@tangle-network/agent-runtime 0.287.0 → 0.287.2

package/dist/testing.js

@@ -1,14 +1,14 @@
 import { O as immutableCandidateValue, w as canonicalCandidateDigest$1 } from "./workspace-archive-MhowMCmp.js";
-import { f as verifyAgentImprovementProposal } from "./improvement-cycle-CYlT8ljt.js";
+import { f as verifyAgentImprovementProposal } from "./improvement-cycle-B_cNqkAZ.js";
 import { i as applyExactAgentProfileDiff, p as parseExactAgentProfile } from "./profile-C4NDjZyB.js";
-import { r as driverAgent } from "./coordination-driver-DDghv2Gd.js";
-import { a as superviseWithTestBrain, h as supervisorAgentWithTestBrain } from "./supervise-PbqXJ2vC.js";
-import { i as runGraphWithTestBrain } from "./graph-BTpOi49c.js";
+import { r as driverAgent } from "./coordination-driver-Gjn2GpJS.js";
+import { a as superviseWithTestBrain, h as supervisorAgentWithTestBrain } from "./supervise-DyT807bA.js";
+import { i as runGraphWithTestBrain } from "./graph-CjbB6Yy6.js";
 import { SANDBOX_SIZE_PRESET_NAMES, canonicalAgentProfileDigest } from "@tangle-network/agent-interface";
 //#region src/testing/fixtures/agent-improvement-proposal.json
 var agent_improvement_proposal_default = {
 	changedSurfaces: ["prompt"],
-	digest: "sha256:1881be550553aeebaed1edf0f88060b19db8a84a9a8dbaefa8634afa7fbafba0",
+	digest: "sha256:bd0fc2ed371d1d4970c70d2689723ea8f0e26eaa796dac677e37b2dc56654f59",
 	evaluation: {
 		"decision": {
 			"contributingChecks": [
@@ -4579,7 +4579,7 @@ var agent_improvement_proposal_default = {
 		],
 		"metadata": {
 			"fixture": "agent-improvement-proposal",
-			"runtimeVersion": "0.287.0"
+			"runtimeVersion": "0.287.2"
 		},
 		"objectives": [
 			{
@@ -4690,8 +4690,8 @@ var agent_improvement_proposal_default = {
 			"baselineContentHash": "sha256:5c21ee53e513fc604cb09754e21c392b24a424da0ef37dbf8f1ee4a8a0b08f09",
 			"candidateContentHash": "sha256:60fcbb1c728194bd51d7d19cb732d1c3f1881dce7e0a6266b41c8b98cfd65693",
 			"kind": "agent-eval-loop",
-			"recordDigest": "sha256:e707b76cdbd81f6b9a8c724221e56af001e6533530f5f7ea86ef3685855a39dd",
-			"runId": "agent-runtime-0.287.0-proposal-fixture",
+			"recordDigest": "sha256:9c9924f14cb7e1b38d6b34f7c22ca5979150de241cef2a48669119a59a130882",
+			"runId": "agent-runtime-0.287.2-proposal-fixture",
 			"schema": "agent-candidate-experiment"
 		}
 	},
@@ -4714,13 +4714,13 @@ var agent_improvement_proposal_default = {
 	}],
 	kind: "agent-improvement-proposal",
 	proposedAt: "2026-07-10T01:00:00.000Z",
-	runId: "agent-runtime-0.287.0-proposal-fixture"
+	runId: "agent-runtime-0.287.2-proposal-fixture"
 };
 //#endregion
 //#region src/testing/fixtures/agent-profile-improvement-proposal.json
 var agent_profile_improvement_proposal_default = {
 	changedSurfaces: ["prompt", "skills"],
-	digest: "sha256:8050e70299889de2d59e96b952bb55bb08ed5f60b91aabac1b9c646564445ccd",
+	digest: "sha256:401033284309aed72474a49deb05b858e2fa1bcb0a246550d66366c1dfc31f2b",
 	evaluation: {
 		"decision": {
 			"contributingChecks": [
@@ -6354,7 +6354,7 @@ var agent_profile_improvement_proposal_default = {
 		],
 		"metadata": {
 			"fixture": "agent-profile-improvement-proposal",
-			"runtimeVersion": "0.287.0"
+			"runtimeVersion": "0.287.2"
 		},
 		"objectives": [
 			{
@@ -6465,7 +6465,7 @@ var agent_profile_improvement_proposal_default = {
 			"baselineContentHash": "sha256:21c495a37c418c10bde64fbaa188beddeed31f1f051ea60a6a6582a9ee0db704",
 			"candidateContentHash": "sha256:103f77bc8481601eef1ad5fe6ba84a40dffabc3a44f421f8c8559121edab84e9",
 			"kind": "agent-eval-loop",
-			"recordDigest": "sha256:c5dbdd0b90f5ecf567ded1b15b22ff62b1e64a773be0a52feefd7f62596cba0b",
+			"recordDigest": "sha256:9880bd4bff05a7e238b1a8139db7204d5f213c93f1e819c94be902d04664a0b9",
 			"runId": "profile-improvement-1",
 			"schema": "agent-profile-improvement-experiment"
 		}

package/dist/tui/index.js

@@ -1,3 +1,3 @@
-import { t as provisionSupervisor } from "../provision-supervisor-DOcn_znM.js";
+import { t as provisionSupervisor } from "../provision-supervisor-DCM6hVKI.js";
 import { a as renderTopFrameWithLayout, i as renderTopFrame, n as runTopApp, r as loadTopSnapshot, t as renderTopOnce } from "../top-app-DaiR4LXM.js";
 export { loadTopSnapshot, provisionSupervisor, renderTopFrame, renderTopFrameWithLayout, renderTopOnce, runTopApp };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-runtime",
-  "version": "0.287.0",
+  "version": "0.287.2",
   "description": "Shared task-lifecycle skeleton for agents: a recursive loop kernel for chat turns, one-shot tasks, and multi-attempt loops, with trace capture and eval-gated self-improvement. Domain behavior lives in adapters; scoring and ship-gates in @tangle-network/agent-eval.",
   "homepage": "https://github.com/tangle-network/agent-runtime#readme",
   "repository": {

package/skills/profile-authoring/SKILL.md

@@ -123,7 +123,9 @@ Hard limits live in Runtime options and per-assignment budgets: `budget`, `worke
 Prompt text enforces no limit.
 `maxTokens` is settled after the work: an overspent child keeps its output and carries a `budgetViolation`.
 A child's total counts input tokens on every turn, so reserve turns times context.
-Give each paid job its own named key with a dollar cap, and state the dollars before launch.
+For paid calls, use the execution owner's named credential and enforceable dollar limit.
+For subscriptions, retain token, iteration, time, and compute bounds that the installed path can enforce.
+An unmeasured dollar cost stays unknown; an unsupported dollar cap is not protection.
 
 ## 8. Register arms, a control and outcomes
 
@@ -153,6 +155,16 @@ Group retries of the same assignment into one lineage when comparing teams.
 Grant `submit_result` only when Runtime gives that node an independent check; otherwise its settlement stays unassessed.
 Grant only the observation, steering and journal tools that the assignment needs.
 Set `harness`, `model.default` and `model.provider` explicitly, and validate against the current `agentProfileSchema`.
+
+For subscription execution, select a harness and model that the granted account can serve.
+The private executor resolves the authorized credential and materializes the harness's authentication files.
+Keep credential references in supported configuration; keep credential values outside profiles, tasks, resources, and journals.
+Runtime descendants use the same configured provider and credential resolver; author their profiles rather than copying login files.
+Check the child's materialization receipt and actual session before claiming that account or harness executed.
+Grant only the models and authentication routes the execution owner authorized.
+When the run requires cloud execution, place its controller, root, and descendants through the maintained managed-cloud deployment.
+When mounted, [execution and credentials](references/execution-and-credentials.md) explains binding, renewal, and recovery in more detail.
+
 A tool name must be one the harness publishes, and a refused name fails the same way on retry.
 `ls`, `list` and `find` are not tool names; select paths with a glob tool and search contents with a grep tool.
 Inspect materialized permissions and served tools before relying on a restriction.

package/skills/profile-authoring/references/execution-and-credentials.md

@@ -0,0 +1,73 @@
+# Execution and credentials
+
+## Choose the profile; inherit the authorized execution
+
+The profile defines the harness, model, instructions, capabilities, and research behavior.
+The private executor supplies authentication and placement under the run's authority.
+An account credential does not select a different model or grant additional tools.
+
+Select the harness and model explicitly from the installed capability contract.
+Use the granted provider for the root and its Runtime descendants.
+Let its credential resolver select an authorized account for each exact profile and creation identity.
+Use the installed provider's supported static binding when no dynamic selector is configured.
+Account selection, quota, validity, and renewal belong to that account owner.
+
+The executor materializes credentials in the format the selected harness requires.
+Authentication files are private execution inputs, even when they are ordinary files inside the sandbox.
+Keep their values outside public profiles, mounted research inputs, prompts, and evidence archives.
+Use supported secret references or private backend configuration at the execution boundary.
+Read the current schema before naming a profile field; metadata alone does not configure authentication.
+
+The director authors each descendant's profile and grants its permitted capabilities.
+It does not need to perform an interactive login or export a parent's token.
+A descendant that can spawn receives the complete profile-authoring skill and the same authorized execution path.
+Changing its harness requires a granted authentication route for that harness.
+Native harness subagents and Runtime descendants remain distinct observation units.
+
+## Cloud execution and persistence
+
+When the run requires cloud execution, place its controller, root, and descendants in the managed cloud.
+Use the maintained managed-process deployment and ingress rather than a detached host process.
+Choose a distinct run identity and immutable controller image for each commission.
+The ingress binds each Runtime actor to its own authenticated listener.
+Research policy stays in profiles and the registered method, not the ingress.
+
+Retain the original workspace and native session through the execution owner's supported continuation path.
+Record account changes, renewal, reconnects, and native-session changes separately.
+A fresh environment with copied files is not proof that the original native session resumed.
+Preserve partial artifacts before environment cleanup and archive them through the existing storage path.
+Check that retained capture excludes authentication files and other private credentials.
+
+## What proves execution
+
+Separate configuration, materialization, model execution, research progress, and outside acceptance.
+For a root and a recursively spawned child, inspect:
+
+- The exact authored profile and materialization receipt.
+- The cloud placement, Runtime actor, and native session identities.
+- The granted account reference and actual harness/model evidence, without credential values.
+- The first model invocation and a real tool action.
+- The child-to-grandchild edge when claiming recursion.
+- Retrievable trace and artifact bytes after capture.
+
+A merged source change or published package does not prove a running deployment supports it.
+A supported deployment does not prove an account was used.
+An agent's claim of delegation does not prove that its child executed.
+Keep missing identity, usage, cost, and renewal evidence unknown.
+
+The operator establishes the execution path before research begins.
+When an authorized capability fails inside a run, retain its receipt and use the granted reporting or recovery tool.
+Continue useful research through capabilities that remain available within the same authority.
+
+## Maintained contracts
+
+Use these owners for changing fields and commands instead of copying an API catalog into this skill.
+
+- [Runtime profile and execution composition](https://github.com/tangle-network/agent-runtime/blob/main/docs/canonical-api.md#15-the-agentprofile-rule-author-the-profile-the-substrate-materializes-it).
+- [Runtime managed compute](https://github.com/tangle-network/agent-runtime/blob/main/docs/agent-managed-compute/README.md).
+- [Portable profile schema](https://github.com/tangle-network/agent-sdk/blob/main/packages/agent-interface/src/profile-schema.ts).
+- [Tangle provider credentials and execution](https://github.com/tangle-network/agent-sdk/blob/main/packages/agent-provider-tangle/README.md).
+- [Discovery cloud submission and retention](https://github.com/tangle-network/discovery-lab/blob/master/README.md).
+
+Read the installed provider's contract before using a newer source-only resolver or capability.
+The core skill remains sufficient to author a child; mount this reference when its assignment includes execution integration.

package/dist/model-policy-BbSCSak0.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"model-policy-BbSCSak0.js","names":["positiveInteger"],"sources":["../src/runtime/harness-role.ts","../src/runtime/router-retry-policy.ts","../src/runtime/supervise/model-policy.ts"],"sourcesContent":["/**\n * Which `HarnessType` values name a real coding-agent runtime, and which name a MODE that has no\n * agent behind it.\n *\n * `cli-base` is the router-backed mode — a plain multi-turn router call with no coding-agent\n * harness (`@tangle-network/agent-interface`'s `HarnessType` doc, and the same table's\n * `harnessReasoningCeiling['cli-base'] = 'none'` commented \"cli-base has no agent\"). The\n * distinction is REAL; what was accidental is that three call sites each spelled the test\n * themselves, so a second no-agent mode would have to be remembered in three places.\n *\n * SHOULD UPSTREAM: this belongs next to `harnessHonorsEffort` in agent-interface's\n * `harness-capabilities.ts`, which already encodes the fact but exports no predicate for it.\n * Until it does, this is the one local copy — extend the set here, never re-test the name.\n */\n\nimport type { HarnessType } from '@tangle-network/agent-interface'\n\n/**\n * Harness ids that select a router/no-agent mode rather than a coding-agent runtime.\n *\n * `nanoclaw` is deliberately ABSENT: the shared capability table clamps its reasoning ceiling the\n * same way it clamps `cli-base`, but nanoclaw does run an agent (a socket-bridge runner to the\n * NanoClaw daemon) and every caller here treats it as a full harness. Add a row only with the\n * behavior change stated, never to make the two clamps look symmetric.\n */\nconst NO_AGENT_HARNESSES: ReadonlySet<string> = new Set<string>(['cli-base' satisfies HarnessType])\n\n/** Whether this profile harness selects a real coding-agent runtime (vs. the router/no-agent mode\n *  or no preference at all). Accepts the looser `string` some local profile shapes declare, and\n *  preserves the caller's own harness type when it is narrower. */\nexport function harnessRunsAgent<T extends string>(harness: T | null | undefined): harness is T {\n  return harness != null && !NO_AGENT_HARNESSES.has(harness)\n}\n\n/** The coding-agent harness this profile selects, or `undefined` when it selects none — the shape\n *  callers want when a no-agent mode must fall through to the router arm. */\nexport function agentHarness<T extends string>(harness: T | null | undefined): T | undefined {\n  return harnessRunsAgent(harness) ? harness : undefined\n}\n","import { ValidationError } from '../errors'\n\n/** Exact retry controls accepted at `AgentProfile.model.metadata.retry`. */\nexport interface RouterRetryPolicy {\n  /** Total attempts, including the first request. */\n  readonly maxAttempts?: number\n  /** Delay before the second attempt. Later delays grow exponentially. */\n  readonly initialBackoffMs?: number\n  /** Maximum delay between attempts. */\n  readonly maxBackoffMs?: number\n  /** Symmetric random variation around each delay, from 0 through 1. */\n  readonly jitter?: number\n  /** HTTP statuses that may be retried. */\n  readonly retryStatuses?: ReadonlyArray<number>\n  /** Deadline for receiving one attempt's response headers. Zero disables it. */\n  readonly requestTimeoutMs?: number\n}\n\nexport interface ResolvedRouterRetryPolicy {\n  readonly maxAttempts: number\n  readonly initialBackoffMs: number\n  readonly maxBackoffMs: number\n  readonly jitter: number\n  readonly retryStatuses: ReadonlyArray<number>\n  readonly requestTimeoutMs: number\n}\n\nconst maximumTimerMs = 2_147_483_647\nconst defaultRetryStatuses = Object.freeze([408, 425, 429, 500, 502, 503, 504, 520, 522, 524])\nconst retryPolicyKeys = new Set([\n  'initialBackoffMs',\n  'jitter',\n  'maxAttempts',\n  'maxBackoffMs',\n  'requestTimeoutMs',\n  'retryStatuses',\n])\n\n/** Parse untrusted profile/config data once and return an immutable complete policy. */\nexport function resolveRouterRetryPolicy(\n  input: unknown,\n  context: string,\n): ResolvedRouterRetryPolicy {\n  if (\n    input !== undefined &&\n    (typeof input !== 'object' || input === null || Array.isArray(input))\n  ) {\n    throw new ValidationError(`${context} must be an object`)\n  }\n  const policy = input === undefined ? {} : Object.fromEntries(Object.entries(input))\n  const unknown = Object.keys(policy).filter((key) => !retryPolicyKeys.has(key))\n  if (unknown.length > 0) {\n    throw new ValidationError(`${context} has unsupported fields: ${unknown.join(', ')}`)\n  }\n  const maxAttempts = positiveInteger(policy.maxAttempts, 5, `${context}.maxAttempts`)\n  const initialBackoffMs = timerInteger(\n    policy.initialBackoffMs,\n    1_000,\n    `${context}.initialBackoffMs`,\n  )\n  const maxBackoffMs = timerInteger(policy.maxBackoffMs, 30_000, `${context}.maxBackoffMs`)\n  const requestTimeoutMs = timerInteger(\n    policy.requestTimeoutMs,\n    0,\n    `${context}.requestTimeoutMs`,\n    Number.MAX_SAFE_INTEGER - Date.now(),\n  )\n  const jitter = policy.jitter ?? 0.25\n  if (typeof jitter !== 'number' || !Number.isFinite(jitter) || jitter < 0 || jitter > 1) {\n    throw new ValidationError(`${context}.jitter must be a finite number from 0 through 1`)\n  }\n  const retryStatuses = parseRetryStatuses(policy.retryStatuses, context)\n  return Object.freeze({\n    maxAttempts,\n    initialBackoffMs,\n    maxBackoffMs,\n    jitter,\n    retryStatuses,\n    requestTimeoutMs,\n  })\n}\n\nfunction parseRetryStatuses(value: unknown, context: string): ReadonlyArray<number> {\n  if (value === undefined) return defaultRetryStatuses\n  if (!Array.isArray(value)) {\n    throw new ValidationError(`${context}.retryStatuses must be an array of HTTP statuses`)\n  }\n  const statuses: number[] = []\n  const seen = new Set<number>()\n  for (const status of value) {\n    if (!Number.isSafeInteger(status) || status < 100 || status > 599) {\n      throw new ValidationError(\n        `${context}.retryStatuses must contain integer HTTP statuses from 100 through 599`,\n      )\n    }\n    if (seen.has(status)) {\n      throw new ValidationError(`${context}.retryStatuses must not contain duplicates`)\n    }\n    seen.add(status)\n    statuses.push(status)\n  }\n  return Object.freeze(statuses)\n}\n\nfunction positiveInteger(value: unknown, fallback: number, context: string): number {\n  const parsed = value ?? fallback\n  if (typeof parsed !== 'number' || !Number.isSafeInteger(parsed) || parsed < 1) {\n    throw new ValidationError(`${context} must be a positive safe integer`)\n  }\n  return parsed\n}\n\nfunction timerInteger(\n  value: unknown,\n  fallback: number,\n  context: string,\n  maximum = maximumTimerMs,\n): number {\n  const parsed = value ?? fallback\n  if (\n    typeof parsed !== 'number' ||\n    !Number.isSafeInteger(parsed) ||\n    parsed < 0 ||\n    parsed > maximum\n  ) {\n    throw new ValidationError(\n      `${context} must be a nonnegative safe integer no greater than ${maximum}`,\n    )\n  }\n  return parsed\n}\n","/**\n * `assertModelAllowed` — a fail-loud guard that restricts a run to a chosen subset of\n * models. The two front doors (`supervise()` / `improve()`) call it once per configured\n * model at resolve time, so a run that names a model outside the allowed set throws before\n * any compute is spent — never silently swapped or silently allowed.\n */\nimport { HARNESS_NATIVE_MODEL } from '@tangle-network/agent-eval'\nimport type { AgentProfile } from '@tangle-network/agent-interface'\nimport { ConfigError } from '../../errors'\nimport { agentHarness } from '../harness-role'\nimport { type ResolvedRouterRetryPolicy, resolveRouterRetryPolicy } from '../router-retry-policy'\n\n/**\n * Return the model id an executor may send to a provider.\n *\n * Eval stamps {@link HARNESS_NATIVE_MODEL} into a profile when model selection is deliberately\n * delegated to the configured runtime. That marker belongs in experiment identity and cost\n * admission; it is not a provider model id.\n */\nexport function concreteModelId(model: string | undefined): string | undefined {\n  if (model === undefined) return undefined\n  const id = model.trim()\n  return id.length > 0 && !isHarnessNativeModel(id) ? id : undefined\n}\n\n/** Whether a model value delegates selection to the chosen execution system. */\nexport function isHarnessNativeModel(model: string | undefined): boolean {\n  return model?.trim() === HARNESS_NATIVE_MODEL\n}\n\n/** Return a profile's explicitly selected provider model, if it has one. */\nexport function concreteProfileModel(profile: Pick<AgentProfile, 'model'>): string | undefined {\n  return concreteModelId(profile.model?.default)\n}\n\n/**\n * Return the model id for a direct provider request.\n *\n * A portable profile can qualify its model with the selected provider. The direct endpoint already\n * selects that provider, so remove only the exact matching prefix. Preserve every other prefix\n * because it can identify a provider-owned nested route, such as `anthropic/claude-sonnet`.\n */\nexport function profileProviderModel(profile: Pick<AgentProfile, 'model'>): string | undefined {\n  const model = concreteProfileModel(profile)\n  const provider = profile.model?.provider?.trim()\n  if (!model || !provider || !model.startsWith(`${provider}/`)) return model\n  return concreteModelId(model.slice(provider.length + 1))\n}\n\n/** The full cli-bridge wire id declared by a profile: harness/provider/model. */\nexport function profileBridgeWireModel(\n  profile: Pick<AgentProfile, 'harness' | 'model'>,\n): string | undefined {\n  const model = concreteProfileModel(profile)\n  const provider = profile.model?.provider\n  const harness = agentHarness(profile.harness)\n  const modelWithoutHarness =\n    model && harness && model.startsWith(`${harness}/`) ? model.slice(harness.length + 1) : model\n  const providerModel = modelWithoutHarness\n    ? provider && !modelWithoutHarness.startsWith(`${provider}/`)\n      ? `${provider}/${modelWithoutHarness}`\n      : modelWithoutHarness\n    : undefined\n  if (!harness) return providerModel\n  if (!providerModel) return harness\n  return providerModel.startsWith(`${harness}/`) ? providerModel : `${harness}/${providerModel}`\n}\n\n/**\n * Refuse an incomplete execution identity before any backend may fill it from ambient config.\n * `AgentProfile` is the sole behavioral authority: harness, provider, and concrete model all\n * participate in its digest. Eval's runtime-selected marker is a matrix-planning value, never an\n * executable model.\n */\nexport function assertExecutableAgentProfile(profile: AgentProfile, context: string): void {\n  if (profile.harness === undefined) {\n    throw new ConfigError(`${context}: AgentProfile.harness must be explicit before execution`)\n  }\n  const declared = profile.model?.default\n  const model = concreteModelId(declared)\n  if (!model) {\n    const reason = isHarnessNativeModel(declared) ? 'runtime-selected' : 'missing'\n    throw new ConfigError(\n      `${context}: AgentProfile.model.default is ${reason}; execution requires a concrete model`,\n    )\n  }\n  if (!profile.model?.provider?.trim()) {\n    throw new ConfigError(\n      `${context}: AgentProfile.model.provider must be explicit before execution`,\n    )\n  }\n}\n\n/**\n * Separate completion ceilings an exact profile may request.\n *\n * They are distinct because providers do not share one meaning for a single number: measured\n * through the Tangle Router on 2026-08-10, `glm-5.2` accepted `max_tokens: 8` and still billed 135\n * completion tokens — 132 reasoning, 3 visible — while `max_completion_tokens: 256` bounded the\n * total. A path that cannot enforce a requested ceiling refuses the run instead of sending a\n * number that means something else there.\n */\nexport interface ProfileTokenLimits {\n  /** Visible answer tokens, from `AgentProfile.model.maxVisibleOutputTokens`. */\n  readonly visible?: number\n  /** Hidden reasoning tokens, from `AgentProfile.model.maxReasoningTokens`. */\n  readonly reasoning?: number\n  /** Visible and reasoning tokens together, from `AgentProfile.model.maxTotalOutputTokens`. */\n  readonly total?: number\n}\n\n/** The ceilings one execution path actually sends, in the request fields it sends them as. */\nexport interface AppliedTokenLimits {\n  /** Sent as `max_tokens`. */\n  readonly maxTokens?: number\n  /** Sent as `max_completion_tokens`. */\n  readonly maxCompletionTokens?: number\n}\n\n/** What a path was asked to enforce and what it sent, for the execution receipt. */\nexport interface TokenLimitDecision {\n  readonly requested: ProfileTokenLimits\n  readonly applied: AppliedTokenLimits\n}\n\n/** The execution paths that lower a profile into a provider request. */\nexport type ModelExecutionPath = 'router' | 'bridge' | 'sandbox' | 'provider'\n\n/** Generation and loop controls that may affect one model execution. */\nexport interface ProfileModelExecutionSettings {\n  readonly temperature?: number\n  /** Completion ceilings the profile requested. Empty when it requested none. */\n  readonly tokenLimits: ProfileTokenLimits\n  readonly retry?: ResolvedRouterRetryPolicy\n  readonly seed?: number\n  readonly toolChoice?: 'auto' | 'required' | 'none'\n  readonly extraBody?: Readonly<Record<string, unknown>>\n  /** Zero means no turn-count cap; conserved budgets and deadlines still apply. */\n  readonly maxTurns?: number\n  readonly stream?: boolean\n}\n\nconst PROFILE_MODEL_METADATA_KEYS = new Set([\n  'extraBody',\n  'maxTurns',\n  'retry',\n  'seed',\n  'stream',\n  'temperature',\n  'toolChoice',\n])\n\n/**\n * Read every Router-affecting control from the exact profile and reject unknown controls.\n * Backends receive endpoint/auth and executable ports only; they cannot silently alter behavior.\n */\nexport function profileModelExecutionSettings(\n  profile: Pick<AgentProfile, 'model'>,\n  context: string,\n): ProfileModelExecutionSettings {\n  const metadata = profile.model?.metadata ?? {}\n  if (metadata.maxTokens !== undefined) {\n    throw new ConfigError(\n      `${context}: AgentProfile.model.metadata.maxTokens is ambiguous across providers; declare AgentProfile.model.maxVisibleOutputTokens, maxReasoningTokens, or maxTotalOutputTokens instead`,\n    )\n  }\n  const unknown = Object.keys(metadata).filter((key) => !PROFILE_MODEL_METADATA_KEYS.has(key))\n  if (unknown.length > 0) {\n    throw new ConfigError(\n      `${context}: unsupported AgentProfile.model.metadata fields: ${unknown.join(', ')}`,\n    )\n  }\n  const temperature = finiteNumber(metadata.temperature, `${context}: temperature`)\n  const tokenLimits = profileTokenLimits(profile, context)\n  const retryInput = metadata.retry\n  const retry =\n    retryInput === undefined\n      ? undefined\n      : resolveRouterRetryPolicy(retryInput, `${context}: AgentProfile.model.metadata.retry`)\n  const seed = safeInteger(metadata.seed, `${context}: seed`)\n  const maxTurns = nonnegativeInteger(metadata.maxTurns, `${context}: maxTurns`)\n  const stream = optionalBoolean(metadata.stream, `${context}: stream`)\n  const toolChoice = metadata.toolChoice\n  if (\n    toolChoice !== undefined &&\n    toolChoice !== 'auto' &&\n    toolChoice !== 'required' &&\n    toolChoice !== 'none'\n  ) {\n    throw new ConfigError(`${context}: toolChoice must be auto, required, or none`)\n  }\n  const extraBody = metadata.extraBody\n  if (\n    extraBody !== undefined &&\n    (typeof extraBody !== 'object' || extraBody === null || Array.isArray(extraBody))\n  ) {\n    throw new ConfigError(`${context}: extraBody must be an object`)\n  }\n  return {\n    ...(temperature !== undefined ? { temperature } : {}),\n    tokenLimits,\n    ...(retry !== undefined ? { retry } : {}),\n    ...(seed !== undefined ? { seed } : {}),\n    ...(toolChoice !== undefined ? { toolChoice } : {}),\n    ...(extraBody !== undefined\n      ? { extraBody: Object.freeze({ ...(extraBody as Record<string, unknown>) }) }\n      : {}),\n    ...(maxTurns !== undefined ? { maxTurns } : {}),\n    ...(stream !== undefined ? { stream } : {}),\n  }\n}\n\n/**\n * Read the completion ceilings an exact profile declares. The Interface schema already refines\n * these fields, but a profile can reach an executor without a parse, so the same rules are\n * enforced here: positive integers, and no single ceiling above the total.\n */\nexport function profileTokenLimits(\n  profile: Pick<AgentProfile, 'model'>,\n  context: string,\n): ProfileTokenLimits {\n  const model = profile.model\n  const visible = positiveInteger(\n    model?.maxVisibleOutputTokens,\n    `${context}: maxVisibleOutputTokens`,\n  )\n  const reasoning = positiveInteger(model?.maxReasoningTokens, `${context}: maxReasoningTokens`)\n  const total = positiveInteger(model?.maxTotalOutputTokens, `${context}: maxTotalOutputTokens`)\n  if (total !== undefined) {\n    for (const [name, value] of [\n      ['maxVisibleOutputTokens', visible],\n      ['maxReasoningTokens', reasoning],\n    ] as const) {\n      if (value !== undefined && value > total) {\n        throw new ConfigError(\n          `${context}: AgentProfile.model.${name} (${value}) exceeds maxTotalOutputTokens (${total})`,\n        )\n      }\n    }\n  }\n  return {\n    ...(visible !== undefined ? { visible } : {}),\n    ...(reasoning !== undefined ? { reasoning } : {}),\n    ...(total !== undefined ? { total } : {}),\n  }\n}\n\n/**\n * Lower the requested ceilings onto one execution path, or refuse the run before any paid\n * transport.\n *\n * - Router and OpenAI-compatible routes send the visible ceiling as `max_tokens` and the total as\n *   `max_completion_tokens`.\n * - The CLI Bridge lowers ONE completion cap into the run's model catalog, so it carries the total\n *   as `max_tokens` and cannot bound the visible half on its own.\n * - The Sandbox and environment-provider paths expose no completion cap at all.\n * - No route publishes a reasoning-token budget, so a reasoning ceiling is refused everywhere.\n *   `AgentProfile.model.reasoningEffort` is an intensity dial, not a token bound.\n */\nexport function enforceTokenLimits(\n  limits: ProfileTokenLimits,\n  path: ModelExecutionPath,\n  context: string,\n): TokenLimitDecision {\n  const refuse = (field: string, reason: string): never => {\n    throw new ConfigError(\n      `${context}: AgentProfile.model.${field} cannot be enforced on the ${path} path (${reason}); remove the ceiling or select a path that enforces it`,\n    )\n  }\n  if (limits.reasoning !== undefined) {\n    refuse('maxReasoningTokens', 'no route exposes a reasoning-token budget')\n  }\n  if (path === 'router') {\n    return {\n      requested: limits,\n      applied: {\n        ...(limits.visible !== undefined ? { maxTokens: limits.visible } : {}),\n        ...(limits.total !== undefined ? { maxCompletionTokens: limits.total } : {}),\n      },\n    }\n  }\n  if (path === 'bridge') {\n    if (limits.visible !== undefined) {\n      refuse('maxVisibleOutputTokens', 'the bridge lowers one completion cap covering both halves')\n    }\n    return {\n      requested: limits,\n      applied: {\n        ...(limits.total !== undefined ? { maxTokens: limits.total } : {}),\n      },\n    }\n  }\n  if (limits.visible !== undefined) refuse('maxVisibleOutputTokens', 'the backend accepts no cap')\n  if (limits.total !== undefined) refuse('maxTotalOutputTokens', 'the backend accepts no cap')\n  return { requested: limits, applied: {} }\n}\n\n/** The receipt form of one path's ceilings: what was asked for, and what was sent. */\nexport function tokenLimitReceipt(decision: TokenLimitDecision): {\n  readonly requested: ProfileTokenLimits\n  readonly applied: AppliedTokenLimits\n} {\n  return { requested: decision.requested, applied: decision.applied }\n}\n\nfunction finiteNumber(value: unknown, context: string): number | undefined {\n  if (value === undefined) return undefined\n  if (typeof value !== 'number' || !Number.isFinite(value)) {\n    throw new ConfigError(`${context} must be a finite number`)\n  }\n  return value\n}\n\nfunction safeInteger(value: unknown, context: string): number | undefined {\n  if (value === undefined) return undefined\n  if (!Number.isSafeInteger(value)) throw new ConfigError(`${context} must be a safe integer`)\n  return value as number\n}\n\nfunction positiveInteger(value: unknown, context: string): number | undefined {\n  const parsed = safeInteger(value, context)\n  if (parsed !== undefined && parsed < 1) {\n    throw new ConfigError(`${context} must be positive`)\n  }\n  return parsed\n}\n\nfunction nonnegativeInteger(value: unknown, context: string): number | undefined {\n  const parsed = safeInteger(value, context)\n  if (parsed !== undefined && parsed < 0) {\n    throw new ConfigError(`${context} must be nonnegative`)\n  }\n  return parsed\n}\n\nfunction optionalBoolean(value: unknown, context: string): boolean | undefined {\n  if (value === undefined) return undefined\n  if (typeof value !== 'boolean') throw new ConfigError(`${context} must be boolean`)\n  return value\n}\n\n/**\n * Throw a `ConfigError` when `allowed` is set, `model` is defined, and `model` is not a\n * member of `allowed`. No-op when `allowed` is unset (the unrestricted default) or when\n * `model` is undefined (nothing was configured to check).\n */\nexport function assertModelAllowed(\n  model: string | undefined,\n  allowed: readonly string[] | undefined,\n): void {\n  if (!allowed || model === undefined) return\n  if (!allowed.includes(model)) {\n    throw new ConfigError(\n      `model ${JSON.stringify(model)} is not in the allowed set ${JSON.stringify([...allowed])}`,\n    )\n  }\n}\n\n/** Check every canonical model-bearing field in a complete profile, including the models a\n * backend may select for cheap work, named subagents, or modes.\n *\n * Every compared value is a bare model id. The composed `harness/provider/model` wire id\n * (`profileBridgeWireModel`) is neither built nor compared here, so this admits any route that\n * declares an allowed id, and a qualified entry in `allowed` matches nothing. Route pinning\n * belongs to `SuperviseOptions.authorizeSpawn`. */\nexport function assertProfileModelsAllowed(\n  profile: AgentProfile,\n  allowed: readonly string[] | undefined,\n): void {\n  assertModelAllowed(profile.model?.default, allowed)\n  assertModelAllowed(profile.model?.small, allowed)\n  for (const subagent of Object.values(profile.subagents ?? {})) {\n    assertModelAllowed(subagent.model, allowed)\n  }\n  for (const mode of Object.values(profile.modes ?? {})) {\n    assertModelAllowed(mode.model, allowed)\n  }\n}\n"],"mappings":";;;;;;;;;;;AAyBA,MAAM,qCAA0C,IAAI,IAAY,CAAC,UAAgC,CAAC;;;;AAKlG,SAAgB,iBAAmC,SAA6C;CAC9F,OAAO,WAAW,QAAQ,CAAC,mBAAmB,IAAI,OAAO;AAC3D;;;AAIA,SAAgB,aAA+B,SAA8C;CAC3F,OAAO,iBAAiB,OAAO,IAAI,UAAU,KAAA;AAC/C;;;ACXA,MAAM,iBAAiB;AACvB,MAAM,uBAAuB,OAAO,OAAO;CAAC;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;AAAG,CAAC;AAC7F,MAAM,kCAAkB,IAAI,IAAI;CAC9B;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,SAAgB,yBACd,OACA,SAC2B;CAC3B,IACE,UAAU,KAAA,MACT,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,IAEnE,MAAM,IAAI,gBAAgB,GAAG,QAAQ,mBAAmB;CAE1D,MAAM,SAAS,UAAU,KAAA,IAAY,CAAC,IAAI,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC;CAClF,MAAM,UAAU,OAAO,KAAK,MAAM,CAAC,CAAC,QAAQ,QAAQ,CAAC,gBAAgB,IAAI,GAAG,CAAC;CAC7E,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,gBAAgB,GAAG,QAAQ,2BAA2B,QAAQ,KAAK,IAAI,GAAG;CAEtF,MAAM,cAAcA,kBAAgB,OAAO,aAAa,GAAG,GAAG,QAAQ,aAAa;CACnF,MAAM,mBAAmB,aACvB,OAAO,kBACP,KACA,GAAG,QAAQ,kBACb;CACA,MAAM,eAAe,aAAa,OAAO,cAAc,KAAQ,GAAG,QAAQ,cAAc;CACxF,MAAM,mBAAmB,aACvB,OAAO,kBACP,GACA,GAAG,QAAQ,oBACX,OAAO,mBAAmB,KAAK,IAAI,CACrC;CACA,MAAM,SAAS,OAAO,UAAU;CAChC,IAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,KAAK,SAAS,GACnF,MAAM,IAAI,gBAAgB,GAAG,QAAQ,iDAAiD;CAExF,MAAM,gBAAgB,mBAAmB,OAAO,eAAe,OAAO;CACtE,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;AACH;AAEA,SAAS,mBAAmB,OAAgB,SAAwC;CAClF,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,gBAAgB,GAAG,QAAQ,iDAAiD;CAExF,MAAM,WAAqB,CAAC;CAC5B,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,UAAU,OAAO;EAC1B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,OAAO,SAAS,KAC5D,MAAM,IAAI,gBACR,GAAG,QAAQ,uEACb;EAEF,IAAI,KAAK,IAAI,MAAM,GACjB,MAAM,IAAI,gBAAgB,GAAG,QAAQ,2CAA2C;EAElF,KAAK,IAAI,MAAM;EACf,SAAS,KAAK,MAAM;CACtB;CACA,OAAO,OAAO,OAAO,QAAQ;AAC/B;AAEA,SAASA,kBAAgB,OAAgB,UAAkB,SAAyB;CAClF,MAAM,SAAS,SAAS;CACxB,IAAI,OAAO,WAAW,YAAY,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,GAC1E,MAAM,IAAI,gBAAgB,GAAG,QAAQ,iCAAiC;CAExE,OAAO;AACT;AAEA,SAAS,aACP,OACA,UACA,SACA,UAAU,gBACF;CACR,MAAM,SAAS,SAAS;CACxB,IACE,OAAO,WAAW,YAClB,CAAC,OAAO,cAAc,MAAM,KAC5B,SAAS,KACT,SAAS,SAET,MAAM,IAAI,gBACR,GAAG,QAAQ,sDAAsD,SACnE;CAEF,OAAO;AACT;;;;;;;;;;;;;;;;AC/GA,SAAgB,gBAAgB,OAA+C;CAC7E,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAM,KAAK,MAAM,KAAK;CACtB,OAAO,GAAG,SAAS,KAAK,CAAC,qBAAqB,EAAE,IAAI,KAAK,KAAA;AAC3D;;AAGA,SAAgB,qBAAqB,OAAoC;CACvE,OAAO,OAAO,KAAK,MAAM;AAC3B;;AAGA,SAAgB,qBAAqB,SAA0D;CAC7F,OAAO,gBAAgB,QAAQ,OAAO,OAAO;AAC/C;;;;;;;;AASA,SAAgB,qBAAqB,SAA0D;CAC7F,MAAM,QAAQ,qBAAqB,OAAO;CAC1C,MAAM,WAAW,QAAQ,OAAO,UAAU,KAAK;CAC/C,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,WAAW,GAAG,SAAS,EAAE,GAAG,OAAO;CACrE,OAAO,gBAAgB,MAAM,MAAM,SAAS,SAAS,CAAC,CAAC;AACzD;;AAGA,SAAgB,uBACd,SACoB;CACpB,MAAM,QAAQ,qBAAqB,OAAO;CAC1C,MAAM,WAAW,QAAQ,OAAO;CAChC,MAAM,UAAU,aAAa,QAAQ,OAAO;CAC5C,MAAM,sBACJ,SAAS,WAAW,MAAM,WAAW,GAAG,QAAQ,EAAE,IAAI,MAAM,MAAM,QAAQ,SAAS,CAAC,IAAI;CAC1F,MAAM,gBAAgB,sBAClB,YAAY,CAAC,oBAAoB,WAAW,GAAG,SAAS,EAAE,IACxD,GAAG,SAAS,GAAG,wBACf,sBACF,KAAA;CACJ,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,CAAC,eAAe,OAAO;CAC3B,OAAO,cAAc,WAAW,GAAG,QAAQ,EAAE,IAAI,gBAAgB,GAAG,QAAQ,GAAG;AACjF;;;;;;;AAQA,SAAgB,6BAA6B,SAAuB,SAAuB;CACzF,IAAI,QAAQ,YAAY,KAAA,GACtB,MAAM,IAAI,YAAY,GAAG,QAAQ,yDAAyD;CAE5F,MAAM,WAAW,QAAQ,OAAO;CAEhC,IAAI,CADU,gBAAgB,QACrB,GAEP,MAAM,IAAI,YACR,GAAG,QAAQ,kCAFE,qBAAqB,QAAQ,IAAI,qBAAqB,UAEf,sCACtD;CAEF,IAAI,CAAC,QAAQ,OAAO,UAAU,KAAK,GACjC,MAAM,IAAI,YACR,GAAG,QAAQ,gEACb;AAEJ;AAmDA,MAAM,8CAA8B,IAAI,IAAI;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;AAMD,SAAgB,8BACd,SACA,SAC+B;CAC/B,MAAM,WAAW,QAAQ,OAAO,YAAY,CAAC;CAC7C,IAAI,SAAS,cAAc,KAAA,GACzB,MAAM,IAAI,YACR,GAAG,QAAQ,8KACb;CAEF,MAAM,UAAU,OAAO,KAAK,QAAQ,CAAC,CAAC,QAAQ,QAAQ,CAAC,4BAA4B,IAAI,GAAG,CAAC;CAC3F,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,YACR,GAAG,QAAQ,oDAAoD,QAAQ,KAAK,IAAI,GAClF;CAEF,MAAM,cAAc,aAAa,SAAS,aAAa,GAAG,QAAQ,cAAc;CAChF,MAAM,cAAc,mBAAmB,SAAS,OAAO;CACvD,MAAM,aAAa,SAAS;CAC5B,MAAM,QACJ,eAAe,KAAA,IACX,KAAA,IACA,yBAAyB,YAAY,GAAG,QAAQ,oCAAoC;CAC1F,MAAM,OAAO,YAAY,SAAS,MAAM,GAAG,QAAQ,OAAO;CAC1D,MAAM,WAAW,mBAAmB,SAAS,UAAU,GAAG,QAAQ,WAAW;CAC7E,MAAM,SAAS,gBAAgB,SAAS,QAAQ,GAAG,QAAQ,SAAS;CACpE,MAAM,aAAa,SAAS;CAC5B,IACE,eAAe,KAAA,KACf,eAAe,UACf,eAAe,cACf,eAAe,QAEf,MAAM,IAAI,YAAY,GAAG,QAAQ,6CAA6C;CAEhF,MAAM,YAAY,SAAS;CAC3B,IACE,cAAc,KAAA,MACb,OAAO,cAAc,YAAY,cAAc,QAAQ,MAAM,QAAQ,SAAS,IAE/E,MAAM,IAAI,YAAY,GAAG,QAAQ,8BAA8B;CAEjE,OAAO;EACL,GAAI,gBAAgB,KAAA,IAAY,EAAE,YAAY,IAAI,CAAC;EACnD;EACA,GAAI,UAAU,KAAA,IAAY,EAAE,MAAM,IAAI,CAAC;EACvC,GAAI,SAAS,KAAA,IAAY,EAAE,KAAK,IAAI,CAAC;EACrC,GAAI,eAAe,KAAA,IAAY,EAAE,WAAW,IAAI,CAAC;EACjD,GAAI,cAAc,KAAA,IACd,EAAE,WAAW,OAAO,OAAO,EAAE,GAAI,UAAsC,CAAC,EAAE,IAC1E,CAAC;EACL,GAAI,aAAa,KAAA,IAAY,EAAE,SAAS,IAAI,CAAC;EAC7C,GAAI,WAAW,KAAA,IAAY,EAAE,OAAO,IAAI,CAAC;CAC3C;AACF;;;;;;AAOA,SAAgB,mBACd,SACA,SACoB;CACpB,MAAM,QAAQ,QAAQ;CACtB,MAAM,UAAU,gBACd,OAAO,wBACP,GAAG,QAAQ,yBACb;CACA,MAAM,YAAY,gBAAgB,OAAO,oBAAoB,GAAG,QAAQ,qBAAqB;CAC7F,MAAM,QAAQ,gBAAgB,OAAO,sBAAsB,GAAG,QAAQ,uBAAuB;CAC7F,IAAI,UAAU,KAAA,GACP;OAAA,MAAM,CAAC,MAAM,UAAU,CAC1B,CAAC,0BAA0B,OAAO,GAClC,CAAC,sBAAsB,SAAS,CAClC,GACE,IAAI,UAAU,KAAA,KAAa,QAAQ,OACjC,MAAM,IAAI,YACR,GAAG,QAAQ,uBAAuB,KAAK,IAAI,MAAM,kCAAkC,MAAM,EAC3F;CAAA;CAIN,OAAO;EACL,GAAI,YAAY,KAAA,IAAY,EAAE,QAAQ,IAAI,CAAC;EAC3C,GAAI,cAAc,KAAA,IAAY,EAAE,UAAU,IAAI,CAAC;EAC/C,GAAI,UAAU,KAAA,IAAY,EAAE,MAAM,IAAI,CAAC;CACzC;AACF;;;;;;;;;;;;;AAcA,SAAgB,mBACd,QACA,MACA,SACoB;CACpB,MAAM,UAAU,OAAe,WAA0B;EACvD,MAAM,IAAI,YACR,GAAG,QAAQ,uBAAuB,MAAM,6BAA6B,KAAK,SAAS,OAAO,wDAC5F;CACF;CACA,IAAI,OAAO,cAAc,KAAA,GACvB,OAAO,sBAAsB,2CAA2C;CAE1E,IAAI,SAAS,UACX,OAAO;EACL,WAAW;EACX,SAAS;GACP,GAAI,OAAO,YAAY,KAAA,IAAY,EAAE,WAAW,OAAO,QAAQ,IAAI,CAAC;GACpE,GAAI,OAAO,UAAU,KAAA,IAAY,EAAE,qBAAqB,OAAO,MAAM,IAAI,CAAC;EAC5E;CACF;CAEF,IAAI,SAAS,UAAU;EACrB,IAAI,OAAO,YAAY,KAAA,GACrB,OAAO,0BAA0B,2DAA2D;EAE9F,OAAO;GACL,WAAW;GACX,SAAS,EACP,GAAI,OAAO,UAAU,KAAA,IAAY,EAAE,WAAW,OAAO,MAAM,IAAI,CAAC,EAClE;EACF;CACF;CACA,IAAI,OAAO,YAAY,KAAA,GAAW,OAAO,0BAA0B,4BAA4B;CAC/F,IAAI,OAAO,UAAU,KAAA,GAAW,OAAO,wBAAwB,4BAA4B;CAC3F,OAAO;EAAE,WAAW;EAAQ,SAAS,CAAC;CAAE;AAC1C;AAUA,SAAS,aAAa,OAAgB,SAAqC;CACzE,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,GACrD,MAAM,IAAI,YAAY,GAAG,QAAQ,yBAAyB;CAE5D,OAAO;AACT;AAEA,SAAS,YAAY,OAAgB,SAAqC;CACxE,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG,MAAM,IAAI,YAAY,GAAG,QAAQ,wBAAwB;CAC3F,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAgB,SAAqC;CAC5E,MAAM,SAAS,YAAY,OAAO,OAAO;CACzC,IAAI,WAAW,KAAA,KAAa,SAAS,GACnC,MAAM,IAAI,YAAY,GAAG,QAAQ,kBAAkB;CAErD,OAAO;AACT;AAEA,SAAS,mBAAmB,OAAgB,SAAqC;CAC/E,MAAM,SAAS,YAAY,OAAO,OAAO;CACzC,IAAI,WAAW,KAAA,KAAa,SAAS,GACnC,MAAM,IAAI,YAAY,GAAG,QAAQ,qBAAqB;CAExD,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAgB,SAAsC;CAC7E,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,OAAO,UAAU,WAAW,MAAM,IAAI,YAAY,GAAG,QAAQ,iBAAiB;CAClF,OAAO;AACT;;;;;;AAOA,SAAgB,mBACd,OACA,SACM;CACN,IAAI,CAAC,WAAW,UAAU,KAAA,GAAW;CACrC,IAAI,CAAC,QAAQ,SAAS,KAAK,GACzB,MAAM,IAAI,YACR,SAAS,KAAK,UAAU,KAAK,EAAE,6BAA6B,KAAK,UAAU,CAAC,GAAG,OAAO,CAAC,GACzF;AAEJ;;;;;;;;AASA,SAAgB,2BACd,SACA,SACM;CACN,mBAAmB,QAAQ,OAAO,SAAS,OAAO;CAClD,mBAAmB,QAAQ,OAAO,OAAO,OAAO;CAChD,KAAK,MAAM,YAAY,OAAO,OAAO,QAAQ,aAAa,CAAC,CAAC,GAC1D,mBAAmB,SAAS,OAAO,OAAO;CAE5C,KAAK,MAAM,QAAQ,OAAO,OAAO,QAAQ,SAAS,CAAC,CAAC,GAClD,mBAAmB,KAAK,OAAO,OAAO;AAE1C"}