparationEvidence(\n  value: unknown,\n  executionPlanDigest: Sha256Digest,\n): AgentCandidatePreparationEvidence {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error('candidate execution preparation evidence must be an object')\n  }\n  const record = value as Record<string, unknown>\n  assertExactObjectKeys(\n    record,\n    ['executionPlan', 'materializationReceipt'],\n    'candidate execution preparation evidence',\n  )\n  const executionPlan = immutableCandidateValue(\n    agentCandidateArtifactRefSchema.parse(record.executionPlan),\n  )\n  const materializationReceipt = immutableCandidateValue(\n    agentCandidateArtifactRefSchema.parse(record.materializationReceipt),\n  )\n  if (executionPlan.sha256 !== executionPlanDigest) {\n    throw new Error('candidate execution plan artifact digest does not match its claim')\n  }\n  return Object.freeze({ executionPlan, materializationReceipt })\n}\n\nexport interface PersistedAgentCandidateExecutionClaim extends AgentCandidateExecutionClaim {\n  phase: 'claimed'\n  leaseDigest: Sha256Digest\n}\n\nexport interface PersistedAgentCandidateExecutionPending {\n  kind: 'candidate-execution-pending-terminal'\n  terminal: AgentCandidateExecutionTerminalRecord\n}\n\nexport interface PersistedAgentCandidateExecutionPhase {\n  kind: 'candidate-execution-phase'\n  executionId: string\n  attempt: number\n  executionPlanDigest: Sha256Digest\n  phase: 'candidate-may-run'\n}\n\nexport interface PersistedAgentCandidateExecutionTerminal {\n  terminal: AgentCandidateExecutionTerminalRecord\n}\n","import type {\n  AgentCandidateArtifactRef,\n  AgentCandidateFixedSpend,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\nimport { agentCandidateArtifactRefSchema } from '@tangle-network/agent-interface'\n\nimport type {\n  AgentCandidateExecutionClaim,\n  AgentCandidateExecutionFailureClass,\n  AgentCandidateExecutionFinishResult,\n  AgentCandidateExecutionPhase,\n  AgentCandidateExecutionRecoveryEvidence,\n  AgentCandidateExecutionStageResult,\n  AgentCandidateExecutionTerminalRecord,\n  AgentCandidateExecutionTerminalResult,\n} from './claim'\nimport { sealCandidatePreparationEvidence } from './claim-file-formats'\nimport { canonicalCandidateDigest, immutableCandidateValue } from './digest'\nimport { assertExactObjectKeys as assertExactKeys } from './exact-object'\n\nconst SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/\n\nexport function terminalRecord(\n  claim: AgentCandidateExecutionClaim,\n  result: AgentCandidateExecutionTerminalResult,\n): AgentCandidateExecutionTerminalRecord {\n  const terminal = sealTerminalResult(result)\n  const value = {\n    executionId: claim.executionId,\n    attempt: claim.attempt,\n    bundleDigest: claim.bundleDigest,\n    executionPlanDigest: claim.executionPlanDigest,\n    preparationEvidence: claim.preparationEvidence,\n    ...terminal,\n  }\n  return immutableCandidateValue({\n    ...value,\n    terminalDigest: canonicalCandidateDigest(value),\n  }) as AgentCandidateExecutionTerminalRecord\n}\n\nexport function recoveredTerminalRecord(\n  claim: AgentCandidateExecutionClaim,\n  phase: AgentCandidateExecutionPhase,\n  evidence: AgentCandidateExecutionRecoveryEvidence,\n): AgentCandidateExecutionTerminalRecord {\n  const recovered = sealRecoveryEvidence(evidence, claim)\n  return terminalRecord(claim, {\n    status: 'failed',\n    failureClass:\n      recovered.failureClass === 'pre-model-infrastructure' && phase !== 'claimed'\n        ? 'unknown'\n        : recovered.failureClass,\n    usage: recovered.usage,\n    modelSettlement: recovered.modelSettlement,\n    ...(recovered.failureEvidence ? { failureEvidence: recovered.failureEvidence } : {}),\n  })\n}\n\nexport function assertTerminalAllowedInPhase(\n  phase: AgentCandidateExecutionPhase,\n  terminal: AgentCandidateExecutionTerminalRecord,\n): void {\n  if (\n    phase === 'candidate-may-run' &&\n    terminal.status === 'failed' &&\n    terminal.failureClass === 'pre-model-infrastructure'\n  ) {\n    throw new Error('candidate execution crossed candidate-may-run before pre-model failure')\n  }\n  if (\n    phase === 'claimed' &&\n    (terminal.status === 'succeeded' ||\n      (terminal.status === 'failed' &&\n        (terminal.failureClass === 'execution' ||\n          terminal.failureClass === 'post-model-infrastructure')))\n  ) {\n    throw new Error('candidate execution terminal requires candidate-may-run phase')\n  }\n}\n\nexport function rejectedFinish(\n  existing: AgentCandidateExecutionTerminalRecord,\n  requestedTerminalDigest: Sha256Digest,\n): AgentCandidateExecutionFinishResult {\n  return Object.freeze({\n    finished: false,\n    terminal: existing,\n    exactReplay: existing.terminalDigest === requestedTerminalDigest,\n  })\n}\n\nexport function rejectedStage(\n  existing: AgentCandidateExecutionTerminalRecord,\n  requested: AgentCandidateExecutionTerminalRecord,\n): AgentCandidateExecutionStageResult {\n  return Object.freeze({\n    staged: false,\n    terminal: existing,\n    exactReplay: existing.terminalDigest === requested.terminalDigest,\n  })\n}\n\nexport function requireStagedTerminal(\n  staged: AgentCandidateExecutionTerminalRecord | undefined,\n  terminalDigest: Sha256Digest,\n): AgentCandidateExecutionTerminalRecord {\n  if (!staged) throw new Error('candidate execution terminal has not been staged')\n  if (staged.terminalDigest !== terminalDigest) {\n    throw new Error('candidate execution terminal digest does not match staged outbox')\n  }\n  return staged\n}\n\nexport function sealTerminalDigest(value: Sha256Digest): Sha256Digest {\n  assertSha256Digest(value, 'terminalDigest')\n  return value\n}\n\nexport function assertRecoveryMatchesStaged(\n  staged: AgentCandidateExecutionTerminalRecord,\n  recovered: AgentCandidateExecutionTerminalRecord,\n): void {\n  if (\n    canonicalCandidateDigest(staged.usage) !== canonicalCandidateDigest(recovered.usage) ||\n    canonicalCandidateDigest(staged.modelSettlement) !==\n      canonicalCandidateDigest(recovered.modelSettlement)\n  ) {\n    throw new Error('candidate execution recovery evidence does not match staged model evidence')\n  }\n}\n\nexport function sealTerminalRecordValue(\n  value: Record<string, unknown>,\n  label: string,\n): AgentCandidateExecutionTerminalRecord {\n  const status = requireTerminalStatus(value.status, label)\n  assertExactKeys(\n    value,\n    status === 'succeeded'\n      ? [\n          'executionId',\n          'attempt',\n          'bundleDigest',\n          'executionPlanDigest',\n          'preparationEvidence',\n          'terminalDigest',\n          'status',\n          'usage',\n          'modelSettlement',\n          'taskOutcome',\n          'benchmarkResult',\n          'runReceipt',\n        ]\n      : [\n          'executionId',\n          'attempt',\n          'bundleDigest',\n          'executionPlanDigest',\n          'preparationEvidence',\n          'terminalDigest',\n          'status',\n          'failureClass',\n          'usage',\n          'modelSettlement',\n          ...(value.failureEvidence ? ['failureEvidence'] : []),\n        ],\n    label,\n  )\n  const executionPlanDigest = requireString(\n    value.executionPlanDigest,\n    label,\n    'executionPlanDigest',\n  ) as Sha256Digest\n  const identity = {\n    executionId: requireString(value.executionId, label, 'executionId'),\n    attempt: requireNumber(value.attempt, label, 'attempt'),\n    bundleDigest: requireString(value.bundleDigest, label, 'bundleDigest') as Sha256Digest,\n    executionPlanDigest,\n    preparationEvidence: sealCandidatePreparationEvidence(\n      value.preparationEvidence,\n      executionPlanDigest,\n    ),\n  }\n  assertExecutionId(identity.executionId)\n  if (!Number.isSafeInteger(identity.attempt) || identity.attempt < 1) {\n    throw new Error(`${label} has invalid attempt`)\n  }\n  assertSha256Digest(identity.bundleDigest, 'bundleDigest')\n  assertSha256Digest(identity.executionPlanDigest, 'executionPlanDigest')\n  if (identity.preparationEvidence.executionPlan.sha256 !== identity.executionPlanDigest) {\n    throw new Error(`${label} execution plan artifact does not match executionPlanDigest`)\n  }\n  const result = sealTerminalResult(\n    status === 'succeeded'\n      ? {\n          status,\n          usage: requireObject(value.usage, label, 'usage') as unknown as AgentCandidateFixedSpend,\n          modelSettlement: requireArtifactRef(value.modelSettlement, label, 'modelSettlement'),\n          taskOutcome: requireArtifactRef(value.taskOutcome, label, 'taskOutcome'),\n          benchmarkResult: requireArtifactRef(value.benchmarkResult, label, 'benchmarkResult'),\n          runReceipt: requireArtifactRef(value.runReceipt, label, 'runReceipt'),\n        }\n      : {\n          status,\n          failureClass: requireFailureClass(value.failureClass, label),\n          usage: requireObject(value.usage, label, 'usage') as unknown as AgentCandidateFixedSpend,\n          modelSettlement: requireArtifactRef(value.modelSettlement, label, 'modelSettlement'),\n          ...(value.failureEvidence\n            ? {\n                failureEvidence: requireArtifactRef(\n                  value.failureEvidence,\n                  label,\n                  'failureEvidence',\n                ),\n              }\n            : {}),\n        },\n  )\n  const material = { ...identity, ...result }\n  const terminalDigest = requireString(\n    value.terminalDigest,\n    label,\n    'terminalDigest',\n  ) as Sha256Digest\n  assertSha256Digest(terminalDigest, 'terminalDigest')\n  if (terminalDigest !== canonicalCandidateDigest(material)) {\n    throw new Error(`${label} has invalid terminalDigest`)\n  }\n  return immutableCandidateValue({\n    ...material,\n    terminalDigest,\n  }) as AgentCandidateExecutionTerminalRecord\n}\n\nexport function assertTerminalMatchesClaim(\n  terminal: AgentCandidateExecutionTerminalRecord,\n  claim: AgentCandidateExecutionClaim,\n  path: string,\n): void {\n  if (\n    terminal.executionId !== claim.executionId ||\n    terminal.attempt !== claim.attempt ||\n    terminal.bundleDigest !== claim.bundleDigest ||\n    terminal.executionPlanDigest !== claim.executionPlanDigest ||\n    canonicalCandidateDigest(terminal.preparationEvidence) !==\n      canonicalCandidateDigest(claim.preparationEvidence)\n  ) {\n    throw new Error(`candidate execution terminal record at ${path} does not match its claim`)\n  }\n}\n\nexport function assertTerminalMatchesStaged(\n  terminal: AgentCandidateExecutionTerminalRecord,\n  staged: AgentCandidateExecutionTerminalRecord,\n  path: string,\n): void {\n  if (\n    terminal.terminalDigest !== staged.terminalDigest ||\n    canonicalCandidateDigest(terminal) !== canonicalCandidateDigest(staged)\n  ) {\n    throw new Error(`candidate execution terminal record at ${path} differs from staged outbox`)\n  }\n}\n\nfunction sealRecoveryEvidence(\n  evidence: AgentCandidateExecutionRecoveryEvidence,\n  claim: AgentCandidateExecutionClaim,\n): AgentCandidateExecutionRecoveryEvidence {\n  assertExactKeys(\n    evidence,\n    [\n      'failureClass',\n      'usage',\n      'modelSettlement',\n      'process',\n      'model',\n      ...(evidence.failureEvidence ? ['failureEvidence'] : []),\n      ...(evidence.memory ? ['memory'] : []),\n    ],\n    'candidate execution recovery evidence',\n  )\n  assertFailureClass(evidence.failureClass)\n  const usage = sealUsage(evidence.usage)\n  if (evidence.failureClass === 'pre-model-infrastructure' && usage.modelCalls !== 0) {\n    throw new Error('pre-model infrastructure failure cannot contain model calls')\n  }\n  const modelSettlement = sealArtifactRef(evidence.modelSettlement, 'modelSettlement')\n  const failureEvidence = evidence.failureEvidence\n    ? sealArtifactRef(evidence.failureEvidence, 'failureEvidence')\n    : undefined\n  assertExactKeys(\n    evidence.process,\n    ['stopped', 'executionPlanDigest'],\n    'candidate execution process closure evidence',\n  )\n  if (\n    evidence.process.stopped !== true ||\n    evidence.process.executionPlanDigest !== claim.executionPlanDigest\n  ) {\n    throw new Error('candidate execution recovery does not prove the claimed process stopped')\n  }\n  assertExactKeys(\n    evidence.model,\n    ['closed', 'preparationId', 'grantDigest'],\n    'candidate execution model closure evidence',\n  )\n  if (\n    evidence.model.closed !== true ||\n    evidence.model.preparationId !== claim.cleanup.preparationId ||\n    evidence.model.grantDigest !== claim.cleanup.modelGrantDigest\n  ) {\n    throw new Error('candidate execution recovery does not prove the claimed model grant closed')\n  }\n  if (claim.cleanup.memory) {\n    if (!evidence.memory) {\n      throw new Error('candidate execution recovery is missing memory closure evidence')\n    }\n    assertExactKeys(\n      evidence.memory,\n      ['closed', 'preparationId', 'accessDigest', 'effectiveNamespace'],\n      'candidate execution memory closure evidence',\n    )\n    if (\n      evidence.memory.closed !== true ||\n      evidence.memory.preparationId !== claim.cleanup.preparationId ||\n      evidence.memory.accessDigest !== claim.cleanup.memory.accessDigest ||\n      evidence.memory.effectiveNamespace !== claim.cleanup.memory.effectiveNamespace\n    ) {\n      throw new Error(\n        'candidate execution recovery does not prove the claimed memory access closed',\n      )\n    }\n  } else if (evidence.memory !== undefined) {\n    throw new Error('candidate execution recovery has unexpected memory closure evidence')\n  }\n  return Object.freeze({\n    failureClass: evidence.failureClass,\n    usage,\n    modelSettlement,\n    ...(failureEvidence ? { failureEvidence } : {}),\n    process: Object.freeze({ ...evidence.process }),\n    model: Object.freeze({ ...evidence.model }),\n    ...(evidence.memory ? { memory: Object.freeze({ ...evidence.memory }) } : {}),\n  })\n}\n\nfunction sealTerminalResult(\n  result: AgentCandidateExecutionTerminalResult,\n): AgentCandidateExecutionTerminalResult {\n  if (result.status !== 'succeeded' && result.status !== 'failed') {\n    throw new Error('candidate execution terminal status is invalid')\n  }\n  assertExactKeys(\n    result,\n    result.status === 'succeeded'\n      ? ['status', 'usage', 'modelSettlement', 'taskOutcome', 'benchmarkResult', 'runReceipt']\n      : [\n          'status',\n          'failureClass',\n          'usage',\n          'modelSettlement',\n          ...(result.failureEvidence ? ['failureEvidence'] : []),\n        ],\n    'candidate execution terminal result',\n  )\n  const usage = sealUsage(result.usage)\n  const modelSettlement = sealArtifactRef(result.modelSettlement, 'modelSettlement')\n  if (result.status === 'succeeded') {\n    return Object.freeze({\n      status: 'succeeded',\n      usage,\n      modelSettlement,\n      taskOutcome: sealArtifactRef(result.taskOutcome, 'taskOutcome'),\n      benchmarkResult: sealArtifactRef(result.benchmarkResult, 'benchmarkResult'),\n      runReceipt: sealArtifactRef(result.runReceipt, 'runReceipt'),\n    })\n  }\n  assertFailureClass(result.failureClass)\n  if (result.failureClass === 'pre-model-infrastructure' && usage.modelCalls !== 0) {\n    throw new Error('pre-model infrastructure failure cannot contain model calls')\n  }\n  return Object.freeze({\n    status: 'failed',\n    failureClass: result.failureClass,\n    usage,\n    modelSettlement,\n    ...(result.failureEvidence\n      ? { failureEvidence: sealArtifactRef(result.failureEvidence, 'failureEvidence') }\n      : {}),\n  })\n}\n\nfunction sealUsage(usage: AgentCandidateFixedSpend): AgentCandidateFixedSpend {\n  assertExactKeys(\n    usage,\n    [\n      'costUsdNanos',\n      'inputTokens',\n      'outputTokens',\n      'cachedInputTokens',\n      'reasoningTokens',\n      'modelCalls',\n      'costProvenance',\n    ],\n    'candidate execution terminal usage',\n  )\n  for (const field of [\n    'costUsdNanos',\n    'inputTokens',\n    'outputTokens',\n    'cachedInputTokens',\n    'reasoningTokens',\n    'modelCalls',\n  ] as const) {\n    assertCount(usage[field], `terminal usage ${field}`)\n  }\n  if (usage.costProvenance !== 'observed' && usage.costProvenance !== 'estimated') {\n    throw new Error('terminal usage costProvenance must be observed or estimated')\n  }\n  return Object.freeze({\n    costUsdNanos: usage.costUsdNanos,\n    inputTokens: usage.inputTokens,\n    outputTokens: usage.outputTokens,\n    cachedInputTokens: usage.cachedInputTokens,\n    reasoningTokens: usage.reasoningTokens,\n    modelCalls: usage.modelCalls,\n    costProvenance: usage.costProvenance,\n  })\n}\n\nfunction sealArtifactRef(ref: AgentCandidateArtifactRef, label: string): AgentCandidateArtifactRef {\n  const parsed = agentCandidateArtifactRefSchema.parse(ref)\n  if (!Number.isSafeInteger(parsed.byteLength)) {\n    throw new Error(`candidate execution terminal ${label} byteLength exceeds safe integer range`)\n  }\n  return immutableCandidateValue(parsed)\n}\n\nfunction requireArtifactRef(\n  value: unknown,\n  path: string,\n  field: string,\n): AgentCandidateArtifactRef {\n  return requireObject(value, path, field) as unknown as AgentCandidateArtifactRef\n}\n\nfunction requireString(value: unknown, path: string, field: string): string {\n  if (typeof value !== 'string') {\n    throw new Error(`candidate execution record at ${path} has invalid ${field}`)\n  }\n  return value\n}\n\nfunction requireNumber(value: unknown, path: string, field: string): number {\n  if (typeof value !== 'number') {\n    throw new Error(`candidate execution record at ${path} has invalid ${field}`)\n  }\n  return value\n}\n\nfunction requireObject(value: unknown, path: string, field: string): Record<string, unknown> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`candidate execution record at ${path} has invalid ${field}`)\n  }\n  return value as Record<string, unknown>\n}\n\nfunction requireTerminalStatus(\n  value: unknown,\n  path: string,\n): AgentCandidateExecutionTerminalResult['status'] {\n  if (value !== 'succeeded' && value !== 'failed') {\n    throw new Error(`candidate execution terminal record at ${path} has invalid status`)\n  }\n  return value\n}\n\nfunction requireFailureClass(value: unknown, path: string): AgentCandidateExecutionFailureClass {\n  try {\n    assertFailureClass(value)\n    return value\n  } catch (error) {\n    throw new Error(`candidate execution terminal record at ${path} has invalid failureClass`, {\n      cause: error,\n    })\n  }\n}\n\nfunction assertFailureClass(value: unknown): asserts value is AgentCandidateExecutionFailureClass {\n  if (\n    value !== 'pre-model-infrastructure' &&\n    value !== 'execution' &&\n    value !== 'post-model-infrastructure' &&\n    value !== 'unknown'\n  ) {\n    throw new Error('candidate execution failureClass is invalid')\n  }\n}\n\nfunction assertExecutionId(value: unknown): asserts value is string {\n  if (typeof value !== 'string' || !/^[A-Za-z0-9._:-]{1,200}$/.test(value)) {\n    throw new Error('candidate execution claim executionId is invalid')\n  }\n}\n\nfunction assertSha256Digest(value: string, field: string): void {\n  if (!SHA256_PATTERN.test(value)) {\n    throw new Error(`candidate execution claim ${field} must be a lowercase sha256 digest`)\n  }\n}\n\nfunction assertCount(value: unknown, label: string): asserts value is number {\n  if (!Number.isSafeInteger(value) || (value as number) < 0) {\n    throw new Error(`candidate execution ${label} must be a non-negative safe integer`)\n  }\n}\n","export const DEFAULT_CANDIDATE_CLEANUP_TIMEOUT_MS = 30_000\n/** Largest delay Node schedules without clamping to one millisecond. */\nexport const MAX_CANDIDATE_TIMER_INTERVAL_MS = 2_147_483_647\n\nexport function candidateCleanupTimeout(timeoutMs: number | undefined): number {\n  const effective = timeoutMs ?? DEFAULT_CANDIDATE_CLEANUP_TIMEOUT_MS\n  if (\n    !Number.isSafeInteger(effective) ||\n    effective <= 0 ||\n    effective > MAX_CANDIDATE_TIMER_INTERVAL_MS\n  ) {\n    throw new Error('candidate cleanup timeout is outside the supported timer range')\n  }\n  return effective\n}\n\nexport function candidateCleanupDeadline(timeoutMs: number | undefined): number {\n  return Date.now() + candidateCleanupTimeout(timeoutMs)\n}\n\n/** Freeze a separate result-construction budget; defaults to the task wall limit. */\nexport function candidateResultTimeout(\n  timeoutMs: number | undefined,\n  taskTimeoutMs: number,\n): number {\n  const effective = timeoutMs ?? taskTimeoutMs\n  if (\n    !Number.isSafeInteger(effective) ||\n    effective <= 0 ||\n    effective > MAX_CANDIDATE_TIMER_INTERVAL_MS\n  ) {\n    throw new Error('candidate result timeout is outside the supported timer range')\n  }\n  return effective\n}\n\n/** Bound an evaluator cleanup call and cancel the underlying port at expiry. */\nexport async function withinCandidateCleanupDeadline<T>(\n  operation: (signal: AbortSignal) => Promise<T>,\n  deadlineAtMs: number,\n  label: string,\n): Promise<T> {\n  return withinCandidateDeadline(operation, deadlineAtMs, new CandidateCleanupTimeoutError(label))\n}\n\n/**\n * Bound cancellable scoring/result work. Every side-effecting port called by\n * `operation` must honor the supplied signal before durable publication.\n */\nexport async function withinCandidateResultDeadline<T>(\n  operation: (signal: AbortSignal) => Promise<T>,\n  deadlineAtMs: number,\n  label: string,\n): Promise<T> {\n  return withinCandidateDeadline(operation, deadlineAtMs, new CandidateResultTimeoutError(label))\n}\n\nasync function withinCandidateDeadline<T>(\n  operation: (signal: AbortSignal) => Promise<T>,\n  deadlineAtMs: number,\n  timeoutError: Error,\n): Promise<T> {\n  const remainingMs = deadlineAtMs - Date.now()\n  if (remainingMs <= 0) throw timeoutError\n\n  const controller = new AbortController()\n  const pending = Promise.resolve().then(() => operation(controller.signal))\n  void pending.catch(() => undefined)\n  let timer: ReturnType<typeof setTimeout> | undefined\n  try {\n    const result = await Promise.race([\n      pending,\n      new Promise<never>((_resolve, reject) => {\n        timer = setTimeout(() => {\n          controller.abort(timeoutError)\n          reject(timeoutError)\n        }, remainingMs)\n      }),\n    ])\n    // Exact-boundary completion is ambiguous under event-loop delay.\n    if (Date.now() >= deadlineAtMs) {\n      controller.abort(timeoutError)\n      throw timeoutError\n    }\n    return result\n  } finally {\n    if (timer) clearTimeout(timer)\n  }\n}\n\nexport class CandidateCleanupTimeoutError extends Error {\n  constructor(label: string) {\n    super(`${label} did not complete before the evaluator cleanup deadline`)\n    this.name = 'CandidateCleanupTimeoutError'\n  }\n}\n\nexport class CandidateResultTimeoutError extends Error {\n  constructor(label: string) {\n    super(`${label} did not complete before the evaluator result deadline`)\n    this.name = 'CandidateResultTimeoutError'\n  }\n}\n","import { MAX_CANDIDATE_TIMER_INTERVAL_MS } from './cleanup'\n\nexport const CANDIDATE_TERMINAL_PERSISTENCE_MARGIN_MS = 10_000\nconst CANDIDATE_POST_RUN_CLEANUP_PHASES = 4\n\n/** Process stop, access closure, model evidence, and task/result evidence. */\nexport function candidatePostRunWindowMs(\n  cleanupTimeoutMs: number,\n  resultTimeoutMs: number,\n): number {\n  const windowMs =\n    cleanupTimeoutMs * CANDIDATE_POST_RUN_CLEANUP_PHASES +\n    resultTimeoutMs +\n    CANDIDATE_TERMINAL_PERSISTENCE_MARGIN_MS\n  if (!Number.isSafeInteger(windowMs) || windowMs > MAX_CANDIDATE_TIMER_INTERVAL_MS) {\n    throw new Error('candidate post-run window exceeds the supported timer range')\n  }\n  return windowMs\n}\n\n/** Maximum owner lifetime from claim through process stop, access closure, and terminal write. */\nexport function candidateExecutionOwnerWindowMs(\n  timeoutMs: number,\n  cleanupTimeoutMs: number,\n  resultTimeoutMs: number,\n): number {\n  const windowMs = timeoutMs + candidatePostRunWindowMs(cleanupTimeoutMs, resultTimeoutMs)\n  if (!Number.isSafeInteger(windowMs) || windowMs > MAX_CANDIDATE_TIMER_INTERVAL_MS) {\n    throw new Error('candidate execution and cleanup window exceeds the supported timer range')\n  }\n  return windowMs\n}\n\n/** Time reserved after scoring for failure evidence plus terminal publication. */\nexport function candidateTerminalWindowMs(cleanupTimeoutMs: number): number {\n  const windowMs = cleanupTimeoutMs + CANDIDATE_TERMINAL_PERSISTENCE_MARGIN_MS\n  if (!Number.isSafeInteger(windowMs) || windowMs > MAX_CANDIDATE_TIMER_INTERVAL_MS) {\n    throw new Error('candidate terminal window exceeds the supported timer range')\n  }\n  return windowMs\n}\n","import { constants as fsConstants } from 'node:fs'\nimport { lstat, open, readdir, realpath } from 'node:fs/promises'\nimport { relative, resolve, sep } from 'node:path'\n\nimport type {\n  AgentCandidateArtifactRef,\n  AgentCandidateCapturedArtifact,\n  AgentCandidateProfilePlanMaterial,\n  AgentCandidateWorkspaceManifestMaterial,\n  AgentCandidateWorkspaceSnapshotEvidence,\n} from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateBytes, sha256Bytes } from './digest'\nimport type { AgentCandidateArtifactPort } from './types'\n\nexport function artifactCacheKey(artifact: AgentCandidateCapturedArtifact): string {\n  return `${artifact.sha256}:${artifact.byteLength}`\n}\n\nexport async function readVerifiedArtifact(\n  artifact: AgentCandidateCapturedArtifact,\n  port: AgentCandidateArtifactPort,\n): Promise<Uint8Array> {\n  const bytes =\n    'content' in artifact\n      ? Buffer.from(artifact.content, 'base64')\n      : await port.read(artifact as AgentCandidateArtifactRef)\n  verifyBytes(bytes, artifact.sha256, artifact.byteLength, 'candidate artifact')\n  return Uint8Array.from(bytes)\n}\n\nexport function verifyBytes(\n  bytes: Uint8Array,\n  digest: string,\n  byteLength: number,\n  label: string,\n): void {\n  if (bytes.byteLength !== byteLength) {\n    throw new Error(`${label} byte length ${bytes.byteLength} does not match ${byteLength}`)\n  }\n  const actual = sha256Bytes(bytes)\n  if (actual !== digest) {\n    throw new Error(`${label} digest ${actual} does not match ${digest}`)\n  }\n}\n\nexport async function verifyWorkspaceSnapshotArtifacts(\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n  port: AgentCandidateArtifactPort,\n): Promise<{ manifest: Uint8Array; archive: Uint8Array }> {\n  const [manifest, archive] = await Promise.all([\n    readVerifiedArtifact(snapshot.manifest, port),\n    readVerifiedArtifact(snapshot.archive, port),\n  ])\n  const canonicalManifest = canonicalCandidateBytes(snapshot.material)\n  if (!Buffer.from(manifest).equals(Buffer.from(canonicalManifest))) {\n    throw new Error('workspace manifest artifact is not the exact canonical manifest material')\n  }\n  if (sha256Bytes(canonicalManifest) !== snapshot.digest) {\n    throw new Error('workspace snapshot digest does not match its canonical manifest material')\n  }\n  return { manifest, archive }\n}\n\nexport async function verifyMaterializedWorkspace(\n  root: string,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n  options: { ignoredProtectedRootEntries?: readonly ('.git' | '.sidecar')[] } = {},\n): Promise<void> {\n  const observed = await scanWorkspace(root, new Set(options.ignoredProtectedRootEntries ?? []))\n  assertWorkspaceManifest(observed.manifest, expected)\n}\n\nexport async function captureMaterializedWorkspace(\n  root: string,\n  options: {\n    ignoredProtectedRootEntries?: readonly ('.git' | '.sidecar')[]\n    limits?: {\n      maxFiles: number\n      maxFileBytes: number\n      maxTotalFileBytes: number\n    }\n  } = {},\n): Promise<{\n  manifest: AgentCandidateWorkspaceManifestMaterial\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>\n}> {\n  const observed = await scanWorkspace(\n    root,\n    new Set(options.ignoredProtectedRootEntries ?? []),\n    options.limits,\n  )\n  return {\n    manifest: observed.manifest,\n    files: observed.files.map((file) => ({\n      path: file.path,\n      mode: file.mode,\n      bytes: Uint8Array.from(file.bytes),\n    })),\n  }\n}\n\n/** Capture exact verified regular-file bytes for fresh isolated materialization. */\nexport async function readMaterializedWorkspaceFiles(\n  root: string,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n  options: { ignoredProtectedRootEntries?: readonly ('.git' | '.sidecar')[] } = {},\n): Promise<ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>> {\n  const observed = await captureMaterializedWorkspace(root, options)\n  assertWorkspaceManifest(observed.manifest, expected)\n  return observed.files.map((file) =>\n    Object.freeze({ path: file.path, mode: file.mode, bytes: Uint8Array.from(file.bytes) }),\n  )\n}\n\nexport function candidateWorkspaceManifest(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n): AgentCandidateWorkspaceManifestMaterial {\n  return {\n    kind: 'agent-candidate-workspace-manifest',\n    files: files\n      .map((file) => ({\n        path: file.path,\n        mode: file.mode,\n        sha256: sha256Bytes(file.bytes),\n        byteLength: file.bytes.byteLength,\n      }))\n      .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)),\n  }\n}\n\nfunction assertWorkspaceManifest(\n  observed: AgentCandidateWorkspaceManifestMaterial,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n): void {\n  if (!Buffer.from(canonicalCandidateBytes(observed)).equals(canonicalCandidateBytes(expected))) {\n    throw new Error(\n      'materialized workspace files, modes, or bytes do not match the signed manifest',\n    )\n  }\n}\n\nexport async function verifyMaterializedProfileWorkspace(\n  root: string,\n  expected: AgentCandidateProfilePlanMaterial,\n): Promise<void> {\n  const observed = await scanWorkspace(root, new Set())\n  const observedProfile = observed.manifest.files.map(({ path, mode, sha256 }) => ({\n    relPath: path,\n    mode,\n    contentSha256: sha256,\n  }))\n  if (\n    !Buffer.from(canonicalCandidateBytes(observedProfile)).equals(\n      canonicalCandidateBytes(expected.files),\n    )\n  ) {\n    throw new Error('profile staging files, modes, or bytes do not match the signed profile plan')\n  }\n}\n\nasync function scanWorkspace(\n  root: string,\n  ignoredProtectedRootEntries: ReadonlySet<string>,\n  limits?: {\n    maxFiles: number\n    maxFileBytes: number\n    maxTotalFileBytes: number\n  },\n): Promise<{\n  manifest: AgentCandidateWorkspaceManifestMaterial\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n}> {\n  const absoluteRoot = resolve(root)\n  const rootStats = await lstat(absoluteRoot)\n  if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) {\n    throw new Error('workspace root must be a real directory')\n  }\n  if ((await realpath(absoluteRoot)) !== absoluteRoot) {\n    throw new Error('workspace root has a symlinked path component')\n  }\n  const capturedFiles: Array<{ path: string; mode: number; bytes: Uint8Array }> = []\n  let totalBytes = 0\n\n  async function visit(directory: string): Promise<void> {\n    const entries = await readdir(directory, { withFileTypes: true })\n    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))\n    for (const entry of entries) {\n      if (directory === absoluteRoot && ignoredProtectedRootEntries.has(entry.name)) {\n        continue\n      }\n      const absolute = resolve(directory, entry.name)\n      const relPath = relative(absoluteRoot, absolute).split(sep).join('/')\n      if (!relPath || relPath.startsWith('../') || relPath.includes('/../')) {\n        throw new Error(`workspace entry escapes root: ${relPath}`)\n      }\n      const stats = await lstat(absolute)\n      if (stats.isSymbolicLink()) {\n        throw new Error(`workspace contains a symlink: ${relPath}`)\n      }\n      if (stats.isDirectory()) {\n        await visit(absolute)\n        continue\n      }\n      if (!stats.isFile()) {\n        throw new Error(`workspace contains a non-regular entry: ${relPath}`)\n      }\n      if (limits && capturedFiles.length >= limits.maxFiles) {\n        throw new Error('workspace exceeds maxFiles')\n      }\n      const descriptor = await open(\n        absolute,\n        fsConstants.O_RDONLY |\n          (typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0),\n      )\n      try {\n        const openedStats = await descriptor.stat()\n        if (!openedStats.isFile()) {\n          throw new Error(`workspace contains a non-regular entry: ${relPath}`)\n        }\n        if (openedStats.nlink !== 1) {\n          throw new Error(`workspace contains a hard-linked file: ${relPath}`)\n        }\n        const mode = openedStats.mode & 0o777\n        if (limits && openedStats.size > limits.maxFileBytes) {\n          throw new Error(`workspace file exceeds maxFileBytes: ${relPath}`)\n        }\n        const remainingBytes = limits ? limits.maxTotalFileBytes - totalBytes : undefined\n        if (remainingBytes !== undefined && openedStats.size > remainingBytes) {\n          throw new Error('workspace exceeds maxTotalFileBytes')\n        }\n        const bytes = await readBoundedFile(\n          descriptor,\n          limits ? Math.min(limits.maxFileBytes, remainingBytes ?? limits.maxFileBytes) : undefined,\n          relPath,\n        )\n        totalBytes += bytes.byteLength\n        capturedFiles.push({ path: relPath, mode, bytes: Uint8Array.from(bytes) })\n      } finally {\n        await descriptor.close()\n      }\n    }\n  }\n\n  await visit(absoluteRoot)\n  return {\n    manifest: candidateWorkspaceManifest(capturedFiles),\n    files: capturedFiles,\n  }\n}\n\nasync function readBoundedFile(\n  descriptor: Awaited<ReturnType<typeof open>>,\n  maxBytes: number | undefined,\n  path: string,\n): Promise<Buffer> {\n  if (maxBytes === undefined) return await descriptor.readFile()\n  const chunks: Buffer[] = []\n  let total = 0\n  while (true) {\n    const remaining = maxBytes - total\n    const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, remaining + 1))\n    const { bytesRead } = await descriptor.read(chunk, 0, chunk.byteLength, null)\n    if (bytesRead === 0) break\n    total += bytesRead\n    if (total > maxBytes) throw new Error(`workspace file exceeds its capture limit: ${path}`)\n    chunks.push(chunk.subarray(0, bytesRead))\n  }\n  return Buffer.concat(chunks, total)\n}\n","import { spawn } from 'node:child_process'\nimport { mkdir, mkdtemp, readFile, realpath, rm, stat } from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { join, resolve } from 'node:path'\n\nimport type {\n  AgentCandidateCode,\n  AgentCandidateGitHubRepository,\n  AgentCandidateGitHubResource,\n  AgentCandidateWorkspaceManifestMaterial,\n} from '@tangle-network/agent-interface'\n\nimport { candidateWorkspaceManifest, verifyBytes } from './artifacts'\nimport { canonicalCandidateBytes } from './digest'\nimport type { AgentCandidateRepositoryPort } from './types'\n\ninterface GitResult {\n  stdout: Buffer\n  stderr: Buffer\n}\n\nexport async function verifyCandidateCode(\n  code: AgentCandidateCode,\n  repositories: AgentCandidateRepositoryPort,\n  patchBytes?: Uint8Array,\n): Promise<string | undefined> {\n  if (code.kind === 'disabled') return undefined\n  const repositoryRoot = await verifiedRepositoryRoot(code.repository, repositories)\n  await assertCommitAndBaseTree(repositoryRoot, code.baseCommit, code.baseTree)\n\n  if (code.kind === 'no-op') {\n    await assertSafeTree(repositoryRoot, code.baseTree)\n    return code.baseTree\n  }\n  if (!patchBytes) throw new Error('git-patch candidate is missing verified patch bytes')\n\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-git-'))\n  try {\n    const indexFile = join(temporary, 'index')\n    await runCandidateGit(repositoryRoot, ['read-tree', code.baseTree], undefined, {\n      GIT_INDEX_FILE: indexFile,\n    })\n    await runCandidateGit(\n      repositoryRoot,\n      ['apply', '--cached', '--binary', '--whitespace=nowarn', '-'],\n      patchBytes,\n      { GIT_INDEX_FILE: indexFile },\n    )\n    const candidateTree = (\n      await runCandidateGit(repositoryRoot, ['write-tree'], undefined, {\n        GIT_INDEX_FILE: indexFile,\n      })\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (candidateTree !== code.candidateTree) {\n      throw new Error(\n        `git patch materialized tree ${candidateTree} does not match ${code.candidateTree}`,\n      )\n    }\n    await assertSafeTree(repositoryRoot, candidateTree)\n    return candidateTree\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nexport async function readCandidateGitHubResource(\n  resource: AgentCandidateGitHubResource,\n  repositories: AgentCandidateRepositoryPort,\n): Promise<Uint8Array> {\n  const repositoryRoot = await verifiedRepositoryRoot(resource.repository, repositories)\n  const commitType = (\n    await runCandidateGit(repositoryRoot, ['cat-file', '-t', resource.commit])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (commitType !== 'commit') {\n    throw new Error(`GitHub resource commit is not a commit object: ${resource.commit}`)\n  }\n  const listing = (\n    await runCandidateGit(repositoryRoot, ['ls-tree', '-z', resource.commit, '--', resource.path])\n  ).stdout\n  const entries = parseTreeEntries(listing)\n  if (entries.length !== 1 || entries[0]?.path !== resource.path) {\n    throw new Error(`GitHub resource path is not one exact file: ${resource.path}`)\n  }\n  const entry = entries[0]\n  if (entry?.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n    throw new Error(`GitHub resource path is not a regular Git blob: ${resource.path}`)\n  }\n  const bytes = (await runCandidateGit(repositoryRoot, ['cat-file', 'blob', entry.object])).stdout\n  verifyBytes(bytes, resource.sha256, resource.byteLength, `GitHub resource ${resource.path}`)\n  return Uint8Array.from(bytes)\n}\n\nexport async function verifyTaskCheckout(\n  taskRoot: string,\n  expected: { baseCommit: string; baseTree: string },\n): Promise<void> {\n  const root = resolve(taskRoot)\n  const head = (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout.toString('utf8').trim()\n  if (head !== expected.baseCommit) {\n    throw new Error(`task checkout HEAD ${head} does not match ${expected.baseCommit}`)\n  }\n  const tree = (await runCandidateGit(root, ['rev-parse', 'HEAD^{tree}'])).stdout\n    .toString('utf8')\n    .trim()\n  if (tree !== expected.baseTree) {\n    throw new Error(`task checkout base tree ${tree} does not match ${expected.baseTree}`)\n  }\n}\n\n/**\n * Apply an evaluator-captured binary diff in a detached object database and\n * prove its result tree exactly matches the captured after-state manifest.\n */\nexport async function verifyTaskOutcomePatch(input: {\n  repositoryRoot: string\n  baseCommit: string\n  baseTree: string\n  resultTree: string\n  patch: Uint8Array\n  afterState: AgentCandidateWorkspaceManifestMaterial\n}): Promise<{ resultTree: string; resultCommit: string }> {\n  const repositoryRoot = resolve(input.repositoryRoot)\n  await verifyTaskCheckout(repositoryRoot, input)\n  const gitDir = resolve(\n    (await runCandidateGit(repositoryRoot, ['rev-parse', '--absolute-git-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(gitDir)) !== gitDir || gitDir.includes(':')) {\n    throw new Error('task Git object store has an unsupported path')\n  }\n  await assertNoGitIndirection(repositoryRoot, gitDir, 'task repository')\n\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-task-outcome-'))\n  try {\n    const objectDirectory = join(temporary, 'objects')\n    const indexFile = join(temporary, 'index')\n    await mkdir(objectDirectory)\n    const gitEnvironment = {\n      GIT_INDEX_FILE: indexFile,\n      GIT_OBJECT_DIRECTORY: objectDirectory,\n      GIT_ALTERNATE_OBJECT_DIRECTORIES: join(gitDir, 'objects'),\n    }\n    await runCandidateGit(repositoryRoot, ['read-tree', input.baseTree], undefined, gitEnvironment)\n    if (input.patch.byteLength > 0) {\n      await runCandidateGit(\n        repositoryRoot,\n        ['apply', '--cached', '--binary', '--whitespace=nowarn', '-'],\n        input.patch,\n        gitEnvironment,\n      )\n    }\n    const resultTree = (\n      await runCandidateGit(repositoryRoot, ['write-tree'], undefined, gitEnvironment)\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (resultTree !== input.resultTree) {\n      throw new Error(\n        `task outcome patch materialized tree ${resultTree} does not match ${input.resultTree}`,\n      )\n    }\n    await assertSafeTree(repositoryRoot, resultTree, gitEnvironment)\n    const observed = await workspaceManifestFromGitTree(repositoryRoot, resultTree, gitEnvironment)\n    if (\n      !Buffer.from(canonicalCandidateBytes(observed)).equals(\n        Buffer.from(canonicalCandidateBytes(input.afterState)),\n      )\n    ) {\n      throw new Error('task outcome after-state does not match the materialized result tree')\n    }\n    const resultCommit = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['commit-tree', resultTree, '-p', input.baseCommit],\n        Buffer.from('candidate task outcome\\n', 'utf8'),\n        {\n          ...gitEnvironment,\n          GIT_AUTHOR_NAME: 'Tangle Evaluator',\n          GIT_AUTHOR_EMAIL: 'evaluator@tangle.tools',\n          GIT_AUTHOR_DATE: '2000-01-01T00:00:00Z',\n          GIT_COMMITTER_NAME: 'Tangle Evaluator',\n          GIT_COMMITTER_EMAIL: 'evaluator@tangle.tools',\n          GIT_COMMITTER_DATE: '2000-01-01T00:00:00Z',\n        },\n      )\n    ).stdout\n      .toString('utf8')\n      .trim()\n    const committedTree = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['rev-parse', `${resultCommit}^{tree}`],\n        undefined,\n        gitEnvironment,\n      )\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (committedTree !== resultTree) {\n      throw new Error('task outcome evaluator commit does not bind the verified result tree')\n    }\n    return { resultTree, resultCommit }\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nasync function verifiedRepositoryRoot(\n  repository: AgentCandidateGitHubRepository,\n  repositories: AgentCandidateRepositoryPort,\n): Promise<string> {\n  const repositoryRoot = resolve(await repositories.resolve(repository))\n  const rootStats = await stat(repositoryRoot)\n  if (!rootStats.isDirectory()) throw new Error('candidate repository path is not a directory')\n\n  const origin = (await runCandidateGit(repositoryRoot, ['remote', 'get-url', 'origin'])).stdout\n    .toString('utf8')\n    .trim()\n  const actual = parseGitHubRemote(origin)\n  if (!actual || actual.owner !== repository.owner || actual.repo !== repository.repo) {\n    throw new Error(\n      `local repository origin ${origin || '<missing>'} does not match github.com/${repository.owner}/${repository.repo}`,\n    )\n  }\n\n  const gitDirText = (\n    await runCandidateGit(repositoryRoot, ['rev-parse', '--absolute-git-dir'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  const gitDir = resolve(gitDirText)\n  await assertNoGitIndirection(repositoryRoot, gitDir, 'candidate repository')\n  return repositoryRoot\n}\n\nexport async function assertNoGitIndirection(\n  repositoryRoot: string,\n  gitDir: string,\n  label: string,\n): Promise<void> {\n  const replacements = (\n    await runCandidateGit(repositoryRoot, ['for-each-ref', '--format=%(refname)', 'refs/replace'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (replacements) throw new Error(`${label} contains Git replace refs`)\n  const commonDir = resolve(\n    repositoryRoot,\n    (await runCandidateGit(repositoryRoot, ['rev-parse', '--git-common-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(commonDir)) !== commonDir || commonDir.includes(':')) {\n    throw new Error(`${label} Git common directory has an unsupported path`)\n  }\n  for (const objectRoot of new Set([gitDir, commonDir])) {\n    for (const name of ['alternates', 'http-alternates']) {\n      const path = join(objectRoot, 'objects', 'info', name)\n      try {\n        const contents = await readFile(path, 'utf8')\n        if (contents.trim()) throw new Error(`${label} uses forbidden Git ${name}`)\n      } catch (error) {\n        if (!isNoEntry(error)) throw error\n      }\n    }\n  }\n}\n\nasync function assertCommitAndBaseTree(\n  repositoryRoot: string,\n  commit: string,\n  expectedTree: string,\n): Promise<void> {\n  const type = (await runCandidateGit(repositoryRoot, ['cat-file', '-t', commit])).stdout\n    .toString('utf8')\n    .trim()\n  if (type !== 'commit') throw new Error(`candidate base object is not a commit: ${commit}`)\n  const actualTree = (\n    await runCandidateGit(repositoryRoot, ['rev-parse', `${commit}^{tree}`])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (actualTree !== expectedTree) {\n    throw new Error(`candidate base commit tree ${actualTree} does not match ${expectedTree}`)\n  }\n}\n\nasync function assertSafeTree(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string> = {},\n): Promise<void> {\n  const listing = (\n    await runCandidateGit(\n      repositoryRoot,\n      ['ls-tree', '-rz', '--full-tree', tree],\n      undefined,\n      environment,\n    )\n  ).stdout\n  const entries = parseTreeEntries(listing)\n  if (entries.length === 0) throw new Error('candidate Git tree cannot be empty')\n  for (const entry of entries) {\n    if (entry.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n      throw new Error(\n        `candidate Git tree contains a symlink, submodule, or non-blob: ${entry.path}`,\n      )\n    }\n    assertSafeGitPath(entry.path)\n  }\n}\n\nasync function workspaceManifestFromGitTree(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string>,\n): Promise<AgentCandidateWorkspaceManifestMaterial> {\n  return candidateWorkspaceManifest(\n    await readCandidateGitTreeFiles(repositoryRoot, tree, environment),\n  )\n}\n\nexport async function readCandidateGitTreeFiles(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string> = {},\n  limits?: { maxFiles: number; maxFileBytes: number; maxTotalFileBytes: number },\n): Promise<Array<{ path: string; mode: 0o644 | 0o755; bytes: Uint8Array }>> {\n  const listing = (\n    await runCandidateGit(\n      repositoryRoot,\n      ['ls-tree', '-rzl', '--full-tree', tree],\n      undefined,\n      environment,\n    )\n  ).stdout\n  const files: Array<{ path: string; mode: 0o644 | 0o755; bytes: Uint8Array }> = []\n  const entries = parseTreeEntries(listing)\n  if (limits && entries.length > limits.maxFiles) {\n    throw new Error('candidate Git tree exceeds maxFiles')\n  }\n  let totalBytes = 0\n  for (const entry of entries) {\n    if (entry.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n      throw new Error(`candidate Git tree contains a non-regular file: ${entry.path}`)\n    }\n    assertSafeGitPath(entry.path)\n    if (entry.size === undefined) {\n      throw new Error(`candidate Git tree is missing blob size: ${entry.path}`)\n    }\n    if (limits && entry.size > limits.maxFileBytes) {\n      throw new Error(`candidate Git tree file exceeds maxFileBytes: ${entry.path}`)\n    }\n    totalBytes += entry.size\n    if (limits && totalBytes > limits.maxTotalFileBytes) {\n      throw new Error('candidate Git tree exceeds maxTotalFileBytes')\n    }\n    const bytes = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['cat-file', 'blob', entry.object],\n        undefined,\n        environment,\n      )\n    ).stdout\n    if (bytes.byteLength !== entry.size) {\n      throw new Error(`candidate Git blob size changed: ${entry.path}`)\n    }\n    files.push({\n      path: entry.path,\n      mode: entry.mode === '100755' ? 0o755 : 0o644,\n      bytes: Uint8Array.from(bytes),\n    })\n  }\n  return files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))\n}\n\nfunction parseTreeEntries(bytes: Uint8Array): Array<{\n  mode: string\n  type: string\n  object: string\n  size?: number\n  path: string\n}> {\n  const raw = Buffer.from(bytes)\n  const decoded = raw.toString('utf8')\n  if (!Buffer.from(decoded, 'utf8').equals(raw)) {\n    throw new Error('candidate Git tree contains a non-UTF-8 path')\n  }\n  const rows = decoded.split('\\0').filter(Boolean)\n  return rows.map((row) => {\n    const tab = row.indexOf('\\t')\n    const header = row.slice(0, tab).split(' ').filter(Boolean)\n    const path = row.slice(tab + 1)\n    const [mode, type, object, sizeText] = header\n    if (tab < 1 || !mode || !type || !object || !path) {\n      throw new Error('malformed Git tree entry')\n    }\n    const size = sizeText && /^\\d+$/.test(sizeText) ? Number(sizeText) : undefined\n    if (size !== undefined && !Number.isSafeInteger(size)) {\n      throw new Error('candidate Git tree entry size exceeds the safe integer range')\n    }\n    return { mode, type, object, ...(size === undefined ? {} : { size }), path }\n  })\n}\n\nfunction assertSafeGitPath(path: string): void {\n  if (\n    !path ||\n    path.startsWith('/') ||\n    path.includes('\\\\') ||\n    path.includes('\\0') ||\n    hasControlCharacter(path) ||\n    path.split('/').some((part) => !part || part === '.' || part === '..') ||\n    path.split('/')[0]?.toLowerCase() === '.git'\n  ) {\n    throw new Error(`candidate Git tree contains an unsafe path: ${path}`)\n  }\n}\n\nfunction hasControlCharacter(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code < 0x20 || code === 0x7f) return true\n  }\n  return false\n}\n\nfunction parseGitHubRemote(value: string): { owner: string; repo: string } | undefined {\n  const match = value.match(\n    /^(?:https?:\\/\\/github\\.com\\/|ssh:\\/\\/git@github\\.com\\/|git@github\\.com:)([^/]+)\\/([^/]+?)(?:\\.git)?$/,\n  )\n  if (!match?.[1] || !match[2]) return undefined\n  return { owner: match[1], repo: match[2] }\n}\n\nexport async function runCandidateGit(\n  repositoryRoot: string,\n  args: string[],\n  input?: Uint8Array,\n  extraEnv: Record<string, string> = {},\n): Promise<GitResult> {\n  const env = Object.fromEntries(\n    Object.entries(process.env).filter(([name]) => !name.startsWith('GIT_')),\n  ) as Record<string, string>\n  Object.assign(env, {\n    GIT_CONFIG_NOSYSTEM: '1',\n    GIT_CONFIG_GLOBAL: '/dev/null',\n    GIT_CONFIG_SYSTEM: '/dev/null',\n    GIT_TERMINAL_PROMPT: '0',\n    GIT_NO_REPLACE_OBJECTS: '1',\n    LC_ALL: 'C',\n    ...extraEnv,\n  })\n  const fullArgs = [\n    '-c',\n    'core.hooksPath=/dev/null',\n    '-c',\n    'core.fsmonitor=false',\n    '-c',\n    'core.untrackedCache=false',\n    '-c',\n    'protocol.file.allow=never',\n    '-C',\n    repositoryRoot,\n    ...args,\n  ]\n  return await new Promise((resolveResult, reject) => {\n    const child = spawn('git', fullArgs, { env, stdio: ['pipe', 'pipe', 'pipe'] })\n    const stdout: Buffer[] = []\n    const stderr: Buffer[] = []\n    child.stdout.on('data', (chunk: Buffer) => stdout.push(chunk))\n    child.stderr.on('data', (chunk: Buffer) => stderr.push(chunk))\n    child.on('error', reject)\n    child.on('close', (code, signal) => {\n      const out = Buffer.concat(stdout)\n      const err = Buffer.concat(stderr)\n      if (code !== 0) {\n        reject(\n          new Error(\n            `git ${args[0] ?? '<command>'} failed (${signal ?? code}): ${err.toString('utf8').trim()}`,\n          ),\n        )\n        return\n      }\n      resolveResult({ stdout: out, stderr: err })\n    })\n    if (input) child.stdin.end(input)\n    else child.stdin.end()\n  })\n}\n\nfunction isNoEntry(error: unknown): boolean {\n  return (\n    typeof error === 'object' &&\n    error !== null &&\n    'code' in error &&\n    (error as { code?: string }).code === 'ENOENT'\n  )\n}\n","import type { BenchmarkEvaluation, TraceStore } from '@tangle-network/agent-eval'\nimport type {\n  AgentCandidateArtifactRef,\n  AgentCandidateAttemptPolicy,\n  AgentCandidateBenchmarkSuite,\n  AgentCandidateBenchmarkTask,\n  AgentCandidateBundle,\n  AgentCandidateCapturedArtifact,\n  AgentCandidateContainer,\n  AgentCandidateEffectiveMemory,\n  AgentCandidateExecutionLimits,\n  AgentCandidateExecutionPlanEvidence,\n  AgentCandidateFixedSpend,\n  AgentCandidateGitHubRepository,\n  AgentCandidateInstructionDelivery,\n  AgentCandidateKnowledgeRef,\n  AgentCandidateMaterializationReceipt,\n  AgentCandidateMemoryReceipt,\n  AgentCandidateModelAccessNetwork,\n  AgentCandidateModelSettlementCall,\n  AgentCandidateOciPlatform,\n  AgentCandidateProfileActivation,\n  AgentCandidateProfilePlanEvidence,\n  AgentCandidateResolvedModel,\n  AgentCandidateRunCell,\n  AgentCandidateRunReceipt,\n  AgentCandidateTaskOutcomeEvidence,\n  AgentCandidateTaskOutcomeMaterial,\n  AgentCandidateTaskOutputSpec,\n  AgentCandidateTermination,\n  AgentCandidateWorkspaceManifestMaterial,\n  AgentCandidateWorkspaceSnapshotEvidence,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nexport const verifiedCandidateBrand: unique symbol = Symbol('verifiedAgentCandidate')\nexport const preparedCandidateBrand: unique symbol = Symbol('preparedAgentCandidate')\nexport const verifiedTaskOutcomeBrand: unique symbol = Symbol('verifiedTaskOutcome')\n\n/** Reads one content-addressed object from the closed S3/IPFS locator set. */\nexport interface AgentCandidateArtifactPort {\n  read(ref: AgentCandidateArtifactRef): Promise<Uint8Array>\n}\n\nexport type AgentCandidateOutputPurpose =\n  | 'execution-plan'\n  | 'materialization-receipt'\n  | 'candidate-workspace-manifest'\n  | 'candidate-workspace-archive'\n  | 'task-manifest'\n  | 'task-archive'\n  | 'task-patch'\n  | 'task-output'\n  | 'task-outcome'\n  | 'memory-after-manifest'\n  | 'memory-after-archive'\n  | 'grader-evidence'\n  | 'benchmark-result'\n  | 'model-settlement'\n  | 'trace'\n  | 'executor-native-evidence'\n  | 'executor-capture'\n  | 'run-receipt'\n  | 'knowledge-retrieval-config'\n  | 'knowledge-evaluation'\n  | 'failure-evidence'\n\n/** Durable content-addressed evidence store controlled only by the evaluator. */\nexport interface AgentCandidateOutputArtifactPort extends AgentCandidateArtifactPort {\n  /** Must be idempotent for identical bytes and return only a durable S3/IPFS locator. */\n  put(input: {\n    executionId: string\n    purpose: AgentCandidateOutputPurpose\n    bytes: Uint8Array\n    /** Abort must prevent durable publication when it happens before resolution. */\n    signal?: AbortSignal\n  }): Promise<AgentCandidateArtifactRef>\n}\n\n/** Resolves a declared GitHub repository to an already-present local Git object store. */\nexport interface AgentCandidateRepositoryPort {\n  resolve(repository: AgentCandidateGitHubRepository): Promise<string>\n}\n\nexport interface AgentCandidateVerificationPorts {\n  artifacts: AgentCandidateArtifactPort\n  repositories: AgentCandidateRepositoryPort\n}\n\n/**\n * Materializes an already-verified workspace archive.\n *\n * The runtime independently scans every resulting byte, mode, and path against\n * the signed manifest after this returns. Implementations may therefore unpack\n * any archive encoding, or no-op when the exact workspace is already present.\n */\nexport interface AgentCandidateWorkspacePort {\n  materialize(input: {\n    role: 'task' | 'candidate' | 'knowledge' | 'memory'\n    snapshot: AgentCandidateWorkspaceSnapshotEvidence\n    archive: Uint8Array\n    destination: string\n  }): Promise<void>\n}\n\nexport interface ResolvedAgentCandidateContainer {\n  source: 'pinned-container' | 'evaluator-task-container'\n  image: string\n  indexDigest: Sha256Digest\n  manifestDigest: Sha256Digest\n  platform: AgentCandidateOciPlatform\n}\n\nexport interface AgentCandidateContainerPort {\n  resolve(input: {\n    candidate: AgentCandidateContainer | undefined\n    evaluatorTaskContainer: ResolvedAgentCandidateContainer | undefined\n  }): Promise<ResolvedAgentCandidateContainer>\n}\n\nexport interface AgentCandidateModelPort {\n  resolve(input: {\n    requested: string\n    harness: AgentCandidateBundle['execution']['harness']\n    reasoningEffort: NonNullable<AgentCandidateBundle['profile']['model']>['reasoningEffort']\n  }): Promise<AgentCandidateResolvedModel>\n  /**\n   * Reserve a stable access identity without creating a live credential.\n   * The reservation is scoped to `preparationId` and must automatically expire\n   * at `expiresAtMs`, even if this call returns ambiguously to the runtime.\n   */\n  reserveGrant(input: {\n    executionId: string\n    preparationId: string\n    expiresAtMs: number\n    attempt: AgentCandidateAttemptPolicy\n    bundleDigest: Sha256Digest\n    resolved: AgentCandidateResolvedModel\n    limits: AgentCandidateModelLimits\n  }): Promise<AgentCandidateProtectedModelReservation>\n  /** Create the live scoped credential only after the execution attempt is durably claimed. */\n  activateGrant(input: {\n    executionId: string\n    preparationId: string\n    grantDigest: Sha256Digest\n    resolved: AgentCandidateResolvedModel\n    deadlineAtMs: number\n  }): Promise<AgentCandidateProtectedModelActivation>\n  /**\n   * Atomically revoke the grant, drain in-flight calls, and return its immutable final ledger.\n   * This operation must be idempotent for the exact preparation and must also\n   * settle a reservation that was never activated. It must never affect a\n   * different preparation, even when both reservations report the same digest.\n   */\n  settleGrant(input: {\n    executionId: string\n    preparationId: string\n    grantDigest: Sha256Digest\n    resolved: AgentCandidateResolvedModel\n    reason: 'completed' | 'failed' | 'timeout' | 'replayed' | 'preparation-failed' | 'abandoned'\n  }): Promise<AgentCandidateProtectedModelSettlement>\n}\n\n/** Limits mechanically enforced by the evaluator-owned model gateway. */\nexport type AgentCandidateModelLimits = Pick<\n  AgentCandidateExecutionLimits,\n  'maxModelCalls' | 'maxInputTokens' | 'maxOutputTokens' | 'maxCostUsd'\n> & {\n  /** Optional caller-declared cap across input and output tokens. */\n  maxTotalTokens?: number\n}\n\nexport interface AgentCandidateProtectedModelReservation {\n  preparationId: string\n  digest: Sha256Digest\n  /** Evaluator service must expire and revoke this reservation at this epoch millisecond. */\n  expiresAtMs: number\n  /** The gateway must stop calls before any declared model limit is exceeded. */\n  enforcedLimits: AgentCandidateModelLimits\n  /** Exact public endpoint exception; every other candidate destination stays blocked. */\n  network: AgentCandidateModelAccessNetwork\n}\n\nexport interface AgentCandidateProtectedModelActivation {\n  /** Injected only into the trusted executor after all pre-launch checks pass. */\n  env: Readonly<Record<string, string>>\n}\n\nexport interface AgentCandidateProtectedModelSettlement {\n  preparationId: string\n  grantDigest: Sha256Digest\n  closed: true\n  /** Router's terminal integrity result. False must never become a receipt. */\n  usageWithinLimits: boolean\n  calls: readonly AgentCandidateProtectedModelSettlementCall[]\n}\n\n/** Protected-port wire call with the gateway's counted input total preserved. */\nexport type AgentCandidateProtectedModelSettlementCall = AgentCandidateModelSettlementCall & {\n  accountedInputTokens: number\n}\n\nexport interface AgentCandidateMemoryResetResult {\n  preparationId: string\n  accessDigest: Sha256Digest\n  expiresAtMs: number\n  evidence: AgentCandidateCapturedArtifact\n  emptyStateDigest: Sha256Digest\n  beforeState: AgentCandidateWorkspaceSnapshotEvidence\n}\n\nexport interface AgentCandidateMemoryPort {\n  /**\n   * Reset and reserve exact task memory without returning live access.\n   * The service must scope the reservation to `preparationId`, automatically\n   * revoke it at `expiresAtMs`, and never reuse it for another preparation.\n   */\n  reset(input: {\n    executionId: string\n    preparationId: string\n    expiresAtMs: number\n    effectiveNamespace: string\n    seed?: Uint8Array\n    seedDigest?: Sha256Digest\n  }): Promise<AgentCandidateMemoryResetResult>\n  /**\n   * Create live scoped access only after the execution attempt is durably claimed.\n   * Activation must match the exact preparation/access pair and may not extend expiry.\n   */\n  activate(input: {\n    executionId: string\n    preparationId: string\n    accessDigest: Sha256Digest\n    effectiveNamespace: string\n    deadlineAtMs: number\n  }): Promise<{ env: Readonly<Record<string, string>> }>\n  /**\n   * Revoke evaluator-owned access after process death or a failed preparation.\n   * Must be idempotent and concurrency-safe for the exact preparation/access\n   * pair and must never close a different preparation.\n   */\n  close(input: {\n    executionId: string\n    preparationId: string\n    accessDigest: Sha256Digest\n    effectiveNamespace: string\n    reason: 'completed' | 'failed' | 'timeout' | 'replayed' | 'preparation-failed' | 'abandoned'\n  }): Promise<{ closed: true }>\n}\n\nexport interface AgentCandidateExecutionPorts extends AgentCandidateVerificationPorts {\n  workspaces: AgentCandidateWorkspacePort\n  containers: AgentCandidateContainerPort\n  models: AgentCandidateModelPort\n  memory: AgentCandidateMemoryPort\n}\n\n/** Runtime placement for one exact cell from a signed candidate experiment. */\nexport interface AgentCandidateTaskExecution {\n  executionId: string\n  runCell: AgentCandidateRunCell\n  benchmarkSuite: AgentCandidateBenchmarkSuite\n  task: AgentCandidateBenchmarkTask\n  /** Absolute paths inside the evaluator-owned execution environment. */\n  executionRoots: {\n    taskRoot: string\n    candidateRoot?: string\n  }\n  /** Host-side staging roots. These are verified but never signed as container paths. */\n  stagingRoots: {\n    taskRoot: string\n    candidateRoot?: string\n    profileRoot: string\n  }\n}\n\nexport interface VerifiedAgentCandidate {\n  readonly bundle: AgentCandidateBundle\n  readonly materializedTree?: string\n  readonly [verifiedCandidateBrand]: true\n}\n\nexport interface CanonicalCandidateDocument<T> {\n  readonly value: T\n  /** Canonical UTF-8 bytes of `value` with its top-level digest omitted. */\n  readonly bytes: Uint8Array\n  readonly digest: Sha256Digest\n}\n\nexport interface PreparedAgentCandidateLaunch {\n  executable: string\n  /** Complete fixed argv, including profile materializer flags but excluding task delivery. */\n  args: readonly string[]\n  env: Readonly<Record<string, string>>\n  /** Informational subset already present at the tail of `args`; executors must not append twice. */\n  flags: readonly string[]\n  cwd: string\n}\n\nexport interface PreparedAgentCandidateInstruction {\n  bytes: Uint8Array\n  delivery: AgentCandidateInstructionDelivery\n}\n\n/** Exact file-backed knowledge admitted by the candidate bundle. */\nexport interface PreparedAgentCandidateKnowledge {\n  readonly candidate: AgentCandidateKnowledgeRef\n  readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  readonly files: readonly AgentCandidateExecutorWorkspaceFile[]\n  readonly retrievalConfig?: Uint8Array\n}\n\nexport interface PreparedAgentCandidateTrace {\n  runId: string\n  tags: Readonly<Record<string, string>>\n  env: Readonly<Record<string, string>>\n}\n\nexport interface PreparedAgentCandidateExecution {\n  readonly bundle: AgentCandidateBundle\n  readonly benchmark: {\n    readonly suite: AgentCandidateBenchmarkSuite\n    readonly task: AgentCandidateBenchmarkTask\n  }\n  readonly executionId: string\n  readonly roots: {\n    execution: {\n      taskRoot: string\n      candidateRoot?: string\n    }\n    staging: {\n      taskRoot: string\n      candidateRoot?: string\n      profileRoot: string\n    }\n  }\n  readonly profilePlan: {\n    value: AgentCandidateProfilePlanEvidence\n    bytes: Uint8Array\n    written: readonly string[]\n  }\n  readonly profileActivation: AgentCandidateProfileActivation\n  readonly executionPlan: {\n    value: AgentCandidateExecutionPlanEvidence\n    bytes: Uint8Array\n  }\n  readonly materializationReceipt: CanonicalCandidateDocument<AgentCandidateMaterializationReceipt>\n  readonly launch: PreparedAgentCandidateLaunch\n  readonly instruction: PreparedAgentCandidateInstruction\n  readonly resolvedModel: AgentCandidateResolvedModel\n  readonly knowledge?: PreparedAgentCandidateKnowledge\n  readonly trace: PreparedAgentCandidateTrace\n  readonly memory: AgentCandidateEffectiveMemory\n  readonly [preparedCandidateBrand]: true\n}\n\nexport type { AgentCandidateBenchmarkGraderIdentity } from '@tangle-network/agent-interface'\n\nexport interface AgentCandidateProtectedRunCapture {\n  executionId: string\n  termination: AgentCandidateTermination\n}\n\n/** Raw evaluator capture made only after the candidate process is dead. */\nexport type AgentCandidateExecutorTaskOutcomeCapture =\n  | {\n      readonly kind: 'workspace'\n      /** Claimed final tree. The runtime recomputes it independently from `gitDiff`. */\n      readonly resultTree: string\n      /** Complete evaluator-captured workspace description after candidate execution. */\n      readonly afterState: AgentCandidateWorkspaceManifestMaterial\n      /** Reproducible workspace archive corresponding to `afterState`. */\n      readonly archive: Uint8Array\n      /** Exact binary patch from the signed task base to `afterState`. */\n      readonly gitDiff: Uint8Array\n    }\n  | {\n      readonly kind: 'output'\n      /** Exact evaluator-captured final output bytes. */\n      readonly bytes: Uint8Array\n    }\n\n/** Raw isolated-memory capture made only after access has been revoked. */\nexport interface AgentCandidateExecutorMemoryCapture {\n  readonly afterState: AgentCandidateWorkspaceManifestMaterial\n  readonly archive: Uint8Array\n}\n\n/** Replayable evaluator result captured only after process death and trace drain. */\nexport interface AgentCandidateExecutorFinalCapture {\n  readonly taskOutcome?: AgentCandidateExecutorTaskOutcomeCapture\n  /** Required only when the prepared candidate uses isolated task memory. */\n  readonly memoryAfter?: AgentCandidateExecutorMemoryCapture\n  /** Executor-native bytes preserved when a fresh worker cannot reconstruct a verified outcome. */\n  readonly evidence?: Uint8Array\n}\n\n/** Immutable evaluator evidence retained with a verified candidate task outcome. */\nexport type PersistedTaskOutcomeEvidence<\n  Kind extends AgentCandidateTaskOutcomeMaterial['outcome']['kind'],\n> = Omit<AgentCandidateTaskOutcomeEvidence, 'material'> & {\n  readonly artifact: AgentCandidateArtifactRef\n  readonly material: Omit<AgentCandidateTaskOutcomeMaterial, 'outcome'> & {\n    readonly outcome: Extract<AgentCandidateTaskOutcomeMaterial['outcome'], { kind: Kind }>\n  }\n}\n\n/** Branded task outcome that has survived independent evaluator verification. */\nexport type VerifiedAgentCandidateTaskOutcome =\n  | {\n      readonly kind: 'workspace'\n      readonly evidence: PersistedTaskOutcomeEvidence<'workspace'>\n      readonly patch: Uint8Array\n      readonly [verifiedTaskOutcomeBrand]: true\n    }\n  | {\n      readonly kind: 'output'\n      readonly evidence: PersistedTaskOutcomeEvidence<'output'>\n      readonly spec: AgentCandidateTaskOutputSpec\n      readonly bytes: Uint8Array\n      readonly [verifiedTaskOutcomeBrand]: true\n    }\n\n/**\n * Evaluator-owned executable grader, pinned by immutable implementation bytes.\n *\n * `run` is an isolation boundary, not an arbitrary scoring callback. The\n * implementation admitted to that boundary is supplied by the runtime after\n * artifact verification. Implementations must derive every returned binding\n * digest from the bytes and task outcome they actually admitted, rather than\n * copying an expected digest from ambient configuration.\n */\nexport interface AgentCandidateBenchmarkGraderPort {\n  readonly name: string\n  readonly version: string\n  readonly artifact: AgentCandidateArtifactRef\n  run(input: {\n    readonly executionId: string\n    readonly termination: AgentCandidateTermination\n    readonly outcome: VerifiedAgentCandidateTaskOutcome\n    /** Exact verified artifact bytes. Each read returns a detached copy. */\n    readonly implementation: {\n      readonly byteLength: number\n      readonly bytes: Uint8Array\n    }\n    /** Frozen result deadline; runners must stop work and side effects when aborted. */\n    readonly signal: AbortSignal\n  }): Promise<{\n    readonly evaluation: BenchmarkEvaluation\n    /** Raw grader output needed to audit or reproduce the normalized result. */\n    readonly evidence: Uint8Array\n    /** Runtime-checked binding between admitted code, task input, and raw output. */\n    readonly binding: {\n      /** Digest computed from the implementation bytes admitted to execution. */\n      readonly implementationDigest: Sha256Digest\n      /** Digest of the exact runtime-verified task outcome graded by this run. */\n      readonly taskOutcomeDigest: Sha256Digest\n      /** Digest computed from `evidence` before it leaves the execution boundary. */\n      readonly outputDigest: Sha256Digest\n    }\n  }>\n}\n\n/** One detached request passed to the trusted environment-specific executor. */\nexport interface AgentCandidateExecutorRequest {\n  readonly executionId: string\n  readonly benchmark: PreparedAgentCandidateExecution['benchmark']\n  /** Immutable bytes from which the executor creates fresh isolated workspaces. */\n  readonly inputs: {\n    readonly task: AgentCandidateExecutorWorkspaceInput\n    readonly candidate?: AgentCandidateExecutorWorkspaceInput\n    readonly profile: {\n      readonly files: readonly AgentCandidateExecutorProfileFile[]\n    }\n  }\n  readonly roots: PreparedAgentCandidateExecution['roots']['execution']\n  readonly profilePlan: PreparedAgentCandidateExecution['profilePlan']\n  readonly profileActivation: AgentCandidateProfileActivation\n  readonly executionPlan: PreparedAgentCandidateExecution['executionPlan']\n  readonly materializationReceipt: CanonicalCandidateDocument<AgentCandidateMaterializationReceipt>\n  readonly launch: PreparedAgentCandidateLaunch\n  readonly instruction: PreparedAgentCandidateInstruction\n  readonly resolvedModel: AgentCandidateResolvedModel\n  /** Mechanically enforced by the runtime plus executor process-death acknowledgement. */\n  readonly hardLimits: Pick<AgentCandidateExecutionLimits, 'timeoutMs'>\n  /** Validity bound checked against protected traces; generic black-box executors cannot preempt it. */\n  readonly observedLimits: Pick<AgentCandidateExecutionLimits, 'maxSteps'>\n  readonly knowledge?: PreparedAgentCandidateKnowledge\n  readonly trace: PreparedAgentCandidateTrace\n  readonly memory: AgentCandidateEffectiveMemory\n}\n\n/**\n * Executes one prepared request inside an evaluator-owned isolation boundary.\n *\n * `request.launch.env` is the complete allowlisted environment, including\n * protected model, memory, and trace bindings. Implementations must not merge\n * ambient host variables into it. The returned capture deliberately contains\n * no candidate-authored usage or score fields.\n */\nexport interface AgentCandidateExecutorPort {\n  execute(\n    request: AgentCandidateExecutorRequest,\n    context: {\n      traceStore: TraceStore\n      /** Aborted by the runtime at the exact frozen wall-time deadline. */\n      signal: AbortSignal\n      /** Absolute epoch-millisecond deadline owned by the runtime. */\n      deadlineAtMs: number\n    },\n  ): Promise<AgentCandidateProtectedRunCapture>\n  /** Kill the exact process/container and drain trace writes. Must be idempotent. */\n  stop(\n    request: AgentCandidateExecutorStopRequest,\n    context: {\n      traceStore: TraceStore\n      reason: 'completed' | 'failed' | 'timeout'\n      /** Aborted at the frozen execution deadline or evaluator cleanup deadline. */\n      signal: AbortSignal\n      /** Absolute execution deadline; a later stop acknowledgement cannot produce success. */\n      deadlineAtMs: number\n    },\n  ): Promise<{ readonly stopped: true }>\n  /** Capture immutable final evidence after stop. Must be replayable by a fresh worker. */\n  capture(\n    request: AgentCandidateExecutorStopRequest,\n    context: {\n      traceStore: TraceStore\n      /** Aborted at the frozen execution deadline or evaluator cleanup deadline. */\n      signal: AbortSignal\n    },\n  ): Promise<AgentCandidateExecutorFinalCapture>\n  /** Remove evaluator-owned execution resources after final capture. Must be idempotent. */\n  dispose?(\n    request: AgentCandidateExecutorStopRequest,\n    context: {\n      signal: AbortSignal\n    },\n  ): Promise<{ readonly disposed: true }>\n}\n\n/** Opaque process identity used for termination without re-exposing launch credentials. */\nexport interface AgentCandidateExecutorStopRequest {\n  readonly executionId: string\n  readonly executionPlanDigest: Sha256Digest\n}\n\nexport interface AgentCandidateExecutorWorkspaceInput {\n  readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  readonly files: readonly AgentCandidateExecutorWorkspaceFile[]\n}\n\nexport interface AgentCandidateExecutorWorkspaceFile {\n  readonly path: string\n  readonly mode: number\n  readonly bytes: Uint8Array\n}\n\n/** One exact profile file supplied to an evaluator-owned executor. */\nexport interface AgentCandidateExecutorProfileFile {\n  readonly path: string\n  readonly mode: number\n  readonly bytes: Uint8Array\n}\n\nexport type AgentCandidateRunFinalization =\n  | {\n      succeeded: true\n      receipt: CanonicalCandidateDocument<AgentCandidateRunReceipt>\n      artifacts: {\n        executorCapture: AgentCandidateArtifactRef\n        modelSettlement: AgentCandidateArtifactRef\n        taskOutcome: AgentCandidateArtifactRef\n        benchmarkResult: AgentCandidateArtifactRef\n        runReceipt: AgentCandidateArtifactRef\n      }\n    }\n  | {\n      succeeded: false\n      reason: string\n      partial: {\n        executionId: string\n        bundleDigest: Sha256Digest\n        executionPlanDigest: Sha256Digest\n        materializationReceiptDigest: Sha256Digest\n        termination?: AgentCandidateTermination\n      }\n      /** Independent evaluator-gateway usage, even when execution or trace capture failed. */\n      usage: AgentCandidateFixedSpend | null\n    }\n\n/** Protected trace tags that bind a run to one prepared candidate execution. */\nexport const CANDIDATE_TRACE_TAGS = {\n  executionId: 'tangle.candidate.execution_id',\n  bundleDigest: 'tangle.candidate.bundle_digest',\n  executionPlanDigest: 'tangle.candidate.execution_plan_digest',\n  materializationReceiptDigest: 'tangle.candidate.materialization_receipt_digest',\n} as const\n\n/** Environment keys used to propagate immutable candidate trace identity. */\nexport const CANDIDATE_TRACE_ENV = {\n  executionId: 'TANGLE_CANDIDATE_EXECUTION_ID',\n  bundleDigest: 'TANGLE_CANDIDATE_BUNDLE_DIGEST',\n  executionPlanDigest: 'TANGLE_CANDIDATE_EXECUTION_PLAN_DIGEST',\n  materializationReceiptDigest: 'TANGLE_CANDIDATE_MATERIALIZATION_RECEIPT_DIGEST',\n  traceRunId: 'TANGLE_TRACE_RUN_ID',\n} as const\n\nexport type PreparedMemoryReceipt = AgentCandidateMemoryReceipt\n","import {\n  type AgentCandidateBenchmarkSuite,\n  type AgentCandidateBenchmarkTask,\n  type AgentCandidateWorkspaceManifestMaterial,\n  agentCandidateBenchmarkSuiteSchema,\n  agentCandidateBenchmarkTaskSchema,\n  agentCandidateExecutionPlanEvidenceSchema,\n  agentCandidateMaterializationReceiptSchema,\n  agentCandidateProfilePlanEvidenceSchema,\n} from '@tangle-network/agent-interface'\n\nimport { verifyMaterializedProfileWorkspace, verifyMaterializedWorkspace } from './artifacts'\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  canonicalCandidateDocument,\n  immutableCandidateValue,\n  omitTopLevelDigest,\n  sha256Bytes,\n} from './digest'\nimport { verifyTaskCheckout } from './git-materialize'\nimport { parseAgentCandidateProfileActivation } from './profile'\nimport type {\n  AgentCandidateExecutionPorts,\n  AgentCandidateExecutorRequest,\n  AgentCandidateExecutorWorkspaceFile,\n  AgentCandidateProtectedModelActivation,\n  AgentCandidateProtectedModelReservation,\n  PreparedAgentCandidateExecution,\n} from './types'\nimport { CANDIDATE_TRACE_ENV, CANDIDATE_TRACE_TAGS, preparedCandidateBrand } from './types'\n\nexport interface PreparedCandidateState {\n  ports: AgentCandidateExecutionPorts\n  bundle: PreparedAgentCandidateExecution['bundle']\n  benchmarkSuite: AgentCandidateBenchmarkSuite\n  benchmarkTask: AgentCandidateBenchmarkTask\n  executionId: string\n  roots: PreparedAgentCandidateExecution['roots']\n  profilePlan: PreparedAgentCandidateExecution['profilePlan']\n  profileActivation: PreparedAgentCandidateExecution['profileActivation']\n  executionPlan: PreparedAgentCandidateExecution['executionPlan']\n  materializationReceipt: PreparedAgentCandidateExecution['materializationReceipt']\n  launch: PreparedAgentCandidateExecution['launch']\n  instruction: PreparedAgentCandidateExecution['instruction']\n  resolvedModel: PreparedAgentCandidateExecution['resolvedModel']\n  preparationId: string\n  reservationExpiresAtMs: number\n  cleanupTimeoutMs: number\n  resultTimeoutMs: number\n  modelReservation: AgentCandidateProtectedModelReservation\n  executorInputs: {\n    taskFiles: ReadonlyArray<{\n      path: string\n      mode: number\n      bytes: Uint8Array\n    }>\n    candidateFiles?: ReadonlyArray<{\n      path: string\n      mode: number\n      bytes: Uint8Array\n    }>\n    profileFiles: ReadonlyArray<{\n      path: string\n      mode: number\n      bytes: Uint8Array\n    }>\n  }\n  memoryReservation?: {\n    preparationId: string\n    accessDigest: `sha256:${string}`\n    expiresAtMs: number\n    effectiveNamespace: string\n  }\n  knowledge?: PreparedAgentCandidateExecution['knowledge']\n  trace: PreparedAgentCandidateExecution['trace']\n  memory: PreparedAgentCandidateExecution['memory']\n}\n\nconst stateByExecution = new WeakMap<PreparedAgentCandidateExecution, PreparedCandidateState>()\nconst lifecycleByExecution = new WeakMap<\n  PreparedAgentCandidateExecution,\n  {\n    status:\n      | 'prepared'\n      | 'claiming'\n      | 'claimed'\n      | 'running'\n      | 'settling'\n      | 'disposing'\n      | 'succeeded'\n      | 'failed'\n      | 'disposal-failed'\n      | 'cleanup-failed'\n      | 'disposed'\n  }\n>()\n\nexport function createPreparedCandidateExecution(\n  input: PreparedCandidateState,\n): PreparedAgentCandidateExecution {\n  const state = detachPreparedCandidateState(input)\n  assertPrivateCandidateIntegrity(state)\n  const prepared = Object.freeze({\n    bundle: state.bundle,\n    benchmark: Object.freeze({ suite: state.benchmarkSuite, task: state.benchmarkTask }),\n    executionId: state.executionId,\n    roots: state.roots,\n    profilePlan: evidenceView(state.profilePlan),\n    profileActivation: state.profileActivation,\n    executionPlan: evidenceView(state.executionPlan),\n    materializationReceipt: state.materializationReceipt,\n    launch: state.launch,\n    instruction: bytesView(state.instruction, 'bytes'),\n    resolvedModel: state.resolvedModel,\n    ...(state.knowledge ? { knowledge: knowledgeView(state.knowledge) } : {}),\n    trace: state.trace,\n    memory: state.memory,\n    [preparedCandidateBrand]: true as const,\n  })\n  stateByExecution.set(prepared, state)\n  lifecycleByExecution.set(prepared, { status: 'prepared' })\n  return prepared\n}\n\nexport function getPreparedCandidateState(\n  prepared: PreparedAgentCandidateExecution,\n): PreparedCandidateState {\n  const state = stateByExecution.get(prepared)\n  if (!state || prepared[preparedCandidateBrand] !== true) {\n    throw new Error('execution must come from prepareAgentCandidateExecution')\n  }\n  return state\n}\n\n/** Revalidates the exact private bytes immediately before execution or finalization. */\nexport function assertPreparedCandidateIntegrity(\n  prepared: PreparedAgentCandidateExecution,\n): PreparedCandidateState {\n  const state = getPreparedCandidateState(prepared)\n  assertPrivateCandidateIntegrity(state)\n  return state\n}\n\n/** Atomically reserves this in-memory prepared value before the first await. */\nexport function beginPreparedCandidateClaim(\n  prepared: PreparedAgentCandidateExecution,\n): PreparedCandidateState {\n  const state = assertPreparedCandidateIntegrity(prepared)\n  transitionLifecycle(prepared, ['prepared'], 'claiming')\n  return state\n}\n\n/** Claim an unexecuted preparation for explicit resource disposal. */\nexport function beginPreparedCandidateDisposal(\n  prepared: PreparedAgentCandidateExecution,\n): PreparedCandidateState {\n  const state = assertPreparedCandidateIntegrity(prepared)\n  transitionLifecycle(prepared, ['prepared', 'disposal-failed', 'cleanup-failed'], 'disposing')\n  return state\n}\n\nexport function markPreparedCandidateClaimed(prepared: PreparedAgentCandidateExecution): void {\n  transitionLifecycle(prepared, ['claiming'], 'claimed')\n}\n\n/** Reveal protected values only after the durable claim and workspace checks succeed. */\nexport function beginPreparedCandidateRun(\n  prepared: PreparedAgentCandidateExecution,\n  modelAccess: AgentCandidateProtectedModelActivation,\n  memoryAccess?: { env: Readonly<Record<string, string>> },\n): { state: PreparedCandidateState; request: AgentCandidateExecutorRequest } {\n  const state = assertPreparedCandidateIntegrity(prepared)\n  assertProtectedEnvironment(state, modelAccess.env, memoryAccess?.env)\n  transitionLifecycle(prepared, ['claimed'], 'running')\n  const completeEnvironment = immutableCandidateValue({\n    ...state.launch.env,\n    ...modelAccess.env,\n    ...(memoryAccess?.env ?? {}),\n    ...state.trace.env,\n  })\n  const material = state.executionPlan.value.material\n  const request = Object.freeze({\n    executionId: state.executionId,\n    benchmark: preparedBenchmark(state),\n    inputs: Object.freeze({\n      task: workspaceInputView(state.benchmarkTask.workspace, state.executorInputs.taskFiles),\n      ...(material.candidateWorkspace && state.executorInputs.candidateFiles\n        ? {\n            candidate: workspaceInputView(\n              material.candidateWorkspace,\n              state.executorInputs.candidateFiles,\n            ),\n          }\n        : {}),\n      profile: Object.freeze({\n        files: Object.freeze(\n          state.executorInputs.profileFiles.map((file) => profileFileView(file)),\n        ),\n      }),\n    }),\n    roots: state.roots.execution,\n    profilePlan: evidenceView(state.profilePlan),\n    profileActivation: state.profileActivation,\n    executionPlan: evidenceView(state.executionPlan),\n    materializationReceipt: state.materializationReceipt,\n    launch: immutableCandidateValue({ ...state.launch, env: completeEnvironment }),\n    instruction: bytesView(state.instruction, 'bytes'),\n    resolvedModel: state.resolvedModel,\n    hardLimits: Object.freeze({ timeoutMs: state.executionPlan.value.material.limits.timeoutMs }),\n    observedLimits: Object.freeze({ maxSteps: state.executionPlan.value.material.limits.maxSteps }),\n    ...(state.knowledge ? { knowledge: knowledgeView(state.knowledge) } : {}),\n    trace: state.trace,\n    memory: state.memory,\n  })\n  return { state, request }\n}\n\nfunction preparedBenchmark(\n  state: PreparedCandidateState,\n): PreparedAgentCandidateExecution['benchmark'] {\n  return Object.freeze({ suite: state.benchmarkSuite, task: state.benchmarkTask })\n}\n\nexport function consumePreparedCandidateExecution(\n  prepared: PreparedAgentCandidateExecution,\n  outcome: 'succeeded' | 'failed' | 'disposed' | 'disposal-failed' | 'cleanup-failed',\n): void {\n  transitionLifecycle(\n    prepared,\n    outcome === 'disposed' || outcome === 'disposal-failed' ? ['disposing'] : ['settling'],\n    outcome,\n  )\n}\n\nexport function beginPreparedCandidateSettlement(prepared: PreparedAgentCandidateExecution): void {\n  transitionLifecycle(prepared, ['claiming', 'claimed', 'running'], 'settling')\n}\n\n/** Rechecks every mutable staging byte immediately before handing control to an executor. */\nexport async function assertPreparedCandidateWorkspaces(\n  state: PreparedCandidateState,\n): Promise<void> {\n  const plan = state.executionPlan.value.material\n  await verifyMaterializedWorkspace(\n    state.roots.staging.taskRoot,\n    state.benchmarkTask.workspace.material,\n    {\n      ignoredProtectedRootEntries: ['.git', '.sidecar'],\n    },\n  )\n  if (state.benchmarkTask.repository) {\n    await verifyTaskCheckout(state.roots.staging.taskRoot, state.benchmarkTask.repository)\n  }\n  await verifyMaterializedProfileWorkspace(\n    state.roots.staging.profileRoot,\n    state.profilePlan.value.material,\n  )\n  if (plan.candidateWorkspace) {\n    const candidateRoot = state.roots.staging.candidateRoot\n    if (!candidateRoot) throw new Error('prepared candidate staging root is missing')\n    await verifyMaterializedWorkspace(candidateRoot, plan.candidateWorkspace.material)\n  } else if (state.roots.staging.candidateRoot !== undefined) {\n    throw new Error('disabled candidate unexpectedly has a staging root')\n  }\n}\n\nfunction detachPreparedCandidateState(input: PreparedCandidateState): PreparedCandidateState {\n  const benchmarkSuite = immutableCandidateValue(\n    agentCandidateBenchmarkSuiteSchema.parse(input.benchmarkSuite),\n  )\n  const benchmarkTask = immutableCandidateValue(\n    agentCandidateBenchmarkTaskSchema.parse(input.benchmarkTask),\n  )\n  const profilePlan = immutableCandidateValue(\n    agentCandidateProfilePlanEvidenceSchema.parse(input.profilePlan.value),\n  )\n  const profileActivation = parseAgentCandidateProfileActivation(\n    input.profileActivation,\n    profilePlan.digest,\n  )\n  const executionPlan = immutableCandidateValue(\n    agentCandidateExecutionPlanEvidenceSchema.parse(input.executionPlan.value),\n  )\n  const receiptValue = immutableCandidateValue(\n    agentCandidateMaterializationReceiptSchema.parse(input.materializationReceipt.value),\n  )\n  const materializationReceipt = canonicalCandidateDocument(\n    omitTopLevelDigest(receiptValue),\n  ) as PreparedAgentCandidateExecution['materializationReceipt']\n  if (materializationReceipt.digest !== input.materializationReceipt.digest) {\n    throw new Error('materialization receipt digest changed while sealing prepared execution')\n  }\n  return Object.freeze({\n    ports: input.ports,\n    bundle: input.bundle,\n    benchmarkSuite,\n    benchmarkTask,\n    executionId: input.executionId,\n    roots: immutableCandidateValue(input.roots),\n    profilePlan: Object.freeze({\n      value: profilePlan,\n      bytes: Uint8Array.from(input.profilePlan.bytes),\n      written: Object.freeze([...input.profilePlan.written]),\n    }),\n    profileActivation,\n    executionPlan: Object.freeze({\n      value: executionPlan,\n      bytes: Uint8Array.from(input.executionPlan.bytes),\n    }),\n    materializationReceipt,\n    launch: immutableCandidateValue(input.launch),\n    instruction: Object.freeze({\n      bytes: Uint8Array.from(input.instruction.bytes),\n      delivery: immutableCandidateValue(input.instruction.delivery),\n    }),\n    resolvedModel: immutableCandidateValue(input.resolvedModel),\n    preparationId: input.preparationId,\n    reservationExpiresAtMs: input.reservationExpiresAtMs,\n    cleanupTimeoutMs: input.cleanupTimeoutMs,\n    resultTimeoutMs: input.resultTimeoutMs,\n    modelReservation: immutableCandidateValue(input.modelReservation),\n    executorInputs: Object.freeze({\n      taskFiles: immutableExecutorFiles(input.executorInputs.taskFiles),\n      ...(input.executorInputs.candidateFiles\n        ? { candidateFiles: immutableExecutorFiles(input.executorInputs.candidateFiles) }\n        : {}),\n      profileFiles: immutableExecutorFiles(input.executorInputs.profileFiles),\n    }),\n    ...(input.memoryReservation\n      ? { memoryReservation: immutableCandidateValue(input.memoryReservation) }\n      : {}),\n    ...(input.knowledge\n      ? {\n          knowledge: Object.freeze({\n            candidate: immutableCandidateValue(input.knowledge.candidate),\n            snapshot: immutableCandidateValue(input.knowledge.snapshot),\n            files: immutableExecutorFiles(input.knowledge.files),\n            ...(input.knowledge.retrievalConfig\n              ? { retrievalConfig: Uint8Array.from(input.knowledge.retrievalConfig) }\n              : {}),\n          }),\n        }\n      : {}),\n    trace: immutableCandidateValue(input.trace),\n    memory: immutableCandidateValue(input.memory),\n  })\n}\n\nfunction assertPrivateCandidateIntegrity(state: PreparedCandidateState): void {\n  const bundleMaterial = omitTopLevelDigest(state.bundle)\n  if (canonicalCandidateDigest(bundleMaterial) !== state.bundle.digest) {\n    throw new Error('prepared candidate bundle no longer matches its digest')\n  }\n  assertPlanEvidence(state.profilePlan.value, state.profilePlan.bytes, 'profile plan')\n  parseAgentCandidateProfileActivation(state.profileActivation, state.profilePlan.value.digest)\n  assertPlanEvidence(state.executionPlan.value, state.executionPlan.bytes, 'execution plan')\n  agentCandidateExecutionPlanEvidenceSchema.parse(state.executionPlan.value)\n\n  const receipt = agentCandidateMaterializationReceiptSchema.parse(\n    state.materializationReceipt.value,\n  )\n  const receiptBytes = canonicalCandidateBytes(omitTopLevelDigest(receipt))\n  if (\n    canonicalCandidateDigest(omitTopLevelDigest(receipt)) !== state.materializationReceipt.digest ||\n    !Buffer.from(receiptBytes).equals(Buffer.from(state.materializationReceipt.bytes))\n  ) {\n    throw new Error('prepared materialization receipt no longer matches its canonical bytes')\n  }\n\n  assertSignedBenchmarkInput(state)\n  const instruction = Buffer.from(state.benchmarkTask.instruction, 'utf8')\n  if (\n    !Buffer.from(state.instruction.bytes).equals(instruction) ||\n    JSON.stringify(state.instruction.delivery) !==\n      JSON.stringify(state.executionPlan.value.material.instructionDelivery)\n  ) {\n    throw new Error('prepared instruction no longer matches the signed execution plan')\n  }\n  if (\n    !/^candidate-preparation\\.[A-Za-z0-9_-]{43}$/.test(state.preparationId) ||\n    !Number.isSafeInteger(state.reservationExpiresAtMs) ||\n    state.reservationExpiresAtMs <= 0 ||\n    !Number.isSafeInteger(state.cleanupTimeoutMs) ||\n    state.cleanupTimeoutMs <= 0 ||\n    !Number.isSafeInteger(state.resultTimeoutMs) ||\n    state.resultTimeoutMs <= 0 ||\n    JSON.stringify(state.resolvedModel) !==\n      JSON.stringify(state.executionPlan.value.material.model.resolved) ||\n    state.modelReservation.digest !== state.executionPlan.value.material.model.access.grantDigest ||\n    state.modelReservation.preparationId !== state.preparationId ||\n    state.modelReservation.expiresAtMs !== state.reservationExpiresAtMs ||\n    canonicalCandidateDigest(state.modelReservation.network) !==\n      canonicalCandidateDigest(state.executionPlan.value.material.model.access.network) ||\n    canonicalCandidateDigest(state.modelReservation.enforcedLimits) !==\n      canonicalCandidateDigest(modelLimits(state.executionPlan.value.material.limits))\n  ) {\n    throw new Error('prepared model access no longer matches the signed execution plan')\n  }\n  assertExecutorInputs(state)\n  assertPreparedKnowledge(state)\n  if (\n    (state.memory.mode === 'isolated' && !state.memoryReservation) ||\n    (state.memory.mode === 'disabled' && state.memoryReservation)\n  ) {\n    throw new Error('prepared memory reservation does not match the signed execution plan')\n  }\n  if (\n    state.memory.mode === 'isolated' &&\n    state.memoryReservation &&\n    (state.memoryReservation.preparationId !== state.preparationId ||\n      state.memoryReservation.expiresAtMs !== state.reservationExpiresAtMs ||\n      state.memoryReservation.effectiveNamespace !== state.memory.effectiveNamespace)\n  ) {\n    throw new Error('prepared memory reservation identity no longer matches the execution')\n  }\n  if (JSON.stringify(state.memory) !== JSON.stringify(state.executionPlan.value.material.memory)) {\n    throw new Error('prepared memory no longer matches the signed execution plan')\n  }\n\n  const expectedTags = {\n    [CANDIDATE_TRACE_TAGS.executionId]: state.executionId,\n    [CANDIDATE_TRACE_TAGS.bundleDigest]: state.bundle.digest,\n    [CANDIDATE_TRACE_TAGS.executionPlanDigest]: state.executionPlan.value.digest,\n    [CANDIDATE_TRACE_TAGS.materializationReceiptDigest]: state.materializationReceipt.digest,\n  }\n  const expectedTraceEnvironment = {\n    [CANDIDATE_TRACE_ENV.executionId]: state.executionId,\n    [CANDIDATE_TRACE_ENV.bundleDigest]: state.bundle.digest,\n    [CANDIDATE_TRACE_ENV.executionPlanDigest]: state.executionPlan.value.digest,\n    [CANDIDATE_TRACE_ENV.materializationReceiptDigest]: state.materializationReceipt.digest,\n    [CANDIDATE_TRACE_ENV.traceRunId]: state.trace.runId,\n  }\n  if (\n    !state.trace.runId.startsWith(\n      `${state.executionId}:attempt-${state.executionPlan.value.material.runCell.attempt}:`,\n    ) ||\n    canonicalCandidateDigest(state.trace.tags) !== canonicalCandidateDigest(expectedTags) ||\n    canonicalCandidateDigest(state.trace.env) !== canonicalCandidateDigest(expectedTraceEnvironment)\n  ) {\n    throw new Error('prepared trace identity no longer matches the signed execution')\n  }\n}\n\nfunction assertPlanEvidence(\n  evidence:\n    | PreparedAgentCandidateExecution['profilePlan']['value']\n    | PreparedAgentCandidateExecution['executionPlan']['value'],\n  bytes: Uint8Array,\n  label: string,\n): void {\n  const expected = canonicalCandidateBytes(evidence.material)\n  if (\n    sha256Bytes(expected) !== evidence.digest ||\n    !Buffer.from(expected).equals(Buffer.from(bytes)) ||\n    evidence.artifact.sha256 !== evidence.digest ||\n    evidence.artifact.byteLength !== bytes.byteLength ||\n    !('content' in evidence.artifact) ||\n    !Buffer.from(evidence.artifact.content, 'base64').equals(Buffer.from(bytes))\n  ) {\n    throw new Error(`prepared ${label} no longer matches its canonical bytes`)\n  }\n}\n\nfunction evidenceView<T extends { value: unknown; bytes: Uint8Array }>(evidence: T): T {\n  const bytes = Uint8Array.from(evidence.bytes)\n  return Object.freeze({\n    ...evidence,\n    get bytes(): Uint8Array {\n      return Uint8Array.from(bytes)\n    },\n  })\n}\n\nfunction bytesView<T extends { bytes: Uint8Array }>(value: T, key: 'bytes'): T {\n  const bytes = Uint8Array.from(value.bytes)\n  return Object.freeze({\n    ...value,\n    get [key](): Uint8Array {\n      return Uint8Array.from(bytes)\n    },\n  })\n}\n\nfunction knowledgeView(\n  knowledge: NonNullable<PreparedAgentCandidateExecution['knowledge']>,\n): NonNullable<PreparedAgentCandidateExecution['knowledge']> {\n  const retrievalConfig = knowledge.retrievalConfig\n    ? Uint8Array.from(knowledge.retrievalConfig)\n    : undefined\n  return Object.freeze({\n    candidate: knowledge.candidate,\n    snapshot: knowledge.snapshot,\n    files: Object.freeze(knowledge.files.map((file) => profileFileView(file))),\n    ...(retrievalConfig\n      ? {\n          get retrievalConfig(): Uint8Array {\n            return Uint8Array.from(retrievalConfig)\n          },\n        }\n      : {}),\n  })\n}\nfunction workspaceInputView(\n  snapshot: AgentCandidateExecutorRequest['inputs']['task']['snapshot'],\n  sourceFiles: PreparedCandidateState['executorInputs']['taskFiles'],\n): AgentCandidateExecutorRequest['inputs']['task'] {\n  return Object.freeze({\n    snapshot,\n    files: Object.freeze(sourceFiles.map((file) => executorFileView(file))),\n  })\n}\n\nfunction profileFileView(\n  source: PreparedCandidateState['executorInputs']['profileFiles'][number],\n): AgentCandidateExecutorRequest['inputs']['profile']['files'][number] {\n  const bytes = Uint8Array.from(source.bytes)\n  return Object.freeze({\n    path: source.path,\n    mode: source.mode,\n    get bytes(): Uint8Array {\n      return Uint8Array.from(bytes)\n    },\n  })\n}\n\nfunction executorFileView(\n  source: PreparedCandidateState['executorInputs']['taskFiles'][number],\n): AgentCandidateExecutorWorkspaceFile {\n  const bytes = Uint8Array.from(source.bytes)\n  return Object.freeze({\n    path: source.path,\n    mode: source.mode,\n    get bytes(): Uint8Array {\n      return Uint8Array.from(bytes)\n    },\n  })\n}\n\nfunction assertExecutorInputs(state: PreparedCandidateState): void {\n  const material = state.executionPlan.value.material\n  assertWorkspaceExecutorFiles(\n    state.executorInputs.taskFiles,\n    state.benchmarkTask.workspace.material,\n  )\n  if (material.candidateWorkspace) {\n    if (!state.executorInputs.candidateFiles) {\n      throw new Error('prepared candidate executor files are missing')\n    }\n    assertWorkspaceExecutorFiles(\n      state.executorInputs.candidateFiles,\n      material.candidateWorkspace.material,\n    )\n  } else if (state.executorInputs.candidateFiles) {\n    throw new Error('disabled candidate has executor files')\n  }\n\n  const expectedFiles = state.profilePlan.value.material.files\n  if (state.executorInputs.profileFiles.length !== expectedFiles.length) {\n    throw new Error('prepared profile executor files do not match the signed profile plan')\n  }\n  for (let index = 0; index < expectedFiles.length; index++) {\n    const expected = expectedFiles[index]\n    const actual = state.executorInputs.profileFiles[index]\n    if (\n      !expected ||\n      !actual ||\n      actual.path !== expected.relPath ||\n      actual.mode !== expected.mode ||\n      sha256Bytes(actual.bytes) !== expected.contentSha256\n    ) {\n      throw new Error('prepared profile executor files do not match the signed profile plan')\n    }\n  }\n}\n\nfunction assertPreparedKnowledge(state: PreparedCandidateState): void {\n  const expected = state.bundle.knowledge\n  const actual = state.knowledge\n  if (!expected || !actual) {\n    if (expected || actual)\n      throw new Error('prepared knowledge does not match the candidate bundle')\n    return\n  }\n  if (\n    canonicalCandidateDigest(actual.candidate) !== canonicalCandidateDigest(expected.candidate) ||\n    canonicalCandidateDigest(actual.snapshot) !== canonicalCandidateDigest(expected.snapshot) ||\n    state.executionPlan.value.material.knowledgeManifestDigest !== expected.snapshot.digest\n  ) {\n    throw new Error('prepared knowledge identity does not match the candidate bundle')\n  }\n  assertWorkspaceExecutorFiles(actual.files, expected.snapshot.material)\n  if (!expected.retrievalConfig || !actual.retrievalConfig) {\n    if (expected.retrievalConfig || actual.retrievalConfig) {\n      throw new Error('prepared knowledge retrieval config does not match the candidate bundle')\n    }\n    return\n  }\n  if (\n    actual.retrievalConfig.byteLength !== expected.retrievalConfig.byteLength ||\n    sha256Bytes(actual.retrievalConfig) !== expected.retrievalConfig.sha256\n  ) {\n    throw new Error('prepared knowledge retrieval config does not match the candidate bundle')\n  }\n}\n\nfunction assertWorkspaceExecutorFiles(\n  actualFiles: PreparedCandidateState['executorInputs']['taskFiles'],\n  expected: AgentCandidateWorkspaceManifestMaterial,\n): void {\n  if (actualFiles.length !== expected.files.length) {\n    throw new Error('prepared workspace executor files do not match the signed manifest')\n  }\n  for (let index = 0; index < expected.files.length; index++) {\n    const actual = actualFiles[index]\n    const planned = expected.files[index]\n    if (\n      !actual ||\n      !planned ||\n      actual.path !== planned.path ||\n      actual.mode !== planned.mode ||\n      actual.bytes.byteLength !== planned.byteLength ||\n      sha256Bytes(actual.bytes) !== planned.sha256\n    ) {\n      throw new Error('prepared workspace executor files do not match the signed manifest')\n    }\n  }\n}\n\nfunction assertSignedBenchmarkInput(state: PreparedCandidateState): void {\n  const plan = state.executionPlan.value.material\n  const cell = plan.runCell\n  const suite = state.benchmarkSuite\n  const task = state.benchmarkTask\n  const receipt = state.materializationReceipt.value\n  const cellIndex = cell.taskIndex * suite.reps + cell.repetition\n  if (\n    canonicalCandidateDigest(omitTopLevelDigest(suite)) !== suite.digest ||\n    canonicalCandidateDigest(omitTopLevelDigest(task)) !== task.digest ||\n    canonicalCandidateDigest(omitTopLevelDigest(cell)) !== cell.digest ||\n    cell.bundleDigest !== state.bundle.digest ||\n    cell.suiteDigest !== suite.digest ||\n    cell.taskDigest !== task.digest ||\n    suite.taskDigests[cell.taskIndex] !== task.digest ||\n    suite.seeds[cellIndex] !== cell.seed ||\n    cell.repetition >= suite.reps ||\n    cell.attempt < 1 ||\n    cell.attempt > task.attempt.maxAttempts\n  ) {\n    throw new Error('prepared candidate no longer matches its signed experiment cell')\n  }\n  const suiteBytes = canonicalCandidateBytes(omitTopLevelDigest(suite))\n  const taskBytes = canonicalCandidateBytes(omitTopLevelDigest(task))\n  if (\n    receipt.benchmark.suite.digest !== suite.digest ||\n    receipt.benchmark.suite.material.sha256 !== sha256Bytes(suiteBytes) ||\n    receipt.benchmark.suite.material.byteLength !== suiteBytes.byteLength ||\n    receipt.benchmark.task.digest !== task.digest ||\n    receipt.benchmark.task.material.sha256 !== sha256Bytes(taskBytes) ||\n    receipt.benchmark.task.material.byteLength !== taskBytes.byteLength\n  ) {\n    throw new Error('materialization receipt no longer matches its signed benchmark input')\n  }\n}\n\nfunction immutableExecutorFiles(\n  files: PreparedCandidateState['executorInputs']['taskFiles'],\n): ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }> {\n  return Object.freeze(\n    files.map((file) => Object.freeze({ ...file, bytes: Uint8Array.from(file.bytes) })),\n  )\n}\n\nfunction modelLimits(\n  limits: PreparedAgentCandidateExecution['executionPlan']['value']['material']['limits'],\n): AgentCandidateProtectedModelReservation['enforcedLimits'] {\n  return {\n    maxModelCalls: limits.maxModelCalls,\n    maxInputTokens: limits.maxInputTokens,\n    maxOutputTokens: limits.maxOutputTokens,\n    maxCostUsd: limits.maxCostUsd,\n  }\n}\n\nfunction transitionLifecycle(\n  prepared: PreparedAgentCandidateExecution,\n  expected: ReadonlyArray<\n    | 'prepared'\n    | 'claiming'\n    | 'claimed'\n    | 'running'\n    | 'settling'\n    | 'disposing'\n    | 'succeeded'\n    | 'failed'\n    | 'disposal-failed'\n    | 'cleanup-failed'\n    | 'disposed'\n  >,\n  next:\n    | 'claiming'\n    | 'claimed'\n    | 'running'\n    | 'settling'\n    | 'disposing'\n    | 'succeeded'\n    | 'failed'\n    | 'disposal-failed'\n    | 'cleanup-failed'\n    | 'disposed',\n): void {\n  const lifecycle = lifecycleByExecution.get(prepared)\n  if (!lifecycle || !expected.includes(lifecycle.status)) {\n    throw new Error(`prepared candidate execution is already ${lifecycle?.status ?? 'unknown'}`)\n  }\n  lifecycle.status = next\n}\n\nfunction assertProtectedEnvironment(\n  state: PreparedCandidateState,\n  modelEnvironment: Readonly<Record<string, string>>,\n  memoryEnvironment: Readonly<Record<string, string>> | undefined,\n): void {\n  const seen = new Set([...Object.keys(state.launch.env), ...Object.keys(state.trace.env)])\n  for (const [name, value] of [\n    ...Object.entries(modelEnvironment),\n    ...Object.entries(memoryEnvironment ?? {}),\n  ]) {\n    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || typeof value !== 'string' || value.length < 8) {\n      throw new Error('protected model activation contains an invalid environment binding')\n    }\n    if (seen.has(name)) {\n      throw new Error(`protected model activation collides with environment binding ${name}`)\n    }\n    seen.add(name)\n  }\n}\n","import type { AgentCandidateArtifactRef, Sha256Digest } from '@tangle-network/agent-interface'\n\nimport { type AgentCandidateExecutionClaim, candidateClaimFileInternals } from './claim'\nimport { canonicalCandidateDigest } from './digest'\nimport { candidateExecutionOwnerWindowMs } from './execution-window'\nimport { assertPreparedCandidateIntegrity } from './prepared-state'\nimport type { PreparedAgentCandidateExecution } from './types'\n\n/** Extract the complete durable claim from a prepared execution. */\nexport function candidateExecutionClaim(\n  prepared: PreparedAgentCandidateExecution,\n  preparationEvidence: {\n    executionPlan: AgentCandidateArtifactRef\n    materializationReceipt: AgentCandidateArtifactRef\n  },\n): AgentCandidateExecutionClaim {\n  const state = assertPreparedCandidateIntegrity(prepared)\n  const material = prepared.executionPlan.value.material\n  const attempt = {\n    number: material.runCell.attempt,\n    maxAttempts: state.benchmarkTask.attempt.maxAttempts,\n    retryPolicy: state.benchmarkTask.attempt.retryPolicy,\n  } as const\n  const nowMs = Date.now()\n  if (!Number.isSafeInteger(nowMs) || nowMs < 0) {\n    throw new Error('candidate execution claim-store clock returned an invalid timestamp')\n  }\n  const leaseExpiresAtMs =\n    nowMs +\n    candidateExecutionOwnerWindowMs(\n      material.limits.timeoutMs,\n      state.cleanupTimeoutMs,\n      state.resultTimeoutMs,\n    )\n  if (!Number.isSafeInteger(leaseExpiresAtMs) || leaseExpiresAtMs <= 0) {\n    throw new Error('candidate execution leaseExpiresAtMs must be a positive safe timestamp')\n  }\n  if (leaseExpiresAtMs > state.reservationExpiresAtMs) {\n    throw new Error(\n      'candidate preparation expires before its full execution and cleanup owner window',\n    )\n  }\n  if (\n    preparationEvidence.executionPlan.sha256 !== prepared.executionPlan.value.digest ||\n    preparationEvidence.executionPlan.byteLength !== state.executionPlan.bytes.byteLength\n  ) {\n    throw new Error('persisted execution plan does not match its canonical preparation bytes')\n  }\n  if (\n    preparationEvidence.materializationReceipt.sha256 !== state.materializationReceipt.digest ||\n    preparationEvidence.materializationReceipt.byteLength !==\n      state.materializationReceipt.bytes.byteLength\n  ) {\n    throw new Error(\n      'persisted materialization receipt does not match its canonical preparation bytes',\n    )\n  }\n  return candidateClaimFileInternals.sealClaim({\n    executionId: prepared.executionId,\n    attempt: attempt.number,\n    maxAttempts: attempt.maxAttempts,\n    retryPolicy: attempt.retryPolicy,\n    bundleDigest: prepared.bundle.digest,\n    executionPlanDigest: prepared.executionPlan.value.digest,\n    preparationEvidence,\n    retryLineageDigest: retryLineageDigest(prepared, state.resultTimeoutMs),\n    leaseExpiresAtMs,\n    resultTimeoutMs: state.resultTimeoutMs,\n    cleanup: {\n      preparationId: state.preparationId,\n      modelGrantDigest: state.modelReservation.digest,\n      resolvedModel: state.resolvedModel,\n      traceRunId: state.trace.runId,\n      cleanupTimeoutMs: state.cleanupTimeoutMs,\n      ...(state.memoryReservation\n        ? {\n            memory: {\n              accessDigest: state.memoryReservation.accessDigest,\n              effectiveNamespace: state.memoryReservation.effectiveNamespace,\n            },\n          }\n        : {}),\n    },\n  })\n}\n\nfunction retryLineageDigest(\n  prepared: PreparedAgentCandidateExecution,\n  resultTimeoutMs: number,\n): Sha256Digest {\n  const material = prepared.executionPlan.value.material\n  return canonicalCandidateDigest({\n    resultTimeoutMs,\n    executionPlan: {\n      ...material,\n      runCell: {\n        ...material.runCell,\n        attempt: 0,\n        digest: `sha256:${'0'.repeat(64)}`,\n      },\n      model: {\n        ...material.model,\n        access: {\n          ...material.model.access,\n          grantDigest: `sha256:${'0'.repeat(64)}`,\n        },\n      },\n      memory:\n        material.memory.mode === 'disabled'\n          ? material.memory\n          : {\n              mode: 'isolated',\n              scope: 'task',\n              effectiveNamespace: 'candidate/retry-lineage-normalized',\n              reset: {\n                kind: 'fresh',\n                emptyStateDigest: material.memory.reset.emptyStateDigest,\n              },\n              beforeState: {\n                digest: material.memory.beforeState.digest,\n                material: material.memory.beforeState.material,\n                manifest: {\n                  sha256: material.memory.beforeState.manifest.sha256,\n                  byteLength: material.memory.beforeState.manifest.byteLength,\n                },\n                archive: {\n                  sha256: material.memory.beforeState.archive.sha256,\n                  byteLength: material.memory.beforeState.archive.byteLength,\n                },\n              },\n              ...(material.memory.seedDigest ? { seedDigest: material.memory.seedDigest } : {}),\n            },\n    },\n  })\n}\n","/** Durable one-shot lifecycle for candidate execution attempts. */\n\nimport { createHash, randomBytes, timingSafeEqual } from 'node:crypto'\nimport { readFile } from 'node:fs/promises'\nimport {\n  type AgentCandidateArtifactRef,\n  type AgentCandidateAttemptPolicy,\n  type AgentCandidateFixedSpend,\n  type AgentCandidateResolvedModel,\n  agentCandidateResolvedModelSchema,\n  type Sha256Digest,\n} from '@tangle-network/agent-interface'\nimport {\n  type AgentCandidatePreparationEvidence,\n  type PersistedAgentCandidateExecutionClaim,\n  type PersistedAgentCandidateExecutionPending,\n  type PersistedAgentCandidateExecutionPhase,\n  type PersistedAgentCandidateExecutionTerminal,\n  sealCandidatePreparationEvidence,\n} from './claim-file-formats'\nimport {\n  assertRecoveryMatchesStaged,\n  assertTerminalAllowedInPhase,\n  assertTerminalMatchesClaim,\n  recoveredTerminalRecord,\n  rejectedFinish,\n  rejectedStage,\n  requireStagedTerminal,\n  sealTerminalDigest,\n  sealTerminalRecordValue,\n  terminalRecord,\n} from './claim-terminal'\nimport { candidateCleanupTimeout, candidateResultTimeout } from './cleanup'\nimport { canonicalCandidateDigest, immutableCandidateValue } from './digest'\nimport { assertExactObjectKeys as assertExactKeys } from './exact-object'\n\n/** Non-secret identities a trusted recovery worker needs to close an abandoned attempt. */\nexport interface AgentCandidateExecutionCleanupHandles {\n  readonly preparationId: string\n  readonly modelGrantDigest: Sha256Digest\n  readonly resolvedModel: AgentCandidateResolvedModel\n  readonly traceRunId: string\n  readonly cleanupTimeoutMs: number\n  readonly memory?: {\n    readonly accessDigest: Sha256Digest\n    readonly effectiveNamespace: string\n  }\n}\n\n/** Immutable signed identity stored for one execution attempt. */\nexport interface AgentCandidateExecutionClaim {\n  readonly executionId: string\n  readonly attempt: number\n  readonly maxAttempts: number\n  readonly retryPolicy: AgentCandidateAttemptPolicy['retryPolicy']\n  readonly bundleDigest: Sha256Digest\n  readonly executionPlanDigest: Sha256Digest\n  /** Durable canonical bytes needed to reconstruct the signed preparation. */\n  readonly preparationEvidence: AgentCandidatePreparationEvidence\n  /** Frozen plan identity with only attempt number and per-attempt grant identity normalized. */\n  readonly retryLineageDigest: Sha256Digest\n  /** The winning lease stops authorizing a new terminal write at this instant. */\n  readonly leaseExpiresAtMs: number\n  /** Frozen budget for task verification, executable grading, and receipt construction. */\n  readonly resultTimeoutMs: number\n  /** Non-secret handles retained so an expired attempt can be closed and reconciled. */\n  readonly cleanup: AgentCandidateExecutionCleanupHandles\n}\n\n/** Secret capability required to finish the acquired attempt. */\nexport interface AgentCandidateExecutionLease {\n  readonly executionId: string\n  readonly attempt: number\n  readonly token: string\n  readonly expiresAtMs: number\n}\n\n/** Only the first class is retryable, and only when the closed model ledger has zero calls. */\nexport type AgentCandidateExecutionFailureClass =\n  | 'pre-model-infrastructure'\n  | 'execution'\n  | 'post-model-infrastructure'\n  | 'unknown'\n\n/** Evaluator-owned terminal facts staged durably before the terminal CAS. */\nexport type AgentCandidateExecutionTerminalResult =\n  | {\n      readonly status: 'succeeded'\n      readonly usage: AgentCandidateFixedSpend\n      readonly modelSettlement: AgentCandidateArtifactRef\n      readonly taskOutcome: AgentCandidateArtifactRef\n      readonly benchmarkResult: AgentCandidateArtifactRef\n      readonly runReceipt: AgentCandidateArtifactRef\n    }\n  | {\n      readonly status: 'failed'\n      readonly failureClass: AgentCandidateExecutionFailureClass\n      readonly usage: AgentCandidateFixedSpend\n      readonly modelSettlement: AgentCandidateArtifactRef\n      readonly failureEvidence?: AgentCandidateArtifactRef\n    }\n\n/** Durable terminal record for one acquired execution attempt. */\nexport type AgentCandidateExecutionTerminalRecord = AgentCandidateExecutionTerminalResult & {\n  readonly executionId: string\n  readonly attempt: number\n  readonly bundleDigest: Sha256Digest\n  readonly executionPlanDigest: Sha256Digest\n  readonly preparationEvidence: AgentCandidateExecutionClaim['preparationEvidence']\n  /** RFC 8785 SHA-256 of this record with `terminalDigest` omitted. */\n  readonly terminalDigest: Sha256Digest\n}\n\n/** Monotonic durable phase: the second value means candidate code could have started. */\nexport type AgentCandidateExecutionPhase = 'claimed' | 'candidate-may-run'\n\n/** Trusted, independently observed closure facts for one expired winning lease. */\nexport interface AgentCandidateExecutionRecoveryEvidence {\n  readonly failureClass: AgentCandidateExecutionFailureClass\n  readonly usage: AgentCandidateFixedSpend\n  readonly modelSettlement: AgentCandidateArtifactRef\n  readonly failureEvidence?: AgentCandidateArtifactRef\n  readonly process: {\n    readonly stopped: true\n    readonly executionPlanDigest: Sha256Digest\n  }\n  readonly model: {\n    readonly closed: true\n    readonly preparationId: string\n    readonly grantDigest: Sha256Digest\n  }\n  readonly memory?: {\n    readonly closed: true\n    readonly preparationId: string\n    readonly accessDigest: Sha256Digest\n    readonly effectiveNamespace: string\n  }\n}\n\nexport interface AgentCandidateExecutionAttemptRef {\n  readonly executionId: string\n  readonly attempt: number\n}\n\n/** Persisted state available to a fresh trusted recovery worker after a crash. */\nexport interface AgentCandidateExecutionAttemptRecord {\n  readonly claim: AgentCandidateExecutionClaim\n  readonly phase: AgentCandidateExecutionPhase\n  /** Durable outbox content written before the terminal compare-and-set. */\n  readonly staged?: AgentCandidateExecutionTerminalRecord\n  readonly terminal?: AgentCandidateExecutionTerminalRecord\n}\n\n/** Result of atomically claiming one execution attempt. */\nexport type AgentCandidateExecutionClaimResult =\n  | {\n      readonly acquired: true\n      readonly claim: AgentCandidateExecutionClaim\n      readonly lease: AgentCandidateExecutionLease\n    }\n  | {\n      readonly acquired: false\n      readonly reason: 'already-claimed'\n      /** The durable winner already occupying this execution-attempt slot. */\n      readonly claim: AgentCandidateExecutionClaim\n      /** True only when every signed claim field matches the durable winner. */\n      readonly exactReplay: boolean\n    }\n  | {\n      readonly acquired: false\n      readonly reason: 'retry-not-eligible'\n      readonly claim: AgentCandidateExecutionClaim\n      readonly detail: AgentCandidateRetryRejection\n    }\n\n/** Result of atomically recording an attempt's terminal facts. */\nexport type AgentCandidateExecutionFinishResult =\n  | {\n      readonly finished: true\n      readonly terminal: AgentCandidateExecutionTerminalRecord\n    }\n  | {\n      readonly finished: false\n      readonly terminal: AgentCandidateExecutionTerminalRecord\n      /** True when a repeated finish supplied the same terminal digest. */\n      readonly exactReplay: boolean\n    }\n\n/** Result of durably staging the one immutable terminal outbox entry. */\nexport type AgentCandidateExecutionStageResult =\n  | {\n      readonly staged: true\n      readonly terminal: AgentCandidateExecutionTerminalRecord\n    }\n  | {\n      readonly staged: false\n      readonly terminal: AgentCandidateExecutionTerminalRecord\n      readonly exactReplay: boolean\n    }\n\n/** Result of crossing the irreversible candidate-may-run boundary. */\nexport type AgentCandidateExecutionPhaseResult =\n  | { readonly marked: true; readonly phase: 'candidate-may-run' }\n  | { readonly marked: false; readonly phase: 'candidate-may-run' }\n\nexport type AgentCandidateRetryRejection =\n  | 'prior-attempt-missing'\n  | 'prior-attempt-running'\n  | 'prior-attempt-succeeded'\n  | 'prior-attempt-spent-model-calls'\n  | 'prior-attempt-not-pre-model-infrastructure'\n  | 'retry-lineage-mismatch'\n\n/**\n * Atomic one-shot store for candidate execution attempts.\n *\n * Implementations must linearize both methods across every process sharing the\n * store. Terminal publication is deliberately two-step: `stageTerminal`\n * fsyncs the complete immutable outbox record, then `finish` publishes exactly\n * those staged bytes by digest. A crash between the two leaves recoverable\n * evidence rather than an ambiguous completed run.\n */\nexport interface AgentCandidateExecutionClaimStore {\n  tryClaim(claim: AgentCandidateExecutionClaim): Promise<AgentCandidateExecutionClaimResult>\n  getAttempt(\n    attempt: AgentCandidateExecutionAttemptRef,\n  ): Promise<AgentCandidateExecutionAttemptRecord | undefined>\n  /** Persist the point after which candidate code may have run. */\n  markCandidateMayRun(\n    lease: AgentCandidateExecutionLease,\n  ): Promise<AgentCandidateExecutionPhaseResult>\n  /** Fsync the complete terminal record into the durable outbox. */\n  stageTerminal(\n    lease: AgentCandidateExecutionLease,\n    result: AgentCandidateExecutionTerminalResult,\n  ): Promise<AgentCandidateExecutionStageResult>\n  /** Publish exactly the staged terminal identified by `terminalDigest`. */\n  finish(\n    lease: AgentCandidateExecutionLease,\n    terminalDigest: Sha256Digest,\n  ): Promise<AgentCandidateExecutionFinishResult>\n  /**\n   * Write a failed terminal only after the lease expired and a trusted worker\n   * independently proved process death plus model and memory closure.\n   */\n  recoverExpired(\n    attempt: AgentCandidateExecutionAttemptRef,\n    evidence: AgentCandidateExecutionRecoveryEvidence,\n  ): Promise<AgentCandidateExecutionFinishResult>\n}\n\ninterface StoredClaim {\n  claim: AgentCandidateExecutionClaim\n  leaseDigest: Sha256Digest\n  phase: AgentCandidateExecutionPhase\n  staged?: AgentCandidateExecutionTerminalRecord\n  terminal?: AgentCandidateExecutionTerminalRecord\n}\n\nfunction attemptRecord(\n  claim: AgentCandidateExecutionClaim,\n  phase: AgentCandidateExecutionPhase,\n  staged?: AgentCandidateExecutionTerminalRecord,\n  terminal?: AgentCandidateExecutionTerminalRecord,\n): AgentCandidateExecutionAttemptRecord {\n  return Object.freeze({\n    claim,\n    phase,\n    ...(staged ? { staged } : {}),\n    ...(terminal ? { terminal } : {}),\n  })\n}\n\nexport interface InMemoryAgentCandidateExecutionClaimStoreOptions {\n  /** Testable evaluator clock; defaults to `Date.now`. */\n  now?: () => number\n}\n\n/** Single-process lifecycle implementation. */\nexport class InMemoryAgentCandidateExecutionClaimStore\n  implements AgentCandidateExecutionClaimStore\n{\n  private readonly claims = new Map<string, StoredClaim>()\n  private readonly now: () => number\n\n  constructor(options: InMemoryAgentCandidateExecutionClaimStoreOptions = {}) {\n    this.now = options.now ?? Date.now\n  }\n\n  async tryClaim(\n    requested: AgentCandidateExecutionClaim,\n  ): Promise<AgentCandidateExecutionClaimResult> {\n    const claim = sealClaim(requested)\n    const slot = claimSlot(claim)\n    const existing = this.claims.get(slot)\n    if (existing) return rejectedExistingClaim(existing.claim, claim)\n    assertUnexpiredLease(claim.leaseExpiresAtMs, this.now())\n\n    const retryRejection = retryRejectionFromMemory(this.claims, claim)\n    if (retryRejection) return rejectedRetry(claim, retryRejection)\n\n    const lease = newLease(claim)\n    // No await may occur between the read and write: this is the linearization\n    // point for every caller sharing this store instance.\n    this.claims.set(slot, {\n      claim,\n      leaseDigest: leaseDigest(lease),\n      phase: 'claimed',\n    })\n    return Object.freeze({ acquired: true, claim, lease })\n  }\n\n  async getAttempt(\n    requestedAttempt: AgentCandidateExecutionAttemptRef,\n  ): Promise<AgentCandidateExecutionAttemptRecord | undefined> {\n    const attempt = sealAttemptRef(requestedAttempt)\n    const stored = this.claims.get(claimSlot(attempt))\n    return stored\n      ? attemptRecord(stored.claim, stored.phase, stored.staged, stored.terminal)\n      : undefined\n  }\n\n  async markCandidateMayRun(\n    requestedLease: AgentCandidateExecutionLease,\n  ): Promise<AgentCandidateExecutionPhaseResult> {\n    const lease = sealLease(requestedLease)\n    const stored = this.requireClaim(lease)\n    assertLease(stored.leaseDigest, stored.claim.leaseExpiresAtMs, lease)\n    if (stored.phase === 'candidate-may-run') {\n      return Object.freeze({ marked: false, phase: 'candidate-may-run' })\n    }\n    if (stored.staged || stored.terminal) {\n      throw new Error('candidate execution terminal was staged before candidate-may-run phase')\n    }\n    assertUnexpiredLease(stored.claim.leaseExpiresAtMs, this.now())\n    stored.phase = 'candidate-may-run'\n    return Object.freeze({ marked: true, phase: 'candidate-may-run' })\n  }\n\n  async stageTerminal(\n    requestedLease: AgentCandidateExecutionLease,\n    result: AgentCandidateExecutionTerminalResult,\n  ): Promise<AgentCandidateExecutionStageResult> {\n    const lease = sealLease(requestedLease)\n    const stored = this.requireClaim(lease)\n    assertLease(stored.leaseDigest, stored.claim.leaseExpiresAtMs, lease)\n    const terminal = terminalRecord(stored.claim, result)\n    if (stored.staged) return rejectedStage(stored.staged, terminal)\n    assertTerminalAllowedInPhase(stored.phase, terminal)\n    assertUnexpiredLease(stored.claim.leaseExpiresAtMs, this.now())\n    stored.staged = terminal\n    return Object.freeze({ staged: true, terminal })\n  }\n\n  async finish(\n    requestedLease: AgentCandidateExecutionLease,\n    requestedTerminalDigest: Sha256Digest,\n  ): Promise<AgentCandidateExecutionFinishResult> {\n    const lease = sealLease(requestedLease)\n    const terminalDigest = sealTerminalDigest(requestedTerminalDigest)\n    const stored = this.requireClaim(lease)\n    assertLease(stored.leaseDigest, stored.claim.leaseExpiresAtMs, lease)\n    const staged = requireStagedTerminal(stored.staged, terminalDigest)\n    if (stored.terminal) return rejectedFinish(stored.terminal, terminalDigest)\n    assertUnexpiredLease(stored.claim.leaseExpiresAtMs, this.now())\n\n    // The terminal assignment is the in-memory finish linearization point and\n    // publishes the exact immutable object already present in the outbox.\n    stored.terminal = staged\n    return Object.freeze({ finished: true, terminal: staged })\n  }\n\n  async recoverExpired(\n    requestedAttempt: AgentCandidateExecutionAttemptRef,\n    evidence: AgentCandidateExecutionRecoveryEvidence,\n  ): Promise<AgentCandidateExecutionFinishResult> {\n    const attempt = sealAttemptRef(requestedAttempt)\n    const stored = this.requireClaim(attempt, 'candidate execution recovery')\n    const recovered = recoveredTerminalRecord(stored.claim, stored.phase, evidence)\n    if (stored.staged) assertRecoveryMatchesStaged(stored.staged, recovered)\n    const requestedDigest = stored.staged?.terminalDigest ?? recovered.terminalDigest\n    if (stored.terminal) return rejectedFinish(stored.terminal, requestedDigest)\n    assertExpiredLease(stored.claim.leaseExpiresAtMs, this.now())\n    const terminal = stored.staged ?? recovered\n    assertRecoveryMatchesStaged(terminal, recovered)\n    stored.staged ??= terminal\n    stored.terminal = terminal\n    return Object.freeze({ finished: true, terminal })\n  }\n\n  private requireClaim(\n    attempt: Pick<AgentCandidateExecutionLease, 'executionId' | 'attempt'>,\n    operation = 'candidate execution lease',\n  ): StoredClaim {\n    const stored = this.claims.get(claimSlot(attempt))\n    if (!stored) throw new Error(`${operation} does not name an acquired attempt`)\n    return stored\n  }\n}\n\nconst SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/\nconst LEASE_TOKEN_PATTERN = /^candidate-execution-lease\\.[A-Za-z0-9_-]{43}$/\nconst PREPARATION_ID_PATTERN = /^candidate-preparation\\.[A-Za-z0-9_-]{43}$/\n\nfunction sealClaim(claim: AgentCandidateExecutionClaim): AgentCandidateExecutionClaim {\n  assertExactKeys(\n    claim,\n    [\n      'executionId',\n      'attempt',\n      'maxAttempts',\n      'retryPolicy',\n      'bundleDigest',\n      'executionPlanDigest',\n      'preparationEvidence',\n      'retryLineageDigest',\n      'leaseExpiresAtMs',\n      'resultTimeoutMs',\n      'cleanup',\n    ],\n    'candidate execution claim',\n  )\n  assertExecutionId(claim.executionId)\n  if (!Number.isSafeInteger(claim.attempt) || claim.attempt < 1) {\n    throw new Error('candidate execution claim attempt must be a positive safe integer')\n  }\n  if (!Number.isSafeInteger(claim.maxAttempts) || claim.maxAttempts < 1) {\n    throw new Error('candidate execution claim maxAttempts must be a positive safe integer')\n  }\n  if (claim.attempt > claim.maxAttempts) {\n    throw new Error('candidate execution claim attempt exceeds maxAttempts')\n  }\n  if (!['none', 'pre-model-infrastructure-only'].includes(claim.retryPolicy)) {\n    throw new Error('candidate execution claim retryPolicy is invalid')\n  }\n  if (claim.retryPolicy === 'none' && claim.maxAttempts !== 1) {\n    throw new Error('candidate execution claim retryPolicy none requires maxAttempts 1')\n  }\n  assertSha256Digest(claim.bundleDigest, 'bundleDigest')\n  assertSha256Digest(claim.executionPlanDigest, 'executionPlanDigest')\n  const preparationEvidence = sealCandidatePreparationEvidence(\n    claim.preparationEvidence,\n    claim.executionPlanDigest,\n  )\n  assertSha256Digest(claim.retryLineageDigest, 'retryLineageDigest')\n  assertPositiveTimestamp(claim.leaseExpiresAtMs, 'leaseExpiresAtMs')\n  candidateResultTimeout(claim.resultTimeoutMs, claim.resultTimeoutMs)\n  const cleanup = sealCleanupHandles(claim.cleanup)\n  return Object.freeze({\n    executionId: claim.executionId,\n    attempt: claim.attempt,\n    maxAttempts: claim.maxAttempts,\n    retryPolicy: claim.retryPolicy,\n    bundleDigest: claim.bundleDigest,\n    executionPlanDigest: claim.executionPlanDigest,\n    preparationEvidence,\n    retryLineageDigest: claim.retryLineageDigest,\n    leaseExpiresAtMs: claim.leaseExpiresAtMs,\n    resultTimeoutMs: claim.resultTimeoutMs,\n    cleanup,\n  })\n}\n\nfunction sealCleanupHandles(\n  cleanup: AgentCandidateExecutionCleanupHandles,\n): AgentCandidateExecutionCleanupHandles {\n  assertExactKeys(\n    cleanup,\n    cleanup.memory\n      ? [\n          'preparationId',\n          'modelGrantDigest',\n          'resolvedModel',\n          'traceRunId',\n          'cleanupTimeoutMs',\n          'memory',\n        ]\n      : ['preparationId', 'modelGrantDigest', 'resolvedModel', 'traceRunId', 'cleanupTimeoutMs'],\n    'candidate execution cleanup handles',\n  )\n  if (!PREPARATION_ID_PATTERN.test(cleanup.preparationId)) {\n    throw new Error('candidate execution cleanup preparationId is invalid')\n  }\n  assertSha256Digest(cleanup.modelGrantDigest, 'cleanup modelGrantDigest')\n  const resolvedModel = immutableCandidateValue(\n    agentCandidateResolvedModelSchema.parse(cleanup.resolvedModel),\n  )\n  assertBoundedIdentifier(cleanup.traceRunId, 'cleanup traceRunId', 512)\n  const cleanupTimeoutMs = candidateCleanupTimeout(cleanup.cleanupTimeoutMs)\n  const memory = cleanup.memory ? sealMemoryCleanupHandle(cleanup.memory) : undefined\n  return Object.freeze({\n    preparationId: cleanup.preparationId,\n    modelGrantDigest: cleanup.modelGrantDigest,\n    resolvedModel,\n    traceRunId: cleanup.traceRunId,\n    cleanupTimeoutMs,\n    ...(memory ? { memory } : {}),\n  })\n}\n\nfunction sealMemoryCleanupHandle(\n  memory: NonNullable<AgentCandidateExecutionCleanupHandles['memory']>,\n): NonNullable<AgentCandidateExecutionCleanupHandles['memory']> {\n  assertExactKeys(\n    memory,\n    ['accessDigest', 'effectiveNamespace'],\n    'candidate execution memory cleanup handle',\n  )\n  assertSha256Digest(memory.accessDigest, 'memory accessDigest')\n  assertBoundedIdentifier(memory.effectiveNamespace, 'memory effectiveNamespace', 1_024)\n  return Object.freeze({\n    accessDigest: memory.accessDigest,\n    effectiveNamespace: memory.effectiveNamespace,\n  })\n}\n\nfunction sealAttemptRef(\n  attempt: AgentCandidateExecutionAttemptRef,\n): AgentCandidateExecutionAttemptRef {\n  assertExactKeys(attempt, ['executionId', 'attempt'], 'candidate execution attempt reference')\n  assertExecutionId(attempt.executionId)\n  if (!Number.isSafeInteger(attempt.attempt) || attempt.attempt < 1) {\n    throw new Error('candidate execution attempt reference must have a positive safe attempt')\n  }\n  return Object.freeze({ executionId: attempt.executionId, attempt: attempt.attempt })\n}\n\nfunction sealLease(lease: AgentCandidateExecutionLease): AgentCandidateExecutionLease {\n  assertExactKeys(\n    lease,\n    ['executionId', 'attempt', 'token', 'expiresAtMs'],\n    'candidate execution lease',\n  )\n  if (lease.executionId.length === 0 || !Number.isSafeInteger(lease.attempt) || lease.attempt < 1) {\n    throw new Error('candidate execution lease identity is invalid')\n  }\n  if (!LEASE_TOKEN_PATTERN.test(lease.token)) {\n    throw new Error('candidate execution lease token is invalid')\n  }\n  assertPositiveTimestamp(lease.expiresAtMs, 'lease expiresAtMs')\n  return Object.freeze({\n    executionId: lease.executionId,\n    attempt: lease.attempt,\n    token: lease.token,\n    expiresAtMs: lease.expiresAtMs,\n  })\n}\n\nfunction newLease(claim: AgentCandidateExecutionClaim): AgentCandidateExecutionLease {\n  return Object.freeze({\n    executionId: claim.executionId,\n    attempt: claim.attempt,\n    token: `candidate-execution-lease.${randomBytes(32).toString('base64url')}`,\n    expiresAtMs: claim.leaseExpiresAtMs,\n  })\n}\n\nfunction leaseDigest(lease: AgentCandidateExecutionLease): Sha256Digest {\n  return sha256(lease.token)\n}\n\nfunction assertLease(\n  expectedDigest: Sha256Digest,\n  expectedExpiresAtMs: number,\n  lease: AgentCandidateExecutionLease,\n): void {\n  const expected = Buffer.from(expectedDigest)\n  const actual = Buffer.from(leaseDigest(lease))\n  if (\n    expected.length !== actual.length ||\n    !timingSafeEqual(expected, actual) ||\n    lease.expiresAtMs !== expectedExpiresAtMs\n  ) {\n    throw new Error('candidate execution lease is invalid')\n  }\n}\n\nfunction claimSlot(claim: Pick<AgentCandidateExecutionClaim, 'executionId' | 'attempt'>): string {\n  return createHash('sha256')\n    .update(JSON.stringify([claim.executionId, claim.attempt]), 'utf8')\n    .digest('hex')\n}\n\nfunction retryRejectionFromMemory(\n  claims: ReadonlyMap<string, StoredClaim>,\n  claim: AgentCandidateExecutionClaim,\n): AgentCandidateRetryRejection | undefined {\n  if (claim.attempt === 1) return undefined\n  const prior = claims.get(\n    claimSlot({ executionId: claim.executionId, attempt: claim.attempt - 1 }),\n  )\n  return retryRejection(claim, prior)\n}\n\nfunction retryRejection(\n  claim: AgentCandidateExecutionClaim,\n  prior:\n    | {\n        claim: AgentCandidateExecutionClaim\n        terminal?: AgentCandidateExecutionTerminalRecord\n      }\n    | undefined,\n): AgentCandidateRetryRejection | undefined {\n  if (!prior) return 'prior-attempt-missing'\n  if (\n    claim.retryPolicy !== 'pre-model-infrastructure-only' ||\n    prior.claim.retryPolicy !== claim.retryPolicy ||\n    prior.claim.maxAttempts !== claim.maxAttempts ||\n    prior.claim.bundleDigest !== claim.bundleDigest ||\n    prior.claim.retryLineageDigest !== claim.retryLineageDigest\n  ) {\n    return 'retry-lineage-mismatch'\n  }\n  if (!prior.terminal) return 'prior-attempt-running'\n  if (prior.terminal.status === 'succeeded') return 'prior-attempt-succeeded'\n  if (prior.terminal.usage.modelCalls !== 0) return 'prior-attempt-spent-model-calls'\n  if (prior.terminal.failureClass !== 'pre-model-infrastructure') {\n    return 'prior-attempt-not-pre-model-infrastructure'\n  }\n  return undefined\n}\n\nfunction rejectedExistingClaim(\n  existing: AgentCandidateExecutionClaim,\n  requested: AgentCandidateExecutionClaim,\n): AgentCandidateExecutionClaimResult {\n  return Object.freeze({\n    acquired: false,\n    reason: 'already-claimed',\n    claim: existing,\n    exactReplay: canonicalCandidateDigest(existing) === canonicalCandidateDigest(requested),\n  })\n}\n\nfunction rejectedRetry(\n  claim: AgentCandidateExecutionClaim,\n  detail: AgentCandidateRetryRejection,\n): AgentCandidateExecutionClaimResult {\n  return Object.freeze({ acquired: false, reason: 'retry-not-eligible', claim, detail })\n}\n\nasync function readClaim(path: string): Promise<StoredClaim> {\n  const parsed = await readJsonObject(path, 'claim')\n  const record = parsed as Partial<PersistedAgentCandidateExecutionClaim>\n  assertExactKeys(\n    parsed,\n    [\n      'executionId',\n      'attempt',\n      'maxAttempts',\n      'retryPolicy',\n      'bundleDigest',\n      'executionPlanDigest',\n      'preparationEvidence',\n      'retryLineageDigest',\n      'leaseExpiresAtMs',\n      'resultTimeoutMs',\n      'cleanup',\n      'phase',\n      'leaseDigest',\n    ],\n    `candidate execution claim at ${path}`,\n  )\n  const claim = sealClaim({\n    executionId: requireString(record.executionId, path, 'executionId'),\n    attempt: requireNumber(record.attempt, path, 'attempt'),\n    maxAttempts: requireNumber(record.maxAttempts, path, 'maxAttempts'),\n    retryPolicy: requireRetryPolicy(record.retryPolicy, path),\n    bundleDigest: requireString(record.bundleDigest, path, 'bundleDigest') as Sha256Digest,\n    executionPlanDigest: requireString(\n      record.executionPlanDigest,\n      path,\n      'executionPlanDigest',\n    ) as Sha256Digest,\n    preparationEvidence: requireObject(\n      record.preparationEvidence,\n      path,\n      'preparationEvidence',\n    ) as unknown as AgentCandidateExecutionClaim['preparationEvidence'],\n    retryLineageDigest: requireString(\n      record.retryLineageDigest,\n      path,\n      'retryLineageDigest',\n    ) as Sha256Digest,\n    leaseExpiresAtMs: requireNumber(record.leaseExpiresAtMs, path, 'leaseExpiresAtMs'),\n    resultTimeoutMs: requireNumber(record.resultTimeoutMs, path, 'resultTimeoutMs'),\n    cleanup: requireObject(\n      record.cleanup,\n      path,\n      'cleanup',\n    ) as unknown as AgentCandidateExecutionCleanupHandles,\n  })\n  const persistedLeaseDigest = requireString(\n    record.leaseDigest,\n    path,\n    'leaseDigest',\n  ) as Sha256Digest\n  assertSha256Digest(persistedLeaseDigest, 'leaseDigest')\n  if (record.phase !== 'claimed') {\n    throw new Error(`candidate execution claim at ${path} has invalid initial phase`)\n  }\n  return { claim, leaseDigest: persistedLeaseDigest, phase: 'claimed' }\n}\n\nasync function readClaimIfPresent(path: string): Promise<StoredClaim | undefined> {\n  try {\n    return await readClaim(path)\n  } catch (error) {\n    if (isMissingError(error)) return undefined\n    throw error\n  }\n}\n\nasync function readTerminal(path: string): Promise<AgentCandidateExecutionTerminalRecord> {\n  const parsed = await readJsonObject(path, 'terminal record')\n  const record = parsed as Partial<PersistedAgentCandidateExecutionTerminal>\n  assertExactKeys(parsed, ['terminal'], `candidate execution terminal record at ${path}`)\n  return sealTerminalRecordValue(\n    requireObject(record.terminal, path, 'terminal'),\n    `candidate execution terminal record at ${path}`,\n  )\n}\n\nasync function readTerminalIfPresent(\n  path: string,\n): Promise<AgentCandidateExecutionTerminalRecord | undefined> {\n  try {\n    return await readTerminal(path)\n  } catch (error) {\n    if (isMissingError(error)) return undefined\n    throw error\n  }\n}\n\ntype ReadCandidateExecutionTransition =\n  | { kind: 'phase' }\n  | { kind: 'pending'; terminal: AgentCandidateExecutionTerminalRecord }\n\nasync function readTransitionIfPresent(\n  path: string,\n  claim: AgentCandidateExecutionClaim,\n): Promise<ReadCandidateExecutionTransition | undefined> {\n  let parsed: Record<string, unknown>\n  try {\n    parsed = await readJsonObject(path, 'transition record')\n  } catch (error) {\n    if (isMissingError(error)) return undefined\n    throw error\n  }\n  if (parsed.kind === 'candidate-execution-phase') {\n    const record = parsed as unknown as PersistedAgentCandidateExecutionPhase\n    assertExactKeys(\n      parsed,\n      ['kind', 'executionId', 'attempt', 'executionPlanDigest', 'phase'],\n      `candidate execution phase record at ${path}`,\n    )\n    if (\n      record.executionId !== claim.executionId ||\n      record.attempt !== claim.attempt ||\n      record.executionPlanDigest !== claim.executionPlanDigest ||\n      record.phase !== 'candidate-may-run'\n    ) {\n      throw new Error(`candidate execution phase record at ${path} does not match its claim`)\n    }\n    return { kind: 'phase' }\n  }\n  if (parsed.kind === 'candidate-execution-pending-terminal') {\n    const record = parsed as unknown as PersistedAgentCandidateExecutionPending\n    assertExactKeys(parsed, ['kind', 'terminal'], `candidate execution pending record at ${path}`)\n    const terminal = sealTerminalRecordValue(\n      requireObject(record.terminal, path, 'terminal'),\n      `candidate execution pending record at ${path}`,\n    )\n    assertTerminalMatchesClaim(terminal, claim, path)\n    return { kind: 'pending', terminal }\n  }\n  throw new Error(`candidate execution transition record at ${path} has invalid kind`)\n}\n\nasync function readJsonObject(path: string, kind: string): Promise<Record<string, unknown>> {\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(await readFile(path, 'utf8'))\n  } catch (error) {\n    if (isMissingError(error)) throw error\n    throw new Error(`candidate execution ${kind} at ${path} is unreadable`, { cause: error })\n  }\n  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    throw new Error(`candidate execution ${kind} at ${path} is not an object`)\n  }\n  return parsed as Record<string, unknown>\n}\n\nfunction assertSameSlot(\n  existing: Pick<AgentCandidateExecutionClaim, 'executionId' | 'attempt'>,\n  requested: Pick<AgentCandidateExecutionClaim, 'executionId' | 'attempt'>,\n  path: string,\n): void {\n  if (existing.executionId !== requested.executionId || existing.attempt !== requested.attempt) {\n    throw new Error(`candidate execution record at ${path} does not match its claim slot`)\n  }\n}\n\nfunction assertSha256Digest(value: string, field: string): void {\n  if (!SHA256_PATTERN.test(value)) {\n    throw new Error(`candidate execution claim ${field} must be a lowercase sha256 digest`)\n  }\n}\n\nfunction requireString(value: unknown, path: string, field: string): string {\n  if (typeof value !== 'string') {\n    throw new Error(`candidate execution record at ${path} has invalid ${field}`)\n  }\n  return value\n}\n\nfunction requireNumber(value: unknown, path: string, field: string): number {\n  if (typeof value !== 'number') {\n    throw new Error(`candidate execution record at ${path} has invalid ${field}`)\n  }\n  return value\n}\n\nfunction requireObject(value: unknown, path: string, field: string): Record<string, unknown> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`candidate execution record at ${path} has invalid ${field}`)\n  }\n  return value as Record<string, unknown>\n}\n\nfunction requireRetryPolicy(\n  value: unknown,\n  path: string,\n): AgentCandidateAttemptPolicy['retryPolicy'] {\n  if (value !== 'none' && value !== 'pre-model-infrastructure-only') {\n    throw new Error(`candidate execution record at ${path} has invalid retryPolicy`)\n  }\n  return value\n}\n\nfunction assertExecutionId(value: unknown): asserts value is string {\n  if (typeof value !== 'string' || !/^[A-Za-z0-9._:-]{1,200}$/.test(value)) {\n    throw new Error('candidate execution claim executionId is invalid')\n  }\n}\n\nfunction assertBoundedIdentifier(\n  value: unknown,\n  label: string,\n  maxLength: number,\n): asserts value is string {\n  if (\n    typeof value !== 'string' ||\n    value.length === 0 ||\n    value.length > maxLength ||\n    hasControlCharacter(value)\n  ) {\n    throw new Error(`candidate execution ${label} is invalid`)\n  }\n}\n\nfunction hasControlCharacter(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code < 0x20 || code === 0x7f) return true\n  }\n  return false\n}\n\nfunction assertPositiveTimestamp(value: unknown, label: string): asserts value is number {\n  if (!Number.isSafeInteger(value) || (value as number) <= 0) {\n    throw new Error(`candidate execution ${label} must be a positive safe timestamp`)\n  }\n}\n\nfunction assertClock(value: number): void {\n  if (!Number.isSafeInteger(value) || value < 0) {\n    throw new Error('candidate execution claim-store clock returned an invalid timestamp')\n  }\n}\n\nfunction assertUnexpiredLease(expiresAtMs: number, nowMs: number): void {\n  assertClock(nowMs)\n  if (nowMs >= expiresAtMs) throw new Error('candidate execution lease has expired')\n}\n\nfunction assertExpiredLease(expiresAtMs: number, nowMs: number): void {\n  assertClock(nowMs)\n  if (nowMs < expiresAtMs) throw new Error('candidate execution lease has not expired')\n}\n\nfunction sha256(value: string): Sha256Digest {\n  return `sha256:${createHash('sha256').update(value, 'utf8').digest('hex')}`\n}\n\nfunction isMissingError(error: unknown): boolean {\n  return isNodeError(error, 'ENOENT')\n}\n\nfunction isNodeError(error: unknown, code: string): boolean {\n  return (\n    error !== null &&\n    typeof error === 'object' &&\n    'code' in error &&\n    (error as { code?: unknown }).code === code\n  )\n}\n\nexport const candidateClaimFileInternals = Object.freeze({\n  assertExpiredLease,\n  assertLease,\n  assertSameSlot,\n  assertUnexpiredLease,\n  attemptRecord,\n  claimSlot,\n  leaseDigest,\n  newLease,\n  readClaim,\n  readClaimIfPresent,\n  readTerminal,\n  readTerminalIfPresent,\n  readTransitionIfPresent,\n  rejectedExistingClaim,\n  rejectedRetry,\n  retryRejection,\n  sealAttemptRef,\n  sealClaim,\n  sealLease,\n})\n\nexport { candidateExecutionClaim } from './claim-plan'\n","import { isLlmSpan, type LlmSpan, type TraceStore } from '@tangle-network/agent-eval'\nimport type {\n  AgentCandidateFixedSpend,\n  AgentCandidateModelSettlementCall,\n} from '@tangle-network/agent-interface'\nimport { assertExactObjectKeys } from './exact-object'\nimport type { AgentCandidateProtectedModelSettlement } from './types'\n\nconst USD_NANOS = 1_000_000_000\n\nexport interface SealedAgentCandidateModelSettlement {\n  readonly value: AgentCandidateProtectedModelSettlement\n  /** `inputTokens` is the gateway's accounted input total. */\n  readonly usage: AgentCandidateFixedSpend\n}\n\n/** Validate and detach the evaluator gateway's terminal, revoked call ledger. */\nexport function sealAgentCandidateModelSettlement(\n  settlement: AgentCandidateProtectedModelSettlement,\n  expected: { preparationId: string; grantDigest: string; model: string },\n): SealedAgentCandidateModelSettlement {\n  assertExactObjectKeys(\n    settlement,\n    ['preparationId', 'grantDigest', 'closed', 'usageWithinLimits', 'calls'],\n    'model settlement',\n  )\n  if (settlement.closed !== true) throw new Error('protected model grant is not closed')\n  if (settlement.usageWithinLimits !== true) {\n    throw new Error('protected model settlement reports usage outside frozen limits')\n  }\n  if (settlement.grantDigest !== expected.grantDigest) {\n    throw new Error('protected model settlement grant digest does not match the reservation')\n  }\n  if (settlement.preparationId !== expected.preparationId) {\n    throw new Error('protected model settlement preparation does not match the reservation')\n  }\n  if (!Array.isArray(settlement.calls)) {\n    throw new Error('protected model settlement calls must be an array')\n  }\n\n  const callIds = new Set<string>()\n  const spanIds = new Set<string>()\n  let accountedInputTokens = 0\n  let outputTokens = 0\n  let cachedInputTokens = 0\n  let reasoningTokens = 0\n  let costUsdNanos = 0\n  let costProvenance: AgentCandidateFixedSpend['costProvenance'] = 'observed'\n  const calls = settlement.calls.map((source, index) => {\n    assertExactObjectKeys(\n      source,\n      [\n        'callId',\n        'generationId',\n        'traceSpanId',\n        'status',\n        'model',\n        'startedAtMs',\n        'endedAtMs',\n        'inputTokens',\n        'accountedInputTokens',\n        'outputTokens',\n        'cachedInputTokens',\n        'reasoningTokens',\n        'costUsdNanos',\n        'costProvenance',\n      ],\n      `model settlement call ${index}`,\n    )\n    assertIdentifier(source.callId, `model settlement call ${index} callId`)\n    assertIdentifier(source.generationId, `model settlement call ${index} generationId`)\n    assertIdentifier(source.traceSpanId, `model settlement call ${index} traceSpanId`)\n    if (source.traceSpanId !== source.generationId) {\n      throw new Error(`model settlement call ${index} traceSpanId is not its router generationId`)\n    }\n    if (source.status !== 'succeeded' && source.status !== 'failed') {\n      throw new Error(`model settlement call ${index} has an invalid status`)\n    }\n    if (callIds.has(source.callId))\n      throw new Error('protected model settlement has duplicate call ids')\n    if (spanIds.has(source.traceSpanId)) {\n      throw new Error('protected model settlement has duplicate trace span ids')\n    }\n    callIds.add(source.callId)\n    spanIds.add(source.traceSpanId)\n    if (source.model !== expected.model) {\n      throw new Error(`protected model settlement call ${index} has an unexpected model`)\n    }\n    assertTimestamp(source.startedAtMs, `model settlement call ${index} startedAtMs`)\n    assertTimestamp(source.endedAtMs, `model settlement call ${index} endedAtMs`)\n    if (source.endedAtMs < source.startedAtMs) {\n      throw new Error(`model settlement call ${index} ended before it started`)\n    }\n    assertCount(source.inputTokens, `model settlement call ${index} inputTokens`)\n    assertCount(source.accountedInputTokens, `model settlement call ${index} accountedInputTokens`)\n    if (source.accountedInputTokens < source.inputTokens) {\n      throw new Error(\n        `model settlement call ${index} accountedInputTokens cannot be less than inputTokens`,\n      )\n    }\n    assertCount(source.outputTokens, `model settlement call ${index} outputTokens`)\n    assertCount(source.cachedInputTokens, `model settlement call ${index} cachedInputTokens`)\n    cachedInputTokens = safeAdd(\n      cachedInputTokens,\n      source.cachedInputTokens,\n      'cached input token total',\n    )\n    assertCount(source.reasoningTokens, `model settlement call ${index} reasoningTokens`)\n    reasoningTokens = safeAdd(reasoningTokens, source.reasoningTokens, 'reasoning token total')\n    assertCount(source.costUsdNanos, `model settlement call ${index} costUsdNanos`)\n    if (source.costProvenance !== 'observed' && source.costProvenance !== 'estimated') {\n      throw new Error(`model settlement call ${index} has an invalid cost provenance`)\n    }\n    if (source.costProvenance === 'estimated') costProvenance = 'estimated'\n    accountedInputTokens = safeAdd(\n      accountedInputTokens,\n      source.accountedInputTokens,\n      'accounted input token total',\n    )\n    outputTokens = safeAdd(outputTokens, source.outputTokens, 'output token total')\n    costUsdNanos = safeAdd(costUsdNanos, source.costUsdNanos, 'cost total')\n    return Object.freeze({ ...source })\n  })\n\n  const usage = Object.freeze({\n    costUsdNanos,\n    inputTokens: accountedInputTokens,\n    outputTokens,\n    cachedInputTokens,\n    reasoningTokens,\n    modelCalls: calls.length,\n    costProvenance,\n  })\n  return Object.freeze({\n    value: Object.freeze({\n      preparationId: settlement.preparationId,\n      grantDigest: settlement.grantDigest,\n      closed: true as const,\n      usageWithinLimits: true as const,\n      calls: Object.freeze(calls),\n    }),\n    usage,\n  })\n}\n\n/**\n * Append the only accepted LLM spans from the router's closed ledger.\n * Candidate and executor code may write tool/process spans, but never model usage.\n */\nexport async function appendAuthoritativeModelSettlementSpans(\n  traceStore: TraceStore,\n  runId: string,\n  settlement: SealedAgentCandidateModelSettlement,\n): Promise<void> {\n  const run = await traceStore.getRun(runId)\n  if (!run) throw new Error(`protected trace run is missing before model settlement: ${runId}`)\n  if (run.status === 'running' || run.endedAt === undefined) {\n    throw new Error('protected trace run must be terminal before model spans are appended')\n  }\n  const existing = await traceStore.spans({ runId })\n  if (existing.some(isLlmSpan)) {\n    throw new Error(\n      'protected trace contains a model span not authored from the closed router ledger',\n    )\n  }\n  const occupiedIds = new Set(existing.map((span) => span.spanId))\n  for (const call of settlement.value.calls) {\n    if (occupiedIds.has(call.traceSpanId)) {\n      throw new Error(\n        `protected trace span identity collides with router generation ${call.generationId}`,\n      )\n    }\n    await traceStore.appendSpan({\n      runId,\n      spanId: call.traceSpanId,\n      kind: 'llm',\n      name: 'protected model call',\n      model: call.model,\n      messages: [],\n      startedAt: call.startedAtMs,\n      endedAt: call.endedAtMs,\n      status: call.status === 'succeeded' ? 'ok' : 'error',\n      inputTokens: call.inputTokens,\n      outputTokens: call.outputTokens,\n      cachedTokens: call.cachedInputTokens,\n      reasoningTokens: call.reasoningTokens,\n      costUsd: call.costUsdNanos / USD_NANOS,\n      attributes: {\n        'tangle.protected_model.source': 'router-settlement',\n        'tangle.router.call_id': call.callId,\n        'tangle.router.generation_id': call.generationId,\n      },\n    })\n  }\n}\n\n/** Match every protected trace span one-for-one against gateway call evidence. */\nexport function assertTraceMatchesModelSettlement(\n  spans: readonly LlmSpan[],\n  settlement: SealedAgentCandidateModelSettlement,\n): void {\n  if (spans.length !== settlement.value.calls.length) {\n    throw new Error(\n      `protected trace model calls ${spans.length} do not match model ledger ${settlement.value.calls.length}`,\n    )\n  }\n  const byId = new Map(spans.map((span) => [span.spanId, span]))\n  if (byId.size !== spans.length) throw new Error('protected trace has duplicate model span ids')\n  for (const call of settlement.value.calls) {\n    const span = byId.get(call.traceSpanId)\n    if (!span) {\n      throw new Error(`protected trace is missing model ledger span ${call.traceSpanId}`)\n    }\n    assertTraceCall(span, call)\n  }\n}\n\nexport function usdToNanos(value: number, label: string): number {\n  if (!Number.isFinite(value) || value < 0) throw new Error(`${label} must be nonnegative`)\n  const nanos = Math.round(value * USD_NANOS)\n  if (!Number.isSafeInteger(nanos)) throw new Error(`${label} exceeds fixed-point range`)\n  return nanos\n}\n\nfunction assertTraceCall(span: LlmSpan, call: AgentCandidateModelSettlementCall): void {\n  if (span.model !== call.model) {\n    throw new Error(`protected trace span ${span.spanId} model does not match model ledger`)\n  }\n  if (\n    span.startedAt !== call.startedAtMs ||\n    span.endedAt !== call.endedAtMs ||\n    span.status !== (call.status === 'succeeded' ? 'ok' : 'error')\n  ) {\n    throw new Error(\n      `protected trace span ${span.spanId} timing or status does not match model ledger`,\n    )\n  }\n  if (\n    span.attributes?.['tangle.protected_model.source'] !== 'router-settlement' ||\n    span.attributes?.['tangle.router.call_id'] !== call.callId ||\n    span.attributes?.['tangle.router.generation_id'] !== call.generationId\n  ) {\n    throw new Error(`protected trace span ${span.spanId} lacks router settlement provenance`)\n  }\n  for (const [name, traced, settled] of [\n    ['inputTokens', span.inputTokens, call.inputTokens],\n    ['outputTokens', span.outputTokens, call.outputTokens],\n    ['cachedInputTokens', span.cachedTokens ?? 0, call.cachedInputTokens],\n    ['reasoningTokens', span.reasoningTokens ?? 0, call.reasoningTokens],\n  ] as const) {\n    if (traced === undefined || traced !== settled) {\n      throw new Error(\n        `protected trace span ${span.spanId} ${name} ${traced} does not match model ledger ${settled}`,\n      )\n    }\n  }\n  if (span.costUsd === undefined) {\n    throw new Error(`protected trace span ${span.spanId} is missing costUsd`)\n  }\n  const tracedCost = usdToNanos(span.costUsd, `protected trace span ${span.spanId} costUsd`)\n  if (tracedCost !== call.costUsdNanos) {\n    throw new Error(\n      `protected trace span ${span.spanId} costUsdNanos ${tracedCost} does not match model ledger ${call.costUsdNanos}`,\n    )\n  }\n}\n\nfunction assertIdentifier(value: unknown, label: string): asserts value is string {\n  if (typeof value !== 'string' || value.length === 0 || value.length > 256) {\n    throw new Error(`${label} must be a non-empty bounded string`)\n  }\n}\n\nfunction assertCount(value: unknown, label: string): asserts value is number {\n  if (!Number.isSafeInteger(value) || (value as number) < 0) {\n    throw new Error(`${label} must be a nonnegative safe integer`)\n  }\n}\n\nfunction assertTimestamp(value: unknown, label: string): asserts value is number {\n  if (!Number.isSafeInteger(value) || (value as number) <= 0) {\n    throw new Error(`${label} must be a positive safe integer`)\n  }\n}\n\nfunction safeAdd(left: number, right: number, label: string): number {\n  const total = left + right\n  if (!Number.isSafeInteger(total)) throw new Error(`${label} exceeds safe integer range`)\n  return total\n}\n","import type {\n  AgentCandidateBundle,\n  AgentCandidateCapturedArtifact,\n  AgentCandidateResourceRef,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\nimport { agentCandidateBundleSchema } from '@tangle-network/agent-interface'\n\nimport {\n  artifactCacheKey,\n  readVerifiedArtifact,\n  verifyBytes,\n  verifyWorkspaceSnapshotArtifacts,\n} from './artifacts'\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  deepFreezeCandidate,\n  omitTopLevelDigest,\n} from './digest'\nimport { readCandidateGitHubResource, verifyCandidateCode } from './git-materialize'\nimport { assertCandidateProfileExecutionSupport } from './profile'\nimport {\n  type AgentCandidateVerificationPorts,\n  type VerifiedAgentCandidate,\n  verifiedCandidateBrand,\n} from './types'\n\ninterface VerifiedCandidateState {\n  ports: AgentCandidateVerificationPorts\n  artifactBytes: Map<string, Uint8Array>\n  resourceBytes: Map<string, Uint8Array>\n}\n\nconst verifiedCandidateState = new WeakMap<VerifiedAgentCandidate, VerifiedCandidateState>()\n\n/** Surfaces admitted by Runtime's verifier before an environment adapter is selected. */\nexport const AGENT_CANDIDATE_EXECUTION_SUPPORT = Object.freeze({\n  outcomes: Object.freeze(['workspace', 'output'] as const),\n  code: Object.freeze(['disabled', 'no-op', 'git-patch'] as const),\n  memory: Object.freeze(['disabled', 'isolated'] as const),\n  knowledge: true,\n  profile: Object.freeze({\n    mcpTransports: Object.freeze(['stdio'] as const),\n    remoteMcp: false,\n    tools: false,\n    permissions: false,\n    modes: false,\n    confidential: false,\n  }),\n})\n\n/** Verifies every digest, resource, workspace, and Git object in a candidate bundle. */\nexport async function verifyAgentCandidateBundle(\n  input: unknown,\n  ports: AgentCandidateVerificationPorts,\n): Promise<VerifiedAgentCandidate> {\n  const parsed = agentCandidateBundleSchema.parse(input)\n  const withoutDigest = omitTopLevelDigest(parsed)\n  const actualDigest = canonicalCandidateDigest(withoutDigest)\n  if (actualDigest !== parsed.digest) {\n    throw new Error(`candidate bundle digest ${parsed.digest} does not match ${actualDigest}`)\n  }\n  const canonicalBytes = canonicalCandidateBytes(withoutDigest)\n  verifyBytes(canonicalBytes, parsed.digest, canonicalBytes.byteLength, 'candidate bundle')\n  assertCandidateProfileExecutionSupport(parsed.profile)\n\n  const artifactBytes = new Map<string, Uint8Array>()\n  const readArtifact = async (artifact: AgentCandidateCapturedArtifact): Promise<Uint8Array> => {\n    const key = artifactCacheKey(artifact)\n    const existing = artifactBytes.get(key)\n    if (existing) return Uint8Array.from(existing)\n    const bytes = await readVerifiedArtifact(artifact, ports.artifacts)\n    artifactBytes.set(key, Uint8Array.from(bytes))\n    return bytes\n  }\n\n  let patchBytes: Uint8Array | undefined\n  if (parsed.code.kind === 'git-patch') {\n    patchBytes = await readArtifact(parsed.code.patch.artifact)\n  }\n  const materializedTree = await verifyCandidateCode(parsed.code, ports.repositories, patchBytes)\n\n  const resourceBytes = new Map<string, Uint8Array>()\n  for (const resource of candidateResources(parsed)) {\n    const bytes =\n      resource.kind === 'inline'\n        ? Buffer.from(resource.content, 'utf8')\n        : await readCandidateGitHubResource(resource, ports.repositories)\n    verifyBytes(\n      bytes,\n      resource.sha256,\n      resource.byteLength,\n      `candidate resource ${resource.name ?? (resource.kind === 'github' ? resource.path : '<unnamed>')}`,\n    )\n    resourceBytes.set(resourceKey(resource), Uint8Array.from(bytes))\n    resourceBytes.set(resource.sha256, Uint8Array.from(bytes))\n  }\n\n  if (parsed.execution.workspace) {\n    const workspace = await verifyWorkspaceSnapshotArtifacts(\n      parsed.execution.workspace,\n      ports.artifacts,\n    )\n    artifactBytes.set(artifactCacheKey(parsed.execution.workspace.manifest), workspace.manifest)\n    artifactBytes.set(artifactCacheKey(parsed.execution.workspace.archive), workspace.archive)\n  }\n  if (parsed.knowledge) {\n    const knowledge = await verifyWorkspaceSnapshotArtifacts(\n      parsed.knowledge.snapshot,\n      ports.artifacts,\n    )\n    artifactBytes.set(artifactCacheKey(parsed.knowledge.snapshot.manifest), knowledge.manifest)\n    artifactBytes.set(artifactCacheKey(parsed.knowledge.snapshot.archive), knowledge.archive)\n    if (parsed.knowledge.retrievalConfig) await readArtifact(parsed.knowledge.retrievalConfig)\n    await readArtifact(parsed.knowledge.evaluation)\n  }\n  if (parsed.memory.mode === 'isolated' && parsed.memory.seed)\n    await readArtifact(parsed.memory.seed)\n\n  deepFreezeCandidate(parsed)\n  const verified = Object.freeze({\n    bundle: parsed,\n    ...(materializedTree === undefined ? {} : { materializedTree }),\n    [verifiedCandidateBrand]: true as const,\n  })\n  verifiedCandidateState.set(verified, { ports, artifactBytes, resourceBytes })\n  return verified\n}\n\nexport function getVerifiedCandidateState(\n  candidate: VerifiedAgentCandidate,\n): VerifiedCandidateState {\n  const state = verifiedCandidateState.get(candidate)\n  if (!state || candidate[verifiedCandidateBrand] !== true) {\n    throw new Error('candidate must come from verifyAgentCandidateBundle')\n  }\n  return state\n}\n\nexport async function verifiedArtifactBytes(\n  candidate: VerifiedAgentCandidate,\n  artifact: AgentCandidateCapturedArtifact,\n): Promise<Uint8Array> {\n  const state = getVerifiedCandidateState(candidate)\n  const key = artifactCacheKey(artifact)\n  const existing = state.artifactBytes.get(key)\n  if (existing) return Uint8Array.from(existing)\n  const bytes = await readVerifiedArtifact(artifact, state.ports.artifacts)\n  state.artifactBytes.set(key, Uint8Array.from(bytes))\n  return bytes\n}\n\nexport function verifiedResourceBytes(\n  candidate: VerifiedAgentCandidate,\n  resource: AgentCandidateResourceRef,\n): Uint8Array {\n  const bytes = getVerifiedCandidateState(candidate).resourceBytes.get(resourceKey(resource))\n  if (!bytes) {\n    throw new Error(\n      `candidate resource was not verified: ${resource.name ?? (resource.kind === 'github' ? resource.path : '<unnamed>')}`,\n    )\n  }\n  return Uint8Array.from(bytes)\n}\n\nexport function verifiedResourceTextByDigest(\n  candidate: VerifiedAgentCandidate,\n): ReadonlyMap<Sha256Digest, string> {\n  const output = new Map<Sha256Digest, string>()\n  for (const resource of candidateResources(candidate.bundle)) {\n    const bytes = getVerifiedCandidateState(candidate).resourceBytes.get(resource.sha256)\n    if (!bytes) throw new Error(`candidate resource digest was not verified: ${resource.sha256}`)\n    output.set(resource.sha256, new TextDecoder('utf-8', { fatal: true }).decode(bytes))\n  }\n  return output\n}\n\nfunction candidateResources(bundle: AgentCandidateBundle): AgentCandidateResourceRef[] {\n  const resources = bundle.profile.resources\n  if (!resources) return []\n  const output: AgentCandidateResourceRef[] = []\n  for (const mount of resources.files ?? []) output.push(mount.resource)\n  output.push(...(resources.tools ?? []))\n  output.push(...(resources.skills ?? []))\n  output.push(...(resources.agents ?? []))\n  output.push(...(resources.commands ?? []))\n  if (typeof resources.instructions === 'object') output.push(resources.instructions)\n  return output\n}\n\nfunction resourceKey(resource: AgentCandidateResourceRef): string {\n  return canonicalCandidateDigest(resource)\n}\n","import { mkdtemp, rm } from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { join, posix } from 'node:path'\n\nimport type { AgentCandidateRunCell } from '@tangle-network/agent-interface'\nimport { hashKnowledgeBase } from '@tangle-network/agent-knowledge'\n\nimport { readMaterializedWorkspaceFiles } from './artifacts'\nimport type {\n  AgentCandidateExecutionPorts,\n  PreparedAgentCandidateKnowledge,\n  VerifiedAgentCandidate,\n} from './types'\nimport { verifiedArtifactBytes } from './verify'\n\n/** Environment variable containing the materialized candidate knowledge root. */\nexport const CANDIDATE_KNOWLEDGE_ROOT_ENV = 'TANGLE_CANDIDATE_KNOWLEDGE_ROOT'\n/** Environment variable containing the materialized retrieval configuration path. */\nexport const CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV =\n  'TANGLE_CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG'\n\n/** Deterministic, signed locations used by every candidate executor. */\nexport function candidateKnowledgeExecutionPaths(\n  taskRoot: string,\n  hasRetrievalConfig: boolean,\n): { root: string; retrievalConfig?: string } {\n  if (!posix.isAbsolute(taskRoot) || posix.normalize(taskRoot) !== taskRoot) {\n    throw new Error('candidate knowledge requires a normalized absolute task root')\n  }\n  const parent = posix.join(taskRoot, '.tangle')\n  return {\n    root: posix.join(parent, 'knowledge'),\n    ...(hasRetrievalConfig\n      ? { retrievalConfig: posix.join(parent, 'knowledge-retrieval-config.json') }\n      : {}),\n  }\n}\n\n/** Verify and detach the exact file-backed knowledge admitted by the bundle. */\nexport async function prepareAgentCandidateKnowledge(\n  candidate: VerifiedAgentCandidate,\n  ports: AgentCandidateExecutionPorts,\n  arm: AgentCandidateRunCell['arm'],\n): Promise<PreparedAgentCandidateKnowledge | undefined> {\n  const knowledge = candidate.bundle.knowledge\n  if (!knowledge) return undefined\n\n  const archive = await verifiedArtifactBytes(candidate, knowledge.snapshot.archive)\n  const retrievalConfig = knowledge.retrievalConfig\n    ? await verifiedArtifactBytes(candidate, knowledge.retrievalConfig)\n    : undefined\n  const root = await mkdtemp(join(tmpdir(), 'agent-candidate-knowledge-'))\n  try {\n    await ports.workspaces.materialize({\n      role: 'knowledge',\n      snapshot: knowledge.snapshot,\n      archive,\n      destination: root,\n    })\n    const expectedHash =\n      arm === 'baseline' ? knowledge.candidate.baseHash : knowledge.candidate.candidateHash\n    const actualHash = `sha256:${await hashKnowledgeBase(root)}`\n    if (actualHash !== expectedHash) {\n      throw new Error(\n        `materialized ${arm} knowledge does not match its measured content: expected ${expectedHash}, got ${actualHash}`,\n      )\n    }\n    const files = await readMaterializedWorkspaceFiles(root, knowledge.snapshot.material)\n    return Object.freeze({\n      candidate: knowledge.candidate,\n      snapshot: knowledge.snapshot,\n      files: Object.freeze(\n        files.map((file) =>\n          Object.freeze({ path: file.path, mode: file.mode, bytes: Uint8Array.from(file.bytes) }),\n        ),\n      ),\n      ...(retrievalConfig ? { retrievalConfig: Uint8Array.from(retrievalConfig) } : {}),\n    })\n  } finally {\n    await rm(root, { recursive: true, force: true })\n  }\n}\n","import {\n  type AgentCandidateTaskOutcomeSpec,\n  agentCandidateTerminationSchema,\n  agentCandidateWorkspaceManifestMaterialSchema,\n} from '@tangle-network/agent-interface'\nimport { assertExactObjectKeys as assertExactKeys } from './exact-object'\nimport type { AgentCandidateExecutorFinalCapture, AgentCandidateProtectedRunCapture } from './types'\n\nconst sealedFinalCaptureBrand: unique symbol = Symbol('sealedAgentCandidateExecutorFinalCapture')\n\nexport type SealedAgentCandidateExecutorFinalCapture = AgentCandidateExecutorFinalCapture & {\n  readonly [sealedFinalCaptureBrand]: true\n}\n\n/** Validate and detach the only candidate-authored fields accepted from execution. */\nexport function sealAgentCandidateProtectedRunCapture(\n  value: unknown,\n): AgentCandidateProtectedRunCapture {\n  const capture = requireRecord(value, 'candidate execution capture')\n  assertExactKeys(capture, ['executionId', 'termination'], 'candidate execution capture')\n  if (typeof capture.executionId !== 'string' || capture.executionId.length === 0) {\n    throw new Error('candidate execution capture has an invalid executionId')\n  }\n  return Object.freeze({\n    executionId: capture.executionId,\n    termination: Object.freeze(agentCandidateTerminationSchema.parse(capture.termination)),\n  })\n}\n\n/** Validate, detach, and freeze evaluator-owned evidence captured after process death. */\nexport function sealAgentCandidateExecutorFinalCapture(\n  value: unknown,\n  expectedOutcome: AgentCandidateTaskOutcomeSpec,\n): SealedAgentCandidateExecutorFinalCapture {\n  const capture = requireRecord(value, 'candidate final capture')\n  assertExactKeys(capture, [], 'candidate final capture', [\n    'taskOutcome',\n    'memoryAfter',\n    'evidence',\n  ])\n\n  const taskOutcome = capture.taskOutcome\n    ? sealTaskOutcomeCapture(capture.taskOutcome, expectedOutcome)\n    : undefined\n  const memoryAfter = capture.memoryAfter ? sealMemoryCapture(capture.memoryAfter) : undefined\n  if (capture.evidence !== undefined && !(capture.evidence instanceof Uint8Array)) {\n    throw new Error('candidate executor evidence must be a byte array')\n  }\n  const evidence = capture.evidence ? Uint8Array.from(capture.evidence) : undefined\n  return Object.freeze({\n    ...(taskOutcome ? { taskOutcome } : {}),\n    ...(memoryAfter ? { memoryAfter: Object.freeze(memoryAfter) } : {}),\n    ...(evidence ? { evidence } : {}),\n    [sealedFinalCaptureBrand]: true as const,\n  })\n}\n\n/** Prove exact process death before any final evidence capture. */\nexport function sealAgentCandidateExecutorStopAcknowledgement(value: unknown): void {\n  const capture = requireRecord(value, 'candidate stop acknowledgement')\n  assertExactKeys(capture, ['stopped'], 'candidate stop acknowledgement')\n  if (capture.stopped !== true) {\n    throw new Error('candidate stop acknowledgement does not prove process death')\n  }\n}\n\nfunction sealMemoryCapture(\n  value: unknown,\n): NonNullable<AgentCandidateExecutorFinalCapture['memoryAfter']> {\n  const capture = requireRecord(value, 'candidate memory capture')\n  assertExactKeys(capture, ['afterState', 'archive'], 'candidate memory capture')\n  if (!(capture.archive instanceof Uint8Array)) {\n    throw new Error('candidate memory capture archive must be a byte array')\n  }\n  return Object.freeze({\n    afterState: Object.freeze(\n      agentCandidateWorkspaceManifestMaterialSchema.parse(capture.afterState),\n    ),\n    archive: Uint8Array.from(capture.archive),\n  })\n}\n\nfunction sealTaskOutcomeCapture(\n  value: unknown,\n  expected: AgentCandidateTaskOutcomeSpec,\n): NonNullable<AgentCandidateExecutorFinalCapture['taskOutcome']> {\n  const capture = requireRecord(value, 'candidate task capture')\n  if (capture.kind === 'output') {\n    assertExactKeys(capture, ['kind', 'bytes'], 'candidate task output capture')\n    if (expected.kind !== 'output') {\n      throw new Error('candidate task output capture does not match the signed outcome kind')\n    }\n    if (!(capture.bytes instanceof Uint8Array)) {\n      throw new Error('candidate task output capture must contain a byte array')\n    }\n    if (capture.bytes.byteLength > expected.maxBytes) {\n      throw new Error(`candidate task output exceeds the frozen ${expected.maxBytes}-byte maximum`)\n    }\n    return Object.freeze({ kind: 'output', bytes: Uint8Array.from(capture.bytes) })\n  }\n  assertExactKeys(\n    capture,\n    ['kind', 'resultTree', 'afterState', 'archive', 'gitDiff'],\n    'candidate task capture',\n  )\n  if (capture.kind !== 'workspace') {\n    throw new Error('candidate task capture has an invalid outcome kind')\n  }\n  if (expected.kind !== 'workspace') {\n    throw new Error('candidate workspace capture does not match the signed outcome kind')\n  }\n  if (\n    typeof capture.resultTree !== 'string' ||\n    !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(capture.resultTree)\n  ) {\n    throw new Error('candidate task capture resultTree is not a Git object id')\n  }\n  if (!(capture.archive instanceof Uint8Array) || !(capture.gitDiff instanceof Uint8Array)) {\n    throw new Error('candidate task capture archive and gitDiff must be byte arrays')\n  }\n  const afterState = agentCandidateWorkspaceManifestMaterialSchema.parse(capture.afterState)\n  return Object.freeze({\n    kind: 'workspace',\n    resultTree: capture.resultTree,\n    afterState: Object.freeze(afterState),\n    archive: Uint8Array.from(capture.archive),\n    gitDiff: Uint8Array.from(capture.gitDiff),\n  })\n}\n\nfunction requireRecord(value: unknown, label: string): Record<string, unknown> {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`${label} must be an object`)\n  }\n  return value as Record<string, unknown>\n}\n","import {\n  type AgentCandidateArtifactRef,\n  agentCandidateArtifactRefSchema,\n} from '@tangle-network/agent-interface'\n\nimport { verifyBytes } from './artifacts'\nimport { immutableCandidateValue, sha256Bytes } from './digest'\nimport type { AgentCandidateOutputArtifactPort, AgentCandidateOutputPurpose } from './types'\n\n/** Persist evaluator evidence, read it back, and bind the returned locator to the exact bytes. */\nexport async function persistCandidateOutputArtifact(\n  port: AgentCandidateOutputArtifactPort,\n  input: {\n    executionId: string\n    purpose: AgentCandidateOutputPurpose\n    bytes: Uint8Array\n    signal?: AbortSignal\n  },\n): Promise<AgentCandidateArtifactRef> {\n  input.signal?.throwIfAborted()\n  const bytes = Uint8Array.from(input.bytes)\n  const expectedDigest = sha256Bytes(bytes)\n  const ref = agentCandidateArtifactRefSchema.parse(\n    await port.put({\n      executionId: input.executionId,\n      purpose: input.purpose,\n      bytes: Uint8Array.from(bytes),\n      ...(input.signal ? { signal: input.signal } : {}),\n    }),\n  )\n  input.signal?.throwIfAborted()\n  if (ref.sha256 !== expectedDigest || ref.byteLength !== bytes.byteLength) {\n    throw new Error('candidate output locator does not identify the submitted bytes')\n  }\n  const stored = await port.read(ref)\n  input.signal?.throwIfAborted()\n  verifyBytes(stored, expectedDigest, bytes.byteLength, 'persisted candidate output')\n  return immutableCandidateValue(ref)\n}\n","import type { Span, TraceStore } from '@tangle-network/agent-eval'\nimport { isLlmSpan, REDACTION_VERSION } from '@tangle-network/agent-eval'\nimport type {\n  AgentCandidateBenchmarkResultEvidence,\n  AgentCandidateFixedSpend,\n  AgentCandidateMemoryReceipt,\n  AgentCandidateModelSettlementEvidence,\n  AgentCandidateRunReceipt,\n  AgentCandidateTermination,\n} from '@tangle-network/agent-interface'\nimport {\n  agentCandidateRunReceiptSchema,\n  agentCandidateWorkspaceSnapshotEvidenceSchema,\n} from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateBytes, canonicalCandidateDocument, sha256Bytes } from './digest'\nimport type { SealedAgentCandidateExecutorFinalCapture } from './executor-capture'\nimport type { PersistedAgentCandidateExecutorCapture } from './executor-capture-evidence'\nimport {\n  assertTraceMatchesModelSettlement,\n  type SealedAgentCandidateModelSettlement,\n  usdToNanos,\n} from './model-settlement'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport type { PreparedCandidateState } from './prepared-state'\nimport {\n  assertNoProtectedBytes,\n  type ProtectedRedactionReport,\n  type ProtectedTraceIdentity,\n  redactProtectedReason,\n  redactProtectedValue,\n} from './protected-redaction'\nimport {\n  type AgentCandidateOutputArtifactPort,\n  type AgentCandidateProtectedRunCapture,\n  type AgentCandidateRunFinalization,\n  CANDIDATE_TRACE_TAGS,\n  type VerifiedAgentCandidateTaskOutcome,\n} from './types'\n\ninterface CandidateFinalizationEvidence {\n  finalCapture: SealedAgentCandidateExecutorFinalCapture\n  persistedCapture: PersistedAgentCandidateExecutorCapture\n  modelSettlement: AgentCandidateModelSettlementEvidence & {\n    artifact: import('@tangle-network/agent-interface').AgentCandidateArtifactRef\n  }\n  taskOutcome: VerifiedAgentCandidateTaskOutcome\n  benchmarkResult: AgentCandidateBenchmarkResultEvidence & {\n    artifact: import('@tangle-network/agent-interface').AgentCandidateArtifactRef\n  }\n  outputArtifacts: AgentCandidateOutputArtifactPort\n}\n\n/** Builds a candidate run receipt exclusively from protected trace and memory evidence. */\nexport async function finalizeAgentCandidateRun(\n  state: PreparedCandidateState,\n  capture: AgentCandidateProtectedRunCapture,\n  traceStore: TraceStore,\n  traceIdentity: ProtectedTraceIdentity,\n  settlement: SealedAgentCandidateModelSettlement,\n  evidence: CandidateFinalizationEvidence,\n  protectedValues: readonly string[],\n  writeRedactionReport?: ProtectedRedactionReport,\n  signal?: AbortSignal,\n): Promise<AgentCandidateRunFinalization> {\n  let termination: AgentCandidateTermination | undefined\n  try {\n    signal?.throwIfAborted()\n    if (capture.executionId !== state.executionId) {\n      throw new Error('protected capture execution id does not match the prepared execution')\n    }\n    termination = capture.termination\n    if (\n      termination.kind === 'timeout' &&\n      termination.timeoutMs !== state.executionPlan.value.material.limits.timeoutMs\n    ) {\n      throw new Error('timeout termination does not match the frozen execution limit')\n    }\n\n    const run = await traceStore.getRun(traceIdentity.runId)\n    if (!run) throw new Error(`protected trace run is missing: ${traceIdentity.runId}`)\n    if (run.status === 'running' || run.endedAt === undefined) {\n      throw new Error('protected trace run is not terminal')\n    }\n    assertTraceBindings(run.tags, traceIdentity.tags)\n\n    const [spans, events, budget, artifacts] = await Promise.all([\n      traceStore.spans({ runId: run.runId }),\n      traceStore.events({ runId: run.runId }),\n      traceStore.budget(run.runId),\n      traceStore.artifacts(run.runId),\n    ])\n    const orderedSpans = [...spans].sort(\n      (a, b) => a.startedAt - b.startedAt || compareStrings(a.spanId, b.spanId),\n    )\n    const orderedEvents = [...events].sort(\n      (a, b) => a.timestamp - b.timestamp || compareStrings(a.eventId, b.eventId),\n    )\n    const orderedBudget = [...budget].sort(\n      (a, b) => a.timestamp - b.timestamp || compareStrings(a.dimension, b.dimension),\n    )\n    const orderedArtifacts = [...artifacts].sort((a, b) =>\n      compareStrings(a.artifactId, b.artifactId),\n    )\n\n    const modelSpans = orderedSpans.filter(isLlmSpan)\n    assertTraceMatchesModelSettlement(modelSpans, settlement)\n    const steps = enforceLimits(state, run.startedAt, run.endedAt, orderedSpans, settlement)\n    const memory = await memoryReceipt(\n      state,\n      evidence.finalCapture,\n      evidence.persistedCapture.memoryAfter,\n      signal,\n    )\n    const redacted = redactProtectedValue(\n      {\n        run: { ...run, redactionVersion: REDACTION_VERSION },\n        spans: orderedSpans,\n        events: orderedEvents,\n        budget: orderedBudget,\n        artifacts: orderedArtifacts,\n      },\n      protectedValues,\n    )\n    const combinedByRule = { ...(writeRedactionReport?.byRule ?? {}) }\n    for (const [rule, count] of Object.entries(redacted.report.byRule)) {\n      combinedByRule[rule] = (combinedByRule[rule] ?? 0) + count\n    }\n    const traceMaterial = {\n      ...(redacted.value as Record<string, unknown>),\n      evaluatorLimits: { resultTimeoutMs: state.resultTimeoutMs },\n      redaction: {\n        version: REDACTION_VERSION,\n        redactionCount:\n          (writeRedactionReport?.redactionCount ?? 0) + redacted.report.redactionCount,\n        byRule: combinedByRule,\n      },\n    }\n    const traceBytes = canonicalCandidateBytes(traceMaterial)\n    assertNoProtectedBytes(traceBytes, protectedValues)\n    const traceArtifact = await persistCandidateOutputArtifact(evidence.outputArtifacts, {\n      executionId: state.executionId,\n      purpose: 'trace',\n      bytes: traceBytes,\n      signal,\n    })\n    const trace = {\n      artifact: traceArtifact,\n      eventCount:\n        1 +\n        orderedSpans.length +\n        orderedEvents.length +\n        orderedBudget.length +\n        orderedArtifacts.length,\n      modelCallCount: modelSpans.length,\n    }\n    const document = canonicalCandidateDocument<AgentCandidateRunReceipt>({\n      kind: 'agent-candidate-run',\n      digestAlgorithm: 'rfc8785-sha256',\n      bundleDigest: state.bundle.digest,\n      runCellDigest: state.executionPlan.value.material.runCell.digest,\n      materializationReceiptDigest: state.materializationReceipt.digest,\n      executionPlanDigest: state.executionPlan.value.digest,\n      timing: {\n        startedAtMs: run.startedAt,\n        endedAtMs: run.endedAt,\n        durationMs: run.endedAt - run.startedAt,\n      },\n      steps,\n      memory,\n      trace,\n      termination,\n      executorCapture: evidence.persistedCapture.evidence,\n      modelSettlement: evidence.modelSettlement,\n      taskOutcome: evidence.taskOutcome.evidence,\n      benchmarkResult: evidence.benchmarkResult,\n    })\n    agentCandidateRunReceiptSchema.parse(document.value)\n    const runReceipt = await persistCandidateOutputArtifact(evidence.outputArtifacts, {\n      executionId: state.executionId,\n      purpose: 'run-receipt',\n      bytes: document.bytes,\n      signal,\n    })\n    return {\n      succeeded: true,\n      receipt: document,\n      artifacts: {\n        modelSettlement: evidence.modelSettlement.artifact,\n        executorCapture: evidence.persistedCapture.evidence,\n        taskOutcome: evidence.taskOutcome.evidence.artifact,\n        benchmarkResult: evidence.benchmarkResult.artifact,\n        runReceipt,\n      },\n    }\n  } catch (error) {\n    return {\n      ...failedAgentCandidateRun(\n        state,\n        redactProtectedReason(\n          error instanceof Error ? error.message : String(error),\n          protectedValues,\n        ),\n        termination,\n        settlement.usage,\n      ),\n    }\n  }\n}\n\nfunction assertTraceBindings(\n  tags: Record<string, string> | undefined,\n  expected: Readonly<Record<string, string>>,\n): void {\n  for (const name of Object.values(CANDIDATE_TRACE_TAGS)) {\n    if (tags?.[name] !== expected[name]) {\n      throw new Error(`protected trace is not bound to prepared execution tag ${name}`)\n    }\n  }\n}\n\nfunction enforceLimits(\n  state: PreparedCandidateState,\n  startedAt: number,\n  endedAt: number,\n  spans: Span[],\n  settlement: SealedAgentCandidateModelSettlement,\n): number {\n  const limits = state.executionPlan.value.material.limits\n  const usage = settlement.usage\n  // The runtime-owned Date.now deadline decides when the process must stop.\n  // This separately rejects a receipt whose evaluator-owned trace claims a\n  // longer run; neither clock can make an over-limit execution admissible.\n  const wallMs = endedAt - startedAt\n  if (!Number.isFinite(wallMs) || wallMs < 0 || wallMs > limits.timeoutMs) {\n    throw new Error(`protected trace wall time ${wallMs} exceeds ${limits.timeoutMs}`)\n  }\n  const steps = spans.filter((span) => span.kind === 'tool').length\n  const checks: Array<[number, number, string]> = [\n    [steps, limits.maxSteps, 'tool steps'],\n    [usage.modelCalls, limits.maxModelCalls, 'model calls'],\n    [usage.inputTokens, limits.maxInputTokens, 'input tokens'],\n    [usage.outputTokens, limits.maxOutputTokens, 'output tokens'],\n  ]\n  for (const [actual, limit, label] of checks) {\n    if (actual > limit) throw new Error(`protected ${label} ${actual} exceeds ${limit}`)\n  }\n  if (usage.costUsdNanos > usdToNanos(limits.maxCostUsd, 'frozen maxCostUsd')) {\n    throw new Error(\n      `protected cost USD ${usage.costUsdNanos / 1_000_000_000} exceeds ${limits.maxCostUsd}`,\n    )\n  }\n  return steps\n}\n\nasync function memoryReceipt(\n  state: PreparedCandidateState,\n  capture: SealedAgentCandidateExecutorFinalCapture,\n  persisted: PersistedAgentCandidateExecutorCapture['memoryAfter'],\n  signal?: AbortSignal,\n): Promise<AgentCandidateMemoryReceipt> {\n  signal?.throwIfAborted()\n  if (state.memory.mode === 'disabled') {\n    if (capture.memoryAfter !== undefined || persisted !== undefined) {\n      throw new Error('disabled memory cannot return an after-state')\n    }\n    return { mode: 'disabled' }\n  }\n  if (!capture.memoryAfter) throw new Error('isolated memory is missing its protected after-state')\n  if (!persisted) throw new Error('isolated memory is missing persisted capture evidence')\n  const afterState = capture.memoryAfter.afterState\n  const manifestBytes = canonicalCandidateBytes(afterState)\n  const snapshot = agentCandidateWorkspaceSnapshotEvidenceSchema.parse({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: sha256Bytes(manifestBytes),\n    material: afterState,\n    manifest: persisted.manifest,\n    archive: persisted.archive,\n  })\n  return {\n    mode: 'isolated',\n    scope: 'task',\n    effectiveNamespace: state.memory.effectiveNamespace,\n    resetEvidenceDigest: state.memory.reset.evidence.sha256,\n    beforeStateDigest: state.memory.beforeState.digest,\n    afterState: snapshot,\n  }\n}\n\nexport function failedAgentCandidateRun(\n  state: PreparedCandidateState,\n  reason: string,\n  termination?: AgentCandidateTermination,\n  usage: AgentCandidateFixedSpend | null = null,\n): AgentCandidateRunFinalization & { succeeded: false } {\n  return {\n    succeeded: false,\n    reason,\n    partial: {\n      executionId: state.executionId,\n      bundleDigest: state.bundle.digest,\n      executionPlanDigest: state.executionPlan.value.digest,\n      materializationReceiptDigest: state.materializationReceipt.digest,\n      ...(termination ? { termination } : {}),\n    },\n    usage,\n  }\n}\n\nfunction compareStrings(a: string, b: string): number {\n  return a < b ? -1 : a > b ? 1 : 0\n}\n","import type { BenchmarkEvaluation } from '@tangle-network/agent-eval'\nimport type {\n  AgentCandidateBenchmarkGraderIdentity,\n  AgentCandidateFixedSpend,\n  AgentCandidateTermination,\n} from '@tangle-network/agent-interface'\n\nimport { readVerifiedArtifact } from './artifacts'\nimport { canonicalCandidateDigest, immutableCandidateValue, sha256Bytes } from './digest'\nimport type {\n  AgentCandidateBenchmarkGraderPort,\n  AgentCandidateOutputArtifactPort,\n  VerifiedAgentCandidateTaskOutcome,\n} from './types'\n\nexport interface BoundAgentCandidateBenchmarkRun {\n  readonly grader: AgentCandidateBenchmarkGraderIdentity\n  readonly grading: {\n    readonly usage: AgentCandidateFixedSpend\n    readonly timing: {\n      readonly startedAtMs: number\n      readonly endedAtMs: number\n      readonly durationMs: number\n    }\n  }\n  readonly evaluation: BenchmarkEvaluation\n  readonly evidence: Uint8Array\n}\n\n/**\n * Admit verified grader bytes to the evaluator runner and reject any result\n * that is not bound to those bytes, the exact task outcome, and its raw output.\n */\nexport async function runBoundCandidateBenchmarkGrader(input: {\n  executionId: string\n  termination: AgentCandidateTermination\n  outcome: VerifiedAgentCandidateTaskOutcome\n  expectedGrader: AgentCandidateBenchmarkGraderIdentity\n  grader: AgentCandidateBenchmarkGraderPort\n  artifacts: AgentCandidateOutputArtifactPort\n  signal?: AbortSignal\n}): Promise<BoundAgentCandidateBenchmarkRun> {\n  input.signal?.throwIfAborted()\n  const descriptor = snapshotGraderDescriptor(input.grader, input.expectedGrader)\n  const implementationBytes = await readVerifiedArtifact(descriptor.artifact, input.artifacts)\n  if (implementationBytes.byteLength === 0) {\n    throw new Error('candidate benchmark grader implementation cannot be empty')\n  }\n  const expectedImplementationDigest = sha256Bytes(implementationBytes)\n  const termination = immutableCandidateValue(input.termination)\n  const run = input.grader.run\n  const startedAtMs = Date.now()\n  const result = await run(\n    Object.freeze({\n      executionId: input.executionId,\n      termination,\n      outcome: input.outcome,\n      implementation: detachedImplementation(implementationBytes),\n      signal: input.signal ?? new AbortController().signal,\n    }),\n  )\n  const endedAtMs = Math.max(startedAtMs, Date.now())\n  input.signal?.throwIfAborted()\n  assertExactRunnerResult(result)\n\n  const evidence = Uint8Array.from(result.evidence)\n  const outputDigest = sha256Bytes(evidence)\n  if (result.binding.implementationDigest !== expectedImplementationDigest) {\n    throw new Error(\n      'candidate benchmark grader executed implementation digest does not match its verified artifact',\n    )\n  }\n  if (result.binding.taskOutcomeDigest !== input.outcome.evidence.digest) {\n    throw new Error(\n      'candidate benchmark grader task outcome digest does not match verified outcome',\n    )\n  }\n  if (result.binding.outputDigest !== outputDigest) {\n    throw new Error('candidate benchmark grader raw output digest does not match returned evidence')\n  }\n\n  return Object.freeze({\n    grader: descriptor,\n    grading: immutableCandidateValue({\n      usage: emptyFixedSpend(),\n      timing: {\n        startedAtMs,\n        endedAtMs,\n        durationMs: endedAtMs - startedAtMs,\n      },\n    }),\n    evaluation: result.evaluation,\n    evidence,\n  })\n}\n\nfunction snapshotGraderDescriptor(\n  grader: AgentCandidateBenchmarkGraderPort,\n  expected: AgentCandidateBenchmarkGraderIdentity,\n): BoundAgentCandidateBenchmarkRun['grader'] {\n  if (!grader.name || !grader.version) {\n    throw new Error('candidate benchmark grader name and version must be non-empty')\n  }\n  const actual = {\n    name: grader.name,\n    version: grader.version,\n    format: 'tangle-grader' as const,\n    artifact: grader.artifact,\n  }\n  if (canonicalCandidateDigest(actual) !== canonicalCandidateDigest(expected)) {\n    throw new Error('candidate benchmark grader does not match the signed task grader')\n  }\n  return immutableCandidateValue(expected)\n}\n\nfunction emptyFixedSpend(): AgentCandidateFixedSpend {\n  return {\n    inputTokens: 0,\n    outputTokens: 0,\n    cachedInputTokens: 0,\n    reasoningTokens: 0,\n    modelCalls: 0,\n    costUsdNanos: 0,\n    costProvenance: 'observed',\n  }\n}\n\nfunction detachedImplementation(bytes: Uint8Array): {\n  readonly byteLength: number\n  readonly bytes: Uint8Array\n} {\n  const stored = Uint8Array.from(bytes)\n  return Object.freeze({\n    byteLength: stored.byteLength,\n    get bytes(): Uint8Array {\n      return Uint8Array.from(stored)\n    },\n  })\n}\n\nfunction assertExactRunnerResult(\n  value: unknown,\n): asserts value is Awaited<ReturnType<AgentCandidateBenchmarkGraderPort['run']>> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error('candidate benchmark grader result must be an object')\n  }\n  const result = value as Record<string, unknown>\n  const keys = Object.keys(result).sort()\n  if (\n    keys.length !== 3 ||\n    keys[0] !== 'binding' ||\n    keys[1] !== 'evaluation' ||\n    keys[2] !== 'evidence'\n  ) {\n    throw new Error('candidate benchmark grader returned unknown or missing fields')\n  }\n  if (!(result.evidence instanceof Uint8Array)) {\n    throw new Error('candidate benchmark grader evidence must be bytes')\n  }\n  if (\n    result.binding === null ||\n    typeof result.binding !== 'object' ||\n    Array.isArray(result.binding)\n  ) {\n    throw new Error('candidate benchmark grader binding must be an object')\n  }\n  const bindingKeys = Object.keys(result.binding).sort()\n  if (\n    bindingKeys.length !== 3 ||\n    bindingKeys[0] !== 'implementationDigest' ||\n    bindingKeys[1] !== 'outputDigest' ||\n    bindingKeys[2] !== 'taskOutcomeDigest'\n  ) {\n    throw new Error('candidate benchmark grader binding returned unknown or missing fields')\n  }\n}\n","import type {\n  AgentCandidateArtifactRef,\n  AgentCandidateTaskOutcomeSpec,\n  AgentCandidateTaskOutputSpec,\n  AgentCandidateWorkspaceManifestMaterial,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateBytes } from './digest'\nimport type { SealedAgentCandidateExecutorFinalCapture } from './executor-capture'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport type { AgentCandidateOutputArtifactPort } from './types'\n\nexport type PersistedAgentCandidateTaskCapture =\n  | {\n      readonly kind: 'workspace'\n      readonly resultTree: string\n      readonly afterState: AgentCandidateWorkspaceManifestMaterial\n      readonly manifest: AgentCandidateArtifactRef\n      readonly archive: AgentCandidateArtifactRef\n      readonly gitDiff: AgentCandidateArtifactRef\n    }\n  | {\n      readonly kind: 'output'\n      readonly spec: AgentCandidateTaskOutputSpec\n      readonly artifact: AgentCandidateArtifactRef\n    }\n\nexport interface PersistedAgentCandidateExecutorCapture {\n  readonly evidence: AgentCandidateArtifactRef\n  readonly taskOutcome?: PersistedAgentCandidateTaskCapture\n  readonly memoryAfter?: {\n    readonly afterState: AgentCandidateWorkspaceManifestMaterial\n    readonly manifest: AgentCandidateArtifactRef\n    readonly archive: AgentCandidateArtifactRef\n  }\n}\n\n/** Persist structurally valid post-stop bytes without claiming they passed outcome verification. */\nexport async function persistAgentCandidateExecutorCapture(\n  identity: { executionId: string; executionPlanDigest: Sha256Digest },\n  expected: AgentCandidateTaskOutcomeSpec,\n  capture: SealedAgentCandidateExecutorFinalCapture,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  signal?: AbortSignal,\n): Promise<PersistedAgentCandidateExecutorCapture> {\n  const executorEvidence = capture.evidence\n    ? await persistCandidateOutputArtifact(outputArtifacts, {\n        executionId: identity.executionId,\n        purpose: 'executor-native-evidence',\n        bytes: capture.evidence,\n        signal,\n      })\n    : undefined\n  const taskOutcome = capture.taskOutcome\n    ? await persistTaskCapture(\n        identity.executionId,\n        expected,\n        capture.taskOutcome,\n        outputArtifacts,\n        signal,\n      )\n    : undefined\n  const memoryAfter = capture.memoryAfter\n    ? await persistWorkspaceCapture(\n        identity.executionId,\n        'memory-after-manifest',\n        'memory-after-archive',\n        capture.memoryAfter.afterState,\n        capture.memoryAfter.archive,\n        outputArtifacts,\n        signal,\n      )\n    : undefined\n  const bytes = canonicalCandidateBytes({\n    kind: 'agent-candidate-executor-capture',\n    executionPlanDigest: identity.executionPlanDigest,\n    ...(executorEvidence ? { executorEvidence } : {}),\n    ...(taskOutcome ? { taskOutcome } : {}),\n    ...(memoryAfter ? { memoryAfter } : {}),\n  })\n  const evidence = await persistCandidateOutputArtifact(outputArtifacts, {\n    executionId: identity.executionId,\n    purpose: 'executor-capture',\n    bytes,\n    signal,\n  })\n  return Object.freeze({\n    evidence,\n    ...(taskOutcome ? { taskOutcome: Object.freeze(taskOutcome) } : {}),\n    ...(memoryAfter ? { memoryAfter: Object.freeze(memoryAfter) } : {}),\n  })\n}\n\nasync function persistTaskCapture(\n  executionId: string,\n  expected: AgentCandidateTaskOutcomeSpec,\n  capture: NonNullable<SealedAgentCandidateExecutorFinalCapture['taskOutcome']>,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  signal?: AbortSignal,\n): Promise<PersistedAgentCandidateTaskCapture> {\n  if (capture.kind === 'output') {\n    if (expected.kind !== 'output')\n      throw new Error('captured output does not match the signed task')\n    const artifact = await persistCandidateOutputArtifact(outputArtifacts, {\n      executionId,\n      purpose: 'task-output',\n      bytes: capture.bytes,\n      signal,\n    })\n    return {\n      kind: 'output',\n      spec: { mediaType: expected.mediaType, maxBytes: expected.maxBytes },\n      artifact,\n    }\n  }\n  if (expected.kind !== 'workspace') {\n    throw new Error('captured workspace does not match the signed task')\n  }\n  const workspace = await persistWorkspaceCapture(\n    executionId,\n    'task-manifest',\n    'task-archive',\n    capture.afterState,\n    capture.archive,\n    outputArtifacts,\n    signal,\n  )\n  const gitDiff = await persistCandidateOutputArtifact(outputArtifacts, {\n    executionId,\n    purpose: 'task-patch',\n    bytes: capture.gitDiff,\n    signal,\n  })\n  return { kind: 'workspace', resultTree: capture.resultTree, ...workspace, gitDiff }\n}\n\nasync function persistWorkspaceCapture(\n  executionId: string,\n  manifestPurpose: 'task-manifest' | 'memory-after-manifest',\n  archivePurpose: 'task-archive' | 'memory-after-archive',\n  afterState: AgentCandidateWorkspaceManifestMaterial,\n  archiveBytes: Uint8Array,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  signal?: AbortSignal,\n): Promise<{\n  afterState: AgentCandidateWorkspaceManifestMaterial\n  manifest: AgentCandidateArtifactRef\n  archive: AgentCandidateArtifactRef\n}> {\n  const manifestBytes = canonicalCandidateBytes(afterState)\n  const [manifest, archive] = await Promise.all([\n    persistCandidateOutputArtifact(outputArtifacts, {\n      executionId,\n      purpose: manifestPurpose,\n      bytes: manifestBytes,\n      signal,\n    }),\n    persistCandidateOutputArtifact(outputArtifacts, {\n      executionId,\n      purpose: archivePurpose,\n      bytes: archiveBytes,\n      signal,\n    }),\n  ])\n  return { afterState, manifest, archive }\n}\n","import { mkdtemp, rm } from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { join } from 'node:path'\n\nimport type { BenchmarkEvaluation } from '@tangle-network/agent-eval'\nimport {\n  type AgentCandidateArtifactRef,\n  type AgentCandidateBenchmarkResultEvidence,\n  type AgentCandidateModelSettlementEvidence,\n  type AgentCandidateResolvedModel,\n  type AgentCandidateTaskOutcomeEvidence,\n  type AgentCandidateTaskOutcomeMaterial,\n  type AgentCandidateTaskOutcomeSpec,\n  type AgentCandidateTaskOutputSpec,\n  type AgentCandidateTaskRepository,\n  type AgentCandidateTermination,\n  type AgentCandidateWorkspaceSnapshotEvidence,\n  agentCandidateBenchmarkResultEvidenceSchema,\n  agentCandidateModelSettlementEvidenceSchema,\n  agentCandidateTaskOutcomeEvidenceSchema,\n  agentCandidateWorkspaceSnapshotEvidenceSchema,\n  type Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport { readMaterializedWorkspaceFiles } from './artifacts'\nimport { runBoundCandidateBenchmarkGrader } from './benchmark-grader'\nimport {\n  canonicalCandidateBytes,\n  embeddedCandidateArtifact,\n  immutableCandidateValue,\n  sha256Bytes,\n} from './digest'\nimport type { SealedAgentCandidateExecutorFinalCapture } from './executor-capture'\nimport {\n  type PersistedAgentCandidateExecutorCapture,\n  type PersistedAgentCandidateTaskCapture,\n  persistAgentCandidateExecutorCapture,\n} from './executor-capture-evidence'\nimport { verifyTaskOutcomePatch } from './git-materialize'\nimport type { SealedAgentCandidateModelSettlement } from './model-settlement'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport type { PreparedCandidateState } from './prepared-state'\nimport { assertNoProtectedBytes } from './protected-redaction'\nimport type {\n  AgentCandidateBenchmarkGraderPort,\n  AgentCandidateExecutorTaskOutcomeCapture,\n  AgentCandidateOutputArtifactPort,\n  VerifiedAgentCandidateTaskOutcome,\n} from './types'\nimport { verifiedTaskOutcomeBrand } from './types'\n\nexport type PersistedAgentCandidateModelSettlement = AgentCandidateModelSettlementEvidence & {\n  artifact: AgentCandidateArtifactRef\n}\n\nexport type PersistedAgentCandidateBenchmarkResult = AgentCandidateBenchmarkResultEvidence & {\n  artifact: AgentCandidateArtifactRef\n}\n\n/** Persist the closed evaluator model ledger as canonical receipt evidence. */\nexport async function persistCandidateModelSettlement(\n  state: PreparedCandidateState,\n  settlement: SealedAgentCandidateModelSettlement,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n): Promise<PersistedAgentCandidateModelSettlement> {\n  return await persistCandidateModelSettlementEvidence(\n    {\n      executionId: state.executionId,\n      executionPlanDigest: state.executionPlan.value.digest,\n      resolvedModel: state.resolvedModel,\n    },\n    settlement,\n    outputArtifacts,\n  )\n}\n\n/** Persist a closed model ledger when only durable recovery identity remains. */\nexport async function persistCandidateModelSettlementEvidence(\n  identity: {\n    executionId: string\n    executionPlanDigest: Sha256Digest\n    resolvedModel: AgentCandidateResolvedModel\n  },\n  settlement: SealedAgentCandidateModelSettlement,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n): Promise<PersistedAgentCandidateModelSettlement> {\n  const material = {\n    kind: 'agent-candidate-model-settlement-material' as const,\n    executionPlanDigest: identity.executionPlanDigest,\n    preparationId: settlement.value.preparationId,\n    grantDigest: settlement.value.grantDigest,\n    closed: true as const,\n    usageWithinLimits: settlement.value.usageWithinLimits,\n    resolved: identity.resolvedModel,\n    calls: settlement.value.calls.map((call) => ({\n      callId: call.callId,\n      generationId: call.generationId,\n      traceSpanId: call.traceSpanId,\n      status: call.status,\n      model: call.model,\n      startedAtMs: call.startedAtMs,\n      endedAtMs: call.endedAtMs,\n      inputTokens: call.inputTokens,\n      accountedInputTokens: call.accountedInputTokens,\n      outputTokens: call.outputTokens,\n      cachedInputTokens: call.cachedInputTokens ?? 0,\n      reasoningTokens: call.reasoningTokens ?? 0,\n      costUsdNanos: call.costUsdNanos,\n      costProvenance: call.costProvenance,\n    })),\n    usage: settlement.usage,\n  }\n  const bytes = canonicalCandidateBytes(material)\n  const digest = sha256Bytes(bytes)\n  const artifact = await persistCandidateOutputArtifact(outputArtifacts, {\n    executionId: identity.executionId,\n    purpose: 'model-settlement',\n    bytes,\n  })\n  return immutableCandidateValue(\n    agentCandidateModelSettlementEvidenceSchema.parse({\n      kind: 'agent-candidate-model-settlement',\n      digest,\n      material,\n      artifact,\n    }),\n  ) as PersistedAgentCandidateModelSettlement\n}\n\n/** Verify once, persist the sealed capture once, and bind the resulting task evidence. */\nexport async function persistVerifiedAgentCandidateExecutorCapture(\n  state: PreparedCandidateState,\n  capture: SealedAgentCandidateExecutorFinalCapture,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  protectedValues: readonly string[],\n  signal?: AbortSignal,\n): Promise<{\n  persistedCapture: PersistedAgentCandidateExecutorCapture\n  taskOutcome: VerifiedAgentCandidateTaskOutcome\n}> {\n  signal?.throwIfAborted()\n  const taskCapture = capture.taskOutcome\n  if (!taskCapture) throw new Error('candidate final capture is missing the task outcome')\n  if (capture.evidence) assertNoProtectedBytes(capture.evidence, protectedValues)\n  const expected = state.benchmarkTask.outcome\n  if (taskCapture.kind !== expected.kind) {\n    throw new Error(\n      `candidate captured ${taskCapture.kind} outcome does not match expected ${expected.kind} outcome`,\n    )\n  }\n  const verified =\n    taskCapture.kind === 'output' && expected.kind === 'output'\n      ? verifyOutputTaskCapture(taskCapture.bytes, expected, protectedValues)\n      : taskCapture.kind === 'workspace' && expected.kind === 'workspace'\n        ? await verifyWorkspaceTaskCapture(state, taskCapture, protectedValues, signal)\n        : undefined\n  if (!verified) throw new Error('candidate task outcome kind could not be narrowed')\n  await verifyMemoryCapture(state, capture, protectedValues, signal)\n\n  const persistedCapture = await persistAgentCandidateExecutorCapture(\n    {\n      executionId: state.executionId,\n      executionPlanDigest: state.executionPlan.value.digest,\n    },\n    expected,\n    capture,\n    outputArtifacts,\n    signal,\n  )\n  const persisted = persistedCapture.taskOutcome\n  if (!persisted || persisted.kind !== verified.kind) {\n    throw new Error('persisted task capture kind changed')\n  }\n  const taskOutcome =\n    verified.kind === 'output' && persisted.kind === 'output'\n      ? await persistVerifiedOutputTaskOutcome(state, verified, persisted, outputArtifacts, signal)\n      : verified.kind === 'workspace' && persisted.kind === 'workspace'\n        ? await persistVerifiedWorkspaceTaskOutcome(\n            state,\n            verified,\n            persisted,\n            outputArtifacts,\n            signal,\n          )\n        : undefined\n  if (!taskOutcome) throw new Error('persisted task outcome kind could not be narrowed')\n  return Object.freeze({ persistedCapture, taskOutcome })\n}\n\ninterface VerifiedWorkspaceTaskCapture {\n  readonly kind: 'workspace'\n  readonly patch: Uint8Array\n  readonly archive: Uint8Array\n  readonly afterState: Extract<\n    AgentCandidateExecutorTaskOutcomeCapture,\n    { kind: 'workspace' }\n  >['afterState']\n  readonly manifestBytes: Uint8Array\n  readonly resultCommit: string\n  readonly resultTree: string\n  readonly repository: AgentCandidateTaskRepository\n}\n\nasync function verifyWorkspaceTaskCapture(\n  state: PreparedCandidateState,\n  capture: Extract<AgentCandidateExecutorTaskOutcomeCapture, { kind: 'workspace' }>,\n  protectedValues: readonly string[],\n  signal?: AbortSignal,\n): Promise<VerifiedWorkspaceTaskCapture> {\n  const repository = state.benchmarkTask.repository\n  if (!repository) throw new Error('workspace task outcome is missing repository identity')\n  const patch = Uint8Array.from(capture.gitDiff)\n  const archive = Uint8Array.from(capture.archive)\n  if (archive.byteLength === 0) throw new Error('candidate task archive cannot be empty')\n  assertNoProtectedBytes(patch, protectedValues)\n  assertNoProtectedBytes(archive, protectedValues)\n  const afterState = immutableCandidateValue(capture.afterState)\n  const verified = await verifyTaskOutcomePatch({\n    repositoryRoot: state.roots.staging.taskRoot,\n    baseCommit: repository.baseCommit,\n    baseTree: repository.baseTree,\n    resultTree: capture.resultTree,\n    patch,\n    afterState,\n  })\n  signal?.throwIfAborted()\n  const manifestBytes = canonicalCandidateBytes(afterState)\n  assertNoProtectedBytes(manifestBytes, protectedValues)\n  const provisionalSnapshot = agentCandidateWorkspaceSnapshotEvidenceSchema.parse({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: sha256Bytes(manifestBytes),\n    material: afterState,\n    manifest: embeddedCandidateArtifact(manifestBytes),\n    archive: embeddedCandidateArtifact(archive),\n  })\n  await verifyTaskOutcomeArchive(state, provisionalSnapshot, archive, protectedValues)\n  signal?.throwIfAborted()\n  return {\n    kind: 'workspace',\n    patch,\n    archive,\n    afterState,\n    manifestBytes,\n    resultCommit: verified.resultCommit,\n    resultTree: verified.resultTree,\n    repository,\n  }\n}\n\nasync function persistVerifiedWorkspaceTaskOutcome(\n  state: PreparedCandidateState,\n  verified: VerifiedWorkspaceTaskCapture,\n  persisted: Extract<PersistedAgentCandidateTaskCapture, { kind: 'workspace' }>,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  signal?: AbortSignal,\n): Promise<VerifiedAgentCandidateTaskOutcome> {\n  const { afterState, manifestBytes, patch, repository } = verified\n  const snapshot = agentCandidateWorkspaceSnapshotEvidenceSchema.parse({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: sha256Bytes(manifestBytes),\n    material: afterState,\n    manifest: persisted.manifest,\n    archive: persisted.archive,\n  })\n  const material = {\n    kind: 'agent-candidate-task-outcome-material' as const,\n    executionPlanDigest: state.executionPlan.value.digest,\n    outcome: {\n      kind: 'workspace' as const,\n      baseRepository: {\n        identity: repository.identity,\n        rootIdentity: repository.rootIdentity,\n        commit: repository.baseCommit,\n        tree: repository.baseTree,\n      },\n      resultRepository: {\n        identity: repository.identity,\n        rootIdentity: repository.rootIdentity,\n        commit: verified.resultCommit,\n        tree: verified.resultTree,\n      },\n      afterState: snapshot,\n      gitDiff: {\n        format: 'git-diff-binary' as const,\n        artifact: persisted.gitDiff,\n      },\n    },\n  } satisfies AgentCandidateTaskOutcomeMaterial\n  const evidence = await persistTaskOutcomeEvidence(state, material, outputArtifacts, signal)\n  const storedPatch = Uint8Array.from(patch)\n  return Object.freeze({\n    kind: 'workspace' as const,\n    evidence,\n    get patch(): Uint8Array {\n      return Uint8Array.from(storedPatch)\n    },\n    [verifiedTaskOutcomeBrand]: true as const,\n  })\n}\n\ninterface VerifiedOutputTaskCapture {\n  readonly kind: 'output'\n  readonly bytes: Uint8Array\n  readonly spec: AgentCandidateTaskOutputSpec\n}\n\nfunction verifyOutputTaskCapture(\n  capturedBytes: Uint8Array,\n  expected: Extract<AgentCandidateTaskOutcomeSpec, { kind: 'output' }>,\n  protectedValues: readonly string[],\n): VerifiedOutputTaskCapture {\n  if (capturedBytes.byteLength === 0) throw new Error('candidate task output cannot be empty')\n  if (capturedBytes.byteLength > expected.maxBytes) {\n    throw new Error(`candidate task output exceeds the frozen ${expected.maxBytes}-byte maximum`)\n  }\n  const output = Uint8Array.from(capturedBytes)\n  assertNoProtectedBytes(output, protectedValues)\n  return {\n    kind: 'output',\n    bytes: output,\n    spec: { mediaType: expected.mediaType, maxBytes: expected.maxBytes },\n  }\n}\n\nasync function persistVerifiedOutputTaskOutcome(\n  state: PreparedCandidateState,\n  verified: VerifiedOutputTaskCapture,\n  persisted: Extract<PersistedAgentCandidateTaskCapture, { kind: 'output' }>,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  signal?: AbortSignal,\n): Promise<VerifiedAgentCandidateTaskOutcome> {\n  if (\n    persisted.spec.mediaType !== verified.spec.mediaType ||\n    persisted.spec.maxBytes !== verified.spec.maxBytes\n  ) {\n    throw new Error('persisted task output changed the signed media constraints')\n  }\n  const material = {\n    kind: 'agent-candidate-task-outcome-material' as const,\n    executionPlanDigest: state.executionPlan.value.digest,\n    outcome: {\n      kind: 'output' as const,\n      spec: verified.spec,\n      artifact: persisted.artifact,\n    },\n  } satisfies AgentCandidateTaskOutcomeMaterial\n  const evidence = await persistTaskOutcomeEvidence(state, material, outputArtifacts, signal)\n  const storedOutput = Uint8Array.from(verified.bytes)\n  return Object.freeze({\n    kind: 'output' as const,\n    evidence,\n    spec: immutableCandidateValue(verified.spec),\n    get bytes(): Uint8Array {\n      return Uint8Array.from(storedOutput)\n    },\n    [verifiedTaskOutcomeBrand]: true as const,\n  })\n}\n\nasync function persistTaskOutcomeEvidence<Material extends AgentCandidateTaskOutcomeMaterial>(\n  state: PreparedCandidateState,\n  material: Material,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  signal?: AbortSignal,\n): Promise<\n  Omit<AgentCandidateTaskOutcomeEvidence, 'material'> & {\n    material: Material\n    artifact: AgentCandidateArtifactRef\n  }\n> {\n  const bytes = canonicalCandidateBytes(material)\n  const digest = sha256Bytes(bytes)\n  const artifact = await persistCandidateOutputArtifact(outputArtifacts, {\n    executionId: state.executionId,\n    purpose: 'task-outcome',\n    bytes,\n    signal,\n  })\n  return immutableCandidateValue(\n    agentCandidateTaskOutcomeEvidenceSchema.parse({\n      kind: 'agent-candidate-task-outcome',\n      digest,\n      material,\n      artifact,\n    }),\n  ) as Omit<AgentCandidateTaskOutcomeEvidence, 'material'> & {\n    material: Material\n    artifact: AgentCandidateArtifactRef\n  }\n}\n\n/** Grade only a runtime-verified outcome and persist both raw and normalized evidence. */\nexport async function persistCandidateBenchmarkResult(\n  state: PreparedCandidateState,\n  termination: AgentCandidateTermination,\n  outcome: VerifiedAgentCandidateTaskOutcome,\n  grader: AgentCandidateBenchmarkGraderPort,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  protectedValues: readonly string[],\n  signal?: AbortSignal,\n): Promise<PersistedAgentCandidateBenchmarkResult> {\n  signal?.throwIfAborted()\n  const frozenTermination = immutableCandidateValue(termination)\n  const graded = await runBoundCandidateBenchmarkGrader({\n    executionId: state.executionId,\n    termination: frozenTermination,\n    outcome,\n    expectedGrader: state.benchmarkTask.grader,\n    grader,\n    artifacts: outputArtifacts,\n    signal,\n  })\n  signal?.throwIfAborted()\n  const evaluation = normalizeEvaluation(graded.evaluation, frozenTermination)\n  const rawEvidence = Uint8Array.from(graded.evidence)\n  if (rawEvidence.byteLength === 0) throw new Error('candidate benchmark evidence cannot be empty')\n  assertNoProtectedBytes(rawEvidence, protectedValues)\n  const evidenceRef = await persistCandidateOutputArtifact(outputArtifacts, {\n    executionId: state.executionId,\n    purpose: 'grader-evidence',\n    bytes: rawEvidence,\n    signal,\n  })\n  const material = {\n    kind: 'agent-candidate-benchmark-result-material' as const,\n    executionPlanDigest: state.executionPlan.value.digest,\n    taskOutcomeDigest: outcome.evidence.digest,\n    grader: graded.grader,\n    evidence: evidenceRef,\n    grading: graded.grading,\n    score: evaluation.score,\n    passed: evaluation.passed,\n    dimensions: evaluation.dimensions,\n  }\n  const bytes = canonicalCandidateBytes(material)\n  const digest = sha256Bytes(bytes)\n  const artifact = await persistCandidateOutputArtifact(outputArtifacts, {\n    executionId: state.executionId,\n    purpose: 'benchmark-result',\n    bytes,\n    signal,\n  })\n  return immutableCandidateValue(\n    agentCandidateBenchmarkResultEvidenceSchema.parse({\n      kind: 'agent-candidate-benchmark-result',\n      digest,\n      material,\n      artifact,\n    }),\n  ) as PersistedAgentCandidateBenchmarkResult\n}\n\nasync function verifyTaskOutcomeArchive(\n  state: PreparedCandidateState,\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n  archive: Uint8Array,\n  protectedValues: readonly string[],\n): Promise<void> {\n  const root = await mkdtemp(join(tmpdir(), 'agent-candidate-task-archive-'))\n  try {\n    await state.ports.workspaces.materialize({\n      role: 'task',\n      snapshot,\n      archive: Uint8Array.from(archive),\n      destination: root,\n    })\n    const files = await readMaterializedWorkspaceFiles(root, snapshot.material)\n    for (const file of files) assertNoProtectedBytes(file.bytes, protectedValues)\n  } finally {\n    await rm(root, { recursive: true, force: true })\n  }\n}\n\nasync function verifyMemoryCapture(\n  state: PreparedCandidateState,\n  capture: SealedAgentCandidateExecutorFinalCapture,\n  protectedValues: readonly string[],\n  signal?: AbortSignal,\n): Promise<void> {\n  if (state.memory.mode === 'disabled') {\n    if (capture.memoryAfter) throw new Error('disabled memory cannot return an after-state')\n    return\n  }\n  const memory = capture.memoryAfter\n  if (!memory) throw new Error('isolated memory is missing its protected after-state')\n  if (memory.archive.byteLength === 0) throw new Error('isolated memory archive cannot be empty')\n  const manifestBytes = canonicalCandidateBytes(memory.afterState)\n  assertNoProtectedBytes(manifestBytes, protectedValues)\n  assertNoProtectedBytes(memory.archive, protectedValues)\n  const snapshot = agentCandidateWorkspaceSnapshotEvidenceSchema.parse({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: sha256Bytes(manifestBytes),\n    material: memory.afterState,\n    manifest: embeddedCandidateArtifact(manifestBytes),\n    archive: embeddedCandidateArtifact(memory.archive),\n  })\n  const root = await mkdtemp(join(tmpdir(), 'agent-candidate-memory-after-'))\n  try {\n    await state.ports.workspaces.materialize({\n      role: 'memory',\n      snapshot,\n      archive: Uint8Array.from(memory.archive),\n      destination: root,\n    })\n    const files = await readMaterializedWorkspaceFiles(root, memory.afterState)\n    for (const file of files) assertNoProtectedBytes(file.bytes, protectedValues)\n    signal?.throwIfAborted()\n  } finally {\n    await rm(root, { recursive: true, force: true })\n  }\n}\n\nfunction normalizeEvaluation(\n  evaluation: BenchmarkEvaluation,\n  termination: AgentCandidateTermination,\n): { score: number; passed: boolean; dimensions: Array<{ name: string; score: number }> } {\n  if (!evaluation || typeof evaluation !== 'object' || Array.isArray(evaluation)) {\n    throw new Error('candidate benchmark evaluation must be an object')\n  }\n  assertUnitScore(evaluation.score, 'candidate benchmark score')\n  if (evaluation.passed !== undefined && typeof evaluation.passed !== 'boolean') {\n    throw new Error('candidate benchmark passed must be boolean')\n  }\n  const cleanExit = termination.kind === 'exit' && termination.exitCode === 0\n  const dimensions = Object.entries(evaluation.dimensions ?? {})\n    .map(([name, score]) => {\n      if (!/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/.test(name)) {\n        throw new Error(`candidate benchmark dimension is not normalized: ${name}`)\n      }\n      assertUnitScore(score, `candidate benchmark dimension ${name}`)\n      return { name, score: cleanExit ? score : 0 }\n    })\n    .sort((left, right) => left.name.localeCompare(right.name))\n  return {\n    score: cleanExit ? evaluation.score : 0,\n    passed: cleanExit && (evaluation.passed ?? evaluation.score > 0),\n    dimensions,\n  }\n}\n\nfunction assertUnitScore(value: unknown, label: string): asserts value is number {\n  if (typeof value !== 'number' || !Number.isFinite(value) || value < 0 || value > 1) {\n    throw new Error(`${label} must be finite and within [0, 1]`)\n  }\n}\n","import type { TraceStore } from '@tangle-network/agent-eval'\n\nimport {\n  createProtectedRecordRedactor,\n  type ProtectedRedactionReport,\n  type ProtectedTraceIdentity,\n} from './protected-redaction'\n\nexport interface ProtectedAgentCandidateTraceAccess {\n  readonly store: TraceStore\n  closeWrites(): Promise<void>\n  identity(trace: ProtectedTraceIdentity): ProtectedTraceIdentity\n  report(): ProtectedRedactionReport\n}\n\n/** Keep the identity key in evaluator-owned closures and expose only the redacting store to code. */\nexport function createProtectedAgentCandidateTraceAccess(\n  inner: TraceStore,\n  protectedValues: readonly string[],\n): ProtectedAgentCandidateTraceAccess {\n  const redactor = createProtectedRecordRedactor(protectedValues)\n  const pendingWrites = new Set<Promise<void>>()\n  let acceptsWrites = true\n  const write = (operation: () => Promise<void>): Promise<void> => {\n    if (!acceptsWrites) {\n      return Promise.reject(new Error('candidate trace writes are closed'))\n    }\n    let started: Promise<void>\n    try {\n      started = operation()\n    } catch (error) {\n      return Promise.reject(error)\n    }\n    let tracked: Promise<void>\n    tracked = started.finally(() => pendingWrites.delete(tracked))\n    pendingWrites.add(tracked)\n    return tracked\n  }\n  const store = Object.freeze<TraceStore>({\n    appendRun: (run) => write(() => inner.appendRun(redactor.record(run))),\n    updateRun: (runId, patch) =>\n      write(() => inner.updateRun(redactor.identifier(runId), redactor.record(patch))),\n    appendSpan: (span) =>\n      write(async () => {\n        if (span.kind === 'llm') {\n          throw new Error('candidate executors cannot author protected model spans')\n        }\n        await inner.appendSpan(redactor.record(span))\n      }),\n    updateSpan: (spanId, patch) =>\n      write(async () => {\n        if (patch.kind === 'llm') {\n          throw new Error('candidate executors cannot author protected model spans')\n        }\n        await inner.updateSpan(redactor.identifier(spanId), redactor.record(patch))\n      }),\n    appendEvent: (event) => write(() => inner.appendEvent(redactor.record(event))),\n    appendArtifact: (artifact) => write(() => inner.appendArtifact(redactor.record(artifact))),\n    appendBudgetEntry: (entry) => write(() => inner.appendBudgetEntry(redactor.record(entry))),\n    getRun: async (runId) => inner.getRun(redactor.identifier(runId)),\n    listRuns: async (filter) => inner.listRuns(filter ? redactor.query(filter) : undefined),\n    spans: async (filter) => inner.spans(filter ? redactor.query(filter) : undefined),\n    events: async (filter) => inner.events(filter ? redactor.query(filter) : undefined),\n    budget: async (runId) => inner.budget(redactor.identifier(runId)),\n    artifacts: async (runId) => inner.artifacts(redactor.identifier(runId)),\n  })\n  return Object.freeze({\n    store,\n    closeWrites: async () => {\n      acceptsWrites = false\n      await Promise.all([...pendingWrites])\n    },\n    identity: (trace: ProtectedTraceIdentity) => redactor.traceIdentity(trace),\n    report: () => redactor.report(),\n  })\n}\n\n/** Recovery can read existing trace state but must never accept new unredactable writes. */\nexport class RecoveryAgentCandidateTraceStore implements TraceStore {\n  constructor(private readonly inner: TraceStore) {}\n\n  appendRun(): Promise<void> {\n    return this.rejectWrite()\n  }\n\n  updateRun(): Promise<void> {\n    return this.rejectWrite()\n  }\n\n  appendSpan(): Promise<void> {\n    return this.rejectWrite()\n  }\n\n  updateSpan(): Promise<void> {\n    return this.rejectWrite()\n  }\n\n  appendEvent(): Promise<void> {\n    return this.rejectWrite()\n  }\n\n  appendArtifact(): Promise<void> {\n    return this.rejectWrite()\n  }\n\n  appendBudgetEntry(): Promise<void> {\n    return this.rejectWrite()\n  }\n\n  getRun(...args: Parameters<TraceStore['getRun']>): ReturnType<TraceStore['getRun']> {\n    return this.inner.getRun(...args)\n  }\n\n  listRuns(...args: Parameters<TraceStore['listRuns']>): ReturnType<TraceStore['listRuns']> {\n    return this.inner.listRuns(...args)\n  }\n\n  spans(...args: Parameters<TraceStore['spans']>): ReturnType<TraceStore['spans']> {\n    return this.inner.spans(...args)\n  }\n\n  events(...args: Parameters<TraceStore['events']>): ReturnType<TraceStore['events']> {\n    return this.inner.events(...args)\n  }\n\n  budget(...args: Parameters<TraceStore['budget']>): ReturnType<TraceStore['budget']> {\n    return this.inner.budget(...args)\n  }\n\n  artifacts(...args: Parameters<TraceStore['artifacts']>): ReturnType<TraceStore['artifacts']> {\n    return this.inner.artifacts(...args)\n  }\n\n  private rejectWrite(): Promise<never> {\n    return Promise.reject(new Error('expired candidate recovery cannot append trace evidence'))\n  }\n}\n","import type { TraceStore } from '@tangle-network/agent-eval'\nimport type {\n  AgentCandidateTaskOutcomeSpec,\n  AgentCandidateTermination,\n} from '@tangle-network/agent-interface'\n\nimport type {\n  AgentCandidateExecutionClaim,\n  AgentCandidateExecutionClaimStore,\n  AgentCandidateExecutionFailureClass,\n  AgentCandidateExecutionLease,\n  AgentCandidateExecutionTerminalResult,\n} from './claim'\nimport { candidateExecutionClaim } from './claim-plan'\nimport {\n  candidateCleanupDeadline,\n  candidateCleanupTimeout,\n  candidateResultTimeout,\n  withinCandidateCleanupDeadline,\n  withinCandidateResultDeadline,\n} from './cleanup'\nimport { canonicalCandidateBytes } from './digest'\nimport { candidatePostRunWindowMs, candidateTerminalWindowMs } from './execution-window'\nimport {\n  type SealedAgentCandidateExecutorFinalCapture,\n  sealAgentCandidateExecutorFinalCapture,\n  sealAgentCandidateExecutorStopAcknowledgement,\n  sealAgentCandidateProtectedRunCapture,\n} from './executor-capture'\nimport { failedAgentCandidateRun, finalizeAgentCandidateRun } from './finalize'\nimport {\n  appendAuthoritativeModelSettlementSpans,\n  type SealedAgentCandidateModelSettlement,\n  sealAgentCandidateModelSettlement,\n} from './model-settlement'\nimport {\n  type PersistedAgentCandidateModelSettlement,\n  persistCandidateBenchmarkResult,\n  persistCandidateModelSettlement,\n  persistVerifiedAgentCandidateExecutorCapture,\n} from './outcome-evidence'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport {\n  assertPreparedCandidateIntegrity,\n  assertPreparedCandidateWorkspaces,\n  beginPreparedCandidateClaim,\n  beginPreparedCandidateRun,\n  beginPreparedCandidateSettlement,\n  consumePreparedCandidateExecution,\n  markPreparedCandidateClaimed,\n  type PreparedCandidateState,\n} from './prepared-state'\nimport { redactProtectedReason } from './protected-redaction'\nimport { createProtectedAgentCandidateTraceAccess } from './protected-trace-store'\nimport type {\n  AgentCandidateBenchmarkGraderPort,\n  AgentCandidateExecutorPort,\n  AgentCandidateExecutorRequest,\n  AgentCandidateOutputArtifactPort,\n  AgentCandidateProtectedModelActivation,\n  AgentCandidateProtectedRunCapture,\n  AgentCandidateRunFinalization,\n  PreparedAgentCandidateExecution,\n} from './types'\n\nexport interface ExecutePreparedAgentCandidateOptions {\n  executor: AgentCandidateExecutorPort\n  grader: AgentCandidateBenchmarkGraderPort\n  outputArtifacts: AgentCandidateOutputArtifactPort\n  traceStore: TraceStore\n  /** Long-lived evaluator-owned store shared by every process that can run this benchmark. */\n  claimStore: AgentCandidateExecutionClaimStore\n  /** Maximum time to prove process death and revoke protected access after a run ends. */\n  cleanupTimeoutMs?: number\n  /** Maximum time for task verification, executable grading, and receipt construction. */\n  resultTimeoutMs?: number\n}\n\n/** Executes and finalizes one durably claimed candidate without exposing an unproven result. */\nexport async function executePreparedAgentCandidate(\n  prepared: PreparedAgentCandidateExecution,\n  options: ExecutePreparedAgentCandidateOptions,\n): Promise<AgentCandidateRunFinalization> {\n  const initialState = assertPreparedCandidateIntegrity(prepared)\n  const cleanupTimeoutMs = candidateCleanupTimeout(\n    options.cleanupTimeoutMs ?? initialState.cleanupTimeoutMs,\n  )\n  if (cleanupTimeoutMs > initialState.cleanupTimeoutMs) {\n    throw new Error('execution cleanup timeout exceeds the frozen preparation bound')\n  }\n  const resultTimeoutMs = candidateResultTimeout(\n    options.resultTimeoutMs ?? initialState.resultTimeoutMs,\n    initialState.resultTimeoutMs,\n  )\n  if (resultTimeoutMs > initialState.resultTimeoutMs) {\n    throw new Error('execution result timeout exceeds the frozen preparation bound')\n  }\n  let state: PreparedCandidateState\n  try {\n    state = beginPreparedCandidateClaim(prepared)\n  } catch (error) {\n    return failedAgentCandidateRun(initialState, errorMessage(error))\n  }\n\n  try {\n    // Mutable staging is only a preparation check. The executor receives the\n    // detached file bytes sealed in private state, never these host paths.\n    await assertPreparedCandidateWorkspaces(state)\n  } catch (error) {\n    return await failBeforeActivation(prepared, state, error, 'failed', cleanupTimeoutMs)\n  }\n\n  let preparationEvidence: AgentCandidateExecutionClaim['preparationEvidence']\n  try {\n    const [executionPlan, materializationReceipt] = await Promise.all([\n      persistCandidateOutputArtifact(options.outputArtifacts, {\n        executionId: state.executionId,\n        purpose: 'execution-plan',\n        bytes: state.executionPlan.bytes,\n      }),\n      persistCandidateOutputArtifact(options.outputArtifacts, {\n        executionId: state.executionId,\n        purpose: 'materialization-receipt',\n        bytes: state.materializationReceipt.bytes,\n      }),\n    ])\n    preparationEvidence = Object.freeze({ executionPlan, materializationReceipt })\n  } catch (error) {\n    return await failBeforeActivation(prepared, state, error, 'failed', cleanupTimeoutMs)\n  }\n\n  let acquired: Awaited<ReturnType<AgentCandidateExecutionClaimStore['tryClaim']>>\n  try {\n    acquired = await options.claimStore.tryClaim(\n      candidateExecutionClaim(prepared, preparationEvidence),\n    )\n  } catch (error) {\n    return await failBeforeActivation(prepared, state, error, 'failed', cleanupTimeoutMs)\n  }\n  if (!acquired.acquired) {\n    return await failBeforeActivation(\n      prepared,\n      state,\n      new Error(\n        acquired.reason === 'retry-not-eligible'\n          ? `candidate execution retry is not eligible: ${acquired.detail}`\n          : 'candidate execution attempt is already claimed',\n      ),\n      'replayed',\n      cleanupTimeoutMs,\n    )\n  }\n\n  markPreparedCandidateClaimed(prepared)\n  const postRunWindowMs = candidatePostRunWindowMs(cleanupTimeoutMs, resultTimeoutMs)\n  // A caller may shorten cleanup for this invocation, but that must never buy\n  // the candidate more execution time. The claim was frozen with the prepared\n  // cleanup window, so recover the original task deadline from that value.\n  const deadlineAtMs =\n    acquired.claim.leaseExpiresAtMs -\n    candidatePostRunWindowMs(state.cleanupTimeoutMs, state.resultTimeoutMs)\n  const requiredLeaseExpiry = deadlineAtMs + postRunWindowMs\n  if (\n    Date.now() >= deadlineAtMs ||\n    deadlineAtMs > state.reservationExpiresAtMs ||\n    requiredLeaseExpiry > acquired.lease.expiresAtMs\n  ) {\n    return await failClaimedExecution(\n      prepared,\n      state,\n      acquired.lease,\n      options.claimStore,\n      options.outputArtifacts,\n      new Error('candidate claim no longer covers its full execution and cleanup window'),\n      'failed',\n      cleanupTimeoutMs,\n      'pre-model-infrastructure',\n    )\n  }\n  let activation: AgentCandidateProtectedModelActivation\n  try {\n    const activated = await withinCandidateCleanupDeadline(\n      () =>\n        state.ports.models.activateGrant({\n          executionId: state.executionId,\n          preparationId: state.preparationId,\n          grantDigest: state.modelReservation.digest,\n          resolved: state.resolvedModel,\n          deadlineAtMs,\n        }),\n      Math.min(deadlineAtMs, candidateCleanupDeadline(cleanupTimeoutMs)),\n      'protected model activation',\n    )\n    activation = Object.freeze({ env: Object.freeze({ ...activated.env }) })\n  } catch (error) {\n    return await failClaimedExecution(\n      prepared,\n      state,\n      acquired.lease,\n      options.claimStore,\n      options.outputArtifacts,\n      new Error('protected model activation failed', { cause: error }),\n      'failed',\n      cleanupTimeoutMs,\n      'pre-model-infrastructure',\n    )\n  }\n\n  let memoryActivation: { env: Readonly<Record<string, string>> } | undefined\n  if (state.memory.mode === 'isolated') {\n    try {\n      const reservation = state.memoryReservation\n      if (!reservation) throw new Error('isolated memory reservation is missing')\n      const activated = await withinCandidateCleanupDeadline(\n        () =>\n          state.ports.memory.activate({\n            executionId: state.executionId,\n            preparationId: reservation.preparationId,\n            accessDigest: reservation.accessDigest,\n            effectiveNamespace: reservation.effectiveNamespace,\n            deadlineAtMs,\n          }),\n        Math.min(deadlineAtMs, candidateCleanupDeadline(cleanupTimeoutMs)),\n        'isolated memory activation',\n      )\n      memoryActivation = Object.freeze({ env: Object.freeze({ ...activated.env }) })\n    } catch (error) {\n      return await failClaimedExecution(\n        prepared,\n        state,\n        acquired.lease,\n        options.claimStore,\n        options.outputArtifacts,\n        new Error('isolated memory activation failed', { cause: error }),\n        'failed',\n        cleanupTimeoutMs,\n        'pre-model-infrastructure',\n        activation,\n      )\n    }\n  }\n\n  let request: AgentCandidateExecutorRequest\n  try {\n    request = beginPreparedCandidateRun(prepared, activation, memoryActivation).request\n  } catch (error) {\n    return await failClaimedExecution(\n      prepared,\n      state,\n      acquired.lease,\n      options.claimStore,\n      options.outputArtifacts,\n      error,\n      'failed',\n      cleanupTimeoutMs,\n      'pre-model-infrastructure',\n      activation,\n      memoryActivation,\n    )\n  }\n\n  try {\n    const phase = await options.claimStore.markCandidateMayRun(acquired.lease)\n    if (phase.phase !== 'candidate-may-run') {\n      throw new Error('candidate claim did not persist the candidate-may-run phase')\n    }\n  } catch (error) {\n    return await failClaimedExecution(\n      prepared,\n      state,\n      acquired.lease,\n      options.claimStore,\n      options.outputArtifacts,\n      new Error('candidate execution phase persistence failed', { cause: error }),\n      'failed',\n      cleanupTimeoutMs,\n      'pre-model-infrastructure',\n      activation,\n      memoryActivation,\n    )\n  }\n  if (Date.now() >= deadlineAtMs) {\n    return await failClaimedExecution(\n      prepared,\n      state,\n      acquired.lease,\n      options.claimStore,\n      options.outputArtifacts,\n      new Error('candidate execution deadline elapsed while persisting its launch phase'),\n      'failed',\n      cleanupTimeoutMs,\n      'unknown',\n      activation,\n      memoryActivation,\n    )\n  }\n\n  const protectedValues = protectedEnvironmentValues(activation, memoryActivation)\n  const protectedTrace = createProtectedAgentCandidateTraceAccess(\n    options.traceStore,\n    protectedValues,\n  )\n  const persistedTrace = protectedTrace.identity(state.trace)\n  const execution = await runAndStopExecutor(\n    options.executor,\n    request,\n    state.benchmarkTask.outcome,\n    protectedTrace.store,\n    deadlineAtMs,\n    cleanupTimeoutMs,\n  )\n  beginPreparedCandidateSettlement(prepared)\n  const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs)\n\n  const accessReason =\n    execution.kind === 'timeout' || execution.termination?.kind === 'timeout'\n      ? 'timeout'\n      : execution.kind === 'capture'\n        ? 'completed'\n        : 'failed'\n  const traceClosure = withinCandidateCleanupDeadline(\n    () => protectedTrace.closeWrites(),\n    cleanupDeadlineAtMs,\n    'candidate trace write closure',\n  ).then(\n    () => ({ closed: true as const, error: undefined }),\n    (error: unknown) => ({ closed: false as const, error }),\n  )\n  const [traceClose, memoryClose, settlementResult] = await Promise.all([\n    traceClosure,\n    closeMemoryAccess(state, accessReason, cleanupDeadlineAtMs),\n    settleModelGrant(state, accessReason, cleanupDeadlineAtMs),\n  ])\n  if (\n    !execution.processStopped ||\n    !traceClose.closed ||\n    !settlementResult.settlement ||\n    !memoryClose.closed\n  ) {\n    consumePreparedCandidateExecution(prepared, 'failed')\n    return failedAgentCandidateRun(\n      state,\n      redactProtectedReason(\n        joinErrors(\n          execution.error,\n          !execution.processStopped\n            ? new Error('candidate process termination is not proven')\n            : undefined,\n          traceClose.error,\n          memoryClose.error,\n          settlementResult.error ??\n            (!settlementResult.settlement ? new Error('model settlement failed') : undefined),\n          new Error('candidate claim remains recoverable until protected cleanup is proven'),\n        ),\n        protectedValues,\n      ),\n      execution.termination,\n      settlementResult.settlement?.usage ?? null,\n    )\n  }\n\n  let modelSettlement: PersistedAgentCandidateModelSettlement\n  try {\n    modelSettlement = await withinCandidateCleanupDeadline(\n      () =>\n        persistCandidateModelSettlement(\n          state,\n          settlementResult.settlement as SealedAgentCandidateModelSettlement,\n          options.outputArtifacts,\n        ),\n      candidateCleanupDeadline(cleanupTimeoutMs),\n      'candidate model settlement persistence',\n    )\n  } catch (error) {\n    consumePreparedCandidateExecution(prepared, 'failed')\n    return failedAgentCandidateRun(\n      state,\n      redactProtectedReason(\n        joinErrors(\n          error,\n          new Error('candidate claim remains recoverable until settlement evidence is durable'),\n        ),\n        protectedValues,\n      ),\n      execution.termination,\n      settlementResult.settlement.usage,\n    )\n  }\n\n  let result: AgentCandidateRunFinalization\n  const failureClass: AgentCandidateExecutionFailureClass =\n    execution.kind === 'error' ? 'execution' : 'post-model-infrastructure'\n  if (execution.kind === 'error') {\n    result = failedAgentCandidateRun(\n      state,\n      redactProtectedReason(errorMessage(execution.error), protectedValues),\n      execution.termination,\n      settlementResult.settlement.usage,\n    )\n  } else if (!execution.finalCapture.taskOutcome) {\n    result = failedAgentCandidateRun(\n      state,\n      'candidate executor stopped without a captured task outcome',\n      execution.termination,\n      settlementResult.settlement.usage,\n    )\n  } else {\n    const capture =\n      execution.kind === 'capture'\n        ? execution.capture\n        : {\n            executionId: state.executionId,\n            termination: execution.termination,\n          }\n    try {\n      const resultDeadlineAtMs = Math.min(\n        Date.now() + resultTimeoutMs,\n        acquired.lease.expiresAtMs - candidateTerminalWindowMs(cleanupTimeoutMs),\n      )\n      result = await withinCandidateResultDeadline(\n        async (signal) => {\n          await appendAuthoritativeModelSettlementSpans(\n            options.traceStore,\n            persistedTrace.runId,\n            settlementResult.settlement as SealedAgentCandidateModelSettlement,\n          )\n          const { persistedCapture, taskOutcome } =\n            await persistVerifiedAgentCandidateExecutorCapture(\n              state,\n              execution.finalCapture,\n              options.outputArtifacts,\n              protectedValues,\n              signal,\n            )\n          const benchmarkResult = await persistCandidateBenchmarkResult(\n            state,\n            capture.termination,\n            taskOutcome,\n            options.grader,\n            options.outputArtifacts,\n            protectedValues,\n            signal,\n          )\n          return await finalizeAgentCandidateRun(\n            state,\n            capture,\n            options.traceStore,\n            persistedTrace,\n            settlementResult.settlement as SealedAgentCandidateModelSettlement,\n            {\n              finalCapture: execution.finalCapture,\n              persistedCapture,\n              modelSettlement,\n              taskOutcome,\n              benchmarkResult,\n              outputArtifacts: options.outputArtifacts,\n            },\n            protectedValues,\n            protectedTrace.report(),\n            signal,\n          )\n        },\n        resultDeadlineAtMs,\n        'candidate evidence finalization',\n      )\n    } catch (error) {\n      result = failedAgentCandidateRun(\n        state,\n        redactProtectedReason(errorMessage(error), protectedValues),\n        execution.termination,\n        settlementResult.settlement.usage,\n      )\n    }\n  }\n\n  let terminal: AgentCandidateExecutionTerminalResult\n  try {\n    terminal = result.succeeded\n      ? {\n          status: 'succeeded',\n          usage: settlementResult.settlement.usage,\n          modelSettlement: result.artifacts.modelSettlement,\n          taskOutcome: result.artifacts.taskOutcome,\n          benchmarkResult: result.artifacts.benchmarkResult,\n          runReceipt: result.artifacts.runReceipt,\n        }\n      : {\n          status: 'failed',\n          failureClass,\n          usage: settlementResult.settlement.usage,\n          modelSettlement: modelSettlement.artifact,\n          failureEvidence: await withinCandidateCleanupDeadline(\n            () =>\n              persistFailureEvidence(\n                state,\n                result.reason,\n                failureClass,\n                execution.termination,\n                options.outputArtifacts,\n              ),\n            acquired.lease.expiresAtMs,\n            'candidate failure-evidence persistence',\n          ),\n        }\n  } catch (error) {\n    consumePreparedCandidateExecution(prepared, 'failed')\n    return failedAgentCandidateRun(\n      state,\n      redactProtectedReason(\n        joinErrors(\n          error,\n          new Error('candidate claim remains recoverable until terminal evidence is durable'),\n        ),\n        protectedValues,\n      ),\n      execution.termination,\n      settlementResult.settlement.usage,\n    )\n  }\n\n  const finished = await finishClaim(\n    options.claimStore,\n    acquired.lease,\n    terminal,\n    acquired.lease.expiresAtMs,\n  )\n  if (finished) {\n    consumePreparedCandidateExecution(prepared, result.succeeded ? 'succeeded' : 'failed')\n    return result\n  }\n\n  consumePreparedCandidateExecution(prepared, 'failed')\n  return failedAgentCandidateRun(\n    state,\n    'candidate execution terminal record could not be persisted',\n    execution.termination,\n    settlementResult.settlement.usage,\n  )\n}\n\ntype ExecutorOutcome =\n  | {\n      kind: 'capture'\n      capture: AgentCandidateProtectedRunCapture\n      termination: AgentCandidateTermination\n      finalCapture: SealedAgentCandidateExecutorFinalCapture\n      processStopped: true\n      error?: undefined\n    }\n  | {\n      kind: 'timeout'\n      termination: AgentCandidateTermination & { kind: 'timeout' }\n      finalCapture: SealedAgentCandidateExecutorFinalCapture\n      processStopped: true\n      error?: undefined\n    }\n  | {\n      kind: 'error'\n      error: unknown\n      termination?: AgentCandidateTermination\n      finalCapture?: SealedAgentCandidateExecutorFinalCapture\n      processStopped: boolean\n    }\n\nasync function runAndStopExecutor(\n  executor: AgentCandidateExecutorPort,\n  request: AgentCandidateExecutorRequest,\n  expectedOutcome: AgentCandidateTaskOutcomeSpec,\n  traceStore: TraceStore,\n  deadlineAtMs: number,\n  cleanupTimeoutMs: number,\n): Promise<ExecutorOutcome> {\n  const timeoutMs = request.hardLimits.timeoutMs\n  const timeoutError = new CandidateExecutionDeadlineError(timeoutMs)\n  if (Date.now() >= deadlineAtMs) {\n    return {\n      kind: 'error',\n      error: timeoutError,\n      termination: { kind: 'timeout', timeoutMs },\n      processStopped: true,\n    }\n  }\n  const controller = new AbortController()\n  let timer: ReturnType<typeof setTimeout> | undefined\n  let timedOut = false\n  let capture: AgentCandidateProtectedRunCapture | undefined\n  let executionError: unknown\n  const executionPromise = Promise.resolve().then(() =>\n    executor.execute(request, {\n      traceStore,\n      signal: controller.signal,\n      deadlineAtMs,\n    }),\n  )\n  // A stopped process may still leave a buggy adapter promise pending. Attach a\n  // terminal handler now so the deadline path cannot create an unhandled rejection.\n  void executionPromise.catch(() => undefined)\n  const deadlinePromise = new Promise<never>((_resolve, reject) => {\n    timer = setTimeout(\n      () => {\n        timedOut = true\n        controller.abort(timeoutError)\n        reject(timeoutError)\n      },\n      Math.max(0, deadlineAtMs - Date.now()),\n    )\n  })\n  void deadlinePromise.catch(() => undefined)\n  try {\n    capture = sealAgentCandidateProtectedRunCapture(\n      await Promise.race([executionPromise, deadlinePromise]),\n    )\n  } catch (error) {\n    executionError = error\n  }\n\n  if (!timedOut && capture && capture.executionId !== request.executionId) {\n    executionError = new Error('candidate execution capture id does not match the request')\n    capture = undefined\n  } else if (!timedOut && capture && Date.now() >= deadlineAtMs) {\n    // Promise resolution at the boundary is ambiguous under event-loop delay.\n    // Fail closed unless completion is observed strictly before the deadline.\n    timedOut = true\n    executionError = timeoutError\n    capture = undefined\n  } else if (!timedOut && capture?.termination.kind === 'timeout') {\n    executionError = new Error('candidate executor cannot declare the runtime-owned timeout')\n    capture = undefined\n  }\n\n  if (!capture || timedOut) controller.abort(executionError)\n  const stopReason = timedOut ? 'timeout' : capture ? 'completed' : 'failed'\n  const cleanupDeadlineAtMs = Date.now() + cleanupTimeoutMs\n  try {\n    const stopped = await withinCandidateCleanupDeadline(\n      (cleanupSignal) =>\n        executor.stop(\n          {\n            executionId: request.executionId,\n            executionPlanDigest: request.executionPlan.value.digest,\n          },\n          {\n            traceStore,\n            reason: stopReason,\n            signal: cleanupSignal,\n            deadlineAtMs: cleanupDeadlineAtMs,\n          },\n        ),\n      cleanupDeadlineAtMs,\n      'candidate process termination',\n    )\n    sealAgentCandidateExecutorStopAcknowledgement(stopped)\n  } catch (stopError) {\n    let disposalError: unknown\n    try {\n      await disposeExecutor(executor, request, cleanupDeadlineAtMs)\n    } catch (error) {\n      disposalError = error\n    }\n    if (timer) clearTimeout(timer)\n    controller.abort(stopError)\n    return {\n      kind: 'error',\n      error: new Error(joinErrors(executionError, stopError, disposalError)),\n      ...(timedOut ? { termination: { kind: 'timeout', timeoutMs } } : {}),\n      processStopped: false,\n    }\n  }\n\n  let finalCapture: SealedAgentCandidateExecutorFinalCapture | undefined\n  let finalCaptureError: unknown\n  try {\n    finalCapture = sealAgentCandidateExecutorFinalCapture(\n      await withinCandidateCleanupDeadline(\n        (cleanupSignal) =>\n          executor.capture(\n            {\n              executionId: request.executionId,\n              executionPlanDigest: request.executionPlan.value.digest,\n            },\n            {\n              traceStore,\n              signal: cleanupSignal,\n            },\n          ),\n        cleanupDeadlineAtMs,\n        'candidate final evidence capture',\n      ),\n      expectedOutcome,\n    )\n  } catch (captureError) {\n    finalCaptureError = captureError\n  }\n\n  let disposalError: unknown\n  try {\n    await disposeExecutor(executor, request, cleanupDeadlineAtMs)\n  } catch (disposeError) {\n    disposalError = disposeError\n  }\n  if (finalCaptureError || disposalError || !finalCapture) {\n    if (timer) clearTimeout(timer)\n    controller.abort(finalCaptureError ?? disposalError)\n    return {\n      kind: 'error',\n      error: new Error(joinErrors(executionError, finalCaptureError, disposalError)),\n      ...(timedOut ? { termination: { kind: 'timeout', timeoutMs } } : {}),\n      processStopped: true,\n    }\n  }\n\n  if (Date.now() >= deadlineAtMs) {\n    timedOut = true\n    executionError = timeoutError\n    capture = undefined\n    controller.abort(timeoutError)\n  }\n  if (timer) clearTimeout(timer)\n\n  if (timedOut) {\n    return {\n      kind: 'timeout',\n      termination: { kind: 'timeout', timeoutMs },\n      finalCapture,\n      processStopped: true,\n    }\n  }\n  if (executionError || !capture) {\n    return {\n      kind: 'error',\n      error: executionError ?? new Error('candidate executor returned no capture'),\n      finalCapture,\n      processStopped: true,\n    }\n  }\n  return {\n    kind: 'capture',\n    capture,\n    termination: capture.termination,\n    finalCapture,\n    processStopped: true,\n  }\n}\n\nasync function disposeExecutor(\n  executor: AgentCandidateExecutorPort,\n  request: AgentCandidateExecutorRequest,\n  cleanupDeadlineAtMs: number,\n): Promise<void> {\n  const dispose = executor.dispose\n  if (!dispose) return\n  const disposed = await withinCandidateCleanupDeadline(\n    (cleanupSignal) =>\n      dispose.call(\n        executor,\n        {\n          executionId: request.executionId,\n          executionPlanDigest: request.executionPlan.value.digest,\n        },\n        { signal: cleanupSignal },\n      ),\n    cleanupDeadlineAtMs,\n    'candidate execution resource disposal',\n  )\n  if (disposed?.disposed !== true || Object.keys(disposed).some((key) => key !== 'disposed')) {\n    throw new Error('candidate executor did not acknowledge resource disposal')\n  }\n}\n\nasync function failBeforeActivation(\n  prepared: PreparedAgentCandidateExecution,\n  state: PreparedCandidateState,\n  error: unknown,\n  reason: 'failed' | 'replayed',\n  cleanupTimeoutMs: number,\n): Promise<AgentCandidateRunFinalization> {\n  beginPreparedCandidateSettlement(prepared)\n  const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs)\n  const [memoryClose, settled] = await Promise.all([\n    closeMemoryAccess(state, reason, cleanupDeadlineAtMs),\n    settleModelGrant(state, reason, cleanupDeadlineAtMs),\n  ])\n  const cleanupProven = memoryClose.closed && settled.settlement !== undefined\n  consumePreparedCandidateExecution(prepared, cleanupProven ? 'failed' : 'cleanup-failed')\n  return failedAgentCandidateRun(\n    state,\n    redactProtectedReason(\n      joinErrors(\n        error,\n        memoryClose.error,\n        settled.error,\n        !cleanupProven\n          ? new Error('prepared access cleanup remains incomplete and may be retried by disposal')\n          : undefined,\n      ),\n      [],\n    ),\n    undefined,\n    settled.settlement?.usage ?? null,\n  )\n}\n\nasync function failClaimedExecution(\n  prepared: PreparedAgentCandidateExecution,\n  state: PreparedCandidateState,\n  lease: AgentCandidateExecutionLease,\n  claimStore: AgentCandidateExecutionClaimStore,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  error: unknown,\n  reason: 'failed',\n  cleanupTimeoutMs: number,\n  failureClass: AgentCandidateExecutionFailureClass,\n  activation?: AgentCandidateProtectedModelActivation,\n  memoryActivation?: { env: Readonly<Record<string, string>> },\n): Promise<AgentCandidateRunFinalization> {\n  beginPreparedCandidateSettlement(prepared)\n  const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs)\n  const [memoryClose, settled] = await Promise.all([\n    closeMemoryAccess(state, reason, cleanupDeadlineAtMs),\n    settleModelGrant(state, reason, cleanupDeadlineAtMs),\n  ])\n  const protectedValues = protectedEnvironmentValues(activation, memoryActivation)\n  const safeReason = redactProtectedReason(\n    joinErrors(error, memoryClose.error, settled.error),\n    protectedValues,\n  )\n  let finishFailed = false\n  let persistenceFailure: unknown\n  if (settled.settlement && memoryClose.closed) {\n    try {\n      const modelSettlement = await withinCandidateCleanupDeadline(\n        () => persistCandidateModelSettlement(state, settled.settlement!, outputArtifacts),\n        lease.expiresAtMs,\n        'candidate pre-run model-settlement persistence',\n      )\n      const failureEvidence = await withinCandidateCleanupDeadline(\n        () => persistFailureEvidence(state, safeReason, failureClass, undefined, outputArtifacts),\n        lease.expiresAtMs,\n        'candidate pre-run failure-evidence persistence',\n      )\n      finishFailed = !(await finishClaim(\n        claimStore,\n        lease,\n        {\n          status: 'failed',\n          failureClass,\n          usage: settled.settlement.usage,\n          modelSettlement: modelSettlement.artifact,\n          failureEvidence,\n        },\n        lease.expiresAtMs,\n      ))\n    } catch (persistenceError) {\n      finishFailed = true\n      persistenceFailure = persistenceError\n    }\n  }\n  consumePreparedCandidateExecution(prepared, 'failed')\n  return failedAgentCandidateRun(\n    state,\n    redactProtectedReason(\n      joinErrors(\n        safeReason,\n        persistenceFailure,\n        memoryClose.error,\n        settled.error,\n        !memoryClose.closed || !settled.settlement\n          ? new Error('candidate claim remains recoverable until protected cleanup is proven')\n          : undefined,\n        finishFailed\n          ? new Error('candidate execution terminal record could not be persisted')\n          : undefined,\n      ),\n      protectedValues,\n    ),\n    undefined,\n    settled.settlement?.usage ?? null,\n  )\n}\n\nasync function closeMemoryAccess(\n  state: PreparedCandidateState,\n  reason: 'completed' | 'failed' | 'timeout' | 'replayed',\n  cleanupDeadlineAtMs: number,\n): Promise<{ closed: true; error?: undefined } | { closed: false; error: unknown }> {\n  if (state.memory.mode === 'disabled') return { closed: true }\n  try {\n    const reservation = state.memoryReservation\n    if (!reservation) throw new Error('isolated memory reservation is missing')\n    const closed = await withinCandidateCleanupDeadline(\n      () =>\n        state.ports.memory.close({\n          executionId: state.executionId,\n          preparationId: reservation.preparationId,\n          accessDigest: reservation.accessDigest,\n          effectiveNamespace: reservation.effectiveNamespace,\n          reason,\n        }),\n      cleanupDeadlineAtMs,\n      'isolated memory closure',\n    )\n    if (closed.closed !== true || Object.keys(closed).some((key) => key !== 'closed')) {\n      throw new Error('isolated memory access did not acknowledge closure')\n    }\n    return { closed: true }\n  } catch (error) {\n    return { closed: false, error }\n  }\n}\n\nasync function settleModelGrant(\n  state: PreparedCandidateState,\n  reason: 'completed' | 'failed' | 'timeout' | 'replayed',\n  cleanupDeadlineAtMs: number,\n): Promise<{\n  settlement?: SealedAgentCandidateModelSettlement\n  error?: unknown\n}> {\n  try {\n    const value = await withinCandidateCleanupDeadline(\n      () =>\n        state.ports.models.settleGrant({\n          executionId: state.executionId,\n          preparationId: state.preparationId,\n          grantDigest: state.modelReservation.digest,\n          resolved: state.resolvedModel,\n          reason,\n        }),\n      cleanupDeadlineAtMs,\n      'protected model settlement',\n    )\n    return {\n      settlement: sealAgentCandidateModelSettlement(value, {\n        preparationId: state.preparationId,\n        grantDigest: state.modelReservation.digest,\n        model: state.resolvedModel.model,\n      }),\n    }\n  } catch (error) {\n    return { error: new Error('protected model settlement failed', { cause: error }) }\n  }\n}\n\nasync function finishClaim(\n  store: AgentCandidateExecutionClaimStore,\n  lease: AgentCandidateExecutionLease,\n  terminal: AgentCandidateExecutionTerminalResult,\n  deadlineAtMs?: number,\n): Promise<boolean> {\n  try {\n    const staged = await withinCandidateCleanupDeadline(\n      () => store.stageTerminal(lease, terminal),\n      deadlineAtMs ?? lease.expiresAtMs,\n      'candidate terminal staging',\n    )\n    if (!staged.staged && !staged.exactReplay) return false\n    const result = await withinCandidateCleanupDeadline(\n      () => store.finish(lease, staged.terminal.terminalDigest),\n      deadlineAtMs ?? lease.expiresAtMs,\n      'candidate terminal publication',\n    )\n    return result.finished || result.exactReplay\n  } catch {\n    return false\n  }\n}\n\nasync function persistFailureEvidence(\n  state: PreparedCandidateState,\n  reason: string,\n  failureClass: AgentCandidateExecutionFailureClass,\n  termination: AgentCandidateTermination | undefined,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n) {\n  const bytes = canonicalCandidateBytes({\n    kind: 'agent-candidate-execution-failure',\n    executionId: state.executionId,\n    bundleDigest: state.bundle.digest,\n    executionPlanDigest: state.executionPlan.value.digest,\n    failureClass,\n    reason,\n    ...(termination ? { termination } : {}),\n  })\n  return await persistCandidateOutputArtifact(outputArtifacts, {\n    executionId: state.executionId,\n    purpose: 'failure-evidence',\n    bytes,\n  })\n}\n\nfunction protectedEnvironmentValues(\n  activation?: AgentCandidateProtectedModelActivation,\n  memoryActivation?: { env: Readonly<Record<string, string>> },\n): string[] {\n  return [...Object.values(activation?.env ?? {}), ...Object.values(memoryActivation?.env ?? {})]\n}\n\nfunction joinErrors(...errors: unknown[]): string {\n  return errors\n    .filter((error) => error !== undefined)\n    .map(errorMessage)\n    .join('; ')\n}\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error)\n}\n\nclass CandidateExecutionDeadlineError extends Error {\n  constructor(timeoutMs: number) {\n    super(`candidate execution reached its frozen ${timeoutMs}ms deadline`)\n    this.name = 'CandidateExecutionDeadlineError'\n  }\n}\n","import { randomBytes } from 'node:crypto'\nimport { lstat, readdir } from 'node:fs/promises'\nimport { isAbsolute, posix, relative, resolve as resolveHostPath } from 'node:path'\n\nimport type {\n  AgentCandidateConfigValue,\n  AgentCandidateEffectiveMemory,\n  AgentCandidateExecutionLimits,\n  AgentCandidateExecutionPlanEvidence,\n  AgentCandidateExecutionPlanMaterial,\n  AgentCandidateMaterializationReceipt,\n  AgentCandidateModelAccessNetwork,\n  AgentCandidateResolvedModel,\n} from '@tangle-network/agent-interface'\nimport {\n  agentCandidateBenchmarkSuiteSchema,\n  agentCandidateBenchmarkTaskSchema,\n  agentCandidateContainerSchema,\n  agentCandidateExecutionLimitsSchema,\n  agentCandidateExecutionPlanEvidenceSchema,\n  agentCandidateExecutionPlanMaterialSchema,\n  agentCandidateMaterializationReceiptSchema,\n  agentCandidateModelAccessNetworkSchema,\n  agentCandidateRunCellSchema,\n  agentCandidateTaskOutcomeSpecSchema,\n  agentCandidateWorkspaceSnapshotEvidenceSchema,\n  sha256DigestSchema,\n} from '@tangle-network/agent-interface'\nimport { applyAgentCandidateWorkspacePlan } from '@tangle-network/agent-profile-materialize'\n\nimport {\n  readMaterializedWorkspaceFiles,\n  readVerifiedArtifact,\n  verifyMaterializedProfileWorkspace,\n  verifyMaterializedWorkspace,\n  verifyWorkspaceSnapshotArtifacts,\n} from './artifacts'\nimport {\n  candidateCleanupDeadline,\n  candidateCleanupTimeout,\n  candidateResultTimeout,\n  MAX_CANDIDATE_TIMER_INTERVAL_MS,\n  withinCandidateCleanupDeadline,\n} from './cleanup'\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  canonicalCandidateDocument,\n  embeddedCandidateArtifact,\n  omitTopLevelDigest,\n  sha256Bytes,\n} from './digest'\nimport { candidateExecutionOwnerWindowMs } from './execution-window'\nimport { verifyTaskCheckout } from './git-materialize'\nimport {\n  CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV,\n  CANDIDATE_KNOWLEDGE_ROOT_ENV,\n  candidateKnowledgeExecutionPaths,\n  prepareAgentCandidateKnowledge,\n} from './knowledge'\nimport { sealAgentCandidateModelSettlement, usdToNanos } from './model-settlement'\nimport { createPreparedCandidateExecution } from './prepared-state'\nimport { materializeAgentCandidateProfilePlan } from './profile'\nimport {\n  type AgentCandidateExecutionPorts,\n  type AgentCandidateTaskExecution,\n  CANDIDATE_TRACE_ENV,\n  CANDIDATE_TRACE_TAGS,\n  type PreparedAgentCandidateExecution,\n  type ResolvedAgentCandidateContainer,\n  type VerifiedAgentCandidate,\n} from './types'\nimport {\n  getVerifiedCandidateState,\n  verifiedArtifactBytes,\n  verifiedResourceTextByDigest,\n} from './verify'\n\nconst MIN_RESERVATION_TTL_MS = 15 * 60_000\nconst PREPARED_HOLD_MARGIN_MS = 5 * 60_000\n\nexport interface PrepareAgentCandidateExecutionOptions {\n  cleanupTimeoutMs?: number\n  /** Maximum time for task verification, executable grading, and receipt construction. */\n  resultTimeoutMs?: number\n}\n\n/** Materializes a verified candidate into one immutable evaluator-owned execution plan. */\nexport async function prepareAgentCandidateExecution(\n  candidate: VerifiedAgentCandidate,\n  task: AgentCandidateTaskExecution,\n  ports: AgentCandidateExecutionPorts,\n  options: PrepareAgentCandidateExecutionOptions = {},\n): Promise<PreparedAgentCandidateExecution> {\n  const cleanupTimeoutMs = candidateCleanupTimeout(options.cleanupTimeoutMs)\n  const verifiedState = getVerifiedCandidateState(candidate)\n  assertSameVerificationPorts(verifiedState.ports, ports)\n  const bundle = candidate.bundle\n  if (task.runCell.bundleDigest !== bundle.digest) {\n    throw new Error('candidate experiment cell does not bind the verified bundle')\n  }\n  const benchmarkTask = task.task\n  const attempt = {\n    number: task.runCell.attempt,\n    maxAttempts: benchmarkTask.attempt.maxAttempts,\n    retryPolicy: benchmarkTask.attempt.retryPolicy,\n  } as const\n  assertTaskInput(task, bundle.execution.instructionDelivery)\n  const resultTimeoutMs = candidateResultTimeout(\n    options.resultTimeoutMs,\n    benchmarkTask.limits.timeoutMs,\n  )\n  const ownerWindowMs = candidateExecutionOwnerWindowMs(\n    benchmarkTask.limits.timeoutMs,\n    cleanupTimeoutMs,\n    resultTimeoutMs,\n  )\n  const reservationWindowMs = ownerWindowMs + PREPARED_HOLD_MARGIN_MS\n  if (reservationWindowMs > MAX_CANDIDATE_TIMER_INTERVAL_MS) {\n    throw new Error('candidate reservation window exceeds the supported timer range')\n  }\n  assertDisjointHostStagingRoots(task)\n\n  const instructionBytes = Buffer.from(benchmarkTask.instruction, 'utf8')\n\n  const taskArtifacts = await verifyWorkspaceSnapshotArtifacts(\n    benchmarkTask.workspace,\n    ports.artifacts,\n  )\n  await ports.workspaces.materialize({\n    role: 'task',\n    snapshot: benchmarkTask.workspace,\n    archive: taskArtifacts.archive,\n    destination: task.stagingRoots.taskRoot,\n  })\n  await verifyMaterializedWorkspace(task.stagingRoots.taskRoot, benchmarkTask.workspace.material, {\n    ignoredProtectedRootEntries: ['.git', '.sidecar'],\n  })\n  if (benchmarkTask.repository) {\n    await verifyTaskCheckout(task.stagingRoots.taskRoot, benchmarkTask.repository)\n  }\n  const taskExecutorFiles = await readMaterializedWorkspaceFiles(\n    task.stagingRoots.taskRoot,\n    benchmarkTask.workspace.material,\n    { ignoredProtectedRootEntries: ['.git', '.sidecar'] },\n  )\n\n  let candidateArchive: Uint8Array | undefined\n  let candidateExecutorFiles:\n    | ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>\n    | undefined\n  if (bundle.execution.workspace) {\n    if (!task.stagingRoots.candidateRoot || !task.executionRoots.candidateRoot) {\n      throw new Error('active candidate execution requires host and container candidate roots')\n    }\n    candidateArchive = await verifiedArtifactBytes(candidate, bundle.execution.workspace.archive)\n    await ports.workspaces.materialize({\n      role: 'candidate',\n      snapshot: bundle.execution.workspace,\n      archive: candidateArchive,\n      destination: task.stagingRoots.candidateRoot,\n    })\n    await verifyMaterializedWorkspace(\n      task.stagingRoots.candidateRoot,\n      bundle.execution.workspace.material,\n    )\n    candidateExecutorFiles = await readMaterializedWorkspaceFiles(\n      task.stagingRoots.candidateRoot,\n      bundle.execution.workspace.material,\n    )\n  } else if (task.stagingRoots.candidateRoot || task.executionRoots.candidateRoot) {\n    throw new Error('disabled code cannot receive a candidate workspace root')\n  }\n\n  await assertEmptyDirectory(task.stagingRoots.profileRoot)\n  const profileWorkspacePlan = materializeAgentCandidateProfilePlan({\n    profile: bundle.profile,\n    harness: bundle.execution.harness,\n    launch: bundle.execution.launch,\n    workspace: bundle.execution.cwd.workspace,\n    workspaces: task.executionRoots,\n    resolvedResources: verifiedResourceTextByDigest(candidate),\n  })\n  const profileApplication = applyAgentCandidateWorkspacePlan(\n    profileWorkspacePlan,\n    task.stagingRoots.profileRoot,\n    bundle.execution.cwd.workspace,\n  )\n  await verifyMaterializedProfileWorkspace(\n    task.stagingRoots.profileRoot,\n    profileApplication.profileActivation.profilePlan.material,\n  )\n  const profilePlanBytes = await readVerifiedArtifact(\n    profileApplication.profileActivation.profilePlan.artifact,\n    ports.artifacts,\n  )\n  if (\n    !Buffer.from(profilePlanBytes).equals(\n      Buffer.from(\n        canonicalCandidateBytes(profileApplication.profileActivation.profilePlan.material),\n      ),\n    )\n  ) {\n    throw new Error('profile materializer did not capture exact canonical plan bytes')\n  }\n  const profileActivation = profileApplication.profileActivation\n\n  const container = await resolveContainer(candidate, task, ports)\n  const resolvedModel = await resolveModel(candidate, task, ports)\n  const preparationId = `candidate-preparation.${randomBytes(32).toString('base64url')}`\n  const reservationExpiresAtMs = Date.now() + Math.max(MIN_RESERVATION_TTL_MS, reservationWindowMs)\n  const modelReservation = await withinCandidateCleanupDeadline(\n    () =>\n      ports.models.reserveGrant({\n        executionId: task.executionId,\n        preparationId,\n        expiresAtMs: reservationExpiresAtMs,\n        attempt,\n        bundleDigest: bundle.digest,\n        resolved: resolvedModel,\n        limits: modelLimits(benchmarkTask.limits),\n      }),\n    candidateCleanupDeadline(cleanupTimeoutMs),\n    'protected model reservation',\n  )\n  let preparedMemory: Awaited<ReturnType<typeof prepareMemory>> | undefined\n  try {\n    validateProtectedModelReservation(\n      modelReservation,\n      benchmarkTask.limits,\n      preparationId,\n      reservationExpiresAtMs,\n    )\n    preparedMemory = await prepareMemory(\n      candidate,\n      task,\n      ports,\n      preparationId,\n      reservationExpiresAtMs,\n      cleanupTimeoutMs,\n    )\n    const memory = preparedMemory.value\n    const knowledge = await prepareAgentCandidateKnowledge(candidate, ports, task.runCell.arm)\n    const knowledgePaths = knowledge\n      ? candidateKnowledgeExecutionPaths(\n          task.executionRoots.taskRoot,\n          knowledge.retrievalConfig !== undefined,\n        )\n      : undefined\n    const baseLaunch = buildLaunch(candidate, task, profileApplication.flags)\n    const publicEnv = mergePublicEnvironment(\n      bundle.execution.env ?? {},\n      profileApplication.env,\n      bundle.execution.instructionDelivery.kind === 'utf8-file'\n        ? {\n            [bundle.execution.instructionDelivery.env]: {\n              kind: 'public',\n              value: bundle.execution.instructionDelivery.path,\n            },\n          }\n        : {},\n      knowledgePaths\n        ? {\n            [CANDIDATE_KNOWLEDGE_ROOT_ENV]: {\n              kind: 'public',\n              value: knowledgePaths.root,\n            },\n            ...(knowledgePaths.retrievalConfig\n              ? {\n                  [CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV]: {\n                    kind: 'public' as const,\n                    value: knowledgePaths.retrievalConfig,\n                  },\n                }\n              : {}),\n          }\n        : {},\n    )\n    const routes = modelRoutes(bundle.profile, benchmarkTask.model.requested)\n    const executionMaterial: AgentCandidateExecutionPlanMaterial = {\n      kind: 'agent-candidate-execution-plan-material',\n      runCell: task.runCell,\n      executionId: task.executionId,\n      workspaces: {\n        taskRoot: task.executionRoots.taskRoot,\n        ...(task.executionRoots.candidateRoot\n          ? { candidateRoot: task.executionRoots.candidateRoot }\n          : {}),\n      },\n      codeKind: bundle.code.kind,\n      ...(bundle.execution.workspace ? { candidateWorkspace: bundle.execution.workspace } : {}),\n      profile: profileApplication.application,\n      harness: bundle.execution.harness,\n      harnessVersion: bundle.execution.harnessVersion,\n      instructionDelivery: bundle.execution.instructionDelivery,\n      limits: benchmarkTask.limits,\n      container,\n      model: {\n        policy: 'single',\n        resolved: resolvedModel,\n        access: {\n          kind: 'evaluator-mediated',\n          grantDigest: modelReservation.digest,\n          network: modelReservation.network,\n        },\n        routes,\n      },\n      launch: {\n        executable: baseLaunch.executable,\n        args: baseLaunch.args,\n        env: publicEnv,\n        cwd: bundle.execution.cwd,\n      },\n      ...(bundle.knowledge ? { knowledgeManifestDigest: bundle.knowledge.snapshot.digest } : {}),\n      memory,\n      network: { mode: 'disabled' },\n    }\n    agentCandidateExecutionPlanMaterialSchema.parse(executionMaterial)\n    const executionBytes = canonicalCandidateBytes(executionMaterial)\n    const executionDigest = canonicalCandidateDigest(executionMaterial)\n    if (sha256Bytes(executionBytes) !== executionDigest) {\n      throw new Error('execution plan canonical serializers disagree')\n    }\n    const executionPlan: AgentCandidateExecutionPlanEvidence =\n      agentCandidateExecutionPlanEvidenceSchema.parse({\n        kind: 'agent-candidate-execution-plan',\n        digest: executionDigest,\n        material: executionMaterial,\n        artifact: embeddedCandidateArtifact(executionBytes),\n      })\n\n    const entrypoint = candidateEntrypointReceipt(candidate)\n    const materializationReceipt = canonicalCandidateDocument<AgentCandidateMaterializationReceipt>(\n      {\n        kind: 'agent-candidate-materialization',\n        digestAlgorithm: 'rfc8785-sha256',\n        bundleDigest: bundle.digest,\n        benchmark: {\n          suite: {\n            digest: task.benchmarkSuite.digest,\n            material: embeddedCandidateArtifact(\n              canonicalCandidateBytes(omitTopLevelDigest(task.benchmarkSuite)),\n            ),\n          },\n          task: {\n            digest: benchmarkTask.digest,\n            material: embeddedCandidateArtifact(\n              canonicalCandidateBytes(omitTopLevelDigest(benchmarkTask)),\n            ),\n          },\n        },\n        profileActivation,\n        executionPlan,\n        ...(bundle.execution.workspace ? { candidateWorkspace: bundle.execution.workspace } : {}),\n        codeKind: bundle.code.kind,\n        ...(candidate.materializedTree ? { materializedTree: candidate.materializedTree } : {}),\n        harness: bundle.execution.harness,\n        harnessVersion: bundle.execution.harnessVersion,\n        container,\n        resolvedModel,\n        ...(bundle.knowledge ? { knowledgeManifestDigest: bundle.knowledge.snapshot.digest } : {}),\n        ...(entrypoint ? { entrypoint } : {}),\n      },\n    )\n    agentCandidateMaterializationReceiptSchema.parse(materializationReceipt.value)\n\n    const traceRunId = `${task.executionId}:attempt-${attempt.number}:${canonicalCandidateDigest({ preparationId }).slice(7, 23)}`\n    const traceTags = {\n      [CANDIDATE_TRACE_TAGS.executionId]: task.executionId,\n      [CANDIDATE_TRACE_TAGS.bundleDigest]: bundle.digest,\n      [CANDIDATE_TRACE_TAGS.executionPlanDigest]: executionPlan.digest,\n      [CANDIDATE_TRACE_TAGS.materializationReceiptDigest]: materializationReceipt.digest,\n    }\n    const traceEnv = {\n      [CANDIDATE_TRACE_ENV.executionId]: task.executionId,\n      [CANDIDATE_TRACE_ENV.bundleDigest]: bundle.digest,\n      [CANDIDATE_TRACE_ENV.executionPlanDigest]: executionPlan.digest,\n      [CANDIDATE_TRACE_ENV.materializationReceiptDigest]: materializationReceipt.digest,\n      [CANDIDATE_TRACE_ENV.traceRunId]: traceRunId,\n    }\n    assertEnvironmentDisjoint(publicEnv, traceEnv)\n\n    return createPreparedCandidateExecution({\n      ports,\n      bundle,\n      benchmarkSuite: task.benchmarkSuite,\n      benchmarkTask,\n      executionId: task.executionId,\n      roots: {\n        execution: { ...task.executionRoots },\n        staging: { ...task.stagingRoots },\n      },\n      profilePlan: {\n        value: profileApplication.profileActivation.profilePlan,\n        bytes: profilePlanBytes,\n        written: [...profileApplication.application.mountPaths],\n      },\n      profileActivation,\n      executionPlan: { value: executionPlan, bytes: executionBytes },\n      materializationReceipt,\n      launch: {\n        executable: baseLaunch.executable,\n        args: baseLaunch.args.map((value) => value.value),\n        env: unwrapPublicEnvironment(publicEnv),\n        flags: profileApplication.flags.map((value) => value.value),\n        cwd: absoluteExecutionCwd(bundle.execution.cwd, task.executionRoots),\n      },\n      instruction: {\n        bytes: Uint8Array.from(instructionBytes),\n        delivery: bundle.execution.instructionDelivery,\n      },\n      resolvedModel,\n      preparationId,\n      reservationExpiresAtMs,\n      cleanupTimeoutMs,\n      resultTimeoutMs,\n      modelReservation: {\n        preparationId: modelReservation.preparationId,\n        digest: modelReservation.digest,\n        expiresAtMs: modelReservation.expiresAtMs,\n        enforcedLimits: modelReservation.enforcedLimits,\n        network: modelReservation.network,\n      },\n      executorInputs: {\n        taskFiles: taskExecutorFiles,\n        ...(candidateExecutorFiles ? { candidateFiles: candidateExecutorFiles } : {}),\n        profileFiles: exactProfileExecutorFiles(\n          profileWorkspacePlan.files,\n          profileApplication.profileActivation.profilePlan.material.files,\n        ),\n      },\n      ...(preparedMemory.accessDigest && preparedMemory.value.mode === 'isolated'\n        ? {\n            memoryReservation: {\n              preparationId,\n              accessDigest: preparedMemory.accessDigest,\n              expiresAtMs: reservationExpiresAtMs,\n              effectiveNamespace: preparedMemory.value.effectiveNamespace,\n            },\n          }\n        : {}),\n      ...(knowledge ? { knowledge } : {}),\n      trace: { runId: traceRunId, tags: traceTags, env: traceEnv },\n      memory,\n    })\n  } catch (error) {\n    const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs)\n    const cleanup: Array<Promise<unknown>> = []\n    if (preparedMemory?.value.mode === 'isolated') {\n      const accessDigest = preparedMemory.accessDigest\n      const effectiveNamespace = preparedMemory.value.effectiveNamespace\n      if (!accessDigest) throw new Error('isolated memory preparation is missing access identity')\n      cleanup.push(\n        withinCandidateCleanupDeadline(\n          async () => {\n            const closed = await ports.memory.close({\n              executionId: task.executionId,\n              preparationId,\n              accessDigest,\n              effectiveNamespace,\n              reason: 'preparation-failed',\n            })\n            if (closed.closed !== true || Object.keys(closed).some((key) => key !== 'closed')) {\n              throw new Error('failed preparation did not close isolated memory access')\n            }\n          },\n          cleanupDeadlineAtMs,\n          'failed preparation memory cleanup',\n        ),\n      )\n    }\n    cleanup.push(\n      withinCandidateCleanupDeadline(\n        async () => {\n          const settlement = sealAgentCandidateModelSettlement(\n            await ports.models.settleGrant({\n              executionId: task.executionId,\n              preparationId,\n              grantDigest: modelReservation.digest,\n              resolved: resolvedModel,\n              reason: 'preparation-failed',\n            }),\n            {\n              preparationId,\n              grantDigest: modelReservation.digest,\n              model: resolvedModel.model,\n            },\n          )\n          if (settlement.usage.modelCalls !== 0) {\n            throw new Error('failed preparation unexpectedly contains model calls')\n          }\n        },\n        cleanupDeadlineAtMs,\n        'failed preparation model cleanup',\n      ),\n    )\n    const cleanupResults = await Promise.allSettled(cleanup)\n    const cleanupErrors = cleanupResults\n      .filter((result): result is PromiseRejectedResult => result.status === 'rejected')\n      .map((result) => result.reason)\n    if (cleanupErrors.length > 0) {\n      throw new Error(\n        `candidate preparation failed and protected access cleanup failed: ${cleanupErrors.map(errorMessage).join('; ')}`,\n        { cause: error },\n      )\n    }\n    throw error\n  }\n}\n\nfunction assertSameVerificationPorts(\n  verified: AgentCandidateExecutionPorts | { artifacts: unknown; repositories: unknown },\n  execution: AgentCandidateExecutionPorts,\n): void {\n  if (\n    verified.artifacts !== execution.artifacts ||\n    verified.repositories !== execution.repositories\n  ) {\n    throw new Error(\n      'prepare must use the same artifact and repository ports that verified the bundle',\n    )\n  }\n}\n\nfunction assertTaskInput(\n  task: AgentCandidateTaskExecution,\n  delivery: VerifiedAgentCandidate['bundle']['execution']['instructionDelivery'],\n): void {\n  const benchmarkTask = agentCandidateBenchmarkTaskSchema.parse(task.task)\n  const benchmarkSuite = agentCandidateBenchmarkSuiteSchema.parse(task.benchmarkSuite)\n  const runCell = agentCandidateRunCellSchema.parse(task.runCell)\n  const requiredStrings: Array<[string, string]> = [\n    ['executionId', task.executionId],\n    ['benchmark', benchmarkTask.benchmark.name],\n    ['benchmarkVersion', benchmarkTask.benchmark.version],\n    ['taskId', benchmarkTask.scenario.id],\n  ]\n  if (benchmarkTask.outcome.kind === 'workspace' && !benchmarkTask.repository) {\n    throw new Error('workspace task outcome requires repository identity')\n  }\n  if (benchmarkTask.repository) {\n    requiredStrings.push(\n      ['repository identity', benchmarkTask.repository.identity],\n      ['repository root identity', benchmarkTask.repository.rootIdentity],\n    )\n  }\n  for (const [name, value] of requiredStrings) {\n    if (!value.trim()) throw new Error(`${name} must be non-empty`)\n  }\n  if (!/^[A-Za-z0-9._:-]{1,200}$/.test(task.executionId)) {\n    throw new Error('executionId must be a stable filesystem-neutral identifier')\n  }\n  if (!benchmarkTask.instruction || !isWellFormedUnicode(benchmarkTask.instruction)) {\n    throw new Error('task instruction must be non-empty well-formed Unicode')\n  }\n  if (\n    canonicalCandidateDigest(omitTopLevelDigest(benchmarkTask)) !== benchmarkTask.digest ||\n    canonicalCandidateDigest(omitTopLevelDigest(benchmarkSuite)) !== benchmarkSuite.digest ||\n    canonicalCandidateDigest(omitTopLevelDigest(runCell)) !== runCell.digest\n  ) {\n    throw new Error('candidate experiment cell contains an invalid content digest')\n  }\n  const cellIndex = runCell.taskIndex * benchmarkSuite.reps + runCell.repetition\n  if (\n    runCell.suiteDigest !== benchmarkSuite.digest ||\n    runCell.taskDigest !== benchmarkTask.digest ||\n    benchmarkSuite.taskDigests[runCell.taskIndex] !== benchmarkTask.digest ||\n    runCell.repetition >= benchmarkSuite.reps ||\n    benchmarkSuite.seeds[cellIndex] !== runCell.seed ||\n    runCell.attempt > benchmarkTask.attempt.maxAttempts\n  ) {\n    throw new Error('candidate experiment cell does not match its signed suite and task')\n  }\n  sha256DigestSchema.parse(benchmarkTask.benchmark.splitDigest)\n  agentCandidateTaskOutcomeSpecSchema.parse(benchmarkTask.outcome)\n  agentCandidateWorkspaceSnapshotEvidenceSchema.parse(benchmarkTask.workspace)\n  agentCandidateExecutionLimitsSchema.parse(benchmarkTask.limits)\n  if (benchmarkTask.repository) {\n    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(benchmarkTask.repository.baseCommit)) {\n      throw new Error('task repository base commit is not a full Git object id')\n    }\n    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(benchmarkTask.repository.baseTree)) {\n      throw new Error('task repository base tree is not a full Git object id')\n    }\n    if (benchmarkTask.repository.baseCommit.length !== benchmarkTask.repository.baseTree.length) {\n      throw new Error('task repository Git object formats disagree')\n    }\n  }\n  for (const [name, root] of [\n    ['execution task root', task.executionRoots.taskRoot],\n    ['execution candidate root', task.executionRoots.candidateRoot],\n    ['staging task root', task.stagingRoots.taskRoot],\n    ['staging candidate root', task.stagingRoots.candidateRoot],\n    ['staging profile root', task.stagingRoots.profileRoot],\n  ] as const) {\n    if (root === undefined) continue\n    const canonical = name.startsWith('execution')\n      ? posix.isAbsolute(root) && posix.normalize(root) === root\n      : isAbsolute(root) && resolveHostPath(root) === root\n    if (!canonical) throw new Error(`${name} must be a canonical absolute path`)\n  }\n  if (\n    !Number.isInteger(runCell.attempt) ||\n    !Number.isInteger(benchmarkTask.attempt.maxAttempts) ||\n    runCell.attempt < 1 ||\n    runCell.attempt > benchmarkTask.attempt.maxAttempts ||\n    (benchmarkTask.attempt.retryPolicy === 'none' && benchmarkTask.attempt.maxAttempts !== 1)\n  ) {\n    throw new Error('task attempt policy is invalid')\n  }\n  const limits = benchmarkTask.limits\n  if (\n    !Number.isInteger(limits.timeoutMs) ||\n    limits.timeoutMs <= 0 ||\n    limits.timeoutMs > MAX_CANDIDATE_TIMER_INTERVAL_MS ||\n    !Number.isInteger(limits.maxSteps) ||\n    limits.maxSteps <= 0 ||\n    !Number.isInteger(limits.maxModelCalls) ||\n    limits.maxModelCalls < 0 ||\n    !Number.isInteger(limits.maxInputTokens) ||\n    limits.maxInputTokens < 0 ||\n    !Number.isInteger(limits.maxOutputTokens) ||\n    limits.maxOutputTokens < 0 ||\n    !Number.isFinite(limits.maxCostUsd) ||\n    limits.maxCostUsd < 0\n  ) {\n    throw new Error('task execution limits are invalid')\n  }\n  usdToNanos(limits.maxCostUsd, 'task maxCostUsd')\n  if (!benchmarkTask.model.requested.trim()) {\n    throw new Error('evaluator model request must be non-empty')\n  }\n  if (!benchmarkTask.grader.name.trim() || !benchmarkTask.grader.version.trim()) {\n    throw new Error('evaluator benchmark grader identity must be non-empty')\n  }\n  if (\n    !Number.isInteger(benchmarkTask.grader.artifact.byteLength) ||\n    benchmarkTask.grader.artifact.byteLength <= 0\n  ) {\n    throw new Error('evaluator benchmark grader artifact must be non-empty')\n  }\n  sha256DigestSchema.parse(benchmarkTask.grader.artifact.sha256)\n  if (benchmarkTask.evaluatorTaskContainer) {\n    if (\n      benchmarkTask.evaluatorTaskContainer.source !== 'evaluator-task-container' ||\n      !benchmarkTask.evaluatorTaskContainer.image.trim() ||\n      !benchmarkTask.evaluatorTaskContainer.platform.os.trim() ||\n      !benchmarkTask.evaluatorTaskContainer.platform.architecture.trim()\n    ) {\n      throw new Error('evaluator task container evidence is incomplete')\n    }\n    sha256DigestSchema.parse(benchmarkTask.evaluatorTaskContainer.indexDigest)\n    sha256DigestSchema.parse(benchmarkTask.evaluatorTaskContainer.manifestDigest)\n    agentCandidateContainerSchema.parse({\n      image: benchmarkTask.evaluatorTaskContainer.image,\n      indexDigest: benchmarkTask.evaluatorTaskContainer.indexDigest,\n    })\n  }\n  if (delivery.kind === 'utf8-file') {\n    if (\n      executionPathsOverlap(task.executionRoots.taskRoot, delivery.path) ||\n      (task.executionRoots.candidateRoot !== undefined &&\n        executionPathsOverlap(task.executionRoots.candidateRoot, delivery.path))\n    ) {\n      throw new Error('task instruction file must remain outside execution workspaces')\n    }\n  }\n}\n\nfunction executionPathsOverlap(left: string, right: string): boolean {\n  const a = posix.normalize(left)\n  const b = posix.normalize(right)\n  return (\n    a === b || b.startsWith(a === '/' ? '/' : `${a}/`) || a.startsWith(b === '/' ? '/' : `${b}/`)\n  )\n}\n\nfunction assertDisjointHostStagingRoots(task: AgentCandidateTaskExecution): void {\n  const roots = [\n    task.stagingRoots.taskRoot,\n    task.stagingRoots.candidateRoot,\n    task.stagingRoots.profileRoot,\n  ]\n    .filter((value): value is string => value !== undefined)\n    .map((value) => resolveHostPath(value))\n  for (let left = 0; left < roots.length; left++) {\n    for (let right = left + 1; right < roots.length; right++) {\n      const a = roots[left]\n      const b = roots[right]\n      if (a && b && (a === b || isContainedPath(a, b) || isContainedPath(b, a))) {\n        throw new Error('host task, candidate, and profile staging roots must be disjoint')\n      }\n    }\n  }\n}\n\nfunction isContainedPath(parent: string, child: string): boolean {\n  const path = relative(parent, child)\n  return path !== '' && !path.startsWith('..') && !isAbsolute(path)\n}\n\nasync function assertEmptyDirectory(path: string): Promise<void> {\n  const stats = await lstat(path)\n  if (!stats.isDirectory() || stats.isSymbolicLink()) {\n    throw new Error('profile staging root must be a real directory')\n  }\n  if ((await readdir(path)).length !== 0) {\n    throw new Error('profile staging root must be empty before materialization')\n  }\n}\n\nasync function resolveContainer(\n  candidate: VerifiedAgentCandidate,\n  task: AgentCandidateTaskExecution,\n  ports: AgentCandidateExecutionPorts,\n): Promise<ResolvedAgentCandidateContainer> {\n  const environment = candidate.bundle.execution.environment\n  const evaluatorTaskContainer = task.task.evaluatorTaskContainer\n  const pinned = environment.kind === 'pinned-container' ? environment.container : undefined\n  if (environment.kind === 'evaluator-task-container' && !evaluatorTaskContainer) {\n    throw new Error('evaluator-task-container candidate requires an evaluator-owned task image')\n  }\n  if (environment.kind === 'pinned-container' && evaluatorTaskContainer) {\n    throw new Error('pinned candidate containers cannot be replaced by a task image')\n  }\n  const resolved = await ports.containers.resolve({\n    candidate: pinned,\n    evaluatorTaskContainer,\n  })\n  if (resolved.source !== environment.kind) throw new Error('resolved container source drifted')\n  if (pinned && (resolved.image !== pinned.image || resolved.indexDigest !== pinned.indexDigest)) {\n    throw new Error('resolved pinned container does not match the candidate image index')\n  }\n  if (\n    evaluatorTaskContainer &&\n    canonicalCandidateDigest(resolved) !== canonicalCandidateDigest(evaluatorTaskContainer)\n  ) {\n    throw new Error('resolved task container does not match evaluator-owned image evidence')\n  }\n  return resolved\n}\n\nasync function resolveModel(\n  candidate: VerifiedAgentCandidate,\n  task: AgentCandidateTaskExecution,\n  ports: AgentCandidateExecutionPorts,\n): Promise<AgentCandidateResolvedModel> {\n  const hints = candidate.bundle.profile.model\n  const expected = task.task.model\n  if (hints?.default !== undefined && hints.default !== expected.requested) {\n    throw new Error('candidate model preference conflicts with the evaluator-owned model')\n  }\n  if (hints?.reasoningEffort !== undefined && hints.reasoningEffort !== expected.reasoningEffort) {\n    throw new Error('candidate reasoning effort conflicts with the evaluator-owned effort')\n  }\n  const resolved = await ports.models.resolve({\n    requested: expected.requested,\n    harness: candidate.bundle.execution.harness,\n    reasoningEffort: expected.reasoningEffort,\n  })\n  if (canonicalCandidateDigest(resolved) !== canonicalCandidateDigest(expected)) {\n    throw new Error('model resolver drifted from the signed benchmark model')\n  }\n  return resolved\n}\n\nasync function prepareMemory(\n  candidate: VerifiedAgentCandidate,\n  task: AgentCandidateTaskExecution,\n  ports: AgentCandidateExecutionPorts,\n  preparationId: string,\n  expiresAtMs: number,\n  cleanupTimeoutMs: number,\n): Promise<{\n  value: AgentCandidateEffectiveMemory\n  accessDigest?: `sha256:${string}`\n}> {\n  const policy = candidate.bundle.memory\n  if (policy.mode === 'disabled') return { value: { mode: 'disabled' } }\n  const seed = policy.seed ? await verifiedArtifactBytes(candidate, policy.seed) : undefined\n  const executionSegment = canonicalCandidateDigest({ executionId: task.executionId }).slice(7)\n  const taskSegment = canonicalCandidateDigest({ taskDigest: task.task.digest }).slice(7)\n  const preparationSegment = canonicalCandidateDigest({ preparationId }).slice(7, 23)\n  const effectiveNamespace = `candidate/${candidate.bundle.digest.slice(7, 23)}/${executionSegment}/${taskSegment}/${preparationSegment}`\n  const reset = await withinCandidateCleanupDeadline(\n    () =>\n      ports.memory.reset({\n        executionId: task.executionId,\n        preparationId,\n        expiresAtMs,\n        effectiveNamespace,\n        ...(seed ? { seed } : {}),\n        ...(policy.seed ? { seedDigest: policy.seed.sha256 } : {}),\n      }),\n    candidateCleanupDeadline(cleanupTimeoutMs),\n    'isolated memory reset',\n  )\n  try {\n    if (\n      reset.preparationId !== preparationId ||\n      reset.expiresAtMs !== expiresAtMs ||\n      !/^sha256:[a-f0-9]{64}$/.test(reset.accessDigest)\n    ) {\n      throw new Error('isolated memory reservation is not scoped to this preparation')\n    }\n    await readVerifiedArtifact(reset.evidence, ports.artifacts)\n    await verifyWorkspaceSnapshotArtifacts(reset.beforeState, ports.artifacts)\n    return {\n      value: {\n        mode: 'isolated',\n        scope: 'task',\n        effectiveNamespace,\n        reset: {\n          kind: 'fresh',\n          evidence: reset.evidence,\n          emptyStateDigest: reset.emptyStateDigest,\n        },\n        beforeState: reset.beforeState,\n        ...(policy.seed ? { seedDigest: policy.seed.sha256 } : {}),\n      },\n      accessDigest: reset.accessDigest,\n    }\n  } catch (error) {\n    try {\n      const closed = await withinCandidateCleanupDeadline(\n        () =>\n          ports.memory.close({\n            executionId: task.executionId,\n            preparationId,\n            accessDigest: reset.accessDigest,\n            effectiveNamespace,\n            reason: 'preparation-failed',\n          }),\n        candidateCleanupDeadline(cleanupTimeoutMs),\n        'invalid isolated memory reset cleanup',\n      )\n      if (closed.closed !== true || Object.keys(closed).some((key) => key !== 'closed')) {\n        throw new Error('invalid isolated memory reset did not acknowledge closure')\n      }\n    } catch (closeError) {\n      throw new Error('isolated memory preparation and cleanup both failed', {\n        cause: new AggregateError([error, closeError]),\n      })\n    }\n    throw error\n  }\n}\n\nfunction buildLaunch(\n  candidate: VerifiedAgentCandidate,\n  task: AgentCandidateTaskExecution,\n  profileFlags: AgentCandidateConfigValue[],\n): { executable: string; args: AgentCandidateConfigValue[] } {\n  const launch = candidate.bundle.execution.launch\n  if (launch.kind === 'container-command') {\n    return { executable: launch.executable, args: [...(launch.args ?? []), ...profileFlags] }\n  }\n  const candidateRoot = task.executionRoots.candidateRoot\n  if (!candidateRoot) throw new Error('candidate entrypoint requires a container candidate root')\n  const entrypoint = posix.join(candidateRoot, launch.entrypoint)\n  const candidateArgs = launch.args ?? []\n  if (launch.interpreter) {\n    return {\n      executable: launch.interpreter,\n      args: [{ kind: 'public', value: entrypoint }, ...candidateArgs, ...profileFlags],\n    }\n  }\n  return { executable: entrypoint, args: [...candidateArgs, ...profileFlags] }\n}\n\nfunction mergePublicEnvironment(\n  ...records: Array<Record<string, AgentCandidateConfigValue>>\n): Record<string, AgentCandidateConfigValue> {\n  const output: Record<string, AgentCandidateConfigValue> = {}\n  for (const record of records) {\n    for (const [name, value] of Object.entries(record)) {\n      const previous = output[name]\n      if (previous && previous.value !== value.value) {\n        throw new Error(`candidate and profile environment disagree on ${name}`)\n      }\n      output[name] = value\n    }\n  }\n  return output\n}\n\nfunction unwrapPublicEnvironment(\n  values: Record<string, AgentCandidateConfigValue>,\n): Record<string, string> {\n  return Object.fromEntries(Object.entries(values).map(([name, value]) => [name, value.value]))\n}\n\nfunction modelRoutes(\n  profile: VerifiedAgentCandidate['bundle']['profile'],\n  requested: string,\n): AgentCandidateExecutionPlanMaterial['model']['routes'] {\n  const routes: AgentCandidateExecutionPlanMaterial['model']['routes'] = [\n    { kind: 'primary', requested },\n  ]\n  if (profile.model?.small) routes.push({ kind: 'small', requested })\n  for (const name of Object.keys(profile.modes ?? {}).sort()) {\n    if (profile.modes?.[name]?.model) routes.push({ kind: 'mode', name, requested })\n  }\n  for (const name of Object.keys(profile.subagents ?? {}).sort()) {\n    if (profile.subagents?.[name]?.model) routes.push({ kind: 'subagent', name, requested })\n  }\n  return routes\n}\n\nfunction candidateEntrypointReceipt(\n  candidate: VerifiedAgentCandidate,\n): { path: string; sha256: `sha256:${string}`; byteLength: number } | undefined {\n  const launch = candidate.bundle.execution.launch\n  const workspace = candidate.bundle.execution.workspace\n  if (launch.kind !== 'candidate-entrypoint' || !workspace) return undefined\n  const file = workspace.material.files.find((entry) => entry.path === launch.entrypoint)\n  if (!file) throw new Error('candidate entrypoint is absent from the verified workspace')\n  return { path: file.path, sha256: file.sha256, byteLength: file.byteLength }\n}\n\nfunction absoluteExecutionCwd(\n  cwd: VerifiedAgentCandidate['bundle']['execution']['cwd'],\n  roots: AgentCandidateTaskExecution['executionRoots'],\n): string {\n  const root = cwd.workspace === 'task' ? roots.taskRoot : roots.candidateRoot\n  if (!root) throw new Error('candidate cwd is missing its execution workspace root')\n  const absolute = cwd.path === '.' ? root : posix.join(root, cwd.path)\n  if (absolute !== root && !absolute.startsWith(`${root}/`)) {\n    throw new Error('candidate cwd escapes its execution workspace')\n  }\n  return absolute\n}\n\nfunction validateProtectedModelReservation(\n  reservation: {\n    preparationId: string\n    digest: string\n    expiresAtMs: number\n    enforcedLimits: {\n      maxModelCalls: number\n      maxInputTokens: number\n      maxOutputTokens: number\n      maxCostUsd: number\n    }\n    network: AgentCandidateModelAccessNetwork\n  },\n  expectedLimits: AgentCandidateExecutionLimits,\n  preparationId: string,\n  expiresAtMs: number,\n): void {\n  if (!/^sha256:[a-f0-9]{64}$/.test(reservation.digest)) {\n    throw new Error('protected model reservation has an invalid identity digest')\n  }\n  if (reservation.preparationId !== preparationId || reservation.expiresAtMs !== expiresAtMs) {\n    throw new Error('protected model reservation is not scoped to this preparation')\n  }\n  const limits = modelLimits(expectedLimits)\n  if (canonicalCandidateDigest(reservation.enforcedLimits) !== canonicalCandidateDigest(limits)) {\n    throw new Error('protected model reservation does not enforce the frozen model limits')\n  }\n  const expectedNetworkMode = limits.maxModelCalls === 0 ? 'disabled' : 'gateway-only'\n  const network = agentCandidateModelAccessNetworkSchema.parse(reservation.network)\n  if (network.mode !== expectedNetworkMode) {\n    throw new Error('protected model reservation has the wrong network policy for its call limit')\n  }\n}\n\nfunction assertEnvironmentDisjoint(\n  publicEnv: Record<string, AgentCandidateConfigValue>,\n  traceEnv: Record<string, string>,\n): void {\n  const seen = new Set(Object.keys(publicEnv))\n  for (const name of Object.keys(traceEnv)) {\n    if (seen.has(name)) throw new Error(`evaluator environment binding collides with ${name}`)\n    seen.add(name)\n  }\n}\n\nfunction modelLimits(limits: AgentCandidateExecutionLimits): {\n  maxModelCalls: number\n  maxInputTokens: number\n  maxOutputTokens: number\n  maxCostUsd: number\n} {\n  return {\n    maxModelCalls: limits.maxModelCalls,\n    maxInputTokens: limits.maxInputTokens,\n    maxOutputTokens: limits.maxOutputTokens,\n    maxCostUsd: limits.maxCostUsd,\n  }\n}\n\nfunction exactProfileExecutorFiles(\n  sourceFiles: ReadonlyArray<{ relPath: string; content: string; mode?: number }>,\n  expectedFiles: ReadonlyArray<{ relPath: string; mode: number; contentSha256: string }>,\n): Array<{ path: string; mode: number; bytes: Uint8Array }> {\n  const byPath = new Map(sourceFiles.map((file) => [file.relPath, file]))\n  if (byPath.size !== sourceFiles.length || sourceFiles.length !== expectedFiles.length) {\n    throw new Error('profile source files do not match the signed profile plan')\n  }\n  return expectedFiles.map((expected) => {\n    const source = byPath.get(expected.relPath)\n    const mode = source?.mode ?? 0o644\n    const bytes = Buffer.from(source?.content ?? '', 'utf8')\n    if (\n      !source ||\n      !Number.isInteger(mode) ||\n      mode < 0 ||\n      mode > 0o777 ||\n      mode !== expected.mode ||\n      sha256Bytes(bytes) !== expected.contentSha256\n    ) {\n      throw new Error('profile source files do not match the signed profile plan')\n    }\n    return { path: expected.relPath, mode, bytes: Uint8Array.from(bytes) }\n  })\n}\nfunction isWellFormedUnicode(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1)\n      if (!(next >= 0xdc00 && next <= 0xdfff)) return false\n      index++\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      return false\n    }\n  }\n  return true\n}\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error)\n}\n"],"mappings":";;;;;;;;;;;;;AAOA,SAAgB,YAAY,OAAiC;CAC3D,OAAO,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAClE;AAEA,SAAgB,wBAAwB,OAA4B;CAClE,OAAO,OAAO,KAAK,cAAc,KAAK,GAAG,MAAM;AACjD;AAEA,SAAgBA,2BAAyB,OAA8B;CACrE,OAAO,eAAe,KAAK;AAC7B;;AAGA,SAAgB,wBAA2B,OAAa;CACtD,OAAO,oBACL,KAAK,MAAM,OAAO,KAAK,wBAAwB,KAAK,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,CACzE;AACF;AAEA,SAAgB,2BACd,oBAC+B;CAC/B,MAAM,QAAQ,wBAAwB,kBAAkB;CACxD,MAAM,SAASA,2BAAyB,kBAAkB;CAC1D,IAAI,YAAY,KAAK,MAAM,QACzB,MAAM,IAAI,MAAM,6DAA6D;CAE/E,MAAM,cAAc,WAAW,KAAK,KAAK;CACzC,MAAM,QAAQ,wBAAwB;EAAE,GAAG;EAAoB;CAAO,CAAC;CACvE,OAAO,OAAO,OAAO;EACnB;EACA,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,WAAW;EACpC;EACA;CACF,CAAC;AACH;AAEA,SAAgB,iCACd,OACA,OACG;CACH,IAAIA,2BAAyB,mBAAmB,KAAK,CAAC,MAAM,MAAM,QAChE,MAAM,IAAI,MAAM,GAAG,MAAM,uBAAuB;CAElD,OAAO,wBAAwB,KAAK;AACtC;AAEA,SAAgB,0BAA0B,OAAmD;CAC3F,OAAO;EACL,UAAU;EACV,SAAS,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;EAC7C,QAAQ,YAAY,KAAK;EACzB,YAAY,MAAM;CACpB;AACF;AAEA,SAAgB,mBACd,OACmB;CACnB,MAAM,EAAE,QAAQ,SAAS,GAAG,SAAS;CACrC,OAAO;AACT;AAEA,SAAgB,oBAAuB,OAAU,uBAAO,IAAI,IAAY,GAAM;CAC5E,IACE,UAAU,QACV,OAAO,UAAU,YACjB,YAAY,OAAO,KAAK,KACxB,KAAK,IAAI,KAAe,GAExB,OAAO;CAET,KAAK,IAAI,KAAe;CACxB,KAAK,MAAM,SAAS,OAAO,OAAO,KAAgC,GAChE,oBAAoB,OAAO,IAAI;CAEjC,OAAO,OAAO,OAAO,KAAK;AAC5B;;;AC1EA,MAAM,qBAAqB;AAC3B,MAAM,4BAA4B;AA8BlC,MAAM,sBAAsB,CAAC,mBAAmB,sBAAsB;AACtE,MAAM,6BAA6B,CACjC,0BACA,6BACF;AAEA,SAAS,wBAAwB,QAAoC;CACnE,OAAO,OAAO,MAAM,UAClB,oBAAoB,MAAM,SAAS,UAAU,QAAQ,MAAM,WAAW,GAAG,KAAK,EAAE,CAAC,CACnF;AACF;AAEA,SAAS,8BAA8B,QAAoC;CACzE,OAAO,OAAO,MAAM,UAClB,2BAA2B,MAAM,SAAS,UAAU,QAAQ,MAAM,WAAW,GAAG,KAAK,EAAE,CAAC,CAC1F;AACF;;AAGA,MAAM,yBAAyB,CAAC,2BAA2B,wBAAwB;AAEnF,SAAS,gCAAgC,QAAoC;CAC3E,KAAK,IAAI,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;EAClD,MAAM,QAAQ,OAAO;EACrB,MAAM,SACJ,UAAU,QAAQ,UAAU,aACxB,OAAO,QAAQ,KACf,MAAM,WAAW,WAAW,IAC1B,MAAM,MAAM,CAAkB,IAC9B,KAAA;EACR,IACE,WAAW,KAAA,KACX,uBAAuB,MAAM,QAAQ,OAAO,UAAU,CAAC,CAAC,WAAW,GAAG,IAAI,EAAE,CAAC,GAE7E,OAAO;CAEX;CACA,OAAO;AACT;AAEA,MAAM,yBAAyB;CAC7B,eAAe;EACb,YAAY;EACZ,UAAU,MAAM,cAAc,SAC5B,YACE,cAAc,MAAM,oBAAoB,YAAY,GACpD,wBACA,IACF;EACF,gBAAgB,MAAM,oBAAoB,SACxC,YACE,cAAc,MAAM,2BAA2B,kBAAkB,GACjE,+BACA,IACF;EACF,mBAAmB;EACnB,yBAAyB;CAC3B;;CAEA,UAAU;EACR,YAAY;EACZ,UAAU,SAAS;EACnB,8BAA8B;EAC9B,oBAAoB,WAClB,OAAO,MAAM,UAAU,UAAU,aAAa,MAAM,WAAW,UAAU,CAAC;EAC5E,yBAAyB;CAC3B;CACA,IAAI;EACF,YAAY;EACZ,UAAU,MAAM,cAAc,SAC5B,YAAY,cAAc,MAAM,oBAAoB,YAAY,GAAG,mBAAmB,IAAI;EAC5F,gBAAgB,MAAM,oBAAoB,SACxC,YACE,cAAc,MAAM,2BAA2B,kBAAkB,GACjE,0BACA,IACF;EACF,mBAAmB;EACnB,yBAAyB;CAC3B;CACA,OAAO;EACL,YAAY;EACZ,UAAU,MAAM,cAAc,SAC5B,YAAY,cAAc,MAAM,oBAAoB,YAAY,GAAG,mBAAmB,IAAI;EAC5F,gBAAgB,MAAM,oBAAoB,SACxC,YACE,cAAc,MAAM,2BAA2B,kBAAkB,GACjE,0BACA,IACF;EACF,mBAAmB;EACnB,yBAAyB;CAC3B;;CAEA,QAAQ;EACN,YAAY;EACZ,UAAU,SAAS;EACnB,mBAAmB;EACnB,yBAAyB;CAC3B;AACF;;;;;;AAaA,MAAM,iCAAiC;CACrC,OAAO;EACL,YAAY;EACZ,YAAY,SACV,KAAK,MAAM,MAAM,SAAS,KAAK,YAAY,yBAAyB,KACpE,KAAK,MAAM,MAAM,SAAS,KAAK,UAAU,iDAAiD;EAC5F,mBAAmB;CACrB;CACA,QAAQ;EACN,YAAY;EACZ,YAAY,SACV,KAAK,MAAM,MAAM,SAAS,KAAK,YAAY,mBAAmB,KAC9D,KAAK,IAAI,kBAAkB,UAAU;EACvC,mBAAmB;CACrB;AACF;;AAGA,SAAgB,8BACd,MACA,QACA,sBACA,wBAA4C,KAAK,cAAc,OAC/D,8BAAkD,KAAK,oBAAoB,OAC9C;CAC7B,MAAM,eAAe,KAAK;CAC1B,MAAM,qBAAqB,KAAK;CAChC,MAAM,WAAW,+BACf,KAAK;CAGP,IAAI,iBAAiB,KAAA,KAAa,UAAU,UAAU,IAAI,GAAG;EAC3D,2BAA2B,KAAK,SAAS,SAAS,YAAY,QAAQ,aAAa;EACnF,sBAAsB,KAAK,SAAS,SAAS,mBAAmB,QAAQ,aAAa;EACrF,IAAI,0BAA0B,KAAA,GAAW,OAAO;EAChD,OAAO;CACT;CAEA,IAAI,0BAA0B,KAAA,KAAa,gCAAgC,KAAA,GACzE,OAAO;CAGT,MAAM,aAAa,uBAAuB,KAAK;CAG/C,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,+DAA+D,KAAK,SAAS;CAG/F,MAAM,uBAAuB,0BAA0B,KAAA;CACvD,IAAI,wBAAwB,iBAAiB,KAAA,GAC3C,MAAM,IAAI,MACR,wEAAwE,KAAK,SAC/E;CAEF,IAAI,iBAAiB,KAAA,KAAa,0BAA0B,KAAA,GAC1D,MAAM,IAAI,MACR,wEAAwE,KAAK,SAC/E;CAEF,IAAI,iBAAiB,KAAA,KAAa,aAAa,UAAU,uBACvD,MAAM,IAAI,MAAM,0DAA0D;CAE5E,IACE,uBAAuB,KAAA,KACvB,mBAAmB,UAAU,6BAE7B,MAAM,IAAI,MAAM,iEAAiE;CAGnF,MAAM,SAAS,uBAAuB,gBAAgB;CACtD,2BAA2B,KAAK,SAAS,WAAW,YAAY,QAAQ,MAAM;CAC9E,MAAM,cAAc,OAAO,QAAQ,CAAC,EAAA,CAAG,KAAK,UAAU,MAAM,KAAK;CACjE,IAAI,wBAAwB,WAAW,kBAAkB,UAAU,GACjE,MAAM,IAAI,MACR,GAAG,KAAK,QAAQ,oEAClB;CAEF,IAAI,gCAAgC,KAAA,KAAa,WAAW,wBAAwB,UAAU,GAC5F,MAAM,IAAI,MACR,GAAG,KAAK,QAAQ,2EAClB;CAGF,IAAI,YAAY;CAChB,IAAI,iBAAiB,KAAA,GACnB,YAAY,WAAW,QACrB,WAAW,+BACP,YACA,iBAAiB,WAAW,cAAc,GAC9C,aAAa,OACb,oBACF;CAEF,IAAI,uBAAuB,KAAA,GAAW;EACpC,IAAI,CAAC,WAAW,eACd,MAAM,IAAI,MACR,sEAAsE,KAAK,SAC7E;EAEF,YAAY,WAAW,cACrB,iBAAiB,WAAW,oBAAoB,GAChD,mBAAmB,OACnB,MAAM,KAAK,MAAM,QAAQ,oBAAoB,GAAG,yBAAyB,CAC3E;CACF;CAGA,OAAO;AACT;AAEA,SAAS,2BACP,SACA,oBACA,QACA,QACwE;CACxE,IAAI,OAAO,SAAS,qBAClB,MAAM,IAAI,MAAM,4CAA4C,QAAQ,iBAAiB,QAAQ;CAE/F,IACE,OAAO,eAAe,sBACtB,EACE,MAAM,WAAW,OAAO,UAAU,KAClC,MAAM,SAAS,OAAO,UAAU,MAAM,qBAGxC,MAAM,IAAI,MACR,GAAG,QAAQ,iBAAiB,OAAO,uBAAuB,mBAAmB,YAC/E;AAEJ;AAEA,SAAS,sBACP,SACA,mBACA,QACA,QACM;CACN,IAAI,mBAAmB,OAAO,QAAQ,CAAC,EAAA,CAAG,KAAK,UAAU,MAAM,KAAK,CAAC,GACnE,MAAM,IAAI,MACR,GAAG,QAAQ,wDAAwD,WAAW,gBAAgB,WAAW,gBAAgB,QAC3H;AAEJ;AAEA,SAAS,iBACP,MACA,QAC6B;CAC7B,MAAM,YAAY,EAAE,GAAG,KAAK;CAC5B,OAAO,UAAU;CACjB,OAAO;AACT;AAEA,SAAS,YACP,MACA,GAAG,QAC0B;CAC7B,OAAO;EACL,GAAG;EACH,OAAO,CAAC,GAAG,KAAK,OAAO,GAAG,OAAO,IAAIC,aAAW,CAAC;CACnD;AACF;AAEA,SAASA,cAAY,OAA0C;CAC7D,OAAO;EAAE,MAAM;EAAU;CAAM;AACjC;AAEA,SAAS,cACP,MACA,SACA,QAC6B;CAG7B,IAAI,KAAK,MAAM,MAAM,SAAS,KAAK,YAAY,OAAO,GACpD,MAAM,IAAI,MAAM,6CAA6C,SAAS;CAExE,OAAO;EACL,GAAG;EACH,OAAO,CACL,GAAG,KAAK,OACR;GACE;GACA,SAAS;GACT,QAAQ;EACV,CACF;CACF;AACF;;;AC7SA,SAAgB,6BAA6B,SAAiC;CAC5E,IAAI,CAAC,sBAAsB,OAAO,GAChC,MAAM,IAAI,MACR,uEAAuE,SACzE;CAEF,OAAO;AACT;;AAGA,MAAa,uCAAuC,CAAC,cAAc;;AAenE,SAAgB,qCACd,SAC6B;CAC7B,MAAM,OACJ,QAAQ,cAAc,SAAS,QAAQ,WAAW,WAAW,QAAQ,WAAW;CAClF,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,kEAAkE;CAS7F,OAAO,8BARM,4BACX,QAAQ,SACR,6BAA6B,QAAQ,OAAO,GAC5C;EACE,OAAO;EACP,mBAAmB,QAAQ;CAC7B,CAGG,GACH,QAAQ,QACR,MAAM,KAAK,MAAM,0BAA0B,GAC3C,QAAQ,QAAQ,QAAQ,cACxB,QAAQ,QAAQ,QAAQ,kBAC1B;AACF;;AAGA,SAAgB,sCACd,MACA,aACiC;CACjC,MAAM,eAAe,IAAI,IAAI,KAAK,MAAM,KAAK,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC;CAC3E,IAAI,aAAa,SAAS,KAAK,MAAM,QACnC,MAAM,IAAI,MAAM,mEAAmE;CAErF,MAAM,QAAQ,YAAY,SAAS,MAAM,KAAK,aAAa;EACzD,MAAM,SAAS,aAAa,IAAI,SAAS,OAAO;EAChD,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,2CAA2C,SAAS,SAAS;EAE/E,MAAM,OAAO,OAAO,QAAQ;EAC5B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO,KACpD,MAAM,IAAI,MAAM,qDAAqD,SAAS,SAAS;EAEzF,OAAO;GAAE,MAAM,SAAS;GAAS;GAAM,SAAS,OAAO;EAAQ;CACjE,CAAC;CACD,IAAI,MAAM,WAAW,KAAK,MAAM,QAC9B,MAAM,IAAI,MAAM,8DAA8D;CAEhF,OAAO,qCACL,2BAA4D;EAC1D,MAAM;EACN;EACA;CACF,CAAC,CAAC,CAAC,OACH,YAAY,MACd;AACF;;AAGA,SAAgB,qCACd,OACA,2BACiC;CACjC,MAAM,aAAa,sCAAsC,MAAM,KAAK;CACpE,MAAM,YAAY,wBAAwB,WAAW,YAAY,QAAQ;CACzE,MAAM,sBAAsB,WAAW,YAAY;CACnD,IACE,YAAY,SAAS,MAAM,WAAW,YAAY,UAClD,oBAAoB,WAAW,WAAW,YAAY,UACtD,oBAAoB,eAAe,UAAU,cAC5C,aAAa,uBACZ,CAAC,OAAO,KAAK,oBAAoB,SAAS,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,SAAS,CAAC,KAClF,8BAA8B,KAAA,KAC7B,WAAW,YAAY,WAAW,2BAEpC,MAAM,IAAI,MAAM,oEAAoE;CAEtF,IAAIC,2BAAyB,mBAAmB,UAAU,CAAC,MAAM,WAAW,QAC1E,MAAM,IAAI,MAAM,oDAAoD;CAEtE,OAAO,wBAAwB,UAAU;AAC3C;AAEA,MAAM,kCAAkC;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,SAAgB,mCAAmC,OAA4C;CAE7F,OAAO,mCADS,uBAAuB,OAAO,SACE,CAAC;AACnD;;;;;;AAOA,SAAS,mCAAmC,SAA8C;CACxF,IAAI,QAAQ,gBAAgB,KAAA,GAAW,wBAAwB,aAAa;CAC5E,IAAI,QAAQ,aAAa,KAAA,GAAW,wBAAwB,UAAU;CACtE,IAAI,QAAQ,eAAe,KAAA,GAAW,wBAAwB,YAAY;CAC1E,IAAI,QAAQ,OAAO,aAAa,KAAA,GAAW,wBAAwB,gBAAgB;CAEnF,MAAM,YAAqC,CAAC;CAC5C,wBAAwB,WAAW,OAAkC;CACrE,IAAI,QAAQ,OAAO;EACjB,MAAM,EAAE,UAAU,WAAW,GAAG,UAAU,QAAQ;EAClD,UAAU,QAAQ;CACpB;CACA,IAAI,QAAQ,KAAK,UAAU,MAAM,iBAAiB,QAAQ,GAAG;CAC7D,IAAI,QAAQ,WACV,UAAU,YAAY,OAAO,YAC3B,OAAO,QAAQ,QAAQ,SAAS,CAAC,CAAC,KAAK,CAAC,MAAM,cAAc;EAC1D,IAAI,SAAS,aAAa,KAAA,GAAW,wBAAwB,aAAa,KAAK,UAAU;EACzF,MAAM,EAAE,UAAU,WAAW,GAAG,UAAU;EAC1C,OAAO,CAAC,MAAM,KAAK;CACrB,CAAC,CACH;CAEF,IAAI,QAAQ,WAAW,UAAU,YAAY,gBAAgB,QAAQ,SAAS;CAC9E,IAAI,QAAQ,SAAS,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,MAAM,aAAa,SAAS,SAAS,CAAC,GACtF,MAAM,IAAI,MACR,4GACF;CAEF,IAAI,QAAQ,OAAO,UAAU,QAAQ,QAAQ;CAC7C,IAAI,QAAQ,OACV,UAAU,QAAQ,OAAO,YACvB,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,UAAU;EAClD,IAAI,KAAK,aAAa,KAAA,GAAW,wBAAwB,SAAS,KAAK,UAAU;EACjF,MAAM,EAAE,UAAU,WAAW,GAAG,UAAU;EAC1C,OAAO,CAAC,MAAM,KAAK;CACrB,CAAC,CACH;CAGF,OADe,2BAA2B,SAC9B;AACd;;AAGA,SAAgB,8BACd,eACA,SACM;CAGN,IAAIA,2BADa,mCADA,uBAAuB,eAAe,wBACI,CACvB,CAAC,MAAMA,2BAAyB,OAAO,GACzE,MAAM,IAAI,MAAM,gEAAgE;AAEpF;;AAGA,SAAgB,uBAAuB,OAAgB,OAA6B;CAClF,IAAI;CACJ,IAAI;EACF,SAAS,mBAAmB,MAAM,KAAK;CACzC,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,GAAG,MAAM,gDAAgD,EAAE,MAAM,CAAC;CACpF;CACA,qBAAqB,OAAO,QAAQ,KAAK;CACzC,OAAO;AACT;;AAGA,SAAgB,2BAA2B,OAAgB,OAAiC;CAC1F,IAAI;CACJ,IAAI;EACF,SAAS,uBAAuB,MAAM,KAAK;CAC7C,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,GAAG,MAAM,gDAAgD,EAAE,MAAM,CAAC;CACpF;CACA,qBAAqB,OAAO,QAAQ,KAAK;CACzC,OAAO;AACT;;AAGA,SAAgB,2BACd,WACA,WACA,OACc;CAId,OAAO,uBADS,0BAA0B,sBAF7B,uBAAuB,WAAW,GAAG,MAAM,cAEW,GADtD,2BAA2B,WAAW,GAAG,MAAM,MACa,CAAC,GAAG,KACzC,GAAG,GAAG,MAAM,QAAQ;AAC1D;;AAGA,SAAgB,2BAA2B,OAAuC;CAChF,MAAM,SAAS,4BAA4B,MAAM,KAAK;CACtD,qBAAqB,OAAO,QAAQ,mBAAmB;CACvD,OAAO;AACT;;AAGA,SAAgB,uCAAuC,SAAsC;CAE3F,MAAM,cAAc;EADJ;EAAS;EAAe;EAAS;CACxB,CAAC,CAAC,QAAQ,UAAU,WAAW,QAAQ,MAAM,CAAC;CACvE,IAAI,YAAY,SAAS,GACvB,MAAM,IAAI,MACR,0FAA0F,YAAY,KAAK,IAAI,GACjH;AAEJ;;AAGA,SAAgB,oCACd,WACc;CACd,MAAM,SAAkC,CAAC;CACzC,wBAAwB,QAAQ,SAA+C;CAC/E,IAAI,UAAU,OAAO,OAAO,QAAQ,EAAE,GAAG,UAAU,MAAM;CACzD,IAAI,UAAU,KACZ,OAAO,MAAM,OAAO,YAClB,OAAO,QAAQ,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CACpD,MACA;EACE,GAAG;EAKH,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,KAAK,WAAW,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,CAAC;EAC1E,GAAI,OAAO,MAAM,EAAE,KAAK,YAAY,OAAO,GAAG,EAAE,IAAI,CAAC;CACvD,CACF,CAAC,CACH;CAEF,IAAI,UAAU,WAAW,OAAO,YAAY,YAAY,UAAU,SAAS;CAC3E,IAAI,UAAU,OAAO,OAAO,QAAQ,YAAY,UAAU,KAAK;CAC/D,IAAI,UAAU,OACZ,OAAO,QAAQ,OAAO,YACpB,OAAO,QAAQ,UAAU,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CACtD,OACA,MAAM,KAAK,EAAE,YAAY,MAAM,KAAK,GAAG,YAAY;EACjD,GAAG;EACH,SAAS,CAAC,YAAY,IAAI,QAAQ,CAAC,EAAA,CAAG,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,KAAK,GAAG;EAGhF,GAAI,MAAM,EAAE,KAAK,YAAY,GAAG,EAAE,IAAI,CAAC;CACzC,EAAE,CACJ,CAAC,CACH;CAEF,IAAI,UAAU,WAAW;EACvB,IAAI,UAAU,UAAU,gBAAgB,MACtC,MAAM,IAAI,MAAM,0EAA0E;EAE5F,OAAO,YAAY;GACjB,aAAa;GACb,GAAI,UAAU,UAAU,QACpB,EACE,OAAO,UAAU,UAAU,MAAM,KAAK,UAAU;IAC9C,GAAG;IACH,UAAU,eAAe,KAAK,QAAQ;GACxC,EAAE,EACJ,IACA,CAAC;GACL,GAAI,UAAU,UAAU,QACpB,EAAE,OAAO,UAAU,UAAU,MAAM,IAAI,cAAc,EAAE,IACvD,CAAC;GACL,GAAI,UAAU,UAAU,SACpB,EAAE,QAAQ,UAAU,UAAU,OAAO,IAAI,cAAc,EAAE,IACzD,CAAC;GACL,GAAI,UAAU,UAAU,SACpB,EAAE,QAAQ,UAAU,UAAU,OAAO,IAAI,cAAc,EAAE,IACzD,CAAC;GACL,GAAI,UAAU,UAAU,WACpB,EAAE,UAAU,UAAU,UAAU,SAAS,IAAI,cAAc,EAAE,IAC7D,CAAC;GACL,GAAI,UAAU,UAAU,iBAAiB,KAAA,IACrC,EACE,cACE,OAAO,UAAU,UAAU,iBAAiB,WACxC,UAAU,UAAU,eACpB,eAAe,UAAU,UAAU,YAAY,EACvD,IACA,CAAC;EACP;CACF;CACA,OAAO;AACT;;AAGA,SAAgB,0BAA0B,OAAgB,MAAuB;CAC/E,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,OAAO,UAAU;EACjC,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,GAAG,KAAK,wCAAwC,OAAO;EAEzE,OAAO,0BAA0B,OAAO,GAAG,KAAK,GAAG,MAAM,EAAE;CAC7D,CAAC;CAEH,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAgC,CAAC,CAC7C,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAAC,CAC1C,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,0BAA0B,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CACpF;AACF;AAEA,SAAS,iBAAiB,SAAyE;CACjG,OAAO,OAAO,YACZ,OAAO,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY;EAC9C,IAAI,OAAO,cAAc,KAAA,KAAa,OAAO,cAAc,SACzD,wBAAwB,OAAO,KAAK,aAAa,OAAO,WAAW;EAErE,IAAI,OAAO,QAAQ,KAAA,GAAW,wBAAwB,OAAO,KAAK,KAAK;EACvE,IAAI,OAAO,YAAY,KAAA,GAAW,wBAAwB,OAAO,KAAK,SAAS;EAC/E,IAAI,OAAO,aAAa,KAAA,GAAW,wBAAwB,OAAO,KAAK,UAAU;EACjF,OAAO,CACL,MACA;GACE,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;GAC1D,GAAI,OAAO,UAAU,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC;GACpD,GAAI,OAAO,OACP,EACE,MAAM,OAAO,KAAK,KAAK,OAAO,UAC5B,qBAAqB,OAAO,OAAO,KAAK,QAAQ,MAAM,EAAE,CAC1D,EACF,IACA,CAAC;GACL,GAAI,OAAO,MAAM,EAAE,KAAK,yBAAyB,OAAO,KAAK,OAAO,KAAK,KAAK,EAAE,IAAI,CAAC;GACrF,GAAI,OAAO,MAAM,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC;GACxC,GAAI,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;EACpE,CACF;CACF,CAAC,CACH;AACF;AAEA,SAAS,gBAAgB,WAA4D;CACnF,IAAI,UAAU,gBAAgB,MAC5B,MAAM,IAAI,MAAM,uDAAuD;CAEzE,OAAO;EACL,aAAa;EACb,GAAI,UAAU,QACV,EACE,OAAO,UAAU,MAAM,KAAK,UAAU;GACpC,GAAG;GACH,UAAU,eAAe,KAAK,QAAQ;EACxC,EAAE,EACJ,IACA,CAAC;EACL,GAAI,UAAU,QAAQ,EAAE,OAAO,UAAU,MAAM,IAAI,cAAc,EAAE,IAAI,CAAC;EACxE,GAAI,UAAU,SAAS,EAAE,QAAQ,UAAU,OAAO,IAAI,cAAc,EAAE,IAAI,CAAC;EAC3E,GAAI,UAAU,SAAS,EAAE,QAAQ,UAAU,OAAO,IAAI,cAAc,EAAE,IAAI,CAAC;EAC3E,GAAI,UAAU,WAAW,EAAE,UAAU,UAAU,SAAS,IAAI,cAAc,EAAE,IAAI,CAAC;EACjF,GAAI,UAAU,iBAAiB,KAAA,IAC3B,CAAC,IACD,EACE,cACE,OAAO,UAAU,iBAAiB,WAC9B,UAAU,eACV,eAAe,UAAU,YAAY,EAC7C;CACN;AACF;AAEA,SAAS,eAAe,UAA8D;CACpF,IAAI,SAAS,SAAS,UACpB,MAAM,IAAI,MACR,2IACF;CAEF,MAAM,QAAQ,OAAO,KAAK,SAAS,SAAS,MAAM;CAClD,OAAO;EACL,GAAG;EACH,QAAQ,0BAA0B,KAAK,CAAC,CAAC;EACzC,YAAY,MAAM;CACpB;AACF;AAEA,SAAS,wBACP,QACA,QACM;CACN,KAAK,MAAM,OAAO,iCAChB,IAAI,OAAO,SAAS,KAAA,GAAW,OAAO,OAAO,OAAO;AAExD;AAEA,SAAS,qBAAqB,OAAgB,QAAiB,OAAqB;CAClF,IAAI,CAAC,OAAO,KAAK,wBAAwB,KAAK,CAAC,CAAC,CAAC,OAAO,wBAAwB,MAAM,CAAC,GACrF,MAAM,IAAI,MAAM,GAAG,MAAM,8CAA8C;AAE3E;AAEA,SAAS,eAAe,UAA8C;CACpE,IAAI,SAAS,SAAS,UACpB,OAAO;EAAE,MAAM;EAAU,MAAM,SAAS;EAAM,SAAS,SAAS;CAAQ;CAE1E,OAAO;EACL,MAAM;EACN,YAAY,GAAG,SAAS,WAAW,MAAM,GAAG,SAAS,WAAW;EAChE,MAAM,SAAS;EACf,KAAK,SAAS;EACd,GAAI,SAAS,OAAO,EAAE,MAAM,SAAS,KAAK,IAAI,CAAC;CACjD;AACF;;;;AAKA,SAAS,qBACP,OACA,MACmC;CACnC,IAAI,MAAM,SAAS,UAAU,wBAAwB,GAAG,KAAK,gBAAgB,MAAM,IAAI,GAAG;CAC1F,OAAO;EAAE,MAAM;EAAU,OAAO,MAAM;CAAM;AAC9C;AAEA,SAAS,yBACP,QACA,YACmD;CACnD,OAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CAC5C,MACA,qBAAqB,OAAO,GAAG,WAAW,GAAG,MAAM,CACrD,CAAC,CACH;AACF;AAEA,SAAS,YAAY,OAA0C;CAC7D,OAAO,MAAM;AACf;AAEA,SAAS,YAAe,QAA8C;CACpE,OAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,CAClE;AACF;AAEA,SAAS,WAAW,OAAyB;CAC3C,OAAO,UAAU,KAAA,KAAa,UAAU,QAAQ,OAAO,UAAU,WAC7D,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,IAC5B;AACN;AAEA,SAAS,WAAW,OAAuB;CACzC,OAAO,2BAA2B,KAAK,KAAK,IAAI,QAAQ,IAAI,MAAM,WAAW,KAAK,OAAO,EAAE;AAC7F;AAEA,SAAS,wBAAwB,MAAqB;CACpD,MAAM,IAAI,MACR,8BAA8B,KAAK,oDACrC;AACF;;;;AC5gBA,SAAgB,sBACd,OACA,UACA,OACA,WAA8B,CAAC,GACzB;CACN,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CAE9C,MAAM,0BAAU,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,QAAQ,CAAC;CAClD,IAAI,QAAQ,SAAS,SAAS,SAAS,SAAS,QAC9C,MAAM,IAAI,MAAM,GAAG,MAAM,8CAA8C;CAEzE,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GACjC,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B,KAAK;CAEjF,KAAK,MAAM,OAAO,UAChB,IAAI,EAAE,OAAO,QAAQ,MAAM,IAAI,MAAM,GAAG,MAAM,oBAAoB,KAAK;AAE3E;;;ACLA,SAAgB,iCACd,OACA,qBACmC;CACnC,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,4DAA4D;CAE9E,MAAM,SAAS;CACf,sBACE,QACA,CAAC,iBAAiB,wBAAwB,GAC1C,0CACF;CACA,MAAM,gBAAgB,wBACpB,gCAAgC,MAAM,OAAO,aAAa,CAC5D;CACA,MAAM,yBAAyB,wBAC7B,gCAAgC,MAAM,OAAO,sBAAsB,CACrE;CACA,IAAI,cAAc,WAAW,qBAC3B,MAAM,IAAI,MAAM,mEAAmE;CAErF,OAAO,OAAO,OAAO;EAAE;EAAe;CAAuB,CAAC;AAChE;;;ACjBA,MAAMC,mBAAiB;AAEvB,SAAgB,eACd,OACA,QACuC;CACvC,MAAM,WAAW,mBAAmB,MAAM;CAC1C,MAAM,QAAQ;EACZ,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,cAAc,MAAM;EACpB,qBAAqB,MAAM;EAC3B,qBAAqB,MAAM;EAC3B,GAAG;CACL;CACA,OAAO,wBAAwB;EAC7B,GAAG;EACH,gBAAgBC,2BAAyB,KAAK;CAChD,CAAC;AACH;AAEA,SAAgB,wBACd,OACA,OACA,UACuC;CACvC,MAAM,YAAY,qBAAqB,UAAU,KAAK;CACtD,OAAO,eAAe,OAAO;EAC3B,QAAQ;EACR,cACE,UAAU,iBAAiB,8BAA8B,UAAU,YAC/D,YACA,UAAU;EAChB,OAAO,UAAU;EACjB,iBAAiB,UAAU;EAC3B,GAAI,UAAU,kBAAkB,EAAE,iBAAiB,UAAU,gBAAgB,IAAI,CAAC;CACpF,CAAC;AACH;AAEA,SAAgB,6BACd,OACA,UACM;CACN,IACE,UAAU,uBACV,SAAS,WAAW,YACpB,SAAS,iBAAiB,4BAE1B,MAAM,IAAI,MAAM,wEAAwE;CAE1F,IACE,UAAU,cACT,SAAS,WAAW,eAClB,SAAS,WAAW,aAClB,SAAS,iBAAiB,eACzB,SAAS,iBAAiB,+BAEhC,MAAM,IAAI,MAAM,+DAA+D;AAEnF;AAEA,SAAgB,eACd,UACA,yBACqC;CACrC,OAAO,OAAO,OAAO;EACnB,UAAU;EACV,UAAU;EACV,aAAa,SAAS,mBAAmB;CAC3C,CAAC;AACH;AAEA,SAAgB,cACd,UACA,WACoC;CACpC,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR,UAAU;EACV,aAAa,SAAS,mBAAmB,UAAU;CACrD,CAAC;AACH;AAEA,SAAgB,sBACd,QACA,gBACuC;CACvC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,kDAAkD;CAC/E,IAAI,OAAO,mBAAmB,gBAC5B,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO;AACT;AAEA,SAAgB,mBAAmB,OAAmC;CACpE,qBAAmB,OAAO,gBAAgB;CAC1C,OAAO;AACT;AAEA,SAAgB,4BACd,QACA,WACM;CACN,IACEA,2BAAyB,OAAO,KAAK,MAAMA,2BAAyB,UAAU,KAAK,KACnFA,2BAAyB,OAAO,eAAe,MAC7CA,2BAAyB,UAAU,eAAe,GAEpD,MAAM,IAAI,MAAM,4EAA4E;AAEhG;AAEA,SAAgB,wBACd,OACA,OACuC;CACvC,MAAM,SAAS,sBAAsB,MAAM,QAAQ,KAAK;CACxD,sBACE,OACA,WAAW,cACP;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,IACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,GAAI,MAAM,kBAAkB,CAAC,iBAAiB,IAAI,CAAC;CACrD,GACJ,KACF;CACA,MAAM,sBAAsBC,gBAC1B,MAAM,qBACN,OACA,qBACF;CACA,MAAM,WAAW;EACf,aAAaA,gBAAc,MAAM,aAAa,OAAO,aAAa;EAClE,SAASC,gBAAc,MAAM,SAAS,OAAO,SAAS;EACtD,cAAcD,gBAAc,MAAM,cAAc,OAAO,cAAc;EACrE;EACA,qBAAqB,iCACnB,MAAM,qBACN,mBACF;CACF;CACA,oBAAkB,SAAS,WAAW;CACtC,IAAI,CAAC,OAAO,cAAc,SAAS,OAAO,KAAK,SAAS,UAAU,GAChE,MAAM,IAAI,MAAM,GAAG,MAAM,qBAAqB;CAEhD,qBAAmB,SAAS,cAAc,cAAc;CACxD,qBAAmB,SAAS,qBAAqB,qBAAqB;CACtE,IAAI,SAAS,oBAAoB,cAAc,WAAW,SAAS,qBACjE,MAAM,IAAI,MAAM,GAAG,MAAM,4DAA4D;CAEvF,MAAM,SAAS,mBACb,WAAW,cACP;EACE;EACA,OAAOE,gBAAc,MAAM,OAAO,OAAO,OAAO;EAChD,iBAAiB,mBAAmB,MAAM,iBAAiB,OAAO,iBAAiB;EACnF,aAAa,mBAAmB,MAAM,aAAa,OAAO,aAAa;EACvE,iBAAiB,mBAAmB,MAAM,iBAAiB,OAAO,iBAAiB;EACnF,YAAY,mBAAmB,MAAM,YAAY,OAAO,YAAY;CACtE,IACA;EACE;EACA,cAAc,oBAAoB,MAAM,cAAc,KAAK;EAC3D,OAAOA,gBAAc,MAAM,OAAO,OAAO,OAAO;EAChD,iBAAiB,mBAAmB,MAAM,iBAAiB,OAAO,iBAAiB;EACnF,GAAI,MAAM,kBACN,EACE,iBAAiB,mBACf,MAAM,iBACN,OACA,iBACF,EACF,IACA,CAAC;CACP,CACN;CACA,MAAM,WAAW;EAAE,GAAG;EAAU,GAAG;CAAO;CAC1C,MAAM,iBAAiBF,gBACrB,MAAM,gBACN,OACA,gBACF;CACA,qBAAmB,gBAAgB,gBAAgB;CACnD,IAAI,mBAAmBD,2BAAyB,QAAQ,GACtD,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CAEvD,OAAO,wBAAwB;EAC7B,GAAG;EACH;CACF,CAAC;AACH;AAEA,SAAgB,2BACd,UACA,OACA,MACM;CACN,IACE,SAAS,gBAAgB,MAAM,eAC/B,SAAS,YAAY,MAAM,WAC3B,SAAS,iBAAiB,MAAM,gBAChC,SAAS,wBAAwB,MAAM,uBACvCA,2BAAyB,SAAS,mBAAmB,MACnDA,2BAAyB,MAAM,mBAAmB,GAEpD,MAAM,IAAI,MAAM,0CAA0C,KAAK,0BAA0B;AAE7F;AAEA,SAAgB,4BACd,UACA,QACA,MACM;CACN,IACE,SAAS,mBAAmB,OAAO,kBACnCA,2BAAyB,QAAQ,MAAMA,2BAAyB,MAAM,GAEtE,MAAM,IAAI,MAAM,0CAA0C,KAAK,4BAA4B;AAE/F;AAEA,SAAS,qBACP,UACA,OACyC;CACzC,sBACE,UACA;EACE;EACA;EACA;EACA;EACA;EACA,GAAI,SAAS,kBAAkB,CAAC,iBAAiB,IAAI,CAAC;EACtD,GAAI,SAAS,SAAS,CAAC,QAAQ,IAAI,CAAC;CACtC,GACA,uCACF;CACA,mBAAmB,SAAS,YAAY;CACxC,MAAM,QAAQ,UAAU,SAAS,KAAK;CACtC,IAAI,SAAS,iBAAiB,8BAA8B,MAAM,eAAe,GAC/E,MAAM,IAAI,MAAM,6DAA6D;CAE/E,MAAM,kBAAkB,gBAAgB,SAAS,iBAAiB,iBAAiB;CACnF,MAAM,kBAAkB,SAAS,kBAC7B,gBAAgB,SAAS,iBAAiB,iBAAiB,IAC3D,KAAA;CACJ,sBACE,SAAS,SACT,CAAC,WAAW,qBAAqB,GACjC,8CACF;CACA,IACE,SAAS,QAAQ,YAAY,QAC7B,SAAS,QAAQ,wBAAwB,MAAM,qBAE/C,MAAM,IAAI,MAAM,yEAAyE;CAE3F,sBACE,SAAS,OACT;EAAC;EAAU;EAAiB;CAAa,GACzC,4CACF;CACA,IACE,SAAS,MAAM,WAAW,QAC1B,SAAS,MAAM,kBAAkB,MAAM,QAAQ,iBAC/C,SAAS,MAAM,gBAAgB,MAAM,QAAQ,kBAE7C,MAAM,IAAI,MAAM,4EAA4E;CAE9F,IAAI,MAAM,QAAQ,QAAQ;EACxB,IAAI,CAAC,SAAS,QACZ,MAAM,IAAI,MAAM,iEAAiE;EAEnF,sBACE,SAAS,QACT;GAAC;GAAU;GAAiB;GAAgB;EAAoB,GAChE,6CACF;EACA,IACE,SAAS,OAAO,WAAW,QAC3B,SAAS,OAAO,kBAAkB,MAAM,QAAQ,iBAChD,SAAS,OAAO,iBAAiB,MAAM,QAAQ,OAAO,gBACtD,SAAS,OAAO,uBAAuB,MAAM,QAAQ,OAAO,oBAE5D,MAAM,IAAI,MACR,8EACF;CAEJ,OAAO,IAAI,SAAS,WAAW,KAAA,GAC7B,MAAM,IAAI,MAAM,qEAAqE;CAEvF,OAAO,OAAO,OAAO;EACnB,cAAc,SAAS;EACvB;EACA;EACA,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;EAC7C,SAAS,OAAO,OAAO,EAAE,GAAG,SAAS,QAAQ,CAAC;EAC9C,OAAO,OAAO,OAAO,EAAE,GAAG,SAAS,MAAM,CAAC;EAC1C,GAAI,SAAS,SAAS,EAAE,QAAQ,OAAO,OAAO,EAAE,GAAG,SAAS,OAAO,CAAC,EAAE,IAAI,CAAC;CAC7E,CAAC;AACH;AAEA,SAAS,mBACP,QACuC;CACvC,IAAI,OAAO,WAAW,eAAe,OAAO,WAAW,UACrD,MAAM,IAAI,MAAM,gDAAgD;CAElE,sBACE,QACA,OAAO,WAAW,cACd;EAAC;EAAU;EAAS;EAAmB;EAAe;EAAmB;CAAY,IACrF;EACE;EACA;EACA;EACA;EACA,GAAI,OAAO,kBAAkB,CAAC,iBAAiB,IAAI,CAAC;CACtD,GACJ,qCACF;CACA,MAAM,QAAQ,UAAU,OAAO,KAAK;CACpC,MAAM,kBAAkB,gBAAgB,OAAO,iBAAiB,iBAAiB;CACjF,IAAI,OAAO,WAAW,aACpB,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR;EACA;EACA,aAAa,gBAAgB,OAAO,aAAa,aAAa;EAC9D,iBAAiB,gBAAgB,OAAO,iBAAiB,iBAAiB;EAC1E,YAAY,gBAAgB,OAAO,YAAY,YAAY;CAC7D,CAAC;CAEH,mBAAmB,OAAO,YAAY;CACtC,IAAI,OAAO,iBAAiB,8BAA8B,MAAM,eAAe,GAC7E,MAAM,IAAI,MAAM,6DAA6D;CAE/E,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR,cAAc,OAAO;EACrB;EACA;EACA,GAAI,OAAO,kBACP,EAAE,iBAAiB,gBAAgB,OAAO,iBAAiB,iBAAiB,EAAE,IAC9E,CAAC;CACP,CAAC;AACH;AAEA,SAAS,UAAU,OAA2D;CAC5E,sBACE,OACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;CACF,GACA,oCACF;CACA,KAAK,MAAM,SAAS;EAClB;EACA;EACA;EACA;EACA;EACA;CACF,GACE,cAAY,MAAM,QAAQ,kBAAkB,OAAO;CAErD,IAAI,MAAM,mBAAmB,cAAc,MAAM,mBAAmB,aAClE,MAAM,IAAI,MAAM,6DAA6D;CAE/E,OAAO,OAAO,OAAO;EACnB,cAAc,MAAM;EACpB,aAAa,MAAM;EACnB,cAAc,MAAM;EACpB,mBAAmB,MAAM;EACzB,iBAAiB,MAAM;EACvB,YAAY,MAAM;EAClB,gBAAgB,MAAM;CACxB,CAAC;AACH;AAEA,SAAS,gBAAgB,KAAgC,OAA0C;CACjG,MAAM,SAAS,gCAAgC,MAAM,GAAG;CACxD,IAAI,CAAC,OAAO,cAAc,OAAO,UAAU,GACzC,MAAM,IAAI,MAAM,gCAAgC,MAAM,uCAAuC;CAE/F,OAAO,wBAAwB,MAAM;AACvC;AAEA,SAAS,mBACP,OACA,MACA,OAC2B;CAC3B,OAAOG,gBAAc,OAAO,MAAM,KAAK;AACzC;AAEA,SAASF,gBAAc,OAAgB,MAAc,OAAuB;CAC1E,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,iCAAiC,KAAK,eAAe,OAAO;CAE9E,OAAO;AACT;AAEA,SAASC,gBAAc,OAAgB,MAAc,OAAuB;CAC1E,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,iCAAiC,KAAK,eAAe,OAAO;CAE9E,OAAO;AACT;AAEA,SAASC,gBAAc,OAAgB,MAAc,OAAwC;CAC3F,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,iCAAiC,KAAK,eAAe,OAAO;CAE9E,OAAO;AACT;AAEA,SAAS,sBACP,OACA,MACiD;CACjD,IAAI,UAAU,eAAe,UAAU,UACrC,MAAM,IAAI,MAAM,0CAA0C,KAAK,oBAAoB;CAErF,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAgB,MAAmD;CAC9F,IAAI;EACF,mBAAmB,KAAK;EACxB,OAAO;CACT,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,0CAA0C,KAAK,4BAA4B,EACzF,OAAO,MACT,CAAC;CACH;AACF;AAEA,SAAS,mBAAmB,OAAsE;CAChG,IACE,UAAU,8BACV,UAAU,eACV,UAAU,+BACV,UAAU,WAEV,MAAM,IAAI,MAAM,6CAA6C;AAEjE;AAEA,SAASC,oBAAkB,OAAyC;CAClE,IAAI,OAAO,UAAU,YAAY,CAAC,2BAA2B,KAAK,KAAK,GACrE,MAAM,IAAI,MAAM,kDAAkD;AAEtE;AAEA,SAASC,qBAAmB,OAAe,OAAqB;CAC9D,IAAI,CAACN,iBAAe,KAAK,KAAK,GAC5B,MAAM,IAAI,MAAM,6BAA6B,MAAM,mCAAmC;AAE1F;AAEA,SAASO,cAAY,OAAgB,OAAwC;CAC3E,IAAI,CAAC,OAAO,cAAc,KAAK,KAAM,QAAmB,GACtD,MAAM,IAAI,MAAM,uBAAuB,MAAM,qCAAqC;AAEtF;ACjgBA,SAAgB,wBAAwB,WAAuC;CAC7E,MAAM,YAAY,aAAA;CAClB,IACE,CAAC,OAAO,cAAc,SAAS,KAC/B,aAAa,KACb,YAAA,YAEA,MAAM,IAAI,MAAM,gEAAgE;CAElF,OAAO;AACT;AAEA,SAAgB,yBAAyB,WAAuC;CAC9E,OAAO,KAAK,IAAI,IAAI,wBAAwB,SAAS;AACvD;;AAGA,SAAgB,uBACd,WACA,eACQ;CACR,MAAM,YAAY,aAAa;CAC/B,IACE,CAAC,OAAO,cAAc,SAAS,KAC/B,aAAa,KACb,YAAA,YAEA,MAAM,IAAI,MAAM,+DAA+D;CAEjF,OAAO;AACT;;AAGA,eAAsB,+BACpB,WACA,cACA,OACY;CACZ,OAAO,wBAAwB,WAAW,cAAc,IAAI,6BAA6B,KAAK,CAAC;AACjG;;;;;AAMA,eAAsB,8BACpB,WACA,cACA,OACY;CACZ,OAAO,wBAAwB,WAAW,cAAc,IAAI,4BAA4B,KAAK,CAAC;AAChG;AAEA,eAAe,wBACb,WACA,cACA,cACY;CACZ,MAAM,cAAc,eAAe,KAAK,IAAI;CAC5C,IAAI,eAAe,GAAG,MAAM;CAE5B,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,WAAW,UAAU,WAAW,MAAM,CAAC;CACzE,QAAa,YAAY,KAAA,CAAS;CAClC,IAAI;CACJ,IAAI;EACF,MAAM,SAAS,MAAM,QAAQ,KAAK,CAChC,SACA,IAAI,SAAgB,UAAU,WAAW;GACvC,QAAQ,iBAAiB;IACvB,WAAW,MAAM,YAAY;IAC7B,OAAO,YAAY;GACrB,GAAG,WAAW;EAChB,CAAC,CACH,CAAC;EAED,IAAI,KAAK,IAAI,KAAK,cAAc;GAC9B,WAAW,MAAM,YAAY;GAC7B,MAAM;EACR;EACA,OAAO;CACT,UAAU;EACR,IAAI,OAAO,aAAa,KAAK;CAC/B;AACF;AAEA,IAAa,+BAAb,cAAkD,MAAM;CACtD,YAAY,OAAe;EACzB,MAAM,GAAG,MAAM,wDAAwD;EACvE,KAAK,OAAO;CACd;AACF;AAEA,IAAa,8BAAb,cAAiD,MAAM;CACrD,YAAY,OAAe;EACzB,MAAM,GAAG,MAAM,uDAAuD;EACtE,KAAK,OAAO;CACd;AACF;;;ACpGA,MAAa,2CAA2C;AACxD,MAAM,oCAAoC;;AAG1C,SAAgB,yBACd,kBACA,iBACQ;CACR,MAAM,WACJ,mBAAmB,oCACnB,kBACA;CACF,IAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAA,YACrC,MAAM,IAAI,MAAM,6DAA6D;CAE/E,OAAO;AACT;;AAGA,SAAgB,gCACd,WACA,kBACA,iBACQ;CACR,MAAM,WAAW,YAAY,yBAAyB,kBAAkB,eAAe;CACvF,IAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAA,YACrC,MAAM,IAAI,MAAM,0EAA0E;CAE5F,OAAO;AACT;;AAGA,SAAgB,0BAA0B,kBAAkC;CAC1E,MAAM,WAAW,mBAAmB;CACpC,IAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAA,YACrC,MAAM,IAAI,MAAM,6DAA6D;CAE/E,OAAO;AACT;;;ACzBA,SAAgB,iBAAiB,UAAkD;CACjF,OAAO,GAAG,SAAS,OAAO,GAAG,SAAS;AACxC;AAEA,eAAsB,qBACpB,UACA,MACqB;CACrB,MAAM,QACJ,aAAa,WACT,OAAO,KAAK,SAAS,SAAS,QAAQ,IACtC,MAAM,KAAK,KAAK,QAAqC;CAC3D,YAAY,OAAO,SAAS,QAAQ,SAAS,YAAY,oBAAoB;CAC7E,OAAO,WAAW,KAAK,KAAK;AAC9B;AAEA,SAAgB,YACd,OACA,QACA,YACA,OACM;CACN,IAAI,MAAM,eAAe,YACvB,MAAM,IAAI,MAAM,GAAG,MAAM,eAAe,MAAM,WAAW,kBAAkB,YAAY;CAEzF,MAAM,SAAS,YAAY,KAAK;CAChC,IAAI,WAAW,QACb,MAAM,IAAI,MAAM,GAAG,MAAM,UAAU,OAAO,kBAAkB,QAAQ;AAExE;AAEA,eAAsB,iCACpB,UACA,MACwD;CACxD,MAAM,CAAC,UAAU,WAAW,MAAM,QAAQ,IAAI,CAC5C,qBAAqB,SAAS,UAAU,IAAI,GAC5C,qBAAqB,SAAS,SAAS,IAAI,CAC7C,CAAC;CACD,MAAM,oBAAoB,wBAAwB,SAAS,QAAQ;CACnE,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,iBAAiB,CAAC,GAC9D,MAAM,IAAI,MAAM,0EAA0E;CAE5F,IAAI,YAAY,iBAAiB,MAAM,SAAS,QAC9C,MAAM,IAAI,MAAM,0EAA0E;CAE5F,OAAO;EAAE;EAAU;CAAQ;AAC7B;AAEA,eAAsB,4BACpB,MACA,UACA,UAA8E,CAAC,GAChE;CAEf,yBAAwB,MADD,cAAc,MAAM,IAAI,IAAI,QAAQ,+BAA+B,CAAC,CAAC,CAAC,EAAA,CAC5D,UAAU,QAAQ;AACrD;AAEA,eAAsB,6BACpB,MACA,UAOI,CAAC,GAIJ;CACD,MAAM,WAAW,MAAM,cACrB,MACA,IAAI,IAAI,QAAQ,+BAA+B,CAAC,CAAC,GACjD,QAAQ,MACV;CACA,OAAO;EACL,UAAU,SAAS;EACnB,OAAO,SAAS,MAAM,KAAK,UAAU;GACnC,MAAM,KAAK;GACX,MAAM,KAAK;GACX,OAAO,WAAW,KAAK,KAAK,KAAK;EACnC,EAAE;CACJ;AACF;;AAGA,eAAsB,+BACpB,MACA,UACA,UAA8E,CAAC,GACJ;CAC3E,MAAM,WAAW,MAAM,6BAA6B,MAAM,OAAO;CACjE,wBAAwB,SAAS,UAAU,QAAQ;CACnD,OAAO,SAAS,MAAM,KAAK,SACzB,OAAO,OAAO;EAAE,MAAM,KAAK;EAAM,MAAM,KAAK;EAAM,OAAO,WAAW,KAAK,KAAK,KAAK;CAAE,CAAC,CACxF;AACF;AAEA,SAAgB,2BACd,OACyC;CACzC,OAAO;EACL,MAAM;EACN,OAAO,MACJ,KAAK,UAAU;GACd,MAAM,KAAK;GACX,MAAM,KAAK;GACX,QAAQ,YAAY,KAAK,KAAK;GAC9B,YAAY,KAAK,MAAM;EACzB,EAAE,CAAC,CACF,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAAE;CACpE;AACF;AAEA,SAAS,wBACP,UACA,UACM;CACN,IAAI,CAAC,OAAO,KAAK,wBAAwB,QAAQ,CAAC,CAAC,CAAC,OAAO,wBAAwB,QAAQ,CAAC,GAC1F,MAAM,IAAI,MACR,gFACF;AAEJ;AAEA,eAAsB,mCACpB,MACA,UACe;CAEf,MAAM,mBAAkB,MADD,cAAc,sBAAM,IAAI,IAAI,CAAC,EAAA,CACnB,SAAS,MAAM,KAAK,EAAE,MAAM,MAAM,cAAc;EAC/E,SAAS;EACT;EACA,eAAe;CACjB,EAAE;CACF,IACE,CAAC,OAAO,KAAK,wBAAwB,eAAe,CAAC,CAAC,CAAC,OACrD,wBAAwB,SAAS,KAAK,CACxC,GAEA,MAAM,IAAI,MAAM,6EAA6E;AAEjG;AAEA,eAAe,cACb,MACA,6BACA,QAQC;CACD,MAAM,eAAe,QAAQ,IAAI;CACjC,MAAM,YAAY,MAAM,MAAM,YAAY;CAC1C,IAAI,CAAC,UAAU,YAAY,KAAK,UAAU,eAAe,GACvD,MAAM,IAAI,MAAM,yCAAyC;CAE3D,IAAK,MAAM,SAAS,YAAY,MAAO,cACrC,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,gBAA0E,CAAC;CACjF,IAAI,aAAa;CAEjB,eAAe,MAAM,WAAkC;EACrD,MAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC;EAChE,QAAQ,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAAE;EACvE,KAAK,MAAM,SAAS,SAAS;GAC3B,IAAI,cAAc,gBAAgB,4BAA4B,IAAI,MAAM,IAAI,GAC1E;GAEF,MAAM,WAAW,QAAQ,WAAW,MAAM,IAAI;GAC9C,MAAM,UAAU,SAAS,cAAc,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG;GACpE,IAAI,CAAC,WAAW,QAAQ,WAAW,KAAK,KAAK,QAAQ,SAAS,MAAM,GAClE,MAAM,IAAI,MAAM,iCAAiC,SAAS;GAE5D,MAAM,QAAQ,MAAM,MAAM,QAAQ;GAClC,IAAI,MAAM,eAAe,GACvB,MAAM,IAAI,MAAM,iCAAiC,SAAS;GAE5D,IAAI,MAAM,YAAY,GAAG;IACvB,MAAM,MAAM,QAAQ;IACpB;GACF;GACA,IAAI,CAAC,MAAM,OAAO,GAChB,MAAM,IAAI,MAAM,2CAA2C,SAAS;GAEtE,IAAI,UAAU,cAAc,UAAU,OAAO,UAC3C,MAAM,IAAI,MAAM,4BAA4B;GAE9C,MAAM,aAAa,MAAM,KACvB,UACAC,UAAY,YACT,OAAOA,UAAY,eAAe,WAAWA,UAAY,aAAa,EAC3E;GACA,IAAI;IACF,MAAM,cAAc,MAAM,WAAW,KAAK;IAC1C,IAAI,CAAC,YAAY,OAAO,GACtB,MAAM,IAAI,MAAM,2CAA2C,SAAS;IAEtE,IAAI,YAAY,UAAU,GACxB,MAAM,IAAI,MAAM,0CAA0C,SAAS;IAErE,MAAM,OAAO,YAAY,OAAO;IAChC,IAAI,UAAU,YAAY,OAAO,OAAO,cACtC,MAAM,IAAI,MAAM,wCAAwC,SAAS;IAEnE,MAAM,iBAAiB,SAAS,OAAO,oBAAoB,aAAa,KAAA;IACxE,IAAI,mBAAmB,KAAA,KAAa,YAAY,OAAO,gBACrD,MAAM,IAAI,MAAM,qCAAqC;IAEvD,MAAM,QAAQ,MAAM,gBAClB,YACA,SAAS,KAAK,IAAI,OAAO,cAAc,kBAAkB,OAAO,YAAY,IAAI,KAAA,GAChF,OACF;IACA,cAAc,MAAM;IACpB,cAAc,KAAK;KAAE,MAAM;KAAS;KAAM,OAAO,WAAW,KAAK,KAAK;IAAE,CAAC;GAC3E,UAAU;IACR,MAAM,WAAW,MAAM;GACzB;EACF;CACF;CAEA,MAAM,MAAM,YAAY;CACxB,OAAO;EACL,UAAU,2BAA2B,aAAa;EAClD,OAAO;CACT;AACF;AAEA,eAAe,gBACb,YACA,UACA,MACiB;CACjB,IAAI,aAAa,KAAA,GAAW,OAAO,MAAM,WAAW,SAAS;CAC7D,MAAM,SAAmB,CAAC;CAC1B,IAAI,QAAQ;CACZ,OAAO,MAAM;EACX,MAAM,YAAY,WAAW;EAC7B,MAAM,QAAQ,OAAO,YAAY,KAAK,IAAI,KAAK,MAAM,YAAY,CAAC,CAAC;EACnE,MAAM,EAAE,cAAc,MAAM,WAAW,KAAK,OAAO,GAAG,MAAM,YAAY,IAAI;EAC5E,IAAI,cAAc,GAAG;EACrB,SAAS;EACT,IAAI,QAAQ,UAAU,MAAM,IAAI,MAAM,6CAA6C,MAAM;EACzF,OAAO,KAAK,MAAM,SAAS,GAAG,SAAS,CAAC;CAC1C;CACA,OAAO,OAAO,OAAO,QAAQ,KAAK;AACpC;;;ACxPA,eAAsB,oBACpB,MACA,cACA,YAC6B;CAC7B,IAAI,KAAK,SAAS,YAAY,OAAO,KAAA;CACrC,MAAM,iBAAiB,MAAM,uBAAuB,KAAK,YAAY,YAAY;CACjF,MAAM,wBAAwB,gBAAgB,KAAK,YAAY,KAAK,QAAQ;CAE5E,IAAI,KAAK,SAAS,SAAS;EACzB,MAAM,eAAe,gBAAgB,KAAK,QAAQ;EAClD,OAAO,KAAK;CACd;CACA,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,qDAAqD;CAEtF,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,sBAAsB,CAAC;CACtE,IAAI;EACF,MAAM,YAAY,KAAK,WAAW,OAAO;EACzC,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,KAAK,QAAQ,GAAG,KAAA,GAAW,EAC7E,gBAAgB,UAClB,CAAC;EACD,MAAM,gBACJ,gBACA;GAAC;GAAS;GAAY;GAAY;GAAuB;EAAG,GAC5D,YACA,EAAE,gBAAgB,UAAU,CAC9B;EACA,MAAM,iBACJ,MAAM,gBAAgB,gBAAgB,CAAC,YAAY,GAAG,KAAA,GAAW,EAC/D,gBAAgB,UAClB,CAAC,EAAA,CACD,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EACR,IAAI,kBAAkB,KAAK,eACzB,MAAM,IAAI,MACR,+BAA+B,cAAc,kBAAkB,KAAK,eACtE;EAEF,MAAM,eAAe,gBAAgB,aAAa;EAClD,OAAO;CACT,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAsB,4BACpB,UACA,cACqB;CACrB,MAAM,iBAAiB,MAAM,uBAAuB,SAAS,YAAY,YAAY;CAMrF,KAJE,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAM,SAAS;CAAM,CAAC,EAAA,CACzE,OACC,SAAS,MAAM,CAAC,CAChB,KACU,MAAM,UACjB,MAAM,IAAI,MAAM,kDAAkD,SAAS,QAAQ;CAErF,MAAM,WACJ,MAAM,gBAAgB,gBAAgB;EAAC;EAAW;EAAM,SAAS;EAAQ;EAAM,SAAS;CAAI,CAAC,EAAA,CAC7F;CACF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,QAAQ,WAAW,KAAK,QAAQ,EAAE,EAAE,SAAS,SAAS,MACxD,MAAM,IAAI,MAAM,+CAA+C,SAAS,MAAM;CAEhF,MAAM,QAAQ,QAAQ;CACtB,IAAI,OAAO,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACvE,MAAM,IAAI,MAAM,mDAAmD,SAAS,MAAM;CAEpF,MAAM,SAAS,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAQ,MAAM;CAAM,CAAC,EAAA,CAAG;CAC1F,YAAY,OAAO,SAAS,QAAQ,SAAS,YAAY,mBAAmB,SAAS,MAAM;CAC3F,OAAO,WAAW,KAAK,KAAK;AAC9B;AAEA,eAAsB,mBACpB,UACA,UACe;CACf,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,QAAQ,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK;CAC/F,IAAI,SAAS,SAAS,YACpB,MAAM,IAAI,MAAM,sBAAsB,KAAK,kBAAkB,SAAS,YAAY;CAEpF,MAAM,QAAQ,MAAM,gBAAgB,MAAM,CAAC,aAAa,aAAa,CAAC,EAAA,CAAG,OACtE,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,IAAI,SAAS,SAAS,UACpB,MAAM,IAAI,MAAM,2BAA2B,KAAK,kBAAkB,SAAS,UAAU;AAEzF;;;;;AAMA,eAAsB,uBAAuB,OAOa;CACxD,MAAM,iBAAiB,QAAQ,MAAM,cAAc;CACnD,MAAM,mBAAmB,gBAAgB,KAAK;CAC9C,MAAM,SAAS,SACZ,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,oBAAoB,CAAC,EAAA,CAAG,OAC1E,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,MAAM,MAAO,UAAU,OAAO,SAAS,GAAG,GAC5D,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,uBAAuB,gBAAgB,QAAQ,iBAAiB;CAEtE,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,+BAA+B,CAAC;CAC/E,IAAI;EACF,MAAM,kBAAkB,KAAK,WAAW,SAAS;EACjD,MAAM,YAAY,KAAK,WAAW,OAAO;EACzC,MAAM,MAAM,eAAe;EAC3B,MAAM,iBAAiB;GACrB,gBAAgB;GAChB,sBAAsB;GACtB,kCAAkC,KAAK,QAAQ,SAAS;EAC1D;EACA,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,MAAM,QAAQ,GAAG,KAAA,GAAW,cAAc;EAC9F,IAAI,MAAM,MAAM,aAAa,GAC3B,MAAM,gBACJ,gBACA;GAAC;GAAS;GAAY;GAAY;GAAuB;EAAG,GAC5D,MAAM,OACN,cACF;EAEF,MAAM,cACJ,MAAM,gBAAgB,gBAAgB,CAAC,YAAY,GAAG,KAAA,GAAW,cAAc,EAAA,CAC/E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EACR,IAAI,eAAe,MAAM,YACvB,MAAM,IAAI,MACR,wCAAwC,WAAW,kBAAkB,MAAM,YAC7E;EAEF,MAAM,eAAe,gBAAgB,YAAY,cAAc;EAC/D,MAAM,WAAW,MAAM,6BAA6B,gBAAgB,YAAY,cAAc;EAC9F,IACE,CAAC,OAAO,KAAK,wBAAwB,QAAQ,CAAC,CAAC,CAAC,OAC9C,OAAO,KAAK,wBAAwB,MAAM,UAAU,CAAC,CACvD,GAEA,MAAM,IAAI,MAAM,sEAAsE;EAExF,MAAM,gBACJ,MAAM,gBACJ,gBACA;GAAC;GAAe;GAAY;GAAM,MAAM;EAAU,GAClD,OAAO,KAAK,4BAA4B,MAAM,GAC9C;GACE,GAAG;GACH,iBAAiB;GACjB,kBAAkB;GAClB,iBAAiB;GACjB,oBAAoB;GACpB,qBAAqB;GACrB,oBAAoB;EACtB,CACF,EAAA,CACA,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EAWR,KATE,MAAM,gBACJ,gBACA,CAAC,aAAa,GAAG,aAAa,QAAQ,GACtC,KAAA,GACA,cACF,EAAA,CACA,OACC,SAAS,MAAM,CAAC,CAChB,KACa,MAAM,YACpB,MAAM,IAAI,MAAM,sEAAsE;EAExF,OAAO;GAAE;GAAY;EAAa;CACpC,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAe,uBACb,YACA,cACiB;CACjB,MAAM,iBAAiB,QAAQ,MAAM,aAAa,QAAQ,UAAU,CAAC;CAErE,IAAI,EAAC,MADmB,KAAK,cAAc,EAAA,CAC5B,YAAY,GAAG,MAAM,IAAI,MAAM,8CAA8C;CAE5F,MAAM,UAAU,MAAM,gBAAgB,gBAAgB;EAAC;EAAU;EAAW;CAAQ,CAAC,EAAA,CAAG,OACrF,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,SAAS,kBAAkB,MAAM;CACvC,IAAI,CAAC,UAAU,OAAO,UAAU,WAAW,SAAS,OAAO,SAAS,WAAW,MAC7E,MAAM,IAAI,MACR,2BAA2B,UAAU,YAAY,6BAA6B,WAAW,MAAM,GAAG,WAAW,MAC/G;CASF,MAAM,uBAAuB,gBADd,SAJb,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,oBAAoB,CAAC,EAAA,CACzE,OACC,SAAS,MAAM,CAAC,CAChB,KAC6B,CACkB,GAAG,sBAAsB;CAC3E,OAAO;AACT;AAEA,eAAsB,uBACpB,gBACA,QACA,OACe;CAMf,KAJE,MAAM,gBAAgB,gBAAgB;EAAC;EAAgB;EAAuB;CAAc,CAAC,EAAA,CAC7F,OACC,SAAS,MAAM,CAAC,CAChB,KACY,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CACtE,MAAM,YAAY,QAChB,iBACC,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,kBAAkB,CAAC,EAAA,CAAG,OACxE,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,SAAS,MAAO,aAAa,UAAU,SAAS,GAAG,GACrE,MAAM,IAAI,MAAM,GAAG,MAAM,8CAA8C;CAEzE,KAAK,MAAM,8BAAc,IAAI,IAAI,CAAC,QAAQ,SAAS,CAAC,GAClD,KAAK,MAAM,QAAQ,CAAC,cAAc,iBAAiB,GAAG;EACpD,MAAM,OAAO,KAAK,YAAY,WAAW,QAAQ,IAAI;EACrD,IAAI;GAEF,KAAI,MADmB,SAAS,MAAM,MAAM,EAAA,CAC/B,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sBAAsB,MAAM;EAC5E,SAAS,OAAO;GACd,IAAI,CAAC,UAAU,KAAK,GAAG,MAAM;EAC/B;CACF;AAEJ;AAEA,eAAe,wBACb,gBACA,QACA,cACe;CAIf,KAHc,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAM;CAAM,CAAC,EAAA,CAAG,OAC9E,SAAS,MAAM,CAAC,CAChB,KACI,MAAM,UAAU,MAAM,IAAI,MAAM,0CAA0C,QAAQ;CACzF,MAAM,cACJ,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,GAAG,OAAO,QAAQ,CAAC,EAAA,CACvE,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,IAAI,eAAe,cACjB,MAAM,IAAI,MAAM,8BAA8B,WAAW,kBAAkB,cAAc;AAE7F;AAEA,eAAe,eACb,gBACA,MACA,cAAsC,CAAC,GACxB;CACf,MAAM,WACJ,MAAM,gBACJ,gBACA;EAAC;EAAW;EAAO;EAAe;CAAI,GACtC,KAAA,GACA,WACF,EAAA,CACA;CACF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,QAAQ,WAAW,GAAG,MAAM,IAAI,MAAM,oCAAoC;CAC9E,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,MAAM,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACtE,MAAM,IAAI,MACR,kEAAkE,MAAM,MAC1E;EAEF,kBAAkB,MAAM,IAAI;CAC9B;AACF;AAEA,eAAe,6BACb,gBACA,MACA,aACkD;CAClD,OAAO,2BACL,MAAM,0BAA0B,gBAAgB,MAAM,WAAW,CACnE;AACF;AAEA,eAAsB,0BACpB,gBACA,MACA,cAAsC,CAAC,GACvC,QAC0E;CAC1E,MAAM,WACJ,MAAM,gBACJ,gBACA;EAAC;EAAW;EAAQ;EAAe;CAAI,GACvC,KAAA,GACA,WACF,EAAA,CACA;CACF,MAAM,QAAyE,CAAC;CAChF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,UAAU,QAAQ,SAAS,OAAO,UACpC,MAAM,IAAI,MAAM,qCAAqC;CAEvD,IAAI,aAAa;CACjB,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,MAAM,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACtE,MAAM,IAAI,MAAM,mDAAmD,MAAM,MAAM;EAEjF,kBAAkB,MAAM,IAAI;EAC5B,IAAI,MAAM,SAAS,KAAA,GACjB,MAAM,IAAI,MAAM,4CAA4C,MAAM,MAAM;EAE1E,IAAI,UAAU,MAAM,OAAO,OAAO,cAChC,MAAM,IAAI,MAAM,iDAAiD,MAAM,MAAM;EAE/E,cAAc,MAAM;EACpB,IAAI,UAAU,aAAa,OAAO,mBAChC,MAAM,IAAI,MAAM,8CAA8C;EAEhE,MAAM,SACJ,MAAM,gBACJ,gBACA;GAAC;GAAY;GAAQ,MAAM;EAAM,GACjC,KAAA,GACA,WACF,EAAA,CACA;EACF,IAAI,MAAM,eAAe,MAAM,MAC7B,MAAM,IAAI,MAAM,oCAAoC,MAAM,MAAM;EAElE,MAAM,KAAK;GACT,MAAM,MAAM;GACZ,MAAM,MAAM,SAAS,WAAW,MAAQ;GACxC,OAAO,WAAW,KAAK,KAAK;EAC9B,CAAC;CACH;CACA,OAAO,MAAM,MAAM,MAAM,UAAW,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,CAAE;AACnG;AAEA,SAAS,iBAAiB,OAMvB;CACD,MAAM,MAAM,OAAO,KAAK,KAAK;CAC7B,MAAM,UAAU,IAAI,SAAS,MAAM;CACnC,IAAI,CAAC,OAAO,KAAK,SAAS,MAAM,CAAC,CAAC,OAAO,GAAG,GAC1C,MAAM,IAAI,MAAM,8CAA8C;CAGhE,OADa,QAAQ,MAAM,IAAI,CAAC,CAAC,OAAO,OAC9B,CAAC,CAAC,KAAK,QAAQ;EACvB,MAAM,MAAM,IAAI,QAAQ,GAAI;EAC5B,MAAM,SAAS,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;EAC1D,MAAM,OAAO,IAAI,MAAM,MAAM,CAAC;EAC9B,MAAM,CAAC,MAAM,MAAM,QAAQ,YAAY;EACvC,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,MAC3C,MAAM,IAAI,MAAM,0BAA0B;EAE5C,MAAM,OAAO,YAAY,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,IAAI,KAAA;EACrE,IAAI,SAAS,KAAA,KAAa,CAAC,OAAO,cAAc,IAAI,GAClD,MAAM,IAAI,MAAM,8DAA8D;EAEhF,OAAO;GAAE;GAAM;GAAM;GAAQ,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;GAAI;EAAK;CAC7E,CAAC;AACH;AAEA,SAAS,kBAAkB,MAAoB;CAC7C,IACE,CAAC,QACD,KAAK,WAAW,GAAG,KACnB,KAAK,SAAS,IAAI,KAClB,KAAK,SAAS,IAAI,KAClBC,sBAAoB,IAAI,KACxB,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,KACrE,KAAK,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,YAAY,MAAM,QAEtC,MAAM,IAAI,MAAM,+CAA+C,MAAM;AAEzE;AAEA,SAASA,sBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,OAAO,MAAQ,SAAS,KAAM,OAAO;CAC3C;CACA,OAAO;AACT;AAEA,SAAS,kBAAkB,OAA4D;CACrF,MAAM,QAAQ,MAAM,MAClB,sGACF;CACA,IAAI,CAAC,QAAQ,MAAM,CAAC,MAAM,IAAI,OAAO,KAAA;CACrC,OAAO;EAAE,OAAO,MAAM;EAAI,MAAM,MAAM;CAAG;AAC3C;AAEA,eAAsB,gBACpB,gBACA,MACA,OACA,WAAmC,CAAC,GAChB;CACpB,MAAM,MAAM,OAAO,YACjB,OAAO,QAAQ,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,WAAW,MAAM,CAAC,CACzE;CACA,OAAO,OAAO,KAAK;EACjB,qBAAqB;EACrB,mBAAmB;EACnB,mBAAmB;EACnB,qBAAqB;EACrB,wBAAwB;EACxB,QAAQ;EACR,GAAG;CACL,CAAC;CACD,MAAM,WAAW;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,GAAG;CACL;CACA,OAAO,MAAM,IAAI,SAAS,eAAe,WAAW;EAClD,MAAM,QAAQ,MAAM,OAAO,UAAU;GAAE;GAAK,OAAO;IAAC;IAAQ;IAAQ;GAAM;EAAE,CAAC;EAC7E,MAAM,SAAmB,CAAC;EAC1B,MAAM,SAAmB,CAAC;EAC1B,MAAM,OAAO,GAAG,SAAS,UAAkB,OAAO,KAAK,KAAK,CAAC;EAC7D,MAAM,OAAO,GAAG,SAAS,UAAkB,OAAO,KAAK,KAAK,CAAC;EAC7D,MAAM,GAAG,SAAS,MAAM;EACxB,MAAM,GAAG,UAAU,MAAM,WAAW;GAClC,MAAM,MAAM,OAAO,OAAO,MAAM;GAChC,MAAM,MAAM,OAAO,OAAO,MAAM;GAChC,IAAI,SAAS,GAAG;IACd,uBACE,IAAI,MACF,OAAO,KAAK,MAAM,YAAY,WAAW,UAAU,KAAK,KAAK,IAAI,SAAS,MAAM,CAAC,CAAC,KAAK,GACzF,CACF;IACA;GACF;GACA,cAAc;IAAE,QAAQ;IAAK,QAAQ;GAAI,CAAC;EAC5C,CAAC;EACD,IAAI,OAAO,MAAM,MAAM,IAAI,KAAK;OAC3B,MAAM,MAAM,IAAI;CACvB,CAAC;AACH;AAEA,SAAS,UAAU,OAAyB;CAC1C,OACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAA4B,SAAS;AAE1C;;;ACrdA,MAAa,yBAAwC,OAAO,wBAAwB;AACpF,MAAa,yBAAwC,OAAO,wBAAwB;AACpF,MAAa,2BAA0C,OAAO,qBAAqB;;AA2iBnF,MAAa,uBAAuB;CAClC,aAAa;CACb,cAAc;CACd,qBAAqB;CACrB,8BAA8B;AAChC;;AAGA,MAAa,sBAAsB;CACjC,aAAa;CACb,cAAc;CACd,qBAAqB;CACrB,8BAA8B;CAC9B,YAAY;AACd;;;AC/gBA,MAAM,mCAAmB,IAAI,QAAiE;AAC9F,MAAM,uCAAuB,IAAI,QAgB/B;AAEF,SAAgB,iCACd,OACiC;CACjC,MAAM,QAAQ,6BAA6B,KAAK;CAChD,gCAAgC,KAAK;CACrC,MAAM,WAAW,OAAO,OAAO;EAC7B,QAAQ,MAAM;EACd,WAAW,OAAO,OAAO;GAAE,OAAO,MAAM;GAAgB,MAAM,MAAM;EAAc,CAAC;EACnF,aAAa,MAAM;EACnB,OAAO,MAAM;EACb,aAAa,aAAa,MAAM,WAAW;EAC3C,mBAAmB,MAAM;EACzB,eAAe,aAAa,MAAM,aAAa;EAC/C,wBAAwB,MAAM;EAC9B,QAAQ,MAAM;EACd,aAAa,UAAU,MAAM,aAAa,OAAO;EACjD,eAAe,MAAM;EACrB,GAAI,MAAM,YAAY,EAAE,WAAW,cAAc,MAAM,SAAS,EAAE,IAAI,CAAC;EACvE,OAAO,MAAM;EACb,QAAQ,MAAM;GACb,yBAAyB;CAC5B,CAAC;CACD,iBAAiB,IAAI,UAAU,KAAK;CACpC,qBAAqB,IAAI,UAAU,EAAE,QAAQ,WAAW,CAAC;CACzD,OAAO;AACT;AAEA,SAAgB,0BACd,UACwB;CACxB,MAAM,QAAQ,iBAAiB,IAAI,QAAQ;CAC3C,IAAI,CAAC,SAAS,SAAS,4BAA4B,MACjD,MAAM,IAAI,MAAM,yDAAyD;CAE3E,OAAO;AACT;;AAGA,SAAgB,iCACd,UACwB;CACxB,MAAM,QAAQ,0BAA0B,QAAQ;CAChD,gCAAgC,KAAK;CACrC,OAAO;AACT;;AAGA,SAAgB,4BACd,UACwB;CACxB,MAAM,QAAQ,iCAAiC,QAAQ;CACvD,oBAAoB,UAAU,CAAC,UAAU,GAAG,UAAU;CACtD,OAAO;AACT;;AAGA,SAAgB,+BACd,UACwB;CACxB,MAAM,QAAQ,iCAAiC,QAAQ;CACvD,oBAAoB,UAAU;EAAC;EAAY;EAAmB;CAAgB,GAAG,WAAW;CAC5F,OAAO;AACT;AAEA,SAAgB,6BAA6B,UAAiD;CAC5F,oBAAoB,UAAU,CAAC,UAAU,GAAG,SAAS;AACvD;;AAGA,SAAgB,0BACd,UACA,aACA,cAC2E;CAC3E,MAAM,QAAQ,iCAAiC,QAAQ;CACvD,2BAA2B,OAAO,YAAY,KAAK,cAAc,GAAG;CACpE,oBAAoB,UAAU,CAAC,SAAS,GAAG,SAAS;CACpD,MAAM,sBAAsB,wBAAwB;EAClD,GAAG,MAAM,OAAO;EAChB,GAAG,YAAY;EACf,GAAI,cAAc,OAAO,CAAC;EAC1B,GAAG,MAAM,MAAM;CACjB,CAAC;CACD,MAAM,WAAW,MAAM,cAAc,MAAM;CAkC3C,OAAO;EAAE;EAAO,SAjCA,OAAO,OAAO;GAC5B,aAAa,MAAM;GACnB,WAAW,kBAAkB,KAAK;GAClC,QAAQ,OAAO,OAAO;IACpB,MAAM,mBAAmB,MAAM,cAAc,WAAW,MAAM,eAAe,SAAS;IACtF,GAAI,SAAS,sBAAsB,MAAM,eAAe,iBACpD,EACE,WAAW,mBACT,SAAS,oBACT,MAAM,eAAe,cACvB,EACF,IACA,CAAC;IACL,SAAS,OAAO,OAAO,EACrB,OAAO,OAAO,OACZ,MAAM,eAAe,aAAa,KAAK,SAAS,gBAAgB,IAAI,CAAC,CACvE,EACF,CAAC;GACH,CAAC;GACD,OAAO,MAAM,MAAM;GACnB,aAAa,aAAa,MAAM,WAAW;GAC3C,mBAAmB,MAAM;GACzB,eAAe,aAAa,MAAM,aAAa;GAC/C,wBAAwB,MAAM;GAC9B,QAAQ,wBAAwB;IAAE,GAAG,MAAM;IAAQ,KAAK;GAAoB,CAAC;GAC7E,aAAa,UAAU,MAAM,aAAa,OAAO;GACjD,eAAe,MAAM;GACrB,YAAY,OAAO,OAAO,EAAE,WAAW,MAAM,cAAc,MAAM,SAAS,OAAO,UAAU,CAAC;GAC5F,gBAAgB,OAAO,OAAO,EAAE,UAAU,MAAM,cAAc,MAAM,SAAS,OAAO,SAAS,CAAC;GAC9F,GAAI,MAAM,YAAY,EAAE,WAAW,cAAc,MAAM,SAAS,EAAE,IAAI,CAAC;GACvE,OAAO,MAAM;GACb,QAAQ,MAAM;EAChB,CACsB;CAAE;AAC1B;AAEA,SAAS,kBACP,OAC8C;CAC9C,OAAO,OAAO,OAAO;EAAE,OAAO,MAAM;EAAgB,MAAM,MAAM;CAAc,CAAC;AACjF;AAEA,SAAgB,kCACd,UACA,SACM;CACN,oBACE,UACA,YAAY,cAAc,YAAY,oBAAoB,CAAC,WAAW,IAAI,CAAC,UAAU,GACrF,OACF;AACF;AAEA,SAAgB,iCAAiC,UAAiD;CAChG,oBAAoB,UAAU;EAAC;EAAY;EAAW;CAAS,GAAG,UAAU;AAC9E;;AAGA,eAAsB,kCACpB,OACe;CACf,MAAM,OAAO,MAAM,cAAc,MAAM;CACvC,MAAM,4BACJ,MAAM,MAAM,QAAQ,UACpB,MAAM,cAAc,UAAU,UAC9B,EACE,6BAA6B,CAAC,QAAQ,UAAU,EAClD,CACF;CACA,IAAI,MAAM,cAAc,YACtB,MAAM,mBAAmB,MAAM,MAAM,QAAQ,UAAU,MAAM,cAAc,UAAU;CAEvF,MAAM,mCACJ,MAAM,MAAM,QAAQ,aACpB,MAAM,YAAY,MAAM,QAC1B;CACA,IAAI,KAAK,oBAAoB;EAC3B,MAAM,gBAAgB,MAAM,MAAM,QAAQ;EAC1C,IAAI,CAAC,eAAe,MAAM,IAAI,MAAM,4CAA4C;EAChF,MAAM,4BAA4B,eAAe,KAAK,mBAAmB,QAAQ;CACnF,OAAO,IAAI,MAAM,MAAM,QAAQ,kBAAkB,KAAA,GAC/C,MAAM,IAAI,MAAM,oDAAoD;AAExE;AAEA,SAAS,6BAA6B,OAAuD;CAC3F,MAAM,iBAAiB,wBACrB,mCAAmC,MAAM,MAAM,cAAc,CAC/D;CACA,MAAM,gBAAgB,wBACpB,kCAAkC,MAAM,MAAM,aAAa,CAC7D;CACA,MAAM,cAAc,wBAClB,wCAAwC,MAAM,MAAM,YAAY,KAAK,CACvE;CACA,MAAM,oBAAoB,qCACxB,MAAM,mBACN,YAAY,MACd;CACA,MAAM,gBAAgB,wBACpB,0CAA0C,MAAM,MAAM,cAAc,KAAK,CAC3E;CAIA,MAAM,yBAAyB,2BAC7B,mBAJmB,wBACnB,2CAA2C,MAAM,MAAM,uBAAuB,KAAK,CAGrD,CAAC,CACjC;CACA,IAAI,uBAAuB,WAAW,MAAM,uBAAuB,QACjE,MAAM,IAAI,MAAM,yEAAyE;CAE3F,OAAO,OAAO,OAAO;EACnB,OAAO,MAAM;EACb,QAAQ,MAAM;EACd;EACA;EACA,aAAa,MAAM;EACnB,OAAO,wBAAwB,MAAM,KAAK;EAC1C,aAAa,OAAO,OAAO;GACzB,OAAO;GACP,OAAO,WAAW,KAAK,MAAM,YAAY,KAAK;GAC9C,SAAS,OAAO,OAAO,CAAC,GAAG,MAAM,YAAY,OAAO,CAAC;EACvD,CAAC;EACD;EACA,eAAe,OAAO,OAAO;GAC3B,OAAO;GACP,OAAO,WAAW,KAAK,MAAM,cAAc,KAAK;EAClD,CAAC;EACD;EACA,QAAQ,wBAAwB,MAAM,MAAM;EAC5C,aAAa,OAAO,OAAO;GACzB,OAAO,WAAW,KAAK,MAAM,YAAY,KAAK;GAC9C,UAAU,wBAAwB,MAAM,YAAY,QAAQ;EAC9D,CAAC;EACD,eAAe,wBAAwB,MAAM,aAAa;EAC1D,eAAe,MAAM;EACrB,wBAAwB,MAAM;EAC9B,kBAAkB,MAAM;EACxB,iBAAiB,MAAM;EACvB,kBAAkB,wBAAwB,MAAM,gBAAgB;EAChE,gBAAgB,OAAO,OAAO;GAC5B,WAAW,uBAAuB,MAAM,eAAe,SAAS;GAChE,GAAI,MAAM,eAAe,iBACrB,EAAE,gBAAgB,uBAAuB,MAAM,eAAe,cAAc,EAAE,IAC9E,CAAC;GACL,cAAc,uBAAuB,MAAM,eAAe,YAAY;EACxE,CAAC;EACD,GAAI,MAAM,oBACN,EAAE,mBAAmB,wBAAwB,MAAM,iBAAiB,EAAE,IACtE,CAAC;EACL,GAAI,MAAM,YACN,EACE,WAAW,OAAO,OAAO;GACvB,WAAW,wBAAwB,MAAM,UAAU,SAAS;GAC5D,UAAU,wBAAwB,MAAM,UAAU,QAAQ;GAC1D,OAAO,uBAAuB,MAAM,UAAU,KAAK;GACnD,GAAI,MAAM,UAAU,kBAChB,EAAE,iBAAiB,WAAW,KAAK,MAAM,UAAU,eAAe,EAAE,IACpE,CAAC;EACP,CAAC,EACH,IACA,CAAC;EACL,OAAO,wBAAwB,MAAM,KAAK;EAC1C,QAAQ,wBAAwB,MAAM,MAAM;CAC9C,CAAC;AACH;AAEA,SAAS,gCAAgC,OAAqC;CAE5E,IAAIC,2BADmB,mBAAmB,MAAM,MACN,CAAC,MAAM,MAAM,OAAO,QAC5D,MAAM,IAAI,MAAM,wDAAwD;CAE1E,mBAAmB,MAAM,YAAY,OAAO,MAAM,YAAY,OAAO,cAAc;CACnF,qCAAqC,MAAM,mBAAmB,MAAM,YAAY,MAAM,MAAM;CAC5F,mBAAmB,MAAM,cAAc,OAAO,MAAM,cAAc,OAAO,gBAAgB;CACzF,0CAA0C,MAAM,MAAM,cAAc,KAAK;CAEzE,MAAM,UAAU,2CAA2C,MACzD,MAAM,uBAAuB,KAC/B;CACA,MAAM,eAAe,wBAAwB,mBAAmB,OAAO,CAAC;CACxE,IACEA,2BAAyB,mBAAmB,OAAO,CAAC,MAAM,MAAM,uBAAuB,UACvF,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,OAAO,OAAO,KAAK,MAAM,uBAAuB,KAAK,CAAC,GAEjF,MAAM,IAAI,MAAM,wEAAwE;CAG1F,2BAA2B,KAAK;CAChC,MAAM,cAAc,OAAO,KAAK,MAAM,cAAc,aAAa,MAAM;CACvE,IACE,CAAC,OAAO,KAAK,MAAM,YAAY,KAAK,CAAC,CAAC,OAAO,WAAW,KACxD,KAAK,UAAU,MAAM,YAAY,QAAQ,MACvC,KAAK,UAAU,MAAM,cAAc,MAAM,SAAS,mBAAmB,GAEvE,MAAM,IAAI,MAAM,kEAAkE;CAEpF,IACE,CAAC,6CAA6C,KAAK,MAAM,aAAa,KACtE,CAAC,OAAO,cAAc,MAAM,sBAAsB,KAClD,MAAM,0BAA0B,KAChC,CAAC,OAAO,cAAc,MAAM,gBAAgB,KAC5C,MAAM,oBAAoB,KAC1B,CAAC,OAAO,cAAc,MAAM,eAAe,KAC3C,MAAM,mBAAmB,KACzB,KAAK,UAAU,MAAM,aAAa,MAChC,KAAK,UAAU,MAAM,cAAc,MAAM,SAAS,MAAM,QAAQ,KAClE,MAAM,iBAAiB,WAAW,MAAM,cAAc,MAAM,SAAS,MAAM,OAAO,eAClF,MAAM,iBAAiB,kBAAkB,MAAM,iBAC/C,MAAM,iBAAiB,gBAAgB,MAAM,0BAC7CA,2BAAyB,MAAM,iBAAiB,OAAO,MACrDA,2BAAyB,MAAM,cAAc,MAAM,SAAS,MAAM,OAAO,OAAO,KAClFA,2BAAyB,MAAM,iBAAiB,cAAc,MAC5DA,2BAAyBC,cAAY,MAAM,cAAc,MAAM,SAAS,MAAM,CAAC,GAEjF,MAAM,IAAI,MAAM,mEAAmE;CAErF,qBAAqB,KAAK;CAC1B,wBAAwB,KAAK;CAC7B,IACG,MAAM,OAAO,SAAS,cAAc,CAAC,MAAM,qBAC3C,MAAM,OAAO,SAAS,cAAc,MAAM,mBAE3C,MAAM,IAAI,MAAM,sEAAsE;CAExF,IACE,MAAM,OAAO,SAAS,cACtB,MAAM,sBACL,MAAM,kBAAkB,kBAAkB,MAAM,iBAC/C,MAAM,kBAAkB,gBAAgB,MAAM,0BAC9C,MAAM,kBAAkB,uBAAuB,MAAM,OAAO,qBAE9D,MAAM,IAAI,MAAM,sEAAsE;CAExF,IAAI,KAAK,UAAU,MAAM,MAAM,MAAM,KAAK,UAAU,MAAM,cAAc,MAAM,SAAS,MAAM,GAC3F,MAAM,IAAI,MAAM,6DAA6D;CAG/E,MAAM,eAAe;GAClB,qBAAqB,cAAc,MAAM;GACzC,qBAAqB,eAAe,MAAM,OAAO;GACjD,qBAAqB,sBAAsB,MAAM,cAAc,MAAM;GACrE,qBAAqB,+BAA+B,MAAM,uBAAuB;CACpF;CACA,MAAM,2BAA2B;GAC9B,oBAAoB,cAAc,MAAM;GACxC,oBAAoB,eAAe,MAAM,OAAO;GAChD,oBAAoB,sBAAsB,MAAM,cAAc,MAAM;GACpE,oBAAoB,+BAA+B,MAAM,uBAAuB;GAChF,oBAAoB,aAAa,MAAM,MAAM;CAChD;CACA,IACE,CAAC,MAAM,MAAM,MAAM,WACjB,GAAG,MAAM,YAAY,WAAW,MAAM,cAAc,MAAM,SAAS,QAAQ,QAAQ,EACrF,KACAD,2BAAyB,MAAM,MAAM,IAAI,MAAMA,2BAAyB,YAAY,KACpFA,2BAAyB,MAAM,MAAM,GAAG,MAAMA,2BAAyB,wBAAwB,GAE/F,MAAM,IAAI,MAAM,gEAAgE;AAEpF;AAEA,SAAS,mBACP,UAGA,OACA,OACM;CACN,MAAM,WAAW,wBAAwB,SAAS,QAAQ;CAC1D,IACE,YAAY,QAAQ,MAAM,SAAS,UACnC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,KAAK,CAAC,KAChD,SAAS,SAAS,WAAW,SAAS,UACtC,SAAS,SAAS,eAAe,MAAM,cACvC,EAAE,aAAa,SAAS,aACxB,CAAC,OAAO,KAAK,SAAS,SAAS,SAAS,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,KAAK,CAAC,GAE3E,MAAM,IAAI,MAAM,YAAY,MAAM,uCAAuC;AAE7E;AAEA,SAAS,aAA8D,UAAgB;CACrF,MAAM,QAAQ,WAAW,KAAK,SAAS,KAAK;CAC5C,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,KAAK;EAC9B;CACF,CAAC;AACH;AAEA,SAAS,UAA2C,OAAU,KAAiB;CAC7E,MAAM,QAAQ,WAAW,KAAK,MAAM,KAAK;CACzC,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,KAAK,OAAmB;GACtB,OAAO,WAAW,KAAK,KAAK;EAC9B;CACF,CAAC;AACH;AAEA,SAAS,cACP,WAC2D;CAC3D,MAAM,kBAAkB,UAAU,kBAC9B,WAAW,KAAK,UAAU,eAAe,IACzC,KAAA;CACJ,OAAO,OAAO,OAAO;EACnB,WAAW,UAAU;EACrB,UAAU,UAAU;EACpB,OAAO,OAAO,OAAO,UAAU,MAAM,KAAK,SAAS,gBAAgB,IAAI,CAAC,CAAC;EACzE,GAAI,kBACA,EACE,IAAI,kBAA8B;GAChC,OAAO,WAAW,KAAK,eAAe;EACxC,EACF,IACA,CAAC;CACP,CAAC;AACH;AACA,SAAS,mBACP,UACA,aACiD;CACjD,OAAO,OAAO,OAAO;EACnB;EACA,OAAO,OAAO,OAAO,YAAY,KAAK,SAAS,iBAAiB,IAAI,CAAC,CAAC;CACxE,CAAC;AACH;AAEA,SAAS,gBACP,QACqE;CACrE,MAAM,QAAQ,WAAW,KAAK,OAAO,KAAK;CAC1C,OAAO,OAAO,OAAO;EACnB,MAAM,OAAO;EACb,MAAM,OAAO;EACb,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,KAAK;EAC9B;CACF,CAAC;AACH;AAEA,SAAS,iBACP,QACqC;CACrC,MAAM,QAAQ,WAAW,KAAK,OAAO,KAAK;CAC1C,OAAO,OAAO,OAAO;EACnB,MAAM,OAAO;EACb,MAAM,OAAO;EACb,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,KAAK;EAC9B;CACF,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAqC;CACjE,MAAM,WAAW,MAAM,cAAc,MAAM;CAC3C,6BACE,MAAM,eAAe,WACrB,MAAM,cAAc,UAAU,QAChC;CACA,IAAI,SAAS,oBAAoB;EAC/B,IAAI,CAAC,MAAM,eAAe,gBACxB,MAAM,IAAI,MAAM,+CAA+C;EAEjE,6BACE,MAAM,eAAe,gBACrB,SAAS,mBAAmB,QAC9B;CACF,OAAO,IAAI,MAAM,eAAe,gBAC9B,MAAM,IAAI,MAAM,uCAAuC;CAGzD,MAAM,gBAAgB,MAAM,YAAY,MAAM,SAAS;CACvD,IAAI,MAAM,eAAe,aAAa,WAAW,cAAc,QAC7D,MAAM,IAAI,MAAM,sEAAsE;CAExF,KAAK,IAAI,QAAQ,GAAG,QAAQ,cAAc,QAAQ,SAAS;EACzD,MAAM,WAAW,cAAc;EAC/B,MAAM,SAAS,MAAM,eAAe,aAAa;EACjD,IACE,CAAC,YACD,CAAC,UACD,OAAO,SAAS,SAAS,WACzB,OAAO,SAAS,SAAS,QACzB,YAAY,OAAO,KAAK,MAAM,SAAS,eAEvC,MAAM,IAAI,MAAM,sEAAsE;CAE1F;AACF;AAEA,SAAS,wBAAwB,OAAqC;CACpE,MAAM,WAAW,MAAM,OAAO;CAC9B,MAAM,SAAS,MAAM;CACrB,IAAI,CAAC,YAAY,CAAC,QAAQ;EACxB,IAAI,YAAY,QACd,MAAM,IAAI,MAAM,wDAAwD;EAC1E;CACF;CACA,IACEA,2BAAyB,OAAO,SAAS,MAAMA,2BAAyB,SAAS,SAAS,KAC1FA,2BAAyB,OAAO,QAAQ,MAAMA,2BAAyB,SAAS,QAAQ,KACxF,MAAM,cAAc,MAAM,SAAS,4BAA4B,SAAS,SAAS,QAEjF,MAAM,IAAI,MAAM,iEAAiE;CAEnF,6BAA6B,OAAO,OAAO,SAAS,SAAS,QAAQ;CACrE,IAAI,CAAC,SAAS,mBAAmB,CAAC,OAAO,iBAAiB;EACxD,IAAI,SAAS,mBAAmB,OAAO,iBACrC,MAAM,IAAI,MAAM,yEAAyE;EAE3F;CACF;CACA,IACE,OAAO,gBAAgB,eAAe,SAAS,gBAAgB,cAC/D,YAAY,OAAO,eAAe,MAAM,SAAS,gBAAgB,QAEjE,MAAM,IAAI,MAAM,yEAAyE;AAE7F;AAEA,SAAS,6BACP,aACA,UACM;CACN,IAAI,YAAY,WAAW,SAAS,MAAM,QACxC,MAAM,IAAI,MAAM,oEAAoE;CAEtF,KAAK,IAAI,QAAQ,GAAG,QAAQ,SAAS,MAAM,QAAQ,SAAS;EAC1D,MAAM,SAAS,YAAY;EAC3B,MAAM,UAAU,SAAS,MAAM;EAC/B,IACE,CAAC,UACD,CAAC,WACD,OAAO,SAAS,QAAQ,QACxB,OAAO,SAAS,QAAQ,QACxB,OAAO,MAAM,eAAe,QAAQ,cACpC,YAAY,OAAO,KAAK,MAAM,QAAQ,QAEtC,MAAM,IAAI,MAAM,oEAAoE;CAExF;AACF;AAEA,SAAS,2BAA2B,OAAqC;CAEvE,MAAM,OADO,MAAM,cAAc,MAAM,SACrB;CAClB,MAAM,QAAQ,MAAM;CACpB,MAAM,OAAO,MAAM;CACnB,MAAM,UAAU,MAAM,uBAAuB;CAC7C,MAAM,YAAY,KAAK,YAAY,MAAM,OAAO,KAAK;CACrD,IACEA,2BAAyB,mBAAmB,KAAK,CAAC,MAAM,MAAM,UAC9DA,2BAAyB,mBAAmB,IAAI,CAAC,MAAM,KAAK,UAC5DA,2BAAyB,mBAAmB,IAAI,CAAC,MAAM,KAAK,UAC5D,KAAK,iBAAiB,MAAM,OAAO,UACnC,KAAK,gBAAgB,MAAM,UAC3B,KAAK,eAAe,KAAK,UACzB,MAAM,YAAY,KAAK,eAAe,KAAK,UAC3C,MAAM,MAAM,eAAe,KAAK,QAChC,KAAK,cAAc,MAAM,QACzB,KAAK,UAAU,KACf,KAAK,UAAU,KAAK,QAAQ,aAE5B,MAAM,IAAI,MAAM,iEAAiE;CAEnF,MAAM,aAAa,wBAAwB,mBAAmB,KAAK,CAAC;CACpE,MAAM,YAAY,wBAAwB,mBAAmB,IAAI,CAAC;CAClE,IACE,QAAQ,UAAU,MAAM,WAAW,MAAM,UACzC,QAAQ,UAAU,MAAM,SAAS,WAAW,YAAY,UAAU,KAClE,QAAQ,UAAU,MAAM,SAAS,eAAe,WAAW,cAC3D,QAAQ,UAAU,KAAK,WAAW,KAAK,UACvC,QAAQ,UAAU,KAAK,SAAS,WAAW,YAAY,SAAS,KAChE,QAAQ,UAAU,KAAK,SAAS,eAAe,UAAU,YAEzD,MAAM,IAAI,MAAM,sEAAsE;AAE1F;AAEA,SAAS,uBACP,OACkE;CAClE,OAAO,OAAO,OACZ,MAAM,KAAK,SAAS,OAAO,OAAO;EAAE,GAAG;EAAM,OAAO,WAAW,KAAK,KAAK,KAAK;CAAE,CAAC,CAAC,CACpF;AACF;AAEA,SAASC,cACP,QAC2D;CAC3D,OAAO;EACL,eAAe,OAAO;EACtB,gBAAgB,OAAO;EACvB,iBAAiB,OAAO;EACxB,YAAY,OAAO;CACrB;AACF;AAEA,SAAS,oBACP,UACA,UAaA,MAWM;CACN,MAAM,YAAY,qBAAqB,IAAI,QAAQ;CACnD,IAAI,CAAC,aAAa,CAAC,SAAS,SAAS,UAAU,MAAM,GACnD,MAAM,IAAI,MAAM,2CAA2C,WAAW,UAAU,WAAW;CAE7F,UAAU,SAAS;AACrB;AAEA,SAAS,2BACP,OACA,kBACA,mBACM;CACN,MAAM,uBAAO,IAAI,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,OAAO,GAAG,GAAG,GAAG,OAAO,KAAK,MAAM,MAAM,GAAG,CAAC,CAAC;CACxF,KAAK,MAAM,CAAC,MAAM,UAAU,CAC1B,GAAG,OAAO,QAAQ,gBAAgB,GAClC,GAAG,OAAO,QAAQ,qBAAqB,CAAC,CAAC,CAC3C,GAAG;EACD,IAAI,CAAC,2BAA2B,KAAK,IAAI,KAAK,OAAO,UAAU,YAAY,MAAM,SAAS,GACxF,MAAM,IAAI,MAAM,oEAAoE;EAEtF,IAAI,KAAK,IAAI,IAAI,GACf,MAAM,IAAI,MAAM,gEAAgE,MAAM;EAExF,KAAK,IAAI,IAAI;CACf;AACF;;;;ACvtBA,SAAgB,wBACd,UACA,qBAI8B;CAC9B,MAAM,QAAQ,iCAAiC,QAAQ;CACvD,MAAM,WAAW,SAAS,cAAc,MAAM;CAC9C,MAAM,UAAU;EACd,QAAQ,SAAS,QAAQ;EACzB,aAAa,MAAM,cAAc,QAAQ;EACzC,aAAa,MAAM,cAAc,QAAQ;CAC3C;CACA,MAAM,QAAQ,KAAK,IAAI;CACvB,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAC1C,MAAM,IAAI,MAAM,qEAAqE;CAEvF,MAAM,mBACJ,QACA,gCACE,SAAS,OAAO,WAChB,MAAM,kBACN,MAAM,eACR;CACF,IAAI,CAAC,OAAO,cAAc,gBAAgB,KAAK,oBAAoB,GACjE,MAAM,IAAI,MAAM,wEAAwE;CAE1F,IAAI,mBAAmB,MAAM,wBAC3B,MAAM,IAAI,MACR,kFACF;CAEF,IACE,oBAAoB,cAAc,WAAW,SAAS,cAAc,MAAM,UAC1E,oBAAoB,cAAc,eAAe,MAAM,cAAc,MAAM,YAE3E,MAAM,IAAI,MAAM,yEAAyE;CAE3F,IACE,oBAAoB,uBAAuB,WAAW,MAAM,uBAAuB,UACnF,oBAAoB,uBAAuB,eACzC,MAAM,uBAAuB,MAAM,YAErC,MAAM,IAAI,MACR,kFACF;CAEF,OAAO,4BAA4B,UAAU;EAC3C,aAAa,SAAS;EACtB,SAAS,QAAQ;EACjB,aAAa,QAAQ;EACrB,aAAa,QAAQ;EACrB,cAAc,SAAS,OAAO;EAC9B,qBAAqB,SAAS,cAAc,MAAM;EAClD;EACA,oBAAoB,mBAAmB,UAAU,MAAM,eAAe;EACtE;EACA,iBAAiB,MAAM;EACvB,SAAS;GACP,eAAe,MAAM;GACrB,kBAAkB,MAAM,iBAAiB;GACzC,eAAe,MAAM;GACrB,YAAY,MAAM,MAAM;GACxB,kBAAkB,MAAM;GACxB,GAAI,MAAM,oBACN,EACE,QAAQ;IACN,cAAc,MAAM,kBAAkB;IACtC,oBAAoB,MAAM,kBAAkB;GAC9C,EACF,IACA,CAAC;EACP;CACF,CAAC;AACH;AAEA,SAAS,mBACP,UACA,iBACc;CACd,MAAM,WAAW,SAAS,cAAc,MAAM;CAC9C,OAAOC,2BAAyB;EAC9B;EACA,eAAe;GACb,GAAG;GACH,SAAS;IACP,GAAG,SAAS;IACZ,SAAS;IACT,QAAQ,UAAU,IAAI,OAAO,EAAE;GACjC;GACA,OAAO;IACL,GAAG,SAAS;IACZ,QAAQ;KACN,GAAG,SAAS,MAAM;KAClB,aAAa,UAAU,IAAI,OAAO,EAAE;IACtC;GACF;GACA,QACE,SAAS,OAAO,SAAS,aACrB,SAAS,SACT;IACE,MAAM;IACN,OAAO;IACP,oBAAoB;IACpB,OAAO;KACL,MAAM;KACN,kBAAkB,SAAS,OAAO,MAAM;IAC1C;IACA,aAAa;KACX,QAAQ,SAAS,OAAO,YAAY;KACpC,UAAU,SAAS,OAAO,YAAY;KACtC,UAAU;MACR,QAAQ,SAAS,OAAO,YAAY,SAAS;MAC7C,YAAY,SAAS,OAAO,YAAY,SAAS;KACnD;KACA,SAAS;MACP,QAAQ,SAAS,OAAO,YAAY,QAAQ;MAC5C,YAAY,SAAS,OAAO,YAAY,QAAQ;KAClD;IACF;IACA,GAAI,SAAS,OAAO,aAAa,EAAE,YAAY,SAAS,OAAO,WAAW,IAAI,CAAC;GACjF;EACR;CACF,CAAC;AACH;;;;AC6HA,SAAS,cACP,OACA,OACA,QACA,UACsC;CACtC,OAAO,OAAO,OAAO;EACnB;EACA;EACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CACjC,CAAC;AACH;;AAQA,IAAa,4CAAb,MAEA;CACE,yBAA0B,IAAI,IAAyB;CACvD;CAEA,YAAY,UAA4D,CAAC,GAAG;EAC1E,KAAK,MAAM,QAAQ,OAAO,KAAK;CACjC;CAEA,MAAM,SACJ,WAC6C;EAC7C,MAAM,QAAQ,UAAU,SAAS;EACjC,MAAM,OAAO,UAAU,KAAK;EAC5B,MAAM,WAAW,KAAK,OAAO,IAAI,IAAI;EACrC,IAAI,UAAU,OAAO,sBAAsB,SAAS,OAAO,KAAK;EAChE,qBAAqB,MAAM,kBAAkB,KAAK,IAAI,CAAC;EAEvD,MAAM,iBAAiB,yBAAyB,KAAK,QAAQ,KAAK;EAClE,IAAI,gBAAgB,OAAO,cAAc,OAAO,cAAc;EAE9D,MAAM,QAAQ,SAAS,KAAK;EAG5B,KAAK,OAAO,IAAI,MAAM;GACpB;GACA,aAAa,YAAY,KAAK;GAC9B,OAAO;EACT,CAAC;EACD,OAAO,OAAO,OAAO;GAAE,UAAU;GAAM;GAAO;EAAM,CAAC;CACvD;CAEA,MAAM,WACJ,kBAC2D;EAC3D,MAAM,UAAU,eAAe,gBAAgB;EAC/C,MAAM,SAAS,KAAK,OAAO,IAAI,UAAU,OAAO,CAAC;EACjD,OAAO,SACH,cAAc,OAAO,OAAO,OAAO,OAAO,OAAO,QAAQ,OAAO,QAAQ,IACxE,KAAA;CACN;CAEA,MAAM,oBACJ,gBAC6C;EAC7C,MAAM,QAAQ,UAAU,cAAc;EACtC,MAAM,SAAS,KAAK,aAAa,KAAK;EACtC,YAAY,OAAO,aAAa,OAAO,MAAM,kBAAkB,KAAK;EACpE,IAAI,OAAO,UAAU,qBACnB,OAAO,OAAO,OAAO;GAAE,QAAQ;GAAO,OAAO;EAAoB,CAAC;EAEpE,IAAI,OAAO,UAAU,OAAO,UAC1B,MAAM,IAAI,MAAM,wEAAwE;EAE1F,qBAAqB,OAAO,MAAM,kBAAkB,KAAK,IAAI,CAAC;EAC9D,OAAO,QAAQ;EACf,OAAO,OAAO,OAAO;GAAE,QAAQ;GAAM,OAAO;EAAoB,CAAC;CACnE;CAEA,MAAM,cACJ,gBACA,QAC6C;EAC7C,MAAM,QAAQ,UAAU,cAAc;EACtC,MAAM,SAAS,KAAK,aAAa,KAAK;EACtC,YAAY,OAAO,aAAa,OAAO,MAAM,kBAAkB,KAAK;EACpE,MAAM,WAAW,eAAe,OAAO,OAAO,MAAM;EACpD,IAAI,OAAO,QAAQ,OAAO,cAAc,OAAO,QAAQ,QAAQ;EAC/D,6BAA6B,OAAO,OAAO,QAAQ;EACnD,qBAAqB,OAAO,MAAM,kBAAkB,KAAK,IAAI,CAAC;EAC9D,OAAO,SAAS;EAChB,OAAO,OAAO,OAAO;GAAE,QAAQ;GAAM;EAAS,CAAC;CACjD;CAEA,MAAM,OACJ,gBACA,yBAC8C;EAC9C,MAAM,QAAQ,UAAU,cAAc;EACtC,MAAM,iBAAiB,mBAAmB,uBAAuB;EACjE,MAAM,SAAS,KAAK,aAAa,KAAK;EACtC,YAAY,OAAO,aAAa,OAAO,MAAM,kBAAkB,KAAK;EACpE,MAAM,SAAS,sBAAsB,OAAO,QAAQ,cAAc;EAClE,IAAI,OAAO,UAAU,OAAO,eAAe,OAAO,UAAU,cAAc;EAC1E,qBAAqB,OAAO,MAAM,kBAAkB,KAAK,IAAI,CAAC;EAI9D,OAAO,WAAW;EAClB,OAAO,OAAO,OAAO;GAAE,UAAU;GAAM,UAAU;EAAO,CAAC;CAC3D;CAEA,MAAM,eACJ,kBACA,UAC8C;EAC9C,MAAM,UAAU,eAAe,gBAAgB;EAC/C,MAAM,SAAS,KAAK,aAAa,SAAS,8BAA8B;EACxE,MAAM,YAAY,wBAAwB,OAAO,OAAO,OAAO,OAAO,QAAQ;EAC9E,IAAI,OAAO,QAAQ,4BAA4B,OAAO,QAAQ,SAAS;EACvE,MAAM,kBAAkB,OAAO,QAAQ,kBAAkB,UAAU;EACnE,IAAI,OAAO,UAAU,OAAO,eAAe,OAAO,UAAU,eAAe;EAC3E,mBAAmB,OAAO,MAAM,kBAAkB,KAAK,IAAI,CAAC;EAC5D,MAAM,WAAW,OAAO,UAAU;EAClC,4BAA4B,UAAU,SAAS;EAC/C,OAAO,WAAW;EAClB,OAAO,WAAW;EAClB,OAAO,OAAO,OAAO;GAAE,UAAU;GAAM;EAAS,CAAC;CACnD;CAEA,aACE,SACA,YAAY,6BACC;EACb,MAAM,SAAS,KAAK,OAAO,IAAI,UAAU,OAAO,CAAC;EACjD,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,GAAG,UAAU,mCAAmC;EAC7E,OAAO;CACT;AACF;AAEA,MAAM,iBAAiB;AACvB,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,SAAS,UAAU,OAAmE;CACpF,sBACE,OACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,GACA,2BACF;CACA,kBAAkB,MAAM,WAAW;CACnC,IAAI,CAAC,OAAO,cAAc,MAAM,OAAO,KAAK,MAAM,UAAU,GAC1D,MAAM,IAAI,MAAM,mEAAmE;CAErF,IAAI,CAAC,OAAO,cAAc,MAAM,WAAW,KAAK,MAAM,cAAc,GAClE,MAAM,IAAI,MAAM,uEAAuE;CAEzF,IAAI,MAAM,UAAU,MAAM,aACxB,MAAM,IAAI,MAAM,uDAAuD;CAEzE,IAAI,CAAC,CAAC,QAAQ,+BAA+B,CAAC,CAAC,SAAS,MAAM,WAAW,GACvE,MAAM,IAAI,MAAM,kDAAkD;CAEpE,IAAI,MAAM,gBAAgB,UAAU,MAAM,gBAAgB,GACxD,MAAM,IAAI,MAAM,mEAAmE;CAErF,mBAAmB,MAAM,cAAc,cAAc;CACrD,mBAAmB,MAAM,qBAAqB,qBAAqB;CACnE,MAAM,sBAAsB,iCAC1B,MAAM,qBACN,MAAM,mBACR;CACA,mBAAmB,MAAM,oBAAoB,oBAAoB;CACjE,wBAAwB,MAAM,kBAAkB,kBAAkB;CAClE,uBAAuB,MAAM,iBAAiB,MAAM,eAAe;CACnE,MAAM,UAAU,mBAAmB,MAAM,OAAO;CAChD,OAAO,OAAO,OAAO;EACnB,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,aAAa,MAAM;EACnB,aAAa,MAAM;EACnB,cAAc,MAAM;EACpB,qBAAqB,MAAM;EAC3B;EACA,oBAAoB,MAAM;EAC1B,kBAAkB,MAAM;EACxB,iBAAiB,MAAM;EACvB;CACF,CAAC;AACH;AAEA,SAAS,mBACP,SACuC;CACvC,sBACE,SACA,QAAQ,SACJ;EACE;EACA;EACA;EACA;EACA;EACA;CACF,IACA;EAAC;EAAiB;EAAoB;EAAiB;EAAc;CAAkB,GAC3F,qCACF;CACA,IAAI,CAAC,uBAAuB,KAAK,QAAQ,aAAa,GACpD,MAAM,IAAI,MAAM,sDAAsD;CAExE,mBAAmB,QAAQ,kBAAkB,0BAA0B;CACvE,MAAM,gBAAgB,wBACpB,kCAAkC,MAAM,QAAQ,aAAa,CAC/D;CACA,wBAAwB,QAAQ,YAAY,sBAAsB,GAAG;CACrE,MAAM,mBAAmB,wBAAwB,QAAQ,gBAAgB;CACzE,MAAM,SAAS,QAAQ,SAAS,wBAAwB,QAAQ,MAAM,IAAI,KAAA;CAC1E,OAAO,OAAO,OAAO;EACnB,eAAe,QAAQ;EACvB,kBAAkB,QAAQ;EAC1B;EACA,YAAY,QAAQ;EACpB;EACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;CAC7B,CAAC;AACH;AAEA,SAAS,wBACP,QAC8D;CAC9D,sBACE,QACA,CAAC,gBAAgB,oBAAoB,GACrC,2CACF;CACA,mBAAmB,OAAO,cAAc,qBAAqB;CAC7D,wBAAwB,OAAO,oBAAoB,6BAA6B,IAAK;CACrF,OAAO,OAAO,OAAO;EACnB,cAAc,OAAO;EACrB,oBAAoB,OAAO;CAC7B,CAAC;AACH;AAEA,SAAS,eACP,SACmC;CACnC,sBAAgB,SAAS,CAAC,eAAe,SAAS,GAAG,uCAAuC;CAC5F,kBAAkB,QAAQ,WAAW;CACrC,IAAI,CAAC,OAAO,cAAc,QAAQ,OAAO,KAAK,QAAQ,UAAU,GAC9D,MAAM,IAAI,MAAM,yEAAyE;CAE3F,OAAO,OAAO,OAAO;EAAE,aAAa,QAAQ;EAAa,SAAS,QAAQ;CAAQ,CAAC;AACrF;AAEA,SAAS,UAAU,OAAmE;CACpF,sBACE,OACA;EAAC;EAAe;EAAW;EAAS;CAAa,GACjD,2BACF;CACA,IAAI,MAAM,YAAY,WAAW,KAAK,CAAC,OAAO,cAAc,MAAM,OAAO,KAAK,MAAM,UAAU,GAC5F,MAAM,IAAI,MAAM,+CAA+C;CAEjE,IAAI,CAAC,oBAAoB,KAAK,MAAM,KAAK,GACvC,MAAM,IAAI,MAAM,4CAA4C;CAE9D,wBAAwB,MAAM,aAAa,mBAAmB;CAC9D,OAAO,OAAO,OAAO;EACnB,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,OAAO,MAAM;EACb,aAAa,MAAM;CACrB,CAAC;AACH;AAEA,SAAS,SAAS,OAAmE;CACnF,OAAO,OAAO,OAAO;EACnB,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,OAAO,6BAA6B,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;EACxE,aAAa,MAAM;CACrB,CAAC;AACH;AAEA,SAAS,YAAY,OAAmD;CACtE,OAAO,OAAO,MAAM,KAAK;AAC3B;AAEA,SAAS,YACP,gBACA,qBACA,OACM;CACN,MAAM,WAAW,OAAO,KAAK,cAAc;CAC3C,MAAM,SAAS,OAAO,KAAK,YAAY,KAAK,CAAC;CAC7C,IACE,SAAS,WAAW,OAAO,UAC3B,CAAC,gBAAgB,UAAU,MAAM,KACjC,MAAM,gBAAgB,qBAEtB,MAAM,IAAI,MAAM,sCAAsC;AAE1D;AAEA,SAAS,UAAU,OAA8E;CAC/F,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,KAAK,UAAU,CAAC,MAAM,aAAa,MAAM,OAAO,CAAC,GAAG,MAAM,CAAC,CAClE,OAAO,KAAK;AACjB;AAEA,SAAS,yBACP,QACA,OAC0C;CAC1C,IAAI,MAAM,YAAY,GAAG,OAAO,KAAA;CAIhC,OAAO,eAAe,OAHR,OAAO,IACnB,UAAU;EAAE,aAAa,MAAM;EAAa,SAAS,MAAM,UAAU;CAAE,CAAC,CAEzC,CAAC;AACpC;AAEA,SAAS,eACP,OACA,OAM0C;CAC1C,IAAI,CAAC,OAAO,OAAO;CACnB,IACE,MAAM,gBAAgB,mCACtB,MAAM,MAAM,gBAAgB,MAAM,eAClC,MAAM,MAAM,gBAAgB,MAAM,eAClC,MAAM,MAAM,iBAAiB,MAAM,gBACnC,MAAM,MAAM,uBAAuB,MAAM,oBAEzC,OAAO;CAET,IAAI,CAAC,MAAM,UAAU,OAAO;CAC5B,IAAI,MAAM,SAAS,WAAW,aAAa,OAAO;CAClD,IAAI,MAAM,SAAS,MAAM,eAAe,GAAG,OAAO;CAClD,IAAI,MAAM,SAAS,iBAAiB,4BAClC,OAAO;AAGX;AAEA,SAAS,sBACP,UACA,WACoC;CACpC,OAAO,OAAO,OAAO;EACnB,UAAU;EACV,QAAQ;EACR,OAAO;EACP,aAAaC,2BAAyB,QAAQ,MAAMA,2BAAyB,SAAS;CACxF,CAAC;AACH;AAEA,SAAS,cACP,OACA,QACoC;CACpC,OAAO,OAAO,OAAO;EAAE,UAAU;EAAO,QAAQ;EAAsB;EAAO;CAAO,CAAC;AACvF;AAEA,eAAe,UAAU,MAAoC;CAC3D,MAAM,SAAS,MAAM,eAAe,MAAM,OAAO;CACjD,MAAM,SAAS;CACf,sBACE,QACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,GACA,gCAAgC,MAClC;CACA,MAAM,QAAQ,UAAU;EACtB,aAAa,cAAc,OAAO,aAAa,MAAM,aAAa;EAClE,SAAS,cAAc,OAAO,SAAS,MAAM,SAAS;EACtD,aAAa,cAAc,OAAO,aAAa,MAAM,aAAa;EAClE,aAAa,mBAAmB,OAAO,aAAa,IAAI;EACxD,cAAc,cAAc,OAAO,cAAc,MAAM,cAAc;EACrE,qBAAqB,cACnB,OAAO,qBACP,MACA,qBACF;EACA,qBAAqB,cACnB,OAAO,qBACP,MACA,qBACF;EACA,oBAAoB,cAClB,OAAO,oBACP,MACA,oBACF;EACA,kBAAkB,cAAc,OAAO,kBAAkB,MAAM,kBAAkB;EACjF,iBAAiB,cAAc,OAAO,iBAAiB,MAAM,iBAAiB;EAC9E,SAAS,cACP,OAAO,SACP,MACA,SACF;CACF,CAAC;CACD,MAAM,uBAAuB,cAC3B,OAAO,aACP,MACA,aACF;CACA,mBAAmB,sBAAsB,aAAa;CACtD,IAAI,OAAO,UAAU,WACnB,MAAM,IAAI,MAAM,gCAAgC,KAAK,2BAA2B;CAElF,OAAO;EAAE;EAAO,aAAa;EAAsB,OAAO;CAAU;AACtE;AAEA,eAAe,mBAAmB,MAAgD;CAChF,IAAI;EACF,OAAO,MAAM,UAAU,IAAI;CAC7B,SAAS,OAAO;EACd,IAAI,eAAe,KAAK,GAAG,OAAO,KAAA;EAClC,MAAM;CACR;AACF;AAEA,eAAe,aAAa,MAA8D;CACxF,MAAM,SAAS,MAAM,eAAe,MAAM,iBAAiB;CAC3D,MAAM,SAAS;CACf,sBAAgB,QAAQ,CAAC,UAAU,GAAG,0CAA0C,MAAM;CACtF,OAAO,wBACL,cAAc,OAAO,UAAU,MAAM,UAAU,GAC/C,0CAA0C,MAC5C;AACF;AAEA,eAAe,sBACb,MAC4D;CAC5D,IAAI;EACF,OAAO,MAAM,aAAa,IAAI;CAChC,SAAS,OAAO;EACd,IAAI,eAAe,KAAK,GAAG,OAAO,KAAA;EAClC,MAAM;CACR;AACF;AAMA,eAAe,wBACb,MACA,OACuD;CACvD,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,eAAe,MAAM,mBAAmB;CACzD,SAAS,OAAO;EACd,IAAI,eAAe,KAAK,GAAG,OAAO,KAAA;EAClC,MAAM;CACR;CACA,IAAI,OAAO,SAAS,6BAA6B;EAC/C,MAAM,SAAS;EACf,sBACE,QACA;GAAC;GAAQ;GAAe;GAAW;GAAuB;EAAO,GACjE,uCAAuC,MACzC;EACA,IACE,OAAO,gBAAgB,MAAM,eAC7B,OAAO,YAAY,MAAM,WACzB,OAAO,wBAAwB,MAAM,uBACrC,OAAO,UAAU,qBAEjB,MAAM,IAAI,MAAM,uCAAuC,KAAK,0BAA0B;EAExF,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,IAAI,OAAO,SAAS,wCAAwC;EAC1D,MAAM,SAAS;EACf,sBAAgB,QAAQ,CAAC,QAAQ,UAAU,GAAG,yCAAyC,MAAM;EAC7F,MAAM,WAAW,wBACf,cAAc,OAAO,UAAU,MAAM,UAAU,GAC/C,yCAAyC,MAC3C;EACA,2BAA2B,UAAU,OAAO,IAAI;EAChD,OAAO;GAAE,MAAM;GAAW;EAAS;CACrC;CACA,MAAM,IAAI,MAAM,4CAA4C,KAAK,kBAAkB;AACrF;AAEA,eAAe,eAAe,MAAc,MAAgD;CAC1F,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;CAClD,SAAS,OAAO;EACd,IAAI,eAAe,KAAK,GAAG,MAAM;EACjC,MAAM,IAAI,MAAM,uBAAuB,KAAK,MAAM,KAAK,iBAAiB,EAAE,OAAO,MAAM,CAAC;CAC1F;CACA,IAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GACvE,MAAM,IAAI,MAAM,uBAAuB,KAAK,MAAM,KAAK,kBAAkB;CAE3E,OAAO;AACT;AAEA,SAAS,eACP,UACA,WACA,MACM;CACN,IAAI,SAAS,gBAAgB,UAAU,eAAe,SAAS,YAAY,UAAU,SACnF,MAAM,IAAI,MAAM,iCAAiC,KAAK,+BAA+B;AAEzF;AAEA,SAAS,mBAAmB,OAAe,OAAqB;CAC9D,IAAI,CAAC,eAAe,KAAK,KAAK,GAC5B,MAAM,IAAI,MAAM,6BAA6B,MAAM,mCAAmC;AAE1F;AAEA,SAAS,cAAc,OAAgB,MAAc,OAAuB;CAC1E,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,iCAAiC,KAAK,eAAe,OAAO;CAE9E,OAAO;AACT;AAEA,SAAS,cAAc,OAAgB,MAAc,OAAuB;CAC1E,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,iCAAiC,KAAK,eAAe,OAAO;CAE9E,OAAO;AACT;AAEA,SAAS,cAAc,OAAgB,MAAc,OAAwC;CAC3F,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,iCAAiC,KAAK,eAAe,OAAO;CAE9E,OAAO;AACT;AAEA,SAAS,mBACP,OACA,MAC4C;CAC5C,IAAI,UAAU,UAAU,UAAU,iCAChC,MAAM,IAAI,MAAM,iCAAiC,KAAK,yBAAyB;CAEjF,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAyC;CAClE,IAAI,OAAO,UAAU,YAAY,CAAC,2BAA2B,KAAK,KAAK,GACrE,MAAM,IAAI,MAAM,kDAAkD;AAEtE;AAEA,SAAS,wBACP,OACA,OACA,WACyB;CACzB,IACE,OAAO,UAAU,YACjB,MAAM,WAAW,KACjB,MAAM,SAAS,aACf,oBAAoB,KAAK,GAEzB,MAAM,IAAI,MAAM,uBAAuB,MAAM,YAAY;AAE7D;AAEA,SAAS,oBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,OAAO,MAAQ,SAAS,KAAM,OAAO;CAC3C;CACA,OAAO;AACT;AAEA,SAAS,wBAAwB,OAAgB,OAAwC;CACvF,IAAI,CAAC,OAAO,cAAc,KAAK,KAAM,SAAoB,GACvD,MAAM,IAAI,MAAM,uBAAuB,MAAM,mCAAmC;AAEpF;AAEA,SAAS,YAAY,OAAqB;CACxC,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAC1C,MAAM,IAAI,MAAM,qEAAqE;AAEzF;AAEA,SAAS,qBAAqB,aAAqB,OAAqB;CACtE,YAAY,KAAK;CACjB,IAAI,SAAS,aAAa,MAAM,IAAI,MAAM,uCAAuC;AACnF;AAEA,SAAS,mBAAmB,aAAqB,OAAqB;CACpE,YAAY,KAAK;CACjB,IAAI,QAAQ,aAAa,MAAM,IAAI,MAAM,2CAA2C;AACtF;AAEA,SAAS,OAAO,OAA6B;CAC3C,OAAO,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,MAAM,CAAC,CAAC,OAAO,KAAK;AAC1E;AAEA,SAAS,eAAe,OAAyB;CAC/C,OAAO,YAAY,OAAO,QAAQ;AACpC;AAEA,SAAS,YAAY,OAAgB,MAAuB;CAC1D,OACE,UAAU,QACV,OAAO,UAAU,YACjB,UAAU,SACT,MAA6B,SAAS;AAE3C;AAEA,MAAa,8BAA8B,OAAO,OAAO;CACvD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;ACx5BD,MAAM,YAAY;;AASlB,SAAgB,kCACd,YACA,UACqC;CACrC,sBACE,YACA;EAAC;EAAiB;EAAe;EAAU;EAAqB;CAAO,GACvE,kBACF;CACA,IAAI,WAAW,WAAW,MAAM,MAAM,IAAI,MAAM,qCAAqC;CACrF,IAAI,WAAW,sBAAsB,MACnC,MAAM,IAAI,MAAM,gEAAgE;CAElF,IAAI,WAAW,gBAAgB,SAAS,aACtC,MAAM,IAAI,MAAM,wEAAwE;CAE1F,IAAI,WAAW,kBAAkB,SAAS,eACxC,MAAM,IAAI,MAAM,uEAAuE;CAEzF,IAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,GACjC,MAAM,IAAI,MAAM,mDAAmD;CAGrE,MAAM,0BAAU,IAAI,IAAY;CAChC,MAAM,0BAAU,IAAI,IAAY;CAChC,IAAI,uBAAuB;CAC3B,IAAI,eAAe;CACnB,IAAI,oBAAoB;CACxB,IAAI,kBAAkB;CACtB,IAAI,eAAe;CACnB,IAAI,iBAA6D;CACjE,MAAM,QAAQ,WAAW,MAAM,KAAK,QAAQ,UAAU;EACpD,sBACE,QACA;GACE;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF,GACA,yBAAyB,OAC3B;EACA,iBAAiB,OAAO,QAAQ,yBAAyB,MAAM,QAAQ;EACvE,iBAAiB,OAAO,cAAc,yBAAyB,MAAM,cAAc;EACnF,iBAAiB,OAAO,aAAa,yBAAyB,MAAM,aAAa;EACjF,IAAI,OAAO,gBAAgB,OAAO,cAChC,MAAM,IAAI,MAAM,yBAAyB,MAAM,4CAA4C;EAE7F,IAAI,OAAO,WAAW,eAAe,OAAO,WAAW,UACrD,MAAM,IAAI,MAAM,yBAAyB,MAAM,uBAAuB;EAExE,IAAI,QAAQ,IAAI,OAAO,MAAM,GAC3B,MAAM,IAAI,MAAM,mDAAmD;EACrE,IAAI,QAAQ,IAAI,OAAO,WAAW,GAChC,MAAM,IAAI,MAAM,yDAAyD;EAE3E,QAAQ,IAAI,OAAO,MAAM;EACzB,QAAQ,IAAI,OAAO,WAAW;EAC9B,IAAI,OAAO,UAAU,SAAS,OAC5B,MAAM,IAAI,MAAM,mCAAmC,MAAM,yBAAyB;EAEpF,gBAAgB,OAAO,aAAa,yBAAyB,MAAM,aAAa;EAChF,gBAAgB,OAAO,WAAW,yBAAyB,MAAM,WAAW;EAC5E,IAAI,OAAO,YAAY,OAAO,aAC5B,MAAM,IAAI,MAAM,yBAAyB,MAAM,yBAAyB;EAE1E,YAAY,OAAO,aAAa,yBAAyB,MAAM,aAAa;EAC5E,YAAY,OAAO,sBAAsB,yBAAyB,MAAM,sBAAsB;EAC9F,IAAI,OAAO,uBAAuB,OAAO,aACvC,MAAM,IAAI,MACR,yBAAyB,MAAM,sDACjC;EAEF,YAAY,OAAO,cAAc,yBAAyB,MAAM,cAAc;EAC9E,YAAY,OAAO,mBAAmB,yBAAyB,MAAM,mBAAmB;EACxF,oBAAoB,QAClB,mBACA,OAAO,mBACP,0BACF;EACA,YAAY,OAAO,iBAAiB,yBAAyB,MAAM,iBAAiB;EACpF,kBAAkB,QAAQ,iBAAiB,OAAO,iBAAiB,uBAAuB;EAC1F,YAAY,OAAO,cAAc,yBAAyB,MAAM,cAAc;EAC9E,IAAI,OAAO,mBAAmB,cAAc,OAAO,mBAAmB,aACpE,MAAM,IAAI,MAAM,yBAAyB,MAAM,gCAAgC;EAEjF,IAAI,OAAO,mBAAmB,aAAa,iBAAiB;EAC5D,uBAAuB,QACrB,sBACA,OAAO,sBACP,6BACF;EACA,eAAe,QAAQ,cAAc,OAAO,cAAc,oBAAoB;EAC9E,eAAe,QAAQ,cAAc,OAAO,cAAc,YAAY;EACtE,OAAO,OAAO,OAAO,EAAE,GAAG,OAAO,CAAC;CACpC,CAAC;CAED,MAAM,QAAQ,OAAO,OAAO;EAC1B;EACA,aAAa;EACb;EACA;EACA;EACA,YAAY,MAAM;EAClB;CACF,CAAC;CACD,OAAO,OAAO,OAAO;EACnB,OAAO,OAAO,OAAO;GACnB,eAAe,WAAW;GAC1B,aAAa,WAAW;GACxB,QAAQ;GACR,mBAAmB;GACnB,OAAO,OAAO,OAAO,KAAK;EAC5B,CAAC;EACD;CACF,CAAC;AACH;;;;;AAMA,eAAsB,wCACpB,YACA,OACA,YACe;CACf,MAAM,MAAM,MAAM,WAAW,OAAO,KAAK;CACzC,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,2DAA2D,OAAO;CAC5F,IAAI,IAAI,WAAW,aAAa,IAAI,YAAY,KAAA,GAC9C,MAAM,IAAI,MAAM,sEAAsE;CAExF,MAAM,WAAW,MAAM,WAAW,MAAM,EAAE,MAAM,CAAC;CACjD,IAAI,SAAS,KAAK,SAAS,GACzB,MAAM,IAAI,MACR,kFACF;CAEF,MAAM,cAAc,IAAI,IAAI,SAAS,KAAK,SAAS,KAAK,MAAM,CAAC;CAC/D,KAAK,MAAM,QAAQ,WAAW,MAAM,OAAO;EACzC,IAAI,YAAY,IAAI,KAAK,WAAW,GAClC,MAAM,IAAI,MACR,iEAAiE,KAAK,cACxE;EAEF,MAAM,WAAW,WAAW;GAC1B;GACA,QAAQ,KAAK;GACb,MAAM;GACN,MAAM;GACN,OAAO,KAAK;GACZ,UAAU,CAAC;GACX,WAAW,KAAK;GAChB,SAAS,KAAK;GACd,QAAQ,KAAK,WAAW,cAAc,OAAO;GAC7C,aAAa,KAAK;GAClB,cAAc,KAAK;GACnB,cAAc,KAAK;GACnB,iBAAiB,KAAK;GACtB,SAAS,KAAK,eAAe;GAC7B,YAAY;IACV,iCAAiC;IACjC,yBAAyB,KAAK;IAC9B,+BAA+B,KAAK;GACtC;EACF,CAAC;CACH;AACF;;AAGA,SAAgB,kCACd,OACA,YACM;CACN,IAAI,MAAM,WAAW,WAAW,MAAM,MAAM,QAC1C,MAAM,IAAI,MACR,+BAA+B,MAAM,OAAO,6BAA6B,WAAW,MAAM,MAAM,QAClG;CAEF,MAAM,OAAO,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC;CAC7D,IAAI,KAAK,SAAS,MAAM,QAAQ,MAAM,IAAI,MAAM,8CAA8C;CAC9F,KAAK,MAAM,QAAQ,WAAW,MAAM,OAAO;EACzC,MAAM,OAAO,KAAK,IAAI,KAAK,WAAW;EACtC,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,gDAAgD,KAAK,aAAa;EAEpF,gBAAgB,MAAM,IAAI;CAC5B;AACF;AAEA,SAAgB,WAAW,OAAe,OAAuB;CAC/D,IAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,qBAAqB;CACxF,MAAM,QAAQ,KAAK,MAAM,QAAQ,SAAS;CAC1C,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CACtF,OAAO;AACT;AAEA,SAAS,gBAAgB,MAAe,MAA+C;CACrF,IAAI,KAAK,UAAU,KAAK,OACtB,MAAM,IAAI,MAAM,wBAAwB,KAAK,OAAO,mCAAmC;CAEzF,IACE,KAAK,cAAc,KAAK,eACxB,KAAK,YAAY,KAAK,aACtB,KAAK,YAAY,KAAK,WAAW,cAAc,OAAO,UAEtD,MAAM,IAAI,MACR,wBAAwB,KAAK,OAAO,8CACtC;CAEF,IACE,KAAK,aAAa,qCAAqC,uBACvD,KAAK,aAAa,6BAA6B,KAAK,UACpD,KAAK,aAAa,mCAAmC,KAAK,cAE1D,MAAM,IAAI,MAAM,wBAAwB,KAAK,OAAO,oCAAoC;CAE1F,KAAK,MAAM,CAAC,MAAM,QAAQ,YAAY;EACpC;GAAC;GAAe,KAAK;GAAa,KAAK;EAAW;EAClD;GAAC;GAAgB,KAAK;GAAc,KAAK;EAAY;EACrD;GAAC;GAAqB,KAAK,gBAAgB;GAAG,KAAK;EAAiB;EACpE;GAAC;GAAmB,KAAK,mBAAmB;GAAG,KAAK;EAAe;CACrE,GACE,IAAI,WAAW,KAAA,KAAa,WAAW,SACrC,MAAM,IAAI,MACR,wBAAwB,KAAK,OAAO,GAAG,KAAK,GAAG,OAAO,+BAA+B,SACvF;CAGJ,IAAI,KAAK,YAAY,KAAA,GACnB,MAAM,IAAI,MAAM,wBAAwB,KAAK,OAAO,oBAAoB;CAE1E,MAAM,aAAa,WAAW,KAAK,SAAS,wBAAwB,KAAK,OAAO,SAAS;CACzF,IAAI,eAAe,KAAK,cACtB,MAAM,IAAI,MACR,wBAAwB,KAAK,OAAO,gBAAgB,WAAW,+BAA+B,KAAK,cACrG;AAEJ;AAEA,SAAS,iBAAiB,OAAgB,OAAwC;CAChF,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,KACpE,MAAM,IAAI,MAAM,GAAG,MAAM,oCAAoC;AAEjE;AAEA,SAAS,YAAY,OAAgB,OAAwC;CAC3E,IAAI,CAAC,OAAO,cAAc,KAAK,KAAM,QAAmB,GACtD,MAAM,IAAI,MAAM,GAAG,MAAM,oCAAoC;AAEjE;AAEA,SAAS,gBAAgB,OAAgB,OAAwC;CAC/E,IAAI,CAAC,OAAO,cAAc,KAAK,KAAM,SAAoB,GACvD,MAAM,IAAI,MAAM,GAAG,MAAM,iCAAiC;AAE9D;AAEA,SAAS,QAAQ,MAAc,OAAe,OAAuB;CACnE,MAAM,QAAQ,OAAO;CACrB,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CACvF,OAAO;AACT;;;AC/PA,MAAM,yCAAyB,IAAI,QAAwD;;AAG3F,MAAa,oCAAoC,OAAO,OAAO;CAC7D,UAAU,OAAO,OAAO,CAAC,aAAa,QAAQ,CAAU;CACxD,MAAM,OAAO,OAAO;EAAC;EAAY;EAAS;CAAW,CAAU;CAC/D,QAAQ,OAAO,OAAO,CAAC,YAAY,UAAU,CAAU;CACvD,WAAW;CACX,SAAS,OAAO,OAAO;EACrB,eAAe,OAAO,OAAO,CAAC,OAAO,CAAU;EAC/C,WAAW;EACX,OAAO;EACP,aAAa;EACb,OAAO;EACP,cAAc;CAChB,CAAC;AACH,CAAC;;AAGD,eAAsB,2BACpB,OACA,OACiC;CACjC,MAAM,SAAS,2BAA2B,MAAM,KAAK;CACrD,MAAM,gBAAgB,mBAAmB,MAAM;CAC/C,MAAM,eAAeC,2BAAyB,aAAa;CAC3D,IAAI,iBAAiB,OAAO,QAC1B,MAAM,IAAI,MAAM,2BAA2B,OAAO,OAAO,kBAAkB,cAAc;CAE3F,MAAM,iBAAiB,wBAAwB,aAAa;CAC5D,YAAY,gBAAgB,OAAO,QAAQ,eAAe,YAAY,kBAAkB;CACxF,uCAAuC,OAAO,OAAO;CAErD,MAAM,gCAAgB,IAAI,IAAwB;CAClD,MAAM,eAAe,OAAO,aAAkE;EAC5F,MAAM,MAAM,iBAAiB,QAAQ;EACrC,MAAM,WAAW,cAAc,IAAI,GAAG;EACtC,IAAI,UAAU,OAAO,WAAW,KAAK,QAAQ;EAC7C,MAAM,QAAQ,MAAM,qBAAqB,UAAU,MAAM,SAAS;EAClE,cAAc,IAAI,KAAK,WAAW,KAAK,KAAK,CAAC;EAC7C,OAAO;CACT;CAEA,IAAI;CACJ,IAAI,OAAO,KAAK,SAAS,aACvB,aAAa,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ;CAE5D,MAAM,mBAAmB,MAAM,oBAAoB,OAAO,MAAM,MAAM,cAAc,UAAU;CAE9F,MAAM,gCAAgB,IAAI,IAAwB;CAClD,KAAK,MAAM,YAAY,mBAAmB,MAAM,GAAG;EACjD,MAAM,QACJ,SAAS,SAAS,WACd,OAAO,KAAK,SAAS,SAAS,MAAM,IACpC,MAAM,4BAA4B,UAAU,MAAM,YAAY;EACpE,YACE,OACA,SAAS,QACT,SAAS,YACT,sBAAsB,SAAS,SAAS,SAAS,SAAS,WAAW,SAAS,OAAO,cACvF;EACA,cAAc,IAAI,YAAY,QAAQ,GAAG,WAAW,KAAK,KAAK,CAAC;EAC/D,cAAc,IAAI,SAAS,QAAQ,WAAW,KAAK,KAAK,CAAC;CAC3D;CAEA,IAAI,OAAO,UAAU,WAAW;EAC9B,MAAM,YAAY,MAAM,iCACtB,OAAO,UAAU,WACjB,MAAM,SACR;EACA,cAAc,IAAI,iBAAiB,OAAO,UAAU,UAAU,QAAQ,GAAG,UAAU,QAAQ;EAC3F,cAAc,IAAI,iBAAiB,OAAO,UAAU,UAAU,OAAO,GAAG,UAAU,OAAO;CAC3F;CACA,IAAI,OAAO,WAAW;EACpB,MAAM,YAAY,MAAM,iCACtB,OAAO,UAAU,UACjB,MAAM,SACR;EACA,cAAc,IAAI,iBAAiB,OAAO,UAAU,SAAS,QAAQ,GAAG,UAAU,QAAQ;EAC1F,cAAc,IAAI,iBAAiB,OAAO,UAAU,SAAS,OAAO,GAAG,UAAU,OAAO;EACxF,IAAI,OAAO,UAAU,iBAAiB,MAAM,aAAa,OAAO,UAAU,eAAe;EACzF,MAAM,aAAa,OAAO,UAAU,UAAU;CAChD;CACA,IAAI,OAAO,OAAO,SAAS,cAAc,OAAO,OAAO,MACrD,MAAM,aAAa,OAAO,OAAO,IAAI;CAEvC,oBAAoB,MAAM;CAC1B,MAAM,WAAW,OAAO,OAAO;EAC7B,QAAQ;EACR,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC5D,yBAAyB;CAC5B,CAAC;CACD,uBAAuB,IAAI,UAAU;EAAE;EAAO;EAAe;CAAc,CAAC;CAC5E,OAAO;AACT;AAEA,SAAgB,0BACd,WACwB;CACxB,MAAM,QAAQ,uBAAuB,IAAI,SAAS;CAClD,IAAI,CAAC,SAAS,UAAU,4BAA4B,MAClD,MAAM,IAAI,MAAM,qDAAqD;CAEvE,OAAO;AACT;AAEA,eAAsB,sBACpB,WACA,UACqB;CACrB,MAAM,QAAQ,0BAA0B,SAAS;CACjD,MAAM,MAAM,iBAAiB,QAAQ;CACrC,MAAM,WAAW,MAAM,cAAc,IAAI,GAAG;CAC5C,IAAI,UAAU,OAAO,WAAW,KAAK,QAAQ;CAC7C,MAAM,QAAQ,MAAM,qBAAqB,UAAU,MAAM,MAAM,SAAS;CACxE,MAAM,cAAc,IAAI,KAAK,WAAW,KAAK,KAAK,CAAC;CACnD,OAAO;AACT;AAeA,SAAgB,6BACd,WACmC;CACnC,MAAM,yBAAS,IAAI,IAA0B;CAC7C,KAAK,MAAM,YAAY,mBAAmB,UAAU,MAAM,GAAG;EAC3D,MAAM,QAAQ,0BAA0B,SAAS,CAAC,CAAC,cAAc,IAAI,SAAS,MAAM;EACpF,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,+CAA+C,SAAS,QAAQ;EAC5F,OAAO,IAAI,SAAS,QAAQ,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CACrF;CACA,OAAO;AACT;AAEA,SAAS,mBAAmB,QAA2D;CACrF,MAAM,YAAY,OAAO,QAAQ;CACjC,IAAI,CAAC,WAAW,OAAO,CAAC;CACxB,MAAM,SAAsC,CAAC;CAC7C,KAAK,MAAM,SAAS,UAAU,SAAS,CAAC,GAAG,OAAO,KAAK,MAAM,QAAQ;CACrE,OAAO,KAAK,GAAI,UAAU,SAAS,CAAC,CAAE;CACtC,OAAO,KAAK,GAAI,UAAU,UAAU,CAAC,CAAE;CACvC,OAAO,KAAK,GAAI,UAAU,UAAU,CAAC,CAAE;CACvC,OAAO,KAAK,GAAI,UAAU,YAAY,CAAC,CAAE;CACzC,IAAI,OAAO,UAAU,iBAAiB,UAAU,OAAO,KAAK,UAAU,YAAY;CAClF,OAAO;AACT;AAEA,SAAS,YAAY,UAA6C;CAChE,OAAOA,2BAAyB,QAAQ;AAC1C;;;;ACjLA,MAAa,+BAA+B;;AAE5C,MAAa,2CACX;;AAGF,SAAgB,iCACd,UACA,oBAC4C;CAC5C,IAAI,CAAC,MAAM,WAAW,QAAQ,KAAK,MAAM,UAAU,QAAQ,MAAM,UAC/D,MAAM,IAAI,MAAM,8DAA8D;CAEhF,MAAM,SAAS,MAAM,KAAK,UAAU,SAAS;CAC7C,OAAO;EACL,MAAM,MAAM,KAAK,QAAQ,WAAW;EACpC,GAAI,qBACA,EAAE,iBAAiB,MAAM,KAAK,QAAQ,iCAAiC,EAAE,IACzE,CAAC;CACP;AACF;;AAGA,eAAsB,+BACpB,WACA,OACA,KACsD;CACtD,MAAM,YAAY,UAAU,OAAO;CACnC,IAAI,CAAC,WAAW,OAAO,KAAA;CAEvB,MAAM,UAAU,MAAM,sBAAsB,WAAW,UAAU,SAAS,OAAO;CACjF,MAAM,kBAAkB,UAAU,kBAC9B,MAAM,sBAAsB,WAAW,UAAU,eAAe,IAChE,KAAA;CACJ,MAAM,OAAO,MAAM,QAAQ,KAAK,OAAO,GAAG,4BAA4B,CAAC;CACvE,IAAI;EACF,MAAM,MAAM,WAAW,YAAY;GACjC,MAAM;GACN,UAAU,UAAU;GACpB;GACA,aAAa;EACf,CAAC;EACD,MAAM,eACJ,QAAQ,aAAa,UAAU,UAAU,WAAW,UAAU,UAAU;EAC1E,MAAM,aAAa,UAAU,MAAM,kBAAkB,IAAI;EACzD,IAAI,eAAe,cACjB,MAAM,IAAI,MACR,gBAAgB,IAAI,2DAA2D,aAAa,QAAQ,YACtG;EAEF,MAAM,QAAQ,MAAM,+BAA+B,MAAM,UAAU,SAAS,QAAQ;EACpF,OAAO,OAAO,OAAO;GACnB,WAAW,UAAU;GACrB,UAAU,UAAU;GACpB,OAAO,OAAO,OACZ,MAAM,KAAK,SACT,OAAO,OAAO;IAAE,MAAM,KAAK;IAAM,MAAM,KAAK;IAAM,OAAO,WAAW,KAAK,KAAK,KAAK;GAAE,CAAC,CACxF,CACF;GACA,GAAI,kBAAkB,EAAE,iBAAiB,WAAW,KAAK,eAAe,EAAE,IAAI,CAAC;EACjF,CAAC;CACH,UAAU;EACR,MAAM,GAAG,MAAM;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACjD;AACF;;;ACzEA,MAAM,0BAAyC,OAAO,0CAA0C;;AAOhG,SAAgB,sCACd,OACmC;CACnC,MAAM,UAAU,cAAc,OAAO,6BAA6B;CAClE,sBAAgB,SAAS,CAAC,eAAe,aAAa,GAAG,6BAA6B;CACtF,IAAI,OAAO,QAAQ,gBAAgB,YAAY,QAAQ,YAAY,WAAW,GAC5E,MAAM,IAAI,MAAM,wDAAwD;CAE1E,OAAO,OAAO,OAAO;EACnB,aAAa,QAAQ;EACrB,aAAa,OAAO,OAAO,gCAAgC,MAAM,QAAQ,WAAW,CAAC;CACvF,CAAC;AACH;;AAGA,SAAgB,uCACd,OACA,iBAC0C;CAC1C,MAAM,UAAU,cAAc,OAAO,yBAAyB;CAC9D,sBAAgB,SAAS,CAAC,GAAG,2BAA2B;EACtD;EACA;EACA;CACF,CAAC;CAED,MAAM,cAAc,QAAQ,cACxB,uBAAuB,QAAQ,aAAa,eAAe,IAC3D,KAAA;CACJ,MAAM,cAAc,QAAQ,cAAc,kBAAkB,QAAQ,WAAW,IAAI,KAAA;CACnF,IAAI,QAAQ,aAAa,KAAA,KAAa,EAAE,QAAQ,oBAAoB,aAClE,MAAM,IAAI,MAAM,kDAAkD;CAEpE,MAAM,WAAW,QAAQ,WAAW,WAAW,KAAK,QAAQ,QAAQ,IAAI,KAAA;CACxE,OAAO,OAAO,OAAO;EACnB,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;EACrC,GAAI,cAAc,EAAE,aAAa,OAAO,OAAO,WAAW,EAAE,IAAI,CAAC;EACjE,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;GAC9B,0BAA0B;CAC7B,CAAC;AACH;;AAGA,SAAgB,8CAA8C,OAAsB;CAClF,MAAM,UAAU,cAAc,OAAO,gCAAgC;CACrE,sBAAgB,SAAS,CAAC,SAAS,GAAG,gCAAgC;CACtE,IAAI,QAAQ,YAAY,MACtB,MAAM,IAAI,MAAM,6DAA6D;AAEjF;AAEA,SAAS,kBACP,OACgE;CAChE,MAAM,UAAU,cAAc,OAAO,0BAA0B;CAC/D,sBAAgB,SAAS,CAAC,cAAc,SAAS,GAAG,0BAA0B;CAC9E,IAAI,EAAE,QAAQ,mBAAmB,aAC/B,MAAM,IAAI,MAAM,uDAAuD;CAEzE,OAAO,OAAO,OAAO;EACnB,YAAY,OAAO,OACjB,8CAA8C,MAAM,QAAQ,UAAU,CACxE;EACA,SAAS,WAAW,KAAK,QAAQ,OAAO;CAC1C,CAAC;AACH;AAEA,SAAS,uBACP,OACA,UACgE;CAChE,MAAM,UAAU,cAAc,OAAO,wBAAwB;CAC7D,IAAI,QAAQ,SAAS,UAAU;EAC7B,sBAAgB,SAAS,CAAC,QAAQ,OAAO,GAAG,+BAA+B;EAC3E,IAAI,SAAS,SAAS,UACpB,MAAM,IAAI,MAAM,sEAAsE;EAExF,IAAI,EAAE,QAAQ,iBAAiB,aAC7B,MAAM,IAAI,MAAM,yDAAyD;EAE3E,IAAI,QAAQ,MAAM,aAAa,SAAS,UACtC,MAAM,IAAI,MAAM,4CAA4C,SAAS,SAAS,cAAc;EAE9F,OAAO,OAAO,OAAO;GAAE,MAAM;GAAU,OAAO,WAAW,KAAK,QAAQ,KAAK;EAAE,CAAC;CAChF;CACA,sBACE,SACA;EAAC;EAAQ;EAAc;EAAc;EAAW;CAAS,GACzD,wBACF;CACA,IAAI,QAAQ,SAAS,aACnB,MAAM,IAAI,MAAM,oDAAoD;CAEtE,IAAI,SAAS,SAAS,aACpB,MAAM,IAAI,MAAM,oEAAoE;CAEtF,IACE,OAAO,QAAQ,eAAe,YAC9B,CAAC,kCAAkC,KAAK,QAAQ,UAAU,GAE1D,MAAM,IAAI,MAAM,0DAA0D;CAE5E,IAAI,EAAE,QAAQ,mBAAmB,eAAe,EAAE,QAAQ,mBAAmB,aAC3E,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,aAAa,8CAA8C,MAAM,QAAQ,UAAU;CACzF,OAAO,OAAO,OAAO;EACnB,MAAM;EACN,YAAY,QAAQ;EACpB,YAAY,OAAO,OAAO,UAAU;EACpC,SAAS,WAAW,KAAK,QAAQ,OAAO;EACxC,SAAS,WAAW,KAAK,QAAQ,OAAO;CAC1C,CAAC;AACH;AAEA,SAAS,cAAc,OAAgB,OAAwC;CAC7E,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAC5D,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CAE9C,OAAO;AACT;;;;AC7HA,eAAsB,+BACpB,MACA,OAMoC;CACpC,MAAM,QAAQ,eAAe;CAC7B,MAAM,QAAQ,WAAW,KAAK,MAAM,KAAK;CACzC,MAAM,iBAAiB,YAAY,KAAK;CACxC,MAAM,MAAM,gCAAgC,MAC1C,MAAM,KAAK,IAAI;EACb,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,OAAO,WAAW,KAAK,KAAK;EAC5B,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;CACjD,CAAC,CACH;CACA,MAAM,QAAQ,eAAe;CAC7B,IAAI,IAAI,WAAW,kBAAkB,IAAI,eAAe,MAAM,YAC5D,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG;CAClC,MAAM,QAAQ,eAAe;CAC7B,YAAY,QAAQ,gBAAgB,MAAM,YAAY,4BAA4B;CAClF,OAAO,wBAAwB,GAAG;AACpC;;;;ACgBA,eAAsB,0BACpB,OACA,SACA,YACA,eACA,YACA,UACA,iBACA,sBACA,QACwC;CACxC,IAAI;CACJ,IAAI;EACF,QAAQ,eAAe;EACvB,IAAI,QAAQ,gBAAgB,MAAM,aAChC,MAAM,IAAI,MAAM,sEAAsE;EAExF,cAAc,QAAQ;EACtB,IACE,YAAY,SAAS,aACrB,YAAY,cAAc,MAAM,cAAc,MAAM,SAAS,OAAO,WAEpE,MAAM,IAAI,MAAM,+DAA+D;EAGjF,MAAM,MAAM,MAAM,WAAW,OAAO,cAAc,KAAK;EACvD,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,mCAAmC,cAAc,OAAO;EAClF,IAAI,IAAI,WAAW,aAAa,IAAI,YAAY,KAAA,GAC9C,MAAM,IAAI,MAAM,qCAAqC;EAEvD,oBAAoB,IAAI,MAAM,cAAc,IAAI;EAEhD,MAAM,CAAC,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI;GAC3D,WAAW,MAAM,EAAE,OAAO,IAAI,MAAM,CAAC;GACrC,WAAW,OAAO,EAAE,OAAO,IAAI,MAAM,CAAC;GACtC,WAAW,OAAO,IAAI,KAAK;GAC3B,WAAW,UAAU,IAAI,KAAK;EAChC,CAAC;EACD,MAAM,eAAe,CAAC,GAAG,KAAK,CAAC,CAAC,MAC7B,GAAG,MAAM,EAAE,YAAY,EAAE,aAAa,eAAe,EAAE,QAAQ,EAAE,MAAM,CAC1E;EACA,MAAM,gBAAgB,CAAC,GAAG,MAAM,CAAC,CAAC,MAC/B,GAAG,MAAM,EAAE,YAAY,EAAE,aAAa,eAAe,EAAE,SAAS,EAAE,OAAO,CAC5E;EACA,MAAM,gBAAgB,CAAC,GAAG,MAAM,CAAC,CAAC,MAC/B,GAAG,MAAM,EAAE,YAAY,EAAE,aAAa,eAAe,EAAE,WAAW,EAAE,SAAS,CAChF;EACA,MAAM,mBAAmB,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,GAAG,MAC/C,eAAe,EAAE,YAAY,EAAE,UAAU,CAC3C;EAEA,MAAM,aAAa,aAAa,OAAO,SAAS;EAChD,kCAAkC,YAAY,UAAU;EACxD,MAAM,QAAQ,cAAc,OAAO,IAAI,WAAW,IAAI,SAAS,cAAc,UAAU;EACvF,MAAM,SAAS,MAAM,cACnB,OACA,SAAS,cACT,SAAS,iBAAiB,aAC1B,MACF;EACA,MAAM,WAAW,qBACf;GACE,KAAK;IAAE,GAAG;IAAK,kBAAkB;GAAkB;GACnD,OAAO;GACP,QAAQ;GACR,QAAQ;GACR,WAAW;EACb,GACA,eACF;EACA,MAAM,iBAAiB,EAAE,GAAI,sBAAsB,UAAU,CAAC,EAAG;EACjE,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO,MAAM,GAC/D,eAAe,SAAS,eAAe,SAAS,KAAK;EAYvD,MAAM,aAAa,wBAAwB;GATzC,GAAI,SAAS;GACb,iBAAiB,EAAE,iBAAiB,MAAM,gBAAgB;GAC1D,WAAW;IACT,SAAS;IACT,iBACG,sBAAsB,kBAAkB,KAAK,SAAS,OAAO;IAChE,QAAQ;GACV;EAEqD,CAAC;EACxD,uBAAuB,YAAY,eAAe;EAOlD,MAAM,QAAQ;GACZ,UAAU,MAPgB,+BAA+B,SAAS,iBAAiB;IACnF,aAAa,MAAM;IACnB,SAAS;IACT,OAAO;IACP;GACF,CAAC;GAGC,YACE,IACA,aAAa,SACb,cAAc,SACd,cAAc,SACd,iBAAiB;GACnB,gBAAgB,WAAW;EAC7B;EACA,MAAM,WAAW,2BAAqD;GACpE,MAAM;GACN,iBAAiB;GACjB,cAAc,MAAM,OAAO;GAC3B,eAAe,MAAM,cAAc,MAAM,SAAS,QAAQ;GAC1D,8BAA8B,MAAM,uBAAuB;GAC3D,qBAAqB,MAAM,cAAc,MAAM;GAC/C,QAAQ;IACN,aAAa,IAAI;IACjB,WAAW,IAAI;IACf,YAAY,IAAI,UAAU,IAAI;GAChC;GACA;GACA;GACA;GACA;GACA,iBAAiB,SAAS,iBAAiB;GAC3C,iBAAiB,SAAS;GAC1B,aAAa,SAAS,YAAY;GAClC,iBAAiB,SAAS;EAC5B,CAAC;EACD,+BAA+B,MAAM,SAAS,KAAK;EACnD,MAAM,aAAa,MAAM,+BAA+B,SAAS,iBAAiB;GAChF,aAAa,MAAM;GACnB,SAAS;GACT,OAAO,SAAS;GAChB;EACF,CAAC;EACD,OAAO;GACL,WAAW;GACX,SAAS;GACT,WAAW;IACT,iBAAiB,SAAS,gBAAgB;IAC1C,iBAAiB,SAAS,iBAAiB;IAC3C,aAAa,SAAS,YAAY,SAAS;IAC3C,iBAAiB,SAAS,gBAAgB;IAC1C;GACF;EACF;CACF,SAAS,OAAO;EACd,OAAO,EACL,GAAG,wBACD,OACA,sBACE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACrD,eACF,GACA,aACA,WAAW,KACb,EACF;CACF;AACF;AAEA,SAAS,oBACP,MACA,UACM;CACN,KAAK,MAAM,QAAQ,OAAO,OAAO,oBAAoB,GACnD,IAAI,OAAO,UAAU,SAAS,OAC5B,MAAM,IAAI,MAAM,0DAA0D,MAAM;AAGtF;AAEA,SAAS,cACP,OACA,WACA,SACA,OACA,YACQ;CACR,MAAM,SAAS,MAAM,cAAc,MAAM,SAAS;CAClD,MAAM,QAAQ,WAAW;CAIzB,MAAM,SAAS,UAAU;CACzB,IAAI,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,KAAK,SAAS,OAAO,WAC5D,MAAM,IAAI,MAAM,6BAA6B,OAAO,WAAW,OAAO,WAAW;CAEnF,MAAM,QAAQ,MAAM,QAAQ,SAAS,KAAK,SAAS,MAAM,CAAC,CAAC;CAC3D,MAAM,SAA0C;EAC9C;GAAC;GAAO,OAAO;GAAU;EAAY;EACrC;GAAC,MAAM;GAAY,OAAO;GAAe;EAAa;EACtD;GAAC,MAAM;GAAa,OAAO;GAAgB;EAAc;EACzD;GAAC,MAAM;GAAc,OAAO;GAAiB;EAAe;CAC9D;CACA,KAAK,MAAM,CAAC,QAAQ,OAAO,UAAU,QACnC,IAAI,SAAS,OAAO,MAAM,IAAI,MAAM,aAAa,MAAM,GAAG,OAAO,WAAW,OAAO;CAErF,IAAI,MAAM,eAAe,WAAW,OAAO,YAAY,mBAAmB,GACxE,MAAM,IAAI,MACR,sBAAsB,MAAM,eAAe,IAAc,WAAW,OAAO,YAC7E;CAEF,OAAO;AACT;AAEA,eAAe,cACb,OACA,SACA,WACA,QACsC;CACtC,QAAQ,eAAe;CACvB,IAAI,MAAM,OAAO,SAAS,YAAY;EACpC,IAAI,QAAQ,gBAAgB,KAAA,KAAa,cAAc,KAAA,GACrD,MAAM,IAAI,MAAM,8CAA8C;EAEhE,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,IAAI,CAAC,QAAQ,aAAa,MAAM,IAAI,MAAM,sDAAsD;CAChG,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,uDAAuD;CACvF,MAAM,aAAa,QAAQ,YAAY;CACvC,MAAM,gBAAgB,wBAAwB,UAAU;CACxD,MAAM,WAAW,8CAA8C,MAAM;EACnE,MAAM;EACN,QAAQ,YAAY,aAAa;EACjC,UAAU;EACV,UAAU,UAAU;EACpB,SAAS,UAAU;CACrB,CAAC;CACD,OAAO;EACL,MAAM;EACN,OAAO;EACP,oBAAoB,MAAM,OAAO;EACjC,qBAAqB,MAAM,OAAO,MAAM,SAAS;EACjD,mBAAmB,MAAM,OAAO,YAAY;EAC5C,YAAY;CACd;AACF;AAEA,SAAgB,wBACd,OACA,QACA,aACA,QAAyC,MACa;CACtD,OAAO;EACL,WAAW;EACX;EACA,SAAS;GACP,aAAa,MAAM;GACnB,cAAc,MAAM,OAAO;GAC3B,qBAAqB,MAAM,cAAc,MAAM;GAC/C,8BAA8B,MAAM,uBAAuB;GAC3D,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;EACvC;EACA;CACF;AACF;AAEA,SAAS,eAAe,GAAW,GAAmB;CACpD,OAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;AAClC;;;;;;;ACtRA,eAAsB,iCAAiC,OAQV;CAC3C,MAAM,QAAQ,eAAe;CAC7B,MAAM,aAAa,yBAAyB,MAAM,QAAQ,MAAM,cAAc;CAC9E,MAAM,sBAAsB,MAAM,qBAAqB,WAAW,UAAU,MAAM,SAAS;CAC3F,IAAI,oBAAoB,eAAe,GACrC,MAAM,IAAI,MAAM,2DAA2D;CAE7E,MAAM,+BAA+B,YAAY,mBAAmB;CACpE,MAAM,cAAc,wBAAwB,MAAM,WAAW;CAC7D,MAAM,MAAM,MAAM,OAAO;CACzB,MAAM,cAAc,KAAK,IAAI;CAC7B,MAAM,SAAS,MAAM,IACnB,OAAO,OAAO;EACZ,aAAa,MAAM;EACnB;EACA,SAAS,MAAM;EACf,gBAAgB,uBAAuB,mBAAmB;EAC1D,QAAQ,MAAM,UAAU,IAAI,gBAAgB,CAAC,CAAC;CAChD,CAAC,CACH;CACA,MAAM,YAAY,KAAK,IAAI,aAAa,KAAK,IAAI,CAAC;CAClD,MAAM,QAAQ,eAAe;CAC7B,wBAAwB,MAAM;CAE9B,MAAM,WAAW,WAAW,KAAK,OAAO,QAAQ;CAChD,MAAM,eAAe,YAAY,QAAQ;CACzC,IAAI,OAAO,QAAQ,yBAAyB,8BAC1C,MAAM,IAAI,MACR,gGACF;CAEF,IAAI,OAAO,QAAQ,sBAAsB,MAAM,QAAQ,SAAS,QAC9D,MAAM,IAAI,MACR,gFACF;CAEF,IAAI,OAAO,QAAQ,iBAAiB,cAClC,MAAM,IAAI,MAAM,+EAA+E;CAGjG,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR,SAAS,wBAAwB;GAC/B,OAAO,gBAAgB;GACvB,QAAQ;IACN;IACA;IACA,YAAY,YAAY;GAC1B;EACF,CAAC;EACD,YAAY,OAAO;EACnB;CACF,CAAC;AACH;AAEA,SAAS,yBACP,QACA,UAC2C;CAC3C,IAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,SAC1B,MAAM,IAAI,MAAM,+DAA+D;CAQjF,IAAIC,2BAAyB;EAL3B,MAAM,OAAO;EACb,SAAS,OAAO;EAChB,QAAQ;EACR,UAAU,OAAO;CAEe,CAAC,MAAMA,2BAAyB,QAAQ,GACxE,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO,wBAAwB,QAAQ;AACzC;AAEA,SAAS,kBAA4C;CACnD,OAAO;EACL,aAAa;EACb,cAAc;EACd,mBAAmB;EACnB,iBAAiB;EACjB,YAAY;EACZ,cAAc;EACd,gBAAgB;CAClB;AACF;AAEA,SAAS,uBAAuB,OAG9B;CACA,MAAM,SAAS,WAAW,KAAK,KAAK;CACpC,OAAO,OAAO,OAAO;EACnB,YAAY,OAAO;EACnB,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,MAAM;EAC/B;CACF,CAAC;AACH;AAEA,SAAS,wBACP,OACgF;CAChF,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,qDAAqD;CAEvE,MAAM,SAAS;CACf,MAAM,OAAO,OAAO,KAAK,MAAM,CAAC,CAAC,KAAK;CACtC,IACE,KAAK,WAAW,KAChB,KAAK,OAAO,aACZ,KAAK,OAAO,gBACZ,KAAK,OAAO,YAEZ,MAAM,IAAI,MAAM,+DAA+D;CAEjF,IAAI,EAAE,OAAO,oBAAoB,aAC/B,MAAM,IAAI,MAAM,mDAAmD;CAErE,IACE,OAAO,YAAY,QACnB,OAAO,OAAO,YAAY,YAC1B,MAAM,QAAQ,OAAO,OAAO,GAE5B,MAAM,IAAI,MAAM,sDAAsD;CAExE,MAAM,cAAc,OAAO,KAAK,OAAO,OAAO,CAAC,CAAC,KAAK;CACrD,IACE,YAAY,WAAW,KACvB,YAAY,OAAO,0BACnB,YAAY,OAAO,kBACnB,YAAY,OAAO,qBAEnB,MAAM,IAAI,MAAM,uEAAuE;AAE3F;;;;ACxIA,eAAsB,qCACpB,UACA,UACA,SACA,iBACA,QACiD;CACjD,MAAM,mBAAmB,QAAQ,WAC7B,MAAM,+BAA+B,iBAAiB;EACpD,aAAa,SAAS;EACtB,SAAS;EACT,OAAO,QAAQ;EACf;CACF,CAAC,IACD,KAAA;CACJ,MAAM,cAAc,QAAQ,cACxB,MAAM,mBACJ,SAAS,aACT,UACA,QAAQ,aACR,iBACA,MACF,IACA,KAAA;CACJ,MAAM,cAAc,QAAQ,cACxB,MAAM,wBACJ,SAAS,aACT,yBACA,wBACA,QAAQ,YAAY,YACpB,QAAQ,YAAY,SACpB,iBACA,MACF,IACA,KAAA;CACJ,MAAM,QAAQ,wBAAwB;EACpC,MAAM;EACN,qBAAqB,SAAS;EAC9B,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;EAC/C,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;EACrC,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;CACvC,CAAC;CACD,MAAM,WAAW,MAAM,+BAA+B,iBAAiB;EACrE,aAAa,SAAS;EACtB,SAAS;EACT;EACA;CACF,CAAC;CACD,OAAO,OAAO,OAAO;EACnB;EACA,GAAI,cAAc,EAAE,aAAa,OAAO,OAAO,WAAW,EAAE,IAAI,CAAC;EACjE,GAAI,cAAc,EAAE,aAAa,OAAO,OAAO,WAAW,EAAE,IAAI,CAAC;CACnE,CAAC;AACH;AAEA,eAAe,mBACb,aACA,UACA,SACA,iBACA,QAC6C;CAC7C,IAAI,QAAQ,SAAS,UAAU;EAC7B,IAAI,SAAS,SAAS,UACpB,MAAM,IAAI,MAAM,gDAAgD;EAClE,MAAM,WAAW,MAAM,+BAA+B,iBAAiB;GACrE;GACA,SAAS;GACT,OAAO,QAAQ;GACf;EACF,CAAC;EACD,OAAO;GACL,MAAM;GACN,MAAM;IAAE,WAAW,SAAS;IAAW,UAAU,SAAS;GAAS;GACnE;EACF;CACF;CACA,IAAI,SAAS,SAAS,aACpB,MAAM,IAAI,MAAM,mDAAmD;CAErE,MAAM,YAAY,MAAM,wBACtB,aACA,iBACA,gBACA,QAAQ,YACR,QAAQ,SACR,iBACA,MACF;CACA,MAAM,UAAU,MAAM,+BAA+B,iBAAiB;EACpE;EACA,SAAS;EACT,OAAO,QAAQ;EACf;CACF,CAAC;CACD,OAAO;EAAE,MAAM;EAAa,YAAY,QAAQ;EAAY,GAAG;EAAW;CAAQ;AACpF;AAEA,eAAe,wBACb,aACA,iBACA,gBACA,YACA,cACA,iBACA,QAKC;CACD,MAAM,gBAAgB,wBAAwB,UAAU;CACxD,MAAM,CAAC,UAAU,WAAW,MAAM,QAAQ,IAAI,CAC5C,+BAA+B,iBAAiB;EAC9C;EACA,SAAS;EACT,OAAO;EACP;CACF,CAAC,GACD,+BAA+B,iBAAiB;EAC9C;EACA,SAAS;EACT,OAAO;EACP;CACF,CAAC,CACH,CAAC;CACD,OAAO;EAAE;EAAY;EAAU;CAAQ;AACzC;;;;AC1GA,eAAsB,gCACpB,OACA,YACA,iBACiD;CACjD,OAAO,MAAM,wCACX;EACE,aAAa,MAAM;EACnB,qBAAqB,MAAM,cAAc,MAAM;EAC/C,eAAe,MAAM;CACvB,GACA,YACA,eACF;AACF;;AAGA,eAAsB,wCACpB,UAKA,YACA,iBACiD;CACjD,MAAM,WAAW;EACf,MAAM;EACN,qBAAqB,SAAS;EAC9B,eAAe,WAAW,MAAM;EAChC,aAAa,WAAW,MAAM;EAC9B,QAAQ;EACR,mBAAmB,WAAW,MAAM;EACpC,UAAU,SAAS;EACnB,OAAO,WAAW,MAAM,MAAM,KAAK,UAAU;GAC3C,QAAQ,KAAK;GACb,cAAc,KAAK;GACnB,aAAa,KAAK;GAClB,QAAQ,KAAK;GACb,OAAO,KAAK;GACZ,aAAa,KAAK;GAClB,WAAW,KAAK;GAChB,aAAa,KAAK;GAClB,sBAAsB,KAAK;GAC3B,cAAc,KAAK;GACnB,mBAAmB,KAAK,qBAAqB;GAC7C,iBAAiB,KAAK,mBAAmB;GACzC,cAAc,KAAK;GACnB,gBAAgB,KAAK;EACvB,EAAE;EACF,OAAO,WAAW;CACpB;CACA,MAAM,QAAQ,wBAAwB,QAAQ;CAC9C,MAAM,SAAS,YAAY,KAAK;CAChC,MAAM,WAAW,MAAM,+BAA+B,iBAAiB;EACrE,aAAa,SAAS;EACtB,SAAS;EACT;CACF,CAAC;CACD,OAAO,wBACL,4CAA4C,MAAM;EAChD,MAAM;EACN;EACA;EACA;CACF,CAAC,CACH;AACF;;AAGA,eAAsB,6CACpB,OACA,SACA,iBACA,iBACA,QAIC;CACD,QAAQ,eAAe;CACvB,MAAM,cAAc,QAAQ;CAC5B,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,qDAAqD;CACvF,IAAI,QAAQ,UAAU,uBAAuB,QAAQ,UAAU,eAAe;CAC9E,MAAM,WAAW,MAAM,cAAc;CACrC,IAAI,YAAY,SAAS,SAAS,MAChC,MAAM,IAAI,MACR,sBAAsB,YAAY,KAAK,mCAAmC,SAAS,KAAK,SAC1F;CAEF,MAAM,WACJ,YAAY,SAAS,YAAY,SAAS,SAAS,WAC/C,wBAAwB,YAAY,OAAO,UAAU,eAAe,IACpE,YAAY,SAAS,eAAe,SAAS,SAAS,cACpD,MAAM,2BAA2B,OAAO,aAAa,iBAAiB,MAAM,IAC5E,KAAA;CACR,IAAI,CAAC,UAAU,MAAM,IAAI,MAAM,mDAAmD;CAClF,MAAM,oBAAoB,OAAO,SAAS,iBAAiB,MAAM;CAEjE,MAAM,mBAAmB,MAAM,qCAC7B;EACE,aAAa,MAAM;EACnB,qBAAqB,MAAM,cAAc,MAAM;CACjD,GACA,UACA,SACA,iBACA,MACF;CACA,MAAM,YAAY,iBAAiB;CACnC,IAAI,CAAC,aAAa,UAAU,SAAS,SAAS,MAC5C,MAAM,IAAI,MAAM,qCAAqC;CAEvD,MAAM,cACJ,SAAS,SAAS,YAAY,UAAU,SAAS,WAC7C,MAAM,iCAAiC,OAAO,UAAU,WAAW,iBAAiB,MAAM,IAC1F,SAAS,SAAS,eAAe,UAAU,SAAS,cAClD,MAAM,oCACJ,OACA,UACA,WACA,iBACA,MACF,IACA,KAAA;CACR,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,mDAAmD;CACrF,OAAO,OAAO,OAAO;EAAE;EAAkB;CAAY,CAAC;AACxD;AAgBA,eAAe,2BACb,OACA,SACA,iBACA,QACuC;CACvC,MAAM,aAAa,MAAM,cAAc;CACvC,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,uDAAuD;CACxF,MAAM,QAAQ,WAAW,KAAK,QAAQ,OAAO;CAC7C,MAAM,UAAU,WAAW,KAAK,QAAQ,OAAO;CAC/C,IAAI,QAAQ,eAAe,GAAG,MAAM,IAAI,MAAM,wCAAwC;CACtF,uBAAuB,OAAO,eAAe;CAC7C,uBAAuB,SAAS,eAAe;CAC/C,MAAM,aAAa,wBAAwB,QAAQ,UAAU;CAC7D,MAAM,WAAW,MAAM,uBAAuB;EAC5C,gBAAgB,MAAM,MAAM,QAAQ;EACpC,YAAY,WAAW;EACvB,UAAU,WAAW;EACrB,YAAY,QAAQ;EACpB;EACA;CACF,CAAC;CACD,QAAQ,eAAe;CACvB,MAAM,gBAAgB,wBAAwB,UAAU;CACxD,uBAAuB,eAAe,eAAe;CAQrD,MAAM,yBAAyB,OAPH,8CAA8C,MAAM;EAC9E,MAAM;EACN,QAAQ,YAAY,aAAa;EACjC,UAAU;EACV,UAAU,0BAA0B,aAAa;EACjD,SAAS,0BAA0B,OAAO;CAC5C,CACwD,GAAG,SAAS,eAAe;CACnF,QAAQ,eAAe;CACvB,OAAO;EACL,MAAM;EACN;EACA;EACA;EACA;EACA,cAAc,SAAS;EACvB,YAAY,SAAS;EACrB;CACF;AACF;AAEA,eAAe,oCACb,OACA,UACA,WACA,iBACA,QAC4C;CAC5C,MAAM,EAAE,YAAY,eAAe,OAAO,eAAe;CACzD,MAAM,WAAW,8CAA8C,MAAM;EACnE,MAAM;EACN,QAAQ,YAAY,aAAa;EACjC,UAAU;EACV,UAAU,UAAU;EACpB,SAAS,UAAU;CACrB,CAAC;CAyBD,MAAM,WAAW,MAAM,2BAA2B,OAAO;EAvBvD,MAAM;EACN,qBAAqB,MAAM,cAAc,MAAM;EAC/C,SAAS;GACP,MAAM;GACN,gBAAgB;IACd,UAAU,WAAW;IACrB,cAAc,WAAW;IACzB,QAAQ,WAAW;IACnB,MAAM,WAAW;GACnB;GACA,kBAAkB;IAChB,UAAU,WAAW;IACrB,cAAc,WAAW;IACzB,QAAQ,SAAS;IACjB,MAAM,SAAS;GACjB;GACA,YAAY;GACZ,SAAS;IACP,QAAQ;IACR,UAAU,UAAU;GACtB;EACF;CAE8D,GAAG,iBAAiB,MAAM;CAC1F,MAAM,cAAc,WAAW,KAAK,KAAK;CACzC,OAAO,OAAO,OAAO;EACnB,MAAM;EACN;EACA,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,WAAW;EACpC;GACC,2BAA2B;CAC9B,CAAC;AACH;AAQA,SAAS,wBACP,eACA,UACA,iBAC2B;CAC3B,IAAI,cAAc,eAAe,GAAG,MAAM,IAAI,MAAM,uCAAuC;CAC3F,IAAI,cAAc,aAAa,SAAS,UACtC,MAAM,IAAI,MAAM,4CAA4C,SAAS,SAAS,cAAc;CAE9F,MAAM,SAAS,WAAW,KAAK,aAAa;CAC5C,uBAAuB,QAAQ,eAAe;CAC9C,OAAO;EACL,MAAM;EACN,OAAO;EACP,MAAM;GAAE,WAAW,SAAS;GAAW,UAAU,SAAS;EAAS;CACrE;AACF;AAEA,eAAe,iCACb,OACA,UACA,WACA,iBACA,QAC4C;CAC5C,IACE,UAAU,KAAK,cAAc,SAAS,KAAK,aAC3C,UAAU,KAAK,aAAa,SAAS,KAAK,UAE1C,MAAM,IAAI,MAAM,4DAA4D;CAW9E,MAAM,WAAW,MAAM,2BAA2B,OAAO;EARvD,MAAM;EACN,qBAAqB,MAAM,cAAc,MAAM;EAC/C,SAAS;GACP,MAAM;GACN,MAAM,SAAS;GACf,UAAU,UAAU;EACtB;CAE8D,GAAG,iBAAiB,MAAM;CAC1F,MAAM,eAAe,WAAW,KAAK,SAAS,KAAK;CACnD,OAAO,OAAO,OAAO;EACnB,MAAM;EACN;EACA,MAAM,wBAAwB,SAAS,IAAI;EAC3C,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,YAAY;EACrC;GACC,2BAA2B;CAC9B,CAAC;AACH;AAEA,eAAe,2BACb,OACA,UACA,iBACA,QAMA;CACA,MAAM,QAAQ,wBAAwB,QAAQ;CAC9C,MAAM,SAAS,YAAY,KAAK;CAChC,MAAM,WAAW,MAAM,+BAA+B,iBAAiB;EACrE,aAAa,MAAM;EACnB,SAAS;EACT;EACA;CACF,CAAC;CACD,OAAO,wBACL,wCAAwC,MAAM;EAC5C,MAAM;EACN;EACA;EACA;CACF,CAAC,CACH;AAIF;;AAGA,eAAsB,gCACpB,OACA,aACA,SACA,QACA,iBACA,iBACA,QACiD;CACjD,QAAQ,eAAe;CACvB,MAAM,oBAAoB,wBAAwB,WAAW;CAC7D,MAAM,SAAS,MAAM,iCAAiC;EACpD,aAAa,MAAM;EACnB,aAAa;EACb;EACA,gBAAgB,MAAM,cAAc;EACpC;EACA,WAAW;EACX;CACF,CAAC;CACD,QAAQ,eAAe;CACvB,MAAM,aAAa,oBAAoB,OAAO,YAAY,iBAAiB;CAC3E,MAAM,cAAc,WAAW,KAAK,OAAO,QAAQ;CACnD,IAAI,YAAY,eAAe,GAAG,MAAM,IAAI,MAAM,8CAA8C;CAChG,uBAAuB,aAAa,eAAe;CACnD,MAAM,cAAc,MAAM,+BAA+B,iBAAiB;EACxE,aAAa,MAAM;EACnB,SAAS;EACT,OAAO;EACP;CACF,CAAC;CACD,MAAM,WAAW;EACf,MAAM;EACN,qBAAqB,MAAM,cAAc,MAAM;EAC/C,mBAAmB,QAAQ,SAAS;EACpC,QAAQ,OAAO;EACf,UAAU;EACV,SAAS,OAAO;EAChB,OAAO,WAAW;EAClB,QAAQ,WAAW;EACnB,YAAY,WAAW;CACzB;CACA,MAAM,QAAQ,wBAAwB,QAAQ;CAC9C,MAAM,SAAS,YAAY,KAAK;CAChC,MAAM,WAAW,MAAM,+BAA+B,iBAAiB;EACrE,aAAa,MAAM;EACnB,SAAS;EACT;EACA;CACF,CAAC;CACD,OAAO,wBACL,4CAA4C,MAAM;EAChD,MAAM;EACN;EACA;EACA;CACF,CAAC,CACH;AACF;AAEA,eAAe,yBACb,OACA,UACA,SACA,iBACe;CACf,MAAM,OAAO,MAAM,QAAQ,KAAK,OAAO,GAAG,+BAA+B,CAAC;CAC1E,IAAI;EACF,MAAM,MAAM,MAAM,WAAW,YAAY;GACvC,MAAM;GACN;GACA,SAAS,WAAW,KAAK,OAAO;GAChC,aAAa;EACf,CAAC;EACD,MAAM,QAAQ,MAAM,+BAA+B,MAAM,SAAS,QAAQ;EAC1E,KAAK,MAAM,QAAQ,OAAO,uBAAuB,KAAK,OAAO,eAAe;CAC9E,UAAU;EACR,MAAM,GAAG,MAAM;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACjD;AACF;AAEA,eAAe,oBACb,OACA,SACA,iBACA,QACe;CACf,IAAI,MAAM,OAAO,SAAS,YAAY;EACpC,IAAI,QAAQ,aAAa,MAAM,IAAI,MAAM,8CAA8C;EACvF;CACF;CACA,MAAM,SAAS,QAAQ;CACvB,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,sDAAsD;CACnF,IAAI,OAAO,QAAQ,eAAe,GAAG,MAAM,IAAI,MAAM,yCAAyC;CAC9F,MAAM,gBAAgB,wBAAwB,OAAO,UAAU;CAC/D,uBAAuB,eAAe,eAAe;CACrD,uBAAuB,OAAO,SAAS,eAAe;CACtD,MAAM,WAAW,8CAA8C,MAAM;EACnE,MAAM;EACN,QAAQ,YAAY,aAAa;EACjC,UAAU,OAAO;EACjB,UAAU,0BAA0B,aAAa;EACjD,SAAS,0BAA0B,OAAO,OAAO;CACnD,CAAC;CACD,MAAM,OAAO,MAAM,QAAQ,KAAK,OAAO,GAAG,+BAA+B,CAAC;CAC1E,IAAI;EACF,MAAM,MAAM,MAAM,WAAW,YAAY;GACvC,MAAM;GACN;GACA,SAAS,WAAW,KAAK,OAAO,OAAO;GACvC,aAAa;EACf,CAAC;EACD,MAAM,QAAQ,MAAM,+BAA+B,MAAM,OAAO,UAAU;EAC1E,KAAK,MAAM,QAAQ,OAAO,uBAAuB,KAAK,OAAO,eAAe;EAC5E,QAAQ,eAAe;CACzB,UAAU;EACR,MAAM,GAAG,MAAM;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACjD;AACF;AAEA,SAAS,oBACP,YACA,aACwF;CACxF,IAAI,CAAC,cAAc,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,GAC3E,MAAM,IAAI,MAAM,kDAAkD;CAEpE,gBAAgB,WAAW,OAAO,2BAA2B;CAC7D,IAAI,WAAW,WAAW,KAAA,KAAa,OAAO,WAAW,WAAW,WAClE,MAAM,IAAI,MAAM,4CAA4C;CAE9D,MAAM,YAAY,YAAY,SAAS,UAAU,YAAY,aAAa;CAC1E,MAAM,aAAa,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,CAAC,CAC3D,KAAK,CAAC,MAAM,WAAW;EACtB,IAAI,CAAC,iCAAiC,KAAK,IAAI,GAC7C,MAAM,IAAI,MAAM,oDAAoD,MAAM;EAE5E,gBAAgB,OAAO,iCAAiC,MAAM;EAC9D,OAAO;GAAE;GAAM,OAAO,YAAY,QAAQ;EAAE;CAC9C,CAAC,CAAC,CACD,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;CAC5D,OAAO;EACL,OAAO,YAAY,WAAW,QAAQ;EACtC,QAAQ,cAAc,WAAW,UAAU,WAAW,QAAQ;EAC9D;CACF;AACF;AAEA,SAAS,gBAAgB,OAAgB,OAAwC;CAC/E,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,KAAK,QAAQ,GAC/E,MAAM,IAAI,MAAM,GAAG,MAAM,kCAAkC;AAE/D;;;;AChhBA,SAAgB,yCACd,OACA,iBACoC;CACpC,MAAM,WAAW,8BAA8B,eAAe;CAC9D,MAAM,gCAAgB,IAAI,IAAmB;CAC7C,IAAI,gBAAgB;CACpB,MAAM,SAAS,cAAkD;EAC/D,IAAI,CAAC,eACH,OAAO,QAAQ,uBAAO,IAAI,MAAM,mCAAmC,CAAC;EAEtE,IAAI;EACJ,IAAI;GACF,UAAU,UAAU;EACtB,SAAS,OAAO;GACd,OAAO,QAAQ,OAAO,KAAK;EAC7B;EACA,IAAI;EACJ,UAAU,QAAQ,cAAc,cAAc,OAAO,OAAO,CAAC;EAC7D,cAAc,IAAI,OAAO;EACzB,OAAO;CACT;CACA,MAAM,QAAQ,OAAO,OAAmB;EACtC,YAAY,QAAQ,YAAY,MAAM,UAAU,SAAS,OAAO,GAAG,CAAC,CAAC;EACrE,YAAY,OAAO,UACjB,YAAY,MAAM,UAAU,SAAS,WAAW,KAAK,GAAG,SAAS,OAAO,KAAK,CAAC,CAAC;EACjF,aAAa,SACX,MAAM,YAAY;GAChB,IAAI,KAAK,SAAS,OAChB,MAAM,IAAI,MAAM,yDAAyD;GAE3E,MAAM,MAAM,WAAW,SAAS,OAAO,IAAI,CAAC;EAC9C,CAAC;EACH,aAAa,QAAQ,UACnB,MAAM,YAAY;GAChB,IAAI,MAAM,SAAS,OACjB,MAAM,IAAI,MAAM,yDAAyD;GAE3E,MAAM,MAAM,WAAW,SAAS,WAAW,MAAM,GAAG,SAAS,OAAO,KAAK,CAAC;EAC5E,CAAC;EACH,cAAc,UAAU,YAAY,MAAM,YAAY,SAAS,OAAO,KAAK,CAAC,CAAC;EAC7E,iBAAiB,aAAa,YAAY,MAAM,eAAe,SAAS,OAAO,QAAQ,CAAC,CAAC;EACzF,oBAAoB,UAAU,YAAY,MAAM,kBAAkB,SAAS,OAAO,KAAK,CAAC,CAAC;EACzF,QAAQ,OAAO,UAAU,MAAM,OAAO,SAAS,WAAW,KAAK,CAAC;EAChE,UAAU,OAAO,WAAW,MAAM,SAAS,SAAS,SAAS,MAAM,MAAM,IAAI,KAAA,CAAS;EACtF,OAAO,OAAO,WAAW,MAAM,MAAM,SAAS,SAAS,MAAM,MAAM,IAAI,KAAA,CAAS;EAChF,QAAQ,OAAO,WAAW,MAAM,OAAO,SAAS,SAAS,MAAM,MAAM,IAAI,KAAA,CAAS;EAClF,QAAQ,OAAO,UAAU,MAAM,OAAO,SAAS,WAAW,KAAK,CAAC;EAChE,WAAW,OAAO,UAAU,MAAM,UAAU,SAAS,WAAW,KAAK,CAAC;CACxE,CAAC;CACD,OAAO,OAAO,OAAO;EACnB;EACA,aAAa,YAAY;GACvB,gBAAgB;GAChB,MAAM,QAAQ,IAAI,CAAC,GAAG,aAAa,CAAC;EACtC;EACA,WAAW,UAAkC,SAAS,cAAc,KAAK;EACzE,cAAc,SAAS,OAAO;CAChC,CAAC;AACH;;AAGA,IAAa,mCAAb,MAAoE;CACrC;CAA7B,YAAY,OAAoC;EAAnB,KAAA,QAAA;CAAoB;CAEjD,YAA2B;EACzB,OAAO,KAAK,YAAY;CAC1B;CAEA,YAA2B;EACzB,OAAO,KAAK,YAAY;CAC1B;CAEA,aAA4B;EAC1B,OAAO,KAAK,YAAY;CAC1B;CAEA,aAA4B;EAC1B,OAAO,KAAK,YAAY;CAC1B;CAEA,cAA6B;EAC3B,OAAO,KAAK,YAAY;CAC1B;CAEA,iBAAgC;EAC9B,OAAO,KAAK,YAAY;CAC1B;CAEA,oBAAmC;EACjC,OAAO,KAAK,YAAY;CAC1B;CAEA,OAAO,GAAG,MAA0E;EAClF,OAAO,KAAK,MAAM,OAAO,GAAG,IAAI;CAClC;CAEA,SAAS,GAAG,MAA8E;EACxF,OAAO,KAAK,MAAM,SAAS,GAAG,IAAI;CACpC;CAEA,MAAM,GAAG,MAAwE;EAC/E,OAAO,KAAK,MAAM,MAAM,GAAG,IAAI;CACjC;CAEA,OAAO,GAAG,MAA0E;EAClF,OAAO,KAAK,MAAM,OAAO,GAAG,IAAI;CAClC;CAEA,OAAO,GAAG,MAA0E;EAClF,OAAO,KAAK,MAAM,OAAO,GAAG,IAAI;CAClC;CAEA,UAAU,GAAG,MAAgF;EAC3F,OAAO,KAAK,MAAM,UAAU,GAAG,IAAI;CACrC;CAEA,cAAsC;EACpC,OAAO,QAAQ,uBAAO,IAAI,MAAM,yDAAyD,CAAC;CAC5F;AACF;;;;ACzDA,eAAsB,8BACpB,UACA,SACwC;CACxC,MAAM,eAAe,iCAAiC,QAAQ;CAC9D,MAAM,mBAAmB,wBACvB,QAAQ,oBAAoB,aAAa,gBAC3C;CACA,IAAI,mBAAmB,aAAa,kBAClC,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,kBAAkB,uBACtB,QAAQ,mBAAmB,aAAa,iBACxC,aAAa,eACf;CACA,IAAI,kBAAkB,aAAa,iBACjC,MAAM,IAAI,MAAM,+DAA+D;CAEjF,IAAI;CACJ,IAAI;EACF,QAAQ,4BAA4B,QAAQ;CAC9C,SAAS,OAAO;EACd,OAAO,wBAAwB,cAAcC,eAAa,KAAK,CAAC;CAClE;CAEA,IAAI;EAGF,MAAM,kCAAkC,KAAK;CAC/C,SAAS,OAAO;EACd,OAAO,MAAM,qBAAqB,UAAU,OAAO,OAAO,UAAU,gBAAgB;CACtF;CAEA,IAAI;CACJ,IAAI;EACF,MAAM,CAAC,eAAe,0BAA0B,MAAM,QAAQ,IAAI,CAChE,+BAA+B,QAAQ,iBAAiB;GACtD,aAAa,MAAM;GACnB,SAAS;GACT,OAAO,MAAM,cAAc;EAC7B,CAAC,GACD,+BAA+B,QAAQ,iBAAiB;GACtD,aAAa,MAAM;GACnB,SAAS;GACT,OAAO,MAAM,uBAAuB;EACtC,CAAC,CACH,CAAC;EACD,sBAAsB,OAAO,OAAO;GAAE;GAAe;EAAuB,CAAC;CAC/E,SAAS,OAAO;EACd,OAAO,MAAM,qBAAqB,UAAU,OAAO,OAAO,UAAU,gBAAgB;CACtF;CAEA,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,QAAQ,WAAW,SAClC,wBAAwB,UAAU,mBAAmB,CACvD;CACF,SAAS,OAAO;EACd,OAAO,MAAM,qBAAqB,UAAU,OAAO,OAAO,UAAU,gBAAgB;CACtF;CACA,IAAI,CAAC,SAAS,UACZ,OAAO,MAAM,qBACX,UACA,uBACA,IAAI,MACF,SAAS,WAAW,uBAChB,8CAA8C,SAAS,WACvD,gDACN,GACA,YACA,gBACF;CAGF,6BAA6B,QAAQ;CACrC,MAAM,kBAAkB,yBAAyB,kBAAkB,eAAe;CAIlF,MAAM,eACJ,SAAS,MAAM,mBACf,yBAAyB,MAAM,kBAAkB,MAAM,eAAe;CACxE,MAAM,sBAAsB,eAAe;CAC3C,IACE,KAAK,IAAI,KAAK,gBACd,eAAe,MAAM,0BACrB,sBAAsB,SAAS,MAAM,aAErC,OAAO,MAAM,qBACX,UACA,OACA,SAAS,OACT,QAAQ,YACR,QAAQ,iCACR,IAAI,MAAM,wEAAwE,GAClF,UACA,kBACA,0BACF;CAEF,IAAI;CACJ,IAAI;EACF,MAAM,YAAY,MAAM,qCAEpB,MAAM,MAAM,OAAO,cAAc;GAC/B,aAAa,MAAM;GACnB,eAAe,MAAM;GACrB,aAAa,MAAM,iBAAiB;GACpC,UAAU,MAAM;GAChB;EACF,CAAC,GACH,KAAK,IAAI,cAAc,yBAAyB,gBAAgB,CAAC,GACjE,4BACF;EACA,aAAa,OAAO,OAAO,EAAE,KAAK,OAAO,OAAO,EAAE,GAAG,UAAU,IAAI,CAAC,EAAE,CAAC;CACzE,SAAS,OAAO;EACd,OAAO,MAAM,qBACX,UACA,OACA,SAAS,OACT,QAAQ,YACR,QAAQ,iBACR,IAAI,MAAM,qCAAqC,EAAE,OAAO,MAAM,CAAC,GAC/D,UACA,kBACA,0BACF;CACF;CAEA,IAAI;CACJ,IAAI,MAAM,OAAO,SAAS,YACxB,IAAI;EACF,MAAM,cAAc,MAAM;EAC1B,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,wCAAwC;EAC1E,MAAM,YAAY,MAAM,qCAEpB,MAAM,MAAM,OAAO,SAAS;GAC1B,aAAa,MAAM;GACnB,eAAe,YAAY;GAC3B,cAAc,YAAY;GAC1B,oBAAoB,YAAY;GAChC;EACF,CAAC,GACH,KAAK,IAAI,cAAc,yBAAyB,gBAAgB,CAAC,GACjE,4BACF;EACA,mBAAmB,OAAO,OAAO,EAAE,KAAK,OAAO,OAAO,EAAE,GAAG,UAAU,IAAI,CAAC,EAAE,CAAC;CAC/E,SAAS,OAAO;EACd,OAAO,MAAM,qBACX,UACA,OACA,SAAS,OACT,QAAQ,YACR,QAAQ,iBACR,IAAI,MAAM,qCAAqC,EAAE,OAAO,MAAM,CAAC,GAC/D,UACA,kBACA,4BACA,UACF;CACF;CAGF,IAAI;CACJ,IAAI;EACF,UAAU,0BAA0B,UAAU,YAAY,gBAAgB,CAAC,CAAC;CAC9E,SAAS,OAAO;EACd,OAAO,MAAM,qBACX,UACA,OACA,SAAS,OACT,QAAQ,YACR,QAAQ,iBACR,OACA,UACA,kBACA,4BACA,YACA,gBACF;CACF;CAEA,IAAI;EAEF,KAAI,MADgB,QAAQ,WAAW,oBAAoB,SAAS,KAAK,EAAA,CAC/D,UAAU,qBAClB,MAAM,IAAI,MAAM,6DAA6D;CAEjF,SAAS,OAAO;EACd,OAAO,MAAM,qBACX,UACA,OACA,SAAS,OACT,QAAQ,YACR,QAAQ,iBACR,IAAI,MAAM,gDAAgD,EAAE,OAAO,MAAM,CAAC,GAC1E,UACA,kBACA,4BACA,YACA,gBACF;CACF;CACA,IAAI,KAAK,IAAI,KAAK,cAChB,OAAO,MAAM,qBACX,UACA,OACA,SAAS,OACT,QAAQ,YACR,QAAQ,iCACR,IAAI,MAAM,wEAAwE,GAClF,UACA,kBACA,WACA,YACA,gBACF;CAGF,MAAM,kBAAkB,2BAA2B,YAAY,gBAAgB;CAC/E,MAAM,iBAAiB,yCACrB,QAAQ,YACR,eACF;CACA,MAAM,iBAAiB,eAAe,SAAS,MAAM,KAAK;CAC1D,MAAM,YAAY,MAAM,mBACtB,QAAQ,UACR,SACA,MAAM,cAAc,SACpB,eAAe,OACf,cACA,gBACF;CACA,iCAAiC,QAAQ;CACzC,MAAM,sBAAsB,yBAAyB,gBAAgB;CAErE,MAAM,eACJ,UAAU,SAAS,aAAa,UAAU,aAAa,SAAS,YAC5D,YACA,UAAU,SAAS,YACjB,cACA;CACR,MAAM,eAAe,qCACb,eAAe,YAAY,GACjC,qBACA,+BACF,CAAC,CAAC,YACO;EAAE,QAAQ;EAAe,OAAO,KAAA;CAAU,KAChD,WAAoB;EAAE,QAAQ;EAAgB;CAAM,EACvD;CACA,MAAM,CAAC,YAAY,aAAa,oBAAoB,MAAM,QAAQ,IAAI;EACpE;EACA,kBAAkB,OAAO,cAAc,mBAAmB;EAC1D,iBAAiB,OAAO,cAAc,mBAAmB;CAC3D,CAAC;CACD,IACE,CAAC,UAAU,kBACX,CAAC,WAAW,UACZ,CAAC,iBAAiB,cAClB,CAAC,YAAY,QACb;EACA,kCAAkC,UAAU,QAAQ;EACpD,OAAO,wBACL,OACA,sBACE,WACE,UAAU,OACV,CAAC,UAAU,iCACP,IAAI,MAAM,6CAA6C,IACvD,KAAA,GACJ,WAAW,OACX,YAAY,OACZ,iBAAiB,UACd,CAAC,iBAAiB,6BAAa,IAAI,MAAM,yBAAyB,IAAI,KAAA,oBACzE,IAAI,MAAM,uEAAuE,CACnF,GACA,eACF,GACA,UAAU,aACV,iBAAiB,YAAY,SAAS,IACxC;CACF;CAEA,IAAI;CACJ,IAAI;EACF,kBAAkB,MAAM,qCAEpB,gCACE,OACA,iBAAiB,YACjB,QAAQ,eACV,GACF,yBAAyB,gBAAgB,GACzC,wCACF;CACF,SAAS,OAAO;EACd,kCAAkC,UAAU,QAAQ;EACpD,OAAO,wBACL,OACA,sBACE,WACE,uBACA,IAAI,MAAM,0EAA0E,CACtF,GACA,eACF,GACA,UAAU,aACV,iBAAiB,WAAW,KAC9B;CACF;CAEA,IAAI;CACJ,MAAM,eACJ,UAAU,SAAS,UAAU,cAAc;CAC7C,IAAI,UAAU,SAAS,SACrB,SAAS,wBACP,OACA,sBAAsBA,eAAa,UAAU,KAAK,GAAG,eAAe,GACpE,UAAU,aACV,iBAAiB,WAAW,KAC9B;MACK,IAAI,CAAC,UAAU,aAAa,aACjC,SAAS,wBACP,OACA,8DACA,UAAU,aACV,iBAAiB,WAAW,KAC9B;MACK;EACL,MAAM,UACJ,UAAU,SAAS,YACf,UAAU,UACV;GACE,aAAa,MAAM;GACnB,aAAa,UAAU;EACzB;EACN,IAAI;GAKF,SAAS,MAAM,8BACb,OAAO,WAAW;IAChB,MAAM,wCACJ,QAAQ,YACR,eAAe,OACf,iBAAiB,UACnB;IACA,MAAM,EAAE,kBAAkB,gBACxB,MAAM,6CACJ,OACA,UAAU,cACV,QAAQ,iBACR,iBACA,MACF;IACF,MAAM,kBAAkB,MAAM,gCAC5B,OACA,QAAQ,aACR,aACA,QAAQ,QACR,QAAQ,iBACR,iBACA,MACF;IACA,OAAO,MAAM,0BACX,OACA,SACA,QAAQ,YACR,gBACA,iBAAiB,YACjB;KACE,cAAc,UAAU;KACxB;KACA;KACA;KACA;KACA,iBAAiB,QAAQ;IAC3B,GACA,iBACA,eAAe,OAAO,GACtB,MACF;GACF,GA9CyB,KAAK,IAC9B,KAAK,IAAI,IAAI,iBACb,SAAS,MAAM,cAAc,0BAA0B,gBAAgB,CA6CtD,GACjB,iCACF;EACF,SAAS,OAAO;GACd,SAAS,wBACP,OACA,sBAAsBA,eAAa,KAAK,GAAG,eAAe,GAC1D,UAAU,aACV,iBAAiB,WAAW,KAC9B;EACF;CACF;CAEA,IAAI;CACJ,IAAI;EACF,WAAW,OAAO,YACd;GACE,QAAQ;GACR,OAAO,iBAAiB,WAAW;GACnC,iBAAiB,OAAO,UAAU;GAClC,aAAa,OAAO,UAAU;GAC9B,iBAAiB,OAAO,UAAU;GAClC,YAAY,OAAO,UAAU;EAC/B,IACA;GACE,QAAQ;GACR;GACA,OAAO,iBAAiB,WAAW;GACnC,iBAAiB,gBAAgB;GACjC,iBAAiB,MAAM,qCAEnB,uBACE,OACA,OAAO,QACP,cACA,UAAU,aACV,QAAQ,eACV,GACF,SAAS,MAAM,aACf,wCACF;EACF;CACN,SAAS,OAAO;EACd,kCAAkC,UAAU,QAAQ;EACpD,OAAO,wBACL,OACA,sBACE,WACE,uBACA,IAAI,MAAM,wEAAwE,CACpF,GACA,eACF,GACA,UAAU,aACV,iBAAiB,WAAW,KAC9B;CACF;CAQA,IAAI,MANmB,YACrB,QAAQ,YACR,SAAS,OACT,UACA,SAAS,MAAM,WACjB,GACc;EACZ,kCAAkC,UAAU,OAAO,YAAY,cAAc,QAAQ;EACrF,OAAO;CACT;CAEA,kCAAkC,UAAU,QAAQ;CACpD,OAAO,wBACL,OACA,8DACA,UAAU,aACV,iBAAiB,WAAW,KAC9B;AACF;AA0BA,eAAe,mBACb,UACA,SACA,iBACA,YACA,cACA,kBAC0B;CAC1B,MAAM,YAAY,QAAQ,WAAW;CACrC,MAAM,eAAe,IAAI,gCAAgC,SAAS;CAClE,IAAI,KAAK,IAAI,KAAK,cAChB,OAAO;EACL,MAAM;EACN,OAAO;EACP,aAAa;GAAE,MAAM;GAAW;EAAU;EAC1C,gBAAgB;CAClB;CAEF,MAAM,aAAa,IAAI,gBAAgB;CACvC,IAAI;CACJ,IAAI,WAAW;CACf,IAAI;CACJ,IAAI;CACJ,MAAM,mBAAmB,QAAQ,QAAQ,CAAC,CAAC,WACzC,SAAS,QAAQ,SAAS;EACxB;EACA,QAAQ,WAAW;EACnB;CACF,CAAC,CACH;CAGA,iBAAsB,YAAY,KAAA,CAAS;CAC3C,MAAM,kBAAkB,IAAI,SAAgB,UAAU,WAAW;EAC/D,QAAQ,iBACA;GACJ,WAAW;GACX,WAAW,MAAM,YAAY;GAC7B,OAAO,YAAY;EACrB,GACA,KAAK,IAAI,GAAG,eAAe,KAAK,IAAI,CAAC,CACvC;CACF,CAAC;CACD,gBAAqB,YAAY,KAAA,CAAS;CAC1C,IAAI;EACF,UAAU,sCACR,MAAM,QAAQ,KAAK,CAAC,kBAAkB,eAAe,CAAC,CACxD;CACF,SAAS,OAAO;EACd,iBAAiB;CACnB;CAEA,IAAI,CAAC,YAAY,WAAW,QAAQ,gBAAgB,QAAQ,aAAa;EACvE,iCAAiB,IAAI,MAAM,2DAA2D;EACtF,UAAU,KAAA;CACZ,OAAO,IAAI,CAAC,YAAY,WAAW,KAAK,IAAI,KAAK,cAAc;EAG7D,WAAW;EACX,iBAAiB;EACjB,UAAU,KAAA;CACZ,OAAO,IAAI,CAAC,YAAY,SAAS,YAAY,SAAS,WAAW;EAC/D,iCAAiB,IAAI,MAAM,6DAA6D;EACxF,UAAU,KAAA;CACZ;CAEA,IAAI,CAAC,WAAW,UAAU,WAAW,MAAM,cAAc;CACzD,MAAM,aAAa,WAAW,YAAY,UAAU,cAAc;CAClE,MAAM,sBAAsB,KAAK,IAAI,IAAI;CACzC,IAAI;EAkBF,8CAA8C,MAjBxB,gCACnB,kBACC,SAAS,KACP;GACE,aAAa,QAAQ;GACrB,qBAAqB,QAAQ,cAAc,MAAM;EACnD,GACA;GACE;GACA,QAAQ;GACR,QAAQ;GACR,cAAc;EAChB,CACF,GACF,qBACA,+BACF,CACqD;CACvD,SAAS,WAAW;EAClB,IAAI;EACJ,IAAI;GACF,MAAM,gBAAgB,UAAU,SAAS,mBAAmB;EAC9D,SAAS,OAAO;GACd,gBAAgB;EAClB;EACA,IAAI,OAAO,aAAa,KAAK;EAC7B,WAAW,MAAM,SAAS;EAC1B,OAAO;GACL,MAAM;GACN,OAAO,IAAI,MAAM,WAAW,gBAAgB,WAAW,aAAa,CAAC;GACrE,GAAI,WAAW,EAAE,aAAa;IAAE,MAAM;IAAW;GAAU,EAAE,IAAI,CAAC;GAClE,gBAAgB;EAClB;CACF;CAEA,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,eAAe,uCACb,MAAM,gCACH,kBACC,SAAS,QACP;GACE,aAAa,QAAQ;GACrB,qBAAqB,QAAQ,cAAc,MAAM;EACnD,GACA;GACE;GACA,QAAQ;EACV,CACF,GACF,qBACA,kCACF,GACA,eACF;CACF,SAAS,cAAc;EACrB,oBAAoB;CACtB;CAEA,IAAI;CACJ,IAAI;EACF,MAAM,gBAAgB,UAAU,SAAS,mBAAmB;CAC9D,SAAS,cAAc;EACrB,gBAAgB;CAClB;CACA,IAAI,qBAAqB,iBAAiB,CAAC,cAAc;EACvD,IAAI,OAAO,aAAa,KAAK;EAC7B,WAAW,MAAM,qBAAqB,aAAa;EACnD,OAAO;GACL,MAAM;GACN,OAAO,IAAI,MAAM,WAAW,gBAAgB,mBAAmB,aAAa,CAAC;GAC7E,GAAI,WAAW,EAAE,aAAa;IAAE,MAAM;IAAW;GAAU,EAAE,IAAI,CAAC;GAClE,gBAAgB;EAClB;CACF;CAEA,IAAI,KAAK,IAAI,KAAK,cAAc;EAC9B,WAAW;EACX,iBAAiB;EACjB,UAAU,KAAA;EACV,WAAW,MAAM,YAAY;CAC/B;CACA,IAAI,OAAO,aAAa,KAAK;CAE7B,IAAI,UACF,OAAO;EACL,MAAM;EACN,aAAa;GAAE,MAAM;GAAW;EAAU;EAC1C;EACA,gBAAgB;CAClB;CAEF,IAAI,kBAAkB,CAAC,SACrB,OAAO;EACL,MAAM;EACN,OAAO,kCAAkB,IAAI,MAAM,wCAAwC;EAC3E;EACA,gBAAgB;CAClB;CAEF,OAAO;EACL,MAAM;EACN;EACA,aAAa,QAAQ;EACrB;EACA,gBAAgB;CAClB;AACF;AAEA,eAAe,gBACb,UACA,SACA,qBACe;CACf,MAAM,UAAU,SAAS;CACzB,IAAI,CAAC,SAAS;CACd,MAAM,WAAW,MAAM,gCACpB,kBACC,QAAQ,KACN,UACA;EACE,aAAa,QAAQ;EACrB,qBAAqB,QAAQ,cAAc,MAAM;CACnD,GACA,EAAE,QAAQ,cAAc,CAC1B,GACF,qBACA,uCACF;CACA,IAAI,UAAU,aAAa,QAAQ,OAAO,KAAK,QAAQ,CAAC,CAAC,MAAM,QAAQ,QAAQ,UAAU,GACvF,MAAM,IAAI,MAAM,0DAA0D;AAE9E;AAEA,eAAe,qBACb,UACA,OACA,OACA,QACA,kBACwC;CACxC,iCAAiC,QAAQ;CACzC,MAAM,sBAAsB,yBAAyB,gBAAgB;CACrE,MAAM,CAAC,aAAa,WAAW,MAAM,QAAQ,IAAI,CAC/C,kBAAkB,OAAO,QAAQ,mBAAmB,GACpD,iBAAiB,OAAO,QAAQ,mBAAmB,CACrD,CAAC;CACD,MAAM,gBAAgB,YAAY,UAAU,QAAQ,eAAe,KAAA;CACnE,kCAAkC,UAAU,gBAAgB,WAAW,gBAAgB;CACvF,OAAO,wBACL,OACA,sBACE,WACE,OACA,YAAY,OACZ,QAAQ,OACR,CAAC,gCACG,IAAI,MAAM,2EAA2E,IACrF,KAAA,CACN,GACA,CAAC,CACH,GACA,KAAA,GACA,QAAQ,YAAY,SAAS,IAC/B;AACF;AAEA,eAAe,qBACb,UACA,OACA,OACA,YACA,iBACA,OACA,QACA,kBACA,cACA,YACA,kBACwC;CACxC,iCAAiC,QAAQ;CACzC,MAAM,sBAAsB,yBAAyB,gBAAgB;CACrE,MAAM,CAAC,aAAa,WAAW,MAAM,QAAQ,IAAI,CAC/C,kBAAkB,OAAO,QAAQ,mBAAmB,GACpD,iBAAiB,OAAO,QAAQ,mBAAmB,CACrD,CAAC;CACD,MAAM,kBAAkB,2BAA2B,YAAY,gBAAgB;CAC/E,MAAM,aAAa,sBACjB,WAAW,OAAO,YAAY,OAAO,QAAQ,KAAK,GAClD,eACF;CACA,IAAI,eAAe;CACnB,IAAI;CACJ,IAAI,QAAQ,cAAc,YAAY,QACpC,IAAI;EACF,MAAM,kBAAkB,MAAM,qCACtB,gCAAgC,OAAO,QAAQ,YAAa,eAAe,GACjF,MAAM,aACN,gDACF;EACA,MAAM,kBAAkB,MAAM,qCACtB,uBAAuB,OAAO,YAAY,cAAc,KAAA,GAAW,eAAe,GACxF,MAAM,aACN,gDACF;EACA,eAAe,CAAE,MAAM,YACrB,YACA,OACA;GACE,QAAQ;GACR;GACA,OAAO,QAAQ,WAAW;GAC1B,iBAAiB,gBAAgB;GACjC;EACF,GACA,MAAM,WACR;CACF,SAAS,kBAAkB;EACzB,eAAe;EACf,qBAAqB;CACvB;CAEF,kCAAkC,UAAU,QAAQ;CACpD,OAAO,wBACL,OACA,sBACE,WACE,YACA,oBACA,YAAY,OACZ,QAAQ,OACR,CAAC,YAAY,UAAU,CAAC,QAAQ,6BAC5B,IAAI,MAAM,uEAAuE,IACjF,KAAA,GACJ,+BACI,IAAI,MAAM,4DAA4D,IACtE,KAAA,CACN,GACA,eACF,GACA,KAAA,GACA,QAAQ,YAAY,SAAS,IAC/B;AACF;AAEA,eAAe,kBACb,OACA,QACA,qBACkF;CAClF,IAAI,MAAM,OAAO,SAAS,YAAY,OAAO,EAAE,QAAQ,KAAK;CAC5D,IAAI;EACF,MAAM,cAAc,MAAM;EAC1B,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,wCAAwC;EAC1E,MAAM,SAAS,MAAM,qCAEjB,MAAM,MAAM,OAAO,MAAM;GACvB,aAAa,MAAM;GACnB,eAAe,YAAY;GAC3B,cAAc,YAAY;GAC1B,oBAAoB,YAAY;GAChC;EACF,CAAC,GACH,qBACA,yBACF;EACA,IAAI,OAAO,WAAW,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,QAAQ,QAAQ,QAAQ,GAC9E,MAAM,IAAI,MAAM,oDAAoD;EAEtE,OAAO,EAAE,QAAQ,KAAK;CACxB,SAAS,OAAO;EACd,OAAO;GAAE,QAAQ;GAAO;EAAM;CAChC;AACF;AAEA,eAAe,iBACb,OACA,QACA,qBAIC;CACD,IAAI;EAaF,OAAO,EACL,YAAY,kCAAkC,MAb5B,qCAEhB,MAAM,MAAM,OAAO,YAAY;GAC7B,aAAa,MAAM;GACnB,eAAe,MAAM;GACrB,aAAa,MAAM,iBAAiB;GACpC,UAAU,MAAM;GAChB;EACF,CAAC,GACH,qBACA,4BACF,GAEuD;GACnD,eAAe,MAAM;GACrB,aAAa,MAAM,iBAAiB;GACpC,OAAO,MAAM,cAAc;EAC7B,CAAC,EACH;CACF,SAAS,OAAO;EACd,OAAO,EAAE,OAAO,IAAI,MAAM,qCAAqC,EAAE,OAAO,MAAM,CAAC,EAAE;CACnF;AACF;AAEA,eAAe,YACb,OACA,OACA,UACA,cACkB;CAClB,IAAI;EACF,MAAM,SAAS,MAAM,qCACb,MAAM,cAAc,OAAO,QAAQ,GACzC,gBAAgB,MAAM,aACtB,4BACF;EACA,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,aAAa,OAAO;EAClD,MAAM,SAAS,MAAM,qCACb,MAAM,OAAO,OAAO,OAAO,SAAS,cAAc,GACxD,gBAAgB,MAAM,aACtB,gCACF;EACA,OAAO,OAAO,YAAY,OAAO;CACnC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAe,uBACb,OACA,QACA,cACA,aACA,iBACA;CACA,MAAM,QAAQ,wBAAwB;EACpC,MAAM;EACN,aAAa,MAAM;EACnB,cAAc,MAAM,OAAO;EAC3B,qBAAqB,MAAM,cAAc,MAAM;EAC/C;EACA;EACA,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;CACvC,CAAC;CACD,OAAO,MAAM,+BAA+B,iBAAiB;EAC3D,aAAa,MAAM;EACnB,SAAS;EACT;CACF,CAAC;AACH;AAEA,SAAS,2BACP,YACA,kBACU;CACV,OAAO,CAAC,GAAG,OAAO,OAAO,YAAY,OAAO,CAAC,CAAC,GAAG,GAAG,OAAO,OAAO,kBAAkB,OAAO,CAAC,CAAC,CAAC;AAChG;AAEA,SAAS,WAAW,GAAG,QAA2B;CAChD,OAAO,OACJ,QAAQ,UAAU,UAAU,KAAA,CAAS,CAAC,CACtC,IAAIA,cAAY,CAAC,CACjB,KAAK,IAAI;AACd;AAEA,SAASA,eAAa,OAAwB;CAC5C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,IAAM,kCAAN,cAA8C,MAAM;CAClD,YAAY,WAAmB;EAC7B,MAAM,0CAA0C,UAAU,YAAY;EACtE,KAAK,OAAO;CACd;AACF;;;ACv6BA,MAAM,yBAAyB,KAAK;AACpC,MAAM,0BAA0B,IAAI;;AASpC,eAAsB,+BACpB,WACA,MACA,OACA,UAAiD,CAAC,GACR;CAC1C,MAAM,mBAAmB,wBAAwB,QAAQ,gBAAgB;CAEzE,4BADsB,0BAA0B,SACR,CAAC,CAAC,OAAO,KAAK;CACtD,MAAM,SAAS,UAAU;CACzB,IAAI,KAAK,QAAQ,iBAAiB,OAAO,QACvC,MAAM,IAAI,MAAM,6DAA6D;CAE/E,MAAM,gBAAgB,KAAK;CAC3B,MAAM,UAAU;EACd,QAAQ,KAAK,QAAQ;EACrB,aAAa,cAAc,QAAQ;EACnC,aAAa,cAAc,QAAQ;CACrC;CACA,gBAAgB,MAAM,OAAO,UAAU,mBAAmB;CAC1D,MAAM,kBAAkB,uBACtB,QAAQ,iBACR,cAAc,OAAO,SACvB;CAMA,MAAM,sBALgB,gCACpB,cAAc,OAAO,WACrB,kBACA,eAEsC,IAAI;CAC5C,IAAI,sBAAA,YACF,MAAM,IAAI,MAAM,gEAAgE;CAElF,+BAA+B,IAAI;CAEnC,MAAM,mBAAmB,OAAO,KAAK,cAAc,aAAa,MAAM;CAEtE,MAAM,gBAAgB,MAAM,iCAC1B,cAAc,WACd,MAAM,SACR;CACA,MAAM,MAAM,WAAW,YAAY;EACjC,MAAM;EACN,UAAU,cAAc;EACxB,SAAS,cAAc;EACvB,aAAa,KAAK,aAAa;CACjC,CAAC;CACD,MAAM,4BAA4B,KAAK,aAAa,UAAU,cAAc,UAAU,UAAU,EAC9F,6BAA6B,CAAC,QAAQ,UAAU,EAClD,CAAC;CACD,IAAI,cAAc,YAChB,MAAM,mBAAmB,KAAK,aAAa,UAAU,cAAc,UAAU;CAE/E,MAAM,oBAAoB,MAAM,+BAC9B,KAAK,aAAa,UAClB,cAAc,UAAU,UACxB,EAAE,6BAA6B,CAAC,QAAQ,UAAU,EAAE,CACtD;CAEA,IAAI;CACJ,IAAI;CAGJ,IAAI,OAAO,UAAU,WAAW;EAC9B,IAAI,CAAC,KAAK,aAAa,iBAAiB,CAAC,KAAK,eAAe,eAC3D,MAAM,IAAI,MAAM,wEAAwE;EAE1F,mBAAmB,MAAM,sBAAsB,WAAW,OAAO,UAAU,UAAU,OAAO;EAC5F,MAAM,MAAM,WAAW,YAAY;GACjC,MAAM;GACN,UAAU,OAAO,UAAU;GAC3B,SAAS;GACT,aAAa,KAAK,aAAa;EACjC,CAAC;EACD,MAAM,4BACJ,KAAK,aAAa,eAClB,OAAO,UAAU,UAAU,QAC7B;EACA,yBAAyB,MAAM,+BAC7B,KAAK,aAAa,eAClB,OAAO,UAAU,UAAU,QAC7B;CACF,OAAO,IAAI,KAAK,aAAa,iBAAiB,KAAK,eAAe,eAChE,MAAM,IAAI,MAAM,yDAAyD;CAG3E,MAAM,qBAAqB,KAAK,aAAa,WAAW;CACxD,MAAM,uBAAuB,qCAAqC;EAChE,SAAS,OAAO;EAChB,SAAS,OAAO,UAAU;EAC1B,QAAQ,OAAO,UAAU;EACzB,WAAW,OAAO,UAAU,IAAI;EAChC,YAAY,KAAK;EACjB,mBAAmB,6BAA6B,SAAS;CAC3D,CAAC;CACD,MAAM,qBAAqB,iCACzB,sBACA,KAAK,aAAa,aAClB,OAAO,UAAU,IAAI,SACvB;CACA,MAAM,mCACJ,KAAK,aAAa,aAClB,mBAAmB,kBAAkB,YAAY,QACnD;CACA,MAAM,mBAAmB,MAAM,qBAC7B,mBAAmB,kBAAkB,YAAY,UACjD,MAAM,SACR;CACA,IACE,CAAC,OAAO,KAAK,gBAAgB,CAAC,CAAC,OAC7B,OAAO,KACL,wBAAwB,mBAAmB,kBAAkB,YAAY,QAAQ,CACnF,CACF,GAEA,MAAM,IAAI,MAAM,iEAAiE;CAEnF,MAAM,oBAAoB,mBAAmB;CAE7C,MAAM,YAAY,MAAM,iBAAiB,WAAW,MAAM,KAAK;CAC/D,MAAM,gBAAgB,MAAM,aAAa,WAAW,MAAM,KAAK;CAC/D,MAAM,gBAAgB,yBAAyB,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CACnF,MAAM,yBAAyB,KAAK,IAAI,IAAI,KAAK,IAAI,wBAAwB,mBAAmB;CAChG,MAAM,mBAAmB,MAAM,qCAE3B,MAAM,OAAO,aAAa;EACxB,aAAa,KAAK;EAClB;EACA,aAAa;EACb;EACA,cAAc,OAAO;EACrB,UAAU;EACV,QAAQ,YAAY,cAAc,MAAM;CAC1C,CAAC,GACH,yBAAyB,gBAAgB,GACzC,6BACF;CACA,IAAI;CACJ,IAAI;EACF,kCACE,kBACA,cAAc,QACd,eACA,sBACF;EACA,iBAAiB,MAAM,cACrB,WACA,MACA,OACA,eACA,wBACA,gBACF;EACA,MAAM,SAAS,eAAe;EAC9B,MAAM,YAAY,MAAM,+BAA+B,WAAW,OAAO,KAAK,QAAQ,GAAG;EACzF,MAAM,iBAAiB,YACnB,iCACE,KAAK,eAAe,UACpB,UAAU,oBAAoB,KAAA,CAChC,IACA,KAAA;EACJ,MAAM,aAAa,YAAY,WAAW,MAAM,mBAAmB,KAAK;EACxE,MAAM,YAAY,uBAChB,OAAO,UAAU,OAAO,CAAC,GACzB,mBAAmB,KACnB,OAAO,UAAU,oBAAoB,SAAS,cAC1C,GACG,OAAO,UAAU,oBAAoB,MAAM;GAC1C,MAAM;GACN,OAAO,OAAO,UAAU,oBAAoB;EAC9C,EACF,IACA,CAAC,GACL,iBACI;IACG,+BAA+B;IAC9B,MAAM;IACN,OAAO,eAAe;GACxB;GACA,GAAI,eAAe,kBACf,GACG,2CAA2C;IAC1C,MAAM;IACN,OAAO,eAAe;GACxB,EACF,IACA,CAAC;EACP,IACA,CAAC,CACP;EACA,MAAM,SAAS,YAAY,OAAO,SAAS,cAAc,MAAM,SAAS;EACxE,MAAM,oBAAyD;GAC7D,MAAM;GACN,SAAS,KAAK;GACd,aAAa,KAAK;GAClB,YAAY;IACV,UAAU,KAAK,eAAe;IAC9B,GAAI,KAAK,eAAe,gBACpB,EAAE,eAAe,KAAK,eAAe,cAAc,IACnD,CAAC;GACP;GACA,UAAU,OAAO,KAAK;GACtB,GAAI,OAAO,UAAU,YAAY,EAAE,oBAAoB,OAAO,UAAU,UAAU,IAAI,CAAC;GACvF,SAAS,mBAAmB;GAC5B,SAAS,OAAO,UAAU;GAC1B,gBAAgB,OAAO,UAAU;GACjC,qBAAqB,OAAO,UAAU;GACtC,QAAQ,cAAc;GACtB;GACA,OAAO;IACL,QAAQ;IACR,UAAU;IACV,QAAQ;KACN,MAAM;KACN,aAAa,iBAAiB;KAC9B,SAAS,iBAAiB;IAC5B;IACA;GACF;GACA,QAAQ;IACN,YAAY,WAAW;IACvB,MAAM,WAAW;IACjB,KAAK;IACL,KAAK,OAAO,UAAU;GACxB;GACA,GAAI,OAAO,YAAY,EAAE,yBAAyB,OAAO,UAAU,SAAS,OAAO,IAAI,CAAC;GACxF;GACA,SAAS,EAAE,MAAM,WAAW;EAC9B;EACA,0CAA0C,MAAM,iBAAiB;EACjE,MAAM,iBAAiB,wBAAwB,iBAAiB;EAChE,MAAM,kBAAkBC,2BAAyB,iBAAiB;EAClE,IAAI,YAAY,cAAc,MAAM,iBAClC,MAAM,IAAI,MAAM,+CAA+C;EAEjE,MAAM,gBACJ,0CAA0C,MAAM;GAC9C,MAAM;GACN,QAAQ;GACR,UAAU;GACV,UAAU,0BAA0B,cAAc;EACpD,CAAC;EAEH,MAAM,aAAa,2BAA2B,SAAS;EACvD,MAAM,yBAAyB,2BAC7B;GACE,MAAM;GACN,iBAAiB;GACjB,cAAc,OAAO;GACrB,WAAW;IACT,OAAO;KACL,QAAQ,KAAK,eAAe;KAC5B,UAAU,0BACR,wBAAwB,mBAAmB,KAAK,cAAc,CAAC,CACjE;IACF;IACA,MAAM;KACJ,QAAQ,cAAc;KACtB,UAAU,0BACR,wBAAwB,mBAAmB,aAAa,CAAC,CAC3D;IACF;GACF;GACA;GACA;GACA,GAAI,OAAO,UAAU,YAAY,EAAE,oBAAoB,OAAO,UAAU,UAAU,IAAI,CAAC;GACvF,UAAU,OAAO,KAAK;GACtB,GAAI,UAAU,mBAAmB,EAAE,kBAAkB,UAAU,iBAAiB,IAAI,CAAC;GACrF,SAAS,OAAO,UAAU;GAC1B,gBAAgB,OAAO,UAAU;GACjC;GACA;GACA,GAAI,OAAO,YAAY,EAAE,yBAAyB,OAAO,UAAU,SAAS,OAAO,IAAI,CAAC;GACxF,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACrC,CACF;EACA,2CAA2C,MAAM,uBAAuB,KAAK;EAE7E,MAAM,aAAa,GAAG,KAAK,YAAY,WAAW,QAAQ,OAAO,GAAGA,2BAAyB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE;EAC3H,MAAM,YAAY;IACf,qBAAqB,cAAc,KAAK;IACxC,qBAAqB,eAAe,OAAO;IAC3C,qBAAqB,sBAAsB,cAAc;IACzD,qBAAqB,+BAA+B,uBAAuB;EAC9E;EACA,MAAM,WAAW;IACd,oBAAoB,cAAc,KAAK;IACvC,oBAAoB,eAAe,OAAO;IAC1C,oBAAoB,sBAAsB,cAAc;IACxD,oBAAoB,+BAA+B,uBAAuB;IAC1E,oBAAoB,aAAa;EACpC;EACA,0BAA0B,WAAW,QAAQ;EAE7C,OAAO,iCAAiC;GACtC;GACA;GACA,gBAAgB,KAAK;GACrB;GACA,aAAa,KAAK;GAClB,OAAO;IACL,WAAW,EAAE,GAAG,KAAK,eAAe;IACpC,SAAS,EAAE,GAAG,KAAK,aAAa;GAClC;GACA,aAAa;IACX,OAAO,mBAAmB,kBAAkB;IAC5C,OAAO;IACP,SAAS,CAAC,GAAG,mBAAmB,YAAY,UAAU;GACxD;GACA;GACA,eAAe;IAAE,OAAO;IAAe,OAAO;GAAe;GAC7D;GACA,QAAQ;IACN,YAAY,WAAW;IACvB,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM,KAAK;IAChD,KAAK,wBAAwB,SAAS;IACtC,OAAO,mBAAmB,MAAM,KAAK,UAAU,MAAM,KAAK;IAC1D,KAAK,qBAAqB,OAAO,UAAU,KAAK,KAAK,cAAc;GACrE;GACA,aAAa;IACX,OAAO,WAAW,KAAK,gBAAgB;IACvC,UAAU,OAAO,UAAU;GAC7B;GACA;GACA;GACA;GACA;GACA;GACA,kBAAkB;IAChB,eAAe,iBAAiB;IAChC,QAAQ,iBAAiB;IACzB,aAAa,iBAAiB;IAC9B,gBAAgB,iBAAiB;IACjC,SAAS,iBAAiB;GAC5B;GACA,gBAAgB;IACd,WAAW;IACX,GAAI,yBAAyB,EAAE,gBAAgB,uBAAuB,IAAI,CAAC;IAC3E,cAAc,0BACZ,qBAAqB,OACrB,mBAAmB,kBAAkB,YAAY,SAAS,KAC5D;GACF;GACA,GAAI,eAAe,gBAAgB,eAAe,MAAM,SAAS,aAC7D,EACE,mBAAmB;IACjB;IACA,cAAc,eAAe;IAC7B,aAAa;IACb,oBAAoB,eAAe,MAAM;GAC3C,EACF,IACA,CAAC;GACL,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;GACjC,OAAO;IAAE,OAAO;IAAY,MAAM;IAAW,KAAK;GAAS;GAC3D;EACF,CAAC;CACH,SAAS,OAAO;EACd,MAAM,sBAAsB,yBAAyB,gBAAgB;EACrE,MAAM,UAAmC,CAAC;EAC1C,IAAI,gBAAgB,MAAM,SAAS,YAAY;GAC7C,MAAM,eAAe,eAAe;GACpC,MAAM,qBAAqB,eAAe,MAAM;GAChD,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,wDAAwD;GAC3F,QAAQ,KACN,+BACE,YAAY;IACV,MAAM,SAAS,MAAM,MAAM,OAAO,MAAM;KACtC,aAAa,KAAK;KAClB;KACA;KACA;KACA,QAAQ;IACV,CAAC;IACD,IAAI,OAAO,WAAW,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,QAAQ,QAAQ,QAAQ,GAC9E,MAAM,IAAI,MAAM,yDAAyD;GAE7E,GACA,qBACA,mCACF,CACF;EACF;EACA,QAAQ,KACN,+BACE,YAAY;GAeV,IAdmB,kCACjB,MAAM,MAAM,OAAO,YAAY;IAC7B,aAAa,KAAK;IAClB;IACA,aAAa,iBAAiB;IAC9B,UAAU;IACV,QAAQ;GACV,CAAC,GACD;IACE;IACA,aAAa,iBAAiB;IAC9B,OAAO,cAAc;GACvB,CAEW,CAAC,CAAC,MAAM,eAAe,GAClC,MAAM,IAAI,MAAM,sDAAsD;EAE1E,GACA,qBACA,kCACF,CACF;EAEA,MAAM,iBAAgB,MADO,QAAQ,WAAW,OAAO,EAAA,CAEpD,QAAQ,WAA4C,OAAO,WAAW,UAAU,CAAC,CACjF,KAAK,WAAW,OAAO,MAAM;EAChC,IAAI,cAAc,SAAS,GACzB,MAAM,IAAI,MACR,qEAAqE,cAAc,IAAI,YAAY,CAAC,CAAC,KAAK,IAAI,KAC9G,EAAE,OAAO,MAAM,CACjB;EAEF,MAAM;CACR;AACF;AAEA,SAAS,4BACP,UACA,WACM;CACN,IACE,SAAS,cAAc,UAAU,aACjC,SAAS,iBAAiB,UAAU,cAEpC,MAAM,IAAI,MACR,kFACF;AAEJ;AAEA,SAAS,gBACP,MACA,UACM;CACN,MAAM,gBAAgB,kCAAkC,MAAM,KAAK,IAAI;CACvE,MAAM,iBAAiB,mCAAmC,MAAM,KAAK,cAAc;CACnF,MAAM,UAAU,4BAA4B,MAAM,KAAK,OAAO;CAC9D,MAAM,kBAA2C;EAC/C,CAAC,eAAe,KAAK,WAAW;EAChC,CAAC,aAAa,cAAc,UAAU,IAAI;EAC1C,CAAC,oBAAoB,cAAc,UAAU,OAAO;EACpD,CAAC,UAAU,cAAc,SAAS,EAAE;CACtC;CACA,IAAI,cAAc,QAAQ,SAAS,eAAe,CAAC,cAAc,YAC/D,MAAM,IAAI,MAAM,qDAAqD;CAEvE,IAAI,cAAc,YAChB,gBAAgB,KACd,CAAC,uBAAuB,cAAc,WAAW,QAAQ,GACzD,CAAC,4BAA4B,cAAc,WAAW,YAAY,CACpE;CAEF,KAAK,MAAM,CAAC,MAAM,UAAU,iBAC1B,IAAI,CAAC,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,KAAK,mBAAmB;CAEhE,IAAI,CAAC,2BAA2B,KAAK,KAAK,WAAW,GACnD,MAAM,IAAI,MAAM,4DAA4D;CAE9E,IAAI,CAAC,cAAc,eAAe,CAAC,oBAAoB,cAAc,WAAW,GAC9E,MAAM,IAAI,MAAM,wDAAwD;CAE1E,IACEA,2BAAyB,mBAAmB,aAAa,CAAC,MAAM,cAAc,UAC9EA,2BAAyB,mBAAmB,cAAc,CAAC,MAAM,eAAe,UAChFA,2BAAyB,mBAAmB,OAAO,CAAC,MAAM,QAAQ,QAElE,MAAM,IAAI,MAAM,8DAA8D;CAEhF,MAAM,YAAY,QAAQ,YAAY,eAAe,OAAO,QAAQ;CACpE,IACE,QAAQ,gBAAgB,eAAe,UACvC,QAAQ,eAAe,cAAc,UACrC,eAAe,YAAY,QAAQ,eAAe,cAAc,UAChE,QAAQ,cAAc,eAAe,QACrC,eAAe,MAAM,eAAe,QAAQ,QAC5C,QAAQ,UAAU,cAAc,QAAQ,aAExC,MAAM,IAAI,MAAM,oEAAoE;CAEtF,mBAAmB,MAAM,cAAc,UAAU,WAAW;CAC5D,oCAAoC,MAAM,cAAc,OAAO;CAC/D,8CAA8C,MAAM,cAAc,SAAS;CAC3E,oCAAoC,MAAM,cAAc,MAAM;CAC9D,IAAI,cAAc,YAAY;EAC5B,IAAI,CAAC,kCAAkC,KAAK,cAAc,WAAW,UAAU,GAC7E,MAAM,IAAI,MAAM,yDAAyD;EAE3E,IAAI,CAAC,kCAAkC,KAAK,cAAc,WAAW,QAAQ,GAC3E,MAAM,IAAI,MAAM,uDAAuD;EAEzE,IAAI,cAAc,WAAW,WAAW,WAAW,cAAc,WAAW,SAAS,QACnF,MAAM,IAAI,MAAM,6CAA6C;CAEjE;CACA,KAAK,MAAM,CAAC,MAAM,SAAS;EACzB,CAAC,uBAAuB,KAAK,eAAe,QAAQ;EACpD,CAAC,4BAA4B,KAAK,eAAe,aAAa;EAC9D,CAAC,qBAAqB,KAAK,aAAa,QAAQ;EAChD,CAAC,0BAA0B,KAAK,aAAa,aAAa;EAC1D,CAAC,wBAAwB,KAAK,aAAa,WAAW;CACxD,GAAY;EACV,IAAI,SAAS,KAAA,GAAW;EAIxB,IAAI,EAHc,KAAK,WAAW,WAAW,IACzC,MAAM,WAAW,IAAI,KAAK,MAAM,UAAU,IAAI,MAAM,OACpD,WAAW,IAAI,KAAKC,QAAgB,IAAI,MAAM,OAClC,MAAM,IAAI,MAAM,GAAG,KAAK,mCAAmC;CAC7E;CACA,IACE,CAAC,OAAO,UAAU,QAAQ,OAAO,KACjC,CAAC,OAAO,UAAU,cAAc,QAAQ,WAAW,KACnD,QAAQ,UAAU,KAClB,QAAQ,UAAU,cAAc,QAAQ,eACvC,cAAc,QAAQ,gBAAgB,UAAU,cAAc,QAAQ,gBAAgB,GAEvF,MAAM,IAAI,MAAM,gCAAgC;CAElD,MAAM,SAAS,cAAc;CAC7B,IACE,CAAC,OAAO,UAAU,OAAO,SAAS,KAClC,OAAO,aAAa,KACpB,OAAO,YAAA,cACP,CAAC,OAAO,UAAU,OAAO,QAAQ,KACjC,OAAO,YAAY,KACnB,CAAC,OAAO,UAAU,OAAO,aAAa,KACtC,OAAO,gBAAgB,KACvB,CAAC,OAAO,UAAU,OAAO,cAAc,KACvC,OAAO,iBAAiB,KACxB,CAAC,OAAO,UAAU,OAAO,eAAe,KACxC,OAAO,kBAAkB,KACzB,CAAC,OAAO,SAAS,OAAO,UAAU,KAClC,OAAO,aAAa,GAEpB,MAAM,IAAI,MAAM,mCAAmC;CAErD,WAAW,OAAO,YAAY,iBAAiB;CAC/C,IAAI,CAAC,cAAc,MAAM,UAAU,KAAK,GACtC,MAAM,IAAI,MAAM,2CAA2C;CAE7D,IAAI,CAAC,cAAc,OAAO,KAAK,KAAK,KAAK,CAAC,cAAc,OAAO,QAAQ,KAAK,GAC1E,MAAM,IAAI,MAAM,uDAAuD;CAEzE,IACE,CAAC,OAAO,UAAU,cAAc,OAAO,SAAS,UAAU,KAC1D,cAAc,OAAO,SAAS,cAAc,GAE5C,MAAM,IAAI,MAAM,uDAAuD;CAEzE,mBAAmB,MAAM,cAAc,OAAO,SAAS,MAAM;CAC7D,IAAI,cAAc,wBAAwB;EACxC,IACE,cAAc,uBAAuB,WAAW,8BAChD,CAAC,cAAc,uBAAuB,MAAM,KAAK,KACjD,CAAC,cAAc,uBAAuB,SAAS,GAAG,KAAK,KACvD,CAAC,cAAc,uBAAuB,SAAS,aAAa,KAAK,GAEjE,MAAM,IAAI,MAAM,iDAAiD;EAEnE,mBAAmB,MAAM,cAAc,uBAAuB,WAAW;EACzE,mBAAmB,MAAM,cAAc,uBAAuB,cAAc;EAC5E,8BAA8B,MAAM;GAClC,OAAO,cAAc,uBAAuB;GAC5C,aAAa,cAAc,uBAAuB;EACpD,CAAC;CACH;CACA,IAAI,SAAS,SAAS,aAElB;MAAA,sBAAsB,KAAK,eAAe,UAAU,SAAS,IAAI,KAChE,KAAK,eAAe,kBAAkB,KAAA,KACrC,sBAAsB,KAAK,eAAe,eAAe,SAAS,IAAI,GAExE,MAAM,IAAI,MAAM,gEAAgE;CAAA;AAGtF;AAEA,SAAS,sBAAsB,MAAc,OAAwB;CACnE,MAAM,IAAI,MAAM,UAAU,IAAI;CAC9B,MAAM,IAAI,MAAM,UAAU,KAAK;CAC/B,OACE,MAAM,KAAK,EAAE,WAAW,MAAM,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,MAAM,MAAM,MAAM,GAAG,EAAE,EAAE;AAEhG;AAEA,SAAS,+BAA+B,MAAyC;CAC/E,MAAM,QAAQ;EACZ,KAAK,aAAa;EAClB,KAAK,aAAa;EAClB,KAAK,aAAa;CACpB,CAAC,CACE,QAAQ,UAA2B,UAAU,KAAA,CAAS,CAAC,CACvD,KAAK,UAAUA,QAAgB,KAAK,CAAC;CACxC,KAAK,IAAI,OAAO,GAAG,OAAO,MAAM,QAAQ,QACtC,KAAK,IAAI,QAAQ,OAAO,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACxD,MAAM,IAAI,MAAM;EAChB,MAAM,IAAI,MAAM;EAChB,IAAI,KAAK,MAAM,MAAM,KAAK,gBAAgB,GAAG,CAAC,KAAK,gBAAgB,GAAG,CAAC,IACrE,MAAM,IAAI,MAAM,kEAAkE;CAEtF;AAEJ;AAEA,SAAS,gBAAgB,QAAgB,OAAwB;CAC/D,MAAM,OAAO,SAAS,QAAQ,KAAK;CACnC,OAAO,SAAS,MAAM,CAAC,KAAK,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI;AAClE;AAEA,eAAe,qBAAqB,MAA6B;CAC/D,MAAM,QAAQ,MAAM,MAAM,IAAI;CAC9B,IAAI,CAAC,MAAM,YAAY,KAAK,MAAM,eAAe,GAC/C,MAAM,IAAI,MAAM,+CAA+C;CAEjE,KAAK,MAAM,QAAQ,IAAI,EAAA,CAAG,WAAW,GACnC,MAAM,IAAI,MAAM,2DAA2D;AAE/E;AAEA,eAAe,iBACb,WACA,MACA,OAC0C;CAC1C,MAAM,cAAc,UAAU,OAAO,UAAU;CAC/C,MAAM,yBAAyB,KAAK,KAAK;CACzC,MAAM,SAAS,YAAY,SAAS,qBAAqB,YAAY,YAAY,KAAA;CACjF,IAAI,YAAY,SAAS,8BAA8B,CAAC,wBACtD,MAAM,IAAI,MAAM,2EAA2E;CAE7F,IAAI,YAAY,SAAS,sBAAsB,wBAC7C,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,WAAW,MAAM,MAAM,WAAW,QAAQ;EAC9C,WAAW;EACX;CACF,CAAC;CACD,IAAI,SAAS,WAAW,YAAY,MAAM,MAAM,IAAI,MAAM,mCAAmC;CAC7F,IAAI,WAAW,SAAS,UAAU,OAAO,SAAS,SAAS,gBAAgB,OAAO,cAChF,MAAM,IAAI,MAAM,oEAAoE;CAEtF,IACE,0BACAD,2BAAyB,QAAQ,MAAMA,2BAAyB,sBAAsB,GAEtF,MAAM,IAAI,MAAM,uEAAuE;CAEzF,OAAO;AACT;AAEA,eAAe,aACb,WACA,MACA,OACsC;CACtC,MAAM,QAAQ,UAAU,OAAO,QAAQ;CACvC,MAAM,WAAW,KAAK,KAAK;CAC3B,IAAI,OAAO,YAAY,KAAA,KAAa,MAAM,YAAY,SAAS,WAC7D,MAAM,IAAI,MAAM,qEAAqE;CAEvF,IAAI,OAAO,oBAAoB,KAAA,KAAa,MAAM,oBAAoB,SAAS,iBAC7E,MAAM,IAAI,MAAM,sEAAsE;CAExF,MAAM,WAAW,MAAM,MAAM,OAAO,QAAQ;EAC1C,WAAW,SAAS;EACpB,SAAS,UAAU,OAAO,UAAU;EACpC,iBAAiB,SAAS;CAC5B,CAAC;CACD,IAAIA,2BAAyB,QAAQ,MAAMA,2BAAyB,QAAQ,GAC1E,MAAM,IAAI,MAAM,wDAAwD;CAE1E,OAAO;AACT;AAEA,eAAe,cACb,WACA,MACA,OACA,eACA,aACA,kBAIC;CACD,MAAM,SAAS,UAAU,OAAO;CAChC,IAAI,OAAO,SAAS,YAAY,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE;CACrE,MAAM,OAAO,OAAO,OAAO,MAAM,sBAAsB,WAAW,OAAO,IAAI,IAAI,KAAA;CACjF,MAAM,mBAAmBA,2BAAyB,EAAE,aAAa,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;CAC5F,MAAM,cAAcA,2BAAyB,EAAE,YAAY,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;CACtF,MAAM,qBAAqBA,2BAAyB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE;CAClF,MAAM,qBAAqB,aAAa,UAAU,OAAO,OAAO,MAAM,GAAG,EAAE,EAAE,GAAG,iBAAiB,GAAG,YAAY,GAAG;CACnH,MAAM,QAAQ,MAAM,qCAEhB,MAAM,OAAO,MAAM;EACjB,aAAa,KAAK;EAClB;EACA;EACA;EACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EACvB,GAAI,OAAO,OAAO,EAAE,YAAY,OAAO,KAAK,OAAO,IAAI,CAAC;CAC1D,CAAC,GACH,yBAAyB,gBAAgB,GACzC,uBACF;CACA,IAAI;EACF,IACE,MAAM,kBAAkB,iBACxB,MAAM,gBAAgB,eACtB,CAAC,wBAAwB,KAAK,MAAM,YAAY,GAEhD,MAAM,IAAI,MAAM,+DAA+D;EAEjF,MAAM,qBAAqB,MAAM,UAAU,MAAM,SAAS;EAC1D,MAAM,iCAAiC,MAAM,aAAa,MAAM,SAAS;EACzE,OAAO;GACL,OAAO;IACL,MAAM;IACN,OAAO;IACP;IACA,OAAO;KACL,MAAM;KACN,UAAU,MAAM;KAChB,kBAAkB,MAAM;IAC1B;IACA,aAAa,MAAM;IACnB,GAAI,OAAO,OAAO,EAAE,YAAY,OAAO,KAAK,OAAO,IAAI,CAAC;GAC1D;GACA,cAAc,MAAM;EACtB;CACF,SAAS,OAAO;EACd,IAAI;GACF,MAAM,SAAS,MAAM,qCAEjB,MAAM,OAAO,MAAM;IACjB,aAAa,KAAK;IAClB;IACA,cAAc,MAAM;IACpB;IACA,QAAQ;GACV,CAAC,GACH,yBAAyB,gBAAgB,GACzC,uCACF;GACA,IAAI,OAAO,WAAW,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,QAAQ,QAAQ,QAAQ,GAC9E,MAAM,IAAI,MAAM,2DAA2D;EAE/E,SAAS,YAAY;GACnB,MAAM,IAAI,MAAM,uDAAuD,EACrE,OAAO,IAAI,eAAe,CAAC,OAAO,UAAU,CAAC,EAC/C,CAAC;EACH;EACA,MAAM;CACR;AACF;AAEA,SAAS,YACP,WACA,MACA,cAC2D;CAC3D,MAAM,SAAS,UAAU,OAAO,UAAU;CAC1C,IAAI,OAAO,SAAS,qBAClB,OAAO;EAAE,YAAY,OAAO;EAAY,MAAM,CAAC,GAAI,OAAO,QAAQ,CAAC,GAAI,GAAG,YAAY;CAAE;CAE1F,MAAM,gBAAgB,KAAK,eAAe;CAC1C,IAAI,CAAC,eAAe,MAAM,IAAI,MAAM,0DAA0D;CAC9F,MAAM,aAAa,MAAM,KAAK,eAAe,OAAO,UAAU;CAC9D,MAAM,gBAAgB,OAAO,QAAQ,CAAC;CACtC,IAAI,OAAO,aACT,OAAO;EACL,YAAY,OAAO;EACnB,MAAM;GAAC;IAAE,MAAM;IAAU,OAAO;GAAW;GAAG,GAAG;GAAe,GAAG;EAAY;CACjF;CAEF,OAAO;EAAE,YAAY;EAAY,MAAM,CAAC,GAAG,eAAe,GAAG,YAAY;CAAE;AAC7E;AAEA,SAAS,uBACP,GAAG,SACwC;CAC3C,MAAM,SAAoD,CAAC;CAC3D,KAAK,MAAM,UAAU,SACnB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAAG;EAClD,MAAM,WAAW,OAAO;EACxB,IAAI,YAAY,SAAS,UAAU,MAAM,OACvC,MAAM,IAAI,MAAM,iDAAiD,MAAM;EAEzE,OAAO,QAAQ;CACjB;CAEF,OAAO;AACT;AAEA,SAAS,wBACP,QACwB;CACxB,OAAO,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,MAAM,MAAM,KAAK,CAAC,CAAC;AAC9F;AAEA,SAAS,YACP,SACA,WACwD;CACxD,MAAM,SAAiE,CACrE;EAAE,MAAM;EAAW;CAAU,CAC/B;CACA,IAAI,QAAQ,OAAO,OAAO,OAAO,KAAK;EAAE,MAAM;EAAS;CAAU,CAAC;CAClE,KAAK,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,GACvD,IAAI,QAAQ,QAAQ,KAAK,EAAE,OAAO,OAAO,KAAK;EAAE,MAAM;EAAQ;EAAM;CAAU,CAAC;CAEjF,KAAK,MAAM,QAAQ,OAAO,KAAK,QAAQ,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,GAC3D,IAAI,QAAQ,YAAY,KAAK,EAAE,OAAO,OAAO,KAAK;EAAE,MAAM;EAAY;EAAM;CAAU,CAAC;CAEzF,OAAO;AACT;AAEA,SAAS,2BACP,WAC8E;CAC9E,MAAM,SAAS,UAAU,OAAO,UAAU;CAC1C,MAAM,YAAY,UAAU,OAAO,UAAU;CAC7C,IAAI,OAAO,SAAS,0BAA0B,CAAC,WAAW,OAAO,KAAA;CACjE,MAAM,OAAO,UAAU,SAAS,MAAM,MAAM,UAAU,MAAM,SAAS,OAAO,UAAU;CACtF,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,4DAA4D;CACvF,OAAO;EAAE,MAAM,KAAK;EAAM,QAAQ,KAAK;EAAQ,YAAY,KAAK;CAAW;AAC7E;AAEA,SAAS,qBACP,KACA,OACQ;CACR,MAAM,OAAO,IAAI,cAAc,SAAS,MAAM,WAAW,MAAM;CAC/D,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,uDAAuD;CAClF,MAAM,WAAW,IAAI,SAAS,MAAM,OAAO,MAAM,KAAK,MAAM,IAAI,IAAI;CACpE,IAAI,aAAa,QAAQ,CAAC,SAAS,WAAW,GAAG,KAAK,EAAE,GACtD,MAAM,IAAI,MAAM,+CAA+C;CAEjE,OAAO;AACT;AAEA,SAAS,kCACP,aAYA,gBACA,eACA,aACM;CACN,IAAI,CAAC,wBAAwB,KAAK,YAAY,MAAM,GAClD,MAAM,IAAI,MAAM,4DAA4D;CAE9E,IAAI,YAAY,kBAAkB,iBAAiB,YAAY,gBAAgB,aAC7E,MAAM,IAAI,MAAM,+DAA+D;CAEjF,MAAM,SAAS,YAAY,cAAc;CACzC,IAAIA,2BAAyB,YAAY,cAAc,MAAMA,2BAAyB,MAAM,GAC1F,MAAM,IAAI,MAAM,sEAAsE;CAExF,MAAM,sBAAsB,OAAO,kBAAkB,IAAI,aAAa;CAEtE,IADgB,uCAAuC,MAAM,YAAY,OAC/D,CAAC,CAAC,SAAS,qBACnB,MAAM,IAAI,MAAM,6EAA6E;AAEjG;AAEA,SAAS,0BACP,WACA,UACM;CACN,MAAM,OAAO,IAAI,IAAI,OAAO,KAAK,SAAS,CAAC;CAC3C,KAAK,MAAM,QAAQ,OAAO,KAAK,QAAQ,GAAG;EACxC,IAAI,KAAK,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,+CAA+C,MAAM;EACzF,KAAK,IAAI,IAAI;CACf;AACF;AAEA,SAAS,YAAY,QAKnB;CACA,OAAO;EACL,eAAe,OAAO;EACtB,gBAAgB,OAAO;EACvB,iBAAiB,OAAO;EACxB,YAAY,OAAO;CACrB;AACF;AAEA,SAAS,0BACP,aACA,eAC0D;CAC1D,MAAM,SAAS,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC;CACtE,IAAI,OAAO,SAAS,YAAY,UAAU,YAAY,WAAW,cAAc,QAC7E,MAAM,IAAI,MAAM,2DAA2D;CAE7E,OAAO,cAAc,KAAK,aAAa;EACrC,MAAM,SAAS,OAAO,IAAI,SAAS,OAAO;EAC1C,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,QAAQ,OAAO,KAAK,QAAQ,WAAW,IAAI,MAAM;EACvD,IACE,CAAC,UACD,CAAC,OAAO,UAAU,IAAI,KACtB,OAAO,KACP,OAAO,OACP,SAAS,SAAS,QAClB,YAAY,KAAK,MAAM,SAAS,eAEhC,MAAM,IAAI,MAAM,2DAA2D;EAE7E,OAAO;GAAE,MAAM,SAAS;GAAS;GAAM,OAAO,WAAW,KAAK,KAAK;EAAE;CACvE,CAAC;AACH;AACA,SAAS,oBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,QAAQ,SAAU,QAAQ,OAAQ;GACpC,MAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;GACvC,IAAI,EAAE,QAAQ,SAAU,QAAQ,QAAS,OAAO;GAChD;EACF,OAAO,IAAI,QAAQ,SAAU,QAAQ,OACnC,OAAO;CAEX;CACA,OAAO;AACT;AAEA,SAAS,aAAa,OAAwB;CAC5C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D"}
+{"version":3,"file":"prepare-D3n7cA39.js","names":["canonicalCandidateDigest","publicValue","canonicalCandidateDigest","SHA256_PATTERN","canonicalCandidateDigest","requireString","requireNumber","requireObject","assertExecutionId","assertSha256Digest","assertCount","fsConstants","hasControlCharacter","canonicalCandidateDigest","modelLimits","canonicalCandidateDigest","canonicalCandidateDigest","canonicalCandidateDigest","canonicalCandidateDigest","errorMessage","canonicalCandidateDigest","resolveHostPath"],"sources":["../src/candidate-execution/digest.ts","../src/candidate-execution/system-prompt.ts","../src/candidate-execution/profile.ts","../src/candidate-execution/exact-object.ts","../src/candidate-execution/claim-file-formats.ts","../src/candidate-execution/claim-terminal.ts","../src/candidate-execution/cleanup.ts","../src/candidate-execution/execution-window.ts","../src/candidate-execution/artifacts.ts","../src/candidate-execution/git-materialize.ts","../src/candidate-execution/types.ts","../src/candidate-execution/prepared-state.ts","../src/candidate-execution/claim-plan.ts","../src/candidate-execution/claim.ts","../src/candidate-execution/model-settlement.ts","../src/candidate-execution/verify.ts","../src/candidate-execution/knowledge.ts","../src/candidate-execution/executor-capture.ts","../src/candidate-execution/output-artifacts.ts","../src/candidate-execution/finalize.ts","../src/candidate-execution/benchmark-grader.ts","../src/candidate-execution/executor-capture-evidence.ts","../src/candidate-execution/outcome-evidence.ts","../src/candidate-execution/protected-trace-store.ts","../src/candidate-execution/execute.ts","../src/candidate-execution/prepare.ts"],"sourcesContent":["import { createHash } from 'node:crypto'\nimport { canonicalJson } from '@tangle-network/agent-eval'\nimport type { AgentCandidateEmbeddedArtifact, Sha256Digest } from '@tangle-network/agent-interface'\n\nimport { contentAddress } from '../durable/spawn-journal'\nimport type { CanonicalCandidateDocument } from './types'\n\nexport function sha256Bytes(bytes: Uint8Array): Sha256Digest {\n  return `sha256:${createHash('sha256').update(bytes).digest('hex')}`\n}\n\nexport function canonicalCandidateBytes(value: unknown): Uint8Array {\n  return Buffer.from(canonicalJson(value), 'utf8')\n}\n\nexport function canonicalCandidateDigest(value: unknown): Sha256Digest {\n  return contentAddress(value) as Sha256Digest\n}\n\n/** Returns a detached, deeply frozen JSON value with canonical number normalization. */\nexport function immutableCandidateValue<T>(value: T): T {\n  return deepFreezeCandidate(\n    JSON.parse(Buffer.from(canonicalCandidateBytes(value)).toString('utf8')) as T,\n  )\n}\n\nexport function canonicalCandidateDocument<T extends { digest: Sha256Digest }>(\n  valueWithoutDigest: Omit<T, 'digest'>,\n): CanonicalCandidateDocument<T> {\n  const bytes = canonicalCandidateBytes(valueWithoutDigest)\n  const digest = canonicalCandidateDigest(valueWithoutDigest)\n  if (sha256Bytes(bytes) !== digest) {\n    throw new Error('canonical candidate serializers disagree on document digest')\n  }\n  const storedBytes = Uint8Array.from(bytes)\n  const value = immutableCandidateValue({ ...valueWithoutDigest, digest }) as T\n  return Object.freeze({\n    value,\n    get bytes(): Uint8Array {\n      return Uint8Array.from(storedBytes)\n    },\n    digest,\n  })\n}\n\nexport function verifyCanonicalCandidateDocument<T extends { digest: Sha256Digest }>(\n  value: T,\n  label: string,\n): T {\n  if (canonicalCandidateDigest(omitTopLevelDigest(value)) !== value.digest) {\n    throw new Error(`${label} digest does not match`)\n  }\n  return immutableCandidateValue(value)\n}\n\nexport function embeddedCandidateArtifact(bytes: Uint8Array): AgentCandidateEmbeddedArtifact {\n  return {\n    encoding: 'base64',\n    content: Buffer.from(bytes).toString('base64'),\n    sha256: sha256Bytes(bytes),\n    byteLength: bytes.byteLength,\n  }\n}\n\nexport function omitTopLevelDigest<T extends { digest: Sha256Digest }>(\n  value: T,\n): Omit<T, 'digest'> {\n  const { digest: _digest, ...rest } = value\n  return rest\n}\n\nexport function deepFreezeCandidate<T>(value: T, seen = new Set<object>()): T {\n  if (\n    value === null ||\n    typeof value !== 'object' ||\n    ArrayBuffer.isView(value) ||\n    seen.has(value as object)\n  ) {\n    return value\n  }\n  seen.add(value as object)\n  for (const child of Object.values(value as Record<string, unknown>)) {\n    deepFreezeCandidate(child, seen)\n  }\n  return Object.freeze(value)\n}\n","import { posix } from 'node:path'\n\nimport type {\n  AgentCandidateConfigValue,\n  AgentCandidateLaunch,\n} from '@tangle-network/agent-interface'\nimport type {\n  AgentCandidateWorkspacePlan,\n  HarnessId,\n} from '@tangle-network/agent-profile-materialize'\n\nconst SYSTEM_PROMPT_FILE = '.tangle/system-prompt.md'\nconst APPEND_SYSTEM_PROMPT_FILE = '.tangle/append-system-prompt.md'\n\n/**\n * One row describes the native process control for each prompt intent this adapter owns.\n * A row with no executor projection means the shared materializer already lowered the intent into\n * the signed workspace plan; this adapter still proves that the launch reaches the native binary.\n */\ninterface HarnessSystemPrompt {\n  /** The native binary the launch must run for this projection to be provable. */\n  readonly executable: string\n  /** Apply a replacement prompt to the harness's own control. */\n  readonly project: (\n    plan: AgentCandidateWorkspacePlan,\n    systemPrompt: string,\n    systemPromptFilePath: string,\n  ) => AgentCandidateWorkspacePlan\n  /** Apply an addition without replacing the harness's own prompt. */\n  readonly projectAppend?: (\n    plan: AgentCandidateWorkspacePlan,\n    appendSystemPrompt: string,\n    appendSystemPromptFilePath: string,\n  ) => AgentCandidateWorkspacePlan\n  /** The materializer already projected replacement text into native plan files and flags. */\n  readonly retainsProjectedSystemPrompt?: boolean\n  /** Does caller argv already set a replacement control this projection would shadow? */\n  readonly conflictsWithArgs: (values: readonly string[]) => boolean\n  /** Does caller argv already set an additive control this projection would shadow? */\n  readonly conflictsWithAppendArgs: (values: readonly string[]) => boolean\n}\n\nconst SYSTEM_PROMPT_FLAGS = ['--system-prompt', '--system-prompt-file'] as const\nconst APPEND_SYSTEM_PROMPT_FLAGS = [\n  '--append-system-prompt',\n  '--append-system-prompt-file',\n] as const\n\nfunction argsSetSystemPromptFlag(values: readonly string[]): boolean {\n  return values.some((value) =>\n    SYSTEM_PROMPT_FLAGS.some((flag) => value === flag || value.startsWith(`${flag}=`)),\n  )\n}\n\nfunction argsSetAppendSystemPromptFlag(values: readonly string[]): boolean {\n  return values.some((value) =>\n    APPEND_SYSTEM_PROMPT_FLAGS.some((flag) => value === flag || value.startsWith(`${flag}=`)),\n  )\n}\n\n/** Codex keys that can replace or contaminate the materializer's sealed instructions file. */\nconst CODEX_INSTRUCTION_KEYS = ['model_instructions_file', 'developer_instructions'] as const\n\nfunction argsSetCodexInstructionOverride(values: readonly string[]): boolean {\n  for (let index = 0; index < values.length; index++) {\n    const value = values[index]!\n    const config =\n      value === '-c' || value === '--config'\n        ? values[index + 1]\n        : value.startsWith('--config=')\n          ? value.slice('--config='.length)\n          : undefined\n    if (\n      config !== undefined &&\n      CODEX_INSTRUCTION_KEYS.some((key) => config.trimStart().startsWith(`${key}=`))\n    ) {\n      return true\n    }\n  }\n  return false\n}\n\nconst HARNESS_SYSTEM_PROMPTS = {\n  'claude-code': {\n    executable: 'claude',\n    project: (plan, systemPrompt, path) =>\n      appendFlags(\n        addPromptFile(plan, SYSTEM_PROMPT_FILE, systemPrompt),\n        '--system-prompt-file',\n        path,\n      ),\n    projectAppend: (plan, appendSystemPrompt, path) =>\n      appendFlags(\n        addPromptFile(plan, APPEND_SYSTEM_PROMPT_FILE, appendSystemPrompt),\n        '--append-system-prompt-file',\n        path,\n      ),\n    conflictsWithArgs: argsSetSystemPromptFlag,\n    conflictsWithAppendArgs: argsSetAppendSystemPromptFlag,\n  },\n  /** OpenCode's bound primary agent is already selected by the materializer's --agent flag. */\n  opencode: {\n    executable: 'opencode',\n    project: (plan) => plan,\n    retainsProjectedSystemPrompt: true,\n    conflictsWithArgs: (values) =>\n      values.some((value) => value === '--agent' || value.startsWith('--agent=')),\n    conflictsWithAppendArgs: argsSetAppendSystemPromptFlag,\n  },\n  pi: {\n    executable: 'pi',\n    project: (plan, systemPrompt, path) =>\n      appendFlags(addPromptFile(plan, SYSTEM_PROMPT_FILE, systemPrompt), '--system-prompt', path),\n    projectAppend: (plan, appendSystemPrompt, path) =>\n      appendFlags(\n        addPromptFile(plan, APPEND_SYSTEM_PROMPT_FILE, appendSystemPrompt),\n        '--append-system-prompt',\n        path,\n      ),\n    conflictsWithArgs: argsSetSystemPromptFlag,\n    conflictsWithAppendArgs: argsSetAppendSystemPromptFlag,\n  },\n  prime: {\n    executable: 'prime-agent',\n    project: (plan, systemPrompt, path) =>\n      appendFlags(addPromptFile(plan, SYSTEM_PROMPT_FILE, systemPrompt), '--system-prompt', path),\n    projectAppend: (plan, appendSystemPrompt, path) =>\n      appendFlags(\n        addPromptFile(plan, APPEND_SYSTEM_PROMPT_FILE, appendSystemPrompt),\n        '--append-system-prompt',\n        path,\n      ),\n    conflictsWithArgs: argsSetSystemPromptFlag,\n    conflictsWithAppendArgs: argsSetAppendSystemPromptFlag,\n  },\n  /** Gemini's file and env lowering is materializer-owned; this row supplies the launch proof. */\n  gemini: {\n    executable: 'gemini',\n    project: (plan) => plan,\n    conflictsWithArgs: argsSetSystemPromptFlag,\n    conflictsWithAppendArgs: argsSetAppendSystemPromptFlag,\n  },\n} as const satisfies Partial<Record<HarnessId, HarnessSystemPrompt>>\n\ninterface MaterializedPromptDelivery {\n  readonly executable: string\n  readonly delivered: (plan: AgentCandidateWorkspacePlan) => boolean\n  readonly conflictsWithArgs: (values: readonly string[]) => boolean\n}\n\n/**\n * These controls are lowered by agent-profile-materialize into files plus launch inputs. The\n * candidate adapter does not own the spawn, so it must reject an arbitrary entrypoint even when\n * the plan has the right bytes: only the native binary can make those inputs effective.\n */\nconst MATERIALIZED_PROMPT_DELIVERIES = {\n  codex: {\n    executable: 'codex',\n    delivered: (plan) =>\n      plan.files.some((file) => file.relPath === '.codex/system-prompt.md') &&\n      plan.flags.some((flag) => flag.value === 'model_instructions_file=.codex/system-prompt.md'),\n    conflictsWithArgs: argsSetCodexInstructionOverride,\n  },\n  gemini: {\n    executable: 'gemini',\n    delivered: (plan) =>\n      plan.files.some((file) => file.relPath === '.gemini/system.md') &&\n      plan.env.GEMINI_SYSTEM_MD?.value === '1',\n    conflictsWithArgs: argsSetSystemPromptFlag,\n  },\n} as const satisfies Partial<Record<HarnessId, MaterializedPromptDelivery>>\n\n/** Project both prompt intents onto their distinct native process controls. */\nexport function projectCandidatePromptIntents(\n  plan: AgentCandidateWorkspacePlan,\n  launch: AgentCandidateLaunch,\n  systemPromptFilePath: string,\n  requestedSystemPrompt: string | undefined = plan.systemPrompt?.value,\n  requestedAppendSystemPrompt: string | undefined = plan.appendSystemPrompt?.value,\n): AgentCandidateWorkspacePlan {\n  const systemPrompt = plan.systemPrompt\n  const appendSystemPrompt = plan.appendSystemPrompt\n  const delivery = MATERIALIZED_PROMPT_DELIVERIES[\n    plan.harness as keyof typeof MATERIALIZED_PROMPT_DELIVERIES\n  ] as MaterializedPromptDelivery | undefined\n\n  if (systemPrompt === undefined && delivery?.delivered(plan)) {\n    assertProvableNativeLaunch(plan.harness, delivery.executable, launch, 'replacement')\n    assertNoShadowingArgs(plan.harness, delivery.conflictsWithArgs, launch, 'replacement')\n    if (requestedSystemPrompt === undefined) return plan\n    return plan\n  }\n\n  if (requestedSystemPrompt === undefined && requestedAppendSystemPrompt === undefined) {\n    return plan\n  }\n\n  const projection = HARNESS_SYSTEM_PROMPTS[plan.harness as keyof typeof HARNESS_SYSTEM_PROMPTS] as\n    | HarnessSystemPrompt\n    | undefined\n  if (!projection) {\n    throw new Error(`candidate system prompt has no native launch projection for ${plan.harness}`)\n  }\n\n  const requestedReplacement = requestedSystemPrompt !== undefined\n  if (requestedReplacement && systemPrompt === undefined) {\n    throw new Error(\n      `profile materializer did not deliver the candidate system prompt for ${plan.harness}`,\n    )\n  }\n  if (systemPrompt !== undefined && requestedSystemPrompt === undefined) {\n    throw new Error(\n      `profile materializer added an unexpected candidate system prompt for ${plan.harness}`,\n    )\n  }\n  if (systemPrompt !== undefined && systemPrompt.value !== requestedSystemPrompt) {\n    throw new Error('profile materializer changed the candidate system prompt')\n  }\n  if (\n    appendSystemPrompt !== undefined &&\n    appendSystemPrompt.value !== requestedAppendSystemPrompt\n  ) {\n    throw new Error('profile materializer changed the candidate append system prompt')\n  }\n\n  const intent = requestedReplacement ? 'replacement' : 'addition'\n  assertProvableNativeLaunch(plan.harness, projection.executable, launch, intent)\n  const launchArgs = (launch.args ?? []).map((value) => value.value)\n  if (requestedReplacement && projection.conflictsWithArgs(launchArgs)) {\n    throw new Error(\n      `${plan.harness} launch arguments conflict with the candidate profile system prompt`,\n    )\n  }\n  if (requestedAppendSystemPrompt !== undefined && projection.conflictsWithAppendArgs(launchArgs)) {\n    throw new Error(\n      `${plan.harness} launch arguments conflict with the candidate profile append system prompt`,\n    )\n  }\n\n  let projected = plan\n  if (systemPrompt !== undefined) {\n    projected = projection.project(\n      projection.retainsProjectedSystemPrompt\n        ? projected\n        : omitPromptIntent(projected, 'systemPrompt'),\n      systemPrompt.value,\n      systemPromptFilePath,\n    )\n  }\n  if (appendSystemPrompt !== undefined) {\n    if (!projection.projectAppend) {\n      throw new Error(\n        `candidate append system prompt has no native launch projection for ${plan.harness}`,\n      )\n    }\n    projected = projection.projectAppend(\n      omitPromptIntent(projected, 'appendSystemPrompt'),\n      appendSystemPrompt.value,\n      posix.join(posix.dirname(systemPromptFilePath), 'append-system-prompt.md'),\n    )\n  }\n  // The source-profile digest binds authored values. Remove executor handoff fields only after\n  // converting them into native controls; materializer-owned controls remain visible in the plan.\n  return projected\n}\n\nfunction assertProvableNativeLaunch(\n  harness: string,\n  expectedExecutable: string,\n  launch: AgentCandidateLaunch,\n  intent: 'replacement' | 'addition',\n): asserts launch is AgentCandidateLaunch & { kind: 'container-command' } {\n  if (launch.kind !== 'container-command') {\n    throw new Error(`candidate-entrypoint launch cannot prove ${harness} system-prompt ${intent}`)\n  }\n  if (\n    launch.executable !== expectedExecutable &&\n    !(\n      posix.isAbsolute(launch.executable) &&\n      posix.basename(launch.executable) === expectedExecutable\n    )\n  ) {\n    throw new Error(\n      `${harness} system-prompt ${intent} requires the native ${expectedExecutable} executable`,\n    )\n  }\n}\n\nfunction assertNoShadowingArgs(\n  harness: string,\n  conflictsWithArgs: (values: readonly string[]) => boolean,\n  launch: Extract<AgentCandidateLaunch, { kind: 'container-command' }>,\n  intent: 'replacement' | 'addition',\n): void {\n  if (conflictsWithArgs((launch.args ?? []).map((value) => value.value))) {\n    throw new Error(\n      `${harness} launch arguments conflict with the candidate profile ${intent === 'replacement' ? 'system' : 'append system'} prompt`,\n    )\n  }\n}\n\nfunction omitPromptIntent(\n  plan: AgentCandidateWorkspacePlan,\n  intent: 'systemPrompt' | 'appendSystemPrompt',\n): AgentCandidateWorkspacePlan {\n  const projected = { ...plan }\n  delete projected[intent]\n  return projected\n}\n\nfunction appendFlags(\n  plan: AgentCandidateWorkspacePlan,\n  ...values: string[]\n): AgentCandidateWorkspacePlan {\n  return {\n    ...plan,\n    flags: [...plan.flags, ...values.map(publicValue)],\n  }\n}\n\nfunction publicValue(value: string): AgentCandidateConfigValue {\n  return { kind: 'public', value }\n}\n\nfunction addPromptFile(\n  plan: AgentCandidateWorkspacePlan,\n  relPath: string,\n  prompt: string,\n): AgentCandidateWorkspacePlan {\n  // Candidate argv rejects control characters. Native prompt-file loading preserves multiline\n  // bytes without weakening the shared process schema.\n  if (plan.files.some((file) => file.relPath === relPath)) {\n    throw new Error(`candidate profile conflicts with reserved ${relPath}`)\n  }\n  return {\n    ...plan,\n    files: [\n      ...plan.files,\n      {\n        relPath,\n        content: prompt,\n        source: 'generated',\n      },\n    ],\n  }\n}\n","import { posix } from 'node:path'\n\nimport type {\n  AgentCandidateConfigValue,\n  AgentCandidateLaunch,\n  AgentCandidateProfile,\n  AgentCandidateProfileActivation,\n  AgentCandidateProfilePlanEvidence,\n  AgentCandidateResourceRef,\n  AgentProfile,\n  AgentProfileConfigValue,\n  AgentProfileDiff,\n  AgentProfileMcpServer,\n  AgentProfileResourceRef,\n  HarnessType,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\nimport {\n  agentCandidateProfileActivationSchema,\n  agentCandidateProfileSchema,\n  agentProfileDiffSchema,\n  agentProfileSchema,\n  applyAgentProfileDiff,\n} from '@tangle-network/agent-interface'\nimport type {\n  AgentCandidateWorkspacePlan,\n  HarnessId,\n} from '@tangle-network/agent-profile-materialize'\nimport {\n  isMaterializerHarness,\n  materializeCandidateProfile,\n} from '@tangle-network/agent-profile-materialize'\n\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  canonicalCandidateDocument,\n  embeddedCandidateArtifact,\n  immutableCandidateValue,\n  omitTopLevelDigest,\n  sha256Bytes,\n} from './digest'\nimport { projectCandidatePromptIntents } from './system-prompt'\n\nexport function candidateMaterializerHarness(harness: HarnessType): HarnessId {\n  if (!isMaterializerHarness(harness)) {\n    throw new Error(\n      `sealed candidate profile materialization is unsupported for harness ${harness}`,\n    )\n  }\n  return harness\n}\n\n/** Runtime applies the materializer's launch flags to the candidate process. */\nexport const CANDIDATE_PROFILE_MATERIALIZER_BINDS = ['systemPrompt'] as const\n\ninterface MaterializeAgentCandidateProfilePlanOptions {\n  profile: AgentCandidateProfile\n  harness: HarnessType\n  launch: AgentCandidateLaunch\n  workspace: 'task' | 'candidate'\n  workspaces: {\n    taskRoot: string\n    candidateRoot?: string\n  }\n  resolvedResources?: ReadonlyMap<Sha256Digest, string>\n}\n\n/** Derive the exact native profile plan used by preparation and later evidence checks. */\nexport function materializeAgentCandidateProfilePlan(\n  options: MaterializeAgentCandidateProfilePlanOptions,\n): AgentCandidateWorkspacePlan {\n  const root =\n    options.workspace === 'task' ? options.workspaces.taskRoot : options.workspaces.candidateRoot\n  if (!root) throw new Error('candidate profile target is missing its execution workspace root')\n  const plan = materializeCandidateProfile(\n    options.profile,\n    candidateMaterializerHarness(options.harness),\n    {\n      binds: CANDIDATE_PROFILE_MATERIALIZER_BINDS,\n      resolvedResources: options.resolvedResources,\n    },\n  )\n  return projectCandidatePromptIntents(\n    plan,\n    options.launch,\n    posix.join(root, '.tangle/system-prompt.md'),\n    options.profile.prompt?.systemPrompt,\n    options.profile.prompt?.appendSystemPrompt,\n  )\n}\n\n/** Bind exact native profile text to the canonical plan captured during preparation. */\nexport function createAgentCandidateProfileActivation(\n  plan: AgentCandidateWorkspacePlan,\n  profilePlan: AgentCandidateProfilePlanEvidence,\n): AgentCandidateProfileActivation {\n  const sourceByPath = new Map(plan.files.map((file) => [file.relPath, file]))\n  if (sourceByPath.size !== plan.files.length) {\n    throw new Error('candidate profile activation contains duplicate native file paths')\n  }\n  const files = profilePlan.material.files.map((expected) => {\n    const source = sourceByPath.get(expected.relPath)\n    if (!source) {\n      throw new Error(`candidate profile activation is missing ${expected.relPath}`)\n    }\n    const mode = source.mode ?? 0o644\n    if (!Number.isSafeInteger(mode) || mode < 0 || mode > 0o777) {\n      throw new Error(`candidate profile activation has invalid mode for ${expected.relPath}`)\n    }\n    return { path: expected.relPath, mode, content: source.content }\n  })\n  if (files.length !== plan.files.length) {\n    throw new Error('candidate profile activation contains unplanned native files')\n  }\n  return parseAgentCandidateProfileActivation(\n    canonicalCandidateDocument<AgentCandidateProfileActivation>({\n      kind: 'agent-candidate-profile-activation',\n      profilePlan,\n      files,\n    }).value,\n    profilePlan.digest,\n  )\n}\n\n/** Parse and check every native file hash plus both canonical document digests. */\nexport function parseAgentCandidateProfileActivation(\n  input: unknown,\n  expectedProfilePlanDigest?: AgentCandidateProfilePlanEvidence['digest'],\n): AgentCandidateProfileActivation {\n  const activation = agentCandidateProfileActivationSchema.parse(input)\n  const planBytes = canonicalCandidateBytes(activation.profilePlan.material)\n  const profilePlanArtifact = activation.profilePlan.artifact\n  if (\n    sha256Bytes(planBytes) !== activation.profilePlan.digest ||\n    profilePlanArtifact.sha256 !== activation.profilePlan.digest ||\n    profilePlanArtifact.byteLength !== planBytes.byteLength ||\n    ('content' in profilePlanArtifact &&\n      !Buffer.from(profilePlanArtifact.content, 'base64').equals(Buffer.from(planBytes))) ||\n    (expectedProfilePlanDigest !== undefined &&\n      activation.profilePlan.digest !== expectedProfilePlanDigest)\n  ) {\n    throw new Error('candidate profile activation has an invalid canonical profile plan')\n  }\n  if (canonicalCandidateDigest(omitTopLevelDigest(activation)) !== activation.digest) {\n    throw new Error('candidate profile activation digest does not match')\n  }\n  return immutableCandidateValue(activation)\n}\n\nconst CANDIDATE_PROFILE_DIRECT_FIELDS = [\n  'name',\n  'description',\n  'version',\n  'tags',\n  'prompt',\n  'harness',\n  'permissions',\n  'tools',\n  'confidential',\n] as const\n\n/** Convert only behavior-preserving generic profile fields into the closed candidate contract. */\nexport function freezeGenericAgentCandidateProfile(input: AgentProfile): AgentCandidateProfile {\n  const profile = parseExactAgentProfile(input, 'profile')\n  return candidateProfileFromGenericProfile(profile)\n}\n\n/**\n * Keep every generic-profile-to-candidate conversion in one place.\n * Callers use this both when sealing a new bundle and when proving a measured\n * profile is exactly the profile in an existing candidate.\n */\nfunction candidateProfileFromGenericProfile(profile: AgentProfile): AgentCandidateProfile {\n  if (profile.connections !== undefined) unsupportedProfileField('connections')\n  if (profile.metadata !== undefined) unsupportedProfileField('metadata')\n  if (profile.extensions !== undefined) unsupportedProfileField('extensions')\n  if (profile.model?.metadata !== undefined) unsupportedProfileField('model.metadata')\n\n  const candidate: Record<string, unknown> = {}\n  copyDirectProfileFields(candidate, profile as Record<string, unknown>)\n  if (profile.model) {\n    const { metadata: _metadata, ...model } = profile.model\n    candidate.model = model\n  }\n  if (profile.mcp) candidate.mcp = freezeMcpServers(profile.mcp)\n  if (profile.subagents) {\n    candidate.subagents = Object.fromEntries(\n      Object.entries(profile.subagents).map(([name, subagent]) => {\n        if (subagent.metadata !== undefined) unsupportedProfileField(`subagents.${name}.metadata`)\n        const { metadata: _metadata, ...value } = subagent\n        return [name, value]\n      }),\n    )\n  }\n  if (profile.resources) candidate.resources = freezeResources(profile.resources)\n  if (profile.hooks && Object.values(profile.hooks).some((commands) => commands.length > 0)) {\n    throw new Error(\n      'generic AgentProfile hooks cannot be safely tokenized; use a candidate-profile source with executable/args',\n    )\n  }\n  if (profile.hooks) candidate.hooks = profile.hooks\n  if (profile.modes) {\n    candidate.modes = Object.fromEntries(\n      Object.entries(profile.modes).map(([name, mode]) => {\n        if (mode.metadata !== undefined) unsupportedProfileField(`modes.${name}.metadata`)\n        const { metadata: _metadata, ...value } = mode\n        return [name, value]\n      }),\n    )\n  }\n  const parsed = parseExactCandidateProfile(candidate)\n  return parsed\n}\n\n/** Prove the measured generic profile and sealed candidate profile describe the same behavior. */\nexport function assertCandidateProfileBinding(\n  measuredInput: unknown,\n  bundled: AgentCandidateProfile,\n): void {\n  const measured = parseExactAgentProfile(measuredInput, 'measured agent profile')\n  const expected = candidateProfileFromGenericProfile(measured)\n  if (canonicalCandidateDigest(expected) !== canonicalCandidateDigest(bundled)) {\n    throw new Error('measured agent profile does not match sealed candidate profile')\n  }\n}\n\n/** Parse a complete profile without silently discarding unsupported fields. */\nexport function parseExactAgentProfile(input: unknown, label: string): AgentProfile {\n  let parsed: AgentProfile\n  try {\n    parsed = agentProfileSchema.parse(input) as AgentProfile\n  } catch (cause) {\n    throw new Error(`${label} contains unsupported or non-canonical fields`, { cause })\n  }\n  assertCanonicalParse(input, parsed, label)\n  return parsed\n}\n\n/** Parse a profile diff without silently discarding unsupported fields. */\nexport function parseExactAgentProfileDiff(input: unknown, label: string): AgentProfileDiff {\n  let parsed: AgentProfileDiff\n  try {\n    parsed = agentProfileDiffSchema.parse(input) as AgentProfileDiff\n  } catch (cause) {\n    throw new Error(`${label} contains unsupported or non-canonical fields`, { cause })\n  }\n  assertCanonicalParse(input, parsed, label)\n  return parsed\n}\n\n/** Apply one exact diff and reject any value that cannot be preserved canonically. */\nexport function applyExactAgentProfileDiff(\n  baseInput: unknown,\n  diffInput: unknown,\n  label: string,\n): AgentProfile {\n  const base = parseExactAgentProfile(baseInput, `${label} base profile`)\n  const diff = parseExactAgentProfileDiff(diffInput, `${label} diff`)\n  const applied = omitUndefinedObjectFields(applyAgentProfileDiff(base, diff), label)\n  return parseExactAgentProfile(applied, `${label} result`)\n}\n\n/** Parse a candidate profile without silently discarding unsupported or non-canonical fields. */\nexport function parseExactCandidateProfile(input: unknown): AgentCandidateProfile {\n  const parsed = agentCandidateProfileSchema.parse(input)\n  assertCanonicalParse(input, parsed, 'candidate profile')\n  return parsed\n}\n\n/** Reject profile fields whose behavioral effect is not yet proven by candidate executors. */\nexport function assertCandidateProfileExecutionSupport(profile: AgentCandidateProfile): void {\n  const fields = ['tools', 'permissions', 'modes', 'confidential'] as const\n  const unsupported = fields.filter((field) => hasEntries(profile[field]))\n  if (unsupported.length > 0) {\n    throw new Error(\n      `candidate execution cannot prove in-session effects for non-empty AgentProfile fields: ${unsupported.join(', ')}`,\n    )\n  }\n}\n\n/** Convert the candidate profile contract into the portable interface profile it represents. */\nexport function agentCandidateProfileAsAgentProfile(\n  candidate: AgentCandidateProfile,\n): AgentProfile {\n  const output: Record<string, unknown> = {}\n  copyDirectProfileFields(output, candidate as unknown as Record<string, unknown>)\n  if (candidate.model) output.model = { ...candidate.model }\n  if (candidate.mcp) {\n    output.mcp = Object.fromEntries(\n      Object.entries(candidate.mcp).map(([name, server]) => [\n        name,\n        {\n          ...server,\n          // Candidate config values ({kind:'public', value}) are already valid\n          // AgentProfileConfigValue entries under interface >=0.40 — clone them\n          // rather than unwrapping to plain strings, which the 0.40 profile\n          // schema rejects.\n          ...(server.args ? { args: server.args.map((value) => ({ ...value })) } : {}),\n          ...(server.env ? { env: cloneRecord(server.env) } : {}),\n        },\n      ]),\n    )\n  }\n  if (candidate.subagents) output.subagents = cloneRecord(candidate.subagents)\n  if (candidate.modes) output.modes = cloneRecord(candidate.modes)\n  if (candidate.hooks) {\n    output.hooks = Object.fromEntries(\n      Object.entries(candidate.hooks).map(([event, hooks]) => [\n        event,\n        hooks.map(({ executable, args, env, ...hook }) => ({\n          ...hook,\n          command: [executable, ...(args ?? []).map(publicValue)].map(shellQuote).join(' '),\n          // Hook env stays in config-value form: the 0.40 profile hook contract\n          // types env as Record<string, AgentProfileConfigValue>.\n          ...(env ? { env: cloneRecord(env) } : {}),\n        })),\n      ]),\n    )\n  }\n  if (candidate.resources) {\n    if (candidate.resources.failOnError !== true) {\n      throw new Error('sealed candidate profile contains fields unsupported by generic profiles')\n    }\n    output.resources = {\n      failOnError: true,\n      ...(candidate.resources.files\n        ? {\n            files: candidate.resources.files.map((file) => ({\n              ...file,\n              resource: publicResource(file.resource),\n            })),\n          }\n        : {}),\n      ...(candidate.resources.tools\n        ? { tools: candidate.resources.tools.map(publicResource) }\n        : {}),\n      ...(candidate.resources.skills\n        ? { skills: candidate.resources.skills.map(publicResource) }\n        : {}),\n      ...(candidate.resources.agents\n        ? { agents: candidate.resources.agents.map(publicResource) }\n        : {}),\n      ...(candidate.resources.commands\n        ? { commands: candidate.resources.commands.map(publicResource) }\n        : {}),\n      ...(candidate.resources.instructions !== undefined\n        ? {\n            instructions:\n              typeof candidate.resources.instructions === 'string'\n                ? candidate.resources.instructions\n                : publicResource(candidate.resources.instructions),\n          }\n        : {}),\n    }\n  }\n  return output as AgentProfile\n}\n\n/** Recursively remove undefined object fields while refusing undefined array entries. */\nexport function omitUndefinedObjectFields(value: unknown, path: string): unknown {\n  if (Array.isArray(value)) {\n    return value.map((entry, index) => {\n      if (entry === undefined) {\n        throw new Error(`${path} produced an undefined array entry at ${index}`)\n      }\n      return omitUndefinedObjectFields(entry, `${path}[${index}]`)\n    })\n  }\n  if (value === null || typeof value !== 'object') return value\n  return Object.fromEntries(\n    Object.entries(value as Record<string, unknown>)\n      .filter(([, entry]) => entry !== undefined)\n      .map(([key, entry]) => [key, omitUndefinedObjectFields(entry, `${path}.${key}`)]),\n  )\n}\n\nfunction freezeMcpServers(servers: Record<string, AgentProfileMcpServer>): Record<string, unknown> {\n  return Object.fromEntries(\n    Object.entries(servers).map(([name, server]) => {\n      if (server.transport !== undefined && server.transport !== 'stdio') {\n        unsupportedProfileField(`mcp.${name}.transport=${server.transport}`)\n      }\n      if (server.url !== undefined) unsupportedProfileField(`mcp.${name}.url`)\n      if (server.headers !== undefined) unsupportedProfileField(`mcp.${name}.headers`)\n      if (server.metadata !== undefined) unsupportedProfileField(`mcp.${name}.metadata`)\n      return [\n        name,\n        {\n          ...(server.transport ? { transport: server.transport } : {}),\n          ...(server.command ? { command: server.command } : {}),\n          ...(server.args\n            ? {\n                args: server.args.map((value, index) =>\n                  candidatePublicValue(value, `mcp.${name}.args[${index}]`),\n                ),\n              }\n            : {}),\n          ...(server.env ? { env: mapCandidatePublicValues(server.env, `mcp.${name}.env`) } : {}),\n          ...(server.cwd ? { cwd: server.cwd } : {}),\n          ...(server.enabled === undefined ? {} : { enabled: server.enabled }),\n        },\n      ]\n    }),\n  )\n}\n\nfunction freezeResources(resources: NonNullable<AgentProfile['resources']>): unknown {\n  if (resources.failOnError !== true) {\n    throw new Error('candidate profile resources require failOnError: true')\n  }\n  return {\n    failOnError: true,\n    ...(resources.files\n      ? {\n          files: resources.files.map((file) => ({\n            ...file,\n            resource: freezeResource(file.resource),\n          })),\n        }\n      : {}),\n    ...(resources.tools ? { tools: resources.tools.map(freezeResource) } : {}),\n    ...(resources.skills ? { skills: resources.skills.map(freezeResource) } : {}),\n    ...(resources.agents ? { agents: resources.agents.map(freezeResource) } : {}),\n    ...(resources.commands ? { commands: resources.commands.map(freezeResource) } : {}),\n    ...(resources.instructions === undefined\n      ? {}\n      : {\n          instructions:\n            typeof resources.instructions === 'string'\n              ? resources.instructions\n              : freezeResource(resources.instructions),\n        }),\n  }\n}\n\nfunction freezeResource(resource: AgentProfileResourceRef): AgentCandidateResourceRef {\n  if (resource.kind === 'github') {\n    throw new Error(\n      'generic GitHub profile resources do not carry byte identity; use a candidate-profile source with a pinned commit, digest, and byte length',\n    )\n  }\n  const bytes = Buffer.from(resource.content, 'utf8')\n  return {\n    ...resource,\n    sha256: embeddedCandidateArtifact(bytes).sha256,\n    byteLength: bytes.byteLength,\n  }\n}\n\nfunction copyDirectProfileFields(\n  target: Record<string, unknown>,\n  source: Record<string, unknown>,\n): void {\n  for (const key of CANDIDATE_PROFILE_DIRECT_FIELDS) {\n    if (source[key] !== undefined) target[key] = source[key]\n  }\n}\n\nfunction assertCanonicalParse(input: unknown, parsed: unknown, label: string): void {\n  if (!Buffer.from(canonicalCandidateBytes(input)).equals(canonicalCandidateBytes(parsed))) {\n    throw new Error(`${label} contains unsupported or non-canonical fields`)\n  }\n}\n\nfunction publicResource(resource: AgentCandidateResourceRef): unknown {\n  if (resource.kind === 'inline') {\n    return { kind: 'inline', name: resource.name, content: resource.content }\n  }\n  return {\n    kind: 'github',\n    repository: `${resource.repository.owner}/${resource.repository.repo}`,\n    path: resource.path,\n    ref: resource.commit,\n    ...(resource.name ? { name: resource.name } : {}),\n  }\n}\n\n/** Freeze one profile config value into the candidate's PUBLIC-only config\n *  shape. A secret-ref has no candidate representation (AgentCandidateConfigValue\n *  is public-only), so it is rejected, never silently dropped or unwrapped. */\nfunction candidatePublicValue(\n  value: AgentProfileConfigValue,\n  path: string,\n): { kind: 'public'; value: string } {\n  if (value.kind !== 'public') unsupportedProfileField(`${path} (secret-ref '${value.key}')`)\n  return { kind: 'public', value: value.value }\n}\n\nfunction mapCandidatePublicValues(\n  values: Record<string, AgentProfileConfigValue>,\n  pathPrefix: string,\n): Record<string, { kind: 'public'; value: string }> {\n  return Object.fromEntries(\n    Object.entries(values).map(([name, value]) => [\n      name,\n      candidatePublicValue(value, `${pathPrefix}.${name}`),\n    ]),\n  )\n}\n\nfunction publicValue(value: AgentCandidateConfigValue): string {\n  return value.value\n}\n\nfunction cloneRecord<T>(values: Record<string, T>): Record<string, T> {\n  return Object.fromEntries(\n    Object.entries(values).map(([key, value]) => [key, { ...value }]),\n  ) as Record<string, T>\n}\n\nfunction hasEntries(value: unknown): boolean {\n  return value !== undefined && value !== null && typeof value === 'object'\n    ? Object.keys(value).length > 0\n    : false\n}\n\nfunction shellQuote(value: string): string {\n  return /^[A-Za-z0-9_./:@%+=,-]+$/.test(value) ? value : `'${value.replaceAll(\"'\", `'\"'\"'`)}'`\n}\n\nfunction unsupportedProfileField(path: string): never {\n  throw new Error(\n    `generic AgentProfile field ${path} is not representable in a sealed candidate profile`,\n  )\n}\n","/** Reject unknown fields while requiring every declared non-optional field. */\nexport function assertExactObjectKeys(\n  value: unknown,\n  required: readonly string[],\n  label: string,\n  optional: readonly string[] = [],\n): void {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`${label} must be an object`)\n  }\n  const allowed = new Set([...required, ...optional])\n  if (allowed.size !== required.length + optional.length) {\n    throw new Error(`${label} exact-key contract contains duplicate fields`)\n  }\n  for (const key of Object.keys(value)) {\n    if (!allowed.has(key)) throw new Error(`${label} contains unknown field ${key}`)\n  }\n  for (const key of required) {\n    if (!(key in value)) throw new Error(`${label} is missing field ${key}`)\n  }\n}\n","import {\n  type AgentCandidateArtifactRef,\n  agentCandidateArtifactRefSchema,\n  type Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport type { AgentCandidateExecutionClaim, AgentCandidateExecutionTerminalRecord } from './claim'\nimport { immutableCandidateValue } from './digest'\nimport { assertExactObjectKeys } from './exact-object'\n\nexport interface AgentCandidatePreparationEvidence {\n  readonly executionPlan: AgentCandidateArtifactRef\n  readonly materializationReceipt: AgentCandidateArtifactRef\n}\n\nexport function sealCandidatePreparationEvidence(\n  value: unknown,\n  executionPlanDigest: Sha256Digest,\n): AgentCandidatePreparationEvidence {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error('candidate execution preparation evidence must be an object')\n  }\n  const record = value as Record<string, unknown>\n  assertExactObjectKeys(\n    record,\n    ['executionPlan', 'materializationReceipt'],\n    'candidate execution preparation evidence',\n  )\n  const executionPlan = immutableCandidateValue(\n    agentCandidateArtifactRefSchema.parse(record.executionPlan),\n  )\n  const materializationReceipt = immutableCandidateValue(\n    agentCandidateArtifactRefSchema.parse(record.materializationReceipt),\n  )\n  if (executionPlan.sha256 !== executionPlanDigest) {\n    throw new Error('candidate execution plan artifact digest does not match its claim')\n  }\n  return Object.freeze({ executionPlan, materializationReceipt })\n}\n\nexport interface PersistedAgentCandidateExecutionClaim extends AgentCandidateExecutionClaim {\n  phase: 'claimed'\n  leaseDigest: Sha256Digest\n}\n\nexport interface PersistedAgentCandidateExecutionPending {\n  kind: 'candidate-execution-pending-terminal'\n  terminal: AgentCandidateExecutionTerminalRecord\n}\n\nexport interface PersistedAgentCandidateExecutionPhase {\n  kind: 'candidate-execution-phase'\n  executionId: string\n  attempt: number\n  executionPlanDigest: Sha256Digest\n  phase: 'candidate-may-run'\n}\n\nexport interface PersistedAgentCandidateExecutionTerminal {\n  terminal: AgentCandidateExecutionTerminalRecord\n}\n","import type {\n  AgentCandidateArtifactRef,\n  AgentCandidateFixedSpend,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\nimport { agentCandidateArtifactRefSchema } from '@tangle-network/agent-interface'\n\nimport type {\n  AgentCandidateExecutionClaim,\n  AgentCandidateExecutionFailureClass,\n  AgentCandidateExecutionFinishResult,\n  AgentCandidateExecutionPhase,\n  AgentCandidateExecutionRecoveryEvidence,\n  AgentCandidateExecutionStageResult,\n  AgentCandidateExecutionTerminalRecord,\n  AgentCandidateExecutionTerminalResult,\n} from './claim'\nimport { sealCandidatePreparationEvidence } from './claim-file-formats'\nimport { canonicalCandidateDigest, immutableCandidateValue } from './digest'\nimport { assertExactObjectKeys as assertExactKeys } from './exact-object'\n\nconst SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/\n\nexport function terminalRecord(\n  claim: AgentCandidateExecutionClaim,\n  result: AgentCandidateExecutionTerminalResult,\n): AgentCandidateExecutionTerminalRecord {\n  const terminal = sealTerminalResult(result)\n  const value = {\n    executionId: claim.executionId,\n    attempt: claim.attempt,\n    bundleDigest: claim.bundleDigest,\n    executionPlanDigest: claim.executionPlanDigest,\n    preparationEvidence: claim.preparationEvidence,\n    ...terminal,\n  }\n  return immutableCandidateValue({\n    ...value,\n    terminalDigest: canonicalCandidateDigest(value),\n  }) as AgentCandidateExecutionTerminalRecord\n}\n\nexport function recoveredTerminalRecord(\n  claim: AgentCandidateExecutionClaim,\n  phase: AgentCandidateExecutionPhase,\n  evidence: AgentCandidateExecutionRecoveryEvidence,\n): AgentCandidateExecutionTerminalRecord {\n  const recovered = sealRecoveryEvidence(evidence, claim)\n  return terminalRecord(claim, {\n    status: 'failed',\n    failureClass:\n      recovered.failureClass === 'pre-model-infrastructure' && phase !== 'claimed'\n        ? 'unknown'\n        : recovered.failureClass,\n    usage: recovered.usage,\n    modelSettlement: recovered.modelSettlement,\n    ...(recovered.failureEvidence ? { failureEvidence: recovered.failureEvidence } : {}),\n  })\n}\n\nexport function assertTerminalAllowedInPhase(\n  phase: AgentCandidateExecutionPhase,\n  terminal: AgentCandidateExecutionTerminalRecord,\n): void {\n  if (\n    phase === 'candidate-may-run' &&\n    terminal.status === 'failed' &&\n    terminal.failureClass === 'pre-model-infrastructure'\n  ) {\n    throw new Error('candidate execution crossed candidate-may-run before pre-model failure')\n  }\n  if (\n    phase === 'claimed' &&\n    (terminal.status === 'succeeded' ||\n      (terminal.status === 'failed' &&\n        (terminal.failureClass === 'execution' ||\n          terminal.failureClass === 'post-model-infrastructure')))\n  ) {\n    throw new Error('candidate execution terminal requires candidate-may-run phase')\n  }\n}\n\nexport function rejectedFinish(\n  existing: AgentCandidateExecutionTerminalRecord,\n  requestedTerminalDigest: Sha256Digest,\n): AgentCandidateExecutionFinishResult {\n  return Object.freeze({\n    finished: false,\n    terminal: existing,\n    exactReplay: existing.terminalDigest === requestedTerminalDigest,\n  })\n}\n\nexport function rejectedStage(\n  existing: AgentCandidateExecutionTerminalRecord,\n  requested: AgentCandidateExecutionTerminalRecord,\n): AgentCandidateExecutionStageResult {\n  return Object.freeze({\n    staged: false,\n    terminal: existing,\n    exactReplay: existing.terminalDigest === requested.terminalDigest,\n  })\n}\n\nexport function requireStagedTerminal(\n  staged: AgentCandidateExecutionTerminalRecord | undefined,\n  terminalDigest: Sha256Digest,\n): AgentCandidateExecutionTerminalRecord {\n  if (!staged) throw new Error('candidate execution terminal has not been staged')\n  if (staged.terminalDigest !== terminalDigest) {\n    throw new Error('candidate execution terminal digest does not match staged outbox')\n  }\n  return staged\n}\n\nexport function sealTerminalDigest(value: Sha256Digest): Sha256Digest {\n  assertSha256Digest(value, 'terminalDigest')\n  return value\n}\n\nexport function assertRecoveryMatchesStaged(\n  staged: AgentCandidateExecutionTerminalRecord,\n  recovered: AgentCandidateExecutionTerminalRecord,\n): void {\n  if (\n    canonicalCandidateDigest(staged.usage) !== canonicalCandidateDigest(recovered.usage) ||\n    canonicalCandidateDigest(staged.modelSettlement) !==\n      canonicalCandidateDigest(recovered.modelSettlement)\n  ) {\n    throw new Error('candidate execution recovery evidence does not match staged model evidence')\n  }\n}\n\nexport function sealTerminalRecordValue(\n  value: Record<string, unknown>,\n  label: string,\n): AgentCandidateExecutionTerminalRecord {\n  const status = requireTerminalStatus(value.status, label)\n  assertExactKeys(\n    value,\n    status === 'succeeded'\n      ? [\n          'executionId',\n          'attempt',\n          'bundleDigest',\n          'executionPlanDigest',\n          'preparationEvidence',\n          'terminalDigest',\n          'status',\n          'usage',\n          'modelSettlement',\n          'taskOutcome',\n          'benchmarkResult',\n          'runReceipt',\n        ]\n      : [\n          'executionId',\n          'attempt',\n          'bundleDigest',\n          'executionPlanDigest',\n          'preparationEvidence',\n          'terminalDigest',\n          'status',\n          'failureClass',\n          'usage',\n          'modelSettlement',\n          ...(value.failureEvidence ? ['failureEvidence'] : []),\n        ],\n    label,\n  )\n  const executionPlanDigest = requireString(\n    value.executionPlanDigest,\n    label,\n    'executionPlanDigest',\n  ) as Sha256Digest\n  const identity = {\n    executionId: requireString(value.executionId, label, 'executionId'),\n    attempt: requireNumber(value.attempt, label, 'attempt'),\n    bundleDigest: requireString(value.bundleDigest, label, 'bundleDigest') as Sha256Digest,\n    executionPlanDigest,\n    preparationEvidence: sealCandidatePreparationEvidence(\n      value.preparationEvidence,\n      executionPlanDigest,\n    ),\n  }\n  assertExecutionId(identity.executionId)\n  if (!Number.isSafeInteger(identity.attempt) || identity.attempt < 1) {\n    throw new Error(`${label} has invalid attempt`)\n  }\n  assertSha256Digest(identity.bundleDigest, 'bundleDigest')\n  assertSha256Digest(identity.executionPlanDigest, 'executionPlanDigest')\n  if (identity.preparationEvidence.executionPlan.sha256 !== identity.executionPlanDigest) {\n    throw new Error(`${label} execution plan artifact does not match executionPlanDigest`)\n  }\n  const result = sealTerminalResult(\n    status === 'succeeded'\n      ? {\n          status,\n          usage: requireObject(value.usage, label, 'usage') as unknown as AgentCandidateFixedSpend,\n          modelSettlement: requireArtifactRef(value.modelSettlement, label, 'modelSettlement'),\n          taskOutcome: requireArtifactRef(value.taskOutcome, label, 'taskOutcome'),\n          benchmarkResult: requireArtifactRef(value.benchmarkResult, label, 'benchmarkResult'),\n          runReceipt: requireArtifactRef(value.runReceipt, label, 'runReceipt'),\n        }\n      : {\n          status,\n          failureClass: requireFailureClass(value.failureClass, label),\n          usage: requireObject(value.usage, label, 'usage') as unknown as AgentCandidateFixedSpend,\n          modelSettlement: requireArtifactRef(value.modelSettlement, label, 'modelSettlement'),\n          ...(value.failureEvidence\n            ? {\n                failureEvidence: requireArtifactRef(\n                  value.failureEvidence,\n                  label,\n                  'failureEvidence',\n                ),\n              }\n            : {}),\n        },\n  )\n  const material = { ...identity, ...result }\n  const terminalDigest = requireString(\n    value.terminalDigest,\n    label,\n    'terminalDigest',\n  ) as Sha256Digest\n  assertSha256Digest(terminalDigest, 'terminalDigest')\n  if (terminalDigest !== canonicalCandidateDigest(material)) {\n    throw new Error(`${label} has invalid terminalDigest`)\n  }\n  return immutableCandidateValue({\n    ...material,\n    terminalDigest,\n  }) as AgentCandidateExecutionTerminalRecord\n}\n\nexport function assertTerminalMatchesClaim(\n  terminal: AgentCandidateExecutionTerminalRecord,\n  claim: AgentCandidateExecutionClaim,\n  path: string,\n): void {\n  if (\n    terminal.executionId !== claim.executionId ||\n    terminal.attempt !== claim.attempt ||\n    terminal.bundleDigest !== claim.bundleDigest ||\n    terminal.executionPlanDigest !== claim.executionPlanDigest ||\n    canonicalCandidateDigest(terminal.preparationEvidence) !==\n      canonicalCandidateDigest(claim.preparationEvidence)\n  ) {\n    throw new Error(`candidate execution terminal record at ${path} does not match its claim`)\n  }\n}\n\nexport function assertTerminalMatchesStaged(\n  terminal: AgentCandidateExecutionTerminalRecord,\n  staged: AgentCandidateExecutionTerminalRecord,\n  path: string,\n): void {\n  if (\n    terminal.terminalDigest !== staged.terminalDigest ||\n    canonicalCandidateDigest(terminal) !== canonicalCandidateDigest(staged)\n  ) {\n    throw new Error(`candidate execution terminal record at ${path} differs from staged outbox`)\n  }\n}\n\nfunction sealRecoveryEvidence(\n  evidence: AgentCandidateExecutionRecoveryEvidence,\n  claim: AgentCandidateExecutionClaim,\n): AgentCandidateExecutionRecoveryEvidence {\n  assertExactKeys(\n    evidence,\n    [\n      'failureClass',\n      'usage',\n      'modelSettlement',\n      'process',\n      'model',\n      ...(evidence.failureEvidence ? ['failureEvidence'] : []),\n      ...(evidence.memory ? ['memory'] : []),\n    ],\n    'candidate execution recovery evidence',\n  )\n  assertFailureClass(evidence.failureClass)\n  const usage = sealUsage(evidence.usage)\n  if (evidence.failureClass === 'pre-model-infrastructure' && usage.modelCalls !== 0) {\n    throw new Error('pre-model infrastructure failure cannot contain model calls')\n  }\n  const modelSettlement = sealArtifactRef(evidence.modelSettlement, 'modelSettlement')\n  const failureEvidence = evidence.failureEvidence\n    ? sealArtifactRef(evidence.failureEvidence, 'failureEvidence')\n    : undefined\n  assertExactKeys(\n    evidence.process,\n    ['stopped', 'executionPlanDigest'],\n    'candidate execution process closure evidence',\n  )\n  if (\n    evidence.process.stopped !== true ||\n    evidence.process.executionPlanDigest !== claim.executionPlanDigest\n  ) {\n    throw new Error('candidate execution recovery does not prove the claimed process stopped')\n  }\n  assertExactKeys(\n    evidence.model,\n    ['closed', 'preparationId', 'grantDigest'],\n    'candidate execution model closure evidence',\n  )\n  if (\n    evidence.model.closed !== true ||\n    evidence.model.preparationId !== claim.cleanup.preparationId ||\n    evidence.model.grantDigest !== claim.cleanup.modelGrantDigest\n  ) {\n    throw new Error('candidate execution recovery does not prove the claimed model grant closed')\n  }\n  if (claim.cleanup.memory) {\n    if (!evidence.memory) {\n      throw new Error('candidate execution recovery is missing memory closure evidence')\n    }\n    assertExactKeys(\n      evidence.memory,\n      ['closed', 'preparationId', 'accessDigest', 'effectiveNamespace'],\n      'candidate execution memory closure evidence',\n    )\n    if (\n      evidence.memory.closed !== true ||\n      evidence.memory.preparationId !== claim.cleanup.preparationId ||\n      evidence.memory.accessDigest !== claim.cleanup.memory.accessDigest ||\n      evidence.memory.effectiveNamespace !== claim.cleanup.memory.effectiveNamespace\n    ) {\n      throw new Error(\n        'candidate execution recovery does not prove the claimed memory access closed',\n      )\n    }\n  } else if (evidence.memory !== undefined) {\n    throw new Error('candidate execution recovery has unexpected memory closure evidence')\n  }\n  return Object.freeze({\n    failureClass: evidence.failureClass,\n    usage,\n    modelSettlement,\n    ...(failureEvidence ? { failureEvidence } : {}),\n    process: Object.freeze({ ...evidence.process }),\n    model: Object.freeze({ ...evidence.model }),\n    ...(evidence.memory ? { memory: Object.freeze({ ...evidence.memory }) } : {}),\n  })\n}\n\nfunction sealTerminalResult(\n  result: AgentCandidateExecutionTerminalResult,\n): AgentCandidateExecutionTerminalResult {\n  if (result.status !== 'succeeded' && result.status !== 'failed') {\n    throw new Error('candidate execution terminal status is invalid')\n  }\n  assertExactKeys(\n    result,\n    result.status === 'succeeded'\n      ? ['status', 'usage', 'modelSettlement', 'taskOutcome', 'benchmarkResult', 'runReceipt']\n      : [\n          'status',\n          'failureClass',\n          'usage',\n          'modelSettlement',\n          ...(result.failureEvidence ? ['failureEvidence'] : []),\n        ],\n    'candidate execution terminal result',\n  )\n  const usage = sealUsage(result.usage)\n  const modelSettlement = sealArtifactRef(result.modelSettlement, 'modelSettlement')\n  if (result.status === 'succeeded') {\n    return Object.freeze({\n      status: 'succeeded',\n      usage,\n      modelSettlement,\n      taskOutcome: sealArtifactRef(result.taskOutcome, 'taskOutcome'),\n      benchmarkResult: sealArtifactRef(result.benchmarkResult, 'benchmarkResult'),\n      runReceipt: sealArtifactRef(result.runReceipt, 'runReceipt'),\n    })\n  }\n  assertFailureClass(result.failureClass)\n  if (result.failureClass === 'pre-model-infrastructure' && usage.modelCalls !== 0) {\n    throw new Error('pre-model infrastructure failure cannot contain model calls')\n  }\n  return Object.freeze({\n    status: 'failed',\n    failureClass: result.failureClass,\n    usage,\n    modelSettlement,\n    ...(result.failureEvidence\n      ? { failureEvidence: sealArtifactRef(result.failureEvidence, 'failureEvidence') }\n      : {}),\n  })\n}\n\nfunction sealUsage(usage: AgentCandidateFixedSpend): AgentCandidateFixedSpend {\n  assertExactKeys(\n    usage,\n    [\n      'costUsdNanos',\n      'inputTokens',\n      'outputTokens',\n      'cachedInputTokens',\n      'reasoningTokens',\n      'modelCalls',\n      'costProvenance',\n    ],\n    'candidate execution terminal usage',\n  )\n  for (const field of [\n    'costUsdNanos',\n    'inputTokens',\n    'outputTokens',\n    'cachedInputTokens',\n    'reasoningTokens',\n    'modelCalls',\n  ] as const) {\n    assertCount(usage[field], `terminal usage ${field}`)\n  }\n  if (usage.costProvenance !== 'observed' && usage.costProvenance !== 'estimated') {\n    throw new Error('terminal usage costProvenance must be observed or estimated')\n  }\n  return Object.freeze({\n    costUsdNanos: usage.costUsdNanos,\n    inputTokens: usage.inputTokens,\n    outputTokens: usage.outputTokens,\n    cachedInputTokens: usage.cachedInputTokens,\n    reasoningTokens: usage.reasoningTokens,\n    modelCalls: usage.modelCalls,\n    costProvenance: usage.costProvenance,\n  })\n}\n\nfunction sealArtifactRef(ref: AgentCandidateArtifactRef, label: string): AgentCandidateArtifactRef {\n  const parsed = agentCandidateArtifactRefSchema.parse(ref)\n  if (!Number.isSafeInteger(parsed.byteLength)) {\n    throw new Error(`candidate execution terminal ${label} byteLength exceeds safe integer range`)\n  }\n  return immutableCandidateValue(parsed)\n}\n\nfunction requireArtifactRef(\n  value: unknown,\n  path: string,\n  field: string,\n): AgentCandidateArtifactRef {\n  return requireObject(value, path, field) as unknown as AgentCandidateArtifactRef\n}\n\nfunction requireString(value: unknown, path: string, field: string): string {\n  if (typeof value !== 'string') {\n    throw new Error(`candidate execution record at ${path} has invalid ${field}`)\n  }\n  return value\n}\n\nfunction requireNumber(value: unknown, path: string, field: string): number {\n  if (typeof value !== 'number') {\n    throw new Error(`candidate execution record at ${path} has invalid ${field}`)\n  }\n  return value\n}\n\nfunction requireObject(value: unknown, path: string, field: string): Record<string, unknown> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`candidate execution record at ${path} has invalid ${field}`)\n  }\n  return value as Record<string, unknown>\n}\n\nfunction requireTerminalStatus(\n  value: unknown,\n  path: string,\n): AgentCandidateExecutionTerminalResult['status'] {\n  if (value !== 'succeeded' && value !== 'failed') {\n    throw new Error(`candidate execution terminal record at ${path} has invalid status`)\n  }\n  return value\n}\n\nfunction requireFailureClass(value: unknown, path: string): AgentCandidateExecutionFailureClass {\n  try {\n    assertFailureClass(value)\n    return value\n  } catch (error) {\n    throw new Error(`candidate execution terminal record at ${path} has invalid failureClass`, {\n      cause: error,\n    })\n  }\n}\n\nfunction assertFailureClass(value: unknown): asserts value is AgentCandidateExecutionFailureClass {\n  if (\n    value !== 'pre-model-infrastructure' &&\n    value !== 'execution' &&\n    value !== 'post-model-infrastructure' &&\n    value !== 'unknown'\n  ) {\n    throw new Error('candidate execution failureClass is invalid')\n  }\n}\n\nfunction assertExecutionId(value: unknown): asserts value is string {\n  if (typeof value !== 'string' || !/^[A-Za-z0-9._:-]{1,200}$/.test(value)) {\n    throw new Error('candidate execution claim executionId is invalid')\n  }\n}\n\nfunction assertSha256Digest(value: string, field: string): void {\n  if (!SHA256_PATTERN.test(value)) {\n    throw new Error(`candidate execution claim ${field} must be a lowercase sha256 digest`)\n  }\n}\n\nfunction assertCount(value: unknown, label: string): asserts value is number {\n  if (!Number.isSafeInteger(value) || (value as number) < 0) {\n    throw new Error(`candidate execution ${label} must be a non-negative safe integer`)\n  }\n}\n","export const DEFAULT_CANDIDATE_CLEANUP_TIMEOUT_MS = 30_000\n/** Largest delay Node schedules without clamping to one millisecond. */\nexport const MAX_CANDIDATE_TIMER_INTERVAL_MS = 2_147_483_647\n\nexport function candidateCleanupTimeout(timeoutMs: number | undefined): number {\n  const effective = timeoutMs ?? DEFAULT_CANDIDATE_CLEANUP_TIMEOUT_MS\n  if (\n    !Number.isSafeInteger(effective) ||\n    effective <= 0 ||\n    effective > MAX_CANDIDATE_TIMER_INTERVAL_MS\n  ) {\n    throw new Error('candidate cleanup timeout is outside the supported timer range')\n  }\n  return effective\n}\n\nexport function candidateCleanupDeadline(timeoutMs: number | undefined): number {\n  return Date.now() + candidateCleanupTimeout(timeoutMs)\n}\n\n/** Freeze a separate result-construction budget; defaults to the task wall limit. */\nexport function candidateResultTimeout(\n  timeoutMs: number | undefined,\n  taskTimeoutMs: number,\n): number {\n  const effective = timeoutMs ?? taskTimeoutMs\n  if (\n    !Number.isSafeInteger(effective) ||\n    effective <= 0 ||\n    effective > MAX_CANDIDATE_TIMER_INTERVAL_MS\n  ) {\n    throw new Error('candidate result timeout is outside the supported timer range')\n  }\n  return effective\n}\n\n/** Bound an evaluator cleanup call and cancel the underlying port at expiry. */\nexport async function withinCandidateCleanupDeadline<T>(\n  operation: (signal: AbortSignal) => Promise<T>,\n  deadlineAtMs: number,\n  label: string,\n): Promise<T> {\n  return withinCandidateDeadline(operation, deadlineAtMs, new CandidateCleanupTimeoutError(label))\n}\n\n/**\n * Bound cancellable scoring/result work. Every side-effecting port called by\n * `operation` must honor the supplied signal before durable publication.\n */\nexport async function withinCandidateResultDeadline<T>(\n  operation: (signal: AbortSignal) => Promise<T>,\n  deadlineAtMs: number,\n  label: string,\n): Promise<T> {\n  return withinCandidateDeadline(operation, deadlineAtMs, new CandidateResultTimeoutError(label))\n}\n\nasync function withinCandidateDeadline<T>(\n  operation: (signal: AbortSignal) => Promise<T>,\n  deadlineAtMs: number,\n  timeoutError: Error,\n): Promise<T> {\n  const remainingMs = deadlineAtMs - Date.now()\n  if (remainingMs <= 0) throw timeoutError\n\n  const controller = new AbortController()\n  const pending = Promise.resolve().then(() => operation(controller.signal))\n  void pending.catch(() => undefined)\n  let timer: ReturnType<typeof setTimeout> | undefined\n  try {\n    const result = await Promise.race([\n      pending,\n      new Promise<never>((_resolve, reject) => {\n        timer = setTimeout(() => {\n          controller.abort(timeoutError)\n          reject(timeoutError)\n        }, remainingMs)\n      }),\n    ])\n    // Exact-boundary completion is ambiguous under event-loop delay.\n    if (Date.now() >= deadlineAtMs) {\n      controller.abort(timeoutError)\n      throw timeoutError\n    }\n    return result\n  } finally {\n    if (timer) clearTimeout(timer)\n  }\n}\n\nexport class CandidateCleanupTimeoutError extends Error {\n  constructor(label: string) {\n    super(`${label} did not complete before the evaluator cleanup deadline`)\n    this.name = 'CandidateCleanupTimeoutError'\n  }\n}\n\nexport class CandidateResultTimeoutError extends Error {\n  constructor(label: string) {\n    super(`${label} did not complete before the evaluator result deadline`)\n    this.name = 'CandidateResultTimeoutError'\n  }\n}\n","import { MAX_CANDIDATE_TIMER_INTERVAL_MS } from './cleanup'\n\nexport const CANDIDATE_TERMINAL_PERSISTENCE_MARGIN_MS = 10_000\nconst CANDIDATE_POST_RUN_CLEANUP_PHASES = 4\n\n/** Process stop, access closure, model evidence, and task/result evidence. */\nexport function candidatePostRunWindowMs(\n  cleanupTimeoutMs: number,\n  resultTimeoutMs: number,\n): number {\n  const windowMs =\n    cleanupTimeoutMs * CANDIDATE_POST_RUN_CLEANUP_PHASES +\n    resultTimeoutMs +\n    CANDIDATE_TERMINAL_PERSISTENCE_MARGIN_MS\n  if (!Number.isSafeInteger(windowMs) || windowMs > MAX_CANDIDATE_TIMER_INTERVAL_MS) {\n    throw new Error('candidate post-run window exceeds the supported timer range')\n  }\n  return windowMs\n}\n\n/** Maximum owner lifetime from claim through process stop, access closure, and terminal write. */\nexport function candidateExecutionOwnerWindowMs(\n  timeoutMs: number,\n  cleanupTimeoutMs: number,\n  resultTimeoutMs: number,\n): number {\n  const windowMs = timeoutMs + candidatePostRunWindowMs(cleanupTimeoutMs, resultTimeoutMs)\n  if (!Number.isSafeInteger(windowMs) || windowMs > MAX_CANDIDATE_TIMER_INTERVAL_MS) {\n    throw new Error('candidate execution and cleanup window exceeds the supported timer range')\n  }\n  return windowMs\n}\n\n/** Time reserved after scoring for failure evidence plus terminal publication. */\nexport function candidateTerminalWindowMs(cleanupTimeoutMs: number): number {\n  const windowMs = cleanupTimeoutMs + CANDIDATE_TERMINAL_PERSISTENCE_MARGIN_MS\n  if (!Number.isSafeInteger(windowMs) || windowMs > MAX_CANDIDATE_TIMER_INTERVAL_MS) {\n    throw new Error('candidate terminal window exceeds the supported timer range')\n  }\n  return windowMs\n}\n","import { constants as fsConstants } from 'node:fs'\nimport { lstat, open, readdir, realpath } from 'node:fs/promises'\nimport { relative, resolve, sep } from 'node:path'\n\nimport type {\n  AgentCandidateArtifactRef,\n  AgentCandidateCapturedArtifact,\n  AgentCandidateProfilePlanMaterial,\n  AgentCandidateWorkspaceManifestMaterial,\n  AgentCandidateWorkspaceSnapshotEvidence,\n} from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateBytes, sha256Bytes } from './digest'\nimport type { AgentCandidateArtifactPort } from './types'\n\nexport function artifactCacheKey(artifact: AgentCandidateCapturedArtifact): string {\n  return `${artifact.sha256}:${artifact.byteLength}`\n}\n\nexport async function readVerifiedArtifact(\n  artifact: AgentCandidateCapturedArtifact,\n  port: AgentCandidateArtifactPort,\n): Promise<Uint8Array> {\n  const bytes =\n    'content' in artifact\n      ? Buffer.from(artifact.content, 'base64')\n      : await port.read(artifact as AgentCandidateArtifactRef)\n  verifyBytes(bytes, artifact.sha256, artifact.byteLength, 'candidate artifact')\n  return Uint8Array.from(bytes)\n}\n\nexport function verifyBytes(\n  bytes: Uint8Array,\n  digest: string,\n  byteLength: number,\n  label: string,\n): void {\n  if (bytes.byteLength !== byteLength) {\n    throw new Error(`${label} byte length ${bytes.byteLength} does not match ${byteLength}`)\n  }\n  const actual = sha256Bytes(bytes)\n  if (actual !== digest) {\n    throw new Error(`${label} digest ${actual} does not match ${digest}`)\n  }\n}\n\nexport async function verifyWorkspaceSnapshotArtifacts(\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n  port: AgentCandidateArtifactPort,\n): Promise<{ manifest: Uint8Array; archive: Uint8Array }> {\n  const [manifest, archive] = await Promise.all([\n    readVerifiedArtifact(snapshot.manifest, port),\n    readVerifiedArtifact(snapshot.archive, port),\n  ])\n  const canonicalManifest = canonicalCandidateBytes(snapshot.material)\n  if (!Buffer.from(manifest).equals(Buffer.from(canonicalManifest))) {\n    throw new Error('workspace manifest artifact is not the exact canonical manifest material')\n  }\n  if (sha256Bytes(canonicalManifest) !== snapshot.digest) {\n    throw new Error('workspace snapshot digest does not match its canonical manifest material')\n  }\n  return { manifest, archive }\n}\n\nexport async function verifyMaterializedWorkspace(\n  root: string,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n  options: { ignoredProtectedRootEntries?: readonly ('.git' | '.sidecar')[] } = {},\n): Promise<void> {\n  const observed = await scanWorkspace(root, new Set(options.ignoredProtectedRootEntries ?? []))\n  assertWorkspaceManifest(observed.manifest, expected)\n}\n\nexport async function captureMaterializedWorkspace(\n  root: string,\n  options: {\n    ignoredProtectedRootEntries?: readonly ('.git' | '.sidecar')[]\n    limits?: {\n      maxFiles: number\n      maxFileBytes: number\n      maxTotalFileBytes: number\n    }\n  } = {},\n): Promise<{\n  manifest: AgentCandidateWorkspaceManifestMaterial\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>\n}> {\n  const observed = await scanWorkspace(\n    root,\n    new Set(options.ignoredProtectedRootEntries ?? []),\n    options.limits,\n  )\n  return {\n    manifest: observed.manifest,\n    files: observed.files.map((file) => ({\n      path: file.path,\n      mode: file.mode,\n      bytes: Uint8Array.from(file.bytes),\n    })),\n  }\n}\n\n/** Capture exact verified regular-file bytes for fresh isolated materialization. */\nexport async function readMaterializedWorkspaceFiles(\n  root: string,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n  options: { ignoredProtectedRootEntries?: readonly ('.git' | '.sidecar')[] } = {},\n): Promise<ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>> {\n  const observed = await captureMaterializedWorkspace(root, options)\n  assertWorkspaceManifest(observed.manifest, expected)\n  return observed.files.map((file) =>\n    Object.freeze({ path: file.path, mode: file.mode, bytes: Uint8Array.from(file.bytes) }),\n  )\n}\n\nexport function candidateWorkspaceManifest(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n): AgentCandidateWorkspaceManifestMaterial {\n  return {\n    kind: 'agent-candidate-workspace-manifest',\n    files: files\n      .map((file) => ({\n        path: file.path,\n        mode: file.mode,\n        sha256: sha256Bytes(file.bytes),\n        byteLength: file.bytes.byteLength,\n      }))\n      .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)),\n  }\n}\n\nfunction assertWorkspaceManifest(\n  observed: AgentCandidateWorkspaceManifestMaterial,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n): void {\n  if (!Buffer.from(canonicalCandidateBytes(observed)).equals(canonicalCandidateBytes(expected))) {\n    throw new Error(\n      'materialized workspace files, modes, or bytes do not match the signed manifest',\n    )\n  }\n}\n\nexport async function verifyMaterializedProfileWorkspace(\n  root: string,\n  expected: AgentCandidateProfilePlanMaterial,\n): Promise<void> {\n  const observed = await scanWorkspace(root, new Set())\n  const observedProfile = observed.manifest.files.map(({ path, mode, sha256 }) => ({\n    relPath: path,\n    mode,\n    contentSha256: sha256,\n  }))\n  if (\n    !Buffer.from(canonicalCandidateBytes(observedProfile)).equals(\n      canonicalCandidateBytes(expected.files),\n    )\n  ) {\n    throw new Error('profile staging files, modes, or bytes do not match the signed profile plan')\n  }\n}\n\nasync function scanWorkspace(\n  root: string,\n  ignoredProtectedRootEntries: ReadonlySet<string>,\n  limits?: {\n    maxFiles: number\n    maxFileBytes: number\n    maxTotalFileBytes: number\n  },\n): Promise<{\n  manifest: AgentCandidateWorkspaceManifestMaterial\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n}> {\n  const absoluteRoot = resolve(root)\n  const rootStats = await lstat(absoluteRoot)\n  if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) {\n    throw new Error('workspace root must be a real directory')\n  }\n  if ((await realpath(absoluteRoot)) !== absoluteRoot) {\n    throw new Error('workspace root has a symlinked path component')\n  }\n  const capturedFiles: Array<{ path: string; mode: number; bytes: Uint8Array }> = []\n  let totalBytes = 0\n\n  async function visit(directory: string): Promise<void> {\n    const entries = await readdir(directory, { withFileTypes: true })\n    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))\n    for (const entry of entries) {\n      if (directory === absoluteRoot && ignoredProtectedRootEntries.has(entry.name)) {\n        continue\n      }\n      const absolute = resolve(directory, entry.name)\n      const relPath = relative(absoluteRoot, absolute).split(sep).join('/')\n      if (!relPath || relPath.startsWith('../') || relPath.includes('/../')) {\n        throw new Error(`workspace entry escapes root: ${relPath}`)\n      }\n      const stats = await lstat(absolute)\n      if (stats.isSymbolicLink()) {\n        throw new Error(`workspace contains a symlink: ${relPath}`)\n      }\n      if (stats.isDirectory()) {\n        await visit(absolute)\n        continue\n      }\n      if (!stats.isFile()) {\n        throw new Error(`workspace contains a non-regular entry: ${relPath}`)\n      }\n      if (limits && capturedFiles.length >= limits.maxFiles) {\n        throw new Error('workspace exceeds maxFiles')\n      }\n      const descriptor = await open(\n        absolute,\n        fsConstants.O_RDONLY |\n          (typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0),\n      )\n      try {\n        const openedStats = await descriptor.stat()\n        if (!openedStats.isFile()) {\n          throw new Error(`workspace contains a non-regular entry: ${relPath}`)\n        }\n        if (openedStats.nlink !== 1) {\n          throw new Error(`workspace contains a hard-linked file: ${relPath}`)\n        }\n        const mode = openedStats.mode & 0o777\n        if (limits && openedStats.size > limits.maxFileBytes) {\n          throw new Error(`workspace file exceeds maxFileBytes: ${relPath}`)\n        }\n        const remainingBytes = limits ? limits.maxTotalFileBytes - totalBytes : undefined\n        if (remainingBytes !== undefined && openedStats.size > remainingBytes) {\n          throw new Error('workspace exceeds maxTotalFileBytes')\n        }\n        const bytes = await readBoundedFile(\n          descriptor,\n          limits ? Math.min(limits.maxFileBytes, remainingBytes ?? limits.maxFileBytes) : undefined,\n          relPath,\n        )\n        totalBytes += bytes.byteLength\n        capturedFiles.push({ path: relPath, mode, bytes: Uint8Array.from(bytes) })\n      } finally {\n        await descriptor.close()\n      }\n    }\n  }\n\n  await visit(absoluteRoot)\n  return {\n    manifest: candidateWorkspaceManifest(capturedFiles),\n    files: capturedFiles,\n  }\n}\n\nasync function readBoundedFile(\n  descriptor: Awaited<ReturnType<typeof open>>,\n  maxBytes: number | undefined,\n  path: string,\n): Promise<Buffer> {\n  if (maxBytes === undefined) return await descriptor.readFile()\n  const chunks: Buffer[] = []\n  let total = 0\n  while (true) {\n    const remaining = maxBytes - total\n    const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, remaining + 1))\n    const { bytesRead } = await descriptor.read(chunk, 0, chunk.byteLength, null)\n    if (bytesRead === 0) break\n    total += bytesRead\n    if (total > maxBytes) throw new Error(`workspace file exceeds its capture limit: ${path}`)\n    chunks.push(chunk.subarray(0, bytesRead))\n  }\n  return Buffer.concat(chunks, total)\n}\n","import { spawn } from 'node:child_process'\nimport { mkdir, mkdtemp, readFile, realpath, rm, stat } from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { join, resolve } from 'node:path'\n\nimport type {\n  AgentCandidateCode,\n  AgentCandidateGitHubRepository,\n  AgentCandidateGitHubResource,\n  AgentCandidateWorkspaceManifestMaterial,\n} from '@tangle-network/agent-interface'\n\nimport { candidateWorkspaceManifest, verifyBytes } from './artifacts'\nimport { canonicalCandidateBytes } from './digest'\nimport type { AgentCandidateRepositoryPort } from './types'\n\ninterface GitResult {\n  stdout: Buffer\n  stderr: Buffer\n}\n\nexport async function verifyCandidateCode(\n  code: AgentCandidateCode,\n  repositories: AgentCandidateRepositoryPort,\n  patchBytes?: Uint8Array,\n): Promise<string | undefined> {\n  if (code.kind === 'disabled') return undefined\n  const repositoryRoot = await verifiedRepositoryRoot(code.repository, repositories)\n  await assertCommitAndBaseTree(repositoryRoot, code.baseCommit, code.baseTree)\n\n  if (code.kind === 'no-op') {\n    await assertSafeTree(repositoryRoot, code.baseTree)\n    return code.baseTree\n  }\n  if (!patchBytes) throw new Error('git-patch candidate is missing verified patch bytes')\n\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-git-'))\n  try {\n    const indexFile = join(temporary, 'index')\n    await runCandidateGit(repositoryRoot, ['read-tree', code.baseTree], undefined, {\n      GIT_INDEX_FILE: indexFile,\n    })\n    await runCandidateGit(\n      repositoryRoot,\n      ['apply', '--cached', '--binary', '--whitespace=nowarn', '-'],\n      patchBytes,\n      { GIT_INDEX_FILE: indexFile },\n    )\n    const candidateTree = (\n      await runCandidateGit(repositoryRoot, ['write-tree'], undefined, {\n        GIT_INDEX_FILE: indexFile,\n      })\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (candidateTree !== code.candidateTree) {\n      throw new Error(\n        `git patch materialized tree ${candidateTree} does not match ${code.candidateTree}`,\n      )\n    }\n    await assertSafeTree(repositoryRoot, candidateTree)\n    return candidateTree\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nexport async function readCandidateGitHubResource(\n  resource: AgentCandidateGitHubResource,\n  repositories: AgentCandidateRepositoryPort,\n): Promise<Uint8Array> {\n  const repositoryRoot = await verifiedRepositoryRoot(resource.repository, repositories)\n  const commitType = (\n    await runCandidateGit(repositoryRoot, ['cat-file', '-t', resource.commit])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (commitType !== 'commit') {\n    throw new Error(`GitHub resource commit is not a commit object: ${resource.commit}`)\n  }\n  const listing = (\n    await runCandidateGit(repositoryRoot, ['ls-tree', '-z', resource.commit, '--', resource.path])\n  ).stdout\n  const entries = parseTreeEntries(listing)\n  if (entries.length !== 1 || entries[0]?.path !== resource.path) {\n    throw new Error(`GitHub resource path is not one exact file: ${resource.path}`)\n  }\n  const entry = entries[0]\n  if (entry?.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n    throw new Error(`GitHub resource path is not a regular Git blob: ${resource.path}`)\n  }\n  const bytes = (await runCandidateGit(repositoryRoot, ['cat-file', 'blob', entry.object])).stdout\n  verifyBytes(bytes, resource.sha256, resource.byteLength, `GitHub resource ${resource.path}`)\n  return Uint8Array.from(bytes)\n}\n\nexport async function verifyTaskCheckout(\n  taskRoot: string,\n  expected: { baseCommit: string; baseTree: string },\n): Promise<void> {\n  const root = resolve(taskRoot)\n  const head = (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout.toString('utf8').trim()\n  if (head !== expected.baseCommit) {\n    throw new Error(`task checkout HEAD ${head} does not match ${expected.baseCommit}`)\n  }\n  const tree = (await runCandidateGit(root, ['rev-parse', 'HEAD^{tree}'])).stdout\n    .toString('utf8')\n    .trim()\n  if (tree !== expected.baseTree) {\n    throw new Error(`task checkout base tree ${tree} does not match ${expected.baseTree}`)\n  }\n}\n\n/**\n * Apply an evaluator-captured binary diff in a detached object database and\n * prove its result tree exactly matches the captured after-state manifest.\n */\nexport async function verifyTaskOutcomePatch(input: {\n  repositoryRoot: string\n  baseCommit: string\n  baseTree: string\n  resultTree: string\n  patch: Uint8Array\n  afterState: AgentCandidateWorkspaceManifestMaterial\n}): Promise<{ resultTree: string; resultCommit: string }> {\n  const repositoryRoot = resolve(input.repositoryRoot)\n  await verifyTaskCheckout(repositoryRoot, input)\n  const gitDir = resolve(\n    (await runCandidateGit(repositoryRoot, ['rev-parse', '--absolute-git-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(gitDir)) !== gitDir || gitDir.includes(':')) {\n    throw new Error('task Git object store has an unsupported path')\n  }\n  await assertNoGitIndirection(repositoryRoot, gitDir, 'task repository')\n\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-task-outcome-'))\n  try {\n    const objectDirectory = join(temporary, 'objects')\n    const indexFile = join(temporary, 'index')\n    await mkdir(objectDirectory)\n    const gitEnvironment = {\n      GIT_INDEX_FILE: indexFile,\n      GIT_OBJECT_DIRECTORY: objectDirectory,\n      GIT_ALTERNATE_OBJECT_DIRECTORIES: join(gitDir, 'objects'),\n    }\n    await runCandidateGit(repositoryRoot, ['read-tree', input.baseTree], undefined, gitEnvironment)\n    if (input.patch.byteLength > 0) {\n      await runCandidateGit(\n        repositoryRoot,\n        ['apply', '--cached', '--binary', '--whitespace=nowarn', '-'],\n        input.patch,\n        gitEnvironment,\n      )\n    }\n    const resultTree = (\n      await runCandidateGit(repositoryRoot, ['write-tree'], undefined, gitEnvironment)\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (resultTree !== input.resultTree) {\n      throw new Error(\n        `task outcome patch materialized tree ${resultTree} does not match ${input.resultTree}`,\n      )\n    }\n    await assertSafeTree(repositoryRoot, resultTree, gitEnvironment)\n    const observed = await workspaceManifestFromGitTree(repositoryRoot, resultTree, gitEnvironment)\n    if (\n      !Buffer.from(canonicalCandidateBytes(observed)).equals(\n        Buffer.from(canonicalCandidateBytes(input.afterState)),\n      )\n    ) {\n      throw new Error('task outcome after-state does not match the materialized result tree')\n    }\n    const resultCommit = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['commit-tree', resultTree, '-p', input.baseCommit],\n        Buffer.from('candidate task outcome\\n', 'utf8'),\n        {\n          ...gitEnvironment,\n          GIT_AUTHOR_NAME: 'Tangle Evaluator',\n          GIT_AUTHOR_EMAIL: 'evaluator@tangle.tools',\n          GIT_AUTHOR_DATE: '2000-01-01T00:00:00Z',\n          GIT_COMMITTER_NAME: 'Tangle Evaluator',\n          GIT_COMMITTER_EMAIL: 'evaluator@tangle.tools',\n          GIT_COMMITTER_DATE: '2000-01-01T00:00:00Z',\n        },\n      )\n    ).stdout\n      .toString('utf8')\n      .trim()\n    const committedTree = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['rev-parse', `${resultCommit}^{tree}`],\n        undefined,\n        gitEnvironment,\n      )\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (committedTree !== resultTree) {\n      throw new Error('task outcome evaluator commit does not bind the verified result tree')\n    }\n    return { resultTree, resultCommit }\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nasync function verifiedRepositoryRoot(\n  repository: AgentCandidateGitHubRepository,\n  repositories: AgentCandidateRepositoryPort,\n): Promise<string> {\n  const repositoryRoot = resolve(await repositories.resolve(repository))\n  const rootStats = await stat(repositoryRoot)\n  if (!rootStats.isDirectory()) throw new Error('candidate repository path is not a directory')\n\n  const origin = (await runCandidateGit(repositoryRoot, ['remote', 'get-url', 'origin'])).stdout\n    .toString('utf8')\n    .trim()\n  const actual = parseGitHubRemote(origin)\n  if (!actual || actual.owner !== repository.owner || actual.repo !== repository.repo) {\n    throw new Error(\n      `local repository origin ${origin || '<missing>'} does not match github.com/${repository.owner}/${repository.repo}`,\n    )\n  }\n\n  const gitDirText = (\n    await runCandidateGit(repositoryRoot, ['rev-parse', '--absolute-git-dir'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  const gitDir = resolve(gitDirText)\n  await assertNoGitIndirection(repositoryRoot, gitDir, 'candidate repository')\n  return repositoryRoot\n}\n\nexport async function assertNoGitIndirection(\n  repositoryRoot: string,\n  gitDir: string,\n  label: string,\n): Promise<void> {\n  const replacements = (\n    await runCandidateGit(repositoryRoot, ['for-each-ref', '--format=%(refname)', 'refs/replace'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (replacements) throw new Error(`${label} contains Git replace refs`)\n  const commonDir = resolve(\n    repositoryRoot,\n    (await runCandidateGit(repositoryRoot, ['rev-parse', '--git-common-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(commonDir)) !== commonDir || commonDir.includes(':')) {\n    throw new Error(`${label} Git common directory has an unsupported path`)\n  }\n  for (const objectRoot of new Set([gitDir, commonDir])) {\n    for (const name of ['alternates', 'http-alternates']) {\n      const path = join(objectRoot, 'objects', 'info', name)\n      try {\n        const contents = await readFile(path, 'utf8')\n        if (contents.trim()) throw new Error(`${label} uses forbidden Git ${name}`)\n      } catch (error) {\n        if (!isNoEntry(error)) throw error\n      }\n    }\n  }\n}\n\nasync function assertCommitAndBaseTree(\n  repositoryRoot: string,\n  commit: string,\n  expectedTree: string,\n): Promise<void> {\n  const type = (await runCandidateGit(repositoryRoot, ['cat-file', '-t', commit])).stdout\n    .toString('utf8')\n    .trim()\n  if (type !== 'commit') throw new Error(`candidate base object is not a commit: ${commit}`)\n  const actualTree = (\n    await runCandidateGit(repositoryRoot, ['rev-parse', `${commit}^{tree}`])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (actualTree !== expectedTree) {\n    throw new Error(`candidate base commit tree ${actualTree} does not match ${expectedTree}`)\n  }\n}\n\nasync function assertSafeTree(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string> = {},\n): Promise<void> {\n  const listing = (\n    await runCandidateGit(\n      repositoryRoot,\n      ['ls-tree', '-rz', '--full-tree', tree],\n      undefined,\n      environment,\n    )\n  ).stdout\n  const entries = parseTreeEntries(listing)\n  if (entries.length === 0) throw new Error('candidate Git tree cannot be empty')\n  for (const entry of entries) {\n    if (entry.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n      throw new Error(\n        `candidate Git tree contains a symlink, submodule, or non-blob: ${entry.path}`,\n      )\n    }\n    assertSafeGitPath(entry.path)\n  }\n}\n\nasync function workspaceManifestFromGitTree(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string>,\n): Promise<AgentCandidateWorkspaceManifestMaterial> {\n  return candidateWorkspaceManifest(\n    await readCandidateGitTreeFiles(repositoryRoot, tree, environment),\n  )\n}\n\nexport async function readCandidateGitTreeFiles(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string> = {},\n  limits?: { maxFiles: number; maxFileBytes: number; maxTotalFileBytes: number },\n): Promise<Array<{ path: string; mode: 0o644 | 0o755; bytes: Uint8Array }>> {\n  const listing = (\n    await runCandidateGit(\n      repositoryRoot,\n      ['ls-tree', '-rzl', '--full-tree', tree],\n      undefined,\n      environment,\n    )\n  ).stdout\n  const files: Array<{ path: string; mode: 0o644 | 0o755; bytes: Uint8Array }> = []\n  const entries = parseTreeEntries(listing)\n  if (limits && entries.length > limits.maxFiles) {\n    throw new Error('candidate Git tree exceeds maxFiles')\n  }\n  let totalBytes = 0\n  for (const entry of entries) {\n    if (entry.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n      throw new Error(`candidate Git tree contains a non-regular file: ${entry.path}`)\n    }\n    assertSafeGitPath(entry.path)\n    if (entry.size === undefined) {\n      throw new Error(`candidate Git tree is missing blob size: ${entry.path}`)\n    }\n    if (limits && entry.size > limits.maxFileBytes) {\n      throw new Error(`candidate Git tree file exceeds maxFileBytes: ${entry.path}`)\n    }\n    totalBytes += entry.size\n    if (limits && totalBytes > limits.maxTotalFileBytes) {\n      throw new Error('candidate Git tree exceeds maxTotalFileBytes')\n    }\n    const bytes = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['cat-file', 'blob', entry.object],\n        undefined,\n        environment,\n      )\n    ).stdout\n    if (bytes.byteLength !== entry.size) {\n      throw new Error(`candidate Git blob size changed: ${entry.path}`)\n    }\n    files.push({\n      path: entry.path,\n      mode: entry.mode === '100755' ? 0o755 : 0o644,\n      bytes: Uint8Array.from(bytes),\n    })\n  }\n  return files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))\n}\n\nfunction parseTreeEntries(bytes: Uint8Array): Array<{\n  mode: string\n  type: string\n  object: string\n  size?: number\n  path: string\n}> {\n  const raw = Buffer.from(bytes)\n  const decoded = raw.toString('utf8')\n  if (!Buffer.from(decoded, 'utf8').equals(raw)) {\n    throw new Error('candidate Git tree contains a non-UTF-8 path')\n  }\n  const rows = decoded.split('\\0').filter(Boolean)\n  return rows.map((row) => {\n    const tab = row.indexOf('\\t')\n    const header = row.slice(0, tab).split(' ').filter(Boolean)\n    const path = row.slice(tab + 1)\n    const [mode, type, object, sizeText] = header\n    if (tab < 1 || !mode || !type || !object || !path) {\n      throw new Error('malformed Git tree entry')\n    }\n    const size = sizeText && /^\\d+$/.test(sizeText) ? Number(sizeText) : undefined\n    if (size !== undefined && !Number.isSafeInteger(size)) {\n      throw new Error('candidate Git tree entry size exceeds the safe integer range')\n    }\n    return { mode, type, object, ...(size === undefined ? {} : { size }), path }\n  })\n}\n\nfunction assertSafeGitPath(path: string): void {\n  if (\n    !path ||\n    path.startsWith('/') ||\n    path.includes('\\\\') ||\n    path.includes('\\0') ||\n    hasControlCharacter(path) ||\n    path.split('/').some((part) => !part || part === '.' || part === '..') ||\n    path.split('/')[0]?.toLowerCase() === '.git'\n  ) {\n    throw new Error(`candidate Git tree contains an unsafe path: ${path}`)\n  }\n}\n\nfunction hasControlCharacter(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code < 0x20 || code === 0x7f) return true\n  }\n  return false\n}\n\nfunction parseGitHubRemote(value: string): { owner: string; repo: string } | undefined {\n  const match = value.match(\n    /^(?:https?:\\/\\/github\\.com\\/|ssh:\\/\\/git@github\\.com\\/|git@github\\.com:)([^/]+)\\/([^/]+?)(?:\\.git)?$/,\n  )\n  if (!match?.[1] || !match[2]) return undefined\n  return { owner: match[1], repo: match[2] }\n}\n\nexport async function runCandidateGit(\n  repositoryRoot: string,\n  args: string[],\n  input?: Uint8Array,\n  extraEnv: Record<string, string> = {},\n): Promise<GitResult> {\n  const env = Object.fromEntries(\n    Object.entries(process.env).filter(([name]) => !name.startsWith('GIT_')),\n  ) as Record<string, string>\n  Object.assign(env, {\n    GIT_CONFIG_NOSYSTEM: '1',\n    GIT_CONFIG_GLOBAL: '/dev/null',\n    GIT_CONFIG_SYSTEM: '/dev/null',\n    GIT_TERMINAL_PROMPT: '0',\n    GIT_NO_REPLACE_OBJECTS: '1',\n    LC_ALL: 'C',\n    ...extraEnv,\n  })\n  const fullArgs = [\n    '-c',\n    'core.hooksPath=/dev/null',\n    '-c',\n    'core.fsmonitor=false',\n    '-c',\n    'core.untrackedCache=false',\n    '-c',\n    'protocol.file.allow=never',\n    '-C',\n    repositoryRoot,\n    ...args,\n  ]\n  return await new Promise((resolveResult, reject) => {\n    const child = spawn('git', fullArgs, { env, stdio: ['pipe', 'pipe', 'pipe'] })\n    const stdout: Buffer[] = []\n    const stderr: Buffer[] = []\n    child.stdout.on('data', (chunk: Buffer) => stdout.push(chunk))\n    child.stderr.on('data', (chunk: Buffer) => stderr.push(chunk))\n    child.on('error', reject)\n    child.on('close', (code, signal) => {\n      const out = Buffer.concat(stdout)\n      const err = Buffer.concat(stderr)\n      if (code !== 0) {\n        reject(\n          new Error(\n            `git ${args[0] ?? '<command>'} failed (${signal ?? code}): ${err.toString('utf8').trim()}`,\n          ),\n        )\n        return\n      }\n      resolveResult({ stdout: out, stderr: err })\n    })\n    if (input) child.stdin.end(input)\n    else child.stdin.end()\n  })\n}\n\nfunction isNoEntry(error: unknown): boolean {\n  return (\n    typeof error === 'object' &&\n    error !== null &&\n    'code' in error &&\n    (error as { code?: string }).code === 'ENOENT'\n  )\n}\n","import type { BenchmarkEvaluation, TraceStore } from '@tangle-network/agent-eval'\nimport type {\n  AgentCandidateArtifactRef,\n  AgentCandidateAttemptPolicy,\n  AgentCandidateBenchmarkSuite,\n  AgentCandidateBenchmarkTask,\n  AgentCandidateBundle,\n  AgentCandidateCapturedArtifact,\n  AgentCandidateContainer,\n  AgentCandidateEffectiveMemory,\n  AgentCandidateExecutionLimits,\n  AgentCandidateExecutionPlanEvidence,\n  AgentCandidateFixedSpend,\n  AgentCandidateGitHubRepository,\n  AgentCandidateInstructionDelivery,\n  AgentCandidateKnowledgeRef,\n  AgentCandidateMaterializationReceipt,\n  AgentCandidateMemoryReceipt,\n  AgentCandidateModelAccessNetwork,\n  AgentCandidateModelSettlementCall,\n  AgentCandidateOciPlatform,\n  AgentCandidateProfileActivation,\n  AgentCandidateProfilePlanEvidence,\n  AgentCandidateResolvedModel,\n  AgentCandidateRunCell,\n  AgentCandidateRunReceipt,\n  AgentCandidateTaskOutcomeEvidence,\n  AgentCandidateTaskOutcomeMaterial,\n  AgentCandidateTaskOutputSpec,\n  AgentCandidateTermination,\n  AgentCandidateWorkspaceManifestMaterial,\n  AgentCandidateWorkspaceSnapshotEvidence,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nexport const verifiedCandidateBrand: unique symbol = Symbol('verifiedAgentCandidate')\nexport const preparedCandidateBrand: unique symbol = Symbol('preparedAgentCandidate')\nexport const verifiedTaskOutcomeBrand: unique symbol = Symbol('verifiedTaskOutcome')\n\n/** Reads one content-addressed object from the closed S3/IPFS locator set. */\nexport interface AgentCandidateArtifactPort {\n  read(ref: AgentCandidateArtifactRef): Promise<Uint8Array>\n}\n\nexport type AgentCandidateOutputPurpose =\n  | 'execution-plan'\n  | 'materialization-receipt'\n  | 'candidate-workspace-manifest'\n  | 'candidate-workspace-archive'\n  | 'task-manifest'\n  | 'task-archive'\n  | 'task-patch'\n  | 'task-output'\n  | 'task-outcome'\n  | 'memory-after-manifest'\n  | 'memory-after-archive'\n  | 'grader-evidence'\n  | 'benchmark-result'\n  | 'model-settlement'\n  | 'trace'\n  | 'executor-native-evidence'\n  | 'executor-capture'\n  | 'run-receipt'\n  | 'knowledge-retrieval-config'\n  | 'knowledge-evaluation'\n  | 'failure-evidence'\n\n/** Durable content-addressed evidence store controlled only by the evaluator. */\nexport interface AgentCandidateOutputArtifactPort extends AgentCandidateArtifactPort {\n  /** Must be idempotent for identical bytes and return only a durable S3/IPFS locator. */\n  put(input: {\n    executionId: string\n    purpose: AgentCandidateOutputPurpose\n    bytes: Uint8Array\n    /** Abort must prevent durable publication when it happens before resolution. */\n    signal?: AbortSignal\n  }): Promise<AgentCandidateArtifactRef>\n}\n\n/** Resolves a declared GitHub repository to an already-present local Git object store. */\nexport interface AgentCandidateRepositoryPort {\n  resolve(repository: AgentCandidateGitHubRepository): Promise<string>\n}\n\nexport interface AgentCandidateVerificationPorts {\n  artifacts: AgentCandidateArtifactPort\n  repositories: AgentCandidateRepositoryPort\n}\n\n/**\n * Materializes an already-verified workspace archive.\n *\n * The runtime independently scans every resulting byte, mode, and path against\n * the signed manifest after this returns. Implementations may therefore unpack\n * any archive encoding, or no-op when the exact workspace is already present.\n */\nexport interface AgentCandidateWorkspacePort {\n  materialize(input: {\n    role: 'task' | 'candidate' | 'knowledge' | 'memory'\n    snapshot: AgentCandidateWorkspaceSnapshotEvidence\n    archive: Uint8Array\n    destination: string\n  }): Promise<void>\n}\n\nexport interface ResolvedAgentCandidateContainer {\n  source: 'pinned-container' | 'evaluator-task-container'\n  image: string\n  indexDigest: Sha256Digest\n  manifestDigest: Sha256Digest\n  platform: AgentCandidateOciPlatform\n}\n\nexport interface AgentCandidateContainerPort {\n  resolve(input: {\n    candidate: AgentCandidateContainer | undefined\n    evaluatorTaskContainer: ResolvedAgentCandidateContainer | undefined\n  }): Promise<ResolvedAgentCandidateContainer>\n}\n\nexport interface AgentCandidateModelPort {\n  resolve(input: {\n    requested: string\n    harness: AgentCandidateBundle['execution']['harness']\n    reasoningEffort: NonNullable<AgentCandidateBundle['profile']['model']>['reasoningEffort']\n  }): Promise<AgentCandidateResolvedModel>\n  /**\n   * Reserve a stable access identity without creating a live credential.\n   * The reservation is scoped to `preparationId` and must automatically expire\n   * at `expiresAtMs`, even if this call returns ambiguously to the runtime.\n   */\n  reserveGrant(input: {\n    executionId: string\n    preparationId: string\n    expiresAtMs: number\n    attempt: AgentCandidateAttemptPolicy\n    bundleDigest: Sha256Digest\n    resolved: AgentCandidateResolvedModel\n    limits: AgentCandidateModelLimits\n  }): Promise<AgentCandidateProtectedModelReservation>\n  /** Create the live scoped credential only after the execution attempt is durably claimed. */\n  activateGrant(input: {\n    executionId: string\n    preparationId: string\n    grantDigest: Sha256Digest\n    resolved: AgentCandidateResolvedModel\n    deadlineAtMs: number\n  }): Promise<AgentCandidateProtectedModelActivation>\n  /**\n   * Atomically revoke the grant, drain in-flight calls, and return its immutable final ledger.\n   * This operation must be idempotent for the exact preparation and must also\n   * settle a reservation that was never activated. It must never affect a\n   * different preparation, even when both reservations report the same digest.\n   */\n  settleGrant(input: {\n    executionId: string\n    preparationId: string\n    grantDigest: Sha256Digest\n    resolved: AgentCandidateResolvedModel\n    reason: 'completed' | 'failed' | 'timeout' | 'replayed' | 'preparation-failed' | 'abandoned'\n  }): Promise<AgentCandidateProtectedModelSettlement>\n}\n\n/** Limits mechanically enforced by the evaluator-owned model gateway. */\nexport type AgentCandidateModelLimits = Pick<\n  AgentCandidateExecutionLimits,\n  'maxModelCalls' | 'maxInputTokens' | 'maxOutputTokens' | 'maxCostUsd'\n> & {\n  /** Optional caller-declared cap across input and output tokens. */\n  maxTotalTokens?: number\n}\n\nexport interface AgentCandidateProtectedModelReservation {\n  preparationId: string\n  digest: Sha256Digest\n  /** Evaluator service must expire and revoke this reservation at this epoch millisecond. */\n  expiresAtMs: number\n  /** The gateway must stop calls before any declared model limit is exceeded. */\n  enforcedLimits: AgentCandidateModelLimits\n  /** Exact public endpoint exception; every other candidate destination stays blocked. */\n  network: AgentCandidateModelAccessNetwork\n}\n\nexport interface AgentCandidateProtectedModelActivation {\n  /** Injected only into the trusted executor after all pre-launch checks pass. */\n  env: Readonly<Record<string, string>>\n}\n\nexport interface AgentCandidateProtectedModelSettlement {\n  preparationId: string\n  grantDigest: Sha256Digest\n  closed: true\n  /** Router's terminal integrity result. False must never become a receipt. */\n  usageWithinLimits: boolean\n  calls: readonly AgentCandidateProtectedModelSettlementCall[]\n}\n\n/** Protected-port wire call with the gateway's counted input total preserved. */\nexport type AgentCandidateProtectedModelSettlementCall = AgentCandidateModelSettlementCall & {\n  accountedInputTokens: number\n}\n\nexport interface AgentCandidateMemoryResetResult {\n  preparationId: string\n  accessDigest: Sha256Digest\n  expiresAtMs: number\n  evidence: AgentCandidateCapturedArtifact\n  emptyStateDigest: Sha256Digest\n  beforeState: AgentCandidateWorkspaceSnapshotEvidence\n}\n\nexport interface AgentCandidateMemoryPort {\n  /**\n   * Reset and reserve exact task memory without returning live access.\n   * The service must scope the reservation to `preparationId`, automatically\n   * revoke it at `expiresAtMs`, and never reuse it for another preparation.\n   */\n  reset(input: {\n    executionId: string\n    preparationId: string\n    expiresAtMs: number\n    effectiveNamespace: string\n    seed?: Uint8Array\n    seedDigest?: Sha256Digest\n  }): Promise<AgentCandidateMemoryResetResult>\n  /**\n   * Create live scoped access only after the execution attempt is durably claimed.\n   * Activation must match the exact preparation/access pair and may not extend expiry.\n   */\n  activate(input: {\n    executionId: string\n    preparationId: string\n    accessDigest: Sha256Digest\n    effectiveNamespace: string\n    deadlineAtMs: number\n  }): Promise<{ env: Readonly<Record<string, string>> }>\n  /**\n   * Revoke evaluator-owned access after process death or a failed preparation.\n   * Must be idempotent and concurrency-safe for the exact preparation/access\n   * pair and must never close a different preparation.\n   */\n  close(input: {\n    executionId: string\n    preparationId: string\n    accessDigest: Sha256Digest\n    effectiveNamespace: string\n    reason: 'completed' | 'failed' | 'timeout' | 'replayed' | 'preparation-failed' | 'abandoned'\n  }): Promise<{ closed: true }>\n}\n\nexport interface AgentCandidateExecutionPorts extends AgentCandidateVerificationPorts {\n  workspaces: AgentCandidateWorkspacePort\n  containers: AgentCandidateContainerPort\n  models: AgentCandidateModelPort\n  memory: AgentCandidateMemoryPort\n}\n\n/** Runtime placement for one exact cell from a signed candidate experiment. */\nexport interface AgentCandidateTaskExecution {\n  executionId: string\n  runCell: AgentCandidateRunCell\n  benchmarkSuite: AgentCandidateBenchmarkSuite\n  task: AgentCandidateBenchmarkTask\n  /** Absolute paths inside the evaluator-owned execution environment. */\n  executionRoots: {\n    taskRoot: string\n    candidateRoot?: string\n  }\n  /** Host-side staging roots. These are verified but never signed as container paths. */\n  stagingRoots: {\n    taskRoot: string\n    candidateRoot?: string\n    profileRoot: string\n  }\n}\n\nexport interface VerifiedAgentCandidate {\n  readonly bundle: AgentCandidateBundle\n  readonly materializedTree?: string\n  readonly [verifiedCandidateBrand]: true\n}\n\nexport interface CanonicalCandidateDocument<T> {\n  readonly value: T\n  /** Canonical UTF-8 bytes of `value` with its top-level digest omitted. */\n  readonly bytes: Uint8Array\n  readonly digest: Sha256Digest\n}\n\nexport interface PreparedAgentCandidateLaunch {\n  executable: string\n  /** Complete fixed argv, including profile materializer flags but excluding task delivery. */\n  args: readonly string[]\n  env: Readonly<Record<string, string>>\n  /** Informational subset already present at the tail of `args`; executors must not append twice. */\n  flags: readonly string[]\n  cwd: string\n}\n\nexport interface PreparedAgentCandidateInstruction {\n  bytes: Uint8Array\n  delivery: AgentCandidateInstructionDelivery\n}\n\n/** Exact file-backed knowledge admitted by the candidate bundle. */\nexport interface PreparedAgentCandidateKnowledge {\n  readonly candidate: AgentCandidateKnowledgeRef\n  readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  readonly files: readonly AgentCandidateExecutorWorkspaceFile[]\n  readonly retrievalConfig?: Uint8Array\n}\n\nexport interface PreparedAgentCandidateTrace {\n  runId: string\n  tags: Readonly<Record<string, string>>\n  env: Readonly<Record<string, string>>\n}\n\nexport interface PreparedAgentCandidateExecution {\n  readonly bundle: AgentCandidateBundle\n  readonly benchmark: {\n    readonly suite: AgentCandidateBenchmarkSuite\n    readonly task: AgentCandidateBenchmarkTask\n  }\n  readonly executionId: string\n  readonly roots: {\n    execution: {\n      taskRoot: string\n      candidateRoot?: string\n    }\n    staging: {\n      taskRoot: string\n      candidateRoot?: string\n      profileRoot: string\n    }\n  }\n  readonly profilePlan: {\n    value: AgentCandidateProfilePlanEvidence\n    bytes: Uint8Array\n    written: readonly string[]\n  }\n  readonly profileActivation: AgentCandidateProfileActivation\n  readonly executionPlan: {\n    value: AgentCandidateExecutionPlanEvidence\n    bytes: Uint8Array\n  }\n  readonly materializationReceipt: CanonicalCandidateDocument<AgentCandidateMaterializationReceipt>\n  readonly launch: PreparedAgentCandidateLaunch\n  readonly instruction: PreparedAgentCandidateInstruction\n  readonly resolvedModel: AgentCandidateResolvedModel\n  readonly knowledge?: PreparedAgentCandidateKnowledge\n  readonly trace: PreparedAgentCandidateTrace\n  readonly memory: AgentCandidateEffectiveMemory\n  readonly [preparedCandidateBrand]: true\n}\n\nexport type { AgentCandidateBenchmarkGraderIdentity } from '@tangle-network/agent-interface'\n\nexport interface AgentCandidateProtectedRunCapture {\n  executionId: string\n  termination: AgentCandidateTermination\n}\n\n/** Raw evaluator capture made only after the candidate process is dead. */\nexport type AgentCandidateExecutorTaskOutcomeCapture =\n  | {\n      readonly kind: 'workspace'\n      /** Claimed final tree. The runtime recomputes it independently from `gitDiff`. */\n      readonly resultTree: string\n      /** Complete evaluator-captured workspace description after candidate execution. */\n      readonly afterState: AgentCandidateWorkspaceManifestMaterial\n      /** Reproducible workspace archive corresponding to `afterState`. */\n      readonly archive: Uint8Array\n      /** Exact binary patch from the signed task base to `afterState`. */\n      readonly gitDiff: Uint8Array\n    }\n  | {\n      readonly kind: 'output'\n      /** Exact evaluator-captured final output bytes. */\n      readonly bytes: Uint8Array\n    }\n\n/** Raw isolated-memory capture made only after access has been revoked. */\nexport interface AgentCandidateExecutorMemoryCapture {\n  readonly afterState: AgentCandidateWorkspaceManifestMaterial\n  readonly archive: Uint8Array\n}\n\n/** Replayable evaluator result captured only after process death and trace drain. */\nexport interface AgentCandidateExecutorFinalCapture {\n  readonly taskOutcome?: AgentCandidateExecutorTaskOutcomeCapture\n  /** Required only when the prepared candidate uses isolated task memory. */\n  readonly memoryAfter?: AgentCandidateExecutorMemoryCapture\n  /** Executor-native bytes preserved when a fresh worker cannot reconstruct a verified outcome. */\n  readonly evidence?: Uint8Array\n}\n\n/** Immutable evaluator evidence retained with a verified candidate task outcome. */\nexport type PersistedTaskOutcomeEvidence<\n  Kind extends AgentCandidateTaskOutcomeMaterial['outcome']['kind'],\n> = Omit<AgentCandidateTaskOutcomeEvidence, 'material'> & {\n  readonly artifact: AgentCandidateArtifactRef\n  readonly material: Omit<AgentCandidateTaskOutcomeMaterial, 'outcome'> & {\n    readonly outcome: Extract<AgentCandidateTaskOutcomeMaterial['outcome'], { kind: Kind }>\n  }\n}\n\n/** Branded task outcome that has survived independent evaluator verification. */\nexport type VerifiedAgentCandidateTaskOutcome =\n  | {\n      readonly kind: 'workspace'\n      readonly evidence: PersistedTaskOutcomeEvidence<'workspace'>\n      readonly patch: Uint8Array\n      readonly [verifiedTaskOutcomeBrand]: true\n    }\n  | {\n      readonly kind: 'output'\n      readonly evidence: PersistedTaskOutcomeEvidence<'output'>\n      readonly spec: AgentCandidateTaskOutputSpec\n      readonly bytes: Uint8Array\n      readonly [verifiedTaskOutcomeBrand]: true\n    }\n\n/**\n * Evaluator-owned executable grader, pinned by immutable implementation bytes.\n *\n * `run` is an isolation boundary, not an arbitrary scoring callback. The\n * implementation admitted to that boundary is supplied by the runtime after\n * artifact verification. Implementations must derive every returned binding\n * digest from the bytes and task outcome they actually admitted, rather than\n * copying an expected digest from ambient configuration.\n */\nexport interface AgentCandidateBenchmarkGraderPort {\n  readonly name: string\n  readonly version: string\n  readonly artifact: AgentCandidateArtifactRef\n  run(input: {\n    readonly executionId: string\n    readonly termination: AgentCandidateTermination\n    readonly outcome: VerifiedAgentCandidateTaskOutcome\n    /** Exact verified artifact bytes. Each read returns a detached copy. */\n    readonly implementation: {\n      readonly byteLength: number\n      readonly bytes: Uint8Array\n    }\n    /** Frozen result deadline; runners must stop work and side effects when aborted. */\n    readonly signal: AbortSignal\n  }): Promise<{\n    readonly evaluation: BenchmarkEvaluation\n    /** Raw grader output needed to audit or reproduce the normalized result. */\n    readonly evidence: Uint8Array\n    /** Runtime-checked binding between admitted code, task input, and raw output. */\n    readonly binding: {\n      /** Digest computed from the implementation bytes admitted to execution. */\n      readonly implementationDigest: Sha256Digest\n      /** Digest of the exact runtime-verified task outcome graded by this run. */\n      readonly taskOutcomeDigest: Sha256Digest\n      /** Digest computed from `evidence` before it leaves the execution boundary. */\n      readonly outputDigest: Sha256Digest\n    }\n  }>\n}\n\n/** One detached request passed to the trusted environment-specific executor. */\nexport interface AgentCandidateExecutorRequest {\n  readonly executionId: string\n  readonly benchmark: PreparedAgentCandidateExecution['benchmark']\n  /** Immutable bytes from which the executor creates fresh isolated workspaces. */\n  readonly inputs: {\n    readonly task: AgentCandidateExecutorWorkspaceInput\n    readonly candidate?: AgentCandidateExecutorWorkspaceInput\n    readonly profile: {\n      readonly files: readonly AgentCandidateExecutorProfileFile[]\n    }\n  }\n  readonly roots: PreparedAgentCandidateExecution['roots']['execution']\n  readonly profilePlan: PreparedAgentCandidateExecution['profilePlan']\n  readonly profileActivation: AgentCandidateProfileActivation\n  readonly executionPlan: PreparedAgentCandidateExecution['executionPlan']\n  readonly materializationReceipt: CanonicalCandidateDocument<AgentCandidateMaterializationReceipt>\n  readonly launch: PreparedAgentCandidateLaunch\n  readonly instruction: PreparedAgentCandidateInstruction\n  readonly resolvedModel: AgentCandidateResolvedModel\n  /** Mechanically enforced by the runtime plus executor process-death acknowledgement. */\n  readonly hardLimits: Pick<AgentCandidateExecutionLimits, 'timeoutMs'>\n  /** Validity bound checked against protected traces; generic black-box executors cannot preempt it. */\n  readonly observedLimits: Pick<AgentCandidateExecutionLimits, 'maxSteps'>\n  readonly knowledge?: PreparedAgentCandidateKnowledge\n  readonly trace: PreparedAgentCandidateTrace\n  readonly memory: AgentCandidateEffectiveMemory\n}\n\n/**\n * Executes one prepared request inside an evaluator-owned isolation boundary.\n *\n * `request.launch.env` is the complete allowlisted environment, including\n * protected model, memory, and trace bindings. Implementations must not merge\n * ambient host variables into it. The returned capture deliberately contains\n * no candidate-authored usage or score fields.\n */\nexport interface AgentCandidateExecutorPort {\n  execute(\n    request: AgentCandidateExecutorRequest,\n    context: {\n      traceStore: TraceStore\n      /** Aborted by the runtime at the exact frozen wall-time deadline. */\n      signal: AbortSignal\n      /** Absolute epoch-millisecond deadline owned by the runtime. */\n      deadlineAtMs: number\n    },\n  ): Promise<AgentCandidateProtectedRunCapture>\n  /** Kill the exact process/container and drain trace writes. Must be idempotent. */\n  stop(\n    request: AgentCandidateExecutorStopRequest,\n    context: {\n      traceStore: TraceStore\n      reason: 'completed' | 'failed' | 'timeout'\n      /** Aborted at the frozen execution deadline or evaluator cleanup deadline. */\n      signal: AbortSignal\n      /** Absolute execution deadline; a later stop acknowledgement cannot produce success. */\n      deadlineAtMs: number\n    },\n  ): Promise<{ readonly stopped: true }>\n  /** Capture immutable final evidence after stop. Must be replayable by a fresh worker. */\n  capture(\n    request: AgentCandidateExecutorStopRequest,\n    context: {\n      traceStore: TraceStore\n      /** Aborted at the frozen execution deadline or evaluator cleanup deadline. */\n      signal: AbortSignal\n    },\n  ): Promise<AgentCandidateExecutorFinalCapture>\n  /** Remove evaluator-owned execution resources after final capture. Must be idempotent. */\n  dispose?(\n    request: AgentCandidateExecutorStopRequest,\n    context: {\n      signal: AbortSignal\n    },\n  ): Promise<{ readonly disposed: true }>\n}\n\n/** Opaque process identity used for termination without re-exposing launch credentials. */\nexport interface AgentCandidateExecutorStopRequest {\n  readonly executionId: string\n  readonly executionPlanDigest: Sha256Digest\n}\n\nexport interface AgentCandidateExecutorWorkspaceInput {\n  readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  readonly files: readonly AgentCandidateExecutorWorkspaceFile[]\n}\n\nexport interface AgentCandidateExecutorWorkspaceFile {\n  readonly path: string\n  readonly mode: number\n  readonly bytes: Uint8Array\n}\n\n/** One exact profile file supplied to an evaluator-owned executor. */\nexport interface AgentCandidateExecutorProfileFile {\n  readonly path: string\n  readonly mode: number\n  readonly bytes: Uint8Array\n}\n\nexport type AgentCandidateRunFinalization =\n  | {\n      succeeded: true\n      receipt: CanonicalCandidateDocument<AgentCandidateRunReceipt>\n      artifacts: {\n        executorCapture: AgentCandidateArtifactRef\n        modelSettlement: AgentCandidateArtifactRef\n        taskOutcome: AgentCandidateArtifactRef\n        benchmarkResult: AgentCandidateArtifactRef\n        runReceipt: AgentCandidateArtifactRef\n      }\n    }\n  | {\n      succeeded: false\n      reason: string\n      partial: {\n        executionId: string\n        bundleDigest: Sha256Digest\n        executionPlanDigest: Sha256Digest\n        materializationReceiptDigest: Sha256Digest\n        termination?: AgentCandidateTermination\n      }\n      /** Independent evaluator-gateway usage, even when execution or trace capture failed. */\n      usage: AgentCandidateFixedSpend | null\n    }\n\n/** Protected trace tags that bind a run to one prepared candidate execution. */\nexport const CANDIDATE_TRACE_TAGS = {\n  executionId: 'tangle.candidate.execution_id',\n  bundleDigest: 'tangle.candidate.bundle_digest',\n  executionPlanDigest: 'tangle.candidate.execution_plan_digest',\n  materializationReceiptDigest: 'tangle.candidate.materialization_receipt_digest',\n} as const\n\n/** Environment keys used to propagate immutable candidate trace identity. */\nexport const CANDIDATE_TRACE_ENV = {\n  executionId: 'TANGLE_CANDIDATE_EXECUTION_ID',\n  bundleDigest: 'TANGLE_CANDIDATE_BUNDLE_DIGEST',\n  executionPlanDigest: 'TANGLE_CANDIDATE_EXECUTION_PLAN_DIGEST',\n  materializationReceiptDigest: 'TANGLE_CANDIDATE_MATERIALIZATION_RECEIPT_DIGEST',\n  traceRunId: 'TANGLE_TRACE_RUN_ID',\n} as const\n\nexport type PreparedMemoryReceipt = AgentCandidateMemoryReceipt\n","import {\n  type AgentCandidateBenchmarkSuite,\n  type AgentCandidateBenchmarkTask,\n  type AgentCandidateWorkspaceManifestMaterial,\n  agentCandidateBenchmarkSuiteSchema,\n  agentCandidateBenchmarkTaskSchema,\n  agentCandidateExecutionPlanEvidenceSchema,\n  agentCandidateMaterializationReceiptSchema,\n  agentCandidateProfilePlanEvidenceSchema,\n} from '@tangle-network/agent-interface'\n\nimport { verifyMaterializedProfileWorkspace, verifyMaterializedWorkspace } from './artifacts'\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  canonicalCandidateDocument,\n  immutableCandidateValue,\n  omitTopLevelDigest,\n  sha256Bytes,\n} from './digest'\nimport { verifyTaskCheckout } from './git-materialize'\nimport { parseAgentCandidateProfileActivation } from './profile'\nimport type {\n  AgentCandidateExecutionPorts,\n  AgentCandidateExecutorRequest,\n  AgentCandidateExecutorWorkspaceFile,\n  AgentCandidateProtectedModelActivation,\n  AgentCandidateProtectedModelReservation,\n  PreparedAgentCandidateExecution,\n} from './types'\nimport { CANDIDATE_TRACE_ENV, CANDIDATE_TRACE_TAGS, preparedCandidateBrand } from './types'\n\nexport interface PreparedCandidateState {\n  ports: AgentCandidateExecutionPorts\n  bundle: PreparedAgentCandidateExecution['bundle']\n  benchmarkSuite: AgentCandidateBenchmarkSuite\n  benchmarkTask: AgentCandidateBenchmarkTask\n  executionId: string\n  roots: PreparedAgentCandidateExecution['roots']\n  profilePlan: PreparedAgentCandidateExecution['profilePlan']\n  profileActivation: PreparedAgentCandidateExecution['profileActivation']\n  executionPlan: PreparedAgentCandidateExecution['executionPlan']\n  materializationReceipt: PreparedAgentCandidateExecution['materializationReceipt']\n  launch: PreparedAgentCandidateExecution['launch']\n  instruction: PreparedAgentCandidateExecution['instruction']\n  resolvedModel: PreparedAgentCandidateExecution['resolvedModel']\n  preparationId: string\n  reservationExpiresAtMs: number\n  cleanupTimeoutMs: number\n  resultTimeoutMs: number\n  modelReservation: AgentCandidateProtectedModelReservation\n  executorInputs: {\n    taskFiles: ReadonlyArray<{\n      path: string\n      mode: number\n      bytes: Uint8Array\n    }>\n    candidateFiles?: ReadonlyArray<{\n      path: string\n      mode: number\n      bytes: Uint8Array\n    }>\n    profileFiles: ReadonlyArray<{\n      path: string\n      mode: number\n      bytes: Uint8Array\n    }>\n  }\n  memoryReservation?: {\n    preparationId: string\n    accessDigest: `sha256:${string}`\n    expiresAtMs: number\n    effectiveNamespace: string\n  }\n  knowledge?: PreparedAgentCandidateExecution['knowledge']\n  trace: PreparedAgentCandidateExecution['trace']\n  memory: PreparedAgentCandidateExecution['memory']\n}\n\nconst stateByExecution = new WeakMap<PreparedAgentCandidateExecution, PreparedCandidateState>()\nconst lifecycleByExecution = new WeakMap<\n  PreparedAgentCandidateExecution,\n  {\n    status:\n      | 'prepared'\n      | 'claiming'\n      | 'claimed'\n      | 'running'\n      | 'settling'\n      | 'disposing'\n      | 'succeeded'\n      | 'failed'\n      | 'disposal-failed'\n      | 'cleanup-failed'\n      | 'disposed'\n  }\n>()\n\nexport function createPreparedCandidateExecution(\n  input: PreparedCandidateState,\n): PreparedAgentCandidateExecution {\n  const state = detachPreparedCandidateState(input)\n  assertPrivateCandidateIntegrity(state)\n  const prepared = Object.freeze({\n    bundle: state.bundle,\n    benchmark: Object.freeze({ suite: state.benchmarkSuite, task: state.benchmarkTask }),\n    executionId: state.executionId,\n    roots: state.roots,\n    profilePlan: evidenceView(state.profilePlan),\n    profileActivation: state.profileActivation,\n    executionPlan: evidenceView(state.executionPlan),\n    materializationReceipt: state.materializationReceipt,\n    launch: state.launch,\n    instruction: bytesView(state.instruction, 'bytes'),\n    resolvedModel: state.resolvedModel,\n    ...(state.knowledge ? { knowledge: knowledgeView(state.knowledge) } : {}),\n    trace: state.trace,\n    memory: state.memory,\n    [preparedCandidateBrand]: true as const,\n  })\n  stateByExecution.set(prepared, state)\n  lifecycleByExecution.set(prepared, { status: 'prepared' })\n  return prepared\n}\n\nexport function getPreparedCandidateState(\n  prepared: PreparedAgentCandidateExecution,\n): PreparedCandidateState {\n  const state = stateByExecution.get(prepared)\n  if (!state || prepared[preparedCandidateBrand] !== true) {\n    throw new Error('execution must come from prepareAgentCandidateExecution')\n  }\n  return state\n}\n\n/** Revalidates the exact private bytes immediately before execution or finalization. */\nexport function assertPreparedCandidateIntegrity(\n  prepared: PreparedAgentCandidateExecution,\n): PreparedCandidateState {\n  const state = getPreparedCandidateState(prepared)\n  assertPrivateCandidateIntegrity(state)\n  return state\n}\n\n/** Atomically reserves this in-memory prepared value before the first await. */\nexport function beginPreparedCandidateClaim(\n  prepared: PreparedAgentCandidateExecution,\n): PreparedCandidateState {\n  const state = assertPreparedCandidateIntegrity(prepared)\n  transitionLifecycle(prepared, ['prepared'], 'claiming')\n  return state\n}\n\n/** Claim an unexecuted preparation for explicit resource disposal. */\nexport function beginPreparedCandidateDisposal(\n  prepared: PreparedAgentCandidateExecution,\n): PreparedCandidateState {\n  const state = assertPreparedCandidateIntegrity(prepared)\n  transitionLifecycle(prepared, ['prepared', 'disposal-failed', 'cleanup-failed'], 'disposing')\n  return state\n}\n\nexport function markPreparedCandidateClaimed(prepared: PreparedAgentCandidateExecution): void {\n  transitionLifecycle(prepared, ['claiming'], 'claimed')\n}\n\n/** Reveal protected values only after the durable claim and workspace checks succeed. */\nexport function beginPreparedCandidateRun(\n  prepared: PreparedAgentCandidateExecution,\n  modelAccess: AgentCandidateProtectedModelActivation,\n  memoryAccess?: { env: Readonly<Record<string, string>> },\n): { state: PreparedCandidateState; request: AgentCandidateExecutorRequest } {\n  const state = assertPreparedCandidateIntegrity(prepared)\n  assertProtectedEnvironment(state, modelAccess.env, memoryAccess?.env)\n  transitionLifecycle(prepared, ['claimed'], 'running')\n  const completeEnvironment = immutableCandidateValue({\n    ...state.launch.env,\n    ...modelAccess.env,\n    ...(memoryAccess?.env ?? {}),\n    ...state.trace.env,\n  })\n  const material = state.executionPlan.value.material\n  const request = Object.freeze({\n    executionId: state.executionId,\n    benchmark: preparedBenchmark(state),\n    inputs: Object.freeze({\n      task: workspaceInputView(state.benchmarkTask.workspace, state.executorInputs.taskFiles),\n      ...(material.candidateWorkspace && state.executorInputs.candidateFiles\n        ? {\n            candidate: workspaceInputView(\n              material.candidateWorkspace,\n              state.executorInputs.candidateFiles,\n            ),\n          }\n        : {}),\n      profile: Object.freeze({\n        files: Object.freeze(\n          state.executorInputs.profileFiles.map((file) => profileFileView(file)),\n        ),\n      }),\n    }),\n    roots: state.roots.execution,\n    profilePlan: evidenceView(state.profilePlan),\n    profileActivation: state.profileActivation,\n    executionPlan: evidenceView(state.executionPlan),\n    materializationReceipt: state.materializationReceipt,\n    launch: immutableCandidateValue({ ...state.launch, env: completeEnvironment }),\n    instruction: bytesView(state.instruction, 'bytes'),\n    resolvedModel: state.resolvedModel,\n    hardLimits: Object.freeze({ timeoutMs: state.executionPlan.value.material.limits.timeoutMs }),\n    observedLimits: Object.freeze({ maxSteps: state.executionPlan.value.material.limits.maxSteps }),\n    ...(state.knowledge ? { knowledge: knowledgeView(state.knowledge) } : {}),\n    trace: state.trace,\n    memory: state.memory,\n  })\n  return { state, request }\n}\n\nfunction preparedBenchmark(\n  state: PreparedCandidateState,\n): PreparedAgentCandidateExecution['benchmark'] {\n  return Object.freeze({ suite: state.benchmarkSuite, task: state.benchmarkTask })\n}\n\nexport function consumePreparedCandidateExecution(\n  prepared: PreparedAgentCandidateExecution,\n  outcome: 'succeeded' | 'failed' | 'disposed' | 'disposal-failed' | 'cleanup-failed',\n): void {\n  transitionLifecycle(\n    prepared,\n    outcome === 'disposed' || outcome === 'disposal-failed' ? ['disposing'] : ['settling'],\n    outcome,\n  )\n}\n\nexport function beginPreparedCandidateSettlement(prepared: PreparedAgentCandidateExecution): void {\n  transitionLifecycle(prepared, ['claiming', 'claimed', 'running'], 'settling')\n}\n\n/** Rechecks every mutable staging byte immediately before handing control to an executor. */\nexport async function assertPreparedCandidateWorkspaces(\n  state: PreparedCandidateState,\n): Promise<void> {\n  const plan = state.executionPlan.value.material\n  await verifyMaterializedWorkspace(\n    state.roots.staging.taskRoot,\n    state.benchmarkTask.workspace.material,\n    {\n      ignoredProtectedRootEntries: ['.git', '.sidecar'],\n    },\n  )\n  if (state.benchmarkTask.repository) {\n    await verifyTaskCheckout(state.roots.staging.taskRoot, state.benchmarkTask.repository)\n  }\n  await verifyMaterializedProfileWorkspace(\n    state.roots.staging.profileRoot,\n    state.profilePlan.value.material,\n  )\n  if (plan.candidateWorkspace) {\n    const candidateRoot = state.roots.staging.candidateRoot\n    if (!candidateRoot) throw new Error('prepared candidate staging root is missing')\n    await verifyMaterializedWorkspace(candidateRoot, plan.candidateWorkspace.material)\n  } else if (state.roots.staging.candidateRoot !== undefined) {\n    throw new Error('disabled candidate unexpectedly has a staging root')\n  }\n}\n\nfunction detachPreparedCandidateState(input: PreparedCandidateState): PreparedCandidateState {\n  const benchmarkSuite = immutableCandidateValue(\n    agentCandidateBenchmarkSuiteSchema.parse(input.benchmarkSuite),\n  )\n  const benchmarkTask = immutableCandidateValue(\n    agentCandidateBenchmarkTaskSchema.parse(input.benchmarkTask),\n  )\n  const profilePlan = immutableCandidateValue(\n    agentCandidateProfilePlanEvidenceSchema.parse(input.profilePlan.value),\n  )\n  const profileActivation = parseAgentCandidateProfileActivation(\n    input.profileActivation,\n    profilePlan.digest,\n  )\n  const executionPlan = immutableCandidateValue(\n    agentCandidateExecutionPlanEvidenceSchema.parse(input.executionPlan.value),\n  )\n  const receiptValue = immutableCandidateValue(\n    agentCandidateMaterializationReceiptSchema.parse(input.materializationReceipt.value),\n  )\n  const materializationReceipt = canonicalCandidateDocument(\n    omitTopLevelDigest(receiptValue),\n  ) as PreparedAgentCandidateExecution['materializationReceipt']\n  if (materializationReceipt.digest !== input.materializationReceipt.digest) {\n    throw new Error('materialization receipt digest changed while sealing prepared execution')\n  }\n  return Object.freeze({\n    ports: input.ports,\n    bundle: input.bundle,\n    benchmarkSuite,\n    benchmarkTask,\n    executionId: input.executionId,\n    roots: immutableCandidateValue(input.roots),\n    profilePlan: Object.freeze({\n      value: profilePlan,\n      bytes: Uint8Array.from(input.profilePlan.bytes),\n      written: Object.freeze([...input.profilePlan.written]),\n    }),\n    profileActivation,\n    executionPlan: Object.freeze({\n      value: executionPlan,\n      bytes: Uint8Array.from(input.executionPlan.bytes),\n    }),\n    materializationReceipt,\n    launch: immutableCandidateValue(input.launch),\n    instruction: Object.freeze({\n      bytes: Uint8Array.from(input.instruction.bytes),\n      delivery: immutableCandidateValue(input.instruction.delivery),\n    }),\n    resolvedModel: immutableCandidateValue(input.resolvedModel),\n    preparationId: input.preparationId,\n    reservationExpiresAtMs: input.reservationExpiresAtMs,\n    cleanupTimeoutMs: input.cleanupTimeoutMs,\n    resultTimeoutMs: input.resultTimeoutMs,\n    modelReservation: immutableCandidateValue(input.modelReservation),\n    executorInputs: Object.freeze({\n      taskFiles: immutableExecutorFiles(input.executorInputs.taskFiles),\n      ...(input.executorInputs.candidateFiles\n        ? { candidateFiles: immutableExecutorFiles(input.executorInputs.candidateFiles) }\n        : {}),\n      profileFiles: immutableExecutorFiles(input.executorInputs.profileFiles),\n    }),\n    ...(input.memoryReservation\n      ? { memoryReservation: immutableCandidateValue(input.memoryReservation) }\n      : {}),\n    ...(input.knowledge\n      ? {\n          knowledge: Object.freeze({\n            candidate: immutableCandidateValue(input.knowledge.candidate),\n            snapshot: immutableCandidateValue(input.knowledge.snapshot),\n            files: immutableExecutorFiles(input.knowledge.files),\n            ...(input.knowledge.retrievalConfig\n              ? { retrievalConfig: Uint8Array.from(input.knowledge.retrievalConfig) }\n              : {}),\n          }),\n        }\n      : {}),\n    trace: immutableCandidateValue(input.trace),\n    memory: immutableCandidateValue(input.memory),\n  })\n}\n\nfunction assertPrivateCandidateIntegrity(state: PreparedCandidateState): void {\n  const bundleMaterial = omitTopLevelDigest(state.bundle)\n  if (canonicalCandidateDigest(bundleMaterial) !== state.bundle.digest) {\n    throw new Error('prepared candidate bundle no longer matches its digest')\n  }\n  assertPlanEvidence(state.profilePlan.value, state.profilePlan.bytes, 'profile plan')\n  parseAgentCandidateProfileActivation(state.profileActivation, state.profilePlan.value.digest)\n  assertPlanEvidence(state.executionPlan.value, state.executionPlan.bytes, 'execution plan')\n  agentCandidateExecutionPlanEvidenceSchema.parse(state.executionPlan.value)\n\n  const receipt = agentCandidateMaterializationReceiptSchema.parse(\n    state.materializationReceipt.value,\n  )\n  const receiptBytes = canonicalCandidateBytes(omitTopLevelDigest(receipt))\n  if (\n    canonicalCandidateDigest(omitTopLevelDigest(receipt)) !== state.materializationReceipt.digest ||\n    !Buffer.from(receiptBytes).equals(Buffer.from(state.materializationReceipt.bytes))\n  ) {\n    throw new Error('prepared materialization receipt no longer matches its canonical bytes')\n  }\n\n  assertSignedBenchmarkInput(state)\n  const instruction = Buffer.from(state.benchmarkTask.instruction, 'utf8')\n  if (\n    !Buffer.from(state.instruction.bytes).equals(instruction) ||\n    JSON.stringify(state.instruction.delivery) !==\n      JSON.stringify(state.executionPlan.value.material.instructionDelivery)\n  ) {\n    throw new Error('prepared instruction no longer matches the signed execution plan')\n  }\n  if (\n    !/^candidate-preparation\\.[A-Za-z0-9_-]{43}$/.test(state.preparationId) ||\n    !Number.isSafeInteger(state.reservationExpiresAtMs) ||\n    state.reservationExpiresAtMs <= 0 ||\n    !Number.isSafeInteger(state.cleanupTimeoutMs) ||\n    state.cleanupTimeoutMs <= 0 ||\n    !Number.isSafeInteger(state.resultTimeoutMs) ||\n    state.resultTimeoutMs <= 0 ||\n    JSON.stringify(state.resolvedModel) !==\n      JSON.stringify(state.executionPlan.value.material.model.resolved) ||\n    state.modelReservation.digest !== state.executionPlan.value.material.model.access.grantDigest ||\n    state.modelReservation.preparationId !== state.preparationId ||\n    state.modelReservation.expiresAtMs !== state.reservationExpiresAtMs ||\n    canonicalCandidateDigest(state.modelReservation.network) !==\n      canonicalCandidateDigest(state.executionPlan.value.material.model.access.network) ||\n    canonicalCandidateDigest(state.modelReservation.enforcedLimits) !==\n      canonicalCandidateDigest(modelLimits(state.executionPlan.value.material.limits))\n  ) {\n    throw new Error('prepared model access no longer matches the signed execution plan')\n  }\n  assertExecutorInputs(state)\n  assertPreparedKnowledge(state)\n  if (\n    (state.memory.mode === 'isolated' && !state.memoryReservation) ||\n    (state.memory.mode === 'disabled' && state.memoryReservation)\n  ) {\n    throw new Error('prepared memory reservation does not match the signed execution plan')\n  }\n  if (\n    state.memory.mode === 'isolated' &&\n    state.memoryReservation &&\n    (state.memoryReservation.preparationId !== state.preparationId ||\n      state.memoryReservation.expiresAtMs !== state.reservationExpiresAtMs ||\n      state.memoryReservation.effectiveNamespace !== state.memory.effectiveNamespace)\n  ) {\n    throw new Error('prepared memory reservation identity no longer matches the execution')\n  }\n  if (JSON.stringify(state.memory) !== JSON.stringify(state.executionPlan.value.material.memory)) {\n    throw new Error('prepared memory no longer matches the signed execution plan')\n  }\n\n  const expectedTags = {\n    [CANDIDATE_TRACE_TAGS.executionId]: state.executionId,\n    [CANDIDATE_TRACE_TAGS.bundleDigest]: state.bundle.digest,\n    [CANDIDATE_TRACE_TAGS.executionPlanDigest]: state.executionPlan.value.digest,\n    [CANDIDATE_TRACE_TAGS.materializationReceiptDigest]: state.materializationReceipt.digest,\n  }\n  const expectedTraceEnvironment = {\n    [CANDIDATE_TRACE_ENV.executionId]: state.executionId,\n    [CANDIDATE_TRACE_ENV.bundleDigest]: state.bundle.digest,\n    [CANDIDATE_TRACE_ENV.executionPlanDigest]: state.executionPlan.value.digest,\n    [CANDIDATE_TRACE_ENV.materializationReceiptDigest]: state.materializationReceipt.digest,\n    [CANDIDATE_TRACE_ENV.traceRunId]: state.trace.runId,\n  }\n  if (\n    !state.trace.runId.startsWith(\n      `${state.executionId}:attempt-${state.executionPlan.value.material.runCell.attempt}:`,\n    ) ||\n    canonicalCandidateDigest(state.trace.tags) !== canonicalCandidateDigest(expectedTags) ||\n    canonicalCandidateDigest(state.trace.env) !== canonicalCandidateDigest(expectedTraceEnvironment)\n  ) {\n    throw new Error('prepared trace identity no longer matches the signed execution')\n  }\n}\n\nfunction assertPlanEvidence(\n  evidence:\n    | PreparedAgentCandidateExecution['profilePlan']['value']\n    | PreparedAgentCandidateExecution['executionPlan']['value'],\n  bytes: Uint8Array,\n  label: string,\n): void {\n  const expected = canonicalCandidateBytes(evidence.material)\n  if (\n    sha256Bytes(expected) !== evidence.digest ||\n    !Buffer.from(expected).equals(Buffer.from(bytes)) ||\n    evidence.artifact.sha256 !== evidence.digest ||\n    evidence.artifact.byteLength !== bytes.byteLength ||\n    !('content' in evidence.artifact) ||\n    !Buffer.from(evidence.artifact.content, 'base64').equals(Buffer.from(bytes))\n  ) {\n    throw new Error(`prepared ${label} no longer matches its canonical bytes`)\n  }\n}\n\nfunction evidenceView<T extends { value: unknown; bytes: Uint8Array }>(evidence: T): T {\n  const bytes = Uint8Array.from(evidence.bytes)\n  return Object.freeze({\n    ...evidence,\n    get bytes(): Uint8Array {\n      return Uint8Array.from(bytes)\n    },\n  })\n}\n\nfunction bytesView<T extends { bytes: Uint8Array }>(value: T, key: 'bytes'): T {\n  const bytes = Uint8Array.from(value.bytes)\n  return Object.freeze({\n    ...value,\n    get [key](): Uint8Array {\n      return Uint8Array.from(bytes)\n    },\n  })\n}\n\nfunction knowledgeView(\n  knowledge: NonNullable<PreparedAgentCandidateExecution['knowledge']>,\n): NonNullable<PreparedAgentCandidateExecution['knowledge']> {\n  const retrievalConfig = knowledge.retrievalConfig\n    ? Uint8Array.from(knowledge.retrievalConfig)\n    : undefined\n  return Object.freeze({\n    candidate: knowledge.candidate,\n    snapshot: knowledge.snapshot,\n    files: Object.freeze(knowledge.files.map((file) => profileFileView(file))),\n    ...(retrievalConfig\n      ? {\n          get retrievalConfig(): Uint8Array {\n            return Uint8Array.from(retrievalConfig)\n          },\n        }\n      : {}),\n  })\n}\nfunction workspaceInputView(\n  snapshot: AgentCandidateExecutorRequest['inputs']['task']['snapshot'],\n  sourceFiles: PreparedCandidateState['executorInputs']['taskFiles'],\n): AgentCandidateExecutorRequest['inputs']['task'] {\n  return Object.freeze({\n    snapshot,\n    files: Object.freeze(sourceFiles.map((file) => executorFileView(file))),\n  })\n}\n\nfunction profileFileView(\n  source: PreparedCandidateState['executorInputs']['profileFiles'][number],\n): AgentCandidateExecutorRequest['inputs']['profile']['files'][number] {\n  const bytes = Uint8Array.from(source.bytes)\n  return Object.freeze({\n    path: source.path,\n    mode: source.mode,\n    get bytes(): Uint8Array {\n      return Uint8Array.from(bytes)\n    },\n  })\n}\n\nfunction executorFileView(\n  source: PreparedCandidateState['executorInputs']['taskFiles'][number],\n): AgentCandidateExecutorWorkspaceFile {\n  const bytes = Uint8Array.from(source.bytes)\n  return Object.freeze({\n    path: source.path,\n    mode: source.mode,\n    get bytes(): Uint8Array {\n      return Uint8Array.from(bytes)\n    },\n  })\n}\n\nfunction assertExecutorInputs(state: PreparedCandidateState): void {\n  const material = state.executionPlan.value.material\n  assertWorkspaceExecutorFiles(\n    state.executorInputs.taskFiles,\n    state.benchmarkTask.workspace.material,\n  )\n  if (material.candidateWorkspace) {\n    if (!state.executorInputs.candidateFiles) {\n      throw new Error('prepared candidate executor files are missing')\n    }\n    assertWorkspaceExecutorFiles(\n      state.executorInputs.candidateFiles,\n      material.candidateWorkspace.material,\n    )\n  } else if (state.executorInputs.candidateFiles) {\n    throw new Error('disabled candidate has executor files')\n  }\n\n  const expectedFiles = state.profilePlan.value.material.files\n  if (state.executorInputs.profileFiles.length !== expectedFiles.length) {\n    throw new Error('prepared profile executor files do not match the signed profile plan')\n  }\n  for (let index = 0; index < expectedFiles.length; index++) {\n    const expected = expectedFiles[index]\n    const actual = state.executorInputs.profileFiles[index]\n    if (\n      !expected ||\n      !actual ||\n      actual.path !== expected.relPath ||\n      actual.mode !== expected.mode ||\n      sha256Bytes(actual.bytes) !== expected.contentSha256\n    ) {\n      throw new Error('prepared profile executor files do not match the signed profile plan')\n    }\n  }\n}\n\nfunction assertPreparedKnowledge(state: PreparedCandidateState): void {\n  const expected = state.bundle.knowledge\n  const actual = state.knowledge\n  if (!expected || !actual) {\n    if (expected || actual)\n      throw new Error('prepared knowledge does not match the candidate bundle')\n    return\n  }\n  if (\n    canonicalCandidateDigest(actual.candidate) !== canonicalCandidateDigest(expected.candidate) ||\n    canonicalCandidateDigest(actual.snapshot) !== canonicalCandidateDigest(expected.snapshot) ||\n    state.executionPlan.value.material.knowledgeManifestDigest !== expected.snapshot.digest\n  ) {\n    throw new Error('prepared knowledge identity does not match the candidate bundle')\n  }\n  assertWorkspaceExecutorFiles(actual.files, expected.snapshot.material)\n  if (!expected.retrievalConfig || !actual.retrievalConfig) {\n    if (expected.retrievalConfig || actual.retrievalConfig) {\n      throw new Error('prepared knowledge retrieval config does not match the candidate bundle')\n    }\n    return\n  }\n  if (\n    actual.retrievalConfig.byteLength !== expected.retrievalConfig.byteLength ||\n    sha256Bytes(actual.retrievalConfig) !== expected.retrievalConfig.sha256\n  ) {\n    throw new Error('prepared knowledge retrieval config does not match the candidate bundle')\n  }\n}\n\nfunction assertWorkspaceExecutorFiles(\n  actualFiles: PreparedCandidateState['executorInputs']['taskFiles'],\n  expected: AgentCandidateWorkspaceManifestMaterial,\n): void {\n  if (actualFiles.length !== expected.files.length) {\n    throw new Error('prepared workspace executor files do not match the signed manifest')\n  }\n  for (let index = 0; index < expected.files.length; index++) {\n    const actual = actualFiles[index]\n    const planned = expected.files[index]\n    if (\n      !actual ||\n      !planned ||\n      actual.path !== planned.path ||\n      actual.mode !== planned.mode ||\n      actual.bytes.byteLength !== planned.byteLength ||\n      sha256Bytes(actual.bytes) !== planned.sha256\n    ) {\n      throw new Error('prepared workspace executor files do not match the signed manifest')\n    }\n  }\n}\n\nfunction assertSignedBenchmarkInput(state: PreparedCandidateState): void {\n  const plan = state.executionPlan.value.material\n  const cell = plan.runCell\n  const suite = state.benchmarkSuite\n  const task = state.benchmarkTask\n  const receipt = state.materializationReceipt.value\n  const cellIndex = cell.taskIndex * suite.reps + cell.repetition\n  if (\n    canonicalCandidateDigest(omitTopLevelDigest(suite)) !== suite.digest ||\n    canonicalCandidateDigest(omitTopLevelDigest(task)) !== task.digest ||\n    canonicalCandidateDigest(omitTopLevelDigest(cell)) !== cell.digest ||\n    cell.bundleDigest !== state.bundle.digest ||\n    cell.suiteDigest !== suite.digest ||\n    cell.taskDigest !== task.digest ||\n    suite.taskDigests[cell.taskIndex] !== task.digest ||\n    suite.seeds[cellIndex] !== cell.seed ||\n    cell.repetition >= suite.reps ||\n    cell.attempt < 1 ||\n    cell.attempt > task.attempt.maxAttempts\n  ) {\n    throw new Error('prepared candidate no longer matches its signed experiment cell')\n  }\n  const suiteBytes = canonicalCandidateBytes(omitTopLevelDigest(suite))\n  const taskBytes = canonicalCandidateBytes(omitTopLevelDigest(task))\n  if (\n    receipt.benchmark.suite.digest !== suite.digest ||\n    receipt.benchmark.suite.material.sha256 !== sha256Bytes(suiteBytes) ||\n    receipt.benchmark.suite.material.byteLength !== suiteBytes.byteLength ||\n    receipt.benchmark.task.digest !== task.digest ||\n    receipt.benchmark.task.material.sha256 !== sha256Bytes(taskBytes) ||\n    receipt.benchmark.task.material.byteLength !== taskBytes.byteLength\n  ) {\n    throw new Error('materialization receipt no longer matches its signed benchmark input')\n  }\n}\n\nfunction immutableExecutorFiles(\n  files: PreparedCandidateState['executorInputs']['taskFiles'],\n): ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }> {\n  return Object.freeze(\n    files.map((file) => Object.freeze({ ...file, bytes: Uint8Array.from(file.bytes) })),\n  )\n}\n\nfunction modelLimits(\n  limits: PreparedAgentCandidateExecution['executionPlan']['value']['material']['limits'],\n): AgentCandidateProtectedModelReservation['enforcedLimits'] {\n  return {\n    maxModelCalls: limits.maxModelCalls,\n    maxInputTokens: limits.maxInputTokens,\n    maxOutputTokens: limits.maxOutputTokens,\n    maxCostUsd: limits.maxCostUsd,\n  }\n}\n\nfunction transitionLifecycle(\n  prepared: PreparedAgentCandidateExecution,\n  expected: ReadonlyArray<\n    | 'prepared'\n    | 'claiming'\n    | 'claimed'\n    | 'running'\n    | 'settling'\n    | 'disposing'\n    | 'succeeded'\n    | 'failed'\n    | 'disposal-failed'\n    | 'cleanup-failed'\n    | 'disposed'\n  >,\n  next:\n    | 'claiming'\n    | 'claimed'\n    | 'running'\n    | 'settling'\n    | 'disposing'\n    | 'succeeded'\n    | 'failed'\n    | 'disposal-failed'\n    | 'cleanup-failed'\n    | 'disposed',\n): void {\n  const lifecycle = lifecycleByExecution.get(prepared)\n  if (!lifecycle || !expected.includes(lifecycle.status)) {\n    throw new Error(`prepared candidate execution is already ${lifecycle?.status ?? 'unknown'}`)\n  }\n  lifecycle.status = next\n}\n\nfunction assertProtectedEnvironment(\n  state: PreparedCandidateState,\n  modelEnvironment: Readonly<Record<string, string>>,\n  memoryEnvironment: Readonly<Record<string, string>> | undefined,\n): void {\n  const seen = new Set([...Object.keys(state.launch.env), ...Object.keys(state.trace.env)])\n  for (const [name, value] of [\n    ...Object.entries(modelEnvironment),\n    ...Object.entries(memoryEnvironment ?? {}),\n  ]) {\n    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || typeof value !== 'string' || value.length < 8) {\n      throw new Error('protected model activation contains an invalid environment binding')\n    }\n    if (seen.has(name)) {\n      throw new Error(`protected model activation collides with environment binding ${name}`)\n    }\n    seen.add(name)\n  }\n}\n","import type { AgentCandidateArtifactRef, Sha256Digest } from '@tangle-network/agent-interface'\n\nimport { type AgentCandidateExecutionClaim, candidateClaimFileInternals } from './claim'\nimport { canonicalCandidateDigest } from './digest'\nimport { candidateExecutionOwnerWindowMs } from './execution-window'\nimport { assertPreparedCandidateIntegrity } from './prepared-state'\nimport type { PreparedAgentCandidateExecution } from './types'\n\n/** Extract the complete durable claim from a prepared execution. */\nexport function candidateExecutionClaim(\n  prepared: PreparedAgentCandidateExecution,\n  preparationEvidence: {\n    executionPlan: AgentCandidateArtifactRef\n    materializationReceipt: AgentCandidateArtifactRef\n  },\n): AgentCandidateExecutionClaim {\n  const state = assertPreparedCandidateIntegrity(prepared)\n  const material = prepared.executionPlan.value.material\n  const attempt = {\n    number: material.runCell.attempt,\n    maxAttempts: state.benchmarkTask.attempt.maxAttempts,\n    retryPolicy: state.benchmarkTask.attempt.retryPolicy,\n  } as const\n  const nowMs = Date.now()\n  if (!Number.isSafeInteger(nowMs) || nowMs < 0) {\n    throw new Error('candidate execution claim-store clock returned an invalid timestamp')\n  }\n  const leaseExpiresAtMs =\n    nowMs +\n    candidateExecutionOwnerWindowMs(\n      material.limits.timeoutMs,\n      state.cleanupTimeoutMs,\n      state.resultTimeoutMs,\n    )\n  if (!Number.isSafeInteger(leaseExpiresAtMs) || leaseExpiresAtMs <= 0) {\n    throw new Error('candidate execution leaseExpiresAtMs must be a positive safe timestamp')\n  }\n  if (leaseExpiresAtMs > state.reservationExpiresAtMs) {\n    throw new Error(\n      'candidate preparation expires before its full execution and cleanup owner window',\n    )\n  }\n  if (\n    preparationEvidence.executionPlan.sha256 !== prepared.executionPlan.value.digest ||\n    preparationEvidence.executionPlan.byteLength !== state.executionPlan.bytes.byteLength\n  ) {\n    throw new Error('persisted execution plan does not match its canonical preparation bytes')\n  }\n  if (\n    preparationEvidence.materializationReceipt.sha256 !== state.materializationReceipt.digest ||\n    preparationEvidence.materializationReceipt.byteLength !==\n      state.materializationReceipt.bytes.byteLength\n  ) {\n    throw new Error(\n      'persisted materialization receipt does not match its canonical preparation bytes',\n    )\n  }\n  return candidateClaimFileInternals.sealClaim({\n    executionId: prepared.executionId,\n    attempt: attempt.number,\n    maxAttempts: attempt.maxAttempts,\n    retryPolicy: attempt.retryPolicy,\n    bundleDigest: prepared.bundle.digest,\n    executionPlanDigest: prepared.executionPlan.value.digest,\n    preparationEvidence,\n    retryLineageDigest: retryLineageDigest(prepared, state.resultTimeoutMs),\n    leaseExpiresAtMs,\n    resultTimeoutMs: state.resultTimeoutMs,\n    cleanup: {\n      preparationId: state.preparationId,\n      modelGrantDigest: state.modelReservation.digest,\n      resolvedModel: state.resolvedModel,\n      traceRunId: state.trace.runId,\n      cleanupTimeoutMs: state.cleanupTimeoutMs,\n      ...(state.memoryReservation\n        ? {\n            memory: {\n              accessDigest: state.memoryReservation.accessDigest,\n              effectiveNamespace: state.memoryReservation.effectiveNamespace,\n            },\n          }\n        : {}),\n    },\n  })\n}\n\nfunction retryLineageDigest(\n  prepared: PreparedAgentCandidateExecution,\n  resultTimeoutMs: number,\n): Sha256Digest {\n  const material = prepared.executionPlan.value.material\n  return canonicalCandidateDigest({\n    resultTimeoutMs,\n    executionPlan: {\n      ...material,\n      runCell: {\n        ...material.runCell,\n        attempt: 0,\n        digest: `sha256:${'0'.repeat(64)}`,\n      },\n      model: {\n        ...material.model,\n        access: {\n          ...material.model.access,\n          grantDigest: `sha256:${'0'.repeat(64)}`,\n        },\n      },\n      memory:\n        material.memory.mode === 'disabled'\n          ? material.memory\n          : {\n              mode: 'isolated',\n              scope: 'task',\n              effectiveNamespace: 'candidate/retry-lineage-normalized',\n              reset: {\n                kind: 'fresh',\n                emptyStateDigest: material.memory.reset.emptyStateDigest,\n              },\n              beforeState: {\n                digest: material.memory.beforeState.digest,\n                material: material.memory.beforeState.material,\n                manifest: {\n                  sha256: material.memory.beforeState.manifest.sha256,\n                  byteLength: material.memory.beforeState.manifest.byteLength,\n                },\n                archive: {\n                  sha256: material.memory.beforeState.archive.sha256,\n                  byteLength: material.memory.beforeState.archive.byteLength,\n                },\n              },\n              ...(material.memory.seedDigest ? { seedDigest: material.memory.seedDigest } : {}),\n            },\n    },\n  })\n}\n","/** Durable one-shot lifecycle for candidate execution attempts. */\n\nimport { createHash, randomBytes, timingSafeEqual } from 'node:crypto'\nimport { readFile } from 'node:fs/promises'\nimport {\n  type AgentCandidateArtifactRef,\n  type AgentCandidateAttemptPolicy,\n  type AgentCandidateFixedSpend,\n  type AgentCandidateResolvedModel,\n  agentCandidateResolvedModelSchema,\n  type Sha256Digest,\n} from '@tangle-network/agent-interface'\nimport {\n  type AgentCandidatePreparationEvidence,\n  type PersistedAgentCandidateExecutionClaim,\n  type PersistedAgentCandidateExecutionPending,\n  type PersistedAgentCandidateExecutionPhase,\n  type PersistedAgentCandidateExecutionTerminal,\n  sealCandidatePreparationEvidence,\n} from './claim-file-formats'\nimport {\n  assertRecoveryMatchesStaged,\n  assertTerminalAllowedInPhase,\n  assertTerminalMatchesClaim,\n  recoveredTerminalRecord,\n  rejectedFinish,\n  rejectedStage,\n  requireStagedTerminal,\n  sealTerminalDigest,\n  sealTerminalRecordValue,\n  terminalRecord,\n} from './claim-terminal'\nimport { candidateCleanupTimeout, candidateResultTimeout } from './cleanup'\nimport { canonicalCandidateDigest, immutableCandidateValue } from './digest'\nimport { assertExactObjectKeys as assertExactKeys } from './exact-object'\n\n/** Non-secret identities a trusted recovery worker needs to close an abandoned attempt. */\nexport interface AgentCandidateExecutionCleanupHandles {\n  readonly preparationId: string\n  readonly modelGrantDigest: Sha256Digest\n  readonly resolvedModel: AgentCandidateResolvedModel\n  readonly traceRunId: string\n  readonly cleanupTimeoutMs: number\n  readonly memory?: {\n    readonly accessDigest: Sha256Digest\n    readonly effectiveNamespace: string\n  }\n}\n\n/** Immutable signed identity stored for one execution attempt. */\nexport interface AgentCandidateExecutionClaim {\n  readonly executionId: string\n  readonly attempt: number\n  readonly maxAttempts: number\n  readonly retryPolicy: AgentCandidateAttemptPolicy['retryPolicy']\n  readonly bundleDigest: Sha256Digest\n  readonly executionPlanDigest: Sha256Digest\n  /** Durable canonical bytes needed to reconstruct the signed preparation. */\n  readonly preparationEvidence: AgentCandidatePreparationEvidence\n  /** Frozen plan identity with only attempt number and per-attempt grant identity normalized. */\n  readonly retryLineageDigest: Sha256Digest\n  /** The winning lease stops authorizing a new terminal write at this instant. */\n  readonly leaseExpiresAtMs: number\n  /** Frozen budget for task verification, executable grading, and receipt construction. */\n  readonly resultTimeoutMs: number\n  /** Non-secret handles retained so an expired attempt can be closed and reconciled. */\n  readonly cleanup: AgentCandidateExecutionCleanupHandles\n}\n\n/** Secret capability required to finish the acquired attempt. */\nexport interface AgentCandidateExecutionLease {\n  readonly executionId: string\n  readonly attempt: number\n  readonly token: string\n  readonly expiresAtMs: number\n}\n\n/** Only the first class is retryable, and only when the closed model ledger has zero calls. */\nexport type AgentCandidateExecutionFailureClass =\n  | 'pre-model-infrastructure'\n  | 'execution'\n  | 'post-model-infrastructure'\n  | 'unknown'\n\n/** Evaluator-owned terminal facts staged durably before the terminal CAS. */\nexport type AgentCandidateExecutionTerminalResult =\n  | {\n      readonly status: 'succeeded'\n      readonly usage: AgentCandidateFixedSpend\n      readonly modelSettlement: AgentCandidateArtifactRef\n      readonly taskOutcome: AgentCandidateArtifactRef\n      readonly benchmarkResult: AgentCandidateArtifactRef\n      readonly runReceipt: AgentCandidateArtifactRef\n    }\n  | {\n      readonly status: 'failed'\n      readonly failureClass: AgentCandidateExecutionFailureClass\n      readonly usage: AgentCandidateFixedSpend\n      readonly modelSettlement: AgentCandidateArtifactRef\n      readonly failureEvidence?: AgentCandidateArtifactRef\n    }\n\n/** Durable terminal record for one acquired execution attempt. */\nexport type AgentCandidateExecutionTerminalRecord = AgentCandidateExecutionTerminalResult & {\n  readonly executionId: string\n  readonly attempt: number\n  readonly bundleDigest: Sha256Digest\n  readonly executionPlanDigest: Sha256Digest\n  readonly preparationEvidence: AgentCandidateExecutionClaim['preparationEvidence']\n  /** RFC 8785 SHA-256 of this record with `terminalDigest` omitted. */\n  readonly terminalDigest: Sha256Digest\n}\n\n/** Monotonic durable phase: the second value means candidate code could have started. */\nexport type AgentCandidateExecutionPhase = 'claimed' | 'candidate-may-run'\n\n/** Trusted, independently observed closure facts for one expired winning lease. */\nexport interface AgentCandidateExecutionRecoveryEvidence {\n  readonly failureClass: AgentCandidateExecutionFailureClass\n  readonly usage: AgentCandidateFixedSpend\n  readonly modelSettlement: AgentCandidateArtifactRef\n  readonly failureEvidence?: AgentCandidateArtifactRef\n  readonly process: {\n    readonly stopped: true\n    readonly executionPlanDigest: Sha256Digest\n  }\n  readonly model: {\n    readonly closed: true\n    readonly preparationId: string\n    readonly grantDigest: Sha256Digest\n  }\n  readonly memory?: {\n    readonly closed: true\n    readonly preparationId: string\n    readonly accessDigest: Sha256Digest\n    readonly effectiveNamespace: string\n  }\n}\n\nexport interface AgentCandidateExecutionAttemptRef {\n  readonly executionId: string\n  readonly attempt: number\n}\n\n/** Persisted state available to a fresh trusted recovery worker after a crash. */\nexport interface AgentCandidateExecutionAttemptRecord {\n  readonly claim: AgentCandidateExecutionClaim\n  readonly phase: AgentCandidateExecutionPhase\n  /** Durable outbox content written before the terminal compare-and-set. */\n  readonly staged?: AgentCandidateExecutionTerminalRecord\n  readonly terminal?: AgentCandidateExecutionTerminalRecord\n}\n\n/** Result of atomically claiming one execution attempt. */\nexport type AgentCandidateExecutionClaimResult =\n  | {\n      readonly acquired: true\n      readonly claim: AgentCandidateExecutionClaim\n      readonly lease: AgentCandidateExecutionLease\n    }\n  | {\n      readonly acquired: false\n      readonly reason: 'already-claimed'\n      /** The durable winner already occupying this execution-attempt slot. */\n      readonly claim: AgentCandidateExecutionClaim\n      /** True only when every signed claim field matches the durable winner. */\n      readonly exactReplay: boolean\n    }\n  | {\n      readonly acquired: false\n      readonly reason: 'retry-not-eligible'\n      readonly claim: AgentCandidateExecutionClaim\n      readonly detail: AgentCandidateRetryRejection\n    }\n\n/** Result of atomically recording an attempt's terminal facts. */\nexport type AgentCandidateExecutionFinishResult =\n  | {\n      readonly finished: true\n      readonly terminal: AgentCandidateExecutionTerminalRecord\n    }\n  | {\n      readonly finished: false\n      readonly terminal: AgentCandidateExecutionTerminalRecord\n      /** True when a repeated finish supplied the same terminal digest. */\n      readonly exactReplay: boolean\n    }\n\n/** Result of durably staging the one immutable terminal outbox entry. */\nexport type AgentCandidateExecutionStageResult =\n  | {\n      readonly staged: true\n      readonly terminal: AgentCandidateExecutionTerminalRecord\n    }\n  | {\n      readonly staged: false\n      readonly terminal: AgentCandidateExecutionTerminalRecord\n      readonly exactReplay: boolean\n    }\n\n/** Result of crossing the irreversible candidate-may-run boundary. */\nexport type AgentCandidateExecutionPhaseResult =\n  | { readonly marked: true; readonly phase: 'candidate-may-run' }\n  | { readonly marked: false; readonly phase: 'candidate-may-run' }\n\nexport type AgentCandidateRetryRejection =\n  | 'prior-attempt-missing'\n  | 'prior-attempt-running'\n  | 'prior-attempt-succeeded'\n  | 'prior-attempt-spent-model-calls'\n  | 'prior-attempt-not-pre-model-infrastructure'\n  | 'retry-lineage-mismatch'\n\n/**\n * Atomic one-shot store for candidate execution attempts.\n *\n * Implementations must linearize both methods across every process sharing the\n * store. Terminal publication is deliberately two-step: `stageTerminal`\n * fsyncs the complete immutable outbox record, then `finish` publishes exactly\n * those staged bytes by digest. A crash between the two leaves recoverable\n * evidence rather than an ambiguous completed run.\n */\nexport interface AgentCandidateExecutionClaimStore {\n  tryClaim(claim: AgentCandidateExecutionClaim): Promise<AgentCandidateExecutionClaimResult>\n  getAttempt(\n    attempt: AgentCandidateExecutionAttemptRef,\n  ): Promise<AgentCandidateExecutionAttemptRecord | undefined>\n  /** Persist the point after which candidate code may have run. */\n  markCandidateMayRun(\n    lease: AgentCandidateExecutionLease,\n  ): Promise<AgentCandidateExecutionPhaseResult>\n  /** Fsync the complete terminal record into the durable outbox. */\n  stageTerminal(\n    lease: AgentCandidateExecutionLease,\n    result: AgentCandidateExecutionTerminalResult,\n  ): Promise<AgentCandidateExecutionStageResult>\n  /** Publish exactly the staged terminal identified by `terminalDigest`. */\n  finish(\n    lease: AgentCandidateExecutionLease,\n    terminalDigest: Sha256Digest,\n  ): Promise<AgentCandidateExecutionFinishResult>\n  /**\n   * Write a failed terminal only after the lease expired and a trusted worker\n   * independently proved process death plus model and memory closure.\n   */\n  recoverExpired(\n    attempt: AgentCandidateExecutionAttemptRef,\n    evidence: AgentCandidateExecutionRecoveryEvidence,\n  ): Promise<AgentCandidateExecutionFinishResult>\n}\n\ninterface StoredClaim {\n  claim: AgentCandidateExecutionClaim\n  leaseDigest: Sha256Digest\n  phase: AgentCandidateExecutionPhase\n  staged?: AgentCandidateExecutionTerminalRecord\n  terminal?: AgentCandidateExecutionTerminalRecord\n}\n\nfunction attemptRecord(\n  claim: AgentCandidateExecutionClaim,\n  phase: AgentCandidateExecutionPhase,\n  staged?: AgentCandidateExecutionTerminalRecord,\n  terminal?: AgentCandidateExecutionTerminalRecord,\n): AgentCandidateExecutionAttemptRecord {\n  return Object.freeze({\n    claim,\n    phase,\n    ...(staged ? { staged } : {}),\n    ...(terminal ? { terminal } : {}),\n  })\n}\n\nexport interface InMemoryAgentCandidateExecutionClaimStoreOptions {\n  /** Testable evaluator clock; defaults to `Date.now`. */\n  now?: () => number\n}\n\n/** Single-process lifecycle implementation. */\nexport class InMemoryAgentCandidateExecutionClaimStore\n  implements AgentCandidateExecutionClaimStore\n{\n  private readonly claims = new Map<string, StoredClaim>()\n  private readonly now: () => number\n\n  constructor(options: InMemoryAgentCandidateExecutionClaimStoreOptions = {}) {\n    this.now = options.now ?? Date.now\n  }\n\n  async tryClaim(\n    requested: AgentCandidateExecutionClaim,\n  ): Promise<AgentCandidateExecutionClaimResult> {\n    const claim = sealClaim(requested)\n    const slot = claimSlot(claim)\n    const existing = this.claims.get(slot)\n    if (existing) return rejectedExistingClaim(existing.claim, claim)\n    assertUnexpiredLease(claim.leaseExpiresAtMs, this.now())\n\n    const retryRejection = retryRejectionFromMemory(this.claims, claim)\n    if (retryRejection) return rejectedRetry(claim, retryRejection)\n\n    const lease = newLease(claim)\n    // No await may occur between the read and write: this is the linearization\n    // point for every caller sharing this store instance.\n    this.claims.set(slot, {\n      claim,\n      leaseDigest: leaseDigest(lease),\n      phase: 'claimed',\n    })\n    return Object.freeze({ acquired: true, claim, lease })\n  }\n\n  async getAttempt(\n    requestedAttempt: AgentCandidateExecutionAttemptRef,\n  ): Promise<AgentCandidateExecutionAttemptRecord | undefined> {\n    const attempt = sealAttemptRef(requestedAttempt)\n    const stored = this.claims.get(claimSlot(attempt))\n    return stored\n      ? attemptRecord(stored.claim, stored.phase, stored.staged, stored.terminal)\n      : undefined\n  }\n\n  async markCandidateMayRun(\n    requestedLease: AgentCandidateExecutionLease,\n  ): Promise<AgentCandidateExecutionPhaseResult> {\n    const lease = sealLease(requestedLease)\n    const stored = this.requireClaim(lease)\n    assertLease(stored.leaseDigest, stored.claim.leaseExpiresAtMs, lease)\n    if (stored.phase === 'candidate-may-run') {\n      return Object.freeze({ marked: false, phase: 'candidate-may-run' })\n    }\n    if (stored.staged || stored.terminal) {\n      throw new Error('candidate execution terminal was staged before candidate-may-run phase')\n    }\n    assertUnexpiredLease(stored.claim.leaseExpiresAtMs, this.now())\n    stored.phase = 'candidate-may-run'\n    return Object.freeze({ marked: true, phase: 'candidate-may-run' })\n  }\n\n  async stageTerminal(\n    requestedLease: AgentCandidateExecutionLease,\n    result: AgentCandidateExecutionTerminalResult,\n  ): Promise<AgentCandidateExecutionStageResult> {\n    const lease = sealLease(requestedLease)\n    const stored = this.requireClaim(lease)\n    assertLease(stored.leaseDigest, stored.claim.leaseExpiresAtMs, lease)\n    const terminal = terminalRecord(stored.claim, result)\n    if (stored.staged) return rejectedStage(stored.staged, terminal)\n    assertTerminalAllowedInPhase(stored.phase, terminal)\n    assertUnexpiredLease(stored.claim.leaseExpiresAtMs, this.now())\n    stored.staged = terminal\n    return Object.freeze({ staged: true, terminal })\n  }\n\n  async finish(\n    requestedLease: AgentCandidateExecutionLease,\n    requestedTerminalDigest: Sha256Digest,\n  ): Promise<AgentCandidateExecutionFinishResult> {\n    const lease = sealLease(requestedLease)\n    const terminalDigest = sealTerminalDigest(requestedTerminalDigest)\n    const stored = this.requireClaim(lease)\n    assertLease(stored.leaseDigest, stored.claim.leaseExpiresAtMs, lease)\n    const staged = requireStagedTerminal(stored.staged, terminalDigest)\n    if (stored.terminal) return rejectedFinish(stored.terminal, terminalDigest)\n    assertUnexpiredLease(stored.claim.leaseExpiresAtMs, this.now())\n\n    // The terminal assignment is the in-memory finish linearization point and\n    // publishes the exact immutable object already present in the outbox.\n    stored.terminal = staged\n    return Object.freeze({ finished: true, terminal: staged })\n  }\n\n  async recoverExpired(\n    requestedAttempt: AgentCandidateExecutionAttemptRef,\n    evidence: AgentCandidateExecutionRecoveryEvidence,\n  ): Promise<AgentCandidateExecutionFinishResult> {\n    const attempt = sealAttemptRef(requestedAttempt)\n    const stored = this.requireClaim(attempt, 'candidate execution recovery')\n    const recovered = recoveredTerminalRecord(stored.claim, stored.phase, evidence)\n    if (stored.staged) assertRecoveryMatchesStaged(stored.staged, recovered)\n    const requestedDigest = stored.staged?.terminalDigest ?? recovered.terminalDigest\n    if (stored.terminal) return rejectedFinish(stored.terminal, requestedDigest)\n    assertExpiredLease(stored.claim.leaseExpiresAtMs, this.now())\n    const terminal = stored.staged ?? recovered\n    assertRecoveryMatchesStaged(terminal, recovered)\n    stored.staged ??= terminal\n    stored.terminal = terminal\n    return Object.freeze({ finished: true, terminal })\n  }\n\n  private requireClaim(\n    attempt: Pick<AgentCandidateExecutionLease, 'executionId' | 'attempt'>,\n    operation = 'candidate execution lease',\n  ): StoredClaim {\n    const stored = this.claims.get(claimSlot(attempt))\n    if (!stored) throw new Error(`${operation} does not name an acquired attempt`)\n    return stored\n  }\n}\n\nconst SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/\nconst LEASE_TOKEN_PATTERN = /^candidate-execution-lease\\.[A-Za-z0-9_-]{43}$/\nconst PREPARATION_ID_PATTERN = /^candidate-preparation\\.[A-Za-z0-9_-]{43}$/\n\nfunction sealClaim(claim: AgentCandidateExecutionClaim): AgentCandidateExecutionClaim {\n  assertExactKeys(\n    claim,\n    [\n      'executionId',\n      'attempt',\n      'maxAttempts',\n      'retryPolicy',\n      'bundleDigest',\n      'executionPlanDigest',\n      'preparationEvidence',\n      'retryLineageDigest',\n      'leaseExpiresAtMs',\n      'resultTimeoutMs',\n      'cleanup',\n    ],\n    'candidate execution claim',\n  )\n  assertExecutionId(claim.executionId)\n  if (!Number.isSafeInteger(claim.attempt) || claim.attempt < 1) {\n    throw new Error('candidate execution claim attempt must be a positive safe integer')\n  }\n  if (!Number.isSafeInteger(claim.maxAttempts) || claim.maxAttempts < 1) {\n    throw new Error('candidate execution claim maxAttempts must be a positive safe integer')\n  }\n  if (claim.attempt > claim.maxAttempts) {\n    throw new Error('candidate execution claim attempt exceeds maxAttempts')\n  }\n  if (!['none', 'pre-model-infrastructure-only'].includes(claim.retryPolicy)) {\n    throw new Error('candidate execution claim retryPolicy is invalid')\n  }\n  if (claim.retryPolicy === 'none' && claim.maxAttempts !== 1) {\n    throw new Error('candidate execution claim retryPolicy none requires maxAttempts 1')\n  }\n  assertSha256Digest(claim.bundleDigest, 'bundleDigest')\n  assertSha256Digest(claim.executionPlanDigest, 'executionPlanDigest')\n  const preparationEvidence = sealCandidatePreparationEvidence(\n    claim.preparationEvidence,\n    claim.executionPlanDigest,\n  )\n  assertSha256Digest(claim.retryLineageDigest, 'retryLineageDigest')\n  assertPositiveTimestamp(claim.leaseExpiresAtMs, 'leaseExpiresAtMs')\n  candidateResultTimeout(claim.resultTimeoutMs, claim.resultTimeoutMs)\n  const cleanup = sealCleanupHandles(claim.cleanup)\n  return Object.freeze({\n    executionId: claim.executionId,\n    attempt: claim.attempt,\n    maxAttempts: claim.maxAttempts,\n    retryPolicy: claim.retryPolicy,\n    bundleDigest: claim.bundleDigest,\n    executionPlanDigest: claim.executionPlanDigest,\n    preparationEvidence,\n    retryLineageDigest: claim.retryLineageDigest,\n    leaseExpiresAtMs: claim.leaseExpiresAtMs,\n    resultTimeoutMs: claim.resultTimeoutMs,\n    cleanup,\n  })\n}\n\nfunction sealCleanupHandles(\n  cleanup: AgentCandidateExecutionCleanupHandles,\n): AgentCandidateExecutionCleanupHandles {\n  assertExactKeys(\n    cleanup,\n    cleanup.memory\n      ? [\n          'preparationId',\n          'modelGrantDigest',\n          'resolvedModel',\n          'traceRunId',\n          'cleanupTimeoutMs',\n          'memory',\n        ]\n      : ['preparationId', 'modelGrantDigest', 'resolvedModel', 'traceRunId', 'cleanupTimeoutMs'],\n    'candidate execution cleanup handles',\n  )\n  if (!PREPARATION_ID_PATTERN.test(cleanup.preparationId)) {\n    throw new Error('candidate execution cleanup preparationId is invalid')\n  }\n  assertSha256Digest(cleanup.modelGrantDigest, 'cleanup modelGrantDigest')\n  const resolvedModel = immutableCandidateValue(\n    agentCandidateResolvedModelSchema.parse(cleanup.resolvedModel),\n  )\n  assertBoundedIdentifier(cleanup.traceRunId, 'cleanup traceRunId', 512)\n  const cleanupTimeoutMs = candidateCleanupTimeout(cleanup.cleanupTimeoutMs)\n  const memory = cleanup.memory ? sealMemoryCleanupHandle(cleanup.memory) : undefined\n  return Object.freeze({\n    preparationId: cleanup.preparationId,\n    modelGrantDigest: cleanup.modelGrantDigest,\n    resolvedModel,\n    traceRunId: cleanup.traceRunId,\n    cleanupTimeoutMs,\n    ...(memory ? { memory } : {}),\n  })\n}\n\nfunction sealMemoryCleanupHandle(\n  memory: NonNullable<AgentCandidateExecutionCleanupHandles['memory']>,\n): NonNullable<AgentCandidateExecutionCleanupHandles['memory']> {\n  assertExactKeys(\n    memory,\n    ['accessDigest', 'effectiveNamespace'],\n    'candidate execution memory cleanup handle',\n  )\n  assertSha256Digest(memory.accessDigest, 'memory accessDigest')\n  assertBoundedIdentifier(memory.effectiveNamespace, 'memory effectiveNamespace', 1_024)\n  return Object.freeze({\n    accessDigest: memory.accessDigest,\n    effectiveNamespace: memory.effectiveNamespace,\n  })\n}\n\nfunction sealAttemptRef(\n  attempt: AgentCandidateExecutionAttemptRef,\n): AgentCandidateExecutionAttemptRef {\n  assertExactKeys(attempt, ['executionId', 'attempt'], 'candidate execution attempt reference')\n  assertExecutionId(attempt.executionId)\n  if (!Number.isSafeInteger(attempt.attempt) || attempt.attempt < 1) {\n    throw new Error('candidate execution attempt reference must have a positive safe attempt')\n  }\n  return Object.freeze({ executionId: attempt.executionId, attempt: attempt.attempt })\n}\n\nfunction sealLease(lease: AgentCandidateExecutionLease): AgentCandidateExecutionLease {\n  assertExactKeys(\n    lease,\n    ['executionId', 'attempt', 'token', 'expiresAtMs'],\n    'candidate execution lease',\n  )\n  if (lease.executionId.length === 0 || !Number.isSafeInteger(lease.attempt) || lease.attempt < 1) {\n    throw new Error('candidate execution lease identity is invalid')\n  }\n  if (!LEASE_TOKEN_PATTERN.test(lease.token)) {\n    throw new Error('candidate execution lease token is invalid')\n  }\n  assertPositiveTimestamp(lease.expiresAtMs, 'lease expiresAtMs')\n  return Object.freeze({\n    executionId: lease.executionId,\n    attempt: lease.attempt,\n    token: lease.token,\n    expiresAtMs: lease.expiresAtMs,\n  })\n}\n\nfunction newLease(claim: AgentCandidateExecutionClaim): AgentCandidateExecutionLease {\n  return Object.freeze({\n    executionId: claim.executionId,\n    attempt: claim.attempt,\n    token: `candidate-execution-lease.${randomBytes(32).toString('base64url')}`,\n    expiresAtMs: claim.leaseExpiresAtMs,\n  })\n}\n\nfunction leaseDigest(lease: AgentCandidateExecutionLease): Sha256Digest {\n  return sha256(lease.token)\n}\n\nfunction assertLease(\n  expectedDigest: Sha256Digest,\n  expectedExpiresAtMs: number,\n  lease: AgentCandidateExecutionLease,\n): void {\n  const expected = Buffer.from(expectedDigest)\n  const actual = Buffer.from(leaseDigest(lease))\n  if (\n    expected.length !== actual.length ||\n    !timingSafeEqual(expected, actual) ||\n    lease.expiresAtMs !== expectedExpiresAtMs\n  ) {\n    throw new Error('candidate execution lease is invalid')\n  }\n}\n\nfunction claimSlot(claim: Pick<AgentCandidateExecutionClaim, 'executionId' | 'attempt'>): string {\n  return createHash('sha256')\n    .update(JSON.stringify([claim.executionId, claim.attempt]), 'utf8')\n    .digest('hex')\n}\n\nfunction retryRejectionFromMemory(\n  claims: ReadonlyMap<string, StoredClaim>,\n  claim: AgentCandidateExecutionClaim,\n): AgentCandidateRetryRejection | undefined {\n  if (claim.attempt === 1) return undefined\n  const prior = claims.get(\n    claimSlot({ executionId: claim.executionId, attempt: claim.attempt - 1 }),\n  )\n  return retryRejection(claim, prior)\n}\n\nfunction retryRejection(\n  claim: AgentCandidateExecutionClaim,\n  prior:\n    | {\n        claim: AgentCandidateExecutionClaim\n        terminal?: AgentCandidateExecutionTerminalRecord\n      }\n    | undefined,\n): AgentCandidateRetryRejection | undefined {\n  if (!prior) return 'prior-attempt-missing'\n  if (\n    claim.retryPolicy !== 'pre-model-infrastructure-only' ||\n    prior.claim.retryPolicy !== claim.retryPolicy ||\n    prior.claim.maxAttempts !== claim.maxAttempts ||\n    prior.claim.bundleDigest !== claim.bundleDigest ||\n    prior.claim.retryLineageDigest !== claim.retryLineageDigest\n  ) {\n    return 'retry-lineage-mismatch'\n  }\n  if (!prior.terminal) return 'prior-attempt-running'\n  if (prior.terminal.status === 'succeeded') return 'prior-attempt-succeeded'\n  if (prior.terminal.usage.modelCalls !== 0) return 'prior-attempt-spent-model-calls'\n  if (prior.terminal.failureClass !== 'pre-model-infrastructure') {\n    return 'prior-attempt-not-pre-model-infrastructure'\n  }\n  return undefined\n}\n\nfunction rejectedExistingClaim(\n  existing: AgentCandidateExecutionClaim,\n  requested: AgentCandidateExecutionClaim,\n): AgentCandidateExecutionClaimResult {\n  return Object.freeze({\n    acquired: false,\n    reason: 'already-claimed',\n    claim: existing,\n    exactReplay: canonicalCandidateDigest(existing) === canonicalCandidateDigest(requested),\n  })\n}\n\nfunction rejectedRetry(\n  claim: AgentCandidateExecutionClaim,\n  detail: AgentCandidateRetryRejection,\n): AgentCandidateExecutionClaimResult {\n  return Object.freeze({ acquired: false, reason: 'retry-not-eligible', claim, detail })\n}\n\nasync function readClaim(path: string): Promise<StoredClaim> {\n  const parsed = await readJsonObject(path, 'claim')\n  const record = parsed as Partial<PersistedAgentCandidateExecutionClaim>\n  assertExactKeys(\n    parsed,\n    [\n      'executionId',\n      'attempt',\n      'maxAttempts',\n      'retryPolicy',\n      'bundleDigest',\n      'executionPlanDigest',\n      'preparationEvidence',\n      'retryLineageDigest',\n      'leaseExpiresAtMs',\n      'resultTimeoutMs',\n      'cleanup',\n      'phase',\n      'leaseDigest',\n    ],\n    `candidate execution claim at ${path}`,\n  )\n  const claim = sealClaim({\n    executionId: requireString(record.executionId, path, 'executionId'),\n    attempt: requireNumber(record.attempt, path, 'attempt'),\n    maxAttempts: requireNumber(record.maxAttempts, path, 'maxAttempts'),\n    retryPolicy: requireRetryPolicy(record.retryPolicy, path),\n    bundleDigest: requireString(record.bundleDigest, path, 'bundleDigest') as Sha256Digest,\n    executionPlanDigest: requireString(\n      record.executionPlanDigest,\n      path,\n      'executionPlanDigest',\n    ) as Sha256Digest,\n    preparationEvidence: requireObject(\n      record.preparationEvidence,\n      path,\n      'preparationEvidence',\n    ) as unknown as AgentCandidateExecutionClaim['preparationEvidence'],\n    retryLineageDigest: requireString(\n      record.retryLineageDigest,\n      path,\n      'retryLineageDigest',\n    ) as Sha256Digest,\n    leaseExpiresAtMs: requireNumber(record.leaseExpiresAtMs, path, 'leaseExpiresAtMs'),\n    resultTimeoutMs: requireNumber(record.resultTimeoutMs, path, 'resultTimeoutMs'),\n    cleanup: requireObject(\n      record.cleanup,\n      path,\n      'cleanup',\n    ) as unknown as AgentCandidateExecutionCleanupHandles,\n  })\n  const persistedLeaseDigest = requireString(\n    record.leaseDigest,\n    path,\n    'leaseDigest',\n  ) as Sha256Digest\n  assertSha256Digest(persistedLeaseDigest, 'leaseDigest')\n  if (record.phase !== 'claimed') {\n    throw new Error(`candidate execution claim at ${path} has invalid initial phase`)\n  }\n  return { claim, leaseDigest: persistedLeaseDigest, phase: 'claimed' }\n}\n\nasync function readClaimIfPresent(path: string): Promise<StoredClaim | undefined> {\n  try {\n    return await readClaim(path)\n  } catch (error) {\n    if (isMissingError(error)) return undefined\n    throw error\n  }\n}\n\nasync function readTerminal(path: string): Promise<AgentCandidateExecutionTerminalRecord> {\n  const parsed = await readJsonObject(path, 'terminal record')\n  const record = parsed as Partial<PersistedAgentCandidateExecutionTerminal>\n  assertExactKeys(parsed, ['terminal'], `candidate execution terminal record at ${path}`)\n  return sealTerminalRecordValue(\n    requireObject(record.terminal, path, 'terminal'),\n    `candidate execution terminal record at ${path}`,\n  )\n}\n\nasync function readTerminalIfPresent(\n  path: string,\n): Promise<AgentCandidateExecutionTerminalRecord | undefined> {\n  try {\n    return await readTerminal(path)\n  } catch (error) {\n    if (isMissingError(error)) return undefined\n    throw error\n  }\n}\n\ntype ReadCandidateExecutionTransition =\n  | { kind: 'phase' }\n  | { kind: 'pending'; terminal: AgentCandidateExecutionTerminalRecord }\n\nasync function readTransitionIfPresent(\n  path: string,\n  claim: AgentCandidateExecutionClaim,\n): Promise<ReadCandidateExecutionTransition | undefined> {\n  let parsed: Record<string, unknown>\n  try {\n    parsed = await readJsonObject(path, 'transition record')\n  } catch (error) {\n    if (isMissingError(error)) return undefined\n    throw error\n  }\n  if (parsed.kind === 'candidate-execution-phase') {\n    const record = parsed as unknown as PersistedAgentCandidateExecutionPhase\n    assertExactKeys(\n      parsed,\n      ['kind', 'executionId', 'attempt', 'executionPlanDigest', 'phase'],\n      `candidate execution phase record at ${path}`,\n    )\n    if (\n      record.executionId !== claim.executionId ||\n      record.attempt !== claim.attempt ||\n      record.executionPlanDigest !== claim.executionPlanDigest ||\n      record.phase !== 'candidate-may-run'\n    ) {\n      throw new Error(`candidate execution phase record at ${path} does not match its claim`)\n    }\n    return { kind: 'phase' }\n  }\n  if (parsed.kind === 'candidate-execution-pending-terminal') {\n    const record = parsed as unknown as PersistedAgentCandidateExecutionPending\n    assertExactKeys(parsed, ['kind', 'terminal'], `candidate execution pending record at ${path}`)\n    const terminal = sealTerminalRecordValue(\n      requireObject(record.terminal, path, 'terminal'),\n      `candidate execution pending record at ${path}`,\n    )\n    assertTerminalMatchesClaim(terminal, claim, path)\n    return { kind: 'pending', terminal }\n  }\n  throw new Error(`candidate execution transition record at ${path} has invalid kind`)\n}\n\nasync function readJsonObject(path: string, kind: string): Promise<Record<string, unknown>> {\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(await readFile(path, 'utf8'))\n  } catch (error) {\n    if (isMissingError(error)) throw error\n    throw new Error(`candidate execution ${kind} at ${path} is unreadable`, { cause: error })\n  }\n  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    throw new Error(`candidate execution ${kind} at ${path} is not an object`)\n  }\n  return parsed as Record<string, unknown>\n}\n\nfunction assertSameSlot(\n  existing: Pick<AgentCandidateExecutionClaim, 'executionId' | 'attempt'>,\n  requested: Pick<AgentCandidateExecutionClaim, 'executionId' | 'attempt'>,\n  path: string,\n): void {\n  if (existing.executionId !== requested.executionId || existing.attempt !== requested.attempt) {\n    throw new Error(`candidate execution record at ${path} does not match its claim slot`)\n  }\n}\n\nfunction assertSha256Digest(value: string, field: string): void {\n  if (!SHA256_PATTERN.test(value)) {\n    throw new Error(`candidate execution claim ${field} must be a lowercase sha256 digest`)\n  }\n}\n\nfunction requireString(value: unknown, path: string, field: string): string {\n  if (typeof value !== 'string') {\n    throw new Error(`candidate execution record at ${path} has invalid ${field}`)\n  }\n  return value\n}\n\nfunction requireNumber(value: unknown, path: string, field: string): number {\n  if (typeof value !== 'number') {\n    throw new Error(`candidate execution record at ${path} has invalid ${field}`)\n  }\n  return value\n}\n\nfunction requireObject(value: unknown, path: string, field: string): Record<string, unknown> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`candidate execution record at ${path} has invalid ${field}`)\n  }\n  return value as Record<string, unknown>\n}\n\nfunction requireRetryPolicy(\n  value: unknown,\n  path: string,\n): AgentCandidateAttemptPolicy['retryPolicy'] {\n  if (value !== 'none' && value !== 'pre-model-infrastructure-only') {\n    throw new Error(`candidate execution record at ${path} has invalid retryPolicy`)\n  }\n  return value\n}\n\nfunction assertExecutionId(value: unknown): asserts value is string {\n  if (typeof value !== 'string' || !/^[A-Za-z0-9._:-]{1,200}$/.test(value)) {\n    throw new Error('candidate execution claim executionId is invalid')\n  }\n}\n\nfunction assertBoundedIdentifier(\n  value: unknown,\n  label: string,\n  maxLength: number,\n): asserts value is string {\n  if (\n    typeof value !== 'string' ||\n    value.length === 0 ||\n    value.length > maxLength ||\n    hasControlCharacter(value)\n  ) {\n    throw new Error(`candidate execution ${label} is invalid`)\n  }\n}\n\nfunction hasControlCharacter(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code < 0x20 || code === 0x7f) return true\n  }\n  return false\n}\n\nfunction assertPositiveTimestamp(value: unknown, label: string): asserts value is number {\n  if (!Number.isSafeInteger(value) || (value as number) <= 0) {\n    throw new Error(`candidate execution ${label} must be a positive safe timestamp`)\n  }\n}\n\nfunction assertClock(value: number): void {\n  if (!Number.isSafeInteger(value) || value < 0) {\n    throw new Error('candidate execution claim-store clock returned an invalid timestamp')\n  }\n}\n\nfunction assertUnexpiredLease(expiresAtMs: number, nowMs: number): void {\n  assertClock(nowMs)\n  if (nowMs >= expiresAtMs) throw new Error('candidate execution lease has expired')\n}\n\nfunction assertExpiredLease(expiresAtMs: number, nowMs: number): void {\n  assertClock(nowMs)\n  if (nowMs < expiresAtMs) throw new Error('candidate execution lease has not expired')\n}\n\nfunction sha256(value: string): Sha256Digest {\n  return `sha256:${createHash('sha256').update(value, 'utf8').digest('hex')}`\n}\n\nfunction isMissingError(error: unknown): boolean {\n  return isNodeError(error, 'ENOENT')\n}\n\nfunction isNodeError(error: unknown, code: string): boolean {\n  return (\n    error !== null &&\n    typeof error === 'object' &&\n    'code' in error &&\n    (error as { code?: unknown }).code === code\n  )\n}\n\nexport const candidateClaimFileInternals = Object.freeze({\n  assertExpiredLease,\n  assertLease,\n  assertSameSlot,\n  assertUnexpiredLease,\n  attemptRecord,\n  claimSlot,\n  leaseDigest,\n  newLease,\n  readClaim,\n  readClaimIfPresent,\n  readTerminal,\n  readTerminalIfPresent,\n  readTransitionIfPresent,\n  rejectedExistingClaim,\n  rejectedRetry,\n  retryRejection,\n  sealAttemptRef,\n  sealClaim,\n  sealLease,\n})\n\nexport { candidateExecutionClaim } from './claim-plan'\n","import { isLlmSpan, type LlmSpan, type TraceStore } from '@tangle-network/agent-eval'\nimport type {\n  AgentCandidateFixedSpend,\n  AgentCandidateModelSettlementCall,\n} from '@tangle-network/agent-interface'\nimport { assertExactObjectKeys } from './exact-object'\nimport type { AgentCandidateProtectedModelSettlement } from './types'\n\nconst USD_NANOS = 1_000_000_000\n\nexport interface SealedAgentCandidateModelSettlement {\n  readonly value: AgentCandidateProtectedModelSettlement\n  /** `inputTokens` is the gateway's accounted input total. */\n  readonly usage: AgentCandidateFixedSpend\n}\n\n/** Validate and detach the evaluator gateway's terminal, revoked call ledger. */\nexport function sealAgentCandidateModelSettlement(\n  settlement: AgentCandidateProtectedModelSettlement,\n  expected: { preparationId: string; grantDigest: string; model: string },\n): SealedAgentCandidateModelSettlement {\n  assertExactObjectKeys(\n    settlement,\n    ['preparationId', 'grantDigest', 'closed', 'usageWithinLimits', 'calls'],\n    'model settlement',\n  )\n  if (settlement.closed !== true) throw new Error('protected model grant is not closed')\n  if (settlement.usageWithinLimits !== true) {\n    throw new Error('protected model settlement reports usage outside frozen limits')\n  }\n  if (settlement.grantDigest !== expected.grantDigest) {\n    throw new Error('protected model settlement grant digest does not match the reservation')\n  }\n  if (settlement.preparationId !== expected.preparationId) {\n    throw new Error('protected model settlement preparation does not match the reservation')\n  }\n  if (!Array.isArray(settlement.calls)) {\n    throw new Error('protected model settlement calls must be an array')\n  }\n\n  const callIds = new Set<string>()\n  const spanIds = new Set<string>()\n  let accountedInputTokens = 0\n  let outputTokens = 0\n  let cachedInputTokens = 0\n  let reasoningTokens = 0\n  let costUsdNanos = 0\n  let costProvenance: AgentCandidateFixedSpend['costProvenance'] = 'observed'\n  const calls = settlement.calls.map((source, index) => {\n    assertExactObjectKeys(\n      source,\n      [\n        'callId',\n        'generationId',\n        'traceSpanId',\n        'status',\n        'model',\n        'startedAtMs',\n        'endedAtMs',\n        'inputTokens',\n        'accountedInputTokens',\n        'outputTokens',\n        'cachedInputTokens',\n        'reasoningTokens',\n        'costUsdNanos',\n        'costProvenance',\n      ],\n      `model settlement call ${index}`,\n    )\n    assertIdentifier(source.callId, `model settlement call ${index} callId`)\n    assertIdentifier(source.generationId, `model settlement call ${index} generationId`)\n    assertIdentifier(source.traceSpanId, `model settlement call ${index} traceSpanId`)\n    if (source.traceSpanId !== source.generationId) {\n      throw new Error(`model settlement call ${index} traceSpanId is not its router generationId`)\n    }\n    if (source.status !== 'succeeded' && source.status !== 'failed') {\n      throw new Error(`model settlement call ${index} has an invalid status`)\n    }\n    if (callIds.has(source.callId))\n      throw new Error('protected model settlement has duplicate call ids')\n    if (spanIds.has(source.traceSpanId)) {\n      throw new Error('protected model settlement has duplicate trace span ids')\n    }\n    callIds.add(source.callId)\n    spanIds.add(source.traceSpanId)\n    if (source.model !== expected.model) {\n      throw new Error(`protected model settlement call ${index} has an unexpected model`)\n    }\n    assertTimestamp(source.startedAtMs, `model settlement call ${index} startedAtMs`)\n    assertTimestamp(source.endedAtMs, `model settlement call ${index} endedAtMs`)\n    if (source.endedAtMs < source.startedAtMs) {\n      throw new Error(`model settlement call ${index} ended before it started`)\n    }\n    assertCount(source.inputTokens, `model settlement call ${index} inputTokens`)\n    assertCount(source.accountedInputTokens, `model settlement call ${index} accountedInputTokens`)\n    if (source.accountedInputTokens < source.inputTokens) {\n      throw new Error(\n        `model settlement call ${index} accountedInputTokens cannot be less than inputTokens`,\n      )\n    }\n    assertCount(source.outputTokens, `model settlement call ${index} outputTokens`)\n    assertCount(source.cachedInputTokens, `model settlement call ${index} cachedInputTokens`)\n    cachedInputTokens = safeAdd(\n      cachedInputTokens,\n      source.cachedInputTokens,\n      'cached input token total',\n    )\n    assertCount(source.reasoningTokens, `model settlement call ${index} reasoningTokens`)\n    reasoningTokens = safeAdd(reasoningTokens, source.reasoningTokens, 'reasoning token total')\n    assertCount(source.costUsdNanos, `model settlement call ${index} costUsdNanos`)\n    if (source.costProvenance !== 'observed' && source.costProvenance !== 'estimated') {\n      throw new Error(`model settlement call ${index} has an invalid cost provenance`)\n    }\n    if (source.costProvenance === 'estimated') costProvenance = 'estimated'\n    accountedInputTokens = safeAdd(\n      accountedInputTokens,\n      source.accountedInputTokens,\n      'accounted input token total',\n    )\n    outputTokens = safeAdd(outputTokens, source.outputTokens, 'output token total')\n    costUsdNanos = safeAdd(costUsdNanos, source.costUsdNanos, 'cost total')\n    return Object.freeze({ ...source })\n  })\n\n  const usage = Object.freeze({\n    costUsdNanos,\n    inputTokens: accountedInputTokens,\n    outputTokens,\n    cachedInputTokens,\n    reasoningTokens,\n    modelCalls: calls.length,\n    costProvenance,\n  })\n  return Object.freeze({\n    value: Object.freeze({\n      preparationId: settlement.preparationId,\n      grantDigest: settlement.grantDigest,\n      closed: true as const,\n      usageWithinLimits: true as const,\n      calls: Object.freeze(calls),\n    }),\n    usage,\n  })\n}\n\n/**\n * Append the only accepted LLM spans from the router's closed ledger.\n * Candidate and executor code may write tool/process spans, but never model usage.\n */\nexport async function appendAuthoritativeModelSettlementSpans(\n  traceStore: TraceStore,\n  runId: string,\n  settlement: SealedAgentCandidateModelSettlement,\n): Promise<void> {\n  const run = await traceStore.getRun(runId)\n  if (!run) throw new Error(`protected trace run is missing before model settlement: ${runId}`)\n  if (run.status === 'running' || run.endedAt === undefined) {\n    throw new Error('protected trace run must be terminal before model spans are appended')\n  }\n  const existing = await traceStore.spans({ runId })\n  if (existing.some(isLlmSpan)) {\n    throw new Error(\n      'protected trace contains a model span not authored from the closed router ledger',\n    )\n  }\n  const occupiedIds = new Set(existing.map((span) => span.spanId))\n  for (const call of settlement.value.calls) {\n    if (occupiedIds.has(call.traceSpanId)) {\n      throw new Error(\n        `protected trace span identity collides with router generation ${call.generationId}`,\n      )\n    }\n    await traceStore.appendSpan({\n      runId,\n      spanId: call.traceSpanId,\n      kind: 'llm',\n      name: 'protected model call',\n      model: call.model,\n      messages: [],\n      startedAt: call.startedAtMs,\n      endedAt: call.endedAtMs,\n      status: call.status === 'succeeded' ? 'ok' : 'error',\n      inputTokens: call.inputTokens,\n      outputTokens: call.outputTokens,\n      cachedTokens: call.cachedInputTokens,\n      reasoningTokens: call.reasoningTokens,\n      costUsd: call.costUsdNanos / USD_NANOS,\n      attributes: {\n        'tangle.protected_model.source': 'router-settlement',\n        'tangle.router.call_id': call.callId,\n        'tangle.router.generation_id': call.generationId,\n      },\n    })\n  }\n}\n\n/** Match every protected trace span one-for-one against gateway call evidence. */\nexport function assertTraceMatchesModelSettlement(\n  spans: readonly LlmSpan[],\n  settlement: SealedAgentCandidateModelSettlement,\n): void {\n  if (spans.length !== settlement.value.calls.length) {\n    throw new Error(\n      `protected trace model calls ${spans.length} do not match model ledger ${settlement.value.calls.length}`,\n    )\n  }\n  const byId = new Map(spans.map((span) => [span.spanId, span]))\n  if (byId.size !== spans.length) throw new Error('protected trace has duplicate model span ids')\n  for (const call of settlement.value.calls) {\n    const span = byId.get(call.traceSpanId)\n    if (!span) {\n      throw new Error(`protected trace is missing model ledger span ${call.traceSpanId}`)\n    }\n    assertTraceCall(span, call)\n  }\n}\n\nexport function usdToNanos(value: number, label: string): number {\n  if (!Number.isFinite(value) || value < 0) throw new Error(`${label} must be nonnegative`)\n  const nanos = Math.round(value * USD_NANOS)\n  if (!Number.isSafeInteger(nanos)) throw new Error(`${label} exceeds fixed-point range`)\n  return nanos\n}\n\nfunction assertTraceCall(span: LlmSpan, call: AgentCandidateModelSettlementCall): void {\n  if (span.model !== call.model) {\n    throw new Error(`protected trace span ${span.spanId} model does not match model ledger`)\n  }\n  if (\n    span.startedAt !== call.startedAtMs ||\n    span.endedAt !== call.endedAtMs ||\n    span.status !== (call.status === 'succeeded' ? 'ok' : 'error')\n  ) {\n    throw new Error(\n      `protected trace span ${span.spanId} timing or status does not match model ledger`,\n    )\n  }\n  if (\n    span.attributes?.['tangle.protected_model.source'] !== 'router-settlement' ||\n    span.attributes?.['tangle.router.call_id'] !== call.callId ||\n    span.attributes?.['tangle.router.generation_id'] !== call.generationId\n  ) {\n    throw new Error(`protected trace span ${span.spanId} lacks router settlement provenance`)\n  }\n  for (const [name, traced, settled] of [\n    ['inputTokens', span.inputTokens, call.inputTokens],\n    ['outputTokens', span.outputTokens, call.outputTokens],\n    ['cachedInputTokens', span.cachedTokens ?? 0, call.cachedInputTokens],\n    ['reasoningTokens', span.reasoningTokens ?? 0, call.reasoningTokens],\n  ] as const) {\n    if (traced === undefined || traced !== settled) {\n      throw new Error(\n        `protected trace span ${span.spanId} ${name} ${traced} does not match model ledger ${settled}`,\n      )\n    }\n  }\n  if (span.costUsd === undefined) {\n    throw new Error(`protected trace span ${span.spanId} is missing costUsd`)\n  }\n  const tracedCost = usdToNanos(span.costUsd, `protected trace span ${span.spanId} costUsd`)\n  if (tracedCost !== call.costUsdNanos) {\n    throw new Error(\n      `protected trace span ${span.spanId} costUsdNanos ${tracedCost} does not match model ledger ${call.costUsdNanos}`,\n    )\n  }\n}\n\nfunction assertIdentifier(value: unknown, label: string): asserts value is string {\n  if (typeof value !== 'string' || value.length === 0 || value.length > 256) {\n    throw new Error(`${label} must be a non-empty bounded string`)\n  }\n}\n\nfunction assertCount(value: unknown, label: string): asserts value is number {\n  if (!Number.isSafeInteger(value) || (value as number) < 0) {\n    throw new Error(`${label} must be a nonnegative safe integer`)\n  }\n}\n\nfunction assertTimestamp(value: unknown, label: string): asserts value is number {\n  if (!Number.isSafeInteger(value) || (value as number) <= 0) {\n    throw new Error(`${label} must be a positive safe integer`)\n  }\n}\n\nfunction safeAdd(left: number, right: number, label: string): number {\n  const total = left + right\n  if (!Number.isSafeInteger(total)) throw new Error(`${label} exceeds safe integer range`)\n  return total\n}\n","import type {\n  AgentCandidateBundle,\n  AgentCandidateCapturedArtifact,\n  AgentCandidateResourceRef,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\nimport { agentCandidateBundleSchema } from '@tangle-network/agent-interface'\n\nimport {\n  artifactCacheKey,\n  readVerifiedArtifact,\n  verifyBytes,\n  verifyWorkspaceSnapshotArtifacts,\n} from './artifacts'\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  deepFreezeCandidate,\n  omitTopLevelDigest,\n} from './digest'\nimport { readCandidateGitHubResource, verifyCandidateCode } from './git-materialize'\nimport { assertCandidateProfileExecutionSupport } from './profile'\nimport {\n  type AgentCandidateVerificationPorts,\n  type VerifiedAgentCandidate,\n  verifiedCandidateBrand,\n} from './types'\n\ninterface VerifiedCandidateState {\n  ports: AgentCandidateVerificationPorts\n  artifactBytes: Map<string, Uint8Array>\n  resourceBytes: Map<string, Uint8Array>\n}\n\nconst verifiedCandidateState = new WeakMap<VerifiedAgentCandidate, VerifiedCandidateState>()\n\n/** Surfaces admitted by Runtime's verifier before an environment adapter is selected. */\nexport const AGENT_CANDIDATE_EXECUTION_SUPPORT = Object.freeze({\n  outcomes: Object.freeze(['workspace', 'output'] as const),\n  code: Object.freeze(['disabled', 'no-op', 'git-patch'] as const),\n  memory: Object.freeze(['disabled', 'isolated'] as const),\n  knowledge: true,\n  profile: Object.freeze({\n    mcpTransports: Object.freeze(['stdio'] as const),\n    remoteMcp: false,\n    tools: false,\n    permissions: false,\n    modes: false,\n    confidential: false,\n  }),\n})\n\n/** Verifies every digest, resource, workspace, and Git object in a candidate bundle. */\nexport async function verifyAgentCandidateBundle(\n  input: unknown,\n  ports: AgentCandidateVerificationPorts,\n): Promise<VerifiedAgentCandidate> {\n  const parsed = agentCandidateBundleSchema.parse(input)\n  const withoutDigest = omitTopLevelDigest(parsed)\n  const actualDigest = canonicalCandidateDigest(withoutDigest)\n  if (actualDigest !== parsed.digest) {\n    throw new Error(`candidate bundle digest ${parsed.digest} does not match ${actualDigest}`)\n  }\n  const canonicalBytes = canonicalCandidateBytes(withoutDigest)\n  verifyBytes(canonicalBytes, parsed.digest, canonicalBytes.byteLength, 'candidate bundle')\n  assertCandidateProfileExecutionSupport(parsed.profile)\n\n  const artifactBytes = new Map<string, Uint8Array>()\n  const readArtifact = async (artifact: AgentCandidateCapturedArtifact): Promise<Uint8Array> => {\n    const key = artifactCacheKey(artifact)\n    const existing = artifactBytes.get(key)\n    if (existing) return Uint8Array.from(existing)\n    const bytes = await readVerifiedArtifact(artifact, ports.artifacts)\n    artifactBytes.set(key, Uint8Array.from(bytes))\n    return bytes\n  }\n\n  let patchBytes: Uint8Array | undefined\n  if (parsed.code.kind === 'git-patch') {\n    patchBytes = await readArtifact(parsed.code.patch.artifact)\n  }\n  const materializedTree = await verifyCandidateCode(parsed.code, ports.repositories, patchBytes)\n\n  const resourceBytes = new Map<string, Uint8Array>()\n  for (const resource of candidateResources(parsed)) {\n    const bytes =\n      resource.kind === 'inline'\n        ? Buffer.from(resource.content, 'utf8')\n        : await readCandidateGitHubResource(resource, ports.repositories)\n    verifyBytes(\n      bytes,\n      resource.sha256,\n      resource.byteLength,\n      `candidate resource ${resource.name ?? (resource.kind === 'github' ? resource.path : '<unnamed>')}`,\n    )\n    resourceBytes.set(resourceKey(resource), Uint8Array.from(bytes))\n    resourceBytes.set(resource.sha256, Uint8Array.from(bytes))\n  }\n\n  if (parsed.execution.workspace) {\n    const workspace = await verifyWorkspaceSnapshotArtifacts(\n      parsed.execution.workspace,\n      ports.artifacts,\n    )\n    artifactBytes.set(artifactCacheKey(parsed.execution.workspace.manifest), workspace.manifest)\n    artifactBytes.set(artifactCacheKey(parsed.execution.workspace.archive), workspace.archive)\n  }\n  if (parsed.knowledge) {\n    const knowledge = await verifyWorkspaceSnapshotArtifacts(\n      parsed.knowledge.snapshot,\n      ports.artifacts,\n    )\n    artifactBytes.set(artifactCacheKey(parsed.knowledge.snapshot.manifest), knowledge.manifest)\n    artifactBytes.set(artifactCacheKey(parsed.knowledge.snapshot.archive), knowledge.archive)\n    if (parsed.knowledge.retrievalConfig) await readArtifact(parsed.knowledge.retrievalConfig)\n    await readArtifact(parsed.knowledge.evaluation)\n  }\n  if (parsed.memory.mode === 'isolated' && parsed.memory.seed)\n    await readArtifact(parsed.memory.seed)\n\n  deepFreezeCandidate(parsed)\n  const verified = Object.freeze({\n    bundle: parsed,\n    ...(materializedTree === undefined ? {} : { materializedTree }),\n    [verifiedCandidateBrand]: true as const,\n  })\n  verifiedCandidateState.set(verified, { ports, artifactBytes, resourceBytes })\n  return verified\n}\n\nexport function getVerifiedCandidateState(\n  candidate: VerifiedAgentCandidate,\n): VerifiedCandidateState {\n  const state = verifiedCandidateState.get(candidate)\n  if (!state || candidate[verifiedCandidateBrand] !== true) {\n    throw new Error('candidate must come from verifyAgentCandidateBundle')\n  }\n  return state\n}\n\nexport async function verifiedArtifactBytes(\n  candidate: VerifiedAgentCandidate,\n  artifact: AgentCandidateCapturedArtifact,\n): Promise<Uint8Array> {\n  const state = getVerifiedCandidateState(candidate)\n  const key = artifactCacheKey(artifact)\n  const existing = state.artifactBytes.get(key)\n  if (existing) return Uint8Array.from(existing)\n  const bytes = await readVerifiedArtifact(artifact, state.ports.artifacts)\n  state.artifactBytes.set(key, Uint8Array.from(bytes))\n  return bytes\n}\n\nexport function verifiedResourceBytes(\n  candidate: VerifiedAgentCandidate,\n  resource: AgentCandidateResourceRef,\n): Uint8Array {\n  const bytes = getVerifiedCandidateState(candidate).resourceBytes.get(resourceKey(resource))\n  if (!bytes) {\n    throw new Error(\n      `candidate resource was not verified: ${resource.name ?? (resource.kind === 'github' ? resource.path : '<unnamed>')}`,\n    )\n  }\n  return Uint8Array.from(bytes)\n}\n\nexport function verifiedResourceTextByDigest(\n  candidate: VerifiedAgentCandidate,\n): ReadonlyMap<Sha256Digest, string> {\n  const output = new Map<Sha256Digest, string>()\n  for (const resource of candidateResources(candidate.bundle)) {\n    const bytes = getVerifiedCandidateState(candidate).resourceBytes.get(resource.sha256)\n    if (!bytes) throw new Error(`candidate resource digest was not verified: ${resource.sha256}`)\n    output.set(resource.sha256, new TextDecoder('utf-8', { fatal: true }).decode(bytes))\n  }\n  return output\n}\n\nfunction candidateResources(bundle: AgentCandidateBundle): AgentCandidateResourceRef[] {\n  const resources = bundle.profile.resources\n  if (!resources) return []\n  const output: AgentCandidateResourceRef[] = []\n  for (const mount of resources.files ?? []) output.push(mount.resource)\n  output.push(...(resources.tools ?? []))\n  output.push(...(resources.skills ?? []))\n  output.push(...(resources.agents ?? []))\n  output.push(...(resources.commands ?? []))\n  if (typeof resources.instructions === 'object') output.push(resources.instructions)\n  return output\n}\n\nfunction resourceKey(resource: AgentCandidateResourceRef): string {\n  return canonicalCandidateDigest(resource)\n}\n","import { mkdtemp, rm } from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { join, posix } from 'node:path'\n\nimport type { AgentCandidateRunCell } from '@tangle-network/agent-interface'\nimport { hashKnowledgeBase } from '@tangle-network/agent-knowledge'\n\nimport { readMaterializedWorkspaceFiles } from './artifacts'\nimport type {\n  AgentCandidateExecutionPorts,\n  PreparedAgentCandidateKnowledge,\n  VerifiedAgentCandidate,\n} from './types'\nimport { verifiedArtifactBytes } from './verify'\n\n/** Environment variable containing the materialized candidate knowledge root. */\nexport const CANDIDATE_KNOWLEDGE_ROOT_ENV = 'TANGLE_CANDIDATE_KNOWLEDGE_ROOT'\n/** Environment variable containing the materialized retrieval configuration path. */\nexport const CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV =\n  'TANGLE_CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG'\n\n/** Deterministic, signed locations used by every candidate executor. */\nexport function candidateKnowledgeExecutionPaths(\n  taskRoot: string,\n  hasRetrievalConfig: boolean,\n): { root: string; retrievalConfig?: string } {\n  if (!posix.isAbsolute(taskRoot) || posix.normalize(taskRoot) !== taskRoot) {\n    throw new Error('candidate knowledge requires a normalized absolute task root')\n  }\n  const parent = posix.join(taskRoot, '.tangle')\n  return {\n    root: posix.join(parent, 'knowledge'),\n    ...(hasRetrievalConfig\n      ? { retrievalConfig: posix.join(parent, 'knowledge-retrieval-config.json') }\n      : {}),\n  }\n}\n\n/** Verify and detach the exact file-backed knowledge admitted by the bundle. */\nexport async function prepareAgentCandidateKnowledge(\n  candidate: VerifiedAgentCandidate,\n  ports: AgentCandidateExecutionPorts,\n  arm: AgentCandidateRunCell['arm'],\n): Promise<PreparedAgentCandidateKnowledge | undefined> {\n  const knowledge = candidate.bundle.knowledge\n  if (!knowledge) return undefined\n\n  const archive = await verifiedArtifactBytes(candidate, knowledge.snapshot.archive)\n  const retrievalConfig = knowledge.retrievalConfig\n    ? await verifiedArtifactBytes(candidate, knowledge.retrievalConfig)\n    : undefined\n  const root = await mkdtemp(join(tmpdir(), 'agent-candidate-knowledge-'))\n  try {\n    await ports.workspaces.materialize({\n      role: 'knowledge',\n      snapshot: knowledge.snapshot,\n      archive,\n      destination: root,\n    })\n    const expectedHash =\n      arm === 'baseline' ? knowledge.candidate.baseHash : knowledge.candidate.candidateHash\n    const actualHash = `sha256:${await hashKnowledgeBase(root)}`\n    if (actualHash !== expectedHash) {\n      throw new Error(\n        `materialized ${arm} knowledge does not match its measured content: expected ${expectedHash}, got ${actualHash}`,\n      )\n    }\n    const files = await readMaterializedWorkspaceFiles(root, knowledge.snapshot.material)\n    return Object.freeze({\n      candidate: knowledge.candidate,\n      snapshot: knowledge.snapshot,\n      files: Object.freeze(\n        files.map((file) =>\n          Object.freeze({ path: file.path, mode: file.mode, bytes: Uint8Array.from(file.bytes) }),\n        ),\n      ),\n      ...(retrievalConfig ? { retrievalConfig: Uint8Array.from(retrievalConfig) } : {}),\n    })\n  } finally {\n    await rm(root, { recursive: true, force: true })\n  }\n}\n","import {\n  type AgentCandidateTaskOutcomeSpec,\n  agentCandidateTerminationSchema,\n  agentCandidateWorkspaceManifestMaterialSchema,\n} from '@tangle-network/agent-interface'\nimport { assertExactObjectKeys as assertExactKeys } from './exact-object'\nimport type { AgentCandidateExecutorFinalCapture, AgentCandidateProtectedRunCapture } from './types'\n\nconst sealedFinalCaptureBrand: unique symbol = Symbol('sealedAgentCandidateExecutorFinalCapture')\n\nexport type SealedAgentCandidateExecutorFinalCapture = AgentCandidateExecutorFinalCapture & {\n  readonly [sealedFinalCaptureBrand]: true\n}\n\n/** Validate and detach the only candidate-authored fields accepted from execution. */\nexport function sealAgentCandidateProtectedRunCapture(\n  value: unknown,\n): AgentCandidateProtectedRunCapture {\n  const capture = requireRecord(value, 'candidate execution capture')\n  assertExactKeys(capture, ['executionId', 'termination'], 'candidate execution capture')\n  if (typeof capture.executionId !== 'string' || capture.executionId.length === 0) {\n    throw new Error('candidate execution capture has an invalid executionId')\n  }\n  return Object.freeze({\n    executionId: capture.executionId,\n    termination: Object.freeze(agentCandidateTerminationSchema.parse(capture.termination)),\n  })\n}\n\n/** Validate, detach, and freeze evaluator-owned evidence captured after process death. */\nexport function sealAgentCandidateExecutorFinalCapture(\n  value: unknown,\n  expectedOutcome: AgentCandidateTaskOutcomeSpec,\n): SealedAgentCandidateExecutorFinalCapture {\n  const capture = requireRecord(value, 'candidate final capture')\n  assertExactKeys(capture, [], 'candidate final capture', [\n    'taskOutcome',\n    'memoryAfter',\n    'evidence',\n  ])\n\n  const taskOutcome = capture.taskOutcome\n    ? sealTaskOutcomeCapture(capture.taskOutcome, expectedOutcome)\n    : undefined\n  const memoryAfter = capture.memoryAfter ? sealMemoryCapture(capture.memoryAfter) : undefined\n  if (capture.evidence !== undefined && !(capture.evidence instanceof Uint8Array)) {\n    throw new Error('candidate executor evidence must be a byte array')\n  }\n  const evidence = capture.evidence ? Uint8Array.from(capture.evidence) : undefined\n  return Object.freeze({\n    ...(taskOutcome ? { taskOutcome } : {}),\n    ...(memoryAfter ? { memoryAfter: Object.freeze(memoryAfter) } : {}),\n    ...(evidence ? { evidence } : {}),\n    [sealedFinalCaptureBrand]: true as const,\n  })\n}\n\n/** Prove exact process death before any final evidence capture. */\nexport function sealAgentCandidateExecutorStopAcknowledgement(value: unknown): void {\n  const capture = requireRecord(value, 'candidate stop acknowledgement')\n  assertExactKeys(capture, ['stopped'], 'candidate stop acknowledgement')\n  if (capture.stopped !== true) {\n    throw new Error('candidate stop acknowledgement does not prove process death')\n  }\n}\n\nfunction sealMemoryCapture(\n  value: unknown,\n): NonNullable<AgentCandidateExecutorFinalCapture['memoryAfter']> {\n  const capture = requireRecord(value, 'candidate memory capture')\n  assertExactKeys(capture, ['afterState', 'archive'], 'candidate memory capture')\n  if (!(capture.archive instanceof Uint8Array)) {\n    throw new Error('candidate memory capture archive must be a byte array')\n  }\n  return Object.freeze({\n    afterState: Object.freeze(\n      agentCandidateWorkspaceManifestMaterialSchema.parse(capture.afterState),\n    ),\n    archive: Uint8Array.from(capture.archive),\n  })\n}\n\nfunction sealTaskOutcomeCapture(\n  value: unknown,\n  expected: AgentCandidateTaskOutcomeSpec,\n): NonNullable<AgentCandidateExecutorFinalCapture['taskOutcome']> {\n  const capture = requireRecord(value, 'candidate task capture')\n  if (capture.kind === 'output') {\n    assertExactKeys(capture, ['kind', 'bytes'], 'candidate task output capture')\n    if (expected.kind !== 'output') {\n      throw new Error('candidate task output capture does not match the signed outcome kind')\n    }\n    if (!(capture.bytes instanceof Uint8Array)) {\n      throw new Error('candidate task output capture must contain a byte array')\n    }\n    if (capture.bytes.byteLength > expected.maxBytes) {\n      throw new Error(`candidate task output exceeds the frozen ${expected.maxBytes}-byte maximum`)\n    }\n    return Object.freeze({ kind: 'output', bytes: Uint8Array.from(capture.bytes) })\n  }\n  assertExactKeys(\n    capture,\n    ['kind', 'resultTree', 'afterState', 'archive', 'gitDiff'],\n    'candidate task capture',\n  )\n  if (capture.kind !== 'workspace') {\n    throw new Error('candidate task capture has an invalid outcome kind')\n  }\n  if (expected.kind !== 'workspace') {\n    throw new Error('candidate workspace capture does not match the signed outcome kind')\n  }\n  if (\n    typeof capture.resultTree !== 'string' ||\n    !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(capture.resultTree)\n  ) {\n    throw new Error('candidate task capture resultTree is not a Git object id')\n  }\n  if (!(capture.archive instanceof Uint8Array) || !(capture.gitDiff instanceof Uint8Array)) {\n    throw new Error('candidate task capture archive and gitDiff must be byte arrays')\n  }\n  const afterState = agentCandidateWorkspaceManifestMaterialSchema.parse(capture.afterState)\n  return Object.freeze({\n    kind: 'workspace',\n    resultTree: capture.resultTree,\n    afterState: Object.freeze(afterState),\n    archive: Uint8Array.from(capture.archive),\n    gitDiff: Uint8Array.from(capture.gitDiff),\n  })\n}\n\nfunction requireRecord(value: unknown, label: string): Record<string, unknown> {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`${label} must be an object`)\n  }\n  return value as Record<string, unknown>\n}\n","import {\n  type AgentCandidateArtifactRef,\n  agentCandidateArtifactRefSchema,\n} from '@tangle-network/agent-interface'\n\nimport { verifyBytes } from './artifacts'\nimport { immutableCandidateValue, sha256Bytes } from './digest'\nimport type { AgentCandidateOutputArtifactPort, AgentCandidateOutputPurpose } from './types'\n\n/** Persist evaluator evidence, read it back, and bind the returned locator to the exact bytes. */\nexport async function persistCandidateOutputArtifact(\n  port: AgentCandidateOutputArtifactPort,\n  input: {\n    executionId: string\n    purpose: AgentCandidateOutputPurpose\n    bytes: Uint8Array\n    signal?: AbortSignal\n  },\n): Promise<AgentCandidateArtifactRef> {\n  input.signal?.throwIfAborted()\n  const bytes = Uint8Array.from(input.bytes)\n  const expectedDigest = sha256Bytes(bytes)\n  const ref = agentCandidateArtifactRefSchema.parse(\n    await port.put({\n      executionId: input.executionId,\n      purpose: input.purpose,\n      bytes: Uint8Array.from(bytes),\n      ...(input.signal ? { signal: input.signal } : {}),\n    }),\n  )\n  input.signal?.throwIfAborted()\n  if (ref.sha256 !== expectedDigest || ref.byteLength !== bytes.byteLength) {\n    throw new Error('candidate output locator does not identify the submitted bytes')\n  }\n  const stored = await port.read(ref)\n  input.signal?.throwIfAborted()\n  verifyBytes(stored, expectedDigest, bytes.byteLength, 'persisted candidate output')\n  return immutableCandidateValue(ref)\n}\n","import type { Span, TraceStore } from '@tangle-network/agent-eval'\nimport { isLlmSpan, REDACTION_VERSION } from '@tangle-network/agent-eval'\nimport type {\n  AgentCandidateBenchmarkResultEvidence,\n  AgentCandidateFixedSpend,\n  AgentCandidateMemoryReceipt,\n  AgentCandidateModelSettlementEvidence,\n  AgentCandidateRunReceipt,\n  AgentCandidateTermination,\n} from '@tangle-network/agent-interface'\nimport {\n  agentCandidateRunReceiptSchema,\n  agentCandidateWorkspaceSnapshotEvidenceSchema,\n} from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateBytes, canonicalCandidateDocument, sha256Bytes } from './digest'\nimport type { SealedAgentCandidateExecutorFinalCapture } from './executor-capture'\nimport type { PersistedAgentCandidateExecutorCapture } from './executor-capture-evidence'\nimport {\n  assertTraceMatchesModelSettlement,\n  type SealedAgentCandidateModelSettlement,\n  usdToNanos,\n} from './model-settlement'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport type { PreparedCandidateState } from './prepared-state'\nimport {\n  assertNoProtectedBytes,\n  type ProtectedRedactionReport,\n  type ProtectedTraceIdentity,\n  redactProtectedReason,\n  redactProtectedValue,\n} from './protected-redaction'\nimport {\n  type AgentCandidateOutputArtifactPort,\n  type AgentCandidateProtectedRunCapture,\n  type AgentCandidateRunFinalization,\n  CANDIDATE_TRACE_TAGS,\n  type VerifiedAgentCandidateTaskOutcome,\n} from './types'\n\ninterface CandidateFinalizationEvidence {\n  finalCapture: SealedAgentCandidateExecutorFinalCapture\n  persistedCapture: PersistedAgentCandidateExecutorCapture\n  modelSettlement: AgentCandidateModelSettlementEvidence & {\n    artifact: import('@tangle-network/agent-interface').AgentCandidateArtifactRef\n  }\n  taskOutcome: VerifiedAgentCandidateTaskOutcome\n  benchmarkResult: AgentCandidateBenchmarkResultEvidence & {\n    artifact: import('@tangle-network/agent-interface').AgentCandidateArtifactRef\n  }\n  outputArtifacts: AgentCandidateOutputArtifactPort\n}\n\n/** Builds a candidate run receipt exclusively from protected trace and memory evidence. */\nexport async function finalizeAgentCandidateRun(\n  state: PreparedCandidateState,\n  capture: AgentCandidateProtectedRunCapture,\n  traceStore: TraceStore,\n  traceIdentity: ProtectedTraceIdentity,\n  settlement: SealedAgentCandidateModelSettlement,\n  evidence: CandidateFinalizationEvidence,\n  protectedValues: readonly string[],\n  writeRedactionReport?: ProtectedRedactionReport,\n  signal?: AbortSignal,\n): Promise<AgentCandidateRunFinalization> {\n  let termination: AgentCandidateTermination | undefined\n  try {\n    signal?.throwIfAborted()\n    if (capture.executionId !== state.executionId) {\n      throw new Error('protected capture execution id does not match the prepared execution')\n    }\n    termination = capture.termination\n    if (\n      termination.kind === 'timeout' &&\n      termination.timeoutMs !== state.executionPlan.value.material.limits.timeoutMs\n    ) {\n      throw new Error('timeout termination does not match the frozen execution limit')\n    }\n\n    const run = await traceStore.getRun(traceIdentity.runId)\n    if (!run) throw new Error(`protected trace run is missing: ${traceIdentity.runId}`)\n    if (run.status === 'running' || run.endedAt === undefined) {\n      throw new Error('protected trace run is not terminal')\n    }\n    assertTraceBindings(run.tags, traceIdentity.tags)\n\n    const [spans, events, budget, artifacts] = await Promise.all([\n      traceStore.spans({ runId: run.runId }),\n      traceStore.events({ runId: run.runId }),\n      traceStore.budget(run.runId),\n      traceStore.artifacts(run.runId),\n    ])\n    const orderedSpans = [...spans].sort(\n      (a, b) => a.startedAt - b.startedAt || compareStrings(a.spanId, b.spanId),\n    )\n    const orderedEvents = [...events].sort(\n      (a, b) => a.timestamp - b.timestamp || compareStrings(a.eventId, b.eventId),\n    )\n    const orderedBudget = [...budget].sort(\n      (a, b) => a.timestamp - b.timestamp || compareStrings(a.dimension, b.dimension),\n    )\n    const orderedArtifacts = [...artifacts].sort((a, b) =>\n      compareStrings(a.artifactId, b.artifactId),\n    )\n\n    const modelSpans = orderedSpans.filter(isLlmSpan)\n    assertTraceMatchesModelSettlement(modelSpans, settlement)\n    const steps = enforceLimits(state, run.startedAt, run.endedAt, orderedSpans, settlement)\n    const memory = await memoryReceipt(\n      state,\n      evidence.finalCapture,\n      evidence.persistedCapture.memoryAfter,\n      signal,\n    )\n    const redacted = redactProtectedValue(\n      {\n        run: { ...run, redactionVersion: REDACTION_VERSION },\n        spans: orderedSpans,\n        events: orderedEvents,\n        budget: orderedBudget,\n        artifacts: orderedArtifacts,\n      },\n      protectedValues,\n    )\n    const combinedByRule = { ...(writeRedactionReport?.byRule ?? {}) }\n    for (const [rule, count] of Object.entries(redacted.report.byRule)) {\n      combinedByRule[rule] = (combinedByRule[rule] ?? 0) + count\n    }\n    const traceMaterial = {\n      ...(redacted.value as Record<string, unknown>),\n      evaluatorLimits: { resultTimeoutMs: state.resultTimeoutMs },\n      redaction: {\n        version: REDACTION_VERSION,\n        redactionCount:\n          (writeRedactionReport?.redactionCount ?? 0) + redacted.report.redactionCount,\n        byRule: combinedByRule,\n      },\n    }\n    const traceBytes = canonicalCandidateBytes(traceMaterial)\n    assertNoProtectedBytes(traceBytes, protectedValues)\n    const traceArtifact = await persistCandidateOutputArtifact(evidence.outputArtifacts, {\n      executionId: state.executionId,\n      purpose: 'trace',\n      bytes: traceBytes,\n      signal,\n    })\n    const trace = {\n      artifact: traceArtifact,\n      eventCount:\n        1 +\n        orderedSpans.length +\n        orderedEvents.length +\n        orderedBudget.length +\n        orderedArtifacts.length,\n      modelCallCount: modelSpans.length,\n    }\n    const document = canonicalCandidateDocument<AgentCandidateRunReceipt>({\n      kind: 'agent-candidate-run',\n      digestAlgorithm: 'rfc8785-sha256',\n      bundleDigest: state.bundle.digest,\n      runCellDigest: state.executionPlan.value.material.runCell.digest,\n      materializationReceiptDigest: state.materializationReceipt.digest,\n      executionPlanDigest: state.executionPlan.value.digest,\n      timing: {\n        startedAtMs: run.startedAt,\n        endedAtMs: run.endedAt,\n        durationMs: run.endedAt - run.startedAt,\n      },\n      steps,\n      memory,\n      trace,\n      termination,\n      executorCapture: evidence.persistedCapture.evidence,\n      modelSettlement: evidence.modelSettlement,\n      taskOutcome: evidence.taskOutcome.evidence,\n      benchmarkResult: evidence.benchmarkResult,\n    })\n    agentCandidateRunReceiptSchema.parse(document.value)\n    const runReceipt = await persistCandidateOutputArtifact(evidence.outputArtifacts, {\n      executionId: state.executionId,\n      purpose: 'run-receipt',\n      bytes: document.bytes,\n      signal,\n    })\n    return {\n      succeeded: true,\n      receipt: document,\n      artifacts: {\n        modelSettlement: evidence.modelSettlement.artifact,\n        executorCapture: evidence.persistedCapture.evidence,\n        taskOutcome: evidence.taskOutcome.evidence.artifact,\n        benchmarkResult: evidence.benchmarkResult.artifact,\n        runReceipt,\n      },\n    }\n  } catch (error) {\n    return {\n      ...failedAgentCandidateRun(\n        state,\n        redactProtectedReason(\n          error instanceof Error ? error.message : String(error),\n          protectedValues,\n        ),\n        termination,\n        settlement.usage,\n      ),\n    }\n  }\n}\n\nfunction assertTraceBindings(\n  tags: Record<string, string> | undefined,\n  expected: Readonly<Record<string, string>>,\n): void {\n  for (const name of Object.values(CANDIDATE_TRACE_TAGS)) {\n    if (tags?.[name] !== expected[name]) {\n      throw new Error(`protected trace is not bound to prepared execution tag ${name}`)\n    }\n  }\n}\n\nfunction enforceLimits(\n  state: PreparedCandidateState,\n  startedAt: number,\n  endedAt: number,\n  spans: Span[],\n  settlement: SealedAgentCandidateModelSettlement,\n): number {\n  const limits = state.executionPlan.value.material.limits\n  const usage = settlement.usage\n  // The runtime-owned Date.now deadline decides when the process must stop.\n  // This separately rejects a receipt whose evaluator-owned trace claims a\n  // longer run; neither clock can make an over-limit execution admissible.\n  const wallMs = endedAt - startedAt\n  if (!Number.isFinite(wallMs) || wallMs < 0 || wallMs > limits.timeoutMs) {\n    throw new Error(`protected trace wall time ${wallMs} exceeds ${limits.timeoutMs}`)\n  }\n  const steps = spans.filter((span) => span.kind === 'tool').length\n  const checks: Array<[number, number, string]> = [\n    [steps, limits.maxSteps, 'tool steps'],\n    [usage.modelCalls, limits.maxModelCalls, 'model calls'],\n    [usage.inputTokens, limits.maxInputTokens, 'input tokens'],\n    [usage.outputTokens, limits.maxOutputTokens, 'output tokens'],\n  ]\n  for (const [actual, limit, label] of checks) {\n    if (actual > limit) throw new Error(`protected ${label} ${actual} exceeds ${limit}`)\n  }\n  if (usage.costUsdNanos > usdToNanos(limits.maxCostUsd, 'frozen maxCostUsd')) {\n    throw new Error(\n      `protected cost USD ${usage.costUsdNanos / 1_000_000_000} exceeds ${limits.maxCostUsd}`,\n    )\n  }\n  return steps\n}\n\nasync function memoryReceipt(\n  state: PreparedCandidateState,\n  capture: SealedAgentCandidateExecutorFinalCapture,\n  persisted: PersistedAgentCandidateExecutorCapture['memoryAfter'],\n  signal?: AbortSignal,\n): Promise<AgentCandidateMemoryReceipt> {\n  signal?.throwIfAborted()\n  if (state.memory.mode === 'disabled') {\n    if (capture.memoryAfter !== undefined || persisted !== undefined) {\n      throw new Error('disabled memory cannot return an after-state')\n    }\n    return { mode: 'disabled' }\n  }\n  if (!capture.memoryAfter) throw new Error('isolated memory is missing its protected after-state')\n  if (!persisted) throw new Error('isolated memory is missing persisted capture evidence')\n  const afterState = capture.memoryAfter.afterState\n  const manifestBytes = canonicalCandidateBytes(afterState)\n  const snapshot = agentCandidateWorkspaceSnapshotEvidenceSchema.parse({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: sha256Bytes(manifestBytes),\n    material: afterState,\n    manifest: persisted.manifest,\n    archive: persisted.archive,\n  })\n  return {\n    mode: 'isolated',\n    scope: 'task',\n    effectiveNamespace: state.memory.effectiveNamespace,\n    resetEvidenceDigest: state.memory.reset.evidence.sha256,\n    beforeStateDigest: state.memory.beforeState.digest,\n    afterState: snapshot,\n  }\n}\n\nexport function failedAgentCandidateRun(\n  state: PreparedCandidateState,\n  reason: string,\n  termination?: AgentCandidateTermination,\n  usage: AgentCandidateFixedSpend | null = null,\n): AgentCandidateRunFinalization & { succeeded: false } {\n  return {\n    succeeded: false,\n    reason,\n    partial: {\n      executionId: state.executionId,\n      bundleDigest: state.bundle.digest,\n      executionPlanDigest: state.executionPlan.value.digest,\n      materializationReceiptDigest: state.materializationReceipt.digest,\n      ...(termination ? { termination } : {}),\n    },\n    usage,\n  }\n}\n\nfunction compareStrings(a: string, b: string): number {\n  return a < b ? -1 : a > b ? 1 : 0\n}\n","import type { BenchmarkEvaluation } from '@tangle-network/agent-eval'\nimport type {\n  AgentCandidateBenchmarkGraderIdentity,\n  AgentCandidateFixedSpend,\n  AgentCandidateTermination,\n} from '@tangle-network/agent-interface'\n\nimport { readVerifiedArtifact } from './artifacts'\nimport { canonicalCandidateDigest, immutableCandidateValue, sha256Bytes } from './digest'\nimport type {\n  AgentCandidateBenchmarkGraderPort,\n  AgentCandidateOutputArtifactPort,\n  VerifiedAgentCandidateTaskOutcome,\n} from './types'\n\nexport interface BoundAgentCandidateBenchmarkRun {\n  readonly grader: AgentCandidateBenchmarkGraderIdentity\n  readonly grading: {\n    readonly usage: AgentCandidateFixedSpend\n    readonly timing: {\n      readonly startedAtMs: number\n      readonly endedAtMs: number\n      readonly durationMs: number\n    }\n  }\n  readonly evaluation: BenchmarkEvaluation\n  readonly evidence: Uint8Array\n}\n\n/**\n * Admit verified grader bytes to the evaluator runner and reject any result\n * that is not bound to those bytes, the exact task outcome, and its raw output.\n */\nexport async function runBoundCandidateBenchmarkGrader(input: {\n  executionId: string\n  termination: AgentCandidateTermination\n  outcome: VerifiedAgentCandidateTaskOutcome\n  expectedGrader: AgentCandidateBenchmarkGraderIdentity\n  grader: AgentCandidateBenchmarkGraderPort\n  artifacts: AgentCandidateOutputArtifactPort\n  signal?: AbortSignal\n}): Promise<BoundAgentCandidateBenchmarkRun> {\n  input.signal?.throwIfAborted()\n  const descriptor = snapshotGraderDescriptor(input.grader, input.expectedGrader)\n  const implementationBytes = await readVerifiedArtifact(descriptor.artifact, input.artifacts)\n  if (implementationBytes.byteLength === 0) {\n    throw new Error('candidate benchmark grader implementation cannot be empty')\n  }\n  const expectedImplementationDigest = sha256Bytes(implementationBytes)\n  const termination = immutableCandidateValue(input.termination)\n  const run = input.grader.run\n  const startedAtMs = Date.now()\n  const result = await run(\n    Object.freeze({\n      executionId: input.executionId,\n      termination,\n      outcome: input.outcome,\n      implementation: detachedImplementation(implementationBytes),\n      signal: input.signal ?? new AbortController().signal,\n    }),\n  )\n  const endedAtMs = Math.max(startedAtMs, Date.now())\n  input.signal?.throwIfAborted()\n  assertExactRunnerResult(result)\n\n  const evidence = Uint8Array.from(result.evidence)\n  const outputDigest = sha256Bytes(evidence)\n  if (result.binding.implementationDigest !== expectedImplementationDigest) {\n    throw new Error(\n      'candidate benchmark grader executed implementation digest does not match its verified artifact',\n    )\n  }\n  if (result.binding.taskOutcomeDigest !== input.outcome.evidence.digest) {\n    throw new Error(\n      'candidate benchmark grader task outcome digest does not match verified outcome',\n    )\n  }\n  if (result.binding.outputDigest !== outputDigest) {\n    throw new Error('candidate benchmark grader raw output digest does not match returned evidence')\n  }\n\n  return Object.freeze({\n    grader: descriptor,\n    grading: immutableCandidateValue({\n      usage: emptyFixedSpend(),\n      timing: {\n        startedAtMs,\n        endedAtMs,\n        durationMs: endedAtMs - startedAtMs,\n      },\n    }),\n    evaluation: result.evaluation,\n    evidence,\n  })\n}\n\nfunction snapshotGraderDescriptor(\n  grader: AgentCandidateBenchmarkGraderPort,\n  expected: AgentCandidateBenchmarkGraderIdentity,\n): BoundAgentCandidateBenchmarkRun['grader'] {\n  if (!grader.name || !grader.version) {\n    throw new Error('candidate benchmark grader name and version must be non-empty')\n  }\n  const actual = {\n    name: grader.name,\n    version: grader.version,\n    format: 'tangle-grader' as const,\n    artifact: grader.artifact,\n  }\n  if (canonicalCandidateDigest(actual) !== canonicalCandidateDigest(expected)) {\n    throw new Error('candidate benchmark grader does not match the signed task grader')\n  }\n  return immutableCandidateValue(expected)\n}\n\nfunction emptyFixedSpend(): AgentCandidateFixedSpend {\n  return {\n    inputTokens: 0,\n    outputTokens: 0,\n    cachedInputTokens: 0,\n    reasoningTokens: 0,\n    modelCalls: 0,\n    costUsdNanos: 0,\n    costProvenance: 'observed',\n  }\n}\n\nfunction detachedImplementation(bytes: Uint8Array): {\n  readonly byteLength: number\n  readonly bytes: Uint8Array\n} {\n  const stored = Uint8Array.from(bytes)\n  return Object.freeze({\n    byteLength: stored.byteLength,\n    get bytes(): Uint8Array {\n      return Uint8Array.from(stored)\n    },\n  })\n}\n\nfunction assertExactRunnerResult(\n  value: unknown,\n): asserts value is Awaited<ReturnType<AgentCandidateBenchmarkGraderPort['run']>> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error('candidate benchmark grader result must be an object')\n  }\n  const result = value as Record<string, unknown>\n  const keys = Object.keys(result).sort()\n  if (\n    keys.length !== 3 ||\n    keys[0] !== 'binding' ||\n    keys[1] !== 'evaluation' ||\n    keys[2] !== 'evidence'\n  ) {\n    throw new Error('candidate benchmark grader returned unknown or missing fields')\n  }\n  if (!(result.evidence instanceof Uint8Array)) {\n    throw new Error('candidate benchmark grader evidence must be bytes')\n  }\n  if (\n    result.binding === null ||\n    typeof result.binding !== 'object' ||\n    Array.isArray(result.binding)\n  ) {\n    throw new Error('candidate benchmark grader binding must be an object')\n  }\n  const bindingKeys = Object.keys(result.binding).sort()\n  if (\n    bindingKeys.length !== 3 ||\n    bindingKeys[0] !== 'implementationDigest' ||\n    bindingKeys[1] !== 'outputDigest' ||\n    bindingKeys[2] !== 'taskOutcomeDigest'\n  ) {\n    throw new Error('candidate benchmark grader binding returned unknown or missing fields')\n  }\n}\n","import type {\n  AgentCandidateArtifactRef,\n  AgentCandidateTaskOutcomeSpec,\n  AgentCandidateTaskOutputSpec,\n  AgentCandidateWorkspaceManifestMaterial,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateBytes } from './digest'\nimport type { SealedAgentCandidateExecutorFinalCapture } from './executor-capture'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport type { AgentCandidateOutputArtifactPort } from './types'\n\nexport type PersistedAgentCandidateTaskCapture =\n  | {\n      readonly kind: 'workspace'\n      readonly resultTree: string\n      readonly afterState: AgentCandidateWorkspaceManifestMaterial\n      readonly manifest: AgentCandidateArtifactRef\n      readonly archive: AgentCandidateArtifactRef\n      readonly gitDiff: AgentCandidateArtifactRef\n    }\n  | {\n      readonly kind: 'output'\n      readonly spec: AgentCandidateTaskOutputSpec\n      readonly artifact: AgentCandidateArtifactRef\n    }\n\nexport interface PersistedAgentCandidateExecutorCapture {\n  readonly evidence: AgentCandidateArtifactRef\n  readonly taskOutcome?: PersistedAgentCandidateTaskCapture\n  readonly memoryAfter?: {\n    readonly afterState: AgentCandidateWorkspaceManifestMaterial\n    readonly manifest: AgentCandidateArtifactRef\n    readonly archive: AgentCandidateArtifactRef\n  }\n}\n\n/** Persist structurally valid post-stop bytes without claiming they passed outcome verification. */\nexport async function persistAgentCandidateExecutorCapture(\n  identity: { executionId: string; executionPlanDigest: Sha256Digest },\n  expected: AgentCandidateTaskOutcomeSpec,\n  capture: SealedAgentCandidateExecutorFinalCapture,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  signal?: AbortSignal,\n): Promise<PersistedAgentCandidateExecutorCapture> {\n  const executorEvidence = capture.evidence\n    ? await persistCandidateOutputArtifact(outputArtifacts, {\n        executionId: identity.executionId,\n        purpose: 'executor-native-evidence',\n        bytes: capture.evidence,\n        signal,\n      })\n    : undefined\n  const taskOutcome = capture.taskOutcome\n    ? await persistTaskCapture(\n        identity.executionId,\n        expected,\n        capture.taskOutcome,\n        outputArtifacts,\n        signal,\n      )\n    : undefined\n  const memoryAfter = capture.memoryAfter\n    ? await persistWorkspaceCapture(\n        identity.executionId,\n        'memory-after-manifest',\n        'memory-after-archive',\n        capture.memoryAfter.afterState,\n        capture.memoryAfter.archive,\n        outputArtifacts,\n        signal,\n      )\n    : undefined\n  const bytes = canonicalCandidateBytes({\n    kind: 'agent-candidate-executor-capture',\n    executionPlanDigest: identity.executionPlanDigest,\n    ...(executorEvidence ? { executorEvidence } : {}),\n    ...(taskOutcome ? { taskOutcome } : {}),\n    ...(memoryAfter ? { memoryAfter } : {}),\n  })\n  const evidence = await persistCandidateOutputArtifact(outputArtifacts, {\n    executionId: identity.executionId,\n    purpose: 'executor-capture',\n    bytes,\n    signal,\n  })\n  return Object.freeze({\n    evidence,\n    ...(taskOutcome ? { taskOutcome: Object.freeze(taskOutcome) } : {}),\n    ...(memoryAfter ? { memoryAfter: Object.freeze(memoryAfter) } : {}),\n  })\n}\n\nasync function persistTaskCapture(\n  executionId: string,\n  expected: AgentCandidateTaskOutcomeSpec,\n  capture: NonNullable<SealedAgentCandidateExecutorFinalCapture['taskOutcome']>,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  signal?: AbortSignal,\n): Promise<PersistedAgentCandidateTaskCapture> {\n  if (capture.kind === 'output') {\n    if (expected.kind !== 'output')\n      throw new Error('captured output does not match the signed task')\n    const artifact = await persistCandidateOutputArtifact(outputArtifacts, {\n      executionId,\n      purpose: 'task-output',\n      bytes: capture.bytes,\n      signal,\n    })\n    return {\n      kind: 'output',\n      spec: { mediaType: expected.mediaType, maxBytes: expected.maxBytes },\n      artifact,\n    }\n  }\n  if (expected.kind !== 'workspace') {\n    throw new Error('captured workspace does not match the signed task')\n  }\n  const workspace = await persistWorkspaceCapture(\n    executionId,\n    'task-manifest',\n    'task-archive',\n    capture.afterState,\n    capture.archive,\n    outputArtifacts,\n    signal,\n  )\n  const gitDiff = await persistCandidateOutputArtifact(outputArtifacts, {\n    executionId,\n    purpose: 'task-patch',\n    bytes: capture.gitDiff,\n    signal,\n  })\n  return { kind: 'workspace', resultTree: capture.resultTree, ...workspace, gitDiff }\n}\n\nasync function persistWorkspaceCapture(\n  executionId: string,\n  manifestPurpose: 'task-manifest' | 'memory-after-manifest',\n  archivePurpose: 'task-archive' | 'memory-after-archive',\n  afterState: AgentCandidateWorkspaceManifestMaterial,\n  archiveBytes: Uint8Array,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  signal?: AbortSignal,\n): Promise<{\n  afterState: AgentCandidateWorkspaceManifestMaterial\n  manifest: AgentCandidateArtifactRef\n  archive: AgentCandidateArtifactRef\n}> {\n  const manifestBytes = canonicalCandidateBytes(afterState)\n  const [manifest, archive] = await Promise.all([\n    persistCandidateOutputArtifact(outputArtifacts, {\n      executionId,\n      purpose: manifestPurpose,\n      bytes: manifestBytes,\n      signal,\n    }),\n    persistCandidateOutputArtifact(outputArtifacts, {\n      executionId,\n      purpose: archivePurpose,\n      bytes: archiveBytes,\n      signal,\n    }),\n  ])\n  return { afterState, manifest, archive }\n}\n","import { mkdtemp, rm } from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { join } from 'node:path'\n\nimport type { BenchmarkEvaluation } from '@tangle-network/agent-eval'\nimport {\n  type AgentCandidateArtifactRef,\n  type AgentCandidateBenchmarkResultEvidence,\n  type AgentCandidateModelSettlementEvidence,\n  type AgentCandidateResolvedModel,\n  type AgentCandidateTaskOutcomeEvidence,\n  type AgentCandidateTaskOutcomeMaterial,\n  type AgentCandidateTaskOutcomeSpec,\n  type AgentCandidateTaskOutputSpec,\n  type AgentCandidateTaskRepository,\n  type AgentCandidateTermination,\n  type AgentCandidateWorkspaceSnapshotEvidence,\n  agentCandidateBenchmarkResultEvidenceSchema,\n  agentCandidateModelSettlementEvidenceSchema,\n  agentCandidateTaskOutcomeEvidenceSchema,\n  agentCandidateWorkspaceSnapshotEvidenceSchema,\n  type Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport { readMaterializedWorkspaceFiles } from './artifacts'\nimport { runBoundCandidateBenchmarkGrader } from './benchmark-grader'\nimport {\n  canonicalCandidateBytes,\n  embeddedCandidateArtifact,\n  immutableCandidateValue,\n  sha256Bytes,\n} from './digest'\nimport type { SealedAgentCandidateExecutorFinalCapture } from './executor-capture'\nimport {\n  type PersistedAgentCandidateExecutorCapture,\n  type PersistedAgentCandidateTaskCapture,\n  persistAgentCandidateExecutorCapture,\n} from './executor-capture-evidence'\nimport { verifyTaskOutcomePatch } from './git-materialize'\nimport type { SealedAgentCandidateModelSettlement } from './model-settlement'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport type { PreparedCandidateState } from './prepared-state'\nimport { assertNoProtectedBytes } from './protected-redaction'\nimport type {\n  AgentCandidateBenchmarkGraderPort,\n  AgentCandidateExecutorTaskOutcomeCapture,\n  AgentCandidateOutputArtifactPort,\n  VerifiedAgentCandidateTaskOutcome,\n} from './types'\nimport { verifiedTaskOutcomeBrand } from './types'\n\nexport type PersistedAgentCandidateModelSettlement = AgentCandidateModelSettlementEvidence & {\n  artifact: AgentCandidateArtifactRef\n}\n\nexport type PersistedAgentCandidateBenchmarkResult = AgentCandidateBenchmarkResultEvidence & {\n  artifact: AgentCandidateArtifactRef\n}\n\n/** Persist the closed evaluator model ledger as canonical receipt evidence. */\nexport async function persistCandidateModelSettlement(\n  state: PreparedCandidateState,\n  settlement: SealedAgentCandidateModelSettlement,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n): Promise<PersistedAgentCandidateModelSettlement> {\n  return await persistCandidateModelSettlementEvidence(\n    {\n      executionId: state.executionId,\n      executionPlanDigest: state.executionPlan.value.digest,\n      resolvedModel: state.resolvedModel,\n    },\n    settlement,\n    outputArtifacts,\n  )\n}\n\n/** Persist a closed model ledger when only durable recovery identity remains. */\nexport async function persistCandidateModelSettlementEvidence(\n  identity: {\n    executionId: string\n    executionPlanDigest: Sha256Digest\n    resolvedModel: AgentCandidateResolvedModel\n  },\n  settlement: SealedAgentCandidateModelSettlement,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n): Promise<PersistedAgentCandidateModelSettlement> {\n  const material = {\n    kind: 'agent-candidate-model-settlement-material' as const,\n    executionPlanDigest: identity.executionPlanDigest,\n    preparationId: settlement.value.preparationId,\n    grantDigest: settlement.value.grantDigest,\n    closed: true as const,\n    usageWithinLimits: settlement.value.usageWithinLimits,\n    resolved: identity.resolvedModel,\n    calls: settlement.value.calls.map((call) => ({\n      callId: call.callId,\n      generationId: call.generationId,\n      traceSpanId: call.traceSpanId,\n      status: call.status,\n      model: call.model,\n      startedAtMs: call.startedAtMs,\n      endedAtMs: call.endedAtMs,\n      inputTokens: call.inputTokens,\n      accountedInputTokens: call.accountedInputTokens,\n      outputTokens: call.outputTokens,\n      cachedInputTokens: call.cachedInputTokens ?? 0,\n      reasoningTokens: call.reasoningTokens ?? 0,\n      costUsdNanos: call.costUsdNanos,\n      costProvenance: call.costProvenance,\n    })),\n    usage: settlement.usage,\n  }\n  const bytes = canonicalCandidateBytes(material)\n  const digest = sha256Bytes(bytes)\n  const artifact = await persistCandidateOutputArtifact(outputArtifacts, {\n    executionId: identity.executionId,\n    purpose: 'model-settlement',\n    bytes,\n  })\n  return immutableCandidateValue(\n    agentCandidateModelSettlementEvidenceSchema.parse({\n      kind: 'agent-candidate-model-settlement',\n      digest,\n      material,\n      artifact,\n    }),\n  ) as PersistedAgentCandidateModelSettlement\n}\n\n/** Verify once, persist the sealed capture once, and bind the resulting task evidence. */\nexport async function persistVerifiedAgentCandidateExecutorCapture(\n  state: PreparedCandidateState,\n  capture: SealedAgentCandidateExecutorFinalCapture,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  protectedValues: readonly string[],\n  signal?: AbortSignal,\n): Promise<{\n  persistedCapture: PersistedAgentCandidateExecutorCapture\n  taskOutcome: VerifiedAgentCandidateTaskOutcome\n}> {\n  signal?.throwIfAborted()\n  const taskCapture = capture.taskOutcome\n  if (!taskCapture) throw new Error('candidate final capture is missing the task outcome')\n  if (capture.evidence) assertNoProtectedBytes(capture.evidence, protectedValues)\n  const expected = state.benchmarkTask.outcome\n  if (taskCapture.kind !== expected.kind) {\n    throw new Error(\n      `candidate captured ${taskCapture.kind} outcome does not match expected ${expected.kind} outcome`,\n    )\n  }\n  const verified =\n    taskCapture.kind === 'output' && expected.kind === 'output'\n      ? verifyOutputTaskCapture(taskCapture.bytes, expected, protectedValues)\n      : taskCapture.kind === 'workspace' && expected.kind === 'workspace'\n        ? await verifyWorkspaceTaskCapture(state, taskCapture, protectedValues, signal)\n        : undefined\n  if (!verified) throw new Error('candidate task outcome kind could not be narrowed')\n  await verifyMemoryCapture(state, capture, protectedValues, signal)\n\n  const persistedCapture = await persistAgentCandidateExecutorCapture(\n    {\n      executionId: state.executionId,\n      executionPlanDigest: state.executionPlan.value.digest,\n    },\n    expected,\n    capture,\n    outputArtifacts,\n    signal,\n  )\n  const persisted = persistedCapture.taskOutcome\n  if (!persisted || persisted.kind !== verified.kind) {\n    throw new Error('persisted task capture kind changed')\n  }\n  const taskOutcome =\n    verified.kind === 'output' && persisted.kind === 'output'\n      ? await persistVerifiedOutputTaskOutcome(state, verified, persisted, outputArtifacts, signal)\n      : verified.kind === 'workspace' && persisted.kind === 'workspace'\n        ? await persistVerifiedWorkspaceTaskOutcome(\n            state,\n            verified,\n            persisted,\n            outputArtifacts,\n            signal,\n          )\n        : undefined\n  if (!taskOutcome) throw new Error('persisted task outcome kind could not be narrowed')\n  return Object.freeze({ persistedCapture, taskOutcome })\n}\n\ninterface VerifiedWorkspaceTaskCapture {\n  readonly kind: 'workspace'\n  readonly patch: Uint8Array\n  readonly archive: Uint8Array\n  readonly afterState: Extract<\n    AgentCandidateExecutorTaskOutcomeCapture,\n    { kind: 'workspace' }\n  >['afterState']\n  readonly manifestBytes: Uint8Array\n  readonly resultCommit: string\n  readonly resultTree: string\n  readonly repository: AgentCandidateTaskRepository\n}\n\nasync function verifyWorkspaceTaskCapture(\n  state: PreparedCandidateState,\n  capture: Extract<AgentCandidateExecutorTaskOutcomeCapture, { kind: 'workspace' }>,\n  protectedValues: readonly string[],\n  signal?: AbortSignal,\n): Promise<VerifiedWorkspaceTaskCapture> {\n  const repository = state.benchmarkTask.repository\n  if (!repository) throw new Error('workspace task outcome is missing repository identity')\n  const patch = Uint8Array.from(capture.gitDiff)\n  const archive = Uint8Array.from(capture.archive)\n  if (archive.byteLength === 0) throw new Error('candidate task archive cannot be empty')\n  assertNoProtectedBytes(patch, protectedValues)\n  assertNoProtectedBytes(archive, protectedValues)\n  const afterState = immutableCandidateValue(capture.afterState)\n  const verified = await verifyTaskOutcomePatch({\n    repositoryRoot: state.roots.staging.taskRoot,\n    baseCommit: repository.baseCommit,\n    baseTree: repository.baseTree,\n    resultTree: capture.resultTree,\n    patch,\n    afterState,\n  })\n  signal?.throwIfAborted()\n  const manifestBytes = canonicalCandidateBytes(afterState)\n  assertNoProtectedBytes(manifestBytes, protectedValues)\n  const provisionalSnapshot = agentCandidateWorkspaceSnapshotEvidenceSchema.parse({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: sha256Bytes(manifestBytes),\n    material: afterState,\n    manifest: embeddedCandidateArtifact(manifestBytes),\n    archive: embeddedCandidateArtifact(archive),\n  })\n  await verifyTaskOutcomeArchive(state, provisionalSnapshot, archive, protectedValues)\n  signal?.throwIfAborted()\n  return {\n    kind: 'workspace',\n    patch,\n    archive,\n    afterState,\n    manifestBytes,\n    resultCommit: verified.resultCommit,\n    resultTree: verified.resultTree,\n    repository,\n  }\n}\n\nasync function persistVerifiedWorkspaceTaskOutcome(\n  state: PreparedCandidateState,\n  verified: VerifiedWorkspaceTaskCapture,\n  persisted: Extract<PersistedAgentCandidateTaskCapture, { kind: 'workspace' }>,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  signal?: AbortSignal,\n): Promise<VerifiedAgentCandidateTaskOutcome> {\n  const { afterState, manifestBytes, patch, repository } = verified\n  const snapshot = agentCandidateWorkspaceSnapshotEvidenceSchema.parse({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: sha256Bytes(manifestBytes),\n    material: afterState,\n    manifest: persisted.manifest,\n    archive: persisted.archive,\n  })\n  const material = {\n    kind: 'agent-candidate-task-outcome-material' as const,\n    executionPlanDigest: state.executionPlan.value.digest,\n    outcome: {\n      kind: 'workspace' as const,\n      baseRepository: {\n        identity: repository.identity,\n        rootIdentity: repository.rootIdentity,\n        commit: repository.baseCommit,\n        tree: repository.baseTree,\n      },\n      resultRepository: {\n        identity: repository.identity,\n        rootIdentity: repository.rootIdentity,\n        commit: verified.resultCommit,\n        tree: verified.resultTree,\n      },\n      afterState: snapshot,\n      gitDiff: {\n        format: 'git-diff-binary' as const,\n        artifact: persisted.gitDiff,\n      },\n    },\n  } satisfies AgentCandidateTaskOutcomeMaterial\n  const evidence = await persistTaskOutcomeEvidence(state, material, outputArtifacts, signal)\n  const storedPatch = Uint8Array.from(patch)\n  return Object.freeze({\n    kind: 'workspace' as const,\n    evidence,\n    get patch(): Uint8Array {\n      return Uint8Array.from(storedPatch)\n    },\n    [verifiedTaskOutcomeBrand]: true as const,\n  })\n}\n\ninterface VerifiedOutputTaskCapture {\n  readonly kind: 'output'\n  readonly bytes: Uint8Array\n  readonly spec: AgentCandidateTaskOutputSpec\n}\n\nfunction verifyOutputTaskCapture(\n  capturedBytes: Uint8Array,\n  expected: Extract<AgentCandidateTaskOutcomeSpec, { kind: 'output' }>,\n  protectedValues: readonly string[],\n): VerifiedOutputTaskCapture {\n  if (capturedBytes.byteLength === 0) throw new Error('candidate task output cannot be empty')\n  if (capturedBytes.byteLength > expected.maxBytes) {\n    throw new Error(`candidate task output exceeds the frozen ${expected.maxBytes}-byte maximum`)\n  }\n  const output = Uint8Array.from(capturedBytes)\n  assertNoProtectedBytes(output, protectedValues)\n  return {\n    kind: 'output',\n    bytes: output,\n    spec: { mediaType: expected.mediaType, maxBytes: expected.maxBytes },\n  }\n}\n\nasync function persistVerifiedOutputTaskOutcome(\n  state: PreparedCandidateState,\n  verified: VerifiedOutputTaskCapture,\n  persisted: Extract<PersistedAgentCandidateTaskCapture, { kind: 'output' }>,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  signal?: AbortSignal,\n): Promise<VerifiedAgentCandidateTaskOutcome> {\n  if (\n    persisted.spec.mediaType !== verified.spec.mediaType ||\n    persisted.spec.maxBytes !== verified.spec.maxBytes\n  ) {\n    throw new Error('persisted task output changed the signed media constraints')\n  }\n  const material = {\n    kind: 'agent-candidate-task-outcome-material' as const,\n    executionPlanDigest: state.executionPlan.value.digest,\n    outcome: {\n      kind: 'output' as const,\n      spec: verified.spec,\n      artifact: persisted.artifact,\n    },\n  } satisfies AgentCandidateTaskOutcomeMaterial\n  const evidence = await persistTaskOutcomeEvidence(state, material, outputArtifacts, signal)\n  const storedOutput = Uint8Array.from(verified.bytes)\n  return Object.freeze({\n    kind: 'output' as const,\n    evidence,\n    spec: immutableCandidateValue(verified.spec),\n    get bytes(): Uint8Array {\n      return Uint8Array.from(storedOutput)\n    },\n    [verifiedTaskOutcomeBrand]: true as const,\n  })\n}\n\nasync function persistTaskOutcomeEvidence<Material extends AgentCandidateTaskOutcomeMaterial>(\n  state: PreparedCandidateState,\n  material: Material,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  signal?: AbortSignal,\n): Promise<\n  Omit<AgentCandidateTaskOutcomeEvidence, 'material'> & {\n    material: Material\n    artifact: AgentCandidateArtifactRef\n  }\n> {\n  const bytes = canonicalCandidateBytes(material)\n  const digest = sha256Bytes(bytes)\n  const artifact = await persistCandidateOutputArtifact(outputArtifacts, {\n    executionId: state.executionId,\n    purpose: 'task-outcome',\n    bytes,\n    signal,\n  })\n  return immutableCandidateValue(\n    agentCandidateTaskOutcomeEvidenceSchema.parse({\n      kind: 'agent-candidate-task-outcome',\n      digest,\n      material,\n      artifact,\n    }),\n  ) as Omit<AgentCandidateTaskOutcomeEvidence, 'material'> & {\n    material: Material\n    artifact: AgentCandidateArtifactRef\n  }\n}\n\n/** Grade only a runtime-verified outcome and persist both raw and normalized evidence. */\nexport async function persistCandidateBenchmarkResult(\n  state: PreparedCandidateState,\n  termination: AgentCandidateTermination,\n  outcome: VerifiedAgentCandidateTaskOutcome,\n  grader: AgentCandidateBenchmarkGraderPort,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  protectedValues: readonly string[],\n  signal?: AbortSignal,\n): Promise<PersistedAgentCandidateBenchmarkResult> {\n  signal?.throwIfAborted()\n  const frozenTermination = immutableCandidateValue(termination)\n  const graded = await runBoundCandidateBenchmarkGrader({\n    executionId: state.executionId,\n    termination: frozenTermination,\n    outcome,\n    expectedGrader: state.benchmarkTask.grader,\n    grader,\n    artifacts: outputArtifacts,\n    signal,\n  })\n  signal?.throwIfAborted()\n  const evaluation = normalizeEvaluation(graded.evaluation, frozenTermination)\n  const rawEvidence = Uint8Array.from(graded.evidence)\n  if (rawEvidence.byteLength === 0) throw new Error('candidate benchmark evidence cannot be empty')\n  assertNoProtectedBytes(rawEvidence, protectedValues)\n  const evidenceRef = await persistCandidateOutputArtifact(outputArtifacts, {\n    executionId: state.executionId,\n    purpose: 'grader-evidence',\n    bytes: rawEvidence,\n    signal,\n  })\n  const material = {\n    kind: 'agent-candidate-benchmark-result-material' as const,\n    executionPlanDigest: state.executionPlan.value.digest,\n    taskOutcomeDigest: outcome.evidence.digest,\n    grader: graded.grader,\n    evidence: evidenceRef,\n    grading: graded.grading,\n    score: evaluation.score,\n    passed: evaluation.passed,\n    dimensions: evaluation.dimensions,\n  }\n  const bytes = canonicalCandidateBytes(material)\n  const digest = sha256Bytes(bytes)\n  const artifact = await persistCandidateOutputArtifact(outputArtifacts, {\n    executionId: state.executionId,\n    purpose: 'benchmark-result',\n    bytes,\n    signal,\n  })\n  return immutableCandidateValue(\n    agentCandidateBenchmarkResultEvidenceSchema.parse({\n      kind: 'agent-candidate-benchmark-result',\n      digest,\n      material,\n      artifact,\n    }),\n  ) as PersistedAgentCandidateBenchmarkResult\n}\n\nasync function verifyTaskOutcomeArchive(\n  state: PreparedCandidateState,\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n  archive: Uint8Array,\n  protectedValues: readonly string[],\n): Promise<void> {\n  const root = await mkdtemp(join(tmpdir(), 'agent-candidate-task-archive-'))\n  try {\n    await state.ports.workspaces.materialize({\n      role: 'task',\n      snapshot,\n      archive: Uint8Array.from(archive),\n      destination: root,\n    })\n    const files = await readMaterializedWorkspaceFiles(root, snapshot.material)\n    for (const file of files) assertNoProtectedBytes(file.bytes, protectedValues)\n  } finally {\n    await rm(root, { recursive: true, force: true })\n  }\n}\n\nasync function verifyMemoryCapture(\n  state: PreparedCandidateState,\n  capture: SealedAgentCandidateExecutorFinalCapture,\n  protectedValues: readonly string[],\n  signal?: AbortSignal,\n): Promise<void> {\n  if (state.memory.mode === 'disabled') {\n    if (capture.memoryAfter) throw new Error('disabled memory cannot return an after-state')\n    return\n  }\n  const memory = capture.memoryAfter\n  if (!memory) throw new Error('isolated memory is missing its protected after-state')\n  if (memory.archive.byteLength === 0) throw new Error('isolated memory archive cannot be empty')\n  const manifestBytes = canonicalCandidateBytes(memory.afterState)\n  assertNoProtectedBytes(manifestBytes, protectedValues)\n  assertNoProtectedBytes(memory.archive, protectedValues)\n  const snapshot = agentCandidateWorkspaceSnapshotEvidenceSchema.parse({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: sha256Bytes(manifestBytes),\n    material: memory.afterState,\n    manifest: embeddedCandidateArtifact(manifestBytes),\n    archive: embeddedCandidateArtifact(memory.archive),\n  })\n  const root = await mkdtemp(join(tmpdir(), 'agent-candidate-memory-after-'))\n  try {\n    await state.ports.workspaces.materialize({\n      role: 'memory',\n      snapshot,\n      archive: Uint8Array.from(memory.archive),\n      destination: root,\n    })\n    const files = await readMaterializedWorkspaceFiles(root, memory.afterState)\n    for (const file of files) assertNoProtectedBytes(file.bytes, protectedValues)\n    signal?.throwIfAborted()\n  } finally {\n    await rm(root, { recursive: true, force: true })\n  }\n}\n\nfunction normalizeEvaluation(\n  evaluation: BenchmarkEvaluation,\n  termination: AgentCandidateTermination,\n): { score: number; passed: boolean; dimensions: Array<{ name: string; score: number }> } {\n  if (!evaluation || typeof evaluation !== 'object' || Array.isArray(evaluation)) {\n    throw new Error('candidate benchmark evaluation must be an object')\n  }\n  assertUnitScore(evaluation.score, 'candidate benchmark score')\n  if (evaluation.passed !== undefined && typeof evaluation.passed !== 'boolean') {\n    throw new Error('candidate benchmark passed must be boolean')\n  }\n  const cleanExit = termination.kind === 'exit' && termination.exitCode === 0\n  const dimensions = Object.entries(evaluation.dimensions ?? {})\n    .map(([name, score]) => {\n      if (!/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/.test(name)) {\n        throw new Error(`candidate benchmark dimension is not normalized: ${name}`)\n      }\n      assertUnitScore(score, `candidate benchmark dimension ${name}`)\n      return { name, score: cleanExit ? score : 0 }\n    })\n    .sort((left, right) => left.name.localeCompare(right.name))\n  return {\n    score: cleanExit ? evaluation.score : 0,\n    passed: cleanExit && (evaluation.passed ?? evaluation.score > 0),\n    dimensions,\n  }\n}\n\nfunction assertUnitScore(value: unknown, label: string): asserts value is number {\n  if (typeof value !== 'number' || !Number.isFinite(value) || value < 0 || value > 1) {\n    throw new Error(`${label} must be finite and within [0, 1]`)\n  }\n}\n","import type { TraceStore } from '@tangle-network/agent-eval'\n\nimport {\n  createProtectedRecordRedactor,\n  type ProtectedRedactionReport,\n  type ProtectedTraceIdentity,\n} from './protected-redaction'\n\nexport interface ProtectedAgentCandidateTraceAccess {\n  readonly store: TraceStore\n  closeWrites(): Promise<void>\n  identity(trace: ProtectedTraceIdentity): ProtectedTraceIdentity\n  report(): ProtectedRedactionReport\n}\n\n/** Keep the identity key in evaluator-owned closures and expose only the redacting store to code. */\nexport function createProtectedAgentCandidateTraceAccess(\n  inner: TraceStore,\n  protectedValues: readonly string[],\n): ProtectedAgentCandidateTraceAccess {\n  const redactor = createProtectedRecordRedactor(protectedValues)\n  const pendingWrites = new Set<Promise<void>>()\n  let acceptsWrites = true\n  const write = (operation: () => Promise<void>): Promise<void> => {\n    if (!acceptsWrites) {\n      return Promise.reject(new Error('candidate trace writes are closed'))\n    }\n    let started: Promise<void>\n    try {\n      started = operation()\n    } catch (error) {\n      return Promise.reject(error)\n    }\n    let tracked: Promise<void>\n    tracked = started.finally(() => pendingWrites.delete(tracked))\n    pendingWrites.add(tracked)\n    return tracked\n  }\n  const store = Object.freeze<TraceStore>({\n    appendRun: (run) => write(() => inner.appendRun(redactor.record(run))),\n    updateRun: (runId, patch) =>\n      write(() => inner.updateRun(redactor.identifier(runId), redactor.record(patch))),\n    appendSpan: (span) =>\n      write(async () => {\n        if (span.kind === 'llm') {\n          throw new Error('candidate executors cannot author protected model spans')\n        }\n        await inner.appendSpan(redactor.record(span))\n      }),\n    updateSpan: (spanId, patch) =>\n      write(async () => {\n        if (patch.kind === 'llm') {\n          throw new Error('candidate executors cannot author protected model spans')\n        }\n        await inner.updateSpan(redactor.identifier(spanId), redactor.record(patch))\n      }),\n    appendEvent: (event) => write(() => inner.appendEvent(redactor.record(event))),\n    appendArtifact: (artifact) => write(() => inner.appendArtifact(redactor.record(artifact))),\n    appendBudgetEntry: (entry) => write(() => inner.appendBudgetEntry(redactor.record(entry))),\n    getRun: async (runId) => inner.getRun(redactor.identifier(runId)),\n    listRuns: async (filter) => inner.listRuns(filter ? redactor.query(filter) : undefined),\n    spans: async (filter) => inner.spans(filter ? redactor.query(filter) : undefined),\n    events: async (filter) => inner.events(filter ? redactor.query(filter) : undefined),\n    budget: async (runId) => inner.budget(redactor.identifier(runId)),\n    artifacts: async (runId) => inner.artifacts(redactor.identifier(runId)),\n  })\n  return Object.freeze({\n    store,\n    closeWrites: async () => {\n      acceptsWrites = false\n      await Promise.all([...pendingWrites])\n    },\n    identity: (trace: ProtectedTraceIdentity) => redactor.traceIdentity(trace),\n    report: () => redactor.report(),\n  })\n}\n\n/** Recovery can read existing trace state but must never accept new unredactable writes. */\nexport class RecoveryAgentCandidateTraceStore implements TraceStore {\n  constructor(private readonly inner: TraceStore) {}\n\n  appendRun(): Promise<void> {\n    return this.rejectWrite()\n  }\n\n  updateRun(): Promise<void> {\n    return this.rejectWrite()\n  }\n\n  appendSpan(): Promise<void> {\n    return this.rejectWrite()\n  }\n\n  updateSpan(): Promise<void> {\n    return this.rejectWrite()\n  }\n\n  appendEvent(): Promise<void> {\n    return this.rejectWrite()\n  }\n\n  appendArtifact(): Promise<void> {\n    return this.rejectWrite()\n  }\n\n  appendBudgetEntry(): Promise<void> {\n    return this.rejectWrite()\n  }\n\n  getRun(...args: Parameters<TraceStore['getRun']>): ReturnType<TraceStore['getRun']> {\n    return this.inner.getRun(...args)\n  }\n\n  listRuns(...args: Parameters<TraceStore['listRuns']>): ReturnType<TraceStore['listRuns']> {\n    return this.inner.listRuns(...args)\n  }\n\n  spans(...args: Parameters<TraceStore['spans']>): ReturnType<TraceStore['spans']> {\n    return this.inner.spans(...args)\n  }\n\n  events(...args: Parameters<TraceStore['events']>): ReturnType<TraceStore['events']> {\n    return this.inner.events(...args)\n  }\n\n  budget(...args: Parameters<TraceStore['budget']>): ReturnType<TraceStore['budget']> {\n    return this.inner.budget(...args)\n  }\n\n  artifacts(...args: Parameters<TraceStore['artifacts']>): ReturnType<TraceStore['artifacts']> {\n    return this.inner.artifacts(...args)\n  }\n\n  private rejectWrite(): Promise<never> {\n    return Promise.reject(new Error('expired candidate recovery cannot append trace evidence'))\n  }\n}\n","import type { TraceStore } from '@tangle-network/agent-eval'\nimport type {\n  AgentCandidateTaskOutcomeSpec,\n  AgentCandidateTermination,\n} from '@tangle-network/agent-interface'\n\nimport type {\n  AgentCandidateExecutionClaim,\n  AgentCandidateExecutionClaimStore,\n  AgentCandidateExecutionFailureClass,\n  AgentCandidateExecutionLease,\n  AgentCandidateExecutionTerminalResult,\n} from './claim'\nimport { candidateExecutionClaim } from './claim-plan'\nimport {\n  candidateCleanupDeadline,\n  candidateCleanupTimeout,\n  candidateResultTimeout,\n  withinCandidateCleanupDeadline,\n  withinCandidateResultDeadline,\n} from './cleanup'\nimport { canonicalCandidateBytes } from './digest'\nimport { candidatePostRunWindowMs, candidateTerminalWindowMs } from './execution-window'\nimport {\n  type SealedAgentCandidateExecutorFinalCapture,\n  sealAgentCandidateExecutorFinalCapture,\n  sealAgentCandidateExecutorStopAcknowledgement,\n  sealAgentCandidateProtectedRunCapture,\n} from './executor-capture'\nimport { failedAgentCandidateRun, finalizeAgentCandidateRun } from './finalize'\nimport {\n  appendAuthoritativeModelSettlementSpans,\n  type SealedAgentCandidateModelSettlement,\n  sealAgentCandidateModelSettlement,\n} from './model-settlement'\nimport {\n  type PersistedAgentCandidateModelSettlement,\n  persistCandidateBenchmarkResult,\n  persistCandidateModelSettlement,\n  persistVerifiedAgentCandidateExecutorCapture,\n} from './outcome-evidence'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport {\n  assertPreparedCandidateIntegrity,\n  assertPreparedCandidateWorkspaces,\n  beginPreparedCandidateClaim,\n  beginPreparedCandidateRun,\n  beginPreparedCandidateSettlement,\n  consumePreparedCandidateExecution,\n  markPreparedCandidateClaimed,\n  type PreparedCandidateState,\n} from './prepared-state'\nimport { redactProtectedReason } from './protected-redaction'\nimport { createProtectedAgentCandidateTraceAccess } from './protected-trace-store'\nimport type {\n  AgentCandidateBenchmarkGraderPort,\n  AgentCandidateExecutorPort,\n  AgentCandidateExecutorRequest,\n  AgentCandidateOutputArtifactPort,\n  AgentCandidateProtectedModelActivation,\n  AgentCandidateProtectedRunCapture,\n  AgentCandidateRunFinalization,\n  PreparedAgentCandidateExecution,\n} from './types'\n\nexport interface ExecutePreparedAgentCandidateOptions {\n  executor: AgentCandidateExecutorPort\n  grader: AgentCandidateBenchmarkGraderPort\n  outputArtifacts: AgentCandidateOutputArtifactPort\n  traceStore: TraceStore\n  /** Long-lived evaluator-owned store shared by every process that can run this benchmark. */\n  claimStore: AgentCandidateExecutionClaimStore\n  /** Maximum time to prove process death and revoke protected access after a run ends. */\n  cleanupTimeoutMs?: number\n  /** Maximum time for task verification, executable grading, and receipt construction. */\n  resultTimeoutMs?: number\n}\n\n/** Executes and finalizes one durably claimed candidate without exposing an unproven result. */\nexport async function executePreparedAgentCandidate(\n  prepared: PreparedAgentCandidateExecution,\n  options: ExecutePreparedAgentCandidateOptions,\n): Promise<AgentCandidateRunFinalization> {\n  const initialState = assertPreparedCandidateIntegrity(prepared)\n  const cleanupTimeoutMs = candidateCleanupTimeout(\n    options.cleanupTimeoutMs ?? initialState.cleanupTimeoutMs,\n  )\n  if (cleanupTimeoutMs > initialState.cleanupTimeoutMs) {\n    throw new Error('execution cleanup timeout exceeds the frozen preparation bound')\n  }\n  const resultTimeoutMs = candidateResultTimeout(\n    options.resultTimeoutMs ?? initialState.resultTimeoutMs,\n    initialState.resultTimeoutMs,\n  )\n  if (resultTimeoutMs > initialState.resultTimeoutMs) {\n    throw new Error('execution result timeout exceeds the frozen preparation bound')\n  }\n  let state: PreparedCandidateState\n  try {\n    state = beginPreparedCandidateClaim(prepared)\n  } catch (error) {\n    return failedAgentCandidateRun(initialState, errorMessage(error))\n  }\n\n  try {\n    // Mutable staging is only a preparation check. The executor receives the\n    // detached file bytes sealed in private state, never these host paths.\n    await assertPreparedCandidateWorkspaces(state)\n  } catch (error) {\n    return await failBeforeActivation(prepared, state, error, 'failed', cleanupTimeoutMs)\n  }\n\n  let preparationEvidence: AgentCandidateExecutionClaim['preparationEvidence']\n  try {\n    const [executionPlan, materializationReceipt] = await Promise.all([\n      persistCandidateOutputArtifact(options.outputArtifacts, {\n        executionId: state.executionId,\n        purpose: 'execution-plan',\n        bytes: state.executionPlan.bytes,\n      }),\n      persistCandidateOutputArtifact(options.outputArtifacts, {\n        executionId: state.executionId,\n        purpose: 'materialization-receipt',\n        bytes: state.materializationReceipt.bytes,\n      }),\n    ])\n    preparationEvidence = Object.freeze({ executionPlan, materializationReceipt })\n  } catch (error) {\n    return await failBeforeActivation(prepared, state, error, 'failed', cleanupTimeoutMs)\n  }\n\n  let acquired: Awaited<ReturnType<AgentCandidateExecutionClaimStore['tryClaim']>>\n  try {\n    acquired = await options.claimStore.tryClaim(\n      candidateExecutionClaim(prepared, preparationEvidence),\n    )\n  } catch (error) {\n    return await failBeforeActivation(prepared, state, error, 'failed', cleanupTimeoutMs)\n  }\n  if (!acquired.acquired) {\n    return await failBeforeActivation(\n      prepared,\n      state,\n      new Error(\n        acquired.reason === 'retry-not-eligible'\n          ? `candidate execution retry is not eligible: ${acquired.detail}`\n          : 'candidate execution attempt is already claimed',\n      ),\n      'replayed',\n      cleanupTimeoutMs,\n    )\n  }\n\n  markPreparedCandidateClaimed(prepared)\n  const postRunWindowMs = candidatePostRunWindowMs(cleanupTimeoutMs, resultTimeoutMs)\n  // A caller may shorten cleanup for this invocation, but that must never buy\n  // the candidate more execution time. The claim was frozen with the prepared\n  // cleanup window, so recover the original task deadline from that value.\n  const deadlineAtMs =\n    acquired.claim.leaseExpiresAtMs -\n    candidatePostRunWindowMs(state.cleanupTimeoutMs, state.resultTimeoutMs)\n  const requiredLeaseExpiry = deadlineAtMs + postRunWindowMs\n  if (\n    Date.now() >= deadlineAtMs ||\n    deadlineAtMs > state.reservationExpiresAtMs ||\n    requiredLeaseExpiry > acquired.lease.expiresAtMs\n  ) {\n    return await failClaimedExecution(\n      prepared,\n      state,\n      acquired.lease,\n      options.claimStore,\n      options.outputArtifacts,\n      new Error('candidate claim no longer covers its full execution and cleanup window'),\n      'failed',\n      cleanupTimeoutMs,\n      'pre-model-infrastructure',\n    )\n  }\n  let activation: AgentCandidateProtectedModelActivation\n  try {\n    const activated = await withinCandidateCleanupDeadline(\n      () =>\n        state.ports.models.activateGrant({\n          executionId: state.executionId,\n          preparationId: state.preparationId,\n          grantDigest: state.modelReservation.digest,\n          resolved: state.resolvedModel,\n          deadlineAtMs,\n        }),\n      Math.min(deadlineAtMs, candidateCleanupDeadline(cleanupTimeoutMs)),\n      'protected model activation',\n    )\n    activation = Object.freeze({ env: Object.freeze({ ...activated.env }) })\n  } catch (error) {\n    return await failClaimedExecution(\n      prepared,\n      state,\n      acquired.lease,\n      options.claimStore,\n      options.outputArtifacts,\n      new Error('protected model activation failed', { cause: error }),\n      'failed',\n      cleanupTimeoutMs,\n      'pre-model-infrastructure',\n    )\n  }\n\n  let memoryActivation: { env: Readonly<Record<string, string>> } | undefined\n  if (state.memory.mode === 'isolated') {\n    try {\n      const reservation = state.memoryReservation\n      if (!reservation) throw new Error('isolated memory reservation is missing')\n      const activated = await withinCandidateCleanupDeadline(\n        () =>\n          state.ports.memory.activate({\n            executionId: state.executionId,\n            preparationId: reservation.preparationId,\n            accessDigest: reservation.accessDigest,\n            effectiveNamespace: reservation.effectiveNamespace,\n            deadlineAtMs,\n          }),\n        Math.min(deadlineAtMs, candidateCleanupDeadline(cleanupTimeoutMs)),\n        'isolated memory activation',\n      )\n      memoryActivation = Object.freeze({ env: Object.freeze({ ...activated.env }) })\n    } catch (error) {\n      return await failClaimedExecution(\n        prepared,\n        state,\n        acquired.lease,\n        options.claimStore,\n        options.outputArtifacts,\n        new Error('isolated memory activation failed', { cause: error }),\n        'failed',\n        cleanupTimeoutMs,\n        'pre-model-infrastructure',\n        activation,\n      )\n    }\n  }\n\n  let request: AgentCandidateExecutorRequest\n  try {\n    request = beginPreparedCandidateRun(prepared, activation, memoryActivation).request\n  } catch (error) {\n    return await failClaimedExecution(\n      prepared,\n      state,\n      acquired.lease,\n      options.claimStore,\n      options.outputArtifacts,\n      error,\n      'failed',\n      cleanupTimeoutMs,\n      'pre-model-infrastructure',\n      activation,\n      memoryActivation,\n    )\n  }\n\n  try {\n    const phase = await options.claimStore.markCandidateMayRun(acquired.lease)\n    if (phase.phase !== 'candidate-may-run') {\n      throw new Error('candidate claim did not persist the candidate-may-run phase')\n    }\n  } catch (error) {\n    return await failClaimedExecution(\n      prepared,\n      state,\n      acquired.lease,\n      options.claimStore,\n      options.outputArtifacts,\n      new Error('candidate execution phase persistence failed', { cause: error }),\n      'failed',\n      cleanupTimeoutMs,\n      'pre-model-infrastructure',\n      activation,\n      memoryActivation,\n    )\n  }\n  if (Date.now() >= deadlineAtMs) {\n    return await failClaimedExecution(\n      prepared,\n      state,\n      acquired.lease,\n      options.claimStore,\n      options.outputArtifacts,\n      new Error('candidate execution deadline elapsed while persisting its launch phase'),\n      'failed',\n      cleanupTimeoutMs,\n      'unknown',\n      activation,\n      memoryActivation,\n    )\n  }\n\n  const protectedValues = protectedEnvironmentValues(activation, memoryActivation)\n  const protectedTrace = createProtectedAgentCandidateTraceAccess(\n    options.traceStore,\n    protectedValues,\n  )\n  const persistedTrace = protectedTrace.identity(state.trace)\n  const execution = await runAndStopExecutor(\n    options.executor,\n    request,\n    state.benchmarkTask.outcome,\n    protectedTrace.store,\n    deadlineAtMs,\n    cleanupTimeoutMs,\n  )\n  beginPreparedCandidateSettlement(prepared)\n  const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs)\n\n  const accessReason =\n    execution.kind === 'timeout' || execution.termination?.kind === 'timeout'\n      ? 'timeout'\n      : execution.kind === 'capture'\n        ? 'completed'\n        : 'failed'\n  const traceClosure = withinCandidateCleanupDeadline(\n    () => protectedTrace.closeWrites(),\n    cleanupDeadlineAtMs,\n    'candidate trace write closure',\n  ).then(\n    () => ({ closed: true as const, error: undefined }),\n    (error: unknown) => ({ closed: false as const, error }),\n  )\n  const [traceClose, memoryClose, settlementResult] = await Promise.all([\n    traceClosure,\n    closeMemoryAccess(state, accessReason, cleanupDeadlineAtMs),\n    settleModelGrant(state, accessReason, cleanupDeadlineAtMs),\n  ])\n  if (\n    !execution.processStopped ||\n    !traceClose.closed ||\n    !settlementResult.settlement ||\n    !memoryClose.closed\n  ) {\n    consumePreparedCandidateExecution(prepared, 'failed')\n    return failedAgentCandidateRun(\n      state,\n      redactProtectedReason(\n        joinErrors(\n          execution.error,\n          !execution.processStopped\n            ? new Error('candidate process termination is not proven')\n            : undefined,\n          traceClose.error,\n          memoryClose.error,\n          settlementResult.error ??\n            (!settlementResult.settlement ? new Error('model settlement failed') : undefined),\n          new Error('candidate claim remains recoverable until protected cleanup is proven'),\n        ),\n        protectedValues,\n      ),\n      execution.termination,\n      settlementResult.settlement?.usage ?? null,\n    )\n  }\n\n  let modelSettlement: PersistedAgentCandidateModelSettlement\n  try {\n    modelSettlement = await withinCandidateCleanupDeadline(\n      () =>\n        persistCandidateModelSettlement(\n          state,\n          settlementResult.settlement as SealedAgentCandidateModelSettlement,\n          options.outputArtifacts,\n        ),\n      candidateCleanupDeadline(cleanupTimeoutMs),\n      'candidate model settlement persistence',\n    )\n  } catch (error) {\n    consumePreparedCandidateExecution(prepared, 'failed')\n    return failedAgentCandidateRun(\n      state,\n      redactProtectedReason(\n        joinErrors(\n          error,\n          new Error('candidate claim remains recoverable until settlement evidence is durable'),\n        ),\n        protectedValues,\n      ),\n      execution.termination,\n      settlementResult.settlement.usage,\n    )\n  }\n\n  let result: AgentCandidateRunFinalization\n  const failureClass: AgentCandidateExecutionFailureClass =\n    execution.kind === 'error' ? 'execution' : 'post-model-infrastructure'\n  if (execution.kind === 'error') {\n    result = failedAgentCandidateRun(\n      state,\n      redactProtectedReason(errorMessage(execution.error), protectedValues),\n      execution.termination,\n      settlementResult.settlement.usage,\n    )\n  } else if (!execution.finalCapture.taskOutcome) {\n    result = failedAgentCandidateRun(\n      state,\n      'candidate executor stopped without a captured task outcome',\n      execution.termination,\n      settlementResult.settlement.usage,\n    )\n  } else {\n    const capture =\n      execution.kind === 'capture'\n        ? execution.capture\n        : {\n            executionId: state.executionId,\n            termination: execution.termination,\n          }\n    try {\n      const resultDeadlineAtMs = Math.min(\n        Date.now() + resultTimeoutMs,\n        acquired.lease.expiresAtMs - candidateTerminalWindowMs(cleanupTimeoutMs),\n      )\n      result = await withinCandidateResultDeadline(\n        async (signal) => {\n          await appendAuthoritativeModelSettlementSpans(\n            options.traceStore,\n            persistedTrace.runId,\n            settlementResult.settlement as SealedAgentCandidateModelSettlement,\n          )\n          const { persistedCapture, taskOutcome } =\n            await persistVerifiedAgentCandidateExecutorCapture(\n              state,\n              execution.finalCapture,\n              options.outputArtifacts,\n              protectedValues,\n              signal,\n            )\n          const benchmarkResult = await persistCandidateBenchmarkResult(\n            state,\n            capture.termination,\n            taskOutcome,\n            options.grader,\n            options.outputArtifacts,\n            protectedValues,\n            signal,\n          )\n          return await finalizeAgentCandidateRun(\n            state,\n            capture,\n            options.traceStore,\n            persistedTrace,\n            settlementResult.settlement as SealedAgentCandidateModelSettlement,\n            {\n              finalCapture: execution.finalCapture,\n              persistedCapture,\n              modelSettlement,\n              taskOutcome,\n              benchmarkResult,\n              outputArtifacts: options.outputArtifacts,\n            },\n            protectedValues,\n            protectedTrace.report(),\n            signal,\n          )\n        },\n        resultDeadlineAtMs,\n        'candidate evidence finalization',\n      )\n    } catch (error) {\n      result = failedAgentCandidateRun(\n        state,\n        redactProtectedReason(errorMessage(error), protectedValues),\n        execution.termination,\n        settlementResult.settlement.usage,\n      )\n    }\n  }\n\n  let terminal: AgentCandidateExecutionTerminalResult\n  try {\n    terminal = result.succeeded\n      ? {\n          status: 'succeeded',\n          usage: settlementResult.settlement.usage,\n          modelSettlement: result.artifacts.modelSettlement,\n          taskOutcome: result.artifacts.taskOutcome,\n          benchmarkResult: result.artifacts.benchmarkResult,\n          runReceipt: result.artifacts.runReceipt,\n        }\n      : {\n          status: 'failed',\n          failureClass,\n          usage: settlementResult.settlement.usage,\n          modelSettlement: modelSettlement.artifact,\n          failureEvidence: await withinCandidateCleanupDeadline(\n            () =>\n              persistFailureEvidence(\n                state,\n                result.reason,\n                failureClass,\n                execution.termination,\n                options.outputArtifacts,\n              ),\n            acquired.lease.expiresAtMs,\n            'candidate failure-evidence persistence',\n          ),\n        }\n  } catch (error) {\n    consumePreparedCandidateExecution(prepared, 'failed')\n    return failedAgentCandidateRun(\n      state,\n      redactProtectedReason(\n        joinErrors(\n          error,\n          new Error('candidate claim remains recoverable until terminal evidence is durable'),\n        ),\n        protectedValues,\n      ),\n      execution.termination,\n      settlementResult.settlement.usage,\n    )\n  }\n\n  const finished = await finishClaim(\n    options.claimStore,\n    acquired.lease,\n    terminal,\n    acquired.lease.expiresAtMs,\n  )\n  if (finished) {\n    consumePreparedCandidateExecution(prepared, result.succeeded ? 'succeeded' : 'failed')\n    return result\n  }\n\n  consumePreparedCandidateExecution(prepared, 'failed')\n  return failedAgentCandidateRun(\n    state,\n    'candidate execution terminal record could not be persisted',\n    execution.termination,\n    settlementResult.settlement.usage,\n  )\n}\n\ntype ExecutorOutcome =\n  | {\n      kind: 'capture'\n      capture: AgentCandidateProtectedRunCapture\n      termination: AgentCandidateTermination\n      finalCapture: SealedAgentCandidateExecutorFinalCapture\n      processStopped: true\n      error?: undefined\n    }\n  | {\n      kind: 'timeout'\n      termination: AgentCandidateTermination & { kind: 'timeout' }\n      finalCapture: SealedAgentCandidateExecutorFinalCapture\n      processStopped: true\n      error?: undefined\n    }\n  | {\n      kind: 'error'\n      error: unknown\n      termination?: AgentCandidateTermination\n      finalCapture?: SealedAgentCandidateExecutorFinalCapture\n      processStopped: boolean\n    }\n\nasync function runAndStopExecutor(\n  executor: AgentCandidateExecutorPort,\n  request: AgentCandidateExecutorRequest,\n  expectedOutcome: AgentCandidateTaskOutcomeSpec,\n  traceStore: TraceStore,\n  deadlineAtMs: number,\n  cleanupTimeoutMs: number,\n): Promise<ExecutorOutcome> {\n  const timeoutMs = request.hardLimits.timeoutMs\n  const timeoutError = new CandidateExecutionDeadlineError(timeoutMs)\n  if (Date.now() >= deadlineAtMs) {\n    return {\n      kind: 'error',\n      error: timeoutError,\n      termination: { kind: 'timeout', timeoutMs },\n      processStopped: true,\n    }\n  }\n  const controller = new AbortController()\n  let timer: ReturnType<typeof setTimeout> | undefined\n  let timedOut = false\n  let capture: AgentCandidateProtectedRunCapture | undefined\n  let executionError: unknown\n  const executionPromise = Promise.resolve().then(() =>\n    executor.execute(request, {\n      traceStore,\n      signal: controller.signal,\n      deadlineAtMs,\n    }),\n  )\n  // A stopped process may still leave a buggy adapter promise pending. Attach a\n  // terminal handler now so the deadline path cannot create an unhandled rejection.\n  void executionPromise.catch(() => undefined)\n  const deadlinePromise = new Promise<never>((_resolve, reject) => {\n    timer = setTimeout(\n      () => {\n        timedOut = true\n        controller.abort(timeoutError)\n        reject(timeoutError)\n      },\n      Math.max(0, deadlineAtMs - Date.now()),\n    )\n  })\n  void deadlinePromise.catch(() => undefined)\n  try {\n    capture = sealAgentCandidateProtectedRunCapture(\n      await Promise.race([executionPromise, deadlinePromise]),\n    )\n  } catch (error) {\n    executionError = error\n  }\n\n  if (!timedOut && capture && capture.executionId !== request.executionId) {\n    executionError = new Error('candidate execution capture id does not match the request')\n    capture = undefined\n  } else if (!timedOut && capture && Date.now() >= deadlineAtMs) {\n    // Promise resolution at the boundary is ambiguous under event-loop delay.\n    // Fail closed unless completion is observed strictly before the deadline.\n    timedOut = true\n    executionError = timeoutError\n    capture = undefined\n  } else if (!timedOut && capture?.termination.kind === 'timeout') {\n    executionError = new Error('candidate executor cannot declare the runtime-owned timeout')\n    capture = undefined\n  }\n\n  if (!capture || timedOut) controller.abort(executionError)\n  const stopReason = timedOut ? 'timeout' : capture ? 'completed' : 'failed'\n  const cleanupDeadlineAtMs = Date.now() + cleanupTimeoutMs\n  try {\n    const stopped = await withinCandidateCleanupDeadline(\n      (cleanupSignal) =>\n        executor.stop(\n          {\n            executionId: request.executionId,\n            executionPlanDigest: request.executionPlan.value.digest,\n          },\n          {\n            traceStore,\n            reason: stopReason,\n            signal: cleanupSignal,\n            deadlineAtMs: cleanupDeadlineAtMs,\n          },\n        ),\n      cleanupDeadlineAtMs,\n      'candidate process termination',\n    )\n    sealAgentCandidateExecutorStopAcknowledgement(stopped)\n  } catch (stopError) {\n    let disposalError: unknown\n    try {\n      await disposeExecutor(executor, request, cleanupDeadlineAtMs)\n    } catch (error) {\n      disposalError = error\n    }\n    if (timer) clearTimeout(timer)\n    controller.abort(stopError)\n    return {\n      kind: 'error',\n      error: new Error(joinErrors(executionError, stopError, disposalError)),\n      ...(timedOut ? { termination: { kind: 'timeout', timeoutMs } } : {}),\n      processStopped: false,\n    }\n  }\n\n  let finalCapture: SealedAgentCandidateExecutorFinalCapture | undefined\n  let finalCaptureError: unknown\n  try {\n    finalCapture = sealAgentCandidateExecutorFinalCapture(\n      await withinCandidateCleanupDeadline(\n        (cleanupSignal) =>\n          executor.capture(\n            {\n              executionId: request.executionId,\n              executionPlanDigest: request.executionPlan.value.digest,\n            },\n            {\n              traceStore,\n              signal: cleanupSignal,\n            },\n          ),\n        cleanupDeadlineAtMs,\n        'candidate final evidence capture',\n      ),\n      expectedOutcome,\n    )\n  } catch (captureError) {\n    finalCaptureError = captureError\n  }\n\n  let disposalError: unknown\n  try {\n    await disposeExecutor(executor, request, cleanupDeadlineAtMs)\n  } catch (disposeError) {\n    disposalError = disposeError\n  }\n  if (finalCaptureError || disposalError || !finalCapture) {\n    if (timer) clearTimeout(timer)\n    controller.abort(finalCaptureError ?? disposalError)\n    return {\n      kind: 'error',\n      error: new Error(joinErrors(executionError, finalCaptureError, disposalError)),\n      ...(timedOut ? { termination: { kind: 'timeout', timeoutMs } } : {}),\n      processStopped: true,\n    }\n  }\n\n  if (Date.now() >= deadlineAtMs) {\n    timedOut = true\n    executionError = timeoutError\n    capture = undefined\n    controller.abort(timeoutError)\n  }\n  if (timer) clearTimeout(timer)\n\n  if (timedOut) {\n    return {\n      kind: 'timeout',\n      termination: { kind: 'timeout', timeoutMs },\n      finalCapture,\n      processStopped: true,\n    }\n  }\n  if (executionError || !capture) {\n    return {\n      kind: 'error',\n      error: executionError ?? new Error('candidate executor returned no capture'),\n      finalCapture,\n      processStopped: true,\n    }\n  }\n  return {\n    kind: 'capture',\n    capture,\n    termination: capture.termination,\n    finalCapture,\n    processStopped: true,\n  }\n}\n\nasync function disposeExecutor(\n  executor: AgentCandidateExecutorPort,\n  request: AgentCandidateExecutorRequest,\n  cleanupDeadlineAtMs: number,\n): Promise<void> {\n  const dispose = executor.dispose\n  if (!dispose) return\n  const disposed = await withinCandidateCleanupDeadline(\n    (cleanupSignal) =>\n      dispose.call(\n        executor,\n        {\n          executionId: request.executionId,\n          executionPlanDigest: request.executionPlan.value.digest,\n        },\n        { signal: cleanupSignal },\n      ),\n    cleanupDeadlineAtMs,\n    'candidate execution resource disposal',\n  )\n  if (disposed?.disposed !== true || Object.keys(disposed).some((key) => key !== 'disposed')) {\n    throw new Error('candidate executor did not acknowledge resource disposal')\n  }\n}\n\nasync function failBeforeActivation(\n  prepared: PreparedAgentCandidateExecution,\n  state: PreparedCandidateState,\n  error: unknown,\n  reason: 'failed' | 'replayed',\n  cleanupTimeoutMs: number,\n): Promise<AgentCandidateRunFinalization> {\n  beginPreparedCandidateSettlement(prepared)\n  const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs)\n  const [memoryClose, settled] = await Promise.all([\n    closeMemoryAccess(state, reason, cleanupDeadlineAtMs),\n    settleModelGrant(state, reason, cleanupDeadlineAtMs),\n  ])\n  const cleanupProven = memoryClose.closed && settled.settlement !== undefined\n  consumePreparedCandidateExecution(prepared, cleanupProven ? 'failed' : 'cleanup-failed')\n  return failedAgentCandidateRun(\n    state,\n    redactProtectedReason(\n      joinErrors(\n        error,\n        memoryClose.error,\n        settled.error,\n        !cleanupProven\n          ? new Error('prepared access cleanup remains incomplete and may be retried by disposal')\n          : undefined,\n      ),\n      [],\n    ),\n    undefined,\n    settled.settlement?.usage ?? null,\n  )\n}\n\nasync function failClaimedExecution(\n  prepared: PreparedAgentCandidateExecution,\n  state: PreparedCandidateState,\n  lease: AgentCandidateExecutionLease,\n  claimStore: AgentCandidateExecutionClaimStore,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n  error: unknown,\n  reason: 'failed',\n  cleanupTimeoutMs: number,\n  failureClass: AgentCandidateExecutionFailureClass,\n  activation?: AgentCandidateProtectedModelActivation,\n  memoryActivation?: { env: Readonly<Record<string, string>> },\n): Promise<AgentCandidateRunFinalization> {\n  beginPreparedCandidateSettlement(prepared)\n  const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs)\n  const [memoryClose, settled] = await Promise.all([\n    closeMemoryAccess(state, reason, cleanupDeadlineAtMs),\n    settleModelGrant(state, reason, cleanupDeadlineAtMs),\n  ])\n  const protectedValues = protectedEnvironmentValues(activation, memoryActivation)\n  const safeReason = redactProtectedReason(\n    joinErrors(error, memoryClose.error, settled.error),\n    protectedValues,\n  )\n  let finishFailed = false\n  let persistenceFailure: unknown\n  if (settled.settlement && memoryClose.closed) {\n    try {\n      const modelSettlement = await withinCandidateCleanupDeadline(\n        () => persistCandidateModelSettlement(state, settled.settlement!, outputArtifacts),\n        lease.expiresAtMs,\n        'candidate pre-run model-settlement persistence',\n      )\n      const failureEvidence = await withinCandidateCleanupDeadline(\n        () => persistFailureEvidence(state, safeReason, failureClass, undefined, outputArtifacts),\n        lease.expiresAtMs,\n        'candidate pre-run failure-evidence persistence',\n      )\n      finishFailed = !(await finishClaim(\n        claimStore,\n        lease,\n        {\n          status: 'failed',\n          failureClass,\n          usage: settled.settlement.usage,\n          modelSettlement: modelSettlement.artifact,\n          failureEvidence,\n        },\n        lease.expiresAtMs,\n      ))\n    } catch (persistenceError) {\n      finishFailed = true\n      persistenceFailure = persistenceError\n    }\n  }\n  consumePreparedCandidateExecution(prepared, 'failed')\n  return failedAgentCandidateRun(\n    state,\n    redactProtectedReason(\n      joinErrors(\n        safeReason,\n        persistenceFailure,\n        memoryClose.error,\n        settled.error,\n        !memoryClose.closed || !settled.settlement\n          ? new Error('candidate claim remains recoverable until protected cleanup is proven')\n          : undefined,\n        finishFailed\n          ? new Error('candidate execution terminal record could not be persisted')\n          : undefined,\n      ),\n      protectedValues,\n    ),\n    undefined,\n    settled.settlement?.usage ?? null,\n  )\n}\n\nasync function closeMemoryAccess(\n  state: PreparedCandidateState,\n  reason: 'completed' | 'failed' | 'timeout' | 'replayed',\n  cleanupDeadlineAtMs: number,\n): Promise<{ closed: true; error?: undefined } | { closed: false; error: unknown }> {\n  if (state.memory.mode === 'disabled') return { closed: true }\n  try {\n    const reservation = state.memoryReservation\n    if (!reservation) throw new Error('isolated memory reservation is missing')\n    const closed = await withinCandidateCleanupDeadline(\n      () =>\n        state.ports.memory.close({\n          executionId: state.executionId,\n          preparationId: reservation.preparationId,\n          accessDigest: reservation.accessDigest,\n          effectiveNamespace: reservation.effectiveNamespace,\n          reason,\n        }),\n      cleanupDeadlineAtMs,\n      'isolated memory closure',\n    )\n    if (closed.closed !== true || Object.keys(closed).some((key) => key !== 'closed')) {\n      throw new Error('isolated memory access did not acknowledge closure')\n    }\n    return { closed: true }\n  } catch (error) {\n    return { closed: false, error }\n  }\n}\n\nasync function settleModelGrant(\n  state: PreparedCandidateState,\n  reason: 'completed' | 'failed' | 'timeout' | 'replayed',\n  cleanupDeadlineAtMs: number,\n): Promise<{\n  settlement?: SealedAgentCandidateModelSettlement\n  error?: unknown\n}> {\n  try {\n    const value = await withinCandidateCleanupDeadline(\n      () =>\n        state.ports.models.settleGrant({\n          executionId: state.executionId,\n          preparationId: state.preparationId,\n          grantDigest: state.modelReservation.digest,\n          resolved: state.resolvedModel,\n          reason,\n        }),\n      cleanupDeadlineAtMs,\n      'protected model settlement',\n    )\n    return {\n      settlement: sealAgentCandidateModelSettlement(value, {\n        preparationId: state.preparationId,\n        grantDigest: state.modelReservation.digest,\n        model: state.resolvedModel.model,\n      }),\n    }\n  } catch (error) {\n    return { error: new Error('protected model settlement failed', { cause: error }) }\n  }\n}\n\nasync function finishClaim(\n  store: AgentCandidateExecutionClaimStore,\n  lease: AgentCandidateExecutionLease,\n  terminal: AgentCandidateExecutionTerminalResult,\n  deadlineAtMs?: number,\n): Promise<boolean> {\n  try {\n    const staged = await withinCandidateCleanupDeadline(\n      () => store.stageTerminal(lease, terminal),\n      deadlineAtMs ?? lease.expiresAtMs,\n      'candidate terminal staging',\n    )\n    if (!staged.staged && !staged.exactReplay) return false\n    const result = await withinCandidateCleanupDeadline(\n      () => store.finish(lease, staged.terminal.terminalDigest),\n      deadlineAtMs ?? lease.expiresAtMs,\n      'candidate terminal publication',\n    )\n    return result.finished || result.exactReplay\n  } catch {\n    return false\n  }\n}\n\nasync function persistFailureEvidence(\n  state: PreparedCandidateState,\n  reason: string,\n  failureClass: AgentCandidateExecutionFailureClass,\n  termination: AgentCandidateTermination | undefined,\n  outputArtifacts: AgentCandidateOutputArtifactPort,\n) {\n  const bytes = canonicalCandidateBytes({\n    kind: 'agent-candidate-execution-failure',\n    executionId: state.executionId,\n    bundleDigest: state.bundle.digest,\n    executionPlanDigest: state.executionPlan.value.digest,\n    failureClass,\n    reason,\n    ...(termination ? { termination } : {}),\n  })\n  return await persistCandidateOutputArtifact(outputArtifacts, {\n    executionId: state.executionId,\n    purpose: 'failure-evidence',\n    bytes,\n  })\n}\n\nfunction protectedEnvironmentValues(\n  activation?: AgentCandidateProtectedModelActivation,\n  memoryActivation?: { env: Readonly<Record<string, string>> },\n): string[] {\n  return [...Object.values(activation?.env ?? {}), ...Object.values(memoryActivation?.env ?? {})]\n}\n\nfunction joinErrors(...errors: unknown[]): string {\n  return errors\n    .filter((error) => error !== undefined)\n    .map(errorMessage)\n    .join('; ')\n}\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error)\n}\n\nclass CandidateExecutionDeadlineError extends Error {\n  constructor(timeoutMs: number) {\n    super(`candidate execution reached its frozen ${timeoutMs}ms deadline`)\n    this.name = 'CandidateExecutionDeadlineError'\n  }\n}\n","import { randomBytes } from 'node:crypto'\nimport { lstat, readdir } from 'node:fs/promises'\nimport { isAbsolute, posix, relative, resolve as resolveHostPath } from 'node:path'\n\nimport type {\n  AgentCandidateConfigValue,\n  AgentCandidateEffectiveMemory,\n  AgentCandidateExecutionLimits,\n  AgentCandidateExecutionPlanEvidence,\n  AgentCandidateExecutionPlanMaterial,\n  AgentCandidateMaterializationReceipt,\n  AgentCandidateModelAccessNetwork,\n  AgentCandidateResolvedModel,\n} from '@tangle-network/agent-interface'\nimport {\n  agentCandidateBenchmarkSuiteSchema,\n  agentCandidateBenchmarkTaskSchema,\n  agentCandidateContainerSchema,\n  agentCandidateExecutionLimitsSchema,\n  agentCandidateExecutionPlanEvidenceSchema,\n  agentCandidateExecutionPlanMaterialSchema,\n  agentCandidateMaterializationReceiptSchema,\n  agentCandidateModelAccessNetworkSchema,\n  agentCandidateRunCellSchema,\n  agentCandidateTaskOutcomeSpecSchema,\n  agentCandidateWorkspaceSnapshotEvidenceSchema,\n  sha256DigestSchema,\n} from '@tangle-network/agent-interface'\nimport { applyAgentCandidateWorkspacePlan } from '@tangle-network/agent-profile-materialize'\n\nimport {\n  readMaterializedWorkspaceFiles,\n  readVerifiedArtifact,\n  verifyMaterializedProfileWorkspace,\n  verifyMaterializedWorkspace,\n  verifyWorkspaceSnapshotArtifacts,\n} from './artifacts'\nimport {\n  candidateCleanupDeadline,\n  candidateCleanupTimeout,\n  candidateResultTimeout,\n  MAX_CANDIDATE_TIMER_INTERVAL_MS,\n  withinCandidateCleanupDeadline,\n} from './cleanup'\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  canonicalCandidateDocument,\n  embeddedCandidateArtifact,\n  omitTopLevelDigest,\n  sha256Bytes,\n} from './digest'\nimport { candidateExecutionOwnerWindowMs } from './execution-window'\nimport { verifyTaskCheckout } from './git-materialize'\nimport {\n  CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV,\n  CANDIDATE_KNOWLEDGE_ROOT_ENV,\n  candidateKnowledgeExecutionPaths,\n  prepareAgentCandidateKnowledge,\n} from './knowledge'\nimport { sealAgentCandidateModelSettlement, usdToNanos } from './model-settlement'\nimport { createPreparedCandidateExecution } from './prepared-state'\nimport { materializeAgentCandidateProfilePlan } from './profile'\nimport {\n  type AgentCandidateExecutionPorts,\n  type AgentCandidateTaskExecution,\n  CANDIDATE_TRACE_ENV,\n  CANDIDATE_TRACE_TAGS,\n  type PreparedAgentCandidateExecution,\n  type ResolvedAgentCandidateContainer,\n  type VerifiedAgentCandidate,\n} from './types'\nimport {\n  getVerifiedCandidateState,\n  verifiedArtifactBytes,\n  verifiedResourceTextByDigest,\n} from './verify'\n\nconst MIN_RESERVATION_TTL_MS = 15 * 60_000\nconst PREPARED_HOLD_MARGIN_MS = 5 * 60_000\n\nexport interface PrepareAgentCandidateExecutionOptions {\n  cleanupTimeoutMs?: number\n  /** Maximum time for task verification, executable grading, and receipt construction. */\n  resultTimeoutMs?: number\n}\n\n/** Materializes a verified candidate into one immutable evaluator-owned execution plan. */\nexport async function prepareAgentCandidateExecution(\n  candidate: VerifiedAgentCandidate,\n  task: AgentCandidateTaskExecution,\n  ports: AgentCandidateExecutionPorts,\n  options: PrepareAgentCandidateExecutionOptions = {},\n): Promise<PreparedAgentCandidateExecution> {\n  const cleanupTimeoutMs = candidateCleanupTimeout(options.cleanupTimeoutMs)\n  const verifiedState = getVerifiedCandidateState(candidate)\n  assertSameVerificationPorts(verifiedState.ports, ports)\n  const bundle = candidate.bundle\n  if (task.runCell.bundleDigest !== bundle.digest) {\n    throw new Error('candidate experiment cell does not bind the verified bundle')\n  }\n  const benchmarkTask = task.task\n  const attempt = {\n    number: task.runCell.attempt,\n    maxAttempts: benchmarkTask.attempt.maxAttempts,\n    retryPolicy: benchmarkTask.attempt.retryPolicy,\n  } as const\n  assertTaskInput(task, bundle.execution.instructionDelivery)\n  const resultTimeoutMs = candidateResultTimeout(\n    options.resultTimeoutMs,\n    benchmarkTask.limits.timeoutMs,\n  )\n  const ownerWindowMs = candidateExecutionOwnerWindowMs(\n    benchmarkTask.limits.timeoutMs,\n    cleanupTimeoutMs,\n    resultTimeoutMs,\n  )\n  const reservationWindowMs = ownerWindowMs + PREPARED_HOLD_MARGIN_MS\n  if (reservationWindowMs > MAX_CANDIDATE_TIMER_INTERVAL_MS) {\n    throw new Error('candidate reservation window exceeds the supported timer range')\n  }\n  assertDisjointHostStagingRoots(task)\n\n  const instructionBytes = Buffer.from(benchmarkTask.instruction, 'utf8')\n\n  const taskArtifacts = await verifyWorkspaceSnapshotArtifacts(\n    benchmarkTask.workspace,\n    ports.artifacts,\n  )\n  await ports.workspaces.materialize({\n    role: 'task',\n    snapshot: benchmarkTask.workspace,\n    archive: taskArtifacts.archive,\n    destination: task.stagingRoots.taskRoot,\n  })\n  await verifyMaterializedWorkspace(task.stagingRoots.taskRoot, benchmarkTask.workspace.material, {\n    ignoredProtectedRootEntries: ['.git', '.sidecar'],\n  })\n  if (benchmarkTask.repository) {\n    await verifyTaskCheckout(task.stagingRoots.taskRoot, benchmarkTask.repository)\n  }\n  const taskExecutorFiles = await readMaterializedWorkspaceFiles(\n    task.stagingRoots.taskRoot,\n    benchmarkTask.workspace.material,\n    { ignoredProtectedRootEntries: ['.git', '.sidecar'] },\n  )\n\n  let candidateArchive: Uint8Array | undefined\n  let candidateExecutorFiles:\n    | ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>\n    | undefined\n  if (bundle.execution.workspace) {\n    if (!task.stagingRoots.candidateRoot || !task.executionRoots.candidateRoot) {\n      throw new Error('active candidate execution requires host and container candidate roots')\n    }\n    candidateArchive = await verifiedArtifactBytes(candidate, bundle.execution.workspace.archive)\n    await ports.workspaces.materialize({\n      role: 'candidate',\n      snapshot: bundle.execution.workspace,\n      archive: candidateArchive,\n      destination: task.stagingRoots.candidateRoot,\n    })\n    await verifyMaterializedWorkspace(\n      task.stagingRoots.candidateRoot,\n      bundle.execution.workspace.material,\n    )\n    candidateExecutorFiles = await readMaterializedWorkspaceFiles(\n      task.stagingRoots.candidateRoot,\n      bundle.execution.workspace.material,\n    )\n  } else if (task.stagingRoots.candidateRoot || task.executionRoots.candidateRoot) {\n    throw new Error('disabled code cannot receive a candidate workspace root')\n  }\n\n  await assertEmptyDirectory(task.stagingRoots.profileRoot)\n  const profileWorkspacePlan = materializeAgentCandidateProfilePlan({\n    profile: bundle.profile,\n    harness: bundle.execution.harness,\n    launch: bundle.execution.launch,\n    workspace: bundle.execution.cwd.workspace,\n    workspaces: task.executionRoots,\n    resolvedResources: verifiedResourceTextByDigest(candidate),\n  })\n  const profileApplication = applyAgentCandidateWorkspacePlan(\n    profileWorkspacePlan,\n    task.stagingRoots.profileRoot,\n    bundle.execution.cwd.workspace,\n  )\n  await verifyMaterializedProfileWorkspace(\n    task.stagingRoots.profileRoot,\n    profileApplication.profileActivation.profilePlan.material,\n  )\n  const profilePlanBytes = await readVerifiedArtifact(\n    profileApplication.profileActivation.profilePlan.artifact,\n    ports.artifacts,\n  )\n  if (\n    !Buffer.from(profilePlanBytes).equals(\n      Buffer.from(\n        canonicalCandidateBytes(profileApplication.profileActivation.profilePlan.material),\n      ),\n    )\n  ) {\n    throw new Error('profile materializer did not capture exact canonical plan bytes')\n  }\n  const profileActivation = profileApplication.profileActivation\n\n  const container = await resolveContainer(candidate, task, ports)\n  const resolvedModel = await resolveModel(candidate, task, ports)\n  const preparationId = `candidate-preparation.${randomBytes(32).toString('base64url')}`\n  const reservationExpiresAtMs = Date.now() + Math.max(MIN_RESERVATION_TTL_MS, reservationWindowMs)\n  const modelReservation = await withinCandidateCleanupDeadline(\n    () =>\n      ports.models.reserveGrant({\n        executionId: task.executionId,\n        preparationId,\n        expiresAtMs: reservationExpiresAtMs,\n        attempt,\n        bundleDigest: bundle.digest,\n        resolved: resolvedModel,\n        limits: modelLimits(benchmarkTask.limits),\n      }),\n    candidateCleanupDeadline(cleanupTimeoutMs),\n    'protected model reservation',\n  )\n  let preparedMemory: Awaited<ReturnType<typeof prepareMemory>> | undefined\n  try {\n    validateProtectedModelReservation(\n      modelReservation,\n      benchmarkTask.limits,\n      preparationId,\n      reservationExpiresAtMs,\n    )\n    preparedMemory = await prepareMemory(\n      candidate,\n      task,\n      ports,\n      preparationId,\n      reservationExpiresAtMs,\n      cleanupTimeoutMs,\n    )\n    const memory = preparedMemory.value\n    const knowledge = await prepareAgentCandidateKnowledge(candidate, ports, task.runCell.arm)\n    const knowledgePaths = knowledge\n      ? candidateKnowledgeExecutionPaths(\n          task.executionRoots.taskRoot,\n          knowledge.retrievalConfig !== undefined,\n        )\n      : undefined\n    const baseLaunch = buildLaunch(candidate, task, profileApplication.flags)\n    const publicEnv = mergePublicEnvironment(\n      bundle.execution.env ?? {},\n      profileApplication.env,\n      bundle.execution.instructionDelivery.kind === 'utf8-file'\n        ? {\n            [bundle.execution.instructionDelivery.env]: {\n              kind: 'public',\n              value: bundle.execution.instructionDelivery.path,\n            },\n          }\n        : {},\n      knowledgePaths\n        ? {\n            [CANDIDATE_KNOWLEDGE_ROOT_ENV]: {\n              kind: 'public',\n              value: knowledgePaths.root,\n            },\n            ...(knowledgePaths.retrievalConfig\n              ? {\n                  [CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV]: {\n                    kind: 'public' as const,\n                    value: knowledgePaths.retrievalConfig,\n                  },\n                }\n              : {}),\n          }\n        : {},\n    )\n    const routes = modelRoutes(bundle.profile, benchmarkTask.model.requested)\n    const executionMaterial: AgentCandidateExecutionPlanMaterial = {\n      kind: 'agent-candidate-execution-plan-material',\n      runCell: task.runCell,\n      executionId: task.executionId,\n      workspaces: {\n        taskRoot: task.executionRoots.taskRoot,\n        ...(task.executionRoots.candidateRoot\n          ? { candidateRoot: task.executionRoots.candidateRoot }\n          : {}),\n      },\n      codeKind: bundle.code.kind,\n      ...(bundle.execution.workspace ? { candidateWorkspace: bundle.execution.workspace } : {}),\n      profile: profileApplication.application,\n      harness: bundle.execution.harness,\n      harnessVersion: bundle.execution.harnessVersion,\n      instructionDelivery: bundle.execution.instructionDelivery,\n      limits: benchmarkTask.limits,\n      container,\n      model: {\n        policy: 'single',\n        resolved: resolvedModel,\n        access: {\n          kind: 'evaluator-mediated',\n          grantDigest: modelReservation.digest,\n          network: modelReservation.network,\n        },\n        routes,\n      },\n      launch: {\n        executable: baseLaunch.executable,\n        args: baseLaunch.args,\n        env: publicEnv,\n        cwd: bundle.execution.cwd,\n      },\n      ...(bundle.knowledge ? { knowledgeManifestDigest: bundle.knowledge.snapshot.digest } : {}),\n      memory,\n      network: { mode: 'disabled' },\n    }\n    agentCandidateExecutionPlanMaterialSchema.parse(executionMaterial)\n    const executionBytes = canonicalCandidateBytes(executionMaterial)\n    const executionDigest = canonicalCandidateDigest(executionMaterial)\n    if (sha256Bytes(executionBytes) !== executionDigest) {\n      throw new Error('execution plan canonical serializers disagree')\n    }\n    const executionPlan: AgentCandidateExecutionPlanEvidence =\n      agentCandidateExecutionPlanEvidenceSchema.parse({\n        kind: 'agent-candidate-execution-plan',\n        digest: executionDigest,\n        material: executionMaterial,\n        artifact: embeddedCandidateArtifact(executionBytes),\n      })\n\n    const entrypoint = candidateEntrypointReceipt(candidate)\n    const materializationReceipt = canonicalCandidateDocument<AgentCandidateMaterializationReceipt>(\n      {\n        kind: 'agent-candidate-materialization',\n        digestAlgorithm: 'rfc8785-sha256',\n        bundleDigest: bundle.digest,\n        benchmark: {\n          suite: {\n            digest: task.benchmarkSuite.digest,\n            material: embeddedCandidateArtifact(\n              canonicalCandidateBytes(omitTopLevelDigest(task.benchmarkSuite)),\n            ),\n          },\n          task: {\n            digest: benchmarkTask.digest,\n            material: embeddedCandidateArtifact(\n              canonicalCandidateBytes(omitTopLevelDigest(benchmarkTask)),\n            ),\n          },\n        },\n        profileActivation,\n        executionPlan,\n        ...(bundle.execution.workspace ? { candidateWorkspace: bundle.execution.workspace } : {}),\n        codeKind: bundle.code.kind,\n        ...(candidate.materializedTree ? { materializedTree: candidate.materializedTree } : {}),\n        harness: bundle.execution.harness,\n        harnessVersion: bundle.execution.harnessVersion,\n        container,\n        resolvedModel,\n        ...(bundle.knowledge ? { knowledgeManifestDigest: bundle.knowledge.snapshot.digest } : {}),\n        ...(entrypoint ? { entrypoint } : {}),\n      },\n    )\n    agentCandidateMaterializationReceiptSchema.parse(materializationReceipt.value)\n\n    const traceRunId = `${task.executionId}:attempt-${attempt.number}:${canonicalCandidateDigest({ preparationId }).slice(7, 23)}`\n    const traceTags = {\n      [CANDIDATE_TRACE_TAGS.executionId]: task.executionId,\n      [CANDIDATE_TRACE_TAGS.bundleDigest]: bundle.digest,\n      [CANDIDATE_TRACE_TAGS.executionPlanDigest]: executionPlan.digest,\n      [CANDIDATE_TRACE_TAGS.materializationReceiptDigest]: materializationReceipt.digest,\n    }\n    const traceEnv = {\n      [CANDIDATE_TRACE_ENV.executionId]: task.executionId,\n      [CANDIDATE_TRACE_ENV.bundleDigest]: bundle.digest,\n      [CANDIDATE_TRACE_ENV.executionPlanDigest]: executionPlan.digest,\n      [CANDIDATE_TRACE_ENV.materializationReceiptDigest]: materializationReceipt.digest,\n      [CANDIDATE_TRACE_ENV.traceRunId]: traceRunId,\n    }\n    assertEnvironmentDisjoint(publicEnv, traceEnv)\n\n    return createPreparedCandidateExecution({\n      ports,\n      bundle,\n      benchmarkSuite: task.benchmarkSuite,\n      benchmarkTask,\n      executionId: task.executionId,\n      roots: {\n        execution: { ...task.executionRoots },\n        staging: { ...task.stagingRoots },\n      },\n      profilePlan: {\n        value: profileApplication.profileActivation.profilePlan,\n        bytes: profilePlanBytes,\n        written: [...profileApplication.application.mountPaths],\n      },\n      profileActivation,\n      executionPlan: { value: executionPlan, bytes: executionBytes },\n      materializationReceipt,\n      launch: {\n        executable: baseLaunch.executable,\n        args: baseLaunch.args.map((value) => value.value),\n        env: unwrapPublicEnvironment(publicEnv),\n        flags: profileApplication.flags.map((value) => value.value),\n        cwd: absoluteExecutionCwd(bundle.execution.cwd, task.executionRoots),\n      },\n      instruction: {\n        bytes: Uint8Array.from(instructionBytes),\n        delivery: bundle.execution.instructionDelivery,\n      },\n      resolvedModel,\n      preparationId,\n      reservationExpiresAtMs,\n      cleanupTimeoutMs,\n      resultTimeoutMs,\n      modelReservation: {\n        preparationId: modelReservation.preparationId,\n        digest: modelReservation.digest,\n        expiresAtMs: modelReservation.expiresAtMs,\n        enforcedLimits: modelReservation.enforcedLimits,\n        network: modelReservation.network,\n      },\n      executorInputs: {\n        taskFiles: taskExecutorFiles,\n        ...(candidateExecutorFiles ? { candidateFiles: candidateExecutorFiles } : {}),\n        profileFiles: exactProfileExecutorFiles(\n          profileWorkspacePlan.files,\n          profileApplication.profileActivation.profilePlan.material.files,\n        ),\n      },\n      ...(preparedMemory.accessDigest && preparedMemory.value.mode === 'isolated'\n        ? {\n            memoryReservation: {\n              preparationId,\n              accessDigest: preparedMemory.accessDigest,\n              expiresAtMs: reservationExpiresAtMs,\n              effectiveNamespace: preparedMemory.value.effectiveNamespace,\n            },\n          }\n        : {}),\n      ...(knowledge ? { knowledge } : {}),\n      trace: { runId: traceRunId, tags: traceTags, env: traceEnv },\n      memory,\n    })\n  } catch (error) {\n    const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs)\n    const cleanup: Array<Promise<unknown>> = []\n    if (preparedMemory?.value.mode === 'isolated') {\n      const accessDigest = preparedMemory.accessDigest\n      const effectiveNamespace = preparedMemory.value.effectiveNamespace\n      if (!accessDigest) throw new Error('isolated memory preparation is missing access identity')\n      cleanup.push(\n        withinCandidateCleanupDeadline(\n          async () => {\n            const closed = await ports.memory.close({\n              executionId: task.executionId,\n              preparationId,\n              accessDigest,\n              effectiveNamespace,\n              reason: 'preparation-failed',\n            })\n            if (closed.closed !== true || Object.keys(closed).some((key) => key !== 'closed')) {\n              throw new Error('failed preparation did not close isolated memory access')\n            }\n          },\n          cleanupDeadlineAtMs,\n          'failed preparation memory cleanup',\n        ),\n      )\n    }\n    cleanup.push(\n      withinCandidateCleanupDeadline(\n        async () => {\n          const settlement = sealAgentCandidateModelSettlement(\n            await ports.models.settleGrant({\n              executionId: task.executionId,\n              preparationId,\n              grantDigest: modelReservation.digest,\n              resolved: resolvedModel,\n              reason: 'preparation-failed',\n            }),\n            {\n              preparationId,\n              grantDigest: modelReservation.digest,\n              model: resolvedModel.model,\n            },\n          )\n          if (settlement.usage.modelCalls !== 0) {\n            throw new Error('failed preparation unexpectedly contains model calls')\n          }\n        },\n        cleanupDeadlineAtMs,\n        'failed preparation model cleanup',\n      ),\n    )\n    const cleanupResults = await Promise.allSettled(cleanup)\n    const cleanupErrors = cleanupResults\n      .filter((result): result is PromiseRejectedResult => result.status === 'rejected')\n      .map((result) => result.reason)\n    if (cleanupErrors.length > 0) {\n      throw new Error(\n        `candidate preparation failed and protected access cleanup failed: ${cleanupErrors.map(errorMessage).join('; ')}`,\n        { cause: error },\n      )\n    }\n    throw error\n  }\n}\n\nfunction assertSameVerificationPorts(\n  verified: AgentCandidateExecutionPorts | { artifacts: unknown; repositories: unknown },\n  execution: AgentCandidateExecutionPorts,\n): void {\n  if (\n    verified.artifacts !== execution.artifacts ||\n    verified.repositories !== execution.repositories\n  ) {\n    throw new Error(\n      'prepare must use the same artifact and repository ports that verified the bundle',\n    )\n  }\n}\n\nfunction assertTaskInput(\n  task: AgentCandidateTaskExecution,\n  delivery: VerifiedAgentCandidate['bundle']['execution']['instructionDelivery'],\n): void {\n  const benchmarkTask = agentCandidateBenchmarkTaskSchema.parse(task.task)\n  const benchmarkSuite = agentCandidateBenchmarkSuiteSchema.parse(task.benchmarkSuite)\n  const runCell = agentCandidateRunCellSchema.parse(task.runCell)\n  const requiredStrings: Array<[string, string]> = [\n    ['executionId', task.executionId],\n    ['benchmark', benchmarkTask.benchmark.name],\n    ['benchmarkVersion', benchmarkTask.benchmark.version],\n    ['taskId', benchmarkTask.scenario.id],\n  ]\n  if (benchmarkTask.outcome.kind === 'workspace' && !benchmarkTask.repository) {\n    throw new Error('workspace task outcome requires repository identity')\n  }\n  if (benchmarkTask.repository) {\n    requiredStrings.push(\n      ['repository identity', benchmarkTask.repository.identity],\n      ['repository root identity', benchmarkTask.repository.rootIdentity],\n    )\n  }\n  for (const [name, value] of requiredStrings) {\n    if (!value.trim()) throw new Error(`${name} must be non-empty`)\n  }\n  if (!/^[A-Za-z0-9._:-]{1,200}$/.test(task.executionId)) {\n    throw new Error('executionId must be a stable filesystem-neutral identifier')\n  }\n  if (!benchmarkTask.instruction || !isWellFormedUnicode(benchmarkTask.instruction)) {\n    throw new Error('task instruction must be non-empty well-formed Unicode')\n  }\n  if (\n    canonicalCandidateDigest(omitTopLevelDigest(benchmarkTask)) !== benchmarkTask.digest ||\n    canonicalCandidateDigest(omitTopLevelDigest(benchmarkSuite)) !== benchmarkSuite.digest ||\n    canonicalCandidateDigest(omitTopLevelDigest(runCell)) !== runCell.digest\n  ) {\n    throw new Error('candidate experiment cell contains an invalid content digest')\n  }\n  const cellIndex = runCell.taskIndex * benchmarkSuite.reps + runCell.repetition\n  if (\n    runCell.suiteDigest !== benchmarkSuite.digest ||\n    runCell.taskDigest !== benchmarkTask.digest ||\n    benchmarkSuite.taskDigests[runCell.taskIndex] !== benchmarkTask.digest ||\n    runCell.repetition >= benchmarkSuite.reps ||\n    benchmarkSuite.seeds[cellIndex] !== runCell.seed ||\n    runCell.attempt > benchmarkTask.attempt.maxAttempts\n  ) {\n    throw new Error('candidate experiment cell does not match its signed suite and task')\n  }\n  sha256DigestSchema.parse(benchmarkTask.benchmark.splitDigest)\n  agentCandidateTaskOutcomeSpecSchema.parse(benchmarkTask.outcome)\n  agentCandidateWorkspaceSnapshotEvidenceSchema.parse(benchmarkTask.workspace)\n  agentCandidateExecutionLimitsSchema.parse(benchmarkTask.limits)\n  if (benchmarkTask.repository) {\n    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(benchmarkTask.repository.baseCommit)) {\n      throw new Error('task repository base commit is not a full Git object id')\n    }\n    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(benchmarkTask.repository.baseTree)) {\n      throw new Error('task repository base tree is not a full Git object id')\n    }\n    if (benchmarkTask.repository.baseCommit.length !== benchmarkTask.repository.baseTree.length) {\n      throw new Error('task repository Git object formats disagree')\n    }\n  }\n  for (const [name, root] of [\n    ['execution task root', task.executionRoots.taskRoot],\n    ['execution candidate root', task.executionRoots.candidateRoot],\n    ['staging task root', task.stagingRoots.taskRoot],\n    ['staging candidate root', task.stagingRoots.candidateRoot],\n    ['staging profile root', task.stagingRoots.profileRoot],\n  ] as const) {\n    if (root === undefined) continue\n    const canonical = name.startsWith('execution')\n      ? posix.isAbsolute(root) && posix.normalize(root) === root\n      : isAbsolute(root) && resolveHostPath(root) === root\n    if (!canonical) throw new Error(`${name} must be a canonical absolute path`)\n  }\n  if (\n    !Number.isInteger(runCell.attempt) ||\n    !Number.isInteger(benchmarkTask.attempt.maxAttempts) ||\n    runCell.attempt < 1 ||\n    runCell.attempt > benchmarkTask.attempt.maxAttempts ||\n    (benchmarkTask.attempt.retryPolicy === 'none' && benchmarkTask.attempt.maxAttempts !== 1)\n  ) {\n    throw new Error('task attempt policy is invalid')\n  }\n  const limits = benchmarkTask.limits\n  if (\n    !Number.isInteger(limits.timeoutMs) ||\n    limits.timeoutMs <= 0 ||\n    limits.timeoutMs > MAX_CANDIDATE_TIMER_INTERVAL_MS ||\n    !Number.isInteger(limits.maxSteps) ||\n    limits.maxSteps <= 0 ||\n    !Number.isInteger(limits.maxModelCalls) ||\n    limits.maxModelCalls < 0 ||\n    !Number.isInteger(limits.maxInputTokens) ||\n    limits.maxInputTokens < 0 ||\n    !Number.isInteger(limits.maxOutputTokens) ||\n    limits.maxOutputTokens < 0 ||\n    !Number.isFinite(limits.maxCostUsd) ||\n    limits.maxCostUsd < 0\n  ) {\n    throw new Error('task execution limits are invalid')\n  }\n  usdToNanos(limits.maxCostUsd, 'task maxCostUsd')\n  if (!benchmarkTask.model.requested.trim()) {\n    throw new Error('evaluator model request must be non-empty')\n  }\n  if (!benchmarkTask.grader.name.trim() || !benchmarkTask.grader.version.trim()) {\n    throw new Error('evaluator benchmark grader identity must be non-empty')\n  }\n  if (\n    !Number.isInteger(benchmarkTask.grader.artifact.byteLength) ||\n    benchmarkTask.grader.artifact.byteLength <= 0\n  ) {\n    throw new Error('evaluator benchmark grader artifact must be non-empty')\n  }\n  sha256DigestSchema.parse(benchmarkTask.grader.artifact.sha256)\n  if (benchmarkTask.evaluatorTaskContainer) {\n    if (\n      benchmarkTask.evaluatorTaskContainer.source !== 'evaluator-task-container' ||\n      !benchmarkTask.evaluatorTaskContainer.image.trim() ||\n      !benchmarkTask.evaluatorTaskContainer.platform.os.trim() ||\n      !benchmarkTask.evaluatorTaskContainer.platform.architecture.trim()\n    ) {\n      throw new Error('evaluator task container evidence is incomplete')\n    }\n    sha256DigestSchema.parse(benchmarkTask.evaluatorTaskContainer.indexDigest)\n    sha256DigestSchema.parse(benchmarkTask.evaluatorTaskContainer.manifestDigest)\n    agentCandidateContainerSchema.parse({\n      image: benchmarkTask.evaluatorTaskContainer.image,\n      indexDigest: benchmarkTask.evaluatorTaskContainer.indexDigest,\n    })\n  }\n  if (delivery.kind === 'utf8-file') {\n    if (\n      executionPathsOverlap(task.executionRoots.taskRoot, delivery.path) ||\n      (task.executionRoots.candidateRoot !== undefined &&\n        executionPathsOverlap(task.executionRoots.candidateRoot, delivery.path))\n    ) {\n      throw new Error('task instruction file must remain outside execution workspaces')\n    }\n  }\n}\n\nfunction executionPathsOverlap(left: string, right: string): boolean {\n  const a = posix.normalize(left)\n  const b = posix.normalize(right)\n  return (\n    a === b || b.startsWith(a === '/' ? '/' : `${a}/`) || a.startsWith(b === '/' ? '/' : `${b}/`)\n  )\n}\n\nfunction assertDisjointHostStagingRoots(task: AgentCandidateTaskExecution): void {\n  const roots = [\n    task.stagingRoots.taskRoot,\n    task.stagingRoots.candidateRoot,\n    task.stagingRoots.profileRoot,\n  ]\n    .filter((value): value is string => value !== undefined)\n    .map((value) => resolveHostPath(value))\n  for (let left = 0; left < roots.length; left++) {\n    for (let right = left + 1; right < roots.length; right++) {\n      const a = roots[left]\n      const b = roots[right]\n      if (a && b && (a === b || isContainedPath(a, b) || isContainedPath(b, a))) {\n        throw new Error('host task, candidate, and profile staging roots must be disjoint')\n      }\n    }\n  }\n}\n\nfunction isContainedPath(parent: string, child: string): boolean {\n  const path = relative(parent, child)\n  return path !== '' && !path.startsWith('..') && !isAbsolute(path)\n}\n\nasync function assertEmptyDirectory(path: string): Promise<void> {\n  const stats = await lstat(path)\n  if (!stats.isDirectory() || stats.isSymbolicLink()) {\n    throw new Error('profile staging root must be a real directory')\n  }\n  if ((await readdir(path)).length !== 0) {\n    throw new Error('profile staging root must be empty before materialization')\n  }\n}\n\nasync function resolveContainer(\n  candidate: VerifiedAgentCandidate,\n  task: AgentCandidateTaskExecution,\n  ports: AgentCandidateExecutionPorts,\n): Promise<ResolvedAgentCandidateContainer> {\n  const environment = candidate.bundle.execution.environment\n  const evaluatorTaskContainer = task.task.evaluatorTaskContainer\n  const pinned = environment.kind === 'pinned-container' ? environment.container : undefined\n  if (environment.kind === 'evaluator-task-container' && !evaluatorTaskContainer) {\n    throw new Error('evaluator-task-container candidate requires an evaluator-owned task image')\n  }\n  if (environment.kind === 'pinned-container' && evaluatorTaskContainer) {\n    throw new Error('pinned candidate containers cannot be replaced by a task image')\n  }\n  const resolved = await ports.containers.resolve({\n    candidate: pinned,\n    evaluatorTaskContainer,\n  })\n  if (resolved.source !== environment.kind) throw new Error('resolved container source drifted')\n  if (pinned && (resolved.image !== pinned.image || resolved.indexDigest !== pinned.indexDigest)) {\n    throw new Error('resolved pinned container does not match the candidate image index')\n  }\n  if (\n    evaluatorTaskContainer &&\n    canonicalCandidateDigest(resolved) !== canonicalCandidateDigest(evaluatorTaskContainer)\n  ) {\n    throw new Error('resolved task container does not match evaluator-owned image evidence')\n  }\n  return resolved\n}\n\nasync function resolveModel(\n  candidate: VerifiedAgentCandidate,\n  task: AgentCandidateTaskExecution,\n  ports: AgentCandidateExecutionPorts,\n): Promise<AgentCandidateResolvedModel> {\n  const hints = candidate.bundle.profile.model\n  const expected = task.task.model\n  if (hints?.default !== undefined && hints.default !== expected.requested) {\n    throw new Error('candidate model preference conflicts with the evaluator-owned model')\n  }\n  if (hints?.reasoningEffort !== undefined && hints.reasoningEffort !== expected.reasoningEffort) {\n    throw new Error('candidate reasoning effort conflicts with the evaluator-owned effort')\n  }\n  const resolved = await ports.models.resolve({\n    requested: expected.requested,\n    harness: candidate.bundle.execution.harness,\n    reasoningEffort: expected.reasoningEffort,\n  })\n  if (canonicalCandidateDigest(resolved) !== canonicalCandidateDigest(expected)) {\n    throw new Error('model resolver drifted from the signed benchmark model')\n  }\n  return resolved\n}\n\nasync function prepareMemory(\n  candidate: VerifiedAgentCandidate,\n  task: AgentCandidateTaskExecution,\n  ports: AgentCandidateExecutionPorts,\n  preparationId: string,\n  expiresAtMs: number,\n  cleanupTimeoutMs: number,\n): Promise<{\n  value: AgentCandidateEffectiveMemory\n  accessDigest?: `sha256:${string}`\n}> {\n  const policy = candidate.bundle.memory\n  if (policy.mode === 'disabled') return { value: { mode: 'disabled' } }\n  const seed = policy.seed ? await verifiedArtifactBytes(candidate, policy.seed) : undefined\n  const executionSegment = canonicalCandidateDigest({ executionId: task.executionId }).slice(7)\n  const taskSegment = canonicalCandidateDigest({ taskDigest: task.task.digest }).slice(7)\n  const preparationSegment = canonicalCandidateDigest({ preparationId }).slice(7, 23)\n  const effectiveNamespace = `candidate/${candidate.bundle.digest.slice(7, 23)}/${executionSegment}/${taskSegment}/${preparationSegment}`\n  const reset = await withinCandidateCleanupDeadline(\n    () =>\n      ports.memory.reset({\n        executionId: task.executionId,\n        preparationId,\n        expiresAtMs,\n        effectiveNamespace,\n        ...(seed ? { seed } : {}),\n        ...(policy.seed ? { seedDigest: policy.seed.sha256 } : {}),\n      }),\n    candidateCleanupDeadline(cleanupTimeoutMs),\n    'isolated memory reset',\n  )\n  try {\n    if (\n      reset.preparationId !== preparationId ||\n      reset.expiresAtMs !== expiresAtMs ||\n      !/^sha256:[a-f0-9]{64}$/.test(reset.accessDigest)\n    ) {\n      throw new Error('isolated memory reservation is not scoped to this preparation')\n    }\n    await readVerifiedArtifact(reset.evidence, ports.artifacts)\n    await verifyWorkspaceSnapshotArtifacts(reset.beforeState, ports.artifacts)\n    return {\n      value: {\n        mode: 'isolated',\n        scope: 'task',\n        effectiveNamespace,\n        reset: {\n          kind: 'fresh',\n          evidence: reset.evidence,\n          emptyStateDigest: reset.emptyStateDigest,\n        },\n        beforeState: reset.beforeState,\n        ...(policy.seed ? { seedDigest: policy.seed.sha256 } : {}),\n      },\n      accessDigest: reset.accessDigest,\n    }\n  } catch (error) {\n    try {\n      const closed = await withinCandidateCleanupDeadline(\n        () =>\n          ports.memory.close({\n            executionId: task.executionId,\n            preparationId,\n            accessDigest: reset.accessDigest,\n            effectiveNamespace,\n            reason: 'preparation-failed',\n          }),\n        candidateCleanupDeadline(cleanupTimeoutMs),\n        'invalid isolated memory reset cleanup',\n      )\n      if (closed.closed !== true || Object.keys(closed).some((key) => key !== 'closed')) {\n        throw new Error('invalid isolated memory reset did not acknowledge closure')\n      }\n    } catch (closeError) {\n      throw new Error('isolated memory preparation and cleanup both failed', {\n        cause: new AggregateError([error, closeError]),\n      })\n    }\n    throw error\n  }\n}\n\nfunction buildLaunch(\n  candidate: VerifiedAgentCandidate,\n  task: AgentCandidateTaskExecution,\n  profileFlags: AgentCandidateConfigValue[],\n): { executable: string; args: AgentCandidateConfigValue[] } {\n  const launch = candidate.bundle.execution.launch\n  if (launch.kind === 'container-command') {\n    return { executable: launch.executable, args: [...(launch.args ?? []), ...profileFlags] }\n  }\n  const candidateRoot = task.executionRoots.candidateRoot\n  if (!candidateRoot) throw new Error('candidate entrypoint requires a container candidate root')\n  const entrypoint = posix.join(candidateRoot, launch.entrypoint)\n  const candidateArgs = launch.args ?? []\n  if (launch.interpreter) {\n    return {\n      executable: launch.interpreter,\n      args: [{ kind: 'public', value: entrypoint }, ...candidateArgs, ...profileFlags],\n    }\n  }\n  return { executable: entrypoint, args: [...candidateArgs, ...profileFlags] }\n}\n\nfunction mergePublicEnvironment(\n  ...records: Array<Record<string, AgentCandidateConfigValue>>\n): Record<string, AgentCandidateConfigValue> {\n  const output: Record<string, AgentCandidateConfigValue> = {}\n  for (const record of records) {\n    for (const [name, value] of Object.entries(record)) {\n      const previous = output[name]\n      if (previous && previous.value !== value.value) {\n        throw new Error(`candidate and profile environment disagree on ${name}`)\n      }\n      output[name] = value\n    }\n  }\n  return output\n}\n\nfunction unwrapPublicEnvironment(\n  values: Record<string, AgentCandidateConfigValue>,\n): Record<string, string> {\n  return Object.fromEntries(Object.entries(values).map(([name, value]) => [name, value.value]))\n}\n\nfunction modelRoutes(\n  profile: VerifiedAgentCandidate['bundle']['profile'],\n  requested: string,\n): AgentCandidateExecutionPlanMaterial['model']['routes'] {\n  const routes: AgentCandidateExecutionPlanMaterial['model']['routes'] = [\n    { kind: 'primary', requested },\n  ]\n  if (profile.model?.small) routes.push({ kind: 'small', requested })\n  for (const name of Object.keys(profile.modes ?? {}).sort()) {\n    if (profile.modes?.[name]?.model) routes.push({ kind: 'mode', name, requested })\n  }\n  for (const name of Object.keys(profile.subagents ?? {}).sort()) {\n    if (profile.subagents?.[name]?.model) routes.push({ kind: 'subagent', name, requested })\n  }\n  return routes\n}\n\nfunction candidateEntrypointReceipt(\n  candidate: VerifiedAgentCandidate,\n): { path: string; sha256: `sha256:${string}`; byteLength: number } | undefined {\n  const launch = candidate.bundle.execution.launch\n  const workspace = candidate.bundle.execution.workspace\n  if (launch.kind !== 'candidate-entrypoint' || !workspace) return undefined\n  const file = workspace.material.files.find((entry) => entry.path === launch.entrypoint)\n  if (!file) throw new Error('candidate entrypoint is absent from the verified workspace')\n  return { path: file.path, sha256: file.sha256, byteLength: file.byteLength }\n}\n\nfunction absoluteExecutionCwd(\n  cwd: VerifiedAgentCandidate['bundle']['execution']['cwd'],\n  roots: AgentCandidateTaskExecution['executionRoots'],\n): string {\n  const root = cwd.workspace === 'task' ? roots.taskRoot : roots.candidateRoot\n  if (!root) throw new Error('candidate cwd is missing its execution workspace root')\n  const absolute = cwd.path === '.' ? root : posix.join(root, cwd.path)\n  if (absolute !== root && !absolute.startsWith(`${root}/`)) {\n    throw new Error('candidate cwd escapes its execution workspace')\n  }\n  return absolute\n}\n\nfunction validateProtectedModelReservation(\n  reservation: {\n    preparationId: string\n    digest: string\n    expiresAtMs: number\n    enforcedLimits: {\n      maxModelCalls: number\n      maxInputTokens: number\n      maxOutputTokens: number\n      maxCostUsd: number\n    }\n    network: AgentCandidateModelAccessNetwork\n  },\n  expectedLimits: AgentCandidateExecutionLimits,\n  preparationId: string,\n  expiresAtMs: number,\n): void {\n  if (!/^sha256:[a-f0-9]{64}$/.test(reservation.digest)) {\n    throw new Error('protected model reservation has an invalid identity digest')\n  }\n  if (reservation.preparationId !== preparationId || reservation.expiresAtMs !== expiresAtMs) {\n    throw new Error('protected model reservation is not scoped to this preparation')\n  }\n  const limits = modelLimits(expectedLimits)\n  if (canonicalCandidateDigest(reservation.enforcedLimits) !== canonicalCandidateDigest(limits)) {\n    throw new Error('protected model reservation does not enforce the frozen model limits')\n  }\n  const expectedNetworkMode = limits.maxModelCalls === 0 ? 'disabled' : 'gateway-only'\n  const network = agentCandidateModelAccessNetworkSchema.parse(reservation.network)\n  if (network.mode !== expectedNetworkMode) {\n    throw new Error('protected model reservation has the wrong network policy for its call limit')\n  }\n}\n\nfunction assertEnvironmentDisjoint(\n  publicEnv: Record<string, AgentCandidateConfigValue>,\n  traceEnv: Record<string, string>,\n): void {\n  const seen = new Set(Object.keys(publicEnv))\n  for (const name of Object.keys(traceEnv)) {\n    if (seen.has(name)) throw new Error(`evaluator environment binding collides with ${name}`)\n    seen.add(name)\n  }\n}\n\nfunction modelLimits(limits: AgentCandidateExecutionLimits): {\n  maxModelCalls: number\n  maxInputTokens: number\n  maxOutputTokens: number\n  maxCostUsd: number\n} {\n  return {\n    maxModelCalls: limits.maxModelCalls,\n    maxInputTokens: limits.maxInputTokens,\n    maxOutputTokens: limits.maxOutputTokens,\n    maxCostUsd: limits.maxCostUsd,\n  }\n}\n\nfunction exactProfileExecutorFiles(\n  sourceFiles: ReadonlyArray<{ relPath: string; content: string; mode?: number }>,\n  expectedFiles: ReadonlyArray<{ relPath: string; mode: number; contentSha256: string }>,\n): Array<{ path: string; mode: number; bytes: Uint8Array }> {\n  const byPath = new Map(sourceFiles.map((file) => [file.relPath, file]))\n  if (byPath.size !== sourceFiles.length || sourceFiles.length !== expectedFiles.length) {\n    throw new Error('profile source files do not match the signed profile plan')\n  }\n  return expectedFiles.map((expected) => {\n    const source = byPath.get(expected.relPath)\n    const mode = source?.mode ?? 0o644\n    const bytes = Buffer.from(source?.content ?? '', 'utf8')\n    if (\n      !source ||\n      !Number.isInteger(mode) ||\n      mode < 0 ||\n      mode > 0o777 ||\n      mode !== expected.mode ||\n      sha256Bytes(bytes) !== expected.contentSha256\n    ) {\n      throw new Error('profile source files do not match the signed profile plan')\n    }\n    return { path: expected.relPath, mode, bytes: Uint8Array.from(bytes) }\n  })\n}\nfunction isWellFormedUnicode(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1)\n      if (!(next >= 0xdc00 && next <= 0xdfff)) return false\n      index++\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      return false\n    }\n  }\n  return true\n}\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error)\n}\n"],"mappings":";;;;;;;;;;;;;AAOA,SAAgB,YAAY,OAAiC;CAC3D,OAAO,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAClE;AAEA,SAAgB,wBAAwB,OAA4B;CAClE,OAAO,OAAO,KAAK,cAAc,KAAK,GAAG,MAAM;AACjD;AAEA,SAAgBA,2BAAyB,OAA8B;CACrE,OAAO,eAAe,KAAK;AAC7B;;AAGA,SAAgB,wBAA2B,OAAa;CACtD,OAAO,oBACL,KAAK,MAAM,OAAO,KAAK,wBAAwB,KAAK,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,CACzE;AACF;AAEA,SAAgB,2BACd,oBAC+B;CAC/B,MAAM,QAAQ,wBAAwB,kBAAkB;CACxD,MAAM,SAASA,2BAAyB,kBAAkB;CAC1D,IAAI,YAAY,KAAK,MAAM,QACzB,MAAM,IAAI,MAAM,6DAA6D;CAE/E,MAAM,cAAc,WAAW,KAAK,KAAK;CACzC,MAAM,QAAQ,wBAAwB;EAAE,GAAG;EAAoB;CAAO,CAAC;CACvE,OAAO,OAAO,OAAO;EACnB;EACA,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,WAAW;EACpC;EACA;CACF,CAAC;AACH;AAEA,SAAgB,iCACd,OACA,OACG;CACH,IAAIA,2BAAyB,mBAAmB,KAAK,CAAC,MAAM,MAAM,QAChE,MAAM,IAAI,MAAM,GAAG,MAAM,uBAAuB;CAElD,OAAO,wBAAwB,KAAK;AACtC;AAEA,SAAgB,0BAA0B,OAAmD;CAC3F,OAAO;EACL,UAAU;EACV,SAAS,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;EAC7C,QAAQ,YAAY,KAAK;EACzB,YAAY,MAAM;CACpB;AACF;AAEA,SAAgB,mBACd,OACmB;CACnB,MAAM,EAAE,QAAQ,SAAS,GAAG,SAAS;CACrC,OAAO;AACT;AAEA,SAAgB,oBAAuB,OAAU,uBAAO,IAAI,IAAY,GAAM;CAC5E,IACE,UAAU,QACV,OAAO,UAAU,YACjB,YAAY,OAAO,KAAK,KACxB,KAAK,IAAI,KAAe,GAExB,OAAO;CAET,KAAK,IAAI,KAAe;CACxB,KAAK,MAAM,SAAS,OAAO,OAAO,KAAgC,GAChE,oBAAoB,OAAO,IAAI;CAEjC,OAAO,OAAO,OAAO,KAAK;AAC5B;;;AC1EA,MAAM,qBAAqB;AAC3B,MAAM,4BAA4B;AA8BlC,MAAM,sBAAsB,CAAC,mBAAmB,sBAAsB;AACtE,MAAM,6BAA6B,CACjC,0BACA,6BACF;AAEA,SAAS,wBAAwB,QAAoC;CACnE,OAAO,OAAO,MAAM,UAClB,oBAAoB,MAAM,SAAS,UAAU,QAAQ,MAAM,WAAW,GAAG,KAAK,EAAE,CAAC,CACnF;AACF;AAEA,SAAS,8BAA8B,QAAoC;CACzE,OAAO,OAAO,MAAM,UAClB,2BAA2B,MAAM,SAAS,UAAU,QAAQ,MAAM,WAAW,GAAG,KAAK,EAAE,CAAC,CAC1F;AACF;;AAGA,MAAM,yBAAyB,CAAC,2BAA2B,wBAAwB;AAEnF,SAAS,gCAAgC,QAAoC;CAC3E,KAAK,IAAI,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;EAClD,MAAM,QAAQ,OAAO;EACrB,MAAM,SACJ,UAAU,QAAQ,UAAU,aACxB,OAAO,QAAQ,KACf,MAAM,WAAW,WAAW,IAC1B,MAAM,MAAM,CAAkB,IAC9B,KAAA;EACR,IACE,WAAW,KAAA,KACX,uBAAuB,MAAM,QAAQ,OAAO,UAAU,CAAC,CAAC,WAAW,GAAG,IAAI,EAAE,CAAC,GAE7E,OAAO;CAEX;CACA,OAAO;AACT;AAEA,MAAM,yBAAyB;CAC7B,eAAe;EACb,YAAY;EACZ,UAAU,MAAM,cAAc,SAC5B,YACE,cAAc,MAAM,oBAAoB,YAAY,GACpD,wBACA,IACF;EACF,gBAAgB,MAAM,oBAAoB,SACxC,YACE,cAAc,MAAM,2BAA2B,kBAAkB,GACjE,+BACA,IACF;EACF,mBAAmB;EACnB,yBAAyB;CAC3B;;CAEA,UAAU;EACR,YAAY;EACZ,UAAU,SAAS;EACnB,8BAA8B;EAC9B,oBAAoB,WAClB,OAAO,MAAM,UAAU,UAAU,aAAa,MAAM,WAAW,UAAU,CAAC;EAC5E,yBAAyB;CAC3B;CACA,IAAI;EACF,YAAY;EACZ,UAAU,MAAM,cAAc,SAC5B,YAAY,cAAc,MAAM,oBAAoB,YAAY,GAAG,mBAAmB,IAAI;EAC5F,gBAAgB,MAAM,oBAAoB,SACxC,YACE,cAAc,MAAM,2BAA2B,kBAAkB,GACjE,0BACA,IACF;EACF,mBAAmB;EACnB,yBAAyB;CAC3B;CACA,OAAO;EACL,YAAY;EACZ,UAAU,MAAM,cAAc,SAC5B,YAAY,cAAc,MAAM,oBAAoB,YAAY,GAAG,mBAAmB,IAAI;EAC5F,gBAAgB,MAAM,oBAAoB,SACxC,YACE,cAAc,MAAM,2BAA2B,kBAAkB,GACjE,0BACA,IACF;EACF,mBAAmB;EACnB,yBAAyB;CAC3B;;CAEA,QAAQ;EACN,YAAY;EACZ,UAAU,SAAS;EACnB,mBAAmB;EACnB,yBAAyB;CAC3B;AACF;;;;;;AAaA,MAAM,iCAAiC;CACrC,OAAO;EACL,YAAY;EACZ,YAAY,SACV,KAAK,MAAM,MAAM,SAAS,KAAK,YAAY,yBAAyB,KACpE,KAAK,MAAM,MAAM,SAAS,KAAK,UAAU,iDAAiD;EAC5F,mBAAmB;CACrB;CACA,QAAQ;EACN,YAAY;EACZ,YAAY,SACV,KAAK,MAAM,MAAM,SAAS,KAAK,YAAY,mBAAmB,KAC9D,KAAK,IAAI,kBAAkB,UAAU;EACvC,mBAAmB;CACrB;AACF;;AAGA,SAAgB,8BACd,MACA,QACA,sBACA,wBAA4C,KAAK,cAAc,OAC/D,8BAAkD,KAAK,oBAAoB,OAC9C;CAC7B,MAAM,eAAe,KAAK;CAC1B,MAAM,qBAAqB,KAAK;CAChC,MAAM,WAAW,+BACf,KAAK;CAGP,IAAI,iBAAiB,KAAA,KAAa,UAAU,UAAU,IAAI,GAAG;EAC3D,2BAA2B,KAAK,SAAS,SAAS,YAAY,QAAQ,aAAa;EACnF,sBAAsB,KAAK,SAAS,SAAS,mBAAmB,QAAQ,aAAa;EACrF,IAAI,0BAA0B,KAAA,GAAW,OAAO;EAChD,OAAO;CACT;CAEA,IAAI,0BAA0B,KAAA,KAAa,gCAAgC,KAAA,GACzE,OAAO;CAGT,MAAM,aAAa,uBAAuB,KAAK;CAG/C,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,+DAA+D,KAAK,SAAS;CAG/F,MAAM,uBAAuB,0BAA0B,KAAA;CACvD,IAAI,wBAAwB,iBAAiB,KAAA,GAC3C,MAAM,IAAI,MACR,wEAAwE,KAAK,SAC/E;CAEF,IAAI,iBAAiB,KAAA,KAAa,0BAA0B,KAAA,GAC1D,MAAM,IAAI,MACR,wEAAwE,KAAK,SAC/E;CAEF,IAAI,iBAAiB,KAAA,KAAa,aAAa,UAAU,uBACvD,MAAM,IAAI,MAAM,0DAA0D;CAE5E,IACE,uBAAuB,KAAA,KACvB,mBAAmB,UAAU,6BAE7B,MAAM,IAAI,MAAM,iEAAiE;CAGnF,MAAM,SAAS,uBAAuB,gBAAgB;CACtD,2BAA2B,KAAK,SAAS,WAAW,YAAY,QAAQ,MAAM;CAC9E,MAAM,cAAc,OAAO,QAAQ,CAAC,EAAA,CAAG,KAAK,UAAU,MAAM,KAAK;CACjE,IAAI,wBAAwB,WAAW,kBAAkB,UAAU,GACjE,MAAM,IAAI,MACR,GAAG,KAAK,QAAQ,oEAClB;CAEF,IAAI,gCAAgC,KAAA,KAAa,WAAW,wBAAwB,UAAU,GAC5F,MAAM,IAAI,MACR,GAAG,KAAK,QAAQ,2EAClB;CAGF,IAAI,YAAY;CAChB,IAAI,iBAAiB,KAAA,GACnB,YAAY,WAAW,QACrB,WAAW,+BACP,YACA,iBAAiB,WAAW,cAAc,GAC9C,aAAa,OACb,oBACF;CAEF,IAAI,uBAAuB,KAAA,GAAW;EACpC,IAAI,CAAC,WAAW,eACd,MAAM,IAAI,MACR,sEAAsE,KAAK,SAC7E;EAEF,YAAY,WAAW,cACrB,iBAAiB,WAAW,oBAAoB,GAChD,mBAAmB,OACnB,MAAM,KAAK,MAAM,QAAQ,oBAAoB,GAAG,yBAAyB,CAC3E;CACF;CAGA,OAAO;AACT;AAEA,SAAS,2BACP,SACA,oBACA,QACA,QACwE;CACxE,IAAI,OAAO,SAAS,qBAClB,MAAM,IAAI,MAAM,4CAA4C,QAAQ,iBAAiB,QAAQ;CAE/F,IACE,OAAO,eAAe,sBACtB,EACE,MAAM,WAAW,OAAO,UAAU,KAClC,MAAM,SAAS,OAAO,UAAU,MAAM,qBAGxC,MAAM,IAAI,MACR,GAAG,QAAQ,iBAAiB,OAAO,uBAAuB,mBAAmB,YAC/E;AAEJ;AAEA,SAAS,sBACP,SACA,mBACA,QACA,QACM;CACN,IAAI,mBAAmB,OAAO,QAAQ,CAAC,EAAA,CAAG,KAAK,UAAU,MAAM,KAAK,CAAC,GACnE,MAAM,IAAI,MACR,GAAG,QAAQ,wDAAwD,WAAW,gBAAgB,WAAW,gBAAgB,QAC3H;AAEJ;AAEA,SAAS,iBACP,MACA,QAC6B;CAC7B,MAAM,YAAY,EAAE,GAAG,KAAK;CAC5B,OAAO,UAAU;CACjB,OAAO;AACT;AAEA,SAAS,YACP,MACA,GAAG,QAC0B;CAC7B,OAAO;EACL,GAAG;EACH,OAAO,CAAC,GAAG,KAAK,OAAO,GAAG,OAAO,IAAIC,aAAW,CAAC;CACnD;AACF;AAEA,SAASA,cAAY,OAA0C;CAC7D,OAAO;EAAE,MAAM;EAAU;CAAM;AACjC;AAEA,SAAS,cACP,MACA,SACA,QAC6B;CAG7B,IAAI,KAAK,MAAM,MAAM,SAAS,KAAK,YAAY,OAAO,GACpD,MAAM,IAAI,MAAM,6CAA6C,SAAS;CAExE,OAAO;EACL,GAAG;EACH,OAAO,CACL,GAAG,KAAK,OACR;GACE;GACA,SAAS;GACT,QAAQ;EACV,CACF;CACF;AACF;;;AC7SA,SAAgB,6BAA6B,SAAiC;CAC5E,IAAI,CAAC,sBAAsB,OAAO,GAChC,MAAM,IAAI,MACR,uEAAuE,SACzE;CAEF,OAAO;AACT;;AAGA,MAAa,uCAAuC,CAAC,cAAc;;AAenE,SAAgB,qCACd,SAC6B;CAC7B,MAAM,OACJ,QAAQ,cAAc,SAAS,QAAQ,WAAW,WAAW,QAAQ,WAAW;CAClF,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,kEAAkE;CAS7F,OAAO,8BARM,4BACX,QAAQ,SACR,6BAA6B,QAAQ,OAAO,GAC5C;EACE,OAAO;EACP,mBAAmB,QAAQ;CAC7B,CAGG,GACH,QAAQ,QACR,MAAM,KAAK,MAAM,0BAA0B,GAC3C,QAAQ,QAAQ,QAAQ,cACxB,QAAQ,QAAQ,QAAQ,kBAC1B;AACF;;AAGA,SAAgB,sCACd,MACA,aACiC;CACjC,MAAM,eAAe,IAAI,IAAI,KAAK,MAAM,KAAK,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC;CAC3E,IAAI,aAAa,SAAS,KAAK,MAAM,QACnC,MAAM,IAAI,MAAM,mEAAmE;CAErF,MAAM,QAAQ,YAAY,SAAS,MAAM,KAAK,aAAa;EACzD,MAAM,SAAS,aAAa,IAAI,SAAS,OAAO;EAChD,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,2CAA2C,SAAS,SAAS;EAE/E,MAAM,OAAO,OAAO,QAAQ;EAC5B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO,KACpD,MAAM,IAAI,MAAM,qDAAqD,SAAS,SAAS;EAEzF,OAAO;GAAE,MAAM,SAAS;GAAS;GAAM,SAAS,OAAO;EAAQ;CACjE,CAAC;CACD,IAAI,MAAM,WAAW,KAAK,MAAM,QAC9B,MAAM,IAAI,MAAM,8DAA8D;CAEhF,OAAO,qCACL,2BAA4D;EAC1D,MAAM;EACN;EACA;CACF,CAAC,CAAC,CAAC,OACH,YAAY,MACd;AACF;;AAGA,SAAgB,qCACd,OACA,2BACiC;CACjC,MAAM,aAAa,sCAAsC,MAAM,KAAK;CACpE,MAAM,YAAY,wBAAwB,WAAW,YAAY,QAAQ;CACzE,MAAM,sBAAsB,WAAW,YAAY;CACnD,IACE,YAAY,SAAS,MAAM,WAAW,YAAY,UAClD,oBAAoB,WAAW,WAAW,YAAY,UACtD,oBAAoB,eAAe,UAAU,cAC5C,aAAa,uBACZ,CAAC,OAAO,KAAK,oBAAoB,SAAS,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,SAAS,CAAC,KAClF,8BAA8B,KAAA,KAC7B,WAAW,YAAY,WAAW,2BAEpC,MAAM,IAAI,MAAM,oEAAoE;CAEtF,IAAIC,2BAAyB,mBAAmB,UAAU,CAAC,MAAM,WAAW,QAC1E,MAAM,IAAI,MAAM,oDAAoD;CAEtE,OAAO,wBAAwB,UAAU;AAC3C;AAEA,MAAM,kCAAkC;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,SAAgB,mCAAmC,OAA4C;CAE7F,OAAO,mCADS,uBAAuB,OAAO,SACE,CAAC;AACnD;;;;;;AAOA,SAAS,mCAAmC,SAA8C;CACxF,IAAI,QAAQ,gBAAgB,KAAA,GAAW,wBAAwB,aAAa;CAC5E,IAAI,QAAQ,aAAa,KAAA,GAAW,wBAAwB,UAAU;CACtE,IAAI,QAAQ,eAAe,KAAA,GAAW,wBAAwB,YAAY;CAC1E,IAAI,QAAQ,OAAO,aAAa,KAAA,GAAW,wBAAwB,gBAAgB;CAEnF,MAAM,YAAqC,CAAC;CAC5C,wBAAwB,WAAW,OAAkC;CACrE,IAAI,QAAQ,OAAO;EACjB,MAAM,EAAE,UAAU,WAAW,GAAG,UAAU,QAAQ;EAClD,UAAU,QAAQ;CACpB;CACA,IAAI,QAAQ,KAAK,UAAU,MAAM,iBAAiB,QAAQ,GAAG;CAC7D,IAAI,QAAQ,WACV,UAAU,YAAY,OAAO,YAC3B,OAAO,QAAQ,QAAQ,SAAS,CAAC,CAAC,KAAK,CAAC,MAAM,cAAc;EAC1D,IAAI,SAAS,aAAa,KAAA,GAAW,wBAAwB,aAAa,KAAK,UAAU;EACzF,MAAM,EAAE,UAAU,WAAW,GAAG,UAAU;EAC1C,OAAO,CAAC,MAAM,KAAK;CACrB,CAAC,CACH;CAEF,IAAI,QAAQ,WAAW,UAAU,YAAY,gBAAgB,QAAQ,SAAS;CAC9E,IAAI,QAAQ,SAAS,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,MAAM,aAAa,SAAS,SAAS,CAAC,GACtF,MAAM,IAAI,MACR,4GACF;CAEF,IAAI,QAAQ,OAAO,UAAU,QAAQ,QAAQ;CAC7C,IAAI,QAAQ,OACV,UAAU,QAAQ,OAAO,YACvB,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,UAAU;EAClD,IAAI,KAAK,aAAa,KAAA,GAAW,wBAAwB,SAAS,KAAK,UAAU;EACjF,MAAM,EAAE,UAAU,WAAW,GAAG,UAAU;EAC1C,OAAO,CAAC,MAAM,KAAK;CACrB,CAAC,CACH;CAGF,OADe,2BAA2B,SAC9B;AACd;;AAGA,SAAgB,8BACd,eACA,SACM;CAGN,IAAIA,2BADa,mCADA,uBAAuB,eAAe,wBACI,CACvB,CAAC,MAAMA,2BAAyB,OAAO,GACzE,MAAM,IAAI,MAAM,gEAAgE;AAEpF;;AAGA,SAAgB,uBAAuB,OAAgB,OAA6B;CAClF,IAAI;CACJ,IAAI;EACF,SAAS,mBAAmB,MAAM,KAAK;CACzC,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,GAAG,MAAM,gDAAgD,EAAE,MAAM,CAAC;CACpF;CACA,qBAAqB,OAAO,QAAQ,KAAK;CACzC,OAAO;AACT;;AAGA,SAAgB,2BAA2B,OAAgB,OAAiC;CAC1F,IAAI;CACJ,IAAI;EACF,SAAS,uBAAuB,MAAM,KAAK;CAC7C,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,GAAG,MAAM,gDAAgD,EAAE,MAAM,CAAC;CACpF;CACA,qBAAqB,OAAO,QAAQ,KAAK;CACzC,OAAO;AACT;;AAGA,SAAgB,2BACd,WACA,WACA,OACc;CAId,OAAO,uBADS,0BAA0B,sBAF7B,uBAAuB,WAAW,GAAG,MAAM,cAEW,GADtD,2BAA2B,WAAW,GAAG,MAAM,MACa,CAAC,GAAG,KACzC,GAAG,GAAG,MAAM,QAAQ;AAC1D;;AAGA,SAAgB,2BAA2B,OAAuC;CAChF,MAAM,SAAS,4BAA4B,MAAM,KAAK;CACtD,qBAAqB,OAAO,QAAQ,mBAAmB;CACvD,OAAO;AACT;;AAGA,SAAgB,uCAAuC,SAAsC;CAE3F,MAAM,cAAc;EADJ;EAAS;EAAe;EAAS;CACxB,CAAC,CAAC,QAAQ,UAAU,WAAW,QAAQ,MAAM,CAAC;CACvE,IAAI,YAAY,SAAS,GACvB,MAAM,IAAI,MACR,0FAA0F,YAAY,KAAK,IAAI,GACjH;AAEJ;;AAGA,SAAgB,oCACd,WACc;CACd,MAAM,SAAkC,CAAC;CACzC,wBAAwB,QAAQ,SAA+C;CAC/E,IAAI,UAAU,OAAO,OAAO,QAAQ,EAAE,GAAG,UAAU,MAAM;CACzD,IAAI,UAAU,KACZ,OAAO,MAAM,OAAO,YAClB,OAAO,QAAQ,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CACpD,MACA;EACE,GAAG;EAKH,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,KAAK,WAAW,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,CAAC;EAC1E,GAAI,OAAO,MAAM,EAAE,KAAK,YAAY,OAAO,GAAG,EAAE,IAAI,CAAC;CACvD,CACF,CAAC,CACH;CAEF,IAAI,UAAU,WAAW,OAAO,YAAY,YAAY,UAAU,SAAS;CAC3E,IAAI,UAAU,OAAO,OAAO,QAAQ,YAAY,UAAU,KAAK;CAC/D,IAAI,UAAU,OACZ,OAAO,QAAQ,OAAO,YACpB,OAAO,QAAQ,UAAU,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CACtD,OACA,MAAM,KAAK,EAAE,YAAY,MAAM,KAAK,GAAG,YAAY;EACjD,GAAG;EACH,SAAS,CAAC,YAAY,IAAI,QAAQ,CAAC,EAAA,CAAG,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,KAAK,GAAG;EAGhF,GAAI,MAAM,EAAE,KAAK,YAAY,GAAG,EAAE,IAAI,CAAC;CACzC,EAAE,CACJ,CAAC,CACH;CAEF,IAAI,UAAU,WAAW;EACvB,IAAI,UAAU,UAAU,gBAAgB,MACtC,MAAM,IAAI,MAAM,0EAA0E;EAE5F,OAAO,YAAY;GACjB,aAAa;GACb,GAAI,UAAU,UAAU,QACpB,EACE,OAAO,UAAU,UAAU,MAAM,KAAK,UAAU;IAC9C,GAAG;IACH,UAAU,eAAe,KAAK,QAAQ;GACxC,EAAE,EACJ,IACA,CAAC;GACL,GAAI,UAAU,UAAU,QACpB,EAAE,OAAO,UAAU,UAAU,MAAM,IAAI,cAAc,EAAE,IACvD,CAAC;GACL,GAAI,UAAU,UAAU,SACpB,EAAE,QAAQ,UAAU,UAAU,OAAO,IAAI,cAAc,EAAE,IACzD,CAAC;GACL,GAAI,UAAU,UAAU,SACpB,EAAE,QAAQ,UAAU,UAAU,OAAO,IAAI,cAAc,EAAE,IACzD,CAAC;GACL,GAAI,UAAU,UAAU,WACpB,EAAE,UAAU,UAAU,UAAU,SAAS,IAAI,cAAc,EAAE,IAC7D,CAAC;GACL,GAAI,UAAU,UAAU,iBAAiB,KAAA,IACrC,EACE,cACE,OAAO,UAAU,UAAU,iBAAiB,WACxC,UAAU,UAAU,eACpB,eAAe,UAAU,UAAU,YAAY,EACvD,IACA,CAAC;EACP;CACF;CACA,OAAO;AACT;;AAGA,SAAgB,0BAA0B,OAAgB,MAAuB;CAC/E,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,OAAO,UAAU;EACjC,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,GAAG,KAAK,wCAAwC,OAAO;EAEzE,OAAO,0BAA0B,OAAO,GAAG,KAAK,GAAG,MAAM,EAAE;CAC7D,CAAC;CAEH,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAgC,CAAC,CAC7C,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAAC,CAC1C,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,0BAA0B,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CACpF;AACF;AAEA,SAAS,iBAAiB,SAAyE;CACjG,OAAO,OAAO,YACZ,OAAO,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY;EAC9C,IAAI,OAAO,cAAc,KAAA,KAAa,OAAO,cAAc,SACzD,wBAAwB,OAAO,KAAK,aAAa,OAAO,WAAW;EAErE,IAAI,OAAO,QAAQ,KAAA,GAAW,wBAAwB,OAAO,KAAK,KAAK;EACvE,IAAI,OAAO,YAAY,KAAA,GAAW,wBAAwB,OAAO,KAAK,SAAS;EAC/E,IAAI,OAAO,aAAa,KAAA,GAAW,wBAAwB,OAAO,KAAK,UAAU;EACjF,OAAO,CACL,MACA;GACE,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;GAC1D,GAAI,OAAO,UAAU,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC;GACpD,GAAI,OAAO,OACP,EACE,MAAM,OAAO,KAAK,KAAK,OAAO,UAC5B,qBAAqB,OAAO,OAAO,KAAK,QAAQ,MAAM,EAAE,CAC1D,EACF,IACA,CAAC;GACL,GAAI,OAAO,MAAM,EAAE,KAAK,yBAAyB,OAAO,KAAK,OAAO,KAAK,KAAK,EAAE,IAAI,CAAC;GACrF,GAAI,OAAO,MAAM,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC;GACxC,GAAI,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;EACpE,CACF;CACF,CAAC,CACH;AACF;AAEA,SAAS,gBAAgB,WAA4D;CACnF,IAAI,UAAU,gBAAgB,MAC5B,MAAM,IAAI,MAAM,uDAAuD;CAEzE,OAAO;EACL,aAAa;EACb,GAAI,UAAU,QACV,EACE,OAAO,UAAU,MAAM,KAAK,UAAU;GACpC,GAAG;GACH,UAAU,eAAe,KAAK,QAAQ;EACxC,EAAE,EACJ,IACA,CAAC;EACL,GAAI,UAAU,QAAQ,EAAE,OAAO,UAAU,MAAM,IAAI,cAAc,EAAE,IAAI,CAAC;EACxE,GAAI,UAAU,SAAS,EAAE,QAAQ,UAAU,OAAO,IAAI,cAAc,EAAE,IAAI,CAAC;EAC3E,GAAI,UAAU,SAAS,EAAE,QAAQ,UAAU,OAAO,IAAI,cAAc,EAAE,IAAI,CAAC;EAC3E,GAAI,UAAU,WAAW,EAAE,UAAU,UAAU,SAAS,IAAI,cAAc,EAAE,IAAI,CAAC;EACjF,GAAI,UAAU,iBAAiB,KAAA,IAC3B,CAAC,IACD,EACE,cACE,OAAO,UAAU,iBAAiB,WAC9B,UAAU,eACV,eAAe,UAAU,YAAY,EAC7C;CACN;AACF;AAEA,SAAS,eAAe,UAA8D;CACpF,IAAI,SAAS,SAAS,UACpB,MAAM,IAAI,MACR,2IACF;CAEF,MAAM,QAAQ,OAAO,KAAK,SAAS,SAAS,MAAM;CAClD,OAAO;EACL,GAAG;EACH,QAAQ,0BAA0B,KAAK,CAAC,CAAC;EACzC,YAAY,MAAM;CACpB;AACF;AAEA,SAAS,wBACP,QACA,QACM;CACN,KAAK,MAAM,OAAO,iCAChB,IAAI,OAAO,SAAS,KAAA,GAAW,OAAO,OAAO,OAAO;AAExD;AAEA,SAAS,qBAAqB,OAAgB,QAAiB,OAAqB;CAClF,IAAI,CAAC,OAAO,KAAK,wBAAwB,KAAK,CAAC,CAAC,CAAC,OAAO,wBAAwB,MAAM,CAAC,GACrF,MAAM,IAAI,MAAM,GAAG,MAAM,8CAA8C;AAE3E;AAEA,SAAS,eAAe,UAA8C;CACpE,IAAI,SAAS,SAAS,UACpB,OAAO;EAAE,MAAM;EAAU,MAAM,SAAS;EAAM,SAAS,SAAS;CAAQ;CAE1E,OAAO;EACL,MAAM;EACN,YAAY,GAAG,SAAS,WAAW,MAAM,GAAG,SAAS,WAAW;EAChE,MAAM,SAAS;EACf,KAAK,SAAS;EACd,GAAI,SAAS,OAAO,EAAE,MAAM,SAAS,KAAK,IAAI,CAAC;CACjD;AACF;;;;AAKA,SAAS,qBACP,OACA,MACmC;CACnC,IAAI,MAAM,SAAS,UAAU,wBAAwB,GAAG,KAAK,gBAAgB,MAAM,IAAI,GAAG;CAC1F,OAAO;EAAE,MAAM;EAAU,OAAO,MAAM;CAAM;AAC9C;AAEA,SAAS,yBACP,QACA,YACmD;CACnD,OAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CAC5C,MACA,qBAAqB,OAAO,GAAG,WAAW,GAAG,MAAM,CACrD,CAAC,CACH;AACF;AAEA,SAAS,YAAY,OAA0C;CAC7D,OAAO,MAAM;AACf;AAEA,SAAS,YAAe,QAA8C;CACpE,OAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,CAClE;AACF;AAEA,SAAS,WAAW,OAAyB;CAC3C,OAAO,UAAU,KAAA,KAAa,UAAU,QAAQ,OAAO,UAAU,WAC7D,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,IAC5B;AACN;AAEA,SAAS,WAAW,OAAuB;CACzC,OAAO,2BAA2B,KAAK,KAAK,IAAI,QAAQ,IAAI,MAAM,WAAW,KAAK,OAAO,EAAE;AAC7F;AAEA,SAAS,wBAAwB,MAAqB;CACpD,MAAM,IAAI,MACR,8BAA8B,KAAK,oDACrC;AACF;;;;AC5gBA,SAAgB,sBACd,OACA,UACA,OACA,WAA8B,CAAC,GACzB;CACN,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CAE9C,MAAM,0BAAU,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,QAAQ,CAAC;CAClD,IAAI,QAAQ,SAAS,SAAS,SAAS,SAAS,QAC9C,MAAM,IAAI,MAAM,GAAG,MAAM,8CAA8C;CAEzE,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GACjC,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B,KAAK;CAEjF,KAAK,MAAM,OAAO,UAChB,IAAI,EAAE,OAAO,QAAQ,MAAM,IAAI,MAAM,GAAG,MAAM,oBAAoB,KAAK;AAE3E;;;ACLA,SAAgB,iCACd,OACA,qBACmC;CACnC,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,4DAA4D;CAE9E,MAAM,SAAS;CACf,sBACE,QACA,CAAC,iBAAiB,wBAAwB,GAC1C,0CACF;CACA,MAAM,gBAAgB,wBACpB,gCAAgC,MAAM,OAAO,aAAa,CAC5D;CACA,MAAM,yBAAyB,wBAC7B,gCAAgC,MAAM,OAAO,sBAAsB,CACrE;CACA,IAAI,cAAc,WAAW,qBAC3B,MAAM,IAAI,MAAM,mEAAmE;CAErF,OAAO,OAAO,OAAO;EAAE;EAAe;CAAuB,CAAC;AAChE;;;ACjBA,MAAMC,mBAAiB;AAEvB,SAAgB,eACd,OACA,QACuC;CACvC,MAAM,WAAW,mBAAmB,MAAM;CAC1C,MAAM,QAAQ;EACZ,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,cAAc,MAAM;EACpB,qBAAqB,MAAM;EAC3B,qBAAqB,MAAM;EAC3B,GAAG;CACL;CACA,OAAO,wBAAwB;EAC7B,GAAG;EACH,gBAAgBC,2BAAyB,KAAK;CAChD,CAAC;AACH;AAEA,SAAgB,wBACd,OACA,OACA,UACuC;CACvC,MAAM,YAAY,qBAAqB,UAAU,KAAK;CACtD,OAAO,eAAe,OAAO;EAC3B,QAAQ;EACR,cACE,UAAU,iBAAiB,8BAA8B,UAAU,YAC/D,YACA,UAAU;EAChB,OAAO,UAAU;EACjB,iBAAiB,UAAU;EAC3B,GAAI,UAAU,kBAAkB,EAAE,iBAAiB,UAAU,gBAAgB,IAAI,CAAC;CACpF,CAAC;AACH;AAEA,SAAgB,6BACd,OACA,UACM;CACN,IACE,UAAU,uBACV,SAAS,WAAW,YACpB,SAAS,iBAAiB,4BAE1B,MAAM,IAAI,MAAM,wEAAwE;CAE1F,IACE,UAAU,cACT,SAAS,WAAW,eAClB,SAAS,WAAW,aAClB,SAAS,iBAAiB,eACzB,SAAS,iBAAiB,+BAEhC,MAAM,IAAI,MAAM,+DAA+D;AAEnF;AAEA,SAAgB,eACd,UACA,yBACqC;CACrC,OAAO,OAAO,OAAO;EACnB,UAAU;EACV,UAAU;EACV,aAAa,SAAS,mBAAmB;CAC3C,CAAC;AACH;AAEA,SAAgB,cACd,UACA,WACoC;CACpC,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR,UAAU;EACV,aAAa,SAAS,mBAAmB,UAAU;CACrD,CAAC;AACH;AAEA,SAAgB,sBACd,QACA,gBACuC;CACvC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,kDAAkD;CAC/E,IAAI,OAAO,mBAAmB,gBAC5B,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO;AACT;AAEA,SAAgB,mBAAmB,OAAmC;CACpE,qBAAmB,OAAO,gBAAgB;CAC1C,OAAO;AACT;AAEA,SAAgB,4BACd,QACA,WACM;CACN,IACEA,2BAAyB,OAAO,KAAK,MAAMA,2BAAyB,UAAU,KAAK,KACnFA,2BAAyB,OAAO,eAAe,MAC7CA,2BAAyB,UAAU,eAAe,GAEpD,MAAM,IAAI,MAAM,4EAA4E;AAEhG;AAEA,SAAgB,wBACd,OACA,OACuC;CACvC,MAAM,SAAS,sBAAsB,MAAM,QAAQ,KAAK;CACxD,sBACE,OACA,WAAW,cACP;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,IACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,GAAI,MAAM,kBAAkB,CAAC,iBAAiB,IAAI,CAAC;CACrD,GACJ,KACF;CACA,MAAM,sBAAsBC,gBAC1B,MAAM,qBACN,OACA,qBACF;CACA,MAAM,WAAW;EACf,aAAaA,gBAAc,MAAM,aAAa,OAAO,aAAa;EAClE,SAASC,gBAAc,MAAM,SAAS,OAAO,SAAS;EACtD,cAAcD,gBAAc,MAAM,cAAc,OAAO,cAAc;EACrE;EACA,qBAAqB,iCACnB,MAAM,qBACN,mBACF;CACF;CACA,oBAAkB,SAAS,WAAW;CACtC,IAAI,CAAC,OAAO,cAAc,SAAS,OAAO,KAAK,SAAS,UAAU,GAChE,MAAM,IAAI,MAAM,GAAG,MAAM,qBAAqB;CAEhD,qBAAmB,SAAS,cAAc,cAAc;CACxD,qBAAmB,SAAS,qBAAqB,qBAAqB;CACtE,IAAI,SAAS,oBAAoB,cAAc,WAAW,SAAS,qBACjE,MAAM,IAAI,MAAM,GAAG,MAAM,4DAA4D;CAEvF,MAAM,SAAS,mBACb,WAAW,cACP;EACE;EACA,OAAOE,gBAAc,MAAM,OAAO,OAAO,OAAO;EAChD,iBAAiB,mBAAmB,MAAM,iBAAiB,OAAO,iBAAiB;EACnF,aAAa,mBAAmB,MAAM,aAAa,OAAO,aAAa;EACvE,iBAAiB,mBAAmB,MAAM,iBAAiB,OAAO,iBAAiB;EACnF,YAAY,mBAAmB,MAAM,YAAY,OAAO,YAAY;CACtE,IACA;EACE;EACA,cAAc,oBAAoB,MAAM,cAAc,KAAK;EAC3D,OAAOA,gBAAc,MAAM,OAAO,OAAO,OAAO;EAChD,iBAAiB,mBAAmB,MAAM,iBAAiB,OAAO,iBAAiB;EACnF,GAAI,MAAM,kBACN,EACE,iBAAiB,mBACf,MAAM,iBACN,OACA,iBACF,EACF,IACA,CAAC;CACP,CACN;CACA,MAAM,WAAW;EAAE,GAAG;EAAU,GAAG;CAAO;CAC1C,MAAM,iBAAiBF,gBACrB,MAAM,gBACN,OACA,gBACF;CACA,qBAAmB,gBAAgB,gBAAgB;CACnD,IAAI,mBAAmBD,2BAAyB,QAAQ,GACtD,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CAEvD,OAAO,wBAAwB;EAC7B,GAAG;EACH;CACF,CAAC;AACH;AAEA,SAAgB,2BACd,UACA,OACA,MACM;CACN,IACE,SAAS,gBAAgB,MAAM,eAC/B,SAAS,YAAY,MAAM,WAC3B,SAAS,iBAAiB,MAAM,gBAChC,SAAS,wBAAwB,MAAM,uBACvCA,2BAAyB,SAAS,mBAAmB,MACnDA,2BAAyB,MAAM,mBAAmB,GAEpD,MAAM,IAAI,MAAM,0CAA0C,KAAK,0BAA0B;AAE7F;AAEA,SAAgB,4BACd,UACA,QACA,MACM;CACN,IACE,SAAS,mBAAmB,OAAO,kBACnCA,2BAAyB,QAAQ,MAAMA,2BAAyB,MAAM,GAEtE,MAAM,IAAI,MAAM,0CAA0C,KAAK,4BAA4B;AAE/F;AAEA,SAAS,qBACP,UACA,OACyC;CACzC,sBACE,UACA;EACE;EACA;EACA;EACA;EACA;EACA,GAAI,SAAS,kBAAkB,CAAC,iBAAiB,IAAI,CAAC;EACtD,GAAI,SAAS,SAAS,CAAC,QAAQ,IAAI,CAAC;CACtC,GACA,uCACF;CACA,mBAAmB,SAAS,YAAY;CACxC,MAAM,QAAQ,UAAU,SAAS,KAAK;CACtC,IAAI,SAAS,iBAAiB,8BAA8B,MAAM,eAAe,GAC/E,MAAM,IAAI,MAAM,6DAA6D;CAE/E,MAAM,kBAAkB,gBAAgB,SAAS,iBAAiB,iBAAiB;CACnF,MAAM,kBAAkB,SAAS,kBAC7B,gBAAgB,SAAS,iBAAiB,iBAAiB,IAC3D,KAAA;CACJ,sBACE,SAAS,SACT,CAAC,WAAW,qBAAqB,GACjC,8CACF;CACA,IACE,SAAS,QAAQ,YAAY,QAC7B,SAAS,QAAQ,wBAAwB,MAAM,qBAE/C,MAAM,IAAI,MAAM,yEAAyE;CAE3F,sBACE,SAAS,OACT;EAAC;EAAU;EAAiB;CAAa,GACzC,4CACF;CACA,IACE,SAAS,MAAM,WAAW,QAC1B,SAAS,MAAM,kBAAkB,MAAM,QAAQ,iBAC/C,SAAS,MAAM,gBAAgB,MAAM,QAAQ,kBAE7C,MAAM,IAAI,MAAM,4EAA4E;CAE9F,IAAI,MAAM,QAAQ,QAAQ;EACxB,IAAI,CAAC,SAAS,QACZ,MAAM,IAAI,MAAM,iEAAiE;EAEnF,sBACE,SAAS,QACT;GAAC;GAAU;GAAiB;GAAgB;EAAoB,GAChE,6CACF;EACA,IACE,SAAS,OAAO,WAAW,QAC3B,SAAS,OAAO,kBAAkB,MAAM,QAAQ,iBAChD,SAAS,OAAO,iBAAiB,MAAM,QAAQ,OAAO,gBACtD,SAAS,OAAO,uBAAuB,MAAM,QAAQ,OAAO,oBAE5D,MAAM,IAAI,MACR,8EACF;CAEJ,OAAO,IAAI,SAAS,WAAW,KAAA,GAC7B,MAAM,IAAI,MAAM,qEAAqE;CAEvF,OAAO,OAAO,OAAO;EACnB,cAAc,SAAS;EACvB;EACA;EACA,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;EAC7C,SAAS,OAAO,OAAO,EAAE,GAAG,SAAS,QAAQ,CAAC;EAC9C,OAAO,OAAO,OAAO,EAAE,GAAG,SAAS,MAAM,CAAC;EAC1C,GAAI,SAAS,SAAS,EAAE,QAAQ,OAAO,OAAO,EAAE,GAAG,SAAS,OAAO,CAAC,EAAE,IAAI,CAAC;CAC7E,CAAC;AACH;AAEA,SAAS,mBACP,QACuC;CACvC,IAAI,OAAO,WAAW,eAAe,OAAO,WAAW,UACrD,MAAM,IAAI,MAAM,gDAAgD;CAElE,sBACE,QACA,OAAO,WAAW,cACd;EAAC;EAAU;EAAS;EAAmB;EAAe;EAAmB;CAAY,IACrF;EACE;EACA;EACA;EACA;EACA,GAAI,OAAO,kBAAkB,CAAC,iBAAiB,IAAI,CAAC;CACtD,GACJ,qCACF;CACA,MAAM,QAAQ,UAAU,OAAO,KAAK;CACpC,MAAM,kBAAkB,gBAAgB,OAAO,iBAAiB,iBAAiB;CACjF,IAAI,OAAO,WAAW,aACpB,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR;EACA;EACA,aAAa,gBAAgB,OAAO,aAAa,aAAa;EAC9D,iBAAiB,gBAAgB,OAAO,iBAAiB,iBAAiB;EAC1E,YAAY,gBAAgB,OAAO,YAAY,YAAY;CAC7D,CAAC;CAEH,mBAAmB,OAAO,YAAY;CACtC,IAAI,OAAO,iBAAiB,8BAA8B,MAAM,eAAe,GAC7E,MAAM,IAAI,MAAM,6DAA6D;CAE/E,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR,cAAc,OAAO;EACrB;EACA;EACA,GAAI,OAAO,kBACP,EAAE,iBAAiB,gBAAgB,OAAO,iBAAiB,iBAAiB,EAAE,IAC9E,CAAC;CACP,CAAC;AACH;AAEA,SAAS,UAAU,OAA2D;CAC5E,sBACE,OACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;CACF,GACA,oCACF;CACA,KAAK,MAAM,SAAS;EAClB;EACA;EACA;EACA;EACA;EACA;CACF,GACE,cAAY,MAAM,QAAQ,kBAAkB,OAAO;CAErD,IAAI,MAAM,mBAAmB,cAAc,MAAM,mBAAmB,aAClE,MAAM,IAAI,MAAM,6DAA6D;CAE/E,OAAO,OAAO,OAAO;EACnB,cAAc,MAAM;EACpB,aAAa,MAAM;EACnB,cAAc,MAAM;EACpB,mBAAmB,MAAM;EACzB,iBAAiB,MAAM;EACvB,YAAY,MAAM;EAClB,gBAAgB,MAAM;CACxB,CAAC;AACH;AAEA,SAAS,gBAAgB,KAAgC,OAA0C;CACjG,MAAM,SAAS,gCAAgC,MAAM,GAAG;CACxD,IAAI,CAAC,OAAO,cAAc,OAAO,UAAU,GACzC,MAAM,IAAI,MAAM,gCAAgC,MAAM,uCAAuC;CAE/F,OAAO,wBAAwB,MAAM;AACvC;AAEA,SAAS,mBACP,OACA,MACA,OAC2B;CAC3B,OAAOG,gBAAc,OAAO,MAAM,KAAK;AACzC;AAEA,SAASF,gBAAc,OAAgB,MAAc,OAAuB;CAC1E,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,iCAAiC,KAAK,eAAe,OAAO;CAE9E,OAAO;AACT;AAEA,SAASC,gBAAc,OAAgB,MAAc,OAAuB;CAC1E,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,iCAAiC,KAAK,eAAe,OAAO;CAE9E,OAAO;AACT;AAEA,SAASC,gBAAc,OAAgB,MAAc,OAAwC;CAC3F,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,iCAAiC,KAAK,eAAe,OAAO;CAE9E,OAAO;AACT;AAEA,SAAS,sBACP,OACA,MACiD;CACjD,IAAI,UAAU,eAAe,UAAU,UACrC,MAAM,IAAI,MAAM,0CAA0C,KAAK,oBAAoB;CAErF,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAgB,MAAmD;CAC9F,IAAI;EACF,mBAAmB,KAAK;EACxB,OAAO;CACT,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,0CAA0C,KAAK,4BAA4B,EACzF,OAAO,MACT,CAAC;CACH;AACF;AAEA,SAAS,mBAAmB,OAAsE;CAChG,IACE,UAAU,8BACV,UAAU,eACV,UAAU,+BACV,UAAU,WAEV,MAAM,IAAI,MAAM,6CAA6C;AAEjE;AAEA,SAASC,oBAAkB,OAAyC;CAClE,IAAI,OAAO,UAAU,YAAY,CAAC,2BAA2B,KAAK,KAAK,GACrE,MAAM,IAAI,MAAM,kDAAkD;AAEtE;AAEA,SAASC,qBAAmB,OAAe,OAAqB;CAC9D,IAAI,CAACN,iBAAe,KAAK,KAAK,GAC5B,MAAM,IAAI,MAAM,6BAA6B,MAAM,mCAAmC;AAE1F;AAEA,SAASO,cAAY,OAAgB,OAAwC;CAC3E,IAAI,CAAC,OAAO,cAAc,KAAK,KAAM,QAAmB,GACtD,MAAM,IAAI,MAAM,uBAAuB,MAAM,qCAAqC;AAEtF;ACjgBA,SAAgB,wBAAwB,WAAuC;CAC7E,MAAM,YAAY,aAAA;CAClB,IACE,CAAC,OAAO,cAAc,SAAS,KAC/B,aAAa,KACb,YAAA,YAEA,MAAM,IAAI,MAAM,gEAAgE;CAElF,OAAO;AACT;AAEA,SAAgB,yBAAyB,WAAuC;CAC9E,OAAO,KAAK,IAAI,IAAI,wBAAwB,SAAS;AACvD;;AAGA,SAAgB,uBACd,WACA,eACQ;CACR,MAAM,YAAY,aAAa;CAC/B,IACE,CAAC,OAAO,cAAc,SAAS,KAC/B,aAAa,KACb,YAAA,YAEA,MAAM,IAAI,MAAM,+DAA+D;CAEjF,OAAO;AACT;;AAGA,eAAsB,+BACpB,WACA,cACA,OACY;CACZ,OAAO,wBAAwB,WAAW,cAAc,IAAI,6BAA6B,KAAK,CAAC;AACjG;;;;;AAMA,eAAsB,8BACpB,WACA,cACA,OACY;CACZ,OAAO,wBAAwB,WAAW,cAAc,IAAI,4BAA4B,KAAK,CAAC;AAChG;AAEA,eAAe,wBACb,WACA,cACA,cACY;CACZ,MAAM,cAAc,eAAe,KAAK,IAAI;CAC5C,IAAI,eAAe,GAAG,MAAM;CAE5B,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,UAAU,QAAQ,QAAQ,CAAC,CAAC,WAAW,UAAU,WAAW,MAAM,CAAC;CACzE,QAAa,YAAY,KAAA,CAAS;CAClC,IAAI;CACJ,IAAI;EACF,MAAM,SAAS,MAAM,QAAQ,KAAK,CAChC,SACA,IAAI,SAAgB,UAAU,WAAW;GACvC,QAAQ,iBAAiB;IACvB,WAAW,MAAM,YAAY;IAC7B,OAAO,YAAY;GACrB,GAAG,WAAW;EAChB,CAAC,CACH,CAAC;EAED,IAAI,KAAK,IAAI,KAAK,cAAc;GAC9B,WAAW,MAAM,YAAY;GAC7B,MAAM;EACR;EACA,OAAO;CACT,UAAU;EACR,IAAI,OAAO,aAAa,KAAK;CAC/B;AACF;AAEA,IAAa,+BAAb,cAAkD,MAAM;CACtD,YAAY,OAAe;EACzB,MAAM,GAAG,MAAM,wDAAwD;EACvE,KAAK,OAAO;CACd;AACF;AAEA,IAAa,8BAAb,cAAiD,MAAM;CACrD,YAAY,OAAe;EACzB,MAAM,GAAG,MAAM,uDAAuD;EACtE,KAAK,OAAO;CACd;AACF;;;ACpGA,MAAa,2CAA2C;AACxD,MAAM,oCAAoC;;AAG1C,SAAgB,yBACd,kBACA,iBACQ;CACR,MAAM,WACJ,mBAAmB,oCACnB,kBACA;CACF,IAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAA,YACrC,MAAM,IAAI,MAAM,6DAA6D;CAE/E,OAAO;AACT;;AAGA,SAAgB,gCACd,WACA,kBACA,iBACQ;CACR,MAAM,WAAW,YAAY,yBAAyB,kBAAkB,eAAe;CACvF,IAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAA,YACrC,MAAM,IAAI,MAAM,0EAA0E;CAE5F,OAAO;AACT;;AAGA,SAAgB,0BAA0B,kBAAkC;CAC1E,MAAM,WAAW,mBAAmB;CACpC,IAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAA,YACrC,MAAM,IAAI,MAAM,6DAA6D;CAE/E,OAAO;AACT;;;ACzBA,SAAgB,iBAAiB,UAAkD;CACjF,OAAO,GAAG,SAAS,OAAO,GAAG,SAAS;AACxC;AAEA,eAAsB,qBACpB,UACA,MACqB;CACrB,MAAM,QACJ,aAAa,WACT,OAAO,KAAK,SAAS,SAAS,QAAQ,IACtC,MAAM,KAAK,KAAK,QAAqC;CAC3D,YAAY,OAAO,SAAS,QAAQ,SAAS,YAAY,oBAAoB;CAC7E,OAAO,WAAW,KAAK,KAAK;AAC9B;AAEA,SAAgB,YACd,OACA,QACA,YACA,OACM;CACN,IAAI,MAAM,eAAe,YACvB,MAAM,IAAI,MAAM,GAAG,MAAM,eAAe,MAAM,WAAW,kBAAkB,YAAY;CAEzF,MAAM,SAAS,YAAY,KAAK;CAChC,IAAI,WAAW,QACb,MAAM,IAAI,MAAM,GAAG,MAAM,UAAU,OAAO,kBAAkB,QAAQ;AAExE;AAEA,eAAsB,iCACpB,UACA,MACwD;CACxD,MAAM,CAAC,UAAU,WAAW,MAAM,QAAQ,IAAI,CAC5C,qBAAqB,SAAS,UAAU,IAAI,GAC5C,qBAAqB,SAAS,SAAS,IAAI,CAC7C,CAAC;CACD,MAAM,oBAAoB,wBAAwB,SAAS,QAAQ;CACnE,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,iBAAiB,CAAC,GAC9D,MAAM,IAAI,MAAM,0EAA0E;CAE5F,IAAI,YAAY,iBAAiB,MAAM,SAAS,QAC9C,MAAM,IAAI,MAAM,0EAA0E;CAE5F,OAAO;EAAE;EAAU;CAAQ;AAC7B;AAEA,eAAsB,4BACpB,MACA,UACA,UAA8E,CAAC,GAChE;CAEf,yBAAwB,MADD,cAAc,MAAM,IAAI,IAAI,QAAQ,+BAA+B,CAAC,CAAC,CAAC,EAAA,CAC5D,UAAU,QAAQ;AACrD;AAEA,eAAsB,6BACpB,MACA,UAOI,CAAC,GAIJ;CACD,MAAM,WAAW,MAAM,cACrB,MACA,IAAI,IAAI,QAAQ,+BAA+B,CAAC,CAAC,GACjD,QAAQ,MACV;CACA,OAAO;EACL,UAAU,SAAS;EACnB,OAAO,SAAS,MAAM,KAAK,UAAU;GACnC,MAAM,KAAK;GACX,MAAM,KAAK;GACX,OAAO,WAAW,KAAK,KAAK,KAAK;EACnC,EAAE;CACJ;AACF;;AAGA,eAAsB,+BACpB,MACA,UACA,UAA8E,CAAC,GACJ;CAC3E,MAAM,WAAW,MAAM,6BAA6B,MAAM,OAAO;CACjE,wBAAwB,SAAS,UAAU,QAAQ;CACnD,OAAO,SAAS,MAAM,KAAK,SACzB,OAAO,OAAO;EAAE,MAAM,KAAK;EAAM,MAAM,KAAK;EAAM,OAAO,WAAW,KAAK,KAAK,KAAK;CAAE,CAAC,CACxF;AACF;AAEA,SAAgB,2BACd,OACyC;CACzC,OAAO;EACL,MAAM;EACN,OAAO,MACJ,KAAK,UAAU;GACd,MAAM,KAAK;GACX,MAAM,KAAK;GACX,QAAQ,YAAY,KAAK,KAAK;GAC9B,YAAY,KAAK,MAAM;EACzB,EAAE,CAAC,CACF,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAAE;CACpE;AACF;AAEA,SAAS,wBACP,UACA,UACM;CACN,IAAI,CAAC,OAAO,KAAK,wBAAwB,QAAQ,CAAC,CAAC,CAAC,OAAO,wBAAwB,QAAQ,CAAC,GAC1F,MAAM,IAAI,MACR,gFACF;AAEJ;AAEA,eAAsB,mCACpB,MACA,UACe;CAEf,MAAM,mBAAkB,MADD,cAAc,sBAAM,IAAI,IAAI,CAAC,EAAA,CACnB,SAAS,MAAM,KAAK,EAAE,MAAM,MAAM,cAAc;EAC/E,SAAS;EACT;EACA,eAAe;CACjB,EAAE;CACF,IACE,CAAC,OAAO,KAAK,wBAAwB,eAAe,CAAC,CAAC,CAAC,OACrD,wBAAwB,SAAS,KAAK,CACxC,GAEA,MAAM,IAAI,MAAM,6EAA6E;AAEjG;AAEA,eAAe,cACb,MACA,6BACA,QAQC;CACD,MAAM,eAAe,QAAQ,IAAI;CACjC,MAAM,YAAY,MAAM,MAAM,YAAY;CAC1C,IAAI,CAAC,UAAU,YAAY,KAAK,UAAU,eAAe,GACvD,MAAM,IAAI,MAAM,yCAAyC;CAE3D,IAAK,MAAM,SAAS,YAAY,MAAO,cACrC,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,gBAA0E,CAAC;CACjF,IAAI,aAAa;CAEjB,eAAe,MAAM,WAAkC;EACrD,MAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC;EAChE,QAAQ,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAAE;EACvE,KAAK,MAAM,SAAS,SAAS;GAC3B,IAAI,cAAc,gBAAgB,4BAA4B,IAAI,MAAM,IAAI,GAC1E;GAEF,MAAM,WAAW,QAAQ,WAAW,MAAM,IAAI;GAC9C,MAAM,UAAU,SAAS,cAAc,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG;GACpE,IAAI,CAAC,WAAW,QAAQ,WAAW,KAAK,KAAK,QAAQ,SAAS,MAAM,GAClE,MAAM,IAAI,MAAM,iCAAiC,SAAS;GAE5D,MAAM,QAAQ,MAAM,MAAM,QAAQ;GAClC,IAAI,MAAM,eAAe,GACvB,MAAM,IAAI,MAAM,iCAAiC,SAAS;GAE5D,IAAI,MAAM,YAAY,GAAG;IACvB,MAAM,MAAM,QAAQ;IACpB;GACF;GACA,IAAI,CAAC,MAAM,OAAO,GAChB,MAAM,IAAI,MAAM,2CAA2C,SAAS;GAEtE,IAAI,UAAU,cAAc,UAAU,OAAO,UAC3C,MAAM,IAAI,MAAM,4BAA4B;GAE9C,MAAM,aAAa,MAAM,KACvB,UACAC,UAAY,YACT,OAAOA,UAAY,eAAe,WAAWA,UAAY,aAAa,EAC3E;GACA,IAAI;IACF,MAAM,cAAc,MAAM,WAAW,KAAK;IAC1C,IAAI,CAAC,YAAY,OAAO,GACtB,MAAM,IAAI,MAAM,2CAA2C,SAAS;IAEtE,IAAI,YAAY,UAAU,GACxB,MAAM,IAAI,MAAM,0CAA0C,SAAS;IAErE,MAAM,OAAO,YAAY,OAAO;IAChC,IAAI,UAAU,YAAY,OAAO,OAAO,cACtC,MAAM,IAAI,MAAM,wCAAwC,SAAS;IAEnE,MAAM,iBAAiB,SAAS,OAAO,oBAAoB,aAAa,KAAA;IACxE,IAAI,mBAAmB,KAAA,KAAa,YAAY,OAAO,gBACrD,MAAM,IAAI,MAAM,qCAAqC;IAEvD,MAAM,QAAQ,MAAM,gBAClB,YACA,SAAS,KAAK,IAAI,OAAO,cAAc,kBAAkB,OAAO,YAAY,IAAI,KAAA,GAChF,OACF;IACA,cAAc,MAAM;IACpB,cAAc,KAAK;KAAE,MAAM;KAAS;KAAM,OAAO,WAAW,KAAK,KAAK;IAAE,CAAC;GAC3E,UAAU;IACR,MAAM,WAAW,MAAM;GACzB;EACF;CACF;CAEA,MAAM,MAAM,YAAY;CACxB,OAAO;EACL,UAAU,2BAA2B,aAAa;EAClD,OAAO;CACT;AACF;AAEA,eAAe,gBACb,YACA,UACA,MACiB;CACjB,IAAI,aAAa,KAAA,GAAW,OAAO,MAAM,WAAW,SAAS;CAC7D,MAAM,SAAmB,CAAC;CAC1B,IAAI,QAAQ;CACZ,OAAO,MAAM;EACX,MAAM,YAAY,WAAW;EAC7B,MAAM,QAAQ,OAAO,YAAY,KAAK,IAAI,KAAK,MAAM,YAAY,CAAC,CAAC;EACnE,MAAM,EAAE,cAAc,MAAM,WAAW,KAAK,OAAO,GAAG,MAAM,YAAY,IAAI;EAC5E,IAAI,cAAc,GAAG;EACrB,SAAS;EACT,IAAI,QAAQ,UAAU,MAAM,IAAI,MAAM,6CAA6C,MAAM;EACzF,OAAO,KAAK,MAAM,SAAS,GAAG,SAAS,CAAC;CAC1C;CACA,OAAO,OAAO,OAAO,QAAQ,KAAK;AACpC;;;ACxPA,eAAsB,oBACpB,MACA,cACA,YAC6B;CAC7B,IAAI,KAAK,SAAS,YAAY,OAAO,KAAA;CACrC,MAAM,iBAAiB,MAAM,uBAAuB,KAAK,YAAY,YAAY;CACjF,MAAM,wBAAwB,gBAAgB,KAAK,YAAY,KAAK,QAAQ;CAE5E,IAAI,KAAK,SAAS,SAAS;EACzB,MAAM,eAAe,gBAAgB,KAAK,QAAQ;EAClD,OAAO,KAAK;CACd;CACA,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,qDAAqD;CAEtF,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,sBAAsB,CAAC;CACtE,IAAI;EACF,MAAM,YAAY,KAAK,WAAW,OAAO;EACzC,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,KAAK,QAAQ,GAAG,KAAA,GAAW,EAC7E,gBAAgB,UAClB,CAAC;EACD,MAAM,gBACJ,gBACA;GAAC;GAAS;GAAY;GAAY;GAAuB;EAAG,GAC5D,YACA,EAAE,gBAAgB,UAAU,CAC9B;EACA,MAAM,iBACJ,MAAM,gBAAgB,gBAAgB,CAAC,YAAY,GAAG,KAAA,GAAW,EAC/D,gBAAgB,UAClB,CAAC,EAAA,CACD,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EACR,IAAI,kBAAkB,KAAK,eACzB,MAAM,IAAI,MACR,+BAA+B,cAAc,kBAAkB,KAAK,eACtE;EAEF,MAAM,eAAe,gBAAgB,aAAa;EAClD,OAAO;CACT,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAsB,4BACpB,UACA,cACqB;CACrB,MAAM,iBAAiB,MAAM,uBAAuB,SAAS,YAAY,YAAY;CAMrF,KAJE,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAM,SAAS;CAAM,CAAC,EAAA,CACzE,OACC,SAAS,MAAM,CAAC,CAChB,KACU,MAAM,UACjB,MAAM,IAAI,MAAM,kDAAkD,SAAS,QAAQ;CAErF,MAAM,WACJ,MAAM,gBAAgB,gBAAgB;EAAC;EAAW;EAAM,SAAS;EAAQ;EAAM,SAAS;CAAI,CAAC,EAAA,CAC7F;CACF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,QAAQ,WAAW,KAAK,QAAQ,EAAE,EAAE,SAAS,SAAS,MACxD,MAAM,IAAI,MAAM,+CAA+C,SAAS,MAAM;CAEhF,MAAM,QAAQ,QAAQ;CACtB,IAAI,OAAO,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACvE,MAAM,IAAI,MAAM,mDAAmD,SAAS,MAAM;CAEpF,MAAM,SAAS,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAQ,MAAM;CAAM,CAAC,EAAA,CAAG;CAC1F,YAAY,OAAO,SAAS,QAAQ,SAAS,YAAY,mBAAmB,SAAS,MAAM;CAC3F,OAAO,WAAW,KAAK,KAAK;AAC9B;AAEA,eAAsB,mBACpB,UACA,UACe;CACf,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,QAAQ,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK;CAC/F,IAAI,SAAS,SAAS,YACpB,MAAM,IAAI,MAAM,sBAAsB,KAAK,kBAAkB,SAAS,YAAY;CAEpF,MAAM,QAAQ,MAAM,gBAAgB,MAAM,CAAC,aAAa,aAAa,CAAC,EAAA,CAAG,OACtE,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,IAAI,SAAS,SAAS,UACpB,MAAM,IAAI,MAAM,2BAA2B,KAAK,kBAAkB,SAAS,UAAU;AAEzF;;;;;AAMA,eAAsB,uBAAuB,OAOa;CACxD,MAAM,iBAAiB,QAAQ,MAAM,cAAc;CACnD,MAAM,mBAAmB,gBAAgB,KAAK;CAC9C,MAAM,SAAS,SACZ,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,oBAAoB,CAAC,EAAA,CAAG,OAC1E,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,MAAM,MAAO,UAAU,OAAO,SAAS,GAAG,GAC5D,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,uBAAuB,gBAAgB,QAAQ,iBAAiB;CAEtE,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,+BAA+B,CAAC;CAC/E,IAAI;EACF,MAAM,kBAAkB,KAAK,WAAW,SAAS;EACjD,MAAM,YAAY,KAAK,WAAW,OAAO;EACzC,MAAM,MAAM,eAAe;EAC3B,MAAM,iBAAiB;GACrB,gBAAgB;GAChB,sBAAsB;GACtB,kCAAkC,KAAK,QAAQ,SAAS;EAC1D;EACA,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,MAAM,QAAQ,GAAG,KAAA,GAAW,cAAc;EAC9F,IAAI,MAAM,MAAM,aAAa,GAC3B,MAAM,gBACJ,gBACA;GAAC;GAAS;GAAY;GAAY;GAAuB;EAAG,GAC5D,MAAM,OACN,cACF;EAEF,MAAM,cACJ,MAAM,gBAAgB,gBAAgB,CAAC,YAAY,GAAG,KAAA,GAAW,cAAc,EAAA,CAC/E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EACR,IAAI,eAAe,MAAM,YACvB,MAAM,IAAI,MACR,wCAAwC,WAAW,kBAAkB,MAAM,YAC7E;EAEF,MAAM,eAAe,gBAAgB,YAAY,cAAc;EAC/D,MAAM,WAAW,MAAM,6BAA6B,gBAAgB,YAAY,cAAc;EAC9F,IACE,CAAC,OAAO,KAAK,wBAAwB,QAAQ,CAAC,CAAC,CAAC,OAC9C,OAAO,KAAK,wBAAwB,MAAM,UAAU,CAAC,CACvD,GAEA,MAAM,IAAI,MAAM,sEAAsE;EAExF,MAAM,gBACJ,MAAM,gBACJ,gBACA;GAAC;GAAe;GAAY;GAAM,MAAM;EAAU,GAClD,OAAO,KAAK,4BAA4B,MAAM,GAC9C;GACE,GAAG;GACH,iBAAiB;GACjB,kBAAkB;GAClB,iBAAiB;GACjB,oBAAoB;GACpB,qBAAqB;GACrB,oBAAoB;EACtB,CACF,EAAA,CACA,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EAWR,KATE,MAAM,gBACJ,gBACA,CAAC,aAAa,GAAG,aAAa,QAAQ,GACtC,KAAA,GACA,cACF,EAAA,CACA,OACC,SAAS,MAAM,CAAC,CAChB,KACa,MAAM,YACpB,MAAM,IAAI,MAAM,sEAAsE;EAExF,OAAO;GAAE;GAAY;EAAa;CACpC,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAe,uBACb,YACA,cACiB;CACjB,MAAM,iBAAiB,QAAQ,MAAM,aAAa,QAAQ,UAAU,CAAC;CAErE,IAAI,EAAC,MADmB,KAAK,cAAc,EAAA,CAC5B,YAAY,GAAG,MAAM,IAAI,MAAM,8CAA8C;CAE5F,MAAM,UAAU,MAAM,gBAAgB,gBAAgB;EAAC;EAAU;EAAW;CAAQ,CAAC,EAAA,CAAG,OACrF,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,SAAS,kBAAkB,MAAM;CACvC,IAAI,CAAC,UAAU,OAAO,UAAU,WAAW,SAAS,OAAO,SAAS,WAAW,MAC7E,MAAM,IAAI,MACR,2BAA2B,UAAU,YAAY,6BAA6B,WAAW,MAAM,GAAG,WAAW,MAC/G;CASF,MAAM,uBAAuB,gBADd,SAJb,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,oBAAoB,CAAC,EAAA,CACzE,OACC,SAAS,MAAM,CAAC,CAChB,KAC6B,CACkB,GAAG,sBAAsB;CAC3E,OAAO;AACT;AAEA,eAAsB,uBACpB,gBACA,QACA,OACe;CAMf,KAJE,MAAM,gBAAgB,gBAAgB;EAAC;EAAgB;EAAuB;CAAc,CAAC,EAAA,CAC7F,OACC,SAAS,MAAM,CAAC,CAChB,KACY,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CACtE,MAAM,YAAY,QAChB,iBACC,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,kBAAkB,CAAC,EAAA,CAAG,OACxE,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,SAAS,MAAO,aAAa,UAAU,SAAS,GAAG,GACrE,MAAM,IAAI,MAAM,GAAG,MAAM,8CAA8C;CAEzE,KAAK,MAAM,8BAAc,IAAI,IAAI,CAAC,QAAQ,SAAS,CAAC,GAClD,KAAK,MAAM,QAAQ,CAAC,cAAc,iBAAiB,GAAG;EACpD,MAAM,OAAO,KAAK,YAAY,WAAW,QAAQ,IAAI;EACrD,IAAI;GAEF,KAAI,MADmB,SAAS,MAAM,MAAM,EAAA,CAC/B,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sBAAsB,MAAM;EAC5E,SAAS,OAAO;GACd,IAAI,CAAC,UAAU,KAAK,GAAG,MAAM;EAC/B;CACF;AAEJ;AAEA,eAAe,wBACb,gBACA,QACA,cACe;CAIf,KAHc,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAM;CAAM,CAAC,EAAA,CAAG,OAC9E,SAAS,MAAM,CAAC,CAChB,KACI,MAAM,UAAU,MAAM,IAAI,MAAM,0CAA0C,QAAQ;CACzF,MAAM,cACJ,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,GAAG,OAAO,QAAQ,CAAC,EAAA,CACvE,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,IAAI,eAAe,cACjB,MAAM,IAAI,MAAM,8BAA8B,WAAW,kBAAkB,cAAc;AAE7F;AAEA,eAAe,eACb,gBACA,MACA,cAAsC,CAAC,GACxB;CACf,MAAM,WACJ,MAAM,gBACJ,gBACA;EAAC;EAAW;EAAO;EAAe;CAAI,GACtC,KAAA,GACA,WACF,EAAA,CACA;CACF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,QAAQ,WAAW,GAAG,MAAM,IAAI,MAAM,oCAAoC;CAC9E,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,MAAM,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACtE,MAAM,IAAI,MACR,kEAAkE,MAAM,MAC1E;EAEF,kBAAkB,MAAM,IAAI;CAC9B;AACF;AAEA,eAAe,6BACb,gBACA,MACA,aACkD;CAClD,OAAO,2BACL,MAAM,0BAA0B,gBAAgB,MAAM,WAAW,CACnE;AACF;AAEA,eAAsB,0BACpB,gBACA,MACA,cAAsC,CAAC,GACvC,QAC0E;CAC1E,MAAM,WACJ,MAAM,gBACJ,gBACA;EAAC;EAAW;EAAQ;EAAe;CAAI,GACvC,KAAA,GACA,WACF,EAAA,CACA;CACF,MAAM,QAAyE,CAAC;CAChF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,UAAU,QAAQ,SAAS,OAAO,UACpC,MAAM,IAAI,MAAM,qCAAqC;CAEvD,IAAI,aAAa;CACjB,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,MAAM,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACtE,MAAM,IAAI,MAAM,mDAAmD,MAAM,MAAM;EAEjF,kBAAkB,MAAM,IAAI;EAC5B,IAAI,MAAM,SAAS,KAAA,GACjB,MAAM,IAAI,MAAM,4CAA4C,MAAM,MAAM;EAE1E,IAAI,UAAU,MAAM,OAAO,OAAO,cAChC,MAAM,IAAI,MAAM,iDAAiD,MAAM,MAAM;EAE/E,cAAc,MAAM;EACpB,IAAI,UAAU,aAAa,OAAO,mBAChC,MAAM,IAAI,MAAM,8CAA8C;EAEhE,MAAM,SACJ,MAAM,gBACJ,gBACA;GAAC;GAAY;GAAQ,MAAM;EAAM,GACjC,KAAA,GACA,WACF,EAAA,CACA;EACF,IAAI,MAAM,eAAe,MAAM,MAC7B,MAAM,IAAI,MAAM,oCAAoC,MAAM,MAAM;EAElE,MAAM,KAAK;GACT,MAAM,MAAM;GACZ,MAAM,MAAM,SAAS,WAAW,MAAQ;GACxC,OAAO,WAAW,KAAK,KAAK;EAC9B,CAAC;CACH;CACA,OAAO,MAAM,MAAM,MAAM,UAAW,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,CAAE;AACnG;AAEA,SAAS,iBAAiB,OAMvB;CACD,MAAM,MAAM,OAAO,KAAK,KAAK;CAC7B,MAAM,UAAU,IAAI,SAAS,MAAM;CACnC,IAAI,CAAC,OAAO,KAAK,SAAS,MAAM,CAAC,CAAC,OAAO,GAAG,GAC1C,MAAM,IAAI,MAAM,8CAA8C;CAGhE,OADa,QAAQ,MAAM,IAAI,CAAC,CAAC,OAAO,OAC9B,CAAC,CAAC,KAAK,QAAQ;EACvB,MAAM,MAAM,IAAI,QAAQ,GAAI;EAC5B,MAAM,SAAS,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;EAC1D,MAAM,OAAO,IAAI,MAAM,MAAM,CAAC;EAC9B,MAAM,CAAC,MAAM,MAAM,QAAQ,YAAY;EACvC,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,MAC3C,MAAM,IAAI,MAAM,0BAA0B;EAE5C,MAAM,OAAO,YAAY,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,IAAI,KAAA;EACrE,IAAI,SAAS,KAAA,KAAa,CAAC,OAAO,cAAc,IAAI,GAClD,MAAM,IAAI,MAAM,8DAA8D;EAEhF,OAAO;GAAE;GAAM;GAAM;GAAQ,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;GAAI;EAAK;CAC7E,CAAC;AACH;AAEA,SAAS,kBAAkB,MAAoB;CAC7C,IACE,CAAC,QACD,KAAK,WAAW,GAAG,KACnB,KAAK,SAAS,IAAI,KAClB,KAAK,SAAS,IAAI,KAClBC,sBAAoB,IAAI,KACxB,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,KACrE,KAAK,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,YAAY,MAAM,QAEtC,MAAM,IAAI,MAAM,+CAA+C,MAAM;AAEzE;AAEA,SAASA,sBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,OAAO,MAAQ,SAAS,KAAM,OAAO;CAC3C;CACA,OAAO;AACT;AAEA,SAAS,kBAAkB,OAA4D;CACrF,MAAM,QAAQ,MAAM,MAClB,sGACF;CACA,IAAI,CAAC,QAAQ,MAAM,CAAC,MAAM,IAAI,OAAO,KAAA;CACrC,OAAO;EAAE,OAAO,MAAM;EAAI,MAAM,MAAM;CAAG;AAC3C;AAEA,eAAsB,gBACpB,gBACA,MACA,OACA,WAAmC,CAAC,GAChB;CACpB,MAAM,MAAM,OAAO,YACjB,OAAO,QAAQ,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,WAAW,MAAM,CAAC,CACzE;CACA,OAAO,OAAO,KAAK;EACjB,qBAAqB;EACrB,mBAAmB;EACnB,mBAAmB;EACnB,qBAAqB;EACrB,wBAAwB;EACxB,QAAQ;EACR,GAAG;CACL,CAAC;CACD,MAAM,WAAW;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,GAAG;CACL;CACA,OAAO,MAAM,IAAI,SAAS,eAAe,WAAW;EAClD,MAAM,QAAQ,MAAM,OAAO,UAAU;GAAE;GAAK,OAAO;IAAC;IAAQ;IAAQ;GAAM;EAAE,CAAC;EAC7E,MAAM,SAAmB,CAAC;EAC1B,MAAM,SAAmB,CAAC;EAC1B,MAAM,OAAO,GAAG,SAAS,UAAkB,OAAO,KAAK,KAAK,CAAC;EAC7D,MAAM,OAAO,GAAG,SAAS,UAAkB,OAAO,KAAK,KAAK,CAAC;EAC7D,MAAM,GAAG,SAAS,MAAM;EACxB,MAAM,GAAG,UAAU,MAAM,WAAW;GAClC,MAAM,MAAM,OAAO,OAAO,MAAM;GAChC,MAAM,MAAM,OAAO,OAAO,MAAM;GAChC,IAAI,SAAS,GAAG;IACd,uBACE,IAAI,MACF,OAAO,KAAK,MAAM,YAAY,WAAW,UAAU,KAAK,KAAK,IAAI,SAAS,MAAM,CAAC,CAAC,KAAK,GACzF,CACF;IACA;GACF;GACA,cAAc;IAAE,QAAQ;IAAK,QAAQ;GAAI,CAAC;EAC5C,CAAC;EACD,IAAI,OAAO,MAAM,MAAM,IAAI,KAAK;OAC3B,MAAM,MAAM,IAAI;CACvB,CAAC;AACH;AAEA,SAAS,UAAU,OAAyB;CAC1C,OACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAA4B,SAAS;AAE1C;;;ACrdA,MAAa,yBAAwC,OAAO,wBAAwB;AACpF,MAAa,yBAAwC,OAAO,wBAAwB;AACpF,MAAa,2BAA0C,OAAO,qBAAqB;;AA2iBnF,MAAa,uBAAuB;CAClC,aAAa;CACb,cAAc;CACd,qBAAqB;CACrB,8BAA8B;AAChC;;AAGA,MAAa,sBAAsB;CACjC,aAAa;CACb,cAAc;CACd,qBAAqB;CACrB,8BAA8B;CAC9B,YAAY;AACd;;;AC/gBA,MAAM,mCAAmB,IAAI,QAAiE;AAC9F,MAAM,uCAAuB,IAAI,QAgB/B;AAEF,SAAgB,iCACd,OACiC;CACjC,MAAM,QAAQ,6BAA6B,KAAK;CAChD,gCAAgC,KAAK;CACrC,MAAM,WAAW,OAAO,OAAO;EAC7B,QAAQ,MAAM;EACd,WAAW,OAAO,OAAO;GAAE,OAAO,MAAM;GAAgB,MAAM,MAAM;EAAc,CAAC;EACnF,aAAa,MAAM;EACnB,OAAO,MAAM;EACb,aAAa,aAAa,MAAM,WAAW;EAC3C,mBAAmB,MAAM;EACzB,eAAe,aAAa,MAAM,aAAa;EAC/C,wBAAwB,MAAM;EAC9B,QAAQ,MAAM;EACd,aAAa,UAAU,MAAM,aAAa,OAAO;EACjD,eAAe,MAAM;EACrB,GAAI,MAAM,YAAY,EAAE,WAAW,cAAc,MAAM,SAAS,EAAE,IAAI,CAAC;EACvE,OAAO,MAAM;EACb,QAAQ,MAAM;GACb,yBAAyB;CAC5B,CAAC;CACD,iBAAiB,IAAI,UAAU,KAAK;CACpC,qBAAqB,IAAI,UAAU,EAAE,QAAQ,WAAW,CAAC;CACzD,OAAO;AACT;AAEA,SAAgB,0BACd,UACwB;CACxB,MAAM,QAAQ,iBAAiB,IAAI,QAAQ;CAC3C,IAAI,CAAC,SAAS,SAAS,4BAA4B,MACjD,MAAM,IAAI,MAAM,yDAAyD;CAE3E,OAAO;AACT;;AAGA,SAAgB,iCACd,UACwB;CACxB,MAAM,QAAQ,0BAA0B,QAAQ;CAChD,gCAAgC,KAAK;CACrC,OAAO;AACT;;AAGA,SAAgB,4BACd,UACwB;CACxB,MAAM,QAAQ,iCAAiC,QAAQ;CACvD,oBAAoB,UAAU,CAAC,UAAU,GAAG,UAAU;CACtD,OAAO;AACT;;AAGA,SAAgB,+BACd,UACwB;CACxB,MAAM,QAAQ,iCAAiC,QAAQ;CACvD,oBAAoB,UAAU;EAAC;EAAY;EAAmB;CAAgB,GAAG,WAAW;CAC5F,OAAO;AACT;AAEA,SAAgB,6BAA6B,UAAiD;CAC5F,oBAAoB,UAAU,CAAC,UAAU,GAAG,SAAS;AACvD;;AAGA,SAAgB,0BACd,UACA,aACA,cAC2E;CAC3E,MAAM,QAAQ,iCAAiC,QAAQ;CACvD,2BAA2B,OAAO,YAAY,KAAK,cAAc,GAAG;CACpE,oBAAoB,UAAU,CAAC,SAAS,GAAG,SAAS;CACpD,MAAM,sBAAsB,wBAAwB;EAClD,GAAG,MAAM,OAAO;EAChB,GAAG,YAAY;EACf,GAAI,cAAc,OAAO,CAAC;EAC1B,GAAG,MAAM,MAAM;CACjB,CAAC;CACD,MAAM,WAAW,MAAM,cAAc,MAAM;CAkC3C,OAAO;EAAE;EAAO,SAjCA,OAAO,OAAO;GAC5B,aAAa,MAAM;GACnB,WAAW,kBAAkB,KAAK;GAClC,QAAQ,OAAO,OAAO;IACpB,MAAM,mBAAmB,MAAM,cAAc,WAAW,MAAM,eAAe,SAAS;IACtF,GAAI,SAAS,sBAAsB,MAAM,eAAe,iBACpD,EACE,WAAW,mBACT,SAAS,oBACT,MAAM,eAAe,cACvB,EACF,IACA,CAAC;IACL,SAAS,OAAO,OAAO,EACrB,OAAO,OAAO,OACZ,MAAM,eAAe,aAAa,KAAK,SAAS,gBAAgB,IAAI,CAAC,CACvE,EACF,CAAC;GACH,CAAC;GACD,OAAO,MAAM,MAAM;GACnB,aAAa,aAAa,MAAM,WAAW;GAC3C,mBAAmB,MAAM;GACzB,eAAe,aAAa,MAAM,aAAa;GAC/C,wBAAwB,MAAM;GAC9B,QAAQ,wBAAwB;IAAE,GAAG,MAAM;IAAQ,KAAK;GAAoB,CAAC;GAC7E,aAAa,UAAU,MAAM,aAAa,OAAO;GACjD,eAAe,MAAM;GACrB,YAAY,OAAO,OAAO,EAAE,WAAW,MAAM,cAAc,MAAM,SAAS,OAAO,UAAU,CAAC;GAC5F,gBAAgB,OAAO,OAAO,EAAE,UAAU,MAAM,cAAc,MAAM,SAAS,OAAO,SAAS,CAAC;GAC9F,GAAI,MAAM,YAAY,EAAE,WAAW,cAAc,MAAM,SAAS,EAAE,IAAI,CAAC;GACvE,OAAO,MAAM;GACb,QAAQ,MAAM;EAChB,CACsB;CAAE;AAC1B;AAEA,SAAS,kBACP,OAC8C;CAC9C,OAAO,OAAO,OAAO;EAAE,OAAO,MAAM;EAAgB,MAAM,MAAM;CAAc,CAAC;AACjF;AAEA,SAAgB,kCACd,UACA,SACM;CACN,oBACE,UACA,YAAY,cAAc,YAAY,oBAAoB,CAAC,WAAW,IAAI,CAAC,UAAU,GACrF,OACF;AACF;AAEA,SAAgB,iCAAiC,UAAiD;CAChG,oBAAoB,UAAU;EAAC;EAAY;EAAW;CAAS,GAAG,UAAU;AAC9E;;AAGA,eAAsB,kCACpB,OACe;CACf,MAAM,OAAO,MAAM,cAAc,MAAM;CACvC,MAAM,4BACJ,MAAM,MAAM,QAAQ,UACpB,MAAM,cAAc,UAAU,UAC9B,EACE,6BAA6B,CAAC,QAAQ,UAAU,EAClD,CACF;CACA,IAAI,MAAM,cAAc,YACtB,MAAM,mBAAmB,MAAM,MAAM,QAAQ,UAAU,MAAM,cAAc,UAAU;CAEvF,MAAM,mCACJ,MAAM,MAAM,QAAQ,aACpB,MAAM,YAAY,MAAM,QAC1B;CACA,IAAI,KAAK,oBAAoB;EAC3B,MAAM,gBAAgB,MAAM,MAAM,QAAQ;EAC1C,IAAI,CAAC,eAAe,MAAM,IAAI,MAAM,4CAA4C;EAChF,MAAM,4BAA4B,eAAe,KAAK,mBAAmB,QAAQ;CACnF,OAAO,IAAI,MAAM,MAAM,QAAQ,kBAAkB,KAAA,GAC/C,MAAM,IAAI,MAAM,oDAAoD;AAExE;AAEA,SAAS,6BAA6B,OAAuD;CAC3F,MAAM,iBAAiB,wBACrB,mCAAmC,MAAM,MAAM,cAAc,CAC/D;CACA,MAAM,gBAAgB,wBACpB,kCAAkC,MAAM,MAAM,aAAa,CAC7D;CACA,MAAM,cAAc,wBAClB,wCAAwC,MAAM,MAAM,YAAY,KAAK,CACvE;CACA,MAAM,oBAAoB,qCACxB,MAAM,mBACN,YAAY,MACd;CACA,MAAM,gBAAgB,wBACpB,0CAA0C,MAAM,MAAM,cAAc,KAAK,CAC3E;CAIA,MAAM,yBAAyB,2BAC7B,mBAJmB,wBACnB,2CAA2C,MAAM,MAAM,uBAAuB,KAAK,CAGrD,CAAC,CACjC;CACA,IAAI,uBAAuB,WAAW,MAAM,uBAAuB,QACjE,MAAM,IAAI,MAAM,yEAAyE;CAE3F,OAAO,OAAO,OAAO;EACnB,OAAO,MAAM;EACb,QAAQ,MAAM;EACd;EACA;EACA,aAAa,MAAM;EACnB,OAAO,wBAAwB,MAAM,KAAK;EAC1C,aAAa,OAAO,OAAO;GACzB,OAAO;GACP,OAAO,WAAW,KAAK,MAAM,YAAY,KAAK;GAC9C,SAAS,OAAO,OAAO,CAAC,GAAG,MAAM,YAAY,OAAO,CAAC;EACvD,CAAC;EACD;EACA,eAAe,OAAO,OAAO;GAC3B,OAAO;GACP,OAAO,WAAW,KAAK,MAAM,cAAc,KAAK;EAClD,CAAC;EACD;EACA,QAAQ,wBAAwB,MAAM,MAAM;EAC5C,aAAa,OAAO,OAAO;GACzB,OAAO,WAAW,KAAK,MAAM,YAAY,KAAK;GAC9C,UAAU,wBAAwB,MAAM,YAAY,QAAQ;EAC9D,CAAC;EACD,eAAe,wBAAwB,MAAM,aAAa;EAC1D,eAAe,MAAM;EACrB,wBAAwB,MAAM;EAC9B,kBAAkB,MAAM;EACxB,iBAAiB,MAAM;EACvB,kBAAkB,wBAAwB,MAAM,gBAAgB;EAChE,gBAAgB,OAAO,OAAO;GAC5B,WAAW,uBAAuB,MAAM,eAAe,SAAS;GAChE,GAAI,MAAM,eAAe,iBACrB,EAAE,gBAAgB,uBAAuB,MAAM,eAAe,cAAc,EAAE,IAC9E,CAAC;GACL,cAAc,uBAAuB,MAAM,eAAe,YAAY;EACxE,CAAC;EACD,GAAI,MAAM,oBACN,EAAE,mBAAmB,wBAAwB,MAAM,iBAAiB,EAAE,IACtE,CAAC;EACL,GAAI,MAAM,YACN,EACE,WAAW,OAAO,OAAO;GACvB,WAAW,wBAAwB,MAAM,UAAU,SAAS;GAC5D,UAAU,wBAAwB,MAAM,UAAU,QAAQ;GAC1D,OAAO,uBAAuB,MAAM,UAAU,KAAK;GACnD,GAAI,MAAM,UAAU,kBAChB,EAAE,iBAAiB,WAAW,KAAK,MAAM,UAAU,eAAe,EAAE,IACpE,CAAC;EACP,CAAC,EACH,IACA,CAAC;EACL,OAAO,wBAAwB,MAAM,KAAK;EAC1C,QAAQ,wBAAwB,MAAM,MAAM;CAC9C,CAAC;AACH;AAEA,SAAS,gCAAgC,OAAqC;CAE5E,IAAIC,2BADmB,mBAAmB,MAAM,MACN,CAAC,MAAM,MAAM,OAAO,QAC5D,MAAM,IAAI,MAAM,wDAAwD;CAE1E,mBAAmB,MAAM,YAAY,OAAO,MAAM,YAAY,OAAO,cAAc;CACnF,qCAAqC,MAAM,mBAAmB,MAAM,YAAY,MAAM,MAAM;CAC5F,mBAAmB,MAAM,cAAc,OAAO,MAAM,cAAc,OAAO,gBAAgB;CACzF,0CAA0C,MAAM,MAAM,cAAc,KAAK;CAEzE,MAAM,UAAU,2CAA2C,MACzD,MAAM,uBAAuB,KAC/B;CACA,MAAM,eAAe,wBAAwB,mBAAmB,OAAO,CAAC;CACxE,IACEA,2BAAyB,mBAAmB,OAAO,CAAC,MAAM,MAAM,uBAAuB,UACvF,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,OAAO,OAAO,KAAK,MAAM,uBAAuB,KAAK,CAAC,GAEjF,MAAM,IAAI,MAAM,wEAAwE;CAG1F,2BAA2B,KAAK;CAChC,MAAM,cAAc,OAAO,KAAK,MAAM,cAAc,aAAa,MAAM;CACvE,IACE,CAAC,OAAO,KAAK,MAAM,YAAY,KAAK,CAAC,CAAC,OAAO,WAAW,KACxD,KAAK,UAAU,MAAM,YAAY,QAAQ,MACvC,KAAK,UAAU,MAAM,cAAc,MAAM,SAAS,mBAAmB,GAEvE,MAAM,IAAI,MAAM,kEAAkE;CAEpF,IACE,CAAC,6CAA6C,KAAK,MAAM,aAAa,KACtE,CAAC,OAAO,cAAc,MAAM,sBAAsB,KAClD,MAAM,0BAA0B,KAChC,CAAC,OAAO,cAAc,MAAM,gBAAgB,KAC5C,MAAM,oBAAoB,KAC1B,CAAC,OAAO,cAAc,MAAM,eAAe,KAC3C,MAAM,mBAAmB,KACzB,KAAK,UAAU,MAAM,aAAa,MAChC,KAAK,UAAU,MAAM,cAAc,MAAM,SAAS,MAAM,QAAQ,KAClE,MAAM,iBAAiB,WAAW,MAAM,cAAc,MAAM,SAAS,MAAM,OAAO,eAClF,MAAM,iBAAiB,kBAAkB,MAAM,iBAC/C,MAAM,iBAAiB,gBAAgB,MAAM,0BAC7CA,2BAAyB,MAAM,iBAAiB,OAAO,MACrDA,2BAAyB,MAAM,cAAc,MAAM,SAAS,MAAM,OAAO,OAAO,KAClFA,2BAAyB,MAAM,iBAAiB,cAAc,MAC5DA,2BAAyBC,cAAY,MAAM,cAAc,MAAM,SAAS,MAAM,CAAC,GAEjF,MAAM,IAAI,MAAM,mEAAmE;CAErF,qBAAqB,KAAK;CAC1B,wBAAwB,KAAK;CAC7B,IACG,MAAM,OAAO,SAAS,cAAc,CAAC,MAAM,qBAC3C,MAAM,OAAO,SAAS,cAAc,MAAM,mBAE3C,MAAM,IAAI,MAAM,sEAAsE;CAExF,IACE,MAAM,OAAO,SAAS,cACtB,MAAM,sBACL,MAAM,kBAAkB,kBAAkB,MAAM,iBAC/C,MAAM,kBAAkB,gBAAgB,MAAM,0BAC9C,MAAM,kBAAkB,uBAAuB,MAAM,OAAO,qBAE9D,MAAM,IAAI,MAAM,sEAAsE;CAExF,IAAI,KAAK,UAAU,MAAM,MAAM,MAAM,KAAK,UAAU,MAAM,cAAc,MAAM,SAAS,MAAM,GAC3F,MAAM,IAAI,MAAM,6DAA6D;CAG/E,MAAM,eAAe;GAClB,qBAAqB,cAAc,MAAM;GACzC,qBAAqB,eAAe,MAAM,OAAO;GACjD,qBAAqB,sBAAsB,MAAM,cAAc,MAAM;GACrE,qBAAqB,+BAA+B,MAAM,uBAAuB;CACpF;CACA,MAAM,2BAA2B;GAC9B,oBAAoB,cAAc,MAAM;GACxC,oBAAoB,eAAe,MAAM,OAAO;GAChD,oBAAoB,sBAAsB,MAAM,cAAc,MAAM;GACpE,oBAAoB,+BAA+B,MAAM,uBAAuB;GAChF,oBAAoB,aAAa,MAAM,MAAM;CAChD;CACA,IACE,CAAC,MAAM,MAAM,MAAM,WACjB,GAAG,MAAM,YAAY,WAAW,MAAM,cAAc,MAAM,SAAS,QAAQ,QAAQ,EACrF,KACAD,2BAAyB,MAAM,MAAM,IAAI,MAAMA,2BAAyB,YAAY,KACpFA,2BAAyB,MAAM,MAAM,GAAG,MAAMA,2BAAyB,wBAAwB,GAE/F,MAAM,IAAI,MAAM,gEAAgE;AAEpF;AAEA,SAAS,mBACP,UAGA,OACA,OACM;CACN,MAAM,WAAW,wBAAwB,SAAS,QAAQ;CAC1D,IACE,YAAY,QAAQ,MAAM,SAAS,UACnC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,KAAK,CAAC,KAChD,SAAS,SAAS,WAAW,SAAS,UACtC,SAAS,SAAS,eAAe,MAAM,cACvC,EAAE,aAAa,SAAS,aACxB,CAAC,OAAO,KAAK,SAAS,SAAS,SAAS,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,KAAK,CAAC,GAE3E,MAAM,IAAI,MAAM,YAAY,MAAM,uCAAuC;AAE7E;AAEA,SAAS,aAA8D,UAAgB;CACrF,MAAM,QAAQ,WAAW,KAAK,SAAS,KAAK;CAC5C,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,KAAK;EAC9B;CACF,CAAC;AACH;AAEA,SAAS,UAA2C,OAAU,KAAiB;CAC7E,MAAM,QAAQ,WAAW,KAAK,MAAM,KAAK;CACzC,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,KAAK,OAAmB;GACtB,OAAO,WAAW,KAAK,KAAK;EAC9B;CACF,CAAC;AACH;AAEA,SAAS,cACP,WAC2D;CAC3D,MAAM,kBAAkB,UAAU,kBAC9B,WAAW,KAAK,UAAU,eAAe,IACzC,KAAA;CACJ,OAAO,OAAO,OAAO;EACnB,WAAW,UAAU;EACrB,UAAU,UAAU;EACpB,OAAO,OAAO,OAAO,UAAU,MAAM,KAAK,SAAS,gBAAgB,IAAI,CAAC,CAAC;EACzE,GAAI,kBACA,EACE,IAAI,kBAA8B;GAChC,OAAO,WAAW,KAAK,eAAe;EACxC,EACF,IACA,CAAC;CACP,CAAC;AACH;AACA,SAAS,mBACP,UACA,aACiD;CACjD,OAAO,OAAO,OAAO;EACnB;EACA,OAAO,OAAO,OAAO,YAAY,KAAK,SAAS,iBAAiB,IAAI,CAAC,CAAC;CACxE,CAAC;AACH;AAEA,SAAS,gBACP,QACqE;CACrE,MAAM,QAAQ,WAAW,KAAK,OAAO,KAAK;CAC1C,OAAO,OAAO,OAAO;EACnB,MAAM,OAAO;EACb,MAAM,OAAO;EACb,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,KAAK;EAC9B;CACF,CAAC;AACH;AAEA,SAAS,iBACP,QACqC;CACrC,MAAM,QAAQ,WAAW,KAAK,OAAO,KAAK;CAC1C,OAAO,OAAO,OAAO;EACnB,MAAM,OAAO;EACb,MAAM,OAAO;EACb,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,KAAK;EAC9B;CACF,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAqC;CACjE,MAAM,WAAW,MAAM,cAAc,MAAM;CAC3C,6BACE,MAAM,eAAe,WACrB,MAAM,cAAc,UAAU,QAChC;CACA,IAAI,SAAS,oBAAoB;EAC/B,IAAI,CAAC,MAAM,eAAe,gBACxB,MAAM,IAAI,MAAM,+CAA+C;EAEjE,6BACE,MAAM,eAAe,gBACrB,SAAS,mBAAmB,QAC9B;CACF,OAAO,IAAI,MAAM,eAAe,gBAC9B,MAAM,IAAI,MAAM,uCAAuC;CAGzD,MAAM,gBAAgB,MAAM,YAAY,MAAM,SAAS;CACvD,IAAI,MAAM,eAAe,aAAa,WAAW,cAAc,QAC7D,MAAM,IAAI,MAAM,sEAAsE;CAExF,KAAK,IAAI,QAAQ,GAAG,QAAQ,cAAc,QAAQ,SAAS;EACzD,MAAM,WAAW,cAAc;EAC/B,MAAM,SAAS,MAAM,eAAe,aAAa;EACjD,IACE,CAAC,YACD,CAAC,UACD,OAAO,SAAS,SAAS,WACzB,OAAO,SAAS,SAAS,QACzB,YAAY,OAAO,KAAK,MAAM,SAAS,eAEvC,MAAM,IAAI,MAAM,sEAAsE;CAE1F;AACF;AAEA,SAAS,wBAAwB,OAAqC;CACpE,MAAM,WAAW,MAAM,OAAO;CAC9B,MAAM,SAAS,MAAM;CACrB,IAAI,CAAC,YAAY,CAAC,QAAQ;EACxB,IAAI,YAAY,QACd,MAAM,IAAI,MAAM,wDAAwD;EAC1E;CACF;CACA,IACEA,2BAAyB,OAAO,SAAS,MAAMA,2BAAyB,SAAS,SAAS,KAC1FA,2BAAyB,OAAO,QAAQ,MAAMA,2BAAyB,SAAS,QAAQ,KACxF,MAAM,cAAc,MAAM,SAAS,4BAA4B,SAAS,SAAS,QAEjF,MAAM,IAAI,MAAM,iEAAiE;CAEnF,6BAA6B,OAAO,OAAO,SAAS,SAAS,QAAQ;CACrE,IAAI,CAAC,SAAS,mBAAmB,CAAC,OAAO,iBAAiB;EACxD,IAAI,SAAS,mBAAmB,OAAO,iBACrC,MAAM,IAAI,MAAM,yEAAyE;EAE3F;CACF;CACA,IACE,OAAO,gBAAgB,eAAe,SAAS,gBAAgB,cAC/D,YAAY,OAAO,eAAe,MAAM,SAAS,gBAAgB,QAEjE,MAAM,IAAI,MAAM,yEAAyE;AAE7F;AAEA,SAAS,6BACP,aACA,UACM;CACN,IAAI,YAAY,WAAW,SAAS,MAAM,QACxC,MAAM,IAAI,MAAM,oEAAoE;CAEtF,KAAK,IAAI,QAAQ,GAAG,QAAQ,SAAS,MAAM,QAAQ,SAAS;EAC1D,MAAM,SAAS,YAAY;EAC3B,MAAM,UAAU,SAAS,MAAM;EAC/B,IACE,CAAC,UACD,CAAC,WACD,OAAO,SAAS,QAAQ,QACxB,OAAO,SAAS,QAAQ,QACxB,OAAO,MAAM,eAAe,QAAQ,cACpC,YAAY,OAAO,KAAK,MAAM,QAAQ,QAEtC,MAAM,IAAI,MAAM,oEAAoE;CAExF;AACF;AAEA,SAAS,2BAA2B,OAAqC;CAEvE,MAAM,OADO,MAAM,cAAc,MAAM,SACrB;CAClB,MAAM,QAAQ,MAAM;CACpB,MAAM,OAAO,MAAM;CACnB,MAAM,UAAU,MAAM,uBAAuB;CAC7C,MAAM,YAAY,KAAK,YAAY,MAAM,OAAO,KAAK;CACrD,IACEA,2BAAyB,mBAAmB,KAAK,CAAC,MAAM,MAAM,UAC9DA,2BAAyB,mBAAmB,IAAI,CAAC,MAAM,KAAK,UAC5DA,2BAAyB,mBAAmB,IAAI,CAAC,MAAM,KAAK,UAC5D,KAAK,iBAAiB,MAAM,OAAO,UACnC,KAAK,gBAAgB,MAAM,UAC3B,KAAK,eAAe,KAAK,UACzB,MAAM,YAAY,KAAK,eAAe,KAAK,UAC3C,MAAM,MAAM,eAAe,KAAK,QAChC,KAAK,cAAc,MAAM,QACzB,KAAK,UAAU,KACf,KAAK,UAAU,KAAK,QAAQ,aAE5B,MAAM,IAAI,MAAM,iEAAiE;CAEnF,MAAM,aAAa,wBAAwB,mBAAmB,KAAK,CAAC;CACpE,MAAM,YAAY,wBAAwB,mBAAmB,IAAI,CAAC;CAClE,IACE,QAAQ,UAAU,MAAM,WAAW,MAAM,UACzC,QAAQ,UAAU,MAAM,SAAS,WAAW,YAAY,UAAU,KAClE,QAAQ,UAAU,MAAM,SAAS,eAAe,WAAW,cAC3D,QAAQ,UAAU,KAAK,WAAW,KAAK,UACvC,QAAQ,UAAU,KAAK,SAAS,WAAW,YAAY,SAAS,KAChE,QAAQ,UAAU,KAAK,SAAS,eAAe,UAAU,YAEzD,MAAM,IAAI,MAAM,sEAAsE;AAE1F;AAEA,SAAS,uBACP,OACkE;CAClE,OAAO,OAAO,OACZ,MAAM,KAAK,SAAS,OAAO,OAAO;EAAE,GAAG;EAAM,OAAO,WAAW,KAAK,KAAK,KAAK;CAAE,CAAC,CAAC,CACpF;AACF;AAEA,SAASC,cACP,QAC2D;CAC3D,OAAO;EACL,eAAe,OAAO;EACtB,gBAAgB,OAAO;EACvB,iBAAiB,OAAO;EACxB,YAAY,OAAO;CACrB;AACF;AAEA,SAAS,oBACP,UACA,UAaA,MAWM;CACN,MAAM,YAAY,qBAAqB,IAAI,QAAQ;CACnD,IAAI,CAAC,aAAa,CAAC,SAAS,SAAS,UAAU,MAAM,GACnD,MAAM,IAAI,MAAM,2CAA2C,WAAW,UAAU,WAAW;CAE7F,UAAU,SAAS;AACrB;AAEA,SAAS,2BACP,OACA,kBACA,mBACM;CACN,MAAM,uBAAO,IAAI,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,OAAO,GAAG,GAAG,GAAG,OAAO,KAAK,MAAM,MAAM,GAAG,CAAC,CAAC;CACxF,KAAK,MAAM,CAAC,MAAM,UAAU,CAC1B,GAAG,OAAO,QAAQ,gBAAgB,GAClC,GAAG,OAAO,QAAQ,qBAAqB,CAAC,CAAC,CAC3C,GAAG;EACD,IAAI,CAAC,2BAA2B,KAAK,IAAI,KAAK,OAAO,UAAU,YAAY,MAAM,SAAS,GACxF,MAAM,IAAI,MAAM,oEAAoE;EAEtF,IAAI,KAAK,IAAI,IAAI,GACf,MAAM,IAAI,MAAM,gEAAgE,MAAM;EAExF,KAAK,IAAI,IAAI;CACf;AACF;;;;ACvtBA,SAAgB,wBACd,UACA,qBAI8B;CAC9B,MAAM,QAAQ,iCAAiC,QAAQ;CACvD,MAAM,WAAW,SAAS,cAAc,MAAM;CAC9C,MAAM,UAAU;EACd,QAAQ,SAAS,QAAQ;EACzB,aAAa,MAAM,cAAc,QAAQ;EACzC,aAAa,MAAM,cAAc,QAAQ;CAC3C;CACA,MAAM,QAAQ,KAAK,IAAI;CACvB,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAC1C,MAAM,IAAI,MAAM,qEAAqE;CAEvF,MAAM,mBACJ,QACA,gCACE,SAAS,OAAO,WAChB,MAAM,kBACN,MAAM,eACR;CACF,IAAI,CAAC,OAAO,cAAc,gBAAgB,KAAK,oBAAoB,GACjE,MAAM,IAAI,MAAM,wEAAwE;CAE1F,IAAI,mBAAmB,MAAM,wBAC3B,MAAM,IAAI,MACR,kFACF;CAEF,IACE,oBAAoB,cAAc,WAAW,SAAS,cAAc,MAAM,UAC1E,oBAAoB,cAAc,eAAe,MAAM,cAAc,MAAM,YAE3E,MAAM,IAAI,MAAM,yEAAyE;CAE3F,IACE,oBAAoB,uBAAuB,WAAW,MAAM,uBAAuB,UACnF,oBAAoB,uBAAuB,eACzC,MAAM,uBAAuB,MAAM,YAErC,MAAM,IAAI,MACR,kFACF;CAEF,OAAO,4BAA4B,UAAU;EAC3C,aAAa,SAAS;EACtB,SAAS,QAAQ;EACjB,aAAa,QAAQ;EACrB,aAAa,QAAQ;EACrB,cAAc,SAAS,OAAO;EAC9B,qBAAqB,SAAS,cAAc,MAAM;EAClD;EACA,oBAAoB,mBAAmB,UAAU,MAAM,eAAe;EACtE;EACA,iBAAiB,MAAM;EACvB,SAAS;GACP,eAAe,MAAM;GACrB,kBAAkB,MAAM,iBAAiB;GACzC,eAAe,MAAM;GACrB,YAAY,MAAM,MAAM;GACxB,kBAAkB,MAAM;GACxB,GAAI,MAAM,oBACN,EACE,QAAQ;IACN,cAAc,MAAM,kBAAkB;IACtC,oBAAoB,MAAM,kBAAkB;GAC9C,EACF,IACA,CAAC;EACP;CACF,CAAC;AACH;AAEA,SAAS,mBACP,UACA,iBACc;CACd,MAAM,WAAW,SAAS,cAAc,MAAM;CAC9C,OAAOC,2BAAyB;EAC9B;EACA,eAAe;GACb,GAAG;GACH,SAAS;IACP,GAAG,SAAS;IACZ,SAAS;IACT,QAAQ,UAAU,IAAI,OAAO,EAAE;GACjC;GACA,OAAO;IACL,GAAG,SAAS;IACZ,QAAQ;KACN,GAAG,SAAS,MAAM;KAClB,aAAa,UAAU,IAAI,OAAO,EAAE;IACtC;GACF;GACA,QACE,SAAS,OAAO,SAAS,aACrB,SAAS,SACT;IACE,MAAM;IACN,OAAO;IACP,oBAAoB;IACpB,OAAO;KACL,MAAM;KACN,kBAAkB,SAAS,OAAO,MAAM;IAC1C;IACA,aAAa;KACX,QAAQ,SAAS,OAAO,YAAY;KACpC,UAAU,SAAS,OAAO,YAAY;KACtC,UAAU;MACR,QAAQ,SAAS,OAAO,YAAY,SAAS;MAC7C,YAAY,SAAS,OAAO,YAAY,SAAS;KACnD;KACA,SAAS;MACP,QAAQ,SAAS,OAAO,YAAY,QAAQ;MAC5C,YAAY,SAAS,OAAO,YAAY,QAAQ;KAClD;IACF;IACA,GAAI,SAAS,OAAO,aAAa,EAAE,YAAY,SAAS,OAAO,WAAW,IAAI,CAAC;GACjF;EACR;CACF,CAAC;AACH;;;;AC6HA,SAAS,cACP,OACA,OACA,QACA,UACsC;CACtC,OAAO,OAAO,OAAO;EACnB;EACA;EACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CACjC,CAAC;AACH;;AAQA,IAAa,4CAAb,MAEA;CACE,yBAA0B,IAAI,IAAyB;CACvD;CAEA,YAAY,UAA4D,CAAC,GAAG;EAC1E,KAAK,MAAM,QAAQ,OAAO,KAAK;CACjC;CAEA,MAAM,SACJ,WAC6C;EAC7C,MAAM,QAAQ,UAAU,SAAS;EACjC,MAAM,OAAO,UAAU,KAAK;EAC5B,MAAM,WAAW,KAAK,OAAO,IAAI,IAAI;EACrC,IAAI,UAAU,OAAO,sBAAsB,SAAS,OAAO,KAAK;EAChE,qBAAqB,MAAM,kBAAkB,KAAK,IAAI,CAAC;EAEvD,MAAM,iBAAiB,yBAAyB,KAAK,QAAQ,KAAK;EAClE,IAAI,gBAAgB,OAAO,cAAc,OAAO,cAAc;EAE9D,MAAM,QAAQ,SAAS,KAAK;EAG5B,KAAK,OAAO,IAAI,MAAM;GACpB;GACA,aAAa,YAAY,KAAK;GAC9B,OAAO;EACT,CAAC;EACD,OAAO,OAAO,OAAO;GAAE,UAAU;GAAM;GAAO;EAAM,CAAC;CACvD;CAEA,MAAM,WACJ,kBAC2D;EAC3D,MAAM,UAAU,eAAe,gBAAgB;EAC/C,MAAM,SAAS,KAAK,OAAO,IAAI,UAAU,OAAO,CAAC;EACjD,OAAO,SACH,cAAc,OAAO,OAAO,OAAO,OAAO,OAAO,QAAQ,OAAO,QAAQ,IACxE,KAAA;CACN;CAEA,MAAM,oBACJ,gBAC6C;EAC7C,MAAM,QAAQ,UAAU,cAAc;EACtC,MAAM,SAAS,KAAK,aAAa,KAAK;EACtC,YAAY,OAAO,aAAa,OAAO,MAAM,kBAAkB,KAAK;EACpE,IAAI,OAAO,UAAU,qBACnB,OAAO,OAAO,OAAO;GAAE,QAAQ;GAAO,OAAO;EAAoB,CAAC;EAEpE,IAAI,OAAO,UAAU,OAAO,UAC1B,MAAM,IAAI,MAAM,wEAAwE;EAE1F,qBAAqB,OAAO,MAAM,kBAAkB,KAAK,IAAI,CAAC;EAC9D,OAAO,QAAQ;EACf,OAAO,OAAO,OAAO;GAAE,QAAQ;GAAM,OAAO;EAAoB,CAAC;CACnE;CAEA,MAAM,cACJ,gBACA,QAC6C;EAC7C,MAAM,QAAQ,UAAU,cAAc;EACtC,MAAM,SAAS,KAAK,aAAa,KAAK;EACtC,YAAY,OAAO,aAAa,OAAO,MAAM,kBAAkB,KAAK;EACpE,MAAM,WAAW,eAAe,OAAO,OAAO,MAAM;EACpD,IAAI,OAAO,QAAQ,OAAO,cAAc,OAAO,QAAQ,QAAQ;EAC/D,6BAA6B,OAAO,OAAO,QAAQ;EACnD,qBAAqB,OAAO,MAAM,kBAAkB,KAAK,IAAI,CAAC;EAC9D,OAAO,SAAS;EAChB,OAAO,OAAO,OAAO;GAAE,QAAQ;GAAM;EAAS,CAAC;CACjD;CAEA,MAAM,OACJ,gBACA,yBAC8C;EAC9C,MAAM,QAAQ,UAAU,cAAc;EACtC,MAAM,iBAAiB,mBAAmB,uBAAuB;EACjE,MAAM,SAAS,KAAK,aAAa,KAAK;EACtC,YAAY,OAAO,aAAa,OAAO,MAAM,kBAAkB,KAAK;EACpE,MAAM,SAAS,sBAAsB,OAAO,QAAQ,cAAc;EAClE,IAAI,OAAO,UAAU,OAAO,eAAe,OAAO,UAAU,cAAc;EAC1E,qBAAqB,OAAO,MAAM,kBAAkB,KAAK,IAAI,CAAC;EAI9D,OAAO,WAAW;EAClB,OAAO,OAAO,OAAO;GAAE,UAAU;GAAM,UAAU;EAAO,CAAC;CAC3D;CAEA,MAAM,eACJ,kBACA,UAC8C;EAC9C,MAAM,UAAU,eAAe,gBAAgB;EAC/C,MAAM,SAAS,KAAK,aAAa,SAAS,8BAA8B;EACxE,MAAM,YAAY,wBAAwB,OAAO,OAAO,OAAO,OAAO,QAAQ;EAC9E,IAAI,OAAO,QAAQ,4BAA4B,OAAO,QAAQ,SAAS;EACvE,MAAM,kBAAkB,OAAO,QAAQ,kBAAkB,UAAU;EACnE,IAAI,OAAO,UAAU,OAAO,eAAe,OAAO,UAAU,eAAe;EAC3E,mBAAmB,OAAO,MAAM,kBAAkB,KAAK,IAAI,CAAC;EAC5D,MAAM,WAAW,OAAO,UAAU;EAClC,4BAA4B,UAAU,SAAS;EAC/C,OAAO,WAAW;EAClB,OAAO,WAAW;EAClB,OAAO,OAAO,OAAO;GAAE,UAAU;GAAM;EAAS,CAAC;CACnD;CAEA,aACE,SACA,YAAY,6BACC;EACb,MAAM,SAAS,KAAK,OAAO,IAAI,UAAU,OAAO,CAAC;EACjD,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,GAAG,UAAU,mCAAmC;EAC7E,OAAO;CACT;AACF;AAEA,MAAM,iBAAiB;AACvB,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,SAAS,UAAU,OAAmE;CACpF,sBACE,OACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,GACA,2BACF;CACA,kBAAkB,MAAM,WAAW;CACnC,IAAI,CAAC,OAAO,cAAc,MAAM,OAAO,KAAK,MAAM,UAAU,GAC1D,MAAM,IAAI,MAAM,mEAAmE;CAErF,IAAI,CAAC,OAAO,cAAc,MAAM,WAAW,KAAK,MAAM,cAAc,GAClE,MAAM,IAAI,MAAM,uEAAuE;CAEzF,IAAI,MAAM,UAAU,MAAM,aACxB,MAAM,IAAI,MAAM,uDAAuD;CAEzE,IAAI,CAAC,CAAC,QAAQ,+BAA+B,CAAC,CAAC,SAAS,MAAM,WAAW,GACvE,MAAM,IAAI,MAAM,kDAAkD;CAEpE,IAAI,MAAM,gBAAgB,UAAU,MAAM,gBAAgB,GACxD,MAAM,IAAI,MAAM,mEAAmE;CAErF,mBAAmB,MAAM,cAAc,cAAc;CACrD,mBAAmB,MAAM,qBAAqB,qBAAqB;CACnE,MAAM,sBAAsB,iCAC1B,MAAM,qBACN,MAAM,mBACR;CACA,mBAAmB,MAAM,oBAAoB,oBAAoB;CACjE,wBAAwB,MAAM,kBAAkB,kBAAkB;CAClE,uBAAuB,MAAM,iBAAiB,MAAM,eAAe;CACnE,MAAM,UAAU,mBAAmB,MAAM,OAAO;CAChD,OAAO,OAAO,OAAO;EACnB,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,aAAa,MAAM;EACnB,aAAa,MAAM;EACnB,cAAc,MAAM;EACpB,qBAAqB,MAAM;EAC3B;EACA,oBAAoB,MAAM;EAC1B,kBAAkB,MAAM;EACxB,iBAAiB,MAAM;EACvB;CACF,CAAC;AACH;AAEA,SAAS,mBACP,SACuC;CACvC,sBACE,SACA,QAAQ,SACJ;EACE;EACA;EACA;EACA;EACA;EACA;CACF,IACA;EAAC;EAAiB;EAAoB;EAAiB;EAAc;CAAkB,GAC3F,qCACF;CACA,IAAI,CAAC,uBAAuB,KAAK,QAAQ,aAAa,GACpD,MAAM,IAAI,MAAM,sDAAsD;CAExE,mBAAmB,QAAQ,kBAAkB,0BAA0B;CACvE,MAAM,gBAAgB,wBACpB,kCAAkC,MAAM,QAAQ,aAAa,CAC/D;CACA,wBAAwB,QAAQ,YAAY,sBAAsB,GAAG;CACrE,MAAM,mBAAmB,wBAAwB,QAAQ,gBAAgB;CACzE,MAAM,SAAS,QAAQ,SAAS,wBAAwB,QAAQ,MAAM,IAAI,KAAA;CAC1E,OAAO,OAAO,OAAO;EACnB,eAAe,QAAQ;EACvB,kBAAkB,QAAQ;EAC1B;EACA,YAAY,QAAQ;EACpB;EACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;CAC7B,CAAC;AACH;AAEA,SAAS,wBACP,QAC8D;CAC9D,sBACE,QACA,CAAC,gBAAgB,oBAAoB,GACrC,2CACF;CACA,mBAAmB,OAAO,cAAc,qBAAqB;CAC7D,wBAAwB,OAAO,oBAAoB,6BAA6B,IAAK;CACrF,OAAO,OAAO,OAAO;EACnB,cAAc,OAAO;EACrB,oBAAoB,OAAO;CAC7B,CAAC;AACH;AAEA,SAAS,eACP,SACmC;CACnC,sBAAgB,SAAS,CAAC,eAAe,SAAS,GAAG,uCAAuC;CAC5F,kBAAkB,QAAQ,WAAW;CACrC,IAAI,CAAC,OAAO,cAAc,QAAQ,OAAO,KAAK,QAAQ,UAAU,GAC9D,MAAM,IAAI,MAAM,yEAAyE;CAE3F,OAAO,OAAO,OAAO;EAAE,aAAa,QAAQ;EAAa,SAAS,QAAQ;CAAQ,CAAC;AACrF;AAEA,SAAS,UAAU,OAAmE;CACpF,sBACE,OACA;EAAC;EAAe;EAAW;EAAS;CAAa,GACjD,2BACF;CACA,IAAI,MAAM,YAAY,WAAW,KAAK,CAAC,OAAO,cAAc,MAAM,OAAO,KAAK,MAAM,UAAU,GAC5F,MAAM,IAAI,MAAM,+CAA+C;CAEjE,IAAI,CAAC,oBAAoB,KAAK,MAAM,KAAK,GACvC,MAAM,IAAI,MAAM,4CAA4C;CAE9D,wBAAwB,MAAM,aAAa,mBAAmB;CAC9D,OAAO,OAAO,OAAO;EACnB,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,OAAO,MAAM;EACb,aAAa,MAAM;CACrB,CAAC;AACH;AAEA,SAAS,SAAS,OAAmE;CACnF,OAAO,OAAO,OAAO;EACnB,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,OAAO,6BAA6B,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;EACxE,aAAa,MAAM;CACrB,CAAC;AACH;AAEA,SAAS,YAAY,OAAmD;CACtE,OAAO,OAAO,MAAM,KAAK;AAC3B;AAEA,SAAS,YACP,gBACA,qBACA,OACM;CACN,MAAM,WAAW,OAAO,KAAK,cAAc;CAC3C,MAAM,SAAS,OAAO,KAAK,YAAY,KAAK,CAAC;CAC7C,IACE,SAAS,WAAW,OAAO,UAC3B,CAAC,gBAAgB,UAAU,MAAM,KACjC,MAAM,gBAAgB,qBAEtB,MAAM,IAAI,MAAM,sCAAsC;AAE1D;AAEA,SAAS,UAAU,OAA8E;CAC/F,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,KAAK,UAAU,CAAC,MAAM,aAAa,MAAM,OAAO,CAAC,GAAG,MAAM,CAAC,CAClE,OAAO,KAAK;AACjB;AAEA,SAAS,yBACP,QACA,OAC0C;CAC1C,IAAI,MAAM,YAAY,GAAG,OAAO,KAAA;CAIhC,OAAO,eAAe,OAHR,OAAO,IACnB,UAAU;EAAE,aAAa,MAAM;EAAa,SAAS,MAAM,UAAU;CAAE,CAAC,CAEzC,CAAC;AACpC;AAEA,SAAS,eACP,OACA,OAM0C;CAC1C,IAAI,CAAC,OAAO,OAAO;CACnB,IACE,MAAM,gBAAgB,mCACtB,MAAM,MAAM,gBAAgB,MAAM,eAClC,MAAM,MAAM,gBAAgB,MAAM,eAClC,MAAM,MAAM,iBAAiB,MAAM,gBACnC,MAAM,MAAM,uBAAuB,MAAM,oBAEzC,OAAO;CAET,IAAI,CAAC,MAAM,UAAU,OAAO;CAC5B,IAAI,MAAM,SAAS,WAAW,aAAa,OAAO;CAClD,IAAI,MAAM,SAAS,MAAM,eAAe,GAAG,OAAO;CAClD,IAAI,MAAM,SAAS,iBAAiB,4BAClC,OAAO;AAGX;AAEA,SAAS,sBACP,UACA,WACoC;CACpC,OAAO,OAAO,OAAO;EACnB,UAAU;EACV,QAAQ;EACR,OAAO;EACP,aAAaC,2BAAyB,QAAQ,MAAMA,2BAAyB,SAAS;CACxF,CAAC;AACH;AAEA,SAAS,cACP,OACA,QACoC;CACpC,OAAO,OAAO,OAAO;EAAE,UAAU;EAAO,QAAQ;EAAsB;EAAO;CAAO,CAAC;AACvF;AAEA,eAAe,UAAU,MAAoC;CAC3D,MAAM,SAAS,MAAM,eAAe,MAAM,OAAO;CACjD,MAAM,SAAS;CACf,sBACE,QACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,GACA,gCAAgC,MAClC;CACA,MAAM,QAAQ,UAAU;EACtB,aAAa,cAAc,OAAO,aAAa,MAAM,aAAa;EAClE,SAAS,cAAc,OAAO,SAAS,MAAM,SAAS;EACtD,aAAa,cAAc,OAAO,aAAa,MAAM,aAAa;EAClE,aAAa,mBAAmB,OAAO,aAAa,IAAI;EACxD,cAAc,cAAc,OAAO,cAAc,MAAM,cAAc;EACrE,qBAAqB,cACnB,OAAO,qBACP,MACA,qBACF;EACA,qBAAqB,cACnB,OAAO,qBACP,MACA,qBACF;EACA,oBAAoB,cAClB,OAAO,oBACP,MACA,oBACF;EACA,kBAAkB,cAAc,OAAO,kBAAkB,MAAM,kBAAkB;EACjF,iBAAiB,cAAc,OAAO,iBAAiB,MAAM,iBAAiB;EAC9E,SAAS,cACP,OAAO,SACP,MACA,SACF;CACF,CAAC;CACD,MAAM,uBAAuB,cAC3B,OAAO,aACP,MACA,aACF;CACA,mBAAmB,sBAAsB,aAAa;CACtD,IAAI,OAAO,UAAU,WACnB,MAAM,IAAI,MAAM,gCAAgC,KAAK,2BAA2B;CAElF,OAAO;EAAE;EAAO,aAAa;EAAsB,OAAO;CAAU;AACtE;AAEA,eAAe,mBAAmB,MAAgD;CAChF,IAAI;EACF,OAAO,MAAM,UAAU,IAAI;CAC7B,SAAS,OAAO;EACd,IAAI,eAAe,KAAK,GAAG,OAAO,KAAA;EAClC,MAAM;CACR;AACF;AAEA,eAAe,aAAa,MAA8D;CACxF,MAAM,SAAS,MAAM,eAAe,MAAM,iBAAiB;CAC3D,MAAM,SAAS;CACf,sBAAgB,QAAQ,CAAC,UAAU,GAAG,0CAA0C,MAAM;CACtF,OAAO,wBACL,cAAc,OAAO,UAAU,MAAM,UAAU,GAC/C,0CAA0C,MAC5C;AACF;AAEA,eAAe,sBACb,MAC4D;CAC5D,IAAI;EACF,OAAO,MAAM,aAAa,IAAI;CAChC,SAAS,OAAO;EACd,IAAI,eAAe,KAAK,GAAG,OAAO,KAAA;EAClC,MAAM;CACR;AACF;AAMA,eAAe,wBACb,MACA,OACuD;CACvD,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,eAAe,MAAM,mBAAmB;CACzD,SAAS,OAAO;EACd,IAAI,eAAe,KAAK,GAAG,OAAO,KAAA;EAClC,MAAM;CACR;CACA,IAAI,OAAO,SAAS,6BAA6B;EAC/C,MAAM,SAAS;EACf,sBACE,QACA;GAAC;GAAQ;GAAe;GAAW;GAAuB;EAAO,GACjE,uCAAuC,MACzC;EACA,IACE,OAAO,gBAAgB,MAAM,eAC7B,OAAO,YAAY,MAAM,WACzB,OAAO,wBAAwB,MAAM,uBACrC,OAAO,UAAU,qBAEjB,MAAM,IAAI,MAAM,uCAAuC,KAAK,0BAA0B;EAExF,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,IAAI,OAAO,SAAS,wCAAwC;EAC1D,MAAM,SAAS;EACf,sBAAgB,QAAQ,CAAC,QAAQ,UAAU,GAAG,yCAAyC,MAAM;EAC7F,MAAM,WAAW,wBACf,cAAc,OAAO,UAAU,MAAM,UAAU,GAC/C,yCAAyC,MAC3C;EACA,2BAA2B,UAAU,OAAO,IAAI;EAChD,OAAO;GAAE,MAAM;GAAW;EAAS;CACrC;CACA,MAAM,IAAI,MAAM,4CAA4C,KAAK,kBAAkB;AACrF;AAEA,eAAe,eAAe,MAAc,MAAgD;CAC1F,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;CAClD,SAAS,OAAO;EACd,IAAI,eAAe,KAAK,GAAG,MAAM;EACjC,MAAM,IAAI,MAAM,uBAAuB,KAAK,MAAM,KAAK,iBAAiB,EAAE,OAAO,MAAM,CAAC;CAC1F;CACA,IAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GACvE,MAAM,IAAI,MAAM,uBAAuB,KAAK,MAAM,KAAK,kBAAkB;CAE3E,OAAO;AACT;AAEA,SAAS,eACP,UACA,WACA,MACM;CACN,IAAI,SAAS,gBAAgB,UAAU,eAAe,SAAS,YAAY,UAAU,SACnF,MAAM,IAAI,MAAM,iCAAiC,KAAK,+BAA+B;AAEzF;AAEA,SAAS,mBAAmB,OAAe,OAAqB;CAC9D,IAAI,CAAC,eAAe,KAAK,KAAK,GAC5B,MAAM,IAAI,MAAM,6BAA6B,MAAM,mCAAmC;AAE1F;AAEA,SAAS,cAAc,OAAgB,MAAc,OAAuB;CAC1E,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,iCAAiC,KAAK,eAAe,OAAO;CAE9E,OAAO;AACT;AAEA,SAAS,cAAc,OAAgB,MAAc,OAAuB;CAC1E,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,iCAAiC,KAAK,eAAe,OAAO;CAE9E,OAAO;AACT;AAEA,SAAS,cAAc,OAAgB,MAAc,OAAwC;CAC3F,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,iCAAiC,KAAK,eAAe,OAAO;CAE9E,OAAO;AACT;AAEA,SAAS,mBACP,OACA,MAC4C;CAC5C,IAAI,UAAU,UAAU,UAAU,iCAChC,MAAM,IAAI,MAAM,iCAAiC,KAAK,yBAAyB;CAEjF,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAyC;CAClE,IAAI,OAAO,UAAU,YAAY,CAAC,2BAA2B,KAAK,KAAK,GACrE,MAAM,IAAI,MAAM,kDAAkD;AAEtE;AAEA,SAAS,wBACP,OACA,OACA,WACyB;CACzB,IACE,OAAO,UAAU,YACjB,MAAM,WAAW,KACjB,MAAM,SAAS,aACf,oBAAoB,KAAK,GAEzB,MAAM,IAAI,MAAM,uBAAuB,MAAM,YAAY;AAE7D;AAEA,SAAS,oBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,OAAO,MAAQ,SAAS,KAAM,OAAO;CAC3C;CACA,OAAO;AACT;AAEA,SAAS,wBAAwB,OAAgB,OAAwC;CACvF,IAAI,CAAC,OAAO,cAAc,KAAK,KAAM,SAAoB,GACvD,MAAM,IAAI,MAAM,uBAAuB,MAAM,mCAAmC;AAEpF;AAEA,SAAS,YAAY,OAAqB;CACxC,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAC1C,MAAM,IAAI,MAAM,qEAAqE;AAEzF;AAEA,SAAS,qBAAqB,aAAqB,OAAqB;CACtE,YAAY,KAAK;CACjB,IAAI,SAAS,aAAa,MAAM,IAAI,MAAM,uCAAuC;AACnF;AAEA,SAAS,mBAAmB,aAAqB,OAAqB;CACpE,YAAY,KAAK;CACjB,IAAI,QAAQ,aAAa,MAAM,IAAI,MAAM,2CAA2C;AACtF;AAEA,SAAS,OAAO,OAA6B;CAC3C,OAAO,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,MAAM,CAAC,CAAC,OAAO,KAAK;AAC1E;AAEA,SAAS,eAAe,OAAyB;CAC/C,OAAO,YAAY,OAAO,QAAQ;AACpC;AAEA,SAAS,YAAY,OAAgB,MAAuB;CAC1D,OACE,UAAU,QACV,OAAO,UAAU,YACjB,UAAU,SACT,MAA6B,SAAS;AAE3C;AAEA,MAAa,8BAA8B,OAAO,OAAO;CACvD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;ACx5BD,MAAM,YAAY;;AASlB,SAAgB,kCACd,YACA,UACqC;CACrC,sBACE,YACA;EAAC;EAAiB;EAAe;EAAU;EAAqB;CAAO,GACvE,kBACF;CACA,IAAI,WAAW,WAAW,MAAM,MAAM,IAAI,MAAM,qCAAqC;CACrF,IAAI,WAAW,sBAAsB,MACnC,MAAM,IAAI,MAAM,gEAAgE;CAElF,IAAI,WAAW,gBAAgB,SAAS,aACtC,MAAM,IAAI,MAAM,wEAAwE;CAE1F,IAAI,WAAW,kBAAkB,SAAS,eACxC,MAAM,IAAI,MAAM,uEAAuE;CAEzF,IAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,GACjC,MAAM,IAAI,MAAM,mDAAmD;CAGrE,MAAM,0BAAU,IAAI,IAAY;CAChC,MAAM,0BAAU,IAAI,IAAY;CAChC,IAAI,uBAAuB;CAC3B,IAAI,eAAe;CACnB,IAAI,oBAAoB;CACxB,IAAI,kBAAkB;CACtB,IAAI,eAAe;CACnB,IAAI,iBAA6D;CACjE,MAAM,QAAQ,WAAW,MAAM,KAAK,QAAQ,UAAU;EACpD,sBACE,QACA;GACE;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF,GACA,yBAAyB,OAC3B;EACA,iBAAiB,OAAO,QAAQ,yBAAyB,MAAM,QAAQ;EACvE,iBAAiB,OAAO,cAAc,yBAAyB,MAAM,cAAc;EACnF,iBAAiB,OAAO,aAAa,yBAAyB,MAAM,aAAa;EACjF,IAAI,OAAO,gBAAgB,OAAO,cAChC,MAAM,IAAI,MAAM,yBAAyB,MAAM,4CAA4C;EAE7F,IAAI,OAAO,WAAW,eAAe,OAAO,WAAW,UACrD,MAAM,IAAI,MAAM,yBAAyB,MAAM,uBAAuB;EAExE,IAAI,QAAQ,IAAI,OAAO,MAAM,GAC3B,MAAM,IAAI,MAAM,mDAAmD;EACrE,IAAI,QAAQ,IAAI,OAAO,WAAW,GAChC,MAAM,IAAI,MAAM,yDAAyD;EAE3E,QAAQ,IAAI,OAAO,MAAM;EACzB,QAAQ,IAAI,OAAO,WAAW;EAC9B,IAAI,OAAO,UAAU,SAAS,OAC5B,MAAM,IAAI,MAAM,mCAAmC,MAAM,yBAAyB;EAEpF,gBAAgB,OAAO,aAAa,yBAAyB,MAAM,aAAa;EAChF,gBAAgB,OAAO,WAAW,yBAAyB,MAAM,WAAW;EAC5E,IAAI,OAAO,YAAY,OAAO,aAC5B,MAAM,IAAI,MAAM,yBAAyB,MAAM,yBAAyB;EAE1E,YAAY,OAAO,aAAa,yBAAyB,MAAM,aAAa;EAC5E,YAAY,OAAO,sBAAsB,yBAAyB,MAAM,sBAAsB;EAC9F,IAAI,OAAO,uBAAuB,OAAO,aACvC,MAAM,IAAI,MACR,yBAAyB,MAAM,sDACjC;EAEF,YAAY,OAAO,cAAc,yBAAyB,MAAM,cAAc;EAC9E,YAAY,OAAO,mBAAmB,yBAAyB,MAAM,mBAAmB;EACxF,oBAAoB,QAClB,mBACA,OAAO,mBACP,0BACF;EACA,YAAY,OAAO,iBAAiB,yBAAyB,MAAM,iBAAiB;EACpF,kBAAkB,QAAQ,iBAAiB,OAAO,iBAAiB,uBAAuB;EAC1F,YAAY,OAAO,cAAc,yBAAyB,MAAM,cAAc;EAC9E,IAAI,OAAO,mBAAmB,cAAc,OAAO,mBAAmB,aACpE,MAAM,IAAI,MAAM,yBAAyB,MAAM,gCAAgC;EAEjF,IAAI,OAAO,mBAAmB,aAAa,iBAAiB;EAC5D,uBAAuB,QACrB,sBACA,OAAO,sBACP,6BACF;EACA,eAAe,QAAQ,cAAc,OAAO,cAAc,oBAAoB;EAC9E,eAAe,QAAQ,cAAc,OAAO,cAAc,YAAY;EACtE,OAAO,OAAO,OAAO,EAAE,GAAG,OAAO,CAAC;CACpC,CAAC;CAED,MAAM,QAAQ,OAAO,OAAO;EAC1B;EACA,aAAa;EACb;EACA;EACA;EACA,YAAY,MAAM;EAClB;CACF,CAAC;CACD,OAAO,OAAO,OAAO;EACnB,OAAO,OAAO,OAAO;GACnB,eAAe,WAAW;GAC1B,aAAa,WAAW;GACxB,QAAQ;GACR,mBAAmB;GACnB,OAAO,OAAO,OAAO,KAAK;EAC5B,CAAC;EACD;CACF,CAAC;AACH;;;;;AAMA,eAAsB,wCACpB,YACA,OACA,YACe;CACf,MAAM,MAAM,MAAM,WAAW,OAAO,KAAK;CACzC,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,2DAA2D,OAAO;CAC5F,IAAI,IAAI,WAAW,aAAa,IAAI,YAAY,KAAA,GAC9C,MAAM,IAAI,MAAM,sEAAsE;CAExF,MAAM,WAAW,MAAM,WAAW,MAAM,EAAE,MAAM,CAAC;CACjD,IAAI,SAAS,KAAK,SAAS,GACzB,MAAM,IAAI,MACR,kFACF;CAEF,MAAM,cAAc,IAAI,IAAI,SAAS,KAAK,SAAS,KAAK,MAAM,CAAC;CAC/D,KAAK,MAAM,QAAQ,WAAW,MAAM,OAAO;EACzC,IAAI,YAAY,IAAI,KAAK,WAAW,GAClC,MAAM,IAAI,MACR,iEAAiE,KAAK,cACxE;EAEF,MAAM,WAAW,WAAW;GAC1B;GACA,QAAQ,KAAK;GACb,MAAM;GACN,MAAM;GACN,OAAO,KAAK;GACZ,UAAU,CAAC;GACX,WAAW,KAAK;GAChB,SAAS,KAAK;GACd,QAAQ,KAAK,WAAW,cAAc,OAAO;GAC7C,aAAa,KAAK;GAClB,cAAc,KAAK;GACnB,cAAc,KAAK;GACnB,iBAAiB,KAAK;GACtB,SAAS,KAAK,eAAe;GAC7B,YAAY;IACV,iCAAiC;IACjC,yBAAyB,KAAK;IAC9B,+BAA+B,KAAK;GACtC;EACF,CAAC;CACH;AACF;;AAGA,SAAgB,kCACd,OACA,YACM;CACN,IAAI,MAAM,WAAW,WAAW,MAAM,MAAM,QAC1C,MAAM,IAAI,MACR,+BAA+B,MAAM,OAAO,6BAA6B,WAAW,MAAM,MAAM,QAClG;CAEF,MAAM,OAAO,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC;CAC7D,IAAI,KAAK,SAAS,MAAM,QAAQ,MAAM,IAAI,MAAM,8CAA8C;CAC9F,KAAK,MAAM,QAAQ,WAAW,MAAM,OAAO;EACzC,MAAM,OAAO,KAAK,IAAI,KAAK,WAAW;EACtC,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,gDAAgD,KAAK,aAAa;EAEpF,gBAAgB,MAAM,IAAI;CAC5B;AACF;AAEA,SAAgB,WAAW,OAAe,OAAuB;CAC/D,IAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,qBAAqB;CACxF,MAAM,QAAQ,KAAK,MAAM,QAAQ,SAAS;CAC1C,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CACtF,OAAO;AACT;AAEA,SAAS,gBAAgB,MAAe,MAA+C;CACrF,IAAI,KAAK,UAAU,KAAK,OACtB,MAAM,IAAI,MAAM,wBAAwB,KAAK,OAAO,mCAAmC;CAEzF,IACE,KAAK,cAAc,KAAK,eACxB,KAAK,YAAY,KAAK,aACtB,KAAK,YAAY,KAAK,WAAW,cAAc,OAAO,UAEtD,MAAM,IAAI,MACR,wBAAwB,KAAK,OAAO,8CACtC;CAEF,IACE,KAAK,aAAa,qCAAqC,uBACvD,KAAK,aAAa,6BAA6B,KAAK,UACpD,KAAK,aAAa,mCAAmC,KAAK,cAE1D,MAAM,IAAI,MAAM,wBAAwB,KAAK,OAAO,oCAAoC;CAE1F,KAAK,MAAM,CAAC,MAAM,QAAQ,YAAY;EACpC;GAAC;GAAe,KAAK;GAAa,KAAK;EAAW;EAClD;GAAC;GAAgB,KAAK;GAAc,KAAK;EAAY;EACrD;GAAC;GAAqB,KAAK,gBAAgB;GAAG,KAAK;EAAiB;EACpE;GAAC;GAAmB,KAAK,mBAAmB;GAAG,KAAK;EAAe;CACrE,GACE,IAAI,WAAW,KAAA,KAAa,WAAW,SACrC,MAAM,IAAI,MACR,wBAAwB,KAAK,OAAO,GAAG,KAAK,GAAG,OAAO,+BAA+B,SACvF;CAGJ,IAAI,KAAK,YAAY,KAAA,GACnB,MAAM,IAAI,MAAM,wBAAwB,KAAK,OAAO,oBAAoB;CAE1E,MAAM,aAAa,WAAW,KAAK,SAAS,wBAAwB,KAAK,OAAO,SAAS;CACzF,IAAI,eAAe,KAAK,cACtB,MAAM,IAAI,MACR,wBAAwB,KAAK,OAAO,gBAAgB,WAAW,+BAA+B,KAAK,cACrG;AAEJ;AAEA,SAAS,iBAAiB,OAAgB,OAAwC;CAChF,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,KACpE,MAAM,IAAI,MAAM,GAAG,MAAM,oCAAoC;AAEjE;AAEA,SAAS,YAAY,OAAgB,OAAwC;CAC3E,IAAI,CAAC,OAAO,cAAc,KAAK,KAAM,QAAmB,GACtD,MAAM,IAAI,MAAM,GAAG,MAAM,oCAAoC;AAEjE;AAEA,SAAS,gBAAgB,OAAgB,OAAwC;CAC/E,IAAI,CAAC,OAAO,cAAc,KAAK,KAAM,SAAoB,GACvD,MAAM,IAAI,MAAM,GAAG,MAAM,iCAAiC;AAE9D;AAEA,SAAS,QAAQ,MAAc,OAAe,OAAuB;CACnE,MAAM,QAAQ,OAAO;CACrB,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CACvF,OAAO;AACT;;;AC/PA,MAAM,yCAAyB,IAAI,QAAwD;;AAG3F,MAAa,oCAAoC,OAAO,OAAO;CAC7D,UAAU,OAAO,OAAO,CAAC,aAAa,QAAQ,CAAU;CACxD,MAAM,OAAO,OAAO;EAAC;EAAY;EAAS;CAAW,CAAU;CAC/D,QAAQ,OAAO,OAAO,CAAC,YAAY,UAAU,CAAU;CACvD,WAAW;CACX,SAAS,OAAO,OAAO;EACrB,eAAe,OAAO,OAAO,CAAC,OAAO,CAAU;EAC/C,WAAW;EACX,OAAO;EACP,aAAa;EACb,OAAO;EACP,cAAc;CAChB,CAAC;AACH,CAAC;;AAGD,eAAsB,2BACpB,OACA,OACiC;CACjC,MAAM,SAAS,2BAA2B,MAAM,KAAK;CACrD,MAAM,gBAAgB,mBAAmB,MAAM;CAC/C,MAAM,eAAeC,2BAAyB,aAAa;CAC3D,IAAI,iBAAiB,OAAO,QAC1B,MAAM,IAAI,MAAM,2BAA2B,OAAO,OAAO,kBAAkB,cAAc;CAE3F,MAAM,iBAAiB,wBAAwB,aAAa;CAC5D,YAAY,gBAAgB,OAAO,QAAQ,eAAe,YAAY,kBAAkB;CACxF,uCAAuC,OAAO,OAAO;CAErD,MAAM,gCAAgB,IAAI,IAAwB;CAClD,MAAM,eAAe,OAAO,aAAkE;EAC5F,MAAM,MAAM,iBAAiB,QAAQ;EACrC,MAAM,WAAW,cAAc,IAAI,GAAG;EACtC,IAAI,UAAU,OAAO,WAAW,KAAK,QAAQ;EAC7C,MAAM,QAAQ,MAAM,qBAAqB,UAAU,MAAM,SAAS;EAClE,cAAc,IAAI,KAAK,WAAW,KAAK,KAAK,CAAC;EAC7C,OAAO;CACT;CAEA,IAAI;CACJ,IAAI,OAAO,KAAK,SAAS,aACvB,aAAa,MAAM,aAAa,OAAO,KAAK,MAAM,QAAQ;CAE5D,MAAM,mBAAmB,MAAM,oBAAoB,OAAO,MAAM,MAAM,cAAc,UAAU;CAE9F,MAAM,gCAAgB,IAAI,IAAwB;CAClD,KAAK,MAAM,YAAY,mBAAmB,MAAM,GAAG;EACjD,MAAM,QACJ,SAAS,SAAS,WACd,OAAO,KAAK,SAAS,SAAS,MAAM,IACpC,MAAM,4BAA4B,UAAU,MAAM,YAAY;EACpE,YACE,OACA,SAAS,QACT,SAAS,YACT,sBAAsB,SAAS,SAAS,SAAS,SAAS,WAAW,SAAS,OAAO,cACvF;EACA,cAAc,IAAI,YAAY,QAAQ,GAAG,WAAW,KAAK,KAAK,CAAC;EAC/D,cAAc,IAAI,SAAS,QAAQ,WAAW,KAAK,KAAK,CAAC;CAC3D;CAEA,IAAI,OAAO,UAAU,WAAW;EAC9B,MAAM,YAAY,MAAM,iCACtB,OAAO,UAAU,WACjB,MAAM,SACR;EACA,cAAc,IAAI,iBAAiB,OAAO,UAAU,UAAU,QAAQ,GAAG,UAAU,QAAQ;EAC3F,cAAc,IAAI,iBAAiB,OAAO,UAAU,UAAU,OAAO,GAAG,UAAU,OAAO;CAC3F;CACA,IAAI,OAAO,WAAW;EACpB,MAAM,YAAY,MAAM,iCACtB,OAAO,UAAU,UACjB,MAAM,SACR;EACA,cAAc,IAAI,iBAAiB,OAAO,UAAU,SAAS,QAAQ,GAAG,UAAU,QAAQ;EAC1F,cAAc,IAAI,iBAAiB,OAAO,UAAU,SAAS,OAAO,GAAG,UAAU,OAAO;EACxF,IAAI,OAAO,UAAU,iBAAiB,MAAM,aAAa,OAAO,UAAU,eAAe;EACzF,MAAM,aAAa,OAAO,UAAU,UAAU;CAChD;CACA,IAAI,OAAO,OAAO,SAAS,cAAc,OAAO,OAAO,MACrD,MAAM,aAAa,OAAO,OAAO,IAAI;CAEvC,oBAAoB,MAAM;CAC1B,MAAM,WAAW,OAAO,OAAO;EAC7B,QAAQ;EACR,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC5D,yBAAyB;CAC5B,CAAC;CACD,uBAAuB,IAAI,UAAU;EAAE;EAAO;EAAe;CAAc,CAAC;CAC5E,OAAO;AACT;AAEA,SAAgB,0BACd,WACwB;CACxB,MAAM,QAAQ,uBAAuB,IAAI,SAAS;CAClD,IAAI,CAAC,SAAS,UAAU,4BAA4B,MAClD,MAAM,IAAI,MAAM,qDAAqD;CAEvE,OAAO;AACT;AAEA,eAAsB,sBACpB,WACA,UACqB;CACrB,MAAM,QAAQ,0BAA0B,SAAS;CACjD,MAAM,MAAM,iBAAiB,QAAQ;CACrC,MAAM,WAAW,MAAM,cAAc,IAAI,GAAG;CAC5C,IAAI,UAAU,OAAO,WAAW,KAAK,QAAQ;CAC7C,MAAM,QAAQ,MAAM,qBAAqB,UAAU,MAAM,MAAM,SAAS;CACxE,MAAM,cAAc,IAAI,KAAK,WAAW,KAAK,KAAK,CAAC;CACnD,OAAO;AACT;AAeA,SAAgB,6BACd,WACmC;CACnC,MAAM,yBAAS,IAAI,IAA0B;CAC7C,KAAK,MAAM,YAAY,mBAAmB,UAAU,MAAM,GAAG;EAC3D,MAAM,QAAQ,0BAA0B,SAAS,CAAC,CAAC,cAAc,IAAI,SAAS,MAAM;EACpF,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,+CAA+C,SAAS,QAAQ;EAC5F,OAAO,IAAI,SAAS,QAAQ,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CACrF;CACA,OAAO;AACT;AAEA,SAAS,mBAAmB,QAA2D;CACrF,MAAM,YAAY,OAAO,QAAQ;CACjC,IAAI,CAAC,WAAW,OAAO,CAAC;CACxB,MAAM,SAAsC,CAAC;CAC7C,KAAK,MAAM,SAAS,UAAU,SAAS,CAAC,GAAG,OAAO,KAAK,MAAM,QAAQ;CACrE,OAAO,KAAK,GAAI,UAAU,SAAS,CAAC,CAAE;CACtC,OAAO,KAAK,GAAI,UAAU,UAAU,CAAC,CAAE;CACvC,OAAO,KAAK,GAAI,UAAU,UAAU,CAAC,CAAE;CACvC,OAAO,KAAK,GAAI,UAAU,YAAY,CAAC,CAAE;CACzC,IAAI,OAAO,UAAU,iBAAiB,UAAU,OAAO,KAAK,UAAU,YAAY;CAClF,OAAO;AACT;AAEA,SAAS,YAAY,UAA6C;CAChE,OAAOA,2BAAyB,QAAQ;AAC1C;;;;ACjLA,MAAa,+BAA+B;;AAE5C,MAAa,2CACX;;AAGF,SAAgB,iCACd,UACA,oBAC4C;CAC5C,IAAI,CAAC,MAAM,WAAW,QAAQ,KAAK,MAAM,UAAU,QAAQ,MAAM,UAC/D,MAAM,IAAI,MAAM,8DAA8D;CAEhF,MAAM,SAAS,MAAM,KAAK,UAAU,SAAS;CAC7C,OAAO;EACL,MAAM,MAAM,KAAK,QAAQ,WAAW;EACpC,GAAI,qBACA,EAAE,iBAAiB,MAAM,KAAK,QAAQ,iCAAiC,EAAE,IACzE,CAAC;CACP;AACF;;AAGA,eAAsB,+BACpB,WACA,OACA,KACsD;CACtD,MAAM,YAAY,UAAU,OAAO;CACnC,IAAI,CAAC,WAAW,OAAO,KAAA;CAEvB,MAAM,UAAU,MAAM,sBAAsB,WAAW,UAAU,SAAS,OAAO;CACjF,MAAM,kBAAkB,UAAU,kBAC9B,MAAM,sBAAsB,WAAW,UAAU,eAAe,IAChE,KAAA;CACJ,MAAM,OAAO,MAAM,QAAQ,KAAK,OAAO,GAAG,4BAA4B,CAAC;CACvE,IAAI;EACF,MAAM,MAAM,WAAW,YAAY;GACjC,MAAM;GACN,UAAU,UAAU;GACpB;GACA,aAAa;EACf,CAAC;EACD,MAAM,eACJ,QAAQ,aAAa,UAAU,UAAU,WAAW,UAAU,UAAU;EAC1E,MAAM,aAAa,UAAU,MAAM,kBAAkB,IAAI;EACzD,IAAI,eAAe,cACjB,MAAM,IAAI,MACR,gBAAgB,IAAI,2DAA2D,aAAa,QAAQ,YACtG;EAEF,MAAM,QAAQ,MAAM,+BAA+B,MAAM,UAAU,SAAS,QAAQ;EACpF,OAAO,OAAO,OAAO;GACnB,WAAW,UAAU;GACrB,UAAU,UAAU;GACpB,OAAO,OAAO,OACZ,MAAM,KAAK,SACT,OAAO,OAAO;IAAE,MAAM,KAAK;IAAM,MAAM,KAAK;IAAM,OAAO,WAAW,KAAK,KAAK,KAAK;GAAE,CAAC,CACxF,CACF;GACA,GAAI,kBAAkB,EAAE,iBAAiB,WAAW,KAAK,eAAe,EAAE,IAAI,CAAC;EACjF,CAAC;CACH,UAAU;EACR,MAAM,GAAG,MAAM;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACjD;AACF;;;ACzEA,MAAM,0BAAyC,OAAO,0CAA0C;;AAOhG,SAAgB,sCACd,OACmC;CACnC,MAAM,UAAU,cAAc,OAAO,6BAA6B;CAClE,sBAAgB,SAAS,CAAC,eAAe,aAAa,GAAG,6BAA6B;CACtF,IAAI,OAAO,QAAQ,gBAAgB,YAAY,QAAQ,YAAY,WAAW,GAC5E,MAAM,IAAI,MAAM,wDAAwD;CAE1E,OAAO,OAAO,OAAO;EACnB,aAAa,QAAQ;EACrB,aAAa,OAAO,OAAO,gCAAgC,MAAM,QAAQ,WAAW,CAAC;CACvF,CAAC;AACH;;AAGA,SAAgB,uCACd,OACA,iBAC0C;CAC1C,MAAM,UAAU,cAAc,OAAO,yBAAyB;CAC9D,sBAAgB,SAAS,CAAC,GAAG,2BAA2B;EACtD;EACA;EACA;CACF,CAAC;CAED,MAAM,cAAc,QAAQ,cACxB,uBAAuB,QAAQ,aAAa,eAAe,IAC3D,KAAA;CACJ,MAAM,cAAc,QAAQ,cAAc,kBAAkB,QAAQ,WAAW,IAAI,KAAA;CACnF,IAAI,QAAQ,aAAa,KAAA,KAAa,EAAE,QAAQ,oBAAoB,aAClE,MAAM,IAAI,MAAM,kDAAkD;CAEpE,MAAM,WAAW,QAAQ,WAAW,WAAW,KAAK,QAAQ,QAAQ,IAAI,KAAA;CACxE,OAAO,OAAO,OAAO;EACnB,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;EACrC,GAAI,cAAc,EAAE,aAAa,OAAO,OAAO,WAAW,EAAE,IAAI,CAAC;EACjE,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;GAC9B,0BAA0B;CAC7B,CAAC;AACH;;AAGA,SAAgB,8CAA8C,OAAsB;CAClF,MAAM,UAAU,cAAc,OAAO,gCAAgC;CACrE,sBAAgB,SAAS,CAAC,SAAS,GAAG,gCAAgC;CACtE,IAAI,QAAQ,YAAY,MACtB,MAAM,IAAI,MAAM,6DAA6D;AAEjF;AAEA,SAAS,kBACP,OACgE;CAChE,MAAM,UAAU,cAAc,OAAO,0BAA0B;CAC/D,sBAAgB,SAAS,CAAC,cAAc,SAAS,GAAG,0BAA0B;CAC9E,IAAI,EAAE,QAAQ,mBAAmB,aAC/B,MAAM,IAAI,MAAM,uDAAuD;CAEzE,OAAO,OAAO,OAAO;EACnB,YAAY,OAAO,OACjB,8CAA8C,MAAM,QAAQ,UAAU,CACxE;EACA,SAAS,WAAW,KAAK,QAAQ,OAAO;CAC1C,CAAC;AACH;AAEA,SAAS,uBACP,OACA,UACgE;CAChE,MAAM,UAAU,cAAc,OAAO,wBAAwB;CAC7D,IAAI,QAAQ,SAAS,UAAU;EAC7B,sBAAgB,SAAS,CAAC,QAAQ,OAAO,GAAG,+BAA+B;EAC3E,IAAI,SAAS,SAAS,UACpB,MAAM,IAAI,MAAM,sEAAsE;EAExF,IAAI,EAAE,QAAQ,iBAAiB,aAC7B,MAAM,IAAI,MAAM,yDAAyD;EAE3E,IAAI,QAAQ,MAAM,aAAa,SAAS,UACtC,MAAM,IAAI,MAAM,4CAA4C,SAAS,SAAS,cAAc;EAE9F,OAAO,OAAO,OAAO;GAAE,MAAM;GAAU,OAAO,WAAW,KAAK,QAAQ,KAAK;EAAE,CAAC;CAChF;CACA,sBACE,SACA;EAAC;EAAQ;EAAc;EAAc;EAAW;CAAS,GACzD,wBACF;CACA,IAAI,QAAQ,SAAS,aACnB,MAAM,IAAI,MAAM,oDAAoD;CAEtE,IAAI,SAAS,SAAS,aACpB,MAAM,IAAI,MAAM,oEAAoE;CAEtF,IACE,OAAO,QAAQ,eAAe,YAC9B,CAAC,kCAAkC,KAAK,QAAQ,UAAU,GAE1D,MAAM,IAAI,MAAM,0DAA0D;CAE5E,IAAI,EAAE,QAAQ,mBAAmB,eAAe,EAAE,QAAQ,mBAAmB,aAC3E,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,aAAa,8CAA8C,MAAM,QAAQ,UAAU;CACzF,OAAO,OAAO,OAAO;EACnB,MAAM;EACN,YAAY,QAAQ;EACpB,YAAY,OAAO,OAAO,UAAU;EACpC,SAAS,WAAW,KAAK,QAAQ,OAAO;EACxC,SAAS,WAAW,KAAK,QAAQ,OAAO;CAC1C,CAAC;AACH;AAEA,SAAS,cAAc,OAAgB,OAAwC;CAC7E,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAC5D,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CAE9C,OAAO;AACT;;;;AC7HA,eAAsB,+BACpB,MACA,OAMoC;CACpC,MAAM,QAAQ,eAAe;CAC7B,MAAM,QAAQ,WAAW,KAAK,MAAM,KAAK;CACzC,MAAM,iBAAiB,YAAY,KAAK;CACxC,MAAM,MAAM,gCAAgC,MAC1C,MAAM,KAAK,IAAI;EACb,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,OAAO,WAAW,KAAK,KAAK;EAC5B,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;CACjD,CAAC,CACH;CACA,MAAM,QAAQ,eAAe;CAC7B,IAAI,IAAI,WAAW,kBAAkB,IAAI,eAAe,MAAM,YAC5D,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG;CAClC,MAAM,QAAQ,eAAe;CAC7B,YAAY,QAAQ,gBAAgB,MAAM,YAAY,4BAA4B;CAClF,OAAO,wBAAwB,GAAG;AACpC;;;;ACgBA,eAAsB,0BACpB,OACA,SACA,YACA,eACA,YACA,UACA,iBACA,sBACA,QACwC;CACxC,IAAI;CACJ,IAAI;EACF,QAAQ,eAAe;EACvB,IAAI,QAAQ,gBAAgB,MAAM,aAChC,MAAM,IAAI,MAAM,sEAAsE;EAExF,cAAc,QAAQ;EACtB,IACE,YAAY,SAAS,aACrB,YAAY,cAAc,MAAM,cAAc,MAAM,SAAS,OAAO,WAEpE,MAAM,IAAI,MAAM,+DAA+D;EAGjF,MAAM,MAAM,MAAM,WAAW,OAAO,cAAc,KAAK;EACvD,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,mCAAmC,cAAc,OAAO;EAClF,IAAI,IAAI,WAAW,aAAa,IAAI,YAAY,KAAA,GAC9C,MAAM,IAAI,MAAM,qCAAqC;EAEvD,oBAAoB,IAAI,MAAM,cAAc,IAAI;EAEhD,MAAM,CAAC,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI;GAC3D,WAAW,MAAM,EAAE,OAAO,IAAI,MAAM,CAAC;GACrC,WAAW,OAAO,EAAE,OAAO,IAAI,MAAM,CAAC;GACtC,WAAW,OAAO,IAAI,KAAK;GAC3B,WAAW,UAAU,IAAI,KAAK;EAChC,CAAC;EACD,MAAM,eAAe,CAAC,GAAG,KAAK,CAAC,CAAC,MAC7B,GAAG,MAAM,EAAE,YAAY,EAAE,aAAa,eAAe,EAAE,QAAQ,EAAE,MAAM,CAC1E;EACA,MAAM,gBAAgB,CAAC,GAAG,MAAM,CAAC,CAAC,MAC/B,GAAG,MAAM,EAAE,YAAY,EAAE,aAAa,eAAe,EAAE,SAAS,EAAE,OAAO,CAC5E;EACA,MAAM,gBAAgB,CAAC,GAAG,MAAM,CAAC,CAAC,MAC/B,GAAG,MAAM,EAAE,YAAY,EAAE,aAAa,eAAe,EAAE,WAAW,EAAE,SAAS,CAChF;EACA,MAAM,mBAAmB,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,GAAG,MAC/C,eAAe,EAAE,YAAY,EAAE,UAAU,CAC3C;EAEA,MAAM,aAAa,aAAa,OAAO,SAAS;EAChD,kCAAkC,YAAY,UAAU;EACxD,MAAM,QAAQ,cAAc,OAAO,IAAI,WAAW,IAAI,SAAS,cAAc,UAAU;EACvF,MAAM,SAAS,MAAM,cACnB,OACA,SAAS,cACT,SAAS,iBAAiB,aAC1B,MACF;EACA,MAAM,WAAW,qBACf;GACE,KAAK;IAAE,GAAG;IAAK,kBAAkB;GAAkB;GACnD,OAAO;GACP,QAAQ;GACR,QAAQ;GACR,WAAW;EACb,GACA,eACF;EACA,MAAM,iBAAiB,EAAE,GAAI,sBAAsB,UAAU,CAAC,EAAG;EACjE,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO,MAAM,GAC/D,eAAe,SAAS,eAAe,SAAS,KAAK;EAYvD,MAAM,aAAa,wBAAwB;GATzC,GAAI,SAAS;GACb,iBAAiB,EAAE,iBAAiB,MAAM,gBAAgB;GAC1D,WAAW;IACT,SAAS;IACT,iBACG,sBAAsB,kBAAkB,KAAK,SAAS,OAAO;IAChE,QAAQ;GACV;EAEqD,CAAC;EACxD,uBAAuB,YAAY,eAAe;EAOlD,MAAM,QAAQ;GACZ,UAAU,MAPgB,+BAA+B,SAAS,iBAAiB;IACnF,aAAa,MAAM;IACnB,SAAS;IACT,OAAO;IACP;GACF,CAAC;GAGC,YACE,IACA,aAAa,SACb,cAAc,SACd,cAAc,SACd,iBAAiB;GACnB,gBAAgB,WAAW;EAC7B;EACA,MAAM,WAAW,2BAAqD;GACpE,MAAM;GACN,iBAAiB;GACjB,cAAc,MAAM,OAAO;GAC3B,eAAe,MAAM,cAAc,MAAM,SAAS,QAAQ;GAC1D,8BAA8B,MAAM,uBAAuB;GAC3D,qBAAqB,MAAM,cAAc,MAAM;GAC/C,QAAQ;IACN,aAAa,IAAI;IACjB,WAAW,IAAI;IACf,YAAY,IAAI,UAAU,IAAI;GAChC;GACA;GACA;GACA;GACA;GACA,iBAAiB,SAAS,iBAAiB;GAC3C,iBAAiB,SAAS;GAC1B,aAAa,SAAS,YAAY;GAClC,iBAAiB,SAAS;EAC5B,CAAC;EACD,+BAA+B,MAAM,SAAS,KAAK;EACnD,MAAM,aAAa,MAAM,+BAA+B,SAAS,iBAAiB;GAChF,aAAa,MAAM;GACnB,SAAS;GACT,OAAO,SAAS;GAChB;EACF,CAAC;EACD,OAAO;GACL,WAAW;GACX,SAAS;GACT,WAAW;IACT,iBAAiB,SAAS,gBAAgB;IAC1C,iBAAiB,SAAS,iBAAiB;IAC3C,aAAa,SAAS,YAAY,SAAS;IAC3C,iBAAiB,SAAS,gBAAgB;IAC1C;GACF;EACF;CACF,SAAS,OAAO;EACd,OAAO,EACL,GAAG,wBACD,OACA,sBACE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACrD,eACF,GACA,aACA,WAAW,KACb,EACF;CACF;AACF;AAEA,SAAS,oBACP,MACA,UACM;CACN,KAAK,MAAM,QAAQ,OAAO,OAAO,oBAAoB,GACnD,IAAI,OAAO,UAAU,SAAS,OAC5B,MAAM,IAAI,MAAM,0DAA0D,MAAM;AAGtF;AAEA,SAAS,cACP,OACA,WACA,SACA,OACA,YACQ;CACR,MAAM,SAAS,MAAM,cAAc,MAAM,SAAS;CAClD,MAAM,QAAQ,WAAW;CAIzB,MAAM,SAAS,UAAU;CACzB,IAAI,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,KAAK,SAAS,OAAO,WAC5D,MAAM,IAAI,MAAM,6BAA6B,OAAO,WAAW,OAAO,WAAW;CAEnF,MAAM,QAAQ,MAAM,QAAQ,SAAS,KAAK,SAAS,MAAM,CAAC,CAAC;CAC3D,MAAM,SAA0C;EAC9C;GAAC;GAAO,OAAO;GAAU;EAAY;EACrC;GAAC,MAAM;GAAY,OAAO;GAAe;EAAa;EACtD;GAAC,MAAM;GAAa,OAAO;GAAgB;EAAc;EACzD;GAAC,MAAM;GAAc,OAAO;GAAiB;EAAe;CAC9D;CACA,KAAK,MAAM,CAAC,QAAQ,OAAO,UAAU,QACnC,IAAI,SAAS,OAAO,MAAM,IAAI,MAAM,aAAa,MAAM,GAAG,OAAO,WAAW,OAAO;CAErF,IAAI,MAAM,eAAe,WAAW,OAAO,YAAY,mBAAmB,GACxE,MAAM,IAAI,MACR,sBAAsB,MAAM,eAAe,IAAc,WAAW,OAAO,YAC7E;CAEF,OAAO;AACT;AAEA,eAAe,cACb,OACA,SACA,WACA,QACsC;CACtC,QAAQ,eAAe;CACvB,IAAI,MAAM,OAAO,SAAS,YAAY;EACpC,IAAI,QAAQ,gBAAgB,KAAA,KAAa,cAAc,KAAA,GACrD,MAAM,IAAI,MAAM,8CAA8C;EAEhE,OAAO,EAAE,MAAM,WAAW;CAC5B;CACA,IAAI,CAAC,QAAQ,aAAa,MAAM,IAAI,MAAM,sDAAsD;CAChG,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,uDAAuD;CACvF,MAAM,aAAa,QAAQ,YAAY;CACvC,MAAM,gBAAgB,wBAAwB,UAAU;CACxD,MAAM,WAAW,8CAA8C,MAAM;EACnE,MAAM;EACN,QAAQ,YAAY,aAAa;EACjC,UAAU;EACV,UAAU,UAAU;EACpB,SAAS,UAAU;CACrB,CAAC;CACD,OAAO;EACL,MAAM;EACN,OAAO;EACP,oBAAoB,MAAM,OAAO;EACjC,qBAAqB,MAAM,OAAO,MAAM,SAAS;EACjD,mBAAmB,MAAM,OAAO,YAAY;EAC5C,YAAY;CACd;AACF;AAEA,SAAgB,wBACd,OACA,QACA,aACA,QAAyC,MACa;CACtD,OAAO;EACL,WAAW;EACX;EACA,SAAS;GACP,aAAa,MAAM;GACnB,cAAc,MAAM,OAAO;GAC3B,qBAAqB,MAAM,cAAc,MAAM;GAC/C,8BAA8B,MAAM,uBAAuB;GAC3D,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;EACvC;EACA;CACF;AACF;AAEA,SAAS,eAAe,GAAW,GAAmB;CACpD,OAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;AAClC;;;;;;;ACtRA,eAAsB,iCAAiC,OAQV;CAC3C,MAAM,QAAQ,eAAe;CAC7B,MAAM,aAAa,yBAAyB,MAAM,QAAQ,MAAM,cAAc;CAC9E,MAAM,sBAAsB,MAAM,qBAAqB,WAAW,UAAU,MAAM,SAAS;CAC3F,IAAI,oBAAoB,eAAe,GACrC,MAAM,IAAI,MAAM,2DAA2D;CAE7E,MAAM,+BAA+B,YAAY,mBAAmB;CACpE,MAAM,cAAc,wBAAwB,MAAM,WAAW;CAC7D,MAAM,MAAM,MAAM,OAAO;CACzB,MAAM,cAAc,KAAK,IAAI;CAC7B,MAAM,SAAS,MAAM,IACnB,OAAO,OAAO;EACZ,aAAa,MAAM;EACnB;EACA,SAAS,MAAM;EACf,gBAAgB,uBAAuB,mBAAmB;EAC1D,QAAQ,MAAM,UAAU,IAAI,gBAAgB,CAAC,CAAC;CAChD,CAAC,CACH;CACA,MAAM,YAAY,KAAK,IAAI,aAAa,KAAK,IAAI,CAAC;CAClD,MAAM,QAAQ,eAAe;CAC7B,wBAAwB,MAAM;CAE9B,MAAM,WAAW,WAAW,KAAK,OAAO,QAAQ;CAChD,MAAM,eAAe,YAAY,QAAQ;CACzC,IAAI,OAAO,QAAQ,yBAAyB,8BAC1C,MAAM,IAAI,MACR,gGACF;CAEF,IAAI,OAAO,QAAQ,sBAAsB,MAAM,QAAQ,SAAS,QAC9D,MAAM,IAAI,MACR,gFACF;CAEF,IAAI,OAAO,QAAQ,iBAAiB,cAClC,MAAM,IAAI,MAAM,+EAA+E;CAGjG,OAAO,OAAO,OAAO;EACnB,QAAQ;EACR,SAAS,wBAAwB;GAC/B,OAAO,gBAAgB;GACvB,QAAQ;IACN;IACA;IACA,YAAY,YAAY;GAC1B;EACF,CAAC;EACD,YAAY,OAAO;EACnB;CACF,CAAC;AACH;AAEA,SAAS,yBACP,QACA,UAC2C;CAC3C,IAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,SAC1B,MAAM,IAAI,MAAM,+DAA+D;CAQjF,IAAIC,2BAAyB;EAL3B,MAAM,OAAO;EACb,SAAS,OAAO;EAChB,QAAQ;EACR,UAAU,OAAO;CAEe,CAAC,MAAMA,2BAAyB,QAAQ,GACxE,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO,wBAAwB,QAAQ;AACzC;AAEA,SAAS,kBAA4C;CACnD,OAAO;EACL,aAAa;EACb,cAAc;EACd,mBAAmB;EACnB,iBAAiB;EACjB,YAAY;EACZ,cAAc;EACd,gBAAgB;CAClB;AACF;AAEA,SAAS,uBAAuB,OAG9B;CACA,MAAM,SAAS,WAAW,KAAK,KAAK;CACpC,OAAO,OAAO,OAAO;EACnB,YAAY,OAAO;EACnB,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,MAAM;EAC/B;CACF,CAAC;AACH;AAEA,SAAS,wBACP,OACgF;CAChF,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,qDAAqD;CAEvE,MAAM,SAAS;CACf,MAAM,OAAO,OAAO,KAAK,MAAM,CAAC,CAAC,KAAK;CACtC,IACE,KAAK,WAAW,KAChB,KAAK,OAAO,aACZ,KAAK,OAAO,gBACZ,KAAK,OAAO,YAEZ,MAAM,IAAI,MAAM,+DAA+D;CAEjF,IAAI,EAAE,OAAO,oBAAoB,aAC/B,MAAM,IAAI,MAAM,mDAAmD;CAErE,IACE,OAAO,YAAY,QACnB,OAAO,OAAO,YAAY,YAC1B,MAAM,QAAQ,OAAO,OAAO,GAE5B,MAAM,IAAI,MAAM,sDAAsD;CAExE,MAAM,cAAc,OAAO,KAAK,OAAO,OAAO,CAAC,CAAC,KAAK;CACrD,IACE,YAAY,WAAW,KACvB,YAAY,OAAO,0BACnB,YAAY,OAAO,kBACnB,YAAY,OAAO,qBAEnB,MAAM,IAAI,MAAM,uEAAuE;AAE3F;;;;ACxIA,eAAsB,qCACpB,UACA,UACA,SACA,iBACA,QACiD;CACjD,MAAM,mBAAmB,QAAQ,WAC7B,MAAM,+BAA+B,iBAAiB;EACpD,aAAa,SAAS;EACtB,SAAS;EACT,OAAO,QAAQ;EACf;CACF,CAAC,IACD,KAAA;CACJ,MAAM,cAAc,QAAQ,cACxB,MAAM,mBACJ,SAAS,aACT,UACA,QAAQ,aACR,iBACA,MACF,IACA,KAAA;CACJ,MAAM,cAAc,QAAQ,cACxB,MAAM,wBACJ,SAAS,aACT,yBACA,wBACA,QAAQ,YAAY,YACpB,QAAQ,YAAY,SACpB,iBACA,MACF,IACA,KAAA;CACJ,MAAM,QAAQ,wBAAwB;EACpC,MAAM;EACN,qBAAqB,SAAS;EAC9B,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;EAC/C,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;EACrC,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;CACvC,CAAC;CACD,MAAM,WAAW,MAAM,+BAA+B,iBAAiB;EACrE,aAAa,SAAS;EACtB,SAAS;EACT;EACA;CACF,CAAC;CACD,OAAO,OAAO,OAAO;EACnB;EACA,GAAI,cAAc,EAAE,aAAa,OAAO,OAAO,WAAW,EAAE,IAAI,CAAC;EACjE,GAAI,cAAc,EAAE,aAAa,OAAO,OAAO,WAAW,EAAE,IAAI,CAAC;CACnE,CAAC;AACH;AAEA,eAAe,mBACb,aACA,UACA,SACA,iBACA,QAC6C;CAC7C,IAAI,QAAQ,SAAS,UAAU;EAC7B,IAAI,SAAS,SAAS,UACpB,MAAM,IAAI,MAAM,gDAAgD;EAClE,MAAM,WAAW,MAAM,+BAA+B,iBAAiB;GACrE;GACA,SAAS;GACT,OAAO,QAAQ;GACf;EACF,CAAC;EACD,OAAO;GACL,MAAM;GACN,MAAM;IAAE,WAAW,SAAS;IAAW,UAAU,SAAS;GAAS;GACnE;EACF;CACF;CACA,IAAI,SAAS,SAAS,aACpB,MAAM,IAAI,MAAM,mDAAmD;CAErE,MAAM,YAAY,MAAM,wBACtB,aACA,iBACA,gBACA,QAAQ,YACR,QAAQ,SACR,iBACA,MACF;CACA,MAAM,UAAU,MAAM,+BAA+B,iBAAiB;EACpE;EACA,SAAS;EACT,OAAO,QAAQ;EACf;CACF,CAAC;CACD,OAAO;EAAE,MAAM;EAAa,YAAY,QAAQ;EAAY,GAAG;EAAW;CAAQ;AACpF;AAEA,eAAe,wBACb,aACA,iBACA,gBACA,YACA,cACA,iBACA,QAKC;CACD,MAAM,gBAAgB,wBAAwB,UAAU;CACxD,MAAM,CAAC,UAAU,WAAW,MAAM,QAAQ,IAAI,CAC5C,+BAA+B,iBAAiB;EAC9C;EACA,SAAS;EACT,OAAO;EACP;CACF,CAAC,GACD,+BAA+B,iBAAiB;EAC9C;EACA,SAAS;EACT,OAAO;EACP;CACF,CAAC,CACH,CAAC;CACD,OAAO;EAAE;EAAY;EAAU;CAAQ;AACzC;;;;AC1GA,eAAsB,gCACpB,OACA,YACA,iBACiD;CACjD,OAAO,MAAM,wCACX;EACE,aAAa,MAAM;EACnB,qBAAqB,MAAM,cAAc,MAAM;EAC/C,eAAe,MAAM;CACvB,GACA,YACA,eACF;AACF;;AAGA,eAAsB,wCACpB,UAKA,YACA,iBACiD;CACjD,MAAM,WAAW;EACf,MAAM;EACN,qBAAqB,SAAS;EAC9B,eAAe,WAAW,MAAM;EAChC,aAAa,WAAW,MAAM;EAC9B,QAAQ;EACR,mBAAmB,WAAW,MAAM;EACpC,UAAU,SAAS;EACnB,OAAO,WAAW,MAAM,MAAM,KAAK,UAAU;GAC3C,QAAQ,KAAK;GACb,cAAc,KAAK;GACnB,aAAa,KAAK;GAClB,QAAQ,KAAK;GACb,OAAO,KAAK;GACZ,aAAa,KAAK;GAClB,WAAW,KAAK;GAChB,aAAa,KAAK;GAClB,sBAAsB,KAAK;GAC3B,cAAc,KAAK;GACnB,mBAAmB,KAAK,qBAAqB;GAC7C,iBAAiB,KAAK,mBAAmB;GACzC,cAAc,KAAK;GACnB,gBAAgB,KAAK;EACvB,EAAE;EACF,OAAO,WAAW;CACpB;CACA,MAAM,QAAQ,wBAAwB,QAAQ;CAC9C,MAAM,SAAS,YAAY,KAAK;CAChC,MAAM,WAAW,MAAM,+BAA+B,iBAAiB;EACrE,aAAa,SAAS;EACtB,SAAS;EACT;CACF,CAAC;CACD,OAAO,wBACL,4CAA4C,MAAM;EAChD,MAAM;EACN;EACA;EACA;CACF,CAAC,CACH;AACF;;AAGA,eAAsB,6CACpB,OACA,SACA,iBACA,iBACA,QAIC;CACD,QAAQ,eAAe;CACvB,MAAM,cAAc,QAAQ;CAC5B,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,qDAAqD;CACvF,IAAI,QAAQ,UAAU,uBAAuB,QAAQ,UAAU,eAAe;CAC9E,MAAM,WAAW,MAAM,cAAc;CACrC,IAAI,YAAY,SAAS,SAAS,MAChC,MAAM,IAAI,MACR,sBAAsB,YAAY,KAAK,mCAAmC,SAAS,KAAK,SAC1F;CAEF,MAAM,WACJ,YAAY,SAAS,YAAY,SAAS,SAAS,WAC/C,wBAAwB,YAAY,OAAO,UAAU,eAAe,IACpE,YAAY,SAAS,eAAe,SAAS,SAAS,cACpD,MAAM,2BAA2B,OAAO,aAAa,iBAAiB,MAAM,IAC5E,KAAA;CACR,IAAI,CAAC,UAAU,MAAM,IAAI,MAAM,mDAAmD;CAClF,MAAM,oBAAoB,OAAO,SAAS,iBAAiB,MAAM;CAEjE,MAAM,mBAAmB,MAAM,qCAC7B;EACE,aAAa,MAAM;EACnB,qBAAqB,MAAM,cAAc,MAAM;CACjD,GACA,UACA,SACA,iBACA,MACF;CACA,MAAM,YAAY,iBAAiB;CACnC,IAAI,CAAC,aAAa,UAAU,SAAS,SAAS,MAC5C,MAAM,IAAI,MAAM,qCAAqC;CAEvD,MAAM,cACJ,SAAS,SAAS,YAAY,UAAU,SAAS,WAC7C,MAAM,iCAAiC,OAAO,UAAU,WAAW,iBAAiB,MAAM,IAC1F,SAAS,SAAS,eAAe,UAAU,SAAS,cAClD,MAAM,oCACJ,OACA,UACA,WACA,iBACA,MACF,IACA,KAAA;CACR,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,mDAAmD;CACrF,OAAO,OAAO,OAAO;EAAE;EAAkB;CAAY,CAAC;AACxD;AAgBA,eAAe,2BACb,OACA,SACA,iBACA,QACuC;CACvC,MAAM,aAAa,MAAM,cAAc;CACvC,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,uDAAuD;CACxF,MAAM,QAAQ,WAAW,KAAK,QAAQ,OAAO;CAC7C,MAAM,UAAU,WAAW,KAAK,QAAQ,OAAO;CAC/C,IAAI,QAAQ,eAAe,GAAG,MAAM,IAAI,MAAM,wCAAwC;CACtF,uBAAuB,OAAO,eAAe;CAC7C,uBAAuB,SAAS,eAAe;CAC/C,MAAM,aAAa,wBAAwB,QAAQ,UAAU;CAC7D,MAAM,WAAW,MAAM,uBAAuB;EAC5C,gBAAgB,MAAM,MAAM,QAAQ;EACpC,YAAY,WAAW;EACvB,UAAU,WAAW;EACrB,YAAY,QAAQ;EACpB;EACA;CACF,CAAC;CACD,QAAQ,eAAe;CACvB,MAAM,gBAAgB,wBAAwB,UAAU;CACxD,uBAAuB,eAAe,eAAe;CAQrD,MAAM,yBAAyB,OAPH,8CAA8C,MAAM;EAC9E,MAAM;EACN,QAAQ,YAAY,aAAa;EACjC,UAAU;EACV,UAAU,0BAA0B,aAAa;EACjD,SAAS,0BAA0B,OAAO;CAC5C,CACwD,GAAG,SAAS,eAAe;CACnF,QAAQ,eAAe;CACvB,OAAO;EACL,MAAM;EACN;EACA;EACA;EACA;EACA,cAAc,SAAS;EACvB,YAAY,SAAS;EACrB;CACF;AACF;AAEA,eAAe,oCACb,OACA,UACA,WACA,iBACA,QAC4C;CAC5C,MAAM,EAAE,YAAY,eAAe,OAAO,eAAe;CACzD,MAAM,WAAW,8CAA8C,MAAM;EACnE,MAAM;EACN,QAAQ,YAAY,aAAa;EACjC,UAAU;EACV,UAAU,UAAU;EACpB,SAAS,UAAU;CACrB,CAAC;CAyBD,MAAM,WAAW,MAAM,2BAA2B,OAAO;EAvBvD,MAAM;EACN,qBAAqB,MAAM,cAAc,MAAM;EAC/C,SAAS;GACP,MAAM;GACN,gBAAgB;IACd,UAAU,WAAW;IACrB,cAAc,WAAW;IACzB,QAAQ,WAAW;IACnB,MAAM,WAAW;GACnB;GACA,kBAAkB;IAChB,UAAU,WAAW;IACrB,cAAc,WAAW;IACzB,QAAQ,SAAS;IACjB,MAAM,SAAS;GACjB;GACA,YAAY;GACZ,SAAS;IACP,QAAQ;IACR,UAAU,UAAU;GACtB;EACF;CAE8D,GAAG,iBAAiB,MAAM;CAC1F,MAAM,cAAc,WAAW,KAAK,KAAK;CACzC,OAAO,OAAO,OAAO;EACnB,MAAM;EACN;EACA,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,WAAW;EACpC;GACC,2BAA2B;CAC9B,CAAC;AACH;AAQA,SAAS,wBACP,eACA,UACA,iBAC2B;CAC3B,IAAI,cAAc,eAAe,GAAG,MAAM,IAAI,MAAM,uCAAuC;CAC3F,IAAI,cAAc,aAAa,SAAS,UACtC,MAAM,IAAI,MAAM,4CAA4C,SAAS,SAAS,cAAc;CAE9F,MAAM,SAAS,WAAW,KAAK,aAAa;CAC5C,uBAAuB,QAAQ,eAAe;CAC9C,OAAO;EACL,MAAM;EACN,OAAO;EACP,MAAM;GAAE,WAAW,SAAS;GAAW,UAAU,SAAS;EAAS;CACrE;AACF;AAEA,eAAe,iCACb,OACA,UACA,WACA,iBACA,QAC4C;CAC5C,IACE,UAAU,KAAK,cAAc,SAAS,KAAK,aAC3C,UAAU,KAAK,aAAa,SAAS,KAAK,UAE1C,MAAM,IAAI,MAAM,4DAA4D;CAW9E,MAAM,WAAW,MAAM,2BAA2B,OAAO;EARvD,MAAM;EACN,qBAAqB,MAAM,cAAc,MAAM;EAC/C,SAAS;GACP,MAAM;GACN,MAAM,SAAS;GACf,UAAU,UAAU;EACtB;CAE8D,GAAG,iBAAiB,MAAM;CAC1F,MAAM,eAAe,WAAW,KAAK,SAAS,KAAK;CACnD,OAAO,OAAO,OAAO;EACnB,MAAM;EACN;EACA,MAAM,wBAAwB,SAAS,IAAI;EAC3C,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,YAAY;EACrC;GACC,2BAA2B;CAC9B,CAAC;AACH;AAEA,eAAe,2BACb,OACA,UACA,iBACA,QAMA;CACA,MAAM,QAAQ,wBAAwB,QAAQ;CAC9C,MAAM,SAAS,YAAY,KAAK;CAChC,MAAM,WAAW,MAAM,+BAA+B,iBAAiB;EACrE,aAAa,MAAM;EACnB,SAAS;EACT;EACA;CACF,CAAC;CACD,OAAO,wBACL,wCAAwC,MAAM;EAC5C,MAAM;EACN;EACA;EACA;CACF,CAAC,CACH;AAIF;;AAGA,eAAsB,gCACpB,OACA,aACA,SACA,QACA,iBACA,iBACA,QACiD;CACjD,QAAQ,eAAe;CACvB,MAAM,oBAAoB,wBAAwB,WAAW;CAC7D,MAAM,SAAS,MAAM,iCAAiC;EACpD,aAAa,MAAM;EACnB,aAAa;EACb;EACA,gBAAgB,MAAM,cAAc;EACpC;EACA,WAAW;EACX;CACF,CAAC;CACD,QAAQ,eAAe;CACvB,MAAM,aAAa,oBAAoB,OAAO,YAAY,iBAAiB;CAC3E,MAAM,cAAc,WAAW,KAAK,OAAO,QAAQ;CACnD,IAAI,YAAY,eAAe,GAAG,MAAM,IAAI,MAAM,8CAA8C;CAChG,uBAAuB,aAAa,eAAe;CACnD,MAAM,cAAc,MAAM,+BAA+B,iBAAiB;EACxE,aAAa,MAAM;EACnB,SAAS;EACT,OAAO;EACP;CACF,CAAC;CACD,MAAM,WAAW;EACf,MAAM;EACN,qBAAqB,MAAM,cAAc,MAAM;EAC/C,mBAAmB,QAAQ,SAAS;EACpC,QAAQ,OAAO;EACf,UAAU;EACV,SAAS,OAAO;EAChB,OAAO,WAAW;EAClB,QAAQ,WAAW;EACnB,YAAY,WAAW;CACzB;CACA,MAAM,QAAQ,wBAAwB,QAAQ;CAC9C,MAAM,SAAS,YAAY,KAAK;CAChC,MAAM,WAAW,MAAM,+BAA+B,iBAAiB;EACrE,aAAa,MAAM;EACnB,SAAS;EACT;EACA;CACF,CAAC;CACD,OAAO,wBACL,4CAA4C,MAAM;EAChD,MAAM;EACN;EACA;EACA;CACF,CAAC,CACH;AACF;AAEA,eAAe,yBACb,OACA,UACA,SACA,iBACe;CACf,MAAM,OAAO,MAAM,QAAQ,KAAK,OAAO,GAAG,+BAA+B,CAAC;CAC1E,IAAI;EACF,MAAM,MAAM,MAAM,WAAW,YAAY;GACvC,MAAM;GACN;GACA,SAAS,WAAW,KAAK,OAAO;GAChC,aAAa;EACf,CAAC;EACD,MAAM,QAAQ,MAAM,+BAA+B,MAAM,SAAS,QAAQ;EAC1E,KAAK,MAAM,QAAQ,OAAO,uBAAuB,KAAK,OAAO,eAAe;CAC9E,UAAU;EACR,MAAM,GAAG,MAAM;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACjD;AACF;AAEA,eAAe,oBACb,OACA,SACA,iBACA,QACe;CACf,IAAI,MAAM,OAAO,SAAS,YAAY;EACpC,IAAI,QAAQ,aAAa,MAAM,IAAI,MAAM,8CAA8C;EACvF;CACF;CACA,MAAM,SAAS,QAAQ;CACvB,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,sDAAsD;CACnF,IAAI,OAAO,QAAQ,eAAe,GAAG,MAAM,IAAI,MAAM,yCAAyC;CAC9F,MAAM,gBAAgB,wBAAwB,OAAO,UAAU;CAC/D,uBAAuB,eAAe,eAAe;CACrD,uBAAuB,OAAO,SAAS,eAAe;CACtD,MAAM,WAAW,8CAA8C,MAAM;EACnE,MAAM;EACN,QAAQ,YAAY,aAAa;EACjC,UAAU,OAAO;EACjB,UAAU,0BAA0B,aAAa;EACjD,SAAS,0BAA0B,OAAO,OAAO;CACnD,CAAC;CACD,MAAM,OAAO,MAAM,QAAQ,KAAK,OAAO,GAAG,+BAA+B,CAAC;CAC1E,IAAI;EACF,MAAM,MAAM,MAAM,WAAW,YAAY;GACvC,MAAM;GACN;GACA,SAAS,WAAW,KAAK,OAAO,OAAO;GACvC,aAAa;EACf,CAAC;EACD,MAAM,QAAQ,MAAM,+BAA+B,MAAM,OAAO,UAAU;EAC1E,KAAK,MAAM,QAAQ,OAAO,uBAAuB,KAAK,OAAO,eAAe;EAC5E,QAAQ,eAAe;CACzB,UAAU;EACR,MAAM,GAAG,MAAM;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACjD;AACF;AAEA,SAAS,oBACP,YACA,aACwF;CACxF,IAAI,CAAC,cAAc,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,GAC3E,MAAM,IAAI,MAAM,kDAAkD;CAEpE,gBAAgB,WAAW,OAAO,2BAA2B;CAC7D,IAAI,WAAW,WAAW,KAAA,KAAa,OAAO,WAAW,WAAW,WAClE,MAAM,IAAI,MAAM,4CAA4C;CAE9D,MAAM,YAAY,YAAY,SAAS,UAAU,YAAY,aAAa;CAC1E,MAAM,aAAa,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,CAAC,CAC3D,KAAK,CAAC,MAAM,WAAW;EACtB,IAAI,CAAC,iCAAiC,KAAK,IAAI,GAC7C,MAAM,IAAI,MAAM,oDAAoD,MAAM;EAE5E,gBAAgB,OAAO,iCAAiC,MAAM;EAC9D,OAAO;GAAE;GAAM,OAAO,YAAY,QAAQ;EAAE;CAC9C,CAAC,CAAC,CACD,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;CAC5D,OAAO;EACL,OAAO,YAAY,WAAW,QAAQ;EACtC,QAAQ,cAAc,WAAW,UAAU,WAAW,QAAQ;EAC9D;CACF;AACF;AAEA,SAAS,gBAAgB,OAAgB,OAAwC;CAC/E,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,KAAK,QAAQ,GAC/E,MAAM,IAAI,MAAM,GAAG,MAAM,kCAAkC;AAE/D;;;;AChhBA,SAAgB,yCACd,OACA,iBACoC;CACpC,MAAM,WAAW,8BAA8B,eAAe;CAC9D,MAAM,gCAAgB,IAAI,IAAmB;CAC7C,IAAI,gBAAgB;CACpB,MAAM,SAAS,cAAkD;EAC/D,IAAI,CAAC,eACH,OAAO,QAAQ,uBAAO,IAAI,MAAM,mCAAmC,CAAC;EAEtE,IAAI;EACJ,IAAI;GACF,UAAU,UAAU;EACtB,SAAS,OAAO;GACd,OAAO,QAAQ,OAAO,KAAK;EAC7B;EACA,IAAI;EACJ,UAAU,QAAQ,cAAc,cAAc,OAAO,OAAO,CAAC;EAC7D,cAAc,IAAI,OAAO;EACzB,OAAO;CACT;CACA,MAAM,QAAQ,OAAO,OAAmB;EACtC,YAAY,QAAQ,YAAY,MAAM,UAAU,SAAS,OAAO,GAAG,CAAC,CAAC;EACrE,YAAY,OAAO,UACjB,YAAY,MAAM,UAAU,SAAS,WAAW,KAAK,GAAG,SAAS,OAAO,KAAK,CAAC,CAAC;EACjF,aAAa,SACX,MAAM,YAAY;GAChB,IAAI,KAAK,SAAS,OAChB,MAAM,IAAI,MAAM,yDAAyD;GAE3E,MAAM,MAAM,WAAW,SAAS,OAAO,IAAI,CAAC;EAC9C,CAAC;EACH,aAAa,QAAQ,UACnB,MAAM,YAAY;GAChB,IAAI,MAAM,SAAS,OACjB,MAAM,IAAI,MAAM,yDAAyD;GAE3E,MAAM,MAAM,WAAW,SAAS,WAAW,MAAM,GAAG,SAAS,OAAO,KAAK,CAAC;EAC5E,CAAC;EACH,cAAc,UAAU,YAAY,MAAM,YAAY,SAAS,OAAO,KAAK,CAAC,CAAC;EAC7E,iBAAiB,aAAa,YAAY,MAAM,eAAe,SAAS,OAAO,QAAQ,CAAC,CAAC;EACzF,oBAAoB,UAAU,YAAY,MAAM,kBAAkB,SAAS,OAAO,KAAK,CAAC,CAAC;EACzF,QAAQ,OAAO,UAAU,MAAM,OAAO,SAAS,WAAW,KAAK,CAAC;EAChE,UAAU,OAAO,WAAW,MAAM,SAAS,SAAS,SAAS,MAAM,MAAM,IAAI,KAAA,CAAS;EACtF,OAAO,OAAO,WAAW,MAAM,MAAM,SAAS,SAAS,MAAM,MAAM,IAAI,KAAA,CAAS;EAChF,QAAQ,OAAO,WAAW,MAAM,OAAO,SAAS,SAAS,MAAM,MAAM,IAAI,KAAA,CAAS;EAClF,QAAQ,OAAO,UAAU,MAAM,OAAO,SAAS,WAAW,KAAK,CAAC;EAChE,WAAW,OAAO,UAAU,MAAM,UAAU,SAAS,WAAW,KAAK,CAAC;CACxE,CAAC;CACD,OAAO,OAAO,OAAO;EACnB;EACA,aAAa,YAAY;GACvB,gBAAgB;GAChB,MAAM,QAAQ,IAAI,CAAC,GAAG,aAAa,CAAC;EACtC;EACA,WAAW,UAAkC,SAAS,cAAc,KAAK;EACzE,cAAc,SAAS,OAAO;CAChC,CAAC;AACH;;AAGA,IAAa,mCAAb,MAAoE;CACrC;CAA7B,YAAY,OAAoC;EAAnB,KAAA,QAAA;CAAoB;CAEjD,YAA2B;EACzB,OAAO,KAAK,YAAY;CAC1B;CAEA,YAA2B;EACzB,OAAO,KAAK,YAAY;CAC1B;CAEA,aAA4B;EAC1B,OAAO,KAAK,YAAY;CAC1B;CAEA,aAA4B;EAC1B,OAAO,KAAK,YAAY;CAC1B;CAEA,cAA6B;EAC3B,OAAO,KAAK,YAAY;CAC1B;CAEA,iBAAgC;EAC9B,OAAO,KAAK,YAAY;CAC1B;CAEA,oBAAmC;EACjC,OAAO,KAAK,YAAY;CAC1B;CAEA,OAAO,GAAG,MAA0E;EAClF,OAAO,KAAK,MAAM,OAAO,GAAG,IAAI;CAClC;CAEA,SAAS,GAAG,MAA8E;EACxF,OAAO,KAAK,MAAM,SAAS,GAAG,IAAI;CACpC;CAEA,MAAM,GAAG,MAAwE;EAC/E,OAAO,KAAK,MAAM,MAAM,GAAG,IAAI;CACjC;CAEA,OAAO,GAAG,MAA0E;EAClF,OAAO,KAAK,MAAM,OAAO,GAAG,IAAI;CAClC;CAEA,OAAO,GAAG,MAA0E;EAClF,OAAO,KAAK,MAAM,OAAO,GAAG,IAAI;CAClC;CAEA,UAAU,GAAG,MAAgF;EAC3F,OAAO,KAAK,MAAM,UAAU,GAAG,IAAI;CACrC;CAEA,cAAsC;EACpC,OAAO,QAAQ,uBAAO,IAAI,MAAM,yDAAyD,CAAC;CAC5F;AACF;;;;ACzDA,eAAsB,8BACpB,UACA,SACwC;CACxC,MAAM,eAAe,iCAAiC,QAAQ;CAC9D,MAAM,mBAAmB,wBACvB,QAAQ,oBAAoB,aAAa,gBAC3C;CACA,IAAI,mBAAmB,aAAa,kBAClC,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,kBAAkB,uBACtB,QAAQ,mBAAmB,aAAa,iBACxC,aAAa,eACf;CACA,IAAI,kBAAkB,aAAa,iBACjC,MAAM,IAAI,MAAM,+DAA+D;CAEjF,IAAI;CACJ,IAAI;EACF,QAAQ,4BAA4B,QAAQ;CAC9C,SAAS,OAAO;EACd,OAAO,wBAAwB,cAAcC,eAAa,KAAK,CAAC;CAClE;CAEA,IAAI;EAGF,MAAM,kCAAkC,KAAK;CAC/C,SAAS,OAAO;EACd,OAAO,MAAM,qBAAqB,UAAU,OAAO,OAAO,UAAU,gBAAgB;CACtF;CAEA,IAAI;CACJ,IAAI;EACF,MAAM,CAAC,eAAe,0BAA0B,MAAM,QAAQ,IAAI,CAChE,+BAA+B,QAAQ,iBAAiB;GACtD,aAAa,MAAM;GACnB,SAAS;GACT,OAAO,MAAM,cAAc;EAC7B,CAAC,GACD,+BAA+B,QAAQ,iBAAiB;GACtD,aAAa,MAAM;GACnB,SAAS;GACT,OAAO,MAAM,uBAAuB;EACtC,CAAC,CACH,CAAC;EACD,sBAAsB,OAAO,OAAO;GAAE;GAAe;EAAuB,CAAC;CAC/E,SAAS,OAAO;EACd,OAAO,MAAM,qBAAqB,UAAU,OAAO,OAAO,UAAU,gBAAgB;CACtF;CAEA,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,QAAQ,WAAW,SAClC,wBAAwB,UAAU,mBAAmB,CACvD;CACF,SAAS,OAAO;EACd,OAAO,MAAM,qBAAqB,UAAU,OAAO,OAAO,UAAU,gBAAgB;CACtF;CACA,IAAI,CAAC,SAAS,UACZ,OAAO,MAAM,qBACX,UACA,uBACA,IAAI,MACF,SAAS,WAAW,uBAChB,8CAA8C,SAAS,WACvD,gDACN,GACA,YACA,gBACF;CAGF,6BAA6B,QAAQ;CACrC,MAAM,kBAAkB,yBAAyB,kBAAkB,eAAe;CAIlF,MAAM,eACJ,SAAS,MAAM,mBACf,yBAAyB,MAAM,kBAAkB,MAAM,eAAe;CACxE,MAAM,sBAAsB,eAAe;CAC3C,IACE,KAAK,IAAI,KAAK,gBACd,eAAe,MAAM,0BACrB,sBAAsB,SAAS,MAAM,aAErC,OAAO,MAAM,qBACX,UACA,OACA,SAAS,OACT,QAAQ,YACR,QAAQ,iCACR,IAAI,MAAM,wEAAwE,GAClF,UACA,kBACA,0BACF;CAEF,IAAI;CACJ,IAAI;EACF,MAAM,YAAY,MAAM,qCAEpB,MAAM,MAAM,OAAO,cAAc;GAC/B,aAAa,MAAM;GACnB,eAAe,MAAM;GACrB,aAAa,MAAM,iBAAiB;GACpC,UAAU,MAAM;GAChB;EACF,CAAC,GACH,KAAK,IAAI,cAAc,yBAAyB,gBAAgB,CAAC,GACjE,4BACF;EACA,aAAa,OAAO,OAAO,EAAE,KAAK,OAAO,OAAO,EAAE,GAAG,UAAU,IAAI,CAAC,EAAE,CAAC;CACzE,SAAS,OAAO;EACd,OAAO,MAAM,qBACX,UACA,OACA,SAAS,OACT,QAAQ,YACR,QAAQ,iBACR,IAAI,MAAM,qCAAqC,EAAE,OAAO,MAAM,CAAC,GAC/D,UACA,kBACA,0BACF;CACF;CAEA,IAAI;CACJ,IAAI,MAAM,OAAO,SAAS,YACxB,IAAI;EACF,MAAM,cAAc,MAAM;EAC1B,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,wCAAwC;EAC1E,MAAM,YAAY,MAAM,qCAEpB,MAAM,MAAM,OAAO,SAAS;GAC1B,aAAa,MAAM;GACnB,eAAe,YAAY;GAC3B,cAAc,YAAY;GAC1B,oBAAoB,YAAY;GAChC;EACF,CAAC,GACH,KAAK,IAAI,cAAc,yBAAyB,gBAAgB,CAAC,GACjE,4BACF;EACA,mBAAmB,OAAO,OAAO,EAAE,KAAK,OAAO,OAAO,EAAE,GAAG,UAAU,IAAI,CAAC,EAAE,CAAC;CAC/E,SAAS,OAAO;EACd,OAAO,MAAM,qBACX,UACA,OACA,SAAS,OACT,QAAQ,YACR,QAAQ,iBACR,IAAI,MAAM,qCAAqC,EAAE,OAAO,MAAM,CAAC,GAC/D,UACA,kBACA,4BACA,UACF;CACF;CAGF,IAAI;CACJ,IAAI;EACF,UAAU,0BAA0B,UAAU,YAAY,gBAAgB,CAAC,CAAC;CAC9E,SAAS,OAAO;EACd,OAAO,MAAM,qBACX,UACA,OACA,SAAS,OACT,QAAQ,YACR,QAAQ,iBACR,OACA,UACA,kBACA,4BACA,YACA,gBACF;CACF;CAEA,IAAI;EAEF,KAAI,MADgB,QAAQ,WAAW,oBAAoB,SAAS,KAAK,EAAA,CAC/D,UAAU,qBAClB,MAAM,IAAI,MAAM,6DAA6D;CAEjF,SAAS,OAAO;EACd,OAAO,MAAM,qBACX,UACA,OACA,SAAS,OACT,QAAQ,YACR,QAAQ,iBACR,IAAI,MAAM,gDAAgD,EAAE,OAAO,MAAM,CAAC,GAC1E,UACA,kBACA,4BACA,YACA,gBACF;CACF;CACA,IAAI,KAAK,IAAI,KAAK,cAChB,OAAO,MAAM,qBACX,UACA,OACA,SAAS,OACT,QAAQ,YACR,QAAQ,iCACR,IAAI,MAAM,wEAAwE,GAClF,UACA,kBACA,WACA,YACA,gBACF;CAGF,MAAM,kBAAkB,2BAA2B,YAAY,gBAAgB;CAC/E,MAAM,iBAAiB,yCACrB,QAAQ,YACR,eACF;CACA,MAAM,iBAAiB,eAAe,SAAS,MAAM,KAAK;CAC1D,MAAM,YAAY,MAAM,mBACtB,QAAQ,UACR,SACA,MAAM,cAAc,SACpB,eAAe,OACf,cACA,gBACF;CACA,iCAAiC,QAAQ;CACzC,MAAM,sBAAsB,yBAAyB,gBAAgB;CAErE,MAAM,eACJ,UAAU,SAAS,aAAa,UAAU,aAAa,SAAS,YAC5D,YACA,UAAU,SAAS,YACjB,cACA;CACR,MAAM,eAAe,qCACb,eAAe,YAAY,GACjC,qBACA,+BACF,CAAC,CAAC,YACO;EAAE,QAAQ;EAAe,OAAO,KAAA;CAAU,KAChD,WAAoB;EAAE,QAAQ;EAAgB;CAAM,EACvD;CACA,MAAM,CAAC,YAAY,aAAa,oBAAoB,MAAM,QAAQ,IAAI;EACpE;EACA,kBAAkB,OAAO,cAAc,mBAAmB;EAC1D,iBAAiB,OAAO,cAAc,mBAAmB;CAC3D,CAAC;CACD,IACE,CAAC,UAAU,kBACX,CAAC,WAAW,UACZ,CAAC,iBAAiB,cAClB,CAAC,YAAY,QACb;EACA,kCAAkC,UAAU,QAAQ;EACpD,OAAO,wBACL,OACA,sBACE,WACE,UAAU,OACV,CAAC,UAAU,iCACP,IAAI,MAAM,6CAA6C,IACvD,KAAA,GACJ,WAAW,OACX,YAAY,OACZ,iBAAiB,UACd,CAAC,iBAAiB,6BAAa,IAAI,MAAM,yBAAyB,IAAI,KAAA,oBACzE,IAAI,MAAM,uEAAuE,CACnF,GACA,eACF,GACA,UAAU,aACV,iBAAiB,YAAY,SAAS,IACxC;CACF;CAEA,IAAI;CACJ,IAAI;EACF,kBAAkB,MAAM,qCAEpB,gCACE,OACA,iBAAiB,YACjB,QAAQ,eACV,GACF,yBAAyB,gBAAgB,GACzC,wCACF;CACF,SAAS,OAAO;EACd,kCAAkC,UAAU,QAAQ;EACpD,OAAO,wBACL,OACA,sBACE,WACE,uBACA,IAAI,MAAM,0EAA0E,CACtF,GACA,eACF,GACA,UAAU,aACV,iBAAiB,WAAW,KAC9B;CACF;CAEA,IAAI;CACJ,MAAM,eACJ,UAAU,SAAS,UAAU,cAAc;CAC7C,IAAI,UAAU,SAAS,SACrB,SAAS,wBACP,OACA,sBAAsBA,eAAa,UAAU,KAAK,GAAG,eAAe,GACpE,UAAU,aACV,iBAAiB,WAAW,KAC9B;MACK,IAAI,CAAC,UAAU,aAAa,aACjC,SAAS,wBACP,OACA,8DACA,UAAU,aACV,iBAAiB,WAAW,KAC9B;MACK;EACL,MAAM,UACJ,UAAU,SAAS,YACf,UAAU,UACV;GACE,aAAa,MAAM;GACnB,aAAa,UAAU;EACzB;EACN,IAAI;GAKF,SAAS,MAAM,8BACb,OAAO,WAAW;IAChB,MAAM,wCACJ,QAAQ,YACR,eAAe,OACf,iBAAiB,UACnB;IACA,MAAM,EAAE,kBAAkB,gBACxB,MAAM,6CACJ,OACA,UAAU,cACV,QAAQ,iBACR,iBACA,MACF;IACF,MAAM,kBAAkB,MAAM,gCAC5B,OACA,QAAQ,aACR,aACA,QAAQ,QACR,QAAQ,iBACR,iBACA,MACF;IACA,OAAO,MAAM,0BACX,OACA,SACA,QAAQ,YACR,gBACA,iBAAiB,YACjB;KACE,cAAc,UAAU;KACxB;KACA;KACA;KACA;KACA,iBAAiB,QAAQ;IAC3B,GACA,iBACA,eAAe,OAAO,GACtB,MACF;GACF,GA9CyB,KAAK,IAC9B,KAAK,IAAI,IAAI,iBACb,SAAS,MAAM,cAAc,0BAA0B,gBAAgB,CA6CtD,GACjB,iCACF;EACF,SAAS,OAAO;GACd,SAAS,wBACP,OACA,sBAAsBA,eAAa,KAAK,GAAG,eAAe,GAC1D,UAAU,aACV,iBAAiB,WAAW,KAC9B;EACF;CACF;CAEA,IAAI;CACJ,IAAI;EACF,WAAW,OAAO,YACd;GACE,QAAQ;GACR,OAAO,iBAAiB,WAAW;GACnC,iBAAiB,OAAO,UAAU;GAClC,aAAa,OAAO,UAAU;GAC9B,iBAAiB,OAAO,UAAU;GAClC,YAAY,OAAO,UAAU;EAC/B,IACA;GACE,QAAQ;GACR;GACA,OAAO,iBAAiB,WAAW;GACnC,iBAAiB,gBAAgB;GACjC,iBAAiB,MAAM,qCAEnB,uBACE,OACA,OAAO,QACP,cACA,UAAU,aACV,QAAQ,eACV,GACF,SAAS,MAAM,aACf,wCACF;EACF;CACN,SAAS,OAAO;EACd,kCAAkC,UAAU,QAAQ;EACpD,OAAO,wBACL,OACA,sBACE,WACE,uBACA,IAAI,MAAM,wEAAwE,CACpF,GACA,eACF,GACA,UAAU,aACV,iBAAiB,WAAW,KAC9B;CACF;CAQA,IAAI,MANmB,YACrB,QAAQ,YACR,SAAS,OACT,UACA,SAAS,MAAM,WACjB,GACc;EACZ,kCAAkC,UAAU,OAAO,YAAY,cAAc,QAAQ;EACrF,OAAO;CACT;CAEA,kCAAkC,UAAU,QAAQ;CACpD,OAAO,wBACL,OACA,8DACA,UAAU,aACV,iBAAiB,WAAW,KAC9B;AACF;AA0BA,eAAe,mBACb,UACA,SACA,iBACA,YACA,cACA,kBAC0B;CAC1B,MAAM,YAAY,QAAQ,WAAW;CACrC,MAAM,eAAe,IAAI,gCAAgC,SAAS;CAClE,IAAI,KAAK,IAAI,KAAK,cAChB,OAAO;EACL,MAAM;EACN,OAAO;EACP,aAAa;GAAE,MAAM;GAAW;EAAU;EAC1C,gBAAgB;CAClB;CAEF,MAAM,aAAa,IAAI,gBAAgB;CACvC,IAAI;CACJ,IAAI,WAAW;CACf,IAAI;CACJ,IAAI;CACJ,MAAM,mBAAmB,QAAQ,QAAQ,CAAC,CAAC,WACzC,SAAS,QAAQ,SAAS;EACxB;EACA,QAAQ,WAAW;EACnB;CACF,CAAC,CACH;CAGA,iBAAsB,YAAY,KAAA,CAAS;CAC3C,MAAM,kBAAkB,IAAI,SAAgB,UAAU,WAAW;EAC/D,QAAQ,iBACA;GACJ,WAAW;GACX,WAAW,MAAM,YAAY;GAC7B,OAAO,YAAY;EACrB,GACA,KAAK,IAAI,GAAG,eAAe,KAAK,IAAI,CAAC,CACvC;CACF,CAAC;CACD,gBAAqB,YAAY,KAAA,CAAS;CAC1C,IAAI;EACF,UAAU,sCACR,MAAM,QAAQ,KAAK,CAAC,kBAAkB,eAAe,CAAC,CACxD;CACF,SAAS,OAAO;EACd,iBAAiB;CACnB;CAEA,IAAI,CAAC,YAAY,WAAW,QAAQ,gBAAgB,QAAQ,aAAa;EACvE,iCAAiB,IAAI,MAAM,2DAA2D;EACtF,UAAU,KAAA;CACZ,OAAO,IAAI,CAAC,YAAY,WAAW,KAAK,IAAI,KAAK,cAAc;EAG7D,WAAW;EACX,iBAAiB;EACjB,UAAU,KAAA;CACZ,OAAO,IAAI,CAAC,YAAY,SAAS,YAAY,SAAS,WAAW;EAC/D,iCAAiB,IAAI,MAAM,6DAA6D;EACxF,UAAU,KAAA;CACZ;CAEA,IAAI,CAAC,WAAW,UAAU,WAAW,MAAM,cAAc;CACzD,MAAM,aAAa,WAAW,YAAY,UAAU,cAAc;CAClE,MAAM,sBAAsB,KAAK,IAAI,IAAI;CACzC,IAAI;EAkBF,8CAA8C,MAjBxB,gCACnB,kBACC,SAAS,KACP;GACE,aAAa,QAAQ;GACrB,qBAAqB,QAAQ,cAAc,MAAM;EACnD,GACA;GACE;GACA,QAAQ;GACR,QAAQ;GACR,cAAc;EAChB,CACF,GACF,qBACA,+BACF,CACqD;CACvD,SAAS,WAAW;EAClB,IAAI;EACJ,IAAI;GACF,MAAM,gBAAgB,UAAU,SAAS,mBAAmB;EAC9D,SAAS,OAAO;GACd,gBAAgB;EAClB;EACA,IAAI,OAAO,aAAa,KAAK;EAC7B,WAAW,MAAM,SAAS;EAC1B,OAAO;GACL,MAAM;GACN,OAAO,IAAI,MAAM,WAAW,gBAAgB,WAAW,aAAa,CAAC;GACrE,GAAI,WAAW,EAAE,aAAa;IAAE,MAAM;IAAW;GAAU,EAAE,IAAI,CAAC;GAClE,gBAAgB;EAClB;CACF;CAEA,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,eAAe,uCACb,MAAM,gCACH,kBACC,SAAS,QACP;GACE,aAAa,QAAQ;GACrB,qBAAqB,QAAQ,cAAc,MAAM;EACnD,GACA;GACE;GACA,QAAQ;EACV,CACF,GACF,qBACA,kCACF,GACA,eACF;CACF,SAAS,cAAc;EACrB,oBAAoB;CACtB;CAEA,IAAI;CACJ,IAAI;EACF,MAAM,gBAAgB,UAAU,SAAS,mBAAmB;CAC9D,SAAS,cAAc;EACrB,gBAAgB;CAClB;CACA,IAAI,qBAAqB,iBAAiB,CAAC,cAAc;EACvD,IAAI,OAAO,aAAa,KAAK;EAC7B,WAAW,MAAM,qBAAqB,aAAa;EACnD,OAAO;GACL,MAAM;GACN,OAAO,IAAI,MAAM,WAAW,gBAAgB,mBAAmB,aAAa,CAAC;GAC7E,GAAI,WAAW,EAAE,aAAa;IAAE,MAAM;IAAW;GAAU,EAAE,IAAI,CAAC;GAClE,gBAAgB;EAClB;CACF;CAEA,IAAI,KAAK,IAAI,KAAK,cAAc;EAC9B,WAAW;EACX,iBAAiB;EACjB,UAAU,KAAA;EACV,WAAW,MAAM,YAAY;CAC/B;CACA,IAAI,OAAO,aAAa,KAAK;CAE7B,IAAI,UACF,OAAO;EACL,MAAM;EACN,aAAa;GAAE,MAAM;GAAW;EAAU;EAC1C;EACA,gBAAgB;CAClB;CAEF,IAAI,kBAAkB,CAAC,SACrB,OAAO;EACL,MAAM;EACN,OAAO,kCAAkB,IAAI,MAAM,wCAAwC;EAC3E;EACA,gBAAgB;CAClB;CAEF,OAAO;EACL,MAAM;EACN;EACA,aAAa,QAAQ;EACrB;EACA,gBAAgB;CAClB;AACF;AAEA,eAAe,gBACb,UACA,SACA,qBACe;CACf,MAAM,UAAU,SAAS;CACzB,IAAI,CAAC,SAAS;CACd,MAAM,WAAW,MAAM,gCACpB,kBACC,QAAQ,KACN,UACA;EACE,aAAa,QAAQ;EACrB,qBAAqB,QAAQ,cAAc,MAAM;CACnD,GACA,EAAE,QAAQ,cAAc,CAC1B,GACF,qBACA,uCACF;CACA,IAAI,UAAU,aAAa,QAAQ,OAAO,KAAK,QAAQ,CAAC,CAAC,MAAM,QAAQ,QAAQ,UAAU,GACvF,MAAM,IAAI,MAAM,0DAA0D;AAE9E;AAEA,eAAe,qBACb,UACA,OACA,OACA,QACA,kBACwC;CACxC,iCAAiC,QAAQ;CACzC,MAAM,sBAAsB,yBAAyB,gBAAgB;CACrE,MAAM,CAAC,aAAa,WAAW,MAAM,QAAQ,IAAI,CAC/C,kBAAkB,OAAO,QAAQ,mBAAmB,GACpD,iBAAiB,OAAO,QAAQ,mBAAmB,CACrD,CAAC;CACD,MAAM,gBAAgB,YAAY,UAAU,QAAQ,eAAe,KAAA;CACnE,kCAAkC,UAAU,gBAAgB,WAAW,gBAAgB;CACvF,OAAO,wBACL,OACA,sBACE,WACE,OACA,YAAY,OACZ,QAAQ,OACR,CAAC,gCACG,IAAI,MAAM,2EAA2E,IACrF,KAAA,CACN,GACA,CAAC,CACH,GACA,KAAA,GACA,QAAQ,YAAY,SAAS,IAC/B;AACF;AAEA,eAAe,qBACb,UACA,OACA,OACA,YACA,iBACA,OACA,QACA,kBACA,cACA,YACA,kBACwC;CACxC,iCAAiC,QAAQ;CACzC,MAAM,sBAAsB,yBAAyB,gBAAgB;CACrE,MAAM,CAAC,aAAa,WAAW,MAAM,QAAQ,IAAI,CAC/C,kBAAkB,OAAO,QAAQ,mBAAmB,GACpD,iBAAiB,OAAO,QAAQ,mBAAmB,CACrD,CAAC;CACD,MAAM,kBAAkB,2BAA2B,YAAY,gBAAgB;CAC/E,MAAM,aAAa,sBACjB,WAAW,OAAO,YAAY,OAAO,QAAQ,KAAK,GAClD,eACF;CACA,IAAI,eAAe;CACnB,IAAI;CACJ,IAAI,QAAQ,cAAc,YAAY,QACpC,IAAI;EACF,MAAM,kBAAkB,MAAM,qCACtB,gCAAgC,OAAO,QAAQ,YAAa,eAAe,GACjF,MAAM,aACN,gDACF;EACA,MAAM,kBAAkB,MAAM,qCACtB,uBAAuB,OAAO,YAAY,cAAc,KAAA,GAAW,eAAe,GACxF,MAAM,aACN,gDACF;EACA,eAAe,CAAE,MAAM,YACrB,YACA,OACA;GACE,QAAQ;GACR;GACA,OAAO,QAAQ,WAAW;GAC1B,iBAAiB,gBAAgB;GACjC;EACF,GACA,MAAM,WACR;CACF,SAAS,kBAAkB;EACzB,eAAe;EACf,qBAAqB;CACvB;CAEF,kCAAkC,UAAU,QAAQ;CACpD,OAAO,wBACL,OACA,sBACE,WACE,YACA,oBACA,YAAY,OACZ,QAAQ,OACR,CAAC,YAAY,UAAU,CAAC,QAAQ,6BAC5B,IAAI,MAAM,uEAAuE,IACjF,KAAA,GACJ,+BACI,IAAI,MAAM,4DAA4D,IACtE,KAAA,CACN,GACA,eACF,GACA,KAAA,GACA,QAAQ,YAAY,SAAS,IAC/B;AACF;AAEA,eAAe,kBACb,OACA,QACA,qBACkF;CAClF,IAAI,MAAM,OAAO,SAAS,YAAY,OAAO,EAAE,QAAQ,KAAK;CAC5D,IAAI;EACF,MAAM,cAAc,MAAM;EAC1B,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,wCAAwC;EAC1E,MAAM,SAAS,MAAM,qCAEjB,MAAM,MAAM,OAAO,MAAM;GACvB,aAAa,MAAM;GACnB,eAAe,YAAY;GAC3B,cAAc,YAAY;GAC1B,oBAAoB,YAAY;GAChC;EACF,CAAC,GACH,qBACA,yBACF;EACA,IAAI,OAAO,WAAW,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,QAAQ,QAAQ,QAAQ,GAC9E,MAAM,IAAI,MAAM,oDAAoD;EAEtE,OAAO,EAAE,QAAQ,KAAK;CACxB,SAAS,OAAO;EACd,OAAO;GAAE,QAAQ;GAAO;EAAM;CAChC;AACF;AAEA,eAAe,iBACb,OACA,QACA,qBAIC;CACD,IAAI;EAaF,OAAO,EACL,YAAY,kCAAkC,MAb5B,qCAEhB,MAAM,MAAM,OAAO,YAAY;GAC7B,aAAa,MAAM;GACnB,eAAe,MAAM;GACrB,aAAa,MAAM,iBAAiB;GACpC,UAAU,MAAM;GAChB;EACF,CAAC,GACH,qBACA,4BACF,GAEuD;GACnD,eAAe,MAAM;GACrB,aAAa,MAAM,iBAAiB;GACpC,OAAO,MAAM,cAAc;EAC7B,CAAC,EACH;CACF,SAAS,OAAO;EACd,OAAO,EAAE,OAAO,IAAI,MAAM,qCAAqC,EAAE,OAAO,MAAM,CAAC,EAAE;CACnF;AACF;AAEA,eAAe,YACb,OACA,OACA,UACA,cACkB;CAClB,IAAI;EACF,MAAM,SAAS,MAAM,qCACb,MAAM,cAAc,OAAO,QAAQ,GACzC,gBAAgB,MAAM,aACtB,4BACF;EACA,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,aAAa,OAAO;EAClD,MAAM,SAAS,MAAM,qCACb,MAAM,OAAO,OAAO,OAAO,SAAS,cAAc,GACxD,gBAAgB,MAAM,aACtB,gCACF;EACA,OAAO,OAAO,YAAY,OAAO;CACnC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAe,uBACb,OACA,QACA,cACA,aACA,iBACA;CACA,MAAM,QAAQ,wBAAwB;EACpC,MAAM;EACN,aAAa,MAAM;EACnB,cAAc,MAAM,OAAO;EAC3B,qBAAqB,MAAM,cAAc,MAAM;EAC/C;EACA;EACA,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;CACvC,CAAC;CACD,OAAO,MAAM,+BAA+B,iBAAiB;EAC3D,aAAa,MAAM;EACnB,SAAS;EACT;CACF,CAAC;AACH;AAEA,SAAS,2BACP,YACA,kBACU;CACV,OAAO,CAAC,GAAG,OAAO,OAAO,YAAY,OAAO,CAAC,CAAC,GAAG,GAAG,OAAO,OAAO,kBAAkB,OAAO,CAAC,CAAC,CAAC;AAChG;AAEA,SAAS,WAAW,GAAG,QAA2B;CAChD,OAAO,OACJ,QAAQ,UAAU,UAAU,KAAA,CAAS,CAAC,CACtC,IAAIA,cAAY,CAAC,CACjB,KAAK,IAAI;AACd;AAEA,SAASA,eAAa,OAAwB;CAC5C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,IAAM,kCAAN,cAA8C,MAAM;CAClD,YAAY,WAAmB;EAC7B,MAAM,0CAA0C,UAAU,YAAY;EACtE,KAAK,OAAO;CACd;AACF;;;ACv6BA,MAAM,yBAAyB,KAAK;AACpC,MAAM,0BAA0B,IAAI;;AASpC,eAAsB,+BACpB,WACA,MACA,OACA,UAAiD,CAAC,GACR;CAC1C,MAAM,mBAAmB,wBAAwB,QAAQ,gBAAgB;CAEzE,4BADsB,0BAA0B,SACR,CAAC,CAAC,OAAO,KAAK;CACtD,MAAM,SAAS,UAAU;CACzB,IAAI,KAAK,QAAQ,iBAAiB,OAAO,QACvC,MAAM,IAAI,MAAM,6DAA6D;CAE/E,MAAM,gBAAgB,KAAK;CAC3B,MAAM,UAAU;EACd,QAAQ,KAAK,QAAQ;EACrB,aAAa,cAAc,QAAQ;EACnC,aAAa,cAAc,QAAQ;CACrC;CACA,gBAAgB,MAAM,OAAO,UAAU,mBAAmB;CAC1D,MAAM,kBAAkB,uBACtB,QAAQ,iBACR,cAAc,OAAO,SACvB;CAMA,MAAM,sBALgB,gCACpB,cAAc,OAAO,WACrB,kBACA,eAEsC,IAAI;CAC5C,IAAI,sBAAA,YACF,MAAM,IAAI,MAAM,gEAAgE;CAElF,+BAA+B,IAAI;CAEnC,MAAM,mBAAmB,OAAO,KAAK,cAAc,aAAa,MAAM;CAEtE,MAAM,gBAAgB,MAAM,iCAC1B,cAAc,WACd,MAAM,SACR;CACA,MAAM,MAAM,WAAW,YAAY;EACjC,MAAM;EACN,UAAU,cAAc;EACxB,SAAS,cAAc;EACvB,aAAa,KAAK,aAAa;CACjC,CAAC;CACD,MAAM,4BAA4B,KAAK,aAAa,UAAU,cAAc,UAAU,UAAU,EAC9F,6BAA6B,CAAC,QAAQ,UAAU,EAClD,CAAC;CACD,IAAI,cAAc,YAChB,MAAM,mBAAmB,KAAK,aAAa,UAAU,cAAc,UAAU;CAE/E,MAAM,oBAAoB,MAAM,+BAC9B,KAAK,aAAa,UAClB,cAAc,UAAU,UACxB,EAAE,6BAA6B,CAAC,QAAQ,UAAU,EAAE,CACtD;CAEA,IAAI;CACJ,IAAI;CAGJ,IAAI,OAAO,UAAU,WAAW;EAC9B,IAAI,CAAC,KAAK,aAAa,iBAAiB,CAAC,KAAK,eAAe,eAC3D,MAAM,IAAI,MAAM,wEAAwE;EAE1F,mBAAmB,MAAM,sBAAsB,WAAW,OAAO,UAAU,UAAU,OAAO;EAC5F,MAAM,MAAM,WAAW,YAAY;GACjC,MAAM;GACN,UAAU,OAAO,UAAU;GAC3B,SAAS;GACT,aAAa,KAAK,aAAa;EACjC,CAAC;EACD,MAAM,4BACJ,KAAK,aAAa,eAClB,OAAO,UAAU,UAAU,QAC7B;EACA,yBAAyB,MAAM,+BAC7B,KAAK,aAAa,eAClB,OAAO,UAAU,UAAU,QAC7B;CACF,OAAO,IAAI,KAAK,aAAa,iBAAiB,KAAK,eAAe,eAChE,MAAM,IAAI,MAAM,yDAAyD;CAG3E,MAAM,qBAAqB,KAAK,aAAa,WAAW;CACxD,MAAM,uBAAuB,qCAAqC;EAChE,SAAS,OAAO;EAChB,SAAS,OAAO,UAAU;EAC1B,QAAQ,OAAO,UAAU;EACzB,WAAW,OAAO,UAAU,IAAI;EAChC,YAAY,KAAK;EACjB,mBAAmB,6BAA6B,SAAS;CAC3D,CAAC;CACD,MAAM,qBAAqB,iCACzB,sBACA,KAAK,aAAa,aAClB,OAAO,UAAU,IAAI,SACvB;CACA,MAAM,mCACJ,KAAK,aAAa,aAClB,mBAAmB,kBAAkB,YAAY,QACnD;CACA,MAAM,mBAAmB,MAAM,qBAC7B,mBAAmB,kBAAkB,YAAY,UACjD,MAAM,SACR;CACA,IACE,CAAC,OAAO,KAAK,gBAAgB,CAAC,CAAC,OAC7B,OAAO,KACL,wBAAwB,mBAAmB,kBAAkB,YAAY,QAAQ,CACnF,CACF,GAEA,MAAM,IAAI,MAAM,iEAAiE;CAEnF,MAAM,oBAAoB,mBAAmB;CAE7C,MAAM,YAAY,MAAM,iBAAiB,WAAW,MAAM,KAAK;CAC/D,MAAM,gBAAgB,MAAM,aAAa,WAAW,MAAM,KAAK;CAC/D,MAAM,gBAAgB,yBAAyB,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CACnF,MAAM,yBAAyB,KAAK,IAAI,IAAI,KAAK,IAAI,wBAAwB,mBAAmB;CAChG,MAAM,mBAAmB,MAAM,qCAE3B,MAAM,OAAO,aAAa;EACxB,aAAa,KAAK;EAClB;EACA,aAAa;EACb;EACA,cAAc,OAAO;EACrB,UAAU;EACV,QAAQ,YAAY,cAAc,MAAM;CAC1C,CAAC,GACH,yBAAyB,gBAAgB,GACzC,6BACF;CACA,IAAI;CACJ,IAAI;EACF,kCACE,kBACA,cAAc,QACd,eACA,sBACF;EACA,iBAAiB,MAAM,cACrB,WACA,MACA,OACA,eACA,wBACA,gBACF;EACA,MAAM,SAAS,eAAe;EAC9B,MAAM,YAAY,MAAM,+BAA+B,WAAW,OAAO,KAAK,QAAQ,GAAG;EACzF,MAAM,iBAAiB,YACnB,iCACE,KAAK,eAAe,UACpB,UAAU,oBAAoB,KAAA,CAChC,IACA,KAAA;EACJ,MAAM,aAAa,YAAY,WAAW,MAAM,mBAAmB,KAAK;EACxE,MAAM,YAAY,uBAChB,OAAO,UAAU,OAAO,CAAC,GACzB,mBAAmB,KACnB,OAAO,UAAU,oBAAoB,SAAS,cAC1C,GACG,OAAO,UAAU,oBAAoB,MAAM;GAC1C,MAAM;GACN,OAAO,OAAO,UAAU,oBAAoB;EAC9C,EACF,IACA,CAAC,GACL,iBACI;IACG,+BAA+B;IAC9B,MAAM;IACN,OAAO,eAAe;GACxB;GACA,GAAI,eAAe,kBACf,GACG,2CAA2C;IAC1C,MAAM;IACN,OAAO,eAAe;GACxB,EACF,IACA,CAAC;EACP,IACA,CAAC,CACP;EACA,MAAM,SAAS,YAAY,OAAO,SAAS,cAAc,MAAM,SAAS;EACxE,MAAM,oBAAyD;GAC7D,MAAM;GACN,SAAS,KAAK;GACd,aAAa,KAAK;GAClB,YAAY;IACV,UAAU,KAAK,eAAe;IAC9B,GAAI,KAAK,eAAe,gBACpB,EAAE,eAAe,KAAK,eAAe,cAAc,IACnD,CAAC;GACP;GACA,UAAU,OAAO,KAAK;GACtB,GAAI,OAAO,UAAU,YAAY,EAAE,oBAAoB,OAAO,UAAU,UAAU,IAAI,CAAC;GACvF,SAAS,mBAAmB;GAC5B,SAAS,OAAO,UAAU;GAC1B,gBAAgB,OAAO,UAAU;GACjC,qBAAqB,OAAO,UAAU;GACtC,QAAQ,cAAc;GACtB;GACA,OAAO;IACL,QAAQ;IACR,UAAU;IACV,QAAQ;KACN,MAAM;KACN,aAAa,iBAAiB;KAC9B,SAAS,iBAAiB;IAC5B;IACA;GACF;GACA,QAAQ;IACN,YAAY,WAAW;IACvB,MAAM,WAAW;IACjB,KAAK;IACL,KAAK,OAAO,UAAU;GACxB;GACA,GAAI,OAAO,YAAY,EAAE,yBAAyB,OAAO,UAAU,SAAS,OAAO,IAAI,CAAC;GACxF;GACA,SAAS,EAAE,MAAM,WAAW;EAC9B;EACA,0CAA0C,MAAM,iBAAiB;EACjE,MAAM,iBAAiB,wBAAwB,iBAAiB;EAChE,MAAM,kBAAkBC,2BAAyB,iBAAiB;EAClE,IAAI,YAAY,cAAc,MAAM,iBAClC,MAAM,IAAI,MAAM,+CAA+C;EAEjE,MAAM,gBACJ,0CAA0C,MAAM;GAC9C,MAAM;GACN,QAAQ;GACR,UAAU;GACV,UAAU,0BAA0B,cAAc;EACpD,CAAC;EAEH,MAAM,aAAa,2BAA2B,SAAS;EACvD,MAAM,yBAAyB,2BAC7B;GACE,MAAM;GACN,iBAAiB;GACjB,cAAc,OAAO;GACrB,WAAW;IACT,OAAO;KACL,QAAQ,KAAK,eAAe;KAC5B,UAAU,0BACR,wBAAwB,mBAAmB,KAAK,cAAc,CAAC,CACjE;IACF;IACA,MAAM;KACJ,QAAQ,cAAc;KACtB,UAAU,0BACR,wBAAwB,mBAAmB,aAAa,CAAC,CAC3D;IACF;GACF;GACA;GACA;GACA,GAAI,OAAO,UAAU,YAAY,EAAE,oBAAoB,OAAO,UAAU,UAAU,IAAI,CAAC;GACvF,UAAU,OAAO,KAAK;GACtB,GAAI,UAAU,mBAAmB,EAAE,kBAAkB,UAAU,iBAAiB,IAAI,CAAC;GACrF,SAAS,OAAO,UAAU;GAC1B,gBAAgB,OAAO,UAAU;GACjC;GACA;GACA,GAAI,OAAO,YAAY,EAAE,yBAAyB,OAAO,UAAU,SAAS,OAAO,IAAI,CAAC;GACxF,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACrC,CACF;EACA,2CAA2C,MAAM,uBAAuB,KAAK;EAE7E,MAAM,aAAa,GAAG,KAAK,YAAY,WAAW,QAAQ,OAAO,GAAGA,2BAAyB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE;EAC3H,MAAM,YAAY;IACf,qBAAqB,cAAc,KAAK;IACxC,qBAAqB,eAAe,OAAO;IAC3C,qBAAqB,sBAAsB,cAAc;IACzD,qBAAqB,+BAA+B,uBAAuB;EAC9E;EACA,MAAM,WAAW;IACd,oBAAoB,cAAc,KAAK;IACvC,oBAAoB,eAAe,OAAO;IAC1C,oBAAoB,sBAAsB,cAAc;IACxD,oBAAoB,+BAA+B,uBAAuB;IAC1E,oBAAoB,aAAa;EACpC;EACA,0BAA0B,WAAW,QAAQ;EAE7C,OAAO,iCAAiC;GACtC;GACA;GACA,gBAAgB,KAAK;GACrB;GACA,aAAa,KAAK;GAClB,OAAO;IACL,WAAW,EAAE,GAAG,KAAK,eAAe;IACpC,SAAS,EAAE,GAAG,KAAK,aAAa;GAClC;GACA,aAAa;IACX,OAAO,mBAAmB,kBAAkB;IAC5C,OAAO;IACP,SAAS,CAAC,GAAG,mBAAmB,YAAY,UAAU;GACxD;GACA;GACA,eAAe;IAAE,OAAO;IAAe,OAAO;GAAe;GAC7D;GACA,QAAQ;IACN,YAAY,WAAW;IACvB,MAAM,WAAW,KAAK,KAAK,UAAU,MAAM,KAAK;IAChD,KAAK,wBAAwB,SAAS;IACtC,OAAO,mBAAmB,MAAM,KAAK,UAAU,MAAM,KAAK;IAC1D,KAAK,qBAAqB,OAAO,UAAU,KAAK,KAAK,cAAc;GACrE;GACA,aAAa;IACX,OAAO,WAAW,KAAK,gBAAgB;IACvC,UAAU,OAAO,UAAU;GAC7B;GACA;GACA;GACA;GACA;GACA;GACA,kBAAkB;IAChB,eAAe,iBAAiB;IAChC,QAAQ,iBAAiB;IACzB,aAAa,iBAAiB;IAC9B,gBAAgB,iBAAiB;IACjC,SAAS,iBAAiB;GAC5B;GACA,gBAAgB;IACd,WAAW;IACX,GAAI,yBAAyB,EAAE,gBAAgB,uBAAuB,IAAI,CAAC;IAC3E,cAAc,0BACZ,qBAAqB,OACrB,mBAAmB,kBAAkB,YAAY,SAAS,KAC5D;GACF;GACA,GAAI,eAAe,gBAAgB,eAAe,MAAM,SAAS,aAC7D,EACE,mBAAmB;IACjB;IACA,cAAc,eAAe;IAC7B,aAAa;IACb,oBAAoB,eAAe,MAAM;GAC3C,EACF,IACA,CAAC;GACL,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;GACjC,OAAO;IAAE,OAAO;IAAY,MAAM;IAAW,KAAK;GAAS;GAC3D;EACF,CAAC;CACH,SAAS,OAAO;EACd,MAAM,sBAAsB,yBAAyB,gBAAgB;EACrE,MAAM,UAAmC,CAAC;EAC1C,IAAI,gBAAgB,MAAM,SAAS,YAAY;GAC7C,MAAM,eAAe,eAAe;GACpC,MAAM,qBAAqB,eAAe,MAAM;GAChD,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,wDAAwD;GAC3F,QAAQ,KACN,+BACE,YAAY;IACV,MAAM,SAAS,MAAM,MAAM,OAAO,MAAM;KACtC,aAAa,KAAK;KAClB;KACA;KACA;KACA,QAAQ;IACV,CAAC;IACD,IAAI,OAAO,WAAW,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,QAAQ,QAAQ,QAAQ,GAC9E,MAAM,IAAI,MAAM,yDAAyD;GAE7E,GACA,qBACA,mCACF,CACF;EACF;EACA,QAAQ,KACN,+BACE,YAAY;GAeV,IAdmB,kCACjB,MAAM,MAAM,OAAO,YAAY;IAC7B,aAAa,KAAK;IAClB;IACA,aAAa,iBAAiB;IAC9B,UAAU;IACV,QAAQ;GACV,CAAC,GACD;IACE;IACA,aAAa,iBAAiB;IAC9B,OAAO,cAAc;GACvB,CAEW,CAAC,CAAC,MAAM,eAAe,GAClC,MAAM,IAAI,MAAM,sDAAsD;EAE1E,GACA,qBACA,kCACF,CACF;EAEA,MAAM,iBAAgB,MADO,QAAQ,WAAW,OAAO,EAAA,CAEpD,QAAQ,WAA4C,OAAO,WAAW,UAAU,CAAC,CACjF,KAAK,WAAW,OAAO,MAAM;EAChC,IAAI,cAAc,SAAS,GACzB,MAAM,IAAI,MACR,qEAAqE,cAAc,IAAI,YAAY,CAAC,CAAC,KAAK,IAAI,KAC9G,EAAE,OAAO,MAAM,CACjB;EAEF,MAAM;CACR;AACF;AAEA,SAAS,4BACP,UACA,WACM;CACN,IACE,SAAS,cAAc,UAAU,aACjC,SAAS,iBAAiB,UAAU,cAEpC,MAAM,IAAI,MACR,kFACF;AAEJ;AAEA,SAAS,gBACP,MACA,UACM;CACN,MAAM,gBAAgB,kCAAkC,MAAM,KAAK,IAAI;CACvE,MAAM,iBAAiB,mCAAmC,MAAM,KAAK,cAAc;CACnF,MAAM,UAAU,4BAA4B,MAAM,KAAK,OAAO;CAC9D,MAAM,kBAA2C;EAC/C,CAAC,eAAe,KAAK,WAAW;EAChC,CAAC,aAAa,cAAc,UAAU,IAAI;EAC1C,CAAC,oBAAoB,cAAc,UAAU,OAAO;EACpD,CAAC,UAAU,cAAc,SAAS,EAAE;CACtC;CACA,IAAI,cAAc,QAAQ,SAAS,eAAe,CAAC,cAAc,YAC/D,MAAM,IAAI,MAAM,qDAAqD;CAEvE,IAAI,cAAc,YAChB,gBAAgB,KACd,CAAC,uBAAuB,cAAc,WAAW,QAAQ,GACzD,CAAC,4BAA4B,cAAc,WAAW,YAAY,CACpE;CAEF,KAAK,MAAM,CAAC,MAAM,UAAU,iBAC1B,IAAI,CAAC,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,KAAK,mBAAmB;CAEhE,IAAI,CAAC,2BAA2B,KAAK,KAAK,WAAW,GACnD,MAAM,IAAI,MAAM,4DAA4D;CAE9E,IAAI,CAAC,cAAc,eAAe,CAAC,oBAAoB,cAAc,WAAW,GAC9E,MAAM,IAAI,MAAM,wDAAwD;CAE1E,IACEA,2BAAyB,mBAAmB,aAAa,CAAC,MAAM,cAAc,UAC9EA,2BAAyB,mBAAmB,cAAc,CAAC,MAAM,eAAe,UAChFA,2BAAyB,mBAAmB,OAAO,CAAC,MAAM,QAAQ,QAElE,MAAM,IAAI,MAAM,8DAA8D;CAEhF,MAAM,YAAY,QAAQ,YAAY,eAAe,OAAO,QAAQ;CACpE,IACE,QAAQ,gBAAgB,eAAe,UACvC,QAAQ,eAAe,cAAc,UACrC,eAAe,YAAY,QAAQ,eAAe,cAAc,UAChE,QAAQ,cAAc,eAAe,QACrC,eAAe,MAAM,eAAe,QAAQ,QAC5C,QAAQ,UAAU,cAAc,QAAQ,aAExC,MAAM,IAAI,MAAM,oEAAoE;CAEtF,mBAAmB,MAAM,cAAc,UAAU,WAAW;CAC5D,oCAAoC,MAAM,cAAc,OAAO;CAC/D,8CAA8C,MAAM,cAAc,SAAS;CAC3E,oCAAoC,MAAM,cAAc,MAAM;CAC9D,IAAI,cAAc,YAAY;EAC5B,IAAI,CAAC,kCAAkC,KAAK,cAAc,WAAW,UAAU,GAC7E,MAAM,IAAI,MAAM,yDAAyD;EAE3E,IAAI,CAAC,kCAAkC,KAAK,cAAc,WAAW,QAAQ,GAC3E,MAAM,IAAI,MAAM,uDAAuD;EAEzE,IAAI,cAAc,WAAW,WAAW,WAAW,cAAc,WAAW,SAAS,QACnF,MAAM,IAAI,MAAM,6CAA6C;CAEjE;CACA,KAAK,MAAM,CAAC,MAAM,SAAS;EACzB,CAAC,uBAAuB,KAAK,eAAe,QAAQ;EACpD,CAAC,4BAA4B,KAAK,eAAe,aAAa;EAC9D,CAAC,qBAAqB,KAAK,aAAa,QAAQ;EAChD,CAAC,0BAA0B,KAAK,aAAa,aAAa;EAC1D,CAAC,wBAAwB,KAAK,aAAa,WAAW;CACxD,GAAY;EACV,IAAI,SAAS,KAAA,GAAW;EAIxB,IAAI,EAHc,KAAK,WAAW,WAAW,IACzC,MAAM,WAAW,IAAI,KAAK,MAAM,UAAU,IAAI,MAAM,OACpD,WAAW,IAAI,KAAKC,QAAgB,IAAI,MAAM,OAClC,MAAM,IAAI,MAAM,GAAG,KAAK,mCAAmC;CAC7E;CACA,IACE,CAAC,OAAO,UAAU,QAAQ,OAAO,KACjC,CAAC,OAAO,UAAU,cAAc,QAAQ,WAAW,KACnD,QAAQ,UAAU,KAClB,QAAQ,UAAU,cAAc,QAAQ,eACvC,cAAc,QAAQ,gBAAgB,UAAU,cAAc,QAAQ,gBAAgB,GAEvF,MAAM,IAAI,MAAM,gCAAgC;CAElD,MAAM,SAAS,cAAc;CAC7B,IACE,CAAC,OAAO,UAAU,OAAO,SAAS,KAClC,OAAO,aAAa,KACpB,OAAO,YAAA,cACP,CAAC,OAAO,UAAU,OAAO,QAAQ,KACjC,OAAO,YAAY,KACnB,CAAC,OAAO,UAAU,OAAO,aAAa,KACtC,OAAO,gBAAgB,KACvB,CAAC,OAAO,UAAU,OAAO,cAAc,KACvC,OAAO,iBAAiB,KACxB,CAAC,OAAO,UAAU,OAAO,eAAe,KACxC,OAAO,kBAAkB,KACzB,CAAC,OAAO,SAAS,OAAO,UAAU,KAClC,OAAO,aAAa,GAEpB,MAAM,IAAI,MAAM,mCAAmC;CAErD,WAAW,OAAO,YAAY,iBAAiB;CAC/C,IAAI,CAAC,cAAc,MAAM,UAAU,KAAK,GACtC,MAAM,IAAI,MAAM,2CAA2C;CAE7D,IAAI,CAAC,cAAc,OAAO,KAAK,KAAK,KAAK,CAAC,cAAc,OAAO,QAAQ,KAAK,GAC1E,MAAM,IAAI,MAAM,uDAAuD;CAEzE,IACE,CAAC,OAAO,UAAU,cAAc,OAAO,SAAS,UAAU,KAC1D,cAAc,OAAO,SAAS,cAAc,GAE5C,MAAM,IAAI,MAAM,uDAAuD;CAEzE,mBAAmB,MAAM,cAAc,OAAO,SAAS,MAAM;CAC7D,IAAI,cAAc,wBAAwB;EACxC,IACE,cAAc,uBAAuB,WAAW,8BAChD,CAAC,cAAc,uBAAuB,MAAM,KAAK,KACjD,CAAC,cAAc,uBAAuB,SAAS,GAAG,KAAK,KACvD,CAAC,cAAc,uBAAuB,SAAS,aAAa,KAAK,GAEjE,MAAM,IAAI,MAAM,iDAAiD;EAEnE,mBAAmB,MAAM,cAAc,uBAAuB,WAAW;EACzE,mBAAmB,MAAM,cAAc,uBAAuB,cAAc;EAC5E,8BAA8B,MAAM;GAClC,OAAO,cAAc,uBAAuB;GAC5C,aAAa,cAAc,uBAAuB;EACpD,CAAC;CACH;CACA,IAAI,SAAS,SAAS,aAElB;MAAA,sBAAsB,KAAK,eAAe,UAAU,SAAS,IAAI,KAChE,KAAK,eAAe,kBAAkB,KAAA,KACrC,sBAAsB,KAAK,eAAe,eAAe,SAAS,IAAI,GAExE,MAAM,IAAI,MAAM,gEAAgE;CAAA;AAGtF;AAEA,SAAS,sBAAsB,MAAc,OAAwB;CACnE,MAAM,IAAI,MAAM,UAAU,IAAI;CAC9B,MAAM,IAAI,MAAM,UAAU,KAAK;CAC/B,OACE,MAAM,KAAK,EAAE,WAAW,MAAM,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,MAAM,MAAM,MAAM,GAAG,EAAE,EAAE;AAEhG;AAEA,SAAS,+BAA+B,MAAyC;CAC/E,MAAM,QAAQ;EACZ,KAAK,aAAa;EAClB,KAAK,aAAa;EAClB,KAAK,aAAa;CACpB,CAAC,CACE,QAAQ,UAA2B,UAAU,KAAA,CAAS,CAAC,CACvD,KAAK,UAAUA,QAAgB,KAAK,CAAC;CACxC,KAAK,IAAI,OAAO,GAAG,OAAO,MAAM,QAAQ,QACtC,KAAK,IAAI,QAAQ,OAAO,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACxD,MAAM,IAAI,MAAM;EAChB,MAAM,IAAI,MAAM;EAChB,IAAI,KAAK,MAAM,MAAM,KAAK,gBAAgB,GAAG,CAAC,KAAK,gBAAgB,GAAG,CAAC,IACrE,MAAM,IAAI,MAAM,kEAAkE;CAEtF;AAEJ;AAEA,SAAS,gBAAgB,QAAgB,OAAwB;CAC/D,MAAM,OAAO,SAAS,QAAQ,KAAK;CACnC,OAAO,SAAS,MAAM,CAAC,KAAK,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI;AAClE;AAEA,eAAe,qBAAqB,MAA6B;CAC/D,MAAM,QAAQ,MAAM,MAAM,IAAI;CAC9B,IAAI,CAAC,MAAM,YAAY,KAAK,MAAM,eAAe,GAC/C,MAAM,IAAI,MAAM,+CAA+C;CAEjE,KAAK,MAAM,QAAQ,IAAI,EAAA,CAAG,WAAW,GACnC,MAAM,IAAI,MAAM,2DAA2D;AAE/E;AAEA,eAAe,iBACb,WACA,MACA,OAC0C;CAC1C,MAAM,cAAc,UAAU,OAAO,UAAU;CAC/C,MAAM,yBAAyB,KAAK,KAAK;CACzC,MAAM,SAAS,YAAY,SAAS,qBAAqB,YAAY,YAAY,KAAA;CACjF,IAAI,YAAY,SAAS,8BAA8B,CAAC,wBACtD,MAAM,IAAI,MAAM,2EAA2E;CAE7F,IAAI,YAAY,SAAS,sBAAsB,wBAC7C,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,WAAW,MAAM,MAAM,WAAW,QAAQ;EAC9C,WAAW;EACX;CACF,CAAC;CACD,IAAI,SAAS,WAAW,YAAY,MAAM,MAAM,IAAI,MAAM,mCAAmC;CAC7F,IAAI,WAAW,SAAS,UAAU,OAAO,SAAS,SAAS,gBAAgB,OAAO,cAChF,MAAM,IAAI,MAAM,oEAAoE;CAEtF,IACE,0BACAD,2BAAyB,QAAQ,MAAMA,2BAAyB,sBAAsB,GAEtF,MAAM,IAAI,MAAM,uEAAuE;CAEzF,OAAO;AACT;AAEA,eAAe,aACb,WACA,MACA,OACsC;CACtC,MAAM,QAAQ,UAAU,OAAO,QAAQ;CACvC,MAAM,WAAW,KAAK,KAAK;CAC3B,IAAI,OAAO,YAAY,KAAA,KAAa,MAAM,YAAY,SAAS,WAC7D,MAAM,IAAI,MAAM,qEAAqE;CAEvF,IAAI,OAAO,oBAAoB,KAAA,KAAa,MAAM,oBAAoB,SAAS,iBAC7E,MAAM,IAAI,MAAM,sEAAsE;CAExF,MAAM,WAAW,MAAM,MAAM,OAAO,QAAQ;EAC1C,WAAW,SAAS;EACpB,SAAS,UAAU,OAAO,UAAU;EACpC,iBAAiB,SAAS;CAC5B,CAAC;CACD,IAAIA,2BAAyB,QAAQ,MAAMA,2BAAyB,QAAQ,GAC1E,MAAM,IAAI,MAAM,wDAAwD;CAE1E,OAAO;AACT;AAEA,eAAe,cACb,WACA,MACA,OACA,eACA,aACA,kBAIC;CACD,MAAM,SAAS,UAAU,OAAO;CAChC,IAAI,OAAO,SAAS,YAAY,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE;CACrE,MAAM,OAAO,OAAO,OAAO,MAAM,sBAAsB,WAAW,OAAO,IAAI,IAAI,KAAA;CACjF,MAAM,mBAAmBA,2BAAyB,EAAE,aAAa,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;CAC5F,MAAM,cAAcA,2BAAyB,EAAE,YAAY,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;CACtF,MAAM,qBAAqBA,2BAAyB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE;CAClF,MAAM,qBAAqB,aAAa,UAAU,OAAO,OAAO,MAAM,GAAG,EAAE,EAAE,GAAG,iBAAiB,GAAG,YAAY,GAAG;CACnH,MAAM,QAAQ,MAAM,qCAEhB,MAAM,OAAO,MAAM;EACjB,aAAa,KAAK;EAClB;EACA;EACA;EACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EACvB,GAAI,OAAO,OAAO,EAAE,YAAY,OAAO,KAAK,OAAO,IAAI,CAAC;CAC1D,CAAC,GACH,yBAAyB,gBAAgB,GACzC,uBACF;CACA,IAAI;EACF,IACE,MAAM,kBAAkB,iBACxB,MAAM,gBAAgB,eACtB,CAAC,wBAAwB,KAAK,MAAM,YAAY,GAEhD,MAAM,IAAI,MAAM,+DAA+D;EAEjF,MAAM,qBAAqB,MAAM,UAAU,MAAM,SAAS;EAC1D,MAAM,iCAAiC,MAAM,aAAa,MAAM,SAAS;EACzE,OAAO;GACL,OAAO;IACL,MAAM;IACN,OAAO;IACP;IACA,OAAO;KACL,MAAM;KACN,UAAU,MAAM;KAChB,kBAAkB,MAAM;IAC1B;IACA,aAAa,MAAM;IACnB,GAAI,OAAO,OAAO,EAAE,YAAY,OAAO,KAAK,OAAO,IAAI,CAAC;GAC1D;GACA,cAAc,MAAM;EACtB;CACF,SAAS,OAAO;EACd,IAAI;GACF,MAAM,SAAS,MAAM,qCAEjB,MAAM,OAAO,MAAM;IACjB,aAAa,KAAK;IAClB;IACA,cAAc,MAAM;IACpB;IACA,QAAQ;GACV,CAAC,GACH,yBAAyB,gBAAgB,GACzC,uCACF;GACA,IAAI,OAAO,WAAW,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,QAAQ,QAAQ,QAAQ,GAC9E,MAAM,IAAI,MAAM,2DAA2D;EAE/E,SAAS,YAAY;GACnB,MAAM,IAAI,MAAM,uDAAuD,EACrE,OAAO,IAAI,eAAe,CAAC,OAAO,UAAU,CAAC,EAC/C,CAAC;EACH;EACA,MAAM;CACR;AACF;AAEA,SAAS,YACP,WACA,MACA,cAC2D;CAC3D,MAAM,SAAS,UAAU,OAAO,UAAU;CAC1C,IAAI,OAAO,SAAS,qBAClB,OAAO;EAAE,YAAY,OAAO;EAAY,MAAM,CAAC,GAAI,OAAO,QAAQ,CAAC,GAAI,GAAG,YAAY;CAAE;CAE1F,MAAM,gBAAgB,KAAK,eAAe;CAC1C,IAAI,CAAC,eAAe,MAAM,IAAI,MAAM,0DAA0D;CAC9F,MAAM,aAAa,MAAM,KAAK,eAAe,OAAO,UAAU;CAC9D,MAAM,gBAAgB,OAAO,QAAQ,CAAC;CACtC,IAAI,OAAO,aACT,OAAO;EACL,YAAY,OAAO;EACnB,MAAM;GAAC;IAAE,MAAM;IAAU,OAAO;GAAW;GAAG,GAAG;GAAe,GAAG;EAAY;CACjF;CAEF,OAAO;EAAE,YAAY;EAAY,MAAM,CAAC,GAAG,eAAe,GAAG,YAAY;CAAE;AAC7E;AAEA,SAAS,uBACP,GAAG,SACwC;CAC3C,MAAM,SAAoD,CAAC;CAC3D,KAAK,MAAM,UAAU,SACnB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAAG;EAClD,MAAM,WAAW,OAAO;EACxB,IAAI,YAAY,SAAS,UAAU,MAAM,OACvC,MAAM,IAAI,MAAM,iDAAiD,MAAM;EAEzE,OAAO,QAAQ;CACjB;CAEF,OAAO;AACT;AAEA,SAAS,wBACP,QACwB;CACxB,OAAO,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,MAAM,MAAM,KAAK,CAAC,CAAC;AAC9F;AAEA,SAAS,YACP,SACA,WACwD;CACxD,MAAM,SAAiE,CACrE;EAAE,MAAM;EAAW;CAAU,CAC/B;CACA,IAAI,QAAQ,OAAO,OAAO,OAAO,KAAK;EAAE,MAAM;EAAS;CAAU,CAAC;CAClE,KAAK,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,GACvD,IAAI,QAAQ,QAAQ,KAAK,EAAE,OAAO,OAAO,KAAK;EAAE,MAAM;EAAQ;EAAM;CAAU,CAAC;CAEjF,KAAK,MAAM,QAAQ,OAAO,KAAK,QAAQ,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,GAC3D,IAAI,QAAQ,YAAY,KAAK,EAAE,OAAO,OAAO,KAAK;EAAE,MAAM;EAAY;EAAM;CAAU,CAAC;CAEzF,OAAO;AACT;AAEA,SAAS,2BACP,WAC8E;CAC9E,MAAM,SAAS,UAAU,OAAO,UAAU;CAC1C,MAAM,YAAY,UAAU,OAAO,UAAU;CAC7C,IAAI,OAAO,SAAS,0BAA0B,CAAC,WAAW,OAAO,KAAA;CACjE,MAAM,OAAO,UAAU,SAAS,MAAM,MAAM,UAAU,MAAM,SAAS,OAAO,UAAU;CACtF,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,4DAA4D;CACvF,OAAO;EAAE,MAAM,KAAK;EAAM,QAAQ,KAAK;EAAQ,YAAY,KAAK;CAAW;AAC7E;AAEA,SAAS,qBACP,KACA,OACQ;CACR,MAAM,OAAO,IAAI,cAAc,SAAS,MAAM,WAAW,MAAM;CAC/D,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,uDAAuD;CAClF,MAAM,WAAW,IAAI,SAAS,MAAM,OAAO,MAAM,KAAK,MAAM,IAAI,IAAI;CACpE,IAAI,aAAa,QAAQ,CAAC,SAAS,WAAW,GAAG,KAAK,EAAE,GACtD,MAAM,IAAI,MAAM,+CAA+C;CAEjE,OAAO;AACT;AAEA,SAAS,kCACP,aAYA,gBACA,eACA,aACM;CACN,IAAI,CAAC,wBAAwB,KAAK,YAAY,MAAM,GAClD,MAAM,IAAI,MAAM,4DAA4D;CAE9E,IAAI,YAAY,kBAAkB,iBAAiB,YAAY,gBAAgB,aAC7E,MAAM,IAAI,MAAM,+DAA+D;CAEjF,MAAM,SAAS,YAAY,cAAc;CACzC,IAAIA,2BAAyB,YAAY,cAAc,MAAMA,2BAAyB,MAAM,GAC1F,MAAM,IAAI,MAAM,sEAAsE;CAExF,MAAM,sBAAsB,OAAO,kBAAkB,IAAI,aAAa;CAEtE,IADgB,uCAAuC,MAAM,YAAY,OAC/D,CAAC,CAAC,SAAS,qBACnB,MAAM,IAAI,MAAM,6EAA6E;AAEjG;AAEA,SAAS,0BACP,WACA,UACM;CACN,MAAM,OAAO,IAAI,IAAI,OAAO,KAAK,SAAS,CAAC;CAC3C,KAAK,MAAM,QAAQ,OAAO,KAAK,QAAQ,GAAG;EACxC,IAAI,KAAK,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,+CAA+C,MAAM;EACzF,KAAK,IAAI,IAAI;CACf;AACF;AAEA,SAAS,YAAY,QAKnB;CACA,OAAO;EACL,eAAe,OAAO;EACtB,gBAAgB,OAAO;EACvB,iBAAiB,OAAO;EACxB,YAAY,OAAO;CACrB;AACF;AAEA,SAAS,0BACP,aACA,eAC0D;CAC1D,MAAM,SAAS,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC;CACtE,IAAI,OAAO,SAAS,YAAY,UAAU,YAAY,WAAW,cAAc,QAC7E,MAAM,IAAI,MAAM,2DAA2D;CAE7E,OAAO,cAAc,KAAK,aAAa;EACrC,MAAM,SAAS,OAAO,IAAI,SAAS,OAAO;EAC1C,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,QAAQ,OAAO,KAAK,QAAQ,WAAW,IAAI,MAAM;EACvD,IACE,CAAC,UACD,CAAC,OAAO,UAAU,IAAI,KACtB,OAAO,KACP,OAAO,OACP,SAAS,SAAS,QAClB,YAAY,KAAK,MAAM,SAAS,eAEhC,MAAM,IAAI,MAAM,2DAA2D;EAE7E,OAAO;GAAE,MAAM,SAAS;GAAS;GAAM,OAAO,WAAW,KAAK,KAAK;EAAE;CACvE,CAAC;AACH;AACA,SAAS,oBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,QAAQ,SAAU,QAAQ,OAAQ;GACpC,MAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;GACvC,IAAI,EAAE,QAAQ,SAAU,QAAQ,QAAS,OAAO;GAChD;EACF,OAAO,IAAI,QAAQ,SAAU,QAAQ,OACnC,OAAO;CAEX;CACA,OAAO;AACT;AAEA,SAAS,aAAa,OAAwB;CAC5C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D"}