@tangle-network/agent-runtime 0.295.3 → 0.296.0

package/dist/workspace-streams-D4TMTrJV.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"workspace-streams-D4TMTrJV.js","names":["sha256Bytes","canonicalCandidateDigest","canonicalCandidateBytes","sha256Bytes","canonicalCandidateBytes","fsConstants","canonicalCandidateBytes","hasControlCharacter","sha256Bytes","canonicalCandidateBytes","canonicalCandidateDigest","sha256Bytes","fsConstants","canonicalCandidateBytes","canonicalCandidateDigest"],"sources":["../src/candidate-execution/digest.ts","../src/candidate-execution/artifacts.ts","../src/candidate-execution/exact-object.ts","../src/candidate-execution/git-materialize.ts","../src/candidate-execution/output-artifacts.ts","../src/candidate-execution/workspace-archive.ts","../src/candidate-execution/artifact-streams.ts","../src/candidate-execution/workspace-streams.ts"],"sourcesContent":["import { createHash } from 'node:crypto'\nimport {\n  type AgentCandidateEmbeddedArtifact,\n  canonicalCandidateBytes,\n  type Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport type { CanonicalCandidateDocument } from './types'\n\nexport { canonicalCandidateBytes }\n\n/** Use native hashing for workspace archives. */\nexport function sha256Bytes(bytes: Uint8Array): Sha256Digest {\n  return `sha256:${createHash('sha256').update(bytes).digest('hex')}`\n}\n\nexport function canonicalCandidateDigest(value: unknown): Sha256Digest {\n  return sha256Bytes(canonicalCandidateBytes(value))\n}\n\n/** Returns a detached, deeply frozen JSON value with canonical number normalization. */\nexport function immutableCandidateValue<T>(value: T): T {\n  return deepFreezeCandidate(\n    JSON.parse(Buffer.from(canonicalCandidateBytes(value)).toString('utf8')) as T,\n  )\n}\n\nexport function canonicalCandidateDocument<T extends { digest: Sha256Digest }>(\n  valueWithoutDigest: Omit<T, 'digest'>,\n): CanonicalCandidateDocument<T> {\n  const bytes = canonicalCandidateBytes(valueWithoutDigest)\n  const digest = sha256Bytes(bytes)\n  const value = deepFreezeCandidate({\n    ...JSON.parse(Buffer.from(bytes).toString('utf8')),\n    digest,\n  }) as T\n  return Object.freeze({\n    value,\n    get bytes(): Uint8Array {\n      return Uint8Array.from(bytes)\n    },\n    digest,\n  })\n}\n\nexport function verifyCanonicalCandidateDocument<T extends { digest: Sha256Digest }>(\n  value: T,\n  label: string,\n): T {\n  if (canonicalCandidateDigest(omitTopLevelDigest(value)) !== value.digest) {\n    throw new Error(`${label} digest does not match`)\n  }\n  return immutableCandidateValue(value)\n}\n\nexport function embeddedCandidateArtifact(bytes: Uint8Array): AgentCandidateEmbeddedArtifact {\n  return {\n    encoding: 'base64',\n    content: Buffer.from(bytes).toString('base64'),\n    sha256: sha256Bytes(bytes),\n    byteLength: bytes.byteLength,\n  }\n}\n\nexport function omitTopLevelDigest<T extends { digest: Sha256Digest }>(\n  value: T,\n): Omit<T, 'digest'> {\n  const { digest: _digest, ...rest } = value\n  return rest\n}\n\nexport function deepFreezeCandidate<T>(value: T, seen = new Set<object>()): T {\n  if (\n    value === null ||\n    typeof value !== 'object' ||\n    ArrayBuffer.isView(value) ||\n    seen.has(value as object)\n  ) {\n    return value\n  }\n  seen.add(value as object)\n  for (const child of Object.values(value as Record<string, unknown>)) {\n    deepFreezeCandidate(child, seen)\n  }\n  return Object.freeze(value)\n}\n","import { createHash } from 'node:crypto'\nimport { constants as fsConstants } from 'node:fs'\nimport { lstat, open, readdir, readlink, realpath } from 'node:fs/promises'\nimport { dirname, isAbsolute, relative, resolve, sep } from 'node:path'\n\nimport type {\n  AgentCandidateArtifactRef,\n  AgentCandidateCapturedArtifact,\n  AgentCandidateProfilePlanMaterial,\n  AgentCandidateWorkspaceManifestMaterial,\n  AgentCandidateWorkspaceSnapshotEvidence,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateBytes, sha256Bytes } from './digest'\nimport type { AgentCandidateArtifactPort } from './types'\n\nexport function artifactCacheKey(artifact: AgentCandidateCapturedArtifact): string {\n  return `${artifact.sha256}:${artifact.byteLength}`\n}\n\nexport async function readVerifiedArtifact(\n  artifact: AgentCandidateCapturedArtifact,\n  port: AgentCandidateArtifactPort,\n): Promise<Uint8Array> {\n  const bytes =\n    'content' in artifact\n      ? Buffer.from(artifact.content, 'base64')\n      : await port.read(artifact as AgentCandidateArtifactRef)\n  verifyBytes(bytes, artifact.sha256, artifact.byteLength, 'candidate artifact')\n  return Uint8Array.from(bytes)\n}\n\nexport function verifyBytes(\n  bytes: Uint8Array,\n  digest: string,\n  byteLength: number,\n  label: string,\n): void {\n  if (bytes.byteLength !== byteLength) {\n    throw new Error(`${label} byte length ${bytes.byteLength} does not match ${byteLength}`)\n  }\n  const actual = sha256Bytes(bytes)\n  if (actual !== digest) {\n    throw new Error(`${label} digest ${actual} does not match ${digest}`)\n  }\n}\n\nexport async function verifyWorkspaceSnapshotArtifacts(\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n  port: AgentCandidateArtifactPort,\n): Promise<{ manifest: Uint8Array; archive: Uint8Array }> {\n  const [manifest, archive] = await Promise.all([\n    readVerifiedArtifact(snapshot.manifest, port),\n    readVerifiedArtifact(snapshot.archive, port),\n  ])\n  const canonicalManifest = canonicalCandidateBytes(snapshot.material)\n  if (!Buffer.from(manifest).equals(Buffer.from(canonicalManifest))) {\n    throw new Error('workspace manifest artifact is not the exact canonical manifest material')\n  }\n  if (sha256Bytes(canonicalManifest) !== snapshot.digest) {\n    throw new Error('workspace snapshot digest does not match its canonical manifest material')\n  }\n  return { manifest, archive }\n}\n\n/** The per-scan caps a bounded capture applies. */\nexport interface WorkspaceScanLimits {\n  readonly maxFiles: number\n  readonly maxFileBytes: number\n  readonly maxTotalFileBytes: number\n}\n\n/** A configured file-count or byte limit stopped workspace capture. */\nexport class WorkspaceScanLimitError extends Error {}\n\n/** What a workspace scan reads and how it records a file's permission bits. */\nexport interface WorkspaceScanOptions {\n  readonly signal?: AbortSignal\n  readonly ignoredProtectedRootEntries?: readonly ('.git' | '.sidecar')[]\n  readonly limits?: WorkspaceScanLimits\n  /**\n   * Record Git's two file modes instead of the filesystem's exact permission bits: `0o755` when\n   * any execute bit is set, `0o644` otherwise. A checkout umask then cannot move a manifest\n   * digest, while a real permission change still does.\n   *\n   * This is the normalization `readCandidateGitTreeFiles` already applies to a Git tree\n   * (`100644`/`100755`), so one tree scanned from disk and the same tree read out of Git produce\n   * the same manifest. Off by default: the flag changes the digest, so a capture and the verify\n   * that checks it must agree on it.\n   */\n  readonly portableTree?: boolean\n}\n\n/**\n * Refuse a materialized workspace whose files, modes, or bytes are not the signed manifest.\n *\n * The scan streams, so the size of the largest file does not decide whether the check can run, and\n * the refusal names the one mismatch a caller can produce on its own: a capture and a verify that\n * disagree about `portableTree`.\n */\nexport async function verifyMaterializedWorkspace(\n  root: string,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n  options: Omit<WorkspaceScanOptions, 'limits'> = {},\n): Promise<void> {\n  assertWorkspaceManifest(await scanMaterializedWorkspaceManifest(root, options), expected)\n}\n\n/**\n * The canonical manifest of one materialized workspace, read without holding any file.\n *\n * Every file is digested by streaming, so the size of the largest file does not decide whether the\n * workspace can be described. `FileHandle.readFile` refuses anything above 2 GiB with\n * `ERR_FS_FILE_TOO_LARGE`, which made a workspace holding one such artifact impossible to verify\n * against a manifest it already matched. The digest is sha-256 over the same bytes either way, so\n * a manifest a buffered read produced is reproduced exactly.\n */\nexport async function scanMaterializedWorkspaceManifest(\n  root: string,\n  options: WorkspaceScanOptions = {},\n): Promise<AgentCandidateWorkspaceManifestMaterial> {\n  return workspaceManifestFromEntries(await walkWorkspace(root, options, false))\n}\n\nexport async function captureMaterializedWorkspace(\n  root: string,\n  options: WorkspaceScanOptions = {},\n): Promise<{\n  manifest: AgentCandidateWorkspaceManifestMaterial\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>\n}> {\n  const entries = await walkWorkspace(root, options, true)\n  return {\n    manifest: workspaceManifestFromEntries(entries),\n    files: entries.map((entry) => ({\n      path: entry.path,\n      mode: entry.mode,\n      bytes: Uint8Array.from(capturedBytes(entry)),\n    })),\n  }\n}\n\n/** Capture exact verified regular-file bytes for fresh isolated materialization. */\nexport async function readMaterializedWorkspaceFiles(\n  root: string,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n  options: WorkspaceScanOptions = {},\n): Promise<ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>> {\n  const observed = await captureMaterializedWorkspace(root, options)\n  assertWorkspaceManifest(observed.manifest, expected)\n  return observed.files.map((file) =>\n    Object.freeze({ path: file.path, mode: file.mode, bytes: Uint8Array.from(file.bytes) }),\n  )\n}\n\n/**\n * Build the canonical manifest for files a caller already holds — the shape a remote executor\n * returns. Pass `portableTree` to record Git's two file modes instead of exact permission bits, and\n * pass the same flag to every verify that reads the result.\n */\nexport function candidateWorkspaceManifest(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  options: { portableTree?: boolean } = {},\n): AgentCandidateWorkspaceManifestMaterial {\n  return workspaceManifestFromEntries(\n    files.map((file) => ({\n      path: file.path,\n      mode: options.portableTree === true ? portableFileMode(file.mode) : file.mode,\n      sha256: sha256Bytes(file.bytes),\n      byteLength: file.bytes.byteLength,\n    })),\n  )\n}\n\nfunction workspaceManifestFromEntries(\n  entries: ReadonlyArray<{\n    path: string\n    mode: number\n    sha256: Sha256Digest\n    byteLength: number\n  }>,\n): AgentCandidateWorkspaceManifestMaterial {\n  return {\n    kind: 'agent-candidate-workspace-manifest',\n    files: entries\n      .map((entry) => ({\n        path: entry.path,\n        mode: entry.mode,\n        sha256: entry.sha256,\n        byteLength: entry.byteLength,\n      }))\n      .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)),\n  }\n}\n\n/** Git records exactly two file modes, and a portable-tree scan records the same two. */\nfunction portableFileMode(mode: number): number {\n  return (mode & 0o111) !== 0 ? 0o755 : 0o644\n}\n\nfunction capturedBytes(entry: ScannedWorkspaceEntry): Buffer {\n  if (!entry.bytes) throw new Error(`workspace file was digested without its bytes: ${entry.path}`)\n  return entry.bytes\n}\n\nfunction assertWorkspaceManifest(\n  observed: AgentCandidateWorkspaceManifestMaterial,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n): void {\n  if (Buffer.from(canonicalCandidateBytes(observed)).equals(canonicalCandidateBytes(expected))) {\n    return\n  }\n  // The one mismatch a caller can produce by passing `portableTree` on one side of a\n  // capture/verify pair and not the other. Named, because the general refusal below reads as\n  // changed bytes and would send a reader looking for a file that never changed. Comparing the\n  // two manifests already in hand costs no second walk.\n  if (\n    Buffer.from(canonicalCandidateBytes(withPortableModes(observed))).equals(\n      canonicalCandidateBytes(withPortableModes(expected)),\n    )\n  ) {\n    throw new Error(\n      'materialized workspace files do not match the signed manifest: only the file modes differ, ' +\n        'so the capture and this verify disagree about portableTree',\n    )\n  }\n  throw new Error('materialized workspace files, modes, or bytes do not match the signed manifest')\n}\n\nfunction withPortableModes(\n  material: AgentCandidateWorkspaceManifestMaterial,\n): AgentCandidateWorkspaceManifestMaterial {\n  return {\n    ...material,\n    files: material.files.map((file) => ({ ...file, mode: portableFileMode(file.mode) })),\n  }\n}\n\nexport async function verifyMaterializedProfileWorkspace(\n  root: string,\n  expected: AgentCandidateProfilePlanMaterial,\n  fileRoot: 'workspace' | 'agent' = 'workspace',\n): Promise<void> {\n  const observed = await scanMaterializedWorkspaceManifest(root)\n  const observedProfile = observed.files.map(({ path, mode, sha256 }) => ({\n    relPath: path,\n    mode,\n    contentSha256: sha256,\n  }))\n  const expectedFiles = expected.files\n    .filter((file) => (file.root ?? 'workspace') === fileRoot)\n    .map(({ root: _root, ...file }) => file)\n  if (\n    !Buffer.from(canonicalCandidateBytes(observedProfile)).equals(\n      canonicalCandidateBytes(expectedFiles),\n    )\n  ) {\n    throw new Error(\n      `profile ${fileRoot} staging files, modes, or bytes do not match the signed profile plan`,\n    )\n  }\n}\n\ninterface ScannedWorkspaceEntry {\n  readonly path: string\n  readonly mode: number\n  readonly sha256: Sha256Digest\n  readonly byteLength: number\n  /** Present only when the walk was asked to keep bytes. */\n  readonly bytes?: Buffer\n}\n\nasync function walkWorkspace(\n  root: string,\n  options: WorkspaceScanOptions,\n  keepBytes: boolean,\n): Promise<ScannedWorkspaceEntry[]> {\n  const ignoredProtectedRootEntries = new Set<string>(options.ignoredProtectedRootEntries ?? [])\n  const limits = options.limits\n  // Scan the RESOLVED root. The property this guards is that every captured path lies under\n  // one real directory with no aliasing, which resolving satisfies directly — rejecting a\n  // symlinked prefix outright does not, and makes the scan impossible on macOS, where the\n  // OS itself hands out temp paths under /var, a symlink to /private/var. Symlinks INSIDE\n  // the workspace are still refused entry by entry below, with O_NOFOLLOW on every open.\n  const requestedRoot = resolve(root)\n  const rootStats = await lstat(requestedRoot)\n  if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) {\n    throw new Error('workspace root must be a real directory')\n  }\n  const absoluteRoot = await realpath(requestedRoot)\n  const resolvedStats = await lstat(absoluteRoot)\n  if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) {\n    throw new Error('workspace root must resolve to a real directory')\n  }\n  const scanned: ScannedWorkspaceEntry[] = []\n  let totalBytes = 0\n\n  async function visit(directory: string): Promise<void> {\n    options.signal?.throwIfAborted()\n    const entries = await readdir(directory, { withFileTypes: true })\n    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))\n    for (const entry of entries) {\n      options.signal?.throwIfAborted()\n      if (directory === absoluteRoot && ignoredProtectedRootEntries.has(entry.name)) {\n        continue\n      }\n      const absolute = resolve(directory, entry.name)\n      const relPath = relative(absoluteRoot, absolute).split(sep).join('/')\n      if (!relPath || relPath.startsWith('../') || relPath.includes('/../')) {\n        throw new Error(`workspace entry escapes root: ${relPath}`)\n      }\n      const stats = await lstat(absolute)\n      if (stats.isSymbolicLink()) {\n        throw new Error(await symlinkRefusal(absolute, relPath, absoluteRoot))\n      }\n      if (stats.isDirectory()) {\n        await visit(absolute)\n        continue\n      }\n      if (!stats.isFile()) {\n        throw new Error(`workspace contains a non-regular entry: ${relPath}`)\n      }\n      if (limits && scanned.length >= limits.maxFiles) {\n        throw new WorkspaceScanLimitError('workspace exceeds maxFiles')\n      }\n      const descriptor = await open(\n        absolute,\n        fsConstants.O_RDONLY |\n          (typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0),\n      )\n      try {\n        const openedStats = await descriptor.stat()\n        if (!openedStats.isFile()) {\n          throw new Error(`workspace contains a non-regular entry: ${relPath}`)\n        }\n        if (openedStats.nlink !== 1) {\n          throw new Error(`workspace contains a hard-linked file: ${relPath}`)\n        }\n        const mode =\n          options.portableTree === true\n            ? portableFileMode(openedStats.mode)\n            : openedStats.mode & 0o777\n        if (limits && openedStats.size > limits.maxFileBytes) {\n          throw new WorkspaceScanLimitError(`workspace file exceeds maxFileBytes: ${relPath}`)\n        }\n        const remainingBytes = limits ? limits.maxTotalFileBytes - totalBytes : undefined\n        if (remainingBytes !== undefined && openedStats.size > remainingBytes) {\n          throw new WorkspaceScanLimitError('workspace exceeds maxTotalFileBytes')\n        }\n        const read = await readWorkspaceFile(\n          descriptor,\n          limits ? Math.min(limits.maxFileBytes, remainingBytes ?? limits.maxFileBytes) : undefined,\n          keepBytes,\n          relPath,\n          options.signal,\n        )\n        totalBytes += read.byteLength\n        scanned.push({\n          path: relPath,\n          mode,\n          sha256: read.sha256,\n          byteLength: read.byteLength,\n          ...(read.bytes === undefined ? {} : { bytes: read.bytes }),\n        })\n      } finally {\n        await descriptor.close()\n      }\n    }\n  }\n\n  await visit(absoluteRoot)\n  return scanned\n}\n\n/**\n * Why one symbolic link is refused, in the terms that separate a portable link from a link that\n * reaches outside the tree.\n *\n * Every link is refused, in both mode policies. `AgentCandidateWorkspaceManifestMaterial` has no\n * representation for one — `mode`, `sha256` and `byteLength` describe a regular file — so a link\n * recorded as a file would let two different trees share one digest. The reason says which kind of\n * link it was, so a caller can tell a link it can rewrite from one it cannot.\n */\nasync function symlinkRefusal(\n  absolute: string,\n  relPath: string,\n  absoluteRoot: string,\n): Promise<string> {\n  const target = await readlink(absolute)\n  if (isAbsolute(target)) {\n    return `workspace contains an absolute symlink: ${relPath} -> ${target}`\n  }\n  if (!isWithin(absoluteRoot, resolve(dirname(absolute), target))) {\n    return `workspace contains a symlink that escapes its tree: ${relPath} -> ${target}`\n  }\n  let physical: string\n  try {\n    physical = await realpath(absolute)\n  } catch {\n    return `workspace contains an unresolved symlink: ${relPath} -> ${target}`\n  }\n  if (!isWithin(absoluteRoot, physical)) {\n    return `workspace contains a symlink that resolves outside its tree: ${relPath} -> ${target}`\n  }\n  return `workspace contains a symlink: ${relPath} -> ${target}`\n}\n\nfunction isWithin(root: string, path: string): boolean {\n  return path === root || path.startsWith(`${root}${sep}`)\n}\n\n/**\n * Read one open regular file into its digest, keeping the bytes only when the caller needs them.\n *\n * The content reaches the hash in 1 MiB chunks and is never held whole for a digest-only walk, so\n * the size of the largest file does not decide whether a workspace can be described.\n * `FileHandle.readFile` refuses anything above 2 GiB with `ERR_FS_FILE_TOO_LARGE`. Hashing the\n * chunks in order equals hashing the whole buffer, so a manifest a buffered read produced is\n * reproduced byte for byte.\n */\nasync function readWorkspaceFile(\n  descriptor: Awaited<ReturnType<typeof open>>,\n  maxBytes: number | undefined,\n  keepBytes: boolean,\n  path: string,\n  signal?: AbortSignal,\n): Promise<{ sha256: Sha256Digest; byteLength: number; bytes?: Buffer }> {\n  const hash = createHash('sha256')\n  const buffer = Buffer.allocUnsafe(1024 * 1024)\n  const chunks: Buffer[] = []\n  let total = 0\n  while (true) {\n    signal?.throwIfAborted()\n    const { bytesRead } = await descriptor.read(buffer, 0, buffer.byteLength, null)\n    if (bytesRead === 0) break\n    total += bytesRead\n    if (maxBytes !== undefined && total > maxBytes) {\n      throw new WorkspaceScanLimitError(`workspace file exceeds its capture limit: ${path}`)\n    }\n    const chunk = buffer.subarray(0, bytesRead)\n    hash.update(chunk)\n    // The read buffer is reused, so a kept chunk has to be copied out of it.\n    if (keepBytes) chunks.push(Buffer.from(chunk))\n  }\n  const sha256 = `sha256:${hash.digest('hex')}` as Sha256Digest\n  return keepBytes\n    ? { sha256, byteLength: total, bytes: Buffer.concat(chunks, total) }\n    : { sha256, byteLength: total }\n}\n","/** Reject unknown fields while requiring every declared non-optional field. */\nexport function assertExactObjectKeys(\n  value: unknown,\n  required: readonly string[],\n  label: string,\n  optional: readonly string[] = [],\n): void {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`${label} must be an object`)\n  }\n  const allowed = new Set([...required, ...optional])\n  if (allowed.size !== required.length + optional.length) {\n    throw new Error(`${label} exact-key contract contains duplicate fields`)\n  }\n  for (const key of Object.keys(value)) {\n    if (!allowed.has(key)) throw new Error(`${label} contains unknown field ${key}`)\n  }\n  for (const key of required) {\n    if (!(key in value)) throw new Error(`${label} is missing field ${key}`)\n  }\n}\n\n/**\n * Reject a string carrying a lone surrogate. A well-formed UTF-16 string round-trips through UTF-8\n * unchanged; a lone surrogate does not, so a value that passes here is safe to persist and re-read\n * as the same bytes.\n */\nexport function isWellFormedUnicode(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1)\n      if (!(next >= 0xdc00 && next <= 0xdfff)) return false\n      index++\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      return false\n    }\n  }\n  return true\n}\n","import { spawn } from 'node:child_process'\nimport { mkdir, mkdtemp, readFile, realpath, rm, stat } from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { join, resolve } from 'node:path'\n\nimport type {\n  AgentCandidateCode,\n  AgentCandidateGitHubRepository,\n  AgentCandidateGitHubResource,\n  AgentCandidateWorkspaceManifestMaterial,\n} from '@tangle-network/agent-interface'\n\nimport { candidateWorkspaceManifest, verifyBytes } from './artifacts'\nimport { canonicalCandidateBytes } from './digest'\nimport type { AgentCandidateRepositoryPort } from './types'\n\ninterface GitResult {\n  stdout: Buffer\n  stderr: Buffer\n}\n\nexport async function verifyCandidateCode(\n  code: AgentCandidateCode,\n  repositories: AgentCandidateRepositoryPort,\n  patchBytes?: Uint8Array,\n): Promise<string | undefined> {\n  if (code.kind === 'disabled') return undefined\n  const repositoryRoot = await verifiedRepositoryRoot(code.repository, repositories)\n  await assertCommitAndBaseTree(repositoryRoot, code.baseCommit, code.baseTree)\n\n  if (code.kind === 'no-op') {\n    await assertSafeTree(repositoryRoot, code.baseTree)\n    return code.baseTree\n  }\n  if (!patchBytes) throw new Error('git-patch candidate is missing verified patch bytes')\n\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-git-'))\n  try {\n    const indexFile = join(temporary, 'index')\n    await runCandidateGit(repositoryRoot, ['read-tree', code.baseTree], undefined, {\n      GIT_INDEX_FILE: indexFile,\n    })\n    await runCandidateGit(\n      repositoryRoot,\n      ['apply', '--cached', '--binary', '--whitespace=nowarn', '-'],\n      patchBytes,\n      { GIT_INDEX_FILE: indexFile },\n    )\n    const candidateTree = (\n      await runCandidateGit(repositoryRoot, ['write-tree'], undefined, {\n        GIT_INDEX_FILE: indexFile,\n      })\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (candidateTree !== code.candidateTree) {\n      throw new Error(\n        `git patch materialized tree ${candidateTree} does not match ${code.candidateTree}`,\n      )\n    }\n    await assertSafeTree(repositoryRoot, candidateTree)\n    return candidateTree\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nexport async function readCandidateGitHubResource(\n  resource: AgentCandidateGitHubResource,\n  repositories: AgentCandidateRepositoryPort,\n): Promise<Uint8Array> {\n  const repositoryRoot = await verifiedRepositoryRoot(resource.repository, repositories)\n  const commitType = (\n    await runCandidateGit(repositoryRoot, ['cat-file', '-t', resource.commit])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (commitType !== 'commit') {\n    throw new Error(`GitHub resource commit is not a commit object: ${resource.commit}`)\n  }\n  const listing = (\n    await runCandidateGit(repositoryRoot, ['ls-tree', '-z', resource.commit, '--', resource.path])\n  ).stdout\n  const entries = parseTreeEntries(listing)\n  if (entries.length !== 1 || entries[0]?.path !== resource.path) {\n    throw new Error(`GitHub resource path is not one exact file: ${resource.path}`)\n  }\n  const entry = entries[0]\n  if (entry?.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n    throw new Error(`GitHub resource path is not a regular Git blob: ${resource.path}`)\n  }\n  const bytes = (await runCandidateGit(repositoryRoot, ['cat-file', 'blob', entry.object])).stdout\n  verifyBytes(bytes, resource.sha256, resource.byteLength, `GitHub resource ${resource.path}`)\n  return Uint8Array.from(bytes)\n}\n\nexport async function verifyTaskCheckout(\n  taskRoot: string,\n  expected: { baseCommit: string; baseTree: string },\n): Promise<void> {\n  const root = resolve(taskRoot)\n  const head = (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout.toString('utf8').trim()\n  if (head !== expected.baseCommit) {\n    throw new Error(`task checkout HEAD ${head} does not match ${expected.baseCommit}`)\n  }\n  const tree = (await runCandidateGit(root, ['rev-parse', 'HEAD^{tree}'])).stdout\n    .toString('utf8')\n    .trim()\n  if (tree !== expected.baseTree) {\n    throw new Error(`task checkout base tree ${tree} does not match ${expected.baseTree}`)\n  }\n}\n\n/**\n * Apply an evaluator-captured binary diff in a detached object database and\n * prove its result tree exactly matches the captured after-state manifest.\n */\nexport async function verifyTaskOutcomePatch(input: {\n  repositoryRoot: string\n  baseCommit: string\n  baseTree: string\n  resultTree: string\n  patch: Uint8Array\n  afterState: AgentCandidateWorkspaceManifestMaterial\n}): Promise<{ resultTree: string; resultCommit: string }> {\n  const repositoryRoot = resolve(input.repositoryRoot)\n  await verifyTaskCheckout(repositoryRoot, input)\n  const gitDir = resolve(\n    (await runCandidateGit(repositoryRoot, ['rev-parse', '--absolute-git-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(gitDir)) !== gitDir || gitDir.includes(':')) {\n    throw new Error('task Git object store has an unsupported path')\n  }\n  await assertNoGitIndirection(repositoryRoot, gitDir, 'task repository')\n\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-task-outcome-'))\n  try {\n    const objectDirectory = join(temporary, 'objects')\n    const indexFile = join(temporary, 'index')\n    await mkdir(objectDirectory)\n    const gitEnvironment = {\n      GIT_INDEX_FILE: indexFile,\n      GIT_OBJECT_DIRECTORY: objectDirectory,\n      GIT_ALTERNATE_OBJECT_DIRECTORIES: join(gitDir, 'objects'),\n    }\n    await runCandidateGit(repositoryRoot, ['read-tree', input.baseTree], undefined, gitEnvironment)\n    if (input.patch.byteLength > 0) {\n      await runCandidateGit(\n        repositoryRoot,\n        ['apply', '--cached', '--binary', '--whitespace=nowarn', '-'],\n        input.patch,\n        gitEnvironment,\n      )\n    }\n    const resultTree = (\n      await runCandidateGit(repositoryRoot, ['write-tree'], undefined, gitEnvironment)\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (resultTree !== input.resultTree) {\n      throw new Error(\n        `task outcome patch materialized tree ${resultTree} does not match ${input.resultTree}`,\n      )\n    }\n    await assertSafeTree(repositoryRoot, resultTree, gitEnvironment)\n    const observed = await workspaceManifestFromGitTree(repositoryRoot, resultTree, gitEnvironment)\n    if (\n      !Buffer.from(canonicalCandidateBytes(observed)).equals(\n        Buffer.from(canonicalCandidateBytes(input.afterState)),\n      )\n    ) {\n      throw new Error('task outcome after-state does not match the materialized result tree')\n    }\n    const resultCommit = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['commit-tree', resultTree, '-p', input.baseCommit],\n        Buffer.from('candidate task outcome\\n', 'utf8'),\n        {\n          ...gitEnvironment,\n          GIT_AUTHOR_NAME: 'Tangle Evaluator',\n          GIT_AUTHOR_EMAIL: 'evaluator@tangle.tools',\n          GIT_AUTHOR_DATE: '2000-01-01T00:00:00Z',\n          GIT_COMMITTER_NAME: 'Tangle Evaluator',\n          GIT_COMMITTER_EMAIL: 'evaluator@tangle.tools',\n          GIT_COMMITTER_DATE: '2000-01-01T00:00:00Z',\n        },\n      )\n    ).stdout\n      .toString('utf8')\n      .trim()\n    const committedTree = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['rev-parse', `${resultCommit}^{tree}`],\n        undefined,\n        gitEnvironment,\n      )\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (committedTree !== resultTree) {\n      throw new Error('task outcome evaluator commit does not bind the verified result tree')\n    }\n    return { resultTree, resultCommit }\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nasync function verifiedRepositoryRoot(\n  repository: AgentCandidateGitHubRepository,\n  repositories: AgentCandidateRepositoryPort,\n): Promise<string> {\n  const repositoryRoot = resolve(await repositories.resolve(repository))\n  const rootStats = await stat(repositoryRoot)\n  if (!rootStats.isDirectory()) throw new Error('candidate repository path is not a directory')\n\n  const origin = (await runCandidateGit(repositoryRoot, ['remote', 'get-url', 'origin'])).stdout\n    .toString('utf8')\n    .trim()\n  const actual = parseGitHubRemote(origin)\n  if (!actual || actual.owner !== repository.owner || actual.repo !== repository.repo) {\n    throw new Error(\n      `local repository origin ${origin || '<missing>'} does not match github.com/${repository.owner}/${repository.repo}`,\n    )\n  }\n\n  const gitDirText = (\n    await runCandidateGit(repositoryRoot, ['rev-parse', '--absolute-git-dir'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  const gitDir = resolve(gitDirText)\n  await assertNoGitIndirection(repositoryRoot, gitDir, 'candidate repository')\n  return repositoryRoot\n}\n\nexport async function assertNoGitIndirection(\n  repositoryRoot: string,\n  gitDir: string,\n  label: string,\n): Promise<void> {\n  const replacements = (\n    await runCandidateGit(repositoryRoot, ['for-each-ref', '--format=%(refname)', 'refs/replace'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (replacements) throw new Error(`${label} contains Git replace refs`)\n  // `--git-common-dir` answers relative to the worktree for an ordinary repository, so the\n  // path is resolved against a root the caller supplied and carries whatever symlinks that\n  // root carries. Read the object store through its RESOLVED path: the alternates below must\n  // be read at the real location, and a symlinked prefix is the OS's own doing on macOS,\n  // where a temp root lives under /var, a symlink to /private/var.\n  const commonDir = await realpath(\n    resolve(\n      repositoryRoot,\n      (await runCandidateGit(repositoryRoot, ['rev-parse', '--git-common-dir'])).stdout\n        .toString('utf8')\n        .trim(),\n    ),\n  )\n  if (commonDir.includes(':')) {\n    throw new Error(`${label} Git common directory has an unsupported path`)\n  }\n  for (const objectRoot of new Set([gitDir, commonDir])) {\n    for (const name of ['alternates', 'http-alternates']) {\n      const path = join(objectRoot, 'objects', 'info', name)\n      try {\n        const contents = await readFile(path, 'utf8')\n        if (contents.trim()) throw new Error(`${label} uses forbidden Git ${name}`)\n      } catch (error) {\n        if (!isNoEntry(error)) throw error\n      }\n    }\n  }\n}\n\nasync function assertCommitAndBaseTree(\n  repositoryRoot: string,\n  commit: string,\n  expectedTree: string,\n): Promise<void> {\n  const type = (await runCandidateGit(repositoryRoot, ['cat-file', '-t', commit])).stdout\n    .toString('utf8')\n    .trim()\n  if (type !== 'commit') throw new Error(`candidate base object is not a commit: ${commit}`)\n  const actualTree = (\n    await runCandidateGit(repositoryRoot, ['rev-parse', `${commit}^{tree}`])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (actualTree !== expectedTree) {\n    throw new Error(`candidate base commit tree ${actualTree} does not match ${expectedTree}`)\n  }\n}\n\nasync function assertSafeTree(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string> = {},\n): Promise<void> {\n  const listing = (\n    await runCandidateGit(\n      repositoryRoot,\n      ['ls-tree', '-rz', '--full-tree', tree],\n      undefined,\n      environment,\n    )\n  ).stdout\n  const entries = parseTreeEntries(listing)\n  if (entries.length === 0) throw new Error('candidate Git tree cannot be empty')\n  for (const entry of entries) {\n    if (entry.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n      throw new Error(\n        `candidate Git tree contains a symlink, submodule, or non-blob: ${entry.path}`,\n      )\n    }\n    assertSafeGitPath(entry.path)\n  }\n}\n\nasync function workspaceManifestFromGitTree(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string>,\n): Promise<AgentCandidateWorkspaceManifestMaterial> {\n  return candidateWorkspaceManifest(\n    await readCandidateGitTreeFiles(repositoryRoot, tree, environment),\n  )\n}\n\nexport async function readCandidateGitTreeFiles(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string> = {},\n  limits?: { maxFiles: number; maxFileBytes: number; maxTotalFileBytes: number },\n): Promise<Array<{ path: string; mode: 0o644 | 0o755; bytes: Uint8Array }>> {\n  const listing = (\n    await runCandidateGit(\n      repositoryRoot,\n      ['ls-tree', '-rzl', '--full-tree', tree],\n      undefined,\n      environment,\n    )\n  ).stdout\n  const files: Array<{ path: string; mode: 0o644 | 0o755; bytes: Uint8Array }> = []\n  const entries = parseTreeEntries(listing)\n  if (limits && entries.length > limits.maxFiles) {\n    throw new Error('candidate Git tree exceeds maxFiles')\n  }\n  let totalBytes = 0\n  for (const entry of entries) {\n    if (entry.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n      throw new Error(`candidate Git tree contains a non-regular file: ${entry.path}`)\n    }\n    assertSafeGitPath(entry.path)\n    if (entry.size === undefined) {\n      throw new Error(`candidate Git tree is missing blob size: ${entry.path}`)\n    }\n    if (limits && entry.size > limits.maxFileBytes) {\n      throw new Error(`candidate Git tree file exceeds maxFileBytes: ${entry.path}`)\n    }\n    totalBytes += entry.size\n    if (limits && totalBytes > limits.maxTotalFileBytes) {\n      throw new Error('candidate Git tree exceeds maxTotalFileBytes')\n    }\n    const bytes = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['cat-file', 'blob', entry.object],\n        undefined,\n        environment,\n      )\n    ).stdout\n    if (bytes.byteLength !== entry.size) {\n      throw new Error(`candidate Git blob size changed: ${entry.path}`)\n    }\n    files.push({\n      path: entry.path,\n      mode: entry.mode === '100755' ? 0o755 : 0o644,\n      bytes: Uint8Array.from(bytes),\n    })\n  }\n  return files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))\n}\n\nfunction parseTreeEntries(bytes: Uint8Array): Array<{\n  mode: string\n  type: string\n  object: string\n  size?: number\n  path: string\n}> {\n  const raw = Buffer.from(bytes)\n  const decoded = raw.toString('utf8')\n  if (!Buffer.from(decoded, 'utf8').equals(raw)) {\n    throw new Error('candidate Git tree contains a non-UTF-8 path')\n  }\n  const rows = decoded.split('\\0').filter(Boolean)\n  return rows.map((row) => {\n    const tab = row.indexOf('\\t')\n    const header = row.slice(0, tab).split(' ').filter(Boolean)\n    const path = row.slice(tab + 1)\n    const [mode, type, object, sizeText] = header\n    if (tab < 1 || !mode || !type || !object || !path) {\n      throw new Error('malformed Git tree entry')\n    }\n    const size = sizeText && /^\\d+$/.test(sizeText) ? Number(sizeText) : undefined\n    if (size !== undefined && !Number.isSafeInteger(size)) {\n      throw new Error('candidate Git tree entry size exceeds the safe integer range')\n    }\n    return { mode, type, object, ...(size === undefined ? {} : { size }), path }\n  })\n}\n\nfunction assertSafeGitPath(path: string): void {\n  if (\n    !path ||\n    path.startsWith('/') ||\n    path.includes('\\\\') ||\n    path.includes('\\0') ||\n    hasControlCharacter(path) ||\n    path.split('/').some((part) => !part || part === '.' || part === '..') ||\n    path.split('/')[0]?.toLowerCase() === '.git'\n  ) {\n    throw new Error(`candidate Git tree contains an unsafe path: ${path}`)\n  }\n}\n\nfunction hasControlCharacter(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code < 0x20 || code === 0x7f) return true\n  }\n  return false\n}\n\nfunction parseGitHubRemote(value: string): { owner: string; repo: string } | undefined {\n  const match = value.match(\n    /^(?:https?:\\/\\/github\\.com\\/|ssh:\\/\\/git@github\\.com\\/|git@github\\.com:)([^/]+)\\/([^/]+?)(?:\\.git)?$/,\n  )\n  if (!match?.[1] || !match[2]) return undefined\n  return { owner: match[1], repo: match[2] }\n}\n\nexport async function runCandidateGit(\n  repositoryRoot: string,\n  args: string[],\n  input?: Uint8Array,\n  extraEnv: Record<string, string> = {},\n): Promise<GitResult> {\n  const env = Object.fromEntries(\n    Object.entries(process.env).filter(([name]) => !name.startsWith('GIT_')),\n  ) as Record<string, string>\n  Object.assign(env, {\n    GIT_CONFIG_NOSYSTEM: '1',\n    GIT_CONFIG_GLOBAL: '/dev/null',\n    GIT_CONFIG_SYSTEM: '/dev/null',\n    GIT_TERMINAL_PROMPT: '0',\n    GIT_NO_REPLACE_OBJECTS: '1',\n    LC_ALL: 'C',\n    ...extraEnv,\n  })\n  const fullArgs = [\n    '-c',\n    'core.hooksPath=/dev/null',\n    '-c',\n    'core.fsmonitor=false',\n    '-c',\n    'core.untrackedCache=false',\n    '-c',\n    'protocol.file.allow=never',\n    '-C',\n    repositoryRoot,\n    ...args,\n  ]\n  return await new Promise((resolveResult, reject) => {\n    const child = spawn('git', fullArgs, { env, stdio: ['pipe', 'pipe', 'pipe'] })\n    const stdout: Buffer[] = []\n    const stderr: Buffer[] = []\n    child.stdout.on('data', (chunk: Buffer) => stdout.push(chunk))\n    child.stderr.on('data', (chunk: Buffer) => stderr.push(chunk))\n    child.on('error', reject)\n    child.on('close', (code, signal) => {\n      const out = Buffer.concat(stdout)\n      const err = Buffer.concat(stderr)\n      if (code !== 0) {\n        reject(\n          new Error(\n            `git ${args[0] ?? '<command>'} failed (${signal ?? code}): ${err.toString('utf8').trim()}`,\n          ),\n        )\n        return\n      }\n      resolveResult({ stdout: out, stderr: err })\n    })\n    if (input) child.stdin.end(input)\n    else child.stdin.end()\n  })\n}\n\nfunction isNoEntry(error: unknown): boolean {\n  return (\n    typeof error === 'object' &&\n    error !== null &&\n    'code' in error &&\n    (error as { code?: string }).code === 'ENOENT'\n  )\n}\n","import {\n  type AgentCandidateArtifactRef,\n  agentCandidateArtifactRefSchema,\n} from '@tangle-network/agent-interface'\n\nimport { verifyBytes } from './artifacts'\nimport { immutableCandidateValue, sha256Bytes } from './digest'\nimport type { AgentCandidateOutputArtifactPort, AgentCandidateOutputPurpose } from './types'\n\n/** Persist evaluator evidence, read it back, and bind the returned locator to the exact bytes. */\nexport async function persistCandidateOutputArtifact(\n  port: AgentCandidateOutputArtifactPort,\n  input: {\n    executionId: string\n    purpose: AgentCandidateOutputPurpose\n    bytes: Uint8Array\n    signal?: AbortSignal\n  },\n): Promise<AgentCandidateArtifactRef> {\n  input.signal?.throwIfAborted()\n  const bytes = Uint8Array.from(input.bytes)\n  const expectedDigest = sha256Bytes(bytes)\n  const ref = agentCandidateArtifactRefSchema.parse(\n    await port.put({\n      executionId: input.executionId,\n      purpose: input.purpose,\n      bytes: Uint8Array.from(bytes),\n      ...(input.signal ? { signal: input.signal } : {}),\n    }),\n  )\n  input.signal?.throwIfAborted()\n  if (ref.sha256 !== expectedDigest || ref.byteLength !== bytes.byteLength) {\n    throw new Error('candidate output locator does not identify the submitted bytes')\n  }\n  const stored = await port.read(ref)\n  input.signal?.throwIfAborted()\n  verifyBytes(stored, expectedDigest, bytes.byteLength, 'persisted candidate output')\n  return immutableCandidateValue(ref)\n}\n","import { randomUUID } from 'node:crypto'\nimport { constants as fsConstants } from 'node:fs'\nimport {\n  lstat,\n  mkdir,\n  mkdtemp,\n  open,\n  readdir,\n  readFile,\n  realpath,\n  rename,\n  rm,\n  writeFile,\n} from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { dirname, isAbsolute, join, resolve, sep, win32 } from 'node:path'\nimport { isAnyArrayBuffer, isSharedArrayBuffer } from 'node:util/types'\nimport type {\n  AgentCandidateCapturedArtifact,\n  AgentCandidateWorkspaceSnapshotEvidence,\n} from '@tangle-network/agent-interface'\nimport { extract, type Pack, pack, type Extract as TarExtract } from 'tar-stream'\nimport {\n  candidateWorkspaceManifest,\n  captureMaterializedWorkspace,\n  verifyBytes,\n  verifyMaterializedWorkspace,\n} from './artifacts'\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  deepFreezeCandidate,\n  embeddedCandidateArtifact,\n  sha256Bytes,\n} from './digest'\nimport { isWellFormedUnicode } from './exact-object'\nimport {\n  assertNoGitIndirection,\n  readCandidateGitTreeFiles,\n  runCandidateGit,\n} from './git-materialize'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport type {\n  AgentCandidateExecutorWorkspaceFile,\n  AgentCandidateOutputArtifactPort,\n  AgentCandidateWorkspacePort,\n} from './types'\n\nconst archiveKind = 'agent-candidate-workspace-archive' as const\nconst workspaceEntryPrefix = 'workspace/'\nconst repositoryMetadataEntry = 'metadata/repository.json'\nconst repositoryBundleEntry = 'metadata/repository.bundle'\nconst fixedTarTime = new Date(0)\n\nexport interface AgentCandidateWorkspaceArchiveLimits {\n  maxArchiveBytes: number\n  maxEmbeddedArtifactBytes: number\n  maxFiles: number\n  maxFileBytes: number\n  maxTotalFileBytes: number\n  maxPathBytes: number\n  maxRepositoryBundleBytes: number\n}\n\nconst defaultLimits: AgentCandidateWorkspaceArchiveLimits = Object.freeze({\n  maxArchiveBytes: 512 * 1024 * 1024,\n  maxEmbeddedArtifactBytes: 1024 * 1024,\n  maxFiles: 50_000,\n  maxFileBytes: 128 * 1024 * 1024,\n  maxTotalFileBytes: 256 * 1024 * 1024,\n  maxPathBytes: 4_096,\n  maxRepositoryBundleBytes: 128 * 1024 * 1024,\n})\n\ninterface WorkspaceArchiveRepository {\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n    bytes: Uint8Array\n  }\n}\n\ninterface WorkspaceArchiveRepositoryMetadata {\n  kind: typeof archiveKind\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n  }\n}\n\ninterface DecodedWorkspaceArchive {\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository?: WorkspaceArchiveRepository\n}\n\nexport interface CaptureAgentCandidateWorkspaceOptions {\n  /** Include Git HEAD so task preparation can prove its exact commit and tree. */\n  includeRepository?: boolean\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n  /** Use the evaluator-owned artifact store when manifest or archive bytes should not be embedded. */\n  artifactPersistence?: {\n    executionId: string\n    outputArtifacts: AgentCandidateOutputArtifactPort\n    signal?: AbortSignal\n  }\n}\n\nexport interface CreateAgentCandidateWorkspacePortOptions {\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n}\n\nexport interface CapturedAgentCandidateWorkspace {\n  readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  /** Caller-owned bytes accepted by createAgentCandidateWorkspacePort. */\n  readonly archive: Uint8Array\n}\n\n/** Capture one exact regular-file workspace for immutable candidate execution. */\nexport async function captureAgentCandidateWorkspace(\n  rootInput: string,\n  options: CaptureAgentCandidateWorkspaceOptions = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const root = resolve(rootInput)\n  const limits = workspaceLimits(options.limits)\n  const captured = options.includeRepository\n    ? await captureRepository(root, limits)\n    : await captureMaterializedWorkspace(root, {\n        limits: {\n          maxFiles: limits.maxFiles,\n          maxFileBytes: limits.maxFileBytes,\n          maxTotalFileBytes: limits.maxTotalFileBytes,\n        },\n      })\n  assertWorkspaceFilesWithinLimits(captured.files, limits)\n  const repository = 'repository' in captured ? captured.repository : undefined\n  return captureWorkspaceFiles(captured.files, repository, limits, options.artifactPersistence)\n}\n\n/** Capture detached files returned by a remote executor into the standard archive. */\nexport async function captureAgentCandidateWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  options: Omit<CaptureAgentCandidateWorkspaceOptions, 'includeRepository'> = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const limits = workspaceLimits(options.limits)\n  return captureWorkspaceFiles(\n    normalizeWorkspaceFiles(input, limits),\n    undefined,\n    limits,\n    options.artifactPersistence,\n  )\n}\n\nasync function captureWorkspaceFiles(\n  files: readonly AgentCandidateExecutorWorkspaceFile[],\n  repository: WorkspaceArchiveRepository | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n  artifactPersistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<CapturedAgentCandidateWorkspace> {\n  const material = candidateWorkspaceManifest(files)\n  const manifest = canonicalCandidateBytes(material)\n  const archive = await encodeWorkspaceArchive(files, repository, limits.maxArchiveBytes)\n  if (\n    !artifactPersistence &&\n    (manifest.byteLength > limits.maxEmbeddedArtifactBytes ||\n      archive.byteLength > limits.maxEmbeddedArtifactBytes)\n  ) {\n    throw new Error(\n      'candidate workspace artifacts exceed maxEmbeddedArtifactBytes; artifactPersistence is required',\n    )\n  }\n  const manifestArtifact = await captureWorkspaceArtifact('manifest', manifest, artifactPersistence)\n  const archiveArtifact = await captureWorkspaceArtifact('archive', archive, artifactPersistence)\n  const snapshot = deepFreezeCandidate({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: canonicalCandidateDigest(material),\n    material,\n    manifest: manifestArtifact,\n    archive: archiveArtifact,\n  } satisfies AgentCandidateWorkspaceSnapshotEvidence)\n  return Object.freeze({ snapshot, archive })\n}\n\nasync function captureWorkspaceArtifact(\n  kind: 'manifest' | 'archive',\n  bytes: Uint8Array,\n  persistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<AgentCandidateCapturedArtifact> {\n  if (!persistence) return embeddedCandidateArtifact(bytes)\n  if (!persistence.executionId.trim()) {\n    throw new Error('candidate workspace artifact persistence requires an executionId')\n  }\n  return persistCandidateOutputArtifact(persistence.outputArtifacts, {\n    executionId: persistence.executionId,\n    purpose: kind === 'manifest' ? 'candidate-workspace-manifest' : 'candidate-workspace-archive',\n    bytes,\n    ...(persistence.signal ? { signal: persistence.signal } : {}),\n  })\n}\n\n/** Create the standard bounded materializer for candidate execution ports. */\nexport function createAgentCandidateWorkspacePort(\n  options: CreateAgentCandidateWorkspacePortOptions = {},\n): AgentCandidateWorkspacePort {\n  const limits = workspaceLimits(options.limits)\n  const port: AgentCandidateWorkspacePort = {\n    materialize: async ({ role, snapshot, archive, destination }) => {\n      await materializeAgentCandidateWorkspace({\n        role,\n        snapshot,\n        archive,\n        destination,\n        limits,\n      })\n    },\n  }\n  return Object.freeze(port)\n}\n\nasync function materializeAgentCandidateWorkspace(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  destination: string\n  limits: AgentCandidateWorkspaceArchiveLimits\n}): Promise<void> {\n  const decoded = await decodeVerifiedWorkspaceArchive(input)\n  const destination = resolve(input.destination)\n  await prepareEmptyDestination(destination)\n  const staging = await mkdtemp(`${destination}.materializing-`)\n  try {\n    await writeWorkspaceFiles(staging, decoded.files)\n    if (decoded.repository) {\n      await materializeRepository(decoded.repository, staging)\n    }\n    await verifyMaterializedWorkspace(staging, input.snapshot.material, {\n      ignoredProtectedRootEntries: decoded.repository ? ['.git'] : [],\n    })\n    await rename(staging, destination)\n  } catch (error) {\n    await rm(staging, { recursive: true, force: true })\n    await rm(destination, { recursive: true, force: true })\n    throw error\n  }\n}\n\n/** Verify a portable archive before its source environment may be discarded. */\nexport async function verifyAgentCandidateWorkspaceArchive(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n}): Promise<void> {\n  await decodeVerifiedWorkspaceArchive({ ...input, limits: workspaceLimits(input.limits) })\n}\n\nasync function decodeVerifiedWorkspaceArchive(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  limits: AgentCandidateWorkspaceArchiveLimits\n}): Promise<DecodedWorkspaceArchive> {\n  verifyBytes(\n    input.archive,\n    input.snapshot.archive.sha256,\n    input.snapshot.archive.byteLength,\n    'candidate workspace archive',\n  )\n  const decoded = await parseWorkspaceArchive(input.archive, input.limits)\n  if (decoded.repository && input.role !== 'task') {\n    throw new Error('only task workspaces may carry a Git repository')\n  }\n  assertArchiveMatchesSnapshot(decoded.files, input.snapshot)\n  return decoded\n}\n\nasync function captureRepository(\n  requestedRoot: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<{\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository: WorkspaceArchiveRepository\n}> {\n  const requestedStats = await lstat(requestedRoot)\n  if (!requestedStats.isDirectory() || requestedStats.isSymbolicLink()) {\n    throw new Error('candidate repository root must be a real directory')\n  }\n  // Capture the RESOLVED root. The property this guards is that capture starts at one real\n  // worktree root with no aliasing, which resolving satisfies directly — rejecting a symlinked\n  // prefix outright does not, and makes capture impossible on macOS, where the OS itself hands\n  // out temp paths under /var, a symlink to /private/var. Git reports a resolved path, so the\n  // worktree-root comparison below needs the resolved form on both sides.\n  const root = await realpath(requestedRoot)\n  const resolvedStats = await lstat(root)\n  if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) {\n    throw new Error('candidate repository root must resolve to a real directory')\n  }\n  const topLevel = (await runCandidateGit(root, ['rev-parse', '--show-toplevel'])).stdout\n    .toString('utf8')\n    .trim()\n  if ((await realpath(resolve(topLevel))) !== root) {\n    throw new Error('candidate repository capture must start at the Git worktree root')\n  }\n  const gitDir = resolve(\n    (await runCandidateGit(root, ['rev-parse', '--absolute-git-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(gitDir)) !== gitDir || gitDir.includes(':')) {\n    throw new Error('candidate repository Git object store has an unsupported path')\n  }\n  await assertNoGitIndirection(root, gitDir, 'candidate repository')\n  const headCommit = (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout\n    .toString('utf8')\n    .trim()\n  const headTree = (await runCandidateGit(root, ['rev-parse', 'HEAD^{tree}'])).stdout\n    .toString('utf8')\n    .trim()\n  assertGitObjectId(headCommit, 'HEAD')\n  assertGitObjectId(headTree, 'HEAD tree')\n  if (headCommit.length !== headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  const files = await readCandidateGitTreeFiles(root, headTree, {}, limits)\n  assertWorkspaceFilesWithinLimits(files, limits)\n  const reachableBytesText = (\n    await runCandidateGit(root, ['rev-list', '--disk-usage', '--objects', 'HEAD'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  const reachableBytes = Number(reachableBytesText)\n  if (!Number.isSafeInteger(reachableBytes) || reachableBytes < 0) {\n    throw new Error('candidate repository reachable size is invalid')\n  }\n  if (reachableBytes > limits.maxRepositoryBundleBytes) {\n    throw new Error('candidate repository exceeds maxRepositoryBundleBytes')\n  }\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    await runCandidateGit(root, ['bundle', 'create', bundlePath, 'HEAD'])\n    const bundle = Uint8Array.from(await readFile(bundlePath))\n    if (bundle.byteLength > limits.maxRepositoryBundleBytes) {\n      throw new Error('candidate repository bundle exceeds maxRepositoryBundleBytes')\n    }\n    return {\n      files,\n      repository: {\n        headCommit,\n        headTree,\n        bundle: {\n          sha256: sha256Bytes(bundle),\n          byteLength: bundle.byteLength,\n          bytes: bundle,\n        },\n      },\n    }\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nasync function encodeWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  maxArchiveBytes: number,\n): Promise<Uint8Array> {\n  const archive = pack()\n  const output = collectStream(archive, maxArchiveBytes, 'candidate workspace archive')\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    return await output\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await output.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function verifyCanonicalWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  expected: Uint8Array,\n  maxArchiveBytes: number,\n): Promise<void> {\n  const archive = pack()\n  const comparison = streamEqualsBytes(\n    archive,\n    expected,\n    maxArchiveBytes,\n    'candidate workspace archive',\n  )\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    if (!(await comparison)) throw new Error('candidate workspace tar is not canonical')\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await comparison.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function writeWorkspaceArchiveEntries(\n  archive: Pack,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n): Promise<void> {\n  for (const file of files) {\n    await writeTarEntry(archive, `${workspaceEntryPrefix}${file.path}`, file.mode, file.bytes)\n  }\n  if (!repository) return\n  const metadata = canonicalCandidateBytes({\n    kind: archiveKind,\n    headCommit: repository.headCommit,\n    headTree: repository.headTree,\n    bundle: {\n      sha256: repository.bundle.sha256,\n      byteLength: repository.bundle.byteLength,\n    },\n  } satisfies WorkspaceArchiveRepositoryMetadata)\n  await writeTarEntry(archive, repositoryMetadataEntry, 0o600, metadata)\n  await writeTarEntry(archive, repositoryBundleEntry, 0o600, repository.bundle.bytes)\n}\n\nasync function parseWorkspaceArchive(\n  bytes: Uint8Array,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<DecodedWorkspaceArchive> {\n  if (bytes.byteLength > limits.maxArchiveBytes) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n  }\n  const parser = extract()\n  const files: DecodedWorkspaceArchive['files'] = []\n  const observedEntryNames = new Set<string>()\n  const observedPaths = new Set<string>()\n  let totalBytes = 0\n  let retainedEntryBytes = 0\n  let previousPath: string | undefined\n  let repositoryMetadata: WorkspaceArchiveRepositoryMetadata | undefined\n  let repositoryBundle: Uint8Array | undefined\n  const decoded = (async () => {\n    for await (const entry of parser) {\n      const name = entry.header.name\n      if (\n        entry.header.type !== 'file' ||\n        typeof name !== 'string' ||\n        observedEntryNames.has(name)\n      ) {\n        throw new Error('candidate workspace tar contains an invalid entry')\n      }\n      observedEntryNames.add(name)\n      if (name.startsWith(workspaceEntryPrefix)) {\n        if (files.length >= limits.maxFiles) {\n          throw new Error('candidate workspace archive has an invalid file count')\n        }\n        const path = safeArchivePath(name.slice(workspaceEntryPrefix.length), limits.maxPathBytes)\n        if (!isWorkspaceFileMode(entry.header.mode)) {\n          throw new Error(`candidate workspace archive has an unsupported mode: ${path}`)\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const fileBytes = await readTarEntry(entry, limits.maxFileBytes, `workspace file ${path}`)\n        retainedEntryBytes += fileBytes.byteLength\n        assertWorkspacePathOrder(\n          path,\n          previousPath,\n          observedPaths,\n          'candidate workspace archive paths must be unique and sorted',\n        )\n        previousPath = path\n        if (fileBytes.byteLength > limits.maxTotalFileBytes - totalBytes) {\n          throw new Error('candidate workspace archive exceeds maxTotalFileBytes')\n        }\n        totalBytes += fileBytes.byteLength\n        files.push({ path, mode: entry.header.mode, bytes: fileBytes })\n      } else if (name === repositoryMetadataEntry) {\n        if (entry.header.mode !== 0o600 || repositoryMetadata) {\n          throw new Error('candidate workspace archive repository metadata is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const metadataBytes = await readTarEntry(\n          entry,\n          limits.maxPathBytes,\n          'candidate repository metadata',\n        )\n        retainedEntryBytes += metadataBytes.byteLength\n        repositoryMetadata = parseRepositoryMetadata(metadataBytes, limits.maxRepositoryBundleBytes)\n      } else if (name === repositoryBundleEntry) {\n        if (entry.header.mode !== 0o600 || repositoryBundle) {\n          throw new Error('candidate workspace archive repository bundle is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        repositoryBundle = await readTarEntry(\n          entry,\n          limits.maxRepositoryBundleBytes,\n          'candidate Git bundle',\n        )\n        retainedEntryBytes += repositoryBundle.byteLength\n      } else {\n        throw new Error(`candidate workspace tar contains an unsupported entry: ${name}`)\n      }\n    }\n    if (Boolean(repositoryMetadata) !== Boolean(repositoryBundle)) {\n      throw new Error('candidate workspace archive repository evidence is incomplete')\n    }\n    const repository =\n      repositoryMetadata && repositoryBundle\n        ? repositoryFromTar(repositoryMetadata, repositoryBundle)\n        : undefined\n    return { files, ...(repository ? { repository } : {}) }\n  })()\n  parser.end(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength))\n  const result = await decoded\n  await verifyCanonicalWorkspaceArchive(\n    result.files,\n    result.repository,\n    bytes,\n    limits.maxArchiveBytes,\n  )\n  return result\n}\n\nfunction assertRetainedArchiveSize(\n  archiveBytes: number,\n  retainedEntryBytes: number,\n  entryBytes: number | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (\n    !Number.isSafeInteger(entryBytes) ||\n    entryBytes === undefined ||\n    entryBytes < 0 ||\n    entryBytes > limits.maxArchiveBytes - archiveBytes - retainedEntryBytes\n  ) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes while decoding')\n  }\n}\n\nfunction parseRepositoryMetadata(\n  bytes: Uint8Array,\n  maxBundleBytes: number,\n): WorkspaceArchiveRepositoryMetadata {\n  let value: unknown\n  try {\n    value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes))\n  } catch (error) {\n    throw new Error('candidate workspace archive repository metadata is invalid', { cause: error })\n  }\n  if (\n    !isRecord(value) ||\n    Object.keys(value).sort().join(',') !== 'bundle,headCommit,headTree,kind' ||\n    value.kind !== archiveKind ||\n    typeof value.headCommit !== 'string' ||\n    typeof value.headTree !== 'string' ||\n    !isRecord(value.bundle) ||\n    Object.keys(value.bundle).sort().join(',') !== 'byteLength,sha256' ||\n    typeof value.bundle.sha256 !== 'string' ||\n    !/^sha256:[a-f0-9]{64}$/.test(value.bundle.sha256) ||\n    !Number.isSafeInteger(value.bundle.byteLength) ||\n    (value.bundle.byteLength as number) <= 0 ||\n    (value.bundle.byteLength as number) > maxBundleBytes\n  ) {\n    throw new Error('candidate workspace archive repository is invalid')\n  }\n  if (!Buffer.from(canonicalCandidateBytes(value)).equals(Buffer.from(bytes))) {\n    throw new Error('candidate workspace archive repository metadata is not canonical')\n  }\n  assertGitObjectId(value.headCommit, 'repository HEAD')\n  assertGitObjectId(value.headTree, 'repository HEAD tree')\n  if (value.headCommit.length !== value.headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  return {\n    kind: archiveKind,\n    headCommit: value.headCommit,\n    headTree: value.headTree,\n    bundle: {\n      sha256: value.bundle.sha256 as `sha256:${string}`,\n      byteLength: value.bundle.byteLength as number,\n    },\n  }\n}\n\nfunction repositoryFromTar(\n  metadata: WorkspaceArchiveRepositoryMetadata,\n  bundle: Uint8Array,\n): WorkspaceArchiveRepository {\n  verifyBytes(bundle, metadata.bundle.sha256, metadata.bundle.byteLength, 'candidate Git bundle')\n  return {\n    headCommit: metadata.headCommit,\n    headTree: metadata.headTree,\n    bundle: { ...metadata.bundle, bytes: bundle },\n  }\n}\n\nasync function writeTarEntry(\n  archive: Pack,\n  name: string,\n  mode: number,\n  bytes: Uint8Array,\n): Promise<void> {\n  await new Promise<void>((resolveEntry, rejectEntry) => {\n    archive.entry(\n      workspaceTarHeader(name, mode, bytes.byteLength),\n      Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength),\n      (error) => (error ? rejectEntry(error) : resolveEntry()),\n    )\n  })\n}\n\ntype TarEntry = TarExtract extends AsyncIterable<infer Entry> ? Entry : never\n\nasync function readTarEntry(entry: TarEntry, maxBytes: number, label: string): Promise<Uint8Array> {\n  const size = entry.header.size\n  if (!Number.isSafeInteger(size) || size === undefined || size < 0 || size > maxBytes) {\n    throw new Error(`${label} has an invalid tar size`)\n  }\n  const bytes = await collectStream(entry, maxBytes, label)\n  if (bytes.byteLength !== size) throw new Error(`${label} differs from its tar size`)\n  return bytes\n}\n\nasync function collectStream(\n  stream: AsyncIterable<unknown>,\n  maxBytes: number,\n  label: string,\n): Promise<Uint8Array> {\n  const chunks: Buffer[] = []\n  let totalBytes = 0\n  for await (const chunk of stream) {\n    if (!(chunk instanceof Uint8Array)) {\n      throw new Error(`${label} emitted a non-byte chunk`)\n    }\n    if (chunk.byteLength > maxBytes - totalBytes) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)\n    chunks.push(bytes)\n    totalBytes += bytes.byteLength\n  }\n  return Buffer.concat(chunks, totalBytes)\n}\n\nasync function streamEqualsBytes(\n  stream: AsyncIterable<unknown>,\n  expected: Uint8Array,\n  maxBytes: number,\n  label: string,\n): Promise<boolean> {\n  const expectedBuffer = Buffer.from(expected.buffer, expected.byteOffset, expected.byteLength)\n  let equal = true\n  let offset = 0\n  for await (const chunk of stream) {\n    if (!(chunk instanceof Uint8Array)) {\n      throw new Error(`${label} emitted a non-byte chunk`)\n    }\n    if (chunk.byteLength > maxBytes - offset) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const observed = Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength)\n    if (\n      offset + observed.byteLength > expectedBuffer.byteLength ||\n      !observed.equals(expectedBuffer.subarray(offset, offset + observed.byteLength))\n    ) {\n      equal = false\n    }\n    offset += observed.byteLength\n  }\n  return equal && offset === expectedBuffer.byteLength\n}\n\nexport async function prepareEmptyDestination(destination: string): Promise<void> {\n  await mkdir(destination, { recursive: true, mode: 0o700 })\n  const stats = await lstat(destination)\n  if (!stats.isDirectory() || stats.isSymbolicLink()) {\n    throw new Error('candidate workspace destination must be a real directory')\n  }\n  // A symlinked PREFIX is the OS's own doing on macOS, where temp paths live under /var, a\n  // symlink to /private/var. What must hold is that the destination itself is a real\n  // directory, which both this check and the lstat above require.\n  const resolvedDestination = await realpath(destination)\n  const resolvedStats = await lstat(resolvedDestination)\n  if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) {\n    throw new Error('candidate workspace destination must resolve to a real directory')\n  }\n  if ((await readdir(destination)).length > 0) {\n    throw new Error('candidate workspace destination must be empty')\n  }\n}\n\nasync function writeWorkspaceFiles(\n  destination: string,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n): Promise<void> {\n  for (const file of files) {\n    const path = workspacePath(destination, file.path)\n    await mkdir(dirname(path), { recursive: true, mode: 0o700 })\n    const descriptor = await open(\n      path,\n      fsConstants.O_WRONLY |\n        fsConstants.O_CREAT |\n        fsConstants.O_EXCL |\n        (typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0),\n      0o600,\n    )\n    try {\n      await descriptor.writeFile(file.bytes)\n      const stats = await descriptor.stat()\n      if (!stats.isFile() || stats.nlink !== 1) {\n        throw new Error(`candidate workspace file identity changed while writing: ${file.path}`)\n      }\n      await descriptor.chmod(file.mode)\n    } finally {\n      await descriptor.close()\n    }\n  }\n}\n\nasync function materializeRepository(\n  repository: WorkspaceArchiveRepository,\n  destination: string,\n): Promise<void> {\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    await writeFile(bundlePath, repository.bundle.bytes, { flag: 'wx', mode: 0o600 })\n    await runCandidateGit(destination, [\n      'init',\n      '--quiet',\n      '--initial-branch=candidate',\n      `--object-format=${repository.headCommit.length === 64 ? 'sha256' : 'sha1'}`,\n    ])\n    await runCandidateGit(destination, ['bundle', 'verify', bundlePath])\n    await runCandidateGit(destination, ['bundle', 'unbundle', bundlePath])\n    const objectType = (\n      await runCandidateGit(destination, ['cat-file', '-t', repository.headCommit])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (objectType !== 'commit') throw new Error('candidate repository HEAD is not a commit')\n    const observedTree = (\n      await runCandidateGit(destination, ['rev-parse', `${repository.headCommit}^{tree}`])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (observedTree !== repository.headTree) {\n      throw new Error('candidate repository bundle HEAD tree changed')\n    }\n    await runCandidateGit(destination, ['update-ref', '--no-deref', 'HEAD', repository.headCommit])\n    await runCandidateGit(destination, ['read-tree', repository.headTree])\n    const status = (\n      await runCandidateGit(destination, ['status', '--porcelain=v1', '--untracked-files=all'])\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (status) throw new Error('candidate repository files do not exactly match HEAD')\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nfunction assertArchiveMatchesSnapshot(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n): void {\n  const material = candidateWorkspaceManifest(files)\n  const materialBytes = canonicalCandidateBytes(material)\n  verifyBytes(\n    materialBytes,\n    snapshot.manifest.sha256,\n    snapshot.manifest.byteLength,\n    'candidate workspace manifest',\n  )\n  if (\n    canonicalCandidateDigest(material) !== snapshot.digest ||\n    !Buffer.from(materialBytes).equals(Buffer.from(canonicalCandidateBytes(snapshot.material)))\n  ) {\n    throw new Error('candidate workspace archive does not match its snapshot manifest')\n  }\n}\n\nfunction assertWorkspaceFilesWithinLimits(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (files.length > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  let previousPath: string | undefined\n  const observedPaths = new Set<string>()\n  for (const file of files) {\n    const path = safeArchivePath(file.path, limits.maxPathBytes)\n    assertWorkspacePathOrder(\n      path,\n      previousPath,\n      observedPaths,\n      'candidate workspace paths must be unique and sorted',\n    )\n    previousPath = path\n    if (!isWorkspaceFileMode(file.mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    if (file.bytes.byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    totalBytes += file.bytes.byteLength\n    if (totalBytes > limits.maxTotalFileBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n  }\n}\n\nfunction normalizeWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): AgentCandidateExecutorWorkspaceFile[] {\n  if (!Array.isArray(input)) {\n    throw new Error('candidate workspace files must be an array')\n  }\n  const fileCount = input.length\n  if (fileCount > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  const files: AgentCandidateExecutorWorkspaceFile[] = []\n  for (let index = 0; index < fileCount; index++) {\n    const inputFile = input[index]\n    if (!isRecord(inputFile) || Object.keys(inputFile).sort().join(',') !== 'bytes,mode,path') {\n      throw new Error(`candidate workspace file ${index} is invalid`)\n    }\n    const descriptors = Object.getOwnPropertyDescriptors(inputFile)\n    if (\n      !('value' in (descriptors.path ?? {})) ||\n      !('value' in (descriptors.mode ?? {})) ||\n      !('value' in (descriptors.bytes ?? {}))\n    ) {\n      throw new Error(`candidate workspace file ${index} must use fixed values`)\n    }\n    const path = safeArchivePath(descriptors.path?.value, limits.maxPathBytes)\n    const mode = descriptors.mode?.value\n    const inputBytes = descriptors.bytes?.value\n    if (!isWorkspaceFileMode(mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    const view = inspectWorkspaceBytes(inputBytes, path)\n    if (view.byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    if (view.byteLength > limits.maxTotalFileBytes - totalBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n    if (view.byteLength > Math.max(0, limits.maxArchiveBytes - 1024)) {\n      throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n    }\n    totalBytes += view.byteLength\n    files.push({ path, mode, bytes: detachWorkspaceBytes(view) })\n  }\n  files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))\n  assertWorkspaceFilesWithinLimits(files, limits)\n  return files\n}\n\nfunction isWorkspaceFileMode(value: unknown): value is number {\n  return Number.isSafeInteger(value) && (value as number) >= 0 && (value as number) <= 0o777\n}\n\nexport function workspaceLimits(\n  overrides: Partial<AgentCandidateWorkspaceArchiveLimits> | undefined,\n): AgentCandidateWorkspaceArchiveLimits {\n  const limits = { ...defaultLimits, ...overrides }\n  for (const [name, value] of Object.entries(limits)) {\n    if (!Number.isSafeInteger(value) || value <= 0) {\n      throw new Error(`candidate workspace ${name} must be a positive safe integer`)\n    }\n  }\n  return Object.freeze(limits)\n}\n\nexport function safeArchivePath(value: unknown, maxPathBytes: number): string {\n  if (\n    typeof value !== 'string' ||\n    !value ||\n    !isWellFormedUnicode(value) ||\n    Buffer.byteLength(value, 'utf8') > maxPathBytes ||\n    isAbsolute(value) ||\n    win32.isAbsolute(value) ||\n    value.includes('\\\\') ||\n    value.includes('\\0') ||\n    hasControlCharacter(value) ||\n    value.split('/').some((part) => !part || part === '.' || part === '..') ||\n    ['.git', '.sidecar'].includes(value.split('/')[0]?.toLowerCase() ?? '')\n  ) {\n    throw new Error(`candidate workspace archive contains an unsafe path: ${String(value)}`)\n  }\n  return value\n}\n\nexport function assertWorkspacePathOrder(\n  path: string,\n  previousPath: string | undefined,\n  observedPaths: Set<string>,\n  errorMessage: string,\n): void {\n  if (previousPath !== undefined && previousPath >= path) throw new Error(errorMessage)\n  for (let slash = path.indexOf('/'); slash !== -1; slash = path.indexOf('/', slash + 1)) {\n    if (observedPaths.has(path.slice(0, slash))) throw new Error(errorMessage)\n  }\n  observedPaths.add(path)\n}\n\nfunction inspectWorkspaceBytes(\n  input: unknown,\n  path: string,\n): { buffer: ArrayBuffer; byteOffset: number; byteLength: number } {\n  let buffer: ArrayBufferLike\n  let byteOffset: number\n  let byteLength: number\n  try {\n    buffer = typedArrayBufferGetter.call(input as Uint8Array) as ArrayBufferLike\n    byteOffset = typedArrayByteOffsetGetter.call(input as Uint8Array) as number\n    byteLength = typedArrayByteLengthGetter.call(input as Uint8Array) as number\n  } catch {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  if (isSharedArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file uses shared bytes: ${path}`)\n  }\n  if (!isAnyArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  return { buffer, byteOffset, byteLength }\n}\n\nfunction detachWorkspaceBytes(input: {\n  buffer: ArrayBuffer\n  byteOffset: number\n  byteLength: number\n}): Uint8Array {\n  const { buffer, byteOffset, byteLength } = input\n  const copy = new Uint8Array(byteLength)\n  Uint8Array.prototype.set.call(copy, new Uint8Array(buffer, byteOffset, byteLength))\n  return copy\n}\n\nexport function workspacePath(root: string, relativePath: string): string {\n  const path = resolve(root, relativePath)\n  if (!path.startsWith(`${root}${sep}`)) {\n    throw new Error(`candidate workspace archive path escapes its destination: ${relativePath}`)\n  }\n  return path\n}\n\nfunction assertGitObjectId(value: string, label: string): void {\n  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value)) {\n    throw new Error(`candidate repository ${label} is not a Git object id`)\n  }\n}\n\nfunction hasControlCharacter(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code < 0x20 || code === 0x7f) return true\n  }\n  return false\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\ntype TypedArrayGetter = (this: Uint8Array) => unknown\n\nfunction requireTypedArrayGetter(name: 'buffer' | 'byteOffset' | 'byteLength'): TypedArrayGetter {\n  const typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype) as object\n  const getter = Object.getOwnPropertyDescriptor(typedArrayPrototype, name)?.get\n  if (!getter) throw new Error(`typed array intrinsic ${name} accessor is unavailable`)\n  return getter\n}\n\nconst typedArrayBufferGetter = requireTypedArrayGetter('buffer')\nconst typedArrayByteOffsetGetter = requireTypedArrayGetter('byteOffset')\nconst typedArrayByteLengthGetter = requireTypedArrayGetter('byteLength')\n\n/** Shared canonical header for both archive encoders. */\nexport function workspaceTarHeader(name: string, mode: number, size: number) {\n  return {\n    name,\n    mode,\n    uid: 0,\n    gid: 0,\n    size,\n    mtime: fixedTarTime,\n    type: 'file' as const,\n    uname: '',\n    gname: '',\n  }\n}\n","import { createHash } from 'node:crypto'\nimport {\n  type AgentCandidateArtifactRef,\n  type AgentCandidateCapturedArtifact,\n  agentCandidateArtifactRefSchema,\n} from '@tangle-network/agent-interface'\nimport { immutableCandidateValue } from './digest'\nimport type {\n  AgentCandidateArtifactPort,\n  AgentCandidateOutputArtifactPort,\n  AgentCandidateOutputPurpose,\n} from './types'\n\n/** Verify the complete stream, including its final digest, before accepting its consumer's result. */\nexport async function* verifiedArtifactChunks(\n  artifact: AgentCandidateCapturedArtifact,\n  port: AgentCandidateArtifactPort,\n  signal?: AbortSignal,\n): AsyncGenerator<Uint8Array> {\n  signal?.throwIfAborted()\n  if (!('content' in artifact) && !port.readStream) {\n    throw new Error('streaming workspace artifacts require readStream')\n  }\n  const chunks =\n    'content' in artifact\n      ? [Buffer.from(artifact.content, 'base64')]\n      : port.readStream!(artifact, { signal })\n  const hash = createHash('sha256')\n  let byteLength = 0\n  for await (const chunk of chunks) {\n    signal?.throwIfAborted()\n    if (!(chunk instanceof Uint8Array))\n      throw new Error('candidate artifact emitted a non-byte chunk')\n    byteLength += chunk.byteLength\n    if (byteLength > artifact.byteLength)\n      throw new Error('candidate artifact exceeds its declared length')\n    hash.update(chunk)\n    yield chunk\n  }\n  signal?.throwIfAborted()\n  if (byteLength !== artifact.byteLength || `sha256:${hash.digest('hex')}` !== artifact.sha256) {\n    throw new Error('candidate artifact failed digest or length verification')\n  }\n}\n\n/** Stream evaluator evidence into its existing store and verify durable readback before returning. */\nexport async function persistCandidateOutputArtifactStream(\n  port: AgentCandidateOutputArtifactPort,\n  input: {\n    executionId: string\n    purpose: AgentCandidateOutputPurpose\n    chunks: AsyncIterable<Uint8Array>\n    maxBytes: number\n    signal?: AbortSignal\n  },\n): Promise<AgentCandidateArtifactRef> {\n  if (!port.putStream || !port.readStream) {\n    throw new Error('streaming workspace persistence requires putStream and readStream')\n  }\n  input.signal?.throwIfAborted()\n  const hash = createHash('sha256')\n  let byteLength = 0\n  let consumed = false\n  async function* checked(): AsyncGenerator<Uint8Array> {\n    for await (const chunk of input.chunks) {\n      input.signal?.throwIfAborted()\n      if (!(chunk instanceof Uint8Array))\n        throw new Error('candidate artifact emitted a non-byte chunk')\n      byteLength += chunk.byteLength\n      if (byteLength > input.maxBytes)\n        throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n      hash.update(chunk)\n      yield chunk\n    }\n    consumed = true\n    input.signal?.throwIfAborted()\n  }\n  const chunks = checked()\n  try {\n    const ref = agentCandidateArtifactRefSchema.parse(\n      await port.putStream({\n        executionId: input.executionId,\n        purpose: input.purpose,\n        chunks,\n        ...(input.signal ? { signal: input.signal } : {}),\n      }),\n    )\n    input.signal?.throwIfAborted()\n    if (\n      !consumed ||\n      ref.sha256 !== `sha256:${hash.digest('hex')}` ||\n      ref.byteLength !== byteLength\n    ) {\n      throw new Error('candidate output locator does not identify the submitted bytes')\n    }\n    for await (const _chunk of verifiedArtifactChunks(ref, port, input.signal)) {\n      // Verification consumes the durable object without retaining it.\n    }\n    return immutableCandidateValue(ref)\n  } finally {\n    await chunks.return(undefined)\n  }\n}\n","import { createHash } from 'node:crypto'\nimport { constants } from 'node:fs'\nimport { mkdir, mkdtemp, open, realpath, rename, rm } from 'node:fs/promises'\nimport { dirname, resolve } from 'node:path'\nimport { Readable } from 'node:stream'\nimport { pipeline } from 'node:stream/promises'\nimport type {\n  AgentCandidateWorkspaceManifestMaterial,\n  AgentCandidateWorkspaceSnapshotEvidence,\n} from '@tangle-network/agent-interface'\nimport { extract, type Pack, pack } from 'tar-stream'\nimport { persistCandidateOutputArtifactStream, verifiedArtifactChunks } from './artifact-streams'\nimport { scanMaterializedWorkspaceManifest, verifyBytes } from './artifacts'\nimport { canonicalCandidateBytes, canonicalCandidateDigest, deepFreezeCandidate } from './digest'\nimport type { AgentCandidateArtifactPort } from './types'\nimport {\n  type AgentCandidateWorkspaceArchiveLimits,\n  assertWorkspacePathOrder,\n  type CaptureAgentCandidateWorkspaceOptions,\n  prepareEmptyDestination,\n  safeArchivePath,\n  workspaceLimits,\n  workspacePath,\n  workspaceTarHeader,\n} from './workspace-archive'\n\ntype WorkspaceFile = AgentCandidateWorkspaceManifestMaterial['files'][number]\n\nexport interface CaptureAgentCandidateWorkspaceToArtifactsOptions {\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n  artifactPersistence: NonNullable<CaptureAgentCandidateWorkspaceOptions['artifactPersistence']>\n}\n\n/** Capture regular files to durable artifacts with memory bounded by the manifest and stream buffers. */\nexport async function captureAgentCandidateWorkspaceToArtifacts(\n  rootInput: string,\n  options: CaptureAgentCandidateWorkspaceToArtifactsOptions,\n): Promise<{ readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence }> {\n  const { outputArtifacts, executionId, signal } = options.artifactPersistence\n  if (!outputArtifacts.putStream || !outputArtifacts.readStream) {\n    throw new Error('streaming workspace persistence requires putStream and readStream')\n  }\n  if (!executionId.trim())\n    throw new Error('candidate workspace artifact persistence requires an executionId')\n  signal?.throwIfAborted()\n  const limits = workspaceLimits(options.limits)\n  const material = await scanMaterializedWorkspaceManifest(rootInput, { limits, signal })\n  validateManifest(material, limits)\n  const root = await realpath(resolve(rootInput))\n  const manifest = canonicalCandidateBytes(material)\n  const manifestArtifact = await persistCandidateOutputArtifactStream(outputArtifacts, {\n    executionId,\n    purpose: 'candidate-workspace-manifest',\n    chunks: oneChunk(manifest),\n    maxBytes: manifest.byteLength,\n    signal,\n  })\n  const archiveArtifact = await persistCandidateOutputArtifactStream(outputArtifacts, {\n    executionId,\n    purpose: 'candidate-workspace-archive',\n    chunks: workspaceArchiveChunks(root, material, signal),\n    maxBytes: limits.maxArchiveBytes,\n    signal,\n  })\n  return Object.freeze({\n    snapshot: deepFreezeCandidate({\n      kind: 'agent-candidate-workspace-snapshot' as const,\n      digest: canonicalCandidateDigest(material),\n      material,\n      manifest: manifestArtifact,\n      archive: archiveArtifact,\n    }),\n  })\n}\n\nexport interface AgentCandidateWorkspaceArtifactsOptions {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  artifacts: AgentCandidateArtifactPort\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n  signal?: AbortSignal\n}\n\n/** Verify durable regular-file workspace evidence without retaining archive or file contents. */\nexport async function verifyAgentCandidateWorkspaceArtifacts(\n  input: AgentCandidateWorkspaceArtifactsOptions,\n): Promise<void> {\n  await consumeWorkspaceArtifacts(input)\n}\n\n/** Restore regular-file artifacts into an empty destination, publishing only after complete verification. */\nexport async function materializeAgentCandidateWorkspaceFromArtifacts(\n  input: AgentCandidateWorkspaceArtifactsOptions & { destination: string },\n): Promise<void> {\n  input.signal?.throwIfAborted()\n  if (!input.artifacts.readStream)\n    throw new Error('streaming workspace artifacts require readStream')\n  const destination = resolve(input.destination)\n  await prepareEmptyDestination(destination)\n  const staging = await mkdtemp(`${destination}.materializing-`)\n  try {\n    await consumeWorkspaceArtifacts(input, staging)\n    input.signal?.throwIfAborted()\n    await rename(staging, destination)\n  } catch (error) {\n    await rm(staging, { recursive: true, force: true })\n    throw error\n  }\n}\n\nasync function consumeWorkspaceArtifacts(\n  input: AgentCandidateWorkspaceArtifactsOptions,\n  destination?: string,\n): Promise<void> {\n  const { artifacts, signal } = input\n  const snapshot = deepFreezeCandidate(structuredClone(input.snapshot))\n  signal?.throwIfAborted()\n  if (!artifacts.readStream) throw new Error('streaming workspace artifacts require readStream')\n  const limits = workspaceLimits(input.limits)\n  validateManifest(snapshot.material, limits)\n  if (snapshot.archive.byteLength > limits.maxArchiveBytes)\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n  const manifest = canonicalCandidateBytes(snapshot.material)\n  verifyBytes(\n    manifest,\n    snapshot.manifest.sha256,\n    snapshot.manifest.byteLength,\n    'candidate workspace manifest',\n  )\n  if (canonicalCandidateDigest(snapshot.material) !== snapshot.digest)\n    throw new Error('workspace snapshot digest does not match its canonical manifest material')\n  let offset = 0\n  for await (const chunk of verifiedArtifactChunks(snapshot.manifest, artifacts, signal)) {\n    if (\n      !Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength).equals(\n        manifest.subarray(offset, offset + chunk.byteLength),\n      )\n    ) {\n      throw new Error('workspace manifest artifact is not the exact canonical manifest material')\n    }\n    offset += chunk.byteLength\n  }\n\n  const parser = extract()\n  const canonical = pack()\n  const canonicalResult = digestChunks(canonical, limits.maxArchiveBytes, signal)\n  // Both drains start before writing, so tar-stream's backpressure bounds every queue.\n  const reading = pipeline(\n    Readable.from(verifiedArtifactChunks(snapshot.archive, artifacts, signal)),\n    parser as unknown as NodeJS.WritableStream,\n    { signal },\n  )\n  reading.catch(() => undefined)\n  canonicalResult.catch(() => undefined)\n  try {\n    let index = 0\n    for await (const entry of parser) {\n      signal?.throwIfAborted()\n      const expected = snapshot.material.files[index++]\n      if (\n        !expected ||\n        entry.header.type !== 'file' ||\n        entry.header.name !== `workspace/${expected.path}` ||\n        entry.header.mode !== expected.mode ||\n        entry.header.size !== expected.byteLength\n      ) {\n        throw new Error('candidate workspace archive does not match its snapshot manifest')\n      }\n      const file = destination ? await openDestination(destination, expected.path) : undefined\n      try {\n        async function* checked(): AsyncGenerator<Uint8Array> {\n          const hash = createHash('sha256')\n          let byteLength = 0\n          for await (const chunk of entry) {\n            if (!(chunk instanceof Uint8Array))\n              throw new Error('workspace entry emitted a non-byte chunk')\n            signal?.throwIfAborted()\n            byteLength += chunk.byteLength\n            if (byteLength > expected!.byteLength)\n              throw new Error('workspace entry exceeds its manifest length')\n            hash.update(chunk)\n            if (file) await file.writeFile(chunk)\n            yield chunk\n          }\n          if (\n            byteLength !== expected!.byteLength ||\n            `sha256:${hash.digest('hex')}` !== expected!.sha256\n          ) {\n            throw new Error('candidate workspace archive does not match its snapshot manifest')\n          }\n        }\n        await appendTarFile(canonical, expected, checked(), signal)\n        if (file) await file.chmod(expected.mode)\n      } finally {\n        await file?.close()\n      }\n    }\n    if (index !== snapshot.material.files.length)\n      throw new Error('candidate workspace archive does not match its snapshot manifest')\n    await reading\n    canonical.finalize()\n    const observed = await canonicalResult\n    if (\n      observed.byteLength !== snapshot.archive.byteLength ||\n      observed.sha256 !== snapshot.archive.sha256\n    ) {\n      throw new Error('candidate workspace tar is not canonical')\n    }\n  } catch (error) {\n    parser.destroy(asError(error))\n    canonical.destroy(asError(error))\n    await Promise.allSettled([reading, canonicalResult])\n    throw error\n  }\n}\n\nasync function openDestination(destination: string, relativePath: string) {\n  const path = workspacePath(destination, relativePath)\n  await mkdir(dirname(path), { recursive: true, mode: 0o700 })\n  return open(\n    path,\n    constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,\n    0o600,\n  )\n}\n\nasync function* workspaceArchiveChunks(\n  root: string,\n  material: AgentCandidateWorkspaceManifestMaterial,\n  signal?: AbortSignal,\n): AsyncGenerator<Uint8Array> {\n  const archive = pack()\n  const writing = (async () => {\n    try {\n      for (const file of material.files) {\n        signal?.throwIfAborted()\n        await appendTarFile(archive, file, workspaceFileChunks(root, file, signal), signal)\n      }\n      archive.finalize()\n    } catch (error) {\n      archive.destroy(asError(error))\n      throw error\n    }\n  })()\n  writing.catch(() => undefined)\n  try {\n    for await (const chunk of archive) {\n      if (!(chunk instanceof Uint8Array))\n        throw new Error('workspace archive emitted a non-byte chunk')\n      signal?.throwIfAborted()\n      yield chunk\n    }\n    await writing\n  } finally {\n    archive.destroy()\n    await writing.catch(() => undefined)\n  }\n}\n\nasync function* workspaceFileChunks(\n  root: string,\n  expected: WorkspaceFile,\n  signal?: AbortSignal,\n): AsyncGenerator<Uint8Array> {\n  const path = workspacePath(root, expected.path)\n  if ((await realpath(path)) !== path)\n    throw new Error(`workspace file path changed during capture: ${expected.path}`)\n  const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW)\n  try {\n    const stats = await file.stat()\n    if (\n      !stats.isFile() ||\n      stats.nlink !== 1 ||\n      stats.size !== expected.byteLength ||\n      (stats.mode & 0o777) !== expected.mode\n    ) {\n      throw new Error(`workspace file changed during capture: ${expected.path}`)\n    }\n    const hash = createHash('sha256')\n    let byteLength = 0\n    for await (const chunk of file.createReadStream({\n      autoClose: false,\n      highWaterMark: 64 * 1024,\n    })) {\n      signal?.throwIfAborted()\n      byteLength += chunk.byteLength\n      if (byteLength > expected.byteLength)\n        throw new Error(`workspace file changed during capture: ${expected.path}`)\n      hash.update(chunk)\n      yield chunk\n    }\n    if (byteLength !== expected.byteLength || `sha256:${hash.digest('hex')}` !== expected.sha256) {\n      throw new Error(`workspace file changed during capture: ${expected.path}`)\n    }\n  } finally {\n    await file.close()\n  }\n}\n\nasync function appendTarFile(\n  archive: Pack,\n  file: WorkspaceFile,\n  chunks: AsyncIterable<Uint8Array>,\n  signal?: AbortSignal,\n): Promise<void> {\n  const entry = archive.entry(\n    workspaceTarHeader(`workspace/${file.path}`, file.mode, file.byteLength),\n  )\n  await pipeline(Readable.from(chunks), entry as unknown as NodeJS.WritableStream, { signal })\n}\n\nasync function digestChunks(\n  chunks: AsyncIterable<unknown>,\n  maxBytes: number,\n  signal?: AbortSignal,\n) {\n  const hash = createHash('sha256')\n  let byteLength = 0\n  for await (const chunk of chunks) {\n    if (!(chunk instanceof Uint8Array))\n      throw new Error('workspace archive emitted a non-byte chunk')\n    signal?.throwIfAborted()\n    byteLength += chunk.byteLength\n    if (byteLength > maxBytes)\n      throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n    hash.update(chunk)\n  }\n  return { sha256: `sha256:${hash.digest('hex')}`, byteLength }\n}\n\nfunction validateManifest(\n  material: AgentCandidateWorkspaceManifestMaterial,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (\n    material.kind !== 'agent-candidate-workspace-manifest' ||\n    material.files.length > limits.maxFiles\n  )\n    throw new Error('candidate workspace exceeds maxFiles')\n  let total = 0\n  let previous: string | undefined\n  const paths = new Set<string>()\n  for (const file of material.files) {\n    safeArchivePath(file.path, limits.maxPathBytes)\n    assertWorkspacePathOrder(\n      file.path,\n      previous,\n      paths,\n      'candidate workspace paths must be unique and sorted',\n    )\n    previous = file.path\n    if (!Number.isSafeInteger(file.mode) || file.mode < 0 || file.mode > 0o777)\n      throw new Error('candidate workspace file has unsupported mode')\n    if (\n      !Number.isSafeInteger(file.byteLength) ||\n      file.byteLength < 0 ||\n      file.byteLength > limits.maxFileBytes\n    )\n      throw new Error('candidate workspace file exceeds maxFileBytes')\n    total += file.byteLength\n    if (total > limits.maxTotalFileBytes)\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n  }\n}\n\nasync function* oneChunk(bytes: Uint8Array): AsyncGenerator<Uint8Array> {\n  yield bytes\n}\nfunction asError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error))\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAgBA,cAAY,OAAiC;CAC3D,OAAO,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAClE;AAEA,SAAgBC,2BAAyB,OAA8B;CACrE,OAAOD,cAAYE,0BAAwB,KAAK,CAAC;AACnD;;AAGA,SAAgB,wBAA2B,OAAa;CACtD,OAAO,oBACL,KAAK,MAAM,OAAO,KAAKA,0BAAwB,KAAK,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,CACzE;AACF;AAEA,SAAgB,2BACd,oBAC+B;CAC/B,MAAM,QAAQA,0BAAwB,kBAAkB;CACxD,MAAM,SAASF,cAAY,KAAK;CAChC,MAAM,QAAQ,oBAAoB;EAChC,GAAG,KAAK,MAAM,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC;EACjD;CACF,CAAC;CACD,OAAO,OAAO,OAAO;EACnB;EACA,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,KAAK;EAC9B;EACA;CACF,CAAC;AACH;AAEA,SAAgB,iCACd,OACA,OACG;CACH,IAAIC,2BAAyB,mBAAmB,KAAK,CAAC,MAAM,MAAM,QAChE,MAAM,IAAI,MAAM,GAAG,MAAM,uBAAuB;CAElD,OAAO,wBAAwB,KAAK;AACtC;AAEA,SAAgB,0BAA0B,OAAmD;CAC3F,OAAO;EACL,UAAU;EACV,SAAS,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;EAC7C,QAAQD,cAAY,KAAK;EACzB,YAAY,MAAM;CACpB;AACF;AAEA,SAAgB,mBACd,OACmB;CACnB,MAAM,EAAE,QAAQ,SAAS,GAAG,SAAS;CACrC,OAAO;AACT;AAEA,SAAgB,oBAAuB,OAAU,uBAAO,IAAI,IAAY,GAAM;CAC5E,IACE,UAAU,QACV,OAAO,UAAU,YACjB,YAAY,OAAO,KAAK,KACxB,KAAK,IAAI,KAAe,GAExB,OAAO;CAET,KAAK,IAAI,KAAe;CACxB,KAAK,MAAM,SAAS,OAAO,OAAO,KAAgC,GAChE,oBAAoB,OAAO,IAAI;CAEjC,OAAO,OAAO,OAAO,KAAK;AAC5B;;;ACpEA,SAAgB,iBAAiB,UAAkD;CACjF,OAAO,GAAG,SAAS,OAAO,GAAG,SAAS;AACxC;AAEA,eAAsB,qBACpB,UACA,MACqB;CACrB,MAAM,QACJ,aAAa,WACT,OAAO,KAAK,SAAS,SAAS,QAAQ,IACtC,MAAM,KAAK,KAAK,QAAqC;CAC3D,YAAY,OAAO,SAAS,QAAQ,SAAS,YAAY,oBAAoB;CAC7E,OAAO,WAAW,KAAK,KAAK;AAC9B;AAEA,SAAgB,YACd,OACA,QACA,YACA,OACM;CACN,IAAI,MAAM,eAAe,YACvB,MAAM,IAAI,MAAM,GAAG,MAAM,eAAe,MAAM,WAAW,kBAAkB,YAAY;CAEzF,MAAM,SAASG,cAAY,KAAK;CAChC,IAAI,WAAW,QACb,MAAM,IAAI,MAAM,GAAG,MAAM,UAAU,OAAO,kBAAkB,QAAQ;AAExE;AAEA,eAAsB,iCACpB,UACA,MACwD;CACxD,MAAM,CAAC,UAAU,WAAW,MAAM,QAAQ,IAAI,CAC5C,qBAAqB,SAAS,UAAU,IAAI,GAC5C,qBAAqB,SAAS,SAAS,IAAI,CAC7C,CAAC;CACD,MAAM,oBAAoBC,0BAAwB,SAAS,QAAQ;CACnE,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,iBAAiB,CAAC,GAC9D,MAAM,IAAI,MAAM,0EAA0E;CAE5F,IAAID,cAAY,iBAAiB,MAAM,SAAS,QAC9C,MAAM,IAAI,MAAM,0EAA0E;CAE5F,OAAO;EAAE;EAAU;CAAQ;AAC7B;;AAUA,IAAa,0BAAb,cAA6C,MAAM,CAAC;;;;;;;;AA2BpD,eAAsB,4BACpB,MACA,UACA,UAAgD,CAAC,GAClC;CACf,wBAAwB,MAAM,kCAAkC,MAAM,OAAO,GAAG,QAAQ;AAC1F;;;;;;;;;;AAWA,eAAsB,kCACpB,MACA,UAAgC,CAAC,GACiB;CAClD,OAAO,6BAA6B,MAAM,cAAc,MAAM,SAAS,KAAK,CAAC;AAC/E;AAEA,eAAsB,6BACpB,MACA,UAAgC,CAAC,GAIhC;CACD,MAAM,UAAU,MAAM,cAAc,MAAM,SAAS,IAAI;CACvD,OAAO;EACL,UAAU,6BAA6B,OAAO;EAC9C,OAAO,QAAQ,KAAK,WAAW;GAC7B,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,OAAO,WAAW,KAAK,cAAc,KAAK,CAAC;EAC7C,EAAE;CACJ;AACF;;AAGA,eAAsB,+BACpB,MACA,UACA,UAAgC,CAAC,GAC0C;CAC3E,MAAM,WAAW,MAAM,6BAA6B,MAAM,OAAO;CACjE,wBAAwB,SAAS,UAAU,QAAQ;CACnD,OAAO,SAAS,MAAM,KAAK,SACzB,OAAO,OAAO;EAAE,MAAM,KAAK;EAAM,MAAM,KAAK;EAAM,OAAO,WAAW,KAAK,KAAK,KAAK;CAAE,CAAC,CACxF;AACF;;;;;;AAOA,SAAgB,2BACd,OACA,UAAsC,CAAC,GACE;CACzC,OAAO,6BACL,MAAM,KAAK,UAAU;EACnB,MAAM,KAAK;EACX,MAAM,QAAQ,iBAAiB,OAAO,iBAAiB,KAAK,IAAI,IAAI,KAAK;EACzE,QAAQA,cAAY,KAAK,KAAK;EAC9B,YAAY,KAAK,MAAM;CACzB,EAAE,CACJ;AACF;AAEA,SAAS,6BACP,SAMyC;CACzC,OAAO;EACL,MAAM;EACN,OAAO,QACJ,KAAK,WAAW;GACf,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,QAAQ,MAAM;GACd,YAAY,MAAM;EACpB,EAAE,CAAC,CACF,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAAE;CACpE;AACF;;AAGA,SAAS,iBAAiB,MAAsB;CAC9C,QAAQ,OAAO,QAAW,IAAI,MAAQ;AACxC;AAEA,SAAS,cAAc,OAAsC;CAC3D,IAAI,CAAC,MAAM,OAAO,MAAM,IAAI,MAAM,kDAAkD,MAAM,MAAM;CAChG,OAAO,MAAM;AACf;AAEA,SAAS,wBACP,UACA,UACM;CACN,IAAI,OAAO,KAAKC,0BAAwB,QAAQ,CAAC,CAAC,CAAC,OAAOA,0BAAwB,QAAQ,CAAC,GACzF;CAMF,IACE,OAAO,KAAKA,0BAAwB,kBAAkB,QAAQ,CAAC,CAAC,CAAC,CAAC,OAChEA,0BAAwB,kBAAkB,QAAQ,CAAC,CACrD,GAEA,MAAM,IAAI,MACR,uJAEF;CAEF,MAAM,IAAI,MAAM,gFAAgF;AAClG;AAEA,SAAS,kBACP,UACyC;CACzC,OAAO;EACL,GAAG;EACH,OAAO,SAAS,MAAM,KAAK,UAAU;GAAE,GAAG;GAAM,MAAM,iBAAiB,KAAK,IAAI;EAAE,EAAE;CACtF;AACF;AAEA,eAAsB,mCACpB,MACA,UACA,WAAkC,aACnB;CAEf,MAAM,mBAAkB,MADD,kCAAkC,IAAI,EAAA,CAC5B,MAAM,KAAK,EAAE,MAAM,MAAM,cAAc;EACtE,SAAS;EACT;EACA,eAAe;CACjB,EAAE;CACF,MAAM,gBAAgB,SAAS,MAC5B,QAAQ,UAAU,KAAK,QAAQ,iBAAiB,QAAQ,CAAC,CACzD,KAAK,EAAE,MAAM,OAAO,GAAG,WAAW,IAAI;CACzC,IACE,CAAC,OAAO,KAAKA,0BAAwB,eAAe,CAAC,CAAC,CAAC,OACrDA,0BAAwB,aAAa,CACvC,GAEA,MAAM,IAAI,MACR,WAAW,SAAS,qEACtB;AAEJ;AAWA,eAAe,cACb,MACA,SACA,WACkC;CAClC,MAAM,8BAA8B,IAAI,IAAY,QAAQ,+BAA+B,CAAC,CAAC;CAC7F,MAAM,SAAS,QAAQ;CAMvB,MAAM,gBAAgB,QAAQ,IAAI;CAClC,MAAM,YAAY,MAAM,MAAM,aAAa;CAC3C,IAAI,CAAC,UAAU,YAAY,KAAK,UAAU,eAAe,GACvD,MAAM,IAAI,MAAM,yCAAyC;CAE3D,MAAM,eAAe,MAAM,SAAS,aAAa;CACjD,MAAM,gBAAgB,MAAM,MAAM,YAAY;CAC9C,IAAI,CAAC,cAAc,YAAY,KAAK,cAAc,eAAe,GAC/D,MAAM,IAAI,MAAM,iDAAiD;CAEnE,MAAM,UAAmC,CAAC;CAC1C,IAAI,aAAa;CAEjB,eAAe,MAAM,WAAkC;EACrD,QAAQ,QAAQ,eAAe;EAC/B,MAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC;EAChE,QAAQ,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAAE;EACvE,KAAK,MAAM,SAAS,SAAS;GAC3B,QAAQ,QAAQ,eAAe;GAC/B,IAAI,cAAc,gBAAgB,4BAA4B,IAAI,MAAM,IAAI,GAC1E;GAEF,MAAM,WAAW,QAAQ,WAAW,MAAM,IAAI;GAC9C,MAAM,UAAU,SAAS,cAAc,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG;GACpE,IAAI,CAAC,WAAW,QAAQ,WAAW,KAAK,KAAK,QAAQ,SAAS,MAAM,GAClE,MAAM,IAAI,MAAM,iCAAiC,SAAS;GAE5D,MAAM,QAAQ,MAAM,MAAM,QAAQ;GAClC,IAAI,MAAM,eAAe,GACvB,MAAM,IAAI,MAAM,MAAM,eAAe,UAAU,SAAS,YAAY,CAAC;GAEvE,IAAI,MAAM,YAAY,GAAG;IACvB,MAAM,MAAM,QAAQ;IACpB;GACF;GACA,IAAI,CAAC,MAAM,OAAO,GAChB,MAAM,IAAI,MAAM,2CAA2C,SAAS;GAEtE,IAAI,UAAU,QAAQ,UAAU,OAAO,UACrC,MAAM,IAAI,wBAAwB,4BAA4B;GAEhE,MAAM,aAAa,MAAM,KACvB,UACAC,UAAY,YACT,OAAOA,UAAY,eAAe,WAAWA,UAAY,aAAa,EAC3E;GACA,IAAI;IACF,MAAM,cAAc,MAAM,WAAW,KAAK;IAC1C,IAAI,CAAC,YAAY,OAAO,GACtB,MAAM,IAAI,MAAM,2CAA2C,SAAS;IAEtE,IAAI,YAAY,UAAU,GACxB,MAAM,IAAI,MAAM,0CAA0C,SAAS;IAErE,MAAM,OACJ,QAAQ,iBAAiB,OACrB,iBAAiB,YAAY,IAAI,IACjC,YAAY,OAAO;IACzB,IAAI,UAAU,YAAY,OAAO,OAAO,cACtC,MAAM,IAAI,wBAAwB,wCAAwC,SAAS;IAErF,MAAM,iBAAiB,SAAS,OAAO,oBAAoB,aAAa,KAAA;IACxE,IAAI,mBAAmB,KAAA,KAAa,YAAY,OAAO,gBACrD,MAAM,IAAI,wBAAwB,qCAAqC;IAEzE,MAAM,OAAO,MAAM,kBACjB,YACA,SAAS,KAAK,IAAI,OAAO,cAAc,kBAAkB,OAAO,YAAY,IAAI,KAAA,GAChF,WACA,SACA,QAAQ,MACV;IACA,cAAc,KAAK;IACnB,QAAQ,KAAK;KACX,MAAM;KACN;KACA,QAAQ,KAAK;KACb,YAAY,KAAK;KACjB,GAAI,KAAK,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM;IAC1D,CAAC;GACH,UAAU;IACR,MAAM,WAAW,MAAM;GACzB;EACF;CACF;CAEA,MAAM,MAAM,YAAY;CACxB,OAAO;AACT;;;;;;;;;;AAWA,eAAe,eACb,UACA,SACA,cACiB;CACjB,MAAM,SAAS,MAAM,SAAS,QAAQ;CACtC,IAAI,WAAW,MAAM,GACnB,OAAO,2CAA2C,QAAQ,MAAM;CAElE,IAAI,CAAC,SAAS,cAAc,QAAQ,QAAQ,QAAQ,GAAG,MAAM,CAAC,GAC5D,OAAO,uDAAuD,QAAQ,MAAM;CAE9E,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,SAAS,QAAQ;CACpC,QAAQ;EACN,OAAO,6CAA6C,QAAQ,MAAM;CACpE;CACA,IAAI,CAAC,SAAS,cAAc,QAAQ,GAClC,OAAO,gEAAgE,QAAQ,MAAM;CAEvF,OAAO,iCAAiC,QAAQ,MAAM;AACxD;AAEA,SAAS,SAAS,MAAc,MAAuB;CACrD,OAAO,SAAS,QAAQ,KAAK,WAAW,GAAG,OAAO,KAAK;AACzD;;;;;;;;;;AAWA,eAAe,kBACb,YACA,UACA,WACA,MACA,QACuE;CACvE,MAAM,OAAO,WAAW,QAAQ;CAChC,MAAM,SAAS,OAAO,YAAY,OAAO,IAAI;CAC7C,MAAM,SAAmB,CAAC;CAC1B,IAAI,QAAQ;CACZ,OAAO,MAAM;EACX,QAAQ,eAAe;EACvB,MAAM,EAAE,cAAc,MAAM,WAAW,KAAK,QAAQ,GAAG,OAAO,YAAY,IAAI;EAC9E,IAAI,cAAc,GAAG;EACrB,SAAS;EACT,IAAI,aAAa,KAAA,KAAa,QAAQ,UACpC,MAAM,IAAI,wBAAwB,6CAA6C,MAAM;EAEvF,MAAM,QAAQ,OAAO,SAAS,GAAG,SAAS;EAC1C,KAAK,OAAO,KAAK;EAEjB,IAAI,WAAW,OAAO,KAAK,OAAO,KAAK,KAAK,CAAC;CAC/C;CACA,MAAM,SAAS,UAAU,KAAK,OAAO,KAAK;CAC1C,OAAO,YACH;EAAE;EAAQ,YAAY;EAAO,OAAO,OAAO,OAAO,QAAQ,KAAK;CAAE,IACjE;EAAE;EAAQ,YAAY;CAAM;AAClC;;;;AChcA,SAAgB,sBACd,OACA,UACA,OACA,WAA8B,CAAC,GACzB;CACN,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CAE9C,MAAM,0BAAU,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,QAAQ,CAAC;CAClD,IAAI,QAAQ,SAAS,SAAS,SAAS,SAAS,QAC9C,MAAM,IAAI,MAAM,GAAG,MAAM,8CAA8C;CAEzE,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GACjC,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B,KAAK;CAEjF,KAAK,MAAM,OAAO,UAChB,IAAI,EAAE,OAAO,QAAQ,MAAM,IAAI,MAAM,GAAG,MAAM,oBAAoB,KAAK;AAE3E;;;;;;AAOA,SAAgB,oBAAoB,OAAwB;CAC1D,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,QAAQ,SAAU,QAAQ,OAAQ;GACpC,MAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;GACvC,IAAI,EAAE,QAAQ,SAAU,QAAQ,QAAS,OAAO;GAChD;EACF,OAAO,IAAI,QAAQ,SAAU,QAAQ,OACnC,OAAO;CAEX;CACA,OAAO;AACT;;;AClBA,eAAsB,oBACpB,MACA,cACA,YAC6B;CAC7B,IAAI,KAAK,SAAS,YAAY,OAAO,KAAA;CACrC,MAAM,iBAAiB,MAAM,uBAAuB,KAAK,YAAY,YAAY;CACjF,MAAM,wBAAwB,gBAAgB,KAAK,YAAY,KAAK,QAAQ;CAE5E,IAAI,KAAK,SAAS,SAAS;EACzB,MAAM,eAAe,gBAAgB,KAAK,QAAQ;EAClD,OAAO,KAAK;CACd;CACA,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,qDAAqD;CAEtF,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,sBAAsB,CAAC;CACtE,IAAI;EACF,MAAM,YAAY,KAAK,WAAW,OAAO;EACzC,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,KAAK,QAAQ,GAAG,KAAA,GAAW,EAC7E,gBAAgB,UAClB,CAAC;EACD,MAAM,gBACJ,gBACA;GAAC;GAAS;GAAY;GAAY;GAAuB;EAAG,GAC5D,YACA,EAAE,gBAAgB,UAAU,CAC9B;EACA,MAAM,iBACJ,MAAM,gBAAgB,gBAAgB,CAAC,YAAY,GAAG,KAAA,GAAW,EAC/D,gBAAgB,UAClB,CAAC,EAAA,CACD,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EACR,IAAI,kBAAkB,KAAK,eACzB,MAAM,IAAI,MACR,+BAA+B,cAAc,kBAAkB,KAAK,eACtE;EAEF,MAAM,eAAe,gBAAgB,aAAa;EAClD,OAAO;CACT,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAsB,4BACpB,UACA,cACqB;CACrB,MAAM,iBAAiB,MAAM,uBAAuB,SAAS,YAAY,YAAY;CAMrF,KAJE,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAM,SAAS;CAAM,CAAC,EAAA,CACzE,OACC,SAAS,MAAM,CAAC,CAChB,KACU,MAAM,UACjB,MAAM,IAAI,MAAM,kDAAkD,SAAS,QAAQ;CAErF,MAAM,WACJ,MAAM,gBAAgB,gBAAgB;EAAC;EAAW;EAAM,SAAS;EAAQ;EAAM,SAAS;CAAI,CAAC,EAAA,CAC7F;CACF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,QAAQ,WAAW,KAAK,QAAQ,EAAE,EAAE,SAAS,SAAS,MACxD,MAAM,IAAI,MAAM,+CAA+C,SAAS,MAAM;CAEhF,MAAM,QAAQ,QAAQ;CACtB,IAAI,OAAO,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACvE,MAAM,IAAI,MAAM,mDAAmD,SAAS,MAAM;CAEpF,MAAM,SAAS,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAQ,MAAM;CAAM,CAAC,EAAA,CAAG;CAC1F,YAAY,OAAO,SAAS,QAAQ,SAAS,YAAY,mBAAmB,SAAS,MAAM;CAC3F,OAAO,WAAW,KAAK,KAAK;AAC9B;AAEA,eAAsB,mBACpB,UACA,UACe;CACf,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,QAAQ,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK;CAC/F,IAAI,SAAS,SAAS,YACpB,MAAM,IAAI,MAAM,sBAAsB,KAAK,kBAAkB,SAAS,YAAY;CAEpF,MAAM,QAAQ,MAAM,gBAAgB,MAAM,CAAC,aAAa,aAAa,CAAC,EAAA,CAAG,OACtE,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,IAAI,SAAS,SAAS,UACpB,MAAM,IAAI,MAAM,2BAA2B,KAAK,kBAAkB,SAAS,UAAU;AAEzF;;;;;AAMA,eAAsB,uBAAuB,OAOa;CACxD,MAAM,iBAAiB,QAAQ,MAAM,cAAc;CACnD,MAAM,mBAAmB,gBAAgB,KAAK;CAC9C,MAAM,SAAS,SACZ,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,oBAAoB,CAAC,EAAA,CAAG,OAC1E,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,MAAM,MAAO,UAAU,OAAO,SAAS,GAAG,GAC5D,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,uBAAuB,gBAAgB,QAAQ,iBAAiB;CAEtE,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,+BAA+B,CAAC;CAC/E,IAAI;EACF,MAAM,kBAAkB,KAAK,WAAW,SAAS;EACjD,MAAM,YAAY,KAAK,WAAW,OAAO;EACzC,MAAM,MAAM,eAAe;EAC3B,MAAM,iBAAiB;GACrB,gBAAgB;GAChB,sBAAsB;GACtB,kCAAkC,KAAK,QAAQ,SAAS;EAC1D;EACA,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,MAAM,QAAQ,GAAG,KAAA,GAAW,cAAc;EAC9F,IAAI,MAAM,MAAM,aAAa,GAC3B,MAAM,gBACJ,gBACA;GAAC;GAAS;GAAY;GAAY;GAAuB;EAAG,GAC5D,MAAM,OACN,cACF;EAEF,MAAM,cACJ,MAAM,gBAAgB,gBAAgB,CAAC,YAAY,GAAG,KAAA,GAAW,cAAc,EAAA,CAC/E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EACR,IAAI,eAAe,MAAM,YACvB,MAAM,IAAI,MACR,wCAAwC,WAAW,kBAAkB,MAAM,YAC7E;EAEF,MAAM,eAAe,gBAAgB,YAAY,cAAc;EAC/D,MAAM,WAAW,MAAM,6BAA6B,gBAAgB,YAAY,cAAc;EAC9F,IACE,CAAC,OAAO,KAAKC,0BAAwB,QAAQ,CAAC,CAAC,CAAC,OAC9C,OAAO,KAAKA,0BAAwB,MAAM,UAAU,CAAC,CACvD,GAEA,MAAM,IAAI,MAAM,sEAAsE;EAExF,MAAM,gBACJ,MAAM,gBACJ,gBACA;GAAC;GAAe;GAAY;GAAM,MAAM;EAAU,GAClD,OAAO,KAAK,4BAA4B,MAAM,GAC9C;GACE,GAAG;GACH,iBAAiB;GACjB,kBAAkB;GAClB,iBAAiB;GACjB,oBAAoB;GACpB,qBAAqB;GACrB,oBAAoB;EACtB,CACF,EAAA,CACA,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EAWR,KATE,MAAM,gBACJ,gBACA,CAAC,aAAa,GAAG,aAAa,QAAQ,GACtC,KAAA,GACA,cACF,EAAA,CACA,OACC,SAAS,MAAM,CAAC,CAChB,KACa,MAAM,YACpB,MAAM,IAAI,MAAM,sEAAsE;EAExF,OAAO;GAAE;GAAY;EAAa;CACpC,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAe,uBACb,YACA,cACiB;CACjB,MAAM,iBAAiB,QAAQ,MAAM,aAAa,QAAQ,UAAU,CAAC;CAErE,IAAI,EAAC,MADmB,KAAK,cAAc,EAAA,CAC5B,YAAY,GAAG,MAAM,IAAI,MAAM,8CAA8C;CAE5F,MAAM,UAAU,MAAM,gBAAgB,gBAAgB;EAAC;EAAU;EAAW;CAAQ,CAAC,EAAA,CAAG,OACrF,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,SAAS,kBAAkB,MAAM;CACvC,IAAI,CAAC,UAAU,OAAO,UAAU,WAAW,SAAS,OAAO,SAAS,WAAW,MAC7E,MAAM,IAAI,MACR,2BAA2B,UAAU,YAAY,6BAA6B,WAAW,MAAM,GAAG,WAAW,MAC/G;CASF,MAAM,uBAAuB,gBADd,SAJb,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,oBAAoB,CAAC,EAAA,CACzE,OACC,SAAS,MAAM,CAAC,CAChB,KAC6B,CACkB,GAAG,sBAAsB;CAC3E,OAAO;AACT;AAEA,eAAsB,uBACpB,gBACA,QACA,OACe;CAMf,KAJE,MAAM,gBAAgB,gBAAgB;EAAC;EAAgB;EAAuB;CAAc,CAAC,EAAA,CAC7F,OACC,SAAS,MAAM,CAAC,CAChB,KACY,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CAMtE,MAAM,YAAY,MAAM,SACtB,QACE,iBACC,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,kBAAkB,CAAC,EAAA,CAAG,OACxE,SAAS,MAAM,CAAC,CAChB,KAAK,CACV,CACF;CACA,IAAI,UAAU,SAAS,GAAG,GACxB,MAAM,IAAI,MAAM,GAAG,MAAM,8CAA8C;CAEzE,KAAK,MAAM,8BAAc,IAAI,IAAI,CAAC,QAAQ,SAAS,CAAC,GAClD,KAAK,MAAM,QAAQ,CAAC,cAAc,iBAAiB,GAAG;EACpD,MAAM,OAAO,KAAK,YAAY,WAAW,QAAQ,IAAI;EACrD,IAAI;GAEF,KAAI,MADmB,SAAS,MAAM,MAAM,EAAA,CAC/B,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sBAAsB,MAAM;EAC5E,SAAS,OAAO;GACd,IAAI,CAAC,UAAU,KAAK,GAAG,MAAM;EAC/B;CACF;AAEJ;AAEA,eAAe,wBACb,gBACA,QACA,cACe;CAIf,KAHc,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAM;CAAM,CAAC,EAAA,CAAG,OAC9E,SAAS,MAAM,CAAC,CAChB,KACI,MAAM,UAAU,MAAM,IAAI,MAAM,0CAA0C,QAAQ;CACzF,MAAM,cACJ,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,GAAG,OAAO,QAAQ,CAAC,EAAA,CACvE,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,IAAI,eAAe,cACjB,MAAM,IAAI,MAAM,8BAA8B,WAAW,kBAAkB,cAAc;AAE7F;AAEA,eAAe,eACb,gBACA,MACA,cAAsC,CAAC,GACxB;CACf,MAAM,WACJ,MAAM,gBACJ,gBACA;EAAC;EAAW;EAAO;EAAe;CAAI,GACtC,KAAA,GACA,WACF,EAAA,CACA;CACF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,QAAQ,WAAW,GAAG,MAAM,IAAI,MAAM,oCAAoC;CAC9E,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,MAAM,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACtE,MAAM,IAAI,MACR,kEAAkE,MAAM,MAC1E;EAEF,kBAAkB,MAAM,IAAI;CAC9B;AACF;AAEA,eAAe,6BACb,gBACA,MACA,aACkD;CAClD,OAAO,2BACL,MAAM,0BAA0B,gBAAgB,MAAM,WAAW,CACnE;AACF;AAEA,eAAsB,0BACpB,gBACA,MACA,cAAsC,CAAC,GACvC,QAC0E;CAC1E,MAAM,WACJ,MAAM,gBACJ,gBACA;EAAC;EAAW;EAAQ;EAAe;CAAI,GACvC,KAAA,GACA,WACF,EAAA,CACA;CACF,MAAM,QAAyE,CAAC;CAChF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,UAAU,QAAQ,SAAS,OAAO,UACpC,MAAM,IAAI,MAAM,qCAAqC;CAEvD,IAAI,aAAa;CACjB,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,MAAM,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACtE,MAAM,IAAI,MAAM,mDAAmD,MAAM,MAAM;EAEjF,kBAAkB,MAAM,IAAI;EAC5B,IAAI,MAAM,SAAS,KAAA,GACjB,MAAM,IAAI,MAAM,4CAA4C,MAAM,MAAM;EAE1E,IAAI,UAAU,MAAM,OAAO,OAAO,cAChC,MAAM,IAAI,MAAM,iDAAiD,MAAM,MAAM;EAE/E,cAAc,MAAM;EACpB,IAAI,UAAU,aAAa,OAAO,mBAChC,MAAM,IAAI,MAAM,8CAA8C;EAEhE,MAAM,SACJ,MAAM,gBACJ,gBACA;GAAC;GAAY;GAAQ,MAAM;EAAM,GACjC,KAAA,GACA,WACF,EAAA,CACA;EACF,IAAI,MAAM,eAAe,MAAM,MAC7B,MAAM,IAAI,MAAM,oCAAoC,MAAM,MAAM;EAElE,MAAM,KAAK;GACT,MAAM,MAAM;GACZ,MAAM,MAAM,SAAS,WAAW,MAAQ;GACxC,OAAO,WAAW,KAAK,KAAK;EAC9B,CAAC;CACH;CACA,OAAO,MAAM,MAAM,MAAM,UAAW,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,CAAE;AACnG;AAEA,SAAS,iBAAiB,OAMvB;CACD,MAAM,MAAM,OAAO,KAAK,KAAK;CAC7B,MAAM,UAAU,IAAI,SAAS,MAAM;CACnC,IAAI,CAAC,OAAO,KAAK,SAAS,MAAM,CAAC,CAAC,OAAO,GAAG,GAC1C,MAAM,IAAI,MAAM,8CAA8C;CAGhE,OADa,QAAQ,MAAM,IAAI,CAAC,CAAC,OAAO,OAC9B,CAAC,CAAC,KAAK,QAAQ;EACvB,MAAM,MAAM,IAAI,QAAQ,GAAI;EAC5B,MAAM,SAAS,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;EAC1D,MAAM,OAAO,IAAI,MAAM,MAAM,CAAC;EAC9B,MAAM,CAAC,MAAM,MAAM,QAAQ,YAAY;EACvC,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,MAC3C,MAAM,IAAI,MAAM,0BAA0B;EAE5C,MAAM,OAAO,YAAY,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,IAAI,KAAA;EACrE,IAAI,SAAS,KAAA,KAAa,CAAC,OAAO,cAAc,IAAI,GAClD,MAAM,IAAI,MAAM,8DAA8D;EAEhF,OAAO;GAAE;GAAM;GAAM;GAAQ,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;GAAI;EAAK;CAC7E,CAAC;AACH;AAEA,SAAS,kBAAkB,MAAoB;CAC7C,IACE,CAAC,QACD,KAAK,WAAW,GAAG,KACnB,KAAK,SAAS,IAAI,KAClB,KAAK,SAAS,IAAI,KAClBC,sBAAoB,IAAI,KACxB,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,KACrE,KAAK,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,YAAY,MAAM,QAEtC,MAAM,IAAI,MAAM,+CAA+C,MAAM;AAEzE;AAEA,SAASA,sBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,OAAO,MAAQ,SAAS,KAAM,OAAO;CAC3C;CACA,OAAO;AACT;AAEA,SAAS,kBAAkB,OAA4D;CACrF,MAAM,QAAQ,MAAM,MAClB,sGACF;CACA,IAAI,CAAC,QAAQ,MAAM,CAAC,MAAM,IAAI,OAAO,KAAA;CACrC,OAAO;EAAE,OAAO,MAAM;EAAI,MAAM,MAAM;CAAG;AAC3C;AAEA,eAAsB,gBACpB,gBACA,MACA,OACA,WAAmC,CAAC,GAChB;CACpB,MAAM,MAAM,OAAO,YACjB,OAAO,QAAQ,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,WAAW,MAAM,CAAC,CACzE;CACA,OAAO,OAAO,KAAK;EACjB,qBAAqB;EACrB,mBAAmB;EACnB,mBAAmB;EACnB,qBAAqB;EACrB,wBAAwB;EACxB,QAAQ;EACR,GAAG;CACL,CAAC;CACD,MAAM,WAAW;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,GAAG;CACL;CACA,OAAO,MAAM,IAAI,SAAS,eAAe,WAAW;EAClD,MAAM,QAAQ,MAAM,OAAO,UAAU;GAAE;GAAK,OAAO;IAAC;IAAQ;IAAQ;GAAM;EAAE,CAAC;EAC7E,MAAM,SAAmB,CAAC;EAC1B,MAAM,SAAmB,CAAC;EAC1B,MAAM,OAAO,GAAG,SAAS,UAAkB,OAAO,KAAK,KAAK,CAAC;EAC7D,MAAM,OAAO,GAAG,SAAS,UAAkB,OAAO,KAAK,KAAK,CAAC;EAC7D,MAAM,GAAG,SAAS,MAAM;EACxB,MAAM,GAAG,UAAU,MAAM,WAAW;GAClC,MAAM,MAAM,OAAO,OAAO,MAAM;GAChC,MAAM,MAAM,OAAO,OAAO,MAAM;GAChC,IAAI,SAAS,GAAG;IACd,uBACE,IAAI,MACF,OAAO,KAAK,MAAM,YAAY,WAAW,UAAU,KAAK,KAAK,IAAI,SAAS,MAAM,CAAC,CAAC,KAAK,GACzF,CACF;IACA;GACF;GACA,cAAc;IAAE,QAAQ;IAAK,QAAQ;GAAI,CAAC;EAC5C,CAAC;EACD,IAAI,OAAO,MAAM,MAAM,IAAI,KAAK;OAC3B,MAAM,MAAM,IAAI;CACvB,CAAC;AACH;AAEA,SAAS,UAAU,OAAyB;CAC1C,OACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAA4B,SAAS;AAE1C;;;;ACrfA,eAAsB,+BACpB,MACA,OAMoC;CACpC,MAAM,QAAQ,eAAe;CAC7B,MAAM,QAAQ,WAAW,KAAK,MAAM,KAAK;CACzC,MAAM,iBAAiBC,cAAY,KAAK;CACxC,MAAM,MAAM,gCAAgC,MAC1C,MAAM,KAAK,IAAI;EACb,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,OAAO,WAAW,KAAK,KAAK;EAC5B,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;CACjD,CAAC,CACH;CACA,MAAM,QAAQ,eAAe;CAC7B,IAAI,IAAI,WAAW,kBAAkB,IAAI,eAAe,MAAM,YAC5D,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG;CAClC,MAAM,QAAQ,eAAe;CAC7B,YAAY,QAAQ,gBAAgB,MAAM,YAAY,4BAA4B;CAClF,OAAO,wBAAwB,GAAG;AACpC;;;ACUA,MAAM,cAAc;AACpB,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;AAChC,MAAM,wBAAwB;AAC9B,MAAM,+BAAe,IAAI,KAAK,CAAC;AAY/B,MAAM,gBAAsD,OAAO,OAAO;CACxE,iBAAiB,MAAM,OAAO;CAC9B,0BAA0B,OAAO;CACjC,UAAU;CACV,cAAc,MAAM,OAAO;CAC3B,mBAAmB,MAAM,OAAO;CAChC,cAAc;CACd,0BAA0B,MAAM,OAAO;AACzC,CAAC;;AAkDD,eAAsB,+BACpB,WACA,UAAiD,CAAC,GACR;CAC1C,MAAM,OAAO,QAAQ,SAAS;CAC9B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,MAAM,WAAW,QAAQ,oBACrB,MAAM,kBAAkB,MAAM,MAAM,IACpC,MAAM,6BAA6B,MAAM,EACvC,QAAQ;EACN,UAAU,OAAO;EACjB,cAAc,OAAO;EACrB,mBAAmB,OAAO;CAC5B,EACF,CAAC;CACL,iCAAiC,SAAS,OAAO,MAAM;CACvD,MAAM,aAAa,gBAAgB,WAAW,SAAS,aAAa,KAAA;CACpE,OAAO,sBAAsB,SAAS,OAAO,YAAY,QAAQ,QAAQ,mBAAmB;AAC9F;;AAGA,eAAsB,oCACpB,OACA,UAA4E,CAAC,GACnC;CAC1C,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,OAAO,sBACL,wBAAwB,OAAO,MAAM,GACrC,KAAA,GACA,QACA,QAAQ,mBACV;AACF;AAEA,eAAe,sBACb,OACA,YACA,QACA,qBAC0C;CAC1C,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,WAAWC,0BAAwB,QAAQ;CACjD,MAAM,UAAU,MAAM,uBAAuB,OAAO,YAAY,OAAO,eAAe;CACtF,IACE,CAAC,wBACA,SAAS,aAAa,OAAO,4BAC5B,QAAQ,aAAa,OAAO,2BAE9B,MAAM,IAAI,MACR,gGACF;CAEF,MAAM,mBAAmB,MAAM,yBAAyB,YAAY,UAAU,mBAAmB;CACjG,MAAM,kBAAkB,MAAM,yBAAyB,WAAW,SAAS,mBAAmB;CAC9F,MAAM,WAAW,oBAAoB;EACnC,MAAM;EACN,QAAQC,2BAAyB,QAAQ;EACzC;EACA,UAAU;EACV,SAAS;CACX,CAAmD;CACnD,OAAO,OAAO,OAAO;EAAE;EAAU;CAAQ,CAAC;AAC5C;AAEA,eAAe,yBACb,MACA,OACA,aACyC;CACzC,IAAI,CAAC,aAAa,OAAO,0BAA0B,KAAK;CACxD,IAAI,CAAC,YAAY,YAAY,KAAK,GAChC,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO,+BAA+B,YAAY,iBAAiB;EACjE,aAAa,YAAY;EACzB,SAAS,SAAS,aAAa,iCAAiC;EAChE;EACA,GAAI,YAAY,SAAS,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;CAC7D,CAAC;AACH;;AAGA,SAAgB,kCACd,UAAoD,CAAC,GACxB;CAC7B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAY7C,OAAO,OAAO,OAAO,EAVnB,aAAa,OAAO,EAAE,MAAM,UAAU,SAAS,kBAAkB;EAC/D,MAAM,mCAAmC;GACvC;GACA;GACA;GACA;GACA;EACF,CAAC;CACH,EAEsB,CAAC;AAC3B;AAEA,eAAe,mCAAmC,OAMhC;CAChB,MAAM,UAAU,MAAM,+BAA+B,KAAK;CAC1D,MAAM,cAAc,QAAQ,MAAM,WAAW;CAC7C,MAAM,wBAAwB,WAAW;CACzC,MAAM,UAAU,MAAM,QAAQ,GAAG,YAAY,gBAAgB;CAC7D,IAAI;EACF,MAAM,oBAAoB,SAAS,QAAQ,KAAK;EAChD,IAAI,QAAQ,YACV,MAAM,sBAAsB,QAAQ,YAAY,OAAO;EAEzD,MAAM,4BAA4B,SAAS,MAAM,SAAS,UAAU,EAClE,6BAA6B,QAAQ,aAAa,CAAC,MAAM,IAAI,CAAC,EAChE,CAAC;EACD,MAAM,OAAO,SAAS,WAAW;CACnC,SAAS,OAAO;EACd,MAAM,GAAG,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAClD,MAAM,GAAG,aAAa;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACtD,MAAM;CACR;AACF;;AAGA,eAAsB,qCAAqC,OAKzC;CAChB,MAAM,+BAA+B;EAAE,GAAG;EAAO,QAAQ,gBAAgB,MAAM,MAAM;CAAE,CAAC;AAC1F;AAEA,eAAe,+BAA+B,OAKT;CACnC,YACE,MAAM,SACN,MAAM,SAAS,QAAQ,QACvB,MAAM,SAAS,QAAQ,YACvB,6BACF;CACA,MAAM,UAAU,MAAM,sBAAsB,MAAM,SAAS,MAAM,MAAM;CACvE,IAAI,QAAQ,cAAc,MAAM,SAAS,QACvC,MAAM,IAAI,MAAM,iDAAiD;CAEnE,6BAA6B,QAAQ,OAAO,MAAM,QAAQ;CAC1D,OAAO;AACT;AAEA,eAAe,kBACb,eACA,QAIC;CACD,MAAM,iBAAiB,MAAM,MAAM,aAAa;CAChD,IAAI,CAAC,eAAe,YAAY,KAAK,eAAe,eAAe,GACjE,MAAM,IAAI,MAAM,oDAAoD;CAOtE,MAAM,OAAO,MAAM,SAAS,aAAa;CACzC,MAAM,gBAAgB,MAAM,MAAM,IAAI;CACtC,IAAI,CAAC,cAAc,YAAY,KAAK,cAAc,eAAe,GAC/D,MAAM,IAAI,MAAM,4DAA4D;CAK9E,IAAK,MAAM,SAAS,SAHF,MAAM,gBAAgB,MAAM,CAAC,aAAa,iBAAiB,CAAC,EAAA,CAAG,OAC9E,SAAS,MAAM,CAAC,CAChB,KACgC,CAAC,CAAC,MAAO,MAC1C,MAAM,IAAI,MAAM,kEAAkE;CAEpF,MAAM,SAAS,SACZ,MAAM,gBAAgB,MAAM,CAAC,aAAa,oBAAoB,CAAC,EAAA,CAAG,OAChE,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,MAAM,MAAO,UAAU,OAAO,SAAS,GAAG,GAC5D,MAAM,IAAI,MAAM,+DAA+D;CAEjF,MAAM,uBAAuB,MAAM,QAAQ,sBAAsB;CACjE,MAAM,cAAc,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OACrE,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,YAAY,MAAM,gBAAgB,MAAM,CAAC,aAAa,aAAa,CAAC,EAAA,CAAG,OAC1E,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,kBAAkB,YAAY,MAAM;CACpC,kBAAkB,UAAU,WAAW;CACvC,IAAI,WAAW,WAAW,SAAS,QACjC,MAAM,IAAI,MAAM,iEAAiE;CAEnF,MAAM,QAAQ,MAAM,0BAA0B,MAAM,UAAU,CAAC,GAAG,MAAM;CACxE,iCAAiC,OAAO,MAAM;CAC9C,MAAM,sBACJ,MAAM,gBAAgB,MAAM;EAAC;EAAY;EAAgB;EAAa;CAAM,CAAC,EAAA,CAC7E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,iBAAiB,OAAO,kBAAkB;CAChD,IAAI,CAAC,OAAO,cAAc,cAAc,KAAK,iBAAiB,GAC5D,MAAM,IAAI,MAAM,gDAAgD;CAElE,IAAI,iBAAiB,OAAO,0BAC1B,MAAM,IAAI,MAAM,uDAAuD;CAEzE,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,MAAM,gBAAgB,MAAM;GAAC;GAAU;GAAU;GAAY;EAAM,CAAC;EACpE,MAAM,SAAS,WAAW,KAAK,MAAM,SAAS,UAAU,CAAC;EACzD,IAAI,OAAO,aAAa,OAAO,0BAC7B,MAAM,IAAI,MAAM,8DAA8D;EAEhF,OAAO;GACL;GACA,YAAY;IACV;IACA;IACA,QAAQ;KACN,QAAQC,cAAY,MAAM;KAC1B,YAAY,OAAO;KACnB,OAAO;IACT;GACF;EACF;CACF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAe,uBACb,OACA,YACA,iBACqB;CACrB,MAAM,UAAU,KAAK;CACrB,MAAM,SAAS,cAAc,SAAS,iBAAiB,6BAA6B;CACpF,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,OAAO,MAAM;CACf,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,OAAO,YAAY,KAAA,CAAS;EAClC,MAAM;CACR;AACF;AAEA,eAAe,gCACb,OACA,YACA,UACA,iBACe;CACf,MAAM,UAAU,KAAK;CACrB,MAAM,aAAa,kBACjB,SACA,UACA,iBACA,6BACF;CACA,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,IAAI,CAAE,MAAM,YAAa,MAAM,IAAI,MAAM,0CAA0C;CACrF,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,WAAW,YAAY,KAAA,CAAS;EACtC,MAAM;CACR;AACF;AAEA,eAAe,6BACb,SACA,OACA,YACe;CACf,KAAK,MAAM,QAAQ,OACjB,MAAM,cAAc,SAAS,GAAG,uBAAuB,KAAK,QAAQ,KAAK,MAAM,KAAK,KAAK;CAE3F,IAAI,CAAC,YAAY;CACjB,MAAM,WAAWF,0BAAwB;EACvC,MAAM;EACN,YAAY,WAAW;EACvB,UAAU,WAAW;EACrB,QAAQ;GACN,QAAQ,WAAW,OAAO;GAC1B,YAAY,WAAW,OAAO;EAChC;CACF,CAA8C;CAC9C,MAAM,cAAc,SAAS,yBAAyB,KAAO,QAAQ;CACrE,MAAM,cAAc,SAAS,uBAAuB,KAAO,WAAW,OAAO,KAAK;AACpF;AAEA,eAAe,sBACb,OACA,QACkC;CAClC,IAAI,MAAM,aAAa,OAAO,iBAC5B,MAAM,IAAI,MAAM,qDAAqD;CAEvE,MAAM,SAAS,QAAQ;CACvB,MAAM,QAA0C,CAAC;CACjD,MAAM,qCAAqB,IAAI,IAAY;CAC3C,MAAM,gCAAgB,IAAI,IAAY;CACtC,IAAI,aAAa;CACjB,IAAI,qBAAqB;CACzB,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,WAAW,YAAY;EAC3B,WAAW,MAAM,SAAS,QAAQ;GAChC,MAAM,OAAO,MAAM,OAAO;GAC1B,IACE,MAAM,OAAO,SAAS,UACtB,OAAO,SAAS,YAChB,mBAAmB,IAAI,IAAI,GAE3B,MAAM,IAAI,MAAM,mDAAmD;GAErE,mBAAmB,IAAI,IAAI;GAC3B,IAAI,KAAK,WAAW,oBAAoB,GAAG;IACzC,IAAI,MAAM,UAAU,OAAO,UACzB,MAAM,IAAI,MAAM,uDAAuD;IAEzE,MAAM,OAAO,gBAAgB,KAAK,MAAM,EAA2B,GAAG,OAAO,YAAY;IACzF,IAAI,CAAC,oBAAoB,MAAM,OAAO,IAAI,GACxC,MAAM,IAAI,MAAM,wDAAwD,MAAM;IAEhF,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,YAAY,MAAM,aAAa,OAAO,OAAO,cAAc,kBAAkB,MAAM;IACzF,sBAAsB,UAAU;IAChC,yBACE,MACA,cACA,eACA,6DACF;IACA,eAAe;IACf,IAAI,UAAU,aAAa,OAAO,oBAAoB,YACpD,MAAM,IAAI,MAAM,uDAAuD;IAEzE,cAAc,UAAU;IACxB,MAAM,KAAK;KAAE;KAAM,MAAM,MAAM,OAAO;KAAM,OAAO;IAAU,CAAC;GAChE,OAAO,IAAI,SAAS,yBAAyB;IAC3C,IAAI,MAAM,OAAO,SAAS,OAAS,oBACjC,MAAM,IAAI,MAAM,4DAA4D;IAE9E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,gBAAgB,MAAM,aAC1B,OACA,OAAO,cACP,+BACF;IACA,sBAAsB,cAAc;IACpC,qBAAqB,wBAAwB,eAAe,OAAO,wBAAwB;GAC7F,OAAO,IAAI,SAAS,uBAAuB;IACzC,IAAI,MAAM,OAAO,SAAS,OAAS,kBACjC,MAAM,IAAI,MAAM,0DAA0D;IAE5E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,mBAAmB,MAAM,aACvB,OACA,OAAO,0BACP,sBACF;IACA,sBAAsB,iBAAiB;GACzC,OACE,MAAM,IAAI,MAAM,0DAA0D,MAAM;EAEpF;EACA,IAAI,QAAQ,kBAAkB,MAAM,QAAQ,gBAAgB,GAC1D,MAAM,IAAI,MAAM,+DAA+D;EAEjF,MAAM,aACJ,sBAAsB,mBAClB,kBAAkB,oBAAoB,gBAAgB,IACtD,KAAA;EACN,OAAO;GAAE;GAAO,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EAAG;CACxD,EAAA,CAAG;CACH,OAAO,IAAI,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,CAAC;CACxE,MAAM,SAAS,MAAM;CACrB,MAAM,gCACJ,OAAO,OACP,OAAO,YACP,OACA,OAAO,eACT;CACA,OAAO;AACT;AAEA,SAAS,0BACP,cACA,oBACA,YACA,QACM;CACN,IACE,CAAC,OAAO,cAAc,UAAU,KAChC,eAAe,KAAA,KACf,aAAa,KACb,aAAa,OAAO,kBAAkB,eAAe,oBAErD,MAAM,IAAI,MAAM,oEAAoE;AAExF;AAEA,SAAS,wBACP,OACA,gBACoC;CACpC,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC5E,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,8DAA8D,EAAE,OAAO,MAAM,CAAC;CAChG;CACA,IACE,CAAC,SAAS,KAAK,KACf,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,qCACxC,MAAM,SAAS,eACf,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,aAAa,YAC1B,CAAC,SAAS,MAAM,MAAM,KACtB,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,uBAC/C,OAAO,MAAM,OAAO,WAAW,YAC/B,CAAC,wBAAwB,KAAK,MAAM,OAAO,MAAM,KACjD,CAAC,OAAO,cAAc,MAAM,OAAO,UAAU,KAC5C,MAAM,OAAO,cAAyB,KACtC,MAAM,OAAO,aAAwB,gBAEtC,MAAM,IAAI,MAAM,mDAAmD;CAErE,IAAI,CAAC,OAAO,KAAKA,0BAAwB,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,KAAK,KAAK,CAAC,GACxE,MAAM,IAAI,MAAM,kEAAkE;CAEpF,kBAAkB,MAAM,YAAY,iBAAiB;CACrD,kBAAkB,MAAM,UAAU,sBAAsB;CACxD,IAAI,MAAM,WAAW,WAAW,MAAM,SAAS,QAC7C,MAAM,IAAI,MAAM,iEAAiE;CAEnF,OAAO;EACL,MAAM;EACN,YAAY,MAAM;EAClB,UAAU,MAAM;EAChB,QAAQ;GACN,QAAQ,MAAM,OAAO;GACrB,YAAY,MAAM,OAAO;EAC3B;CACF;AACF;AAEA,SAAS,kBACP,UACA,QAC4B;CAC5B,YAAY,QAAQ,SAAS,OAAO,QAAQ,SAAS,OAAO,YAAY,sBAAsB;CAC9F,OAAO;EACL,YAAY,SAAS;EACrB,UAAU,SAAS;EACnB,QAAQ;GAAE,GAAG,SAAS;GAAQ,OAAO;EAAO;CAC9C;AACF;AAEA,eAAe,cACb,SACA,MACA,MACA,OACe;CACf,MAAM,IAAI,SAAe,cAAc,gBAAgB;EACrD,QAAQ,MACN,mBAAmB,MAAM,MAAM,MAAM,UAAU,GAC/C,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,IAC3D,UAAW,QAAQ,YAAY,KAAK,IAAI,aAAa,CACxD;CACF,CAAC;AACH;AAIA,eAAe,aAAa,OAAiB,UAAkB,OAAoC;CACjG,MAAM,OAAO,MAAM,OAAO;CAC1B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,SAAS,KAAA,KAAa,OAAO,KAAK,OAAO,UAC1E,MAAM,IAAI,MAAM,GAAG,MAAM,yBAAyB;CAEpD,MAAM,QAAQ,MAAM,cAAc,OAAO,UAAU,KAAK;CACxD,IAAI,MAAM,eAAe,MAAM,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CACnF,OAAO;AACT;AAEA,eAAe,cACb,QACA,UACA,OACqB;CACrB,MAAM,SAAmB,CAAC;CAC1B,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B;EAErD,IAAI,MAAM,aAAa,WAAW,YAAY;GAC5C,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,QAAQ,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;EAChE,OAAO,KAAK,KAAK;EACjB,cAAc,MAAM;CACtB;CACA,OAAO,OAAO,OAAO,QAAQ,UAAU;AACzC;AAEA,eAAe,kBACb,QACA,UACA,UACA,OACkB;CAClB,MAAM,iBAAiB,OAAO,KAAK,SAAS,QAAQ,SAAS,YAAY,SAAS,UAAU;CAC5F,IAAI,QAAQ;CACZ,IAAI,SAAS;CACb,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B;EAErD,IAAI,MAAM,aAAa,WAAW,QAAQ;GACxC,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,WAAW,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU;EAC7E,IACE,SAAS,SAAS,aAAa,eAAe,cAC9C,CAAC,SAAS,OAAO,eAAe,SAAS,QAAQ,SAAS,SAAS,UAAU,CAAC,GAE9E,QAAQ;EAEV,UAAU,SAAS;CACrB;CACA,OAAO,SAAS,WAAW,eAAe;AAC5C;AAEA,eAAsB,wBAAwB,aAAoC;CAChF,MAAM,MAAM,aAAa;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACzD,MAAM,QAAQ,MAAM,MAAM,WAAW;CACrC,IAAI,CAAC,MAAM,YAAY,KAAK,MAAM,eAAe,GAC/C,MAAM,IAAI,MAAM,0DAA0D;CAM5E,MAAM,gBAAgB,MAAM,MAAM,MADA,SAAS,WAAW,CACD;CACrD,IAAI,CAAC,cAAc,YAAY,KAAK,cAAc,eAAe,GAC/D,MAAM,IAAI,MAAM,kEAAkE;CAEpF,KAAK,MAAM,QAAQ,WAAW,EAAA,CAAG,SAAS,GACxC,MAAM,IAAI,MAAM,+CAA+C;AAEnE;AAEA,eAAe,oBACb,aACA,OACe;CACf,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,cAAc,aAAa,KAAK,IAAI;EACjD,MAAM,MAAM,QAAQ,IAAI,GAAG;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC3D,MAAM,aAAa,MAAM,KACvB,MACAG,UAAY,WACVA,UAAY,UACZA,UAAY,UACX,OAAOA,UAAY,eAAe,WAAWA,UAAY,aAAa,IACzE,GACF;EACA,IAAI;GACF,MAAM,WAAW,UAAU,KAAK,KAAK;GACrC,MAAM,QAAQ,MAAM,WAAW,KAAK;GACpC,IAAI,CAAC,MAAM,OAAO,KAAK,MAAM,UAAU,GACrC,MAAM,IAAI,MAAM,4DAA4D,KAAK,MAAM;GAEzF,MAAM,WAAW,MAAM,KAAK,IAAI;EAClC,UAAU;GACR,MAAM,WAAW,MAAM;EACzB;CACF;AACF;AAEA,eAAe,sBACb,YACA,aACe;CACf,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,MAAM,UAAU,YAAY,WAAW,OAAO,OAAO;GAAE,MAAM;GAAM,MAAM;EAAM,CAAC;EAChF,MAAM,gBAAgB,aAAa;GACjC;GACA;GACA;GACA,mBAAmB,WAAW,WAAW,WAAW,KAAK,WAAW;EACtE,CAAC;EACD,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAU;EAAU,CAAC;EACnE,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAY;EAAU,CAAC;EAMrE,KAJE,MAAM,gBAAgB,aAAa;GAAC;GAAY;GAAM,WAAW;EAAU,CAAC,EAAA,CAC5E,OACC,SAAS,MAAM,CAAC,CAChB,KACU,MAAM,UAAU,MAAM,IAAI,MAAM,2CAA2C;EAMxF,KAJE,MAAM,gBAAgB,aAAa,CAAC,aAAa,GAAG,WAAW,WAAW,QAAQ,CAAC,EAAA,CACnF,OACC,SAAS,MAAM,CAAC,CAChB,KACY,MAAM,WAAW,UAC9B,MAAM,IAAI,MAAM,+CAA+C;EAEjE,MAAM,gBAAgB,aAAa;GAAC;GAAc;GAAc;GAAQ,WAAW;EAAU,CAAC;EAC9F,MAAM,gBAAgB,aAAa,CAAC,aAAa,WAAW,QAAQ,CAAC;EAMrE,KAJE,MAAM,gBAAgB,aAAa;GAAC;GAAU;GAAkB;EAAuB,CAAC,EAAA,CACxF,OACC,SAAS,MAAM,CAAC,CAChB,KACM,GAAG,MAAM,IAAI,MAAM,sDAAsD;CACpF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,SAAS,6BACP,OACA,UACM;CACN,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,gBAAgBH,0BAAwB,QAAQ;CACtD,YACE,eACA,SAAS,SAAS,QAClB,SAAS,SAAS,YAClB,8BACF;CACA,IACEC,2BAAyB,QAAQ,MAAM,SAAS,UAChD,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,OAAO,OAAO,KAAKD,0BAAwB,SAAS,QAAQ,CAAC,CAAC,GAE1F,MAAM,IAAI,MAAM,kEAAkE;AAEtF;AAEA,SAAS,iCACP,OACA,QACM;CACN,IAAI,MAAM,SAAS,OAAO,UACxB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,IAAI;CACJ,MAAM,gCAAgB,IAAI,IAAY;CACtC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,gBAAgB,KAAK,MAAM,OAAO,YAAY;EAC3D,yBACE,MACA,cACA,eACA,qDACF;EACA,eAAe;EACf,IAAI,CAAC,oBAAoB,KAAK,IAAI,GAChC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,KAAK,MAAM,aAAa,OAAO,cACjC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,cAAc,KAAK,MAAM;EACzB,IAAI,aAAa,OAAO,mBACtB,MAAM,IAAI,MAAM,+CAA+C;CAEnE;AACF;AAEA,SAAS,wBACP,OACA,QACuC;CACvC,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,MAAM,4CAA4C;CAE9D,MAAM,YAAY,MAAM;CACxB,IAAI,YAAY,OAAO,UACrB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,MAAM,QAA+C,CAAC;CACtD,KAAK,IAAI,QAAQ,GAAG,QAAQ,WAAW,SAAS;EAC9C,MAAM,YAAY,MAAM;EACxB,IAAI,CAAC,SAAS,SAAS,KAAK,OAAO,KAAK,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,mBACtE,MAAM,IAAI,MAAM,4BAA4B,MAAM,YAAY;EAEhE,MAAM,cAAc,OAAO,0BAA0B,SAAS;EAC9D,IACE,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,SAAS,CAAC,KAEpC,MAAM,IAAI,MAAM,4BAA4B,MAAM,uBAAuB;EAE3E,MAAM,OAAO,gBAAgB,YAAY,MAAM,OAAO,OAAO,YAAY;EACzE,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,aAAa,YAAY,OAAO;EACtC,IAAI,CAAC,oBAAoB,IAAI,GAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,MAAM,OAAO,sBAAsB,YAAY,IAAI;EACnD,IAAI,KAAK,aAAa,OAAO,cAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,KAAK,aAAa,OAAO,oBAAoB,YAC/C,MAAM,IAAI,MAAM,+CAA+C;EAEjE,IAAI,KAAK,aAAa,KAAK,IAAI,GAAG,OAAO,kBAAkB,IAAI,GAC7D,MAAM,IAAI,MAAM,qDAAqD;EAEvE,cAAc,KAAK;EACnB,MAAM,KAAK;GAAE;GAAM;GAAM,OAAO,qBAAqB,IAAI;EAAE,CAAC;CAC9D;CACA,MAAM,MAAM,MAAM,UAAW,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,CAAE;CAC1F,iCAAiC,OAAO,MAAM;CAC9C,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAiC;CAC5D,OAAO,OAAO,cAAc,KAAK,KAAM,SAAoB,KAAM,SAAoB;AACvF;AAEA,SAAgB,gBACd,WACsC;CACtC,MAAM,SAAS;EAAE,GAAG;EAAe,GAAG;CAAU;CAChD,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAC/C,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAC3C,MAAM,IAAI,MAAM,uBAAuB,KAAK,iCAAiC;CAGjF,OAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAgB,gBAAgB,OAAgB,cAA8B;CAC5E,IACE,OAAO,UAAU,YACjB,CAAC,SACD,CAAC,oBAAoB,KAAK,KAC1B,OAAO,WAAW,OAAO,MAAM,IAAI,gBACnC,WAAW,KAAK,KAChB,MAAM,WAAW,KAAK,KACtB,MAAM,SAAS,IAAI,KACnB,MAAM,SAAS,IAAI,KACnB,oBAAoB,KAAK,KACzB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,KACtE,CAAC,QAAQ,UAAU,CAAC,CAAC,SAAS,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,YAAY,KAAK,EAAE,GAEtE,MAAM,IAAI,MAAM,wDAAwD,OAAO,KAAK,GAAG;CAEzF,OAAO;AACT;AAEA,SAAgB,yBACd,MACA,cACA,eACA,cACM;CACN,IAAI,iBAAiB,KAAA,KAAa,gBAAgB,MAAM,MAAM,IAAI,MAAM,YAAY;CACpF,KAAK,IAAI,QAAQ,KAAK,QAAQ,GAAG,GAAG,UAAU,IAAI,QAAQ,KAAK,QAAQ,KAAK,QAAQ,CAAC,GACnF,IAAI,cAAc,IAAI,KAAK,MAAM,GAAG,KAAK,CAAC,GAAG,MAAM,IAAI,MAAM,YAAY;CAE3E,cAAc,IAAI,IAAI;AACxB;AAEA,SAAS,sBACP,OACA,MACiE;CACjE,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,SAAS,uBAAuB,KAAK,KAAmB;EACxD,aAAa,2BAA2B,KAAK,KAAmB;EAChE,aAAa,2BAA2B,KAAK,KAAmB;CAClE,QAAQ;EACN,MAAM,IAAI,MAAM,+CAA+C,MAAM;CACvE;CACA,IAAI,oBAAoB,MAAM,GAC5B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,IAAI,CAAC,iBAAiB,MAAM,GAC1B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,OAAO;EAAE;EAAQ;EAAY;CAAW;AAC1C;AAEA,SAAS,qBAAqB,OAIf;CACb,MAAM,EAAE,QAAQ,YAAY,eAAe;CAC3C,MAAM,OAAO,IAAI,WAAW,UAAU;CACtC,WAAW,UAAU,IAAI,KAAK,MAAM,IAAI,WAAW,QAAQ,YAAY,UAAU,CAAC;CAClF,OAAO;AACT;AAEA,SAAgB,cAAc,MAAc,cAA8B;CACxE,MAAM,OAAO,QAAQ,MAAM,YAAY;CACvC,IAAI,CAAC,KAAK,WAAW,GAAG,OAAO,KAAK,GAClC,MAAM,IAAI,MAAM,6DAA6D,cAAc;CAE7F,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAe,OAAqB;CAC7D,IAAI,CAAC,kCAAkC,KAAK,KAAK,GAC/C,MAAM,IAAI,MAAM,wBAAwB,MAAM,wBAAwB;AAE1E;AAEA,SAAS,oBAAoB,OAAwB;CACnD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,OAAO,MAAQ,SAAS,KAAM,OAAO;CAC3C;CACA,OAAO;AACT;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAIA,SAAS,wBAAwB,MAAgE;CAC/F,MAAM,sBAAsB,OAAO,eAAe,WAAW,SAAS;CACtE,MAAM,SAAS,OAAO,yBAAyB,qBAAqB,IAAI,CAAC,EAAE;CAC3E,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,yBAAyB,KAAK,yBAAyB;CACpF,OAAO;AACT;AAEA,MAAM,yBAAyB,wBAAwB,QAAQ;AAC/D,MAAM,6BAA6B,wBAAwB,YAAY;AACvE,MAAM,6BAA6B,wBAAwB,YAAY;;AAGvE,SAAgB,mBAAmB,MAAc,MAAc,MAAc;CAC3E,OAAO;EACL;EACA;EACA,KAAK;EACL,KAAK;EACL;EACA,OAAO;EACP,MAAM;EACN,OAAO;EACP,OAAO;CACT;AACF;;;;AC/9BA,gBAAuB,uBACrB,UACA,MACA,QAC4B;CAC5B,QAAQ,eAAe;CACvB,IAAI,EAAE,aAAa,aAAa,CAAC,KAAK,YACpC,MAAM,IAAI,MAAM,kDAAkD;CAEpE,MAAM,SACJ,aAAa,WACT,CAAC,OAAO,KAAK,SAAS,SAAS,QAAQ,CAAC,IACxC,KAAK,WAAY,UAAU,EAAE,OAAO,CAAC;CAC3C,MAAM,OAAO,WAAW,QAAQ;CAChC,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ;EAChC,QAAQ,eAAe;EACvB,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,6CAA6C;EAC/D,cAAc,MAAM;EACpB,IAAI,aAAa,SAAS,YACxB,MAAM,IAAI,MAAM,gDAAgD;EAClE,KAAK,OAAO,KAAK;EACjB,MAAM;CACR;CACA,QAAQ,eAAe;CACvB,IAAI,eAAe,SAAS,cAAc,UAAU,KAAK,OAAO,KAAK,QAAQ,SAAS,QACpF,MAAM,IAAI,MAAM,yDAAyD;AAE7E;;AAGA,eAAsB,qCACpB,MACA,OAOoC;CACpC,IAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAC3B,MAAM,IAAI,MAAM,mEAAmE;CAErF,MAAM,QAAQ,eAAe;CAC7B,MAAM,OAAO,WAAW,QAAQ;CAChC,IAAI,aAAa;CACjB,IAAI,WAAW;CACf,gBAAgB,UAAsC;EACpD,WAAW,MAAM,SAAS,MAAM,QAAQ;GACtC,MAAM,QAAQ,eAAe;GAC7B,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,6CAA6C;GAC/D,cAAc,MAAM;GACpB,IAAI,aAAa,MAAM,UACrB,MAAM,IAAI,MAAM,qDAAqD;GACvE,KAAK,OAAO,KAAK;GACjB,MAAM;EACR;EACA,WAAW;EACX,MAAM,QAAQ,eAAe;CAC/B;CACA,MAAM,SAAS,QAAQ;CACvB,IAAI;EACF,MAAM,MAAM,gCAAgC,MAC1C,MAAM,KAAK,UAAU;GACnB,aAAa,MAAM;GACnB,SAAS,MAAM;GACf;GACA,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EACjD,CAAC,CACH;EACA,MAAM,QAAQ,eAAe;EAC7B,IACE,CAAC,YACD,IAAI,WAAW,UAAU,KAAK,OAAO,KAAK,OAC1C,IAAI,eAAe,YAEnB,MAAM,IAAI,MAAM,gEAAgE;EAElF,WAAW,MAAM,UAAU,uBAAuB,KAAK,MAAM,MAAM,MAAM;EAGzE,OAAO,wBAAwB,GAAG;CACpC,UAAU;EACR,MAAM,OAAO,OAAO,KAAA,CAAS;CAC/B;AACF;;;;ACpEA,eAAsB,0CACpB,WACA,SACyE;CACzE,MAAM,EAAE,iBAAiB,aAAa,WAAW,QAAQ;CACzD,IAAI,CAAC,gBAAgB,aAAa,CAAC,gBAAgB,YACjD,MAAM,IAAI,MAAM,mEAAmE;CAErF,IAAI,CAAC,YAAY,KAAK,GACpB,MAAM,IAAI,MAAM,kEAAkE;CACpF,QAAQ,eAAe;CACvB,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,MAAM,WAAW,MAAM,kCAAkC,WAAW;EAAE;EAAQ;CAAO,CAAC;CACtF,iBAAiB,UAAU,MAAM;CACjC,MAAM,OAAO,MAAM,SAAS,QAAQ,SAAS,CAAC;CAC9C,MAAM,WAAWI,0BAAwB,QAAQ;CACjD,MAAM,mBAAmB,MAAM,qCAAqC,iBAAiB;EACnF;EACA,SAAS;EACT,QAAQ,SAAS,QAAQ;EACzB,UAAU,SAAS;EACnB;CACF,CAAC;CACD,MAAM,kBAAkB,MAAM,qCAAqC,iBAAiB;EAClF;EACA,SAAS;EACT,QAAQ,uBAAuB,MAAM,UAAU,MAAM;EACrD,UAAU,OAAO;EACjB;CACF,CAAC;CACD,OAAO,OAAO,OAAO,EACnB,UAAU,oBAAoB;EAC5B,MAAM;EACN,QAAQC,2BAAyB,QAAQ;EACzC;EACA,UAAU;EACV,SAAS;CACX,CAAC,EACH,CAAC;AACH;;AAWA,eAAsB,uCACpB,OACe;CACf,MAAM,0BAA0B,KAAK;AACvC;;AAGA,eAAsB,gDACpB,OACe;CACf,MAAM,QAAQ,eAAe;CAC7B,IAAI,CAAC,MAAM,UAAU,YACnB,MAAM,IAAI,MAAM,kDAAkD;CACpE,MAAM,cAAc,QAAQ,MAAM,WAAW;CAC7C,MAAM,wBAAwB,WAAW;CACzC,MAAM,UAAU,MAAM,QAAQ,GAAG,YAAY,gBAAgB;CAC7D,IAAI;EACF,MAAM,0BAA0B,OAAO,OAAO;EAC9C,MAAM,QAAQ,eAAe;EAC7B,MAAM,OAAO,SAAS,WAAW;CACnC,SAAS,OAAO;EACd,MAAM,GAAG,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAClD,MAAM;CACR;AACF;AAEA,eAAe,0BACb,OACA,aACe;CACf,MAAM,EAAE,WAAW,WAAW;CAC9B,MAAM,WAAW,oBAAoB,gBAAgB,MAAM,QAAQ,CAAC;CACpE,QAAQ,eAAe;CACvB,IAAI,CAAC,UAAU,YAAY,MAAM,IAAI,MAAM,kDAAkD;CAC7F,MAAM,SAAS,gBAAgB,MAAM,MAAM;CAC3C,iBAAiB,SAAS,UAAU,MAAM;CAC1C,IAAI,SAAS,QAAQ,aAAa,OAAO,iBACvC,MAAM,IAAI,MAAM,qDAAqD;CACvE,MAAM,WAAWD,0BAAwB,SAAS,QAAQ;CAC1D,YACE,UACA,SAAS,SAAS,QAClB,SAAS,SAAS,YAClB,8BACF;CACA,IAAIC,2BAAyB,SAAS,QAAQ,MAAM,SAAS,QAC3D,MAAM,IAAI,MAAM,0EAA0E;CAC5F,IAAI,SAAS;CACb,WAAW,MAAM,SAAS,uBAAuB,SAAS,UAAU,WAAW,MAAM,GAAG;EACtF,IACE,CAAC,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,CAAC,CAAC,OAC7D,SAAS,SAAS,QAAQ,SAAS,MAAM,UAAU,CACrD,GAEA,MAAM,IAAI,MAAM,0EAA0E;EAE5F,UAAU,MAAM;CAClB;CAEA,MAAM,SAAS,QAAQ;CACvB,MAAM,YAAY,KAAK;CACvB,MAAM,kBAAkB,aAAa,WAAW,OAAO,iBAAiB,MAAM;CAE9E,MAAM,UAAU,SACd,SAAS,KAAK,uBAAuB,SAAS,SAAS,WAAW,MAAM,CAAC,GACzE,QACA,EAAE,OAAO,CACX;CACA,QAAQ,YAAY,KAAA,CAAS;CAC7B,gBAAgB,YAAY,KAAA,CAAS;CACrC,IAAI;EACF,IAAI,QAAQ;EACZ,WAAW,MAAM,SAAS,QAAQ;GAChC,QAAQ,eAAe;GACvB,MAAM,WAAW,SAAS,SAAS,MAAM;GACzC,IACE,CAAC,YACD,MAAM,OAAO,SAAS,UACtB,MAAM,OAAO,SAAS,aAAa,SAAS,UAC5C,MAAM,OAAO,SAAS,SAAS,QAC/B,MAAM,OAAO,SAAS,SAAS,YAE/B,MAAM,IAAI,MAAM,kEAAkE;GAEpF,MAAM,OAAO,cAAc,MAAM,gBAAgB,aAAa,SAAS,IAAI,IAAI,KAAA;GAC/E,IAAI;IACF,gBAAgB,UAAsC;KACpD,MAAM,OAAO,WAAW,QAAQ;KAChC,IAAI,aAAa;KACjB,WAAW,MAAM,SAAS,OAAO;MAC/B,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,0CAA0C;MAC5D,QAAQ,eAAe;MACvB,cAAc,MAAM;MACpB,IAAI,aAAa,SAAU,YACzB,MAAM,IAAI,MAAM,6CAA6C;MAC/D,KAAK,OAAO,KAAK;MACjB,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK;MACpC,MAAM;KACR;KACA,IACE,eAAe,SAAU,cACzB,UAAU,KAAK,OAAO,KAAK,QAAQ,SAAU,QAE7C,MAAM,IAAI,MAAM,kEAAkE;IAEtF;IACA,MAAM,cAAc,WAAW,UAAU,QAAQ,GAAG,MAAM;IAC1D,IAAI,MAAM,MAAM,KAAK,MAAM,SAAS,IAAI;GAC1C,UAAU;IACR,MAAM,MAAM,MAAM;GACpB;EACF;EACA,IAAI,UAAU,SAAS,SAAS,MAAM,QACpC,MAAM,IAAI,MAAM,kEAAkE;EACpF,MAAM;EACN,UAAU,SAAS;EACnB,MAAM,WAAW,MAAM;EACvB,IACE,SAAS,eAAe,SAAS,QAAQ,cACzC,SAAS,WAAW,SAAS,QAAQ,QAErC,MAAM,IAAI,MAAM,0CAA0C;CAE9D,SAAS,OAAO;EACd,OAAO,QAAQ,QAAQ,KAAK,CAAC;EAC7B,UAAU,QAAQ,QAAQ,KAAK,CAAC;EAChC,MAAM,QAAQ,WAAW,CAAC,SAAS,eAAe,CAAC;EACnD,MAAM;CACR;AACF;AAEA,eAAe,gBAAgB,aAAqB,cAAsB;CACxE,MAAM,OAAO,cAAc,aAAa,YAAY;CACpD,MAAM,MAAM,QAAQ,IAAI,GAAG;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CAC3D,OAAO,KACL,MACA,UAAU,WAAW,UAAU,UAAU,UAAU,SAAS,UAAU,YACtE,GACF;AACF;AAEA,gBAAgB,uBACd,MACA,UACA,QAC4B;CAC5B,MAAM,UAAU,KAAK;CACrB,MAAM,WAAW,YAAY;EAC3B,IAAI;GACF,KAAK,MAAM,QAAQ,SAAS,OAAO;IACjC,QAAQ,eAAe;IACvB,MAAM,cAAc,SAAS,MAAM,oBAAoB,MAAM,MAAM,MAAM,GAAG,MAAM;GACpF;GACA,QAAQ,SAAS;EACnB,SAAS,OAAO;GACd,QAAQ,QAAQ,QAAQ,KAAK,CAAC;GAC9B,MAAM;EACR;CACF,EAAA,CAAG;CACH,QAAQ,YAAY,KAAA,CAAS;CAC7B,IAAI;EACF,WAAW,MAAM,SAAS,SAAS;GACjC,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,4CAA4C;GAC9D,QAAQ,eAAe;GACvB,MAAM;EACR;EACA,MAAM;CACR,UAAU;EACR,QAAQ,QAAQ;EAChB,MAAM,QAAQ,YAAY,KAAA,CAAS;CACrC;AACF;AAEA,gBAAgB,oBACd,MACA,UACA,QAC4B;CAC5B,MAAM,OAAO,cAAc,MAAM,SAAS,IAAI;CAC9C,IAAK,MAAM,SAAS,IAAI,MAAO,MAC7B,MAAM,IAAI,MAAM,+CAA+C,SAAS,MAAM;CAChF,MAAM,OAAO,MAAM,KAAK,MAAM,UAAU,WAAW,UAAU,UAAU;CACvE,IAAI;EACF,MAAM,QAAQ,MAAM,KAAK,KAAK;EAC9B,IACE,CAAC,MAAM,OAAO,KACd,MAAM,UAAU,KAChB,MAAM,SAAS,SAAS,eACvB,MAAM,OAAO,SAAW,SAAS,MAElC,MAAM,IAAI,MAAM,0CAA0C,SAAS,MAAM;EAE3E,MAAM,OAAO,WAAW,QAAQ;EAChC,IAAI,aAAa;EACjB,WAAW,MAAM,SAAS,KAAK,iBAAiB;GAC9C,WAAW;GACX,eAAe,KAAK;EACtB,CAAC,GAAG;GACF,QAAQ,eAAe;GACvB,cAAc,MAAM;GACpB,IAAI,aAAa,SAAS,YACxB,MAAM,IAAI,MAAM,0CAA0C,SAAS,MAAM;GAC3E,KAAK,OAAO,KAAK;GACjB,MAAM;EACR;EACA,IAAI,eAAe,SAAS,cAAc,UAAU,KAAK,OAAO,KAAK,QAAQ,SAAS,QACpF,MAAM,IAAI,MAAM,0CAA0C,SAAS,MAAM;CAE7E,UAAU;EACR,MAAM,KAAK,MAAM;CACnB;AACF;AAEA,eAAe,cACb,SACA,MACA,QACA,QACe;CACf,MAAM,QAAQ,QAAQ,MACpB,mBAAmB,aAAa,KAAK,QAAQ,KAAK,MAAM,KAAK,UAAU,CACzE;CACA,MAAM,SAAS,SAAS,KAAK,MAAM,GAAG,OAA2C,EAAE,OAAO,CAAC;AAC7F;AAEA,eAAe,aACb,QACA,UACA,QACA;CACA,MAAM,OAAO,WAAW,QAAQ;CAChC,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,4CAA4C;EAC9D,QAAQ,eAAe;EACvB,cAAc,MAAM;EACpB,IAAI,aAAa,UACf,MAAM,IAAI,MAAM,qDAAqD;EACvE,KAAK,OAAO,KAAK;CACnB;CACA,OAAO;EAAE,QAAQ,UAAU,KAAK,OAAO,KAAK;EAAK;CAAW;AAC9D;AAEA,SAAS,iBACP,UACA,QACM;CACN,IACE,SAAS,SAAS,wCAClB,SAAS,MAAM,SAAS,OAAO,UAE/B,MAAM,IAAI,MAAM,sCAAsC;CACxD,IAAI,QAAQ;CACZ,IAAI;CACJ,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,QAAQ,SAAS,OAAO;EACjC,gBAAgB,KAAK,MAAM,OAAO,YAAY;EAC9C,yBACE,KAAK,MACL,UACA,OACA,qDACF;EACA,WAAW,KAAK;EAChB,IAAI,CAAC,OAAO,cAAc,KAAK,IAAI,KAAK,KAAK,OAAO,KAAK,KAAK,OAAO,KACnE,MAAM,IAAI,MAAM,+CAA+C;EACjE,IACE,CAAC,OAAO,cAAc,KAAK,UAAU,KACrC,KAAK,aAAa,KAClB,KAAK,aAAa,OAAO,cAEzB,MAAM,IAAI,MAAM,+CAA+C;EACjE,SAAS,KAAK;EACd,IAAI,QAAQ,OAAO,mBACjB,MAAM,IAAI,MAAM,+CAA+C;CACnE;AACF;AAEA,gBAAgB,SAAS,OAA+C;CACtE,MAAM;AACR;AACA,SAAS,QAAQ,OAAuB;CACtC,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACjE"}