@tangle-network/agent-runtime 0.259.1 → 0.261.0

package/dist/testing.d.ts

@@ -1,5 +1,5 @@
-import { $a as SuperviseTestOptions, $t as runGraphWithTestBrain, Ao as supervisorAgentWithTestBrain, Tn as driverAgent, Yt as RunGraphTestOptions, to as superviseWithTestBrain, wn as DriverAgentOptions, xo as SupervisorAgentTestDeps } from "./index-sGOO254Q.js";
-import { On as ToolLoopCallContext, kn as ToolLoopChat } from "./stream-agent-turn-DRTFLphI.js";
+import { $a as SuperviseTestOptions, $t as runGraphWithTestBrain, Ao as supervisorAgentWithTestBrain, Tn as driverAgent, Yt as RunGraphTestOptions, to as superviseWithTestBrain, wn as DriverAgentOptions, xo as SupervisorAgentTestDeps } from "./index-tubViIQJ.js";
+import { On as ToolLoopCallContext, kn as ToolLoopChat } from "./stream-agent-turn-DTgxWXbR.js";
 import { AgentImprovementProposal, AgentProfile, AgentProfileImprovementMeasuredComparison, SandboxSizePreset } from "@tangle-network/agent-interface";
 //#region src/testing/index.d.ts
 /** A proposal produced by Runtime's opaque profile-improvement path. */

package/dist/testing.js

@@ -1,14 +1,14 @@
-import { E as immutableCandidateValue, S as canonicalCandidateDigest$1 } from "./workspace-archive-DQGFwvM6.js";
-import { f as verifyAgentImprovementProposal } from "./improvement-cycle-D0Os0Hg_.js";
-import { C as applyExactAgentProfileDiff, j as parseExactAgentProfile } from "./prepare-RuaAclli.js";
-import { i as superviseWithTestBrain, m as supervisorAgentWithTestBrain } from "./supervise-DsQjhLN-.js";
-import { r as driverAgent } from "./coordination-driver-BmtrkNPu.js";
-import { i as runGraphWithTestBrain } from "./graph-BKRvWzHx.js";
+import { C as canonicalCandidateDigest$1, D as immutableCandidateValue } from "./workspace-archive-C9lgf77y.js";
+import { f as verifyAgentImprovementProposal } from "./improvement-cycle-DYiwfjWY.js";
+import { i as applyExactAgentProfileDiff, p as parseExactAgentProfile } from "./profile-D3eXNBQV.js";
+import { a as superviseWithTestBrain, h as supervisorAgentWithTestBrain } from "./supervise-1QzYAyS2.js";
+import { r as driverAgent } from "./coordination-driver-LmDxHvAO.js";
+import { i as runGraphWithTestBrain } from "./graph-Bn3wSH8-.js";
 import { SANDBOX_SIZE_PRESET_NAMES } from "@tangle-network/agent-interface";
 //#region src/testing/fixtures/agent-improvement-proposal.json
 var agent_improvement_proposal_default = {
 	changedSurfaces: ["prompt"],
-	digest: "sha256:19457805693ea7ddd45aa6c1e3a9ae0bb360827141cf6d991b1f82d185496389",
+	digest: "sha256:1b4cf56071011f049b6df89286d5e015034e41c02abaf43a83633161766708b9",
 	evaluation: {
 		"decision": {
 			"contributingChecks": [
@@ -4579,7 +4579,7 @@ var agent_improvement_proposal_default = {
 		],
 		"metadata": {
 			"fixture": "agent-improvement-proposal",
-			"runtimeVersion": "0.259.1"
+			"runtimeVersion": "0.261.0"
 		},
 		"objectives": [
 			{
@@ -4690,8 +4690,8 @@ var agent_improvement_proposal_default = {
 			"baselineContentHash": "sha256:5c21ee53e513fc604cb09754e21c392b24a424da0ef37dbf8f1ee4a8a0b08f09",
 			"candidateContentHash": "sha256:60fcbb1c728194bd51d7d19cb732d1c3f1881dce7e0a6266b41c8b98cfd65693",
 			"kind": "agent-eval-loop",
-			"recordDigest": "sha256:4505cf8191efaec81ddaf725576407f06dfee1ed2f87888853e0696ed37eff7a",
-			"runId": "agent-runtime-0.259.1-proposal-fixture",
+			"recordDigest": "sha256:add9ca9df7fce58f88035e24078c2e572228fb7c02c29800d93f8378a27ee6a0",
+			"runId": "agent-runtime-0.261.0-proposal-fixture",
 			"schema": "agent-candidate-experiment"
 		}
 	},
@@ -4714,13 +4714,13 @@ var agent_improvement_proposal_default = {
 	}],
 	kind: "agent-improvement-proposal",
 	proposedAt: "2026-07-10T01:00:00.000Z",
-	runId: "agent-runtime-0.259.1-proposal-fixture"
+	runId: "agent-runtime-0.261.0-proposal-fixture"
 };
 //#endregion
 //#region src/testing/fixtures/agent-profile-improvement-proposal.json
 var agent_profile_improvement_proposal_default = {
 	changedSurfaces: ["prompt", "skills"],
-	digest: "sha256:3ed48a3ac943729eb507b7d105bbf7b5c898a30da911761347a00f30e194cb74",
+	digest: "sha256:1e43961498ecc94991d3a36d1ab84ffcef3d4504cb864ae52c7302635d450c74",
 	evaluation: {
 		"decision": {
 			"contributingChecks": [
@@ -6354,7 +6354,7 @@ var agent_profile_improvement_proposal_default = {
 		],
 		"metadata": {
 			"fixture": "agent-profile-improvement-proposal",
-			"runtimeVersion": "0.259.1"
+			"runtimeVersion": "0.261.0"
 		},
 		"objectives": [
 			{
@@ -6465,7 +6465,7 @@ var agent_profile_improvement_proposal_default = {
 			"baselineContentHash": "sha256:21c495a37c418c10bde64fbaa188beddeed31f1f051ea60a6a6582a9ee0db704",
 			"candidateContentHash": "sha256:103f77bc8481601eef1ad5fe6ba84a40dffabc3a44f421f8c8559121edab84e9",
 			"kind": "agent-eval-loop",
-			"recordDigest": "sha256:7f24dbb41ae9f4a3ca2c8998a7a0f7f3fcab2295f06436d36b986225b2ac70cf",
+			"recordDigest": "sha256:bb909764b0de8f8d4f1cc03368426ab1bd1fff4ba787c6d7ffbe88c52b59471c",
 			"runId": "profile-improvement-1",
 			"schema": "agent-profile-improvement-experiment"
 		}

package/dist/tui/index.d.ts

@@ -1,4 +1,4 @@
-import { Ct as ProvisionedSupervisor, St as ProvisionSupervisorRequest, Tt as provisionSupervisor, wt as SupervisorCleanupReceipt, xt as ProvisionSupervisorConnection } from "../index-sGOO254Q.js";
+import { Ct as ProvisionedSupervisor, St as ProvisionSupervisorRequest, Tt as provisionSupervisor, wt as SupervisorCleanupReceipt, xt as ProvisionSupervisorConnection } from "../index-tubViIQJ.js";
 //#region src/tui/top-app.d.ts
 /**
  * The interactive side of the supervisor-run TUI: a keypress/mouse loop over the frames

package/dist/tui/index.js

@@ -1,3 +1,3 @@
-import { t as provisionSupervisor } from "../provision-supervisor-B9tf4soF.js";
+import { t as provisionSupervisor } from "../provision-supervisor-By5oGk3t.js";
 import { a as renderTopFrameWithLayout, i as renderTopFrame, n as runTopApp, r as loadTopSnapshot, t as renderTopOnce } from "../top-app-VAOrBskv.js";
 export { loadTopSnapshot, provisionSupervisor, renderTopFrame, renderTopFrameWithLayout, renderTopOnce, runTopApp };

package/dist/{types-ChewVlpE.d.ts → types-DNCNRu0E.d.ts}

@@ -3521,6 +3521,10 @@ interface SpawnOpts {
    * (`'duplicate-key'`). Unkeyed spawns (the default) are position-identified and always run.
    */
   readonly key?: string;
+  /** The settled sibling node this spawn replaces, so a run's record names which worker took over
+   *  whose work. The caller asserts the relation; the coordination `spawn_worker` tool admits only
+   *  a settled worker of the same manager. Journaled on `spawned` and on the `agent.spawn` hook. */
+  readonly successorOf?: NodeId;
 }
 /** Fail-closed spawn rejections: an exhausted pool, a dollar request against a root that budgets
  *  no dollars, an exceeded recursion ceiling, a full tree-wide worker allocation, a `key` that is
@@ -3939,8 +3943,17 @@ type SpawnEvent = {
   key?: string;
   /** Manager-scoped assignment identity used to join unkeyed and keyed work alike. */
   assignmentId?: string;
+  /** The settled sibling node this spawn replaces (`SpawnOpts.successorOf`). */
+  successorOf?: NodeId;
   budget: Budget;
   runtime: Runtime;
+  /** Root-only opt-in admission contract. A resumed run must use the same policy and fleet
+   * limits; absent on historical and default-off records. */
+  recursiveAdmission?: {
+    policy: RecursiveReservationPolicy;
+    maxDepth: number;
+    maxLiveWorkers: number;
+  };
   /** Exact nested journal tree this node owns. Runtime writes this only after privately
    * attesting the executor as a recursive scope owner. Its absence means no tree is followed,
    * including records written before this field existed and caller leaves named `driver`. */
@@ -4357,6 +4370,12 @@ interface Supervisor<Task, Out> {
   run(root: Agent<Task, Out>, task: Task, opts: SupervisorOpts): Promise<SupervisedResult<Out>>;
   attach(h: RootHandle<Out>): void;
 }
+/** Optional recursive admission policy. `ownerShare` is the fraction of every manager's budget
+ * kept free for its own inference while children hold their full declared ceilings. The same
+ * policy reserves one live worker slot per remaining depth, up to `maxDepth`. */
+interface RecursiveReservationPolicy {
+  readonly ownerShare: number;
+}
 interface SupervisorOpts {
   /** The root conserved-pool ceiling (tokens + usd + iterations + deadline). */
   readonly budget: Budget;
@@ -4384,6 +4403,9 @@ interface SupervisorOpts {
   /** Hard tree-wide cap on simultaneously executing spawned workers. The root is excluded; every
    *  nested driver and leaf shares this one allocation. Omit/`<= 0` leaves worker count uncapped. */
   readonly maxLiveWorkers?: number;
+  /** Opt in to reserving each manager's inference share and enough tree-wide worker slots for a
+   * descendant path to `maxDepth`. Omit to retain full-ceiling admission behavior. */
+  readonly reservationPolicy?: RecursiveReservationPolicy;
   /**
    * OTP intensity breaker: more than `maxRestarts` child restarts within `withinMs`
    * trips the supervisor to `no-winner` rather than restarting forever.
@@ -4820,5 +4842,5 @@ interface WidenGate<Out> {
   readonly judgeExempt?: boolean;
 }
 //#endregion
-export { SpawnOpts as $, ReadableEnvironment as $n, LoopPlanDescription as $r, RuntimeEventCollector as $t, NodeExecutionIdentity as A, AgentRuntimeEvent as Ai, RetainedChildRecovery as An, BudgetPool as Ar, traceContextToEnv as At, ResumedKeyState as B, OpenAIChatToolChoice as Bi, ReconnectRetainedInteractiveRunOptions as Bn, createBudgetPool as Br, OtelSpan as Bt, ExecutorToolCall as C, RuntimeRunStatus as Ci, SessionMessageLike as Cn, RetainedRunIntentAdmission as Cr, workerTraceEnv as Ct, MaterializedExecutionIdentity as D, AgentBackendInput as Di, createPushTraceSource as Dn, RetainedRunTurnInput as Dr, createPropagatingTraceEmitter as Dt, HeldEnvironment as E, AgentBackendContext as Ei, TraceSource as En, RetainedRunStartMaterial as Er, TraceContext as Et, ProviderModelAttemptEvidence as F, AgentTaskStatus as Fi, ExecutorProgress as Fn, ReservationHolder as Fr, INTELLIGENCE_WIRE_VERSION as Ft, RootProviderModelEvidence as G, RuntimeSessionStore as Gi, RetainedInteractiveStartMaterial as Gn, ExecCtx as Gr, createOpenInferenceFileExporter as Gt, RetainedExecutionState as H, RunAgentTaskStreamOptions as Hi, RetainedInteractiveAdmissionHook as Hn, AgentRunSpec as Hr, buildLoopOtelSpans as Ht, ProviderModelExecutionEvidence as I, BackendErrorDetail as Ii, ScopeProgressInput as In, ReservationRejection as Ir, LoopSpanNode as It, Runtime as J, HarnessTranscriptCapture as Jn, LoopEndedPayload as Jr, generateSpanId as Jt, RootSignal as K, RuntimeStreamEvent as Ki, StartRetainedInteractiveRunOptions as Kn, Iteration as Kr, createOtelExporter as Kt, ResourceLimit as L, KnowledgeReadinessDecision as Li, WorkerProgress as Ln, ReservationShortfall as Lr, OtelAttribute as Lt, NodeSnapshot as M, AgentTaskContext as Mi, ActivityLog as Mn, BudgetReadout as Mr, EvalRunGeneration as Mt, NodeStatus as N, AgentTaskRunResult as Ni, ActivityNote as Nn, BudgetReconcileFault as Nr, EvalRunsExportConfig as Nt, MaterializedModelIdentity as O, AgentExecutionBackend as Oi, decodeToolPart as On, StartRetainedRunInEnvironmentOptions as Or, mergeTraceEnv as Ot, ProfileMaterializationReceipt as P, AgentTaskSpec as Pi, DEFAULT_STALL_AFTER_MS as Pn, LeakedReservation as Pr, EvalRunsExportResult as Pt, SpawnJournal as Q, HarnessTranscriptUnavailableReason as Qn, LoopLineageOptions as Qr, toOtelAttributes as Qt, ResourceSpend as R, OpenAIChatResponseFormat as Ri, createActivityLog as Rn, ReservationStage as Rr, OtelExportConfig as Rt, ExecutorTeardownWarning as S, RuntimeRunRow as Si, waitUntil as Sn, RetainedRunHandle as Sr, readWorkerTraceContext as St, Handle as T, AgentAdapter as Ti, ToolStepInput as Tn, RetainedRunSnapshot as Tr, workerTraceSeamKey as Tt, RootHandle as U, RuntimeCanonicalStreamEvent as Ui, RetainedInteractiveEnvironmentInput as Un, DefaultVerdict$1 as Ur, buildLoopSpanNodes as Ut, ResumedWork as V, RunAgentTaskOptions as Vi, RecoverRetainedInteractiveRunOptions as Vn, spendFromUsageEvents as Vr, RuntimeEventOtelOptions as Vt, RootMaterialization as W, RuntimeSession as Wi, RetainedInteractiveRunHandle as Wn, Driver as Wr, buildRuntimeEventOtelSpans as Wt, Settled as X, HarnessTranscriptFile as Xn, LoopIterationEndedPayload as Xr, padSpanId as Xt, Scope as Y, HarnessTranscriptEvidence as Yn, LoopIterationDispatchPayload as Yr, loopEventToOtelSpan as Yt, SpawnEvent as Z, HarnessTranscriptUnavailable as Zn, LoopIterationStartedPayload as Zr, padTraceId as Zt, ExecutorMaterialization as _, RuntimeRunCompleteInput as _i, createWaitProbes as _n, RetainedRunCancellation as _r, WorkerInteractiveUnavailableReason as _t, BudgetOverspend as a, LoopTokenUsage as ai, SanitizedKnowledgeRequirement as an, NativeContextContinuationInput as ar, SteerableRootHandle as at, ExecutorRegistry as b, RuntimeRunOptions as bi, timerAt as bn, RetainedRunEnvironmentAdmission as br, WorkerTraceResolver as bt, EnvironmentTeardownReceipt as c, LoopWinner as ci, sanitizeAgentRuntimeEvent as cn, RecoverRetainedRunOptions as cr, SupervisorOpts as ct, ExecutorAccounting as d, OutputAdapter as di, PendingWait as dn, RetainedInteractiveEnvironmentAdmission as dr, UnconfirmedTeardown as dt, LoopPlanPayload as ei, RuntimeStreamEventCollector as en, captureHarnessTranscript as er, SpawnPrior as et, ExecutorCancellation as f, RunProvenance as fi, WaitOutcome as fn, RetainedInteractiveIntentAdmission as fr, UnknownMaterializationReason as ft, ExecutorFactory as g, Validator as gi, WaitSpec as gn, RetainedRunCancelOptions as gr, WorkerInteractiveSession as gt, ExecutorExecutionBinding as h, ValidationCtx as hi, WaitRejection as hn, RetainedRunAdmissionHook as hr, WidenGate as ht, Budget as i, LoopTeardownFailedPayload as ii, SanitizedKnowledgeReadinessReport as in, NativeContextContinuationHandle as ir, SpendGap as it, NodeId as j, AgentRuntimeEventSink as ji, RetainedPendingCause as jn, BudgetPoolRestore as jr, EvalRunEvent as jt, NoWinnerError as k, AgentKnowledgeProvider as ki, sandboxSessionTraceSource as kn, StartRetainedRunOptions as kr, readTraceContextFromEnv as kt, ExecutionBindingReceipt as l, MountManifestEntry as li, sanitizeKnowledgeReadinessReport as ln, RecoverRetainedRunResult as lr, TokenUsageProvenance as lt, ExecutorContext as m, SelectionReceipt as mi, WaitProbeRegistry as mn, RetainedRunAdmission as mr, WaitOpts as mt, AgentExecutionRef as n, LoopSandboxPlacement as ni, RuntimeStreamEventSummary as nn, persistHarnessTranscript as nr, Spend as nt, BudgetViolation as o, LoopTraceEmitter as oi, createRuntimeEventCollector as on, ReconnectRetainedRunOptions as or, SupervisedResult as ot, ExecutorCancellationRequest as p, SandboxClient as pi, WaitProbe as pn, RetainedInteractiveStartedAdmission as pr, UsageEvent as pt, RootStreamReceipt as q, HarnessTranscriptArtifact as qn, LoopDecisionPayload as qr, exportEvalRuns as qt, AgentSpec as r, LoopStartedPayload as ri, RuntimeTelemetryOptions as rn, NativeContextContinuationExecution as rr, SpendChannel as rt, DefaultVerdict as s, LoopTraceEvent as si, createRuntimeStreamEventCollector as sn, RecoverRetainedRunIntentOptions as sr, Supervisor as st, Agent as t, LoopResult as ti, RuntimeStreamEventSink as tn, harnessTranscriptArtifact as tr, SpawnRejection as tt, Executor as u, MountRecorder as ui, sanitizeRuntimeStreamEvent as un, RetainedInteractiveAdmission as ur, TreeView as ut, ExecutorNodeContext as v, RuntimeRunCost as vi, isWaitOutcome as vn, RetainedRunDispatchedAdmission as vr, WorkerTraceEvidence as vt, FleetYield as w, startRuntimeRun as wi, SessionTraceBox as wn, RetainedRunReplayPoint as wr, workerTraceHeaders as wt, ExecutorResult as x, RuntimeRunPersistenceAdapter as xi, validateWaitSpec as xn, RetainedRunEventOptions as xr, WorkerTraceSeamCarrier as xt, ExecutorProgressEvent as y, RuntimeRunHandle as yi, pollFor as yn, RetainedRunEffect as yr, WorkerTraceUnavailableReason as yt, ResultBlobStore as z, OpenAIChatTool as zi, readWorkerProgress as zn, ReservationTicket as zr, OtelExporter as zt };
-//# sourceMappingURL=types-ChewVlpE.d.ts.map
+export { SpawnJournal as $, HarnessTranscriptUnavailableReason as $n, LoopLineageOptions as $r, toOtelAttributes as $t, NodeExecutionIdentity as A, AgentKnowledgeProvider as Ai, sandboxSessionTraceSource as An, StartRetainedRunOptions as Ar, readTraceContextFromEnv as At, ResultBlobStore as B, OpenAIChatTool as Bi, readWorkerProgress as Bn, ReservationTicket as Br, OtelExporter as Bt, ExecutorToolCall as C, RuntimeRunRow as Ci, waitUntil as Cn, RetainedRunHandle as Cr, readWorkerTraceContext as Ct, MaterializedExecutionIdentity as D, AgentBackendContext as Di, TraceSource as Dn, RetainedRunStartMaterial as Dr, TraceContext as Dt, HeldEnvironment as E, AgentAdapter as Ei, ToolStepInput as En, RetainedRunSnapshot as Er, workerTraceSeamKey as Et, ProviderModelAttemptEvidence as F, AgentTaskSpec as Fi, DEFAULT_STALL_AFTER_MS as Fn, LeakedReservation as Fr, EvalRunsExportResult as Ft, RootMaterialization as G, RuntimeSession as Gi, RetainedInteractiveRunHandle as Gn, Driver as Gr, buildRuntimeEventOtelSpans as Gt, ResumedWork as H, RunAgentTaskOptions as Hi, RecoverRetainedInteractiveRunOptions as Hn, spendFromUsageEvents as Hr, RuntimeEventOtelOptions as Ht, ProviderModelExecutionEvidence as I, AgentTaskStatus as Ii, ExecutorProgress as In, ReservationHolder as Ir, INTELLIGENCE_WIRE_VERSION as It, RootStreamReceipt as J, HarnessTranscriptArtifact as Jn, LoopDecisionPayload as Jr, exportEvalRuns as Jt, RootProviderModelEvidence as K, RuntimeSessionStore as Ki, RetainedInteractiveStartMaterial as Kn, ExecCtx as Kr, createOpenInferenceFileExporter as Kt, RecursiveReservationPolicy as L, BackendErrorDetail as Li, ScopeProgressInput as Ln, ReservationRejection as Lr, LoopSpanNode as Lt, NodeSnapshot as M, AgentRuntimeEventSink as Mi, RetainedPendingCause as Mn, BudgetPoolRestore as Mr, EvalRunEvent as Mt, NodeStatus as N, AgentTaskContext as Ni, ActivityLog as Nn, BudgetReadout as Nr, EvalRunGeneration as Nt, MaterializedModelIdentity as O, AgentBackendInput as Oi, createPushTraceSource as On, RetainedRunTurnInput as Or, createPropagatingTraceEmitter as Ot, ProfileMaterializationReceipt as P, AgentTaskRunResult as Pi, ActivityNote as Pn, BudgetReconcileFault as Pr, EvalRunsExportConfig as Pt, SpawnEvent as Q, HarnessTranscriptUnavailable as Qn, LoopIterationStartedPayload as Qr, padTraceId as Qt, ResourceLimit as R, KnowledgeReadinessDecision as Ri, WorkerProgress as Rn, ReservationShortfall as Rr, OtelAttribute as Rt, ExecutorTeardownWarning as S, RuntimeRunPersistenceAdapter as Si, validateWaitSpec as Sn, RetainedRunEventOptions as Sr, WorkerTraceSeamCarrier as St, Handle as T, startRuntimeRun as Ti, SessionTraceBox as Tn, RetainedRunReplayPoint as Tr, workerTraceHeaders as Tt, RetainedExecutionState as U, RunAgentTaskStreamOptions as Ui, RetainedInteractiveAdmissionHook as Un, AgentRunSpec as Ur, buildLoopOtelSpans as Ut, ResumedKeyState as V, OpenAIChatToolChoice as Vi, ReconnectRetainedInteractiveRunOptions as Vn, createBudgetPool as Vr, OtelSpan as Vt, RootHandle as W, RuntimeCanonicalStreamEvent as Wi, RetainedInteractiveEnvironmentInput as Wn, DefaultVerdict$1 as Wr, buildLoopSpanNodes as Wt, Scope as X, HarnessTranscriptEvidence as Xn, LoopIterationDispatchPayload as Xr, loopEventToOtelSpan as Xt, Runtime as Y, HarnessTranscriptCapture as Yn, LoopEndedPayload as Yr, generateSpanId as Yt, Settled as Z, HarnessTranscriptFile as Zn, LoopIterationEndedPayload as Zr, padSpanId as Zt, ExecutorMaterialization as _, Validator as _i, WaitSpec as _n, RetainedRunCancelOptions as _r, WorkerInteractiveSession as _t, BudgetOverspend as a, LoopTeardownFailedPayload as ai, SanitizedKnowledgeReadinessReport as an, NativeContextContinuationHandle as ar, SpendGap as at, ExecutorRegistry as b, RuntimeRunHandle as bi, pollFor as bn, RetainedRunEffect as br, WorkerTraceUnavailableReason as bt, EnvironmentTeardownReceipt as c, LoopTraceEvent as ci, createRuntimeStreamEventCollector as cn, RecoverRetainedRunIntentOptions as cr, Supervisor as ct, ExecutorAccounting as d, MountRecorder as di, sanitizeRuntimeStreamEvent as dn, RetainedInteractiveAdmission as dr, TreeView as dt, LoopPlanDescription as ei, RuntimeEventCollector as en, ReadableEnvironment as er, SpawnOpts as et, ExecutorCancellation as f, OutputAdapter as fi, PendingWait as fn, RetainedInteractiveEnvironmentAdmission as fr, UnconfirmedTeardown as ft, ExecutorFactory as g, ValidationCtx as gi, WaitRejection as gn, RetainedRunAdmissionHook as gr, WidenGate as gt, ExecutorExecutionBinding as h, SelectionReceipt as hi, WaitProbeRegistry as hn, RetainedRunAdmission as hr, WaitOpts as ht, Budget as i, LoopStartedPayload as ii, RuntimeTelemetryOptions as in, NativeContextContinuationExecution as ir, SpendChannel as it, NodeId as j, AgentRuntimeEvent as ji, RetainedChildRecovery as jn, BudgetPool as jr, traceContextToEnv as jt, NoWinnerError as k, AgentExecutionBackend as ki, decodeToolPart as kn, StartRetainedRunInEnvironmentOptions as kr, mergeTraceEnv as kt, ExecutionBindingReceipt as l, LoopWinner as li, sanitizeAgentRuntimeEvent as ln, RecoverRetainedRunOptions as lr, SupervisorOpts as lt, ExecutorContext as m, SandboxClient as mi, WaitProbe as mn, RetainedInteractiveStartedAdmission as mr, UsageEvent as mt, AgentExecutionRef as n, LoopResult as ni, RuntimeStreamEventSink as nn, harnessTranscriptArtifact as nr, SpawnRejection as nt, BudgetViolation as o, LoopTokenUsage as oi, SanitizedKnowledgeRequirement as on, NativeContextContinuationInput as or, SteerableRootHandle as ot, ExecutorCancellationRequest as p, RunProvenance as pi, WaitOutcome as pn, RetainedInteractiveIntentAdmission as pr, UnknownMaterializationReason as pt, RootSignal as q, RuntimeStreamEvent as qi, StartRetainedInteractiveRunOptions as qn, Iteration as qr, createOtelExporter as qt, AgentSpec as r, LoopSandboxPlacement as ri, RuntimeStreamEventSummary as rn, persistHarnessTranscript as rr, Spend as rt, DefaultVerdict as s, LoopTraceEmitter as si, createRuntimeEventCollector as sn, ReconnectRetainedRunOptions as sr, SupervisedResult as st, Agent as t, LoopPlanPayload as ti, RuntimeStreamEventCollector as tn, captureHarnessTranscript as tr, SpawnPrior as tt, Executor as u, MountManifestEntry as ui, sanitizeKnowledgeReadinessReport as un, RecoverRetainedRunResult as ur, TokenUsageProvenance as ut, ExecutorNodeContext as v, RuntimeRunCompleteInput as vi, createWaitProbes as vn, RetainedRunCancellation as vr, WorkerInteractiveUnavailableReason as vt, FleetYield as w, RuntimeRunStatus as wi, SessionMessageLike as wn, RetainedRunIntentAdmission as wr, workerTraceEnv as wt, ExecutorResult as x, RuntimeRunOptions as xi, timerAt as xn, RetainedRunEnvironmentAdmission as xr, WorkerTraceResolver as xt, ExecutorProgressEvent as y, RuntimeRunCost as yi, isWaitOutcome as yn, RetainedRunDispatchedAdmission as yr, WorkerTraceEvidence as yt, ResourceSpend as z, OpenAIChatResponseFormat as zi, createActivityLog as zn, ReservationStage as zr, OtelExportConfig as zt };
+//# sourceMappingURL=types-DNCNRu0E.d.ts.map

package/dist/{workspace-archive-DQGFwvM6.js → workspace-archive-C9lgf77y.js}

@@ -9,11 +9,11 @@ import { isAnyArrayBuffer, isSharedArrayBuffer } from "node:util/types";
 import { extract, pack } from "tar-stream";
 //#region src/candidate-execution/digest.ts
 /** Use native hashing for workspace archives. */
-function sha256Bytes(bytes) {
+function sha256Bytes$1(bytes) {
 	return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
 }
 function canonicalCandidateDigest$1(value) {
-	return sha256Bytes(canonicalCandidateBytes$1(value));
+	return sha256Bytes$1(canonicalCandidateBytes$1(value));
 }
 /** Returns a detached, deeply frozen JSON value with canonical number normalization. */
 function immutableCandidateValue(value) {
@@ -21,7 +21,7 @@ function immutableCandidateValue(value) {
 }
 function canonicalCandidateDocument(valueWithoutDigest) {
 	const bytes = canonicalCandidateBytes$1(valueWithoutDigest);
-	const digest = sha256Bytes(bytes);
+	const digest = sha256Bytes$1(bytes);
 	const value = deepFreezeCandidate({
 		...JSON.parse(Buffer.from(bytes).toString("utf8")),
 		digest
@@ -42,7 +42,7 @@ function embeddedCandidateArtifact(bytes) {
 	return {
 		encoding: "base64",
 		content: Buffer.from(bytes).toString("base64"),
-		sha256: sha256Bytes(bytes),
+		sha256: sha256Bytes$1(bytes),
 		byteLength: bytes.byteLength
 	};
 }
@@ -68,14 +68,14 @@ async function readVerifiedArtifact(artifact, port) {
 }
 function verifyBytes(bytes, digest, byteLength, label) {
 	if (bytes.byteLength !== byteLength) throw new Error(`${label} byte length ${bytes.byteLength} does not match ${byteLength}`);
-	const actual = sha256Bytes(bytes);
+	const actual = sha256Bytes$1(bytes);
 	if (actual !== digest) throw new Error(`${label} digest ${actual} does not match ${digest}`);
 }
 async function verifyWorkspaceSnapshotArtifacts(snapshot, port) {
 	const [manifest, archive] = await Promise.all([readVerifiedArtifact(snapshot.manifest, port), readVerifiedArtifact(snapshot.archive, port)]);
 	const canonicalManifest = canonicalCandidateBytes$1(snapshot.material);
 	if (!Buffer.from(manifest).equals(Buffer.from(canonicalManifest))) throw new Error("workspace manifest artifact is not the exact canonical manifest material");
-	if (sha256Bytes(canonicalManifest) !== snapshot.digest) throw new Error("workspace snapshot digest does not match its canonical manifest material");
+	if (sha256Bytes$1(canonicalManifest) !== snapshot.digest) throw new Error("workspace snapshot digest does not match its canonical manifest material");
 	return {
 		manifest,
 		archive
@@ -133,7 +133,7 @@ function candidateWorkspaceManifest(files, options = {}) {
 	return workspaceManifestFromEntries(files.map((file) => ({
 		path: file.path,
 		mode: options.portableTree === true ? portableFileMode(file.mode) : file.mode,
-		sha256: sha256Bytes(file.bytes),
+		sha256: sha256Bytes$1(file.bytes),
 		byteLength: file.bytes.byteLength
 	})));
 }
@@ -631,7 +631,7 @@ function isNoEntry(error) {
 async function persistCandidateOutputArtifact(port, input) {
 	input.signal?.throwIfAborted();
 	const bytes = Uint8Array.from(input.bytes);
-	const expectedDigest = sha256Bytes(bytes);
+	const expectedDigest = sha256Bytes$1(bytes);
 	const ref = agentCandidateArtifactRefSchema.parse(await port.put({
 		executionId: input.executionId,
 		purpose: input.purpose,
@@ -800,7 +800,7 @@ async function captureRepository(requestedRoot, limits) {
 				headCommit,
 				headTree,
 				bundle: {
-					sha256: sha256Bytes(bundle),
+					sha256: sha256Bytes$1(bundle),
 					byteLength: bundle.byteLength,
 					bytes: bundle
 				}
@@ -1204,6 +1204,6 @@ const typedArrayBufferGetter = requireTypedArrayGetter("buffer");
 const typedArrayByteOffsetGetter = requireTypedArrayGetter("byteOffset");
 const typedArrayByteLengthGetter = requireTypedArrayGetter("byteLength");
 //#endregion
-export { canonicalCandidateDocument as C, omitTopLevelDigest as D, immutableCandidateValue as E, sha256Bytes as O, canonicalCandidateDigest$1 as S, embeddedCandidateArtifact as T, verifyBytes as _, persistCandidateOutputArtifact as a, verifyWorkspaceSnapshotArtifacts as b, verifyTaskCheckout as c, isWellFormedUnicode as d, artifactCacheKey as f, scanMaterializedWorkspaceManifest as g, readVerifiedArtifact as h, verifyAgentCandidateWorkspaceArchive as i, verifyCanonicalCandidateDocument as k, verifyTaskOutcomePatch as l, readMaterializedWorkspaceFiles as m, captureAgentCandidateWorkspaceFiles as n, readCandidateGitHubResource as o, candidateWorkspaceManifest as p, createAgentCandidateWorkspacePort as r, verifyCandidateCode as s, captureAgentCandidateWorkspace as t, assertExactObjectKeys as u, verifyMaterializedProfileWorkspace as v, deepFreezeCandidate as w, canonicalCandidateBytes$1 as x, verifyMaterializedWorkspace as y };
+export { verifyCanonicalCandidateDocument as A, canonicalCandidateDigest$1 as C, immutableCandidateValue as D, embeddedCandidateArtifact as E, omitTopLevelDigest as O, canonicalCandidateBytes$1 as S, deepFreezeCandidate as T, scanMaterializedWorkspaceManifest as _, persistCandidateOutputArtifact as a, verifyMaterializedWorkspace as b, verifyTaskCheckout as c, isWellFormedUnicode as d, artifactCacheKey as f, readVerifiedArtifact as g, readMaterializedWorkspaceFiles as h, verifyAgentCandidateWorkspaceArchive as i, sha256Bytes$1 as k, verifyTaskOutcomePatch as l, captureMaterializedWorkspace as m, captureAgentCandidateWorkspaceFiles as n, readCandidateGitHubResource as o, candidateWorkspaceManifest as p, createAgentCandidateWorkspacePort as r, verifyCandidateCode as s, captureAgentCandidateWorkspace as t, assertExactObjectKeys as u, verifyBytes as v, canonicalCandidateDocument as w, verifyWorkspaceSnapshotArtifacts as x, verifyMaterializedProfileWorkspace as y };
 
-//# sourceMappingURL=workspace-archive-DQGFwvM6.js.map
+//# sourceMappingURL=workspace-archive-C9lgf77y.js.map

package/dist/workspace-archive-C9lgf77y.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-archive-C9lgf77y.js","names":["sha256Bytes","canonicalCandidateDigest","canonicalCandidateBytes","sha256Bytes","canonicalCandidateBytes","fsConstants","canonicalCandidateBytes","hasControlCharacter","sha256Bytes","canonicalCandidateBytes","canonicalCandidateDigest","sha256Bytes","fsConstants"],"sources":["../src/candidate-execution/digest.ts","../src/candidate-execution/artifacts.ts","../src/candidate-execution/exact-object.ts","../src/candidate-execution/git-materialize.ts","../src/candidate-execution/output-artifacts.ts","../src/candidate-execution/workspace-archive.ts"],"sourcesContent":["import { createHash } from 'node:crypto'\nimport {\n  type AgentCandidateEmbeddedArtifact,\n  canonicalCandidateBytes,\n  type Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport type { CanonicalCandidateDocument } from './types'\n\nexport { canonicalCandidateBytes }\n\n/** Use native hashing for workspace archives. */\nexport function sha256Bytes(bytes: Uint8Array): Sha256Digest {\n  return `sha256:${createHash('sha256').update(bytes).digest('hex')}`\n}\n\nexport function canonicalCandidateDigest(value: unknown): Sha256Digest {\n  return sha256Bytes(canonicalCandidateBytes(value))\n}\n\n/** Returns a detached, deeply frozen JSON value with canonical number normalization. */\nexport function immutableCandidateValue<T>(value: T): T {\n  return deepFreezeCandidate(\n    JSON.parse(Buffer.from(canonicalCandidateBytes(value)).toString('utf8')) as T,\n  )\n}\n\nexport function canonicalCandidateDocument<T extends { digest: Sha256Digest }>(\n  valueWithoutDigest: Omit<T, 'digest'>,\n): CanonicalCandidateDocument<T> {\n  const bytes = canonicalCandidateBytes(valueWithoutDigest)\n  const digest = sha256Bytes(bytes)\n  const value = deepFreezeCandidate({\n    ...JSON.parse(Buffer.from(bytes).toString('utf8')),\n    digest,\n  }) as T\n  return Object.freeze({\n    value,\n    get bytes(): Uint8Array {\n      return Uint8Array.from(bytes)\n    },\n    digest,\n  })\n}\n\nexport function verifyCanonicalCandidateDocument<T extends { digest: Sha256Digest }>(\n  value: T,\n  label: string,\n): T {\n  if (canonicalCandidateDigest(omitTopLevelDigest(value)) !== value.digest) {\n    throw new Error(`${label} digest does not match`)\n  }\n  return immutableCandidateValue(value)\n}\n\nexport function embeddedCandidateArtifact(bytes: Uint8Array): AgentCandidateEmbeddedArtifact {\n  return {\n    encoding: 'base64',\n    content: Buffer.from(bytes).toString('base64'),\n    sha256: sha256Bytes(bytes),\n    byteLength: bytes.byteLength,\n  }\n}\n\nexport function omitTopLevelDigest<T extends { digest: Sha256Digest }>(\n  value: T,\n): Omit<T, 'digest'> {\n  const { digest: _digest, ...rest } = value\n  return rest\n}\n\nexport function deepFreezeCandidate<T>(value: T, seen = new Set<object>()): T {\n  if (\n    value === null ||\n    typeof value !== 'object' ||\n    ArrayBuffer.isView(value) ||\n    seen.has(value as object)\n  ) {\n    return value\n  }\n  seen.add(value as object)\n  for (const child of Object.values(value as Record<string, unknown>)) {\n    deepFreezeCandidate(child, seen)\n  }\n  return Object.freeze(value)\n}\n","import { createHash } from 'node:crypto'\nimport { constants as fsConstants } from 'node:fs'\nimport { lstat, open, readdir, readlink, realpath } from 'node:fs/promises'\nimport { dirname, isAbsolute, relative, resolve, sep } from 'node:path'\n\nimport type {\n  AgentCandidateArtifactRef,\n  AgentCandidateCapturedArtifact,\n  AgentCandidateProfilePlanMaterial,\n  AgentCandidateWorkspaceManifestMaterial,\n  AgentCandidateWorkspaceSnapshotEvidence,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateBytes, sha256Bytes } from './digest'\nimport type { AgentCandidateArtifactPort } from './types'\n\nexport function artifactCacheKey(artifact: AgentCandidateCapturedArtifact): string {\n  return `${artifact.sha256}:${artifact.byteLength}`\n}\n\nexport async function readVerifiedArtifact(\n  artifact: AgentCandidateCapturedArtifact,\n  port: AgentCandidateArtifactPort,\n): Promise<Uint8Array> {\n  const bytes =\n    'content' in artifact\n      ? Buffer.from(artifact.content, 'base64')\n      : await port.read(artifact as AgentCandidateArtifactRef)\n  verifyBytes(bytes, artifact.sha256, artifact.byteLength, 'candidate artifact')\n  return Uint8Array.from(bytes)\n}\n\nexport function verifyBytes(\n  bytes: Uint8Array,\n  digest: string,\n  byteLength: number,\n  label: string,\n): void {\n  if (bytes.byteLength !== byteLength) {\n    throw new Error(`${label} byte length ${bytes.byteLength} does not match ${byteLength}`)\n  }\n  const actual = sha256Bytes(bytes)\n  if (actual !== digest) {\n    throw new Error(`${label} digest ${actual} does not match ${digest}`)\n  }\n}\n\nexport async function verifyWorkspaceSnapshotArtifacts(\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n  port: AgentCandidateArtifactPort,\n): Promise<{ manifest: Uint8Array; archive: Uint8Array }> {\n  const [manifest, archive] = await Promise.all([\n    readVerifiedArtifact(snapshot.manifest, port),\n    readVerifiedArtifact(snapshot.archive, port),\n  ])\n  const canonicalManifest = canonicalCandidateBytes(snapshot.material)\n  if (!Buffer.from(manifest).equals(Buffer.from(canonicalManifest))) {\n    throw new Error('workspace manifest artifact is not the exact canonical manifest material')\n  }\n  if (sha256Bytes(canonicalManifest) !== snapshot.digest) {\n    throw new Error('workspace snapshot digest does not match its canonical manifest material')\n  }\n  return { manifest, archive }\n}\n\n/** The per-scan caps a bounded capture applies. */\nexport interface WorkspaceScanLimits {\n  readonly maxFiles: number\n  readonly maxFileBytes: number\n  readonly maxTotalFileBytes: number\n}\n\n/** What a workspace scan reads and how it records a file's permission bits. */\nexport interface WorkspaceScanOptions {\n  readonly ignoredProtectedRootEntries?: readonly ('.git' | '.sidecar')[]\n  readonly limits?: WorkspaceScanLimits\n  /**\n   * Record Git's two file modes instead of the filesystem's exact permission bits: `0o755` when\n   * any execute bit is set, `0o644` otherwise. A checkout umask then cannot move a manifest\n   * digest, while a real permission change still does.\n   *\n   * This is the normalization `readCandidateGitTreeFiles` already applies to a Git tree\n   * (`100644`/`100755`), so one tree scanned from disk and the same tree read out of Git produce\n   * the same manifest. Off by default: the flag changes the digest, so a capture and the verify\n   * that checks it must agree on it.\n   */\n  readonly portableTree?: boolean\n}\n\n/**\n * Refuse a materialized workspace whose files, modes, or bytes are not the signed manifest.\n *\n * The scan streams, so the size of the largest file does not decide whether the check can run, and\n * the refusal names the one mismatch a caller can produce on its own: a capture and a verify that\n * disagree about `portableTree`.\n */\nexport async function verifyMaterializedWorkspace(\n  root: string,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n  options: Omit<WorkspaceScanOptions, 'limits'> = {},\n): Promise<void> {\n  assertWorkspaceManifest(await scanMaterializedWorkspaceManifest(root, options), expected)\n}\n\n/**\n * The canonical manifest of one materialized workspace, read without holding any file.\n *\n * Every file is digested by streaming, so the size of the largest file does not decide whether the\n * workspace can be described. `FileHandle.readFile` refuses anything above 2 GiB with\n * `ERR_FS_FILE_TOO_LARGE`, which made a workspace holding one such artifact impossible to verify\n * against a manifest it already matched. The digest is sha-256 over the same bytes either way, so\n * a manifest a buffered read produced is reproduced exactly.\n */\nexport async function scanMaterializedWorkspaceManifest(\n  root: string,\n  options: WorkspaceScanOptions = {},\n): Promise<AgentCandidateWorkspaceManifestMaterial> {\n  return workspaceManifestFromEntries(await walkWorkspace(root, options, false))\n}\n\nexport async function captureMaterializedWorkspace(\n  root: string,\n  options: WorkspaceScanOptions = {},\n): Promise<{\n  manifest: AgentCandidateWorkspaceManifestMaterial\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>\n}> {\n  const entries = await walkWorkspace(root, options, true)\n  return {\n    manifest: workspaceManifestFromEntries(entries),\n    files: entries.map((entry) => ({\n      path: entry.path,\n      mode: entry.mode,\n      bytes: Uint8Array.from(capturedBytes(entry)),\n    })),\n  }\n}\n\n/** Capture exact verified regular-file bytes for fresh isolated materialization. */\nexport async function readMaterializedWorkspaceFiles(\n  root: string,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n  options: WorkspaceScanOptions = {},\n): Promise<ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>> {\n  const observed = await captureMaterializedWorkspace(root, options)\n  assertWorkspaceManifest(observed.manifest, expected)\n  return observed.files.map((file) =>\n    Object.freeze({ path: file.path, mode: file.mode, bytes: Uint8Array.from(file.bytes) }),\n  )\n}\n\n/**\n * Build the canonical manifest for files a caller already holds — the shape a remote executor\n * returns. Pass `portableTree` to record Git's two file modes instead of exact permission bits, and\n * pass the same flag to every verify that reads the result.\n */\nexport function candidateWorkspaceManifest(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  options: { portableTree?: boolean } = {},\n): AgentCandidateWorkspaceManifestMaterial {\n  return workspaceManifestFromEntries(\n    files.map((file) => ({\n      path: file.path,\n      mode: options.portableTree === true ? portableFileMode(file.mode) : file.mode,\n      sha256: sha256Bytes(file.bytes),\n      byteLength: file.bytes.byteLength,\n    })),\n  )\n}\n\nfunction workspaceManifestFromEntries(\n  entries: ReadonlyArray<{\n    path: string\n    mode: number\n    sha256: Sha256Digest\n    byteLength: number\n  }>,\n): AgentCandidateWorkspaceManifestMaterial {\n  return {\n    kind: 'agent-candidate-workspace-manifest',\n    files: entries\n      .map((entry) => ({\n        path: entry.path,\n        mode: entry.mode,\n        sha256: entry.sha256,\n        byteLength: entry.byteLength,\n      }))\n      .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)),\n  }\n}\n\n/** Git records exactly two file modes, and a portable-tree scan records the same two. */\nfunction portableFileMode(mode: number): number {\n  return (mode & 0o111) !== 0 ? 0o755 : 0o644\n}\n\nfunction capturedBytes(entry: ScannedWorkspaceEntry): Buffer {\n  if (!entry.bytes) throw new Error(`workspace file was digested without its bytes: ${entry.path}`)\n  return entry.bytes\n}\n\nfunction assertWorkspaceManifest(\n  observed: AgentCandidateWorkspaceManifestMaterial,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n): void {\n  if (Buffer.from(canonicalCandidateBytes(observed)).equals(canonicalCandidateBytes(expected))) {\n    return\n  }\n  // The one mismatch a caller can produce by passing `portableTree` on one side of a\n  // capture/verify pair and not the other. Named, because the general refusal below reads as\n  // changed bytes and would send a reader looking for a file that never changed. Comparing the\n  // two manifests already in hand costs no second walk.\n  if (\n    Buffer.from(canonicalCandidateBytes(withPortableModes(observed))).equals(\n      canonicalCandidateBytes(withPortableModes(expected)),\n    )\n  ) {\n    throw new Error(\n      'materialized workspace files do not match the signed manifest: only the file modes differ, ' +\n        'so the capture and this verify disagree about portableTree',\n    )\n  }\n  throw new Error('materialized workspace files, modes, or bytes do not match the signed manifest')\n}\n\nfunction withPortableModes(\n  material: AgentCandidateWorkspaceManifestMaterial,\n): AgentCandidateWorkspaceManifestMaterial {\n  return {\n    ...material,\n    files: material.files.map((file) => ({ ...file, mode: portableFileMode(file.mode) })),\n  }\n}\n\nexport async function verifyMaterializedProfileWorkspace(\n  root: string,\n  expected: AgentCandidateProfilePlanMaterial,\n  fileRoot: 'workspace' | 'agent' = 'workspace',\n): Promise<void> {\n  const observed = await scanMaterializedWorkspaceManifest(root)\n  const observedProfile = observed.files.map(({ path, mode, sha256 }) => ({\n    relPath: path,\n    mode,\n    contentSha256: sha256,\n  }))\n  const expectedFiles = expected.files\n    .filter((file) => (file.root ?? 'workspace') === fileRoot)\n    .map(({ root: _root, ...file }) => file)\n  if (\n    !Buffer.from(canonicalCandidateBytes(observedProfile)).equals(\n      canonicalCandidateBytes(expectedFiles),\n    )\n  ) {\n    throw new Error(\n      `profile ${fileRoot} staging files, modes, or bytes do not match the signed profile plan`,\n    )\n  }\n}\n\ninterface ScannedWorkspaceEntry {\n  readonly path: string\n  readonly mode: number\n  readonly sha256: Sha256Digest\n  readonly byteLength: number\n  /** Present only when the walk was asked to keep bytes. */\n  readonly bytes?: Buffer\n}\n\nasync function walkWorkspace(\n  root: string,\n  options: WorkspaceScanOptions,\n  keepBytes: boolean,\n): Promise<ScannedWorkspaceEntry[]> {\n  const ignoredProtectedRootEntries = new Set<string>(options.ignoredProtectedRootEntries ?? [])\n  const limits = options.limits\n  // Scan the RESOLVED root. The property this guards is that every captured path lies under\n  // one real directory with no aliasing, which resolving satisfies directly — rejecting a\n  // symlinked prefix outright does not, and makes the scan impossible on macOS, where the\n  // OS itself hands out temp paths under /var, a symlink to /private/var. Symlinks INSIDE\n  // the workspace are still refused entry by entry below, with O_NOFOLLOW on every open.\n  const requestedRoot = resolve(root)\n  const rootStats = await lstat(requestedRoot)\n  if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) {\n    throw new Error('workspace root must be a real directory')\n  }\n  const absoluteRoot = await realpath(requestedRoot)\n  const resolvedStats = await lstat(absoluteRoot)\n  if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) {\n    throw new Error('workspace root must resolve to a real directory')\n  }\n  const scanned: ScannedWorkspaceEntry[] = []\n  let totalBytes = 0\n\n  async function visit(directory: string): Promise<void> {\n    const entries = await readdir(directory, { withFileTypes: true })\n    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))\n    for (const entry of entries) {\n      if (directory === absoluteRoot && ignoredProtectedRootEntries.has(entry.name)) {\n        continue\n      }\n      const absolute = resolve(directory, entry.name)\n      const relPath = relative(absoluteRoot, absolute).split(sep).join('/')\n      if (!relPath || relPath.startsWith('../') || relPath.includes('/../')) {\n        throw new Error(`workspace entry escapes root: ${relPath}`)\n      }\n      const stats = await lstat(absolute)\n      if (stats.isSymbolicLink()) {\n        throw new Error(await symlinkRefusal(absolute, relPath, absoluteRoot))\n      }\n      if (stats.isDirectory()) {\n        await visit(absolute)\n        continue\n      }\n      if (!stats.isFile()) {\n        throw new Error(`workspace contains a non-regular entry: ${relPath}`)\n      }\n      if (limits && scanned.length >= limits.maxFiles) {\n        throw new Error('workspace exceeds maxFiles')\n      }\n      const descriptor = await open(\n        absolute,\n        fsConstants.O_RDONLY |\n          (typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0),\n      )\n      try {\n        const openedStats = await descriptor.stat()\n        if (!openedStats.isFile()) {\n          throw new Error(`workspace contains a non-regular entry: ${relPath}`)\n        }\n        if (openedStats.nlink !== 1) {\n          throw new Error(`workspace contains a hard-linked file: ${relPath}`)\n        }\n        const mode =\n          options.portableTree === true\n            ? portableFileMode(openedStats.mode)\n            : openedStats.mode & 0o777\n        if (limits && openedStats.size > limits.maxFileBytes) {\n          throw new Error(`workspace file exceeds maxFileBytes: ${relPath}`)\n        }\n        const remainingBytes = limits ? limits.maxTotalFileBytes - totalBytes : undefined\n        if (remainingBytes !== undefined && openedStats.size > remainingBytes) {\n          throw new Error('workspace exceeds maxTotalFileBytes')\n        }\n        const read = await readWorkspaceFile(\n          descriptor,\n          limits ? Math.min(limits.maxFileBytes, remainingBytes ?? limits.maxFileBytes) : undefined,\n          keepBytes,\n          relPath,\n        )\n        totalBytes += read.byteLength\n        scanned.push({\n          path: relPath,\n          mode,\n          sha256: read.sha256,\n          byteLength: read.byteLength,\n          ...(read.bytes === undefined ? {} : { bytes: read.bytes }),\n        })\n      } finally {\n        await descriptor.close()\n      }\n    }\n  }\n\n  await visit(absoluteRoot)\n  return scanned\n}\n\n/**\n * Why one symbolic link is refused, in the terms that separate a portable link from a link that\n * reaches outside the tree.\n *\n * Every link is refused, in both mode policies. `AgentCandidateWorkspaceManifestMaterial` has no\n * representation for one — `mode`, `sha256` and `byteLength` describe a regular file — so a link\n * recorded as a file would let two different trees share one digest. The reason says which kind of\n * link it was, so a caller can tell a link it can rewrite from one it cannot.\n */\nasync function symlinkRefusal(\n  absolute: string,\n  relPath: string,\n  absoluteRoot: string,\n): Promise<string> {\n  const target = await readlink(absolute)\n  if (isAbsolute(target)) {\n    return `workspace contains an absolute symlink: ${relPath} -> ${target}`\n  }\n  if (!isWithin(absoluteRoot, resolve(dirname(absolute), target))) {\n    return `workspace contains a symlink that escapes its tree: ${relPath} -> ${target}`\n  }\n  let physical: string\n  try {\n    physical = await realpath(absolute)\n  } catch {\n    return `workspace contains an unresolved symlink: ${relPath} -> ${target}`\n  }\n  if (!isWithin(absoluteRoot, physical)) {\n    return `workspace contains a symlink that resolves outside its tree: ${relPath} -> ${target}`\n  }\n  return `workspace contains a symlink: ${relPath} -> ${target}`\n}\n\nfunction isWithin(root: string, path: string): boolean {\n  return path === root || path.startsWith(`${root}${sep}`)\n}\n\n/**\n * Read one open regular file into its digest, keeping the bytes only when the caller needs them.\n *\n * The content reaches the hash in 1 MiB chunks and is never held whole for a digest-only walk, so\n * the size of the largest file does not decide whether a workspace can be described.\n * `FileHandle.readFile` refuses anything above 2 GiB with `ERR_FS_FILE_TOO_LARGE`. Hashing the\n * chunks in order equals hashing the whole buffer, so a manifest a buffered read produced is\n * reproduced byte for byte.\n */\nasync function readWorkspaceFile(\n  descriptor: Awaited<ReturnType<typeof open>>,\n  maxBytes: number | undefined,\n  keepBytes: boolean,\n  path: string,\n): Promise<{ sha256: Sha256Digest; byteLength: number; bytes?: Buffer }> {\n  const hash = createHash('sha256')\n  const buffer = Buffer.allocUnsafe(1024 * 1024)\n  const chunks: Buffer[] = []\n  let total = 0\n  while (true) {\n    const { bytesRead } = await descriptor.read(buffer, 0, buffer.byteLength, null)\n    if (bytesRead === 0) break\n    total += bytesRead\n    if (maxBytes !== undefined && total > maxBytes) {\n      throw new Error(`workspace file exceeds its capture limit: ${path}`)\n    }\n    const chunk = buffer.subarray(0, bytesRead)\n    hash.update(chunk)\n    // The read buffer is reused, so a kept chunk has to be copied out of it.\n    if (keepBytes) chunks.push(Buffer.from(chunk))\n  }\n  const sha256 = `sha256:${hash.digest('hex')}` as Sha256Digest\n  return keepBytes\n    ? { sha256, byteLength: total, bytes: Buffer.concat(chunks, total) }\n    : { sha256, byteLength: total }\n}\n","/** Reject unknown fields while requiring every declared non-optional field. */\nexport function assertExactObjectKeys(\n  value: unknown,\n  required: readonly string[],\n  label: string,\n  optional: readonly string[] = [],\n): void {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`${label} must be an object`)\n  }\n  const allowed = new Set([...required, ...optional])\n  if (allowed.size !== required.length + optional.length) {\n    throw new Error(`${label} exact-key contract contains duplicate fields`)\n  }\n  for (const key of Object.keys(value)) {\n    if (!allowed.has(key)) throw new Error(`${label} contains unknown field ${key}`)\n  }\n  for (const key of required) {\n    if (!(key in value)) throw new Error(`${label} is missing field ${key}`)\n  }\n}\n\n/**\n * Reject a string carrying a lone surrogate. A well-formed UTF-16 string round-trips through UTF-8\n * unchanged; a lone surrogate does not, so a value that passes here is safe to persist and re-read\n * as the same bytes.\n */\nexport function isWellFormedUnicode(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1)\n      if (!(next >= 0xdc00 && next <= 0xdfff)) return false\n      index++\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      return false\n    }\n  }\n  return true\n}\n","import { spawn } from 'node:child_process'\nimport { mkdir, mkdtemp, readFile, realpath, rm, stat } from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { join, resolve } from 'node:path'\n\nimport type {\n  AgentCandidateCode,\n  AgentCandidateGitHubRepository,\n  AgentCandidateGitHubResource,\n  AgentCandidateWorkspaceManifestMaterial,\n} from '@tangle-network/agent-interface'\n\nimport { candidateWorkspaceManifest, verifyBytes } from './artifacts'\nimport { canonicalCandidateBytes } from './digest'\nimport type { AgentCandidateRepositoryPort } from './types'\n\ninterface GitResult {\n  stdout: Buffer\n  stderr: Buffer\n}\n\nexport async function verifyCandidateCode(\n  code: AgentCandidateCode,\n  repositories: AgentCandidateRepositoryPort,\n  patchBytes?: Uint8Array,\n): Promise<string | undefined> {\n  if (code.kind === 'disabled') return undefined\n  const repositoryRoot = await verifiedRepositoryRoot(code.repository, repositories)\n  await assertCommitAndBaseTree(repositoryRoot, code.baseCommit, code.baseTree)\n\n  if (code.kind === 'no-op') {\n    await assertSafeTree(repositoryRoot, code.baseTree)\n    return code.baseTree\n  }\n  if (!patchBytes) throw new Error('git-patch candidate is missing verified patch bytes')\n\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-git-'))\n  try {\n    const indexFile = join(temporary, 'index')\n    await runCandidateGit(repositoryRoot, ['read-tree', code.baseTree], undefined, {\n      GIT_INDEX_FILE: indexFile,\n    })\n    await runCandidateGit(\n      repositoryRoot,\n      ['apply', '--cached', '--binary', '--whitespace=nowarn', '-'],\n      patchBytes,\n      { GIT_INDEX_FILE: indexFile },\n    )\n    const candidateTree = (\n      await runCandidateGit(repositoryRoot, ['write-tree'], undefined, {\n        GIT_INDEX_FILE: indexFile,\n      })\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (candidateTree !== code.candidateTree) {\n      throw new Error(\n        `git patch materialized tree ${candidateTree} does not match ${code.candidateTree}`,\n      )\n    }\n    await assertSafeTree(repositoryRoot, candidateTree)\n    return candidateTree\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nexport async function readCandidateGitHubResource(\n  resource: AgentCandidateGitHubResource,\n  repositories: AgentCandidateRepositoryPort,\n): Promise<Uint8Array> {\n  const repositoryRoot = await verifiedRepositoryRoot(resource.repository, repositories)\n  const commitType = (\n    await runCandidateGit(repositoryRoot, ['cat-file', '-t', resource.commit])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (commitType !== 'commit') {\n    throw new Error(`GitHub resource commit is not a commit object: ${resource.commit}`)\n  }\n  const listing = (\n    await runCandidateGit(repositoryRoot, ['ls-tree', '-z', resource.commit, '--', resource.path])\n  ).stdout\n  const entries = parseTreeEntries(listing)\n  if (entries.length !== 1 || entries[0]?.path !== resource.path) {\n    throw new Error(`GitHub resource path is not one exact file: ${resource.path}`)\n  }\n  const entry = entries[0]\n  if (entry?.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n    throw new Error(`GitHub resource path is not a regular Git blob: ${resource.path}`)\n  }\n  const bytes = (await runCandidateGit(repositoryRoot, ['cat-file', 'blob', entry.object])).stdout\n  verifyBytes(bytes, resource.sha256, resource.byteLength, `GitHub resource ${resource.path}`)\n  return Uint8Array.from(bytes)\n}\n\nexport async function verifyTaskCheckout(\n  taskRoot: string,\n  expected: { baseCommit: string; baseTree: string },\n): Promise<void> {\n  const root = resolve(taskRoot)\n  const head = (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout.toString('utf8').trim()\n  if (head !== expected.baseCommit) {\n    throw new Error(`task checkout HEAD ${head} does not match ${expected.baseCommit}`)\n  }\n  const tree = (await runCandidateGit(root, ['rev-parse', 'HEAD^{tree}'])).stdout\n    .toString('utf8')\n    .trim()\n  if (tree !== expected.baseTree) {\n    throw new Error(`task checkout base tree ${tree} does not match ${expected.baseTree}`)\n  }\n}\n\n/**\n * Apply an evaluator-captured binary diff in a detached object database and\n * prove its result tree exactly matches the captured after-state manifest.\n */\nexport async function verifyTaskOutcomePatch(input: {\n  repositoryRoot: string\n  baseCommit: string\n  baseTree: string\n  resultTree: string\n  patch: Uint8Array\n  afterState: AgentCandidateWorkspaceManifestMaterial\n}): Promise<{ resultTree: string; resultCommit: string }> {\n  const repositoryRoot = resolve(input.repositoryRoot)\n  await verifyTaskCheckout(repositoryRoot, input)\n  const gitDir = resolve(\n    (await runCandidateGit(repositoryRoot, ['rev-parse', '--absolute-git-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(gitDir)) !== gitDir || gitDir.includes(':')) {\n    throw new Error('task Git object store has an unsupported path')\n  }\n  await assertNoGitIndirection(repositoryRoot, gitDir, 'task repository')\n\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-task-outcome-'))\n  try {\n    const objectDirectory = join(temporary, 'objects')\n    const indexFile = join(temporary, 'index')\n    await mkdir(objectDirectory)\n    const gitEnvironment = {\n      GIT_INDEX_FILE: indexFile,\n      GIT_OBJECT_DIRECTORY: objectDirectory,\n      GIT_ALTERNATE_OBJECT_DIRECTORIES: join(gitDir, 'objects'),\n    }\n    await runCandidateGit(repositoryRoot, ['read-tree', input.baseTree], undefined, gitEnvironment)\n    if (input.patch.byteLength > 0) {\n      await runCandidateGit(\n        repositoryRoot,\n        ['apply', '--cached', '--binary', '--whitespace=nowarn', '-'],\n        input.patch,\n        gitEnvironment,\n      )\n    }\n    const resultTree = (\n      await runCandidateGit(repositoryRoot, ['write-tree'], undefined, gitEnvironment)\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (resultTree !== input.resultTree) {\n      throw new Error(\n        `task outcome patch materialized tree ${resultTree} does not match ${input.resultTree}`,\n      )\n    }\n    await assertSafeTree(repositoryRoot, resultTree, gitEnvironment)\n    const observed = await workspaceManifestFromGitTree(repositoryRoot, resultTree, gitEnvironment)\n    if (\n      !Buffer.from(canonicalCandidateBytes(observed)).equals(\n        Buffer.from(canonicalCandidateBytes(input.afterState)),\n      )\n    ) {\n      throw new Error('task outcome after-state does not match the materialized result tree')\n    }\n    const resultCommit = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['commit-tree', resultTree, '-p', input.baseCommit],\n        Buffer.from('candidate task outcome\\n', 'utf8'),\n        {\n          ...gitEnvironment,\n          GIT_AUTHOR_NAME: 'Tangle Evaluator',\n          GIT_AUTHOR_EMAIL: 'evaluator@tangle.tools',\n          GIT_AUTHOR_DATE: '2000-01-01T00:00:00Z',\n          GIT_COMMITTER_NAME: 'Tangle Evaluator',\n          GIT_COMMITTER_EMAIL: 'evaluator@tangle.tools',\n          GIT_COMMITTER_DATE: '2000-01-01T00:00:00Z',\n        },\n      )\n    ).stdout\n      .toString('utf8')\n      .trim()\n    const committedTree = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['rev-parse', `${resultCommit}^{tree}`],\n        undefined,\n        gitEnvironment,\n      )\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (committedTree !== resultTree) {\n      throw new Error('task outcome evaluator commit does not bind the verified result tree')\n    }\n    return { resultTree, resultCommit }\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nasync function verifiedRepositoryRoot(\n  repository: AgentCandidateGitHubRepository,\n  repositories: AgentCandidateRepositoryPort,\n): Promise<string> {\n  const repositoryRoot = resolve(await repositories.resolve(repository))\n  const rootStats = await stat(repositoryRoot)\n  if (!rootStats.isDirectory()) throw new Error('candidate repository path is not a directory')\n\n  const origin = (await runCandidateGit(repositoryRoot, ['remote', 'get-url', 'origin'])).stdout\n    .toString('utf8')\n    .trim()\n  const actual = parseGitHubRemote(origin)\n  if (!actual || actual.owner !== repository.owner || actual.repo !== repository.repo) {\n    throw new Error(\n      `local repository origin ${origin || '<missing>'} does not match github.com/${repository.owner}/${repository.repo}`,\n    )\n  }\n\n  const gitDirText = (\n    await runCandidateGit(repositoryRoot, ['rev-parse', '--absolute-git-dir'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  const gitDir = resolve(gitDirText)\n  await assertNoGitIndirection(repositoryRoot, gitDir, 'candidate repository')\n  return repositoryRoot\n}\n\nexport async function assertNoGitIndirection(\n  repositoryRoot: string,\n  gitDir: string,\n  label: string,\n): Promise<void> {\n  const replacements = (\n    await runCandidateGit(repositoryRoot, ['for-each-ref', '--format=%(refname)', 'refs/replace'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (replacements) throw new Error(`${label} contains Git replace refs`)\n  // `--git-common-dir` answers relative to the worktree for an ordinary repository, so the\n  // path is resolved against a root the caller supplied and carries whatever symlinks that\n  // root carries. Read the object store through its RESOLVED path: the alternates below must\n  // be read at the real location, and a symlinked prefix is the OS's own doing on macOS,\n  // where a temp root lives under /var, a symlink to /private/var.\n  const commonDir = await realpath(\n    resolve(\n      repositoryRoot,\n      (await runCandidateGit(repositoryRoot, ['rev-parse', '--git-common-dir'])).stdout\n        .toString('utf8')\n        .trim(),\n    ),\n  )\n  if (commonDir.includes(':')) {\n    throw new Error(`${label} Git common directory has an unsupported path`)\n  }\n  for (const objectRoot of new Set([gitDir, commonDir])) {\n    for (const name of ['alternates', 'http-alternates']) {\n      const path = join(objectRoot, 'objects', 'info', name)\n      try {\n        const contents = await readFile(path, 'utf8')\n        if (contents.trim()) throw new Error(`${label} uses forbidden Git ${name}`)\n      } catch (error) {\n        if (!isNoEntry(error)) throw error\n      }\n    }\n  }\n}\n\nasync function assertCommitAndBaseTree(\n  repositoryRoot: string,\n  commit: string,\n  expectedTree: string,\n): Promise<void> {\n  const type = (await runCandidateGit(repositoryRoot, ['cat-file', '-t', commit])).stdout\n    .toString('utf8')\n    .trim()\n  if (type !== 'commit') throw new Error(`candidate base object is not a commit: ${commit}`)\n  const actualTree = (\n    await runCandidateGit(repositoryRoot, ['rev-parse', `${commit}^{tree}`])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (actualTree !== expectedTree) {\n    throw new Error(`candidate base commit tree ${actualTree} does not match ${expectedTree}`)\n  }\n}\n\nasync function assertSafeTree(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string> = {},\n): Promise<void> {\n  const listing = (\n    await runCandidateGit(\n      repositoryRoot,\n      ['ls-tree', '-rz', '--full-tree', tree],\n      undefined,\n      environment,\n    )\n  ).stdout\n  const entries = parseTreeEntries(listing)\n  if (entries.length === 0) throw new Error('candidate Git tree cannot be empty')\n  for (const entry of entries) {\n    if (entry.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n      throw new Error(\n        `candidate Git tree contains a symlink, submodule, or non-blob: ${entry.path}`,\n      )\n    }\n    assertSafeGitPath(entry.path)\n  }\n}\n\nasync function workspaceManifestFromGitTree(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string>,\n): Promise<AgentCandidateWorkspaceManifestMaterial> {\n  return candidateWorkspaceManifest(\n    await readCandidateGitTreeFiles(repositoryRoot, tree, environment),\n  )\n}\n\nexport async function readCandidateGitTreeFiles(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string> = {},\n  limits?: { maxFiles: number; maxFileBytes: number; maxTotalFileBytes: number },\n): Promise<Array<{ path: string; mode: 0o644 | 0o755; bytes: Uint8Array }>> {\n  const listing = (\n    await runCandidateGit(\n      repositoryRoot,\n      ['ls-tree', '-rzl', '--full-tree', tree],\n      undefined,\n      environment,\n    )\n  ).stdout\n  const files: Array<{ path: string; mode: 0o644 | 0o755; bytes: Uint8Array }> = []\n  const entries = parseTreeEntries(listing)\n  if (limits && entries.length > limits.maxFiles) {\n    throw new Error('candidate Git tree exceeds maxFiles')\n  }\n  let totalBytes = 0\n  for (const entry of entries) {\n    if (entry.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n      throw new Error(`candidate Git tree contains a non-regular file: ${entry.path}`)\n    }\n    assertSafeGitPath(entry.path)\n    if (entry.size === undefined) {\n      throw new Error(`candidate Git tree is missing blob size: ${entry.path}`)\n    }\n    if (limits && entry.size > limits.maxFileBytes) {\n      throw new Error(`candidate Git tree file exceeds maxFileBytes: ${entry.path}`)\n    }\n    totalBytes += entry.size\n    if (limits && totalBytes > limits.maxTotalFileBytes) {\n      throw new Error('candidate Git tree exceeds maxTotalFileBytes')\n    }\n    const bytes = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['cat-file', 'blob', entry.object],\n        undefined,\n        environment,\n      )\n    ).stdout\n    if (bytes.byteLength !== entry.size) {\n      throw new Error(`candidate Git blob size changed: ${entry.path}`)\n    }\n    files.push({\n      path: entry.path,\n      mode: entry.mode === '100755' ? 0o755 : 0o644,\n      bytes: Uint8Array.from(bytes),\n    })\n  }\n  return files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))\n}\n\nfunction parseTreeEntries(bytes: Uint8Array): Array<{\n  mode: string\n  type: string\n  object: string\n  size?: number\n  path: string\n}> {\n  const raw = Buffer.from(bytes)\n  const decoded = raw.toString('utf8')\n  if (!Buffer.from(decoded, 'utf8').equals(raw)) {\n    throw new Error('candidate Git tree contains a non-UTF-8 path')\n  }\n  const rows = decoded.split('\\0').filter(Boolean)\n  return rows.map((row) => {\n    const tab = row.indexOf('\\t')\n    const header = row.slice(0, tab).split(' ').filter(Boolean)\n    const path = row.slice(tab + 1)\n    const [mode, type, object, sizeText] = header\n    if (tab < 1 || !mode || !type || !object || !path) {\n      throw new Error('malformed Git tree entry')\n    }\n    const size = sizeText && /^\\d+$/.test(sizeText) ? Number(sizeText) : undefined\n    if (size !== undefined && !Number.isSafeInteger(size)) {\n      throw new Error('candidate Git tree entry size exceeds the safe integer range')\n    }\n    return { mode, type, object, ...(size === undefined ? {} : { size }), path }\n  })\n}\n\nfunction assertSafeGitPath(path: string): void {\n  if (\n    !path ||\n    path.startsWith('/') ||\n    path.includes('\\\\') ||\n    path.includes('\\0') ||\n    hasControlCharacter(path) ||\n    path.split('/').some((part) => !part || part === '.' || part === '..') ||\n    path.split('/')[0]?.toLowerCase() === '.git'\n  ) {\n    throw new Error(`candidate Git tree contains an unsafe path: ${path}`)\n  }\n}\n\nfunction hasControlCharacter(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code < 0x20 || code === 0x7f) return true\n  }\n  return false\n}\n\nfunction parseGitHubRemote(value: string): { owner: string; repo: string } | undefined {\n  const match = value.match(\n    /^(?:https?:\\/\\/github\\.com\\/|ssh:\\/\\/git@github\\.com\\/|git@github\\.com:)([^/]+)\\/([^/]+?)(?:\\.git)?$/,\n  )\n  if (!match?.[1] || !match[2]) return undefined\n  return { owner: match[1], repo: match[2] }\n}\n\nexport async function runCandidateGit(\n  repositoryRoot: string,\n  args: string[],\n  input?: Uint8Array,\n  extraEnv: Record<string, string> = {},\n): Promise<GitResult> {\n  const env = Object.fromEntries(\n    Object.entries(process.env).filter(([name]) => !name.startsWith('GIT_')),\n  ) as Record<string, string>\n  Object.assign(env, {\n    GIT_CONFIG_NOSYSTEM: '1',\n    GIT_CONFIG_GLOBAL: '/dev/null',\n    GIT_CONFIG_SYSTEM: '/dev/null',\n    GIT_TERMINAL_PROMPT: '0',\n    GIT_NO_REPLACE_OBJECTS: '1',\n    LC_ALL: 'C',\n    ...extraEnv,\n  })\n  const fullArgs = [\n    '-c',\n    'core.hooksPath=/dev/null',\n    '-c',\n    'core.fsmonitor=false',\n    '-c',\n    'core.untrackedCache=false',\n    '-c',\n    'protocol.file.allow=never',\n    '-C',\n    repositoryRoot,\n    ...args,\n  ]\n  return await new Promise((resolveResult, reject) => {\n    const child = spawn('git', fullArgs, { env, stdio: ['pipe', 'pipe', 'pipe'] })\n    const stdout: Buffer[] = []\n    const stderr: Buffer[] = []\n    child.stdout.on('data', (chunk: Buffer) => stdout.push(chunk))\n    child.stderr.on('data', (chunk: Buffer) => stderr.push(chunk))\n    child.on('error', reject)\n    child.on('close', (code, signal) => {\n      const out = Buffer.concat(stdout)\n      const err = Buffer.concat(stderr)\n      if (code !== 0) {\n        reject(\n          new Error(\n            `git ${args[0] ?? '<command>'} failed (${signal ?? code}): ${err.toString('utf8').trim()}`,\n          ),\n        )\n        return\n      }\n      resolveResult({ stdout: out, stderr: err })\n    })\n    if (input) child.stdin.end(input)\n    else child.stdin.end()\n  })\n}\n\nfunction isNoEntry(error: unknown): boolean {\n  return (\n    typeof error === 'object' &&\n    error !== null &&\n    'code' in error &&\n    (error as { code?: string }).code === 'ENOENT'\n  )\n}\n","import {\n  type AgentCandidateArtifactRef,\n  agentCandidateArtifactRefSchema,\n} from '@tangle-network/agent-interface'\n\nimport { verifyBytes } from './artifacts'\nimport { immutableCandidateValue, sha256Bytes } from './digest'\nimport type { AgentCandidateOutputArtifactPort, AgentCandidateOutputPurpose } from './types'\n\n/** Persist evaluator evidence, read it back, and bind the returned locator to the exact bytes. */\nexport async function persistCandidateOutputArtifact(\n  port: AgentCandidateOutputArtifactPort,\n  input: {\n    executionId: string\n    purpose: AgentCandidateOutputPurpose\n    bytes: Uint8Array\n    signal?: AbortSignal\n  },\n): Promise<AgentCandidateArtifactRef> {\n  input.signal?.throwIfAborted()\n  const bytes = Uint8Array.from(input.bytes)\n  const expectedDigest = sha256Bytes(bytes)\n  const ref = agentCandidateArtifactRefSchema.parse(\n    await port.put({\n      executionId: input.executionId,\n      purpose: input.purpose,\n      bytes: Uint8Array.from(bytes),\n      ...(input.signal ? { signal: input.signal } : {}),\n    }),\n  )\n  input.signal?.throwIfAborted()\n  if (ref.sha256 !== expectedDigest || ref.byteLength !== bytes.byteLength) {\n    throw new Error('candidate output locator does not identify the submitted bytes')\n  }\n  const stored = await port.read(ref)\n  input.signal?.throwIfAborted()\n  verifyBytes(stored, expectedDigest, bytes.byteLength, 'persisted candidate output')\n  return immutableCandidateValue(ref)\n}\n","import { randomUUID } from 'node:crypto'\nimport { constants as fsConstants } from 'node:fs'\nimport {\n  lstat,\n  mkdir,\n  mkdtemp,\n  open,\n  readdir,\n  readFile,\n  realpath,\n  rename,\n  rm,\n  writeFile,\n} from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { dirname, isAbsolute, join, resolve, sep, win32 } from 'node:path'\nimport { isAnyArrayBuffer, isSharedArrayBuffer } from 'node:util/types'\nimport type {\n  AgentCandidateCapturedArtifact,\n  AgentCandidateWorkspaceSnapshotEvidence,\n} from '@tangle-network/agent-interface'\nimport { extract, type Pack, pack, type Extract as TarExtract } from 'tar-stream'\nimport {\n  candidateWorkspaceManifest,\n  captureMaterializedWorkspace,\n  verifyBytes,\n  verifyMaterializedWorkspace,\n} from './artifacts'\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  deepFreezeCandidate,\n  embeddedCandidateArtifact,\n  sha256Bytes,\n} from './digest'\nimport { isWellFormedUnicode } from './exact-object'\nimport {\n  assertNoGitIndirection,\n  readCandidateGitTreeFiles,\n  runCandidateGit,\n} from './git-materialize'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport type {\n  AgentCandidateExecutorWorkspaceFile,\n  AgentCandidateOutputArtifactPort,\n  AgentCandidateWorkspacePort,\n} from './types'\n\nconst archiveKind = 'agent-candidate-workspace-archive' as const\nconst workspaceEntryPrefix = 'workspace/'\nconst repositoryMetadataEntry = 'metadata/repository.json'\nconst repositoryBundleEntry = 'metadata/repository.bundle'\nconst fixedTarTime = new Date(0)\n\nexport interface AgentCandidateWorkspaceArchiveLimits {\n  maxArchiveBytes: number\n  maxEmbeddedArtifactBytes: number\n  maxFiles: number\n  maxFileBytes: number\n  maxTotalFileBytes: number\n  maxPathBytes: number\n  maxRepositoryBundleBytes: number\n}\n\nconst defaultLimits: AgentCandidateWorkspaceArchiveLimits = Object.freeze({\n  maxArchiveBytes: 512 * 1024 * 1024,\n  maxEmbeddedArtifactBytes: 1024 * 1024,\n  maxFiles: 50_000,\n  maxFileBytes: 128 * 1024 * 1024,\n  maxTotalFileBytes: 256 * 1024 * 1024,\n  maxPathBytes: 4_096,\n  maxRepositoryBundleBytes: 128 * 1024 * 1024,\n})\n\ninterface WorkspaceArchiveRepository {\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n    bytes: Uint8Array\n  }\n}\n\ninterface WorkspaceArchiveRepositoryMetadata {\n  kind: typeof archiveKind\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n  }\n}\n\ninterface DecodedWorkspaceArchive {\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository?: WorkspaceArchiveRepository\n}\n\nexport interface CaptureAgentCandidateWorkspaceOptions {\n  /** Include Git HEAD so task preparation can prove its exact commit and tree. */\n  includeRepository?: boolean\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n  /** Use the evaluator-owned artifact store when manifest or archive bytes should not be embedded. */\n  artifactPersistence?: {\n    executionId: string\n    outputArtifacts: AgentCandidateOutputArtifactPort\n    signal?: AbortSignal\n  }\n}\n\nexport interface CreateAgentCandidateWorkspacePortOptions {\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n}\n\nexport interface CapturedAgentCandidateWorkspace {\n  readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  /** Caller-owned bytes accepted by createAgentCandidateWorkspacePort. */\n  readonly archive: Uint8Array\n}\n\n/** Capture one exact regular-file workspace for immutable candidate execution. */\nexport async function captureAgentCandidateWorkspace(\n  rootInput: string,\n  options: CaptureAgentCandidateWorkspaceOptions = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const root = resolve(rootInput)\n  const limits = workspaceLimits(options.limits)\n  const captured = options.includeRepository\n    ? await captureRepository(root, limits)\n    : await captureMaterializedWorkspace(root, {\n        limits: {\n          maxFiles: limits.maxFiles,\n          maxFileBytes: limits.maxFileBytes,\n          maxTotalFileBytes: limits.maxTotalFileBytes,\n        },\n      })\n  assertWorkspaceFilesWithinLimits(captured.files, limits)\n  const repository = 'repository' in captured ? captured.repository : undefined\n  return captureWorkspaceFiles(captured.files, repository, limits, options.artifactPersistence)\n}\n\n/** Capture detached files returned by a remote executor into the standard archive. */\nexport async function captureAgentCandidateWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  options: Omit<CaptureAgentCandidateWorkspaceOptions, 'includeRepository'> = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const limits = workspaceLimits(options.limits)\n  return captureWorkspaceFiles(\n    normalizeWorkspaceFiles(input, limits),\n    undefined,\n    limits,\n    options.artifactPersistence,\n  )\n}\n\nasync function captureWorkspaceFiles(\n  files: readonly AgentCandidateExecutorWorkspaceFile[],\n  repository: WorkspaceArchiveRepository | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n  artifactPersistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<CapturedAgentCandidateWorkspace> {\n  const material = candidateWorkspaceManifest(files)\n  const manifest = canonicalCandidateBytes(material)\n  const archive = await encodeWorkspaceArchive(files, repository, limits.maxArchiveBytes)\n  if (\n    !artifactPersistence &&\n    (manifest.byteLength > limits.maxEmbeddedArtifactBytes ||\n      archive.byteLength > limits.maxEmbeddedArtifactBytes)\n  ) {\n    throw new Error(\n      'candidate workspace artifacts exceed maxEmbeddedArtifactBytes; artifactPersistence is required',\n    )\n  }\n  const manifestArtifact = await captureWorkspaceArtifact('manifest', manifest, artifactPersistence)\n  const archiveArtifact = await captureWorkspaceArtifact('archive', archive, artifactPersistence)\n  const snapshot = deepFreezeCandidate({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: canonicalCandidateDigest(material),\n    material,\n    manifest: manifestArtifact,\n    archive: archiveArtifact,\n  } satisfies AgentCandidateWorkspaceSnapshotEvidence)\n  return Object.freeze({ snapshot, archive })\n}\n\nasync function captureWorkspaceArtifact(\n  kind: 'manifest' | 'archive',\n  bytes: Uint8Array,\n  persistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<AgentCandidateCapturedArtifact> {\n  if (!persistence) return embeddedCandidateArtifact(bytes)\n  if (!persistence.executionId.trim()) {\n    throw new Error('candidate workspace artifact persistence requires an executionId')\n  }\n  return persistCandidateOutputArtifact(persistence.outputArtifacts, {\n    executionId: persistence.executionId,\n    purpose: kind === 'manifest' ? 'candidate-workspace-manifest' : 'candidate-workspace-archive',\n    bytes,\n    ...(persistence.signal ? { signal: persistence.signal } : {}),\n  })\n}\n\n/** Create the standard bounded materializer for candidate execution ports. */\nexport function createAgentCandidateWorkspacePort(\n  options: CreateAgentCandidateWorkspacePortOptions = {},\n): AgentCandidateWorkspacePort {\n  const limits = workspaceLimits(options.limits)\n  const port: AgentCandidateWorkspacePort = {\n    materialize: async ({ role, snapshot, archive, destination }) => {\n      await materializeAgentCandidateWorkspace({\n        role,\n        snapshot,\n        archive,\n        destination,\n        limits,\n      })\n    },\n  }\n  return Object.freeze(port)\n}\n\nasync function materializeAgentCandidateWorkspace(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  destination: string\n  limits: AgentCandidateWorkspaceArchiveLimits\n}): Promise<void> {\n  const decoded = await decodeVerifiedWorkspaceArchive(input)\n  const destination = resolve(input.destination)\n  await prepareEmptyDestination(destination)\n  const staging = await mkdtemp(`${destination}.materializing-`)\n  try {\n    await writeWorkspaceFiles(staging, decoded.files)\n    if (decoded.repository) {\n      await materializeRepository(decoded.repository, staging)\n    }\n    await verifyMaterializedWorkspace(staging, input.snapshot.material, {\n      ignoredProtectedRootEntries: decoded.repository ? ['.git'] : [],\n    })\n    await rename(staging, destination)\n  } catch (error) {\n    await rm(staging, { recursive: true, force: true })\n    await rm(destination, { recursive: true, force: true })\n    throw error\n  }\n}\n\n/** Verify a portable archive before its source environment may be discarded. */\nexport async function verifyAgentCandidateWorkspaceArchive(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n}): Promise<void> {\n  await decodeVerifiedWorkspaceArchive({ ...input, limits: workspaceLimits(input.limits) })\n}\n\nasync function decodeVerifiedWorkspaceArchive(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  limits: AgentCandidateWorkspaceArchiveLimits\n}): Promise<DecodedWorkspaceArchive> {\n  verifyBytes(\n    input.archive,\n    input.snapshot.archive.sha256,\n    input.snapshot.archive.byteLength,\n    'candidate workspace archive',\n  )\n  const decoded = await parseWorkspaceArchive(input.archive, input.limits)\n  if (decoded.repository && input.role !== 'task') {\n    throw new Error('only task workspaces may carry a Git repository')\n  }\n  assertArchiveMatchesSnapshot(decoded.files, input.snapshot)\n  return decoded\n}\n\nasync function captureRepository(\n  requestedRoot: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<{\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository: WorkspaceArchiveRepository\n}> {\n  const requestedStats = await lstat(requestedRoot)\n  if (!requestedStats.isDirectory() || requestedStats.isSymbolicLink()) {\n    throw new Error('candidate repository root must be a real directory')\n  }\n  // Capture the RESOLVED root. The property this guards is that capture starts at one real\n  // worktree root with no aliasing, which resolving satisfies directly — rejecting a symlinked\n  // prefix outright does not, and makes capture impossible on macOS, where the OS itself hands\n  // out temp paths under /var, a symlink to /private/var. Git reports a resolved path, so the\n  // worktree-root comparison below needs the resolved form on both sides.\n  const root = await realpath(requestedRoot)\n  const resolvedStats = await lstat(root)\n  if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) {\n    throw new Error('candidate repository root must resolve to a real directory')\n  }\n  const topLevel = (await runCandidateGit(root, ['rev-parse', '--show-toplevel'])).stdout\n    .toString('utf8')\n    .trim()\n  if ((await realpath(resolve(topLevel))) !== root) {\n    throw new Error('candidate repository capture must start at the Git worktree root')\n  }\n  const gitDir = resolve(\n    (await runCandidateGit(root, ['rev-parse', '--absolute-git-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(gitDir)) !== gitDir || gitDir.includes(':')) {\n    throw new Error('candidate repository Git object store has an unsupported path')\n  }\n  await assertNoGitIndirection(root, gitDir, 'candidate repository')\n  const headCommit = (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout\n    .toString('utf8')\n    .trim()\n  const headTree = (await runCandidateGit(root, ['rev-parse', 'HEAD^{tree}'])).stdout\n    .toString('utf8')\n    .trim()\n  assertGitObjectId(headCommit, 'HEAD')\n  assertGitObjectId(headTree, 'HEAD tree')\n  if (headCommit.length !== headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  const files = await readCandidateGitTreeFiles(root, headTree, {}, limits)\n  assertWorkspaceFilesWithinLimits(files, limits)\n  const reachableBytesText = (\n    await runCandidateGit(root, ['rev-list', '--disk-usage', '--objects', 'HEAD'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  const reachableBytes = Number(reachableBytesText)\n  if (!Number.isSafeInteger(reachableBytes) || reachableBytes < 0) {\n    throw new Error('candidate repository reachable size is invalid')\n  }\n  if (reachableBytes > limits.maxRepositoryBundleBytes) {\n    throw new Error('candidate repository exceeds maxRepositoryBundleBytes')\n  }\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    await runCandidateGit(root, ['bundle', 'create', bundlePath, 'HEAD'])\n    const bundle = Uint8Array.from(await readFile(bundlePath))\n    if (bundle.byteLength > limits.maxRepositoryBundleBytes) {\n      throw new Error('candidate repository bundle exceeds maxRepositoryBundleBytes')\n    }\n    return {\n      files,\n      repository: {\n        headCommit,\n        headTree,\n        bundle: {\n          sha256: sha256Bytes(bundle),\n          byteLength: bundle.byteLength,\n          bytes: bundle,\n        },\n      },\n    }\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nasync function encodeWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  maxArchiveBytes: number,\n): Promise<Uint8Array> {\n  const archive = pack()\n  const output = collectStream(archive, maxArchiveBytes, 'candidate workspace archive')\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    return await output\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await output.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function verifyCanonicalWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  expected: Uint8Array,\n  maxArchiveBytes: number,\n): Promise<void> {\n  const archive = pack()\n  const comparison = streamEqualsBytes(\n    archive,\n    expected,\n    maxArchiveBytes,\n    'candidate workspace archive',\n  )\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    if (!(await comparison)) throw new Error('candidate workspace tar is not canonical')\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await comparison.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function writeWorkspaceArchiveEntries(\n  archive: Pack,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n): Promise<void> {\n  for (const file of files) {\n    await writeTarEntry(archive, `${workspaceEntryPrefix}${file.path}`, file.mode, file.bytes)\n  }\n  if (!repository) return\n  const metadata = canonicalCandidateBytes({\n    kind: archiveKind,\n    headCommit: repository.headCommit,\n    headTree: repository.headTree,\n    bundle: {\n      sha256: repository.bundle.sha256,\n      byteLength: repository.bundle.byteLength,\n    },\n  } satisfies WorkspaceArchiveRepositoryMetadata)\n  await writeTarEntry(archive, repositoryMetadataEntry, 0o600, metadata)\n  await writeTarEntry(archive, repositoryBundleEntry, 0o600, repository.bundle.bytes)\n}\n\nasync function parseWorkspaceArchive(\n  bytes: Uint8Array,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<DecodedWorkspaceArchive> {\n  if (bytes.byteLength > limits.maxArchiveBytes) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n  }\n  const parser = extract()\n  const files: DecodedWorkspaceArchive['files'] = []\n  const observedEntryNames = new Set<string>()\n  const observedPaths = new Set<string>()\n  let totalBytes = 0\n  let retainedEntryBytes = 0\n  let previousPath: string | undefined\n  let repositoryMetadata: WorkspaceArchiveRepositoryMetadata | undefined\n  let repositoryBundle: Uint8Array | undefined\n  const decoded = (async () => {\n    for await (const entry of parser) {\n      const name = entry.header.name\n      if (\n        entry.header.type !== 'file' ||\n        typeof name !== 'string' ||\n        observedEntryNames.has(name)\n      ) {\n        throw new Error('candidate workspace tar contains an invalid entry')\n      }\n      observedEntryNames.add(name)\n      if (name.startsWith(workspaceEntryPrefix)) {\n        if (files.length >= limits.maxFiles) {\n          throw new Error('candidate workspace archive has an invalid file count')\n        }\n        const path = safeArchivePath(name.slice(workspaceEntryPrefix.length), limits.maxPathBytes)\n        if (!isWorkspaceFileMode(entry.header.mode)) {\n          throw new Error(`candidate workspace archive has an unsupported mode: ${path}`)\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const fileBytes = await readTarEntry(entry, limits.maxFileBytes, `workspace file ${path}`)\n        retainedEntryBytes += fileBytes.byteLength\n        assertWorkspacePathOrder(\n          path,\n          previousPath,\n          observedPaths,\n          'candidate workspace archive paths must be unique and sorted',\n        )\n        previousPath = path\n        if (fileBytes.byteLength > limits.maxTotalFileBytes - totalBytes) {\n          throw new Error('candidate workspace archive exceeds maxTotalFileBytes')\n        }\n        totalBytes += fileBytes.byteLength\n        files.push({ path, mode: entry.header.mode, bytes: fileBytes })\n      } else if (name === repositoryMetadataEntry) {\n        if (entry.header.mode !== 0o600 || repositoryMetadata) {\n          throw new Error('candidate workspace archive repository metadata is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const metadataBytes = await readTarEntry(\n          entry,\n          limits.maxPathBytes,\n          'candidate repository metadata',\n        )\n        retainedEntryBytes += metadataBytes.byteLength\n        repositoryMetadata = parseRepositoryMetadata(metadataBytes, limits.maxRepositoryBundleBytes)\n      } else if (name === repositoryBundleEntry) {\n        if (entry.header.mode !== 0o600 || repositoryBundle) {\n          throw new Error('candidate workspace archive repository bundle is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        repositoryBundle = await readTarEntry(\n          entry,\n          limits.maxRepositoryBundleBytes,\n          'candidate Git bundle',\n        )\n        retainedEntryBytes += repositoryBundle.byteLength\n      } else {\n        throw new Error(`candidate workspace tar contains an unsupported entry: ${name}`)\n      }\n    }\n    if (Boolean(repositoryMetadata) !== Boolean(repositoryBundle)) {\n      throw new Error('candidate workspace archive repository evidence is incomplete')\n    }\n    const repository =\n      repositoryMetadata && repositoryBundle\n        ? repositoryFromTar(repositoryMetadata, repositoryBundle)\n        : undefined\n    return { files, ...(repository ? { repository } : {}) }\n  })()\n  parser.end(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength))\n  const result = await decoded\n  await verifyCanonicalWorkspaceArchive(\n    result.files,\n    result.repository,\n    bytes,\n    limits.maxArchiveBytes,\n  )\n  return result\n}\n\nfunction assertRetainedArchiveSize(\n  archiveBytes: number,\n  retainedEntryBytes: number,\n  entryBytes: number | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (\n    !Number.isSafeInteger(entryBytes) ||\n    entryBytes === undefined ||\n    entryBytes < 0 ||\n    entryBytes > limits.maxArchiveBytes - archiveBytes - retainedEntryBytes\n  ) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes while decoding')\n  }\n}\n\nfunction parseRepositoryMetadata(\n  bytes: Uint8Array,\n  maxBundleBytes: number,\n): WorkspaceArchiveRepositoryMetadata {\n  let value: unknown\n  try {\n    value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes))\n  } catch (error) {\n    throw new Error('candidate workspace archive repository metadata is invalid', { cause: error })\n  }\n  if (\n    !isRecord(value) ||\n    Object.keys(value).sort().join(',') !== 'bundle,headCommit,headTree,kind' ||\n    value.kind !== archiveKind ||\n    typeof value.headCommit !== 'string' ||\n    typeof value.headTree !== 'string' ||\n    !isRecord(value.bundle) ||\n    Object.keys(value.bundle).sort().join(',') !== 'byteLength,sha256' ||\n    typeof value.bundle.sha256 !== 'string' ||\n    !/^sha256:[a-f0-9]{64}$/.test(value.bundle.sha256) ||\n    !Number.isSafeInteger(value.bundle.byteLength) ||\n    (value.bundle.byteLength as number) <= 0 ||\n    (value.bundle.byteLength as number) > maxBundleBytes\n  ) {\n    throw new Error('candidate workspace archive repository is invalid')\n  }\n  if (!Buffer.from(canonicalCandidateBytes(value)).equals(Buffer.from(bytes))) {\n    throw new Error('candidate workspace archive repository metadata is not canonical')\n  }\n  assertGitObjectId(value.headCommit, 'repository HEAD')\n  assertGitObjectId(value.headTree, 'repository HEAD tree')\n  if (value.headCommit.length !== value.headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  return {\n    kind: archiveKind,\n    headCommit: value.headCommit,\n    headTree: value.headTree,\n    bundle: {\n      sha256: value.bundle.sha256 as `sha256:${string}`,\n      byteLength: value.bundle.byteLength as number,\n    },\n  }\n}\n\nfunction repositoryFromTar(\n  metadata: WorkspaceArchiveRepositoryMetadata,\n  bundle: Uint8Array,\n): WorkspaceArchiveRepository {\n  verifyBytes(bundle, metadata.bundle.sha256, metadata.bundle.byteLength, 'candidate Git bundle')\n  return {\n    headCommit: metadata.headCommit,\n    headTree: metadata.headTree,\n    bundle: { ...metadata.bundle, bytes: bundle },\n  }\n}\n\nasync function writeTarEntry(\n  archive: Pack,\n  name: string,\n  mode: number,\n  bytes: Uint8Array,\n): Promise<void> {\n  await new Promise<void>((resolveEntry, rejectEntry) => {\n    archive.entry(\n      {\n        name,\n        mode,\n        uid: 0,\n        gid: 0,\n        size: bytes.byteLength,\n        mtime: fixedTarTime,\n        type: 'file',\n        uname: '',\n        gname: '',\n      },\n      Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength),\n      (error) => (error ? rejectEntry(error) : resolveEntry()),\n    )\n  })\n}\n\ntype TarEntry = TarExtract extends AsyncIterable<infer Entry> ? Entry : never\n\nasync function readTarEntry(entry: TarEntry, maxBytes: number, label: string): Promise<Uint8Array> {\n  const size = entry.header.size\n  if (!Number.isSafeInteger(size) || size === undefined || size < 0 || size > maxBytes) {\n    throw new Error(`${label} has an invalid tar size`)\n  }\n  const bytes = await collectStream(entry, maxBytes, label)\n  if (bytes.byteLength !== size) throw new Error(`${label} differs from its tar size`)\n  return bytes\n}\n\nasync function collectStream(\n  stream: AsyncIterable<unknown>,\n  maxBytes: number,\n  label: string,\n): Promise<Uint8Array> {\n  const chunks: Buffer[] = []\n  let totalBytes = 0\n  for await (const chunk of stream) {\n    if (!(chunk instanceof Uint8Array)) {\n      throw new Error(`${label} emitted a non-byte chunk`)\n    }\n    if (chunk.byteLength > maxBytes - totalBytes) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)\n    chunks.push(bytes)\n    totalBytes += bytes.byteLength\n  }\n  return Buffer.concat(chunks, totalBytes)\n}\n\nasync function streamEqualsBytes(\n  stream: AsyncIterable<unknown>,\n  expected: Uint8Array,\n  maxBytes: number,\n  label: string,\n): Promise<boolean> {\n  const expectedBuffer = Buffer.from(expected.buffer, expected.byteOffset, expected.byteLength)\n  let equal = true\n  let offset = 0\n  for await (const chunk of stream) {\n    if (!(chunk instanceof Uint8Array)) {\n      throw new Error(`${label} emitted a non-byte chunk`)\n    }\n    if (chunk.byteLength > maxBytes - offset) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const observed = Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength)\n    if (\n      offset + observed.byteLength > expectedBuffer.byteLength ||\n      !observed.equals(expectedBuffer.subarray(offset, offset + observed.byteLength))\n    ) {\n      equal = false\n    }\n    offset += observed.byteLength\n  }\n  return equal && offset === expectedBuffer.byteLength\n}\n\nasync function prepareEmptyDestination(destination: string): Promise<void> {\n  await mkdir(destination, { recursive: true, mode: 0o700 })\n  const stats = await lstat(destination)\n  if (!stats.isDirectory() || stats.isSymbolicLink()) {\n    throw new Error('candidate workspace destination must be a real directory')\n  }\n  // A symlinked PREFIX is the OS's own doing on macOS, where temp paths live under /var, a\n  // symlink to /private/var. What must hold is that the destination itself is a real\n  // directory, which both this check and the lstat above require.\n  const resolvedDestination = await realpath(destination)\n  const resolvedStats = await lstat(resolvedDestination)\n  if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) {\n    throw new Error('candidate workspace destination must resolve to a real directory')\n  }\n  if ((await readdir(destination)).length > 0) {\n    throw new Error('candidate workspace destination must be empty')\n  }\n}\n\nasync function writeWorkspaceFiles(\n  destination: string,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n): Promise<void> {\n  for (const file of files) {\n    const path = workspacePath(destination, file.path)\n    await mkdir(dirname(path), { recursive: true, mode: 0o700 })\n    const descriptor = await open(\n      path,\n      fsConstants.O_WRONLY |\n        fsConstants.O_CREAT |\n        fsConstants.O_EXCL |\n        (typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0),\n      0o600,\n    )\n    try {\n      await descriptor.writeFile(file.bytes)\n      const stats = await descriptor.stat()\n      if (!stats.isFile() || stats.nlink !== 1) {\n        throw new Error(`candidate workspace file identity changed while writing: ${file.path}`)\n      }\n      await descriptor.chmod(file.mode)\n    } finally {\n      await descriptor.close()\n    }\n  }\n}\n\nasync function materializeRepository(\n  repository: WorkspaceArchiveRepository,\n  destination: string,\n): Promise<void> {\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    await writeFile(bundlePath, repository.bundle.bytes, { flag: 'wx', mode: 0o600 })\n    await runCandidateGit(destination, [\n      'init',\n      '--quiet',\n      '--initial-branch=candidate',\n      `--object-format=${repository.headCommit.length === 64 ? 'sha256' : 'sha1'}`,\n    ])\n    await runCandidateGit(destination, ['bundle', 'verify', bundlePath])\n    await runCandidateGit(destination, ['bundle', 'unbundle', bundlePath])\n    const objectType = (\n      await runCandidateGit(destination, ['cat-file', '-t', repository.headCommit])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (objectType !== 'commit') throw new Error('candidate repository HEAD is not a commit')\n    const observedTree = (\n      await runCandidateGit(destination, ['rev-parse', `${repository.headCommit}^{tree}`])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (observedTree !== repository.headTree) {\n      throw new Error('candidate repository bundle HEAD tree changed')\n    }\n    await runCandidateGit(destination, ['update-ref', '--no-deref', 'HEAD', repository.headCommit])\n    await runCandidateGit(destination, ['read-tree', repository.headTree])\n    const status = (\n      await runCandidateGit(destination, ['status', '--porcelain=v1', '--untracked-files=all'])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (status) throw new Error('candidate repository files do not exactly match HEAD')\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nfunction assertArchiveMatchesSnapshot(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n): void {\n  const material = candidateWorkspaceManifest(files)\n  const materialBytes = canonicalCandidateBytes(material)\n  verifyBytes(\n    materialBytes,\n    snapshot.manifest.sha256,\n    snapshot.manifest.byteLength,\n    'candidate workspace manifest',\n  )\n  if (\n    canonicalCandidateDigest(material) !== snapshot.digest ||\n    !Buffer.from(materialBytes).equals(Buffer.from(canonicalCandidateBytes(snapshot.material)))\n  ) {\n    throw new Error('candidate workspace archive does not match its snapshot manifest')\n  }\n}\n\nfunction assertWorkspaceFilesWithinLimits(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (files.length > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  let previousPath: string | undefined\n  const observedPaths = new Set<string>()\n  for (const file of files) {\n    const path = safeArchivePath(file.path, limits.maxPathBytes)\n    assertWorkspacePathOrder(\n      path,\n      previousPath,\n      observedPaths,\n      'candidate workspace paths must be unique and sorted',\n    )\n    previousPath = path\n    if (!isWorkspaceFileMode(file.mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    if (file.bytes.byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    totalBytes += file.bytes.byteLength\n    if (totalBytes > limits.maxTotalFileBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n  }\n}\n\nfunction normalizeWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): AgentCandidateExecutorWorkspaceFile[] {\n  if (!Array.isArray(input)) {\n    throw new Error('candidate workspace files must be an array')\n  }\n  const fileCount = input.length\n  if (fileCount > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  const files: AgentCandidateExecutorWorkspaceFile[] = []\n  for (let index = 0; index < fileCount; index++) {\n    const inputFile = input[index]\n    if (!isRecord(inputFile) || Object.keys(inputFile).sort().join(',') !== 'bytes,mode,path') {\n      throw new Error(`candidate workspace file ${index} is invalid`)\n    }\n    const descriptors = Object.getOwnPropertyDescriptors(inputFile)\n    if (\n      !('value' in (descriptors.path ?? {})) ||\n      !('value' in (descriptors.mode ?? {})) ||\n      !('value' in (descriptors.bytes ?? {}))\n    ) {\n      throw new Error(`candidate workspace file ${index} must use fixed values`)\n    }\n    const path = safeArchivePath(descriptors.path?.value, limits.maxPathBytes)\n    const mode = descriptors.mode?.value\n    const inputBytes = descriptors.bytes?.value\n    if (!isWorkspaceFileMode(mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    const view = inspectWorkspaceBytes(inputBytes, path)\n    if (view.byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    if (view.byteLength > limits.maxTotalFileBytes - totalBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n    if (view.byteLength > Math.max(0, limits.maxArchiveBytes - 1024)) {\n      throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n    }\n    totalBytes += view.byteLength\n    files.push({ path, mode, bytes: detachWorkspaceBytes(view) })\n  }\n  files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))\n  assertWorkspaceFilesWithinLimits(files, limits)\n  return files\n}\n\nfunction isWorkspaceFileMode(value: unknown): value is number {\n  return Number.isSafeInteger(value) && (value as number) >= 0 && (value as number) <= 0o777\n}\n\nfunction workspaceLimits(\n  overrides: Partial<AgentCandidateWorkspaceArchiveLimits> | undefined,\n): AgentCandidateWorkspaceArchiveLimits {\n  const limits = { ...defaultLimits, ...overrides }\n  for (const [name, value] of Object.entries(limits)) {\n    if (!Number.isSafeInteger(value) || value <= 0) {\n      throw new Error(`candidate workspace ${name} must be a positive safe integer`)\n    }\n  }\n  return Object.freeze(limits)\n}\n\nfunction safeArchivePath(value: unknown, maxPathBytes: number): string {\n  if (\n    typeof value !== 'string' ||\n    !value ||\n    !isWellFormedUnicode(value) ||\n    Buffer.byteLength(value, 'utf8') > maxPathBytes ||\n    isAbsolute(value) ||\n    win32.isAbsolute(value) ||\n    value.includes('\\\\') ||\n    value.includes('\\0') ||\n    hasControlCharacter(value) ||\n    value.split('/').some((part) => !part || part === '.' || part === '..') ||\n    ['.git', '.sidecar'].includes(value.split('/')[0]?.toLowerCase() ?? '')\n  ) {\n    throw new Error(`candidate workspace archive contains an unsafe path: ${String(value)}`)\n  }\n  return value\n}\n\nfunction assertWorkspacePathOrder(\n  path: string,\n  previousPath: string | undefined,\n  observedPaths: Set<string>,\n  errorMessage: string,\n): void {\n  if (previousPath !== undefined && previousPath >= path) throw new Error(errorMessage)\n  for (let slash = path.indexOf('/'); slash !== -1; slash = path.indexOf('/', slash + 1)) {\n    if (observedPaths.has(path.slice(0, slash))) throw new Error(errorMessage)\n  }\n  observedPaths.add(path)\n}\n\nfunction inspectWorkspaceBytes(\n  input: unknown,\n  path: string,\n): { buffer: ArrayBuffer; byteOffset: number; byteLength: number } {\n  let buffer: ArrayBufferLike\n  let byteOffset: number\n  let byteLength: number\n  try {\n    buffer = typedArrayBufferGetter.call(input as Uint8Array) as ArrayBufferLike\n    byteOffset = typedArrayByteOffsetGetter.call(input as Uint8Array) as number\n    byteLength = typedArrayByteLengthGetter.call(input as Uint8Array) as number\n  } catch {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  if (isSharedArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file uses shared bytes: ${path}`)\n  }\n  if (!isAnyArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  return { buffer, byteOffset, byteLength }\n}\n\nfunction detachWorkspaceBytes(input: {\n  buffer: ArrayBuffer\n  byteOffset: number\n  byteLength: number\n}): Uint8Array {\n  const { buffer, byteOffset, byteLength } = input\n  const copy = new Uint8Array(byteLength)\n  Uint8Array.prototype.set.call(copy, new Uint8Array(buffer, byteOffset, byteLength))\n  return copy\n}\n\nfunction workspacePath(root: string, relativePath: string): string {\n  const path = resolve(root, relativePath)\n  if (!path.startsWith(`${root}${sep}`)) {\n    throw new Error(`candidate workspace archive path escapes its destination: ${relativePath}`)\n  }\n  return path\n}\n\nfunction assertGitObjectId(value: string, label: string): void {\n  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value)) {\n    throw new Error(`candidate repository ${label} is not a Git object id`)\n  }\n}\n\nfunction hasControlCharacter(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code < 0x20 || code === 0x7f) return true\n  }\n  return false\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\ntype TypedArrayGetter = (this: Uint8Array) => unknown\n\nfunction requireTypedArrayGetter(name: 'buffer' | 'byteOffset' | 'byteLength'): TypedArrayGetter {\n  const typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype) as object\n  const getter = Object.getOwnPropertyDescriptor(typedArrayPrototype, name)?.get\n  if (!getter) throw new Error(`typed array intrinsic ${name} accessor is unavailable`)\n  return getter\n}\n\nconst typedArrayBufferGetter = requireTypedArrayGetter('buffer')\nconst typedArrayByteOffsetGetter = requireTypedArrayGetter('byteOffset')\nconst typedArrayByteLengthGetter = requireTypedArrayGetter('byteLength')\n"],"mappings":";;;;;;;;;;;AAYA,SAAgBA,cAAY,OAAiC;CAC3D,OAAO,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAClE;AAEA,SAAgBC,2BAAyB,OAA8B;CACrE,OAAOD,cAAYE,0BAAwB,KAAK,CAAC;AACnD;;AAGA,SAAgB,wBAA2B,OAAa;CACtD,OAAO,oBACL,KAAK,MAAM,OAAO,KAAKA,0BAAwB,KAAK,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,CACzE;AACF;AAEA,SAAgB,2BACd,oBAC+B;CAC/B,MAAM,QAAQA,0BAAwB,kBAAkB;CACxD,MAAM,SAASF,cAAY,KAAK;CAChC,MAAM,QAAQ,oBAAoB;EAChC,GAAG,KAAK,MAAM,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC;EACjD;CACF,CAAC;CACD,OAAO,OAAO,OAAO;EACnB;EACA,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,KAAK;EAC9B;EACA;CACF,CAAC;AACH;AAEA,SAAgB,iCACd,OACA,OACG;CACH,IAAIC,2BAAyB,mBAAmB,KAAK,CAAC,MAAM,MAAM,QAChE,MAAM,IAAI,MAAM,GAAG,MAAM,uBAAuB;CAElD,OAAO,wBAAwB,KAAK;AACtC;AAEA,SAAgB,0BAA0B,OAAmD;CAC3F,OAAO;EACL,UAAU;EACV,SAAS,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;EAC7C,QAAQD,cAAY,KAAK;EACzB,YAAY,MAAM;CACpB;AACF;AAEA,SAAgB,mBACd,OACmB;CACnB,MAAM,EAAE,QAAQ,SAAS,GAAG,SAAS;CACrC,OAAO;AACT;AAEA,SAAgB,oBAAuB,OAAU,uBAAO,IAAI,IAAY,GAAM;CAC5E,IACE,UAAU,QACV,OAAO,UAAU,YACjB,YAAY,OAAO,KAAK,KACxB,KAAK,IAAI,KAAe,GAExB,OAAO;CAET,KAAK,IAAI,KAAe;CACxB,KAAK,MAAM,SAAS,OAAO,OAAO,KAAgC,GAChE,oBAAoB,OAAO,IAAI;CAEjC,OAAO,OAAO,OAAO,KAAK;AAC5B;;;ACpEA,SAAgB,iBAAiB,UAAkD;CACjF,OAAO,GAAG,SAAS,OAAO,GAAG,SAAS;AACxC;AAEA,eAAsB,qBACpB,UACA,MACqB;CACrB,MAAM,QACJ,aAAa,WACT,OAAO,KAAK,SAAS,SAAS,QAAQ,IACtC,MAAM,KAAK,KAAK,QAAqC;CAC3D,YAAY,OAAO,SAAS,QAAQ,SAAS,YAAY,oBAAoB;CAC7E,OAAO,WAAW,KAAK,KAAK;AAC9B;AAEA,SAAgB,YACd,OACA,QACA,YACA,OACM;CACN,IAAI,MAAM,eAAe,YACvB,MAAM,IAAI,MAAM,GAAG,MAAM,eAAe,MAAM,WAAW,kBAAkB,YAAY;CAEzF,MAAM,SAASG,cAAY,KAAK;CAChC,IAAI,WAAW,QACb,MAAM,IAAI,MAAM,GAAG,MAAM,UAAU,OAAO,kBAAkB,QAAQ;AAExE;AAEA,eAAsB,iCACpB,UACA,MACwD;CACxD,MAAM,CAAC,UAAU,WAAW,MAAM,QAAQ,IAAI,CAC5C,qBAAqB,SAAS,UAAU,IAAI,GAC5C,qBAAqB,SAAS,SAAS,IAAI,CAC7C,CAAC;CACD,MAAM,oBAAoBC,0BAAwB,SAAS,QAAQ;CACnE,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,iBAAiB,CAAC,GAC9D,MAAM,IAAI,MAAM,0EAA0E;CAE5F,IAAID,cAAY,iBAAiB,MAAM,SAAS,QAC9C,MAAM,IAAI,MAAM,0EAA0E;CAE5F,OAAO;EAAE;EAAU;CAAQ;AAC7B;;;;;;;;AAiCA,eAAsB,4BACpB,MACA,UACA,UAAgD,CAAC,GAClC;CACf,wBAAwB,MAAM,kCAAkC,MAAM,OAAO,GAAG,QAAQ;AAC1F;;;;;;;;;;AAWA,eAAsB,kCACpB,MACA,UAAgC,CAAC,GACiB;CAClD,OAAO,6BAA6B,MAAM,cAAc,MAAM,SAAS,KAAK,CAAC;AAC/E;AAEA,eAAsB,6BACpB,MACA,UAAgC,CAAC,GAIhC;CACD,MAAM,UAAU,MAAM,cAAc,MAAM,SAAS,IAAI;CACvD,OAAO;EACL,UAAU,6BAA6B,OAAO;EAC9C,OAAO,QAAQ,KAAK,WAAW;GAC7B,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,OAAO,WAAW,KAAK,cAAc,KAAK,CAAC;EAC7C,EAAE;CACJ;AACF;;AAGA,eAAsB,+BACpB,MACA,UACA,UAAgC,CAAC,GAC0C;CAC3E,MAAM,WAAW,MAAM,6BAA6B,MAAM,OAAO;CACjE,wBAAwB,SAAS,UAAU,QAAQ;CACnD,OAAO,SAAS,MAAM,KAAK,SACzB,OAAO,OAAO;EAAE,MAAM,KAAK;EAAM,MAAM,KAAK;EAAM,OAAO,WAAW,KAAK,KAAK,KAAK;CAAE,CAAC,CACxF;AACF;;;;;;AAOA,SAAgB,2BACd,OACA,UAAsC,CAAC,GACE;CACzC,OAAO,6BACL,MAAM,KAAK,UAAU;EACnB,MAAM,KAAK;EACX,MAAM,QAAQ,iBAAiB,OAAO,iBAAiB,KAAK,IAAI,IAAI,KAAK;EACzE,QAAQA,cAAY,KAAK,KAAK;EAC9B,YAAY,KAAK,MAAM;CACzB,EAAE,CACJ;AACF;AAEA,SAAS,6BACP,SAMyC;CACzC,OAAO;EACL,MAAM;EACN,OAAO,QACJ,KAAK,WAAW;GACf,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,QAAQ,MAAM;GACd,YAAY,MAAM;EACpB,EAAE,CAAC,CACF,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAAE;CACpE;AACF;;AAGA,SAAS,iBAAiB,MAAsB;CAC9C,QAAQ,OAAO,QAAW,IAAI,MAAQ;AACxC;AAEA,SAAS,cAAc,OAAsC;CAC3D,IAAI,CAAC,MAAM,OAAO,MAAM,IAAI,MAAM,kDAAkD,MAAM,MAAM;CAChG,OAAO,MAAM;AACf;AAEA,SAAS,wBACP,UACA,UACM;CACN,IAAI,OAAO,KAAKC,0BAAwB,QAAQ,CAAC,CAAC,CAAC,OAAOA,0BAAwB,QAAQ,CAAC,GACzF;CAMF,IACE,OAAO,KAAKA,0BAAwB,kBAAkB,QAAQ,CAAC,CAAC,CAAC,CAAC,OAChEA,0BAAwB,kBAAkB,QAAQ,CAAC,CACrD,GAEA,MAAM,IAAI,MACR,uJAEF;CAEF,MAAM,IAAI,MAAM,gFAAgF;AAClG;AAEA,SAAS,kBACP,UACyC;CACzC,OAAO;EACL,GAAG;EACH,OAAO,SAAS,MAAM,KAAK,UAAU;GAAE,GAAG;GAAM,MAAM,iBAAiB,KAAK,IAAI;EAAE,EAAE;CACtF;AACF;AAEA,eAAsB,mCACpB,MACA,UACA,WAAkC,aACnB;CAEf,MAAM,mBAAkB,MADD,kCAAkC,IAAI,EAAA,CAC5B,MAAM,KAAK,EAAE,MAAM,MAAM,cAAc;EACtE,SAAS;EACT;EACA,eAAe;CACjB,EAAE;CACF,MAAM,gBAAgB,SAAS,MAC5B,QAAQ,UAAU,KAAK,QAAQ,iBAAiB,QAAQ,CAAC,CACzD,KAAK,EAAE,MAAM,OAAO,GAAG,WAAW,IAAI;CACzC,IACE,CAAC,OAAO,KAAKA,0BAAwB,eAAe,CAAC,CAAC,CAAC,OACrDA,0BAAwB,aAAa,CACvC,GAEA,MAAM,IAAI,MACR,WAAW,SAAS,qEACtB;AAEJ;AAWA,eAAe,cACb,MACA,SACA,WACkC;CAClC,MAAM,8BAA8B,IAAI,IAAY,QAAQ,+BAA+B,CAAC,CAAC;CAC7F,MAAM,SAAS,QAAQ;CAMvB,MAAM,gBAAgB,QAAQ,IAAI;CAClC,MAAM,YAAY,MAAM,MAAM,aAAa;CAC3C,IAAI,CAAC,UAAU,YAAY,KAAK,UAAU,eAAe,GACvD,MAAM,IAAI,MAAM,yCAAyC;CAE3D,MAAM,eAAe,MAAM,SAAS,aAAa;CACjD,MAAM,gBAAgB,MAAM,MAAM,YAAY;CAC9C,IAAI,CAAC,cAAc,YAAY,KAAK,cAAc,eAAe,GAC/D,MAAM,IAAI,MAAM,iDAAiD;CAEnE,MAAM,UAAmC,CAAC;CAC1C,IAAI,aAAa;CAEjB,eAAe,MAAM,WAAkC;EACrD,MAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC;EAChE,QAAQ,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAAE;EACvE,KAAK,MAAM,SAAS,SAAS;GAC3B,IAAI,cAAc,gBAAgB,4BAA4B,IAAI,MAAM,IAAI,GAC1E;GAEF,MAAM,WAAW,QAAQ,WAAW,MAAM,IAAI;GAC9C,MAAM,UAAU,SAAS,cAAc,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG;GACpE,IAAI,CAAC,WAAW,QAAQ,WAAW,KAAK,KAAK,QAAQ,SAAS,MAAM,GAClE,MAAM,IAAI,MAAM,iCAAiC,SAAS;GAE5D,MAAM,QAAQ,MAAM,MAAM,QAAQ;GAClC,IAAI,MAAM,eAAe,GACvB,MAAM,IAAI,MAAM,MAAM,eAAe,UAAU,SAAS,YAAY,CAAC;GAEvE,IAAI,MAAM,YAAY,GAAG;IACvB,MAAM,MAAM,QAAQ;IACpB;GACF;GACA,IAAI,CAAC,MAAM,OAAO,GAChB,MAAM,IAAI,MAAM,2CAA2C,SAAS;GAEtE,IAAI,UAAU,QAAQ,UAAU,OAAO,UACrC,MAAM,IAAI,MAAM,4BAA4B;GAE9C,MAAM,aAAa,MAAM,KACvB,UACAC,UAAY,YACT,OAAOA,UAAY,eAAe,WAAWA,UAAY,aAAa,EAC3E;GACA,IAAI;IACF,MAAM,cAAc,MAAM,WAAW,KAAK;IAC1C,IAAI,CAAC,YAAY,OAAO,GACtB,MAAM,IAAI,MAAM,2CAA2C,SAAS;IAEtE,IAAI,YAAY,UAAU,GACxB,MAAM,IAAI,MAAM,0CAA0C,SAAS;IAErE,MAAM,OACJ,QAAQ,iBAAiB,OACrB,iBAAiB,YAAY,IAAI,IACjC,YAAY,OAAO;IACzB,IAAI,UAAU,YAAY,OAAO,OAAO,cACtC,MAAM,IAAI,MAAM,wCAAwC,SAAS;IAEnE,MAAM,iBAAiB,SAAS,OAAO,oBAAoB,aAAa,KAAA;IACxE,IAAI,mBAAmB,KAAA,KAAa,YAAY,OAAO,gBACrD,MAAM,IAAI,MAAM,qCAAqC;IAEvD,MAAM,OAAO,MAAM,kBACjB,YACA,SAAS,KAAK,IAAI,OAAO,cAAc,kBAAkB,OAAO,YAAY,IAAI,KAAA,GAChF,WACA,OACF;IACA,cAAc,KAAK;IACnB,QAAQ,KAAK;KACX,MAAM;KACN;KACA,QAAQ,KAAK;KACb,YAAY,KAAK;KACjB,GAAI,KAAK,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM;IAC1D,CAAC;GACH,UAAU;IACR,MAAM,WAAW,MAAM;GACzB;EACF;CACF;CAEA,MAAM,MAAM,YAAY;CACxB,OAAO;AACT;;;;;;;;;;AAWA,eAAe,eACb,UACA,SACA,cACiB;CACjB,MAAM,SAAS,MAAM,SAAS,QAAQ;CACtC,IAAI,WAAW,MAAM,GACnB,OAAO,2CAA2C,QAAQ,MAAM;CAElE,IAAI,CAAC,SAAS,cAAc,QAAQ,QAAQ,QAAQ,GAAG,MAAM,CAAC,GAC5D,OAAO,uDAAuD,QAAQ,MAAM;CAE9E,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,SAAS,QAAQ;CACpC,QAAQ;EACN,OAAO,6CAA6C,QAAQ,MAAM;CACpE;CACA,IAAI,CAAC,SAAS,cAAc,QAAQ,GAClC,OAAO,gEAAgE,QAAQ,MAAM;CAEvF,OAAO,iCAAiC,QAAQ,MAAM;AACxD;AAEA,SAAS,SAAS,MAAc,MAAuB;CACrD,OAAO,SAAS,QAAQ,KAAK,WAAW,GAAG,OAAO,KAAK;AACzD;;;;;;;;;;AAWA,eAAe,kBACb,YACA,UACA,WACA,MACuE;CACvE,MAAM,OAAO,WAAW,QAAQ;CAChC,MAAM,SAAS,OAAO,YAAY,OAAO,IAAI;CAC7C,MAAM,SAAmB,CAAC;CAC1B,IAAI,QAAQ;CACZ,OAAO,MAAM;EACX,MAAM,EAAE,cAAc,MAAM,WAAW,KAAK,QAAQ,GAAG,OAAO,YAAY,IAAI;EAC9E,IAAI,cAAc,GAAG;EACrB,SAAS;EACT,IAAI,aAAa,KAAA,KAAa,QAAQ,UACpC,MAAM,IAAI,MAAM,6CAA6C,MAAM;EAErE,MAAM,QAAQ,OAAO,SAAS,GAAG,SAAS;EAC1C,KAAK,OAAO,KAAK;EAEjB,IAAI,WAAW,OAAO,KAAK,OAAO,KAAK,KAAK,CAAC;CAC/C;CACA,MAAM,SAAS,UAAU,KAAK,OAAO,KAAK;CAC1C,OAAO,YACH;EAAE;EAAQ,YAAY;EAAO,OAAO,OAAO,OAAO,QAAQ,KAAK;CAAE,IACjE;EAAE;EAAQ,YAAY;CAAM;AAClC;;;;ACvbA,SAAgB,sBACd,OACA,UACA,OACA,WAA8B,CAAC,GACzB;CACN,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CAE9C,MAAM,0BAAU,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,QAAQ,CAAC;CAClD,IAAI,QAAQ,SAAS,SAAS,SAAS,SAAS,QAC9C,MAAM,IAAI,MAAM,GAAG,MAAM,8CAA8C;CAEzE,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GACjC,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B,KAAK;CAEjF,KAAK,MAAM,OAAO,UAChB,IAAI,EAAE,OAAO,QAAQ,MAAM,IAAI,MAAM,GAAG,MAAM,oBAAoB,KAAK;AAE3E;;;;;;AAOA,SAAgB,oBAAoB,OAAwB;CAC1D,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,QAAQ,SAAU,QAAQ,OAAQ;GACpC,MAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;GACvC,IAAI,EAAE,QAAQ,SAAU,QAAQ,QAAS,OAAO;GAChD;EACF,OAAO,IAAI,QAAQ,SAAU,QAAQ,OACnC,OAAO;CAEX;CACA,OAAO;AACT;;;AClBA,eAAsB,oBACpB,MACA,cACA,YAC6B;CAC7B,IAAI,KAAK,SAAS,YAAY,OAAO,KAAA;CACrC,MAAM,iBAAiB,MAAM,uBAAuB,KAAK,YAAY,YAAY;CACjF,MAAM,wBAAwB,gBAAgB,KAAK,YAAY,KAAK,QAAQ;CAE5E,IAAI,KAAK,SAAS,SAAS;EACzB,MAAM,eAAe,gBAAgB,KAAK,QAAQ;EAClD,OAAO,KAAK;CACd;CACA,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,qDAAqD;CAEtF,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,sBAAsB,CAAC;CACtE,IAAI;EACF,MAAM,YAAY,KAAK,WAAW,OAAO;EACzC,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,KAAK,QAAQ,GAAG,KAAA,GAAW,EAC7E,gBAAgB,UAClB,CAAC;EACD,MAAM,gBACJ,gBACA;GAAC;GAAS;GAAY;GAAY;GAAuB;EAAG,GAC5D,YACA,EAAE,gBAAgB,UAAU,CAC9B;EACA,MAAM,iBACJ,MAAM,gBAAgB,gBAAgB,CAAC,YAAY,GAAG,KAAA,GAAW,EAC/D,gBAAgB,UAClB,CAAC,EAAA,CACD,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EACR,IAAI,kBAAkB,KAAK,eACzB,MAAM,IAAI,MACR,+BAA+B,cAAc,kBAAkB,KAAK,eACtE;EAEF,MAAM,eAAe,gBAAgB,aAAa;EAClD,OAAO;CACT,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAsB,4BACpB,UACA,cACqB;CACrB,MAAM,iBAAiB,MAAM,uBAAuB,SAAS,YAAY,YAAY;CAMrF,KAJE,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAM,SAAS;CAAM,CAAC,EAAA,CACzE,OACC,SAAS,MAAM,CAAC,CAChB,KACU,MAAM,UACjB,MAAM,IAAI,MAAM,kDAAkD,SAAS,QAAQ;CAErF,MAAM,WACJ,MAAM,gBAAgB,gBAAgB;EAAC;EAAW;EAAM,SAAS;EAAQ;EAAM,SAAS;CAAI,CAAC,EAAA,CAC7F;CACF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,QAAQ,WAAW,KAAK,QAAQ,EAAE,EAAE,SAAS,SAAS,MACxD,MAAM,IAAI,MAAM,+CAA+C,SAAS,MAAM;CAEhF,MAAM,QAAQ,QAAQ;CACtB,IAAI,OAAO,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACvE,MAAM,IAAI,MAAM,mDAAmD,SAAS,MAAM;CAEpF,MAAM,SAAS,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAQ,MAAM;CAAM,CAAC,EAAA,CAAG;CAC1F,YAAY,OAAO,SAAS,QAAQ,SAAS,YAAY,mBAAmB,SAAS,MAAM;CAC3F,OAAO,WAAW,KAAK,KAAK;AAC9B;AAEA,eAAsB,mBACpB,UACA,UACe;CACf,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,QAAQ,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK;CAC/F,IAAI,SAAS,SAAS,YACpB,MAAM,IAAI,MAAM,sBAAsB,KAAK,kBAAkB,SAAS,YAAY;CAEpF,MAAM,QAAQ,MAAM,gBAAgB,MAAM,CAAC,aAAa,aAAa,CAAC,EAAA,CAAG,OACtE,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,IAAI,SAAS,SAAS,UACpB,MAAM,IAAI,MAAM,2BAA2B,KAAK,kBAAkB,SAAS,UAAU;AAEzF;;;;;AAMA,eAAsB,uBAAuB,OAOa;CACxD,MAAM,iBAAiB,QAAQ,MAAM,cAAc;CACnD,MAAM,mBAAmB,gBAAgB,KAAK;CAC9C,MAAM,SAAS,SACZ,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,oBAAoB,CAAC,EAAA,CAAG,OAC1E,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,MAAM,MAAO,UAAU,OAAO,SAAS,GAAG,GAC5D,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,uBAAuB,gBAAgB,QAAQ,iBAAiB;CAEtE,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,+BAA+B,CAAC;CAC/E,IAAI;EACF,MAAM,kBAAkB,KAAK,WAAW,SAAS;EACjD,MAAM,YAAY,KAAK,WAAW,OAAO;EACzC,MAAM,MAAM,eAAe;EAC3B,MAAM,iBAAiB;GACrB,gBAAgB;GAChB,sBAAsB;GACtB,kCAAkC,KAAK,QAAQ,SAAS;EAC1D;EACA,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,MAAM,QAAQ,GAAG,KAAA,GAAW,cAAc;EAC9F,IAAI,MAAM,MAAM,aAAa,GAC3B,MAAM,gBACJ,gBACA;GAAC;GAAS;GAAY;GAAY;GAAuB;EAAG,GAC5D,MAAM,OACN,cACF;EAEF,MAAM,cACJ,MAAM,gBAAgB,gBAAgB,CAAC,YAAY,GAAG,KAAA,GAAW,cAAc,EAAA,CAC/E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EACR,IAAI,eAAe,MAAM,YACvB,MAAM,IAAI,MACR,wCAAwC,WAAW,kBAAkB,MAAM,YAC7E;EAEF,MAAM,eAAe,gBAAgB,YAAY,cAAc;EAC/D,MAAM,WAAW,MAAM,6BAA6B,gBAAgB,YAAY,cAAc;EAC9F,IACE,CAAC,OAAO,KAAKC,0BAAwB,QAAQ,CAAC,CAAC,CAAC,OAC9C,OAAO,KAAKA,0BAAwB,MAAM,UAAU,CAAC,CACvD,GAEA,MAAM,IAAI,MAAM,sEAAsE;EAExF,MAAM,gBACJ,MAAM,gBACJ,gBACA;GAAC;GAAe;GAAY;GAAM,MAAM;EAAU,GAClD,OAAO,KAAK,4BAA4B,MAAM,GAC9C;GACE,GAAG;GACH,iBAAiB;GACjB,kBAAkB;GAClB,iBAAiB;GACjB,oBAAoB;GACpB,qBAAqB;GACrB,oBAAoB;EACtB,CACF,EAAA,CACA,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EAWR,KATE,MAAM,gBACJ,gBACA,CAAC,aAAa,GAAG,aAAa,QAAQ,GACtC,KAAA,GACA,cACF,EAAA,CACA,OACC,SAAS,MAAM,CAAC,CAChB,KACa,MAAM,YACpB,MAAM,IAAI,MAAM,sEAAsE;EAExF,OAAO;GAAE;GAAY;EAAa;CACpC,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAe,uBACb,YACA,cACiB;CACjB,MAAM,iBAAiB,QAAQ,MAAM,aAAa,QAAQ,UAAU,CAAC;CAErE,IAAI,EAAC,MADmB,KAAK,cAAc,EAAA,CAC5B,YAAY,GAAG,MAAM,IAAI,MAAM,8CAA8C;CAE5F,MAAM,UAAU,MAAM,gBAAgB,gBAAgB;EAAC;EAAU;EAAW;CAAQ,CAAC,EAAA,CAAG,OACrF,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,SAAS,kBAAkB,MAAM;CACvC,IAAI,CAAC,UAAU,OAAO,UAAU,WAAW,SAAS,OAAO,SAAS,WAAW,MAC7E,MAAM,IAAI,MACR,2BAA2B,UAAU,YAAY,6BAA6B,WAAW,MAAM,GAAG,WAAW,MAC/G;CASF,MAAM,uBAAuB,gBADd,SAJb,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,oBAAoB,CAAC,EAAA,CACzE,OACC,SAAS,MAAM,CAAC,CAChB,KAC6B,CACkB,GAAG,sBAAsB;CAC3E,OAAO;AACT;AAEA,eAAsB,uBACpB,gBACA,QACA,OACe;CAMf,KAJE,MAAM,gBAAgB,gBAAgB;EAAC;EAAgB;EAAuB;CAAc,CAAC,EAAA,CAC7F,OACC,SAAS,MAAM,CAAC,CAChB,KACY,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CAMtE,MAAM,YAAY,MAAM,SACtB,QACE,iBACC,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,kBAAkB,CAAC,EAAA,CAAG,OACxE,SAAS,MAAM,CAAC,CAChB,KAAK,CACV,CACF;CACA,IAAI,UAAU,SAAS,GAAG,GACxB,MAAM,IAAI,MAAM,GAAG,MAAM,8CAA8C;CAEzE,KAAK,MAAM,8BAAc,IAAI,IAAI,CAAC,QAAQ,SAAS,CAAC,GAClD,KAAK,MAAM,QAAQ,CAAC,cAAc,iBAAiB,GAAG;EACpD,MAAM,OAAO,KAAK,YAAY,WAAW,QAAQ,IAAI;EACrD,IAAI;GAEF,KAAI,MADmB,SAAS,MAAM,MAAM,EAAA,CAC/B,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sBAAsB,MAAM;EAC5E,SAAS,OAAO;GACd,IAAI,CAAC,UAAU,KAAK,GAAG,MAAM;EAC/B;CACF;AAEJ;AAEA,eAAe,wBACb,gBACA,QACA,cACe;CAIf,KAHc,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAM;CAAM,CAAC,EAAA,CAAG,OAC9E,SAAS,MAAM,CAAC,CAChB,KACI,MAAM,UAAU,MAAM,IAAI,MAAM,0CAA0C,QAAQ;CACzF,MAAM,cACJ,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,GAAG,OAAO,QAAQ,CAAC,EAAA,CACvE,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,IAAI,eAAe,cACjB,MAAM,IAAI,MAAM,8BAA8B,WAAW,kBAAkB,cAAc;AAE7F;AAEA,eAAe,eACb,gBACA,MACA,cAAsC,CAAC,GACxB;CACf,MAAM,WACJ,MAAM,gBACJ,gBACA;EAAC;EAAW;EAAO;EAAe;CAAI,GACtC,KAAA,GACA,WACF,EAAA,CACA;CACF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,QAAQ,WAAW,GAAG,MAAM,IAAI,MAAM,oCAAoC;CAC9E,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,MAAM,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACtE,MAAM,IAAI,MACR,kEAAkE,MAAM,MAC1E;EAEF,kBAAkB,MAAM,IAAI;CAC9B;AACF;AAEA,eAAe,6BACb,gBACA,MACA,aACkD;CAClD,OAAO,2BACL,MAAM,0BAA0B,gBAAgB,MAAM,WAAW,CACnE;AACF;AAEA,eAAsB,0BACpB,gBACA,MACA,cAAsC,CAAC,GACvC,QAC0E;CAC1E,MAAM,WACJ,MAAM,gBACJ,gBACA;EAAC;EAAW;EAAQ;EAAe;CAAI,GACvC,KAAA,GACA,WACF,EAAA,CACA;CACF,MAAM,QAAyE,CAAC;CAChF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,UAAU,QAAQ,SAAS,OAAO,UACpC,MAAM,IAAI,MAAM,qCAAqC;CAEvD,IAAI,aAAa;CACjB,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,MAAM,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACtE,MAAM,IAAI,MAAM,mDAAmD,MAAM,MAAM;EAEjF,kBAAkB,MAAM,IAAI;EAC5B,IAAI,MAAM,SAAS,KAAA,GACjB,MAAM,IAAI,MAAM,4CAA4C,MAAM,MAAM;EAE1E,IAAI,UAAU,MAAM,OAAO,OAAO,cAChC,MAAM,IAAI,MAAM,iDAAiD,MAAM,MAAM;EAE/E,cAAc,MAAM;EACpB,IAAI,UAAU,aAAa,OAAO,mBAChC,MAAM,IAAI,MAAM,8CAA8C;EAEhE,MAAM,SACJ,MAAM,gBACJ,gBACA;GAAC;GAAY;GAAQ,MAAM;EAAM,GACjC,KAAA,GACA,WACF,EAAA,CACA;EACF,IAAI,MAAM,eAAe,MAAM,MAC7B,MAAM,IAAI,MAAM,oCAAoC,MAAM,MAAM;EAElE,MAAM,KAAK;GACT,MAAM,MAAM;GACZ,MAAM,MAAM,SAAS,WAAW,MAAQ;GACxC,OAAO,WAAW,KAAK,KAAK;EAC9B,CAAC;CACH;CACA,OAAO,MAAM,MAAM,MAAM,UAAW,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,CAAE;AACnG;AAEA,SAAS,iBAAiB,OAMvB;CACD,MAAM,MAAM,OAAO,KAAK,KAAK;CAC7B,MAAM,UAAU,IAAI,SAAS,MAAM;CACnC,IAAI,CAAC,OAAO,KAAK,SAAS,MAAM,CAAC,CAAC,OAAO,GAAG,GAC1C,MAAM,IAAI,MAAM,8CAA8C;CAGhE,OADa,QAAQ,MAAM,IAAI,CAAC,CAAC,OAAO,OAC9B,CAAC,CAAC,KAAK,QAAQ;EACvB,MAAM,MAAM,IAAI,QAAQ,GAAI;EAC5B,MAAM,SAAS,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;EAC1D,MAAM,OAAO,IAAI,MAAM,MAAM,CAAC;EAC9B,MAAM,CAAC,MAAM,MAAM,QAAQ,YAAY;EACvC,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,MAC3C,MAAM,IAAI,MAAM,0BAA0B;EAE5C,MAAM,OAAO,YAAY,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,IAAI,KAAA;EACrE,IAAI,SAAS,KAAA,KAAa,CAAC,OAAO,cAAc,IAAI,GAClD,MAAM,IAAI,MAAM,8DAA8D;EAEhF,OAAO;GAAE;GAAM;GAAM;GAAQ,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;GAAI;EAAK;CAC7E,CAAC;AACH;AAEA,SAAS,kBAAkB,MAAoB;CAC7C,IACE,CAAC,QACD,KAAK,WAAW,GAAG,KACnB,KAAK,SAAS,IAAI,KAClB,KAAK,SAAS,IAAI,KAClBC,sBAAoB,IAAI,KACxB,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,KACrE,KAAK,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,YAAY,MAAM,QAEtC,MAAM,IAAI,MAAM,+CAA+C,MAAM;AAEzE;AAEA,SAASA,sBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,OAAO,MAAQ,SAAS,KAAM,OAAO;CAC3C;CACA,OAAO;AACT;AAEA,SAAS,kBAAkB,OAA4D;CACrF,MAAM,QAAQ,MAAM,MAClB,sGACF;CACA,IAAI,CAAC,QAAQ,MAAM,CAAC,MAAM,IAAI,OAAO,KAAA;CACrC,OAAO;EAAE,OAAO,MAAM;EAAI,MAAM,MAAM;CAAG;AAC3C;AAEA,eAAsB,gBACpB,gBACA,MACA,OACA,WAAmC,CAAC,GAChB;CACpB,MAAM,MAAM,OAAO,YACjB,OAAO,QAAQ,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,WAAW,MAAM,CAAC,CACzE;CACA,OAAO,OAAO,KAAK;EACjB,qBAAqB;EACrB,mBAAmB;EACnB,mBAAmB;EACnB,qBAAqB;EACrB,wBAAwB;EACxB,QAAQ;EACR,GAAG;CACL,CAAC;CACD,MAAM,WAAW;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,GAAG;CACL;CACA,OAAO,MAAM,IAAI,SAAS,eAAe,WAAW;EAClD,MAAM,QAAQ,MAAM,OAAO,UAAU;GAAE;GAAK,OAAO;IAAC;IAAQ;IAAQ;GAAM;EAAE,CAAC;EAC7E,MAAM,SAAmB,CAAC;EAC1B,MAAM,SAAmB,CAAC;EAC1B,MAAM,OAAO,GAAG,SAAS,UAAkB,OAAO,KAAK,KAAK,CAAC;EAC7D,MAAM,OAAO,GAAG,SAAS,UAAkB,OAAO,KAAK,KAAK,CAAC;EAC7D,MAAM,GAAG,SAAS,MAAM;EACxB,MAAM,GAAG,UAAU,MAAM,WAAW;GAClC,MAAM,MAAM,OAAO,OAAO,MAAM;GAChC,MAAM,MAAM,OAAO,OAAO,MAAM;GAChC,IAAI,SAAS,GAAG;IACd,uBACE,IAAI,MACF,OAAO,KAAK,MAAM,YAAY,WAAW,UAAU,KAAK,KAAK,IAAI,SAAS,MAAM,CAAC,CAAC,KAAK,GACzF,CACF;IACA;GACF;GACA,cAAc;IAAE,QAAQ;IAAK,QAAQ;GAAI,CAAC;EAC5C,CAAC;EACD,IAAI,OAAO,MAAM,MAAM,IAAI,KAAK;OAC3B,MAAM,MAAM,IAAI;CACvB,CAAC;AACH;AAEA,SAAS,UAAU,OAAyB;CAC1C,OACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAA4B,SAAS;AAE1C;;;;ACrfA,eAAsB,+BACpB,MACA,OAMoC;CACpC,MAAM,QAAQ,eAAe;CAC7B,MAAM,QAAQ,WAAW,KAAK,MAAM,KAAK;CACzC,MAAM,iBAAiBC,cAAY,KAAK;CACxC,MAAM,MAAM,gCAAgC,MAC1C,MAAM,KAAK,IAAI;EACb,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,OAAO,WAAW,KAAK,KAAK;EAC5B,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;CACjD,CAAC,CACH;CACA,MAAM,QAAQ,eAAe;CAC7B,IAAI,IAAI,WAAW,kBAAkB,IAAI,eAAe,MAAM,YAC5D,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG;CAClC,MAAM,QAAQ,eAAe;CAC7B,YAAY,QAAQ,gBAAgB,MAAM,YAAY,4BAA4B;CAClF,OAAO,wBAAwB,GAAG;AACpC;;;ACUA,MAAM,cAAc;AACpB,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;AAChC,MAAM,wBAAwB;AAC9B,MAAM,+BAAe,IAAI,KAAK,CAAC;AAY/B,MAAM,gBAAsD,OAAO,OAAO;CACxE,iBAAiB,MAAM,OAAO;CAC9B,0BAA0B,OAAO;CACjC,UAAU;CACV,cAAc,MAAM,OAAO;CAC3B,mBAAmB,MAAM,OAAO;CAChC,cAAc;CACd,0BAA0B,MAAM,OAAO;AACzC,CAAC;;AAkDD,eAAsB,+BACpB,WACA,UAAiD,CAAC,GACR;CAC1C,MAAM,OAAO,QAAQ,SAAS;CAC9B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,MAAM,WAAW,QAAQ,oBACrB,MAAM,kBAAkB,MAAM,MAAM,IACpC,MAAM,6BAA6B,MAAM,EACvC,QAAQ;EACN,UAAU,OAAO;EACjB,cAAc,OAAO;EACrB,mBAAmB,OAAO;CAC5B,EACF,CAAC;CACL,iCAAiC,SAAS,OAAO,MAAM;CACvD,MAAM,aAAa,gBAAgB,WAAW,SAAS,aAAa,KAAA;CACpE,OAAO,sBAAsB,SAAS,OAAO,YAAY,QAAQ,QAAQ,mBAAmB;AAC9F;;AAGA,eAAsB,oCACpB,OACA,UAA4E,CAAC,GACnC;CAC1C,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,OAAO,sBACL,wBAAwB,OAAO,MAAM,GACrC,KAAA,GACA,QACA,QAAQ,mBACV;AACF;AAEA,eAAe,sBACb,OACA,YACA,QACA,qBAC0C;CAC1C,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,WAAWC,0BAAwB,QAAQ;CACjD,MAAM,UAAU,MAAM,uBAAuB,OAAO,YAAY,OAAO,eAAe;CACtF,IACE,CAAC,wBACA,SAAS,aAAa,OAAO,4BAC5B,QAAQ,aAAa,OAAO,2BAE9B,MAAM,IAAI,MACR,gGACF;CAEF,MAAM,mBAAmB,MAAM,yBAAyB,YAAY,UAAU,mBAAmB;CACjG,MAAM,kBAAkB,MAAM,yBAAyB,WAAW,SAAS,mBAAmB;CAC9F,MAAM,WAAW,oBAAoB;EACnC,MAAM;EACN,QAAQC,2BAAyB,QAAQ;EACzC;EACA,UAAU;EACV,SAAS;CACX,CAAmD;CACnD,OAAO,OAAO,OAAO;EAAE;EAAU;CAAQ,CAAC;AAC5C;AAEA,eAAe,yBACb,MACA,OACA,aACyC;CACzC,IAAI,CAAC,aAAa,OAAO,0BAA0B,KAAK;CACxD,IAAI,CAAC,YAAY,YAAY,KAAK,GAChC,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO,+BAA+B,YAAY,iBAAiB;EACjE,aAAa,YAAY;EACzB,SAAS,SAAS,aAAa,iCAAiC;EAChE;EACA,GAAI,YAAY,SAAS,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;CAC7D,CAAC;AACH;;AAGA,SAAgB,kCACd,UAAoD,CAAC,GACxB;CAC7B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAY7C,OAAO,OAAO,OAAO,EAVnB,aAAa,OAAO,EAAE,MAAM,UAAU,SAAS,kBAAkB;EAC/D,MAAM,mCAAmC;GACvC;GACA;GACA;GACA;GACA;EACF,CAAC;CACH,EAEsB,CAAC;AAC3B;AAEA,eAAe,mCAAmC,OAMhC;CAChB,MAAM,UAAU,MAAM,+BAA+B,KAAK;CAC1D,MAAM,cAAc,QAAQ,MAAM,WAAW;CAC7C,MAAM,wBAAwB,WAAW;CACzC,MAAM,UAAU,MAAM,QAAQ,GAAG,YAAY,gBAAgB;CAC7D,IAAI;EACF,MAAM,oBAAoB,SAAS,QAAQ,KAAK;EAChD,IAAI,QAAQ,YACV,MAAM,sBAAsB,QAAQ,YAAY,OAAO;EAEzD,MAAM,4BAA4B,SAAS,MAAM,SAAS,UAAU,EAClE,6BAA6B,QAAQ,aAAa,CAAC,MAAM,IAAI,CAAC,EAChE,CAAC;EACD,MAAM,OAAO,SAAS,WAAW;CACnC,SAAS,OAAO;EACd,MAAM,GAAG,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAClD,MAAM,GAAG,aAAa;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACtD,MAAM;CACR;AACF;;AAGA,eAAsB,qCAAqC,OAKzC;CAChB,MAAM,+BAA+B;EAAE,GAAG;EAAO,QAAQ,gBAAgB,MAAM,MAAM;CAAE,CAAC;AAC1F;AAEA,eAAe,+BAA+B,OAKT;CACnC,YACE,MAAM,SACN,MAAM,SAAS,QAAQ,QACvB,MAAM,SAAS,QAAQ,YACvB,6BACF;CACA,MAAM,UAAU,MAAM,sBAAsB,MAAM,SAAS,MAAM,MAAM;CACvE,IAAI,QAAQ,cAAc,MAAM,SAAS,QACvC,MAAM,IAAI,MAAM,iDAAiD;CAEnE,6BAA6B,QAAQ,OAAO,MAAM,QAAQ;CAC1D,OAAO;AACT;AAEA,eAAe,kBACb,eACA,QAIC;CACD,MAAM,iBAAiB,MAAM,MAAM,aAAa;CAChD,IAAI,CAAC,eAAe,YAAY,KAAK,eAAe,eAAe,GACjE,MAAM,IAAI,MAAM,oDAAoD;CAOtE,MAAM,OAAO,MAAM,SAAS,aAAa;CACzC,MAAM,gBAAgB,MAAM,MAAM,IAAI;CACtC,IAAI,CAAC,cAAc,YAAY,KAAK,cAAc,eAAe,GAC/D,MAAM,IAAI,MAAM,4DAA4D;CAK9E,IAAK,MAAM,SAAS,SAHF,MAAM,gBAAgB,MAAM,CAAC,aAAa,iBAAiB,CAAC,EAAA,CAAG,OAC9E,SAAS,MAAM,CAAC,CAChB,KACgC,CAAC,CAAC,MAAO,MAC1C,MAAM,IAAI,MAAM,kEAAkE;CAEpF,MAAM,SAAS,SACZ,MAAM,gBAAgB,MAAM,CAAC,aAAa,oBAAoB,CAAC,EAAA,CAAG,OAChE,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,MAAM,MAAO,UAAU,OAAO,SAAS,GAAG,GAC5D,MAAM,IAAI,MAAM,+DAA+D;CAEjF,MAAM,uBAAuB,MAAM,QAAQ,sBAAsB;CACjE,MAAM,cAAc,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OACrE,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,YAAY,MAAM,gBAAgB,MAAM,CAAC,aAAa,aAAa,CAAC,EAAA,CAAG,OAC1E,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,kBAAkB,YAAY,MAAM;CACpC,kBAAkB,UAAU,WAAW;CACvC,IAAI,WAAW,WAAW,SAAS,QACjC,MAAM,IAAI,MAAM,iEAAiE;CAEnF,MAAM,QAAQ,MAAM,0BAA0B,MAAM,UAAU,CAAC,GAAG,MAAM;CACxE,iCAAiC,OAAO,MAAM;CAC9C,MAAM,sBACJ,MAAM,gBAAgB,MAAM;EAAC;EAAY;EAAgB;EAAa;CAAM,CAAC,EAAA,CAC7E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,iBAAiB,OAAO,kBAAkB;CAChD,IAAI,CAAC,OAAO,cAAc,cAAc,KAAK,iBAAiB,GAC5D,MAAM,IAAI,MAAM,gDAAgD;CAElE,IAAI,iBAAiB,OAAO,0BAC1B,MAAM,IAAI,MAAM,uDAAuD;CAEzE,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,MAAM,gBAAgB,MAAM;GAAC;GAAU;GAAU;GAAY;EAAM,CAAC;EACpE,MAAM,SAAS,WAAW,KAAK,MAAM,SAAS,UAAU,CAAC;EACzD,IAAI,OAAO,aAAa,OAAO,0BAC7B,MAAM,IAAI,MAAM,8DAA8D;EAEhF,OAAO;GACL;GACA,YAAY;IACV;IACA;IACA,QAAQ;KACN,QAAQC,cAAY,MAAM;KAC1B,YAAY,OAAO;KACnB,OAAO;IACT;GACF;EACF;CACF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAe,uBACb,OACA,YACA,iBACqB;CACrB,MAAM,UAAU,KAAK;CACrB,MAAM,SAAS,cAAc,SAAS,iBAAiB,6BAA6B;CACpF,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,OAAO,MAAM;CACf,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,OAAO,YAAY,KAAA,CAAS;EAClC,MAAM;CACR;AACF;AAEA,eAAe,gCACb,OACA,YACA,UACA,iBACe;CACf,MAAM,UAAU,KAAK;CACrB,MAAM,aAAa,kBACjB,SACA,UACA,iBACA,6BACF;CACA,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,IAAI,CAAE,MAAM,YAAa,MAAM,IAAI,MAAM,0CAA0C;CACrF,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,WAAW,YAAY,KAAA,CAAS;EACtC,MAAM;CACR;AACF;AAEA,eAAe,6BACb,SACA,OACA,YACe;CACf,KAAK,MAAM,QAAQ,OACjB,MAAM,cAAc,SAAS,GAAG,uBAAuB,KAAK,QAAQ,KAAK,MAAM,KAAK,KAAK;CAE3F,IAAI,CAAC,YAAY;CACjB,MAAM,WAAWF,0BAAwB;EACvC,MAAM;EACN,YAAY,WAAW;EACvB,UAAU,WAAW;EACrB,QAAQ;GACN,QAAQ,WAAW,OAAO;GAC1B,YAAY,WAAW,OAAO;EAChC;CACF,CAA8C;CAC9C,MAAM,cAAc,SAAS,yBAAyB,KAAO,QAAQ;CACrE,MAAM,cAAc,SAAS,uBAAuB,KAAO,WAAW,OAAO,KAAK;AACpF;AAEA,eAAe,sBACb,OACA,QACkC;CAClC,IAAI,MAAM,aAAa,OAAO,iBAC5B,MAAM,IAAI,MAAM,qDAAqD;CAEvE,MAAM,SAAS,QAAQ;CACvB,MAAM,QAA0C,CAAC;CACjD,MAAM,qCAAqB,IAAI,IAAY;CAC3C,MAAM,gCAAgB,IAAI,IAAY;CACtC,IAAI,aAAa;CACjB,IAAI,qBAAqB;CACzB,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,WAAW,YAAY;EAC3B,WAAW,MAAM,SAAS,QAAQ;GAChC,MAAM,OAAO,MAAM,OAAO;GAC1B,IACE,MAAM,OAAO,SAAS,UACtB,OAAO,SAAS,YAChB,mBAAmB,IAAI,IAAI,GAE3B,MAAM,IAAI,MAAM,mDAAmD;GAErE,mBAAmB,IAAI,IAAI;GAC3B,IAAI,KAAK,WAAW,oBAAoB,GAAG;IACzC,IAAI,MAAM,UAAU,OAAO,UACzB,MAAM,IAAI,MAAM,uDAAuD;IAEzE,MAAM,OAAO,gBAAgB,KAAK,MAAM,EAA2B,GAAG,OAAO,YAAY;IACzF,IAAI,CAAC,oBAAoB,MAAM,OAAO,IAAI,GACxC,MAAM,IAAI,MAAM,wDAAwD,MAAM;IAEhF,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,YAAY,MAAM,aAAa,OAAO,OAAO,cAAc,kBAAkB,MAAM;IACzF,sBAAsB,UAAU;IAChC,yBACE,MACA,cACA,eACA,6DACF;IACA,eAAe;IACf,IAAI,UAAU,aAAa,OAAO,oBAAoB,YACpD,MAAM,IAAI,MAAM,uDAAuD;IAEzE,cAAc,UAAU;IACxB,MAAM,KAAK;KAAE;KAAM,MAAM,MAAM,OAAO;KAAM,OAAO;IAAU,CAAC;GAChE,OAAO,IAAI,SAAS,yBAAyB;IAC3C,IAAI,MAAM,OAAO,SAAS,OAAS,oBACjC,MAAM,IAAI,MAAM,4DAA4D;IAE9E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,gBAAgB,MAAM,aAC1B,OACA,OAAO,cACP,+BACF;IACA,sBAAsB,cAAc;IACpC,qBAAqB,wBAAwB,eAAe,OAAO,wBAAwB;GAC7F,OAAO,IAAI,SAAS,uBAAuB;IACzC,IAAI,MAAM,OAAO,SAAS,OAAS,kBACjC,MAAM,IAAI,MAAM,0DAA0D;IAE5E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,mBAAmB,MAAM,aACvB,OACA,OAAO,0BACP,sBACF;IACA,sBAAsB,iBAAiB;GACzC,OACE,MAAM,IAAI,MAAM,0DAA0D,MAAM;EAEpF;EACA,IAAI,QAAQ,kBAAkB,MAAM,QAAQ,gBAAgB,GAC1D,MAAM,IAAI,MAAM,+DAA+D;EAEjF,MAAM,aACJ,sBAAsB,mBAClB,kBAAkB,oBAAoB,gBAAgB,IACtD,KAAA;EACN,OAAO;GAAE;GAAO,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EAAG;CACxD,EAAA,CAAG;CACH,OAAO,IAAI,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,CAAC;CACxE,MAAM,SAAS,MAAM;CACrB,MAAM,gCACJ,OAAO,OACP,OAAO,YACP,OACA,OAAO,eACT;CACA,OAAO;AACT;AAEA,SAAS,0BACP,cACA,oBACA,YACA,QACM;CACN,IACE,CAAC,OAAO,cAAc,UAAU,KAChC,eAAe,KAAA,KACf,aAAa,KACb,aAAa,OAAO,kBAAkB,eAAe,oBAErD,MAAM,IAAI,MAAM,oEAAoE;AAExF;AAEA,SAAS,wBACP,OACA,gBACoC;CACpC,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC5E,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,8DAA8D,EAAE,OAAO,MAAM,CAAC;CAChG;CACA,IACE,CAAC,SAAS,KAAK,KACf,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,qCACxC,MAAM,SAAS,eACf,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,aAAa,YAC1B,CAAC,SAAS,MAAM,MAAM,KACtB,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,uBAC/C,OAAO,MAAM,OAAO,WAAW,YAC/B,CAAC,wBAAwB,KAAK,MAAM,OAAO,MAAM,KACjD,CAAC,OAAO,cAAc,MAAM,OAAO,UAAU,KAC5C,MAAM,OAAO,cAAyB,KACtC,MAAM,OAAO,aAAwB,gBAEtC,MAAM,IAAI,MAAM,mDAAmD;CAErE,IAAI,CAAC,OAAO,KAAKA,0BAAwB,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,KAAK,KAAK,CAAC,GACxE,MAAM,IAAI,MAAM,kEAAkE;CAEpF,kBAAkB,MAAM,YAAY,iBAAiB;CACrD,kBAAkB,MAAM,UAAU,sBAAsB;CACxD,IAAI,MAAM,WAAW,WAAW,MAAM,SAAS,QAC7C,MAAM,IAAI,MAAM,iEAAiE;CAEnF,OAAO;EACL,MAAM;EACN,YAAY,MAAM;EAClB,UAAU,MAAM;EAChB,QAAQ;GACN,QAAQ,MAAM,OAAO;GACrB,YAAY,MAAM,OAAO;EAC3B;CACF;AACF;AAEA,SAAS,kBACP,UACA,QAC4B;CAC5B,YAAY,QAAQ,SAAS,OAAO,QAAQ,SAAS,OAAO,YAAY,sBAAsB;CAC9F,OAAO;EACL,YAAY,SAAS;EACrB,UAAU,SAAS;EACnB,QAAQ;GAAE,GAAG,SAAS;GAAQ,OAAO;EAAO;CAC9C;AACF;AAEA,eAAe,cACb,SACA,MACA,MACA,OACe;CACf,MAAM,IAAI,SAAe,cAAc,gBAAgB;EACrD,QAAQ,MACN;GACE;GACA;GACA,KAAK;GACL,KAAK;GACL,MAAM,MAAM;GACZ,OAAO;GACP,MAAM;GACN,OAAO;GACP,OAAO;EACT,GACA,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,IAC3D,UAAW,QAAQ,YAAY,KAAK,IAAI,aAAa,CACxD;CACF,CAAC;AACH;AAIA,eAAe,aAAa,OAAiB,UAAkB,OAAoC;CACjG,MAAM,OAAO,MAAM,OAAO;CAC1B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,SAAS,KAAA,KAAa,OAAO,KAAK,OAAO,UAC1E,MAAM,IAAI,MAAM,GAAG,MAAM,yBAAyB;CAEpD,MAAM,QAAQ,MAAM,cAAc,OAAO,UAAU,KAAK;CACxD,IAAI,MAAM,eAAe,MAAM,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CACnF,OAAO;AACT;AAEA,eAAe,cACb,QACA,UACA,OACqB;CACrB,MAAM,SAAmB,CAAC;CAC1B,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B;EAErD,IAAI,MAAM,aAAa,WAAW,YAAY;GAC5C,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,QAAQ,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;EAChE,OAAO,KAAK,KAAK;EACjB,cAAc,MAAM;CACtB;CACA,OAAO,OAAO,OAAO,QAAQ,UAAU;AACzC;AAEA,eAAe,kBACb,QACA,UACA,UACA,OACkB;CAClB,MAAM,iBAAiB,OAAO,KAAK,SAAS,QAAQ,SAAS,YAAY,SAAS,UAAU;CAC5F,IAAI,QAAQ;CACZ,IAAI,SAAS;CACb,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B;EAErD,IAAI,MAAM,aAAa,WAAW,QAAQ;GACxC,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,WAAW,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU;EAC7E,IACE,SAAS,SAAS,aAAa,eAAe,cAC9C,CAAC,SAAS,OAAO,eAAe,SAAS,QAAQ,SAAS,SAAS,UAAU,CAAC,GAE9E,QAAQ;EAEV,UAAU,SAAS;CACrB;CACA,OAAO,SAAS,WAAW,eAAe;AAC5C;AAEA,eAAe,wBAAwB,aAAoC;CACzE,MAAM,MAAM,aAAa;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACzD,MAAM,QAAQ,MAAM,MAAM,WAAW;CACrC,IAAI,CAAC,MAAM,YAAY,KAAK,MAAM,eAAe,GAC/C,MAAM,IAAI,MAAM,0DAA0D;CAM5E,MAAM,gBAAgB,MAAM,MAAM,MADA,SAAS,WAAW,CACD;CACrD,IAAI,CAAC,cAAc,YAAY,KAAK,cAAc,eAAe,GAC/D,MAAM,IAAI,MAAM,kEAAkE;CAEpF,KAAK,MAAM,QAAQ,WAAW,EAAA,CAAG,SAAS,GACxC,MAAM,IAAI,MAAM,+CAA+C;AAEnE;AAEA,eAAe,oBACb,aACA,OACe;CACf,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,cAAc,aAAa,KAAK,IAAI;EACjD,MAAM,MAAM,QAAQ,IAAI,GAAG;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC3D,MAAM,aAAa,MAAM,KACvB,MACAG,UAAY,WACVA,UAAY,UACZA,UAAY,UACX,OAAOA,UAAY,eAAe,WAAWA,UAAY,aAAa,IACzE,GACF;EACA,IAAI;GACF,MAAM,WAAW,UAAU,KAAK,KAAK;GACrC,MAAM,QAAQ,MAAM,WAAW,KAAK;GACpC,IAAI,CAAC,MAAM,OAAO,KAAK,MAAM,UAAU,GACrC,MAAM,IAAI,MAAM,4DAA4D,KAAK,MAAM;GAEzF,MAAM,WAAW,MAAM,KAAK,IAAI;EAClC,UAAU;GACR,MAAM,WAAW,MAAM;EACzB;CACF;AACF;AAEA,eAAe,sBACb,YACA,aACe;CACf,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,MAAM,UAAU,YAAY,WAAW,OAAO,OAAO;GAAE,MAAM;GAAM,MAAM;EAAM,CAAC;EAChF,MAAM,gBAAgB,aAAa;GACjC;GACA;GACA;GACA,mBAAmB,WAAW,WAAW,WAAW,KAAK,WAAW;EACtE,CAAC;EACD,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAU;EAAU,CAAC;EACnE,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAY;EAAU,CAAC;EAMrE,KAJE,MAAM,gBAAgB,aAAa;GAAC;GAAY;GAAM,WAAW;EAAU,CAAC,EAAA,CAC5E,OACC,SAAS,MAAM,CAAC,CAChB,KACU,MAAM,UAAU,MAAM,IAAI,MAAM,2CAA2C;EAMxF,KAJE,MAAM,gBAAgB,aAAa,CAAC,aAAa,GAAG,WAAW,WAAW,QAAQ,CAAC,EAAA,CACnF,OACC,SAAS,MAAM,CAAC,CAChB,KACY,MAAM,WAAW,UAC9B,MAAM,IAAI,MAAM,+CAA+C;EAEjE,MAAM,gBAAgB,aAAa;GAAC;GAAc;GAAc;GAAQ,WAAW;EAAU,CAAC;EAC9F,MAAM,gBAAgB,aAAa,CAAC,aAAa,WAAW,QAAQ,CAAC;EAMrE,KAJE,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAkB;EAAuB,CAAC,EAAA,CACxF,OACC,SAAS,MAAM,CAAC,CAChB,KACM,GAAG,MAAM,IAAI,MAAM,sDAAsD;CACpF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,SAAS,6BACP,OACA,UACM;CACN,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,gBAAgBH,0BAAwB,QAAQ;CACtD,YACE,eACA,SAAS,SAAS,QAClB,SAAS,SAAS,YAClB,8BACF;CACA,IACEC,2BAAyB,QAAQ,MAAM,SAAS,UAChD,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,OAAO,OAAO,KAAKD,0BAAwB,SAAS,QAAQ,CAAC,CAAC,GAE1F,MAAM,IAAI,MAAM,kEAAkE;AAEtF;AAEA,SAAS,iCACP,OACA,QACM;CACN,IAAI,MAAM,SAAS,OAAO,UACxB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,IAAI;CACJ,MAAM,gCAAgB,IAAI,IAAY;CACtC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,gBAAgB,KAAK,MAAM,OAAO,YAAY;EAC3D,yBACE,MACA,cACA,eACA,qDACF;EACA,eAAe;EACf,IAAI,CAAC,oBAAoB,KAAK,IAAI,GAChC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,KAAK,MAAM,aAAa,OAAO,cACjC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,cAAc,KAAK,MAAM;EACzB,IAAI,aAAa,OAAO,mBACtB,MAAM,IAAI,MAAM,+CAA+C;CAEnE;AACF;AAEA,SAAS,wBACP,OACA,QACuC;CACvC,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,MAAM,4CAA4C;CAE9D,MAAM,YAAY,MAAM;CACxB,IAAI,YAAY,OAAO,UACrB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,MAAM,QAA+C,CAAC;CACtD,KAAK,IAAI,QAAQ,GAAG,QAAQ,WAAW,SAAS;EAC9C,MAAM,YAAY,MAAM;EACxB,IAAI,CAAC,SAAS,SAAS,KAAK,OAAO,KAAK,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,mBACtE,MAAM,IAAI,MAAM,4BAA4B,MAAM,YAAY;EAEhE,MAAM,cAAc,OAAO,0BAA0B,SAAS;EAC9D,IACE,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,SAAS,CAAC,KAEpC,MAAM,IAAI,MAAM,4BAA4B,MAAM,uBAAuB;EAE3E,MAAM,OAAO,gBAAgB,YAAY,MAAM,OAAO,OAAO,YAAY;EACzE,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,aAAa,YAAY,OAAO;EACtC,IAAI,CAAC,oBAAoB,IAAI,GAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,MAAM,OAAO,sBAAsB,YAAY,IAAI;EACnD,IAAI,KAAK,aAAa,OAAO,cAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,KAAK,aAAa,OAAO,oBAAoB,YAC/C,MAAM,IAAI,MAAM,+CAA+C;EAEjE,IAAI,KAAK,aAAa,KAAK,IAAI,GAAG,OAAO,kBAAkB,IAAI,GAC7D,MAAM,IAAI,MAAM,qDAAqD;EAEvE,cAAc,KAAK;EACnB,MAAM,KAAK;GAAE;GAAM;GAAM,OAAO,qBAAqB,IAAI;EAAE,CAAC;CAC9D;CACA,MAAM,MAAM,MAAM,UAAW,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,CAAE;CAC1F,iCAAiC,OAAO,MAAM;CAC9C,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAiC;CAC5D,OAAO,OAAO,cAAc,KAAK,KAAM,SAAoB,KAAM,SAAoB;AACvF;AAEA,SAAS,gBACP,WACsC;CACtC,MAAM,SAAS;EAAE,GAAG;EAAe,GAAG;CAAU;CAChD,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAC/C,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAC3C,MAAM,IAAI,MAAM,uBAAuB,KAAK,iCAAiC;CAGjF,OAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAS,gBAAgB,OAAgB,cAA8B;CACrE,IACE,OAAO,UAAU,YACjB,CAAC,SACD,CAAC,oBAAoB,KAAK,KAC1B,OAAO,WAAW,OAAO,MAAM,IAAI,gBACnC,WAAW,KAAK,KAChB,MAAM,WAAW,KAAK,KACtB,MAAM,SAAS,IAAI,KACnB,MAAM,SAAS,IAAI,KACnB,oBAAoB,KAAK,KACzB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,KACtE,CAAC,QAAQ,UAAU,CAAC,CAAC,SAAS,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,YAAY,KAAK,EAAE,GAEtE,MAAM,IAAI,MAAM,wDAAwD,OAAO,KAAK,GAAG;CAEzF,OAAO;AACT;AAEA,SAAS,yBACP,MACA,cACA,eACA,cACM;CACN,IAAI,iBAAiB,KAAA,KAAa,gBAAgB,MAAM,MAAM,IAAI,MAAM,YAAY;CACpF,KAAK,IAAI,QAAQ,KAAK,QAAQ,GAAG,GAAG,UAAU,IAAI,QAAQ,KAAK,QAAQ,KAAK,QAAQ,CAAC,GACnF,IAAI,cAAc,IAAI,KAAK,MAAM,GAAG,KAAK,CAAC,GAAG,MAAM,IAAI,MAAM,YAAY;CAE3E,cAAc,IAAI,IAAI;AACxB;AAEA,SAAS,sBACP,OACA,MACiE;CACjE,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,SAAS,uBAAuB,KAAK,KAAmB;EACxD,aAAa,2BAA2B,KAAK,KAAmB;EAChE,aAAa,2BAA2B,KAAK,KAAmB;CAClE,QAAQ;EACN,MAAM,IAAI,MAAM,+CAA+C,MAAM;CACvE;CACA,IAAI,oBAAoB,MAAM,GAC5B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,IAAI,CAAC,iBAAiB,MAAM,GAC1B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,OAAO;EAAE;EAAQ;EAAY;CAAW;AAC1C;AAEA,SAAS,qBAAqB,OAIf;CACb,MAAM,EAAE,QAAQ,YAAY,eAAe;CAC3C,MAAM,OAAO,IAAI,WAAW,UAAU;CACtC,WAAW,UAAU,IAAI,KAAK,MAAM,IAAI,WAAW,QAAQ,YAAY,UAAU,CAAC;CAClF,OAAO;AACT;AAEA,SAAS,cAAc,MAAc,cAA8B;CACjE,MAAM,OAAO,QAAQ,MAAM,YAAY;CACvC,IAAI,CAAC,KAAK,WAAW,GAAG,OAAO,KAAK,GAClC,MAAM,IAAI,MAAM,6DAA6D,cAAc;CAE7F,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAe,OAAqB;CAC7D,IAAI,CAAC,kCAAkC,KAAK,KAAK,GAC/C,MAAM,IAAI,MAAM,wBAAwB,MAAM,wBAAwB;AAE1E;AAEA,SAAS,oBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,OAAO,MAAQ,SAAS,KAAM,OAAO;CAC3C;CACA,OAAO;AACT;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAIA,SAAS,wBAAwB,MAAgE;CAC/F,MAAM,sBAAsB,OAAO,eAAe,WAAW,SAAS;CACtE,MAAM,SAAS,OAAO,yBAAyB,qBAAqB,IAAI,CAAC,EAAE;CAC3E,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,yBAAyB,KAAK,yBAAyB;CACpF,OAAO;AACT;AAEA,MAAM,yBAAyB,wBAAwB,QAAQ;AAC/D,MAAM,6BAA6B,wBAAwB,YAAY;AACvE,MAAM,6BAA6B,wBAAwB,YAAY"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-runtime",
-  "version": "0.259.1",
+  "version": "0.261.0",
   "description": "Shared task-lifecycle skeleton for agents: a recursive loop kernel for chat turns, one-shot tasks, and multi-attempt loops, with trace capture and eval-gated self-improvement. Domain behavior lives in adapters; scoring and ship-gates in @tangle-network/agent-eval.",
   "homepage": "https://github.com/tangle-network/agent-runtime#readme",
   "repository": {
@@ -98,7 +98,7 @@
     "@arethetypeswrong/cli": "0.18.5",
     "@biomejs/biome": "^2.5.11",
     "@modelcontextprotocol/sdk": "1.30.0",
-    "@tangle-network/agent-eval": "0.186.0",
+    "@tangle-network/agent-eval": "0.187.0",
     "@tangle-network/agent-interface": "^2.11.0",
     "@tangle-network/sandbox": ">=0.36.4 <0.48.0",
     "@types/node": "26.4.0",
@@ -121,13 +121,13 @@
   },
   "license": "MIT",
   "peerDependencies": {
-    "@tangle-network/agent-eval": ">=0.185.0 <0.187.0",
+    "@tangle-network/agent-eval": ">=0.185.0 <0.188.0",
     "@tangle-network/agent-interface": "^2.11.0",
     "@tangle-network/sandbox": ">=0.36.4 <0.48.0 || ^0.49.0-0"
   },
   "dependencies": {
     "@tangle-network/agent-core": ">=0.9.6 <0.10.0",
-    "@tangle-network/agent-knowledge": "^17.1.2",
+    "@tangle-network/agent-knowledge": "^17.1.3",
     "@tangle-network/agent-profile-materialize": ">=0.20.1 <0.21.0",
     "@tangle-network/agent-trace-contract": "^1.0.2",
     "tar-stream": "3.2.1"