@tangle-network/agent-runtime 0.317.0 → 0.319.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-runtime",
-  "version": "0.317.0",
+  "version": "0.319.3",
   "description": "Shared task-lifecycle skeleton for agents: a recursive loop kernel for chat turns, one-shot tasks, and multi-attempt loops, with trace capture and eval-gated self-improvement. Domain behavior lives in adapters; scoring and ship-gates in @tangle-network/agent-eval.",
   "homepage": "https://github.com/tangle-network/agent-runtime#readme",
   "repository": {
@@ -113,10 +113,13 @@
     "@arethetypeswrong/cli": "0.18.5",
     "@biomejs/biome": "^2.5.11",
     "@modelcontextprotocol/sdk": "1.30.0",
-    "@tangle-network/agent-eval": "0.211.3",
-    "@tangle-network/agent-interface": "^3.1.1",
-    "@tangle-network/agent-provider-tangle": "2.0.0",
-    "@tangle-network/sandbox": "^0.60.0",
+    "@tangle-network/agent-eval": "0.213.0",
+    "@tangle-network/agent-interface": "5.2.0",
+    "@tangle-network/agent-provider-cli-bridge": "2.0.0",
+    "@tangle-network/agent-provider-daytona": "0.6.0",
+    "@tangle-network/agent-provider-e2b": "0.6.0",
+    "@tangle-network/agent-provider-tangle": "4.0.0",
+    "@tangle-network/sandbox": "0.60.49",
     "@types/node": "26.4.0",
     "@types/tar-stream": "3.1.4",
     "miniflare": "4.20260722.0",
@@ -133,18 +136,19 @@
     "yaml": "2.9.0"
   },
   "engines": {
-    "node": ">=22.13.0"
+    "node": ">=22.19.0"
   },
   "license": "MIT",
   "peerDependencies": {
-    "@tangle-network/agent-eval": ">=0.209.1 <0.212.0",
-    "@tangle-network/agent-interface": "^3.1.1",
+    "@tangle-network/agent-eval": ">=0.213.0 <0.214.0",
+    "@tangle-network/agent-interface": "^5.2.0",
     "@tangle-network/sandbox": ">=0.58.4 <0.61.0"
   },
   "dependencies": {
-    "@tangle-network/agent-core": ">=0.10.3 <0.11.0",
-    "@tangle-network/agent-knowledge": "^20.0.1",
-    "@tangle-network/agent-profile-materialize": ">=0.21.0 <0.23.0",
+    "@earendil-works/pi-codemode": "1.0.4",
+    "@tangle-network/agent-core": ">=0.12.0 <0.13.0",
+    "@tangle-network/agent-knowledge": "^22.0.1",
+    "@tangle-network/agent-profile-materialize": ">=0.25.2 <0.26.0",
     "@tangle-network/agent-trace-contract": "^2.0.0",
     "tar-stream": "3.2.1",
     "zod": "4.6.5"

package/skills/agent-graphs/references/authoring.md

@@ -10,6 +10,13 @@ Each node holds an id and a canonical AgentProfile; its profile name matches the
 Standing roles belong in the profile prompt, with explicit tools and resources.
 Put the concrete mission in the deliverable description and supply an independent completion check that rejects incomplete output.
 
+A node whose work is mechanical composition (fan-out, filtering, pagination, cross-tool joins)
+can be a CODE node: `model.metadata.codeMode` on its profile presents `tool_search` + `codemode`
+instead of the raw tools, so the model authors one program per assignment instead of one tool
+call per turn. The grant (`profile.tools`) is unchanged — every nested call still crosses the
+authorized handler, and spend still settles on the node. Reserve code nodes for judgment-free
+stretches; anything that must re-plan on an observed result belongs in an ordinary agent node.
+
 ## Edges
 
 Delegation edges carry work from the root to a worker through registered prompt references.

package/skills/codemode/SKILL.md

@@ -21,11 +21,13 @@ A batch does not expand the permission of its individual operations.
 Meter paid operations on the owning execution path and preserve their usage records.
 Keep dependent actions sequential unless their contract supports safe composition.
 
-## Runtime-supervised code
+## Runtime scripts and agents
 
-When configuring code execution for a Runtime supervisor, read [the execution boundary](references/runtime-execution.md).
-That branch supplies a generated API over Runtime's existing coordination tools and requires an explicit runner.
-For ordinary shell or session-tool batching, no additional runtime is needed.
+Use Runtime's maintained code-mode execution rather than creating a script runner or an agent loop.
+Read [the Runtime execution surface](references/runtime-execution.md) for `runCodeMode`, the
+existing router-tools executor's `codeMode` option, structured results and retained state.
+The implementation is independent of Pi's coding harness and uses the standalone QuickJS engine.
+For a harness already offering native code mode, use that surface instead of nesting code mode.
 
 Complete the requested work and inspect the resulting artifact.
 Code reduces mechanical round trips; it does not replace judgment or prove the quality of the result.

package/skills/codemode/references/runtime-execution.md

@@ -1,14 +1,66 @@
-# Runtime code execution boundary
+# Runtime code mode
 
-Read [code-mode implementation and types](https://github.com/tangle-network/agent-runtime/blob/main/src/runtime/supervise/code-mode.ts) and its [contract tests](https://github.com/tangle-network/agent-runtime/blob/main/tests/kernel/code-mode.test.ts).
-Use `codeModeSupervisorTools(runner)` with an explicit `CodeModeRunner`; there is no default runner.
-For untrusted model output, supply a real isolated execution environment.
-The in-process runner and source lint are not security boundaries.
+Use `runCodeMode` from `@tangle-network/agent-runtime/kernel` for an authored Runtime script.
+Pass the already-authorized tool descriptors and their original execution handlers. Scripts
+call `tools.name(args)`, compose calls with normal JavaScript, and return a small result.
+`tool_search` generates input and output declarations when using `createCodeModeTools`.
 
-The generated API follows the live coordination grant.
-Code can spawn or steer through Runtime-provided bindings such as `api.spawn_worker`; these retain authorization, shared budgets, and journal records.
-Direct coordination requests over HTTP or a second scheduler bypass that contract.
+For a model-driven Runtime agent, select `codeMode: true` (or explicit execution limits)
+on the existing `createExecutor({ backend: 'router-tools', ... })` configuration. Keep
+`AgentProfile.tools` as the actual capability grant. Runtime presents `tool_search` and
+`codemode`; nested calls still go through the original `executeToolCall`, with a cancellation
+signal, parent call ID and nested call ID. The original tool-step observer records them.
+The existing internal brain loop and local MCP client accept the same presentation option.
+This does not require the Pi coding harness.
 
-Lifecycle decisions remain model tools: `submit_result`, `stop`, and `ask_parent` are outside the generated code API.
-Keep judgment in the model and mechanics in the program.
-Before broad use, exercise one allowed call, one denied call, a failed operation, and cancellation through the selected runner.
+For ONE node of a graph — a code node beside ordinary agent nodes — declare it on the
+node's pinned profile instead of the environment: `model.metadata.codeMode = true` (or
+`{ concurrency, maxCalls, timeoutMs, memoryLimitBytes, directTools }`). The profile
+declaration enables code mode for that node; `false` opts that node out even when its
+backend defaults to code mode. This changes presentation only: profile tool grants,
+handler authorization, Runtime budgets and metering still apply. `true` and an empty
+object inherit the host's settings.
+For enabled nodes, each numeric setting is the smaller of the explicit host ceiling and
+profile request. Omitted settings inherit; engine defaults apply only if neither supplies
+one. Host and profile `directTools` are combined, so a profile cannot make a host's
+direct-only capability callable from a program. Restored `store` always belongs to the
+host and survives profile declarations. This keeps one authoring surface and no new node
+kind. Unknown or host-owned profile fields are refused before any request.
+
+The implementation uses the standalone `@earendil-works/pi-codemode` QuickJS/WASM worker.
+There is no unsafe Node VM fallback. Code cannot read host files, processes or network
+except through explicitly supplied tools. The default VM memory cap is 64 MiB, wall deadline
+five minutes, tool concurrency four (excess calls queue), and total call cap 1024. Exceeding the call cap aborts the program, even if it catches
+tool errors; failed programs do not commit store writes. Limits
+are caller-authored; finite wall deadlines must fit the worker timer (at most 2,147,483,647 ms).
+`timeoutMs: Infinity` explicitly removes the wall deadline.
+
+Return structured objects from tool handlers when programs need structured data. Existing
+text handlers remain text: Runtime does not guess that arbitrary strings should be parsed as
+JSON. Tool input validation, approvals, external-effect idempotency and metering remain the
+original handler's responsibility. Code mode does not grant access or automatically retry effects.
+
+Use `text()` for text output and `image()` with actual inline image data for image output.
+Only selected output and the return value enter the next model turn; intermediate results stay
+in the script, while the existing execution trace retains calls. `store`/`load` hold small JSON
+state. Retain `codeModeStore` through the existing run/session owner and provide it as
+`codeMode.store` on continuation. The router executor's `onMessages` callback receives the
+store snapshot as its optional second argument. Only successful programs commit store writes.
+
+A fresh VM runs each program. A stored JSON snapshot is not a checkpoint of the instruction
+pointer or guest heap. A lost result does not prove an external operation did not run; inspect
+its existing effect receipt rather than blindly replaying the script. Cancellation stops new
+calls and closes program authority; it cannot undo a previously accepted external effect.
+
+A harness that already supplies code mode should use its native surface, not wrap it in another
+code-mode tool. `createCodeModeTools` refuses reserved-tool collisions instead of nesting engines.
+Use `directTools` for capabilities the host keeps as direct-only model tools (for example, a
+lifecycle decision). They are not available inside programs.
+
+Tool names must have distinct normalized JavaScript identifiers. Runtime refuses collisions
+(such as `send-email` and `send_email`) before running a program, because the engine otherwise
+selects the first handler even for an exact-name access. Rename the host descriptors explicitly.
+
+Run Node host applications from a file. The current engine inherits Node worker flags;
+`node --input-type=module --eval ...` is unsupported because Node rejects that flag on
+file-backed workers. This returns a sandbox error and never falls back to host execution.

package/skills/graph-designer/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: graph-designer
+description: Design, replay, and improve agent graphs — an agent whose job is the graph, not the work.
+---
+
+# Graph Designer
+
+When an input arrives, your job is NOT to do the work. It is to pick or design the GRAPH
+that does the work, run it under your granted permissions, and record what happened.
+Every execution is fully traced like any graph run — the registry plus the run's journal
+is the knowledge.
+
+## The loop (every input)
+
+1. Compute the task shape: the durable description you will look this kind of work up by
+   (kind, source, constraints — stable fields, not the payload itself). Hash it.
+2. `lookupGraph(registry, taskDigest)` over YOUR WORKSPACE's registry:
+   - **replay** → run the stored graph verbatim. Re-bind the deliverable's check from the
+     environment (oracles are never stored). Record the run. This path spends near-zero
+     inference: no re-authoring, no redesign — the graph IS the answer.
+   - **author** (with the stated reason) → design per the `agent-graphs` skill, run it,
+     record it. If a prior graph failed to deliver for this shape, mutate deliberately
+     (budget, directives as new prompt-registry versions, model mix, an added analyst),
+     never blindly: name what the prior record says went wrong.
+3. Record EVERY run: `recordGraphRun` with the terminal accounting. The registry is the
+   compounding asset — a run you don't record is knowledge you burn.
+
+## Where the registry lives
+
+The registry is files in your workspace (`graph-registry/records.jsonl` + content-addressed
+graphs). In a sandbox, snapshots carry it: a rerun over the same sandbox finds every graph
+ever run. Do not store the deliverable's check function — the environment re-binds it.
+
+## Improving, honestly
+
+Replay is the default; improvement is the exception with a reason. Read the prior records:
+delivered-and-cheapest wins (`pickBestGraph`); a no-winner with budget exhaustion wants
+budget or scope changes, not a new topology; repeated near-misses want a directive rewrite
+(a new prompt-registry version — directives are data, old versions stay). Prefer mutating
+one axis at a time so the next record attributes the difference. When an optimizer run
+(agent-eval) is available, feed it the losing graph's journal; otherwise your reasoned
+mutation IS the search step.
+
+## Profiles improve the same way graphs do
+
+A worker profile is named and content-addressed; when a mutation rewrites a node's
+prompt, record the run in the profile registry too (`recordProfileRun`) — same shape
+as the graph registry, one level down. The winning revision per name is then an
+answered question (`bestProfileFor`), not an argument: delivered beats failed, then
+cheaper, then recent, and revisions never overwrite so old-vs-new is always a
+controlled diff.
+
+## Then consider
+
+- `agent-graphs` for the authoring contract (roles, edges, deliverable, budget).
+- `codemode` when a node's work is mechanical composition — `model.metadata.codeMode`.
+- The run's own ledger (`GraphResult.ledger`, the journal) as the evidence for every decision above.

package/skills/profile-authoring/SKILL.md

@@ -13,7 +13,7 @@ Do not constrain agents with prohibitions: change what is rewarded and who is in
 ## A profile that starts
 
 A refused profile fails before its first model turn, and it fails the same way on every retry.
-On 2026-10-10 Discovery plays lost 20 driver attempts to child profiles naming a tool the harness does not publish, and 3 spawns to a missing subscription source.
+On 2026-10-10 Discovery lost 20 driver attempts to unpublished tool names and 3 spawns to a missing subscription source.
 Start from a profile that already ran (in a Discovery play, `inputs/profile-examples/<family>.json`) and change only `name`, `description` and `prompt.instructions`.
 
 | Field | Rule |
@@ -25,7 +25,7 @@ Start from a profile that already ran (in a Discovery play, `inputs/profile-exam
 | `prompt` | The role in `instructions[0]`, the procedure after it. No `systemPrompt`: it replaces the harness's own guidance (17,730 characters on Codex), and Discovery refuses one under 4,000 characters. No `appendSystemPrompt` on Codex or Gemini. |
 | `resources` | `failOnError: true`. Hand each file by path, `{"path": "<mount>", "resource": {"kind": "inline", "name": "<name>", "path": "<file in your workspace>"}}`: Runtime reads the bytes (UTF-8, at most 4 MiB). Never retype a file into `content`: a manager that did delivered 5 wrong characters in 24,008. |
 
-Native tool ids (agent-dev-container `packages/agent-profile-materialize/src/control-maps.ts` and `execution-controls.ts`; matching ignores case and every character but letters, digits and `_`):
+Native tool ids (agent-dev-container `packages/agent-profile-materialize/src/control-maps.ts` and `execution-controls.ts`; matching ignores case and all but letters, digits and `_`):
 
 | Harness | Accepted | Refused |
 |---|---|---|
@@ -46,7 +46,7 @@ Runtime keys (agent-runtime `src/runtime/supervise/provider-visible-profile.ts`;
 
 Leaf or manager is decided by the keys you write (`withInheritedSpawnRights`, `src/runtime/supervise/supervise.ts`).
 A child whose profile names any `agent_runtime_coordination_` key gets exactly those keys.
-A child that names none, under a parent that can spawn, inherits the parent's coordination verbs, `spawn_worker` included, plus `submit_result`; it does not inherit product verbs, so it cannot write Knowledge pages.
+A child that names none, under a parent that can spawn, inherits the parent's coordination verbs (`spawn_worker` included) and `submit_result`, but no product verbs, so it cannot write Knowledge pages.
 So always write them. A leaf gets the product verbs it uses, `submit_result` and `report_blocked`.
 A manager adds `agent_runtime_coordination_spawn_worker: true` and only the observation and steering verbs it will use, and carries this skill byte for byte: `"skills": [{"kind": "inline", "name": "profile-authoring", "path": "<this file in your workspace>"}]` beside `resources.failOnError: true`.
 
@@ -73,7 +73,7 @@ The spawn's assignment carries the work; the profile carries the role.
 Every assignment names four things: the exact page path and format to record, with one literal example line; the command that checks the part; what to do when blocked; and when to check in.
 Hand every file the child judges by path, never a summary.
 A spawn's `deadlineMs` is a check-in, not a kill: the child is told to record its state and submit what it has, and is stopped only if it then makes no progress. Set it from the work.
-A manager waits by ending its turn: Runtime wakes it with each settlement, finding or message, and with a notice before its deadline. A shell timer or polling loop is not re-entry, and it spends turns. Ending a turn with work open is not completion; a manager with a check ends on an accepted `submit_result` or a bound.
+A manager waits by ending its turn: Runtime wakes it with each settlement, finding or message, and with a notice before its deadline. Polling or a shell timer is not re-entry and spends turns. Ending a turn with work open is not completion; a manager with a check ends on an accepted `submit_result` or a bound.
 A nested manager that returns early can end its scope and cancel live descendants.
 Require each child to record partial work where its parent can recover it after an interruption.
 Before retrying a failed child, read what it recorded; finished work may be usable. A retry names the specific failure in a new profile.
@@ -89,43 +89,45 @@ Make a literature search part of acceptance, and record an answer already publis
 ## 2. Probe the proxy's gap before launch
 
 The proxy is the check you can run during the work: an exact checker, a test suite, a rater or a demo. The gap is everything it accepts and the audience rejects; hacks live there, and a stronger model does not close it.
-Try to make the proxy accept what the audience rejects: plant the source's trivial and excluded cases, a published answer, a degenerate artifact, an impossible variant, a stale comparator. Each must be refused or classed as known; if one passes, fix the proxy or narrow the claim.
-Probe the other side too: write one correct result in a format the brief allows but the proxy's author did not expect, and run the proxy on it. A proxy that refuses it trains agents on format, not substance.
+Try to make the proxy accept what the audience rejects: plant trivial and excluded cases, a published answer, a degenerate artifact, an impossible variant, a stale comparator. Each must be refused or classed as known; if one passes, fix the proxy or narrow the claim.
+Probe the other side too: run the proxy on one correct result in a format the brief allows but its author did not expect. A proxy that refuses it trains agents on format, not substance.
 Use exact or interval arithmetic, and count only what is proven.
 An LLM judge becomes a gate only after it beats an always-reject baseline on cases a human graded.
 
 ## 3. Keep acceptance out of the reward loop
 
 Give agents a development check they can run; hiding every check also blocks honest work.
-Hold back a stricter acceptance check, run from the delivered packet in a fresh environment by a party outside the authoring lineage, and grade only what its rerun reproduces.
+Hold back a stricter acceptance check, run from the delivered packet in a fresh environment by a party outside the authoring lineage; grade only what its rerun reproduces.
+Record any root-authored boundary or comparison claim in Knowledge before a child sees it, so the blind check compares the same statement.
 A parent that promotes children on proxy passes alone selects for the gap; have the referee attack a result before anyone builds on it.
 Keep the headline gate fixed for the whole task; report a stricter bar as a second line.
-For a customer commission the bar is the first deliverable: the root's first milestone writes 50 to 100 checkable expectations, the deliverable spec and a workplan, and a partner outside the authoring lineage raises the bar against named exemplars and holds part of it back.
+For a customer commission the bar is the first deliverable: the root's first milestone writes 50 to 100 checkable expectations, the deliverable spec and a workplan; a partner outside the authoring lineage raises the bar against named exemplars and holds part back.
 
 ## 4. Choose roles and a model for each
 
 Proposers: cheap, high-throughput models where an exact checker exists, with an occasional strong model.
 Referee: a skeptic from another model family, holding the artifact and its own instrument (exact recomputation, execution, a literature search, an attempted counter-case). It can reject a claim; only the held-back check accepts one. A change of family alone is weak.
 Monitor: reads the journal and live notes, flags drift or proxy gaming, and steers or reports; it never scores.
-Choose each model from measured cost and quality on this kind of work, state its dollars, and admit it in `allowedModels`; Runtime refuses a model outside that list at spawn.
+Choose each model from measured cost and quality on this kind of work, state its dollars, and admit it in `allowedModels`; Runtime refuses any other at spawn.
 Spawn a helper only for work that is independent, long enough to repay a cold start, and checkable on its own.
 
 ## 5. Define success, the honest null, and the stop
 
 Success is an accepted result or a reproduced null. Separate execution settlement, development progress and final acceptance; an unknown outside verdict is not absent progress.
-A null from a search counts only with a coverage certificate: the searched space as data (ranges, method, seeds, bound reached), one row per cell, a calibration cell where the search must find objects that exist, and the sha256 of the reproducer.
+A null from a search counts only with a coverage certificate: the searched space as data (ranges, method, seeds, bound reached), one row per cell, a calibration cell with objects the search must find, and the reproducer's sha256.
 The reproducer belongs to the check: registered before launch with its hash, the statements it covers and its own calibration; agents may run it and never write it.
-The outside check reruns its own copy, reruns the calibration first and credits nothing on a miss, then reruns cells until its budget ends; one mismatched row refuses the certificate, and only rerun, matched cells earn credit.
+The outside check reruns its own copy: the calibration first, crediting nothing on a miss, then cells until its budget ends; one mismatched row refuses the certificate, and only rerun, matched cells earn credit.
 A null that is no search (a spec conflict, a gap list) counts when the held-back check reproduces each named item. A null without a certificate is "stopped, unverified"; one inside a range already covered adds nothing.
 Tell agents the checker may be wrong; credit a reproduced checker-defect report like a result.
-Grant `submit_result` only where Runtime gives the node a check; otherwise its settlement stays unassessed. Match completion instructions to the tools actually served to each node.
+Grant `submit_result` only where Runtime gives the node a check; otherwise its settlement stays unassessed, and a child returning no structured validity verdict stays unresolved in the parent's comparison.
+Match completion instructions to the tools served to each node. List every harness tool a child needs in `tools`, defaults included: a harness honoring a map of coordination tools alone serves nothing else. A revision states why it drops any tool its source profile listed.
 State the stop: what the agent does the moment its check passes, and that work after a pass spends seats and adds nothing.
 For continued research, read the installed continuation contract first and choose `maxBarren` from the measured feedback cadence.
 
 ## 6. Carry known traps
 
 Write each trap as what the held-back acceptance refuses, never as what the proxy passes: "the outside check does not count a c = 0 instance" is a trap; "the checker passed c = 0 claims" is a recipe. Give the rule, not the incident: the operator owns the stack.
-Typical traps: excluded or trivial cases, stale or wrong-field comparators, published answers, tests versus users, a demo versus a customer, a rater versus an expert.
+Typical traps beyond the gap probe's canaries: wrong-field comparators, tests versus users, a demo versus a customer, a rater versus an expert.
 Record each new trap where the next author reads it, in the same change as its fix.
 
 ## 7. Set budget and caps
@@ -170,5 +172,5 @@ Records that expose a hack, and unavailable observations:
 ## Then consider
 
 - `supervise` to drive the tree once its profiles exist.
-- `eval-engineering` (its pre-spend calibration) when a judge or checker has no calibration yet.
-- `pursue` (its controlled architecture comparison) when the claim compares arms.
+- `eval-engineering` when a judge or checker has no calibration yet.
+- `pursue` when the claim compares arms.

package/dist/model-policy-DhvyZ8-O.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"model-policy-DhvyZ8-O.js","names":["positiveInteger"],"sources":["../src/runtime/harness-role.ts","../src/runtime/model-identity.ts","../src/runtime/router-auto-evidence.ts","../src/runtime/router-retry-policy.ts","../src/runtime/supervise/model-policy.ts"],"sourcesContent":["/**\n * Which `HarnessType` values name a real coding-agent runtime, and which name a MODE that has no\n * agent behind it.\n *\n * `cli-base` is the router-backed mode — a plain multi-turn router call with no coding-agent\n * harness (`@tangle-network/agent-interface`'s `HarnessType` doc, and the same table's\n * `harnessReasoningCeiling['cli-base'] = 'none'` commented \"cli-base has no agent\"). The\n * distinction is REAL; what was accidental is that three call sites each spelled the test\n * themselves, so a second no-agent mode would have to be remembered in three places.\n *\n * SHOULD UPSTREAM: this belongs next to `harnessHonorsEffort` in agent-interface's\n * `harness-capabilities.ts`, which already encodes the fact but exports no predicate for it.\n * Until it does, this is the one local copy — extend the set here, never re-test the name.\n */\n\nimport type { HarnessType } from '@tangle-network/agent-interface'\n\n/**\n * Harness ids that select a router/no-agent mode rather than a coding-agent runtime.\n *\n * `nanoclaw` is deliberately ABSENT: the shared capability table clamps its reasoning ceiling the\n * same way it clamps `cli-base`, but nanoclaw does run an agent (a socket-bridge runner to the\n * NanoClaw daemon) and every caller here treats it as a full harness. Add a row only with the\n * behavior change stated, never to make the two clamps look symmetric.\n */\nconst NO_AGENT_HARNESSES: ReadonlySet<string> = new Set<string>(['cli-base' satisfies HarnessType])\n\n/** Whether this profile harness selects a real coding-agent runtime (vs. the router/no-agent mode\n *  or no preference at all). Accepts the looser `string` some local profile shapes declare, and\n *  preserves the caller's own harness type when it is narrower. */\nexport function harnessRunsAgent<T extends string>(harness: T | null | undefined): harness is T {\n  return harness != null && !NO_AGENT_HARNESSES.has(harness)\n}\n\n/** The coding-agent harness this profile selects, or `undefined` when it selects none — the shape\n *  callers want when a no-agent mode must fall through to the router arm. */\nexport function agentHarness<T extends string>(harness: T | null | undefined): T | undefined {\n  return harnessRunsAgent(harness) ? harness : undefined\n}\n","import { harnessTypeSchema } from '@tangle-network/agent-interface'\n\nconst SNAPSHOT_TOKEN = /^[A-Za-z0-9._-]+$/u\nconst datedIsoSuffix = /^(.*)-(\\d{4})-(\\d{2})-(\\d{2})$/u\nconst datedCompactSuffix = /^(.*)-(\\d{4})(\\d{2})(\\d{2})$/u\nconst datedMonthSuffix = /^(.*)-(\\d{4})-(\\d{2})$/u\n\ntype SnapshotKind = 'date' | 'opaque'\n\ninterface ModelIdentityParts {\n  readonly base: string\n  readonly snapshot?: string\n  readonly snapshotKind?: SnapshotKind\n}\n\nexport interface CanonicalObservedModelParts {\n  readonly base: string\n  readonly snapshot?: string\n  readonly snapshotKind?: SnapshotKind\n  readonly canonical: string\n}\n\n/** Match equivalent bare and provider-qualified spellings without discarding observed identity. */\nexport function observedModelMatchesDeclared(observed: string, declared: string): boolean {\n  const observedIdentity = modelIdentityParts(observed)\n  const declaredIdentity = modelIdentityParts(declared)\n  if (!observedIdentity || !declaredIdentity) return false\n  if (\n    declaredIdentity.snapshot !== undefined &&\n    (observedIdentity.snapshot !== declaredIdentity.snapshot ||\n      observedIdentity.snapshotKind !== declaredIdentity.snapshotKind)\n  ) {\n    return false\n  }\n  return equivalentModelBase(observedIdentity.base, declaredIdentity.base)\n}\n\n/** Merge two observations of one served model while retaining a snapshot-bearing raw identity. */\nexport function mergeObservedModelIdentity(current: string, next: string): string | undefined {\n  const currentIdentity = modelIdentityParts(current)\n  const nextIdentity = modelIdentityParts(next)\n  if (!currentIdentity || !nextIdentity) return undefined\n  if (!equivalentModelBase(currentIdentity.base, nextIdentity.base)) return undefined\n  if (\n    currentIdentity.snapshot !== undefined &&\n    nextIdentity.snapshot !== undefined &&\n    (currentIdentity.snapshot !== nextIdentity.snapshot ||\n      currentIdentity.snapshotKind !== nextIdentity.snapshotKind)\n  ) {\n    return undefined\n  }\n  return currentIdentity.snapshot === undefined && nextIdentity.snapshot !== undefined\n    ? next\n    : current\n}\n\n/** Canonicalize a served model for cross-route identity comparisons. */\nexport function canonicalObservedModel(model: string): string | undefined {\n  return canonicalObservedModelParts(model)?.canonical\n}\n\n/** Return the canonical model and its validated snapshot kind for runtime evidence reduction. */\nexport function canonicalObservedModelParts(\n  model: string,\n): CanonicalObservedModelParts | undefined {\n  const identity = modelIdentityParts(model)\n  if (!identity) return undefined\n  const base = identity.base.slice(identity.base.lastIndexOf('/') + 1)\n  const canonical =\n    identity.snapshot === undefined\n      ? base\n      : identity.snapshotKind === 'date'\n        ? `${base}-${identity.snapshot}`\n        : `${base}@${identity.snapshot}`\n  return {\n    base,\n    ...(identity.snapshot !== undefined ? { snapshot: identity.snapshot } : {}),\n    ...(identity.snapshotKind !== undefined ? { snapshotKind: identity.snapshotKind } : {}),\n    canonical,\n  }\n}\n\n/** Return whether an observed identity includes a provider snapshot. */\nexport function observedModelHasSnapshot(model: string): boolean {\n  return modelIdentityParts(model)?.snapshot !== undefined\n}\n\nfunction modelIdentityParts(model: string): ModelIdentityParts | null {\n  if (model.length === 0) return null\n  const at = model.lastIndexOf('@')\n  if (at < 0) {\n    const dated = datedModelIdentity(model)\n    if (dated !== undefined) return dated\n    return modelLeaf(model).length === 0 ? null : { base: model }\n  }\n  const base = model.slice(0, at)\n  const snapshot = model.slice(at + 1)\n  if (base.length === 0 || modelLeaf(base).length === 0 || !SNAPSHOT_TOKEN.test(snapshot)) {\n    return null\n  }\n  return { base, snapshot, snapshotKind: 'opaque' }\n}\n\nfunction equivalentModelBase(observed: string, declared: string): boolean {\n  const observedPath = modelBaseParts(observed)\n  const declaredPath = modelBaseParts(declared)\n  if (!samePath(observedPath.path, declaredPath.path)) return false\n\n  // A bare id omits provider routing. It can match an explicitly qualified spelling\n  // only when the model path is otherwise identical.\n  if (\n    observedPath.provider === undefined ||\n    declaredPath.provider === undefined ||\n    sameProvider(observedPath.provider, declaredPath.provider)\n  ) {\n    return true\n  }\n\n  // Tangle Router may report the upstream provider's qualified spelling. Preserve this\n  // one documented alias without allowing arbitrary provider-to-provider substitutions.\n  if (observedPath.provider === 'tangle-router' || declaredPath.provider === 'tangle-router') {\n    const router = observedPath.provider === 'tangle-router' ? observedPath : declaredPath\n    const upstream = observedPath.provider === 'tangle-router' ? declaredPath : observedPath\n    if (upstream.provider === undefined) return false\n    return (\n      samePath(router.path, upstream.path) ||\n      (router.path[0] === upstream.provider && samePath(router.path.slice(1), upstream.path))\n    )\n  }\n\n  return false\n}\n\n/**\n * Compare provider slugs across catalogs that spell one vendor with or without hyphens,\n * such as `zai` and OpenRouter's `z-ai`. Any other provider difference is a substitution.\n */\nfunction sameProvider(left: string, right: string): boolean {\n  return left.replaceAll('-', '') === right.replaceAll('-', '')\n}\n\ninterface ModelBaseParts {\n  readonly provider: string | undefined\n  readonly path: ReadonlyArray<string>\n}\n\nfunction modelBaseParts(model: string): ModelBaseParts {\n  const segments = model.split('/')\n  const normalized =\n    segments.length > 1 && isHarnessPrefix(segments[0]) ? segments.slice(1) : segments\n  if (normalized.length === 1) return { provider: undefined, path: normalized }\n  return { provider: normalized[0], path: normalized.slice(1) }\n}\n\nfunction isHarnessPrefix(segment: string | undefined): boolean {\n  return segment !== undefined && harnessTypeSchema.safeParse(segment).success\n}\n\nfunction samePath(left: ReadonlyArray<string>, right: ReadonlyArray<string>): boolean {\n  return left.length === right.length && left.every((segment, index) => segment === right[index])\n}\n\nfunction modelLeaf(model: string): string {\n  return model.slice(model.lastIndexOf('/') + 1)\n}\n\n/**\n * Parse the provider's documented dated snapshot forms.\n *\n * `undefined` means that the model has no dated shape and must be treated as a normal base.\n * `null` means that it has a dated shape but the date is invalid, so identity matching fails.\n */\nfunction datedModelIdentity(model: string): ModelIdentityParts | null | undefined {\n  const iso = datedIsoSuffix.exec(model)\n  if (iso) {\n    const [, base, yearText, monthText, dayText] = iso\n    return buildDatedIdentity(\n      base,\n      `${yearText}-${monthText}-${dayText}`,\n      isValidCalendarDate(yearText, monthText, dayText),\n    )\n  }\n\n  const compact = datedCompactSuffix.exec(model)\n  if (compact) {\n    const [, base, yearText, monthText, dayText] = compact\n    return buildDatedIdentity(\n      base,\n      `${yearText}-${monthText}-${dayText}`,\n      isValidCalendarDate(yearText, monthText, dayText),\n    )\n  }\n\n  const month = datedMonthSuffix.exec(model)\n  if (month) {\n    const [, base, yearText, monthText] = month\n    return buildDatedIdentity(\n      base,\n      `${yearText}-${monthText}`,\n      isValidCalendarMonth(yearText, monthText),\n    )\n  }\n\n  return undefined\n}\n\nfunction buildDatedIdentity(\n  base: string | undefined,\n  snapshot: string,\n  valid: boolean,\n): ModelIdentityParts | null | undefined {\n  // A date that is the entire model segment is not a snapshot suffix.\n  if (base === undefined || base.length === 0 || base.endsWith('/')) return undefined\n  return valid ? { base, snapshot, snapshotKind: 'date' } : null\n}\n\nfunction isValidCalendarDate(\n  yearText: string | undefined,\n  monthText: string | undefined,\n  dayText: string | undefined,\n): boolean {\n  if (yearText === undefined || monthText === undefined || dayText === undefined) return false\n  const year = Number(yearText)\n  const month = Number(monthText)\n  const day = Number(dayText)\n  if (year < 2000 || year > 2099 || month < 1 || month > 12 || day < 1 || day > 31) {\n    return false\n  }\n  const date = new Date(Date.UTC(year, month - 1, day))\n  return (\n    date.getUTCFullYear() === year && date.getUTCMonth() === month - 1 && date.getUTCDate() === day\n  )\n}\n\nfunction isValidCalendarMonth(\n  yearText: string | undefined,\n  monthText: string | undefined,\n): boolean {\n  if (yearText === undefined || monthText === undefined) return false\n  const year = Number(yearText)\n  const month = Number(monthText)\n  return year >= 2000 && year <= 2099 && month >= 1 && month <= 12\n}\n","import { ValidationError } from '../errors'\nimport { observedModelMatchesDeclared } from './model-identity'\n\nfunction object(value: unknown): Record<string, unknown> {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new ValidationError('Router Auto requires an inline policy and routing receipt')\n  }\n  return value as Record<string, unknown>\n}\n\n/** Router owns policy parsing. Runtime requires visible model authority before dispatch. */\nexport function assertRouterAutoDeclaration(value: unknown, stream: boolean | undefined): void {\n  const policy = object(value)\n  if (stream === true) throw new ValidationError('Router Auto requires buffered transport')\n  if (\n    policy.version !== 1 ||\n    typeof policy.id !== 'string' ||\n    typeof policy.revision !== 'string' ||\n    !Array.isArray(policy.strategies) ||\n    policy.strategies.length === 0\n  ) {\n    throw new ValidationError(\n      'Router Auto requires a versioned inline policy with concrete strategies',\n    )\n  }\n  for (const raw of policy.strategies) {\n    const strategy = object(raw)\n    if (\n      typeof strategy.id !== 'string' ||\n      typeof strategy.model !== 'string' ||\n      strategy.model === 'tangle/auto' ||\n      strategy.model.length === 0\n    ) {\n      throw new ValidationError('Router Auto strategy model authority is missing')\n    }\n  }\n  for (const phase of ['selector', 'review']) {\n    if (policy[phase] !== undefined && typeof object(policy[phase]).model !== 'string') {\n      throw new ValidationError('Router Auto assessment model authority is missing')\n    }\n  }\n}\n\n/** An alias does not waive identity checks. Every reported child must match its declared phase. */\nexport function assertRouterAutoResponse(\n  policyValue: unknown,\n  response: unknown,\n  served: string | undefined,\n): void {\n  const policy = object(policyValue)\n  const receipt = object(object(response).tangle_auto)\n  const decision = object(receipt.decision)\n  const strategies = policy.strategies as unknown[]\n  const selected = strategies.map(object).find((strategy) => strategy.id === decision.strategyId)\n  if (\n    decision.requestedModel !== 'tangle/auto' ||\n    decision.policyId !== policy.id ||\n    decision.policyRevision !== policy.revision ||\n    typeof decision.policyDigest !== 'string' ||\n    !selected ||\n    decision.selectedModel !== selected.model ||\n    served === undefined ||\n    !observedModelMatchesDeclared(served, String(selected.model))\n  ) {\n    throw new ValidationError(\n      'Router Auto response does not match AgentProfile policy/model authority',\n    )\n  }\n  if (!Array.isArray(receipt.calls) || receipt.calls.length === 0) {\n    throw new ValidationError('Router Auto response is missing physical call receipts')\n  }\n  for (const raw of receipt.calls) {\n    const call = object(raw)\n    const declared =\n      call.phase === 'selector'\n        ? object(policy.selector).model\n        : call.phase === 'review'\n          ? object(policy.review).model\n          : call.phase === 'initial' || call.phase === 'escalation'\n            ? strategies.map(object).map((strategy) => strategy.model)\n            : []\n    const allowed = Array.isArray(declared) ? declared : [declared]\n    if (\n      typeof call.model !== 'string' ||\n      !allowed.some(\n        (model) =>\n          typeof model === 'string' && observedModelMatchesDeclared(call.model as string, model),\n      )\n    )\n      throw new ValidationError('Router Auto physical call exceeds AgentProfile model authority')\n  }\n}\n\n/** The concrete authority declared by an inline Auto policy, including paid assessments. */\nexport function routerAutoDeclaredModels(value: unknown): readonly string[] {\n  assertRouterAutoDeclaration(value, undefined)\n  const policy = object(value)\n  const models = (policy.strategies as unknown[]).map((raw) => String(object(raw).model))\n  for (const phase of ['selector', 'review']) {\n    if (policy[phase] !== undefined) models.push(String(object(policy[phase]).model))\n  }\n  return [...new Set(models)]\n}\n","import { ValidationError } from '../errors'\n\n/** Exact retry controls accepted at `AgentProfile.model.metadata.retry`. */\nexport interface RouterRetryPolicy {\n  /** Total attempts, including the first request. */\n  readonly maxAttempts?: number\n  /** Delay before the second attempt. Later delays grow exponentially. */\n  readonly initialBackoffMs?: number\n  /** Maximum delay between attempts. */\n  readonly maxBackoffMs?: number\n  /** Symmetric random variation around each delay, from 0 through 1. */\n  readonly jitter?: number\n  /** HTTP statuses that may be retried. */\n  readonly retryStatuses?: ReadonlyArray<number>\n  /** Deadline for receiving one attempt's response headers. Zero disables it. */\n  readonly requestTimeoutMs?: number\n}\n\nexport interface ResolvedRouterRetryPolicy {\n  readonly maxAttempts: number\n  readonly initialBackoffMs: number\n  readonly maxBackoffMs: number\n  readonly jitter: number\n  readonly retryStatuses: ReadonlyArray<number>\n  readonly requestTimeoutMs: number\n}\n\nconst maximumTimerMs = 2_147_483_647\nconst defaultRetryStatuses = Object.freeze([408, 425, 429, 500, 502, 503, 504, 520, 522, 524])\nconst retryPolicyKeys = new Set([\n  'initialBackoffMs',\n  'jitter',\n  'maxAttempts',\n  'maxBackoffMs',\n  'requestTimeoutMs',\n  'retryStatuses',\n])\n\n/** Parse untrusted profile/config data once and return an immutable complete policy. */\nexport function resolveRouterRetryPolicy(\n  input: unknown,\n  context: string,\n): ResolvedRouterRetryPolicy {\n  if (\n    input !== undefined &&\n    (typeof input !== 'object' || input === null || Array.isArray(input))\n  ) {\n    throw new ValidationError(`${context} must be an object`)\n  }\n  const policy = input === undefined ? {} : Object.fromEntries(Object.entries(input))\n  const unknown = Object.keys(policy).filter((key) => !retryPolicyKeys.has(key))\n  if (unknown.length > 0) {\n    throw new ValidationError(`${context} has unsupported fields: ${unknown.join(', ')}`)\n  }\n  const maxAttempts = positiveInteger(policy.maxAttempts, 5, `${context}.maxAttempts`)\n  const initialBackoffMs = timerInteger(\n    policy.initialBackoffMs,\n    1_000,\n    `${context}.initialBackoffMs`,\n  )\n  const maxBackoffMs = timerInteger(policy.maxBackoffMs, 30_000, `${context}.maxBackoffMs`)\n  const requestTimeoutMs = timerInteger(\n    policy.requestTimeoutMs,\n    0,\n    `${context}.requestTimeoutMs`,\n    Number.MAX_SAFE_INTEGER - Date.now(),\n  )\n  const jitter = policy.jitter ?? 0.25\n  if (typeof jitter !== 'number' || !Number.isFinite(jitter) || jitter < 0 || jitter > 1) {\n    throw new ValidationError(`${context}.jitter must be a finite number from 0 through 1`)\n  }\n  const retryStatuses = parseRetryStatuses(policy.retryStatuses, context)\n  return Object.freeze({\n    maxAttempts,\n    initialBackoffMs,\n    maxBackoffMs,\n    jitter,\n    retryStatuses,\n    requestTimeoutMs,\n  })\n}\n\nfunction parseRetryStatuses(value: unknown, context: string): ReadonlyArray<number> {\n  if (value === undefined) return defaultRetryStatuses\n  if (!Array.isArray(value)) {\n    throw new ValidationError(`${context}.retryStatuses must be an array of HTTP statuses`)\n  }\n  const statuses: number[] = []\n  const seen = new Set<number>()\n  for (const status of value) {\n    if (!Number.isSafeInteger(status) || status < 100 || status > 599) {\n      throw new ValidationError(\n        `${context}.retryStatuses must contain integer HTTP statuses from 100 through 599`,\n      )\n    }\n    if (seen.has(status)) {\n      throw new ValidationError(`${context}.retryStatuses must not contain duplicates`)\n    }\n    seen.add(status)\n    statuses.push(status)\n  }\n  return Object.freeze(statuses)\n}\n\nfunction positiveInteger(value: unknown, fallback: number, context: string): number {\n  const parsed = value ?? fallback\n  if (typeof parsed !== 'number' || !Number.isSafeInteger(parsed) || parsed < 1) {\n    throw new ValidationError(`${context} must be a positive safe integer`)\n  }\n  return parsed\n}\n\nfunction timerInteger(\n  value: unknown,\n  fallback: number,\n  context: string,\n  maximum = maximumTimerMs,\n): number {\n  const parsed = value ?? fallback\n  if (\n    typeof parsed !== 'number' ||\n    !Number.isSafeInteger(parsed) ||\n    parsed < 0 ||\n    parsed > maximum\n  ) {\n    throw new ValidationError(\n      `${context} must be a nonnegative safe integer no greater than ${maximum}`,\n    )\n  }\n  return parsed\n}\n","/**\n * `assertModelAllowed` — a fail-loud guard that restricts a run to a chosen subset of\n * models. The two front doors (`supervise()` / `improve()`) call it once per configured\n * model at resolve time, so a run that names a model outside the allowed set throws before\n * any compute is spent — never silently swapped or silently allowed.\n */\nimport { HARNESS_NATIVE_MODEL } from '@tangle-network/agent-eval'\nimport type { AgentProfile } from '@tangle-network/agent-interface'\nimport { ConfigError } from '../../errors'\nimport { agentHarness } from '../harness-role'\nimport { routerAutoDeclaredModels } from '../router-auto-evidence'\nimport { type ResolvedRouterRetryPolicy, resolveRouterRetryPolicy } from '../router-retry-policy'\n\n/**\n * Return the model id an executor may send to a provider.\n *\n * Eval stamps {@link HARNESS_NATIVE_MODEL} into a profile when model selection is deliberately\n * delegated to the configured runtime. That marker belongs in experiment identity and cost\n * admission; it is not a provider model id.\n */\nexport function concreteModelId(model: string | undefined): string | undefined {\n  if (model === undefined) return undefined\n  const id = model.trim()\n  return id.length > 0 && !isHarnessNativeModel(id) ? id : undefined\n}\n\n/** Whether a model value delegates selection to the chosen execution system. */\nexport function isHarnessNativeModel(model: string | undefined): boolean {\n  return model?.trim() === HARNESS_NATIVE_MODEL\n}\n\n/** Return a profile's explicitly selected provider model, if it has one. */\nexport function concreteProfileModel(profile: Pick<AgentProfile, 'model'>): string | undefined {\n  return concreteModelId(profile.model?.default)\n}\n\n/**\n * Return the model id for a direct provider request.\n *\n * A portable profile can qualify its model with the selected provider. The direct endpoint already\n * selects that provider, so remove only the exact matching prefix. Preserve every other prefix\n * because it can identify a provider-owned nested route, such as `anthropic/claude-sonnet`.\n */\nexport function profileProviderModel(profile: Pick<AgentProfile, 'model'>): string | undefined {\n  const model = concreteProfileModel(profile)\n  const provider = profile.model?.provider?.trim()\n  if (!model || !provider || !model.startsWith(`${provider}/`)) return model\n  return concreteModelId(model.slice(provider.length + 1))\n}\n\n/** The full cli-bridge wire id declared by a profile: harness/provider/model. */\nexport function profileBridgeWireModel(\n  profile: Pick<AgentProfile, 'harness' | 'model'>,\n): string | undefined {\n  const model = concreteProfileModel(profile)\n  const provider = profile.model?.provider\n  const harness = agentHarness(profile.harness)\n  const modelWithoutHarness =\n    model && harness && model.startsWith(`${harness}/`) ? model.slice(harness.length + 1) : model\n  const providerModel = modelWithoutHarness\n    ? provider && !modelWithoutHarness.startsWith(`${provider}/`)\n      ? `${provider}/${modelWithoutHarness}`\n      : modelWithoutHarness\n    : undefined\n  if (!harness) return providerModel\n  if (!providerModel) return harness\n  return providerModel.startsWith(`${harness}/`) ? providerModel : `${harness}/${providerModel}`\n}\n\n/**\n * Refuse an incomplete execution identity before any backend may fill it from ambient config.\n * `AgentProfile` is the sole behavioral authority: harness, provider, and concrete model all\n * participate in its digest. Eval's runtime-selected marker is a matrix-planning value, never an\n * executable model.\n */\nexport function assertExecutableAgentProfile(profile: AgentProfile, context: string): void {\n  if (profile.harness === undefined) {\n    throw new ConfigError(`${context}: AgentProfile.harness must be explicit before execution`)\n  }\n  const declared = profile.model?.default\n  const model = concreteModelId(declared)\n  if (!model) {\n    const reason = isHarnessNativeModel(declared) ? 'runtime-selected' : 'missing'\n    throw new ConfigError(\n      `${context}: AgentProfile.model.default is ${reason}; execution requires a concrete model`,\n    )\n  }\n  if (!profile.model?.provider?.trim()) {\n    throw new ConfigError(\n      `${context}: AgentProfile.model.provider must be explicit before execution`,\n    )\n  }\n}\n\n/**\n * Separate completion ceilings an exact profile may request.\n *\n * They are distinct because providers do not share one meaning for a single number: measured\n * through the Tangle Router on 2026-08-10, `glm-5.2` accepted `max_tokens: 8` and still billed 135\n * completion tokens — 132 reasoning, 3 visible — while `max_completion_tokens: 256` bounded the\n * total. A path that cannot enforce a requested ceiling refuses the run instead of sending a\n * number that means something else there.\n */\nexport interface ProfileTokenLimits {\n  /** Visible answer tokens, from `AgentProfile.model.maxVisibleOutputTokens`. */\n  readonly visible?: number\n  /** Hidden reasoning tokens, from `AgentProfile.model.maxReasoningTokens`. */\n  readonly reasoning?: number\n  /** Visible and reasoning tokens together, from `AgentProfile.model.maxTotalOutputTokens`. */\n  readonly total?: number\n}\n\n/** The ceilings one execution path actually sends, in the request fields it sends them as. */\nexport interface AppliedTokenLimits {\n  /** Sent as `max_tokens`. */\n  readonly maxTokens?: number\n  /** Sent as `max_completion_tokens`. */\n  readonly maxCompletionTokens?: number\n}\n\n/** What a path was asked to enforce and what it sent, for the execution receipt. */\nexport interface TokenLimitDecision {\n  readonly requested: ProfileTokenLimits\n  readonly applied: AppliedTokenLimits\n}\n\n/** The execution paths that lower a profile into a provider request. */\nexport type ModelExecutionPath = 'router' | 'bridge' | 'sandbox' | 'provider'\n\n/** Generation and loop controls that may affect one model execution. */\nexport interface ProfileModelExecutionSettings {\n  readonly temperature?: number\n  /** Completion ceilings the profile requested. Empty when it requested none. */\n  readonly tokenLimits: ProfileTokenLimits\n  readonly retry?: ResolvedRouterRetryPolicy\n  readonly seed?: number\n  readonly toolChoice?: 'auto' | 'required' | 'none'\n  readonly extraBody?: Readonly<Record<string, unknown>>\n  /** Zero means no turn-count cap; conserved budgets and deadlines still apply. */\n  readonly maxTurns?: number\n  /**\n   * Take each Router completion over SSE, with or without tools. The Router's request deadline ends\n   * when response headers are committed, so a long thinking-model answer needs a stream to finish.\n   * Requires the HTTP transport; an injected buffered `complete` transport is refused.\n   */\n  readonly stream?: boolean\n}\n\nconst PROFILE_MODEL_METADATA_KEYS = new Set([\n  'extraBody',\n  'maxTurns',\n  'retry',\n  'seed',\n  'stream',\n  'temperature',\n  'toolChoice',\n])\n\n/**\n * Read execution controls from the exact profile and reject unknown controls.\n * Credential intent reaches environment providers unchanged; other paths cannot enforce it.\n * Backends receive endpoint/auth and executable ports only; they cannot silently alter behavior.\n */\nexport function profileModelExecutionSettings(\n  profile: Pick<AgentProfile, 'model'>,\n  context: string,\n  path: ModelExecutionPath = 'router',\n): ProfileModelExecutionSettings {\n  const metadata = profile.model?.metadata ?? {}\n  if (metadata.maxTokens !== undefined) {\n    throw new ConfigError(\n      `${context}: AgentProfile.model.metadata.maxTokens is ambiguous across providers; declare AgentProfile.model.maxVisibleOutputTokens, maxReasoningTokens, or maxTotalOutputTokens instead`,\n    )\n  }\n  const unknown = Object.keys(metadata).filter(\n    (key) =>\n      !PROFILE_MODEL_METADATA_KEYS.has(key) && !(path === 'provider' && key === 'credentialSource'),\n  )\n  if (unknown.length > 0) {\n    throw new ConfigError(\n      `${context}: unsupported AgentProfile.model.metadata fields: ${unknown.join(', ')}`,\n    )\n  }\n  if (\n    metadata.credentialSource !== undefined &&\n    metadata.credentialSource !== 'managed' &&\n    metadata.credentialSource !== 'subscription'\n  ) {\n    throw new ConfigError(\n      `${context}: AgentProfile.model.metadata.credentialSource must be managed or subscription`,\n    )\n  }\n  const temperature = finiteNumber(metadata.temperature, `${context}: temperature`)\n  const tokenLimits = profileTokenLimits(profile, context)\n  const retryInput = metadata.retry\n  const retry =\n    retryInput === undefined\n      ? undefined\n      : resolveRouterRetryPolicy(retryInput, `${context}: AgentProfile.model.metadata.retry`)\n  const seed = safeInteger(metadata.seed, `${context}: seed`)\n  const maxTurns = nonnegativeInteger(metadata.maxTurns, `${context}: maxTurns`)\n  const stream = optionalBoolean(metadata.stream, `${context}: stream`)\n  const toolChoice = metadata.toolChoice\n  if (\n    toolChoice !== undefined &&\n    toolChoice !== 'auto' &&\n    toolChoice !== 'required' &&\n    toolChoice !== 'none'\n  ) {\n    throw new ConfigError(`${context}: toolChoice must be auto, required, or none`)\n  }\n  const extraBody = metadata.extraBody\n  if (\n    extraBody !== undefined &&\n    (typeof extraBody !== 'object' || extraBody === null || Array.isArray(extraBody))\n  ) {\n    throw new ConfigError(`${context}: extraBody must be an object`)\n  }\n  return {\n    ...(temperature !== undefined ? { temperature } : {}),\n    tokenLimits,\n    ...(retry !== undefined ? { retry } : {}),\n    ...(seed !== undefined ? { seed } : {}),\n    ...(toolChoice !== undefined ? { toolChoice } : {}),\n    ...(extraBody !== undefined\n      ? { extraBody: Object.freeze({ ...(extraBody as Record<string, unknown>) }) }\n      : {}),\n    ...(maxTurns !== undefined ? { maxTurns } : {}),\n    ...(stream !== undefined ? { stream } : {}),\n  }\n}\n\n/**\n * Read the completion ceilings an exact profile declares. The Interface schema already refines\n * these fields, but a profile can reach an executor without a parse, so the same rules are\n * enforced here: positive integers, and no single ceiling above the total.\n */\nexport function profileTokenLimits(\n  profile: Pick<AgentProfile, 'model'>,\n  context: string,\n): ProfileTokenLimits {\n  const model = profile.model\n  const visible = positiveInteger(\n    model?.maxVisibleOutputTokens,\n    `${context}: maxVisibleOutputTokens`,\n  )\n  const reasoning = positiveInteger(model?.maxReasoningTokens, `${context}: maxReasoningTokens`)\n  const total = positiveInteger(model?.maxTotalOutputTokens, `${context}: maxTotalOutputTokens`)\n  if (total !== undefined) {\n    for (const [name, value] of [\n      ['maxVisibleOutputTokens', visible],\n      ['maxReasoningTokens', reasoning],\n    ] as const) {\n      if (value !== undefined && value > total) {\n        throw new ConfigError(\n          `${context}: AgentProfile.model.${name} (${value}) exceeds maxTotalOutputTokens (${total})`,\n        )\n      }\n    }\n  }\n  return {\n    ...(visible !== undefined ? { visible } : {}),\n    ...(reasoning !== undefined ? { reasoning } : {}),\n    ...(total !== undefined ? { total } : {}),\n  }\n}\n\n/**\n * Lower the requested ceilings onto one execution path, or refuse the run before any paid\n * transport.\n *\n * - Router and OpenAI-compatible routes send the visible ceiling as `max_tokens` and the total as\n *   `max_completion_tokens`.\n * - The CLI Bridge lowers ONE completion cap into the run's model catalog, so it carries the total\n *   as `max_tokens` and cannot bound the visible half on its own.\n * - The Sandbox and environment-provider paths expose no completion cap at all.\n * - No route publishes a reasoning-token budget, so a reasoning ceiling is refused everywhere.\n *   `AgentProfile.model.reasoningEffort` is an intensity dial, not a token bound.\n */\nexport function enforceTokenLimits(\n  limits: ProfileTokenLimits,\n  path: ModelExecutionPath,\n  context: string,\n): TokenLimitDecision {\n  const refuse = (field: string, reason: string): never => {\n    throw new ConfigError(\n      `${context}: AgentProfile.model.${field} cannot be enforced on the ${path} path (${reason}); remove the ceiling or select a path that enforces it`,\n    )\n  }\n  if (limits.reasoning !== undefined) {\n    refuse('maxReasoningTokens', 'no route exposes a reasoning-token budget')\n  }\n  if (path === 'router') {\n    return {\n      requested: limits,\n      applied: {\n        ...(limits.visible !== undefined ? { maxTokens: limits.visible } : {}),\n        ...(limits.total !== undefined ? { maxCompletionTokens: limits.total } : {}),\n      },\n    }\n  }\n  if (path === 'bridge') {\n    if (limits.visible !== undefined) {\n      refuse('maxVisibleOutputTokens', 'the bridge lowers one completion cap covering both halves')\n    }\n    return {\n      requested: limits,\n      applied: {\n        ...(limits.total !== undefined ? { maxTokens: limits.total } : {}),\n      },\n    }\n  }\n  if (limits.visible !== undefined) refuse('maxVisibleOutputTokens', 'the backend accepts no cap')\n  if (limits.total !== undefined) refuse('maxTotalOutputTokens', 'the backend accepts no cap')\n  return { requested: limits, applied: {} }\n}\n\nfunction finiteNumber(value: unknown, context: string): number | undefined {\n  if (value === undefined) return undefined\n  if (typeof value !== 'number' || !Number.isFinite(value)) {\n    throw new ConfigError(`${context} must be a finite number`)\n  }\n  return value\n}\n\nfunction safeInteger(value: unknown, context: string): number | undefined {\n  if (value === undefined) return undefined\n  if (!Number.isSafeInteger(value)) throw new ConfigError(`${context} must be a safe integer`)\n  return value as number\n}\n\nfunction positiveInteger(value: unknown, context: string): number | undefined {\n  const parsed = safeInteger(value, context)\n  if (parsed !== undefined && parsed < 1) {\n    throw new ConfigError(`${context} must be positive`)\n  }\n  return parsed\n}\n\nfunction nonnegativeInteger(value: unknown, context: string): number | undefined {\n  const parsed = safeInteger(value, context)\n  if (parsed !== undefined && parsed < 0) {\n    throw new ConfigError(`${context} must be nonnegative`)\n  }\n  return parsed\n}\n\nfunction optionalBoolean(value: unknown, context: string): boolean | undefined {\n  if (value === undefined) return undefined\n  if (typeof value !== 'boolean') throw new ConfigError(`${context} must be boolean`)\n  return value\n}\n\n/**\n * Throw a `ConfigError` when `allowed` is set, `model` is defined, and `model` is not a\n * member of `allowed`. No-op when `allowed` is unset (the unrestricted default) or when\n * `model` is undefined (nothing was configured to check).\n */\nexport function assertModelAllowed(\n  model: string | undefined,\n  allowed: readonly string[] | undefined,\n): void {\n  if (!allowed || model === undefined) return\n  if (!allowed.includes(model)) {\n    throw new ConfigError(\n      `model ${JSON.stringify(model)} is not in the allowed set ${JSON.stringify([...allowed])}`,\n    )\n  }\n}\n\n/** Check every canonical model-bearing field in a complete profile, including the models a\n * backend may select for cheap work, named subagents, or modes.\n *\n * Every compared value is a bare model id. The composed `harness/provider/model` wire id\n * (`profileBridgeWireModel`) is neither built nor compared here, so this admits any route that\n * declares an allowed id, and a qualified entry in `allowed` matches nothing. Route pinning\n * belongs to `SuperviseOptions.authorizeSpawn`. */\nexport function assertProfileModelsAllowed(\n  profile: AgentProfile,\n  allowed: readonly string[] | undefined,\n): void {\n  assertModelAllowed(profile.model?.default, allowed)\n  assertModelAllowed(profile.model?.small, allowed)\n  if (profile.model?.default === 'tangle/auto') {\n    const extra = profile.model.metadata?.extraBody\n    const policy =\n      extra !== null && typeof extra === 'object'\n        ? (extra as Record<string, unknown>).auto\n        : undefined\n    for (const model of routerAutoDeclaredModels(policy)) assertModelAllowed(model, allowed)\n  }\n  for (const subagent of Object.values(profile.subagents ?? {})) {\n    assertModelAllowed(subagent.model, allowed)\n  }\n  for (const mode of Object.values(profile.modes ?? {})) {\n    assertModelAllowed(mode.model, allowed)\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAyBA,MAAM,qCAA0C,IAAI,IAAY,CAAC,UAAgC,CAAC;;;;AAKlG,SAAgB,iBAAmC,SAA6C;CAC9F,OAAO,WAAW,QAAQ,CAAC,mBAAmB,IAAI,OAAO;AAC3D;;;AAIA,SAAgB,aAA+B,SAA8C;CAC3F,OAAO,iBAAiB,OAAO,IAAI,UAAU,KAAA;AAC/C;;;ACpCA,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;AACvB,MAAM,qBAAqB;AAC3B,MAAM,mBAAmB;;AAkBzB,SAAgB,6BAA6B,UAAkB,UAA2B;CACxF,MAAM,mBAAmB,mBAAmB,QAAQ;CACpD,MAAM,mBAAmB,mBAAmB,QAAQ;CACpD,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,OAAO;CACnD,IACE,iBAAiB,aAAa,KAAA,MAC7B,iBAAiB,aAAa,iBAAiB,YAC9C,iBAAiB,iBAAiB,iBAAiB,eAErD,OAAO;CAET,OAAO,oBAAoB,iBAAiB,MAAM,iBAAiB,IAAI;AACzE;;AAGA,SAAgB,2BAA2B,SAAiB,MAAkC;CAC5F,MAAM,kBAAkB,mBAAmB,OAAO;CAClD,MAAM,eAAe,mBAAmB,IAAI;CAC5C,IAAI,CAAC,mBAAmB,CAAC,cAAc,OAAO,KAAA;CAC9C,IAAI,CAAC,oBAAoB,gBAAgB,MAAM,aAAa,IAAI,GAAG,OAAO,KAAA;CAC1E,IACE,gBAAgB,aAAa,KAAA,KAC7B,aAAa,aAAa,KAAA,MACzB,gBAAgB,aAAa,aAAa,YACzC,gBAAgB,iBAAiB,aAAa,eAEhD;CAEF,OAAO,gBAAgB,aAAa,KAAA,KAAa,aAAa,aAAa,KAAA,IACvE,OACA;AACN;;AAQA,SAAgB,4BACd,OACyC;CACzC,MAAM,WAAW,mBAAmB,KAAK;CACzC,IAAI,CAAC,UAAU,OAAO,KAAA;CACtB,MAAM,OAAO,SAAS,KAAK,MAAM,SAAS,KAAK,YAAY,GAAG,IAAI,CAAC;CACnE,MAAM,YACJ,SAAS,aAAa,KAAA,IAClB,OACA,SAAS,iBAAiB,SACxB,GAAG,KAAK,GAAG,SAAS,aACpB,GAAG,KAAK,GAAG,SAAS;CAC5B,OAAO;EACL;EACA,GAAI,SAAS,aAAa,KAAA,IAAY,EAAE,UAAU,SAAS,SAAS,IAAI,CAAC;EACzE,GAAI,SAAS,iBAAiB,KAAA,IAAY,EAAE,cAAc,SAAS,aAAa,IAAI,CAAC;EACrF;CACF;AACF;;AAGA,SAAgB,yBAAyB,OAAwB;CAC/D,OAAO,mBAAmB,KAAK,CAAC,EAAE,aAAa,KAAA;AACjD;AAEA,SAAS,mBAAmB,OAA0C;CACpE,IAAI,MAAM,WAAW,GAAG,OAAO;CAC/B,MAAM,KAAK,MAAM,YAAY,GAAG;CAChC,IAAI,KAAK,GAAG;EACV,MAAM,QAAQ,mBAAmB,KAAK;EACtC,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,OAAO,UAAU,KAAK,CAAC,CAAC,WAAW,IAAI,OAAO,EAAE,MAAM,MAAM;CAC9D;CACA,MAAM,OAAO,MAAM,MAAM,GAAG,EAAE;CAC9B,MAAM,WAAW,MAAM,MAAM,KAAK,CAAC;CACnC,IAAI,KAAK,WAAW,KAAK,UAAU,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,eAAe,KAAK,QAAQ,GACpF,OAAO;CAET,OAAO;EAAE;EAAM;EAAU,cAAc;CAAS;AAClD;AAEA,SAAS,oBAAoB,UAAkB,UAA2B;CACxE,MAAM,eAAe,eAAe,QAAQ;CAC5C,MAAM,eAAe,eAAe,QAAQ;CAC5C,IAAI,CAAC,SAAS,aAAa,MAAM,aAAa,IAAI,GAAG,OAAO;CAI5D,IACE,aAAa,aAAa,KAAA,KAC1B,aAAa,aAAa,KAAA,KAC1B,aAAa,aAAa,UAAU,aAAa,QAAQ,GAEzD,OAAO;CAKT,IAAI,aAAa,aAAa,mBAAmB,aAAa,aAAa,iBAAiB;EAC1F,MAAM,SAAS,aAAa,aAAa,kBAAkB,eAAe;EAC1E,MAAM,WAAW,aAAa,aAAa,kBAAkB,eAAe;EAC5E,IAAI,SAAS,aAAa,KAAA,GAAW,OAAO;EAC5C,OACE,SAAS,OAAO,MAAM,SAAS,IAAI,KAClC,OAAO,KAAK,OAAO,SAAS,YAAY,SAAS,OAAO,KAAK,MAAM,CAAC,GAAG,SAAS,IAAI;CAEzF;CAEA,OAAO;AACT;;;;;AAMA,SAAS,aAAa,MAAc,OAAwB;CAC1D,OAAO,KAAK,WAAW,KAAK,EAAE,MAAM,MAAM,WAAW,KAAK,EAAE;AAC9D;AAOA,SAAS,eAAe,OAA+B;CACrD,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,MAAM,aACJ,SAAS,SAAS,KAAK,gBAAgB,SAAS,EAAE,IAAI,SAAS,MAAM,CAAC,IAAI;CAC5E,IAAI,WAAW,WAAW,GAAG,OAAO;EAAE,UAAU,KAAA;EAAW,MAAM;CAAW;CAC5E,OAAO;EAAE,UAAU,WAAW;EAAI,MAAM,WAAW,MAAM,CAAC;CAAE;AAC9D;AAEA,SAAS,gBAAgB,SAAsC;CAC7D,OAAO,YAAY,KAAA,KAAa,kBAAkB,UAAU,OAAO,CAAC,CAAC;AACvE;AAEA,SAAS,SAAS,MAA6B,OAAuC;CACpF,OAAO,KAAK,WAAW,MAAM,UAAU,KAAK,OAAO,SAAS,UAAU,YAAY,MAAM,MAAM;AAChG;AAEA,SAAS,UAAU,OAAuB;CACxC,OAAO,MAAM,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC;AAC/C;;;;;;;AAQA,SAAS,mBAAmB,OAAsD;CAChF,MAAM,MAAM,eAAe,KAAK,KAAK;CACrC,IAAI,KAAK;EACP,MAAM,GAAG,MAAM,UAAU,WAAW,WAAW;EAC/C,OAAO,mBACL,MACA,GAAG,SAAS,GAAG,UAAU,GAAG,WAC5B,oBAAoB,UAAU,WAAW,OAAO,CAClD;CACF;CAEA,MAAM,UAAU,mBAAmB,KAAK,KAAK;CAC7C,IAAI,SAAS;EACX,MAAM,GAAG,MAAM,UAAU,WAAW,WAAW;EAC/C,OAAO,mBACL,MACA,GAAG,SAAS,GAAG,UAAU,GAAG,WAC5B,oBAAoB,UAAU,WAAW,OAAO,CAClD;CACF;CAEA,MAAM,QAAQ,iBAAiB,KAAK,KAAK;CACzC,IAAI,OAAO;EACT,MAAM,GAAG,MAAM,UAAU,aAAa;EACtC,OAAO,mBACL,MACA,GAAG,SAAS,GAAG,aACf,qBAAqB,UAAU,SAAS,CAC1C;CACF;AAGF;AAEA,SAAS,mBACP,MACA,UACA,OACuC;CAEvC,IAAI,SAAS,KAAA,KAAa,KAAK,WAAW,KAAK,KAAK,SAAS,GAAG,GAAG,OAAO,KAAA;CAC1E,OAAO,QAAQ;EAAE;EAAM;EAAU,cAAc;CAAO,IAAI;AAC5D;AAEA,SAAS,oBACP,UACA,WACA,SACS;CACT,IAAI,aAAa,KAAA,KAAa,cAAc,KAAA,KAAa,YAAY,KAAA,GAAW,OAAO;CACvF,MAAM,OAAO,OAAO,QAAQ;CAC5B,MAAM,QAAQ,OAAO,SAAS;CAC9B,MAAM,MAAM,OAAO,OAAO;CAC1B,IAAI,OAAO,OAAQ,OAAO,QAAQ,QAAQ,KAAK,QAAQ,MAAM,MAAM,KAAK,MAAM,IAC5E,OAAO;CAET,MAAM,OAAO,IAAI,KAAK,KAAK,IAAI,MAAM,QAAQ,GAAG,GAAG,CAAC;CACpD,OACE,KAAK,eAAe,MAAM,QAAQ,KAAK,YAAY,MAAM,QAAQ,KAAK,KAAK,WAAW,MAAM;AAEhG;AAEA,SAAS,qBACP,UACA,WACS;CACT,IAAI,aAAa,KAAA,KAAa,cAAc,KAAA,GAAW,OAAO;CAC9D,MAAM,OAAO,OAAO,QAAQ;CAC5B,MAAM,QAAQ,OAAO,SAAS;CAC9B,OAAO,QAAQ,OAAQ,QAAQ,QAAQ,SAAS,KAAK,SAAS;AAChE;;;AC/OA,SAAS,OAAO,OAAyC;CACvD,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,gBAAgB,2DAA2D;CAEvF,OAAO;AACT;;AAGA,SAAgB,4BAA4B,OAAgB,QAAmC;CAC7F,MAAM,SAAS,OAAO,KAAK;CAC3B,IAAI,WAAW,MAAM,MAAM,IAAI,gBAAgB,yCAAyC;CACxF,IACE,OAAO,YAAY,KACnB,OAAO,OAAO,OAAO,YACrB,OAAO,OAAO,aAAa,YAC3B,CAAC,MAAM,QAAQ,OAAO,UAAU,KAChC,OAAO,WAAW,WAAW,GAE7B,MAAM,IAAI,gBACR,yEACF;CAEF,KAAK,MAAM,OAAO,OAAO,YAAY;EACnC,MAAM,WAAW,OAAO,GAAG;EAC3B,IACE,OAAO,SAAS,OAAO,YACvB,OAAO,SAAS,UAAU,YAC1B,SAAS,UAAU,iBACnB,SAAS,MAAM,WAAW,GAE1B,MAAM,IAAI,gBAAgB,iDAAiD;CAE/E;CACA,KAAK,MAAM,SAAS,CAAC,YAAY,QAAQ,GACvC,IAAI,OAAO,WAAW,KAAA,KAAa,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,UAAU,UACxE,MAAM,IAAI,gBAAgB,mDAAmD;AAGnF;;AAGA,SAAgB,yBACd,aACA,UACA,QACM;CACN,MAAM,SAAS,OAAO,WAAW;CACjC,MAAM,UAAU,OAAO,OAAO,QAAQ,CAAC,CAAC,WAAW;CACnD,MAAM,WAAW,OAAO,QAAQ,QAAQ;CACxC,MAAM,aAAa,OAAO;CAC1B,MAAM,WAAW,WAAW,IAAI,MAAM,CAAC,CAAC,MAAM,aAAa,SAAS,OAAO,SAAS,UAAU;CAC9F,IACE,SAAS,mBAAmB,iBAC5B,SAAS,aAAa,OAAO,MAC7B,SAAS,mBAAmB,OAAO,YACnC,OAAO,SAAS,iBAAiB,YACjC,CAAC,YACD,SAAS,kBAAkB,SAAS,SACpC,WAAW,KAAA,KACX,CAAC,6BAA6B,QAAQ,OAAO,SAAS,KAAK,CAAC,GAE5D,MAAM,IAAI,gBACR,yEACF;CAEF,IAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,KAAK,QAAQ,MAAM,WAAW,GAC5D,MAAM,IAAI,gBAAgB,wDAAwD;CAEpF,KAAK,MAAM,OAAO,QAAQ,OAAO;EAC/B,MAAM,OAAO,OAAO,GAAG;EACvB,MAAM,WACJ,KAAK,UAAU,aACX,OAAO,OAAO,QAAQ,CAAC,CAAC,QACxB,KAAK,UAAU,WACb,OAAO,OAAO,MAAM,CAAC,CAAC,QACtB,KAAK,UAAU,aAAa,KAAK,UAAU,eACzC,WAAW,IAAI,MAAM,CAAC,CAAC,KAAK,aAAa,SAAS,KAAK,IACvD,CAAC;EACX,MAAM,UAAU,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ;EAC9D,IACE,OAAO,KAAK,UAAU,YACtB,CAAC,QAAQ,MACN,UACC,OAAO,UAAU,YAAY,6BAA6B,KAAK,OAAiB,KAAK,CACzF,GAEA,MAAM,IAAI,gBAAgB,gEAAgE;CAC9F;AACF;;AAGA,SAAgB,yBAAyB,OAAmC;CAC1E,4BAA4B,OAAO,KAAA,CAAS;CAC5C,MAAM,SAAS,OAAO,KAAK;CAC3B,MAAM,SAAU,OAAO,WAAyB,KAAK,QAAQ,OAAO,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC;CACtF,KAAK,MAAM,SAAS,CAAC,YAAY,QAAQ,GACvC,IAAI,OAAO,WAAW,KAAA,GAAW,OAAO,KAAK,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,KAAK,CAAC;CAElF,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAC5B;;;AC3EA,MAAM,iBAAiB;AACvB,MAAM,uBAAuB,OAAO,OAAO;CAAC;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;AAAG,CAAC;AAC7F,MAAM,kCAAkB,IAAI,IAAI;CAC9B;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,SAAgB,yBACd,OACA,SAC2B;CAC3B,IACE,UAAU,KAAA,MACT,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,IAEnE,MAAM,IAAI,gBAAgB,GAAG,QAAQ,mBAAmB;CAE1D,MAAM,SAAS,UAAU,KAAA,IAAY,CAAC,IAAI,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC;CAClF,MAAM,UAAU,OAAO,KAAK,MAAM,CAAC,CAAC,QAAQ,QAAQ,CAAC,gBAAgB,IAAI,GAAG,CAAC;CAC7E,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,gBAAgB,GAAG,QAAQ,2BAA2B,QAAQ,KAAK,IAAI,GAAG;CAEtF,MAAM,cAAcA,kBAAgB,OAAO,aAAa,GAAG,GAAG,QAAQ,aAAa;CACnF,MAAM,mBAAmB,aACvB,OAAO,kBACP,KACA,GAAG,QAAQ,kBACb;CACA,MAAM,eAAe,aAAa,OAAO,cAAc,KAAQ,GAAG,QAAQ,cAAc;CACxF,MAAM,mBAAmB,aACvB,OAAO,kBACP,GACA,GAAG,QAAQ,oBACX,OAAO,mBAAmB,KAAK,IAAI,CACrC;CACA,MAAM,SAAS,OAAO,UAAU;CAChC,IAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,KAAK,SAAS,GACnF,MAAM,IAAI,gBAAgB,GAAG,QAAQ,iDAAiD;CAExF,MAAM,gBAAgB,mBAAmB,OAAO,eAAe,OAAO;CACtE,OAAO,OAAO,OAAO;EACnB;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;AACH;AAEA,SAAS,mBAAmB,OAAgB,SAAwC;CAClF,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,gBAAgB,GAAG,QAAQ,iDAAiD;CAExF,MAAM,WAAqB,CAAC;CAC5B,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,UAAU,OAAO;EAC1B,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,OAAO,SAAS,KAC5D,MAAM,IAAI,gBACR,GAAG,QAAQ,uEACb;EAEF,IAAI,KAAK,IAAI,MAAM,GACjB,MAAM,IAAI,gBAAgB,GAAG,QAAQ,2CAA2C;EAElF,KAAK,IAAI,MAAM;EACf,SAAS,KAAK,MAAM;CACtB;CACA,OAAO,OAAO,OAAO,QAAQ;AAC/B;AAEA,SAASA,kBAAgB,OAAgB,UAAkB,SAAyB;CAClF,MAAM,SAAS,SAAS;CACxB,IAAI,OAAO,WAAW,YAAY,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,GAC1E,MAAM,IAAI,gBAAgB,GAAG,QAAQ,iCAAiC;CAExE,OAAO;AACT;AAEA,SAAS,aACP,OACA,UACA,SACA,UAAU,gBACF;CACR,MAAM,SAAS,SAAS;CACxB,IACE,OAAO,WAAW,YAClB,CAAC,OAAO,cAAc,MAAM,KAC5B,SAAS,KACT,SAAS,SAET,MAAM,IAAI,gBACR,GAAG,QAAQ,sDAAsD,SACnE;CAEF,OAAO;AACT;;;;;;;;;;;;;;;;AC9GA,SAAgB,gBAAgB,OAA+C;CAC7E,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAM,KAAK,MAAM,KAAK;CACtB,OAAO,GAAG,SAAS,KAAK,CAAC,qBAAqB,EAAE,IAAI,KAAK,KAAA;AAC3D;;AAGA,SAAgB,qBAAqB,OAAoC;CACvE,OAAO,OAAO,KAAK,MAAM;AAC3B;;AAGA,SAAgB,qBAAqB,SAA0D;CAC7F,OAAO,gBAAgB,QAAQ,OAAO,OAAO;AAC/C;;;;;;;;AASA,SAAgB,qBAAqB,SAA0D;CAC7F,MAAM,QAAQ,qBAAqB,OAAO;CAC1C,MAAM,WAAW,QAAQ,OAAO,UAAU,KAAK;CAC/C,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,WAAW,GAAG,SAAS,EAAE,GAAG,OAAO;CACrE,OAAO,gBAAgB,MAAM,MAAM,SAAS,SAAS,CAAC,CAAC;AACzD;;AAGA,SAAgB,uBACd,SACoB;CACpB,MAAM,QAAQ,qBAAqB,OAAO;CAC1C,MAAM,WAAW,QAAQ,OAAO;CAChC,MAAM,UAAU,aAAa,QAAQ,OAAO;CAC5C,MAAM,sBACJ,SAAS,WAAW,MAAM,WAAW,GAAG,QAAQ,EAAE,IAAI,MAAM,MAAM,QAAQ,SAAS,CAAC,IAAI;CAC1F,MAAM,gBAAgB,sBAClB,YAAY,CAAC,oBAAoB,WAAW,GAAG,SAAS,EAAE,IACxD,GAAG,SAAS,GAAG,wBACf,sBACF,KAAA;CACJ,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,CAAC,eAAe,OAAO;CAC3B,OAAO,cAAc,WAAW,GAAG,QAAQ,EAAE,IAAI,gBAAgB,GAAG,QAAQ,GAAG;AACjF;;;;;;;AAQA,SAAgB,6BAA6B,SAAuB,SAAuB;CACzF,IAAI,QAAQ,YAAY,KAAA,GACtB,MAAM,IAAI,YAAY,GAAG,QAAQ,yDAAyD;CAE5F,MAAM,WAAW,QAAQ,OAAO;CAEhC,IAAI,CADU,gBAAgB,QACrB,GAEP,MAAM,IAAI,YACR,GAAG,QAAQ,kCAFE,qBAAqB,QAAQ,IAAI,qBAAqB,UAEf,sCACtD;CAEF,IAAI,CAAC,QAAQ,OAAO,UAAU,KAAK,GACjC,MAAM,IAAI,YACR,GAAG,QAAQ,gEACb;AAEJ;AAwDA,MAAM,8CAA8B,IAAI,IAAI;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,SAAgB,8BACd,SACA,SACA,OAA2B,UACI;CAC/B,MAAM,WAAW,QAAQ,OAAO,YAAY,CAAC;CAC7C,IAAI,SAAS,cAAc,KAAA,GACzB,MAAM,IAAI,YACR,GAAG,QAAQ,8KACb;CAEF,MAAM,UAAU,OAAO,KAAK,QAAQ,CAAC,CAAC,QACnC,QACC,CAAC,4BAA4B,IAAI,GAAG,KAAK,EAAE,SAAS,cAAc,QAAQ,mBAC9E;CACA,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,YACR,GAAG,QAAQ,oDAAoD,QAAQ,KAAK,IAAI,GAClF;CAEF,IACE,SAAS,qBAAqB,KAAA,KAC9B,SAAS,qBAAqB,aAC9B,SAAS,qBAAqB,gBAE9B,MAAM,IAAI,YACR,GAAG,QAAQ,+EACb;CAEF,MAAM,cAAc,aAAa,SAAS,aAAa,GAAG,QAAQ,cAAc;CAChF,MAAM,cAAc,mBAAmB,SAAS,OAAO;CACvD,MAAM,aAAa,SAAS;CAC5B,MAAM,QACJ,eAAe,KAAA,IACX,KAAA,IACA,yBAAyB,YAAY,GAAG,QAAQ,oCAAoC;CAC1F,MAAM,OAAO,YAAY,SAAS,MAAM,GAAG,QAAQ,OAAO;CAC1D,MAAM,WAAW,mBAAmB,SAAS,UAAU,GAAG,QAAQ,WAAW;CAC7E,MAAM,SAAS,gBAAgB,SAAS,QAAQ,GAAG,QAAQ,SAAS;CACpE,MAAM,aAAa,SAAS;CAC5B,IACE,eAAe,KAAA,KACf,eAAe,UACf,eAAe,cACf,eAAe,QAEf,MAAM,IAAI,YAAY,GAAG,QAAQ,6CAA6C;CAEhF,MAAM,YAAY,SAAS;CAC3B,IACE,cAAc,KAAA,MACb,OAAO,cAAc,YAAY,cAAc,QAAQ,MAAM,QAAQ,SAAS,IAE/E,MAAM,IAAI,YAAY,GAAG,QAAQ,8BAA8B;CAEjE,OAAO;EACL,GAAI,gBAAgB,KAAA,IAAY,EAAE,YAAY,IAAI,CAAC;EACnD;EACA,GAAI,UAAU,KAAA,IAAY,EAAE,MAAM,IAAI,CAAC;EACvC,GAAI,SAAS,KAAA,IAAY,EAAE,KAAK,IAAI,CAAC;EACrC,GAAI,eAAe,KAAA,IAAY,EAAE,WAAW,IAAI,CAAC;EACjD,GAAI,cAAc,KAAA,IACd,EAAE,WAAW,OAAO,OAAO,EAAE,GAAI,UAAsC,CAAC,EAAE,IAC1E,CAAC;EACL,GAAI,aAAa,KAAA,IAAY,EAAE,SAAS,IAAI,CAAC;EAC7C,GAAI,WAAW,KAAA,IAAY,EAAE,OAAO,IAAI,CAAC;CAC3C;AACF;;;;;;AAOA,SAAgB,mBACd,SACA,SACoB;CACpB,MAAM,QAAQ,QAAQ;CACtB,MAAM,UAAU,gBACd,OAAO,wBACP,GAAG,QAAQ,yBACb;CACA,MAAM,YAAY,gBAAgB,OAAO,oBAAoB,GAAG,QAAQ,qBAAqB;CAC7F,MAAM,QAAQ,gBAAgB,OAAO,sBAAsB,GAAG,QAAQ,uBAAuB;CAC7F,IAAI,UAAU,KAAA,GACP;OAAA,MAAM,CAAC,MAAM,UAAU,CAC1B,CAAC,0BAA0B,OAAO,GAClC,CAAC,sBAAsB,SAAS,CAClC,GACE,IAAI,UAAU,KAAA,KAAa,QAAQ,OACjC,MAAM,IAAI,YACR,GAAG,QAAQ,uBAAuB,KAAK,IAAI,MAAM,kCAAkC,MAAM,EAC3F;CAAA;CAIN,OAAO;EACL,GAAI,YAAY,KAAA,IAAY,EAAE,QAAQ,IAAI,CAAC;EAC3C,GAAI,cAAc,KAAA,IAAY,EAAE,UAAU,IAAI,CAAC;EAC/C,GAAI,UAAU,KAAA,IAAY,EAAE,MAAM,IAAI,CAAC;CACzC;AACF;;;;;;;;;;;;;AAcA,SAAgB,mBACd,QACA,MACA,SACoB;CACpB,MAAM,UAAU,OAAe,WAA0B;EACvD,MAAM,IAAI,YACR,GAAG,QAAQ,uBAAuB,MAAM,6BAA6B,KAAK,SAAS,OAAO,wDAC5F;CACF;CACA,IAAI,OAAO,cAAc,KAAA,GACvB,OAAO,sBAAsB,2CAA2C;CAE1E,IAAI,SAAS,UACX,OAAO;EACL,WAAW;EACX,SAAS;GACP,GAAI,OAAO,YAAY,KAAA,IAAY,EAAE,WAAW,OAAO,QAAQ,IAAI,CAAC;GACpE,GAAI,OAAO,UAAU,KAAA,IAAY,EAAE,qBAAqB,OAAO,MAAM,IAAI,CAAC;EAC5E;CACF;CAEF,IAAI,SAAS,UAAU;EACrB,IAAI,OAAO,YAAY,KAAA,GACrB,OAAO,0BAA0B,2DAA2D;EAE9F,OAAO;GACL,WAAW;GACX,SAAS,EACP,GAAI,OAAO,UAAU,KAAA,IAAY,EAAE,WAAW,OAAO,MAAM,IAAI,CAAC,EAClE;EACF;CACF;CACA,IAAI,OAAO,YAAY,KAAA,GAAW,OAAO,0BAA0B,4BAA4B;CAC/F,IAAI,OAAO,UAAU,KAAA,GAAW,OAAO,wBAAwB,4BAA4B;CAC3F,OAAO;EAAE,WAAW;EAAQ,SAAS,CAAC;CAAE;AAC1C;AAEA,SAAS,aAAa,OAAgB,SAAqC;CACzE,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,GACrD,MAAM,IAAI,YAAY,GAAG,QAAQ,yBAAyB;CAE5D,OAAO;AACT;AAEA,SAAS,YAAY,OAAgB,SAAqC;CACxE,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,OAAO,cAAc,KAAK,GAAG,MAAM,IAAI,YAAY,GAAG,QAAQ,wBAAwB;CAC3F,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAgB,SAAqC;CAC5E,MAAM,SAAS,YAAY,OAAO,OAAO;CACzC,IAAI,WAAW,KAAA,KAAa,SAAS,GACnC,MAAM,IAAI,YAAY,GAAG,QAAQ,kBAAkB;CAErD,OAAO;AACT;AAEA,SAAS,mBAAmB,OAAgB,SAAqC;CAC/E,MAAM,SAAS,YAAY,OAAO,OAAO;CACzC,IAAI,WAAW,KAAA,KAAa,SAAS,GACnC,MAAM,IAAI,YAAY,GAAG,QAAQ,qBAAqB;CAExD,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAgB,SAAsC;CAC7E,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,OAAO,UAAU,WAAW,MAAM,IAAI,YAAY,GAAG,QAAQ,iBAAiB;CAClF,OAAO;AACT;;;;;;AAOA,SAAgB,mBACd,OACA,SACM;CACN,IAAI,CAAC,WAAW,UAAU,KAAA,GAAW;CACrC,IAAI,CAAC,QAAQ,SAAS,KAAK,GACzB,MAAM,IAAI,YACR,SAAS,KAAK,UAAU,KAAK,EAAE,6BAA6B,KAAK,UAAU,CAAC,GAAG,OAAO,CAAC,GACzF;AAEJ;;;;;;;;AASA,SAAgB,2BACd,SACA,SACM;CACN,mBAAmB,QAAQ,OAAO,SAAS,OAAO;CAClD,mBAAmB,QAAQ,OAAO,OAAO,OAAO;CAChD,IAAI,QAAQ,OAAO,YAAY,eAAe;EAC5C,MAAM,QAAQ,QAAQ,MAAM,UAAU;EACtC,MAAM,SACJ,UAAU,QAAQ,OAAO,UAAU,WAC9B,MAAkC,OACnC,KAAA;EACN,KAAK,MAAM,SAAS,yBAAyB,MAAM,GAAG,mBAAmB,OAAO,OAAO;CACzF;CACA,KAAK,MAAM,YAAY,OAAO,OAAO,QAAQ,aAAa,CAAC,CAAC,GAC1D,mBAAmB,SAAS,OAAO,OAAO;CAE5C,KAAK,MAAM,QAAQ,OAAO,OAAO,QAAQ,SAAS,CAAC,CAAC,GAClD,mBAAmB,KAAK,OAAO,OAAO;AAE1C"}