@tangle-network/agent-runtime 0.314.2 → 0.317.0

package/dist/placement.d.ts

@@ -0,0 +1,132 @@
+import { n as AgentProfileMaterializationAxis, s as ProfileMaterializationContract } from "./profile-materialization-Cca615eu.js";
+import { AgentProfile } from "@tangle-network/agent-interface";
+//#region src/placement/index.d.ts
+/** The policy version every {@link PlacementRecord} carries. */
+declare const PLACEMENT_POLICY = "agent-placement/3";
+/** Where one unit of agent work runs, cheapest first. */
+type ExecutionTier = 'inference' | 'loop' | 'sandbox';
+/** What was chosen, under which policy, why, and why each other tier was refused. */
+interface PlacementRecord {
+  chosen: ExecutionTier;
+  policy: typeof PLACEMENT_POLICY;
+  reason: string;
+  /**
+   * The profile's declared materialization axes the chosen tier carries. A tier that
+   * cannot carry a declared axis is rejected, so on a fresh decision this is every
+   * declared axis; an authored or resumed record makes no coverage decision and is empty.
+   */
+  coveredAxes: AgentProfileMaterializationAxis[];
+  rejected: Array<{
+    placement: ExecutionTier;
+    reason: string;
+  }>;
+}
+/**
+ * The declared requirements of the work, beside its profile. Field names follow
+ * Platform's `agent.run` action, the first consumer; an app's chat turn usually
+ * declares none of them.
+ */
+interface PlacementRequirements {
+  /** A pinned harness. Always runs in the sandbox. */
+  harness?: string;
+  /** A model other than the profile's own needs the sandbox to choose between them. */
+  model?: string;
+  source?: unknown;
+  /** Skill ids resolved into a box. Profile skills are `profile.resources.skills`. */
+  skills?: unknown;
+  env?: unknown;
+  image?: unknown;
+  size?: unknown;
+  resources?: unknown;
+  fromSnapshot?: unknown;
+  fromSandboxId?: unknown;
+  resume?: unknown;
+  maxRounds?: number;
+  ask?: boolean;
+  /** Hub connections: tools the loop holds. */
+  connections?: readonly string[];
+  /** Owner-object grants: tools only the loop holds. */
+  objects?: unknown;
+  /** Public HTTPS reads: a tool only the loop holds. */
+  http?: unknown;
+  /** Tools the caller binds into the loop itself, such as an app's product tools. */
+  tools?: readonly string[];
+}
+/** Which tiers this deployment has wired. */
+interface PlacementContext {
+  interactive: boolean;
+  inferenceAvailable: boolean;
+  loopAvailable: boolean;
+  /** Why the loop cannot take this work, when it cannot. */
+  loopUnavailableReason?: string;
+}
+/** Profile axes a tier may count as covered when their declared value grants nothing. */
+type VacuousAxis = 'permissions';
+interface PlaceExecutionInput {
+  requirements?: PlacementRequirements;
+  /** The RESOLVED profile: a named profile is read before the decision. */
+  profile?: AgentProfile | object;
+  context: PlacementContext;
+  /**
+   * Axes whose deny-only value counts as covered on `inference` and `loop`.
+   * `permissions` qualifies when every rule is `deny`: a tier without native tools
+   * already denies them. Deny-only `tools` are covered without opting in.
+   */
+  vacuousAxes?: readonly VacuousAxis[];
+  /**
+   * The caller inlines the profile's skill content into the loop's context, so
+   * `resources.skills` (with a strict `resources.failOnError`) and the native `skill`
+   * tool and permission that load them count as covered on `loop`. Off by default:
+   * the skills then keep the work in the sandbox.
+   */
+  inlineSkills?: boolean;
+}
+/** No tier can meet every declared requirement. Raised before any spend. */
+declare class PlacementRefusedError extends Error {
+  readonly reason: string;
+  constructor(reason: string);
+}
+/**
+ * The profile axes `inference` and `loop` carry: identity, prompt, model controls and
+ * metadata. No harness, native tools, files, MCP, subagents, hooks or modes.
+ */
+declare const loopTierProfileMaterialization: ProfileMaterializationContract;
+/** Options for {@link loopProfileRefusal}. */
+interface LoopProfileRefusalOptions {
+  vacuousAxes?: readonly VacuousAxis[];
+  inlineSkills?: boolean;
+}
+/**
+ * Why `inference` and `loop` cannot run this profile, or undefined when they can.
+ * A profile that needs a harness, files, harness built-in tools, MCP servers,
+ * subagents, hooks or modes needs a sandbox; the loop never drops one silently.
+ * Platform's `workerProfileRefusal`, read through {@link loopTierProfileMaterialization}.
+ */
+declare function loopProfileRefusal(profile: object, options?: LoopProfileRefusalOptions): string | undefined;
+/** Options for {@link sandboxOnlyRequirements}. */
+interface SandboxOnlyRequirementsOptions extends LoopProfileRefusalOptions {
+  requirements?: PlacementRequirements;
+  profile?: AgentProfile | object;
+  interactive: boolean;
+}
+/**
+ * Every declared requirement only a sandbox can meet. A caller resuming work in the
+ * loop it began in checks this is empty before it continues there.
+ */
+declare function sandboxOnlyRequirements(options: SandboxOnlyRequirementsOptions): string[];
+/**
+ * Choose where work runs: the cheapest tier every declared requirement allows.
+ * Throws {@link PlacementRefusedError} when no tier can meet every requirement.
+ */
+declare function placeExecution(input: PlaceExecutionInput): PlacementRecord;
+/** The record for a tier the author named: nothing was chosen or refused. */
+declare function authoredPlacement(chosen: ExecutionTier): PlacementRecord;
+/**
+ * The record for work that resumes under the tier it began with. A retry reuses the
+ * recorded tier and never re-decides, so one turn never runs on two tiers; a caller
+ * resuming on `loop` first checks {@link sandboxOnlyRequirements} is empty.
+ */
+declare function resumedPlacement(chosen: ExecutionTier): PlacementRecord;
+//#endregion
+export { ExecutionTier, LoopProfileRefusalOptions, PLACEMENT_POLICY, PlaceExecutionInput, PlacementContext, PlacementRecord, PlacementRefusedError, PlacementRequirements, SandboxOnlyRequirementsOptions, VacuousAxis, authoredPlacement, loopProfileRefusal, loopTierProfileMaterialization, placeExecution, resumedPlacement, sandboxOnlyRequirements };
+//# sourceMappingURL=placement.d.ts.map

package/dist/placement.js

@@ -0,0 +1,319 @@
+//#region src/placement/index.ts
+/** The policy version every {@link PlacementRecord} carries. */
+const PLACEMENT_POLICY = "agent-placement/3";
+/** No tier can meet every declared requirement. Raised before any spend. */
+var PlacementRefusedError = class extends Error {
+	reason;
+	constructor(reason) {
+		super(`placement cannot run this work — ${reason}`);
+		this.reason = reason;
+		this.name = "PlacementRefusedError";
+	}
+};
+/**
+* The profile axes `inference` and `loop` carry: identity, prompt, model controls and
+* metadata. No harness, native tools, files, MCP, subagents, hooks or modes.
+*/
+const loopTierProfileMaterialization = {
+	name: "placement-loop-tier",
+	axes: [
+		"name",
+		"description",
+		"version",
+		"tags",
+		"systemPrompt",
+		"appendSystemPrompt",
+		"instructions",
+		"modelDefault",
+		"modelSmall",
+		"modelProvider",
+		"modelReasoningEffort",
+		"modelMaxVisibleOutputTokens",
+		"modelMaxTotalOutputTokens",
+		"modelMetadata",
+		"metadata"
+	]
+};
+/** Compound profile properties and the axis each child maps to. */
+const COMPOUND_FIELDS = {
+	prompt: {
+		systemPrompt: "systemPrompt",
+		appendSystemPrompt: "appendSystemPrompt",
+		instructions: "instructions"
+	},
+	model: {
+		default: "modelDefault",
+		small: "modelSmall",
+		provider: "modelProvider",
+		reasoningEffort: "modelReasoningEffort",
+		maxVisibleOutputTokens: "modelMaxVisibleOutputTokens",
+		maxReasoningTokens: "modelMaxReasoningTokens",
+		maxTotalOutputTokens: "modelMaxTotalOutputTokens",
+		metadata: "modelMetadata"
+	},
+	resources: {
+		files: "files",
+		tools: "resourceTools",
+		skills: "skills",
+		agents: "resourceAgents",
+		commands: "commands",
+		instructions: "resourceInstructions",
+		failOnError: "resourceFailOnError"
+	}
+};
+/** Top-level profile properties that are themselves an axis (the rest are compounds). */
+const TOP_LEVEL_AXES = /* @__PURE__ */ new Set([
+	"name",
+	"description",
+	"version",
+	"tags",
+	"harness",
+	"seats",
+	"permissions",
+	"tools",
+	"mcp",
+	"connections",
+	"subagents",
+	"hooks",
+	"modes",
+	"confidential",
+	"metadata",
+	"extensions"
+]);
+/**
+* Why `inference` and `loop` cannot run this profile, or undefined when they can.
+* A profile that needs a harness, files, harness built-in tools, MCP servers,
+* subagents, hooks or modes needs a sandbox; the loop never drops one silently.
+* Platform's `workerProfileRefusal`, read through {@link loopTierProfileMaterialization}.
+*/
+function loopProfileRefusal(profile, options = {}) {
+	const fields = profile;
+	const vacuousPermissions = options.vacuousAxes?.includes("permissions") === true;
+	const inlineSkills = options.inlineSkills === true;
+	const carried = new Set(loopTierProfileMaterialization.axes);
+	if (inlineSkills) carried.add("skills");
+	const childCovered = (field, child, value) => {
+		const axis = COMPOUND_FIELDS[field]?.[child];
+		if (axis === void 0) return false;
+		if (axis === "resourceFailOnError") return inlineSkills && value === true;
+		return carried.has(axis);
+	};
+	const reasons = [];
+	for (const [field, value] of Object.entries(fields)) {
+		if (value === void 0) continue;
+		if (field === "tools") continue;
+		if (field === "permissions" && vacuousPermissions && permissionsGrantNothing(value, inlineSkills)) continue;
+		if (TOP_LEVEL_AXES.has(field) && carried.has(field)) continue;
+		const children = COMPOUND_FIELDS[field];
+		if (children && Object.values(children).some((axis) => carried.has(axis))) continue;
+		reasons.push(`profile ${field} needs a sandbox`);
+	}
+	for (const field of Object.keys(COMPOUND_FIELDS)) {
+		const value = fields[field];
+		if (typeof value !== "object" || value === null) continue;
+		if (!Object.values(COMPOUND_FIELDS[field] ?? {}).some((axis) => carried.has(axis))) continue;
+		for (const [child, inner] of Object.entries(value)) if (inner !== void 0 && !childCovered(field, child, inner)) reasons.push(`profile ${field}.${child} is not supported by the worker`);
+	}
+	const tools = fields.tools;
+	if (typeof tools === "object" && tools !== null) {
+		const enabled = Object.entries(tools).filter(([name, on]) => on === true && !(inlineSkills && name === "skill")).map(([name]) => name);
+		if (enabled.length > 0) reasons.push(`profile tools ${enabled.join(", ")} need a sandbox`);
+	}
+	return reasons.length > 0 ? reasons.join("; ") : void 0;
+}
+/** True when every permission rule denies, or allows only `skill` under inlined skills. */
+function permissionsGrantNothing(value, inlineSkills) {
+	if (typeof value !== "object" || value === null) return false;
+	return Object.entries(value).every(([tool, rule]) => {
+		if (inlineSkills && tool === "skill") return true;
+		if (rule === "deny") return true;
+		if (typeof rule !== "object" || rule === null) return false;
+		return Object.values(rule).every((inner) => inner === "deny");
+	});
+}
+/** Requirement fields that only mean something inside a provisioned box. */
+const SANDBOX_FIELDS = [
+	"source",
+	"skills",
+	"env",
+	"image",
+	"size",
+	"resources",
+	"fromSnapshot",
+	"fromSandboxId",
+	"resume"
+];
+/** Every declared requirement only a sandbox can meet, in field order. */
+function sandboxRequirements(options) {
+	const { requirements: cfg, profile } = options;
+	const needs = [];
+	if (options.interactive) needs.push("interactive run needs a session");
+	if (cfg.harness !== void 0) needs.push(`harness ${cfg.harness} is pinned`);
+	for (const field of SANDBOX_FIELDS) if (cfg[field] !== void 0) needs.push(`${field} needs a sandbox`);
+	if (cfg.maxRounds !== void 0 && cfg.maxRounds > 1) needs.push("maxRounds > 1 needs a multi-round session");
+	if (cfg.ask === true) needs.push("ask needs a session to answer into");
+	const refusal = profile ? loopProfileRefusal(profile, options) : void 0;
+	if (refusal) needs.push(refusal);
+	const profileModel = profileDefaultModel(profile);
+	if (cfg.model !== void 0 && profileModel !== void 0 && cfg.model !== profileModel) needs.push(`the action model ${cfg.model} differs from the profile model ${String(profileModel)}`);
+	return needs;
+}
+function profileDefaultModel(profile) {
+	return profile?.model?.default;
+}
+/**
+* Every declared requirement only a sandbox can meet. A caller resuming work in the
+* loop it began in checks this is empty before it continues there.
+*/
+function sandboxOnlyRequirements(options) {
+	return sandboxRequirements({
+		...options,
+		requirements: options.requirements ?? {}
+	});
+}
+/** Tools the work grants, each of which the loop can hold. */
+function toolRequirements(cfg) {
+	const tools = [];
+	if ((cfg.connections ?? []).length > 0) tools.push("connections need Hub tools");
+	if (cfg.objects !== void 0) tools.push("objects need object tools");
+	if (cfg.http !== void 0) tools.push("http needs a fetch tool");
+	if ((cfg.tools ?? []).length > 0) tools.push(`tools ${cfg.tools?.join(", ")} need the loop`);
+	return tools;
+}
+/** Grants only the loop holds: a sandbox cannot honour them. */
+function loopOnlyGrants(cfg) {
+	return [...cfg.objects !== void 0 ? ["objects"] : [], ...cfg.http !== void 0 ? ["http"] : []];
+}
+/** True when the profile declares skills that only an inliner on the loop can carry. */
+function declaresProfileSkills(profile) {
+	const fields = profile ?? {};
+	const skills = fields.resources?.skills;
+	return Array.isArray(skills) && skills.length > 0 || fields.tools?.skill === true || fields.permissions?.skill !== void 0 && fields.permissions.skill !== "deny";
+}
+/**
+* Choose where work runs: the cheapest tier every declared requirement allows.
+* Throws {@link PlacementRefusedError} when no tier can meet every requirement.
+*/
+function placeExecution(input) {
+	const cfg = input.requirements ?? {};
+	const { context, profile } = input;
+	const opts = {
+		...input.vacuousAxes ? { vacuousAxes: input.vacuousAxes } : {},
+		...input.inlineSkills ? { inlineSkills: true } : {}
+	};
+	const sandboxNeeds = sandboxRequirements({
+		requirements: cfg,
+		profile,
+		interactive: context.interactive,
+		...opts
+	});
+	const tools = toolRequirements(cfg);
+	if (input.inlineSkills && declaresProfileSkills(profile)) tools.push("skills are inlined by the loop");
+	const loopOnly = loopOnlyGrants(cfg);
+	const coveredAxes = profile ? declaredAxes(profile) : [];
+	const record = (chosen, reason, rejected) => ({
+		chosen,
+		policy: PLACEMENT_POLICY,
+		reason,
+		coveredAxes,
+		rejected
+	});
+	if (sandboxNeeds.length > 0) {
+		const reason = sandboxNeeds.join("; ");
+		if (loopOnly.length > 0) throw new PlacementRefusedError(`${loopOnly.join(" and ")} run only in the worker, but ${reason}`);
+		return record("sandbox", reason, [{
+			placement: "inference",
+			reason
+		}, {
+			placement: "loop",
+			reason
+		}]);
+	}
+	if (tools.length > 0) {
+		const reason = `${tools.join("; ")}, which the worker holds without a sandbox`;
+		if (!context.loopAvailable) {
+			const unavailable = context.loopUnavailableReason ?? "worker placement is not wired on this deployment";
+			if (loopOnly.length > 0) throw new PlacementRefusedError(`${loopOnly.join(" and ")} need the worker, but ${unavailable}`);
+			return record("sandbox", unavailable, [{
+				placement: "inference",
+				reason: tools.join("; ")
+			}, {
+				placement: "loop",
+				reason: unavailable
+			}]);
+		}
+		return record("loop", reason, [{
+			placement: "inference",
+			reason: tools.join("; ")
+		}, {
+			placement: "sandbox",
+			reason: "costs more and no declared requirement needs it"
+		}]);
+	}
+	if (context.inferenceAvailable) return record("inference", "no declared requirement needs tools, files or a session", [{
+		placement: "loop",
+		reason: "no declared tool needs a loop"
+	}, {
+		placement: "sandbox",
+		reason: "costs more and no declared requirement needs it"
+	}]);
+	const unwired = "inference is not wired on this deployment";
+	if (context.loopAvailable) return record("loop", `${unwired}; one tool-free worker turn`, [{
+		placement: "inference",
+		reason: unwired
+	}, {
+		placement: "sandbox",
+		reason: "costs more and no declared requirement needs it"
+	}]);
+	return record("sandbox", unwired, [{
+		placement: "inference",
+		reason: unwired
+	}, {
+		placement: "loop",
+		reason: "worker placement is not wired on this deployment"
+	}]);
+}
+/** The materialization axes a profile declares, in its own field order. Read from the
+*  same field map as {@link loopProfileRefusal}, so the module has no runtime import. */
+function declaredAxes(profile) {
+	const axes = [];
+	for (const [field, value] of Object.entries(profile)) {
+		if (value === void 0) continue;
+		if (TOP_LEVEL_AXES.has(field)) axes.push(field);
+		const children = COMPOUND_FIELDS[field];
+		if (!children || typeof value !== "object" || value === null) continue;
+		for (const [child, inner] of Object.entries(value)) {
+			const axis = children[child];
+			if (axis !== void 0 && inner !== void 0) axes.push(axis);
+		}
+	}
+	return axes;
+}
+/** The record for a tier the author named: nothing was chosen or refused. */
+function authoredPlacement(chosen) {
+	return {
+		chosen,
+		policy: PLACEMENT_POLICY,
+		reason: `authored placement: ${chosen}`,
+		coveredAxes: [],
+		rejected: []
+	};
+}
+/**
+* The record for work that resumes under the tier it began with. A retry reuses the
+* recorded tier and never re-decides, so one turn never runs on two tiers; a caller
+* resuming on `loop` first checks {@link sandboxOnlyRequirements} is empty.
+*/
+function resumedPlacement(chosen) {
+	return {
+		chosen,
+		policy: PLACEMENT_POLICY,
+		reason: `resumed under the placement it began with: ${chosen}`,
+		coveredAxes: [],
+		rejected: []
+	};
+}
+//#endregion
+export { PLACEMENT_POLICY, PlacementRefusedError, authoredPlacement, loopProfileRefusal, loopTierProfileMaterialization, placeExecution, resumedPlacement, sandboxOnlyRequirements };
+
+//# sourceMappingURL=placement.js.map

package/dist/placement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"placement.js","names":[],"sources":["../src/placement/index.ts"],"sourcesContent":["/**\n * Execution placement: choose the cheapest executor whose declared capabilities\n * cover the work, before any key, sandbox or model call.\n *\n * A pure decision over DECLARED data — the work's requirements and its resolved\n * {@link AgentProfile}. It never reads the prompt and does no I/O, so it is safe\n * in a Worker or Durable Object and costs nothing on the path to the first word.\n * Tiers, cheapest first:\n *  - `inference`: one Router call, when nothing needs a tool, a file or a session;\n *  - `loop`: the Runtime tool loop in the caller's own process (a Worker or the\n *    Platform workflow worker), when the only tools are ones that loop holds;\n *  - `sandbox`: anything that needs a harness, a filesystem, a shell, files, MCP\n *    servers, subagents, hooks or an interactive session.\n * A requirement no tier can meet refuses the work by name\n * ({@link PlacementRefusedError}); a capability is never dropped silently, and a\n * pinned harness always runs in the sandbox.\n *\n * This is Platform's `agent-placement/2` (`selectAgentPlacement` and\n * `workerProfileRefusal`) moved here unchanged in semantics. Its reason strings\n * are kept byte-identical so a shadow comparison against Platform's copy reads\n * equal; only the tier name changes (`worker` → `loop`). `agent-placement/3`\n * adds two caller opt-ins, both off by default:\n *  - {@link PlaceExecutionInput.vacuousAxes}: a deny-only `permissions` map asks\n *    for nothing a tier lacks, so it counts as covered;\n *  - {@link PlaceExecutionInput.inlineSkills}: profile skills count as covered on\n *    `loop` when the caller inlines their content.\n */\n\nimport type { AgentProfile } from '@tangle-network/agent-interface'\nimport type {\n  AgentProfileMaterializationAxis,\n  ProfileMaterializationContract,\n} from '../agent/profile-materialization'\n\n/** The policy version every {@link PlacementRecord} carries. */\nexport const PLACEMENT_POLICY = 'agent-placement/3'\n\n/** Where one unit of agent work runs, cheapest first. */\nexport type ExecutionTier = 'inference' | 'loop' | 'sandbox'\n\n/** What was chosen, under which policy, why, and why each other tier was refused. */\nexport interface PlacementRecord {\n  chosen: ExecutionTier\n  policy: typeof PLACEMENT_POLICY\n  reason: string\n  /**\n   * The profile's declared materialization axes the chosen tier carries. A tier that\n   * cannot carry a declared axis is rejected, so on a fresh decision this is every\n   * declared axis; an authored or resumed record makes no coverage decision and is empty.\n   */\n  coveredAxes: AgentProfileMaterializationAxis[]\n  rejected: Array<{ placement: ExecutionTier; reason: string }>\n}\n\n/**\n * The declared requirements of the work, beside its profile. Field names follow\n * Platform's `agent.run` action, the first consumer; an app's chat turn usually\n * declares none of them.\n */\nexport interface PlacementRequirements {\n  /** A pinned harness. Always runs in the sandbox. */\n  harness?: string\n  /** A model other than the profile's own needs the sandbox to choose between them. */\n  model?: string\n  source?: unknown\n  /** Skill ids resolved into a box. Profile skills are `profile.resources.skills`. */\n  skills?: unknown\n  env?: unknown\n  image?: unknown\n  size?: unknown\n  resources?: unknown\n  fromSnapshot?: unknown\n  fromSandboxId?: unknown\n  resume?: unknown\n  maxRounds?: number\n  ask?: boolean\n  /** Hub connections: tools the loop holds. */\n  connections?: readonly string[]\n  /** Owner-object grants: tools only the loop holds. */\n  objects?: unknown\n  /** Public HTTPS reads: a tool only the loop holds. */\n  http?: unknown\n  /** Tools the caller binds into the loop itself, such as an app's product tools. */\n  tools?: readonly string[]\n}\n\n/** Which tiers this deployment has wired. */\nexport interface PlacementContext {\n  interactive: boolean\n  inferenceAvailable: boolean\n  loopAvailable: boolean\n  /** Why the loop cannot take this work, when it cannot. */\n  loopUnavailableReason?: string\n}\n\n/** Profile axes a tier may count as covered when their declared value grants nothing. */\nexport type VacuousAxis = 'permissions'\n\nexport interface PlaceExecutionInput {\n  requirements?: PlacementRequirements\n  /** The RESOLVED profile: a named profile is read before the decision. */\n  profile?: AgentProfile | object\n  context: PlacementContext\n  /**\n   * Axes whose deny-only value counts as covered on `inference` and `loop`.\n   * `permissions` qualifies when every rule is `deny`: a tier without native tools\n   * already denies them. Deny-only `tools` are covered without opting in.\n   */\n  vacuousAxes?: readonly VacuousAxis[]\n  /**\n   * The caller inlines the profile's skill content into the loop's context, so\n   * `resources.skills` (with a strict `resources.failOnError`) and the native `skill`\n   * tool and permission that load them count as covered on `loop`. Off by default:\n   * the skills then keep the work in the sandbox.\n   */\n  inlineSkills?: boolean\n}\n\n/** No tier can meet every declared requirement. Raised before any spend. */\nexport class PlacementRefusedError extends Error {\n  constructor(readonly reason: string) {\n    super(`placement cannot run this work — ${reason}`)\n    this.name = 'PlacementRefusedError'\n  }\n}\n\n/**\n * The profile axes `inference` and `loop` carry: identity, prompt, model controls and\n * metadata. No harness, native tools, files, MCP, subagents, hooks or modes.\n */\nexport const loopTierProfileMaterialization: ProfileMaterializationContract = {\n  name: 'placement-loop-tier',\n  axes: [\n    'name',\n    'description',\n    'version',\n    'tags',\n    'systemPrompt',\n    'appendSystemPrompt',\n    'instructions',\n    'modelDefault',\n    'modelSmall',\n    'modelProvider',\n    'modelReasoningEffort',\n    'modelMaxVisibleOutputTokens',\n    'modelMaxTotalOutputTokens',\n    'modelMetadata',\n    'metadata',\n  ],\n}\n\n/** Compound profile properties and the axis each child maps to. */\nconst COMPOUND_FIELDS: Record<string, Record<string, AgentProfileMaterializationAxis>> = {\n  prompt: {\n    systemPrompt: 'systemPrompt',\n    appendSystemPrompt: 'appendSystemPrompt',\n    instructions: 'instructions',\n  },\n  model: {\n    default: 'modelDefault',\n    small: 'modelSmall',\n    provider: 'modelProvider',\n    reasoningEffort: 'modelReasoningEffort',\n    maxVisibleOutputTokens: 'modelMaxVisibleOutputTokens',\n    maxReasoningTokens: 'modelMaxReasoningTokens',\n    maxTotalOutputTokens: 'modelMaxTotalOutputTokens',\n    metadata: 'modelMetadata',\n  },\n  resources: {\n    files: 'files',\n    tools: 'resourceTools',\n    skills: 'skills',\n    agents: 'resourceAgents',\n    commands: 'commands',\n    instructions: 'resourceInstructions',\n    failOnError: 'resourceFailOnError',\n  },\n}\n\n/** Top-level profile properties that are themselves an axis (the rest are compounds). */\nconst TOP_LEVEL_AXES: ReadonlySet<string> = new Set([\n  'name',\n  'description',\n  'version',\n  'tags',\n  'harness',\n  'seats',\n  'permissions',\n  'tools',\n  'mcp',\n  'connections',\n  'subagents',\n  'hooks',\n  'modes',\n  'confidential',\n  'metadata',\n  'extensions',\n])\n\n/** Options for {@link loopProfileRefusal}. */\nexport interface LoopProfileRefusalOptions {\n  vacuousAxes?: readonly VacuousAxis[]\n  inlineSkills?: boolean\n}\n\n/**\n * Why `inference` and `loop` cannot run this profile, or undefined when they can.\n * A profile that needs a harness, files, harness built-in tools, MCP servers,\n * subagents, hooks or modes needs a sandbox; the loop never drops one silently.\n * Platform's `workerProfileRefusal`, read through {@link loopTierProfileMaterialization}.\n */\nexport function loopProfileRefusal(\n  profile: object,\n  options: LoopProfileRefusalOptions = {},\n): string | undefined {\n  const fields = profile as Record<string, unknown>\n  const vacuousPermissions = options.vacuousAxes?.includes('permissions') === true\n  const inlineSkills = options.inlineSkills === true\n  const carried = new Set<string>(loopTierProfileMaterialization.axes)\n  if (inlineSkills) carried.add('skills')\n  const childCovered = (field: string, child: string, value: unknown): boolean => {\n    const axis = COMPOUND_FIELDS[field]?.[child]\n    if (axis === undefined) return false\n    // A strict failure policy is honoured by an inliner that fails closed; a best-effort\n    // one would have to report a skipped skill, which the loop has no channel for.\n    if (axis === 'resourceFailOnError') return inlineSkills && value === true\n    return carried.has(axis)\n  }\n  const reasons: string[] = []\n  for (const [field, value] of Object.entries(fields)) {\n    if (value === undefined) continue\n    if (field === 'tools') continue\n    if (\n      field === 'permissions' &&\n      vacuousPermissions &&\n      permissionsGrantNothing(value, inlineSkills)\n    )\n      continue\n    if (TOP_LEVEL_AXES.has(field) && carried.has(field)) continue\n    const children = COMPOUND_FIELDS[field]\n    if (children && Object.values(children).some((axis) => carried.has(axis))) continue\n    reasons.push(`profile ${field} needs a sandbox`)\n  }\n  for (const field of Object.keys(COMPOUND_FIELDS)) {\n    const value = fields[field]\n    if (typeof value !== 'object' || value === null) continue\n    // A compound the loop carries none of was refused whole above.\n    if (!Object.values(COMPOUND_FIELDS[field] ?? {}).some((axis) => carried.has(axis))) continue\n    for (const [child, inner] of Object.entries(value)) {\n      if (inner !== undefined && !childCovered(field, child, inner)) {\n        reasons.push(`profile ${field}.${child} is not supported by the worker`)\n      }\n    }\n  }\n  // Harness built-in tools (shell, edit, browser) exist only in a sandbox. A profile may\n  // still switch them off. The `skill` tool only loads skills, which an inliner supplies.\n  const tools = fields.tools\n  if (typeof tools === 'object' && tools !== null) {\n    const enabled = Object.entries(tools)\n      .filter(([name, on]) => on === true && !(inlineSkills && name === 'skill'))\n      .map(([name]) => name)\n    if (enabled.length > 0) reasons.push(`profile tools ${enabled.join(', ')} need a sandbox`)\n  }\n  return reasons.length > 0 ? reasons.join('; ') : undefined\n}\n\n/** True when every permission rule denies, or allows only `skill` under inlined skills. */\nfunction permissionsGrantNothing(value: unknown, inlineSkills: boolean): boolean {\n  if (typeof value !== 'object' || value === null) return false\n  return Object.entries(value).every(([tool, rule]) => {\n    if (inlineSkills && tool === 'skill') return true\n    if (rule === 'deny') return true\n    if (typeof rule !== 'object' || rule === null) return false\n    return Object.values(rule).every((inner) => inner === 'deny')\n  })\n}\n\n/** Requirement fields that only mean something inside a provisioned box. */\nconst SANDBOX_FIELDS = [\n  'source',\n  'skills',\n  'env',\n  'image',\n  'size',\n  'resources',\n  'fromSnapshot',\n  'fromSandboxId',\n  'resume',\n] as const satisfies ReadonlyArray<keyof PlacementRequirements>\n\ninterface RequirementOptions extends LoopProfileRefusalOptions {\n  requirements: PlacementRequirements\n  profile?: object\n  interactive: boolean\n}\n\n/** Every declared requirement only a sandbox can meet, in field order. */\nfunction sandboxRequirements(options: RequirementOptions): string[] {\n  const { requirements: cfg, profile } = options\n  const needs: string[] = []\n  if (options.interactive) needs.push('interactive run needs a session')\n  if (cfg.harness !== undefined) needs.push(`harness ${cfg.harness} is pinned`)\n  for (const field of SANDBOX_FIELDS) {\n    if (cfg[field] !== undefined) needs.push(`${field} needs a sandbox`)\n  }\n  if (cfg.maxRounds !== undefined && cfg.maxRounds > 1)\n    needs.push('maxRounds > 1 needs a multi-round session')\n  if (cfg.ask === true) needs.push('ask needs a session to answer into')\n  const refusal = profile ? loopProfileRefusal(profile, options) : undefined\n  if (refusal) needs.push(refusal)\n  // Inference and the loop run the profile's own model and refuse another; only the\n  // sandbox decides between a requested model and the profile's.\n  const profileModel = profileDefaultModel(profile)\n  if (cfg.model !== undefined && profileModel !== undefined && cfg.model !== profileModel) {\n    needs.push(\n      `the action model ${cfg.model} differs from the profile model ${String(profileModel)}`,\n    )\n  }\n  return needs\n}\n\nfunction profileDefaultModel(profile: object | undefined): unknown {\n  return (profile as { model?: { default?: unknown } } | undefined)?.model?.default\n}\n\n/** Options for {@link sandboxOnlyRequirements}. */\nexport interface SandboxOnlyRequirementsOptions extends LoopProfileRefusalOptions {\n  requirements?: PlacementRequirements\n  profile?: AgentProfile | object\n  interactive: boolean\n}\n\n/**\n * Every declared requirement only a sandbox can meet. A caller resuming work in the\n * loop it began in checks this is empty before it continues there.\n */\nexport function sandboxOnlyRequirements(options: SandboxOnlyRequirementsOptions): string[] {\n  return sandboxRequirements({ ...options, requirements: options.requirements ?? {} })\n}\n\n/** Tools the work grants, each of which the loop can hold. */\nfunction toolRequirements(cfg: PlacementRequirements): string[] {\n  const tools: string[] = []\n  if ((cfg.connections ?? []).length > 0) tools.push('connections need Hub tools')\n  if (cfg.objects !== undefined) tools.push('objects need object tools')\n  if (cfg.http !== undefined) tools.push('http needs a fetch tool')\n  if ((cfg.tools ?? []).length > 0) tools.push(`tools ${cfg.tools?.join(', ')} need the loop`)\n  return tools\n}\n\n/** Grants only the loop holds: a sandbox cannot honour them. */\nfunction loopOnlyGrants(cfg: PlacementRequirements): string[] {\n  return [\n    ...(cfg.objects !== undefined ? ['objects'] : []),\n    ...(cfg.http !== undefined ? ['http'] : []),\n  ]\n}\n\n/** True when the profile declares skills that only an inliner on the loop can carry. */\nfunction declaresProfileSkills(profile: object | undefined): boolean {\n  const fields = (profile ?? {}) as {\n    resources?: { skills?: unknown }\n    tools?: Record<string, unknown>\n    permissions?: Record<string, unknown>\n  }\n  const skills = fields.resources?.skills\n  return (\n    (Array.isArray(skills) && skills.length > 0) ||\n    fields.tools?.skill === true ||\n    (fields.permissions?.skill !== undefined && fields.permissions.skill !== 'deny')\n  )\n}\n\n/**\n * Choose where work runs: the cheapest tier every declared requirement allows.\n * Throws {@link PlacementRefusedError} when no tier can meet every requirement.\n */\nexport function placeExecution(input: PlaceExecutionInput): PlacementRecord {\n  const cfg = input.requirements ?? {}\n  const { context, profile } = input\n  const opts: LoopProfileRefusalOptions = {\n    ...(input.vacuousAxes ? { vacuousAxes: input.vacuousAxes } : {}),\n    ...(input.inlineSkills ? { inlineSkills: true } : {}),\n  }\n  const sandboxNeeds = sandboxRequirements({\n    requirements: cfg,\n    profile,\n    interactive: context.interactive,\n    ...opts,\n  })\n  const tools = toolRequirements(cfg)\n  if (input.inlineSkills && declaresProfileSkills(profile))\n    tools.push('skills are inlined by the loop')\n  const loopOnly = loopOnlyGrants(cfg)\n  const coveredAxes = profile ? declaredAxes(profile) : []\n  const record = (\n    chosen: ExecutionTier,\n    reason: string,\n    rejected: PlacementRecord['rejected'],\n  ): PlacementRecord => ({ chosen, policy: PLACEMENT_POLICY, reason, coveredAxes, rejected })\n\n  if (sandboxNeeds.length > 0) {\n    const reason = sandboxNeeds.join('; ')\n    if (loopOnly.length > 0) {\n      throw new PlacementRefusedError(\n        `${loopOnly.join(' and ')} run only in the worker, but ${reason}`,\n      )\n    }\n    return record('sandbox', reason, [\n      { placement: 'inference', reason },\n      { placement: 'loop', reason },\n    ])\n  }\n\n  // Past the sandbox check the profile is one the loop (and a single Router call) can\n  // honour, so only granted tools separate the two.\n  if (tools.length > 0) {\n    const reason = `${tools.join('; ')}, which the worker holds without a sandbox`\n    if (!context.loopAvailable) {\n      const unavailable =\n        context.loopUnavailableReason ?? 'worker placement is not wired on this deployment'\n      if (loopOnly.length > 0) {\n        throw new PlacementRefusedError(\n          `${loopOnly.join(' and ')} need the worker, but ${unavailable}`,\n        )\n      }\n      // Inlined skills are the one loop need a sandbox also meets, natively.\n      return record('sandbox', unavailable, [\n        { placement: 'inference', reason: tools.join('; ') },\n        { placement: 'loop', reason: unavailable },\n      ])\n    }\n    return record('loop', reason, [\n      { placement: 'inference', reason: tools.join('; ') },\n      { placement: 'sandbox', reason: 'costs more and no declared requirement needs it' },\n    ])\n  }\n\n  if (context.inferenceAvailable) {\n    return record('inference', 'no declared requirement needs tools, files or a session', [\n      { placement: 'loop', reason: 'no declared tool needs a loop' },\n      { placement: 'sandbox', reason: 'costs more and no declared requirement needs it' },\n    ])\n  }\n  const unwired = 'inference is not wired on this deployment'\n  if (context.loopAvailable) {\n    return record('loop', `${unwired}; one tool-free worker turn`, [\n      { placement: 'inference', reason: unwired },\n      { placement: 'sandbox', reason: 'costs more and no declared requirement needs it' },\n    ])\n  }\n  return record('sandbox', unwired, [\n    { placement: 'inference', reason: unwired },\n    { placement: 'loop', reason: 'worker placement is not wired on this deployment' },\n  ])\n}\n\n/** The materialization axes a profile declares, in its own field order. Read from the\n *  same field map as {@link loopProfileRefusal}, so the module has no runtime import. */\nfunction declaredAxes(profile: object): AgentProfileMaterializationAxis[] {\n  const axes: AgentProfileMaterializationAxis[] = []\n  for (const [field, value] of Object.entries(profile)) {\n    if (value === undefined) continue\n    if (TOP_LEVEL_AXES.has(field)) axes.push(field as AgentProfileMaterializationAxis)\n    const children = COMPOUND_FIELDS[field]\n    if (!children || typeof value !== 'object' || value === null) continue\n    for (const [child, inner] of Object.entries(value)) {\n      const axis = children[child]\n      if (axis !== undefined && inner !== undefined) axes.push(axis)\n    }\n  }\n  return axes\n}\n\n/** The record for a tier the author named: nothing was chosen or refused. */\nexport function authoredPlacement(chosen: ExecutionTier): PlacementRecord {\n  return {\n    chosen,\n    policy: PLACEMENT_POLICY,\n    reason: `authored placement: ${chosen}`,\n    coveredAxes: [],\n    rejected: [],\n  }\n}\n\n/**\n * The record for work that resumes under the tier it began with. A retry reuses the\n * recorded tier and never re-decides, so one turn never runs on two tiers; a caller\n * resuming on `loop` first checks {@link sandboxOnlyRequirements} is empty.\n */\nexport function resumedPlacement(chosen: ExecutionTier): PlacementRecord {\n  return {\n    chosen,\n    policy: PLACEMENT_POLICY,\n    reason: `resumed under the placement it began with: ${chosen}`,\n    coveredAxes: [],\n    rejected: [],\n  }\n}\n"],"mappings":";;AAmCA,MAAa,mBAAmB;;AAoFhC,IAAa,wBAAb,cAA2C,MAAM;CAC1B;CAArB,YAAY,QAAyB;EACnC,MAAM,oCAAoC,QAAQ;EAD/B,KAAA,SAAA;EAEnB,KAAK,OAAO;CACd;AACF;;;;;AAMA,MAAa,iCAAiE;CAC5E,MAAM;CACN,MAAM;EACJ;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;AAGA,MAAM,kBAAmF;CACvF,QAAQ;EACN,cAAc;EACd,oBAAoB;EACpB,cAAc;CAChB;CACA,OAAO;EACL,SAAS;EACT,OAAO;EACP,UAAU;EACV,iBAAiB;EACjB,wBAAwB;EACxB,oBAAoB;EACpB,sBAAsB;EACtB,UAAU;CACZ;CACA,WAAW;EACT,OAAO;EACP,OAAO;EACP,QAAQ;EACR,QAAQ;EACR,UAAU;EACV,cAAc;EACd,aAAa;CACf;AACF;;AAGA,MAAM,iCAAsC,IAAI,IAAI;CAClD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;AAcD,SAAgB,mBACd,SACA,UAAqC,CAAC,GAClB;CACpB,MAAM,SAAS;CACf,MAAM,qBAAqB,QAAQ,aAAa,SAAS,aAAa,MAAM;CAC5E,MAAM,eAAe,QAAQ,iBAAiB;CAC9C,MAAM,UAAU,IAAI,IAAY,+BAA+B,IAAI;CACnE,IAAI,cAAc,QAAQ,IAAI,QAAQ;CACtC,MAAM,gBAAgB,OAAe,OAAe,UAA4B;EAC9E,MAAM,OAAO,gBAAgB,MAAM,GAAG;EACtC,IAAI,SAAS,KAAA,GAAW,OAAO;EAG/B,IAAI,SAAS,uBAAuB,OAAO,gBAAgB,UAAU;EACrE,OAAO,QAAQ,IAAI,IAAI;CACzB;CACA,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,MAAM,GAAG;EACnD,IAAI,UAAU,KAAA,GAAW;EACzB,IAAI,UAAU,SAAS;EACvB,IACE,UAAU,iBACV,sBACA,wBAAwB,OAAO,YAAY,GAE3C;EACF,IAAI,eAAe,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG;EACrD,MAAM,WAAW,gBAAgB;EACjC,IAAI,YAAY,OAAO,OAAO,QAAQ,CAAC,CAAC,MAAM,SAAS,QAAQ,IAAI,IAAI,CAAC,GAAG;EAC3E,QAAQ,KAAK,WAAW,MAAM,iBAAiB;CACjD;CACA,KAAK,MAAM,SAAS,OAAO,KAAK,eAAe,GAAG;EAChD,MAAM,QAAQ,OAAO;EACrB,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;EAEjD,IAAI,CAAC,OAAO,OAAO,gBAAgB,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,QAAQ,IAAI,IAAI,CAAC,GAAG;EACpF,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,GAC/C,IAAI,UAAU,KAAA,KAAa,CAAC,aAAa,OAAO,OAAO,KAAK,GAC1D,QAAQ,KAAK,WAAW,MAAM,GAAG,MAAM,gCAAgC;CAG7E;CAGA,MAAM,QAAQ,OAAO;CACrB,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;EAC/C,MAAM,UAAU,OAAO,QAAQ,KAAK,CAAC,CAClC,QAAQ,CAAC,MAAM,QAAQ,OAAO,QAAQ,EAAE,gBAAgB,SAAS,QAAQ,CAAC,CAC1E,KAAK,CAAC,UAAU,IAAI;EACvB,IAAI,QAAQ,SAAS,GAAG,QAAQ,KAAK,iBAAiB,QAAQ,KAAK,IAAI,EAAE,gBAAgB;CAC3F;CACA,OAAO,QAAQ,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAA;AACnD;;AAGA,SAAS,wBAAwB,OAAgB,cAAgC;CAC/E,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,UAAU;EACnD,IAAI,gBAAgB,SAAS,SAAS,OAAO;EAC7C,IAAI,SAAS,QAAQ,OAAO;EAC5B,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM,OAAO;EACtD,OAAO,OAAO,OAAO,IAAI,CAAC,CAAC,OAAO,UAAU,UAAU,MAAM;CAC9D,CAAC;AACH;;AAGA,MAAM,iBAAiB;CACrB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AASA,SAAS,oBAAoB,SAAuC;CAClE,MAAM,EAAE,cAAc,KAAK,YAAY;CACvC,MAAM,QAAkB,CAAC;CACzB,IAAI,QAAQ,aAAa,MAAM,KAAK,iCAAiC;CACrE,IAAI,IAAI,YAAY,KAAA,GAAW,MAAM,KAAK,WAAW,IAAI,QAAQ,WAAW;CAC5E,KAAK,MAAM,SAAS,gBAClB,IAAI,IAAI,WAAW,KAAA,GAAW,MAAM,KAAK,GAAG,MAAM,iBAAiB;CAErE,IAAI,IAAI,cAAc,KAAA,KAAa,IAAI,YAAY,GACjD,MAAM,KAAK,2CAA2C;CACxD,IAAI,IAAI,QAAQ,MAAM,MAAM,KAAK,oCAAoC;CACrE,MAAM,UAAU,UAAU,mBAAmB,SAAS,OAAO,IAAI,KAAA;CACjE,IAAI,SAAS,MAAM,KAAK,OAAO;CAG/B,MAAM,eAAe,oBAAoB,OAAO;CAChD,IAAI,IAAI,UAAU,KAAA,KAAa,iBAAiB,KAAA,KAAa,IAAI,UAAU,cACzE,MAAM,KACJ,oBAAoB,IAAI,MAAM,kCAAkC,OAAO,YAAY,GACrF;CAEF,OAAO;AACT;AAEA,SAAS,oBAAoB,SAAsC;CACjE,OAAQ,SAA2D,OAAO;AAC5E;;;;;AAaA,SAAgB,wBAAwB,SAAmD;CACzF,OAAO,oBAAoB;EAAE,GAAG;EAAS,cAAc,QAAQ,gBAAgB,CAAC;CAAE,CAAC;AACrF;;AAGA,SAAS,iBAAiB,KAAsC;CAC9D,MAAM,QAAkB,CAAC;CACzB,KAAK,IAAI,eAAe,CAAC,EAAA,CAAG,SAAS,GAAG,MAAM,KAAK,4BAA4B;CAC/E,IAAI,IAAI,YAAY,KAAA,GAAW,MAAM,KAAK,2BAA2B;CACrE,IAAI,IAAI,SAAS,KAAA,GAAW,MAAM,KAAK,yBAAyB;CAChE,KAAK,IAAI,SAAS,CAAC,EAAA,CAAG,SAAS,GAAG,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,eAAe;CAC3F,OAAO;AACT;;AAGA,SAAS,eAAe,KAAsC;CAC5D,OAAO,CACL,GAAI,IAAI,YAAY,KAAA,IAAY,CAAC,SAAS,IAAI,CAAC,GAC/C,GAAI,IAAI,SAAS,KAAA,IAAY,CAAC,MAAM,IAAI,CAAC,CAC3C;AACF;;AAGA,SAAS,sBAAsB,SAAsC;CACnE,MAAM,SAAU,WAAW,CAAC;CAK5B,MAAM,SAAS,OAAO,WAAW;CACjC,OACG,MAAM,QAAQ,MAAM,KAAK,OAAO,SAAS,KAC1C,OAAO,OAAO,UAAU,QACvB,OAAO,aAAa,UAAU,KAAA,KAAa,OAAO,YAAY,UAAU;AAE7E;;;;;AAMA,SAAgB,eAAe,OAA6C;CAC1E,MAAM,MAAM,MAAM,gBAAgB,CAAC;CACnC,MAAM,EAAE,SAAS,YAAY;CAC7B,MAAM,OAAkC;EACtC,GAAI,MAAM,cAAc,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;EAC9D,GAAI,MAAM,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;CACrD;CACA,MAAM,eAAe,oBAAoB;EACvC,cAAc;EACd;EACA,aAAa,QAAQ;EACrB,GAAG;CACL,CAAC;CACD,MAAM,QAAQ,iBAAiB,GAAG;CAClC,IAAI,MAAM,gBAAgB,sBAAsB,OAAO,GACrD,MAAM,KAAK,gCAAgC;CAC7C,MAAM,WAAW,eAAe,GAAG;CACnC,MAAM,cAAc,UAAU,aAAa,OAAO,IAAI,CAAC;CACvD,MAAM,UACJ,QACA,QACA,cACqB;EAAE;EAAQ,QAAQ;EAAkB;EAAQ;EAAa;CAAS;CAEzF,IAAI,aAAa,SAAS,GAAG;EAC3B,MAAM,SAAS,aAAa,KAAK,IAAI;EACrC,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,sBACR,GAAG,SAAS,KAAK,OAAO,EAAE,+BAA+B,QAC3D;EAEF,OAAO,OAAO,WAAW,QAAQ,CAC/B;GAAE,WAAW;GAAa;EAAO,GACjC;GAAE,WAAW;GAAQ;EAAO,CAC9B,CAAC;CACH;CAIA,IAAI,MAAM,SAAS,GAAG;EACpB,MAAM,SAAS,GAAG,MAAM,KAAK,IAAI,EAAE;EACnC,IAAI,CAAC,QAAQ,eAAe;GAC1B,MAAM,cACJ,QAAQ,yBAAyB;GACnC,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,sBACR,GAAG,SAAS,KAAK,OAAO,EAAE,wBAAwB,aACpD;GAGF,OAAO,OAAO,WAAW,aAAa,CACpC;IAAE,WAAW;IAAa,QAAQ,MAAM,KAAK,IAAI;GAAE,GACnD;IAAE,WAAW;IAAQ,QAAQ;GAAY,CAC3C,CAAC;EACH;EACA,OAAO,OAAO,QAAQ,QAAQ,CAC5B;GAAE,WAAW;GAAa,QAAQ,MAAM,KAAK,IAAI;EAAE,GACnD;GAAE,WAAW;GAAW,QAAQ;EAAkD,CACpF,CAAC;CACH;CAEA,IAAI,QAAQ,oBACV,OAAO,OAAO,aAAa,2DAA2D,CACpF;EAAE,WAAW;EAAQ,QAAQ;CAAgC,GAC7D;EAAE,WAAW;EAAW,QAAQ;CAAkD,CACpF,CAAC;CAEH,MAAM,UAAU;CAChB,IAAI,QAAQ,eACV,OAAO,OAAO,QAAQ,GAAG,QAAQ,8BAA8B,CAC7D;EAAE,WAAW;EAAa,QAAQ;CAAQ,GAC1C;EAAE,WAAW;EAAW,QAAQ;CAAkD,CACpF,CAAC;CAEH,OAAO,OAAO,WAAW,SAAS,CAChC;EAAE,WAAW;EAAa,QAAQ;CAAQ,GAC1C;EAAE,WAAW;EAAQ,QAAQ;CAAmD,CAClF,CAAC;AACH;;;AAIA,SAAS,aAAa,SAAoD;CACxE,MAAM,OAA0C,CAAC;CACjD,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,OAAO,GAAG;EACpD,IAAI,UAAU,KAAA,GAAW;EACzB,IAAI,eAAe,IAAI,KAAK,GAAG,KAAK,KAAK,KAAwC;EACjF,MAAM,WAAW,gBAAgB;EACjC,IAAI,CAAC,YAAY,OAAO,UAAU,YAAY,UAAU,MAAM;EAC9D,KAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,GAAG;GAClD,MAAM,OAAO,SAAS;GACtB,IAAI,SAAS,KAAA,KAAa,UAAU,KAAA,GAAW,KAAK,KAAK,IAAI;EAC/D;CACF;CACA,OAAO;AACT;;AAGA,SAAgB,kBAAkB,QAAwC;CACxE,OAAO;EACL;EACA,QAAQ;EACR,QAAQ,uBAAuB;EAC/B,aAAa,CAAC;EACd,UAAU,CAAC;CACb;AACF;;;;;;AAOA,SAAgB,iBAAiB,QAAwC;CACvE,OAAO;EACL;EACA,QAAQ;EACR,QAAQ,8CAA8C;EACtD,aAAa,CAAC;EACd,UAAU,CAAC;CACb;AACF"}